Services

2026 06 16 Skill Inventory

Cloudflare skill-guided implementation inventory — 2026-06-16

Scope: read-only inventory of Cloudflare-related implementation, configuration, and documentation surfaces in this repository. No Cloudflare APIs were called, no DNS was mutated, no deploys were run, and no secrets were printed or added.

Skill guidance applied#

Reviewed before inventory:

  • /home/vchavkov/.config/brain/notes/skills/cloudflare/INDEX.md
  • /home/vchavkov/.config/brain/.agents/skills/cloudflare-pages/SKILL.md
  • /home/vchavkov/.config/brain/.agents/skills/cloudflare-workers/SKILL.md
  • /home/vchavkov/.config/brain/.agents/skills/cloudflare-storage/SKILL.md
  • /home/vchavkov/.config/brain/.agents/skills/cloudflare-dns/SKILL.md
  • /home/vchavkov/.config/brain/.agents/_pi/skills/service-registry/SKILL.md

Operational constraints carried into this audit:

  • Prefer Wrangler for Pages/Workers deploy surfaces; use REST only where Wrangler lacks coverage.
  • Treat KV/D1/R2 as explicit storage bindings, with destructive operations and token scopes handled carefully.
  • For DNS/custom domains, coordinate Cloudflare-hosted zones with the Cloudflare DNS guidance and registry-owned svc.*/Linode/split-horizon hostnames with the Service Registry guidance.
  • Do not hardcode or expose Cloudflare tokens; use CLOUDFLARE_API_TOKEN / CF_API_TOKEN and account/zone IDs only through environment/configured deploy contexts.

Evidence commands#

Read-only discovery commands used:

bash
1
find . \( -path '*/node_modules/*' -o -path './.git/*' -o -path '*/.turbo/*' -o -path '*/.next/*' -o -path '*/.next-build/*' -o -path '*/.next-dev/*' -o -path '*/.open-next/*' -o -path '*/.wrangler/*' -o -path '*/dist/*' -o -path '*/out/*' -o -path '*/build/*' -o -path '*/coverage/*' -o -path './.worktrees/*' -o -path '*/content/courses/*' -o -path '*/content/learnings/*' -o -path '*/content/presentations/*' -o -path '*/_blog/*' \) -prune -o \( -iname '*wrangler*' -o -iname '*cloudflare*' -o -iname '*opennext*' \) -print | sort
2
3
rg -l -i "cloudflare|wrangler|opennext|pages\.dev|CF_|CLOUDFLARE|kv_namespaces|d1_databases|r2_buckets|@cloudflare|workers" \
4
  --glob '!**/node_modules/**' --glob '!.git/**' --glob '!**/.turbo/**' \
5
  --glob '!**/.next/**' --glob '!**/.next-build/**' --glob '!**/.next-dev/**' \
6
  --glob '!**/.open-next/**' --glob '!**/.wrangler/**' --glob '!**/dist/**' \
7
  --glob '!**/out/**' --glob '!**/build/**' --glob '!**/coverage/**' \
8
  --glob '!**/content/courses/**' --glob '!**/content/learnings/**' --glob '!**/content/presentations/**' \
9
  --glob '!**/_blog/**' --glob '!**/public/img/**' --glob '!**/public/images/**' \
10
  --glob '!**/spec/**' | sort
11
12
find . \( -path '*/node_modules/*' -o -path './.git/*' -o -path '*/.turbo/*' -o -path '*/.next/*' -o -path '*/.next-build/*' -o -path '*/.next-dev/*' -o -path '*/.open-next/*' -o -path '*/.wrangler/*' -o -path './.worktrees/*' \) -prune -o -name 'wrangler.*' -print | sort

Generated/local artifacts intentionally excluded from the inventory include node_modules/, .next*/, .open-next/, .wrangler/, dist/, out/, build/, coverage/, .turbo/, and .worktrees/. Course/blog content hits were also excluded where they were educational content rather than repo implementation or operator surfaces.

Primary deploy/config inventory#

PathPurpose / evidenceApplies skill guidance
.mise.tomlCanonical repo task surface. Defines cf:build*, cf:deploy*, cf:release*, cf:health, cf:index:search, and deploy preflight. The preflight requires CLOUDFLARE_API_TOKEN and documents minimum Account token capabilities for Workers Scripts, Workers KV Storage, and Pages.Cloudflare Pages, Workers, Storage; token hygiene from Cloudflare index.
package.jsonRoot scripts include perf:cf-budgets; dev dependency pins wrangler; pnpm patch metadata includes wrangler@4.78.0.Workers/Pages Wrangler-first guidance; dependency hygiene.
turbo.jsonDeclares Cloudflare-relevant env passthrough (CLOUDFLARE-adjacent app envs, OPEN_NEXT, SEARCH_PROVIDER, RESEND_*) and build outputs used by Pages/OpenNext builds.Pages/Workers build reproducibility; secret/env hygiene.
.github/workflows/cd.ymlTag-based CI deploys only www and manager to Cloudflare Pages with CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID secrets. Worker/OpenNext deploys are not in this workflow.Cloudflare Pages; least-privilege CI token handling.
patches/wrangler@4.78.0.patchPatch for Wrangler's bundled punycode imports. Supports the root pinned Wrangler CLI.Wrangler operational surface for Pages/Workers/Storage tasks.

App deployment surfaces#

PathPurpose / evidenceApplies skill guidance
apps/www/wrangler.tomlCloudflare Pages project assistance-www, output .next-build, compatibility date, service bindings to assistance-blog and assistance-docs, and notes for Pages secrets (RESEND_API_KEY, email vars).Cloudflare Pages for static deploy; Workers service bindings; Pages secrets guidance.
apps/www/package.jsonStatic Next build scripts; cf:build:www in .mise.toml sets NEXT_DIST_DIR=.next-build before pnpm --filter www build.Cloudflare Pages build/deploy workflow.
apps/www/next.config.mjsNext static export (output: 'export'), .next-build dist override support, and asset CDN prefix logic for Cloudflare-fronted static assets.Pages static output; cache/CDN awareness.
apps/www/functions/blog/[[path]].tsPages Function proxies /blog/* to BLOG_WORKER service binding.Cloudflare Pages Functions + Workers service binding guidance.
apps/www/functions/docs/[[path]].tsPages Function proxies /docs/* to DOCS_WORKER service binding.Cloudflare Pages Functions + Workers service binding guidance.
apps/www/public/_headersPages header rules for production vs preview domains and static asset cache headers.Cloudflare Pages _headers; cache and noindex safety.
apps/www/public/_redirectsPages redirect file; notes that /docs and /blog are served by separate Workers/routing.Pages redirects; Workers route coordination.
apps/manager/wrangler.tomlCloudflare Pages project assistance-manager, Vite build output build.Cloudflare Pages static/SPAs.
apps/manager/package.jsonVite build/preview scripts used by cf:build:manager and cf:deploy:manager.Cloudflare Pages deploy output workflow.
apps/docs/wrangler.jsoncCloudflare Worker assistance-docs, OpenNext worker entry, nodejs_compat, Workers Assets binding, explicit www.assistance.bg/docs* and assistance.bg/docs* routes, KV incremental cache binding, D1 SEARCH_DB binding, and SEARCH_PROVIDER=d1.Cloudflare Workers routing/assets; Storage KV and D1 bindings; DNS/route coordination.
apps/docs/open-next.config.tsUses @opennextjs/cloudflare and KV incremental cache override.Workers + OpenNext; KV incremental cache guidance.
apps/docs/package.jsonbuild:cf runs production-flavored Next build then opennextjs-cloudflare build --skipNextBuild.Workers/OpenNext build guidance.
apps/docs/next.config.mjsUses Redis cache handler outside OpenNext, switches behavior when OPEN_NEXT is set, emits Cloudflare-oriented CDN-Cache-Control headers through shared helper, and blocks preview domains in headers.Workers runtime compatibility; Cloudflare cache header guidance.
apps/docs/public/_headersHeaders/cache rules for docs paths and preview noindex behavior.Pages/Workers static assets and indexing safety; cache guidance.
apps/blog/wrangler.jsoncCloudflare Worker assistance-blog, OpenNext worker entry, nodejs_compat, Workers Assets binding, KV incremental cache binding.Workers/OpenNext; KV binding guidance.
apps/blog/open-next.config.tsOpenNext KV incremental cache config plus cloudflare.useWorkerdCondition=false workaround documented in .docs/developer.md.Workers/OpenNext compatibility guidance.
apps/blog/package.jsonbuild:cf sets OPEN_NEXT=1 and runs opennextjs-cloudflare build --skipNextBuild.Workers/OpenNext build guidance.
apps/blog/next.config.mjsbasePath: '/blog', OpenNext-specific exclusion of @vercel/og, output tracing excludes for .next-build/.open-next.Workers runtime/bundle-size compatibility guidance.
apps/blog/public/_headersProduction/preview indexing and static asset cache headers for /blog.Cache/noindex safety for Cloudflare-hosted app.
apps/academy/wrangler.jsoncCloudflare Worker assistance-academy, OpenNext worker entry, nodejs_compat, Workers Assets binding. No KV binding present in inspected config.Workers/OpenNext; note Storage skill if KV is added later.
apps/academy/open-next.config.tsConfigures OpenNext with KV incremental cache override, despite current Wrangler config not exposing a KV namespace.Workers/OpenNext and Storage KV guidance; review consistency before deploy.
apps/academy/package.jsonbuild:cf runs content build, Next build, then OpenNext Cloudflare build. Also depends on @cloudflare/stream-react.Workers/OpenNext build guidance; Cloudflare product dependency.
apps/academy/public/_headersProduction/preview indexing rules, static asset cache headers, and noindex for dashboard/certificates.Cache/noindex safety.
apps/design-system/wrangler.jsoncCloudflare Worker assistance-design-system, OpenNext worker entry, Workers Assets, KV incremental cache binding.Workers/OpenNext; KV binding guidance.
apps/design-system/open-next.config.tsOpenNext KV incremental cache override.Workers/OpenNext; Storage KV guidance.
apps/design-system/package.jsonbuild:cf runs content and registry generation before OpenNext build.Workers/OpenNext build guidance.
apps/design-system/next.config.mjsOPEN_NEXT disables non-edge Redis cache handler; emits Cloudflare cache headers via shared helper.Workers runtime compatibility; cache guidance.
apps/design-system/public/_headersProduction/preview indexing and static asset cache headers.Cache/noindex safety.
apps/ui-library/wrangler.jsoncCloudflare Worker assistance-ui-library, OpenNext worker entry, Workers Assets, KV incremental cache binding.Workers/OpenNext; KV binding guidance.
apps/ui-library/open-next.config.tsOpenNext KV incremental cache override.Workers/OpenNext; Storage KV guidance.
apps/ui-library/package.jsonbuild:cf runs content, registry, LLMS generation, Next build, then OpenNext build.Workers/OpenNext build guidance.
apps/ui-library/next.config.mjsOPEN_NEXT toggles cache behavior and aliases @vercel/og away for Workers; emits Cloudflare cache headers.Workers runtime/bundle-size compatibility; cache guidance.
apps/ui-library/public/_headersProduction/preview indexing and static asset cache headers, including /r/* registry assets.Cache/noindex safety.

Storage/search surfaces#

PathPurpose / evidenceApplies skill guidance
tools/d1-search/index-d1.tsGenerates SQL for the D1 docs search database and prints the Wrangler D1 execute command.Cloudflare Storage — D1 lifecycle and Wrangler D1 operations.
.mise.toml (cf:index:search)Runs D1 search SQL generation and wrangler d1 execute assistance-search --file=tools/d1-search/index-data.sql.Cloudflare Storage — D1 execution; token/account readiness.
apps/docs/lib/d1-search.tsRuntime docs search client expects a D1 binding named SEARCH_DB.Cloudflare Storage — D1 binding consumed by Worker runtime.
apps/docs/lib/search/cloudflare.tsClient wrapper for a Cloudflare-backed search endpoint using endpoint/key env vars.Token/secret hygiene from Cloudflare index; Worker/API integration guidance.
backend/internal/infra/search/cloudflare.goBackend search provider talks to Cloudflare REST using CF_ACCOUNT_ID, CF_SEARCH_INDEX_ID, and CF_SEARCH_API_TOKEN; no tokens are hardcoded.Cloudflare API/token safety; keep credentials in environment.
backend/internal/infra/search/factory.goSelects Cloudflare search provider when configured.Cloudflare API integration surface.
apps/docs/.env.exampleDocuments optional Cloudflare search public endpoint/key placeholders and SEARCH_PROVIDER modes without real values.Secret hygiene; Pages/Workers env guidance.
backend/.env.exampleDocuments Cloudflare search env var names as commented placeholders, no real values.Secret hygiene; least-privilege token guidance.
.env.exampleDocuments root Resend vars referenced by Cloudflare Pages forms/secrets.Pages secrets/environment guidance.

Cache/performance/quality surfaces#

PathPurpose / evidenceApplies skill guidance
packages/config/cache-headers.mjsShared helper emits Cache-Control plus CDN-Cache-Control for Cloudflare edge cache ownership.Cloudflare cache behavior guidance.
packages/config/next-cache-handler.mjsRedis-backed Next cache used when not running in OpenNext; app configs avoid it for OPEN_NEXT.Workers runtime compatibility; avoid non-edge dependencies in Worker builds.
tools/cloudflare-artifact-budgets.jsonLists Cloudflare output directories and MiB budgets for Pages and OpenNext apps.Workers/Pages deploy artifact size risk management.
tools/cloudflare-artifact-budgets.schema.jsonSchema for the Cloudflare budget config.Budget config validation.
tools/scripts/check-cloudflare-artifact-budgets.mjsRead-only budget gate inspecting already-built Pages/OpenNext outputs.Workers bundle/asset-size safety.
docs/cloudflare-artifact-budgets.mdOperator docs for running the artifact budget gate.Workers/Pages verification guidance.
tools/scripts/verify-m003-s04-build.shFocused academy Cloudflare build verifier split into Contentlayer, Next, and OpenNext stages.Workers/OpenNext build troubleshooting.

Documentation surfaces#

PathPurpose / evidenceApplies skill guidance
.docs/developer.mdCurrent mise task catalog including Cloudflare build/deploy/index/release commands and a blog OpenNext follow-up note.Pages/Workers operator workflow.
.docs/cloudflare-deployment.mdMain Cloudflare deployment documentation: Pages vs Workers topology, build/deploy commands, DNS, TLS, cache rules, and D1 search.Pages, Workers, Storage, DNS, Service Registry.
.docs/cloudflare-hosting-options-2026-06-16.mdRecent assessment recommending Pages for www/manager, Workers+OpenNext for SSR apps, selective KV/D1/R2, and registry coordination for DNS.All Cloudflare skill-pack areas plus Service Registry.
docs/hosting-inventory-2026-06-16.mdExisting deployment inventory that confirms app-to-target mapping and CF operator commands.Pages/Workers/Storage inventory.
docs/cloudflare-performance-*.md, docs/performance-audit-2026-06-16.mdPerformance reviews around Cloudflare-hosted surfaces, artifact budgets, and bottlenecks.Workers/Pages runtime verification and cache guidance.
docs/search-console-fixes-deployment.md, .docs/adr/001-search-console-indexing-fixes.mdSearch indexing/noindex deployment guidance for Pages/Workers preview domains and routes.Pages _headers, Workers routes, DNS/custom-domain coordination.
docs/migrations/2026-04-05-learn-to-academy.mdHistorical academy/learn migration notes, including older Cloudflare Workers KV setup concerns.Workers/OpenNext and Storage KV guidance; treat as historical context.
docs/superpowers/specs/2026-03-20-caddy-gateway-exposure-design.mdDescribes Cloudflare-managed assistance.bg and Caddy/gateway exposure relationships.Cloudflare DNS plus Service Registry/Caddy split-horizon guidance.
docs/superpowers/specs/2026-04-05-managed-infra-backend-10yr-roadmap.mdNotes frontends on Cloudflare Pages/Workers and possible future Cloudflare/Linode DNS/edge considerations.DNS/Service Registry and future platform planning.

DNS and registry-relevant findings#

  • apps/docs/wrangler.jsonc is the only inspected app config with explicit Worker routes under assistance.bg; future route changes should follow Cloudflare Workers routing guidance and coordinate with DNS/custom-domain ownership.
  • .docs/cloudflare-deployment.md states www.assistance.bg is production Cloudflare DNS, while dev/prod subzones are delegated to Linode and should be managed through the registry MCP/API.
  • Service Registry skill guidance applies whenever new svc.assistance.bg, svc.chavkov.com, split-horizon, Caddy, or registry-owned DNS/Caddy exposure work is proposed. This audit did not call the registry API.
  • Cloudflare DNS skill guidance applies to Cloudflare-hosted public records: resolve zone IDs by name, use idempotent upserts, dry-run/confirm before mutation, and avoid hardcoded zone IDs in operator snippets.

Not included as implementation surfaces#

  • Generated outputs: .open-next/, .wrangler/, .next*, app build/, dist/, and out/ directories.
  • Installed dependencies under node_modules/, including nested Wrangler/OpenNext packages.
  • Course lessons, blog articles, and image/icon references that mention Cloudflare as educational/product content rather than deployment/configuration implementation.
  • Private runtime state or account details; no Cloudflare account/resource queries were made.