Local dev vs Cloudflare Pages — how URLs reach code and static files.
Route catalog SSOT: lib/http/public-routes.ts mirrors buildPublicRoutes() in scripts/serve-public.ts. Update both when adding portal or API paths.
Domain SSOT: config/r2-env.ts · tenant docs/harness/tenants/cloudflare-pages.md
| Surface | Domain(s) | Artifact tree |
|---|---|---|
| Portal + registry proofs | project-r-score.pages.dev, score.factory-wager.com |
public/ + functions/ |
| npm/R2 registry | registry.factory-wager.com |
Worker + R2 (not Pages portal) |
| Reasonix UI | reasonix.factory-wager.com |
Cloudflare Tunnel → local :8787 |
| Local dev | http://127.0.0.1:<port> |
serve-public.ts + functions-bun-only/ |
Port resolution: lib/http/bun-serve-shape.ts — --port → BUN_PORT → PORT → NODE_PORT → 3000.
public/)public/portal/*public/registry/*public/_redirects (301 only — no SPA /* → index.html)public/_headersfunctions/ — deployed to Pages)Edge-safe only (no bun:sqlite). Key handlers:
| Path | Module |
|---|---|
/api/operations/summary |
functions/api/operations/summary.ts → snapshot JSON |
/api/registry/* |
functions/api/registry/[[path]].ts → R2 binding |
/api/health, /api/env, /api/monitoring |
functions/api/*.ts |
/health (JSON) · /health/pre (plain) |
functions/health/index.ts · functions/health/pre.ts → portal-health-edge.ts (no functions/health.ts file — CF rejects file+dir same name) |
Full inventory: docs/harness/tenants/cloudflare-pages.md.
functions-bun-only/ + serve-public.ts fetch)serve-public.tsfunctions-bun-only/README.mdREGISTRY_SECRET is setLocal serve-public protects most paths via Bearer auth. Public read plane (matches Pages static deploy):
/portal/* — HTML, CSS, JS, modules/registry/* — proof JSON consumed by ops dashboard/api/monitoring, /api/registry, /api/operations/summary, … (see publicReadPaths in serve-public.ts)Publish remains auth-gated.
| Concern | Command |
|---|---|
| Local portal + styles | bun run verify:portal · override PORTAL_VERIFY_BASE |
| Live Pages edge | PAGES_VERIFY_BASE=https://project-r-score.pages.dev bun run verify:pages-edge |
| Route catalog | bun run check:routes |
| Routing proof | bun run routing:proof |
| Proof taxonomy | bun run verify:proof-taxonomy:save |
| Ops snapshot | bun run ops:snapshot |
| Cloudflare pins | bun run cloudflare:env |
/portal/ops/ → operations-dashboard.js fetches:
/api/operations/summary (SQLite)public/registry/ops-summary.json/registry/*.json including proof-taxonomy-audit.jsonproofTaxonomy slice (contracts/consistency/hash); dashboard uses slice first, full audit JSON for the contract tabletoc slice from /registry/toc-ops.json (TOC rollup card → /portal/toc/)Regenerate: bun run ops:snapshot (writes summary + taxonomy audit + routing proofs + TOC bake).
/portal/toc/ → toc-dashboard.js fetches:
/registry/toc-ops.json (baked fixture) or GET /api/toc (same ASSETS on Pages)/api/toc/* → 503 (mutations stay in toc-ops-repo ct)Routes: lib/http/public-routes.ts · tenant docs/harness/tenants/toc-ops.md · portal foundation § TOC Ops board.
HTTP MCP servers in .mcp.json: cloudflare, cloudflare-docs, cloudflare-bindings, cloudflare-builds, cloudflare-observability. Token: CLOUDFLARE_API_TOKEN (~/.reasonix/.env). Scope probe: bun run cloudflare:env:validate. Discovery: /.well-known/mcp.json on Pages. See AGENTS.md and docs/harness/tenants/cloudflare-pages.md.
Note: cloudflare-builds is Workers Builds CI — not Cloudflare Pages deploy history. Use cloudflare execute for Pages API (/accounts/{id}/pages/projects/...).
TOC Ops is not an MCP server. MCP is platform deploy/inspect only. Partner desk (Soft Balance, rails, MessageLog, phones, package bot) lives in toc-ops-repo Central Tool; Pages serves the baked fixture under /registry/toc-ops.json.