byCaliber Infra Tree 09-09-2026 — verified live
Drag the boxes to reorganise. Arrows stay connected. Positions are saved in your browser.
The two Cloudflare Pages projects are the core of the system (white outline): bycaliber serves the public site, bycaliber-tools serves this admin surface behind Cloudflare Access. Colours = category. Dashed lines = monitoring or indirect link.
Double-click a box to rename it. Use + Add independent node to drop in custom nodes, then drag them anywhere.
Read back on 09/09/2026 from the Cloudflare API, not declared: Workers and their schedules, Pages projects and their bindings, D1 tables, R2, KV, zones and public DNS.
What each box is
One line per box of the tree above, in plain words. The small text under each name is what the box does for this business.
| Box | Type | What it is |
|---|---|---|
| Brevo magic-link mail · pending | Email · pending | Brevo, the transactional email service of this business: the magic-link login mails and the client mails. |
| Resend worker alerts + reports | Resend, the transactional email service: one-off mails sent by code (magic links, alerts, reports). | |
| Google Workspace MX · SPF · DKIM · DMARC | Google Workspace, the mailboxes of the business (the MX, SPF, DKIM and DMARC records in DNS point to it). | |
| Cloudflare DNS zone bycaliber.work | Network | The Cloudflare DNS zone of the domain: the records that say where the site, the mail and the subdomains live. |
| Cloudflare D1 bycaliber · 11 tables | Storage | Cloudflare D1, the SQL database of this business, shared by the public site, the intranet and the backup worker. One table per kind of record (contacts, events, bookings…). |
| R2 · user-toolkit client documents | Storage | Cloudflare R2 bucket (file storage, like a Dropbox folder) holding the documents shared with clients through their toolkit page. |
| R2 · backups dumps + archives | Storage | Cloudflare R2 bucket where the backup worker drops the nightly database dumps and the monthly archives. |
| bycaliber-backup-worker 8 crons | Automation | A Cloudflare Worker (a script that runs in the cloud on a timer): the nightly backup and every other scheduled robot of this business, listed on /crons. |
| Cloudflare Access eo-team SSO · AL only | Auth | Cloudflare Access, the login wall in front of the intranets and the admin routes: only the eo-team emails get in, Claude uses a service token. |
| Pages · bycaliber bycaliber.work · public | Core | The public website, hosted on Cloudflare Pages: the pages visitors see, plus the small server functions behind its forms. |
| Pages · bycaliber-tools tools.bycaliber.work · admin | Core | This intranet, hosted on Cloudflare Pages: the admin pages and the /api routes they call, behind Cloudflare Access. |
| Cal.com career-move | Booking | Cal.com, the booking page prospects use to book a call; its webhook writes each booking in D1. |
| GitHub 4 private repos | Operator | GitHub, where every repository of the business lives; the Mac pushes there after each deploy (rule 14). |
| Terminal (macOS) operator CLI | Operator | The Terminal on AL's Mac, where Claude Code and the deploy chains run. |
| Wrangler (CF CLI) deploy · D1 · secrets | Operator | Wrangler, the Cloudflare command-line tool used from the Terminal to deploy, run database migrations and set secrets. |
| Finder · ~/Projects local repos on the Mac | Operator | The Finder folder ~/Projects on AL's Mac, one sub-folder per repository: the working copy of the code before it is pushed to GitHub and deployed. |
| Claude Code agent in the Terminal | Operator | Claude Code, the agent running in that Terminal: it reads and writes the files of ~/Projects and runs the deploy chains, with AL's own accounts on this Mac. |
| Shell CLIs gh · op · ffmpeg · codex… | Operator | Any command-line tool installed on the Mac. Claude Code can call one the way a human types it in the shell: there is no integration behind it, the tool runs under the account it is already signed into on this machine. |
| 1Password secrets vault · pending | Operator · pending | 1Password, the planned vault for the secrets that today live in a file on the Mac; not in service yet. |
What Claude Code can reach from the shell — the field of possibilities
Claude Code works inside the Terminal on the Mac. Anything AL can type in that Terminal, it can run: a deploy, a git command, a database migration, or any other command-line tool installed on the machine.
This is not an integration. Calling another vendor's CLI does not connect Claude to that vendor. The binary runs locally under the account it is already signed into on this Mac, and Claude only reads what the command prints.
Measured on the Mac, 11/09/2026. On the PATH: git, gh (signed in as alexandrecorne), wrangler, op (1Password), node, npx, python3, ffmpeg, whisper-cli, rtk, claude. Off the PATH but callable by its full path: /Applications/ChatGPT.app/Contents/Resources/codex, the ChatGPT app's own CLI, which answers with AL's ChatGPT account.
Two limits. A tool that is not installed cannot be called, and the Claude Code permission layer can refuse a command (it blocks some of them, wrangler d1 among others, and each refusal is reported).
The types, in one line each
| Core | The two Cloudflare Pages projects everything else plugs into: the public site and this intranet. |
| Storage | Where data and files live (databases, buckets). |
| Auth | Who is allowed in, and how bots are kept out. |
| Network | Domains, DNS, redirects, monitoring: the plumbing between the internet and the sites. |
| Everything that sends or receives mail, and the tools that watch mail reputation. | |
| Payment | Services that take money and tell the site about it. |
| Booking | Calendars and appointment pages. |
| Automation | Robots that run on a schedule without anyone clicking. |
| Operator | The tools AL and Claude use from the Mac to build and deploy. |
| Not wired | Services used by hand or by a script, with no live link to the sites. |
| Independent | Boxes added by hand on this diagram, not read from the account. |
| Pending | Planned, not in service yet. |
The 7 branches of the trunk
Each branch groups services by function. The trunk is the pair of Cloudflare Pages projects. Both projects read and write the same D1 database, which is why a schema change is never a single-repo decision.
Storage branch
Cloudflare D1 bycaliber ↔ both Pages projects (11 live tables, densest link)
R2 bycaliber-user-toolkit ← both projects (client documents, binding USER_TOOLKIT)
R2 bycaliber-backups ← backup worker only (D1 dumps + event archives)
Auth branch
Cloudflare Access → bycaliber-tools (app "byCaliber Tools — AL only" on the shared eo-team team, gates every route, measured 302 on 09/09/2026)
Defense in depth: functions/_middleware.js re-checks the Access JWT against ADMIN_EMAIL on /api/admin/*
Magic link → public site (D1 tables magic_link_tokens + pending_logins, no third-party identity provider). The mail leg is not in service: see the email branch.
Network branch
Cloudflare DNS, zone bycaliber.work → routes both Pages projects. The Pages API lists no www domain.
Mail records (public DNS, 09/09/2026): MX on Google, SPF v=spf1 include:_spf.google.com ~all, DKIM google._domainkey, DMARC p=quarantine with reports to al@eliteoutsiders.com, MTA-STS id=20260830000000
No Brevo DKIM: no brevo1._domainkey CNAME on the zone, consistent with the pending Brevo domain validation.
Shared: mta-sts.bycaliber.work is served by the cross-brand Worker mta-sts-policy, documented on the EO infra tree.
Email branch
Brevo ← public site (magic-link mail, functions/api/_lib/brevo.js). pending The Pages project carries no BREVO_API_KEY on the API and the domain is not validated: production sign-in mail cannot go out.
Resend ← bycaliber-backup-worker (secret RESEND_API_KEY, alert and report mail, incl. the monthly unused-pages report)
Google Workspace ← DNS (mailboxes on bycaliber.work, MX on Google)
Booking branch
Cal.com ← public site, /call links to cal.com/alexandrecorne/career-move (event-type id 5471203)
No Cal.com webhook is wired: /bookings on this intranet has no data source yet. The daily slot watcher on this event runs on another brand's worker (see the EO infra tree).
Automation branch
bycaliber-backup-worker → D1 + R2 (8 cron triggers on the schedules API, incl. 0 6 1 * * unused-pages added 09/09/2026)
bycaliber-cron-purge: Worker absent from the account on 09/09/2026 (deleted 28/08/2026, repo kept). The backup worker is the only scheduled writer on D1.
Standalone Worker, not a Pages Function.
Operator branch
Terminal (macOS) → Wrangler (deploy, D1 queries, Pages secrets)
Terminal → GitHub (git push/pull on 4 private repos)
Wrangler → both Pages projects + D1. It is the only write path to production.
1Password ··· Terminal (secrets vault, pending CLI installed, account registered, integration not verified)
Quick read — who's connected to whom
5 services touch the code directly: D1 (read/write from both projects), R2 user-toolkit (uploads and client reads), Cloudflare Access (gates tools), Cloudflare DNS (routes), Brevo (magic-link API, key absent in production).
4 peripheral services: R2 backups (downstream of the backup worker), bycaliber-backup-worker (the one scheduled writer on D1), Resend (the worker's outgoing mail), Google Workspace (mailboxes on the zone). Cal.com is reached by a link, not by code.
3 operator tools: Terminal (macOS) drives Wrangler and GitHub. It is the human control layer — if Terminal breaks, no more deploys and no more admin work, but the live sites keep serving.
D1 is the silent hub: 3 pieces of code write to it (public site Functions, tools Functions, backup worker). A schema change touches all three. There is no staging copy — bycaliber is the only database.
DNS is the second silent hub: Pages routing, Access and Google Workspace mail all resolve through the same zone. Break the zone and mail plus hosting fail together.
Cloudflare inventory
Read live from the Cloudflare API on 09/09/2026, not declared: Workers, schedules, Pages, D1 sqlite_master, R2, KV, zones.
Pages projects (2)
- bycaliber
- bycaliber.pages.dev · bycaliber.work (no www on the Pages API) · last deploy 07/09/2026
- bindings: DB → d1
bycaliber, USER_TOOLKIT → r2bycaliber-user-toolkit - secrets:
AUTH_SECRETonly (noBREVO_API_KEYon the API) - 10 Functions endpoints under
/api(auth, events, healthz, me, toolkit)
- bycaliber-tools
- bycaliber-tools.pages.dev · tools.bycaliber.work · last deploy 09/09/2026
- bindings: DB → d1
bycaliber, USER_TOOLKIT → r2bycaliber-user-toolkit - secrets:
ADMIN_EMAIL,CF_WORKERS_READ_TOKEN - 9 Functions endpoints (7 under
/api/adminbehind CF Access, plus/api/visitand/api/visits)
D1 databases (1)
- bycaliber
- id
363071d8-189c-4c75-b7d3-3ceb4d24e364· created 04/05/2026 - 11 live tables on 09/09/2026, shared by site + tools + backup worker
- analytics:
events,error_events,analytics_snapshots - auth:
magic_link_tokens,pending_logins - contacts:
contacts,toolkit_resources - crawl:
page_inventory,button_inventory - intranet usage:
tools_pages,tools_visits(unused-pages report)
- id
R2 buckets (2)
- bycaliber-backups · created 04/05/2026
- private, reached only through the worker binding
BACKUP_BUCKET - prefix
YYYY-MM/d1-bycaliber-DATE.sql(monthly D1 dump) - prefix
events-archive/YYYY-MM/(monthly events archive)
- private, reached only through the worker binding
- bycaliber-user-toolkit · created 23/05/2026
- bound as
USER_TOOLKITon both Pages projects - client documents uploaded from the admin, served through
/api/me/toolkit
- bound as
Workers (1)
- bycaliber-backup-worker
- 8 crons on the schedules API:
0 2 1 * *events archive ·0 3 1 * *D1 backup ·0 4 1 * *URL audit ·0 4 * * 1page-flow crawl ·0 5 1 1,7 *analytics-map refresh ·0 6 * * *error watchdog ·0 6 1 * *unused-pages (added 09/09/2026) ·0 8 * * 1weekly snapshot - bindings: DB (bycaliber), BACKUP_BUCKET (bycaliber-backups) · vars BRAND, NOTIFY_FROM, NOTIFY_TO, SITE_HOST, TOOLS_HOST
- secret on the settings API:
RESEND_API_KEY(alert and report mail) - 9 endpoints:
/run,/backup/last-run,/admin/events-archive-now,/admin/url-audit-now,/admin/page-flow-crawl-now,/admin/error-events-watchdog-now,/admin/weekly-snapshot-now,/admin/analytics-map-refresh-now,/admin/unused-pages-now - default domain bycaliber-backup-worker.alexandre-corne-ac.workers.dev
- 8 crons on the schedules API:
- bycaliber-cron-purge: absent from
/workers/scriptson 09/09/2026 (deleted 28/08/2026, repo kept, script copy in~/Projects/_deleted-workers-backup-2026-08-28/)
KV namespaces (0)
- none for byCaliber
- no byCaliber
wrangler.tomldeclares a KV binding — cron run history is not persisted yet
- no byCaliber
Domains
- Custom domains (2)
- bycaliber.work → Pages project bycaliber
- tools.bycaliber.work → Pages project bycaliber-tools, CF Access gated (302 measured)
- Platform domains (3)
- bycaliber.pages.dev · bycaliber-tools.pages.dev
- bycaliber-backup-worker.alexandre-corne-ac.workers.dev
- Zone (1)
- bycaliber.work, active · MX Google · SPF, DKIM, DMARC, MTA-STS records above
mta-sts.bycaliber.work→ shared Worker mta-sts-policy, listed on the EO infra tree
Nothing orphan on this brand: the one Worker on the account is the backup worker, and the deleted purge worker left only its repo. Secrets shared by the four brands (the eo-team Access team, the local secrets file, the quarterly rotation routine) are described on the EO infra tree.
The two repos
| Repo | Serves | Gate | Contents |
|---|---|---|---|
| bycaliber-site | bycaliber.work — the public bilingual FR/EN site | Public. Magic-link login on /account only (mail leg pending) |
13 pages in public/, 10 Functions endpoints, 5 D1 migrations, smoke test script |
| bycaliber-tools | tools.bycaliber.work — the admin surface, this page included | Cloudflare Access SSO (team eo-team, app "byCaliber Tools — AL only") + ADMIN_EMAIL check on the API |
39 pages in the inventory, 9 endpoints, 3 D1 migrations |
| bycaliber-backup-worker | Scheduled jobs against D1 and R2 | Worker default domain, admin endpoints behind a shared secret | 8 job modules, 8 crons |
| bycaliber-cron-purge | Nothing: the Worker was deleted on 28/08/2026 | n/a | Single module, repo kept on GitHub (last commit 27/08/2026) |
All four repos are private on GitHub under alexandrecorne/, verified with git remote -v on 09/09/2026. The site and tools repos both bind the same D1 and the same R2 toolkit bucket — that coupling is deliberate and it is the main reason a migration has to be run once and smoke-tested twice.
Tool pages on tools.bycaliber.work (39)
One line per page, from public/pages.json (rewritten by scripts/pages-inventory.js at every deploy). "Live" means the page is in the inventory and serves; the State column was not audited page by page.
| Page | What it is | State |
|---|---|---|
| /index | Home. The hub that links every page below. | Hub |
| /alllinks | All links — manual index of every page on tools.bycaliber.work | Live |
| /analytics-map | Analytics map | Live |
| /architecture | Architecture | Live |
| /bookings | Bookings | Live |
| /cal-questionnaires | Cal questionnaires — Caliber Tools | Live |
| /click-analytics | Click analytics | Live |
| /clients | Clients | Live |
| /clients-detail | Client detail | Live |
| /content-system | Content system | Live |
| /coredata | Core data | Live |
| /crons | Scheduled tasks | Live |
| /data | Data | Live |
| /direction-2026 | Direction 2026 | Live |
| /email-deliverability | Email deliverability | Live |
| /email-system | Email system | Live |
| /entre-deux | Six in-betweens | Live |
| /health | Health | Live |
| /heatmap | Heatmap | Live |
| /homepage-variants | Homepage variants, byCaliber | Live |
| /infra-tree | Infra tree. This page. | This page |
| /lf-cross-platform-content | LF cross-platform content | Live |
| /lf-cross-platform-content-doc | LF cross-platform doc | Live |
| /logo-candidates | Logo candidates, byCaliber | Live |
| /maison | Neutral typefaces | Live |
| /mercury | The Mercury register | Live |
| /notion-vs-tools | Notion vs Tools | Live |
| /og-preview | OG preview | Live |
| /page-flow | Page flow | Live |
| /palette-candidates | Palette candidates | Live |
| /preview-clients-detail | Preview · client detail | Live |
| /public-site-deploy-process | Deploy process | Live |
| /purchases | Purchases | Live |
| /scenes | Three scenes | Live |
| /signature | Gmail signatures | Live |
| /sources/email | Email sources | Live |
| /sources/external | External sources | Live |
| /videos | Videos | Live |
| /weekly-business-steering | Weekly steering | Live |
39 pages in the inventory on 09/09/2026, this hub included. Live/placeholder was not audited page by page on this rebuild: mark placeholders here when they are found.
External services wired
| Service | Category | Role | If it breaks... |
|---|---|---|---|
| Cloudflare Pages | Cloudflare | Hosts bycaliber.work and tools.bycaliber.work | Everything goes dark — public site and admin at once |
| Cloudflare D1 | Storage | Single shared SQL database, 11 tables | Login, contacts, analytics and crons all fail together |
| Cloudflare R2 | Storage | Client documents (user-toolkit) and monthly backups | Toolkit downloads break; backups stop accumulating |
| Cloudflare Access | Auth | SSO gate on tools.bycaliber.work, team eo-team (shared across the four intranets) |
No access to the admin surface at all |
| Cloudflare DNS | Network | Zone bycaliber.work — routing plus every mail record | Cascade: hosting, Access and mail fail in the same minute |
| Brevo | Magic-link sign-in mail. pending no API key on the Pages project, domain not validated | Nothing more than today: nobody can sign in to /account until the key and the domain are in place | |
| Resend | Worker alert and report mail (RESEND_API_KEY on the backup worker) |
Watchdog alerts and the unused-pages report go silent | |
| Google Workspace | Mailboxes on bycaliber.work. MX on Google, SPF include:_spf.google.com, DKIM google._domainkey, DMARC p=quarantine |
Outbound mail stops and inbound replies bounce | |
| Cal.com | Booking | Event career-move (id 5471203), linked from /call. No webhook |
No calls can be booked from the site |
| GitHub | Operator | 4 private repos (site, tools, backup worker, cron purge repo without its worker) | No versioning or history; the live sites keep serving |
| Wrangler (CF CLI) | Operator | Deploys both Pages projects, queries D1, manages secrets | No deploys and no manual DB work |
| 1Password | Operator | Secrets vault: logins and API keys. pending CLI installed, account registered in the CLI on 09/09/2026, integration not verified. See the section below | Nothing today, it holds no live secret. Once activated, no op read means falling back to the local secrets file |
Secrets vault · 1Password pending
Status on 09/09/2026: not in service. The CLI is installed on AL's Mac (op 2.39.0, via Homebrew, binary at /opt/homebrew/bin/op). op account list now returns one account, so the account exists; the CLI integration was not verified. Nothing in this tree reads a secret from it today. This block records a decision that is taken, not a service that is running.
Role. Secrets vault: the place that holds the logins and the API keys.
What it replaces…
What it replaces. Today the secrets sit in clear text in one local file on the Mac, ~/.config/eo/secrets.env, with dated copies beside it. That single file is the current point of truth for all four brands, byCaliber included. The eo in the path is historic, like the shared eo-team Access team, not a brand boundary. 1Password does not remove that file yet: it doubles it first, then replaces it.
What changes once the CLI integration is on. A secret is read with op read at the moment it is needed, and its value never has to transit in clear text through a file.
Rotation. Shared routine, documented on the EO infra tree: the quarterly rotation of API keys is a Claude Code scheduled task on AL's Mac (eo-rotate-api-secrets-quarterly, next run 01/10/2026), not a Cloudflare cron, which is why it carries no card on /crons.
Plan, and the two moments it changes.
| Plan | Price | Trigger |
|---|---|---|
| Individual | about 3 USD per month | The starting point. One operator, one vault. |
| Families | about 5 USD per month, up to 5 people | The day Ali, AL's associate, needs shared access. |
| Teams Starter | about 20 USD per month, flat | The day a key owned by a client enters the vault. Holding a third party's secrets inside a family plan does not hold up. |
Next action, on AL: create the account, then activate the CLI integration. Nothing here changes state until both are done.
Redirects
| From | To | Code | Why |
|---|---|---|---|
| /index-en.html · /index-en | / | 301 | EN is the default at root. Kept so old external links survive. |
| /coaching · /work | /workwithalex | 301 | Rule inherited from the Elite Outsiders port; workwithalex.html does not exist in bycaliber-site/public/. |
| /product · /produit | /manifesto | 301 | Inherited from the EO port; no manifesto.html in this repo. |
| /trigger-map · /me/trauma-maps · /trauma-map/* | /trauma-map | 301 · 200 | Inherited from the EO port; no trauma-map.html in this repo. |
| tools.bycaliber.work/* | eo-team Access login | 302 | Every route of this intranet without a session. Measured 302 on 09/09/2026. |
All rules live in bycaliber-site/public/_redirects; bycaliber-tools/public/_redirects is empty. The five EO-inherited rules point at pages this site does not ship: worth pruning, AL's call.
Links to the full documentation
→ Notion: Claude Code HQ — universal patterns · rules shared across all four verticals
→ /architecture · the long-form system map · → /crons · the automation surface · → /health · live counters
For Claude
Template. Since 09/09/2026 this page follows the byForja /infra-tree template (rule 15, Intranet structure): same markup, same CSS, same diagram engine as tools.byforja.com/infra-tree, byCaliber data only. Edit the data (nodes, edges, inventory, repos, notes), never the engine; an engine change is made on the byForja page first and copied to the four.
Audit of 09/09/2026, read back from the Cloudflare API, not declared. Workers from /accounts/{id}/workers/scripts with /schedules and /settings, Pages projects and their production bindings from /pages/projects/{name}, D1 tables from a sqlite_master query, R2 and KV from their list endpoints, public DNS with dig. HTTP codes measured with curl --max-redirs 0.
What changed on this rebuild. The page gained the diagram, the branches, the quick read, the repo table, the tool-pages table, the external services table and the redirects table it did not have. Facts corrected from the API: the Pages project bycaliber carries one secret (AUTH_SECRET), BREVO_API_KEY is absent, which is why the magic link is drawn dashed; bycaliber-tools carries ADMIN_EMAIL and CF_WORKERS_READ_TOKEN; the backup worker exposes 9 endpoints, not 5. Shared items (mta-sts-policy, the eo-team Access team, the quarterly rotation routine) are documented on the EO infra tree and referenced here by one line each.
Not read back. The Brevo domain validation state (no API call made). The tool-pages table comes from public/pages.json; the State column was not audited page by page.