JeffLin.dev Runtime Architecture Diagram

A visit to /stats renders in the Worker; SSR calls its own /api/stats with the shared token
Read endpoints return the KV payload as-is and never query Analytics Engine or GitHub on the request path
Freshness is carried by updatedAt inside the payload, not by cache expiry
The client re-uses the same endpoints over SPA navigation, and filters repos locally with Fuse.js

*/10 * * * * recomputes stats; 0 * * * * re-syncs repos, matched by exact cron string
Stats are six Analytics SQL queries issued in parallel, weighted by SUM(_sample_interval)
Both KV keys are written with no expiry, so a failed run simply leaves the previous payload in place
Cron errors are logged and swallowed on purpose; the next tick retries

x-internal-token lives in runtimeConfig.public, so it ships in the SSR payload: a speed bump against bots, not a secret
visitorSalt, cfAccountId and cfAnalyticsToken stay server-only; leaking the salt would let IPv4 addresses be brute-forced back out
KV and Analytics Engine are reached by in-account binding; the SQL API is credentialed HTTPS egress to a third party
The scheduled invocation carries no HTTP request, so it passes no token gate and must read credentials from the hook env, not useRuntimeConfig()

Raw IP is used only to derive a daily-rotating SHA-256 visitor hash, then leaves scope unstored
Referrer is reduced to a hostname so visitors' internal URLs never land in the dataset
Bots and empty user agents are dropped before any write; /stats excludes itself
The endpoint always answers 204, so a stats failure can never break browsing

Cold start: if a KV key is empty, the read endpoint synchronously fills it once, then cron takes over
POST /api/cron/sync-repos is a manual escape hatch for forcing a repo re-sync
The Analytics SQL API reads the same jxlin_pageviews dataset the binding writes to
Route rules add SWR 3600 on /github/** in production and CORS limited to https://jxlin.dev
In dev the beacon returns early, auth skips when no token is set, and missing credentials yield an empty stats payload