Everything you need tobuild & scale

flowchart TB User((End User)) Dashboard[ArylHive Dashboard] API[ArylHive API Worker] subgraph Auth OAuth2[Google OAuth 2.0] JWT[JWT Session Manager] end subgraph Edge["Cloudflare Edge (300+ PoPs)"] Worker[CF Worker — Site Server] EdgeCache[Edge Cache Layer] end subgraph Storage Drive[Google Drive API v3] Turso[Turso DB — Previews Table] end User -- "1. Connect Drive" --> Dashboard Dashboard -- "2. OAuth2 Consent" --> OAuth2 OAuth2 -- "3. Access Token + Refresh Token" --> API API -- "4. Store Tokens (Encrypted)" --> Turso User -- "5. Visit site.aryl.app" --> Worker Worker -- "6. Lookup Route Metadata" --> Turso Worker -- "7. Check Edge Cache" --> EdgeCache Worker -- "8. Fetch via Drive API (OAuth2)" --> Drive Drive -- "9. Stream File Content" --> Worker Worker -- "10. Proxy Response + Cache" --> User

sequenceDiagram participant Visitor participant Worker as CF Worker (Edge) participant Cache as Edge Cache (Cloudflare) participant Turso as Turso DB participant Drive as Google Drive API v3 participant Collapse as Request Collapsing Map Visitor->>Worker: GET https://my-site.aryl.app/index.html Worker->>Turso: SELECT * FROM previews WHERE subdomain = 'my-site' Turso-->>Worker: Return provider='google-drive', folder_id, tokens Worker->>Cache: cache.match(request) alt Cache HIT Cache-->>Visitor: 200 OK (Cached Asset, 0 origin fetches) else Cache MISS Worker->>Collapse: Check pendingSiteRequests map alt Concurrent request in-flight Collapse-->>Worker: Re-use pending Promise else No pending request Worker->>Drive: GET file by path (OAuth2 Bearer Token) Drive-->>Worker: Raw byte stream (chunked) Worker->>Worker: Inject correct Content-Type via MIME detection Worker->>Worker: Set Cache-Control headers (24h static / 1h HTML) Worker->>Cache: cache.put (non-blocking) end Worker-->>Visitor: 200 OK (Proxied Stream) end

flowchart TB Dev((Developer)) GitHub[GitHub Repository] subgraph ArylHive["ArylHive Platform"] Dashboard[Dashboard UI] API[API Worker] BuildEngine[Build Engine — Hive Build Worker] end subgraph CI["Continuous Deployment"] Webhook[GitHub Webhook Listener] Builder[Build Runner — npm / Vite / Next.js] end subgraph Storage["Deployment Storage"] B2[Backblaze B2 — CAS Objects] Manifest[B2 — Deployment Manifests] Turso[Turso DB — Deployments Table] end subgraph Edge["Cloudflare Edge"] Worker[CF Worker — Site Server] EdgeCache[Edge Cache] end Dev -- "1. git push" --> GitHub GitHub -- "2. Webhook Event (push)" --> Webhook Webhook -- "3. Trigger Build" --> BuildEngine BuildEngine -- "4. Clone + npm install + build" --> Builder Builder -- "5. Upload CAS Chunks (deduplicated)" --> B2 Builder -- "6. Write Manifest (file→hash mapping)" --> Manifest Builder -- "7. Record Deployment" --> Turso Builder -- "8. Purge + Pre-warm Edge Cache" --> EdgeCache Dev -- "9. Visit site.aryl.app" --> Worker Worker -- "10. Resolve Deployment" --> Turso Worker -- "11. Fetch via Manifest → CAS" --> B2 Worker -- "12. Serve from Edge Cache" --> EdgeCache

sequenceDiagram participant Dev as Developer participant GH as GitHub participant Webhook as CF Worker (Webhook) participant DB as Turso DB participant Build as Hive Build Worker participant B2 as Backblaze B2 participant Cache as Edge Cache participant Visitor Dev->>GH: git push origin main GH->>Webhook: POST /api/github/webhook (push event) Webhook->>DB: Lookup linked project by installation_id + repo DB-->>Webhook: project_id, preview_id, build_command, output_dir Webhook->>Build: Dispatch async build job Build->>GH: Clone repository (GitHub Contents API) Build->>Build: npm install → npm run build Build->>Build: Hash each output file (SHA-256) Build->>B2: Upload only NEW chunks (deduplication) Build->>B2: Write manifest (cas:deployId.json) Build->>DB: INSERT deployment (status='success', folder_id='cas:...') Build->>Cache: Purge old edge cache entries Build->>Cache: Pre-warm critical paths (/index.html, /404.html) Visitor->>Cache: GET https://site.aryl.app/ alt Cache HIT Cache-->>Visitor: 200 OK (Edge-cached) else Cache MISS Cache->>B2: Fetch CAS object by hash B2-->>Cache: File content Cache-->>Visitor: 200 OK end

flowchart TB Visitor((Global Visitor)) subgraph Cloudflare["Cloudflare Anycast Network (300+ PoPs)"] DNS[Anycast DNS Resolution] Edge[Nearest Edge PoP] WAF[Web Application Firewall] DDoS[L3/4/7 DDoS Shield — 100+ Tbps] end subgraph Caching["Multi-Tier Cache"] L1Cache[L1 — Edge PoP RAM Cache] L2Cache[L2 — Regional Tier Cache] OriginShield[Origin Shield] end subgraph Origin["Origin Storage"] B2[Backblaze B2] R2[Cloudflare R2] Drive[Google Drive API] end subgraph TLS["TLS Termination"] ACME["Let's Encrypt ACME"] TLS13[TLS 1.3 + HTTP/3 QUIC] end Visitor -- "1. DNS Query" --> DNS DNS -- "2. Anycast → Nearest PoP" --> Edge Edge -- "3. DDoS + WAF Check" --> WAF WAF --> DDoS Edge -- "4. TLS Termination" --> TLS13 Edge -- "5. Check L1 Cache" --> L1Cache L1Cache -- "6. MISS → Regional Tier" --> L2Cache L2Cache -- "7. MISS → Origin Shield" --> OriginShield OriginShield -- "8. Fetch from Origin" --> B2 OriginShield -- "8. Fetch from Origin" --> R2 OriginShield -- "8. Proxy from Origin" --> Drive

sequenceDiagram participant Visitor participant DNS as Anycast DNS participant Edge as Nearest Edge PoP participant WAF as WAF + DDoS Shield participant Cache as Multi-Tier Cache participant Worker as CF Worker (V8 Isolate) participant Origin as Origin Storage (B2/R2/Drive) Visitor->>DNS: Resolve my-site.aryl.app DNS-->>Visitor: Anycast IP → nearest PoP (< 5ms) Visitor->>Edge: GET /assets/app.js (HTTP/3 QUIC) Edge->>WAF: Inspect request (Rules, Bot Score, IP Reputation) alt Malicious / DDoS WAF-->>Visitor: 403 Blocked (Challenge / CAPTCHA) else Clean Traffic WAF-->>Edge: Pass end Edge->>Cache: L1 PoP RAM Cache lookup alt L1 HIT Cache-->>Visitor: 200 OK (< 1ms TTFB) else L1 MISS Cache->>Cache: L2 Regional Tier lookup alt L2 HIT Cache-->>Visitor: 200 OK (< 5ms TTFB) else L2 MISS Cache->>Worker: Route to V8 Isolate (0ms cold start) Worker->>Origin: Fetch asset (S3-compatible / Drive API) Origin-->>Worker: Byte stream Worker->>Worker: Set Cache-Control, Content-Type, ETag Worker->>Cache: Store in L1 + L2 (non-blocking) Worker-->>Visitor: 200 OK (Streamed) end end

flowchart TB Request((Incoming Request)) subgraph EdgeSecurity["Edge Security Layer"] TLS[TLS 1.3 Termination] DDoS[DDoS Mitigation — 100+ Tbps] WAF[WAF Rules Engine] BotMgmt[Bot Management — ML Scoring] end subgraph Auth["Authentication & Authorization"] JWT[JWT Session Verification] OAuth[OAuth2 Provider Validation] CORS[CORS Origin Allowlist] RateLimit[Rate Limiting — Sliding Window] end subgraph DataSecurity["Data Security"] PasswordGate[Password Gate — bcrypt Hashed] EmailGate[Email Gate — Lead Capture] Expiry[Link Expiration — Unix Timestamp] Visibility[Visibility Control — Public / Private] end subgraph Isolation["Domain Isolation"] AppDomain["*.aryl.app — Site Deployments"] CloudDomain["*.aryl.cloud — Pages"] APIDomain["api.aryllabs.com — API Only"] end Request --> TLS TLS --> DDoS DDoS --> WAF WAF --> BotMgmt BotMgmt --> JWT JWT --> OAuth OAuth --> CORS CORS --> RateLimit RateLimit -- "Page Route" --> PasswordGate PasswordGate --> EmailGate EmailGate --> Expiry Expiry --> Visibility RateLimit -- "Domain Isolation" --> Isolation

sequenceDiagram participant Client participant Edge as CF Edge (TLS + DDoS) participant WAF as WAF + Bot Detection participant Worker as CF Worker participant Auth as Auth Engine participant Gate as Access Gates participant Resource as Protected Resource Client->>Edge: HTTPS Request (TLS 1.3 Handshake) Edge->>Edge: DDoS fingerprint check (L3/4/7) Edge->>WAF: Apply managed rulesets + custom rules WAF->>WAF: Bot score via ML model alt Bot Score < 30 (Likely Bot) WAF-->>Client: 403 + JS Challenge else Clean Request WAF-->>Worker: Pass to V8 Isolate end Worker->>Worker: Validate Origin header against CORS allowlist alt Origin not in allowlist Worker-->>Client: 403 CORS Rejected end Worker->>Auth: Check rate limit (sliding window per IP) alt Rate exceeded Auth-->>Client: 429 Too Many Requests end alt API Route (/api/*) Worker->>Auth: Extract + Verify JWT from cookie Auth->>Auth: Validate signature, expiry, claims alt Invalid JWT Auth-->>Client: 401 Unauthorized (Clear cookie) end end alt Share Route (*.aryl.cloud) Worker->>Gate: Check link expiration (expires_at vs NOW) alt Link Expired Gate-->>Client: 410 Gone end Worker->>Gate: Check password requirement alt Password Required Gate->>Gate: Validate share_pwd cookie alt No Valid Cookie Gate-->>Client: 200 Password Gate HTML end end Worker->>Gate: Check email requirement alt Email Required Gate->>Gate: Check share_email cookie alt No Cookie Gate-->>Client: 200 Email Capture Gate HTML end end end Worker->>Resource: Fetch protected resource Resource-->>Worker: Content Worker-->>Client: 200 OK

flowchart TB Request((Incoming Request)) subgraph V8["V8 Isolate Runtime"] Isolate[V8 Isolate — 0ms Cold Start] StreamAPI[Streams API — Chunked Transfer] WaitUntil["ctx.waitUntil() — Async Side-effects"] end subgraph Caching["Intelligent Cache Strategy"] EdgeCache[CF Edge Cache API] B2Cache["B2 Cache Layer (cache.match)"] MemoryCollapse[In-Memory Request Collapsing] end subgraph Optimization["Response Optimization"] MIME[MIME-Type Intelligence] Headers[Header Injection Engine] Compression[Brotli / Gzip Auto-Negotiation] end subgraph Analytics["Non-Blocking Analytics"] AE[CF Analytics Engine] ViewTrack[View Tracking — Fire-and-Forget] DurationTrack[Duration Tracking — JS Beacon] end subgraph Scheduled["Scheduled Maintenance"] CASGC[CAS Garbage Collection] GuestCleanup[Guest Link Cleanup] PackedGC[Packed Storage Compaction] end Request --> Isolate Isolate -- "Concurrent Safe" --> MemoryCollapse Isolate --> StreamAPI Isolate --> EdgeCache EdgeCache -- "MISS" --> B2Cache B2Cache -- "fetch + cache.put" --> EdgeCache StreamAPI --> MIME MIME --> Headers Headers --> Compression Isolate -.-> WaitUntil WaitUntil -.-> AE WaitUntil -.-> ViewTrack WaitUntil -.-> DurationTrack Isolate -.-> Scheduled

sequenceDiagram participant Client participant Isolate as V8 Isolate (0ms boot) participant Memory as In-Memory Collapse Map participant EdgeCache as Edge Cache API participant B2Cache as B2 Cache Layer participant Origin as Origin (B2 / Drive) participant AE as Analytics Engine Client->>Isolate: Incoming Request (0ms cold start) Isolate->>EdgeCache: cache.match(request URL) alt Edge Cache HIT EdgeCache-->>Client: 200 OK (instant, 0 DB queries, 0 KV reads) else Edge Cache MISS Isolate->>Isolate: Turso edge query (sub-ms latency) Isolate->>B2Cache: cache.match(b2-cache-url) alt B2 Cache HIT B2Cache-->>Isolate: Cached B2 Response else B2 Cache MISS Isolate->>Memory: pendingSiteRequests.has(key)? alt Concurrent Request In-Flight Memory-->>Isolate: Reuse existing Promise (0 extra origin calls) else First Request Memory->>Memory: pendingSiteRequests.set(key, promise) Isolate->>Origin: Fetch (Streams API — chunked) Origin-->>Isolate: ReadableStream Memory->>Memory: pendingSiteRequests.delete(key) end Isolate->>Isolate: MIME-type detection (extension + magic bytes) Isolate->>Isolate: Inject Cache-Control, ETag, Content-Type Isolate->>Isolate: Brotli / Gzip auto-negotiation Isolate->>EdgeCache: ctx.waitUntil(cache.put(...)) Isolate->>B2Cache: ctx.waitUntil(cache.put(...)) end Isolate-->>Client: 200 OK (Streamed Response) end Isolate-)AE: ctx.waitUntil(trackView(...)) — fire-and-forget