Make Yourself to Science agent-ready on Cloudflare Workers

[jnton]

Summary

Adds a hardened, read-only agent API and migrates the full-stack Next.js deployment from the archived Cloudflare Pages adapter to OpenNext on Cloudflare Workers.

Agent capabilities

• Search API at /api/resources
• Stable UUID/slug lookup at /api/resources/{id}
• Facet discovery at /api/facets
• Dataset health at /api/health
• Agent discovery at /.well-known/agent-card.json
• Generated OpenAPI and LLM-readable artifacts
• Canonical remote MCP discovery at https://mcp.yourselftoscience.org/mcp

Workers migration

• Worker name: yourselftoscience-web
• Node.js 22.23.1
• Next.js 15.5.22
• React and React DOM 19.2.8
• @opennextjs/cloudflare 1.20.2
• Wrangler 4.114.0
• OpenNext static-assets cache with no R2, D1, KV, Durable Objects, or Queues
• Removed @cloudflare/next-on-pages and obsolete direct Vercel build dependencies
• Removed all route-level Edge Runtime declarations
• Added wrangler.jsonc, open-next.config.ts, Workers scripts, static-asset headers, and local-secret templates

Integrated security controls

• Strict single-value query parsing and bounded inputs
• Strict integer ranges, enums, and boolean parsing
• Tri-state boolean filtering
• URL-safe bounded resource identifiers
• Generic public errors with detailed failures kept server-side
• Dataset, in-flight request, and normalized-search caching
• Fail-closed generation and validation of AI/agent artifacts
• Fixed-destination bounded Umami proxies
• 64 KiB analytics-event limit and strict JSON media type
• Self-hosted Next image optimization disabled
• Middleware redirects marked private, no-store and varied on x-nextjs-data
• Patched direct and transitive runtime/build dependencies
• Read-only permanent GitHub Actions validation

Final repository verification

Permanent workflow run 30865201782 passed on the final migration configuration:

• locked dependency installation: passed
• migration invariants: passed
• 13 regression tests: passed
• OpenAPI and agent-artifact validation: passed
• Next.js and OpenNext production build: passed
• Wrangler Free-plan dry run: passed
• compressed Worker size: 1677.25 KiB (below the Free-plan 3072 KiB limit)
• runtime dependency audit: 0 findings
• full dependency audit: 0 findings

Deployment state

The repository migration is complete, but the Worker has not yet been created in the Cloudflare account or tested through a live Workers preview. Keep this PR in draft and unmerged until:

1. yourselftoscience-web is created from this GitHub branch;
2. runtime secrets are configured;
3. the Workers preview passes the documented API, forms, analytics, redirects, static assets, agent-card, OpenAPI, and MCP smoke tests;
4. the custom domains are cut over from Pages without capturing mcp.yourselftoscience.org;
5. production verification passes.

The existing Pages project should remain available as a rollback target until the Worker cutover is proven. Detailed instructions are in docs/cloudflare-agent-api-security.md; deployment completion remains tracked in issue #36.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cloudflare-workers-and-pages]

Deploying yourselftoscience-org with    Cloudflare Pages

Latest commit:	61cabea
Status:	🚫  Build failed.

View logs

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[jnton]

OpenNext migration completed in repository

Repository-side work is complete and PR #35 has been returned to draft.

Final validation on workflow run 30865201782:

• 13 regression tests passed
• OpenAPI and agent artifacts regenerated and validated
• Next.js/OpenNext production build passed
• Wrangler dry run passed
• compressed Worker size: 1677.25 KiB (Workers Free limit: 3072 KiB)
• runtime audit: 0 findings
• full dependency audit: 0 findings
• permanent CI is read-only and now blocks high/critical runtime and build dependency findings

No one-shot migration or remediation workflow remains on the branch.

The only remaining blocker is live Cloudflare deployment. Create yourselftoscience-web from this branch, configure runtime secrets, run the documented Workers preview smoke tests, and complete the custom-domain cutover before marking this PR ready or merging it. Keep the existing Pages project as rollback until production verification passes.