Worker configuration

For agents: Discover current capabilities, preserve exact operation identities, and follow the native workflow.

Use a normal wrangler.jsonc package. Native apps do not require the legacy custom resource manifest.

{
  "name": "notes",
  "main": "worker.js",
  "compatibility_date": "2026-05-01",
  "d1_databases": [{ "binding": "DB", "database_name": "notes", "migrations_dir": "migrations" }],
  "r2_buckets": [{ "binding": "FILES", "bucket_name": "attachments" }],
  "assets": { "directory": "public", "binding": "ASSETS", "run_worker_first": true }
}

Logical resource names describe the requested binding. Userland resolves exact owned resource IDs separately for each environment. Do not insert a foreign Cloudflare account ID, resource ID or provider token to bypass ownership. Unsupported configuration returns an actionable error; arbitrary service bindings and management credentials are not exposed.

Secret requirements

Keep values out of configuration and source. An apply request can include typed requirements:

{
  "secret_requirements": [
    { "name": "SESSION_SECRET", "ensure": "generated", "bytes": 32 }
  ]
}

Generated values are stored outside the model-visible package. External values use a protected browser action. An ordinary redeploy preserves the current secret revision; rotation is a separate explicit effect. See Secrets.

Source and compilation

Submit complete source, dependency metadata, assets and migrations with apps_apply. Use hosted compilation only when the current context advertises it. Prebuilt JavaScript can skip that execution. Preserve source, configuration, migration, binding and executable identities returned by the operation; they describe different things.

A preview and production can have different resource bindings. A verified preview is not proof that production migrations or credentials work. Inspect and test the exact target after activation. See Resource migrations and the API reference.