# Worker configuration

> Wrangler configuration and typed deployment requirements.

- Canonical page: https://docs.userland.fun/reference/resource-manifest/
- Docs index for agents: https://docs.userland.fun/llms.txt

> **For agents:** Discover current capabilities, preserve exact operation identities, and follow the native workflow.

Use a normal `wrangler.jsonc` package. Native apps do not require the legacy custom resource manifest.

```json
{
  "name": "notes",
  "main": "worker.js",
  "compatibility_date": "2026-05-01",
  "d1_databases": [{ "binding": "DB", "database_name": "notes", "migrations_dir": "migrations" }],
  "r2_buckets": [{ "binding": "FILES", "bucket_name": "attachments" }],
  "assets": { "directory": "public", "binding": "ASSETS", "run_worker_first": true }
}
```

Logical resource names describe the requested binding. Userland resolves exact owned resource IDs separately for each environment. Do not insert a foreign Cloudflare account ID, resource ID or provider token to bypass ownership. Unsupported configuration returns an actionable error; arbitrary service bindings and management credentials are not exposed.

## Secret requirements

Keep values out of configuration and source. An apply request can include typed requirements:

```json
{
  "secret_requirements": [
    { "name": "SESSION_SECRET", "ensure": "generated", "bytes": 32 }
  ]
}
```

Generated values are stored outside the model-visible package. External values use a protected browser action. An ordinary redeploy preserves the current secret revision; rotation is a separate explicit effect. See [Secrets](/guides/secrets/).

## Source and compilation

Submit complete source, dependency metadata, assets and migrations with `apps_apply`. Use hosted compilation only when the current context advertises it. Prebuilt JavaScript can skip that execution. Preserve source, configuration, migration, binding and executable identities returned by the operation; they describe different things.

A preview and production can have different resource bindings. A verified preview is not proof that production migrations or credentials work. Inspect and test the exact target after activation. See [Resource migrations](/guides/resource-migrations/) and the [API reference](/reference/api/).