Update to Cloudflare

{
  "name": "workers-best-practices",
  "description": "Reviews and authors Cloudflare Workers code against production best practices. Load when writing new Workers, reviewing Worker code, configuring wrangler.jsonc, or checking for common Workers anti-patterns (streaming, floating promises, global state, secrets, bindings, observability). Biases towards retrieval from Cloudflare docs over pre-trained knowledge.",
  "included_files": [
    {
      "relative_path": "references/review.md",
      "size_in_bytes": 8145
    },
    {
      "relative_path": "references/rules.md",
      "size_in_bytes": 16483
    }
  ],
  "skill_md_contents": "---\nname: workers-best-practices\ndescription: Reviews and authors Cloudflare Workers code against production best practices. Load when writing new Workers, reviewing Worker code, configuring wrangler.jsonc, or checking for common Workers anti-patterns (streaming, floating promises, global state, secrets, bindings, observability). Biases towards retrieval from Cloudflare docs over pre-trained knowledge.\n---\n\nYour knowledge of Cloudflare Workers APIs, types, and configuration may be outdated. **Prefer retrieval over pre-training** for any Workers code task — writing or reviewing.\n\n## Retrieval Sources\n\nFetch the **latest** versions before writing or reviewing Workers code. Do not rely on baked-in knowledge for API signatures, config fields, or binding shapes.\n\n| Source | How to retrieve | Use for |\n|--------|----------------|---------|\n| Workers best practices | Fetch `https://developers.cloudflare.com/workers/best-practices/workers-best-practices/` | Canonical rules, patterns, anti-patterns |\n| Workers types | See `references/review.md` for retrieval steps | API signatures, handler types, binding types |\n| Wrangler config schema | `node_modules/wrangler/config-schema.json` | Config fields, binding shapes, allowed values |\n| Cloudflare docs | Search tool or `https://developers.cloudflare.com/workers/` | API reference, compatibility dates/flags |\n\n## FIRST: Fetch Latest References\n\nBefore reviewing or writing Workers code, retrieve the current best practices page and relevant type definitions. If the project's `node_modules` has an older version, **prefer the latest published version**.\n\n```bash\n# Fetch latest workers types\nmkdir -p /tmp/workers-types-latest && \\\n  npm pack @cloudflare/workers-types --pack-destination /tmp/workers-types-latest && \\\n  tar -xzf /tmp/workers-types-latest/cloudflare-workers-types-*.tgz -C /tmp/workers-types-latest\n# Types at /tmp/workers-types-latest/package/index.d.ts\n```\n\n## Reference Documentation\n\n- `references/rules.md` — all best practice rules with code examples and anti-patterns\n- `references/review.md` — type validation, config validation, binding access patterns, review process\n\n## Rules Quick Reference\n\n### Configuration\n\n| Rule | Summary |\n|------|---------|\n| Compatibility date | Set `compatibility_date` to today on new projects; update periodically on existing ones |\n| nodejs_compat | Enable the `nodejs_compat` flag — many libraries depend on Node.js built-ins |\n| wrangler types | Run `wrangler types` to generate `Env` — never hand-write binding interfaces |\n| Secrets | Use `wrangler secret put`, never hardcode secrets in config or source |\n| wrangler.jsonc | Use JSONC config for non-secret settings — newer features are JSON-only |\n\n### Request & Response Handling\n\n| Rule | Summary |\n|------|---------|\n| Streaming | Stream large/unknown payloads — never `await response.text()` on unbounded data |\n| waitUntil | Use `ctx.waitUntil()` for post-response work; do not destructure `ctx` |\n\n### Architecture\n\n| Rule | Summary |\n|------|---------|\n| Bindings over REST | Use in-process bindings (KV, R2, D1, Queues) — not the Cloudflare REST API |\n| Queues & Workflows | Move async/background work off the critical path |\n| Service bindings | Use service bindings for Worker-to-Worker calls — not public HTTP |\n| Hyperdrive | Always use Hyperdrive for external PostgreSQL/MySQL connections |\n\n### Observability\n\n| Rule | Summary |\n|------|---------|\n| Logs & Traces | Enable `observability` in config with `head_sampling_rate`; use structured JSON logging |\n\n### Code Patterns\n\n| Rule | Summary |\n|------|---------|\n| No global request state | Never store request-scoped data in module-level variables |\n| Floating promises | Every Promise must be `await`ed, `return`ed, `void`ed, or passed to `ctx.waitUntil()` |\n\n### Security\n\n| Rule | Summary |\n|------|---------|\n| Web Crypto | Use `crypto.randomUUID()` / `crypto.getRandomValues()` — never `Math.random()` for security |\n| No passThroughOnException | Use explicit try/catch with structured error responses |\n\n## Anti-Patterns to Flag\n\n| Anti-pattern | Why it matters |\n|-------------|----------------|\n| `await response.text()` on unbounded data | Memory exhaustion — 128 MB limit |\n| Hardcoded secrets in source or config | Credential leak via version control |\n| `Math.random()` for tokens/IDs | Predictable, not cryptographically secure |\n| Bare `fetch()` without `await` or `waitUntil` | Floating promise — dropped result, swallowed error |\n| Module-level mutable variables for request state | Cross-request data leaks, stale state, I/O errors |\n| Cloudflare REST API from inside a Worker | Unnecessary network hop, auth overhead, added latency |\n| `ctx.passThroughOnException()` as error handling | Hides bugs, makes debugging impossible |\n| Hand-written `Env` interface | Drifts from actual wrangler config bindings |\n| Direct string comparison for secret values | Timing side-channel — use `crypto.subtle.timingSafeEqual` |\n| Destructuring `ctx` (`const { waitUntil } = ctx`) | Loses `this` binding — throws \"Illegal invocation\" at runtime |\n| `any` on `Env` or handler params | Defeats type safety for all binding access |\n| `as unknown as T` double-cast | Hides real type incompatibilities — fix the design |\n| `implements` on platform base classes (instead of `extends`) | Legacy — loses `this.ctx`, `this.env`. Applies to DurableObject, WorkerEntrypoint, Workflow |\n| `env.X` inside platform base class | Should be `this.env.X` in classes extending DurableObject, WorkerEntrypoint, etc. |\n\n## Review Workflow\n\n1. **Retrieve** — fetch latest best practices page, workers types, and wrangler schema\n2. **Read full files** — not just diffs; context matters for binding access patterns\n3. **Check types** — binding access, handler signatures, no `any`, no unsafe casts (see `references/review.md`)\n4. **Check config** — compatibility_date, nodejs_compat, observability, secrets, binding-code consistency\n5. **Check patterns** — streaming, floating promises, global state, serialization boundaries\n6. **Check security** — crypto usage, secret handling, timing-safe comparisons, error handling\n7. **Validate with tools** — `npx tsc --noEmit`, lint for `no-floating-promises`\n8. **Reference rules** — see `references/rules.md` for each rule's correct pattern\n\n## Scope\n\nThis skill covers Workers-specific best practices and code review. For related topics:\n\n- **Durable Objects**: load the `durable-objects` skill\n- **Workflows**: see [Rules of Workflows](https://developers.cloudflare.com/workflows/build/rules-of-workflows/)\n- **Wrangler CLI commands**: load the `wrangler` skill\n\n## Principles\n\n- **Be certain.** Retrieve before flagging. If unsure about an API, config field, or pattern, fetch the docs first.\n- **Provide evidence.** Reference line numbers, tool output, or docs links.\n- **Focus on what developers will copy.** Workers code in examples and docs gets pasted into production.\n- **Correctness over completeness.** A concise example that works beats a comprehensive one with errors.\n"
}