Cursor rule: Workers runtime constraints

An auto-attached .mdc rule pinning workerd constraints: Web APIs only, no module-scope state, prepared statements, TTL'd KV writes.

---
description: Cloudflare Workers runtime constraints and binding usage
globs: src/**/*.ts
alwaysApply: false
---

# Workers runtime rules

- Target workerd, not Node: Web APIs only (`fetch`, `crypto.subtle`,
  `URLPattern`, Web Streams). A dependency that imports `fs` or `net` cannot
  ship here.
- Module scope is shared across requests on an isolate - never stash request
  or user data there. Derive everything from the request or bindings.
- Access bindings through the typed `Env`:

```ts
app.get("/items/:id", async (c) => {
  const row = await c.env.DB.prepare(
    "select id, name from items where id = ?1",
  ).bind(c.req.param("id")).first<Item>();
  return row ? c.json(row) : c.notFound();
});
```

- D1: prepared statements with bound params only; string interpolation into
  SQL fails review.
- KV: every `put` sets `expirationTtl`. Follow @src/lib/cache.ts for key
  naming and TTL tiers.
- After changing `wrangler.jsonc` bindings, regenerate types before writing
  code against them.

These examples are released under CC0. Use them freely, no attribution required. They are provided as is, without warranty of any kind: review and adapt them to your project before use, as you are responsible for the outcome of applying them.