Manifest reference
Every field of appflare.jsonc, generated from the catalog manifest JSON Schema.
Each app in the catalog is described by one file, apps/<slug>/appflare.jsonc.
This page lists every field the catalog accepts. It is generated from the
manifest's JSON Schema each time the docs are built. The catalog checks every
manifest against the same schema when an app is packed and refuses a field it
does not know, so a misspelled field is an error, never silently dropped.
Start the file with the schema URL so your editor can check it as you type:
{
"$schema": "https://appflare.github.io/catalog/schema/v1.json"
}Bindings, compatibility settings, static assets, Durable Object migrations, and cron triggers are not listed here. The packer reads them from the app's own wrangler config at the pinned commit. See Submit an app for a worked example.
Top-level fields
| Field | Type | Required | Details |
|---|---|---|---|
$schema | string (URL) | no | Set it to https://appflare.github.io/catalog/schema/v1.json for editor checks. |
slug | string | yes | The entry's permanent id, in lowercase letters, digits and hyphens, for example open-seo. It is also the entry's folder in the catalog, the first part of its release tags (<slug>@<version>) and the Worker name the install form suggests. It never changes once the entry is published. Must match ^[a-z0-9][a-z0-9-]{0,62}$. |
name | string | yes | The app's name as the catalog and the manager show it, for example Open SEO. Must not be empty. |
summary | string | yes | What the app does and who it is for, in a few plain sentences, shown on the app's page (a blank line starts a new paragraph). The catalog search reads it too. Must not be empty. |
tagline | string | yes | What the app does, as one plain sentence of at most 80 characters, without a trailing period, such as "Short links on your own domain". Shown under the app's name on catalog tiles. Length 1 to 80. |
features | array of strings | no | What the app does for the person who installs it, as 3 to 6 plain lines of at most 100 characters each, without a trailing period, such as "Share short links that open your long ones". Written for people who are not developers, from the upstream project's own description, each line saying something different. Shown on the app's page. Leave it out to list none. Each length 1 to 100. |
alternativeTo | array of strings | no | The well-known products or services the app can replace, as 1 to 5 names of at most 40 characters each, such as "Google Analytics" or "Plausible". Names only, no URLs. Shown on the app's page. Leave it out to list none. Each length 1 to 40. |
homepage | string | no | The app's website, as an https:// URL. Defaults to its repository on GitHub. Must match ^https:\/\/. |
repo | string | yes | The public GitHub repository the app is built from, as owner/repo. The source pin, builds and version bumps always use this repository. Also shown as the app's source code link unless upstreamRepo names its main project. Must match ^[^/\s]+\/[^/\s]+$. |
upstreamRepo | string | no | The app's main public GitHub repository, as owner/repo, when repo is a deployment template or a fork. Used for source code links, GitHub stars, and the default homepage and authors. Builds, source pins and version bumps still use repo. Must match ^[^/\s]+\/[^/\s]+$. |
license | string | yes | The license the app's own repository declares, as an SPDX license expression of current SPDX ids: MIT, Apache-2.0, GPL-3.0-only, MIT OR Apache-2.0, or a source-available license such as BUSL-1.1, FSL-1.1-MIT or Elastic-2.0. Deprecated ids such as GPL-3.0 are refused: write -only or -or-later, as the project's license notice says. For a license without an SPDX id, write LicenseRef-<name> and describe it in licenseNote; write NONE when the repository publishes no license. The catalog shows the license on the app's card and page; it never decides whether an app is listed. Must not be empty. |
licenseNote | string | no | One short line shown next to the license, for what its id does not say, such as "Source-available: production use restricted; see the license". An app with a note is shown as source-available. Length 1 to 160; must match ^\S(?:[^\r\n]*\S)?$. |
categories | array, each one of "ai", "analytics", "bots", "business", "chat", "cms", "community", "developer-tools", "ecommerce", "education", "email", "family", "files", "finance", "games", "marketing", "media", "monitoring", "networking", "notes", "notifications", "passwords", "privacy", "productivity", "remote-access", "scheduling", "security", "sharing", "sync", "utilities" | yes | One to 3 categories the catalog lists the app under, each once: ai (AI), analytics (Analytics), bots (Bots), business (Business), chat (Chat), cms (Websites and blogs), community (Community), developer-tools (Developer tools), ecommerce (E-commerce), education (Education), email (Email), family (Family), files (Files), finance (Finance), games (Games), marketing (Marketing), media (Media), monitoring (Monitoring), networking (Networking), notes (Notes), notifications (Notifications), passwords (Passwords), privacy (Privacy), productivity (Productivity), remote-access (Remote access), scheduling (Scheduling), security (Security), sharing (Sharing), sync (Sync), utilities (Utilities). |
authors | array of objects | no | Who wrote the app upstream: one or more people or organizations, shown on the catalog card and the app's page. Not the people who package it for the catalog (those are maintainers). When omitted, the catalog lists the owner of upstreamRepo, or repo when no upstream repository is set. |
maintainers | array of strings | no (default []) | The GitHub usernames, without @, of the people who package the app for the catalog and look after this entry, shown as "Packaged by". Not the app's own authors (those are authors). Each must not be empty. |
source | object | yes | The exact upstream commit the version is built from. The bump bot edits it. |
install | object | yes | How the packer builds the app and what the manager calls it. |
plan | "free" or "paid" | yes | The Cloudflare Workers plan the app needs: "free" when it runs on Workers Free, "paid" when it needs Workers Paid. An entry with Pipelines must say "paid". |
requires | array, each one of "r2", "zone", "email-routing", "workers-ai", "browser-rendering", "containers", "analytics-engine", "access", "secret-keys", "service-props", "config-patch-values", "email-worker", "email-placeholders", "hyperdrive-caching" | no (default []) | Account capabilities the app needs beyond the free Workers baseline. "access": the app goes with Cloudflare Access. The account needs a Zero Trust organization only while the app is protected (always, with access.mode: "required"), and the value keeps the entry away from managers too old to protect apps. Required with access.mode: "required" and whenever a var's default uses an Access placeholder. Some values name a feature of Appflare instead, which keeps the entry away from managers too old for it: "secret-keys" (a secret with a key), "service-props" (props on a service binding), "config-patch-values" (a config patch that sets var text or adds Workers AI), "email-worker" (install.emailRouting.worker), "email-placeholders" ({{emailDomain}} or {{emailZoneId}} anywhere, or any placeholder in an object key of a JSON var or of service binding props) and "hyperdrive-caching" (caching on a Hyperdrive binding). |
secrets | array of objects | no (default []) | Secrets the install form asks for. |
vars | array of objects | no (default []) | Settings the install form asks for. Each reaches the Worker as a variable: text, or JSON when the wrangler config gives it a value that is not a string. |
postInstall | array of objects | no (default []) | Instructions shown after a successful install, in order. |
tokenPermissions | array of objects | no (default []) | The permissions of the Cloudflare API token the admin creates for the app itself (never Appflare's own). The secret that takes the token sets cloudflareToken: true. |
resources | object | no | Settings for resources that the wrangler config cannot describe. |
bump | object | no (default {"autoMerge":false}) | How the catalog's bump bot treats this entry when its upstream moves. Left out, an artifact tier entry's bumps merge themselves once their checks pass. |
revision | integer | no (default 1) | Which edit of this entry's form and copy the catalog publishes for the build its source already released, starting at 1 (the default when omitted). Raise it by one to publish a change to name, summary, homepage, upstreamRepo, license, categories, maintainers, secrets, vars, postInstall, bump, access or openPath, or to add "access" to requires, without moving source: the released artifact stays as it is, and managers show the new form without an update. tagline, features, alternativeTo, licenseNote and authors need no revision while the entry has never published one: the catalog shows them from the current manifest. A published revision is signed with the whole manifest and never changes, so on an entry that has one, an edit to any of them needs a higher revision too. Anything else needs a new build, so move source instead. From 1 to 1000000. |
access | object | no | How the app goes with Cloudflare Access, which Appflare can put in front of any installed app so that only the manager's users reach it (and Appflare's own health checks, with a service token of the app's own). Without this block protection is offered at install, switched off. An app that verifies Access's sign-in itself reads the {{accessTeamDomain}}, {{accessTeamName}}, {{accessAud}} and {{accessCertsUrl}} placeholders from a var. Not for the self-deploying tier. |
openPath | string | no | Where the manager's Open buttons take people in the app, as a path on its address, for an app whose interface is not at its root, for example /dashboard. It starts with /, has no query or fragment, no empty, . or .. segments, and holds letters, digits and - . _ ~ @ : + = , only, at most 128 characters; it may end in /. Omitted means the root. Health checks, {{appUrl}} and the addresses the manager lists stay the root, so a postInstall note links to the path itself ({{appUrl}}/dashboard). A manager from before this field opens the root. Length at most 128; must match ^(?:/(?!\.\.?(?:/|$))[A-Za-z0-9._~@:+=,-]+)+/?$. |
authors[]
Each entry of authors has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The author's name as shown in the catalog, for example Ben Senescu. Length 1 to 100. |
url | string | no | The author's website, as an https:// URL. Must match ^https:\/\/. |
github | string | no | The author's GitHub username or organization, without @. Must match ^(?=.{1,39}$)[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*$. |
x | string | no | The author's X (Twitter) handle, without @. Must match ^[A-Za-z0-9_]{1,15}$. |
source
Fields of source.
| Field | Type | Required | Details |
|---|---|---|---|
ref | string | yes | The tag or branch of the app's repository this entry is built from, for example v1.4.2 or main. A tag that is a semver version is also the version the catalog shows. The catalog's bump bot moves it when upstream publishes a new release. Must not be empty. |
sha | string | yes | The commit the entry is built from, as its full 40-character SHA in lower case: the commit ref pointed at when the entry was last updated. The build always uses this commit, so a moved tag or a new commit on the branch changes nothing until sha does. Must match ^[0-9a-f]{40}$. |
version | string | no | The version shown for this entry when the repository's tag does not describe this app (monorepos); it must change whenever sha moves. Omitted, the version comes from ref when it is a semver tag, else from the pinned commit's date and SHA. Must match ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$. |
install
Fields of install.
| Field | Type | Required | Details |
|---|---|---|---|
tier | one of "artifact", "sandbox", "self-deploying" | no (default "artifact") | How the app is built: "artifact" (the default: a signed release catalog CI builds), "sandbox" (built from the pinned commit in the account's sandbox Worker) or "self-deploying" (the app's own installer, run in the sandbox Worker). |
packageManager | one of "pnpm", "npm", "yarn", "bun" | yes | The package manager used to install the app's dependencies. |
wranglerConfig | string | yes | The wrangler config to build from, relative to the repository root, for example wrangler.jsonc. A config the repository keeps only as a template (wrangler.toml.example, wrangler.jsonc.template) is copied to its real name (wrangler.toml) before it is read. Must not be empty. |
workerName | string | no | The Worker name the install form suggests; the admin may change it unless fixedWorkerName is set. Defaults to the entry's slug. Must not be empty. |
fixedWorkerName | boolean | no (default false) | The app only works under workerName (for example, it hard-codes its own hostname), so it installs at most once per account. |
health | object | no (default {"path":"/","mode":"no-server-errors"}) | How the manager checks that the app serves after an install, update or rollback. |
buildCommand | string, or array | no | The command the packer runs at the root of the checkout after installing dependencies (with install scripts disabled) and before bundling, for example pnpm --filter @scope/web build, or a list of such commands run in order, for example ["pnpm run build:sphere", "pnpm run build"]; the build stops at the first that fails. Use it when the wrangler config has no build.command. Each runs as a plain command without a shell, with no credentials in its environment and the checkout's node_modules/.bin on its PATH, so pipes, redirects, quotes, variables, and environment assignments are not allowed. pnpm and npm run no pre or post hooks of package scripts there (pnpm run build skips prebuild), so list such a step as a command of its own. At most 8 commands of at most 256 characters each. |
buildEnv | map of name to string | no | Public constants the build compiles into the app, by name, for example { "VITE_API_ORIGIN": "https://api.example.com" }: the packer sets them in the environment of every build command and of wrangler's bundling. Everyone can read them (the catalog publishes them and the build writes them into downloadable files), so a name that looks like a credential (containing SECRET, PASSWORD, PASSWD, PASSPHRASE, TOKEN, PRIVATE or CREDENTIAL) is refused, and so is a name the build's tools read: wrangler and what it runs (WRANGLER_, CLOUDFLARE_, CF_, ESBUILD_, MINIFLARE_, WORKERD_), Node.js and package managers (NODE_, NPM_, PNPM_, YARN_, BUN_, COREPACK_, DENO_), git and CI (GIT_, GITHUB_, RUNNER_, ACTIONS_, CI), shells (BASH*, ENV, IFS, PS4, PROMPT_COMMAND and the like), the dynamic linker (LD_, DYLD_, GCONV*), TLS and HTTP clients (SSL_, OPENSSL_, CURL_, PROXY), configuration directories (XDG, HOME, TMPDIR), other toolchains (PYTHON, PERL5*, RUBY*, JAVA_, CARGO_, RUST*, GOPATH, GOFLAGS and the other Go settings), and build tools (TURBO_, NX_, PRISMA_). Catalog review reads every constant as well. Upper-case names, at most 32 constants. Not for the self-deploying tier. Names length at most 128; names must match ^(?!(?:CLOUDFLARE_|WRANGLER_|CF_|APPFLARE_|ESBUILD_|MINIFLARE_|WORKERD_|NODE_|NPM_|NPX_|PNPM_|YARN_|BUN_|COREPACK_|DENO_|GIT_|GITHUB_|RUNNER_|ACTIONS_|BASH|SHELLOPTS|LD_|DYLD_|GCONV|SSL_|OPENSSL_|CURL_|XDG_|PYTHON|PERL5|RUBY|JAVA_|_JAVA|CARGO_|RUST|TURBO_|NX_|PRISMA_))(?!(?:PATH|HOME|USER|LOGNAME|SHELL|PWD|OLDPWD|TMPDIR|TMP|TEMP|LANG|TERM|TZ|GOPATH|GOROOT|GOFLAGS|GOPROXY|GOENV|GOCACHE|GOMODCACHE|GOPRIVATE|GONOSUMDB|GONOSUMCHECK|GOINSECURE|GOTOOLCHAIN|GOWORK|HOSTNAME|CI|GH_TOKEN|ENV|PS4|IFS|CDPATH|GLOBIGNORE|PROMPT_COMMAND|HTTP_PROXY|HTTPS_PROXY|ALL_PROXY|NO_PROXY|FTP_PROXY)$)(?!.*(?:SECRET|PASSWORD|PASSWD|PASSPHRASE|TOKEN|PRIVATE|CREDENTIAL))[A-Z][A-Z0-9_]*$. |
installDirs | array of objects | no | The directories whose dependencies the packer installs, in order, each with install scripts disabled, before any build command. Omitted means [{ "path": "." }], the root of the checkout; list . as well when the root still needs its install. Use it when the Worker's package.json sits in a directory of its own (a template repository), or for a second install beside the root one. At most 8 directories. An empty list installs nothing, for a repository without a package.json: wrangler bundles the entry and its relative imports, and any build command runs with no dependencies installed. An entry of several Workers lists them once for all its Workers. |
emailRouting | object | no | Email the app receives through Email Routing. The install form asks for one of the account's zones; the install turns Email Routing on there if it is off, then points the listed addresses (and, with catchAll, every other address) at the app's Worker (the primary one, or the Worker worker names), which must export an email handler. Uninstalling removes what the install added. {{emailDomain}} and {{emailZoneId}} give the app the zone's name and id. Not for the self-deploying tier, whose own installer deploys the app. |
wildcardHostname | object | no | The app needs every name under one hostname (*.<base>) rather than one exact hostname, for example a tunnel that gives each session a name of its own. The admin assigns the base (tunnels.example.com) in one of the account's domains; the manager then serves the primary Worker on the base and every name under it (a proxied wildcard DNS record and Workers routes). Not for the self-deploying tier. |
container | object | no | How a run of this app in the user's sandbox Worker is sized: the build of a sandbox tier entry or the installer of a self-deploying one (not allowed on artifact entries). Both fields feed the cost the manager shows before each install and update. |
configPatch | object | no | Changes to the app's wrangler config, applied before wrangler reads it, as a JSON merge patch (RFC 7386): an object merges key by key, null removes a key, and anything else, arrays included, replaces the value. Allowed keys: main, assets, build, services, kv_namespaces, r2_buckets, d1_databases, vars, migrations, ratelimits, ai; a section Appflare cannot install (such as vpc_services), or a key the packer's wrangler does not know, may be set to null, which drops it, when the app works without it. Prefer a pull request upstream and link it in a comment beside the patch; the patch is for the time until it is merged. |
wranglerConfigInline | object | no | The wrangler config of an app whose repository ships none, which the packer writes as .appflare.wrangler.jsonc where wranglerConfig names (for example .appflare.wrangler.jsonc, or server/.appflare.wrangler.jsonc) and reads like any other config. Not beside configPatch or workers. Prefer a pull request upstream that adds a config, and link it in a comment beside this one. |
toolchains | array, each one of "rust" | no | Toolchains beyond Node.js the build needs. "rust": catalog CI installs a pinned Rust toolchain with the wasm32-unknown-unknown target before installing and building, for workers-rs apps (worker-build). Artifact tier only: the sandbox image that builds sandbox and self-deploying entries in an account has no Rust. |
selfDeploying | object | no | How the sandbox Worker runs the app's own installer (self-deploying tier only). The admin creates a Cloudflare API token from tokenPermissions for it. The installer keeps its state in the account (for Alchemy, its alchemy-state-store Worker), so every run sees what earlier runs deployed. |
workers | array of objects | no | For an app that installs as several Workers deployed together (for example an API and a web front end), 2 to 24 of them: each Worker's name, wrangler config and optional build command. Exactly one is primary: it answers the app's address and health check, and its wranglerConfig is install.wranglerConfig. Service bindings between these Workers, Durable Object bindings to a class in another of them, and Workflow bindings to a Workflow another of them defines are pointed at the installed Workers; bindings of the same name share one resource. Artifact tier only. On Workers Free a job for more than three Workers can take longer: the manager waits 5 minutes whenever the job needs a fresh allowance of the 50 requests Cloudflare gives it at a time. |
secrets[]
Each entry of secrets has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The name the Worker reads the secret by, exactly as the app's code spells it, for example ADMIN_PASSWORD. Must not be empty. |
key | string | no | What Appflare calls the secret, when it is not its name: unique among the entry's secrets, for an entry of several Workers where two secrets give different Workers a value under one name, for example GITHUB_CLIENT_ID for the CLIENT_ID of the github Worker. The forms, the install's record and derive.from, seed params and a Pipelines sink's tokenSecret use the key; the Worker still reads the secret by name. Defaults to name. An entry with a key other than its secret's name lists "secret-keys" in requires, so managers that do not know keys leave it out. Not for self-deploying entries. Changing a released secret's key makes installs ask for its value again. Length 1 to 64; must match ^[A-Za-z_][A-Za-z0-9_]*$. |
label | string | yes | What the install and settings forms call the secret, in plain words, for example Admin password. Must not be empty. |
help | string | no | A sentence or two shown under the field: what the value is for, or where to find it. |
link | object | no | A link shown beside the field in the install and settings forms, opened in a new tab: where to get the value, such as the page that creates an API key. Help text is shown as plain text, so put the link here rather than in help. |
generate | one of "password", "vapid-private-key", "base64-key-32" | no | The install form fills in a value instead of asking for one. "password": a random value the admin can copy, regenerate, or replace. "vapid-private-key": a new Web Push (VAPID) private key, a P-256 private key as the unpadded base64url of its raw 32 bytes (the form web-push libraries take), and the manager refuses a value that is not one. Pair it with a derive: { method: "vapid-public-key" } var for the public key. "base64-key-32": 32 random bytes as padded base64 (44 characters), for an app that reads a raw 256-bit key; the manager refuses a value that does not decode to 32 bytes. |
optional | boolean | no (default false) | The app works without this secret. The install form leaves it unset unless the admin chooses "Set now", updates never ask for it, and the app's settings can remove it. Not allowed on self-deploying entries. |
derive | object | no | Computes this secret from another one instead of asking for it: the install form shows only the source secret, and the manager writes both at install, and again whenever the source secret gets a new value in the app's settings or an update. Neither value is ever logged. Not allowed with generate or optional, nor on self-deploying entries. |
workers | array of strings | no | For an entry that installs several Workers (install.workers): the names of the Workers that get this value. Omitted means every Worker for a secret, and for a var the Workers whose wrangler config declares it (every Worker when none does). Each length 1 to 24; each must match ^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$. |
seedOnly | boolean | no (default false) | The secret exists only for resources.d1[binding].seed: the install form asks for it once, the seed uses it (as a param or the source of a hash), and it is never set on the Worker, stored, or asked for again by updates or settings. For a first admin's password, so the plaintext never sits in the app's environment. Not allowed with optional, derive or workers, nor on self-deploying entries. |
multiline | boolean | no (default false) | The value spans several lines, such as a PEM private key: the install, update and settings forms ask for it in a multi-line field that keeps every line break, and the Worker gets the value as entered (Windows line endings become \n, and spaces or tabs at the end of the last line are dropped). Not allowed with generate or derive. |
cloudflareToken | boolean | no (default false) | This secret takes the Cloudflare API token the admin creates for the app from tokenPermissions: the install and settings forms show how to create that token next to its field. At most one secret per entry. Not allowed with generate, derive or seedOnly, and only when the entry lists tokenPermissions (or a Pipelines sink, whose token permissions Appflare adds). |
vars[]
Each entry of vars has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The name the Worker reads the setting by, exactly as the app's code and wrangler config spell it, for example SITE_TITLE. Must not be empty. |
label | string | yes | What the install and settings forms call the setting, in plain words, for example Site title. Must not be empty. |
help | string | no | A sentence or two shown under the field: what the setting changes, or which values work. |
link | object | no | A link shown beside the field in the install and settings forms, opened in a new tab: where to get the value, such as the page that creates an API key. Help text is shown as plain text, so put the link here rather than in help. |
default | string | no | Value the form starts with, filled in on every install, update and settings change. {{appUrl}} becomes the address the app is served at (its custom domain while workers.dev is off for it, else its workers.dev URL; no trailing slash) and {{appHostname}} that address's hostname; {{workerUrl}} and {{workerHostname}} are always the workers.dev address (https://<worker name>.<account subdomain>.workers.dev); {{workerName}} is the installed Worker's name and {{accountId}} the id of the Cloudflare account. {{wildcardHostname}} becomes the hostname of the app's wildcard domain (for an entry with install.wildcardHostname), empty until one is assigned. For an app Appflare protects with Cloudflare Access, {{accessTeamDomain}} becomes the team domain (<team>.cloudflareaccess.com), {{accessTeamName}} the team name alone (<team>), {{accessAud}} the audience tag of the app's Access application and {{accessCertsUrl}} the URL of the keys that sign Access's JWTs; all four are empty while the app is not protected, and filled in again when protection is turned on or off. An entry of several Workers names one with {{appUrl:<name>}} and the like. When the app's wrangler config gives this var a value that is not a string (an array, object, number, or boolean), the var reaches the Worker as JSON and default must be JSON text, for example ["{{appUrl}}"]. Without default, the form starts with the wrangler config's value. For a type: "select" var, default must be one of the options values. |
optional | boolean | no (default false) | The admin may leave this var empty. Every other var needs a value, typed or from default, before the install runs. |
type | "text" or "select" | no (default "text") | "text" (the default) takes any value; "select" takes one of options, shown as choices (cards for up to 4, a dropdown beyond). |
options | array of objects | no | The values a type: "select" var can take, in the order the form shows them. Required for, and only allowed with, select. Values must be distinct. |
derive | object | no | Computes this var from a secret instead of asking for it: the install and settings forms show it read-only, and the manager sets it at install, and again whenever the source secret gets a new value in the app's settings or an update. Not allowed with default, optional: true, type: "select" or options, nor on self-deploying entries. |
workers | array of strings | no | For an entry that installs several Workers (install.workers): the names of the Workers that get this value. Omitted means every Worker for a secret, and for a var the Workers whose wrangler config declares it (every Worker when none does). Each length 1 to 24; each must match ^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$. |
seedOnly | boolean | no (default false) | The var exists only for resources.d1[binding].seed, such as a first admin's user name: the install form asks for it once, a seed statement binds it, and it is never set on the Worker, stored, or shown in settings. Must not be optional, or must have a default. Not allowed with derive or workers, nor on self-deploying entries. |
postInstall[]
Each entry of postInstall has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
type | "markdown" | yes | How content is written. Only "markdown" for now. |
content | string | yes | Markdown the manager shows once the app is installed, such as how to sign in the first time. These placeholders are filled in: {{appUrl}}, {{appHostname}}, {{workerUrl}}, {{workerHostname}}, {{workerName}}, {{accountId}}, {{emailDomain}}, {{emailZoneId}}, {{wildcardHostname}}. For the address people open, use {{appUrl}}, which follows a custom domain. An entry of several Workers names one of them with {{appUrl:<name>}} and the like. Must not be empty. |
tokenPermissions[]
Each entry of tokenPermissions has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
group | one of "DNS", "Zone", "Zone Settings", "Analytics", "Page Rules", "Cache Purge", "SSL and Certificates", "Firewall Services", "Load Balancers", "Logs", "Workers Routes", "Email Routing Rules", "Account Settings", "Account Analytics", "Billing", "Magic Transit", "Workers Scripts", "Workers KV Storage", "Workers R2 Storage", "Workers R2 Data Catalog", "Workers R2 SQL", "Workers Tail", "Workers Containers", "D1", "Queues", "Vectorize", "Images", "Hyperdrive", "Pipelines", "Secrets Store", "Email Sending", "Email Routing Addresses", "Access: Apps and Policies", "Access: Organizations, Identity Providers, and Groups" | yes | The permission group, as the Cloudflare dashboard's token form names it, for example "DNS" or "Workers Scripts". Zone groups: DNS, Zone, Zone Settings, Analytics, Page Rules, Cache Purge, SSL and Certificates, Firewall Services, Load Balancers, Logs, Workers Routes, Email Routing Rules. Account groups: Account Settings, Account Analytics, Billing, Logs, Magic Transit, Workers Scripts, Workers KV Storage, Workers R2 Storage, Workers R2 Data Catalog, Workers R2 SQL, Workers Tail, Workers Containers, D1, Queues, Vectorize, Images, Hyperdrive, Pipelines, Secrets Store, Email Sending, Email Routing Addresses, Access: Apps and Policies, Access: Organizations, Identity Providers, and Groups. Must not be empty. |
scope | "account" or "zone" | yes | "account" or "zone": where the group applies, as the token form groups it. |
access | "read" or "edit" | yes | "read" or "edit": the access level the app needs. |
reason | string | yes | Why the app needs the permission, in one plain sentence shown next to it, for example "Lists your zones." Say "Optional:" first when the app works without it. Length 1 to 300. |
resources
Fields of resources.
| Field | Type | Required | Details |
|---|---|---|---|
vectorize | map of name to object | no | One entry per Vectorize binding in the wrangler config, keyed by binding name. Required for each such binding. Names must not be empty. |
r2 | map of name to object | no | Settings of the R2 bucket Appflare creates for an R2 binding, keyed by the binding's name: lifecycle rules that delete objects, move them to Infrequent Access storage, or abort unfinished multipart uploads after some days. Every key must be an R2 binding of the wrangler config. Not allowed on self-deploying entries. Names must not be empty. |
hyperdrive | map of name to object | no | The Hyperdrive bindings of the wrangler config, keyed by the binding's name, each with the database it connects to (postgres or mysql). The database runs outside Cloudflare: the install form asks for its connection string, and Appflare creates a Hyperdrive configuration of the install's own from it. Every Hyperdrive binding must be listed. Not allowed on self-deploying entries. Names must not be empty. |
pipelines | map of name to object | no | The Pipelines bindings of the wrangler config, keyed by binding name: each stream's schema and the Iceberg table its events land in. Appflare creates the stream, an R2 Data Catalog sink and a pass-through pipeline for each, and binds the stream. Needs plan: "paid" (Pipelines is on Workers Paid only). Not allowed on self-deploying entries. Names must match ^[A-Za-z_$][A-Za-z0-9_$]*$. |
d1 | map of name to object | no | Where each D1 binding's SQL lives when the wrangler config's migrations folder does not describe it, keyed by the binding's name: a migrations folder or glob, schema files that run on every install and update, migrations that run after the new version serves, seed statements, and a baseline schema that runs once on a new database. Paths are relative to the checkout's root. Not allowed on self-deploying entries. Names must not be empty. |
bump
Fields of bump.
| Field | Type | Required | Details |
|---|---|---|---|
autoMerge | boolean | no (default false) | Whether the bump bot's pull request merges itself once the required checks, including the install check, pass. Left out or true, it does for an artifact tier entry that does not set source.version; the default of false shown here only keeps released manifests as they were and does not opt out. Set false to have a maintainer merge each bump, for example when upstream's releases often break installs or need a migration guide. Sandbox and self-deploying entries are never merged by the bot and may not set true. |
access
Fields of access.
| Field | Type | Required | Details |
|---|---|---|---|
mode | "required" or "recommended" | no | "required": the app is always installed behind Cloudflare Access, and its protection cannot be turned off. For an app with no sign-in of its own, or one that relies on Access's. It installs only on accounts with a Zero Trust organization and a Cloudflare token with the Access permissions. "recommended": the install form's protection switch starts on. Leave it out to offer protection with the switch off. |
bypass | array of strings | no | Paths that stay public while the app is protected, such as share links ("/s/*"), "/.well-known/*" or a webhook ("/api/webhook"). Each starts with / and may end in /* for everything under it (/s/* does not cover /share); no other wildcard, query or fragment. At most 10. They stay public on every address the app answers on (its workers.dev address and its domains). The health check path is not made public: Appflare's health checks sign in with a token of their own. Each length at most 128; each must match ^(?:/[A-Za-z0-9._~@:+=,-]+)+(?:/\*)?$. |
install.health
Fields of install.health.
| Field | Type | Required | Details |
|---|---|---|---|
path | string | no (default "/") | The path the manager probes, for example /api/health. When it answers JSON with a string version, an update's check of the new version requires that version. Defaults to "/". Must match ^\/[^\s?#]*$. |
mode | "no-server-errors" or "any-response" | no (default "no-server-errors") | Which answers of the Worker count as serving. "no-server-errors" (the default): any answer but a server error (5xx), so a redirect or a 404 passes and a 500 fails. "any-response": any answer the Worker itself gives, server errors included; use it for an app whose health path asks for a sign-in, its own or one it checks from Cloudflare Access. Either way, connection failures and Cloudflare's own error pages (such as error code: 1042 while the route goes live) are retried and never count as serving, and neither does the redirect to Cloudflare Access's sign-in page, which Access sends before the request reaches the Worker. |
install.installDirs[]
Each entry of install.installDirs has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
path | string | yes | The directory to install, relative to the root of the checkout: . for the root, or a path such as templates/blog. No absolute paths and no ... Must match ^(?:\.|(?!\.\.?(?:/|$))[0-9A-Za-z.@+_-]+(?:/(?!\.\.?(?:/|$))[0-9A-Za-z.@+_-]+)*)$. |
packageManager | one of "pnpm", "npm", "yarn", "bun" | no | The package manager to install this directory with. Omitted, it is install.packageManager when the directory holds that manager's lockfile or no lockfile at all, else the one its lockfile names. |
lockfile | "required" or "none" | no (default "required") | Omitted or "required", the install follows the directory's lockfile exactly and fails without one. "none" resolves the dependencies instead and records the hash of the lockfile it wrote in the pack log; use it only when upstream ships no lockfile for this directory. |
devDependencies | boolean | no (default true) | false installs this directory's dependencies without its devDependencies (pnpm --prod, npm --omit=dev, classic yarn and bun --production), for a project whose devDependencies cannot be installed (one from a private registry, say) and are not needed to bundle the Worker. Omitted or true installs them all. yarn 2 and later have no such frozen install, so they refuse it. |
install.emailRouting
Fields of install.emailRouting.
| Field | Type | Required | Details |
|---|---|---|---|
worker | string | no | For an app of several Workers (install.workers): the name of the Worker that receives the mail, which must export an email handler. Omitted means the primary Worker. Email Routing delivers to a Worker by name, not over HTTP, so a Worker with workersDev: false can receive mail. An entry that sets it lists "email-worker" in requires. Length 1 to 24; must match ^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$. |
catchAll | boolean | no (default false) | Send every address of the zone that no other rule matches to the app (the zone's catch-all rule). The install refuses when the catch-all already sends mail somewhere else. |
rules | array of strings | no (default []) | Addresses to route to the app, one routing rule each: a local part such as inbox (becomes inbox@<zone>) or a full address in the chosen zone. The install refuses an address that already has a rule. Each must match ^(?=[^@]{1,64}(?:@|$))[a-z0-9]+(?:[._+-][a-z0-9]+)*(?:@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)?$. |
install.wildcardHostname
Fields of install.wildcardHostname.
| Field | Type | Required | Details |
|---|---|---|---|
reason | string | yes | One short sentence, shown where the admin assigns the hostname, on why the app needs every name under it, for example "Each tunnel gets its own address under this hostname." At most 200 characters. Length 1 to 200. |
install.container
Fields of install.container.
| Field | Type | Required | Details |
|---|---|---|---|
expectedMinutes | integer | no (default 10) | About how many minutes one run of this app in the sandbox Worker takes (its build, or for a self-deploying entry its installer's deploy), measured on a standard-1 container (or instanceType, when set). The manager multiplies it by the container's rates to show what each install or update costs before the admin confirms it. Whole minutes, 1 to 120; defaults to 10. From 1 to 120. |
instanceType | "standard-1" or "standard-2" | no (default "standard-1") | The container the run uses: standard-1 (1/2 vCPU, 4 GiB memory, 8 GB disk) or standard-2 (1 vCPU, 6 GiB, 12 GB) for builds or installers that run out of memory or disk on the smaller one. The larger container costs more per minute, which the manager's cost estimate reflects. Defaults to "standard-1". |
install.configPatch
Fields of install.configPatch.
| Field | Type | Required | Details |
|---|---|---|---|
main | string | no | The Worker's entrypoint, relative to the config, for example dist/index.js; not absolute and without ... Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
assets | object, or null | no | Merged into the config's assets: directory, binding, html_handling, not_found_handling, run_worker_first; null removes a key, or assets itself. |
build | null | no | Only null: removes the config's build, when install.buildCommand builds instead. |
services | array, or null | no | The whole list of service bindings (a merge patch replaces arrays): the config's own entries, some left out, and entries that point at a Worker of this entry. null removes them all. |
kv_namespaces | array of objects | no | The whole list: every binding of the config, plus new ones. A binding whose id is an empty string or a placeholder ($NAME, ${NAME}, {{NAME}}, <NAME>) may leave it out, so the install provisions it; "" is refused by wrangler. |
r2_buckets | array of objects | no | The whole list: every binding of the config, plus new ones. A binding whose bucket_name is an empty string or a placeholder may leave it out. |
d1_databases | array of objects | no | The whole list: every binding of the config, plus new ones. A binding whose database_id is an empty string or a placeholder may leave it out. |
vars | object, or null | no | Vars to set or remove: text sets the var (added, or replacing the config's value), null removes it, and null for vars itself removes them all. Text may hold the placeholders a var's default takes ({{appUrl}}, {{appUrl:<name>}} and the others), filled in at every deploy. For a value only one Worker of the entry gets, such as the address it is reached at; a value the admin chooses is a catalog var. The admin does not see these in the app's settings. |
ratelimits | array of objects | no | The whole list: every rate limit of the config, unchanged, plus new ones, for a limit an upstream deploy script adds. |
ai | object | no | Adds a Workers AI binding, for one an upstream deploy script adds: only binding, and only to a config without an ai binding of its own (or with this one). |
migrations | array of objects | no | The config's Durable Object migrations, the same list with new_classes renamed to new_sqlite_classes, which the Free plan requires. |
containers | null | no | Only null: drops containers, which Appflare cannot install, from the config. |
cloudchamber | null | no | Only null: drops cloudchamber, which Appflare cannot install, from the config. |
dispatch_namespaces | null | no | Only null: drops dispatch_namespaces, which Appflare cannot install, from the config. |
mtls_certificates | null | no | Only null: drops mtls_certificates, which Appflare cannot install, from the config. |
tail_consumers | null | no | Only null: drops tail_consumers, which Appflare cannot install, from the config. |
streaming_tail_consumers | null | no | Only null: drops streaming_tail_consumers, which Appflare cannot install, from the config. |
logfwdr | null | no | Only null: drops logfwdr, which Appflare cannot install, from the config. |
pipelines | null | no | Only null: drops pipelines, which Appflare cannot install, from the config. |
secrets_store_secrets | null | no | Only null: drops secrets_store_secrets, which Appflare cannot install, from the config. |
unsafe | null | no | Only null: drops unsafe, which Appflare cannot install, from the config. |
vpc_services | null | no | Only null: drops vpc_services, which Appflare cannot install, from the config. |
vpc_networks | null | no | Only null: drops vpc_networks, which Appflare cannot install, from the config. |
ai_search_namespaces | null | no | Only null: drops ai_search_namespaces, which Appflare cannot install, from the config. |
ai_search | null | no | Only null: drops ai_search, which Appflare cannot install, from the config. |
agent_memory | null | no | Only null: drops agent_memory, which Appflare cannot install, from the config. |
media | null | no | Only null: drops media, which Appflare cannot install, from the config. |
stream | null | no | Only null: drops stream, which Appflare cannot install, from the config. |
artifacts | null | no | Only null: drops artifacts, which Appflare cannot install, from the config. |
flagship | null | no | Only null: drops flagship, which Appflare cannot install, from the config. |
unsafe_hello_world | null | no | Only null: drops unsafe_hello_world, which Appflare cannot install, from the config. |
connect | null | no | Only null: drops connect, which Appflare cannot install, from the config. |
addresses | null | no | Only null: drops addresses, which Appflare cannot install, from the config. |
site | null | no | Only null: drops site, which Appflare cannot install, from the config. |
pages_build_output_dir | null | no | Only null: drops pages_build_output_dir, which Appflare cannot install, from the config. |
wasm_modules | null | no | Only null: drops wasm_modules, which Appflare cannot install, from the config. |
text_blobs | null | no | Only null: drops text_blobs, which Appflare cannot install, from the config. |
data_blobs | null | no | Only null: drops data_blobs, which Appflare cannot install, from the config. |
install.wranglerConfigInline
Fields of install.wranglerConfigInline.
| Field | Type | Required | Details |
|---|---|---|---|
main | string | no | The Worker's entrypoint, relative to the config, for example src/index.ts. Omitted for a Worker of static assets only. Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
compatibility_date | string | yes | The compatibility date the app is tested against. Must match ^\d{4}-\d{2}-\d{2}$. |
compatibility_flags | array of strings | no | Compatibility flags, for example nodejs_compat. Each must not be empty. |
assets | object | no | Static assets the Worker serves, as wrangler's assets. |
vars | map of name to any | no | Plain variables: a string, or any JSON value. Names must not be empty. |
triggers | object | no | Cron triggers. |
observability | object | no | Workers Logs and traces, as wrangler's observability. |
placement | object | no | Smart Placement: smart, with an optional region hint, or off. |
kv_namespaces | array of objects | no | KV namespaces, by binding only: the install creates each one. |
r2_buckets | array of objects | no | R2 buckets, by binding only: the install creates each one. |
d1_databases | array of objects | no | D1 databases, without ids: the install creates each one. |
queues | object | no | Queue producers and consumers; the install creates each queue. |
durable_objects | object | no | Durable Object bindings. |
migrations | array of objects | no | Durable Object migrations, in order. |
workflows | array of objects | no | Workflows defined by this Worker. |
services | array of objects | no | Service bindings to this Worker or another Worker of the entry. |
ai | object | no | The Workers AI binding. |
browser | object | no | The Browser Rendering binding. |
images | object | no | The Images binding. |
version_metadata | object | no | The version metadata binding. |
install.selfDeploying
Fields of install.selfDeploying.
| Field | Type | Required | Details |
|---|---|---|---|
tool | "alchemy" | yes | The installer the app ships. "alchemy": an Alchemy stack, which gets the app's token as CLOUDFLARE_API_TOKEN and the account id as CLOUDFLARE_ACCOUNT_ID. |
deployCommand | array of strings | yes | The command that deploys (or updates) the app, as argv, run at the root of the checkout after the dependency install and install.buildCommand, for example ["pnpm", "alchemy", "deploy", "--yes"]. The sandbox Worker appends the stage option and the stage (--stage <stage> for Alchemy). It must not prompt: it runs without a terminal. A list of words rather than one string, so the words run exactly as listed. Each must not be empty; each must match ^[A-Za-z0-9@%+,./:=_-]+$. |
destroyCommand | array of strings | yes | The command that deletes everything the deploy command created, as argv, for example ["pnpm", "alchemy", "destroy", "--yes"]. Uninstalling runs it; Appflare never deletes the app's resources itself. Each must not be empty; each must match ^[A-Za-z0-9@%+,./:=_-]+$. |
workerNames | array of strings | yes | The Workers the deploy command creates, with {{stage}} for the install's stage, for example ["open-seo-{{stage}}", "open-seo-{{stage}}-audit"]. The first one serves the app: its workers.dev URL is the install's URL and the health check probes it. After each deploy Appflare reads these Workers and records what they bind. Each must match ^[a-z0-9-]*\{\{stage\}\}[a-z0-9-]*$. |
install.workers[]
Each entry of install.workers has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The Worker's name within the entry, for example api. The primary Worker installs under the install's Worker name; every other one as <install Worker name>-<name>. Placeholders name it too: {{appUrl:<name>}}, {{workerUrl:<name>}}, {{workerName:<name>}} and the hostname forms. Length 1 to 24; must match ^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$. |
wranglerConfig | string | yes | Path of this Worker's wrangler config in the repository. Must not be empty. |
buildCommand | string, or array | no | The command, or the commands in order, the packer runs at the root of the checkout for this Worker, after install.buildCommand (when set) and before bundling it. Same rules as install.buildCommand. |
configPatch | object | no | Changes to this Worker's wrangler config, applied before wrangler reads it; the same rules as install.configPatch. |
wranglerConfigInline | object | no | This Worker's wrangler config, for a repository that ships none; the same rules as install.wranglerConfigInline, and wranglerConfig names where it is written. |
primary | boolean | no (default false) | The Worker that answers the app's address and its health check. Exactly one Worker is primary, and its wranglerConfig is install.wranglerConfig. |
workersDev | boolean | no (default true) | Whether this Worker answers on its workers.dev URL (on unless set to false). Set false for a Worker only the entry's other Workers call, through a service binding or a Durable Object binding, and that must not be reachable from the internet (for example one that trusts identity headers set by the primary Worker). It then has no public URL and no version previews, and updates skip its preview check. The primary Worker always keeps its workers.dev URL: it is the app's address and health check until a custom domain takes over. |
secrets[].link
Fields of secrets[].link.
| Field | Type | Required | Details |
|---|---|---|---|
label | string | yes | What the link says, in a few plain words (at most 40 characters), for example Get a key or Create a bot. The forms add the mark of a link that opens in a new tab. Length 1 to 40; must match ^\S(?:[^\r\n]*\S)?$. |
url | string | yes | Where the link goes, as an https:// URL without a user name or password, at most 500 characters, for example https://openrouter.ai/settings/keys. Length at most 500; must match ^https:\/\/[^\s\x00-\x1f\x7f/?#@\\]+(?:[/?#][^\s\x00-\x1f\x7f\\]*)?$. |
secrets[].derive
Fields of secrets[].derive.
| Field | Type | Required | Details |
|---|---|---|---|
from | string | yes | The secret whose value this one is computed from, by its key (its name when it has no key). It must be another secret of this manifest, not itself derived, not optional. Must not be empty. |
method | "bcrypt" or "vapid-public-key" | yes | How the value is computed. "bcrypt": a bcrypt hash ($2b$, cost 10) of the source value, for apps that check a password against a stored hash. "vapid-public-key": the Web Push (VAPID) public key of a source secret with generate: "vapid-private-key", as the unpadded base64url of its 65-byte uncompressed point. |
vars[].link
Fields of vars[].link.
| Field | Type | Required | Details |
|---|---|---|---|
label | string | yes | What the link says, in a few plain words (at most 40 characters), for example Get a key or Create a bot. The forms add the mark of a link that opens in a new tab. Length 1 to 40; must match ^\S(?:[^\r\n]*\S)?$. |
url | string | yes | Where the link goes, as an https:// URL without a user name or password, at most 500 characters, for example https://openrouter.ai/settings/keys. Length at most 500; must match ^https:\/\/[^\s\x00-\x1f\x7f/?#@\\]+(?:[/?#][^\s\x00-\x1f\x7f\\]*)?$. |
vars[].options[]
Each entry of vars[].options has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
value | string | yes | What the Worker gets. For a var the app reads as JSON, JSON text such as true or 404. Length 1 to 200. |
label | string | yes | What the form shows for this choice. Length 1 to 80. |
vars[].derive
Fields of vars[].derive.
| Field | Type | Required | Details |
|---|---|---|---|
from | string | yes | The secret whose value this var is computed from, by its key (its name when it has no key). It must be a secret of this manifest, not itself derived, not optional. Must not be empty. |
method | "vapid-public-key" | yes | "vapid-public-key": the Web Push (VAPID) public key of a source secret with generate: "vapid-private-key", as the unpadded base64url of its 65-byte uncompressed point: public config the app hands to browsers. |
resources.vectorize.<name>
Each value of resources.vectorize, keyed by name, has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
dimensions | integer | yes | Vector size of the index. Fixed when the index is created. From 1 to 1536. |
metric | one of "cosine", "euclidean", "dot-product" | yes | Distance metric of the index. Fixed when the index is created. |
metadataIndexes | array of objects | no | Metadata properties the app's queries filter on, each with its type. Appflare creates these metadata indexes when it creates the index, before the app writes a vector (a vector written earlier is not indexed). At most 10. |
resources.r2.<name>
Each value of resources.r2, keyed by name, has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
lifecycle | array of objects | yes | Lifecycle rules Appflare sets on the bucket when it creates it, and when an update declares them for a bucket the app already has, beside Cloudflare's default rule for unfinished multipart uploads and any rule added by hand. On the bucket each id starts with appflare:. At most 20, each with a unique id. |
resources.hyperdrive.<name>
Each value of resources.hyperdrive, keyed by name, has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
protocol | "postgres" or "mysql" | yes | The database the app expects behind the binding: postgres or mysql. |
label | string | no | What the install form calls the database, for example "Main database". Must not be empty. |
help | string | no | A sentence under the connection string field, for example which schema it needs. Must not be empty. |
caching | boolean | no | Whether Hyperdrive caches the results of read queries for this database. Omitted keeps Cloudflare's default (on) when the configuration is created, and updates leave the setting as it is. false turns caching off, for an app that must read its own writes at once; true turns it on. Either value is applied at install and again on every update and settings change, and needs "hyperdrive-caching" in requires. |
resources.pipelines.<name>
Each value of resources.pipelines, keyed by name, has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
schema | object | no | The stream's schema. Cloudflare drops events that do not match it. Omitted: the stream is unstructured and every event lands in one value column. |
sink | object | yes | Where the stream's events land: an Iceberg table in an R2 bucket's Data Catalog, written with the API token the admin enters for the app. |
resources.d1.<name>
Each value of resources.d1, keyed by name, has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
migrationsDir | string | no | The folder of the binding's migrations, relative to the checkout's root. Replaces the wrangler config's migrations_dir: its .sql files run and are recorded in d1_migrations as wrangler d1 migrations apply does. Length at most 256; must match ^(?!(?:.*\/)?\.{1,2}(?:\/|$))[0-9A-Za-z.@+_-]+(?:\/[0-9A-Za-z.@+_-]+)*$. |
migrationsGlob | string | no | A glob of the binding's migration files, relative to the checkout's root, for tools that write one folder per migration: prisma/migrations/*/migration.sql. The folder before the first * segment works as wrangler's migrations_dir and the glob as its migrations_pattern: each file is recorded by its path from that folder (20240101_init/migration.sql), as wrangler records it. Prefer migrations_pattern in the wrangler config when upstream sets it. Must match ^[0-9A-Za-z.@+_*/-]+$. |
schema | array of strings | no | SQL files that run on every install and update, in this order, after the migrations, and are not recorded in d1_migrations. Each must be safe to run again: every CREATE TABLE, INDEX, TRIGGER and VIEW says IF NOT EXISTS, and no statement drops or alters anything. Each length at most 256; each must match ^(?!(?:.*\/)?\.{1,2}(?:\/|$))[0-9A-Za-z.@+_-]+(?:\/[0-9A-Za-z.@+_-]+)*$. |
postDeployMigrationsDir | string | no | A folder of migrations that run once the new version serves all traffic, for changes the previous version's code would break on. Recorded in d1_migrations like the others, so their file names must differ from the migrations'. Rolling back does not undo them. Length at most 256; must match ^(?!(?:.*\/)?\.{1,2}(?:\/|$))[0-9A-Za-z.@+_-]+(?:\/[0-9A-Za-z.@+_-]+)*$. |
seed | object | no | Rows the app needs before anyone can sign in (a first admin account), added once at install with values from the install form, bound as D1 parameters. Not allowed on self-deploying entries. |
baseline | string | no | One SQL file with the binding's whole current schema, for apps whose migrations only bring older databases up to date. It runs once, on the new database, before the migrations (at install, or in the update that adds the binding); every migration the version ships is then recorded in d1_migrations as applied without running, and updates run only migrations added later. It may create without IF NOT EXISTS and insert rows, but not ATTACH or DETACH a database, set a PRAGMA, open or end a transaction, or name d1_migrations or a sqlite_ or _cf_ table. Not together with schema. Length at most 256; must match ^(?!(?:.*\/)?\.{1,2}(?:\/|$))[0-9A-Za-z.@+_-]+(?:\/[0-9A-Za-z.@+_-]+)*$. |
install.configPatch.kv_namespaces[]
Each entry of install.configPatch.kv_namespaces has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.configPatch.r2_buckets[]
Each entry of install.configPatch.r2_buckets has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.configPatch.d1_databases[]
Each entry of install.configPatch.d1_databases has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.configPatch.ratelimits[]
Each entry of install.configPatch.ratelimits has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
namespace_id | string | yes | The limit's namespace; the install gives each one of its own. Must not be empty. |
simple | object | yes | The limit. |
install.configPatch.ai
Fields of install.configPatch.ai.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.configPatch.migrations[]
Each entry of install.configPatch.migrations has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
tag | string | yes | The migration's tag, as the config gives it. Must not be empty. |
install.wranglerConfigInline.assets
Fields of install.wranglerConfigInline.assets.
| Field | Type | Required | Details |
|---|---|---|---|
directory | string | yes | The directory of static assets, relative to the config, for example dist/client. Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
binding | string | no | The binding the Worker fetches its assets through, for example ASSETS. Must not be empty. |
html_handling | one of "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none" | no | How requests for HTML pages match files, as wrangler's html_handling. |
not_found_handling | one of "single-page-application", "404-page", "none" | no | What a request that matches no file gets, as wrangler's not_found_handling. |
run_worker_first | boolean, or array | no | Whether the Worker runs before assets are served, or for which paths. |
install.wranglerConfigInline.triggers
Fields of install.wranglerConfigInline.triggers.
| Field | Type | Required | Details |
|---|---|---|---|
crons | array of strings | yes | Cron expressions the Worker runs on. Each must not be empty. |
install.wranglerConfigInline.observability
Fields of install.wranglerConfigInline.observability.
| Field | Type | Required | Details |
|---|---|---|---|
enabled | boolean | no | Whether Workers Logs record the Worker. |
head_sampling_rate | number | no | The share of requests recorded, from 0 to 1. From 0 to 1. |
logs | object | no | Settings for logs alone. |
traces | object | no | Settings for traces. |
install.wranglerConfigInline.placement
Fields of install.wranglerConfigInline.placement.
| Field | Type | Required | Details |
|---|---|---|---|
mode | "off" or "smart" | yes | smart for Smart Placement, or off. |
hint | string | no | A region to place the Worker near, which makes the placement smart. Must not be empty. |
install.wranglerConfigInline.kv_namespaces[]
Each entry of install.wranglerConfigInline.kv_namespaces has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.wranglerConfigInline.r2_buckets[]
Each entry of install.wranglerConfigInline.r2_buckets has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.wranglerConfigInline.d1_databases[]
Each entry of install.wranglerConfigInline.d1_databases has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
database_name | string | no | The database's name upstream; the install names its own. Must not be empty. |
migrations_dir | string | no | The directory of the database's migrations, relative to the config. Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
migrations_table | string | no | The table that records applied migrations. Must not be empty. |
install.wranglerConfigInline.queues
Fields of install.wranglerConfigInline.queues.
| Field | Type | Required | Details |
|---|---|---|---|
producers | array of objects | no | Queues the Worker sends to. |
consumers | array of objects | no | Queues the Worker consumes. |
install.wranglerConfigInline.durable_objects
Fields of install.wranglerConfigInline.durable_objects.
| Field | Type | Required | Details |
|---|---|---|---|
bindings | array of objects | yes | Durable Object bindings, each to a class of this Worker. |
install.wranglerConfigInline.migrations[]
Each entry of install.wranglerConfigInline.migrations has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
tag | string | yes | The migration's tag, unique within the list. Must not be empty. |
new_sqlite_classes | array of strings | no | Classes this migration creates, SQLite-backed. Each must not be empty. |
renamed_classes | array of objects | no | Classes this migration renames. |
deleted_classes | array of strings | no | Classes this migration deletes, with their data. Each must not be empty. |
install.wranglerConfigInline.workflows[]
Each entry of install.wranglerConfigInline.workflows has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
name | string | yes | The Workflow's name. Must not be empty. |
class_name | string | yes | The Workflow class the Worker exports. Must not be empty. |
install.wranglerConfigInline.services[]
Each entry of install.wranglerConfigInline.services has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
service | string | yes | This Worker, or another Worker of the entry, by the name the packer gives it (install.workerName, or <workerName>-<name>). Must not be empty. |
entrypoint | string | no | The named entrypoint the binding calls. Must not be empty. |
install.wranglerConfigInline.ai
Fields of install.wranglerConfigInline.ai.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.wranglerConfigInline.browser
Fields of install.wranglerConfigInline.browser.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.wranglerConfigInline.images
Fields of install.wranglerConfigInline.images.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.wranglerConfigInline.version_metadata
Fields of install.wranglerConfigInline.version_metadata.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].configPatch
Fields of install.workers[].configPatch.
| Field | Type | Required | Details |
|---|---|---|---|
main | string | no | The Worker's entrypoint, relative to the config, for example dist/index.js; not absolute and without ... Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
assets | object, or null | no | Merged into the config's assets: directory, binding, html_handling, not_found_handling, run_worker_first; null removes a key, or assets itself. |
build | null | no | Only null: removes the config's build, when install.buildCommand builds instead. |
services | array, or null | no | The whole list of service bindings (a merge patch replaces arrays): the config's own entries, some left out, and entries that point at a Worker of this entry. null removes them all. |
kv_namespaces | array of objects | no | The whole list: every binding of the config, plus new ones. A binding whose id is an empty string or a placeholder ($NAME, ${NAME}, {{NAME}}, <NAME>) may leave it out, so the install provisions it; "" is refused by wrangler. |
r2_buckets | array of objects | no | The whole list: every binding of the config, plus new ones. A binding whose bucket_name is an empty string or a placeholder may leave it out. |
d1_databases | array of objects | no | The whole list: every binding of the config, plus new ones. A binding whose database_id is an empty string or a placeholder may leave it out. |
vars | object, or null | no | Vars to set or remove: text sets the var (added, or replacing the config's value), null removes it, and null for vars itself removes them all. Text may hold the placeholders a var's default takes ({{appUrl}}, {{appUrl:<name>}} and the others), filled in at every deploy. For a value only one Worker of the entry gets, such as the address it is reached at; a value the admin chooses is a catalog var. The admin does not see these in the app's settings. |
ratelimits | array of objects | no | The whole list: every rate limit of the config, unchanged, plus new ones, for a limit an upstream deploy script adds. |
ai | object | no | Adds a Workers AI binding, for one an upstream deploy script adds: only binding, and only to a config without an ai binding of its own (or with this one). |
migrations | array of objects | no | The config's Durable Object migrations, the same list with new_classes renamed to new_sqlite_classes, which the Free plan requires. |
containers | null | no | Only null: drops containers, which Appflare cannot install, from the config. |
cloudchamber | null | no | Only null: drops cloudchamber, which Appflare cannot install, from the config. |
dispatch_namespaces | null | no | Only null: drops dispatch_namespaces, which Appflare cannot install, from the config. |
mtls_certificates | null | no | Only null: drops mtls_certificates, which Appflare cannot install, from the config. |
tail_consumers | null | no | Only null: drops tail_consumers, which Appflare cannot install, from the config. |
streaming_tail_consumers | null | no | Only null: drops streaming_tail_consumers, which Appflare cannot install, from the config. |
logfwdr | null | no | Only null: drops logfwdr, which Appflare cannot install, from the config. |
pipelines | null | no | Only null: drops pipelines, which Appflare cannot install, from the config. |
secrets_store_secrets | null | no | Only null: drops secrets_store_secrets, which Appflare cannot install, from the config. |
unsafe | null | no | Only null: drops unsafe, which Appflare cannot install, from the config. |
vpc_services | null | no | Only null: drops vpc_services, which Appflare cannot install, from the config. |
vpc_networks | null | no | Only null: drops vpc_networks, which Appflare cannot install, from the config. |
ai_search_namespaces | null | no | Only null: drops ai_search_namespaces, which Appflare cannot install, from the config. |
ai_search | null | no | Only null: drops ai_search, which Appflare cannot install, from the config. |
agent_memory | null | no | Only null: drops agent_memory, which Appflare cannot install, from the config. |
media | null | no | Only null: drops media, which Appflare cannot install, from the config. |
stream | null | no | Only null: drops stream, which Appflare cannot install, from the config. |
artifacts | null | no | Only null: drops artifacts, which Appflare cannot install, from the config. |
flagship | null | no | Only null: drops flagship, which Appflare cannot install, from the config. |
unsafe_hello_world | null | no | Only null: drops unsafe_hello_world, which Appflare cannot install, from the config. |
connect | null | no | Only null: drops connect, which Appflare cannot install, from the config. |
addresses | null | no | Only null: drops addresses, which Appflare cannot install, from the config. |
site | null | no | Only null: drops site, which Appflare cannot install, from the config. |
pages_build_output_dir | null | no | Only null: drops pages_build_output_dir, which Appflare cannot install, from the config. |
wasm_modules | null | no | Only null: drops wasm_modules, which Appflare cannot install, from the config. |
text_blobs | null | no | Only null: drops text_blobs, which Appflare cannot install, from the config. |
data_blobs | null | no | Only null: drops data_blobs, which Appflare cannot install, from the config. |
install.workers[].wranglerConfigInline
Fields of install.workers[].wranglerConfigInline.
| Field | Type | Required | Details |
|---|---|---|---|
main | string | no | The Worker's entrypoint, relative to the config, for example src/index.ts. Omitted for a Worker of static assets only. Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
compatibility_date | string | yes | The compatibility date the app is tested against. Must match ^\d{4}-\d{2}-\d{2}$. |
compatibility_flags | array of strings | no | Compatibility flags, for example nodejs_compat. Each must not be empty. |
assets | object | no | Static assets the Worker serves, as wrangler's assets. |
vars | map of name to any | no | Plain variables: a string, or any JSON value. Names must not be empty. |
triggers | object | no | Cron triggers. |
observability | object | no | Workers Logs and traces, as wrangler's observability. |
placement | object | no | Smart Placement: smart, with an optional region hint, or off. |
kv_namespaces | array of objects | no | KV namespaces, by binding only: the install creates each one. |
r2_buckets | array of objects | no | R2 buckets, by binding only: the install creates each one. |
d1_databases | array of objects | no | D1 databases, without ids: the install creates each one. |
queues | object | no | Queue producers and consumers; the install creates each queue. |
durable_objects | object | no | Durable Object bindings. |
migrations | array of objects | no | Durable Object migrations, in order. |
workflows | array of objects | no | Workflows defined by this Worker. |
services | array of objects | no | Service bindings to this Worker or another Worker of the entry. |
ai | object | no | The Workers AI binding. |
browser | object | no | The Browser Rendering binding. |
images | object | no | The Images binding. |
version_metadata | object | no | The version metadata binding. |
resources.vectorize.<name>.metadataIndexes[]
Each entry of resources.vectorize.<name>.metadataIndexes has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
propertyName | string | yes | The metadata property queries filter on, for example url or user_id. Length 1 to 512; must match ^[^$"][^"]*$. |
type | one of "string", "number", "boolean" | yes | The property's type: string, number or boolean. |
resources.r2.<name>.lifecycle[]
Each entry of resources.r2.<name>.lifecycle has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
id | string | yes | The rule's name, shown in the bucket's settings, for example "Delete temporary files". Must match ^[A-Za-z0-9][A-Za-z0-9 ._-]{0,54}$. |
prefix | string | no | Apply the rule to objects whose keys start with this, for example tmp/. Omitted, it applies to every object. Length 1 to 1024. |
deleteAfterDays | integer | no | Delete an object this long after it was uploaded, in whole days (1 to 36500). From 1 to 36500. |
infrequentAccessAfterDays | integer | no | Move an object to Infrequent Access storage this long after it was uploaded, in whole days (1 to 36500). From 1 to 36500. |
abortMultipartUploadsAfterDays | integer | no | Abort a multipart upload still unfinished this long after it started, in whole days (1 to 36500). From 1 to 36500. |
resources.pipelines.<name>.schema
Fields of resources.pipelines.<name>.schema.
| Field | Type | Required | Details |
|---|---|---|---|
fields | array of objects | yes | The fields of each event, in order. Pipelines adds __ingest_ts itself; do not list it. |
resources.pipelines.<name>.sink
Fields of resources.pipelines.<name>.sink.
| Field | Type | Required | Details |
|---|---|---|---|
type | string | yes | An Apache Iceberg table in R2 Data Catalog, the only sink Appflare sets up. |
bucket | string | yes | The bucket the table lives in. The name of an R2 binding of the app's wrangler config uses that binding's bucket; any other name gets a bucket of the install's own, named <worker name>-<name lowercased, _ as -> like every resource Appflare creates, which no Worker binds (the app reaches it through R2 SQL, for example). Must match ^[A-Za-z_][A-Za-z0-9_]*$. |
namespace | string | yes | The table's namespace in the bucket's catalog. Length at most 128; must match ^[A-Za-z_][A-Za-z0-9_]*$. |
table | string | yes | The table's name in the namespace. Length at most 128; must match ^[A-Za-z_][A-Za-z0-9_]*$. |
tokenSecret | string | yes | The catalog secret, by its key (its name when it has none), that holds a Cloudflare API token with R2 Data Catalog and R2 Storage write access (the dashboard's R2 token with Admin Read & Write). Cloudflare keeps it as the sink's credential, and as the catalog's for table maintenance; Appflare's own token never leaves the manager. The secret must be asked for (no generate, optional, derive or seedOnly). Must not be empty. |
rollIntervalSeconds | integer | no | How often the sink writes a file, in seconds: at least 60 for a catalog sink. Cloudflare's default is 300. From 60 to 86400. |
compression | one of "zstd", "snappy", "gzip", "lz4", "uncompressed" | no | The Parquet compression. Cloudflare's default is zstd. |
compaction | boolean | no | Turn on the catalog's automatic compaction, which merges the sink's small files. |
snapshotExpiration | object | no | Turn on the catalog's snapshot expiration, which deletes old snapshots' files. |
resources.d1.<name>.seed
Fields of resources.d1.<name>.seed.
| Field | Type | Required | Details |
|---|---|---|---|
hashes | map of name to any | no | Values derived from secrets, by name, for { hash } and { salt } params: a pbkdf2-sha256 hash with explicit parameters, or a bcrypt hash. Each is computed once per install, so a hash and its salt match. Never logged or stored by Appflare. Names must match ^[A-Za-z][A-Za-z0-9_-]{0,63}$. |
statements | array of objects | yes | The statements, run in order, each once, at install only. Updates never run them, even when they change. |
beforeSchema | boolean | no | Run the statements before the binding's schema files instead of after them (the default), so a seeded row wins over a default row a schema file adds with INSERT OR IGNORE. The binding's migrations always run first; post-deploy migrations run after the seed when beforeSchema is set. |
install.configPatch.ratelimits[].simple
Fields of install.configPatch.ratelimits[].simple.
| Field | Type | Required | Details |
|---|---|---|---|
limit | integer | yes | Requests allowed per period. From 1 to 9007199254740991. |
period | number, or number | yes | Seconds: 10 or 60. |
install.wranglerConfigInline.observability.logs
Fields of install.wranglerConfigInline.observability.logs.
| Field | Type | Required | Details |
|---|---|---|---|
enabled | boolean | no | Whether logs are recorded. |
head_sampling_rate | number | no | The share of requests recorded, from 0 to 1. From 0 to 1. |
invocation_logs | boolean | no | Whether a log line is recorded for each invocation. |
install.wranglerConfigInline.observability.traces
Fields of install.wranglerConfigInline.observability.traces.
| Field | Type | Required | Details |
|---|---|---|---|
enabled | boolean | no | Whether traces are recorded. |
head_sampling_rate | number | no | The share of requests recorded, from 0 to 1. From 0 to 1. |
install.wranglerConfigInline.queues.producers[]
Each entry of install.wranglerConfigInline.queues.producers has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
queue | string | yes | The queue's name upstream; the install creates one of its own. Must not be empty. |
delivery_delay | integer | no | Seconds before a message sent is delivered. From 0 to 9007199254740991. |
install.wranglerConfigInline.queues.consumers[]
Each entry of install.wranglerConfigInline.queues.consumers has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
queue | string | yes | The queue consumed, by its name upstream. Must not be empty. |
max_batch_size | integer | no | Most messages in a batch. From 1 to 9007199254740991. |
max_batch_timeout | number | no | Most seconds to wait for a batch to fill. From at least 0. |
max_retries | integer | no | Retries of a failed message. From 0 to 9007199254740991. |
dead_letter_queue | string | no | The queue failed messages go to, by its name upstream. Must not be empty. |
max_concurrency | integer | no | Most batches consumed at once. From 1 to 9007199254740991. |
retry_delay | integer | no | Seconds before a message is retried. From 0 to 9007199254740991. |
install.wranglerConfigInline.durable_objects.bindings[]
Each entry of install.wranglerConfigInline.durable_objects.bindings has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
class_name | string | yes | The class, created by this config's migrations. Must not be empty. |
install.wranglerConfigInline.migrations[].renamed_classes[]
Each entry of install.wranglerConfigInline.migrations[].renamed_classes has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
from | string | yes | The class's name before. Must not be empty. |
to | string | yes | The class's name after. Must not be empty. |
install.workers[].configPatch.kv_namespaces[]
Each entry of install.workers[].configPatch.kv_namespaces has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].configPatch.r2_buckets[]
Each entry of install.workers[].configPatch.r2_buckets has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].configPatch.d1_databases[]
Each entry of install.workers[].configPatch.d1_databases has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].configPatch.ratelimits[]
Each entry of install.workers[].configPatch.ratelimits has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
namespace_id | string | yes | The limit's namespace; the install gives each one of its own. Must not be empty. |
simple | object | yes | The limit. |
install.workers[].configPatch.ai
Fields of install.workers[].configPatch.ai.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].configPatch.migrations[]
Each entry of install.workers[].configPatch.migrations has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
tag | string | yes | The migration's tag, as the config gives it. Must not be empty. |
install.workers[].wranglerConfigInline.assets
Fields of install.workers[].wranglerConfigInline.assets.
| Field | Type | Required | Details |
|---|---|---|---|
directory | string | yes | The directory of static assets, relative to the config, for example dist/client. Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
binding | string | no | The binding the Worker fetches its assets through, for example ASSETS. Must not be empty. |
html_handling | one of "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none" | no | How requests for HTML pages match files, as wrangler's html_handling. |
not_found_handling | one of "single-page-application", "404-page", "none" | no | What a request that matches no file gets, as wrangler's not_found_handling. |
run_worker_first | boolean, or array | no | Whether the Worker runs before assets are served, or for which paths. |
install.workers[].wranglerConfigInline.triggers
Fields of install.workers[].wranglerConfigInline.triggers.
| Field | Type | Required | Details |
|---|---|---|---|
crons | array of strings | yes | Cron expressions the Worker runs on. Each must not be empty. |
install.workers[].wranglerConfigInline.observability
Fields of install.workers[].wranglerConfigInline.observability.
| Field | Type | Required | Details |
|---|---|---|---|
enabled | boolean | no | Whether Workers Logs record the Worker. |
head_sampling_rate | number | no | The share of requests recorded, from 0 to 1. From 0 to 1. |
logs | object | no | Settings for logs alone. |
traces | object | no | Settings for traces. |
install.workers[].wranglerConfigInline.placement
Fields of install.workers[].wranglerConfigInline.placement.
| Field | Type | Required | Details |
|---|---|---|---|
mode | "off" or "smart" | yes | smart for Smart Placement, or off. |
hint | string | no | A region to place the Worker near, which makes the placement smart. Must not be empty. |
install.workers[].wranglerConfigInline.kv_namespaces[]
Each entry of install.workers[].wranglerConfigInline.kv_namespaces has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].wranglerConfigInline.r2_buckets[]
Each entry of install.workers[].wranglerConfigInline.r2_buckets has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].wranglerConfigInline.d1_databases[]
Each entry of install.workers[].wranglerConfigInline.d1_databases has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
database_name | string | no | The database's name upstream; the install names its own. Must not be empty. |
migrations_dir | string | no | The directory of the database's migrations, relative to the config. Must not be empty; must match ^(?![/\\])(?![A-Za-z]:)(?!(?:.*[/\\])?\.\.(?:[/\\]|$)).+$. |
migrations_table | string | no | The table that records applied migrations. Must not be empty. |
install.workers[].wranglerConfigInline.queues
Fields of install.workers[].wranglerConfigInline.queues.
| Field | Type | Required | Details |
|---|---|---|---|
producers | array of objects | no | Queues the Worker sends to. |
consumers | array of objects | no | Queues the Worker consumes. |
install.workers[].wranglerConfigInline.durable_objects
Fields of install.workers[].wranglerConfigInline.durable_objects.
| Field | Type | Required | Details |
|---|---|---|---|
bindings | array of objects | yes | Durable Object bindings, each to a class of this Worker. |
install.workers[].wranglerConfigInline.migrations[]
Each entry of install.workers[].wranglerConfigInline.migrations has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
tag | string | yes | The migration's tag, unique within the list. Must not be empty. |
new_sqlite_classes | array of strings | no | Classes this migration creates, SQLite-backed. Each must not be empty. |
renamed_classes | array of objects | no | Classes this migration renames. |
deleted_classes | array of strings | no | Classes this migration deletes, with their data. Each must not be empty. |
install.workers[].wranglerConfigInline.workflows[]
Each entry of install.workers[].wranglerConfigInline.workflows has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
name | string | yes | The Workflow's name. Must not be empty. |
class_name | string | yes | The Workflow class the Worker exports. Must not be empty. |
install.workers[].wranglerConfigInline.services[]
Each entry of install.workers[].wranglerConfigInline.services has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
service | string | yes | This Worker, or another Worker of the entry, by the name the packer gives it (install.workerName, or <workerName>-<name>). Must not be empty. |
entrypoint | string | no | The named entrypoint the binding calls. Must not be empty. |
install.workers[].wranglerConfigInline.ai
Fields of install.workers[].wranglerConfigInline.ai.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].wranglerConfigInline.browser
Fields of install.workers[].wranglerConfigInline.browser.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].wranglerConfigInline.images
Fields of install.workers[].wranglerConfigInline.images.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
install.workers[].wranglerConfigInline.version_metadata
Fields of install.workers[].wranglerConfigInline.version_metadata.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
resources.pipelines.<name>.schema.fields[]
Each entry of resources.pipelines.<name>.schema.fields has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The field's name in each event. Length 1 to 128. |
type | one of "int32", "int64", "float32", "float64", "bool", "string", "binary", "timestamp", "json" | yes | The field's type. |
required | boolean | no | Every event carries the field. Cloudflare drops an event that lacks it. |
unit | one of "second", "millisecond", "microsecond", "nanosecond" | no | For a timestamp field sent as a number: what the number counts. |
resources.pipelines.<name>.sink.snapshotExpiration
Fields of resources.pipelines.<name>.sink.snapshotExpiration.
| Field | Type | Required | Details |
|---|---|---|---|
maxAge | string | yes | Snapshots older than this are expired, such as "30d" (d, h, m or s). Must match ^\d+[dhms]$. |
minSnapshotsToKeep | integer | no | Snapshots kept however old they are. From 1 to 9007199254740991. |
resources.d1.<name>.seed.statements[]
Each entry of resources.d1.<name>.seed.statements has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
sql | string | yes | Exactly one INSERT OR IGNORE or INSERT ... ON CONFLICT ... DO NOTHING statement, with an anonymous ? placeholder for each param. No WITH, DO UPDATE, other statement kinds, numbered or named parameters, and no d1_migrations, sqlite_ or _cf_ tables. Length 1 to 4096. |
params | array of values | yes | The values bound to the placeholders, in order: one object per ?. |
install.workers[].configPatch.ratelimits[].simple
Fields of install.workers[].configPatch.ratelimits[].simple.
| Field | Type | Required | Details |
|---|---|---|---|
limit | integer | yes | Requests allowed per period. From 1 to 9007199254740991. |
period | number, or number | yes | Seconds: 10 or 60. |
install.workers[].wranglerConfigInline.observability.logs
Fields of install.workers[].wranglerConfigInline.observability.logs.
| Field | Type | Required | Details |
|---|---|---|---|
enabled | boolean | no | Whether logs are recorded. |
head_sampling_rate | number | no | The share of requests recorded, from 0 to 1. From 0 to 1. |
invocation_logs | boolean | no | Whether a log line is recorded for each invocation. |
install.workers[].wranglerConfigInline.observability.traces
Fields of install.workers[].wranglerConfigInline.observability.traces.
| Field | Type | Required | Details |
|---|---|---|---|
enabled | boolean | no | Whether traces are recorded. |
head_sampling_rate | number | no | The share of requests recorded, from 0 to 1. From 0 to 1. |
install.workers[].wranglerConfigInline.queues.producers[]
Each entry of install.workers[].wranglerConfigInline.queues.producers has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
binding | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
queue | string | yes | The queue's name upstream; the install creates one of its own. Must not be empty. |
delivery_delay | integer | no | Seconds before a message sent is delivered. From 0 to 9007199254740991. |
install.workers[].wranglerConfigInline.queues.consumers[]
Each entry of install.workers[].wranglerConfigInline.queues.consumers has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
queue | string | yes | The queue consumed, by its name upstream. Must not be empty. |
max_batch_size | integer | no | Most messages in a batch. From 1 to 9007199254740991. |
max_batch_timeout | number | no | Most seconds to wait for a batch to fill. From at least 0. |
max_retries | integer | no | Retries of a failed message. From 0 to 9007199254740991. |
dead_letter_queue | string | no | The queue failed messages go to, by its name upstream. Must not be empty. |
max_concurrency | integer | no | Most batches consumed at once. From 1 to 9007199254740991. |
retry_delay | integer | no | Seconds before a message is retried. From 0 to 9007199254740991. |
install.workers[].wranglerConfigInline.durable_objects.bindings[]
Each entry of install.workers[].wranglerConfigInline.durable_objects.bindings has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
name | string | yes | The binding's name, as the Worker reads it from env. Must not be empty. |
class_name | string | yes | The class, created by this config's migrations. Must not be empty. |
install.workers[].wranglerConfigInline.migrations[].renamed_classes[]
Each entry of install.workers[].wranglerConfigInline.migrations[].renamed_classes has these fields.
| Field | Type | Required | Details |
|---|---|---|---|
from | string | yes | The class's name before. Must not be empty. |
to | string | yes | The class's name after. Must not be empty. |
Add an Install badge
Put an "Install with Appflare" button in your project's README, for an app in the catalog or for any GitHub repository.
Security model
Signed artifacts, pinned builds, what the manager does with its access to your Cloudflare account, the browser installer's part, sessions, roles, notification credentials, and the optional Cloudflare Access protection.