Interface SiteWorkerEnv

how long a superseded page may still be answered, in ms; see agedServeMaxMs()

The Workers AI binding; absent on accounts without it, so readers treat it as optional. A binding, not the HTTP API, which would need the account token readable from a queue row.

comma-separated model ids; unset means the short default list

argon2id password hashing; off unless 1, because it rehashes every login

Replaces a stored page's asset tags with the build's aggregates; off unless 1. Needs bun run assets:agg (writes assets/agg/, 6.57 MB for 808 libraries).

Boots from the published image under assets/bootimage/ when this site equals the bake's (pack, modules, driver, config rows, settings); any difference boots plain. Off unless 1.

lets this object capture its own boot image; only the local bake rig sets it

off where the platform forbids caches.default (a WfP user Worker); on otherwise

the account the Cloudflare Email Sending HTTP API posts under

an API token with Email Sending: Edit; a secret, never a vars entry

the serving Worker version, reported on /health; absent under wrangler dev --local

0 stops rendering styles on upload while the binding stays

the front worker's compiled-plan tier; on unless 0

The origin public files are served from, when FILES has a custom domain. Empty serves through the Worker; a file not yet mirrored keeps the Worker URL.

ms a fresh interpreter runs no background PHP (fill, cron); default 60,000, 0 is off

Takes a heap image per pack generation so a cold boot can restore; off unless 1. A restore cost ~648 ms more cpuTime than a boot (1,912 vs 1,264 ms median, deployed free).

Image derivative engine: tinyimg (default) or images. images needs a zone with transformations and caps at 5,000 a month; only it encodes avif.

Whole-isolate drop threshold: linear memory plus the JS-side mount bytes. RECYCLE_ABOVE_BYTES reads linear memory alone, but the 128 MiB ceiling covers both.

messages one firing may send; capped at 25, because each is one of 50 subrequests

whether alarm() sends what cfwMail queued

the From address for a message that carries none; Drupal's site mail wins when set

auto | binding | api | smtp | off; auto takes the first configured transport

largest non-file request body the edge forwards, in bytes; default 2 MiB, 0 disables

largest multipart/form-data body the edge forwards, in bytes; default 100 MiB, 0 disables

1 logs memory readings at each boot and invocation end; for diagnosing a reset

Comma-separated path prefixes never answered from a previous generation. Added to the built-in deny-list, not replacing it; see staleAllowed().

The OIDC client secret. Never add it or the issuer (in cfw_meta) to KV_OVERRIDABLE: a KV writer could point logins at their own provider.

the opcache arm: file (shipping), shm or off; see src/runtime/opcache.ts

Refuses an outbound fetch to a private, loopback or metadata address; on unless 0. PHP names the URL, so any module chooses the destination; 0 is for the e2e rig.

Whether the Zend park may arm; on unless set to something other than 1. Arming routes every render through cfw_park_run, even when nothing yields.

PHP log level mirrored to console.log: off | error | warn | log | info | debug. Defaults to info; on 8.5 debug is mostly deprecation notices with stack traces.

logs every Drupal statement through console.log, which survives an object reset

first statement number to log, so a 256 KB tail budget covers the end of a long run

Brings an already-provisioned site up to the pack that ships today; on unless 0. The pack delivers only at provisioning, so off means pack fixes never arrive.

Linear memory above which the interpreter is dropped at the end of an invocation. Defaults to 112 MiB; past ~120 MiB it trades the boot it avoids for the reset it prevents.

redirect rules for the front worker, in the same two forms

The Redis endpoint as one URL, redis://user:pass@host:6379/0 (rediss:// for TLS). The endpoint is the operator's; PHP names an operation and never a host.

the lanes an upload's image styles are rendered on; see src/ops/render-lane.ts

Replica lanes a site has beyond the primary; 0 or unset means one object per site. Only the router reads it; an object's own role comes from its name.

How long a serving lane may go without pulling the primary's log; the staleness bound. A stalled lane looks healthy: the fence refuses only callers that state a freshness need.

Makes this object a read-only replica: every mutating host capability is refused. Off unless 1; a primary that silently refuses writes is a broken site.

response header rules for the front worker, as a JSON string or array; see edge-rules

A send_email binding, the only Cloudflare send that needs no credential. It reaches verified destination addresses only (200 per account), so it cannot mail visitors.

fragment assembly for authenticated GETs; on unless 0

Where a site's Durable Object is created: one of wnam enam sam weur eeur apac oc afr me. KV-overridable through settings; applies at creation only.

The scheme://host[:port] Drupal renders absolute URLs against. Unset, the object pins the first non-local origin; set it behind a proxy rewriting Host.

see sleepBudgetMs()

PLAIN | LOGIN

submission host for the third-party lane; a Cloudflare relay is refused

587 for starttls, 465 for implicit TLS; 25 is blocked on Workers and is refused

starttls | implicit | off

the app name on every record this site ships; defaults to drupal

syslog://collector:514 or syslogs://collector:6514 for RFC 5425 TLS

Where release history is fetched from when a site does not use drupal.org. Only the prefetch reads it; set it together with update.settings:fetch.url.

Lets a pool lane execute writes and forward them to the primary instead of refusing them. Off unless 1; the read path's safety argument does not cover forwarding.