# Cloudflare Workers

The Cloudflare target generates a complete Hono-based API running on Cloudflare Workers with D1 as the database. This is the recommended target for production deployments.

## Configuration

```typescript
import { defineConfig, defineRuntime, defineDatabase, defineAuth } from "@quickback/compiler";

export default defineConfig({
  name: "my-app",
  template: "hono",
  features: ["organizations"],
  providers: {
    runtime: defineRuntime("cloudflare"),
    database: defineDatabase("cloudflare-d1"),
    auth: defineAuth("better-auth"),
  },
});
```

## Generated Output

```
src/
├── routes/           # Hono route handlers (one per resource, plus actions)
├── middleware/       # Auth, db, and services middleware
├── features/         # Per-feature schema, resource config, action handlers
├── lib/              # Generated runtime (errors, masks, scoped db, etag, access)
├── db/
│   └── schema.ts     # Drizzle schema
└── index.ts          # Hono app entry point

quickback/drizzle/
├── features/         # SQL migrations + meta/ for the features DB
├── auth/             # …for the Better Auth DB
├── files/            # …for the files DB
├── webhooks/         # …for the webhooks DB
└── audit/            # …for the audit DB
```

## Security Model

All four security layers run at the application level:

1. **Firewall** — Drizzle WHERE clauses for data isolation
2. **Access** — Role checks in middleware
3. **Guards** — Field filtering in request handlers
4. **Masking** — Response transformation before sending

Since D1 is only accessible through your Worker (no external connection string), the application layer is the only entry point. See [D1 Security Architecture](/platform/database/d1#security-architecture) for details.

## Features

- Full CRUD with batch operations (create, update, delete, upsert)
- Custom actions — one file per action, each exporting `defineAction({ … })`
- Soft delete with cascading to child tables
- Pagination, filtering, sorting, field selection, and full-text search
- Views (column-level projections with per-view access control)
- OpenAPI specification generation at `/openapi.json`

## Deployment

```bash
# Local development
npm run dev

# Apply migrations to remote D1
npm run db:migrate:remote

# Deploy to Cloudflare Workers
npm run deploy
```

## Environment & Bindings

Your `wrangler.toml` needs these bindings:

| Binding | Type | Required | Purpose |
|---------|------|----------|---------|
| `DB` | D1 | Yes | Feature database |
| `AUTH_DB` | D1 | Yes | Better Auth database |
| `AUDIT_DB` | D1 | No* | Unsafe cross-tenant action audit logs |
| `KV` | KV | Yes | Session storage |
| `R2` | R2 | No | File storage (avatars, uploads) |
| `AI` | Workers AI | No | Embeddings generation |
| `VECTORIZE` | Vectorize | No | Vector search index |
| `BROADCASTER` | Durable Object | No | Realtime broadcasts (inline DO) |

\* Required when you define cross-tenant unsafe actions.

## See Also

- [Cloudflare Template](/start/template-cloudflare) — Step-by-step setup guide with full wrangler.toml configuration
- [D1 Database](/platform/database/d1) — D1 setup, multi-database pattern, and security architecture
- [Neon Integration](/platform/database/neon) — Alternative: PostgreSQL via Hyperdrive