workers-best-practices

Fetch the latest Workers best practices page, workers-types, and wrangler config schema first, then check types, config, patterns, and security in order. Validate with `npx tsc --noEmit` and lint for no-floating-promises, and report findings with severity levels and line references.

Key anti-patterns include buffering unbounded responses with `await response.text()`, floating promises without await or waitUntil, module-level mutable request state, hardcoded secrets, `Math.random()` for tokens, and calling the Cloudflare REST API instead of using bindings.

Use wrangler.jsonc for new projects because newer Workers features are JSON-only and JSONC supports comments for documenting config decisions. TOML is legacy and should be flagged in new projects, though it remains acceptable in existing ones.

Destructuring `const { waitUntil } = ctx` loses the `this` binding that the method depends on, throwing "Illegal invocation" at runtime. Always call `ctx.waitUntil()` directly on the ExecutionContext object passed to your handler.

Module export handlers like fetch access bindings via the `env` parameter, while classes extending platform base classes like DurableObject or WorkerEntrypoint use `this.env`. Mixing these patterns is the most common binding access error.

Use Hyperdrive for all external PostgreSQL or MySQL connections from Workers. It maintains a regional connection pool that eliminates per-request TCP, TLS, and auth overhead of 300-500ms, and requires the nodejs_compat compatibility flag.