Tier 5 production patterns implemented or documented for interview “extend it” answers.
RateLimiterDurable Object - one instance per client IP (cf-connecting-ip).- Token bucket persisted in DO storage (survives isolate restarts).
- Middleware falls back to in-memory bucket when
RATE_LIMITERis unbound (unit tests). /healthand/openapi.jsonare exempt.
CACHEKV namespace cachesGET /sessionsresponses (KV TTL 60s minimum; HTTPmax-age=15).- Version key per owner (
sessions:ver:<ownerId>) bumped onPOST/PATCH→ instant invalidation. - Response headers:
X-Cache: HIT|MISS,Cache-Control: private, max-age=15.
- JSON logs via
lib/logger.ts-level,message,traceId,cf-ray, path, env. X-Trace-Idon every response (cf-raywhen present, else UUID).- 500 responses include
traceIdfor support correlation.
GET /health- liveness (no DB).GET /health?deep=1- readiness:select 1via Hyperdrive/DATABASE_URL; 503 if DB down.
Neon read replicas + Hyperdrive:
- Create a Neon read replica branch for analytics/history-heavy routes.
- Add a second Hyperdrive config (
HYPERDRIVE_REPLICA) pointing at the replica. - Route read-only handlers (
GET /sessions,GET /sessions/:id) through replica connection; writes stay on primary. - Accept replication lag (typically ms–s) for list/history; live scores still use primary + WebSocket.
See PERFORMANCE.md for index/pagination notes.
Full pipeline design in MEDIA.md - R2 event → Queue → FFmpeg Container → HLS renditions → DB patch, with idempotency + DLQ.
| Binding | Type | Purpose |
|---|---|---|
RATE_LIMITER |
Durable Object | Per-IP rate limit |
CACHE |
KV | Session list cache |
HYPERDRIVE |
Hyperdrive | Pooled Postgres (primary) |
Create KV for deploy (run from apps/api - that is where wrangler.toml lives):
cd apps/api
npx wrangler kv namespace create oche-cache-staging --env staging
npx wrangler kv namespace create oche-cache-prod --env productionCopy each returned id into apps/api/wrangler.toml under [[env.staging.kv_namespaces]] and [[env.production.kv_namespaces]].
Local dev: no Cloudflare KV needed - wrangler dev simulates the namespace using the placeholder id in the root [[kv_namespaces]] block.
If you see Authentication error [code: 10000]: your CLOUDFLARE_API_TOKEN is missing or lacks permission. Create a token at Cloudflare API tokens with at least:
- Account → Workers KV Storage → Edit
- Account → Workers Scripts → Edit (for deploy)
Set in the repo root .env (or your shell):
CLOUDFLARE_ACCOUNT_ID=...
CLOUDFLARE_API_TOKEN=...
Then retry from apps/api.