# Generated server runtime

Podda accepts a prebuilt JavaScript ES-module Cloudflare Worker with a default export containing fetch(request, env). Arbitrary routes including /api/* are supported. Use createPoddaRouter from @deviselabs/podda-sdk/worker, or return explicit API 404/405 responses before using env.ASSETS.fetch(request) for genuine client assets. The Worker receives no direct storage binding or Podda credential.

Same-origin fetch calls to /__podda/v2 capability routes are intercepted by the trusted outbound and gateway layers and receive app/member context without exposing a credential to generated code. External HTTPS starts denied and requires an owner-confirmed exact-origin server grant. Redirects, raw sockets, alternate ports, private IPs, and WebSockets remain unavailable.

```js
export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    if (url.pathname !== "/api/count")
      return url.pathname.startsWith("/api/")
        ? Response.json({ error: { code: "ROUTE_NOT_FOUND" } }, { status: 404 })
        : env.ASSETS.fetch(request);
    const current = await fetch(new URL("/__podda/v2/kv/counter", request.url));
    if (request.method === "GET")
      return current.status === 404 ? Response.json({ count: 0 }) : current;
    return new Response("Method not allowed", { status: 405, headers: { Allow: "GET" } });
  }
};
```

The platform supplies only env.ASSETS. A packaged app may bundle `@deviselabs/podda-sdk/worker` at build time; runtime package installation is unavailable. Use same-origin capability URLs and never expect secrets, database bindings, Node APIs, or dynamic imports.

The entrypoint must be one bundled .js or .mjs JavaScript ESM file. TypeScript is supported after compilation. Python, Go, Rust, and other authoring languages are supported only when their toolchain emits that JavaScript artifact; there are no native Python, Go, Rust, or WASM runtimes. Run `npx podda verify <artifact-directory>` before packaging.