alchemy 2.0.0-beta.2 → 2.0.0-beta.21

package/src/Cloudflare/Workers/Worker.ts

@@ -2,6 +2,7 @@ import type * as cf from "@cloudflare/workers-types";
 import cloudflareRolldown from "@distilled.cloud/cloudflare-rolldown-plugin";
 import cloudflareVite from "@distilled.cloud/cloudflare-vite-plugin";
 import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as zones from "@distilled.cloud/cloudflare/zones";
 import type * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Data from "effect/Data";
@@ -15,18 +16,25 @@ import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import * as Socket from "effect/unstable/socket/Socket";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
 import type * as rolldown from "rolldown";
 import Sonda from "sonda/rolldown";
 import type * as vite from "vite";
 import * as Artifacts from "../../Artifacts.ts";
 import * as Binding from "../../Binding.ts";
+import {
+  isArtifacts as isArtifactsBinding,
+  type Artifacts as ArtifactsBinding,
+} from "../Artifacts/Artifacts.ts";
 import { hashDirectory, type MemoOptions } from "../../Build/Memo.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
 import type { HttpEffect } from "../../Http.ts";
-import type { Input, InputProps } from "../../Input.ts";
+import type { InputProps } from "../../Input.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import {
@@ -41,16 +49,28 @@ import { Resource, type ResourceBinding } from "../../Resource.ts";
 import { Self } from "../../Self.ts";
 import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
-import { Account } from "../Account.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { D1Database } from "../D1/D1Database.ts";
 import { fromCloudflareFetcher } from "../Fetcher.ts";
+import type { KVNamespace } from "../KV/KVNamespace.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
+import type { Queue as CloudflareQueue } from "../Queue/Queue.ts";
 import type { R2Bucket } from "../R2/R2Bucket.ts";
-import type { AssetsConfig, AssetsProps } from "./Assets.ts";
-import * as Assets from "./Assets.ts";
+import {
+  isAssets,
+  readAssets,
+  uploadAssets,
+  type Assets,
+  type AssetsConfig,
+  type AssetsProps,
+} from "./Assets.ts";
 import cloudflare_workers from "./cloudflare_workers.ts";
-import { isDurableObjectExport } from "./DurableObject.ts";
+import {
+  isDurableObjectExport,
+  isDurableObjectNamespaceLike,
+  type DurableObjectNamespaceLike,
+} from "./DurableObjectNamespace.ts";
 import { workersHttpHandler } from "./HttpServer.ts";
 import { Request } from "./Request.ts";
 import { makeRpcStub } from "./Rpc.ts";
@@ -105,12 +125,12 @@ export interface AssetsWithHash {
   /**
    * Path to the assets directory.
    */
-  path: Input<string>;
+  path: string;
   /**
    * Pre-computed hash of the assets. When provided, this hash is used for diffing
    * to determine if the worker needs to be redeployed.
    */
-  hash: Input<string>;
+  hash: string;
   /**
    * Optional assets configuration.
    */
@@ -157,11 +177,18 @@ export interface WorkerExecutionContext extends Serverless.FunctionContext {
   export(name: string, value: any): Effect.Effect<void>;
 }
 
-export type WorkerServices = Worker | WorkerEnvironment | Request;
+export type WorkerServices = Worker | Request;
 
-export type WorkerShape = Main<WorkerServices>;
+export type WorkerShape = Main<WorkerServices | WorkerEnvironment>;
 
-export type WorkerBindingResource = R2Bucket | D1Database;
+export type WorkerBindingResource =
+  | Assets
+  | R2Bucket
+  | D1Database
+  | KVNamespace
+  | CloudflareQueue
+  | ArtifactsBinding
+  | DurableObjectNamespaceLike<any>;
 
 export type WorkerBindings = {
   [bindingName in string]: WorkerBindingResource;
@@ -173,8 +200,26 @@ export type WorkerBindingProps = {
     | Effect.Effect<WorkerBindingResource, any, any>;
 };
 
+type NormalizedBindings<
+  Bindings extends WorkerBindingProps = {},
+  AssetsConfig extends WorkerAssetsConfig | undefined = undefined,
+> = {
+  [B in keyof Bindings]: Bindings[B] extends Effect.Effect<
+    infer T extends WorkerBindingResource,
+    any,
+    any
+  >
+    ? T
+    : Extract<Bindings[B], WorkerBindingResource>;
+} & (undefined extends AssetsConfig ? {} : { ASSETS: Assets });
+
+export type WorkerAssetsConfig = string | AssetsProps | AssetsWithHash;
+
 export interface WorkerProps<
   Bindings extends WorkerBindingProps = any,
+  Assets extends WorkerAssetsConfig | undefined =
+    | WorkerAssetsConfig
+    | undefined,
 > extends PlatformProps {
   /**
    * Worker name override. If omitted, Alchemy derives a deterministic physical
@@ -192,11 +237,7 @@ export interface WorkerProps<
    * - An AssetsProps object with directory and config
    * - An object with path and hash (e.g., from a Build resource)
    */
-  assets?:
-    | string
-    | AssetsProps
-    | AssetsWithHash
-    | (AssetsWithHash & { [K: string]: any });
+  assets?: Assets;
   subdomain?: {
     enabled?: boolean;
     previewsEnabled?: boolean;
@@ -219,12 +260,29 @@ export interface WorkerProps<
   env?: Record<string, string | Redacted.Redacted<string>>;
   exports?: string[];
   bindings?: Bindings;
+  /**
+   * One or more custom hostnames (e.g. `"app.example.com"`) to bind to this
+   * Worker. The Cloudflare Zone is inferred from the hostname — the zone must
+   * already exist in the account.
+   */
+  domain?: string | string[];
   build?: {
     /**
      * Whether to generate a metafile for the worker bundle.
      * @default false
      */
     metafile?: boolean;
+    /**
+     * Configures the {@link Bundle.purePlugin} which annotates top-level
+     * call/new expressions in matching packages with `/*#__PURE__*\/`
+     * so rolldown can tree-shake them.
+     *
+     * - `undefined` (default): plugin is enabled with default packages
+     *   (`effect`, `@effect/*`).
+     * - `PurePluginOptions`: plugin is enabled with the provided options.
+     * - `false`: plugin is disabled.
+     */
+    pure?: Bundle.BundleExtraOptions["pure"];
   };
 }
 
@@ -239,6 +297,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
     tags: string[] | undefined;
     durableObjectNamespaces: Record<string, string>;
     accountId: string;
+    domains: { hostname: string; id: string; zoneId: string }[];
     hash?: {
       assets: string | undefined;
       bundle: string | undefined;
@@ -256,17 +315,326 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * A Cloudflare Worker host with deploy-time binding support and runtime export
  * collection.
  *
- * `Worker` behaves like a resource during deploy, but it also carries a runtime
- * execution context so KV, R2, Durable Objects, assets, and service bindings
- * can be inferred from the worker program itself.
+ * A Worker follows a two-phase pattern. The outer `Effect.gen` runs at
+ * deploy time to bind resources (KV, R2, Durable Objects, etc.). It returns
+ * an object whose properties are the Worker's runtime handlers — `fetch` for
+ * HTTP requests and any additional RPC methods.
+ *
+ * ```typescript
+ * Effect.gen(function* () {
+ *   // Phase 1: bind resources (runs at deploy time)
+ *   const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *   return {
+ *     // Phase 2: runtime handlers (runs on each request)
+ *     fetch: Effect.gen(function* () {
+ *       const value = yield* kv.get("key");
+ *       return HttpServerResponse.text(value ?? "not found");
+ *     }),
+ *   };
+ * })
+ * ```
+ *
+ * There are three ways to define a Worker, from simplest to most
+ * flexible. See the {@link https://alchemy.run/concepts/platform | Platform concept}
+ * page for the full explanation.
+ *
+ * - **Async** — plain `async fetch` handler, no Effect runtime in the bundle.
+ * - **Effect** — Effect implementation passed directly, single file.
+ * - **Layer** — class and `.make()` in a single file; Rolldown tree-shakes `.make()` from consumers.
+ *
+ * @section Async Workers
+ * You don't have to use Effect for your runtime code. If you create
+ * a Worker resource with `main` pointing at a file but provide no
+ * `Effect.gen` implementation, Alchemy bundles and deploys that file
+ * as-is. Your handler is a plain `async fetch` — no Effect runtime
+ * is included in the bundle.
  *
- * @section Creating Workers
- * @example Basic Worker
+ * Use the `bindings` prop to declare which resources are available
+ * at runtime, and `Cloudflare.InferEnv` to extract a fully typed
+ * `env` object from those bindings.
+ *
+ * See the {@link https://alchemy.run/guides/async-worker | Async Workers Guide}
+ * for a comprehensive walkthrough of all binding types (R2, D1,
+ * Durable Objects, Assets, and more).
+ *
+ * @example Defining an async Worker in your stack
  * ```typescript
- * const worker = yield* Worker("ApiWorker", {
+ * // alchemy.run.ts
+ * const db = yield* Cloudflare.D1Database("DB");
+ * const bucket = yield* Cloudflare.R2Bucket("Bucket");
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ *
+ * export const Worker = Cloudflare.Worker("Worker", {
  *   main: "./src/worker.ts",
+ *   bindings: { db, bucket },
  * });
  * ```
+ *
+ * @example Writing the async handler
+ * ```typescript
+ * // src/worker.ts
+ * import type { WorkerEnv } from "../alchemy.run.ts";
+ *
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     if (request.method === "GET") {
+ *       const object = await env.bucket.get("key");
+ *       return new Response(object?.body ?? null);
+ *     }
+ *     return new Response("Not Found", { status: 404 });
+ *   },
+ * };
+ * ```
+ *
+ * @section Effect Workers
+ * Pass the Effect implementation as the third argument. This is the
+ * simplest Effect-based approach — everything lives in one file.
+ * Convenient for standalone Workers that don't need to be referenced
+ * by other Workers.
+ *
+ * @example Worker Effect
+ * ```typescript
+ * export default class MyWorker extends Cloudflare.Worker<MyWorker>()(
+ *   "MyWorker",
+ *   { main: import.meta.path },
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *     return {
+ *       // runtime: use them
+ *       fetch: Effect.gen(function* () {
+ *         const value = yield* kv.get("key");
+ *         return HttpServerResponse.text(value ?? "not found");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Worker Layer
+ * When two Workers need to reference each other (e.g. WorkerA calls
+ * WorkerB and vice versa), or you simply want optimal tree-shaking,
+ * define the Worker class separately from its `.make()` call. The
+ * class is a lightweight identifier; `.make()` provides the runtime
+ * implementation as an `export default`. Rolldown treats `.make()`
+ * as pure, so any Worker that imports the class to bind it will not
+ * pull in the `.make()` dependencies — the bundler tree-shakes
+ * them away entirely.
+ *
+ * The class and `.make()` can live in the same file. This is the
+ * same pattern used by `Container` and `DurableObjectNamespace`,
+ * and is recommended for any cross-Worker or cross-DO bindings.
+ *
+ * @example Worker Layer (class + .make() in one file)
+ * ```typescript
+ * // src/WorkerB.ts
+ * export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+ *   "WorkerB",
+ *   { main: import.meta.path },
+ * ) {}
+ *
+ * export default WorkerB.make(
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *     return {
+ *       // runtime: use them
+ *       greet: (name: string) =>
+ *         Effect.gen(function* () {
+ *           yield* kv.put("last-greeted", name);
+ *           return `Hello ${name}`;
+ *         }),
+ *     };
+ *   }),
+ * );
+ * ```
+ *
+ * @example Binding a Worker Layer from another Worker
+ * ```typescript
+ * // src/WorkerA.ts — imports WorkerB; bundler tree-shakes .make()
+ * import WorkerB from "./WorkerB.ts";
+ *
+ * export default class WorkerA extends Cloudflare.Worker<WorkerA>()(
+ *   "WorkerA",
+ *   { main: import.meta.path },
+ *   Effect.gen(function* () {
+ *     const b = yield* Cloudflare.Worker.bind(WorkerB);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         return yield* b.greet("world");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Configuration
+ * The props object controls compatibility flags, static assets, and
+ * build options. These are evaluated at deploy time.
+ *
+ * @example Enabling Node.js compatibility
+ * ```typescript
+ * {
+ *   main: import.meta.path,
+ *   compatibility: {
+ *     flags: ["nodejs_compat"],
+ *     date: "2026-03-17",
+ *   },
+ * }
+ * ```
+ *
+ * @example Serving static assets
+ * ```typescript
+ * {
+ *   main: import.meta.path,
+ *   assets: "./public",
+ * }
+ * ```
+ *
+ * @section R2 Bucket
+ * Bind an R2 bucket in the init phase with `Cloudflare.R2Bucket.bind`.
+ * The returned handle exposes `get`, `put`, `delete`, and `list`
+ * methods you can call in your runtime handlers.
+ *
+ * @example Binding and using R2
+ * ```typescript
+ * // init
+ * const bucket = yield* Cloudflare.R2Bucket.bind(MyBucket);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const request = yield* HttpServerRequest;
+ *     const key = request.url.split("/").pop()!;
+ *
+ *     if (request.method === "GET") {
+ *       const object = yield* bucket.get(key);
+ *       return object
+ *         ? HttpServerResponse.text(yield* object.text())
+ *         : HttpServerResponse.empty({ status: 404 });
+ *     }
+ *
+ *     yield* bucket.put(key, request.stream);
+ *     return HttpServerResponse.empty({ status: 201 });
+ *   }),
+ * };
+ * ```
+ *
+ * @section KV Namespace
+ * Bind a KV namespace with `Cloudflare.KVNamespace.bind`. KV provides
+ * eventually-consistent, low-latency key-value reads replicated
+ * globally across Cloudflare's edge.
+ *
+ * @example Binding and using KV
+ * ```typescript
+ * // init
+ * const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const value = yield* kv.get("my-key");
+ *     return HttpServerResponse.text(value ?? "not found");
+ *   }),
+ * };
+ * ```
+ *
+ * @section D1 Database
+ * Bind a D1 database with `Cloudflare.D1Connection.bind`. D1 is a
+ * serverless SQLite database — use `prepare` to build parameterized
+ * queries and `all`, `first`, or `run` to execute them.
+ *
+ * @example Binding and querying D1
+ * ```typescript
+ * // init
+ * const db = yield* Cloudflare.D1Connection.bind(MyDB);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const results = yield* db
+ *       .prepare("SELECT * FROM users WHERE id = ?")
+ *       .bind(userId)
+ *       .all();
+ *     return yield* HttpServerResponse.json(results);
+ *   }),
+ * };
+ * ```
+ *
+ * @section Durable Objects
+ * Yield a `DurableObjectNamespace` class in the init phase to get a
+ * namespace handle. Call `getByName` or `getById` to get a typed RPC
+ * stub, then call its methods from your runtime handlers.
+ *
+ * @example Using a Durable Object
+ * ```typescript
+ * // init
+ * const counters = yield* Counter;
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const counter = counters.getByName("user-123");
+ *     const value = yield* counter.increment();
+ *     return HttpServerResponse.text(String(value));
+ *   }),
+ * };
+ * ```
+ *
+ * @section Containers
+ * Containers run long-lived processes alongside Durable Objects. Bind
+ * one with `Cloudflare.Container.bind` and start it with
+ * `Cloudflare.start`. You can call typed methods on the running
+ * container or make HTTP requests to its exposed ports.
+ *
+ * @example Binding and starting a Container
+ * ```typescript
+ * // init (inside a DurableObjectNamespace)
+ * const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+ *
+ * return Effect.gen(function* () {
+ *   const container = yield* Cloudflare.start(sandbox);
+ *
+ *   return {
+ *     exec: (cmd: string) => container.exec(cmd),
+ *     fetch: Effect.gen(function* () {
+ *       const { fetch } = yield* container.getTcpPort(3000);
+ *       const res = yield* fetch(HttpClientRequest.get("http://container/"));
+ *       return HttpServerResponse.fromClientResponse(res);
+ *     }),
+ *   };
+ * });
+ * ```
+ *
+ * @section Dynamic Workers
+ * `DynamicWorkerLoader` lets you spin up ephemeral Workers at runtime
+ * from inline JavaScript modules. This is useful for sandboxing
+ * user-provided code or running untrusted scripts in isolation.
+ *
+ * @example Loading a dynamic Worker
+ * ```typescript
+ * // init
+ * const loader = yield* Cloudflare.DynamicWorkerLoader("Loader");
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const worker = loader.load({
+ *       compatibilityDate: "2026-01-28",
+ *       mainModule: "worker.js",
+ *       modules: {
+ *         "worker.js": `export default {
+ *           async fetch(req) { return new Response("sandboxed"); }
+ *         }`,
+ *       },
+ *     });
+ *
+ *     const res = yield* worker.fetch(
+ *       HttpClientRequest.get("https://worker/"),
+ *     );
+ *     return HttpServerResponse.fromClientResponse(res);
+ *   }),
+ * };
+ * ```
  */
 export const Worker: Platform<
   Worker,
@@ -274,19 +642,24 @@ export const Worker: Platform<
   WorkerShape,
   WorkerExecutionContext
 > & {
-  <const Bindings extends WorkerBindingProps>(
+  <
+    const Bindings extends WorkerBindingProps,
+    const Assets extends WorkerAssetsConfig | undefined = undefined,
+    Req = never,
+  >(
     id: string,
-    props: InputProps<WorkerProps<Bindings>>,
+    props:
+      | InputProps<WorkerProps<Bindings, Assets>>
+      | Effect.Effect<InputProps<WorkerProps<Bindings, Assets>>, never, Req>,
   ): Effect.Effect<
     Worker<{
-      [B in keyof Bindings]: Bindings[B] extends Effect.Effect<
-        infer T extends WorkerBindingResource,
-        any,
-        any
-      >
-        ? T
-        : Extract<Bindings[B], WorkerBindingResource>;
-    }>
+      [binding in keyof NormalizedBindings<
+        Bindings,
+        Assets
+      >]: NormalizedBindings<Bindings, Assets>[binding];
+    }>,
+    never,
+    Req | Providers
   >;
 } = Platform(WorkerTypeId, {
   onCreate: Effect.fnUntraced(function* (
@@ -303,31 +676,63 @@ export const Worker: Platform<
           ? yield* bindingEff
           : bindingEff;
 
-        const bindingMeta: InputProps<WorkerBinding> | undefined =
-          binding.Type === "Cloudflare.D1Database"
-            ? {
-                type: "d1",
-                id: binding.databaseId,
+        const bindingMeta: InputProps<WorkerBinding> | undefined = isAssets(
+          binding,
+        )
+          ? {
+              type: "assets",
+              name: bindingName,
+            }
+          : isArtifactsBinding(binding)
+            ? ({
+                type: "artifacts",
                 name: bindingName,
-              }
-            : binding.Type === "Cloudflare.R2Bucket"
+                namespace: binding.namespace,
+              } as any)
+            : isDurableObjectNamespaceLike(binding)
               ? {
-                  type: "r2_bucket",
+                  type: "durable_object_namespace",
                   name: bindingName,
-                  bucketName: binding.bucketName,
-                  jurisdiction: binding.jurisdiction.pipe(
-                    Output.map((jurisdiction) =>
-                      jurisdiction === "default" ? undefined : jurisdiction,
-                    ),
-                  ),
+                  className: binding.className ?? binding.name,
                 }
-              : // TODO(sam): handle others
-                undefined;
+              : binding.Type === "Cloudflare.D1Database"
+                ? {
+                    type: "d1",
+                    id: binding.databaseId,
+                    name: bindingName,
+                  }
+                : binding.Type === "Cloudflare.R2Bucket"
+                  ? {
+                      type: "r2_bucket",
+                      name: bindingName,
+                      bucketName: binding.bucketName,
+                      jurisdiction: binding.jurisdiction.pipe(
+                        Output.map((jurisdiction) =>
+                          jurisdiction === "default" ? undefined : jurisdiction,
+                        ),
+                      ),
+                    }
+                  : binding.Type === "Cloudflare.KVNamespace"
+                    ? {
+                        type: "kv_namespace",
+                        name: bindingName,
+                        namespaceId: binding.namespaceId,
+                      }
+                    : binding.Type === "Cloudflare.Queue"
+                      ? {
+                          type: "queue",
+                          name: bindingName,
+                          queueName: binding.queueName,
+                        }
+                      : // TODO(sam): handle others
+                        undefined;
 
         if (bindingMeta) {
           yield* resource.bind`${bindingName}`({
             bindings: [bindingMeta],
           });
+        } else {
+          return yield* Effect.die(`Unknown binding type: ${bindingName}`);
         }
       }
     }
@@ -357,8 +762,19 @@ export const Worker: Platform<
           Effect.map((json) => {
             try {
               const value = JSON.parse(json);
-              if (!Redacted.isRedacted(value)) {
-                return Redacted.make(value.value);
+              // The `set` path serializes Redacted values as
+              // `{_tag: "Redacted", value: ...}`. After JSON.parse the
+              // result is a plain object — `Redacted.isRedacted` would
+              // always return `false` on it — so detect the marker shape
+              // and rebuild the Redacted wrapper. Plain values pass
+              // through unchanged.
+              if (
+                value !== null &&
+                typeof value === "object" &&
+                (value as { _tag?: unknown })._tag === "Redacted" &&
+                "value" in (value as object)
+              ) {
+                return Redacted.make((value as { value: unknown }).value);
               }
               return value;
             } catch {
@@ -369,20 +785,29 @@ export const Worker: Platform<
       set: (id: string, output: Output.Output) =>
         Effect.sync(() => {
           const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
+          // Preserve `Redacted`-ness across the Output → env → Cloudflare
+          // binding boundary so the put-worker loop can deploy secrets via
+          // `secret_text` instead of leaking them as `plain_text`. The JSON
+          // payload still carries the `{_tag: "Redacted", …}` marker so the
+          // runtime `get` accessor can rebuild the wrapper after Cloudflare
+          // hands the binding back as a plain string.
           env[key] = output.pipe(
             Output.map((value) =>
               Redacted.isRedacted(value)
-                ? JSON.stringify({
-                    _tag: "Redacted",
-                    value: Redacted.value(value),
-                  })
+                ? Redacted.make(
+                    JSON.stringify({
+                      _tag: "Redacted",
+                      value: Redacted.value(value),
+                    }),
+                  )
                 : JSON.stringify(value),
             ),
           );
           return key;
         }),
-      serve: <Req = never>(handler: HttpEffect<Req>) =>
-        ctx.listen(workersHttpHandler(handler)),
+      serve: <Req = never>(
+        handler: HttpEffect<Req> | Effect.Effect<HttpEffect<Req>>,
+      ) => ctx.listen(workersHttpHandler(handler)),
       listen: ((
         handler:
           | Serverless.FunctionListener
@@ -548,11 +973,10 @@ export const WorkerProvider = () =>
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
 
-      const accountId = yield* Account;
+      const { accountId } = yield* CloudflareEnvironment;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
       const stack = yield* Stack;
 
-      const { read, upload } = yield* Assets.Assets;
       const createScriptSubdomain = yield* workers.createScriptSubdomain;
       const createScriptTail = yield* workers.createScriptTail;
       const deleteScript = yield* workers.deleteScript;
@@ -562,11 +986,17 @@ export const WorkerProvider = () =>
       const getSubdomain = yield* workers.getSubdomain;
       const listScripts = yield* workers.listScripts;
       const putScript = yield* workers.putScript;
+      const putDomain = yield* workers.putDomain;
+      const listDomains = yield* workers.listDomains;
+      const deleteDomain = yield* workers.deleteDomain;
+      const listZones = yield* zones.listZones;
       const telemetry = yield* CloudflareLogs;
-      const defaultCompatibilityDate = yield* Effect.promise(() =>
-        // @ts-expect-error no types for workerd
-        import("workerd").then((m) => m.compatibilityDate as string),
-      );
+      // TODO(sam): figure out why the later one from workerd breaks
+      const defaultCompatibilityDate = "2026-03-17";
+      // const defaultCompatibilityDate = yield* Effect.promise(() =>
+      //   // @ts-expect-error no types for workerd
+      //   import("workerd").then((m) => m.compatibilityDate as string),
+      // );
 
       const getAccountSubdomain = (accountId: string) =>
         getSubdomain({
@@ -588,6 +1018,108 @@ export const WorkerProvider = () =>
               maxLength: 54,
             }).pipe(Effect.map((name) => name.toLowerCase()));
 
+      // Convert non-ASCII hostnames (emoji, IDN, etc.) to punycode so the
+      // Cloudflare API receives the form it stores domains in. `new URL(...)`
+      // does IDNA via WHATWG URL parsing — `📦.alchemy.run` → `xn--5z8h.alchemy.run`.
+      const toPunycode = (hostname: string): string => {
+        try {
+          return new URL(`https://${hostname}`).hostname;
+        } catch {
+          return hostname;
+        }
+      };
+
+      const normalizeDomains = (
+        domain: string | string[] | undefined,
+      ): string[] =>
+        domain === undefined
+          ? []
+          : Array.from(
+              new Set(
+                (Array.isArray(domain) ? domain : [domain]).map(toPunycode),
+              ),
+            );
+
+      /**
+       * Infer the Cloudflare Zone ID for a given hostname by listing the
+       * account's zones and matching the hostname against each zone's name —
+       * walking up the DNS label hierarchy until a match is found.
+       */
+      const inferZoneIdForHostname = (
+        hostname: string,
+        zoneCache: Map<string, string>,
+      ) =>
+        Effect.gen(function* () {
+          const cached = zoneCache.get(hostname);
+          if (cached) return cached;
+
+          const zoneList = yield* listZones({}).pipe(
+            Effect.map((response) => response.result ?? []),
+          );
+          for (const zone of zoneList) {
+            zoneCache.set(zone.name, zone.id);
+          }
+
+          const parts = hostname.split(".");
+          for (let i = 0; i < parts.length - 1; i++) {
+            const candidate = parts.slice(i).join(".");
+            const match = zoneList.find((z) => z.name === candidate);
+            if (match) {
+              zoneCache.set(hostname, match.id);
+              return match.id;
+            }
+          }
+          return yield* Effect.die(
+            `Could not infer Cloudflare Zone for hostname "${hostname}". ` +
+              "Ensure the parent zone exists in this account.",
+          );
+        });
+
+      const reconcileDomains = (
+        scriptName: string,
+        desired: string[],
+        previous: Worker["Attributes"]["domains"],
+      ) =>
+        Effect.gen(function* () {
+          const desiredSet = new Set(desired);
+          const toRemove = previous.filter((p) => !desiredSet.has(p.hostname));
+          yield* Effect.all(
+            toRemove.map((d) =>
+              deleteDomain({ accountId, domainId: d.id }).pipe(
+                Effect.catchTag("DomainNotFound", () => Effect.void),
+              ),
+            ),
+            { concurrency: "unbounded" },
+          );
+
+          if (desired.length === 0) return [];
+
+          const zoneCache = new Map<string, string>();
+          const applied = yield* Effect.all(
+            desired.map((hostname) =>
+              Effect.gen(function* () {
+                const zoneId = yield* inferZoneIdForHostname(
+                  hostname,
+                  zoneCache,
+                );
+                const res = yield* putDomain({
+                  accountId,
+                  hostname,
+                  service: scriptName,
+                  zoneId,
+                });
+                return {
+                  hostname,
+                  id: res.id ?? "",
+                  zoneId: res.zoneId ?? zoneId,
+                };
+              }),
+            ),
+            { concurrency: "unbounded" },
+          );
+          return applied;
+        });
+
       const createAlchemyWorkerTags = (id: string) => [
         `alchemy:stack:${stack.name}`,
         `alchemy:stage:${stack.stage}`,
@@ -669,7 +1201,9 @@ export const WorkerProvider = () =>
       const prepareAssets = Effect.fnUntraced(function* (
         assets: WorkerProps["assets"],
       ) {
-        if (!assets) return undefined;
+        if (!assets) {
+          return undefined;
+        }
 
         // Handle AssetsWithHash (from Build resource)
         // Props are resolved by Plan, so Input<string> values are already strings at runtime
@@ -678,7 +1212,7 @@ export const WorkerProvider = () =>
           "path" in assets &&
           "hash" in assets
         ) {
-          const result = yield* read({
+          const result = yield* readAssets({
             directory: assets.path as string,
             config: assets.config,
           });
@@ -689,26 +1223,37 @@ export const WorkerProvider = () =>
         }
 
         // Handle string path or AssetsProps
-        return yield* read(
+        return yield* readAssets(
           typeof assets === "string" ? { directory: assets } : assets,
         );
       });
 
+      const getCompatibility = (props: WorkerProps) => ({
+        compatibilityDate:
+          props.compatibility?.date ?? defaultCompatibilityDate,
+        compatibilityFlags: props.compatibility?.flags
+          ? [
+              ...props.compatibility.flags,
+              ...(props.isExternal ? [] : ["nodejs_compat"]),
+            ].filter((value, index, self) => self.indexOf(value) === index)
+          : props.isExternal
+            ? []
+            : ["nodejs_compat"],
+      });
+
       const prepareBundle = (id: string, props: WorkerProps) =>
         Effect.gen(function* () {
           const main = yield* fs.realPath(props.main);
           const cwd = yield* findCwdForBundle(main);
+          const { compatibilityDate, compatibilityFlags } =
+            getCompatibility(props);
           const buildBundle = (plugins?: rolldown.RolldownPluginOption) =>
             Bundle.build(
               {
                 input: main,
                 cwd,
                 plugins: [
-                  cloudflareRolldown({
-                    compatibilityDate:
-                      props.compatibility?.date ?? defaultCompatibilityDate,
-                    compatibilityFlags: props.compatibility?.flags,
-                  }),
+                  cloudflareRolldown({ compatibilityDate, compatibilityFlags }),
                   plugins,
                   ...(props.build?.metafile ? [Sonda({ open: false })] : []),
                 ],
@@ -724,6 +1269,7 @@ export const WorkerProvider = () =>
                 keepNames: true,
                 dir: `.alchemy/bundles/${id}`,
               },
+              { pure: props.build?.pure },
             );
 
           if (props.isExternal) {
@@ -760,8 +1306,8 @@ import * as Stream from "effect/Stream";
 import { env, DurableObject${hasWfClasses ? ", WorkflowEntrypoint" : ""} } from "cloudflare:workers";
 import { MinimumLogLevel } from "effect/References";
 import { NodeServices } from "@effect/platform-node";
-import { Stack } from "alchemy-effect/Stack";
-import { WorkerEnvironment, makeDurableObjectBridge${hasWfClasses ? ", makeWorkflowBridge" : ""}, ExportedHandlerMethods } from "alchemy-effect/Cloudflare";
+import { Stack } from "alchemy/Stack";
+import { WorkerEnvironment, makeDurableObjectBridge${hasWfClasses ? ", makeWorkflowBridge" : ""}, ExportedHandlerMethods } from "alchemy/Cloudflare";
 
 import entry from "${importPath}";
 
@@ -790,7 +1336,6 @@ const stack = Layer.succeed(
 
 const exportsEffect = tag.asEffect().pipe(
   Effect.flatMap(func => func.ExecutionContext.exports),
-  Effect.map(exports => exports),
   Effect.provide(
     layer.pipe(
       Layer.provideMerge(stack),
@@ -863,11 +1408,13 @@ ${[
         }).pipe(Artifacts.cached("build"));
 
       const viteBuild = Effect.fnUntraced(function* (props: WorkerProps) {
-        const vite = yield* Effect.promise(() => import("vite"));
         let assetsDirectory: string | undefined;
         let serverBundle: vite.Rolldown.OutputBundle | undefined;
+        const { compatibilityDate, compatibilityFlags } =
+          getCompatibility(props);
 
         yield* Effect.promise(async () => {
+          const vite = await loadVite();
           const builder = await vite.createBuilder(
             {
               root: props.vite?.rootDir,
@@ -888,9 +1435,8 @@ ${[
               },
               plugins: [
                 cloudflareVite({
-                  compatibilityDate:
-                    props.compatibility?.date ?? defaultCompatibilityDate,
-                  compatibilityFlags: props.compatibility?.flags,
+                  compatibilityDate,
+                  compatibilityFlags,
                 }),
                 {
                   name: "output:ssr",
@@ -927,7 +1473,7 @@ ${[
         const [assets, bundle] = yield* Effect.all(
           [
             assetsDirectory
-              ? read({
+              ? readAssets({
                   directory: assetsDirectory,
                   config:
                     typeof props.assets === "object" && "config" in props.assets
@@ -1007,7 +1553,12 @@ ${[
             yield* Effect.logInfo(
               `Cloudflare Worker ${olds ? "update" : "create"}: uploading assets for ${name}`,
             );
-            const { jwt } = yield* upload(accountId, name, assets, session);
+            const { jwt } = yield* uploadAssets(
+              accountId,
+              name,
+              assets,
+              session,
+            );
             metadataAssets = {
               jwt,
               config: assets.config,
@@ -1209,8 +1760,7 @@ ${[
           assets: metadataAssets,
           bindings: metadataBindings,
           bodyPart: undefined,
-          compatibilityDate: news.compatibility?.date ?? "2026-03-10",
-          compatibilityFlags: news.compatibility?.flags,
+          ...getCompatibility(news),
           containers:
             metadataContainers.length > 0 ? metadataContainers : undefined,
           keepAssets,
@@ -1281,6 +1831,18 @@ ${[
           );
           yield* setWorkerSubdomain(name, enable);
         }
+        const desiredDomains = normalizeDomains(news.domain);
+        const previousDomains = output?.domains ?? [];
+        if (desiredDomains.length > 0 || previousDomains.length > 0) {
+          yield* session.note(
+            `Reconciling custom domains (${desiredDomains.length}) ...`,
+          );
+        }
+        const domains = yield* reconcileDomains(
+          name,
+          desiredDomains,
+          previousDomains,
+        );
         return {
           workerId: worker.id ?? name,
           workerName: name,
@@ -1292,6 +1854,7 @@ ${[
           tags: settings.tags ?? metadata.tags,
           durableObjectNamespaces,
           accountId,
+          domains,
           hash,
         } satisfies Worker["Attributes"];
       });
@@ -1337,7 +1900,14 @@ ${[
           if (!output) {
             return;
           }
-          if (yield* hasChanged(id, news, output)) {
+          const newDomains = normalizeDomains(news.domain).sort();
+          const oldDomains = (output?.domains ?? [])
+            .map((d) => d.hostname)
+            .sort();
+          const domainsChanged =
+            newDomains.length !== oldDomains.length ||
+            newDomains.some((d, i) => d !== oldDomains[i]);
+          if (domainsChanged || (yield* hasChanged(id, news, output))) {
             return {
               action: "update",
               stables:
@@ -1416,9 +1986,7 @@ ${[
                         className,
                       }))
                     : undefined,
-                compatibilityDate:
-                  news.compatibility?.date ?? defaultCompatibilityDate,
-                compatibilityFlags: news.compatibility?.flags,
+                ...getCompatibility(news),
                 containers,
                 migrations:
                   doClasses.length > 0
@@ -1466,6 +2034,7 @@ ${[
             tags: existingSettings?.tags ?? tags,
             durableObjectNamespaces,
             accountId,
+            domains: [],
           } satisfies Worker["Attributes"];
         }),
         read: Effect.fnUntraced(
@@ -1475,23 +2044,28 @@ ${[
             yield* Effect.logInfo(
               `Cloudflare Worker read: checking ${workerName}`,
             );
-            const [worker, subdomain, settings] = yield* Effect.all([
-              listScripts({
-                accountId,
-              }).pipe(
-                Effect.map((workers) =>
-                  workers.result.find((worker) => worker.id === workerName),
+            const [worker, subdomain, settings, domainsList] =
+              yield* Effect.all([
+                listScripts({
+                  accountId,
+                }).pipe(
+                  Effect.map((workers) =>
+                    workers.result.find((worker) => worker.id === workerName),
+                  ),
                 ),
-              ),
-              getScriptSubdomain({
-                accountId,
-                scriptName: workerName,
-              }),
-              getScriptSettings({
-                accountId,
-                scriptName: workerName,
-              }),
-            ]);
+                getScriptSubdomain({
+                  accountId,
+                  scriptName: workerName,
+                }),
+                getScriptSettings({
+                  accountId,
+                  scriptName: workerName,
+                }),
+                listDomains({
+                  accountId,
+                  service: workerName,
+                }).pipe(Effect.map((r) => r.result ?? [])),
+              ]);
             if (!worker) {
               yield* Effect.logInfo(
                 `Cloudflare Worker read: ${workerName} not found in script list`,
@@ -1513,6 +2087,11 @@ ${[
               durableObjectNamespaces: getDurableObjectNamespaces(
                 settings.bindings,
               ),
+              domains: domainsList.flatMap((d) =>
+                d.id && d.hostname && d.zoneId
+                  ? [{ id: d.id, hostname: d.hostname, zoneId: d.zoneId }]
+                  : [],
+              ),
             } satisfies Worker["Attributes"];
           },
           (effect) =>
@@ -1614,6 +2193,17 @@ ${[
           yield* Effect.logInfo(
             `Cloudflare Worker delete: deleting ${output.workerName}`,
           );
+          if (output.domains?.length) {
+            yield* Effect.all(
+              output.domains.map((d) =>
+                deleteDomain({
+                  accountId: output.accountId,
+                  domainId: d.id,
+                }).pipe(Effect.catchTag("DomainNotFound", () => Effect.void)),
+              ),
+              { concurrency: "unbounded" },
+            );
+          }
           yield* deleteScript({
             accountId: output.accountId,
             scriptName: output.workerName,
@@ -1759,3 +2349,33 @@ const contentTypeFromExtension = (extension: string) => {
       return "application/octet-stream";
   }
 };
+
+type ViteModule = typeof import("vite");
+let _viteModule: ViteModule | null = null;
+
+/**
+ * Dynamically load Vite from the project root. Falls back to the bundled
+ * copy if the project doesn't have its own Vite installation.
+ */
+async function loadVite(): Promise<ViteModule> {
+  if (_viteModule) return _viteModule;
+
+  const projectRoot = process.cwd();
+  let vitePath: string;
+
+  try {
+    // Resolve "vite" from the project root, not from vinext's location
+    const require = createRequire(path.join(projectRoot, "package.json"));
+    vitePath = require.resolve("vite");
+  } catch {
+    // Fallback: use the Vite that ships with vinext (works for non-linked installs)
+    vitePath = "vite";
+  }
+
+  // On Windows, absolute paths must be file:// URLs for ESM import().
+  // The fallback ("vite") is a bare specifier and works as-is.
+  const viteUrl = vitePath === "vite" ? vitePath : pathToFileURL(vitePath).href;
+  const vite = (await import(/* @vite-ignore */ viteUrl)) as ViteModule;
+  _viteModule = vite;
+  return vite;
+}