alchemy 2.0.0-beta.3 → 2.0.0-beta.30

package/lib/Cloudflare/Workers/Worker.js

@@ -0,0 +1,1701 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import cloudflareRolldown from "@distilled.cloud/cloudflare-rolldown-plugin";
+import cloudflareVite from "@distilled.cloud/cloudflare-vite-plugin";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as zones from "@distilled.cloud/cloudflare/zones";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Queue from "effect/Queue";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as Socket from "effect/unstable/socket/Socket";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import Sonda from "sonda/rolldown";
+import { AlchemyContext } from "../../AlchemyContext.js";
+import * as Artifacts from "../../Artifacts.js";
+import * as Binding from "../../Binding.js";
+import { isArtifacts as isArtifactsBinding, } from "../Artifacts/Artifacts.js";
+import { hashDirectory } from "../../Build/Memo.js";
+import * as Bundle from "../../Bundle/Bundle.js";
+import { findCwdForBundle } from "../../Bundle/TempRoot.js";
+import { isResolved } from "../../Diff.js";
+import * as Output from "../../Output.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import { Platform, } from "../../Platform.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { Self } from "../../Self.js";
+import * as Serverless from "../../Serverless/index.js";
+import { Stack } from "../../Stack.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+import { D1Database } from "../D1/D1Database.js";
+import { fromCloudflareFetcher } from "../Fetcher.js";
+import { SidecarLive } from "../Local/Sidecar.js";
+import { CloudflareLogs } from "../Logs.js";
+import { isAssets, readAssets, uploadAssets, } from "./Assets.js";
+import cloudflare_workers from "./cloudflare_workers.js";
+import { isDurableObjectExport, isDurableObjectNamespaceLike, } from "./DurableObjectNamespace.js";
+import { workersHttpHandler } from "./HttpServer.js";
+import { LocalWorkerProvider } from "./LocalWorkerProvider.js";
+import { Request } from "./Request.js";
+import { makeRpcStub } from "./Rpc.js";
+import { isWorkflowExport } from "./Workflow.js";
+const WorkerTypeId = "Cloudflare.Worker";
+export const isWorker = (value) => typeof value === "object" &&
+    value !== null &&
+    "Type" in value &&
+    value.Type === WorkerTypeId;
+export class WorkerEnvironment extends Context.Service()("Cloudflare.Workers.WorkerEnvironment") {
+}
+export const WorkerEnvironmentLive = Layer.effect(WorkerEnvironment, cloudflare_workers.pipe(Effect.map((m) => m.env)));
+export class ExecutionContext extends Context.Service()("Cloudflare.Workers.ExecutionContext") {
+}
+export const isWorkerEvent = (value) => value?.kind === "Cloudflare.Workers.WorkerEvent";
+export const ExportedHandlerMethods = [
+    "fetch",
+    "tail",
+    "trace",
+    "tailStream",
+    "scheduled",
+    "test",
+    "email",
+    "queue",
+];
+/**
+ * A Cloudflare Worker host with deploy-time binding support and runtime export
+ * collection.
+ *
+ * A Worker follows a two-phase pattern. The outer `Effect.gen` runs at
+ * deploy time to bind resources (KV, R2, Durable Objects, etc.). It returns
+ * an object whose properties are the Worker's runtime handlers — `fetch` for
+ * HTTP requests and any additional RPC methods.
+ *
+ * ```typescript
+ * Effect.gen(function* () {
+ *   // Phase 1: bind resources (runs at deploy time)
+ *   const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *   return {
+ *     // Phase 2: runtime handlers (runs on each request)
+ *     fetch: Effect.gen(function* () {
+ *       const value = yield* kv.get("key");
+ *       return HttpServerResponse.text(value ?? "not found");
+ *     }),
+ *   };
+ * })
+ * ```
+ *
+ * There are three ways to define a Worker, from simplest to most
+ * flexible. See the {@link https://alchemy.run/concepts/platform | Platform concept}
+ * page for the full explanation.
+ *
+ * - **Async** — plain `async fetch` handler, no Effect runtime in the bundle.
+ * - **Effect** — Effect implementation passed directly, single file.
+ * - **Layer** — class and `.make()` in a single file; Rolldown tree-shakes `.make()` from consumers.
+ *
+ * @section Async Workers
+ * You don't have to use Effect for your runtime code. If you create
+ * a Worker resource with `main` pointing at a file but provide no
+ * `Effect.gen` implementation, Alchemy bundles and deploys that file
+ * as-is. Your handler is a plain `async fetch` — no Effect runtime
+ * is included in the bundle.
+ *
+ * Use the `bindings` prop to declare which resources are available
+ * at runtime, and `Cloudflare.InferEnv` to extract a fully typed
+ * `env` object from those bindings.
+ *
+ * See the {@link https://alchemy.run/guides/async-worker | Async Workers Guide}
+ * for a comprehensive walkthrough of all binding types (R2, D1,
+ * Durable Objects, Assets, and more).
+ *
+ * @example Defining an async Worker in your stack
+ * ```typescript
+ * // alchemy.run.ts
+ * const db = yield* Cloudflare.D1Database("DB");
+ * const bucket = yield* Cloudflare.R2Bucket("Bucket");
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ *
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { db, bucket },
+ * });
+ * ```
+ *
+ * @example Writing the async handler
+ * ```typescript
+ * // src/worker.ts
+ * import type { WorkerEnv } from "../alchemy.run.ts";
+ *
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     if (request.method === "GET") {
+ *       const object = await env.bucket.get("key");
+ *       return new Response(object?.body ?? null);
+ *     }
+ *     return new Response("Not Found", { status: 404 });
+ *   },
+ * };
+ * ```
+ *
+ * @section Effect Workers
+ * Pass the Effect implementation as the third argument. This is the
+ * simplest Effect-based approach — everything lives in one file.
+ * Convenient for standalone Workers that don't need to be referenced
+ * by other Workers.
+ *
+ * @example Worker Effect
+ * ```typescript
+ * export default class MyWorker extends Cloudflare.Worker<MyWorker>()(
+ *   "MyWorker",
+ *   { main: import.meta.path },
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *     return {
+ *       // runtime: use them
+ *       fetch: Effect.gen(function* () {
+ *         const value = yield* kv.get("key");
+ *         return HttpServerResponse.text(value ?? "not found");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Worker Layer
+ * When two Workers need to reference each other (e.g. WorkerA calls
+ * WorkerB and vice versa), or you simply want optimal tree-shaking,
+ * define the Worker class separately from its `.make()` call. The
+ * class is a lightweight identifier; `.make()` provides the runtime
+ * implementation as an `export default`. Rolldown treats `.make()`
+ * as pure, so any Worker that imports the class to bind it will not
+ * pull in the `.make()` dependencies — the bundler tree-shakes
+ * them away entirely.
+ *
+ * The class and `.make()` can live in the same file. This is the
+ * same pattern used by `Container` and `DurableObjectNamespace`,
+ * and is recommended for any cross-Worker or cross-DO bindings.
+ *
+ * @example Worker Layer (class + .make() in one file)
+ * ```typescript
+ * // src/WorkerB.ts
+ * export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+ *   "WorkerB",
+ *   { main: import.meta.path },
+ * ) {}
+ *
+ * export default WorkerB.make(
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *     return {
+ *       // runtime: use them
+ *       greet: (name: string) =>
+ *         Effect.gen(function* () {
+ *           yield* kv.put("last-greeted", name);
+ *           return `Hello ${name}`;
+ *         }),
+ *     };
+ *   }),
+ * );
+ * ```
+ *
+ * @example Binding a Worker Layer from another Worker
+ * ```typescript
+ * // src/WorkerA.ts — imports WorkerB; bundler tree-shakes .make()
+ * import WorkerB from "./WorkerB.ts";
+ *
+ * export default class WorkerA extends Cloudflare.Worker<WorkerA>()(
+ *   "WorkerA",
+ *   { main: import.meta.path },
+ *   Effect.gen(function* () {
+ *     const b = yield* Cloudflare.Worker.bind(WorkerB);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         return yield* b.greet("world");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Configuration
+ * The props object controls compatibility flags, static assets, and
+ * build options. These are evaluated at deploy time.
+ *
+ * @example Enabling Node.js compatibility
+ * ```typescript
+ * {
+ *   main: import.meta.path,
+ *   compatibility: {
+ *     flags: ["nodejs_compat"],
+ *     date: "2026-03-17",
+ *   },
+ * }
+ * ```
+ *
+ * @example Serving static assets
+ * ```typescript
+ * {
+ *   main: import.meta.path,
+ *   assets: "./public",
+ * }
+ * ```
+ *
+ * @section R2 Bucket
+ * Bind an R2 bucket in the init phase with `Cloudflare.R2Bucket.bind`.
+ * The returned handle exposes `get`, `put`, `delete`, and `list`
+ * methods you can call in your runtime handlers.
+ *
+ * @example Binding and using R2
+ * ```typescript
+ * // init
+ * const bucket = yield* Cloudflare.R2Bucket.bind(MyBucket);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const request = yield* HttpServerRequest;
+ *     const key = request.url.split("/").pop()!;
+ *
+ *     if (request.method === "GET") {
+ *       const object = yield* bucket.get(key);
+ *       return object
+ *         ? HttpServerResponse.text(yield* object.text())
+ *         : HttpServerResponse.empty({ status: 404 });
+ *     }
+ *
+ *     yield* bucket.put(key, request.stream);
+ *     return HttpServerResponse.empty({ status: 201 });
+ *   }),
+ * };
+ * ```
+ *
+ * @section KV Namespace
+ * Bind a KV namespace with `Cloudflare.KVNamespace.bind`. KV provides
+ * eventually-consistent, low-latency key-value reads replicated
+ * globally across Cloudflare's edge.
+ *
+ * @example Binding and using KV
+ * ```typescript
+ * // init
+ * const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const value = yield* kv.get("my-key");
+ *     return HttpServerResponse.text(value ?? "not found");
+ *   }),
+ * };
+ * ```
+ *
+ * @section D1 Database
+ * Bind a D1 database with `Cloudflare.D1Connection.bind`. D1 is a
+ * serverless SQLite database — use `prepare` to build parameterized
+ * queries and `all`, `first`, or `run` to execute them.
+ *
+ * @example Binding and querying D1
+ * ```typescript
+ * // init
+ * const db = yield* Cloudflare.D1Connection.bind(MyDB);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const results = yield* db
+ *       .prepare("SELECT * FROM users WHERE id = ?")
+ *       .bind(userId)
+ *       .all();
+ *     return yield* HttpServerResponse.json(results);
+ *   }),
+ * };
+ * ```
+ *
+ * @section Durable Objects
+ * Yield a `DurableObjectNamespace` class in the init phase to get a
+ * namespace handle. Call `getByName` or `getById` to get a typed RPC
+ * stub, then call its methods from your runtime handlers.
+ *
+ * @example Using a Durable Object
+ * ```typescript
+ * // init
+ * const counters = yield* Counter;
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const counter = counters.getByName("user-123");
+ *     const value = yield* counter.increment();
+ *     return HttpServerResponse.text(String(value));
+ *   }),
+ * };
+ * ```
+ *
+ * @section Containers
+ * Containers run long-lived processes alongside Durable Objects. Bind
+ * one with `Cloudflare.Container.bind` and start it with
+ * `Cloudflare.start`. You can call typed methods on the running
+ * container or make HTTP requests to its exposed ports.
+ *
+ * @example Binding and starting a Container
+ * ```typescript
+ * // init (inside a DurableObjectNamespace)
+ * const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+ *
+ * return Effect.gen(function* () {
+ *   const container = yield* Cloudflare.start(sandbox);
+ *
+ *   return {
+ *     exec: (cmd: string) => container.exec(cmd),
+ *     fetch: Effect.gen(function* () {
+ *       const { fetch } = yield* container.getTcpPort(3000);
+ *       const res = yield* fetch(HttpClientRequest.get("http://container/"));
+ *       return HttpServerResponse.fromClientResponse(res);
+ *     }),
+ *   };
+ * });
+ * ```
+ *
+ * @section Dynamic Workers
+ * `DynamicWorkerLoader` lets you spin up ephemeral Workers at runtime
+ * from inline JavaScript modules. This is useful for sandboxing
+ * user-provided code or running untrusted scripts in isolation.
+ *
+ * @example Loading a dynamic Worker
+ * ```typescript
+ * // init
+ * const loader = yield* Cloudflare.DynamicWorkerLoader("Loader");
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const worker = loader.load({
+ *       compatibilityDate: "2026-01-28",
+ *       mainModule: "worker.js",
+ *       modules: {
+ *         "worker.js": `export default {
+ *           async fetch(req) { return new Response("sandboxed"); }
+ *         }`,
+ *       },
+ *     });
+ *
+ *     const res = yield* worker.fetch(
+ *       HttpClientRequest.get("https://worker/"),
+ *     );
+ *     return HttpServerResponse.fromClientResponse(res);
+ *   }),
+ * };
+ * ```
+ */
+export const Worker = Platform(WorkerTypeId, {
+    onCreate: Effect.fnUntraced(function* (resource, props) {
+        if (props.bindings) {
+            for (const bindingName in props.bindings) {
+                // @ts-expect-error
+                const bindingEff = props.bindings?.[bindingName];
+                const binding = Effect.isEffect(bindingEff)
+                    ? yield* bindingEff
+                    : bindingEff;
+                const bindingMeta = isAssets(binding)
+                    ? {
+                        type: "assets",
+                        name: bindingName,
+                    }
+                    : isArtifactsBinding(binding)
+                        ? {
+                            type: "artifacts",
+                            name: bindingName,
+                            namespace: binding.namespace,
+                        }
+                        : isDurableObjectNamespaceLike(binding)
+                            ? {
+                                type: "durable_object_namespace",
+                                name: bindingName,
+                                className: binding.className ?? binding.name,
+                            }
+                            : binding.Type === "Cloudflare.D1Database"
+                                ? {
+                                    type: "d1",
+                                    id: binding.databaseId,
+                                    name: bindingName,
+                                }
+                                : binding.Type === "Cloudflare.R2Bucket"
+                                    ? {
+                                        type: "r2_bucket",
+                                        name: bindingName,
+                                        bucketName: binding.bucketName,
+                                        jurisdiction: binding.jurisdiction.pipe(Output.map((jurisdiction) => jurisdiction === "default" ? undefined : jurisdiction)),
+                                    }
+                                    : binding.Type === "Cloudflare.KVNamespace"
+                                        ? {
+                                            type: "kv_namespace",
+                                            name: bindingName,
+                                            namespaceId: binding.namespaceId,
+                                        }
+                                        : binding.Type === "Cloudflare.Queue"
+                                            ? {
+                                                type: "queue",
+                                                name: bindingName,
+                                                queueName: binding.queueName,
+                                            }
+                                            : binding.Type === "Cloudflare.AiGateway"
+                                                ? {
+                                                    type: "ai",
+                                                    name: bindingName,
+                                                }
+                                                : // TODO(sam): handle others
+                                                    undefined;
+                if (bindingMeta) {
+                    yield* resource.bind `${bindingName}`({
+                        bindings: [bindingMeta],
+                    });
+                }
+                else {
+                    return yield* Effect.die(`Unknown binding type: ${bindingName}`);
+                }
+            }
+        }
+    }),
+    createExecutionContext: (id) => {
+        const listeners = [];
+        const exports = {};
+        const env = {};
+        const ctx = {
+            Type: WorkerTypeId,
+            id,
+            env,
+            get: (key) => Effect.serviceOption(WorkerEnvironment).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((env) => env
+                ? Effect.succeed(env[key])
+                : Effect.die("WorkerEnvironment not found")), Effect.flatMap((value) => value
+                ? Effect.succeed(value)
+                : Effect.die(`Environment variable '${key}' not found`)), Effect.map((json) => {
+                try {
+                    const value = JSON.parse(json);
+                    // The `set` path serializes Redacted values as
+                    // `{_tag: "Redacted", value: ...}`. After JSON.parse the
+                    // result is a plain object — `Redacted.isRedacted` would
+                    // always return `false` on it — so detect the marker shape
+                    // and rebuild the Redacted wrapper. Plain values pass
+                    // through unchanged.
+                    if (value !== null &&
+                        typeof value === "object" &&
+                        value._tag === "Redacted" &&
+                        "value" in value) {
+                        return Redacted.make(value.value);
+                    }
+                    return value;
+                }
+                catch {
+                    return json;
+                }
+            })),
+            set: (id, output) => Effect.sync(() => {
+                const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
+                // Preserve `Redacted`-ness across the Output → env → Cloudflare
+                // binding boundary so the put-worker loop can deploy secrets via
+                // `secret_text` instead of leaking them as `plain_text`. The JSON
+                // payload still carries the `{_tag: "Redacted", …}` marker so the
+                // runtime `get` accessor can rebuild the wrapper after Cloudflare
+                // hands the binding back as a plain string.
+                env[key] = output.pipe(Output.map((value) => Redacted.isRedacted(value)
+                    ? Redacted.make(JSON.stringify({
+                        _tag: "Redacted",
+                        value: Redacted.value(value),
+                    }))
+                    : JSON.stringify(value)));
+                return key;
+            }),
+            serve: (handler) => ctx.listen(workersHttpHandler(handler)),
+            listen: ((handler) => Effect.sync(() => Effect.isEffect(handler)
+                ? listeners.push(handler)
+                : listeners.push(Effect.succeed(handler)))),
+            export: (name, value) => Effect.sync(() => {
+                exports[name] = value;
+            }),
+            exports: Effect.gen(function* () {
+                const handlers = yield* Effect.all(listeners, {
+                    concurrency: "unbounded",
+                });
+                const services = yield* Effect.context();
+                const handle = (type) => (request, env, context) => {
+                    const event = {
+                        kind: "Cloudflare.Workers.WorkerEvent",
+                        type,
+                        input: request,
+                        env,
+                        context,
+                    };
+                    for (const handler of handlers) {
+                        const eff = handler(event);
+                        if (Effect.isEffect(eff)) {
+                            return eff.pipe(Effect.provideContext(services), Effect.provide(Layer.succeed(ExecutionContext, context)), Effect.runPromise);
+                        }
+                    }
+                    return Promise.reject(new Error("No event handler found"));
+                };
+                return {
+                    ...exports,
+                    default: Object.fromEntries(ExportedHandlerMethods.map((method) => [method, handle(method)])),
+                };
+            }),
+        };
+        return ctx;
+    },
+});
+export const bindWorker = Effect.fnUntraced(function* (workerEff) {
+    const worker = Effect.isEffect(workerEff) ? yield* workerEff : workerEff;
+    const self = yield* Worker;
+    yield* self.bind `${worker}`({
+        bindings: [
+            {
+                type: "service",
+                name: worker.LogicalId,
+                service: worker.workerName,
+            },
+        ],
+    });
+    const workerBinding = WorkerEnvironment.asEffect().pipe(Effect.map((env) => env[worker.LogicalId]));
+    const fetcher = workerBinding.pipe(Effect.map(fromCloudflareFetcher));
+    // TODO(sam): update makeRpcStub to support lazily evaluating the Effect<Fetcher>
+    return makeRpcStub(fetcher);
+});
+export class BindWorkerPolicy extends Binding.Policy()("Cloudflare.Worker.Bind") {
+}
+export const BindWorkerPolicyLive = BindWorkerPolicy.layer.succeed(Effect.fn(function* (host, worker) {
+    if (isWorker(host)) {
+        yield* host.bind `${worker}`({
+            bindings: [
+                {
+                    type: "service",
+                    name: worker.LogicalId,
+                    service: worker.workerName,
+                },
+            ],
+        });
+    }
+    else {
+        return yield* Effect.die(new Error(`BindWorkerPolicy does not support runtime '${host.Type}'`));
+    }
+}));
+class MissingDurableObjectNamespaces extends Data.TaggedError("MissingDurableObjectNamespaces") {
+}
+function bumpMigrationTagVersion(oldTag) {
+    if (!oldTag)
+        return undefined;
+    const version = oldTag.match(/^(alchemy:)?v(\d+)$/)?.[2];
+    if (!version)
+        return "alchemy:v1";
+    return `alchemy:v${parseInt(version, 10) + 1}`;
+}
+function getDurableObjectBindings(bindings, workerName) {
+    return bindings.flatMap((binding) => (binding.data.bindings ?? []).flatMap((item) => item.type === "durable_object_namespace" &&
+        "className" in item &&
+        item.className &&
+        (!("scriptName" in item) ||
+            !item.scriptName ||
+            item.scriptName === workerName)
+        ? [
+            {
+                logicalId: binding.sid,
+                bindingName: item.name,
+                className: item.className,
+            },
+        ]
+        : []));
+}
+function getDurableObjectTagMap(tags) {
+    return Object.fromEntries(tags.flatMap((tag) => {
+        if (!tag.startsWith("alchemy:do:")) {
+            return [];
+        }
+        const parts = tag.split(":");
+        const logicalId = parts[2];
+        const className = parts.slice(3).join(":");
+        return logicalId && className ? [[logicalId, className]] : [];
+    }));
+}
+const selectLayer = (input) => Layer.unwrap(AlchemyContext.useSync((context) => context.dev ? input.dev() : input.live()));
+export const WorkerProvider = () => selectLayer({
+    live: LiveWorkerProvider,
+    dev: () => Layer.provide(LocalWorkerProvider(), SidecarLive),
+});
+export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const { accountId } = yield* CloudflareEnvironment;
+    const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+    const stack = yield* Stack;
+    const createScriptSubdomain = yield* workers.createScriptSubdomain;
+    const createScriptTail = yield* workers.createScriptTail;
+    const deleteScript = yield* workers.deleteScript;
+    const deleteScriptTail = yield* workers.deleteScriptTail;
+    const getScriptSubdomain = yield* workers.getScriptSubdomain;
+    const getScriptSettings = yield* workers.getScriptScriptAndVersionSetting;
+    const getSubdomain = yield* workers.getSubdomain;
+    const putScript = yield* workers.putScript;
+    const putDomain = yield* workers.putDomain;
+    const listDomains = yield* workers.listDomains;
+    const deleteDomain = yield* workers.deleteDomain;
+    const listZones = yield* zones.listZones;
+    const telemetry = yield* CloudflareLogs;
+    // TODO(sam): figure out why the later one from workerd breaks
+    const defaultCompatibilityDate = "2026-03-17";
+    // const defaultCompatibilityDate = yield* Effect.promise(() =>
+    //   // @ts-expect-error no types for workerd
+    //   import("workerd").then((m) => m.compatibilityDate as string),
+    // );
+    const getAccountSubdomain = (accountId) => getSubdomain({
+        accountId,
+    }).pipe(Effect.map((result) => result.subdomain));
+    const setWorkerSubdomain = (name, enabled) => createScriptSubdomain({
+        accountId,
+        scriptName: name,
+        enabled,
+    });
+    const createWorkerName = (id, name) => name
+        ? Effect.succeed(name)
+        : createPhysicalName({
+            id,
+            maxLength: 54,
+        }).pipe(Effect.map((name) => name.toLowerCase()));
+    // Convert non-ASCII hostnames (emoji, IDN, etc.) to punycode so the
+    // Cloudflare API receives the form it stores domains in. `new URL(...)`
+    // does IDNA via WHATWG URL parsing — `📦.alchemy.run` → `xn--5z8h.alchemy.run`.
+    const toPunycode = (hostname) => {
+        try {
+            return new URL(`https://${hostname}`).hostname;
+        }
+        catch {
+            return hostname;
+        }
+    };
+    const normalizeDomains = (domain) => domain === undefined
+        ? []
+        : Array.from(new Set((Array.isArray(domain) ? domain : [domain]).map(toPunycode)));
+    /**
+     * Infer the Cloudflare Zone ID for a given hostname by listing the
+     * account's zones and matching the hostname against each zone's name —
+     * walking up the DNS label hierarchy until a match is found.
+     */
+    const inferZoneIdForHostname = (hostname, zoneCache) => Effect.gen(function* () {
+        const cached = zoneCache.get(hostname);
+        if (cached)
+            return cached;
+        const zoneList = yield* listZones({}).pipe(Effect.map((response) => response.result ?? []));
+        for (const zone of zoneList) {
+            zoneCache.set(zone.name, zone.id);
+        }
+        const parts = hostname.split(".");
+        for (let i = 0; i < parts.length - 1; i++) {
+            const candidate = parts.slice(i).join(".");
+            const match = zoneList.find((z) => z.name === candidate);
+            if (match) {
+                zoneCache.set(hostname, match.id);
+                return match.id;
+            }
+        }
+        return yield* Effect.die(`Could not infer Cloudflare Zone for hostname "${hostname}". ` +
+            "Ensure the parent zone exists in this account.");
+    });
+    const reconcileDomains = (scriptName, desired, _previous) => Effect.gen(function* () {
+        // Always query the live state of domains attached to *this*
+        // Worker rather than trusting `_previous` from local state.
+        // State may have been wiped, populated by another machine, or
+        // simply be out of date. Without this we PUT domains that are
+        // already registered to this same Worker and Cloudflare
+        // returns a confusing "hostname already in use" error.
+        const liveAll = yield* listDomains({
+            accountId,
+            service: scriptName,
+        }).pipe(Effect.map((r) => (r.result ?? []).flatMap((d) => d.id && d.hostname && d.zoneId
+            ? [
+                {
+                    id: d.id,
+                    hostname: d.hostname,
+                    zoneId: d.zoneId,
+                    service: d.service ?? undefined,
+                },
+            ]
+            : [])), Effect.catch(() => Effect.succeed([])));
+        const desiredSet = new Set(desired);
+        const liveByHostname = new Map(liveAll.map((d) => [d.hostname, d]));
+        // Detach what's no longer wanted. Use the live list so we
+        // don't try to delete domains we no longer track.
+        const toRemove = liveAll.filter((d) => !desiredSet.has(d.hostname));
+        yield* Effect.all(toRemove.map((d) => deleteDomain({ accountId, domainId: d.id }).pipe(Effect.catchTag("DomainNotFound", () => Effect.void))), { concurrency: "unbounded" });
+        if (desired.length === 0)
+            return [];
+        const zoneCache = new Map();
+        // Attach `hostname` to this Worker. Skip the PUT entirely if
+        // the hostname is already attached to *this* Worker — that's a
+        // no-op for Cloudflare and avoids the "already in use" 409.
+        // If it's attached to a *different* Worker, refuse with a
+        // clear message rather than silently re-routing traffic.
+        const attachDomain = Effect.fnUntraced(function* (hostname) {
+            const live = liveByHostname.get(hostname);
+            if (live) {
+                return {
+                    hostname: live.hostname,
+                    id: live.id,
+                    zoneId: live.zoneId,
+                };
+            }
+            // Not attached to this Worker — but it could still belong
+            // to another Worker. Check before we try to PUT so we can
+            // emit a helpful error instead of the raw 409.
+            const otherOwner = yield* listDomains({
+                accountId,
+                hostname,
+            }).pipe(Effect.map((r) => (r.result ?? []).find((d) => d.hostname === hostname && d.service !== scriptName)), Effect.catch(() => Effect.succeed(undefined)));
+            if (otherOwner?.id) {
+                return yield* Effect.die(new Error(`Cannot attach hostname '${hostname}' to Worker '${scriptName}': ` +
+                    `it is already attached to Worker '${otherOwner.service ?? "<unknown>"}'. ` +
+                    `Detach it from that Worker first, or pick a different hostname.`));
+            }
+            const zoneId = yield* inferZoneIdForHostname(hostname, zoneCache);
+            const res = yield* putDomain({
+                accountId,
+                hostname,
+                service: scriptName,
+                zoneId,
+            });
+            return {
+                hostname,
+                id: res.id ?? "",
+                zoneId: res.zoneId ?? zoneId,
+            };
+        });
+        const applied = yield* Effect.all(desired.map(attachDomain), {
+            concurrency: "unbounded",
+        });
+        return applied;
+    });
+    const createAlchemyWorkerTags = (id) => [
+        `alchemy:stack:${stack.name}`,
+        `alchemy:stage:${stack.stage}`,
+        `alchemy:id:${id}`,
+    ];
+    const hasAlchemyWorkerTags = (id, tags) => {
+        const actualTags = new Set(tags ?? []);
+        return createAlchemyWorkerTags(id).every((tag) => actualTags.has(tag));
+    };
+    const getDurableObjectNamespaces = (bindings) => {
+        const namespaces = Object.fromEntries((bindings ?? []).flatMap((binding) => binding.type === "durable_object_namespace" &&
+            binding.className &&
+            binding.namespaceId
+            ? [[binding.className, binding.namespaceId]]
+            : []));
+        return namespaces;
+    };
+    const getExpectedDurableObjectClassNames = (bindings) => Array.from(new Set(bindings?.flatMap((binding) => binding.type === "durable_object_namespace" && binding.className
+        ? [binding.className]
+        : []) ?? []));
+    const getWorkerSettingsWithDurableObjects = Effect.fnUntraced(function* (scriptName, expectedClassNames) {
+        return yield* getScriptSettings({
+            accountId,
+            scriptName,
+        }).pipe(Effect.map((settings) => {
+            const namespaces = getDurableObjectNamespaces(settings.bindings);
+            const missing = expectedClassNames.filter((className) => !namespaces[className]);
+            if (missing.length > 0) {
+                return Effect.fail(new MissingDurableObjectNamespaces({
+                    scriptName,
+                    expected: missing,
+                }));
+            }
+            return Effect.succeed({
+                settings,
+                durableObjectNamespaces: namespaces,
+            });
+        }), Effect.flatten, Effect.retry({
+            while: (error) => error._tag === "MissingDurableObjectNamespaces",
+            schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(20))),
+        }));
+    });
+    const prepareAssets = Effect.fnUntraced(function* (assets) {
+        if (!assets) {
+            return undefined;
+        }
+        if (typeof assets === "object" &&
+            "path" in assets &&
+            "hash" in assets) {
+            return yield* readAssets({
+                directory: assets.path,
+                config: assets.config,
+            });
+        }
+        // Handle string path or AssetsProps
+        return yield* readAssets(typeof assets === "string" ? { directory: assets } : assets);
+    });
+    const getCompatibility = (props) => ({
+        compatibilityDate: props.compatibility?.date ?? defaultCompatibilityDate,
+        compatibilityFlags: props.compatibility?.flags
+            ? [
+                ...props.compatibility.flags,
+                ...(props.isExternal ? [] : ["nodejs_compat"]),
+            ].filter((value, index, self) => self.indexOf(value) === index)
+            : props.isExternal
+                ? []
+                : ["nodejs_compat"],
+    });
+    const prepareBundle = (id, props) => Effect.gen(function* () {
+        const main = yield* fs.realPath(props.main);
+        const cwd = yield* findCwdForBundle(main);
+        const { compatibilityDate, compatibilityFlags } = getCompatibility(props);
+        const buildBundle = (plugins) => Bundle.build({
+            input: main,
+            cwd,
+            plugins: [
+                cloudflareRolldown({ compatibilityDate, compatibilityFlags }),
+                plugins,
+                ...(props.build?.metafile ? [Sonda({ open: false })] : []),
+            ],
+            checks: {
+                // Suppress unresolved import warnings for unrelated AWS packages
+                unresolvedImport: false,
+            },
+        }, {
+            format: "esm",
+            sourcemap: "hidden",
+            minify: true,
+            keepNames: true,
+            dir: `.alchemy/bundles/${id}`,
+        }, { pure: props.build?.pure });
+        if (props.isExternal) {
+            const bundle = yield* buildBundle();
+            return bundle;
+        }
+        const exportMap = (props.exports ?? {});
+        const allExportNames = Object.keys(exportMap).filter((id) => id !== "default");
+        const doClasses = [];
+        const wfClasses = [];
+        for (const name of allExportNames) {
+            if (isWorkflowExport(exportMap[name])) {
+                wfClasses.push(name);
+            }
+            else if (isDurableObjectExport(exportMap[name])) {
+                doClasses.push(name);
+            }
+        }
+        const hasDoClasses = doClasses.length > 0;
+        const hasWfClasses = wfClasses.length > 0;
+        const script = (importPath) => `
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Context from "effect/Context";
+import * as Stream from "effect/Stream";
+
+import { env, DurableObject${hasWfClasses ? ", WorkflowEntrypoint" : ""} } from "cloudflare:workers";
+import { MinimumLogLevel } from "effect/References";
+import { NodeServices } from "@effect/platform-node";
+import { Stack } from "alchemy/Stack";
+import { WorkerEnvironment, makeDurableObjectBridge${hasWfClasses ? ", makeWorkflowBridge" : ""}, ExportedHandlerMethods } from "alchemy/Cloudflare";
+
+import entry from "${importPath}";
+
+const tag = Context.Service("${Self.key}")
+const layer =
+  typeof entry?.build === "function"
+    ? entry
+    : Layer.effect(tag, typeof entry?.asEffect === "function" ? entry.asEffect() : entry);
+
+const platform = Layer.mergeAll(
+  NodeServices.layer,
+  FetchHttpClient.layer,
+  // TODO(sam): wire this up to telemetry more directly
+  Logger.layer([Logger.consolePretty()]),
+);
+
+const stack = Layer.succeed(
+  Stack,
+  {
+    name: "${stack.name}",
+    stage: "${stack.stage}",
+    bindings: {},
+    resources: {}
+  }
+);
+
+const exportsEffect = tag.asEffect().pipe(
+  Effect.flatMap(func => func.ExecutionContext.exports),
+  Effect.provide(
+    layer.pipe(
+      Layer.provideMerge(stack),
+      // TODO(sam): additional credentials?
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          ConfigProvider.orElse(
+            ConfigProvider.fromUnknown({ ALCHEMY_PHASE: "runtime" }),
+            ConfigProvider.fromUnknown(env),
+          ),
+        )
+      ),
+      Layer.provideMerge(
+        Layer.succeed(
+          WorkerEnvironment,
+          env,
+        )
+      ),
+      Layer.provideMerge(
+        Layer.succeed(
+          MinimumLogLevel,
+          env.DEBUG ? "Debug" : "Info",
+        )
+      ),
+    )
+  ),
+  Effect.scoped
+);
+
+// TODO(sam): we could kick this off during module init, but any I/O will break deploy
+// let exportsPromise = Effect.runPromise(exportsEffect);
+
+// for now, we delay initializing the worker until the first request
+let exportsPromise;
+
+// don't initialize the workerEffect during module init because Cloudflare does not allow I/O during module init
+// we cache it synchronously (??=) to guarnatee only one initialization ever happens
+const getExports = () => (exportsPromise ??= Effect.runPromise(exportsEffect))
+const getExport = (name) => getExports().then(exports => exports[name]?.make)
+const worker = () => getExports().then(exports => exports.default)
+
+export default Object.fromEntries(ExportedHandlerMethods.map(
+  method => [method, async (...args) => (await worker())[method](...args)])
+) satisfies Required<cf.ExportedHandler>;
+
+// export class proxy stubs for Durable Objects and Workflows
+${[
+            ...(hasDoClasses
+                ? [
+                    "const DurableObjectBridge = makeDurableObjectBridge(DurableObject, getExport);",
+                    ...doClasses.map((id) => `export class ${id} extends DurableObjectBridge("${id}") {}`),
+                ]
+                : []),
+            ...(hasWfClasses
+                ? [
+                    "const WorkflowBridgeFn = makeWorkflowBridge(WorkflowEntrypoint, getExport);",
+                    ...wfClasses.map((id) => `export class ${id} extends WorkflowBridgeFn("${id}") {}`),
+                ]
+                : []),
+        ].join("\n")}
+`;
+        return yield* buildBundle(virtualEntryPlugin(script));
+    }).pipe(Artifacts.cached("build"));
+    const viteBuild = Effect.fnUntraced(function* (props) {
+        let assetsDirectory;
+        let serverBundle;
+        const { compatibilityDate, compatibilityFlags } = getCompatibility(props);
+        yield* Effect.promise(async () => {
+            const vite = await loadVite(props.vite?.rootDir);
+            const builder = await vite.createBuilder({
+                root: props.vite?.rootDir,
+                // Declare the ssr environment so Vite 8+ creates it.
+                // The cloudflare-vite-plugin config hook merges its
+                // SSR-specific settings on top of this stub.
+                environments: {
+                    ssr: {
+                        build: {
+                            // Prevent the SSR build from wiping the client
+                            // build's output (both share the dist/ directory).
+                            emptyOutDir: false,
+                        },
+                    },
+                },
+                builder: {
+                    sharedConfigBuild: true,
+                },
+                plugins: [
+                    cloudflareVite({
+                        compatibilityDate,
+                        compatibilityFlags,
+                    }),
+                    {
+                        name: "output:ssr",
+                        applyToEnvironment(environment) {
+                            return environment.name === "ssr";
+                        },
+                        generateBundle(_outputOptions, bundle) {
+                            serverBundle = bundle;
+                        },
+                    },
+                    {
+                        name: "output:client",
+                        applyToEnvironment(environment) {
+                            return environment.name === "client";
+                        },
+                        generateBundle(outputOptions) {
+                            assetsDirectory = outputOptions.dir;
+                        },
+                    },
+                ],
+            }, 
+            // This is the `useLegacyBuilder` option. The Vite CLI implementation uses `null` here.
+            // Originally we used `undefined` here, but this caused the static site build to fail.
+            // https://github.com/vitejs/vite/blob/a07a4bd052ac75f916391c999c408ad5f2867e61/packages/vite/src/node/cli.ts#L367
+            null);
+            await builder.buildApp();
+        });
+        if (!assetsDirectory && !serverBundle) {
+            return yield* Effect.die(new Error("Vite build produced neither server nor client output"));
+        }
+        const [assets, bundle] = yield* Effect.all([
+            assetsDirectory
+                ? readAssets({
+                    directory: assetsDirectory,
+                    config: typeof props.assets === "object" && "config" in props.assets
+                        ? props.assets.config
+                        : undefined,
+                })
+                : Effect.succeed(undefined),
+            serverBundle
+                ? Bundle.bundleOutputFromRolldownOutputBundle(serverBundle)
+                : Effect.succeed(undefined),
+        ], { concurrency: "unbounded" });
+        return { assets, bundle };
+    });
+    const prepareAssetsAndBundle = (id, props) => Effect.gen(function* () {
+        if (props.vite) {
+            const [{ assets, bundle }, input] = yield* Effect.all([
+                viteBuild(props),
+                // hashDirectory expects `{ cwd, memo }`. The vite props
+                // store the project root under `rootDir`, so map it
+                // here. Without this, `cwd` falls back to
+                // `process.cwd()` and the input hash is computed over
+                // the wrong directory tree (often the entire monorepo
+                // root), making it both slow and unable to detect
+                // changes scoped to the actual Vite project.
+                hashDirectory({
+                    cwd: props.vite.rootDir,
+                    memo: props.vite.memo,
+                }),
+            ], { concurrency: "unbounded" });
+            return { assets, bundle, input };
+        }
+        const [assets, bundle] = yield* Effect.all([prepareAssets(props.assets), prepareBundle(id, props)], { concurrency: "unbounded" });
+        return { assets, bundle };
+    }).pipe(Effect.map(({ assets, bundle, input }) => ({
+        assets,
+        bundle: {
+            main: bundle?.files[0].path,
+            files: bundle?.files.map((file) => new File([file.content], file.path, {
+                type: contentTypeFromExtension(path.extname(file.path)),
+            })),
+        },
+        hash: {
+            assets: assets?.hash,
+            bundle: bundle?.hash,
+            input,
+        },
+    })));
+    const putWorker = Effect.fnUntraced(function* (id, news, bindings, olds, output, session, existingSettings) {
+        const name = yield* createWorkerName(id, news.name);
+        yield* Effect.logInfo(`Cloudflare Worker ${olds ? "update" : "create"}: preparing bundle for ${name}`);
+        const { assets, bundle, hash } = yield* prepareAssetsAndBundle(id, news);
+        const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
+        const expectedDurableObjectClassNames = getExpectedDurableObjectClassNames(metadataBindings);
+        let metadataAssets;
+        const keepAssets = false;
+        if (assets) {
+            // Always upload assets on every deploy. The "skip if hash
+            // unchanged" optimization was the source of subtle bundle/
+            // asset desync bugs (deploy succeeds but worker serves 404s
+            // because the bundle references hashed asset filenames that
+            // aren't in the still-on-Cloudflare manifest). The upload
+            // session is content-addressed on Cloudflare's side — only
+            // genuinely-new asset bytes are PUT; unchanged assets cost
+            // a manifest check and nothing else, so the optimization
+            // wasn't worth the failure mode.
+            yield* Effect.logInfo(`Cloudflare Worker ${olds ? "update" : "create"}: uploading assets for ${name}`);
+            const { jwt } = yield* uploadAssets(accountId, name, assets, session);
+            metadataAssets = {
+                jwt,
+                config: assets.config,
+            };
+            metadataBindings.push({
+                type: "assets",
+                name: "ASSETS",
+            });
+        }
+        metadataBindings.push({
+            type: "plain_text",
+            name: "ALCHEMY_STACK_NAME",
+            text: stack.name,
+        }, {
+            type: "plain_text",
+            name: "ALCHEMY_STAGE",
+            text: stack.stage,
+        });
+        // Add environment variables as metadata bindings
+        if (news.env) {
+            for (const [key, value] of Object.entries(news.env)) {
+                if (value == null)
+                    continue;
+                if (Redacted.isRedacted(value)) {
+                    metadataBindings.push({
+                        type: "secret_text",
+                        name: key,
+                        text: Redacted.value(value),
+                    });
+                }
+                else {
+                    metadataBindings.push({
+                        type: "plain_text",
+                        name: key,
+                        text: typeof value === "string" ? value : String(value),
+                    });
+                }
+            }
+        }
+        yield* Effect.logInfo(`Cloudflare Worker ${olds ? "update" : "create"}: uploading script for ${name}`);
+        const size = bundle.files
+            ?.filter((file) => !file.name.endsWith(".map"))
+            .reduce((acc, file) => acc + file.size, 0) ?? 0;
+        const sizeKB = size / 1024;
+        const sizeMB = sizeKB / 1024;
+        const bundleSize = `${sizeKB > 1024 ? `${sizeMB.toFixed(2)} MB` : `${sizeKB.toFixed(2)} KB`}`;
+        yield* session.note(`Uploading worker (${bundleSize}) ...`);
+        // Read existing worker settings for migration tracking
+        const oldSettings = existingSettings ??
+            (yield* getScriptSettings({
+                accountId,
+                scriptName: name,
+            }).pipe(Effect.map((s) => s), Effect.catch(() => Effect.succeed(undefined))));
+        const oldTags = Array.from(new Set(oldSettings?.tags ?? []));
+        const oldBindings = oldSettings?.bindings ?? [];
+        // Parse alchemy:do:{logicalId}:{className} tags
+        const oldDoClassNameByLogicalId = getDurableObjectTagMap(oldTags);
+        const currentDoBindings = getDurableObjectBindings(bindings, name);
+        const currentDoClassNameByLogicalId = Object.fromEntries(currentDoBindings.map((binding) => [
+            binding.logicalId,
+            binding.className,
+        ]));
+        // Parse alchemy:migration-tag:{version}
+        const oldMigrationTag = oldTags.flatMap((tag) => tag.startsWith("alchemy:migration-tag:")
+            ? [tag.slice("alchemy:migration-tag:".length)]
+            : [])[0];
+        const newMigrationTag = bumpMigrationTagVersion(oldMigrationTag);
+        // Compute deleted classes
+        const deletedClasses = [];
+        for (const [logicalId, className] of Object.entries(oldDoClassNameByLogicalId)) {
+            if (!currentDoClassNameByLogicalId[logicalId]) {
+                deletedClasses.push(className);
+            }
+        }
+        // Backward compatibility for old workers that have DO bindings but no
+        // alchemy:do tags yet.
+        if (Object.keys(oldDoClassNameByLogicalId).length === 0) {
+            for (const oldBinding of oldBindings) {
+                if (oldBinding.type === "durable_object_namespace" &&
+                    "className" in oldBinding &&
+                    oldBinding.className &&
+                    (!("scriptName" in oldBinding) ||
+                        !oldBinding.scriptName ||
+                        oldBinding.scriptName === name) &&
+                    !currentDoBindings.some((binding) => binding.bindingName === oldBinding.name)) {
+                    deletedClasses.push(oldBinding.className);
+                }
+            }
+        }
+        // Collect container-backed class names so we can send container metadata
+        const containerClassNames = new Set(bindings.flatMap((b) => (b.data.containers ?? []).map((c) => c.className)));
+        // Compute new and renamed classes
+        const newClasses = [];
+        const newSqliteClasses = [];
+        const renamedClasses = [];
+        for (const binding of currentDoBindings) {
+            const previousClassName = oldDoClassNameByLogicalId[binding.logicalId];
+            if (!previousClassName) {
+                // Default all new Durable Object classes to SQLite. Cloudflare
+                // recommends SQLite for new namespaces, and container-backed
+                // Durable Objects require it.
+                newSqliteClasses.push(binding.className);
+            }
+            else if (previousClassName !== binding.className) {
+                renamedClasses.push({
+                    from: previousClassName,
+                    to: binding.className,
+                });
+            }
+        }
+        yield* Effect.logInfo(`Cloudflare Worker put: durable object reconciliation ${JSON.stringify({
+            oldDoClassNameByLogicalId,
+            currentDoClassNameByLogicalId,
+            deletedClasses,
+            renamedClasses,
+            newSqliteClasses,
+        })}`);
+        // Build alchemy:do:{logicalId}:{className} tags for each DO binding
+        const alchemyDoTags = [];
+        for (const binding of currentDoBindings) {
+            alchemyDoTags.push(`alchemy:do:${binding.logicalId}:${binding.className}`);
+        }
+        const metadataTags = Array.from(new Set([
+            ...createAlchemyWorkerTags(id),
+            ...alchemyDoTags,
+            ...(newMigrationTag
+                ? [`alchemy:migration-tag:${newMigrationTag}`]
+                : []),
+            ...(news.tags ?? []),
+        ]));
+        const migrations = {
+            oldTag: oldMigrationTag,
+            newTag: newMigrationTag,
+            newClasses,
+            deletedClasses,
+            renamedClasses,
+            transferredClasses: [],
+            newSqliteClasses,
+        };
+        const metadataContainers = [...containerClassNames].map((className) => ({
+            className,
+        }));
+        const metadata = {
+            assets: metadataAssets,
+            bindings: metadataBindings,
+            bodyPart: undefined,
+            ...getCompatibility(news),
+            containers: metadataContainers.length > 0 ? metadataContainers : undefined,
+            keepAssets,
+            keepBindings: undefined,
+            limits: news.limits,
+            logpush: news.logpush,
+            mainModule: bundle.main,
+            migrations,
+            observability: news.observability ?? {
+                enabled: true,
+                logs: {
+                    enabled: true,
+                    invocationLogs: true,
+                },
+            },
+            placement: news.placement,
+            tags: metadataTags,
+            tailConsumers: undefined,
+            usageModel: undefined,
+        };
+        const worker = yield* putScript({
+            accountId,
+            scriptName: name,
+            metadata,
+            files: bundle.files,
+        }).pipe(Effect.catch((err) => {
+            // When adopting a Worker managed by Wrangler (or after a previous
+            // deploy with mismatched migrations), the old_tag precondition
+            // fails. The only way to discover the actual tag is through the
+            // error message — getScriptSettings is meant to return it but
+            // doesn't at runtime.
+            const msg = String(typeof err === "object" && err !== null && "message" in err
+                ? err.message
+                : err);
+            const expectedTag = msg.match(/when expected tag is ['"]?([^'"]+)['"]?/)?.[1];
+            if (expectedTag) {
+                return putScript({
+                    accountId,
+                    scriptName: name,
+                    metadata: {
+                        ...metadata,
+                        migrations: {
+                            ...migrations,
+                            oldTag: expectedTag,
+                            newTag: bumpMigrationTagVersion(expectedTag),
+                        },
+                    },
+                    files: bundle.files,
+                });
+            }
+            return Effect.fail(err);
+        }));
+        const { settings, durableObjectNamespaces } = yield* getWorkerSettingsWithDurableObjects(name, expectedDurableObjectClassNames);
+        if (!olds || news.url !== olds.url) {
+            const enable = news.url !== false;
+            yield* session.note(`${enable ? "Enabling" : "Disabling"} workers.dev subdomain...`);
+            yield* setWorkerSubdomain(name, enable);
+        }
+        const desiredDomains = normalizeDomains(news.domain);
+        const previousDomains = output?.domains ?? [];
+        if (desiredDomains.length > 0 || previousDomains.length > 0) {
+            yield* session.note(`Reconciling custom domains (${desiredDomains.length}) ...`);
+        }
+        const domains = yield* reconcileDomains(name, desiredDomains, previousDomains);
+        return {
+            workerId: worker.id ?? name,
+            workerName: name,
+            logpush: worker.logpush ?? undefined,
+            url: news.url !== false
+                ? `https://${name}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+                : undefined,
+            tags: settings.tags ?? metadata.tags,
+            durableObjectNamespaces,
+            accountId,
+            domains,
+            hash,
+        };
+    });
+    const hasChanged = Effect.fnUntraced(function* (id, props, output) {
+        if (props.vite) {
+            const input = yield* hashDirectory({
+                cwd: props.vite.rootDir,
+                memo: props.vite.memo,
+            });
+            return input !== output.hash?.input;
+        }
+        // The asset hash comes from walking the actual `outdir` —
+        // whatever bytes are on disk are what we'd be deploying, so
+        // that's what we diff against. Non-deterministic build outputs
+        // (e.g. Astro/Vite shuffling content-hashed chunk filenames)
+        // are a property of the build, not something we should paper
+        // over here. The bundle hash is similarly recomputed.
+        const [assetsHash, bundleHash] = yield* Effect.all([
+            prepareAssets(props.assets).pipe(Effect.map((a) => a?.hash)),
+            prepareBundle(id, props).pipe(Effect.map((b) => b.hash)),
+        ], { concurrency: "unbounded" });
+        return (assetsHash !== output.hash?.assets ||
+            bundleHash !== output.hash?.bundle);
+    });
+    return Worker.Provider.of({
+        stables: ["workerId", "workerName"],
+        diff: Effect.fnUntraced(function* ({ id, news, olds, output }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((output?.accountId ?? accountId) !== accountId) {
+                return { action: "replace" };
+            }
+            const workerName = yield* createWorkerName(id, news.name);
+            const oldWorkerName = output?.workerName
+                ? output.workerName
+                : yield* createWorkerName(id, olds?.name);
+            if (workerName !== oldWorkerName) {
+                return { action: "replace" };
+            }
+            if (!output) {
+                return;
+            }
+            const newDomains = normalizeDomains(news.domain).sort();
+            const oldDomains = (output?.domains ?? [])
+                .map((d) => d.hostname)
+                .sort();
+            const domainsChanged = newDomains.length !== oldDomains.length ||
+                newDomains.some((d, i) => d !== oldDomains[i]);
+            if (domainsChanged || (yield* hasChanged(id, news, output))) {
+                return {
+                    action: "update",
+                    stables: oldWorkerName === workerName ? ["workerName"] : undefined,
+                };
+            }
+        }),
+        precreate: Effect.fnUntraced(function* ({ id, news, session }) {
+            const name = yield* createWorkerName(id, news.name);
+            const exportMap = (news.exports ?? {});
+            const durableObjects = Object.keys(exportMap)
+                .filter((logicalId) => isDurableObjectExport(exportMap[logicalId]))
+                .map((logicalId) => ({
+                logicalId,
+                className: logicalId,
+            }));
+            const doClasses = durableObjects.map((binding) => binding.className);
+            const containers = doClasses.map((className) => ({ className }));
+            const alchemyDoTags = durableObjects.map(({ logicalId, className }) => `alchemy:do:${logicalId}:${className}`);
+            const tags = Array.from(new Set([
+                ...createAlchemyWorkerTags(id),
+                ...alchemyDoTags,
+                ...(news.tags ?? []),
+            ]));
+            yield* Effect.logInfo(`Cloudflare Worker precreate: starting ${name}`);
+            yield* Effect.logInfo(`Cloudflare Worker precreate: durable objects ${JSON.stringify(durableObjects)}`);
+            const existingSettings = yield* getScriptSettings({
+                accountId,
+                scriptName: name,
+            }).pipe(Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)));
+            let durableObjectNamespaces = getDurableObjectNamespaces(existingSettings?.bindings);
+            if (existingSettings) {
+                if (!hasAlchemyWorkerTags(id, existingSettings.tags ?? [])) {
+                    return yield* Effect.die(`Worker "${name}" already exists but is not owned by this stack/stage/resource`);
+                }
+                yield* Effect.logInfo(`Cloudflare Worker precreate: adopting existing ${name} owned by this stack/stage/resource`);
+            }
+            else {
+                yield* session.note("Pre-creating worker...");
+                const mainModule = "main.js";
+                const placeholderScript = `${doClasses.length > 0 ? 'import { DurableObject } from "cloudflare:workers";\n\n' : ""}export default { fetch() { return new Response("Alchemy worker is being deployed...") } };\n${doClasses
+                    .map((className) => `export class ${className} extends DurableObject {}`)
+                    .join("\n")}`;
+                yield* putScript({
+                    accountId,
+                    scriptName: name,
+                    metadata: {
+                        mainModule,
+                        bindings: doClasses.length > 0
+                            ? doClasses.map((className) => ({
+                                type: "durable_object_namespace",
+                                name: className,
+                                className,
+                            }))
+                            : undefined,
+                        ...getCompatibility(news),
+                        containers,
+                        migrations: doClasses.length > 0
+                            ? {
+                                oldTag: undefined,
+                                newTag: undefined,
+                                newClasses: [],
+                                deletedClasses: [],
+                                renamedClasses: [],
+                                transferredClasses: [],
+                                newSqliteClasses: doClasses,
+                            }
+                            : undefined,
+                        observability: news.observability ?? {
+                            enabled: true,
+                            logs: {
+                                enabled: true,
+                                invocationLogs: true,
+                            },
+                        },
+                        tags,
+                    },
+                    files: [
+                        new File([placeholderScript], mainModule, {
+                            type: "application/javascript+module",
+                        }),
+                    ],
+                });
+                if (doClasses.length > 0) {
+                    ({ durableObjectNamespaces } =
+                        yield* getWorkerSettingsWithDurableObjects(name, doClasses));
+                }
+            }
+            if (existingSettings && doClasses.length > 0) {
+                ({ durableObjectNamespaces } =
+                    yield* getWorkerSettingsWithDurableObjects(name, doClasses));
+            }
+            return {
+                workerId: name,
+                workerName: name,
+                logpush: existingSettings?.logpush ?? undefined,
+                url: undefined,
+                tags: existingSettings?.tags ?? tags,
+                durableObjectNamespaces,
+                accountId,
+                domains: [],
+            };
+        }),
+        read: Effect.fnUntraced(function* ({ id, output, olds }) {
+            const workerName = output?.workerName ?? (yield* createWorkerName(id, olds?.name));
+            yield* Effect.logInfo(`Cloudflare Worker read: checking ${workerName}`);
+            // We deliberately don't call `listScripts({ accountId })` here:
+            // it pulls every Worker on the account back through a strict
+            // schema decode, and a single existing Worker the schema doesn't
+            // know about (e.g. `placement_mode: "targeted"`) breaks the
+            // entire read. `getScriptSettings` already fails with
+            // `WorkerNotFound` if the script doesn't exist, which the
+            // surrounding `Effect.catchTag` turns into `undefined` — that's
+            // all the existence check we need.
+            const [subdomain, settings, domainsList] = yield* Effect.all([
+                getScriptSubdomain({
+                    accountId,
+                    scriptName: workerName,
+                }),
+                getScriptSettings({
+                    accountId,
+                    scriptName: workerName,
+                }),
+                listDomains({
+                    accountId,
+                    service: workerName,
+                }).pipe(Effect.map((r) => r.result ?? [])),
+            ]);
+            yield* Effect.logInfo(`Cloudflare Worker read: found ${workerName}`);
+            return {
+                accountId,
+                workerId: workerName,
+                workerName,
+                logpush: settings.logpush ?? undefined,
+                url: subdomain.enabled
+                    ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+                    : undefined,
+                tags: settings.tags ?? undefined,
+                durableObjectNamespaces: getDurableObjectNamespaces(settings.bindings),
+                domains: domainsList.flatMap((d) => d.id && d.hostname && d.zoneId
+                    ? [{ id: d.id, hostname: d.hostname, zoneId: d.zoneId }]
+                    : []),
+            };
+        }, (effect) => effect.pipe(Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)))),
+        create: Effect.fnUntraced(function* ({ id, news, bindings, output, session, }) {
+            const name = yield* createWorkerName(id, news.name);
+            const durableObjects = getDurableObjectBindings(bindings, name).map(({ logicalId, className }) => ({
+                logicalId,
+                className,
+            }));
+            yield* Effect.logInfo(`Cloudflare Worker create: starting ${name}`);
+            yield* Effect.logInfo(`Cloudflare Worker create: durable objects ${JSON.stringify(durableObjects)}`);
+            const existingSettings = yield* getScriptSettings({
+                accountId,
+                scriptName: name,
+            }).pipe(Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)));
+            yield* Effect.logInfo(`Cloudflare Worker create: existing durable object tags ${JSON.stringify((existingSettings?.tags ?? []).filter((tag) => tag.startsWith("alchemy:do:")))}`);
+            if (existingSettings) {
+                yield* Effect.logInfo(`Cloudflare Worker create: ${name} already exists`);
+                if (!hasAlchemyWorkerTags(id, existingSettings.tags ?? [])) {
+                    return yield* Effect.die(`Worker "${name}" already exists but is not owned by this stack/stage/resource`);
+                }
+                yield* Effect.logInfo(`Cloudflare Worker create: adopting existing ${name} owned by this stack/stage/resource`);
+            }
+            return yield* putWorker(id, news, bindings, undefined, output, session, existingSettings);
+        }),
+        update: Effect.fnUntraced(function* ({ id, olds, news, output, bindings, session, }) {
+            const durableObjects = getDurableObjectBindings(bindings, output.workerName).map(({ logicalId, className }) => ({
+                logicalId,
+                className,
+            }));
+            yield* Effect.logInfo(`Cloudflare Worker update: starting ${output.workerName}`);
+            yield* Effect.logInfo(`Cloudflare Worker update: durable objects ${JSON.stringify(durableObjects)}`);
+            yield* Effect.logInfo(`Cloudflare Worker update: previous durable object tags ${JSON.stringify((output.tags ?? []).filter((tag) => tag.startsWith("alchemy:do:")))}`);
+            return yield* putWorker(id, news, bindings, olds, output, session);
+        }),
+        delete: Effect.fnUntraced(function* ({ output }) {
+            yield* Effect.logInfo(`Cloudflare Worker delete: deleting ${output.workerName}`);
+            if (output.domains?.length) {
+                yield* Effect.all(output.domains.map((d) => deleteDomain({
+                    accountId: output.accountId,
+                    domainId: d.id,
+                }).pipe(Effect.catchTag("DomainNotFound", () => Effect.void))), { concurrency: "unbounded" });
+            }
+            yield* deleteScript({
+                accountId: output.accountId,
+                scriptName: output.workerName,
+            }).pipe(Effect.catchTag("WorkerNotFound", () => Effect.void));
+        }),
+        tail: ({ output }) => {
+            const runTailSession = Effect.gen(function* () {
+                const { id: tailId, url } = yield* createScriptTail({
+                    scriptName: output.workerName,
+                    accountId: output.accountId,
+                    body: { filters: [] },
+                });
+                const socket = yield* Socket.makeWebSocket(url, {
+                    protocols: ["trace-v1"],
+                });
+                const queue = yield* Queue.make();
+                yield* socket
+                    .runRaw((raw) => {
+                    const text = typeof raw === "string" ? raw : new TextDecoder().decode(raw);
+                    const data = JSON.parse(text);
+                    const eventTs = new Date(data.eventTimestamp ?? Date.now());
+                    if (data.event && "request" in data.event) {
+                        const reqEvent = data.event;
+                        const pathname = (() => {
+                            try {
+                                return new URL(reqEvent.request.url).pathname;
+                            }
+                            catch {
+                                return reqEvent.request.url;
+                            }
+                        })();
+                        const status = reqEvent.response?.status ?? 500;
+                        Queue.offerUnsafe(queue, {
+                            timestamp: eventTs,
+                            message: `${reqEvent.request.method} ${pathname} > ${status} (cpu: ${Math.round(data.cpuTime)}ms, wall: ${Math.round(data.wallTime)}ms)`,
+                        });
+                    }
+                    for (const log of data.logs) {
+                        const msg = log.message.join(" ");
+                        Queue.offerUnsafe(queue, {
+                            timestamp: new Date(log.timestamp),
+                            message: log.level === "log" ? msg : `${log.level}: ${msg}`,
+                        });
+                    }
+                    for (const exception of data.exceptions) {
+                        Queue.offerUnsafe(queue, {
+                            timestamp: new Date(exception.timestamp),
+                            message: `${exception.name} ${exception.message}\n${exception.stack}`,
+                        });
+                    }
+                })
+                    .pipe(Effect.ensuring(Effect.all([
+                    deleteScriptTail({
+                        scriptName: output.workerName,
+                        id: tailId,
+                        accountId: output.accountId,
+                    }).pipe(Effect.ignore),
+                    Queue.end(queue),
+                ])), Effect.ignore, Effect.forkChild());
+                return Stream.fromQueue(queue);
+            });
+            return Stream.unwrap(runTailSession).pipe(Stream.repeat(Schedule.spaced("1 second")));
+        },
+        logs: ({ output, options }) => telemetry.queryLogs({
+            accountId: output.accountId,
+            filters: [
+                {
+                    key: "$workers.scriptName",
+                    operation: "eq",
+                    type: "string",
+                    value: output.workerName,
+                },
+            ],
+            options,
+        }),
+    });
+}));
+const contentTypeFromExtension = (extension) => {
+    switch (extension) {
+        case ".wasm":
+            return "application/wasm";
+        case ".txt":
+        case ".html":
+        case ".sql":
+        case ".custom":
+            return "text/plain";
+        case ".bin":
+            return "application/octet-stream";
+        case ".mjs":
+        case ".js":
+            return "application/javascript+module";
+        case ".cjs":
+            return "application/javascript";
+        case ".map":
+            return "application/source-map";
+        default:
+            return "application/octet-stream";
+    }
+};
+/**
+ * Dynamically load Vite from the project root. Falls back to the bundled
+ * copy if the project doesn't have its own Vite installation.
+ */
+async function loadVite(projectRoot = process.cwd()) {
+    try {
+        const require = createRequire(path.join(projectRoot, "package.json"));
+        const vitePath = require.resolve("vite");
+        // On Windows, absolute paths must be file:// URLs for ESM import().
+        const viteUrl = pathToFileURL(vitePath);
+        return await import(__rewriteRelativeImportExtension(/* @vite-ignore */ viteUrl.href));
+    }
+    catch {
+        // Fallback: try to import vite from the global node_modules (works for non-linked installs)
+        // The fallback is a bare specifier and works as-is.
+        return await import("vite");
+    }
+}
+//# sourceMappingURL=Worker.js.map