alchemy 2.0.0-beta.3 → 2.0.0-beta.30

package/src/Cloudflare/Workers/Worker.ts

@@ -2,6 +2,7 @@ import type * as cf from "@cloudflare/workers-types";
 import cloudflareRolldown from "@distilled.cloud/cloudflare-rolldown-plugin";
 import cloudflareVite from "@distilled.cloud/cloudflare-vite-plugin";
 import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as zones from "@distilled.cloud/cloudflare/zones";
 import type * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Data from "effect/Data";
@@ -15,18 +16,26 @@ import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import * as Socket from "effect/unstable/socket/Socket";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
 import type * as rolldown from "rolldown";
 import Sonda from "sonda/rolldown";
 import type * as vite from "vite";
+import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Artifacts from "../../Artifacts.ts";
 import * as Binding from "../../Binding.ts";
+import {
+  isArtifacts as isArtifactsBinding,
+  type Artifacts as ArtifactsBinding,
+} from "../Artifacts/Artifacts.ts";
 import { hashDirectory, type MemoOptions } from "../../Build/Memo.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
 import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
 import type { HttpEffect } from "../../Http.ts";
-import type { Input, InputProps } from "../../Input.ts";
+import type { InputProps } from "../../Input.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import {
@@ -41,17 +50,32 @@ import { Resource, type ResourceBinding } from "../../Resource.ts";
 import { Self } from "../../Self.ts";
 import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
-import { Account } from "../Account.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { AiGateway } from "../AiGateway/AiGateway.ts";
 import { D1Database } from "../D1/D1Database.ts";
 import { fromCloudflareFetcher } from "../Fetcher.ts";
+import type { KVNamespace } from "../KV/KVNamespace.ts";
+import { SidecarLive } from "../Local/Sidecar.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
+import type { Queue as CloudflareQueue } from "../Queue/Queue.ts";
 import type { R2Bucket } from "../R2/R2Bucket.ts";
-import type { AssetsConfig, AssetsProps } from "./Assets.ts";
-import * as Assets from "./Assets.ts";
+import {
+  isAssets,
+  readAssets,
+  uploadAssets,
+  type Assets,
+  type AssetsConfig,
+  type AssetsProps,
+} from "./Assets.ts";
 import cloudflare_workers from "./cloudflare_workers.ts";
-import { isDurableObjectExport } from "./DurableObjectNamespace.ts";
+import {
+  isDurableObjectExport,
+  isDurableObjectNamespaceLike,
+  type DurableObjectNamespaceLike,
+} from "./DurableObjectNamespace.ts";
 import { workersHttpHandler } from "./HttpServer.ts";
+import { LocalWorkerProvider } from "./LocalWorkerProvider.ts";
 import { Request } from "./Request.ts";
 import { makeRpcStub } from "./Rpc.ts";
 import { isWorkflowExport } from "./Workflow.ts";
@@ -105,12 +129,12 @@ export interface AssetsWithHash {
   /**
    * Path to the assets directory.
    */
-  path: Input<string>;
+  path: string;
   /**
    * Pre-computed hash of the assets. When provided, this hash is used for diffing
    * to determine if the worker needs to be redeployed.
    */
-  hash: Input<string>;
+  hash: string;
   /**
    * Optional assets configuration.
    */
@@ -157,11 +181,19 @@ export interface WorkerExecutionContext extends Serverless.FunctionContext {
   export(name: string, value: any): Effect.Effect<void>;
 }
 
-export type WorkerServices = Worker | WorkerEnvironment | Request;
+export type WorkerServices = Worker | Request;
 
-export type WorkerShape = Main<WorkerServices>;
+export type WorkerShape = Main<WorkerServices | WorkerEnvironment>;
 
-export type WorkerBindingResource = R2Bucket | D1Database;
+export type WorkerBindingResource =
+  | Assets
+  | R2Bucket
+  | D1Database
+  | KVNamespace
+  | CloudflareQueue
+  | AiGateway
+  | ArtifactsBinding
+  | DurableObjectNamespaceLike<any>;
 
 export type WorkerBindings = {
   [bindingName in string]: WorkerBindingResource;
@@ -173,8 +205,26 @@ export type WorkerBindingProps = {
     | Effect.Effect<WorkerBindingResource, any, any>;
 };
 
+type NormalizedBindings<
+  Bindings extends WorkerBindingProps = {},
+  AssetsConfig extends WorkerAssetsConfig | undefined = undefined,
+> = {
+  [B in keyof Bindings]: Bindings[B] extends Effect.Effect<
+    infer T extends WorkerBindingResource,
+    any,
+    any
+  >
+    ? T
+    : Extract<Bindings[B], WorkerBindingResource>;
+} & (undefined extends AssetsConfig ? {} : { ASSETS: Assets });
+
+export type WorkerAssetsConfig = string | AssetsProps | AssetsWithHash;
+
 export interface WorkerProps<
   Bindings extends WorkerBindingProps = any,
+  Assets extends WorkerAssetsConfig | undefined =
+    | WorkerAssetsConfig
+    | undefined,
 > extends PlatformProps {
   /**
    * Worker name override. If omitted, Alchemy derives a deterministic physical
@@ -192,11 +242,7 @@ export interface WorkerProps<
    * - An AssetsProps object with directory and config
    * - An object with path and hash (e.g., from a Build resource)
    */
-  assets?:
-    | string
-    | AssetsProps
-    | AssetsWithHash
-    | (AssetsWithHash & { [K: string]: any });
+  assets?: Assets;
   subdomain?: {
     enabled?: boolean;
     previewsEnabled?: boolean;
@@ -219,12 +265,29 @@ export interface WorkerProps<
   env?: Record<string, string | Redacted.Redacted<string>>;
   exports?: string[];
   bindings?: Bindings;
+  /**
+   * One or more custom hostnames (e.g. `"app.example.com"`) to bind to this
+   * Worker. The Cloudflare Zone is inferred from the hostname — the zone must
+   * already exist in the account.
+   */
+  domain?: string | string[];
   build?: {
     /**
      * Whether to generate a metafile for the worker bundle.
      * @default false
      */
     metafile?: boolean;
+    /**
+     * Configures the {@link Bundle.purePlugin} which annotates top-level
+     * call/new expressions in matching packages with `/*#__PURE__*\/`
+     * so rolldown can tree-shake them.
+     *
+     * - `undefined` (default): plugin is enabled with default packages
+     *   (`effect`, `@effect/*`).
+     * - `PurePluginOptions`: plugin is enabled with the provided options.
+     * - `false`: plugin is disabled.
+     */
+    pure?: Bundle.BundleExtraOptions["pure"];
   };
 }
 
@@ -239,6 +302,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
     tags: string[] | undefined;
     durableObjectNamespaces: Record<string, string>;
     accountId: string;
+    domains: { hostname: string; id: string; zoneId: string }[];
     hash?: {
       assets: string | undefined;
       bundle: string | undefined;
@@ -295,6 +359,10 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * at runtime, and `Cloudflare.InferEnv` to extract a fully typed
  * `env` object from those bindings.
  *
+ * See the {@link https://alchemy.run/guides/async-worker | Async Workers Guide}
+ * for a comprehensive walkthrough of all binding types (R2, D1,
+ * Durable Objects, Assets, and more).
+ *
  * @example Defining an async Worker in your stack
  * ```typescript
  * // alchemy.run.ts
@@ -579,19 +647,24 @@ export const Worker: Platform<
   WorkerShape,
   WorkerExecutionContext
 > & {
-  <const Bindings extends WorkerBindingProps>(
+  <
+    const Bindings extends WorkerBindingProps,
+    const Assets extends WorkerAssetsConfig | undefined = undefined,
+    Req = never,
+  >(
     id: string,
-    props: InputProps<WorkerProps<Bindings>>,
+    props:
+      | InputProps<WorkerProps<Bindings, Assets>>
+      | Effect.Effect<InputProps<WorkerProps<Bindings, Assets>>, never, Req>,
   ): Effect.Effect<
     Worker<{
-      [B in keyof Bindings]: Bindings[B] extends Effect.Effect<
-        infer T extends WorkerBindingResource,
-        any,
-        any
-      >
-        ? T
-        : Extract<Bindings[B], WorkerBindingResource>;
-    }>
+      [binding in keyof NormalizedBindings<
+        Bindings,
+        Assets
+      >]: NormalizedBindings<Bindings, Assets>[binding];
+    }>,
+    never,
+    Req | Providers
   >;
 } = Platform(WorkerTypeId, {
   onCreate: Effect.fnUntraced(function* (
@@ -608,31 +681,68 @@ export const Worker: Platform<
           ? yield* bindingEff
           : bindingEff;
 
-        const bindingMeta: InputProps<WorkerBinding> | undefined =
-          binding.Type === "Cloudflare.D1Database"
-            ? {
-                type: "d1",
-                id: binding.databaseId,
+        const bindingMeta: InputProps<WorkerBinding> | undefined = isAssets(
+          binding,
+        )
+          ? {
+              type: "assets",
+              name: bindingName,
+            }
+          : isArtifactsBinding(binding)
+            ? ({
+                type: "artifacts",
                 name: bindingName,
-              }
-            : binding.Type === "Cloudflare.R2Bucket"
+                namespace: binding.namespace,
+              } as any)
+            : isDurableObjectNamespaceLike(binding)
               ? {
-                  type: "r2_bucket",
+                  type: "durable_object_namespace",
                   name: bindingName,
-                  bucketName: binding.bucketName,
-                  jurisdiction: binding.jurisdiction.pipe(
-                    Output.map((jurisdiction) =>
-                      jurisdiction === "default" ? undefined : jurisdiction,
-                    ),
-                  ),
+                  className: binding.className ?? binding.name,
                 }
-              : // TODO(sam): handle others
-                undefined;
+              : binding.Type === "Cloudflare.D1Database"
+                ? {
+                    type: "d1",
+                    id: binding.databaseId,
+                    name: bindingName,
+                  }
+                : binding.Type === "Cloudflare.R2Bucket"
+                  ? {
+                      type: "r2_bucket",
+                      name: bindingName,
+                      bucketName: binding.bucketName,
+                      jurisdiction: binding.jurisdiction.pipe(
+                        Output.map((jurisdiction) =>
+                          jurisdiction === "default" ? undefined : jurisdiction,
+                        ),
+                      ),
+                    }
+                  : binding.Type === "Cloudflare.KVNamespace"
+                    ? {
+                        type: "kv_namespace",
+                        name: bindingName,
+                        namespaceId: binding.namespaceId,
+                      }
+                    : binding.Type === "Cloudflare.Queue"
+                      ? {
+                          type: "queue",
+                          name: bindingName,
+                          queueName: binding.queueName,
+                        }
+                      : binding.Type === "Cloudflare.AiGateway"
+                        ? {
+                            type: "ai",
+                            name: bindingName,
+                          }
+                        : // TODO(sam): handle others
+                          undefined;
 
         if (bindingMeta) {
           yield* resource.bind`${bindingName}`({
             bindings: [bindingMeta],
           });
+        } else {
+          return yield* Effect.die(`Unknown binding type: ${bindingName}`);
         }
       }
     }
@@ -662,8 +772,19 @@ export const Worker: Platform<
           Effect.map((json) => {
             try {
               const value = JSON.parse(json);
-              if (!Redacted.isRedacted(value)) {
-                return Redacted.make(value.value);
+              // The `set` path serializes Redacted values as
+              // `{_tag: "Redacted", value: ...}`. After JSON.parse the
+              // result is a plain object — `Redacted.isRedacted` would
+              // always return `false` on it — so detect the marker shape
+              // and rebuild the Redacted wrapper. Plain values pass
+              // through unchanged.
+              if (
+                value !== null &&
+                typeof value === "object" &&
+                (value as { _tag?: unknown })._tag === "Redacted" &&
+                "value" in (value as object)
+              ) {
+                return Redacted.make((value as { value: unknown }).value);
               }
               return value;
             } catch {
@@ -674,20 +795,29 @@ export const Worker: Platform<
       set: (id: string, output: Output.Output) =>
         Effect.sync(() => {
           const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
+          // Preserve `Redacted`-ness across the Output → env → Cloudflare
+          // binding boundary so the put-worker loop can deploy secrets via
+          // `secret_text` instead of leaking them as `plain_text`. The JSON
+          // payload still carries the `{_tag: "Redacted", …}` marker so the
+          // runtime `get` accessor can rebuild the wrapper after Cloudflare
+          // hands the binding back as a plain string.
           env[key] = output.pipe(
             Output.map((value) =>
               Redacted.isRedacted(value)
-                ? JSON.stringify({
-                    _tag: "Redacted",
-                    value: Redacted.value(value),
-                  })
+                ? Redacted.make(
+                    JSON.stringify({
+                      _tag: "Redacted",
+                      value: Redacted.value(value),
+                    }),
+                  )
                 : JSON.stringify(value),
             ),
           );
           return key;
         }),
-      serve: <Req = never>(handler: HttpEffect<Req>) =>
-        ctx.listen(workersHttpHandler(handler)),
+      serve: <Req = never>(
+        handler: HttpEffect<Req> | Effect.Effect<HttpEffect<Req>>,
+      ) => ctx.listen(workersHttpHandler(handler)),
       listen: ((
         handler:
           | Serverless.FunctionListener
@@ -846,18 +976,40 @@ function getDurableObjectTagMap(tags: ReadonlyArray<string>) {
   );
 }
 
+const selectLayer = <
+  LayerLive extends Layer.Layer<any, any, any>,
+  LayerDev extends Layer.Layer<any, any, any>,
+>(input: {
+  live: () => LayerLive;
+  dev: () => LayerDev;
+}): Layer.Layer<
+  Layer.Success<LayerLive | LayerDev>,
+  Layer.Error<LayerLive | LayerDev>,
+  Layer.Services<LayerLive | LayerDev> | AlchemyContext
+> =>
+  Layer.unwrap(
+    AlchemyContext.useSync((context) =>
+      context.dev ? input.dev() : input.live(),
+    ),
+  );
+
 export const WorkerProvider = () =>
+  selectLayer({
+    live: LiveWorkerProvider,
+    dev: () => Layer.provide(LocalWorkerProvider(), SidecarLive),
+  });
+
+export const LiveWorkerProvider = () =>
   Provider.effect(
     Worker,
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
 
-      const accountId = yield* Account;
+      const { accountId } = yield* CloudflareEnvironment;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
       const stack = yield* Stack;
 
-      const { read, upload } = yield* Assets.Assets;
       const createScriptSubdomain = yield* workers.createScriptSubdomain;
       const createScriptTail = yield* workers.createScriptTail;
       const deleteScript = yield* workers.deleteScript;
@@ -865,13 +1017,18 @@ export const WorkerProvider = () =>
       const getScriptSubdomain = yield* workers.getScriptSubdomain;
       const getScriptSettings = yield* workers.getScriptScriptAndVersionSetting;
       const getSubdomain = yield* workers.getSubdomain;
-      const listScripts = yield* workers.listScripts;
       const putScript = yield* workers.putScript;
+      const putDomain = yield* workers.putDomain;
+      const listDomains = yield* workers.listDomains;
+      const deleteDomain = yield* workers.deleteDomain;
+      const listZones = yield* zones.listZones;
       const telemetry = yield* CloudflareLogs;
-      const defaultCompatibilityDate = yield* Effect.promise(() =>
-        // @ts-expect-error no types for workerd
-        import("workerd").then((m) => m.compatibilityDate as string),
-      );
+      // TODO(sam): figure out why the later one from workerd breaks
+      const defaultCompatibilityDate = "2026-03-17";
+      // const defaultCompatibilityDate = yield* Effect.promise(() =>
+      //   // @ts-expect-error no types for workerd
+      //   import("workerd").then((m) => m.compatibilityDate as string),
+      // );
 
       const getAccountSubdomain = (accountId: string) =>
         getSubdomain({
@@ -893,6 +1050,174 @@ export const WorkerProvider = () =>
               maxLength: 54,
             }).pipe(Effect.map((name) => name.toLowerCase()));
 
+      // Convert non-ASCII hostnames (emoji, IDN, etc.) to punycode so the
+      // Cloudflare API receives the form it stores domains in. `new URL(...)`
+      // does IDNA via WHATWG URL parsing — `📦.alchemy.run` → `xn--5z8h.alchemy.run`.
+      const toPunycode = (hostname: string): string => {
+        try {
+          return new URL(`https://${hostname}`).hostname;
+        } catch {
+          return hostname;
+        }
+      };
+
+      const normalizeDomains = (
+        domain: string | string[] | undefined,
+      ): string[] =>
+        domain === undefined
+          ? []
+          : Array.from(
+              new Set(
+                (Array.isArray(domain) ? domain : [domain]).map(toPunycode),
+              ),
+            );
+
+      /**
+       * Infer the Cloudflare Zone ID for a given hostname by listing the
+       * account's zones and matching the hostname against each zone's name —
+       * walking up the DNS label hierarchy until a match is found.
+       */
+      const inferZoneIdForHostname = (
+        hostname: string,
+        zoneCache: Map<string, string>,
+      ) =>
+        Effect.gen(function* () {
+          const cached = zoneCache.get(hostname);
+          if (cached) return cached;
+
+          const zoneList = yield* listZones({}).pipe(
+            Effect.map((response) => response.result ?? []),
+          );
+          for (const zone of zoneList) {
+            zoneCache.set(zone.name, zone.id);
+          }
+
+          const parts = hostname.split(".");
+          for (let i = 0; i < parts.length - 1; i++) {
+            const candidate = parts.slice(i).join(".");
+            const match = zoneList.find((z) => z.name === candidate);
+            if (match) {
+              zoneCache.set(hostname, match.id);
+              return match.id;
+            }
+          }
+          return yield* Effect.die(
+            `Could not infer Cloudflare Zone for hostname "${hostname}". ` +
+              "Ensure the parent zone exists in this account.",
+          );
+        });
+
+      const reconcileDomains = (
+        scriptName: string,
+        desired: string[],
+        _previous: Worker["Attributes"]["domains"],
+      ) =>
+        Effect.gen(function* () {
+          // Always query the live state of domains attached to *this*
+          // Worker rather than trusting `_previous` from local state.
+          // State may have been wiped, populated by another machine, or
+          // simply be out of date. Without this we PUT domains that are
+          // already registered to this same Worker and Cloudflare
+          // returns a confusing "hostname already in use" error.
+          const liveAll = yield* listDomains({
+            accountId,
+            service: scriptName,
+          }).pipe(
+            Effect.map((r) =>
+              (r.result ?? []).flatMap((d) =>
+                d.id && d.hostname && d.zoneId
+                  ? [
+                      {
+                        id: d.id,
+                        hostname: d.hostname,
+                        zoneId: d.zoneId,
+                        service: d.service ?? undefined,
+                      },
+                    ]
+                  : [],
+              ),
+            ),
+            Effect.catch(() => Effect.succeed([])),
+          );
+
+          const desiredSet = new Set(desired);
+          const liveByHostname = new Map(liveAll.map((d) => [d.hostname, d]));
+
+          // Detach what's no longer wanted. Use the live list so we
+          // don't try to delete domains we no longer track.
+          const toRemove = liveAll.filter((d) => !desiredSet.has(d.hostname));
+          yield* Effect.all(
+            toRemove.map((d) =>
+              deleteDomain({ accountId, domainId: d.id }).pipe(
+                Effect.catchTag("DomainNotFound", () => Effect.void),
+              ),
+            ),
+            { concurrency: "unbounded" },
+          );
+
+          if (desired.length === 0) return [];
+
+          const zoneCache = new Map<string, string>();
+
+          // Attach `hostname` to this Worker. Skip the PUT entirely if
+          // the hostname is already attached to *this* Worker — that's a
+          // no-op for Cloudflare and avoids the "already in use" 409.
+          // If it's attached to a *different* Worker, refuse with a
+          // clear message rather than silently re-routing traffic.
+          const attachDomain = Effect.fnUntraced(function* (hostname: string) {
+            const live = liveByHostname.get(hostname);
+            if (live) {
+              return {
+                hostname: live.hostname,
+                id: live.id,
+                zoneId: live.zoneId,
+              };
+            }
+
+            // Not attached to this Worker — but it could still belong
+            // to another Worker. Check before we try to PUT so we can
+            // emit a helpful error instead of the raw 409.
+            const otherOwner = yield* listDomains({
+              accountId,
+              hostname,
+            }).pipe(
+              Effect.map((r) =>
+                (r.result ?? []).find(
+                  (d) => d.hostname === hostname && d.service !== scriptName,
+                ),
+              ),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+            if (otherOwner?.id) {
+              return yield* Effect.die(
+                new Error(
+                  `Cannot attach hostname '${hostname}' to Worker '${scriptName}': ` +
+                    `it is already attached to Worker '${otherOwner.service ?? "<unknown>"}'. ` +
+                    `Detach it from that Worker first, or pick a different hostname.`,
+                ),
+              );
+            }
+
+            const zoneId = yield* inferZoneIdForHostname(hostname, zoneCache);
+            const res = yield* putDomain({
+              accountId,
+              hostname,
+              service: scriptName,
+              zoneId,
+            });
+            return {
+              hostname,
+              id: res.id ?? "",
+              zoneId: res.zoneId ?? zoneId,
+            };
+          });
+
+          const applied = yield* Effect.all(desired.map(attachDomain), {
+            concurrency: "unbounded",
+          });
+          return applied;
+        });
+
       const createAlchemyWorkerTags = (id: string) => [
         `alchemy:stack:${stack.name}`,
         `alchemy:stage:${stack.stage}`,
@@ -974,46 +1299,53 @@ export const WorkerProvider = () =>
       const prepareAssets = Effect.fnUntraced(function* (
         assets: WorkerProps["assets"],
       ) {
-        if (!assets) return undefined;
+        if (!assets) {
+          return undefined;
+        }
 
-        // Handle AssetsWithHash (from Build resource)
-        // Props are resolved by Plan, so Input<string> values are already strings at runtime
         if (
           typeof assets === "object" &&
           "path" in assets &&
           "hash" in assets
         ) {
-          const result = yield* read({
+          return yield* readAssets({
             directory: assets.path as string,
             config: assets.config,
           });
-          return {
-            ...result,
-            hash: assets.hash as string,
-          };
         }
 
         // Handle string path or AssetsProps
-        return yield* read(
+        return yield* readAssets(
           typeof assets === "string" ? { directory: assets } : assets,
         );
       });
 
+      const getCompatibility = (props: WorkerProps) => ({
+        compatibilityDate:
+          props.compatibility?.date ?? defaultCompatibilityDate,
+        compatibilityFlags: props.compatibility?.flags
+          ? [
+              ...props.compatibility.flags,
+              ...(props.isExternal ? [] : ["nodejs_compat"]),
+            ].filter((value, index, self) => self.indexOf(value) === index)
+          : props.isExternal
+            ? []
+            : ["nodejs_compat"],
+      });
+
       const prepareBundle = (id: string, props: WorkerProps) =>
         Effect.gen(function* () {
           const main = yield* fs.realPath(props.main);
           const cwd = yield* findCwdForBundle(main);
+          const { compatibilityDate, compatibilityFlags } =
+            getCompatibility(props);
           const buildBundle = (plugins?: rolldown.RolldownPluginOption) =>
             Bundle.build(
               {
                 input: main,
                 cwd,
                 plugins: [
-                  cloudflareRolldown({
-                    compatibilityDate:
-                      props.compatibility?.date ?? defaultCompatibilityDate,
-                    compatibilityFlags: props.compatibility?.flags,
-                  }),
+                  cloudflareRolldown({ compatibilityDate, compatibilityFlags }),
                   plugins,
                   ...(props.build?.metafile ? [Sonda({ open: false })] : []),
                 ],
@@ -1029,6 +1361,7 @@ export const WorkerProvider = () =>
                 keepNames: true,
                 dir: `.alchemy/bundles/${id}`,
               },
+              { pure: props.build?.pure },
             );
 
           if (props.isExternal) {
@@ -1065,8 +1398,8 @@ import * as Stream from "effect/Stream";
 import { env, DurableObject${hasWfClasses ? ", WorkflowEntrypoint" : ""} } from "cloudflare:workers";
 import { MinimumLogLevel } from "effect/References";
 import { NodeServices } from "@effect/platform-node";
-import { Stack } from "alchemy-effect/Stack";
-import { WorkerEnvironment, makeDurableObjectBridge${hasWfClasses ? ", makeWorkflowBridge" : ""}, ExportedHandlerMethods } from "alchemy-effect/Cloudflare";
+import { Stack } from "alchemy/Stack";
+import { WorkerEnvironment, makeDurableObjectBridge${hasWfClasses ? ", makeWorkflowBridge" : ""}, ExportedHandlerMethods } from "alchemy/Cloudflare";
 
 import entry from "${importPath}";
 
@@ -1095,7 +1428,6 @@ const stack = Layer.succeed(
 
 const exportsEffect = tag.asEffect().pipe(
   Effect.flatMap(func => func.ExecutionContext.exports),
-  Effect.map(exports => exports),
   Effect.provide(
     layer.pipe(
       Layer.provideMerge(stack),
@@ -1168,11 +1500,13 @@ ${[
         }).pipe(Artifacts.cached("build"));
 
       const viteBuild = Effect.fnUntraced(function* (props: WorkerProps) {
-        const vite = yield* Effect.promise(() => import("vite"));
         let assetsDirectory: string | undefined;
         let serverBundle: vite.Rolldown.OutputBundle | undefined;
+        const { compatibilityDate, compatibilityFlags } =
+          getCompatibility(props);
 
         yield* Effect.promise(async () => {
+          const vite = await loadVite(props.vite?.rootDir);
           const builder = await vite.createBuilder(
             {
               root: props.vite?.rootDir,
@@ -1193,9 +1527,8 @@ ${[
               },
               plugins: [
                 cloudflareVite({
-                  compatibilityDate:
-                    props.compatibility?.date ?? defaultCompatibilityDate,
-                  compatibilityFlags: props.compatibility?.flags,
+                  compatibilityDate,
+                  compatibilityFlags,
                 }),
                 {
                   name: "output:ssr",
@@ -1232,7 +1565,7 @@ ${[
         const [assets, bundle] = yield* Effect.all(
           [
             assetsDirectory
-              ? read({
+              ? readAssets({
                   directory: assetsDirectory,
                   config:
                     typeof props.assets === "object" && "config" in props.assets
@@ -1253,7 +1586,20 @@ ${[
         Effect.gen(function* () {
           if (props.vite) {
             const [{ assets, bundle }, input] = yield* Effect.all(
-              [viteBuild(props), hashDirectory(props.vite)],
+              [
+                viteBuild(props),
+                // hashDirectory expects `{ cwd, memo }`. The vite props
+                // store the project root under `rootDir`, so map it
+                // here. Without this, `cwd` falls back to
+                // `process.cwd()` and the input hash is computed over
+                // the wrong directory tree (often the entire monorepo
+                // root), making it both slow and unable to detect
+                // changes scoped to the actual Vite project.
+                hashDirectory({
+                  cwd: props.vite.rootDir,
+                  memo: props.vite.memo,
+                }),
+              ],
               { concurrency: "unbounded" },
             );
             return { assets, bundle, input };
@@ -1306,26 +1652,25 @@ ${[
         let metadataAssets:
           | workers.PutScriptRequest["metadata"]["assets"]
           | undefined;
-        let keepAssets = false;
+        const keepAssets = false;
         if (assets) {
-          if (output?.hash?.assets !== assets.hash) {
-            yield* Effect.logInfo(
-              `Cloudflare Worker ${olds ? "update" : "create"}: uploading assets for ${name}`,
-            );
-            const { jwt } = yield* upload(accountId, name, assets, session);
-            metadataAssets = {
-              jwt,
-              config: assets.config,
-            };
-          } else {
-            yield* Effect.logInfo(
-              `Cloudflare Worker update: reusing existing assets for ${name}`,
-            );
-            metadataAssets = {
-              config: assets.config,
-            };
-            keepAssets = true;
-          }
+          // Always upload assets on every deploy. The "skip if hash
+          // unchanged" optimization was the source of subtle bundle/
+          // asset desync bugs (deploy succeeds but worker serves 404s
+          // because the bundle references hashed asset filenames that
+          // aren't in the still-on-Cloudflare manifest). The upload
+          // session is content-addressed on Cloudflare's side — only
+          // genuinely-new asset bytes are PUT; unchanged assets cost
+          // a manifest check and nothing else, so the optimization
+          // wasn't worth the failure mode.
+          yield* Effect.logInfo(
+            `Cloudflare Worker ${olds ? "update" : "create"}: uploading assets for ${name}`,
+          );
+          const { jwt } = yield* uploadAssets(accountId, name, assets, session);
+          metadataAssets = {
+            jwt,
+            config: assets.config,
+          };
           metadataBindings.push({
             type: "assets",
             name: "ASSETS",
@@ -1514,8 +1859,7 @@ ${[
           assets: metadataAssets,
           bindings: metadataBindings,
           bodyPart: undefined,
-          compatibilityDate: news.compatibility?.date ?? "2026-03-10",
-          compatibilityFlags: news.compatibility?.flags,
+          ...getCompatibility(news),
           containers:
             metadataContainers.length > 0 ? metadataContainers : undefined,
           keepAssets,
@@ -1586,6 +1930,18 @@ ${[
           );
           yield* setWorkerSubdomain(name, enable);
         }
+        const desiredDomains = normalizeDomains(news.domain);
+        const previousDomains = output?.domains ?? [];
+        if (desiredDomains.length > 0 || previousDomains.length > 0) {
+          yield* session.note(
+            `Reconciling custom domains (${desiredDomains.length}) ...`,
+          );
+        }
+        const domains = yield* reconcileDomains(
+          name,
+          desiredDomains,
+          previousDomains,
+        );
         return {
           workerId: worker.id ?? name,
           workerName: name,
@@ -1597,6 +1953,7 @@ ${[
           tags: settings.tags ?? metadata.tags,
           durableObjectNamespaces,
           accountId,
+          domains,
           hash,
         } satisfies Worker["Attributes"];
       });
@@ -1607,14 +1964,21 @@ ${[
         output: Worker["Attributes"],
       ) {
         if (props.vite) {
-          const input = yield* hashDirectory(props.vite);
+          const input = yield* hashDirectory({
+            cwd: props.vite.rootDir,
+            memo: props.vite.memo,
+          });
           return input !== output.hash?.input;
         }
+        // The asset hash comes from walking the actual `outdir` —
+        // whatever bytes are on disk are what we'd be deploying, so
+        // that's what we diff against. Non-deterministic build outputs
+        // (e.g. Astro/Vite shuffling content-hashed chunk filenames)
+        // are a property of the build, not something we should paper
+        // over here. The bundle hash is similarly recomputed.
         const [assetsHash, bundleHash] = yield* Effect.all(
           [
-            "assets" in output && output.hash?.assets
-              ? Effect.succeed(output.hash.assets)
-              : prepareAssets(props.assets).pipe(Effect.map((a) => a?.hash)),
+            prepareAssets(props.assets).pipe(Effect.map((a) => a?.hash)),
             prepareBundle(id, props).pipe(Effect.map((b) => b.hash)),
           ],
           { concurrency: "unbounded" },
@@ -1642,7 +2006,14 @@ ${[
           if (!output) {
             return;
           }
-          if (yield* hasChanged(id, news, output)) {
+          const newDomains = normalizeDomains(news.domain).sort();
+          const oldDomains = (output?.domains ?? [])
+            .map((d) => d.hostname)
+            .sort();
+          const domainsChanged =
+            newDomains.length !== oldDomains.length ||
+            newDomains.some((d, i) => d !== oldDomains[i]);
+          if (domainsChanged || (yield* hasChanged(id, news, output))) {
             return {
               action: "update",
               stables:
@@ -1721,9 +2092,7 @@ ${[
                         className,
                       }))
                     : undefined,
-                compatibilityDate:
-                  news.compatibility?.date ?? defaultCompatibilityDate,
-                compatibilityFlags: news.compatibility?.flags,
+                ...getCompatibility(news),
                 containers,
                 migrations:
                   doClasses.length > 0
@@ -1771,6 +2140,7 @@ ${[
             tags: existingSettings?.tags ?? tags,
             durableObjectNamespaces,
             accountId,
+            domains: [],
           } satisfies Worker["Attributes"];
         }),
         read: Effect.fnUntraced(
@@ -1780,14 +2150,15 @@ ${[
             yield* Effect.logInfo(
               `Cloudflare Worker read: checking ${workerName}`,
             );
-            const [worker, subdomain, settings] = yield* Effect.all([
-              listScripts({
-                accountId,
-              }).pipe(
-                Effect.map((workers) =>
-                  workers.result.find((worker) => worker.id === workerName),
-                ),
-              ),
+            // We deliberately don't call `listScripts({ accountId })` here:
+            // it pulls every Worker on the account back through a strict
+            // schema decode, and a single existing Worker the schema doesn't
+            // know about (e.g. `placement_mode: "targeted"`) breaks the
+            // entire read. `getScriptSettings` already fails with
+            // `WorkerNotFound` if the script doesn't exist, which the
+            // surrounding `Effect.catchTag` turns into `undefined` — that's
+            // all the existence check we need.
+            const [subdomain, settings, domainsList] = yield* Effect.all([
               getScriptSubdomain({
                 accountId,
                 scriptName: workerName,
@@ -1796,21 +2167,19 @@ ${[
                 accountId,
                 scriptName: workerName,
               }),
+              listDomains({
+                accountId,
+                service: workerName,
+              }).pipe(Effect.map((r) => r.result ?? [])),
             ]);
-            if (!worker) {
-              yield* Effect.logInfo(
-                `Cloudflare Worker read: ${workerName} not found in script list`,
-              );
-              return undefined;
-            }
             yield* Effect.logInfo(
               `Cloudflare Worker read: found ${workerName}`,
             );
             return {
               accountId,
-              workerId: worker.id ?? workerName,
+              workerId: workerName,
               workerName,
-              logpush: worker.logpush ?? undefined,
+              logpush: settings.logpush ?? undefined,
               url: subdomain.enabled
                 ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
                 : undefined,
@@ -1818,6 +2187,11 @@ ${[
               durableObjectNamespaces: getDurableObjectNamespaces(
                 settings.bindings,
               ),
+              domains: domainsList.flatMap((d) =>
+                d.id && d.hostname && d.zoneId
+                  ? [{ id: d.id, hostname: d.hostname, zoneId: d.zoneId }]
+                  : [],
+              ),
             } satisfies Worker["Attributes"];
           },
           (effect) =>
@@ -1919,6 +2293,17 @@ ${[
           yield* Effect.logInfo(
             `Cloudflare Worker delete: deleting ${output.workerName}`,
           );
+          if (output.domains?.length) {
+            yield* Effect.all(
+              output.domains.map((d) =>
+                deleteDomain({
+                  accountId: output.accountId,
+                  domainId: d.id,
+                }).pipe(Effect.catchTag("DomainNotFound", () => Effect.void)),
+              ),
+              { concurrency: "unbounded" },
+            );
+          }
           yield* deleteScript({
             accountId: output.accountId,
             scriptName: output.workerName,
@@ -2064,3 +2449,25 @@ const contentTypeFromExtension = (extension: string) => {
       return "application/octet-stream";
   }
 };
+
+type ViteModule = typeof import("vite");
+
+/**
+ * Dynamically load Vite from the project root. Falls back to the bundled
+ * copy if the project doesn't have its own Vite installation.
+ */
+async function loadVite(
+  projectRoot: string = process.cwd(),
+): Promise<ViteModule> {
+  try {
+    const require = createRequire(path.join(projectRoot, "package.json"));
+    const vitePath = require.resolve("vite");
+    // On Windows, absolute paths must be file:// URLs for ESM import().
+    const viteUrl = pathToFileURL(vitePath);
+    return await import(/* @vite-ignore */ viteUrl.href);
+  } catch {
+    // Fallback: try to import vite from the global node_modules (works for non-linked installs)
+    // The fallback is a bare specifier and works as-is.
+    return await import("vite");
+  }
+}