alchemy 2.0.0-beta.4 → 2.0.0-beta.40

package/src/Cloudflare/Workers/Worker.ts

@@ -1,52 +1,66 @@
 import type * as cf from "@cloudflare/workers-types";
-import cloudflareRolldown from "@distilled.cloud/cloudflare-rolldown-plugin";
-import cloudflareVite from "@distilled.cloud/cloudflare-vite-plugin";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as zones from "@distilled.cloud/cloudflare/zones";
-import type * as Cause from "effect/Cause";
+import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
+import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
-import * as Queue from "effect/Queue";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
+import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
-import * as Socket from "effect/unstable/socket/Socket";
-import type * as rolldown from "rolldown";
-import Sonda from "sonda/rolldown";
-import type * as vite from "vite";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Artifacts from "../../Artifacts.ts";
 import * as Binding from "../../Binding.ts";
 import { hashDirectory, type MemoOptions } from "../../Build/Memo.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
-import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
+import { ExecutionContext } from "../../ExecutionContext.ts";
 import type { HttpEffect } from "../../Http.ts";
 import type { InputProps } from "../../Input.ts";
 import * as Output from "../../Output.ts";
-import { createPhysicalName } from "../../PhysicalName.ts";
 import {
   Platform,
   type Main,
   type PlatformProps,
   type Rpc,
 } from "../../Platform.ts";
-import type { LogLine } from "../../Provider.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
-import { Self } from "../../Self.ts";
 import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
-import { Account } from "../Account.ts";
+import { isYieldableEffectLike } from "../../Util/effect.ts";
+import type { AiGateway } from "../AiGateway/AiGateway.ts";
+import {
+  isAnalyticsEngineDataset,
+  type AnalyticsEngineDataset,
+} from "../AnalyticsEngine/AnalyticsEngineDataset.ts";
+import {
+  isArtifacts as isArtifactsBinding,
+  type Artifacts as ArtifactsBinding,
+} from "../Artifacts/Artifacts.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { D1Database } from "../D1/D1Database.ts";
-import { fromCloudflareFetcher } from "../Fetcher.ts";
+import { isSendEmail, type SendEmail } from "../Email/SendEmail.ts";
+import type {
+  Hyperdrive,
+  HyperdriveDevOrigin,
+} from "../Hyperdrive/Hyperdrive.ts";
+import {
+  isImages as isImagesBinding,
+  type Images as ImagesBinding,
+} from "../Images/Images.ts";
+import type { KVNamespace } from "../KV/KVNamespace.ts";
+import { SidecarLive } from "../Local/Sidecar.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
+import type { Queue as CloudflareQueue } from "../Queue/Queue.ts";
 import type { R2Bucket } from "../R2/R2Bucket.ts";
 import {
   isAssets,
@@ -56,16 +70,26 @@ import {
   type AssetsConfig,
   type AssetsProps,
 } from "./Assets.ts";
-import cloudflare_workers from "./cloudflare_workers.ts";
+import { getCompatibility } from "./Compatibility.ts";
 import {
   isDurableObjectExport,
   isDurableObjectNamespaceLike,
   type DurableObjectNamespaceLike,
 } from "./DurableObjectNamespace.ts";
 import { workersHttpHandler } from "./HttpServer.ts";
+import { LocalWorkerProvider } from "./LocalWorkerProvider.ts";
 import { Request } from "./Request.ts";
-import { makeRpcStub } from "./Rpc.ts";
-import { isWorkflowExport } from "./Workflow.ts";
+import {
+  encodeRpcError,
+  ErrorTag,
+  makeRpcStub,
+  toRpcStream,
+  type RpcErrorEnvelope,
+  type RpcStreamEnvelope,
+} from "./Rpc.ts";
+import * as Vite from "./Vite.ts";
+import { WorkerBundle } from "./WorkerBundle.ts";
+import { createWorkerName } from "./WorkerName.ts";
 
 const WorkerTypeId = "Cloudflare.Worker";
 type WorkerTypeId = typeof WorkerTypeId;
@@ -81,15 +105,10 @@ export class WorkerEnvironment extends Context.Service<
   Record<string, any>
 >()("Cloudflare.Workers.WorkerEnvironment") {}
 
-export const WorkerEnvironmentLive = Layer.effect(
-  WorkerEnvironment,
-  cloudflare_workers.pipe(Effect.map((m) => m.env)),
-);
-
-export class ExecutionContext extends Context.Service<
-  ExecutionContext,
+export class WorkerExecutionContext extends Context.Service<
+  WorkerExecutionContext,
   cf.ExecutionContext
->()("Cloudflare.Workers.ExecutionContext") {}
+>()("Cloudflare.Workers.WorkerExecutionContext") {}
 
 export type WorkerEvent = Exclude<
   {
@@ -164,18 +183,27 @@ export const ExportedHandlerMethods = [
   "queue",
 ] as const satisfies (keyof cf.ExportedHandler)[];
 
-export interface WorkerExecutionContext extends Serverless.FunctionContext {
+export interface WorkerRuntimeContext extends Serverless.FunctionContext {
   export(name: string, value: any): Effect.Effect<void>;
 }
 
-export type WorkerServices = Worker | WorkerEnvironment | Request;
+export type WorkerServices = Worker | Request;
 
-export type WorkerShape = Main<WorkerServices>;
+export type WorkerShape = Main<WorkerServices | WorkerEnvironment>;
 
 export type WorkerBindingResource =
   | Assets
   | R2Bucket
   | D1Database
+  | KVNamespace
+  | CloudflareQueue
+  | AiGateway
+  | AnalyticsEngineDataset
+  | SendEmail
+  | ArtifactsBinding
+  | ImagesBinding
+  | Hyperdrive
+  | Worker
   | DurableObjectNamespaceLike<any>;
 
 export type WorkerBindings = {
@@ -236,6 +264,15 @@ export interface WorkerProps<
     memo?: MemoOptions;
   };
   logpush?: boolean;
+  /**
+   * Cloudflare Workers Observability settings. Controls Workers Logs
+   * (`logs`) and Workers Traces (`traces`), each with their own
+   * `enabled`, `headSamplingRate`, and `persist` toggles.
+   *
+   * If omitted, defaults to `{ enabled: true, logs: { enabled: true,
+   * invocationLogs: true } }`. Traces are off by default — opt in via
+   * `traces: { enabled: true, ... }`.
+   */
   observability?: WorkerObservability;
   tags?: string[];
   main: string;
@@ -245,9 +282,24 @@ export interface WorkerProps<
   };
   limits?: WorkerLimits;
   placement?: WorkerPlacement;
-  env?: Record<string, string | Redacted.Redacted<string>>;
+  env?: Record<
+    string,
+    | string
+    | number
+    | boolean
+    | null
+    | readonly unknown[]
+    | { readonly [key: string]: unknown }
+    | Redacted.Redacted<string>
+  >;
   exports?: string[];
   bindings?: Bindings;
+  /**
+   * Cron expressions that trigger the Worker's scheduled handler.
+   *
+   * Pass an empty array to remove all Cron Triggers.
+   */
+  crons?: string[];
   /**
    * One or more custom hostnames (e.g. `"app.example.com"`) to bind to this
    * Worker. The Cloudflare Zone is inferred from the hostname — the zone must
@@ -260,6 +312,17 @@ export interface WorkerProps<
      * @default false
      */
     metafile?: boolean;
+    /**
+     * Configures the {@link Bundle.purePlugin} which annotates top-level
+     * call/new expressions in matching packages with `/*#__PURE__*\/`
+     * so rolldown can tree-shake them.
+     *
+     * - `undefined` (default): plugin is enabled with default packages
+     *   (`effect`, `@effect/*`).
+     * - `PurePluginOptions`: plugin is enabled with the provided options.
+     * - `false`: plugin is disabled.
+     */
+    pure?: Bundle.BundleExtraOptions["pure"];
   };
 }
 
@@ -275,6 +338,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
     durableObjectNamespaces: Record<string, string>;
     accountId: string;
     domains: { hostname: string; id: string; zoneId: string }[];
+    crons: string[];
     hash?: {
       assets: string | undefined;
       bundle: string | undefined;
@@ -284,6 +348,8 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
   {
     bindings?: WorkerBinding[];
     containers?: { className: string }[];
+    crons?: string[];
+    hyperdrives?: Record<string, Required<HyperdriveDevOrigin>>;
   },
   Providers
 >;
@@ -375,7 +441,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * ```typescript
  * export default class MyWorker extends Cloudflare.Worker<MyWorker>()(
  *   "MyWorker",
- *   { main: import.meta.path },
+ *   { main: import.meta.filename },
  *   Effect.gen(function* () {
  *     // init: bind resources
  *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
@@ -410,7 +476,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * // src/WorkerB.ts
  * export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
  *   "WorkerB",
- *   { main: import.meta.path },
+ *   { main: import.meta.filename },
  * ) {}
  *
  * export default WorkerB.make(
@@ -437,7 +503,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  *
  * export default class WorkerA extends Cloudflare.Worker<WorkerA>()(
  *   "WorkerA",
- *   { main: import.meta.path },
+ *   { main: import.meta.filename },
  *   Effect.gen(function* () {
  *     const b = yield* Cloudflare.Worker.bind(WorkerB);
  *     return {
@@ -456,7 +522,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * @example Enabling Node.js compatibility
  * ```typescript
  * {
- *   main: import.meta.path,
+ *   main: import.meta.filename,
  *   compatibility: {
  *     flags: ["nodejs_compat"],
  *     date: "2026-03-17",
@@ -467,11 +533,43 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * @example Serving static assets
  * ```typescript
  * {
- *   main: import.meta.path,
+ *   main: import.meta.filename,
  *   assets: "./public",
  * }
  * ```
  *
+ * @section Observability
+ * Cloudflare Workers Observability is on by default — `logs.enabled` and
+ * `logs.invocationLogs` are turned on if you don't pass an `observability`
+ * prop. Pass the prop yourself to tune sampling, enable persistence, or
+ * turn on the new `traces` channel (the same toggle the dashboard's
+ * Observability tab writes).
+ *
+ * Field names match the Cloudflare API (camelCased): `headSamplingRate`,
+ * `invocationLogs`, etc.
+ *
+ * @example Enabling logs and traces
+ * ```typescript
+ * {
+ *   main: import.meta.filename,
+ *   observability: {
+ *     enabled: true,
+ *     headSamplingRate: 1,
+ *     logs: {
+ *       enabled: true,
+ *       invocationLogs: true,
+ *       headSamplingRate: 1,
+ *       persist: true,
+ *     },
+ *     traces: {
+ *       enabled: true,
+ *       headSamplingRate: 1,
+ *       persist: true,
+ *     },
+ *   },
+ * }
+ * ```
+ *
  * @section R2 Bucket
  * Bind an R2 bucket in the init phase with `Cloudflare.R2Bucket.bind`.
  * The returned handle exposes `get`, `put`, `delete`, and `list`
@@ -617,7 +715,7 @@ export const Worker: Platform<
   Worker,
   WorkerServices,
   WorkerShape,
-  WorkerExecutionContext
+  WorkerRuntimeContext
 > & {
   <
     const Bindings extends WorkerBindingProps,
@@ -649,8 +747,11 @@ export const Worker: Platform<
         const bindingEff = props.bindings?.[bindingName] as
           | WorkerBindingResource
           | Effect.Effect<WorkerBindingResource>;
-        const binding = Effect.isEffect(bindingEff)
-          ? yield* bindingEff
+        // Bindings can be passed as a plain resource value, an Effect that
+        // yields a resource, or an effect-class (e.g. a `Cloudflare.Worker`
+        // class). Resolve the yieldable forms before deriving binding metadata.
+        const binding = isYieldableEffectLike(bindingEff)
+          ? ((yield* bindingEff as Effect.Effect<unknown>) as WorkerBindingResource)
           : bindingEff;
 
         const bindingMeta: InputProps<WorkerBinding> | undefined = isAssets(
@@ -660,31 +761,88 @@ export const Worker: Platform<
               type: "assets",
               name: bindingName,
             }
-          : isDurableObjectNamespaceLike(binding)
-            ? {
-                type: "durable_object_namespace",
+          : isArtifactsBinding(binding)
+            ? ({
+                type: "artifacts",
                 name: bindingName,
-                className: binding.className ?? binding.name,
-              }
-            : binding.Type === "Cloudflare.D1Database"
+                namespace: binding.namespace,
+              } as any)
+            : isImagesBinding(binding)
               ? {
-                  type: "d1",
-                  id: binding.databaseId,
+                  type: "images",
                   name: bindingName,
                 }
-              : binding.Type === "Cloudflare.R2Bucket"
+              : isAnalyticsEngineDataset(binding)
                 ? {
-                    type: "r2_bucket",
+                    type: "analytics_engine",
                     name: bindingName,
-                    bucketName: binding.bucketName,
-                    jurisdiction: binding.jurisdiction.pipe(
-                      Output.map((jurisdiction) =>
-                        jurisdiction === "default" ? undefined : jurisdiction,
-                      ),
-                    ),
+                    dataset: binding.dataset,
                   }
-                : // TODO(sam): handle others
-                  undefined;
+                : isSendEmail(binding)
+                  ? {
+                      type: "send_email",
+                      name: bindingName,
+                      destinationAddress: binding.destinationAddress,
+                      allowedDestinationAddresses:
+                        binding.allowedDestinationAddresses,
+                      allowedSenderAddresses: binding.allowedSenderAddresses,
+                    }
+                  : isDurableObjectNamespaceLike(binding)
+                    ? {
+                        type: "durable_object_namespace",
+                        name: bindingName,
+                        className: binding.className ?? binding.name,
+                      }
+                    : binding.Type === "Cloudflare.D1Database"
+                      ? {
+                          type: "d1",
+                          id: binding.databaseId,
+                          name: bindingName,
+                        }
+                      : binding.Type === "Cloudflare.R2Bucket"
+                        ? {
+                            type: "r2_bucket",
+                            name: bindingName,
+                            bucketName: binding.bucketName,
+                            jurisdiction: binding.jurisdiction.pipe(
+                              Output.map((jurisdiction) =>
+                                jurisdiction === "default"
+                                  ? undefined
+                                  : jurisdiction,
+                              ),
+                            ),
+                          }
+                        : binding.Type === "Cloudflare.KVNamespace"
+                          ? {
+                              type: "kv_namespace",
+                              name: bindingName,
+                              namespaceId: binding.namespaceId,
+                            }
+                          : binding.Type === "Cloudflare.Queue"
+                            ? {
+                                type: "queue",
+                                name: bindingName,
+                                queueName: binding.queueName,
+                              }
+                            : binding.Type === "Cloudflare.AiGateway"
+                              ? {
+                                  type: "ai",
+                                  name: bindingName,
+                                }
+                              : binding.Type === "Cloudflare.Hyperdrive"
+                                ? {
+                                    type: "hyperdrive",
+                                    name: bindingName,
+                                    id: binding.hyperdriveId,
+                                  }
+                                : isWorker(binding)
+                                  ? {
+                                      type: "service",
+                                      name: bindingName,
+                                      service: binding.workerName,
+                                    }
+                                  : // TODO(sam): handle others
+                                    undefined;
 
         if (bindingMeta) {
           yield* resource.bind`${bindingName}`({
@@ -696,10 +854,11 @@ export const Worker: Platform<
       }
     }
   }),
-  createExecutionContext: (id: string): WorkerExecutionContext => {
+  createRuntimeContext: (id: string): WorkerRuntimeContext => {
     const listeners: Effect.Effect<Serverless.FunctionListener>[] = [];
     const exports: Record<string, any> = {};
     const env: Record<string, any> = {};
+    let userShape: Record<string, unknown> | undefined;
 
     const ctx = {
       Type: WorkerTypeId,
@@ -721,8 +880,19 @@ export const Worker: Platform<
           Effect.map((json) => {
             try {
               const value = JSON.parse(json);
-              if (!Redacted.isRedacted(value)) {
-                return Redacted.make(value.value);
+              // The `set` path serializes Redacted values as
+              // `{_tag: "Redacted", value: ...}`. After JSON.parse the
+              // result is a plain object — `Redacted.isRedacted` would
+              // always return `false` on it — so detect the marker shape
+              // and rebuild the Redacted wrapper. Plain values pass
+              // through unchanged.
+              if (
+                value !== null &&
+                typeof value === "object" &&
+                (value as { _tag?: unknown })._tag === "Redacted" &&
+                "value" in (value as object)
+              ) {
+                return Redacted.make((value as { value: unknown }).value);
               }
               return value;
             } catch {
@@ -733,20 +903,36 @@ export const Worker: Platform<
       set: (id: string, output: Output.Output) =>
         Effect.sync(() => {
           const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
+          // Preserve `Redacted`-ness across the Output → env → Cloudflare
+          // binding boundary so the put-worker loop can deploy secrets via
+          // `secret_text` instead of leaking them as `plain_text`. The JSON
+          // payload still carries the `{_tag: "Redacted", …}` marker so the
+          // runtime `get` accessor can rebuild the wrapper after Cloudflare
+          // hands the binding back as a plain string.
           env[key] = output.pipe(
             Output.map((value) =>
               Redacted.isRedacted(value)
-                ? JSON.stringify({
-                    _tag: "Redacted",
-                    value: Redacted.value(value),
-                  })
+                ? Redacted.make(
+                    JSON.stringify({
+                      _tag: "Redacted",
+                      value: Redacted.value(value),
+                    }),
+                  )
                 : JSON.stringify(value),
             ),
           );
           return key;
         }),
-      serve: <Req = never>(handler: HttpEffect<Req>) =>
-        ctx.listen(workersHttpHandler(handler)),
+      serve: <Req = never>(
+        handler: HttpEffect<Req> | Effect.Effect<HttpEffect<Req>>,
+        options?: { shape?: Record<string, unknown> },
+      ) => {
+        // Capture the user's full default-export shape so `exports` can
+        // expose any non-handler methods on it as RPC methods on the
+        // deployed `WorkerEntrypoint` subclass — see `__rpc__` below.
+        if (options?.shape) userShape = options.shape;
+        return ctx.listen(workersHttpHandler(handler));
+      },
       listen: ((
         handler:
           | Serverless.FunctionListener
@@ -766,6 +952,35 @@ export const Worker: Platform<
           concurrency: "unbounded",
         });
         const services = yield* Effect.context();
+
+        // Provide the per-request runtime layer (services + `WorkerExecutionContext`
+        // + a fresh `ExecutionContext`/`Scope`) to a user effect, then run it.
+        // This is the bridge between Cloudflare's request-time callback and
+        // the user's Effect-native handler. Used by both the standard
+        // `handle()` dispatch (fetch/scheduled/…) and the per-RPC dispatchers
+        // below — keeping them on a single layer-provision path.
+        const runUserEffect = <A, E>(
+          eff: Effect.Effect<A, E>,
+          context: cf.ExecutionContext,
+        ): Promise<Exit.Exit<A, E>> => {
+          const scope = Scope.makeUnsafe();
+          return eff
+            .pipe(
+              Effect.provideContext(services),
+              Scope.provide(scope),
+              Effect.provide(Layer.succeed(WorkerExecutionContext, context)),
+              Effect.provide(
+                Layer.succeed(ExecutionContext, { scope, cache: {} }),
+              ),
+              Effect.runPromiseExit,
+            )
+            .finally(() =>
+              context.waitUntil(
+                Effect.runPromise(Scope.close(scope, Exit.void)),
+              ),
+            );
+        };
+
         const handle =
           (type: WorkerEvent["type"]) =>
           (request: any, env: unknown, context: cf.ExecutionContext) => {
@@ -779,20 +994,76 @@ export const Worker: Platform<
             for (const handler of handlers) {
               const eff = handler(event);
               if (Effect.isEffect(eff)) {
-                return eff.pipe(
-                  Effect.provideContext(services),
-                  Effect.provide(Layer.succeed(ExecutionContext, context)),
-                  Effect.runPromise,
-                );
+                return runUserEffect(
+                  eff as Effect.Effect<unknown, unknown>,
+                  context,
+                ).then((exit) => {
+                  if (exit._tag === "Success") return exit.value;
+                  throw Cause.squash(exit.cause);
+                });
               }
             }
             return Promise.reject(new Error("No event handler found"));
           };
+
+        // RPC method dispatchers — one per non-handler method on the user's
+        // shape. Each dispatcher is invoked by the WorkerEntrypoint bridge
+        // as `dispatcher(args, ctx)`: `args` are the user-facing call args,
+        // `ctx` is the `this.ctx` that Cloudflare hands the bridge per RPC
+        // request. The dispatcher runs the user effect with the same runtime
+        // layer the fetch path uses, then envelope-encodes the result so
+        // `Effect.fail` round-trips as `RpcErrorEnvelope` and `Stream` as
+        // `RpcStreamEnvelope` (consumers wrap the binding with
+        // `toPromiseApi`/`bindWorker` to decode).
+        const exportedHandlerSet = new Set<string>(ExportedHandlerMethods);
+        const rpcDispatchers: Record<
+          string,
+          (args: unknown[], ctx: cf.ExecutionContext) => Promise<unknown>
+        > = {};
+        if (userShape) {
+          for (const [name, value] of Object.entries(userShape)) {
+            if (exportedHandlerSet.has(name)) continue;
+            if (typeof value !== "function") continue;
+            rpcDispatchers[name] = async (
+              args: unknown[],
+              context: cf.ExecutionContext,
+            ) => {
+              const result = (value as (...a: unknown[]) => unknown)(...args);
+              if (!Effect.isEffect(result)) return result;
+              const exit = await runUserEffect(
+                result as Effect.Effect<unknown, unknown>,
+                context,
+              );
+              if (exit._tag === "Success") {
+                if (Stream.isStream(exit.value)) {
+                  return await Effect.runPromise(
+                    toRpcStream(exit.value) as Effect.Effect<RpcStreamEnvelope>,
+                  );
+                }
+                return exit.value;
+              }
+              const failReason = exit.cause.reasons.find(Cause.isFailReason);
+              if (failReason) {
+                return {
+                  _tag: ErrorTag,
+                  error: encodeRpcError(failReason.error),
+                } satisfies RpcErrorEnvelope;
+              }
+              const dieReason = exit.cause.reasons.find(Cause.isDieReason);
+              throw (
+                dieReason?.defect ??
+                new Error("RPC method failed with an unexpected cause")
+              );
+            };
+          }
+        }
+
         return {
           ...exports,
           default: Object.fromEntries(
             ExportedHandlerMethods.map((method) => [method, handle(method)]),
           ),
+          __rpc__: rpcDispatchers,
         };
       }),
     };
@@ -805,7 +1076,10 @@ export const bindWorker = Effect.fnUntraced(function* <Shape, Req = never>(
     | (Worker & Rpc<Shape>)
     | Effect.Effect<Worker & Rpc<Shape>, never, Req>,
 ) {
-  const worker = Effect.isEffect(workerEff) ? yield* workerEff : workerEff;
+  // Worker classes and regular Effects are both yieldable here.
+  const worker = isYieldableEffectLike(workerEff)
+    ? yield* workerEff as Effect.Effect<Worker & Rpc<Shape>, never, Req>
+    : workerEff;
   const self = yield* Worker;
   yield* self.bind`${worker}`({
     bindings: [
@@ -817,13 +1091,14 @@ export const bindWorker = Effect.fnUntraced(function* <Shape, Req = never>(
     ],
   });
 
-  const workerBinding = WorkerEnvironment.asEffect().pipe(
-    Effect.map((env) => env[worker.LogicalId]),
+  // `bindWorker` runs at *init* phase (both at plantime and at runtime
+  // cold-start). `WorkerEnvironment` only exists at exec phase on the
+  // deployed worker, so we hand `makeRpcStub` an `Effect<stub>` that
+  // resolves the binding lazily on each method call.
+  const stubEff = WorkerEnvironment.pipe(
+    Effect.map((env) => (env as Record<string, unknown>)[worker.LogicalId]),
   );
-
-  const fetcher = workerBinding.pipe(Effect.map(fromCloudflareFetcher));
-  // TODO(sam): update makeRpcStub to support lazily evaluating the Effect<Fetcher>
-  return makeRpcStub<Shape>(fetcher);
+  return makeRpcStub<Shape>(stubEff);
 });
 
 export class BindWorkerPolicy extends Binding.Policy<
@@ -891,6 +1166,12 @@ function getDurableObjectBindings(
   );
 }
 
+export function getCronBindings(
+  bindings: ReadonlyArray<ResourceBinding<Worker["Binding"]>>,
+) {
+  return Array.from(new Set(bindings.flatMap((b) => b.data.crons ?? [])));
+}
+
 function getDurableObjectTagMap(tags: ReadonlyArray<string>) {
   return Object.fromEntries(
     tags.flatMap((tag) => {
@@ -905,64 +1186,147 @@ function getDurableObjectTagMap(tags: ReadonlyArray<string>) {
   );
 }
 
+const selectLayer = <
+  LayerLive extends Layer.Layer<any, any, any>,
+  LayerDev extends Layer.Layer<any, any, any>,
+>(input: {
+  live: () => LayerLive;
+  dev: () => LayerDev;
+}): Layer.Layer<
+  Layer.Success<LayerLive | LayerDev>,
+  Layer.Error<LayerLive | LayerDev>,
+  Layer.Services<LayerLive | LayerDev> | AlchemyContext
+> =>
+  Layer.unwrap(
+    AlchemyContext.useSync((context) =>
+      context.dev ? input.dev() : input.live(),
+    ),
+  );
+
 export const WorkerProvider = () =>
+  selectLayer({
+    live: LiveWorkerProvider,
+    dev: () => Layer.provide(LocalWorkerProvider(), SidecarLive),
+  });
+
+export const LiveWorkerProvider = () =>
   Provider.effect(
     Worker,
     Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
 
-      const accountId = yield* Account;
-      const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+      const { accountId } = yield* CloudflareEnvironment;
+      const bundler = yield* WorkerBundle;
       const stack = yield* Stack;
 
       const createScriptSubdomain = yield* workers.createScriptSubdomain;
-      const createScriptTail = yield* workers.createScriptTail;
       const deleteScript = yield* workers.deleteScript;
-      const deleteScriptTail = yield* workers.deleteScriptTail;
       const getScriptSubdomain = yield* workers.getScriptSubdomain;
+      const getScriptSchedule = yield* workers.getScriptSchedule;
       const getScriptSettings = yield* workers.getScriptScriptAndVersionSetting;
       const getSubdomain = yield* workers.getSubdomain;
-      const listScripts = yield* workers.listScripts;
       const putScript = yield* workers.putScript;
+      const putScriptSchedule = yield* workers.putScriptSchedule;
       const putDomain = yield* workers.putDomain;
       const listDomains = yield* workers.listDomains;
       const deleteDomain = yield* workers.deleteDomain;
       const listZones = yield* zones.listZones;
       const telemetry = yield* CloudflareLogs;
-      const defaultCompatibilityDate = yield* Effect.promise(() =>
-        // @ts-expect-error no types for workerd
-        import("workerd").then((m) => m.compatibilityDate as string),
-      );
 
       const getAccountSubdomain = (accountId: string) =>
         getSubdomain({
           accountId,
         }).pipe(Effect.map((result) => result.subdomain));
 
+      // Toggle the workers.dev subdomain via `POST /subdomain` with
+      // `enabled: true | false`. Mirrors the upstream Alchemy
+      // implementation in `.vendor/alchemy/.../worker-subdomain.ts`.
+      // When enabling we also set `previewsEnabled: true` so the
+      // script is reachable both at its stable workers.dev URL and at
+      // version-preview URLs; on disable we send just `enabled: false`.
       const setWorkerSubdomain = (name: string, enabled: boolean) =>
         createScriptSubdomain({
           accountId,
           scriptName: name,
           enabled,
+          previewsEnabled: enabled ? true : undefined,
         });
 
-      const createWorkerName = (id: string, name: string | undefined) =>
-        name
-          ? Effect.succeed(name)
-          : createPhysicalName({
-              id,
-              maxLength: 54,
-            }).pipe(Effect.map((name) => name.toLowerCase()));
+      // Convert non-ASCII hostnames (emoji, IDN, etc.) to punycode so the
+      // Cloudflare API receives the form it stores domains in. `new URL(...)`
+      // does IDNA via WHATWG URL parsing — `📦.alchemy.run` → `xn--5z8h.alchemy.run`.
+      const toPunycode = (hostname: string): string => {
+        try {
+          return new URL(`https://${hostname}`).hostname;
+        } catch {
+          return hostname;
+        }
+      };
 
       const normalizeDomains = (
         domain: string | string[] | undefined,
       ): string[] =>
         domain === undefined
           ? []
-          : Array.isArray(domain)
-            ? Array.from(new Set(domain))
-            : [domain];
+          : Array.from(
+              new Set(
+                (Array.isArray(domain) ? domain : [domain]).map(toPunycode),
+              ),
+            );
+
+      const normalizeCrons = (crons: string[] | undefined): string[] =>
+        Array.from(new Set(crons ?? []));
+
+      const getWorkerCrons = (scriptName: string) =>
+        getScriptSchedule({
+          accountId,
+          scriptName,
+        }).pipe(
+          Effect.map((response) =>
+            normalizeCrons(response.schedules.map((schedule) => schedule.cron)),
+          ),
+          Effect.catchTag("WorkerNotFound", () => Effect.succeed([])),
+        );
+
+      const reconcileCrons = (
+        scriptName: string,
+        desired: string[],
+        previous: string[],
+        session: ScopedPlanStatusSession,
+      ) =>
+        Effect.gen(function* () {
+          const live = yield* getWorkerCrons(scriptName);
+          const desiredSorted = [...desired].sort();
+          const liveSorted = [...live].sort();
+          const changed =
+            desiredSorted.length !== liveSorted.length ||
+            desiredSorted.some((cron, index) => cron !== liveSorted[index]);
+
+          if (!changed) return live;
+
+          if (desired.length > 0 || previous.length > 0 || live.length > 0) {
+            yield* session.note(
+              `Reconciling Cron Triggers (${desired.length}) ...`,
+            );
+          }
+
+          const result = yield* putScriptSchedule({
+            accountId,
+            scriptName,
+            body: desired.map((cron) => ({ cron })),
+          }).pipe(
+            Effect.retry({
+              while: (error: { _tag?: string }) =>
+                error?._tag === "WorkerNotFound",
+              schedule: Schedule.exponential(200).pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
+          );
+          return normalizeCrons(
+            result.schedules.map((schedule) => schedule.cron),
+          );
+        });
 
       /**
        * Infer the Cloudflare Zone ID for a given hostname by listing the
@@ -1002,11 +1366,42 @@ export const WorkerProvider = () =>
       const reconcileDomains = (
         scriptName: string,
         desired: string[],
-        previous: Worker["Attributes"]["domains"],
+        _previous: Worker["Attributes"]["domains"],
       ) =>
         Effect.gen(function* () {
+          // Always query the live state of domains attached to *this*
+          // Worker rather than trusting `_previous` from local state.
+          // State may have been wiped, populated by another machine, or
+          // simply be out of date. Without this we PUT domains that are
+          // already registered to this same Worker and Cloudflare
+          // returns a confusing "hostname already in use" error.
+          const liveAll = yield* listDomains({
+            accountId,
+            service: scriptName,
+          }).pipe(
+            Effect.map((r) =>
+              (r.result ?? []).flatMap((d) =>
+                d.id && d.hostname && d.zoneId
+                  ? [
+                      {
+                        id: d.id,
+                        hostname: d.hostname,
+                        zoneId: d.zoneId,
+                        service: d.service ?? undefined,
+                      },
+                    ]
+                  : [],
+              ),
+            ),
+            Effect.catch(() => Effect.succeed([])),
+          );
+
           const desiredSet = new Set(desired);
-          const toRemove = previous.filter((p) => !desiredSet.has(p.hostname));
+          const liveByHostname = new Map(liveAll.map((d) => [d.hostname, d]));
+
+          // Detach what's no longer wanted. Use the live list so we
+          // don't try to delete domains we no longer track.
+          const toRemove = liveAll.filter((d) => !desiredSet.has(d.hostname));
           yield* Effect.all(
             toRemove.map((d) =>
               deleteDomain({ accountId, domainId: d.id }).pipe(
@@ -1019,28 +1414,75 @@ export const WorkerProvider = () =>
           if (desired.length === 0) return [];
 
           const zoneCache = new Map<string, string>();
-          const applied = yield* Effect.all(
-            desired.map((hostname) =>
-              Effect.gen(function* () {
-                const zoneId = yield* inferZoneIdForHostname(
-                  hostname,
-                  zoneCache,
-                );
-                const res = yield* putDomain({
-                  accountId,
-                  hostname,
-                  service: scriptName,
-                  zoneId,
-                });
-                return {
-                  hostname,
-                  id: res.id ?? "",
-                  zoneId: res.zoneId ?? zoneId,
-                };
+
+          // Attach `hostname` to this Worker. Skip the PUT entirely if
+          // the hostname is already attached to *this* Worker — that's a
+          // no-op for Cloudflare and avoids the "already in use" 409.
+          // If it's attached to a *different* Worker, refuse with a
+          // clear message rather than silently re-routing traffic.
+          const attachDomain = Effect.fnUntraced(function* (hostname: string) {
+            const live = liveByHostname.get(hostname);
+            if (live) {
+              return {
+                hostname: live.hostname,
+                id: live.id,
+                zoneId: live.zoneId,
+              };
+            }
+
+            // Not attached to this Worker — but it could still belong
+            // to another Worker. Check before we try to PUT so we can
+            // emit a helpful error instead of the raw 409.
+            const otherOwner = yield* listDomains({
+              accountId,
+              hostname,
+            }).pipe(
+              Effect.map((r) =>
+                (r.result ?? []).find(
+                  (d) => d.hostname === hostname && d.service !== scriptName,
+                ),
+              ),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+            if (otherOwner?.id) {
+              return yield* Effect.die(
+                new Error(
+                  `Cannot attach hostname '${hostname}' to Worker '${scriptName}': ` +
+                    `it is already attached to Worker '${otherOwner.service ?? "<unknown>"}'. ` +
+                    `Detach it from that Worker first, or pick a different hostname.`,
+                ),
+              );
+            }
+
+            const zoneId = yield* inferZoneIdForHostname(hostname, zoneCache);
+            // Same eventual-consistency window as `setWorkerSubdomain`:
+            // PUT /accounts/.../workers/domains right after `putScript`
+            // can return `WorkerNotFound` until Cloudflare's script
+            // registry has propagated. Retry on that specific tag.
+            const res = yield* putDomain({
+              accountId,
+              hostname,
+              service: scriptName,
+              zoneId,
+            }).pipe(
+              Effect.retry({
+                while: (error: { _tag?: string }) =>
+                  error?._tag === "WorkerNotFound",
+                schedule: Schedule.exponential(200).pipe(
+                  Schedule.both(Schedule.recurs(15)),
+                ),
               }),
-            ),
-            { concurrency: "unbounded" },
-          );
+            );
+            return {
+              hostname,
+              id: res.id ?? "",
+              zoneId: res.zoneId ?? zoneId,
+            };
+          });
+
+          const applied = yield* Effect.all(desired.map(attachDomain), {
+            concurrency: "unbounded",
+          });
           return applied;
         });
 
@@ -1129,21 +1571,15 @@ export const WorkerProvider = () =>
           return undefined;
         }
 
-        // Handle AssetsWithHash (from Build resource)
-        // Props are resolved by Plan, so Input<string> values are already strings at runtime
         if (
           typeof assets === "object" &&
           "path" in assets &&
           "hash" in assets
         ) {
-          const result = yield* readAssets({
+          return yield* readAssets({
             directory: assets.path as string,
             config: assets.config,
           });
-          return {
-            ...result,
-            hash: assets.hash as string,
-          };
         }
 
         // Handle string path or AssetsProps
@@ -1153,230 +1589,35 @@ export const WorkerProvider = () =>
       });
 
       const prepareBundle = (id: string, props: WorkerProps) =>
-        Effect.gen(function* () {
-          const main = yield* fs.realPath(props.main);
-          const cwd = yield* findCwdForBundle(main);
-          const buildBundle = (plugins?: rolldown.RolldownPluginOption) =>
-            Bundle.build(
-              {
-                input: main,
-                cwd,
-                plugins: [
-                  cloudflareRolldown({
-                    compatibilityDate:
-                      props.compatibility?.date ?? defaultCompatibilityDate,
-                    compatibilityFlags: props.compatibility?.flags,
-                  }),
-                  plugins,
-                  ...(props.build?.metafile ? [Sonda({ open: false })] : []),
-                ],
-                checks: {
-                  // Suppress unresolved import warnings for unrelated AWS packages
-                  unresolvedImport: false,
+        bundler
+          .build({
+            id,
+            main: props.main,
+            compatibility: getCompatibility(props),
+            entry: props.isExternal
+              ? {
+                  kind: "external",
+                }
+              : {
+                  kind: "effect",
+                  exports: (props.exports ?? {}) as any,
                 },
-              },
-              {
-                format: "esm",
-                sourcemap: "hidden",
-                minify: true,
-                keepNames: true,
-                dir: `.alchemy/bundles/${id}`,
-              },
-            );
-
-          if (props.isExternal) {
-            const bundle = yield* buildBundle();
-            return bundle;
-          }
-
-          const exportMap = (props.exports ?? {}) as Record<string, unknown>;
-          const allExportNames = Object.keys(exportMap).filter(
-            (id) => id !== "default",
-          );
-          const doClasses: string[] = [];
-          const wfClasses: string[] = [];
-          for (const name of allExportNames) {
-            if (isWorkflowExport(exportMap[name])) {
-              wfClasses.push(name);
-            } else if (isDurableObjectExport(exportMap[name])) {
-              doClasses.push(name);
-            }
-          }
-          const hasDoClasses = doClasses.length > 0;
-          const hasWfClasses = wfClasses.length > 0;
-          const script = (importPath: string) => `
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Console from "effect/Console";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Context from "effect/Context";
-import * as Stream from "effect/Stream";
-
-import { env, DurableObject${hasWfClasses ? ", WorkflowEntrypoint" : ""} } from "cloudflare:workers";
-import { MinimumLogLevel } from "effect/References";
-import { NodeServices } from "@effect/platform-node";
-import { Stack } from "alchemy/Stack";
-import { WorkerEnvironment, makeDurableObjectBridge${hasWfClasses ? ", makeWorkflowBridge" : ""}, ExportedHandlerMethods } from "alchemy/Cloudflare";
-
-import entry from "${importPath}";
-
-const tag = Context.Service("${Self.key}")
-const layer =
-  typeof entry?.build === "function"
-    ? entry
-    : Layer.effect(tag, typeof entry?.asEffect === "function" ? entry.asEffect() : entry);
-
-const platform = Layer.mergeAll(
-  NodeServices.layer,
-  FetchHttpClient.layer,
-  // TODO(sam): wire this up to telemetry more directly
-  Logger.layer([Logger.consolePretty()]),
-);
-
-const stack = Layer.succeed(
-  Stack,
-  {
-    name: "${stack.name}",
-    stage: "${stack.stage}",
-    bindings: {},
-    resources: {}
-  }
-);
-
-const exportsEffect = tag.asEffect().pipe(
-  Effect.flatMap(func => func.ExecutionContext.exports),
-  Effect.map(exports => exports),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      // TODO(sam): additional credentials?
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          ConfigProvider.orElse(
-            ConfigProvider.fromUnknown({ ALCHEMY_PHASE: "runtime" }),
-            ConfigProvider.fromUnknown(env),
-          ),
-        )
-      ),
-      Layer.provideMerge(
-        Layer.succeed(
-          WorkerEnvironment,
-          env,
-        )
-      ),
-      Layer.provideMerge(
-        Layer.succeed(
-          MinimumLogLevel,
-          env.DEBUG ? "Debug" : "Info",
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-// TODO(sam): we could kick this off during module init, but any I/O will break deploy
-// let exportsPromise = Effect.runPromise(exportsEffect);
-
-// for now, we delay initializing the worker until the first request
-let exportsPromise;
-
-// don't initialize the workerEffect during module init because Cloudflare does not allow I/O during module init
-// we cache it synchronously (??=) to guarnatee only one initialization ever happens
-const getExports = () => (exportsPromise ??= Effect.runPromise(exportsEffect))
-const getExport = (name) => getExports().then(exports => exports[name]?.make)
-const worker = () => getExports().then(exports => exports.default)
-
-export default Object.fromEntries(ExportedHandlerMethods.map(
-  method => [method, async (...args) => (await worker())[method](...args)])
-) satisfies Required<cf.ExportedHandler>;
-
-// export class proxy stubs for Durable Objects and Workflows
-${[
-  ...(hasDoClasses
-    ? [
-        "const DurableObjectBridge = makeDurableObjectBridge(DurableObject, getExport);",
-        ...doClasses.map(
-          (id) => `export class ${id} extends DurableObjectBridge("${id}") {}`,
-        ),
-      ]
-    : []),
-  ...(hasWfClasses
-    ? [
-        "const WorkflowBridgeFn = makeWorkflowBridge(WorkflowEntrypoint, getExport);",
-        ...wfClasses.map(
-          (id) => `export class ${id} extends WorkflowBridgeFn("${id}") {}`,
-        ),
-      ]
-    : []),
-].join("\n")}
-`;
-
-          return yield* buildBundle(virtualEntryPlugin(script));
-        }).pipe(Artifacts.cached("build"));
+            stack: { name: stack.name, stage: stack.stage },
+            userOptions: props.build,
+          })
+          .pipe(Artifacts.cached("build"));
 
       const viteBuild = Effect.fnUntraced(function* (props: WorkerProps) {
-        const vite = yield* Effect.promise(() => import("vite"));
-        let assetsDirectory: string | undefined;
-        let serverBundle: vite.Rolldown.OutputBundle | undefined;
+        const compatibility = getCompatibility(props);
+        const { assetsDirectory, serverBundle } = yield* Vite.viteBuild(
+          props.vite?.rootDir,
+          props.env ?? {},
+          {
+            compatibilityDate: compatibility.date,
+            compatibilityFlags: compatibility.flags,
+          },
+        );
 
-        yield* Effect.promise(async () => {
-          const builder = await vite.createBuilder(
-            {
-              root: props.vite?.rootDir,
-              // Declare the ssr environment so Vite 8+ creates it.
-              // The cloudflare-vite-plugin config hook merges its
-              // SSR-specific settings on top of this stub.
-              environments: {
-                ssr: {
-                  build: {
-                    // Prevent the SSR build from wiping the client
-                    // build's output (both share the dist/ directory).
-                    emptyOutDir: false,
-                  },
-                },
-              },
-              builder: {
-                sharedConfigBuild: true,
-              },
-              plugins: [
-                cloudflareVite({
-                  compatibilityDate:
-                    props.compatibility?.date ?? defaultCompatibilityDate,
-                  compatibilityFlags: props.compatibility?.flags,
-                }),
-                {
-                  name: "output:ssr",
-                  applyToEnvironment(environment) {
-                    return environment.name === "ssr";
-                  },
-                  generateBundle(_outputOptions, bundle) {
-                    serverBundle = bundle;
-                  },
-                },
-                {
-                  name: "output:client",
-                  applyToEnvironment(environment) {
-                    return environment.name === "client";
-                  },
-                  generateBundle(outputOptions) {
-                    assetsDirectory = outputOptions.dir;
-                  },
-                },
-              ],
-            },
-            // This is the `useLegacyBuilder` option. The Vite CLI implementation uses `null` here.
-            // Originally we used `undefined` here, but this caused the static site build to fail.
-            // https://github.com/vitejs/vite/blob/a07a4bd052ac75f916391c999c408ad5f2867e61/packages/vite/src/node/cli.ts#L367
-            null,
-          );
-          await builder.buildApp();
-        });
         if (!assetsDirectory && !serverBundle) {
           return yield* Effect.die(
             new Error("Vite build produced neither server nor client output"),
@@ -1402,17 +1643,39 @@ ${[
         return { assets, bundle };
       });
 
-      const prepareAssetsAndBundle = (id: string, props: WorkerProps) =>
+      const prepareAssetsAndBundle = (
+        id: string,
+        props: WorkerProps,
+        opts: { skipAssetsRead?: boolean } = {},
+      ) =>
         Effect.gen(function* () {
           if (props.vite) {
             const [{ assets, bundle }, input] = yield* Effect.all(
-              [viteBuild(props), hashDirectory(props.vite)],
+              [
+                viteBuild(props),
+                // hashDirectory expects `{ cwd, memo }`. The vite props
+                // store the project root under `rootDir`, so map it
+                // here. Without this, `cwd` falls back to
+                // `process.cwd()` and the input hash is computed over
+                // the wrong directory tree (often the entire monorepo
+                // root), making it both slow and unable to detect
+                // changes scoped to the actual Vite project.
+                hashDirectory({
+                  cwd: props.vite.rootDir,
+                  memo: props.vite.memo,
+                }),
+              ],
               { concurrency: "unbounded" },
             );
             return { assets, bundle, input };
           }
           const [assets, bundle] = yield* Effect.all(
-            [prepareAssets(props.assets), prepareBundle(id, props)],
+            [
+              opts.skipAssetsRead
+                ? Effect.succeed(undefined)
+                : prepareAssets(props.assets),
+              prepareBundle(id, props),
+            ],
             { concurrency: "unbounded" },
           );
           return { assets, bundle };
@@ -1449,10 +1712,43 @@ ${[
         yield* Effect.logInfo(
           `Cloudflare Worker ${olds ? "update" : "create"}: preparing bundle for ${name}`,
         );
-        const { assets, bundle, hash } = yield* prepareAssetsAndBundle(
-          id,
-          news,
-        );
+        // If the caller handed us a precomputed asset hash that matches
+        // what we previously stored, we can skip walking the directory
+        // entirely and tell Cloudflare to keep the assets it already
+        // has bound to this script. The disk read is the expensive
+        // part; the script PUT happens either way.
+        const previousAssetsHash = output?.hash?.assets;
+        const precomputedAssetsHash =
+          news.assets &&
+          typeof news.assets === "object" &&
+          "path" in news.assets &&
+          "hash" in news.assets
+            ? (news.assets.hash as string)
+            : undefined;
+        const assetsConfigFromProps =
+          news.assets &&
+          typeof news.assets === "object" &&
+          "config" in news.assets
+            ? news.assets.config
+            : undefined;
+        const skipAssetsRead =
+          precomputedAssetsHash !== undefined &&
+          precomputedAssetsHash === previousAssetsHash;
+        const {
+          assets,
+          bundle,
+          hash: preparedHash,
+        } = yield* prepareAssetsAndBundle(id, news, { skipAssetsRead });
+        // When the caller supplied a precomputed hash (e.g. via
+        // `Build.Command`), store *that* hash in output state so the
+        // next diff can short-circuit by comparing it directly. The
+        // hash that `readAssets` produces is the manifest-derived
+        // hash, which is shaped differently from any upstream
+        // build-input hash and will never match it on the next pass.
+        const hash = {
+          ...preparedHash,
+          assets: precomputedAssetsHash ?? preparedHash.assets,
+        } satisfies Worker["Attributes"]["hash"];
         const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
         const expectedDurableObjectClassNames =
           getExpectedDurableObjectClassNames(metadataBindings);
@@ -1460,8 +1756,35 @@ ${[
           | workers.PutScriptRequest["metadata"]["assets"]
           | undefined;
         let keepAssets = false;
-        if (assets) {
-          if (output?.hash?.assets !== assets.hash) {
+        if (skipAssetsRead) {
+          // Hash matched what's already on Cloudflare: keep the
+          // existing asset manifest and skip the upload session.
+          yield* Effect.logInfo(
+            `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
+          );
+          keepAssets = true;
+          metadataAssets = assetsConfigFromProps
+            ? { config: assetsConfigFromProps }
+            : undefined;
+          metadataBindings.push({
+            type: "assets",
+            name: "ASSETS",
+          });
+        } else if (assets) {
+          // We had to read the directory. Even after the read, the
+          // computed hash may match what's already deployed (e.g.
+          // legacy `string` / `AssetsProps` shapes that don't carry a
+          // precomputed hash, or a precomputed hash that disagreed with
+          // disk). In that case still keep the existing manifest and
+          // skip the upload session — Cloudflare's content-addressed
+          // session would no-op on every byte anyway.
+          if (assets.hash === previousAssetsHash) {
+            yield* Effect.logInfo(
+              `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
+            );
+            keepAssets = true;
+            metadataAssets = { config: assets.config };
+          } else {
             yield* Effect.logInfo(
               `Cloudflare Worker ${olds ? "update" : "create"}: uploading assets for ${name}`,
             );
@@ -1475,14 +1798,6 @@ ${[
               jwt,
               config: assets.config,
             };
-          } else {
-            yield* Effect.logInfo(
-              `Cloudflare Worker update: reusing existing assets for ${name}`,
-            );
-            metadataAssets = {
-              config: assets.config,
-            };
-            keepAssets = true;
           }
           metadataBindings.push({
             type: "assets",
@@ -1504,18 +1819,24 @@ ${[
         // Add environment variables as metadata bindings
         if (news.env) {
           for (const [key, value] of Object.entries(news.env)) {
-            if (value == null) continue;
+            if (value === undefined) continue;
             if (Redacted.isRedacted(value)) {
               metadataBindings.push({
                 type: "secret_text",
                 name: key,
                 text: Redacted.value(value),
               });
-            } else {
+            } else if (typeof value === "string") {
               metadataBindings.push({
                 type: "plain_text",
                 name: key,
-                text: typeof value === "string" ? value : String(value),
+                text: value,
+              });
+            } else {
+              metadataBindings.push({
+                type: "json",
+                name: key,
+                json: value,
               });
             }
           }
@@ -1668,12 +1989,13 @@ ${[
           }),
         );
 
-        const metadata = {
+        const compatibility = getCompatibility(news);
+        const metadata: workers.PutScriptRequest["metadata"] = {
           assets: metadataAssets,
           bindings: metadataBindings,
           bodyPart: undefined,
-          compatibilityDate: news.compatibility?.date ?? "2026-03-10",
-          compatibilityFlags: news.compatibility?.flags,
+          compatibilityDate: compatibility.date,
+          compatibilityFlags: compatibility.flags,
           containers:
             metadataContainers.length > 0 ? metadataContainers : undefined,
           keepAssets,
@@ -1737,12 +2059,40 @@ ${[
             name,
             expectedDurableObjectClassNames,
           );
-        if (!olds || news.url !== olds.url) {
-          const enable = news.url !== false;
+        // Reconcile workers.dev subdomain against observed cloud state.
+        // We can't diff `news.url` against `olds.url` here because both
+        // default to `undefined` (meaning "enable") — that comparison
+        // would skip the API call on every deploy where the user never
+        // explicitly set `url`, leaving the subdomain in whatever state
+        // Cloudflare currently has it (disabled by default, or whatever
+        // a previous failed/external action left it as).
+        const desiredSubdomainEnabled = news.url !== false;
+        const observedSubdomainEnabled = yield* getScriptSubdomain({
+          accountId,
+          scriptName: name,
+        }).pipe(
+          Effect.map((s) => s.enabled === true),
+          Effect.catch(() => Effect.succeed(false)),
+        );
+        if (desiredSubdomainEnabled !== observedSubdomainEnabled) {
           yield* session.note(
-            `${enable ? "Enabling" : "Disabling"} workers.dev subdomain...`,
+            `${desiredSubdomainEnabled ? "Enabling" : "Disabling"} workers.dev subdomain...`,
+          );
+          // Cloudflare's script registry is eventually consistent — for the
+          // first few hundred ms after `putScript` returns, POST /subdomain
+          // can still get back `WorkerNotFound` (a generic "unknown error"
+          // body). Bigger uploads race harder. Retry the subdomain toggle on
+          // that specific tag with a short exponential backoff; same pattern
+          // we use elsewhere in this provider for DO-namespace propagation.
+          yield* setWorkerSubdomain(name, desiredSubdomainEnabled).pipe(
+            Effect.retry({
+              while: (error: { _tag?: string }) =>
+                error?._tag === "WorkerNotFound",
+              schedule: Schedule.exponential(200).pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
           );
-          yield* setWorkerSubdomain(name, enable);
         }
         const desiredDomains = normalizeDomains(news.domain);
         const previousDomains = output?.domains ?? [];
@@ -1756,6 +2106,12 @@ ${[
           desiredDomains,
           previousDomains,
         );
+        const crons = yield* reconcileCrons(
+          name,
+          normalizeCrons([...getCronBindings(bindings), ...(news.crons ?? [])]),
+          output?.crons ?? [],
+          session,
+        );
         return {
           workerId: worker.id ?? name,
           workerName: name,
@@ -1768,6 +2124,7 @@ ${[
           durableObjectNamespaces,
           accountId,
           domains,
+          crons,
           hash,
         } satisfies Worker["Attributes"];
       });
@@ -1778,27 +2135,58 @@ ${[
         output: Worker["Attributes"],
       ) {
         if (props.vite) {
-          const input = yield* hashDirectory(props.vite);
+          const input = yield* hashDirectory({
+            cwd: props.vite.rootDir,
+            memo: props.vite.memo,
+          });
           return input !== output.hash?.input;
         }
-        const [assetsHash, bundleHash] = yield* Effect.all(
-          [
-            "assets" in output && output.hash?.assets
-              ? Effect.succeed(output.hash.assets)
-              : prepareAssets(props.assets).pipe(Effect.map((a) => a?.hash)),
-            prepareBundle(id, props).pipe(Effect.map((b) => b.hash)),
-          ],
-          { concurrency: "unbounded" },
-        );
-        return (
-          assetsHash !== output.hash?.assets ||
-          bundleHash !== output.hash?.bundle
+        const bundleHash = yield* prepareBundle(id, props).pipe(
+          Effect.map((b) => b.hash),
         );
+        if (bundleHash !== output.hash?.bundle) {
+          return true;
+        }
+        if (!props.assets) {
+          return false;
+        }
+        // We deliberately don't read the assets directory during diff.
+        // For `AssetsWithHash` (the documented contract) the upstream
+        // `Build.Command` already gave us an authoritative hash — we
+        // just compare strings. Reading the directory here would
+        // (a) hash the same tree twice per apply (`putWorker` reads
+        // again when an upload is actually required), and (b) crash
+        // when the prior state was written on a different machine
+        // and `path` doesn't exist locally — blocking any local
+        // reapply even though the precomputed hash is right there
+        // in props.
+        //
+        // For the legacy `string` / `AssetsProps` shapes there's no
+        // hash in props to compare against, so we conservatively
+        // assume the assets changed; `putWorker` will read once,
+        // hash, and use `keepAssets` if it turns out nothing actually
+        // changed.
+        const assetsHash =
+          typeof props.assets === "object" &&
+          "path" in props.assets &&
+          "hash" in props.assets
+            ? (props.assets.hash as string)
+            : undefined;
+        if (assetsHash === undefined) {
+          return true;
+        }
+        return assetsHash !== output.hash?.assets;
       });
 
       return Worker.Provider.of({
         stables: ["workerId", "workerName"],
-        diff: Effect.fnUntraced(function* ({ id, news, olds, output }) {
+        diff: Effect.fnUntraced(function* ({
+          id,
+          news,
+          olds,
+          output,
+          newBindings,
+        }) {
           if (!isResolved(news)) return undefined;
           if ((output?.accountId ?? accountId) !== accountId) {
             return { action: "replace" };
@@ -1820,7 +2208,23 @@ ${[
           const domainsChanged =
             newDomains.length !== oldDomains.length ||
             newDomains.some((d, i) => d !== oldDomains[i]);
-          if (domainsChanged || (yield* hasChanged(id, news, output))) {
+          const newCrons = normalizeCrons([
+            ...(Array.isArray(newBindings)
+              ? getCronBindings(
+                  newBindings as ResourceBinding<Worker["Binding"]>[],
+                )
+              : []),
+            ...(news.crons ?? []),
+          ]).sort();
+          const oldCrons = [...(output?.crons ?? [])].sort();
+          const cronsChanged =
+            newCrons.length !== oldCrons.length ||
+            newCrons.some((cron, index) => cron !== oldCrons[index]);
+          if (
+            domainsChanged ||
+            cronsChanged ||
+            (yield* hasChanged(id, news, output))
+          ) {
             return {
               action: "update",
               stables:
@@ -1869,13 +2273,11 @@ ${[
           );
 
           if (existingSettings) {
-            if (!hasAlchemyWorkerTags(id, existingSettings.tags ?? [])) {
-              return yield* Effect.die(
-                `Worker "${name}" already exists but is not owned by this stack/stage/resource`,
-              );
-            }
+            // Engine has already cleared this resource for write via
+            // `read` + AdoptPolicy. Either we own it (matching tags) or
+            // the user opted in to a takeover (`--adopt` / `adopt(true)`).
             yield* Effect.logInfo(
-              `Cloudflare Worker precreate: adopting existing ${name} owned by this stack/stage/resource`,
+              `Cloudflare Worker precreate: reusing existing ${name}`,
             );
           } else {
             yield* session.note("Pre-creating worker...");
@@ -1899,9 +2301,7 @@ ${[
                         className,
                       }))
                     : undefined,
-                compatibilityDate:
-                  news.compatibility?.date ?? defaultCompatibilityDate,
-                compatibilityFlags: news.compatibility?.flags,
+                ...getCompatibility(news),
                 containers,
                 migrations:
                   doClasses.length > 0
@@ -1929,7 +2329,23 @@ ${[
                   type: "application/javascript+module",
                 }),
               ],
-            });
+            }).pipe(
+              // Cloudflare's PUT /workers/scripts/{name} intermittently
+              // returns code 10002 / "An unknown error has occurred" on the
+              // first put for a fresh worker name. Surfaced as the shared
+              // `InternalServerError` upstream (alchemy-run/distilled#290).
+              // Also match `UnknownCloudflareError` for older
+              // @distilled.cloud/cloudflare versions that haven't picked
+              // up the patch yet.
+              Effect.retry({
+                while: (e: any) =>
+                  e._tag === "InternalServerError" ||
+                  e._tag === "UnknownCloudflareError",
+                schedule: Schedule.exponential(1000).pipe(
+                  Schedule.both(Schedule.recurs(5)),
+                ),
+              }),
+            );
             if (doClasses.length > 0) {
               ({ durableObjectNamespaces } =
                 yield* getWorkerSettingsWithDurableObjects(name, doClasses));
@@ -1950,6 +2366,7 @@ ${[
             durableObjectNamespaces,
             accountId,
             domains: [],
+            crons: [],
           } satisfies Worker["Attributes"];
         }),
         read: Effect.fnUntraced(
@@ -1959,42 +2376,37 @@ ${[
             yield* Effect.logInfo(
               `Cloudflare Worker read: checking ${workerName}`,
             );
-            const [worker, subdomain, settings, domainsList] =
-              yield* Effect.all([
-                listScripts({
-                  accountId,
-                }).pipe(
-                  Effect.map((workers) =>
-                    workers.result.find((worker) => worker.id === workerName),
-                  ),
-                ),
-                getScriptSubdomain({
-                  accountId,
-                  scriptName: workerName,
-                }),
-                getScriptSettings({
-                  accountId,
-                  scriptName: workerName,
-                }),
-                listDomains({
-                  accountId,
-                  service: workerName,
-                }).pipe(Effect.map((r) => r.result ?? [])),
-              ]);
-            if (!worker) {
-              yield* Effect.logInfo(
-                `Cloudflare Worker read: ${workerName} not found in script list`,
-              );
-              return undefined;
-            }
+            // We deliberately don't call `listScripts({ accountId })` here:
+            // it pulls every Worker on the account back through a strict
+            // schema decode, and a single existing Worker the schema doesn't
+            // know about (e.g. `placement_mode: "targeted"`) breaks the
+            // entire read. `getScriptSettings` already fails with
+            // `WorkerNotFound` if the script doesn't exist, which the
+            // surrounding `Effect.catchTag` turns into `undefined` — that's
+            // all the existence check we need.
+            const [subdomain, settings, domainsList] = yield* Effect.all([
+              getScriptSubdomain({
+                accountId,
+                scriptName: workerName,
+              }),
+              getScriptSettings({
+                accountId,
+                scriptName: workerName,
+              }),
+              listDomains({
+                accountId,
+                service: workerName,
+              }).pipe(Effect.map((r) => r.result ?? [])),
+            ]);
+            const crons = yield* getWorkerCrons(workerName);
             yield* Effect.logInfo(
               `Cloudflare Worker read: found ${workerName}`,
             );
-            return {
+            const attrs = {
               accountId,
-              workerId: worker.id ?? workerName,
+              workerId: workerName,
               workerName,
-              logpush: worker.logpush ?? undefined,
+              logpush: settings.logpush ?? undefined,
               url: subdomain.enabled
                 ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
                 : undefined,
@@ -2007,7 +2419,18 @@ ${[
                   ? [{ id: d.id, hostname: d.hostname, zoneId: d.zoneId }]
                   : [],
               ),
+              crons,
             } satisfies Worker["Attributes"];
+
+            // Centralized ownership decision: the engine routes `read`'s
+            // return value based on `AdoptPolicy`. We hand it the attrs
+            // either as-is (owned: alchemy tags identify this stack/stage/id,
+            // safe to silently adopt even without `--adopt`) or branded with
+            // `Unowned` (caller must opt in via `--adopt` or the engine
+            // raises `OwnedBySomeoneElse`).
+            return hasAlchemyWorkerTags(id, settings.tags ?? [])
+              ? attrs
+              : Unowned(attrs);
           },
           (effect) =>
             effect.pipe(
@@ -2016,26 +2439,36 @@ ${[
               ),
             ),
         ),
-        create: Effect.fnUntraced(function* ({
+        reconcile: Effect.fnUntraced(function* ({
           id,
           news,
+          olds,
           bindings,
           output,
           session,
         }) {
-          const name = yield* createWorkerName(id, news.name);
+          const name =
+            output?.workerName ?? (yield* createWorkerName(id, news.name));
           const durableObjects = getDurableObjectBindings(bindings, name).map(
             ({ logicalId, className }) => ({
               logicalId,
               className,
             }),
           );
-          yield* Effect.logInfo(`Cloudflare Worker create: starting ${name}`);
           yield* Effect.logInfo(
-            `Cloudflare Worker create: durable objects ${JSON.stringify(
+            `Cloudflare Worker reconcile: starting ${name}`,
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: durable objects ${JSON.stringify(
               durableObjects,
             )}`,
           );
+
+          // Observe — fetch the script's current settings if it already exists.
+          // `putWorker` is a true upsert against the Cloudflare API; the
+          // existing settings inform asset/migration decisions and let the
+          // reconciler converge whether the worker is brand-new, adopted, or
+          // an in-place update.
           const existingSettings = yield* getScriptSettings({
             accountId,
             scriptName: name,
@@ -2043,67 +2476,29 @@ ${[
             Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
           );
           yield* Effect.logInfo(
-            `Cloudflare Worker create: existing durable object tags ${JSON.stringify(
+            `Cloudflare Worker reconcile: existing durable object tags ${JSON.stringify(
               (existingSettings?.tags ?? []).filter((tag) =>
                 tag.startsWith("alchemy:do:"),
               ),
             )}`,
           );
-          if (existingSettings) {
-            yield* Effect.logInfo(
-              `Cloudflare Worker create: ${name} already exists`,
-            );
-            if (!hasAlchemyWorkerTags(id, existingSettings.tags ?? [])) {
-              return yield* Effect.die(
-                `Worker "${name}" already exists but is not owned by this stack/stage/resource`,
-              );
-            }
-            yield* Effect.logInfo(
-              `Cloudflare Worker create: adopting existing ${name} owned by this stack/stage/resource`,
-            );
-          }
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: previous durable object tags ${JSON.stringify(
+              (output?.tags ?? []).filter((tag) =>
+                tag.startsWith("alchemy:do:"),
+              ),
+            )}`,
+          );
           return yield* putWorker(
             id,
             news,
             bindings,
-            undefined,
+            olds,
             output,
             session,
             existingSettings,
           );
         }),
-        update: Effect.fnUntraced(function* ({
-          id,
-          olds,
-          news,
-          output,
-          bindings,
-          session,
-        }) {
-          const durableObjects = getDurableObjectBindings(
-            bindings,
-            output.workerName,
-          ).map(({ logicalId, className }) => ({
-            logicalId,
-            className,
-          }));
-          yield* Effect.logInfo(
-            `Cloudflare Worker update: starting ${output.workerName}`,
-          );
-          yield* Effect.logInfo(
-            `Cloudflare Worker update: durable objects ${JSON.stringify(
-              durableObjects,
-            )}`,
-          );
-          yield* Effect.logInfo(
-            `Cloudflare Worker update: previous durable object tags ${JSON.stringify(
-              (output.tags ?? []).filter((tag) =>
-                tag.startsWith("alchemy:do:"),
-              ),
-            )}`,
-          );
-          return yield* putWorker(id, news, bindings, olds, output, session);
-        }),
         delete: Effect.fnUntraced(function* ({ output }) {
           yield* Effect.logInfo(
             `Cloudflare Worker delete: deleting ${output.workerName}`,
@@ -2124,80 +2519,11 @@ ${[
             scriptName: output.workerName,
           }).pipe(Effect.catchTag("WorkerNotFound", () => Effect.void));
         }),
-        tail: ({ output }) => {
-          const runTailSession = Effect.gen(function* () {
-            const { id: tailId, url } = yield* createScriptTail({
-              scriptName: output.workerName,
-              accountId: output.accountId,
-              body: { filters: [] },
-            });
-
-            const socket = yield* Socket.makeWebSocket(url, {
-              protocols: ["trace-v1"],
-            });
-
-            const queue = yield* Queue.make<LogLine, Cause.Done>();
-
-            yield* socket
-              .runRaw((raw) => {
-                const text =
-                  typeof raw === "string" ? raw : new TextDecoder().decode(raw);
-                const data: TailEventMessage = JSON.parse(text);
-                const eventTs = new Date(data.eventTimestamp ?? Date.now());
-
-                if (data.event && "request" in data.event) {
-                  const reqEvent = data.event;
-                  const pathname = (() => {
-                    try {
-                      return new URL(reqEvent.request.url).pathname;
-                    } catch {
-                      return reqEvent.request.url;
-                    }
-                  })();
-                  const status = reqEvent.response?.status ?? 500;
-                  Queue.offerUnsafe(queue, {
-                    timestamp: eventTs,
-                    message: `${reqEvent.request.method} ${pathname} > ${status} (cpu: ${Math.round(data.cpuTime)}ms, wall: ${Math.round(data.wallTime)}ms)`,
-                  });
-                }
-
-                for (const log of data.logs) {
-                  const msg = log.message.join(" ");
-                  Queue.offerUnsafe(queue, {
-                    timestamp: new Date(log.timestamp),
-                    message: log.level === "log" ? msg : `${log.level}: ${msg}`,
-                  });
-                }
-
-                for (const exception of data.exceptions) {
-                  Queue.offerUnsafe(queue, {
-                    timestamp: new Date(exception.timestamp),
-                    message: `${exception.name} ${exception.message}\n${exception.stack}`,
-                  });
-                }
-              })
-              .pipe(
-                Effect.ensuring(
-                  Effect.all([
-                    deleteScriptTail({
-                      scriptName: output.workerName,
-                      id: tailId,
-                      accountId: output.accountId,
-                    }).pipe(Effect.ignore),
-                    Queue.end(queue),
-                  ]),
-                ),
-                Effect.ignore,
-                Effect.forkChild(),
-              );
-
-            return Stream.fromQueue(queue);
-          });
-
-          return Stream.unwrap(runTailSession).pipe(
-            Stream.repeat(Schedule.spaced("1 second")),
-          );
-        },
+        tail: ({ output }) =>
+          telemetry.tailScript({
+            accountId: output.accountId,
+            scriptName: output.workerName,
+          }),
         logs: ({ output, options }) =>
           telemetry.queryLogs({
             accountId: output.accountId,
@@ -2215,33 +2541,6 @@ ${[
     }),
   );
 
-interface TailEventMessage {
-  eventTimestamp?: number;
-  wallTime: number;
-  cpuTime: number;
-  truncated: boolean;
-  outcome: string;
-  scriptName: string;
-  exceptions: {
-    name: string;
-    message: string;
-    stack: string;
-    timestamp: string;
-  }[];
-  logs: {
-    message: string[];
-    level: string;
-    timestamp: string;
-  }[];
-  event:
-    | {
-        request: { method: string; url: string };
-        response?: { status: number };
-      }
-    | null
-    | undefined;
-}
-
 const contentTypeFromExtension = (extension: string) => {
   switch (extension) {
     case ".wasm":