alchemy 2.0.0-beta.43 → 2.0.0-beta.45

package/src/Cloudflare/Workers/Worker.ts

@@ -1,6 +1,7 @@
 import type * as cf from "@cloudflare/workers-types";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as zones from "@distilled.cloud/cloudflare/zones";
+import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
@@ -8,6 +9,7 @@ import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
+import * as crypto from "node:crypto";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Artifacts from "../../Artifacts.ts";
@@ -22,7 +24,6 @@ import { Resource, type ResourceBinding } from "../../Resource.ts";
 import { Stack } from "../../Stack.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { HyperdriveDevOrigin } from "../Hyperdrive/Hyperdrive.ts";
-import { SidecarLive } from "../Local/Sidecar.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
 import {
@@ -34,7 +35,10 @@ import {
 } from "./Assets.ts";
 import { getCompatibility } from "./Compatibility.ts";
 import { isDurableObjectExport } from "./DurableObjectNamespace.ts";
-import { LocalWorkerProvider } from "./LocalWorkerProvider.ts";
+import {
+  LocalWorkerProvider,
+  localRuntimeServices,
+} from "./LocalWorkerProvider.ts";
 import { Request } from "./Request.ts";
 import * as Vite from "./Vite.ts";
 import {
@@ -170,7 +174,9 @@ type NormalizedBindings<
     any,
     any
   >
-    ? T
+    ? T extends Redacted.Redacted<infer T> | Config.Config<infer T>
+      ? T
+      : T
     : Extract<Bindings[B], WorkerBindingResource>;
 } & (undefined extends AssetsConfig ? {} : { ASSETS: Assets });
 
@@ -178,7 +184,6 @@ export type WorkerAssetsConfig = string | AssetsProps | AssetsWithHash;
 
 export interface WorkerProps<
   Bindings extends WorkerBindingProps = any,
-  Env extends WorkerEnv = WorkerEnv,
   Assets extends WorkerAssetsConfig | undefined =
     | WorkerAssetsConfig
     | undefined,
@@ -221,16 +226,46 @@ export interface WorkerProps<
    */
   observability?: WorkerObservability;
   tags?: string[];
-  main: string;
+  /**
+   * Path to the Worker's entry module. Bundled with rolldown before
+   * upload. Mutually exclusive with {@link script} — provide exactly one.
+   */
+  main?: string;
+  /**
+   * Raw module source for the Worker. When provided, bundling is bypassed
+   * entirely and this string is uploaded as a single ESM module
+   * (`main.js`). Useful for tiny inline workers (tests, fixtures,
+   * one-offs) and any case where you've already produced the final
+   * bundle elsewhere. Mutually exclusive with {@link main}.
+   */
+  script?: string;
   compatibility?: {
     date?: string;
     flags?: ("nodejs_compat" | "nodejs_als" | (string & {}))[];
   };
   limits?: WorkerLimits;
   placement?: WorkerPlacement;
-  env?: Env;
   exports?: string[];
-  bindings?: Bindings;
+  /**
+   * Environment variables and native Cloudflare Bindings to bind to
+   * the Worker. Accepts:
+   *
+   * - Resource references (R2 bucket, KV namespace, D1 database,
+   *   another Worker, Durable Object, etc.) — emitted as the
+   *   corresponding native binding.
+   * - `effect/Config` values (`Config.redacted`, `Config.string`,
+   *   `Config.number`, …) — resolved at deploy time and bound as
+   *   `secret_text` on Cloudflare regardless of the `Config`
+   *   constructor used. See
+   *   {@link https://v2.alchemy.run/concepts/secrets | Concepts › Secrets and Variables}.
+   * - Literal values — routed by shape: `Redacted<string>` →
+   *   `secret_text`, `string` → `plain_text`, anything else → `json`.
+   *
+   * In Effect-native Workers you can alternatively `yield*` a
+   * `Config` in the Init phase to register the binding implicitly;
+   * `env` is the only option for async (non-Effect) Workers.
+   */
+  env?: Bindings;
   /**
    * Cron expressions that trigger the Worker's scheduled handler.
    *
@@ -243,23 +278,33 @@ export interface WorkerProps<
    * already exist in the account.
    */
   domain?: string | string[];
-  build?: {
+  /**
+   * Extra bundler options applied on top of the standard rolldown input/output
+   * options used to build this Worker. See {@link Bundle.BundleExtraOptions}.
+   */
+  build?: Bundle.BundleExtraOptions;
+  /**
+   * Options for the local dev server that runs this Worker under `alchemy dev`.
+   * Each Worker is served on its own port.
+   */
+  dev?: {
     /**
-     * Whether to generate a metafile for the worker bundle.
-     * @default false
+     * Host the local dev server binds to.
+     * @default "localhost"
      */
-    metafile?: boolean;
+    host?: string;
     /**
-     * Configures the {@link Bundle.purePlugin} which annotates top-level
-     * call/new expressions in matching packages with `/*#__PURE__*\/`
-     * so rolldown can tree-shake them.
-     *
-     * - `undefined` (default): plugin is enabled with default packages
-     *   (`effect`, `@effect/*`).
-     * - `PurePluginOptions`: plugin is enabled with the provided options.
-     * - `false`: plugin is disabled.
+     * Port the local dev server listens on. If the port is unavailable, the
+     * next free port is used unless {@link strictPort} is `true`.
+     * @default 1337
      */
-    pure?: Bundle.BundleExtraOptions["pure"];
+    port?: number;
+    /**
+     * When `true`, fail instead of falling back to another port if {@link port}
+     * is already in use.
+     * @default false
+     */
+    strictPort?: boolean;
   };
 }
 
@@ -274,7 +319,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
     tags: string[] | undefined;
     durableObjectNamespaces: Record<string, string>;
     accountId: string;
-    domains: { hostname: string; id: string; zoneId: string }[];
+    domains: string[];
     crons: string[];
     hash?: {
       assets: string | undefined;
@@ -330,9 +375,10 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * as-is. Your handler is a plain `async fetch` — no Effect runtime
  * is included in the bundle.
  *
- * Use the `bindings` prop to declare which resources are available
- * at runtime, and `Cloudflare.InferEnv` to extract a fully typed
- * `env` object from those bindings.
+ * Use the `env` prop to declare which resources, `Config` values,
+ * and literal env vars are available at runtime, and
+ * `Cloudflare.InferEnv` to extract a fully typed `env` object from
+ * them.
  *
  * See the {@link https://alchemy.run/guides/async-worker | Async Workers Guide}
  * for a comprehensive walkthrough of all binding types (R2, D1,
@@ -348,7 +394,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  *
  * export const Worker = Cloudflare.Worker("Worker", {
  *   main: "./src/worker.ts",
- *   bindings: { db, bucket },
+ *   env: { db, bucket },
  * });
  * ```
  *
@@ -605,7 +651,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * const sandbox = yield* Cloudflare.Container.bind(Sandbox);
  *
  * return Effect.gen(function* () {
- *   const container = yield* Cloudflare.start(sandbox);
+ *   const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
  *
  *   return {
  *     exec: (cmd: string) => container.exec(cmd),
@@ -656,31 +702,20 @@ export const Worker: Platform<
 > & {
   <
     const Bindings extends WorkerBindingProps = {},
-    const Env extends WorkerEnv = {},
     const Assets extends WorkerAssetsConfig | undefined = undefined,
     Req = never,
   >(
     id: string,
     props:
-      | InputProps<WorkerProps<Bindings, Env, Assets>>
-      | Effect.Effect<
-          InputProps<WorkerProps<Bindings, Env, Assets>>,
-          never,
-          Req
-        >,
+      | InputProps<WorkerProps<Bindings, Assets>>
+      | Effect.Effect<InputProps<WorkerProps<Bindings, Assets>>, never, Req>,
   ): Effect.Effect<
-    Worker<
-      {
-        [binding in keyof NormalizedBindings<
-          Bindings,
-          Assets
-        >]: NormalizedBindings<Bindings, Assets>[binding];
-      } & {
-        [K in keyof Env]: Env[K] extends Redacted.Redacted<infer T>
-          ? T
-          : Env[K];
-      }
-    >,
+    Worker<{
+      [binding in keyof NormalizedBindings<
+        Bindings,
+        Assets
+      >]: NormalizedBindings<Bindings, Assets>[binding];
+    }>,
     never,
     Req | Providers
   >;
@@ -724,7 +759,7 @@ const selectLayer = <
 export const WorkerProvider = () =>
   selectLayer({
     live: LiveWorkerProvider,
-    dev: () => Layer.provide(LocalWorkerProvider(), SidecarLive),
+    dev: () => Layer.provide(LocalWorkerProvider(), localRuntimeServices()),
   });
 
 export const LiveWorkerProvider = () =>
@@ -881,11 +916,7 @@ export const LiveWorkerProvider = () =>
           );
         });
 
-      const reconcileDomains = (
-        scriptName: string,
-        desired: string[],
-        _previous: Worker["Attributes"]["domains"],
-      ) =>
+      const reconcileDomains = (scriptName: string, desired: string[]) =>
         Effect.gen(function* () {
           // Always query the live state of domains attached to *this*
           // Worker rather than trusting `_previous` from local state.
@@ -1035,11 +1066,15 @@ export const LiveWorkerProvider = () =>
 
       const getExpectedDurableObjectClassNames = (
         bindings: readonly WorkerBinding[] | undefined,
+        workerName: string,
       ) =>
         Array.from(
           new Set(
             bindings?.flatMap((binding) =>
-              binding.type === "durable_object_namespace" && binding.className
+              binding.type === "durable_object_namespace" &&
+              binding.className &&
+              (binding.scriptName === undefined ||
+                binding.scriptName === workerName)
                 ? [binding.className]
                 : [],
             ) ?? [],
@@ -1110,7 +1145,7 @@ export const LiveWorkerProvider = () =>
         bundler
           .build({
             id,
-            main: props.main,
+            main: props.main!,
             compatibility: getCompatibility(props),
             entry: props.isExternal
               ? {
@@ -1121,15 +1156,38 @@ export const LiveWorkerProvider = () =>
                   exports: (props.exports ?? {}) as any,
                 },
             stack: { name: stack.name, stage: stack.stage },
-            userOptions: props.build,
+            extraOptions: props.build,
           })
           .pipe(Artifacts.cached("build"));
 
+      const hashScript = (script: string) =>
+        Effect.sync(() =>
+          crypto.createHash("sha256").update(script).digest("hex"),
+        );
+
       const viteBuild = Effect.fnUntraced(function* (props: WorkerProps) {
         const compatibility = getCompatibility(props);
         const { assetsDirectory, serverBundle } = yield* Vite.viteBuild(
           props.vite?.rootDir,
-          props.env ?? {},
+          Object.fromEntries(
+            (yield* Effect.all(
+              Object.entries(props.env ?? {}).map(
+                Effect.fnUntraced(function* ([key, value]) {
+                  return [
+                    key,
+                    typeof value === "string"
+                      ? value
+                      : Redacted.isRedacted(value) &&
+                          typeof Redacted.value(value) === "string"
+                        ? Redacted.value(value)
+                        : Config.isConfig(value) || Effect.isEffect(value)
+                          ? yield* value
+                          : undefined,
+                  ];
+                }),
+              ),
+            )).filter(([_, value]) => value !== undefined),
+          ),
           {
             compatibilityDate: compatibility.date,
             compatibilityFlags: compatibility.flags,
@@ -1167,6 +1225,24 @@ export const LiveWorkerProvider = () =>
         opts: { skipAssetsRead?: boolean } = {},
       ) =>
         Effect.gen(function* () {
+          if (props.script !== undefined) {
+            const [assets, bundleHash] = yield* Effect.all(
+              [
+                opts.skipAssetsRead
+                  ? Effect.succeed(undefined)
+                  : prepareAssets(props.assets),
+                hashScript(props.script),
+              ],
+              { concurrency: "unbounded" },
+            );
+            return {
+              assets,
+              bundle: {
+                files: [{ path: "main.js", content: props.script }],
+                hash: bundleHash,
+              },
+            };
+          }
           if (props.vite) {
             const [{ assets, bundle }, input] = yield* Effect.all(
               [
@@ -1269,7 +1345,7 @@ export const LiveWorkerProvider = () =>
         } satisfies Worker["Attributes"]["hash"];
         const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
         const expectedDurableObjectClassNames =
-          getExpectedDurableObjectClassNames(metadataBindings);
+          getExpectedDurableObjectClassNames(metadataBindings, name);
         let metadataAssets:
           | workers.PutScriptRequest["metadata"]["assets"]
           | undefined;
@@ -1323,6 +1399,11 @@ export const LiveWorkerProvider = () =>
           });
         }
         metadataBindings.push(
+          {
+            type: "plain_text",
+            name: "ALCHEMY_PHASE",
+            text: "runtime",
+          },
           {
             type: "plain_text",
             name: "ALCHEMY_STACK_NAME",
@@ -1338,11 +1419,16 @@ export const LiveWorkerProvider = () =>
         if (news.env) {
           for (const [key, value] of Object.entries(news.env)) {
             if (value === undefined) continue;
+            if (metadataBindings.some((b) => b.name === key)) continue;
             if (Redacted.isRedacted(value)) {
+              const unredacted = Redacted.value(value);
               metadataBindings.push({
                 type: "secret_text",
                 name: key,
-                text: Redacted.value(value),
+                text:
+                  typeof unredacted === "string"
+                    ? unredacted
+                    : JSON.stringify(unredacted),
               });
             } else if (typeof value === "string") {
               metadataBindings.push({
@@ -1414,16 +1500,19 @@ export const LiveWorkerProvider = () =>
         }
 
         // Backward compatibility for old workers that have DO bindings but no
-        // alchemy:do tags yet.
+        // alchemy:do tags yet. Cross-script bindings (`scriptName` set to
+        // anything other than this worker) are NEVER candidates for
+        // delete-class migrations — the class lives on the foreign script
+        // and we don't own its lifecycle.
         if (Object.keys(oldDoClassNameByLogicalId).length === 0) {
           for (const oldBinding of oldBindings) {
+            const ownedLocally =
+              !("scriptName" in oldBinding) || oldBinding.scriptName === name;
             if (
               oldBinding.type === "durable_object_namespace" &&
               "className" in oldBinding &&
               oldBinding.className &&
-              (!("scriptName" in oldBinding) ||
-                !oldBinding.scriptName ||
-                oldBinding.scriptName === name) &&
+              ownedLocally &&
               !currentDoBindings.some(
                 (binding) => binding.bindingName === oldBinding.name,
               )
@@ -1585,27 +1674,36 @@ export const LiveWorkerProvider = () =>
         // Cloudflare currently has it (disabled by default, or whatever
         // a previous failed/external action left it as).
         const desiredSubdomainEnabled = news.url !== false;
-        const observedSubdomainEnabled = yield* getScriptSubdomain({
+        const observedSubdomain = yield* getScriptSubdomain({
           accountId,
           scriptName: name,
         }).pipe(
-          Effect.map((s) => s.enabled === true),
-          Effect.catch(() => Effect.succeed(false)),
+          Effect.orElseSucceed<workers.GetScriptSubdomainResponse>(() => ({
+            enabled: false,
+            previewsEnabled: false,
+          })),
         );
-        if (desiredSubdomainEnabled !== observedSubdomainEnabled) {
+        if (
+          desiredSubdomainEnabled !== observedSubdomain.enabled ||
+          desiredSubdomainEnabled !== observedSubdomain.previewsEnabled
+        ) {
           yield* session.note(
             `${desiredSubdomainEnabled ? "Enabling" : "Disabling"} workers.dev subdomain...`,
           );
           // Cloudflare's script registry is eventually consistent — for the
           // first few hundred ms after `putScript` returns, POST /subdomain
           // can still get back `WorkerNotFound` (a generic "unknown error"
-          // body). Bigger uploads race harder. Retry the subdomain toggle on
-          // that specific tag with a short exponential backoff; same pattern
-          // we use elsewhere in this provider for DO-namespace propagation.
+          // body), or a bare 500 surfaced as `InternalServerError` /
+          // `UnknownCloudflareError` (code 10013). Bigger uploads race harder.
+          // Retry the subdomain toggle on those transient tags with a short
+          // exponential backoff; same pattern we use elsewhere in this
+          // provider for DO-namespace propagation and for `putScript` itself.
           yield* setWorkerSubdomain(name, desiredSubdomainEnabled).pipe(
             Effect.retry({
               while: (error: { _tag?: string }) =>
-                error?._tag === "WorkerNotFound",
+                error?._tag === "WorkerNotFound" ||
+                error?._tag === "InternalServerError" ||
+                error?._tag === "UnknownCloudflareError",
               schedule: Schedule.exponential(200).pipe(
                 Schedule.both(Schedule.recurs(15)),
               ),
@@ -1619,11 +1717,15 @@ export const LiveWorkerProvider = () =>
             `Reconciling custom domains (${desiredDomains.length}) ...`,
           );
         }
-        const domains = yield* reconcileDomains(
-          name,
-          desiredDomains,
-          previousDomains,
-        );
+        const reconciled = yield* reconcileDomains(name, desiredDomains);
+        const workersDevUrl =
+          news.url !== false
+            ? `https://${name}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+            : undefined;
+        const domains = [
+          ...reconciled.map((d) => `https://${d.hostname}`),
+          ...(workersDevUrl ? [workersDevUrl] : []),
+        ];
         const crons = yield* reconcileCrons(
           name,
           normalizeCrons([...getCronBindings(bindings), ...(news.crons ?? [])]),
@@ -1634,10 +1736,7 @@ export const LiveWorkerProvider = () =>
           workerId: worker.id ?? name,
           workerName: name,
           logpush: worker.logpush ?? undefined,
-          url:
-            news.url !== false
-              ? `https://${name}.${yield* getAccountSubdomain(accountId)}.workers.dev`
-              : undefined,
+          url: domains[0],
           tags: settings.tags ?? metadata.tags,
           durableObjectNamespaces,
           accountId,
@@ -1652,6 +1751,25 @@ export const LiveWorkerProvider = () =>
         props: WorkerProps,
         output: Worker["Attributes"],
       ) {
+        if (props.script !== undefined) {
+          const scriptHash = yield* hashScript(props.script);
+          if (scriptHash !== output.hash?.bundle) {
+            return true;
+          }
+          if (!props.assets) {
+            return false;
+          }
+          const assetsHash =
+            typeof props.assets === "object" &&
+            "path" in props.assets &&
+            "hash" in props.assets
+              ? (props.assets.hash as string)
+              : undefined;
+          if (assetsHash === undefined) {
+            return true;
+          }
+          return assetsHash !== output.hash?.assets;
+        }
         if (props.vite) {
           const input = yield* hashDirectory({
             cwd: props.vite.rootDir,
@@ -1719,9 +1837,11 @@ export const LiveWorkerProvider = () =>
           if (!output) {
             return;
           }
-          const newDomains = normalizeDomains(news.domain).sort();
+          const newDomains = normalizeDomains(news.domain)
+            .map((h) => `https://${h}`)
+            .sort();
           const oldDomains = (output?.domains ?? [])
-            .map((d) => d.hostname)
+            .filter((u) => !u.endsWith(".workers.dev"))
             .sort();
           const domainsChanged =
             newDomains.length !== oldDomains.length ||
@@ -1916,6 +2036,30 @@ export const LiveWorkerProvider = () =>
                 service: workerName,
               }).pipe(Effect.map((r) => r.result ?? [])),
             ]);
+            // Preserve the order the user provided in `olds.domain`. The
+            // Cloudflare API returns domains in non-deterministic order,
+            // which would cause downstream `worker.domains[0]` reads to flip
+            // between deploys. Drift (domains we don't know about) is
+            // appended after the user-ordered ones.
+            const userOrder = normalizeDomains(olds?.domain);
+            const orderedHostnames = [
+              ...userOrder.flatMap(
+                (h) =>
+                  domainsList.find((d) => d.hostname === h)?.hostname ?? [],
+              ),
+              ...domainsList.flatMap((d) =>
+                d.hostname && !userOrder.includes(d.hostname)
+                  ? [d.hostname]
+                  : [],
+              ),
+            ];
+            const workersDevUrl = subdomain.enabled
+              ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+              : undefined;
+            const domains = [
+              ...orderedHostnames.map((h) => `https://${h}`),
+              ...(workersDevUrl ? [workersDevUrl] : []),
+            ];
             const crons = yield* getWorkerCrons(workerName);
             yield* Effect.logInfo(
               `Cloudflare Worker read: found ${workerName}`,
@@ -1925,18 +2069,12 @@ export const LiveWorkerProvider = () =>
               workerId: workerName,
               workerName,
               logpush: settings.logpush ?? undefined,
-              url: subdomain.enabled
-                ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
-                : undefined,
+              url: domains[0],
               tags: settings.tags ?? undefined,
               durableObjectNamespaces: getDurableObjectNamespaces(
                 settings.bindings,
               ),
-              domains: domainsList.flatMap((d) =>
-                d.id && d.hostname && d.zoneId
-                  ? [{ id: d.id, hostname: d.hostname, zoneId: d.zoneId }]
-                  : [],
-              ),
+              domains,
               crons,
             } satisfies Worker["Attributes"];
 
@@ -2021,13 +2159,30 @@ export const LiveWorkerProvider = () =>
           yield* Effect.logInfo(
             `Cloudflare Worker delete: deleting ${output.workerName}`,
           );
-          if (output.domains?.length) {
+          // Look up live domain IDs rather than trusting persisted state.
+          // We no longer track `{ id, zoneId }` on the output; fetching
+          // straight from Cloudflare handles both the normal case and
+          // adopted workers whose domains we never recorded.
+          const liveDomains = yield* listDomains({
+            accountId: output.accountId,
+            service: output.workerName,
+          }).pipe(
+            Effect.map((r) => r.result ?? []),
+            Effect.catch(() => Effect.succeed([])),
+          );
+          if (liveDomains.length) {
             yield* Effect.all(
-              output.domains.map((d) =>
-                deleteDomain({
-                  accountId: output.accountId,
-                  domainId: d.id,
-                }).pipe(Effect.catchTag("DomainNotFound", () => Effect.void)),
+              liveDomains.flatMap((d) =>
+                d.id
+                  ? [
+                      deleteDomain({
+                        accountId: output.accountId,
+                        domainId: d.id,
+                      }).pipe(
+                        Effect.catchTag("DomainNotFound", () => Effect.void),
+                      ),
+                    ]
+                  : [],
               ),
               { concurrency: "unbounded" },
             );
@@ -2101,23 +2256,38 @@ function getDurableObjectBindings(
   bindings: ReadonlyArray<ResourceBinding>,
   workerName: string,
 ) {
+  // Resource authors (and the `make`/`yield* Tag`/plan-vs-apply machinery)
+  // can register the same DO binding multiple times under the same logical
+  // id — `binding()` is a plain `worker.bind` and intentionally has no
+  // dedup. Collapse duplicates here so each `(logicalId, bindingName,
+  // className)` tuple appears at most once. We also exclude cross-script
+  // references: a `scriptName` pointing to *another* worker means this
+  // worker just references a foreign class — ship the binding to
+  // Cloudflare, but don't drive class migrations for it.
+  const seen = new Set<string>();
   return bindings.flatMap((binding) =>
-    (binding.data.bindings ?? []).flatMap((item: WorkerBinding) =>
-      item.type === "durable_object_namespace" &&
-      "className" in item &&
-      item.className &&
-      (!("scriptName" in item) ||
-        !item.scriptName ||
-        item.scriptName === workerName)
-        ? [
-            {
-              logicalId: binding.sid,
-              bindingName: item.name,
-              className: item.className,
-            },
-          ]
-        : [],
-    ),
+    (binding.data.bindings ?? []).flatMap((item: WorkerBinding) => {
+      if (
+        item.type !== "durable_object_namespace" ||
+        !("className" in item) ||
+        !item.className
+      ) {
+        return [];
+      }
+      if (item.scriptName !== undefined && item.scriptName !== workerName) {
+        return [];
+      }
+      const dedupKey = `${binding.sid}::${item.name}::${item.className}`;
+      if (seen.has(dedupKey)) return [];
+      seen.add(dedupKey);
+      return [
+        {
+          logicalId: binding.sid,
+          bindingName: item.name,
+          className: item.className,
+        },
+      ];
+    }),
   );
 }