alchemy 2.0.0-beta.5 → 2.0.0-beta.51

package/src/Cloudflare/Workers/Worker.ts

@@ -1,74 +1,66 @@
 import type * as cf from "@cloudflare/workers-types";
-import cloudflareRolldown from "@distilled.cloud/cloudflare-rolldown-plugin";
-import cloudflareVite from "@distilled.cloud/cloudflare-vite-plugin";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as zones from "@distilled.cloud/cloudflare/zones";
-import type * as Cause from "effect/Cause";
+import type { ConfigError } from "effect/Config";
+import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
 import * as Path from "effect/Path";
-import * as Queue from "effect/Queue";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
-import * as Stream from "effect/Stream";
-import * as Socket from "effect/unstable/socket/Socket";
-import type * as rolldown from "rolldown";
-import Sonda from "sonda/rolldown";
-import type * as vite from "vite";
+import * as crypto from "node:crypto";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
 import * as Artifacts from "../../Artifacts.ts";
-import * as Binding from "../../Binding.ts";
 import { hashDirectory, type MemoOptions } from "../../Build/Memo.ts";
 import * as Bundle from "../../Bundle/Bundle.ts";
-import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
-import type { HttpEffect } from "../../Http.ts";
 import type { InputProps } from "../../Input.ts";
-import * as Output from "../../Output.ts";
-import { createPhysicalName } from "../../PhysicalName.ts";
-import {
-  Platform,
-  type Main,
-  type PlatformProps,
-  type Rpc,
-} from "../../Platform.ts";
-import type { LogLine } from "../../Provider.ts";
+import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource, type ResourceBinding } from "../../Resource.ts";
-import { Self } from "../../Self.ts";
-import * as Serverless from "../../Serverless/index.ts";
 import { Stack } from "../../Stack.ts";
-import { Account } from "../Account.ts";
-import { D1Database } from "../D1/D1Database.ts";
-import { fromCloudflareFetcher } from "../Fetcher.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { HyperdriveDevOrigin } from "../Hyperdrive/Hyperdrive.ts";
 import { CloudflareLogs } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
-import type { R2Bucket } from "../R2/R2Bucket.ts";
 import {
-  isAssets,
   readAssets,
   uploadAssets,
   type Assets,
   type AssetsConfig,
   type AssetsProps,
 } from "./Assets.ts";
-import cloudflare_workers from "./cloudflare_workers.ts";
+import { getCompatibility } from "./Compatibility.ts";
+import { isDurableObjectExport } from "./DurableObjectNamespace.ts";
 import {
-  isDurableObjectExport,
-  isDurableObjectNamespaceLike,
-  type DurableObjectNamespaceLike,
-} from "./DurableObjectNamespace.ts";
-import { workersHttpHandler } from "./HttpServer.ts";
+  LocalWorkerProvider,
+  localRuntimeServices,
+} from "./LocalWorkerProvider.ts";
 import { Request } from "./Request.ts";
-import { makeRpcStub } from "./Rpc.ts";
-import { isWorkflowExport } from "./Workflow.ts";
+import * as Vite from "./Vite.ts";
+import {
+  bindWorkerAsyncBindings,
+  getCronBindings,
+} from "./WorkerAsyncBindings.ts";
+import type {
+  WorkerBinding,
+  WorkerBindingResource,
+  WorkerBindings,
+  WorkerSettingsBinding,
+} from "./WorkerBinding.ts";
+import { WorkerBundle } from "./WorkerBundle.ts";
+import { createWorkerName } from "./WorkerName.ts";
+import {
+  makeWorkerRuntimeContext,
+  type WorkerRuntimeContext,
+} from "./WorkerRuntimeContext.ts";
 
-const WorkerTypeId = "Cloudflare.Worker";
-type WorkerTypeId = typeof WorkerTypeId;
+export const WorkerTypeId = "Cloudflare.Worker";
+export type WorkerTypeId = typeof WorkerTypeId;
 
 export const isWorker = <T>(value: T): value is T & Worker =>
   typeof value === "object" &&
@@ -81,15 +73,10 @@ export class WorkerEnvironment extends Context.Service<
   Record<string, any>
 >()("Cloudflare.Workers.WorkerEnvironment") {}
 
-export const WorkerEnvironmentLive = Layer.effect(
-  WorkerEnvironment,
-  cloudflare_workers.pipe(Effect.map((m) => m.env)),
-);
-
-export class ExecutionContext extends Context.Service<
-  ExecutionContext,
+export class WorkerExecutionContext extends Context.Service<
+  WorkerExecutionContext,
   cf.ExecutionContext
->()("Cloudflare.Workers.ExecutionContext") {}
+>()("Cloudflare.Workers.WorkerExecutionContext") {}
 
 export type WorkerEvent = Exclude<
   {
@@ -143,16 +130,6 @@ export type WorkerPlacement = Exclude<
   undefined
 >;
 
-export type WorkerBinding = Exclude<
-  workers.PutScriptRequest["metadata"]["bindings"],
-  undefined
->[number];
-
-type WorkerSettingsBinding = Exclude<
-  workers.GetScriptScriptAndVersionSettingResponse["bindings"],
-  null | undefined
->[number];
-
 export const ExportedHandlerMethods = [
   "fetch",
   "tail",
@@ -164,23 +141,24 @@ export const ExportedHandlerMethods = [
   "queue",
 ] as const satisfies (keyof cf.ExportedHandler)[];
 
-export interface WorkerExecutionContext extends Serverless.FunctionContext {
-  export(name: string, value: any): Effect.Effect<void>;
-}
-
-export type WorkerServices = Worker | WorkerEnvironment | Request;
+export type WorkerServices =
+  | Worker
+  | Request
+  | WorkerExecutionContext
+  | WorkerEnvironment;
 
 export type WorkerShape = Main<WorkerServices>;
 
-export type WorkerBindingResource =
-  | Assets
-  | R2Bucket
-  | D1Database
-  | DurableObjectNamespaceLike<any>;
-
-export type WorkerBindings = {
-  [bindingName in string]: WorkerBindingResource;
-};
+export type WorkerEnv = Record<
+  string,
+  | string
+  | number
+  | boolean
+  | null
+  | readonly unknown[]
+  | { readonly [key: string]: unknown }
+  | Redacted.Redacted<string>
+>;
 
 export type WorkerBindingProps = {
   [bindingName in string]:
@@ -197,7 +175,9 @@ type NormalizedBindings<
     any,
     any
   >
-    ? T
+    ? T extends Redacted.Redacted<infer T> | Config.Config<infer T>
+      ? T
+      : T
     : Extract<Bindings[B], WorkerBindingResource>;
 } & (undefined extends AssetsConfig ? {} : { ASSETS: Assets });
 
@@ -236,30 +216,96 @@ export interface WorkerProps<
     memo?: MemoOptions;
   };
   logpush?: boolean;
+  /**
+   * Cloudflare Workers Observability settings. Controls Workers Logs
+   * (`logs`) and Workers Traces (`traces`), each with their own
+   * `enabled`, `headSamplingRate`, and `persist` toggles.
+   *
+   * If omitted, defaults to `{ enabled: true, logs: { enabled: true,
+   * invocationLogs: true } }`. Traces are off by default — opt in via
+   * `traces: { enabled: true, ... }`.
+   */
   observability?: WorkerObservability;
   tags?: string[];
-  main: string;
+  /**
+   * Path to the Worker's entry module. Bundled with rolldown before
+   * upload. Mutually exclusive with {@link script} — provide exactly one.
+   */
+  main?: string;
+  /**
+   * Raw module source for the Worker. When provided, bundling is bypassed
+   * entirely and this string is uploaded as a single ESM module
+   * (`main.js`). Useful for tiny inline workers (tests, fixtures,
+   * one-offs) and any case where you've already produced the final
+   * bundle elsewhere. Mutually exclusive with {@link main}.
+   */
+  script?: string;
   compatibility?: {
     date?: string;
     flags?: ("nodejs_compat" | "nodejs_als" | (string & {}))[];
   };
   limits?: WorkerLimits;
   placement?: WorkerPlacement;
-  env?: Record<string, string | Redacted.Redacted<string>>;
   exports?: string[];
-  bindings?: Bindings;
+  /**
+   * Environment variables and native Cloudflare Bindings to bind to
+   * the Worker. Accepts:
+   *
+   * - Resource references (R2 bucket, KV namespace, D1 database,
+   *   another Worker, Durable Object, etc.) — emitted as the
+   *   corresponding native binding.
+   * - `effect/Config` values (`Config.redacted`, `Config.string`,
+   *   `Config.number`, …) — resolved at deploy time and bound as
+   *   `secret_text` on Cloudflare regardless of the `Config`
+   *   constructor used. See
+   *   {@link https://v2.alchemy.run/concepts/secrets | Concepts › Secrets and Variables}.
+   * - Literal values — routed by shape: `Redacted<string>` →
+   *   `secret_text`, `string` → `plain_text`, anything else → `json`.
+   *
+   * In Effect-native Workers you can alternatively `yield*` a
+   * `Config` in the Init phase to register the binding implicitly;
+   * `env` is the only option for async (non-Effect) Workers.
+   */
+  env?: Bindings;
+  /**
+   * Cron expressions that trigger the Worker's scheduled handler.
+   *
+   * Pass an empty array to remove all Cron Triggers.
+   */
+  crons?: string[];
   /**
    * One or more custom hostnames (e.g. `"app.example.com"`) to bind to this
    * Worker. The Cloudflare Zone is inferred from the hostname — the zone must
    * already exist in the account.
    */
   domain?: string | string[];
-  build?: {
+  /**
+   * Extra bundler options applied on top of the standard rolldown input/output
+   * options used to build this Worker. See {@link Bundle.BundleExtraOptions}.
+   */
+  build?: Bundle.BundleExtraOptions;
+  /**
+   * Options for the local dev server that runs this Worker under `alchemy dev`.
+   * Each Worker is served on its own port.
+   */
+  dev?: {
+    /**
+     * Host the local dev server binds to.
+     * @default "localhost"
+     */
+    host?: string;
     /**
-     * Whether to generate a metafile for the worker bundle.
+     * Port the local dev server listens on. If the port is unavailable, the
+     * next free port is used unless {@link strictPort} is `true`.
+     * @default 1337
+     */
+    port?: number;
+    /**
+     * When `true`, fail instead of falling back to another port if {@link port}
+     * is already in use.
      * @default false
      */
-    metafile?: boolean;
+    strictPort?: boolean;
   };
 }
 
@@ -274,7 +320,8 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
     tags: string[] | undefined;
     durableObjectNamespaces: Record<string, string>;
     accountId: string;
-    domains: { hostname: string; id: string; zoneId: string }[];
+    domains: string[];
+    crons: string[];
     hash?: {
       assets: string | undefined;
       bundle: string | undefined;
@@ -284,6 +331,8 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
   {
     bindings?: WorkerBinding[];
     containers?: { className: string }[];
+    crons?: string[];
+    hyperdrives?: Record<string, Required<HyperdriveDevOrigin>>;
   },
   Providers
 >;
@@ -327,9 +376,10 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * as-is. Your handler is a plain `async fetch` — no Effect runtime
  * is included in the bundle.
  *
- * Use the `bindings` prop to declare which resources are available
- * at runtime, and `Cloudflare.InferEnv` to extract a fully typed
- * `env` object from those bindings.
+ * Use the `env` prop to declare which resources, `Config` values,
+ * and literal env vars are available at runtime, and
+ * `Cloudflare.InferEnv` to extract a fully typed `env` object from
+ * them.
  *
  * See the {@link https://alchemy.run/guides/async-worker | Async Workers Guide}
  * for a comprehensive walkthrough of all binding types (R2, D1,
@@ -345,7 +395,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  *
  * export const Worker = Cloudflare.Worker("Worker", {
  *   main: "./src/worker.ts",
- *   bindings: { db, bucket },
+ *   env: { db, bucket },
  * });
  * ```
  *
@@ -375,7 +425,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * ```typescript
  * export default class MyWorker extends Cloudflare.Worker<MyWorker>()(
  *   "MyWorker",
- *   { main: import.meta.path },
+ *   { main: import.meta.filename },
  *   Effect.gen(function* () {
  *     // init: bind resources
  *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
@@ -410,7 +460,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * // src/WorkerB.ts
  * export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
  *   "WorkerB",
- *   { main: import.meta.path },
+ *   { main: import.meta.filename },
  * ) {}
  *
  * export default WorkerB.make(
@@ -437,7 +487,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  *
  * export default class WorkerA extends Cloudflare.Worker<WorkerA>()(
  *   "WorkerA",
- *   { main: import.meta.path },
+ *   { main: import.meta.filename },
  *   Effect.gen(function* () {
  *     const b = yield* Cloudflare.Worker.bind(WorkerB);
  *     return {
@@ -456,7 +506,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * @example Enabling Node.js compatibility
  * ```typescript
  * {
- *   main: import.meta.path,
+ *   main: import.meta.filename,
  *   compatibility: {
  *     flags: ["nodejs_compat"],
  *     date: "2026-03-17",
@@ -467,11 +517,43 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * @example Serving static assets
  * ```typescript
  * {
- *   main: import.meta.path,
+ *   main: import.meta.filename,
  *   assets: "./public",
  * }
  * ```
  *
+ * @section Observability
+ * Cloudflare Workers Observability is on by default — `logs.enabled` and
+ * `logs.invocationLogs` are turned on if you don't pass an `observability`
+ * prop. Pass the prop yourself to tune sampling, enable persistence, or
+ * turn on the new `traces` channel (the same toggle the dashboard's
+ * Observability tab writes).
+ *
+ * Field names match the Cloudflare API (camelCased): `headSamplingRate`,
+ * `invocationLogs`, etc.
+ *
+ * @example Enabling logs and traces
+ * ```typescript
+ * {
+ *   main: import.meta.filename,
+ *   observability: {
+ *     enabled: true,
+ *     headSamplingRate: 1,
+ *     logs: {
+ *       enabled: true,
+ *       invocationLogs: true,
+ *       headSamplingRate: 1,
+ *       persist: true,
+ *     },
+ *     traces: {
+ *       enabled: true,
+ *       headSamplingRate: 1,
+ *       persist: true,
+ *     },
+ *   },
+ * }
+ * ```
+ *
  * @section R2 Bucket
  * Bind an R2 bucket in the init phase with `Cloudflare.R2Bucket.bind`.
  * The returned handle exposes `get`, `put`, `delete`, and `list`
@@ -570,7 +652,7 @@ export type Worker<Bindings extends WorkerBindings = any> = Resource<
  * const sandbox = yield* Cloudflare.Container.bind(Sandbox);
  *
  * return Effect.gen(function* () {
- *   const container = yield* Cloudflare.start(sandbox);
+ *   const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
  *
  *   return {
  *     exec: (cmd: string) => container.exec(cmd),
@@ -617,17 +699,21 @@ export const Worker: Platform<
   Worker,
   WorkerServices,
   WorkerShape,
-  WorkerExecutionContext
+  WorkerRuntimeContext
 > & {
   <
-    const Bindings extends WorkerBindingProps,
+    const Bindings extends WorkerBindingProps = {},
     const Assets extends WorkerAssetsConfig | undefined = undefined,
     Req = never,
   >(
     id: string,
     props:
       | InputProps<WorkerProps<Bindings, Assets>>
-      | Effect.Effect<InputProps<WorkerProps<Bindings, Assets>>, never, Req>,
+      | Effect.Effect<
+          InputProps<WorkerProps<Bindings, Assets>>,
+          ConfigError,
+          Req
+        >,
   ): Effect.Effect<
     Worker<{
       [binding in keyof NormalizedBindings<
@@ -639,218 +725,18 @@ export const Worker: Platform<
     Req | Providers
   >;
 } = Platform(WorkerTypeId, {
-  onCreate: Effect.fnUntraced(function* (
-    resource: Worker,
-    props: InputProps<WorkerProps<WorkerBindingProps>>,
-  ) {
-    if (props.bindings) {
-      for (const bindingName in props.bindings) {
-        // @ts-expect-error
-        const bindingEff = props.bindings?.[bindingName] as
-          | WorkerBindingResource
-          | Effect.Effect<WorkerBindingResource>;
-        const binding = Effect.isEffect(bindingEff)
-          ? yield* bindingEff
-          : bindingEff;
-
-        const bindingMeta: InputProps<WorkerBinding> | undefined = isAssets(
-          binding,
-        )
-          ? {
-              type: "assets",
-              name: bindingName,
-            }
-          : isDurableObjectNamespaceLike(binding)
-            ? {
-                type: "durable_object_namespace",
-                name: bindingName,
-                className: binding.className ?? binding.name,
-              }
-            : binding.Type === "Cloudflare.D1Database"
-              ? {
-                  type: "d1",
-                  id: binding.databaseId,
-                  name: bindingName,
-                }
-              : binding.Type === "Cloudflare.R2Bucket"
-                ? {
-                    type: "r2_bucket",
-                    name: bindingName,
-                    bucketName: binding.bucketName,
-                    jurisdiction: binding.jurisdiction.pipe(
-                      Output.map((jurisdiction) =>
-                        jurisdiction === "default" ? undefined : jurisdiction,
-                      ),
-                    ),
-                  }
-                : // TODO(sam): handle others
-                  undefined;
-
-        if (bindingMeta) {
-          yield* resource.bind`${bindingName}`({
-            bindings: [bindingMeta],
-          });
-        } else {
-          return yield* Effect.die(`Unknown binding type: ${bindingName}`);
-        }
-      }
-    }
-  }),
-  createExecutionContext: (id: string): WorkerExecutionContext => {
-    const listeners: Effect.Effect<Serverless.FunctionListener>[] = [];
-    const exports: Record<string, any> = {};
-    const env: Record<string, any> = {};
-
-    const ctx = {
-      Type: WorkerTypeId,
-      id,
-      env,
-      get: (key: string) =>
-        Effect.serviceOption(WorkerEnvironment).pipe(
-          Effect.map(Option.getOrUndefined),
-          Effect.flatMap((env) =>
-            env
-              ? Effect.succeed(env[key])
-              : Effect.die("WorkerEnvironment not found"),
-          ),
-          Effect.flatMap((value) =>
-            value
-              ? Effect.succeed(value)
-              : Effect.die(`Environment variable '${key}' not found`),
-          ),
-          Effect.map((json) => {
-            try {
-              const value = JSON.parse(json);
-              if (!Redacted.isRedacted(value)) {
-                return Redacted.make(value.value);
-              }
-              return value;
-            } catch {
-              return json;
-            }
-          }),
-        ) as any,
-      set: (id: string, output: Output.Output) =>
-        Effect.sync(() => {
-          const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
-          env[key] = output.pipe(
-            Output.map((value) =>
-              Redacted.isRedacted(value)
-                ? JSON.stringify({
-                    _tag: "Redacted",
-                    value: Redacted.value(value),
-                  })
-                : JSON.stringify(value),
-            ),
-          );
-          return key;
-        }),
-      serve: <Req = never>(handler: HttpEffect<Req>) =>
-        ctx.listen(workersHttpHandler(handler)),
-      listen: ((
-        handler:
-          | Serverless.FunctionListener
-          | Effect.Effect<Serverless.FunctionListener>,
-      ) =>
-        Effect.sync(() =>
-          Effect.isEffect(handler)
-            ? listeners.push(handler)
-            : listeners.push(Effect.succeed(handler)),
-        )) as any as Serverless.FunctionContext["listen"],
-      export: (name: string, value: any) =>
-        Effect.sync(() => {
-          exports[name] = value;
-        }),
-      exports: Effect.gen(function* () {
-        const handlers = yield* Effect.all(listeners, {
-          concurrency: "unbounded",
-        });
-        const services = yield* Effect.context();
-        const handle =
-          (type: WorkerEvent["type"]) =>
-          (request: any, env: unknown, context: cf.ExecutionContext) => {
-            const event: WorkerEvent = {
-              kind: "Cloudflare.Workers.WorkerEvent",
-              type,
-              input: request,
-              env,
-              context,
-            };
-            for (const handler of handlers) {
-              const eff = handler(event);
-              if (Effect.isEffect(eff)) {
-                return eff.pipe(
-                  Effect.provideContext(services),
-                  Effect.provide(Layer.succeed(ExecutionContext, context)),
-                  Effect.runPromise,
-                );
-              }
-            }
-            return Promise.reject(new Error("No event handler found"));
-          };
-        return {
-          ...exports,
-          default: Object.fromEntries(
-            ExportedHandlerMethods.map((method) => [method, handle(method)]),
-          ),
-        };
-      }),
-    };
-    return ctx;
-  },
+  // Both hooks are wrapped in arrows so the imported references are resolved
+  // at call time rather than at module-load time. Worker.ts forms import
+  // cycles with both WorkerAsyncBindings.ts (which imports `isWorker` here)
+  // and WorkerRuntimeContext.ts (which imports `WorkerTypeId`/`WorkerEnvironment`
+  // here). Reading either binding eagerly here hits TDZ when Bun loads the
+  // package from node_modules in a different module-init order than the local
+  // workspace.
+  onCreate: (resource, props) =>
+    bindWorkerAsyncBindings(resource as Worker, props),
+  createRuntimeContext: (id) => makeWorkerRuntimeContext(id),
 });
 
-export const bindWorker = Effect.fnUntraced(function* <Shape, Req = never>(
-  workerEff:
-    | (Worker & Rpc<Shape>)
-    | Effect.Effect<Worker & Rpc<Shape>, never, Req>,
-) {
-  const worker = Effect.isEffect(workerEff) ? yield* workerEff : workerEff;
-  const self = yield* Worker;
-  yield* self.bind`${worker}`({
-    bindings: [
-      {
-        type: "service",
-        name: worker.LogicalId,
-        service: worker.workerName,
-      },
-    ],
-  });
-
-  const workerBinding = WorkerEnvironment.asEffect().pipe(
-    Effect.map((env) => env[worker.LogicalId]),
-  );
-
-  const fetcher = workerBinding.pipe(Effect.map(fromCloudflareFetcher));
-  // TODO(sam): update makeRpcStub to support lazily evaluating the Effect<Fetcher>
-  return makeRpcStub<Shape>(fetcher);
-});
-
-export class BindWorkerPolicy extends Binding.Policy<
-  BindWorkerPolicy,
-  (worker: Worker) => Effect.Effect<void>
->()("Cloudflare.Worker.Bind") {}
-
-export const BindWorkerPolicyLive = BindWorkerPolicy.layer.succeed(
-  Effect.fn(function* (host, worker: Worker) {
-    if (isWorker(host)) {
-      yield* host.bind`${worker}`({
-        bindings: [
-          {
-            type: "service",
-            name: worker.LogicalId,
-            service: worker.workerName,
-          },
-        ],
-      });
-    } else {
-      return yield* Effect.die(
-        new Error(`BindWorkerPolicy does not support runtime '${host.Type}'`),
-      );
-    }
-  }),
-);
-
 class MissingDurableObjectNamespaces extends Data.TaggedError(
   "MissingDurableObjectNamespaces",
 )<{
@@ -858,111 +744,147 @@ class MissingDurableObjectNamespaces extends Data.TaggedError(
   expected: string[];
 }> {}
 
-function bumpMigrationTagVersion(
-  oldTag: string | undefined,
-): string | undefined {
-  if (!oldTag) return undefined;
-  const version = oldTag.match(/^(alchemy:)?v(\d+)$/)?.[2];
-  if (!version) return "alchemy:v1";
-  return `alchemy:v${parseInt(version, 10) + 1}`;
-}
-
-function getDurableObjectBindings(
-  bindings: ReadonlyArray<ResourceBinding>,
-  workerName: string,
-) {
-  return bindings.flatMap((binding) =>
-    (binding.data.bindings ?? []).flatMap((item: WorkerBinding) =>
-      item.type === "durable_object_namespace" &&
-      "className" in item &&
-      item.className &&
-      (!("scriptName" in item) ||
-        !item.scriptName ||
-        item.scriptName === workerName)
-        ? [
-            {
-              logicalId: binding.sid,
-              bindingName: item.name,
-              className: item.className,
-            },
-          ]
-        : [],
+const selectLayer = <
+  LayerLive extends Layer.Layer<any, any, any>,
+  LayerDev extends Layer.Layer<any, any, any>,
+>(input: {
+  live: () => LayerLive;
+  dev: () => LayerDev;
+}): Layer.Layer<
+  Layer.Success<LayerLive | LayerDev>,
+  Layer.Error<LayerLive | LayerDev>,
+  Layer.Services<LayerLive | LayerDev> | AlchemyContext
+> =>
+  Layer.unwrap(
+    AlchemyContext.useSync((context) =>
+      context.dev ? input.dev() : input.live(),
     ),
   );
-}
-
-function getDurableObjectTagMap(tags: ReadonlyArray<string>) {
-  return Object.fromEntries(
-    tags.flatMap((tag) => {
-      if (!tag.startsWith("alchemy:do:")) {
-        return [];
-      }
-      const parts = tag.split(":");
-      const logicalId = parts[2];
-      const className = parts.slice(3).join(":");
-      return logicalId && className ? [[logicalId, className]] : [];
-    }),
-  );
-}
 
 export const WorkerProvider = () =>
+  selectLayer({
+    live: LiveWorkerProvider,
+    dev: () => Layer.provide(LocalWorkerProvider(), localRuntimeServices()),
+  });
+
+export const LiveWorkerProvider = () =>
   Provider.effect(
     Worker,
     Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
 
-      const accountId = yield* Account;
-      const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+      const { accountId } = yield* CloudflareEnvironment;
+      const bundler = yield* WorkerBundle;
       const stack = yield* Stack;
 
       const createScriptSubdomain = yield* workers.createScriptSubdomain;
-      const createScriptTail = yield* workers.createScriptTail;
       const deleteScript = yield* workers.deleteScript;
-      const deleteScriptTail = yield* workers.deleteScriptTail;
       const getScriptSubdomain = yield* workers.getScriptSubdomain;
+      const getScriptSchedule = yield* workers.getScriptSchedule;
       const getScriptSettings = yield* workers.getScriptScriptAndVersionSetting;
       const getSubdomain = yield* workers.getSubdomain;
-      const listScripts = yield* workers.listScripts;
       const putScript = yield* workers.putScript;
+      const putScriptSchedule = yield* workers.putScriptSchedule;
       const putDomain = yield* workers.putDomain;
       const listDomains = yield* workers.listDomains;
       const deleteDomain = yield* workers.deleteDomain;
       const listZones = yield* zones.listZones;
       const telemetry = yield* CloudflareLogs;
-      const defaultCompatibilityDate = yield* Effect.promise(() =>
-        // @ts-expect-error no types for workerd
-        import("workerd").then((m) => m.compatibilityDate as string),
-      );
 
       const getAccountSubdomain = (accountId: string) =>
         getSubdomain({
           accountId,
         }).pipe(Effect.map((result) => result.subdomain));
 
+      // Toggle the workers.dev subdomain via `POST /subdomain` with
+      // `enabled: true | false`. Mirrors the upstream Alchemy
+      // implementation in `.vendor/alchemy/.../worker-subdomain.ts`.
+      // When enabling we also set `previewsEnabled: true` so the
+      // script is reachable both at its stable workers.dev URL and at
+      // version-preview URLs; on disable we send just `enabled: false`.
       const setWorkerSubdomain = (name: string, enabled: boolean) =>
         createScriptSubdomain({
           accountId,
           scriptName: name,
           enabled,
+          previewsEnabled: enabled ? true : undefined,
         });
 
-      const createWorkerName = (id: string, name: string | undefined) =>
-        name
-          ? Effect.succeed(name)
-          : createPhysicalName({
-              id,
-              maxLength: 54,
-            }).pipe(Effect.map((name) => name.toLowerCase()));
+      // Convert non-ASCII hostnames (emoji, IDN, etc.) to punycode so the
+      // Cloudflare API receives the form it stores domains in. `new URL(...)`
+      // does IDNA via WHATWG URL parsing — `📦.alchemy.run` → `xn--5z8h.alchemy.run`.
+      const toPunycode = (hostname: string): string => {
+        try {
+          return new URL(`https://${hostname}`).hostname;
+        } catch {
+          return hostname;
+        }
+      };
 
       const normalizeDomains = (
         domain: string | string[] | undefined,
       ): string[] =>
         domain === undefined
           ? []
-          : Array.isArray(domain)
-            ? Array.from(new Set(domain))
-            : [domain];
+          : Array.from(
+              new Set(
+                (Array.isArray(domain) ? domain : [domain]).map(toPunycode),
+              ),
+            );
+
+      const normalizeCrons = (crons: string[] | undefined): string[] =>
+        Array.from(new Set(crons ?? []));
+
+      const getWorkerCrons = (scriptName: string) =>
+        getScriptSchedule({
+          accountId,
+          scriptName,
+        }).pipe(
+          Effect.map((response) =>
+            normalizeCrons(response.schedules.map((schedule) => schedule.cron)),
+          ),
+          Effect.catchTag("WorkerNotFound", () => Effect.succeed([])),
+        );
+
+      const reconcileCrons = (
+        scriptName: string,
+        desired: string[],
+        previous: string[],
+        session: ScopedPlanStatusSession,
+      ) =>
+        Effect.gen(function* () {
+          const live = yield* getWorkerCrons(scriptName);
+          const desiredSorted = [...desired].sort();
+          const liveSorted = [...live].sort();
+          const changed =
+            desiredSorted.length !== liveSorted.length ||
+            desiredSorted.some((cron, index) => cron !== liveSorted[index]);
+
+          if (!changed) return live;
+
+          if (desired.length > 0 || previous.length > 0 || live.length > 0) {
+            yield* session.note(
+              `Reconciling Cron Triggers (${desired.length}) ...`,
+            );
+          }
+
+          const result = yield* putScriptSchedule({
+            accountId,
+            scriptName,
+            body: desired.map((cron) => ({ cron })),
+          }).pipe(
+            Effect.retry({
+              while: (error: { _tag?: string }) =>
+                error?._tag === "WorkerNotFound",
+              schedule: Schedule.exponential(200).pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
+          );
+          return normalizeCrons(
+            result.schedules.map((schedule) => schedule.cron),
+          );
+        });
 
       /**
        * Infer the Cloudflare Zone ID for a given hostname by listing the
@@ -999,14 +921,41 @@ export const WorkerProvider = () =>
           );
         });
 
-      const reconcileDomains = (
-        scriptName: string,
-        desired: string[],
-        previous: Worker["Attributes"]["domains"],
-      ) =>
+      const reconcileDomains = (scriptName: string, desired: string[]) =>
         Effect.gen(function* () {
+          // Always query the live state of domains attached to *this*
+          // Worker rather than trusting `_previous` from local state.
+          // State may have been wiped, populated by another machine, or
+          // simply be out of date. Without this we PUT domains that are
+          // already registered to this same Worker and Cloudflare
+          // returns a confusing "hostname already in use" error.
+          const liveAll = yield* listDomains({
+            accountId,
+            service: scriptName,
+          }).pipe(
+            Effect.map((r) =>
+              (r.result ?? []).flatMap((d) =>
+                d.id && d.hostname && d.zoneId
+                  ? [
+                      {
+                        id: d.id,
+                        hostname: d.hostname,
+                        zoneId: d.zoneId,
+                        service: d.service ?? undefined,
+                      },
+                    ]
+                  : [],
+              ),
+            ),
+            Effect.catch(() => Effect.succeed([])),
+          );
+
           const desiredSet = new Set(desired);
-          const toRemove = previous.filter((p) => !desiredSet.has(p.hostname));
+          const liveByHostname = new Map(liveAll.map((d) => [d.hostname, d]));
+
+          // Detach what's no longer wanted. Use the live list so we
+          // don't try to delete domains we no longer track.
+          const toRemove = liveAll.filter((d) => !desiredSet.has(d.hostname));
           yield* Effect.all(
             toRemove.map((d) =>
               deleteDomain({ accountId, domainId: d.id }).pipe(
@@ -1019,28 +968,75 @@ export const WorkerProvider = () =>
           if (desired.length === 0) return [];
 
           const zoneCache = new Map<string, string>();
-          const applied = yield* Effect.all(
-            desired.map((hostname) =>
-              Effect.gen(function* () {
-                const zoneId = yield* inferZoneIdForHostname(
-                  hostname,
-                  zoneCache,
-                );
-                const res = yield* putDomain({
-                  accountId,
-                  hostname,
-                  service: scriptName,
-                  zoneId,
-                });
-                return {
-                  hostname,
-                  id: res.id ?? "",
-                  zoneId: res.zoneId ?? zoneId,
-                };
+
+          // Attach `hostname` to this Worker. Skip the PUT entirely if
+          // the hostname is already attached to *this* Worker — that's a
+          // no-op for Cloudflare and avoids the "already in use" 409.
+          // If it's attached to a *different* Worker, refuse with a
+          // clear message rather than silently re-routing traffic.
+          const attachDomain = Effect.fnUntraced(function* (hostname: string) {
+            const live = liveByHostname.get(hostname);
+            if (live) {
+              return {
+                hostname: live.hostname,
+                id: live.id,
+                zoneId: live.zoneId,
+              };
+            }
+
+            // Not attached to this Worker — but it could still belong
+            // to another Worker. Check before we try to PUT so we can
+            // emit a helpful error instead of the raw 409.
+            const otherOwner = yield* listDomains({
+              accountId,
+              hostname,
+            }).pipe(
+              Effect.map((r) =>
+                (r.result ?? []).find(
+                  (d) => d.hostname === hostname && d.service !== scriptName,
+                ),
+              ),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+            if (otherOwner?.id) {
+              return yield* Effect.die(
+                new Error(
+                  `Cannot attach hostname '${hostname}' to Worker '${scriptName}': ` +
+                    `it is already attached to Worker '${otherOwner.service ?? "<unknown>"}'. ` +
+                    `Detach it from that Worker first, or pick a different hostname.`,
+                ),
+              );
+            }
+
+            const zoneId = yield* inferZoneIdForHostname(hostname, zoneCache);
+            // Same eventual-consistency window as `setWorkerSubdomain`:
+            // PUT /accounts/.../workers/domains right after `putScript`
+            // can return `WorkerNotFound` until Cloudflare's script
+            // registry has propagated. Retry on that specific tag.
+            const res = yield* putDomain({
+              accountId,
+              hostname,
+              service: scriptName,
+              zoneId,
+            }).pipe(
+              Effect.retry({
+                while: (error: { _tag?: string }) =>
+                  error?._tag === "WorkerNotFound",
+                schedule: Schedule.exponential(200).pipe(
+                  Schedule.both(Schedule.recurs(15)),
+                ),
               }),
-            ),
-            { concurrency: "unbounded" },
-          );
+            );
+            return {
+              hostname,
+              id: res.id ?? "",
+              zoneId: res.zoneId ?? zoneId,
+            };
+          });
+
+          const applied = yield* Effect.all(desired.map(attachDomain), {
+            concurrency: "unbounded",
+          });
           return applied;
         });
 
@@ -1075,11 +1071,15 @@ export const WorkerProvider = () =>
 
       const getExpectedDurableObjectClassNames = (
         bindings: readonly WorkerBinding[] | undefined,
+        workerName: string,
       ) =>
         Array.from(
           new Set(
             bindings?.flatMap((binding) =>
-              binding.type === "durable_object_namespace" && binding.className
+              binding.type === "durable_object_namespace" &&
+              binding.className &&
+              (binding.scriptName === undefined ||
+                binding.scriptName === workerName)
                 ? [binding.className]
                 : [],
             ) ?? [],
@@ -1129,21 +1129,15 @@ export const WorkerProvider = () =>
           return undefined;
         }
 
-        // Handle AssetsWithHash (from Build resource)
-        // Props are resolved by Plan, so Input<string> values are already strings at runtime
         if (
           typeof assets === "object" &&
           "path" in assets &&
           "hash" in assets
         ) {
-          const result = yield* readAssets({
+          return yield* readAssets({
             directory: assets.path as string,
             config: assets.config,
           });
-          return {
-            ...result,
-            hash: assets.hash as string,
-          };
         }
 
         // Handle string path or AssetsProps
@@ -1153,230 +1147,58 @@ export const WorkerProvider = () =>
       });
 
       const prepareBundle = (id: string, props: WorkerProps) =>
-        Effect.gen(function* () {
-          const main = yield* fs.realPath(props.main);
-          const cwd = yield* findCwdForBundle(main);
-          const buildBundle = (plugins?: rolldown.RolldownPluginOption) =>
-            Bundle.build(
-              {
-                input: main,
-                cwd,
-                plugins: [
-                  cloudflareRolldown({
-                    compatibilityDate:
-                      props.compatibility?.date ?? defaultCompatibilityDate,
-                    compatibilityFlags: props.compatibility?.flags,
-                  }),
-                  plugins,
-                  ...(props.build?.metafile ? [Sonda({ open: false })] : []),
-                ],
-                checks: {
-                  // Suppress unresolved import warnings for unrelated AWS packages
-                  unresolvedImport: false,
+        bundler
+          .build({
+            id,
+            main: props.main!,
+            compatibility: getCompatibility(props),
+            entry: props.isExternal
+              ? {
+                  kind: "external",
+                }
+              : {
+                  kind: "effect",
+                  exports: (props.exports ?? {}) as any,
                 },
-              },
-              {
-                format: "esm",
-                sourcemap: "hidden",
-                minify: true,
-                keepNames: true,
-                dir: `.alchemy/bundles/${id}`,
-              },
-            );
-
-          if (props.isExternal) {
-            const bundle = yield* buildBundle();
-            return bundle;
-          }
+            stack: { name: stack.name, stage: stack.stage },
+            extraOptions: props.build,
+          })
+          .pipe(Artifacts.cached("build"));
 
-          const exportMap = (props.exports ?? {}) as Record<string, unknown>;
-          const allExportNames = Object.keys(exportMap).filter(
-            (id) => id !== "default",
-          );
-          const doClasses: string[] = [];
-          const wfClasses: string[] = [];
-          for (const name of allExportNames) {
-            if (isWorkflowExport(exportMap[name])) {
-              wfClasses.push(name);
-            } else if (isDurableObjectExport(exportMap[name])) {
-              doClasses.push(name);
-            }
-          }
-          const hasDoClasses = doClasses.length > 0;
-          const hasWfClasses = wfClasses.length > 0;
-          const script = (importPath: string) => `
-import * as Config from "effect/Config";
-import * as ConfigProvider from "effect/ConfigProvider";
-import * as Console from "effect/Console";
-import * as Effect from "effect/Effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Layer from "effect/Layer";
-import * as Logger from "effect/Logger";
-import * as Context from "effect/Context";
-import * as Stream from "effect/Stream";
-
-import { env, DurableObject${hasWfClasses ? ", WorkflowEntrypoint" : ""} } from "cloudflare:workers";
-import { MinimumLogLevel } from "effect/References";
-import { NodeServices } from "@effect/platform-node";
-import { Stack } from "alchemy/Stack";
-import { WorkerEnvironment, makeDurableObjectBridge${hasWfClasses ? ", makeWorkflowBridge" : ""}, ExportedHandlerMethods } from "alchemy/Cloudflare";
-
-import entry from "${importPath}";
-
-const tag = Context.Service("${Self.key}")
-const layer =
-  typeof entry?.build === "function"
-    ? entry
-    : Layer.effect(tag, typeof entry?.asEffect === "function" ? entry.asEffect() : entry);
-
-const platform = Layer.mergeAll(
-  NodeServices.layer,
-  FetchHttpClient.layer,
-  // TODO(sam): wire this up to telemetry more directly
-  Logger.layer([Logger.consolePretty()]),
-);
-
-const stack = Layer.succeed(
-  Stack,
-  {
-    name: "${stack.name}",
-    stage: "${stack.stage}",
-    bindings: {},
-    resources: {}
-  }
-);
-
-const exportsEffect = tag.asEffect().pipe(
-  Effect.flatMap(func => func.ExecutionContext.exports),
-  Effect.map(exports => exports),
-  Effect.provide(
-    layer.pipe(
-      Layer.provideMerge(stack),
-      // TODO(sam): additional credentials?
-      Layer.provideMerge(platform),
-      Layer.provideMerge(
-        Layer.succeed(
-          ConfigProvider.ConfigProvider,
-          ConfigProvider.orElse(
-            ConfigProvider.fromUnknown({ ALCHEMY_PHASE: "runtime" }),
-            ConfigProvider.fromUnknown(env),
-          ),
-        )
-      ),
-      Layer.provideMerge(
-        Layer.succeed(
-          WorkerEnvironment,
-          env,
-        )
-      ),
-      Layer.provideMerge(
-        Layer.succeed(
-          MinimumLogLevel,
-          env.DEBUG ? "Debug" : "Info",
-        )
-      ),
-    )
-  ),
-  Effect.scoped
-);
-
-// TODO(sam): we could kick this off during module init, but any I/O will break deploy
-// let exportsPromise = Effect.runPromise(exportsEffect);
-
-// for now, we delay initializing the worker until the first request
-let exportsPromise;
-
-// don't initialize the workerEffect during module init because Cloudflare does not allow I/O during module init
-// we cache it synchronously (??=) to guarnatee only one initialization ever happens
-const getExports = () => (exportsPromise ??= Effect.runPromise(exportsEffect))
-const getExport = (name) => getExports().then(exports => exports[name]?.make)
-const worker = () => getExports().then(exports => exports.default)
-
-export default Object.fromEntries(ExportedHandlerMethods.map(
-  method => [method, async (...args) => (await worker())[method](...args)])
-) satisfies Required<cf.ExportedHandler>;
-
-// export class proxy stubs for Durable Objects and Workflows
-${[
-  ...(hasDoClasses
-    ? [
-        "const DurableObjectBridge = makeDurableObjectBridge(DurableObject, getExport);",
-        ...doClasses.map(
-          (id) => `export class ${id} extends DurableObjectBridge("${id}") {}`,
-        ),
-      ]
-    : []),
-  ...(hasWfClasses
-    ? [
-        "const WorkflowBridgeFn = makeWorkflowBridge(WorkflowEntrypoint, getExport);",
-        ...wfClasses.map(
-          (id) => `export class ${id} extends WorkflowBridgeFn("${id}") {}`,
-        ),
-      ]
-    : []),
-].join("\n")}
-`;
-
-          return yield* buildBundle(virtualEntryPlugin(script));
-        }).pipe(Artifacts.cached("build"));
+      const hashScript = (script: string) =>
+        Effect.sync(() =>
+          crypto.createHash("sha256").update(script).digest("hex"),
+        );
 
       const viteBuild = Effect.fnUntraced(function* (props: WorkerProps) {
-        const vite = yield* Effect.promise(() => import("vite"));
-        let assetsDirectory: string | undefined;
-        let serverBundle: vite.Rolldown.OutputBundle | undefined;
-
-        yield* Effect.promise(async () => {
-          const builder = await vite.createBuilder(
-            {
-              root: props.vite?.rootDir,
-              // Declare the ssr environment so Vite 8+ creates it.
-              // The cloudflare-vite-plugin config hook merges its
-              // SSR-specific settings on top of this stub.
-              environments: {
-                ssr: {
-                  build: {
-                    // Prevent the SSR build from wiping the client
-                    // build's output (both share the dist/ directory).
-                    emptyOutDir: false,
-                  },
-                },
-              },
-              builder: {
-                sharedConfigBuild: true,
-              },
-              plugins: [
-                cloudflareVite({
-                  compatibilityDate:
-                    props.compatibility?.date ?? defaultCompatibilityDate,
-                  compatibilityFlags: props.compatibility?.flags,
+        const compatibility = getCompatibility(props);
+        const { assetsDirectory, serverBundle } = yield* Vite.viteBuild(
+          props.vite?.rootDir,
+          Object.fromEntries(
+            (yield* Effect.all(
+              Object.entries(props.env ?? {}).map(
+                Effect.fnUntraced(function* ([key, value]) {
+                  return [
+                    key,
+                    typeof value === "string"
+                      ? value
+                      : Redacted.isRedacted(value) &&
+                          typeof Redacted.value(value) === "string"
+                        ? Redacted.value(value)
+                        : Config.isConfig(value) || Effect.isEffect(value)
+                          ? yield* value
+                          : undefined,
+                  ];
                 }),
-                {
-                  name: "output:ssr",
-                  applyToEnvironment(environment) {
-                    return environment.name === "ssr";
-                  },
-                  generateBundle(_outputOptions, bundle) {
-                    serverBundle = bundle;
-                  },
-                },
-                {
-                  name: "output:client",
-                  applyToEnvironment(environment) {
-                    return environment.name === "client";
-                  },
-                  generateBundle(outputOptions) {
-                    assetsDirectory = outputOptions.dir;
-                  },
-                },
-              ],
-            },
-            // This is the `useLegacyBuilder` option. The Vite CLI implementation uses `null` here.
-            // Originally we used `undefined` here, but this caused the static site build to fail.
-            // https://github.com/vitejs/vite/blob/a07a4bd052ac75f916391c999c408ad5f2867e61/packages/vite/src/node/cli.ts#L367
-            null,
-          );
-          await builder.buildApp();
-        });
+              ),
+            )).filter(([_, value]) => value !== undefined),
+          ),
+          {
+            compatibilityDate: compatibility.date,
+            compatibilityFlags: compatibility.flags,
+          },
+        );
+
         if (!assetsDirectory && !serverBundle) {
           return yield* Effect.die(
             new Error("Vite build produced neither server nor client output"),
@@ -1402,17 +1224,57 @@ ${[
         return { assets, bundle };
       });
 
-      const prepareAssetsAndBundle = (id: string, props: WorkerProps) =>
+      const prepareAssetsAndBundle = (
+        id: string,
+        props: WorkerProps,
+        opts: { skipAssetsRead?: boolean } = {},
+      ) =>
         Effect.gen(function* () {
+          if (props.script !== undefined) {
+            const [assets, bundleHash] = yield* Effect.all(
+              [
+                opts.skipAssetsRead
+                  ? Effect.succeed(undefined)
+                  : prepareAssets(props.assets),
+                hashScript(props.script),
+              ],
+              { concurrency: "unbounded" },
+            );
+            return {
+              assets,
+              bundle: {
+                files: [{ path: "main.js", content: props.script }],
+                hash: bundleHash,
+              },
+            };
+          }
           if (props.vite) {
             const [{ assets, bundle }, input] = yield* Effect.all(
-              [viteBuild(props), hashDirectory(props.vite)],
+              [
+                viteBuild(props),
+                // hashDirectory expects `{ cwd, memo }`. The vite props
+                // store the project root under `rootDir`, so map it
+                // here. Without this, `cwd` falls back to
+                // `process.cwd()` and the input hash is computed over
+                // the wrong directory tree (often the entire monorepo
+                // root), making it both slow and unable to detect
+                // changes scoped to the actual Vite project.
+                hashDirectory({
+                  cwd: props.vite.rootDir,
+                  memo: props.vite.memo,
+                }),
+              ],
               { concurrency: "unbounded" },
             );
             return { assets, bundle, input };
           }
           const [assets, bundle] = yield* Effect.all(
-            [prepareAssets(props.assets), prepareBundle(id, props)],
+            [
+              opts.skipAssetsRead
+                ? Effect.succeed(undefined)
+                : prepareAssets(props.assets),
+              prepareBundle(id, props),
+            ],
             { concurrency: "unbounded" },
           );
           return { assets, bundle };
@@ -1449,19 +1311,79 @@ ${[
         yield* Effect.logInfo(
           `Cloudflare Worker ${olds ? "update" : "create"}: preparing bundle for ${name}`,
         );
-        const { assets, bundle, hash } = yield* prepareAssetsAndBundle(
-          id,
-          news,
-        );
+        // If the caller handed us a precomputed asset hash that matches
+        // what we previously stored, we can skip walking the directory
+        // entirely and tell Cloudflare to keep the assets it already
+        // has bound to this script. The disk read is the expensive
+        // part; the script PUT happens either way.
+        const previousAssetsHash = output?.hash?.assets;
+        const precomputedAssetsHash =
+          news.assets &&
+          typeof news.assets === "object" &&
+          "path" in news.assets &&
+          "hash" in news.assets
+            ? (news.assets.hash as string)
+            : undefined;
+        const assetsConfigFromProps =
+          news.assets &&
+          typeof news.assets === "object" &&
+          "config" in news.assets
+            ? news.assets.config
+            : undefined;
+        const skipAssetsRead =
+          precomputedAssetsHash !== undefined &&
+          precomputedAssetsHash === previousAssetsHash;
+        const {
+          assets,
+          bundle,
+          hash: preparedHash,
+        } = yield* prepareAssetsAndBundle(id, news, { skipAssetsRead });
+        // When the caller supplied a precomputed hash (e.g. via
+        // `Build.Command`), store *that* hash in output state so the
+        // next diff can short-circuit by comparing it directly. The
+        // hash that `readAssets` produces is the manifest-derived
+        // hash, which is shaped differently from any upstream
+        // build-input hash and will never match it on the next pass.
+        const hash = {
+          ...preparedHash,
+          assets: precomputedAssetsHash ?? preparedHash.assets,
+        } satisfies Worker["Attributes"]["hash"];
         const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
         const expectedDurableObjectClassNames =
-          getExpectedDurableObjectClassNames(metadataBindings);
+          getExpectedDurableObjectClassNames(metadataBindings, name);
         let metadataAssets:
           | workers.PutScriptRequest["metadata"]["assets"]
           | undefined;
         let keepAssets = false;
-        if (assets) {
-          if (output?.hash?.assets !== assets.hash) {
+        if (skipAssetsRead) {
+          // Hash matched what's already on Cloudflare: keep the
+          // existing asset manifest and skip the upload session.
+          yield* Effect.logInfo(
+            `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
+          );
+          keepAssets = true;
+          metadataAssets = assetsConfigFromProps
+            ? { config: assetsConfigFromProps }
+            : undefined;
+          metadataBindings.push({
+            type: "assets",
+            name: "ASSETS",
+          });
+        } else if (assets) {
+          // We had to read the directory. Even after the read, the
+          // computed hash may match what's already deployed (e.g.
+          // legacy `string` / `AssetsProps` shapes that don't carry a
+          // precomputed hash, or a precomputed hash that disagreed with
+          // disk). In that case still keep the existing manifest and
+          // skip the upload session — Cloudflare's content-addressed
+          // session would no-op on every byte anyway.
+          if (assets.hash === previousAssetsHash) {
+            yield* Effect.logInfo(
+              `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
+            );
+            keepAssets = true;
+            metadataAssets = { config: assets.config };
+          } else {
             yield* Effect.logInfo(
               `Cloudflare Worker ${olds ? "update" : "create"}: uploading assets for ${name}`,
             );
@@ -1475,14 +1397,6 @@ ${[
               jwt,
               config: assets.config,
             };
-          } else {
-            yield* Effect.logInfo(
-              `Cloudflare Worker update: reusing existing assets for ${name}`,
-            );
-            metadataAssets = {
-              config: assets.config,
-            };
-            keepAssets = true;
           }
           metadataBindings.push({
             type: "assets",
@@ -1490,6 +1404,11 @@ ${[
           });
         }
         metadataBindings.push(
+          {
+            type: "plain_text",
+            name: "ALCHEMY_PHASE",
+            text: "runtime",
+          },
           {
             type: "plain_text",
             name: "ALCHEMY_STACK_NAME",
@@ -1504,18 +1423,29 @@ ${[
         // Add environment variables as metadata bindings
         if (news.env) {
           for (const [key, value] of Object.entries(news.env)) {
-            if (value == null) continue;
+            if (value === undefined) continue;
+            if (metadataBindings.some((b) => b.name === key)) continue;
             if (Redacted.isRedacted(value)) {
+              const unredacted = Redacted.value(value);
               metadataBindings.push({
                 type: "secret_text",
                 name: key,
-                text: Redacted.value(value),
+                text:
+                  typeof unredacted === "string"
+                    ? unredacted
+                    : JSON.stringify(unredacted),
               });
-            } else {
+            } else if (typeof value === "string") {
               metadataBindings.push({
                 type: "plain_text",
                 name: key,
-                text: typeof value === "string" ? value : String(value),
+                text: value,
+              });
+            } else {
+              metadataBindings.push({
+                type: "json",
+                name: key,
+                json: value,
               });
             }
           }
@@ -1575,16 +1505,19 @@ ${[
         }
 
         // Backward compatibility for old workers that have DO bindings but no
-        // alchemy:do tags yet.
+        // alchemy:do tags yet. Cross-script bindings (`scriptName` set to
+        // anything other than this worker) are NEVER candidates for
+        // delete-class migrations — the class lives on the foreign script
+        // and we don't own its lifecycle.
         if (Object.keys(oldDoClassNameByLogicalId).length === 0) {
           for (const oldBinding of oldBindings) {
+            const ownedLocally =
+              !("scriptName" in oldBinding) || oldBinding.scriptName === name;
             if (
               oldBinding.type === "durable_object_namespace" &&
               "className" in oldBinding &&
               oldBinding.className &&
-              (!("scriptName" in oldBinding) ||
-                !oldBinding.scriptName ||
-                oldBinding.scriptName === name) &&
+              ownedLocally &&
               !currentDoBindings.some(
                 (binding) => binding.bindingName === oldBinding.name,
               )
@@ -1668,12 +1601,13 @@ ${[
           }),
         );
 
-        const metadata = {
+        const compatibility = getCompatibility(news);
+        const metadata: workers.PutScriptRequest["metadata"] = {
           assets: metadataAssets,
           bindings: metadataBindings,
           bodyPart: undefined,
-          compatibilityDate: news.compatibility?.date ?? "2026-03-10",
-          compatibilityFlags: news.compatibility?.flags,
+          compatibilityDate: compatibility.date,
+          compatibilityFlags: compatibility.flags,
           containers:
             metadataContainers.length > 0 ? metadataContainers : undefined,
           keepAssets,
@@ -1737,12 +1671,49 @@ ${[
             name,
             expectedDurableObjectClassNames,
           );
-        if (!olds || news.url !== olds.url) {
-          const enable = news.url !== false;
+        // Reconcile workers.dev subdomain against observed cloud state.
+        // We can't diff `news.url` against `olds.url` here because both
+        // default to `undefined` (meaning "enable") — that comparison
+        // would skip the API call on every deploy where the user never
+        // explicitly set `url`, leaving the subdomain in whatever state
+        // Cloudflare currently has it (disabled by default, or whatever
+        // a previous failed/external action left it as).
+        const desiredSubdomainEnabled = news.url !== false;
+        const observedSubdomain = yield* getScriptSubdomain({
+          accountId,
+          scriptName: name,
+        }).pipe(
+          Effect.orElseSucceed<workers.GetScriptSubdomainResponse>(() => ({
+            enabled: false,
+            previewsEnabled: false,
+          })),
+        );
+        if (
+          desiredSubdomainEnabled !== observedSubdomain.enabled ||
+          desiredSubdomainEnabled !== observedSubdomain.previewsEnabled
+        ) {
           yield* session.note(
-            `${enable ? "Enabling" : "Disabling"} workers.dev subdomain...`,
+            `${desiredSubdomainEnabled ? "Enabling" : "Disabling"} workers.dev subdomain...`,
+          );
+          // Cloudflare's script registry is eventually consistent — for the
+          // first few hundred ms after `putScript` returns, POST /subdomain
+          // can still get back `WorkerNotFound` (a generic "unknown error"
+          // body), or a bare 500 surfaced as `InternalServerError` /
+          // `UnknownCloudflareError` (code 10013). Bigger uploads race harder.
+          // Retry the subdomain toggle on those transient tags with a short
+          // exponential backoff; same pattern we use elsewhere in this
+          // provider for DO-namespace propagation and for `putScript` itself.
+          yield* setWorkerSubdomain(name, desiredSubdomainEnabled).pipe(
+            Effect.retry({
+              while: (error: { _tag?: string }) =>
+                error?._tag === "WorkerNotFound" ||
+                error?._tag === "InternalServerError" ||
+                error?._tag === "UnknownCloudflareError",
+              schedule: Schedule.exponential(200).pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
           );
-          yield* setWorkerSubdomain(name, enable);
         }
         const desiredDomains = normalizeDomains(news.domain);
         const previousDomains = output?.domains ?? [];
@@ -1751,23 +1722,31 @@ ${[
             `Reconciling custom domains (${desiredDomains.length}) ...`,
           );
         }
-        const domains = yield* reconcileDomains(
+        const reconciled = yield* reconcileDomains(name, desiredDomains);
+        const workersDevUrl =
+          news.url !== false
+            ? `https://${name}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+            : undefined;
+        const domains = [
+          ...reconciled.map((d) => `https://${d.hostname}`),
+          ...(workersDevUrl ? [workersDevUrl] : []),
+        ];
+        const crons = yield* reconcileCrons(
           name,
-          desiredDomains,
-          previousDomains,
+          normalizeCrons([...getCronBindings(bindings), ...(news.crons ?? [])]),
+          output?.crons ?? [],
+          session,
         );
         return {
           workerId: worker.id ?? name,
           workerName: name,
           logpush: worker.logpush ?? undefined,
-          url:
-            news.url !== false
-              ? `https://${name}.${yield* getAccountSubdomain(accountId)}.workers.dev`
-              : undefined,
+          url: domains[0],
           tags: settings.tags ?? metadata.tags,
           durableObjectNamespaces,
           accountId,
           domains,
+          crons,
           hash,
         } satisfies Worker["Attributes"];
       });
@@ -1777,28 +1756,78 @@ ${[
         props: WorkerProps,
         output: Worker["Attributes"],
       ) {
+        if (props.script !== undefined) {
+          const scriptHash = yield* hashScript(props.script);
+          if (scriptHash !== output.hash?.bundle) {
+            return true;
+          }
+          if (!props.assets) {
+            return false;
+          }
+          const assetsHash =
+            typeof props.assets === "object" &&
+            "path" in props.assets &&
+            "hash" in props.assets
+              ? (props.assets.hash as string)
+              : undefined;
+          if (assetsHash === undefined) {
+            return true;
+          }
+          return assetsHash !== output.hash?.assets;
+        }
         if (props.vite) {
-          const input = yield* hashDirectory(props.vite);
+          const input = yield* hashDirectory({
+            cwd: props.vite.rootDir,
+            memo: props.vite.memo,
+          });
           return input !== output.hash?.input;
         }
-        const [assetsHash, bundleHash] = yield* Effect.all(
-          [
-            "assets" in output && output.hash?.assets
-              ? Effect.succeed(output.hash.assets)
-              : prepareAssets(props.assets).pipe(Effect.map((a) => a?.hash)),
-            prepareBundle(id, props).pipe(Effect.map((b) => b.hash)),
-          ],
-          { concurrency: "unbounded" },
-        );
-        return (
-          assetsHash !== output.hash?.assets ||
-          bundleHash !== output.hash?.bundle
+        const bundleHash = yield* prepareBundle(id, props).pipe(
+          Effect.map((b) => b.hash),
         );
+        if (bundleHash !== output.hash?.bundle) {
+          return true;
+        }
+        if (!props.assets) {
+          return false;
+        }
+        // We deliberately don't read the assets directory during diff.
+        // For `AssetsWithHash` (the documented contract) the upstream
+        // `Build.Command` already gave us an authoritative hash — we
+        // just compare strings. Reading the directory here would
+        // (a) hash the same tree twice per apply (`putWorker` reads
+        // again when an upload is actually required), and (b) crash
+        // when the prior state was written on a different machine
+        // and `path` doesn't exist locally — blocking any local
+        // reapply even though the precomputed hash is right there
+        // in props.
+        //
+        // For the legacy `string` / `AssetsProps` shapes there's no
+        // hash in props to compare against, so we conservatively
+        // assume the assets changed; `putWorker` will read once,
+        // hash, and use `keepAssets` if it turns out nothing actually
+        // changed.
+        const assetsHash =
+          typeof props.assets === "object" &&
+          "path" in props.assets &&
+          "hash" in props.assets
+            ? (props.assets.hash as string)
+            : undefined;
+        if (assetsHash === undefined) {
+          return true;
+        }
+        return assetsHash !== output.hash?.assets;
       });
 
       return Worker.Provider.of({
         stables: ["workerId", "workerName"],
-        diff: Effect.fnUntraced(function* ({ id, news, olds, output }) {
+        diff: Effect.fnUntraced(function* ({
+          id,
+          news,
+          olds,
+          output,
+          newBindings,
+        }) {
           if (!isResolved(news)) return undefined;
           if ((output?.accountId ?? accountId) !== accountId) {
             return { action: "replace" };
@@ -1813,14 +1842,32 @@ ${[
           if (!output) {
             return;
           }
-          const newDomains = normalizeDomains(news.domain).sort();
+          const newDomains = normalizeDomains(news.domain)
+            .map((h) => `https://${h}`)
+            .sort();
           const oldDomains = (output?.domains ?? [])
-            .map((d) => d.hostname)
+            .filter((u) => !u.endsWith(".workers.dev"))
             .sort();
           const domainsChanged =
             newDomains.length !== oldDomains.length ||
             newDomains.some((d, i) => d !== oldDomains[i]);
-          if (domainsChanged || (yield* hasChanged(id, news, output))) {
+          const newCrons = normalizeCrons([
+            ...(Array.isArray(newBindings)
+              ? getCronBindings(
+                  newBindings as ResourceBinding<Worker["Binding"]>[],
+                )
+              : []),
+            ...(news.crons ?? []),
+          ]).sort();
+          const oldCrons = [...(output?.crons ?? [])].sort();
+          const cronsChanged =
+            newCrons.length !== oldCrons.length ||
+            newCrons.some((cron, index) => cron !== oldCrons[index]);
+          if (
+            domainsChanged ||
+            cronsChanged ||
+            (yield* hasChanged(id, news, output))
+          ) {
             return {
               action: "update",
               stables:
@@ -1869,13 +1916,11 @@ ${[
           );
 
           if (existingSettings) {
-            if (!hasAlchemyWorkerTags(id, existingSettings.tags ?? [])) {
-              return yield* Effect.die(
-                `Worker "${name}" already exists but is not owned by this stack/stage/resource`,
-              );
-            }
+            // Engine has already cleared this resource for write via
+            // `read` + AdoptPolicy. Either we own it (matching tags) or
+            // the user opted in to a takeover (`--adopt` / `adopt(true)`).
             yield* Effect.logInfo(
-              `Cloudflare Worker precreate: adopting existing ${name} owned by this stack/stage/resource`,
+              `Cloudflare Worker precreate: reusing existing ${name}`,
             );
           } else {
             yield* session.note("Pre-creating worker...");
@@ -1899,9 +1944,7 @@ ${[
                         className,
                       }))
                     : undefined,
-                compatibilityDate:
-                  news.compatibility?.date ?? defaultCompatibilityDate,
-                compatibilityFlags: news.compatibility?.flags,
+                ...getCompatibility(news),
                 containers,
                 migrations:
                   doClasses.length > 0
@@ -1929,7 +1972,23 @@ ${[
                   type: "application/javascript+module",
                 }),
               ],
-            });
+            }).pipe(
+              // Cloudflare's PUT /workers/scripts/{name} intermittently
+              // returns code 10002 / "An unknown error has occurred" on the
+              // first put for a fresh worker name. Surfaced as the shared
+              // `InternalServerError` upstream (alchemy-run/distilled#290).
+              // Also match `UnknownCloudflareError` for older
+              // @distilled.cloud/cloudflare versions that haven't picked
+              // up the patch yet.
+              Effect.retry({
+                while: (e: any) =>
+                  e._tag === "InternalServerError" ||
+                  e._tag === "UnknownCloudflareError",
+                schedule: Schedule.exponential(1000).pipe(
+                  Schedule.both(Schedule.recurs(5)),
+                ),
+              }),
+            );
             if (doClasses.length > 0) {
               ({ durableObjectNamespaces } =
                 yield* getWorkerSettingsWithDurableObjects(name, doClasses));
@@ -1950,6 +2009,7 @@ ${[
             durableObjectNamespaces,
             accountId,
             domains: [],
+            crons: [],
           } satisfies Worker["Attributes"];
         }),
         read: Effect.fnUntraced(
@@ -1959,55 +2019,79 @@ ${[
             yield* Effect.logInfo(
               `Cloudflare Worker read: checking ${workerName}`,
             );
-            const [worker, subdomain, settings, domainsList] =
-              yield* Effect.all([
-                listScripts({
-                  accountId,
-                }).pipe(
-                  Effect.map((workers) =>
-                    workers.result.find((worker) => worker.id === workerName),
-                  ),
-                ),
-                getScriptSubdomain({
-                  accountId,
-                  scriptName: workerName,
-                }),
-                getScriptSettings({
-                  accountId,
-                  scriptName: workerName,
-                }),
-                listDomains({
-                  accountId,
-                  service: workerName,
-                }).pipe(Effect.map((r) => r.result ?? [])),
-              ]);
-            if (!worker) {
-              yield* Effect.logInfo(
-                `Cloudflare Worker read: ${workerName} not found in script list`,
-              );
-              return undefined;
-            }
+            // We deliberately don't call `listScripts({ accountId })` here:
+            // it pulls every Worker on the account back through a strict
+            // schema decode, and a single existing Worker the schema doesn't
+            // know about (e.g. `placement_mode: "targeted"`) breaks the
+            // entire read. `getScriptSettings` already fails with
+            // `WorkerNotFound` if the script doesn't exist, which the
+            // surrounding `Effect.catchTag` turns into `undefined` — that's
+            // all the existence check we need.
+            const [subdomain, settings, domainsList] = yield* Effect.all([
+              getScriptSubdomain({
+                accountId,
+                scriptName: workerName,
+              }),
+              getScriptSettings({
+                accountId,
+                scriptName: workerName,
+              }),
+              listDomains({
+                accountId,
+                service: workerName,
+              }).pipe(Effect.map((r) => r.result ?? [])),
+            ]);
+            // Preserve the order the user provided in `olds.domain`. The
+            // Cloudflare API returns domains in non-deterministic order,
+            // which would cause downstream `worker.domains[0]` reads to flip
+            // between deploys. Drift (domains we don't know about) is
+            // appended after the user-ordered ones.
+            const userOrder = normalizeDomains(olds?.domain);
+            const orderedHostnames = [
+              ...userOrder.flatMap(
+                (h) =>
+                  domainsList.find((d) => d.hostname === h)?.hostname ?? [],
+              ),
+              ...domainsList.flatMap((d) =>
+                d.hostname && !userOrder.includes(d.hostname)
+                  ? [d.hostname]
+                  : [],
+              ),
+            ];
+            const workersDevUrl = subdomain.enabled
+              ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+              : undefined;
+            const domains = [
+              ...orderedHostnames.map((h) => `https://${h}`),
+              ...(workersDevUrl ? [workersDevUrl] : []),
+            ];
+            const crons = yield* getWorkerCrons(workerName);
             yield* Effect.logInfo(
               `Cloudflare Worker read: found ${workerName}`,
             );
-            return {
+            const attrs = {
               accountId,
-              workerId: worker.id ?? workerName,
+              workerId: workerName,
               workerName,
-              logpush: worker.logpush ?? undefined,
-              url: subdomain.enabled
-                ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
-                : undefined,
+              logpush: settings.logpush ?? undefined,
+              url: domains[0],
               tags: settings.tags ?? undefined,
               durableObjectNamespaces: getDurableObjectNamespaces(
                 settings.bindings,
               ),
-              domains: domainsList.flatMap((d) =>
-                d.id && d.hostname && d.zoneId
-                  ? [{ id: d.id, hostname: d.hostname, zoneId: d.zoneId }]
-                  : [],
-              ),
+              domains,
+              crons,
             } satisfies Worker["Attributes"];
+
+            // Centralized ownership decision: the engine routes `read`'s
+            // return value based on `AdoptPolicy`. We hand it the attrs
+            // either as-is (owned: alchemy tags identify this stack/stage/id,
+            // safe to silently adopt even without `--adopt`) or branded with
+            // `Unowned` (caller must opt in via `--adopt` or the engine
+            // raises `OwnedBySomeoneElse`).
+            return hasAlchemyWorkerTags(id, settings.tags ?? [])
+              ? attrs
+              : Unowned(attrs);
           },
           (effect) =>
             effect.pipe(
@@ -2016,26 +2100,36 @@ ${[
               ),
             ),
         ),
-        create: Effect.fnUntraced(function* ({
+        reconcile: Effect.fnUntraced(function* ({
           id,
           news,
+          olds,
           bindings,
           output,
           session,
         }) {
-          const name = yield* createWorkerName(id, news.name);
+          const name =
+            output?.workerName ?? (yield* createWorkerName(id, news.name));
           const durableObjects = getDurableObjectBindings(bindings, name).map(
             ({ logicalId, className }) => ({
               logicalId,
               className,
             }),
           );
-          yield* Effect.logInfo(`Cloudflare Worker create: starting ${name}`);
           yield* Effect.logInfo(
-            `Cloudflare Worker create: durable objects ${JSON.stringify(
+            `Cloudflare Worker reconcile: starting ${name}`,
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: durable objects ${JSON.stringify(
               durableObjects,
             )}`,
           );
+
+          // Observe — fetch the script's current settings if it already exists.
+          // `putWorker` is a true upsert against the Cloudflare API; the
+          // existing settings inform asset/migration decisions and let the
+          // reconciler converge whether the worker is brand-new, adopted, or
+          // an in-place update.
           const existingSettings = yield* getScriptSettings({
             accountId,
             scriptName: name,
@@ -2043,78 +2137,57 @@ ${[
             Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
           );
           yield* Effect.logInfo(
-            `Cloudflare Worker create: existing durable object tags ${JSON.stringify(
+            `Cloudflare Worker reconcile: existing durable object tags ${JSON.stringify(
               (existingSettings?.tags ?? []).filter((tag) =>
                 tag.startsWith("alchemy:do:"),
               ),
             )}`,
           );
-          if (existingSettings) {
-            yield* Effect.logInfo(
-              `Cloudflare Worker create: ${name} already exists`,
-            );
-            if (!hasAlchemyWorkerTags(id, existingSettings.tags ?? [])) {
-              return yield* Effect.die(
-                `Worker "${name}" already exists but is not owned by this stack/stage/resource`,
-              );
-            }
-            yield* Effect.logInfo(
-              `Cloudflare Worker create: adopting existing ${name} owned by this stack/stage/resource`,
-            );
-          }
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: previous durable object tags ${JSON.stringify(
+              (output?.tags ?? []).filter((tag) =>
+                tag.startsWith("alchemy:do:"),
+              ),
+            )}`,
+          );
           return yield* putWorker(
             id,
             news,
             bindings,
-            undefined,
+            olds,
             output,
             session,
             existingSettings,
           );
         }),
-        update: Effect.fnUntraced(function* ({
-          id,
-          olds,
-          news,
-          output,
-          bindings,
-          session,
-        }) {
-          const durableObjects = getDurableObjectBindings(
-            bindings,
-            output.workerName,
-          ).map(({ logicalId, className }) => ({
-            logicalId,
-            className,
-          }));
-          yield* Effect.logInfo(
-            `Cloudflare Worker update: starting ${output.workerName}`,
-          );
-          yield* Effect.logInfo(
-            `Cloudflare Worker update: durable objects ${JSON.stringify(
-              durableObjects,
-            )}`,
-          );
-          yield* Effect.logInfo(
-            `Cloudflare Worker update: previous durable object tags ${JSON.stringify(
-              (output.tags ?? []).filter((tag) =>
-                tag.startsWith("alchemy:do:"),
-              ),
-            )}`,
-          );
-          return yield* putWorker(id, news, bindings, olds, output, session);
-        }),
         delete: Effect.fnUntraced(function* ({ output }) {
           yield* Effect.logInfo(
             `Cloudflare Worker delete: deleting ${output.workerName}`,
           );
-          if (output.domains?.length) {
+          // Look up live domain IDs rather than trusting persisted state.
+          // We no longer track `{ id, zoneId }` on the output; fetching
+          // straight from Cloudflare handles both the normal case and
+          // adopted workers whose domains we never recorded.
+          const liveDomains = yield* listDomains({
+            accountId: output.accountId,
+            service: output.workerName,
+          }).pipe(
+            Effect.map((r) => r.result ?? []),
+            Effect.catch(() => Effect.succeed([])),
+          );
+          if (liveDomains.length) {
             yield* Effect.all(
-              output.domains.map((d) =>
-                deleteDomain({
-                  accountId: output.accountId,
-                  domainId: d.id,
-                }).pipe(Effect.catchTag("DomainNotFound", () => Effect.void)),
+              liveDomains.flatMap((d) =>
+                d.id
+                  ? [
+                      deleteDomain({
+                        accountId: output.accountId,
+                        domainId: d.id,
+                      }).pipe(
+                        Effect.catchTag("DomainNotFound", () => Effect.void),
+                      ),
+                    ]
+                  : [],
               ),
               { concurrency: "unbounded" },
             );
@@ -2122,82 +2195,19 @@ ${[
           yield* deleteScript({
             accountId: output.accountId,
             scriptName: output.workerName,
+            // Force teardown of queue consumers, durable object classes, and
+            // service bindings hanging off this worker. Without `force`, those
+            // conditions raise QueueConsumerConflict / ServiceBindingConflict
+            // and leave the script in CF. Alchemy is the source of truth for
+            // the worker, so we want a hard delete on teardown.
+            force: true,
           }).pipe(Effect.catchTag("WorkerNotFound", () => Effect.void));
         }),
-        tail: ({ output }) => {
-          const runTailSession = Effect.gen(function* () {
-            const { id: tailId, url } = yield* createScriptTail({
-              scriptName: output.workerName,
-              accountId: output.accountId,
-              body: { filters: [] },
-            });
-
-            const socket = yield* Socket.makeWebSocket(url, {
-              protocols: ["trace-v1"],
-            });
-
-            const queue = yield* Queue.make<LogLine, Cause.Done>();
-
-            yield* socket
-              .runRaw((raw) => {
-                const text =
-                  typeof raw === "string" ? raw : new TextDecoder().decode(raw);
-                const data: TailEventMessage = JSON.parse(text);
-                const eventTs = new Date(data.eventTimestamp ?? Date.now());
-
-                if (data.event && "request" in data.event) {
-                  const reqEvent = data.event;
-                  const pathname = (() => {
-                    try {
-                      return new URL(reqEvent.request.url).pathname;
-                    } catch {
-                      return reqEvent.request.url;
-                    }
-                  })();
-                  const status = reqEvent.response?.status ?? 500;
-                  Queue.offerUnsafe(queue, {
-                    timestamp: eventTs,
-                    message: `${reqEvent.request.method} ${pathname} > ${status} (cpu: ${Math.round(data.cpuTime)}ms, wall: ${Math.round(data.wallTime)}ms)`,
-                  });
-                }
-
-                for (const log of data.logs) {
-                  const msg = log.message.join(" ");
-                  Queue.offerUnsafe(queue, {
-                    timestamp: new Date(log.timestamp),
-                    message: log.level === "log" ? msg : `${log.level}: ${msg}`,
-                  });
-                }
-
-                for (const exception of data.exceptions) {
-                  Queue.offerUnsafe(queue, {
-                    timestamp: new Date(exception.timestamp),
-                    message: `${exception.name} ${exception.message}\n${exception.stack}`,
-                  });
-                }
-              })
-              .pipe(
-                Effect.ensuring(
-                  Effect.all([
-                    deleteScriptTail({
-                      scriptName: output.workerName,
-                      id: tailId,
-                      accountId: output.accountId,
-                    }).pipe(Effect.ignore),
-                    Queue.end(queue),
-                  ]),
-                ),
-                Effect.ignore,
-                Effect.forkChild(),
-              );
-
-            return Stream.fromQueue(queue);
-          });
-
-          return Stream.unwrap(runTailSession).pipe(
-            Stream.repeat(Schedule.spaced("1 second")),
-          );
-        },
+        tail: ({ output }) =>
+          telemetry.tailScript({
+            accountId: output.accountId,
+            scriptName: output.workerName,
+          }),
         logs: ({ output, options }) =>
           telemetry.queryLogs({
             accountId: output.accountId,
@@ -2215,33 +2225,6 @@ ${[
     }),
   );
 
-interface TailEventMessage {
-  eventTimestamp?: number;
-  wallTime: number;
-  cpuTime: number;
-  truncated: boolean;
-  outcome: string;
-  scriptName: string;
-  exceptions: {
-    name: string;
-    message: string;
-    stack: string;
-    timestamp: string;
-  }[];
-  logs: {
-    message: string[];
-    level: string;
-    timestamp: string;
-  }[];
-  event:
-    | {
-        request: { method: string; url: string };
-        response?: { status: number };
-      }
-    | null
-    | undefined;
-}
-
 const contentTypeFromExtension = (extension: string) => {
   switch (extension) {
     case ".wasm":
@@ -2264,3 +2247,65 @@ const contentTypeFromExtension = (extension: string) => {
       return "application/octet-stream";
   }
 };
+
+function bumpMigrationTagVersion(
+  oldTag: string | undefined,
+): string | undefined {
+  if (!oldTag) return undefined;
+  const version = oldTag.match(/^(alchemy:)?v(\d+)$/)?.[2];
+  if (!version) return "alchemy:v1";
+  return `alchemy:v${parseInt(version, 10) + 1}`;
+}
+
+function getDurableObjectBindings(
+  bindings: ReadonlyArray<ResourceBinding>,
+  workerName: string,
+) {
+  // Resource authors (and the `make`/`yield* Tag`/plan-vs-apply machinery)
+  // can register the same DO binding multiple times under the same logical
+  // id — `binding()` is a plain `worker.bind` and intentionally has no
+  // dedup. Collapse duplicates here so each `(logicalId, bindingName,
+  // className)` tuple appears at most once. We also exclude cross-script
+  // references: a `scriptName` pointing to *another* worker means this
+  // worker just references a foreign class — ship the binding to
+  // Cloudflare, but don't drive class migrations for it.
+  const seen = new Set<string>();
+  return bindings.flatMap((binding) =>
+    (binding.data.bindings ?? []).flatMap((item: WorkerBinding) => {
+      if (
+        item.type !== "durable_object_namespace" ||
+        !("className" in item) ||
+        !item.className
+      ) {
+        return [];
+      }
+      if (item.scriptName !== undefined && item.scriptName !== workerName) {
+        return [];
+      }
+      const dedupKey = `${binding.sid}::${item.name}::${item.className}`;
+      if (seen.has(dedupKey)) return [];
+      seen.add(dedupKey);
+      return [
+        {
+          logicalId: binding.sid,
+          bindingName: item.name,
+          className: item.className,
+        },
+      ];
+    }),
+  );
+}
+
+function getDurableObjectTagMap(tags: ReadonlyArray<string>) {
+  return Object.fromEntries(
+    tags.flatMap((tag) => {
+      if (!tag.startsWith("alchemy:do:")) {
+        return [];
+      }
+      const parts = tag.split(":");
+      const logicalId = parts[2];
+      const className = parts.slice(3).join(":");
+      return logicalId && className ? [[logicalId, className]] : [];
+    }),
+  );
+}