alchemy 2.0.0-beta.57 → 2.0.0-beta.58

package/src/Cloudflare/Container/ContainerProvider.ts

@@ -0,0 +1,1052 @@
+import * as Containers from "@distilled.cloud/cloudflare/containers";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { hashDirectory } from "../../Command/Memo.ts";
+import {
+  dockerBuild,
+  dockerTag,
+  materializeDockerfile,
+  pushImage,
+  runDockerCommand,
+  writeContextFiles,
+} from "../../Bundle/Docker.ts";
+import { getStableContextDir } from "../../Bundle/TempRoot.ts";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { type ResourceBinding } from "../../Resource.ts";
+import { sha256Object } from "../../Util/sha256.ts";
+import { normalizeNulls } from "../../Util/stable.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import { isLiveId } from "../LocalRuntime.ts";
+import { CloudflareLogs, type TelemetryFilter } from "../Logs.ts";
+import type {
+  ContainerApplication,
+  ContainerApplicationProps,
+} from "./ContainerApplication.ts";
+import {
+  buildFinalDockerfile,
+  bundleContainerProgram,
+  createContainerApplicationName,
+  foldEnvIntoEnvironmentVariables,
+} from "./ContainerBundle.ts";
+import { ContainerPlatform } from "./ContainerPlatform.ts";
+
+/**
+ * The image source resolved from a {@link ContainerApplicationProps}. Selects
+ * one of three strategies used by `buildAndPushImage`:
+ *
+ * - `effectful` — bundle an Effect-native `main` and build a generated image.
+ * - `external` — build a user-supplied Dockerfile against a context directory.
+ * - `remote` — pull a pre-built remote image and re-push it to Cloudflare.
+ */
+type ImageBuild =
+  | {
+      readonly kind: "effectful";
+      readonly files: ReadonlyArray<{ path: string; content: Uint8Array }>;
+    }
+  | {
+      readonly kind: "external";
+      readonly context: string;
+      readonly dockerfile: string;
+    }
+  | {
+      readonly kind: "remote";
+      readonly image: string;
+    };
+
+export const LiveContainerProvider = () =>
+  Provider.effect(
+    ContainerPlatform,
+    Effect.gen(function* () {
+      const { dotAlchemy } = yield* AlchemyContext;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      const telemetry = yield* CloudflareLogs;
+
+      const createApplicationName = createContainerApplicationName;
+
+      const findApplicationByName = Effect.fn(function* (name: string) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+
+        return yield* Containers.listContainerApplications({ accountId }).pipe(
+          Effect.map((apps) => apps.find((app) => app.name === name)),
+        );
+      });
+
+      const findApplicationByNamespace = Effect.fn(function* (
+        namespaceId: string,
+      ) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+
+        return yield* Containers.listContainerApplications({ accountId }).pipe(
+          Effect.map((apps) =>
+            apps.find((app) => app.durableObjects?.namespaceId === namespaceId),
+          ),
+        );
+      });
+
+      // After deleting an application by id, Cloudflare's account-scoped
+      // `list` endpoint stays eventually-consistent for a short window and can
+      // keep returning the now-deleted row. A subsequent recreate that
+      // re-discovers the application by name (`createApplication`) would then
+      // "adopt" that stale row and try to UPDATE it — which fails permanently
+      // with `ContainerApplicationNotFound` (the app is really gone) and
+      // exhausts the readiness retry. Block until the deleted id no longer
+      // appears under that name (or a different id has taken the name, i.e. a
+      // concurrent recreate) before proceeding. Bounded by the readiness
+      // schedule; if it never clears we fall through and let create handle it.
+      const waitForApplicationDeleted = (name: string, deletedId: string) =>
+        findApplicationByName(name).pipe(
+          Effect.repeat({
+            schedule: containerApplicationReadinessSchedule,
+            until: (app) => app?.id !== deletedId,
+          }),
+          Effect.asVoid,
+        );
+
+      const desiredConfiguration = (
+        props: ContainerApplicationProps,
+        imageRef: string,
+        accountId: string,
+      ) =>
+        normalizeNulls({
+          image: imageRef,
+          instanceType: props.instanceType,
+          observability: props.observability,
+          sshPublicKeyIds: props.sshPublicKeyIds,
+          secrets: props.secrets,
+          vcpu: props.vcpu,
+          memory: props.memory,
+          disk: props.disk,
+          environmentVariables: foldEnvIntoEnvironmentVariables(
+            props,
+            accountId,
+          ),
+          labels: props.labels,
+          network: props.network,
+          command: props.command,
+          entrypoint: props.entrypoint,
+          dns: props.dns,
+          ports: props.ports,
+          checks: props.checks,
+        }) as ContainerApplication.Configuration;
+
+      const computeImage = Effect.fn(function* (
+        id: string,
+        props: ContainerApplicationProps,
+      ) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const name = yield* createApplicationName(id, props.name);
+        const registryId = props.registryId ?? "registry.cloudflare.com";
+        const repositoryName = name.toLowerCase();
+        const makeRef = (imageHash: string) =>
+          `${registryId}/${accountId}/${repositoryName}:${imageHash}`;
+
+        // Variant 1 — Effect-native program. Bundle `main` and build a
+        // generated Dockerfile around it.
+        if (props.main) {
+          const runtime = props.runtime ?? "bun";
+          const { files, hash: bundleHash } = yield* bundleContainerProgram({
+            id,
+            main: props.main,
+            runtime,
+            handler: props.handler,
+            isExternal: props.isExternal,
+            external: props.external,
+          });
+          const finalDockerfile = buildFinalDockerfile(
+            props.dockerfile,
+            runtime,
+            props.external,
+            props.autoInstallExternals,
+          );
+          const imageHash = (yield* sha256Object({
+            bundleHash,
+            dockerfile: finalDockerfile,
+          })).slice(0, 16);
+          return {
+            build: { kind: "effectful" as const, files },
+            imageRef: makeRef(imageHash),
+            imageHash,
+          };
+        }
+
+        // Variant 2 — pre-built remote image. The image reference is the
+        // identity; we pull and re-push it without building anything.
+        if (props.image) {
+          const imageHash = (yield* sha256Object({
+            image: props.image,
+          })).slice(0, 16);
+          return {
+            build: { kind: "remote" as const, image: props.image },
+            imageRef: makeRef(imageHash),
+            imageHash,
+          };
+        }
+
+        // Variant 3 — user-supplied Dockerfile + build context directory.
+        const context = yield* fs.realPath(props.context ?? ".");
+        const dockerfile = props.dockerfile
+          ? yield* fs.realPath(props.dockerfile)
+          : path.join(context, "Dockerfile");
+        const contextHash = yield* hashDirectory({ cwd: context });
+        const dockerfileContent = yield* fs.readFileString(dockerfile);
+        const imageHash = (yield* sha256Object({
+          contextHash,
+          dockerfile: dockerfileContent,
+        })).slice(0, 16);
+        return {
+          build: { kind: "external" as const, context, dockerfile },
+          imageRef: makeRef(imageHash),
+          imageHash,
+        };
+      });
+
+      const buildAndPushImage = Effect.fn(function* (
+        id: string,
+        props: ContainerApplicationProps,
+        build: ImageBuild,
+        imageRef: string,
+        session?: { note: (message: string) => Effect.Effect<void> },
+      ) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const platform = "linux/amd64";
+
+        if (build.kind === "remote") {
+          // Pull the pre-built image and re-tag it to the Cloudflare registry
+          // reference; nothing is built locally.
+          yield* Effect.logInfo(
+            `Cloudflare Container image: pulling ${build.image}`,
+          );
+          if (session) {
+            yield* session.note(`Pulling container image ${build.image}...`);
+          }
+          yield* runDockerCommand([
+            "pull",
+            "--platform",
+            platform,
+            build.image,
+          ]);
+          yield* dockerTag(build.image, imageRef);
+        } else if (build.kind === "external") {
+          // Build the user's Dockerfile directly against their context dir so
+          // relative `COPY`/`ADD` paths resolve as the author intended.
+          yield* Effect.logInfo(
+            `Cloudflare Container image: building ${imageRef}`,
+          );
+          if (session) {
+            yield* session.note(`Building container image ${imageRef}...`);
+          }
+          yield* dockerBuild({
+            tag: imageRef,
+            context: build.context,
+            platform,
+            extraArgs: ["-f", build.dockerfile],
+          });
+        } else {
+          // Effect-native program: materialize the generated Dockerfile and
+          // bundled chunks into a stable staging dir, then build.
+          yield* Effect.logInfo(
+            `Cloudflare Container image: building ${imageRef}`,
+          );
+          if (session) {
+            yield* session.note(`Building container image ${imageRef}...`);
+          }
+          const runtime = props.runtime ?? "bun";
+          const contextDir = yield* getStableContextDir(
+            process.cwd(),
+            dotAlchemy,
+            `${id}-container`,
+          );
+          const finalDockerfile = buildFinalDockerfile(
+            props.dockerfile,
+            runtime,
+            props.external,
+            props.autoInstallExternals,
+          );
+          yield* materializeDockerfile(finalDockerfile, contextDir);
+          yield* writeContextFiles(
+            contextDir,
+            build.files.map((f, i) => ({
+              // Keep the entry rename to `index.mjs` so the Dockerfile
+              // ENTRYPOINT (`ENTRYPOINT ["bun", "/app/index.mjs"]`) stays
+              // valid; preserve rolldown-assigned fileNames for every other
+              // chunk so intra-bundle relative imports resolve at runtime.
+              path: i === 0 ? "index.mjs" : f.path,
+              content: f.content,
+            })),
+          );
+          yield* dockerBuild({
+            tag: imageRef,
+            context: contextDir,
+            platform,
+          });
+        }
+
+        yield* Effect.logInfo(
+          `Cloudflare Container image: pushing ${imageRef}`,
+        );
+        if (session) {
+          yield* session.note(`Pushing container image ${imageRef}...`);
+        }
+
+        const registryId = props.registryId ?? "registry.cloudflare.com";
+        const credentials =
+          yield* Containers.createContainerRegistryCredentials({
+            accountId,
+            registryId,
+            permissions: ["pull", "push"],
+            expirationMinutes: 60,
+          });
+        const username = credentials.username ?? (credentials as any).user;
+        if (!username) {
+          return yield* Effect.fail(
+            new Error(
+              "Cloudflare registry credentials did not include a username.",
+            ),
+          );
+        }
+
+        yield* pushImage(imageRef, {
+          username,
+          password: credentials.password,
+          server: registryId,
+        });
+      });
+
+      const maybeCreateRollout = Effect.fn(function* ({
+        applicationId,
+        configuration,
+        rollout,
+      }: {
+        applicationId: string;
+        configuration: ContainerApplication.Configuration;
+        rollout: ContainerApplication.Rollout | undefined;
+      }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+
+        const strategy = rollout?.strategy ?? "immediate";
+        const stepPercentage =
+          strategy === "immediate" ? 100 : (rollout?.stepPercentage ?? 25);
+
+        yield* retryForContainerApplicationReadiness(
+          "rollout",
+          applicationId,
+          Containers.createContainerApplicationRollout({
+            accountId,
+            applicationId,
+            description:
+              strategy === "immediate"
+                ? "Immediate update"
+                : "Progressive update",
+            strategy: "rolling",
+            kind: rollout?.kind ?? "full_auto",
+            stepPercentage,
+            targetConfiguration: configuration,
+          }),
+        );
+      });
+
+      const createApplication = Effect.fn(function* ({
+        id,
+        news,
+        name,
+        configuration,
+        durableObjects,
+        session,
+      }: {
+        id: string;
+        news: ContainerApplicationProps;
+        name: string;
+        configuration: ContainerApplication.Configuration;
+        durableObjects:
+          | {
+              namespaceId: string;
+            }
+          | undefined;
+        session: { note: (message: string) => Effect.Effect<void> };
+      }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+
+        const describeError = (error: unknown) => {
+          if (error instanceof Error) {
+            return JSON.stringify(
+              Object.fromEntries(
+                Object.getOwnPropertyNames(error).map((key) => [
+                  key,
+                  (error as unknown as Record<string, unknown>)[key],
+                ]),
+              ),
+              null,
+              2,
+            );
+          }
+          return String(error);
+        };
+
+        // Engine has cleared us via `read` (foreign-named applications are
+        // surfaced as `Unowned`). Re-fetch the existing application to fold
+        // it into the upsert path.
+        const existingByName = yield* findApplicationByName(name);
+
+        if (existingByName) {
+          yield* Effect.logInfo(
+            `Cloudflare Container create: adopting existing application ${name}`,
+          );
+          return yield* upsertApplication({
+            id,
+            news,
+            existing: toAttributes(existingByName),
+            durableObjects,
+            session,
+          });
+        }
+
+        yield* Effect.logInfo(
+          `Cloudflare Container create: creating application ${name}`,
+        );
+        yield* session.note(`Creating container application ${name}...`);
+        const adoptExistingByName = Effect.gen(function* () {
+          yield* Effect.logInfo(
+            `Cloudflare Container create: application ${name} already exists, adopting`,
+          );
+          const existing = yield* findApplicationByName(name);
+          if (!existing) {
+            return yield* Effect.fail(
+              new Error(
+                `Container application "${name}" already exists but could not be found for adoption.`,
+              ),
+            );
+          }
+          return yield* upsertApplication({
+            id,
+            news,
+            existing: toAttributes(existing),
+            durableObjects,
+            session,
+          });
+        });
+
+        const application = yield* Containers.createContainerApplication({
+          accountId,
+          name,
+          instances: news.instances ?? 1,
+          maxInstances: news.maxInstances ?? 1,
+          schedulingPolicy: news.schedulingPolicy ?? "default",
+          constraints: news.constraints ?? {},
+          affinities: news.affinities,
+          configuration,
+          durableObjects,
+        }).pipe(
+          Effect.catchTag("DurableObjectAlreadyHasApplication", () =>
+            durableObjects
+              ? Effect.gen(function* () {
+                  const existing = yield* findApplicationByNamespace(
+                    durableObjects.namespaceId,
+                  );
+                  const recovery = resolveDurableObjectApplicationRecovery({
+                    namespaceId: durableObjects.namespaceId,
+                    expectedName: name,
+                    existingName: existing?.name,
+                  });
+                  if (!recovery.canAdopt) {
+                    return yield* Effect.fail(new Error(recovery.message));
+                  }
+                  if (!existing) {
+                    return yield* Effect.fail(
+                      new Error(
+                        `Container application for Durable Object namespace "${durableObjects.namespaceId}" already exists but could not be found for adoption.`,
+                      ),
+                    );
+                  }
+                  return yield* upsertApplication({
+                    id,
+                    news,
+                    existing: toAttributes(existing),
+                    durableObjects,
+                    session,
+                  });
+                })
+              : Effect.fail(
+                  new Error(
+                    "Durable Object namespace already has a container application. Set AdoptPolicy to adopt it.",
+                  ),
+                ),
+          ),
+          Effect.catchIf(
+            (e) =>
+              "message" in (e as any) &&
+              String((e as any).message).includes("already exists"),
+            () => adoptExistingByName,
+          ),
+          Effect.tapError((error) =>
+            Effect.logError(
+              `Cloudflare Container create error: ${describeError(error)}`,
+            ),
+          ),
+        );
+
+        return "applicationId" in application
+          ? application
+          : toAttributes(application);
+      });
+
+      const upsertApplication = Effect.fn(function* ({
+        id,
+        news,
+        existing,
+        durableObjects,
+        session,
+      }: {
+        id: string;
+        news: ContainerApplicationProps;
+        existing: ContainerApplication["Attributes"];
+        // The DO attachment to (re)create with if the "existing" application
+        // turns out to be gone. Threaded through so the update→create fallback
+        // below preserves the binding.
+        durableObjects: { namespaceId: string } | undefined;
+        session: { note: (message: string) => Effect.Effect<void> };
+      }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+
+        yield* Effect.logInfo(
+          `Cloudflare Container update: preparing ${existing.applicationName}`,
+        );
+        const { build, imageRef, imageHash } = yield* computeImage(id, news);
+        const configuration = desiredConfiguration(news, imageRef, accountId);
+
+        if (imageHash !== existing.hash?.image) {
+          yield* buildAndPushImage(id, news, build, imageRef, session);
+        }
+
+        yield* session.note(
+          `Updating container application ${existing.applicationName}...`,
+        );
+        const application = yield* retryForContainerApplicationReadiness(
+          "update",
+          existing.applicationId,
+          Containers.updateContainerApplication({
+            accountId,
+            applicationId: existing.applicationId,
+            instances: news.instances ?? 1,
+            maxInstances: news.maxInstances ?? 1,
+            schedulingPolicy: news.schedulingPolicy ?? "default",
+            constraints: news.constraints ?? {},
+            affinities: news.affinities,
+            configuration,
+          }),
+        ).pipe(
+          // The "existing" application was observed from an eventually-
+          // consistent list/get but is actually gone — e.g. a stale row that
+          // lingered after a replacement/DO-recreate delete, surfaced by
+          // either the by-name or by-namespace lookup. Updating a ghost
+          // exhausts the readiness window and then fails permanently with
+          // `ContainerApplicationNotFound`. Instead, create it fresh so
+          // reconcile converges regardless of the stale observation. By the
+          // time the bounded readiness retry has elapsed, the deleted row has
+          // fallen out of the eventually-consistent views, so this create
+          // does not re-collide.
+          Effect.catchTag("ContainerApplicationNotFound", () =>
+            Effect.gen(function* () {
+              yield* Effect.logInfo(
+                `Cloudflare Container update: ${existing.applicationName} no longer exists, creating fresh`,
+              );
+              return yield* Containers.createContainerApplication({
+                accountId,
+                name: existing.applicationName,
+                instances: news.instances ?? 1,
+                maxInstances: news.maxInstances ?? 1,
+                schedulingPolicy: news.schedulingPolicy ?? "default",
+                constraints: news.constraints ?? {},
+                affinities: news.affinities,
+                configuration,
+                durableObjects,
+              });
+            }),
+          ),
+        );
+        const updated = toAttributes(application);
+        if (!deepEqual(existing.configuration, configuration)) {
+          yield* Effect.logInfo(
+            `Cloudflare Container update: creating rollout for ${updated.applicationName}`,
+          );
+          yield* maybeCreateRollout({
+            applicationId: updated.applicationId,
+            configuration,
+            rollout: news.rollout,
+          });
+        }
+        return { ...updated, configuration, hash: { image: imageHash } };
+      });
+
+      const getDurableObjects = (
+        bindings: ResourceBinding<ContainerApplication["Binding"]>[],
+      ) => {
+        const dos = bindings.flatMap((b) =>
+          b.data.durableObjects ? [b.data.durableObjects] : [],
+        );
+        // A single DO namespace may appear in multiple bindings (e.g. when
+        // a Container is referenced by several resources). Dedupe by namespaceId.
+        const uniqueDos = dos.filter(
+          (d, i, arr) =>
+            arr.findIndex((other) => other.namespaceId === d.namespaceId) === i,
+        );
+        if (uniqueDos.length === 0) {
+          return Effect.succeed(undefined);
+        }
+        if (uniqueDos.length === 1) {
+          return Effect.succeed(uniqueDos[0]);
+        }
+        return Effect.die(
+          new Error(
+            `A Container can only be bound to one Durable Object namespace. Found ${uniqueDos.length} unique namespaces in bindings: ${uniqueDos.map((d) => d.namespaceId).join(", ")}`,
+          ),
+        );
+      };
+
+      return ContainerPlatform.Provider.of({
+        stables: ["accountId", "applicationId"],
+        diff: Effect.fn(function* ({
+          id,
+          olds = {},
+          news = {},
+          output,
+          newBindings,
+          oldBindings,
+        }) {
+          if (!isResolved(news) || !isResolved(newBindings)) {
+            return undefined;
+          }
+          const { accountId } = yield* yield* CloudflareEnvironment;
+
+          const name = yield* createApplicationName(id, news.name);
+          const oldName = output?.applicationName
+            ? output.applicationName
+            : yield* createApplicationName(id, olds.name);
+
+          if (
+            (output?.accountId ?? accountId) !== accountId ||
+            name !== oldName
+          ) {
+            return { action: "replace" } as const;
+          }
+
+          const hasDurableObjects =
+            (yield* getDurableObjects(newBindings)) !== undefined;
+          const hadDurableObjects =
+            (yield* getDurableObjects(oldBindings)) !== undefined;
+          if (hasDurableObjects !== hadDurableObjects) {
+            return { action: "replace" } as const;
+          }
+
+          if (!output) {
+            return undefined;
+          }
+
+          // A `dev:` applicationId means the resource only exists locally and
+          // the real application has never been created. Promote it by forcing
+          // an update so reconcile creates the live application.
+          if (!isLiveId(output.applicationId)) {
+            // Override stables to only include the accountId because the applicationId is going to change.
+            return { action: "update", stables: ["accountId"] } as const;
+          }
+
+          const { imageHash } = yield* computeImage(id, news);
+          if (imageHash !== output.hash?.image) {
+            return { action: "update" } as const;
+          }
+        }),
+        precreate: Effect.fn(function* ({ id, news = {}, session }) {
+          const name = yield* createApplicationName(id, news.name);
+          yield* Effect.logInfo(
+            `Cloudflare Container precreate: starting ${name}`,
+          );
+
+          const { accountId } = yield* yield* CloudflareEnvironment;
+          const { build, imageRef, imageHash } = yield* computeImage(id, news);
+          const configuration = desiredConfiguration(news, imageRef, accountId);
+          yield* buildAndPushImage(id, news, build, imageRef, session);
+
+          // Precreate intentionally omits the Durable Object attachment so the
+          // worker can bind to this application id and break the circular
+          // dependency. The final create step recreates the application with the
+          // resolved namespace when needed.
+          const result = yield* createApplication({
+            id,
+            news,
+            name,
+            configuration,
+            durableObjects: undefined,
+            session: {
+              ...session,
+              note: (message) =>
+                session.note(message.replace("Creating", "Pre-creating")),
+            },
+          });
+          return {
+            ...("applicationId" in result ? result : toAttributes(result)),
+            hash: { image: imageHash },
+          };
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          news = {},
+          bindings,
+          output,
+          session,
+        }) {
+          const name = yield* createApplicationName(id, news.name);
+          yield* Effect.logInfo(
+            `Cloudflare Container reconcile: starting ${name}`,
+          );
+          const durableObjects = yield* getDurableObjects(bindings);
+          const { accountId } = yield* yield* CloudflareEnvironment;
+          const { build, imageRef, imageHash } = yield* computeImage(id, news);
+          const configuration = desiredConfiguration(news, imageRef, accountId);
+
+          // Observe — re-fetch the cached application to confirm it still
+          // exists. Cloudflare reports a deleted container application as
+          // `ContainerApplicationNotFound`; we fall back to a name lookup
+          // so we can recover from out-of-band deletes or partial state
+          // persistence failures.
+          let existing: ContainerApplication["Attributes"] | undefined;
+          // A `dev:` applicationId never exists on Cloudflare — skip the
+          // cached-id fetch and fall through to the name lookup / create path
+          // so we promote the local resource to a real application.
+          if (output?.applicationId && isLiveId(output.applicationId)) {
+            existing = yield* Containers.getContainerApplication({
+              accountId: output.accountId,
+              applicationId: output.applicationId,
+            }).pipe(
+              Effect.map((app) => ({
+                ...toAttributes(app),
+                hash: output.hash,
+              })),
+              Effect.catchTag("ContainerApplicationNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          }
+          if (!existing) {
+            const found = yield* findApplicationByName(name);
+            if (found) {
+              existing = {
+                ...toAttributes(found),
+                hash: output?.hash,
+              };
+            }
+          }
+
+          // Special case: precreate produced an application without the
+          // durable object attachment, but the real reconcile now has one
+          // (or vice versa). The DO attachment is immutable, so we delete
+          // and recreate. Adoption-by-namespace is preferred when an app
+          // already owns the namespace.
+          if (existing && !deepEqual(existing.durableObjects, durableObjects)) {
+            if (durableObjects) {
+              const owner = yield* findApplicationByNamespace(
+                durableObjects.namespaceId,
+              );
+              const recovery = resolveDurableObjectApplicationRecovery({
+                namespaceId: durableObjects.namespaceId,
+                expectedName: name,
+                existingName: owner?.name,
+              });
+              if (recovery.canAdopt) {
+                if (!owner) {
+                  return yield* Effect.fail(
+                    new Error(
+                      `Container application for Durable Object namespace "${durableObjects.namespaceId}" already exists but could not be found for adoption.`,
+                    ),
+                  );
+                }
+                return yield* upsertApplication({
+                  id,
+                  news,
+                  existing: toAttributes(owner),
+                  durableObjects,
+                  session,
+                });
+              }
+            }
+            yield* Effect.logInfo(
+              `Cloudflare Container reconcile: recreating ${name} to attach durable object binding`,
+            );
+            yield* session.note(
+              `Recreating container application ${name} with durable object binding...`,
+            );
+            yield* Containers.deleteContainerApplication({
+              accountId: existing.accountId,
+              applicationId: existing.applicationId,
+            }).pipe(
+              Effect.catchTag(
+                "ContainerApplicationNotFound",
+                () => Effect.void,
+              ),
+            );
+            // Wait out the eventually-consistent `list` so the recreate below
+            // doesn't re-adopt the just-deleted application and then try to
+            // update a now-gone id (see `waitForApplicationDeleted`).
+            yield* waitForApplicationDeleted(name, existing.applicationId);
+            if (imageHash !== existing.hash?.image) {
+              yield* buildAndPushImage(id, news, build, imageRef, session);
+            }
+            const result = yield* createApplication({
+              id,
+              news,
+              name,
+              configuration,
+              durableObjects,
+              session,
+            });
+            return {
+              ...("applicationId" in result ? result : toAttributes(result)),
+              hash: { image: imageHash },
+            };
+          }
+
+          // Sync — application exists with correct DO attachment. Apply
+          // the desired configuration (image + scheduling + secrets, etc.)
+          // through the upsert path, which builds and pushes the image
+          // only when the hash changed and creates a rollout if the
+          // configuration drifted.
+          if (existing) {
+            return yield* upsertApplication({
+              id,
+              news,
+              existing,
+              durableObjects,
+              session,
+            });
+          }
+
+          // Ensure — no application exists. Build and push the image,
+          // then create. `createApplication` itself tolerates concurrent
+          // creates by adopting an existing application with the same
+          // name or namespace.
+          yield* buildAndPushImage(id, news, build, imageRef, session);
+          const result = yield* createApplication({
+            id,
+            news,
+            name,
+            configuration,
+            durableObjects,
+            session,
+          });
+          return {
+            ...("applicationId" in result ? result : toAttributes(result)),
+            hash: { image: imageHash },
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          // A `dev:` applicationId only exists locally — there is no live
+          // application to delete on Cloudflare.
+          if (!isLiveId(output.applicationId)) return;
+          yield* Effect.logInfo(
+            `Cloudflare Container delete: deleting ${output.applicationName}`,
+          );
+          yield* Containers.deleteContainerApplication({
+            accountId: output.accountId,
+            applicationId: output.applicationId,
+          }).pipe(
+            Effect.catchTag("ContainerApplicationNotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const readByName = (name: string) =>
+            Effect.gen(function* () {
+              yield* Effect.logInfo(
+                `Cloudflare Container read: looking up ${name}`,
+              );
+              const existing = yield* findApplicationByName(name);
+              if (!existing) {
+                yield* Effect.logInfo(
+                  `Cloudflare Container read: ${name} not found`,
+                );
+                return undefined;
+              }
+              return {
+                ...toAttributes(existing),
+                hash: output?.hash,
+              };
+            });
+
+          let attrs: ContainerApplication["Attributes"] | undefined;
+          // A `dev:` applicationId never exists on Cloudflare — look the
+          // application up by its (deterministic) name instead of hitting the
+          // API with a fake id.
+          if (output?.applicationId && !isLiveId(output.applicationId)) {
+            return yield* readByName(output.applicationName);
+          }
+          if (output?.applicationId) {
+            yield* Effect.logInfo(
+              `Cloudflare Container read: checking ${output.applicationName}`,
+            );
+            attrs = yield* Containers.getContainerApplication({
+              accountId: output.accountId,
+              applicationId: output.applicationId,
+            }).pipe(
+              Effect.map((app) => ({
+                ...toAttributes(app),
+                hash: output.hash,
+              })),
+              Effect.catchTag("ContainerApplicationNotFound", () =>
+                readByName(output.applicationName),
+              ),
+            );
+            // If we matched by id from prior state, treat as owned.
+            return attrs;
+          }
+
+          const name = yield* createApplicationName(id, olds?.name);
+          attrs = yield* readByName(name);
+          if (!attrs) return undefined;
+          // Cloudflare container applications carry no ownership signal that
+          // we can read back from the API, so a name match is not proof of
+          // ownership. Brand it `Unowned` so the engine surfaces
+          // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
+          return Unowned(attrs);
+        }),
+        list: () =>
+          Effect.gen(function* () {
+            const { accountId } = yield* yield* CloudflareEnvironment;
+            // Account-scoped collection. `listContainerApplications` returns
+            // the full application objects in one (non-paginated) response, so
+            // each item already carries the complete `read` attributes shape —
+            // no per-item hydration is required.
+            return yield* Containers.listContainerApplications({
+              accountId,
+            }).pipe(
+              Effect.map((apps) => apps.map((app) => toAttributes(app))),
+              // Accounts without the containers product reject the route; treat
+              // a non-entitled account as an empty collection rather than an
+              // error.
+              Effect.catchTag("InvalidRoute", () => Effect.succeed([])),
+            );
+          }),
+        tail: ({ output }) =>
+          telemetry.tailStream({
+            accountId: output.accountId,
+            filters: containerFilters(output.applicationId),
+          }),
+        logs: ({ output, options }) =>
+          telemetry.queryLogs({
+            accountId: output.accountId,
+            filters: containerFilters(output.applicationId),
+            options,
+          }),
+      });
+    }),
+  );
+
+const containerFilters = (applicationId: string): TelemetryFilter[] => [
+  {
+    key: "$metadata.type",
+    operation: "eq",
+    type: "string",
+    value: "cf-container",
+  },
+  {
+    key: "$metadata.service",
+    operation: "eq",
+    type: "string",
+    value: applicationId,
+  },
+];
+
+const resolveDurableObjectApplicationRecovery = ({
+  namespaceId,
+  expectedName,
+  existingName,
+}: {
+  namespaceId: string;
+  expectedName: string;
+  existingName: string | undefined;
+}) => {
+  if (!existingName) {
+    return {
+      canAdopt: false as const,
+      message: `Container application for Durable Object namespace "${namespaceId}" already exists but could not be found for adoption.`,
+    };
+  }
+  if (existingName !== expectedName) {
+    return {
+      canAdopt: false as const,
+      message: `Existing container application "${existingName}" is already attached to Durable Object namespace "${namespaceId}". Use that application name to adopt it.`,
+    };
+  }
+  return {
+    canAdopt: true as const,
+  };
+};
+
+// Cap each delay at 3s so the readiness window is ~30s over 10 attempts; an
+// uncapped `Schedule.exponential(150)` reaches a ~76s single delay by the 10th
+// retry (~150s total), which both blows test budgets and needlessly stalls the
+// update→create fallback when the target is genuinely gone.
+const containerApplicationReadinessSchedule = Schedule.exponential(150).pipe(
+  Schedule.either(Schedule.spaced("3 seconds")),
+  Schedule.both(Schedule.recurs(10)),
+);
+
+const isContainerApplicationNotFound = (
+  error: unknown,
+): error is Containers.ContainerApplicationNotFound =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  error._tag === "ContainerApplicationNotFound";
+
+export const retryForContainerApplicationReadiness = <A, E, R>(
+  operation: string,
+  applicationId: string,
+  effect: Effect.Effect<A, E, R>,
+) =>
+  effect.pipe(
+    Effect.tapError((error) =>
+      isContainerApplicationNotFound(error)
+        ? Effect.logDebug(
+            `Cloudflare Container ${operation}: application ${applicationId} not found yet, retrying`,
+          )
+        : Effect.void,
+    ),
+    Effect.retry({
+      while: isContainerApplicationNotFound,
+      schedule: containerApplicationReadinessSchedule,
+    }),
+  );
+
+const toAttributes = (
+  application:
+    | Containers.CreateContainerApplicationResponse
+    | Containers.UpdateContainerApplicationResponse
+    | Containers.GetContainerApplicationResponse
+    | Containers.ListContainerApplicationsResponse[number],
+): ContainerApplication["Attributes"] => ({
+  applicationId: application.id,
+  applicationName: application.name,
+  accountId: application.accountId,
+  schedulingPolicy: application.schedulingPolicy,
+  instances: application.instances,
+  maxInstances: application.maxInstances,
+  constraints: normalizeNulls(
+    application.constraints as ContainerApplication.Constraints | undefined,
+  ),
+  affinities: normalizeNulls(
+    application.affinities as ContainerApplication.Affinities | undefined,
+  ),
+  configuration: normalizeNulls(
+    application.configuration as ContainerApplication.Configuration,
+  ),
+  durableObjects: normalizeNulls(application.durableObjects) as
+    | { namespaceId: string }
+    | undefined,
+  createdAt: application.createdAt,
+  version: application.version,
+  dev: undefined,
+});