alchemy 2.0.0-beta.60 → 2.0.0-beta.61

package/lib/Cloudflare/Workers/WorkerProvider.js

@@ -17,14 +17,16 @@ import * as ProviderLayer from "../../Local/ProviderLayer.js";
 import * as Provider from "../../Provider.js";
 import {} from "../../Resource.js";
 import { Stack } from "../../Stack.js";
+import { sha256Object } from "../../Util/sha256.js";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
 import { CloudflareLogs } from "../Logs.js";
+import { listAllZones, resolveZoneId } from "../Zone/lookup.js";
 import { readAssets, uploadAssets } from "./Assets.js";
 import { getCompatibility } from "./Compatibility.js";
 import { isDurableObjectExport } from "./DurableObject.js";
 import { LocalWorkerProvider } from "./LocalWorkerProvider.js";
 import { Worker } from "./Worker.js";
-import { getCronBindings } from "./WorkerAsyncBindings.js";
+import { getCacheBinding, getCronBindings } from "./WorkerAsyncBindings.js";
 import { readPrebuiltWorkerBundle, WorkerBundle } from "./WorkerBundle.js";
 import { isWorkerLoader } from "./WorkerLoader.js";
 import { createWorkerName } from "./WorkerName.js";
@@ -79,28 +81,66 @@ Effect.gen(function* () {
         scriptName,
     });
 });
+/**
+ * Deploy-time binding validation rejects an upload whose bindings
+ * reference a resource Cloudflare can't see (each resource type has
+ * its own typed not-found error, verified against the live API).
+ * Every bound resource is provisioned before the Worker deploys —
+ * dependency order for KV/R2/D1/queues/etc., a pre-created stub
+ * (which exports the Durable Object classes) for circular
+ * Worker↔Worker references — so a not-found here is either
+ * propagation lag on a just-created resource (a Secrets Store secret
+ * still `pending`, a stub script not yet in the registry) that
+ * retrying converges, or a genuine misconfiguration that keeps
+ * failing and surfaces as the typed error once the bounded budget is
+ * exhausted.
+ */
+const isBindingTargetNotFound = (e) => e._tag === "SecretsStoreBindingNotFound" ||
+    e._tag === "KVNamespaceNotFound" ||
+    e._tag === "R2BucketNotFound" ||
+    e._tag === "D1DatabaseNotFound" ||
+    e._tag === "QueueNotFound" ||
+    e._tag === "ServiceBindingNotFound" ||
+    e._tag === "DurableObjectClassNotFound" ||
+    e._tag === "HyperdriveConfigNotFound" ||
+    e._tag === "VectorizeIndexNotFound" ||
+    e._tag === "DispatchNamespaceNotFound" ||
+    e._tag === "MtlsCertificateNotFound";
+const bindingTargetNotFoundRetrySchedule = () => Schedule.fixed("2 seconds").pipe(Schedule.both(Schedule.recurs(10)));
 /**
  * Upsert a Worker script, routing to the dispatch-namespace endpoint when
- * `dispatchNamespace` is set. The metadata/files contract is identical.
+ * `dispatchNamespace` is set. The metadata/files contract is identical, and
+ * both endpoints run the same binding validation (see
+ * {@link isBindingTargetNotFound}), so both get the same bounded retry.
  *
  * @internal
  */
 const putWorkerScript = (params) => Effect.gen(function* () {
     if (params.dispatchNamespace) {
-        return yield* wfp.putDispatchNamespaceScript({
+        return yield* wfp
+            .putDispatchNamespaceScript({
             accountId: params.accountId,
             dispatchNamespace: params.dispatchNamespace,
             scriptName: params.scriptName,
             metadata: params.metadata,
             files: params.files,
-        });
+        })
+            .pipe(Effect.retry({
+            while: isBindingTargetNotFound,
+            schedule: bindingTargetNotFoundRetrySchedule(),
+        }));
     }
-    return yield* workers.putScript({
+    return yield* workers
+        .putScript({
         accountId: params.accountId,
         scriptName: params.scriptName,
         metadata: params.metadata,
         files: params.files,
-    });
+    })
+        .pipe(Effect.retry({
+        while: isBindingTargetNotFound,
+        schedule: bindingTargetNotFoundRetrySchedule(),
+    }));
 });
 /**
  * Delete a Worker script, routing to the dispatch-namespace endpoint when
@@ -137,6 +177,95 @@ export const normalizeStateDomains = (domains) => (domains ?? []).flatMap((u) =>
     const hostname = u?.hostname;
     return typeof hostname === "string" ? [`https://${hostname}`] : [];
 });
+/**
+ * Deeply materialize an arbitrary value into a JSON-stable shape for hashing:
+ * unwrap `Redacted` secrets by value, ISO-stringify `Date`s, keep plain
+ * objects/arrays/primitives, and drop Effects, functions, `undefined`, and
+ * class instances (which don't round-trip through `JSON.stringify`). Redacted
+ * values contribute by value, not by reference identity, so two
+ * independently-constructed secrets with the same contents hash identically.
+ *
+ * Effects are dropped, never executed: resource-typed `env` entries (Worker
+ * effect-classes, R2 buckets, Provider/Context tags, ...) are all Effects
+ * whose evaluation requires plan-phase context that is not available inside
+ * lifecycle operations (running one here fails with `Service not found:
+ * Cloudflare.Worker`). Their deploy-time identity is already captured by the
+ * resolved `bindings` data hashed alongside `env`, so skipping them loses no
+ * change-detection.
+ */
+const resolveMetadataHashValue = (value) => Effect.gen(function* () {
+    if (Effect.isEffect(value)) {
+        return undefined;
+    }
+    const resolved = Redacted.isRedacted(value) ? Redacted.value(value) : value;
+    if (resolved === null ||
+        Predicate.isString(resolved) ||
+        Predicate.isNumber(resolved) ||
+        Predicate.isBoolean(resolved)) {
+        return resolved;
+    }
+    if (resolved === undefined || Predicate.isFunction(resolved)) {
+        return undefined;
+    }
+    if (Predicate.isDate(resolved)) {
+        return resolved.toISOString();
+    }
+    if (Array.isArray(resolved)) {
+        return yield* Effect.all(resolved.map((item) => resolveMetadataHashValue(item)), { concurrency: "unbounded" });
+    }
+    if (Predicate.isObject(resolved)) {
+        // Only plain objects round-trip predictably. A class instance would
+        // serialize to `{}` (or throw), so drop it rather than hash a lie.
+        const prototype = Object.getPrototypeOf(resolved);
+        if (prototype !== Object.prototype && prototype !== null) {
+            return undefined;
+        }
+        const entries = yield* Effect.all(Object.entries(resolved).map(([key, nested]) => resolveMetadataHashValue(nested).pipe(Effect.map((materializedNested) => [key, materializedNested]))), { concurrency: "unbounded" });
+        return Object.fromEntries(entries.filter(([, nested]) => nested !== undefined));
+    }
+    return undefined;
+});
+// The asset router config the resource declares (htmlHandling,
+// notFoundHandling, ...), minus the local `directory` path (machine-specific,
+// would break hash stability across machines) and the precomputed `hash`
+// (already compared via `output.hash.assets`). A bare string `assets` is just
+// a directory path, so it contributes nothing here.
+const workerAssetConfigForHash = (assets) => {
+    if (!assets || typeof assets === "string") {
+        return undefined;
+    }
+    const { directory: _directory, ...config } = assets;
+    if (Predicate.hasProperty(config, "hash")) {
+        const { hash: _hash, ...configWithoutHash } = config;
+        return configWithoutHash;
+    }
+    return config;
+};
+/**
+ * Hash a Worker's deploy-time metadata surface so metadata-only edits are
+ * detected by the diff (#745). Previously the update decision compared only
+ * the bundle/vite/asset-content hashes, so a change to e.g. a compatibility
+ * flag or observability config planned as a noop and silently never deployed.
+ */
+const resolveWorkerMetadataHash = ({ props, bindings, accountId, stack, }) => resolveMetadataHashValue({
+    accountId,
+    stack: { name: stack.name, stage: stack.stage },
+    compatibility: getCompatibility(props),
+    env: props.env,
+    bindings: bindings.map((binding) => ({
+        sid: binding.sid,
+        data: binding.data,
+    })),
+    assets: workerAssetConfigForHash(props.assets),
+    cache: props.cache,
+    limits: props.limits,
+    logpush: props.logpush,
+    observability: props.observability,
+    placement: props.placement,
+    subdomain: props.subdomain,
+    tags: props.tags,
+    url: props.url,
+}).pipe(Effect.flatMap((metadata) => sha256Object({ metadata })));
 export const WorkerProvider = () => ProviderLayer.select({
     live: () => LiveWorkerProvider(),
     local: () => LocalWorkerProvider(),
@@ -342,6 +471,143 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
         });
         return applied;
     });
+    const routeKey = (route) => `${route.zoneId}:${route.pattern}`;
+    // Derive a concrete hostname inside the zone from a route pattern so
+    // zone inference can walk the DNS label hierarchy. A wildcard label
+    // (`*.example.com/*`) is replaced with a stand-in label — only the
+    // parent labels matter for finding the zone.
+    const hostnameFromPattern = (pattern) => {
+        const hostPart = pattern.split("/")[0] ?? pattern;
+        return hostPart.startsWith("*.")
+            ? `routes.${hostPart.slice(2)}`
+            : hostPart;
+    };
+    // Resolve each route's zone to a concrete zone id: an explicit
+    // `zoneId` wins, then `zone` / `zoneName` via `resolveZoneId`, and
+    // finally inference from the pattern's hostname. Duplicate
+    // `(zoneId, pattern)` pairs are dropped — Cloudflare enforces one
+    // route per pattern per zone.
+    const normalizeRoutes = (routes) => Effect.gen(function* () {
+        if (!routes?.length)
+            return [];
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const zoneCache = new Map();
+        const normalized = [];
+        const seen = new Set();
+        for (const route of routes) {
+            const pattern = route.pattern.trim();
+            const zoneId = route.zoneId
+                ? route.zoneId
+                : route.zone || route.zoneName
+                    ? yield* resolveZoneId({
+                        accountId,
+                        zone: route.zone ?? route.zoneName,
+                        hostname: hostnameFromPattern(pattern),
+                    })
+                    : yield* inferZoneIdForHostname(hostnameFromPattern(pattern), zoneCache);
+            const key = routeKey({ pattern, zoneId });
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            normalized.push({ pattern, zoneId });
+        }
+        return normalized;
+    });
+    // List the routes attached to `scriptName` across the given zones.
+    // Routes without an id/pattern or owned by another script are
+    // ignored. Zones the token can't read are skipped rather than
+    // failing the whole listing.
+    const listWorkerRoutesInZones = (scriptName, zoneIds) => {
+        const uniqueZoneIds = Array.from(new Set(zoneIds));
+        if (uniqueZoneIds.length === 0) {
+            return Effect.succeed([]);
+        }
+        const routesByZone = Effect.all(uniqueZoneIds.map((zoneId) => workers.listRoutes({ zoneId }).pipe(Effect.map((response) => (response.result ?? []).flatMap((route) => route.id && route.pattern && route.script === scriptName
+            ? [{ id: route.id, pattern: route.pattern, zoneId }]
+            : [])), Effect.catch(() => Effect.succeed([])))), { concurrency: "unbounded" });
+        return Effect.map(routesByZone, (routes) => routes.flat());
+    };
+    // Observe every route attached to `scriptName` account-wide. Routes
+    // are zone-scoped with no account-level enumeration API, so fan out
+    // over all of the account's zones. Any failure to enumerate zones
+    // (e.g. a token without zone read scope) degrades to "no routes"
+    // rather than failing the read.
+    const readWorkerRoutes = (scriptName) => Effect.gen(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const accountZones = yield* listAllZones(accountId).pipe(Effect.catch(() => Effect.succeed([])));
+        return yield* listWorkerRoutesInZones(scriptName, accountZones.map((zone) => zone.id));
+    });
+    // Converge the zone routes attached to `scriptName` to `desired`.
+    // Observed cloud state (not `previous`) is the diff baseline —
+    // `previous` only contributes zone ids so routes moved out of a zone
+    // are still cleaned up after state loss or an interrupted apply.
+    const reconcileRoutes = (scriptName, desired, previous) => Effect.gen(function* () {
+        const zoneIds = Array.from(new Set([
+            ...desired.map((route) => route.zoneId),
+            ...previous.map((route) => route.zoneId),
+        ]));
+        const liveAll = yield* listWorkerRoutesInZones(scriptName, zoneIds);
+        const desiredKeys = new Set(desired.map(routeKey));
+        const liveByKey = new Map(liveAll.map((route) => [routeKey(route), route]));
+        const toRemove = liveAll.filter((route) => !desiredKeys.has(routeKey(route)));
+        yield* Effect.all(toRemove.map((route) => workers
+            .deleteRoute({ zoneId: route.zoneId, routeId: route.id })
+            .pipe(Effect.catchTag("RouteNotFound", () => Effect.void))), { concurrency: "unbounded" });
+        if (desired.length === 0)
+            return [];
+        const attachRoute = Effect.fn(function* (route) {
+            const existing = liveByKey.get(routeKey(route));
+            if (existing)
+                return existing;
+            const zoneRoutes = yield* workers
+                .listRoutes({ zoneId: route.zoneId })
+                .pipe(Effect.map((response) => response.result ?? []), Effect.catch(() => Effect.succeed([])));
+            const otherOwner = zoneRoutes.find((candidate) => candidate.pattern === route.pattern &&
+                candidate.script &&
+                candidate.script !== scriptName);
+            if (otherOwner) {
+                return yield* Effect.die(new Error(`Cannot attach route '${route.pattern}' to Worker '${scriptName}': ` +
+                    `it is already attached to Worker '${otherOwner.script}'. ` +
+                    `Remove it from that Worker first, or pick a different pattern.`));
+            }
+            // A duplicate-pattern failure means another actor (or a crashed
+            // previous reconcile) created the route between our observation
+            // and now — re-list and converge if it points at this script.
+            const created = yield* workers
+                .createRoute({
+                zoneId: route.zoneId,
+                pattern: route.pattern,
+                script: scriptName,
+            })
+                .pipe(
+            // Same eventual-consistency window as `putDomain`: creating
+            // a route right after `putScript` can race Cloudflare's
+            // script registry, which rejects with code 10019 ("Cannot
+            // configure a route for a Worker which does not exist") —
+            // typed as `RouteScriptNotFound` via the createRoute patch.
+            Effect.retry({
+                while: (error) => error._tag === "RouteScriptNotFound",
+                schedule: Schedule.exponential(200).pipe(Schedule.both(Schedule.recurs(15))),
+            }), Effect.catchTag("InvalidRoute", (originalError) => Effect.gen(function* () {
+                const match = yield* workers
+                    .listRoutes({ zoneId: route.zoneId })
+                    .pipe(Effect.map((response) => (response.result ?? []).find((candidate) => candidate.pattern === route.pattern &&
+                    candidate.script === scriptName)), Effect.catch(() => Effect.succeed(undefined)));
+                if (!match?.id) {
+                    return yield* Effect.fail(originalError);
+                }
+                return { id: match.id, pattern: match.pattern };
+            })));
+            return {
+                id: created.id,
+                pattern: created.pattern,
+                zoneId: route.zoneId,
+            };
+        });
+        return yield* Effect.all(desired.map(attachRoute), {
+            concurrency: "unbounded",
+        });
+    });
     const createAlchemyWorkerTags = (id) => [
         `alchemy:stack:${stack.name}`,
         `alchemy:stage:${stack.stage}`,
@@ -557,9 +823,16 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
         // hash that `readAssets` produces is the manifest-derived
         // hash, which is shaped differently from any upstream
         // build-input hash and will never match it on the next pass.
+        const metadataHash = yield* resolveWorkerMetadataHash({
+            props: news,
+            bindings,
+            accountId,
+            stack: { name: stack.name, stage: stack.stage },
+        });
         const hash = {
             ...preparedHash,
             assets: prebuiltAssets?.hash ?? preparedHash.assets,
+            metadata: metadataHash,
         };
         const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
         const expectedDurableObjectClassNames = getExpectedDurableObjectClassNames(metadataBindings, name);
@@ -781,6 +1054,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
             assets: metadataAssets,
             bindings: metadataBindings,
             bodyPart: undefined,
+            cache: news.cache ?? getCacheBinding(bindings),
             compatibilityDate: compatibility.date,
             compatibilityFlags: compatibility.flags,
             containers: metadataContainers.length > 0 ? metadataContainers : undefined,
@@ -840,7 +1114,8 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
         const { settings, durableObjectNamespaces } = yield* getWorkerSettingsWithDurableObjects(name, expectedDurableObjectClassNames, dispatchNamespace);
         // Workers for Platforms user workers are invoked via dynamic dispatch,
         // never routed directly — they have no workers.dev subdomain, custom
-        // domains, or cron triggers. Skip all of that reconciliation.
+        // domains, zone routes, or cron triggers. Skip all of that
+        // reconciliation.
         if (dispatchNamespace) {
             return {
                 workerId: worker.id ?? name,
@@ -852,6 +1127,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                 durableObjectNamespaces,
                 accountId,
                 domains: [],
+                routes: [],
                 crons: [],
                 hash,
             };
@@ -904,6 +1180,12 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
             ...reconciled.map((d) => `https://${d.hostname}`),
             ...(workersDevUrl ? [workersDevUrl] : []),
         ];
+        const desiredRoutes = yield* normalizeRoutes(news.routes);
+        const previousRoutes = output?.routes ?? [];
+        if (desiredRoutes.length > 0 || previousRoutes.length > 0) {
+            yield* session.note(`Reconciling worker routes (${desiredRoutes.length}) ...`);
+        }
+        const routes = yield* reconcileRoutes(name, desiredRoutes, previousRoutes);
         const crons = yield* reconcileCrons(name, normalizeCrons([...getCronBindings(bindings), ...(news.crons ?? [])]), output?.crons ?? [], session);
         return {
             workerId: worker.id ?? name,
@@ -915,11 +1197,29 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
             durableObjectNamespaces,
             accountId,
             domains,
+            routes,
             crons,
             hash,
         };
     });
-    const hasChanged = Effect.fn(function* (id, props, output) {
+    const hasChanged = Effect.fn(function* (id, props, output, bindings, accountId) {
+        // #745: metadata-only edits (compatibility, observability, placement,
+        // limits, logpush, env literals, bindings, subdomain config, tags)
+        // don't touch the bundle/vite/asset-content hashes below, so compare a
+        // hash of that surface first. Skipped when bindings are still
+        // unresolved: the hash can't be computed deterministically here, and
+        // the eventual apply stores it once bindings resolve.
+        if (bindings) {
+            const metadataHash = yield* resolveWorkerMetadataHash({
+                props,
+                bindings,
+                accountId,
+                stack: { name: stack.name, stage: stack.stage },
+            });
+            if (metadataHash !== output.hash?.metadata) {
+                return true;
+            }
+        }
         if (props.script !== undefined) {
             const scriptHash = yield* hashScript(props.script);
             if (scriptHash !== output.hash?.bundle) {
@@ -1012,6 +1312,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                         tags: script.tags ?? undefined,
                         durableObjectNamespaces: {},
                         domains: [],
+                        routes: [],
                         crons: [],
                     },
                 ]
@@ -1059,6 +1360,12 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
             const oldCrons = [...(output?.crons ?? [])].sort();
             const cronsChanged = newCrons.length !== oldCrons.length ||
                 newCrons.some((cron, index) => cron !== oldCrons[index]);
+            const newRouteKeys = (yield* normalizeRoutes(news.routes))
+                .map(routeKey)
+                .sort();
+            const oldRouteKeys = (output?.routes ?? []).map(routeKey).sort();
+            const routesChanged = newRouteKeys.length !== oldRouteKeys.length ||
+                newRouteKeys.some((key, index) => key !== oldRouteKeys[index]);
             // `url` is `domains[0]`: the first custom domain in user order if
             // any, otherwise the workers.dev URL (derived from the stable
             // worker name + account subdomain). It's stable across this update
@@ -1100,8 +1407,11 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                 newDoClassNames.length === oldDoClassNames.length &&
                 newDoClassNames.every((name, i) => name === oldDoClassNames[i]);
             if (domainsChanged ||
+                routesChanged ||
                 cronsChanged ||
-                (yield* hasChanged(id, news, output))) {
+                (yield* hasChanged(id, news, output, Array.isArray(newBindings)
+                    ? newBindings
+                    : undefined, accountId))) {
                 // `workerId` is always stable across an update; seed it so it
                 // survives now that `diff.stables` overrides `provider.stables`
                 // rather than being merged with it.
@@ -1121,7 +1431,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                 };
             }
         }),
-        precreate: Effect.fn(function* ({ id, news, session }) {
+        precreate: Effect.fn(function* ({ id, news, session, bindings }) {
             const { accountId } = yield* yield* CloudflareEnvironment;
             const name = yield* createWorkerName(id, news.name);
             // A Workers for Platforms user worker can't be pre-created: precreate
@@ -1144,19 +1454,32 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                     durableObjectNamespaces: {},
                     accountId,
                     domains: [],
+                    routes: [],
                     crons: [],
                 };
             }
             const dispatchNamespace = resolveNamespaceName(news.namespace);
             const exportMap = news.exports ?? {};
-            const durableObjects = Object.keys(exportMap)
+            // A worker hosts Durable Object classes from two independent sources:
+            // Effect-native DO *exports* (classes defined in the worker entry) and
+            // DO *bindings* declared in `env` — e.g. a bare `Cloudflare.DurableObject`
+            // that fronts a Container image. The placeholder must declare *every*
+            // hosted class so each namespace is created here. A class that exists
+            // only as a binding (a container-fronted DO) is otherwise absent from
+            // this stub, and a resource caught in a worker<->container dependency
+            // cycle — which resolves `worker.durableObjectNamespaces[className]`
+            // against the precreate stub rather than the final reconcile output —
+            // fails because the namespace id it needs never surfaced.
+            const exportDerived = Object.keys(exportMap)
                 .filter((logicalId) => isDurableObjectExport(exportMap[logicalId]))
-                .map((logicalId) => ({
-                logicalId,
-                className: logicalId,
-            }));
+                .map((logicalId) => ({ logicalId, className: logicalId }));
+            const durableObjects = mergeDurableObjectClasses(exportDerived, getDurableObjectBindings(bindings, name));
             const doClasses = durableObjects.map((binding) => binding.className);
-            const containers = doClasses.map((className) => ({ className }));
+            // Only attach container metadata for classes actually fronted by a
+            // Container binding (mirrors reconcile's `containerClassNames`).
+            // Mapping every DO class to a container would wrongly mark plain DOs
+            // as container-backed in the placeholder.
+            const containers = Array.from(new Set(bindings.flatMap((b) => (b.data.containers ?? []).map((c) => c.className)))).map((className) => ({ className }));
             const alchemyDoTags = durableObjects.map(({ logicalId, className }) => `alchemy:do:${logicalId}:${className}`);
             const tags = Array.from(new Set([
                 ...createAlchemyWorkerTags(id),
@@ -1258,6 +1581,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                 durableObjectNamespaces,
                 accountId,
                 domains: [],
+                routes: [],
                 crons: [],
             };
         }),
@@ -1282,6 +1606,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                     tags: settings.tags ?? undefined,
                     durableObjectNamespaces: getDurableObjects(settings.bindings),
                     domains: [],
+                    routes: [],
                     crons: [],
                 };
                 return hasAlchemyWorkerTags(id, settings.tags ?? [])
@@ -1296,7 +1621,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
             // `WorkerNotFound` if the script doesn't exist, which the
             // surrounding `Effect.catchTag` turns into `undefined` — that's
             // all the existence check we need.
-            const [subdomain, settings, domainsList] = yield* Effect.all([
+            const [subdomain, settings, domainsList, routesList] = yield* Effect.all([
                 workers.getScriptSubdomain({
                     accountId,
                     scriptName: workerName,
@@ -1311,7 +1636,8 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                     service: workerName,
                 })
                     .pipe(Effect.map((r) => r.result ?? [])),
-            ]);
+                readWorkerRoutes(workerName),
+            ], { concurrency: "unbounded" });
             // Preserve the order the user provided in `olds.domain`. The
             // Cloudflare API returns domains in non-deterministic order,
             // which would cause downstream `worker.domains[0]` reads to flip
@@ -1343,6 +1669,7 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                 tags: settings.tags ?? undefined,
                 durableObjectNamespaces: getDurableObjects(settings.bindings),
                 domains,
+                routes: routesList,
                 crons,
             };
             // Centralized ownership decision: the engine routes `read`'s
@@ -1420,6 +1747,17 @@ export const LiveWorkerProvider = () => Provider.effect(Worker, Effect.gen(funct
                     ]
                     : []), { concurrency: "unbounded" });
             }
+            // Routes are zone-scoped; enumerating every zone live is
+            // expensive, so trust the persisted route ids (refreshed by
+            // `read`) and tolerate already-deleted routes.
+            if (output.routes?.length) {
+                yield* Effect.all(output.routes.map((route) => workers
+                    .deleteRoute({
+                    zoneId: route.zoneId,
+                    routeId: route.id,
+                })
+                    .pipe(Effect.catchTag("RouteNotFound", () => Effect.void))), { concurrency: "unbounded" });
+            }
             yield* deleteWorkerScript(output.accountId, output.workerName, undefined).pipe(Effect.catchTag("WorkerNotFound", () => Effect.void));
         }),
         tail: ({ output }) => telemetry.tailScript({
@@ -1470,6 +1808,15 @@ function bumpMigrationTagVersion(oldTag) {
         return "alchemy:v1";
     return `alchemy:v${parseInt(version, 10) + 1}`;
 }
+/**
+ * Merges a worker's export-derived and binding-derived Durable Object class
+ * lists for the precreate placeholder, deduping by class name. The
+ * binding-derived entry wins on a collision so the `alchemy:do:` tag keys off
+ * the same logical id (the binding sid) that `reconcile` writes.
+ */
+function mergeDurableObjectClasses(exportDerived, bindingDerived) {
+    return Array.from(new Map([...exportDerived, ...bindingDerived].map((binding) => [binding.className, binding])).values());
+}
 function getDurableObjectBindings(bindings, workerName) {
     // Resource authors (and the `make`/`yield* Tag`/plan-vs-apply machinery)
     // can register the same DO binding multiple times under the same logical