alchemy 2.0.0-beta.60 → 2.0.0-beta.61

package/src/Cloudflare/Workers/WorkerProvider.ts

@@ -18,14 +18,16 @@ import * as ProviderLayer from "../../Local/ProviderLayer.ts";
 import * as Provider from "../../Provider.ts";
 import { type ResourceBinding } from "../../Resource.ts";
 import { Stack } from "../../Stack.ts";
+import { sha256Object } from "../../Util/sha256.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { CloudflareLogs } from "../Logs.ts";
+import { listAllZones, resolveZoneId } from "../Zone/lookup.ts";
 import { readAssets, uploadAssets } from "./Assets.ts";
 import { getCompatibility } from "./Compatibility.ts";
 import { isDurableObjectExport } from "./DurableObject.ts";
 import { LocalWorkerProvider } from "./LocalWorkerProvider.ts";
-import { Worker, type WorkerProps } from "./Worker.ts";
-import { getCronBindings } from "./WorkerAsyncBindings.ts";
+import { Worker, type WorkerProps, type WorkerRouteConfig } from "./Worker.ts";
+import { getCacheBinding, getCronBindings } from "./WorkerAsyncBindings.ts";
 import type { WorkerBinding, WorkerSettingsBinding } from "./WorkerBinding.ts";
 import { readPrebuiltWorkerBundle, WorkerBundle } from "./WorkerBundle.ts";
 import { isWorkerLoader } from "./WorkerLoader.ts";
@@ -91,9 +93,45 @@ const getScriptSettings = (
     });
   });
 
+/**
+ * Deploy-time binding validation rejects an upload whose bindings
+ * reference a resource Cloudflare can't see (each resource type has
+ * its own typed not-found error, verified against the live API).
+ * Every bound resource is provisioned before the Worker deploys —
+ * dependency order for KV/R2/D1/queues/etc., a pre-created stub
+ * (which exports the Durable Object classes) for circular
+ * Worker↔Worker references — so a not-found here is either
+ * propagation lag on a just-created resource (a Secrets Store secret
+ * still `pending`, a stub script not yet in the registry) that
+ * retrying converges, or a genuine misconfiguration that keeps
+ * failing and surfaces as the typed error once the bounded budget is
+ * exhausted.
+ */
+const isBindingTargetNotFound = (
+  e:
+    | Effect.Error<ReturnType<typeof workers.putScript>>
+    | Effect.Error<ReturnType<typeof wfp.putDispatchNamespaceScript>>,
+): boolean =>
+  e._tag === "SecretsStoreBindingNotFound" ||
+  e._tag === "KVNamespaceNotFound" ||
+  e._tag === "R2BucketNotFound" ||
+  e._tag === "D1DatabaseNotFound" ||
+  e._tag === "QueueNotFound" ||
+  e._tag === "ServiceBindingNotFound" ||
+  e._tag === "DurableObjectClassNotFound" ||
+  e._tag === "HyperdriveConfigNotFound" ||
+  e._tag === "VectorizeIndexNotFound" ||
+  e._tag === "DispatchNamespaceNotFound" ||
+  e._tag === "MtlsCertificateNotFound";
+
+const bindingTargetNotFoundRetrySchedule = () =>
+  Schedule.fixed("2 seconds").pipe(Schedule.both(Schedule.recurs(10)));
+
 /**
  * Upsert a Worker script, routing to the dispatch-namespace endpoint when
- * `dispatchNamespace` is set. The metadata/files contract is identical.
+ * `dispatchNamespace` is set. The metadata/files contract is identical, and
+ * both endpoints run the same binding validation (see
+ * {@link isBindingTargetNotFound}), so both get the same bounded retry.
  *
  * @internal
  */
@@ -106,21 +144,35 @@ const putWorkerScript = (params: {
 }) =>
   Effect.gen(function* () {
     if (params.dispatchNamespace) {
-      return yield* wfp.putDispatchNamespaceScript({
+      return yield* wfp
+        .putDispatchNamespaceScript({
+          accountId: params.accountId,
+          dispatchNamespace: params.dispatchNamespace,
+          scriptName: params.scriptName,
+          metadata:
+            params.metadata as unknown as wfp.PutDispatchNamespaceScriptRequest["metadata"],
+          files: params.files,
+        })
+        .pipe(
+          Effect.retry({
+            while: isBindingTargetNotFound,
+            schedule: bindingTargetNotFoundRetrySchedule(),
+          }),
+        );
+    }
+    return yield* workers
+      .putScript({
         accountId: params.accountId,
-        dispatchNamespace: params.dispatchNamespace,
         scriptName: params.scriptName,
-        metadata:
-          params.metadata as unknown as wfp.PutDispatchNamespaceScriptRequest["metadata"],
+        metadata: params.metadata,
         files: params.files,
-      });
-    }
-    return yield* workers.putScript({
-      accountId: params.accountId,
-      scriptName: params.scriptName,
-      metadata: params.metadata,
-      files: params.files,
-    });
+      })
+      .pipe(
+        Effect.retry({
+          while: isBindingTargetNotFound,
+          schedule: bindingTargetNotFoundRetrySchedule(),
+        }),
+      );
   });
 
 /**
@@ -167,6 +219,146 @@ export const normalizeStateDomains = (
     return typeof hostname === "string" ? [`https://${hostname}`] : [];
   });
 
+type MetadataHashValue =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | readonly MetadataHashValue[]
+  | { readonly [key: string]: MetadataHashValue };
+
+/**
+ * Deeply materialize an arbitrary value into a JSON-stable shape for hashing:
+ * unwrap `Redacted` secrets by value, ISO-stringify `Date`s, keep plain
+ * objects/arrays/primitives, and drop Effects, functions, `undefined`, and
+ * class instances (which don't round-trip through `JSON.stringify`). Redacted
+ * values contribute by value, not by reference identity, so two
+ * independently-constructed secrets with the same contents hash identically.
+ *
+ * Effects are dropped, never executed: resource-typed `env` entries (Worker
+ * effect-classes, R2 buckets, Provider/Context tags, ...) are all Effects
+ * whose evaluation requires plan-phase context that is not available inside
+ * lifecycle operations (running one here fails with `Service not found:
+ * Cloudflare.Worker`). Their deploy-time identity is already captured by the
+ * resolved `bindings` data hashed alongside `env`, so skipping them loses no
+ * change-detection.
+ */
+const resolveMetadataHashValue = (
+  value: unknown,
+): Effect.Effect<MetadataHashValue> =>
+  Effect.gen(function* () {
+    if (Effect.isEffect(value)) {
+      return undefined;
+    }
+    const resolved = Redacted.isRedacted(value) ? Redacted.value(value) : value;
+
+    if (
+      resolved === null ||
+      Predicate.isString(resolved) ||
+      Predicate.isNumber(resolved) ||
+      Predicate.isBoolean(resolved)
+    ) {
+      return resolved;
+    }
+    if (resolved === undefined || Predicate.isFunction(resolved)) {
+      return undefined;
+    }
+    if (Predicate.isDate(resolved)) {
+      return resolved.toISOString();
+    }
+    if (Array.isArray(resolved)) {
+      return yield* Effect.all(
+        resolved.map((item) => resolveMetadataHashValue(item)),
+        { concurrency: "unbounded" },
+      );
+    }
+    if (Predicate.isObject(resolved)) {
+      // Only plain objects round-trip predictably. A class instance would
+      // serialize to `{}` (or throw), so drop it rather than hash a lie.
+      const prototype = Object.getPrototypeOf(resolved);
+      if (prototype !== Object.prototype && prototype !== null) {
+        return undefined;
+      }
+      const entries = yield* Effect.all(
+        Object.entries(resolved).map(([key, nested]) =>
+          resolveMetadataHashValue(nested).pipe(
+            Effect.map(
+              (materializedNested) => [key, materializedNested] as const,
+            ),
+          ),
+        ),
+        { concurrency: "unbounded" },
+      );
+      return Object.fromEntries(
+        entries.filter(([, nested]) => nested !== undefined),
+      );
+    }
+    return undefined;
+  });
+
+/**
+ * The deploy-time metadata surface of a Worker whose changes must trigger an
+ * update but that never touch the bundle/vite/asset-content hashes:
+ * compatibility, env literals, bindings, asset routing config, cache,
+ * limits, logpush, observability, placement, subdomain, and tags. See #745.
+ */
+interface WorkerMetadataHashInput {
+  readonly props: WorkerProps;
+  readonly bindings: readonly ResourceBinding<Worker["Binding"]>[];
+  readonly accountId: string;
+  readonly stack: { readonly name: string; readonly stage: string };
+}
+
+// The asset router config the resource declares (htmlHandling,
+// notFoundHandling, ...), minus the local `directory` path (machine-specific,
+// would break hash stability across machines) and the precomputed `hash`
+// (already compared via `output.hash.assets`). A bare string `assets` is just
+// a directory path, so it contributes nothing here.
+const workerAssetConfigForHash = (assets: WorkerProps["assets"]) => {
+  if (!assets || typeof assets === "string") {
+    return undefined;
+  }
+  const { directory: _directory, ...config } = assets;
+  if (Predicate.hasProperty(config, "hash")) {
+    const { hash: _hash, ...configWithoutHash } = config;
+    return configWithoutHash;
+  }
+  return config;
+};
+
+/**
+ * Hash a Worker's deploy-time metadata surface so metadata-only edits are
+ * detected by the diff (#745). Previously the update decision compared only
+ * the bundle/vite/asset-content hashes, so a change to e.g. a compatibility
+ * flag or observability config planned as a noop and silently never deployed.
+ */
+const resolveWorkerMetadataHash = ({
+  props,
+  bindings,
+  accountId,
+  stack,
+}: WorkerMetadataHashInput): Effect.Effect<string> =>
+  resolveMetadataHashValue({
+    accountId,
+    stack: { name: stack.name, stage: stack.stage },
+    compatibility: getCompatibility(props),
+    env: props.env,
+    bindings: bindings.map((binding) => ({
+      sid: binding.sid,
+      data: binding.data,
+    })),
+    assets: workerAssetConfigForHash(props.assets),
+    cache: props.cache,
+    limits: props.limits,
+    logpush: props.logpush,
+    observability: props.observability,
+    placement: props.placement,
+    subdomain: props.subdomain,
+    tags: props.tags,
+    url: props.url,
+  }).pipe(Effect.flatMap((metadata) => sha256Object({ metadata })));
+
 export const WorkerProvider = () =>
   ProviderLayer.select({
     live: () => LiveWorkerProvider(),
@@ -466,6 +658,226 @@ export const LiveWorkerProvider = () =>
           return applied;
         });
 
+      type NormalizedWorkerRoute = {
+        pattern: string;
+        zoneId: string;
+      };
+
+      const routeKey = (route: { pattern: string; zoneId: string }) =>
+        `${route.zoneId}:${route.pattern}`;
+
+      // Derive a concrete hostname inside the zone from a route pattern so
+      // zone inference can walk the DNS label hierarchy. A wildcard label
+      // (`*.example.com/*`) is replaced with a stand-in label — only the
+      // parent labels matter for finding the zone.
+      const hostnameFromPattern = (pattern: string): string => {
+        const hostPart = pattern.split("/")[0] ?? pattern;
+        return hostPart.startsWith("*.")
+          ? `routes.${hostPart.slice(2)}`
+          : hostPart;
+      };
+
+      // Resolve each route's zone to a concrete zone id: an explicit
+      // `zoneId` wins, then `zone` / `zoneName` via `resolveZoneId`, and
+      // finally inference from the pattern's hostname. Duplicate
+      // `(zoneId, pattern)` pairs are dropped — Cloudflare enforces one
+      // route per pattern per zone.
+      const normalizeRoutes = (routes: WorkerRouteConfig[] | undefined) =>
+        Effect.gen(function* () {
+          if (!routes?.length) return [] as NormalizedWorkerRoute[];
+          const { accountId } = yield* yield* CloudflareEnvironment;
+          const zoneCache = new Map<string, string>();
+          const normalized: NormalizedWorkerRoute[] = [];
+          const seen = new Set<string>();
+          for (const route of routes) {
+            const pattern = route.pattern.trim();
+            const zoneId = route.zoneId
+              ? route.zoneId
+              : route.zone || route.zoneName
+                ? yield* resolveZoneId({
+                    accountId,
+                    zone: route.zone ?? route.zoneName!,
+                    hostname: hostnameFromPattern(pattern),
+                  })
+                : yield* inferZoneIdForHostname(
+                    hostnameFromPattern(pattern),
+                    zoneCache,
+                  );
+            const key = routeKey({ pattern, zoneId });
+            if (seen.has(key)) continue;
+            seen.add(key);
+            normalized.push({ pattern, zoneId });
+          }
+          return normalized;
+        });
+
+      // List the routes attached to `scriptName` across the given zones.
+      // Routes without an id/pattern or owned by another script are
+      // ignored. Zones the token can't read are skipped rather than
+      // failing the whole listing.
+      const listWorkerRoutesInZones = (
+        scriptName: string,
+        zoneIds: readonly string[],
+      ) => {
+        const uniqueZoneIds = Array.from(new Set(zoneIds));
+        if (uniqueZoneIds.length === 0) {
+          return Effect.succeed([] as Worker["Attributes"]["routes"]);
+        }
+
+        const routesByZone = Effect.all(
+          uniqueZoneIds.map((zoneId) =>
+            workers.listRoutes({ zoneId }).pipe(
+              Effect.map((response) =>
+                (response.result ?? []).flatMap((route) =>
+                  route.id && route.pattern && route.script === scriptName
+                    ? [{ id: route.id, pattern: route.pattern, zoneId }]
+                    : [],
+                ),
+              ),
+              Effect.catch(() => Effect.succeed([])),
+            ),
+          ),
+          { concurrency: "unbounded" },
+        );
+
+        return Effect.map(routesByZone, (routes) => routes.flat());
+      };
+
+      // Observe every route attached to `scriptName` account-wide. Routes
+      // are zone-scoped with no account-level enumeration API, so fan out
+      // over all of the account's zones. Any failure to enumerate zones
+      // (e.g. a token without zone read scope) degrades to "no routes"
+      // rather than failing the read.
+      const readWorkerRoutes = (scriptName: string) =>
+        Effect.gen(function* () {
+          const { accountId } = yield* yield* CloudflareEnvironment;
+          const accountZones = yield* listAllZones(accountId).pipe(
+            Effect.catch(() => Effect.succeed([])),
+          );
+          return yield* listWorkerRoutesInZones(
+            scriptName,
+            accountZones.map((zone) => zone.id),
+          );
+        });
+
+      // Converge the zone routes attached to `scriptName` to `desired`.
+      // Observed cloud state (not `previous`) is the diff baseline —
+      // `previous` only contributes zone ids so routes moved out of a zone
+      // are still cleaned up after state loss or an interrupted apply.
+      const reconcileRoutes = (
+        scriptName: string,
+        desired: NormalizedWorkerRoute[],
+        previous: Worker["Attributes"]["routes"],
+      ) =>
+        Effect.gen(function* () {
+          const zoneIds = Array.from(
+            new Set([
+              ...desired.map((route) => route.zoneId),
+              ...previous.map((route) => route.zoneId),
+            ]),
+          );
+          const liveAll = yield* listWorkerRoutesInZones(scriptName, zoneIds);
+          const desiredKeys = new Set(desired.map(routeKey));
+          const liveByKey = new Map(
+            liveAll.map((route) => [routeKey(route), route]),
+          );
+
+          const toRemove = liveAll.filter(
+            (route) => !desiredKeys.has(routeKey(route)),
+          );
+          yield* Effect.all(
+            toRemove.map((route) =>
+              workers
+                .deleteRoute({ zoneId: route.zoneId, routeId: route.id })
+                .pipe(Effect.catchTag("RouteNotFound", () => Effect.void)),
+            ),
+            { concurrency: "unbounded" },
+          );
+
+          if (desired.length === 0) return [];
+
+          const attachRoute = Effect.fn(function* (
+            route: NormalizedWorkerRoute,
+          ) {
+            const existing = liveByKey.get(routeKey(route));
+            if (existing) return existing;
+
+            const zoneRoutes = yield* workers
+              .listRoutes({ zoneId: route.zoneId })
+              .pipe(
+                Effect.map((response) => response.result ?? []),
+                Effect.catch(() => Effect.succeed([])),
+              );
+            const otherOwner = zoneRoutes.find(
+              (candidate) =>
+                candidate.pattern === route.pattern &&
+                candidate.script &&
+                candidate.script !== scriptName,
+            );
+            if (otherOwner) {
+              return yield* Effect.die(
+                new Error(
+                  `Cannot attach route '${route.pattern}' to Worker '${scriptName}': ` +
+                    `it is already attached to Worker '${otherOwner.script}'. ` +
+                    `Remove it from that Worker first, or pick a different pattern.`,
+                ),
+              );
+            }
+
+            // A duplicate-pattern failure means another actor (or a crashed
+            // previous reconcile) created the route between our observation
+            // and now — re-list and converge if it points at this script.
+            const created = yield* workers
+              .createRoute({
+                zoneId: route.zoneId,
+                pattern: route.pattern,
+                script: scriptName,
+              })
+              .pipe(
+                // Same eventual-consistency window as `putDomain`: creating
+                // a route right after `putScript` can race Cloudflare's
+                // script registry, which rejects with code 10019 ("Cannot
+                // configure a route for a Worker which does not exist") —
+                // typed as `RouteScriptNotFound` via the createRoute patch.
+                Effect.retry({
+                  while: (error) => error._tag === "RouteScriptNotFound",
+                  schedule: Schedule.exponential(200).pipe(
+                    Schedule.both(Schedule.recurs(15)),
+                  ),
+                }),
+                Effect.catchTag("InvalidRoute", (originalError) =>
+                  Effect.gen(function* () {
+                    const match = yield* workers
+                      .listRoutes({ zoneId: route.zoneId })
+                      .pipe(
+                        Effect.map((response) =>
+                          (response.result ?? []).find(
+                            (candidate) =>
+                              candidate.pattern === route.pattern &&
+                              candidate.script === scriptName,
+                          ),
+                        ),
+                        Effect.catch(() => Effect.succeed(undefined)),
+                      );
+                    if (!match?.id) {
+                      return yield* Effect.fail(originalError);
+                    }
+                    return { id: match.id, pattern: match.pattern };
+                  }),
+                ),
+              );
+            return {
+              id: created.id,
+              pattern: created.pattern,
+              zoneId: route.zoneId,
+            };
+          });
+
+          return yield* Effect.all(desired.map(attachRoute), {
+            concurrency: "unbounded",
+          });
+        });
+
       const createAlchemyWorkerTags = (id: string) => [
         `alchemy:stack:${stack.name}`,
         `alchemy:stage:${stack.stage}`,
@@ -794,9 +1206,16 @@ export const LiveWorkerProvider = () =>
         // hash that `readAssets` produces is the manifest-derived
         // hash, which is shaped differently from any upstream
         // build-input hash and will never match it on the next pass.
+        const metadataHash = yield* resolveWorkerMetadataHash({
+          props: news,
+          bindings,
+          accountId,
+          stack: { name: stack.name, stage: stack.stage },
+        });
         const hash = {
           ...preparedHash,
           assets: prebuiltAssets?.hash ?? preparedHash.assets,
+          metadata: metadataHash,
         } satisfies Worker["Attributes"]["hash"];
         const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
         const expectedDurableObjectClassNames =
@@ -1081,6 +1500,7 @@ export const LiveWorkerProvider = () =>
           assets: metadataAssets,
           bindings: metadataBindings,
           bodyPart: undefined,
+          cache: news.cache ?? getCacheBinding(bindings),
           compatibilityDate: compatibility.date,
           compatibilityFlags: compatibility.flags,
           containers:
@@ -1152,7 +1572,8 @@ export const LiveWorkerProvider = () =>
           );
         // Workers for Platforms user workers are invoked via dynamic dispatch,
         // never routed directly — they have no workers.dev subdomain, custom
-        // domains, or cron triggers. Skip all of that reconciliation.
+        // domains, zone routes, or cron triggers. Skip all of that
+        // reconciliation.
         if (dispatchNamespace) {
           return {
             workerId: worker.id ?? name,
@@ -1164,6 +1585,7 @@ export const LiveWorkerProvider = () =>
             durableObjectNamespaces,
             accountId,
             domains: [],
+            routes: [],
             crons: [],
             hash,
           } satisfies Worker["Attributes"];
@@ -1230,6 +1652,18 @@ export const LiveWorkerProvider = () =>
           ...reconciled.map((d) => `https://${d.hostname}`),
           ...(workersDevUrl ? [workersDevUrl] : []),
         ];
+        const desiredRoutes = yield* normalizeRoutes(news.routes);
+        const previousRoutes = output?.routes ?? [];
+        if (desiredRoutes.length > 0 || previousRoutes.length > 0) {
+          yield* session.note(
+            `Reconciling worker routes (${desiredRoutes.length}) ...`,
+          );
+        }
+        const routes = yield* reconcileRoutes(
+          name,
+          desiredRoutes,
+          previousRoutes,
+        );
         const crons = yield* reconcileCrons(
           name,
           normalizeCrons([...getCronBindings(bindings), ...(news.crons ?? [])]),
@@ -1246,6 +1680,7 @@ export const LiveWorkerProvider = () =>
           durableObjectNamespaces,
           accountId,
           domains,
+          routes,
           crons,
           hash,
         } satisfies Worker["Attributes"];
@@ -1255,7 +1690,26 @@ export const LiveWorkerProvider = () =>
         id: string,
         props: WorkerProps,
         output: Worker["Attributes"],
+        bindings: readonly ResourceBinding<Worker["Binding"]>[] | undefined,
+        accountId: string,
       ) {
+        // #745: metadata-only edits (compatibility, observability, placement,
+        // limits, logpush, env literals, bindings, subdomain config, tags)
+        // don't touch the bundle/vite/asset-content hashes below, so compare a
+        // hash of that surface first. Skipped when bindings are still
+        // unresolved: the hash can't be computed deterministically here, and
+        // the eventual apply stores it once bindings resolve.
+        if (bindings) {
+          const metadataHash = yield* resolveWorkerMetadataHash({
+            props,
+            bindings,
+            accountId,
+            stack: { name: stack.name, stage: stack.stage },
+          });
+          if (metadataHash !== output.hash?.metadata) {
+            return true;
+          }
+        }
         if (props.script !== undefined) {
           const scriptHash = yield* hashScript(props.script);
           if (scriptHash !== output.hash?.bundle) {
@@ -1357,6 +1811,7 @@ export const LiveWorkerProvider = () =>
                               tags: script.tags ?? undefined,
                               durableObjectNamespaces: {},
                               domains: [],
+                              routes: [],
                               crons: [],
                             },
                           ]
@@ -1412,6 +1867,13 @@ export const LiveWorkerProvider = () =>
           const cronsChanged =
             newCrons.length !== oldCrons.length ||
             newCrons.some((cron, index) => cron !== oldCrons[index]);
+          const newRouteKeys = (yield* normalizeRoutes(news.routes))
+            .map(routeKey)
+            .sort();
+          const oldRouteKeys = (output?.routes ?? []).map(routeKey).sort();
+          const routesChanged =
+            newRouteKeys.length !== oldRouteKeys.length ||
+            newRouteKeys.some((key, index) => key !== oldRouteKeys[index]);
           // `url` is `domains[0]`: the first custom domain in user order if
           // any, otherwise the workers.dev URL (derived from the stable
           // worker name + account subdomain). It's stable across this update
@@ -1465,8 +1927,17 @@ export const LiveWorkerProvider = () =>
             newDoClassNames.every((name, i) => name === oldDoClassNames[i]);
           if (
             domainsChanged ||
+            routesChanged ||
             cronsChanged ||
-            (yield* hasChanged(id, news, output))
+            (yield* hasChanged(
+              id,
+              news,
+              output,
+              Array.isArray(newBindings)
+                ? (newBindings as ResourceBinding<Worker["Binding"]>[])
+                : undefined,
+              accountId,
+            ))
           ) {
             // `workerId` is always stable across an update; seed it so it
             // survives now that `diff.stables` overrides `provider.stables`
@@ -1487,7 +1958,7 @@ export const LiveWorkerProvider = () =>
             };
           }
         }),
-        precreate: Effect.fn(function* ({ id, news, session }) {
+        precreate: Effect.fn(function* ({ id, news, session, bindings }) {
           const { accountId } = yield* yield* CloudflareEnvironment;
           const name = yield* createWorkerName(id, news.name);
           // A Workers for Platforms user worker can't be pre-created: precreate
@@ -1513,19 +1984,41 @@ export const LiveWorkerProvider = () =>
               durableObjectNamespaces: {},
               accountId,
               domains: [],
+              routes: [],
               crons: [],
             } satisfies Worker["Attributes"];
           }
           const dispatchNamespace = resolveNamespaceName(news.namespace);
           const exportMap = news.exports ?? {};
-          const durableObjects = Object.keys(exportMap)
+          // A worker hosts Durable Object classes from two independent sources:
+          // Effect-native DO *exports* (classes defined in the worker entry) and
+          // DO *bindings* declared in `env` — e.g. a bare `Cloudflare.DurableObject`
+          // that fronts a Container image. The placeholder must declare *every*
+          // hosted class so each namespace is created here. A class that exists
+          // only as a binding (a container-fronted DO) is otherwise absent from
+          // this stub, and a resource caught in a worker<->container dependency
+          // cycle — which resolves `worker.durableObjectNamespaces[className]`
+          // against the precreate stub rather than the final reconcile output —
+          // fails because the namespace id it needs never surfaced.
+          const exportDerived = Object.keys(exportMap)
             .filter((logicalId) => isDurableObjectExport(exportMap[logicalId]))
-            .map((logicalId) => ({
-              logicalId,
-              className: logicalId,
-            }));
+            .map((logicalId) => ({ logicalId, className: logicalId }));
+          const durableObjects = mergeDurableObjectClasses(
+            exportDerived,
+            getDurableObjectBindings(bindings, name),
+          );
           const doClasses = durableObjects.map((binding) => binding.className);
-          const containers = doClasses.map((className) => ({ className }));
+          // Only attach container metadata for classes actually fronted by a
+          // Container binding (mirrors reconcile's `containerClassNames`).
+          // Mapping every DO class to a container would wrongly mark plain DOs
+          // as container-backed in the placeholder.
+          const containers = Array.from(
+            new Set(
+              bindings.flatMap((b) =>
+                (b.data.containers ?? []).map((c) => c.className),
+              ),
+            ),
+          ).map((className) => ({ className }));
           const alchemyDoTags = durableObjects.map(
             ({ logicalId, className }) =>
               `alchemy:do:${logicalId}:${className}`,
@@ -1675,6 +2168,7 @@ export const LiveWorkerProvider = () =>
             durableObjectNamespaces,
             accountId,
             domains: [],
+            routes: [],
             crons: [],
           } satisfies Worker["Attributes"];
         }),
@@ -1711,6 +2205,7 @@ export const LiveWorkerProvider = () =>
                 tags: settings.tags ?? undefined,
                 durableObjectNamespaces: getDurableObjects(settings.bindings),
                 domains: [],
+                routes: [],
                 crons: [],
               } satisfies Worker["Attributes"];
               return hasAlchemyWorkerTags(id, settings.tags ?? [])
@@ -1726,22 +2221,27 @@ export const LiveWorkerProvider = () =>
             // `WorkerNotFound` if the script doesn't exist, which the
             // surrounding `Effect.catchTag` turns into `undefined` — that's
             // all the existence check we need.
-            const [subdomain, settings, domainsList] = yield* Effect.all([
-              workers.getScriptSubdomain({
-                accountId,
-                scriptName: workerName,
-              }),
-              workers.getScriptScriptAndVersionSetting({
-                accountId,
-                scriptName: workerName,
-              }),
-              workers
-                .listDomains({
-                  accountId,
-                  service: workerName,
-                })
-                .pipe(Effect.map((r) => r.result ?? [])),
-            ]);
+            const [subdomain, settings, domainsList, routesList] =
+              yield* Effect.all(
+                [
+                  workers.getScriptSubdomain({
+                    accountId,
+                    scriptName: workerName,
+                  }),
+                  workers.getScriptScriptAndVersionSetting({
+                    accountId,
+                    scriptName: workerName,
+                  }),
+                  workers
+                    .listDomains({
+                      accountId,
+                      service: workerName,
+                    })
+                    .pipe(Effect.map((r) => r.result ?? [])),
+                  readWorkerRoutes(workerName),
+                ],
+                { concurrency: "unbounded" },
+              );
             // Preserve the order the user provided in `olds.domain`. The
             // Cloudflare API returns domains in non-deterministic order,
             // which would cause downstream `worker.domains[0]` reads to flip
@@ -1780,6 +2280,7 @@ export const LiveWorkerProvider = () =>
               tags: settings.tags ?? undefined,
               durableObjectNamespaces: getDurableObjects(settings.bindings),
               domains,
+              routes: routesList,
               crons,
             } satisfies Worker["Attributes"];
 
@@ -1946,6 +2447,22 @@ export const LiveWorkerProvider = () =>
               { concurrency: "unbounded" },
             );
           }
+          // Routes are zone-scoped; enumerating every zone live is
+          // expensive, so trust the persisted route ids (refreshed by
+          // `read`) and tolerate already-deleted routes.
+          if (output.routes?.length) {
+            yield* Effect.all(
+              output.routes.map((route) =>
+                workers
+                  .deleteRoute({
+                    zoneId: route.zoneId,
+                    routeId: route.id,
+                  })
+                  .pipe(Effect.catchTag("RouteNotFound", () => Effect.void)),
+              ),
+              { concurrency: "unbounded" },
+            );
+          }
           yield* deleteWorkerScript(
             output.accountId,
             output.workerName,
@@ -2006,6 +2523,25 @@ function bumpMigrationTagVersion(
   return `alchemy:v${parseInt(version, 10) + 1}`;
 }
 
+/**
+ * Merges a worker's export-derived and binding-derived Durable Object class
+ * lists for the precreate placeholder, deduping by class name. The
+ * binding-derived entry wins on a collision so the `alchemy:do:` tag keys off
+ * the same logical id (the binding sid) that `reconcile` writes.
+ */
+function mergeDurableObjectClasses(
+  exportDerived: ReadonlyArray<{ logicalId: string; className: string }>,
+  bindingDerived: ReadonlyArray<{ logicalId: string; className: string }>,
+) {
+  return Array.from(
+    new Map(
+      [...exportDerived, ...bindingDerived].map(
+        (binding) => [binding.className, binding] as const,
+      ),
+    ).values(),
+  );
+}
+
 function getDurableObjectBindings(
   bindings: ReadonlyArray<ResourceBinding>,
   workerName: string,