alchemy 2.0.0-beta.73 → 2.0.0-beta.75

package/src/Cloudflare/Workers/EmailEventSource.ts

@@ -0,0 +1,348 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Cause from "effect/Cause";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { Input } from "../../Input.ts";
+import * as Namespace from "../../Namespace.ts";
+import * as RemovalPolicy from "../../RemovalPolicy.ts";
+import { RuntimeContext } from "../../RuntimeContext.ts";
+import type { FunctionContext } from "../../Serverless/Function.ts";
+import { CatchAll } from "../Email/CatchAll.ts";
+import { Routing } from "../Email/Routing.ts";
+import { Rule, type Matcher } from "../Email/Rule.ts";
+import type { Reference } from "../Zone/lookup.ts";
+import { isWorkerEvent, Worker } from "./Worker.ts";
+
+/**
+ * Effect-native wrapper around Cloudflare's
+ * [`ForwardableEmailMessage`](https://developers.cloudflare.com/email-routing/email-workers/runtime-api/#forwardableemailmessage).
+ *
+ * Follows the same shape as the other Cloudflare bindings (R2, KV, …):
+ *
+ * - `raw` is the underlying `cf.ForwardableEmailMessage` — an escape
+ *   hatch for any field or future API not yet wrapped.
+ * - Ergonomic fields (`from`, `to`, `headers`, `body`, `bodySize`) are
+ *   forwarded verbatim.
+ * - Action methods (`forward`, `reply`, `setReject`) return `Effect`s
+ *   instead of `Promise`/`void`.
+ */
+export interface ForwardableEmailMessage {
+  /** Underlying Cloudflare message — escape hatch for unwrapped APIs. */
+  readonly raw: cf.ForwardableEmailMessage;
+  /** Envelope From address. */
+  readonly from: string;
+  /** Envelope To address. */
+  readonly to: string;
+  /** RFC 5322 headers. */
+  readonly headers: cf.Headers;
+  /** Raw message body stream (RFC 5322 wire bytes). */
+  readonly body: cf.ReadableStream<Uint8Array>;
+  /** Size of the raw message body in bytes. */
+  readonly bodySize: number;
+  /**
+   * Reject this message back to the connecting client with a permanent
+   * SMTP error and the given reason.
+   */
+  setReject(reason: string): Effect.Effect<void>;
+  /**
+   * Forward this message to a verified destination address on the
+   * account. Fails with `EmailError` if Cloudflare rejects the forward
+   * (e.g. unverified destination).
+   */
+  forward(
+    rcptTo: string,
+    headers?: cf.Headers,
+  ): Effect.Effect<void, EmailError>;
+  /**
+   * Reply to the sender with a new outbound message. Fails with
+   * `EmailError` if Cloudflare rejects the reply.
+   */
+  reply(message: cf.EmailMessage): Effect.Effect<void, EmailError>;
+}
+
+export class EmailError extends Data.TaggedError("EmailError")<{
+  action: "forward" | "reply";
+  message: string;
+  cause: unknown;
+}> {}
+
+const wrap = (raw: cf.ForwardableEmailMessage): ForwardableEmailMessage => ({
+  raw,
+  from: raw.from,
+  to: raw.to,
+  headers: raw.headers,
+  body: raw.raw,
+  bodySize: raw.rawSize,
+  setReject: (reason) => Effect.sync(() => raw.setReject(reason)),
+  forward: (rcptTo, headers) =>
+    Effect.tryPromise({
+      try: () => raw.forward(rcptTo, headers),
+      catch: (cause) =>
+        new EmailError({
+          action: "forward",
+          message: `Cloudflare email forward failed: ${formatCause(cause)}`,
+          cause,
+        }),
+    }),
+  reply: (msg) =>
+    Effect.tryPromise({
+      try: () => raw.reply(msg),
+      catch: (cause) =>
+        new EmailError({
+          action: "reply",
+          message: `Cloudflare email reply failed: ${formatCause(cause)}`,
+          cause,
+        }),
+    }),
+});
+
+/**
+ * Whether a subscription's matchers describe the zone's catch-all — either
+ * omitted entirely (the documented default) or a lone `{ type: "all" }`.
+ * Cloudflare models that as a per-zone singleton behind `/rules/catch_all`,
+ * so it maps to `Email.CatchAll` rather than `Email.Rule`.
+ */
+const isCatchAll = (matchers: Matcher[] | undefined): boolean =>
+  matchers === undefined ||
+  (matchers.length === 1 && matchers[0]?.type === "all");
+
+const formatCause = (cause: unknown): string =>
+  cause instanceof Error ? cause.message : String(cause);
+
+/**
+ * Settings for {@link email} — both halves of the consumer in one place.
+ * `zone` opts in to the deploy-time setup: an `Email.Routing` toggle on the
+ * zone plus the routing resource that hands matched mail to the host
+ * Worker. Omit `zone` to manage routing yourself.
+ *
+ * Which routing resource depends on {@link EmailSubscribeProps.matchers}:
+ * a catch-all subscription yields `Email.CatchAll` (Cloudflare models the
+ * zone catch-all as a singleton behind its own endpoint), anything more
+ * specific yields `Email.Rule`.
+ */
+export interface EmailSubscribeProps {
+  /**
+   * Zone to enable email routing on and attach the routing resource to.
+   * Accepts a zone id, a zone name (`example.com`), or a
+   * `{ zoneId, name? }` object (a `Cloudflare.Zone` resource works).
+   * Required to auto-create routing resources; omit if you're managing
+   * `Email.Routing` and `Email.Rule`/`Email.CatchAll` yourself.
+   */
+  zone?: Input<Reference>;
+  /**
+   * Which envelopes Cloudflare delivers to this Worker. Ignored when
+   * `zone` is omitted.
+   *
+   * Omitting this (or passing a lone `{ type: "all" }`) subscribes to the
+   * zone's catch-all, provisioned as `Email.CatchAll`. There is exactly one
+   * catch-all per zone, so a second Worker subscribing to it takes the
+   * zone's mail from the first.
+   *
+   * @default [{ type: "all" }]
+   */
+  matchers?: Matcher[];
+  /**
+   * Display name for the auto-created `Email.Rule` / `Email.CatchAll`.
+   *
+   * @default the host worker's logical id
+   */
+  ruleName?: string;
+  /**
+   * Priority of the auto-created `Email.Rule`. Lower numbers run first.
+   * Ignored for a catch-all subscription — the catch-all is always
+   * evaluated last.
+   *
+   * @default 0
+   */
+  priority?: number;
+  /**
+   * Whether the auto-created `Email.Rule` / `Email.CatchAll` is enabled.
+   *
+   * @default true
+   */
+  enabled?: boolean;
+}
+
+/**
+ * Subscribe to Cloudflare Email Worker events with an Effect handler.
+ *
+ * Wires both halves of the consumer in one call:
+ *
+ * - **Runtime**: registers an `email` event listener on the Worker.
+ *   The handler receives a {@link ForwardableEmailMessage} whose
+ *   action methods (`forward`, `reply`, `setReject`) return `Effect`s.
+ * - **Deploy-time** (when `zone` is set): yields a
+ *   `Cloudflare.Email.Routing` toggle on the zone plus the routing
+ *   resource whose `actions: [{ type: "worker", … }]` targets this
+ *   Worker — `Cloudflare.Email.CatchAll` for a catch-all subscription,
+ *   `Cloudflare.Email.Rule` for anything more specific. No manual
+ *   wiring needed in `alchemy.run.ts`.
+ *
+ * Requires `EmailEventSourceLive` provided on the Worker's Effect.
+ *
+ * **Failure semantics**: a failing handler is logged and the failure is
+ * re-raised. Cloudflare turns that into a temporary SMTP failure, so the
+ * sending server keeps the message and retries later — mail is never
+ * accepted and then silently dropped. Handle the failures you consider
+ * final inside the handler (`Effect.retry`, `Effect.catchTag`, or
+ * `message.setReject(...)` to bounce permanently); anything you let
+ * escape becomes a retryable delivery failure.
+ *
+ * ### Subscribing to Inbound Mail
+ * **Example:** Catch-all on a zone — auto-creates routing + catch-all
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Cloudflare.Worker(
+ *   "Inbox",
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     yield* Cloudflare.email({ zone: "example.com" }).subscribe(
+ *       (message) => message.forward("ops@example.com"),
+ *     );
+ *     return {};
+ *   }).pipe(Effect.provide(Cloudflare.EmailEventSourceLive)),
+ * );
+ * ```
+ *
+ * **Example:** Match a specific address
+ * ```typescript
+ * yield* Cloudflare.email({
+ *   zone: "example.com",
+ *   matchers: [{ type: "literal", field: "to", value: "hello@example.com" }],
+ * }).subscribe((message) => message.forward("ops@example.com"));
+ * ```
+ *
+ * **Example:** Reject (bounce) a message
+ * ```typescript
+ * yield* Cloudflare.email({ zone: "example.com" }).subscribe((message) =>
+ *   message.setReject("Mailbox closed"),
+ * );
+ * ```
+ *
+ * **Example:** Bring-your-own routing — no `zone`, no auto-create
+ * ```typescript
+ * // Manage `Email.Routing` / `Email.Rule` yourself in alchemy.run.ts.
+ * yield* Cloudflare.email().subscribe((message) =>
+ *   Effect.log(`from ${message.from}`),
+ * );
+ * ```
+ *
+ * @see https://developers.cloudflare.com/email-routing/email-workers/
+ *
+ * @binding
+ * @product Workers
+ * @category Workers & Compute
+ */
+export const email = (props: EmailSubscribeProps = {}) => ({
+  subscribe: <E = never, Req = never>(
+    process: (message: ForwardableEmailMessage) => Effect.Effect<void, E, Req>,
+  ) => EmailEventSource.use((source) => source(props, process)),
+});
+
+export type EmailEventSourceService = <E = never, Req = never>(
+  props: EmailSubscribeProps,
+  process: (message: ForwardableEmailMessage) => Effect.Effect<void, E, Req>,
+) => Effect.Effect<void, never, never>;
+
+export class EmailEventSource extends Context.Service<
+  EmailEventSource,
+  EmailEventSourceService
+>()("Cloudflare.Workers.EmailEventSource") {}
+
+export const EmailEventSourceLive = Layer.effect(
+  EmailEventSource,
+  Effect.gen(function* () {
+    const host = yield* Worker;
+    return Effect.fn(function* <E, Req>(
+      props: EmailSubscribeProps,
+      process: (
+        message: ForwardableEmailMessage,
+      ) => Effect.Effect<void, E, Req>,
+    ) {
+      // Deploy-time: provision the Email.Routing toggle plus the routing
+      // resource that hands matched mail to this Worker. Skipped once
+      // running inside the deployed Worker (the global guard) and when
+      // `zone` is omitted (bring-your-own routing). Namespaced under the
+      // host so logical identity is stable per Worker.
+      if (!globalThis.__ALCHEMY_RUNTIME__ && props.zone !== undefined) {
+        const zone = props.zone;
+        const matchers = props.matchers;
+        yield* Namespace.push(
+          host.LogicalId,
+          Effect.gen(function* () {
+            // Routing is a per-zone singleton shared with other rules on
+            // the zone, so destroying this Worker must not disable it.
+            yield* Routing("EmailRouting", {
+              zone,
+              enabled: true,
+            }).pipe(RemovalPolicy.retain());
+
+            const action = {
+              type: "worker" as const,
+              value: [host.workerName],
+            };
+
+            // Catch-all is a per-zone SINGLETON living behind
+            // `/rules/catch_all`, not an ordinary rule. Cloudflare surfaces
+            // it in `listRules` but rejects mutating it through the rule
+            // endpoint ("Invalid rule operation"), so creating it as an
+            // `Email.Rule` would produce a row the engine cannot delete.
+            // Route an all-matcher subscription to `Email.CatchAll`
+            // instead — the resource that owns that endpoint.
+            if (isCatchAll(matchers)) {
+              yield* CatchAll("EmailCatchAll", {
+                zone,
+                name: props.ruleName ?? host.LogicalId,
+                enabled: props.enabled ?? true,
+                actions: [action],
+              });
+              return;
+            }
+
+            yield* Rule("EmailRule", {
+              zone,
+              name: props.ruleName ?? host.LogicalId,
+              enabled: props.enabled ?? true,
+              priority: props.priority ?? 0,
+              matchers: matchers!,
+              actions: [action],
+            });
+          }),
+        );
+      }
+
+      // Resolve the runtime context per-call rather than at layer
+      // construction (mirrors `Queues.EventSourceLive`).
+      const ctx = (yield* RuntimeContext) as unknown as FunctionContext;
+      yield* ctx.listen<void, Req>((event) => {
+        if (!isWorkerEvent(event) || event.type !== "email") return;
+
+        const message = wrap(event.input as cf.ForwardableEmailMessage);
+        // Log, then let the failure propagate. Cloudflare turns an
+        // exception out of the `email` handler into a temporary SMTP
+        // failure, so the sending server keeps the message and retries.
+        // Swallowing it here would instead ACCEPT the envelope and then
+        // drop it: a transient dependency outage would silently destroy
+        // mail with nothing left to retry from.
+        return process(message).pipe(
+          Effect.tapCause((cause) =>
+            Effect.sync(() => {
+              console.error(
+                `[EmailEventSource] handler failed for message to ` +
+                  `"${message.to}": ${Cause.pretty(cause)}`,
+              );
+            }),
+          ),
+          // The listener contract is `E = never`, so surface the failure as
+          // a defect rather than discarding it: the invocation fails, which
+          // is what Cloudflare turns into the temporary SMTP failure.
+          Effect.orDie,
+        );
+      });
+    }) as EmailEventSourceService;
+  }),
+);

package/src/Cloudflare/Workers/LocalWorkerProvider.ts

@@ -15,7 +15,9 @@ import * as Cause from "effect/Cause";
 import * as Effect from "effect/Effect";
 import * as Equal from "effect/Equal";
 import * as Exit from "effect/Exit";
+import * as Fiber from "effect/Fiber";
 import type * as FileSystem from "effect/FileSystem";
+import * as PlatformFileSystem from "effect/FileSystem";
 import * as MutableHashMap from "effect/MutableHashMap";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
@@ -29,6 +31,7 @@ import type * as Bundle from "../../Bundle/Bundle.ts";
 import * as LocalProvider from "../../Local/LocalProvider.ts";
 import { Stack } from "../../Stack.ts";
 import { unwrapRedacted } from "../../Util/index.ts";
+import { sha256 } from "../../Util/sha256.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import {
   isLiveId,
@@ -327,6 +330,12 @@ export const LocalWorkerProvider = () =>
         // opt-out restarts the instance.
         const devRemote: Record<string, boolean> = {};
         const containers: Record<string, ContainerImage> = {};
+        // Content hashes of the container images, keyed like `containers`.
+        // `ContainerImage` itself only carries stable paths (context /
+        // dockerfile / imageUri), so without the hash an image CONTENT
+        // change (a Dockerfile edit, a rebuilt bundle) would never change
+        // the config and the running container would serve stale code.
+        const containerHashes: Record<string, string> = {};
         for (const { data } of bindings) {
           for (const binding of data.bindings ?? []) {
             if (
@@ -391,6 +400,9 @@ export const LocalWorkerProvider = () =>
                 ...container.dev,
                 env: unwrapRedacted(container.dev.env),
               };
+              if (container.hash !== undefined) {
+                containerHashes[container.className] = container.hash;
+              }
             }
           }
         }
@@ -446,6 +458,14 @@ export const LocalWorkerProvider = () =>
           durableObjectNamespaces: Object.values(durableObjectNamespaces),
           workflows: Object.values(workflows),
           hyperdrives,
+          /**
+           * Container image CONTENT hashes (className → hash). The DO
+           * namespace records above only carry the image's stable paths, so
+           * this is what makes an image content change — a Dockerfile edit,
+           * a rebuilt effectful bundle — restart the instance (which is
+           * what re-runs the docker build).
+           */
+          containerHashes,
           /**
            * External source-provider descriptor (plain JSON). Part of the
            * hashed config so changing the provider or its options restarts
@@ -577,6 +597,152 @@ export const LocalWorkerProvider = () =>
       // last good instance keeps serving until the replacement's first
       // serve completes. Ownership is tracked in `workerdScopes`, closed by
       // the next successful serve, by `delete`, or by provider shutdown.
+      /**
+       * One container-context watcher per worker id, keyed by the watched
+       * path set. Registry-held (NOT per-serve-scope): a worker restarts
+       * through several code paths that overlap scopes, and a watcher per
+       * serve produced DUPLICATES whose simultaneous restarts storm the
+       * instance until the DO's container link breaks.
+       */
+      const containerWatchers = new Map<
+        string,
+        { key: string; fiber: Fiber.Fiber<void> }
+      >();
+
+      const stopContainerWatcher = (id: string) =>
+        Effect.suspend(() => {
+          const existing = containerWatchers.get(id);
+          if (existing === undefined) return Effect.void;
+          containerWatchers.delete(id);
+          return Fiber.interrupt(existing.fiber).pipe(Effect.asVoid);
+        });
+
+      /**
+       * Watch a worker's Build-variant container contexts and restart the
+       * instance when their CONTENT changes — the docker build happens at
+       * instance start, so a restart IS the image rebuild.
+       *
+       * This is the reload path for USER-supplied Dockerfile/context
+       * containers: those files are not imported by the stack, so
+       * `bun --watch` never re-runs the exec child for them and no replan
+       * (hence no config-hash restart) ever fires. Generated contexts
+       * (under `.alchemy/`) are excluded — the effectful `main` variant
+       * rewrites its bundle there on every plan, which would loop; that
+       * variant reloads through the config's `containerHashes` instead.
+       *
+       * Events are debounced and gated on a content fingerprint
+       * (`node_modules`/`.git` skipped), so editor double-saves and
+       * metadata-only churn don't bounce the instance.
+       */
+      const ensureContainerWatcher = (
+        worker: RunnableWorkerConfig,
+        restart: Effect.Effect<
+          void,
+          never,
+          | ChildProcessSpawner.ChildProcessSpawner
+          | PlatformFileSystem.FileSystem
+          | Path.Path
+        >,
+      ) =>
+        Effect.gen(function* () {
+          const fs = yield* PlatformFileSystem.FileSystem;
+          const watched = new Map<string, { dockerfile: string | undefined }>();
+          for (const namespace of worker.durableObjectNamespaces) {
+            const image = namespace.container;
+            if (image === undefined || !("dockerfile" in image)) continue;
+            const context = path.resolve(image.context ?? ".");
+            if (context.split(path.sep).includes(".alchemy")) continue;
+            watched.set(context, {
+              dockerfile:
+                image.dockerfile !== undefined
+                  ? path.resolve(context, image.dockerfile)
+                  : undefined,
+            });
+          }
+          const key = JSON.stringify([...watched.entries()].sort());
+          const existing = containerWatchers.get(worker.id);
+          if (existing !== undefined) {
+            if (existing.key === key) return; // same watcher keeps running
+            yield* stopContainerWatcher(worker.id);
+          }
+          if (watched.size === 0) return;
+
+          const fingerprint = Effect.gen(function* () {
+            const hashes: string[] = [];
+            const walk = (dir: string): Effect.Effect<void, any> =>
+              Effect.gen(function* () {
+                const entries = yield* fs.readDirectory(dir);
+                for (const entry of entries.sort()) {
+                  if (entry === "node_modules" || entry === ".git") continue;
+                  const file = path.join(dir, entry);
+                  const stat = yield* fs.stat(file);
+                  if (stat.type === "Directory") {
+                    yield* walk(file);
+                  } else {
+                    hashes.push(
+                      `${file}:${yield* fs.readFile(file).pipe(Effect.flatMap(sha256))}`,
+                    );
+                  }
+                }
+              });
+            for (const [context, { dockerfile }] of watched) {
+              yield* walk(context);
+              if (dockerfile !== undefined && !dockerfile.startsWith(context)) {
+                hashes.push(
+                  `${dockerfile}:${yield* fs.readFile(dockerfile).pipe(Effect.flatMap(sha256))}`,
+                );
+              }
+            }
+            return yield* sha256(hashes.join("\n"));
+          }).pipe(Effect.orElseSucceed(() => undefined));
+
+          const streams = [...watched.entries()].flatMap(
+            ([context, { dockerfile }]) => [
+              fs.watch(context, { recursive: true }),
+              ...(dockerfile !== undefined && !dockerfile.startsWith(context)
+                ? [fs.watch(path.dirname(dockerfile))]
+                : []),
+            ],
+          );
+          const watchLoop = Effect.gen(function* () {
+            let last = yield* fingerprint;
+            yield* Stream.mergeAll(streams, {
+              concurrency: streams.length,
+            }).pipe(
+              Stream.debounce("500 millis"),
+              Stream.runForEach(() =>
+                Effect.gen(function* () {
+                  const next = yield* fingerprint;
+                  if (next === undefined || next === last) return;
+                  last = next;
+                  yield* Effect.logInfo(
+                    `[${worker.id}] Container build context changed, restarting instance`,
+                  );
+                  yield* restart;
+                }),
+              ),
+              Effect.catchCause((cause) =>
+                Effect.logWarning(
+                  `[${worker.id}] Container context watch failed`,
+                  Cause.squash(cause),
+                ),
+              ),
+            );
+          });
+          const fiber = yield* watchLoop.pipe(
+            Effect.ensuring(
+              Effect.sync(() => {
+                const current = containerWatchers.get(worker.id);
+                if (current?.fiber === fiber) {
+                  containerWatchers.delete(worker.id);
+                }
+              }),
+            ),
+            Effect.forkIn(rootScope),
+          );
+          containerWatchers.set(worker.id, { key, fiber });
+        });
+
       const serveWith = (
         worker: RunnableWorkerConfig,
         bundle: Bundle.BundleOutput,
@@ -666,6 +832,13 @@ export const LocalWorkerProvider = () =>
                   worker.name,
                   restartWorker(worker.id),
                 );
+                // Idempotent: the registry keeps ONE watcher per worker id
+                // across restarts (a new one only when the watched path set
+                // changed).
+                yield* ensureContainerWatcher(
+                  worker,
+                  Effect.suspend(() => restartWorker(worker.id)),
+                );
                 const currentConsumers = yield* getQueueConsumers(worker.name);
                 if (
                   JSON.stringify(currentConsumers) !==
@@ -716,7 +889,15 @@ export const LocalWorkerProvider = () =>
           ),
         );
 
-      const restartWorker = (id: string) =>
+      const restartWorker = (
+        id: string,
+      ): Effect.Effect<
+        void,
+        never,
+        | ChildProcessSpawner.ChildProcessSpawner
+        | PlatformFileSystem.FileSystem
+        | Path.Path
+      > =>
         Effect.suspend(() => {
           const latest = latestServes.get(id);
           if (latest) {
@@ -744,6 +925,7 @@ export const LocalWorkerProvider = () =>
       // instance replacement does NOT go through this: the previous workerd
       // keeps serving until the replacement's first serve closes it.
       const closeWorkerd = Effect.fn(function* (id: string) {
+        yield* stopContainerWatcher(id);
         const scope = workerdScopes.get(id);
         if (scope) {
           workerdScopes.delete(id);

package/src/Cloudflare/Workers/Worker.ts

@@ -1301,7 +1301,17 @@ export type Worker<Bindings = any> = Resource<
      * `WorkerProps.cache` takes precedence.
      */
     cache?: WorkerCache;
-    containers?: { className: string; dev: DevContainerImage | undefined }[];
+    containers?: {
+      className: string;
+      dev: DevContainerImage | undefined;
+      /**
+       * Content hash of the image (bundle/Dockerfile/context). Part of the
+       * local worker's restart config: `dev` only carries stable PATHS, so
+       * without the hash an image content change would never restart the
+       * instance and the running container would serve stale code.
+       */
+      hash: string | undefined;
+    }[];
     crons?: string[];
     hyperdrives?: Record<string, Required<DevOrigin>>;
     /**

package/src/Cloudflare/Workers/WorkerAsyncBindings.ts

@@ -313,6 +313,13 @@ const bindContainerClass = Effect.fn(function* (
       `Worker binding '${bindingName}' is a Container without a deployable image. Declare the container with props (image, or context/dockerfile) to bind it on an async Worker — effectful (main) containers require an Effect-native Durable Object host.`,
     );
   }
+  // Both halves of the Worker's side describe the same env entry, so they
+  // share one `sid`. Binding rows are collapsed by sid (last write wins), so
+  // splitting them across two `bind` calls silently drops the namespace
+  // binding whenever the two sids coincide — e.g. the env key and the
+  // Container's logical id match (`Sandbox: Container("Sandbox", …)`). The
+  // Worker then uploads the Container declaration itself as a `json` binding
+  // and `env.NAME` is not a DO namespace at runtime.
   yield* resource.bind`${bindingName}`({
     bindings: [
       {
@@ -321,6 +328,13 @@ const bindContainerClass = Effect.fn(function* (
         className,
       },
     ],
+    containers: [
+      {
+        className,
+        dev: application.dev,
+        hash: application.hash.pipe(Output.map((h) => h?.image)),
+      },
+    ],
   });
   yield* application.bind`${bindingName}`({
     durableObjects: {
@@ -329,9 +343,6 @@ const bindContainerClass = Effect.fn(function* (
       ),
     },
   });
-  yield* resource.bind`${application.LogicalId}`({
-    containers: [{ className, dev: application.dev }],
-  });
 });
 
 type BindingSpec = InputProps<WorkerBinding>;

package/src/Cloudflare/Workers/index.ts

@@ -12,6 +12,7 @@ export * from "./DurableObject.ts";
 export * from "./DurableObjectBridge.ts";
 export * from "./DurableObjectState.ts";
 export * from "./DurableObjectStorage.ts";
+export * from "./EmailEventSource.ts";
 export * from "./Fetch.ts";
 export * from "./GitHubRepositoryEventSource.ts";
 export * from "./HttpServer.ts";