alchemy 2.0.0-beta.81 → 2.0.0-beta.82

package/src/Cloudflare/Workers/LocalWorkerProvider.ts

@@ -10,7 +10,7 @@ import {
   type QueueConsumer as RuntimeQueueConsumer,
   type Workflow as RuntimeWorkflow,
 } from "@alchemy.run/cloudflare-runtime/core";
-import type { ContainerImage } from "@alchemy.run/cloudflare-runtime/core/Docker";
+import type { ContainerImage as RuntimeContainerImage } from "@alchemy.run/cloudflare-runtime/core/Docker";
 import * as WorkerProxy from "@alchemy.run/cloudflare-runtime/core/proxy/WorkerProxy";
 import * as Cause from "effect/Cause";
 import * as ConsoleService from "effect/Console";
@@ -49,6 +49,7 @@ import {
 import { sha256 } from "../../Util/sha256.ts";
 import { ANSI_RESET, ansiFg, colorsEnabled } from "../../Util/Terminal.ts";
 import { theme } from "../../Util/Theme.ts";
+import type { DevContainerImage } from "../Containers/ContainerApplication.ts";
 import { localAccountId } from "../LocalAccount.ts";
 import {
   isLiveId,
@@ -60,6 +61,8 @@ import type { ConsumerSettings } from "../Queues/Consumer.ts";
 import type { WorkerAssetsConfig, WorkerProps } from "../Workers/Worker.ts";
 import { readAssetsConfigFiles } from "./Assets.ts";
 import { getCompatibility } from "./Compatibility.ts";
+import { LocalEdge } from "./LocalEdge.ts";
+import { routePatternHost } from "./RoutePattern.ts";
 import { materializeRuntimeBindings, WorkerValidationError } from "./RuntimeBindings.ts";
 import { loadSource, SourceProviderError, type DevContext } from "./Source.ts";
 import { watchPrebuiltWorkerBundle } from "./Sources/Prebuilt.ts";
@@ -151,6 +154,7 @@ export const LocalWorkerProvider = () =>
       const path = yield* Path.Path;
       const localRuntimeState = yield* LocalRuntimeState;
       const workerProxy = yield* WorkerProxy.WorkerProxy;
+      const edge = yield* LocalEdge;
       const context = yield* Effect.context<RuntimeServices>();
       const rootScope = yield* Effect.scope;
 
@@ -288,7 +292,7 @@ export const LocalWorkerProvider = () =>
           if (type === "SourceMap") continue;
           if (type === "Data" || type === "Wasm") {
             if (!(file.content instanceof Uint8Array)) {
-              return yield* new WorkerValidationError({
+              return yield* WorkerValidationError.make({
                 message: `Expected Uint8Array for ${file.path} (${type})`,
                 value: file.content,
               });
@@ -350,7 +354,7 @@ export const LocalWorkerProvider = () =>
         // send_email descriptors. Part of the hashed config: flipping the
         // opt-out restarts the instance.
         const devRemote: Record<string, boolean> = {};
-        const containers: Record<string, ContainerImage> = {};
+        const containers: Record<string, NonNullable<RuntimeDurableObject["container"]>> = {};
         // Content hashes of the container images, keyed like `containers`.
         // `ContainerImage` itself only carries stable paths (context /
         // dockerfile / imageUri), so without the hash an image CONTENT
@@ -412,14 +416,23 @@ export const LocalWorkerProvider = () =>
             }
           }
           if (data.containers) {
+            const toRuntimeImage = (image: DevContainerImage) => ({
+              ...image,
+              env: unwrapRedacted(image.env),
+            });
             for (const container of data.containers) {
-              if (!container.dev) {
+              if (container.devImages !== undefined) {
+                // Durable Object-managed: named images, selected at start().
+                const images: Record<string, RuntimeContainerImage> = {};
+                for (const [name, image] of Object.entries(container.devImages)) {
+                  images[name] = toRuntimeImage(image);
+                }
+                containers[container.className] = { images };
+              } else if (container.dev) {
+                containers[container.className] = toRuntimeImage(container.dev);
+              } else {
                 return yield* Effect.die(`Container ${container.className} has no dev image`);
               }
-              containers[container.className] = {
-                ...container.dev,
-                env: unwrapRedacted(container.dev.env),
-              };
               if (container.hash !== undefined) {
                 containerHashes[container.className] = container.hash;
               }
@@ -528,6 +541,26 @@ export const LocalWorkerProvider = () =>
           // list into workerd's `streamingTails` designators, which deliver
           // the producer's events live via the consumer's `tailStream()`.
           streamingTailConsumers: resolveTailConsumers(props.streamingTailConsumers),
+          /**
+           * Zone routes, emulated by the local edge (see `LocalEdge`). The
+           * zone is never resolved in dev — `zoneId` is the declared id or
+           * a `dev:`-marked stand-in.
+           */
+          routes: (props.routes ?? []).map((route) => {
+            const pattern = route.pattern.trim();
+            const zone =
+              route.zoneName ??
+              (typeof route.zone === "string" ? route.zone : route.zone?.zoneId) ??
+              routePatternHost(pattern) ??
+              pattern;
+            return { id: `dev:${pattern}`, pattern, zoneId: route.zoneId ?? `dev:${zone}` };
+          }),
+          /**
+           * The custom-domain hostname. In dev the Worker's own URL serves
+           * it, with zone routes for the hostname applied in front.
+           */
+          edgeDomain:
+            typeof props.domain === "string" ? props.domain : (props.domain?.name ?? undefined),
         };
       });
 
@@ -595,6 +628,9 @@ export const LocalWorkerProvider = () =>
       // bound via `scriptName` from another Worker) therefore never observe
       // a window where the script has no running instance and no registry
       // entry, even when `runtime.start` is slow (container image builds).
+      // Workers with containers are the exception: their previous instance
+      // is retired after the images are ready but before the new workerd
+      // boots (see `beforeServe` in `serveWith`).
       // Both instances use the same registry key; the registry's entry
       // removal is owner-aware, so closing the old scope after the
       // replacement has re-registered cannot delete the replacement's
@@ -653,16 +689,20 @@ export const LocalWorkerProvider = () =>
           const fs = yield* PlatformFileSystem.FileSystem;
           const watched = new Map<string, { dockerfile: string | undefined }>();
           for (const namespace of worker.durableObjectNamespaces) {
-            const image = namespace.container;
-            if (image === undefined || !("dockerfile" in image)) continue;
-            const context = path.resolve(runtimeBase, image.context ?? ".");
-            if (isPathWithin(dotAlchemy, context, runtimeBase)) continue;
-            watched.set(context, {
-              dockerfile:
-                image.dockerfile !== undefined
-                  ? path.resolve(context, image.dockerfile)
-                  : undefined,
-            });
+            const container = namespace.container;
+            if (container === undefined) continue;
+            const images = "images" in container ? Object.values(container.images) : [container];
+            for (const image of images) {
+              if (!("dockerfile" in image)) continue;
+              const context = path.resolve(runtimeBase, image.context ?? ".");
+              if (isPathWithin(dotAlchemy, context, runtimeBase)) continue;
+              watched.set(context, {
+                dockerfile:
+                  image.dockerfile !== undefined
+                    ? path.resolve(context, image.dockerfile)
+                    : undefined,
+              });
+            }
           }
           const key = JSON.stringify([...watched.entries()].sort());
           const existing = containerWatchers.get(worker.fqn);
@@ -744,6 +784,39 @@ export const LocalWorkerProvider = () =>
           containerWatchers.set(worker.fqn, { key, fiber });
         });
 
+      // Custom-domain hostnames handed to the local edge, per worker FQN.
+      const edgeDomains = new Map<string, { host: string; script: string }>();
+
+      const releaseEdgeDomain = Effect.fn(function* (fqn: string) {
+        const previous = edgeDomains.get(fqn);
+        if (previous) {
+          edgeDomains.delete(fqn);
+          yield* edge.removeDomain(previous.host, previous.script);
+        }
+      });
+
+      /**
+       * Point the worker's stable proxy at a freshly served workerd. A
+       * custom-domain worker is handed to the local edge instead, which
+       * fronts it with the zone-route router whenever routes match its
+       * hostname (Cloudflare's routes-over-custom-domain precedence).
+       */
+      const exposeWorker = Effect.fn(function* (
+        worker: RunnableWorkerConfig,
+        proxy: WorkerProxy.WorkerProxyInstance,
+        url: URL,
+      ) {
+        const previous = edgeDomains.get(worker.fqn);
+        if (previous && (previous.host !== worker.edgeDomain || previous.script !== worker.name)) {
+          yield* releaseEdgeDomain(worker.fqn);
+        }
+        if (worker.edgeDomain === undefined) {
+          return yield* proxy.set(url);
+        }
+        edgeDomains.set(worker.fqn, { host: worker.edgeDomain, script: worker.name });
+        yield* edge.serveDomain(worker.edgeDomain, { script: worker.name, proxy, upstream: url });
+      });
+
       const serveWith = (
         worker: RunnableWorkerConfig,
         bundle: Bundle.BundleOutput,
@@ -761,10 +834,43 @@ export const LocalWorkerProvider = () =>
           Effect.uninterruptibleMask((restore) =>
             Effect.gen(function* () {
               const previous = workerdScopes.get(worker.fqn);
-              // Instances whose queue-consumer wiring went stale while they
-              // were starting; never exposed via the proxy, closed together
-              // with `previous` after the cutover below.
-              const superseded: Scope.Closeable[] = [];
+              // Instances to tear down once the replacement is up: `previous`
+              // plus any instance whose queue-consumer wiring went stale
+              // while it was starting (never exposed via the proxy).
+              const retiring: Scope.Closeable[] = previous ? [previous] : [];
+              const closeRetiring = Effect.suspend(() =>
+                Effect.forEach(
+                  retiring.splice(0),
+                  (replaced) =>
+                    Scope.close(replaced, Exit.void).pipe(
+                      Effect.catchCause((cause) =>
+                        Effect.logWarning(
+                          `[${worker.fqn}] Failed to stop previous local worker instance`,
+                          Cause.squash(cause),
+                        ),
+                      ),
+                    ),
+                  { discard: true },
+                ),
+              ).pipe(Effect.uninterruptible);
+              // Container names are deterministic per Durable Object, so a
+              // new workerd would "recover" the previous instance's
+              // still-running container — which the previous instance's
+              // teardown then removes (with its networking sidecar) out from
+              // under it. For workers with containers, break before make:
+              // retire the previous instance after the slow part of the start
+              // (image builds/pulls) but before the new workerd boots, parking
+              // requests on the proxy until the cutover.
+              const hasContainers = worker.durableObjectNamespaces.some(
+                (namespace) => namespace.container !== undefined,
+              );
+              const beforeServe = hasContainers
+                ? Effect.suspend(() =>
+                    retiring.length > 0
+                      ? Effect.andThen(proxy.unset(), closeRetiring)
+                      : Effect.void,
+                  )
+                : undefined;
               let scope!: Scope.Closeable;
               let url!: URL;
               // Queue-consumer wiring can change while `runtime.start` is in
@@ -836,6 +942,7 @@ export const LocalWorkerProvider = () =>
                       cf: worker.dev.cf,
                       modules: yield* toRuntimeModules(bundle),
                       assets: yield* toRuntimeAssets(worker.assets),
+                      beforeServe,
                     })
                     .pipe(Scope.provide(scope)),
                 ).pipe(
@@ -867,27 +974,18 @@ export const LocalWorkerProvider = () =>
                 if (JSON.stringify(currentConsumers) !== JSON.stringify(queueConsumers)) {
                   // Wiring changed while workerd was starting — serve again
                   // with the fresh consumers before exposing the instance.
-                  superseded.push(scope);
+                  retiring.push(scope);
                   continue;
                 }
                 break;
               }
-              yield* proxy.set(url);
-              // Only now tear the replaced instances down: `previous` kept
-              // serving — and stayed registered in the dev registry — until
-              // the cutover above. The registry's entry removal is
-              // owner-aware, so these closes cannot delete the replacement's
-              // registration.
-              for (const replaced of previous ? [...superseded, previous] : superseded) {
-                yield* Scope.close(replaced, Exit.void).pipe(
-                  Effect.catchCause((cause) =>
-                    Effect.logWarning(
-                      `[${worker.fqn}] Failed to stop previous local worker instance`,
-                      Cause.squash(cause),
-                    ),
-                  ),
-                );
-              }
+              yield* exposeWorker(worker, proxy, url);
+              // Only now tear the replaced instances down (unless
+              // `beforeServe` already did): `previous` kept serving — and
+              // stayed registered in the dev registry — until the cutover
+              // above. The registry's entry removal is owner-aware, so these
+              // closes cannot delete the replacement's registration.
+              yield* closeRetiring;
               return url;
             }),
           ),
@@ -1326,12 +1424,10 @@ export const LocalWorkerProvider = () =>
         };
         const handle = yield* source.dev(devCtx);
         if (handle.mode !== "bundle") {
-          return yield* Effect.fail(
-            new SourceProviderError({
-              provider: worker.source!.provider,
-              message: "A source declared devMode 'bundle' but returned a server-mode dev handle.",
-            }),
-          );
+          return yield* new SourceProviderError({
+            provider: worker.source!.provider,
+            message: "A source declared devMode 'bundle' but returned a server-mode dev handle.",
+          });
         }
         yield* serveBundleStream(worker, proxy, handle.bundles);
         return proxy.url;
@@ -1401,6 +1497,8 @@ export const LocalWorkerProvider = () =>
           if (config.dev.mode === "external") {
             dropServeState(fqn);
             yield* closeWorkerd(fqn);
+            yield* edge.removeRoutes(fqn);
+            yield* releaseEdgeDomain(fqn);
             const urls = config.dev.url ? [config.dev.url] : [];
             return {
               workerId: `dev:${config.name}`,
@@ -1450,6 +1548,17 @@ export const LocalWorkerProvider = () =>
             dev: config.dev,
             workerBindings,
           };
+          // Zone routes target this script through the local edge's router.
+          yield* edge.setRoutes(
+            fqn,
+            config.routes.map((route) => ({ pattern: route.pattern, script: config.name })),
+          );
+          // Only workerd-served workers can sit behind the edge router (it
+          // reaches them over service bindings); dev-server modes keep
+          // their proxy pointed at the dev server.
+          if (config.vite || config.source?.devMode === "server") {
+            yield* releaseEdgeDomain(fqn);
+          }
           const serverUrl = yield* config.source
             ? config.source.devMode === "server"
               ? runVite(worker, config.source.rootDir, invalidate, {
@@ -1483,7 +1592,13 @@ export const LocalWorkerProvider = () =>
                 namespace.uniqueKey,
               ]),
             ),
-            routes: [],
+            // Each route reports the edge listener serving its hostname.
+            routes: yield* Effect.forEach(config.routes, (route) => {
+              const host = routePatternHost(route.pattern);
+              return host === undefined
+                ? Effect.succeed(route)
+                : edge.url(host).pipe(Effect.map((url) => ({ ...route, url: url?.origin })));
+            }),
             crons: config.crons,
             tailConsumers: config.tailConsumers,
             streamingTailConsumers: config.streamingTailConsumers,
@@ -1497,6 +1612,8 @@ export const LocalWorkerProvider = () =>
           // and the URL proxy live outside instance scopes and are only
           // reclaimed on a real delete.
           dropServeState(fqn);
+          yield* edge.removeRoutes(fqn);
+          yield* releaseEdgeDomain(fqn);
           yield* closeWorkerd(fqn);
           yield* stopProxy(fqn);
         }),

package/src/Cloudflare/Workers/ObservabilityDestination.ts

@@ -1,6 +1,7 @@
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as Effect from "effect/Effect";
 import * as Predicate from "effect/Predicate";
+import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.ts";
@@ -8,6 +9,7 @@ import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
+import { unwrapRedacted } from "../../Util/data.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
@@ -43,11 +45,12 @@ export interface ObservabilityDestinationProps {
   url: string;
   /**
    * Extra HTTP headers sent with each push (e.g. authentication tokens).
+   * Pass credentials as `Redacted` values to keep them out of plan output.
    * Cloudflare always adds a `content-type: application/json` header of
    * its own. Mutable — updated in place.
    * @default {}
    */
-  headers?: Record<string, string>;
+  headers?: Record<string, string | Redacted.Redacted<string>>;
   /**
    * Which Workers Logs dataset to export. Cannot be changed after
    * creation — updating this property triggers a replacement.
@@ -96,9 +99,10 @@ export interface ObservabilityDestinationAttributes {
   logpushDataset: ObservabilityDataset;
   /**
    * The underlying Logpush destination string (the URL with the
-   * configured headers encoded as query parameters).
+   * configured headers encoded as query parameters). Redacted because it
+   * embeds the header values, including any credentials.
    */
-  destinationConf: string;
+  destinationConf: Redacted.Redacted<string>;
   /**
    * Names of the Worker scripts currently opted in to this destination.
    */
@@ -201,6 +205,12 @@ export const ObservabilityDestinationProvider = () =>
       if (oldDataset !== undefined && oldDataset !== news.logpushDataset) {
         return { action: "replace" } as const;
       }
+      // State written by earlier versions holds `destinationConf` as a plain
+      // string. Reconcile to re-read it as `Redacted`; without header or URL
+      // drift this issues no PATCH.
+      if (output !== undefined && !Redacted.isRedacted(output.destinationConf)) {
+        return { action: "update" } as const;
+      }
       return undefined;
     }),
 
@@ -228,9 +238,9 @@ export const ObservabilityDestinationProvider = () =>
       // Prefer the deployed name: regenerating would target a different
       // resource if the generator's output for this id ever drifts.
       const name = news.name ?? output?.name ?? (yield* createDestinationName(id));
-      // Inputs have been resolved to concrete strings by Plan.
+      // Inputs have been resolved to concrete values by Plan.
       const url = news.url as string;
-      const headers = (news.headers ?? {}) as Record<string, string>;
+      const headers = unwrapRedacted(news.headers ?? {});
       const enabled = news.enabled ?? true;
 
       // 1. Observe — the slug cached on `output` is a hint, not a
@@ -265,7 +275,7 @@ export const ObservabilityDestinationProvider = () =>
               Effect.gen(function* () {
                 const match = yield* findByName(accountId, name);
                 if (!match) {
-                  return yield* Effect.fail(originalError);
+                  return yield* originalError;
                 }
                 return match;
               }),
@@ -381,7 +391,7 @@ const freshObserved = (accountId: string, slug: string) =>
           // succeeded and this read except via an out-of-band delete racing
           // us — surface that as the typed not-found the API would raise.
           Effect.fail(
-            new workers.ObservabilityDestinationNotFound({
+            workers.ObservabilityDestinationNotFound.make({
               code: 0,
               message: `observability destination "${slug}" disappeared during reconcile`,
             }),
@@ -419,6 +429,6 @@ const toAttributes = (
   url: observed.configuration.url,
   // Distilled widens generated string enums to open unions (`string & {}`).
   logpushDataset: observed.configuration.logpushDataset as ObservabilityDataset,
-  destinationConf: observed.configuration.destinationConf,
+  destinationConf: Redacted.make(observed.configuration.destinationConf),
   scripts: [...observed.scripts],
 });

package/src/Cloudflare/Workers/Route.ts

@@ -1,13 +1,25 @@
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 import * as Predicate from "effect/Predicate";
 import * as Stream from "effect/Stream";
 import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as ProviderLayer from "../../Local/ProviderLayer.ts";
+import * as RpcProvider from "../../Local/RpcProvider.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import {
+  generateLocalId,
+  isLiveId,
+  LOCAL_PROVIDERS_URL,
+  localRuntimeServices,
+} from "../LocalRuntime.ts";
 import type { Providers } from "../Providers.ts";
 import { listAllZones } from "../Zone/lookup.ts";
+import { LocalEdge } from "./LocalEdge.ts";
+import { routePatternHost, routePatternUrl } from "./RoutePattern.ts";
 
 export interface WorkerRouteProps {
   /**
@@ -45,6 +57,12 @@ export interface WorkerRouteAttributes {
   pattern: string;
   /** Worker script the route runs, or `undefined` for an opt-out route. */
   script: string | undefined;
+  /**
+   * Origin serving the route's hostname — `https://<host>` when deployed,
+   * the local edge listener under `alchemy dev` — or `undefined` for a
+   * wildcard host.
+   */
+  url?: string;
 }
 
 export type WorkerRoute = Resource<
@@ -70,6 +88,11 @@ export type WorkerRoute = Resource<
  * scans the zone for an existing route with the same pattern and
  * reports it as `Unowned`, so the engine refuses to take it over unless
  * `--adopt` (or `adopt(true)`) is set.
+ *
+ * Under `alchemy dev` the route is emulated locally instead: requests to a
+ * custom-domain Worker on the same hostname (or to the route's `url`, a
+ * local listener for the hostname) are matched against every route and
+ * forwarded to the target Worker, most specific pattern first.
  * ### Routing a hostname to a Worker
  * **Example:** Route all requests on a subdomain to a Worker
  * ```typescript
@@ -113,6 +136,65 @@ export const isWorkerRoute = (value: unknown): value is WorkerRoute =>
   Predicate.hasProperty(value, "Type") && value.Type === "Cloudflare.Workers.Route";
 
 export const WorkerRouteProvider = () =>
+  ProviderLayer.dual(WorkerRoute, {
+    live: () => WorkerRouteProviderLive(),
+    local: () => WorkerRouteProviderLocal().pipe(Layer.provide(localRuntimeServices())),
+  });
+
+/**
+ * `alchemy dev` emulation: the route is registered with the local edge,
+ * which matches its pattern in front of the local Workers exactly like
+ * Cloudflare's zone routing (see `LocalEdge`). No cloud call is made.
+ */
+export const WorkerRouteProviderLocal = () =>
+  RpcProvider.effect(
+    WorkerRoute,
+    LOCAL_PROVIDERS_URL,
+    Effect.gen(function* () {
+      const edge = yield* LocalEdge;
+      const register = Effect.fn(function* (attrs: WorkerRouteAttributes) {
+        yield* edge.setRoutes(attrs.routeId, [{ pattern: attrs.pattern, script: attrs.script }]);
+        const host = routePatternHost(attrs.pattern);
+        const url = host === undefined ? undefined : yield* edge.url(host);
+        return { ...attrs, url: url?.origin };
+      });
+      return {
+        stables: ["routeId", "zoneId"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!output) return undefined;
+          // A real route id on a local row: replace to mint a local one.
+          if (isLiveId(output.routeId)) return { action: "replace" } as const;
+          if (!isResolved(news)) return undefined;
+          if (output.zoneId !== news.zoneId) return { action: "replace" } as const;
+          if (output.pattern !== news.pattern || output.script !== news.script) {
+            return { action: "update" } as const;
+          }
+          // Unchanged: re-register so a fresh dev session's edge serves it
+          // without the plan reporting an update — unless the hostname's
+          // listener moved (a new session picks a new port).
+          const registered = yield* register(output);
+          return registered.url === output.url
+            ? ({ action: "noop" } as const)
+            : ({ action: "update" } as const);
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const attrs: WorkerRouteAttributes = {
+            routeId:
+              output?.routeId && !isLiveId(output.routeId) ? output.routeId : generateLocalId(),
+            zoneId: news.zoneId as string,
+            pattern: news.pattern,
+            script: news.script as string | undefined,
+          };
+          return yield* register(attrs);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* edge.removeRoutes(output.routeId);
+        }),
+      };
+    }),
+  );
+
+export const WorkerRouteProviderLive = () =>
   Provider.succeed(WorkerRoute, {
     stables: ["routeId", "zoneId"],
 
@@ -176,7 +258,7 @@ export const WorkerRouteProvider = () =>
             Effect.gen(function* () {
               const match = yield* findByPattern(zoneId, news.pattern);
               if (!match) {
-                return yield* Effect.fail(originalError);
+                return yield* originalError;
               }
               return match;
             }),
@@ -265,6 +347,7 @@ const toAttributes = (observed: ObservedRoute, zoneId: string): WorkerRouteAttri
   zoneId,
   pattern: observed.pattern,
   script: observed.script,
+  url: routePatternUrl(observed.pattern),
 });
 
 const observeById = (zoneId: string, routeId: string) =>

package/src/Cloudflare/Workers/RoutePattern.ts

@@ -0,0 +1,95 @@
+/**
+ * Cloudflare Workers route patterns (`api.example.com/users/*`), parsed and
+ * matched per Cloudflare's rules: an optional `http://` / `https://` scheme,
+ * an optional leading `*` on the host (zero or more of any character), an
+ * optional trailing `*` on the path, case-insensitive hosts, case-sensitive
+ * paths, and the most specific matching pattern wins.
+ *
+ * `parseRoutePattern` and `matchRoute` are self-contained function
+ * declarations on purpose: the local edge router embeds their source
+ * verbatim (see {@link routeMatcherSource}).
+ */
+
+export interface ParsedRoutePattern {
+  /** Lowercased host, without the leading `*` of a wildcard host. */
+  readonly host: string;
+  readonly hostWildcard: boolean;
+  /** Path, without the trailing `*` of a prefix path. */
+  readonly path: string;
+  readonly pathWildcard: boolean;
+  readonly scheme: "http" | "https" | undefined;
+}
+
+export function parseRoutePattern(pattern: string): ParsedRoutePattern {
+  const scheme = /^(https?):\/\//i.exec(pattern)?.[1]?.toLowerCase() as
+    | "http"
+    | "https"
+    | undefined;
+  const bare = pattern.replace(/^https?:\/\//i, "");
+  const slash = bare.indexOf("/");
+  const host = (slash < 0 ? bare : bare.slice(0, slash)).toLowerCase();
+  const path = slash < 0 ? "/*" : bare.slice(slash);
+  return {
+    host: host.startsWith("*") ? host.slice(1) : host,
+    hostWildcard: host.startsWith("*"),
+    path: path.endsWith("*") ? path.slice(0, -1) : path,
+    pathWildcard: path.endsWith("*"),
+    scheme,
+  };
+}
+
+/**
+ * The most specific route whose pattern matches `host` + `path`: an exact
+ * host beats a wildcard host, then the longer host, then the longer path,
+ * then an exact path beats a prefix.
+ */
+export function matchRoute<R extends { readonly pattern: string }>(
+  routes: ReadonlyArray<R>,
+  host: string,
+  path: string,
+): R | undefined {
+  const lowerHost = host.toLowerCase();
+  let best: R | undefined;
+  let bestScore: number[] = [];
+  for (const route of routes) {
+    const p = parseRoutePattern(route.pattern);
+    const hostMatches = p.hostWildcard ? lowerHost.endsWith(p.host) : lowerHost === p.host;
+    const pathMatches = p.pathWildcard ? path.startsWith(p.path) : path === p.path;
+    if (!hostMatches || !pathMatches) continue;
+    const score = [p.hostWildcard ? 0 : 1, p.host.length, p.path.length, p.pathWildcard ? 0 : 1];
+    let cmp = best === undefined ? 1 : 0;
+    for (let i = 0; cmp === 0 && i < score.length; i++) {
+      cmp = score[i]! - bestScore[i]!;
+    }
+    if (cmp > 0) {
+      best = route;
+      bestScore = score;
+    }
+  }
+  return best;
+}
+
+/** Source of the matcher, for embedding in a generated worker module. */
+export const routeMatcherSource = () => `${parseRoutePattern.toString()}\n${matchRoute.toString()}`;
+
+/** The literal hostname of a pattern, or `undefined` for a wildcard host. */
+export const routePatternHost = (pattern: string): string | undefined => {
+  const parsed = parseRoutePattern(pattern);
+  return parsed.hostWildcard ? undefined : parsed.host;
+};
+
+/** Whether a pattern's host component matches `host`. */
+export const routePatternMatchesHost = (pattern: string, host: string): boolean => {
+  const parsed = parseRoutePattern(pattern);
+  const lower = host.toLowerCase();
+  return parsed.hostWildcard ? lower.endsWith(parsed.host) : lower === parsed.host;
+};
+
+/**
+ * The deployed origin a pattern serves (`https://api.example.com`), or
+ * `undefined` for a wildcard host.
+ */
+export const routePatternUrl = (pattern: string): string | undefined => {
+  const parsed = parseRoutePattern(pattern);
+  return parsed.hostWildcard ? undefined : `${parsed.scheme ?? "https"}://${parsed.host}`;
+};

package/src/Cloudflare/Workers/Rpc.ts

@@ -57,6 +57,7 @@ export const makeRpcStub = <Shape>(
       return (...args: any[]) =>
         asEffectOrStream(
           Effect.gen(function* () {
+            // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- untyped lazy stub source
             const stub = isLazy ? yield* stubSource as Effect.Effect<any> : stubSource;
             return yield* Effect.tryPromise({
               try: () => (stub as any)[prop](...args),