alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/Cloudflare/Workers/Worker.ts

@@ -4,6 +4,7 @@ import type { ConfigError } from "effect/Config";
 import * as Effect from "effect/Effect";
 import type * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
+import path from "pathe";
 import { type MemoOptions } from "../../Command/Memo.ts";
 import type { Dependencies } from "../../Dependencies.ts";
 import type { InputProps } from "../../Input.ts";
@@ -27,6 +28,7 @@ import {
 import type { Rpc } from "../../Rpc.ts";
 import type { RuntimeContext } from "../../RuntimeContext.ts";
 import type { Self as SelfService } from "../../Self.ts";
+import { isPathWithin } from "../../Util/isPathWithin.ts";
 import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Container } from "../Containers/Container.ts";
 import type { DevContainerImage } from "../Containers/ContainerApplication.ts";
@@ -81,6 +83,22 @@ export interface WorkerCache extends Exclude<
   undefined
 > {}
 
+/**
+ * Per-entrypoint settings for one of a Worker's exports, keyed in
+ * {@link WorkerProps.entrypoints} by export name.
+ */
+export interface WorkerEntrypointSettings {
+  /**
+   * Workers Cache override for this entrypoint. `enabled` replaces the
+   * Worker-wide `cache.enabled` for calls into this entrypoint only;
+   * `crossVersionCache` stays Worker-wide.
+   */
+  cache?: {
+    /** Whether Workers Cache is checked before invoking this entrypoint. */
+    enabled: boolean;
+  };
+}
+
 export type WorkerPlacement = Exclude<workers.PutScriptRequest["metadata"]["placement"], undefined>;
 
 export type WorkerServices =
@@ -333,8 +351,8 @@ export interface WorkerVersionAffinity {
  *
  * A gradual rollout carries only what a version can: code, static assets,
  * bindings, compatibility settings, and cache configuration. A deploy that
- * changes Durable Object class migrations must go out at
- * 100% (migrations cannot ride a rollout), and script-level settings
+ * creates, renames, deletes or moves Durable Object classes must go out at
+ * 100% (class lifecycle changes cannot ride a rollout), and script-level settings
  * (tags, observability, limits, placement, logpush) keep their live
  * values until the next full deploy.
  */
@@ -639,6 +657,11 @@ export interface WorkerProps<
    * If omitted, defaults to `{ enabled: true, logs: { enabled: true,
    * invocationLogs: true } }`. Traces are off by default — opt in via
    * `traces: { enabled: true, ... }`.
+   *
+   * Set `issues: { enabled: true }` to enable Workers Issues error detection
+   * across full deployments. Setting it to `false` or omitting `issues`
+   * disables Issues on the next full deployment. Version-only uploads and
+   * gradual rollouts keep the parent's live observability settings.
    */
   observability?: WorkerObservability;
   /**
@@ -661,6 +684,24 @@ export interface WorkerProps<
    * @see https://blog.cloudflare.com/workers-cache/
    */
   cache?: WorkerCache;
+  /**
+   * Per-entrypoint settings, keyed by export name: `default` for the
+   * default export, or the class name of a named `WorkerEntrypoint`.
+   * Entrypoints you leave out inherit the Worker-wide settings.
+   *
+   * Today the only setting is `cache`: a per-entrypoint `cache.enabled`
+   * overrides the Worker-wide {@link cache} for that entrypoint. Workers
+   * Cache only applies to `fetch()` invocations (including loopback calls
+   * through `ctx.exports`); custom RPC methods always bypass it.
+   *
+   * Names must not collide with Durable Object classes hosted by this
+   * Worker.
+   *
+   * Previews upload their own settings, and the versions of a gradual
+   * rollout may differ. `alchemy dev` does not emulate Workers Cache:
+   * locally, every entrypoint runs on every request.
+   */
+  entrypoints?: Record<string, WorkerEntrypointSettings>;
   tags?: string[];
   /**
    * Path to the Worker's entry module. Bundled with rolldown before
@@ -831,6 +872,11 @@ export interface WorkerProps<
    * `routes` array — provide `zoneName` or `zoneId` (or `zone`) alongside each
    * `pattern`. When the zone is omitted, it is inferred from the pattern's
    * hostname.
+   *
+   * `alchemy dev` emulates zone routing locally: a Worker whose custom
+   * {@link domain} matches a route's hostname serves the routes on its own
+   * dev URL, and each route's `url` attribute is a local listener for its
+   * hostname.
    */
   routes?: WorkerRouteConfig[];
   /**
@@ -1144,7 +1190,12 @@ export type Worker<Bindings = any> = Resource<
     tags: string[] | undefined;
     durableObjectNamespaces: Record<string, string>;
     accountId: string;
-    routes: { id: string; pattern: string; zoneId: string }[];
+    /**
+     * The zone routes attached to this Worker. `url` is the origin serving
+     * the route's hostname — `https://<host>` when deployed, the local edge
+     * listener under `alchemy dev` — and `undefined` for a wildcard host.
+     */
+    routes: { id: string; pattern: string; zoneId: string; url?: string }[];
     crons: string[];
     /**
      * The tail consumers attached to this Worker's script — each entry the
@@ -1267,6 +1318,13 @@ export type Worker<Bindings = any> = Resource<
     observability?: Pick<WorkerObservability, "traces">;
     containers?: {
       className: string;
+      /** Set when an async `Cloudflare.DurableObject(name, { containers })` binding contributed the row. */
+      attachedBy?: "binding";
+      /** Application name and prepared images for the native container API. */
+      name?: string;
+      images?: Record<string, string>;
+      /** Named image sources for local workerd. An empty map enables managed images. */
+      devImages?: Record<string, DevContainerImage>;
       dev: DevContainerImage | undefined;
       /**
        * Content hash of the image (bundle/Dockerfile/context). Part of the
@@ -1396,6 +1454,10 @@ export const isSelfUrl = (value: unknown): value is URLEffect =>
  * name at upload, and local dev serves it with the runtime's in-process
  * self service.
  *
+ * `Self` targets the Worker's default export. To bind one of its named
+ * `WorkerEntrypoint` classes instead, name it with
+ * `Cloudflare.WorkerEntrypoint("McpEntrypoint")`.
+ *
  * The canonical consumer is OpenNext's `WORKER_SELF_REFERENCE` (the ISR
  * revalidation queue re-fetches the worker through it):
  *
@@ -1562,6 +1624,8 @@ export const isSelf = (value: unknown): value is Self =>
  *   main: "./src/caller.ts",
  *   env: {
  *     API: Cloudflare.WorkerEntrypoint(target, "Api"), // env.API.greet("alice")
+ *     // one of this Worker's own entrypoints
+ *     MCP: Cloudflare.WorkerEntrypoint("McpEntrypoint"),
  *   },
  * });
  * ```
@@ -1719,6 +1783,31 @@ export const isSelf = (value: unknown): value is Self =>
  * ) {}
  * ```
  *
+ * **Example:** Binding a Worker to itself
+ *
+ * Declare the class before `.make()` so the implementation can reference it.
+ * The self binding uses workerd's `ctx.exports` loopback, so nothing is
+ * added to the Worker's deployed bindings.
+ * ```typescript
+ * export class Greeter extends Cloudflare.Worker<
+ *   Greeter,
+ *   { greet: (name: string) => Effect.Effect<string> }
+ * >()("Greeter") {}
+ *
+ * export default Greeter.make(
+ *   { main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const self = yield* Cloudflare.Workers.bindWorker(Greeter);
+ *     return {
+ *       greet: (name: string) => Effect.succeed(`Hello ${name}`),
+ *       fetch: Effect.gen(function* () {
+ *         return HttpServerResponse.text(yield* self.greet("world"));
+ *       }),
+ *     };
+ *   }),
+ * );
+ * ```
+ *
  * ### Configuration
  * The props object controls compatibility flags, static assets, and
  * build options. These are evaluated at deploy time.
@@ -1788,6 +1877,28 @@ export const isSelf = (value: unknown): value is Self =>
  * }
  * ```
  *
+ * **Example:** Federating one hostname across Workers
+ * Routes take precedence over custom domains, so one Worker can own the
+ * hostname while others claim paths under it — no gateway Worker in the
+ * request path, and each Worker binds only what its paths need. `alchemy
+ * dev` applies the same routing on the custom-domain Worker's local URL.
+ * ```typescript
+ * const home = yield* Cloudflare.Worker("Home", {
+ *   main: "./src/home.ts",
+ *   domain: "api.example.com",
+ * });
+ * yield* Cloudflare.Worker("Products", {
+ *   main: "./src/products.ts",
+ *   routes: [{ pattern: "api.example.com/products*" }],
+ * });
+ * yield* Cloudflare.Worker("Orders", {
+ *   main: "./src/orders.ts",
+ *   routes: [{ pattern: "api.example.com/orders*" }],
+ * });
+ * // https://api.example.com/orders/1 runs Orders; /about runs Home.
+ * return { url: home.url };
+ * ```
+ *
  * **Example:** Deploying a prebuilt Worker without bundling
  * When `main` already points at a complete, runtime-ready ESM bundle
  * produced by an external tool (e.g. OpenNext), set `bundle: false` to
@@ -2085,6 +2196,23 @@ export const isSelf = (value: unknown): value is Self =>
  * }
  * ```
  *
+ * **Example:** Enabling Workers Issues
+ * ```typescript
+ * const worker = yield* Cloudflare.Worker("Api", {
+ *   main: "./src/worker.ts",
+ *   observability: {
+ *     issues: { enabled: true },
+ *   },
+ * });
+ * ```
+ *
+ * Workers Issues groups recurring failures in the Cloudflare dashboard.
+ * Alchemy includes the flag in upload metadata and reconciles it through
+ * script settings after a full deployment so it survives redeploys. Set
+ * `issues.enabled` to `false` or remove `issues` to disable detection.
+ * Configure logs and traces alongside `issues` when you need those channels.
+ * Version-only uploads and gradual rollouts retain the parent's settings.
+ *
  * ### Tail Workers
  * A [Tail Worker](https://developers.cloudflare.com/workers/observability/logs/tail-workers/)
  * receives execution traces (console logs, exceptions, event metadata) from
@@ -2178,6 +2306,41 @@ export const isSelf = (value: unknown): value is Self =>
  * }
  * ```
  *
+ * **Example:** Caching one entrypoint behind an uncached gateway
+ * ```typescript
+ * // alchemy.run.ts
+ * const api = yield* Cloudflare.Worker("Api", {
+ *   main: "./src/worker.ts",
+ *   entrypoints: {
+ *     default: { cache: { enabled: false } },
+ *     Public: { cache: { enabled: true } },
+ *   },
+ * });
+ * ```
+ *
+ * ```typescript
+ * // src/worker.ts
+ * import { WorkerEntrypoint } from "cloudflare:workers";
+ *
+ * export class Public extends WorkerEntrypoint {
+ *   async fetch() {
+ *     return new Response("hello", {
+ *       headers: { "Cache-Control": "public, max-age=300" },
+ *     });
+ *   }
+ * }
+ *
+ * export default {
+ *   // the gateway runs on every request, then forwards to the cached entrypoint
+ *   async fetch(request: Request, env: unknown, ctx: ExecutionContext) {
+ *     if (!request.headers.get("authorization")) {
+ *       return new Response("unauthorized", { status: 401 });
+ *     }
+ *     return ctx.exports.Public.fetch(request);
+ *   },
+ * };
+ * ```
+ *
  * ### Background Work & Scopes
  * Each incoming event (fetch, RPC call, scheduled run) gets its own Effect
  * `Scope`. When the handler finishes, the bridge closes that scope and
@@ -2317,10 +2480,9 @@ export const isSelf = (value: unknown): value is Self =>
  *
  * ### Containers
  * Containers run long-lived processes alongside Durable Objects.
- * Provide `Cloudflare.Containers.layer(Sandbox, …)` on a DO's constructor to
- * bind, start, and monitor the container; then `yield* Sandbox`
- * resolves the **running** instance. Call its typed methods or use
- * `getTcpPort` to make HTTP requests to its exposed ports.
+ * `yield* Sandbox` binds the container to the DO and returns its handle
+ * without starting it. Call `start()` (a no-op once running) before using
+ * its typed methods or `getTcpPort`.
  *
  * **Example:** Running a Container from a Durable Object
  * ```typescript
@@ -2330,10 +2492,12 @@ export const isSelf = (value: unknown): value is Self =>
  *     const sandbox = yield* Sandbox;
  *
  *     return Effect.gen(function* () {
+ *       const start = sandbox.start({ enableInternet: true });
  *       return {
- *         exec: (cmd: string) => sandbox.exec(cmd),
+ *         shell: (cmd: string) => start.pipe(Effect.andThen(sandbox.shell(cmd))),
  *         health: () =>
  *           Effect.gen(function* () {
+ *             yield* start;
  *             const { fetch } = yield* sandbox.getTcpPort(3000);
  *             const res = yield* fetch(
  *               HttpClientRequest.get("http://container/health"),
@@ -2342,11 +2506,7 @@ export const isSelf = (value: unknown): value is Self =>
  *           }),
  *       };
  *     });
- *   }).pipe(
- *     Effect.provide(
- *       Cloudflare.Containers.layer(Sandbox, { enableInternet: true }),
- *     ),
- *   ),
+ *   }),
  * ) {}
  * ```
  *
@@ -2519,6 +2679,27 @@ export const Worker: ResourceClassLike<Worker> &
     // WorkerAsyncBindings imports isWorker; defer access until module initialization completes.
     onCreate: (resource, props) => bindWorkerAsyncBindings(resource as Worker, props),
     createRuntimeContext: (id) => makeWorkerRuntimeContext(id),
+    transformProps: (_id, props) =>
+      Effect.sync(() =>
+        globalThis.__ALCHEMY_RUNTIME__ || typeof props.main !== "string"
+          ? props
+          : { ...props, main: relativeWorkerMain(props.main, process.cwd()) },
+      ),
   },
   { URL },
 );
+
+/**
+ * `main` as a path relative to `cwd` when it points inside `cwd`. State keeps
+ * the Worker's props and `alchemy drift` rebuilds the bundle from them, so an
+ * absolute `main` (such as `import.meta.url`) fails once the checkout that
+ * deployed it moves or is removed. Paths outside `cwd` are kept as given.
+ *
+ * @internal exported for unit testing.
+ */
+export const relativeWorkerMain = (main: string, cwd: string): string => {
+  const file = main.startsWith("file:")
+    ? decodeURIComponent(new globalThis.URL(main).pathname)
+    : main;
+  return path.isAbsolute(file) && isPathWithin(cwd, file, cwd) ? path.relative(cwd, file) : main;
+};

package/src/Cloudflare/Workers/WorkerAsyncBindings.ts

@@ -19,13 +19,24 @@ import { isDataset } from "../AnalyticsEngine/Dataset.ts";
 import { isNamespace } from "../Artifacts/Namespace.ts";
 import type { Container } from "../Containers/Container.ts";
 import type { ContainerApplication } from "../Containers/ContainerApplication.ts";
+import {
+  containerApplicationSettings,
+  DurableObjectContainerBindingError,
+  durableObjectContainerBinding,
+  isDurableObjectContainerResource,
+  workerContainerBinding,
+} from "../Containers/ContainerConfiguration.ts";
+import { declareDurableObjectApplication } from "../Containers/DurableObjectApplication.ts";
 import { isDatabase } from "../D1/Database.ts";
 import { isSendEmail } from "../Email/SendEmail.ts";
 import { isApp } from "../Flagship/App.ts";
-import { getHyperdriveDevOrigin } from "../Hyperdrive/ConnectBinding.ts";
+import { getHyperdriveDevOriginForHost } from "../Hyperdrive/ConnectBinding.ts";
 import { isHyperdriveConnection } from "../Hyperdrive/Connection.ts";
 import { isImages } from "../Images/Images.ts";
+import { isStream as isK2Stream } from "../K2/Stream.ts";
+import { isInstantNamespace } from "../KV/InstantNamespace.ts";
 import { isNamespace as isKVNamespace } from "../KV/Namespace.ts";
+import { isMtlsCertificate } from "../MtlsCertificate/MtlsCertificate.ts";
 import { isLegacyPipeline } from "../Pipelines/LegacyPipeline.ts";
 import { isStream as isPipelinesStream } from "../Pipelines/Stream.ts";
 import { isQueue } from "../Queues/Queue.ts";
@@ -44,7 +55,11 @@ import { isAI } from "./AI.ts";
 import { isAssets } from "./Assets.ts";
 import { isBinding as isWorkerOnlyBinding } from "./Binding.ts";
 import { isBrowser } from "./Browser.ts";
-import { isDurableObjectLike, normalizeTransferredFrom } from "./DurableObject.ts";
+import {
+  type DurableObjectLike,
+  isDurableObjectLike,
+  normalizeTransferredFrom,
+} from "./DurableObject.ts";
 import { isRateLimit } from "./RateLimit.ts";
 import { isSecretKey } from "./SecretKey.ts";
 import { isVersionMetadata } from "./VersionMetadata.ts";
@@ -260,10 +275,18 @@ export const bindWorkerAsyncBindings = Effect.fn(function* (
           } satisfies WorkflowBinding;
         }
 
+        // Durable Object-managed Containers attached to a hosted class. Both
+        // halves describe this env entry, so they share its `sid`.
+        const containers =
+          isDurableObjectLike(binding) && binding.containers?.length
+            ? yield* bindDurableObjectContainers(resource, bindingName, binding)
+            : undefined;
+
         yield* resource.bind`${bindingName}`({
           bindings: [resolvedBindingMeta],
+          containers,
           hyperdrives: isHyperdriveConnection(binding)
-            ? getHyperdriveDevOrigin(binding)
+            ? yield* getHyperdriveDevOriginForHost(binding, resource)
             : undefined,
           // Dev-only local-emulation opt-out channel (like `hyperdrives`):
           // worker-only bindings and `SendEmail` descriptors piped through
@@ -313,8 +336,11 @@ const isContainerApplicationResource = (value: unknown): value is ContainerAppli
   (value as { Type?: unknown }).Type === "Cloudflare.Container";
 
 /**
- * Wire a Container bound directly on an async Worker's `env`
- * (`env: { Sandbox: Cloudflare.Container("Sandbox", { image }) }`). Mirrors
+ * Wire a fleet Container bound directly on an async Worker's `env`
+ * (`env: { Sandbox: Cloudflare.Container("Sandbox", { image }) }`). A
+ * Durable Object-managed Container fails with
+ * {@link DurableObjectContainerBindingError}: it attaches through
+ * `Cloudflare.DurableObject(className, { containers })` instead. Mirrors
  * v1 alchemy, where a Container binding is a Durable Object namespace plus
  * its ContainerApplication in one declaration:
  *
@@ -354,6 +380,14 @@ const bindContainerClass = Effect.fn(function* (
       `Worker binding '${bindingName}' is a Container without a deployable image. Declare the container with props (image, or context/dockerfile) to bind it on an async Worker — effectful (main) containers require an Effect-native Durable Object host.`,
     );
   }
+  if (isDurableObjectContainerResource(application)) {
+    return yield* Effect.die(
+      new DurableObjectContainerBindingError({
+        bindingName,
+        message: `Worker binding '${bindingName}' is a Durable Object-managed Container ('${application.LogicalId}'). Attach it to the Durable Object class that starts it: env: { ${bindingName}: Cloudflare.DurableObject("${className}", { containers: [${application.LogicalId}] }) }.`,
+      }),
+    );
+  }
   // Both halves of the Worker's side describe the same env entry, so they
   // share one `sid`. Binding rows are collapsed by sid (last write wins), so
   // splitting them across two `bind` calls silently drops the namespace
@@ -369,13 +403,7 @@ const bindContainerClass = Effect.fn(function* (
         className,
       },
     ],
-    containers: [
-      {
-        className,
-        dev: application.dev,
-        hash: application.hash.pipe(Output.map((h) => h?.image)),
-      },
-    ],
+    containers: [workerContainerBinding(className, application)],
   });
   yield* application.bind`${bindingName}`({
     durableObjects: {
@@ -386,6 +414,67 @@ const bindContainerClass = Effect.fn(function* (
   });
 });
 
+/**
+ * Binding mistakes die with a {@link DurableObjectContainerBindingError}: the
+ * Worker declaration hook cannot fail, and these are programmer errors.
+ *
+ * Attach the Durable Object-managed Containers of
+ * `Cloudflare.DurableObject(className, { containers })` to the class: each
+ * adds its image to the class's one container application (declared once per
+ * class, deduped by id) and returns the Worker's `containers` row for it. The
+ * same machinery as an Effect-native Durable Object's `yield* Container`.
+ */
+const bindDurableObjectContainers = Effect.fn(function* (
+  resource: Worker,
+  bindingName: string,
+  binding: DurableObjectLike,
+) {
+  const className = binding.className ?? binding.name;
+  if (binding.scriptName !== undefined) {
+    return yield* Effect.die(
+      new DurableObjectContainerBindingError({
+        bindingName,
+        message: `Worker binding '${bindingName}' attaches containers to Durable Object class '${className}' hosted by another Worker. Attach containers where the class is hosted.`,
+      }),
+    );
+  }
+  const classApplication = yield* declareDurableObjectApplication(resource, className);
+  const namespaceId = resource.durableObjectNamespaces.pipe(
+    Output.map((namespaces) => namespaces?.[className]),
+  );
+  const rows = [];
+  for (const decl of binding.containers ?? []) {
+    const declaration = (decl as { Application?: unknown }).Application;
+    const application =
+      isYieldableEffectLike(declaration) && !Output.isOutput(declaration)
+        ? yield* declaration as Effect.Effect<unknown>
+        : undefined;
+    if (
+      !isContainerApplicationResource(application) ||
+      !isDurableObjectContainerResource(application)
+    ) {
+      return yield* Effect.die(
+        new DurableObjectContainerBindingError({
+          bindingName,
+          message: `Cloudflare.DurableObject("${className}", { containers }) lists a Container that is not Durable Object-managed. Declare it with schedulingPolicy: "durable_object" and an image source (image, or context/dockerfile).`,
+        }),
+      );
+    }
+    yield* classApplication.bind`${application.LogicalId}`({
+      durableObjects: { namespaceId },
+      container: {
+        id: application.LogicalId,
+        settings: containerApplicationSettings(application),
+      },
+    });
+    rows.push({
+      ...durableObjectContainerBinding(className, classApplication, application),
+      attachedBy: "binding" as const,
+    });
+  }
+  return rows;
+});
+
 type BindingSpec = InputProps<WorkerBinding>;
 
 /**
@@ -524,6 +613,13 @@ const toBinding = (
       name: bindingName,
       serviceId: binding.serviceId,
     };
+  } else if (isMtlsCertificate(binding)) {
+    // `env.NAME` is a Fetcher whose subrequests present the certificate.
+    return {
+      type: "mtls_certificate",
+      name: bindingName,
+      certificateId: binding.mtlsCertificateId,
+    };
   } else if (isDatabase(binding)) {
     return {
       type: "d1",
@@ -539,7 +635,7 @@ const toBinding = (
         Output.map((jurisdiction) => (jurisdiction === "default" ? undefined : jurisdiction)),
       ),
     };
-  } else if (isKVNamespace(binding)) {
+  } else if (isKVNamespace(binding) || isInstantNamespace(binding)) {
     return {
       type: "kv_namespace",
       name: bindingName,
@@ -597,6 +693,15 @@ const toBinding = (
     // A named-entrypoint service binding (`Cloudflare.WorkerEntrypoint`).
     // Tested BEFORE `isWorker` — the marker carries the Worker rather than
     // being one, but keep the specific classifier ahead of the general one.
+    if (binding.worker === undefined) {
+      // One of this Worker's own named entrypoints: lowered like `Self`.
+      return {
+        type: "self_service",
+        name: bindingName,
+        entrypoint: binding.entrypoint,
+        props: binding.props,
+      };
+    }
     return {
       type: "service",
       name: bindingName,
@@ -660,6 +765,12 @@ const toBinding = (
       name: bindingName,
       pipeline: binding.name,
     };
+  } else if (isK2Stream(binding)) {
+    return {
+      type: "k2",
+      name: bindingName,
+      stream: binding.streamId,
+    };
   } else if (Output.isOutput(binding)) {
     return Output.map(binding, (value: Json | Redacted.Redacted<Json> | VpcServiceLookup) =>
       // A `VpcService.lookup(...)` data source resolves to the service's

package/src/Cloudflare/Workers/WorkerBinding.ts

@@ -17,7 +17,10 @@ import { SendEmail } from "../Email/SendEmail.ts";
 import type { App as FlagshipApp } from "../Flagship/App.ts";
 import type { Connection as Hyperdrive } from "../Hyperdrive/Connection.ts";
 import type { ImagesBinding } from "../Images/ImagesBinding.ts";
+import type { Stream as K2Stream } from "../K2/Stream.ts";
+import type { InstantNamespace } from "../KV/InstantNamespace.ts";
 import type { Namespace } from "../KV/Namespace.ts";
+import type { MtlsCertificate } from "../MtlsCertificate/MtlsCertificate.ts";
 import type { LegacyPipeline } from "../Pipelines/LegacyPipeline.ts";
 import type { Stream as PipelinesStream } from "../Pipelines/Stream.ts";
 import type { Queue } from "../Queues/Queue.ts";
@@ -34,6 +37,7 @@ import type { AIBinding } from "./AIBinding.ts";
 import type { Assets } from "./Assets.ts";
 import type { AnyBindingEffect } from "./Binding.ts";
 import type { BrowserBinding } from "./BrowserBinding.ts";
+import cloudflare_workers from "./cloudflare_workers.ts";
 import type { DurableObjectLike } from "./DurableObject.ts";
 import type { RateLimitBinding } from "./RateLimitBinding.ts";
 import { makeRpcStub } from "./Rpc.ts";
@@ -89,6 +93,10 @@ export interface SelfUrlWorkerBinding {
 export interface SelfServiceWorkerBinding {
   type: "self_service";
   name: string;
+  /** Named `WorkerEntrypoint` class to target; omitted → default export. */
+  entrypoint?: string;
+  /** `ctx.props` delivered to the entrypoint. */
+  props?: Record<string, unknown>;
 }
 
 /**
@@ -128,6 +136,12 @@ export type QueueWorkerBinding = Extract<DistilledWorkerBinding, { type: "queue"
   };
 };
 
+/**
+ * The `k2` metadata binding: produce-only access to a K2 stream, by stream
+ * id (`Cloudflare.K2.WriteStreamBinding`, or a `K2.Stream` in `env`).
+ */
+export type K2WorkerBinding = Extract<DistilledWorkerBinding, { type: "k2" }>;
+
 /**
  * The `service` metadata binding extended with workerd's `ctx.props`.
  * `props` is what a `Cloudflare.WorkerEntrypoint(worker, { props })` env
@@ -198,6 +212,7 @@ export type WorkerBindingResource =
   | S3Credentials
   | D1Database
   | Namespace
+  | InstantNamespace
   | Queue
   | AiGateway
   | AIBinding
@@ -214,6 +229,7 @@ export type WorkerBindingResource =
   | StreamBinding
   | PipelinesStream
   | LegacyPipeline
+  | K2Stream
   | Hyperdrive
   | VectorizeIndex
   | Secret
@@ -230,6 +246,8 @@ export type WorkerBindingResource =
   | WorkflowLike<any>
   | VpcService
   | VpcServiceLookup
+  // An account-level mTLS certificate becomes an `mtls_certificate` binding.
+  | MtlsCertificate
   // A Container bound directly in `env` declares a container-backed Durable
   // Object class (DO namespace binding + ContainerApplication in one).
   | Container.Decl.Any;
@@ -238,14 +256,39 @@ export type WorkerBindings = {
   [bindingName in string]: WorkerBindingResource;
 };
 
+/**
+ * Whether `target` names the Worker being constructed. A Worker class only
+ * carries its static `LogicalId` (one logical id is one resource within a
+ * stack); a resolved resource carries its full `FQN`, so a `Worker.ref` to
+ * the same logical id in another stack or stage is not the host.
+ */
+const isHostWorker = (target: unknown, host: Worker): boolean => {
+  if (typeof target !== "function" && (typeof target !== "object" || target === null)) {
+    return false;
+  }
+  if ("FQN" in target) return target.FQN === host.FQN;
+  return "LogicalId" in target && target.LogicalId === host.LogicalId;
+};
+
 export const bindWorker = Effect.fn(function* <Shape, Req = never>(
   workerEff: (Worker & Rpc<Shape>) | Effect.Effect<Worker & Rpc<Shape>, never, Req>,
 ) {
+  const self = yield* Worker;
+  if (isHostWorker(workerEff, self)) {
+    // A Worker binding itself. Yielding its own class here would wait on
+    // its own construction, and a service binding naming its own script is
+    // unnecessary: workerd's `ctx.exports.default` is a loopback to this
+    // Worker's default entrypoint, so nothing is deployed for the binding.
+    return makeRpcStub<Shape>(
+      cloudflare_workers.pipe(
+        Effect.map(({ exports }) => (exports as Record<string, unknown>).default),
+      ),
+    );
+  }
   // Worker classes and regular Effects are both yieldable here.
   const worker = isYieldableEffectLike(workerEff)
     ? yield* workerEff as Effect.Effect<Worker & Rpc<Shape>, never, Req>
     : workerEff;
-  const self = yield* Worker;
   yield* self.bind`${worker}`({
     bindings: [
       {