lopata 0.18.4 → 0.19.0

package/src/bindings/do-executor-worker.ts

@@ -6,42 +6,47 @@
  */
 
 import { dirname, resolve } from 'node:path'
+import type { WranglerConfig } from '../config'
+import type {
+	DOCommand,
+	DOMainMessage,
+	DoReqStreamChunk,
+	DoReqStreamEnd,
+	DoReqStreamError,
+	DOResult,
+	DOWorkerMessage,
+} from '../worker-thread/do-protocol'
+import type { BindingTarget, RpcReply } from '../worker-thread/protocol'
+import { deserializeError } from '../worker-thread/protocol'
+import { RpcHostChannel } from '../worker-thread/rpc-shared'
+import { OutboundStreamRegistry, pumpStream, STREAM_BACKPRESSURE_WINDOW, StreamReceiver } from '../worker-thread/stream-shared'
+import { WsHostBridge } from '../worker-thread/ws-bridge-shared'
+import { registerContainer, unregisterContainer } from './container-cleanup'
 import type { DOExecutor, DOExecutorFactory, ExecutorConfig } from './do-executor'
-import type { WsBridgeOutbound } from './do-websocket-bridge'
-
-// --- Message protocol ---
-
-/** Commands sent from main thread to worker */
-export type DOCommand =
-	| { type: 'fetch'; url: string; method: string; headers: [string, string][]; body: ArrayBuffer | null }
-	| { type: 'rpc-call'; method: string; args: unknown[] }
-	| { type: 'rpc-get'; prop: string }
-	| { type: 'alarm'; retryCount: number }
-	| { type: 'ws-create'; wsId: string }
-
-/** Results returned from worker to main thread */
-export type DOResult =
-	| { type: 'fetch'; status: number; statusText: string; headers: [string, string][]; body: ArrayBuffer | null }
-	| { type: 'rpc-call'; value: unknown }
-	| { type: 'rpc-get'; value: unknown }
-	| { type: 'alarm' }
-	| { type: 'ws-created'; wsId: string }
-	| { type: 'error'; message: string; stack?: string; name?: string }
-
-/** Messages from main thread → worker */
-export type DOWorkerMessage =
-	| { type: 'command'; id: number; command: DOCommand }
-	| { type: 'ws-message'; wsId: string; data: string | ArrayBuffer }
-	| { type: 'ws-close'; wsId: string; code: number; reason: string; wasClean: boolean }
-	| { type: 'ws-error'; wsId: string }
-
-/** Messages from worker → main thread */
-export type DOMainMessage =
-	| { type: 'need-init' }
-	| { type: 'ready' }
-	| { type: 'result'; id: number; result: DOResult }
-	| { type: 'alarm-set'; time: number | null }
-	| { type: 'ws-bridge'; payload: WsBridgeOutbound }
+import { DurableObjectIdImpl } from './durable-object'
+import { CFWebSocket, type ResponseWithWebSocket } from './websocket-pair'
+
+// The DO-channel message protocol (DOCommand / DOResult / DOWorkerMessage /
+// DOMainMessage / Do*Stream* / WsAcceptSignal) lives in
+// `worker-thread/do-protocol.ts`, beside the user-worker channel's `protocol.ts`.
+// Re-exported here so existing `import … from './do-executor-worker'` sites keep
+// working.
+export type {
+	DOCommand,
+	DOMainMessage,
+	DoReqStreamAck,
+	DoReqStreamCancel,
+	DoReqStreamChunk,
+	DoReqStreamEnd,
+	DoReqStreamError,
+	DOResult,
+	DoStreamAck,
+	DoStreamCancel,
+	DoStreamChunk,
+	DoStreamEnd,
+	DoStreamError,
+	DOWorkerMessage,
+} from '../worker-thread/do-protocol'
 
 // --- Pending command tracking ---
 
@@ -59,13 +64,75 @@ export class WorkerExecutor implements DOExecutor {
 	private _worker: Worker | null = null
 	private _ready: Promise<void> | null = null
 	private _readyResolve: (() => void) | null = null
+	private _readyReject: ((err: Error) => void) | null = null
 	private _pending = new Map<number, PendingCommand>()
 	private _nextId = 1
 	private _disposed = false
+	/** Swallowed copy of `_priorDisposal`, created lazily on the first command.
+	 *  Shared so CONCURRENT first commands all await the prior container's
+	 *  teardown — a boolean gate would let the second racer skip straight to
+	 *  `docker run` while the old container's `docker rm` is still in flight. */
+	private _priorDisposalGate: Promise<void> | null = null
 	private _inFlightCount = 0
+	/** Mirrors of the DO worker's `state` lifecycle, fed by `do-state` signals. */
 	private _blocked = false
-	private _wsCount = 0
-	private _bridgedWebSockets = new Map<string, WebSocket>()
+	private _aborted = false
+	/**
+	 * `wsId`s of every open WebSocket this DO's fetch handler returned — both
+	 * hibernation (`state.acceptWebSocket`) and plain (`new WebSocketPair`) ones.
+	 * Each pins the executor against the idle reaper until it closes. Added when
+	 * `executeFetch` registers the bridge socket; removed on the `fetch-ws-close-out`
+	 * dispatch (server-side close) and the `_fetchBridge` clientClose envelope
+	 * (client disconnect) — both delete from the same set so neither double-counts.
+	 */
+	private _openFetchWsIds = new Set<string>()
+	/**
+	 * Main-side WS bridge for `Response{webSocket}` returned by the DO worker's
+	 * fetch handler. The bridge's peer forwards outgoing bytes (Bun.serve → here)
+	 * down to the DO worker as `fetch-ws-incoming` / `fetch-ws-close-in`.
+	 */
+	private _fetchBridge: WsHostBridge<DOWorkerMessage> | null = null
+	/**
+	 * Main-side WS bridge for upstream CFWebSockets adopted from env-binding
+	 * fetches the DO worker initiated (e.g. `this.env.SVC.fetch('/ws')` returning
+	 * a 101). Direction is opposite of `_fetchBridge`: we already hold the real
+	 * CFWebSocket from main's `resolveBinding(...).fetch()`, the DO worker side
+	 * holds the synthetic user-facing peer.
+	 */
+	private _envBindingWsBridge: WsHostBridge<DOWorkerMessage> | null = null
+	/** Main-side host of the unified cross-thread RPC channel — env-binding
+	 *  call/get/fetch from inside the DO worker (`this.env.SVC.…`), with
+	 *  response/request-body streaming. Shared with the user-worker executor;
+	 *  channel-specifics injected as hooks. */
+	private _rpcChannel = new RpcHostChannel({
+		resolveBinding: (target) => this._resolveBinding(target),
+		post: (reply) => {
+			this._worker?.postMessage(reply satisfies RpcReply)
+		},
+		isAlive: () => !this._disposed && this._worker !== null,
+		decorateResponse: (response, serialized) => {
+			const ws = (response as ResponseWithWebSocket).webSocket
+			if (response.status === 101 && ws instanceof CFWebSocket && this._envBindingWsBridge) {
+				serialized.webSocketId = this._envBindingWsBridge.adoptExisting(ws, { bridgeEvents: true })
+			}
+		},
+	})
+	/** Reconstruction of streamed DO-fetch response bodies (DO worker → main). */
+	private _fetchStreams = new StreamReceiver(
+		(streamId) => {
+			this._worker?.postMessage({ type: 'do-stream-cancel', streamId } satisfies DOWorkerMessage)
+		},
+		{
+			window: STREAM_BACKPRESSURE_WINDOW,
+			onCredit: (streamId) => {
+				this._worker?.postMessage({ type: 'do-stream-ack', streamId } satisfies DOWorkerMessage)
+			},
+		},
+	)
+	/** Outbound request-body pumps for DO-fetch (main → DO worker). A
+	 *  `do-req-stream-cancel` from the DO worker (instance code cancelled the
+	 *  body) stops the source reader. */
+	private _fetchRequestStreams = new OutboundStreamRegistry()
 
 	constructor(config: ExecutorConfig) {
 		this._config = config
@@ -78,12 +145,37 @@ export class WorkerExecutor implements DOExecutor {
 		const config = this._config
 		const worker = new Worker(WORKER_ENTRY_PATH)
 
-		this._ready = new Promise<void>((resolve) => {
+		this._ready = new Promise<void>((resolve, reject) => {
 			this._readyResolve = resolve
+			this._readyReject = reject
+		})
+
+		this._fetchBridge = new WsHostBridge<DOWorkerMessage>(msg => worker.postMessage(msg), {
+			clientMessage: (wsId, data) => ({ type: 'fetch-ws-incoming', wsId, data }),
+			clientClose: (wsId, code, reason, wasClean) => {
+				// A real client disconnect ends the WS regardless of whether user code
+				// calls `ws.close()` in its `webSocketClose` handler (that call is
+				// optional in CF). Drop the pin here so it doesn't leak and keep the DO
+				// worker alive past eviction. The matching `fetch-ws-close-out` (when
+				// the server peer also closes) then finds the id already gone and is a
+				// no-op, so this never double-counts.
+				this._openFetchWsIds.delete(wsId)
+				return { type: 'fetch-ws-close-in', wsId, code, reason, wasClean }
+			},
+		})
+		this._envBindingWsBridge = new WsHostBridge<DOWorkerMessage>(msg => worker.postMessage(msg), {
+			clientMessage: (wsId, data) => ({ type: 'env-ws-incoming', wsId, data }),
+			clientClose: (wsId, code, reason, wasClean) => ({ type: 'env-ws-close-in', wsId, code, reason, wasClean }),
 		})
 
 		worker.onmessage = (event: MessageEvent<DOMainMessage>) => {
+			// Drop late messages after dispose/onerror — the shared RPC dispatchers
+			// would otherwise commit side effects (KV write, R2 put, queue send)
+			// from a dying generation before their reply gets filtered by
+			// `hooks.isAlive()`. Mirrors `WorkerThreadExecutor._handleMessage`.
+			if (this._disposed) return
 			const msg = event.data
+			if (this._rpcChannel.handle(msg)) return
 
 			switch (msg.type) {
 				case 'need-init':
@@ -93,6 +185,9 @@ export class WorkerExecutor implements DOExecutor {
 						config: {
 							modulePath: this._resolveModulePath(),
 							configPath: this._resolveConfigPath(),
+							// Main's parsed, env-overridden config — the DO worker uses this
+							// instead of re-loading from configPath WITHOUT the --env overrides.
+							wranglerConfig: this._config._wranglerConfig,
 							dataDir: this._resolveDataDir(),
 							namespaceName: config.namespaceName,
 							idStr: config.id.toString(),
@@ -107,16 +202,12 @@ export class WorkerExecutor implements DOExecutor {
 
 				case 'result': {
 					if (msg.id === -1 && msg.result.type === 'error') {
-						// Worker init error — reject all pending and the ready promise
-						const error = new Error(msg.result.message)
-						if (msg.result.stack) error.stack = msg.result.stack
-						for (const [, pending] of this._pending) {
-							pending.reject(error)
-						}
-						this._pending.clear()
-						// Resolve ready so _sendCommand doesn't hang forever
-						this._readyResolve?.()
-						this._disposed = true
+						// Worker init error — tear down with the real cause so awaiting
+						// callers surface it instead of a generic "Worker terminated"
+						// after `_disposed` flips. The failed thread would otherwise
+						// linger (SQLite handle, container/health timers) until the 30s
+						// idle reaper or next access disposes it.
+						this._teardown(deserializeError(msg.result.error))
 						break
 					}
 					const pending = this._pending.get(msg.id)
@@ -132,19 +223,71 @@ export class WorkerExecutor implements DOExecutor {
 					config.onAlarmSet?.(msg.time)
 					break
 
-				case 'ws-bridge':
-					this._handleWsBridge(msg.payload)
+				case 'do-state':
+					// Mirror the DO instance's abort/block lifecycle so the idle reaper
+					// evicts an aborted instance (→ recreated fresh) and never evicts
+					// mid-blockConcurrencyWhile.
+					this._aborted = msg.aborted
+					this._blocked = msg.blocked
+					break
+
+				case 'fetch-ws-outgoing':
+					this._fetchBridge?.deliverRemoteMessage(msg.wsId, msg.data)
+					break
+
+				case 'fetch-ws-close-out':
+					this._fetchBridge?.deliverRemoteClose(msg.wsId, msg.code, msg.reason, msg.wasClean)
+					this._openFetchWsIds.delete(msg.wsId)
+					break
+
+				case 'env-ws-outgoing':
+					this._envBindingWsBridge?.deliverRemoteMessage(msg.wsId, msg.data)
+					break
+
+				case 'env-ws-close-out':
+					this._envBindingWsBridge?.deliverRemoteClose(msg.wsId, msg.code, msg.reason, msg.wasClean)
+					break
+
+				case 'do-stream-chunk':
+					this._fetchStreams.push(msg.streamId, msg.chunk)
+					break
+
+				case 'do-stream-end':
+					this._fetchStreams.end(msg.streamId)
+					break
+
+				case 'do-stream-error':
+					this._fetchStreams.error(msg.streamId, deserializeError(msg.error))
+					break
+
+				case 'do-req-stream-cancel':
+					this._fetchRequestStreams.cancel(msg.streamId)
+					break
+				case 'do-req-stream-ack':
+					this._fetchRequestStreams.grantCredit(msg.streamId)
+					break
+
+				case 'container-registered':
+					registerContainer(msg.name)
+					break
+
+				case 'container-removed':
+					unregisterContainer(msg.name)
 					break
 			}
 		}
 
-		worker.onerror = (event) => {
-			// Reject all pending commands
-			const error = new Error(`Worker error: ${event.message}`)
-			for (const [id, pending] of this._pending) {
-				pending.reject(error)
-			}
-			this._pending.clear()
+		worker.onerror = (event: ErrorEvent) => {
+			if (this._disposed) return
+			// Mark dead so the namespace drops this executor and recreates a fresh
+			// one on next access (see `isDisposed()` + `_getOrCreateExecutor`),
+			// instead of posting to a terminated Worker (which would hang). An
+			// uncaught worker error does NOT end the thread (Web Worker semantics),
+			// so `_teardown` terminating it here is what prevents the leak (SQLite
+			// handle, container/health timers, WS bridges). Mirrors
+			// WorkerThreadExecutor's onerror → _failAll.
+			const detail = event.error?.stack ?? event.message ?? 'unknown'
+			this._teardown(new Error(`Worker error: ${detail}`))
 		}
 
 		this._worker = worker
@@ -152,19 +295,27 @@ export class WorkerExecutor implements DOExecutor {
 	}
 
 	private _resolveModulePath(): string {
-		return (this._config as any)._modulePath ?? ''
+		return this._config._modulePath ?? ''
 	}
 
 	private _resolveConfigPath(): string {
-		return (this._config as any)._configPath ?? ''
+		return this._config._configPath ?? ''
 	}
 
 	private _resolveDataDir(): string {
 		return this._config.dataDir ?? ''
 	}
 
-	private async _sendCommand(command: DOCommand): Promise<DOResult> {
+	private async _sendCommand(command: DOCommand, afterPost?: () => void): Promise<DOResult> {
 		const worker = this._ensureWorker()
+		// Wait for the prior executor's container teardown (docker rm) before any
+		// command — a container DO's first fetch triggers `docker run` for the
+		// same name, which would otherwise race the teardown. Every command awaits
+		// the shared gate (a settled promise after the first), so concurrent first
+		// commands serialize too. No-op for non-container DOs (`_priorDisposal`
+		// undefined).
+		this._priorDisposalGate ??= this._config._priorDisposal?.catch(() => {}) ?? Promise.resolve()
+		await this._priorDisposalGate
 		await this._ready
 
 		if (this._disposed) throw new Error('Worker terminated')
@@ -177,10 +328,7 @@ export class WorkerExecutor implements DOExecutor {
 				resolve: (result) => {
 					this._inFlightCount--
 					if (result.type === 'error') {
-						const err = new Error(result.message)
-						err.name = result.name ?? 'Error'
-						if (result.stack) err.stack = result.stack
-						reject(err)
+						reject(deserializeError(result.error))
 					} else {
 						resolve(result)
 					}
@@ -190,98 +338,126 @@ export class WorkerExecutor implements DOExecutor {
 					reject(err)
 				},
 			})
-			worker.postMessage({ type: 'command', id, command } satisfies DOWorkerMessage)
-		})
-	}
-
-	private _handleWsBridge(payload: WsBridgeOutbound): void {
-		switch (payload.type) {
-			case 'ws-send': {
-				const ws = this._bridgedWebSockets.get(payload.wsId)
-				if (ws && ws.readyState === 1) {
-					ws.send(payload.data)
-				}
-				break
-			}
-			case 'ws-close': {
-				const ws = this._bridgedWebSockets.get(payload.wsId)
-				if (ws) {
-					ws.close(payload.code, payload.reason)
-					this._bridgedWebSockets.delete(payload.wsId)
-					this._wsCount--
-				}
-				break
+			try {
+				worker.postMessage({ type: 'command', id, command } satisfies DOWorkerMessage)
+				// Runs only AFTER the command is posted, which is after `await this._ready`
+				// — so the DO worker's full message handler is installed (it's set right
+				// before the worker posts `ready`). Starting the request-body pump here
+				// (not synchronously in executeFetch) means its chunks can't race ahead
+				// of `ready` and get dropped by the init-phase handler.
+				afterPost?.()
+			} catch (e) {
+				// A synchronous postMessage throw (DataCloneError on non-cloneable
+				// args) would otherwise leak the pending entry and the `_inFlightCount`
+				// bump, leaving isActive() true forever and exempting the executor from
+				// idle eviction (thread + DB connection pinned until reload).
+				this._pending.delete(id)
+				this._inFlightCount--
+				reject(e instanceof Error ? e : new Error(String(e)))
 			}
-			case 'ws-accept': {
-				// WebSocket was accepted by the DO — increment count
-				this._wsCount++
-				break
-			}
-		}
-	}
-
-	/** Register a real WebSocket for bridging to the worker */
-	_bridgeWebSocket(wsId: string, ws: WebSocket): void {
-		this._bridgedWebSockets.set(wsId, ws)
-
-		// Forward events from real WS to worker
-		ws.addEventListener('message', (event: MessageEvent) => {
-			this._worker?.postMessage(
-				{
-					type: 'ws-message',
-					wsId,
-					data: event.data,
-				} satisfies DOWorkerMessage,
-			)
-		})
-
-		ws.addEventListener('close', (event: CloseEvent) => {
-			this._worker?.postMessage(
-				{
-					type: 'ws-close',
-					wsId,
-					code: event.code,
-					reason: event.reason,
-					wasClean: event.wasClean,
-				} satisfies DOWorkerMessage,
-			)
-			this._bridgedWebSockets.delete(wsId)
-		})
-
-		ws.addEventListener('error', () => {
-			this._worker?.postMessage(
-				{
-					type: 'ws-error',
-					wsId,
-				} satisfies DOWorkerMessage,
-			)
 		})
 	}
 
 	// --- DOExecutor interface ---
 
 	async executeFetch(request: Request): Promise<Response> {
-		// Serialize Request
 		const headers: [string, string][] = []
 		request.headers.forEach((v, k) => headers.push([k, v]))
-		const body = request.body ? await request.arrayBuffer() : null
+		const body = request.body
+		const streamId = body ? this._fetchRequestStreams.allocateId() : undefined
+
+		// The request-body pump starts in `afterPost` — i.e. AFTER `_sendCommand`
+		// has awaited `_ready` and posted the 'fetch' command. On a COLD worker the
+		// init-phase handler drops every message except `init`, so starting the pump
+		// synchronously here (as before) dropped the head chunks — and a dropped
+		// `end` left `await request.text()` hanging forever, pinning the executor.
+		let pumpStarted = false
+		const resultPromise = this._sendCommand(
+			{
+				type: 'fetch',
+				url: request.url,
+				method: request.method,
+				headers,
+				body: null,
+				streamId,
+			},
+			body && streamId !== undefined
+				? () => {
+					pumpStarted = true
+					this._pumpFetchRequestBody(streamId, body)
+				}
+				: undefined,
+		)
+
+		if (body && streamId !== undefined) {
+			// If `resultPromise` rejects (worker disposed before `_ready`, or errored
+			// mid-flight), release the source body: cancel via the registry if the
+			// pump started (the reader is locked there), else cancel the body itself
+			// so it isn't left dangling unread.
+			resultPromise.catch(() => {
+				if (pumpStarted) this._fetchRequestStreams.cancel(streamId)
+				else body.cancel().catch(() => {})
+			})
+		}
 
-		const result = await this._sendCommand({
-			type: 'fetch',
-			url: request.url,
-			method: request.method,
-			headers,
-			body,
-		})
+		const result = await resultPromise
 
 		if (result.type !== 'fetch') throw new Error('Unexpected result type')
 
-		// Reconstruct Response
-		return new Response(result.body, {
+		const init: ResponseInit & { webSocket?: CFWebSocket } = {
 			status: result.status,
 			statusText: result.statusText,
 			headers: result.headers,
-		})
+		}
+
+		if (result.fetchWebSocketId) {
+			if (!this._fetchBridge) throw new Error('Fetch WS bridge not initialised — worker must be alive')
+			init.webSocket = this._fetchBridge.register(result.fetchWebSocketId)
+			// Pin the executor for as long as the WS is open — hibernation AND plain
+			// sockets alike (a chatty non-hibernation WS bypasses _sendCommand, so
+			// without this the idle reaper would evict it and 1012 the client).
+			this._openFetchWsIds.add(result.fetchWebSocketId)
+		}
+
+		if (result.streamId !== undefined) {
+			const stream = this._fetchStreams.open(result.streamId)
+			return new Response(stream, init)
+		}
+
+		return new Response(result.body, init)
+	}
+
+	private _pumpFetchRequestBody(streamId: number, body: ReadableStream<Uint8Array>): void {
+		pumpStream<DoReqStreamChunk, DoReqStreamEnd, DoReqStreamError>(
+			streamId,
+			body,
+			this._fetchRequestStreams,
+			msg => this._worker?.postMessage(msg satisfies DOWorkerMessage),
+			{
+				chunk: (id, chunk) => ({ type: 'do-req-stream-chunk', streamId: id, chunk }),
+				end: (id) => ({ type: 'do-req-stream-end', streamId: id }),
+				error: (id, error) => ({ type: 'do-req-stream-error', streamId: id, error }),
+			},
+			() => !this._disposed,
+			STREAM_BACKPRESSURE_WINDOW,
+		)
+	}
+
+	/**
+	 * Resolve a binding from main's env. Mirrors the user-worker channel:
+	 * when `target.instanceId` is set, route through the namespace's `.get()`
+	 * so DO-stub redirection works (cross-DO and self-DO access via env-RPC).
+	 */
+	private _resolveBinding = (target: BindingTarget): Record<string, unknown> => {
+		const binding = this._config.env[target.binding] as Record<string, unknown> | undefined
+		if (!binding) throw new Error(`Binding "${target.binding}" not found on main env`)
+		if (target.instanceId === undefined) return binding
+		const get = binding.get
+		if (typeof get !== 'function') {
+			throw new Error(`Binding "${target.binding}" cannot resolve instance "${target.instanceId}" — no .get() method`)
+		}
+		const doId = new DurableObjectIdImpl(target.instanceId, target.instanceName)
+		return (get as (id: DurableObjectIdImpl) => Record<string, unknown>).call(binding, doId)
 	}
 
 	async executeRpc(method: string, args: unknown[]): Promise<unknown> {
@@ -303,7 +479,7 @@ export class WorkerExecutor implements DOExecutor {
 
 		if (result.type !== 'rpc-get') throw new Error('Unexpected result type')
 		// Functions can't cross the boundary — return a callable stub
-		if (result.value === '__function__') {
+		if (result.kind === 'function') {
 			return (...args: unknown[]) => this.executeRpc(prop, args)
 		}
 		return result.value
@@ -315,14 +491,17 @@ export class WorkerExecutor implements DOExecutor {
 			retryCount,
 		})
 		if (result.type === 'error') {
-			const err = new Error(result.message)
-			if (result.stack) err.stack = result.stack
-			throw err
+			throw deserializeError(result.error)
 		}
 	}
 
 	isActive(): boolean {
-		return this._inFlightCount > 0
+		// Open body streams keep the instance active: the fetch promise settles
+		// at response HEADERS, so a long-lived body (SSE, slow download) would
+		// otherwise look idle and get evicted mid-stream — dispose() error()s
+		// the body the caller is still reading. Mirrors the top-level
+		// generation drain's openStreamCount() guard.
+		return this._inFlightCount > 0 || this._fetchStreams.activeCount() > 0 || this._fetchRequestStreams.activeCount() > 0
 	}
 
 	isBlocked(): boolean {
@@ -330,26 +509,70 @@ export class WorkerExecutor implements DOExecutor {
 	}
 
 	activeWebSocketCount(): number {
-		return this._wsCount
+		return this._openFetchWsIds.size
 	}
 
 	isAborted(): boolean {
-		return false // Worker-thread DOs don't support abort
+		return this._aborted
+	}
+
+	isDisposed(): boolean {
+		return this._disposed
+	}
+
+	/**
+	 * Ask the DO worker to tear down its Docker container before we terminate the
+	 * thread. terminate() kills the worker's activity/health timers but leaves the
+	 * Docker process running — mirrors `InProcessExecutor.dispose()`'s
+	 * `containerRuntime.cleanup()`. Bounded so a hung `docker rm` can't block
+	 * reload; the thread is terminated right after regardless.
+	 */
+	private _cleanupContainer(): Promise<void> {
+		let timer: ReturnType<typeof setTimeout>
+		const timeout = new Promise<void>((res) => {
+			timer = setTimeout(res, 3000)
+		})
+		return Promise.race([
+			this._sendCommand({ type: 'cleanup' }).then(() => {}, () => {}),
+			timeout,
+		]).finally(() => clearTimeout(timer))
 	}
 
 	async dispose(): Promise<void> {
+		// Container DOs: stop the Docker container before terminating the thread.
+		// Non-container DOs skip the round-trip so reload stays fast.
+		if (!this._disposed && this._worker && this._config.containerConfig) {
+			try {
+				await this._cleanupContainer()
+			} catch {}
+		}
+		this._teardown(new Error('Worker terminated'))
+	}
+
+	/**
+	 * The one teardown sequence — shared by `dispose()` (planned), `onerror`
+	 * (worker crashed) and the init-error path, so the three can't drift: mark
+	 * disposed, terminate the thread, reject every pending command and the ready
+	 * promise with `error`, and dispose every bridge/stream/rpc registry.
+	 * Idempotent. Counterpart of `WorkerThreadExecutor._failAll`.
+	 */
+	private _teardown(error: Error): void {
 		this._disposed = true
 		if (this._worker) {
 			this._worker.terminate()
 			this._worker = null
 		}
-		// Reject all pending commands
-		const error = new Error('Worker terminated')
+		this._readyReject?.(error)
 		for (const [, pending] of this._pending) {
 			pending.reject(error)
 		}
 		this._pending.clear()
-		this._bridgedWebSockets.clear()
+		this._openFetchWsIds.clear()
+		this._fetchBridge?.disposeAll()
+		this._envBindingWsBridge?.disposeAll()
+		this._rpcChannel.disposeAll(error)
+		this._fetchStreams.disposeAll(error)
+		this._fetchRequestStreams.disposeAll()
 	}
 }
 
@@ -358,21 +581,26 @@ export class WorkerExecutor implements DOExecutor {
 export class WorkerExecutorFactory implements DOExecutorFactory {
 	private _modulePath?: string
 	private _configPath?: string
+	private _wranglerConfig?: WranglerConfig
 
 	/**
-	 * Set the module and config paths for all executors created by this factory.
-	 * Called by the generation manager after loading config.
+	 * Set the module + config paths and the parsed env-overridden config for all
+	 * executors created by this factory. Called by the generation manager after
+	 * loading config.
 	 */
-	configure(modulePath: string, configPath: string): void {
+	configure(modulePath: string, configPath: string, wranglerConfig?: WranglerConfig): void {
 		this._modulePath = modulePath
 		this._configPath = configPath
+		this._wranglerConfig = wranglerConfig
 	}
 
 	create(config: ExecutorConfig): DOExecutor {
-		// Attach paths to the config for the executor to use
-		const extendedConfig = config as any
-		extendedConfig._modulePath = this._modulePath ?? ''
-		extendedConfig._configPath = this._configPath ?? ''
-		return new WorkerExecutor(extendedConfig)
+		// Attach paths + parsed config to the config for the executor to use
+		return new WorkerExecutor({
+			...config,
+			_modulePath: this._modulePath ?? '',
+			_configPath: this._configPath ?? '',
+			_wranglerConfig: this._wranglerConfig,
+		})
 	}
 }