feat(cloudflare/workers): worker versions and gradual deployments

[sam-goodwin]

Adds a version prop to Cloudflare.Worker mapping Cloudflare's versions & gradual deployments onto alchemy stages.

// PR preview: upload this stage's code as a zero-traffic version of
// staging's script; worker.url is the version preview URL
const parent = yield* Cloudflare.Worker.ref("Api", { stage: "staging" });
yield* Cloudflare.Worker("Api", {
  main: "./src/api.ts",
  version: { parent, message: `PR #${process.env.PR_NUMBER}` },
});

// canary: 10% of the parent's traffic
version: { parent, traffic: 10 }

// gradual rollout of a Worker's own deploy (new version 25%, live version 75%)
version: { traffic: 25 }

• parent accepts a Worker ref (yield* Worker.ref(id, { stage, stack })), a locally-declared Worker, or a literal script name as an escape hatch. Changing parent (or mode) replaces the resource.
• Version workers own a version, not a script: read verifies the version exists on the parent (never adopts the parent's script), delete restores 100% of traffic to the surviving version and leaves the parent untouched, precreate skips the placeholder script.
• Script-level settings (routes, domain, crons, tags, observability, logpush, placement, limits, subdomain, assets, name, namespace) are rejected on version workers with a typed WorkerVersionConfigError, as are locally-hosted Durable Object / Workflow classes (their migrations would mutate the parent).
• Self-rollouts deploy through createScriptVersion + createScriptDeployment instead of the full-cutover putScript; the first deploy of a script always goes to 100%. Assets and pending DO migrations can't ride a rollout (typed error).
• New attrs: versionOf, versionId, deploymentId. The metadata hash reduces version.parent to the parent's script name so parent redeploys don't spuriously re-version children.

Depends on alchemy-run/distilled#389 (typed binding-validation errors on createScriptVersion, submodule bumped here).

Live-tested in test/Cloudflare/Workers/WorkerVersion.test.ts: preview URL serves the version's code while the parent's deployment is untouched, canary split asserted at 25/75 out-of-band via listScriptDeployments, canary removal restores 100%, string-name parent, rollout 100 → 50/50 → 100, and the validation error. Worker.test.ts passes unchanged.

Docs: Versions & Gradual Deployments JSDoc section on the Worker resource plus a new section in the Workers guide.

🤖 Generated with Claude Code

[alchemy-version-bot]

Install the packages built from this commit:

alchemy

bun add alchemy@https://pkg.ing/alchemy/5a5eb63

@alchemy.run/better-auth

bun add @alchemy.run/better-auth@https://pkg.ing/@alchemy.run/better-auth/5a5eb63

@alchemy.run/pr-package

bun add @alchemy.run/pr-package@https://pkg.ing/@alchemy.run/pr-package/5a5eb63