alchemy 0.1.13 → 0.1.15

package/src/cloudflare/worker.ts

@@ -1,11 +1,14 @@
 import * as fs from "fs/promises";
 import { apply } from "../apply";
 import { Bundle, type BundleProps } from "../esbuild";
+import type { Resolved } from "../output";
 import { type Context, Resource } from "../resource";
+import { withExponentialBackoff } from "../utils/retry";
 import { type CloudflareApi, createCloudflareApi } from "./api";
-import type { WorkerBinding, WorkerBindingSpec } from "./bindings";
+import type { Bindings, WorkerBindingSpec } from "./bindings";
 import type { DurableObjectNamespace } from "./durable-object-namespace";
 import { isDurableObjectNamespace } from "./durable-object-namespace";
+import { isKVNamespace } from "./kv-namespace";
 import type { WorkerScriptMetadata } from "./worker-metadata";
 import type { SingleStepMigration } from "./worker-migration";
 /**
@@ -54,7 +57,7 @@ export interface WorkerProps {
   /**
    * Bindings to attach to the worker
    */
-  bindings?: WorkerBinding[];
+  bindings?: Bindings;
 
   /**
    * Environment variables to attach to the worker
@@ -94,6 +97,8 @@ export interface WorkerProps {
  * Output returned after Worker creation/update
  */
 export interface WorkerOutput extends Omit<WorkerProps, "url"> {
+  type: "service";
+
   /**
    * The ID of the worker
    */
@@ -118,7 +123,11 @@ export interface WorkerOutput extends Omit<WorkerProps, "url"> {
   /**
    * The bindings that were created
    */
-  bindings: WorkerBinding[];
+  bindings: Bindings;
+}
+
+export function isWorker(resource: any): resource is Resolved<Worker> {
+  return resource && typeof resource === "object" && resource.type === "worker";
 }
 
 export class Worker extends Resource(
@@ -144,7 +153,7 @@ export class Worker extends Resource(
       await assertWorkerDoesNotExist(ctx, api, workerName);
     }
 
-    const oldBindings = await ctx.get<WorkerBinding[]>("bindings");
+    const oldBindings = await ctx.get<Bindings>("bindings");
 
     const scriptMetadata = await prepareWorkerMetadata(ctx, oldBindings, props);
 
@@ -174,12 +183,13 @@ export class Worker extends Resource(
 
     // Construct the output
     const output: WorkerOutput = {
+      type: "service",
       id: workerName,
       name: workerName,
       script: scriptContent,
       format: props.format || "esm", // Include format in the output
       routes: props.routes || [],
-      bindings: props.bindings || [],
+      bindings: props.bindings ?? {},
       env: props.env,
       observability: scriptMetadata.observability,
       createdAt: now,
@@ -267,58 +277,82 @@ async function putWorker(
   scriptContent: string,
   scriptMetadata: WorkerMetadata,
 ) {
-  const scriptName = scriptMetadata.main_module ?? scriptMetadata.body_part!;
-
-  // Create FormData for the upload
-  const formData = new FormData();
-
-  // Add the actual script content as a named file part
-  formData.append(
-    scriptName,
-    new Blob([scriptContent], {
-      type: scriptMetadata.main_module
-        ? "application/javascript+module"
-        : "application/javascript",
-    }),
-    scriptName,
-  );
+  return withExponentialBackoff(
+    async () => {
+      const scriptName =
+        scriptMetadata.main_module ?? scriptMetadata.body_part!;
+
+      // Create FormData for the upload
+      const formData = new FormData();
+
+      // Add the actual script content as a named file part
+      formData.append(
+        scriptName,
+        new Blob([scriptContent], {
+          type: scriptMetadata.main_module
+            ? "application/javascript+module"
+            : "application/javascript",
+        }),
+        scriptName,
+      );
 
-  console.log("Script Metadata:", JSON.stringify(scriptMetadata, null, 2));
+      // console.log("Script Metadata:", JSON.stringify(scriptMetadata, null, 2));
 
-  // Add metadata as JSON
-  formData.append(
-    "metadata",
-    new Blob([JSON.stringify(scriptMetadata)], {
-      type: "application/json",
-    }),
-  );
+      // Add metadata as JSON
+      formData.append(
+        "metadata",
+        new Blob([JSON.stringify(scriptMetadata)], {
+          type: "application/json",
+        }),
+      );
 
-  // Upload worker script with bindings
-  const uploadResponse = await api.put(
-    `/accounts/${api.accountId}/workers/scripts/${workerName}`,
-    formData,
-    {
-      headers: {
-        "Content-Type": "multipart/form-data",
-      },
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+
+      // Upload worker script with bindings
+      const uploadResponse = await api.put(
+        `/accounts/${api.accountId}/workers/scripts/${workerName}`,
+        formData,
+        {
+          headers: {
+            "Content-Type": "multipart/form-data",
+          },
+        },
+      );
+
+      // Check if the upload was successful
+      if (!uploadResponse.ok) {
+        const errorData: any = await uploadResponse
+          .json()
+          .catch(() => ({ errors: [{ message: uploadResponse.statusText }] }));
+
+        const errorMessage = `Error (HTTP ${uploadResponse.status}) uploading worker script '${workerName}': ${errorData.errors?.[0]?.message || uploadResponse.statusText}`;
+
+        if (
+          uploadResponse.status === 400 &&
+          errorMessage.includes("not found")
+        ) {
+          throw new NotFoundError(errorMessage);
+        }
+        throw new Error(errorMessage);
+      }
+
+      return formData;
     },
+    (err) => err instanceof NotFoundError,
+    10,
+    100,
   );
+}
 
-  // Check if the upload was successful
-  if (!uploadResponse.ok) {
-    const errorData: any = await uploadResponse
-      .json()
-      .catch(() => ({ errors: [{ message: uploadResponse.statusText }] }));
-    throw new Error(
-      `Error uploading worker script '${workerName}': ${errorData.errors?.[0]?.message || uploadResponse.statusText}`,
-    );
+class NotFoundError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "NotFoundError";
   }
-
-  return formData;
 }
 
 interface WorkerMetadata {
-  bindings: WorkerBinding[];
+  bindings: WorkerBindingSpec[];
   observability: {
     enabled: boolean;
   };
@@ -330,12 +364,12 @@ interface WorkerMetadata {
 
 async function prepareWorkerMetadata(
   ctx: Context<WorkerOutput>,
-  oldBindings: WorkerBinding[] | undefined,
+  oldBindings: Bindings | undefined,
   props: WorkerProps,
 ): Promise<WorkerMetadata> {
   // Prepare metadata with bindings
   const meta: WorkerMetadata = {
-    bindings: [] as WorkerBinding[],
+    bindings: [],
     observability: {
       enabled: props.observability?.enabled !== false,
     },
@@ -349,30 +383,51 @@ async function prepareWorkerMetadata(
     },
   };
 
+  const bindings = (props.bindings ?? {}) as Resolved<Bindings>;
+
   // Convert bindings to the format expected by the API
-  for (const binding of props.bindings ?? []) {
+  for (const [bindingName, binding] of Object.entries(bindings)) {
     // Create a copy of the binding to avoid modifying the original
-    const bindingData = { ...binding };
 
-    if (isDurableObjectNamespace(bindingData)) {
-      const stableId = bindingData.id;
-      const className = bindingData.className;
+    if (isKVNamespace(binding)) {
+      meta.bindings.push({
+        type: "kv_namespace",
+        name: bindingName,
+        namespace_id: binding.id,
+      });
+    } else if (typeof binding === "string") {
+      meta.bindings.push({
+        type: "plain_text",
+        name: bindingName,
+        text: binding,
+      });
+    } else if (binding.type === "service") {
+      meta.bindings.push({
+        type: "service",
+        name: bindingName,
+        service: binding.id,
+      });
+    } else if (isDurableObjectNamespace(binding)) {
+      const stableId = binding.id;
+      const className = binding.className;
 
       meta.bindings.push({
         type: "durable_object_namespace",
-        name: bindingData.bindingName,
+        name: bindingName,
         class_name: className,
-        script_name: bindingData.scriptName,
-        environment: bindingData.environment,
-        namespace_id: bindingData.namespaceId,
+        script_name: binding.scriptName,
+        environment: binding.environment,
+        namespace_id: binding.namespaceId,
       });
 
-      const oldBinding: DurableObjectNamespace | undefined = oldBindings
+      const oldBinding: DurableObjectNamespace | undefined = Object.values(
+        oldBindings ?? {},
+      )
         ?.filter(isDurableObjectNamespace)
         ?.find((b) => b.id === stableId);
 
       if (!oldBinding) {
-        if (bindingData.sqlite) {
+        if (binding.sqlite) {
           meta.migrations!.new_sqlite_classes!.push(className);
         } else {
           meta.migrations!.new_classes!.push(className);
@@ -384,8 +439,8 @@ async function prepareWorkerMetadata(
         });
       }
     } else {
-      // For all other binding types, use as-is
-      meta.bindings.push(bindingData as WorkerBindingSpec);
+      // @ts-expect-error - we should never reach here
+      throw new Error(`Unsupported binding type: ${binding.type}`);
     }
   }
 

package/src/github/client.ts

@@ -0,0 +1,115 @@
+import { Octokit } from "@octokit/rest";
+import { exec } from "child_process";
+import { promisify } from "util";
+
+// Convert exec to promise-based
+const execAsync = promisify(exec);
+
+/**
+ * Try to get a GitHub token from the GitHub CLI
+ */
+export async function getGitHubTokenFromCLI(): Promise<string | null> {
+  try {
+    // Check if GitHub CLI is installed
+    const { stdout: ghVersion } = await execAsync("gh --version");
+    if (!ghVersion) return null;
+
+    // Get the auth token
+    const { stdout: token } = await execAsync("gh auth token");
+    return token?.trim() || null;
+  } catch (error) {
+    return null;
+  }
+}
+
+/**
+ * Get GitHub authentication token with the following priority:
+ * 1. Explicit token provided in props
+ * 2. GITHUB_ACCESS_TOKEN environment variable (for actions with admin permissions)
+ * 3. GITHUB_TOKEN environment variable
+ * 4. GitHub CLI token (if gh is installed and authenticated)
+ *
+ * @param token Optional token to use
+ * @returns The resolved token or null if not available
+ */
+export async function getGitHubToken(token?: string): Promise<string | null> {
+  return (
+    token ||
+    process.env.GITHUB_ACCESS_TOKEN ||
+    process.env.GITHUB_TOKEN ||
+    (await getGitHubTokenFromCLI())
+  );
+}
+
+/**
+ * Create an authenticated Octokit client
+ *
+ * @param options Options for creating the client
+ * @returns An authenticated Octokit client
+ */
+export async function createGitHubClient(
+  options: { token?: string } = {},
+): Promise<Octokit> {
+  const token = await getGitHubToken(options.token);
+
+  return new Octokit({
+    auth: token,
+  });
+}
+
+/**
+ * Verifies GitHub authentication and provides helpful error messages
+ *
+ * @param octokit Octokit client
+ * @param owner Repository owner
+ * @param repo Repository name
+ */
+export async function verifyGitHubAuth(
+  octokit: Octokit,
+  owner: string,
+  repo: string,
+): Promise<void> {
+  try {
+    // Make a test request to check authentication
+    await octokit.rest.repos.get({
+      owner,
+      repo,
+    });
+  } catch (error: any) {
+    if (error.status === 401) {
+      console.error(
+        "\n⚠️ GitHub authentication failed. Please try one of the following:",
+      );
+      console.error(
+        "1. Run 'gh auth login' to authenticate with the GitHub CLI",
+      );
+      console.error(
+        "2. Set the GITHUB_TOKEN environment variable with a personal access token",
+      );
+      console.error("3. Pass a token directly to the constructor");
+      console.error(
+        "\nTo create a token, visit: https://github.com/settings/tokens",
+      );
+      console.error(
+        "Required scopes: 'repo' for private repos or 'public_repo' for public repos\n",
+      );
+      throw new Error("GitHub authentication failed");
+    } else if (error.status === 403) {
+      console.error(
+        "\n⚠️ Insufficient permissions. You need admin access to the repository.",
+      );
+      console.error(
+        "Make sure your token has the 'repo' scope for private repos or 'public_repo' for public repos\n",
+      );
+      throw new Error("Insufficient GitHub permissions");
+    } else if (error.status === 404) {
+      console.error(`\n⚠️ Repository not found: ${owner}/${repo}`);
+      console.error(
+        "Make sure the repository exists and you have access to it\n",
+      );
+      throw new Error("GitHub repository not found");
+    } else {
+      throw error;
+    }
+  }
+}

package/src/github/index.ts

@@ -0,0 +1 @@
+export * from "./secret";

package/src/github/secret.ts

@@ -0,0 +1,172 @@
+import sodium from "libsodium-wrappers";
+import { type Context, Resource } from "../resource";
+import { createGitHubClient, verifyGitHubAuth } from "./client";
+
+/**
+ * Properties for creating or updating a GitHub Secret
+ */
+export interface GitHubSecretProps {
+  /**
+   * Repository owner (user or organization)
+   */
+  owner: string;
+
+  /**
+   * Repository name
+   */
+  repository: string;
+
+  /**
+   * Secret name
+   */
+  name: string;
+
+  /**
+   * Secret value (will be stored securely on GitHub)
+   */
+  value: string;
+
+  /**
+   * Optional GitHub API token (overrides environment variable)
+   */
+  token?: string;
+}
+
+/**
+ * Output returned after Secret creation/update
+ */
+export interface GitHubSecretOutput extends Omit<GitHubSecretProps, "value"> {
+  /**
+   * The ID of the resource
+   */
+  id: string;
+
+  /**
+   * Time at which the object was created/updated
+   */
+  updatedAt: string;
+}
+
+/**
+ * Encrypt a value for GitHub using libsodium
+ * Based on GitHub's documentation for encrypting secrets
+ *
+ * @param value - The secret value to encrypt
+ * @param publicKey - The base64-encoded public key from GitHub
+ * @returns The base64-encoded encrypted value
+ */
+async function encryptValue(value: string, publicKey: string): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Convert the public key from base64 to binary
+  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+
+  // Convert the message to a Uint8Array
+  const binMessage = sodium.from_string(value);
+
+  // Encrypt the message with the public key using libsodium's sealed box
+  const encryptedBin = sodium.crypto_box_seal(binMessage, binKey);
+
+  // Convert the encrypted message to base64
+  return sodium.to_base64(encryptedBin, sodium.base64_variants.ORIGINAL);
+}
+
+/**
+ * Resource for managing GitHub repository secrets
+ */
+export class GitHubSecret extends Resource(
+  "github::Secret",
+  async (
+    ctx: Context<GitHubSecretOutput>,
+    props: GitHubSecretProps,
+  ): Promise<GitHubSecretOutput | void> => {
+    // Create authenticated Octokit client - will automatically handle token resolution
+    const octokit = await createGitHubClient({ token: props.token });
+
+    // Verify authentication and permissions
+    if (!ctx.quiet) {
+      await verifyGitHubAuth(octokit, props.owner, props.repository);
+    }
+
+    if (ctx.event === "delete") {
+      if (ctx.output?.id) {
+        try {
+          // Delete the secret
+          await octokit.rest.actions.deleteRepoSecret({
+            owner: props.owner,
+            repo: props.repository,
+            secret_name: props.name,
+          });
+        } catch (error: any) {
+          // Ignore 404 errors (secret already deleted)
+          if (error.status === 404) {
+            console.log("Secret doesn't exist, ignoring");
+          } else {
+            throw error;
+          }
+        }
+      }
+
+      // Return void (a deleted resource has no content)
+      return undefined;
+    } else {
+      try {
+        // Get the repository's public key for encrypting secrets
+        const { data: publicKey } = await octokit.rest.actions.getRepoPublicKey(
+          {
+            owner: props.owner,
+            repo: props.repository,
+          },
+        );
+
+        // Encrypt the secret value using libsodium
+        const encryptedValue = await encryptValue(props.value, publicKey.key);
+
+        // Create or update the secret with the encrypted value and key_id
+        const response = await octokit.rest.actions.createOrUpdateRepoSecret({
+          owner: props.owner,
+          repo: props.repository,
+          secret_name: props.name,
+          encrypted_value: encryptedValue,
+          key_id: publicKey.key_id,
+        });
+
+        // Log success
+        if (!ctx.quiet) {
+          console.log(`Successfully created/updated secret: ${props.name}`);
+        }
+
+        // GitHub doesn't return the secret details on create/update, so we need to construct it
+        const output: GitHubSecretOutput = {
+          id: `${props.owner}/${props.repository}/${props.name}`,
+          owner: props.owner,
+          repository: props.repository,
+          name: props.name,
+          token: props.token,
+          updatedAt: new Date().toISOString(),
+        };
+
+        return output;
+      } catch (error: any) {
+        if (
+          error.status === 403 &&
+          error.message?.includes("Must have admin rights")
+        ) {
+          console.error(
+            "\n⚠️ Error creating/updating GitHub secret: You must have admin rights to the repository.",
+          );
+          console.error(
+            "Make sure your GitHub token has the required permissions (repo scope for private repos).\n",
+          );
+        } else {
+          console.error(
+            "Error creating/updating GitHub secret:",
+            error.message,
+          );
+        }
+        throw error;
+      }
+    }
+  },
+) {}

package/src/utils/retry.ts

@@ -0,0 +1,37 @@
+/**
+ * Utility function for exponential backoff retry
+ * Retries an operation with exponential backoff when a retryable error occurs
+ *
+ * @param operation The async operation to execute and potentially retry
+ * @param isRetryable Function to determine if an error should trigger a retry
+ * @param maxAttempts Maximum number of attempts before giving up
+ * @param initialDelayMs Initial delay in milliseconds before first retry
+ * @returns Result of the operation
+ * @throws The last error encountered if all retries fail
+ */
+export async function withExponentialBackoff<T>(
+  operation: () => Promise<T>,
+  isRetryable: (error: any) => boolean,
+  maxAttempts = 5,
+  initialDelayMs = 100,
+): Promise<T> {
+  let attempt = 0;
+  let delay = initialDelayMs;
+
+  while (true) {
+    try {
+      return await operation();
+    } catch (error) {
+      attempt++;
+      if (attempt >= maxAttempts || !isRetryable(error)) {
+        console.warn("Failed after ", attempt, " attempts");
+        throw error;
+      }
+
+      // Exponential backoff with jitter
+      const jitter = Math.random() * 0.1 * delay;
+      await new Promise((resolve) => setTimeout(resolve, delay + jitter));
+      delay *= 2; // Double the delay for next attempt
+    }
+  }
+}