alchemy 0.1.16 → 0.1.18

package/src/cloudflare/bucket.ts

@@ -0,0 +1,240 @@
+import type { Resolved } from "../output";
+import { type Context, Resource } from "../resource";
+import { createCloudflareApi } from "./api";
+
+/**
+ * Properties for creating or updating an R2 Bucket
+ */
+export interface BucketProps {
+  /**
+   * Name of the bucket
+   * Names can only contain lowercase letters (a-z), numbers (0-9), and hyphens (-)
+   * Cannot begin or end with a hyphen
+   */
+  name?: string;
+
+  /**
+   * Optional location hint for the bucket
+   * Indicates the primary geographical location data will be accessed from
+   */
+  locationHint?: string;
+
+  /**
+   * Optional jurisdiction for the bucket
+   * Determines the regulatory jurisdiction the bucket data falls under
+   */
+  jurisdiction?: "default" | "eu" | "fedramp";
+
+  /**
+   * Whether to allow public access through the r2.dev subdomain
+   * Only for development purposes - use custom domains for production
+   */
+  allowPublicAccess?: boolean;
+}
+
+/**
+ * Output returned after R2 Bucket creation/update
+ */
+export interface BucketOutput extends BucketProps {
+  /**
+   * The ID of the bucket (same as name)
+   */
+  id: string;
+
+  /**
+   * Location of the bucket
+   */
+  location: string;
+
+  /**
+   * Time at which the bucket was created (Unix timestamp in seconds)
+   */
+  creationDate: number;
+
+  /**
+   * Resource type identifier
+   */
+  type: "r2_bucket";
+}
+
+/**
+ * Cloudflare R2 bucket API response
+ */
+interface CloudflareBucketResponse {
+  result: {
+    name: string;
+    location?: string;
+    creation_date: string;
+  };
+  success: boolean;
+  errors: Array<{ code: number; message: string }>;
+  messages: string[];
+}
+
+export function isBucket(resource: any): resource is Resolved<R2Bucket> {
+  return (
+    resource && typeof resource === "object" && resource.id && resource.location
+  );
+}
+
+export class R2Bucket extends Resource(
+  "cloudflare::R2Bucket",
+  async (ctx: Context<BucketOutput>, props: BucketProps) => {
+    // Create Cloudflare API client with automatic account discovery
+    const api = await createCloudflareApi();
+
+    // Resource ID defaults to bucket name if provided
+    const bucketName = props.name || ctx.resourceID;
+
+    if (ctx.event === "delete") {
+      if (ctx.output?.id) {
+        // Delete R2 bucket
+        const headers: Record<string, string> = {};
+        if (props.jurisdiction && props.jurisdiction !== "default") {
+          headers["cf-r2-jurisdiction"] = props.jurisdiction;
+        }
+
+        const deleteResponse = await api.delete(
+          `/accounts/${api.accountId}/r2/buckets/${ctx.output.id}`,
+          { headers },
+        );
+
+        if (!deleteResponse.ok && deleteResponse.status !== 404) {
+          const errorData: any = await deleteResponse.json().catch(() => ({
+            errors: [{ message: deleteResponse.statusText }],
+          }));
+          throw new Error(
+            `Error deleting R2 bucket '${bucketName}': ${errorData.errors?.[0]?.message || deleteResponse.statusText}`,
+          );
+        }
+      }
+
+      // Return void (a deleted bucket has no content)
+      return;
+    } else {
+      try {
+        let bucketOutput: BucketOutput;
+
+        if (ctx.event === "update" && ctx.output?.id) {
+          // Get bucket details to verify it exists
+          const headers: Record<string, string> = {};
+          if (props.jurisdiction && props.jurisdiction !== "default") {
+            headers["cf-r2-jurisdiction"] = props.jurisdiction;
+          }
+
+          const getResponse = await api.get(
+            `/accounts/${api.accountId}/r2/buckets/${bucketName}`,
+            { headers },
+          );
+
+          if (!getResponse.ok) {
+            const errorData: any = await getResponse.json().catch(() => ({
+              errors: [{ message: getResponse.statusText }],
+            }));
+            throw new Error(
+              `Error getting R2 bucket '${bucketName}': ${errorData.errors?.[0]?.message || getResponse.statusText}`,
+            );
+          }
+
+          const result = (await getResponse.json()) as CloudflareBucketResponse;
+          bucketOutput = {
+            id: result.result.name,
+            name: result.result.name,
+            location: result.result.location || "default",
+            creationDate: Math.floor(
+              new Date(result.result.creation_date).getTime() / 1000,
+            ),
+            jurisdiction: props.jurisdiction || "default",
+            type: "r2_bucket",
+          };
+
+          // Update public access setting if it has changed
+          if (props.allowPublicAccess !== undefined) {
+            await updatePublicAccess(api, bucketName, props.allowPublicAccess);
+          }
+        } else {
+          // Create new R2 bucket
+          const createPayload: any = {
+            name: bucketName,
+          };
+
+          if (props.locationHint) {
+            createPayload.location_hint = props.locationHint;
+          }
+
+          const headers: Record<string, string> = {};
+          if (props.jurisdiction && props.jurisdiction !== "default") {
+            headers["cf-r2-jurisdiction"] = props.jurisdiction;
+          }
+
+          const createResponse = await api.post(
+            `/accounts/${api.accountId}/r2/buckets`,
+            createPayload,
+            { headers },
+          );
+
+          if (!createResponse.ok) {
+            const errorData: any = await createResponse.json().catch(() => ({
+              errors: [{ message: createResponse.statusText }],
+            }));
+            throw new Error(
+              `Error creating R2 bucket '${bucketName}': ${errorData.errors?.[0]?.message || createResponse.statusText}`,
+            );
+          }
+
+          const result =
+            (await createResponse.json()) as CloudflareBucketResponse;
+          bucketOutput = {
+            id: result.result.name,
+            name: result.result.name,
+            location: result.result.location || "default",
+            creationDate: Math.floor(
+              new Date(result.result.creation_date).getTime() / 1000,
+            ),
+            jurisdiction: props.jurisdiction || "default",
+            type: "r2_bucket",
+          };
+
+          // Set public access if requested
+          if (props.allowPublicAccess) {
+            await updatePublicAccess(api, bucketName, true);
+          }
+        }
+
+        return bucketOutput;
+      } catch (error) {
+        console.error("Error creating/updating R2 bucket:", error);
+        throw error;
+      }
+    }
+  },
+) {}
+
+/**
+ * Helper function to update the public access setting for a bucket
+ */
+async function updatePublicAccess(
+  api: any,
+  bucketName: string,
+  allowPublicAccess: boolean,
+): Promise<void> {
+  try {
+    const response = await api.put(
+      `/accounts/${api.accountId}/r2/buckets/${bucketName}/domains/managed`,
+      {
+        enabled: allowPublicAccess,
+      },
+    );
+
+    if (!response.ok) {
+      const errorData: any = await response.json().catch(() => ({
+        errors: [{ message: response.statusText }],
+      }));
+      throw new Error(
+        `Error updating R2 bucket public access: ${errorData.errors?.[0]?.message || response.statusText}`,
+      );
+    }
+  } catch (error) {
+    console.warn("Could not set public access:", error);
+  }
+}

package/src/cloudflare/index.ts

@@ -1,4 +1,5 @@
 export * from "./bindings";
+export * from "./bucket";
 export * from "./durable-object-namespace";
 export * from "./kv-namespace";
 export * from "./state";

package/src/cloudflare/static-site.ts

@@ -323,6 +323,18 @@ export class StaticSite extends Resource(
         },
       },
     };
+
+    // Determine the entrypoint file - check for .ts first, fallback to .js
+    let entrypointFile = "static-site-router.js";
+    try {
+      const tsFile = path.resolve(__dirname, "static-site-router.ts");
+      await fs.access(tsFile);
+      // If we reach here, the TypeScript file exists
+      entrypointFile = "static-site-router.ts";
+    } catch (error) {
+      // TypeScript file doesn't exist, use JavaScript (default)
+    }
+
     const worker = new Worker(
       "worker",
       {
@@ -333,7 +345,7 @@ export class StaticSite extends Resource(
         ...(props.workerScript
           ? { script: props.workerScript }
           : {
-              entrypoint: path.resolve(__dirname, "static-site-router.ts"),
+              entrypoint: path.resolve(__dirname, entrypointFile),
               bundle: bundleOptions,
             }),
         bindings,
@@ -367,7 +379,7 @@ export class StaticSite extends Resource(
       updatedAt: now,
       domain: props.domain,
       production: props.production !== false,
-      url: worker.url,
+      url: worker.url as Input<string | undefined>,
       routes,
     };
 

package/src/cloudflare/worker.ts

@@ -1,11 +1,15 @@
 import * as fs from "fs/promises";
 import { apply } from "../apply";
 import { Bundle, type BundleProps } from "../esbuild";
+import type { Input } from "../input";
 import type { Resolved } from "../output";
 import { type Context, Resource } from "../resource";
+import { Secret } from "../secret";
 import { withExponentialBackoff } from "../utils/retry";
 import { type CloudflareApi, createCloudflareApi } from "./api";
 import type { Bindings, WorkerBindingSpec } from "./bindings";
+import type { Bound } from "./bound";
+import { isBucket } from "./bucket";
 import type { DurableObjectNamespace } from "./durable-object-namespace";
 import { isDurableObjectNamespace } from "./durable-object-namespace";
 import { isKVNamespace } from "./kv-namespace";
@@ -14,7 +18,7 @@ import type { SingleStepMigration } from "./worker-migration";
 /**
  * Properties for creating or updating a Worker
  */
-export interface WorkerProps {
+export interface WorkerProps<B extends Bindings = Bindings> {
   /**
    * The worker script content (JavaScript or WASM)
    * One of script, entryPoint, or bundle must be provided
@@ -57,7 +61,7 @@ export interface WorkerProps {
   /**
    * Bindings to attach to the worker
    */
-  bindings?: Bindings;
+  bindings?: B;
 
   /**
    * Environment variables to attach to the worker
@@ -96,7 +100,8 @@ export interface WorkerProps {
 /**
  * Output returned after Worker creation/update
  */
-export interface WorkerOutput extends Omit<WorkerProps, "url"> {
+export interface WorkerOutput<B extends Bindings = Bindings>
+  extends Omit<WorkerProps<B>, "url"> {
   type: "service";
 
   /**
@@ -123,83 +128,91 @@ export interface WorkerOutput extends Omit<WorkerProps, "url"> {
   /**
    * The bindings that were created
    */
-  bindings: Bindings;
+  bindings: B;
 }
 
 export function isWorker(resource: any): resource is Resolved<Worker> {
   return resource && typeof resource === "object" && resource.type === "worker";
 }
 
-export class Worker extends Resource(
+export class Worker<B extends Bindings = Bindings> extends Resource(
   "cloudflare::Worker",
   {
     alwaysUpdate: true,
   },
-  async (ctx: Context<WorkerOutput>, props: WorkerProps) => {
-    // Create Cloudflare API client with automatic account discovery
-    const api = await createCloudflareApi();
+  applyWorker,
+) {
+  public declare readonly Env: {
+    [bindingName in keyof B]: Bound<B[bindingName]>;
+  };
+  constructor(id: string, input: Input<WorkerProps<B>>, ...inputs: any[]) {
+    super(id, input as any, ...inputs);
+  }
+}
 
-    // Use the provided name
-    const workerName = props.name;
+async function applyWorker(ctx: Context<WorkerOutput>, props: WorkerProps) {
+  // Create Cloudflare API client with automatic account discovery
+  const api = await createCloudflareApi();
 
-    // Validate input - we need either script, entryPoint, or bundle
-    if (!props.script && !props.entrypoint) {
-      throw new Error("One of script or entryPoint must be provided");
-    }
+  // Use the provided name
+  const workerName = props.name;
 
-    if (ctx.event === "delete") {
-      return deleteWorker(ctx, api, workerName);
-    } else if (ctx.event === "create") {
-      await assertWorkerDoesNotExist(ctx, api, workerName);
-    }
+  // Validate input - we need either script, entryPoint, or bundle
+  if (!props.script && !props.entrypoint) {
+    throw new Error("One of script or entryPoint must be provided");
+  }
 
-    const oldBindings = await ctx.get<Bindings>("bindings");
+  if (ctx.event === "delete") {
+    return deleteWorker(ctx, api, workerName);
+  } else if (ctx.event === "create") {
+    await assertWorkerDoesNotExist(ctx, api, workerName);
+  }
 
-    const scriptMetadata = await prepareWorkerMetadata(ctx, oldBindings, props);
+  const oldBindings = await ctx.get<Bindings>("bindings");
 
-    // Get the script content - either from props.script, or by bundling
-    const scriptContent =
-      props.script ?? (await bundleWorkerScript(ctx, props));
+  const scriptMetadata = await prepareWorkerMetadata(ctx, oldBindings, props);
 
-    // Upload the worker script
-    await putWorker(ctx, api, workerName, scriptContent, scriptMetadata);
+  // Get the script content - either from props.script, or by bundling
+  const scriptContent = props.script ?? (await bundleWorkerScript(ctx, props));
 
-    // TODO: it is less than ideal that this can fail, resulting in state problem
-    await ctx.set("bindings", props.bindings);
+  // Upload the worker script
+  await putWorker(ctx, api, workerName, scriptContent, scriptMetadata);
 
-    // Handle routes if requested
-    await setupRoutes(api, workerName, props.routes || []);
+  // TODO: it is less than ideal that this can fail, resulting in state problem
+  await ctx.set("bindings", props.bindings);
 
-    // Handle worker URL if requested
-    const workerUrl = await configureURL(
-      ctx,
-      api,
-      workerName,
-      props.url ?? false,
-    );
+  // Handle routes if requested
+  await setupRoutes(api, workerName, props.routes || []);
 
-    // Get current timestamp
-    const now = Date.now();
-
-    // Construct the output
-    const output: WorkerOutput = {
-      type: "service",
-      id: workerName,
-      name: workerName,
-      script: scriptContent,
-      format: props.format || "esm", // Include format in the output
-      routes: props.routes || [],
-      bindings: props.bindings ?? {},
-      env: props.env,
-      observability: scriptMetadata.observability,
-      createdAt: now,
-      updatedAt: now,
-      url: workerUrl,
-    };
-
-    return output;
-  },
-) {}
+  // Handle worker URL if requested
+  const workerUrl = await configureURL(
+    ctx,
+    api,
+    workerName,
+    props.url ?? false,
+  );
+
+  // Get current timestamp
+  const now = Date.now();
+
+  // Construct the output
+  const output: WorkerOutput = {
+    type: "service",
+    id: workerName,
+    name: workerName,
+    script: scriptContent,
+    format: props.format || "esm", // Include format in the output
+    routes: props.routes || [],
+    bindings: props.bindings ?? {},
+    env: props.env,
+    observability: scriptMetadata.observability,
+    createdAt: now,
+    updatedAt: now,
+    url: workerUrl,
+  };
+
+  return output;
+}
 
 async function deleteWorker(
   ctx: Context<WorkerOutput>,
@@ -438,6 +451,18 @@ async function prepareWorkerMetadata(
           to: className,
         });
       }
+    } else if (isBucket(binding)) {
+      meta.bindings.push({
+        type: "r2_bucket",
+        name: bindingName,
+        bucket_name: binding.name || binding.id,
+      });
+    } else if (binding instanceof Secret) {
+      meta.bindings.push({
+        type: "secret_text",
+        name: bindingName,
+        text: binding.unencrypted,
+      });
     } else {
       // @ts-expect-error - we should never reach here
       throw new Error(`Unsupported binding type: ${binding.type}`);

package/src/encrypt.ts

@@ -0,0 +1,79 @@
+import sodium from "libsodium-wrappers";
+
+/**
+ * Encrypt a value with a symmetric key using libsodium
+ *
+ * @param value - The value to encrypt
+ * @param key - The encryption key
+ * @returns The base64-encoded encrypted value with nonce
+ */
+export async function encryptWithKey(
+  value: string,
+  key: string,
+): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Derive a key from the passphrase
+  const cryptoKey = sodium.crypto_generichash(
+    sodium.crypto_secretbox_KEYBYTES,
+    sodium.from_string(key),
+  );
+
+  // Generate a random nonce
+  const nonce = sodium.randombytes_buf(sodium.crypto_secretbox_NONCEBYTES);
+
+  // Encrypt the message
+  const encryptedBin = sodium.crypto_secretbox_easy(
+    sodium.from_string(value),
+    nonce,
+    cryptoKey,
+  );
+
+  // Combine nonce and ciphertext, then encode to base64
+  const combined = new Uint8Array(nonce.length + encryptedBin.length);
+  combined.set(nonce);
+  combined.set(encryptedBin, nonce.length);
+
+  return sodium.to_base64(combined, sodium.base64_variants.ORIGINAL);
+}
+
+/**
+ * Decrypt a value encrypted with a symmetric key
+ *
+ * @param encryptedValue - The base64-encoded encrypted value with nonce
+ * @param key - The decryption key
+ * @returns The decrypted string
+ */
+export async function decryptWithKey(
+  encryptedValue: string,
+  key: string,
+): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Derive a key from the passphrase
+  const cryptoKey = sodium.crypto_generichash(
+    sodium.crypto_secretbox_KEYBYTES,
+    sodium.from_string(key),
+  );
+
+  // Decode the base64 combined value
+  const combined = sodium.from_base64(
+    encryptedValue,
+    sodium.base64_variants.ORIGINAL,
+  );
+
+  // Extract nonce and ciphertext
+  const nonce = combined.slice(0, sodium.crypto_secretbox_NONCEBYTES);
+  const ciphertext = combined.slice(sodium.crypto_secretbox_NONCEBYTES);
+
+  // Decrypt the message
+  const decryptedBin = sodium.crypto_secretbox_open_easy(
+    ciphertext,
+    nonce,
+    cryptoKey,
+  );
+
+  return sodium.to_string(decryptedBin);
+}

package/src/github/secret.ts

@@ -1,7 +1,7 @@
 import sodium from "libsodium-wrappers";
 import { type Context, Resource } from "../resource";
+import type { Secret } from "../secret";
 import { createGitHubClient, verifyGitHubAuth } from "./client";
-
 /**
  * Properties for creating or updating a GitHub Secret
  */
@@ -24,7 +24,7 @@ export interface GitHubSecretProps {
   /**
    * Secret value (will be stored securely on GitHub)
    */
-  value: string;
+  value: Secret;
 
   /**
    * Optional GitHub API token (overrides environment variable)
@@ -47,31 +47,6 @@ export interface GitHubSecretOutput extends Omit<GitHubSecretProps, "value"> {
   updatedAt: string;
 }
 
-/**
- * Encrypt a value for GitHub using libsodium
- * Based on GitHub's documentation for encrypting secrets
- *
- * @param value - The secret value to encrypt
- * @param publicKey - The base64-encoded public key from GitHub
- * @returns The base64-encoded encrypted value
- */
-async function encryptValue(value: string, publicKey: string): Promise<string> {
-  // Initialize libsodium
-  await sodium.ready;
-
-  // Convert the public key from base64 to binary
-  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
-
-  // Convert the message to a Uint8Array
-  const binMessage = sodium.from_string(value);
-
-  // Encrypt the message with the public key using libsodium's sealed box
-  const encryptedBin = sodium.crypto_box_seal(binMessage, binKey);
-
-  // Convert the encrypted message to base64
-  return sodium.to_base64(encryptedBin, sodium.base64_variants.ORIGINAL);
-}
-
 /**
  * Resource for managing GitHub repository secrets
  */
@@ -121,7 +96,10 @@ export class GitHubSecret extends Resource(
         );
 
         // Encrypt the secret value using libsodium
-        const encryptedValue = await encryptValue(props.value, publicKey.key);
+        const encryptedValue = await encryptString(
+          props.value.unencrypted,
+          publicKey.key,
+        );
 
         // Create or update the secret with the encrypted value and key_id
         const response = await octokit.rest.actions.createOrUpdateRepoSecret({
@@ -132,11 +110,6 @@ export class GitHubSecret extends Resource(
           key_id: publicKey.key_id,
         });
 
-        // Log success
-        if (!ctx.quiet) {
-          console.log(`Successfully created/updated secret: ${props.name}`);
-        }
-
         // GitHub doesn't return the secret details on create/update, so we need to construct it
         const output: GitHubSecretOutput = {
           id: `${props.owner}/${props.repository}/${props.name}`,
@@ -170,3 +143,31 @@ export class GitHubSecret extends Resource(
     }
   },
 ) {}
+
+/**
+ * Encrypt a value for GitHub using libsodium
+ * Based on GitHub's documentation for encrypting secrets
+ *
+ * @param value - The secret value to encrypt
+ * @param publicKey - The base64-encoded public key from GitHub
+ * @returns The base64-encoded encrypted value
+ */
+async function encryptString(
+  value: string,
+  publicKey: string,
+): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Convert the public key from base64 to binary
+  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+
+  // Convert the message to a Uint8Array
+  const binMessage = sodium.from_string(value);
+
+  // Encrypt the message with the public key using libsodium's sealed box
+  const encryptedBin = sodium.crypto_box_seal(binMessage, binKey);
+
+  // Convert the encrypted message to base64
+  return sodium.to_base64(encryptedBin, sodium.base64_variants.ORIGINAL);
+}

package/src/index.ts

@@ -12,4 +12,5 @@ export {
   type DeleteContext,
   type UpdateContext,
 } from "./resource";
+export * from "./secret";
 export type { FileSystemStateStore as StateStore } from "./state";