alchemy 0.12.21 → 0.14.0

package/src/cloudflare/ai-gateway.ts

@@ -154,7 +154,7 @@ export const AiGateway = Resource(
   async function (
     this: Context<AiGateway>,
     id: string,
-    props: AiGatewayProps = {}
+    props: AiGatewayProps = {},
   ): Promise<AiGateway> {
     const api = await createCloudflareApi(props);
     const gatewayPath = `/accounts/${api.accountId}/ai-gateway/gateways/${id}`;
@@ -199,7 +199,7 @@ export const AiGateway = Resource(
         if (getResponse.status === 200) {
           // Gateway exists, treat as update (PUT)
           console.log(
-            `AI Gateway '${id}' already exists. Updating existing resource.`
+            `AI Gateway '${id}' already exists. Updating existing resource.`,
           );
           const requestBody = mapPropsToApi(id, mergedProps, false);
           response = await api.put(gatewayPath, requestBody);
@@ -248,14 +248,14 @@ export const AiGateway = Resource(
       logpushPublicKey: apiResource.logpush_public_key,
       type: "ai_gateway",
     });
-  }
+  },
 );
 
 // Helper function to map props to the API request body format
 function mapPropsToApi(
   id: string,
   props: AiGatewayProps,
-  includeIdInBody: boolean = false
+  includeIdInBody = false,
 ): Record<string, any> {
   const body: Record<string, any> = {};
   if (includeIdInBody) {

package/src/cloudflare/ai.ts

@@ -2,7 +2,7 @@
  * @see https://developers.cloudflare.com/workers-ai/
  */
 export class Ai<Models extends AiModelListType = AiModelListType> {
-  public readonly type: "ai" = "ai";
+  public readonly type = "ai";
 
   /**
    * @internal

package/src/cloudflare/api-error.ts

@@ -46,7 +46,7 @@ export async function handleApiError(
   response: Response,
   action: string,
   resourceType: string,
-  resourceName: string
+  resourceName: string,
 ): Promise<never> {
   const text = await response.text();
   let json: any;

package/src/cloudflare/api.ts

@@ -1,6 +1,11 @@
+import { alchemy } from "../alchemy.js";
 import type { Secret } from "../secret.js";
 import { withExponentialBackoff } from "../util/retry.js";
-import { getCloudflareAuthHeaders, getCloudflareUserInfo } from "./auth.js";
+import {
+  getCloudflareAuthHeaders,
+  type CloudflareAuthOptions,
+} from "./auth.js";
+import { getCloudflareUserInfo, getUserEmailFromApiKey } from "./user.js";
 
 /**
  * Options for Cloudflare API requests
@@ -29,11 +34,6 @@ export interface CloudflareApiOptions {
    */
   accountId?: string;
 
-  /**
-   * Zone ID to use (overrides CLOUDFLARE_ZONE_ID env var)
-   */
-  zoneId?: string;
-
   /**
    * Email to use with API Key authentication
    * If not provided, will attempt to discover from Cloudflare API
@@ -48,16 +48,43 @@ export interface CloudflareApiOptions {
  * @returns Promise resolving to a CloudflareApi instance
  */
 export async function createCloudflareApi(
-  options: Partial<CloudflareApiOptions> = {}
+  options: Partial<CloudflareApiOptions> = {},
 ): Promise<CloudflareApi> {
-  const userInfo = await getCloudflareUserInfo(options);
+  const apiKey =
+    options.apiKey ??
+    (process.env.CLOUDFLARE_API_KEY
+      ? alchemy.secret(process.env.CLOUDFLARE_API_KEY)
+      : undefined);
+  const apiToken =
+    options.apiToken ??
+    (process.env.CLOUDFLARE_API_TOKEN
+      ? alchemy.secret(process.env.CLOUDFLARE_API_TOKEN)
+      : undefined);
+  let email = options.email ?? process.env.CLOUDFLARE_EMAIL;
+  if (apiKey && !email) {
+    email = await getUserEmailFromApiKey(apiKey.unencrypted);
+  }
+  const accountId =
+    options.accountId ??
+    process.env.CLOUDFLARE_ACCOUNT_ID ??
+    (
+      await getCloudflareUserInfo({
+        apiKey,
+        apiToken,
+        email,
+      } as CloudflareAuthOptions)
+    ).accounts[0]?.id;
+  if (accountId === undefined) {
+    throw new Error(
+      "Either accountId or CLOUDFLARE_ACCOUNT_ID must be provided",
+    );
+  }
   return new CloudflareApi({
     baseUrl: options.baseUrl,
-    accountId: options.accountId ?? userInfo.accounts[0].id!,
-    email: userInfo.email!,
-    apiKey: userInfo.apiKey,
-    apiToken: userInfo.apiToken,
-    zoneId: options.zoneId,
+    accountId,
+    email,
+    apiKey,
+    apiToken,
   });
 }
 
@@ -67,6 +94,11 @@ export async function createCloudflareApi(
 export class CloudflareApi {
   public readonly accountId: string;
   public readonly baseUrl: string;
+  public readonly apiKey: Secret | undefined;
+  public readonly apiToken: Secret | undefined;
+  public readonly email: string | undefined;
+  public readonly authOptions: CloudflareAuthOptions;
+
   /**
    * Create a new Cloudflare API client
    * Use createCloudflareApi factory function instead of direct constructor
@@ -75,12 +107,29 @@ export class CloudflareApi {
    * @param options API options
    */
   constructor(
-    private readonly options: CloudflareApiOptions & {
+    options: CloudflareApiOptions & {
       accountId: string;
-    }
+    },
   ) {
     this.accountId = options.accountId;
     this.baseUrl = options.baseUrl ?? "https://api.cloudflare.com/client/v4";
+    this.apiKey = options.apiKey;
+    this.apiToken = options.apiToken;
+    this.email = options.email;
+
+    if (this.apiKey && this.apiToken) {
+      throw new Error("'apiKey' and 'apiToken' cannot both be provided");
+    } else if (this.apiKey && !this.email) {
+      throw new Error("'email' must be provided if 'apiKey' is provided");
+    }
+    this.authOptions = this.apiKey
+      ? {
+          apiKey: this.apiKey,
+          email: this.email!,
+        }
+      : {
+          apiToken: this.apiToken,
+        };
   }
 
   /**
@@ -106,7 +155,7 @@ export class CloudflareApi {
       headers = init.headers;
     }
     headers = {
-      ...(await getCloudflareAuthHeaders(this.options)),
+      ...(await getCloudflareAuthHeaders(this.authOptions)),
       ...headers,
     };
 
@@ -130,7 +179,7 @@ export class CloudflareApi {
       // transient errors should be retried aggressively
       (error) => error instanceof InternalError,
       5, // Maximum 5 attempts (1 initial + 4 retries)
-      1000 // Start with 1s delay, will exponentially increase
+      1000, // Start with 1s delay, will exponentially increase
     );
   }
 
@@ -153,7 +202,7 @@ export class CloudflareApi {
   async post(
     path: string,
     body: any,
-    init: RequestInit = {}
+    init: RequestInit = {},
   ): Promise<Response> {
     const requestBody =
       body instanceof FormData
@@ -170,7 +219,7 @@ export class CloudflareApi {
   async put(
     path: string,
     body: any,
-    init: RequestInit = {}
+    init: RequestInit = {},
   ): Promise<Response> {
     const requestBody = body instanceof FormData ? body : JSON.stringify(body);
     return this.fetch(path, { ...init, method: "PUT", body: requestBody });
@@ -182,7 +231,7 @@ export class CloudflareApi {
   async patch(
     path: string,
     body: any,
-    init: RequestInit = {}
+    init: RequestInit = {},
   ): Promise<Response> {
     return this.fetch(path, {
       ...init,
@@ -199,8 +248,4 @@ export class CloudflareApi {
   }
 }
 
-class InternalError extends Error {
-  constructor(message: string) {
-    super(message);
-  }
-}
+class InternalError extends Error {}

package/src/cloudflare/assets.ts

@@ -92,7 +92,7 @@ export const Assets = Resource(
   async function (
     this: Context<Assets>,
     id: string,
-    props: AssetsProps
+    props: AssetsProps,
   ): Promise<Assets> {
     if (this.phase === "delete") {
       return this.destroy();
@@ -106,7 +106,7 @@ export const Assets = Resource(
       }
     } catch (error) {
       throw new Error(
-        `Assets directory ${props.path} does not exist or is not accessible`
+        `Assets directory ${props.path} does not exist or is not accessible`,
       );
     }
 
@@ -137,7 +137,7 @@ export const Assets = Resource(
       createdAt: this.output?.createdAt || now,
       updatedAt: now,
     });
-  }
+  },
 );
 
 // Helper functions for file operations
@@ -151,7 +151,7 @@ async function getFilesRecursively(dir: string): Promise<string[]> {
         return getFilesRecursively(path);
       }
       return path;
-    })
+    }),
   );
 
   return allFiles.flat();

package/src/cloudflare/auth.ts

@@ -2,203 +2,88 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import type { Secret } from "../secret.js";
-import type { CloudflareAccountId } from "./account-id.js";
-import { handleApiError } from "./api-error.js";
 /**
  * Authentication options for Cloudflare API
  */
-export interface CloudflareAuthOptions {
+export type CloudflareAuthOptions =
+  | CloudflareApiKeyAuthOptions
+  | CloudflareApiTokenAuthOptions;
+
+export type CloudflareApiKeyAuthOptions = {
   /**
    * API Key to use with API Key
    */
-  apiKey?: Secret;
-
+  apiKey: Secret;
   /**
-   * API Token to use with API Key
+   * Email to use with API Key
+   * If not provided, will attempt to discover from Cloudflare API
    */
-  apiToken?: Secret;
+  email: string;
 
   /**
-   * Email to use with API Key
-   * If not provided, will attempt to discover from Cloudflare API
+   * API Token to use with API Key
    */
-  email?: string;
-}
+  apiToken?: undefined;
+};
 
-export interface CloudflareAccount {
-  name: string;
-  id: CloudflareAccountId;
-  type: "standard" | "zero_rating" | "full_control";
-  settings: {
-    enforce_twofactor: boolean;
-    api_access_enabled: null;
-    access_approval_expiry: null;
-    abuse_contact_email: null;
-  };
-  legacy_flags: {
-    enterprise_zone_quota: {
-      maximum: number;
-      current: number;
-      available: number;
-    };
-  };
+export function isCloudflareApiKeyAuthOptions(
+  options: CloudflareAuthOptions | undefined,
+): options is CloudflareApiKeyAuthOptions {
+  return options !== undefined && options.apiKey !== undefined;
 }
 
-export interface CloudflareUserInfo {
+export type CloudflareApiTokenAuthOptions = {
+  /**
+   * API Token to use with API Key
+   */
   apiToken?: Secret;
-  apiKey?: Secret;
-  email: string;
-  username: string;
-  accounts: CloudflareAccount[];
-  organizations: CloudflareOrganization[];
-  tokenPermissions: string[] | undefined;
-  first_name: string | null;
-  last_name: string | null;
-  telephone: string | null;
-  country: string | null;
-  zipcode: string | null;
-  two_factor_authentication_enabled: boolean;
-  two_factor_authentication_locked: boolean;
-  has_pro_zones: boolean;
-  has_business_zones: boolean;
-  has_enterprise_zones: boolean;
-  suspended: boolean;
-  betas: string[];
-}
 
-export interface CloudflareOrganization {
-  id: string;
-  name: string;
-  status: string;
-  permissions: string[];
-  roles: string[];
-}
+  /**
+   * API Key to use with API Token
+   */
+  apiKey?: undefined;
 
-const userInfoCache: Record<string, CloudflareUserInfo> = {};
+  /**
+   * Email to use with API Token
+   */
+  email?: undefined;
+};
 
-export async function getCloudflareUserInfo(
-  options: CloudflareAuthOptions
-): Promise<CloudflareUserInfo> {
-  const cacheKey = JSON.stringify({
-    apiKey: options.apiKey?.unencrypted,
-    apiToken: options.apiToken?.unencrypted,
-    email: options.email,
-  });
-  if (userInfoCache[cacheKey]) {
-    return userInfoCache[cacheKey];
-  }
-  const headers = await getCloudflareAuthHeaders(options);
-  const user = await fetch("https://api.cloudflare.com/client/v4/user", {
-    headers,
-  });
-  if (!user.ok) {
-    if (user.status === 403) {
-      throw new Error(
-        "Cloudflare authentication required. Did you forget to login with `wrangler login` or set CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL, or CLOUDFLARE_API_KEY?"
-      );
-    }
-    await handleApiError(user, "getting", "user", "user");
-  }
-  const accounts = await fetch(
-    "https://api.cloudflare.com/client/v4/accounts",
-    {
-      headers,
-    }
-  );
-  const userInfo: CloudflareUserInfo = {
-    ...((await user.json()) as any).result,
-    accounts: ((await accounts.json()) as any).result,
-  };
-  userInfoCache[cacheKey] = userInfo;
-  return userInfo;
+export function isCloudflareApiTokenAuthOptions(
+  options: CloudflareAuthOptions | undefined,
+): options is CloudflareApiTokenAuthOptions {
+  return options !== undefined && options.apiToken !== undefined;
 }
 
 export async function getCloudflareAuthHeaders(
-  options: CloudflareAuthOptions = {}
+  options: CloudflareAuthOptions | undefined,
 ): Promise<Record<string, string>> {
-  // Check for API Token (preferred method)
-  const apiToken =
-    options.apiToken?.unencrypted ?? process.env.CLOUDFLARE_API_TOKEN;
-  if (apiToken) {
+  if (isCloudflareApiKeyAuthOptions(options)) {
+    // Global API Key
     return {
-      Authorization: `Bearer ${apiToken}`,
+      "X-Auth-Key": options.apiKey.unencrypted,
+      "X-Auth-Email": options.email,
     };
-  }
-
-  // Check for API Key
-  const apiKey = options.apiKey?.unencrypted ?? process.env.CLOUDFLARE_API_KEY;
-  if (apiKey) {
+  } else if (isCloudflareApiTokenAuthOptions(options)) {
+    // API Token
     return {
-      "X-Auth-Key": apiKey,
-      "X-Auth-Email":
-        options.email ??
-        process.env.CLOUDFLARE_EMAIL ??
-        (await getUserEmailFromApiKey(apiKey)),
+      Authorization: `Bearer ${options.apiToken?.unencrypted}`,
     };
   }
-
+  // Wrangler OAuth Token
   const authConfig = await getRefreshedAuthConfig();
   if (authConfig.oauth_token) {
     return {
       Authorization: `Bearer ${authConfig.oauth_token}`,
     };
   }
-
   throw new Error(
-    "Cloudflare authentication required. Did you forget to login with `wrangler login` or set CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL, or CLOUDFLARE_API_KEY?"
+    "Cloudflare authentication required. Did you forget to login with `wrangler login` or set CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY?",
   );
 }
 
-const emailCache: Record<string, string> = {};
-
-async function getUserEmailFromApiKey(apiKey: string): Promise<string> {
-  if (emailCache[apiKey]) {
-    return emailCache[apiKey];
-  }
-
-  try {
-    const baseUrl = "https://api.cloudflare.com/client/v4";
-
-    // Call the /user endpoint to get user information
-    const response = await fetch(`${baseUrl}/user`, {
-      headers: {
-        "Content-Type": "application/json",
-        "X-Auth-Key": apiKey,
-      },
-    });
-
-    if (!response.ok) {
-      throw new Error(
-        `Failed to get user information: ${response.status} ${response.statusText}`
-      );
-    }
-
-    const data = (await response.json()) as {
-      success: boolean;
-      result: {
-        id: string;
-        email: string;
-        name: string;
-        [key: string]: any;
-      };
-    };
-
-    if (!data.success || !data.result || !data.result.email) {
-      throw new Error("Cloudflare API did not return valid user information");
-    }
-
-    emailCache[apiKey] = data.result.email;
-    return data.result.email;
-  } catch (error) {
-    console.error("Error retrieving email from Cloudflare API:", error);
-    throw new Error(
-      "Failed to automatically discover email for API Key authentication"
-    );
-  }
-}
-
 async function refreshAuthToken(
-  options: WranglerConfig
+  options: WranglerConfig,
 ): Promise<WranglerConfig> {
   const response = await fetch("https://dash.cloudflare.com/oauth2/token", {
     method: "POST",
@@ -214,7 +99,7 @@ async function refreshAuthToken(
 
   if (!response.ok) {
     throw new Error(
-      `Failed to refresh auth token: ${response.status} ${response.statusText}`
+      `Failed to refresh auth token: ${response.status} ${response.statusText}`,
     );
   }
 
@@ -226,7 +111,7 @@ async function refreshAuthToken(
   options.oauth_token = data.access_token;
   options.refresh_token = data.refresh_token;
   options.expiration_time = new Date(
-    Date.now() + data.expires_in * 1000
+    Date.now() + data.expires_in * 1000,
   ).toISOString();
   options.scopes = data.scope?.split(" ") || [];
 
@@ -280,7 +165,7 @@ async function readWranglerConfig(): Promise<WranglerConfig> {
   const configPath = await findWranglerConfig();
   try {
     const config = (authConfigCache[configPath] ??= await parseTOML(
-      await fs.readFile(configPath, "utf-8")
+      await fs.readFile(configPath, "utf-8"),
     ));
     config.path = configPath;
 
@@ -307,7 +192,7 @@ async function findWranglerConfig(): Promise<string> {
   const environment = process.env.WRANGLER_API_ENVIRONMENT ?? "production";
   const filePath = path.join(
     "config",
-    `${environment === "production" ? "default.toml" : `${environment}.toml`}`
+    `${environment === "production" ? "default.toml" : `${environment}.toml`}`,
   );
 
   const xdgAppPaths = (await import("xdg-app-paths")).default;
@@ -318,7 +203,7 @@ async function findWranglerConfig(): Promise<string> {
   // Check for the .wrangler directory in root if it is not there then use the XDG compliant path.
   wranglerConfigPath = path.join(
     (await isDirectory(legacyConfigDir)) ? legacyConfigDir : configDir,
-    filePath
+    filePath,
   );
   return wranglerConfigPath;
 }