alchemy 0.24.1 → 0.26.0

package/src/aws/function.ts

@@ -19,6 +19,7 @@ import type { Context } from "../context.ts";
 import type { Bundle } from "../esbuild/bundle.ts";
 import { Resource } from "../resource.ts";
 import { ignore } from "../util/ignore.ts";
+import { logger } from "../util/logger.ts";
 import { retry } from "./retry.ts";
 
 /**
@@ -325,7 +326,7 @@ export const Function = Resource(
           );
         } catch (error: any) {
           if (error.name !== "ResourceNotFoundException") {
-            console.warn("Failed to delete function URL:", error);
+            logger.warn("Failed to delete function URL:", error);
           }
         }
       }
@@ -446,7 +447,7 @@ export const Function = Resource(
                   );
                 } catch (permError: any) {
                   if (!permError.message?.includes("already exists")) {
-                    console.warn("Error adding URL permission:", permError);
+                    logger.warn("Error adding URL permission:", permError);
                   }
                 }
               }
@@ -489,7 +490,7 @@ export const Function = Resource(
                   );
                 } catch (permError: any) {
                   if (!permError.message?.includes("already exists")) {
-                    console.warn("Error adding URL permission:", permError);
+                    logger.warn("Error adding URL permission:", permError);
                   }
                 }
               }
@@ -534,7 +535,7 @@ export const Function = Resource(
                   );
                 } catch (permError: any) {
                   if (!permError.message?.includes("already exists")) {
-                    console.warn("Error adding URL permission:", permError);
+                    logger.warn("Error adding URL permission:", permError);
                   }
                 }
               }
@@ -555,7 +556,7 @@ export const Function = Resource(
             functionUrl = undefined;
           } catch (error: any) {
             if (error.name !== "ResourceNotFoundException") {
-              console.warn("Failed to delete function URL:", error);
+              logger.warn("Failed to delete function URL:", error);
             }
           }
         }
@@ -673,12 +674,12 @@ export const Function = Resource(
                 );
               } catch (permError: any) {
                 if (!permError.message?.includes("already exists")) {
-                  console.warn("Error adding URL permission:", permError);
+                  logger.warn("Error adding URL permission:", permError);
                 }
               }
             }
           } catch (error) {
-            console.warn("Failed to create function URL:", error);
+            logger.warn("Failed to create function URL:", error);
           }
         }
       } else {
@@ -717,7 +718,7 @@ export const Function = Resource(
         functionUrl = urlConfig.FunctionUrl;
       } catch (error: any) {
         if (error.name !== "ResourceNotFoundException") {
-          console.warn("Failed to get function URL:", error);
+          logger.warn("Failed to get function URL:", error);
         }
       }
     }

package/src/aws/oidc/oidc-provider.ts

@@ -9,6 +9,7 @@ import {
 } from "@aws-sdk/client-iam";
 import type { Context } from "../../context.ts";
 import { Resource } from "../../resource.ts";
+import { logger } from "../../util/logger.ts";
 import { AccountId } from "../account-id.ts";
 
 /**
@@ -173,7 +174,7 @@ export const OIDCProvider = Resource(
           }
         } catch (error) {
           // Log but don't throw on cleanup errors
-          console.error("Error during cleanup:", error);
+          logger.error("Error during cleanup:", error);
         }
       }
       return this.destroy();
@@ -285,7 +286,7 @@ export const OIDCProvider = Resource(
         createdAt: Date.now(),
       });
     } catch (error) {
-      console.error("Error configuring OIDC provider:", error);
+      logger.error("Error configuring OIDC provider:", error);
       throw error;
     }
   },

package/src/aws/queue.ts

@@ -9,6 +9,7 @@ import {
 } from "@aws-sdk/client-sqs";
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
+import { logger } from "../util/logger.ts";
 import { retry } from "./retry.ts";
 
 /**
@@ -193,7 +194,7 @@ export const Queue = Resource(
           }
         }
       } catch (error: any) {
-        console.log(error.message);
+        logger.log(error.message);
         if (!isQueueDoesNotExist(error)) {
           throw error;
         }
@@ -274,7 +275,7 @@ export const Queue = Resource(
       });
     } catch (error: any) {
       if (isQueueDeletedRecently(error)) {
-        console.log(
+        logger.log(
           `Queue "${queueName}" was recently deleted and can't be re-created. Waiting and retrying...`,
         );
         // Queue was recently deleted, wait and retry

package/src/aws/role.ts

@@ -18,6 +18,7 @@ import {
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
 import { ignore } from "../util/ignore.ts";
+import { logger } from "../util/logger.ts";
 import type { PolicyDocument } from "./policy.ts";
 import { retry } from "./retry.ts";
 
@@ -289,7 +290,7 @@ export const Role = Resource(
         // If we get any other error besides NoSuchEntityException, log it but don't fail
         // This ensures the resource is still marked as destroyed
         if (error.name !== NoSuchEntityException.name) {
-          console.error(`Error deleting role ${props.roleName}:`, error);
+          logger.error(`Error deleting role ${props.roleName}:`, error);
         }
       }
 
@@ -359,6 +360,7 @@ export const Role = Resource(
           throw error;
         }
       } else if (error.name !== NoSuchEntityException.name) {
+        logger.error("Error creating/updating role:", error);
         throw error;
       }
     }

package/src/aws/ssm-parameter.ts

@@ -12,6 +12,7 @@ import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
 import { type Secret, isSecret } from "../secret.ts";
 import { ignore } from "../util/ignore.ts";
+import { logger } from "../util/logger.ts";
 
 /**
  * Base properties shared by all SSM Parameter types
@@ -308,7 +309,7 @@ export const SSMParameter = Resource(
         type: (parameter.Parameter.Type as any) ?? parameterType,
       } as SSMParameter);
     } catch (error: any) {
-      console.error(`Error creating/updating parameter ${props.name}:`, error);
+      logger.error(`Error creating/updating parameter ${props.name}:`, error);
       throw error;
     }
   },

package/src/cloudflare/account-api-token.ts

@@ -2,6 +2,7 @@ import { alchemy } from "../alchemy.ts";
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
 import type { Secret } from "../secret.ts";
+import { logger } from "../util/logger.ts";
 import { sha256 } from "../util/sha256.ts";
 import { createCloudflareApi, type CloudflareApiOptions } from "./api.ts";
 import {
@@ -269,10 +270,10 @@ export const AccountApiToken = Resource(
             const errorData: any = await deleteResponse.json().catch(() => ({
               errors: [{ message: deleteResponse.statusText }],
             }));
-            console.error(`Error deleting token '${props.name}':`, errorData);
+            logger.error(`Error deleting token '${props.name}':`, errorData);
           }
         } catch (error) {
-          console.error(`Error deleting token '${props.name}':`, error);
+          logger.error(`Error deleting token '${props.name}':`, error);
         }
       }
 

package/src/cloudflare/ai-gateway.ts

@@ -1,6 +1,7 @@
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
 import { bind } from "../runtime/bind.ts";
+import { logger } from "../util/logger.ts";
 import { handleApiError } from "./api-error.ts";
 import { createCloudflareApi, type CloudflareApiOptions } from "./api.ts";
 import type { Bound } from "./bound.ts";
@@ -187,7 +188,7 @@ const AiGatewayResource = Resource(
           await handleApiError(deleteResponse, "delete", "ai gateway", id);
         }
       } catch (error) {
-        console.error(`Error deleting AI Gateway ${id}:`, error);
+        logger.error(`Error deleting AI Gateway ${id}:`, error);
         throw error;
       }
       return this.destroy();
@@ -217,7 +218,7 @@ const AiGatewayResource = Resource(
         const getResponse = await api.get(gatewayPath);
         if (getResponse.status === 200) {
           // Gateway exists, treat as update (PUT)
-          console.log(
+          logger.log(
             `AI Gateway '${id}' already exists. Updating existing resource.`,
           );
           const requestBody = mapPropsToApi(id, mergedProps, false);
@@ -240,7 +241,7 @@ const AiGatewayResource = Resource(
       const data: { result: Record<string, any> } = await response!.json();
       apiResource = data.result;
     } catch (error) {
-      console.error(`Error ${this.phase} AI Gateway '${id}':`, error);
+      logger.error(`Error ${this.phase} AI Gateway '${id}':`, error);
       throw error; // Re-throw the error to fail the deployment
     }
 

package/src/cloudflare/ai.ts

@@ -1,4 +1,25 @@
 /**
+ * Cloudflare Workers AI binding for running machine learning models.
+ *
+ * The AI binding provides access to Cloudflare's Workers AI platform, allowing you to run
+ * inference on various AI models including text generation, image classification, embeddings,
+ * and more directly from your Workers.
+ *
+ * @example
+ * ```ts
+ * import { Worker, Ai } from "alchemy/cloudflare";
+ *
+ * const ai = new Ai();
+ *
+ * await Worker("my-worker", {
+ *   name: "my-worker",
+ *   entrypoint: "./src/worker.ts",
+ *   bindings: {
+ *     AI: ai
+ *   }
+ * });
+ * ```
+ *
  * @see https://developers.cloudflare.com/workers-ai/
  */
 export class Ai<Models extends AiModelListType = AiModelListType> {

package/src/cloudflare/api-error.ts

@@ -42,12 +42,36 @@ export class CloudflareApiError extends Error {
  * @param resourceName The name/identifier of the specific resource
  * @returns Never returns - always throws an error
  */
+/**
+ * Helper function to detect OAuth token authentication limitations
+ * Does not consume the response - uses the provided parsed JSON data
+ *
+ * @param json The parsed JSON response data
+ * @param action The action being performed (e.g., "creating", "deleting")
+ * @param resourceType The type of resource being acted upon (e.g., "email routing")
+ * @returns true if it's an OAuth error, false otherwise
+ */
+function isOAuthError(
+  json: any,
+  _action: string,
+  _resourceType: string,
+): boolean {
+  const errors: { message: string; code?: number }[] = json?.errors || [];
+  return errors.some(
+    (error) =>
+      error.message?.includes("oauth_token authentication scheme") ||
+      error.message?.includes("POST method not allowed") ||
+      error.code === 10000,
+  );
+}
+
 export async function handleApiError(
   response: Response,
   action: string,
   resourceType: string,
   resourceName?: string,
 ): Promise<never> {
+  // Read response body once and parse it
   const text = await response.text();
   let json: any;
   try {
@@ -55,6 +79,18 @@ export async function handleApiError(
   } catch {
     json = { errors: [{ message: text }] };
   }
+
+  // Check for OAuth-specific errors first
+  if (isOAuthError(json, action, resourceType)) {
+    throw new Error(
+      `${resourceType} ${action} requires API token authentication. ` +
+        `OAuth tokens from 'wrangler login' don't support this operation. ` +
+        "Please set CLOUDFLARE_API_TOKEN environment variable or pass apiToken option. " +
+        "You can create an API token at https://dash.cloudflare.com/profile/api-tokens",
+    );
+  }
+
+  // Handle general API errors
   const errors: { message: string }[] = json?.errors || [
     { message: response.statusText },
   ];

package/src/cloudflare/api.ts

@@ -176,7 +176,7 @@ export class CloudflareApi {
           headers,
         });
         if (response.status.toString().startsWith("5")) {
-          throw new InternalError("5xx error");
+          throw new InternalError(response.statusText);
         }
         if (response.status === 403 && !forbidden) {
           // we occasionally get 403s from Cloudflare tha tare actually transient
@@ -185,7 +185,10 @@ export class CloudflareApi {
           throw new ForbiddenError();
         }
         if (response.status === 429) {
-          throw new TooManyRequestsError();
+          const data: any = await response.json();
+          throw new TooManyRequestsError(
+            data.errors[0].message ?? response.statusText,
+          );
         }
         return response;
       },
@@ -267,8 +270,10 @@ export class CloudflareApi {
 class InternalError extends Error {}
 
 class TooManyRequestsError extends Error {
-  constructor() {
-    super(`Cloudflare Rate Limit Exceeded at ${new Date().toISOString()}`);
+  constructor(message: string) {
+    super(
+      `Cloudflare Rate Limit Exceeded at ${new Date().toISOString()}: ${message}`,
+    );
   }
 }
 

package/src/cloudflare/assets.ts

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
 import { getContentType } from "../util/content-type.ts";
+import ignore from "../util/ignore-matcher.js";
 
 /**
  * Properties for creating or updating Assets
@@ -111,7 +112,8 @@ export const Assets = Resource(
     }
 
     // Recursively get all files in the assets directory
-    const filesList = await getFilesRecursively(props.path);
+    const ignoreMatcher = await createIgnoreMatcher(props.path);
+    const filesList = await getFilesRecursively(props.path, ignoreMatcher);
 
     // Create asset file objects
     const files: AssetFile[] = filesList.map((filePath) => {
@@ -140,19 +142,41 @@ export const Assets = Resource(
   },
 );
 
+async function createIgnoreMatcher(
+  dir: string,
+): Promise<{ ignores: (path: string) => boolean }> {
+  const ignoreMatcher = ignore().add(".assetsignore");
+  const ignorePath = path.join(dir, ".assetsignore");
+  try {
+    const content = await fs.readFile(ignorePath, "utf-8");
+    ignoreMatcher.add(content.split("\n"));
+  } catch {
+    // ignore
+  }
+  return ignoreMatcher;
+}
+
 // Helper functions for file operations
-async function getFilesRecursively(dir: string): Promise<string[]> {
+async function getFilesRecursively(
+  dir: string,
+  ignoreMatcher: { ignores: (path: string) => boolean },
+): Promise<string[]> {
   const files = await fs.readdir(dir, { withFileTypes: true });
+  const result: string[] = [];
 
-  const allFiles = await Promise.all(
+  await Promise.all(
     files.map(async (file) => {
       const path = `${dir}/${file.name}`;
+      if (ignoreMatcher.ignores(file.name)) {
+        return;
+      }
       if (file.isDirectory()) {
-        return getFilesRecursively(path);
+        result.push(...(await getFilesRecursively(path, ignoreMatcher)));
+      } else {
+        result.push(path);
       }
-      return path;
     }),
   );
 
-  return allFiles.flat();
+  return result;
 }

package/src/cloudflare/astro.ts

@@ -0,0 +1,176 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import { alchemy } from "../alchemy.ts";
+import { Exec } from "../os/exec.ts";
+import { Scope } from "../scope.ts";
+import { Assets } from "./assets.ts";
+import type { Bindings } from "./bindings.ts";
+import type { Website, WebsiteProps } from "./website.ts";
+import {
+  DEFAULT_COMPATIBILITY_DATE,
+  Worker,
+  type WorkerProps,
+} from "./worker.ts";
+import { WranglerJson } from "./wrangler.json.ts";
+
+/**
+ * Properties for creating an Astro resource.
+ * Extends WebsiteProps, allowing customization of the underlying Website.
+ */
+export interface AstroProps<B extends Bindings> extends WebsiteProps<B> {}
+
+/**
+ * Represents the output of an Astro resource deployment.
+ * It resolves to the underlying Cloudflare Worker type, ensuring type safety.
+ * Prevents overriding the internal ASSETS binding.
+ */
+export type Astro<B extends Bindings> = B extends { ASSETS: any }
+  ? never
+  : Worker<B & { ASSETS: Assets }>;
+
+/**
+ * Creates and deploys an Astro application using the Cloudflare adapter.
+ *
+ * This resource simplifies deploying Astro applications by providing sensible
+ * defaults for the build command, main entrypoint, and assets directory
+ * based on the `@astrojs/cloudflare` adapter output.
+ *
+ * It wraps the underlying `Website` resource.
+ *
+ * @param id A unique identifier for the resource.
+ * @param props Configuration options for the Astro deployment, overriding defaults.
+ * @returns A promise that resolves to the deployed Cloudflare Worker details.
+ *
+ * @example
+ * ## Deploy a basic Astro site with default settings
+ *
+ * Deploy an Astro application with minimal configuration using default build settings.
+ *
+ * ```ts
+ * import { Astro } from "alchemy/cloudflare";
+ *
+ * const astroSite = await Astro("my-astro-app");
+ * ```
+ *
+ * @example
+ * ## Deploy with custom bindings and build command
+ *
+ * Deploy an Astro application with custom Cloudflare bindings and build configuration.
+ *
+ * ```ts
+ * import { Astro, D1Database } from "alchemy/cloudflare";
+ *
+ * const db = await D1Database("my-db");
+ * const astroSiteWithDb = await Astro("my-astro-app-with-db", {
+ *   command: "npm run build", // Specify a custom build command
+ *   bindings: {
+ *     DB: db, // Add custom bindings
+ *   },
+ * });
+ * ```
+ */
+export async function Astro<B extends Bindings>(
+  id: string,
+  props?: Partial<AstroProps<B>>,
+): Promise<Astro<B>> {
+  if (props?.bindings?.ASSETS) {
+    throw new Error("ASSETS binding is reserved for internal use");
+  }
+  const wrangler = props?.wrangler ?? true;
+  const main = props?.main ?? path.join("dist", "_worker.js/index.js");
+  const assetsDir =
+    typeof props?.assets === "string"
+      ? props?.assets
+      : (props?.assets?.dist ?? "dist");
+
+  return alchemy.run(
+    id,
+    {
+      parent: Scope.current,
+    },
+    async () => {
+      const cwd = path.resolve(props?.cwd || process.cwd());
+      const fileName =
+        typeof wrangler === "boolean"
+          ? "wrangler.jsonc"
+          : typeof wrangler === "string"
+            ? wrangler
+            : (wrangler?.path ?? "wrangler.jsonc");
+      const wranglerPath =
+        fileName && path.relative(cwd, path.join(cwd, fileName));
+      const wranglerMain =
+        typeof wrangler === "object"
+          ? (wrangler.main ?? props?.main)
+          : props?.main;
+
+      const workerName = props?.name ?? id;
+
+      const workerProps = {
+        ...props,
+        compatibilityDate:
+          props?.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE,
+        compatibilityFlags: [
+          "nodejs_compat",
+          ...(props?.compatibilityFlags ?? []),
+        ],
+        name: workerName,
+        entrypoint: main,
+        assets: {
+          html_handling: "auto-trailing-slash",
+          not_found_handling: "single-page-application",
+          run_worker_first: false,
+          ...(typeof props?.assets === "string" ? {} : props?.assets),
+        },
+        script: props?.main
+          ? undefined
+          : `
+export default {
+  async fetch(request, env) {
+    return new Response("Not Found", { status: 404 });
+  },
+};`,
+        url: true,
+        adopt: true,
+      } as WorkerProps<any> & { name: string };
+
+      if (wrangler) {
+        await WranglerJson("wrangler.jsonc", {
+          path: wranglerPath,
+          worker: workerProps,
+          main: wranglerMain,
+          // hard-code the assets directory because we haven't yet included the assets binding
+          assets: {
+            binding: "ASSETS",
+            directory: assetsDir,
+          },
+        });
+      }
+
+      if (props?.command) {
+        await Exec("build", {
+          cwd,
+          command: props?.command,
+          env: props?.env,
+          memoize: props?.memoize,
+        });
+      }
+
+      await writeFile(
+        path.join(cwd, assetsDir, ".assetsignore"),
+        ["_worker.js", "_routes.json"].join("\n"),
+      );
+
+      return (await Worker("worker", {
+        ...workerProps,
+        bindings: {
+          ...workerProps.bindings,
+          // we don't include the Assets binding until after build to make sure the asset manifest is correct
+          // we generate the wrangler.json using all the bind
+          ASSETS: await Assets("assets", {
+            path: assetsDir,
+          }),
+        },
+      } as WorkerProps<any> & { name: string })) as Website<B>;
+    },
+  );
+}

package/src/cloudflare/auth.ts

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import type { Secret } from "../secret.ts";
+import { createXdgAppPaths } from "../util/xdg-paths.ts";
 /**
  * Authentication options for Cloudflare API
  */
@@ -195,9 +196,9 @@ async function findWranglerConfig(): Promise<string> {
     `${environment === "production" ? "default.toml" : `${environment}.toml`}`,
   );
 
-  const xdgAppPaths = (await import("xdg-app-paths")).default;
+  const xdgAppPaths = createXdgAppPaths(".wrangler");
   //TODO: We should implement a custom path --global-config and/or the WRANGLER_HOME type environment variable
-  const configDir = xdgAppPaths(".wrangler").config(); // New XDG compliant config path
+  const configDir = xdgAppPaths.config(); // New XDG compliant config path
   const legacyConfigDir = path.join(os.homedir(), ".wrangler"); // Legacy config in user's home directory
 
   // Check for the .wrangler directory in root if it is not there then use the XDG compliant path.

package/src/cloudflare/bindings.ts

@@ -17,11 +17,13 @@ import type { HyperdriveResource } from "./hyperdrive.ts";
 import type { KVNamespaceResource } from "./kv-namespace.ts";
 import type { PipelineResource } from "./pipeline.ts";
 import type { QueueResource } from "./queue.ts";
+import type { SecretsStore } from "./secrets-store.ts";
 import type { VectorizeIndexResource } from "./vectorize-index.ts";
 import type { VersionMetadata } from "./version-metadata.ts";
 import type { WorkerStub } from "./worker-stub.ts";
 import type { Worker, WorkerRef } from "./worker.ts";
 import type { Workflow } from "./workflow.ts";
+import type { Images } from "./images.ts";
 
 export type Bindings = {
   [bindingName: string]: Binding;
@@ -44,10 +46,12 @@ export type Binding =
   | AnalyticsEngineDataset
   | DurableObjectNamespace<Rpc.DurableObjectBranded | undefined>
   | HyperdriveResource
+  | Images
   | KVNamespaceResource
   | PipelineResource
   | QueueResource
   | R2BucketResource
+  | SecretsStore<any>
   | {
       type: "kv_namespace";
       id: string;
@@ -91,6 +95,7 @@ export type WorkerBindingSpec =
   | WorkerBindingDispatchNamespace
   | WorkerBindingDurableObjectNamespace
   | WorkerBindingHyperdrive
+  | WorkerBindingImages
   | WorkerBindingJson
   | WorkerBindingKVNamespace
   | WorkerBindingMTLSCertificate
@@ -99,6 +104,7 @@ export type WorkerBindingSpec =
   | WorkerBindingQueue
   | WorkerBindingR2Bucket
   | WorkerBindingSecretText
+  | WorkerBindingSecretsStore
   | WorkerBindingService
   | WorkerBindingStaticContent
   | WorkerBindingTailConsumer
@@ -294,6 +300,17 @@ export interface WorkerBindingSecretText {
   text: string;
 }
 
+export interface WorkerBindingSecretsStore {
+  /** The name of the binding */
+  name: string;
+  /** Type identifier for Secrets Store binding */
+  type: "secrets_store";
+  /** Store ID */
+  store_id: string;
+  /** Secret name */
+  secret_name: string;
+}
+
 /**
  * Service binding type
  */
@@ -384,6 +401,16 @@ export interface WorkerBindingWorkflow {
   script_name?: string;
 }
 
+/**
+ * Images binding type
+ */
+export interface WorkerBindingImages {
+  /** The name of the binding */
+  name: string;
+  /** Type identifier for Images binding */
+  type: "images";
+}
+
 /**
  * Pipeline binding type
  */