alchemy 0.40.1 → 0.41.0

package/src/cloudflare/index.ts

@@ -13,6 +13,7 @@ export * from "./browser-rendering.ts";
 export * from "./bucket.ts";
 export * from "./bundle/external.ts";
 export * from "./bundle/local-dev-cloudflare-shim.ts";
+export * from "./container.ts";
 export * from "./custom-domain.ts";
 export * from "./d1-clone.ts";
 export * from "./d1-database.ts";

package/src/cloudflare/worker/miniflare-worker-options.ts

@@ -225,6 +225,11 @@ export function buildMiniflareWorkerOptions({
     compatibilityDate,
     compatibilityFlags,
     unsafeDirectSockets: [{ entrypoint: undefined, proxy: true }],
+    // containerEngine: {
+    //   localDocker: {
+    //     socketPath: "/var/run/docker.sock",
+    //   }
+    // }
   };
   for (const [name, binding] of Object.entries(bindings ?? {})) {
     if (typeof binding === "string") {
@@ -513,6 +518,29 @@ export function buildMiniflareWorkerOptions({
         };
         break;
       }
+      case "container": {
+        (options.durableObjects ??= {})[name] = {
+          className: binding.className,
+          scriptName: binding.scriptName,
+          useSQLite: binding.sqlite,
+          container: {
+            imageName: binding.image.name,
+          },
+          // namespaceId: binding.namespaceId,
+          // unsafeUniqueKey?: string | typeof kUnsafeEphemeralUniqueKey | undefined;
+          // unsafePreventEviction?: boolean | undefined;
+          // remoteProxyConnectionString: binding.local
+          //   ? undefined
+          //   : remoteProxyConnectionString,
+        };
+        if (!binding.scriptName || binding.scriptName === workerName) {
+          options.unsafeDirectSockets!.push({
+            entrypoint: binding.className,
+            proxy: true,
+          });
+        }
+        break;
+      }
       default: {
         assertNever(binding);
       }

package/src/cloudflare/worker-metadata.ts

@@ -8,6 +8,7 @@ import {
   type WorkerBindingDurableObjectNamespace,
   type WorkerBindingSpec,
 } from "./bindings.ts";
+import { isContainer, type Container } from "./container.ts";
 import {
   isDurableObjectNamespace,
   type DurableObjectNamespace,
@@ -194,6 +195,7 @@ export interface WorkerMetadata {
     cron: string;
     suspended: boolean;
   }[];
+  containers?: { class_name: string }[];
 }
 
 export async function prepareWorkerMetadata(
@@ -207,8 +209,12 @@ export async function prepareWorkerMetadata(
   },
 ): Promise<WorkerMetadata> {
   const oldSettings = await getWorkerSettings(api, props.workerName);
-  const oldTags: string[] | undefined =
-    oldSettings?.default_environment?.script?.tags;
+  const oldTags: string[] | undefined = Array.from(
+    new Set([
+      ...(oldSettings?.default_environment?.script?.tags ?? []),
+      ...(oldSettings?.tags ?? []),
+    ]),
+  );
   const oldBindings = oldSettings?.bindings;
   // we use Cloudflare Worker tags to store a mapping between Alchemy's stable identifier and the binding name
   // e.g.
@@ -254,8 +260,9 @@ export async function prepareWorkerMetadata(
 
         // try and find the DO binding by stable id
         const object = Object.values(props.bindings).find(
-          (binding): binding is DurableObjectNamespace<any> =>
-            isDurableObjectNamespace(binding) && binding.id === stableId,
+          (binding): binding is DurableObjectNamespace | Container =>
+            (isDurableObjectNamespace(binding) || isContainer(binding)) &&
+            binding.id === stableId,
         );
         if (object) {
           // we found the corresponding object, it should not be deleted
@@ -302,7 +309,7 @@ export async function prepareWorkerMetadata(
       // we use this to reliably compute class migrations based on server-side state
       ...Object.entries(props.bindings ?? {}).flatMap(
         ([bindingName, binding]) =>
-          isDurableObjectNamespace(binding)
+          isDurableObjectNamespace(binding) || isContainer(binding)
             ? // TODO(sam): base64 encode if contains `:`?
               [`alchemy:do:${binding.id}:${bindingName}`]
             : [],
@@ -512,6 +519,21 @@ export async function prepareWorkerMetadata(
         key_base64: binding.key_base64?.unencrypted,
         key_jwk: binding.key_jwk?.unencrypted,
       });
+    } else if (binding.type === "container") {
+      meta.bindings.push({
+        type: "durable_object_namespace",
+        class_name: binding.className,
+        name: bindingName,
+      });
+      if (
+        binding.scriptName === undefined ||
+        // TODO(sam): not sure if Cloudflare Api would like us using `this` worker name here
+        binding.scriptName === props.workerName
+      ) {
+        // we do not need configure class migrations for cross-script bindings
+        configureClassMigration(bindingName, binding);
+      }
+      (meta.containers ??= []).push({ class_name: binding.className });
     } else {
       assertNever(
         binding,
@@ -525,7 +547,7 @@ export async function prepareWorkerMetadata(
 
   function configureClassMigration(
     bindingName: string,
-    newBinding: DurableObjectNamespace<any>,
+    newBinding: DurableObjectNamespace<any> | Container,
   ) {
     let prevBinding: WorkerBindingDurableObjectNamespace | undefined;
     if (oldBindings) {

package/src/cloudflare/worker.ts

@@ -33,7 +33,9 @@ import {
   type Binding,
   type Bindings,
   Json,
+  type WorkerBindingDurableObjectNamespace,
   type WorkerBindingService,
+  type WorkerBindingSpec,
 } from "./bindings.ts";
 import type { Bound } from "./bound.ts";
 import { isBucket } from "./bucket.ts";
@@ -42,6 +44,7 @@ import {
   type NoBundleResult,
   bundleWorkerScript,
 } from "./bundle/bundle-worker.ts";
+import { type Container, ContainerApplication } from "./container.ts";
 import { CustomDomain } from "./custom-domain.ts";
 import { isD1Database } from "./d1-database.ts";
 import type { DispatchNamespaceResource } from "./dispatch-namespace.ts";
@@ -1176,6 +1179,7 @@ export const _Worker = Resource(
       // Find any assets bindings
       const assetsBindings: { name: string; assets: Assets }[] = [];
       const workflowsBindings: Workflow[] = [];
+      const containersBindings: Container[] = [];
 
       if (props.bindings) {
         for (const [bindingName, binding] of Object.entries(props.bindings)) {
@@ -1184,6 +1188,8 @@ export const _Worker = Resource(
               assetsBindings.push({ name: bindingName, assets: binding });
             } else if (binding.type === "workflow") {
               workflowsBindings.push(binding);
+            } else if (binding.type === "container") {
+              containersBindings.push(binding);
             }
           }
         }
@@ -1223,6 +1229,7 @@ export const _Worker = Resource(
         compatibilityFlags,
         assetUploadResult,
       });
+      versionResult.versionId;
 
       for (const workflow of workflowsBindings) {
         if (
@@ -1237,6 +1244,47 @@ export const _Worker = Resource(
         }
       }
 
+      for (const container of containersBindings) {
+        async function findNamespaceId() {
+          const response = await api.get(
+            `/accounts/${api.accountId}/workers/scripts/${workerName}/versions/${versionResult.deploymentId}`,
+          );
+          const result = (await response.json()) as {
+            result: {
+              resources: {
+                bindings: WorkerBindingSpec[];
+              };
+            };
+          };
+          const namespaceId = result.result.resources.bindings.find(
+            (binding): binding is WorkerBindingDurableObjectNamespace =>
+              binding.type === "durable_object_namespace" &&
+              binding.class_name === container.className,
+          )?.namespace_id;
+          if (!namespaceId) {
+            throw new Error(
+              `Namespace ID not found for container ${container.id}`,
+            );
+          }
+          return namespaceId;
+        }
+        await ContainerApplication(container.id, {
+          accountId: props.accountId,
+          apiKey: props.apiKey,
+          apiToken: props.apiToken,
+          baseUrl: props.baseUrl,
+          email: props.email,
+          image: container.image,
+          name: container.id,
+          instanceType: container.instanceType,
+          observability: container.observability,
+          durableObjects: {
+            namespaceId: await findNamespaceId(),
+          },
+          schedulingPolicy: container.schedulingPolicy,
+        });
+      }
+
       await Promise.all(
         props.eventSources?.map((eventSource) => {
           if (isQueue(eventSource) || isQueueEventSource(eventSource)) {
@@ -1582,7 +1630,7 @@ type PutWorkerOptions = WorkerProps & {
 export async function putWorker(
   api: CloudflareApi,
   props: PutWorkerOptions,
-): Promise<{ versionId?: string; previewUrl?: string }> {
+): Promise<{ versionId?: string; previewUrl?: string; deploymentId: string }> {
   const {
     //
     dispatchNamespace,
@@ -1727,23 +1775,23 @@ export async function putWorker(
           }
         }
       }
-
-      // Handle version response
-      if (props.version) {
-        const responseData = (await uploadResponse.json()) as {
-          result: {
-            id: string;
-            number: number;
-            metadata: {
-              has_preview: boolean;
-            };
-            annotations?: {
-              "workers/tag"?: string;
-            };
+      const responseData = (await uploadResponse.json()) as {
+        result: {
+          id: string;
+          number: number;
+          metadata: {
+            has_preview: boolean;
           };
+          annotations?: {
+            "workers/tag"?: string;
+          };
+          deployment_id: string;
         };
-        const result = responseData.result;
+      };
+      const result = responseData.result;
 
+      // Handle version response
+      if (props.version) {
         // Get the account's workers.dev subdomain to construct preview URL
         let previewUrl: string | undefined;
         if (result.metadata?.has_preview) {
@@ -1770,10 +1818,13 @@ export async function putWorker(
         return {
           versionId: result.id,
           previewUrl,
+          deploymentId: result.deployment_id,
         };
       }
 
-      return {};
+      return {
+        deploymentId: result.deployment_id,
+      };
     },
     (err) =>
       err.status === 404 ||

package/src/cloudflare/wrangler.json.ts

@@ -447,6 +447,9 @@ function processBindings(
     binding: string;
     namespace: string;
   }[] = [];
+  const containers: {
+    class_name: string;
+  }[] = [];
 
   for (const eventSource of eventSources ?? []) {
     if (isQueueEventSource(eventSource)) {
@@ -619,6 +622,15 @@ function processBindings(
       });
     } else if (binding.type === "secret_key") {
       // no-op
+    } else if (binding.type === "container") {
+      durableObjects.push({
+        name: bindingName,
+        class_name: binding.className,
+        script_name: binding.scriptName,
+      });
+      containers.push({
+        class_name: binding.className,
+      });
     } else {
       // biome-ignore lint/correctness/noVoidTypeReturn: it returns never
       return assertNever(binding);

package/src/docker/api.ts

@@ -1,3 +1,4 @@
+import { spawn } from "node:child_process";
 import { exec } from "../os/exec.ts";
 
 /**
@@ -362,4 +363,77 @@ export class DockerApi {
       return false;
     }
   }
+
+  /**
+   * Login to a Docker registry
+   *
+   * @param registry Registry URL
+   * @param username Username for authentication
+   * @param password Password for authentication
+   * @returns Promise that resolves when login is successful
+   */
+  async login(
+    registry: string,
+    username: string,
+    password: string,
+  ): Promise<void> {
+    return new Promise((resolve, reject) => {
+      const args = [
+        "login",
+        registry,
+        "--username",
+        username,
+        "--password-stdin",
+      ];
+
+      const child = spawn(this.dockerPath, args, {
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+
+      let stdout = "";
+      let stderr = "";
+
+      child.stdout.on("data", (data) => {
+        stdout += data.toString();
+      });
+
+      child.stderr.on("data", (data) => {
+        stderr += data.toString();
+      });
+
+      child.on("close", (code) => {
+        if (code === 0) {
+          resolve();
+        } else {
+          reject(
+            new Error(
+              `Docker login failed with exit code ${code}: ${stderr || stdout}`,
+            ),
+          );
+        }
+      });
+
+      child.on("error", (err) => {
+        reject(new Error(`Docker login failed: ${err.message}`));
+      });
+
+      // Write password to stdin and close the stream
+      child.stdin.write(password);
+      child.stdin.end();
+    });
+  }
+
+  /**
+   * Logout from a Docker registry
+   *
+   * @param registry Registry URL
+   */
+  async logout(registry: string): Promise<void> {
+    try {
+      await this.exec(["logout", registry]);
+    } catch (error) {
+      // Ignore logout errors as they're not critical
+      console.warn(`Docker logout failed: ${error}`);
+    }
+  }
 }

package/src/docker/image.ts

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
+import type { Secret } from "../secret.ts";
 import { DockerApi } from "./api.ts";
 
 /**
@@ -10,11 +11,15 @@ import { DockerApi } from "./api.ts";
 export interface DockerBuildOptions {
   /**
    * Path to the build context directory
+   *
+   * @default - the `dirname(dockerfile)` if provided or otherwise `process.cwd()`
    */
-  context: string;
+  context?: string;
 
   /**
    * Path to the Dockerfile, relative to context
+   *
+   * @default - `Dockerfile`
    */
   dockerfile?: string;
 
@@ -39,6 +44,12 @@ export interface DockerBuildOptions {
   cacheFrom?: string[];
 }
 
+export interface ImageRegistry {
+  username: string;
+  password: Secret;
+  server: string;
+}
+
 /**
  * Properties for creating a Docker image
  */
@@ -46,7 +57,7 @@ export interface ImageProps {
   /**
    * Repository name for the image (e.g., "username/image")
    */
-  name: string;
+  name?: string;
 
   /**
    * Tag for the image (e.g., "latest")
@@ -56,7 +67,12 @@ export interface ImageProps {
   /**
    * Build configuration
    */
-  build: DockerBuildOptions;
+  build?: DockerBuildOptions;
+
+  /**
+   * Registry credentials
+   */
+  registry?: ImageRegistry;
 
   /**
    * Whether to skip pushing the image to registry
@@ -68,6 +84,11 @@ export interface ImageProps {
  * Docker Image resource
  */
 export interface Image extends Resource<"docker::Image">, ImageProps {
+  /**
+   * Image name
+   */
+  name: string;
+
   /**
    * Full image reference (name:tag)
    */
@@ -110,7 +131,7 @@ export const Image = Resource(
   "docker::Image",
   async function (
     this: Context<Image>,
-    _id: string,
+    id: string,
     props: ImageProps,
   ): Promise<Image> {
     // Initialize Docker API client
@@ -123,34 +144,44 @@ export const Image = Resource(
     } else {
       // Normalize properties
       const tag = props.tag || "latest";
-      const imageRef = `${props.name}:${tag}`;
+      const name = props.name || id;
+      const imageRef = `${name}:${tag}`;
 
-      // Validate build context
-      const { context } = props.build;
+      let context: string;
+      let dockerfile: string;
+      if (props.build?.dockerfile && props.build?.context) {
+        context = path.resolve(props.build.context);
+        dockerfile = path.resolve(context, props.build.dockerfile);
+      } else if (props.build?.dockerfile) {
+        context = process.cwd();
+        dockerfile = path.resolve(context, props.build.dockerfile);
+      } else if (props.build?.context) {
+        context = path.resolve(props.build.context);
+        dockerfile = path.resolve(context, "Dockerfile");
+      } else {
+        context = process.cwd();
+        dockerfile = path.resolve(context, "Dockerfile");
+      }
       await fs.access(context);
-
-      // Determine Dockerfile path
-      const dockerfile = props.build.dockerfile || "Dockerfile";
-      const dockerfilePath = path.join(context, dockerfile);
-      await fs.access(dockerfilePath);
+      await fs.access(dockerfile);
 
       // Prepare build options
-      const buildOptions: Record<string, string> = props.build.buildArgs || {};
+      const buildOptions: Record<string, string> = props.build?.buildArgs || {};
 
       // Add platform if specified
       let buildArgs = ["build", "-t", imageRef];
 
-      if (props.build.platform) {
+      if (props.build?.platform) {
         buildArgs.push("--platform", props.build.platform);
       }
 
       // Add target if specified
-      if (props.build.target) {
+      if (props.build?.target) {
         buildArgs.push("--target", props.build.target);
       }
 
       // Add cache sources if specified
-      if (props.build.cacheFrom && props.build.cacheFrom.length > 0) {
+      if (props.build?.cacheFrom && props.build.cacheFrom.length > 0) {
         for (const cacheSource of props.build.cacheFrom) {
           buildArgs.push("--cache-from", cacheSource);
         }
@@ -161,36 +192,75 @@ export const Image = Resource(
         buildArgs.push("--build-arg", `${key}="${value}"`);
       }
 
-      // Add dockerfile if not the default
-      if (props.build.dockerfile && props.build.dockerfile !== "Dockerfile") {
-        buildArgs.push("-f", props.build.dockerfile);
-      }
+      buildArgs.push("-f", dockerfile);
 
       // Add context path
-      buildArgs.push(props.build.context);
+      buildArgs.push(context);
 
       // Execute build command
-      console.log(`Building Docker image: ${imageRef}`);
       const { stdout } = await api.exec(buildArgs);
 
       // Extract image ID from build output if available
       const imageIdMatch = /Successfully built ([a-f0-9]+)/.exec(stdout);
       const imageId = imageIdMatch ? imageIdMatch[1] : undefined;
 
-      console.log(`Successfully built Docker image: ${imageRef}`);
-
       // Handle push if required
       let repoDigest: string | undefined;
-      if (!props.skipPush) {
-        console.log(`Pushing Docker image: ${imageRef}`);
-        // TODO: Implement push once API supports it
-        console.warn("Image pushing is not yet implemented");
+      let finalImageRef = imageRef;
+      if (props.registry && !props.skipPush) {
+        const { server, username, password } = props.registry;
+
+        // Ensure the registry server does not have trailing slash
+        const registryHost = server.replace(/\/$/, "");
+
+        // Determine if the built image already includes a registry host (e.g. ghcr.io/user/repo)
+        const firstSegment = imageRef.split("/")[0];
+        const hasRegistryPrefix = firstSegment.includes(".");
+
+        // Compose the target image reference that will be pushed
+        const targetImage = hasRegistryPrefix
+          ? imageRef // already fully-qualified
+          : `${registryHost}/${imageRef}`;
+
+        try {
+          // Authenticate to registry
+          await api.login(registryHost, username, password.unencrypted);
+
+          // Tag local image with fully qualified name if necessary
+          if (targetImage !== imageRef) {
+            await api.exec(["tag", imageRef, targetImage]);
+          }
+
+          // Push the image
+          const { stdout: pushOut } = await api.exec(["push", targetImage]);
+
+          // Attempt to extract the repo digest from push output
+          const digestMatch = /digest:\s+([a-z0-9]+:[a-f0-9]{64})/.exec(
+            pushOut,
+          );
+          if (digestMatch) {
+            const digestHash = digestMatch[1];
+            // Strip tag (anything after last :) to build image@digest reference
+            const [repoWithoutTag] =
+              targetImage.split(":").length > 2
+                ? [targetImage] // unlikely but safety
+                : [targetImage.substring(0, targetImage.lastIndexOf(":"))];
+            repoDigest = `${repoWithoutTag}@${digestHash}`;
+          }
+
+          // Update the final image reference to point at the pushed image
+          finalImageRef = targetImage;
+        } finally {
+          // Always try to logout – failures are non-fatal
+          await api.logout(registryHost);
+        }
       }
 
       // Return the resource using this() to construct output
       return this({
         ...props,
-        imageRef,
+        name,
+        imageRef: finalImageRef,
         imageId,
         repoDigest,
         builtAt: Date.now(),

package/src/github/index.ts

@@ -1,3 +1,4 @@
 export * from "./comment.ts";
 export * from "./repository-environment.ts";
+export * from "./repository-webhook.ts";
 export * from "./secret.ts";