alchemy 0.45.6 → 0.46.1

package/src/cloudflare/oauth.ts

@@ -0,0 +1,300 @@
+import kleur from "kleur";
+import { err, ok, okAsync, ResultAsync } from "neverthrow";
+import assert from "node:assert";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import open from "open";
+import { HTTPServer } from "../util/http-server.ts";
+import { memoize } from "../util/memoize.ts";
+import {
+  detached,
+  ensure,
+  fetchJSON,
+  HTTPError,
+  singleFlight,
+} from "../util/neverthrow.ts";
+import { createXdgAppPaths } from "../util/xdg-paths.ts";
+
+const CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
+const REDIRECT_URI = "http://localhost:8976/oauth/callback";
+export const DEFAULT_SCOPES = [
+  "account:read",
+  "user:read",
+  "workers:write",
+  "workers_kv:write",
+  "workers_routes:write",
+  "workers_scripts:write",
+  "workers_tail:read",
+  "d1:write",
+  "pages:write",
+  "zone:read",
+  "ssl_certs:write",
+  "ai:write",
+  "queues:write",
+  "pipelines:write",
+  "secrets_store:write",
+  "containers:write",
+  "cloudchamber:write",
+];
+const ALCHEMY_BASE_URL = "https://alchemy.run";
+
+interface WranglerConfig {
+  oauth_token: string;
+  refresh_token: string;
+  expiration_time: Date;
+  scopes: string[];
+}
+
+let cached: WranglerConfig | undefined;
+
+export const getRefreshedWranglerConfig = singleFlight(() =>
+  readWranglerConfig()
+    .andThen((config) => {
+      if (config.expiration_time.getTime() > Date.now() + 10 * 1000) {
+        return ok(config);
+      }
+      return fetchToken({
+        grant_type: "refresh_token",
+        refresh_token: config.refresh_token,
+        client_id: CLIENT_ID,
+      });
+    })
+    .orElse((error) => {
+      if (isInteractive()) {
+        return wranglerLogin();
+      }
+      return err(error);
+    }),
+);
+
+const getWranglerConfigPath = memoize(async () => {
+  const xdgConfigDir = createXdgAppPaths(".wrangler").config();
+  const legacyConfigDir = path.join(os.homedir(), ".wrangler");
+  const configDir = (await fs
+    .stat(legacyConfigDir)
+    .then((stat) => stat.isDirectory())
+    .catch(() => false))
+    ? legacyConfigDir
+    : xdgConfigDir;
+  return path.join(configDir, "config", "default.toml");
+});
+
+const readWranglerConfig = () => {
+  if (cached) {
+    return okAsync(cached);
+  }
+  return ResultAsync.fromPromise(
+    getWranglerConfigPath().then(async (path): Promise<WranglerConfig> => {
+      const text = await fs.readFile(path, "utf-8");
+      const toml = await import("@iarna/toml");
+      const config = toml.parse(text.replace(/\r\n/g, "\n"));
+      assert(typeof config.oauth_token === "string");
+      assert(typeof config.refresh_token === "string");
+      assert(config.expiration_time instanceof Date);
+      assert(Array.isArray(config.scopes));
+      return {
+        oauth_token: config.oauth_token,
+        refresh_token: config.refresh_token,
+        expiration_time: new Date(config.expiration_time),
+        scopes: config.scopes as string[],
+      };
+    }),
+    () => new Error("Cloudflare credentials are missing or invalid."),
+  );
+};
+
+const writeWranglerConfig = (config: WranglerConfig) => {
+  cached = config;
+  return ResultAsync.fromSafePromise(getWranglerConfigPath()).map(
+    async (configPath) => {
+      const toml = await import("@iarna/toml");
+      await fs.writeFile(
+        configPath,
+        toml.stringify({
+          oauth_token: config.oauth_token,
+          refresh_token: config.refresh_token,
+          expiration_time: config.expiration_time,
+          scopes: config.scopes,
+        }),
+      );
+    },
+  );
+};
+
+export const wranglerLogin = (
+  scopes: string[] = DEFAULT_SCOPES,
+  log: (message: string) => void = console.log, // using console.log instead of logger.log to avoid bundling hell with CLI
+) => {
+  const challenge = generateAuthorizationURL(scopes);
+  log(
+    [
+      "Opening browser to authorize with Cloudflare...",
+      "",
+      kleur.gray(
+        "If you are not automatically redirected, please open the following URL in your browser:",
+      ),
+      challenge.url,
+    ].join("\n"),
+  );
+  open(challenge.url);
+  const { result, ok, err } = detached<WranglerConfig, OAuthError>();
+  const renderResponse = async (type: "success" | "error") => {
+    return Response.redirect(`${ALCHEMY_BASE_URL}/auth/${type}`);
+  };
+  const server = new HTTPServer({
+    port: 8976,
+    fetch: async (request) => {
+      const url = new URL(request.url);
+      if (url.pathname !== "/oauth/callback") {
+        return new Response("Not found", { status: 404 });
+      }
+      const error = url.searchParams.get("error");
+      const error_description = url.searchParams.get("error_description");
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (error) {
+        err(
+          new OAuthError({
+            error,
+            error_description: error_description ?? "Unknown error",
+            status_code: 400,
+          }),
+        );
+        return renderResponse("error");
+      }
+      if (!code || !state || state !== challenge.state) {
+        err(
+          new OAuthError({
+            error: "invalid_request",
+            error_description: "Invalid request",
+            status_code: 400,
+          }),
+        );
+        return renderResponse("error");
+      }
+      const tokens = await fetchToken({
+        grant_type: "authorization_code",
+        code,
+        code_verifier: challenge.verifier,
+        client_id: CLIENT_ID,
+        redirect_uri: REDIRECT_URI,
+      });
+      if (tokens.isErr()) {
+        err(tokens.error);
+        return renderResponse("error");
+      }
+      ok(tokens.value);
+      return renderResponse("success");
+    },
+  });
+  const timeout = setTimeout(
+    () => {
+      err(
+        new OAuthError({
+          error: "timeout",
+          error_description: "Authorization timed out after 5 minutes",
+          status_code: 408,
+        }),
+      );
+    },
+    1000 * 60 * 5,
+  );
+  return ensure(result, () => {
+    clearTimeout(timeout);
+    void server.stop();
+  });
+};
+
+const generateAuthorizationURL = (scopes: string[]) => {
+  const state = crypto.randomBytes(32).toString("base64url");
+  const verifier = crypto.randomBytes(96).toString("base64url");
+  const challenge = crypto
+    .createHash("sha256")
+    .update(verifier)
+    .digest("base64url");
+  const url = new URL("https://dash.cloudflare.com/oauth2/auth");
+  url.search = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: "http://localhost:8976/oauth/callback",
+    scope: [...scopes, "offline_access"].join(" "),
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+  }).toString();
+  return { url: url.toString(), state, verifier };
+};
+
+interface OAuthTokens {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  scope: string;
+}
+
+interface OAuthErrorParams {
+  error: string;
+  error_description: string;
+  error_verbose?: string;
+  error_hint?: string;
+  status_code: number;
+}
+
+class OAuthError extends Error {
+  constructor(params: OAuthErrorParams) {
+    super(
+      `Cloudflare authentication failed with error ${params.error} (${params.status_code}): ${params.error_description}`,
+    );
+  }
+}
+
+const fetchToken = (
+  body:
+    | {
+        grant_type: "refresh_token";
+        refresh_token: string;
+        client_id: string;
+      }
+    | {
+        grant_type: "authorization_code";
+        code: string;
+        code_verifier: string;
+        client_id: string;
+        redirect_uri: string;
+      },
+) => {
+  return fetchJSON<OAuthTokens, OAuthErrorParams>(
+    "https://dash.cloudflare.com/oauth2/token",
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: new URLSearchParams(body),
+    },
+  )
+    .map(
+      (tokens): WranglerConfig => ({
+        oauth_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        expiration_time: new Date(Date.now() + tokens.expires_in * 1000),
+        scopes: tokens.scope.split(" "),
+      }),
+    )
+    .mapErr((error) =>
+      error instanceof HTTPError
+        ? new OAuthError({
+            error: "http_error",
+            error_description: error.message,
+            status_code: error.status,
+          })
+        : new OAuthError(error),
+    )
+    .andTee((config) => writeWranglerConfig(config));
+};
+
+const isInteractive = () => {
+  return process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
+};

package/src/cloudflare/state.ts

@@ -0,0 +1,35 @@
+import {
+  D1StateStore as _D1StateStore,
+  DOFSStateStore as _DOFSStateStore,
+  R2RestStateStore as _R2RestStateStore,
+} from "../state/index.ts";
+
+/**
+ * @deprecated Use `R2RestStateStore` from `alchemy/state` instead.
+ */
+export const R2RestStateStore = _R2RestStateStore;
+
+/**
+ * @deprecated Use `R2RestStateStore` from `alchemy/state` instead.
+ */
+export type R2RestStateStore = _R2RestStateStore;
+
+/**
+ * @deprecated This state store is no longer recommended for production use. Please use {@link https://alchemy.run/guides/cloudflare-state-store/ CloudflareStateStore} from `alchemy/state` instead.
+ */
+export const DOStateStore = _DOFSStateStore;
+
+/**
+ * @deprecated Use `DOStateStore` from `alchemy/state` instead.
+ */
+export type DOStateStore = _DOFSStateStore;
+
+/**
+ * @deprecated Use `D1StateStore` from `alchemy/state` instead.
+ */
+export const D1StateStore = _D1StateStore;
+
+/**
+ * @deprecated Use `D1StateStore` from `alchemy/state` instead.
+ */
+export type D1StateStore = _D1StateStore;

package/src/cloudflare/user.ts

@@ -1,6 +1,7 @@
 import type { Secret } from "../secret.ts";
 import { logger } from "../util/logger.ts";
-import { CloudflareApiError } from "./api-error.ts";
+import { memoize } from "../util/memoize.ts";
+import { extractCloudflareResult } from "./api-response.ts";
 import {
   getCloudflareAuthHeaders,
   type CloudflareAuthOptions,
@@ -55,82 +56,48 @@ export interface CloudflareOrganization {
   roles: string[];
 }
 
-const accountCache: Record<string, CloudflareAccount[]> = {};
-
-export async function getCloudflareAccounts(
-  options: CloudflareAuthOptions,
-): Promise<CloudflareAccount[]> {
-  const cacheKey = JSON.stringify({
-    apiKey: options.apiKey?.unencrypted,
-    apiToken: options.apiToken?.unencrypted,
-    email: options.email,
-  });
-  if (accountCache[cacheKey]) {
-    return accountCache[cacheKey];
-  }
-
-  const headers = await getCloudflareAuthHeaders(options);
-  const accounts = await fetch(
-    "https://api.cloudflare.com/client/v4/accounts",
-    {
-      headers,
-    },
-  );
-
-  if (accounts.ok) {
-    return (accountCache[cacheKey] ??= ((await accounts.json()) as any).result);
-  } else {
-    throw new CloudflareApiError(
-      `Failed to get accounts for authorized user, please make sure you're authenticated (see: https://alchemy.run/guides/cloudflare/) or explicitly set the Cloudflare Account ID (see: https://alchemy.run/guides/cloudflare/#account-id)`,
-      accounts,
+export const getCloudflareAccountId = memoize(
+  async (options: CloudflareAuthOptions): Promise<string> => {
+    const headers = await getCloudflareAuthHeaders(options);
+    const accounts = await extractCloudflareResult<CloudflareAccount[]>(
+      "get accounts for authorized user",
+      fetch("https://api.cloudflare.com/client/v4/accounts", {
+        headers,
+      }),
     );
-  }
-}
-
-const emailCache: Record<string, string> = {};
-
-export async function getUserEmailFromApiKey(apiKey: string): Promise<string> {
-  if (emailCache[apiKey]) {
-    return emailCache[apiKey];
-  }
-
-  try {
-    const baseUrl = "https://api.cloudflare.com/client/v4";
-
-    // Call the /user endpoint to get user information
-    const response = await fetch(`${baseUrl}/user`, {
-      headers: {
-        "Content-Type": "application/json",
-        "X-Auth-Key": apiKey,
-      },
-    });
-
-    if (!response.ok) {
+    if (!accounts[0]) {
       throw new Error(
-        `Failed to get user information: ${response.status} ${response.statusText}`,
+        "No accounts found for authorized user. Please make sure you're authenticated (see: https://alchemy.run/guides/cloudflare/) or explicitly set the Cloudflare Account ID (see: https://alchemy.run/guides/cloudflare/#account-id)",
       );
     }
-
-    const data = (await response.json()) as {
-      success: boolean;
-      result: {
-        id: string;
-        email: string;
-        name: string;
-        [key: string]: any;
-      };
-    };
-
-    if (!data.success || !data.result || !data.result.email) {
-      throw new Error("Cloudflare API did not return valid user information");
+    if (accounts.length > 1) {
+      logger.warnOnce(
+        [
+          "Multiple Cloudflare accounts found for authorized user:",
+          accounts.map((a, i) => `${i + 1}: ${a.name} (${a.id})`).join("\n"),
+          "The first account will be used by default. To use a different account, explicitly set the Cloudflare Account ID (see: https://alchemy.run/guides/cloudflare/#account-id)",
+        ].join("\n"),
+      );
     }
+    return accounts[0].id;
+  },
+);
 
-    emailCache[apiKey] = data.result.email;
-    return data.result.email;
-  } catch (error) {
-    logger.error("Error retrieving email from Cloudflare API:", error);
-    throw new Error(
-      "Failed to automatically discover email for API Key authentication",
+export const getUserEmailFromApiKey = memoize(
+  async (apiKey: string): Promise<string> => {
+    const result = await extractCloudflareResult<{
+      id: string;
+      name: string;
+      email: string;
+    }>(
+      "automatically discover email for API Key authentication",
+      fetch("https://api.cloudflare.com/client/v4/user", {
+        headers: {
+          "Content-Type": "application/json",
+          "X-Auth-Key": apiKey,
+        },
+      }),
     );
-  }
-}
+    return result.email;
+  },
+);

package/src/cloudflare/vectorize-index.ts

@@ -169,7 +169,7 @@ const _VectorizeIndex = Resource(
         if (
           props.adopt &&
           error instanceof CloudflareApiError &&
-          error.message.includes("already exists")
+          error.message.includes("vectorize.index.duplicate_name")
         ) {
           logger.log(`Index ${indexName} already exists, adopting it`);
           // Find the existing index
@@ -321,7 +321,12 @@ export async function deleteIndex(
     `/accounts/${api.accountId}/vectorize/v2/indexes/${indexName}`,
   );
 
-  if (!deleteResponse.ok && deleteResponse.status !== 404) {
+  if (
+    !deleteResponse.ok &&
+    // not 404 (Not Found) or 410 (Gone)
+    deleteResponse.status !== 404 &&
+    deleteResponse.status !== 410
+  ) {
     const errorData: any = await deleteResponse.json().catch(() => ({
       errors: [{ message: deleteResponse.statusText }],
     }));

package/src/cloudflare/version-metadata.ts

@@ -1,6 +1,23 @@
 /**
+ * Type representing a version metadata binding.
  * @see https://developers.cloudflare.com/workers/runtime-apis/bindings/version-metadata/
  */
-export class VersionMetadata {
-  public readonly type = "version_metadata";
+export type VersionMetadata = {
+  type: "version_metadata";
+};
+
+/**
+ * Creates a version metadata binding that provides access to version information at runtime.
+ *
+ * @example
+ * ```ts
+ * const metadata = VersionMetadata();
+ * ```
+ *
+ * @see https://developers.cloudflare.com/workers/runtime-apis/bindings/version-metadata/
+ */
+export function VersionMetadata(): VersionMetadata {
+  return {
+    type: "version_metadata",
+  };
 }

package/src/cloudflare/vite.ts

@@ -18,12 +18,13 @@ export async function Vite<B extends Bindings>(
   props: ViteProps<B>,
 ): Promise<Vite<B>> {
   const defaultAssets = path.join("dist", "client");
-  const packageManager = detectPackageManager();
+  const packageManager = await detectPackageManager();
   const devCommand = {
     npm: "npx vite dev",
     bun: "bun vite dev",
     pnpm: "pnpm vite dev",
     yarn: "yarn vite dev",
+    deno: "deno vite dev",
   }[packageManager];
   return Website(id, {
     ...props,

package/src/cloudflare/worker-metadata.ts

@@ -1,6 +1,7 @@
 import { assertNever } from "../util/assert-never.ts";
 import { logger } from "../util/logger.ts";
 import { memoize } from "../util/memoize.ts";
+import { extractCloudflareResult } from "./api-response.ts";
 import type { CloudflareApi } from "./api.ts";
 import {
   Self,
@@ -200,7 +201,7 @@ export interface WorkerMetadata {
 
 export async function prepareWorkerMetadata(
   api: CloudflareApi,
-  props: WorkerProps & {
+  props: Omit<WorkerProps, "entrypoint"> & {
     compatibilityDate: string;
     compatibilityFlags: string[];
     workerName: string;
@@ -210,6 +211,7 @@ export async function prepareWorkerMetadata(
       keepAssets?: boolean;
       assetConfig?: AssetsConfig;
     };
+    tags?: string[];
     unstable_cacheWorkerSettings?: boolean;
   },
 ): Promise<WorkerMetadata> {
@@ -226,7 +228,7 @@ export async function prepareWorkerMetadata(
   // we use Cloudflare Worker tags to store a mapping between Alchemy's stable identifier and the binding name
   // e.g.
   // {
-  //   BINDING_NAME: new DurableObjectNamespace("stable-id")
+  //   BINDING_NAME: DurableObjectNamespace("stable-id")
   // }
   // will be stored as alchemy:do:stable-id:BINDING_NAME
   // TODO(sam): should we base64 encode to ensure no `:` collision risk?
@@ -323,6 +325,7 @@ export async function prepareWorkerMetadata(
       ),
       // encode the migraiton tag if there is one so we can avoid the failed PutWorker after adoption
       ...(newMigrationTag ? [`alchemy:migration-tag:${newMigrationTag}`] : []),
+      ...(props.tags ?? []),
     ],
     migrations: {
       old_tag: oldMigrationTag,
@@ -640,6 +643,7 @@ interface WorkerSettings {
   compatibility_date: string;
   compatibility_flags: string[];
   migrations: SingleStepMigration | MultiStepMigration;
+  tags: string[];
   [key: string]: any;
 }
 
@@ -648,51 +652,22 @@ const getWorkerSettingsWithCache = memoize(
   (api, workerName) => `${api.accountId}:${workerName}`,
 );
 
-async function getWorkerSettings(
+export async function getWorkerSettings(
   api: CloudflareApi,
   workerName: string,
 ): Promise<WorkerSettings | undefined> {
   // Fetch the bindings for a worker by calling the Cloudflare API endpoint:
   // GET /accounts/:account_id/workers/scripts/:script_name/bindings
   // See: https://developers.cloudflare.com/api/resources/workers/subresources/scripts/subresources/script_and_version_settings/methods/get/
-  const response = await api.get(
-    `/accounts/${api.accountId}/workers/scripts/${workerName}/settings`,
-  );
-  if (response.status === 404) {
-    return undefined;
-  }
-  if (!response.ok) {
-    throw new Error(
-      `Error getting worker bindings: ${response.status} ${response.statusText}`,
-    );
-  }
-  // The result is an object with a "result" property containing the bindings array
-  const { result, success, errors } = (await response.json()) as {
-    result: {
-      bindings: WorkerBindingSpec[];
-      compatibility_date: string;
-      compatibility_flags: string[];
-      migrations: SingleStepMigration | MultiStepMigration;
-      [key: string]: any;
-    };
-    success: boolean;
-    errors: Array<{
-      code: number;
-      message: string;
-      documentation_url: string;
-      [key: string]: any;
-    }>;
-    messages: Array<{
-      code: number;
-      message: string;
-      documentation_url: string;
-      [key: string]: any;
-    }>;
-  };
-  if (!success) {
-    throw new Error(
-      `Error getting worker bindings: ${response.status} ${response.statusText}\nErrors:\n${errors.map((e) => `- [${e.code}] ${e.message} (${e.documentation_url})`).join("\n")}`,
-    );
-  }
-  return result;
+  return await extractCloudflareResult<WorkerSettings>(
+    `get worker settings for ${workerName}`,
+    api.get(
+      `/accounts/${api.accountId}/workers/scripts/${workerName}/settings`,
+    ),
+  ).catch((error) => {
+    if (error.status === 404) {
+      return undefined;
+    }
+    throw error;
+  });
 }