alchemy 0.46.0 → 0.47.0

package/src/cloudflare/{auth-wrangler.ts → oauth.ts}

@@ -1,18 +1,24 @@
 import kleur from "kleur";
-import { err, ok, ResultAsync } from "neverthrow";
+import { err, ok, okAsync, ResultAsync } from "neverthrow";
+import assert from "node:assert";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import open from "open";
+import xdgAppPaths from "xdg-app-paths";
 import { HTTPServer } from "../util/http-server.ts";
-import { memoize, memoizeSync } from "../util/memoize.ts";
-import { detached, ensure, singleFlight } from "../util/neverthrow.ts";
-import { createXdgAppPaths } from "../util/xdg-paths.ts";
+import { memoize } from "../util/memoize.ts";
+import {
+  detached,
+  ensure,
+  fetchJSON,
+  HTTPError,
+  singleFlight,
+} from "../util/neverthrow.ts";
 
 const CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
 const REDIRECT_URI = "http://localhost:8976/oauth/callback";
-const ALCHEMY_BASE_URL = "https://alchemy.run";
 export const DEFAULT_SCOPES = [
   "account:read",
   "user:read",
@@ -32,6 +38,7 @@ export const DEFAULT_SCOPES = [
   "containers:write",
   "cloudchamber:write",
 ];
+const ALCHEMY_BASE_URL = "https://alchemy.run";
 
 interface WranglerConfig {
   oauth_token: string;
@@ -40,8 +47,30 @@ interface WranglerConfig {
   scopes: string[];
 }
 
+let cached: WranglerConfig | undefined;
+
+export const getRefreshedWranglerConfig = singleFlight(() =>
+  readWranglerConfig()
+    .andThen((config) => {
+      if (config.expiration_time.getTime() > Date.now() + 10 * 1000) {
+        return ok(config);
+      }
+      return fetchToken({
+        grant_type: "refresh_token",
+        refresh_token: config.refresh_token,
+        client_id: CLIENT_ID,
+      });
+    })
+    .orElse((error) => {
+      if (isInteractive()) {
+        return wranglerLogin();
+      }
+      return err(error);
+    }),
+);
+
 const getWranglerConfigPath = memoize(async () => {
-  const xdgConfigDir = createXdgAppPaths(".wrangler").config();
+  const xdgConfigDir = xdgAppPaths(".wrangler").config();
   const legacyConfigDir = path.join(os.homedir(), ".wrangler");
   const configDir = (await fs
     .stat(legacyConfigDir)
@@ -53,38 +82,35 @@ const getWranglerConfigPath = memoize(async () => {
 });
 
 const readWranglerConfig = () => {
-  return ResultAsync.fromSafePromise(getWranglerConfigPath())
-    .andThen((path) =>
-      ResultAsync.fromPromise(
-        fs.readFile(path, "utf-8").then(async (text) => {
-          const toml = await import("@iarna/toml");
-          return toml.parse(text.replace(/\r\n/g, "\n"));
-        }),
-        () => new Error("Failed to read Wrangler config."),
-      ),
-    )
-    .andThen((config) => {
-      if (
-        typeof config.oauth_token !== "string" ||
-        typeof config.refresh_token !== "string" ||
-        !config.expiration_time ||
-        !Array.isArray(config.scopes)
-      ) {
-        return err(new Error("Invalid Wrangler config."));
-      }
-      return ok({
+  if (cached) {
+    return okAsync(cached);
+  }
+  return ResultAsync.fromPromise(
+    getWranglerConfigPath().then(async (path): Promise<WranglerConfig> => {
+      const text = await fs.readFile(path, "utf-8");
+      const toml = await import("@iarna/toml");
+      const config = toml.parse(text.replace(/\r\n/g, "\n"));
+      assert(typeof config.oauth_token === "string");
+      assert(typeof config.refresh_token === "string");
+      assert(!!config.expiration_time);
+      assert(Array.isArray(config.scopes));
+      return {
         oauth_token: config.oauth_token,
         refresh_token: config.refresh_token,
         expiration_time: new Date(config.expiration_time as any),
-        scopes: Array.from(config.scopes as string[]),
-      } as WranglerConfig);
-    });
+        scopes: config.scopes as string[],
+      };
+    }),
+    () => new Error("Cloudflare credentials are missing or invalid."),
+  );
 };
 
 const writeWranglerConfig = (config: WranglerConfig) => {
+  cached = config;
   return ResultAsync.fromSafePromise(getWranglerConfigPath()).map(
     async (configPath) => {
       const toml = await import("@iarna/toml");
+      await fs.mkdir(path.dirname(configPath), { recursive: true });
       await fs.writeFile(
         configPath,
         toml.stringify({
@@ -98,140 +124,6 @@ const writeWranglerConfig = (config: WranglerConfig) => {
   );
 };
 
-const fetchToken = (
-  body:
-    | {
-        grant_type: "refresh_token";
-        refresh_token: string;
-        client_id: string;
-      }
-    | {
-        grant_type: "authorization_code";
-        code: string;
-        code_verifier: string;
-        client_id: string;
-        redirect_uri: string;
-      },
-) => {
-  return ResultAsync.fromPromise(
-    fetch("https://dash.cloudflare.com/oauth2/token", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-      },
-      body: new URLSearchParams(body),
-    }),
-    () =>
-      new OAuthError({
-        error: "fetch_error",
-        error_description: "Failed to fetch OAuth token.",
-        status_code: 0,
-      }),
-  )
-    .andThen((res) =>
-      ResultAsync.fromPromise(
-        res.json(),
-        () =>
-          new OAuthError({
-            error: "invalid_response",
-            error_description: "The server returned an invalid response.",
-            status_code: res.status,
-          }),
-      ).andThen((json) =>
-        res.ok ? ok(json as OAuthTokens) : err(new OAuthError(json as any)),
-      ),
-    )
-    .map(
-      (tokens): WranglerConfig => ({
-        oauth_token: tokens.access_token,
-        refresh_token: tokens.refresh_token,
-        expiration_time: new Date(Date.now() + tokens.expires_in * 1000),
-        scopes: tokens.scope.split(" "),
-      }),
-    )
-    .andTee((config) => writeWranglerConfig(config));
-};
-
-interface OAuthTokens {
-  access_token: string;
-  refresh_token: string;
-  expires_in: number;
-  scope: string;
-}
-
-export const getRefreshedWranglerConfig = singleFlight(
-  memoizeSync(
-    () => {
-      return readWranglerConfig()
-        .andThen((config) => {
-          if (config.expiration_time.getTime() > Date.now() + 10 * 1000) {
-            return ok(config);
-          }
-          return fetchToken({
-            grant_type: "refresh_token",
-            refresh_token: config.refresh_token,
-            client_id: CLIENT_ID,
-          });
-        })
-        .orElse((error) => {
-          if (isInteractive()) {
-            return wranglerLogin();
-          }
-          if (error instanceof OAuthError) {
-            return err(error);
-          }
-          return ok(null);
-        });
-    },
-    () => Math.floor(Date.now() / 5000).toString(),
-  ),
-);
-
-const isInteractive = () => {
-  return process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
-};
-
-const generateAuthorizationURL = (scopes: string[]) => {
-  const state = crypto.randomBytes(32).toString("base64url");
-  const verifier = crypto.randomBytes(96).toString("base64url");
-  const challenge = crypto
-    .createHash("sha256")
-    .update(verifier)
-    .digest("base64url");
-  const url = new URL("https://dash.cloudflare.com/oauth2/auth");
-  url.search = new URLSearchParams({
-    response_type: "code",
-    client_id: CLIENT_ID,
-    redirect_uri: REDIRECT_URI,
-    scope: [...scopes, "offline_access"].join(" "),
-    state,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-  }).toString();
-  return { url: url.toString(), state, verifier };
-};
-
-class OAuthError extends Error {
-  readonly error: string;
-  readonly error_verbose?: string;
-  readonly error_hint?: string;
-  readonly status_code: number;
-  constructor(params: {
-    error: string;
-    error_verbose?: string;
-    error_description: string;
-    error_hint?: string;
-    status_code: number;
-  }) {
-    console.dir(params, { depth: null });
-    super(params.error_description);
-    this.error = params.error;
-    this.error_verbose = params.error_verbose;
-    this.error_hint = params.error_hint;
-    this.status_code = params.status_code;
-  }
-}
-
 export const wranglerLogin = (
   scopes: string[] = DEFAULT_SCOPES,
   log: (message: string) => void = console.log, // using console.log instead of logger.log to avoid bundling hell with CLI
@@ -249,6 +141,9 @@ export const wranglerLogin = (
   );
   open(challenge.url);
   const { result, ok, err } = detached<WranglerConfig, OAuthError>();
+  const renderResponse = async (type: "success" | "error") => {
+    return Response.redirect(`${ALCHEMY_BASE_URL}/auth/${type}`);
+  };
   const server = new HTTPServer({
     port: 8976,
     fetch: async (request) => {
@@ -268,7 +163,7 @@ export const wranglerLogin = (
             status_code: 400,
           }),
         );
-        return Response.redirect(`${ALCHEMY_BASE_URL}/auth/error`);
+        return renderResponse("error");
       }
       if (!code || !state || state !== challenge.state) {
         err(
@@ -278,7 +173,7 @@ export const wranglerLogin = (
             status_code: 400,
           }),
         );
-        return Response.redirect(`${ALCHEMY_BASE_URL}/auth/error`);
+        return renderResponse("error");
       }
       const tokens = await fetchToken({
         grant_type: "authorization_code",
@@ -289,10 +184,10 @@ export const wranglerLogin = (
       });
       if (tokens.isErr()) {
         err(tokens.error);
-        return Response.redirect(`${ALCHEMY_BASE_URL}/auth/error`);
+        return renderResponse("error");
       }
       ok(tokens.value);
-      return Response.redirect(`${ALCHEMY_BASE_URL}/auth/success`);
+      return renderResponse("success");
     },
   });
   const timeout = setTimeout(
@@ -307,8 +202,100 @@ export const wranglerLogin = (
     },
     1000 * 60 * 5,
   );
-  return ensure(result, async () => {
+  return ensure(result, () => {
     clearTimeout(timeout);
-    await server.stop();
+    void server.stop();
   });
 };
+
+const generateAuthorizationURL = (scopes: string[]) => {
+  const state = crypto.randomBytes(32).toString("base64url");
+  const verifier = crypto.randomBytes(96).toString("base64url");
+  const challenge = crypto
+    .createHash("sha256")
+    .update(verifier)
+    .digest("base64url");
+  const url = new URL("https://dash.cloudflare.com/oauth2/auth");
+  url.search = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: "http://localhost:8976/oauth/callback",
+    scope: [...scopes, "offline_access"].join(" "),
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+  }).toString();
+  return { url: url.toString(), state, verifier };
+};
+
+interface OAuthTokens {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  scope: string;
+}
+
+interface OAuthErrorParams {
+  error: string;
+  error_description: string;
+  error_verbose?: string;
+  error_hint?: string;
+  status_code: number;
+}
+
+class OAuthError extends Error {
+  constructor(params: OAuthErrorParams) {
+    super(
+      `Cloudflare authentication failed with error ${params.error} (${params.status_code}): ${params.error_description}`,
+    );
+  }
+}
+
+const fetchToken = (
+  body:
+    | {
+        grant_type: "refresh_token";
+        refresh_token: string;
+        client_id: string;
+      }
+    | {
+        grant_type: "authorization_code";
+        code: string;
+        code_verifier: string;
+        client_id: string;
+        redirect_uri: string;
+      },
+) => {
+  return fetchJSON<OAuthTokens, OAuthErrorParams>(
+    "https://dash.cloudflare.com/oauth2/token",
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: new URLSearchParams(body),
+    },
+  )
+    .map(
+      (tokens): WranglerConfig => ({
+        oauth_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        expiration_time: new Date(Date.now() + tokens.expires_in * 1000),
+        scopes: tokens.scope.split(" "),
+      }),
+    )
+    .mapErr((error) =>
+      error instanceof HTTPError
+        ? new OAuthError({
+            error: "http_error",
+            error_description: error.message,
+            status_code: error.status,
+          })
+        : new OAuthError(error),
+    )
+    .andTee((config) => writeWranglerConfig(config));
+};
+
+const isInteractive = () => {
+  return process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
+};

package/src/cloudflare/user.ts

@@ -1,7 +1,7 @@
 import type { Secret } from "../secret.ts";
 import { logger } from "../util/logger.ts";
 import { memoize } from "../util/memoize.ts";
-import { CloudflareApiError } from "./api-error.ts";
+import { extractCloudflareResult } from "./api-response.ts";
 import {
   getCloudflareAuthHeaders,
   type CloudflareAuthOptions,
@@ -56,66 +56,48 @@ export interface CloudflareOrganization {
   roles: string[];
 }
 
-export const getCloudflareAccounts = memoize(
-  async (options: CloudflareAuthOptions): Promise<CloudflareAccount[]> => {
+export const getCloudflareAccountId = memoize(
+  async (options: CloudflareAuthOptions): Promise<string> => {
     const headers = await getCloudflareAuthHeaders(options);
-    const accounts = await fetch(
-      "https://api.cloudflare.com/client/v4/accounts",
-      {
+    const accounts = await extractCloudflareResult<CloudflareAccount[]>(
+      "get accounts for authorized user",
+      fetch("https://api.cloudflare.com/client/v4/accounts", {
         headers,
-      },
+      }),
     );
-    if (accounts.ok) {
-      return ((await accounts.json()) as any).result;
-    } else {
-      throw new CloudflareApiError(
-        `Failed to get accounts for authorized user, please make sure you're authenticated (see: https://alchemy.run/guides/cloudflare/) or explicitly set the Cloudflare Account ID (see: https://alchemy.run/guides/cloudflare/#account-id)`,
-        accounts,
+    if (!accounts[0]) {
+      throw new Error(
+        "No accounts found for authorized user. Please make sure you're authenticated (see: https://alchemy.run/guides/cloudflare/) or explicitly set the Cloudflare Account ID (see: https://alchemy.run/guides/cloudflare/#account-id)",
+      );
+    }
+    if (accounts.length > 1) {
+      logger.warnOnce(
+        [
+          "Multiple Cloudflare accounts found for authorized user:",
+          accounts.map((a, i) => `${i + 1}: ${a.name} (${a.id})`).join("\n"),
+          "The first account will be used by default. To use a different account, explicitly set the Cloudflare Account ID (see: https://alchemy.run/guides/cloudflare/#account-id)",
+        ].join("\n"),
       );
     }
+    return accounts[0].id;
   },
 );
 
 export const getUserEmailFromApiKey = memoize(
   async (apiKey: string): Promise<string> => {
-    try {
-      // Call the /user endpoint to get user information
-      const response = await fetch(
-        "https://api.cloudflare.com/client/v4/user",
-        {
-          headers: {
-            "Content-Type": "application/json",
-            "X-Auth-Key": apiKey,
-          },
+    const result = await extractCloudflareResult<{
+      id: string;
+      name: string;
+      email: string;
+    }>(
+      "automatically discover email for API Key authentication",
+      fetch("https://api.cloudflare.com/client/v4/user", {
+        headers: {
+          "Content-Type": "application/json",
+          "X-Auth-Key": apiKey,
         },
-      );
-
-      if (!response.ok) {
-        throw new Error(
-          `Failed to get user information: ${response.status} ${response.statusText}`,
-        );
-      }
-
-      const data = (await response.json()) as {
-        success: boolean;
-        result: {
-          id: string;
-          email: string;
-          name: string;
-          [key: string]: any;
-        };
-      };
-
-      if (!data.success || !data.result || !data.result.email) {
-        throw new Error("Cloudflare API did not return valid user information");
-      }
-
-      return data.result.email;
-    } catch (error) {
-      logger.error("Error retrieving email from Cloudflare API:", error);
-      throw new Error(
-        "Failed to automatically discover email for API Key authentication",
-      );
-    }
+      }),
+    );
+    return result.email;
   },
 );

package/src/cloudflare/worker-metadata.ts

@@ -197,6 +197,9 @@ export interface WorkerMetadata {
     suspended: boolean;
   }[];
   containers?: { class_name: string }[];
+  placement?: {
+    mode: "smart";
+  };
 }
 
 export async function prepareWorkerMetadata(
@@ -213,6 +216,9 @@ export async function prepareWorkerMetadata(
     };
     tags?: string[];
     unstable_cacheWorkerSettings?: boolean;
+    placement?: {
+      mode: "smart";
+    };
   },
 ): Promise<WorkerMetadata> {
   const oldSettings = await (props.unstable_cacheWorkerSettings
@@ -336,6 +342,7 @@ export async function prepareWorkerMetadata(
       transferred_classes: [],
       new_sqlite_classes: [],
     },
+    placement: props.placement,
   };
 
   const assetUploadResult = props.assetUploadResult;

package/src/cloudflare/worker.ts

@@ -28,6 +28,7 @@ import { CloudflareApiError, handleApiError } from "./api-error.ts";
 import {
   type CloudflareApi,
   type CloudflareApiOptions,
+  type InternalCloudflareApiOptions,
   createCloudflareApi,
 } from "./api.ts";
 import type { Assets } from "./assets.ts";
@@ -88,6 +89,10 @@ import { WorkerSubdomain, disableWorkerSubdomain } from "./worker-subdomain.ts";
 import { createTail } from "./worker-tail.ts";
 import { Workflow, isWorkflow, upsertWorkflow } from "./workflow.ts";
 
+// Previous versions of `Worker` used the `Bundle` resource.
+// This import is here to avoid errors when destroying the `Bundle` resource.
+import "../esbuild/bundle.ts";
+
 /**
  * Configuration options for static assets
  */
@@ -176,6 +181,8 @@ export interface BaseWorkerProps<
    * Environment variables to attach to the worker
    *
    * These will be converted to plain_text bindings
+   *
+   * @deprecated - use `bindings` instead
    */
   env?: {
     [key: string]: string;
@@ -364,6 +371,24 @@ export interface BaseWorkerProps<
         url: string;
         cwd?: string;
       };
+
+  /**
+   * Smart placement configuration for the worker.
+   *
+   * Controls how Cloudflare places the worker across its network for optimal performance.
+   *
+   * When omitted, smart placement is disabled (default behavior).
+   */
+  placement?: {
+    /**
+     * The placement mode for the worker.
+     *
+     * - "smart": Automatically optimize placement based on performance metrics
+     *
+     * @default undefined (smart placement disabled)
+     */
+    mode: "smart";
+  };
 }
 
 export interface InlineWorkerProps<
@@ -558,6 +583,13 @@ export type Worker<
      * Version label for this worker deployment
      */
     version?: string;
+
+    /**
+     * Smart placement configuration for the worker
+     */
+    placement?: {
+      mode: "smart";
+    };
   };
 
 /**
@@ -1086,6 +1118,8 @@ export const _Worker = Resource(
         assets: props.assets,
         // Include cron triggers in the output
         crons: props.crons,
+        // Include placement configuration in the output
+        placement: props.placement,
         // phantom property
         Env: undefined!,
       } as unknown as Worker<B>);
@@ -1378,6 +1412,8 @@ export const _Worker = Resource(
       namespace: props.namespace,
       // Include version information in the output
       version: props.version,
+      // Include placement configuration in the output
+      placement: props.placement,
       // phantom property
       Env: undefined!,
     } as unknown as Worker<B>);
@@ -1487,12 +1523,12 @@ const normalizeExportBindings = (
   );
 };
 
-const normalizeApiOptions = (api: CloudflareApi): CloudflareApiOptions => ({
+const normalizeApiOptions = (
+  api: CloudflareApi,
+): InternalCloudflareApiOptions => ({
   accountId: api.accountId,
-  apiKey: api.apiKey,
-  apiToken: api.apiToken,
-  email: api.email,
   baseUrl: api.baseUrl,
+  ...api.authOptions,
 });
 
 async function provisionContainers(