alchemy 0.66.0 → 0.68.0

package/src/aws/policy.ts

@@ -108,7 +108,7 @@ export interface PolicyProps {
 /**
  * Output returned after IAM policy creation/update
  */
-export interface Policy extends Resource<"iam::Policy">, PolicyProps {
+export interface Policy extends PolicyProps {
   /**
    * ARN of the policy
    */
@@ -364,7 +364,7 @@ export const Policy = Resource(
         ),
       );
 
-      return this({
+      return {
         ...props,
         arn: policy.Policy!.Arn!,
         policyName,
@@ -373,7 +373,7 @@ export const Policy = Resource(
         createDate: policy.Policy!.CreateDate!,
         updateDate: policy.Policy!.UpdateDate!,
         isAttachable: policy.Policy!.IsAttachable!,
-      });
+      };
     } catch (error: any) {
       if (error.name === "NoSuchEntity") {
         // Create new policy
@@ -394,7 +394,7 @@ export const Policy = Resource(
           ),
         );
 
-        return this({
+        return {
           ...props,
           arn: newPolicy.Policy!.Arn!,
           policyName,
@@ -403,7 +403,7 @@ export const Policy = Resource(
           createDate: newPolicy.Policy!.CreateDate!,
           updateDate: newPolicy.Policy!.UpdateDate!,
           isAttachable: newPolicy.Policy!.IsAttachable!,
-        });
+        };
       }
       throw error;
     }

package/src/aws/queue.ts

@@ -79,7 +79,7 @@ export interface QueueProps {
 /**
  * Output returned after SQS queue creation/update
  */
-export interface Queue extends Resource<"sqs::Queue">, QueueProps {
+export interface Queue extends QueueProps {
   /**
    * ARN of the queue
    */
@@ -283,12 +283,12 @@ export const Queue = Resource(
         ),
       );
 
-      return this({
+      return {
         ...props,
         arn: attributesResponse.Attributes!.QueueArn!,
         queueName,
         url: createResponse.QueueUrl!,
-      });
+      };
     } catch (error: any) {
       if (isQueueDeletedRecently(error)) {
         logger.log(
@@ -324,12 +324,12 @@ export const Queue = Resource(
               ),
             );
 
-            return this({
+            return {
               ...props,
               arn: attributesResponse.Attributes!.QueueArn!,
               queueName,
               url: createResponse.QueueUrl!,
-            });
+            };
           } catch (retryError: any) {
             if (
               !isQueueDeletedRecently(retryError) ||

package/src/aws/role.ts

@@ -67,7 +67,7 @@ export interface RoleProps {
 /**
  * Output returned after IAM role creation/update
  */
-export interface Role extends Resource<"iam::Role">, RoleProps {
+export interface Role extends RoleProps {
   /**
    * ARN of the role
    */
@@ -535,13 +535,13 @@ export const Role = Resource(
       throw new Error(`Failed to create or update role ${props.roleName}`);
     }
 
-    return this({
+    return {
       ...props,
       arn: role.Role.Arn!,
       uniqueId: role.Role.RoleId!,
       roleId: role.Role.RoleId!,
       roleName,
       createDate: role.Role.CreateDate!,
-    });
+    };
   },
 );

package/src/aws/ses.ts

@@ -74,7 +74,7 @@ export interface SESProps {
 /**
  * Output returned after SES resource creation/update
  */
-export interface SES extends Resource<"aws::SES">, SESProps {
+export interface SES extends SESProps {
   /**
    * ARN of the configuration set if created
    * Format: arn:aws:ses:region:account-id:configuration-set/name
@@ -404,12 +404,12 @@ export const SES = Resource(
     }
 
     // Return the resource output
-    return this({
+    return {
       ...props,
       configurationSetArn,
       emailIdentityArn,
       emailIdentityVerificationStatus,
       dkimVerificationStatus,
-    });
+    };
   },
 );

package/src/aws/ssm-parameter.ts

@@ -89,7 +89,7 @@ export type SSMParameterProps =
 /**
  * Output returned after SSM Parameter creation/update
  */
-export type SSMParameter = Resource<"ssm::Parameter"> & {
+export type SSMParameter = {
   /**
    * ARN of the parameter
    */
@@ -316,7 +316,7 @@ export const SSMParameter = Resource(
         );
       }
 
-      return this({
+      return {
         ...props,
         arn: parameter.Parameter.ARN!,
         version: parameter.Parameter.Version!,
@@ -324,7 +324,7 @@ export const SSMParameter = Resource(
         name: parameter.Parameter.Name ?? parameterName,
         value: props.value,
         type: (parameter.Parameter.Type as any) ?? parameterType,
-      } as SSMParameter);
+      } as SSMParameter;
     } catch (error: any) {
       logger.error(
         `Error creating/updating parameter ${parameterName}:`,

package/src/aws/table.ts

@@ -77,7 +77,7 @@ export interface TableProps {
 /**
  * Output returned after DynamoDB table creation/update
  */
-export interface Table extends Resource<"dynamo::Table">, TableProps {
+export interface Table extends TableProps {
   /**
    * ARN of the table
    * Format: arn:aws:dynamodb:region:account-id:table/table-name
@@ -323,12 +323,12 @@ export const Table = Resource(
       );
     }
 
-    return this({
+    return {
       ...props,
       arn: tableDescription!.TableArn!,
       tableName,
       streamArn: tableDescription!.LatestStreamArn,
       tableId: tableDescription!.TableId!,
-    });
+    };
   },
 );

package/src/cloudflare/account-api-token.ts

@@ -140,8 +140,7 @@ interface CloudflareApiToken {
 /**
  * Output returned after Account API Token creation/update
  */
-export interface AccountApiToken
-  extends Resource<"cloudflare::AccountApiToken"> {
+export interface AccountApiToken {
   /**
    * The ID of the token
    *
@@ -385,7 +384,7 @@ export const AccountApiToken = Resource(
     }
 
     // Transform API response to our format
-    return this({
+    return {
       id: tokenData.id,
       name: tokenData.name,
       status: tokenData.status,
@@ -406,6 +405,6 @@ export const AccountApiToken = Resource(
       value: tokenValue,
       accessKeyId: alchemy.secret(tokenData.id),
       secretAccessKey: alchemy.secret(sha256(tokenValue.unencrypted)),
-    });
+    };
   },
 );

package/src/cloudflare/ai-gateway.ts

@@ -92,9 +92,7 @@ export interface AiGatewayProps extends CloudflareApiOptions {
  * Output returned after Cloudflare AI Gateway creation/update.
  * IMPORTANT: The interface name MUST match the exported resource name.
  */
-export interface AiGateway
-  extends Resource<"cloudflare::AiGateway">,
-    AiGatewayProps {
+export interface AiGateway extends AiGatewayProps {
   /**
    * The ID (name) of the gateway.
    */
@@ -248,7 +246,7 @@ export const AiGateway = Resource(
     }
 
     // Construct the output object from API response and merged props
-    return this({
+    return {
       ...mergedProps, // Start with the input props (including defaults)
       id: apiResource.id,
       gatewayName,
@@ -270,7 +268,7 @@ export const AiGateway = Resource(
       logpush: apiResource.logpush,
       logpushPublicKey: apiResource.logpush_public_key,
       type: "ai_gateway",
-    });
+    };
   },
 );
 

package/src/cloudflare/api-gateway-operation.ts

@@ -56,8 +56,7 @@ export interface APIGatewayOperationProps extends CloudflareApiOptions {
 /**
  * API Operation output
  */
-export interface APIGatewayOperation
-  extends Resource<"cloudflare::APIGatewayOperation"> {
+export interface APIGatewayOperation {
   /**
    * Zone ID
    */
@@ -202,7 +201,7 @@ export const APIGatewayOperation = Resource(
       }
     }
 
-    return this({
+    return {
       zoneId,
       zoneName,
       operationId,
@@ -210,7 +209,7 @@ export const APIGatewayOperation = Resource(
       host: props.host,
       method: props.method.toUpperCase(),
       action: props.mitigation ?? null,
-    });
+    };
   },
 );
 

package/src/cloudflare/api-schema.ts

@@ -48,33 +48,32 @@ export interface APISchemaProps<S extends OpenAPIV3.Document>
 /**
  * APISchema resource attributes.
  */
-export type APISchema<S extends OpenAPIV3.Document = OpenAPIV3.Document> =
-  Resource<"cloudflare::APISchema"> & {
-    /**
-     * Schema ID
-     */
-    id: string;
-
-    /**
-     * Name for the schema
-     */
-    name: string;
+export type APISchema<S extends OpenAPIV3.Document = OpenAPIV3.Document> = {
+  /**
+   * Schema ID
+   */
+  id: string;
+
+  /**
+   * Name for the schema
+   */
+  name: string;
 
-    /**
-     * The API Schema
-     */
-    schema: S;
+  /**
+   * The API Schema
+   */
+  schema: S;
 
-    /**
-     * Source of the schema
-     */
-    source: string;
+  /**
+   * Source of the schema
+   */
+  source: string;
 
-    /**
-     * Whether validation is enabled
-     */
-    enabled: boolean;
-  };
+  /**
+   * Whether validation is enabled
+   */
+  enabled: boolean;
+};
 
 /**
  * Cloudflare API Gateway Schema manages OpenAPI v3 schemas for API validation.
@@ -191,13 +190,13 @@ export const APISchema = Resource("cloudflare::APISchema", async function <
     });
   }
 
-  return this({
+  return {
     id: schemaDetails.id,
     name: schemaDetails.name,
     schema: parsedSchema as any,
     source: schemaDetails.source,
     enabled: schemaDetails.validationEnabled,
-  });
+  };
 });
 
 // API helper functions

package/src/cloudflare/api-shield.ts

@@ -163,8 +163,7 @@ export interface ValidationSettings {
 /**
  * Schema Validation output
  */
-export interface APIShield<S extends OpenAPIV3.Document = OpenAPIV3.Document>
-  extends Resource<"cloudflare::APIShield"> {
+export interface APIShield<S extends OpenAPIV3.Document = OpenAPIV3.Document> {
   /**
    * Name of the API Shield.
    */
@@ -440,7 +439,7 @@ const _APIShield = Resource(
       email: props.email,
     });
 
-    return this({
+    return {
       zoneId,
       schema,
       name: schemaName,
@@ -475,7 +474,7 @@ const _APIShield = Resource(
           );
         }),
       ),
-    });
+    };
   },
 );
 

package/src/cloudflare/api.ts

@@ -1,12 +1,10 @@
+import { Provider, type Credentials } from "../auth.ts";
 import type { Secret } from "../secret.ts";
+import { memoize } from "../util/memoize.ts";
 import { withExponentialBackoff } from "../util/retry.ts";
 import { safeFetch } from "../util/safe-fetch.ts";
-import {
-  getCloudflareAuthHeaders,
-  normalizeAuthOptions,
-  type CloudflareAuthOptions,
-} from "./auth.ts";
-import { getCloudflareAccountId } from "./user.ts";
+import { CloudflareAuth } from "./auth.ts";
+import { getCloudflareAccountId, getUserEmailFromApiKey } from "./user.ts";
 
 /**
  * Options for Cloudflare API requests
@@ -19,6 +17,17 @@ export interface CloudflareApiOptions {
    */
   baseUrl?: string;
 
+  /**
+   * The Alchemy profile to use for Cloudflare credentials. Defaults to:
+   * - `process.env.CLOUDFLARE_PROFILE`
+   * - `process.env.ALCHEMY_PROFILE`
+   * - `"default"`
+   *
+   * If an API key or token is provided in these options or in the environment,
+   * the profile will be ignored.
+   */
+  profile?: string;
+
   /**
    * API Key to use (overrides CLOUDFLARE_API_KEY env var)
    */
@@ -42,56 +51,96 @@ export interface CloudflareApiOptions {
   email?: string;
 }
 
-/** Used to propagate normalized auth options from a parent resource to `createCloudflareApi` in a child resource */
-export type InternalCloudflareApiOptions = CloudflareAuthOptions & {
-  baseUrl?: string;
-  accountId: string;
-};
-
-function computeCacheKey(options: CloudflareApiOptions): string {
-  return `${options.baseUrl}|${options.accountId}|${options.apiKey?.unencrypted}|${options.apiToken?.unencrypted}|${options.email}`;
-}
-
-const cloudflareApiCache: Record<string, CloudflareApi> = {};
-
 /**
  * Creates a CloudflareApi instance with automatic account ID discovery if not provided
  *
  * @param options API options
  * @returns Promise resolving to a CloudflareApi instance
  */
-export async function createCloudflareApi(
-  options: Partial<CloudflareApiOptions> | InternalCloudflareApiOptions = {},
-): Promise<CloudflareApi> {
-  // TODO: Implement scope-level credential resolution similar to AWS
-  // This function should check for scope.providerCredentials.cloudflare
-  // and merge those credentials with the provided options, following
-  // the same three-tier resolution pattern: global → scope → resource
-  const cacheKey = computeCacheKey(options);
-  if (cloudflareApiCache[cacheKey]) {
-    return cloudflareApiCache[cacheKey];
-  }
+export const createCloudflareApi = memoize(
+  async (options: CloudflareApiOptions = {}) => {
+    const baseUrl = options.baseUrl ?? process.env.CLOUDFLARE_BASE_URL;
+    const apiKey =
+      options.apiKey?.unencrypted ?? process.env.CLOUDFLARE_API_KEY;
+    const apiToken =
+      options.apiToken?.unencrypted ?? process.env.CLOUDFLARE_API_TOKEN;
+    const email = options.email ?? process.env.CLOUDFLARE_EMAIL;
+    const accountId =
+      options.accountId ??
+      process.env.CLOUDFLARE_ACCOUNT_ID ??
+      process.env.CF_ACCOUNT_ID;
 
-  const authOptions = await normalizeAuthOptions(options);
-  const accountId =
-    options.accountId ??
-    process.env.CLOUDFLARE_ACCOUNT_ID ??
-    process.env.CF_ACCOUNT_ID ??
-    (await getCloudflareAccountId(authOptions));
-  return (cloudflareApiCache[cacheKey] = new CloudflareApi({
-    baseUrl: options.baseUrl,
-    accountId,
-    authOptions,
-  }));
-}
+    if (apiKey) {
+      const credentials: Credentials.ApiKey = {
+        type: "api-key",
+        apiKey,
+        email: email ?? (await getUserEmailFromApiKey(apiKey)),
+      };
+      return new CloudflareApi({
+        baseUrl: options.baseUrl,
+        credentials,
+        accountId: accountId ?? (await getCloudflareAccountId(credentials)),
+      });
+    }
+
+    if (apiToken) {
+      const credentials: Credentials.ApiToken = {
+        type: "api-token",
+        apiToken,
+      };
+      return new CloudflareApi({
+        baseUrl,
+        credentials,
+        accountId: accountId ?? (await getCloudflareAccountId(credentials)),
+      });
+    }
+
+    try {
+      const profile =
+        options.profile ??
+        process.env.CLOUDFLARE_PROFILE ??
+        process.env.ALCHEMY_PROFILE ??
+        "default";
+      const { provider, credentials } =
+        await Provider.getWithCredentials<CloudflareAuth.Metadata>({
+          provider: "cloudflare",
+          profile,
+        });
+      return new CloudflareApi({
+        baseUrl,
+        profile,
+        credentials,
+        accountId: provider.metadata.id,
+      });
+    } catch (error) {
+      throw new Error(
+        [
+          "No credentials found. Please run `alchemy login`, or set either CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY in your environment.",
+          "Learn more: https://alchemy.run/guides/cloudflare/",
+        ].join("\n"),
+        { cause: error },
+      );
+    }
+  },
+  (options = {}) =>
+    [
+      options.baseUrl,
+      options.profile,
+      options.apiKey?.unencrypted,
+      options.apiToken?.unencrypted,
+      options.accountId,
+      options.email,
+    ].join("|"),
+);
 
 /**
  * Cloudflare API client using raw fetch
  */
 export class CloudflareApi {
-  public readonly accountId: string;
   public readonly baseUrl: string;
-  public readonly authOptions: CloudflareAuthOptions;
+  public readonly accountId: string;
+  public readonly credentials: Credentials;
+  public readonly profile: string | undefined;
 
   /**
    * Create a new Cloudflare API client
@@ -103,11 +152,13 @@ export class CloudflareApi {
   constructor(options: {
     baseUrl?: string;
     accountId: string;
-    authOptions: CloudflareAuthOptions;
+    credentials: Credentials;
+    profile?: string;
   }) {
-    this.accountId = options.accountId;
     this.baseUrl = options.baseUrl ?? "https://api.cloudflare.com/client/v4";
-    this.authOptions = options.authOptions;
+    this.accountId = options.accountId;
+    this.credentials = options.credentials;
+    this.profile = options.profile;
   }
 
   /**
@@ -133,7 +184,10 @@ export class CloudflareApi {
       headers = init.headers;
     }
     headers = {
-      ...(await getCloudflareAuthHeaders(this.authOptions)),
+      ...(await CloudflareAuth.formatHeadersWithRefresh({
+        profile: this.profile,
+        credentials: this.credentials,
+      })),
       ...headers,
     };
 
@@ -200,13 +254,11 @@ export class CloudflareApi {
     body: any,
     init: RequestInit = {},
   ): Promise<Response> {
-    const requestBody =
-      body instanceof FormData
-        ? body
-        : typeof body === "string"
-          ? body
-          : JSON.stringify(body);
-    return this.fetch(path, { ...init, method: "POST", body: requestBody });
+    return this.fetch(path, {
+      ...init,
+      method: "POST",
+      body: this.toBody(body),
+    });
   }
 
   /**
@@ -217,8 +269,21 @@ export class CloudflareApi {
     body: any,
     init: RequestInit = {},
   ): Promise<Response> {
-    const requestBody = body instanceof FormData ? body : JSON.stringify(body);
-    return this.fetch(path, { ...init, method: "PUT", body: requestBody });
+    return this.fetch(path, {
+      ...init,
+      method: "PUT",
+      body: this.toBody(body),
+    });
+  }
+
+  toBody(body: BodyInit): BodyInit {
+    return body instanceof FormData
+      ? body
+      : typeof body === "string"
+        ? body
+        : body instanceof ReadableStream
+          ? body
+          : JSON.stringify(body);
   }
 
   /**
@@ -232,7 +297,7 @@ export class CloudflareApi {
     return this.fetch(path, {
       ...init,
       method: "PATCH",
-      body: JSON.stringify(body),
+      body: this.toBody(body),
     });
   }