alchemy 0.66.0 → 0.68.0

package/src/cloudflare/assets.ts

@@ -1,9 +1,9 @@
-import * as fs from "node:fs/promises";
-import * as path from "pathe";
-import type { Context } from "../context.ts";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "pathe";
 import { Resource } from "../resource.ts";
 import { getContentType } from "../util/content-type.ts";
-import ignore from "../util/ignore-matcher.js";
+import ignore from "../util/ignore-matcher.ts";
 
 /**
  * Properties for creating or updating Assets
@@ -17,54 +17,11 @@ export interface AssetsProps {
 }
 
 /**
- * Output returned after Assets creation/update
+ * Assets binding type
  */
-export interface Assets extends Resource<"cloudflare::Asset">, AssetsProps {
-  /**
-   * The type of binding
-   */
+export type Assets = AssetsProps & {
   type: "assets";
-
-  /**
-   * The ID of the assets bundle
-   */
-  id: string;
-
-  /**
-   * Asset files that were found
-   */
-  files: AssetFile[];
-
-  /**
-   * Time at which the assets were created
-   */
-  createdAt: number;
-
-  /**
-   * Time at which the assets were last updated
-   */
-  updatedAt: number;
-}
-
-/**
- * Represents a single asset file
- */
-export interface AssetFile {
-  /**
-   * Path relative to the assets directory
-   */
-  path: string;
-
-  /**
-   * Full filesystem path to the file
-   */
-  filePath: string;
-
-  /**
-   * Content type of the file
-   */
-  contentType: string;
-}
+};
 
 /**
  * Cloudflare Assets represent a collection of static files that can be uploaded and served
@@ -72,7 +29,7 @@ export interface AssetFile {
  *
  * @example
  * // Create a basic assets bundle from a local directory
- * const staticAssets = await Assets("static", {
+ * const staticAssets = await Assets({
  *   path: "./src/assets"
  * });
  *
@@ -85,100 +42,102 @@ export interface AssetFile {
  *   }
  * });
  */
-export const Assets = Resource(
-  "cloudflare::Asset",
-  {
-    alwaysUpdate: true,
-  },
-  async function (
-    this: Context<Assets>,
-    id: string,
-    props: AssetsProps,
-  ): Promise<Assets> {
-    if (this.phase === "delete") {
-      return this.destroy();
-    }
+export async function Assets(props: AssetsProps): Promise<Assets> {
+  return {
+    type: "assets",
+    ...props,
+  };
+}
+
+export namespace Assets {
+  export interface FileMetadata {
+    path: string;
+    name: string;
+    hash: string;
+    size: number;
+    type: string;
+  }
 
+  /**
+   * Recursively read the metadata for all assets in a directory, skipping files that are ignored by the .assetsignore file
+   *
+   * @param root Path to the directory
+   * @returns Metadata for all assets in the directory
+   */
+  export const read = async (root: string): Promise<FileMetadata[]> => {
+    const matcher = ignore().add(".assetsignore");
+    const ignorePath = path.join(root, ".assetsignore");
     try {
-      // Check if the assets directory exists
-      const stats = await fs.stat(props.path);
-      if (!stats.isDirectory()) {
-        throw new Error(`Assets path ${props.path} is not a directory`);
-      }
-    } catch (_error) {
-      throw new Error(
-        `Assets directory ${props.path} does not exist or is not accessible`,
-      );
+      const content = await fs.readFile(ignorePath, "utf-8");
+      matcher.add(content.split("\n"));
+    } catch {
+      // ignore
     }
 
-    // Recursively get all files in the assets directory
-    const ignoreMatcher = await createIgnoreMatcher(props.path);
-    const filesList = await getFilesRecursively(props.path, ignoreMatcher);
+    const readDirectory = async (
+      directory: string,
+    ): Promise<FileMetadata[]> => {
+      const files = await fs.readdir(directory);
+      const result: FileMetadata[] = [];
+      await Promise.all(
+        files.map(async (file) => {
+          const absolutePath = path.join(directory, file);
+          const relativePath = path.relative(root, absolutePath);
+          if (matcher.ignores(relativePath)) {
+            return;
+          }
+          const stat = await fs.stat(absolutePath);
+          if (stat.isDirectory()) {
+            result.push(...(await readDirectory(absolutePath)));
+          } else {
+            if (stat.size > 26214400) {
+              throw new Error(
+                `File "${absolutePath}" is too large to upload as an asset to Cloudflare (the file is ${(stat.size / 1024 / 1024).toFixed(2)} MB; the maximum size is 25MB).`,
+              );
+            }
+            result.push({
+              path: absolutePath,
+              name: relativePath.startsWith("/")
+                ? relativePath
+                : `/${relativePath}`,
+              hash: await computeHash(absolutePath),
+              size: stat.size,
+              type: getContentType(absolutePath) ?? "application/null",
+            });
+          }
+        }),
+      );
+      return result;
+    };
 
-    // Create asset file objects
-    const files: AssetFile[] = filesList.map((filePath) => {
-      const relativePath = path.relative(props.path, filePath);
+    return await readDirectory(root);
+  };
 
-      return {
-        path: path.normalize(relativePath),
-        filePath: path.normalize(filePath),
-        contentType: getContentType(filePath) ?? "application/null",
-      };
-    });
+  /**
+   * Calculate the SHA-256 hash and size of a file
+   *
+   * @param filePath Path to the file
+   * @returns Hash (first 32 chars of SHA-256) and size of the file
+   */
+  const computeHash = async (filePath: string): Promise<string> => {
+    const contents = await fs.readFile(filePath);
 
-    // Get current timestamp
-    const now = Date.now();
+    const hash = crypto.createHash("sha256");
+    hash.update(contents);
 
-    // Construct the output
-    return this({
-      id,
-      type: "assets",
-      path: props.path,
-      files,
-      createdAt: this.output?.createdAt || now,
-      updatedAt: now,
-    });
-  },
-);
+    const extension = path.extname(filePath).substring(1);
+    hash.update(extension);
 
-async function createIgnoreMatcher(
-  dir: string,
-): Promise<{ ignores: (path: string) => boolean }> {
-  const ignoreMatcher = ignore().add(".assetsignore");
-  const ignorePath = path.join(dir, ".assetsignore");
-  try {
-    const content = await fs.readFile(ignorePath, "utf-8");
-    ignoreMatcher.add(content.split("\n"));
-  } catch {
-    // ignore
-  }
-  return ignoreMatcher;
+    return hash.digest("hex").slice(0, 32);
+  };
 }
 
-// Helper functions for file operations
-async function getFilesRecursively(
-  dir: string,
-  ignoreMatcher: { ignores: (path: string) => boolean },
-): Promise<string[]> {
-  const files = await fs.readdir(dir, { withFileTypes: true });
-  const result: string[] = [];
-
-  await Promise.all(
-    files.map(async (file) => {
-      const filePath = path.join(dir, file.name);
-      if (ignoreMatcher.ignores(file.name)) {
-        return;
-      }
-      if (
-        file.isDirectory() ||
-        (file.isSymbolicLink() && (await fs.stat(filePath)).isDirectory())
-      ) {
-        result.push(...(await getFilesRecursively(filePath, ignoreMatcher)));
-      } else {
-        result.push(filePath);
-      }
-    }),
-  );
+// we are deprecating the Assets resource (it is now just a function)
+// but, a user may still have a resource that depends on it, so we register a no-op dummy resource so that it can be cleanly deleted
+Resource("cloudflare::Asset", async function (this) {
+  if (this.phase === "delete") {
+    return this.destroy();
+  }
 
-  return result;
-}
+  throw new Error("Not implemented");
+});

package/src/cloudflare/auth.ts

@@ -1,101 +1,166 @@
-import { alchemy } from "../alchemy.ts";
-import type { Secret } from "../secret.ts";
-import type { CloudflareApiOptions } from "./api.ts";
-import { getRefreshedWranglerConfig } from "./oauth.ts";
-import { getUserEmailFromApiKey } from "./user.ts";
+import assert from "node:assert";
+import { Credentials } from "../auth.ts";
+import { OAuthClient } from "../util/oauth-client.ts";
 
-export interface CloudflareApiTokenAuthOptions {
-  type: "api-token";
-  apiToken: Secret<string>;
-}
-
-export interface CloudflareApiKeyAuthOptions {
-  type: "api-key";
-  apiKey: Secret;
-  apiEmail: string;
-}
-
-export interface CloudflareWranglerAuthOptions {
-  type: "wrangler";
-}
+export namespace CloudflareAuth {
+  export const client = new OAuthClient({
+    clientId: "6d8c2255-0773-45f6-b376-2914632e6f91",
+    redirectUri: "http://localhost:9976/auth/callback",
+    endpoints: {
+      authorize: "https://dash.cloudflare.com/oauth2/authorize",
+      token: "https://dash.cloudflare.com/oauth2/token",
+      revoke: "https://dash.cloudflare.com/oauth2/revoke",
+    },
+  });
 
-export type CloudflareAuthOptions =
-  | CloudflareApiTokenAuthOptions
-  | CloudflareApiKeyAuthOptions
-  | CloudflareWranglerAuthOptions;
+  export type Metadata = {
+    id: string;
+    name: string;
+  };
+  export const ALL_SCOPES = {
+    // TODO: Verify descriptions marked with `//*`
+    "access:read": "Read Cloudflare Access", //*
+    "access:write": "Write Cloudflare Access", //*
+    "account:read":
+      "See your account info such as account details, analytics, and memberships.",
+    "agw:read": "Read API Gateway", //*
+    "agw:run": "Run API Gateway", //*
+    "ai:read": "Read access to Workers AI catalog and assets",
+    "ai:write": "See and change Workers AI catalog and assets",
+    "aiaudit:read": "Read AI Audit", //*
+    "aiaudit:write": "Write AI Audit", //*
+    "aig:read": "Read AI Gateway", //*
+    "aig:write": "Write AI Gateway", //*
+    "auditlogs:read": "Read audit logs", //*
+    "browser:read": "Read Browser", //*
+    "browser:write": "Write Browser", //*
+    "cfone:read": "Read Cloudflare One", //*
+    "cfone:write": "Write Cloudflare One", //*
+    "cloudchamber:write": "Manage Cloudchamber",
+    "constellation:write": "Write Constellation", //*
+    "containers:write": "Manage Workers Containers",
+    "d1:write": "See and change D1 Databases.",
+    "dex:read": "Read DEX", //*
+    "dex:write": "Write DEX", //*
+    "dns_analytics:read": "Read DNS analytics",
+    "dns_records:edit": "Edit DNS records",
+    "dns_records:read": "Read DNS records",
+    "dns_settings:read": "Read DNS settings",
+    "firstpartytags:write": "Write First Party Tags", //*
+    "lb:edit": "Edit Load Balancer", //*
+    "lb:read": "Read Load Balancer", //*
+    "logpush:read": "Read Logpush", //*
+    "logpush:write": "Write Logpush", //*
+    "notification:read": "Read Notifications", //*
+    "notification:write": "Write Notifications", //*
+    "pages:read": "Read access to Pages projects, settings, and deployments.",
+    "pages:write": "See and change Pages projects, settings, and deployments.",
+    "pipelines:read": "Read access to Pipelines configurations and data",
+    "pipelines:setup": "Setup access to Pipelines configurations and data",
+    "pipelines:write": "See and change Pipelines configurations and data",
+    "query_cache:write": "Write Query Cache", //*
+    "queues:write": "See and change Queues settings and data",
+    "r2_catalog:write": "Write R2 Catalog", //*
+    "radar:read": "Read Radar", //*
+    "rag:read": "Read RAG", //*
+    "rag:write": "Write RAG", //*
+    "secrets_store:read":
+      "Read access to secrets + stores within the Secrets Store",
+    "secrets_store:write":
+      "See and change secrets + stores within the Secrets Store",
+    "sso-connector:read": "Read SSO Connector", //*
+    "sso-connector:write": "Write SSO Connector", //*
+    "ssl_certs:write": "See and manage mTLS certificates for your account",
+    "teams:pii": "Read Teams PII", //*
+    "teams:read": "Read Teams", //*
+    "teams:secure_location": "Read Secure Location", //*
+    "teams:write": "Write Teams", //*
+    "url_scanner:read": "Read URL Scanner", //*
+    "url_scanner:write": "Write URL Scanner", //*
+    "user:read":
+      "See your user info such as name, email address, and account memberships.",
+    "vectorize:write": "Write Vectorize", //*
+    "workers:write":
+      "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
+    "workers_builds:read": "Read Workers Builds", //*
+    "workers_builds:write": "Write Workers Builds", //*
+    "workers_kv:write":
+      "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
+    "workers_observability:read": "Read Workers Observability", //*
+    "workers_observability:write": "Write Workers Observability", //*
+    "workers_observability_telemetry:write":
+      "Write Workers Observability Telemetry", //*
+    "workers_routes:write":
+      "See and change Cloudflare Workers data such as filters and routes.",
+    "workers_scripts:write":
+      "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
+    "workers_tail:read": "See Cloudflare Workers tail and script data.",
+    "zone:read": "Grants read level access to account zone.",
+    // Not granted yet
+    // "connectivity:admin":
+    //   "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel.",
+  };
+  export const DEFAULT_SCOPES = [
+    "account:read",
+    "user:read",
+    "workers:write",
+    "workers_kv:write",
+    "workers_routes:write",
+    "workers_scripts:write",
+    "workers_tail:read",
+    "d1:write",
+    "pages:write",
+    "zone:read",
+    "ssl_certs:write",
+    "ai:write",
+    "queues:write",
+    "pipelines:write",
+    "secrets_store:write",
+    "containers:write",
+    "cloudchamber:write",
+  ];
 
-export const isCloudflareAuthOptions = (
-  input?: CloudflareApiOptions | CloudflareAuthOptions,
-): input is CloudflareAuthOptions => {
-  return (
-    input !== undefined &&
-    "type" in input &&
-    (input.type === "api-token" ||
-      input.type === "api-key" ||
-      input.type === "wrangler")
-  );
-};
-
-export async function normalizeAuthOptions(
-  input?: CloudflareApiOptions | CloudflareAuthOptions,
-): Promise<CloudflareAuthOptions> {
-  if (isCloudflareAuthOptions(input)) {
-    return input;
-  }
-
-  const email = async (apiKey: Secret<string>) =>
-    input?.email ??
-    process.env.CLOUDFLARE_EMAIL ??
-    (await getUserEmailFromApiKey(apiKey.unencrypted));
-
-  if (input?.apiKey) {
-    return {
-      type: "api-key",
-      apiKey: input.apiKey,
-      apiEmail: await email(input.apiKey),
-    };
-  }
-  if (input?.apiToken) {
-    return { type: "api-token", apiToken: input.apiToken };
-  }
-  if (process.env.CLOUDFLARE_API_KEY) {
-    const key = alchemy.secret(process.env.CLOUDFLARE_API_KEY);
-    return { type: "api-key", apiKey: key, apiEmail: await email(key) };
-  }
-  if (process.env.CLOUDFLARE_API_TOKEN) {
-    return {
-      type: "api-token",
-      apiToken: alchemy.secret(process.env.CLOUDFLARE_API_TOKEN),
-    };
-  }
-  return { type: "wrangler" };
-}
+  /**
+   * Format Cloudflare credentials as headers, refreshing OAuth credentials if expired.
+   * If the credentials are OAuth, the `profile` is required so we can read and write the updated credentials.
+   */
+  export const formatHeadersWithRefresh = async (input: {
+    profile: string | undefined;
+    credentials: Credentials;
+  }) => {
+    // if the credentials are not expired, return them as is
+    if (!Credentials.isOAuthExpired(input.credentials)) {
+      return formatHeaders(input.credentials);
+    }
+    assert(input.profile, "Profile is required for OAuth credentials");
+    const credentials = await Credentials.getRefreshed(
+      {
+        provider: "cloudflare",
+        profile: input.profile,
+      },
+      async (credentials) => {
+        return await client.refresh(credentials);
+      },
+    );
+    return formatHeaders(credentials);
+  };
 
-export async function getCloudflareAuthHeaders(
-  authOptions: CloudflareAuthOptions,
-): Promise<Record<string, string>> {
-  switch (authOptions.type) {
-    case "api-token":
-      return { Authorization: `Bearer ${authOptions.apiToken.unencrypted}` };
-    case "api-key":
-      return {
-        "X-Auth-Key": authOptions.apiKey.unencrypted,
-        "X-Auth-Email": authOptions.apiEmail,
-      };
-    case "wrangler": {
-      const wranglerConfig = await getRefreshedWranglerConfig();
-      if (wranglerConfig.isErr()) {
-        throw new Error(
-          [
-            wranglerConfig.error.message,
-            "Please run `alchemy login`, or set either CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY in your environment.",
-            "Learn more: https://alchemy.run/guides/cloudflare/",
-          ].join("\n"),
-        );
-      }
-      return {
-        Authorization: `Bearer ${wranglerConfig.value.oauth_token}`,
-      };
+  /**
+   * Format Cloudflare credentials as headers.
+   */
+  export const formatHeaders = (
+    credentials: Credentials,
+  ): Record<string, string> => {
+    switch (credentials.type) {
+      case "api-key":
+        return {
+          "X-Auth-Key": credentials.apiKey,
+          "X-Auth-Email": credentials.email,
+        };
+      case "api-token":
+        return { Authorization: `Bearer ${credentials.apiToken}` };
+      case "oauth":
+        return { Authorization: `Bearer ${credentials.access}` };
     }
-  }
+  };
 }

package/src/cloudflare/bindings.ts

@@ -4,7 +4,6 @@
  * https://developers.cloudflare.com/api/resources/workers/subresources/scripts/methods/update/
  */
 import type { Secret } from "../secret.ts";
-import type { AiGateway } from "./ai-gateway.ts";
 import type { Ai } from "./ai.ts";
 import type { AnalyticsEngineDataset } from "./analytics-engine.ts";
 import type { Assets } from "./assets.ts";
@@ -15,6 +14,7 @@ import type { Container } from "./container.ts";
 import type { D1Database } from "./d1-database.ts";
 import type { DispatchNamespace } from "./dispatch-namespace.ts";
 import type { DurableObjectNamespace } from "./durable-object-namespace.ts";
+import type { HyperdriveRef } from "./hyperdrive-ref.ts";
 import type { Hyperdrive } from "./hyperdrive.ts";
 import type { Images } from "./images.ts";
 import type { KVNamespace } from "./kv-namespace.ts";
@@ -22,6 +22,7 @@ import type { Pipeline } from "./pipeline.ts";
 import type { Queue } from "./queue.ts";
 import type { RateLimit } from "./rate-limit.ts";
 import type { SecretKey } from "./secret-key.ts";
+import type { SecretRef as CloudflareSecretRef } from "./secret-ref.ts";
 import type { Secret as CloudflareSecret } from "./secret.ts";
 import type { VectorizeIndex } from "./vectorize-index.ts";
 import type { VersionMetadata } from "./version-metadata.ts";
@@ -45,15 +46,16 @@ export declare namespace Bindings {
  */
 export type Binding =
   | Ai
-  | AiGateway
   | Assets
   | Container
   | CloudflareSecret
+  | CloudflareSecretRef
   | D1Database
   | DispatchNamespace
   | AnalyticsEngineDataset
   | DurableObjectNamespace<any>
   | Hyperdrive
+  | HyperdriveRef
   | Images
   | KVNamespace
   | Pipeline
@@ -71,14 +73,27 @@ export type Binding =
   | Worker
   | WorkerStub
   | WorkerRef
+  | WorkerEntrypoint
   | Workflow
   | BrowserRendering
   | VersionMetadata
   | Self
   | Json;
 
-export type Self = typeof Self;
-export const Self = Symbol.for("Self");
+export type Self<
+  RPC extends Rpc.WorkerEntrypointBranded = Rpc.WorkerEntrypointBranded,
+> = {
+  type: "cloudflare::Worker::Self";
+  __entrypoint__?: string;
+  __rpc__?: RPC;
+};
+export const Self = {
+  type: "cloudflare::Worker::Self",
+} as const;
+
+export type WorkerEntrypoint = (Worker | WorkerRef) & {
+  __entrypoint__?: string;
+};
 
 export type Json<T = any> = {
   type: "json";
@@ -401,6 +416,8 @@ export interface WorkerBindingService {
   environment?: string;
   /** Service namespace */
   namespace?: string;
+  /** Service entrypoint */
+  entrypoint?: string;
 }
 
 /**