alchemy 0.66.0 → 0.68.0

package/src/cloudflare/miniflare/remote-binding-proxy.ts

@@ -1,4 +1,5 @@
 import type { RemoteProxyConnectionString } from "miniflare";
+import { WebSocket } from "ws";
 import { HTTPServer } from "../../util/http.ts";
 import { extractCloudflareResult } from "../api-response.ts";
 import type { CloudflareApi } from "../api.ts";
@@ -54,18 +55,29 @@ export async function createRemoteProxyWorker(input: {
     getAccountSubdomain(input.api),
   ]);
 
-  const proxyURL = `https://${input.name}.${subdomain}.workers.dev`;
+  const host = `${input.name}.${subdomain}.workers.dev`;
+
   const server = new HTTPServer({
+    websocket: async (req) => {
+      const input = new URL(req.url);
+      const proxied = new URL(input.pathname + input.search, `https://${host}`);
+      return new WebSocket(proxied, {
+        headers: {
+          "cf-workers-preview-token": token,
+          host,
+        },
+      });
+    },
     fetch: async (req) => {
       const url = new URL(req.url);
-      const targetUrl = new URL(url.pathname + url.search, proxyURL);
+      const proxied = new URL(url.pathname + url.search, `https://${host}`);
 
       const headers = new Headers(req.headers);
       headers.set("cf-workers-preview-token", token);
-      headers.set("host", new URL(proxyURL).hostname);
+      headers.set("host", host);
       headers.delete("cf-connecting-ip");
 
-      const res = await fetch(targetUrl, {
+      const res = await fetch(proxied, {
         method: req.method,
         headers,
         body: req.body,

package/src/cloudflare/miniflare/tunnel.ts

@@ -0,0 +1,116 @@
+import type * as miniflare from "miniflare";
+import { Scope } from "../../scope.ts";
+import { findOpenPort } from "../../util/find-open-port.ts";
+import type { CloudflareApi } from "../api.ts";
+import { getInternalWorkerBundle } from "../bundle/internal-worker-bundle.ts";
+import {
+  enableWorkerSubdomain,
+  getAccountSubdomain,
+  getWorkerSubdomain,
+} from "../worker-subdomain.ts";
+import { putWorker } from "../worker.ts";
+import {
+  createMiniflareWorkerProxy,
+  MiniflareWorkerProxyError,
+} from "./miniflare-worker-proxy.ts";
+
+export interface Tunnel {
+  /**
+   * Enables tunneling for a local worker.
+   * Returns a `workers.dev` URL that can be used to access the worker.
+   */
+  configureWorker: (input: {
+    api: CloudflareApi;
+    name: string;
+  }) => Promise<URL>;
+  /**
+   * Closes the tunnel.
+   */
+  close: () => Promise<void>;
+}
+
+export async function createTunnel(
+  miniflare: miniflare.Miniflare,
+): Promise<Tunnel> {
+  const workers = new Set<string>(); // used to avoid exposing workers that are not running with tunneling enabled
+  const proxy = await createMiniflareWorkerProxy({
+    port: await findOpenPort(9977), // alchemy auth uses 9976, so one above that
+    miniflare,
+    mode: "remote",
+    transformRequest: (request) => {
+      if (request.url.origin === remote.origin) {
+        request.url.protocol = proxy.url.protocol;
+        request.url.host = proxy.url.host;
+        request.url.port = proxy.url.port;
+        request.headers.set("host", proxy.url.host);
+      }
+    },
+    getWorkerName: (request) => {
+      const name = request.headers.get("alchemy-worker-name");
+      if (!name) {
+        throw new MiniflareWorkerProxyError(
+          "Worker name is missing from request headers. This indicates a bug in Alchemy.",
+          530,
+        );
+      }
+      if (!workers.has(name)) {
+        throw new MiniflareWorkerProxyError(
+          `The worker "${name}" is not running with tunneling enabled.`,
+          530,
+        );
+      }
+      return name;
+    },
+  });
+  const remoteUrlString = await Scope.current.spawn("tunnel", {
+    processName: `cloudflared-${proxy.url.port}`,
+    cmd: `cloudflared tunnel --url ${proxy.url.toString()}`,
+    quiet: !process.env.DEBUG,
+    extract: (line) => {
+      const match = line.match(/https:\/\/([^\s]+)\.trycloudflare\.com/);
+      if (match) {
+        return `https://${match[1]}.trycloudflare.com`;
+      }
+    },
+  });
+  const remote = new URL(remoteUrlString);
+  return {
+    configureWorker: async (input) => {
+      workers.add(input.name);
+      return await createTunnelProxyWorker({
+        api: input.api,
+        name: input.name,
+        host: remote.host,
+      });
+    },
+    close: async () => {
+      await proxy.close();
+    },
+  };
+}
+
+async function createTunnelProxyWorker(input: {
+  api: CloudflareApi;
+  name: string;
+  host: string;
+}) {
+  const script = await getInternalWorkerBundle("tunnel-proxy");
+  const [accountSubdomain, workerSubdomainStatus] = await Promise.all([
+    getAccountSubdomain(input.api),
+    getWorkerSubdomain(input.api, input.name),
+    putWorker(input.api, {
+      workerName: input.name,
+      scriptBundle: script.bundle,
+      compatibilityDate: "2025-09-01",
+      compatibilityFlags: [],
+      bindings: {
+        WORKER_NAME: input.name,
+        TUNNEL_HOST: input.host,
+      },
+    }),
+  ]);
+  if (!workerSubdomainStatus.enabled) {
+    await enableWorkerSubdomain(input.api, input.name);
+  }
+  return new URL(`https://${input.name}.${accountSubdomain}.workers.dev`);
+}

package/src/cloudflare/next.ts

@@ -33,6 +33,9 @@ export async function Nextjs<const B extends Bindings>(
     );
   }
   return await Website(id, {
+    bundle: {
+      minify: true,
+    },
     ...props,
     entrypoint: props.entrypoint ?? ".open-next/worker.js",
     wrangler: {

package/src/cloudflare/permission-groups.ts

@@ -45,7 +45,7 @@ export type R2PermissionGroups =
  *
  * @see https://developers.cloudflare.com/r2/api/tokens/#permissions
  */
-export type PermissionGroups = Resource<"cloudflare::PermissionGroups"> & {
+export type PermissionGroups = {
   /**
    * Admin Read & Write - Allows create, list, delete buckets and edit bucket configurations
    * plus list, write, and read object access
@@ -140,10 +140,8 @@ export const PermissionGroups = Resource(
       );
     }
 
-    return this(
-      Object.fromEntries(
-        data.result.map((group) => [group.name, group]),
-      ) as PermissionGroups,
-    );
+    return Object.fromEntries(
+      data.result.map((group) => [group.name, group]),
+    ) as PermissionGroups;
   },
 );

package/src/cloudflare/pipeline.ts

@@ -229,41 +229,40 @@ export interface PipelineRecord {
   [key: string]: any;
 }
 
-export function isPipeline(resource: Resource): resource is Pipeline {
-  return resource[ResourceKind] === "cloudflare::Pipeline";
+export function isPipeline(resource: any): resource is Pipeline {
+  return resource?.[ResourceKind] === "cloudflare::Pipeline";
 }
 
 /**
  * Output returned after Pipeline creation/update
  */
 export type Pipeline<_T extends PipelineRecord = PipelineRecord> =
-  Resource<"cloudflare::Pipeline"> &
-    PipelineProps & {
-      /**
-       * Type identifier for the Pipeline resource
-       */
-      type: "pipeline";
-
-      /**
-       * The unique ID of the pipeline
-       */
-      id: string;
+  PipelineProps & {
+    /**
+     * Type identifier for the Pipeline resource
+     */
+    type: "pipeline";
 
-      /**
-       * The name of the pipeline
-       */
-      name: string;
+    /**
+     * The unique ID of the pipeline
+     */
+    id: string;
 
-      /**
-       * HTTP endpoint URL for the pipeline
-       */
-      endpoint: string;
+    /**
+     * The name of the pipeline
+     */
+    name: string;
 
-      /**
-       * Version of the pipeline
-       */
-      version: number;
-    };
+    /**
+     * HTTP endpoint URL for the pipeline
+     */
+    endpoint: string;
+
+    /**
+     * Version of the pipeline
+     */
+    version: number;
+  };
 
 /**
  * Creates and manages Cloudflare Pipelines.
@@ -341,7 +340,7 @@ export const Pipeline = Resource("cloudflare::Pipeline", async function <
     props.name ?? this.output?.name ?? this.scope.createPhysicalName(id);
 
   if (this.scope.local && !props.dev?.remote) {
-    return this({
+    return {
       type: "pipeline",
       id: this.output?.id ?? "",
       name: this.output?.name ?? pipelineName,
@@ -351,7 +350,7 @@ export const Pipeline = Resource("cloudflare::Pipeline", async function <
       destination: props.destination,
       compression: props.compression,
       accountId: this.output?.accountId ?? "",
-    });
+    };
   }
 
   if (this.phase === "update" && this.output?.name !== pipelineName) {
@@ -418,7 +417,7 @@ export const Pipeline = Resource("cloudflare::Pipeline", async function <
     }
   }
 
-  return this({
+  return {
     type: "pipeline",
     id: pipelineData.result.id,
     name: pipelineName,
@@ -433,7 +432,7 @@ export const Pipeline = Resource("cloudflare::Pipeline", async function <
     destination: props.destination, // Use the input destination, not the API response
     compression: props.compression,
     accountId: api.accountId,
-  });
+  };
 });
 
 interface CloudflarePipelineResponse {

package/src/cloudflare/queue-consumer.ts

@@ -96,9 +96,7 @@ export interface QueueConsumerProps extends CloudflareApiOptions {
 /**
  * Output returned after Queue Consumer creation/update
  */
-export interface QueueConsumer
-  extends Resource<"cloudflare::QueueConsumer">,
-    QueueConsumerProps {
+export interface QueueConsumer extends QueueConsumerProps {
   /**
    * Unique ID for the consumer
    */
@@ -162,7 +160,7 @@ export const QueueConsumer = Resource(
       typeof props.queue === "string" ? props.queue : props.queue.id;
 
     if (this.scope.local && props.dev) {
-      return this({
+      return {
         id: this.output?.id ?? "",
         queueId,
         queue: props.queue,
@@ -170,7 +168,7 @@ export const QueueConsumer = Resource(
         scriptName: props.scriptName,
         settings: props.settings,
         accountId: this.output?.accountId ?? "",
-      });
+      };
     }
 
     const api = await createCloudflareApi(props);
@@ -231,7 +229,7 @@ export const QueueConsumer = Resource(
       );
     }
 
-    return this({
+    return {
       id: consumerData.result.consumer_id,
       queueId,
       queue: props.queue,
@@ -249,7 +247,7 @@ export const QueueConsumer = Resource(
         : undefined,
       createdOn: consumerData.result.created_on,
       accountId: api.accountId,
-    });
+    };
   },
 );
 

package/src/cloudflare/queue.ts

@@ -100,56 +100,55 @@ export function isQueue(eventSource: any): eventSource is Queue {
 /**
  * Output returned after Cloudflare Queue creation/update
  */
-export type Queue<Body = unknown> = Resource<"cloudflare::Queue"> &
-  Omit<QueueProps, "dev"> & {
-    /**
-     * Type identifier for Cloudflare Queue
-     */
-    type: "queue";
+export type Queue<Body = unknown> = Omit<QueueProps, "dev"> & {
+  /**
+   * Type identifier for Cloudflare Queue
+   */
+  type: "queue";
 
-    /**
-     * The unique ID of the queue
-     */
-    id: string;
+  /**
+   * The unique ID of the queue
+   */
+  id: string;
 
-    /**
-     * The name of the queue
-     */
-    name: string;
+  /**
+   * The name of the queue
+   */
+  name: string;
 
-    /**
-     * Time when the queue was created
-     */
-    createdOn: string;
+  /**
+   * Time when the queue was created
+   */
+  createdOn: string;
 
-    /**
-     * Modified timestamp
-     */
-    modifiedOn: string;
+  /**
+   * Modified timestamp
+   */
+  modifiedOn: string;
 
+  /**
+   * Phantom property to allow type inference
+   */
+  Body: Body;
+
+  Batch: MessageBatch<Body>;
+
+  /**
+   * Development mode properties
+   * @internal
+   */
+  dev: {
     /**
-     * Phantom property to allow type inference
+     * The ID of the queue in development mode
      */
-    Body: Body;
-
-    Batch: MessageBatch<Body>;
+    id: string;
 
     /**
-     * Development mode properties
-     * @internal
+     * Whether the queue is running remotely
      */
-    dev: {
-      /**
-       * The ID of the queue in development mode
-       */
-      id: string;
-
-      /**
-       * Whether the queue is running remotely
-       */
-      remote: boolean;
-    };
+    remote: boolean;
   };
+};
 
 /**
  * Creates and manages Cloudflare Queues.
@@ -256,7 +255,7 @@ const _Queue = Resource("cloudflare::Queue", async function <
     remote: props.dev?.remote ?? false,
   };
   if (this.scope.local && !props.dev?.remote) {
-    return this({
+    return {
       type: "queue",
       id: this.output?.id ?? "",
       name: queueName,
@@ -265,7 +264,7 @@ const _Queue = Resource("cloudflare::Queue", async function <
       modifiedOn: this.output?.modifiedOn ?? new Date().toISOString(),
       Body: undefined as T,
       Batch: undefined! as MessageBatch<T>,
-    });
+    };
   }
 
   const api = await createCloudflareApi(props);
@@ -320,7 +319,7 @@ const _Queue = Resource("cloudflare::Queue", async function <
     }
   }
 
-  return this({
+  return {
     type: "queue",
     id: queueData.result.queue_id || "",
     name: queueName,
@@ -340,7 +339,7 @@ const _Queue = Resource("cloudflare::Queue", async function <
     // phantom properties
     Body: undefined as T,
     Batch: undefined! as MessageBatch<T>,
-  });
+  };
 });
 
 interface CloudflareQueueResponse {

package/src/cloudflare/react-router/plugin.ts

@@ -1,7 +1,27 @@
 import type { PluginConfig } from "@cloudflare/vite-plugin";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { getDefaultConfigPath } from "../miniflare/paths.ts";
 import alchemyVite from "../vite/plugin.ts";
 
 const alchemy = (config?: PluginConfig) => {
+  const configPath = config?.configPath ?? getDefaultConfigPath();
+  // react-router type generation requries a wrangler.json and creates a chicken and egg problem
+  // we create a dummy wrangler.json file so that clean builds can be performed
+  if (!existsSync(configPath)) {
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        {
+          name: "dummy",
+          compatibility_date: "2025-09-23",
+        },
+        null,
+        2,
+      ),
+    );
+  }
   return alchemyVite({
     ...config,
     viteEnvironment: {

package/src/cloudflare/redirect-rule.ts

@@ -94,7 +94,7 @@ interface CloudflareRule {
 /**
  * Output returned after RedirectRule creation/update
  */
-export interface RedirectRule extends Resource<"cloudflare::RedirectRule"> {
+export interface RedirectRule {
   /**
    * The ID of the redirect rule
    */
@@ -263,7 +263,7 @@ export const RedirectRule = Resource(
         },
       );
 
-      return this({
+      return {
         ruleId: updatedRule.id,
         rulesetId: this.output.rulesetId,
         zoneId,
@@ -274,7 +274,7 @@ export const RedirectRule = Resource(
         preserveQueryString,
         enabled: updatedRule.enabled ?? true,
         lastUpdated: updatedRule.last_updated,
-      });
+      };
     }
 
     // Get or create the redirect ruleset for this zone
@@ -288,7 +288,7 @@ export const RedirectRule = Resource(
       preserveQueryString,
     });
 
-    return this({
+    return {
       ruleId: createdRule.id,
       rulesetId,
       zoneId,
@@ -299,7 +299,7 @@ export const RedirectRule = Resource(
       preserveQueryString,
       enabled: createdRule.enabled ?? true,
       lastUpdated: createdRule.last_updated,
-    });
+    };
   },
 );
 

package/src/cloudflare/route.ts

@@ -62,7 +62,7 @@ export interface RouteProps extends CloudflareApiOptions {
 /**
  * Output returned after Route creation/update
  */
-export interface Route extends Resource<"cloudflare::Route">, RouteProps {
+export interface Route extends RouteProps {
   /**
    * The unique ID of the route
    */
@@ -166,12 +166,12 @@ export const Route = Resource(
         zoneId = this.output?.zoneId ?? "noop-zone";
       }
 
-      return this({
+      return {
         id: this.output?.id ?? "noop-route",
         pattern: props.pattern,
         script: scriptName,
         zoneId: zoneId,
-      });
+      };
     }
 
     // Get or infer zone ID (only needed for create/update phases)
@@ -247,12 +247,12 @@ export const Route = Resource(
     }
 
     // Return the route resource
-    return this({
+    return {
       id: routeData.result.id,
       pattern: routeData.result.pattern,
       script: routeData.result.script,
       zoneId,
-    });
+    };
   },
 );
 

package/src/cloudflare/ruleset.ts

@@ -46,8 +46,7 @@ export interface RulesetProps<Phase extends RulePhase>
 /**
  * Output returned after Ruleset creation/update
  */
-export interface Ruleset<Phase extends RulePhase>
-  extends Resource<"cloudflare::Ruleset"> {
+export interface Ruleset<Phase extends RulePhase> {
   /**
    * The ID of the ruleset
    */
@@ -185,7 +184,7 @@ export const Ruleset = Resource("cloudflare::Ruleset", async function <
   });
 
   // Transform response back to our format
-  return this({
+  return {
     id: result.id,
     zoneId,
     phase: props.phase,
@@ -194,7 +193,7 @@ export const Ruleset = Resource("cloudflare::Ruleset", async function <
     rules: (result.rules as Array<Rule> | undefined) ?? [],
     lastUpdated: result.last_updated,
     version: result.version,
-  });
+  };
 });
 
 interface CloudflareApiRuleset {

package/src/cloudflare/secret-ref.ts

@@ -0,0 +1,56 @@
+import { createCloudflareApi, type CloudflareApiOptions } from "./api.ts";
+import { findSecretsStoreByName, SecretsStore } from "./secrets-store.ts";
+
+/**
+ * Properties for referencing an existing Secret in a Secrets Store (without managing its value)
+ */
+export interface SecretRefProps extends CloudflareApiOptions {
+  name: string;
+  store?: SecretsStore;
+}
+
+export type SecretRef = {
+  type: "secrets_store_secret";
+  name: string;
+  storeId: string;
+};
+
+/**
+ * SecretRef references an existing secret by name in a Secrets Store.
+ *
+ * It does not create or update the secret value – use {@link Secret} for that.
+ *
+ * Behavior:
+ * - Resolves the target secrets store ID (defaults to Cloudflare's `default_secrets_store`, creating/adopting if needed)
+ * - Exposes a binding of type `secrets_store_secret` usable in Worker bindings
+ * - Update with a different name will trigger resource replacement
+ * - Delete is a no-op in Cloudflare (resource removed from state only)
+ *
+ * @example
+ * // Reference an existing secret in the default store and bind to a Worker
+ * const apiKeyRef = await SecretRef("api-key-ref", { name: "API_KEY" });
+ * const worker = await Worker("my-worker", {
+ *   entrypoint: "./src/worker.ts",
+ *   url: true,
+ *   bindings: {
+ *     API_KEY: apiKeyRef,
+ *   },
+ * });
+ */
+export async function SecretRef(props: SecretRefProps): Promise<SecretRef> {
+  const api = await createCloudflareApi(props);
+
+  const storeId =
+    props.store?.id ??
+    (await findSecretsStoreByName(api, SecretsStore.Default))?.id;
+
+  if (!storeId) {
+    throw new Error(`Secrets store ${SecretsStore.Default} not found`);
+  }
+
+  return {
+    type: "secrets_store_secret",
+    name: props.name,
+    storeId,
+  };
+}