alchemy 0.69.1 → 0.70.1

package/src/cloudflare/bun-spa/bun-spa.ts

@@ -0,0 +1,136 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { Scope } from "../../scope.ts";
+import { exists } from "../../util/exists.ts";
+import type { Assets } from "../assets.ts";
+import type { Bindings } from "../bindings.ts";
+import {
+  extractStringAndSecretBindings,
+  unencryptSecrets,
+} from "../util/filter-env-bindings.ts";
+import {
+  spreadBuildProps,
+  spreadDevProps,
+  Website,
+  type WebsiteProps,
+} from "../website.ts";
+
+export interface BunSPAProps<B extends Bindings> extends WebsiteProps<B> {
+  frontend: string;
+  outDir?: string;
+}
+
+export type BunSPA<B extends Bindings> = Website<B> & { apiUrl: string };
+
+export async function BunSPA<B extends Bindings>(
+  id: string,
+  props: BunSPAProps<B>,
+): Promise<BunSPA<B> & { apiUrl: string }> {
+  const frontendPath = path.resolve(props.frontend);
+  if (!(await exists(frontendPath))) {
+    throw new Error(`Frontend path ${frontendPath} does not exist`);
+  }
+
+  const stats = await fs.stat(frontendPath);
+  if (!stats.isFile()) {
+    throw new Error(`Frontend path ${frontendPath} is not a file`);
+  }
+  const outDir = path.resolve(props.outDir ?? "dist/client");
+
+  if (props.assets) {
+    throw new Error("assets are not supported in BunSPA");
+  }
+
+  const scope = Scope.current;
+  console.log("creating website", outDir);
+  const website = await Website(id, {
+    spa: true,
+    ...props,
+    bindings: {
+      ...props.bindings,
+      // set NODE_ENV in worker appropriately if not already set
+      NODE_ENV:
+        (props.bindings?.NODE_ENV ?? scope.local)
+          ? "development"
+          : "production",
+    } as unknown as B,
+    assets: {
+      directory: path.resolve(outDir),
+    },
+    build: spreadBuildProps(
+      props,
+      `bun build '${frontendPath}' --outdir ${outDir}`,
+    ),
+  });
+
+  let apiUrl = website.url!;
+  // in dev
+  if (scope.local) {
+    const cwd = props.cwd ?? process.cwd();
+    await validateBunfigToml(cwd);
+    const dev = spreadDevProps(
+      props,
+      `bun '${path.relative(cwd, frontendPath)}'`,
+    );
+    const secrets = props.wrangler?.secrets ?? !props.wrangler?.path;
+    const env = {
+      ...(process.env ?? {}),
+      ...(props.env ?? {}),
+      ...extractStringAndSecretBindings(props.bindings ?? {}, secrets),
+    };
+    website.url = await scope.spawn(website.name, {
+      cmd: typeof dev === "string" ? dev : dev.command!,
+      cwd,
+      extract: (line) => {
+        const URL_REGEX =
+          /http:\/\/(localhost|0\.0\.0\.0|127\.0\.0\.1|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):\d+\/?/;
+        const match = line
+          .replace(/\x1B\[[0-9;]*[a-zA-Z]/g, "")
+          .match(URL_REGEX);
+        if (match) {
+          return match[0];
+        }
+      },
+      env: {
+        ...unencryptSecrets(env ?? {}),
+        ...(typeof dev === "object" ? dev.env : {}),
+        FORCE_COLOR: "1",
+        ...process.env,
+        NODE_ENV: "development",
+        ALCHEMY_ROOT: Scope.current.rootDir,
+        PUBLIC_BACKEND_URL: apiUrl,
+      },
+    });
+  }
+  return { ...website, apiUrl } as BunSPA<B>;
+}
+
+async function validateBunfigToml(cwd: string): Promise<void> {
+  const bunfigPath = path.join(cwd, "bunfig.toml");
+
+  if (!(await exists(bunfigPath))) {
+    throw new Error(
+      "bunfig.toml is required for BunSPA to work correctly.\n\n" +
+        `Create ${bunfigPath} with the following content:\n\n` +
+        "[serve.static]\n" +
+        `env='PUBLIC_*'\n\n` +
+        "This allows Bun to expose PUBLIC_* environment variables to the frontend during development.",
+    );
+  }
+
+  const content = await fs.readFile(bunfigPath, "utf-8");
+  const config = Bun.TOML.parse(content) as Record<string, any>;
+
+  const hasServeStatic = config.serve?.static;
+  const hasEnvConfig = hasServeStatic && config.serve.static.env === "PUBLIC_*";
+
+  if (!hasServeStatic || !hasEnvConfig) {
+    throw new Error(
+      "bunfig.toml is missing required configuration for BunSPA.\n\n" +
+        `Add the following section to ${bunfigPath}:\n\n` +
+        "[serve.static]\n" +
+        `env='PUBLIC_*'\n\n` +
+        "This allows Bun to expose PUBLIC_* environment variables to the frontend during development.",
+    );
+  }
+}

package/src/cloudflare/compatibility-date.gen.ts

@@ -4,4 +4,4 @@
 /**
  * The default Cloudflare Workers compatibility date, set based on the latest workerd release at the time of build.
  */
-export const DEFAULT_COMPATIBILITY_DATE = "2025-09-27";
+export const DEFAULT_COMPATIBILITY_DATE = "2025-10-01";

package/src/cloudflare/container.ts

@@ -93,9 +93,28 @@ export interface ContainerProps
  * - `basic`: Basic production instances with standard resources
  * - `standard`: Standard production instances with enhanced resources
  *
+ * | Instance Type  | vCPU | Memory (Min) | Memory (Max) |
+ * |---------------|------|--------------|--------------|
+ * | lite          | 1/16 | 256 MiB      | 2 GB         |
+ * | basic         | 1/4  | 1 GiB        | 4 GB         |
+ * | standard-1    | 1/2  | 4 GiB        | 8 GB         |
+ * | standard-2    | 1    | 6 GiB        | 12 GB        |
+ * | standard-3    | 2    | 8 GiB        | 16 GB        |
+ * | standard-4    | 4    | 12 GiB       | 20 GB        |
+ *
  * @see https://developers.cloudflare.com/containers/pricing/
+ * @see https://developers.cloudflare.com/changelog/2025-10-01-new-container-instance-types/
  */
-export type InstanceType = "dev" | "basic" | "standard" | (string & {});
+export type InstanceType =
+  | "lite"
+  | "dev"
+  | "basic"
+  | "standard"
+  | "standard-1"
+  | "standard-2"
+  | "standard-3"
+  | "standard-4"
+  | (string & {});
 
 /**
  * Type guard to check if a binding is a Container binding.

package/src/cloudflare/index.ts

@@ -15,6 +15,7 @@ export * from "./bound.ts";
 export * from "./browser-rendering.ts";
 export * from "./bucket-object.ts";
 export * from "./bucket.ts";
+export * from "./bun-spa/bun-spa.ts";
 export * from "./certificate-pack.ts";
 export * from "./cloudflare-env-proxy.ts";
 export * from "./compatibility-date.gen.ts";

package/src/cloudflare/miniflare/build-worker-options.ts

@@ -1,6 +1,7 @@
 import * as miniflare from "miniflare";
 import { assertNever } from "../../util/assert-never.ts";
 import type { HTTPServer } from "../../util/http.ts";
+import { logger } from "../../util/logger.ts";
 import type { CloudflareApi } from "../api.ts";
 import type {
   Binding,
@@ -52,7 +53,9 @@ type RemoteBinding =
   | WorkerBindingService;
 
 type BaseWorkerOptions = {
-  [K in keyof miniflare.WorkerOptions]: K extends "compatibilityFlags"
+  [K in keyof miniflare.WorkerOptions]: K extends
+    | "compatibilityFlags"
+    | "routes"
     ? miniflare.WorkerOptions[K]
     : Exclude<miniflare.WorkerOptions[K], string[]>;
 };
@@ -70,21 +73,18 @@ export const buildWorkerOptions = async (
     compatibilityFlags: input.compatibilityFlags,
     unsafeDirectSockets: [
       // This matches the Wrangler configuration by exposing the default handler (e.g. `export default { fetch }`).
-      // However, unlike Wrangler, we set `proxy: false` to avoid the following error when connecting via a websocket:
-      // workerd/io/worker.c++:2164: info: uncaught exception; source = Uncaught (in promise); stack = TypeError: Invalid URL string.
       {
         entrypoint: "default",
-        proxy: false,
+        proxy: true,
       },
     ],
     containerEngine: {
       localDocker: {
-        socketPath:
-          process.platform === "win32"
-            ? "//./pipe/docker_engine"
-            : "unix:///var/run/docker.sock",
+        socketPath: await getDockerSocketPath(),
       },
     },
+    // This exposes the worker as a route that can be accessed by setting the MF-Route-Override header.
+    routes: [input.name],
   };
   for (const [key, binding] of Object.entries(input.bindings ?? {})) {
     if (typeof binding === "string") {
@@ -478,3 +478,33 @@ const isRemoteBinding = (binding: Binding) => {
     !!binding.dev.remote
   );
 };
+
+/**
+ * DOCKER_HOST env is standardized
+ * docker has an option to expose on tcp://localhost:2375; so we check 2375 if the user has it enabled
+ * the pipe on windows doesn't work half the time(even though the pipe exists). This seems like a strange error on how miniflare parses the pipe
+ * @returns The Docker path
+ */
+async function getDockerSocketPath() {
+  if (process.env.DOCKER_HOST) {
+    return process.env.DOCKER_HOST;
+  }
+  // Check if docker is running on tcp://localhost:2375 using fetch
+  try {
+    const url = "http://localhost:2375/_ping";
+    const res = await fetch(url, { method: "GET" });
+    if (res.ok) {
+      const text = await res.text();
+      if (text.trim() === "OK") {
+        return "localhost:2375";
+      }
+    }
+  } catch {}
+  if (process.platform === "win32") {
+    logger.warn(
+      "Using the pipe on Windows is unstable. If you have issues, try setting DOCKER_HOST or enabling 'Expose daemon on tcp://localhost:2375 without TLS' in docker desktop",
+    );
+    return "//./pipe/docker_engine";
+  }
+  return "unix:///var/run/docker.sock";
+}

package/src/cloudflare/miniflare/miniflare-controller.ts

@@ -104,6 +104,8 @@ export class MiniflareController {
         // This is required to allow websites and other separate processes
         // to detect Alchemy-managed Durable Objects via the Wrangler dev registry.
         unsafeDevRegistryDurableObjectProxy: true,
+        // This exposes other handlers like `scheduled` and `email` via HTTP.
+        unsafeTriggerHandlers: true,
       };
       for (const worker of this.options.values()) {
         options.workers.push(worker);

package/src/cloudflare/miniflare/miniflare-worker-proxy.ts

@@ -13,7 +13,7 @@ export interface MiniflareWorkerProxy {
 export async function createMiniflareWorkerProxy(options: {
   port: number;
   transformRequest?: (request: RequestInfo) => void;
-  getWorkerName: (request: miniflare.Request) => string;
+  getWorkerName: (request: RequestInfo) => string;
   miniflare: miniflare.Miniflare;
   mode: "local" | "remote";
 }) {
@@ -45,71 +45,50 @@ export async function createMiniflareWorkerProxy(options: {
   const handleFetch = async (
     req: http.IncomingMessage,
   ): Promise<miniflare.Response> => {
-    const { request, url } = toMiniflareRequest(req);
-    const name = options.getWorkerName(request);
-    const worker = await options.miniflare.getWorker(name);
+    const info = parseIncomingMessage(req);
+    options.transformRequest?.(info);
+
+    const name = options.getWorkerName(info);
+    info.headers.set("MF-Route-Override", name);
 
-    // Handle scheduled events
+    // Handle scheduled events.
+    // Wrangler exposes this as /__scheduled, but Miniflare exposes it as /cdn-cgi/handler/scheduled.
     // https://developers.cloudflare.com/workers/runtime-apis/handlers/scheduled/#background
     // https://github.com/cloudflare/workers-sdk/blob/7d53b9ab6b370944b7934ad51ebef43160c3c775/packages/wrangler/templates/middleware/middleware-scheduled.ts#L6
-    if (url.pathname === "/__scheduled") {
-      await worker.scheduled({
-        scheduledTime: new Date(),
-        cron: url.searchParams.get("cron") ?? undefined,
-      });
-      return new miniflare.Response("Ran scheduled function");
+    if (info.url.pathname === "/__scheduled") {
+      info.url.pathname = "/cdn-cgi/handler/scheduled";
     }
 
-    const result = await worker
-      .fetch(request)
-      .then((response) => ({ success: true, response }) as const)
-      .catch((error) => ({ success: false, error }) as const);
-
-    // If you open the `/__scheduled` page in a browser, the browser will automatically make a request to `/favicon.ico`.
-    // For scheduled Workers _without_ a fetch handler, this will result in an unhelpful error that we don't need to log.
-    // To avoid this, inject a 404 response to favicon.ico loads on the `/__scheduled` page
-    if (
-      request.headers.get("referer")?.endsWith("/__scheduled") &&
-      url.pathname === "/favicon.ico" &&
-      !result.success
-    ) {
-      return new miniflare.Response(null, { status: 404 });
-    }
-
-    if (!result.success) {
-      throw result.error;
-    }
-
-    return result.response;
-  };
-
-  const toMiniflareRequest = (
-    req: http.IncomingMessage,
-  ): { request: miniflare.Request; url: URL } => {
-    const info = parseIncomingMessage(req);
-    options.transformRequest?.(info);
-    return {
-      request: new miniflare.Request(info.url, {
-        method: info.method,
-        headers: info.headers,
-        body: info.body,
-        redirect: info.redirect,
-        duplex: info.duplex,
-      }),
-      url: info.url,
-    };
+    const request = new miniflare.Request(info.url, {
+      method: info.method,
+      headers: info.headers,
+      body: info.body,
+      redirect: info.redirect,
+      duplex: info.duplex,
+    });
+    return await options.miniflare.dispatchFetch(request);
   };
 
   const createServerWebSocket = async (req: http.IncomingMessage) => {
-    const { request } = toMiniflareRequest(req);
-    const name = options.getWorkerName(request);
-    const target = await options.miniflare.unsafeGetDirectURL(name);
+    // Rewrite to Miniflare entry URL
+    const target = await options.miniflare.ready;
     const url = new URL(req.url ?? "/", target);
     url.protocol = url.protocol.replace("http", "ws");
+
     const protocols = req.headers["sec-websocket-protocol"]
       ?.split(",")
       .map((p) => p.trim());
-    const server = new WebSocket(url, protocols);
+
+    // Get worker name to set MF-Route-Override header
+    const info = parseIncomingMessage(req);
+    options.transformRequest?.(info);
+    const name = options.getWorkerName(info);
+
+    const server = new WebSocket(url, protocols, {
+      headers: {
+        "MF-Route-Override": name,
+      },
+    });
     await once(server, "open");
     return server;
   };
@@ -121,10 +100,8 @@ export async function createMiniflareWorkerProxy(options: {
   return {
     url,
     close: async () => {
-      await Promise.all([
-        new Promise((resolve) => server.close(resolve)),
-        new Promise((resolve) => wss.close(resolve)),
-      ]);
+      // If we await this while the `wss` server is open, the server will hang.
+      server.close();
     },
   };
 }
@@ -172,7 +149,13 @@ const writeMiniflareResponseToNode = (
 ) => {
   out.statusCode = res.status;
   res.headers.forEach((value, key) => {
-    out.setHeader(key, value);
+    // The `transfer-encoding` header prevents Cloudflare Tunnels from working because of the following error:
+    // Request failed error="Unable to reach the origin service. The service may be down or it may not be
+    // responding to traffic from cloudflared: net/http: HTTP/1.x transport connection broken: too many
+    // transfer encodings: [\"chunked\" \"chunked\"]"
+    if (key !== "transfer-encoding") {
+      out.setHeader(key, value);
+    }
   });
 
   if (res.body) {

package/src/cloudflare/permission-groups.ts

@@ -1,5 +1,5 @@
-import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
+import { extractCloudflareResult } from "./api-response.ts";
 import { createCloudflareApi, type CloudflareApiOptions } from "./api.ts";
 
 /**
@@ -22,16 +22,6 @@ export interface PermissionGroup {
   scopes: string[];
 }
 
-/**
- * Response from the Cloudflare permission groups API
- */
-interface PermissionGroupsResponse {
-  result: PermissionGroup[];
-  success: boolean;
-  errors: any[];
-  messages: any[];
-}
-
 export type PermissionGroupName = R2PermissionGroups | (string & {});
 
 export type R2PermissionGroups =
@@ -86,7 +76,7 @@ export type PermissionGroups = {
  *
  * @example
  * // Get all permission groups including those for R2
- * const permissions = await PermissionGroups("cloudflare-permissions");
+ * const permissions = await PermissionGroups();
  *
  * // Use with AccountApiToken to create a token with proper permissions
  * const token = await AccountApiToken("r2-token", {
@@ -106,42 +96,24 @@ export type PermissionGroups = {
  *   ]
  * });
  */
-export const PermissionGroups = Resource(
-  "cloudflare::PermissionGroups",
-  async function (
-    this: Context<PermissionGroups>,
-    _id: string,
-    options: CloudflareApiOptions = {},
-  ): Promise<PermissionGroups> {
-    // Only create and update phases are supported
-    if (this.phase === "delete") {
-      return this.destroy();
-    }
-
-    // Initialize API client
-    const api = await createCloudflareApi(options);
-
-    // Fetch permission groups from Cloudflare API
-    const response = await api.get(
-      `/accounts/${api.accountId}/tokens/permission_groups`,
-    );
-
-    if (!response.ok) {
-      throw new Error(
-        `Failed to fetch permission groups: ${response.statusText}`,
-      );
-    }
-
-    const data = (await response.json()) as PermissionGroupsResponse;
+export async function PermissionGroups(
+  options: CloudflareApiOptions = {},
+): Promise<PermissionGroups> {
+  const api = await createCloudflareApi(options);
+  const result = await extractCloudflareResult<PermissionGroup[]>(
+    "fetch permission groups",
+    api.get(`/accounts/${api.accountId}/tokens/permission_groups`),
+  );
+  return Object.fromEntries(
+    result.map((group) => [group.name, group]),
+  ) as PermissionGroups;
+}
 
-    if (!data.success || !data.result) {
-      throw new Error(
-        `API returned error: ${data.errors?.[0]?.message || "Unknown error"}`,
-      );
-    }
+// we are deprecating the PermissionGroups resource (it is now just a function)
+Resource("cloudflare::PermissionGroups", async function (this) {
+  if (this.phase === "delete") {
+    return this.destroy();
+  }
 
-    return Object.fromEntries(
-      data.result.map((group) => [group.name, group]),
-    ) as PermissionGroups;
-  },
-);
+  throw new Error("Not implemented");
+});

package/src/cloudflare/redwood/redwood.ts

@@ -12,7 +12,7 @@ export type Redwood<B extends Bindings> = B extends { ASSETS: any }
   : Worker<B & { ASSETS: Assets }>;
 
 /**
- * Deploy a RedwoodJS application to Cloudflare Pages with automatically configured defaults.
+ * Deploy a RedwoodJS application to Cloudflare Workers with automatically configured defaults.
  *
  * This resource handles the deployment of RedwoodJS applications with optimized settings for
  * Cloudflare Workers, including proper build commands and compatibility flags.

package/src/cloudflare/util/filter-env-bindings.ts

@@ -0,0 +1,96 @@
+import { isSecret, type Secret } from "../../secret.ts";
+import type { Bindings } from "../bindings.ts";
+
+/**
+ * Extract string and Secret bindings from a Bindings object
+ *
+ * This utility filters a Bindings object to return only string values
+ * and optionally Secret objects. All other binding types (workers, KV, R2, etc.)
+ * are excluded from the result.
+ *
+ * @param bindings - The bindings object to filter
+ * @param includeSecrets - Whether to include Secret objects in the result
+ * @returns A record containing only string values and Secret objects (if includeSecrets is true)
+ *
+ * @example
+ * ```typescript
+ * const filtered = extractStringAndSecretBindings(props.bindings, true);
+ * // Returns: { API_KEY: Secret(...), DEBUG: "true" }
+ * // Excludes: { CACHE: KVNamespace, STORAGE: R2Bucket }
+ * ```
+ */
+export function extractStringAndSecretBindings(
+  bindings: Bindings,
+  includeSecrets: boolean,
+): Record<string, string | Secret> {
+  return Object.fromEntries(
+    Object.entries(bindings ?? {}).flatMap(([key, value]) => {
+      if (typeof value === "string" || (isSecret(value) && includeSecrets)) {
+        return [[key, value]];
+      }
+      return [];
+    }),
+  );
+}
+
+/**
+ * Unencrypt all Secret values in an environment object
+ *
+ * Takes a record that may contain Secret objects and returns a new record
+ * with all Secret values replaced by their unencrypted string values.
+ * Non-Secret values are passed through unchanged. Undefined values are filtered out.
+ *
+ * @param env - The environment object that may contain Secret values
+ * @returns A new record with all Secrets replaced by their unencrypted values
+ *
+ * @example
+ * ```typescript
+ * const env = { API_KEY: Secret("abc123"), DEBUG: "true" };
+ * const unencrypted = unencryptSecrets(env);
+ * // Returns: { API_KEY: "abc123", DEBUG: "true" }
+ * ```
+ */
+export function unencryptSecrets(
+  env: Record<string, string | Secret | undefined>,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(env ?? {}).flatMap(([key, value]) => {
+      if (isSecret(value)) {
+        return [[key, value.unencrypted]];
+      }
+      if (typeof value === "string") {
+        return [[key, value]];
+      }
+      return [];
+    }),
+  );
+}
+
+/**
+ * Filter bindings to strings and unencrypt secrets in one operation
+ *
+ * This is a convenience function that combines extractStringAndSecretBindings
+ * and unencryptSecrets. It filters bindings to strings/secrets and immediately
+ * unencrypts any Secret values.
+ *
+ * Useful for preparing environment variables for dev/build commands where
+ * secrets need to be decrypted and all resource bindings need to be excluded.
+ *
+ * @param bindings - The bindings object to filter
+ * @param includeSecrets - Whether to include (and unencrypt) Secret objects
+ * @returns A record containing only string values with all secrets unencrypted
+ *
+ * @example
+ * ```typescript
+ * const env = filterStringBindings(props.bindings, true);
+ * // Input: { API_KEY: Secret("abc"), DEBUG: "true", CACHE: KVNamespace }
+ * // Returns: { API_KEY: "abc", DEBUG: "true" }
+ * ```
+ */
+export function filterStringBindings(
+  bindings: Bindings,
+  includeSecrets: boolean,
+): Record<string, string> {
+  const extracted = extractStringAndSecretBindings(bindings, includeSecrets);
+  return unencryptSecrets(extracted);
+}