alchemy 0.76.0 → 0.77.0

package/src/cloudflare/bucket-custom-domain.ts

@@ -0,0 +1,281 @@
+import type { Context } from "../context";
+import { Resource } from "../resource";
+import { diff } from "../util/diff";
+import {
+  CloudflareApi,
+  createCloudflareApi,
+  type CloudflareApiOptions,
+} from "./api";
+import { CloudflareApiError } from "./api-error";
+import { extractCloudflareResult } from "./api-response";
+import { withJurisdiction, type R2BucketJurisdiction } from "./bucket";
+import { inferZoneIdFromPattern } from "./route";
+import type { Zone } from "./zone";
+
+export interface R2BucketCustomDomainProps
+  extends CloudflareApiOptions,
+    R2BucketCustomDomainOptions {
+  /**
+   * The bucket to attach the domain to.
+   */
+  bucketName: string;
+
+  /**
+   * The jurisdiction of the bucket.
+   * @default "default"
+   */
+  jurisdiction?: R2BucketJurisdiction;
+
+  /**
+   * Development mode properties
+   * @internal
+   */
+  dev?: {
+    remote?: boolean;
+  };
+}
+
+export interface R2BucketCustomDomainOptions {
+  /**
+   * The domain name to attach to the bucket.
+   */
+  domain: string;
+
+  /**
+   * Whether the domain is enabled.
+   * @default true
+   */
+  enabled?: boolean;
+
+  /**
+   * The zone to attach the domain to.
+   */
+  zone?: string | Zone;
+
+  /**
+   * An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.
+   */
+  ciphers?: string[];
+
+  /**
+   * The minimum TLS version to support.
+   */
+  minTLS?: "1.0" | "1.1" | "1.2" | "1.3" | (string & {});
+
+  /**
+   * Whether to adopt an existing custom domain binding during creation.
+   * If false and the domain already exists, creation will fail.
+   * This only applies during the create phase.
+   * @default false
+   */
+  adopt?: boolean;
+
+  /**
+   * Whether to delete the custom domain binding during deletion.
+   * If false, the custom domain binding will remain but the resource will be removed from state
+   * @default true
+   */
+  delete?: boolean;
+}
+
+export type R2BucketCustomDomain = {
+  /**
+   * The domain name.
+   */
+  domain: string;
+  /**
+   * Whether the domain is enabled.
+   */
+  enabled: boolean;
+  /**
+   * The zone ID.
+   */
+  zoneId: string;
+  /**
+   * The ciphers to support.
+   */
+  ciphers?: string[];
+  /**
+   * The minimum TLS version to support.
+   */
+  minTLS?: "1.0" | "1.1" | "1.2" | "1.3" | (string & {});
+};
+
+export const R2BucketCustomDomain = Resource(
+  "cloudflare::R2BucketCustomDomain",
+  async function (
+    this: Context<R2BucketCustomDomain>,
+    _id: string,
+    props: R2BucketCustomDomainProps,
+  ): Promise<R2BucketCustomDomain> {
+    if (this.scope.local && !props.dev?.remote && this.phase !== "delete") {
+      return {
+        domain: props.domain,
+        enabled: props.enabled ?? false,
+        zoneId:
+          typeof props.zone === "string"
+            ? props.zone
+            : (props.zone?.id ?? "noop-zone"),
+        ciphers: props.ciphers,
+        minTLS: props.minTLS,
+      };
+    }
+    const adopt = props.adopt ?? this.scope.adopt;
+    const api = await createCloudflareApi(props);
+    const payload: R2BucketCustomDomain = {
+      domain: props.domain,
+      enabled: props.enabled ?? true,
+      zoneId:
+        typeof props.zone === "string"
+          ? props.zone
+          : (props.zone?.id ??
+            (await inferZoneIdFromPattern(api, props.domain))),
+      ciphers: props.ciphers,
+      minTLS: props.minTLS,
+    };
+    switch (this.phase) {
+      case "create": {
+        await createBucketCustomDomain(
+          api,
+          props.bucketName,
+          props.jurisdiction,
+          payload,
+        ).catch(async (error) => {
+          if (
+            error instanceof CloudflareApiError &&
+            error.status === 409 &&
+            adopt
+          ) {
+            return await updateBucketCustomDomain(
+              api,
+              props.bucketName,
+              props.jurisdiction,
+              payload,
+            );
+          }
+          throw error;
+        });
+        return payload;
+      }
+      case "update": {
+        if (
+          diff(this.output, payload).some(
+            (property) => property === "domain" || property === "zoneId",
+          )
+        ) {
+          return this.replace();
+        }
+        await updateBucketCustomDomain(
+          api,
+          props.bucketName,
+          props.jurisdiction,
+          payload,
+        );
+        return payload;
+      }
+      case "delete": {
+        if (props.delete !== false) {
+          await deleteBucketCustomDomain(
+            api,
+            props.bucketName,
+            props.domain,
+            props.jurisdiction,
+          );
+        }
+        return this.destroy();
+      }
+    }
+  },
+);
+
+async function createBucketCustomDomain(
+  api: CloudflareApi,
+  bucket: string,
+  jurisdiction: R2BucketJurisdiction | undefined,
+  payload: R2BucketCustomDomain,
+) {
+  return await extractCloudflareResult(
+    `create custom domain for bucket "${bucket}"`,
+    api.post(
+      `/accounts/${api.accountId}/r2/buckets/${bucket}/domains/custom`,
+      payload,
+      { headers: withJurisdiction({ jurisdiction }) },
+    ),
+  );
+}
+
+async function updateBucketCustomDomain(
+  api: CloudflareApi,
+  bucket: string,
+  jurisdiction: R2BucketJurisdiction | undefined,
+  payload: R2BucketCustomDomain,
+) {
+  return await extractCloudflareResult(
+    `update custom domain for bucket "${bucket}"`,
+    api.put(
+      `/accounts/${api.accountId}/r2/buckets/${bucket}/domains/custom/${encodeURIComponent(payload.domain)}`,
+      payload,
+      { headers: withJurisdiction({ jurisdiction }) },
+    ),
+  );
+}
+
+export async function deleteBucketCustomDomain(
+  api: CloudflareApi,
+  bucket: string,
+  domain: string,
+  jurisdiction: R2BucketJurisdiction | undefined,
+) {
+  return await extractCloudflareResult(
+    `delete custom domain for bucket "${bucket}"`,
+    api.delete(
+      `/accounts/${api.accountId}/r2/buckets/${bucket}/domains/custom/${encodeURIComponent(domain)}`,
+      { headers: withJurisdiction({ jurisdiction }) },
+    ),
+  ).catch((error) => {
+    if (!(error instanceof CloudflareApiError && error.status === 404)) {
+      throw error;
+    }
+  });
+}
+
+export async function getBucketCustomDomain(
+  api: CloudflareApi,
+  bucket: string,
+  domain: string,
+  jurisdiction: R2BucketJurisdiction | undefined,
+) {
+  return await extractCloudflareResult<
+    R2BucketCustomDomain & {
+      zoneName?: string;
+      status: {
+        ownership:
+          | "pending"
+          | "active"
+          | "deactivated"
+          | "blocked"
+          | "error"
+          | "unknown";
+        ssl:
+          | "initializing"
+          | "pending"
+          | "active"
+          | "deactivated"
+          | "error"
+          | "unknown";
+      };
+    }
+  >(
+    `get custom domain for bucket "${bucket}"`,
+    api.get(
+      `/accounts/${api.accountId}/r2/buckets/${bucket}/domains/custom/${encodeURIComponent(domain)}`,
+      {
+        headers: withJurisdiction({ jurisdiction }),
+      },
+    ),
+  ).catch((error) => {
+    if (!(error instanceof CloudflareApiError && error.status === 404)) {
+      throw error;
+    }
+  });
+}

package/src/cloudflare/bucket.ts

@@ -17,6 +17,10 @@ import {
   type CloudflareApi,
   type CloudflareApiOptions,
 } from "./api.ts";
+import {
+  R2BucketCustomDomain,
+  type R2BucketCustomDomainOptions,
+} from "./bucket-custom-domain.ts";
 import { deleteMiniflareBinding } from "./miniflare/delete.ts";
 import { getDefaultPersistPath } from "./miniflare/paths.ts";
 
@@ -56,9 +60,25 @@ export interface BucketProps extends CloudflareApiOptions {
   /**
    * Whether to allow public access through the r2.dev subdomain
    * Only for development purposes - use custom domains for production
+   * @deprecated Use `devDomain` instead
    */
   allowPublicAccess?: boolean;
 
+  /**
+   * Whether to allow public access through the r2.dev subdomain
+   * Only for development purposes - use custom domains for production
+   */
+  devDomain?: boolean;
+
+  /**
+   * The custom domain(s) to attach to the bucket.
+   */
+  domains?:
+    | string
+    | R2BucketCustomDomainOptions
+    | string[]
+    | R2BucketCustomDomainOptions[];
+
   /**
    * Whether to delete the bucket.
    * If set to false, the bucket will remain but the resource will be removed from state
@@ -307,7 +327,10 @@ export type R2Bucket = _R2Bucket & {
 /**
  * Output returned after R2 Bucket creation/update
  */
-type _R2Bucket = Omit<BucketProps, "delete" | "dev"> & {
+type _R2Bucket = Omit<
+  BucketProps,
+  "delete" | "dev" | "domains" | "devDomain"
+> & {
   /**
    * Resource type identifier
    */
@@ -330,8 +353,19 @@ type _R2Bucket = Omit<BucketProps, "delete" | "dev"> & {
 
   /**
    * The `r2.dev` subdomain for the bucket, if `allowPublicAccess` is true
+   * @deprecated Use `devDomain` instead
+   */
+  domain?: string;
+
+  /**
+   * The `r2.dev` subdomain for the bucket, if `devDomain` is true
    */
-  domain: string | undefined;
+  devDomain: string | undefined;
+
+  /**
+   * The custom domains for the bucket, if applicable
+   */
+  domains: string[] | undefined;
 
   /**
    * Development mode properties
@@ -590,10 +624,14 @@ const _R2Bucket = Resource(
       props.name ?? (this.output?.name || this.scope.createPhysicalName(id));
 
     if (this.phase === "update" && this.output?.name !== bucketName) {
-      this.replace();
+      this.replace(
+        // force replacement if custom domain is enabled; otherwise, replace will fail because the bucket has child resources
+        !!this.output.domains?.length,
+      );
     }
 
-    const allowPublicAccess = props.allowPublicAccess === true;
+    const isDevDomainEnabled =
+      props.devDomain === true || props.allowPublicAccess === true;
     const isLocal = this.scope.local && !props.dev?.remote;
     const dev = {
       id: this.output?.dev?.id ?? bucketName,
@@ -602,14 +640,42 @@ const _R2Bucket = Resource(
     } satisfies _R2Bucket["dev"];
     const adopt = props.adopt ?? this.scope.adopt;
 
+    async function createDomains(domain: NonNullable<BucketProps["domains"]>) {
+      return Promise.all(
+        (Array.isArray(domain) ? domain : [domain]).map(async (domain) => {
+          const options: R2BucketCustomDomainOptions =
+            typeof domain === "string"
+              ? { domain, adopt, delete: props.delete }
+              : {
+                  ...domain,
+                  adopt: domain.adopt ?? adopt,
+                  delete: domain.delete ?? props.delete,
+                };
+          const output = await R2BucketCustomDomain(options.domain, {
+            ...options,
+            accountId: props.accountId,
+            apiKey: props.apiKey,
+            apiToken: props.apiToken,
+            email: props.email,
+            baseUrl: props.baseUrl,
+            profile: props.profile,
+            bucketName: bucketName,
+            jurisdiction: props.jurisdiction,
+            dev,
+          });
+          return output.domain;
+        }),
+      );
+    }
+
     if (isLocal) {
       return {
         name: bucketName,
         location: this.output?.location ?? "",
         creationDate: this.output?.creationDate ?? new Date(),
         jurisdiction: this.output?.jurisdiction ?? "default",
-        allowPublicAccess,
-        domain: this.output?.domain,
+        devDomain: this.output?.devDomain ?? this.output?.domain,
+        domains: props.domains ? await createDomains(props.domains) : undefined,
         type: "r2_bucket",
         accountId: this.output?.accountId ?? "",
         cors: props.cors,
@@ -648,10 +714,10 @@ const _R2Bucket = Resource(
           throw err;
         },
       );
-      const domain = await putManagedDomain(
+      const devDomain = await putManagedDomain(
         api,
         bucketName,
-        allowPublicAccess,
+        isDevDomainEnabled,
         props.jurisdiction,
       );
       if (props.cors?.length) {
@@ -673,13 +739,14 @@ const _R2Bucket = Resource(
       if (props.dataCatalog) {
         dataCatalog = await enableDataCatalog(api, bucketName);
       }
+
       return {
         name: bucketName,
         location: bucket.location,
         creationDate: new Date(bucket.creation_date),
         jurisdiction: bucket.jurisdiction,
-        allowPublicAccess,
-        domain,
+        devDomain,
+        domains: props.domains ? await createDomains(props.domains) : undefined,
         type: "r2_bucket",
         accountId: api.accountId,
         lifecycle: props.lifecycle,
@@ -701,12 +768,12 @@ const _R2Bucket = Resource(
       if (!this.output.catalog && props.dataCatalog) {
         this.output.catalog = await enableDataCatalog(api, bucketName);
       }
-      let domain = this.output.domain;
-      if (!!domain !== allowPublicAccess) {
-        domain = await putManagedDomain(
+      let devDomain = this.output.devDomain ?? this.output.domain;
+      if (!!devDomain !== isDevDomainEnabled) {
+        devDomain = await putManagedDomain(
           api,
           bucketName,
-          allowPublicAccess,
+          isDevDomainEnabled,
           props.jurisdiction,
         );
       }
@@ -723,12 +790,12 @@ const _R2Bucket = Resource(
       }
       return {
         ...this.output,
-        allowPublicAccess,
+        devDomain,
+        domains: props.domains ? await createDomains(props.domains) : undefined,
         dev,
         cors: props.cors,
         lifecycle: props.lifecycle,
         lock: props.lock,
-        domain,
       };
     }
   },
@@ -1087,7 +1154,7 @@ export async function putBucketLifecycleRules(
 export async function getBucketLifecycleRules(
   api: CloudflareApi,
   bucketName: string,
-  props: BucketProps = {},
+  props: { jurisdiction?: string },
 ): Promise<R2BucketLifecycleRule[]> {
   const res = await api.get(
     `/accounts/${api.accountId}/r2/buckets/${bucketName}/lifecycle`,
@@ -1140,7 +1207,7 @@ export async function putBucketLockRules(
 export async function getBucketLockRules(
   api: CloudflareApi,
   bucketName: string,
-  props: BucketProps = {},
+  props: { jurisdiction?: R2BucketJurisdiction },
 ): Promise<R2BucketLockRule[]> {
   const res = await api.get(
     `/accounts/${api.accountId}/r2/buckets/${bucketName}/lock`,

package/src/cloudflare/cloudflare-env-proxy.ts

@@ -39,9 +39,6 @@ export const getPlatformProxyOptions = (
     ...input,
     configPath: validateConfigPath(input.configPath ?? getDefaultConfigPath()),
     persist,
-    experimental: (input as any).experimental ?? {
-      remoteBindings: true,
-    },
   };
 };
 

package/src/cloudflare/compatibility-date.gen.ts

@@ -4,4 +4,4 @@
 /**
  * The default Cloudflare Workers compatibility date, set based on the latest workerd release at the time of build.
  */
-export const DEFAULT_COMPATIBILITY_DATE = "2025-10-14";
+export const DEFAULT_COMPATIBILITY_DATE = "2025-10-31";

package/src/cloudflare/index.ts

@@ -15,6 +15,7 @@ export * from "./astro/astro.ts";
 export * from "./bindings.ts";
 export * from "./bound.ts";
 export * from "./browser-rendering.ts";
+export * from "./bucket-custom-domain.ts";
 export * from "./bucket-object.ts";
 export * from "./bucket.ts";
 export * from "./bun-spa/bun-spa.ts";

package/src/cloudflare/miniflare/build-worker-options.ts

@@ -342,7 +342,9 @@ export const buildWorkerOptions = async (
       const dlq = eventSource.settings?.deadLetterQueue;
       (options.queueConsumers ??= {})[queue.name] = {
         maxBatchSize: eventSource.settings?.batchSize,
-        maxBatchTimeout: eventSource.settings?.maxWaitTimeMs,
+        maxBatchTimeout: eventSource.settings?.maxWaitTimeMs
+          ? eventSource.settings?.maxWaitTimeMs / 1000
+          : undefined,
         maxRetries: eventSource.settings?.maxRetries,
         retryDelay: eventSource.settings?.retryDelay,
         deadLetterQueue: typeof dlq === "string" ? dlq : dlq?.name,

package/src/cloudflare/miniflare/remote-binding-proxy.ts

@@ -1,6 +1,8 @@
 import type { RemoteProxyConnectionString } from "miniflare";
 import { WebSocket } from "ws";
+import { Scope } from "../../scope.ts";
 import { HTTPServer } from "../../util/http.ts";
+import { memoize } from "../../util/memoize.ts";
 import { extractCloudflareResult } from "../api-response.ts";
 import type { CloudflareApi } from "../api.ts";
 import type { WorkerBindingSpec } from "../bindings.ts";
@@ -37,7 +39,7 @@ export async function createRemoteProxyWorker(input: {
   bindings: WorkerBindingSpec[];
 }): Promise<RemoteBindingProxy> {
   const script = await getInternalWorkerBundle("remote-binding-proxy");
-  const [token, subdomain] = await Promise.all([
+  const [token, { host, accessToken }] = await Promise.all([
     createWorkersPreviewToken(input.api, {
       name: input.name,
       metadata: {
@@ -52,18 +54,27 @@ export async function createRemoteProxyWorker(input: {
         minimal_mode: true,
       },
     }),
-    getAccountSubdomain(input.api),
+    getAccountSubdomain(input.api).then(async (subdomain) => {
+      const host = `${input.name}.${subdomain}.workers.dev`;
+      return {
+        host,
+        accessToken: await getAccessToken(host),
+      };
+    }),
   ]);
 
-  const host = `${input.name}.${subdomain}.workers.dev`;
+  const baseHeaders: Record<string, string> = {
+    "cf-workers-preview-token": token,
+    host,
+    ...(accessToken ? { cookie: `CF_Authorization=${accessToken}` } : {}),
+  };
 
   const server = new HTTPServer({
     websocket: async (req) => {
       const input = new URL(req.url);
       const proxied = new URL(input.pathname + input.search, `https://${host}`);
       const headers: Record<string, string> = {
-        "cf-workers-preview-token": token,
-        host,
+        ...baseHeaders,
       };
       // We don't want to include all headers because some can mess with websocket connections.
       // However, it's important to include `mf-` prefixed headers to configure bindings for miniflare to work.
@@ -81,8 +92,9 @@ export async function createRemoteProxyWorker(input: {
       const proxied = new URL(url.pathname + url.search, `https://${host}`);
 
       const headers = new Headers(req.headers);
-      headers.set("cf-workers-preview-token", token);
-      headers.set("host", host);
+      for (const [key, value] of Object.entries(baseHeaders)) {
+        headers.set(key, value);
+      }
       headers.delete("cf-connecting-ip");
 
       const res = await fetch(proxied, {
@@ -146,8 +158,13 @@ async function createWorkersPreviewToken(
 
 async function prewarm(url: string, previewToken: string) {
   try {
+    const accessToken = await getAccessToken(new URL(url).hostname);
     await fetch(url, {
-      headers: { "cf-workers-preview-token": previewToken },
+      method: "POST",
+      headers: {
+        "cf-workers-preview-token": previewToken,
+        ...(accessToken ? { cookie: `CF_Authorization=${accessToken}` } : {}),
+      },
     });
   } catch {
     // Ignore prewarm errors
@@ -162,7 +179,12 @@ async function createWorkersPreviewSession(api: CloudflareApi) {
     "create workers preview session",
     api.get(`/accounts/${api.accountId}/workers/subdomain/edge-preview`),
   );
-  const res = await fetch(exchange_url);
+  const accessToken = await getAccessToken(new URL(exchange_url).hostname);
+  const res = await fetch(exchange_url, {
+    headers: {
+      ...(accessToken ? { cookie: `CF_Authorization=${accessToken}` } : {}),
+    },
+  });
   if (!res.ok) {
     throw new Error(
       `Failed to create workers preview session: ${res.status} ${res.statusText}`,
@@ -171,3 +193,52 @@ async function createWorkersPreviewSession(api: CloudflareApi) {
   const json: WorkersPreviewSession = await res.json();
   return json;
 }
+
+/**
+ * If the given domain uses Cloudflare Access, fetches the access token for the domain.
+ * Otherwise, returns undefined.
+ * @see https://github.com/cloudflare/workers-sdk/blob/a5eb5134f73d3983655d325a4de71c6370c57faa/packages/wrangler/src/user/access.ts#L10
+ */
+const getAccessToken = memoize(async (hostname: string) => {
+  if (!(await domainUsesAccess(hostname))) {
+    return undefined;
+  }
+  const result = await Scope.current
+    .exec(`access-${hostname}`, `cloudflared access login ${hostname}`)
+    .catch(() => {
+      throw new Error(
+        [
+          `The \`cloudflared\` CLI is not installed, but is required to access the domain "${hostname}".`,
+          `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation and run \`cloudflare access login ${hostname}\`.`,
+        ].join("\n"),
+      );
+    });
+  const matches = result.stdout.match(/fetched your token:\n\n(.*)/m);
+  if (matches?.[1]) {
+    return matches[1];
+  }
+  const error = new Error(
+    `Failed to get access token for domain "${hostname}".`,
+  );
+  Object.assign(error, result);
+  throw error;
+});
+
+/**
+ * Returns true if the domain uses Cloudflare Access.
+ */
+async function domainUsesAccess(hostname: string) {
+  try {
+    const response = await fetch(`https://${hostname}`, {
+      method: "HEAD",
+      redirect: "manual",
+      signal: AbortSignal.timeout(1000),
+    });
+    return !!(
+      response.status === 302 &&
+      response.headers.get("location")?.includes("cloudflareaccess.com")
+    );
+  } catch {
+    return false;
+  }
+}