alchemy 0.76.1 → 0.77.1

package/src/cloudflare/bucket.ts

@@ -17,6 +17,10 @@ import {
   type CloudflareApi,
   type CloudflareApiOptions,
 } from "./api.ts";
+import {
+  R2BucketCustomDomain,
+  type R2BucketCustomDomainOptions,
+} from "./bucket-custom-domain.ts";
 import { deleteMiniflareBinding } from "./miniflare/delete.ts";
 import { getDefaultPersistPath } from "./miniflare/paths.ts";
 
@@ -56,9 +60,25 @@ export interface BucketProps extends CloudflareApiOptions {
   /**
    * Whether to allow public access through the r2.dev subdomain
    * Only for development purposes - use custom domains for production
+   * @deprecated Use `devDomain` instead
    */
   allowPublicAccess?: boolean;
 
+  /**
+   * Whether to allow public access through the r2.dev subdomain
+   * Only for development purposes - use custom domains for production
+   */
+  devDomain?: boolean;
+
+  /**
+   * The custom domain(s) to attach to the bucket.
+   */
+  domains?:
+    | string
+    | R2BucketCustomDomainOptions
+    | string[]
+    | R2BucketCustomDomainOptions[];
+
   /**
    * Whether to delete the bucket.
    * If set to false, the bucket will remain but the resource will be removed from state
@@ -307,7 +327,10 @@ export type R2Bucket = _R2Bucket & {
 /**
  * Output returned after R2 Bucket creation/update
  */
-type _R2Bucket = Omit<BucketProps, "delete" | "dev"> & {
+type _R2Bucket = Omit<
+  BucketProps,
+  "delete" | "dev" | "domains" | "devDomain"
+> & {
   /**
    * Resource type identifier
    */
@@ -330,8 +353,19 @@ type _R2Bucket = Omit<BucketProps, "delete" | "dev"> & {
 
   /**
    * The `r2.dev` subdomain for the bucket, if `allowPublicAccess` is true
+   * @deprecated Use `devDomain` instead
+   */
+  domain?: string;
+
+  /**
+   * The `r2.dev` subdomain for the bucket, if `devDomain` is true
    */
-  domain: string | undefined;
+  devDomain: string | undefined;
+
+  /**
+   * The custom domains for the bucket, if applicable
+   */
+  domains: string[] | undefined;
 
   /**
    * Development mode properties
@@ -590,10 +624,14 @@ const _R2Bucket = Resource(
       props.name ?? (this.output?.name || this.scope.createPhysicalName(id));
 
     if (this.phase === "update" && this.output?.name !== bucketName) {
-      this.replace();
+      this.replace(
+        // force replacement if custom domain is enabled; otherwise, replace will fail because the bucket has child resources
+        !!this.output.domains?.length,
+      );
     }
 
-    const allowPublicAccess = props.allowPublicAccess === true;
+    const isDevDomainEnabled =
+      props.devDomain === true || props.allowPublicAccess === true;
     const isLocal = this.scope.local && !props.dev?.remote;
     const dev = {
       id: this.output?.dev?.id ?? bucketName,
@@ -602,14 +640,42 @@ const _R2Bucket = Resource(
     } satisfies _R2Bucket["dev"];
     const adopt = props.adopt ?? this.scope.adopt;
 
+    async function createDomains(domain: NonNullable<BucketProps["domains"]>) {
+      return Promise.all(
+        (Array.isArray(domain) ? domain : [domain]).map(async (domain) => {
+          const options: R2BucketCustomDomainOptions =
+            typeof domain === "string"
+              ? { domain, adopt, delete: props.delete }
+              : {
+                  ...domain,
+                  adopt: domain.adopt ?? adopt,
+                  delete: domain.delete ?? props.delete,
+                };
+          const output = await R2BucketCustomDomain(options.domain, {
+            ...options,
+            accountId: props.accountId,
+            apiKey: props.apiKey,
+            apiToken: props.apiToken,
+            email: props.email,
+            baseUrl: props.baseUrl,
+            profile: props.profile,
+            bucketName: bucketName,
+            jurisdiction: props.jurisdiction,
+            dev,
+          });
+          return output.domain;
+        }),
+      );
+    }
+
     if (isLocal) {
       return {
         name: bucketName,
         location: this.output?.location ?? "",
         creationDate: this.output?.creationDate ?? new Date(),
         jurisdiction: this.output?.jurisdiction ?? "default",
-        allowPublicAccess,
-        domain: this.output?.domain,
+        devDomain: this.output?.devDomain ?? this.output?.domain,
+        domains: props.domains ? await createDomains(props.domains) : undefined,
         type: "r2_bucket",
         accountId: this.output?.accountId ?? "",
         cors: props.cors,
@@ -648,10 +714,10 @@ const _R2Bucket = Resource(
           throw err;
         },
       );
-      const domain = await putManagedDomain(
+      const devDomain = await putManagedDomain(
         api,
         bucketName,
-        allowPublicAccess,
+        isDevDomainEnabled,
         props.jurisdiction,
       );
       if (props.cors?.length) {
@@ -673,13 +739,14 @@ const _R2Bucket = Resource(
       if (props.dataCatalog) {
         dataCatalog = await enableDataCatalog(api, bucketName);
       }
+
       return {
         name: bucketName,
         location: bucket.location,
         creationDate: new Date(bucket.creation_date),
         jurisdiction: bucket.jurisdiction,
-        allowPublicAccess,
-        domain,
+        devDomain,
+        domains: props.domains ? await createDomains(props.domains) : undefined,
         type: "r2_bucket",
         accountId: api.accountId,
         lifecycle: props.lifecycle,
@@ -701,12 +768,12 @@ const _R2Bucket = Resource(
       if (!this.output.catalog && props.dataCatalog) {
         this.output.catalog = await enableDataCatalog(api, bucketName);
       }
-      let domain = this.output.domain;
-      if (!!domain !== allowPublicAccess) {
-        domain = await putManagedDomain(
+      let devDomain = this.output.devDomain ?? this.output.domain;
+      if (!!devDomain !== isDevDomainEnabled) {
+        devDomain = await putManagedDomain(
           api,
           bucketName,
-          allowPublicAccess,
+          isDevDomainEnabled,
           props.jurisdiction,
         );
       }
@@ -723,12 +790,12 @@ const _R2Bucket = Resource(
       }
       return {
         ...this.output,
-        allowPublicAccess,
+        devDomain,
+        domains: props.domains ? await createDomains(props.domains) : undefined,
         dev,
         cors: props.cors,
         lifecycle: props.lifecycle,
         lock: props.lock,
-        domain,
       };
     }
   },
@@ -1087,7 +1154,7 @@ export async function putBucketLifecycleRules(
 export async function getBucketLifecycleRules(
   api: CloudflareApi,
   bucketName: string,
-  props: BucketProps = {},
+  props: { jurisdiction?: string },
 ): Promise<R2BucketLifecycleRule[]> {
   const res = await api.get(
     `/accounts/${api.accountId}/r2/buckets/${bucketName}/lifecycle`,
@@ -1140,7 +1207,7 @@ export async function putBucketLockRules(
 export async function getBucketLockRules(
   api: CloudflareApi,
   bucketName: string,
-  props: BucketProps = {},
+  props: { jurisdiction?: R2BucketJurisdiction },
 ): Promise<R2BucketLockRule[]> {
   const res = await api.get(
     `/accounts/${api.accountId}/r2/buckets/${bucketName}/lock`,

package/src/cloudflare/cloudflare-env-proxy.ts

@@ -39,9 +39,6 @@ export const getPlatformProxyOptions = (
     ...input,
     configPath: validateConfigPath(input.configPath ?? getDefaultConfigPath()),
     persist,
-    experimental: (input as any).experimental ?? {
-      remoteBindings: true,
-    },
   };
 };
 

package/src/cloudflare/compatibility-date.gen.ts

@@ -4,4 +4,4 @@
 /**
  * The default Cloudflare Workers compatibility date, set based on the latest workerd release at the time of build.
  */
-export const DEFAULT_COMPATIBILITY_DATE = "2025-10-14";
+export const DEFAULT_COMPATIBILITY_DATE = "2025-11-09";

package/src/cloudflare/container.ts

@@ -218,10 +218,10 @@ export async function Container<T>(
   const isDev = scope.local && !props.dev?.remote;
   if (isDev) {
     const image = await Image(id, {
+      ...props,
       name: `cloudflare-dev/${name}`, // prefix used by Miniflare
       tag,
-      build: props.build,
-    });
+    } as ImageProps);
 
     return {
       ...output,
@@ -235,16 +235,19 @@ export async function Container<T>(
   const image = await Image(id, {
     name: `${api.accountId}/${name}`,
     tag,
-    build: {
-      platform: props.build?.platform ?? "linux/amd64",
-      ...props.build,
-    },
+    build: props.build
+      ? {
+          platform: props.build?.platform ?? "linux/amd64",
+          ...props.build,
+        }
+      : undefined,
+    image: props.image,
     registry: {
       server: "registry.cloudflare.com",
       username: credentials.username || credentials.user!,
       password: secret(credentials.password),
     },
-  });
+  } as ImageProps);
 
   return {
     ...output,

package/src/cloudflare/d1-database.ts

@@ -8,6 +8,7 @@ import {
   type CloudflareApi,
   type CloudflareApiOptions,
 } from "./api.ts";
+import { withJurisdiction } from "./bucket.ts";
 import { cloneD1Database } from "./d1-clone.ts";
 import { applyLocalD1Migrations } from "./d1-local-migrations.ts";
 import { applyMigrations, listMigrationsFiles } from "./d1-migrations.ts";
@@ -15,6 +16,8 @@ import { deleteMiniflareBinding } from "./miniflare/delete.ts";
 
 const DEFAULT_MIGRATIONS_TABLE = "d1_migrations";
 
+export type D1DatabaseJurisdiction = "default" | "eu" | "fedramp";
+
 type PrimaryLocationHint =
   | "wnam"
   | "enam"
@@ -115,6 +118,12 @@ export interface D1DatabaseProps extends CloudflareApiOptions {
      */
     force?: boolean;
   };
+
+  /**
+   * Optional jurisdiction for the bucket
+   * Determines the regulatory jurisdiction the bucket data falls under
+   */
+  jurisdiction?: D1DatabaseJurisdiction;
 }
 
 export function isD1Database(resource: any): resource is D1Database {
@@ -157,6 +166,11 @@ export type D1Database = Pick<
      */
     remote: boolean;
   };
+
+  /**
+   * The jurisdiction of the database
+   */
+  jurisdiction: D1DatabaseJurisdiction;
 };
 
 /**
@@ -260,10 +274,11 @@ const _D1Database = Resource(
   async function (
     this: Context<D1Database>,
     id: string,
-    props: D1DatabaseProps = {},
+    props: D1DatabaseProps,
   ): Promise<D1Database> {
     const databaseName =
       props.name ?? this.output?.name ?? this.scope.createPhysicalName(id);
+    const jurisdiction = props.jurisdiction ?? "default";
 
     if (this.phase === "update" && this.output?.name !== databaseName) {
       this.replace();
@@ -294,6 +309,7 @@ const _D1Database = Resource(
         migrationsDir: props.migrationsDir,
         migrationsTable: props.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE,
         dev,
+        jurisdiction,
       };
     }
 
@@ -304,7 +320,7 @@ const _D1Database = Resource(
         await deleteMiniflareBinding(this.scope, "d1", this.output.dev.id);
       }
       if (props.delete !== false && this.output?.id) {
-        await deleteDatabase(api, this.output.id);
+        await deleteDatabase(api, this.output.id, props);
       }
       // Return void (a deleted database has no content)
       return this.destroy();
@@ -328,7 +344,7 @@ const _D1Database = Resource(
 
         // If clone property is provided, perform cloning after database creation
         if (props.clone && dbData.result.uuid) {
-          await cloneDb(api, props.clone, dbData.result.uuid);
+          await cloneDb(api, props.clone, dbData.result.uuid, jurisdiction);
         }
       } catch (error) {
         // Check if this is a "database already exists" error and adopt is enabled
@@ -339,7 +355,7 @@ const _D1Database = Resource(
         ) {
           logger.log(`Database ${databaseName} already exists, adopting it`);
           // Find the existing database by name
-          const databases = await listDatabases(api, databaseName);
+          const databases = await listDatabases(api, databaseName, props);
           const existingDb = databases.find((db) => db.name === databaseName);
 
           if (!existingDb) {
@@ -349,7 +365,7 @@ const _D1Database = Resource(
           }
 
           // Get the database details using its ID
-          dbData = await getDatabase(api, existingDb.id);
+          dbData = await getDatabase(api, existingDb.id, props);
 
           // Update the database with the provided properties
           if (props.readReplication) {
@@ -413,6 +429,7 @@ const _D1Database = Resource(
       dev,
       migrationsDir: props.migrationsDir,
       migrationsTable: props.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE,
+      jurisdiction,
     };
   },
 );
@@ -454,6 +471,9 @@ export async function createDatabase(
   const createResponse = await api.post(
     `/accounts/${api.accountId}/d1/database`,
     createPayload,
+    {
+      headers: withJurisdiction(props),
+    },
   );
 
   if (!createResponse.ok) {
@@ -474,6 +494,7 @@ export async function createDatabase(
 export async function getDatabase(
   api: CloudflareApi,
   databaseId?: string,
+  props: D1DatabaseProps = {},
 ): Promise<CloudflareD1Response> {
   if (!databaseId) {
     throw new Error("Database ID is required");
@@ -481,6 +502,9 @@ export async function getDatabase(
 
   const response = await api.get(
     `/accounts/${api.accountId}/d1/database/${databaseId}`,
+    {
+      headers: withJurisdiction(props),
+    },
   );
 
   if (!response.ok) {
@@ -496,6 +520,7 @@ export async function getDatabase(
 export async function deleteDatabase(
   api: CloudflareApi,
   databaseId?: string,
+  props: D1DatabaseProps = {},
 ): Promise<void> {
   if (!databaseId) {
     logger.log("No database ID provided, skipping delete");
@@ -505,6 +530,9 @@ export async function deleteDatabase(
   // Delete D1 database
   const deleteResponse = await api.delete(
     `/accounts/${api.accountId}/d1/database/${databaseId}`,
+    {
+      headers: withJurisdiction(props),
+    },
   );
 
   if (!deleteResponse.ok && deleteResponse.status !== 404) {
@@ -524,12 +552,16 @@ export async function deleteDatabase(
 export async function listDatabases(
   api: CloudflareApi,
   name?: string,
+  props: D1DatabaseProps = {},
 ): Promise<{ name: string; id: string }[]> {
   // Construct query string if name is provided
   const queryParams = name ? `?name=${encodeURIComponent(name)}` : "";
 
   const response = await api.get(
     `/accounts/${api.accountId}/d1/database${queryParams}`,
+    {
+      headers: withJurisdiction(props),
+    },
   );
 
   if (!response.ok) {
@@ -582,6 +614,9 @@ export async function updateDatabase(
   const updateResponse = await api.patch(
     `/accounts/${api.accountId}/d1/database/${databaseId}`,
     updatePayload,
+    {
+      headers: withJurisdiction(props),
+    },
   );
 
   if (!updateResponse.ok) {
@@ -608,6 +643,7 @@ async function cloneDb(
   api: CloudflareApi,
   sourceDb: D1Database | { id: string } | { name: string },
   targetDbId: string,
+  jurisdiction: D1DatabaseJurisdiction,
 ): Promise<void> {
   let sourceId: string;
 
@@ -617,7 +653,9 @@ async function cloneDb(
     sourceId = sourceDb.id;
   } else if ("name" in sourceDb && sourceDb.name) {
     // Look up ID by name
-    const databases = await listDatabases(api, sourceDb.name);
+    const databases = await listDatabases(api, sourceDb.name, {
+      jurisdiction,
+    });
     const foundDb = databases.find((db) => db.name === sourceDb.name);
 
     if (!foundDb) {

package/src/cloudflare/index.ts

@@ -15,6 +15,7 @@ export * from "./astro/astro.ts";
 export * from "./bindings.ts";
 export * from "./bound.ts";
 export * from "./browser-rendering.ts";
+export * from "./bucket-custom-domain.ts";
 export * from "./bucket-object.ts";
 export * from "./bucket.ts";
 export * from "./bun-spa/bun-spa.ts";

package/src/cloudflare/miniflare/remote-binding-proxy.ts

@@ -1,6 +1,8 @@
 import type { RemoteProxyConnectionString } from "miniflare";
 import { WebSocket } from "ws";
+import { Scope } from "../../scope.ts";
 import { HTTPServer } from "../../util/http.ts";
+import { memoize } from "../../util/memoize.ts";
 import { extractCloudflareResult } from "../api-response.ts";
 import type { CloudflareApi } from "../api.ts";
 import type { WorkerBindingSpec } from "../bindings.ts";
@@ -37,7 +39,7 @@ export async function createRemoteProxyWorker(input: {
   bindings: WorkerBindingSpec[];
 }): Promise<RemoteBindingProxy> {
   const script = await getInternalWorkerBundle("remote-binding-proxy");
-  const [token, subdomain] = await Promise.all([
+  const [token, { host, accessToken }] = await Promise.all([
     createWorkersPreviewToken(input.api, {
       name: input.name,
       metadata: {
@@ -52,18 +54,27 @@ export async function createRemoteProxyWorker(input: {
         minimal_mode: true,
       },
     }),
-    getAccountSubdomain(input.api),
+    getAccountSubdomain(input.api).then(async (subdomain) => {
+      const host = `${input.name}.${subdomain}.workers.dev`;
+      return {
+        host,
+        accessToken: await getAccessToken(host),
+      };
+    }),
   ]);
 
-  const host = `${input.name}.${subdomain}.workers.dev`;
+  const baseHeaders: Record<string, string> = {
+    "cf-workers-preview-token": token,
+    host,
+    ...(accessToken ? { cookie: `CF_Authorization=${accessToken}` } : {}),
+  };
 
   const server = new HTTPServer({
     websocket: async (req) => {
       const input = new URL(req.url);
       const proxied = new URL(input.pathname + input.search, `https://${host}`);
       const headers: Record<string, string> = {
-        "cf-workers-preview-token": token,
-        host,
+        ...baseHeaders,
       };
       // We don't want to include all headers because some can mess with websocket connections.
       // However, it's important to include `mf-` prefixed headers to configure bindings for miniflare to work.
@@ -81,8 +92,9 @@ export async function createRemoteProxyWorker(input: {
       const proxied = new URL(url.pathname + url.search, `https://${host}`);
 
       const headers = new Headers(req.headers);
-      headers.set("cf-workers-preview-token", token);
-      headers.set("host", host);
+      for (const [key, value] of Object.entries(baseHeaders)) {
+        headers.set(key, value);
+      }
       headers.delete("cf-connecting-ip");
 
       const res = await fetch(proxied, {
@@ -146,8 +158,13 @@ async function createWorkersPreviewToken(
 
 async function prewarm(url: string, previewToken: string) {
   try {
+    const accessToken = await getAccessToken(new URL(url).hostname);
     await fetch(url, {
-      headers: { "cf-workers-preview-token": previewToken },
+      method: "POST",
+      headers: {
+        "cf-workers-preview-token": previewToken,
+        ...(accessToken ? { cookie: `CF_Authorization=${accessToken}` } : {}),
+      },
     });
   } catch {
     // Ignore prewarm errors
@@ -162,7 +179,12 @@ async function createWorkersPreviewSession(api: CloudflareApi) {
     "create workers preview session",
     api.get(`/accounts/${api.accountId}/workers/subdomain/edge-preview`),
   );
-  const res = await fetch(exchange_url);
+  const accessToken = await getAccessToken(new URL(exchange_url).hostname);
+  const res = await fetch(exchange_url, {
+    headers: {
+      ...(accessToken ? { cookie: `CF_Authorization=${accessToken}` } : {}),
+    },
+  });
   if (!res.ok) {
     throw new Error(
       `Failed to create workers preview session: ${res.status} ${res.statusText}`,
@@ -171,3 +193,52 @@ async function createWorkersPreviewSession(api: CloudflareApi) {
   const json: WorkersPreviewSession = await res.json();
   return json;
 }
+
+/**
+ * If the given domain uses Cloudflare Access, fetches the access token for the domain.
+ * Otherwise, returns undefined.
+ * @see https://github.com/cloudflare/workers-sdk/blob/a5eb5134f73d3983655d325a4de71c6370c57faa/packages/wrangler/src/user/access.ts#L10
+ */
+const getAccessToken = memoize(async (hostname: string) => {
+  if (!(await domainUsesAccess(hostname))) {
+    return undefined;
+  }
+  const result = await Scope.current
+    .exec(`access-${hostname}`, `cloudflared access login ${hostname}`)
+    .catch(() => {
+      throw new Error(
+        [
+          `The \`cloudflared\` CLI is not installed, but is required to access the domain "${hostname}".`,
+          `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation and run \`cloudflare access login ${hostname}\`.`,
+        ].join("\n"),
+      );
+    });
+  const matches = result.stdout.match(/fetched your token:\n\n(.*)/m);
+  if (matches?.[1]) {
+    return matches[1];
+  }
+  const error = new Error(
+    `Failed to get access token for domain "${hostname}".`,
+  );
+  Object.assign(error, result);
+  throw error;
+});
+
+/**
+ * Returns true if the domain uses Cloudflare Access.
+ */
+async function domainUsesAccess(hostname: string) {
+  try {
+    const response = await fetch(`https://${hostname}`, {
+      method: "HEAD",
+      redirect: "manual",
+      signal: AbortSignal.timeout(1000),
+    });
+    return !!(
+      response.status === 302 &&
+      response.headers.get("location")?.includes("cloudflareaccess.com")
+    );
+  } catch {
+    return false;
+  }
+}

package/src/cloudflare/react-router/plugin.ts

@@ -1,32 +1,20 @@
 import type { PluginConfig } from "@cloudflare/vite-plugin";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { dirname } from "pathe";
-import { getDefaultConfigPath } from "../miniflare/paths.ts";
+import type { PluginOption } from "vite";
 import alchemyVite from "../vite/plugin.ts";
 
-const alchemy = (config?: PluginConfig) => {
-  const configPath = config?.configPath ?? getDefaultConfigPath();
-  // react-router type generation requries a wrangler.json and creates a chicken and egg problem
-  // we create a dummy wrangler.json file so that clean builds can be performed
-  if (!existsSync(configPath)) {
-    mkdirSync(dirname(configPath), { recursive: true });
-    writeFileSync(
-      configPath,
-      JSON.stringify(
-        {
-          name: "dummy",
-          compatibility_date: "2025-09-23",
-        },
-        null,
-        2,
-      ),
-    );
+const alchemy = (config: PluginConfig = {}): PluginOption => {
+  // plugin is not required for react-router typegen, so return a no-op to avoid errors
+  if (
+    process.argv.some((arg) => arg.includes("react-router")) &&
+    process.argv.includes("typegen")
+  ) {
+    return null;
   }
   return alchemyVite({
-    ...config,
     viteEnvironment: {
       name: "ssr",
     },
+    ...config,
   });
 };
 

package/src/cloudflare/vite/plugin.ts

@@ -26,9 +26,6 @@ const alchemy = (config?: PluginConfig): PluginOption => {
         config?.configPath ?? getDefaultConfigPath(),
       ),
       persistState,
-      experimental: config?.experimental ?? {
-        remoteBindings: true,
-      },
     }),
     {
       name: "alchemy-supress-watch",