alchemy 0.77.4 → 0.78.0

package/src/cloudflare/auth.ts

@@ -18,88 +18,106 @@ export namespace CloudflareAuth {
     name: string;
   };
   export const ALL_SCOPES = {
-    // TODO: Verify descriptions marked with `//*`
-    "access:read": "Read Cloudflare Access", //*
-    "access:write": "Write Cloudflare Access", //*
+    "access:read":
+      "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+    "access:write":
+      "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
     "account:read":
-      "See your account info such as account details, analytics, and memberships.",
-    "agw:read": "Read API Gateway", //*
-    "agw:run": "Run API Gateway", //*
-    "ai:read": "Read access to Workers AI catalog and assets",
-    "ai:write": "See and change Workers AI catalog and assets",
-    "aiaudit:read": "Read AI Audit", //*
-    "aiaudit:write": "Write AI Audit", //*
-    "aig:read": "Read AI Gateway", //*
-    "aig:write": "Write AI Gateway", //*
-    "auditlogs:read": "Read audit logs", //*
-    "browser:read": "Read Browser", //*
-    "browser:write": "Write Browser", //*
-    "cfone:read": "Read Cloudflare One", //*
-    "cfone:write": "Write Cloudflare One", //*
-    "cloudchamber:write": "Manage Cloudchamber",
-    "constellation:write": "Write Constellation", //*
-    "containers:write": "Manage Workers Containers",
-    "d1:write": "See and change D1 Databases.",
-    "dex:read": "Read DEX", //*
-    "dex:write": "Write DEX", //*
-    "dns_analytics:read": "Read DNS analytics",
-    "dns_records:edit": "Edit DNS records",
-    "dns_records:read": "Read DNS records",
-    "dns_settings:read": "Read DNS settings",
-    "firstpartytags:write": "Write First Party Tags", //*
-    "lb:edit": "Edit Load Balancer", //*
-    "lb:read": "Read Load Balancer", //*
-    "logpush:read": "Read Logpush", //*
-    "logpush:write": "Write Logpush", //*
-    "notification:read": "Read Notifications", //*
-    "notification:write": "Write Notifications", //*
-    "pages:read": "Read access to Pages projects, settings, and deployments.",
-    "pages:write": "See and change Pages projects, settings, and deployments.",
-    "pipelines:read": "Read access to Pipelines configurations and data",
-    "pipelines:setup": "Setup access to Pipelines configurations and data",
-    "pipelines:write": "See and change Pipelines configurations and data",
-    "query_cache:write": "Write Query Cache", //*
-    "queues:write": "See and change Queues settings and data",
-    "r2_catalog:write": "Write R2 Catalog", //*
-    "radar:read": "Read Radar", //*
-    "rag:read": "Read RAG", //*
-    "rag:write": "Write RAG", //*
-    "secrets_store:read":
-      "Read access to secrets + stores within the Secrets Store",
-    "secrets_store:write":
-      "See and change secrets + stores within the Secrets Store",
-    "sso-connector:read": "Read SSO Connector", //*
-    "sso-connector:write": "Write SSO Connector", //*
-    "ssl_certs:write": "See and manage mTLS certificates for your account",
-    "teams:pii": "Read Teams PII", //*
-    "teams:read": "Read Teams", //*
-    "teams:secure_location": "Read Secure Location", //*
-    "teams:write": "Write Teams", //*
-    "url_scanner:read": "Read URL Scanner", //*
-    "url_scanner:write": "Write URL Scanner", //*
+      "See your account info such as account details, analytics, and memberships",
+    "agw:read": "Grants read level access to Agents Gateway",
+    "agw:run": "Grants run level access to Agents Gateway",
+    "agw:write": "Grants read and write level access to Agents Gateway",
+    "ai:read": "Grants read level access to Workers AI",
+    "ai:write": "Grants write level access to Workers AI",
+    "aiaudit:read": "Grants read level access to AI Audit",
+    "aiaudit:write": "Grants write level access to AI Audit",
+    "aig:read": "Grants read level access to AI Gateway",
+    "aig:write": "Grants write level access to AI Gateway",
+    "auditlogs:read": "View Cloudflare Account Audit Logs",
+    "browser:read": "Grants read level access to Browser Rendering",
+    "browser:write": "Grants write level access to Browser Rendering",
+    "cfone:read": "Grants read level access to Cloudforce One data",
+    "cfone:write": "Grants write level access to Cloudforce One data",
+    "cloudchamber:write": "See and make changes to Cloudchamber",
+    "connectivity:admin":
+      "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
+    "connectivity:bind":
+      "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
+    "connectivity:read":
+      "See Connectivity Directory services and Cloudflare Tunnels",
+    "constellation:write":
+      "Grants write access to Constellation configuration and models",
+    "containers:write": "See and make changes to Workers Containers",
+    "d1:write": "See and make changes to D1",
+    "dex:read": "Grants read level access to Cloudflare DEX",
+    "dex:write": "Grants write level access to Cloudflare DEX",
+    "dns_analytics:read":
+      "Grants read level access to Cloudflare DNS Analytics",
+    "dns_records:edit": "Grants edit level access to dns records",
+    "dns_records:read": "Grants read level access to dns records",
+    "dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
+    "firstpartytags:write":
+      "Can see, edit and publish Google tag gateway configuration.",
+    "lb:edit": "Grants edit level access to lb and lb pools",
+    "lb:read": "Grants read level access to lb and lb pools",
+    "logpush:read": "See Cloudflare Logpush data",
+    "logpush:write": "See and change Cloudflare Logpush data",
+    "notification:read": "View Cloudflare Notifications",
+    "notification:write": "View and Modify Cloudflare Notifications",
+    "pages:read": "See Cloudflare Pages projects, settings and deployments",
+    "pages:write":
+      "See and change Cloudflare Pages projects, settings and deployments",
+    "pipelines:read": "Grants read level access to Cloudflare Pipelines",
+    "pipelines:setup":
+      "Grants permission to generate R2 tokens for Workers Pipelines",
+    "pipelines:write": "Grants write level access to Cloudflare Pipelines",
+    "query_cache:write": "See and make changes to Hyperdrive",
+    "queues:write": "See and change Cloudflare Queues settings and data",
+    "r2_catalog:write": "Grants write level access to R2 Data Catalog",
+    "radar:read": "Grants access to read Cloudflare Radar data",
+    "rag:read": "Grants read level access to Auto Rag",
+    "rag:write": "Grants write level access to Auto Rag",
+    "secrets_store:read": "Grants read level access to Secrets Store",
+    "secrets_store:write": "Grants write level access to Secrets Store",
+    "ssl_certs:write":
+      "Grants read and write access to SSL MTLS certificates or Certificate Store",
+    "sso-connector:read": "See Cloudflare SSO connectors",
+    "sso-connector:write":
+      "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
+    "teams:pii": "See personally identifiable Cloudflare Teams data",
+    "teams:read":
+      "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+    "teams:secure_location":
+      "See all DNS Location data but can only change secure DNS Locations",
+    "teams:write":
+      "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+    "url_scanner:read": "Grants read level access to URL Scanner",
+    "url_scanner:write": "Grants write level access to URL Scanner",
     "user:read":
-      "See your user info such as name, email address, and account memberships.",
-    "vectorize:write": "Write Vectorize", //*
+      "See your user info such as name, email address, and account memberships",
+    "vectorize:write": "See and make changes to Vectorize",
+    "workers:read":
+      "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
     "workers:write":
-      "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
-    "workers_builds:read": "Read Workers Builds", //*
-    "workers_builds:write": "Write Workers Builds", //*
+      "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+    "workers_builds:read":
+      "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+    "workers_builds:write":
+      "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
     "workers_kv:write":
-      "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
-    "workers_observability:read": "Read Workers Observability", //*
-    "workers_observability:write": "Write Workers Observability", //*
+      "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
+    "workers_observability:read":
+      "Grants read access to Cloudflare Workers Observability",
     "workers_observability_telemetry:write":
-      "Write Workers Observability Telemetry", //*
+      "Grants write access to Cloudflare Workers Observability Telemetry API",
     "workers_routes:write":
-      "See and change Cloudflare Workers data such as filters and routes.",
+      "See and change Cloudflare Workers data such as filters and routes",
     "workers_scripts:write":
-      "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
-    "workers_tail:read": "See Cloudflare Workers tail and script data.",
-    "zone:read": "Grants read level access to account zone.",
-    // Not granted yet
-    // "connectivity:admin":
-    //   "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel.",
-  };
+      "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
+    "workers_tail:read": "See Cloudflare Workers tail and script data",
+    "zone:read": "Grants read level access to account zone",
+  } as const;
+  export type Scope = keyof typeof ALL_SCOPES;
   export const DEFAULT_SCOPES = [
     "account:read",
     "user:read",
@@ -119,6 +137,7 @@ export namespace CloudflareAuth {
     "containers:write",
     "cloudchamber:write",
     "vectorize:write",
+    "connectivity:admin",
   ];
 
   /**

package/src/cloudflare/cloudflare-env-proxy.ts

@@ -16,6 +16,7 @@ export const getCloudflareEnvProxy = async <E>(
 
 export const getPlatformProxyOptions = (
   input: GetPlatformProxyOptions = {},
+  throws: boolean = true,
 ): GetPlatformProxyOptions => {
   const persist =
     input.persist === false
@@ -37,7 +38,10 @@ export const getPlatformProxyOptions = (
   }
   return {
     ...input,
-    configPath: validateConfigPath(input.configPath ?? getDefaultConfigPath()),
+    configPath: validateConfigPath(
+      input.configPath ?? getDefaultConfigPath(),
+      throws,
+    ),
     persist,
   };
 };

package/src/cloudflare/compatibility-date.gen.ts

@@ -4,4 +4,4 @@
 /**
  * The default Cloudflare Workers compatibility date, set based on the latest workerd release at the time of build.
  */
-export const DEFAULT_COMPATIBILITY_DATE = "2025-11-11";
+export const DEFAULT_COMPATIBILITY_DATE = "2025-11-19";

package/src/cloudflare/container.ts

@@ -221,6 +221,11 @@ export async function Container<T>(
       ...props,
       name: `cloudflare-dev/${name}`, // prefix used by Miniflare
       tag,
+      build: props.build ?? {
+        dockerfile: "Dockerfile",
+        platform: "linux/amd64",
+        context: process.cwd(),
+      },
     } as ImageProps);
 
     return {
@@ -240,7 +245,11 @@ export async function Container<T>(
           platform: props.build?.platform ?? "linux/amd64",
           ...props.build,
         }
-      : undefined,
+      : {
+          dockerfile: "Dockerfile",
+          platform: "linux/amd64",
+          context: process.cwd(),
+        },
     image: props.image,
     registry: {
       server: "registry.cloudflare.com",
@@ -562,9 +571,6 @@ export const ContainerApplication = Resource(
         logs: {
           enabled: true,
         },
-        logging: {
-          enabled: true,
-        },
       },
     };
     if (this.phase === "update" && this.output?.id) {
@@ -1039,9 +1045,6 @@ interface CreateRolloutApplicationResponse {
       logs?: {
         enabled: boolean;
       };
-      logging?: {
-        enabled: boolean;
-      };
     };
   };
   target_configuration: DeploymentConfiguration;

package/src/cloudflare/d1-database.ts

@@ -387,10 +387,12 @@ const _D1Database = Resource(
         );
       }
       if (
-        props.jurisdiction &&
-        props.jurisdiction !== this.output?.jurisdiction
+        (props.jurisdiction ?? "default") !==
+        (this.output?.jurisdiction ?? "default")
       ) {
-        return this.replace();
+        throw new Error(
+          `Cannot update jurisdiction from '${this.output.jurisdiction}' to '${props.jurisdiction}' after database creation.`,
+        );
       }
       // Update the database with new properties
       dbData = await updateDatabase(api, this.output.id, props);
@@ -469,7 +471,8 @@ export async function createDatabase(
   // Create new D1 database
   const createPayload: any = {
     name: databaseName,
-    jurisdiction: props.jurisdiction,
+    jurisdiction:
+      props.jurisdiction !== "default" ? props.jurisdiction : undefined,
   };
 
   if (props.primaryLocationHint) {

package/src/cloudflare/index.ts

@@ -69,11 +69,11 @@ export * from "./vectorize-metadata-index.ts";
 export * from "./version-metadata.ts";
 export * from "./vite/vite.ts";
 export * from "./website.ts";
-export { WorkerLoader } from "./worker-loader.ts";
+export * from "./worker-loader.ts";
 export * from "./worker-ref.ts";
 export * from "./worker-stub.ts";
 export * from "./worker-subdomain.ts";
 export * from "./worker.ts";
-export { Workflow } from "./workflow.ts";
+export * from "./workflow.ts";
 export * from "./wrangler.json.ts";
 export * from "./zone.ts";

package/src/cloudflare/permission-groups.ts

@@ -359,6 +359,18 @@ export const PERMISSION_GROUPS = [
     description: "Grants write access to Account Rulesets",
     scopes: ["com.cloudflare.api.account"],
   },
+  {
+    id: "ece81d7757ff406cad61f221a4920d55",
+    name: "Account Security Center Insights Read",
+    description: "Grants read access to Security Center Insights",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cfa2e2893226455c9b945914969dff7c",
+    name: "Account Security Center Insights Write",
+    description: "Grants write access to Security Center Insights",
+    scopes: ["com.cloudflare.api.account"],
+  },
   {
     id: "c1fde68c7bcc44588cbb6ddbc16d6480",
     name: "Account Settings Read",
@@ -527,6 +539,18 @@ export const PERMISSION_GROUPS = [
     description: "Grants write access to Browser Rendering API",
     scopes: ["com.cloudflare.api.account"],
   },
+  {
+    id: "da5fe84b9c5446a0a5955b673fafa288",
+    name: "CASB Read",
+    description: "Grants read access to Cloudflare CASB",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "b9ed086b20864ad89c5aac24cdd02365",
+    name: "CASB Write",
+    description: "Grants write access to Cloudflare CASB",
+    scopes: ["com.cloudflare.api.account"],
+  },
   {
     id: "47b936e2027140c0a474cac8887b8c29",
     name: "CF Agents Read",
@@ -970,6 +994,18 @@ export const PERMISSION_GROUPS = [
     description: "Grants full access to Email Security dmarc reports\n",
     scopes: ["com.cloudflare.api.account.zone"],
   },
+  {
+    id: "2d5b4b1f6c89487bb7184c2c1dcd3bf1",
+    name: "Email Sending Read",
+    description: "Grants access to reading data from Email Sending",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5df633d6b41c42bcaf5b4a62b9d14b64",
+    name: "Email Sending Write",
+    description: "Grants access to reading and writing data from Email Sending",
+    scopes: ["com.cloudflare.api.account"],
+  },
   {
     id: "4ec32dfcb35641c5bb32d5ef1ab963b4",
     name: "Firewall Services Read",
@@ -1426,6 +1462,12 @@ export const PERMISSION_GROUPS = [
     description: "Grants admin access to Realtime configuration",
     scopes: ["com.cloudflare.api.account"],
   },
+  {
+    id: "9bb90620717647a39679e1d951f140d6",
+    name: "Registrar Domains Read",
+    description: "Grants read access to Cloudflare Registrar domains",
+    scopes: ["com.cloudflare.api.account"],
+  },
   {
     id: "93ae59e7a40c4287a57ff6e501186a63",
     name: "Response Compression Read",

package/src/cloudflare/worker-assets.ts

@@ -1,4 +1,5 @@
 import fs from "node:fs/promises";
+import path from "pathe";
 import { AsyncQueue } from "../util/async-queue.ts";
 import { withExponentialBackoff } from "../util/retry.ts";
 import { extractCloudflareResult } from "./api-response.ts";
@@ -38,7 +39,10 @@ export async function uploadAssets(
   },
 ): Promise<AssetUploadResult> {
   // Process the assets configuration once at the beginning
-  const processedConfig = createAssetConfig(assetConfig);
+  const processedConfig = await createAssetConfigWithFiles(
+    assets.path,
+    assetConfig,
+  );
 
   const manifest: Record<string, FileMetadata> = {};
   const filesByHash = new Map<string, Assets.FileMetadata>();
@@ -95,6 +99,35 @@ export async function uploadAssets(
   };
 }
 
+async function createAssetConfigWithFiles(
+  assetsPath: string,
+  config: AssetsConfig = {},
+): Promise<AssetsConfig> {
+  const [_headers, _redirects] = await Promise.all([
+    readFileOrProperty("_headers"),
+    readFileOrProperty("_redirects"),
+  ]);
+  return createAssetConfig({
+    ...config,
+    _headers,
+    _redirects,
+  });
+
+  async function readFileOrProperty(
+    property: "_headers" | "_redirects",
+  ): Promise<string | undefined> {
+    const content = await fs
+      .readFile(path.join(assetsPath, property), "utf-8")
+      .catch(() => undefined);
+    if (content && config[property]) {
+      throw new Error(
+        `Cannot use both ${property} file and ${property} property`,
+      );
+    }
+    return content ?? config[property];
+  }
+}
+
 /**
  * Creates asset configuration object from provided config or defaults
  */

package/src/cloudflare/worker-bundle.ts

@@ -351,6 +351,7 @@ export namespace WorkerBundleSource {
           ".js": "jsx",
           ".mjs": "jsx",
           ".cjs": "jsx",
+          ".sql": "text",
         },
         format,
         sourceRoot: this.props.outdir,

package/src/cloudflare/worker.ts

@@ -71,11 +71,13 @@ import { createEmptyWorker, exists } from "./worker-stub.ts";
 export interface AssetsConfig {
   /**
    * The contents of a _headers file (used to attach custom headers on asset responses)
+   * @default the `_headers` file in the assets directory, if present
    */
   _headers?: string;
 
   /**
    * The contents of a _redirects file (used to apply redirects or proxy paths ahead of asset serving)
+   * @default the `_redirects` file in the assets directory, if present
    */
   _redirects?: string;
 

package/src/util/detect-node-runtime.ts

@@ -6,7 +6,5 @@ export type Runtime = "bun" | "deno" | "node";
 export function detectRuntime(): Runtime {
   if (typeof Bun !== "undefined" && Bun !== null) return "bun";
   if (typeof Deno !== "undefined" && Deno !== null) return "deno";
-  if (typeof process !== "undefined" && process.release?.name === "node")
-    return "node";
   return "node";
 }

package/src/util/detect-package-manager.ts

@@ -1,20 +1,24 @@
+import path from "pathe";
 import { exists } from "./exists.ts";
+import { findWorkspaceRoot } from "./find-workspace-root.ts";
 
 export type PackageManager = "bun" | "pnpm" | "yarn" | "npm" | "deno";
 
 export async function detectPackageManager(
-  path: string = process.cwd(),
+  root: string = process.cwd(),
 ): Promise<PackageManager> {
-  if (await exists(`${path}/deno.lock`)) return "deno";
+  root = await findWorkspaceRoot(root);
+
+  if (await exists(path.resolve(root, "deno.lock"))) return "deno";
   if (
-    (await exists(`${path}/deno.json`)) ||
-    (await exists(`${path}/deno.jsonc`))
+    (await exists(path.resolve(root, "deno.json"))) ||
+    (await exists(path.resolve(root, "deno.jsonc")))
   )
     return "deno";
-  if (await exists(`${path}/bun.lockb`)) return "bun";
-  if (await exists(`${path}/bun.lock`)) return "bun";
-  if (await exists(`${path}/pnpm-lock.yaml`)) return "pnpm";
-  if (await exists(`${path}/yarn.lock`)) return "yarn";
+  if (await exists(path.resolve(root, "bun.lockb"))) return "bun";
+  if (await exists(path.resolve(root, "bun.lock"))) return "bun";
+  if (await exists(path.resolve(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (await exists(path.resolve(root, "yarn.lock"))) return "yarn";
 
   if (process.env.npm_execpath?.includes("bun")) {
     return "bun";

package/templates/tanstack-start/alchemy.run.ts

@@ -1,9 +1,15 @@
 import alchemy from "alchemy";
-import { TanStackStart } from "alchemy/cloudflare";
+import { R2Bucket, TanStackStart } from "alchemy/cloudflare";
 
 const app = await alchemy("{projectName}");
 
-export const website = await TanStackStart("website");
+const r2 = await R2Bucket("r2");
+
+export const website = await TanStackStart("website", {
+  bindings: {
+    R2: r2,
+  },
+});
 
 console.log({
   url: website.url,

package/templates/tanstack-start/src/routes/demo.start.server-funcs.tsx

@@ -1,22 +1,17 @@
-import fs from "node:fs";
-import { useCallback, useState } from "react";
 import { createFileRoute, useRouter } from "@tanstack/react-router";
 import { createServerFn } from "@tanstack/react-start";
+import { env } from "cloudflare:workers";
+import { useCallback, useState } from "react";
 
-const filePath = "todos.json";
+const key = "todos.json";
 
-async function readTodos() {
-  return JSON.parse(
-    await fs.promises.readFile(filePath, "utf-8").catch(() =>
-      JSON.stringify(
-        [
-          { id: 1, name: "Get groceries" },
-          { id: 2, name: "Buy a new phone" },
-        ],
-        null,
-        2,
-      ),
-    ),
+async function readTodos(): Promise<{ id: number; name: string }[]> {
+  const todos = await env.R2.get(key);
+  return (
+    (await todos?.json()) ?? [
+      { id: 1, name: "Get groceries" },
+      { id: 2, name: "Buy a new phone" },
+    ]
   );
 }
 
@@ -29,7 +24,7 @@ const addTodo = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const todos = await readTodos();
     todos.push({ id: todos.length + 1, name: data });
-    await fs.promises.writeFile(filePath, JSON.stringify(todos, null, 2));
+    await env.R2.put(key, JSON.stringify(todos, null, 2));
     return todos;
   });
 

package/workers/tunnel-proxy.js

@@ -83,7 +83,7 @@ const renderErrorHtml = (props) => `
             Alchemy</a>.</p>
       </div>
       <div class="bg-slate-200 px-5 py-3 flex flex-col w-full max-w-lg">
-        <p class="text-sm text-slate-500">Alchemy 0.77.4</p>
+        <p class="text-sm text-slate-500">Alchemy 0.78.0</p>
       </div>
     </div>
   </body>