alchemy 0.93.4 → 0.93.7

package/src/cloudflare/access-service-token.ts

@@ -0,0 +1,255 @@
+import { alchemy } from "../alchemy.ts";
+import type { Context } from "../context.ts";
+import { Resource, ResourceKind } from "../resource.ts";
+import type { Secret } from "../secret.ts";
+import { logger } from "../util/logger.ts";
+import { isCloudflareApiError } from "./api-error.ts";
+import {
+  extractCloudflareResult,
+  type CloudflareApiListResponse,
+} from "./api-response.ts";
+import {
+  createCloudflareApi,
+  type CloudflareApi,
+  type CloudflareApiOptions,
+} from "./api.ts";
+
+/**
+ * Properties for creating or updating an {@link AccessServiceToken}.
+ */
+export interface AccessServiceTokenProps extends CloudflareApiOptions {
+  /**
+   * Display name of the service token.
+   *
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+
+  /**
+   * How long the token is valid for. Format: a Cloudflare duration string
+   * such as `"24h"`, `"30d"`, or `"8760h"` (one year).
+   *
+   * @default "8760h"
+   */
+  duration?: string;
+
+  /**
+   * Adopt an existing service token with the same name instead of failing
+   * with a duplicate-name error.
+   *
+   * Note: when adopting, the `clientSecret` cannot be recovered — the output
+   * `clientSecret` will be `undefined`. Recreate the resource (or rotate via
+   * the Cloudflare dashboard) if you need a new secret.
+   *
+   * @default false
+   */
+  adopt?: boolean;
+
+  /**
+   * Whether to delete the token when removed from Alchemy.
+   *
+   * @default true
+   */
+  delete?: boolean;
+}
+
+/**
+ * Output for an {@link AccessServiceToken}.
+ */
+export type AccessServiceToken = Omit<
+  AccessServiceTokenProps,
+  "delete" | "adopt"
+> & {
+  /** Cloudflare-assigned token UUID. */
+  id: string;
+  /** Display name of the token. */
+  name: string;
+  /**
+   * Value sent in the `CF-Access-Client-Id` header when authenticating.
+   */
+  clientId: string;
+  /**
+   * Value sent in the `CF-Access-Client-Secret` header when authenticating.
+   * **Returned only on creation** — `undefined` for adopted tokens.
+   */
+  clientSecret?: Secret;
+  /** ISO 8601 creation timestamp. */
+  createdAt: string;
+  /** ISO 8601 last-update timestamp. */
+  updatedAt: string;
+};
+
+/**
+ * Type guard for {@link AccessServiceToken}.
+ */
+export function isAccessServiceToken(
+  resource: any,
+): resource is AccessServiceToken {
+  return resource?.[ResourceKind] === "cloudflare::AccessServiceToken";
+}
+
+interface CloudflareAccessServiceToken {
+  id: string;
+  name: string;
+  client_id: string;
+  client_secret?: string;
+  duration?: string;
+  created_at: string;
+  updated_at: string;
+}
+
+/**
+ * Creates a Cloudflare Zero Trust [Access service token](https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/)
+ * for machine-to-machine authentication against Access-protected applications.
+ *
+ * The returned `clientSecret` is only available on creation — store it
+ * immediately. Adopted tokens have `clientSecret: undefined`.
+ *
+ * @example
+ * // Basic service token (defaults to 1 year duration)
+ * const token = await AccessServiceToken("ci-token", {
+ *   name: "ci-runner",
+ * });
+ *
+ * @example
+ * // Custom duration
+ * const shortLived = await AccessServiceToken("preview", {
+ *   name: "preview-deploy-token",
+ *   duration: "720h", // 30 days
+ * });
+ */
+export const AccessServiceToken = Resource(
+  "cloudflare::AccessServiceToken",
+  async function (
+    this: Context<AccessServiceToken>,
+    id: string,
+    props: AccessServiceTokenProps,
+  ): Promise<AccessServiceToken> {
+    const api = await createCloudflareApi(props);
+    const name = props.name ?? this.scope.createPhysicalName(id);
+    const basePath = `/accounts/${api.accountId}/access/service_tokens`;
+
+    if (this.phase === "delete") {
+      if (this.output?.id && props.delete !== false) {
+        await deleteAccessServiceToken(api, this.output.id);
+      }
+      return this.destroy();
+    }
+
+    const body: Record<string, unknown> = { name };
+    if (props.duration) body.duration = props.duration;
+
+    let token: CloudflareAccessServiceToken;
+    if (this.phase === "update" && this.output?.id) {
+      token = await extractCloudflareResult<CloudflareAccessServiceToken>(
+        `update access service token "${name}"`,
+        api.put(`${basePath}/${this.output.id}`, body),
+      );
+    } else {
+      const adopt = props.adopt ?? this.scope.adopt;
+      try {
+        token = await extractCloudflareResult<CloudflareAccessServiceToken>(
+          `create access service token "${name}"`,
+          api.post(basePath, body),
+        );
+      } catch (err) {
+        if (adopt && isAccessDuplicateNameError(err)) {
+          const existing = await findAccessServiceTokenByName(api, name);
+          if (!existing) {
+            throw new Error(
+              `Service token "${name}" already exists but could not be found for adoption.`,
+              { cause: err },
+            );
+          }
+          logger.log(
+            `Adopting existing access service token "${name}" (${existing.id})`,
+          );
+          token = await extractCloudflareResult<CloudflareAccessServiceToken>(
+            `adopt access service token "${name}"`,
+            api.put(`${basePath}/${existing.id}`, body),
+          );
+        } else {
+          throw err;
+        }
+      }
+    }
+
+    // clientSecret is only returned on creation; retain on subsequent updates.
+    const clientSecret = token.client_secret
+      ? alchemy.secret(token.client_secret)
+      : this.output?.clientSecret;
+
+    return {
+      id: token.id,
+      name: token.name,
+      clientId: token.client_id,
+      clientSecret,
+      duration: token.duration,
+      createdAt: token.created_at,
+      updatedAt: token.updated_at,
+    };
+  },
+);
+
+/**
+ * Cloudflare returns error code 12132 ("Access service token already exists")
+ * for duplicate names.
+ */
+function isAccessDuplicateNameError(err: unknown): boolean {
+  if (
+    isCloudflareApiError(err, { status: 409 }) ||
+    isCloudflareApiError(err, { status: 400 })
+  ) {
+    const data = err.errorData;
+    if (
+      Array.isArray(data) &&
+      data.some(
+        (e) => "message" in e && /already exists/i.test(String(e.message)),
+      )
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Look up an existing service token by name across paginated results.
+ */
+async function findAccessServiceTokenByName(
+  api: CloudflareApi,
+  name: string,
+): Promise<CloudflareAccessServiceToken | null> {
+  let page = 1;
+  const perPage = 50;
+  while (true) {
+    const response = await api.get(
+      `/accounts/${api.accountId}/access/service_tokens?page=${page}&per_page=${perPage}`,
+    );
+    if (!response.ok) return null;
+    const data =
+      (await response.json()) as CloudflareApiListResponse<CloudflareAccessServiceToken>;
+    const match = data.result.find((t) => t.name === name);
+    if (match) return match;
+    const info = data.result_info;
+    if (!info || info.page * info.per_page >= info.total_count) return null;
+    page++;
+  }
+}
+
+/**
+ * Delete a service token. No-op on 404.
+ */
+async function deleteAccessServiceToken(
+  api: CloudflareApi,
+  tokenId: string,
+): Promise<void> {
+  const response = await api.delete(
+    `/accounts/${api.accountId}/access/service_tokens/${tokenId}`,
+  );
+  if (!response.ok && response.status !== 404) {
+    logger.error(
+      `Error deleting access service token ${tokenId}: ${response.status} ${response.statusText}`,
+    );
+  }
+}

package/src/cloudflare/index.ts

@@ -1,5 +1,11 @@
 /// <reference types="@cloudflare/workers-types" />
 
+export * from "./access-application.ts";
+export * from "./access-group.ts";
+export * from "./access-identity-provider.ts";
+export * from "./access-policy.ts";
+export * from "./access-rule.ts";
+export * from "./access-service-token.ts";
 export * from "./account-api-token.ts";
 export * from "./account-id.ts";
 export * from "./ai-crawler.ts";

package/src/cloudflare/miniflare/build-worker-options.ts

@@ -1,9 +1,11 @@
 import * as miniflare from "miniflare";
 import path from "pathe";
+import { DockerApi } from "../../docker/api.ts";
 import { assertNever } from "../../util/assert-never.ts";
 import { reservePort } from "../../util/find-open-port.ts";
 import type { HTTPServer } from "../../util/http.ts";
 import { logger } from "../../util/logger.ts";
+import { memoize } from "../../util/memoize.ts";
 import { isAiSearchNamespace } from "../ai-search-namespace.ts";
 import { isAiSearch } from "../ai-search.ts";
 import type { CloudflareApi } from "../api.ts";
@@ -18,6 +20,11 @@ import type { WorkerBundle, WorkerBundleSource } from "../worker-bundle.ts";
 import type { AssetsConfig } from "../worker.ts";
 import { createRemoteProxyWorker } from "./remote-binding-proxy.ts";
 
+// Copied from @cloudflare/containers-shared:
+// https://github.com/cloudflare/workers-sdk/blob/fc2d8838b3c5395d5d248e8073a393f7dbb9536d/packages/containers-shared/src/images.ts#L20
+const CONTAINER_EGRESS_INTERCEPTOR_IMAGE =
+  "cloudflare/proxy-everything:3cb1195@sha256:0ef6716c52430096900b150d84a3302057d6cd2319dae7987128c85d0733e3c8";
+
 export interface MiniflareWorkerInput {
   api: CloudflareApi;
   id: string;
@@ -189,9 +196,7 @@ export const buildWorkerOptions = async (
           },
         };
         options.containerEngine = {
-          localDocker: {
-            socketPath: await getDockerSocketPath(),
-          },
+          localDocker: await getLocalDocker(),
         };
         break;
       }
@@ -632,6 +637,18 @@ const isRemoteBinding = (binding: Binding) => {
   );
 };
 
+const getLocalDocker = memoize(async () => {
+  const docker = new DockerApi();
+  const [socketPath] = await Promise.all([
+    getDockerSocketPath(),
+    docker.pullImage(CONTAINER_EGRESS_INTERCEPTOR_IMAGE),
+  ]);
+  return {
+    socketPath,
+    containerEgressInterceptorImage: CONTAINER_EGRESS_INTERCEPTOR_IMAGE,
+  };
+});
+
 /**
  * DOCKER_HOST env is standardized
  * docker has an option to expose on tcp://localhost:2375; so we check 2375 if the user has it enabled

package/src/state/file-system-state-store.ts

@@ -106,6 +106,22 @@ export class FileSystemStateStore implements StateStore {
     }
   }
 
+  async listScopes(): Promise<string[]> {
+    try {
+      const entries = await fs.promises.readdir(this.dir, {
+        withFileTypes: true,
+      });
+      return entries
+        .filter((dirent) => dirent.isDirectory())
+        .map((dirent) => dirent.name);
+    } catch (error: any) {
+      if (error.code === "ENOENT") {
+        return [];
+      }
+      throw error;
+    }
+  }
+
   async all(): Promise<Record<string, State>> {
     return this.getBatch(await this.list());
   }

package/src/state/operations.ts

@@ -30,6 +30,8 @@ export class SQLiteStateStoreOperations implements StateStore {
         return;
       case "list":
         return this.list();
+      case "listScopes":
+        return this.listScopes();
       case "count":
         return this.count();
       case "get": {
@@ -62,6 +64,26 @@ export class SQLiteStateStoreOperations implements StateStore {
       .where(eq(schema.resources.scope, this.context.chain));
     return result.map((r) => r.id);
   }
+  async listScopes() {
+    const rows = await this.db
+      .selectDistinct({ scope: schema.resources.scope })
+      .from(schema.resources);
+    const prefix = this.context.chain;
+    const names = new Set<string>();
+    for (const row of rows) {
+      const scope = row.scope as string[];
+      if (scope.length !== prefix.length + 1) continue;
+      let matches = true;
+      for (let i = 0; i < prefix.length; i++) {
+        if (scope[i] !== prefix[i]) {
+          matches = false;
+          break;
+        }
+      }
+      if (matches) names.add(scope[prefix.length]!);
+    }
+    return [...names];
+  }
   async count() {
     const result = await this.db.$count(
       this.db

package/src/state/proxy.ts

@@ -39,6 +39,10 @@ export abstract class StateStoreProxy implements StateStore {
     return this.run("list", []);
   }
 
+  listScopes(): Promise<string[]> {
+    return this.run("listScopes", []);
+  }
+
   count(): Promise<number> {
     return this.run("count", []);
   }

package/src/state-cli.ts

@@ -0,0 +1,134 @@
+import { Scope } from "./scope.ts";
+import type { State } from "./state.ts";
+
+export type StateCommand = "tree" | "list" | "get";
+
+interface StateNode {
+  resources: string[];
+  children: Record<string, StateNode>;
+}
+
+async function walk(scope: Scope): Promise<StateNode> {
+  const resources = await scope.state.list();
+  const children: Record<string, StateNode> = {};
+  if (typeof scope.state.listScopes === "function") {
+    const childNames = await scope.state.listScopes();
+    for (const name of childNames) {
+      const childScope = new Scope({ parent: scope, scopeName: name });
+      children[name] = await walk(childScope);
+    }
+  }
+  return { resources, children };
+}
+
+function renderTree(rootName: string, node: StateNode): string {
+  const lines: string[] = [rootName];
+  appendNode(lines, node, "");
+  return lines.join("\n");
+}
+
+function appendNode(lines: string[], node: StateNode, indent: string) {
+  const childEntries = Object.entries(node.children).sort(([a], [b]) =>
+    a.localeCompare(b),
+  );
+  const resources = [...node.resources].sort();
+  const total = resources.length + childEntries.length;
+  let i = 0;
+  for (const r of resources) {
+    const last = i === total - 1;
+    lines.push(`${indent}${last ? "└─" : "├─"} ${r}`);
+    i++;
+  }
+  for (const [name, child] of childEntries) {
+    const last = i === total - 1;
+    lines.push(`${indent}${last ? "└─" : "├─"} ${name}`);
+    appendNode(lines, child, `${indent}${last ? "   " : "│  "}`);
+    i++;
+  }
+}
+
+function flatten(prefix: string[], node: StateNode, out: string[]) {
+  for (const r of [...node.resources].sort()) {
+    out.push([...prefix, r].join("/"));
+  }
+  for (const [name, child] of Object.entries(node.children).sort(([a], [b]) =>
+    a.localeCompare(b),
+  )) {
+    flatten([...prefix, name], child, out);
+  }
+}
+
+/**
+ * Run an `alchemy state` subcommand against the configured state store
+ * and exit. Invoked by `alchemy.ts` when the user's program is launched
+ * via `alchemy state ...` — the user's resources are never created.
+ */
+export async function runStateCommand(
+  scope: Scope,
+  command: StateCommand,
+  arg?: string,
+): Promise<never> {
+  if (command === "get") {
+    const fqn = arg;
+    if (!fqn) {
+      console.error("alchemy state get: missing resource fqn");
+      return process.exit(1);
+    }
+    const state = await findByFqn(scope, fqn);
+    if (state === undefined) {
+      console.log(`(not found: ${fqn})`);
+      return process.exit(1);
+    }
+    console.log(JSON.stringify(state, replacer, 2));
+    return process.exit(0);
+  }
+
+  const node = await walk(scope);
+
+  if (command === "list") {
+    const out: string[] = [];
+    flatten(scope.chain, node, out);
+    if (out.length === 0) {
+      console.log("(no resources)");
+    } else {
+      for (const fqn of out) console.log(fqn);
+    }
+    return process.exit(0);
+  }
+
+  // tree
+  const rootName = scope.chain.join("/");
+  if (node.resources.length === 0 && Object.keys(node.children).length === 0) {
+    console.log(`${rootName}\n(empty)`);
+    return process.exit(0);
+  }
+  console.log(renderTree(rootName, node));
+  return process.exit(0);
+}
+
+async function findByFqn(
+  scope: Scope,
+  fqn: string,
+): Promise<State | undefined> {
+  const parts = fqn.split("/").filter(Boolean);
+  // Strip leading chain (app/stage/...) if user passed full fqn
+  const chain = scope.chain;
+  let path = parts;
+  if (parts.length > chain.length && chain.every((c, i) => c === parts[i])) {
+    path = parts.slice(chain.length);
+  }
+  if (path.length === 0) return undefined;
+  let current: Scope = scope;
+  for (let i = 0; i < path.length - 1; i++) {
+    current = new Scope({ parent: current, scopeName: path[i]! });
+  }
+  return current.state.get(path[path.length - 1]!);
+}
+
+function replacer(_key: string, value: unknown) {
+  if (typeof value === "bigint") return value.toString();
+  if (value && typeof value === "object" && (value as any).type === "Buffer") {
+    return "[Buffer]";
+  }
+  return value;
+}

package/src/state.ts

@@ -40,4 +40,6 @@ export interface StateStore {
   all(): Promise<Record<string, State>>;
   set(key: string, value: State): Promise<void>;
   delete(key: string): Promise<void>;
+  /** List names of nested scopes within this scope, if supported. */
+  listScopes?(): Promise<string[]>;
 }

package/workers/cloudflare-state-store.js

@@ -4693,6 +4693,7 @@ var SQLiteStateStoreOperations = class {
 			case "init": return;
 			case "deinit": return;
 			case "list": return this.list();
+			case "listScopes": return this.listScopes();
 			case "count": return this.count();
 			case "get": {
 				const [key] = params;
@@ -4717,6 +4718,22 @@ var SQLiteStateStoreOperations = class {
 	async list() {
 		return (await this.db.select({ id: resources.id }).from(resources).where(eq(resources.scope, this.context.chain))).map((r) => r.id);
 	}
+	async listScopes() {
+		const rows = await this.db.selectDistinct({ scope: resources.scope }).from(resources);
+		const prefix = this.context.chain;
+		const names = /* @__PURE__ */ new Set();
+		for (const row of rows) {
+			const scope = row.scope;
+			if (scope.length !== prefix.length + 1) continue;
+			let matches = true;
+			for (let i = 0; i < prefix.length; i++) if (scope[i] !== prefix[i]) {
+				matches = false;
+				break;
+			}
+			if (matches) names.add(scope[prefix.length]);
+		}
+		return [...names];
+	}
 	async count() {
 		return await this.db.$count(this.db.select().from(resources).where(eq(resources.scope, this.context.chain)));
 	}

package/workers/tunnel-proxy.js

@@ -83,7 +83,7 @@ const renderErrorHtml = (props) => `
             Alchemy</a>.</p>
       </div>
       <div class="bg-slate-200 px-5 py-3 flex flex-col w-full max-w-lg">
-        <p class="text-sm text-slate-500">Alchemy 0.93.4</p>
+        <p class="text-sm text-slate-500">Alchemy 0.93.7</p>
       </div>
     </div>
   </body>