alchemy 2.0.0-beta.10 → 2.0.0-beta.13

package/src/Cloudflare/Container/ContainerApplication.ts

@@ -31,58 +31,60 @@ import * as Server from "../../Server/index.ts";
 import { Stack } from "../../Stack.ts";
 import { sha256Object } from "../../Util/sha256.ts";
 import { normalizeNulls } from "../../Util/stable.ts";
-import { Account } from "../Account.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import { CloudflareLogs, type TelemetryFilter } from "../Logs.ts";
 import type { Providers } from "../Providers.ts";
 import { Container, ContainerTypeId } from "./Container.ts";
 
 export { Credentials } from "@distilled.cloud/cloudflare/Credentials";
 
-export type InstanceType = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["instanceType"]
->;
-export type SchedulingPolicy = NonNullable<
-  Containers.CreateContainerApplicationRequest["schedulingPolicy"]
->;
-export type Observability = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["observability"]
->;
-export type Secret = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["secrets"]
->[number];
-export type Disk = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["disk"]
->;
-export type EnvironmentVariable = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["environmentVariables"]
->[number];
-export type Label = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["labels"]
->[number];
-export type Network = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["network"]
->;
-export type Dns = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["dns"]
->;
-export type Port = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["ports"]
->[number];
-export type Check = NonNullable<
-  Containers.CreateContainerApplicationRequest["configuration"]["checks"]
->[number];
-export type Constraints = {
-  tier?: number;
-};
-export type Affinities = {
-  colocation?: "datacenter";
-};
-export type Configuration =
-  Containers.CreateContainerApplicationRequest["configuration"];
-export interface Rollout {
-  strategy?: "rolling" | "immediate";
-  kind?: "full_auto";
-  stepPercentage?: number;
+export namespace ContainerApplication {
+  export type InstanceType = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["instanceType"]
+  >;
+  export type SchedulingPolicy = NonNullable<
+    Containers.CreateContainerApplicationRequest["schedulingPolicy"]
+  >;
+  export type Observability = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["observability"]
+  >;
+  export type Secret = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["secrets"]
+  >[number];
+  export type Disk = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["disk"]
+  >;
+  export type EnvironmentVariable = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["environmentVariables"]
+  >[number];
+  export type Label = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["labels"]
+  >[number];
+  export type Network = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["network"]
+  >;
+  export type Dns = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["dns"]
+  >;
+  export type Port = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["ports"]
+  >[number];
+  export type Check = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["checks"]
+  >[number];
+  export type Constraints = {
+    tier?: number;
+  };
+  export type Affinities = {
+    colocation?: "datacenter";
+  };
+  export type Configuration =
+    Containers.CreateContainerApplicationRequest["configuration"];
+  export interface Rollout {
+    strategy?: "rolling" | "immediate";
+    kind?: "full_auto";
+    stepPercentage?: number;
+  }
 }
 
 export interface ContainerApplicationProps extends PlatformProps {
@@ -102,6 +104,32 @@ export interface ContainerApplicationProps extends PlatformProps {
    * @default "bun"
    */
   runtime?: "bun" | "node";
+  /**
+   * Module specifiers that Rolldown should mark as external when bundling
+   * the container entrypoint. The matching packages are installed inside the
+   * image via the runtime's package manager (`bun add` for `runtime: "bun"`,
+   * `npm install` for `runtime: "node"`) before the entrypoint runs.
+   *
+   * Use this for native dependencies that must not be bundled (e.g. `sharp`,
+   * `impit`) or for packages that intentionally ship in the base image.
+   *
+   * Install inside the image is controlled by {@link autoInstallExternals}
+   * (default `true`); set it to `false` if your custom `dockerfile` already
+   * installs these packages and you want to avoid the redundant step.
+   */
+  external?: string[];
+  /**
+   * Whether to auto-install the packages listed in {@link external} inside
+   * the container image (via `bun add` or `npm install`) before running the
+   * entrypoint.
+   *
+   * @default true
+   *
+   * Set to `false` when your custom `dockerfile` already installs these
+   * packages (for example, via a base image that pre-installs `sharp`), to
+   * avoid the redundant install step.
+   */
+  autoInstallExternals?: boolean;
   /**
    * Human-readable application name. If omitted, Alchemy derives a deterministic
    * physical name from the stack, stage, and logical ID.
@@ -127,16 +155,16 @@ export interface ContainerApplicationProps extends PlatformProps {
    * Scheduling policy used by Cloudflare's containers control plane.
    * @default "default"
    */
-  schedulingPolicy?: SchedulingPolicy;
+  schedulingPolicy?: ContainerApplication.SchedulingPolicy;
   /**
    * Instance type for each deployment.
    * @default "dev"
    */
-  instanceType?: InstanceType;
+  instanceType?: ContainerApplication.InstanceType;
   /**
    * Observability settings for the deployment.
    */
-  observability?: Observability;
+  observability?: ContainerApplication.Observability;
   /**
    * SSH public keys to install into the deployment.
    */
@@ -144,7 +172,7 @@ export interface ContainerApplicationProps extends PlatformProps {
   /**
    * Secrets exposed to the container runtime as environment variables.
    */
-  secrets?: Secret[];
+  secrets?: ContainerApplication.Secret[];
   /**
    * CPU allocation override for each deployment.
    */
@@ -156,19 +184,19 @@ export interface ContainerApplicationProps extends PlatformProps {
   /**
    * Disk allocation override for each deployment.
    */
-  disk?: Disk;
+  disk?: ContainerApplication.Disk;
   /**
    * Plain environment variables passed to the container runtime.
    */
-  environmentVariables?: EnvironmentVariable[];
+  environmentVariables?: ContainerApplication.EnvironmentVariable[];
   /**
    * Labels attached to the deployment.
    */
-  labels?: Label[];
+  labels?: ContainerApplication.Label[];
   /**
    * Network configuration for the deployment.
    */
-  network?: Network;
+  network?: ContainerApplication.Network;
   /**
    * Command override for the container image.
    */
@@ -180,27 +208,27 @@ export interface ContainerApplicationProps extends PlatformProps {
   /**
    * DNS configuration for the deployment.
    */
-  dns?: Dns;
+  dns?: ContainerApplication.Dns;
   /**
    * Exposed ports for the deployment.
    */
-  ports?: Port[];
+  ports?: ContainerApplication.Port[];
   /**
    * Health and readiness checks for the deployment.
    */
-  checks?: Check[];
+  checks?: ContainerApplication.Check[];
   /**
    * Resource constraints for the application.
    */
-  constraints?: Constraints;
+  constraints?: ContainerApplication.Constraints;
   /**
    * Affinity hints for scheduling.
    */
-  affinities?: Affinities;
+  affinities?: ContainerApplication.Affinities;
   /**
    * Progressive rollout settings applied after updates.
    */
-  rollout?: Rollout;
+  rollout?: ContainerApplication.Rollout;
   /**
    * Container registry host to use for generated Dockerfile builds.
    * @default "registry.cloudflare.com"
@@ -233,12 +261,12 @@ export interface ContainerApplication<Shape = unknown> extends Resource<
     applicationId: string;
     applicationName: string;
     accountId: string;
-    schedulingPolicy: SchedulingPolicy;
+    schedulingPolicy: ContainerApplication.SchedulingPolicy;
     instances: number;
     maxInstances: number;
-    constraints: Constraints | undefined;
-    affinities: Affinities | undefined;
-    configuration: Configuration;
+    constraints: ContainerApplication.Constraints | undefined;
+    affinities: ContainerApplication.Affinities | undefined;
+    configuration: ContainerApplication.Configuration;
     durableObjects:
       | {
           namespaceId: string;
@@ -327,7 +355,7 @@ export const ContainerProvider = () =>
     Container,
     Effect.gen(function* () {
       const stack = yield* Stack;
-      const accountId = yield* Account;
+      const { accountId } = yield* CloudflareEnvironment;
       const adoptPolicy = yield* Effect.serviceOption(AdoptPolicy).pipe(
         Effect.map(Option.getOrElse(() => false)),
       );
@@ -397,7 +425,7 @@ export const ContainerProvider = () =>
           dns: props.dns,
           ports: props.ports,
           checks: props.checks,
-        }) as Configuration;
+        }) as ContainerApplication.Configuration;
 
       const computeImageHash = Effect.fnUntraced(function* (
         id: string,
@@ -410,15 +438,21 @@ export const ContainerProvider = () =>
           );
         }
         const runtime = props.runtime ?? "bun";
-        const { code, hash: bundleHash } = yield* bundleProgram({
+        const { files, hash: bundleHash } = yield* bundleProgram({
           id,
           main,
           runtime,
           handler: props.handler,
           isExternal: props.isExternal,
+          external: props.external,
         });
 
-        const finalDockerfile = buildFinalDockerfile(props.dockerfile, runtime);
+        const finalDockerfile = buildFinalDockerfile(
+          props.dockerfile,
+          runtime,
+          props.external,
+          props.autoInstallExternals,
+        );
         const imageHash = (yield* sha256Object({
           bundleHash,
           dockerfile: finalDockerfile,
@@ -429,7 +463,7 @@ export const ContainerProvider = () =>
         const repositoryName = name.toLowerCase();
         const imageRef = `${registryId}/${accountId}/${repositoryName}:${imageHash}`;
 
-        return { code, imageRef, imageHash };
+        return { files, imageRef, imageHash };
       });
 
       const bundleProgram = Effect.fnUntraced(function* ({
@@ -437,12 +471,14 @@ export const ContainerProvider = () =>
         runtime,
         handler = "default",
         isExternal = false,
+        external = [],
       }: {
         id: string;
         main: string;
         runtime: "bun" | "node";
         handler: string | undefined;
         isExternal?: boolean;
+        external?: string[];
       }) {
         const realMain = yield* fs.realPath(main);
         const cwd = yield* findCwdForBundle(realMain);
@@ -459,6 +495,7 @@ export const ContainerProvider = () =>
                 "cloudflare:workers",
                 "cloudflare:workflows",
                 ...(runtime === "bun" ? ["bun", "bun:*"] : []),
+                ...external,
               ],
               platform: "node",
               plugins,
@@ -549,28 +586,49 @@ await Effect.runPromise(serverEffect).catch((err) => {
               ),
             );
 
-        const mainFile = bundleOutput.files[0];
-        const code =
-          typeof mainFile.content === "string"
-            ? new TextEncoder().encode(mainFile.content)
-            : mainFile.content;
-
-        return { code, hash: bundleOutput.hash };
+        // Rolldown can emit multiple chunk files (entry + shared chunks).
+        // Return every file so downstream code can materialize all of them
+        // into the Docker build context — dropping any of them produces a
+        // `Cannot find module './chunk-XXX.js'` runtime crash inside the
+        // container (with zero stdout, because it crashes before any user
+        // code runs).
+        const files = bundleOutput.files.map((f) => ({
+          path: f.path,
+          content:
+            typeof f.content === "string"
+              ? new TextEncoder().encode(f.content)
+              : f.content,
+        }));
+
+        return { files, hash: bundleOutput.hash };
       });
 
       const buildFinalDockerfile = (
         userDockerfile: string | undefined,
         runtime: "bun" | "node",
+        external: string[] = [],
+        autoInstallExternals = true,
       ): string => {
         const base =
           userDockerfile?.trim() ??
           (runtime === "bun" ? "FROM oven/bun:1" : "FROM node:22-slim");
         const runtimeBin = runtime === "bun" ? "bun" : "node";
+        const installCmd = runtime === "bun" ? "bun add" : "npm install";
+        const installStep =
+          autoInstallExternals && external.length > 0
+            ? `RUN ${installCmd} ${external.join(" ")}`
+            : "";
         return [
           base,
           "",
           "WORKDIR /app",
+          ...(installStep ? [installStep, ""] : []),
           "COPY index.mjs /app/index.mjs",
+          // Copy any additional rolldown chunks (`chunk-XXX.js`,
+          // `BunServices-YYY.js`, …). The glob matches zero or more files;
+          // non-trivial bundles always emit at least one chunk, minimal
+          // bundles emit none and the COPY no-ops.
+          "COPY *.js /app/",
           `ENTRYPOINT ["${runtimeBin}", "/app/index.mjs"]`,
           "",
         ].join("\n");
@@ -579,7 +637,7 @@ await Effect.runPromise(serverEffect).catch((err) => {
       const buildAndPushImage = Effect.fnUntraced(function* (
         id: string,
         props: ContainerApplicationProps,
-        code: Uint8Array,
+        files: ReadonlyArray<{ path: string; content: Uint8Array }>,
         imageRef: string,
         session?: { note: (message: string) => Effect.Effect<void> },
       ) {
@@ -597,11 +655,24 @@ await Effect.runPromise(serverEffect).catch((err) => {
           dotAlchemy,
           `${id}-container`,
         );
-        const finalDockerfile = buildFinalDockerfile(props.dockerfile, runtime);
+        const finalDockerfile = buildFinalDockerfile(
+          props.dockerfile,
+          runtime,
+          props.external,
+          props.autoInstallExternals,
+        );
         yield* materializeDockerfile(finalDockerfile, contextDir);
-        yield* writeContextFiles(contextDir, [
-          { path: "index.mjs", content: code },
-        ]);
+        yield* writeContextFiles(
+          contextDir,
+          files.map((f, i) => ({
+            // Keep the entry rename to `index.mjs` so the Dockerfile
+            // ENTRYPOINT (`ENTRYPOINT ["bun", "/app/index.mjs"]`) stays
+            // valid; preserve rolldown-assigned fileNames for every other
+            // chunk so intra-bundle relative imports resolve at runtime.
+            path: i === 0 ? "index.mjs" : f.path,
+            content: f.content,
+          })),
+        );
         yield* dockerBuild({
           tag: imageRef,
           context: contextDir,
@@ -644,8 +715,8 @@ await Effect.runPromise(serverEffect).catch((err) => {
         rollout,
       }: {
         applicationId: string;
-        configuration: Configuration;
-        rollout: Rollout | undefined;
+        configuration: ContainerApplication.Configuration;
+        rollout: ContainerApplication.Rollout | undefined;
       }) {
         const strategy = rollout?.strategy ?? "immediate";
         const stepPercentage =
@@ -680,7 +751,7 @@ await Effect.runPromise(serverEffect).catch((err) => {
         id: string;
         news: ContainerApplicationProps;
         name: string;
-        configuration: Configuration;
+        configuration: ContainerApplication.Configuration;
         durableObjects:
           | {
               namespaceId: string;
@@ -821,11 +892,14 @@ await Effect.runPromise(serverEffect).catch((err) => {
         yield* Effect.logInfo(
           `Cloudflare Container update: preparing ${existing.applicationName}`,
         );
-        const { code, imageRef, imageHash } = yield* computeImageHash(id, news);
+        const { files, imageRef, imageHash } = yield* computeImageHash(
+          id,
+          news,
+        );
         const configuration = desiredConfiguration(news, imageRef);
 
         if (imageHash !== existing.hash?.image) {
-          yield* buildAndPushImage(id, news, code, imageRef, session);
+          yield* buildAndPushImage(id, news, files, imageRef, session);
         }
 
         yield* session.note(
@@ -927,12 +1001,12 @@ await Effect.runPromise(serverEffect).catch((err) => {
             `Cloudflare Container precreate: starting ${name}`,
           );
 
-          const { code, imageRef, imageHash } = yield* computeImageHash(
+          const { files, imageRef, imageHash } = yield* computeImageHash(
             id,
             news,
           );
           const configuration = desiredConfiguration(news, imageRef);
-          yield* buildAndPushImage(id, news, code, imageRef, session);
+          yield* buildAndPushImage(id, news, files, imageRef, session);
 
           // Precreate intentionally omits the Durable Object attachment so the
           // worker can bind to this application id and break the circular
@@ -967,7 +1041,7 @@ await Effect.runPromise(serverEffect).catch((err) => {
             `Cloudflare Container create: starting ${name}${adoptPolicy ? " with adopt" : ""}`,
           );
           const durableObjects = yield* getDurableObjects(bindings);
-          const { code, imageRef, imageHash } = yield* computeImageHash(
+          const { files, imageRef, imageHash } = yield* computeImageHash(
             id,
             news,
           );
@@ -1019,7 +1093,7 @@ await Effect.runPromise(serverEffect).catch((err) => {
               ),
             );
             if (imageHash !== output.hash?.image) {
-              yield* buildAndPushImage(id, news, code, imageRef, session);
+              yield* buildAndPushImage(id, news, files, imageRef, session);
             }
             const result = yield* createApplication({
               id,
@@ -1044,7 +1118,7 @@ await Effect.runPromise(serverEffect).catch((err) => {
             });
           }
 
-          yield* buildAndPushImage(id, news, code, imageRef, session);
+          yield* buildAndPushImage(id, news, files, imageRef, session);
 
           const result = yield* createApplication({
             id,
@@ -1169,10 +1243,14 @@ const toAttributes = (
   instances: application.instances,
   maxInstances: application.maxInstances,
   constraints: normalizeNulls(
-    application.constraints as Constraints | undefined,
+    application.constraints as ContainerApplication.Constraints | undefined,
+  ),
+  affinities: normalizeNulls(
+    application.affinities as ContainerApplication.Affinities | undefined,
+  ),
+  configuration: normalizeNulls(
+    application.configuration as ContainerApplication.Configuration,
   ),
-  affinities: normalizeNulls(application.affinities as Affinities | undefined),
-  configuration: normalizeNulls(application.configuration as Configuration),
   durableObjects: normalizeNulls(application.durableObjects) as
     | { namespaceId: string }
     | undefined,

package/src/Cloudflare/Credentials.ts

@@ -0,0 +1,75 @@
+import {
+  apiKeyCredentials,
+  apiTokenCredentials,
+  Credentials,
+  oauthCredentials,
+} from "@distilled.cloud/cloudflare/Credentials";
+import { ConfigError } from "@distilled.cloud/core/errors";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import { getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, loadOrConfigure } from "../Auth/Profile.ts";
+import {
+  CLOUDFLARE_AUTH_PROVIDER_NAME,
+  type CloudflareAuthConfig,
+  type CloudflareResolvedCredentials,
+} from "./Auth/AuthProvider.ts";
+
+export { Credentials, fromEnv } from "@distilled.cloud/cloudflare/Credentials";
+
+/**
+ * Build a `Credentials` layer that resolves Cloudflare credentials via the
+ * Alchemy AuthProvider using the configured profile (defaults to "default",
+ * overridable with the `ALCHEMY_PROFILE` env/config value).
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    Credentials,
+    Effect.gen(function* () {
+      const auth = yield* getAuthProvider<
+        CloudflareAuthConfig,
+        CloudflareResolvedCredentials
+      >(CLOUDFLARE_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const ctx = yield* Effect.context<never>();
+
+      return loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as CloudflareAuthConfig),
+        ),
+        Effect.map((creds) =>
+          Match.value(creds).pipe(
+            Match.when({ type: "apiToken" }, (c) =>
+              apiTokenCredentials({
+                apiToken: Redacted.value(c.apiToken),
+              }),
+            ),
+            Match.when({ type: "apiKey" }, (c) =>
+              apiKeyCredentials({
+                apiKey: Redacted.value(c.apiKey),
+                email: Redacted.value(c.email),
+              }),
+            ),
+            Match.when({ type: "oauth" }, (c) =>
+              oauthCredentials({
+                accessToken: Redacted.value(c.accessToken),
+                expiresAt: c.expires,
+              }),
+            ),
+            Match.exhaustive,
+          ),
+        ),
+        Effect.mapError(
+          (e) =>
+            new ConfigError({
+              message: `Failed to resolve Cloudflare credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+        Effect.provide(ctx),
+      );
+    }),
+  );

package/src/Cloudflare/D1/D1Database.ts

@@ -5,7 +5,7 @@ import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import { Account } from "../Account.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 
 export type Jurisdiction = "default" | "eu" | "fedramp";
@@ -95,7 +95,7 @@ export const DatabaseProvider = () =>
   Provider.effect(
     D1Database,
     Effect.gen(function* () {
-      const accountId = yield* Account;
+      const { accountId } = yield* CloudflareEnvironment;
       const createDb = yield* d1.createDatabase;
       const getDb = yield* d1.getDatabase;
       const patchDb = yield* d1.patchDatabase;

package/src/Cloudflare/KV/KVNamespace.ts

@@ -4,7 +4,7 @@ import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import { Account } from "../Account.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
 import type { Providers } from "../Providers.ts";
 import { KVNamespaceBinding } from "./KVNamespaceBinding.ts";
 
@@ -63,7 +63,7 @@ export const KVNamespaceProvider = () =>
   Provider.effect(
     KVNamespace,
     Effect.gen(function* () {
-      const accountId = yield* Account;
+      const { accountId } = yield* CloudflareEnvironment;
       const createNamespace = yield* kv.createNamespace;
       const updateNamespace = yield* kv.updateNamespace;
       const deleteNamespace = yield* kv.deleteNamespace;