alchemy 2.0.0-beta.75 → 2.0.0-beta.76

package/src/Cloudflare/Email/ImpersonationRegistryEntry.ts

@@ -142,7 +142,15 @@ export const ImpersonationRegistryEntryProvider = () =>
               ),
             ),
           ),
-          Effect.catchTag("EmailSecurityNotEntitled", () =>
+          // Email Security is a paid add-on gated by both account
+          // entitlement and token scope: an unentitled account answers
+          // `EmailSecurityNotEntitled`, while a credential lacking the
+          // Email Security scope (e.g. Cloudflare OAuth) answers a bare
+          // `Forbidden`. Neither can enumerate, so both mean "none
+          // visible" — matching `Domain.list()`. Returning `[]` is the
+          // safe direction for the callers of `list` (orphan detection
+          // never deletes what it cannot see).
+          Effect.catchTag(["EmailSecurityNotEntitled", "Forbidden"], () =>
             Effect.succeed([] as ImpersonationRegistryEntryAttributes[]),
           ),
         );

package/src/Cloudflare/Email/TrustedDomain.ts

@@ -138,7 +138,15 @@ export const TrustedDomainProvider = () =>
               ),
             ),
           ),
-          Effect.catchTag("EmailSecurityNotEntitled", () =>
+          // Email Security is a paid add-on gated by both account
+          // entitlement and token scope: an unentitled account answers
+          // `EmailSecurityNotEntitled`, while a credential lacking the
+          // Email Security scope (e.g. Cloudflare OAuth) answers a bare
+          // `Forbidden`. Neither can enumerate, so both mean "none
+          // visible" — matching `Domain.list()`. Returning `[]` is the
+          // safe direction for the callers of `list` (orphan detection
+          // never deletes what it cannot see).
+          Effect.catchTag(["EmailSecurityNotEntitled", "Forbidden"], () =>
             Effect.succeed([] as TrustedDomainAttributes[]),
           ),
         );

package/src/Cloudflare/Workers/Assets.ts

@@ -1,4 +1,5 @@
 import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as wfp from "@distilled.cloud/cloudflare/workers-for-platforms";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
@@ -428,10 +429,10 @@ export const uploadAssets = Effect.fn(function* (
   workerName: string,
   assets: AssetReadResult,
   { note }: ScopedPlanStatusSession,
+  dispatchNamespace?: string,
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const createScriptAssetUpload = yield* workers.createScriptAssetUpload;
   const createAssetUpload = yield* workers.createAssetUpload;
 
   // Manifest keys are the paths Cloudflare *serves*, so they carry the
@@ -463,11 +464,18 @@ export const uploadAssets = Effect.fn(function* (
   // the completion JWT directly.
   const runSession = Effect.fn(function* () {
     yield* note("Checking assets...");
-    const session = yield* createScriptAssetUpload({
-      accountId,
-      scriptName: workerName,
-      manifest: assets.manifest,
-    });
+    const session = dispatchNamespace
+      ? yield* wfp.createDispatchNamespaceScriptAssetUpload({
+          accountId,
+          dispatchNamespace,
+          scriptName: workerName,
+          manifest: assets.manifest,
+        })
+      : yield* workers.createScriptAssetUpload({
+          accountId,
+          scriptName: workerName,
+          manifest: assets.manifest,
+        });
     if (!session.buckets?.length) {
       if (!session.jwt) {
         return yield* new AssetUploadSessionError({

package/src/Cloudflare/Workers/WorkerProvider.ts

@@ -3234,6 +3234,7 @@ export const LiveWorkerProvider = () =>
               name,
               assets,
               session,
+              dispatchNamespace,
             );
             metadataAssets = {
               jwt,

package/src/Command/Dev.ts

@@ -218,7 +218,15 @@ const ANSI_REGEX = /\x1b\[[0-9;]*m/g;
  */
 export const extractUrl = (text: string) => {
   const clean = text.replaceAll(ANSI_REGEX, "");
-  return clean.match(LOCAL_URL_REGEX)?.[0] ?? clean.match(URL_REGEX)?.[0];
+  const url = clean.match(LOCAL_URL_REGEX)?.[0] ?? clean.match(URL_REGEX)?.[0];
+  // Some dev servers print their *bind* address (Nuxt: `http://0.0.0.0:3000`),
+  // which is not a connectable host. Normalize the unspecified address to
+  // `localhost` so consumers of `url` — browser links, Router dev routing,
+  // the emulated CloudFront edge dialing the origin — can actually reach it.
+  return url?.replace(
+    /^(https?:\/\/)(?:0\.0\.0\.0|\[::\]|\[0+:0+:0+:0+:0+:0+:0+:0+\])(?=[:/]|$)/,
+    "$1localhost",
+  );
 };
 
 const isLocalUrl = (url: string) => LOCAL_URL_REGEX.test(url);

package/src/Planetscale/Postgres/PostgresDefaultRole.ts

@@ -64,6 +64,14 @@ export interface PostgresDefaultRoleAttributes {
   connectionUrl: Redacted.Redacted<string>;
   /** Pooled connection URL via PSBouncer (Redacted). */
   connectionUrlPooled: Redacted.Redacted<string>;
+  /**
+   * Private connection host or DNS zone for this branch, supplied by
+   * PlanetScale. GCP Private Service Connect requires an endpoint name before
+   * this DNS zone.
+   */
+  privateHost: string;
+  /** Service name for this branch supplied by PlanetScale to establish a private connection. */
+  privateConnectionServiceName: string;
   /** Inherited roles. */
   inheritedRoles: InheritedRole[];
   /** Resolved organization slug. */
@@ -144,7 +152,11 @@ export const PostgresDefaultRoleProvider = () =>
           branch: output.branch,
         })
         .pipe(
-          Effect.map(() => output),
+          Effect.map((role) => ({
+            ...output,
+            privateHost: role.private_access_host_url,
+            privateConnectionServiceName: role.private_connection_service_name,
+          })),
           Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
         );
     }),
@@ -171,11 +183,16 @@ export const PostgresDefaultRoleProvider = () =>
 
       // 2. Sync (no-op) — we own the role and it still exists in the
       //    cloud. Default roles have nothing mutable in place: their
-      //    plaintext password isn't retrievable, so we re-emit the
-      //    persisted attributes unchanged. diff() forces a replace
-      //    when database/branch change.
+      //    plaintext password isn't retrievable, so we retain the cached
+      //    credentials while refreshing the private connection details.
+      //    diff() forces a replace when database/branch change.
       if (output && observed) {
-        return output;
+        return {
+          ...output,
+          privateHost: observed.private_access_host_url,
+          privateConnectionServiceName:
+            observed.private_connection_service_name,
+        };
       }
 
       // 3. Adoption guard — observed exists but we have no prior
@@ -225,6 +242,8 @@ export const PostgresDefaultRoleProvider = () =>
         databaseName: data.database_name,
         connectionUrl: Redacted.make(connectionUrl),
         connectionUrlPooled: Redacted.make(connectionUrlPooled),
+        privateHost: data.private_access_host_url,
+        privateConnectionServiceName: data.private_connection_service_name,
         inheritedRoles: data.inherited_roles as InheritedRole[],
         organization,
         database: databaseName,
@@ -290,6 +309,9 @@ export const PostgresDefaultRoleProvider = () =>
                                     databaseName: role.database_name,
                                     connectionUrl: Redacted.make(""),
                                     connectionUrlPooled: Redacted.make(""),
+                                    privateHost: role.private_access_host_url,
+                                    privateConnectionServiceName:
+                                      role.private_connection_service_name,
                                     inheritedRoles:
                                       role.inherited_roles as InheritedRole[],
                                     organization,

package/src/Planetscale/Postgres/PostgresRole.ts

@@ -117,6 +117,14 @@ export interface PostgresRoleAttributes {
   origin: PostgresOrigin;
   /** Parsed pooled (PSBouncer, port 6432) connection components, e.g. for a Hyperdrive `dev` origin. */
   pooledOrigin: PostgresOrigin;
+  /**
+   * Private connection host or DNS zone for this branch, supplied by
+   * PlanetScale. GCP Private Service Connect requires an endpoint name before
+   * this DNS zone.
+   */
+  privateHost: string;
+  /** Service name for this branch supplied by PlanetScale to establish a private connection. */
+  privateConnectionServiceName: string;
   /** Direct connection URL for the database (Redacted). */
   connectionUrl: Redacted.Redacted<string>;
   /** Pooled connection URL via PSBouncer (port 6432, Redacted). */
@@ -495,6 +503,8 @@ const buildAttributes = (
     name: string;
     expires_at: string | null;
     access_host_url: string;
+    private_access_host_url: string;
+    private_connection_service_name: string;
     username: string;
     database_name: string;
     ttl: number | null;
@@ -521,6 +531,8 @@ const buildAttributes = (
     password,
     connectionUrl: Redacted.make(connectionUrl),
     connectionUrlPooled: Redacted.make(connectionUrlPooled),
+    privateHost: role.private_access_host_url,
+    privateConnectionServiceName: role.private_connection_service_name,
     inheritedRoles: context.inheritedRoles,
     successor: context.successor,
     organization: context.organization,

package/src/Website/Server.ts

@@ -456,6 +456,21 @@ const resolveDevPort = Effect.fn(function* (options: {
   );
 });
 
+/**
+ * A framework dev server may advertise its *bind* address — nuxt echoes the
+ * host it was told to listen on, so a Router-attached site (which binds
+ * `0.0.0.0` to be reachable from the emulator container) reports
+ * `http://0.0.0.0:{port}/`. The unspecified address is not a connectable
+ * host: normalize it to `localhost` for the `url` attribute (browser links,
+ * Router dev routing, the emulated CloudFront edge dialing the origin). The
+ * server itself still listens on every interface.
+ */
+const normalizeAdvertisedUrl = (url: string) =>
+  url.replace(
+    /^(https?:\/\/)(?:0\.0\.0\.0|\[::\]|\[0+(?::0+){7}\])(?=[:/]|$)/,
+    "$1localhost",
+  );
+
 /**
  * The `alchemy dev` variant: runs the framework's own dev server (native
  * HMR through the framework's kit — nuxt, astro, ...) inside the dev
@@ -536,7 +551,7 @@ export const ServerProviderLocal = () =>
             distDir: undefined,
             clientDir: undefined,
             serverEntry: undefined,
-            url,
+            url: normalizeAdvertisedUrl(url),
             hash: { input: undefined, output: undefined },
           };
         }),