alepha 0.22.0 → 0.24.0

package/src/cli/platform-lib/adapters/CloudflareAdapter.ts

@@ -82,13 +82,11 @@ export class CloudflareAdapter extends PlatformAdapter {
     command: string,
     options: Parameters<ShellProvider["run"]>[1] = {},
   ) {
-    const capture = options.capture;
-    const output = await this.shell.run(command, {
-      ...options,
-      capture: capture ?? this.runner.useDynamicLogger,
-    });
+    const output = await this.shell.run(command, options);
 
-    if (capture && !this.runner.useDynamicLogger) {
+    // When the caller captured the output, echo it to the log so the user
+    // still sees it (uncaptured commands stream straight to the terminal).
+    if (options.capture) {
       this.log.info(output);
     }
 
@@ -104,7 +102,7 @@ export class CloudflareAdapter extends PlatformAdapter {
     await run({
       name: "authenticate",
       handler: async () => {
-        await this.wrangler.ensureInstalled(ctx.root, run);
+        await this.wrangler.ensureInstalled(ctx.root);
 
         // Always validate the token — refresh tokens can expire between runs
         // even when the cache TTL hasn't elapsed.
@@ -117,9 +115,7 @@ export class CloudflareAdapter extends PlatformAdapter {
         }
 
         if (needsLogin) {
-          run.pause();
           await this.wrangler.login();
-          run.resume();
         }
 
         // Skip account resolution if cache is fresh
@@ -186,11 +182,9 @@ export class CloudflareAdapter extends PlatformAdapter {
     // via tenantDomain's third arg.)
     const host = tenantDomain(ctx.envConfig.domain, ctx.tenant);
     if (host) {
-      if (host.includes("*") && !ctx.envConfig.zone) {
-        throw new AlephaError(
-          `Wildcard domain "${host}" requires "zone" to be set in the environment config (the Cloudflare zone name, e.g. "alepha.dev").`,
-        );
-      }
+      // A wildcard host needs a CF zone for its Worker route, but `zone` is
+      // optional: when omitted the build derives it from the domain's last two
+      // labels (BuildCloudflareTask). Set it only to override that default.
       env.CLOUDFLARE_DOMAIN = host;
       if (ctx.envConfig.zone) {
         env.CLOUDFLARE_ZONE = ctx.envConfig.zone;
@@ -201,6 +195,11 @@ export class CloudflareAdapter extends PlatformAdapter {
       env.CLOUDFLARE_JURISDICTION = ctx.envConfig.jurisdiction;
     }
 
+    // Worker-to-worker service bindings (see EnvironmentConfig.services).
+    if (ctx.envConfig.services?.length) {
+      env.CLOUDFLARE_SERVICES = JSON.stringify(ctx.envConfig.services);
+    }
+
     // Two paths:
     //  - `--prebuilt`: in-process call to BuildCloudflareTask. Reads
     //    `dist/manifest.json` for resources/crons/containers, reads
@@ -1016,8 +1015,10 @@ export class CloudflareAdapter extends PlatformAdapter {
       });
     }
 
-    // 5. Delete R2 bucket (must be emptied first — Cloudflare's REST DELETE
-    // rejects non-empty buckets with `BucketNotEmpty`)
+    // 5. Delete R2 bucket. An empty bucket is removed by the REST DELETE
+    // directly; only a non-empty one needs an S3 wipe first. Crucially the
+    // wipe is NOT a precondition of the delete — a wipe that can't run (no
+    // creds) must never strand an otherwise-deletable bucket.
     const needsBucket = ctx.resources.hasBucket;
     if (needsBucket) {
       const name = ctx.naming.r2();
@@ -1025,14 +1026,10 @@ export class CloudflareAdapter extends PlatformAdapter {
         name: `delete r2 ${name}`,
         handler: async () => {
           try {
-            await this.wipeR2Bucket(name, ctx);
-            await this.api.deleteR2(name);
+            await this.deleteR2Bucket(name, ctx);
           } catch (error: any) {
             const msg = String(error.message || "");
-            if (
-              msg.includes("does not exist") ||
-              msg.includes("NoSuchBucket")
-            ) {
+            if (this.isMissingBucketError(msg)) {
               this.log.debug(`Bucket ${name} not found — skipping.`);
             } else {
               this.log.warn(`Failed to delete r2 ${name}: ${msg}`);
@@ -1128,15 +1125,86 @@ export class CloudflareAdapter extends PlatformAdapter {
     await this.api.createR2(name);
   }
 
+  /** Whether a Cloudflare error message indicates the bucket is already gone. */
+  protected isMissingBucketError(msg: string): boolean {
+    return (
+      msg.includes("does not exist") ||
+      msg.includes("NoSuchBucket") ||
+      msg.includes("bucket not found")
+    );
+  }
+
+  /**
+   * Resolve S3 credentials for wiping an R2 bucket over the S3 protocol.
+   *
+   * Prefers the account's R2 S3 credentials from the environment
+   * (`S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY`) — these are already
+   * provisioned for the deploy (artifact registry) and are account-scoped,
+   * so they can empty any bucket without minting anything. Returns `null`
+   * when not configured, letting the caller fall back to token minting.
+   */
+  protected resolveR2Credentials(): {
+    accessKeyId: string;
+    secretAccessKey: string;
+  } | null {
+    const accessKeyId = process.env.S3_ACCESS_KEY_ID;
+    const secretAccessKey = process.env.S3_SECRET_ACCESS_KEY;
+    if (accessKeyId && secretAccessKey) {
+      return { accessKeyId, secretAccessKey };
+    }
+    return null;
+  }
+
+  /**
+   * Delete an R2 bucket, emptying it first only when necessary.
+   *
+   * Cloudflare's REST `DELETE /r2/buckets/:name` succeeds on an empty bucket
+   * but rejects a non-empty one. So we attempt the delete directly (the
+   * common teardown case — no objects, no creds needed), and only on failure
+   * empty the bucket over the S3 protocol and retry. A missing bucket is a
+   * no-op, so teardown is idempotent.
+   */
+  protected async deleteR2Bucket(
+    name: string,
+    ctx: PlatformContext,
+  ): Promise<void> {
+    try {
+      await this.api.deleteR2(name);
+      return;
+    } catch (error: any) {
+      const msg = String(error.message || "");
+      if (this.isMissingBucketError(msg)) {
+        return; // already gone
+      }
+      // Most often the bucket is non-empty — empty it then retry once.
+      this.log.debug(
+        `Direct delete of r2 ${name} failed (${msg}); emptying then retrying.`,
+      );
+    }
+
+    await this.wipeR2Bucket(name, ctx);
+
+    try {
+      await this.api.deleteR2(name);
+    } catch (error: any) {
+      const msg = String(error.message || "");
+      if (this.isMissingBucketError(msg)) {
+        return;
+      }
+      throw error;
+    }
+  }
+
   /**
    * Empty an R2 bucket via the S3-compatible API.
    *
-   * Cloudflare's REST `DELETE /r2/buckets/:name` rejects non-empty buckets
-   * with `BucketNotEmpty`, and the REST API has no object-level endpoints —
-   * objects must be listed and deleted over the S3 protocol. To avoid
-   * making users pre-create R2 access keys, we mint a short-lived
-   * bucket-scoped API token using the wrangler bearer token, wipe the
-   * bucket with `s3mini`, then revoke the token.
+   * Cloudflare's REST API has no object-level endpoints — objects must be
+   * listed and deleted over the S3 protocol. We use the account's R2 S3
+   * credentials (`S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY`) when present;
+   * otherwise we fall back to minting a short-lived bucket-scoped token via
+   * the CF API (requires a user-scoped `CLOUDFLARE_API_TOKEN`) and revoke it
+   * after. When neither is available the wipe is skipped with a warning —
+   * the caller still attempts the delete, which succeeds for empty buckets.
    *
    * Also aborts any pending multipart uploads — those count as bucket
    * contents from R2's perspective and would otherwise block the delete.
@@ -1145,20 +1213,40 @@ export class CloudflareAdapter extends PlatformAdapter {
     bucketName: string,
     ctx: PlatformContext,
   ): Promise<void> {
-    // `createR2Token` calls `POST /accounts/:id/tokens`, which requires
-    // `User → API Tokens → Edit` — only granted on user-level tokens.
-    // A standard account-scoped `CLOUDFLARE_API_TOKEN` 401s on that path,
-    // and the wrangler OAuth bearer doesn't carry the scope either. Without
-    // either, we can't mint the bucket-scoped S3 creds the wipe needs, so
-    // skip and leave the bucket for manual deletion in the dashboard.
-    if (!process.env.CLOUDFLARE_API_TOKEN) {
-      this.log.warn(
-        `Skipping R2 wipe for ${bucketName}: CLOUDFLARE_API_TOKEN not set. Delete the bucket manually in the Cloudflare dashboard.`,
-      );
-      return;
+    let creds = this.resolveR2Credentials();
+    let mintedTokenId: string | undefined;
+
+    if (!creds) {
+      // No env S3 creds — try minting a bucket-scoped token. This needs a
+      // user-scoped `CLOUDFLARE_API_TOKEN`; an account-scoped one (or the
+      // wrangler OAuth bearer) can't mint, so we skip rather than throw and
+      // let the caller's delete attempt proceed (fine for empty buckets).
+      if (!process.env.CLOUDFLARE_API_TOKEN) {
+        this.log.warn(
+          `Skipping R2 wipe for ${bucketName}: no S3 credentials ` +
+            `(S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY) and no ` +
+            `CLOUDFLARE_API_TOKEN to mint a bucket-scoped token. A non-empty ` +
+            `bucket must be emptied manually in the Cloudflare dashboard.`,
+        );
+        return;
+      }
+      try {
+        const tokenName = `alepha-teardown-${bucketName}-${Date.now()}`;
+        const token = await this.api.createR2Token(tokenName, bucketName);
+        mintedTokenId = token.id;
+        creds = {
+          accessKeyId: token.accessKeyId,
+          secretAccessKey: token.secretAccessKey,
+        };
+      } catch (error: any) {
+        this.log.warn(
+          `Skipping R2 wipe for ${bucketName}: could not mint an R2 token ` +
+            `(${String(error.message || "")}). Set S3_ACCESS_KEY_ID / ` +
+            `S3_SECRET_ACCESS_KEY for reliable teardown.`,
+        );
+        return;
+      }
     }
-    const tokenName = `alepha-teardown-${bucketName}-${Date.now()}`;
-    const token = await this.api.createR2Token(tokenName, bucketName);
 
     try {
       const accountId = await this.api.resolveAccountId();
@@ -1168,8 +1256,8 @@ export class CloudflareAdapter extends PlatformAdapter {
         : `${accountId}.r2.cloudflarestorage.com`;
 
       const client = new S3mini({
-        accessKeyId: token.accessKeyId,
-        secretAccessKey: token.secretAccessKey,
+        accessKeyId: creds.accessKeyId,
+        secretAccessKey: creds.secretAccessKey,
         region: "auto",
         endpoint: `https://${host}/${bucketName}`,
       });
@@ -1226,13 +1314,16 @@ export class CloudflareAdapter extends PlatformAdapter {
         this.log.info(`Emptied ${total} object(s) from bucket ${bucketName}.`);
       }
     } finally {
-      // Always revoke, even if the wipe itself failed mid-way.
-      try {
-        await this.api.deleteR2Token(token.id);
-      } catch (error: any) {
-        this.log.warn(
-          `Failed to revoke ephemeral R2 token ${token.id}: ${String(error.message || "")}`,
-        );
+      // Revoke only a token we minted here — env S3 creds are long-lived and
+      // must not be deleted. Always revoke, even if the wipe failed mid-way.
+      if (mintedTokenId) {
+        try {
+          await this.api.deleteR2Token(mintedTokenId);
+        } catch (error: any) {
+          this.log.warn(
+            `Failed to revoke ephemeral R2 token ${mintedTokenId}: ${String(error.message || "")}`,
+          );
+        }
       }
     }
   }

package/src/cli/platform-lib/adapters/VercelAdapter.ts

@@ -1,6 +1,6 @@
 import { $inject, Alepha } from "alepha";
 import { AlephaCliUtils } from "alepha/cli";
-import { EnvUtils, Runner, type RunnerMethod } from "alepha/command";
+import { EnvUtils, type RunnerMethod } from "alepha/command";
 import { $logger } from "alepha/logger";
 import { FileSystemProvider, ShellProvider } from "alepha/system";
 import { PlatformCacheProvider } from "../providers/PlatformCacheProvider.ts";
@@ -31,7 +31,6 @@ export class VercelAdapter extends PlatformAdapter {
   protected readonly envUtils = $inject(EnvUtils);
   protected readonly api = $inject(VercelApi);
   protected readonly vercelCli = $inject(VercelCli);
-  protected readonly runner = $inject(Runner);
 
   /**
    * Vars that should not be pushed as env vars.
@@ -43,13 +42,11 @@ export class VercelAdapter extends PlatformAdapter {
     command: string,
     options: Parameters<ShellProvider["run"]>[1] = {},
   ) {
-    const capture = options.capture;
-    const output = await this.shell.run(command, {
-      ...options,
-      capture: capture ?? this.runner.useDynamicLogger,
-    });
+    const output = await this.shell.run(command, options);
 
-    if (capture && !this.runner.useDynamicLogger) {
+    // When the caller captured the output, echo it to the log so the user
+    // still sees it (uncaptured commands stream straight to the terminal).
+    if (options.capture) {
       this.log.info(output);
     }
 
@@ -64,7 +61,7 @@ export class VercelAdapter extends PlatformAdapter {
     await run({
       name: "authenticate",
       handler: async () => {
-        await this.vercelCli.ensureInstalled(ctx.root, run);
+        await this.vercelCli.ensureInstalled(ctx.root);
 
         let needsLogin = false;
 
@@ -76,9 +73,7 @@ export class VercelAdapter extends PlatformAdapter {
         }
 
         if (needsLogin) {
-          run.pause();
           await this.vercelCli.login();
-          run.resume();
         }
 
         if (await this.cache.isLoginFresh(ctx.root, "vercel")) {

package/src/cli/platform-lib/atoms/platformOptions.ts

@@ -1,4 +1,4 @@
-import { $atom, type Static, t } from "alepha";
+import { $atom, type Static, z } from "alepha";
 
 /**
  * Platform deployment configuration atom.
@@ -9,19 +9,19 @@ import { $atom, type Static, t } from "alepha";
 export const platformOptions = $atom({
   name: "alepha.cli.platform.options",
   description: "Platform deployment configuration",
-  schema: t.optional(
-    t.object({
+  schema: z
+    .object({
       /**
        * Project name override. Defaults to root package.json "name".
        */
-      name: t.optional(t.text()),
+      name: z.text().optional(),
 
       /**
        * Default environment when --env is omitted.
        *
        * @default "production"
        */
-      default: t.optional(t.text()),
+      default: z.text().optional(),
 
       /**
        * Multi-tenancy mode — controls whether `--tenant <slug>` is
@@ -36,14 +36,14 @@ export const platformOptions = $atom({
        *
        * @default "none"
        */
-      tenancy: t.optional(t.enum(["none", "optional", "required"])),
+      tenancy: z.enum(["none", "optional", "required"]).optional(),
 
       /**
        * Secret store configuration for syncing .env secrets
        * to external providers (e.g. GitHub Actions environments).
        */
-      secrets: t.optional(
-        t.object({
+      secrets: z
+        .object({
           /**
            * Explicit override of the worker secret-key allowlist.
            *
@@ -60,12 +60,12 @@ export const platformOptions = $atom({
            * neither this nor a manifest is present, the `.env.<env>` file is
            * itself the allowlist (legacy fallback).
            */
-          keys: t.optional(t.array(t.text())),
+          keys: z.array(z.text()).optional(),
 
           /**
            * Secret store backend.
            */
-          store: t.optional(t.enum(["github"])),
+          store: z.enum(["github"]).optional(),
 
           /**
            * Pattern for resolving environment names in the store.
@@ -73,20 +73,20 @@ export const platformOptions = $atom({
            *
            * @default "{project}-{env}"
            */
-          environmentPattern: t.optional(t.text()),
-        }),
-      ),
+          environmentPattern: z.text().optional(),
+        })
+        .optional(),
 
       /**
        * Named environments with their adapter and configuration.
        */
-      environments: t.record(
-        t.text({
+      environments: z.record(
+        z.text({
           description:
             "Environment name (e.g. 'production', 'staging', 'preview'). Used in resource naming and selected via --env.",
         }),
-        t.object({
-          adapter: t.enum(["cloudflare", "vercel"]),
+        z.object({
+          adapter: z.enum(["cloudflare", "vercel"]),
           /**
            * Custom domain for the deployed worker (e.g. "api.example.com").
            *
@@ -98,14 +98,34 @@ export const platformOptions = $atom({
            * Wildcard patterns require `zone` to be set, and the wildcard DNS
            * record must already exist (proxied) in the Cloudflare zone.
            */
-          domain: t.optional(t.text()),
+          domain: z.text().optional(),
           /**
            * Cloudflare zone name (e.g. "alepha.dev") that owns `domain`.
            *
-           * Required when `domain` contains a wildcard (`*`). Ignored for
-           * plain custom domains, which Cloudflare resolves automatically.
+           * Required when `domain` contains a wildcard (`*`). For a plain
+           * host, setting `zone` switches the binding from a Custom Domain to
+           * a zone *Route* (`domain/*`) — needed when another Worker holds a
+           * wildcard route covering the host (routes win by specificity,
+           * while a Custom Domain would lose to the wildcard route).
+           */
+          zone: z.text().optional(),
+          /**
+           * Worker-to-worker service bindings, e.g.
+           * `[{ binding: "CLUB", service: "club-staging" }]`.
+           *
+           * Exposed on the runtime `env` (Alepha store key `cloudflare.env`).
+           * Use a binding to fetch() a sibling Worker on the same zone —
+           * plain subrequests to a host served by a same-zone Worker route
+           * bypass the route and 522.
            */
-          zone: t.optional(t.text()),
+          services: z
+            .array(
+              z.object({
+                binding: z.text(),
+                service: z.text(),
+              }),
+            )
+            .optional(),
           /**
            * Cloudflare data jurisdiction for R2 buckets and D1 databases.
            * - "eu": data stays within the EU
@@ -113,7 +133,7 @@ export const platformOptions = $atom({
            *
            * Omit for the default (global) jurisdiction.
            */
-          jurisdiction: t.optional(t.enum(["eu", "fedramp"])),
+          jurisdiction: z.enum(["eu", "fedramp"]).optional(),
           /**
            * Cloudflare account ID to deploy into.
            *
@@ -121,11 +141,11 @@ export const platformOptions = $atom({
            * token's account when the token is scoped to exactly one.
            * Required when the token has access to multiple accounts.
            */
-          accountId: t.optional(t.text()),
+          accountId: z.text().optional(),
         }),
       ),
-    }),
-  ),
+    })
+    .optional(),
 });
 
 /**
@@ -143,4 +163,5 @@ export interface EnvironmentConfig {
   vars?: Record<string, string>;
   jurisdiction?: "eu" | "fedramp";
   accountId?: string;
+  services?: Array<{ binding: string; service: string }>;
 }