alchemy 0.84.0 → 0.85.1

package/src/cloudflare/api-error.ts

@@ -1,3 +1,5 @@
+import type { CloudflareApiErrorPayload } from "./api-response";
+
 /**
  * Custom error class for Cloudflare API errors
  * Includes HTTP status information from the Response
@@ -66,3 +68,20 @@ export async function handleApiError(
   }: ${errors.map((error) => `${error.code}: ${error.message}`).join(", ")}`;
   throw new CloudflareApiError(errorMessage, response, errors);
 }
+
+/**
+ * Helper function to check if an error is a Cloudflare API error.
+ * Optional match criteria can be provided to check for a specific HTTP status code or error code.
+ */
+export function isCloudflareApiError(
+  error: unknown,
+  match: { status?: number; code?: number } = {},
+): error is CloudflareApiError & { errorData: CloudflareApiErrorPayload[] } {
+  return (
+    error instanceof CloudflareApiError &&
+    (match.status === undefined || error.status === match.status) &&
+    (match.code === undefined ||
+      (Array.isArray(error.errorData) &&
+        error.errorData.some((e) => "code" in e && e.code === match.code)))
+  );
+}

package/src/cloudflare/api.ts

@@ -113,7 +113,7 @@ export const createCloudflareApi = memoize(
         baseUrl,
         profile,
         credentials,
-        accountId: provider.metadata.id,
+        accountId: accountId ?? provider.metadata.id,
       });
     } catch (error) {
       throw new Error(

package/src/cloudflare/auth.ts

@@ -75,8 +75,9 @@ export namespace CloudflareAuth {
     "queues:write": "See and change Cloudflare Queues settings and data",
     "r2_catalog:write": "Grants write level access to R2 Data Catalog",
     "radar:read": "Grants access to read Cloudflare Radar data",
-    "rag:read": "Grants read level access to Auto Rag",
-    "rag:write": "Grants write level access to Auto Rag",
+    "ai-search:read": "Grants read level access to AI Search",
+    "ai-search:write": "Grants write level access to AI Search",
+    "ai-search:run": "Grants run level access to AI Search",
     "secrets_store:read": "Grants read level access to Secrets Store",
     "secrets_store:write": "Grants write level access to Secrets Store",
     "ssl_certs:write":
@@ -120,24 +121,26 @@ export namespace CloudflareAuth {
   export type Scope = keyof typeof ALL_SCOPES;
   export const DEFAULT_SCOPES = [
     "account:read",
+    "ai-search:write",
+    "ai-search:run",
+    "ai:write",
+    "cloudchamber:write",
+    "connectivity:admin",
+    "containers:write",
+    "d1:write",
+    "pages:write",
+    "pipelines:write",
+    "queues:write",
+    "secrets_store:write",
+    "ssl_certs:write",
     "user:read",
-    "workers:write",
+    "vectorize:write",
     "workers_kv:write",
     "workers_routes:write",
     "workers_scripts:write",
     "workers_tail:read",
-    "d1:write",
-    "pages:write",
+    "workers:write",
     "zone:read",
-    "ssl_certs:write",
-    "ai:write",
-    "queues:write",
-    "pipelines:write",
-    "secrets_store:write",
-    "containers:write",
-    "cloudchamber:write",
-    "vectorize:write",
-    "connectivity:admin",
   ];
 
   /**

package/src/cloudflare/bindings.ts

@@ -26,6 +26,7 @@ import type { SecretRef as CloudflareSecretRef } from "./secret-ref.ts";
 import type { Secret as CloudflareSecret } from "./secret.ts";
 import type { VectorizeIndex } from "./vectorize-index.ts";
 import type { VersionMetadata } from "./version-metadata.ts";
+import type { VpcService } from "./vpc-service.ts";
 import type { WorkerLoader } from "./worker-loader.ts";
 import type { WorkerRef } from "./worker-ref.ts";
 import type { WorkerStub } from "./worker-stub.ts";
@@ -82,7 +83,8 @@ export type Binding =
   | BrowserRendering
   | VersionMetadata
   | Self
-  | Json;
+  | Json
+  | VpcService;
 
 export type Self<
   RPC extends Rpc.WorkerEntrypointBranded = Rpc.WorkerEntrypointBranded,
@@ -143,7 +145,8 @@ export type WorkerBindingSpec =
   | WorkerBindingVersionMetadata
   | WorkerBindingWasmModule
   | WorkerBindingWorkerLoader
-  | WorkerBindingWorkflow;
+  | WorkerBindingWorkflow
+  | WorkerBindingVpcService;
 
 /**
  * AI binding type
@@ -499,6 +502,16 @@ export interface WorkerBindingWorkflow {
   script_name?: string;
 }
 
+export interface WorkerBindingVpcService {
+  /** The name of the binding */
+  name: string;
+  /** Type identifier for VPC Service binding */
+  type: "vpc_service";
+  /** VPC Service name */
+  service_name: string;
+  service_id: string;
+}
+
 /**
  * Images binding type
  */

package/src/cloudflare/bound.ts

@@ -20,6 +20,7 @@ import type { SecretRef as CloudflareSecretRef } from "./secret-ref.ts";
 import type { Secret as CloudflareSecret } from "./secret.ts";
 import type { VectorizeIndex as _VectorizeIndex } from "./vectorize-index.ts";
 import type { VersionMetadata as _VersionMetadata } from "./version-metadata.ts";
+import type { VpcService as _VpcService } from "./vpc-service.ts";
 import type { WorkerLoader as _WorkerLoader } from "./worker-loader.ts";
 import type { WorkerRef } from "./worker-ref.ts";
 import type { WorkerStub } from "./worker-stub.ts";
@@ -105,6 +106,8 @@ export type Bound<T extends Binding> =
                                                                 Obj &
                                                                   Rpc.DurableObjectBranded
                                                               >
-                                                            : T extends undefined
-                                                              ? undefined
-                                                              : Service;
+                                                            : T extends _VpcService
+                                                              ? Fetcher
+                                                              : T extends undefined
+                                                                ? undefined
+                                                                : Service;

package/src/cloudflare/bucket-custom-domain.ts

@@ -100,6 +100,8 @@ export type R2BucketCustomDomain = {
   minTLS?: "1.0" | "1.1" | "1.2" | "1.3" | (string & {});
 };
 
+const DEV_NOOP_ZONE = "noop-zone";
+
 export const R2BucketCustomDomain = Resource(
   "cloudflare::R2BucketCustomDomain",
   async function (
@@ -114,7 +116,7 @@ export const R2BucketCustomDomain = Resource(
         zoneId:
           typeof props.zone === "string"
             ? props.zone
-            : (props.zone?.id ?? "noop-zone"),
+            : (props.zone?.id ?? DEV_NOOP_ZONE),
         ciphers: props.ciphers,
         minTLS: props.minTLS,
       };
@@ -158,6 +160,7 @@ export const R2BucketCustomDomain = Resource(
       }
       case "update": {
         if (
+          this.output.zoneId !== DEV_NOOP_ZONE && // dev mode placeholder should not trigger replacement
           diff(this.output, payload).some(
             (property) => property === "domain" || property === "zoneId",
           )

package/src/cloudflare/bucket.ts

@@ -689,6 +689,13 @@ const _R2Bucket = Resource(
 
     if (this.phase === "delete") {
       if (props.delete !== false) {
+        // Use bucket's actual jurisdiction from output, falling back to props
+        // This ensures EU/FedRAMP buckets are correctly addressed during cleanup
+        const deleteProps: BucketProps = {
+          ...props,
+          jurisdiction: this.output?.jurisdiction ?? props.jurisdiction,
+        };
+
         if (this.output?.catalog) {
           await disableDataCatalog(api, bucketName);
         }
@@ -696,9 +703,9 @@ const _R2Bucket = Resource(
           await deleteMiniflareBinding(this.scope, "r2", this.output.dev.id);
         }
         if (props.empty) {
-          await emptyBucket(api, bucketName, props);
+          await emptyBucket(api, bucketName, deleteProps);
         }
-        await deleteBucket(api, bucketName, props);
+        await deleteBucket(api, bucketName, deleteProps);
       }
       return this.destroy();
     }

package/src/cloudflare/d1-database.ts

@@ -540,10 +540,17 @@ export async function deleteDatabase(
   api: CloudflareApi,
   databaseId: string,
 ): Promise<void> {
-  await extractCloudflareResult(
-    `delete D1 database "${databaseId}"`,
-    api.delete(`/accounts/${api.accountId}/d1/database/${databaseId}`),
-  );
+  try {
+    await extractCloudflareResult(
+      `delete D1 database "${databaseId}"`,
+      api.delete(`/accounts/${api.accountId}/d1/database/${databaseId}`),
+    );
+  } catch (error) {
+    if (error instanceof CloudflareApiError && error.status === 404) {
+      return;
+    }
+    throw error;
+  }
 }
 
 /**

package/src/cloudflare/index.ts

@@ -2,7 +2,10 @@
 
 export * from "./account-api-token.ts";
 export * from "./account-id.ts";
+export * from "./ai-crawler.ts";
 export * from "./ai-gateway.ts";
+export * from "./ai-search-token.ts";
+export * from "./ai-search.ts";
 export * from "./ai.ts";
 export * from "./analytics-engine.ts";
 export * from "./api-error.ts";
@@ -70,6 +73,7 @@ export * from "./vectorize-index.ts";
 export * from "./vectorize-metadata-index.ts";
 export * from "./version-metadata.ts";
 export * from "./vite/vite.ts";
+export * from "./vpc-service.ts";
 export * from "./warp-default-profile.ts";
 export * from "./warp-device-profile.ts";
 export * from "./website.ts";

package/src/cloudflare/miniflare/build-worker-options.ts

@@ -31,29 +31,26 @@ export interface MiniflareWorkerInput {
   cwd: string;
 }
 
-type RemoteOnlyBindingType =
-  | "ai"
-  | "browser"
-  | "dispatch_namespace"
-  | "mtls_certificate"
-  | "vectorize";
-type RemoteOptionalBindingType =
-  | "d1"
-  | "images"
-  | "kv_namespace"
-  | "queue"
-  | "r2_bucket";
-
 type RemoteBinding =
+  // Supported remote bindings that are NOT a fetcher require the `raw` flag.
   | (Extract<
       WorkerBindingSpec,
       {
-        type: RemoteOnlyBindingType | RemoteOptionalBindingType;
+        type:
+          | "ai"
+          | "browser"
+          | "dispatch_namespace"
+          | "mtls_certificate"
+          | "vectorize"
+          | "d1"
+          | "images"
+          | "kv_namespace"
+          | "queue"
+          | "r2_bucket";
       }
-    > & {
-      raw: true;
-    })
-  | WorkerBindingService;
+    > & { raw: true })
+  // Fetcher type bindings do not require the `raw` flag and will throw an error if it is present.
+  | Extract<WorkerBindingSpec, { type: "service" | "vpc_service" }>;
 
 type BaseWorkerOptions = {
   [K in keyof miniflare.WorkerOptions]: K extends
@@ -324,6 +321,15 @@ export const buildWorkerOptions = async (
         };
         break;
       }
+      case "vpc_service": {
+        remoteBindings.push({
+          type: "vpc_service",
+          name: key,
+          service_name: binding.name,
+          service_id: binding.serviceId,
+        });
+        break;
+      }
       case "worker_loader": {
         (options.workerLoaders ??= {})[key] = {};
         break;
@@ -447,6 +453,12 @@ export const buildWorkerOptions = async (
             remoteProxyConnectionString: remoteProxy.connectionString,
           };
           break;
+        case "vpc_service":
+          (options.vpcServices ??= {})[binding.name] = {
+            service_id: binding.service_id,
+            remoteProxyConnectionString: remoteProxy.connectionString,
+          };
+          break;
         default: {
           assertNever(binding);
         }

package/src/cloudflare/miniflare/miniflare-worker-proxy.ts

@@ -32,10 +32,12 @@ export async function createMiniflareWorkerProxy(options: {
 
   server.on("request", async (req, res) => {
     try {
-      const response = await handleFetch(req);
+      const response = await handleFetch(req, res);
       writeMiniflareResponseToNode(response, res);
     } catch (error) {
-      console.error(error);
+      if (!(error instanceof DOMException && error.name === "AbortError")) {
+        console.error(error);
+      }
       const response = MiniflareWorkerProxyError.fromUnknown(error).toResponse(
         options.mode,
       );
@@ -45,6 +47,7 @@ export async function createMiniflareWorkerProxy(options: {
 
   const handleFetch = async (
     req: http.IncomingMessage,
+    res: http.ServerResponse,
   ): Promise<miniflare.Response> => {
     const info = parseIncomingMessage(req);
     options.transformRequest?.(info);
@@ -60,12 +63,14 @@ export async function createMiniflareWorkerProxy(options: {
       info.url.pathname = "/cdn-cgi/handler/scheduled";
     }
 
+    const signal = getDisconnectSignal(req, res);
     const request = new miniflare.Request(info.url, {
       method: info.method,
       headers: info.headers,
       body: info.body,
       redirect: info.redirect,
       duplex: info.duplex,
+      signal,
     });
     return await options.miniflare.dispatchFetch(request);
   };
@@ -114,6 +119,46 @@ export async function createMiniflareWorkerProxy(options: {
   };
 }
 
+/**
+ * Creates an abort signal that is triggered when the downstream client
+ * disconnects before the response is fully written.
+ *
+ * This signal should be forwarded to Miniflare dispatch so Worker `req.signal`
+ * listeners can observe local client cancellation.
+ */
+function getDisconnectSignal(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+): AbortSignal {
+  const controller = new AbortController();
+  const onAbort = () => {
+    if (!controller.signal.aborted) {
+      controller.abort();
+    }
+    cleanup();
+  };
+  const onClose = () => {
+    if (!res.writableEnded) {
+      onAbort();
+      return;
+    }
+    cleanup();
+  };
+  const cleanup = () => {
+    req.off("aborted", onAbort);
+    req.socket?.off("close", onClose);
+    res.off("close", onClose);
+    res.off("finish", cleanup);
+  };
+
+  req.on("aborted", onAbort);
+  req.socket?.on("close", onClose);
+  res.on("close", onClose);
+  res.on("finish", cleanup);
+
+  return controller.signal;
+}
+
 /**
  * Listens on the given port, retrying on the next port if the port is already in use.
  */

package/src/cloudflare/permission-groups.ts

@@ -98,6 +98,12 @@ export const PERMISSION_GROUPS = [
     description: "Grants access to reading AI Gateways",
     scopes: ["com.cloudflare.api.account"],
   },
+  {
+    id: "9e9b428a0bcd46fd80e580b46a69963c",
+    name: "AI Search Index Engine",
+    description: "Grants access to run AI Search Index Engine",
+    scopes: ["com.cloudflare.api.account"],
+  },
   {
     id: "644535f4ed854494a59cb289d634b257",
     name: "AI Gateway Run",