alchemy 0.85.0 → 0.85.2

package/src/cloudflare/auth.ts

@@ -75,8 +75,9 @@ export namespace CloudflareAuth {
     "queues:write": "See and change Cloudflare Queues settings and data",
     "r2_catalog:write": "Grants write level access to R2 Data Catalog",
     "radar:read": "Grants access to read Cloudflare Radar data",
-    "rag:read": "Grants read level access to Auto Rag",
-    "rag:write": "Grants write level access to Auto Rag",
+    "ai-search:read": "Grants read level access to AI Search",
+    "ai-search:write": "Grants write level access to AI Search",
+    "ai-search:run": "Grants run level access to AI Search",
     "secrets_store:read": "Grants read level access to Secrets Store",
     "secrets_store:write": "Grants write level access to Secrets Store",
     "ssl_certs:write":
@@ -120,24 +121,26 @@ export namespace CloudflareAuth {
   export type Scope = keyof typeof ALL_SCOPES;
   export const DEFAULT_SCOPES = [
     "account:read",
+    "ai-search:write",
+    "ai-search:run",
+    "ai:write",
+    "cloudchamber:write",
+    "connectivity:admin",
+    "containers:write",
+    "d1:write",
+    "pages:write",
+    "pipelines:write",
+    "queues:write",
+    "secrets_store:write",
+    "ssl_certs:write",
     "user:read",
-    "workers:write",
+    "vectorize:write",
     "workers_kv:write",
     "workers_routes:write",
     "workers_scripts:write",
     "workers_tail:read",
-    "d1:write",
-    "pages:write",
+    "workers:write",
     "zone:read",
-    "ssl_certs:write",
-    "ai:write",
-    "queues:write",
-    "pipelines:write",
-    "secrets_store:write",
-    "containers:write",
-    "cloudchamber:write",
-    "vectorize:write",
-    "connectivity:admin",
   ];
 
   /**

package/src/cloudflare/bucket-custom-domain.ts

@@ -100,6 +100,8 @@ export type R2BucketCustomDomain = {
   minTLS?: "1.0" | "1.1" | "1.2" | "1.3" | (string & {});
 };
 
+const DEV_NOOP_ZONE = "noop-zone";
+
 export const R2BucketCustomDomain = Resource(
   "cloudflare::R2BucketCustomDomain",
   async function (
@@ -114,7 +116,7 @@ export const R2BucketCustomDomain = Resource(
         zoneId:
           typeof props.zone === "string"
             ? props.zone
-            : (props.zone?.id ?? "noop-zone"),
+            : (props.zone?.id ?? DEV_NOOP_ZONE),
         ciphers: props.ciphers,
         minTLS: props.minTLS,
       };
@@ -158,6 +160,7 @@ export const R2BucketCustomDomain = Resource(
       }
       case "update": {
         if (
+          this.output.zoneId !== DEV_NOOP_ZONE && // dev mode placeholder should not trigger replacement
           diff(this.output, payload).some(
             (property) => property === "domain" || property === "zoneId",
           )

package/src/cloudflare/bucket.ts

@@ -689,6 +689,13 @@ const _R2Bucket = Resource(
 
     if (this.phase === "delete") {
       if (props.delete !== false) {
+        // Use bucket's actual jurisdiction from output, falling back to props
+        // This ensures EU/FedRAMP buckets are correctly addressed during cleanup
+        const deleteProps: BucketProps = {
+          ...props,
+          jurisdiction: this.output?.jurisdiction ?? props.jurisdiction,
+        };
+
         if (this.output?.catalog) {
           await disableDataCatalog(api, bucketName);
         }
@@ -696,9 +703,9 @@ const _R2Bucket = Resource(
           await deleteMiniflareBinding(this.scope, "r2", this.output.dev.id);
         }
         if (props.empty) {
-          await emptyBucket(api, bucketName, props);
+          await emptyBucket(api, bucketName, deleteProps);
         }
-        await deleteBucket(api, bucketName, props);
+        await deleteBucket(api, bucketName, deleteProps);
       }
       return this.destroy();
     }

package/src/cloudflare/index.ts

@@ -2,7 +2,10 @@
 
 export * from "./account-api-token.ts";
 export * from "./account-id.ts";
+export * from "./ai-crawler.ts";
 export * from "./ai-gateway.ts";
+export * from "./ai-search-token.ts";
+export * from "./ai-search.ts";
 export * from "./ai.ts";
 export * from "./analytics-engine.ts";
 export * from "./api-error.ts";

package/src/cloudflare/permission-groups.ts

@@ -98,6 +98,12 @@ export const PERMISSION_GROUPS = [
     description: "Grants access to reading AI Gateways",
     scopes: ["com.cloudflare.api.account"],
   },
+  {
+    id: "9e9b428a0bcd46fd80e580b46a69963c",
+    name: "AI Search Index Engine",
+    description: "Grants access to run AI Search Index Engine",
+    scopes: ["com.cloudflare.api.account"],
+  },
   {
     id: "644535f4ed854494a59cb289d634b257",
     name: "AI Gateway Run",

package/src/cloudflare/sveltekit/plugin.ts

@@ -2,17 +2,11 @@ import adapter, { type AdapterOptions } from "@sveltejs/adapter-cloudflare";
 import type { Adapter } from "@sveltejs/kit";
 import { getPlatformProxyOptions } from "../cloudflare-env-proxy.ts";
 
-const isSvelteLanguageServer = !!process.argv.find((arg) =>
-  arg.includes("svelte-language-server"),
-);
-
 export default (options?: AdapterOptions): Adapter => {
-  if (isSvelteLanguageServer) {
-    // the svelte language server runs from the root and therefore may be running in a different cwd than the `Website.cwd`
-    // for now, we work around this by returning a noop adapter to avoid breaking svelte intellisense
+  if (shouldDisable()) {
     return {
-      adapt() {},
       name: "alchemy-noop",
+      adapt() {},
     };
   }
   const { platformProxy: proxyOptions, ...config } = options ?? {};
@@ -23,3 +17,18 @@ export default (options?: AdapterOptions): Adapter => {
     ...config,
   });
 };
+
+/**
+ * Return true for `svelte-language-server`, `svelte-check`, and `svelte-kit sync`. This is because:
+ * - The svelte language server runs from the root and therefore may be running in a different cwd than the `Website.cwd`, so disable to avoid breaking intellisense
+ * - The `svelte-check` and `svelte-kit sync` commands do not require Cloudflare-specific configuration, so disable to avoid breaking the commands
+ */
+function shouldDisable(argv = process.argv): boolean {
+  return (
+    argv.some(
+      (arg) =>
+        arg.includes("svelte-check") || arg.includes("svelte-language-server"),
+    ) ||
+    (argv.some((arg) => arg.includes("svelte-kit")) && argv.includes("sync"))
+  );
+}

package/src/cloudflare/vite/vite.ts

@@ -2,6 +2,7 @@ import path from "pathe";
 import { getPackageManagerRunner } from "../../util/detect-package-manager.ts";
 import type { Assets } from "../assets.ts";
 import type { Bindings } from "../bindings.ts";
+import { withSkipPathValidation } from "../miniflare/paths.ts";
 import {
   spreadBuildProps,
   spreadDevProps,
@@ -34,8 +35,9 @@ export async function Vite<B extends Bindings>(
       port = args[index + 1];
     } else {
       try {
-        const config = await import(
-          path.resolve(props.cwd ?? process.cwd(), "vite.config.ts")
+        const config = await withSkipPathValidation(
+          () =>
+            import(path.resolve(props.cwd ?? process.cwd(), "vite.config.ts")),
         );
         port = config.default?.server?.port ?? 5173;
       } catch {}

package/src/docker/api.ts

@@ -69,10 +69,44 @@ type VolumeInfo = {
   Scope: string;
 };
 
-type ContainerInfo = {
+export type ContainerInfo = {
   Id: string;
   State: { Status: "created" | "running" | "paused" | "stopped" | "exited" };
   Created: string;
+  Config: {
+    Image: string;
+    Cmd: string[] | null;
+    Env: string[] | null;
+    Healthcheck?: {
+      Test: string[] | null;
+      Interval?: number;
+      Timeout?: number;
+      Retries?: number;
+      StartPeriod?: number;
+      StartInterval?: number;
+    } | null;
+  };
+  HostConfig: {
+    PortBindings: Record<
+      string,
+      Array<{ HostIp: string; HostPort: string }> | null
+    > | null;
+    Binds: string[] | null;
+    RestartPolicy: {
+      Name: string;
+      MaximumRetryCount: number;
+    };
+    AutoRemove: boolean;
+  };
+  NetworkSettings: {
+    Networks: Record<
+      string,
+      {
+        NetworkID: string;
+        Aliases: string[] | null;
+      }
+    > | null;
+  };
 };
 
 /**
@@ -103,6 +137,7 @@ export class DockerApi {
   async exec(
     args: string[],
     remainingAttempts = 3,
+    quiet = false,
   ): Promise<{ stdout: string; stderr: string }> {
     // If a custom config directory is provided, ensure all commands use it by
     // setting the DOCKER_CONFIG env variable for the spawned process.
@@ -124,13 +159,17 @@ export class DockerApi {
 
     // Stream stdout in real-time
     subprocess.stdout?.on("data", (chunk: string) => {
-      process.stdout.write(chunk);
+      if (!quiet) {
+        process.stdout.write(chunk);
+      }
       stdout += chunk;
     });
 
     // Stream stderr in real-time
     subprocess.stderr?.on("data", (chunk: string) => {
-      process.stderr.write(chunk);
+      if (!quiet) {
+        process.stderr.write(chunk);
+      }
       stderr += chunk;
     });
 
@@ -364,7 +403,11 @@ export class DockerApi {
    * @returns Container details in JSON format
    */
   async inspectContainer(containerId: string): Promise<ContainerInfo[]> {
-    const { stdout } = await this.exec(["container", "inspect", containerId]);
+    const { stdout } = await this.exec(
+      ["container", "inspect", containerId],
+      undefined,
+      true,
+    );
     try {
       return JSON.parse(stdout.trim()) as ContainerInfo[];
     } catch (_error) {

package/src/docker/container.ts

@@ -1,6 +1,6 @@
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
-import { DockerApi } from "./api.ts";
+import { DockerApi, normalizeDuration, type ContainerInfo } from "./api.ts";
 import type { Image } from "./image.ts";
 import type { RemoteImage } from "./remote-image.ts";
 
@@ -201,7 +201,7 @@ export interface Container extends ContainerProps {
   /**
    * Container state
    */
-  state?: "created" | "running" | "paused" | "stopped" | "exited";
+  state: "created" | "running" | "paused" | "stopped" | "exited";
 
   /**
    * Time when the container was created
@@ -277,6 +277,7 @@ export interface Container extends ContainerProps {
  */
 export const Container = Resource(
   "docker::Container",
+  { alwaysUpdate: true },
   async function (
     this: Context<Container>,
     id: string,
@@ -311,39 +312,63 @@ export const Container = Resource(
       return this.destroy();
     }
 
-    let containerState: NonNullable<Container["state"]> = "created";
+    let containerState: Container["state"] = "created";
 
     // Check if container already exists
     const containerExists = await api.containerExists(containerName);
 
     if (containerExists) {
-      if (this.phase === "update") {
-        // Remove existing container for update
-        await api.removeContainer(containerName, true);
+      // Create phase - check for adoption
+      if (this.phase === "create" && !props.adopt) {
+        throw new Error(
+          `Container "${containerName}" already exists. Use adopt: true to adopt it.`,
+        );
+      }
+
+      const [containerInfo] = await api.inspectContainer(containerName);
+
+      // Compute what changes are needed
+      if (shouldReplace(imageRef, props, containerInfo)) {
+        // Need to recreate - remove existing container
+        if (this.phase === "update") {
+          // In update phase, we can replace the resource
+          // Force because we need to delete the old one first if the name is the same
+          return this.replace(true);
+        } else {
+          // In create phase, we cannot replace the resource, so manually delete instead
+          await api.removeContainer(containerName, true);
+        }
       } else {
-        // Create phase - check for adoption
-        if (!props.adopt) {
-          throw new Error(
-            `Container "${containerName}" already exists. Use adopt: true to adopt it.`,
-          );
+        // Apply incremental changes without recreating the container
+
+        const { toConnect, toDisconnect } = getNetworkChanges(
+          props,
+          containerInfo,
+        );
+
+        // Apply network disconnections
+        for (const network of toDisconnect) {
+          await api.disconnectNetwork(containerInfo.Id, network);
         }
 
-        // Adopt existing container
-        const containerInfos = await api.inspectContainer(containerName);
-        const containerInfo = containerInfos[0];
-        let adoptedState = containerInfo.State.Status;
+        // Apply network connections
+        for (const network of toConnect) {
+          await api.connectNetwork(containerInfo.Id, network.name, {
+            aliases: network.aliases,
+          });
+        }
 
         // Optionally start the container if requested
         if (props.start && containerInfo.State.Status !== "running") {
-          await api.startContainer(containerName);
-          adoptedState = "running";
+          await api.startContainer(containerInfo.Id);
+          containerState = "running";
         }
 
         return {
           ...props,
           id: containerInfo.Id,
           name: containerName,
-          state: adoptedState,
+          state: containerState,
           createdAt: new Date(containerInfo.Created).getTime(),
         };
       }
@@ -402,3 +427,278 @@ export const Container = Resource(
     };
   },
 );
+
+function getNetworkChanges(
+  props: ContainerProps,
+  containerInfo: ContainerInfo,
+): { toConnect: NetworkMapping[]; toDisconnect: string[] } {
+  const currentNetworks = new Set(
+    Object.keys(containerInfo.NetworkSettings.Networks || {}),
+  );
+  const desiredNetworks = new Map(
+    (props.networks || []).map((n) => [n.name, n]),
+  );
+  const toConnect: NetworkMapping[] = [];
+  const toDisconnect: string[] = [];
+  for (const network of currentNetworks) {
+    if (!desiredNetworks.has(network) && network !== "bridge") {
+      toDisconnect.push(network);
+    }
+  }
+  for (const [name, config] of desiredNetworks) {
+    if (!currentNetworks.has(name)) {
+      toConnect.push(config);
+    }
+  }
+  return { toConnect, toDisconnect };
+}
+
+function shouldReplace(
+  imageRef: string,
+  props: ContainerProps,
+  containerInfo: ContainerInfo,
+): boolean {
+  // Check immutable properties that require recreation
+
+  // Image change - compare the image ID/digest if available
+  // The container stores the resolved image ID, so we compare against imageRef
+  if (containerInfo.Config.Image !== imageRef) {
+    return true;
+  }
+
+  // Command change
+  const containerCmd = containerInfo.Config.Cmd || [];
+  if (
+    props.command && // only compare if command is set; otherwise we'd be comparing against the image's default command
+    (props.command.length !== containerCmd.length ||
+      !props.command.every((c, i) => c === containerCmd[i]))
+  ) {
+    return true;
+  }
+
+  // Environment variables
+  if (!compareEnv(props.environment, containerInfo.Config.Env)) {
+    return true;
+  }
+
+  // Port bindings
+  if (!comparePorts(props.ports, containerInfo.HostConfig.PortBindings)) {
+    return true;
+  }
+
+  // Volume bindings
+  if (!compareVolumes(props.volumes, containerInfo.HostConfig.Binds)) {
+    return true;
+  }
+
+  // Healthcheck
+  if (
+    !compareHealthcheck(props.healthcheck, containerInfo.Config.Healthcheck)
+  ) {
+    return true;
+  }
+
+  // Restart policy
+  if (
+    !compareRestartPolicy(props.restart, containerInfo.HostConfig.RestartPolicy)
+  ) {
+    return true;
+  }
+
+  // AutoRemove (removeOnExit)
+  if ((props.removeOnExit || false) !== containerInfo.HostConfig.AutoRemove) {
+    return true;
+  }
+
+  return false;
+}
+
+/**
+ * Normalize port mappings to a comparable format
+ * @internal
+ */
+function normalizePortMappings(
+  ports: PortMapping[] | undefined,
+): Map<string, string> {
+  const map = new Map<string, string>();
+  if (!ports) return map;
+  for (const port of ports) {
+    const protocol = port.protocol || "tcp";
+    map.set(`${port.external}`, `${port.internal}/${protocol}`);
+  }
+  return map;
+}
+
+/**
+ * Normalize volume mappings to a comparable format
+ * @internal
+ */
+function normalizeVolumeMappings(
+  volumes: VolumeMapping[] | undefined,
+): Set<string> {
+  const set = new Set<string>();
+  if (!volumes) return set;
+  for (const volume of volumes) {
+    const readOnlyFlag = volume.readOnly ? ":ro" : "";
+    set.add(`${volume.hostPath}:${volume.containerPath}${readOnlyFlag}`);
+  }
+  return set;
+}
+
+/**
+ * Compare environment variables
+ * @internal
+ */
+function compareEnv(
+  propsEnv: Record<string, string> | undefined,
+  containerEnv: string[] | null,
+): boolean {
+  const propsEntries = Object.entries(propsEnv || {}).sort(([a], [b]) =>
+    a.localeCompare(b),
+  );
+  const containerEntries = (containerEnv || [])
+    .map((e) => {
+      const idx = e.indexOf("=");
+      return idx >= 0 ? ([e.slice(0, idx), e.slice(idx + 1)] as const) : null;
+    })
+    .filter((e): e is [string, string] => e !== null)
+    // Filter out PATH and other system env vars that Docker adds
+    .filter(([key]) => propsEnv && key in propsEnv)
+    .sort(([a], [b]) => a.localeCompare(b));
+
+  if (propsEntries.length !== containerEntries.length) return false;
+  for (let i = 0; i < propsEntries.length; i++) {
+    if (
+      propsEntries[i][0] !== containerEntries[i][0] ||
+      propsEntries[i][1] !== containerEntries[i][1]
+    ) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * Compare port bindings
+ * @internal
+ */
+function comparePorts(
+  propsPorts: PortMapping[] | undefined,
+  containerPorts: Record<
+    string,
+    Array<{ HostIp: string; HostPort: string }> | null
+  > | null,
+): boolean {
+  const propsMap = normalizePortMappings(propsPorts);
+
+  // Extract container port mappings
+  const containerMap = new Map<string, string>();
+  if (containerPorts) {
+    for (const [containerPort, bindings] of Object.entries(containerPorts)) {
+      if (bindings && bindings.length > 0) {
+        containerMap.set(bindings[0].HostPort, containerPort);
+      }
+    }
+  }
+
+  if (propsMap.size !== containerMap.size) return false;
+  for (const [hostPort, containerPort] of propsMap) {
+    if (containerMap.get(hostPort) !== containerPort) return false;
+  }
+  return true;
+}
+
+/**
+ * Compare volume bindings
+ * @internal
+ */
+function compareVolumes(
+  propsVolumes: VolumeMapping[] | undefined,
+  containerBinds: string[] | null,
+): boolean {
+  const propsSet = normalizeVolumeMappings(propsVolumes);
+  const containerSet = new Set(containerBinds || []);
+
+  if (propsSet.size !== containerSet.size) return false;
+  for (const bind of propsSet) {
+    if (!containerSet.has(bind)) return false;
+  }
+  return true;
+}
+
+/**
+ * Compare healthcheck configuration
+ * @internal
+ */
+function compareHealthcheck(
+  propsHc: HealthcheckConfig | undefined,
+  containerHc:
+    | {
+        Test: string[] | null;
+        Interval?: number;
+        Timeout?: number;
+        Retries?: number;
+        StartPeriod?: number;
+        StartInterval?: number;
+      }
+    | null
+    | undefined,
+): boolean {
+  // Both undefined/null
+  if (!propsHc && !containerHc) return true;
+  // One defined, one not
+  if (!propsHc || !containerHc) return false;
+
+  // Compare command
+  const propsCmd = Array.isArray(propsHc.cmd)
+    ? propsHc.cmd.join(" ")
+    : propsHc.cmd;
+  const containerCmd = containerHc.Test
+    ? containerHc.Test.slice(1).join(" ")
+    : "";
+  if (propsCmd !== containerCmd) return false;
+
+  // Helper to convert Duration to nanoseconds for comparison
+  const toNanos = (d: Duration | undefined): number => {
+    if (d === undefined) return 0;
+    const str = normalizeDuration(d);
+    const match = str.match(/^(\d+(?:\.\d+)?)(ms|s|m|h)$/);
+    if (!match) return 0;
+    const value = parseFloat(match[1]);
+    const unit = match[2];
+    switch (unit) {
+      case "ms":
+        return value * 1_000_000;
+      case "s":
+        return value * 1_000_000_000;
+      case "m":
+        return value * 60 * 1_000_000_000;
+      case "h":
+        return value * 3600 * 1_000_000_000;
+      default:
+        return 0;
+    }
+  };
+
+  if (toNanos(propsHc.interval) !== (containerHc.Interval || 0)) return false;
+  if (toNanos(propsHc.timeout) !== (containerHc.Timeout || 0)) return false;
+  if ((propsHc.retries || 0) !== (containerHc.Retries || 0)) return false;
+  if (toNanos(propsHc.startPeriod) !== (containerHc.StartPeriod || 0))
+    return false;
+  if (toNanos(propsHc.startInterval) !== (containerHc.StartInterval || 0))
+    return false;
+
+  return true;
+}
+
+/**
+ * Compare restart policy
+ * @internal
+ */
+function compareRestartPolicy(
+  propsRestart: ContainerProps["restart"] | undefined,
+  containerRestart: { Name: string; MaximumRetryCount: number },
+): boolean {
+  const propsPolicy = propsRestart || "no";
+  return propsPolicy === containerRestart.Name;
+}

package/src/scope.ts

@@ -342,12 +342,21 @@ export class Scope {
     return state !== undefined && (type === undefined || state.kind === type);
   }
 
-  public createPhysicalName(id: string, delimiter = "-"): string {
-    const app = this.appName;
-    const stage = this.stage;
-    return [app, ...this.chain.slice(2), id, stage]
-      .map((s) => s.replaceAll(/[^a-z0-9_-]/gi, delimiter))
+  public createPhysicalName(
+    id: string,
+    delimiter = "-",
+    maxLength?: number,
+  ): string {
+    let name = [this.appName, ...this.chain.slice(2), id, this.stage]
+      .map((part) => part.replaceAll(/[^a-z0-9_-]/gi, delimiter))
       .join(delimiter);
+    while (maxLength && name.length > maxLength) {
+      name = name
+        .split(delimiter)
+        .map((part) => part.slice(0, -1))
+        .join(delimiter);
+    }
+    return name;
   }
 
   public async spawn<