alchemy 2.0.0-beta.81 → 2.0.0-beta.83

package/src/Cloudflare/Hyperdrive/ConnectBinding.ts

@@ -1,12 +1,14 @@
 import type * as runtime from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as Output from "../../Output.ts";
+import { defaultProviderMode, type ProviderMode } from "../../ProviderMode.ts";
 import { Worker, WorkerEnvironment } from "../Workers/Worker.ts";
 import { Connect, type ConnectClient } from "./Connect.ts";
 import type { Connection } from "./Connection.ts";
-import { defaultPort, type DevOrigin } from "./Connection.ts";
+import { defaultPort, type DevOrigin, type Mtls, type Origin } from "./Connection.ts";
 
 export const ConnectBinding = Layer.effect(
   Connect,
@@ -24,7 +26,7 @@ export const ConnectBinding = Layer.effect(
               id: connection.hyperdriveId as unknown as string,
             },
           ],
-          hyperdrives: getHyperdriveDevOrigin(connection),
+          hyperdrives: yield* getHyperdriveDevOriginForHost(connection, host),
         });
       }
 
@@ -45,38 +47,80 @@ export const ConnectBinding = Layer.effect(
   }),
 );
 
+/**
+ * The `hyperdrives` dev channel for `connection` bound to `host`. Only the
+ * local worker provider reads it, so it is contributed only when the host
+ * runs locally — its registration-captured `Mode` (`Alchemy.remote()` →
+ * `"live"`) or the run default (`alchemy dev` → `"local"`), the same
+ * resolution the planner applies to the host. A live host (`alchemy deploy`,
+ * or a `remote()` worker in dev) never evaluates the dev origin, so an
+ * Access-protected origin without a `dev` override deploys.
+ */
+export const getHyperdriveDevOriginForHost = Effect.fn(function* (
+  connection: Connection,
+  host: { readonly Mode?: ProviderMode | undefined },
+) {
+  const mode = host.Mode ?? (yield* defaultProviderMode);
+  return mode === "local" ? getHyperdriveDevOrigin(connection) : undefined;
+});
+
+/**
+ * A Hyperdrive origin that `alchemy dev` cannot reach from the local
+ * machine, bound without a `dev` override.
+ */
+export class HyperdriveDevOriginUnsupported extends Data.TaggedError(
+  "HyperdriveDevOriginUnsupported",
+)<{
+  message: string;
+  logicalId: string;
+  origin: "access" | "vpc";
+}> {}
+
 export const getHyperdriveDevOrigin = (connection: Connection) => {
-  const origin = Output.map(
-    Output.all(connection.dev, connection.origin, connection.mtls),
-    ([dev, origin, mtls]): Required<DevOrigin> => {
-      if (dev) {
-        return {
-          scheme: dev.scheme,
-          host: dev.host,
-          port: dev.port ?? defaultPort(dev.scheme),
-          user: dev.user,
-          database: dev.database,
-          password: dev.password,
-          sslmode: dev.sslmode ?? "prefer",
-        };
-      }
-      if ("accessClientId" in origin) {
-        throw new Error(
-          `Hyperdrive instance ${connection.LogicalId} has an origin that requires Cloudflare Access. This is not supported in development mode. ` +
+  const origin = Output.mapEffect(([dev, origin, mtls]: [DevOrigin | undefined, Origin, Mtls]) => {
+    if (dev) {
+      return Effect.succeed<Required<DevOrigin>>({
+        scheme: dev.scheme,
+        host: dev.host,
+        port: dev.port ?? defaultPort(dev.scheme),
+        user: dev.user,
+        database: dev.database,
+        password: dev.password,
+        sslmode: dev.sslmode ?? "prefer",
+      });
+    }
+    if ("accessClientId" in origin) {
+      return Effect.die(
+        new HyperdriveDevOriginUnsupported({
+          logicalId: connection.LogicalId,
+          origin: "access",
+          message:
+            `Hyperdrive instance ${connection.LogicalId} has an origin that requires Cloudflare Access. This is not supported in development mode. ` +
             "Select a different origin or set the `dev` property to an origin that does not require Cloudflare Access.",
-        );
-      }
-      return {
-        scheme: origin.scheme,
-        host: origin.host,
-        port: origin.port ?? defaultPort(origin.scheme),
-        user: origin.user,
-        database: origin.database,
-        password: origin.password,
-        sslmode: mtls?.sslmode ?? "require",
-      };
-    },
-  );
+        }),
+      );
+    }
+    if ("serviceId" in origin) {
+      return Effect.die(
+        new HyperdriveDevOriginUnsupported({
+          logicalId: connection.LogicalId,
+          origin: "vpc",
+          message:
+            `Hyperdrive instance ${connection.LogicalId} has an origin that is reached through a Workers VPC Service. This is not supported in development mode. ` +
+            "Set the `dev` property to an origin reachable from your machine.",
+        }),
+      );
+    }
+    return Effect.succeed<Required<DevOrigin>>({
+      scheme: origin.scheme,
+      host: origin.host,
+      port: origin.port ?? defaultPort(origin.scheme),
+      user: origin.user,
+      database: origin.database,
+      password: origin.password,
+      sslmode: mtls?.sslmode ?? "require",
+    });
+  })(Output.all(connection.dev, connection.origin, connection.mtls));
   return Output.map(
     Output.all(connection.hyperdriveId, Output.asOutput(origin)),
     ([id, origin]) => ({

package/src/Cloudflare/Hyperdrive/Connection.ts

@@ -44,7 +44,33 @@ export type AccessOrigin = {
   accessClientSecret: Redacted.Redacted<string>;
 };
 
-export type Origin = PublicOrigin | AccessOrigin;
+/**
+ * Origin configuration for a private database reached through Workers VPC.
+ *
+ * Hyperdrive egresses through a TCP VPC Service
+ * ({@link https://developers.cloudflare.com/workers-vpc/ Workers VPC}), which
+ * routes over a Cloudflare Tunnel into the private network — e.g. an Aurora
+ * or RDS instance inside an AWS VPC. The host and port live on the VPC
+ * Service, so they are not repeated here. mTLS cannot be combined with a VPC
+ * origin; TLS is managed on the VPC Service.
+ */
+export type VpcOrigin = {
+  scheme: Scheme;
+  /**
+   * Identifier of the TCP VPC Service to connect through, e.g.
+   * `service.serviceId` of a `Cloudflare.Connectivity.DirectoryService`
+   * with `type: "tcp"`.
+   */
+  serviceId: string;
+  database: string;
+  user: string;
+  /**
+   * Database password.
+   */
+  password: Redacted.Redacted<string>;
+};
+
+export type Origin = PublicOrigin | AccessOrigin | VpcOrigin;
 
 export type Caching = {
   /**
@@ -89,7 +115,8 @@ export type Props = {
   name?: string;
   /**
    * Database connection origin. Hyperdrive supports public Postgres/MySQL
-   * databases and databases fronted by Cloudflare Access.
+   * databases, databases fronted by Cloudflare Access, and private databases
+   * reached through a Workers VPC Service.
    */
   origin: Origin;
   /**
@@ -148,6 +175,35 @@ export type Connection = Resource<
  * });
  * ```
  *
+ * ### Connecting to a private database
+ * A database inside a private network (e.g. Aurora or RDS in an AWS VPC) is
+ * reached through Workers VPC: run `cloudflared` inside the network with the
+ * Tunnel's token, expose the database as a TCP VPC Service, and point
+ * Hyperdrive at the service.
+ *
+ * **Example:** Aurora in an AWS VPC through Workers VPC
+ * ```typescript
+ * const tunnel = yield* Cloudflare.Tunnel.Tunnel("VpcTunnel");
+ * const service = yield* Cloudflare.Connectivity.DirectoryService("Aurora", {
+ *   type: "tcp",
+ *   tcpPort: 5432,
+ *   appProtocol: "postgresql",
+ *   host: {
+ *     hostname: "my-cluster.cluster-abc123.us-east-1.rds.amazonaws.com",
+ *     resolverNetwork: { tunnelId: tunnel.tunnelId },
+ *   },
+ * });
+ * const hd = yield* Cloudflare.Hyperdrive.Connection("Aurora", {
+ *   origin: {
+ *     scheme: "postgres",
+ *     serviceId: service.serviceId,
+ *     database: "app",
+ *     user: "app",
+ *     password: yield* Config.Redacted("DB_PASSWORD"),
+ *   },
+ * });
+ * ```
+ *
  * ### Binding to a Worker
  * **Example:** Using Hyperdrive inside a Worker
  * ```typescript
@@ -286,7 +342,7 @@ export const ProviderLive = () =>
                 Effect.gen(function* () {
                   const match = yield* findByName(name);
                   if (!match) {
-                    return yield* Effect.fail(originalError);
+                    return yield* originalError;
                   }
                   return yield* hyperdrive.updateConfig({
                     accountId,
@@ -298,10 +354,14 @@ export const ProviderLive = () =>
               ),
             )
       ).pipe(
+        // Cloudflare connects to the origin on create/update. A just-
+        // provisioned database, or a just-created Workers VPC Service that
+        // has not propagated yet (`destination_not_found`), is briefly
+        // unreachable.
         Effect.retry({
           while: (error) => error._tag === "HyperdriveOriginUnavailable",
-          schedule: Schedule.spaced("2 seconds"),
-          times: 10,
+          schedule: Schedule.spaced("3 seconds"),
+          times: 20,
         }),
       );
 
@@ -399,6 +459,15 @@ const unwrap = (v: string | Redacted.Redacted<string>): string =>
  * runtime schema also accepts `Redacted<string>`.
  */
 const toRequestOrigin = (origin: Origin) => {
+  if ("serviceId" in origin) {
+    return {
+      database: origin.database,
+      password: unwrap(origin.password),
+      scheme: origin.scheme,
+      serviceId: origin.serviceId,
+      user: origin.user,
+    };
+  }
   if ("accessClientId" in origin) {
     return {
       accessClientId: unwrap(origin.accessClientId),

package/src/Cloudflare/Iam/UserGroupMembership.ts

@@ -112,16 +112,14 @@ export const UserGroupMembershipProvider = () =>
             ),
             // Group removed out-of-band between enumeration and member
             // listing — skip it.
-            Effect.catchTag("UserGroupNotFound", () =>
-              Effect.succeed([] as UserGroupMembershipAttributes[]),
-            ),
-            // A group whose policy Cloudflare can't validate rejects the
-            // member listing with a 400 ("Policy validation failed"). It's
-            // not ours to enumerate — contribute nothing rather than failing
-            // the whole account-wide listing.
-            Effect.catchTag("PolicyValidationFailed", () =>
-              Effect.succeed([] as UserGroupMembershipAttributes[]),
-            ),
+            Effect.catchTags({
+              UserGroupNotFound: () => Effect.succeed([] as UserGroupMembershipAttributes[]),
+              // A group whose policy Cloudflare can't validate rejects the
+              // member listing with a 400 ("Policy validation failed"). It's
+              // not ours to enumerate — contribute nothing rather than failing
+              // the whole account-wide listing.
+              PolicyValidationFailed: () => Effect.succeed([] as UserGroupMembershipAttributes[]),
+            }),
           ),
         { concurrency: 10 },
       );

package/src/Cloudflare/Images/SigningKey.ts

@@ -172,12 +172,10 @@ export const SigningKeyProvider = () =>
         // The PUT response and the follow-up list both failed to surface
         // the key — eventual-consistency blip; fail typed so the engine
         // can retry the reconcile.
-        return yield* Effect.fail(
-          new images.KeyNotFound({
-            code: 5404,
-            message: `signing key ${name} not observable after create`,
-          }),
-        );
+        return yield* images.KeyNotFound.make({
+          code: 5404,
+          message: `signing key ${name} not observable after create`,
+        });
       }
 
       return toAttributes(observed, acct);

package/src/Cloudflare/Images/Variant.ts

@@ -257,12 +257,10 @@ export const VariantProvider = () =>
         // Create succeeded but neither the response body nor a re-read
         // surfaced the variant — eventual-consistency blip; fail typed so
         // the engine can retry the reconcile.
-        return yield* Effect.fail(
-          new images.VariantNotFound({
-            code: 5401,
-            message: `variant ${name} not observable after create`,
-          }),
-        );
+        return yield* images.VariantNotFound.make({
+          code: 5401,
+          message: `variant ${name} not observable after create`,
+        });
       }
 
       // 3. Sync — diff observed options against desired; PATCH requires the

package/src/Cloudflare/Intel/IndicatorFeed.ts

@@ -268,12 +268,10 @@ export const IndicatorFeedProvider = () =>
         }
       }
       if (!observed || observed.id == null) {
-        return yield* Effect.fail(
-          new intel.IndicatorFeedNotFound({
-            code: 0,
-            message: `Indicator feed "${name}" was not observable after creation`,
-          }),
-        );
+        return yield* intel.IndicatorFeedNotFound.make({
+          code: 0,
+          message: `Indicator feed "${name}" was not observable after creation`,
+        });
       }
       const feedId = observed.id;
 
@@ -319,12 +317,10 @@ export const IndicatorFeedProvider = () =>
 
       const final = yield* getFeed(accountId, feedId);
       if (!final) {
-        return yield* Effect.fail(
-          new intel.IndicatorFeedNotFound({
-            code: 0,
-            message: `Indicator feed ${feedId} disappeared during reconcile`,
-          }),
-        );
+        return yield* intel.IndicatorFeedNotFound.make({
+          code: 0,
+          message: `Indicator feed ${feedId} disappeared during reconcile`,
+        });
       }
       return toAttributes(final, accountId, snapshotHash);
     }),

package/src/Cloudflare/K2/K2Codec.ts

@@ -0,0 +1,153 @@
+import type * as k2 from "@distilled.cloud/cloudflare/k2";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import {
+  type ConsumedRecord,
+  type DecodedRecord,
+  type EncodedRecord,
+  K2SchemaError,
+  type Record as K2Record,
+  type RecordSchema,
+} from "./K2Types.ts";
+
+/**
+ * Record encoding shared by the K2 producer and consumer clients. Internal —
+ * not exported from the K2 barrel.
+ */
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+/** Header K2 producers set on schema-encoded (JSON) records. */
+export const JSON_HEADERS = { "content-type": "application/json" } as const;
+
+/** Normalize record content to bytes; strings are UTF-8 encoded. */
+export const toBytes = (content: Uint8Array | ArrayBuffer | string): Uint8Array =>
+  typeof content === "string"
+    ? encoder.encode(content)
+    : content instanceof Uint8Array
+      ? content
+      : new Uint8Array(content);
+
+/** Standard (padded) base64, chunked so large payloads don't overflow `apply`. */
+export const toBase64 = (bytes: Uint8Array): string => {
+  let binary = "";
+  const chunk = 0x8000;
+  for (let i = 0; i < bytes.length; i += chunk) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
+  }
+  return btoa(binary);
+};
+
+export const fromBase64 = (base64: string): Uint8Array => {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+};
+
+/** Encode untyped records: content to bytes, headers passed through. */
+export const encodeRecords = (records: ReadonlyArray<K2Record>): ReadonlyArray<EncodedRecord> =>
+  records.map((record) => ({
+    content: toBytes(record.content),
+    ...(record.headers && Object.keys(record.headers).length > 0
+      ? { headers: record.headers }
+      : {}),
+  }));
+
+/** Encode typed values to JSON records with the binding's schema. */
+export const encodeWithSchema =
+  <A>(schema: RecordSchema<A>) =>
+  (values: ReadonlyArray<A>): Effect.Effect<ReadonlyArray<EncodedRecord>, K2SchemaError> =>
+    Effect.forEach(values, (value) =>
+      Schema.encodeEffect(schema)(value).pipe(
+        Effect.mapError(
+          (cause) =>
+            new K2SchemaError({
+              message: `Could not encode K2 record: ${cause.message}`,
+              cause,
+            }),
+        ),
+        Effect.flatMap((encoded) =>
+          Effect.try({
+            try: (): EncodedRecord => ({
+              content: encoder.encode(JSON.stringify(encoded)),
+              headers: { ...JSON_HEADERS },
+            }),
+            catch: (cause) =>
+              new K2SchemaError({ message: "Could not serialize K2 record as JSON", cause }),
+          }),
+        ),
+      ),
+    );
+
+/** The `produce` request body shape for encoded records. */
+export const toProduceRecords = (records: ReadonlyArray<EncodedRecord>): Array<k2.ProduceRecord> =>
+  records.map((record) => ({
+    content: toBase64(record.content),
+    ...(record.headers ? { headers: record.headers } : {}),
+  }));
+
+/** Decode the `consume` response records into bytes + headers + timestamp. */
+export const fromConsumedRecords = (
+  records: ReadonlyArray<k2.ConsumedRecord>,
+): ReadonlyArray<ConsumedRecord> =>
+  records.map((record) => ({
+    content: fromBase64(record.content),
+    headers: Object.fromEntries(
+      Object.entries(record.headers ?? {}).filter(
+        (entry): entry is [string, string] => entry[1] !== undefined,
+      ),
+    ),
+    timestamp: new Date(record.timestampMs),
+  }));
+
+/** Decode JSON record content with a schema into `record.value`. */
+export const decodeWithSchema =
+  <A>(schema: RecordSchema<A>) =>
+  (
+    records: ReadonlyArray<ConsumedRecord>,
+  ): Effect.Effect<ReadonlyArray<DecodedRecord<A>>, K2SchemaError> =>
+    Effect.forEach(records, (record) =>
+      Effect.try({
+        try: () => JSON.parse(decoder.decode(record.content)) as unknown,
+        catch: (cause) =>
+          new K2SchemaError({ message: "K2 record content is not valid JSON", cause }),
+      }).pipe(
+        Effect.flatMap((json) =>
+          Schema.decodeUnknownEffect(schema)(json).pipe(
+            Effect.mapError(
+              (cause) =>
+                new K2SchemaError({
+                  message: `Could not decode K2 record: ${cause.message}`,
+                  cause,
+                }),
+            ),
+          ),
+        ),
+        Effect.map((value): DecodedRecord<A> => ({ ...record, value })),
+      ),
+    );
+
+/**
+ * Approximate size K2 counts against the 1 MB record limit: content plus
+ * header names and values.
+ */
+export const recordSize = (record: EncodedRecord): number => {
+  let size = record.content.byteLength;
+  for (const [key, value] of Object.entries(record.headers ?? {})) {
+    size += encoder.encode(key).byteLength + encoder.encode(value).byteLength;
+  }
+  return size;
+};
+
+/**
+ * Approximate wire size of a record inside a `produce` request: base64
+ * content (4/3 of the bytes) plus headers and JSON framing.
+ */
+export const wireSize = (record: EncodedRecord): number =>
+  Math.ceil(record.content.byteLength / 3) * 4 +
+  (recordSize(record) - record.content.byteLength) +
+  64;

package/src/Cloudflare/K2/K2Http.ts

@@ -0,0 +1,71 @@
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/http/HttpClient";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { Self } from "../../Self.ts";
+import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Credentials } from "../Credentials.ts";
+import { authorizeWith } from "../HttpClientUtils.ts";
+
+/**
+ * Shared scaffolding for the HTTP-backed K2 services. Internal — not
+ * exported from the K2 barrel.
+ */
+
+/**
+ * Injectable auth for the K2 HTTP clients. The scoped-token variant
+ * (`*Http`) and the current-credentials variant (`*Local`) share the same
+ * request path and differ only in how credentials reach the SDK operation.
+ * K2 data-plane operations are addressed by stream id, so no account id is
+ * needed.
+ */
+export interface K2Auth {
+  authorize: <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>,
+  ) => Effect.Effect<A, E, RuntimeContext>;
+}
+
+type K2PermissionGroup = "K2 Produce" | "K2 Consume";
+
+/**
+ * Mint (or extend) the host's scoped {@link AccountApiToken} with the given
+ * K2 permission group, bind it into the host at deploy time, and return
+ * the {@link K2Auth} that authorizes requests with it.
+ */
+export const makeK2HttpAuth = Effect.gen(function* () {
+  const Token = yield* AccountApiToken;
+  const self = yield* Self;
+  const env = yield* CloudflareEnvironment;
+
+  return Effect.fn(function* (resource: { LogicalId: string }, permissionGroup: K2PermissionGroup) {
+    const { accountId } = yield* env;
+    const token = yield* Token(`${self.LogicalId}Token`);
+    if (!globalThis.__ALCHEMY_RUNTIME__) {
+      yield* token.bind`${resource.LogicalId}`({
+        policies: [
+          {
+            effect: "allow",
+            permissionGroups: [permissionGroup],
+            resources: {
+              [`com.cloudflare.api.account.${accountId}`]: "*",
+            },
+          },
+        ],
+      });
+    }
+    const value = yield* token.value;
+    return { authorize: authorizeWith({ value }) } satisfies K2Auth;
+  });
+});
+
+/**
+ * Capture the ambient credentials (the stack's providers layer during
+ * stack-eval) so a client can run with the current credentials instead of a
+ * scoped token — for Actions and other deploy-time Effects.
+ */
+export const makeK2LocalAuth = Effect.gen(function* () {
+  const context = yield* Effect.context<Credentials | HttpClient.HttpClient>();
+  return {
+    authorize: (eff) => eff.pipe(Effect.provideContext(context)),
+  } satisfies K2Auth;
+});

package/src/Cloudflare/K2/K2Types.ts

@@ -0,0 +1,88 @@
+import type * as k2 from "@distilled.cloud/cloudflare/k2";
+import * as Data from "effect/Data";
+import type * as Schema from "effect/Schema";
+
+/**
+ * A record to append to a K2 stream.
+ *
+ * `content` is the payload: raw bytes, or a string encoded as UTF-8.
+ * `headers` are up to 32 string headers describing the content. A record
+ * (content and headers combined) can be at most 1 MB.
+ */
+export interface Record {
+  content: Uint8Array | ArrayBuffer | string;
+  headers?: { [key: string]: string };
+}
+
+/**
+ * A record in the shape every K2 producer path sends: bytes plus headers.
+ * Built by a client's `encode` and accepted by its `sendEncoded`.
+ */
+export interface EncodedRecord {
+  content: Uint8Array;
+  headers?: { [key: string]: string };
+}
+
+/**
+ * A record read from a K2 subscription. `content` is the decoded payload,
+ * `timestamp` is when K2 received the record.
+ */
+export interface ConsumedRecord {
+  content: Uint8Array;
+  headers: { [key: string]: string };
+  timestamp: Date;
+}
+
+/**
+ * A consumed record whose JSON content was decoded with a schema
+ * (`consumeStreamRecords(stream, { schema }, handler)`).
+ */
+export interface DecodedRecord<A> extends ConsumedRecord {
+  value: A;
+}
+
+/**
+ * A batch of records leased to one worker id for five minutes. Ack it once
+ * the records are processed, nack it to have them redelivered, or extend it
+ * while processing takes longer than the lease.
+ */
+export interface Batch {
+  batchId: string;
+  workerId: string;
+  /** When the lease expires. */
+  leasedUntil: Date;
+  records: ReadonlyArray<ConsumedRecord>;
+}
+
+/** Where a new subscription starts reading. */
+export type StartAt = "earliest" | "latest";
+
+/**
+ * A JSON codec for record payloads. `send` encodes values to JSON with it;
+ * `consumeStreamRecords` decodes record content with it.
+ */
+export type RecordSchema<A> = Schema.Codec<A, any, never, never>;
+
+/**
+ * Raised when a value cannot be encoded with (or a record decoded with) the
+ * binding's schema.
+ */
+export class K2SchemaError extends Data.TaggedError("K2SchemaError")<{
+  message: string;
+  cause?: unknown;
+}> {}
+
+/** Errors a K2 producer (`WriteStream`, `StreamSink`) can fail with. */
+export type ProduceError = k2.ProduceError | K2SchemaError;
+
+/** Errors {@link ReadSubscriptionClient.consume} can fail with. */
+export type ConsumeError = k2.ConsumeError;
+
+/** Errors {@link ReadSubscriptionClient.ack} can fail with. */
+export type AckError = k2.AckBatchError;
+
+/** Errors {@link ReadSubscriptionClient.nack} can fail with. */
+export type NackError = k2.NackBatchError;
+
+/** Errors {@link ReadSubscriptionClient.extend} can fail with. */
+export type ExtendError = k2.ExtendLeaseError;