alchemy 0.92.2 → 0.93.1

package/src/cloudflare/miniflare/build-worker-options.ts

@@ -4,6 +4,8 @@ import { assertNever } from "../../util/assert-never.ts";
 import { reservePort } from "../../util/find-open-port.ts";
 import type { HTTPServer } from "../../util/http.ts";
 import { logger } from "../../util/logger.ts";
+import { isAiSearchNamespace } from "../ai-search-namespace.ts";
+import { isAiSearch } from "../ai-search.ts";
 import type { CloudflareApi } from "../api.ts";
 import type {
   Binding,
@@ -53,7 +55,13 @@ type RemoteBinding =
   | Extract<
       WorkerBindingSpec,
       { type: "send_email" | "service" | "vpc_service" }
-    >;
+    >
+  // AI Search bindings reject the `raw` flag at the Cloudflare API
+  // validation layer (10333). Wrangler's upload form deliberately omits
+  // `raw` for these two binding types in
+  // packages/wrangler/src/deployment-bundle/create-worker-upload-form.ts,
+  // so we mirror that here for the remote-binding-proxy upload.
+  | Extract<WorkerBindingSpec, { type: "ai_search" | "ai_search_namespace" }>;
 
 type BaseWorkerOptions = {
   [K in keyof miniflare.WorkerOptions]: K extends
@@ -90,6 +98,35 @@ export const buildWorkerOptions = async (
       (options.bindings ??= {})[key] = binding;
       continue;
     }
+    if (isAiSearch(binding)) {
+      // AI Search instance bindings are not supported natively by Miniflare;
+      // proxy them to the deployed instance via the `remote-binding-proxy`
+      // worker (same mechanism used by `ai`, `vectorize`, etc.). Instance
+      // bindings are always scoped to the default namespace on the CF side,
+      // so the namespace need not be surfaced in the remote-proxy metadata.
+      //
+      // Note: unlike `ai`/`browser`/`vectorize`, AI Search bindings must NOT
+      // carry `raw: true` — CF's API rejects that field on `ai_search` and
+      // `ai_search_namespace` bindings (error 10333). This mirrors wrangler's
+      // create-worker-upload-form.ts which also omits `raw` for these two
+      // binding types.
+      remoteBindings.push({
+        type: "ai_search",
+        name: key,
+        instance_name: binding.name,
+      });
+      continue;
+    }
+    if (isAiSearchNamespace(binding)) {
+      // See comment above on `ai_search`: `raw: true` is rejected by CF for
+      // this binding type, so we push without it.
+      remoteBindings.push({
+        type: "ai_search_namespace",
+        name: key,
+        namespace: binding.namespace,
+      });
+      continue;
+    }
     if (binding.type === "cloudflare::Worker::Self") {
       (options.serviceBindings ??= {})[key] = miniflare.kCurrentWorker;
       continue;
@@ -527,6 +564,18 @@ export const buildWorkerOptions = async (
             remoteProxyConnectionString: remoteProxy.connectionString,
           };
           break;
+        case "ai_search":
+          (options.aiSearchInstances ??= {})[binding.name] = {
+            instance_name: binding.instance_name,
+            remoteProxyConnectionString: remoteProxy.connectionString,
+          };
+          break;
+        case "ai_search_namespace":
+          (options.aiSearchNamespaces ??= {})[binding.name] = {
+            namespace: binding.namespace,
+            remoteProxyConnectionString: remoteProxy.connectionString,
+          };
+          break;
         default: {
           assertNever(binding);
         }

package/src/cloudflare/miniflare/remote-binding-proxy.ts

@@ -39,7 +39,12 @@ export async function createRemoteProxyWorker(input: {
   bindings: WorkerBindingSpec[];
 }): Promise<RemoteBindingProxy> {
   const script = await getInternalWorkerBundle("remote-binding-proxy");
-  const [token, { host, accessToken }] = await Promise.all([
+  // We must create the preview token BEFORE probing for Cloudflare Access:
+  // a preview worker URL only returns the Access 302 when the request carries
+  // the preview token (otherwise CF responds with 404 regardless of Access
+  // configuration). Probing without the token would incorrectly report
+  // "no Access" for accounts that do gate workers.dev behind Access.
+  const [token, subdomain] = await Promise.all([
     createWorkersPreviewToken(input.api, {
       name: input.name,
       metadata: {
@@ -54,14 +59,10 @@ export async function createRemoteProxyWorker(input: {
         minimal_mode: true,
       },
     }),
-    getAccountSubdomain(input.api).then(async (subdomain) => {
-      const host = `${input.name}.${subdomain}.workers.dev`;
-      return {
-        host,
-        accessToken: await getAccessToken(host),
-      };
-    }),
+    getAccountSubdomain(input.api),
   ]);
+  const host = `${input.name}.${subdomain}.workers.dev`;
+  const accessToken = await getAccessToken(host, token);
 
   const baseHeaders: Record<string, string> = {
     "cf-workers-preview-token": token,
@@ -158,7 +159,13 @@ async function createWorkersPreviewToken(
 
 async function prewarm(url: string, previewToken: string) {
   try {
-    const accessToken = await getAccessToken(new URL(url).hostname);
+    // Pass the preview token to the Access probe — prewarm targets a preview
+    // worker URL, which only surfaces an Access 302 when the request carries
+    // the preview token.
+    const accessToken = await getAccessToken(
+      new URL(url).hostname,
+      previewToken,
+    );
     await fetch(url, {
       method: "POST",
       headers: {
@@ -197,42 +204,59 @@ async function createWorkersPreviewSession(api: CloudflareApi) {
 /**
  * If the given domain uses Cloudflare Access, fetches the access token for the domain.
  * Otherwise, returns undefined.
+ *
+ * For workers.dev preview URLs, pass the `cf-workers-preview-token` alongside
+ * the HEAD probe: the preview worker only surfaces its Access 302 when the
+ * request carries the preview token (a bare HEAD returns 404 regardless of
+ * Access configuration).
+ *
  * @see https://github.com/cloudflare/workers-sdk/blob/a5eb5134f73d3983655d325a4de71c6370c57faa/packages/wrangler/src/user/access.ts#L10
  */
-const getAccessToken = memoize(async (hostname: string) => {
-  if (!(await domainUsesAccess(hostname))) {
-    return undefined;
-  }
-  const result = await Scope.current
-    .exec(`access-${hostname}`, `cloudflared access login ${hostname}`)
-    .catch(() => {
-      throw new Error(
-        [
-          `The \`cloudflared\` CLI is not installed, but is required to access the domain "${hostname}".`,
-          `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation and run \`cloudflare access login ${hostname}\`.`,
-        ].join("\n"),
-      );
-    });
-  const matches = result.stdout.match(/fetched your token:\n\n(.*)/m);
-  if (matches?.[1]) {
-    return matches[1];
-  }
-  const error = new Error(
-    `Failed to get access token for domain "${hostname}".`,
-  );
-  Object.assign(error, result);
-  throw error;
-});
+const getAccessToken = memoize(
+  async (hostname: string, previewToken?: string) => {
+    if (!(await domainUsesAccess(hostname, previewToken))) {
+      return undefined;
+    }
+    const result = await Scope.current
+      .exec(`access-${hostname}`, `cloudflared access login ${hostname}`)
+      .catch(() => {
+        throw new Error(
+          [
+            `The \`cloudflared\` CLI is not installed, but is required to access the domain "${hostname}".`,
+            `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation and run \`cloudflare access login ${hostname}\`.`,
+          ].join("\n"),
+        );
+      });
+    const matches = result.stdout.match(/fetched your token:\n\n(.*)/m);
+    if (matches?.[1]) {
+      return matches[1];
+    }
+    const error = new Error(
+      `Failed to get access token for domain "${hostname}".`,
+    );
+    Object.assign(error, result);
+    throw error;
+  },
+  (hostname) => hostname,
+);
 
 /**
  * Returns true if the domain uses Cloudflare Access.
+ *
+ * @param hostname  the workers.dev preview host
+ * @param previewToken  optional preview token; required when probing a
+ *   preview-worker URL because CF only serves the Access 302 to requests
+ *   that carry the token.
  */
-async function domainUsesAccess(hostname: string) {
+async function domainUsesAccess(hostname: string, previewToken?: string) {
   try {
     const response = await fetch(`https://${hostname}`, {
       method: "HEAD",
       redirect: "manual",
       signal: AbortSignal.timeout(1000),
+      headers: previewToken
+        ? { "cf-workers-preview-token": previewToken }
+        : undefined,
     });
     return !!(
       response.status === 302 &&

package/src/cloudflare/website.ts

@@ -10,6 +10,7 @@ import { Assets } from "./assets.ts";
 import type { Bindings } from "./bindings.ts";
 import { DEFAULT_COMPATIBILITY_DATE } from "./compatibility-date.ts";
 import { unionCompatibilityFlags } from "./compatibility-presets.ts";
+import { quickTunnel } from "./quick-tunnel.ts";
 import {
   extractStringAndSecretBindings,
   unencryptSecrets,
@@ -78,6 +79,10 @@ export interface WebsiteProps<
          * The local domain to use for the dev server
          */
         domain?: string;
+        /**
+         * Whether to use a Cloudflare Tunnel for the dev server
+         */
+        tunnel?: boolean;
         /**
          * Additional environment variables to set when running the dev command
          */
@@ -363,6 +368,10 @@ export async function Website<
         ALCHEMY_ROOT: Scope.current.rootDir,
       },
     });
+    if (url && ((typeof dev === "object" && dev.tunnel) || scope.tunnel)) {
+      const { tunnelUrl } = await quickTunnel(scope, url);
+      url = tunnelUrl;
+    }
   }
 
   return (await Worker(id, {
@@ -377,7 +386,16 @@ export async function Website<
           }
         : {}),
     },
-    dev: url ? { url } : undefined,
+    dev: worker.dev
+      ? {
+          url: url as never,
+          port: worker.dev.port,
+          remote: worker.dev.remote,
+          tunnel: worker.dev.tunnel,
+        }
+      : url
+        ? { url }
+        : undefined,
   })) as Website<B, RPC>;
 }
 

package/src/cloudflare/worker-metadata.ts

@@ -2,6 +2,8 @@ import { assertNever } from "../util/assert-never.ts";
 import { camelToSnakeObjectDeep } from "../util/camel-to-snake.ts";
 import { logger } from "../util/logger.ts";
 import { memoize } from "../util/memoize.ts";
+import { isAiSearchNamespace } from "./ai-search-namespace.ts";
+import { isAiSearch } from "./ai-search.ts";
 import { extractCloudflareResult } from "./api-response.ts";
 import type { CloudflareApi } from "./api.ts";
 import type {
@@ -418,7 +420,29 @@ export async function prepareWorkerMetadata(
   for (const [bindingName, binding] of Object.entries(bindings)) {
     // Create a copy of the binding to avoid modifying the original
 
-    if (typeof binding === "string") {
+    if (isAiSearch(binding)) {
+      // Single-instance bindings (ai_search) are always scoped to the `default` namespace.
+      if (binding.namespace !== undefined && binding.namespace !== "default") {
+        throw new Error(
+          `Worker binding "${bindingName}" uses a single-instance AiSearch binding (type: "ai_search"), ` +
+            `but the bound AiSearch instance "${binding.name}" is in namespace "${binding.namespace}". ` +
+            `Single-instance bindings only support the "default" namespace.\n` +
+            `Fix: either (1) create the AiSearch without a custom namespace, or ` +
+            `(2) bind the enclosing AiSearchNamespace and use \`env.${bindingName}.get("${binding.name}")\`.`,
+        );
+      }
+      meta.bindings.push({
+        type: "ai_search",
+        name: bindingName,
+        instance_name: binding.name,
+      });
+    } else if (isAiSearchNamespace(binding)) {
+      meta.bindings.push({
+        type: "ai_search_namespace",
+        name: bindingName,
+        namespace: binding.namespace,
+      });
+    } else if (typeof binding === "string") {
       meta.bindings.push({
         type: "plain_text",
         name: bindingName,

package/src/cloudflare/worker.ts

@@ -329,6 +329,12 @@ export interface BaseWorkerProps<
          * @default false
          */
         adopt?: boolean;
+        /**
+         * Forcibly transfer the hostname when it is currently bound to a
+         * different Worker service. See {@link CustomDomainProps.overrideExistingOrigin}.
+         * @default false
+         */
+        overrideExistingOrigin?: boolean;
       }
   )[];
 
@@ -1497,6 +1503,7 @@ async function provisionResources<B extends Bindings>(
           name: domain,
           zoneId: undefined,
           adopt: props.adopt,
+          overrideExistingOrigin: undefined,
         };
       }
       if (domain.domainName === "") {
@@ -1506,6 +1513,7 @@ async function provisionResources<B extends Bindings>(
         name: domain.domainName,
         zoneId: domain.zoneId,
         adopt: domain.adopt ?? props.adopt,
+        overrideExistingOrigin: domain.overrideExistingOrigin,
       };
     }),
     eventSources: props.eventSources?.map((eventSource) => {
@@ -1578,6 +1586,7 @@ async function provisionResources<B extends Bindings>(
               name: domain.name,
               zoneId: domain.zoneId,
               adopt: domain.adopt,
+              overrideExistingOrigin: domain.overrideExistingOrigin,
               delete: props.delete,
               workerName: options.name,
               dev: options.local,

package/src/cloudflare/wrangler.json.ts

@@ -6,6 +6,8 @@ import { Resource } from "../resource.ts";
 import { Scope } from "../scope.ts";
 import { isSecret } from "../secret.ts";
 import { assertNever } from "../util/assert-never.ts";
+import { isAiSearchNamespace } from "./ai-search-namespace.ts";
+import { isAiSearch } from "./ai-search.ts";
 import { createCloudflareApi } from "./api.ts";
 import type { Bindings } from "./bindings.ts";
 import { getCloudflareRegistryWithAccountNamespace } from "./container.ts";
@@ -289,6 +291,8 @@ async function processBindings(
   const containers: WranglerJsonConfig["containers"] = [];
   const workerLoaders: WranglerJsonConfig["worker_loaders"] = [];
   const vpcServices: WranglerJsonConfig["vpc_services"] = [];
+  const aiSearchInstances: WranglerJsonConfig["ai_search"] = [];
+  const aiSearchNamespaces: WranglerJsonConfig["ai_search_namespaces"] = [];
 
   for (const eventSource of eventSources ?? []) {
     if (isQueueEventSource(eventSource)) {
@@ -321,6 +325,26 @@ async function processBindings(
     } else if (writeSecrets && isSecret(binding)) {
       spec.vars ??= {};
       spec.vars[bindingName] = binding as any;
+    } else if (isAiSearch(binding)) {
+      // AI Search discriminates via ResourceKind (isAiSearch) rather than
+      // binding.type — `AiSearch.type` is the *source* type ("r2" |
+      // "web-crawler") and so would collide with `r2_bucket` string
+      // matching below. Checking here at the top of the chain mirrors the
+      // ordering in worker-metadata.ts.
+      aiSearchInstances.push({
+        binding: bindingName,
+        instance_name: binding.name,
+        // AI Search is not natively supported by Miniflare — emitting
+        // `remote: true` lets `wrangler dev` proxy to the deployed
+        // instance (matches vectorize / browser / ai / vpc_service).
+        remote: true,
+      });
+    } else if (isAiSearchNamespace(binding)) {
+      aiSearchNamespaces.push({
+        binding: bindingName,
+        namespace: binding.namespace,
+        remote: true,
+      });
     } else if (binding.type === "cloudflare::Worker::Self") {
       // Self(service) binding
       services.push({
@@ -646,4 +670,12 @@ async function processBindings(
   if (workerLoaders.length > 0) {
     spec.worker_loaders = workerLoaders;
   }
+
+  if (aiSearchInstances.length > 0) {
+    spec.ai_search = aiSearchInstances;
+  }
+
+  if (aiSearchNamespaces.length > 0) {
+    spec.ai_search_namespaces = aiSearchNamespaces;
+  }
 }

package/src/docker/api.ts

@@ -256,10 +256,19 @@ export class DockerApi {
    * Pull Docker image
    *
    * @param image Image name and tag
+   * @param options Pull options
    * @returns Result of the pull command
    */
-  async pullImage(image: string): Promise<{ stdout: string; stderr: string }> {
-    return this.exec(["pull", image]);
+  async pullImage(
+    image: string,
+    options?: { platform?: string },
+  ): Promise<{ stdout: string; stderr: string }> {
+    const args = ["pull"];
+    if (options?.platform) {
+      args.push("--platform", options.platform);
+    }
+    args.push(image);
+    return this.exec(args);
   }
 
   async tagImage(

package/src/docker/image.ts

@@ -1,10 +1,10 @@
 import fs from "node:fs/promises";
-import os from "node:os";
 import path from "pathe";
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
 import type { Secret } from "../secret.ts";
 import { DockerApi } from "./api.ts";
+import { pushImageToRegistry } from "./registry.ts";
 import type { RemoteImage } from "./remote-image.ts";
 
 /**
@@ -66,9 +66,9 @@ export interface DockerBuildOptions {
 }
 
 export interface ImageRegistry {
+  server: string;
   username: string;
   password: Secret;
-  server: string;
 }
 
 /**
@@ -285,63 +285,12 @@ export const Image = Resource(
     let repoDigest: string | undefined;
     let finalImageRef = imageRef;
     if (props.registry && !props.skipPush) {
-      const { server, username, password } = props.registry;
-
-      // Ensure the registry server does not have trailing slash
-      const registryHost = server.replace(/\/$/, "");
-
-      // Determine if the built image already includes a registry host (e.g. ghcr.io/user/repo)
-      const firstSegment = imageRef.split("/")[0];
-      const hasRegistryPrefix = firstSegment.includes(".");
-
-      // Compose the target image reference that will be pushed
-      const targetImage = hasRegistryPrefix
-        ? imageRef // already fully-qualified
-        : `${registryHost}/${imageRef}`;
-
-      try {
-        // Create a temporary directory that will act as an isolated Docker config
-        // (credentials) directory. This prevents race-conditions when multiple
-        // concurrent tests perform `docker login` / `logout` by ensuring each
-        // Image operation has its own credential store.
-        const tempConfigDir = await fs.mkdtemp(
-          path.join(os.tmpdir(), "docker-config-"),
-        );
-        const api = new DockerApi({ configDir: tempConfigDir });
-
-        // Authenticate to registry using the isolated config directory
-        await api.login(registryHost, username, password.unencrypted);
-
-        // Tag local image with fully qualified name if necessary
-        if (targetImage !== imageRef) {
-          await api.exec(["tag", imageRef, targetImage]);
-        }
-
-        // Push the image
-        const { stdout: pushOut } = await api.exec(["push", targetImage]);
-
-        // Attempt to extract the repo digest from push output
-        const digestMatch = /digest:\s+([a-z0-9]+:[a-f0-9]{64})/.exec(pushOut);
-        if (digestMatch) {
-          const digestHash = digestMatch[1];
-          // Strip tag (anything after last :) to build image@digest reference
-          const [repoWithoutTag] =
-            targetImage.split(":").length > 2
-              ? [targetImage] // unlikely but safety
-              : [targetImage.substring(0, targetImage.lastIndexOf(":"))];
-          repoDigest = `${repoWithoutTag}@${digestHash}`;
-        }
-
-        // Update the final image reference to point at the pushed image
-        finalImageRef = targetImage;
-      } finally {
-        // Clean up credentials from the isolated config
-        await api.logout(registryHost);
-      }
+      const pushedImage = await pushImageToRegistry(imageRef, props.registry);
+      finalImageRef = pushedImage.imageRef;
+      repoDigest = pushedImage.repoDigest;
     }
     return {
       kind: "Image",
-      ...props,
       tag,
       name,
       imageRef: finalImageRef,

package/src/docker/registry.ts

@@ -0,0 +1,62 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "pathe";
+import { Secret, type Secret as SecretValue } from "../secret.ts";
+import { DockerApi } from "./api.ts";
+
+export interface RegistryPushCredentials {
+  server: string;
+  username: string;
+  password: string | SecretValue;
+}
+
+export async function pushImageToRegistry(
+  imageRef: string,
+  registry: RegistryPushCredentials,
+): Promise<{
+  imageRef: string;
+  repoDigest?: string;
+}> {
+  const registryHost = registry.server.replace(/\/$/, "");
+  const password = Secret.unwrap(registry.password);
+
+  const firstSegment = imageRef.split("/")[0];
+  const hasRegistryPrefix = firstSegment.includes(".");
+  const targetImage = hasRegistryPrefix
+    ? imageRef
+    : `${registryHost}/${imageRef}`;
+
+  let repoDigest: string | undefined;
+  let api: DockerApi | undefined;
+
+  try {
+    const tempConfigDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "docker-config-"),
+    );
+    api = new DockerApi({ configDir: tempConfigDir });
+
+    await api.login(registryHost, registry.username, password);
+
+    if (targetImage !== imageRef) {
+      await api.exec(["tag", imageRef, targetImage]);
+    }
+
+    const { stdout } = await api.exec(["push", targetImage]);
+    const digestMatch = /digest:\s+([a-z0-9]+:[a-f0-9]{64})/.exec(stdout);
+    if (digestMatch) {
+      const digestHash = digestMatch[1];
+      const [repoWithoutTag] =
+        targetImage.split(":").length > 2
+          ? [targetImage]
+          : [targetImage.substring(0, targetImage.lastIndexOf(":"))];
+      repoDigest = `${repoWithoutTag}@${digestHash}`;
+    }
+
+    return {
+      imageRef: targetImage,
+      repoDigest,
+    };
+  } finally {
+    await api?.logout(registryHost);
+  }
+}