alchemy 0.63.1 → 0.65.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "0.63.1",
+  "version": "0.65.0",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
   "homepage": "https://alchemy.run",
@@ -147,7 +147,7 @@
   },
   "dependencies": {
     "@aws-sdk/credential-providers": "^3.0.0",
-    "@cloudflare/unenv-preset": "^2.6.1",
+    "@cloudflare/unenv-preset": "^2.6.3",
     "@iarna/toml": "^2.2.5",
     "@smithy/node-config-provider": "^4.0.0",
     "aws4fetch": "^1.0.20",
@@ -182,9 +182,10 @@
     "@aws-sdk/client-ssm": "^3.0.0",
     "@aws-sdk/client-sts": "^3.0.0",
     "@cloudflare/vite-plugin": "^1.10.1",
-    "@cloudflare/workers-types": "*",
+    "@cloudflare/workers-types": "^4.20250805.0",
     "@libsql/client": "^0.15.12",
     "@octokit/rest": "^21.1.1",
+    "@opennextjs/cloudflare": "^1.6.5",
     "astro": "^5.13.2",
     "drizzle-orm": "^0.44.2",
     "rwsdk": "^0.1.36",
@@ -224,6 +225,9 @@
     "@cloudflare/workers-types": {
       "optional": true
     },
+    "@opennextjs/cloudflare": {
+      "optional": true
+    },
     "@octokit/rest": {
       "optional": true
     },
@@ -269,6 +273,7 @@
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "latest",
     "@types/ws": "^8.18.1",
+    "@workos-inc/node": "^7.69.1",
     "arktype": "^2.1.16",
     "astro": "^5.13.2",
     "braintrust": "^0.0.201",

package/src/alchemy.ts

@@ -1,7 +1,7 @@
 import { execArgv } from "node:process";
 import { onExit } from "signal-exit";
-import { ReplacedSignal } from "./apply.ts";
-import { DestroyStrategy, DestroyedSignal, destroy } from "./destroy.ts";
+import { isReplacedSignal } from "./apply.ts";
+import { DestroyStrategy, destroy, isDestroyedSignal } from "./destroy.ts";
 import { env } from "./env.ts";
 import {
   ResourceFQN,
@@ -239,6 +239,10 @@ export interface AlchemyOptions {
    * @default "sequential"
    */
   destroyStrategy?: DestroyStrategy;
+  /**
+   * If true, children of the resource will not be destroyed (but their state will be deleted).
+   */
+  noop?: boolean;
   /**
    * If true, will not print any Create/Update/Delete messages.
    *
@@ -327,6 +331,7 @@ async function run<T>(
     scopeName: id,
     telemetryClient,
   });
+  let noop = options?.noop ?? false;
   try {
     if (options?.isResource !== true && _scope.parent) {
       // TODO(sam): this is an awful hack to differentiate between naked scopes and resources
@@ -364,13 +369,16 @@ async function run<T>(
     }
     return await _scope.run(async () => fn.bind(_scope)(_scope));
   } catch (error) {
-    if (
-      !(error instanceof DestroyedSignal || error instanceof ReplacedSignal)
-    ) {
+    if (!(isDestroyedSignal(error) || isReplacedSignal(error))) {
       _scope.fail();
     }
+    if (isDestroyedSignal(error)) {
+      noop = noop || error.noop;
+    }
     throw error;
   } finally {
-    await _scope.finalize();
+    await _scope.finalize({
+      noop,
+    });
   }
 }

package/src/apply.ts

@@ -22,6 +22,7 @@ import type { Telemetry } from "./util/telemetry/index.ts";
 export interface ApplyOptions {
   quiet?: boolean;
   alwaysUpdate?: boolean;
+  noop?: boolean;
 }
 
 export function apply<Out extends Resource>(
@@ -32,7 +33,12 @@ export function apply<Out extends Resource>(
   return _apply(resource, props, options);
 }
 
+export function isReplacedSignal(error: any): error is ReplacedSignal {
+  return error instanceof Error && (error as any).kind === "ReplacedSignal";
+}
+
 export class ReplacedSignal extends Error {
+  readonly kind = "ReplacedSignal";
   public force: boolean;
 
   constructor(force?: boolean) {
@@ -185,6 +191,7 @@ async function _apply<Out extends Resource>(
           isResource: true,
           parent: scope,
           destroyStrategy: provider.options?.destroyStrategy ?? "sequential",
+          noop: options?.noop,
         },
         async () =>
           await provider.handler.bind(ctx)(resource[ResourceID], props),
@@ -199,6 +206,7 @@ async function _apply<Out extends Resource>(
               props: state.oldProps,
               output: oldOutput,
             },
+            noop: options?.noop,
           });
         } else {
           if (
@@ -219,7 +227,11 @@ async function _apply<Out extends Resource>(
 
         output = await alchemy.run(
           resource[ResourceID],
-          { isResource: true, parent: scope },
+          {
+            isResource: true,
+            parent: scope,
+            noop: options?.noop,
+          },
           async () =>
             provider.handler.bind(
               context({

package/src/cloudflare/bindings.ts

@@ -10,7 +10,7 @@ import type { AnalyticsEngineDataset } from "./analytics-engine.ts";
 import type { Assets } from "./assets.ts";
 import type { Bound } from "./bound.ts";
 import type { BrowserRendering } from "./browser-rendering.ts";
-import type { R2Bucket } from "./bucket.ts";
+import type { R2Bucket, R2BucketJurisdiction } from "./bucket.ts";
 import type { Container } from "./container.ts";
 import type { D1Database } from "./d1-database.ts";
 import type { DispatchNamespace } from "./dispatch-namespace.ts";
@@ -317,6 +317,8 @@ export interface WorkerBindingR2Bucket {
   type: "r2_bucket";
   /** Bucket name */
   bucket_name: string;
+  /** Jurisdiction */
+  jurisdiction?: R2BucketJurisdiction;
 }
 
 /**

package/src/cloudflare/bucket.ts

@@ -15,6 +15,8 @@ import {
 } from "./api.ts";
 import { deleteMiniflareBinding } from "./miniflare/delete.ts";
 
+export type R2BucketJurisdiction = "default" | "eu" | "fedramp";
+
 /**
  * Properties for creating or updating an R2 Bucket
  */
@@ -44,7 +46,7 @@ export interface BucketProps extends CloudflareApiOptions {
    * Optional jurisdiction for the bucket
    * Determines the regulatory jurisdiction the bucket data falls under
    */
-  jurisdiction?: "default" | "eu" | "fedramp";
+  jurisdiction?: R2BucketJurisdiction;
 
   /**
    * Whether to allow public access through the r2.dev subdomain

package/src/cloudflare/bundle/cloudflare-internal.ts

@@ -0,0 +1,42 @@
+import type { Plugin } from "esbuild";
+import { dedent } from "../../util/dedent.ts";
+
+/**
+ * An esbuild plugin that will mark any `cloudflare:...` imports as external.
+ */
+export const cloudflareInternalPlugin: Plugin = {
+  name: "cloudflare-internal-imports",
+  setup(pluginBuild) {
+    const paths = new Set();
+    pluginBuild.onStart(() => paths.clear());
+    pluginBuild.onResolve({ filter: /^cloudflare:.*/ }, (args) => {
+      paths.add(args.path);
+      return { external: true };
+    });
+    pluginBuild.onEnd(() => {
+      if (pluginBuild.initialOptions.format === "iife" && paths.size > 0) {
+        // If we are bundling in "Service Worker" mode,
+        // imports of external modules such as `cloudflare:...`,
+        // which won't be inlined/bundled by esbuild, are invalid.
+        const pathList = new Intl.ListFormat("en-US").format(
+          Array.from(paths.keys())
+            .map((p) => `"${p}"`)
+            .sort(),
+        );
+        return {
+          errors: [
+            {
+              text: dedent`
+                Unexpected external import of ${pathList}.
+                Your worker has no default export, which means it is assumed to be a Service Worker format Worker.
+                Did you mean to create a ES Module format Worker?
+                If so, try adding \`export default { ... }\` in your entry-point.
+                See https://developers.cloudflare.com/workers/reference/migrate-to-module-workers/.
+              `,
+            },
+          ],
+        };
+      }
+    });
+  },
+};

package/src/cloudflare/bundle/nodejs-builtin-modules.ts

@@ -0,0 +1,14 @@
+import { builtinModules } from "node:module";
+
+export const NODEJS_MODULES_RE = new RegExp(
+  `^(node:)?(${builtinModules
+    .filter(
+      (m) =>
+        ![
+          // in some runtimes (like bun), `ws` is a built-in module but is not in `node`
+          // bundling for `nodejs_compat` should not polyfill these modules
+          "ws",
+        ].includes(m),
+    )
+    .join("|")})$`,
+);

package/src/cloudflare/bundle/plugin-als-external.ts

@@ -0,0 +1,13 @@
+import type { Plugin } from "esbuild";
+
+/**
+ * An esbuild plugin that will mark `node:async_hooks` imports as external.
+ */
+export const esbuildPluginAsyncLocalStorage: Plugin = {
+  name: "async-local-storage-imports",
+  setup(pluginBuild) {
+    pluginBuild.onResolve({ filter: /^node:async_hooks(\/|$)/ }, () => {
+      return { external: true };
+    });
+  },
+};

package/src/cloudflare/bundle/plugin-hybrid-node-compat.ts

@@ -4,9 +4,10 @@
 
 import type { Plugin, PluginBuild } from "esbuild";
 import assert from "node:assert";
-import module, { createRequire } from "node:module";
+import { createRequire } from "node:module";
 import nodePath from "node:path";
 import { dedent } from "../../util/dedent.ts";
+import { NODEJS_MODULES_RE } from "./nodejs-builtin-modules.ts";
 
 const _require =
   typeof require === "undefined" ? createRequire(import.meta.url) : require;
@@ -19,15 +20,34 @@ const REQUIRED_UNENV_ALIAS_NAMESPACE = "required-unenv-alias";
  *
  * @returns ESBuild plugin
  */
-export function esbuildPluginHybridNodeCompat(): Plugin {
+export function esbuildPluginHybridNodeCompat({
+  compatibilityDate,
+  compatibilityFlags,
+}: {
+  compatibilityDate?: string;
+  compatibilityFlags?: string[];
+}): Plugin {
   return {
     name: "hybrid-nodejs_compat",
-    setup: async (build) => {
+    async setup(build) {
       // `unenv` and `@cloudflare/unenv-preset` only publish esm
       const { defineEnv } = await import("unenv");
-      const { cloudflare } = await import("@cloudflare/unenv-preset");
+      const { getCloudflarePreset } = await import("@cloudflare/unenv-preset");
+
       const { alias, inject, external, polyfill } = defineEnv({
-        presets: [cloudflare],
+        presets: [
+          getCloudflarePreset({
+            compatibilityDate,
+            compatibilityFlags,
+          }),
+          {
+            alias: {
+              // Force esbuild to use the node implementation of debug instead of unenv's no-op stub.
+              // The alias is processed by handleUnenvAliasedPackages which uses require.resolve().
+              debug: "debug",
+            },
+          },
+        ],
         npmShims: true,
       }).env;
 
@@ -39,19 +59,6 @@ export function esbuildPluginHybridNodeCompat(): Plugin {
   };
 }
 
-const NODEJS_MODULES_RE = new RegExp(
-  `^(node:)?(${module.builtinModules
-    .filter(
-      (m) =>
-        ![
-          // in some runtimes (like bun), `ws` is a built-in module but is not in `node`
-          // bundling for `nodejs_compat` should not polyfill these modules
-          "ws",
-        ].includes(m),
-    )
-    .join("|")})$`,
-);
-
 /**
  * If we are bundling a "Service Worker" formatted Worker, imports of external modules,
  * which won't be inlined/bundled by esbuild, are invalid.
@@ -108,8 +115,8 @@ function handleRequireCallsToNodeJSBuiltins(build: PluginBuild) {
     ({ path }) => {
       return {
         contents: dedent`
-            import libDefault from '${path}';
-            module.exports = libDefault;`,
+          import libDefault from '${path}';
+          module.exports = libDefault;`,
         loader: "js",
       };
     },
@@ -133,7 +140,7 @@ function handleUnenvAliasedPackages(
   for (const [module, unresolvedAlias] of Object.entries(alias)) {
     try {
       aliasAbsolute[module] = _require.resolve(unresolvedAlias);
-    } catch (_e) {
+    } catch {
       // this is an alias for package that is not installed in the current app => ignore
     }
   }
@@ -144,17 +151,12 @@ function handleUnenvAliasedPackages(
 
   build.onResolve({ filter: UNENV_ALIAS_RE }, (args) => {
     const unresolvedAlias = alias[args.path];
-
     // Convert `require()` calls for NPM packages to a virtual ES Module that can be imported avoiding the require calls.
     // Note: Does not apply to Node.js packages that are handled in `handleRequireCallsToNodeJSBuiltins`
     if (
       args.kind === "require-call" &&
       (unresolvedAlias.startsWith("unenv/npm/") ||
-        unresolvedAlias.startsWith("unenv/mock/") ||
-        // this does not exist in the original wrangler code but does seem to resolve the problem
-        // TODO(sam): is this the right solution? Why does the same code work in wrangler?
-        unresolvedAlias.startsWith("@cloudflare/unenv-preset/npm/") ||
-        unresolvedAlias.startsWith("@cloudflare/unenv-preset/mock/"))
+        unresolvedAlias.startsWith("unenv/mock/"))
     ) {
       return {
         path: args.path,
@@ -200,7 +202,6 @@ function handleNodeJSGlobals(
 ) {
   const UNENV_VIRTUAL_MODULE_RE = /_virtual_unenv_global_polyfill-(.+)$/;
   const prefix = nodePath.resolve(
-    // getBasePath(),
     import.meta.dirname,
     "_virtual_unenv_global_polyfill-",
   );

package/src/cloudflare/bundle/plugin-node-compat.ts

@@ -0,0 +1,114 @@
+import type { Plugin } from "esbuild";
+import type { NodeJSCompatMode } from "miniflare";
+import { relative } from "node:path";
+import chalk from "picocolors";
+import { dedent } from "../../util/dedent.ts";
+import { logger } from "../../util/logger.ts";
+import { NODEJS_MODULES_RE } from "./nodejs-builtin-modules.ts";
+
+/**
+ * An esbuild plugin that will:
+ * - mark any `node:...` imports as external
+ * - warn if there are node imports (if not in v1 mode)
+ *
+ * Applies to: null, als, legacy and v1 modes.
+ */
+export const esbuildPluginNodeCompatImports = (
+  mode: NodeJSCompatMode,
+): Plugin => ({
+  name: "nodejs_compat-imports",
+  setup(pluginBuild) {
+    // Infinite loop detection
+    const seen = new Set<string>();
+
+    // Prevent multiple warnings per package
+    const warnedPackages = new Map<string, string[]>();
+
+    pluginBuild.onStart(() => {
+      seen.clear();
+      warnedPackages.clear();
+    });
+    pluginBuild.onResolve(
+      { filter: NODEJS_MODULES_RE },
+      async ({ path, kind, resolveDir, importer }) => {
+        const specifier = `${path}:${kind}:${resolveDir}:${importer}`;
+        if (seen.has(specifier)) {
+          return;
+        }
+
+        seen.add(specifier);
+        // Try to resolve this import as a normal package
+        const result = await pluginBuild.resolve(path, {
+          kind,
+          resolveDir,
+          importer,
+        });
+
+        if (result.errors.length > 0) {
+          // esbuild couldn't resolve the package
+          // We should warn the user, but not fail the build
+          const pathWarnedPackages = warnedPackages.get(path) ?? [];
+          pathWarnedPackages.push(importer);
+          warnedPackages.set(path, pathWarnedPackages);
+
+          return { external: true };
+        }
+        // This is a normal package—don't treat it specially
+        return result;
+      },
+    );
+
+    /**
+     * If we are bundling a "Service Worker" formatted Worker, imports of external modules,
+     * which won't be inlined/bundled by esbuild, are invalid.
+     *
+     * This `onEnd()` handler will error if it identifies node.js external imports.
+     */
+    pluginBuild.onEnd(() => {
+      if (
+        pluginBuild.initialOptions.format === "iife" &&
+        warnedPackages.size > 0
+      ) {
+        const paths = new Intl.ListFormat("en-US").format(
+          Array.from(warnedPackages.keys())
+            .map((p) => `"${p}"`)
+            .sort(),
+        );
+        return {
+          errors: [
+            {
+              text: dedent`
+                Unexpected external import of ${paths}.
+                Your worker has no default export, which means it is assumed to be a Service Worker format Worker.
+                Did you mean to create a ES Module format Worker?
+                If so, try adding \`export default { ... }\` in your entry-point.
+                See https://developers.cloudflare.com/workers/reference/migrate-to-module-workers/.
+              `,
+            },
+          ],
+        };
+      }
+    });
+
+    // Wait until the build finishes to log warnings, so that all files which import a package
+    // can be collated
+    pluginBuild.onEnd(() => {
+      if (mode !== "v1") {
+        warnedPackages.forEach((importers: string[], path: string) => {
+          logger.warn(
+            dedent`
+            The package "${path}" wasn't found on the file system but is built into node.
+            Your Worker may throw errors at runtime unless you enable the "nodejs_compat" compatibility flag. Refer to https://developers.cloudflare.com/workers/runtime-apis/nodejs/ for more details. Imported from:
+            ${toList(importers, pluginBuild.initialOptions.absWorkingDir)}`,
+          );
+        });
+      }
+    });
+  },
+});
+
+function toList(items: string[], absWorkingDir: string | undefined): string {
+  return items
+    .map((i) => ` - ${chalk.blue(relative(absWorkingDir ?? "/", i))}`)
+    .join("\n");
+}

package/src/cloudflare/bundle/plugin-wasm.ts

@@ -12,21 +12,41 @@ export function createWasmPlugin() {
       build.onStart(() => {
         modules.clear();
       });
-      build.onResolve({ filter: /\.wasm$/ }, async (args) => {
-        if (!modules.has(args.path)) {
-          const name = path.normalize(args.path);
-          assert(build.initialOptions.outdir, "outdir is required");
-          await fs.mkdir(build.initialOptions.outdir, { recursive: true });
-          await fs.copyFile(
-            path.join(args.resolveDir, name),
-            path.join(build.initialOptions.outdir, name),
-          );
-          modules.set(args.path, {
-            type: "wasm",
-            path: name,
-          });
+
+      // Handle imports like `import "./foo.wasm"` and `import "./foo.wasm?module"`
+      // TODO(john): Figure out why this suddenly became necessary
+      build.onResolve({ filter: /\.wasm(\?.*)?$/ }, async (args) => {
+        const resolved = modules.get(args.path);
+        if (resolved) {
+          return { path: resolved.path, external: true };
         }
-        return { external: true };
+
+        // Normalize path and remove the `?module` query param so we have the actual file name to copy
+        const name = path.normalize(args.path).replace(/\?.*$/, "");
+
+        // Resolve path to outdir (required for monorepos if the workdir is not the same as process.cwd())
+        assert(
+          build.initialOptions.absWorkingDir && build.initialOptions.outdir,
+          "Missing absWorkingDir or outdir from esbuild options",
+        );
+        const outdir = path.resolve(
+          build.initialOptions.absWorkingDir,
+          build.initialOptions.outdir,
+        );
+
+        // Copy to outdir so it's included in the upload
+        await fs.mkdir(outdir, { recursive: true });
+        await fs.copyFile(
+          path.join(args.resolveDir, name),
+          path.join(outdir, name),
+        );
+        modules.set(args.path, {
+          type: "wasm",
+          path: name,
+        });
+
+        // Resolve to the normalized file name (the `?module` query param is not needed in workerd)
+        return { path: name, external: true };
       });
     },
   };

package/src/cloudflare/compatibility-date.gen.ts

@@ -4,4 +4,4 @@
 /**
  * The default Cloudflare Workers compatibility date, set based on the latest workerd release at the time of build.
  */
-export const DEFAULT_COMPATIBILITY_DATE = "2025-08-26";
+export const DEFAULT_COMPATIBILITY_DATE = "2025-09-06";

package/src/cloudflare/d1-local-migrations.ts

@@ -20,8 +20,8 @@ export const applyLocalD1Migrations = async (
   });
   try {
     await miniflare.ready;
-    const db = await miniflare.getD1Database("DB");
-    const session = db.withSession("first-primary");
+    const db: D1Database = await miniflare.getD1Database("DB");
+    const session: D1DatabaseSession = db.withSession("first-primary");
     await session
       .prepare(
         `CREATE TABLE IF NOT EXISTS ${options.migrationsTable} (

package/src/cloudflare/durable-object-namespace.ts

@@ -19,6 +19,7 @@ export type DurableObjectNamespace<T = any> = {
   environment?: string;
   sqlite?: boolean;
   namespaceId?: string;
+  /** @internal */
   __service__: T;
 };