alchemy 2.0.0-beta.43 → 2.0.0-beta.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.43",
+  "version": "2.0.0-beta.45",
   "homepage": "https://alchemy.run",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
@@ -288,19 +288,19 @@
     "access": "public"
   },
   "dependencies": {
-    "@alchemy.run/node-utils": "0.0.2",
+    "@alchemy.run/node-utils": "0.0.4",
     "@aws-sdk/credential-providers": "^3.0.0",
     "@clack/prompts": "^0.11.0",
-    "@distilled.cloud/aws": "^0.21.3",
-    "@distilled.cloud/axiom": "^0.21.3",
-    "@distilled.cloud/cloudflare": "^0.21.3",
-    "@distilled.cloud/cloudflare-rolldown-plugin": "0.5.4",
-    "@distilled.cloud/cloudflare-runtime": "0.5.4",
-    "@distilled.cloud/cloudflare-vite-plugin": "0.5.4",
-    "@distilled.cloud/core": "^0.21.3",
-    "@distilled.cloud/planetscale": "^0.21.3",
-    "@distilled.cloud/neon": "^0.21.3",
-    "@effect/vitest": ">=4.0.0-beta.66 || >=4.0.0",
+    "@distilled.cloud/aws": "^0.22.1",
+    "@distilled.cloud/axiom": "^0.22.1",
+    "@distilled.cloud/cloudflare": "^0.22.1",
+    "@distilled.cloud/cloudflare-rolldown-plugin": "0.10.1",
+    "@distilled.cloud/cloudflare-runtime": "0.10.1",
+    "@distilled.cloud/cloudflare-vite-plugin": "0.10.1",
+    "@distilled.cloud/core": "^0.22.1",
+    "@distilled.cloud/neon": "^0.22.1",
+    "@distilled.cloud/planetscale": "^0.22.1",
+    "@effect/vitest": ">=4.0.0-beta.74 || >=4.0.0",
     "@libsql/client": "^0.17.0",
     "@octokit/rest": "^22.0.1",
     "@smithy/node-config-provider": "^4.0.0",
@@ -311,7 +311,6 @@
     "capnweb": "^0.6.1",
     "fast-glob": "^3.3.2",
     "fast-xml-parser": "^5.3.4",
-    "foreground-child": "^4.0.3",
     "ink": "^6.3.1",
     "jszip": "^3.10.1",
     "libsodium-wrappers": "^0.8.3",
@@ -321,17 +320,17 @@
     "pg": "^8.13.0",
     "picomatch": "^4.0.4",
     "react": "^19.2.0",
-    "rolldown": "1.0.0-rc.17",
-    "sonda": "^0.11.1",
+    "rolldown": "1.0.1",
     "undici": "^7.16.0",
     "yaml": "^2.0.0"
   },
   "devDependencies": {
     "@clack/prompts": "^0.11.0",
     "@cloudflare/workers-types": "^4.20250805.0",
-    "@effect/platform-bun": ">=4.0.0-beta.66 || >=4.0.0",
-    "@effect/platform-node": ">=4.0.0-beta.66 || >=4.0.0",
-    "@effect/platform-node-shared": ">=4.0.0-beta.66 || >=4.0.0",
+    "@cloudflare/puppeteer": "^1.1.0",
+    "@effect/platform-bun": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/platform-node": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/platform-node-shared": ">=4.0.0-beta.74 || >=4.0.0",
     "@oxc-project/types": "^0.127.0",
     "@types/pg": "^8.11.0",
     "@types/aws-lambda": "^8.10.152",
@@ -341,7 +340,7 @@
     "@types/react": "^19.2.2",
     "@types/ws": "^8.18.1",
     "better-auth": "^1.6.2",
-    "effect": ">=4.0.0-beta.66 || >=4.0.0",
+    "effect": ">=4.0.0-beta.74 || >=4.0.0",
     "react-devtools-core": "^7.0.1",
     "solid-js": "latest",
     "tsconfig-paths": "^4.2.0",
@@ -351,12 +350,12 @@
     "ws": "^8.20.0"
   },
   "peerDependencies": {
-    "@effect/platform-bun": ">=4.0.0-beta.66 || >=4.0.0",
-    "@effect/platform-node": ">=4.0.0-beta.66 || >=4.0.0",
-    "@effect/sql-pg": ">=4.0.0-beta.66 || >=4.0.0",
+    "@effect/platform-bun": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/platform-node": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/sql-pg": ">=4.0.0-beta.74 || >=4.0.0",
     "drizzle-kit": ">=1.0.0-rc.1",
     "drizzle-orm": ">=1.0.0-rc.1",
-    "effect": ">=4.0.0-beta.66 || >=4.0.0",
+    "effect": ">=4.0.0-beta.74 || >=4.0.0",
     "vite": "^8.0.7",
     "ws": "^8.20.0"
   },

package/src/AWS/Lambda/Function.ts

@@ -5,8 +5,8 @@ import type { CreateFunctionRequest } from "@distilled.cloud/aws/lambda";
 import * as Lambda from "@distilled.cloud/aws/lambda";
 import { Region } from "@distilled.cloud/aws/Region";
 import type * as lambda from "aws-lambda";
-import * as Config from "effect/Config";
 import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
@@ -94,8 +94,45 @@ export interface FunctionProps extends PlatformProps {
     subnetIds: string[];
     securityGroupIds: string[];
   };
+  /**
+   * Maximum execution time before the function is forcibly terminated.
+   * Rounded up to whole seconds.
+   *
+   * @default 3 seconds (AWS Lambda default)
+   */
+  timeout?: Duration.Duration;
 }
 
+/**
+ * Normalize a {@link FunctionProps.timeout} to whole seconds.
+ *
+ * State JSON round-trips flatten a `Duration` to its `toJSON` shape
+ * (`{_id:"Duration",_tag:"Millis"|"Nanos"|"Infinity",...}`), which is not a
+ * valid `Duration.Input`. Reconstruct an input that `Duration.toSeconds`
+ * accepts before delegating.
+ */
+export const toTimeoutSeconds = (
+  timeout: Duration.Duration | undefined,
+): number | undefined => {
+  if (timeout === undefined) return undefined;
+  const json = timeout as {
+    _id?: unknown;
+    _tag?: "Millis" | "Nanos" | "Infinity" | "NegativeInfinity";
+    millis?: number;
+    nanos?: string;
+  };
+  const input: Duration.Input =
+    json._id === "Duration"
+      ? json._tag === "Millis"
+        ? json.millis!
+        : json._tag === "Nanos"
+          ? BigInt(json.nanos!)
+          : "Infinity"
+      : timeout;
+  const seconds = Duration.toSeconds(input);
+  return Number.isFinite(seconds) ? Math.max(1, Math.ceil(seconds)) : undefined;
+};
+
 export interface Function extends Resource<
   FunctionTypeId,
   FunctionProps,
@@ -368,7 +405,9 @@ export const Function: Platform<
       env,
       set: (id: string, output: Output.Output) =>
         Effect.sync(() => {
-          const key = id.replaceAll(/[^a-zA-Z0-9]/g, "_");
+          // Key is already canonical (see RuntimeContext.sanitizeKey); store it
+          // verbatim.
+          const key = id;
           // Preserve `Redacted`-ness across the Output → Lambda env var
           // round-trip. `JSON.stringify(Redacted)` would emit the literal
           // string `"<redacted>"` and lose the value, so secrets are
@@ -387,34 +426,35 @@ export const Function: Platform<
           return key;
         }),
       get: <T>(key: string) =>
-        Config.string(key).pipe(
-          Effect.flatMap((val) =>
-            Effect.try({
-              try: () => {
-                const value = JSON.parse(val);
-                if (
-                  value !== null &&
-                  typeof value === "object" &&
-                  (value as { _tag?: unknown })._tag === "Redacted" &&
-                  "value" in (value as object)
-                ) {
-                  return Redacted.make(
-                    (value as { value: unknown }).value,
-                  ) as unknown as T;
-                }
-                return value as T;
-              },
-              catch: () => val, // assume it's just a string
-            }),
-          ),
-          Effect.catch((cause) =>
-            Effect.die(
-              new Error(`Failed to get environment variable: ${key}`, {
-                cause,
-              }),
-            ),
-          ),
-        ),
+        // Read the captured value straight from `process.env`. We must NOT
+        // resolve through `Config.string` here: at runtime the ambient
+        // `ConfigProvider` is the interceptor installed in `Platform.ts`,
+        // whose runtime branch calls back into `ctx.get(key)`. Going through
+        // `Config` would re-enter that interceptor for the same key and
+        // recurse forever, allocating until the Lambda init OOMs. The Worker
+        // runtime reads from `WorkerEnvironment` for the same reason.
+        Effect.sync(() => {
+          // Key is already canonical (see RuntimeContext.sanitizeKey).
+          const val = process.env[key];
+          if (val === undefined) {
+            return undefined;
+          }
+          try {
+            const value = JSON.parse(val);
+            if (
+              typeof value === "object" &&
+              value?._tag === "Redacted" &&
+              "value" in value
+            ) {
+              return Redacted.make(
+                (value as { value: unknown }).value,
+              ) as unknown as T;
+            }
+            return value as T;
+          } catch {
+            return val as unknown as T; // assume it's just a string
+          }
+        }),
       serve: (handler: HttpEffect) =>
         ctx.listen(makeFunctionHttpHandler(handler)),
       listen: ((
@@ -872,6 +912,7 @@ export default await Effect.runPromise(handlerEffect)
               }
             : undefined,
           Tags: tags,
+          Timeout: toTimeoutSeconds(news.timeout),
           VpcConfig: news.vpc
             ? {
                 SubnetIds: news.vpc.subnetIds,
@@ -1121,6 +1162,11 @@ export default await Effect.runPromise(handlerEffect)
             // code changed
             return { action: "update" };
           }
+          if (
+            toTimeoutSeconds(olds.timeout) !== toTimeoutSeconds(news.timeout)
+          ) {
+            return { action: "update" };
+          }
         }),
         read: Effect.fnUntraced(function* ({ id, olds, output }) {
           const functionName =
@@ -1161,7 +1207,7 @@ export default await Effect.runPromise(handlerEffect)
           // Reuse the persisted output where we have it (e.g. code hash) so
           // diff doesn't see drift it can't reconstruct from the API.
           const attrs = {
-            ...(output ?? {}),
+            ...output,
             functionArn: fn.FunctionArn,
             functionName: fn.FunctionName,
             functionUrl,
@@ -1185,8 +1231,15 @@ export default await Effect.runPromise(handlerEffect)
             vpc: news.vpc,
           });
 
-          // mock code
-          const code = new TextEncoder().encode("export default () => {}");
+          // Mock code for the pre-created stub. It responds 503 (rather than a
+          // bare 200) so that, during the brief window where the real
+          // code/config update is still `InProgress`, a Function URL hit serves
+          // an honest "not ready" signal instead of a successful-but-empty 200.
+          // Downstream readiness probes already retry on non-200, so they wait
+          // for the real handler to go live without the provider blocking.
+          const code = new TextEncoder().encode(
+            `export default () => ({ statusCode: 503, headers: { "content-type": "application/json" }, body: JSON.stringify({ error: "function initializing" }) })`,
+          );
           const archive = yield* zipCode(code);
           const hash = yield* hashBundle(code);
           yield* createOrUpdateFunction({
@@ -1261,7 +1314,7 @@ export default await Effect.runPromise(handlerEffect)
           yield* session.note(summary({ code }));
 
           return {
-            ...(output ?? {}),
+            ...output,
             functionArn,
             functionName,
             functionUrl: functionUrl as any,

package/src/AWS/Providers.ts

@@ -19,6 +19,7 @@ import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import { CredentialsStoreLive } from "../Auth/Credentials.ts";
 import { Command, CommandProvider } from "../Build/Command.ts";
 import * as Provider from "../Provider.ts";
+import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
 import { Random, RandomProvider } from "../Random.ts";
 import * as ACM from "./ACM/index.ts";
 import * as ApiGateway from "./ApiGateway/index.ts";
@@ -63,6 +64,7 @@ export const providers = () =>
     Providers,
     Provider.collection([
       Command,
+      KeyPair,
       Random,
       ACM.Certificate,
       ApiGateway.Account,
@@ -571,6 +573,7 @@ export const providers = () =>
     Layer.provideMerge(
       Layer.mergeAll(
         CommandProvider(),
+        KeyPairProvider(),
         RandomProvider(),
         Assets.AssetsProvider(),
       ),

package/src/Apply.ts

@@ -280,7 +280,24 @@ const executePlan = Effect.fnUntraced(function* (
     Effect.all(
       fqns
         .filter((fqn) => fqn in ready)
-        .map((fqn) => Deferred.await(ready[fqn])),
+        .map((fqn) =>
+          // Non-cycle upstreams must be observed at their TERMINAL output
+          // (`readyStable`), not their early precreate signal (`ready`). This
+          // is what makes a failed upstream actually interrupt its downstream:
+          // a resource with `precreate` resolves `ready` before its real
+          // `reconcile` runs, so a downstream waiting on `ready` would proceed
+          // (and even finish) even though the upstream's reconcile later
+          // failed. Waiting on `readyStable` means the downstream's
+          // `waitForDeps` short-circuits with the upstream's failure cause.
+          //
+          // Cycle members are the exception: peers in an SCC depend on each
+          // other, so they must rendezvous on the early `ready`/precreate
+          // signal to break the deadlock. Phase 3 (`converge`) re-runs them
+          // against final outputs once the cycle settles.
+          plan.cycleMembers.has(fqn)
+            ? Deferred.await(ready[fqn])
+            : Deferred.await(readyStable[fqn]),
+        ),
       { concurrency: "unbounded" },
     );
 

package/src/Auth/AuthProvider.ts

@@ -2,6 +2,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
 import { withLock } from "./Lock.ts";
 
 /**
@@ -14,6 +15,20 @@ import { withLock } from "./Lock.ts";
  */
 const LOCKED_METHODS = new Set(["read", "login", "logout", "configure"]);
 
+/**
+ * Methods that may drive an interactive flow (prompts, browser-based
+ * OAuth, etc.). A process-wide mutex serializes these across providers
+ * so that, e.g., Cloudflare's `configure` finishes its prompt sequence
+ * before Planetscale's begins — even when the two auth provider Layers
+ * are built in parallel as part of a single `providers()` Layer.
+ *
+ * The clack prompt wrapper in `Util/Clank.ts` enforces per-prompt
+ * serialization; this mutex enforces per-flow serialization so the user
+ * sees one provider's prompts grouped together rather than interleaved.
+ */
+const INTERACTIVE_METHODS = new Set(["login", "configure"]);
+const interactiveMutex = Semaphore.makeUnsafe(1);
+
 export class AuthError extends Schema.TaggedErrorClass<AuthError>()(
   "AuthError",
   {
@@ -143,13 +158,18 @@ export const AuthProvider =
               Object.entries(service).map(([methodName, fn]) => [
                 methodName,
                 (...args: Parameters<typeof fn>) => {
-                  const eff = (fn as any)(...args).pipe(
+                  let eff = (fn as any)(...args).pipe(
                     Effect.provideContext(ctx),
                   );
-                  if (!LOCKED_METHODS.has(methodName)) return eff;
-                  // First positional arg is always `profileName`.
-                  const profileName = args[0] as string;
-                  return withLock(`${profileName}-${name}`, eff);
+                  if (LOCKED_METHODS.has(methodName)) {
+                    // First positional arg is always `profileName`.
+                    const profileName = args[0] as string;
+                    eff = withLock(`${profileName}-${name}`, eff);
+                  }
+                  if (INTERACTIVE_METHODS.has(methodName)) {
+                    eff = Semaphore.withPermits(interactiveMutex, 1)(eff);
+                  }
+                  return eff;
                 },
               ]),
             ),

package/src/Auth/Credentials.ts

@@ -70,13 +70,14 @@ export const CredentialsStoreLive = Layer.effect(
       credentials: T,
     ): Effect.Effect<void, PlatformError> => {
       const filePath = credentialsFilePath(profile, provider);
-      return fs
-        .makeDirectory(path.dirname(filePath), { recursive: true })
-        .pipe(
-          Effect.flatMap(() =>
-            fs.writeFileString(filePath, JSON.stringify(credentials, null, 2)),
-          ),
-        );
+      return fs.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(
+        Effect.flatMap(() => {
+          return fs.writeFileString(
+            filePath,
+            JSON.stringify(credentials, null, 2),
+          );
+        }),
+      );
     };
 
     const remove_ = (profile: string, provider: string): Effect.Effect<void> =>

package/src/Auth/Lock.ts

@@ -1,4 +1,4 @@
-import * as lockfile from "@alchemy.run/node-utils";
+import { lock } from "@alchemy.run/node-utils/lockfile";
 import * as Effect from "effect/Effect";
 import * as fs from "node:fs/promises";
 import * as path from "pathe";
@@ -24,7 +24,7 @@ export const withLock = <A, E, R>(
   return Effect.acquireUseRelease(
     Effect.promise(async () => {
       await fs.mkdir(lockDir, { recursive: true });
-      return await lockfile.lock(lockPath, {
+      return await lock(lockPath, {
         retries: { retries: 600, minTimeout: 50, maxTimeout: 50 },
         stale: 5_000,
         realpath: false,

package/src/Bundle/Bundle.ts

@@ -6,7 +6,12 @@ import * as Stream from "effect/Stream";
 import assert from "node:assert";
 import * as rolldown from "rolldown";
 import { sha256, sha256Object } from "../Util/sha256.ts";
+import {
+  bundleAnalyzerPlugin,
+  type BundleAnalyzerPluginOptions,
+} from "./BundleAnalyzerPlugin.ts";
 import { purePlugin, type PurePluginOptions } from "./PurePlugin.ts";
+import { rawPlugin } from "./RawPlugin.ts";
 
 /**
  * Extra options accepted by {@link build} / {@link watch} on top of the
@@ -24,6 +29,16 @@ export interface BundleExtraOptions {
    * - `false`: plugin is disabled.
    */
   readonly pure?: PurePluginOptions | false;
+  /**
+   * Configures the {@link bundleAnalyzerPlugin} which emits a bundle analysis
+   * report alongside the bundle output, describing chunks, modules, and the
+   * import graph reachable from each entry point.
+   *
+   * - `undefined` / `false` (default): plugin is disabled.
+   * - `true`: plugin is enabled with default options.
+   * - `BundleAnalyzerPluginOptions`: plugin is enabled with the provided options.
+   */
+  readonly bundleAnalyzer?: BundleAnalyzerPluginOptions | boolean;
 }
 
 export interface BundleOutput {
@@ -86,7 +101,7 @@ export const build = (
     try: async () => {
       const bundle = await rolldown.rolldown({
         ...inputOptions,
-        plugins: withPurePlugin(inputOptions.plugins, extra?.pure),
+        plugins: [inputOptions.plugins, builtInPlugins(extra)],
         optimization: inputOptions.optimization ?? {
           inlineConst: {
             mode: "smart",
@@ -94,7 +109,7 @@ export const build = (
           },
         },
       });
-      const result = await bundle.generate(outputOptions);
+      const result = await bundle.write(outputOptions);
       await bundle.close();
       return result.output;
     },
@@ -128,7 +143,8 @@ export const watch = (
         const watcher = rolldown.watch({
           ...inputOptions,
           plugins: [
-            withPurePlugin(inputOptions.plugins, extra?.pure),
+            inputOptions.plugins,
+            builtInPlugins(extra),
             // The watcher event listener does not receive the bundle output, so we grab it using a plugin.
             {
               name: "alchemy:watch-bundle",
@@ -266,19 +282,25 @@ export function bundleOutputFromRolldownOutputBundle(
 }
 
 /**
- * Composes the user-provided plugin chain with the default
- * {@link purePlugin} according to the `pure` option.
+ * Returns the built-in plugins appended after the user-provided plugin chain,
+ * configured by {@link BundleExtraOptions}.
  *
- * The pure plugin is appended LAST so it sees module ids that have already
- * been resolved into `node_modules/<pkg>/...` by upstream resolver plugins
- * such as `@distilled.cloud/cloudflare-rolldown-plugin`.
+ * These run LAST so they see module ids that have already been resolved into
+ * `node_modules/<pkg>/...` by upstream resolver plugins such as
+ * `@distilled.cloud/cloudflare-rolldown-plugin`.
  */
-function withPurePlugin(
-  plugins: rolldown.RolldownPluginOption,
-  pure: PurePluginOptions | false | undefined,
+function builtInPlugins(
+  extra?: BundleExtraOptions,
 ): rolldown.RolldownPluginOption {
-  if (pure === false) return plugins;
-  return [plugins, purePlugin(pure ?? {})];
+  return [
+    extra?.bundleAnalyzer
+      ? bundleAnalyzerPlugin(
+          extra.bundleAnalyzer === true ? {} : extra.bundleAnalyzer,
+        )
+      : undefined,
+    extra?.pure !== false ? purePlugin(extra?.pure ?? {}) : undefined,
+    rawPlugin(),
+  ];
 }
 
 function bundleErrorFromUnknown(error: unknown): BundleError {

package/src/Bundle/BundleAnalyzerPlugin.ts

@@ -0,0 +1,33 @@
+import type { Plugin } from "rolldown";
+import { bundleAnalyzerPlugin as rolldownBundleAnalyzerPlugin } from "rolldown/experimental";
+
+export interface BundleAnalyzerPluginOptions {
+  /**
+   * The filename of the bundle analysis data.
+   * @default "analyze-data.md"
+   */
+  readonly fileName?: string;
+  /**
+   * The format of the bundle analysis data.
+   * @default "md"
+   */
+  readonly format?: "json" | "md";
+}
+
+/**
+ * Wraps rolldown's experimental bundle analyzer plugin, which emits a report
+ * describing the composition of the bundle.
+ *
+ * The report includes:
+ * - all chunks and their relationships
+ * - the modules bundled into each chunk
+ * - import dependencies between chunks
+ * - the modules reachable from each entry point
+ */
+export const bundleAnalyzerPlugin = (
+  options: BundleAnalyzerPluginOptions = {},
+): Plugin =>
+  rolldownBundleAnalyzerPlugin({
+    fileName: options.fileName,
+    format: options.format ?? "md",
+  });

package/src/Bundle/RawPlugin.ts

@@ -0,0 +1,82 @@
+import type * as rolldown from "rolldown";
+
+/**
+ * Matches `?raw` or `&raw` query suffixes, mirroring Vite's `rawRE`
+ * (see `vite/src/node/utils.ts`). Used to gate both `resolveId` and
+ * `load` so the plugin only inspects ids that opt in.
+ */
+export const RAW_RE: RegExp = /(\?|&)raw(?:&|$)/;
+
+/**
+ * Rolldown plugin that adds Vite-style `?raw` import support to the
+ * Alchemy bundler.
+ *
+ * Importing a file with the `?raw` suffix inlines its contents as the
+ * default export of a JS module:
+ *
+ * ```ts
+ * import sql from "./schema.sql?raw";
+ * //         ^ string — the file contents read as UTF-8
+ * ```
+ *
+ * This plugin only implements `?raw`. Vite's `?url` and `?inline`
+ * variants both rely on a browser asset pipeline (URL serving / `data:`
+ * fallback) that has no analogue in the server-side bundles produced
+ * here (Cloudflare Workers, AWS Lambda), so they are intentionally
+ * omitted.
+ */
+export const rawPlugin = (): rolldown.Plugin => ({
+  name: "alchemy:raw",
+  resolveId: {
+    filter: { id: RAW_RE },
+    async handler(source, importer) {
+      const [base, query] = splitFileAndPostfix(source);
+      const resolved = await this.resolve(base, importer, { skipSelf: true });
+      if (!resolved || resolved.external) return null;
+      return { id: resolved.id + query, moduleSideEffects: false };
+    },
+  },
+  load: {
+    filter: { id: RAW_RE },
+    async handler(id) {
+      const file = id.replace(/[?#].*$/, "");
+      const contents = await this.fs.readFile(file, { encoding: "utf8" });
+      return {
+        code: `export default ${JSON.stringify(contents)};`,
+        // Empty mappings = "this module has no meaningful source map".
+        // The generated code is a synthetic `export default "..."` that
+        // doesn't correspond line-for-line to any source file (the
+        // underlying file isn't JS), so there's nothing to map. Supplying
+        // `{ mappings: "" }` (rather than omitting `map`) opts the module
+        // out of source-map generation without making rolldown synthesize
+        // a default one from the loaded code.
+        map: { mappings: "" },
+        // NOTE: matches Vite — avoids a double `export default` if the
+        // file extension would otherwise be picked up by another loader
+        // (e.g. `?raw&.json`).
+        moduleType: "js",
+      };
+    },
+  },
+});
+
+/**
+ * Splits an id into its file portion and the query/hash postfix (kept
+ * with the leading `?` / `#`). Matches Vite's `splitFileAndPostfix`.
+ *
+ * @example
+ *   splitFileAndPostfix("./foo.txt?raw") // => ["./foo.txt", "?raw"]
+ *   splitFileAndPostfix("./foo.txt")     // => ["./foo.txt", ""]
+ */
+export function splitFileAndPostfix(id: string): [string, string] {
+  const queryIdx = id.indexOf("?");
+  const hashIdx = id.indexOf("#");
+  const idx =
+    queryIdx === -1
+      ? hashIdx
+      : hashIdx === -1
+        ? queryIdx
+        : Math.min(queryIdx, hashIdx);
+  if (idx === -1) return [id, ""];
+  return [id.slice(0, idx), id.slice(idx)];
+}

package/src/Bundle/index.ts

@@ -1,4 +1,6 @@
 export * from "./Bundle.ts";
+export * from "./BundleAnalyzerPlugin.ts";
 export * from "./Docker.ts";
 export * from "./PurePlugin.ts";
+export * from "./RawPlugin.ts";
 export * from "./TempRoot.ts";