alchemy 2.0.0-beta.60 → 2.0.0-beta.61

package/src/AWS/Lambda/EventInvokeConfig.ts

@@ -0,0 +1,150 @@
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { deepEqual } from "../../Diff.ts";
+
+const DEFAULT_MAXIMUM_RETRY_ATTEMPTS = 2;
+const DEFAULT_MAXIMUM_EVENT_AGE_IN_SECONDS = 21_600;
+
+/**
+ * Asynchronous invocation settings for a Lambda function or alias.
+ *
+ * Configured via {@link FunctionProps.eventInvokeConfig} for the unqualified
+ * function, or {@link AliasProps.eventInvokeConfig} for a specific alias.
+ */
+export interface EventInvokeConfig {
+  /**
+   * Maximum number of times Lambda retries an asynchronous invocation.
+   * @default 2
+   */
+  maximumRetryAttempts?: number;
+  /**
+   * Maximum age in seconds that Lambda retains an asynchronous event.
+   * @default 21600
+   */
+  maximumEventAgeInSeconds?: number;
+  /**
+   * Destinations for successful or failed asynchronous invocation records.
+   */
+  destinationConfig?: Lambda.DestinationConfig;
+}
+
+const retryOnConflict = <A, E extends { _tag: string }, R>(
+  effect: Effect.Effect<A, E, R>,
+) =>
+  effect.pipe(
+    Effect.retry({
+      while: (e) => e._tag === "ResourceConflictException",
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
+
+const normalizeDestinationConfig = (
+  config: Lambda.DestinationConfig | undefined,
+): Lambda.DestinationConfig | undefined => {
+  const onSuccess = config?.OnSuccess?.Destination
+    ? { Destination: config.OnSuccess.Destination }
+    : undefined;
+  const onFailure = config?.OnFailure?.Destination
+    ? { Destination: config.OnFailure.Destination }
+    : undefined;
+  return onSuccess || onFailure
+    ? {
+        OnSuccess: onSuccess,
+        OnFailure: onFailure,
+      }
+    : undefined;
+};
+
+const observeConfig = (functionName: string, qualifier: string | undefined) =>
+  Lambda.getFunctionEventInvokeConfig({
+    FunctionName: functionName,
+    Qualifier: qualifier,
+  }).pipe(
+    Effect.catchTag("ResourceNotFoundException", () =>
+      Effect.succeed(undefined),
+    ),
+  );
+
+/**
+ * Converge the async invocation config of a function or alias to the desired
+ * state: put it when set, delete it when omitted. Diffs against the observed
+ * cloud config so a no-op deploy skips the write entirely.
+ */
+export const syncEventInvokeConfig = Effect.fn(function* ({
+  functionName,
+  qualifier,
+  config,
+}: {
+  functionName: string;
+  /** Alias name (or version) to scope the config to. Omit for `$LATEST`. */
+  qualifier?: string;
+  config: EventInvokeConfig | undefined;
+}) {
+  const observed = yield* observeConfig(functionName, qualifier);
+
+  if (config === undefined) {
+    if (observed) {
+      yield* retryOnConflict(
+        Lambda.deleteFunctionEventInvokeConfig({
+          FunctionName: functionName,
+          Qualifier: qualifier,
+        }),
+      ).pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void));
+    }
+    return;
+  }
+
+  const desired = {
+    maximumRetryAttempts:
+      config.maximumRetryAttempts ?? DEFAULT_MAXIMUM_RETRY_ATTEMPTS,
+    maximumEventAgeInSeconds:
+      config.maximumEventAgeInSeconds ?? DEFAULT_MAXIMUM_EVENT_AGE_IN_SECONDS,
+    destinationConfig: normalizeDestinationConfig(config.destinationConfig),
+  };
+
+  if (
+    observed &&
+    (observed.MaximumRetryAttempts ?? DEFAULT_MAXIMUM_RETRY_ATTEMPTS) ===
+      desired.maximumRetryAttempts &&
+    (observed.MaximumEventAgeInSeconds ??
+      DEFAULT_MAXIMUM_EVENT_AGE_IN_SECONDS) ===
+      desired.maximumEventAgeInSeconds &&
+    deepEqual(
+      normalizeDestinationConfig(observed.DestinationConfig),
+      desired.destinationConfig,
+    )
+  ) {
+    return;
+  }
+
+  yield* Lambda.putFunctionEventInvokeConfig({
+    FunctionName: functionName,
+    Qualifier: qualifier,
+    MaximumRetryAttempts: desired.maximumRetryAttempts,
+    MaximumEventAgeInSeconds: desired.maximumEventAgeInSeconds,
+    DestinationConfig: desired.destinationConfig,
+  }).pipe(
+    Effect.retry({
+      while: (
+        e,
+      ): e is
+        | Lambda.ResourceConflictException
+        | Lambda.InvalidParameterValueException =>
+        e._tag === "ResourceConflictException" ||
+        // Destination validation races IAM policy propagation on the
+        // execution role — Lambda rejects the put until the role can reach
+        // the destination.
+        (e._tag === "InvalidParameterValueException" &&
+          (e.message?.includes(
+            "The function execution role does not have permissions to call",
+          ) ??
+            false)),
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
+});

package/src/AWS/Lambda/Function.ts

@@ -51,6 +51,10 @@ import { AWSEnvironment } from "../Environment.ts";
 import * as IAM from "../IAM/index.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
 import type { Providers } from "../Providers.ts";
+import {
+  syncEventInvokeConfig,
+  type EventInvokeConfig,
+} from "./EventInvokeConfig.ts";
 import { makeFunctionHttpHandler } from "./HttpServer.ts";
 
 export const FunctionTypeId = "AWS.Lambda.Function" as const;
@@ -159,6 +163,14 @@ export interface FunctionProps extends PlatformProps {
    * Omit to remove the function-level reserved concurrency limit.
    */
   reservedConcurrentExecutions?: number;
+  /**
+   * Asynchronous invocation settings (retries, event age, destinations) for
+   * the unqualified function. Omit to remove any existing config and fall
+   * back to Lambda's defaults (2 retries, 6-hour max event age, no
+   * destinations). Use {@link AliasProps.eventInvokeConfig} to scope the
+   * config to an alias instead.
+   */
+  eventInvokeConfig?: EventInvokeConfig;
 }
 
 /**
@@ -275,9 +287,9 @@ const matchesConfiguredExternal = (
  * - **Async** — plain handler export, no Effect runtime in the bundle.
  * - **Effect** — Effect implementation with typed bindings and event sources.
  *
- * See the {@link https://alchemy.run/guides/async-lambda | Async Lambda Guide}
+ * See [Effect handlers vs async handlers](/infrastructure-as-effects/functions-and-servers#effect-handlers-vs-async-handlers)
  * for plain handler patterns, or the
- * {@link https://alchemy.run/guides/lambda | Effect Lambda Guide}
+ * [Lambda guide](/aws/compute/lambda)
  * for the full Effect-based approach with bindings, event sources, and sinks.
  * @resource
  * @section Async Functions
@@ -384,6 +396,22 @@ const matchesConfiguredExternal = (
  * });
  * ```
  *
+ * @example Async invocation retries and failure destination
+ * ```typescript
+ * const func = yield* AWS.Lambda.Function("AsyncFunction", {
+ *   main: "./src/handler.ts",
+ *   eventInvokeConfig: {
+ *     maximumRetryAttempts: 0,
+ *     maximumEventAgeInSeconds: 60,
+ *     destinationConfig: {
+ *       OnFailure: {
+ *         Destination: queue.queueArn,
+ *       },
+ *     },
+ *   },
+ * });
+ * ```
+ *
  * @section S3 Bindings
  * Bind S3 operations in the init phase to give the function IAM
  * permissions and inject the bucket name as an environment variable.
@@ -1667,6 +1695,11 @@ export default await Effect.runPromise(handlerEffect)
               reservedConcurrentExecutions: news.reservedConcurrentExecutions,
             });
 
+          yield* syncEventInvokeConfig({
+            functionName,
+            config: news.eventInvokeConfig,
+          });
+
           const functionUrl = yield* createOrUpdateFunctionUrl({
             functionName,
             url: news.url,

package/src/AWS/Lambda/index.ts

@@ -7,6 +7,7 @@ export * from "./CreateShellAuthTokenHttp.ts";
 export * from "./DeleteMicrovmImageVersion.ts";
 export * from "./DeleteMicrovmImageVersionHttp.ts";
 export * from "./EventBridgeEventSource.ts";
+export * from "./EventInvokeConfig.ts";
 export * from "./EventSourceMapping.ts";
 export * from "./Function.ts";
 export * from "./GetMicrovm.ts";

package/src/AWS/Organizations/DelegatedAdministrator.ts

@@ -56,10 +56,18 @@ export const DelegatedAdministratorProvider = () =>
           }
         }),
         read: Effect.fn(function* ({ olds, output }) {
+          const accountId = output?.accountId ?? olds?.accountId;
+          const servicePrincipal =
+            output?.servicePrincipal ?? olds?.servicePrincipal;
+          if (accountId === undefined || servicePrincipal === undefined) {
+            // Output-valued props don't survive a `creating`-state round-trip
+            // (they deserialize as `undefined`) — report "not found" so the
+            // engine re-drives the create.
+            return undefined;
+          }
           return yield* readDelegatedAdministrator({
-            accountId: output?.accountId ?? olds!.accountId,
-            servicePrincipal:
-              output?.servicePrincipal ?? olds!.servicePrincipal,
+            accountId,
+            servicePrincipal,
           });
         }),
         list: () =>

package/src/AWS/Organizations/PolicyAttachment.ts

@@ -55,10 +55,16 @@ export const PolicyAttachmentProvider = () =>
           }
         }),
         read: Effect.fn(function* ({ olds, output }) {
-          return yield* readAttachment({
-            policyId: output?.policyId ?? olds!.policyId,
-            targetId: output?.targetId ?? olds!.targetId,
-          });
+          const policyId = output?.policyId ?? olds?.policyId;
+          const targetId = output?.targetId ?? olds?.targetId;
+          if (policyId === undefined || targetId === undefined) {
+            // A `creating` row persisted before upstream Outputs resolved
+            // can't round-trip Output-valued ids — they deserialize as
+            // `undefined`. Report "not found" so the engine re-drives the
+            // create (reconcile observes before attaching).
+            return undefined;
+          }
+          return yield* readAttachment({ policyId, targetId });
         }),
         // Enumerate every (policy, target) attachment. There is no direct
         // "list attachments" API, so we fan out: for each policy type, list the

package/src/AWS/Organizations/RootPolicyType.ts

@@ -54,10 +54,15 @@ export const RootPolicyTypeProvider = () =>
           }
         }),
         read: Effect.fn(function* ({ olds, output }) {
-          return yield* readRootPolicyType({
-            rootId: output?.rootId ?? olds!.rootId,
-            policyType: output?.policyType ?? olds!.policyType,
-          });
+          const rootId = output?.rootId ?? olds?.rootId;
+          const policyType = output?.policyType ?? olds?.policyType;
+          if (rootId === undefined || policyType === undefined) {
+            // Output-valued props don't survive a `creating`-state round-trip
+            // (they deserialize as `undefined`) — report "not found" so the
+            // engine re-drives the create.
+            return undefined;
+          }
+          return yield* readRootPolicyType({ rootId, policyType });
         }),
         // A RootPolicyType is the enable/disable state of one policy type on
         // one organization root. `listRoots` already returns each root's

package/src/AWS/Organizations/TrustedServiceAccess.ts

@@ -45,9 +45,15 @@ export const TrustedServiceAccessProvider = () =>
           }
         }),
         read: Effect.fn(function* ({ olds, output }) {
-          return yield* readTrustedServiceAccess(
-            output?.servicePrincipal ?? olds!.servicePrincipal,
-          );
+          const servicePrincipal =
+            output?.servicePrincipal ?? olds?.servicePrincipal;
+          if (servicePrincipal === undefined) {
+            // Output-valued props don't survive a `creating`-state round-trip
+            // (they deserialize as `undefined`) — report "not found" so the
+            // engine re-drives the create.
+            return undefined;
+          }
+          return yield* readTrustedServiceAccess(servicePrincipal);
         }),
         list: () =>
           Effect.gen(function* () {

package/src/AWS/Route53/HostedZone.ts

@@ -114,17 +114,22 @@ export const HostedZoneProvider = () =>
       // Poll `getChange` until the change reaches INSYNC. `getChange` is
       // eventually consistent and can briefly return `NoSuchChange` right after
       // submit, so coalesce that to a non-INSYNC status and keep polling.
+      // `ChangeInfo.Id` comes back as "/change/C..." but `getChange` only
+      // accepts the bare id — the prefixed form returns `NoSuchChange`
+      // forever, silently burning the full repeat cap on every change.
       const waitForChange = Effect.fn(function* (changeId: string) {
-        return yield* route53.getChange({ Id: changeId }).pipe(
-          Effect.map((r) => r.ChangeInfo.Status),
-          Effect.catchTag("NoSuchChange", () => Effect.succeed("PENDING")),
-          Effect.repeat({
-            schedule: Schedule.fixed("2 seconds").pipe(
-              Schedule.both(Schedule.recurs(60)),
-            ),
-            until: (status) => status === "INSYNC",
-          }),
-        );
+        return yield* route53
+          .getChange({ Id: changeId.replace(/^\/change\//, "") })
+          .pipe(
+            Effect.map((r) => r.ChangeInfo.Status),
+            Effect.catchTag("NoSuchChange", () => Effect.succeed("PENDING")),
+            Effect.repeat({
+              schedule: Schedule.fixed("2 seconds").pipe(
+                Schedule.both(Schedule.recurs(60)),
+              ),
+              until: (status) => status === "INSYNC",
+            }),
+          );
       });
 
       const findByName = Effect.fn(function* (name: string) {
@@ -242,8 +247,13 @@ export const HostedZoneProvider = () =>
           ),
         diff: Effect.fn(function* ({ olds, news }) {
           if (!isResolved(news)) return undefined;
+          // Name change → replace, but only when the old name is known — a
+          // half-created state row can't round-trip an Output-valued `name`
+          // (it deserializes as `undefined`), and an unknown old name must
+          // fall through to the create/update recovery path.
           if (
-            normalizeName(olds.name) !== normalizeName(news.name) ||
+            (olds.name !== undefined &&
+              normalizeName(olds.name) !== normalizeName(news.name)) ||
             (olds.privateZone ?? false) !== (news.privateZone ?? false) ||
             olds.delegationSetId !== news.delegationSetId ||
             olds.vpc?.vpcId !== news.vpc?.vpcId
@@ -253,8 +263,15 @@ export const HostedZoneProvider = () =>
         }),
         read: Effect.fn(function* ({ olds, output }) {
           // Resolve the zone id: prefer the stored output, else look up by name
-          // (adoption / state-loss recovery).
-          const zoneId = output?.id ?? (yield* findByName(olds!.name))?.Id;
+          // (adoption / state-loss recovery). The persisted `name` may be
+          // `undefined` when a `creating` row was written before upstream
+          // Outputs resolved — report "not found" and let the engine
+          // re-drive the create.
+          const zoneId =
+            output?.id ??
+            (olds?.name !== undefined
+              ? (yield* findByName(olds.name))?.Id
+              : undefined);
           if (zoneId === undefined) {
             return undefined;
           }

package/src/AWS/Route53/Record.ts

@@ -477,17 +477,22 @@ export const RecordProvider = () =>
       // Poll `getChange` until the change reaches INSYNC. `getChange` is
       // eventually consistent and can briefly return `NoSuchChange` right after
       // submit, so coalesce that to a non-INSYNC status and keep polling.
+      // `ChangeInfo.Id` comes back as "/change/C..." but `getChange` only
+      // accepts the bare id — the prefixed form returns `NoSuchChange`
+      // forever, silently burning the full repeat cap on every change.
       const waitForChange = Effect.fn(function* (changeId: string) {
-        return yield* route53.getChange({ Id: changeId }).pipe(
-          Effect.map((response) => response.ChangeInfo.Status),
-          Effect.catchTag("NoSuchChange", () => Effect.succeed("PENDING")),
-          Effect.repeat({
-            schedule: Schedule.fixed("2 seconds").pipe(
-              Schedule.both(Schedule.recurs(60)),
-            ),
-            until: (status) => status === "INSYNC",
-          }),
-        );
+        return yield* route53
+          .getChange({ Id: changeId.replace(/^\/change\//, "") })
+          .pipe(
+            Effect.map((response) => response.ChangeInfo.Status),
+            Effect.catchTag("NoSuchChange", () => Effect.succeed("PENDING")),
+            Effect.repeat({
+              schedule: Schedule.fixed("2 seconds").pipe(
+                Schedule.both(Schedule.recurs(60)),
+              ),
+              until: (status) => status === "INSYNC",
+            }),
+          );
       });
 
       const findRecord = Effect.fn(function* (
@@ -590,10 +595,16 @@ export const RecordProvider = () =>
           }),
         diff: Effect.fn(function* ({ olds, news }) {
           if (!isResolved(news)) return undefined;
+          // Identity change → replace, but only when the old value is known —
+          // a half-created state row can't round-trip Output-valued props
+          // (they deserialize as `undefined`), and an unknown old identity
+          // must fall through to the create/update recovery path.
           if (
-            normalizeHostedZoneId(olds.hostedZoneId) !==
-              normalizeHostedZoneId(news.hostedZoneId) ||
-            normalizeName(olds.name) !== normalizeName(news.name) ||
+            (olds.hostedZoneId !== undefined &&
+              normalizeHostedZoneId(olds.hostedZoneId) !==
+                normalizeHostedZoneId(news.hostedZoneId)) ||
+            (olds.name !== undefined &&
+              normalizeName(olds.name) !== normalizeName(news.name)) ||
             olds.type !== news.type ||
             olds.setIdentifier !== news.setIdentifier
           ) {
@@ -601,20 +612,31 @@ export const RecordProvider = () =>
           }
         }),
         read: Effect.fn(function* ({ olds, output }) {
-          const recordSet = yield* findRecord(
-            output?.hostedZoneId ?? olds!.hostedZoneId,
-            {
-              name: output?.name ?? olds!.name,
-              type: output?.type ?? olds!.type,
-              setIdentifier: output?.setIdentifier ?? olds!.setIdentifier,
-            },
-          );
+          const hostedZoneId = output?.hostedZoneId ?? olds?.hostedZoneId;
+          const name = output?.name ?? olds?.name;
+          const type = output?.type ?? olds?.type;
+          if (
+            hostedZoneId === undefined ||
+            name === undefined ||
+            type === undefined
+          ) {
+            // Output-valued props don't survive a `creating`-state round-trip
+            // — without the record's identity we can't look it up. Report
+            // "not found" so the engine re-drives the create (the UPSERT in
+            // reconcile converges on any half-created record).
+            return undefined;
+          }
+          const recordSet = yield* findRecord(hostedZoneId, {
+            name,
+            type,
+            setIdentifier: output?.setIdentifier ?? olds?.setIdentifier,
+          });
 
           if (!recordSet) {
             return undefined;
           }
 
-          return toAttrs(recordSet, output?.hostedZoneId ?? olds!.hostedZoneId);
+          return toAttrs(recordSet, hostedZoneId);
         }),
         reconcile: Effect.fn(function* ({ news, session }) {
           // Route 53 `changeResourceRecordSets` with `UPSERT` is naturally

package/src/Apply.ts

@@ -465,7 +465,13 @@ const executeNode = (
     // ── noop ──
 
     if (node.action === "noop") {
-      // No work to do — the persisted attr is already stable.
+      // No work to do — the persisted attr is already stable. If the row was
+      // persisted under a legacy type name (the type was since renamed and
+      // carries the old name as an alias), migrate it to the canonical type
+      // so the state stops depending on the alias.
+      if (node.state.resourceType !== node.resource.Type) {
+        yield* commit({ ...node.state, resourceType: node.resource.Type });
+      }
       yield* signalReadyStable;
       yield* storeAndSignal({
         output: node.state.attr,

package/src/Auth/Lock.ts

@@ -4,6 +4,23 @@ import * as fs from "node:fs/promises";
 import * as path from "pathe";
 import { rootDir } from "./Profile.ts";
 
+/**
+ * Make a lock key safe to use as a file name on every platform.
+ *
+ * Keys are derived from user-controlled values (profile names), which
+ * have shown up in production containing shell placeholders like
+ * `${ALCHEMY_PROFILE:-default}` — `:`/`{`/`$` are invalid in Windows
+ * file names and mkdir fails with EINVAL. Collapse anything outside a
+ * conservative allow-list to `_`.
+ *
+ * @internal exported for unit testing.
+ */
+export const sanitizeLockKey = (key: string): string =>
+  key.replace(/[^A-Za-z0-9._-]/g, "_");
+
+/** File-system errors that mean "we cannot lock here at all". */
+const UNLOCKABLE_FS_CODES = new Set(["EROFS", "EACCES", "EPERM", "ENOSPC"]);
+
 /**
  * Serialise execution of `effect` so no two callers ever run inside the
  * critical section concurrently for the same `key`, both within this
@@ -13,6 +30,11 @@ import { rootDir } from "./Profile.ts";
  * holders by path (so same-process callers wait via `retries`) and uses
  * an OS file lock for cross-process coordination, with stale-lock
  * detection at 60s.
+ *
+ * Locking is best-effort: on file systems where the lock directory
+ * cannot be created at all (read-only home in containers/CI), the
+ * effect runs unserialised with a warning instead of failing — a
+ * missed lock only risks a redundant credential refresh.
  */
 export const withLock = <A, E, R>(
   key: string,
@@ -22,26 +44,48 @@ export const withLock = <A, E, R>(
   // `Profile -> AuthProvider -> Lock -> Profile` import cycle never reads
   // `rootDir` before `Profile.ts` has finished initialising it.
   const lockDir = path.join(rootDir, "lock");
-  const lockPath = path.join(lockDir, `${key}.lock`);
+  const lockPath = path.join(lockDir, `${sanitizeLockKey(key)}.lock`);
   return Effect.acquireUseRelease(
     Effect.promise(async () => {
-      await fs.mkdir(lockDir, { recursive: true });
-      return await lock(lockPath, {
-        retries: { retries: 600, minTimeout: 50, maxTimeout: 50 },
-        // The holder refreshes the lockfile mtime on a timer. Under heavy
-        // load (e.g. a full test run saturating every core) that timer can
-        // be starved for several seconds, so keep the stale threshold well
-        // above any realistic starvation pause.
-        stale: 30_000,
-        realpath: false,
-        // The library's default handler throws from a timer callback,
-        // which surfaces as an uncaught exception and kills the process.
-        // A compromised auth lock is benign here (worst case two refreshes
-        // race), so log and continue.
-        onCompromised: (err) => {
-          console.warn(`auth lock compromised (continuing): ${err.message}`);
-        },
-      });
+      try {
+        await fs.mkdir(lockDir, { recursive: true });
+        return await lock(lockPath, {
+          retries: { retries: 600, minTimeout: 50, maxTimeout: 50 },
+          // The holder refreshes the lockfile mtime on a timer. Under heavy
+          // load (e.g. a full test run saturating every core) that timer can
+          // be starved for several seconds, so keep the stale threshold well
+          // above any realistic starvation pause.
+          stale: 30_000,
+          realpath: false,
+          // The library's default handler throws from a timer callback,
+          // which surfaces as an uncaught exception and kills the process.
+          // A compromised auth lock is benign here (worst case two refreshes
+          // race), so log and continue.
+          onCompromised: (err) => {
+            console.warn(`auth lock compromised (continuing): ${err.message}`);
+          },
+        });
+      } catch (err) {
+        const code = (err as NodeJS.ErrnoException).code;
+        if (code !== undefined && UNLOCKABLE_FS_CODES.has(code)) {
+          console.warn(
+            `auth lock unavailable (${code} at '${lockPath}') — continuing without cross-process locking`,
+          );
+          return async () => {};
+        }
+        if (
+          err instanceof Error &&
+          err.message.includes("already being held")
+        ) {
+          throw new Error(
+            `Timed out waiting for the alchemy auth lock '${lockPath}' — another alchemy ` +
+              `process has held it for over 30s. If no other alchemy process is running, ` +
+              `delete the lock file and retry.`,
+            { cause: err },
+          );
+        }
+        throw err;
+      }
     }),
     () => effect,
     (release) => Effect.promise(() => release().catch(() => {})),

package/src/Bundle/PurePlugin.ts

@@ -314,6 +314,11 @@ export async function resolvePackageInfo(
   let foundInfo: PackageInfo | null = null;
   // Hard ceiling to prevent runaway walks on weird ids.
   for (let i = 0; i < 64; i++) {
+    // Never walk above a `node_modules` boundary: the owning package of a
+    // `node_modules/<pkg>/...` id lives at or below `<pkg>`. Climbing past
+    // it can latch onto an unrelated package.json higher up (e.g. a stray
+    // one at the filesystem root) and poison the shared-ancestor cache.
+    if (path.basename(dir) === "node_modules") break;
     const cached = cache.get(dir);
     if (cached !== undefined) {
       cacheDescendants(cache, visited, dir, cached);
@@ -348,8 +353,16 @@ export async function resolvePackageInfo(
     dir = parent;
   }
   if (foundInfo !== null && foundRoot !== null) {
-    cacheDescendants(cache, visited, foundRoot, foundInfo);
-    return foundInfo;
+    // A nameless package.json (e.g. a nested `dist/package.json` holding
+    // only `{"type": "module"}`, or a stray file high up the tree) can't be
+    // matched against the configured patterns — prefer the path-derived
+    // `node_modules/<pkg>` name when one exists.
+    const info =
+      foundInfo.name === null && fastName !== null
+        ? { name: fastName, sideEffects: foundInfo.sideEffects }
+        : foundInfo;
+    cacheDescendants(cache, visited, foundRoot, info);
+    return info;
   }
   // No `package.json` found on disk. If we have a path-derived name
   // (from a `node_modules/<pkg>/...` segment), use it with no