alchemy 2.0.0-beta.64 → 2.0.0-beta.66

package/src/Bundle/Bundle.ts

@@ -4,7 +4,7 @@ import * as Queue from "effect/Queue";
 import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 import assert from "node:assert";
-import * as rolldown from "rolldown";
+import type * as rolldown from "rolldown";
 import { sha256, sha256Object } from "../Util/sha256.ts";
 import {
   bundleAnalyzerPlugin,
@@ -13,6 +13,14 @@ import {
 import { purePlugin, type PurePluginOptions } from "./PurePlugin.ts";
 import { rawPlugin } from "./RawPlugin.ts";
 
+/**
+ * Rolldown is loaded lazily on first {@link build}/{@link watch} so that
+ * merely importing alchemy — the CLI command tree, the Cloudflare provider
+ * barrel — never loads `@rolldown/binding-*`. A stack that bundles
+ * nothing must not require the native bundler to be loadable (#562).
+ */
+const loadRolldown = () => import("rolldown");
+
 /**
  * Extra options accepted by {@link build} / {@link watch} on top of the
  * standard rolldown input/output options.
@@ -148,9 +156,10 @@ export const build = (
 ): Effect.Effect<BundleOutput, BundleError> =>
   Effect.tryPromise({
     try: async () => {
+      const rolldown = await loadRolldown();
       const bundle = await rolldown.rolldown({
         ...withAlchemyDefine(inputOptions),
-        plugins: [inputOptions.plugins, builtInPlugins(extra)],
+        plugins: [inputOptions.plugins, await builtInPlugins(extra)],
         optimization: inputOptions.optimization ?? {
           inlineConst: {
             mode: "smart",
@@ -188,12 +197,13 @@ export const watch = (
       }
   >((queue) =>
     Effect.acquireRelease(
-      Effect.sync(() => {
+      Effect.promise(async () => {
+        const rolldown = await loadRolldown();
         const watcher = rolldown.watch({
           ...withAlchemyDefine(inputOptions),
           plugins: [
             inputOptions.plugins,
-            builtInPlugins(extra),
+            await builtInPlugins(extra),
             // The watcher event listener does not receive the bundle output, so we grab it using a plugin.
             {
               name: "alchemy:watch-bundle",
@@ -348,12 +358,12 @@ export function bundleOutputFromRolldownOutputBundle(
  * `node_modules/<pkg>/...` by upstream resolver plugins such as
  * `@distilled.cloud/cloudflare-rolldown-plugin`.
  */
-function builtInPlugins(
+async function builtInPlugins(
   extra?: BundleExtraOptions,
-): rolldown.RolldownPluginOption {
+): Promise<rolldown.RolldownPluginOption> {
   return [
     extra?.bundleAnalyzer
-      ? bundleAnalyzerPlugin(
+      ? await bundleAnalyzerPlugin(
           extra.bundleAnalyzer === true ? {} : extra.bundleAnalyzer,
         )
       : undefined,

package/src/Bundle/BundleAnalyzerPlugin.ts

@@ -1,5 +1,4 @@
 import type { Plugin } from "rolldown";
-import { bundleAnalyzerPlugin as rolldownBundleAnalyzerPlugin } from "rolldown/experimental";
 
 export interface BundleAnalyzerPluginOptions {
   /**
@@ -24,10 +23,16 @@ export interface BundleAnalyzerPluginOptions {
  * - import dependencies between chunks
  * - the modules reachable from each entry point
  */
-export const bundleAnalyzerPlugin = (
+export const bundleAnalyzerPlugin = async (
   options: BundleAnalyzerPluginOptions = {},
-): Plugin =>
-  rolldownBundleAnalyzerPlugin({
+): Promise<Plugin> => {
+  // `rolldown/experimental` loads `@rolldown/binding-*` at module scope,
+  // so it is imported lazily — importing this module (e.g. via the
+  // `alchemy/Bundle` barrel) must never load the native binding (#562).
+  const { bundleAnalyzerPlugin: rolldownBundleAnalyzerPlugin } =
+    await import("rolldown/experimental");
+  return rolldownBundleAnalyzerPlugin({
     fileName: options.fileName,
     format: options.format ?? "md",
   });
+};

package/src/Bundle/PurePlugin.ts

@@ -13,8 +13,15 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import picomatch from "picomatch";
 import type * as rolldown from "rolldown";
-import { RolldownMagicString } from "rolldown";
-import { parseAst } from "rolldown/parseAst";
+
+/**
+ * `rolldown` and `rolldown/parseAst` load `@rolldown/binding-*` at module
+ * scope, so they are imported lazily on first use — importing this module
+ * (e.g. via the `alchemy/Bundle` barrel) must never load the native
+ * binding (#562).
+ */
+const loadRolldown = () => import("rolldown");
+const loadParseAst = () => import("rolldown/parseAst");
 
 /**
  * Default packages whose modules will receive `/*#__PURE__*\/` annotations.
@@ -62,10 +69,11 @@ export interface PurePluginOptions {
    * too. This makes the user's own source tree-shakeable without any
    * configuration.
    *
-   * The package's `sideEffects` field is NOT consulted for this gate —
-   * if your entry's package has init-time side effects you wish to
-   * preserve, declare them in `package.json` (`"sideEffects": ["./foo.ts"]`)
-   * or set this option to `false`.
+   * Only calls whose result is used (variable initializers, exports) are
+   * annotated in the auto-detected package. Top-level calls whose result
+   * is discarded (e.g. Hono/Express-style `app.get("/", handler)` route
+   * registrations) are preserved unless the package explicitly declares
+   * `"sideEffects": false` (or `[]`) in its `package.json`.
    *
    * @default true
    */
@@ -139,19 +147,32 @@ export const purePlugin = (
         if (name === null || !isMatch(name)) return null;
 
         // Only override `moduleSideEffects` when the owning package
-        // explicitly opts in via `sideEffects: false` / `[]`. Pure
-        // annotations themselves are always safe to add (they only mean
-        // "if the result is unused, the call may be dropped"), but
-        // marking arbitrary modules side-effect-free could erase
-        // intentional registrations / mutations the author made at the
-        // top level of files in packages that did not declare so.
+        // explicitly opts in via `sideEffects: false` / `[]`. Marking
+        // arbitrary modules side-effect-free could erase intentional
+        // registrations / mutations the author made at the top level of
+        // files in packages that did not declare so.
+        const isEntry = entryPaths.has(cleanId);
+        const sideEffectFreePkg = isSideEffectFree(info?.sideEffects);
         const markSideEffectFree =
-          markSideEffectFreeOpt &&
-          !entryPaths.has(cleanId) &&
-          isSideEffectFree(info?.sideEffects);
+          markSideEffectFreeOpt && !isEntry && sideEffectFreePkg;
 
-        const anchors = collectPureAnchorsCached(code, cleanId);
-        if (anchors === null) {
+        const anchors = await collectPureAnchorsCached(code, cleanId);
+        // Annotating a call whose result is BOUND (variable initializer,
+        // export) only lets the minifier drop it when the binding itself
+        // is unused — safe everywhere. Annotating a call whose result is
+        // DISCARDED (a bare expression statement like `app.get("/", h)`)
+        // is an instruction to delete the call under minification, so it
+        // is only applied when the owning package explicitly declared
+        // itself side-effect free, and never to entry modules, whose side
+        // effects we always preserve (#949).
+        const annotateDiscarded = !isEntry && sideEffectFreePkg;
+        const positions =
+          anchors === null
+            ? []
+            : annotateDiscarded
+              ? [...anchors.bound, ...anchors.discarded]
+              : anchors.bound;
+        if (positions.length === 0) {
           // Metadata-only result: omitting `code` tells rolldown the
           // source was NOT transformed, so no sourcemap is expected and
           // no SOURCEMAP_BROKEN warning is emitted.
@@ -161,8 +182,10 @@ export const purePlugin = (
         // `code`. Returning it as `code` hands sourcemap generation to
         // rolldown's native side (computed on a background thread). The
         // fallback covers direct hook invocations (unit tests).
-        const s = meta.magicString ?? new RolldownMagicString(code);
-        for (const anchor of anchors) s.appendLeft(anchor, PURE_COMMENT);
+        const s =
+          meta.magicString ??
+          new (await loadRolldown()).RolldownMagicString(code);
+        for (const anchor of positions) s.appendLeft(anchor, PURE_COMMENT);
         return {
           code: s,
           moduleSideEffects: markSideEffectFree ? false : null,
@@ -324,19 +347,19 @@ export function packageNameFromId(id: string): string | null {
  */
 const anchorsCache = new Map<
   string,
-  { readonly code: string; readonly anchors: number[] | null }
+  { readonly code: string; readonly anchors: PureAnchors | null }
 >();
 const ANCHORS_CACHE_MAX = 10_000;
 
-const collectPureAnchorsCached = (
+const collectPureAnchorsCached = async (
   code: string,
   filename: string,
-): number[] | null => {
+): Promise<PureAnchors | null> => {
   const cached = anchorsCache.get(filename);
   if (cached !== undefined && cached.code === code) {
     return cached.anchors;
   }
-  const anchors = collectPureAnchors(code, filename);
+  const anchors = await collectPureAnchors(code, filename);
   if (anchorsCache.size >= ANCHORS_CACHE_MAX) {
     anchorsCache.clear();
   }
@@ -344,16 +367,39 @@ const collectPureAnchorsCached = (
   return anchors;
 };
 
+/**
+ * Offsets at which `/*#__PURE__*\/` may be inserted, split by whether the
+ * call's result is consumed.
+ */
+export interface PureAnchors {
+  /**
+   * Calls whose result is bound — variable initializers, exports,
+   * assignment right-hand sides. Annotating these only lets the minifier
+   * drop the call when the binding itself is unused, so it is safe for
+   * any module.
+   */
+  readonly bound: number[];
+  /**
+   * Top-level calls whose result is discarded (bare expression
+   * statements such as `app.get("/", handler)`). Annotating these tells
+   * the minifier the whole statement is deletable, so they are only safe
+   * in packages that explicitly declare `sideEffects: false` / `[]`.
+   */
+  readonly discarded: number[];
+}
+
 /**
  * Parses `code` and returns the offsets at which `/*#__PURE__*\/` must be
  * inserted — before every top-level `CallExpression` callee / `new`
- * keyword. Returns `null` if the file does not need to be modified
- * (parse failure or no annotations needed).
+ * keyword — classified by whether the call result is bound or discarded.
+ * Returns `null` if the file does not need to be modified (parse failure
+ * or no annotations needed).
  */
-export function collectPureAnchors(
+export async function collectPureAnchors(
   code: string,
   filename: string,
-): number[] | null {
+): Promise<PureAnchors | null> {
+  const { parseAst } = await loadParseAst();
   let program: Program;
   try {
     // Use TS lang so the parser tolerates TS syntax (`as`, `satisfies`,
@@ -364,51 +410,66 @@ export function collectPureAnchors(
     return null;
   }
 
-  const anchors: number[] = [];
+  const bound: number[] = [];
+  const discarded: number[] = [];
 
-  const visitCall = (call: CallExpression | NewExpression) => {
+  const visitCall = (
+    call: CallExpression | NewExpression,
+    isDiscarded: boolean,
+  ) => {
     if (isIIFE(call)) return;
     // For `new X()`, anchor BEFORE the `new` keyword so we get
     // `/*#__PURE__*/ new X()` (matches babel-plugin-annotate-pure-calls).
     const anchor =
       call.type === "NewExpression" ? call.start : call.callee.start;
     if (alreadyAnnotated(code, anchor)) return;
-    anchors.push(anchor);
+    (isDiscarded ? discarded : bound).push(anchor);
   };
 
-  const visitExpression = (expr: Expression | null | undefined) => {
+  const visitExpression = (
+    expr: Expression | null | undefined,
+    isDiscarded: boolean,
+  ) => {
     if (!expr) return;
     switch (expr.type) {
       case "CallExpression":
       case "NewExpression":
-        visitCall(expr);
+        visitCall(expr, isDiscarded);
         return;
-      case "SequenceExpression":
-        for (const inner of expr.expressions) visitExpression(inner);
+      case "SequenceExpression": {
+        // All but the last expression's results are always discarded;
+        // the last one takes the surrounding context.
+        const exprs = expr.expressions;
+        for (let i = 0; i < exprs.length; i++) {
+          visitExpression(exprs[i], i < exprs.length - 1 ? true : isDiscarded);
+        }
         return;
+      }
       case "ParenthesizedExpression":
-        visitExpression(expr.expression);
+        visitExpression(expr.expression, isDiscarded);
         return;
       case "LogicalExpression":
-        visitExpression(expr.left);
-        visitExpression(expr.right);
+        visitExpression(expr.left, isDiscarded);
+        visitExpression(expr.right, isDiscarded);
         return;
       case "ConditionalExpression":
-        visitExpression(expr.consequent);
-        visitExpression(expr.alternate);
+        visitExpression(expr.consequent, isDiscarded);
+        visitExpression(expr.alternate, isDiscarded);
         return;
       case "AssignmentExpression":
-        visitExpression(expr.right);
+        // The right-hand side's result is stored in the target, so it is
+        // bound even when the assignment appears in statement position.
+        visitExpression(expr.right, false);
         return;
       case "TSAsExpression":
       case "TSSatisfiesExpression":
       case "TSNonNullExpression":
       case "TSTypeAssertion":
-        visitExpression(expr.expression);
+        visitExpression(expr.expression, isDiscarded);
         return;
       case "ChainExpression": {
         const inner = expr.expression;
-        if (inner.type === "CallExpression") visitCall(inner);
+        if (inner.type === "CallExpression") visitCall(inner, isDiscarded);
         return;
       }
       default:
@@ -419,11 +480,11 @@ export function collectPureAnchors(
   const visitTopLevel = (node: Statement) => {
     switch (node.type) {
       case "ExpressionStatement":
-        visitExpression((node as ExpressionStatement).expression);
+        visitExpression((node as ExpressionStatement).expression, true);
         return;
       case "VariableDeclaration":
         for (const decl of (node as VariableDeclaration).declarations) {
-          visitExpression(decl.init);
+          visitExpression(decl.init, false);
         }
         return;
       case "ExportNamedDeclaration": {
@@ -439,7 +500,7 @@ export function collectPureAnchors(
           decl.type !== "ClassDeclaration" &&
           decl.type !== "TSInterfaceDeclaration"
         ) {
-          visitExpression(decl as Expression);
+          visitExpression(decl as Expression, false);
         }
         return;
       }
@@ -455,7 +516,9 @@ export function collectPureAnchors(
     visitTopLevel(node as Statement);
   }
 
-  return anchors.length === 0 ? null : anchors;
+  return bound.length === 0 && discarded.length === 0
+    ? null
+    : { bound, discarded };
 }
 
 function isIIFE(node: CallExpression | NewExpression): boolean {

package/src/Cli/checkVersion.ts

@@ -1,12 +1,30 @@
+import * as Clock from "effect/Clock";
+import * as Console from "effect/Console";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 
+import { AlchemyContext } from "alchemy/AlchemyContext";
 import packageJson from "../../package.json" with { type: "json" };
 
 const NPM_DIST_TAGS_URL =
   "https://registry.npmjs.org/-/package/alchemy/dist-tags";
 
+const CACHE_FILE = "version-check.json";
+const CACHE_TTL_MILLIS = Duration.toMillis(Duration.days(1));
+// npm's dist-tags endpoint is CDN-backed and typically answers in ~100ms;
+// the sync budget only needs to absorb a slow handshake, not a dead network.
+const SYNC_WAIT = Duration.seconds(3);
+
+interface VersionCheckCache {
+  checkedAt: number;
+  /** Absent when the last check attempt failed (offline, timeout, …). */
+  distTags?: Record<string, string>;
+}
+
 /**
  * Pick the dist-tag matching the current channel. For pre-release versions
  * like `2.0.0-beta.33`, npm's `latest` tag points at the most recent stable
@@ -26,32 +44,100 @@ const pickDistTag = (
   return distTags.latest;
 };
 
+const readCache = Effect.fn(
+  function* (cachePath: string) {
+    const fs = yield* FileSystem.FileSystem;
+    const raw = yield* fs.readFileString(cachePath);
+    const parsed = yield* Effect.try(
+      () => JSON.parse(raw) as VersionCheckCache | null | undefined,
+    );
+    return typeof parsed?.checkedAt === "number" ? parsed : undefined;
+  },
+  Effect.catch(() => Effect.succeed(undefined)),
+);
+
+const writeCache = Effect.fn(
+  function* (cachePath: string, distTags?: Record<string, string>) {
+    const fs = yield* FileSystem.FileSystem;
+    const checkedAt = yield* Clock.currentTimeMillis;
+    const cache: VersionCheckCache = { checkedAt, distTags };
+    yield* fs.writeFileString(cachePath, JSON.stringify(cache));
+  },
+  Effect.catch(() => Effect.void),
+);
+
+const fetchDistTags = Effect.gen(function* () {
+  const http = yield* HttpClient.HttpClient;
+  const response = yield* http.get(NPM_DIST_TAGS_URL);
+  const distTags = (yield* response.json) as Record<string, string> | null;
+  if (typeof distTags !== "object" || distTags === null) {
+    return yield* Effect.fail(new Error("malformed dist-tags response"));
+  }
+  return distTags;
+});
+
+/**
+ * Refresh the dist-tags cache with a single request. The fetch is forked so
+ * it outlives the sync wait: we give it {@link SYNC_WAIT} to land inline,
+ * and if it's still in flight the same request keeps going in the
+ * background, writing the cache when it completes. The background path
+ * never logs, so it can't interleave with prompts.
+ */
+const refreshDistTags = Effect.fn(function* (cachePath: string) {
+  const fetch = yield* fetchDistTags.pipe(
+    // The fiber owns all cache writes, whenever it completes — even after
+    // the sync wait below has given up on it. A failed attempt is cached
+    // too (a bare checkedAt), so a dead network costs at most one blocking
+    // wait per TTL window, not one per run.
+    Effect.tap((distTags) => writeCache(cachePath, distTags)),
+    Effect.tapError(() => writeCache(cachePath)),
+    Effect.forkScoped,
+  );
+  return yield* Fiber.join(fetch).pipe(
+    Effect.timeout(SYNC_WAIT),
+    Effect.catch(() => Effect.succeed(undefined)),
+  );
+});
+
 /**
- * Fetch the published `alchemy` version on the dist-tag matching the
- * current channel and log a warning if it's different from the bundled
- * version. Best-effort: any failure (offline, registry hiccup, slow
- * response) is swallowed silently.
+ * Warn if a newer `alchemy` version is published on the dist-tag matching
+ * the current channel. Runs to completion before any interactive prompts so
+ * the warning never interleaves with prompt rendering, and is bounded so it
+ * can never stall the CLI: dist-tags are cached in
+ * `.alchemy/version-check.json` for a day (failed attempts included), so at
+ * most one run per day waits on the network, and only up to
+ * {@link SYNC_WAIT}. Best-effort: every failure is swallowed silently.
  */
 export const checkLatestVersion = Effect.gen(function* () {
-  const http = yield* HttpClient.HttpClient;
-  const response = yield* http.get(NPM_DIST_TAGS_URL);
-  const distTags = (yield* response.json) as Record<string, string>;
-  if (typeof distTags !== "object" || distTags === null) return;
+  const path = yield* Path.Path;
+  const { dotAlchemy } = yield* AlchemyContext;
+  const cachePath = path.join(dotAlchemy, CACHE_FILE);
+  const now = yield* Clock.currentTimeMillis;
+
+  const cached = yield* readCache(cachePath);
+  const distTags =
+    cached !== undefined && now - cached.checkedAt <= CACHE_TTL_MILLIS
+      ? cached.distTags
+      : yield* refreshDistTags(cachePath);
+  if (distTags === undefined) return;
+
   const current = packageJson.version;
   const latest = pickDistTag(current, distTags);
-  if (typeof latest !== "string" || latest === current) return;
+  if (latest === undefined || latest === current) return;
+
   const installCmd =
     typeof process !== "undefined" && (process as any).versions?.bun
       ? `bun add alchemy@${latest}`
       : `pnpm add alchemy@${latest}`;
-  yield* Effect.logWarning(
+  // Print via the Console service, not Effect.logWarning: TelemetryLive
+  // replaces the default stdout logger with an OTLP-only logger at this
+  // stage of the program, so log output would never reach the terminal.
+  const useColor = process.stderr.isTTY === true;
+  const message =
     `alchemy ${latest} is available (you're on ${current}). ` +
-      `Run \`${installCmd}\` to upgrade.`,
-  );
-}).pipe(
-  Effect.timeout(Duration.seconds(5)),
-  Effect.catch(() => Effect.void),
-);
+    `Run \`${installCmd}\` to upgrade.`;
+  yield* Console.warn(useColor ? `\x1b[33m${message}\x1b[0m` : message);
+}).pipe(Effect.catch(() => Effect.void));
 
 // Exported for tests.
 export const _internal = { pickDistTag };

package/src/Cli/commands/deploy.ts

@@ -121,20 +121,9 @@ export const execStack = Effect.fn(function* ({
     const stack = yield* stackEffect;
 
     yield* Effect.gen(function* () {
-      const updatePlan = yield* Plan.make(
-        destroy
-          ? {
-              ...stack,
-              // zero these out (destroy will treat all as orphans)
-              // TODO(sam): probably better to have Plan.destroy and Plan.update
-              resources: {},
-              bindings: {},
-              actions: {},
-              output: {},
-            }
-          : stack,
-        { force },
-      );
+      const updatePlan = destroy
+        ? yield* Plan.destroy(stack)
+        : yield* Plan.make(stack, { force });
       if (dryRun) {
         yield* cli.displayPlan(updatePlan);
       } else {

package/src/Cli/commands/logs.ts

@@ -121,7 +121,12 @@ export const logsCommand = Command.make(
             });
             if (!(resourceState as any)?.attr) continue;
 
-            const provider = yield* findProviderByType(resource.Type);
+            // Query with the provider variant of the mode that deployed the
+            // row (a local dev worker's logs come from the local provider).
+            const provider = yield* findProviderByType(
+              resource.Type,
+              (resourceState as any).providerMode,
+            );
             if (!provider.logs) continue;
 
             const lines = yield* provider.logs({