Incompatibility issue in production build with cloudflare worker from 3.0.1

[vnphanquang]

Description

Hi there, thank you for the good work. During some maintenance update I discovered @paralleldrive/cuid2, starting from 3.0.1, cause crash in my production build, targeted Cloudflare worker environment, using their official vite-plugin. The server log is as follow, although it is not very helpful:

✘ [ERROR] service core:user:cloudflare-vite-get-started: Uncaught Error: Disallowed operation called within global scope. Asynchronous I/O (ex: fetch() or connect()), setting a timeout, and generating random values are not allowed within global scope. To fix this error, perform this operation within a handler. https://developers.cloudflare.com/workers/runtime-apis/handlers/

Reproduction

Please see https://github.com/vnphanquang/cloudflare-worker-vite-plugin-cuid2 and its README for detailed steps to reproduce. I did not test if this causes similar issue without the vite-plugin (running wrangler directly).

I suspect this is due to some ESM syntax introduced recently, or some imported module with side effects. But since there is no entry for 3.0.1 in the CHANGELOG, I'm not able to investigate further at this point, sorry.

[marbemac]

Running into this as well - it's because of the const random = createRandom(); side effect.

[vnphanquang]

Thanks @marbemac for the investigation. Perhaps createRandom can be lazily init here.

[imrea]

+1, I can confirm this issue exists for both CF vite-plugin and wrangler as this is related to workerd runtime and worker initialization

[firxworx]

I hit this too. To provide more detail...

The error has to do with particular restrictions in the Cloudflare Workers runtime:

Uncaught Error: Disallowed operation called within global scope. Asynchronous I/O (ex: fetch() or connect()), setting a timeout, and generating random values are not allowed within global scope. To fix this error, perform this operation within a handler. https://developers.cloudflare.com/workers/runtime-apis/handlers/

So where is cuid2 being "naughty" and doing things like generating random values in global scope instead of in a handler?

I inspected the offending bundle and these were the culprits.

This one is noted above:

const createRandom = () => {
  if (typeof globalThis !== "undefined" && globalThis.crypto && typeof globalThis.crypto.getRandomValues === "function") {
    return () => {
      const buffer = new Uint32Array(1);
      globalThis.crypto.getRandomValues(buffer);
      return buffer[0] / 4294967296;
    };
  }
  return Math.random;
};
const random = createRandom();

And here it looks like adoption of modern syntax may be a contributor: the default values are generated before the init$1() function itself is actually invoked, i.e. this code is generating random numbers in global scope instead of within the handler:

const init$1 = ({
  // Fallback if the user does not pass in a CSPRNG. This should be OK
  // because we don't rely solely on the random number generator for entropy.
  // We also use the host fingerprint, current time, and a session counter.
  random: rand = random,
  counter = createCounter(Math.floor(rand() * initialCountMax)),
  length = defaultLength,
  fingerprint = createFingerprint({ random: rand })
} = {}) => {
  if (length > bigLength) {
    throw new Error(
      `Length must be between 2 and ${bigLength}. Received: ${length}`
    );
  }
  return function cuid22() {
    const firstLetter = randomLetter(rand);
    const time2 = Date.now().toString(36);
    const count2 = counter().toString(36);
    const salt = createEntropy(length, rand);
    const hashInput = `${time2 + salt + count2 + fingerprint}`;
    return `${firstLetter + hash(hashInput).substring(1, length)}`;
  };
};
init$1()

---

In case it helps anyone searching for answers after bumping versions and finding their app won't deploy:

In my particular case the application is using cuid2 as database identifiers in certain tables in a drizzle schema with D1 database. The actual bundle affected was a server-only auth.server-XXXX.js related to a better-auth configuration.

The error with Cloudflare workers will occur even if I use a function to return the better-auth options and even if I use a function to return an auth instance singleton (i.e. even if I try to take every step I can in my code to not break Cloudflare's rules and only execute code within handlers instead of global scope).

It appears second anything related to cuid2 ends up in the bundle this error will occur.

Thanks to OP for identifying the version where this first becomes a problem.

[pliashkou]

Hit this issue today as well..

[angelsanzn]

@ericelliott I submitted a fix in #115

[LeonHeidelbach]

I hit this issue as well today. Figuring out that it was this package causing the problem in a large project with many dependencies was not particularly easy either. This needs to be addressed quickly @ericelliott.

[InvixGG]

Ran into this as well