chore(repo): vendor latest Effect and Alchemy subtrees

repos/alchemy/.claude/skills/audit/SKILL.md

@@ -0,0 +1 @@
+../../../.agents/skills/audit/SKILL.md

repos/alchemy/.claude/skills/pr-queue/SKILL.md

@@ -0,0 +1 @@
+../../../.agents/skills/pr-queue/SKILL.md

repos/alchemy/.claude/skills/prepare-release/SKILL.md

@@ -0,0 +1 @@
+../../../.agents/skills/prepare-release/SKILL.md

repos/alchemy/.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+
+submodules/** linguist-vendored

repos/alchemy/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: alchemy-run

repos/alchemy/.github/workflows/check.yml

@@ -0,0 +1,85 @@
+name: Check
+
+# Validates repository formatting, the type graph, and website docs.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, synchronize]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  check:
+    name: Check
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- submodules/distilled
+
+      - name: Restore Astro build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: website/node_modules/.astro
+          key: website-astro-check-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            website-astro-check-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-
+            website-astro-check-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-
+            website-astro-check-${{ runner.os }}-main-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Check formatting
+        run: pnpm format:check
+
+      - name: Check package versions
+        run: pnpm validate:publish-packages
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      # Must run after the type check: it reads distilled's emitted `lib/*.d.ts`,
+      # and stale/missing declarations resolve to `any`.
+      - name: Lint providers
+        run: pnpm lint:providers
+
+      # Type-aware, so it also needs the build above.
+      - name: Run Lint
+        run: pnpm lint
+
+      - name: Run Node Utils tests
+        run: pnpm -C packages/node-utils test
+
+      - name: Run pkg tests
+        run: pnpm -C packages/pkg test
+
+      - name: Test CLI launcher
+        run: timeout 240 pnpm test test/Cli/launcher.test.ts test/Cli/exitCodes.test.ts --retry 0 --concurrency 1
+
+      - name: Check API JSDocs
+        run: pnpm docs:check-jsdoc
+
+      # An internal PR carrying `deploy-website` gets a full Astro build in
+      # website.yml via StaticSite. That build runs the same output validators,
+      # so avoid building the site a second time here. Forks still run this
+      # check because they cannot access the preview deployment secrets.
+      - name: Check website docs
+        if: >-
+          github.event.pull_request.head.repo.full_name != github.repository ||
+          !contains(github.event.pull_request.labels.*.name, 'deploy-website')
+        run: pnpm docs:check

repos/alchemy/.github/workflows/cloudflare-tools.yml

@@ -0,0 +1,76 @@
+name: Cloudflare Tools
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "submodules/distilled"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/package-build.ts"
+      - "scripts/ensure-built.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
+  pull_request:
+    types: [opened, reopened, synchronize]
+    paths:
+      - "submodules/distilled"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/package-build.ts"
+      - "scripts/ensure-built.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloudflare-tools-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - blacksmith-8vcpu-ubuntu-2404
+          - blacksmith-6vcpu-macos-latest
+          - blacksmith-8vcpu-windows-2025
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- submodules/distilled
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      # Type checking is OS-independent and runs once in check.yml
+      # (`pnpm typecheck`). Test builds what it needs via ensure:built.
+      - name: Test
+        run: pnpm test:cloudflare-packages
+        env:
+          # Limit concurrent package test runs on the smaller runners.
+          pnpm_config_workspace_concurrency: ${{ runner.os == 'Windows' && '3' || runner.os == 'macOS' && '2' || '' }}

repos/alchemy/.github/workflows/pkg.yml

@@ -0,0 +1,100 @@
+name: Package Preview
+
+# Builds, packs, and publishes preview packages from the job that built them.
+# The job proves it is the run it claims to be by uploading the manifest as
+# an artifact of its own run, which only the job's runtime token can do; the
+# registry reads the artifact list back through the GitHub API. That works
+# the same for pushes, same-repo pull requests, and fork pull requests, and
+# needs no permissions or secrets. The upload has to be an action step: the
+# runtime token is never exposed to `run:` steps.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "submodules/distilled"
+      - "packages/**"
+      - "scripts/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.json"
+      - ".github/workflows/pkg.yml"
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+    paths:
+      - "submodules/distilled"
+      - "packages/**"
+      - "scripts/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.json"
+      - ".github/workflows/pkg.yml"
+
+permissions:
+  contents: read
+
+env:
+  PKG_REGISTRY: https://pkg.alchemy.run
+
+concurrency:
+  # Label events get a group per label so adding an unrelated label (such as
+  # `deploy-website`) never cancels the run for the latest push.
+  group: pkg-${{ github.event.pull_request.number || github.ref }}${{ github.event.action == 'labeled' && format('-{0}', github.event.label.name) || '' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  publish:
+    name: Publish preview packages
+    # `labeled` is only for `force-ci`, which repacks every package.
+    if: github.event.action != 'labeled' || github.event.label.name == 'force-ci'
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Pack the pull request head rather than the synthetic merge commit,
+          # so every tarball is addressed by a commit that exists on the PR.
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- submodules/distilled
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Build packages
+        run: pnpm build:pkg
+
+      # Workspace dependencies of the listed packages, such as the
+      # @distilled.cloud SDKs, are packed automatically under a collapsed
+      # "Transitive Dependencies" group. Keep the @alchemy.run
+      # list in sync with `build:pkg`.
+      - name: Pack packages
+        id: pack
+        run: >-
+          pnpm exec pkg pack
+          ${{ contains(github.event.pull_request.labels.*.name, 'force-ci') && '--all' || '' }}
+          --rebuild-all-path 'scripts/package-build.ts'
+          --group 'alchemy=./packages/alchemy'
+          --group '@alchemy.run[Collapsed]=./packages/{better-auth,cloudflare-runtime,frontend-frameworks,node-utils,floci,pkg}'
+
+      - name: Vouch for the manifest
+        if: steps.pack.outputs.package-count != '0'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ steps.pack.outputs.artifact-name }}
+          path: .pkg/pkg-manifest.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Publish packages
+        if: steps.pack.outputs.package-count != '0'
+        run: pnpm exec pkg publish