# Files changed · PR \#10654 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/10654/diffs)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

[chore\(refs\): sync Alchemy reference to beta.76](https://git.cafe/pingdotgg/t3code/pull/10654.md)

Version: 1

Head commit: d8acd131857525b30731ad5f40ce880e4ba4e6cd

Base commit: 98eb810ae28492f415c105d3786c475d22922a04

Comparison base: 98eb810ae28492f415c105d3786c475d22922a04

Showing up to 20 entries from this revision. If the pull request changes, reopen the first page before continuing.

## \.repos/alchemy-effect/\.gitattributes

Status: added; +4; −0

```diff
@@ -1,0 +1,4 @@
+* text=auto eol=lf
+
+.vendor/** linguist-vendored
+distilled/** linguist-vendored
```

## \.repos/alchemy-effect/\.github/pr-assets/967/multi-stack.png

Status: added; +0; −0

Binary file; no text patch.

## \.repos/alchemy-effect/\.github/pr-assets/967/single-stack.png

Status: added; +0; −0

Binary file; no text patch.

## \.repos/alchemy-effect/\.github/workflows/check.yml

Status: modified; +81; −21

```diff
@@ -1,41 +1,101 @@
-name: check
+name: Check
 
-# Runs the website docs validator (`bun run docs:check`) on every PR
+# Validates the repository type graph and website docs.
-# so broken links / missing API references fail fast before merge.
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
   pull_request:
     types: [opened, reopened, synchronize]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-env:
-  NODE_VERSION: "24"
 
 jobs:
   check:
-    runs-on: ubuntu-22-large
+    name: Check
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # `bun install` needs the distilled submodule (workspace member)
-          submodules: true
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Astro build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
+          path: website/node_modules/.astro
+          key: website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-
-          node-version: ${{ env.NODE_VERSION }}
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-
+            website-astro-${{ runner.os }}-main-
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
-          bun-version: latest
 
+      - name: Setup pnpm, Node.js, Bun and install dependencies
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Run Node Utils tests
+        run: pnpm -C packages/node-utils test
+
+      - name: Run Typecheck
+        run: pnpm tsc -b
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-${{ runner.os }}-
 
+      - name: Check API JSDocs
+        run: pnpm docs:check-jsdoc
+
-      - run: bun install
-      - run: bun tsc -b
-      - run: bun run docs:check
+      # An internal PR carrying `deploy-website` gets a full Astro build in
+      # website.yml via StaticSite. That build runs the same output validators,
+      # so avoid building the site a second time here. Forks still run this
+      # check because they cannot access the preview deployment secrets.
+      - name: Check website docs
+        if: >-
+          github.event.pull_request.head.repo.full_name != github.repository ||
+          !contains(github.event.pull_request.labels.*.name, 'deploy-website')
+        run: pnpm docs:check
```

## \.repos/alchemy-effect/\.github/workflows/claude.yml

Status: modified; +28; −3

```diff
@@ -10,6 +10,12 @@
   pull_request_review:
     types: [submitted]
 
+concurrency:
+  group: claude-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
+  # Separate @claude prompts may be independent requests; serialize them for
+  # the same issue or PR without discarding one that is already running.
+  cancel-in-progress: false
+
 jobs:
   claude:
     if: |
@@ -26,20 +32,39 @@
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
       - name: Configure AWS credentials
         id: aws
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-east-1
           output-credentials: true
 
       - name: Run Claude Code
+        uses: anthropics/claude-code-action@e63208cb983318a44e3f945e959ef894b707dcfa # v1.0.192
-        uses: anthropics/claude-code-action@v1
         env:
           AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
           AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
```

## \.repos/alchemy-effect/\.github/workflows/cloudflare-tools.yml

Status: added; +100; −0

```diff
@@ -1,0 +1,100 @@
+name: Cloudflare Tools
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "distilled"
+      - "fixtures/**"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/copy-package-files.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
+  pull_request:
+    types: [opened, reopened, synchronize]
+    paths:
+      - "distilled"
+      - "fixtures/**"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/copy-package-files.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloudflare-tools-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    # GitHub does not expose repository secrets to fork pull requests. Keep
+    # the secret-backed test matrix on trusted refs while still running it for
+    # pushes, manual dispatches, and pull requests from this repository.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - blacksmith-8vcpu-ubuntu-2404
+          - blacksmith-6vcpu-macos-latest
+          - blacksmith-8vcpu-windows-2025
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Typecheck
+        run: pnpm typecheck:cloudflare-packages
+
+      - name: Test
+        run: pnpm test:cloudflare-packages ${{ runner.os == 'Windows' && '--concurrency=3' || runner.os == 'macOS' && '--concurrency=2' || '' }}
+        env:
+          TEST_MYSQL_URL: ${{ secrets.TEST_MYSQL_URL }}
+          TEST_POSTGRES_URL: ${{ secrets.TEST_POSTGRES_URL }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          TEST_KV_NAMESPACE_ID: ${{ secrets.TEST_KV_NAMESPACE_ID }}
+          TEST_R2_BUCKET_NAME: ${{ secrets.TEST_R2_BUCKET_NAME }}
+          TEST_D1_DATABASE_ID: ${{ secrets.TEST_D1_DATABASE_ID }}
+          TEST_SERVICE_WORKER_NAME: ${{ secrets.TEST_SERVICE_WORKER_NAME }}
```

## \.repos/alchemy-effect/\.github/workflows/pr-package.yml

Status: modified; +107; −26

```diff
@@ -1,42 +1,123 @@
-name: pr-package
+name: PR Package
 
 on:
   push:
     branches: [main]
+    paths:
+      - "distilled"
+      - "packages/**"
+      - "scripts/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/pr-package.yml"
   pull_request:
     # `labeled` so adding the `force-ci` label re-triggers the run. We
     # intentionally do NOT listen to `closed` — pr-package tags persist
     # past PR close so existing install URLs keep resolving.
     types: [opened, synchronize, reopened, labeled]
+    paths:
+      - "distilled"
+      - "packages/**"
+      - "scripts/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/pr-package.yml"
 
-# Reusable workflows can't widen permissions — the caller must grant
-# `pull-requests: write` for the sticky install-instructions comment.
+# The action can't widen permissions, so the job must grant write access for
+# the sticky install-instructions comment.
 permissions:
   contents: read
   pull-requests: write
 
+concurrency:
+  group: pr-package-${{ github.ref }}
+  # A newer PR commit supersedes its preview packages. Never interrupt a main
+  # publish, where cancellation could leave only part of the package set live.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pr-package:
+    name: Publish PR preview packages
+    if: >-
+      github.event_name == 'push' ||
+      (github.event_name == 'pull_request' && github.event.action != 'closed' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      # The root install runs Turbo-backed prepare builds, so restore its
+      # cache before the setup action installs dependencies.
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Build packages
+        run: pnpm build:pr-packages
+
+      - name: Publish packages
+        id: publish
+        uses: alchemy-run/actions/actions/pr-package@098beeda4d3c2ce8850638c4466783893b8f0c23 # actions#11
+        with:
+          rebuild-all-paths: distilled
+          packages: >-
+            [
+              { "dir": "packages/alchemy",               "name": "alchemy",                            "group": "Alchemy" },
-    uses: alchemy-run/actions/.github/workflows/pr-package.yml@a18b368e044cb380a8c4904d5cfbccbc2798e768 # main
-    with:
-      # The bun workspace includes `distilled/packages/*` from the
-      # distilled submodule, so the publish jobs must check it out.
-      submodules: "true"
-      # A submodule-pointer bump doesn't fall under any package dir, but
-      # it changes what gets bundled — republish everything.
+              { "dir": "packages/better-auth",           "name": "@alchemy.run/better-auth",           "group": "Alchemy" },
-      rebuild-all-paths: |
-        distilled
-        cloudflare-tools
-      # `|| true` keeps the cp harmless in packages whose pkg dir is
-      # nested differently or that don't need the root README.
-      build-command: "cp ../../README.md . 2>/dev/null || true; bun run build"
-      # Every package's tsc build pulls in the alchemy -> distilled
-      # project-reference chain (distilled/aws is huge), so all three
-      # need the larger runner — same as distilled's own CI.
-      packages: |
-        [
-          { "dir": "packages/alchemy",     "name": "alchemy",                   "runner": "ubuntu-22-large" },
-          { "dir": "packages/better-auth", "name": "@alchemy.run/better-auth",  "runner": "ubuntu-22-large" },
-          { "dir": "packages/pr-package",  "name": "@alchemy.run/pr-package",   "runner": "ubuntu-22-large" }
-        ]
-    secrets: inherit
+              { "dir": "packages/cloudflare-runtime",    "name": "@alchemy.run/cloudflare-runtime",    "group": "Alchemy" },
+              { "dir": "packages/frontend-frameworks",   "name": "@alchemy.run/frontend-frameworks",   "group": "Alchemy" },
+              { "dir": "packages/node-utils",            "name": "@alchemy.run/node-utils",            "group": "Alchemy" },
+              { "dir": "packages/pr-package",            "name": "@alchemy.run/pr-package",            "group": "Alchemy" },
+              { "dir": "packages/floci",                 "name": "@alchemy.run/floci",                 "group": "Alchemy" },
+              { "dir": "distilled/packages/core",        "name": "@distilled.cloud/core",              "group": "Distilled", "submodule": true },
+              { "dir": "distilled/packages/aws",         "name": "@distilled.cloud/aws",               "group": "Distilled", "submodule": true },
+              { "dir": "distilled/packages/axiom",       "name": "@distilled.cloud/axiom",             "group": "Distilled", "submodule": true },
+              { "dir": "distilled/packages/cloudflare",  "name": "@distilled.cloud/cloudflare",        "group": "Distilled", "submodule": true },
+              { "dir": "distilled/packages/hetzner",     "name": "@distilled.cloud/hetzner",           "group": "Distilled", "submodule": true },
+              { "dir": "distilled/packages/neon",        "name": "@distilled.cloud/neon",              "group": "Distilled", "submodule": true },
+              { "dir": "distilled/packages/planetscale", "name": "@distilled.cloud/planetscale",       "group": "Distilled", "submodule": true }
+            ]
+          pr-package-token: ${{ secrets.PR_PACKAGE_TOKEN }}
+
+      - name: Generate bot token
+        if: >-
+          github.event_name == 'pull_request' &&
+          fromJson(steps.publish.outputs.plan).packages[0] != null
+        id: bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
+
+      - name: Comment on PR
+        if: >-
+          github.event_name == 'pull_request' &&
+          fromJson(steps.publish.outputs.plan).packages[0] != null
+        uses: alchemy-run/actions/actions/pr-package-comment@098beeda4d3c2ce8850638c4466783893b8f0c23 # actions#11
+        with:
+          plan: ${{ steps.publish.outputs.plan }}
+          token: ${{ steps.bot-token.outputs.token }}
```

## \.repos/alchemy-effect/\.github/workflows/release.yml

Status: modified; +150; −34

```diff
@@ -1,51 +1,167 @@
-name: release
+name: Release
 
 on:
   workflow_dispatch:
     inputs:
       version:
         description: >-
-          Release spec. Empty = next beta. `patch|minor|major` or `x.y.z`
-          for a stable release. `beta` / `beta.N` / `alpha` / `alpha.N`
-          for a prerelease. Anything else = tag release on
-          `0.0.0-<name>`.
+          Release spec. `beta` (the default) publishes the next
+          `2.0.0-beta.N`; `beta.N` publishes that exact candidate. `rc[.N]`
+          and `alpha[.N]` select those prerelease channels.
+          `patch|minor|major` or `x.y.z` publishes a stable release. Anything
+          else publishes `0.0.0-<name>`.
         required: false
         type: string
+        default: "beta"
+      force-latest:
+        description: Publish the release under the latest dist-tag
-        default: ""
+        required: false
+        type: boolean
+        default: true
 
 concurrency:
   group: release-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
-# Reusable workflows can't widen permissions — the caller must grant
-# `contents: write` (commit + tag) and `id-token: write` (npm OIDC).
 permissions:
   contents: write
   id-token: write
 
+env:
+  ALCHEMY_REPO: alchemy-run/alchemy
+
 jobs:
-  release:
-    uses: alchemy-run/actions/.github/workflows/release.yml@a18b368e044cb380a8c4904d5cfbccbc2798e768 # main
-    with:
-      # The bun workspace includes `distilled/packages/*` from the
-      # distilled submodule, so consumer checkouts must fetch it.
-      submodules: "true"
-      version: ${{ inputs.version }}
-      repo: alchemy-run/alchemy
-      current-version: "2.0.0"
-      # Each package builds in its own publish job: the tsc build pulls
-      # in the alchemy -> distilled project-reference chain (distilled/aws
-      # is huge), which doesn't fit the bump job's ubuntu-latest box.
-      build-mode: per-package
-      # The alchemy package ships the repo-root README.md; copy it in
-      # before the build so `bun pm pack` picks it up. Same trick the
-      # legacy `publish:npm` script used (`|| true` keeps it harmless
-      # elsewhere).
-      build-command: "cp ../../README.md . 2>/dev/null || true; bun run build"
-      packages: |
-        [
-          { "dir": "packages/alchemy",     "name": "alchemy",                   "runner": "ubuntu-22-large" },
+  build:
+    name: Build and pack
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    outputs:
+      sha: ${{ steps.commit.outputs.sha }}
+      tag: ${{ steps.release.outputs.tag }}
+      version: ${{ steps.release.outputs.version }}
+      channel: ${{ steps.release.outputs.channel }}
+    steps:
+      - name: Generate bot token
+        id: bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-          { "dir": "packages/better-auth", "name": "@alchemy.run/better-auth",  "runner": "ubuntu-22-large" },
+        with:
-          { "dir": "packages/pr-package",  "name": "@alchemy.run/pr-package",   "runner": "ubuntu-22-large" }
-        ]
-    secrets: inherit
+          fetch-depth: 0
+          token: ${{ steps.bot-token.outputs.token }}
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - id: release
+        name: Prepare release
+        env:
+          FORCE_LATEST: ${{ inputs.force-latest }}
+        run: |
+          set -euo pipefail
+          bun scripts/release/prepare.ts '${{ inputs.version }}' | tee -a "$GITHUB_OUTPUT"
+
+      - name: Build release packages
+        run: >-
+          pnpm turbo run build
+          $(jq -r '.[] | "--filter=\(.name)"' release-packages.json)
+
+      - name: Pack release artifacts
+        run: |
+          set -euo pipefail
+          mkdir release-packages
+          while IFS= read -r dir; do
+            pnpm --dir "$dir" pack --pack-destination "$GITHUB_WORKSPACE/release-packages"
+          done < <(jq -r '.[].dir' release-packages.json)
+
+      - id: commit
+        name: Commit and tag
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          CHANNEL: ${{ steps.release.outputs.channel }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: bash scripts/release/commit.sh
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-packages
+          path: release-packages/*.tgz
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    name: Publish
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.build.outputs.sha }}
+          fetch-depth: 0
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Setup pnpm, Node.js, Bun
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: false
+
+      # Release scripts import changelogithub, but publishing does not need
+      # package lifecycle scripts or the root Turbo-backed prepare build.
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Remove token-based npm authentication
+        run: sed -i '/always-auth/d' ~/.npmrc 2>/dev/null || true
+
+      - name: Download release artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-packages
+          path: release-packages
+
+      - name: Publish tarballs with OIDC
+        env:
+          PUBLISH_TAG: ${{ needs.build.outputs.tag }}
+          CHANNEL_TAG: ${{ needs.build.outputs.channel == 'release' && 'latest' || needs.build.outputs.channel == 'tag' && needs.build.outputs.tag || 'next' }}
+          FORCE_LATEST: ${{ inputs.force-latest }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: bash scripts/release/publish.sh
+
+      - name: Create GitHub release
+        if: needs.build.outputs.channel != 'tag'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.build.outputs.version }}
+          CHANNEL: ${{ needs.build.outputs.channel }}
+        run: bun scripts/release/github-release.ts "v${VERSION}" "$CHANNEL"
+
+      - name: Notify Discord
+        if: needs.build.outputs.channel != 'tag'
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          VERSION: ${{ needs.build.outputs.version }}
+          CHANNEL: ${{ needs.build.outputs.channel }}
+        run: bun scripts/release/discord-notify.ts "v${VERSION}" "$CHANNEL"
```

## \.repos/alchemy-effect/\.github/workflows/website.yml

Status: modified; +91; −37

```diff
@@ -1,15 +1,24 @@
-name: website
+name: Website
 
 on:
+  # Manual override — deploys unconditionally on whatever branch it's run
+  # from (use this to force a prod deploy from main without a release).
   workflow_dispatch:
+  # Release commits update package manifests, so packages/** keeps production
+  # deploys automatic without redeploying the site for unrelated main commits.
   push:
     branches:
       - main
     paths:
       - "website/**"
-      - "packages/alchemy/**"
-      - "bun.lock"
-      - ".github/workflows/deploy.yml"
+      - "packages/**"
+      - "scripts/generate-api-reference.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.json"
+      - ".github/workflows/website.yml"
   pull_request:
     # `labeled` so adding `deploy-website` on an open PR triggers a
     # deploy without needing another push.
@@ -21,9 +30,14 @@
       - closed
     paths:
       - "website/**"
-      - "packages/alchemy/**"
-      - "bun.lock"
-      - ".github/workflows/deploy.yml"
+      - "packages/**"
+      - "scripts/generate-api-reference.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.json"
+      - ".github/workflows/website.yml"
 
 concurrency:
   group: deploy-website-${{ github.ref }}
@@ -31,13 +45,16 @@
 
 env:
   STAGE: ${{ github.event_name == 'pull_request' && format('pr-{0}',
-    github.event.number) || (github.ref == 'refs/heads/main' && 'prod' ||
-    github.ref_name) }}
+    github.event.number) || (github.event_name == 'workflow_dispatch' ||
+    startsWith(github.event.head_commit.message, 'chore(release):')) && 'prod' ||
+    (github.ref == 'refs/heads/main' && 'main' || github.ref_name) }}
 
 jobs:
   deploy:
-    # Deploy on push-to-main and `workflow_dispatch` always. On PRs,
-    # require BOTH:
+    name: Deploy
+    # Deploy every push to main. Release commits (`chore(release): x.y.z`)
+    # and manual dispatches deploy production; other main commits deploy to
+    # main.alchemy.run. On PRs, require BOTH:
     #   - the PR is internal (forks can't access bot/Cloudflare secrets
     #     so `create-github-app-token` would error immediately), AND
     #   - the PR carries the `deploy-website` label (opt-in — most PRs
@@ -47,16 +64,17 @@
       (github.event_name != 'pull_request' ||
        (github.event.pull_request.head.repo.full_name == github.repository &&
         contains(github.event.pull_request.labels.*.name, 'deploy-website')))
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # `bun install` needs the distilled submodule (workspace member)
-          submodules: true
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
       # Mint a token for the alchemy-version-bot GitHub App so the PR
       # preview comment (created via GitHub.Comment in alchemy.run.ts)
       # posts under the bot's identity instead of `github-actions[bot]`.
@@ -66,30 +84,60 @@
         id: bot-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          client-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
           private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - name: Restore Astro build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: website/node_modules/.astro
+          key: website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-
+            website-astro-${{ runner.os }}-main-
 
-      - name: Install dependencies
-        run: bun install
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
 
-      # Secrets (Cloudflare credentials, etc.) are injected by
-      # `doppler run` from the `alchemy-v2` project — `prod` config on
-      # main, `dev` config everywhere else.
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      # Main/prod use the production account; PR stages use the test account.
       - name: Deploy
         working-directory: website
         run: bun alchemy deploy --stage "$STAGE" --yes
         env:
           PULL_REQUEST: ${{ github.event.number }}
-          CLOUDFLARE_API_TOKEN: ${{ startsWith(env.STAGE, 'prod') && secrets.PROD_CLOUDFLARE_API_TOKEN || secrets.TEST_CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ startsWith(env.STAGE, 'prod') && secrets.PROD_CLOUDFLARE_ACCOUNT_ID || secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ (env.STAGE == 'main' || env.STAGE == 'prod') && secrets.PROD_CLOUDFLARE_API_TOKEN || secrets.TEST_CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ (env.STAGE == 'main' || env.STAGE == 'prod') && secrets.PROD_CLOUDFLARE_ACCOUNT_ID || secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
           BUILD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           GITHUB_TOKEN: ${{ steps.bot-token.outputs.token }}
 
+      # PR builds upload zero-traffic versions of this Worker. Refresh the
+      # parent from merged main using the same test account as PR previews.
+      - name: Deploy preview parent
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        working-directory: website
+        run: bun alchemy deploy --stage preview-base --yes
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.TEST_CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
+          BUILD_SHA: ${{ github.sha }}
+
   cleanup:
-    runs-on: ubuntu-latest
+    name: Cleanup
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     if: >-
       github.event_name == 'pull_request' && github.event.action == 'closed' &&
       github.event.pull_request.head.repo.full_name == github.repository
@@ -97,27 +145,33 @@
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # `bun install` needs the distilled submodule (workspace member)
-          submodules: true
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
       - name: Generate bot token
         id: bot-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          client-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
           private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - name: Setup pnpm, Node.js, Bun
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: false
 
+      - name: Install dependencies
+        # Destroy evaluates the stack and calls providers; it does not build or
+        # bundle anything. Skip native postinstalls and the root prepare build.
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
       - name: Install Doppler CLI
         uses: dopplerhq/cli-action@4819d808ab99e5cde19a0637a16536a4038fad73 # v4
 
-      - name: Install dependencies
-        run: bun install
-
       - name: Safety Check
         run: |-
           if [ "${{ env.STAGE }}" = "prod" ]; then
```

## \.repos/alchemy-effect/\.gitignore

Status: modified; +30; −4

```diff
@@ -14,6 +14,7 @@
 
 .repomix-output.txt
 wrangler.jsonc
+!packages/cloudflare-*/src/**/wrangler.jsonc
 
 # Husky - ignore generated files but keep hooks
 .husky/_
@@ -22,9 +23,6 @@
 .smoke
 .smoke.logs
 smoke
-# Generated by test/smoke.test.ts to make pnpm 11's deps-status check
-# resolve the bun catalog. Cleaned up at end of suite.
-pnpm-workspace.yaml
 .svelte-kit
 .astro
 .wrangler
@@ -32,21 +30,49 @@
 *.tgz
 *.js
 *.d.ts
+!examples/prisma-tanstack-start/migrations/**/start-contract.d.ts
+!examples/prisma-tanstack-start/migrations/**/end-contract.d.ts
+# drizzle-kit's generated durable-sqlite migrations bundle (checked-in test fixture)
+!packages/alchemy/test/Cloudflare/Workers/fixtures/drizzle-do/drizzle/migrations.js
+# Container image contexts COPY these into the image; without the negation
+# a fresh checkout has an empty build context and the container never boots.
+!packages/alchemy/test/Cloudflare/Container/fixtures/**/*.js
 *.map
 
+packages/cloudflare-runtime/src/rolldown/.env.test
+packages/cloudflare-runtime/src/rolldown/out/
+!packages/cloudflare-runtime/src/rolldown/test/fixtures/**/node_modules/
+!packages/cloudflare-runtime/src/rolldown/test/fixtures/**/node_modules/**
+!packages/cloudflare-runtime/src/rolldown/test/fixtures/**/*.js
+!packages/cloudflare-frameworks/src/nextjs/wrangler-stub/*.js
+!packages/cloudflare-*/src/**/*.d.ts
+!fixtures/**/*.d.ts
+!fixtures/**/*.js
+
 .attest
 .cache
+.turbo
+coverage
+test-results
 .external
 .bundle-benchmark
 packages/alchemy/docs
 .sonda
 examples/cloudflare-worker/src/scratch.ts
 
+# Package copies generated by scripts/copy-package-files.ts after builds.
+/packages/*/LICENSE
+/packages/*/NOTICE
+/packages/*/THIRD_PARTY_LICENSES.md
+/packages/alchemy/README.md
+
 !/packages/alchemy/bin/cli.js
 .vendor/*
 .tmp
-pnpm-lock.yaml
+# the lockfile-pinning test fixture is a checked-in lockfile, not a generated one
+!packages/alchemy/test/AWS/Lambda/fixtures/lockfile-pinning/pnpm/pnpm-lock.yaml
 !.vendor/distilled
+!.vendor/floci
 
 .ai-workspace/
 /processes/
```

## \.repos/alchemy-effect/\.gitmodules

Status: modified; +66; −7

```diff
@@ -1,13 +1,72 @@
+	# reference-only checkout of the repos — skipped by
+	# `git submodule update --init` (CI included). Fetch explicitly with
+	# `git submodule update --init --checkout -- .vendor/<repo>`.
 [submodule "vendor/alchemy"]
 	path = .vendor/alchemy
+	url = https://github.com/alchemy-run/alchemy-async.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/workers-sdk"]
+	path = .vendor/workers-sdk
+	url = https://github.com/cloudflare/workers-sdk.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/next.js"]
+	path = .vendor/next.js
+	url = https://github.com/vercel/next.js.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/opennextjs-cloudflare"]
+	path = .vendor/opennextjs-cloudflare
+	url = https://github.com/opennextjs/opennextjs-cloudflare.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/astro"]
+	path = .vendor/astro
+	url = https://github.com/withastro/astro.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/sveltekit"]
+	path = .vendor/sveltekit
+	url = https://github.com/sveltejs/kit.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/waku"]
+	path = .vendor/waku
+	url = https://github.com/wakujs/waku.git
-	url = https://github.com/alchemy-run/alchemy.git
+	shallow = true
-	# ~900MB reference-only checkout of the v1 repo — skipped by
-	# `git submodule update --init` (CI included). Fetch explicitly with
-	# `git submodule update --init --checkout .vendor/alchemy`.
 	update = none
+	ignore = all
+[submodule "vendor/nuxt"]
+	path = .vendor/nuxt
+	url = https://github.com/nuxt/nuxt.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/nitro"]
+	path = .vendor/nitro
+	url = https://github.com/nitrojs/nitro.git
+	shallow = true
+	update = none
+	ignore = all
+[submodule "vendor/nitro-cloudflare-dev"]
+	path = .vendor/nitro-cloudflare-dev
+	url = https://github.com/nitrojs/nitro-cloudflare-dev.git
+	shallow = true
+	update = none
+	ignore = all
 [submodule "distilled"]
 	path = distilled
 	url = https://github.com/alchemy-run/distilled.git
+[submodule "vendor/floci"]
+	path = .vendor/floci
+	url = https://github.com/alchemy-run/floci.git
+	shallow = true
+	update = none
-[submodule "cloudflare-tools"]
-	path = cloudflare-tools
-	url = https://github.com/alchemy-run/cloudflare-tools.git
+	ignore = all
```

## \.repos/alchemy-effect/\.husky/post-checkout

Status: added; +13; −0

```diff
@@ -1,0 +1,13 @@
+#!/usr/bin/env sh
+set -eu
+
+git_dir="$(git rev-parse --path-format=absolute --git-dir)"
+common_dir="$(git rev-parse --path-format=absolute --git-common-dir)"
+
+# `post-checkout` also runs for ordinary checkouts and clones. Distilled only
+# needs bootstrapping when Git has just created (or switched) a linked worktree.
+[ "$git_dir" != "$common_dir" ] || exit 0
+
+bun scripts/bootstrap-distilled-worktree.ts >/dev/null 2>&1 || true
+
+exit 0
```

## \.repos/alchemy-effect/\.node-version

Status: added; +1; −0

```diff
@@ -1,0 +1,1 @@
+24
```

## \.repos/alchemy-effect/\.oxfmtrc.json

Status: modified; +6; −0

```diff
@@ -16,7 +16,13 @@
     "**/mdx/**",
     "**/*.mdx",
     "**/*.md",
+    "**/__snapshots__/**",
+    "**/.svelte-kit/**",
+    "**/routeTree.gen.ts",
+    "**/test-results/**",
     "**/.vendor/**",
+    "examples/prisma-tanstack-start/src/prisma/contract.d.ts",
+    "examples/prisma-tanstack-start/src/prisma/contract.json",
     "**/package.json",
     "./distilled",
     "**/fixtures/chart/templates/**"
```

## \.repos/alchemy-effect/\.vendor/astro

Status: added; +0; −0

No text hunks available.

## \.repos/alchemy-effect/\.vendor/floci

Status: added; +0; −0

No text hunks available.

## \.repos/alchemy-effect/\.vendor/next.js

Status: added; +0; −0

No text hunks available.

## \.repos/alchemy-effect/\.vendor/nitro

Status: added; +0; −0

No text hunks available.

## \.repos/alchemy-effect/\.vendor/nitro-cloudflare-dev

Status: added; +0; −0

No text hunks available.

## \.repos/alchemy-effect/\.vendor/nuxt

Status: added; +0; −0

No text hunks available.

[Next page](https://git.cafe/pingdotgg/t3code/pull/10654/diffs?after=Ii5yZXBvcy9hbGNoZW15LWVmZmVjdC8udmVuZG9yL251eHQi&expectedVersion=1&format=markdown)