chore(sync): merge upstream main and fix orchestration lifecycle races

.coderabbit.config.ts

@@ -0,0 +1,45 @@
+import { defineConfig, type CodeRabbitContext } from "@coderabbitai/config";
+
+// Org members and collaborators merge their own pull requests. On anyone else's, CodeRabbit
+// requests changes until its comments are resolved, then approves.
+const UNGATED_AUTHORS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+const isGated = ({ pr }: CodeRabbitContext) => !UNGATED_AUTHORS.has(pr?.authorAssociation ?? "");
+
+export default defineConfig((ctx) => ({
+  reviews: {
+    high_level_summary: false,
+    review_status: false,
+    request_changes_workflow: isGated(ctx),
+    allow_author_approval: !isGated(ctx),
+    auto_review: {
+      enabled: true,
+    },
+    pre_merge_checks: {
+      docstrings: { mode: "off" },
+      override_requested_reviewers_only: isGated(ctx),
+    },
+    path_filters: [
+      // Vendored read-only reference checkouts of upstream Effect and Alchemy
+      // (see scripts/lib/reference-repos.ts). Nothing imports from them.
+      "!.repos/**",
+    ],
+    path_instructions: [
+      {
+        path: "{apps,packages,infra}/**/*.ts",
+        instructions: "Hold changed code to the rules in docs/internals/effect-services.md.",
+      },
+      {
+        path: "apps/web/src/**/*.{tsx,css}",
+        instructions: "Hold changed code to the rules in docs/internals/web-ui.md.",
+      },
+    ],
+  },
+  knowledge_base: {
+    code_guidelines: {
+      filePatterns: [
+        { files: "docs/internals/effect-services.md", applyTo: "{apps,packages,infra}/**/*.ts" },
+        { files: "docs/internals/web-ui.md", applyTo: "apps/web/src/**/*.{tsx,css}" },
+      ],
+    },
+  },
+}));

.cursor/rules/cursor-cloud.mdc

@@ -69,4 +69,4 @@ Gradle auto-downloads any additional pinned SDK packages on demand.
 ## Known flaky tests (unrelated to setup)
 
 - `apps/server/src/git/GitManager.test.ts` (cross-repo PR metadata, can time out at 12s).
-- `apps/server/src/provider/Layers/ProviderRegistry.test.ts` (codex binaryPath re-probe ordering).
+- `apps/server/src/provider/ProviderRegistry.test.ts` (codex binaryPath re-probe ordering).

.github/VOUCHED.td

@@ -25,6 +25,7 @@ github:cursoragent
 github:D3OXY
 github:dbalders
 github:eggfriedrice24
+github:esthor
 github:extoci
 github:f-trycua
 github:flamboh

.github/workflows/ci.yml

@@ -255,6 +255,9 @@ jobs:
       # No Electron setup here: `t3` (apps/server) has no Electron dependency
       # and none of its tests touch the runtime. Only the non-server `test`
       # job, which covers @t3tools/desktop, needs the download.
+      - name: Install Chromium for server browser integration tests
+        run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium
+
       - name: Test
         env:
           T3CODE_TRANSFER_BUDGET_REPORT_PATH: ${{ runner.temp }}/t3code-transfer-budget.md
@@ -296,7 +299,11 @@ jobs:
   transfer-report:
     name: Transfer report artifact
     needs: test_server
-    runs-on: ubuntu-24.04
+    # On Blacksmith like every other job here: the GitHub-hosted queue is shared
+    # with the PR bots and can leave this job waiting until it is abandoned,
+    # which fails `Check` on an otherwise green run.
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
     steps:
       - name: Require transfer measurements
         uses: actions/download-artifact@v8

.github/workflows/deploy-relay.yml

@@ -4,15 +4,15 @@ on:
   push:
     branches:
       - main
-  # Alchemy does not redeploy the Worker when only a Config value read in its
-  # Init changes (alchemy-run/alchemy#1831), so a changed repository variable
-  # needs a forced deploy to reach production.
+  # Redeploys main after a variable or secret change. Alchemy redeploys the
+  # Worker when a value it reads changes, so force is rarely needed, and it
+  # replaces the Postgres runtime role (alchemy-run/alchemy#1832).
   workflow_dispatch:
     inputs:
       force:
-        description: Redeploy every resource, including ones with no detected changes
+        description: Redeploy every resource, including ones with no detected changes. Replaces the Postgres runtime role.
         type: boolean
-        default: true
+        default: false
 
 permissions:
   contents: read
@@ -40,6 +40,7 @@ jobs:
       RELAY_API_ZONE_NAME: ${{ vars.RELAY_API_ZONE_NAME }}
       RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }}
       RELAY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_TUNNEL_CLEANUP_MODE }}
+      RELAY_LEGACY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_LEGACY_TUNNEL_CLEANUP_MODE }}
       CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }}
       CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }}
       APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }}

.github/workflows/release.yml

@@ -330,6 +330,9 @@ jobs:
       # No Electron setup here: `t3` (apps/server) has no Electron dependency
       # and none of its tests touch the runtime. Only the non-server `test`
       # job, which covers @t3tools/desktop, needs the download.
+      - name: Install Chromium for server browser integration tests
+        run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium
+
       - name: Test
         run: vp run --filter t3 test --shard ${{ matrix.shard }}/${{ strategy.job-total }}
 

.repos/alchemy-effect/.github/workflows/check.yml

@@ -90,6 +90,14 @@ jobs:
       - name: Run Typecheck
         run: pnpm tsc -b
 
+      # Must run after `tsc -b`: it reads distilled's emitted `lib/*.d.ts`,
+      # and stale/missing declarations resolve to `any`.
+      - name: Lint providers
+        run: pnpm lint:providers
+
+      - name: Test CLI launcher
+        run: timeout 240 pnpm test test/Cli/launcher.test.ts test/Cli/exitCodes.test.ts --retry 0 --concurrency 1
+
       - name: Check API JSDocs
         run: pnpm docs:check-jsdoc
 

.repos/alchemy-effect/.github/workflows/pkg.yml

@@ -22,6 +22,7 @@ on:
       - "tsconfig.json"
       - ".github/workflows/pkg.yml"
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
     paths:
       - "submodules/distilled"
       - "packages/**"
@@ -54,6 +55,7 @@ jobs:
           # Pack the pull request head rather than the synthetic merge commit,
           # so every tarball is addressed by a commit that exists on the PR.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
 
       - name: Checkout distilled
         run: git submodule update --init --depth=1 --checkout -- submodules/distilled
@@ -69,19 +71,29 @@ jobs:
           install: true
           require-lockfile: true
 
+      # Cold-building the alchemy package peaks near 17 GB of heap, which
+      # starves the runner agent on a 32 GB machine and drops the job. A soft
+      # limit holds the peak near 11 GB for roughly twice the compile time.
       - name: Build packages
+        env:
+          GOMEMLIMIT: 6GiB
+          GOGC: "40"
         run: pnpm build:pkg
 
-      # Keep the directory lists in sync with the `build:pkg` script.
+      # The @distilled.cloud list is alchemy's dependency set, which `build:pkg`
+      # derives with `--filter=alchemy...`; keep the @alchemy.run list in sync.
       - name: Pack packages
         id: pack
         run: >-
           pnpm exec pkg pack
+          ${{ contains(github.event.pull_request.labels.*.name, 'force-ci') && '--all' || '' }}
+          --rebuild-all-path 'scripts/copy-package-files.ts'
           --group 'alchemy=./packages/alchemy'
           --group '@alchemy.run[Collapsed]=./packages/{better-auth,cloudflare-runtime,frontend-frameworks,node-utils,floci,pkg}'
-          --group '@distilled.cloud[Collapsed]=./submodules/distilled/packages/{core,aws,axiom,cloudflare,fly-io,github,hetzner,neon,planetscale,railway,stripe}'
+          --group '@distilled.cloud[Collapsed]=./submodules/distilled/packages/{core,acme,aws,axiom,cloudflare,doppler,fly-io,github,hetzner,infisical,neon,prisma,planetscale,railway,stripe,zerossl}'
 
       - name: Vouch for the manifest
+        if: steps.pack.outputs.package-count != '0'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ steps.pack.outputs.artifact-name }}
@@ -91,4 +103,5 @@ jobs:
           retention-days: 1
 
       - name: Publish packages
+        if: steps.pack.outputs.package-count != '0'
         run: pnpm exec pkg publish

.repos/alchemy-effect/.github/workflows/release.yml

@@ -81,6 +81,11 @@ jobs:
           bun scripts/release/prepare.ts '${{ inputs.version }}' | tee -a "$GITHUB_OUTPUT"
 
       - name: Build release packages
+        # Match preview CI: the cold tsgo build can starve the runner
+        # without Go heap limits on this 32 GB machine.
+        env:
+          GOMEMLIMIT: 6GiB
+          GOGC: "40"
         run: >-
           pnpm turbo run build
           $(jq -r '.[] | "--filter=\(.name)"' release-packages.json)

.repos/alchemy-effect/.gitignore

@@ -32,6 +32,11 @@ smoke
 *.d.ts
 !examples/prisma-tanstack-start/migrations/**/start-contract.d.ts
 !examples/prisma-tanstack-start/migrations/**/end-contract.d.ts
+# Emitted Prisma ORM v8 contract types: imported by the fixtures/example that
+# consume them, so a clean checkout must typecheck without running a deploy.
+!examples/cloudflare-neon-prisma/src/prisma/generated/contract.d.ts
+!packages/alchemy/test/Cloudflare/Workers/fixtures/prisma-orm/generated/contract.d.ts
+!packages/alchemy/test/Prisma/ORM/fixtures/client/generated/contract.d.ts
 # drizzle-kit's generated durable-sqlite migrations bundle (checked-in test fixture)
 !packages/alchemy/test/Cloudflare/Workers/fixtures/drizzle-do/drizzle/migrations.js
 # Container image contexts COPY these into the image; without the negation
@@ -67,6 +72,8 @@ examples/cloudflare-worker/src/scratch.ts
 /packages/alchemy/README.md
 
 !/packages/alchemy/bin/cli.js
+!/packages/alchemy/bin/alchemy.js
+!/packages/alchemy/bin/exec.js
 !/packages/alchemy/bin/register-dev-mode.js
 !/packages/alchemy/bin/register-oxc.js
 .tmp

.repos/alchemy-effect/AGENTS.md

@@ -857,8 +857,8 @@ Resolve the bindings, expose one route per behavior, default-export the class so
 // fixtures/worker.ts
 import * as Cloudflare from "@/Cloudflare/index.ts";
 import * as Effect from "effect/Effect";
-import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
-import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { HttpServerRequest } from "effect/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/http/HttpServerResponse";
 import { Gateway } from "./gateway.ts";
 
 export default class TestWorker extends Cloudflare.Worker<TestWorker>()(
@@ -895,7 +895,7 @@ import * as Test from "@/Test/Alchemy";
 import { expect } from "alchemy-test";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
-import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClient from "effect/http/HttpClient";
 import TestWorker from "./fixtures/worker.ts";
 
 const { test, beforeAll, afterAll, deploy, destroy } = Test.make({