chore(provider-runtime): resync upstream and verify embedded adapters

.coderabbit.config.ts

@@ -0,0 +1,45 @@
+import { defineConfig, type CodeRabbitContext } from "@coderabbitai/config";
+
+// Org members and collaborators merge their own pull requests. On anyone else's, CodeRabbit
+// requests changes until its comments are resolved, then approves.
+const UNGATED_AUTHORS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+const isGated = ({ pr }: CodeRabbitContext) => !UNGATED_AUTHORS.has(pr?.authorAssociation ?? "");
+
+export default defineConfig((ctx) => ({
+  reviews: {
+    high_level_summary: false,
+    review_status: false,
+    request_changes_workflow: isGated(ctx),
+    allow_author_approval: !isGated(ctx),
+    auto_review: {
+      enabled: true,
+    },
+    pre_merge_checks: {
+      docstrings: { mode: "off" },
+      override_requested_reviewers_only: isGated(ctx),
+    },
+    path_filters: [
+      // Vendored read-only reference checkouts of upstream Effect and Alchemy
+      // (see scripts/lib/reference-repos.ts). Nothing imports from them.
+      "!.repos/**",
+    ],
+    path_instructions: [
+      {
+        path: "{apps,packages,infra}/**/*.ts",
+        instructions: "Hold changed code to the rules in docs/internals/effect-services.md.",
+      },
+      {
+        path: "apps/web/src/**/*.{tsx,css}",
+        instructions: "Hold changed code to the rules in docs/internals/web-ui.md.",
+      },
+    ],
+  },
+  knowledge_base: {
+    code_guidelines: {
+      filePatterns: [
+        { files: "docs/internals/effect-services.md", applyTo: "{apps,packages,infra}/**/*.ts" },
+        { files: "docs/internals/web-ui.md", applyTo: "apps/web/src/**/*.{tsx,css}" },
+      ],
+    },
+  },
+}));

.cursor/rules/cursor-cloud.mdc

@@ -69,4 +69,4 @@ Gradle auto-downloads any additional pinned SDK packages on demand.
 ## Known flaky tests (unrelated to setup)
 
 - `apps/server/src/git/GitManager.test.ts` (cross-repo PR metadata, can time out at 12s).
-- `apps/server/src/provider/Layers/ProviderRegistry.test.ts` (codex binaryPath re-probe ordering).
+- `apps/server/src/provider/ProviderRegistry.test.ts` (codex binaryPath re-probe ordering).

.github/VOUCHED.td

@@ -25,6 +25,7 @@ github:cursoragent
 github:D3OXY
 github:dbalders
 github:eggfriedrice24
+github:esthor
 github:extoci
 github:f-trycua
 github:flamboh

.github/workflows/provider-runtime.yml

@@ -0,0 +1,27 @@
+name: Embedded provider runtime
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: provider-runtime-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v6
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+      - run: vp run --filter @t3tools/contracts --filter @t3tools/provider-runtime build
+      - run: vp run --filter @t3tools/provider-runtime typecheck
+      - run: vp test run packages/provider-runtime/src apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.lazy.test.ts apps/server/src/provider/ProviderRegistry.test.ts apps/server/src/provider/codexUsageLimits.test.ts apps/server/src/provider/claudeUsageLimits.test.ts scripts/lib/cli-external-packages.test.ts --maxWorkers=2

.github/workflows/sync-upstream.yml

@@ -83,7 +83,7 @@ jobs:
         run: |
           vp run --filter @t3tools/contracts --filter @t3tools/provider-runtime build
           vp run --filter @t3tools/provider-runtime typecheck
-          vp test run packages/provider-runtime/src apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.lazy.test.ts apps/server/src/provider/Layers/ProviderRegistry.test.ts apps/server/src/provider/Layers/codexUsageLimits.test.ts apps/server/src/provider/Layers/claudeUsageLimits.test.ts scripts/lib/cli-external-packages.test.ts --maxWorkers=2
+          vp test run packages/provider-runtime/src apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.lazy.test.ts apps/server/src/provider/ProviderRegistry.test.ts apps/server/src/provider/codexUsageLimits.test.ts apps/server/src/provider/claudeUsageLimits.test.ts scripts/lib/cli-external-packages.test.ts --maxWorkers=2
 
       - name: Advance verified fork
         if: steps.sync.outputs.changed == 'true'

.repos/alchemy-effect/.github/workflows/check.yml

@@ -90,6 +90,14 @@ jobs:
       - name: Run Typecheck
         run: pnpm tsc -b
 
+      # Must run after `tsc -b`: it reads distilled's emitted `lib/*.d.ts`,
+      # and stale/missing declarations resolve to `any`.
+      - name: Lint providers
+        run: pnpm lint:providers
+
+      - name: Test CLI launcher
+        run: timeout 240 pnpm test test/Cli/launcher.test.ts test/Cli/exitCodes.test.ts --retry 0 --concurrency 1
+
       - name: Check API JSDocs
         run: pnpm docs:check-jsdoc
 

.repos/alchemy-effect/.github/workflows/pkg.yml

@@ -22,6 +22,7 @@ on:
       - "tsconfig.json"
       - ".github/workflows/pkg.yml"
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
     paths:
       - "submodules/distilled"
       - "packages/**"
@@ -54,6 +55,7 @@ jobs:
           # Pack the pull request head rather than the synthetic merge commit,
           # so every tarball is addressed by a commit that exists on the PR.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
 
       - name: Checkout distilled
         run: git submodule update --init --depth=1 --checkout -- submodules/distilled
@@ -69,19 +71,29 @@ jobs:
           install: true
           require-lockfile: true
 
+      # Cold-building the alchemy package peaks near 17 GB of heap, which
+      # starves the runner agent on a 32 GB machine and drops the job. A soft
+      # limit holds the peak near 11 GB for roughly twice the compile time.
       - name: Build packages
+        env:
+          GOMEMLIMIT: 6GiB
+          GOGC: "40"
         run: pnpm build:pkg
 
-      # Keep the directory lists in sync with the `build:pkg` script.
+      # The @distilled.cloud list is alchemy's dependency set, which `build:pkg`
+      # derives with `--filter=alchemy...`; keep the @alchemy.run list in sync.
       - name: Pack packages
         id: pack
         run: >-
           pnpm exec pkg pack
+          ${{ contains(github.event.pull_request.labels.*.name, 'force-ci') && '--all' || '' }}
+          --rebuild-all-path 'scripts/copy-package-files.ts'
           --group 'alchemy=./packages/alchemy'
           --group '@alchemy.run[Collapsed]=./packages/{better-auth,cloudflare-runtime,frontend-frameworks,node-utils,floci,pkg}'
-          --group '@distilled.cloud[Collapsed]=./submodules/distilled/packages/{core,aws,axiom,cloudflare,fly-io,github,hetzner,neon,planetscale,railway,stripe}'
+          --group '@distilled.cloud[Collapsed]=./submodules/distilled/packages/{core,acme,aws,axiom,cloudflare,doppler,fly-io,github,hetzner,infisical,neon,prisma,planetscale,railway,stripe,zerossl}'
 
       - name: Vouch for the manifest
+        if: steps.pack.outputs.package-count != '0'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ steps.pack.outputs.artifact-name }}
@@ -91,4 +103,5 @@ jobs:
           retention-days: 1
 
       - name: Publish packages
+        if: steps.pack.outputs.package-count != '0'
         run: pnpm exec pkg publish

.repos/alchemy-effect/.github/workflows/release.yml

@@ -81,6 +81,11 @@ jobs:
           bun scripts/release/prepare.ts '${{ inputs.version }}' | tee -a "$GITHUB_OUTPUT"
 
       - name: Build release packages
+        # Match preview CI: the cold tsgo build can starve the runner
+        # without Go heap limits on this 32 GB machine.
+        env:
+          GOMEMLIMIT: 6GiB
+          GOGC: "40"
         run: >-
           pnpm turbo run build
           $(jq -r '.[] | "--filter=\(.name)"' release-packages.json)

.repos/alchemy-effect/.gitignore

@@ -32,6 +32,11 @@ smoke
 *.d.ts
 !examples/prisma-tanstack-start/migrations/**/start-contract.d.ts
 !examples/prisma-tanstack-start/migrations/**/end-contract.d.ts
+# Emitted Prisma ORM v8 contract types: imported by the fixtures/example that
+# consume them, so a clean checkout must typecheck without running a deploy.
+!examples/cloudflare-neon-prisma/src/prisma/generated/contract.d.ts
+!packages/alchemy/test/Cloudflare/Workers/fixtures/prisma-orm/generated/contract.d.ts
+!packages/alchemy/test/Prisma/ORM/fixtures/client/generated/contract.d.ts
 # drizzle-kit's generated durable-sqlite migrations bundle (checked-in test fixture)
 !packages/alchemy/test/Cloudflare/Workers/fixtures/drizzle-do/drizzle/migrations.js
 # Container image contexts COPY these into the image; without the negation
@@ -67,6 +72,8 @@ examples/cloudflare-worker/src/scratch.ts
 /packages/alchemy/README.md
 
 !/packages/alchemy/bin/cli.js
+!/packages/alchemy/bin/alchemy.js
+!/packages/alchemy/bin/exec.js
 !/packages/alchemy/bin/register-dev-mode.js
 !/packages/alchemy/bin/register-oxc.js
 .tmp

.repos/alchemy-effect/AGENTS.md

@@ -857,8 +857,8 @@ Resolve the bindings, expose one route per behavior, default-export the class so
 // fixtures/worker.ts
 import * as Cloudflare from "@/Cloudflare/index.ts";
 import * as Effect from "effect/Effect";
-import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
-import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { HttpServerRequest } from "effect/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/http/HttpServerResponse";
 import { Gateway } from "./gateway.ts";
 
 export default class TestWorker extends Cloudflare.Worker<TestWorker>()(
@@ -895,7 +895,7 @@ import * as Test from "@/Test/Alchemy";
 import { expect } from "alchemy-test";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
-import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClient from "effect/http/HttpClient";
 import TestWorker from "./fixtures/worker.ts";
 
 const { test, beforeAll, afterAll, deploy, destroy } = Test.make({