chore(sync): absorb upstream main through 611132c17

.coderabbit.config.ts

@@ -0,0 +1,66 @@
+import { defineConfig, type CodeRabbitContext } from "@coderabbitai/config";
+
+const approvability = `Fail when a maintainer should read this pull request before CodeRabbit approves it, and name the rule and file. Fail if it:
+
+- Changes a product default: a setting's default value, or what users get without opting in. Making a feature do what it already promises is a bug fix, not a default change.
+- Adds or broadens a directive that disables or suppresses a lint, type-checker, LSP, or other static-analysis diagnostic, including file-level, line-level, and configuration-level overrides.
+- Adds a subsystem or user workflow, or is a large refactor across apps or packages.
+- Changes packages/contracts or persisted data in a way that existing clients or stored data might not accept.
+- Changes authentication, pairing, credentials, secrets, or remote connection trust.
+- Adds or changes an external side effect, such as acting on GitHub, publishing a release, or calling a webhook.
+- Adds, upgrades, or patches a dependency.
+- Changes CI or release configuration, agent or contributor instructions, or any review tool's configuration, including .github/, AGENTS.md, CONTRIBUTING.md, .agents/, and .coderabbit.config.ts.
+
+Otherwise pass. A focused bug fix, copy or layout fix, revert, or docs-only or test-only change passes unless a rule above applies. If you cannot decide, fail rather than report inconclusive. When failing, say that the pull request needs a maintainer's review.
+`;
+
+// Org members and collaborators merge their own pull requests. On anyone else's, CodeRabbit
+// requests changes until its comments are resolved and its checks pass, then approves.
+const UNGATED_AUTHORS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+const isGated = ({ pr }: CodeRabbitContext) => !UNGATED_AUTHORS.has(pr?.authorAssociation ?? "");
+
+export default defineConfig((ctx) => ({
+  reviews: {
+    high_level_summary: false,
+    review_status: false,
+    request_changes_workflow: isGated(ctx),
+    allow_author_approval: !isGated(ctx),
+    auto_review: {
+      enabled: true,
+    },
+    pre_merge_checks: {
+      docstrings: { mode: "off" },
+      override_requested_reviewers_only: isGated(ctx),
+      custom_checks: [
+        {
+          name: "Approvability",
+          mode: isGated(ctx) ? "error" : "off",
+          instructions: approvability,
+        },
+      ],
+    },
+    path_filters: [
+      // Vendored read-only reference checkouts of upstream Effect and Alchemy
+      // (see scripts/lib/reference-repos.ts). Nothing imports from them.
+      "!.repos/**",
+    ],
+    path_instructions: [
+      {
+        path: "{apps,packages,infra}/**/*.ts",
+        instructions: "Hold changed code to the rules in docs/internals/effect-services.md.",
+      },
+      {
+        path: "apps/web/src/**/*.{tsx,css}",
+        instructions: "Hold changed code to the rules in docs/internals/web-ui.md.",
+      },
+    ],
+  },
+  knowledge_base: {
+    code_guidelines: {
+      filePatterns: [
+        { files: "docs/internals/effect-services.md", applyTo: "{apps,packages,infra}/**/*.ts" },
+        { files: "docs/internals/web-ui.md", applyTo: "apps/web/src/**/*.{tsx,css}" },
+      ],
+    },
+  },
+}));

.cursor/rules/cursor-cloud.mdc

@@ -69,4 +69,4 @@ Gradle auto-downloads any additional pinned SDK packages on demand.
 ## Known flaky tests (unrelated to setup)
 
 - `apps/server/src/git/GitManager.test.ts` (cross-repo PR metadata, can time out at 12s).
-- `apps/server/src/provider/Layers/ProviderRegistry.test.ts` (codex binaryPath re-probe ordering).
+- `apps/server/src/provider/ProviderRegistry.test.ts` (codex binaryPath re-probe ordering).

.fork/customizations.yaml

@@ -427,6 +427,9 @@
     # Upstream asserts its own V2 profile name on the packaged-Windows bridge
     # path; fenced to the fork's.
     - apps/desktop/src/app/DesktopClerk.test.ts
+    # Upstream's Windows profile migration test names its own legacy and V2
+    # directories; fenced to the fork's pair.
+    - apps/desktop/src/app/DesktopPreReadyFileSystem.test.ts
     - apps/desktop/src/app/DesktopLegacyLocalStorage.ts
     - apps/desktop/src/legacyLocalStorageMerge.ts
     # The v0.0.32 pre-ready refactor: identity and state-dir logic that never
@@ -2064,6 +2067,7 @@
   shadows: []
   watch:
     - apps/web/src/components/usage/UsagePage.tsx
+    - apps/web/src/components/usage/UsagePage.test.tsx
     - apps/web/src/custom/SidebarV2ChromeRows.tsx
     - apps/web/src/components/Sidebar.tsx
     - docs/user/usage.md
@@ -3596,16 +3600,16 @@
 
 - id: fork-composer-banner-surface
   intent: >
-    Composer banners (the settled / snoozed / woke notices, resume-with-less-
-    context, provider and environment warnings, the inline activity strip) are
-    the top section of the composer card, not a card floating behind it.
+    Composer banners (the branch-changed notice, provider and environment
+    warnings, the inline activity strip) are the top section of the composer
+    card, not a card floating behind it.
 
-    A settled thread shows only its Un-settle notice, with no stacked notice
-    peeking behind it. Other notices, including resume compaction, are hidden
-    without being dismissed and become available once the thread is unsettled.
-    The final stack selection includes activity notices so they cannot push
-    Un-settle behind another card. Snoozed and active threads keep their normal
-    notice ordering.
+    Upstream #16782 moved the settled / snoozed / woke notices out of the
+    banner stack into the timeline-footer status line, where the fork keeps
+    its "Unsettle" / "Unsettling..." action wording, and #16631 replaced the
+    resume-with-less-context card with compact-on-send. The fork's settled-only
+    stack filter (custom/composerBannerVisibility.ts) went with them in the
+    2026-10-07 sync.
 
     Colour: instead of upstream's severity tint — a --info / --success /
     --warning / --error outline plus a wash of the same hue over the glass,
@@ -3632,13 +3636,12 @@
     prompt into one bordered box on the composer fill, is the deliberate
     exception and keeps that construction — including its own top edge under
     a notice, since the notice above it paints no outline to share. Shoulder tabs (stash, tasks) are
-    excluded by name and keep riding the card's shoulder. The three Figma
-    467:33308 cards (settled, resume compaction, branch changed) are stamped
-    data-fork-composer-notice so drawer density stays on Reconnect / Update /
-    tasks. Those cards drop font-medium / leading-7 at the source, stack
-    title over description, and stamp primary / dismiss actions by name
-    (data-fork-composer-notice-action) so Compact still matches when a
-    tooltip wraps it. Compaction uses ChevronsDownUpIcon. The activity strip
+    excluded by name and keep riding the card's shoulder. The remaining Figma
+    467:33308 card (branch changed) is stamped data-fork-composer-notice so
+    drawer density stays on Reconnect / Update / tasks. It drops font-medium /
+    leading-7 at the source, stacks title over description, and stamps its
+    primary / dismiss actions by name (data-fork-composer-notice-action). The
+    activity strip
     stays a single row at 16px padding, including when folded into the stack
     (the in-drawer activity Root is stamped data-chat-composer-activity-strip).
     A notice's primary action is the design's white Primary button, which the
@@ -3650,7 +3653,6 @@
   files:
     - apps/web/src/theme.custom.css
     - apps/web/src/components/ChatView.tsx
-    - apps/web/src/custom/composerBannerVisibility.ts
   shadows: []
   watch:
     # Owns data-composer-banner-surface, data-slot="composer-banner",
@@ -3787,10 +3789,11 @@
     In the composer, model and reasoning are one control. ComposerModelPicker
     wraps ProviderModelPicker and fills its `traits` slot from the same input
     the composer used to hand upstream's TraitsPicker: the trigger reads
-    "Opus 5.5 High" (fast-mode bolt included), and under the pages a panel
+    "Opus 5.5 High Fast" (fast mode rides in the label text since upstream
+    #16069), and under the pages a panel
     shows the selected model's traits. The traits label truncates inside the
     trigger's max width, and in the resting strip it collapses with the model
-    name below 640px (the bolt too), where upstream moved the traits picker
+    name below 640px, where upstream moved the traits picker
     into the ⋯ menu. Effort (`effort`, `reasoningEffort`,
     `reasoning` or `variant`, when it has two or more levels) is a slider over
     the model's own levels, Ultrathink included as the top stop for Claude;

.fork/lint-owned.mjs

@@ -98,10 +98,10 @@ const LINTABLE = new Set([".ts", ".tsx", ".mjs"]);
 export const DEFERRED_RULES = new Map([
   ["react(exhaustive-effect-dependencies)", 17],
   ["react(immutability)", 0],
-  ["react(memo-dependencies)", 22],
-  ["react(preserve-manual-memoization)", 21],
+  ["react(memo-dependencies)", 24],
+  ["react(preserve-manual-memoization)", 20],
   ["react(purity)", 1],
-  ["react(refs)", 36],
+  ["react(refs)", 37],
   ["react(set-state-in-effect)", 26],
   ["react(static-components)", 2],
 ]);

.github/VOUCHED.td

@@ -25,6 +25,7 @@ github:cursoragent
 github:D3OXY
 github:dbalders
 github:eggfriedrice24
+github:esthor
 github:extoci
 github:f-trycua
 github:flamboh

.github/workflows/ci.yml

@@ -283,6 +283,9 @@ jobs:
       # No Electron setup here: `t3` (apps/server) has no Electron dependency
       # and none of its tests touch the runtime. Only the non-server `test`
       # job, which covers @t3tools/desktop, needs the download.
+      - name: Install Chromium for server browser integration tests
+        run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium
+
       - name: Test
         env:
           T3CODE_TRANSFER_BUDGET_REPORT_PATH: ${{ runner.temp }}/t3code-transfer-budget.md
@@ -324,7 +327,13 @@ jobs:
   transfer-report:
     name: Transfer report artifact
     needs: test_server
-    runs-on: ubuntu-24.04
+    # fork:begin ci-runners — see .fork/customizations.yaml#ci-runners
+    # Upstream moved this job to Blacksmith (#16178) because the hosted queue
+    # could abandon it; the fork has no Blacksmith, so it stays hosted with the
+    # same 30-minute ceiling as every other job here.
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # fork:end ci-runners
     steps:
       - name: Require transfer measurements
         uses: actions/download-artifact@v8

.github/workflows/deploy-relay.yml

@@ -4,15 +4,15 @@ on:
   push:
     branches:
       - main
-  # Alchemy does not redeploy the Worker when only a Config value read in its
-  # Init changes (alchemy-run/alchemy#1831), so a changed repository variable
-  # needs a forced deploy to reach production.
+  # Redeploys main after a variable or secret change. Alchemy redeploys the
+  # Worker when a value it reads changes, so force is rarely needed, and it
+  # replaces the Postgres runtime role (alchemy-run/alchemy#1832).
   workflow_dispatch:
     inputs:
       force:
-        description: Redeploy every resource, including ones with no detected changes
+        description: Redeploy every resource, including ones with no detected changes. Replaces the Postgres runtime role.
         type: boolean
-        default: true
+        default: false
 
 permissions:
   contents: read
@@ -42,6 +42,7 @@ jobs:
       RELAY_API_ZONE_NAME: ${{ vars.RELAY_API_ZONE_NAME }}
       RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }}
       RELAY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_TUNNEL_CLEANUP_MODE }}
+      RELAY_LEGACY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_LEGACY_TUNNEL_CLEANUP_MODE }}
       CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }}
       CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }}
       APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }}

.github/workflows/release.yml

@@ -336,6 +336,9 @@ jobs:
       # No Electron setup here: `t3` (apps/server) has no Electron dependency
       # and none of its tests touch the runtime. Only the non-server `test`
       # job, which covers @t3tools/desktop, needs the download.
+      - name: Install Chromium for server browser integration tests
+        run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium
+
       - name: Test
         run: vp run --filter t3 test --shard ${{ matrix.shard }}/${{ strategy.job-total }}
 

.repos/alchemy-effect/.github/workflows/check.yml

@@ -90,6 +90,14 @@ jobs:
       - name: Run Typecheck
         run: pnpm tsc -b
 
+      # Must run after `tsc -b`: it reads distilled's emitted `lib/*.d.ts`,
+      # and stale/missing declarations resolve to `any`.
+      - name: Lint providers
+        run: pnpm lint:providers
+
+      - name: Test CLI launcher
+        run: timeout 240 pnpm test test/Cli/launcher.test.ts test/Cli/exitCodes.test.ts --retry 0 --concurrency 1
+
       - name: Check API JSDocs
         run: pnpm docs:check-jsdoc
 

.repos/alchemy-effect/.github/workflows/pkg.yml

@@ -22,6 +22,7 @@ on:
       - "tsconfig.json"
       - ".github/workflows/pkg.yml"
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
     paths:
       - "submodules/distilled"
       - "packages/**"
@@ -54,6 +55,7 @@ jobs:
           # Pack the pull request head rather than the synthetic merge commit,
           # so every tarball is addressed by a commit that exists on the PR.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
 
       - name: Checkout distilled
         run: git submodule update --init --depth=1 --checkout -- submodules/distilled
@@ -69,19 +71,29 @@ jobs:
           install: true
           require-lockfile: true
 
+      # Cold-building the alchemy package peaks near 17 GB of heap, which
+      # starves the runner agent on a 32 GB machine and drops the job. A soft
+      # limit holds the peak near 11 GB for roughly twice the compile time.
       - name: Build packages
+        env:
+          GOMEMLIMIT: 6GiB
+          GOGC: "40"
         run: pnpm build:pkg
 
-      # Keep the directory lists in sync with the `build:pkg` script.
+      # The @distilled.cloud list is alchemy's dependency set, which `build:pkg`
+      # derives with `--filter=alchemy...`; keep the @alchemy.run list in sync.
       - name: Pack packages
         id: pack
         run: >-
           pnpm exec pkg pack
+          ${{ contains(github.event.pull_request.labels.*.name, 'force-ci') && '--all' || '' }}
+          --rebuild-all-path 'scripts/copy-package-files.ts'
           --group 'alchemy=./packages/alchemy'
           --group '@alchemy.run[Collapsed]=./packages/{better-auth,cloudflare-runtime,frontend-frameworks,node-utils,floci,pkg}'
-          --group '@distilled.cloud[Collapsed]=./submodules/distilled/packages/{core,aws,axiom,cloudflare,fly-io,github,hetzner,neon,planetscale,railway,stripe}'
+          --group '@distilled.cloud[Collapsed]=./submodules/distilled/packages/{core,acme,aws,axiom,cloudflare,doppler,fly-io,github,hetzner,infisical,neon,prisma,planetscale,railway,stripe,zerossl}'
 
       - name: Vouch for the manifest
+        if: steps.pack.outputs.package-count != '0'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ steps.pack.outputs.artifact-name }}
@@ -91,4 +103,5 @@ jobs:
           retention-days: 1
 
       - name: Publish packages
+        if: steps.pack.outputs.package-count != '0'
         run: pnpm exec pkg publish

.repos/alchemy-effect/.github/workflows/release.yml

@@ -81,6 +81,11 @@ jobs:
           bun scripts/release/prepare.ts '${{ inputs.version }}' | tee -a "$GITHUB_OUTPUT"
 
       - name: Build release packages
+        # Match preview CI: the cold tsgo build can starve the runner
+        # without Go heap limits on this 32 GB machine.
+        env:
+          GOMEMLIMIT: 6GiB
+          GOGC: "40"
         run: >-
           pnpm turbo run build
           $(jq -r '.[] | "--filter=\(.name)"' release-packages.json)

.repos/alchemy-effect/.gitignore

@@ -32,6 +32,11 @@ smoke
 *.d.ts
 !examples/prisma-tanstack-start/migrations/**/start-contract.d.ts
 !examples/prisma-tanstack-start/migrations/**/end-contract.d.ts
+# Emitted Prisma ORM v8 contract types: imported by the fixtures/example that
+# consume them, so a clean checkout must typecheck without running a deploy.
+!examples/cloudflare-neon-prisma/src/prisma/generated/contract.d.ts
+!packages/alchemy/test/Cloudflare/Workers/fixtures/prisma-orm/generated/contract.d.ts
+!packages/alchemy/test/Prisma/ORM/fixtures/client/generated/contract.d.ts
 # drizzle-kit's generated durable-sqlite migrations bundle (checked-in test fixture)
 !packages/alchemy/test/Cloudflare/Workers/fixtures/drizzle-do/drizzle/migrations.js
 # Container image contexts COPY these into the image; without the negation
@@ -67,6 +72,8 @@ examples/cloudflare-worker/src/scratch.ts
 /packages/alchemy/README.md
 
 !/packages/alchemy/bin/cli.js
+!/packages/alchemy/bin/alchemy.js
+!/packages/alchemy/bin/exec.js
 !/packages/alchemy/bin/register-dev-mode.js
 !/packages/alchemy/bin/register-oxc.js
 .tmp

.repos/alchemy-effect/AGENTS.md

@@ -857,8 +857,8 @@ Resolve the bindings, expose one route per behavior, default-export the class so
 // fixtures/worker.ts
 import * as Cloudflare from "@/Cloudflare/index.ts";
 import * as Effect from "effect/Effect";
-import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
-import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { HttpServerRequest } from "effect/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/http/HttpServerResponse";
 import { Gateway } from "./gateway.ts";
 
 export default class TestWorker extends Cloudflare.Worker<TestWorker>()(
@@ -895,7 +895,7 @@ import * as Test from "@/Test/Alchemy";
 import { expect } from "alchemy-test";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
-import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClient from "effect/http/HttpClient";
 import TestWorker from "./fixtures/worker.ts";
 
 const { test, beforeAll, afterAll, deploy, destroy } = Test.make({