[bjacobso]

Changes

Addresses alchemy-latest and deploy-alchemy. This is a separate follow-up to #106, branched from main at 1317204 after #106 and #107 merged. Main CI and Deploy succeeded, and the live legacy workbench URL was verified to return 302 to https://foldworks.dev/forma/ (200).

• Upgrade alchemy to 2.0.0-beta.84 and import the provider from @alchemy.run/cloudflare at the same version, following the beta.84 migration notes. Replace the beta.83 crypto patch with exactly one beta.84 patch, based on Triplex's family patch, preserving typed OAuth crypto errors. Effect stays 4.1.1 and Foldkit stays 0.170.0.
• Keep production on the prod stage after successful push CI on main, checking out that validated revision. Preserve the stack/resource IDs, production Worker name, custom domain, routes, and default Cloudflare.state() store. No named state store is introduced.
• Add same-repository PR previews for opened/synchronize/reopened, alchemy deploy --stage pr-<number> --yes, and alchemy destroy on closed. Runs serialize per PR. Only prod binds a custom domain; previews use workers.dev. Read the URL through beta.84's alchemy state read ... --backend cloudflare and create/update one sticky PR comment, marking it destroyed after cleanup. Forks never deploy.
• Missing Cloudflare credentials skip deployment/cleanup with a clear notice. Document the environment setup and new alchemy state bootstrap --backend cloudflare command.

Verification

• Seven offline checks pass: deploy/state entrypoint imports; compiled prod and two PR stages with distinct Worker names, prod-only domain, preserved routes, destroy policy; provider/auth/state-store contribution discovery and lifecycle imports; PKCE/state freshness and SHA-256 correctness; client-secret URL behavior; typed random/digest errors. No authentication, bootstrap, remote state access, or deployment was performed locally.
• Actionlint passes for CI, production and preview workflows. Local fixtures exercise the missing-credential notice, sticky comment create/update, workers.dev URL validation, and closed-stage comment handling.
• Fresh local clone with an empty pnpm store: pnpm install --frozen-lockfile and pnpm check:alchemy pass, with no tracked install changes.
• pnpm check passes: seven Alchemy checks, typechecks, 1,169 Vitest tests, seven surface-runner tests, 248 surface comparisons, docs build and generated llms structure/link-target checks.
• pnpm website:build, pnpm website:dry-run and pnpm test:site pass (all nine assembled-site Chromium tests).
• The Preview workflow passed on this PR and emitted the missing-credentials notice; install/deploy/comment/destroy steps skipped as intended. CI passed, including frozen install, deployment CLI startup, full check, package packing/consumer verification, Playwright visual tests, website build, Wrangler dry run, and all nine assembled-site browser tests.

Configuration and limits

Ben must create/configure the GitHub preview environment with CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN and allow same-repository PR branches. Use Workers Scripts Edit, Account Settings Read and Secrets Store Edit, including the state-store secret's workers scope. Preview credentials need no zone permissions; production keeps its existing environment and zone permissions. No repository settings or secrets were changed in this workspace.

Actual preview deployment, URL reporting and destroy require those credentials and were not exercised from the workspace. Local validation uses offline stack compilation and Wrangler's dry run rather than an authenticated Alchemy plan. No manual deployment, publication or merge was performed.

Status: ready for review; local validation and CI are green. Preview credentials remain to be configured; no deployment or merge performed.