[bjacobso]

Upgrade the existing Alchemy stack to beta.84 and deploy production only from the exact main commit whose CI push run succeeded. Same-repository PRs retain their isolated preview and existing sticky comment; closing a PR now destroys its pr-<number> stage.

Template items

• alchemy-latest: pin Alchemy and the Cloudflare/GitHub providers to 2.0.0-beta.84, migrate split provider imports and explicit Cloudflare state-backend commands, and regenerate the lockfile. Replace the beta.81 patch with one patches/alchemy@2.0.0-beta.84.patch for Effect 4.1 Crypto compatibility. Remove the obsolete distilled AWS patch and its regression fixture because Cloudflare state no longer loads the AWS backend. Verify with the frozen strict-peer install, OAuth/PKCE tests, Cloudflare auth/state-store loading, deploy-entrypoint import, and real local state CLI tests in pnpm check.
• deploy-alchemy: trigger production through a successful CI workflow run for a push on main, check out its head_sha, and deploy prod. Add PR-close destruction, serialize each PR's deploy/destroy operations, keep fork exclusion and missing-secret notices, and preserve the state-managed preview-comment resource. Production domains and API routes remain unchanged; custom domains bind only in prod. Verify with actionlint, the entrypoint TypeScript check, and the workflow event guards; after merge, production requires successful CI, and a same-repository PR exercises the preview/comment/close lifecycle.

Validation

• Node 25.9.0, pnpm 11.1.3.
• pnpm install --frozen-lockfile --strict-peer-dependencies passed.
• Full pnpm check passed: formatting, llms validation, all package tests, TypeScript checks, builds, the Astro playground build, and the HTTP serve smoke (including exact /llms.txt content and text content type).
• Deployment workflows passed actionlint 1.7.7.
• pnpm exec tsc --noEmit --target ESNext --module ESNext --moduleResolution bundler --skipLibCheck --strict --allowImportingTsExtensions --types node alchemy.run.ts passed.
• pnpm alchemy plan --stage prod --no-input imported the entrypoint and resolved stack services, then stopped while loading state: Cloudflare is not configured in the local default profile. A cloud-backed plan and hosted smoke could not be completed here. No deployment or destruction was run from this workspace.

Ben: secrets and repository settings

The workflows reuse CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN; ensure both repository secrets are available to same-repository PR runs and production. Scope the token to the deployment account with account-read, Workers/Durable Object state-store provisioning, and Artifacts access. Production also needs access to the existing schematics.run zone and its custom domains/routes; enable Workers subdomains for previews. Missing preview secrets produce a skip notice.

The existing automatic GITHUB_TOKEN needs the workflow's PR/issue write permissions to update the sticky comment. No separate GitHub token secret is required. OPENROUTER_API_KEY remains optional for hosted chat. Beta.84's manual state-store setup command is pnpm alchemy state bootstrap --backend cloudflare; the workflows pass --yes for any required provisioning/upgrade. No new deployment secrets or environments are introduced.

Final status: both selected template items are implemented and local checks pass; ready for review. Cloud-backed planning and the hosted preview lifecycle require configured Cloudflare credentials.

---

Open workspace in Conductor

[github-actions]

Cloudflare Preview Deployed

Playground: https://schematics-playground-pr-65-an47ryl3budxxayw.bjacobso.workers.dev
API: https://schematics-api-pr-65-rcoltvmou65u3juo.bjacobso.workers.dev

Built from commit 23ef338

---

2026-11-02T01:08:21.708Z

_{This comment updates automatically with each push.}