Vendor Effect AI provider forks

.eslintignore

@@ -0,0 +1,5 @@
+# Vendored upstream source retains Effect's formatting and lint baseline. Local fork changes are
+# covered by focused runtime tests and typechecks; do not rewrite the complete upstream surface.
+packages/effect-ai-openai/src/**
+packages/effect-ai-anthropic/src/**
+packages/effect-ai-openai-compat/src/**

.prettierignore

@@ -0,0 +1,4 @@
+# Vendored upstream source retains Effect's formatting. Local tests, package metadata, and provenance remain formatted.
+packages/effect-ai-openai/src/**
+packages/effect-ai-anthropic/src/**
+packages/effect-ai-openai-compat/src/**

docs/publishing.md

@@ -2,43 +2,116 @@
 
 Releases are driven by pushed `v*` tags. `v1.2.3` publishes with the npm `latest` dist-tag. A prerelease uses its first prerelease identifier, so `v1.2.3-rc.2` publishes with `rc`.
 
+## Effect AI provider fork versions
+
+The three vendored provider packages are regular Fold libraries. Every Fold release publishes the matching version of:
+
+- `@humanlayer/effect-ai-openai`
+- `@humanlayer/effect-ai-anthropic`
+- `@humanlayer/effect-ai-openai-compat`
+
+For example, a Fold `v1.2.3` release publishes all three providers at `1.2.3`. This release version is independent
+from the upstream Effect provider version. Each package's `UPSTREAM.md` records the exact upstream package artifact,
+immutable checksum, import date, and HumanLayer delta used by that Fold release.
+
 ## One-time npm setup
 
-Trusted publishing cannot create a package. The first version of every package must be published manually by an npm owner:
+Trusted publishing cannot create a package. A package's first version must be published manually by an npm owner.
+
+### Initial release of the complete package family
+
+For an initial Fold release, run the full build and staging process locally:
+
+```bash
+bun install --frozen-lockfile
+bun run typecheck
+bun run test
+bun run build:packages --version 0.1.0
+bun run build:binaries --version 0.1.0
+bun run release:prepare --version 0.1.0
+bun run release:validate --version 0.1.0
+bun run release:publish --version 0.1.0 --tag latest --dry-run
+```
+
+Authenticate and publish. The script publishes libraries (ending with `@humanlayer/fold-cli`), native packages, and
+finally `@humanlayer/fold`. It is safe to rerun after a partial publish because existing package versions are skipped.
+
+```bash
+npm login
+bun run release:publish --version 0.1.0 --tag latest
+```
+
+npm may briefly return `404` for a newly created package even though retrying the publish returns `403` because the
+version already exists. During that registry propagation window, explicitly skip a version you have verified was
+published:
+
+```bash
+bun run release:publish --version 0.1.0 --tag latest --skip @humanlayer/effect-branded-id
+```
+
+Repeat `--skip PACKAGE_NAME` for multiple verified packages if necessary. Do not skip a package based only on a failed
+publish; confirm it appears in the npm organization's package access list first.
 
-1. Run the full build and staging process locally:
+### Adding the Effect AI provider packages
 
-    ```bash
-    bun install --frozen-lockfile
-    bun run typecheck
-    bun run test
-    bun run build:packages --version 0.1.0
-    bun run build:binaries --version 0.1.0
-    bun run release:prepare --version 0.1.0
-    bun run release:validate --version 0.1.0
-    bun run release:publish --version 0.1.0 --tag latest --dry-run
-    ```
+The provider packages are being added to an existing release family. Do **not** use the complete-family publishing
+command above: first create only the three new npm packages. npm cannot configure trusted publishing for a package
+that does not yet exist. Use a unique bootstrap prerelease that will never be referenced by a Fold dependency, then
+publish only the three staged provider directories from an npm-owner's machine:
 
-2. Authenticate and publish. The script publishes libraries (ending with `@humanlayer/fold-cli`), native packages, and finally `@humanlayer/fold`. It is safe to rerun after a partial publish because existing package versions are skipped.
+```bash
+export VERSION=0.1.0-provider-bootstrap.0 # choose an unused prerelease version
+
+bun run build:packages --version "$VERSION"
+bun run build:binaries --version "$VERSION"
+bun run release:prepare --version "$VERSION"
+bun run release:validate --version "$VERSION"
+
+npm login
+for package in effect-ai-openai effect-ai-anthropic effect-ai-openai-compat; do
+  (cd ".release/packages/$package" && npm pack --dry-run && npm publish --access public --tag bootstrap)
+done
+```
 
-    ```bash
-    npm login
-    bun run release:publish --version 0.1.0 --tag latest
-    ```
+For a package's first publish, npm also creates a `latest` tag even when `--tag bootstrap` is supplied. npm rejects
+removing that tag while it is the package's only published version. Leave it in place: the next normal Fold release
+will move `latest` to the corresponding stable provider version.
 
-    npm may briefly return `404` for a newly created package even though retrying the publish returns `403` because the version already exists. During that registry propagation window, explicitly skip a version you have verified was published:
+Check each result with `npm view @humanlayer/PACKAGE_NAME@"$VERSION" version`. The next normal Fold release publishes
+the corresponding provider package at its Fold release version through trusted publishing.
 
-    ```bash
-    bun run release:publish --version 0.1.0 --tag latest --skip @humanlayer/effect-branded-id
-    ```
+### Trusted publishing
 
-    Repeat `--skip PACKAGE_NAME` for multiple verified packages if necessary. Do not skip a package based only on a failed publish; confirm it appears in the npm organization's package access list first.
+Trusted publishing is configured per existing npm package. Upgrade to npm 11.15 or later, ensure that 2FA is enabled
+on the npm account, then add GitHub Actions as the trusted publisher. The first command requires interactive 2FA; npm
+offers a five-minute grace period to approve the remaining commands without another challenge.
 
-    After trusted publishing is configured, a partial release can also be resumed from GitHub Actions. Run the `Release` workflow manually with the same version and npm tag, and provide already-published packages as a comma-separated `skip` value. Manual recovery runs publish packages but do not create a GitHub Release; the normal tag-triggered run creates it after publication completes.
+```bash
+npm install --global npm@^11.15.0
+
+for package in effect-ai-openai effect-ai-anthropic effect-ai-openai-compat; do
+  npm trust github "@humanlayer/$package" \
+    --repository humanlayer/fold \
+    --file release.yml \
+    --allow-publish \
+    --yes
+  sleep 2
+done
+
+for package in effect-ai-openai effect-ai-anthropic effect-ai-openai-compat; do
+  npm trust list "@humanlayer/$package"
+done
+```
 
-3. On npmjs.com, configure a GitHub Actions trusted publisher for every package. Use repository `humanlayer/fold` and workflow filename `release.yml`.
+Leave the GitHub environment unspecified: the current release job does not declare one. npm requires this configuration
+independently for each package. The trusted publisher must be added to all eleven library packages (including
+`@humanlayer/fold-cli`), all twelve `@humanlayer/fold-*` native packages, and `@humanlayer/fold` (24 packages total).
+Do not specify a GitHub environment unless the release workflow is updated to use the same protected environment.
 
-The trusted publisher must be added to all eight library packages (including `@humanlayer/fold-cli`), all twelve `@humanlayer/fold-*` native packages, and `@humanlayer/fold` (21 packages total). Do not specify a GitHub environment because the release job does not use one.
+After trusted publishing is configured, a partial release can be resumed from GitHub Actions. Run the `Release`
+workflow manually with the same version and npm tag, and provide already-published packages as a comma-separated
+`skip` value. Manual recovery runs publish packages but does not create a GitHub Release; the normal tag-triggered run
+creates it after publication completes.
 
 ## Install choices
 

package.json

@@ -8,12 +8,13 @@
 	"scripts": {
 		"build": "bun run build:packages",
 		"build:packages": "bun run scripts/build/packages.ts",
+		"build:providers": "bun run scripts/build/packages.ts --providers --quiet",
 		"build:binaries": "bun run scripts/build/binaries.ts",
 		"release:tag-info": "bun run scripts/release/tag-info.ts",
 		"release:prepare": "bun run scripts/release/prepare.ts",
 		"release:validate": "bun run scripts/release/validate-manifest.ts",
 		"release:publish": "bun run scripts/release/publish.ts",
-		"typecheck": "bun run --parallel --if-present --filter './packages/*' typecheck",
+		"typecheck": "bun run build:providers && bun run --parallel --if-present --filter './packages/*' typecheck",
 		"test": "bun run --parallel --if-present --filter './packages/*' test",
 		"test:watch": "bun run --parallel --if-present --filter './packages/*' test:watch",
 		"lint": "oxlint --type-aware",
@@ -33,8 +34,6 @@
 			"@opentui/solid": "0.4.3",
 			"solid-js": "1.9.12",
 			"effect": "4.0.0-rc.112",
-			"@effect/ai-openai": "4.0.0-rc.112",
-			"@effect/ai-openai-compat": "4.0.0-rc.112",
 			"@effect/platform-node": "4.0.0-rc.112",
 			"@effect/vitest": "4.0.0-rc.112",
 			"@silvia-odwyer/photon-node": "0.3.4",
@@ -45,8 +44,7 @@
 			"@vitest/coverage-v8": "4.1.9",
 			"typescript": "7.0.2",
 			"@types/bun": "1.3.14",
-			"@types/node": "26.1.0",
-			"@effect/ai-anthropic": "4.0.0-rc.112"
+			"@types/node": "26.1.0"
 		}
 	},
 	"devDependencies": {
@@ -60,8 +58,5 @@
 		"oxlint-tsgolint": "0.24.0",
 		"typescript": "catalog:",
 		"vitest": "catalog:"
-	},
-	"patchedDependencies": {
-		"@effect/ai-openai@4.0.0-rc.112": "patches/@effect%2Fai-openai@4.0.0-rc.112.patch"
 	}
 }

packages/effect-ai-anthropic/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Effectful Technologies Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.