v0.7.0

Added

• The Alchemy-free alchemy-sops/Config entrypoint, exposing a SOPS document as an Effect ConfigProvider. Alchemy resolves provider credentials through Config.redacted/Config.string, so a deploy can authenticate from an encrypted document with nothing in the environment and no sops exec-env wrapper.
• provideCredentials, which supplies the provider to both a stack's providers and state layers. The state store initializes first and resolves credentials independently, so wiring only providers fails during state initialization.

Decryption is lazy and memoized, and layerAdd registers the document behind the environment, so an ambient credential still wins. A path the document lacks is reported as absent rather than as a failure, so ConfigProvider.orElse composition behaves normally.

Changed

• Backend selection moved into src/backend.ts so the Alchemy-free entrypoints share the same auto/cli/sops-age resolution as SopsFile.

Fixed

• Pinned the effect dev dependency to 4.0.0-beta.102. beta.105 removed Schema.TaggedErrorClass, which the @distilled.cloud/core bundled with alchemy@2.0.0-beta.70 still calls. The peer range is unchanged, so this does not constrain consumers.
• Restored the typecheck against @distilled.cloud/cloudflare@0.30.3, which widened a secret's status to an open union and tightened Output variance.