[pull] main from pingdotgg:main

.macroscope/check-run-agents/effect-service-conventions.md

@@ -14,6 +14,7 @@ exclude:
   - "**/*.test.ts"
 labels:
   - vouch:trusted
+  - macroscope-review
 requires:
   - Check
 maxBudgetPerRun: 5
@@ -51,7 +52,7 @@ Review changed TypeScript for the conventions below. They apply when a pull requ
 
 ## Errors
 
-- Define service failures with `Schema.TaggedErrorClass` and structured attributes: operation or stage, resource path or entity identifier, normalized category or status. Derive `message` from those attributes only. Never derive it from `cause`, `cause.message`, or a stringified defect, and do not add a `detail` field that copies `cause.message`.
+- Define service failures with `Schema.TaggedError` and structured attributes: operation or stage, resource path or entity identifier, normalized category or status. Derive `message` from those attributes only. Never derive it from `cause`, `cause.message`, or a stringified defect, and do not add a `detail` field that copies `cause.message`.
 - When wrapping a real failure, keep the immediate underlying error as `cause` so the chain and stack survive. Make `cause` required if every construction wraps a failure. Pure validation or domain errors created without an underlying failure need no cause.
 - Keep attributes and log annotations safe and bounded: no raw wire payloads, command arguments or output, signed URLs, credentials, query strings, or arbitrary defect text. Preserve the exact value only as `cause`; expose normalized categories, lengths, counts, and safe URL protocol or hostname where useful.
 - At a translation boundary, pass through an already structured domain error when it is part of the target error channel; wrap only unknown or lower-level failures. Map failures where the context is known instead of wrapping a whole multi-step pipeline in one generic error.

.macroscope/check-run-agents/ui-consistency.md

@@ -13,6 +13,7 @@ exclude:
   - "apps/web/src/**/*.test.tsx"
 labels:
   - vouch:trusted
+  - macroscope-review
 requires:
   - Check
 maxBudgetPerRun: 2

.repos/alchemy-effect/.gitattributes

@@ -0,0 +1,4 @@
+* text=auto eol=lf
+
+.vendor/** linguist-vendored
+distilled/** linguist-vendored

.repos/alchemy-effect/.github/workflows/check.yml

@@ -1,41 +1,101 @@
-name: check
+name: Check
 
-# Runs the website docs validator (`bun run docs:check`) on every PR
-# so broken links / missing API references fail fast before merge.
+# Validates the repository type graph and website docs.
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
   pull_request:
     types: [opened, reopened, synchronize]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
-env:
-  NODE_VERSION: "24"
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   check:
-    runs-on: ubuntu-22-large
+    name: Check
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # `bun install` needs the distilled submodule (workspace member)
-          submodules: true
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Restore Astro build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          path: website/node_modules/.astro
+          key: website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-
+            website-astro-${{ runner.os }}-main-
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          bun-version: latest
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
 
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-${{ runner.os }}-
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Run Node Utils tests
+        run: pnpm -C packages/node-utils test
+
+      - name: Run Typecheck
+        run: pnpm tsc -b
+
+      - name: Check API JSDocs
+        run: pnpm docs:check-jsdoc
 
-      - run: bun install
-      - run: bun tsc -b
-      - run: bun run docs:check
+      # An internal PR carrying `deploy-website` gets a full Astro build in
+      # website.yml via StaticSite. That build runs the same output validators,
+      # so avoid building the site a second time here. Forks still run this
+      # check because they cannot access the preview deployment secrets.
+      - name: Check website docs
+        if: >-
+          github.event.pull_request.head.repo.full_name != github.repository ||
+          !contains(github.event.pull_request.labels.*.name, 'deploy-website')
+        run: pnpm docs:check

.repos/alchemy-effect/.github/workflows/claude.yml

@@ -10,6 +10,12 @@ on:
   pull_request_review:
     types: [submitted]
 
+concurrency:
+  group: claude-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
+  # Separate @claude prompts may be independent requests; serialize them for
+  # the same issue or PR without discarding one that is already running.
+  cancel-in-progress: false
+
 jobs:
   claude:
     if: |
@@ -26,20 +32,39 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
       - name: Configure AWS credentials
         id: aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-east-1
           output-credentials: true
 
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@e63208cb983318a44e3f945e959ef894b707dcfa # v1.0.192
         env:
           AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
           AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}

.repos/alchemy-effect/.github/workflows/cloudflare-tools.yml

@@ -0,0 +1,100 @@
+name: Cloudflare Tools
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "distilled"
+      - "fixtures/**"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/copy-package-files.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
+  pull_request:
+    types: [opened, reopened, synchronize]
+    paths:
+      - "distilled"
+      - "fixtures/**"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/copy-package-files.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloudflare-tools-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    # GitHub does not expose repository secrets to fork pull requests. Keep
+    # the secret-backed test matrix on trusted refs while still running it for
+    # pushes, manual dispatches, and pull requests from this repository.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - blacksmith-8vcpu-ubuntu-2404
+          - blacksmith-6vcpu-macos-latest
+          - blacksmith-8vcpu-windows-2025
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Typecheck
+        run: pnpm typecheck:cloudflare-packages
+
+      - name: Test
+        run: pnpm test:cloudflare-packages ${{ runner.os == 'Windows' && '--concurrency=3' || runner.os == 'macOS' && '--concurrency=2' || '' }}
+        env:
+          TEST_MYSQL_URL: ${{ secrets.TEST_MYSQL_URL }}
+          TEST_POSTGRES_URL: ${{ secrets.TEST_POSTGRES_URL }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          TEST_KV_NAMESPACE_ID: ${{ secrets.TEST_KV_NAMESPACE_ID }}
+          TEST_R2_BUCKET_NAME: ${{ secrets.TEST_R2_BUCKET_NAME }}
+          TEST_D1_DATABASE_ID: ${{ secrets.TEST_D1_DATABASE_ID }}
+          TEST_SERVICE_WORKER_NAME: ${{ secrets.TEST_SERVICE_WORKER_NAME }}