fix(run-engine): heartbeat batch items so slow ones are not run twice

A claimed item stayed invisible for a fixed 60s and was never heartbeated, so any
item whose callback ran longer than that was reclaimed and handed to a second
consumer while the first was still working on it. Both consumers created a run for
the same item, and the redelivery could then be dropped, leaving the batch short of
its expected count.

Items are now heartbeated for as long as their callback runs. Each beat extends by
a full visibility timeout while the tick stays at a third of it, so a slow beat has
margin rather than lapsing the deadline. The timeout is configurable so the
behaviour is testable.

If a beat reports the in-flight entry is gone the item was reclaimed, and the
consumer discards its result rather than completing over the new owner. That is a
best-effort signal, not a fence: the in-flight member carries no per-claim token,
so once another consumer re-claims the item this consumer's beats succeed again.

.changeset/agent-skills.md

@@ -1,16 +0,0 @@
----
-"@trigger.dev/sdk": patch
-"@trigger.dev/core": patch
-"@trigger.dev/build": patch
-"trigger.dev": patch
----
-
-Add Agent Skills for `chat.agent`. Drop a folder with a `SKILL.md` and any helper scripts/references next to your task code, register it with `skills.define({ id, path })`, and the CLI bundles it into the deploy image automatically — no `trigger.config.ts` changes. The agent gets a one-line summary in its system prompt and discovers full instructions on demand via `loadSkill`, with `bash` and `readFile` tools scoped per-skill (path-traversal guards, output caps, abort-signal propagation).
-
-```ts
-const pdfSkill = skills.define({ id: "pdf-extract", path: "./skills/pdf-extract" });
-
-chat.skills.set([await pdfSkill.local()]);
-```
-
-Built on the [AI SDK cookbook pattern](https://ai-sdk.dev/cookbook/guides/agent-skills) — portable across providers. SDK + CLI only for now; dashboard-editable `SKILL.md` text is on the roadmap.

.changeset/ai-prompts.md

@@ -1,52 +0,0 @@
----
-"@trigger.dev/sdk": minor
----
-
-**AI Prompts** — define prompt templates as code alongside your tasks, version them on deploy, and override the text or model from the dashboard without redeploying. Prompts integrate with the Vercel AI SDK via `toAISDKTelemetry()` (links every generation span back to the prompt) and with `chat.agent` via `chat.prompt.set()` + `chat.toStreamTextOptions()`.
-
-```ts
-import { prompts } from "@trigger.dev/sdk";
-import { generateText } from "ai";
-import { openai } from "@ai-sdk/openai";
-import { z } from "zod";
-
-export const supportPrompt = prompts.define({
-  id: "customer-support",
-  model: "gpt-4o",
-  config: { temperature: 0.7 },
-  variables: z.object({
-    customerName: z.string(),
-    plan: z.string(),
-    issue: z.string(),
-  }),
-  content: `You are a support agent for Acme.
-
-Customer: {{customerName}} ({{plan}} plan)
-Issue: {{issue}}`,
-});
-
-const resolved = await supportPrompt.resolve({
-  customerName: "Alice",
-  plan: "Pro",
-  issue: "Can't access billing",
-});
-
-const result = await generateText({
-  model: openai(resolved.model ?? "gpt-4o"),
-  system: resolved.text,
-  prompt: "Can't access billing",
-  ...resolved.toAISDKTelemetry(),
-});
-```
-
-**What you get:**
-
-- **Code-defined, deploy-versioned templates** — define with `prompts.define({ id, model, config, variables, content })`. Every deploy creates a new version visible in the dashboard. Mustache-style placeholders (`{{var}}`, `{{#cond}}...{{/cond}}`) with Zod / ArkType / Valibot-typed variables.
-- **Dashboard overrides** — change a prompt's text or model from the dashboard without redeploying. Overrides take priority over the deployed "current" version and are environment-scoped (dev / staging / production independent).
-- **Resolve API** — `prompt.resolve(vars, { version?, label? })` returns the compiled `text`, resolved `model`, `version`, and labels. Standalone `prompts.resolve<typeof handle>(slug, vars)` for cross-file resolution with full type inference on slug and variable shape.
-- **AI SDK integration** — spread `resolved.toAISDKTelemetry({ ...extra })` into any `generateText` / `streamText` call and every generation span links to the prompt in the dashboard alongside its input variables, model, tokens, and cost.
-- **`chat.agent` integration** — `chat.prompt.set(resolved)` stores the resolved prompt run-scoped; `chat.toStreamTextOptions({ registry })` pulls `system`, `model` (resolved via the AI SDK provider registry), `temperature` / `maxTokens` / etc., and telemetry into a single spread for `streamText`.
-- **Management SDK** — `prompts.list()`, `prompts.versions(slug)`, `prompts.promote(slug, version)`, `prompts.createOverride(slug, body)`, `prompts.updateOverride(slug, body)`, `prompts.removeOverride(slug)`, `prompts.reactivateOverride(slug, version)`.
-- **Dashboard** — prompts list with per-prompt usage sparklines; per-prompt detail with Template / Details / Versions / Generations / Metrics tabs. AI generation spans get a custom inspector showing the linked prompt's metadata, input variables, and template content alongside model, tokens, cost, and the message thread.
-
-See [/docs/ai/prompts](https://trigger.dev/docs/ai/prompts) for the full reference — template syntax, version resolution order, override workflow, and type utilities (`PromptHandle`, `PromptIdentifier`, `PromptVariables`).

.changeset/ai-tool-helpers.md

@@ -1,15 +0,0 @@
----
-"@trigger.dev/sdk": patch
----
-
-Add `ai.toolExecute(task)` so you can wire a Trigger subtask in as the `execute` handler of an AI SDK `tool()` while defining `description` and `inputSchema` yourself — useful when you want full control over the tool surface and just need Trigger's subtask machinery for the body.
-
-```ts
-const myTool = tool({
-  description: "...",
-  inputSchema: z.object({ ... }),
-  execute: ai.toolExecute(mySubtask),
-});
-```
-
-`ai.tool(task)` (`toolFromTask`) keeps doing the all-in-one wrap and now aligns its return type with AI SDK's `ToolSet`. Minimum `ai` peer raised to `^6.0.116` to avoid cross-version `ToolSet` mismatches in monorepos.

.changeset/bundle-skills-single-pass.md

@@ -1,5 +0,0 @@
----
-"trigger.dev": patch
----
-
-Fix `chat.agent` skills silently missing in `trigger dev` for projects whose task files read `process.env` at module top level (e.g. a third-party SDK client initialized at import). Skill folders now bundle into `.trigger/skills/` reliably regardless of which env vars are set when the CLI launches.

.changeset/cap-idempotency-key-length.md

@@ -1,5 +0,0 @@
----
-"@trigger.dev/core": patch
----
-
-Reject overlong `idempotencyKey` values at the API boundary so they no longer trip an internal size limit on the underlying unique index and surface as a generic 500. Inputs are capped at 2048 characters — well above what `idempotencyKeys.create()` produces (a 64-character hash) and above any realistic raw key. Applies to `tasks.trigger`, `tasks.batchTrigger`, `batch.create` (Phase 1 streaming batches), `wait.createToken`, `wait.forDuration`, and the input/session stream waitpoint endpoints. Over-limit requests now return a structured 400 instead.

.changeset/chat-agent-on-boot-hook.md

@@ -1,21 +0,0 @@
----
-"@trigger.dev/sdk": minor
----
-
-Adds `onBoot` to `chat.agent` — a lifecycle hook that fires once per worker process picking up the chat. Runs for the initial run, preloaded runs, AND reactive continuation runs (post-cancel, crash, `endRun`, `requestUpgrade`, OOM retry), before any other hook. Use it to initialize `chat.local`, open per-process resources, or re-hydrate state from your DB on continuation — anywhere the SAME run picking up after suspend/resume isn't enough.
-
-```ts
-const userContext = chat.local<{ name: string; plan: string }>({ id: "userContext" });
-
-export const myChat = chat.agent({
-  id: "my-chat",
-  onBoot: async ({ clientData, continuation }) => {
-    const user = await db.user.findUnique({ where: { id: clientData.userId } });
-    userContext.init({ name: user.name, plan: user.plan });
-  },
-  run: async ({ messages, signal }) =>
-    streamText({ model: openai("gpt-4o"), messages, abortSignal: signal }),
-});
-```
-
-Use `onBoot` (not `onChatStart`) for state setup that must run every time a worker picks up the chat — `onChatStart` fires once per chat and won't run on continuation, leaving `chat.local` uninitialized when `run()` tries to use it.

.changeset/chat-agent-preload-oom-recovery.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/sdk": patch
+---
+
+Fix a preloaded `chat.agent` run dropping an in-flight message when it retries after an out-of-memory error. The message being processed when the run hit the OOM is now recovered and re-run on the retry, instead of being skipped while the run waited for a new message.

.changeset/chat-agent.md

@@ -1,44 +0,0 @@
----
-"@trigger.dev/sdk": minor
-"@trigger.dev/core": patch
----
-
-**AI Agents** — run AI SDK chat completions as durable Trigger.dev agents instead of fragile API routes. Define an agent in one function, point `useChat` at it from React, and the conversation survives page refreshes, network blips, and process restarts.
-
-```ts
-import { chat } from "@trigger.dev/sdk/ai";
-import { streamText } from "ai";
-import { openai } from "@ai-sdk/openai";
-
-export const myChat = chat.agent({
-  id: "my-chat",
-  run: async ({ messages, signal }) =>
-    streamText({ model: openai("gpt-4o"), messages, abortSignal: signal }),
-});
-```
-
-```tsx
-import { useChat } from "@ai-sdk/react";
-import { useTriggerChatTransport } from "@trigger.dev/sdk/chat/react";
-
-const transport = useTriggerChatTransport({ task: "my-chat", accessToken, startSession });
-const { messages, sendMessage } = useChat({ transport });
-```
-
-**What you get:**
-
-- **AI SDK `useChat` integration** — a custom [`ChatTransport`](https://sdk.vercel.ai/docs/ai-sdk-ui/transport) (`useTriggerChatTransport`) plugs straight into Vercel AI SDK's `useChat` hook. Text streaming, tool calls, reasoning, and `data-*` parts all work natively over Trigger.dev's realtime streams. No custom API routes needed.
-- **First-turn fast path (`chat.headStart`)** — opt-in handler that runs the first turn's `streamText` step in your warm server process while the agent run boots in parallel, cutting cold-start TTFC by roughly half (measured 2801ms → 1218ms on `claude-sonnet-4-6`). The agent owns step 2+ (tool execution, persistence, hooks) so heavy deps stay where they belong. Web Fetch handler works natively in Next.js, Hono, SvelteKit, Remix, Workers, etc.; bridge to Express/Fastify/Koa via `chat.toNodeListener`. New `@trigger.dev/sdk/chat-server` subpath.
-- **Multi-turn durability via Sessions** — every chat is backed by a durable Session that outlives any individual run. Conversations resume across page refreshes, idle timeout, crashes, and deploys; `resume: true` reconnects via `lastEventId` so clients only see new chunks. `sessions.list` enumerates chats for inbox-style UIs.
-- **Auto-accumulated history, delta-only wire** — the backend accumulates the full conversation across turns; clients only ship the new message each turn. Long chats never hit the 512 KiB body cap. Register `hydrateMessages` to be the source of truth yourself.
-- **Lifecycle hooks** — `onPreload`, `onChatStart`, `onValidateMessages`, `hydrateMessages`, `onTurnStart`, `onBeforeTurnComplete`, `onTurnComplete`, `onChatSuspend`, `onChatResume` — for persistence, validation, and post-turn work.
-- **Stop generation** — client-driven `transport.stopGeneration(chatId)` aborts mid-stream; the run stays alive for the next message, partial response is captured, and aborted parts (stuck `partial-call` tools, in-progress reasoning) are auto-cleaned.
-- **Tool approvals (HITL)** — tools with `needsApproval: true` pause until the user approves or denies via `addToolApprovalResponse`. The runtime reconciles the updated assistant message by ID and continues `streamText`.
-- **Steering and background injection** — `pendingMessages` injects user messages between tool-call steps so users can steer the agent mid-execution; `chat.inject()` + `chat.defer()` adds context from background work (self-review, RAG, safety checks) between turns.
-- **Actions** — non-turn frontend commands (undo, rollback, regenerate, edit) sent via `transport.sendAction`. Fire `hydrateMessages` + `onAction` only — no turn hooks, no `run()`. `onAction` can return a `StreamTextResult` for a model response, or `void` for side-effect-only.
-- **Typed state primitives** — `chat.local<T>` for per-run state accessible from hooks, `run()`, tools, and subtasks (auto-serialized through `ai.toolExecute`); `chat.store` for typed shared data between agent and client; `chat.history` for reading and mutating the message chain; `clientDataSchema` for typed `clientData` in every hook.
-- **`chat.toStreamTextOptions()`** — one spread into `streamText` wires up versioned system [Prompts](https://trigger.dev/docs/ai/prompts), model resolution, telemetry metadata, compaction, steering, and background injection.
-- **Multi-tab coordination** — `multiTab: true` + `useMultiTabChat` prevents duplicate sends and syncs state across browser tabs via `BroadcastChannel`. Non-active tabs go read-only with live updates.
-- **Network resilience** — built-in indefinite retry with bounded backoff, reconnect on `online` / tab refocus / bfcache restore, `Last-Event-ID` mid-stream resume. No app code needed.
-
-See [/docs/ai-chat](https://trigger.dev/docs/ai-chat/overview) for the full surface — quick start, three backend approaches (`chat.agent`, `chat.createSession`, raw task), persistence and code-sandbox patterns, type-level guides, and API reference.

.changeset/chat-handover-cursor-off-by-one.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/core": patch
+---
+
+Fix a chunk occasionally dropped when a chat.agent run takes over from the warm first turn. The realtime stream writer now reports the inclusive last-written position as the resume cursor, so the agent's first record after the handover is no longer skipped.

.changeset/chat-history-read-primitives.md

@@ -1,21 +0,0 @@
----
-"@trigger.dev/sdk": minor
----
-
-Add read primitives to `chat.history` for HITL flows: `getPendingToolCalls()`, `getResolvedToolCalls()`, `extractNewToolResults(message)`, `getChain()`, and `findMessage(messageId)`. These lift the accumulator-walking logic that customers building human-in-the-loop tools were re-implementing into the SDK.
-
-Use `getPendingToolCalls()` to gate fresh user turns while a tool call is awaiting an answer. Use `extractNewToolResults(message)` to dedup tool results when persisting to your own store — the helper returns only the parts whose `toolCallId` is not already resolved on the chain.
-
-```ts
-const pending = chat.history.getPendingToolCalls();
-if (pending.length > 0) {
-  // an addToolOutput is expected before a new user message
-}
-
-onTurnComplete: async ({ responseMessage }) => {
-  const newResults = chat.history.extractNewToolResults(responseMessage);
-  for (const r of newResults) {
-    await db.toolResults.upsert({ id: r.toolCallId, output: r.output, errorText: r.errorText });
-  }
-};
-```

.changeset/chat-session-attributes.md

@@ -1,6 +0,0 @@
----
-"@trigger.dev/sdk": patch
-"@trigger.dev/core": patch
----
-
-Stamp `gen_ai.conversation.id` (the chat id) on every span and metric emitted from inside a `chat.task` or `chat.agent` run. Lets you filter dashboard spans, runs, and metrics by the chat conversation that produced them — independent of the run boundary, so multi-run chats correlate cleanly. No code changes required on the user side.

.changeset/chat-session-caught-up-resume.md

@@ -0,0 +1,7 @@
+---
+"@trigger.dev/core": patch
+"@trigger.dev/sdk": patch
+"trigger.dev": patch
+---
+
+`AgentChat.reconnect()` now settles promptly when reconnecting to an idle chat instead of holding the connection open for the full long-poll window. Also upgrades the S2 streamstore client to 0.25 and moves realtime streams to S2's current hosts.

.changeset/chat-start-session-action-typed-client-data.md

@@ -1,22 +0,0 @@
----
-"@trigger.dev/sdk": patch
----
-
-Type `chat.createStartSessionAction` against your chat agent so `clientData` is typed end-to-end on the first turn:
-
-```ts
-import { chat } from "@trigger.dev/sdk/ai";
-import type { myChat } from "@/trigger/chat";
-
-export const startChatSession = chat.createStartSessionAction<typeof myChat>("my-chat");
-
-// In the browser, threaded from the transport's typed startSession callback:
-const transport = useTriggerChatTransport<typeof myChat>({
-  task: "my-chat",
-  startSession: ({ chatId, clientData }) =>
-    startChatSession({ chatId, clientData }),
-  // ...
-});
-```
-
-`ChatStartSessionParams` gains a typed `clientData` field — folded into the first run's `payload.metadata` so `onPreload` / `onChatStart` see the same shape per-turn `metadata` carries via the transport. The opaque session-level `metadata` field is unchanged.

.changeset/cli-deploy-skip-rewrite-timestamp.md

@@ -1,5 +0,0 @@
----
-"trigger.dev": patch
----
-
-Add `TRIGGER_BUILD_SKIP_REWRITE_TIMESTAMP=1` escape hatch for local self-hosted builds whose buildx driver doesn't support `rewrite-timestamp` alongside push (e.g. orbstack's default `docker` driver).

.changeset/config.json

@@ -14,10 +14,8 @@
   "updateInternalDependencies": "patch",
   "ignore": [
     "webapp",
-    "coordinator",
-    "docker-provider",
-    "kubernetes-provider",
-    "supervisor"
+    "supervisor",
+    "@trigger.dev/plugins"
   ],
   "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {
     "onlyUpdatePeerDependentsWhenOutOfRange": true

.changeset/friendly-keys-batch-tokens.md

@@ -0,0 +1,6 @@
+---
+"@trigger.dev/core": patch
+"@trigger.dev/sdk": patch
+---
+
+Allow task-scoped environment API keys to run batch operations for their permitted tasks. The SDK declares the batch's task set before creation, and `@trigger.dev/core/v3/apiKeys` now exports the additional-key format helper.

.changeset/locals-key-dual-package-fix.md

@@ -1,5 +0,0 @@
----
-"@trigger.dev/core": patch
----
-
-Fix `LocalsKey<T>` type incompatibility across dual-package builds. The phantom value-type brand no longer uses a module-level `unique symbol`, so a single TypeScript compilation that resolves the type from both the ESM and CJS outputs (which can happen under certain pnpm hoisting layouts) no longer sees two structurally-incompatible variants of the same type.

.changeset/mcp-agent-chat-sessions.md

@@ -1,5 +0,0 @@
----
-"trigger.dev": patch
----
-
-The CLI MCP server's agent-chat tools (`start_agent_chat`, `send_agent_message`, `close_agent_chat`) now run on the new Sessions primitive, so AI assistants driving a `chat.agent` get the same idempotent-by-`chatId`, durable-across-runs behavior the browser transport gets. Required PAT scopes go from `write:inputStreams` to `read:sessions` + `write:sessions`.

.changeset/mcp-list-runs-region.md

@@ -1,5 +0,0 @@
----
-"trigger.dev": patch
----
-
-MCP `list_runs` tool: add a `region` filter input and surface each run's executing region in the formatted summary.

.changeset/mcp-trigger-task-region.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+You can now choose the region a run executes in when triggering a task through the MCP server.

.changeset/mock-chat-agent-test-harness.md

@@ -1,8 +0,0 @@
----
-"@trigger.dev/sdk": patch
-"@trigger.dev/core": patch
----
-
-Unit-test `chat.agent` definitions offline with `mockChatAgent` from `@trigger.dev/sdk/ai/test`. Drives a real agent's turn loop in-process — no network, no task runtime — so you can send messages, actions, and stop signals via driver methods, inspect captured output chunks, and verify hooks fire. Pairs with `MockLanguageModelV3` from `ai/test` for model mocking. `setupLocals` lets you pre-seed `locals` (DB clients, service stubs) before `run()` starts.
-
-The broader `runInMockTaskContext` harness it's built on lives at `@trigger.dev/core/v3/test` — useful for unit-testing any task code, not just chat.

.changeset/mollifier-redis-worker-primitives.md

@@ -1,9 +0,0 @@
----
-"@trigger.dev/redis-worker": patch
----
-
-Add MollifierBuffer and MollifierDrainer primitives for trigger burst smoothing.
-
-MollifierBuffer (`accept`, `pop`, `ack`, `requeue`, `fail`, `evaluateTrip`) is a per-env FIFO over Redis with atomic Lua transitions for status tracking. `evaluateTrip` is a sliding-window trip evaluator the webapp gate uses to detect per-env trigger bursts.
-
-MollifierDrainer pops entries through a polling loop with a user-supplied handler. The loop survives transient Redis errors via capped exponential backoff (up to 5s), and per-env pop failures don't poison the rest of the batch — one env's blip is logged and counted as failed for that tick. Rotation is two-level: orgs at the top, envs within each org. The buffer maintains `mollifier:orgs` and `mollifier:org-envs:${orgId}` atomically with per-env queues, so the drainer walks orgs → envs directly without an in-memory cache. The `maxOrgsPerTick` option (default 500) caps how many orgs are scheduled per tick; for each picked org, one env is popped (rotating round-robin within the org). An org with N envs gets the same per-tick scheduling slot as an org with 1 env, so tenant-level drainage throughput is determined by org count rather than env count.

.changeset/plugin-auth-path.md

@@ -1,5 +0,0 @@
----
-"@trigger.dev/plugins": patch
----
-
-The public interfaces for a plugin system. Initially consolidated authentication and authorization interfaces.

.changeset/pre.json

@@ -1,44 +0,0 @@
-{
-  "mode": "pre",
-  "tag": "rc",
-  "initialVersions": {
-    "coordinator": "0.0.1",
-    "docker-provider": "0.0.1",
-    "kubernetes-provider": "0.0.1",
-    "supervisor": "0.0.1",
-    "webapp": "1.0.0",
-    "@trigger.dev/build": "4.4.6",
-    "trigger.dev": "4.4.6",
-    "@trigger.dev/core": "4.4.6",
-    "@trigger.dev/plugins": "4.4.6",
-    "@trigger.dev/python": "4.4.6",
-    "@trigger.dev/react-hooks": "4.4.6",
-    "@trigger.dev/redis-worker": "4.4.6",
-    "@trigger.dev/rsc": "4.4.6",
-    "@trigger.dev/schema-to-json": "4.4.6",
-    "@trigger.dev/sdk": "4.4.6"
-  },
-  "changesets": [
-    "agent-skills",
-    "ai-prompts",
-    "ai-tool-helpers",
-    "bundle-skills-single-pass",
-    "cap-idempotency-key-length",
-    "chat-agent-on-boot-hook",
-    "chat-agent",
-    "chat-history-read-primitives",
-    "chat-session-attributes",
-    "chat-start-session-action-typed-client-data",
-    "cli-deploy-skip-rewrite-timestamp",
-    "locals-key-dual-package-fix",
-    "mcp-agent-chat-sessions",
-    "mcp-list-runs-region",
-    "mock-chat-agent-test-harness",
-    "mollifier-redis-worker-primitives",
-    "plugin-auth-path",
-    "resource-catalog-runtime-registration",
-    "retry-sigsegv",
-    "runs-list-region-filter",
-    "sessions-primitive"
-  ]
-}

.changeset/resource-catalog-runtime-registration.md

@@ -1,6 +0,0 @@
----
-"@trigger.dev/core": patch
-"trigger.dev": patch
----
-
-Fix `COULD_NOT_FIND_EXECUTOR` when a task's definition is loaded via `await import(...)` from inside another task's `run()`. The runtime workers now register such tasks with a sentinel file context, and the catalog logs a one-time warning per task id.

.changeset/retry-run-start-on-connection-error.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/core": patch
+---
+
+Transient connection errors when a run starts are now retried for longer, so a brief connectivity blip no longer sends the run back through the queue and delays its first attempt.

.changeset/retry-sigsegv.md

@@ -1,5 +0,0 @@
----
-"@trigger.dev/core": patch
----
-
-Retry `TASK_PROCESS_SIGSEGV` task crashes under the user's retry policy instead of failing the run on the first segfault. SIGSEGV in Node tasks is frequently non-deterministic (native addon races, JIT/GC interaction, near-OOM in native code, host issues), so retrying on a fresh process often succeeds. The retry is gated by the task's existing `retry` config + `maxAttempts` — same path `TASK_PROCESS_SIGTERM` and uncaught exceptions already use — so tasks without a retry policy still fail fast.

.changeset/runs-list-region-filter.md

@@ -1,6 +0,0 @@
----
-"@trigger.dev/core": patch
-"@trigger.dev/sdk": patch
----
-
-Add `region` to the runs list / retrieve API: filter runs by region (`runs.list({ region: "..." })` / `filter[region]=<masterQueue>`) and read each run's executing region from the new `region` field on the response.

.changeset/sessions-primitive.md

@@ -1,26 +0,0 @@
----
-"@trigger.dev/sdk": minor
-"@trigger.dev/core": patch
----
-
-**Sessions** — a durable, run-aware stream channel keyed on a stable `externalId`. A Session is the unit of state that owns a multi-run conversation: messages flow through `.in`, responses through `.out`, both survive run boundaries. Sessions back the new `chat.agent` runtime, and you can build on them directly for any pattern that needs durable bi-directional streaming across runs.
-
-```ts
-import { sessions, tasks } from "@trigger.dev/sdk";
-
-// Trigger a task and subscribe to its session output in one call
-const { runId, stream } = await tasks.triggerAndSubscribe("my-task", payload, {
-  externalId: "user-456",
-});
-
-for await (const chunk of stream) {
-  // ...
-}
-
-// Enumerate existing sessions (powers inbox-style UIs without a separate index)
-for await (const s of sessions.list({ type: "chat.agent", tag: "user:user-456" })) {
-  console.log(s.id, s.externalId, s.createdAt, s.closedAt);
-}
-```
-
-See [/docs/ai-chat/overview](https://trigger.dev/docs/ai-chat/overview) for the full surface — Sessions powers the durable, resumable chat runtime described there.

.changeset/typescript-seven-builds.md

@@ -0,0 +1,13 @@
+---
+"trigger.dev": patch
+"@trigger.dev/build": patch
+"@trigger.dev/core": patch
+"@trigger.dev/python": patch
+"@trigger.dev/react-hooks": patch
+"@trigger.dev/redis-worker": patch
+"@trigger.dev/rsc": patch
+"@trigger.dev/schema-to-json": patch
+"@trigger.dev/sdk": patch
+---
+
+Refresh package builds for TypeScript 7 compatibility while preserving existing runtime entry points. Projects using `emitDecoratorMetadata()` with TypeScript 7 can install the `@typescript/typescript6` compatibility package alongside it; the package remains optional, so installing the Trigger.dev CLI does not install an additional compiler.

.claude/REVIEW.md

@@ -15,12 +15,44 @@ Reserve 🔴 for things that would page someone or block a rollback. In this cod
 - **Queue / concurrency correctness.** RunQueue, MarQS (V1, legacy), redis-worker — any change to enqueue / dequeue / locking semantics. Re-derive the invariant on paper before flagging or accepting.
 - **Missing index on a hot table.** New Prisma queries against `TaskRun`, `TaskRunExecutionSnapshot`, `JobRun`, `Project`, etc. must use an existing index. Check `internal-packages/database/prisma/schema.prisma` for the relevant `@@index` lines — don't guess and don't propose `EXPLAIN`.
 - **Recovery-path queries.** Any `TaskRun.findFirst` / `findMany` added to a schedule, run-recovery, or restart loop. Recovery fan-outs (Redis crash, restart storms) turn "rare indexed query" into a DB incident. 🔴 even if indexed.
-- **Aggregations on hot tables.** No `COUNT` / `GROUP BY` on `TaskRun` or other multi-million-row tables. Use Redis or ClickHouse for counts.
+- **Aggregations on hot tables.** No `COUNT` / `GROUP BY` on `TaskRun` or other tables that can reach billions of rows. Use Redis or ClickHouse for counts.
 - **Prod Redis blast-radius.** New code paths that `SCAN` with broad patterns (`*foo*`) on prod-shaped Redis, or `EVAL` Lua with `SCAN` loops inside. Both are 🔴.
 - **`@trigger.dev/core` direct import** from anywhere outside the SDK package. Always import from `@trigger.dev/sdk`. Core direct imports are 🔴 — they break the public API contract.
 - **Heavy execute-deps imported into request-handler bundles.** Specifically `chat.handover` and similar split-bundle entry points must not transitively import the agent task's execute path. Watch for new imports added at module top-level of route files.
 - **V1 engine code modified in a "V2 only" PR.** The `apps/webapp/app/v3/` directory contains both. If the PR description says V2-only but it touches `triggerTaskV1`, `cancelTaskRunV1`, `MarQS`, etc. — 🔴.
 
+## Performance (always review)
+
+Every PR gets a performance pass — not just the ones that look perf-sensitive. For each new query or unit of work, weigh three things: (a) the size of the table it hits, (b) whether it sits on a hot path, (c) whether the data it walks can be deep or wide (run trees, batches). The 🔴 bullets above on indexes, recovery-path queries, aggregations, and Redis `SCAN` are part of this pass — the rest below extends it.
+
+**Treat these tables as large — no scans, no `COUNT` / `GROUP BY`, no unbounded fetch:**
+
+- **Postgres — the `TaskRun` family:** `TaskRun`, `TaskRunExecutionSnapshot`, `Waitpoint`, `BatchTaskRun` and their join tables. Assume billions of rows.
+- **ClickHouse — `task_events_v1` / `task_events_v2`.** Partitioned by `toDate(inserted_at)`; `ORDER BY (environment_id, toUnixTimestamp(start_time), trace_id)`. Note `span_id` / `parent_span_id` are NOT in the sort key — span-id lookups can't skip granules, only `environment_id` + a `start_time` window can.
+
+**Hot paths — extra scrutiny on any added query or work:**
+
+- **Trigger + batch trigger** (`triggerTask.server.ts`, `batchTriggerV3.server.ts`) — see `apps/webapp/CLAUDE.md`; do not add DB queries to these.
+- **Dequeue / RunQueue** (`dequeueSystem.ts`, run-queue read/lock paths) — runs on every execution.
+- **Execution-snapshot creation in the run engine** — any engine function that writes a `TaskRunExecutionSnapshot` runs per state transition; a new query there multiplies by run volume.
+- **OTEL ingestion** (`otel.v1.traces.ts`, `otel.v1.logs.ts`) — write volume scales with customer span counts.
+- **Trace + run-list reads** (trace view, run list, span detail) — read paths over the large tables above.
+
+**Deep / wide shapes — one run can explode into a huge tree or batch; code that walks them is the trap:**
+
+- Trace span subtrees (deeply nested child runs → deep span trees).
+- Batch + parent/child fan-out (one run triggers thousands of children).
+- Waitpoint / run-dependency chains.
+- Tag / attribute many-to-many joins against the run/event tables.
+
+**Anti-patterns (severity):**
+
+- **Per-level fan-out that re-scans a large table once per tree depth** → 🔴. A BFS issuing one query per level (e.g. `parent_span_id IN {thisLevel}`) re-reads the same granules D times for a depth-D tree. Prefer one windowed query + an in-memory tree build.
+- **Dropping the partition-pruning predicate** — `inserted_at` for ClickHouse, the `createdAt` window for partitioned Postgres — to "widen" a lookup → 🔴. Without it the query scans every partition. Keep a bounded window even for ancestor / backfill lookups.
+- **Unbounded `IN (...)` built from a result set** (a BFS frontier, a batch's child ids) → 🟡. It can reach the row cap (`MAXIMUM_TRACE_SUMMARY_VIEW_COUNT` defaults to 25k). Cap or chunk to ≤1–2k ids per query.
+- **Sequential per-level round-trips** where one recursive or windowed query would do → 🟡. N levels = N round-trip latencies stacked.
+- **Replacing a single bounded query with a multi-query walk for _every_ call** (not just a rare fallback) → 🔴 on a hot read path, 🟡 elsewhere. Keep the cheap single-query path; branch into the expensive walk only when the cheap one comes up short.
+
 ## Always check
 
 - **Tests use testcontainers, not mocks.** Vitest with `redisTest` / `postgresTest` / `containerTest` from `@internal/testcontainers`. Any new `vi.mock(...)` on Redis, Postgres, BullMQ, or other infra is wrong here — 🔴 if added in production-path tests, 🟡 if isolated unit test.
@@ -33,7 +65,7 @@ Reserve 🔴 for things that would page someone or block a rollback. In this cod
 
 ## Skip (do NOT flag)
 
-- Anything Prettier / ESLint catches. CI runs both.
+- Anything oxfmt / oxlint catches. CI enforces both via the `code-quality` check.
 - TypeScript style preferences (`type` vs `interface`) — already covered by repo standards.
 - Test coverage exhortations as a generic suggestion. Only flag missing tests when a specific code path is genuinely untested and the path has prior incidents.
 - `agentcrumbs` markers (`// @crumbs`, `// #region @crumbs`) and `agentcrumbs` imports — these are temporary debug instrumentation stripped before merge.

.claude/rules/legacy-v3-code.md

@@ -3,31 +3,24 @@ paths:
   - "apps/webapp/app/v3/**"
 ---
 
-# Legacy V1 Engine Code in `app/v3/`
+# v3 (engine V1) has been removed
 
-The `v3/` directory name is misleading - most code here is actively used by the current V2 engine. Only the specific files below are legacy V1-only code.
+The v3 engine (RunEngineVersion `V1`: MarQS queue + Graphile worker) is end-of-life and its execution code has been removed from the webapp. The `app/v3/` directory name is historical: everything under it now serves the current V2 engine (`@internal/run-engine` + `@trigger.dev/redis-worker`).
 
-## V1-Only Files - Never Modify
+There is no `V1` execution path anymore. If you find a `RunEngineVersion` branch, the `V1` arm should only reject or finalize gracefully (for example, mark a historical run cancelled in the DB), never run V1 work. Do not reintroduce MarQS, the graphile worker, or the v3 socket.io namespaces.
 
-- `marqs/` directory (entire MarQS queue system: sharedQueueConsumer, devQueueConsumer, fairDequeuingStrategy, devPubSub)
-- `legacyRunEngineWorker.server.ts` (V1 background job worker)
-- `services/triggerTaskV1.server.ts` (deprecated V1 task triggering)
-- `services/cancelTaskRunV1.server.ts` (deprecated V1 cancellation)
-- `authenticatedSocketConnection.server.ts` (V1 dev WebSocket using DevQueueConsumer)
-- `sharedSocketConnection.ts` (V1 shared queue socket using SharedQueueConsumer)
+## The deprecation boundary (keep this)
 
-## V1/V2 Branching Pattern
+Requests from clients still on v3 (old SDK/CLI) or historical V1 runs must return a clean 4xx, never a 5xx. The boundary lives in:
 
-Some services act as routers that branch on `RunEngineVersion`:
-- `services/cancelTaskRun.server.ts` - calls V1 service or `engine.cancelRun()` for V2
-- `services/batchTriggerV3.server.ts` - uses marqs for V1 path, run-engine for V2
+- `engineDeprecation.server.ts` - the `V3_TRIGGER_DEPRECATION_MESSAGE` / `V3_DEV_DEPRECATION_MESSAGE` / `V3_MIGRATION_URL` upgrade messages.
+- `engineVersion.server.ts` - `determineEngineVersion()` still detects a V1 project/run so callers can reject it.
+- `services/triggerTask.server.ts`, `services/cancelTaskRun.server.ts`, `services/rescheduleTaskRun.server.ts` - the `V1` arm rejects or finalizes gracefully instead of executing.
+- `services/initializeDeployment.server.ts` - the `DEPRECATE_V3_CLI_DEPLOYS_ENABLED`-gated v3 CLI deploy rejection.
+- `handleWebsockets.server.ts` - the legacy `trigger dev` websocket closes with the upgrade message.
 
-When editing these shared services, only modify V2 code paths.
+## V2 modern stack
 
-## V2 Modern Stack
-
-- **Run lifecycle**: `@internal/run-engine` (internal-packages/run-engine)
-- **Background jobs**: `@trigger.dev/redis-worker` (not graphile-worker/zodworker)
-- **Queue operations**: RunQueue inside run-engine (not MarQS)
-- **V2 engine singleton**: `runEngine.server.ts`, `runEngineHandlers.server.ts`
-- **V2 workers**: `commonWorker.server.ts`, `alertsWorker.server.ts`, `batchTriggerWorker.server.ts`
+- **Run lifecycle**: `@internal/run-engine` (`runEngine.server.ts`, `runEngineHandlers.server.ts`)
+- **Background jobs**: `@trigger.dev/redis-worker` (`commonWorker.server.ts`, `alertsWorker.server.ts`, `batchTriggerWorker.server.ts`; `legacyRunEngineWorker.server.ts` still hosts the live batch-completion jobs)
+- **Queue operations**: RunQueue inside run-engine (`runQueue.server.ts`), not MarQS

.claude/rules/sdk-packages.md

@@ -9,4 +9,4 @@ paths:
 - Default to **patch**. Get maintainer approval for minor. Never select major without explicit approval.
 - `@trigger.dev/core`: **Never import the root**. Always use subpath imports (e.g., `@trigger.dev/core/v3`).
 - Do NOT update `rules/` or `.claude/skills/trigger-dev-tasks/` unless explicitly asked. These are maintained in separate dedicated passes.
-- Test changes using `references/hello-world` reference project.
+- Test changes using the `hello-world` project in the [`triggerdotdev/references`](https://github.com/triggerdotdev/references) repo.

.claude/rules/server-apps.md

@@ -5,7 +5,7 @@ paths:
 
 # Server App Changes
 
-When modifying server apps (webapp, supervisor, coordinator, etc.) with **no package changes**, add a `.server-changes/` file instead of a changeset:
+When modifying server apps (webapp, supervisor, etc.) with **no package changes**, add a `.server-changes/` file instead of a changeset:
 
 ```bash
 cat > .server-changes/descriptive-name.md << 'EOF'
@@ -14,10 +14,12 @@ area: webapp
 type: fix
 ---
 
-Brief description of what changed and why.
+Fix pages occasionally loading unstyled during deploys. The dashboard now recovers automatically.
 EOF
 ```
 
-- **area**: `webapp` | `supervisor` | `coordinator` | `kubernetes-provider` | `docker-provider`
+- **area**: `webapp` | `supervisor`
 - **type**: `feature` | `fix` | `improvement` | `breaking`
 - If the PR also touches `packages/`, just the changeset is sufficient (no `.server-changes/` needed).
+
+The body ships **verbatim in user-facing release notes**. Keep it to 1–2 short sentences, non-technical, written for a dashboard user: describe what changed for them, never the implementation (no header names, endpoints, middleware, storage mechanisms, internal tools). See `.server-changes/README.md` for full guidance.

.claude/skills/drizzle/SKILL.md

@@ -0,0 +1,191 @@
+---
+name: drizzle
+description: Use this skill when writing or modifying Drizzle ORM schemas, queries, or migrations in this repo — specifically the `@internal/dashboard-agent-db` package (the dashboard agent's conversation datastore). Covers pg-core schema definition, the postgres-js driver, drizzle-kit migrations, and this repo's conventions: a dedicated Postgres schema, foreign-key-free cross-database design, pooler-safe connections, and the access-pattern query layer. Drizzle is NOT the main database — that's Prisma.
+allowed-tools: Read, Write, Edit, Glob, Grep, Bash
+---
+
+# Drizzle ORM (this repo)
+
+Drizzle is used in exactly one place: **`internal-packages/dashboard-agent-db`** (`@internal/dashboard-agent-db`), the in-dashboard agent's conversation store. Everything else in the monorepo is **Prisma** (`@trigger.dev/database`). Keep them separate.
+
+Pinned versions: **`drizzle-orm` ^0.45**, **`drizzle-kit` ^0.31** (dev), **`postgres` ^3.4** (postgres.js driver). drizzle-orm and drizzle-kit are intentionally on different version lines — 0.31.x is the correct companion for 0.45.x, there is no peer dependency between them.
+
+## Critical rules
+
+1. **Drizzle is only the agent's own datastore.** The agent (and its task bundle) must have **no access to the main Prisma database or ClickHouse**. Never import the Prisma client into the agent task or into `@internal/dashboard-agent-db`. Main data is reached via the API, not Drizzle.
+2. **Foreign-key-free.** In cloud this DB is a *separate* PlanetScale database, so it can't FK into the main DB. Reference main entities (`organizationId`, `userId`, …) **by id only — never `.references()`**. Joins happen in app code; tenant scoping is enforced in the query layer.
+3. **One dedicated Postgres schema.** All tables live under `pgSchema("trigger_dashboard_agent")` so they're schema-qualified and isolated from Prisma's `public` schema (this is what makes the OSS single-database fallback safe).
+4. **Pooler-safe connections.** Connections go through a transaction-mode pooler (PlanetScale / PgBouncer-style), so postgres.js must run with **`prepare: false`** — prepared statements don't survive a connection being handed to another client between checkouts.
+5. **Node16 module resolution.** Relative imports need explicit **`.js`** extensions (`import { chats } from "./schema.js"`), even though the source is `.ts`.
+6. **Scope every user query.** All queries that touch user data go through `src/queries.ts` and are scoped by `organizationId` / `userId`, so callers can't forget the `where`. Don't write ad-hoc cross-tenant queries elsewhere.
+
+## Package layout
+
+```text
+internal-packages/dashboard-agent-db/
+  drizzle.config.ts      # drizzle-kit config (schema path, out dir, schemaFilter)
+  drizzle/               # generated migrations (committed)
+  src/
+    schema.ts            # pgSchema + table definitions
+    client.ts            # createDashboardAgentDb() — postgres.js + drizzle
+    queries.ts           # the access-pattern layer (org/user-scoped)
+    index.ts             # barrel: re-exports schema, client, queries
+```
+
+`package.json` points `main`/`types` at `./src/index.ts` (consumed as source, no build step) — same as other simple internal packages.
+
+## Schema (pg-core)
+
+Use `pgSchema(...).table(...)`, not the bare `pgTable`, so tables land in the dedicated schema. ([schemas](https://orm.drizzle.team/docs/schemas), [pg column types](https://orm.drizzle.team/docs/column-types/pg), [indexes](https://orm.drizzle.team/docs/indexes-constraints))
+
+```ts
+import { sql } from "drizzle-orm";
+import { index, jsonb, pgSchema, text, timestamp } from "drizzle-orm/pg-core";
+
+export const dashboardAgentSchema = pgSchema("trigger_dashboard_agent");
+
+export const chats = dashboardAgentSchema.table(
+  "chats",
+  {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id").notNull(), // FK-free: id only, no .references()
+    userId: text("user_id").notNull(),
+    title: text("title").notNull().default("New chat"),
+    // JSONB with a typed view; .default([]) / .default({}) emit '[]'::jsonb / '{}'::jsonb
+    messages: jsonb("messages").$type<unknown[]>().notNull().default([]),
+    metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
+    deletedAt: timestamp("deleted_at", { withTimezone: true }), // soft delete
+    lastMessageAt: timestamp("last_message_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  // Extra config returns an ARRAY in drizzle-orm 0.36+ (not an object).
+  (t) => [
+    // Partial + ordered composite index. `.desc()` on the column, `.where(sql`...`)` for partial.
+    index("chats_org_user_last_msg_idx")
+      .on(t.organizationId, t.userId, t.lastMessageAt.desc())
+      .where(sql`${t.deletedAt} is null`),
+  ]
+);
+
+// Inferred row types for the query layer + consumers.
+export type Chat = typeof chats.$inferSelect;
+export type NewChat = typeof chats.$inferInsert;
+```
+
+Notes:
+- `timestamp(..., { withTimezone: true })` → `timestamp with time zone`. Use `.defaultNow()` for `DEFAULT now()`.
+- For a "newest first, nulls last" sort the partial index uses `.desc()`; the *query* uses raw `sql` for `NULLS LAST` (see below).
+- Don't add `.references()` — see critical rule 2.
+
+## Client (postgres.js + drizzle)
+
+([connect overview](https://orm.drizzle.team/docs/connect-overview)) One small pool, `prepare: false`. In the agent task create it once in `onBoot` (per-process); in the webapp wrap it in the `singleton(...)` helper.
+
+```ts
+import { drizzle, type PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import postgres, { type Sql } from "postgres";
+import * as schema from "./schema.js";
+
+export type DashboardAgentDb = PostgresJsDatabase<typeof schema>;
+
+export function createDashboardAgentDb(connectionString: string, opts: { max?: number } = {}) {
+  const sql: Sql = postgres(connectionString, {
+    max: opts.max ?? 5,        // small — the pooler does the real pooling
+    idle_timeout: 20,          // release conns when an agent run suspends
+    prepare: false,            // REQUIRED for transaction-mode poolers
+  });
+  return { db: drizzle(sql, { schema }), sql, close: () => sql.end() };
+}
+```
+
+## Queries (the access-pattern layer)
+
+([select](https://orm.drizzle.team/docs/select), [insert](https://orm.drizzle.team/docs/insert), [operators](https://orm.drizzle.team/docs/operators), [transactions](https://orm.drizzle.team/docs/transactions), [joins](https://orm.drizzle.team/docs/joins))
+
+```ts
+import { and, desc, eq, isNull, sql } from "drizzle-orm";
+
+// Select EXPLICIT columns for list views — never select a large blob (messages)
+// or a secret (tokens) you don't need. `NULLS LAST` needs raw sql in orderBy.
+await db
+  .select({ id: chats.id, title: chats.title, lastMessageAt: chats.lastMessageAt })
+  .from(chats)
+  .where(and(eq(chats.organizationId, orgId), eq(chats.userId, userId), isNull(chats.deletedAt)))
+  .orderBy(sql`${chats.pinnedAt} desc nulls last`, desc(chats.lastMessageAt))
+  .limit(50);
+
+// Idempotent create (avoids a duplicate-key race between two writers).
+await db.insert(chats).values({ id, organizationId: orgId, userId }).onConflictDoNothing();
+
+// Upsert.
+await db
+  .insert(chatSessions)
+  .values({ chatId, publicAccessToken })
+  .onConflictDoUpdate({ target: chatSessions.chatId, set: { publicAccessToken, updatedAt: sql`now()` } });
+
+// Owner-scope a join (this DB is FK-free, so enforce ownership in the query).
+await db
+  .select({ /* session cols */ })
+  .from(chatSessions)
+  .innerJoin(chats, eq(chats.id, chatSessions.chatId))
+  .where(and(eq(chatSessions.chatId, chatId), eq(chats.userId, userId)));
+
+// Multi-write that must be consistent on the next read → one transaction.
+await db.transaction(async (tx) => {
+  await tx.update(chats).set({ messages, updatedAt: sql`now()` }).where(eq(chats.id, chatId));
+  await tx.insert(chatSessions).values({ /* ... */ }).onConflictDoUpdate({ /* ... */ });
+});
+```
+
+Use `sql\`now()\`` for DB-side timestamps in updates.
+
+## Migrations (drizzle-kit)
+
+([kit overview](https://orm.drizzle.team/docs/kit-overview), [generate](https://orm.drizzle.team/docs/drizzle-kit-generate), [migrate](https://orm.drizzle.team/docs/drizzle-kit-migrate))
+
+`drizzle.config.ts` must set **`schemaFilter`** so drizzle-kit only ever manages our schema — never Prisma's `public` (critical in the OSS single-DB fallback):
+
+```ts
+import { defineConfig } from "drizzle-kit";
+export default defineConfig({
+  schema: "./src/schema.ts",
+  out: "./drizzle",
+  dialect: "postgresql",
+  schemaFilter: ["trigger_dashboard_agent"],
+  dbCredentials: { url: process.env.DASHBOARD_AGENT_DATABASE_URL ?? process.env.DATABASE_URL ?? "postgres://placeholder" },
+});
+```
+
+Workflow:
+
+```bash
+cd internal-packages/dashboard-agent-db
+pnpm run db:generate   # diff schema.ts → emit SQL into drizzle/. OFFLINE (no DB needed).
+#   review the generated drizzle/000N_*.sql before committing
+pnpm run db:migrate    # apply pending migrations. Needs a real DATABASE URL.
+```
+
+- `db:generate` is **offline** — it only reads `schema.ts`, so you can verify a schema change compiles to valid DDL with no database. Use it as a fast check.
+- drizzle-kit names migration files with a **random suffix** (`0000_magenta_lilandra.sql`). Don't regenerate a committed migration just to "refresh" it — that churns the filename. After the first migration is committed, schema changes produce a **new** `000N_*.sql`; commit that.
+- Generated DDL for a new schema is one `CREATE SCHEMA` + schema-qualified `CREATE TABLE`s + indexes, **no foreign keys** (by design here).
+
+## Common gotchas
+
+- **`prepare: false`** is not optional with a pooler — without it you'll get prepared-statement errors under load.
+- **Missing `.js` extension** on a relative import → TS2835 under Node16 resolution.
+- **Extra-config callback returns an array** `(t) => [ ... ]` in drizzle-orm 0.36+. The old object form `(t) => ({ ... })` is deprecated.
+- **`NULLS LAST` / `NULLS FIRST`** aren't on the `desc()` helper — use raw `sql\`col desc nulls last\`` in `orderBy`.
+- **Don't `SELECT *` into list views** — explicitly pick columns so you never ship a megabyte `messages` blob or a session token to a list query.
+- **Adding a dependency**: edit `package.json`, then `pnpm i` from the repo root (never `pnpm add`). Mind the repo's `minimumReleaseAge` (3 days) — pin with a caret range and let pnpm resolve an old-enough version.
+
+## Reference (official docs)
+
+- Schema declaration — https://orm.drizzle.team/docs/sql-schema-declaration
+- PostgreSQL column types — https://orm.drizzle.team/docs/column-types/pg
+- Schemas (`pgSchema`) — https://orm.drizzle.team/docs/schemas
+- Indexes & constraints — https://orm.drizzle.team/docs/indexes-constraints
+- Connect (postgres-js) — https://orm.drizzle.team/docs/connect-overview
+- Select / Insert / Update / Delete — https://orm.drizzle.team/docs/select · /insert · /update · /delete
+- Joins / Operators — https://orm.drizzle.team/docs/joins · /operators
+- Transactions — https://orm.drizzle.team/docs/transactions
+- drizzle-kit (generate / migrate / push) — https://orm.drizzle.team/docs/kit-overview

.claude/skills/errors-api-e2e/SKILL.md

@@ -0,0 +1,199 @@
+---
+name: errors-api-e2e
+description: End-to-end smoke test for the public Errors HTTP API (error groups). Seeds failed runs into ClickHouse so the error materialized views populate, then drives the real endpoints against the running webapp — list (with filters + pagination), retrieve, resolve/ignore/unresolve, the `filter[error]` runs filter, user attribution via the `trigger.dev mint-token` -> JWT exchange, and the 401/403/404 negatives. Use for "smoke test the errors API", "test the errors API e2e", "prove the errors endpoints work", or to re-verify after changes.
+allowed-tools: Read, Bash
+---
+
+# Errors API — end-to-end smoke test
+
+Proves the public Errors API against the **running** webapp with real HTTP. No
+mocks. The error data plane is ClickHouse (`errors_v1` + `error_occurrences_v1`,
+both materialized-view-fed from `task_runs_v2`) plus Postgres `ErrorGroupState`
+for lifecycle status; this skill seeds straight into `task_runs_v2` and lets the
+MVs do the rest.
+
+Code under test:
+- `apps/webapp/app/routes/api.v1.errors.ts` — `GET /api/v1/errors` (list).
+- `apps/webapp/app/routes/api.v1.errors.$errorId.ts` — `GET /api/v1/errors/:errorId` (detail).
+- `apps/webapp/app/routes/api.v1.errors.$errorId.{resolve,ignore,unresolve}.ts` — state actions.
+- `apps/webapp/app/presenters/v3/ApiErrorListPresenter.server.ts` / `ApiErrorGroupPresenter.server.ts`.
+- `apps/webapp/app/presenters/v3/ApiRunListPresenter.server.ts` — the `filter[error]` addition on `GET /api/v1/runs`.
+- `apps/webapp/app/v3/services/errorGroupActions.server.ts` — resolve/ignore/unresolve (nullable `userId`).
+- Attribution: `api.v1.projects.$projectRef.$env.jwt.ts` stamps `act:{sub}` for PAT **and** UAT exchanges; `@trigger.dev/rbac` surfaces `act.sub` through bearer auth; the action handlers read `authentication.actor?.sub`.
+
+`errorId` is `error_<fingerprint>` (round-trips via `ErrorId` in `@trigger.dev/core/v3/isomorphic`).
+
+## Prerequisites
+
+- Webapp running on http://localhost:3030 (`pnpm run dev --filter webapp`). Confirm `curl -s http://localhost:3030/healthcheck`.
+- DB seeded (`pnpm run db:seed`), and a local ClickHouse reachable at `CLICKHOUSE_URL` (the `pnpm run docker` stack).
+- The CLI built + logged in to localhost:3030 (`pnpm run build --filter trigger.dev`; profile `default` points at localhost:3030). Needed only for the attribution leg.
+
+> Important wiring facts the seed relies on (verified):
+> - The MVs read the error type/message from `error.data.*`, so the seeded
+>   `error` JSON column **must** be wrapped: `{"data": {"type": ..., "message": ..., "stack": ...}}`.
+> - The MVs only fire for failed statuses: `SYSTEM_FAILURE | CRASHED | INTERRUPTED | COMPLETED_WITH_ERRORS | TIMED_OUT`, and require a non-empty `error_fingerprint`.
+> - `GET /api/v1/runs` lists run **ids** from ClickHouse but **hydrates from Postgres** `TaskRun`. So the error-list/detail/action legs work from a ClickHouse-only seed, but the `filter[error]` leg needs a **paired** Postgres `TaskRun` row whose `id` equals the ClickHouse `run_id`.
+
+Run everything from the repo root in one shell. Invoke the built CLI via a
+function (a `CLI="node …"` variable won't word-split under zsh):
+```bash
+cli() { node packages/cli-v3/dist/esm/index.js "$@"; }
+PROFILE=default
+```
+
+## Setup — resolve a dev environment + connection strings
+
+```bash
+cd apps/webapp
+CHURL=$(grep -E "^CLICKHOUSE_URL=" .env | head -1 | cut -d= -f2- | tr -d '"')
+DBURL=$(grep -E "^DATABASE_URL=" .env | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'" | sed 's/?.*//')
+
+# Pick the seeded hello-world dev env (proj_rrkpdguyagvsoktglnod). Adjust the
+# WHERE if you want a different project.
+read ENV ORG PROJ REF < <(psql "$DBURL" -t -A -F' ' -c "
+  SELECT re.id, re.\"organizationId\", re.\"projectId\", p.\"externalRef\"
+  FROM \"RuntimeEnvironment\" re
+  JOIN \"Project\" p ON p.id = re.\"projectId\"
+  WHERE re.slug='dev' AND p.\"externalRef\"='proj_rrkpdguyagvsoktglnod' LIMIT 1;")
+APIKEY=$(psql "$DBURL" -t -A -c "SELECT \"apiKey\" FROM \"RuntimeEnvironment\" WHERE id='$ENV';")
+cd ..
+H="Authorization: Bearer $APIKEY"
+B="http://localhost:3030"
+```
+
+## Steps
+
+### 1. Seed two error groups (ClickHouse, MV-fed)
+
+```bash
+RUN=$(node -e 'console.log(Date.now().toString(36))')
+TASK="errors-api-e2e-$RUN"; FP_A="fpA${RUN}"; FP_B="fpB${RUN}"
+ERRID_A="error_$FP_A"; ERRID_B="error_$FP_B"
+NOW_CH=$(node -e 'console.log(new Date().toISOString().replace("T"," ").replace("Z","").slice(0,23))')
+NOW_MS=$(node -e 'console.log(Date.now())')
+Q=$(python3 -c "import urllib.parse;print(urllib.parse.quote('INSERT INTO trigger_dev.task_runs_v2 FORMAT JSONEachRow'))")
+
+mkrow() { # status fingerprint errorType message runId
+  echo "{\"environment_id\":\"$ENV\",\"organization_id\":\"$ORG\",\"project_id\":\"$PROJ\",\"run_id\":\"$5\",\"friendly_id\":\"run_$5\",\"status\":\"$1\",\"environment_type\":\"DEVELOPMENT\",\"engine\":\"V2\",\"task_identifier\":\"$TASK\",\"created_at\":\"$NOW_CH\",\"updated_at\":\"$NOW_CH\",\"error\":{\"data\":{\"type\":\"$3\",\"message\":\"$4\",\"stack\":\"at x (a.ts:1:1)\"}},\"error_fingerprint\":\"$2\",\"task_version\":\"20240101.1\",\"_version\":\"$NOW_MS\",\"_is_deleted\":0}"
+}
+ROWS="$(mkrow COMPLETED_WITH_ERRORS $FP_A AlphaBoom 'alpha boom happened' r_a1_$RUN)
+$(mkrow COMPLETED_WITH_ERRORS $FP_A AlphaBoom 'alpha boom happened' r_a2_$RUN)
+$(mkrow CRASHED $FP_B BetaCrash 'beta crash happened' r_b1_$RUN)"
+printf '%s' "$ROWS" | curl -s "$CHURL/?query=$Q" --data-binary @-
+
+# Poll until both fingerprints appear in errors_v1 (the MV is near-instant locally).
+for i in $(seq 1 10); do
+  N=$(curl -s "$CHURL" --data-binary "SELECT count() FROM (SELECT 1 FROM trigger_dev.errors_v1 WHERE environment_id='$ENV' AND error_fingerprint IN ('$FP_A','$FP_B') GROUP BY error_fingerprint)")
+  [ "$N" = "2" ] && break; sleep 1
+done
+echo "seeded fingerprints in errors_v1: $N (want 2)"
+```
+PASS: `N = 2`. Alpha has 2 occurrences, beta 1.
+
+### 2. List + filters + pagination
+
+```bash
+curl -s "$B/api/v1/errors?filter%5BtaskIdentifier%5D=$TASK&filter%5Bperiod%5D=1d" -H "$H" \
+  | python3 -c "import sys,json;d=json.load(sys.stdin);print('count',len(d['data']),[(e['id'],e['status'],e['count']) for e in d['data']])"
+```
+PASS: 2 groups, both `status=unresolved`, alpha `count=2`, beta `count=1`, ids `error_<fp>`.
+
+Assert each filter narrows correctly (each should return the noted shape):
+```bash
+curl -s "$B/api/v1/errors?filter%5BtaskIdentifier%5D=$TASK&filter%5Bstatus%5D=unresolved&filter%5Bperiod%5D=1d" -H "$H" | python3 -c "import sys,json;print('unresolved:',len(json.load(sys.stdin)['data']))"   # 2
+curl -s "$B/api/v1/errors?filter%5BtaskIdentifier%5D=$TASK&filter%5Bsearch%5D=AlphaBoom&filter%5Bperiod%5D=1d" -H "$H" | python3 -c "import sys,json;print('search:',[e['errorType'] for e in json.load(sys.stdin)['data']])"   # ['AlphaBoom']
+curl -s "$B/api/v1/errors?filter%5BtaskIdentifier%5D=$TASK&filter%5Bperiod%5D=1d&page%5Bsize%5D=1" -H "$H" | python3 -c "import sys,json;d=json.load(sys.stdin);print('page size 1:',len(d['data']),'next?',bool(d['pagination'].get('next')))"   # 1 / True
+```
+PASS: `unresolved: 2`, `search: ['AlphaBoom']`, `page size 1: 1 / next? True`.
+
+### 3. Retrieve detail
+
+```bash
+curl -s "$B/api/v1/errors/$ERRID_A" -H "$H" \
+  | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['id'],d['errorType'],d['status'],d['count'],d['affectedVersions'],d['resolvedBy'])"
+```
+PASS: `error_<fpA> AlphaBoom unresolved 2 ['20240101.1'] None`.
+
+### 4. Resolve / ignore / unresolve (env API key — `resolvedBy` null)
+
+```bash
+st(){ python3 -c "import sys,json;d=json.load(sys.stdin);print('status',d['status'],'| resolvedInVersion',d['resolvedInVersion'],'| resolvedBy',d['resolvedBy'],'| ignoredUntil',bool(d['ignoredUntil']),'| reason',d['ignoredReason'])"; }
+
+curl -s -X POST "$B/api/v1/errors/$ERRID_A/resolve" -H "$H" -H 'Content-Type: application/json' -d '{"resolvedInVersion":"20240101.1"}' >/dev/null
+curl -s "$B/api/v1/errors/$ERRID_A" -H "$H" | st   # status resolved | resolvedInVersion 20240101.1 | resolvedBy None
+
+curl -s -X POST "$B/api/v1/errors/$ERRID_B/ignore" -H "$H" -H 'Content-Type: application/json' -d '{"duration":3600000,"reason":"known flake"}' >/dev/null
+curl -s "$B/api/v1/errors/$ERRID_B" -H "$H" | st   # status ignored | ignoredUntil True | reason known flake
+
+curl -s -X POST "$B/api/v1/errors/$ERRID_A/unresolve" -H "$H" >/dev/null
+curl -s "$B/api/v1/errors/$ERRID_A" -H "$H" | st   # status unresolved
+```
+PASS: each transition reflected; `filter[status]=ignored` returns only beta:
+```bash
+curl -s "$B/api/v1/errors?filter%5BtaskIdentifier%5D=$TASK&filter%5Bstatus%5D=ignored&filter%5Bperiod%5D=1d" -H "$H" | python3 -c "import sys,json;print([e['id'] for e in json.load(sys.stdin)['data']])"   # [error_<fpB>]
+```
+
+### 5. `filter[error]` on the runs list (paired PG + CH seed)
+
+The runs list hydrates from Postgres, so seed a matching `TaskRun` row + a CH row
+that share `run_id`/`id` and carry a fingerprint:
+```bash
+RID="re2e${RUN}"; FRID="run_${RID}"; FP_R="fpR${RUN}"
+psql "$DBURL" -v ON_ERROR_STOP=1 -c "
+  INSERT INTO \"TaskRun\" (id, \"friendlyId\", \"taskIdentifier\", payload, \"traceId\", \"spanId\", \"runtimeEnvironmentId\", \"projectId\", queue, status, \"createdAt\", \"updatedAt\")
+  VALUES ('$RID','$FRID','$TASK','{}','trace_$RID','span_$RID','$ENV','$PROJ','task/$TASK','COMPLETED_WITH_ERRORS', now(), now())
+  ON CONFLICT (id) DO NOTHING;" >/dev/null
+ROW="{\"environment_id\":\"$ENV\",\"organization_id\":\"$ORG\",\"project_id\":\"$PROJ\",\"run_id\":\"$RID\",\"friendly_id\":\"$FRID\",\"status\":\"COMPLETED_WITH_ERRORS\",\"environment_type\":\"DEVELOPMENT\",\"engine\":\"V2\",\"task_identifier\":\"$TASK\",\"created_at\":\"$NOW_CH\",\"updated_at\":\"$NOW_CH\",\"error\":{\"data\":{\"type\":\"RunsFilterErr\",\"message\":\"for runs filter\",\"stack\":\"at x\"}},\"error_fingerprint\":\"$FP_R\",\"task_version\":\"20240101.1\",\"_version\":\"$NOW_MS\",\"_is_deleted\":0}"
+printf '%s' "$ROW" | curl -s "$CHURL/?query=$Q" --data-binary @-
+sleep 1
+curl -s "$B/api/v1/runs?filter%5Berror%5D=error_$FP_R" -H "$H" | python3 -c "import sys,json;d=json.load(sys.stdin);print('runs:',[r['id'] for r in d['data']])"
+```
+PASS: one run, `run_<RID>` (status maps to `FAILED`). Proves `filter[error]` -> fingerprint -> CH -> PG hydration.
+
+### 6. Attribution — `mint-token` -> JWT exchange records the acting user
+
+```bash
+TOKEN=$(cli mint-token --profile $PROFILE --client errors-api-e2e 2>/dev/null)            # UAT
+ENVJWT=$(curl -sS -X POST "$B/api/v1/projects/$REF/dev/jwt" -H "Authorization: Bearer $TOKEN" \
+  -H 'Content-Type: application/json' -d '{"claims":{"scopes":["read:errors","write:errors"]}}' \
+  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
+# Decoded env JWT carries act.sub = the user id.
+node -e 'const p=JSON.parse(Buffer.from(process.argv[1].split(".")[1],"base64url").toString());console.log("act:",JSON.stringify(p.act))' "$ENVJWT"
+
+curl -s -X POST "$B/api/v1/errors/$ERRID_A/resolve" -H "Authorization: Bearer $ENVJWT" \
+  -H 'Content-Type: application/json' -d '{"resolvedInVersion":"20240101.2"}' >/dev/null
+curl -s "$B/api/v1/errors/$ERRID_A" -H "$H" | python3 -c "import sys,json;d=json.load(sys.stdin);print('resolvedBy:',d['resolvedBy'])"
+```
+PASS: `act.sub` is the user id (matches `cli whoami`), and `detail.resolvedBy` equals that user id (not null). A plain env key leaves it null (step 4). A **PAT** exchanged the same way also stamps `act` — repeat with the stored PAT to confirm `ignoredByUserId` attribution.
+
+### 7. Negatives
+
+```bash
+curl -s -o /dev/null -w 'unknown id: %{http_code} (404)\n'        "$B/api/v1/errors/error_doesnotexist0000" -H "$H"
+curl -s -o /dev/null -w 'no auth list: %{http_code} (401)\n'      "$B/api/v1/errors"
+curl -s -o /dev/null -w 'no auth resolve: %{http_code} (401)\n'   -X POST "$B/api/v1/errors/$ERRID_B/resolve" -H 'Content-Type: application/json' -d '{}'
+
+# read-only JWT must be denied on write, allowed on read
+READJWT=$(curl -sS -X POST "$B/api/v1/projects/$REF/dev/jwt" -H "Authorization: Bearer $TOKEN" \
+  -H 'Content-Type: application/json' -d '{"claims":{"scopes":["read:errors"]}}' | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
+curl -s -o /dev/null -w 'read JWT write: %{http_code} (403)\n'    -X POST "$B/api/v1/errors/$ERRID_B/resolve" -H "Authorization: Bearer $READJWT" -H 'Content-Type: application/json' -d '{}'
+curl -s -o /dev/null -w 'read JWT read: %{http_code} (200)\n'     "$B/api/v1/errors?filter%5BtaskIdentifier%5D=$TASK" -H "Authorization: Bearer $READJWT"
+```
+PASS: `404`, `401`, `401`, `403`, `200` respectively.
+
+## Result
+
+Report PASS only if: step 1 lands 2 groups in `errors_v1`; step 2's filters and
+pagination narrow correctly; step 3 returns the detail; step 4's resolve/ignore/
+unresolve flip status (and `filter[status]` follows); step 5's `filter[error]`
+returns the paired run; step 6 records `resolvedBy` = the acting user via the
+JWT exchange (null with a plain env key); and step 7 returns 404/401/401/403/200.
+A red leg is a bug or a missing prereq — report the exact status + body and file
+a Linear issue, don't tune around it.
+
+## Notes / gotchas
+
+- Run files use a unique `$RUN` suffix per invocation, so reruns don't collide and seeded rows stay isolated by their unique task identifier. They are local-dev test rows (90-day ClickHouse TTL); no cleanup required.
+- After **adding** the route files, the classic Remix dev compiler may not register them until a dev-server restart (a stale manifest returns Remix's HTML 404 on the new paths). If `POST …/resolve` returns a 404 HTML page rather than 401/200, restart `pnpm run dev --filter webapp`.
+- The rbac `act` extraction lives in `@trigger.dev/rbac` (a built dep). After editing it, `pnpm run build --filter @trigger.dev/rbac` and restart the webapp so the attribution leg (step 6) reflects the change.

.configs/tsconfig.base.json

@@ -26,7 +26,6 @@
     "esModuleInterop": true,
     "emitDecoratorMetadata": false,
     "experimentalDecorators": false,
-    "downlevelIteration": true,
     "isolatedModules": true,
     "noUncheckedIndexedAccess": true,
 

.cursor/mcp.json

@@ -1,3 +1,7 @@
 {
-  "mcpServers": {}
+  "mcpServers": {
+    "linear": {
+      "url": "https://mcp.linear.app/mcp"
+    }
+  }
 }

.cursorignore

@@ -1,7 +1,4 @@
-apps/docker-provider/
-apps/kubernetes-provider/
 apps/proxy/
-apps/coordinator/
 packages/rsc/
 .changeset
 .zed

.env.example

@@ -2,12 +2,18 @@
 SESSION_SECRET=abcdef1234
 MAGIC_LINK_SECRET=abcdef1234
 ENCRYPTION_KEY=ae13021afef0819c3a307ad487071c06 # Must be a random 16 byte hex string. You can generate an encryption key by running `openssl rand -hex 16` in your terminal
+MANAGED_WORKER_SECRET=abcdef1234 # Must match the supervisor's MANAGED_WORKER_SECRET
 LOGIN_ORIGIN=http://localhost:3030
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/postgres?schema=public
 # This sets the URL used for direct connections to the database and should only be needed in limited circumstances
 # See: https://www.prisma.io/docs/reference/api-reference/prisma-schema-reference#fields:~:text=the%20shadow%20database.-,directUrl,-No
-DIRECT_URL=${DATABASE_URL}
+DIRECT_URL=postgresql://postgres:postgres@localhost:5432/postgres?schema=public
+# Dedicated run-ops database (@internal/run-ops-database). Only needed to run prisma commands
+# against it or to enable the run-ops split; start it with `docker compose --profile runops up`.
+RUN_OPS_DATABASE_URL=postgresql://postgres:postgres@localhost:5434/postgres?schema=public
 REMIX_APP_PORT=3030
+# Dev-only: stream the webapp's logs over a local telnet/TCP socket (nc localhost 6767). Uncomment to enable.
+# WEBAPP_TELNET_LOGS_PORT=6767
 APP_ENV=development
 APP_ORIGIN=http://localhost:3030
 ELECTRIC_ORIGIN=http://localhost:3060
@@ -17,6 +23,11 @@ NODE_ENV=development
 CLICKHOUSE_URL=http://default:password@localhost:8123
 RUN_REPLICATION_CLICKHOUSE_URL=http://default:password@localhost:8123
 RUN_REPLICATION_ENABLED=1
+# Store task run spans/traces in ClickHouse so the dashboard trace view is
+# populated in local dev. The local stack is ClickHouse-backed (see above), so
+# leaving this unset falls back to the "postgres" store and dev run traces show
+# up empty even though the run itself appears.
+EVENT_REPOSITORY_DEFAULT_STORE=clickhouse_v2
 
 # Set this to UTC because Node.js uses the system timezone
 TZ="UTC"
@@ -156,4 +167,4 @@ POSTHOG_PROJECT_KEY=
 # Uncomment these to send metrics to the local Prometheus via OTEL Collector:
 # INTERNAL_OTEL_METRIC_EXPORTER_ENABLED=1
 # INTERNAL_OTEL_METRIC_EXPORTER_URL=http://localhost:4318/v1/metrics
-# INTERNAL_OTEL_METRIC_EXPORTER_INTERVAL_MS=15000
+# INTERNAL_OTEL_METRIC_EXPORTER_INTERVAL_MS=15000

.eslintignore

@@ -1,4 +0,0 @@
-*/**.js
-*/**.d.ts
-packages/*/dist
-packages/*/lib

.github/VOUCHED.td

@@ -21,4 +21,9 @@ chengzp
 bharathkumar39293
 bhekanik
 jrossi
-ThullyoCunha
+ThullyoCunha
+ConProgramming
+saasjesus
+brentshulman-silkline
+Leafgard
+Rohan170603

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+self-hosted-runner:
+  labels:
+    - warp-ubuntu-*
+    - warp-macos-*
+    - warp-windows-*

.github/labeler.yml

@@ -9,4 +9,4 @@
   - any: ["**/*.md"]
 
 "📌 area: ci":
-  - any: [".github/**/*"]
+  - any: [".github/**/*"]

.github/workflows/changesets-pr.yml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   release-pr:
     name: Create Release PR
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: write
       pull-requests: write
@@ -26,7 +26,7 @@ jobs:
     if: github.repository == 'triggerdotdev/trigger.dev'
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path
         with:
           fetch-depth: 0
 
@@ -36,7 +36,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: Install dependencies
@@ -44,7 +44,7 @@ jobs:
 
       - name: Create release PR
         id: changesets
-        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           version: pnpm run changeset:version
           commit: "chore: release"

.github/workflows/check-review-md.yml

@@ -7,7 +7,6 @@ on:
       - "docs/**"
       - ".changeset/**"
       - ".server-changes/**"
-      - "references/**"
 
 concurrency:
   group: review-md-drift-${{ github.event.pull_request.number }}
@@ -15,28 +14,31 @@ concurrency:
 
 jobs:
   audit:
+    # Set the ENABLE_CLAUDE_CODE repository variable to 'false' to turn off Claude
+    # jobs; leave it unset (the default) to keep them enabled.
     if: >-
+      vars.ENABLE_CLAUDE_CODE != 'false' &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: read
       pull-requests: write
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa # v1.0.111
+        uses: anthropics/claude-code-action@428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d # v1.0.157
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           use_sticky_comment: true
-          allowed_bots: "devin-ai-integration[bot]"
+          allowed_bots: "devin-ai-integration[bot],claude[bot]"
 
           claude_args: |
             --max-turns 30

.github/workflows/claude-md-audit.yml

@@ -1,4 +1,4 @@
-name: 📝 CLAUDE.md Audit
+name: 📝 Agent Instructions Audit
 
 on:
   pull_request:
@@ -8,18 +8,20 @@ on:
       - ".changeset/**"
       - ".server-changes/**"
       - "**/*.md"
-      - "references/**"
 
 concurrency:
-  group: claude-md-audit-${{ github.event.pull_request.number }}
+  group: agent-instructions-audit-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 jobs:
   audit:
+    # Set the ENABLE_CLAUDE_CODE repository variable to 'false' to turn off Claude
+    # jobs; leave it unset (the default) to keep them enabled.
     if: >-
+      vars.ENABLE_CLAUDE_CODE != 'false' &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: read
       pull-requests: write
@@ -27,47 +29,55 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa # v1.0.111
+        uses: anthropics/claude-code-action@428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d # v1.0.157
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           use_sticky_comment: true
-          allowed_bots: "devin-ai-integration[bot]"
+          allowed_bots: "devin-ai-integration[bot],claude[bot]"
 
           claude_args: |
-            --max-turns 15
+            --max-turns 25
+            --model claude-opus-4-8
             --allowedTools "Read,Glob,Grep,Bash(git diff:*)"
 
           prompt: |
-            You are reviewing a PR to check whether any CLAUDE.md files or .claude/rules/ files need updating.
+            You are reviewing a PR to check whether any agent instruction files need updating.
+
+            In this repo:
+            - Root shared agent guidance lives in `AGENTS.md`.
+            - Root `CLAUDE.md` is only a Claude Code adapter that imports `AGENTS.md`.
+            - Subdirectories may still have scoped `CLAUDE.md` files.
+            - `.claude/rules/` contains additional Claude Code guidance.
 
             ## Your task
 
             1. Run `git diff origin/main...HEAD --name-only` to see which files changed in this PR.
-            2. For each changed directory, check if there's a CLAUDE.md in that directory or a parent directory.
-            3. Determine if any CLAUDE.md or .claude/rules/ file should be updated based on the changes. Consider:
+            2. For each changed directory, check the applicable instruction files: root `AGENTS.md`, any `CLAUDE.md` in that directory or a parent directory, and relevant `.claude/rules/` files.
+            3. Determine if any instruction file should be updated based on the changes. Consider:
                - New files/directories that aren't covered by existing documentation
-               - Changed architecture or patterns that contradict current CLAUDE.md guidance
-               - New dependencies, services, or infrastructure that Claude should know about
-               - Renamed or moved files that are referenced in CLAUDE.md
+               - Changed architecture or patterns that contradict current agent guidance
+               - New dependencies, services, or infrastructure that agents should know about
+               - Renamed or moved files that are referenced in an instruction file
                - Changes to build commands, test patterns, or development workflows
 
             ## Response format
 
             If NO updates are needed, respond with exactly:
-            ✅ CLAUDE.md files look current for this PR.
+            ✅ Agent instruction files look current for this PR.
 
             If updates ARE needed, respond with a short list:
-            📝 **CLAUDE.md updates suggested:**
+            📝 **Agent instruction updates suggested:**
+            - `AGENTS.md`: [what should be added/changed]
             - `path/to/CLAUDE.md`: [what should be added/changed]
             - `.claude/rules/file.md`: [what should be added/changed]
 
-            Keep suggestions specific and brief. Only flag things that would actually mislead Claude in future sessions.
+            Keep suggestions specific and brief. Only flag things that would actually mislead agents in future sessions.
             Do NOT suggest updates for trivial changes (bug fixes, small refactors within existing patterns).
-            Do NOT suggest creating new CLAUDE.md files - only updates to existing ones.
+            Do NOT suggest creating new CLAUDE.md files - only updates to existing instruction files.

.github/workflows/claude.yml

@@ -12,12 +12,17 @@ on:
 
 jobs:
   claude:
+    # Set the ENABLE_CLAUDE_CODE repository variable to 'false' to turn off Claude
+    # jobs; leave it unset (the default) to keep them enabled.
     if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
+      vars.ENABLE_CLAUDE_CODE != 'false' &&
+      (
+        (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+        (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      )
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: write
       pull-requests: write
@@ -26,7 +31,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -39,7 +44,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
@@ -50,7 +55,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa # v1.0.111
+        uses: anthropics/claude-code-action@428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d # v1.0.157
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 

.github/workflows/code-quality.yml

@@ -0,0 +1,38 @@
+name: "🎨 Format & Lint"
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  code-quality:
+    runs-on: warp-ubuntu-latest-x64-2x
+
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      - name: 💅 Check formatting
+        run: pnpm exec oxfmt --check .
+
+      - name: 🔎 Lint
+        run: pnpm exec oxlint .

.github/workflows/dashboard-agent-deploy.yml

@@ -0,0 +1,72 @@
+name: "🤖 Deploy dashboard agent"
+
+# Deploys the @internal/dashboard-agent chat.agent to its Trigger.dev project
+# with --skip-promotion, so a deploy never becomes "current" on its own. The
+# consuming app cuts over by pinning DASHBOARD_AGENT_VERSION to the new version.
+# Runs a leg per environment (staging + prod), each gated by its own environment;
+# a push to main that touches the agent or its store triggers both. Version
+# numbers are per-environment, so pin each environment to its own leg's version.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "internal-packages/dashboard-agent/**"
+      - "internal-packages/dashboard-agent-db/**"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  deploy:
+    name: Deploy dashboard agent (${{ matrix.environment }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      # One environment at a time: parallel deploys of the same project race.
+      max-parallel: 1
+      matrix:
+        environment: [staging, prod]
+    # Per-environment reviewer gate + source of the scoped deploy PAT.
+    environment: dashboard-agent-${{ matrix.environment }}
+    concurrency:
+      group: dashboard-agent-deploy-${{ matrix.environment }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+    env:
+      TRIGGER_API_URL: https://api.trigger.dev
+      TRIGGER_DASHBOARD_AGENT_PROJECT_REF: ${{ vars.TRIGGER_DASHBOARD_AGENT_PROJECT_REF }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: Setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: Install + build the CLI and the agent's deps
+        run: |
+          set -euo pipefail
+          pnpm install --frozen-lockfile
+          # Prisma client is needed because the build closure pulls in @trigger.dev/database.
+          pnpm run generate
+          # Config-time imports the agent's trigger.config.ts needs: defineConfig (sdk), aptGet (build).
+          pnpm run build --filter trigger.dev --filter @trigger.dev/build --filter @trigger.dev/sdk
+
+      - name: Deploy (--skip-promotion)
+        working-directory: internal-packages/dashboard-agent
+        env:
+          TRIGGER_ACCESS_TOKEN: ${{ secrets.TRIGGER_DASHBOARD_AGENT_DEPLOY_TOKEN }}
+        # Invoke the built CLI directly (what the workspace .bin/trigger wrapper does),
+        # so a not-yet-linked bin after a fresh install can't break the deploy.
+        run: node ../../packages/cli-v3/dist/esm/index.js deploy --skip-promotion --env ${{ matrix.environment }}

.github/workflows/dependabot-weekly-summary.yml

@@ -1,206 +0,0 @@
-name: Dependabot Weekly Summary
-
-on:
-  schedule:
-    - cron: "0 8 * * 1"  # Mon 08:00 UTC
-  workflow_dispatch:
-
-# Single-purpose monitoring workflow; serialise on workflow name only - we never
-# want two concurrent summary runs racing to post the same digest.
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read       # gh CLI baseline
-  pull-requests: read  # gh pr list (open dependabot PRs)
-  actions: read        # gh run list / view (parse latest dependabot run logs)
-
-jobs:
-  summary:
-    name: Post weekly Dependabot summary
-    runs-on: ubuntu-latest
-    environment: dependabot-summary
-    env:
-      # Severities surface in the actions list when their remaining TTR drops
-      # below this many days. Override via repo/env var ACTION_THRESHOLD_DAYS.
-      THRESHOLD_DAYS: ${{ vars.ACTION_THRESHOLD_DAYS || '7' }}
-    steps:
-      - name: Fetch alerts and compute summaries
-        id: alerts
-        env:
-          GH_TOKEN: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          if ! gh api -X GET "/repos/$REPO/dependabot/alerts" --paginate > pages.json 2> err.txt; then
-            echo "total=?" >> "$GITHUB_OUTPUT"
-            ERR=$(head -c 200 err.txt | tr '\n' ' ')
-            echo "by_severity=:x: _failed to fetch alerts: ${ERR}_" >> "$GITHUB_OUTPUT"
-            echo "actions=:x: _alerts unavailable_" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          jq -s '[.[][] | select(.state == "open")]' pages.json > open.json
-
-          TOTAL=$(jq 'length' open.json)
-          echo "total=$TOTAL" >> "$GITHUB_OUTPUT"
-
-          if [ "$TOTAL" = "0" ]; then
-            echo "by_severity=:white_check_mark: No open alerts." >> "$GITHUB_OUTPUT"
-            echo "actions=_None_" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Severity breakdown - real newlines so jq --arg in the payload
-          # builder encodes them as proper \n in JSON (Slack renders as breaks).
-          BY_SEV=$(jq -r '
-            group_by(.security_advisory.severity)
-            | map({sev: .[0].security_advisory.severity,
-                   count: length,
-                   weight: ({"critical":0,"high":1,"medium":2,"low":3}[.[0].security_advisory.severity])})
-            | sort_by(.weight)
-            | map("• *\(.count)* \(.sev)")
-            | join("\n")
-          ' open.json)
-          {
-            echo "by_severity<<EOF"
-            echo "$BY_SEV"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
-          # Actions: alerts within THRESHOLD_DAYS of their TTR (P0=7d, P1=30d, P2=90d, P3=no deadline)
-          # Grouped by (package, severity); shows earliest deadline per group.
-          ACTIONS=$(jq -r --argjson threshold "$THRESHOLD_DAYS" '
-            [.[]
-              | (.security_advisory.severity) as $sev
-              | ({"critical":7,"high":30,"medium":90,"low":null}[$sev]) as $ttr
-              | select($ttr != null)
-              | ((now - (.created_at | fromdateiso8601)) / 86400 | floor) as $age
-              | {pkg: .dependency.package.name, sev: $sev, remaining: ($ttr - $age)}
-            ]
-            | group_by([.pkg, .sev])
-            | map({pkg: .[0].pkg, sev: .[0].sev, count: length, min_remaining: ([.[].remaining] | min)})
-            | map(select(.min_remaining < $threshold))
-            | sort_by(.min_remaining)
-            | if length == 0 then "_None_"
-              else (map(
-                "• *\(.pkg)* (\(.sev))" +
-                (if .count > 1 then " ×\(.count)" else "" end) + " - " +
-                (if .min_remaining < 0 then "*OVERDUE* by \(-.min_remaining)d"
-                 else "\(.min_remaining)d remaining" end)
-              ) | join("\n"))
-              end
-          ' open.json)
-          {
-            echo "actions<<EOF"
-            echo "$ACTIONS"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Fetch open dependabot PRs
-        id: prs
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          REPO_URL: https://github.com/${{ github.repository }}
-        run: |
-          if ! PR_JSON=$(gh pr list --repo "$REPO" --state open --author "app/dependabot" --json number,title 2> err.txt); then
-            ERR=$(head -c 200 err.txt | tr '\n' ' ')
-            echo "list=:x: _failed to fetch PRs: ${ERR}_" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          LIST=$(echo "$PR_JSON" | jq -r --arg url "$REPO_URL" '
-            if length == 0 then "_None_"
-            else (map("• <\($url)/pull/\(.number)|#\(.number)> \(.title)") | join("\n"))
-            end
-          ')
-          {
-            echo "list<<EOF"
-            echo "$LIST"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Find latest npm dependabot run
-        id: latest
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          # Repos without a dependabot.yml have no "Dependabot Updates" workflow;
-          # treat the lookup failure as "no recent run found" rather than failing.
-          if ! RUN_ID=$(gh run list --repo "$REPO" --workflow "Dependabot Updates" --status success --limit 30 --json databaseId,name --jq 'first(.[] | select(.name | startswith("npm_and_yarn")) | .databaseId) // empty' 2>/dev/null); then
-            RUN_ID=""
-          fi
-          echo "run_id=$RUN_ID" >> "$GITHUB_OUTPUT"
-
-      - name: Extract stuck deps (only if actions pending)
-        id: stuck
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          RUN_ID: ${{ steps.latest.outputs.run_id }}
-          ACTIONS: ${{ steps.alerts.outputs.actions }}
-        run: |
-          # Skip the stuck section entirely when nothing in the actions list
-          # - keeps the digest tidy when there's nothing to actually act on.
-          if [ "$ACTIONS" = "_None_" ]; then
-            echo "section=" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          HEADER=$'\n\n*Couldn\'t auto-fix (need manual `pnpm.overrides`):*\n'
-          if [ -z "$RUN_ID" ]; then
-            {
-              echo "section<<EOF"
-              echo "${HEADER}_(no recent npm run found)_"
-              echo "EOF"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          gh run view "$RUN_ID" --repo "$REPO" --log > log.txt 2>&1 || true
-          STUCK=$(grep -oE "No update possible for [^[:space:]]+ [0-9][^[:space:]]*" log.txt | sed 's/No update possible for //' | sort -u || true)
-          if [ -z "$STUCK" ]; then
-            {
-              echo "section<<EOF"
-              echo "${HEADER}_None_"
-              echo "EOF"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          LIST=$(echo "$STUCK" | awk 'NR>1{printf "\n"} {printf "• *%s* %s", $1, $2}')
-          {
-            echo "section<<EOF"
-            echo "${HEADER}${LIST}"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Build Slack payload
-        env:
-          REPO: ${{ github.repository }}
-          CHANNEL: ${{ vars.SLACK_CHANNEL_ID }}
-          TOTAL: ${{ steps.alerts.outputs.total }}
-          BY_SEVERITY: ${{ steps.alerts.outputs.by_severity }}
-          PRS_LIST: ${{ steps.prs.outputs.list }}
-          ACTIONS: ${{ steps.alerts.outputs.actions }}
-          STUCK: ${{ steps.stuck.outputs.section }}
-        run: |
-          # Build payload via jq so PR titles or error strings containing
-          # quotes/backslashes/newlines can't break the JSON.
-          jq -n \
-            --arg channel "$CHANNEL" \
-            --arg repo "$REPO" \
-            --arg total "$TOTAL" \
-            --arg by_severity "$BY_SEVERITY" \
-            --arg prs_list "$PRS_LIST" \
-            --arg actions "$ACTIONS" \
-            --arg stuck "$STUCK" \
-            --arg threshold "$THRESHOLD_DAYS" \
-            '{
-              channel: $channel,
-              text: ":calendar: *Weekly Dependabot summary* - `\($repo)`\n\n*Open alerts (\($total)):*\n\($by_severity)\n\n*Open Dependabot PRs:*\n\($prs_list)\n\n*Actions needed (<\($threshold)d remaining):*\n\($actions)\($stuck)\n\n<https://github.com/\($repo)/security/dependabot|Dependabot alerts>"
-            }' > payload.json
-
-      - name: Post Slack summary
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_BOT_TOKEN }}
-          payload-file-path: payload.json

.github/workflows/docs.yml

@@ -20,18 +20,18 @@ permissions:
 
 jobs:
   check-broken-links:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     defaults:
       run:
         working-directory: ./docs
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: 📦 Cache npm
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.npm

.github/workflows/e2e-webapp-auth-full.yml

@@ -37,7 +37,7 @@ on:
 jobs:
   e2eAuthFull:
     name: "🛡️ E2E Auth Tests (full)"
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-8x
     timeout-minutes: 30
     env:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -69,7 +69,7 @@ jobs:
         run: sudo systemctl restart docker
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           # Don't leave the GITHUB_TOKEN in .git/config — this job
@@ -85,12 +85,12 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 🐳 Login to DockerHub
         if: ${{ env.DOCKERHUB_USERNAME }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/e2e-webapp.yml

@@ -14,8 +14,8 @@ on:
 jobs:
   e2eTests:
     name: "🧪 E2E Tests: Webapp"
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    runs-on: warp-ubuntu-latest-x64-16x
+    timeout-minutes: 30
     env:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
     steps:
@@ -46,7 +46,7 @@ jobs:
         run: sudo systemctl restart docker
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -59,13 +59,13 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
       - name: 🐳 Login to DockerHub
         if: ${{ env.DOCKERHUB_USERNAME }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -80,6 +80,8 @@ jobs:
           docker pull postgres:14
           docker pull redis:7.2
           docker pull testcontainers/ryuk:0.11.0
+          docker pull ghcr.io/s2-streamstore/s2:0.40.0@sha256:b26249e2ede0949755f5af8028185dc2bcfc3aa2db21eb9610543d144eb6ee9d
+          docker pull minio/minio:latest
           echo "Image pre-pull complete"
 
       - name: 📥 Download deps
@@ -91,6 +93,9 @@ jobs:
       - name: 🏗️ Build Webapp
         run: pnpm run build --filter webapp
 
+      - name: 🎭 Install Playwright Chromium
+        run: cd apps/webapp && pnpm exec playwright install chromium
+
       - name: 🧪 Run Webapp E2E Tests
         run: cd apps/webapp && pnpm exec vitest run --config vitest.e2e.config.ts --reporter=default
         env:

.github/workflows/e2e.yml

@@ -20,11 +20,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [warp-ubuntu-latest-x64-4x, warp-windows-latest-x64-8x]
         package-manager: ["npm", "pnpm"]
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -37,11 +37,13 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
 
       - name: 📥 Download deps
         run: pnpm install --frozen-lockfile --filter trigger.dev...
 
+      # Prisma clients generate concurrently and share one engine binary in the
+      # pnpm store; the generate script retries the transient Windows EPERM race.
       - name: 📀 Generate Prisma Client
         run: pnpm run generate
 

.github/workflows/helm-prerelease.yml

@@ -28,17 +28,17 @@ env:
 
 jobs:
   lint-and-test:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: "3.18.3"
 
@@ -52,12 +52,14 @@ jobs:
 
       - name: Lint Helm Chart
         run: |
-          helm lint ./hosting/k8s/helm/
+          helm lint ./hosting/k8s/helm/ \
+            --values ./hosting/k8s/helm/ci/lint-values.yaml
 
       - name: Render templates
         run: |
           helm template test-release ./hosting/k8s/helm/ \
             --values ./hosting/k8s/helm/values.yaml \
+            --values ./hosting/k8s/helm/ci/lint-values.yaml \
             --output-dir ./helm-output
 
       - name: Validate manifests
@@ -68,23 +70,28 @@ jobs:
 
   prerelease:
     needs: lint-and-test
+    # Set the ENABLE_HELM_PRERELEASE repository variable to 'false' to turn off
+    # publishing the chart to GHCR — e.g. forks/mirrors that lack write_package
+    # on the owner's charts namespace. Defaults to enabled; the lint-and-test
+    # job above always runs regardless.
     if: |
-      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+      vars.ENABLE_HELM_PRERELEASE != 'false' &&
+      ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
       github.event_name == 'push' ||
-      github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+      github.event_name == 'workflow_dispatch')
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: read
       packages: write
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: "3.18.3"
 
@@ -97,7 +104,7 @@ jobs:
           for file in ./charts/*.tgz; do echo "Extracting $file"; tar -xzf "$file" -C ./charts; done
 
       - name: Log in to Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/observability-map.yml

@@ -0,0 +1,386 @@
+name: 🗺️ Observability Map
+
+on:
+  # No paths filter, deliberately. GitHub evaluates one per workflow, so a pull request whose diff
+  # stops matching does not start the workflow at all: the resolved state cannot fire and a comment
+  # from an earlier push stands for ever showing findings that are no longer in the diff. Verified on
+  # a throwaway pull request whose only route change was reverted, and the realistic case is worse
+  # than that empty diff, because a pull request touching a route and other files, whose author
+  # reverts the route change and keeps the rest, still has a non-empty diff that no longer matches.
+  # The gating moved into the jobs below instead, where it can read whether a comment exists.
+  pull_request:
+    types: [opened, synchronize, reopened]
+  # The corpus job below is gated to this package's own paths, so a scheduled run is what still
+  # scans the tree as it drifts. Nightly rather than per route pull request: a new route can make a
+  # known laundering shape start paying, but that is a property of the tree accumulating, not of any
+  # one pull request, and it does not need catching within five minutes of the merge.
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: observability-map-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # The whole cost of a pull request that touches nothing this workflow watches: a checkout, a paths
+  # filter and one comment lookup. Everything expensive is gated on this job's outputs, and the
+  # lookup is here rather than in the report job so that gate can read it and the report job need
+  # never start.
+  changes:
+    name: 🔍 What moved
+    # Only the pull request path reads this job's output. On a schedule the action has no base to
+    # diff, warns that `before` is missing and reports the files in the last commit on main, which
+    # nothing then consults. Skipping it there keeps the nightly off a job it does not need.
+    if: github.event_name == 'pull_request'
+    runs-on: warp-ubuntu-latest-x64-2x
+    permissions:
+      contents: read
+      # Reading the pull request's comments, to find one an earlier push left. Read only: the write
+      # stays on the report job, which is the only job that posts.
+      pull-requests: read
+    outputs:
+      # The corpus job's gate. Narrower than the report's on purpose: what the corpus measures is
+      # the tool's resistance to laundering, which only an edit to the tool can weaken.
+      package: ${{ steps.filter.outputs.package }}
+      # The report job's gate, the union: a route change moves the report as well.
+      report: ${{ steps.filter.outputs.package == 'true' || steps.filter.outputs.routes == 'true' }}
+      # The id of a marker comment an earlier push left, empty if there is none, and the one source
+      # both the render and upsert steps read it from.
+      comment: ${{ steps.comment.outputs.id }}
+      # Set only by a lookup that finished cleanly, so anything else, retries exhausted or the step
+      # dying somewhere unforeseen, reads as "do not touch this pull request's comments".
+      lookup: ${{ steps.comment.outputs.ok }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: filter
+        with:
+          filters: |
+            package:
+              - 'internal-packages/observability-map/**'
+              - '.github/workflows/observability-map.yml'
+            routes:
+              - 'apps/webapp/app/routes/**'
+
+      # Looked up here because the report job's gate needs it: with the watched paths unmoved, a
+      # pull request that already has a comment gets a resolved state rather than being left with
+      # findings that no longer exist, and one that does not gets no job at all.
+      #
+      # On a failure that outlasts the retries this reports nothing, and the report job's gate reads
+      # that as "post nothing this run". Guessing is worse than silence: this step is the only thing
+      # that knows which comment to PATCH, so a guess of "no comment exists" POSTs, which either
+      # adds a second marker comment beside the stale one or says "the findings an earlier push
+      # reported are gone" on a pull request that never had findings. Worst case now is no comment
+      # this run, which the next push fixes.
+      - name: 🔍 Look for a comment from an earlier push
+        id: comment
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          found=""
+          ok=""
+          for attempt in 1 2 3; do
+            # Matched by login, not .user.type == "Bot": other bots and apps on the same PR are
+            # also type Bot, and login is the exact identity this token's own comments carry.
+            if found=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate \
+              --jq '[.[] | select(.user.login == "github-actions[bot]" and ((.body // "") | startswith("<!-- observability-map-report -->")))][0].id // empty'); then
+              ok=1
+              break
+            fi
+            echo "comment lookup attempt ${attempt} failed" >&2
+            sleep $((attempt * 5))
+          done
+
+          if [ -z "$ok" ]; then
+            echo "comment lookup failed after 3 attempts; this run posts nothing" >&2
+            exit 0
+          fi
+
+          # --paginate runs the jq once per page, so a marker comment on more than one page yields
+          # one id per page. Unhandled, that puts a newline in the PATCH url and the step dies under
+          # continue-on-error. The oldest wins: it is the one the upsert has been updating.
+          count=$(printf '%s\n' "$found" | grep -c '[0-9]' || true)
+          if [ "$count" -gt 1 ]; then
+            echo "warning: ${count} marker comments on this pull request; updating the oldest" >&2
+          fi
+          {
+            echo "id=$(printf '%s\n' "$found" | awk 'NF { print $1; exit }')"
+            echo "ok=ok"
+          } >> "$GITHUB_OUTPUT"
+
+  # The tree-scale mutation corpus: every known laundering shape applied to the whole route tree,
+  # asserting the score does not rise. 53 entries, a couple of minutes of a runner and a good deal
+  # longer on a laptop, which is why it is gated out of the package's default `pnpm test` and run
+  # here instead. Unlike the report job
+  # below it has no token to lose, so it runs for fork PRs too, and unlike the report job it is
+  # allowed to fail the build.
+  #
+  # Gated to this package's own paths rather than running on every route pull request. What the
+  # corpus measures is the TOOL's resistance to laundering, and only an edit to the tool can weaken
+  # that, so a routes-only change was paying a couple of minutes of a 4x runner for a result that
+  # could not differ from the last one. It was also the worst kind of job to spend that on: a red x
+  # that fires on a large share of webapp pull requests, is allowed to fail, and gates nothing, which is
+  # the shape people learn to scroll past.
+  #
+  # What this gives up is real and small. A route landing a shape no corpus entry has seen can make
+  # a known laundering mutation start paying, and that is now caught by the nightly rather than by
+  # the pull request that caused it. Tree drift accrues over months, so a day is the right
+  # granularity for it; the tool's own regressions, which are the ones a single commit can cause,
+  # still gate per pull request.
+  #
+  # Nothing in this repo watches whether the nightly itself succeeds: no Slack webhook and no
+  # issue-on-failure step here or in e2e-webapp-auth-full.yml, the only other scheduled workflow, so
+  # there is no house pattern to follow. A broken corpus fails quietly on the 3am cron, red only in
+  # the Actions tab,
+  # for as long as nobody checks it. Wiring up a real notification needs infrastructure (a Slack
+  # webhook secret, at minimum) that does not exist here yet, so this is a known, unfixed gap
+  # rather than a fixed one.
+  mutation-corpus:
+    name: 🧬 Mutation corpus
+    needs: changes
+    # `!cancelled()` is here for the nightly, not for tidiness. `needs` carries an implicit
+    # success() on the job it names, and that implicit test outranks the `||` below: with a plain
+    # condition, a `changes` job that failed or was skipped skips this one, so the nightly would
+    # stop scanning for tree drift and report nothing about having stopped. A status-check function
+    # in the `if` is what drops the implicit success(), so the event test below decides alone.
+    # `!cancelled()` rather than `always()` because `cancel-in-progress` above is a real path and a
+    # superseded run should not finish this job.
+    #
+    # Pull request behaviour is deliberately unchanged: on a PR a failed `changes` leaves
+    # `needs.changes.outputs.package` empty, so the corpus still skips. The nightly is the backstop
+    # for that, which is the same trade the paths gate already makes for routes-only pull requests.
+    if: >-
+      !cancelled() &&
+      (github.event_name != 'pull_request' || needs.changes.outputs.package == 'true')
+    runs-on: warp-ubuntu-latest-x64-4x
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: WarpBuilds/setup-node@bc639b444d583175926b588962199c247d23e8d3 # v6
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      - name: 🧬 Run the corpus
+        env:
+          OBS_MAP_MUTATION_CORPUS: "1"
+        run: |
+          pnpm --filter @internal/observability-map exec vitest run \
+            src/mutationCorpus.test.ts --disable-console-intercept
+
+  # The package's own tests are NOT run here. They gate through pr_checks.yml, which is the only
+  # workflow the all-checks aggregate can see, so a job in this file would report a result nobody
+  # is required to wait for. See unit-tests-observability-map.yml and the obsmap filter.
+  report:
+    needs: changes
+    runs-on: warp-ubuntu-latest-x64-4x
+    # Only this job comments, so only this job gets the write.
+    permissions:
+      contents: read
+      pull-requests: write
+    # Fork PRs get a read-only token, so the comment cannot post. Skipping the job beats a red x.
+    # The event test is what keeps this job off the nightly, which has no pull request to comment on
+    # and only exists for the corpus job above.
+    #
+    # The two output tests are what the workflow-level paths filter used to do, plus the thing it
+    # could not do. The report has to run when the watched paths moved, and ALSO when they did not
+    # but a marker comment is already on the pull request, because that comment is the one showing
+    # findings that have left the diff. Reconciling it needs no scan, so the steps below are gated
+    # again on the same output.
+    #
+    # `needs` carries an implicit success() and that is wanted here: a `changes` job that failed
+    # knows neither which paths moved nor whether a comment exists, and a report job that ran anyway
+    # could only guess. Same reason the lookup test is positive rather than a check for a failure
+    # sentinel: retries exhausted, or the lookup step dying anywhere unforeseen, both leave the
+    # output unset and both mean the same thing, so neither can be read as "no comment exists" by
+    # one step and "a comment exists" by another. That disagreement is what the sentinel pair this
+    # replaces got wrong once already.
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      needs.changes.outputs.lookup == 'ok' &&
+      (needs.changes.outputs.report == 'true' || needs.changes.outputs.comment != '')
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: WarpBuilds/setup-node@bc639b444d583175926b588962199c247d23e8d3 # v6
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      # Guarded rather than allowed to fail: this job must never block a pull request. The failure
+      # is not swallowed either, the render step below turns a missing head report into a comment
+      # saying so, because a swallowed failure with no comment is the outcome nobody wants.
+      #
+      # `--out` rather than a stdout redirect, so nothing a tool decides to print can end up inside
+      # the document `prCommentCli` parses. `pnpm --filter` takes its recursive path and some
+      # versions announce `Scope: N of M workspace projects` on the way; that line landing in
+      # head.json would fail the parse and degrade every run to the stale-report comment, which is
+      # a permanent quiet failure rather than a loud one. It does not reproduce on the 10.33.2
+      # pinned above, so this closes the class rather than a reproduction: the file is written by
+      # the process that owns it and stdout is left to be log output. Held by
+      # `it("let the scanner write its own report rather than capturing stdout")` in
+      # `internal-packages/observability-map/src/integration.test.ts`.
+      #
+      # `-s` keeps the partial dance honest now the redirect no longer creates the file: a scanner
+      # that exits 0 without writing takes the else branch and the stale-report comment, instead of
+      # failing the `mv` and turning the job red.
+      #
+      # Gated: this is the expensive half, and the reconcile run has nothing to compare. The steps
+      # above it are not gated because the renderer is TypeScript in this repo, so reconciling still
+      # needs the checkout and the install. That is the cost of the reconcile run and it is paid only
+      # by a pull request that has a comment and no longer matches the paths.
+      - name: 🔎 Scan head
+        if: needs.changes.outputs.report == 'true'
+        run: |
+          if pnpm --filter @internal/observability-map exec tsx src/cli.ts \
+            --out=/tmp/head.json.partial && [ -s /tmp/head.json.partial ]; then
+            mv /tmp/head.json.partial /tmp/head.json
+          else
+            rm -f /tmp/head.json /tmp/head.json.partial
+            echo "head scan failed; the comment will say the report is stale for this run" >&2
+          fi
+
+      # base.sha, not a merge base, and two reviewers have now read that as a bug. The checkout
+      # above is the default for a pull_request event, so the working tree is GitHub's test merge
+      # commit, whose parents are base.sha and the PR head. The head tree therefore already contains
+      # the base branch up to base.sha, and diffing it against base.sha is what isolates this pull
+      # request's own work. A merge base would leave the intervening base-branch commits in the head
+      # tree and out of the base tree, and blame the pull request for all of them.
+      - name: 🔎 Scan base with the head's scanner
+        if: needs.changes.outputs.report == 'true'
+        run: |
+          if git worktree add /tmp/base-tree ${{ github.event.pull_request.base.sha }} \
+            && pnpm --filter @internal/observability-map exec tsx src/cli.ts \
+              --routes=/tmp/base-tree/apps/webapp/app/routes --out=/tmp/base.json \
+            && [ -s /tmp/base.json ]; then
+            :
+          else
+            echo "-" > /tmp/base.json || true
+            echo "base scan failed or the worktree could not be added; falling back to no base" >&2
+          fi
+
+      # continue-on-error for the same reason as the scan: a rendering bug must not turn the job
+      # red. An empty /tmp/comment.md means there is nothing to post, which is a decision
+      # prCommentCli makes, not this shell.
+      #
+      # Both shas are forwarded so every comment this job posts says which commit it was rendered
+      # for, which a sticky comment edited in place across pushes otherwise never tells you. They go
+      # through the CLI as data: the renderer builds no URL and reads no environment.
+      - name: 📝 Render comment
+        continue-on-error: true
+        env:
+          SCANNED: ${{ needs.changes.outputs.report }}
+          EXISTING_COMMENT: ${{ needs.changes.outputs.comment }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          COMPARE_URL: ${{ github.server_url }}/${{ github.repository }}/compare/${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}
+        run: |
+          rm -f /tmp/comment.md
+          # `--out` rather than a stdout redirect, for the reason the scan steps above give, and with a
+          # worse failure mode than theirs: the marker has to be the comment's first line for the
+          # lookup to find it, so a line printed ahead of the document makes every push post a new
+          # comment instead of updating the one already there. Held by
+          # `it("let the renderer write its own comment rather than capturing stdout")`.
+          render() {
+            pnpm --filter @internal/observability-map exec tsx src/report/prCommentCli.ts \
+              --commit-sha="$HEAD_SHA" --commit-url="$COMPARE_URL" --out=/tmp/comment.md.partial "$@"
+          }
+
+          # Every write goes through this, so a renderer that exits non-zero never leaves a 0-byte
+          # comment.md for the upsert to skip in silence.
+          emit() {
+            rm -f /tmp/comment.md.partial
+            if render "$@"; then
+              mv /tmp/comment.md.partial /tmp/comment.md
+              return 0
+            fi
+            rm -f /tmp/comment.md.partial
+            return 1
+          }
+
+          # Nothing this workflow watches moved, so nothing was scanned and there is no delta to
+          # compute. The job's gate only lets that case through when a comment from an earlier push
+          # is on the pull request, so there is exactly one thing left to say: what it shows is not
+          # in this diff any more.
+          if [ "$SCANNED" != "true" ]; then
+            emit --resolved || echo "could not render the resolved comment" >&2
+            exit 0
+          fi
+
+          if [ ! -s /tmp/head.json ]; then
+            emit --scan-failed || echo "could not render the stale-report comment either" >&2
+            exit 0
+          fi
+
+          base=/tmp/base.json
+          if [ ! -s /tmp/base.json ] || [ "$(cat /tmp/base.json)" = "-" ]; then
+            base="-"
+          fi
+
+          flags=()
+          if [ -n "$EXISTING_COMMENT" ]; then
+            flags=(--existing-comment)
+          fi
+
+          if ! emit /tmp/head.json "$base" "${flags[@]}"; then
+            echo "render failed; falling back to the stale-report comment" >&2
+            emit --scan-failed || echo "could not render the stale-report comment either" >&2
+          fi
+
+      # continue-on-error for the same reason: a transient gh api failure (rate limit, network)
+      # must not fail the job either. Worst case, the PR gets no comment this run.
+      #
+      # The id comes from the same job output the render step read, so the two cannot disagree about
+      # whether a comment exists. A lookup that did not finish cleanly never reaches either of them:
+      # the job's gate stops it.
+      - name: 💬 Upsert PR comment
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          EXISTING_COMMENT: ${{ needs.changes.outputs.comment }}
+        run: |
+          if [ ! -s /tmp/comment.md ]; then
+            echo "nothing to post: this pull request does not move the report"
+            exit 0
+          fi
+          if [ -n "$EXISTING_COMMENT" ]; then
+            gh api -X PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING_COMMENT}" -F body=@/tmp/comment.md
+          else
+            gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" -F body=@/tmp/comment.md
+          fi

.github/workflows/pr_checks.yml

@@ -15,13 +15,14 @@ permissions:
 jobs:
   changes:
     name: Detect changes
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     outputs:
       code: ${{ steps.code_filter.outputs.code }}
       typecheck_self: ${{ steps.filter.outputs.typecheck_self }}
       webapp: ${{ steps.filter.outputs.webapp }}
       packages: ${{ steps.filter.outputs.packages }}
       internal: ${{ steps.filter.outputs.internal }}
+      obsmap: ${{ steps.filter.outputs.obsmap }}
       cli: ${{ steps.filter.outputs.cli }}
       sdk: ${{ steps.filter.outputs.sdk }}
     steps:
@@ -39,7 +40,6 @@ jobs:
               - '!.changeset/**'
               - '!hosting/**'
               - '!.github/**'
-              - '!references/**'
               - '!**/*.md'
               - '!**/.env.example'
       - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
@@ -49,6 +49,7 @@ jobs:
             typecheck_self:
               - '.github/workflows/pr_checks.yml'
               - '.github/workflows/typecheck.yml'
+              - '.github/workflows/code-quality.yml'
             webapp:
               - 'apps/webapp/**'
               - 'packages/**'
@@ -56,6 +57,7 @@ jobs:
               - '.github/workflows/pr_checks.yml'
               - '.github/workflows/unit-tests-webapp.yml'
               - '.github/workflows/e2e-webapp.yml'
+              - '.github/workflows/runops-guard.yml'
               - '.configs/**'
               - 'package.json'
               - 'pnpm-lock.yaml'
@@ -80,6 +82,38 @@ jobs:
               - 'pnpm-lock.yaml'
               - 'pnpm-workspace.yaml'
               - 'turbo.json'
+            # The whole webapp app tree, not just its routes, and that is the whole reason this
+            # filter exists. Two tests in @internal/observability-map read it: integration.test.ts
+            # scans the live route tree, and webappSymbols.test.ts walks all of apps/webapp/app and
+            # fails when a guard, sensitive or audit symbol stops resolving. Routes-only was this
+            # filter's own bug: renaming e.g. requireUserId in app/services/session.server.ts
+            # matched `webapp` and nothing else, so no job ran the suite and the break landed on
+            # main, or on the next unrelated internal-packages PR.
+            #
+            # The cost of the wider set, measured over the last 400 commits on main: 31% touch
+            # routes, 52% touch apps/webapp/app, so the job goes from firing on roughly a third of
+            # PRs to roughly a half. It is the cheap one -- a single 4x runner, no containers, no
+            # database, no prisma generate -- which is what makes that affordable.
+            #
+            # observability-map.yml is here because integration.test.ts asserts on its text and no
+            # other filter watches it, so editing the report workflow alone ran nothing at all.
+            #
+            # Deliberately NOT here: this package's own paths, and packages/plugins/src and
+            # internal-packages/rbac/src, the other two trees webappSymbols.test.ts reads.
+            # `internal` above already matches `internal-packages/**` and `packages/**`, and
+            # `unit-tests-internal.yml` runs `turbo run test --filter "@internal/*"`, which picks up
+            # @internal/observability-map and runs the same vitest suite. Listing them here as well
+            # ran the suite twice on every PR touching them, which was this filter's own doing.
+            #
+            # Also deliberately NOT here: pr_checks.yml, package.json, pnpm-lock.yaml,
+            # pnpm-workspace.yaml. `internal` already lists all four, so a PR touching only one of
+            # them ran this suite twice for the same reason as above. Editing pr_checks.yml no
+            # longer runs this job live as a result; integration.test.ts still asserts on its text
+            # via the `internal` job.
+            obsmap:
+              - 'apps/webapp/app/**'
+              - '.github/workflows/unit-tests-observability-map.yml'
+              - '.github/workflows/observability-map.yml'
             cli:
               - 'packages/cli-v3/**'
               - 'packages/build/**'
@@ -103,11 +137,19 @@ jobs:
               - 'pnpm-workspace.yaml'
               - 'turbo.json'
 
+  code-quality:
+    uses: ./.github/workflows/code-quality.yml
+
   typecheck:
     needs: changes
     if: needs.changes.outputs.code == 'true' || needs.changes.outputs.typecheck_self == 'true'
     uses: ./.github/workflows/typecheck.yml
 
+  runops-guard:
+    needs: changes
+    if: needs.changes.outputs.webapp == 'true'
+    uses: ./.github/workflows/runops-guard.yml
+
   webapp:
     needs: changes
     if: needs.changes.outputs.webapp == 'true'
@@ -140,6 +182,11 @@ jobs:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
 
+  obsmap:
+    needs: changes
+    if: needs.changes.outputs.obsmap == 'true'
+    uses: ./.github/workflows/unit-tests-observability-map.yml
+
   e2e:
     needs: changes
     if: needs.changes.outputs.cli == 'true'
@@ -156,15 +203,18 @@ jobs:
     name: All PR Checks
     needs:
       - changes
+      - code-quality
       - typecheck
+      - runops-guard
       - webapp
       - e2e-webapp
       - packages
       - internal
+      - obsmap
       - e2e
       - sdk-compat
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     steps:
       - name: Verify all checks
         run: |

.github/workflows/preview-dispatch.yml

@@ -0,0 +1,76 @@
+name: 🌱 Preview environment dispatch
+
+# Opt-in per-PR preview environments
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, closed, labeled, unlabeled]
+
+# Serialize a PR's events so dispatches arrive in order. Cloud-side concurrency
+# collapses by branch but can't fix out-of-order arrival — e.g. a push racing a
+# close could cancel the in-flight destroy and leak the preview. One short API
+# call, so queuing is cheap; cancel-in-progress: false lets an in-flight
+# dispatch finish (GitHub keeps only the latest pending, the desired behavior).
+concurrency:
+  group: preview-dispatch-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  dispatch:
+    name: Dispatch preview-deploy to cloud
+    runs-on: warp-ubuntu-latest-x64-2x
+    #   label added             -> create
+    #   new commit while labeled -> update
+    #   label removed / PR closed -> destroy
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (
+        (github.event.action == 'labeled' && github.event.label.name == 'preview') ||
+        (github.event.action == 'unlabeled' && github.event.label.name == 'preview') ||
+        (
+          contains(github.event.pull_request.labels.*.name, 'preview') &&
+          contains(fromJSON('["opened","reopened","synchronize","closed"]'), github.event.action)
+        )
+      )
+    steps:
+      - name: Build dispatch payload
+        id: payload
+        env:
+          ACTION: ${{ github.event.action }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          COMMIT: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          # Map the GitHub PR action to the cloud pipeline's lifecycle event.
+          case "$ACTION" in
+            labeled | opened | reopened) EVENT=opened ;;
+            synchronize) EVENT=synchronize ;;
+            unlabeled | closed) EVENT=closed ;;
+            *) echo "unexpected action: $ACTION" >&2; exit 1 ;;
+          esac
+          # jq --arg JSON-escapes every value, so a branch name containing
+          # quotes/braces can't break or inject into the client payload.
+          payload=$(jq -nc \
+            --arg b "$BRANCH" \
+            --arg c "$COMMIT" \
+            --arg e "$EVENT" \
+            '{branch_name: $b, commit: $c, pull_request_event: $e}')
+          {
+            echo "client_payload=$payload"
+            echo "summary=$EVENT for $BRANCH @ ${COMMIT:0:7}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Log dispatch
+        env:
+          SUMMARY: ${{ steps.payload.outputs.summary }}
+        run: echo "Dispatching preview-deploy event ($SUMMARY)"
+
+      - name: Send repository_dispatch
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.CROSS_REPO_PAT }}
+          repository: triggerdotdev/cloud
+          event-type: preview-deploy
+          client-payload: ${{ steps.payload.outputs.client_payload }}

.github/workflows/preview-packages.yml

@@ -0,0 +1,83 @@
+name: 📦 Preview packages (pkg.pr.new)
+
+# Publishes installable preview builds of the public @trigger.dev/* packages
+# for every push to a branch, via https://pkg.pr.new. These are NOT published
+# to npm — pkg.pr.new serves them by commit SHA and drops install instructions
+# in a comment on the associated PR, e.g.
+#   npm i https://pkg.pr.new/@trigger.dev/sdk@<sha>
+#
+# Prerequisites:
+#   - The pkg.pr.new GitHub App must be installed on triggerdotdev/trigger.dev
+#     (https://github.com/apps/pkg-pr-new). Publishing fails until it is.
+#
+# Fork note: pkg.pr.new authenticates with a GitHub Actions OIDC token, which
+# GitHub does not issue to pull_request workflows from forks. This `push`
+# trigger therefore covers branches pushed to this repo (the core team), not
+# external fork PRs. Adding fork coverage would require a workflow_run two-stage
+# setup.
+
+on:
+  push:
+    branches-ignore:
+      - main
+      - changeset-release/main
+    paths:
+      - "package.json"
+      - "packages/**"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - ".github/workflows/preview-packages.yml"
+      - "scripts/stamp-preview-version.mjs"
+      - "scripts/updateVersion.ts"
+
+concurrency:
+  group: preview-packages-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write # OIDC token used by pkg.pr.new to authenticate the publish
+
+jobs:
+  publish:
+    name: Build and publish previews
+    runs-on: warp-ubuntu-latest-x64-8x
+    if: github.repository == 'triggerdotdev/trigger.dev'
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: 📥 Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: 📀 Generate Prisma client
+        run: pnpm run generate
+
+      # Stamp a unique 0.0.0-preview-<sha> version before building so it can't
+      # collide with real npm versions and so updateVersion.ts bakes it into the
+      # runtime VERSION constant. See scripts/stamp-preview-version.mjs.
+      - name: 🏷️ Stamp preview version
+        run: node scripts/stamp-preview-version.mjs
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+
+      - name: 🔨 Build packages
+        run: pnpm run build --filter "@trigger.dev/*" --filter "trigger.dev"
+
+      - name: 🚀 Publish previews to pkg.pr.new
+        run: pnpm exec pkg-pr-new publish --pnpm --compact --commentWithSha './packages/*'

.github/workflows/publish-docs.yml

@@ -0,0 +1,36 @@
+name: 📚 Publish docs
+
+on:
+  push:
+    tags:
+      - "docs-release-*"
+
+# Only needs to move the docs-live ref; Mintlify's GitHub app deploys from it.
+permissions:
+  contents: write
+
+concurrency:
+  group: publish-docs
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: warp-ubuntu-latest-x64-2x
+    steps:
+      - name: 📥 Checkout tagged commit
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: 🔗 Check for broken links
+        working-directory: ./docs
+        run: npx mintlify@4.0.393 broken-links
+
+      - name: 🚀 Fast-forward docs-live to the tagged commit
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api -X PATCH \
+            "repos/${{ github.repository }}/git/refs/heads/docs-live" \
+            -f sha="${{ github.sha }}" \
+            -F force=false

.github/workflows/publish-webapp.yml

@@ -14,24 +14,44 @@ on:
         type: string
         required: false
         default: ""
+      image_registry:
+        description: The registry namespace to publish under (e.g. ghcr.io/<owner>)
+        type: string
+        required: false
+        default: ""
+    outputs:
+      version:
+        description: The published image tag
+        value: ${{ jobs.publish.outputs.version }}
+      short_sha:
+        description: Short commit SHA of the published build
+        value: ${{ jobs.publish.outputs.short_sha }}
+      image_repo:
+        description: The image repository the build was published to (without tag)
+        value: ${{ jobs.publish.outputs.image_repo }}
+      digest:
+        description: Multi-arch index digest (sha256:...) of the published image
+        value: ${{ jobs.publish.outputs.digest }}
     secrets:
       SENTRY_AUTH_TOKEN:
         required: false
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     env:
       PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING: 1
     outputs:
       version: ${{ steps.get_tag.outputs.tag }}
       short_sha: ${{ steps.get_commit.outputs.sha_short }}
+      image_repo: ${{ steps.set_tags.outputs.image_repo }}
+      digest: ${{ steps.build_push.outputs.digest }}
     steps:
       - name: 🏭 Setup Depot CLI
         uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: recursive
           persist-credentials: false
@@ -50,17 +70,26 @@ jobs:
       - name: 📛 Set the tags
         id: set_tags
         run: |
-          ref_without_tag=ghcr.io/triggerdotdev/trigger.dev
-          image_tags=$ref_without_tag:${STEPS_GET_TAG_OUTPUTS_TAG}
+          # The registry namespace is resolved by the caller (defaulting to
+          # ghcr.io/<owner>, overridable via the IMAGE_REGISTRY repository
+          # variable); the webapp image lives at <registry>/<repo-name>. A fork
+          # therefore publishes to its own package automatically.
+          image_tags=$REF_WITHOUT_TAG:${STEPS_GET_TAG_OUTPUTS_TAG}
+
+          if [[ "${STEPS_GET_TAG_OUTPUTS_TAG}" =~ ^v4\.[0-9]+\.[0-9]+$ ]]; then
+            image_tags=$image_tags,$REF_WITHOUT_TAG:v4,$REF_WITHOUT_TAG:latest
+          fi
 
           # when pushing the mutable main tag, also push an immutable-by-convention
           # full-commit-sha tag so a commit can be resolved to a specific digest
           if [[ "${STEPS_GET_TAG_OUTPUTS_TAG}" == "main" ]]; then
-            image_tags=$image_tags,$ref_without_tag:${GITHUB_SHA}
+            image_tags=$image_tags,$REF_WITHOUT_TAG:${GITHUB_SHA}
           fi
 
           echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
+          echo "image_repo=${REF_WITHOUT_TAG}" >> "$GITHUB_OUTPUT"
         env:
+          REF_WITHOUT_TAG: ${{ format('{0}/{1}', inputs.image_registry || vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner), github.event.repository.name) }}
           STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
           STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}
 
@@ -82,7 +111,7 @@ jobs:
           STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}
 
       - name: 🐙 Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -90,7 +119,7 @@ jobs:
 
       - name: 🐳 Build image and push to GitHub Container Registry
         id: build_push
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           file: ./docker/Dockerfile
           platforms: linux/amd64,linux/arm64
@@ -115,6 +144,6 @@ jobs:
         continue-on-error: true
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
-          subject-name: ghcr.io/triggerdotdev/trigger.dev
+          subject-name: ${{ steps.set_tags.outputs.image_repo }}
           subject-digest: ${{ steps.build_push.outputs.digest }}
           push-to-registry: true

.github/workflows/publish-worker-v4.yml

@@ -8,6 +8,18 @@ on:
         type: string
         required: false
         default: ""
+      image_registry:
+        description: The registry namespace to publish under (e.g. ghcr.io/<owner>)
+        type: string
+        required: false
+        default: ""
+    outputs:
+      version:
+        description: The published image tag
+        value: ${{ jobs.build.outputs.version }}
+      image_repo:
+        description: The image repository the build was published to (without tag)
+        value: ${{ jobs.build.outputs.image_repo }}
   push:
     tags:
       - "re2-test-*"
@@ -20,7 +32,7 @@ permissions:
 
 jobs:
   # check-branch:
-  #   runs-on: ubuntu-latest
+  #   runs-on: warp-ubuntu-latest-x64-2x
   #   steps:
   #     - name: Fail if re2-prod-* is pushed from a non-main branch
   #       if: startsWith(github.ref_name, 're2-prod-') && github.base_ref != 'main'
@@ -32,7 +44,12 @@ jobs:
     strategy:
       matrix:
         package: [supervisor]
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
+    # Single-entry matrix, so these job outputs are unambiguous (consumed by the
+    # scan-supervisor job in publish.yml).
+    outputs:
+      version: ${{ steps.get_tag.outputs.tag }}
+      image_repo: ${{ steps.set_tags.outputs.image_repo }}
     env:
       DOCKER_BUILDKIT: "1"
     steps:
@@ -40,7 +57,7 @@ jobs:
         uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
 
       - name: ⬇️ Checkout git repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -65,24 +82,33 @@ jobs:
       - name: 📛 Set tags to push
         id: set_tags
         run: |
-          ref_without_tag=ghcr.io/triggerdotdev/${STEPS_GET_REPOSITORY_OUTPUTS_REPO}
+          # Resolved by the caller when invoked from publish.yml; falls back to the
+          # IMAGE_REGISTRY repository variable (or ghcr.io/<owner>) for the direct
+          # push triggers above, so a fork publishes to its own namespace.
+          ref_without_tag=${IMAGE_REGISTRY}/${STEPS_GET_REPOSITORY_OUTPUTS_REPO}
           image_tags=$ref_without_tag:${STEPS_GET_TAG_OUTPUTS_TAG}
 
+          if [[ "${STEPS_GET_TAG_OUTPUTS_TAG}" =~ ^v4\.[0-9]+\.[0-9]+$ ]]; then
+            image_tags=$image_tags,$ref_without_tag:v4,$ref_without_tag:latest
+          fi
+
           echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
+          echo "image_repo=${ref_without_tag}" >> "$GITHUB_OUTPUT"
         env:
+          IMAGE_REGISTRY: ${{ inputs.image_registry || vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
           STEPS_GET_REPOSITORY_OUTPUTS_REPO: ${{ steps.get_repository.outputs.repo }}
           STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
           STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}
 
       - name: 🐙 Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 🐳 Build image and push to GitHub Container Registry
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           file: ./apps/${{ matrix.package }}/Containerfile
           platforms: linux/amd64,linux/arm64

.github/workflows/publish-worker.yml

@@ -1,97 +0,0 @@
-name: "⚒️ Publish Worker"
-
-on:
-  workflow_call:
-    inputs:
-      image_tag:
-        description: The image tag to publish
-        type: string
-        required: false
-        default: ""
-    secrets:
-      DOCKERHUB_USERNAME:
-        required: false
-      DOCKERHUB_TOKEN:
-        required: false
-  push:
-    tags:
-      - "infra-dev-*"
-      - "infra-test-*"
-      - "infra-prod-*"
-
-permissions:
-  packages: write
-  contents: read
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        package: [coordinator, docker-provider, kubernetes-provider]
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_BUILDKIT: "1"
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-    steps:
-      - name: ⬇️ Checkout git repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: 📦 Get image repo
-        id: get_repository
-        env:
-          PACKAGE: ${{ matrix.package }}
-        run: |
-          if [[ "$PACKAGE" == *-provider ]]; then
-            repo="provider/${PACKAGE%-provider}"
-          else
-            repo="$PACKAGE"
-          fi
-          echo "repo=${repo}" >> "$GITHUB_OUTPUT"
-
-      - id: get_tag
-        uses: ./.github/actions/get-image-tag
-        with:
-          tag: ${{ inputs.image_tag }}
-
-      - name: 🐋 Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      # ..to avoid rate limits when pulling images
-      - name: 🐳 Login to DockerHub
-        if: ${{ env.DOCKERHUB_USERNAME }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: 🚢 Build Container Image
-        run: |
-          docker build -t infra_image -f ./apps/${{ matrix.package }}/Containerfile .
-
-      # ..to push image
-      - name: 🐙 Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: 🐙 Push to GitHub Container Registry
-        run: |
-          docker tag infra_image "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
-          docker push "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
-        env:
-          REGISTRY: ghcr.io/triggerdotdev
-          REPOSITORY: ${{ steps.get_repository.outputs.repo }}
-          IMAGE_TAG: ${{ steps.get_tag.outputs.tag }}
-
-      # - name: 🐙 Push 'v3' tag to GitHub Container Registry
-      #   if: steps.get_tag.outputs.is_semver == 'true'
-      #   run: |
-      #     docker tag infra_image "$REGISTRY/$REPOSITORY:v3"
-      #     docker push "$REGISTRY/$REPOSITORY:v3"
-      #   env:
-      #     REGISTRY: ghcr.io/triggerdotdev
-      #     REPOSITORY: ${{ steps.get_repository.outputs.repo }}

.github/workflows/publish.yml

@@ -15,6 +15,8 @@ on:
         required: false
       SENTRY_AUTH_TOKEN:
         required: false
+      CROSS_REPO_PAT:
+        required: false
   push:
     branches:
       - main
@@ -28,7 +30,6 @@ on:
       - ".github/workflows/unit-tests.yml"
       - ".github/workflows/e2e.yml"
       - ".github/workflows/publish-webapp.yml"
-      - ".github/workflows/publish-worker.yml"
       - "packages/**"
       - "!packages/**/*.md"
       - "!packages/**/*.eslintrc"
@@ -74,18 +75,9 @@ jobs:
       SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
     with:
       image_tag: ${{ inputs.image_tag }}
-
-  publish-worker:
-    needs: [typecheck]
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/publish-worker.yml
-    secrets:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-    with:
-      image_tag: ${{ inputs.image_tag }}
+      # Target registry namespace. Defaults to ghcr.io/<owner> so a fork publishes
+      # to its own namespace; set the IMAGE_REGISTRY repository variable to override.
+      image_registry: ${{ vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
 
   publish-worker-v4:
     needs: [typecheck]
@@ -96,3 +88,71 @@ jobs:
     uses: ./.github/workflows/publish-worker-v4.yml
     with:
       image_tag: ${{ inputs.image_tag }}
+      image_registry: ${{ vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
+
+  # OS-level CVE scan of the image just published above. Report-only (writes to
+  # the run summary); runs alongside the worker publishes and never blocks them.
+  scan-webapp:
+    needs: [publish-webapp]
+    permissions:
+      contents: read
+      packages: read # pull the just-published image from GHCR
+    uses: ./.github/workflows/trivy-image.yml
+    with:
+      image-ref: ${{ needs.publish-webapp.outputs.image_repo }}:${{ needs.publish-webapp.outputs.version }}
+
+  scan-supervisor:
+    needs: [publish-worker-v4]
+    permissions:
+      contents: read
+      packages: read # pull the just-published image from GHCR
+    uses: ./.github/workflows/trivy-image.yml
+    with:
+      image-ref: ${{ needs.publish-worker-v4.outputs.image_repo }}:${{ needs.publish-worker-v4.outputs.version }}
+
+  # Announce the freshly published mutable `main` webapp image to subscriber
+  # repos via repository_dispatch, handing them a digest-pinned ref to build or
+  # deploy from. The repo, ref prefix, and dispatch target all default to the
+  # canonical values and can be overridden by repository variables.
+  #
+  # `push` only: release builds reach publish.yml via workflow_call (from
+  # release.yml) with an explicit image_tag while github.ref_name is still
+  # `main`, so gate on the event to avoid dispatching — and failing on the
+  # absent CROSS_REPO_PAT — during a release.
+  dispatch-main-image:
+    name: 📣 Dispatch main image
+    needs: [publish-webapp]
+    if: github.repository == (vars.MAIN_IMAGE_DISPATCH_REPO || 'triggerdotdev/trigger.dev') && github.event_name == 'push' && startsWith(github.ref_name, vars.MAIN_IMAGE_DISPATCH_REF_PREFIX || 'main')
+    runs-on: warp-ubuntu-latest-x64-2x
+    permissions: {}
+    steps:
+      - name: Build dispatch payload
+        id: payload
+        env:
+          IMAGE_REPO: ${{ needs.publish-webapp.outputs.image_repo }}
+          DIGEST: ${{ needs.publish-webapp.outputs.digest }}
+          COMMIT: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          # Pin to the exact multi-arch index just pushed so subscribers resolve a
+          # single immutable artifact rather than chasing the moving `main` tag.
+          if [[ -z "${DIGEST}" ]]; then
+            echo "::error::publish-webapp produced no image digest; refusing to dispatch"
+            exit 1
+          fi
+          image="${IMAGE_REPO}@${DIGEST}"
+          # jq --arg JSON-escapes every value, so the ref/commit can't break out of
+          # or inject into the client payload.
+          payload=$(jq -nc \
+            --arg img "$image" \
+            --arg c "$COMMIT" \
+            '{image: $img, commit: $c}')
+          echo "client_payload=$payload" >> "$GITHUB_OUTPUT"
+
+      - name: Send repository_dispatch
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.CROSS_REPO_PAT }}
+          repository: ${{ vars.MAIN_IMAGE_DISPATCH_TARGET || 'triggerdotdev/cloud' }}
+          event-type: main-image-published
+          client-payload: ${{ steps.payload.outputs.client_payload }}

.github/workflows/release-helm.yml

@@ -3,17 +3,17 @@ name: 🧭 Helm Chart Release
 on:
   push:
     tags:
-      - 'helm-v*'
+      - "helm-v*"
   workflow_call:
     inputs:
       chart_version:
-        description: 'Chart version to release'
+        description: "Chart version to release"
         required: true
         type: string
   workflow_dispatch:
     inputs:
       chart_version:
-        description: 'Chart version to release'
+        description: "Chart version to release"
         required: true
         type: string
 
@@ -23,17 +23,17 @@ env:
 
 jobs:
   lint-and-test:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: "3.18.3"
 
@@ -47,34 +47,41 @@ jobs:
 
       - name: Lint Helm Chart
         run: |
-          helm lint ./hosting/k8s/helm/
+          helm lint ./hosting/k8s/helm/ \
+            --values ./hosting/k8s/helm/ci/lint-values.yaml
 
       - name: Render templates
         run: |
           helm template test-release ./hosting/k8s/helm/ \
             --values ./hosting/k8s/helm/values.yaml \
+            --values ./hosting/k8s/helm/ci/lint-values.yaml \
             --output-dir ./helm-output
 
       - name: Validate manifests
         uses: docker://ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
         with:
-          entrypoint: '/kubeconform'
+          entrypoint: "/kubeconform"
           args: "-summary -output json ./helm-output"
 
   release:
     needs: lint-and-test
-    runs-on: ubuntu-latest
+    # Set the ENABLE_HELM_PRERELEASE repository variable to 'false' to turn off
+    # publishing the chart to GHCR — e.g. forks/mirrors that lack write_package
+    # on the owner's charts namespace. Defaults to enabled; the lint-and-test
+    # job above always runs regardless.
+    if: ${{ vars.ENABLE_HELM_PRERELEASE != 'false' }}
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: write # for gh-release
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: "3.18.3"
 
@@ -87,7 +94,7 @@ jobs:
           for file in ./charts/*.tgz; do echo "Extracting $file"; tar -xzf "$file" -C ./charts; done
 
       - name: Log in to Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -129,7 +136,7 @@ jobs:
         run: |
           VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
           CHART_PACKAGE="/tmp/${{ env.CHART_NAME }}-${VERSION}.tgz"
-          
+
           # Push to GHCR OCI registry
           helm push "$CHART_PACKAGE" "oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts"
         env:
@@ -137,7 +144,7 @@ jobs:
 
       - name: Create GitHub Release
         id: release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           tag_name: helm-v${{ steps.version.outputs.version }}
           name: "Helm Chart ${{ steps.version.outputs.version }}"
@@ -148,7 +155,7 @@ jobs:
               oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/${{ env.CHART_NAME }} \
               --version "${{ steps.version.outputs.version }}"
             ```
-            
+
             ### Changes
             See commit history for detailed changes in this release.
           files: |

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
 
   release:
     name: 🚀 Release npm packages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest # this cannot run on non-GH runner
     environment: npm-publish
     permissions:
       contents: write
@@ -67,7 +67,7 @@ jobs:
       is_prerelease: ${{ steps.get_version.outputs.is_prerelease }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.sha }}
@@ -90,7 +90,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       # npm v11.5.1 or newer is required for OIDC support
@@ -112,7 +112,7 @@ jobs:
 
       - name: Publish
         id: changesets
-        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           publish: pnpm run changeset:release
           createGithubReleases: false
@@ -143,6 +143,21 @@ jobs:
           STEPS_GET_VERSION_OUTPUTS_IS_PRERELEASE: ${{ steps.get_version.outputs.is_prerelease }}
         run: |
           VERSION="${STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION}"
+
+          # On the pull_request merge event RELEASE_PR_BODY is the merged "Version Packages"
+          # PR body, which holds the changelog. On a workflow_dispatch re-run (the recovery
+          # path after a failed merge-triggered run) there is no pull_request context, so it's
+          # empty. Fall back to the body of the most recently merged changeset-release/main PR
+          # so the "What's changed" section is still populated.
+          if [ -z "${RELEASE_PR_BODY}" ]; then
+            echo "RELEASE_PR_BODY is empty (workflow_dispatch re-run); fetching merged changeset-release/main PR body"
+            RELEASE_PR_BODY="$(gh pr list --repo triggerdotdev/trigger.dev \
+              --head changeset-release/main --state merged \
+              --json body,mergedAt --limit 10 \
+              -q 'sort_by(.mergedAt) | reverse | .[0].body')"
+          fi
+          export RELEASE_PR_BODY
+
           node scripts/generate-github-release.mjs "$VERSION" > /tmp/release-body.md
           PRERELEASE_FLAG=""
           if [ "${STEPS_GET_VERSION_OUTPUTS_IS_PRERELEASE}" = "true" ]; then
@@ -211,7 +226,7 @@ jobs:
     name: 🔗 Update release Docker link
     needs: [release, publish-docker]
     if: needs.release.outputs.published == 'true'
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: write
       packages: read
@@ -253,7 +268,7 @@ jobs:
     name: 📝 Dispatch changelog PR
     needs: [release, update-release]
     if: needs.release.outputs.published == 'true' && needs.release.outputs.is_prerelease != 'true'
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions: {}
     steps:
       - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
@@ -266,7 +281,7 @@ jobs:
   # The prerelease job needs to be on the same workflow file due to a limitation related to how npm verifies OIDC claims.
   prerelease:
     name: 🧪 Prerelease
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest # this cannot run on non-GH runner
     environment: npm-publish
     permissions:
       contents: read
@@ -274,7 +289,7 @@ jobs:
     if: github.repository == 'triggerdotdev/trigger.dev' && github.event_name == 'workflow_dispatch' && github.event.inputs.type == 'prerelease'
     steps:
       - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           ref: ${{ github.event.inputs.ref }}
@@ -288,7 +303,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       # npm v11.5.1 or newer is required for OIDC support

.github/workflows/runops-guard.yml

@@ -0,0 +1,38 @@
+name: "🛡️ Run-ops Legacy Guard"
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  runops-guard:
+    runs-on: warp-ubuntu-latest-x64-16x
+
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      - name: 📀 Generate Prisma Client
+        run: pnpm run generate
+
+      - name: 🛡️ Run-ops legacy guard
+        run: pnpm --filter webapp run guard:runops-legacy -- --check

.github/workflows/sdk-compat.yml

@@ -13,12 +13,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest]
-        node: ["20.20", "22.12"]
+        os: [warp-ubuntu-latest-x64-4x]
+        node: ["20.20", "22.23", "24.18", "26.4"]
 
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -54,10 +54,10 @@ jobs:
 
   bun-compat:
     name: "Bun Runtime"
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-4x
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -70,7 +70,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 🥟 Setup Bun
@@ -96,10 +96,10 @@ jobs:
 
   deno-compat:
     name: "Deno Runtime"
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-4x
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -112,7 +112,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 🦕 Setup Deno
@@ -142,10 +142,10 @@ jobs:
 
   cloudflare-compat:
     name: "Cloudflare Workers"
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-4x
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -158,7 +158,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps

.github/workflows/trivy-image.yml

@@ -0,0 +1,75 @@
+name: Trivy Image Scan
+
+# OS-level CVE scan of a published image. Called by the publish pipeline
+# (publish.yml) to scan each image right after it's pushed to GHCR — so every
+# main build and every release is scanned, not rebuilt. Also runnable ad-hoc
+# via workflow_dispatch against any image ref.
+#
+# Report-only: writes a table to the run summary. No SARIF upload, no gate.
+# Library/dependency CVEs are covered by Dependabot, so this is restricted to
+# OS packages (`vuln-type: os`) to avoid double-reporting.
+
+on:
+  workflow_call:
+    inputs:
+      image-ref:
+        description: "Full image ref to scan (e.g. ghcr.io/triggerdotdev/trigger.dev:main)"
+        type: string
+        required: true
+  workflow_dispatch:
+    inputs:
+      image-ref:
+        description: "Full image ref to scan"
+        type: string
+        required: false
+        default: "ghcr.io/triggerdotdev/trigger.dev:main"
+
+permissions: {}
+
+concurrency:
+  group: trivy-image-${{ inputs.image-ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Scan
+    runs-on: warp-ubuntu-latest-x64-2x
+    permissions:
+      contents: read
+      packages: read # pull the image from GHCR
+    steps:
+      # Authenticate to GHCR so the scan also works for private images
+      # (GITHUB_TOKEN isn't forwarded to Docker automatically). Harmless for
+      # public images. Pairs with the packages: read permission above.
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Trivy image scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: image
+          image-ref: ${{ inputs.image-ref }}
+          # vuln-type maps to --pkg-types: OS packages only (library deps are
+          # Dependabot's job). ignore-unfixed drops vulns with no patch yet.
+          vuln-type: os
+          ignore-unfixed: true
+          severity: HIGH,CRITICAL
+          format: table
+          output: trivy-image.txt
+
+      - name: Job summary
+        if: always()
+        env:
+          IMAGE_REF: ${{ inputs.image-ref }}
+        run: |
+          {
+            echo "## Trivy Image Scan — \`${IMAGE_REF}\`"
+            echo '```'
+            # GitHub step summary is capped at 1 MiB; truncate large reports.
+            head -c 900000 trivy-image.txt 2>/dev/null || echo "(no report produced)"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/typecheck.yml

@@ -8,11 +8,11 @@ permissions:
 
 jobs:
   typecheck:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-16x
 
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -23,11 +23,19 @@ jobs:
           version: 10.33.2
 
       - name: ⎔ Setup node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: WarpBuilds/setup-node@bc639b444d583175926b588962199c247d23e8d3 # v6
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
+      - name: Restore Turbo cache
+        uses: WarpBuilds/cache@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1
+        with:
+          path: node_modules/.cache/turbo
+          key: turbo-typecheck-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
+          restore-keys: |
+            turbo-typecheck-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
+
       - name: 📥 Download deps
         run: pnpm install --frozen-lockfile
 

.github/workflows/unit-tests-internal.yml

@@ -14,15 +14,14 @@ on:
 jobs:
   unitTests:
     name: "🧪 Unit Tests: Internal"
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        shardIndex: [1, 2, 3, 4, 5, 6, 7, 8]
-        shardTotal: [8]
+    # Single big machine instead of a 12-job matrix: the internal suites are serial
+    # (fileParallelism: false) and container-wait-bound, so 12 in-machine shard processes
+    # fit comfortably in 32 vCPUs while paying the setup cost (install, prisma generate,
+    # image pulls) once instead of 12 times.
+    runs-on: warp-ubuntu-latest-x64-32x
     env:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      SHARD_INDEX: ${{ matrix.shardIndex }}
-      SHARD_TOTAL: ${{ matrix.shardTotal }}
+      SHARD_TOTAL: 12
     steps:
       - name: 🔧 Disable IPv6
         run: |
@@ -51,9 +50,9 @@ jobs:
         run: sudo systemctl restart docker
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           persist-credentials: false
 
       - name: ⎔ Setup pnpm
@@ -64,13 +63,13 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
       - name: 🐳 Login to DockerHub
         if: ${{ env.DOCKERHUB_USERNAME }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -81,12 +80,23 @@ jobs:
       - name: 🐳 Pre-pull testcontainer images
         if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
+          # Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
+          pull() {
+            for attempt in 1 2 3; do
+              docker pull "$1" && return 0
+              echo "::warning::docker pull $1 failed (attempt ${attempt}/3); retrying in 10s"
+              sleep 10
+            done
+            echo "::error::docker pull $1 failed after 3 attempts"
+            return 1
+          }
           echo "Pre-pulling Docker images with authenticated session..."
-          docker pull postgres:14
-          docker pull clickhouse/clickhouse-server:25.4-alpine
-          docker pull redis:7-alpine
-          docker pull testcontainers/ryuk:0.11.0
-          docker pull electricsql/electric:1.2.4
+          pull postgres:14
+          pull postgres:17 # for the heterogeneous PG14/17 test fixture gate (heteroPostgresTest)
+          pull clickhouse/clickhouse-server:26.2.19.43-alpine@sha256:c6ad6a7eb2fb5999df3adfb8b69a0c7222c68fa9b8f6b04a088564ebbc959251
+          pull redis:7.2
+          pull testcontainers/ryuk:0.14.0
+          pull electricsql/electric:1.2.4
           echo "Image pre-pull complete"
 
       - name: 📥 Download deps
@@ -95,8 +105,34 @@ jobs:
       - name: 📀 Generate Prisma Client
         run: pnpm run generate
 
-      - name: 🧪 Run Internal Unit Tests
-        run: pnpm run test:internal --reporter=default --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+      - name: 🏗️ Build test dependencies
+        # Build once up-front so the parallel shard runs below (turbo --only) never race
+        # to build or cache-restore the same outputs concurrently.
+        run: pnpm exec turbo run build --filter "@internal/*..."
+
+      - name: 🧪 Run Internal Unit Tests (${{ env.SHARD_TOTAL }} in-machine shards)
+        run: |
+          # Same shard partitioning as the old 12-job matrix (DurationShardingSequencer
+          # keys off --shard=i/N), but as parallel local processes. --only skips the
+          # ^build dependency handled by the step above.
+          status=0
+          declare -a pids
+          for i in $(seq 1 "$SHARD_TOTAL"); do
+            pnpm exec turbo run test --only --concurrency=1 --filter "@internal/*" -- \
+              --run --reporter=default --reporter=blob --shard="$i/$SHARD_TOTAL" --passWithNoTests \
+              > "/tmp/internal-shard-$i.log" 2>&1 &
+            pids[i]=$!
+          done
+          for i in $(seq 1 "$SHARD_TOTAL"); do
+            if ! wait "${pids[i]}"; then
+              status=1
+              echo "::error::internal unit test shard $i/$SHARD_TOTAL failed"
+            fi
+            echo "::group::🧪 shard $i/$SHARD_TOTAL"
+            cat "/tmp/internal-shard-$i.log"
+            echo "::endgroup::"
+          done
+          exit "$status"
 
       - name: Gather all reports
         if: ${{ !cancelled() }}
@@ -105,44 +141,6 @@ jobs:
           find . -type f -path '*/.vitest-reports/blob-*.json' \
             -exec bash -c 'src="$1"; basename=$(basename "$src"); pkg=$(dirname "$src" | sed "s|^\./||;s|/\.vitest-reports$||;s|/|_|g"); cp "$src" ".vitest-reports/${pkg}-${basename}"' _ {} \;
 
-      - name: Upload blob reports to GitHub Actions Artifacts
+      - name: 📊 Merge reports
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: internal-blob-report-${{ matrix.shardIndex }}
-          path: .vitest-reports/*
-          include-hidden-files: true
-          retention-days: 1
-
-  merge-reports:
-    name: "📊 Merge Reports"
-    if: ${{ !cancelled() }}
-    needs: [unitTests]
-    runs-on: ubuntu-latest
-    steps:
-      - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: ⎔ Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        with:
-          version: 10.33.2
-
-      - name: ⎔ Setup node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 20.20.0
-          # no cache enabled, we're not installing deps
-
-      - name: Download blob reports from GitHub Actions Artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: .vitest-reports
-          pattern: internal-blob-report-*
-          merge-multiple: true
-
-      - name: Merge reports
-        run: pnpm dlx vitest@3.1.4 run --merge-reports --pass-with-no-tests
+        run: pnpm dlx vitest@4.1.7 run --merge-reports --pass-with-no-tests

.github/workflows/unit-tests-observability-map.yml

@@ -0,0 +1,43 @@
+name: "🧪 Unit Tests: Observability Map"
+
+permissions:
+  contents: read
+
+# Its own workflow rather than a job inside observability-map.yml, because that workflow is not
+# reachable from pr_checks.yml's all-checks aggregate and so gates nothing. Called from there
+# instead, behind a paths filter, which is how every other test suite in this repo is gated.
+on:
+  workflow_call:
+
+jobs:
+  unitTests:
+    name: "🧪 Unit Tests: Observability Map"
+    # No containers and no database: the package is a static analyser over source text, so the
+    # suite is CPU bound on parsing the route tree and needs nothing the runner does not have.
+    runs-on: warp-ubuntu-latest-x64-4x
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: WarpBuilds/setup-node@bc639b444d583175926b588962199c247d23e8d3 # v6
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      # This suite reads apps/webapp/app (the route tree for the scan, the whole app tree for the
+      # symbol check) and the report workflow's text, which is why the filter that gates this
+      # workflow watches all of those and not only the routes folder.
+      - name: 🧪 Run tests
+        run: pnpm --filter @internal/observability-map run test

.github/workflows/unit-tests-packages.yml

@@ -14,11 +14,13 @@ on:
 jobs:
   unitTests:
     name: "🧪 Unit Tests: Packages"
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-4x
     strategy:
+      # one flaky shard shouldn't cancel its siblings - lets us re-run only the failed shard
+      fail-fast: false
       matrix:
-        shardIndex: [1]
-        shardTotal: [1]
+        shardIndex: [1, 2, 3]
+        shardTotal: [3]
     env:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       SHARD_INDEX: ${{ matrix.shardIndex }}
@@ -51,9 +53,9 @@ jobs:
         run: sudo systemctl restart docker
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           persist-credentials: false
 
       - name: ⎔ Setup pnpm
@@ -64,13 +66,13 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
       - name: 🐳 Login to DockerHub
         if: ${{ env.DOCKERHUB_USERNAME }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -81,12 +83,22 @@ jobs:
       - name: 🐳 Pre-pull testcontainer images
         if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
+          # Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
+          pull() {
+            for attempt in 1 2 3; do
+              docker pull "$1" && return 0
+              echo "::warning::docker pull $1 failed (attempt ${attempt}/3); retrying in 10s"
+              sleep 10
+            done
+            echo "::error::docker pull $1 failed after 3 attempts"
+            return 1
+          }
           echo "Pre-pulling Docker images with authenticated session..."
-          docker pull postgres:14
-          docker pull clickhouse/clickhouse-server:25.4-alpine
-          docker pull redis:7-alpine
-          docker pull testcontainers/ryuk:0.11.0
-          docker pull electricsql/electric:1.2.4
+          pull postgres:14
+          pull clickhouse/clickhouse-server:26.2.19.43-alpine@sha256:c6ad6a7eb2fb5999df3adfb8b69a0c7222c68fa9b8f6b04a088564ebbc959251
+          pull redis:7.2
+          pull testcontainers/ryuk:0.14.0
+          pull electricsql/electric:1.2.4
           echo "Image pre-pull complete"
 
       - name: 📥 Download deps
@@ -96,7 +108,7 @@ jobs:
         run: pnpm run generate
 
       - name: 🧪 Run Package Unit Tests
-        run: pnpm run test:packages --reporter=default --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+        run: pnpm run test:packages --reporter=default --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --passWithNoTests
 
       - name: Gather all reports
         if: ${{ !cancelled() }}
@@ -118,12 +130,12 @@ jobs:
     name: "📊 Merge Reports"
     if: ${{ !cancelled() }}
     needs: [unitTests]
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           persist-credentials: false
 
       - name: ⎔ Setup pnpm
@@ -134,7 +146,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           # no cache enabled, we're not installing deps
 
       - name: Download blob reports from GitHub Actions Artifacts
@@ -145,4 +157,4 @@ jobs:
           merge-multiple: true
 
       - name: Merge reports
-        run: pnpm dlx vitest@3.1.4 run --merge-reports --pass-with-no-tests
+        run: pnpm dlx vitest@4.1.7 run --merge-reports --pass-with-no-tests

.github/workflows/unit-tests-webapp.yml

@@ -14,11 +14,18 @@ on:
 jobs:
   unitTests:
     name: "🧪 Unit Tests: Webapp"
-    runs-on: ubuntu-latest
+    # 10 shards on 16x machines: webapp test throughput is limited per-machine (one
+    # docker daemon + disk absorbing all the per-file Postgres/ClickHouse container
+    # spin-up), so many machines beats few big ones - fewer/bigger (3x32) measured
+    # SLOWER than 10x8. The 16x (vs 8x) gives the fork pool the CPU headroom the 8x
+    # runners lacked. Setup overhead per machine is ~1 min on warm runners.
+    runs-on: warp-ubuntu-latest-x64-16x
     strategy:
+      # one flaky shard shouldn't cancel its siblings - lets us re-run only the failed shard
+      fail-fast: false
       matrix:
-        shardIndex: [1, 2, 3, 4, 5, 6, 7, 8]
-        shardTotal: [8]
+        shardIndex: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
+        shardTotal: [12]
     env:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       SHARD_INDEX: ${{ matrix.shardIndex }}
@@ -51,9 +58,9 @@ jobs:
         run: sudo systemctl restart docker
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           persist-credentials: false
 
       - name: ⎔ Setup pnpm
@@ -64,13 +71,13 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
       - name: 🐳 Login to DockerHub
         if: ${{ env.DOCKERHUB_USERNAME }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -81,12 +88,23 @@ jobs:
       - name: 🐳 Pre-pull testcontainer images
         if: ${{ env.DOCKERHUB_USERNAME }}
         run: |
+          # Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
+          pull() {
+            for attempt in 1 2 3; do
+              docker pull "$1" && return 0
+              echo "::warning::docker pull $1 failed (attempt ${attempt}/3); retrying in 10s"
+              sleep 10
+            done
+            echo "::error::docker pull $1 failed after 3 attempts"
+            return 1
+          }
           echo "Pre-pulling Docker images with authenticated session..."
-          docker pull postgres:14
-          docker pull clickhouse/clickhouse-server:25.4-alpine
-          docker pull redis:7-alpine
-          docker pull testcontainers/ryuk:0.11.0
-          docker pull electricsql/electric:1.2.4
+          pull postgres:14
+          pull clickhouse/clickhouse-server:26.2.19.43-alpine@sha256:c6ad6a7eb2fb5999df3adfb8b69a0c7222c68fa9b8f6b04a088564ebbc959251
+          pull redis:7.2
+          pull testcontainers/ryuk:0.14.0
+          pull electricsql/electric:1.2.4
+          pull minio/minio:latest
           echo "Image pre-pull complete"
 
       - name: 📥 Download deps
@@ -96,7 +114,7 @@ jobs:
         run: pnpm run generate
 
       - name: 🧪 Run Webapp Unit Tests
-        run: pnpm run test:webapp --reporter=default --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+        run: pnpm run test:webapp --reporter=default --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --passWithNoTests
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
           DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
@@ -126,12 +144,12 @@ jobs:
     name: "📊 Merge Reports"
     if: ${{ !cancelled() }}
     needs: [unitTests]
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           persist-credentials: false
 
       - name: ⎔ Setup pnpm
@@ -142,7 +160,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20.20.0
+          node-version: 24.18.0
           # no cache enabled, we're not installing deps
 
       - name: Download blob reports from GitHub Actions Artifacts
@@ -153,4 +171,4 @@ jobs:
           merge-multiple: true
 
       - name: Merge reports
-        run: pnpm dlx vitest@3.1.4 run --merge-reports --pass-with-no-tests
+        run: pnpm dlx vitest@4.1.7 run --merge-reports --pass-with-no-tests

.github/workflows/vouch-check-pr.yml

@@ -8,7 +8,7 @@ permissions: {}
 
 jobs:
   check-vouch:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: read
       pull-requests: write # auto-close unvouched PRs
@@ -34,7 +34,7 @@ jobs:
       github.event.pull_request.user.login != 'devin-ai-integration[bot]' &&
       github.event.pull_request.user.login != 'dependabot[bot]' &&
       github.event.pull_request.user.login != 'github-actions[bot]'
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     steps:
       - name: Close non-draft PR
         env:

.github/workflows/vouch-manage-by-issue.yml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   manage:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     if: >-
       contains(github.event.comment.body, 'vouch') ||
       contains(github.event.comment.body, 'denounce') ||

.github/workflows/workflow-checks.yml

@@ -4,14 +4,16 @@ on:
   push:
     branches: [main]
     paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-      - '.github/zizmor.yml'
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
+      - ".github/actionlint.yaml"
   pull_request:
     paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-      - '.github/zizmor.yml'
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
+      - ".github/actionlint.yaml"
 
 permissions: {}
 
@@ -22,12 +24,12 @@ concurrency:
 jobs:
   actionlint:
     name: Actionlint
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -36,16 +38,21 @@ jobs:
 
   zizmor:
     name: Zizmor
-    runs-on: ubuntu-latest
+    # Uploads SARIF to the Security tab, which requires GitHub code scanning to be
+    # enabled on the repository. Set the ENABLE_WORKFLOW_SECURITY_SCAN repository
+    # variable to 'false' to skip this job where code scanning isn't available;
+    # leave it unset (the default) to run the scan.
+    if: ${{ vars.ENABLE_WORKFLOW_SECURITY_SCAN != 'false' }}
+    runs-on: warp-ubuntu-latest-x64-2x
     permissions:
       security-events: write # Upload SARIF to GitHub Security tab
       contents: read # Read workflow files for analysis
       actions: read # Read workflow run metadata
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7

.github/zizmor.yml

@@ -2,4 +2,4 @@ rules:
   unpinned-uses:
     config:
       policies:
-        '*': hash-pin
+        "*": hash-pin

.gitignore

@@ -67,9 +67,21 @@ apps/**/public/build
 **/.claude/settings.local.json
 .claude/architecture/
 .claude/docs-plans/
+.claude/plans/
 .claude/review-guides/
 .claude/scheduled_tasks.lock
 .mcp.log
 .mcp.json
 .cursor/debug.log
-ailogger-output.log
+ailogger-output.log
+# per-package vitest timing capture (transient; merged into root test-timings.json)
+.vitest-timing.json
+
+# local git worktree checkouts (not source) — keeps oxfmt/oxlint from descending into them
+.worktrees/
+
+# local planning/design docs, not committed
+**/docs/superpowers/
+
+# observability-map CLI output artifact, not committed
+observability-map.json

.nvmrc

@@ -1 +1 @@
-v20.20.0
+v24.18.0

.oxfmtrc.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "singleQuote": false,
+  "jsxSingleQuote": false,
+  "trailingComma": "es5",
+  "bracketSpacing": true,
+  "bracketSameLine": false,
+  "printWidth": 100,
+  "tabWidth": 2,
+  "useTabs": false,
+  "sortPackageJson": false,
+  "ignorePatterns": [
+    "node_modules",
+    ".env",
+    ".env.local",
+    "pnpm-lock.yaml",
+    "tailwind.css",
+    ".babelrc.json",
+    "**/.react-email/",
+    "**/storybook-static/",
+    "**/.changeset/",
+    "**/dist/",
+    "internal-packages/tsql/src/grammar/",
+    "internal-packages/llm-model-catalog/src/defaultPrices.ts",
+    "internal-packages/llm-model-catalog/src/modelCatalog.ts",
+    // Maybe turn these on in the future
+    "**/*.yaml",
+    "**/*.mdx",
+    "**/*.md"
+  ]
+}

.oxlintrc.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "import", "react"],
+  "jsPlugins": [
+    "./oxlint-plugins/no-thrown-unawaited-redirect.mjs",
+    "./oxlint-plugins/runops-residency.mjs"
+  ],
+  "ignorePatterns": [
+    "**/dist/**",
+    "**/build/**",
+    "**/*.d.ts",
+    "**/seed.js",
+    "**/seedCloud.ts",
+    "**/populate.js",
+    "internal-packages/tsql/src/grammar/"
+  ],
+  "rules": {
+    "no-unused-vars": [
+      "error",
+      {
+        "args": "none",
+        "argsIgnorePattern": "^_",
+        "varsIgnorePattern": "^_",
+        "caughtErrors": "all",
+        "caughtErrorsIgnorePattern": "^_",
+        "destructuredArrayIgnorePattern": "^_",
+        "ignoreRestSiblings": true
+      }
+    ],
+    "no-empty-pattern": "off",
+    "no-control-regex": "off",
+    "typescript/no-non-null-asserted-optional-chain": "off",
+    "no-unused-expressions": ["warn", { "allowShortCircuit": true, "allowTernary": true }],
+    "typescript/consistent-type-imports": "error",
+    "import/no-duplicates": "error",
+    "import/namespace": "off",
+    "react-hooks/exhaustive-deps": "off",
+    "react-hooks/rules-of-hooks": "off",
+    "trigger/no-thrown-unawaited-redirect": "error"
+  },
+  "overrides": [
+    {
+      "files": ["apps/webapp/app/**/*.ts", "apps/webapp/app/**/*.tsx"],
+      "rules": {
+        "trigger-runops/no-control-plane-run-graph-access": "error",
+        "trigger-runops/no-control-plane-in-runops-slot": "error"
+      }
+    },
+    {
+      "files": ["apps/webapp/app/**/*.test.ts", "apps/webapp/app/**/*.test.tsx"],
+      "rules": {
+        "trigger-runops/no-control-plane-run-graph-access": "off",
+        "trigger-runops/no-control-plane-in-runops-slot": "off"
+      }
+    }
+  ]
+}

.prettierignore

@@ -1,10 +0,0 @@
-node_modules
-.env
-.env.local
-pnpm-lock.yaml
-tailwind.css
-.babelrc.json
-**/.react-email/
-**/storybook-static/
-**/.changeset/
-**/dist/

.server-changes/README.md

@@ -1,10 +1,10 @@
 # Server Changes
 
-This directory tracks changes to server-only components (webapp, supervisor, coordinator, etc.) that are not captured by changesets. Changesets only track published npm packages — server changes would otherwise go undocumented.
+This directory tracks changes to server-only components (webapp, supervisor, etc.) that are not captured by changesets. Changesets only track published npm packages — server changes would otherwise go undocumented.
 
 ## When to add a file
 
-**Server-only PRs**: If your PR only changes `apps/webapp/`, `apps/supervisor/`, `apps/coordinator/`, or other server components (and does NOT change anything in `packages/`), add a `.server-changes/` file.
+**Server-only PRs**: If your PR only changes `apps/webapp/`, `apps/supervisor/`, or other server components (and does NOT change anything in `packages/`), add a `.server-changes/` file.
 
 **Mixed PRs** (both packages and server): Just add a changeset as usual. No `.server-changes/` file needed — the changeset covers it.
 
@@ -31,13 +31,27 @@ Speed up batch queue processing by removing stalls and fixing retry race
 
 ### Fields
 
-- **area** (required): `webapp` | `supervisor` | `coordinator` | `kubernetes-provider` | `docker-provider`
+- **area** (required): `webapp` | `supervisor`
 - **type** (required): `feature` | `fix` | `improvement` | `breaking`
 
 ### Description
 
 The body text (below the frontmatter) is a one-line description of the change. Keep it concise — it will appear in release notes.
 
+### Writing guidance
+
+These entries are public-facing - they ship verbatim in user-visible release notes. A few rules to keep them clean:
+
+- **Write for the user, not the reviewer.** Lead with what the user notices or has to do. If a reader who doesn't know the codebase can't tell what changed for them, rewrite it.
+- **One sentence is usually enough.** The body is the bullet in the changelog. If you need a paragraph, you're probably describing the implementation rather than the change.
+- **Describe behavior, not implementation.** Skip internal scopes, middleware names, library specifics, framework internals. Users care about what's different for them, not how it's wired.
+- **Never name internal tools or infra.** Observability stacks, internal services, infra components, monitoring backends, CI surfaces, AWS specifics - none of these belong in user-facing notes.
+
+Before / after:
+
+- ❌ _"The image verification step now parses the manifest's layer media types and returns a new result the finalizer rejects."_ (describes the wiring; a user can't act on it)
+- ✅ _"Deploying with an outdated CLI could produce an image that fails to start on every run. These deploys are now stopped before going live, with a message asking you to upgrade the CLI and re-deploy."_ (what the user sees and does)
+
 ## Lifecycle
 
 1. Engineer adds a `.server-changes/` file in their PR

.server-changes/backpressure-hold-last-verdict.md

@@ -0,0 +1,6 @@
+---
+area: supervisor
+type: fix
+---
+
+When the capacity signal drops out, the last decision is held for a grace period rather than released.

.server-changes/batch-item-streaming-rate-limit.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Batch triggers no longer fail to start their runs when an environment is under heavy API load. If a batch still can't finish being created, `batchTriggerAndWait` now fails with an error instead of leaving the parent run waiting forever, and the batches page says so rather than reporting that it resumed.

.server-changes/clamp-run-priority.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Triggering a run with a very large `priority` no longer fails. The priority is now capped to the highest supported value instead of erroring out.

.server-changes/collapse-trigger-queued-snapshot.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Triggering a task now does one fewer database write, so runs reach the queue slightly faster.

.server-changes/dev-cli-disconnect-md

@@ -1,6 +0,0 @@
----
-area: webapp
-type: feature
----
-
-Added `/engine/v1/dev/disconnect` endpoint to auto-cancel runs when the CLI disconnects. Maximum of 500 runs can be cancelled. Uses the bulk action system when there are more than 25 runs to cancel.

.server-changes/fix-database-connect-timeout.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Honor the configured database connection timeout so brief connection spikes no longer surface as spurious "can't reach database server" errors.

.server-changes/fix-runs-list-batch-drop-on-unparseable-json.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Fixed a rare case where a single run or span carrying data that could not be ingested would make other runs or trace events in the same batch go missing from the runs list, traces, and logs. Now the rest of the batch is always kept: an affected run still appears with its status (only its un-ingestable output is dropped), and an affected trace event or payload is skipped instead of taking down everything around it.

.server-changes/fix-sidebar-feedback.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Fix the sidebar "Help & Feedback → Contact us" form sometimes not sending your message. It now sends reliably every time.

.server-changes/impersonation-consent-and-view-as-user.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Admins opening an impersonation link from outside the dashboard now get a confirmation page naming the organization and destination instead of being bounced back, and while impersonating they can switch to "View as user" to see the dashboard exactly as that user sees it, with the admin-only UI and the impersonation highlight both hidden. Stopping impersonation is still one click away in the account menu.

.server-changes/light-theme.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+The dashboard gets a refreshed Dark theme as its new default look. On the account page you can switch to Light, System preference (follows your OS), or the original Classic look, and fine-tune the new themes with a contrast slider.

.server-changes/multi-task-scope-enforcement.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Requests spanning multiple tasks now require permission for every requested task instead of accepting permission for only one task.

.server-changes/page-tab-titles.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Browser tabs now name the page you're on, and the run, task or queue when you're looking at one, instead of all reading "Trigger.dev".

.server-changes/per-client-connection-timeouts.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Allow the database connection pool and connect timeouts to be tuned separately for each database's writer and read replica, falling back to the shared defaults when unset.

.server-changes/plain-graphql-migration.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+In-app feedback and add-on/quota requests are now recorded with more account context for the support team.

.server-changes/pod-count-exact-list.md

@@ -0,0 +1,6 @@
+---
+area: supervisor
+type: improvement
+---
+
+Self-hosted Kubernetes deployments now measure running-task count more accurately when deciding whether to pause pulling new work, so the safeguard engages closer to its configured thresholds.