Promote stage to bkt3 (2026-10-23): upstream 05b697f6a2, SQLite reader fixes, sidebar child group badge

.github/scripts/ci-changes.cjs

@@ -5,6 +5,8 @@
 //   node ci-changes.cjs --paths <file> --full   run every Linux job, gate only the macOS lint
 //   node ci-changes.cjs                         changed paths unknown: run everything
 //
+// scripts/check-changed.ts requires the same decisions so local runs match CI.
+//
 // Every changed path maps to workspace packages, which then pull in their
 // dependents from package.json. A path this file does not recognize runs
 // everything, so a new root file or directory can only cost minutes.
@@ -201,4 +203,6 @@ function main() {
   for (const [key, value] of Object.entries(outputs)) console.log(`${key}=${value}`);
 }
 
-main();
+module.exports = { readWorkspace, decide };
+
+if (require.main === module) main();

.github/scripts/ci-changes.d.cts

@@ -0,0 +1,27 @@
+interface WorkspacePackage {
+  readonly name: string;
+  readonly dir: string;
+  readonly hasTest: boolean;
+  readonly deps: ReadonlyArray<string>;
+}
+
+export function readWorkspace(): Array<WorkspacePackage>;
+
+export function decide(
+  files: ReadonlyArray<string> | null,
+  packages: ReadonlyArray<WorkspacePackage>,
+  full: boolean,
+): {
+  affected: Array<string>;
+  outputs: {
+    typecheck: boolean;
+    build: boolean;
+    test: boolean;
+    test_packages: string;
+    test_web: boolean;
+    test_server: boolean;
+    rust: boolean;
+    release_smoke: boolean;
+    mobile_native: boolean;
+  };
+};

.github/scripts/vercel-deployment-output.test.cjs

@@ -0,0 +1,87 @@
+const assert = require("node:assert/strict");
+const { spawnSync } = require("node:child_process");
+const { mkdtempSync, readFileSync, rmSync, existsSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+const { test } = require("node:test");
+
+const release = readFileSync(join(__dirname, "../workflows/release.yml"), "utf8");
+const preview = readFileSync(join(__dirname, "../workflows/web-preview.yml"), "utf8");
+const stepPattern =
+  /        name: (?:Build staged deployment|Deploy preview)\n        shell: bash\n        run: \|\n((?:          .*\n|\n)+)/g;
+const steps = [
+  ...Array.from(release.matchAll(stepPattern), (match, index) => [
+    index === 0 ? "hosted web" : "marketing",
+    match[1],
+  ]),
+  ...Array.from(preview.matchAll(stepPattern), (match) => ["web preview", match[1]]),
+];
+assert.equal(steps.length, 3, "Expected both release steps and the preview step");
+
+const url = "https://t3code-fixture-pinglabs.vercel.app";
+const warning = 'Error while parsing config file: "/runner/t3code/pnpm-lock.yaml"';
+
+function runStep(script, stdout, exitCode = 0) {
+  const directory = mkdtempSync(join(tmpdir(), "t3-vercel-output-"));
+  const outputFile = join(directory, "output");
+  try {
+    const result = spawnSync(
+      "bash",
+      [
+        "-c",
+        'vp() { printf "%s\\n" "$FIXTURE_STDOUT"; return "$FIXTURE_EXIT"; }\n' +
+          'curl() { printf \'{"id":"fixture-project"}\\n\'; }\n' +
+          script.replace(/^          /gm, "").replace(/\$\{\{.*?\}\}/g, "fixture"),
+      ],
+      {
+        encoding: "utf8",
+        env: {
+          PATH: process.env.PATH,
+          VERCEL_TOKEN: "fixture-token",
+          VERCEL_ORG_ID: "fixture-org",
+          VERCEL_PROJECT_ID: "fixture-project",
+          GITHUB_OUTPUT: outputFile,
+          FIXTURE_STDOUT: stdout,
+          FIXTURE_EXIT: String(exitCode),
+        },
+      },
+    );
+    assert.ifError(result.error);
+    return {
+      ...result,
+      output: existsSync(outputFile) ? readFileSync(outputFile, "utf8") : "",
+    };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+for (const [name, script] of steps) {
+  for (const [label, stdout] of [
+    ["plain URL", url],
+    ["lockfile warning", `${warning}\n${url}`],
+    ["trailing diagnostic", `${url}\nDone`],
+  ]) {
+    test(`${name}: saves one deployment URL after ${label}`, () => {
+      const result = runStep(script, stdout);
+      assert.equal(result.status, 0, result.stderr);
+      assert.deepEqual(
+        result.output.split("\n").filter((line) => !line.startsWith("project_id=")),
+        [`deployment_url=${url}`, ""],
+      );
+    });
+  }
+
+  for (const [label, stdout, exitCode] of [
+    ["missing URL", warning, 0],
+    ["invalid URL", "https://example.invalid/deployment", 0],
+    ["multiple URLs", `${url}\nhttps://other.vercel.app`, 0],
+    ["failed deployment", url, 1],
+  ]) {
+    test(`${name}: rejects ${label} without saving output`, () => {
+      const result = runStep(script, stdout, exitCode);
+      assert.notEqual(result.status, 0);
+      assert.equal(result.output, "");
+    });
+  }
+}

.github/workflows/ci.yml

@@ -15,8 +15,8 @@ concurrency:
 
 jobs:
   # Skips jobs a pull request cannot affect: a web change does not run the
-  # server shards, a server change does not run the mobile tests, and the macOS
-  # lint (~6.7x a Linux minute) runs only for native mobile sources.
+  # server shards, and a server change does not run the mobile tests.
+  # T3-CUSTOM(expbkt3): Native mobile lint is manual; CI needs no macOS runner.
   # .github/scripts/ci-changes.cjs maps changed files to workspace packages and
   # their dependents. Pushes to main still run every Linux job. Detection fails
   # open: if the diff cannot be resolved, everything runs.
@@ -33,7 +33,6 @@ jobs:
       test_server: ${{ steps.detect.outputs.test_server }}
       rust: ${{ steps.detect.outputs.rust }}
       release_smoke: ${{ steps.detect.outputs.release_smoke }}
-      mobile_native: ${{ steps.detect.outputs.mobile_native }}
     steps:
       # Only the package manifests the script reads to build the dependency graph.
       # Depth 2 brings the base commit the change is diffed against.
@@ -253,7 +252,7 @@ jobs:
         run: python3 -B .github/scripts/stage-preview-bundle.test.py
 
       - name: Test release checks
-        run: node --test .github/scripts/check-nightly-release.test.cjs
+        run: node --test .github/scripts/check-nightly-release.test.cjs .github/scripts/vercel-deployment-output.test.cjs
 
       - name: Finish installing browser secret helper build libraries
         timeout-minutes: 5
@@ -464,36 +463,6 @@ jobs:
             cargo test --locked --manifest-path "native/$crate/Cargo.toml"
           done
 
-  mobile_native_static_analysis:
-    name: Mobile Native Static Analysis
-    needs: changes
-    if: ${{ !cancelled() && needs.changes.outputs.mobile_native != 'false' }}
-    runs-on: blacksmith-6vcpu-macos-26
-    timeout-minutes: 25
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          sparse-checkout: |
-            /*
-            !/.repos/
-          sparse-checkout-cone-mode: false
-
-      - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@v1
-        with:
-          node-version-file: package.json
-          cache: true
-          run-install: |
-            args:
-              - --filter=@t3tools/scripts...
-
-      - name: Install mobile native static analysis tools
-        run: brew bundle install --file apps/mobile/Brewfile
-
-      - name: Lint mobile native sources
-        run: vp run lint:mobile
-
   release_smoke:
     name: Release Smoke
     needs: changes
@@ -524,18 +493,8 @@ jobs:
   check:
     name: Check
     if: ${{ always() }}
-    needs:
-      [
-        changes,
-        lint,
-        build,
-        test,
-        test_web,
-        test_server,
-        rust,
-        mobile_native_static_analysis,
-        release_smoke,
-      ]
+    # T3-CUSTOM(expbkt3): Native mobile lint is not a dependency of Check.
+    needs: [changes, lint, build, test, test_web, test_server, rust, release_smoke]
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
@@ -545,10 +504,10 @@ jobs:
         run: |
           echo "$RESULTS" | jq -r 'to_entries[] | "\(.key): \(.value.result)"'
           # A job may skip only when `changes` said every gate it represents was
-          # not needed. Gates are keyed by job name, except merged Build and the
-          # macOS lint.
+          # not needed. Gates are keyed by job name, except merged Build.
+          # T3-CUSTOM(expbkt3): The native mobile lint job is removed in this fork.
           echo "$RESULTS" | jq -e '.changes.outputs as $gates
-            | {build: ["build", "typecheck"], mobile_native_static_analysis: ["mobile_native"]} as $renamed
+            | {build: ["build", "typecheck"]} as $renamed
             | all(to_entries[];
                 .value.result == "success"
                 or (.value.result == "skipped"

.github/workflows/deploy-bkt3.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
         with:
-          version: 11.10.0
+          version: 12.14.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v7

.github/workflows/deploy-expbkt3.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
         with:
-          version: 11.10.0
+          version: 12.14.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v7

.github/workflows/deploy-stage.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
         with:
-          version: 11.10.0
+          version: 12.14.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v7

.github/workflows/release-desktop.yml

@@ -253,18 +253,13 @@ jobs:
           if [[ "${{ inputs.version }}" =~ -nightly\.[0-9]{8}\.[0-9]+$ ]]; then brand=nightly; fi
           node scripts/apply-web-brand-assets.ts "$brand" apps/server/dist/client
 
-      # The single-executable is built with a Node that supports --build-sea
-      # (25.7+); the repo itself stays on the engines.node version. A native
-      # build injects into the runner's own Node; a Windows target downloads its
-      # node.exe.
+      # Setup Vite+ selects the exact engines.node version from package.json.
+      # Native builds embed that executable; cross-target builds download the
+      # same version for their target.
       - name: Build CLI single-executable
         if: inputs.cli_archive
         shell: bash
         env:
-          # The exact version, not a major: vp downloads it from nodejs.org/dist on
-          # the runner, and only exact versions have a dist directory. Keep in
-          # step with SEA_NODE_VERSION in apps/server/vite.config.ts.
-          VP_NODE_VERSION: "26.8.2"
           # The executable bundles the server again, so it needs the same stamp
           # as release.yml's JS bundle.
           T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && inputs.release_channel || 'dev' }}

.github/workflows/release.yml

@@ -1072,7 +1072,7 @@ jobs:
           fi
 
           echo "Building hosted web app for $channel_name channel."
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --prod \
@@ -1091,6 +1091,13 @@ jobs:
               --build-env "VITE_HOSTED_APP_URL=$router_url" \
               --build-env "VITE_HOSTED_APP_CHANNEL=$channel_name"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
           echo "Staged $deployment_url."
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"
 
@@ -1219,7 +1226,7 @@ jobs:
           )"
           export VERCEL_PROJECT_ID
 
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --prod \
@@ -1228,6 +1235,13 @@ jobs:
               --token "$VERCEL_TOKEN" \
               --scope "${VERCEL_TEAM_SLUG:-$VERCEL_ORG_ID}"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
           echo "Staged $deployment_url."
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"
           echo "project_id=$VERCEL_PROJECT_ID" >> "$GITHUB_OUTPUT"

.github/workflows/web-preview.yml

@@ -77,13 +77,20 @@ jobs:
 
           vercel_scope="${VERCEL_TEAM_SLUG:-$VERCEL_ORG_ID}"
 
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --yes \
               --token "$VERCEL_TOKEN" \
               --scope "$vercel_scope"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
 
           echo "Deployed $deployment_url"
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"

.pnpmfile.cjs

@@ -0,0 +1,21 @@
+// Windows WSL dev mode runs the server under Linux from the same node_modules
+// as the Windows client, so Windows installs also need Linux x64 glibc native
+// modules. Other platforms install only their own binaries; setting this
+// everywhere added ~2.2 GB of foreign binaries to every macOS install.
+// Release scripts stage their own installs with explicit architectures.
+module.exports = {
+  hooks: {
+    updateConfig(config) {
+      // oxlint-disable-next-line t3code/no-global-process-runtime -- pnpm loads this file before any Effect runtime exists.
+      if (process.platform !== "win32") return config;
+      return {
+        ...config,
+        supportedArchitectures: {
+          os: ["current", "linux"],
+          cpu: ["current", "x64"],
+          libc: ["current", "glibc"],
+        },
+      };
+    },
+  },
+};

.vercelignore

@@ -0,0 +1,2 @@
+# Vercel's default .pnp* rule also excludes pnpm's hook, whose checksum is in the lockfile.
+!/.pnpmfile.cjs