Upkeep 2026-07

.Rbuildignore

@@ -25,5 +25,7 @@
 ^vignettes/articles/*_files$
 ^vignettes/articles$
 ^\.vscode$
-^[\.]?air\.toml$
 ^\.git-blame-ignore-revs$
+^AGENTS\.md$
+^\.claude$
+^[.]?air[.]toml$

.claude/.gitignore

@@ -0,0 +1 @@
+settings.local.json

.claude/CLAUDE.md

@@ -0,0 +1 @@
+@../AGENTS.md

.claude/settings.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "deny": [
+      "Read(.Renviron)",
+      "Read(.env)"
+    ]
+  }
+}

.github/workflows/R-CMD-check.yaml

@@ -24,11 +24,7 @@ jobs:
       matrix:
         config:
           - {os: macos-latest,   r: 'release'}
-
           - {os: windows-latest, r: 'release'}
-          # use 4.0 or 4.1 to check with rtools40's older compiler
-          - {os: windows-latest, r: 'oldrel-3'}
-
           - {os: ubuntu-latest,  r: 'devel', http-user-agent: 'release'}
           - {os: ubuntu-latest,  r: 'release'}
           - {os: ubuntu-latest,  r: 'oldrel-1'}
@@ -41,28 +37,23 @@ jobs:
       R_KEEP_PKG_SOURCE: yes
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: r-lib/actions/setup-pandoc@v2
 
       - uses: r-lib/actions/setup-tinytex@v2
-        env:
-          TINYTEX_INSTALLER: TinyTeX
 
       - uses: r-lib/actions/setup-r@v2
         with:
           r-version: ${{ matrix.config.r }}
           http-user-agent: ${{ matrix.config.http-user-agent }}
-          use-public-rspm: true
 
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:
           extra-packages: any::rcmdcheck
           needs: check
 
       - uses: r-lib/actions/check-r-package@v2
-        env:
-          R_QUARTO_QUIET: false
         with:
           upload-snapshots: true
           build_args: 'c("--no-manual","--compact-vignettes=gs+qpdf")'

.github/workflows/format-suggest.yaml

@@ -0,0 +1,46 @@
+# Workflow derived from https://github.com/posit-dev/setup-air/tree/main/examples
+
+on:
+  # Using `pull_request_target` over `pull_request` for elevated `GITHUB_TOKEN`
+  # privileges, otherwise we can't set `pull-requests: write` when the pull
+  # request comes from a fork, which is our main use case (external contributors).
+  #
+  # `pull_request_target` runs in the context of the target branch (`main`, usually),
+  # rather than in the context of the pull request like `pull_request` does. Due
+  # to this, we must explicitly checkout `ref: ${{ github.event.pull_request.head.sha }}`.
+  # This is typically frowned upon by GitHub, as it exposes you to potentially running
+  # untrusted code in a context where you have elevated privileges, but they explicitly
+  # call out the use case of reformatting and committing back / commenting on the PR
+  # as a situation that should be safe (because we aren't actually running the untrusted
+  # code, we are just treating it as passive data).
+  # https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
+  pull_request_target:
+
+name: format-suggest.yaml
+
+jobs:
+  format-suggest:
+    name: format-suggest
+    runs-on: ubuntu-latest
+
+    permissions:
+      # Required to push suggestion comments to the PR
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Install
+        uses: posit-dev/setup-air@v1
+
+      - name: Format
+        run: air format .
+
+      - name: Suggest
+        uses: reviewdog/action-suggester@v1
+        with:
+          level: error
+          fail_level: error
+          tool_name: air

.github/workflows/pkgdown.yaml

@@ -23,13 +23,11 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: r-lib/actions/setup-pandoc@v2
 
       - uses: r-lib/actions/setup-r@v2
-        with:
-          use-public-rspm: true
 
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:
@@ -44,7 +42,7 @@ jobs:
 
       - name: Deploy to GitHub pages 🚀
         if: github.event_name != 'pull_request'
-        uses: JamesIves/github-pages-deploy-action@v4.5.0
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           clean: false
           branch: gh-pages

.github/workflows/test-coverage.yaml

@@ -16,23 +16,19 @@ jobs:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: r-lib/actions/setup-pandoc@v2
 
+      - uses: r-lib/actions/setup-tinytex@v2
+
       - uses: r-lib/actions/setup-r@v2
-        with:
-          use-public-rspm: true
 
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:
           extra-packages: any::covr, any::xml2
           needs: coverage
 
-      - uses: r-lib/actions/setup-tinytex@v2
-        env:
-          TINYTEX_INSTALLER: TinyTeX
-
       - name: Test coverage
         run: |
           cov <- covr::package_coverage(
@@ -44,7 +40,7 @@ jobs:
           covr::to_cobertura(cov)
         shell: Rscript {0}
 
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         with:
           # Fail if error if not on PR, or if on PR and token is given
           fail_ci_if_error: ${{ github.event_name != 'pull_request' || secrets.CODECOV_TOKEN }}
@@ -62,7 +58,7 @@ jobs:
 
       - name: Upload test results
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-test-failures
           path: ${{ runner.temp }}/package

AGENTS.md

@@ -0,0 +1,115 @@
+## This package
+
+<!-- Insert package-specific content here. use_tidy_agents() will preserve this section when updating the rest of the file. -->
+
+## Package development
+
+### Key commands
+
+(All these functions have been optimized for agentic use, so they can be called directly without other arguments.)
+
+```R
+# Executing code
+devtools::load_all()
+code
+
+# Tests
+devtools::test() # all tests
+devtools::test(filter = "^{name}") # tests for files starting with {name}
+devtools::test_active_file("R/{name}.R") # tests for R/{name}.R
+devtools::test_active_file("R/{name}.R", desc = 'blah') # single test with exact description "blah" (no regexp)
+
+# Test coverage
+devtools::test_coverage() # all files
+devtools::test_coverage_active_file("R/{name}.R") # coverage for R/{name}.R from tests in tests/testthat/test-{name}.R
+
+# Documentation
+devtools::document() # redocument package
+pkgdown::check_pkgdown() # check website
+
+# Run complete R CMD check
+devtools::check()
+```
+
+### Running R
+
+There are three possible ways to run code, listed in rough order of desirability:
+
+- If you're running inside Posit Assistant or otherwise have an
+  `executeCode()` tool available, use it to run code in a session that the
+  user can also interact with.
+
+- Otherwise, if an R REPL (e.g. `mcp__r__repl` or `btw::run_r`) is
+  available, use that. Note that `mcp__r__repl` uses a sandbox that blocks
+  network requests and reads/writes outside of the current directory.
+
+- Otherwise, use `Rscript -e "code"`.
+
+### Code style
+
+- Follow the tidyverse style guide
+- Always run `air format .` after generating code.
+- Use the base pipe operator (`|>`), not the magrittr pipe (`%>%`).
+- Use `\() ...` for single-line anonymous functions. For all other cases, use `function() {...}`.
+
+### Test style
+
+- Tests for `R/{name}.R` go in `tests/testthat/test-{name}.R`.
+- All new code should have an accompanying test.
+- If there are existing tests, place new tests next to similar existing tests.
+- Strive to keep your tests minimal with few comments.
+- Never put code in a `test-{name}.R` file outside of a `test_that()` block. Instead, use `tests/testthat/helper.R` or `tests/testthat/helper-{name}.R`.
+- Avoid `expect_true()` and `expect_false()` in favor of a specific expectation with a better failure message. A few expectations in newer releases that you might not know about are `expect_all_true()`, `expect_all_equal()`, and `expect_r6_class()`.
+- When testing errors and warnings:
+  - Only use `expect_error()` or `expect_warning()` if the error or warning has a known class.
+  - Generally, prefer `expect_snapshot(error = TRUE)` for errors and `expect_snapshot()` for warnings because these allow the user to review the full text of the output.
+- Avoid the `.package` argument to `local_mocked_bindings()`; this modifies the namespace of another package, which is not good practice. Instead create a mockable version of the function in the current package. See `?local_mocked_bindings` for more details.
+
+### Documentation
+
+- Every user-facing function should be exported and have roxygen2 documentation.
+- Internal functions should not have roxygen documentation.
+- Wrap roxygen2 comments to 80 characters.
+- Whenever you add a new (non-internal) documentation topic, also add the topic to `_pkgdown.yml`.
+- Always re-document the package after changing a roxygen2 comment.
+- Use `pkgdown::check_pkgdown()` to check that all topics are included in the reference index.
+
+### `NEWS.md`
+
+- Every user-facing change should be given a bullet in `NEWS.md`.
+- Changes that shouldn't get a bullet:
+    - Small documentation changes.
+    - Internal refactorings.
+    - Fixes to bugs introduced in the current dev version.
+- Each bullet should briefly describe the change to the end user and mention the related issue in parentheses.
+- A bullet can consist of multiple sentences but should not contain any newlines (i.e. DO NOT line wrap).
+- If the change is related to a function, put the name of the function early in the bullet.
+- If the change is related to an issue, include the issue number in parentheses.
+- Only include a GitHub username if the PR was created by someone who isn't an author.
+- Order bullets alphabetically by function name. Put all bullets that don't mention function names at the beginning.
+
+## Specialized skills
+
+- Do you need to deprecate a function or argument? Read the output of `usethis::learn_tidy_skill("deprecate")`.
+- Are you adding input checking to an existing function or writing a new exported function? Read the output of `usethis::learn_tidy_skill("arg-checking")`.
+
+## Git
+
+- If the user asks you to commit, use markdown in the commit message, and don't line wrap.
+- If the commit fixes an issue, include `Fixes #num.` on its own line.
+- Only push when the user explicitly requests it.
+
+## Writing
+
+- Use sentence case for headings.
+- Use US English.
+
+### Proofreading
+
+If the user asks you to proofread a file, act as an expert proofreader and editor with a deep understanding of clear, engaging, and well-structured writing.
+
+Work paragraph by paragraph, always starting by making a TODO list that includes individual items for each top-level section.
+
+Fix spelling, grammar, and other minor problems without asking the user. Label any unclear, confusing, or ambiguous sentences with a FIXME comment.
+
+Only report what you have changed.

DESCRIPTION

@@ -34,8 +34,8 @@ Imports:
     httr2 (>= 1.0.2),
     jsonlite,
     lifecycle,
-    openssl,
     nanonext (>= 1.8.0),
+    openssl,
     purrr (>= 1.0.0),
     ragg (>= 1.4.0),
     rlang (>= 1.1.4),
@@ -69,12 +69,12 @@ VignetteBuilder:
     quarto
 Config/Needs/website: usethis, servr
 Config/potools/style: explicit
+Config/roxygen2/version: 8.0.0
 Config/testthat/edition: 3
 Config/testthat/parallel: true
 Config/testthat/start-first: build-article, build-quarto-article,
     build-reference, build
 Config/usethis/last-upkeep: 2025-09-07
 Encoding: UTF-8
 Roxygen: list(markdown = TRUE)
-RoxygenNote: 7.3.3
 SystemRequirements: pandoc (>= 2.10.1)