@blamejs/blamejs-shop 0.4.85 → 0.4.86

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.86 (2026-06-22) — **Failed outbound webhook deliveries are now retried automatically on the backoff schedule, not only by a manual click.** Restores the automatic retry guarantee for outbound webhooks. When an order-lifecycle or low-stock delivery to a subscriber endpoint fails, the delivery already records its next retry time and walks a backoff schedule toward the dead-letter queue — but nothing was ever driving those retries, so a delivery only re-attempted when an operator hand-clicked retry in the admin console. A briefly-unreachable receiver (a deploy, a load-balancer reload) therefore lost every event in the gap. A scheduled tick now re-attempts every due delivery once a minute, so a failed delivery is retried automatically — at one minute, five minutes, thirty minutes, four hours, then a day — until it succeeds or lands in the dead-letter queue, with no manual intervention. The manual retry remains available as an immediate override. No configuration changes; upgrade to pick it up. **Fixed:** *Outbound webhook retries now run automatically* — A scheduled retry pass re-attempts every delivery whose backoff has come due, advancing it through the retry schedule to success or to the dead-letter queue without an operator click. Each delivery is claimed atomically before it is attempted, so two overlapping passes can never re-send the same delivery twice, and a receiver that recovers within the backoff window now receives the events it missed. An operator can still force an immediate retry from the admin console. **Security:** *Bundled framework refreshed to blamejs 0.15.16* — Picks up a broad fail-closed and resource-exhaustion hardening pass that rides inside the composed primitives: a present-but-unparseable timestamp on a credential or certificate verifier (DKIM, ARC, SAML NotBefore, FIDO/BIMI/S-MIME validity windows) now refuses the credential instead of silently skipping the check; DMARC refuses a record with no usable policy rather than defaulting a failing message to delivery; outbound clients enforce an overall wall-clock timeout (not only an idle timer) so a byte-trickling peer can no longer hold a request open indefinitely; DNS lookups gain a default deadline; and append-only log sinks refuse a symlinked path. No configuration changes.
+
 - v0.4.85 (2026-06-22) — **Stock-transfer reconciliation credits the destination exactly once, even when retried after a mid-operation failure.** Fixes an inventory-integrity bug in stock-transfer reconciliation. Reconciling a received transfer credits each line's received quantity to the destination shelf and then records the line's discrepancy. If that discrepancy write failed partway through the transfer, reconciliation rolled its own state back so the operator could retry — but the retry credited the already-credited lines a second time, inflating the destination shelf with stock that was never received and could then be oversold. The destination credit is now keyed and idempotent: a retry recognizes a line it has already credited and skips it, so the shelf is credited exactly once no matter how many times reconciliation runs. The release adds one additive, backward-compatible database migration; apply pending migrations on upgrade. **Fixed:** *Stock-transfer reconciliation no longer double-credits the destination on retry* — Reconciling a received transfer credited each line to the destination shelf before stamping the line's discrepancy. A failure between those two steps rolled the transfer back to 'received' for a clean retry, but the retry re-credited every line whose discrepancy had not yet been stamped — including lines already credited on the failed attempt — minting phantom inventory at the destination. The per-line destination credit is now idempotent and keyed to the transfer and line, so re-running reconciliation after any partial failure credits each line exactly once; the discrepancy stamp is no longer load-bearing for correctness. **Migration:** *inventory_adjustments gains a nullable idempotency key* — Adds a nullable idempotency_key column to inventory_adjustments and a unique index over it, so a keyed stock credit records that it has already been applied and a retry that re-presents the key credits nothing. The column is NULL for every existing row and for plain stock adjustments, which already apply atomically; only keyed credits set it. The change is additive and backward-compatible — apply pending D1 migrations on upgrade.
 
 - v0.4.84 (2026-06-22) — **Payment idempotency and analytics cache keys now use the framework's canonical-JSON encoder.** Internal consistency change with no configuration to apply. The Stripe idempotency replay-protection hash and the subscription-analytics cache key each carried their own copy of a sorted-key JSON serializer; both now compose the framework's canonical-JSON encoder, so a single serializer — with one set of key-ordering, string-escaping, and number-format rules — backs every replay and cache hash. Idempotency replays issued across the upgrade keep working: a request hash written by the prior release is still recognized for the row's lifetime, so a payment retried across the upgrade boundary replays its cached response rather than being refused as a mismatch. Upgrade to pick it up. **Changed:** *Replay and cache hashes share one canonical-JSON encoder* — Payment idempotency-key replay protection and the subscription-analytics cache key now build their hashes with the framework's canonical-JSON encoder instead of a locally maintained serializer. The encoder emits object members in one stable key order, so two requests — or two analytics queries — that differ only in member order resolve to the same hash, and the order is now stable even for integer-like keys, which the previous serializer reordered. Idempotency rows written by the prior release are still matched for their lifetime, so a payment retried across the upgrade boundary replays its cached response and is never refused as a false mismatch; the compatibility path expires with those rows.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.85",
+  "version": "0.4.86",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/order.js

@@ -802,8 +802,10 @@ function create(opts) {
       // outbound HTTP, or a slow / unreachable endpoint would block the
       // transition for seconds (the HTTP client's idle timeout plus
       // retry). send() persists a delivery row per subscriber and attempts
-      // delivery in the background; a failure lives in
-      // `webhook_deliveries.last_error` for retry from the admin console.
+      // delivery in the background; a failure stamps `next_retry_at` and is
+      // re-attempted automatically on the backoff schedule by the
+      // /_/webhook-retry-tick cron (an operator can also force an immediate
+      // retry from the admin console), walking toward success or the DLQ.
       // The promise is detached with a swallowing .catch so a rejection —
       // or a synchronous throw from send() — never becomes an
       // unhandledRejection and never touches the transition's latency.

package/lib/security-middleware.js

@@ -111,6 +111,7 @@ var INTERNAL_BRIDGE_PATHS = [
   "/_/customer-portal-expire",
   "/_/stale-order-reap",
   "/_/quote-expiry-tick",
+  "/_/webhook-retry-tick",
 ];
 
 // Public well-known paths fetched by third-party verification crawlers

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.15",
-      "tag": "v0.15.15",
+      "version": "0.15.16",
+      "tag": "v0.15.16",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -836,6 +836,7 @@
         "release-notes/v0.15.13.json": "lib/vendor/blamejs/release-notes/v0.15.13.json",
         "release-notes/v0.15.14.json": "lib/vendor/blamejs/release-notes/v0.15.14.json",
         "release-notes/v0.15.15.json": "lib/vendor/blamejs/release-notes/v0.15.15.json",
+        "release-notes/v0.15.16.json": "lib/vendor/blamejs/release-notes/v0.15.16.json",
         "release-notes/v0.15.2.json": "lib/vendor/blamejs/release-notes/v0.15.2.json",
         "release-notes/v0.15.3.json": "lib/vendor/blamejs/release-notes/v0.15.3.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
@@ -992,6 +993,7 @@
         "test/layer-0-primitives/atomic-file-conflict-path.test.js": "lib/vendor/blamejs/test/layer-0-primitives/atomic-file-conflict-path.test.js",
         "test/layer-0-primitives/atomic-file-exclusive-temp.test.js": "lib/vendor/blamejs/test/layer-0-primitives/atomic-file-exclusive-temp.test.js",
         "test/layer-0-primitives/atomic-file-fd-read.test.js": "lib/vendor/blamejs/test/layer-0-primitives/atomic-file-fd-read.test.js",
+        "test/layer-0-primitives/atomic-file-open-append-nofollow.test.js": "lib/vendor/blamejs/test/layer-0-primitives/atomic-file-open-append-nofollow.test.js",
         "test/layer-0-primitives/atomic-file-open-nofollow.test.js": "lib/vendor/blamejs/test/layer-0-primitives/atomic-file-open-nofollow.test.js",
         "test/layer-0-primitives/atomic-file-rename-retry.test.js": "lib/vendor/blamejs/test/layer-0-primitives/atomic-file-rename-retry.test.js",
         "test/layer-0-primitives/atomic-file-write-excl.test.js": "lib/vendor/blamejs/test/layer-0-primitives/atomic-file-write-excl.test.js",
@@ -1167,6 +1169,7 @@
         "test/layer-0-primitives/exploit-replay.test.js": "lib/vendor/blamejs/test/layer-0-primitives/exploit-replay.test.js",
         "test/layer-0-primitives/external-db-hardening.test.js": "lib/vendor/blamejs/test/layer-0-primitives/external-db-hardening.test.js",
         "test/layer-0-primitives/external-db-migrate.test.js": "lib/vendor/blamejs/test/layer-0-primitives/external-db-migrate.test.js",
+        "test/layer-0-primitives/external-db-non-atomic-backend.test.js": "lib/vendor/blamejs/test/layer-0-primitives/external-db-non-atomic-backend.test.js",
         "test/layer-0-primitives/external-db-routing.test.js": "lib/vendor/blamejs/test/layer-0-primitives/external-db-routing.test.js",
         "test/layer-0-primitives/fal.test.js": "lib/vendor/blamejs/test/layer-0-primitives/fal.test.js",
         "test/layer-0-primitives/fapi2.test.js": "lib/vendor/blamejs/test/layer-0-primitives/fapi2.test.js",
@@ -1175,6 +1178,7 @@
         "test/layer-0-primitives/fedcm-dbsc.test.js": "lib/vendor/blamejs/test/layer-0-primitives/fedcm-dbsc.test.js",
         "test/layer-0-primitives/federation-vc-suite.test.js": "lib/vendor/blamejs/test/layer-0-primitives/federation-vc-suite.test.js",
         "test/layer-0-primitives/fetch-metadata.test.js": "lib/vendor/blamejs/test/layer-0-primitives/fetch-metadata.test.js",
+        "test/layer-0-primitives/fido-mds3-cert-bad-validity.test.js": "lib/vendor/blamejs/test/layer-0-primitives/fido-mds3-cert-bad-validity.test.js",
         "test/layer-0-primitives/fido-mds3.test.js": "lib/vendor/blamejs/test/layer-0-primitives/fido-mds3.test.js",
         "test/layer-0-primitives/file-type.test.js": "lib/vendor/blamejs/test/layer-0-primitives/file-type.test.js",
         "test/layer-0-primitives/file-upload-content-safety-skip-audit.test.js": "lib/vendor/blamejs/test/layer-0-primitives/file-upload-content-safety-skip-audit.test.js",
@@ -1262,16 +1266,20 @@
         "test/layer-0-primitives/lro.test.js": "lib/vendor/blamejs/test/layer-0-primitives/lro.test.js",
         "test/layer-0-primitives/mail-agent.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-agent.test.js",
         "test/layer-0-primitives/mail-arf.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-arf.test.js",
+        "test/layer-0-primitives/mail-auth-dmarc-policy-failclosed.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-auth-dmarc-policy-failclosed.test.js",
         "test/layer-0-primitives/mail-auth.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-auth.test.js",
+        "test/layer-0-primitives/mail-bimi-cert-validity-unparseable.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-bimi-cert-validity-unparseable.test.js",
         "test/layer-0-primitives/mail-bimi.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-bimi.test.js",
         "test/layer-0-primitives/mail-bounce.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-bounce.test.js",
         "test/layer-0-primitives/mail-canspam.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-canspam.test.js",
         "test/layer-0-primitives/mail-crypto-pgp-experimental.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-pgp-experimental.test.js",
         "test/layer-0-primitives/mail-crypto-pgp.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-pgp.test.js",
+        "test/layer-0-primitives/mail-crypto-smime-bad-validity.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime-bad-validity.test.js",
         "test/layer-0-primitives/mail-crypto-smime.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime.test.js",
         "test/layer-0-primitives/mail-dav.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-dav.test.js",
         "test/layer-0-primitives/mail-deploy-tlsrpt.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-deploy-tlsrpt.test.js",
         "test/layer-0-primitives/mail-deploy.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-deploy.test.js",
+        "test/layer-0-primitives/mail-dkim-numericdate-failclosed.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-dkim-numericdate-failclosed.test.js",
         "test/layer-0-primitives/mail-dkim.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-dkim.test.js",
         "test/layer-0-primitives/mail-feedback-id.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-feedback-id.test.js",
         "test/layer-0-primitives/mail-greylist.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-greylist.test.js",
@@ -1279,6 +1287,7 @@
         "test/layer-0-primitives/mail-helo.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-helo.test.js",
         "test/layer-0-primitives/mail-journal.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-journal.test.js",
         "test/layer-0-primitives/mail-mdn.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-mdn.test.js",
+        "test/layer-0-primitives/mail-proxy-framing-bounds.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-proxy-framing-bounds.test.js",
         "test/layer-0-primitives/mail-rbl.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-rbl.test.js",
         "test/layer-0-primitives/mail-require-tls.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-require-tls.test.js",
         "test/layer-0-primitives/mail-scan.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-scan.test.js",
@@ -1312,9 +1321,12 @@
         "test/layer-0-primitives/nel.test.js": "lib/vendor/blamejs/test/layer-0-primitives/nel.test.js",
         "test/layer-0-primitives/network-allowlist.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-allowlist.test.js",
         "test/layer-0-primitives/network-byte-quota.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-byte-quota.test.js",
+        "test/layer-0-primitives/network-dns-lookup-timeout-default.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-dns-lookup-timeout-default.test.js",
+        "test/layer-0-primitives/network-dns-resolver-timeout.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-dns-resolver-timeout.test.js",
         "test/layer-0-primitives/network-dns-resolver.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-dns-resolver.test.js",
         "test/layer-0-primitives/network-dns.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-dns.test.js",
         "test/layer-0-primitives/network-heartbeat-passive.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-heartbeat-passive.test.js",
+        "test/layer-0-primitives/network-nts-handshake-byte-cap.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-nts-handshake-byte-cap.test.js",
         "test/layer-0-primitives/network-tls-build-options.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-tls-build-options.test.js",
         "test/layer-0-primitives/network-tls-ct-inclusion.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-tls-ct-inclusion.test.js",
         "test/layer-0-primitives/network-tls.test.js": "lib/vendor/blamejs/test/layer-0-primitives/network-tls.test.js",
@@ -1403,6 +1415,7 @@
         "test/layer-0-primitives/safe-vcard.test.js": "lib/vendor/blamejs/test/layer-0-primitives/safe-vcard.test.js",
         "test/layer-0-primitives/safe-xml.test.js": "lib/vendor/blamejs/test/layer-0-primitives/safe-xml.test.js",
         "test/layer-0-primitives/saml-slo.test.js": "lib/vendor/blamejs/test/layer-0-primitives/saml-slo.test.js",
+        "test/layer-0-primitives/saml-subjectconfirmation-notbefore.test.js": "lib/vendor/blamejs/test/layer-0-primitives/saml-subjectconfirmation-notbefore.test.js",
         "test/layer-0-primitives/saml-subjectconfirmation-notonorafter.test.js": "lib/vendor/blamejs/test/layer-0-primitives/saml-subjectconfirmation-notonorafter.test.js",
         "test/layer-0-primitives/sandbox.test.js": "lib/vendor/blamejs/test/layer-0-primitives/sandbox.test.js",
         "test/layer-0-primitives/scheduler-exactly-once.test.js": "lib/vendor/blamejs/test/layer-0-primitives/scheduler-exactly-once.test.js",
@@ -1420,6 +1433,8 @@
         "test/layer-0-primitives/self-update-standalone-verifier.test.js": "lib/vendor/blamejs/test/layer-0-primitives/self-update-standalone-verifier.test.js",
         "test/layer-0-primitives/self-update.test.js": "lib/vendor/blamejs/test/layer-0-primitives/self-update.test.js",
         "test/layer-0-primitives/server-timing.test.js": "lib/vendor/blamejs/test/layer-0-primitives/server-timing.test.js",
+        "test/layer-0-primitives/session-destroy-all-store-backed.test.js": "lib/vendor/blamejs/test/layer-0-primitives/session-destroy-all-store-backed.test.js",
+        "test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js": "lib/vendor/blamejs/test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js",
         "test/layer-0-primitives/session-device-binding.test.js": "lib/vendor/blamejs/test/layer-0-primitives/session-device-binding.test.js",
         "test/layer-0-primitives/session-extensions.test.js": "lib/vendor/blamejs/test/layer-0-primitives/session-extensions.test.js",
         "test/layer-0-primitives/session-valid-from.test.js": "lib/vendor/blamejs/test/layer-0-primitives/session-valid-from.test.js",
@@ -1473,6 +1488,7 @@
         "test/layer-0-primitives/watcher.test.js": "lib/vendor/blamejs/test/layer-0-primitives/watcher.test.js",
         "test/layer-0-primitives/web-push-vapid.test.js": "lib/vendor/blamejs/test/layer-0-primitives/web-push-vapid.test.js",
         "test/layer-0-primitives/webhook-dispatcher.test.js": "lib/vendor/blamejs/test/layer-0-primitives/webhook-dispatcher.test.js",
+        "test/layer-0-primitives/webhook-verify-nonce-atomic.test.js": "lib/vendor/blamejs/test/layer-0-primitives/webhook-verify-nonce-atomic.test.js",
         "test/layer-0-primitives/webhook.test.js": "lib/vendor/blamejs/test/layer-0-primitives/webhook.test.js",
         "test/layer-0-primitives/websocket-channels.test.js": "lib/vendor/blamejs/test/layer-0-primitives/websocket-channels.test.js",
         "test/layer-0-primitives/websocket-extension-header.test.js": "lib/vendor/blamejs/test/layer-0-primitives/websocket-extension-header.test.js",
@@ -1489,7 +1505,7 @@
         "test/smoke.js": "lib/vendor/blamejs/test/smoke.js"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-06-21",
+      "bundledAt": "2026-06-22",
       "hashes": {
         ".clusterfuzzlite/Dockerfile": "sha256:c0f51f4c7d592caea19fdcb658778fe3beda648bb95c3e8809622e1209a18cf1",
         ".clusterfuzzlite/build.sh": "sha256:b9f5a627272c65f6569fa20dcbb32c383ca3a1183ce2562d481408a2fbaf9881",
@@ -1520,7 +1536,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:f88149cf913c47900c01f48f4528fedfba9796cae8888352a69dd24059255c07",
+        "CHANGELOG.md": "sha256:388b50ed32f785a21b9ef31b0b83a83b9a4da01fe15e1dca69b3ce91c4d7b84e",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1530,7 +1546,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:23f7ee4a44f21e433ed1d3c6f414575eb3e30f66a328422973a1109a276c537b",
-        "api-snapshot.json": "sha256:b8ec69df950d762a3ed60508021464d3c7867179152f3c63e0a767474d1b6ed4",
+        "api-snapshot.json": "sha256:fb9df9dec00549ae9a669c304afa57a3b81e49ddb49bd2ada5f4ea37c71550a9",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -1775,7 +1791,7 @@
         "lib/asyncapi-bindings.js": "sha256:2f6f3d7ea836d0483e40f08b8202d78bae54bdc3d76b5faf57d918e699ebeac8",
         "lib/asyncapi-traits.js": "sha256:82ec58b77f0a65ef1b5e8b67ee9555e9cb984de769c3393fe5c6d4d0640546f0",
         "lib/asyncapi.js": "sha256:c26da54ab6760da0043178abb85960e857b6e8f77f31dc3ced8db95760e25a00",
-        "lib/atomic-file.js": "sha256:b0de23cb3ba9b816764037e529eb60dd23ae55000cdfdd9e7d7b6226b9984240",
+        "lib/atomic-file.js": "sha256:70be6c998a1de20342c0cec0d6137e4a80d195287ff9073c43bc2c7ad28aca4c",
         "lib/audit-chain.js": "sha256:1c9895a2bbf6ce3b4c546b1b3c95ac9d5ed55d82a2b58c0de4e3ecc1947c3c31",
         "lib/audit-daily-review.js": "sha256:61cebe47d6e5eeeedcab45515473acfaab623217810a7ab3629b3aeca5028519",
         "lib/audit-emit.js": "sha256:1171699027269e154fd247141a549e65bcdb566e52ed00b993c7dfb9a293ba0f",
@@ -1794,7 +1810,7 @@
         "lib/auth/dpop.js": "sha256:13d2098e2042dbab61baa93ec371b45357e691576232f08f6e99ea67fa64e200",
         "lib/auth/elevation-grant.js": "sha256:cf1c498359073a29d0192f390fe767731025d7cd65c5272298ae06ee10e307e7",
         "lib/auth/fal.js": "sha256:aabf6d8095dd41dcda8a2efdb48e00e95bffe70c78991c93fbef827816918692",
-        "lib/auth/fido-mds3.js": "sha256:8c49af15326ce56b619840e8b06374f980664bac785dcfe7bf42013d4b95ba26",
+        "lib/auth/fido-mds3.js": "sha256:c511f91a19a3d30e3f48af1e9949e5d1f7a9f4cbc39b68faa15f068a54f29a91",
         "lib/auth/jar.js": "sha256:f333f25a87b8c60f5f19c51d68aefba8ae8ed304e0f54a957560475359e11f7f",
         "lib/auth/jwt-external.js": "sha256:4b0073de3b72e3215534613781f16892736b4433f7c9b4fd9f5968a106bb777d",
         "lib/auth/jwt.js": "sha256:e018192d8578c4b1d549fdb14a93852d153f75ecf0443301d6227b6fd72d7d31",
@@ -1804,8 +1820,8 @@
         "lib/auth/oid4vp.js": "sha256:96aee801f9e47491c8eb47f50f21d395aacabbf948cafe2477f876051ac1ef3d",
         "lib/auth/openid-federation.js": "sha256:2644424c3802382c2922dd018d6674790263d77bf0e7b6c80502d8e1e6535e4f",
         "lib/auth/passkey.js": "sha256:14cc2a5f15a4748a03e703d3f6db0a7aaf408d7b277a8388506907e45da4a1f3",
-        "lib/auth/password.js": "sha256:f5c468f9d8f90128bb25a5a0ece6d33ecb152d1e0b4263ded65862ae29bce03e",
-        "lib/auth/saml.js": "sha256:ef97f4e740ad9439a776a95209c9dc0d8e52e7e65406e0eb4d031f4f8d956875",
+        "lib/auth/password.js": "sha256:a3cdbe292d2c803cd42a0e693314bda3b2c3ed4695b2b1f002d7fd440a8254e9",
+        "lib/auth/saml.js": "sha256:1b903b30c52bc16bcb7017fbc46b329bc696470c9681a968656a0717da8add3c",
         "lib/auth/sd-jwt-vc-disclosure.js": "sha256:bc1eff5def71d2eedb6f17c8bede650050af9d790145e8697871c75ddc8431ae",
         "lib/auth/sd-jwt-vc-holder.js": "sha256:9d22b691e6a698aa2240c3ac611bc91e5b8d6acaa4b8fa03e28077ddb5fd56df",
         "lib/auth/sd-jwt-vc-issuer.js": "sha256:8cbfd25af7df5db7e7f61d004059530c46cc18fd1afbcebbe94f8f81f503c413",
@@ -1874,7 +1890,7 @@
         "lib/csp.js": "sha256:b7a4d24f721767edecb7bc0c7a28c7824b7dda596c2edb3be387304684a8698a",
         "lib/csv.js": "sha256:eca5d01409e72f5f73c5a954f3019826ed5da06f72103a5117016aeb0654f17c",
         "lib/cwt.js": "sha256:1c39f6ea999ecdb2cb119933b497af9cbfd512aeaa73261076f12018f0393e80",
-        "lib/daemon.js": "sha256:8ac929f2529e21c94f5d865a488f99bd83d43640e9194c05217ec16578774104",
+        "lib/daemon.js": "sha256:9441d845c9a2d4b2808cdd6bf18915d89338a3dd75fa304c4b38c047b9f47a54",
         "lib/dark-patterns.js": "sha256:e54cc6fb591748b937627560ccdfd84da0e84974da5189e15b911e00b3c7e51b",
         "lib/data-act.js": "sha256:9d8f276393bef93e90ddf471f6c424cf95728a9c67fc8416fc5e3ccc99f690ee",
         "lib/db-collection.js": "sha256:cb7aa1f7cf6b7f6bd86829cc54fc27999e97422370283b258e54e4c05c6f0388",
@@ -1900,7 +1916,7 @@
         "lib/error-page.js": "sha256:4ed2e8a118b35d3dc76a072b233713ae1fdaedb54334df68ad081e19f765cb88",
         "lib/events.js": "sha256:b5f0034fda33285f571b9b247db50bff08f632762d9bf69b83784b435eeea75c",
         "lib/external-db-migrate.js": "sha256:990014016e71a818672b3f2c32eaa2ff6815553feb52efafb88ec765df9a570a",
-        "lib/external-db.js": "sha256:9351e4372a150d4d657253ae513607c95d0016e040c4b90bb71ba1c1eda3b0d7",
+        "lib/external-db.js": "sha256:92b0e0df9da2ad17c5a6b29a1cacbc15412b11003773e6c662fe92737b4d7cb9",
         "lib/fapi2.js": "sha256:6ae4679931675a629fa3f9e9efba71172fe69251dec2dd5d8c995cfb9dcad8f7",
         "lib/fda-21cfr11.js": "sha256:9256bcea7d526a7280d5d3b1beed5be1daf2402ded2d5a18d602466d01a7884c",
         "lib/fdx.js": "sha256:67a29b140b6d07a767da31d6b55d1db0c2219cdaa780531fdec0fec63a5c551c",
@@ -1920,7 +1936,7 @@
         "lib/fsm.js": "sha256:6b5df56768a9ecf432f1bb44083a0ec7d4bec9a29bc156dbaa020263d172eaa6",
         "lib/gate-contract.js": "sha256:ae5551c721867d51656559181c4bbcc91051b5cfad09d51f76d772d531c1cf74",
         "lib/gdpr-ropa.js": "sha256:d0fb72fc7a68186f233832965afa1ffc7c4ce3c514894656c04c327a88f54925",
-        "lib/graphql-federation.js": "sha256:c8fd01995d35ef1db38fbe31357f13d49f84da397c7714fc2b65cf6ca0bbdf06",
+        "lib/graphql-federation.js": "sha256:ce625ea629850a8e2bb2e6139e078c3b0f20c281c2fac00a631672b252504898",
         "lib/guard-agent-registry.js": "sha256:ea4330c2b2af5975ec01b5e704827e5ba1abbcf23b39425c9e15e241ee20d713",
         "lib/guard-all.js": "sha256:a4fefe738be68211c03bad95625fdc83f58742a70e03fa96ae65b31c444f9967",
         "lib/guard-archive.js": "sha256:f63eafbbb4a6e823b084ea2c5f866c4cc1e01b0ae4cce024b131c7c246179028",
@@ -2011,27 +2027,27 @@
         "lib/legal-hold.js": "sha256:58ed5d0295c5b99ed2d9014ed232301f1b969af21def8b6f9090a9e1aeccfd8d",
         "lib/link-header.js": "sha256:145387aeccc1eb6cfa63d42a7690c166673df5b0fc2dd77b69654d293f36a153",
         "lib/local-db-thin.js": "sha256:387adb8396afbabe41d1b1fd8fc943162916b607c970843d0a0e79e7841403fc",
-        "lib/log-stream-cloudwatch.js": "sha256:d5482da93c4d3c30f8e94e4f5bcef20d6f200338c1fccf74eab4ab989348c206",
-        "lib/log-stream-local.js": "sha256:1b0926149cf08fb61f2dd55914c5442b1659d322fe6235e473f941e19483d37e",
+        "lib/log-stream-cloudwatch.js": "sha256:a52797a50778832eff42d921929dc66c78e174a575428726fc059a25c460dab3",
+        "lib/log-stream-local.js": "sha256:191f6b63626def1baf1d1dfc2e8ffdfbeab7a4190e8d9c3a1ef093e11820421a",
         "lib/log-stream-otlp-grpc.js": "sha256:f330886b81cfa3299e12bae771e35bf3ee47c48e477853920d61805645c91da1",
-        "lib/log-stream-otlp.js": "sha256:b2e58c6e15579fdaa4266142ef3167ab382009542f912be74b00729c53966ff1",
+        "lib/log-stream-otlp.js": "sha256:ae9b1ebc6539007acb55b4ed46778f1791695c6452ca1c5082e79d740b0a2840",
         "lib/log-stream-syslog.js": "sha256:da9648a760c35a609a673419ead08b3f21daf72749ef6365f0c40256304e9bfc",
-        "lib/log-stream-webhook.js": "sha256:b95b255310c5b00d18bc41d23d59b2a6b93a74228cf1e10b3eeb9025e0cc669e",
+        "lib/log-stream-webhook.js": "sha256:aaec51da99ec52b62c217ff589558bdb73f7f1439a2d1f750e4ee1826be99a19",
         "lib/log-stream.js": "sha256:9ffda79044835670fba447876b617b1d5cef0592abf08b52167e2ae7b6bcdba7",
         "lib/log.js": "sha256:8902694b381a2c17b100af8c1b9b707248d2879c95ce92e14ff1869a5cd23a5a",
         "lib/lro.js": "sha256:da9baf47f27c422c32d51495b2896c887ec3ac283875712efcd7528fd396868b",
         "lib/mail-agent.js": "sha256:4ca93408c03873796d285d002067ffa54fa70859ad5437215d6001d90c0f76ea",
         "lib/mail-arc-sign.js": "sha256:872f31e16321f8629e3af3cac31d3deb460804748b25a7fbb427164a2ad88f84",
         "lib/mail-arf.js": "sha256:47d02905b58c6c0733114e58594034adedd73799de39b93420459dbb04d22050",
-        "lib/mail-auth.js": "sha256:1f32a4458bbd377cf91eb7fa140af95e17ffb76fd9789aab1f4d235e82d6eb80",
-        "lib/mail-bimi.js": "sha256:f23f250d47ef6b425cf57ff2a7cdaa2ff24ed695b42201d228c0bd52063b4a6f",
+        "lib/mail-auth.js": "sha256:da409e8f2b3bae1308f1d008b6df27f468075a83ceaeae8ee7cda0ab9c4a1027",
+        "lib/mail-bimi.js": "sha256:b22afc5e8ad04503fee7e41f3b34c05c9f0759579436bfbe5f7706180c466155",
         "lib/mail-bounce.js": "sha256:461e885dd2ea0664e9a4af39ae5c36f3a5d9c7dc914dad4c40641b705952fd04",
         "lib/mail-crypto-pgp.js": "sha256:045f1f3a2eea809e5f22fa00d7e8fe99f688b1356341cf7819ad2fe30729a4b6",
-        "lib/mail-crypto-smime.js": "sha256:ae232e1ac4e7cc01291f50ffa447672e4f2841245198556cf4b6c799a2928441",
+        "lib/mail-crypto-smime.js": "sha256:066d0456f385c470000dd05dcf978592c369298675dd8a25263592c8f15c7934",
         "lib/mail-crypto.js": "sha256:19d5f2a9fe6376d2ed6b0153a944dd1d05d8b893172bad173e2df9733c0dafd3",
         "lib/mail-dav.js": "sha256:3bfe6d8c0fa1c0a5d56d78a07778de932828eeebd6e091d2f988ebeaabcf451a",
         "lib/mail-deploy.js": "sha256:2377fe9e80af1c0fa9fb84269f1e7f8386008119b64be92b74263dda8c074d87",
-        "lib/mail-dkim.js": "sha256:5e96c3f496a02cd36b0f12671e1b9031c6c299dd8e5ecc221fdbfe081d260144",
+        "lib/mail-dkim.js": "sha256:a4bacee3eb62373decb28f09a0a8c0ec7bd2a6c4d5ff3c8e9d2da35c818d2406",
         "lib/mail-greylist.js": "sha256:7e8a727e446cbad522ca4902834312c07564365e989c7344a878f4406000fc7b",
         "lib/mail-helo.js": "sha256:196c3b8f3720fdd7fef2321dc5e3f29297128d1f0c4f47a062b5e28d75359aa5",
         "lib/mail-journal.js": "sha256:58ddcbd652c93b626c38060c97a653dc34b993659e13f41c6da5638d80b3f9f3",
@@ -2056,7 +2072,7 @@
         "lib/mail-store-fts.js": "sha256:d7cb4c571fa9709328fa484a4da61e2ba948dd739f09944f8fc1fc5e02ee4b51",
         "lib/mail-store.js": "sha256:e7a5e591ae2d98f5a6b6ab6f04e0c4a0822f100b0d03a676d5e804a184be5a26",
         "lib/mail-unsubscribe.js": "sha256:2944fd1103f00a202d704b0f3479f96c6aa3345be8cbafa2e0711ded111a3109",
-        "lib/mail.js": "sha256:f2b26753b4975945e9f015f27ad2210a1bbb8743ac28cc40aa58eab74ab289cb",
+        "lib/mail.js": "sha256:e43a6cb34813920f5001d3a2f335e57195c7befa9f177103eb971c6546e1041a",
         "lib/markup-escape.js": "sha256:a76e8c77f30ae456caa53c33afeb2dd0b27f7b8799ac857beac86ea038f17d9a",
         "lib/markup-tokenizer.js": "sha256:8aa91d3e173c8d3d4df4dac00e892a359863be7295c5b1846cf322bc7bfc9510",
         "lib/mcp-tool-registry.js": "sha256:df3480e6a0d29a9734bdb19d322f83bff5ebfdd756620f947cf593878dea8776",
@@ -2065,7 +2081,7 @@
         "lib/metrics.js": "sha256:edc2a3f08a48ab67c9e805cb75839cc9d326ac334478b0f30db0423102ee5713",
         "lib/middleware/age-gate.js": "sha256:dc8c61a4d41f4a781220c9c97eb475fb2867f5ee444eb2756badcbc5b8411795",
         "lib/middleware/ai-act-disclosure.js": "sha256:6fc62940d85813019b31c586fc86853570329a939565a6947f81052d50977c42",
-        "lib/middleware/api-encrypt.js": "sha256:59a5da1365227a605959c90c6ad346abbf83b2edef70a01f16e89b9bd4f0f41a",
+        "lib/middleware/api-encrypt.js": "sha256:8807759081c1427ee9daa40edd5ecfe588bc43cf7c989c0b7c5f27df8a523d12",
         "lib/middleware/assetlinks.js": "sha256:bb36f8d53991668b4ae1557d0cab3ec8b479a16f9133c43f9adc07963c8b4750",
         "lib/middleware/asyncapi-serve.js": "sha256:a0f0b62b264a5cd8a24e3cfddae722a84b5e2206729f77403906a1d1cfcd7c7b",
         "lib/middleware/attach-user.js": "sha256:776424918bf302378da99a85ff20c91a42f8c9f528ab435cd7a06b95ec523d6d",
@@ -2128,12 +2144,12 @@
         "lib/mtls-engine-default.js": "sha256:bb2e47de5b8a6fa03f433c4c8ecc02fc7e7841f9eff97a36e7a4379880c81cd7",
         "lib/network-byte-quota.js": "sha256:79eafbf602a10ced990d89cfd26bea3992e42b177407b8e512bd4790999d17e3",
         "lib/network-dane.js": "sha256:1f60a47618bd99a487d6c2faad423546896f753e33b516bdbc354138438d06f8",
-        "lib/network-dns-resolver.js": "sha256:59fe006a83311d19988c94f4e9ae8b870faa7003bbea7e83ff62e9899547990c",
-        "lib/network-dns.js": "sha256:fa8bb25bdd6bd41da5a9088b83bf9489d28bf777f8d70b83e5e48189a577a57f",
+        "lib/network-dns-resolver.js": "sha256:3fd08605a077a8de1c15b3f436d2c2910af77e0078d27ce9d62fdce2e5949b7e",
+        "lib/network-dns.js": "sha256:b9d92448d25c220ad784a4540da04747797bfc5e4edc2c8ff20de827574af136",
         "lib/network-dnssec.js": "sha256:2b0758d09d5af89b49c69892fabaebabba125c3f9f162996c12b9abbbbae4bca",
         "lib/network-heartbeat.js": "sha256:f14ec7fa4667cbb04477d91ae59d6253b6c9ccc43071bc558e737cc672f43975",
-        "lib/network-nts.js": "sha256:31ec97cc8a47ba11201c20d7ec8fa411df28489ea52db6098f1727380c08506e",
-        "lib/network-proxy.js": "sha256:64da517043d13897d994e0e9341e05f190bc8a14b973f5be6a1c051ddf14641b",
+        "lib/network-nts.js": "sha256:90ce47584ad58c171e8029eb1d5df8ba4ba130c4038d1fe260109685c34c8f75",
+        "lib/network-proxy.js": "sha256:9342c534863f905000d2432b67c26dd7a5ea02be25aaf9ebe05976079e61d4c9",
         "lib/network-smtp-policy.js": "sha256:a7b6c91983b312a16c436d3e15259f8f6a84579e2e55f64106285b22795e1510",
         "lib/network-tls.js": "sha256:d39d7e56d3fe987dbb1bd5b4caed2425adc9105a4491b7305a27e1dbe4a6ea31",
         "lib/network-tsig.js": "sha256:41dc85a6e816cce1c58c36891dfc6bafc612b68978936107a09a5a553563e0d7",
@@ -2145,12 +2161,12 @@
         "lib/ntp-check.js": "sha256:4cd90b033e0df88992fdb251c323957e37ec5bee23c14e0d6dc9a8f41891f134",
         "lib/numeric-bounds.js": "sha256:09bd70ab5f971ca7db28a0caf053145dd6b1562276591fe601758c61c41b16a6",
         "lib/numeric-checks.js": "sha256:acc5af6141e942415476b43dfb92dcb8ae243d24d022b619f5e092d15fd6894e",
-        "lib/object-store/azure-blob-bucket-ops.js": "sha256:637a96d49747b406f80565d238c39ecb4276f56445ca434e52caa5934100f573",
+        "lib/object-store/azure-blob-bucket-ops.js": "sha256:5af8f5e1eb4f815dfa075e67be92121f2b29cfc1ea1cccb9c37328281f5f10d3",
         "lib/object-store/azure-blob.js": "sha256:c28f0c5d07958c4dc3bde2475fc511162ef1501b67b72aab217d18b0786683b5",
-        "lib/object-store/gcs-bucket-ops.js": "sha256:9a4c78ce97915bd1422cea62b6ffb1276a7aa016bd771e313b4c1cf482fbe593",
+        "lib/object-store/gcs-bucket-ops.js": "sha256:e2e2f61380b7e9c750f0ee4428a7e35034e177bb8aaaf0c97dcd35fb1ffd96f5",
         "lib/object-store/gcs.js": "sha256:d66736fd0519d8fc67e7a9a3e08ec6a06ac703103a71419edaf9e5518e323b2b",
         "lib/object-store/http-put.js": "sha256:545c9339d0972052b9ab1868d0cae6bc4ba3f0eb156423766873224ea6aa27e6",
-        "lib/object-store/http-request.js": "sha256:5df3620db7568b1af48cf818f6e5b68747e269c96d6c65e81b8ae58e9f639a1d",
+        "lib/object-store/http-request.js": "sha256:1ca977bff2ef4b2d05a7c88f3461d4d189caac9cc5ca9b032fa00c0e648faa10",
         "lib/object-store/index.js": "sha256:53d91d27e19a6a75e3b96fa9a01376dbd6e19dd215cca5b4a0c65a777dd1e42b",
         "lib/object-store/local.js": "sha256:32cdf105ec0d32428ecea7c3d7da2fe82c910ec57093e562483a9c512a6a66bc",
         "lib/object-store/sigv4-bucket-ops.js": "sha256:d54ae720586b595f16d7dd856d0d599d1fa122137a5bdb2d398a7757efcd55cc",
@@ -2164,7 +2180,7 @@
         "lib/openapi-yaml.js": "sha256:25b03bcd1c3d0c336aa597eaf79879c840a6b87b729195c573620a47cadaa0b4",
         "lib/openapi.js": "sha256:94280b4945d8ddbe7f7484e8b425789f6380264f0a7f3ed8c0d9dc1c179140b8",
         "lib/otel-export.js": "sha256:c2f33ee7584638b5b27e2c52223eef111e1486da056d4cc5ef19e2e8a0322d9d",
-        "lib/outbox.js": "sha256:2bce0e40f8a1eb6061d8bc4b3ae9609d5d17c028076a8cd8b2e4fcea0a12e9df",
+        "lib/outbox.js": "sha256:7ce4a9540fc6a6f0b78897647e7b3cc1f4df900341b0966142228f45c6504486",
         "lib/pagination.js": "sha256:0b5141bc978dd727707cf4006fc928282c1c88508c8a4dec5bc7c42585d2e303",
         "lib/parsers/index.js": "sha256:abb1ac7e2aeb2d566d78c749b389fa75c278cc4bf60af3621c650a220a64fcaf",
         "lib/parsers/safe-env.js": "sha256:c02273d9f0299e9409b234c1a7e550a4eb61001588292d71c0a7cce33dc562a4",
@@ -2191,12 +2207,12 @@
         "lib/pubsub.js": "sha256:c2b5394a64081c92ed61cdaa5c98a9a403c403fca64b0ff409e0ca29df7c9525",
         "lib/queue-local.js": "sha256:6fa51df760cab698cad2c442d8e2ef0256b31ba7cf5f4c8fcdbe412e099d4516",
         "lib/queue-redis.js": "sha256:c30d2c7201a7cc0519d39c675730c0b857f5dfa83c5fdd7235a6d3d51ee86996",
-        "lib/queue-sqs.js": "sha256:8283a4bdba2939d2be9d75c30d8bd3bbe44041419c208f3c7cb7df453aff7ec0",
+        "lib/queue-sqs.js": "sha256:0868647c6ff66619b828ca0f5aa9ab0e72fbc1450853efa2f63c971c8f456fed",
         "lib/queue.js": "sha256:e9bc41e04f2fd1bec7c11dcb2d0e1259c59d62cf39c789103d6ed7345891c604",
         "lib/redact.js": "sha256:1cd102db31eb48ffbc677c39013ddc1b829db7597d808785a7b202a5e0dc691d",
         "lib/redis-client.js": "sha256:9f8168b11b81ce7b649b2e0658ceeb7134a257435b611f4917d36e1ed178a3e5",
         "lib/render.js": "sha256:1890c0cce371ea93c1820f70ea544dee25d8d9bd427fdfd6688d7cb17720ed8b",
-        "lib/request-helpers.js": "sha256:19bb581a59330313bb71507248ff294394d35fbd289004360499fedfd85a010b",
+        "lib/request-helpers.js": "sha256:def9efbbcb6a3f66ef605eb46887decabcd82ea59d0c4c3a495f9d4536189317",
         "lib/resource-access-lock.js": "sha256:868d2c0a59d2ca2757a334858779d23e0cde9c18bf63c535350d8ebd6ae20b53",
         "lib/restore-bundle.js": "sha256:c2a9c3af19434a2072ea4cc721211119f71ba363bbbad9df7ac34a3ff03e43e2",
         "lib/restore-rollback.js": "sha256:f00e2f40e2e6a14bc6687afe8c112e367d83314eb04592d9ba399cb699fb0e03",
@@ -2235,9 +2251,9 @@
         "lib/self-update-standalone-verifier.js": "sha256:8309b2dcafe705f1e545b4b0c640cd1ecac5930959f116e2c30d5ceb41777eee",
         "lib/self-update.js": "sha256:4b2403f36d949ce632ef003e0eac29c245d6c5fc8c83ca3cd47069753b2c7af2",
         "lib/server-timing.js": "sha256:74f2556480363c860a7c80a3f2bc1adb68fee53aa4335059069fae66a1eb627c",
-        "lib/session-device-binding.js": "sha256:fa3ea628963f96fe2c233faecb6d1ec482508b121a861f9b4feb9ec0e7e4af62",
+        "lib/session-device-binding.js": "sha256:4365c1449498fdcc0f0619200ea9522febe071ec445ab9f4e165614953340d53",
         "lib/session-stores.js": "sha256:b79de919061a2bfeb090185bcc511919fb01d3e7a495fe0a7c711cf6cf65137b",
-        "lib/session.js": "sha256:295d6da9aeb1ff299a43670e4cc6127755146f9c6d9c08e5638e584a74d587ed",
+        "lib/session.js": "sha256:dc3fcfd31edb04f25ce128ca8eb7106978f6b985c6558c6e1179613b8771930f",
         "lib/slug.js": "sha256:bcebb078559528e6bb50a6244633d425ffdd861bb7a708c2b201eae3b3c44b35",
         "lib/sql.js": "sha256:0bd253186224b8757dc35e3933462773f40f9e08dc8930fa7985ad28fa79f27c",
         "lib/sse.js": "sha256:5e4fca52ddb92ab1c13ad7434c6b13d5c4ef0f7fc3845b003f8c3603c1629dbf",
@@ -2301,7 +2317,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:143094b666ec1ec64477ebd9b73bf214fb1abb91f9d1e3e82f340d9c25dadb42",
+        "package.json": "sha256:ff50471bd603fb8a5194e5283800f7d8616e848b49b2b8907bd3b2560d923d86",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2317,6 +2333,7 @@
         "release-notes/v0.15.13.json": "sha256:afac0388fe6f6094f2d6bcc34c167bf41c5016cef001e9d32393c57cd5f0ea0c",
         "release-notes/v0.15.14.json": "sha256:13e065666436b6d852d1e9e17933d7ee2327bbe7b3d6adc5cec846c858140f34",
         "release-notes/v0.15.15.json": "sha256:5e8f3456e4efa180e8ba368b92616f9f3e57745cdca5fad9bba1c013f728632b",
+        "release-notes/v0.15.16.json": "sha256:6b3b7872fbdfd527dbcc74f2015776808d2af55a9452054f6086c8c8bc2e4a42",
         "release-notes/v0.15.2.json": "sha256:36e1423dda94ed4e55c660e0fae882019005d8de3ee5e3b6ac4f38ccf8e744a2",
         "release-notes/v0.15.3.json": "sha256:19a0074c445545468ca3cc411b21ec8bdb27be2669ae1950347cc244f6aa348c",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
@@ -2456,7 +2473,7 @@
         "test/layer-0-primitives/ai-pref.test.js": "sha256:c80d19bc1bbaf36925614e38a65b0fe8cabad7f27ee525638924d07812bae27d",
         "test/layer-0-primitives/ai-prompt.test.js": "sha256:102a2f1d52a86f9d5bb86eea0b701ff919aa531833fb93b024be56868439cdd4",
         "test/layer-0-primitives/ai-quota.test.js": "sha256:53f96ce0e68c4f09956eb2ee22cca53d1a48ec5da7c026de58e116b78091fb78",
-        "test/layer-0-primitives/api-encrypt.test.js": "sha256:fe6e6f79ba473b68b528c92bfd603b4014b2d7225db928c29f2981126a8546dd",
+        "test/layer-0-primitives/api-encrypt.test.js": "sha256:ea7dd8e5fc4c0923e11993da405eb09d83741bf621c96425dd89e43dedd791ec",
         "test/layer-0-primitives/app-shutdown.test.js": "sha256:e4036095036971bb830217f1cc9efd43d697f7d85958eab5fa7fa5d0c176be57",
         "test/layer-0-primitives/archive-gz.test.js": "sha256:69ec18221fbc89094dec16dc92d9eb1af359a2a9f0df5c2d1f9ff60506e1b8af",
         "test/layer-0-primitives/archive-read.test.js": "sha256:ecc0f7100b94a239023cbc857d1fe025768a5d123c73133c714cda3550a2a451",
@@ -2473,6 +2490,7 @@
         "test/layer-0-primitives/atomic-file-conflict-path.test.js": "sha256:b1e95ff12e5f6871762cc23ed6b862b4cf18097b743e5d4f90abaa4e53601794",
         "test/layer-0-primitives/atomic-file-exclusive-temp.test.js": "sha256:9a0a6193b8051caf1a5e34a7f0be6b12ec92abcadb26468384b0484c55984144",
         "test/layer-0-primitives/atomic-file-fd-read.test.js": "sha256:f94032960507df635acb5676022b13bfe284ba383f2c301f773a74e9876ecb08",
+        "test/layer-0-primitives/atomic-file-open-append-nofollow.test.js": "sha256:39dc85cd84fba390d13ccb2f9cbe8f0e17bb9f24048550706e1bd456711abb82",
         "test/layer-0-primitives/atomic-file-open-nofollow.test.js": "sha256:25bccec5c4ac37f6b273c3a23d2c202b45b028a42f00eacd1999e8057a24d1b4",
         "test/layer-0-primitives/atomic-file-rename-retry.test.js": "sha256:4669ec79347c38427d4d2229a884d705c1deddb3a88e2b55376a3420ae0c7f4c",
         "test/layer-0-primitives/atomic-file-write-excl.test.js": "sha256:80890106b36b988f77df2f124ae6762e9fba94220a2daf4ace92f8dd6f891190",
@@ -2558,7 +2576,7 @@
         "test/layer-0-primitives/cluster-storage.test.js": "sha256:238b3b3db0eba3e6312a863710533178f566347b90e161e564481aa826707647",
         "test/layer-0-primitives/cluster-vault-rotation.test.js": "sha256:3514e9e71d6c39e805248f58ad2f41528d091e196c0f3766a032675677161b2d",
         "test/layer-0-primitives/cms-codec.test.js": "sha256:7e46078ed82be5b69d22c48f22dba37ea5015371c2a8cf5f94fb1a792fb7bb78",
-        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:be13f11407b7367a7588023cb39fc02acfd1dbf6c9a13ce1c1d7223b8b649523",
+        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:3c1e23573b17d69c0edaa6d963ee00cfafc251803d3bd4007c932c31a72e3a70",
         "test/layer-0-primitives/codepoint-class.test.js": "sha256:19764d50264a98cb8fb28575dd82ff7a97e857922c42d9efe886e13d5063e0c5",
         "test/layer-0-primitives/compliance-ai-act.test.js": "sha256:5ee4ad05d12233cb3c5457ef10a727833710bbc1ce1318838f9f9ef5d2cb8d4b",
         "test/layer-0-primitives/compliance-cascade.test.js": "sha256:ee02cf14541a837a9d7977c6ea6bf7f9210bed293925d93c976e31f270aebec4",
@@ -2648,6 +2666,7 @@
         "test/layer-0-primitives/exploit-replay.test.js": "sha256:b0ce85798ae23e9de9ba1d5ac4e3da8b67b26e1dccbd130ff0759c927aec764b",
         "test/layer-0-primitives/external-db-hardening.test.js": "sha256:2b593fd96a13ffec1c8400afda2ca5fd8e9577523fb085ffb6250d07b380c43a",
         "test/layer-0-primitives/external-db-migrate.test.js": "sha256:7c469502efdbe71788ccb4eb9e1a554003b834c1aada657acb2002b3809df6d4",
+        "test/layer-0-primitives/external-db-non-atomic-backend.test.js": "sha256:aaff044af7bff81675a668821fb949a23ddfd1073a402d3fc7e0e39a0fdfa992",
         "test/layer-0-primitives/external-db-routing.test.js": "sha256:bce6254542cf13ba0648452a37768b5e7346013238a7cafd1a09d212a56defde",
         "test/layer-0-primitives/fal.test.js": "sha256:613ebf51d4bde737d277c6db8a40487c25c89fcfc4ce68e784699768f967398b",
         "test/layer-0-primitives/fapi2.test.js": "sha256:bd077f0ec6de953b4deaeef1c8e1dd76f1c756d6242635137ed65b50e5bd4492",
@@ -2656,6 +2675,7 @@
         "test/layer-0-primitives/fedcm-dbsc.test.js": "sha256:4e918c5234e8db4cd84882d577d3be70b6704fb1d3edd836351a45d037e9b44d",
         "test/layer-0-primitives/federation-vc-suite.test.js": "sha256:8d76e5800e5625db3eef4a37e3fafa3cb258c3d830f2ee90a4a051f87f050341",
         "test/layer-0-primitives/fetch-metadata.test.js": "sha256:9b99953d3f1556b05597e30f65ba32d77f65a5a336e4de32fbbd2dfcec054b16",
+        "test/layer-0-primitives/fido-mds3-cert-bad-validity.test.js": "sha256:8c553ff60d8c8f6bea27bd54552401ff097c57c44a7eb2f498ec9519dc4c593c",
         "test/layer-0-primitives/fido-mds3.test.js": "sha256:b363a3f2e6036d6356ffd506f2de7a099bdb4ded77b6c183134d2c1acbeefb25",
         "test/layer-0-primitives/file-type.test.js": "sha256:ba6bb725857cbf7b165f4391e3aa126c9fc4286c5afb92d1964ff1d0dfd2b57c",
         "test/layer-0-primitives/file-upload-content-safety-skip-audit.test.js": "sha256:ad13f7f84a33899b4f4e66b74c896f606e070bfe5df769b0acd109cfb7ab38c7",
@@ -2665,7 +2685,7 @@
         "test/layer-0-primitives/gate-contract-content-gate.test.js": "sha256:d9f8b94231efb0e02a94b7934bf58a3f8e343829ce11346b7302e69e13efd551",
         "test/layer-0-primitives/gcs-bucket-ops.test.js": "sha256:2261e3ac2d66d48e4e436d2f43f9f48f45822930824fa48888f0fc9cfabcf908",
         "test/layer-0-primitives/gdpr-ropa.test.js": "sha256:ebed2f001ddc79e42a9cd0ee5319536662dcb4c601b3eb65077161ab81e243a4",
-        "test/layer-0-primitives/graphql-federation.test.js": "sha256:89eb6193ebfd3398af5f7730c338f81fbfc42b3e840290c4533a4914ac810503",
+        "test/layer-0-primitives/graphql-federation.test.js": "sha256:c920cdc6f8740733b712d139d11da08c4fa5c8add3b0749fa74c6fbce04965cf",
         "test/layer-0-primitives/guard-agent-registry.test.js": "sha256:d432339273cde552cde8101ac1b32df44c36e7dd9381a328669f63884ac9016b",
         "test/layer-0-primitives/guard-all.test.js": "sha256:fdd9a746ecfa6e29f0e5f727fbd66c5ab2e29a263ef0d8c2c1d62fc430cdd59f",
         "test/layer-0-primitives/guard-archive.test.js": "sha256:f8c6be677cc69e5b782bb27e4891bcb18fc91d6890ce694ca06cc63c4d374b16",
@@ -2743,16 +2763,20 @@
         "test/layer-0-primitives/lro.test.js": "sha256:134407dc88a84450d69e15c23ff9d47617466f23a436b3d61339e6836e0c42ce",
         "test/layer-0-primitives/mail-agent.test.js": "sha256:51725784bab6849cb02f1e94e0ba97c2b8e7e101780a26ae7ec19f9d894640ef",
         "test/layer-0-primitives/mail-arf.test.js": "sha256:2279aebee547903a8c1415c9fc1c9c194757b3917e869bfddb43dd0375e68a93",
+        "test/layer-0-primitives/mail-auth-dmarc-policy-failclosed.test.js": "sha256:22066c238cdb9c4f84377f56f2d69e387bcb4a601ef384cc874fc55249fbfaa6",
         "test/layer-0-primitives/mail-auth.test.js": "sha256:4b967c9921ad3e9e84f87eca1a6077d7d089750c4e919ec3ea09e4a11cd06884",
+        "test/layer-0-primitives/mail-bimi-cert-validity-unparseable.test.js": "sha256:d14d66d801b5767372ce7014617841f8710f7ad95107984da058ade794fd4d8f",
         "test/layer-0-primitives/mail-bimi.test.js": "sha256:3e12e211e1f75f07d1ba43ada69c9adcd205902194f983d8ae24293b1acd1cd5",
         "test/layer-0-primitives/mail-bounce.test.js": "sha256:d4ef09adc71e1c9e336a9fc5b059e6b264d9abcd0c032023bfa7b15a9173a4b7",
         "test/layer-0-primitives/mail-canspam.test.js": "sha256:c21dec043c9984d191af0b1f3425e85953b559ec6dfdf281a5f746f7121eb281",
         "test/layer-0-primitives/mail-crypto-pgp-experimental.test.js": "sha256:5b00a55d58cc48eb2864c6f7c6386ce44423e478b1033e5b11bb5130b4bb60c5",
         "test/layer-0-primitives/mail-crypto-pgp.test.js": "sha256:e7b399a99e2ea3d443a409a2a7ddba9d0871c8383a821414a1b1b1122757e3cb",
+        "test/layer-0-primitives/mail-crypto-smime-bad-validity.test.js": "sha256:e7bdef1d3d3aafacfd328a7fb7e0dacb45bf66103e18ad19d97d6e308e4aee31",
         "test/layer-0-primitives/mail-crypto-smime.test.js": "sha256:2b840ad3706840a8d206c9fa09337e0c13ecb83a7ea4d97fceb49d4fb4454dfa",
         "test/layer-0-primitives/mail-dav.test.js": "sha256:5b4dcb1b9d8942f0cc2235a99487b076cf4f984933c609d737bb40471ae7333c",
         "test/layer-0-primitives/mail-deploy-tlsrpt.test.js": "sha256:3063225653b0cc3a6c8653b6e6ebd1e4ffbb3939b51d21f710d718426a3eeaa4",
         "test/layer-0-primitives/mail-deploy.test.js": "sha256:b3e85993397ada25ee86b43403a9307f4e8c0b87e9252967e944bd9c733baaf7",
+        "test/layer-0-primitives/mail-dkim-numericdate-failclosed.test.js": "sha256:a0fee8759d974b7f72bb7b191c307ff737e90c6123b662c3ead73cbfecbccb27",
         "test/layer-0-primitives/mail-dkim.test.js": "sha256:84b0aeb3b9e7c3852e06998ff6af5427bd4445d247b73ec8e2511a8c1cd21e9d",
         "test/layer-0-primitives/mail-feedback-id.test.js": "sha256:f4890df9aa9650680abe99dacb5072b0e4b207be178d1be0e6e139c697185329",
         "test/layer-0-primitives/mail-greylist.test.js": "sha256:ef3e1618a2bea628a09405ad8751e63a1de47e92aeb2d1b421702fd4eae5e768",
@@ -2760,6 +2784,7 @@
         "test/layer-0-primitives/mail-helo.test.js": "sha256:5b06bd53db5aff44ee97d0108cd67d10b931562df33ef289f616957e7184eac1",
         "test/layer-0-primitives/mail-journal.test.js": "sha256:e18b0b46ccedcd5599ae88b341a67f5dc6cefe38514aa4a5305bb48084d5b562",
         "test/layer-0-primitives/mail-mdn.test.js": "sha256:4e24d8ba7ee777593024b2bb564995f4dd19f863ef1effdd05a4c593f2ac405f",
+        "test/layer-0-primitives/mail-proxy-framing-bounds.test.js": "sha256:de9d958b360a7e23cf6c4dd5577f3bd2a89c16bce45770c7d5e20b6bd996d334",
         "test/layer-0-primitives/mail-rbl.test.js": "sha256:43a1f12c03f949cf4d9f2474d0853fefa6f963f0f15360cd330ff38cb4ba7af4",
         "test/layer-0-primitives/mail-require-tls.test.js": "sha256:ffb888e81770c02e69f99ba54808802d53e5880a6fbe82349a914aaae20b016c",
         "test/layer-0-primitives/mail-scan.test.js": "sha256:060758532a2b75e53b28b3b99542c5ea9b0a149986501a0e32cd1f660a7a569f",
@@ -2793,9 +2818,12 @@
         "test/layer-0-primitives/nel.test.js": "sha256:1b074316a1172d23da880ee6c9fa99b5548ae28322ea43a7f91adbdb260375ca",
         "test/layer-0-primitives/network-allowlist.test.js": "sha256:bfd447e56b6f19ee2cf1ed4ca7b34e03ecd6de89df46093e9dc89d93beeaf976",
         "test/layer-0-primitives/network-byte-quota.test.js": "sha256:c53f6a7435472bd02debbd3c2679254bef2dc6bec8a0c0bf5f9c53c956a313e6",
+        "test/layer-0-primitives/network-dns-lookup-timeout-default.test.js": "sha256:6251b8d093f6402a13d08afea2d7164fccdb8d2edbbbe63915b88b4e2bcba47b",
+        "test/layer-0-primitives/network-dns-resolver-timeout.test.js": "sha256:9ba8ca49b8095ec4780959134520ac869c80ca9b9664b5beadce2d135037777d",
         "test/layer-0-primitives/network-dns-resolver.test.js": "sha256:8966ba1b24c9ceb5754a3ef21a6d6e61a6cade983367bece1034110b7928fc1c",
         "test/layer-0-primitives/network-dns.test.js": "sha256:062716b26d49b29b5002787597ad61622b4bfd05c346076ba90ab18e2efc5074",
         "test/layer-0-primitives/network-heartbeat-passive.test.js": "sha256:4dae1d9f61c85489d1a91a6f4a242198d0bee89fdbacff9efba143e78e882ad0",
+        "test/layer-0-primitives/network-nts-handshake-byte-cap.test.js": "sha256:97e95dc14c494b846270abe545dd3995c0f0905aed209f600ac670fad10956fb",
         "test/layer-0-primitives/network-tls-build-options.test.js": "sha256:0380ef886acc0a3bb0f7bc032c11991891fe9f19648e9f8d38829c7ea16b61b0",
         "test/layer-0-primitives/network-tls-ct-inclusion.test.js": "sha256:951b5eeded5762f667c534c0433e4b5f4b0a6a48c7c66a88492c0d4cebd21636",
         "test/layer-0-primitives/network-tls.test.js": "sha256:75605314bf5093ab040c46cdc17327cd609145c4b0b7a17fbbaa9679b94a3b46",
@@ -2884,6 +2912,7 @@
         "test/layer-0-primitives/safe-vcard.test.js": "sha256:10a0695050afee64599411352b34382e15b8f9bd9045ed3951cc6bc561918c89",
         "test/layer-0-primitives/safe-xml.test.js": "sha256:dc94bdc968449a87843a2403e4f9d402cd22fb7479cae30ae42e297ffec5a449",
         "test/layer-0-primitives/saml-slo.test.js": "sha256:b8b3a5e71ad28a0a3e9b69bca9f570410bc8b8eab6a7fdfd186fdf12cd90854f",
+        "test/layer-0-primitives/saml-subjectconfirmation-notbefore.test.js": "sha256:2deac25891a4eb2c5d1073d99c352a01322e6fab6497616209ec6a15cc1fbf71",
         "test/layer-0-primitives/saml-subjectconfirmation-notonorafter.test.js": "sha256:1396afcc34135ab025880ac74738f3eb1984f5725dcf2e676e6a2f1bd7f852c2",
         "test/layer-0-primitives/sandbox.test.js": "sha256:9e4173ff52b2de662c9ca489c723df899f7dfa82526f0c67154de516b2e4f0e7",
         "test/layer-0-primitives/scheduler-exactly-once.test.js": "sha256:f269740eba98d12f05f6fa50c7aa4f6ac49a5a69e1dff23898257405a51089fa",
@@ -2901,7 +2930,9 @@
         "test/layer-0-primitives/self-update-standalone-verifier.test.js": "sha256:01a603efc2ad576fd2a958bc6fb0bf9738c628b9f73ca706089fb2ddfb4b8796",
         "test/layer-0-primitives/self-update.test.js": "sha256:8f0b956a24a609913d14a25a39c03ac4e148f9ae88dcbaa28fbc8fa72517b249",
         "test/layer-0-primitives/server-timing.test.js": "sha256:03fbad2878a8d629c0abf59c175d6de7b113e49b3eaffbdcd950b03920e54693",
-        "test/layer-0-primitives/session-device-binding.test.js": "sha256:92103c0bc7d6e03c01db3289a360ddea4d1eca58f5afffce19463e472ffc7fd3",
+        "test/layer-0-primitives/session-destroy-all-store-backed.test.js": "sha256:a00e2a0a0508e59cef00813884ecdb3cf124b385d8bab9222040441c23112416",
+        "test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js": "sha256:00444e12ce114b9e6103f06279387ba453fdab32b0216e0f437f6c93dda7a606",
+        "test/layer-0-primitives/session-device-binding.test.js": "sha256:c1d5ab76e6bcc971dcbfa9bb435902b87b3d99143e2f09b04158fdf5237025d1",
         "test/layer-0-primitives/session-extensions.test.js": "sha256:42a43a2e82ee4fb1c576cc6dc2ebfcf531e3cbd05bbb5486a402de0bf1b8d141",
         "test/layer-0-primitives/session-valid-from.test.js": "sha256:587bb6aa587d1fbaf84387bd17d0a46fbf0b97ceafc9d2a1416a0e7751e98ab0",
         "test/layer-0-primitives/shape-match.test.js": "sha256:ce63e3be16ff7055fe0a24ffd314e6878a8d2145043a2e2bbc3821f3d9d48b7d",
@@ -2954,6 +2985,7 @@
         "test/layer-0-primitives/watcher.test.js": "sha256:346ef70ff89e9d4b6ba27f6a1859be0cd782b8224930c7c3d2ead5d495c08dd7",
         "test/layer-0-primitives/web-push-vapid.test.js": "sha256:4634dcf1c3fdae300b291d20473285a9d9fe2f49f9c54e4e3a2e149768d3fe32",
         "test/layer-0-primitives/webhook-dispatcher.test.js": "sha256:080b999087102eccaa73e070b3f08ec2ab1fecd3a38d25cdcd2937241c9d9689",
+        "test/layer-0-primitives/webhook-verify-nonce-atomic.test.js": "sha256:42441d6d923d2ba9f83da932e1e4715f2e519735c816e6396f1390e87ff378f6",
         "test/layer-0-primitives/webhook.test.js": "sha256:8eb792cd1b24f7e4e7380286bb08e0e37489ce6a0fc5c1f0d0aa6caa0e170e48",
         "test/layer-0-primitives/websocket-channels.test.js": "sha256:8e1249fd11c4ae1253c8b76cc8638c9cdce2081046d6b80a9a6db0cd71d2716c",
         "test/layer-0-primitives/websocket-extension-header.test.js": "sha256:8f3a29eeb269c7393342e4e7966c330413964cd251b76d5cdefd6455aa8883be",