v0.403.3

What's Changed

• Stop the input pump after exit, so a late message can't hang bynkc-lsp (#2239) by @accuser in #2241
• ci(marketplace): read the publishing identity's ID from connectionData by @accuser in #2244
• Declared migrate steps carry stored agent records forward (#2224) by @accuser in #2243
• chore(vscode): retire the Marketplace identity helper; point installs at the Marketplace by @accuser in #2245
• Packaging slice 2b: git dependencies, the store, bynk.lock, --locked/--offline, dev-dependencies (#2240) by @accuser in #2242
• Report caught Worker faults to Cloudflare so uploaded source maps apply (#2192) by @accuser in #2246
• vscode-bynk: provision bynk and bynkc, so no cargo install is needed by @accuser in #2247
• Require the bynk and bynkc release assets in the extension's server pin check by @accuser in #2250
• Record the live Durable Object exports checks (#1809) by @accuser in #2251
• Rename and remove agent classes through exports tombstones (#2248) by @accuser in #2253
• Track doc: Test Explorer depth (settling draft) by @accuser in #2258
• Validate a consumed refined route parameter with the context's own codec (#2252) by @accuser in #2254
• Add semver and markdown examples by @accuser in #2262
• Track doc: correct the tier model and Slice B's scope (Test Explorer depth) by @accuser in #2264
• bynk migrate: status, and a sweep that raises each agent's floor (#2259) by @accuser in #2263
• Packaging slice 3: npm requires propagation across packages (#2255) by @accuser in #2256
• Name a callee's fault to its caller: CalleeFaulted, not Transport (#2193) by @accuser in #2265
• Track doc: correct the streaming and coverage analysis, record the confirmed seed derivation (Test Explorer depth) by @accuser in #2268
• Drive a callee's fault through two workerd Workers: CalleeFaulted (#2193) by @accuser in #2271
• Track doc: add Slice G (repeatable --case and --suite) and record slice acceptance (Test Explorer depth) by @accuser in #2275
• Fix coverage marking an executed line uncovered next to an uncalled handler by @accuser in #2278
• Anchor service handler headers and the post-handler tail in the source map by @accuser in #2282
• Packaging slice 4a: registry protocol and client, static registries (#2274) by @accuser in #2277
• vscode-bynk Test Explorer: honour the selection, report skipped cases, link suites to files by @accuser in #2283
• bynk migrate sweep: hold the floor until the listing has settled after a deploy (#2276) by @accuser in #2279
• Publish the browser artefacts with each release; let the playground consume them by @accuser in #2285
• Harden the Windows workerd smokes against lost events and lost callee logs by @accuser in #2289
• vscode-bynk Test Explorer: tag tests by tier, run the system suites against a target by @accuser in #2288
• Retire the state-migrations track (#2188) by @accuser in #2290
• fmt: always break braced declaration bodies by @accuser in #2286
• Anchor provider op headers and the post-op tail in the source map by @accuser in #2284
• Packaging slice 4c: HTTP publish API, bynk publish/yank, reference server (#2287) by @accuser in #2291
• CI: path-filter the merge queue like a pull request by @accuser in #2293
• vscode-bynk Test Explorer: reproduce and pin a failed property by seed by @accuser in #2294
• Anchor WebSocket-hosted lifecycle method headers and the dispatch tail in the source map by @accuser in #2295
• docs(spec): name the primitives Float and Instant, as the compiler does by @accuser in #2297
• Give each workerd smoke its own wrangler dev registry; kill the whole tree on Windows by @accuser in #2299
• CI: stop saving Rust caches from, and running coverage in, the merge queue by @accuser in #2292
• Packaging slice 5: adapter npm trust — approved lock rows, bynk approve, compile gate (#2296) by @accuser in #2298
• Test the WebSocket-hosted on close checkpoint and the dispatch tail after it by @accuser in #2303
• Pin that split-context files map to their own source file by @accuser in #2305
• Track: the first-party registry (packaging slice 4b) — settling draft by @accuser in #2309
• ci(stamp): stamp the tip of main so a burst of merges strands no increment by @accuser in #2302
• design: mark the first-party registry track settled by @accuser in #2310
• Print every failed try's output in CI, so a FLAKY test is diagnosable by @accuser in #2307
• Clear code-scanning findings (OSV advisories, pinned npm tools, workflow checkout) by @accuser in #2178
• bynk test: a repeatable --case, a new --suite, and an error for a value that selects nothing by @accuser in #2304
• Reject a Workers WebSocket on open that transfers to an agent in another file by @accuser in #2312
• bynk test: a supported result stream, --format ndjson (Slice D, stage 1) by @accuser in #2315
• Test that a cross-file WebSocket open transfer compiles on bundle and is rejected on Workers by @accuser in #2314
• First-party registry R0: bynk registry conformance, and idempotent same-tree retries (#2311) by @accuser in #2313
• vscode-bynk Test Explorer: run and debug a multi-item selection as one process by @accuser in #2317
• First-party registry R5b: key delegation and revocation (protocol 2), rotate/delegate/revoke/resign (#2316) by @accuser in #2318
• bynk test: report each case as it finishes, with its duration (Slice D, stage 2) by @accuser in #2319
• Bump dompurify from 3.4.16 to 3.4.17 in /vscode-bynk in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2324
• Bump dompurify from 3.4.16 to 3.4.17 in /site by @dependabot[bot] in #2325
• vscode-bynk: a Watch toggle for the Test Explorer, and single-case coverage (Slice E) by @accuser in #2328
• Adapter bindings include WebAssembly modules (includes) — #2321 language half by @accuser in #2326
• R2 object storage: instance-only derived capabilities over Bytes objects (standard-library P5) by @accuser in #2331
• First-party registry L1: raw HTTP request bodies (@raw, 415, counted body caps) by @accuser in #2329
• Registry admission as one I/O-free crate, native and wasm (closes #2321) by @accuser in #2322
• bynk.crypto: effectful Web Crypto with non-storable key handles, and Random.bytes (standard-library K4) by @accuser in #2332
• Slice F spike: pin how the failures to be explained are reported today (fixtures only) by @accuser in #2333
• First-party registry L3: caching raw responses — a weak ETag for Raw, RawTagged, and @cache(immutable:) by @accuser in #2339
• Test runtime: shrink invariant violations and report the failing expect (#2272) by @accuser in #2337
• CI: promote drafts off the fast gates; fail fast in the merge queue by @accuser in #2344
• First-party registry R1: the service skeleton and read path (#2334) by @accuser in #2338
• Rate limiting: an instance-only RateLimit over the Workers Rate Limiting binding (standard-library P3) by @accuser in #2345
• Registry: try IPv4 first for localhost, so Windows doesn't wait on ::1 by @accuser in #2349
• Test runner: report the declaration a violated invariant or transition names (#2272) by @accuser in #2348
• Pin that a system suite's refusal is not attributed to a declaration (#2272) by @accuser in #2346
• First-party registry R5a.1: withdrawn versions in the protocol — withdrawn, bynk registry withdraw, 410, conformance by @accuser in #2340
• Test-leg speed-ups: Windows registry test, longest tests first by @accuser in #2350
• Emit: a provider that calls a local agent receives env through its deps by @accuser in #2355
• bynk test: a failed history names the declaration that refused each of its steps (Slice F, step 3) by @accuser in #2357
• First-party registry L4 (part 1): request headers and RawError error bodies by @accuser in #2347
• First-party registry L4 (part 2): on rejected renders the router's rejections by @accuser in #2351
• vscode-bynk: a failed test names the declaration that refused it (Slice F, step 4) by @accuser in #2358
• CI: audit the five npm trees in one job, not a five-leg matrix by @accuser in #2360
• bynkc: build the integration tests as one binary by @accuser in #2352
• Check: reject another context's agent-constructing provider on Workers by @accuser in #2356
• vscode-bynk CI: retry once on start-up window hang (#2353) by @accuser in #2361
• vscode-bynk: a refused step of a failed history opens its handler (#2359) by @accuser in #2362
• ci: drop stale site npm-audit allowlist entry GHSA-ch52-4w7c-c8xp by @accuser in #2364
• ci(site): serve Playwright's apt deps from the Actions cache by @accuser in #2365
• CI: on a push to main, skip what the merge queue passed on the same commit by @accuser in #2366
• First-party registry R3: accounts, organisations and self-service publish tokens by @accuser in #2367
• ci: share the cached Playwright apt deps with the extension job and the site deploy by @accuser in #2368
• ci: run the npm audit gate when its script or allowlist changes by @accuser in #2371
• vscode-bynk: test the handler lookup of a refused step (#2359 follow-up) by @accuser in #2370
• Build(deps): Bump @codemirror/view from 6.43.14 to 6.43.15 in /playground by @dependabot[bot] in #2372
• Build(deps): Bump @codemirror/autocomplete from 6.20.3 to 6.20.4 in /playground by @dependabot[bot] in #2373
• Build(deps): Bump astro from 7.4.0 to 7.4.1 in /site in the astro group by @dependabot[bot] in #2374
• Build(deps): Bump the cargo group with 4 updates by @dependabot[bot] in #2375
• Build(deps): Bump Swatinem/rust-cache from f0d9c3887740aee45f6153b24b3a6b815192ec16 to c8037a86dde8214a8310e9f54a8fc61ab362aa31 by @dependabot[bot] in #2376
• Build(deps): Bump anthropics/claude-code-action from 1.0.252 to 1.0.255 by @dependabot[bot] in #2377
• tree-sitter: accept trace and advance as ordinary identifiers by @accuser in #2379
• Registry: bynk publish and bynk yank refuse a registry read through a mirror by @accuser in #2385
• First-party registry R3.1: the account client — bynk login, logout and org by @accuser in #2382
• First-party registry L5: Oidc claims (who.claims) and trust roots from the environment (trustFrom) by @accuser in #2384
• First-party registry R3.2: per-organisation publish-token slots by @accuser in #2389
• R5.1: abuse limits — rate limits per token, IP and repository; a per-organisation quota (#2390) by @accuser in #2393
• R5.2: the scheduled export to a backup bucket, with a restore drill (#2391) by @accuser in #2394
• R5.3: the registry deploy workflow — release tags only, staging, then production behind an approval (#2392) by @accuser in #2395
• Embedded text, slice 1: the embed declaration and its checks (#2387) by @accuser in #2388
• Docs: close out Slice F of the Test Explorer depth track (#2272) by @accuser in #2398
• Embedded text, slice 2: read embeds/ and build an embed (#2387) by @accuser in #2399
• bynk-fmt: lay out pipe-form sum types one variant per line by @accuser in #2405
• Checker: a provider calling an agent handler must list its given (#2402) by @accuser in #2404
• First-party registry L6: a raw-body 201 for HTTP handlers, RawCreated(body, contentType) (#2403) by @accuser in #2407
• Retire the test-explorer-depth track (#2257) by @accuser in #2406
• Embedded text, slice 3: editor tooling, reference page and guide (#2387) by @accuser in #2408
• R5a.2: the hosted operator tombstone — withdraw route, audit log, backup and quota follow-through, organisation restore (#2397) by @accuser in #2400
• Registry: answer publish PUT with the protocol's plain index line (#2403) by @accuser in #2411
• Registry paths: express org/package/hex rules as Matches refinements (#2409) by @accuser in #2410
• Registry index lines: refuse a present toolchain/withdrawn that isn't a string by @accuser in #2401
• Build(deps-dev): Bump serialize-javascript from 7.0.5 to 7.1.4 in /vscode-bynk in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2412

Full Changelog: v0.377.2...v0.403.3