build(deps-dev): bump the tooling group across 1 directory with 3 updates

.gitleaks.toml

@@ -3,9 +3,9 @@
 useDefault = true
 
 [[allowlists]]
-description = "Verified SHA-256 of protobuf 2.15.0 api_pb.js in four immutable reviewed profiles"
+description = "Verified SHA-256 of protobuf 2.15.0 api_pb.js in five immutable reviewed profiles"
 targetRules = ["generic-api-key"]
 condition = "AND"
-paths = ['''^eng/provenance/artifact-profiles/ai-worker-r[1234]\.json$''']
+paths = ['''^eng/provenance/artifact-profiles/ai-worker-r[12345]\.json$''']
 regexTarget = "line"
 regexes = ['''^\s*"node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/api_pb\.js": "73e489001027c703bc0224ae73f78ecefe028e88284bd06952e8603c3d81472c",?\s*$''']

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.13/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
   "vcs": { "enabled": true, "clientKind": "git", "useIgnoreFile": true },
   "files": {
     "includes": ["src/**/*.ts", "tests/**/*.ts", "eng/**/*.mjs", "*.ts", "!src/env.generated.d.ts"]

docs/development.md

@@ -10,7 +10,7 @@
 | Workers types                      | 5.20260914.1           | Current binding and model input/output types                                    |
 | Cloudflare Vitest plugin           | 1.1.9                  | Local Workerd/Workflow integration                                              |
 | Vitest                             | 4.1.11                 | Plugin requires Vitest 4.1; latest Vitest 5 is not a compatible upgrade         |
-| Biome / Prettier                   | 2.5.13 / 3.9.6         | Lint/format without depending on the removed TypeScript JavaScript compiler API |
+| Biome / Prettier                   | 2.5.14 / 3.9.8         | Lint/format without depending on the removed TypeScript JavaScript compiler API |
 | ArcForges proto / protobuf runtime | 1.0.0-ci.25.1 / 2.15.0 | Published Contracts messages, not sibling source                                |
 
 `npm ci --ignore-scripts` restores the committed dependency graph on Windows and Linux without lifecycle scripts. The selected tools work with this installation mode. `package-lock.json` includes transitive/platform packages for reproducibility; do not shorten it by hand. Platform-independent source checks run once on Linux CI; no Windows duplicate or macOS job is required.
@@ -34,7 +34,7 @@ To inspect the local health response, run `npm run dev -- --remote-bindings=fals
 
 ## Dependency and contract changes
 
-Update exact versions with `npm install --save-exact <package>@<version>` or `--save-dev` as appropriate, preserving `--ignore-scripts`. Review the manifest and lockfile together. Run the complete check/build/bundle sequence and the dependency audit. A binding/toolchain update also requires regeneration and review of `src/env.generated.d.ts`.
+Update exact versions with `npm install --save-exact <package>@<version>` or `--save-dev` as appropriate, preserving `--ignore-scripts`. Review the manifest and lockfile together. Run the affected offline checks, one candidate build and the dependency audit. Bundle/Workflow runtime diagnostics remain explicit local opt-in under the validation policy. A binding/toolchain update also requires regeneration and review of `src/env.generated.d.ts`.
 
 Keep the Cloudflare plugin, Wrangler and Vitest updates in a compatible group. Dependabot does not independently propose a Vitest major upgrade; review that upgrade explicitly when the Cloudflare plugin supports it. Keep `@arcforges/proto` and `@bufbuild/protobuf` compatible with the published Contracts manifest. No package can float to a different implementation between candidate testing and deployment.
 

eng/provenance/NOTICE.txt

@@ -2,8 +2,8 @@ AI source provenance
 
 Original material retains its recorded licence and full legal text.
 
-ai-worker-bundle-r4
-https://github.com/ArcForges/AI @ fbdcda7c63aebb3445a76890a76d3e25d408439a
+ai-worker-bundle-r5
+https://github.com/ArcForges/AI @ 943169b9e363393d76c5faf9fbb5ec9990b94c34
 AGPL-3.0-only
 Worker: Copyright ArcForges contributors, AGPL-3.0-only. Contracts: ArcForges contributors, Apache-2.0. Protobuf runtimes: Copyright 2021-2026 Buf Technologies, Inc., Apache-2.0; varint/descriptor material: Copyright 2008 Google Inc., BSD-3-Clause. Helpers: Copyright 2020 Evan Wallace, MIT. Generated README: Copyright 2020 Cloudflare, Inc., MIT. Complete respective texts and source-bound records accompany the actual candidate.
 

eng/provenance/files.json

@@ -49,11 +49,13 @@
     "eng/provenance/artifact-profiles/ai-worker-r2.json",
     "eng/provenance/artifact-profiles/ai-worker-r3.json",
     "eng/provenance/artifact-profiles/ai-worker-r4.json",
+    "eng/provenance/artifact-profiles/ai-worker-r5.json",
     "eng/provenance/files.json",
     "eng/provenance/records/ai-worker-bundle-r1.json",
     "eng/provenance/records/ai-worker-bundle-r2.json",
     "eng/provenance/records/ai-worker-bundle-r3.json",
     "eng/provenance/records/ai-worker-bundle-r4.json",
+    "eng/provenance/records/ai-worker-bundle-r5.json",
     "eng/provenance/records/buf-legal-r1.json",
     "eng/provenance/records/canonical-agpl-legal-r1.json",
     "eng/provenance/records/cloud-build-identity-r1.json",
@@ -102,5 +104,5 @@
     "eng/tests/build-identity.test.mjs": "cloud-build-identity-r1",
     "eng/version-sources.json": "cloud-build-identity-r1"
   },
-  "artifacts": ["ai-worker-bundle-r4"]
+  "artifacts": ["ai-worker-bundle-r5"]
 }