fix: adopt rdapper's DomainRecord type and propagate transport errors correctly

The hand-maintained ParsedRdapRecord interface duplicated rdapper's own DomainRecord; it is removed and the real type imported directly, picking up the reseller change (plain string instead of { name }).
safeFetch transport errors (timeout, connection_error, dns_error) are now re-thrown as RdapperError so rdapper's attempt trace records the right code instead of falling through to unknown.
The permanent error codes invalid_input, invalid_tld and unsupported_runtime now surface as lookup_failed instead of being queued for retry.

apps/web/package.json

@@ -38,7 +38,7 @@
     "@icons-pack/react-simple-icons": "^13.15.1",
     "@mdx-js/loader": "^3.1.1",
     "@mdx-js/react": "^3.1.1",
-    "@modelcontextprotocol/server": "^2.2.0",
+    "@modelcontextprotocol/server": "^2.3.0",
     "@next/mdx": "16.3.8",
     "@opentelemetry/api": "catalog:",
     "@opentelemetry/api-logs": "catalog:",
@@ -73,7 +73,7 @@
     "next": "16.3.8",
     "next-themes": "^0.4.6",
     "nuqs": "^2.10.1",
-    "posthog-js": "^1.435.7",
+    "posthog-js": "^1.435.8",
     "posthog-node": "^5.55.0",
     "react": "19.3.0",
     "react-dom": "19.3.0",

packages/auth/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@better-auth/drizzle-adapter": "^1.7.7",
-    "@better-auth/infra": "^0.4.13",
+    "@better-auth/infra": "^0.4.14",
     "@domainstack/db": "workspace:*",
     "@domainstack/email": "workspace:*",
     "@domainstack/logger": "workspace:*",

packages/core/src/whois/index.ts

@@ -9,6 +9,8 @@
 
 import { domainToUnicode } from "node:url";
 
+import type { DomainRecord } from "rdapper";
+
 import { upsertDomain } from "@domainstack/db/queries/domains";
 import {
   resolveOrCreateProviderId,
@@ -17,7 +19,7 @@ import {
 } from "@domainstack/db/queries/providers";
 import { getCachedRegistration, upsertRegistration } from "@domainstack/db/queries/registrations";
 import { getProviderCatalog } from "@domainstack/edge-config";
-import type { RegistrationContact, RegistrationResponse } from "@domainstack/types";
+import type { RegistrationResponse } from "@domainstack/types";
 import { getDomainTld } from "@domainstack/utils/domain";
 import {
   detectRegistrar,
@@ -133,7 +135,7 @@ export async function normalizeRegistration(
   options: NormalizeOptions,
 ): Promise<RegistrationResponse> {
   const { catalog } = options;
-  const record = JSON.parse(recordJson) as ParsedRdapRecord;
+  const record = JSON.parse(recordJson) as DomainRecord;
   const registrarProviders = catalog ? getProvidersFromCatalog(catalog, "registrar") : [];
 
   // Normalize registrar
@@ -183,7 +185,7 @@ export async function normalizeRegistration(
     unicodeName: record.unicodeName,
     punycodeName: record.punycodeName,
     registry: record.registry,
-    reseller: record.reseller?.name,
+    reseller: record.reseller,
     statuses: record.statuses,
     creationDate: record.creationDate,
     updatedDate: record.updatedDate,
@@ -263,45 +265,10 @@ export async function persistRegistration(
 }
 
 // ============================================================================
-// Internal: Types & Helpers
+// Internal: Helpers
 // ============================================================================
 
-interface ParsedRdapRecord {
-  domain: string;
-  tld: string;
-  isRegistered: boolean;
-  unicodeName?: string;
-  punycodeName?: string;
-  registry?: string;
-  registrar?: { name?: string; url?: string };
-  reseller?: { name?: string };
-  statuses?: Array<{ status: string; description?: string; raw?: string }>;
-  creationDate?: string;
-  updatedDate?: string;
-  expirationDate?: string;
-  deletionDate?: string;
-  transferLock?: boolean;
-  dnssec?: {
-    enabled: boolean;
-    dsRecords?: Array<{
-      keyTag?: number;
-      algorithm?: number;
-      digestType?: number;
-      digest?: string;
-    }>;
-  };
-  nameservers?: Array<{ host: string; ipv4?: string[]; ipv6?: string[] }>;
-  contacts?: RegistrationContact[];
-  privacyEnabled?: boolean;
-  whoisServer?: string;
-  rdapServers?: string[];
-  rawRdap?: unknown;
-  rawWhois?: string;
-  source?: "rdap" | "whois" | null;
-  warnings?: string[];
-}
-
-function formatRawResponse(record: ParsedRdapRecord): Record<string, unknown> | string | undefined {
+function formatRawResponse(record: DomainRecord): Record<string, unknown> | string | undefined {
   if (record.source === "rdap" && record.rawRdap) {
     return record.rawRdap as Record<string, unknown>;
   }

packages/core/src/whois/lookup.test.ts

@@ -124,7 +124,6 @@ describe("lookupWhois", () => {
     "no_data",
     "rate_limited",
     "unparseable",
-    "unsupported_runtime",
     "aborted",
     "unknown",
   ] as const)("returns retry for errorCode %s", async (errorCode) => {
@@ -135,6 +134,21 @@ describe("lookupWhois", () => {
     expect(result).toMatchObject({ success: false, error: "retry" });
   });
 
+  it.each(["invalid_input", "invalid_tld", "unsupported_runtime"] as const)(
+    "returns lookup_failed, not retry, for errorCode %s",
+    async (errorCode) => {
+      vi.mocked(lookup).mockResolvedValue({ ok: false, error: "boom", errorCode, attempts: [] });
+
+      const result = await lookupWhois("www.example.com");
+
+      expect(result).toMatchObject({
+        success: false,
+        error: "lookup_failed",
+        detail: { code: errorCode },
+      });
+    },
+  );
+
   it("returns timeout for a deadline timeout", async () => {
     vi.mocked(lookup).mockResolvedValue({
       ok: false,
@@ -241,7 +255,7 @@ describe("lookupWhois", () => {
     );
   });
 
-  it("omits customBootstrapData when the bootstrap fetch fails, so rdapper loads its own", async () => {
+  it("passes no customBootstrapData when the bootstrap fetch fails, so rdapper loads its own", async () => {
     // beforeEach makes the bootstrap fetch fail (ok: false)
     vi.mocked(lookup).mockResolvedValue({
       ok: true,
@@ -251,9 +265,7 @@ describe("lookupWhois", () => {
 
     await lookupWhois("example.com");
 
-    const passed = vi.mocked(lookup).mock.calls[0]?.[1] ?? {};
-    // rdapper rejects the key even when its value is undefined
-    expect("customBootstrapData" in passed).toBe(false);
+    expect(vi.mocked(lookup).mock.calls[0]?.[1]?.customBootstrapData).toBeUndefined();
   });
 
   it("passes the fetched bootstrap data through to rdapper", async () => {

packages/core/src/whois/lookup.ts

@@ -16,11 +16,13 @@ const DEFAULT_DEADLINE_MS = 10_000;
  *
  * `no_server` (IANA answered, no WHOIS server exists) and `blocked` (the WHOIS
  * server refuses this client outright) are permanent: neither will succeed on
- * retry, so both surface as `unsupported_tld`. A failed IANA query surfaces
- * as `timeout` or `connect_failed`, so it retries instead of being mistaken
- * for an unsupported TLD. `rate_limited` (throttle notice or RDAP 429) and
- * `unparseable` (a reply with no recognizable record) are treated as
- * transient, so they are retried rather than persisted.
+ * retry, so both surface as `unsupported_tld`. `invalid_input` (not a
+ * registrable domain), `invalid_tld` and `unsupported_runtime` are permanent
+ * too, so they surface as `lookup_failed` instead of being retried. A failed
+ * IANA query surfaces as `timeout` or `connect_failed`, so it retries instead
+ * of being mistaken for an unsupported TLD. `rate_limited` (throttle notice or
+ * RDAP 429) and `unparseable` (a reply with no recognizable record) are treated
+ * as transient, so they are retried rather than persisted.
  */
 function toFailure(
   res: Pick<
@@ -31,9 +33,13 @@ function toFailure(
   const error =
     res.errorCode === "no_server" || res.errorCode === "blocked"
       ? "unsupported_tld"
-      : res.errorCode === "timeout"
-        ? "timeout"
-        : "retry";
+      : res.errorCode === "invalid_input" ||
+          res.errorCode === "invalid_tld" ||
+          res.errorCode === "unsupported_runtime"
+        ? "lookup_failed"
+        : res.errorCode === "timeout"
+          ? "timeout"
+          : "retry";
   return {
     success: false,
     error,
@@ -74,7 +80,8 @@ export async function fetchBootstrapData(
       return undefined;
     }
 
-    // rdapper throws on malformed bootstrap data, so treat a bad shape like a failed fetch
+    // rdapper fails the lookup (invalid_input) on data without a services array, so treat a bad
+    // shape like a failed fetch and let rdapper load its own
     const json = (await res.json()) as Partial<BootstrapData> | null;
     return Array.isArray(json?.services) ? (json as BootstrapData) : undefined;
   } catch {
@@ -109,9 +116,8 @@ export async function lookupWhois(
       includeRaw,
       // Route every RDAP request (including followed links and redirects) through safeFetch.
       customFetch: createRdapFetch({ userAgent: options.userAgent, timeoutMs }),
-      // rdapper throws on the mere presence of this key, even when undefined, so omit it when our
-      // fetch failed and let rdapper load its own bootstrap (or fall back to WHOIS).
-      ...(bootstrapData ? { customBootstrapData: bootstrapData } : {}),
+      // Undefined when our fetch failed: rdapper then loads its own (or falls back to WHOIS).
+      customBootstrapData: bootstrapData,
     });
 
     if (!res.ok || !res.record) {

packages/core/src/whois/rdap-fetch.test.ts

@@ -1,3 +1,4 @@
+import { RdapperError } from "rdapper";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { safeFetch } from "@domainstack/safe-fetch";
@@ -73,7 +74,7 @@ describe("createRdapFetch", () => {
     expect(await res.json()).toEqual({ errorCode: 429 });
   });
 
-  it("propagates SafeFetchError as a rejection", async () => {
+  it("propagates a SafeFetchError refusal as is", async () => {
     safeFetchMock.mockRejectedValue(new SafeFetchError("host_blocked", "blocked"));
     const rdapFetch = createRdapFetch({ timeoutMs: 1000 });
 
@@ -82,6 +83,24 @@ describe("createRdapFetch", () => {
     );
   });
 
+  it.each([
+    ["timeout", "timeout"],
+    ["connection_error", "connect_failed"],
+    ["dns_error", "connect_failed"],
+  ] as const)(
+    "rethrows a safeFetch %s as an RdapperError coded %s, so rdapper's trace keeps it",
+    async (safeFetchCode, rdapperCode) => {
+      const original = new SafeFetchError(safeFetchCode, "Request failed");
+      safeFetchMock.mockRejectedValue(original);
+      const rdapFetch = createRdapFetch({ timeoutMs: 1000 });
+
+      const err = await rdapFetch("https://rdap.example/domain/example.com").catch((e) => e);
+
+      expect(err).toBeInstanceOf(RdapperError);
+      expect(err).toMatchObject({ code: rdapperCode, message: "Request failed", cause: original });
+    },
+  );
+
   it("forwards the dispatcher and combines safeFetch's and rdapper's abort signals", async () => {
     safeFetchMock.mockResolvedValue(makeResult());
     const globalFetch = vi.fn<typeof fetch>().mockResolvedValue(new Response("{}"));

packages/core/src/whois/rdap-fetch.ts

@@ -1,10 +1,22 @@
-import type { FetchLike } from "rdapper";
+import { type FetchLike, type LookupErrorCode, RdapperError } from "rdapper";
 
 import { safeFetch } from "@domainstack/safe-fetch";
+import { SafeFetchError, type SafeFetchErrorCode } from "@domainstack/safe-fetch/errors";
 
 /** RDAP JSON is small; 2 MB covers the largest real responses with room to spare. */
 const RDAP_MAX_BYTES = 2 * 1024 * 1024;
 
+/**
+ * rdapper codes for safeFetch's transport failures. rdapper classifies only errno codes, so
+ * without this every one would be traced as `unknown`. Policy refusals (private address,
+ * size cap, ...) have no rdapper equivalent and stay `unknown`.
+ */
+const RDAPPER_ERROR_CODES: Partial<Record<SafeFetchErrorCode, LookupErrorCode>> = {
+  timeout: "timeout",
+  connection_error: "connect_failed",
+  dns_error: "connect_failed",
+};
+
 /** Statuses the `Response` constructor refuses to build with a body. */
 const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 
@@ -29,22 +41,31 @@ function combineSignals(
  */
 export function createRdapFetch(options: { userAgent?: string; timeoutMs: number }): FetchLike {
   return async (input, init) => {
-    const result = await safeFetch({
-      url: input.toString(),
-      userAgent: options.userAgent,
-      headers: toHeaderRecord(init?.headers),
-      timeoutMs: options.timeoutMs,
-      maxBytes: RDAP_MAX_BYTES,
-      maxRedirects: 3,
-      // Some registrar RDAP endpoints are plain http; address checks still apply.
-      allowHttp: true,
-      // Must forward `fetchInit` (it carries the pinned `dispatcher`).
-      fetch: (url, fetchInit) =>
-        fetch(url, {
-          ...fetchInit,
-          signal: combineSignals(fetchInit?.signal, init?.signal),
-        }),
-    });
+    let result: Awaited<ReturnType<typeof safeFetch>>;
+    try {
+      result = await safeFetch({
+        url: input.toString(),
+        userAgent: options.userAgent,
+        headers: toHeaderRecord(init?.headers),
+        timeoutMs: options.timeoutMs,
+        maxBytes: RDAP_MAX_BYTES,
+        maxRedirects: 3,
+        // Some registrar RDAP endpoints are plain http; address checks still apply.
+        allowHttp: true,
+        // Must forward `fetchInit` (it carries the pinned `dispatcher`).
+        fetch: (url, fetchInit) =>
+          fetch(url, {
+            ...fetchInit,
+            signal: combineSignals(fetchInit?.signal, init?.signal),
+          }),
+      });
+    } catch (err) {
+      if (err instanceof SafeFetchError) {
+        const code = RDAPPER_ERROR_CODES[err.code];
+        if (code) throw new RdapperError(code, err.message, { cause: err });
+      }
+      throw err;
+    }
 
     const hasBody = !NULL_BODY_STATUSES.has(result.status);
     return new Response(hasBody ? new Uint8Array(result.buffer) : null, {

packages/core/src/whois/registration.test.ts

@@ -1,4 +1,5 @@
 /* @vitest-environment node */
+import type { DomainRecord } from "rdapper";
 import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { RemoteDataUnavailableError } from "../lib/fetch-errors";
@@ -37,7 +38,7 @@ beforeEach(async () => {
   whoisMock.lookupWhois.mockReset();
 });
 
-function mockRecord(record: Record<string, unknown>) {
+function mockRecord(record: DomainRecord) {
   whoisMock.lookupWhois.mockResolvedValue({
     success: true,
     recordJson: JSON.stringify(record),
@@ -58,7 +59,7 @@ describe("fetchRegistration", () => {
         punycodeName: domain,
         registry: "Verisign",
         registrar: { name: "Example Registrar, Inc.", url: "https://registrar.example.net/" },
-        reseller: { name: "Example Registrar, Inc." },
+        reseller: "Example Registrar, Inc.",
         statuses: [
           { status: "clientTransferProhibited", description: "Transfer locked", raw: "raw-1" },
           { status: "clientDeleteProhibited" },
@@ -88,6 +89,8 @@ describe("fetchRegistration", () => {
 
       expect(typeof fresh.data.domainId).toBe("string");
       expect(fresh.data.domainId).not.toBe("");
+      // rdapper reports the reseller as a plain name; it links to the known registrar
+      expect(fresh.data.reseller).toBe("Example Registrar, Inc.");
 
       const cached = await getCachedRegistration(domain);
       expect(fresh.data).toEqual(cached.data);

packages/core/src/whois/types.ts

@@ -32,7 +32,8 @@ interface RdapLookupFailureDetail {
  */
 export interface RdapLookupFailure {
   success: false;
-  error: "unsupported_tld" | "timeout" | "retry";
+  /** `unsupported_tld` and `lookup_failed` are permanent; `timeout` and `retry` are transient. */
+  error: "unsupported_tld" | "lookup_failed" | "timeout" | "retry";
   detail: RdapLookupFailureDetail;
 }
 

packages/logger/package.json

@@ -17,7 +17,7 @@
   "dependencies": {
     "@opentelemetry/api": "catalog:",
     "@opentelemetry/api-logs": "catalog:",
-    "pino": "^10.3.1",
+    "pino": "^10.4.0",
     "pino-pretty": "^13.1.3"
   },
   "devDependencies": {

packages/utils/src/registrant.ts

@@ -6,8 +6,9 @@ import type { RegistrationContact } from "@domainstack/types";
  * Client-safe: this only reads what rdapper already decided (`redacted`,
  * `redactedFields`, `privacyService`) and never imports rdapper itself.
  *
- * Registries can also return NIC handles (e.g. `JJ1234-IS`) in place of a name,
- * which rdapper doesn't resolve yet, so that one check lives here.
+ * Registries can also return NIC handles (e.g. `JJ1234-IS`) in place of a name.
+ * rdapper ≥ 0.18 drops them, but rows stored by older versions stay until the
+ * domain is looked up again, so the same check (rdapper's pattern) stays here.
  */
 
 type RegistrantState =
@@ -83,9 +84,10 @@ export function describeRegistrant(
     : (usableName(registrant.organization) ?? usableName(registrant.name));
   const location = formatLocation(registrant);
 
-  // Identity is withheld or belongs to a privacy service. Mirrors rdapper's
-  // `isPrivacyContact`; a bare `redacted` flag with no field list counts too,
-  // since we can't tell what was hidden.
+  // Identity is withheld or belongs to a privacy service. rdapper's
+  // `isPrivacyContact` asks the same, but it's re-derived here so rows cached by
+  // older rdapper versions read the same way; a bare `redacted` flag with no
+  // field list counts too, since we can't tell what was hidden.
   const redactedFields = registrant.redactedFields ?? [];
   const identityRedacted =
     Boolean(registrant.privacyService) ||
@@ -93,10 +95,12 @@ export function describeRegistrant(
       ? redactedFields.some((f) => f === "name" || f === "organization")
       : Boolean(registrant.redacted));
 
-  // `privacyEnabled` is coarse: rdapper sets it for any redacted registrant field
-  // (an email-only redaction is the usual GDPR shape). Identity is only hidden
-  // when no usable name survived, so a visible name stays a named registrant, and
-  // a redacted country or email on its own doesn't hide anything.
+  // Since rdapper 0.17, `privacyEnabled` means the identity is hidden, but rows
+  // cached before then set it for any redacted registrant field (an email-only
+  // redaction is the usual GDPR shape). Either way identity is only hidden when
+  // no usable name survived (a NIC handle isn't one), so a visible name stays a
+  // named registrant, and a redacted country or email on its own doesn't hide
+  // anything.
   const redacted = !name && (Boolean(privacyEnabled) || identityRedacted);
 
   // Redaction wins even when a stray country is published.

packages/workflows/src/steps/registration.ts

@@ -10,12 +10,12 @@ const MAX_RETRY_AFTER_MS = 5 * 60_000;
 
 type FetchRegistrationResult =
   | { success: true; data: { recordJson: string } }
-  | { success: false; error: "unsupported_tld" };
+  | { success: false; error: "unsupported_tld" | "lookup_failed" };
 
 /**
  * Step: Lookup domain registration via rdapper (WHOIS/RDAP).
  *
- * Unsupported TLD is a permanent failure.
+ * Unsupported TLD and invalid input (`lookup_failed`) are permanent failures.
  * Retry and timeout errors are thrown as RetryableError for automatic retry.
  *
  * @param domain - The domain to lookup
@@ -60,7 +60,7 @@ export async function lookupWhoisStep(domain: string): Promise<FetchRegistration
       }
       throw new RetryableError("RDAP lookup timed out", { retryAfter });
     }
-    // Permanent failure (unsupported_tld) - return to caller
+    // Permanent failure (unsupported_tld, lookup_failed) - return to caller
     return { success: false, error: result.error };
   }
 

pnpm-lock.yaml

@@ -52,8 +52,8 @@ catalogs:
       specifier: 19.3.0
       version: 19.3.0
     '@vercel/functions':
-      specifier: ^3.9.10
-      version: 3.9.10
+      specifier: ^3.9.11
+      version: 3.9.11
     ipaddr.js:
       specifier: ^2.5.0
       version: 2.5.0
@@ -61,8 +61,8 @@ catalogs:
       specifier: ^2.15.0
       version: 2.15.0
     rdapper:
-      specifier: ^0.17.0
-      version: 0.17.0
+      specifier: ^0.18.0
+      version: 0.18.0
     sonner:
       specifier: ^2.0.8
       version: 2.0.8
@@ -171,8 +171,8 @@ importers:
         specifier: ^3.1.1
         version: 3.1.1(@types/react@19.3.0)(react@19.3.0)
       '@modelcontextprotocol/server':
-        specifier: ^2.2.0
-        version: 2.2.0
+        specifier: ^2.3.0
+        version: 2.3.0
       '@next/mdx':
         specifier: 16.3.8
         version: 16.3.8(@mdx-js/loader@3.1.1(supports-color@8.1.1)(webpack@5.111.1(@swc/core@1.15.3(@swc/helpers@0.5.23))(esbuild@0.28.2)(lightningcss@1.33.0)(postcss@8.5.28)(sharp@0.35.5(@types/node@24.19.0))))(@mdx-js/react@3.1.1(@types/react@19.3.0)(react@19.3.0))
@@ -205,7 +205,7 @@ importers:
         version: 8.13.4(@ai-sdk/provider@4.0.21)(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1))(posthog-node@5.55.0(rxjs@7.8.2))
       '@posthog/mcp':
         specifier: ^0.21.4
-        version: 0.21.4(@modelcontextprotocol/sdk@1.31.0(supports-color@8.1.1)(zod@4.6.5))(@modelcontextprotocol/server@2.2.0)(posthog-node@5.55.0(rxjs@7.8.2))
+        version: 0.21.4(@modelcontextprotocol/sdk@1.31.0(supports-color@8.1.1)(zod@4.6.5))(@modelcontextprotocol/server@2.3.0)(posthog-node@5.55.0(rxjs@7.8.2))
       '@posthog/nextjs-config':
         specifier: ^1.11.1
         version: 1.11.1(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(webpack@5.111.1(@swc/core@1.15.3(@swc/helpers@0.5.23))(esbuild@0.28.2)(lightningcss@1.33.0)(postcss@8.5.28)(sharp@0.35.5(@types/node@24.19.0)))
@@ -235,7 +235,7 @@ importers:
         version: 11.19.0(@tanstack/react-query@5.104.1(react@19.3.0))(@trpc/client@11.19.0(@trpc/server@11.19.0(typescript@7.0.2))(typescript@7.0.2))(@trpc/server@11.19.0(typescript@7.0.2))(react@19.3.0)(typescript@7.0.2)
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       '@vercel/otel':
         specifier: ^2.1.3
         version: 2.1.3(@opentelemetry/api-logs@0.222.0)(@opentelemetry/api@1.9.1)(@opentelemetry/instrumentation@0.222.0(@opentelemetry/api@1.9.1)(supports-color@8.1.1))(@opentelemetry/resources@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-logs@0.222.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-metrics@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1))
@@ -259,7 +259,7 @@ importers:
         version: 6.11.2
       mcp-handler:
         specifier: ^2.2.0
-        version: 2.2.0(@modelcontextprotocol/server@2.2.0)(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))
+        version: 2.2.0(@modelcontextprotocol/server@2.3.0)(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))
       motion:
         specifier: ^14.0.0
         version: 14.0.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
@@ -276,8 +276,8 @@ importers:
         specifier: ^2.10.1
         version: 2.10.1(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)
       posthog-js:
-        specifier: ^1.435.7
-        version: 1.435.7(@types/react@19.3.0)(react@19.3.0)
+        specifier: ^1.435.8
+        version: 1.435.8(@types/react@19.3.0)(react@19.3.0)
       posthog-node:
         specifier: ^5.55.0
         version: 5.55.0(rxjs@7.8.2)
@@ -413,7 +413,7 @@ importers:
         version: 11.19.0(typescript@7.0.2)
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       posthog-node:
         specifier: ^5.55.0
         version: 5.55.0(rxjs@7.8.2)
@@ -443,8 +443,8 @@ importers:
         specifier: ^1.7.7
         version: 1.7.7(@better-auth/core@1.7.7(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.6.5))(jose@6.2.12)(kysely@0.29.6)(nanostores@1.5.4))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1))
       '@better-auth/infra':
-        specifier: ^0.4.13
-        version: 0.4.13(@better-auth/core@1.7.7(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.6.5))(jose@6.2.12)(kysely@0.29.6)(nanostores@1.5.4))(better-auth@1.7.7(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.11)(drizzle-orm@0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1))(next@16.3.8(@babel/core@7.29.7(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(pg@8.23.1)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(solid-js@1.9.15)(vitest@5.0.3))(zod@4.6.5)
+        specifier: ^0.4.14
+        version: 0.4.14(@better-auth/core@1.7.7(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.6.5))(jose@6.2.12)(kysely@0.29.6)(nanostores@1.5.4))(better-auth@1.7.7(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.11)(drizzle-orm@0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1))(next@16.3.8(@babel/core@7.29.7(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(pg@8.23.1)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(solid-js@1.9.15)(vitest@5.0.3))(zod@4.6.5)
       '@domainstack/db':
         specifier: workspace:*
         version: link:../db
@@ -468,7 +468,7 @@ importers:
         version: link:../utils
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       better-auth:
         specifier: ^1.7.7
         version: 1.7.7(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.11)(drizzle-orm@0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1))(next@16.3.8(@babel/core@7.29.7(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(pg@8.23.1)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(solid-js@1.9.15)(vitest@5.0.3)
@@ -548,7 +548,7 @@ importers:
         version: 9.0.6
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       cheerio:
         specifier: ^1.2.0
         version: 1.2.0
@@ -560,7 +560,7 @@ importers:
         version: 11.5.3
       rdapper:
         specifier: 'catalog:'
-        version: 0.17.0
+        version: 0.18.0
     devDependencies:
       '@domainstack/typescript-config':
         specifier: workspace:*
@@ -588,7 +588,7 @@ importers:
         version: link:../utils
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       drizzle-orm:
         specifier: ^0.45.3
         version: 0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1)
@@ -708,8 +708,8 @@ importers:
         specifier: 'catalog:'
         version: 0.222.0
       pino:
-        specifier: ^10.3.1
-        version: 10.3.1
+        specifier: ^10.4.0
+        version: 10.4.0
       pino-pretty:
         specifier: ^13.1.3
         version: 13.1.3
@@ -749,7 +749,7 @@ importers:
         version: 1.0.2
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       next:
         specifier: '>=16'
         version: 16.3.8(@babel/core@7.29.7(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
@@ -777,7 +777,7 @@ importers:
         version: 1.39.0
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       ipaddr.js:
         specifier: 'catalog:'
         version: 2.5.0
@@ -824,7 +824,7 @@ importers:
         version: link:../safe-fetch
       '@vercel/functions':
         specifier: 'catalog:'
-        version: 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+        version: 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       '@vercel/sandbox':
         specifier: ^3.5.1
         version: 3.5.1
@@ -914,7 +914,7 @@ importers:
         version: link:../types
       rdapper:
         specifier: 'catalog:'
-        version: 0.17.0
+        version: 0.18.0
     devDependencies:
       '@domainstack/typescript-config':
         specifier: workspace:*
@@ -1250,8 +1250,8 @@ packages:
       drizzle-orm:
         optional: true
 
-  '@better-auth/infra@0.4.13':
-    resolution: {integrity: sha512-OpcrAbsVDVg97/tyhYkb6fyZrmTYRIZZPTI8zcK4RTcJ1Yp5v4F1jbveCsCZ2B9KqSQzEfVaO+buABydhlbzFw==}
+  '@better-auth/infra@0.4.14':
+    resolution: {integrity: sha512-c4LSypBQkAcTw4c87ygWVmDJE3zwzyEQ9ScMdkj7Ml546gf0I1i1pBZ1L1JHqOAVg/Hwp4CMzXnM+9XBlxuOkg==}
     peerDependencies:
       '@better-auth/core': '>=1.4.0'
       '@react-native-async-storage/async-storage': '>=1.21.0'
@@ -2201,8 +2201,8 @@ packages:
   '@mediapipe/tasks-text@0.10.35':
     resolution: {integrity: sha512-BlRWXZAHakqtAos8hNgSU0jy4mh60R9ewzwckS3q2nV7Q/7L65otCtoDrgslRBhlfbElfcHbHQXKRahlMRCf4Q==}
 
-  '@modelcontextprotocol/core@2.2.0':
-    resolution: {integrity: sha512-iLhmprRmWI8EcosOA3wVvww22z02NkgqhV4fBH6f/odQBsi7xnJc0HGmi21yWO+/iKw2yzqVE127Zhna5/+JXw==}
+  '@modelcontextprotocol/core@2.3.0':
+    resolution: {integrity: sha512-09BHFaNVBe5pB2AhzCfLj0cqmsKLERvZQ4FblzP90UMGLaXVqdZPByFjURwsUYCmxonUW2yAwgTTvle+8O2/8w==}
     engines: {node: '>=20'}
 
   '@modelcontextprotocol/sdk@1.31.0':
@@ -2215,8 +2215,8 @@ packages:
       '@cfworker/json-schema':
         optional: true
 
-  '@modelcontextprotocol/server@2.2.0':
-    resolution: {integrity: sha512-qFnltjus6Gk8Lx6J1w2RXmr3YPN22MNT6qD6zjAkaiWIlFIFxWClz0rXHNuJF/KSUyn5YGhkSvXkWDbQHVLFEQ==}
+  '@modelcontextprotocol/server@2.3.0':
+    resolution: {integrity: sha512-+6b0LdsQLmHsvS7J6sQJ4weTpzUn61fU1JKS+321/+IyDYoHW5CR2Tgqcs6GgAAQvlesCo6yX3xttgmx+XGtJw==}
     engines: {node: '>=20'}
 
   '@mswjs/interceptors@0.41.9':
@@ -3841,8 +3841,8 @@ packages:
       next:
         optional: true
 
-  '@vercel/functions@3.9.10':
-    resolution: {integrity: sha512-s/Hbm2e/9YDGqAgjsAuhdnSc07psq0AVuELkImVfzoT52CbHLT3DTVoN6N4wtVeel9Tv1G4xB7S2cEkPH4j0og==}
+  '@vercel/functions@3.9.11':
+    resolution: {integrity: sha512-DbqKqcbUHGBTYgHZieSNDuF1/L2iSPZV0OGm0Xkm/t+s61lFk4VX8yGQ22Og3WYGxypW1l4Elx1NP8BL928u8Q==}
     engines: {node: '>= 20'}
     peerDependencies:
       '@aws-sdk/credential-provider-web-identity': '*'
@@ -3907,6 +3907,10 @@ packages:
     resolution: {integrity: sha512-sPw1kIfQEA6/2dB+zlAJHnhhNBRJ8t/t4HfFvKO+g0EPBA7NbCKyGovuhgAV6Mnl865ka7HqCEguIy596czdAw==}
     engines: {node: '>= 20'}
 
+  '@vercel/oidc@4.0.0':
+    resolution: {integrity: sha512-ko6ATeRUlHZMB5hLFdC7+/Q1dI2f3NX3gZHxtpALdkxurwjD5HFHGWYF+4o+4SF0E47jg6KzcHknmRpHcKgJ5A==}
+    engines: {node: '>= 20'}
+
   '@vercel/otel@2.1.3':
     resolution: {integrity: sha512-Ofvzs9qhftRD1YMLuPnhbXjQZG6IKrJ9AmEKmRHRGfoWlV89ed2gAOkvddkFiZDFZJm2rrFNdeZKRVxoCdnWiw==}
     engines: {node: ^18.19.0 || >=20.6.0}
@@ -7155,8 +7159,8 @@ packages:
   pino-std-serializers@7.1.0:
     resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}
 
-  pino@10.3.1:
-    resolution: {integrity: sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==}
+  pino@10.4.0:
+    resolution: {integrity: sha512-bk1ZMTwG/Vymx+zPoa28MhNzucFvXJWp3csrSuxuHPSMeUettaCoQ5Jvg07mtC4JGNpcfTwz41oVCnNgBK9+vA==}
     hasBin: true
 
   piscina@4.9.4:
@@ -7225,8 +7229,8 @@ packages:
     resolution: {integrity: sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==}
     engines: {node: '>=0.10.0'}
 
-  posthog-js@1.435.7:
-    resolution: {integrity: sha512-IPNA4jfJOXvK8/I+3FVPhdopscZ/GAqYzXDOphuhUcjMBzdMb1N82WH5NGvYQlRVAjko8a2AQ8LSlrsYPpljcw==}
+  posthog-js@1.435.8:
+    resolution: {integrity: sha512-rUrv0kKhD72Wfu++pBlupvrpt1Z60uTAgNUChAH232a05bbRBzV0P4JqbuZEAaaUXumhuB3a8r+iFMzm/2l1Ow==}
     peerDependencies:
       '@types/react': '>=16.8.0'
       react: '>=16.8.0'
@@ -7342,8 +7346,8 @@ packages:
   rc9@3.1.0:
     resolution: {integrity: sha512-ufjkNVzbRHKcCOmTahZkmVsyc3W+MSk3jY03m+a7tGHkIsdVMG9l10/3HvFbWkkKzY5VFp3pkRsIo/UYgmFL7Q==}
 
-  rdapper@0.17.0:
-    resolution: {integrity: sha512-b8YNKxmTwM+l0JwMrHhwbHaC2TwzLr1lUb/0y65CfAfVqGa7g8S0olqb9DQ2c2Zq3EwJf0sl91nVWabhIOQgFQ==}
+  rdapper@0.18.0:
+    resolution: {integrity: sha512-37hdYm79jTKiSCo7bb6HV7tp1DRiCjFiESzgcJIxdkloLu1GgKeAiWazA+XoMt1KlV/x20tbOxR7cO025CpzJQ==}
     engines: {node: '>=20'}
     hasBin: true
 
@@ -7379,10 +7383,6 @@ packages:
     resolution: {integrity: sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==}
     engines: {node: '>= 20.19.0'}
 
-  real-require@0.2.0:
-    resolution: {integrity: sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==}
-    engines: {node: '>= 12.13.0'}
-
   real-require@1.0.0:
     resolution: {integrity: sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==}
 
@@ -8933,7 +8933,7 @@ snapshots:
     optionalDependencies:
       drizzle-orm: 0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1)
 
-  '@better-auth/infra@0.4.13(@better-auth/core@1.7.7(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.6.5))(jose@6.2.12)(kysely@0.29.6)(nanostores@1.5.4))(better-auth@1.7.7(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.11)(drizzle-orm@0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1))(next@16.3.8(@babel/core@7.29.7(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(pg@8.23.1)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(solid-js@1.9.15)(vitest@5.0.3))(zod@4.6.5)':
+  '@better-auth/infra@0.4.14(@better-auth/core@1.7.7(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.6.5))(jose@6.2.12)(kysely@0.29.6)(nanostores@1.5.4))(better-auth@1.7.7(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.11)(drizzle-orm@0.45.3(@electric-sql/pglite@0.5.8)(@opentelemetry/api@1.9.1)(@types/pg@8.23.1)(@upstash/redis@1.39.0)(kysely@0.29.6)(pg@8.23.1))(next@16.3.8(@babel/core@7.29.7(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(pg@8.23.1)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(solid-js@1.9.15)(vitest@5.0.3))(zod@4.6.5)':
     dependencies:
       '@better-auth/core': 1.7.7(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.6.5))(jose@6.2.12)(kysely@0.29.6)(nanostores@1.5.4)
       '@better-auth/utils': 0.4.3
@@ -9635,7 +9635,7 @@ snapshots:
 
   '@mediapipe/tasks-text@0.10.35': {}
 
-  '@modelcontextprotocol/core@2.2.0':
+  '@modelcontextprotocol/core@2.3.0':
     dependencies:
       zod: 4.6.5
 
@@ -9707,9 +9707,9 @@ snapshots:
       - supports-color
     optional: true
 
-  '@modelcontextprotocol/server@2.2.0':
+  '@modelcontextprotocol/server@2.3.0':
     dependencies:
-      '@modelcontextprotocol/core': 2.2.0
+      '@modelcontextprotocol/core': 2.3.0
       zod: 4.6.5
 
   '@mswjs/interceptors@0.41.9':
@@ -10220,13 +10220,13 @@ snapshots:
     dependencies:
       '@posthog/types': 1.413.0
 
-  '@posthog/mcp@0.21.4(@modelcontextprotocol/sdk@1.31.0(supports-color@8.1.1)(zod@4.6.5))(@modelcontextprotocol/server@2.2.0)(posthog-node@5.55.0(rxjs@7.8.2))':
+  '@posthog/mcp@0.21.4(@modelcontextprotocol/sdk@1.31.0(supports-color@8.1.1)(zod@4.6.5))(@modelcontextprotocol/server@2.3.0)(posthog-node@5.55.0(rxjs@7.8.2))':
     dependencies:
       '@posthog/core': 1.55.3
       posthog-node: 5.55.0(rxjs@7.8.2)
     optionalDependencies:
       '@modelcontextprotocol/sdk': 1.31.0(supports-color@8.1.1)(zod@4.6.5)
-      '@modelcontextprotocol/server': 2.2.0
+      '@modelcontextprotocol/server': 2.3.0
 
   '@posthog/nextjs-config@1.11.1(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(webpack@5.111.1(@swc/core@1.15.3(@swc/helpers@0.5.23))(esbuild@0.28.2)(lightningcss@1.33.0)(postcss@8.5.28)(sharp@0.35.5(@types/node@24.19.0)))':
     dependencies:
@@ -11046,7 +11046,7 @@ snapshots:
 
   '@vercel/flags-core@1.9.0(@aws-sdk/credential-provider-web-identity@3.972.49)(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(ws@8.22.0)':
     dependencies:
-      '@vercel/functions': 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+      '@vercel/functions': 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       '@vercel/oidc': 3.5.0
       dequal: 2.0.3
       jose: 5.10.0
@@ -11057,9 +11057,9 @@ snapshots:
       - '@aws-sdk/credential-provider-web-identity'
       - ws
 
-  '@vercel/functions@3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)':
+  '@vercel/functions@3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)':
     dependencies:
-      '@vercel/oidc': 3.8.10
+      '@vercel/oidc': 4.0.0
     optionalDependencies:
       '@aws-sdk/credential-provider-web-identity': 3.972.49
       ws: 8.22.0
@@ -11105,6 +11105,12 @@ snapshots:
       '@vercel/cli-exec': 1.0.1
       jose: 5.10.0
 
+  '@vercel/oidc@4.0.0':
+    dependencies:
+      '@vercel/cli-config': 0.3.1
+      '@vercel/cli-exec': 1.0.1
+      jose: 5.10.0
+
   '@vercel/otel@2.1.3(@opentelemetry/api-logs@0.222.0)(@opentelemetry/api@1.9.1)(@opentelemetry/instrumentation@0.222.0(@opentelemetry/api@1.9.1)(supports-color@8.1.1))(@opentelemetry/resources@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-logs@0.222.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-metrics@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1))':
     dependencies:
       '@opentelemetry/api': 1.9.1
@@ -11497,7 +11503,7 @@ snapshots:
       '@jridgewell/trace-mapping': 0.3.31
       '@standard-schema/spec': 1.0.0
       '@types/ms': 2.1.0
-      '@vercel/functions': 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+      '@vercel/functions': 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       '@workflow/errors': 5.0.1
       '@workflow/serde': 5.0.0
       '@workflow/utils': 5.0.0
@@ -11528,7 +11534,7 @@ snapshots:
       '@jridgewell/trace-mapping': 0.3.31
       '@standard-schema/spec': 1.0.0
       '@types/ms': 2.1.0
-      '@vercel/functions': 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+      '@vercel/functions': 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       '@workflow/errors': 5.0.1
       '@workflow/serde': 5.0.0
       '@workflow/utils': 5.0.0
@@ -11834,7 +11840,7 @@ snapshots:
 
   '@workflow/world-vercel@5.0.1(@aws-sdk/credential-provider-web-identity@3.972.49)(@opentelemetry/api@1.9.1)':
     dependencies:
-      '@vercel/functions': 3.9.10(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
+      '@vercel/functions': 3.9.11(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0)
       '@vercel/oidc': 3.2.0
       '@vercel/queue': 0.5.1(@opentelemetry/api@1.9.1)
       '@workflow/errors': 5.0.1
@@ -14049,9 +14055,9 @@ snapshots:
 
   math-intrinsics@1.1.0: {}
 
-  mcp-handler@2.2.0(@modelcontextprotocol/server@2.2.0)(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)):
+  mcp-handler@2.2.0(@modelcontextprotocol/server@2.3.0)(next@16.3.8(@babel/core@7.29.7(supports-color@8.1.1))(@opentelemetry/api@1.9.1)(@types/node@24.19.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)):
     dependencies:
-      '@modelcontextprotocol/server': 2.2.0
+      '@modelcontextprotocol/server': 2.3.0
       chalk: 5.6.2
       commander: 11.1.0
     optionalDependencies:
@@ -15069,7 +15075,7 @@ snapshots:
 
   pino-std-serializers@7.1.0: {}
 
-  pino@10.3.1:
+  pino@10.4.0:
     dependencies:
       '@pinojs/redact': 0.4.0
       atomic-sleep: 1.0.0
@@ -15078,7 +15084,7 @@ snapshots:
       pino-std-serializers: 7.1.0
       process-warning: 5.1.0
       quick-format-unescaped: 4.0.4
-      real-require: 0.2.0
+      real-require: 1.0.0
       safe-stable-stringify: 2.5.0
       sonic-boom: 4.2.1
       thread-stream: 4.2.0
@@ -15147,7 +15153,7 @@ snapshots:
     dependencies:
       xtend: 4.0.2
 
-  posthog-js@1.435.7(@types/react@19.3.0)(react@19.3.0):
+  posthog-js@1.435.8(@types/react@19.3.0)(react@19.3.0):
     dependencies:
       '@posthog/browser-common': 0.9.1
       '@posthog/core': 1.55.3
@@ -15277,7 +15283,7 @@ snapshots:
       defu: 6.1.7
       destr: 2.0.5
 
-  rdapper@0.17.0:
+  rdapper@0.18.0:
     dependencies:
       tldts: 7.4.16
 
@@ -15329,8 +15335,6 @@ snapshots:
 
   readdirp@5.1.1: {}
 
-  real-require@0.2.0: {}
-
   real-require@1.0.0: {}
 
   recast@0.23.21:

pnpm-workspace.yaml

@@ -17,10 +17,10 @@ catalog:
   '@types/node': ^24.19.0
   '@types/react': 19.3.0
   '@types/react-dom': 19.3.0
-  '@vercel/functions': ^3.9.10
+  '@vercel/functions': ^3.9.11
   ipaddr.js: ^2.5.0
   msw: ^2.15.0
-  rdapper: ^0.17.0
+  rdapper: ^0.18.0
   sonner: ^2.0.8
   superjson: ^2.2.6
   vitest: ^5.0.3
@@ -42,4 +42,4 @@ allowBuilds:
   sharp: true
   '@nestjs/core': false
 minimumReleaseAgeExclude:
-  - rdapper@0.17.0
+  - rdapper