pnpm audit reports a critical advisory for next >=16.0.0 <=16.4.0:
unauthenticated remote code execution through the Image Optimization
API when SVG files are used. progmasoft.com runs 16.3.8. The site sets
no images option and the optimizer refused an SVG request in a check
from outside, but the version is in the affected range, so it moves to
16.4.2, the latest patch release; eslint-config-next follows.

Verified: pnpm check, pnpm test:coverage, pnpm lint and pnpm build
pass; pnpm audit --audit-level high reports nothing beyond the one
advisory already ignored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

BIMI lets mail clients show a sender's logo next to messages from a
domain whose DMARC policy is enforced; progmasoft.com already publishes
p=quarantine with pct=100. The BIMI record points at an SVG on the
domain, so the site now serves one at /bimi/logo.svg.

The file is SVG Tiny Portable/Secure, as BIMI requires: version 1.2,
baseProfile tiny-ps, a title, no scripts, no external references and
no x or y on the root. It draws the same four tiles as the Brand
component, in the same colours (#3b4658, #1e7188, #7655fa, #dc7644)
and the same tile-to-gap ratio (11:2, here 132 and 24 on a 512 grid),
on a white square. The mark stays inside the circle that clients crop
the logo to.

Next.js serves files from apps/web/public before the dynamic routes;
the deployment already copies public/ next to the standalone server.

A failed Google callback has returned the visitor to /login?google=failed
since the previous release, but nothing recorded why: a declined consent,
an expired or missing state cookie and a forged request all looked the
same, and the log of the service held no entry at all.

GoogleSignInFailure now handles OnRemoteFailure. It writes one warning,
event GoogleSignInFailed (id 5), with the cause: the error code Google
reported, such as access_denied, or the reason the handler refused the
callback, such as "The oauth state was missing or invalid." An error code
is written only when it is a short run of letters, digits, '_', '-' and
'.'; anything else from the query string is written as an unrecognized
error. The authorization code, the state and tokens are never logged.
The redirect is unchanged.

Four new tests cover the entry, the redirect, an unusual error value and
a refused state. The account API document describes the log entry.

A session of a Progmasoft Account, whether opened with a password or with
Google, lasted 12 hours from the sign-in, and the setting could not raise
it beyond 7 days. Sessions now last 30 days by default, and
AccountSessions:LifetimeHours may set anything from 1 hour up to that new
maximum of 720 hours; a value outside the range is clamped to it, as
before.

The lifetime stays fixed from the sign-in; it is not extended by use. The
production environment file sets no lifetime, so the new default applies
there once the API is deployed. Sessions opened before keep the expiry
they were given.

New tests check the 30-day default and the clamping of 0, 12, 720 and
10 000 hours. The account API document gives the new default and range.

A Google callback that could not finish ended in an unhandled 500: a
visitor who declined on Google's consent screen, a callback whose state
cookie had expired, and a direct request to the callback path all got an
empty error page. The account API document already promised a redirect
to /login?google=failed for a failed callback; the handler of the Google
scheme now does that through OnRemoteFailure. Three new tests cover a
callback without state, a declined consent and a forged state.

Three statements no longer matched the sites:

- the bug report template still named the catalog paths without the
  language and the build system; they are /langs/tala/<Publisher>/<Name>/
  and /dslplugins/tazel/<Publisher>/<Name>/;
- the operations guide placed Tala content on xsharp-lang.xyz, which only
  redirects to tala.run now;
- the architecture guide described the ViGet routing before the catalogs
  per language and build system: it now gives the rewrites of /langs/tala
  and /dslplugins/tazel, the redirects of /langs and /dslplugins, three
  indexed ViGet pages and a sitemap with the home page and both catalogs.

.com has no HSTS requirement of its own, but progmasoft.com is served as
if it had one:

- Every HTTPS server block of progmasoft.com, www, account and viget
  sends max-age=63072000; includeSubDomains; preload. The www redirect
  sent none before.
- Plain HTTP only answers the ACME challenge and otherwise redirects to
  HTTPS, now with a permanent 308 instead of 301.
- The API's own HSTS policy, which it adds to HTTPS responses outside
  development, carries the same values, so a proxied response never
  shows two different policies. A test checks the header.

A Tazel project file may be called BUILD.kts, BUILD.tzl, BUILD.tazel,
BUILD or Tazel.build, so ViGet no longer names one of them. The plugin
texts in all four locales speak of the project file of Tazel.

viget.progmasoft.com now shows, from the top:

1. The state of the registry: what it holds today, the package format,
   the publisher identity and that publishing is not open yet.
2. LANGUAGES: Tala links to viget.progmasoft.com/langs/tala; C++ is a
   gray, disabled button that leads nowhere.
3. BUILD SYSTEM DSL PLUGINS: Tazel links to
   viget.progmasoft.com/dslplugins/tazel; Gradle is a gray, disabled
   button that leads nowhere.

/langs/tala is the catalog of Tala packages and /dslplugins/tazel the
catalog of Kotlin DSL plugins for Tazel, both honestly empty. /langs and
/dslplugins redirect to them. The header, the footer and the sitemap
link the two catalogs, and the coordinates they show begin with the
catalog: /langs/tala/<Publisher>/<Name>/ and
/dslplugins/tazel/<Publisher>/<Name>/.

The text of the catalogs lives in lib/viget-catalogs.ts in all four
locales; localization.ts is close to the size limit of a file. The
two section headings are the registry's names and stay in English.

The language links of the ViGet and Progmasoft pages point at tala.run.

The language Visual X# is now Tala. The Progmasoft home page, the ViGet
pages, the dashboard and the two footers name it so in the four languages of
the site; the project file is BUILD.kts, and the source link leads to
Progmasoft/tala. The README, the operations and localization documents and
the issue templates follow.

The localization document said that a left-to-right mark follows the name of
the language in Hebrew text. That was for the `#` of the old name; the
sentence now speaks of names that end in a symbol.

The links to xsharp-lang.xyz stay: the language site is still served there.