@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/sessions/adapters/opencode.js

@@ -1,24 +1,25 @@
 import { z } from 'zod';
+import { number } from '../../schema/zod-validation.mjs';
 import { schemaRejectionDetail, schemaIssueDetail, SessionContractError, assertSupportedSchemaMajor, } from '../contracts.js';
 import { readBoundedJson, streamBoundedJsonLines, } from '../readers.js';
 export const OPENCODE_ADAPTER_VERSION = '1.0.0';
 export const OPENCODE_EXPORT_SCHEMA_VERSION = '1.0.0';
-const SessionInfoSchema = z.object({
+const SessionInfoSchema = z.looseObject({
     id: z.string().min(1),
     projectID: z.string().optional(),
     directory: z.string().optional(),
     parentID: z.string().optional(),
     title: z.string().optional(),
     version: z.string().optional(),
-    time: z.object({
-        created: z.number().optional(),
-        updated: z.number().optional(),
-        compacting: z.number().nullable().optional(),
-        archived: z.number().nullable().optional(),
-    }).passthrough().optional(),
-    share: z.object({ url: z.string().optional() }).passthrough().optional(),
-}).passthrough();
-const MessageInfoSchema = z.object({
+    time: z.looseObject({
+        created: number().optional(),
+        updated: number().optional(),
+        compacting: number().nullable().optional(),
+        archived: number().nullable().optional(),
+    }).optional(),
+    share: z.looseObject({ url: z.string().optional() }).optional(),
+});
+const MessageInfoSchema = z.looseObject({
     id: z.string().min(1),
     sessionID: z.string().min(1),
     role: z.string().min(1),
@@ -26,13 +27,12 @@ const MessageInfoSchema = z.object({
     modelID: z.string().optional(),
     providerID: z.string().optional(),
     model: z.object({ providerID: z.string(), modelID: z.string() }).optional(),
-    cost: z.number().optional(),
-    tokens: z.record(z.unknown()).optional(),
-    time: z.object({ created: z.number().optional(), completed: z.number().optional() })
-        .passthrough().optional(),
+    cost: number().optional(),
+    tokens: z.record(z.string(), z.unknown()).optional(),
+    time: z.looseObject({ created: number().optional(), completed: number().optional() }).optional(),
     error: z.unknown().optional(),
-}).passthrough();
-const PartSchema = z.object({
+});
+const PartSchema = z.looseObject({
     id: z.string().min(1),
     sessionID: z.string().min(1),
     messageID: z.string().min(1),
@@ -45,27 +45,27 @@ const PartSchema = z.object({
     filename: z.string().optional(),
     url: z.string().optional(),
     time: z.unknown().optional(),
-}).passthrough();
-const MessageSchema = z.object({
+});
+const MessageSchema = z.looseObject({
     info: MessageInfoSchema,
     parts: z.array(PartSchema),
-}).passthrough();
-const ExportSchema = z.object({
+});
+const ExportSchema = z.looseObject({
     schemaVersion: z.string().optional(),
     info: SessionInfoSchema,
     messages: z.array(MessageSchema),
     sanitized: z.boolean().optional(),
-    sanitization: z.record(z.unknown()).optional(),
+    sanitization: z.record(z.string(), z.unknown()).optional(),
     shared: z.boolean().optional(),
-    providerDeletedAt: z.number().nullable().optional(),
-}).passthrough();
-const EventSchema = z.object({
+    providerDeletedAt: number().nullable().optional(),
+});
+const EventSchema = z.looseObject({
     schemaVersion: z.string().optional(),
     type: z.string().min(1),
-    properties: z.record(z.unknown()),
+    properties: z.record(z.string(), z.unknown()),
     sanitized: z.boolean().optional(),
     shared: z.boolean().optional(),
-}).passthrough();
+});
 export class OpenCodeSessionAdapter {
     limits;
     transports;

package/dist/src/sessions/adapters/openhuman.js

@@ -1,25 +1,26 @@
 import { z } from 'zod';
+import { number } from '../../schema/zod-validation.mjs';
 import { schemaRejectionDetail, schemaIssueDetail, SessionContractError, assertSupportedSchemaMajor, } from '../contracts.js';
 import { streamBoundedJsonLines, } from '../readers.js';
 export const OPENHUMAN_ADAPTER_VERSION = '1.0.0';
 export const OPENHUMAN_SOURCE_SCHEMA_VERSION = '1.0.0';
-const MetadataSchema = z.object({
+const MetadataSchema = z.looseObject({
     provider: z.string().optional(),
     model: z.string().optional(),
     profile: z.string().optional(),
     nestedAgentId: z.string().optional(),
     parentAgentId: z.string().optional(),
-}).passthrough();
-const AttachmentSchema = z.object({
+});
+const AttachmentSchema = z.looseObject({
     id: z.string().min(1),
     name: z.string().optional(),
     mime: z.string().optional(),
     uri: z.string().optional(),
     state: z.enum(['present', 'expired']),
-    expiredAt: z.union([z.string(), z.number()]).optional(),
-}).passthrough();
-const RawSchema = z.object({
-    schemaVersion: z.union([z.string(), z.number()]),
+    expiredAt: z.union([z.string(), number()]).optional(),
+});
+const RawSchema = z.looseObject({
+    schemaVersion: z.union([z.string(), number()]),
     recordType: z.literal('session_raw'),
     session_id: z.string().min(1),
     event_id: z.string().min(1),
@@ -29,36 +30,36 @@ const RawSchema = z.object({
     type: z.string().min(1),
     role: z.string().optional(),
     content: z.unknown().optional(),
-    timestamp: z.union([z.string(), z.number()]).optional(),
+    timestamp: z.union([z.string(), number()]).optional(),
     metadata: MetadataSchema.optional(),
-    input_tokens: z.number().optional(),
-    cached_input_tokens: z.number().optional(),
-    output_tokens: z.number().optional(),
-    charged_amount_usd: z.number().optional(),
+    input_tokens: number().optional(),
+    cached_input_tokens: number().optional(),
+    output_tokens: number().optional(),
+    charged_amount_usd: number().optional(),
     compacted: z.boolean().optional(),
     interrupted: z.boolean().optional(),
-    tool: z.record(z.unknown()).optional(),
+    tool: z.record(z.string(), z.unknown()).optional(),
     attachment: AttachmentSchema.optional(),
     active: z.boolean().optional(),
-    raw_transcript_deleted_at: z.union([z.string(), z.number()]).nullable().optional(),
-}).passthrough();
-const ThreadStateSchema = z.object({
-    schemaVersion: z.union([z.string(), z.number()]),
+    raw_transcript_deleted_at: z.union([z.string(), number()]).nullable().optional(),
+});
+const ThreadStateSchema = z.looseObject({
+    schemaVersion: z.union([z.string(), number()]),
     recordType: z.literal('thread_state'),
     thread_id: z.string().min(1),
     title: z.string().optional(),
     state: z.string().optional(),
-    deleted_at: z.union([z.string(), z.number()]).nullable().optional(),
-}).passthrough();
-const TurnStateSchema = z.object({
-    schemaVersion: z.union([z.string(), z.number()]),
+    deleted_at: z.union([z.string(), number()]).nullable().optional(),
+});
+const TurnStateSchema = z.looseObject({
+    schemaVersion: z.union([z.string(), number()]),
     recordType: z.literal('turn_state'),
     thread_id: z.string().min(1),
     request_id: z.string().min(1),
     state: z.string().min(1),
     interrupted: z.boolean().optional(),
-    completed_at: z.union([z.string(), z.number()]).nullable().optional(),
-}).passthrough();
+    completed_at: z.union([z.string(), number()]).nullable().optional(),
+});
 const RecordSchema = z.discriminatedUnion('recordType', [
     RawSchema, ThreadStateSchema, TurnStateSchema,
 ]);

package/dist/src/sessions/adapters/pi.js

@@ -1,14 +1,15 @@
 import { opendir } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { z } from 'zod';
+import { integer, dateTime } from '../../schema/zod-validation.mjs';
 import { schemaRejectionDetail, schemaIssueDetail, SessionContractError, } from '../contracts.js';
 import { streamBoundedJsonLines } from '../readers.js';
 export const PI_ADAPTER_VERSION = '1.0.0';
 export const PI_SOURCE_SCHEMA_VERSION = '3.0.0';
-const Header = z.object({ type: z.literal('session'), version: z.number().int(), id: z.string().min(1),
-    timestamp: z.string().datetime({ offset: true }), cwd: z.string(), parentSession: z.string().optional() }).passthrough();
-const Entry = z.object({ type: z.string().min(1), id: z.string().min(1),
-    parentId: z.string().nullable(), timestamp: z.string().datetime({ offset: true }) }).passthrough();
+const Header = z.looseObject({ type: z.literal('session'), version: integer(), id: z.string().min(1),
+    timestamp: dateTime({ offset: true }), cwd: z.string(), parentSession: z.string().optional() });
+const Entry = z.looseObject({ type: z.string().min(1), id: z.string().min(1),
+    parentId: z.string().nullable(), timestamp: dateTime({ offset: true }) });
 export class PiSessionAdapter {
     limits;
     maxFiles;

package/dist/src/sessions/adapters/windsurf.js

@@ -8,7 +8,7 @@ export const DEVIN_DESKTOP_TRANSCRIPT_SCHEMA_VERSION = '1.0.0';
 export const WINDSURF_ADAPTER_VERSION = DEVIN_DESKTOP_ADAPTER_VERSION;
 /** @deprecated Compatibility export. */
 export const WINDSURF_TRANSCRIPT_SCHEMA_VERSION = DEVIN_DESKTOP_TRANSCRIPT_SCHEMA_VERSION;
-const StepSchema = z.object({
+const StepSchema = z.looseObject({
     schema_version: z.string().optional(),
     type: z.string().min(1),
     status: z.string().min(1),
@@ -17,13 +17,13 @@ const StepSchema = z.object({
     event_id: z.string().min(1).optional(),
     timestamp: z.string().optional(),
     model_name: z.string().optional(),
-    model: z.union([z.string(), z.record(z.unknown())]).optional(),
-    sensitive_content_warning: z.union([z.boolean(), z.string(), z.record(z.unknown())]).optional(),
-    user_input: z.record(z.unknown()).optional(),
-    planner_response: z.record(z.unknown()).optional(),
-    code_action: z.record(z.unknown()).optional(),
-    tool_info: z.record(z.unknown()).optional(),
-}).passthrough();
+    model: z.union([z.string(), z.record(z.string(), z.unknown())]).optional(),
+    sensitive_content_warning: z.union([z.boolean(), z.string(), z.record(z.string(), z.unknown())]).optional(),
+    user_input: z.record(z.string(), z.unknown()).optional(),
+    planner_response: z.record(z.string(), z.unknown()).optional(),
+    code_action: z.record(z.string(), z.unknown()).optional(),
+    tool_info: z.record(z.string(), z.unknown()).optional(),
+});
 export class DevinDesktopSessionAdapter {
     limits;
     provider = 'devin-desktop';

package/dist/src/sessions/analytics.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { integer, dateTime } from '../schema/zod-validation.mjs';
 import { sha256 } from './contracts.js';
 export const SESSION_ANALYTICS_VERSION = '1.0.0';
 export const SessionAnalyticsCategorySchema = z.enum([
@@ -21,7 +22,7 @@ export const SessionAnalyticsStatusSchema = z.enum([
     'provider-unknown',
     'observed',
 ]);
-export const SessionAnalyticsFactSchema = z.object({
+export const SessionAnalyticsFactSchema = z.strictObject({
     analyticsVersion: z.literal(SESSION_ANALYTICS_VERSION),
     factId: z.string().min(1),
     category: SessionAnalyticsCategorySchema,
@@ -32,33 +33,33 @@ export const SessionAnalyticsFactSchema = z.object({
     eventId: z.string().min(1),
     sourceId: z.string().min(1),
     importRunId: z.string().min(1),
-    occurredAt: z.string().datetime({ offset: true }).nullable(),
-    sequence: z.number().int().nonnegative(),
+    occurredAt: dateTime({ offset: true }).nullable(),
+    sequence: integer().nonnegative(),
     actor: z.string().min(1).nullable(),
     participant: z.string().min(1).nullable(),
     toolName: z.string().min(1).nullable(),
     toolCallId: z.string().min(1).nullable(),
     retryGroupId: z.string().min(1).nullable(),
-    retryOrdinal: z.number().int().positive().nullable(),
+    retryOrdinal: integer().positive().nullable(),
     errorClass: z.string().min(1).nullable(),
     capability: z.string().min(1).nullable(),
     decision: z.string().min(1).nullable(),
     promptType: z.string().min(1).nullable(),
-    latencyMs: z.number().int().nonnegative().nullable(),
+    latencyMs: integer().nonnegative().nullable(),
     transition: z.string().min(1).nullable(),
     indicator: z.string().min(1).nullable(),
     sensitivity: z.enum(['none', 'sensitive']),
     extractionState: z.string().min(1).nullable(),
-    sourceCitation: z.object({
+    sourceCitation: z.strictObject({
         provider: z.string().min(1),
         sessionId: z.string().min(1),
         eventId: z.string().min(1),
         importRunId: z.string().min(1),
         sourceId: z.string().min(1),
         locatorClass: z.string().min(1),
-        sequence: z.number().int().nonnegative(),
-    }).strict(),
-}).strict();
+        sequence: integer().nonnegative(),
+    }),
+});
 /**
  * Derive content-free analytics facts from normalized session events.
  *

package/dist/src/sessions/candidates.js

@@ -1,20 +1,21 @@
 import { z } from 'zod';
+import { integer } from '../schema/zod-validation.mjs';
 import { IntelligenceCandidateSchema, IntelligenceCandidateTypeSchema, SESSION_CONTRACT_VERSION, SessionContractError, sha256, } from './contracts.js';
-export const ExtractedCandidateDraftSchema = z.object({
+export const ExtractedCandidateDraftSchema = z.strictObject({
     type: IntelligenceCandidateTypeSchema,
     assertion: z.string().min(1),
     subject: z.string().min(1).nullable(),
     predicate: z.string().min(1).nullable(),
     object: z.string().min(1).nullable(),
-    evidence: z.array(z.object({
+    evidence: z.array(z.strictObject({
         eventId: z.string().min(1),
-        start: z.number().int().nonnegative(),
-        end: z.number().int().positive(),
-    }).strict()).min(1),
+        start: integer().nonnegative(),
+        end: integer().positive(),
+    })).min(1),
     confidence: z.number().min(0).max(1),
     conflictsWith: z.array(z.string().min(1)).default([]),
     supersedes: z.array(z.string().min(1)).default([]),
-}).strict().superRefine((candidate, context) => {
+}).superRefine((candidate, context) => {
     if (candidate.type === 'relationship'
         && (!candidate.subject || !candidate.predicate || !candidate.object)) {
         context.addIssue({

package/dist/src/sessions/contracts.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { z } from 'zod';
+import { integer, dateTime, number } from '../schema/zod-validation.mjs';
 import { redactSessionText, redactSessionValue } from './policy.js';
 export const SESSION_CONTRACT_VERSION = '1.0.0';
 export const SESSION_PROVIDER_IDS = [
@@ -46,7 +47,7 @@ export const SessionCoveragePreflightSchema = z.object({
         adapterVersion: z.string().nullable(),
         supportedOperations: z.array(z.string()),
         acquisitionModes: z.array(z.string()),
-        sourceCount: z.number().int().nonnegative(),
+        sourceCount: integer().nonnegative(),
         boundaries: z.array(z.string()),
         remediation: z.string().nullable(),
     })),
@@ -80,7 +81,7 @@ export const SessionErrorCodeSchema = z.enum([
 ]);
 const VersionSchema = z.string().regex(/^\d+\.\d+\.\d+(?:[-+].+)?$/);
 const DigestSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/);
-const NativeExtensionsSchema = z.record(z.unknown()).superRefine((value, context) => {
+const NativeExtensionsSchema = z.record(z.string(), z.unknown()).superRefine((value, context) => {
     for (const key of Object.keys(value)) {
         if (!key.startsWith('native.')) {
             context.addIssue({ code: z.ZodIssueCode.custom, message: `native extension must use native.<provider>: ${key}` });
@@ -99,8 +100,8 @@ export const SessionSourceSchema = z.object({
     disposition: CapabilityDispositionSchema,
     operationalState: OperationalStateSchema,
     consistency: ConsistencyStateSchema,
-    authorizedAt: z.string().datetime({ offset: true }),
-    extensions: NativeExtensionsSchema.default({}),
+    authorizedAt: dateTime({ offset: true }),
+    extensions: NativeExtensionsSchema.prefault({}),
 });
 export const SessionEventSchema = z.object({
     contractVersion: z.literal(SESSION_CONTRACT_VERSION),
@@ -109,7 +110,7 @@ export const SessionEventSchema = z.object({
     sourceId: z.string().min(1),
     importRunId: z.string().min(1),
     nativeId: z.string().min(1).nullable(),
-    sequence: z.number().int().nonnegative(),
+    sequence: integer().nonnegative(),
     kind: z.string().min(1),
     role: z.string().min(1).nullable(),
     participant: z.string().min(1).nullable().default(null),
@@ -118,7 +119,7 @@ export const SessionEventSchema = z.object({
     model: z.string().min(1).nullable().default(null),
     entities: z.array(z.string().min(1)).default([]),
     extractionState: z.string().min(1).nullable().default(null),
-    occurredAt: z.string().datetime({ offset: true }).nullable(),
+    occurredAt: dateTime({ offset: true }).nullable(),
     activityBoundary: z.enum(['pause', 'resume', 'continuation', 'end']).nullable().default(null),
     activityBoundaryBasis: z.string().min(1).nullable().default(null),
     activityBoundaryConfidence: z.enum(['low', 'medium', 'high']).nullable().default(null),
@@ -132,8 +133,8 @@ export const SessionEventSchema = z.object({
     digest: DigestSchema,
     rawReference: z.object({
         locatorClass: z.string().min(1),
-        offset: z.number().int().nonnegative().optional(),
-        sequence: z.number().int().nonnegative().optional(),
+        offset: integer().nonnegative().optional(),
+        sequence: integer().nonnegative().optional(),
     }),
     adapterVersion: VersionSchema,
     consistency: ConsistencyStateSchema,
@@ -142,7 +143,7 @@ export const SessionEventSchema = z.object({
         classes: z.array(z.string().min(1)),
     }),
     opaque: z.boolean().default(false),
-    extensions: NativeExtensionsSchema.default({}),
+    extensions: NativeExtensionsSchema.prefault({}),
 });
 export const SessionSchema = z.object({
     contractVersion: z.literal(SESSION_CONTRACT_VERSION),
@@ -151,8 +152,8 @@ export const SessionSchema = z.object({
     provider: CompatibleSessionProviderIdSchema,
     nativeSessionId: z.string().min(1),
     workspaceId: z.string().min(1),
-    startedAt: z.string().datetime({ offset: true }).nullable(),
-    updatedAt: z.string().datetime({ offset: true }).nullable(),
+    startedAt: dateTime({ offset: true }).nullable(),
+    updatedAt: dateTime({ offset: true }).nullable(),
     consistency: ConsistencyStateSchema,
     lifecycle: z.enum([
         'active', 'inactive', 'paused', 'complete', 'interrupted', 'archived',
@@ -161,10 +162,10 @@ export const SessionSchema = z.object({
     intent: z.object({
         status: z.enum(['selected', 'absent', 'unknown']),
         eventId: z.string().min(1).nullable(),
-        sequence: z.number().int().nonnegative().nullable(),
+        sequence: integer().nonnegative().nullable(),
         title: z.string().nullable(),
         summary: z.string().nullable(),
-    }).default({
+    }).prefault({
         status: 'unknown',
         eventId: null,
         sequence: null,
@@ -172,12 +173,12 @@ export const SessionSchema = z.object({
         summary: null,
     }),
     sourceDigest: DigestSchema,
-    extensions: NativeExtensionsSchema.default({}),
+    extensions: NativeExtensionsSchema.prefault({}),
 });
 export const ImportCheckpointSchema = z.object({
     cursor: z.string(),
-    recordsRead: z.number().int().nonnegative(),
-    bytesRead: z.number().int().nonnegative(),
+    recordsRead: integer().nonnegative(),
+    bytesRead: integer().nonnegative(),
     checkpointVersion: z.literal('2').optional(),
     positionKind: z.enum(['record-index', 'byte-offset', 'provider-native']).optional(),
     sourceGeneration: z.string().min(1).optional(),
@@ -191,8 +192,8 @@ export const ImportCheckpointSchema = z.object({
         'unchanged-replay',
         'unverified',
     ]).optional(),
-    sourceSize: z.number().int().nonnegative().optional(),
-    sourceMtimeMs: z.number().nonnegative().optional(),
+    sourceSize: integer().nonnegative().optional(),
+    sourceMtimeMs: number().check(z.gte(0)).meta({ type: 'number', minimum: 0 }).optional(),
     sourceFileIdentity: z.string().min(1).optional(),
     prefixDigest: DigestSchema.optional(),
 });
@@ -206,8 +207,8 @@ export const ImportRunSchema = z.object({
     consistency: ConsistencyStateSchema,
     status: z.enum(['running', 'committed', 'rolled-back', 'failed']),
     checkpoint: ImportCheckpointSchema,
-    startedAt: z.string().datetime({ offset: true }),
-    completedAt: z.string().datetime({ offset: true }).nullable(),
+    startedAt: dateTime({ offset: true }),
+    completedAt: dateTime({ offset: true }).nullable(),
     errorCode: SessionErrorCodeSchema.nullable(),
 });
 export const ProvenanceEdgeSchema = z.object({
@@ -220,7 +221,7 @@ export const ProvenanceEdgeSchema = z.object({
     fromId: z.string().min(1),
     toId: z.string().min(1),
     importRunId: z.string().min(1),
-    createdAt: z.string().datetime({ offset: true }),
+    createdAt: dateTime({ offset: true }),
 });
 export const IntelligenceCandidateTypeSchema = z.enum([
     'decision', 'requirement', 'constraint', 'preference', 'task', 'discovery',
@@ -231,29 +232,29 @@ export const CandidateSecurityWarningSchema = z.enum([
     'instruction-like', 'structure-breaking', 'control-character', 'bidi-control',
     'unicode-confusable', 'active-content', 'secret-bearing',
 ]);
-export const CandidateSecuritySchema = z.object({
+export const CandidateSecuritySchema = z.strictObject({
     disposition: z.enum(['clear', 'suspicious']),
     warnings: z.array(CandidateSecurityWarningSchema),
     requiresAcknowledgement: z.boolean(),
     acknowledged: z.boolean(),
     policyVersion: VersionSchema,
-}).strict();
-export const IntelligenceCandidateSchema = z.object({
+});
+export const IntelligenceCandidateSchema = z.strictObject({
     contractVersion: z.literal(SESSION_CONTRACT_VERSION),
     candidateId: z.string().min(1),
-    version: z.number().int().positive(),
+    version: integer().positive(),
     type: IntelligenceCandidateTypeSchema,
     assertion: z.string().min(1),
     subject: z.string().min(1).nullable(),
     predicate: z.string().min(1).nullable(),
     object: z.string().min(1).nullable(),
-    evidence: z.array(z.object({
+    evidence: z.array(z.strictObject({
         eventId: z.string().min(1),
-        start: z.number().int().nonnegative(),
-        end: z.number().int().positive(),
+        start: integer().nonnegative(),
+        end: integer().positive(),
         quoteDigest: DigestSchema,
         quote: z.string().min(1).optional(),
-    }).strict()).min(1),
+    })).min(1),
     confidence: z.number().min(0).max(1),
     temporalScope: z.string().min(1),
     projectScope: z.string().min(1),
@@ -262,7 +263,7 @@ export const IntelligenceCandidateSchema = z.object({
     extractionPolicyVersion: VersionSchema,
     model: z.string().min(1).nullable(),
     sensitivity: z.enum(['none', 'sensitive']),
-    security: CandidateSecuritySchema.default({
+    security: CandidateSecuritySchema.prefault({
         disposition: 'clear',
         warnings: [],
         requiresAcknowledgement: false,
@@ -274,8 +275,8 @@ export const IntelligenceCandidateSchema = z.object({
     ]),
     conflictsWith: z.array(z.string().min(1)).default([]),
     supersedes: z.array(z.string().min(1)).default([]),
-    createdAt: z.string().datetime({ offset: true }),
-}).strict().superRefine((candidate, context) => {
+    createdAt: dateTime({ offset: true }),
+}).superRefine((candidate, context) => {
     if (candidate.type === 'relationship'
         && (!candidate.subject || !candidate.predicate || !candidate.object)) {
         context.addIssue({
@@ -284,11 +285,11 @@ export const IntelligenceCandidateSchema = z.object({
         });
     }
 });
-export const CandidateReviewReceiptSchema = z.object({
+export const CandidateReviewReceiptSchema = z.strictObject({
     contractVersion: z.literal(SESSION_CONTRACT_VERSION),
     receiptId: z.string().min(1),
     candidateId: z.string().min(1),
-    candidateVersion: z.number().int().positive(),
+    candidateVersion: integer().positive(),
     fromState: z.enum([
         'pending', 'accepted', 'rejected', 'deferred', 'promoted', 'superseded',
     ]),
@@ -299,18 +300,18 @@ export const CandidateReviewReceiptSchema = z.object({
     reason: z.string().min(1),
     securityWarnings: z.array(CandidateSecurityWarningSchema).default([]),
     securityAcknowledged: z.boolean().default(false),
-    occurredAt: z.string().datetime({ offset: true }),
-}).strict();
-export const PromotionReceiptSchema = z.object({
+    occurredAt: dateTime({ offset: true }),
+});
+export const PromotionReceiptSchema = z.strictObject({
     contractVersion: z.literal(SESSION_CONTRACT_VERSION),
     receiptId: z.string().min(1),
     operationId: z.string().min(1),
     candidateId: z.string().min(1),
-    candidateVersion: z.number().int().positive(),
+    candidateVersion: integer().positive(),
     consumer: z.string().min(1),
     destinationRef: z.string().min(1),
     reviewer: z.string().min(1),
-    approvedAt: z.string().datetime({ offset: true }),
+    approvedAt: dateTime({ offset: true }),
     evidenceEventIds: z.array(z.string().min(1)).min(1),
     conflictsWith: z.array(z.string().min(1)),
     supersedes: z.array(z.string().min(1)),
@@ -318,27 +319,27 @@ export const PromotionReceiptSchema = z.object({
     afterHash: DigestSchema,
     dryRun: z.boolean(),
     duplicate: z.boolean(),
-}).strict();
-export const DeletionReceiptSchema = z.object({
+});
+export const DeletionReceiptSchema = z.strictObject({
     contractVersion: z.literal(SESSION_CONTRACT_VERSION),
     receiptId: z.string().min(1),
     operationId: z.string().min(1),
     scopeClass: z.string().min(1),
-    counts: z.record(z.number().int().nonnegative()),
+    counts: z.record(z.string(), integer().nonnegative()),
     survivingDependentIds: z.array(z.string().min(1)),
     actorClass: z.string().min(1),
     reasonCode: z.string().min(1),
-    orphanCounts: z.record(z.number().int().nonnegative()),
+    orphanCounts: z.record(z.string(), integer().nonnegative()),
     outcome: z.enum(['preview', 'committed', 'failed']),
-    occurredAt: z.string().datetime({ offset: true }),
-}).strict();
-export const PromotionDependencyDecisionSchema = z.object({
+    occurredAt: dateTime({ offset: true }),
+});
+export const PromotionDependencyDecisionSchema = z.strictObject({
     dependentId: z.string().min(1),
     action: z.enum([
         'revoke', 'supersede', 'retain', 'origin_unavailable', 'delete', 'abort',
     ]),
     basis: z.string().min(1),
-}).strict();
+});
 export function assertSessionProviderId(value) {
     const canonical = SESSION_PROVIDER_ALIASES[value] ?? value;
     const parsed = SessionProviderIdSchema.safeParse(canonical);
@@ -373,7 +374,7 @@ function stableId(prefix, ...parts) {
     return `${prefix}_${createHash('sha256').update(parts.join('\0')).digest('hex')}`;
 }
 export const SessionRejectionDetailSchema = z.union([
-    z.object({ limit: z.string(), configured: z.number(), observed: z.number(),
+    z.object({ limit: z.string(), configured: number(), observed: number(),
         setting: z.string().optional(), origin: z.enum(['flag', 'env', 'config', 'default']).optional() }),
     z.object({ issues: z.array(z.object({ path: z.string(), code: z.string() })) }),
 ]);
@@ -390,16 +391,25 @@ export function assertSessionResourceLimit(limit, configured, observed) {
 /** Extract schema locations and validator codes without messages or input values. */
 export function schemaRejectionDetail(error) {
     const issues = [];
-    const visit = (entries) => {
+    const visit = (entries, prefix = []) => {
         for (const issue of entries) {
             if (issues.length >= 20)
                 return;
-            if (issue.code === 'invalid_union') {
-                for (const branch of issue.unionErrors)
-                    visit(branch.issues);
+            const path = [...prefix, ...issue.path];
+            if (issue.code === 'invalid_union' && issue.errors.length === 0) {
+                issues.push({ path: path.join('.') || '<root>', code: 'invalid_union_discriminator' });
+            }
+            else if (issue.code === 'invalid_union') {
+                // Native union branches carry paths relative to their parent union.
+                for (const branch of issue.errors)
+                    visit(branch, path);
             }
             else {
-                issues.push({ path: issue.path.join('.') || '<root>', code: issue.code });
+                // Keep the published diagnostic codes stable across validator versions.
+                const code = issue.code === 'invalid_value'
+                    ? (issue.values.length === 1 ? 'invalid_literal' : 'invalid_enum_value')
+                    : issue.code === 'invalid_format' ? 'invalid_string' : issue.code;
+                issues.push({ path: path.join('.') || '<root>', code });
             }
         }
     };