@brainervirus/workit-cursor 2.1.3 → 2.1.5

package/dist/cursor-session-start.js

@@ -27,18 +27,23 @@ function jsonStringifyReplacer(_, value) {
     return value.toString();
   return value;
 }
-function cached(getter) {
-  const set = false;
-  return {
-    get value() {
-      if (!set) {
-        const value = getter();
-        Object.defineProperty(this, "value", { value });
-        return value;
-      }
-      throw new Error("cached value already set");
+
+class Cached {
+  constructor(getter) {
+    this._getter = getter;
+    this._value = undefined;
+  }
+  get value() {
+    const getter = this._getter;
+    if (getter !== undefined) {
+      this._value = getter();
+      this._getter = undefined;
     }
-  };
+    return this._value;
+  }
+}
+function cached(getter) {
+  return new Cached(getter);
 }
 function nullish(input) {
   return input === null || input === undefined;
@@ -64,6 +69,56 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
+function rawShape(def) {
+  const desc = Object.getOwnPropertyDescriptor(def, "shape");
+  return desc?.get ? desc.get.raw : desc?.value;
+}
+function sourceShape(schema) {
+  return rawShape(schema._zod.def) ?? schema._zod.def.shape;
+}
+function deferProp(target, key, getter) {
+  Object.defineProperty(target, key, {
+    get() {
+      const value = getter();
+      assignProp(this, key, value);
+      return value;
+    },
+    enumerable: true,
+    configurable: true
+  });
+}
+function putProp(target, key, value) {
+  if (key in target)
+    assignProp(target, key, value);
+  else
+    target[key] = value;
+}
+function mirrorShape(target, source, keys, wrap) {
+  const raw = sourceShape(source);
+  for (const key of keys) {
+    const desc = Object.getOwnPropertyDescriptor(raw, key);
+    if (!desc.enumerable)
+      continue;
+    if (desc.get) {
+      deferProp(target, key, () => {
+        const value = source._zod.def.shape[key];
+        return wrap ? wrap(value, key) : value;
+      });
+    } else
+      putProp(target, key, wrap ? wrap(desc.value, key) : desc.value);
+  }
+}
+function mirrorProps(target, source) {
+  for (const key of Reflect.ownKeys(source)) {
+    const desc = Object.getOwnPropertyDescriptor(source, key);
+    if (!desc.enumerable)
+      continue;
+    if (desc.get)
+      deferProp(target, key, () => source[key]);
+    else
+      putProp(target, key, desc.value);
+  }
+}
 function mergeDefs(...defs) {
   const mergedDescriptors = {};
   for (const def of defs) {
@@ -152,23 +207,21 @@ function pick(schema, mask) {
   if (hasChecks) {
     throw new Error(".pick() cannot be used on object schemas containing refinements");
   }
-  const def = mergeDefs(schema._zod.def, {
-    get shape() {
-      const newShape = {};
-      for (const key of Reflect.ownKeys(mask)) {
-        if (!Object.prototype.hasOwnProperty.call(currDef.shape, key)) {
-          throw new Error(`Unrecognized key: "${String(key)}"`);
-        }
-        if (!mask[key])
-          continue;
-        assignProp(newShape, key, currDef.shape[key]);
-      }
-      assignProp(this, "shape", newShape);
-      return newShape;
-    },
-    checks: []
-  });
-  return clone(schema, def);
+  const newShape = {};
+  mirrorShape(newShape, schema, maskedKeys(schema, mask));
+  return clone(schema, mergeDefs(currDef, { shape: newShape, checks: [] }));
+}
+function maskedKeys(schema, mask) {
+  const raw = sourceShape(schema);
+  const keys = [];
+  for (const key of Reflect.ownKeys(mask)) {
+    if (!Object.getOwnPropertyDescriptor(raw, key)?.enumerable) {
+      throw new Error(`Unrecognized key: "${String(key)}"`);
+    }
+    if (mask[key])
+      keys.push(key);
+  }
+  return keys;
 }
 function omit(schema, mask) {
   const currDef = schema._zod.def;
@@ -177,23 +230,10 @@ function omit(schema, mask) {
   if (hasChecks) {
     throw new Error(".omit() cannot be used on object schemas containing refinements");
   }
-  const def = mergeDefs(schema._zod.def, {
-    get shape() {
-      const newShape = { ...schema._zod.def.shape };
-      for (const key of Reflect.ownKeys(mask)) {
-        if (!Object.prototype.hasOwnProperty.call(currDef.shape, key)) {
-          throw new Error(`Unrecognized key: "${String(key)}"`);
-        }
-        if (!mask[key])
-          continue;
-        delete newShape[key];
-      }
-      assignProp(this, "shape", newShape);
-      return newShape;
-    },
-    checks: []
-  });
-  return clone(schema, def);
+  const omitted = new Set(maskedKeys(schema, mask));
+  const newShape = {};
+  mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)).filter((key) => !omitted.has(key)));
+  return clone(schema, mergeDefs(currDef, { shape: newShape, checks: [] }));
 }
 function extend(schema, shape) {
   if (!isPlainObject(shape)) {
@@ -202,34 +242,26 @@ function extend(schema, shape) {
   const checks = schema._zod.def.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
-    const existingShape = schema._zod.def.shape;
+    const existingShape = sourceShape(schema);
     for (const key of Reflect.ownKeys(shape)) {
       if (Object.getOwnPropertyDescriptor(existingShape, key) !== undefined) {
         throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.");
       }
     }
   }
-  const def = mergeDefs(schema._zod.def, {
-    get shape() {
-      const _shape = { ...schema._zod.def.shape, ...shape };
-      assignProp(this, "shape", _shape);
-      return _shape;
-    }
-  });
-  return clone(schema, def);
+  return clone(schema, mergeDefs(schema._zod.def, { shape: extended(schema, shape) }));
+}
+function extended(schema, shape) {
+  const newShape = {};
+  mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)));
+  mirrorProps(newShape, shape);
+  return newShape;
 }
 function safeExtend(schema, shape) {
   if (!isPlainObject(shape)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
-  const def = mergeDefs(schema._zod.def, {
-    get shape() {
-      const _shape = { ...schema._zod.def.shape, ...shape };
-      assignProp(this, "shape", _shape);
-      return _shape;
-    }
-  });
-  return clone(schema, def);
+  return clone(schema, mergeDefs(schema._zod.def, { shape: extended(schema, shape) }));
 }
 function merge(a, b) {
   if (!b?._zod?.def) {
@@ -238,12 +270,11 @@ function merge(a, b) {
   if (a._zod.def.checks?.length) {
     throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");
   }
+  const newShape = {};
+  mirrorShape(newShape, a, Reflect.ownKeys(sourceShape(a)));
+  mirrorShape(newShape, b, Reflect.ownKeys(sourceShape(b)));
   const def = mergeDefs(a._zod.def, {
-    get shape() {
-      const _shape = { ...a._zod.def.shape, ...b._zod.def.shape };
-      assignProp(this, "shape", _shape);
-      return _shape;
-    },
+    shape: newShape,
     get catchall() {
       return b._zod.def.catchall;
     },
@@ -258,67 +289,16 @@ function partial(Class, schema, mask, name = "partial") {
   if (hasChecks) {
     throw new Error(`.${name}() cannot be used on object schemas containing refinements`);
   }
-  const def = mergeDefs(schema._zod.def, {
-    get shape() {
-      const oldShape = schema._zod.def.shape;
-      const shape = { ...oldShape };
-      if (mask) {
-        for (const key of Reflect.ownKeys(mask)) {
-          if (!Object.prototype.hasOwnProperty.call(oldShape, key)) {
-            throw new Error(`Unrecognized key: "${String(key)}"`);
-          }
-          if (!mask[key])
-            continue;
-          shape[key] = Class ? new Class({
-            type: "optional",
-            innerType: oldShape[key]
-          }) : oldShape[key];
-        }
-      } else {
-        for (const key of Reflect.ownKeys(oldShape)) {
-          shape[key] = Class ? new Class({
-            type: "optional",
-            innerType: oldShape[key]
-          }) : oldShape[key];
-        }
-      }
-      assignProp(this, "shape", shape);
-      return shape;
-    },
-    checks: []
-  });
-  return clone(schema, def);
+  const selected = mask ? new Set(maskedKeys(schema, mask)) : undefined;
+  const newShape = {};
+  mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)), Class && ((value, key) => selected && !selected.has(key) ? value : new Class({ type: "optional", innerType: value })));
+  return clone(schema, mergeDefs(schema._zod.def, { shape: newShape, checks: [] }));
 }
 function required(Class, schema, mask) {
-  const def = mergeDefs(schema._zod.def, {
-    get shape() {
-      const oldShape = schema._zod.def.shape;
-      const shape = { ...oldShape };
-      if (mask) {
-        for (const key of Reflect.ownKeys(mask)) {
-          if (!Object.prototype.hasOwnProperty.call(shape, key)) {
-            throw new Error(`Unrecognized key: "${String(key)}"`);
-          }
-          if (!mask[key])
-            continue;
-          shape[key] = new Class({
-            type: "nonoptional",
-            innerType: oldShape[key]
-          });
-        }
-      } else {
-        for (const key of Reflect.ownKeys(oldShape)) {
-          shape[key] = new Class({
-            type: "nonoptional",
-            innerType: oldShape[key]
-          });
-        }
-      }
-      assignProp(this, "shape", shape);
-      return shape;
-    }
-  });
-  return clone(schema, def);
+  const selected = mask ? new Set(maskedKeys(schema, mask)) : undefined;
+  const newShape = {};
+  mirrorShape(newShape, schema, Reflect.ownKeys(sourceShape(schema)), (value, key) => selected && !selected.has(key) ? value : new Class({ type: "nonoptional", innerType: value }));
+  return clone(schema, mergeDefs(schema._zod.def, { shape: newShape }));
 }
 function aborted(x, startIndex = 0) {
   if (x.aborted === true)
@@ -368,13 +348,18 @@ function finalizeIssue(iss, ctx, config) {
   }
   const schemaError = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : undefined;
   const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? "Invalid input";
-  const { inst: _inst, schema: _schema, continue: _continue, input: _input, ...rest } = iss;
-  rest.path ?? (rest.path = []);
-  rest.message = message;
+  const full = {};
+  for (const k of Object.keys(iss)) {
+    if (k === "inst" || k === "schema" || k === "continue" || k === "input" || k === "__proto__")
+      continue;
+    full[k] = iss[k];
+  }
+  full.path ?? (full.path = []);
+  full.message = message;
   if (ctx?.reportInput) {
-    rest.input = _input;
+    full.input = iss.input;
   }
-  return rest;
+  return full;
 }
 function codePointLength(str) {
   const units = str.length;
@@ -445,6 +430,22 @@ function own(inst, key, value, enumerable = true) {
 function hide(inst, key, value) {
   return own(inst, key, value, false);
 }
+function derived(computes, table) {
+  for (const key in computes) {
+    const compute = computes[key];
+    Object.defineProperty(table, key, {
+      configurable: true,
+      enumerable: true,
+      get() {
+        return own(this, key, compute(this));
+      },
+      set(value) {
+        own(this, key, value);
+      }
+    });
+  }
+  return table;
+}
 function defineBound(proto, key, fn) {
   Object.defineProperty(proto, key, {
     configurable: true,
@@ -515,7 +516,7 @@ function constantCatch(value) {
   fn[CONSTANT_CATCH] = true;
   return fn;
 }
-var captureStackTrace, allowsEval, propertyKeyTypes, NUMBER_FORMAT_RANGES, highSurrogate, installing, broke = false, breaker, CONSTANT_CATCH = "~constantCatch";
+var captureStackTrace, allowsEval, propertyKeyTypes, NUMBER_FORMAT_RANGES, BIGINT_FORMAT_RANGES, highSurrogate, installing, broke = false, breaker, CONSTANT_CATCH = "~constantCatch";
 var init_util = __esm(() => {
   init_core();
   captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};
@@ -542,6 +543,10 @@ var init_util = __esm(() => {
     float32: [-340282346638528860000000000000000000000, 340282346638528860000000000000000000000],
     float64: [-Number.MAX_VALUE, Number.MAX_VALUE]
   }))();
+  BIGINT_FORMAT_RANGES = {
+    int64: [/* @__PURE__ */ BigInt("-9223372036854775808"), /* @__PURE__ */ BigInt("9223372036854775807")],
+    uint64: [/* @__PURE__ */ BigInt(0), /* @__PURE__ */ BigInt("18446744073709551615")]
+  };
   highSurrogate = /[\uD800-\uDBFF]/;
   breaker = {
     configurable: true,
@@ -591,8 +596,7 @@ function $constructor(name, initializer, proto, params) {
       } finally {
         _zodDesc.value = undefined;
       }
-    }
-    if (inst._zod.traits.has(name)) {
+    } else if (inst._zod.traits.has(name)) {
       return;
     }
     inst._zod.traits.add(name);
@@ -753,13 +757,10 @@ function formatError(error, mapper = (issue) => issue.message) {
   processError(error);
   return fieldErrors;
 }
-var _messageDesc, _zodDesc2, _issuesDesc, _installedToString, initializer = (inst, def) => {
+var _messageDesc, _issuesDesc, _installedToString, initializer = (inst, def) => {
   inst.name = "$ZodError";
-  _zodDesc2.value = inst._zod;
-  Object.defineProperty(inst, "_zod", _zodDesc2);
   _issuesDesc.value = def;
   Object.defineProperty(inst, "issues", _issuesDesc);
-  _zodDesc2.value = undefined;
   _issuesDesc.value = undefined;
   Object.defineProperty(inst, "message", _messageDesc);
   const proto = Object.getPrototypeOf(inst);
@@ -788,7 +789,6 @@ var init_errors = __esm(() => {
     enumerable: true,
     configurable: true
   };
-  _zodDesc2 = { value: undefined, enumerable: false };
   _issuesDesc = { value: undefined, enumerable: false };
   _installedToString = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
   $ZodError = $constructor("$ZodError", initializer);
@@ -801,6 +801,40 @@ var init_errors = __esm(() => {
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
+function failure(Err, issues, ctx) {
+  let error;
+  return {
+    success: false,
+    get error() {
+      if (!error) {
+        error = new Err(issues.map((iss) => finalizeIssue(iss, ctx, config())));
+        issues = undefined;
+        ctx = undefined;
+      }
+      return error;
+    },
+    set error(e) {
+      error = e;
+      issues = undefined;
+      ctx = undefined;
+    }
+  };
+}
+function validateFallback(schema, value, _ctx) {
+  const ctx = _ctx ? { ..._ctx, async: false, abortEarly: true } : { async: false, abortEarly: true };
+  const fallbackRun = schema._zod.bag.fallbackRun;
+  let result;
+  if (fallbackRun) {
+    ctx[COMPILE_FALLBACK] = true;
+    result = fallbackRun({ value, issues: [] }, ctx);
+  } else {
+    result = schema._zod.run({ value, issues: [] }, ctx);
+  }
+  if (result instanceof Promise) {
+    throw new $ZodAsyncError;
+  }
+  return result.issues.length === 0;
+}
 var _parse = (_Err) => {
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, async: false } : { async: false };
@@ -836,20 +870,29 @@ var _parse = (_Err) => {
   if (result instanceof Promise) {
     throw new $ZodAsyncError;
   }
-  return result.issues.length ? {
-    success: false,
-    error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
-  } : { success: true, data: result.value };
-}, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
+  return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
+}, _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
   const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
   let result = schema._zod.run({ value, issues: [] }, ctx);
   if (result instanceof Promise)
     result = await result;
-  return result.issues.length ? {
-    success: false,
-    error: new _Err(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
-  } : { success: true, data: result.value };
-}, safeParseAsync, _encode = (_Err) => {
+  return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
+}, COMPILE_INVALID, COMPILE_FALLBACK, validate = (schema, value, _ctx) => {
+  const validator = schema._zod.bag.validator;
+  if (validator !== undefined) {
+    if (validator(value) !== COMPILE_INVALID)
+      return true;
+    if (validator.definite === true && _ctx === undefined)
+      return false;
+  }
+  return validateFallback(schema, value, _ctx);
+}, validateAsync = async (schema, value, _ctx) => {
+  const ctx = _ctx ? { ..._ctx, async: true, abortEarly: true } : { async: true, abortEarly: true };
+  let result = schema._zod.run({ value, issues: [] }, ctx);
+  if (result instanceof Promise)
+    result = await result;
+  return result.issues.length === 0;
+}, _encode = (_Err) => {
   const parse = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
@@ -888,10 +931,9 @@ var _parse = (_Err) => {
 };
 var init_parse = __esm(() => {
   init_core();
-  init_errors();
   init_util();
-  safeParse = /* @__PURE__ */ _safeParse($ZodRealError);
-  safeParseAsync = /* @__PURE__ */ _safeParseAsync($ZodRealError);
+  COMPILE_INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
+  COMPILE_FALLBACK = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 });
 
 // node_modules/zod/v4/core/regexes.js
@@ -924,10 +966,7 @@ var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid = (version) => {
   if (!version)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
   return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
-}, email, _emoji = `^[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, httpProtocol, e164, creditCard, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, string = (params) => {
-  const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
-  return new RegExp(`^${regex}$`);
-}, integer, number, boolean, lowercase, uppercase;
+}, email, _emoji = `^(?=[\\s\\S]*[\\p{Extended_Pictographic}\\p{Regional_Indicator}\\u20E3])[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, httpProtocol, e164, creditCard, iban, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, anyString, integer, number, boolean, lowercase, uppercase;
 var init_regexes = __esm(() => {
   cuid = /^[cC][0-9a-z]{6,}$/;
   cuid2 = /^[0-9a-z]+$/;
@@ -937,17 +976,19 @@ var init_regexes = __esm(() => {
   nanoid = /^[a-zA-Z0-9_-]{21}$/;
   duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
   guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-  email = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+  email = /^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
   ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
   ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
   cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
   cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
   base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
-  base64url = /^[A-Za-z0-9_-]*$/;
+  base64url = /^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2,3})?$/;
   httpProtocol = /^https?$/;
   e164 = /^\+[1-9]\d{6,14}$/;
   creditCard = /^\d(?:[ -]?\d){11,18}$/;
+  iban = /^[A-Z]{2}(?!00|01|99)\d{2}[A-Z0-9]{11,30}$/;
   date = /* @__PURE__ */ anchor(dateSource);
+  anyString = /^[\s\S]{0,}$/;
   integer = /^-?\d+$/;
   number = /^-?\d+(?:\.\d+)?$/;
   boolean = /^(?:true|false)$/i;
@@ -978,16 +1019,6 @@ var init_checks = __esm(() => {
   $ZodCheckLessThan = /* @__PURE__ */ $constructor("$ZodCheckLessThan", (inst, def) => {
     $ZodCheck.init(inst, def);
     const origin = numericOriginMap[typeof def.value];
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      const curr = (def.inclusive ? bag.maximum : bag.exclusiveMaximum) ?? Number.POSITIVE_INFINITY;
-      if (def.value < curr) {
-        if (def.inclusive)
-          bag.maximum = def.value;
-        else
-          bag.exclusiveMaximum = def.value;
-      }
-    });
     inst._zod.check = (payload) => {
       if (def.inclusive ? payload.value <= def.value : payload.value < def.value) {
         return;
@@ -1006,16 +1037,6 @@ var init_checks = __esm(() => {
   $ZodCheckGreaterThan = /* @__PURE__ */ $constructor("$ZodCheckGreaterThan", (inst, def) => {
     $ZodCheck.init(inst, def);
     const origin = numericOriginMap[typeof def.value];
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      const curr = (def.inclusive ? bag.minimum : bag.exclusiveMinimum) ?? Number.NEGATIVE_INFINITY;
-      if (def.value > curr) {
-        if (def.inclusive)
-          bag.minimum = def.value;
-        else
-          bag.exclusiveMinimum = def.value;
-      }
-    });
     inst._zod.check = (payload) => {
       if (def.inclusive ? payload.value >= def.value : payload.value > def.value) {
         return;
@@ -1033,10 +1054,6 @@ var init_checks = __esm(() => {
   });
   $ZodCheckMultipleOf = /* @__PURE__ */ $constructor("$ZodCheckMultipleOf", (inst, def) => {
     $ZodCheck.init(inst, def);
-    inst._zod.onattach.push((inst) => {
-      var _a;
-      (_a = inst._zod.bag).multipleOf ?? (_a.multipleOf = def.value);
-    });
     inst._zod.check = (payload) => {
       if (typeof payload.value !== typeof def.value)
         throw new Error("Cannot mix number and bigint in multiple_of check.");
@@ -1059,14 +1076,6 @@ var init_checks = __esm(() => {
     const isInt = def.format?.includes("int");
     const origin = isInt ? "int" : "number";
     const [minimum, maximum] = NUMBER_FORMAT_RANGES[def.format];
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      bag.format = def.format;
-      bag.minimum = minimum;
-      bag.maximum = maximum;
-      if (isInt)
-        bag.pattern = integer;
-    });
     inst._zod.check = (payload) => {
       const input = payload.value;
       if (isInt) {
@@ -1136,11 +1145,6 @@ var init_checks = __esm(() => {
     var _a;
     $ZodCheck.init(inst, def);
     (_a = inst._zod.def).when ?? (_a.when = _whenHasLength);
-    inst._zod.onattach.push((inst) => {
-      const curr = inst._zod.bag.maximum ?? Number.POSITIVE_INFINITY;
-      if (def.maximum < curr)
-        inst._zod.bag.maximum = def.maximum;
-    });
     inst._zod.check = (payload) => {
       const input = payload.value;
       const units = input.length;
@@ -1163,11 +1167,6 @@ var init_checks = __esm(() => {
     var _a;
     $ZodCheck.init(inst, def);
     (_a = inst._zod.def).when ?? (_a.when = _whenHasLength);
-    inst._zod.onattach.push((inst) => {
-      const curr = inst._zod.bag.minimum ?? Number.NEGATIVE_INFINITY;
-      if (def.minimum > curr)
-        inst._zod.bag.minimum = def.minimum;
-    });
     inst._zod.check = (payload) => {
       const input = payload.value;
       const units = input.length;
@@ -1190,12 +1189,6 @@ var init_checks = __esm(() => {
     var _a;
     $ZodCheck.init(inst, def);
     (_a = inst._zod.def).when ?? (_a.when = _whenHasLength);
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      bag.minimum = def.length;
-      bag.maximum = def.length;
-      bag.length = def.length;
-    });
     inst._zod.check = (payload) => {
       const input = payload.value;
       const units = input.length;
@@ -1218,14 +1211,6 @@ var init_checks = __esm(() => {
   $ZodCheckStringFormat = /* @__PURE__ */ $constructor("$ZodCheckStringFormat", (inst, def) => {
     var _a, _b;
     $ZodCheck.init(inst, def);
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      bag.format = def.format;
-      if (def.pattern) {
-        bag.patterns ?? (bag.patterns = new Set);
-        bag.patterns.add(def.pattern);
-      }
-    });
     if (def.pattern)
       (_a = inst._zod).check ?? (_a.check = (payload) => {
         def.pattern.lastIndex = 0;
@@ -1274,11 +1259,6 @@ var init_checks = __esm(() => {
     const escapedRegex = escapeRegex(def.includes);
     const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position},}${escapedRegex}` : escapedRegex);
     def.pattern = pattern;
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      bag.patterns ?? (bag.patterns = new Set);
-      bag.patterns.add(pattern);
-    });
     inst._zod.check = (payload) => {
       if (payload.value.includes(def.includes, def.position))
         return;
@@ -1297,11 +1277,6 @@ var init_checks = __esm(() => {
     $ZodCheck.init(inst, def);
     const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
     def.pattern ?? (def.pattern = pattern);
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      bag.patterns ?? (bag.patterns = new Set);
-      bag.patterns.add(pattern);
-    });
     inst._zod.check = (payload) => {
       if (payload.value.startsWith(def.prefix))
         return;
@@ -1320,11 +1295,6 @@ var init_checks = __esm(() => {
     $ZodCheck.init(inst, def);
     const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
     def.pattern ?? (def.pattern = pattern);
-    inst._zod.onattach.push((inst) => {
-      const bag = inst._zod.bag;
-      bag.patterns ?? (bag.patterns = new Set);
-      bag.patterns.add(pattern);
-    });
     inst._zod.check = (payload) => {
       if (payload.value.endsWith(def.suffix))
         return;
@@ -1357,8 +1327,11 @@ class Doc {
   }
   indented(fn) {
     this.indent += 1;
-    fn(this);
-    this.indent -= 1;
+    try {
+      fn(this);
+    } finally {
+      this.indent -= 1;
+    }
   }
   write(arg) {
     if (typeof arg === "function") {
@@ -1391,30 +1364,57 @@ var version;
 var init_versions = __esm(() => {
   version = {
     major: 4,
-    minor: 5,
-    patch: 4
+    minor: 6,
+    patch: 5
   };
 });
 
 // node_modules/zod/v4/core/schemas.js
+async function validateAsync2(inst, value) {
+  const ctx = { async: true };
+  return toStandardResult(await inst._zod.run({ value, issues: [] }, ctx), ctx);
+}
 function standardProps(inst) {
   return {
     validate: (value) => {
+      const ctx = { async: false };
       try {
-        return toStandardResult(safeParse(inst, value));
-      } catch (_) {
-        return safeParseAsync(inst, value).then(toStandardResult);
-      }
+        const r = inst._zod.run({ value, issues: [] }, ctx);
+        if (!(r instanceof Promise))
+          return toStandardResult(r, ctx);
+      } catch (_) {}
+      return validateAsync2(inst, value);
     },
     vendor: "zod",
     version: 1
   };
 }
+function canParseURL(input) {
+  try {
+    if (typeof URL !== "undefined" && typeof URL.canParse === "function")
+      return URL.canParse(input);
+    new URL(input);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function validateURL(trimmed, def) {
+  if (!("normalize" in def) && !("hostname" in def) && !("protocol" in def)) {
+    return canParseURL(trimmed) || URL_UNPARSEABLE;
+  }
+  return parseURLObject(trimmed, def);
+}
 function parseURLObject(trimmed, def) {
   if (!def.normalize && def.protocol?.source === httpProtocol.source && !/^https?:\/\//i.test(trimmed)) {
     return URL_BAD_FORMAT;
   }
   try {
+    if (typeof URL !== "undefined") {
+      const URLStatic = URL;
+      if (typeof URLStatic.parse === "function")
+        return URLStatic.parse(trimmed) ?? URL_UNPARSEABLE;
+    }
     return new URL(trimmed);
   } catch {
     return URL_UNPARSEABLE;
@@ -1434,12 +1434,7 @@ function urlProtocolOk(url, protocol) {
 function isValidIPv6(value) {
   if (!ipv6Alphabet.test(value))
     return false;
-  try {
-    new URL(`http://[${value}]`);
-    return true;
-  } catch {
-    return false;
-  }
+  return canParseURL(`http://[${value}]`);
 }
 function isValidCIDRv6(value) {
   const parts = value.split("/");
@@ -1470,7 +1465,7 @@ function isValidBase64(data) {
   }
 }
 function isValidBase64URL(data) {
-  if (!base64url.test(data))
+  if (!base64urlCharset.test(data))
     return false;
   const base64 = data.replace(/[-_]/g, (c) => c === "-" ? "+" : "/");
   const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
@@ -1481,7 +1476,7 @@ function isLuhnAlgo(digits) {
   let bit = 1;
   let sum = 0;
   while (length) {
-    const value = +digits[--length];
+    const value = digits.charCodeAt(--length) - 48;
     bit ^= 1;
     sum += bit ? [0, 2, 4, 6, 8, 1, 3, 5, 7, 9][value] : value;
   }
@@ -1492,6 +1487,24 @@ function isValidCreditCard(input) {
     return false;
   return isLuhnAlgo(input.replace(CC_SANITIZE, ""));
 }
+function isIso7064Mod97(iban2) {
+  let remainder = 0;
+  const len = iban2.length;
+  for (let i = 4;i < len; i++) {
+    const code = iban2.charCodeAt(i);
+    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+  }
+  for (let i = 0;i < 4; i++) {
+    const code = iban2.charCodeAt(i);
+    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+  }
+  return remainder === 1;
+}
+function isValidIBAN(input) {
+  if (!iban.test(input))
+    return false;
+  return isIso7064Mod97(input);
+}
 function isValidJWT(token, algorithm = null) {
   try {
     const tokensParts = token.split(".");
@@ -1542,7 +1555,7 @@ function handlePropertyResult(result, final, key, input, optin, optout) {
     return;
   }
   if (result.value === undefined) {
-    if (isPresent) {
+    if (isPresent || optin === "defaulted" && !isOptionalOut) {
       final.value[key] = undefined;
     }
   } else {
@@ -1569,14 +1582,20 @@ function normalizeDef(def) {
     optionalKeys: new Set(okeys)
   };
 }
-function handleCatchall(proms, input, payload, ctx, def, inst) {
+function handleCatchall(proms, input, payload, ctx, def, inst, abortEarly) {
   const unrecognized = [];
   const keySet = def.keySet;
   const _catchall = def.catchall._zod;
   const t = _catchall.def.type;
   const optin = _catchall.optin;
   const optout = _catchall.optout;
+  let seen = 0;
   for (const key in input) {
+    if (abortEarly && payload.issues.length !== seen) {
+      if (aborted(payload, seen))
+        break;
+      seen = payload.issues.length;
+    }
     if (keySet.has(key))
       continue;
     if (key === "__proto__") {
@@ -1630,6 +1649,24 @@ function handleUnionResults(results, final, inst, ctx) {
   });
   return final;
 }
+function discriminatorMap(def) {
+  const map = new Map;
+  for (const option of def.options) {
+    const values = option._zod.propValues?.[def.discriminator];
+    if (!values || values.size === 0)
+      throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(option)}"`);
+    for (const value of values) {
+      if (map.has(value)) {
+        if (value !== undefined)
+          throw new Error(`Duplicate discriminator value "${String(value)}"`);
+        map.set(value, null);
+      } else {
+        map.set(value, option);
+      }
+    }
+  }
+  return map;
+}
 function mergeValues(a, b) {
   if (a === b) {
     return { valid: true, data: a };
@@ -1793,11 +1830,10 @@ function handleRefineResult(result, payload, input, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-var $ZodType, toStandardResult = (r) => r.success ? { value: r.data } : { issues: r.error?.issues }, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT = 1, URL_UNPARSEABLE = 2, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodCIDRv4, $ZodCIDRv6, $ZodBase64, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodJWT, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodUnknown, $ZodNever, $ZodArray, NO_SYMBOL_KEYS, propShapes, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodDiscriminatedUnion, $ZodIntersection, $ZodRecord, $ZodEnum, $ZodLiteral, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodCatch, $ZodPipe, $ZodReadonly, $ZodCustom;
+var $ZodType, toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value }, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT = 1, URL_UNPARSEABLE = 2, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodJWT, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodUnknown, $ZodNever, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodDiscriminatedUnion, $ZodIntersection, $ZodRecord, $ZodEnum, $ZodLiteral, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodCatch, $ZodPipe, $ZodReadonly, $ZodCustom;
 var init_schemas = __esm(() => {
   init_checks();
   init_core();
-  init_parse();
   init_regexes();
   init_util();
   init_versions();
@@ -1912,7 +1948,7 @@ var init_schemas = __esm(() => {
   });
   $ZodString = /* @__PURE__ */ $constructor("$ZodString", (inst, def) => {
     $ZodType.init(inst, def);
-    inst._zod.pattern = [...inst?._zod.bag?.patterns ?? []].pop() ?? string(inst._zod.bag);
+    inst._zod.pattern = def.pattern ?? anyString;
     inst._zod.parse = (payload, _) => {
       if (def.coerce)
         try {
@@ -1967,7 +2003,7 @@ var init_schemas = __esm(() => {
     inst._zod.check = (payload) => {
       try {
         const trimmed = payload.value.trim();
-        const url = parseURLObject(trimmed, def);
+        const url = validateURL(trimmed, def);
         if (url === URL_BAD_FORMAT) {
           payload.issues.push({
             code: "invalid_format",
@@ -1989,6 +2025,10 @@ var init_schemas = __esm(() => {
           });
           return;
         }
+        if (url === true) {
+          payload.value = stripTabAndNewline(trimmed);
+          return;
+        }
         if (def.hostname && !urlHostnameOk(url, def.hostname)) {
           payload.issues.push({
             code: "invalid_format",
@@ -2057,12 +2097,6 @@ var init_schemas = __esm(() => {
   $ZodISODateTime = /* @__PURE__ */ $constructor("$ZodISODateTime", (inst, def) => {
     def.pattern ?? (def.pattern = datetime(def));
     $ZodStringFormat.init(inst, def);
-    if (def.local || def.precision === -1) {
-      inst._zod.bag.laxFormat = true;
-      inst._zod.onattach.push((s) => {
-        s._zod.bag.laxFormat = true;
-      });
-    }
   });
   $ZodISODate = /* @__PURE__ */ $constructor("$ZodISODate", (inst, def) => {
     def.pattern ?? (def.pattern = date);
@@ -2079,13 +2113,11 @@ var init_schemas = __esm(() => {
   $ZodIPv4 = /* @__PURE__ */ $constructor("$ZodIPv4", (inst, def) => {
     def.pattern ?? (def.pattern = ipv4);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.format = `ipv4`;
   });
   ipv6Alphabet = /^[0-9a-fA-F:.]+$/;
   $ZodIPv6 = /* @__PURE__ */ $constructor("$ZodIPv6", (inst, def) => {
     def.pattern ?? (def.pattern = ipv6);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.format = `ipv6`;
     inst._zod.check = (payload) => {
       if (!isValidIPv6(payload.value)) {
         payload.issues.push({
@@ -2117,10 +2149,10 @@ var init_schemas = __esm(() => {
       }
     };
   });
+  base64Charset = /^[0-9a-zA-Z+/]*={0,2}$/;
   $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
-    def.pattern ?? (def.pattern = base64);
+    def.pattern ?? (def.pattern = base64Charset);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.contentEncoding = "base64";
     inst._zod.check = (payload) => {
       if (isValidBase64(payload.value))
         return;
@@ -2133,10 +2165,10 @@ var init_schemas = __esm(() => {
       });
     };
   });
+  base64urlCharset = /^[A-Za-z0-9_-]*$/;
   $ZodBase64URL = /* @__PURE__ */ $constructor("$ZodBase64URL", (inst, def) => {
-    def.pattern ?? (def.pattern = base64url);
+    def.pattern ?? (def.pattern = base64urlCharset);
     $ZodStringFormat.init(inst, def);
-    inst._zod.bag.contentEncoding = "base64url";
     inst._zod.check = (payload) => {
       if (isValidBase64URL(payload.value))
         return;
@@ -2170,7 +2202,7 @@ var init_schemas = __esm(() => {
   });
   $ZodNumber = /* @__PURE__ */ $constructor("$ZodNumber", (inst, def) => {
     $ZodType.init(inst, def);
-    inst._zod.pattern = inst._zod.bag.pattern ?? number;
+    inst._zod.pattern = number;
     inst._zod.parse = (payload, _ctx) => {
       if (def.coerce)
         try {
@@ -2248,6 +2280,7 @@ var init_schemas = __esm(() => {
       }
       payload.value = memo ? memo.alloc(inst, payload, Array(input.length), ctx) : Array(input.length);
       const proms = [];
+      const abortEarly = ctx?.abortEarly;
       for (let i = 0;i < input.length; i++) {
         const item = input[i];
         const result = def.element._zod.run({
@@ -2258,6 +2291,8 @@ var init_schemas = __esm(() => {
           proms.push(result.then((result) => handleArrayResult(result, payload, i)));
         } else {
           handleArrayResult(result, payload, i);
+          if (abortEarly && result.issues.length !== 0 && aborted(result))
+            break;
         }
       }
       if (proms.length) {
@@ -2267,23 +2302,19 @@ var init_schemas = __esm(() => {
     };
   });
   NO_SYMBOL_KEYS = [];
-  propShapes = new WeakMap;
   $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     $ZodType.init(inst, def);
     const desc = Object.getOwnPropertyDescriptor(def, "shape");
-    if (!desc?.get) {
-      const sh = def.shape;
-      propShapes.set(def, sh);
-      Object.defineProperty(def, "shape", {
-        get: () => {
-          const newSh = { ...sh };
-          Object.defineProperty(def, "shape", {
-            value: newSh
-          });
-          propShapes.set(def, newSh);
-          return newSh;
-        }
-      });
+    const sh = desc?.get ? desc.get.raw : def.shape ?? {};
+    if (sh) {
+      const get = () => {
+        const newSh = { ...sh };
+        Object.defineProperty(def, "shape", { value: newSh });
+        get.raw = newSh;
+        return newSh;
+      };
+      get.raw = sh;
+      Object.defineProperty(def, "shape", { get });
     }
     const _normalized = cached(() => normalizeDef(def));
     defineLazyInternal(inst, "propValues", (zod) => {
@@ -2323,7 +2354,14 @@ var init_schemas = __esm(() => {
       payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};
       const proms = [];
       const shape = value.shape;
+      const abortEarly = ctx?.abortEarly;
+      let seen = payload.issues.length;
       for (const key of value.allKeys) {
+        if (abortEarly && payload.issues.length !== seen) {
+          if (aborted(payload, seen))
+            break;
+          seen = payload.issues.length;
+        }
         if (key === "__proto__")
           continue;
         const el = shape[key];
@@ -2339,7 +2377,7 @@ var init_schemas = __esm(() => {
       if (!catchall) {
         return proms.length ? Promise.all(proms).then(() => payload) : payload;
       }
-      return handleCatchall(proms, input, payload, ctx, _normalized.value, inst);
+      return handleCatchall(proms, input, payload, ctx, _normalized.value, inst, abortEarly === true);
     };
   });
   $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) => {
@@ -2353,10 +2391,16 @@ var init_schemas = __esm(() => {
       const doc = new Doc(["payload", "ctx"], { shape, inst, memo, syms });
       const parseStr = (k) => `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
       const prefixStr = (id, k) => `
+          let ${id}_ab = false;
           for (let i = 0; i < ${id}.issues.length; i++) {
             const iss = ${id}.issues[i];
             iss.path = iss.path ? [${k}, ...iss.path] : [${k}];
             payload.issues.push(iss);
+            if (iss.continue !== true) ${id}_ab = true;
+          }
+          if (${id}_ab && ctx && ctx.abortEarly) {
+            payload.value = newResult;
+            return payload;
           }`;
       doc.write(`const input = payload.value;`);
       const ids = Object.create(null);
@@ -2402,6 +2446,10 @@ var init_schemas = __esm(() => {
             input: undefined,
             path: [${k}]
           });
+          if (ctx && ctx.abortEarly) {
+            payload.value = newResult;
+            return payload;
+          }
         }
 
         if (${id}_present) {
@@ -2413,16 +2461,16 @@ var init_schemas = __esm(() => {
           doc.write(`
         if (${id}.issues.length) {${prefixStr(id, k)}
         }
-        
-        if (${id}.value === undefined) {
-          if (${isPresent}) {
-            newResult[${k}] = undefined;
-          }
-        } else {
+      `);
+          if (optin === "defaulted") {
+            doc.write(`newResult[${k}] = ${id}.value;`);
+          } else {
+            doc.write(`
+        if (${id}.value !== undefined || ${isPresent}) {
           newResult[${k}] = ${id}.value;
         }
-
       `);
+          }
         }
       }
       doc.write(`payload.value = newResult;`);
@@ -2454,7 +2502,7 @@ var init_schemas = __esm(() => {
         payload = fastpass(payload, ctx);
         if (!catchall)
           return payload;
-        return handleCatchall([], input, payload, ctx, value, inst);
+        return handleCatchall([], input, payload, ctx, value, inst, ctx?.abortEarly === true);
       }
       return superParse(payload, ctx);
     };
@@ -2510,10 +2558,13 @@ var init_schemas = __esm(() => {
     const _super = inst._zod.parse;
     defineLazyInternal(inst, "propValues", (zod) => {
       const propValues = {};
+      let undefinedCount = 0;
       for (const option of zod.def.options) {
         const pv = option._zod.propValues;
         if (!pv || Object.keys(pv).length === 0)
           throw new Error(`Invalid discriminated union option at index "${zod.def.options.indexOf(option)}"`);
+        if (pv[zod.def.discriminator]?.has(undefined))
+          undefinedCount++;
         for (const [k, v] of Object.entries(pv)) {
           if (!Object.prototype.hasOwnProperty.call(propValues, k)) {
             assignProp(propValues, k, new Set);
@@ -2523,30 +2574,17 @@ var init_schemas = __esm(() => {
           }
         }
       }
+      if (!zod.def.unionFallback && undefinedCount > 1)
+        propValues[zod.def.discriminator]?.delete(undefined);
       return propValues;
     });
     def.options.forEach((option, i) => {
-      const propShape = propShapes.get(option._zod.def);
+      const propShape = rawShape(option._zod.def);
       if (propShape && !Object.prototype.hasOwnProperty.call(propShape, def.discriminator)) {
         throw new Error(`Invalid discriminated union option at index "${i}"`);
       }
     });
-    const disc = cached(() => {
-      const opts = def.options;
-      const map = new Map;
-      for (const o of opts) {
-        const values = o._zod.propValues?.[def.discriminator];
-        if (!values || values.size === 0)
-          throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(o)}"`);
-        for (const v of values) {
-          if (map.has(v)) {
-            throw new Error(`Duplicate discriminator value "${String(v)}"`);
-          }
-          map.set(v, o);
-        }
-      }
-      return map;
-    });
+    const disc = cached(() => discriminatorMap(def));
     inst._zod.parse = (payload, ctx) => {
       const input = payload.value;
       if (!isObject(input)) {
@@ -2558,8 +2596,9 @@ var init_schemas = __esm(() => {
         });
         return payload;
       }
-      const opt = disc.value.get(input?.[def.discriminator]);
-      if (opt) {
+      const value = input?.[def.discriminator];
+      const opt = disc.value.get(value);
+      if (opt && (value !== undefined || ctx.direction !== "backward")) {
         return opt._zod.run(payload, ctx);
       }
       if (def.unionFallback || ctx.direction === "backward") {
@@ -2570,7 +2609,7 @@ var init_schemas = __esm(() => {
         errors: [],
         note: "No matching discriminator",
         discriminator: def.discriminator,
-        options: Array.from(disc.value.keys()),
+        options: Array.from(disc.value.keys()).filter((value) => disc.value.get(value) !== null),
         input,
         path: [def.discriminator],
         inst
@@ -2753,8 +2792,10 @@ var init_schemas = __esm(() => {
     const values = getEnumValues(def.entries);
     const valuesSet = new Set(values);
     inst._zod.values = valuesSet;
-    const patternValues = values.filter((k) => propertyKeyTypes.has(typeof k));
-    inst._zod.pattern = new RegExp(patternValues.length ? `^(${patternValues.map((o) => escapeRegex(o.toString())).join("|")})$` : "^[^\\s\\S]$");
+    defineLazyInternal(inst, "pattern", (zod) => {
+      const patternValues = getEnumValues(zod.def.entries).filter((k) => propertyKeyTypes.has(typeof k));
+      return new RegExp(patternValues.length ? `^(${patternValues.map((o) => escapeRegex(o.toString())).join("|")})$` : "^[^\\s\\S]$");
+    });
     inst._zod.parse = (payload, _ctx) => {
       const input = payload.value;
       if (valuesSet.has(input)) {
@@ -2773,7 +2814,10 @@ var init_schemas = __esm(() => {
     $ZodType.init(inst, def);
     const values = new Set(def.values);
     inst._zod.values = values;
-    inst._zod.pattern = new RegExp(def.values.length ? `^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$` : "^[^\\s\\S]$");
+    defineLazyInternal(inst, "pattern", (zod) => {
+      const vals = zod.def.values;
+      return new RegExp(vals.length ? `^(${vals.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$` : "^[^\\s\\S]$");
+    });
     inst._zod.parse = (payload, _ctx) => {
       const input = payload.value;
       if (values.has(input)) {
@@ -2980,27 +3024,49 @@ var init_schemas = __esm(() => {
 });
 
 // node_modules/zod/v4/core/memoizer.js
+function isRef(value) {
+  return value !== null && typeof value === "object";
+}
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack) {
+function isRecursive(inst, stack, resolve) {
   const cached = recursive.get(inst);
   if (cached !== undefined)
-    return cached;
+    return cached ? PROVEN : NONE;
   if (stack.has(inst))
-    return true;
+    return PROVEN;
   stack.add(inst);
-  let result = false;
+  let result = NONE;
   const check = (child) => {
-    if (!result && child?._zod && isRecursive(child, stack))
-      result = true;
+    if (result !== PROVEN && child?._zod) {
+      const answer = isRecursive(child, stack, resolve);
+      if (answer > result)
+        result = answer;
+    }
+  };
+  const shape = (sh, spread) => {
+    let answer = NONE;
+    for (const key of Reflect.ownKeys(sh)) {
+      const desc = Object.getOwnPropertyDescriptor(sh, key);
+      if (spread && !desc.enumerable)
+        continue;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve) : NONE;
+      if (child > answer)
+        answer = child;
+    }
+    return answer;
+  };
+  const merge = (answer) => {
+    if (answer > result)
+      result = answer;
   };
   const def = inst._zod.def;
   const kind = def.type;
   switch (kind) {
     case "object": {
-      for (const key of Reflect.ownKeys(def.shape))
-        check(def.shape[key]);
+      const raw = rawShape(def);
+      merge(raw ? shape(raw, true) : ASSUMED);
       check(def.catchall);
       break;
     }
@@ -3047,9 +3113,11 @@ function isRecursive(inst, stack) {
       check(def.input);
       check(def.output);
       break;
-    case "lazy":
-      check(inst._zod.innerType);
+    case "lazy": {
+      const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : undefined);
+      merge(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
+    }
     case "template_literal":
     case "string":
     case "number":
@@ -3088,16 +3156,20 @@ function isRecursive(inst, stack) {
     }
   }
   stack.delete(inst);
-  recursive.set(inst, result);
-  return result;
+  return settle(inst, result);
+}
+function settle(inst, answer) {
+  if (answer !== ASSUMED)
+    recursive.set(inst, answer === PROVEN);
+  return answer;
 }
 function isRecursiveSchema(inst) {
-  return isRecursive(inst, new Set);
+  return isRecursive(inst, new Set, true) !== NONE;
 }
 function bucketFor(state, inst) {
   let bucket = state.buckets.get(inst);
   if (!bucket) {
-    bucket = new Map;
+    bucket = new WeakMap;
     state.buckets.set(inst, bucket);
   }
   return bucket;
@@ -3107,10 +3179,11 @@ function memoizer() {
 }
 function isBackEdge(ctx, value) {
   const backEdges = ctx[STATE]?.backEdges;
-  return backEdges !== undefined && value !== null && typeof value === "object" && backEdges.has(value);
+  return backEdges !== undefined && isRef(value) && backEdges.has(value);
 }
-var $ZodCyclicError, STATE = "~memo", NO_ISSUES, recursive, handoff, open, memo;
+var $ZodCyclicError, STATE = "~memo", NO_ISSUES, recursive, NONE = 0, ASSUMED = 1, PROVEN = 2, handoff, open, memo;
 var init_memoizer = __esm(() => {
+  init_util();
   $ZodCyclicError = class $ZodCyclicError extends Error {
     constructor() {
       super(`Cannot parse a reference cycle that closes through a transform`);
@@ -3149,6 +3222,7 @@ var init_memoizer = __esm(() => {
     attach(inst) {
       var _a;
       let isRecursiveInst;
+      let rechecked = false;
       let lastCtx;
       let lastBucket;
       (_a = inst._zod).deferred ?? (_a.deferred = []);
@@ -3156,20 +3230,24 @@ var init_memoizer = __esm(() => {
         const base = inst._zod.parse;
         const wrapped = (payload, ctx) => {
           if (isRecursiveInst === undefined) {
-            isRecursiveInst = isRecursive(inst, new Set);
-            if (!isRecursiveInst) {
+            const walked = isRecursive(inst, new Set, false);
+            if (walked === NONE) {
               inst._zod.parse = base;
               if (inst._zod.run === wrapped)
                 inst._zod.run = base;
               return base(payload, ctx);
             }
+            if (walked === PROVEN || rechecked)
+              isRecursiveInst = true;
+            else
+              rechecked = true;
           }
           const input = payload.value;
-          if (input === null || typeof input !== "object")
+          if (!isRef(input))
             return base(payload, ctx);
           let state = ctx[STATE];
           if (!state) {
-            state = { buckets: new Map, backEdges: undefined };
+            state = { buckets: new WeakMap, backEdges: undefined };
             ctx[STATE] = state;
           }
           let bucket;
@@ -3188,7 +3266,7 @@ var init_memoizer = __esm(() => {
                 payload.issues.push(...cloneIssues(hit.issues));
             } else {
               payload.memo = true;
-              state.backEdges ?? (state.backEdges = new Set);
+              state.backEdges ?? (state.backEdges = new WeakSet);
               state.backEdges.add(hit.value);
             }
             return payload;
@@ -3262,7 +3340,9 @@ var error = () => {
     base64url: "base64url-encoded string",
     json_string: "JSON string",
     e164: "E.164 number",
+    currency_code: "currency code",
     credit_card: "credit card number",
+    iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
   };
@@ -3405,38 +3485,46 @@ function compileValidator(schema, parser) {
 function compile(schema, options) {
   try {
     const parser = compileFn(schema);
-    const clone2 = clone(schema);
-    const liveRun = schema._zod.run;
-    const originalRun = liveRun.__originalRun ?? liveRun;
-    const wrapped = (payload, ctx) => {
-      if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks || ctx?.[FALLBACK_FLAG]) {
-        return originalRun(payload, ctx);
-      }
-      if (ctx && isBackEdge(ctx, payload.value)) {
-        return originalRun(payload, ctx);
-      }
-      const out = parser(payload.value);
-      if (out !== INVALID) {
-        payload.value = out;
-        return payload;
-      }
-      if (ctx)
-        ctx[FALLBACK_FLAG] = true;
-      return originalRun(payload, ctx);
-    };
-    wrapped.__originalRun = originalRun;
-    clone2._zod.bag.fallbackRun = originalRun;
-    clone2._zod.bag.validator = compileValidator(schema, parser);
-    clone2._zod.run = wrapped;
-    if (!liveRun.__originalRun)
-      installCompiledUserMethods(clone2, schema, parser);
-    return clone2;
+    const clone = withParser(schema, parser);
+    clone._zod.bag.validator = compileValidator(schema, parser);
+    return clone;
   } catch (err) {
     if (options?.strict)
       throw err;
     return schema;
   }
 }
+function withParser(schema, parser) {
+  if (isRecursiveSchema(schema)) {
+    throw new ZodCompileUnsupportedError("a schema whose subtree contains a reference cycle");
+  }
+  const clone2 = clone(schema);
+  const liveRun = schema._zod.run;
+  const originalRun = liveRun.__originalRun ?? liveRun;
+  const wrapped = (payload, ctx) => {
+    if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks || ctx?.[FALLBACK_FLAG]) {
+      return originalRun(payload, ctx);
+    }
+    if (ctx && isBackEdge(ctx, payload.value)) {
+      return originalRun(payload, ctx);
+    }
+    const out = parser(payload.value);
+    if (out !== INVALID) {
+      payload.value = out;
+      return payload;
+    }
+    if (ctx)
+      ctx[FALLBACK_FLAG] = true;
+    return originalRun(payload, ctx);
+  };
+  wrapped.__originalRun = originalRun;
+  clone2._zod.bag.fallbackRun = originalRun;
+  clone2._zod.bag.validator = parser;
+  clone2._zod.run = wrapped;
+  if (!liveRun.__originalRun)
+    installCompiledUserMethods(clone2, schema, parser);
+  return clone2;
+}
 function installCompiledUserMethods(target, source, parser) {
   const targetAny = target;
   const sourceAny = source;
@@ -3472,7 +3560,8 @@ function compileFn(schema, options) {
   const ctx = {
     constants: new Map,
     constantCounter: 0,
-    varCounter: 0
+    varCounter: 0,
+    definite: true
   };
   const doc = new Doc(["input"]);
   const outputAccessor = generateCheck(doc, ctx, schema, "input", !options?.assertOnly);
@@ -3497,6 +3586,7 @@ ${code}
   if (options?.debug) {
     fn.code = fullCode;
   }
+  fn.definite = ctx.definite;
   return fn;
 }
 function addConstant(ctx, value) {
@@ -3508,6 +3598,10 @@ function addConstant(ctx, value) {
   ctx.constants.set(name, value);
   return name;
 }
+function addUserConstant(ctx, fn) {
+  ctx.definite = false;
+  return addConstant(ctx, fn);
+}
 function newVar(ctx) {
   return `v${ctx.varCounter++}`;
 }
@@ -3540,6 +3634,7 @@ function compileChild(doc, ctx, schema, accessor, needsValue = true) {
   }
 }
 function emitRuntimeIsland(doc, ctx, schema, accessor) {
+  ctx.definite = false;
   const schemaConst = addConstant(ctx, schema);
   const runConst = addConstant(ctx, runtimeRun);
   const outVar = newVar(ctx);
@@ -3612,6 +3707,9 @@ function generateChecks(doc, ctx, schema, accessor) {
       case "property":
         generatePropertyCheck(doc, ctx, def, currentAccessor);
         break;
+      case "properties":
+        generatePropertiesChecks(doc, ctx, def, currentAccessor);
+        break;
       case "overwrite": {
         const newAccessor = newVar(ctx);
         generateOverwriteCheck(doc, ctx, check, currentAccessor, newAccessor);
@@ -3717,6 +3815,19 @@ function generateMimeTypeCheck(doc, ctx, def, accessor) {
     doc.write(`if (!${mimeSet}.has(${accessor}.type)) return INVALID;`);
   }
 }
+function generatePropertiesChecks(doc, ctx, def, accessor) {
+  if (def.when) {
+    throw new ZodCompileUnsupportedError(`check with a custom "when" condition`);
+  }
+  doc.write(`if (${accessor} == null) return INVALID;`);
+  const shape = def.shape;
+  for (const key of Reflect.ownKeys(shape)) {
+    const keyExpr = typeof key === "symbol" ? addConstant(ctx, key) : esc(key);
+    const inputVar = newVar(ctx);
+    doc.write(`const ${inputVar} = ${accessor}[${keyExpr}];`);
+    compileChild(doc, ctx, shape[key], inputVar, false);
+  }
+}
 function generatePropertyCheck(doc, ctx, def, accessor) {
   const propAccessor = `${accessor}[${JSON.stringify(def.property)}]`;
   generateCheck(doc, ctx, def.schema, propAccessor);
@@ -3744,7 +3855,7 @@ function generateCustomRefineCheck(doc, ctx, check, accessor) {
     if (isAsyncFunction(def.fn)) {
       throw new ZodCompileAsyncError("z.compile: async .refine() predicates are not supported");
     }
-    const fnConst = addConstant(ctx, def.fn);
+    const fnConst = addUserConstant(ctx, def.fn);
     const throwAsyncConst = addConstant(ctx, throwAsync);
     const resVar = newVar(ctx);
     doc.write(`const ${resVar} = ${fnConst}(${accessor});`);
@@ -3764,7 +3875,7 @@ function generateCustomRefineCheck(doc, ctx, check, accessor) {
         throwAsync();
       return fakePayload.issues.length === 0 ? fakePayload.value : INVALID;
     };
-    const helperConst = addConstant(ctx, helperFn);
+    const helperConst = addUserConstant(ctx, helperFn);
     const outVar = newVar(ctx);
     doc.write(`const ${outVar} = ${helperConst}(${accessor});`);
     doc.write(`if (${outVar} === INVALID) return INVALID;`);
@@ -3772,7 +3883,7 @@ function generateCustomRefineCheck(doc, ctx, check, accessor) {
   }
   throw new ZodCompileUnsupportedError("custom check without a predicate or check function");
 }
-function generateStringFormatCheck(doc, ctx, def, accessor) {
+function generateStringFormatCheck(doc, ctx, def, accessor, needsValue = true) {
   const fmt = def.format;
   if (fmt === "base64") {
     const validator = addConstant(ctx, isValidBase64);
@@ -3805,9 +3916,14 @@ function generateStringFormatCheck(doc, ctx, def, accessor) {
     doc.write(`if (!${validator}(${accessor})) return INVALID;`);
     return accessor;
   }
+  if (fmt === "iban") {
+    const validator = addConstant(ctx, isValidIBAN);
+    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
+    return accessor;
+  }
   const formatDef = def;
   if (fmt === "url" || fmt === "httpurl" || formatDef.normalize || formatDef.hostname !== undefined || formatDef.protocol !== undefined) {
-    const parseConst = addConstant(ctx, parseURLObject);
+    const parseConst = addConstant(ctx, validateURL);
     const defConst = addConstant(ctx, def);
     const trimVar = newVar(ctx);
     const urlVar = newVar(ctx);
@@ -3822,6 +3938,8 @@ function generateStringFormatCheck(doc, ctx, def, accessor) {
       const protocolConst = addConstant(ctx, urlProtocolOk);
       doc.write(`if (!${protocolConst}(${urlVar}, ${defConst}.protocol)) return INVALID;`);
     }
+    if (!needsValue)
+      return null;
     const outputVar = newVar(ctx);
     const outputExpr = formatDef.normalize ? `${urlVar}.href` : `${addConstant(ctx, stripTabAndNewline)}(${trimVar})`;
     doc.write(`const ${outputVar} = ${outputExpr};`);
@@ -3880,7 +3998,7 @@ function generateCheck(doc, ctx, schema, accessor, needsValue = true) {
   let typeAccessor;
   switch (type) {
     case "string":
-      typeAccessor = generateStringCheck(doc, ctx, schema, accessor);
+      typeAccessor = generateStringCheck(doc, ctx, schema, accessor, buildsValue);
       break;
     case "number":
       typeAccessor = generateNumberCheck(doc, schema, accessor);
@@ -4000,12 +4118,12 @@ function generateCheck(doc, ctx, schema, accessor, needsValue = true) {
     return null;
   return generateChecks(doc, ctx, schema, typeAccessor);
 }
-function generateStringCheck(doc, ctx, schema, accessor) {
+function generateStringCheck(doc, ctx, schema, accessor, needsValue = true) {
   doc.write(`if (typeof ${accessor} !== "string") return INVALID;`);
   const def = schema._zod.def;
   if (def.format === undefined)
     return accessor;
-  return generateStringFormatCheck(doc, ctx, def, accessor);
+  return generateStringFormatCheck(doc, ctx, def, accessor, needsValue);
 }
 function generateNumberCheck(doc, schema, accessor) {
   doc.write(`if (typeof ${accessor} !== "number" || !Number.isFinite(${accessor})) return INVALID;`);
@@ -4123,7 +4241,7 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
     }
   }
   const outputVar = newVar(ctx);
-  const hasConditionalKeys = allKeys.some((k) => mayOutputUndefined(propShape[k]) || dropsWhenAbsent(propShape[k]));
+  const hasConditionalKeys = allKeys.some((k) => mayOmitUndefined(propShape[k]) || dropsWhenAbsent(propShape[k]));
   if (!buildsValue) {
     if (unknownKeysMode === "schema") {
       const knownSet = keys.length > 0 ? addConstant(ctx, new Set(keys)) : null;
@@ -4150,7 +4268,7 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
       const out = propOutputs.get(k);
       if (dropsWhenAbsent(propShape[k])) {
         doc.write(`if (${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
-      } else if (mayOutputUndefined(propShape[k])) {
+      } else if (mayOmitUndefined(propShape[k])) {
         doc.write(`if (${out} !== undefined || ${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
       } else {
         doc.write(`${outputVar}[${kx}] = ${out};`);
@@ -4283,6 +4401,9 @@ function fastPathAcceptsAbsence(schema) {
 function dropsWhenAbsent(schema) {
   return schema._zod.optin === "optional" && schema._zod.optout === "optional";
 }
+function mayOmitUndefined(schema) {
+  return (schema._zod.optin !== "defaulted" || schema._zod.optout === "optional") && mayOutputUndefined(schema);
+}
 function mayOutputUndefined(schema) {
   const def = schema._zod.def;
   switch (def.type) {
@@ -4625,6 +4746,7 @@ function literalEquality(ctx, accessor, value) {
 }
 function generateIntersectionCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
+  ctx.definite = false;
   const leftOutput = compileChild(doc, ctx, def.left, accessor);
   const rightOutput = compileChild(doc, ctx, def.right, accessor);
   const mergeConst = addConstant(ctx, mergeValues);
@@ -4678,14 +4800,13 @@ function generateRecordCheck(doc, ctx, schema, accessor) {
   const keyIsBareString = keyDef.type === "string" && keyDef.format === undefined && !keyDef.coerce && (keyDef.checks?.length ?? 0) === 0;
   if (!keyIsBareString) {
     const isLoose = def.mode === "loose";
-    const keyFast = addConstant(ctx, compileFn(def.keyType));
+    const keyFn = compileFn(def.keyType);
+    if (keyFn.definite === false)
+      ctx.definite = false;
+    const keyFast = addConstant(ctx, keyFn);
     const numericConst = addConstant(ctx, number);
-    const propIsEnumerableConst = addConstant(ctx, Object.prototype.propertyIsEnumerable);
     const outKeyVar = newVar(ctx);
-    doc.write(`for (const ${kVar} of Reflect.ownKeys(${accessor})) {`);
-    doc.indented((d) => {
-      d.write(`if (${kVar} === "__proto__") continue;`);
-      d.write(`if (!${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
+    emitOwnKeys(doc, ctx, accessor, kVar, (d) => {
       d.write(`let ${outKeyVar} = ${keyFast}(${kVar});`);
       d.write(`if (${outKeyVar} === INVALID && typeof ${kVar} === "string" && ${numericConst}.test(${kVar})) ${outKeyVar} = ${keyFast}(Number(${kVar}));`);
       if (isLoose) {
@@ -4699,21 +4820,39 @@ function generateRecordCheck(doc, ctx, schema, accessor) {
       const valOutput = compileChild(d, ctx, def.valueType, valueVar);
       d.write(`${outputVar}[${outKeyVar}] = ${valOutput};`);
     });
-    doc.write(`}`);
     return outputVar;
   }
-  const propIsEnumerable = addConstant(ctx, Object.prototype.propertyIsEnumerable);
-  doc.write(`for (const ${kVar} of Reflect.ownKeys(${accessor})) {`);
-  doc.indented((d) => {
-    d.write(`if (${kVar} === "__proto__") continue;`);
-    d.write(`if (!${propIsEnumerable}.call(${accessor}, ${kVar})) continue;`);
-    d.write(`if (typeof ${kVar} !== "string") return INVALID;`);
+  emitOwnKeys(doc, ctx, accessor, kVar, (d) => {
     d.write(`const ${valVar} = ${accessor}[${kVar}];`);
     const valOutput = compileChild(d, ctx, def.valueType, valVar);
     d.write(`${outputVar}[${kVar}] = ${valOutput};`);
+  }, `return INVALID;`);
+  return outputVar;
+}
+function emitOwnKeys(doc, ctx, accessor, kVar, body, onSymbol) {
+  const propIsEnumerableConst = addConstant(ctx, Object.prototype.propertyIsEnumerable);
+  const symsVar = newVar(ctx);
+  const keysVar = newVar(ctx);
+  const iVar = newVar(ctx);
+  doc.write(`const ${symsVar} = Object.getOwnPropertySymbols(${accessor});`);
+  doc.write(`const ${keysVar} = Object.getOwnPropertyNames(${accessor});`);
+  doc.write(`for (let ${iVar} = 0; ${iVar} < ${keysVar}.length; ${iVar}++) {`);
+  doc.indented((d) => {
+    d.write(`const ${kVar} = ${keysVar}[${iVar}];`);
+    d.write(`if (${kVar} === "__proto__" || !${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
+    body(d);
+  });
+  doc.write(`}`);
+  doc.write(`for (let ${iVar} = 0; ${iVar} < ${symsVar}.length; ${iVar}++) {`);
+  doc.indented((d) => {
+    d.write(`const ${kVar} = ${symsVar}[${iVar}];`);
+    d.write(`if (!${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
+    if (onSymbol)
+      d.write(onSymbol);
+    else
+      body(d);
   });
   doc.write(`}`);
-  return outputVar;
 }
 function literalPropertyKey(ctx, key) {
   if (typeof key === "string")
@@ -4766,7 +4905,7 @@ function generateTemplateLiteralCheck(doc, ctx, schema, accessor) {
 }
 function generateLazyCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
-  const getterConst = addConstant(ctx, def.getter);
+  const getterConst = addUserConstant(ctx, def.getter);
   const cacheConst = addConstant(ctx, { parser: null });
   doc.write(`if (!${cacheConst}.parser) {`);
   doc.indented((d) => {
@@ -4799,7 +4938,7 @@ function generatePipeCheck(doc, ctx, schema, accessor) {
         return INVALID;
       return fakePayload.issues.length === 0 ? result : INVALID;
     };
-    const helperConst = addConstant(ctx, helperFn);
+    const helperConst = addUserConstant(ctx, helperFn);
     const transformedVar = newVar(ctx);
     doc.write(`const ${transformedVar} = ${helperConst}(${inputOutput});`);
     doc.write(`if (${transformedVar} === INVALID) return INVALID;`);
@@ -4817,7 +4956,7 @@ function generateCustomCheck(doc, ctx, schema, accessor) {
     if (isAsyncFunction(def.fn)) {
       throw new ZodCompileAsyncError("z.compile: async custom predicates are not supported");
     }
-    const fnConst = addConstant(ctx, def.fn);
+    const fnConst = addUserConstant(ctx, def.fn);
     const throwAsyncConst = addConstant(ctx, throwAsync);
     const resVar = newVar(ctx);
     doc.write(`const ${resVar} = ${fnConst}(${accessor});`);
@@ -4850,7 +4989,7 @@ function generateCatchCheck(doc, ctx, schema, accessor) {
   });
   doc.write(`})();`);
   const innerConst = addConstant(ctx, def.innerType);
-  const catchConst = addConstant(ctx, def.catchValue);
+  const catchConst = addUserConstant(ctx, def.catchValue);
   const catchHelperConst = addConstant(ctx, runtimeCatch);
   doc.write(`if (${outputVar} === INVALID) {`);
   doc.indented((d) => {
@@ -4874,7 +5013,7 @@ function generateTransformCheck(doc, ctx, schema, accessor) {
         return INVALID;
       return fakePayload.issues.length === 0 ? result : INVALID;
     };
-    const helperConst = addConstant(ctx, helperFn);
+    const helperConst = addUserConstant(ctx, helperFn);
     const outputVar = newVar(ctx);
     doc.write(`const ${outputVar} = ${helperConst}(${accessor});`);
     doc.write(`if (${outputVar} === INVALID) return INVALID;`);
@@ -4941,11 +5080,13 @@ var init_compile = __esm(() => {
 });
 
 // node_modules/zod/v4/core/api.js
+function snapshotChecks(def) {
+  if (def.checks)
+    def.checks = [...def.checks];
+  return def;
+}
 function _string(Class, params) {
-  return new Class({
-    type: "string",
-    ...normalizeParams(params)
-  });
+  return new Class(snapshotChecks({ type: "string", ...normalizeParams(params) }));
 }
 function _email(Class, params) {
   return new Class({
@@ -5185,11 +5326,7 @@ function _isoDuration(Class, params) {
   });
 }
 function _number(Class, params) {
-  return new Class({
-    type: "number",
-    checks: [],
-    ...normalizeParams(params)
-  });
+  return new Class(snapshotChecks({ type: "number", checks: [], ...normalizeParams(params) }));
 }
 function _int(Class, params) {
   return new Class({
@@ -5450,7 +5587,7 @@ function handleUnrepresentable(schema, ctx, json, params, message) {
   Object.assign(json, result);
   return true;
 }
-function process2(schema, ctx, _params = { path: [], schemaPath: [] }) {
+function processSchema(schema, ctx, _params = { path: [], schemaPath: [] }) {
   var _a;
   const def = schema._zod.def;
   const seen = ctx.seen.get(schema);
@@ -5489,7 +5626,7 @@ function process2(schema, ctx, _params = { path: [], schemaPath: [] }) {
     if (parent) {
       if (!result.ref)
         result.ref = parent;
-      process2(parent, ctx, params);
+      processSchema(parent, ctx, params);
       ctx.seen.get(parent).isParent = true;
     }
   }
@@ -5594,7 +5731,6 @@ function extractDefs(ctx, schema) {
     if (seen.count > 1) {
       if (ctx.reused === "ref") {
         extractToDef(entry);
-        continue;
       }
     }
   }
@@ -5917,13 +6053,13 @@ function isTransforming(_schema, _ctx) {
 }
 var FOLDABLE_KEYS, UNION_KEYS, createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
   const ctx = initializeContext({ ...params, processors });
-  process2(schema, ctx);
+  processSchema(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 }, createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
   const { libraryOptions, target } = params ?? {};
   const ctx = initializeContext({ ...libraryOptions ?? {}, target, io, processors });
-  process2(schema, ctx);
+  processSchema(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
@@ -5935,6 +6071,34 @@ var init_to_json_schema = __esm(() => {
 });
 
 // node_modules/zod/v4/core/json-schema-processors.js
+function aggregateChecks(schema) {
+  const agg = {};
+  const def = schema._zod.def;
+  const list = schema._zod.traits.has("$ZodCheck") ? [schema, ...def.checks ?? []] : def.checks ?? [];
+  for (const ch of list)
+    contributors[ch._zod.def.check]?.(agg, ch._zod.def);
+  const bag = schema._zod.bag;
+  if (bag.minimum !== undefined)
+    narrowMin(agg, "minimum", bag.minimum);
+  if (bag.exclusiveMinimum !== undefined)
+    narrowMin(agg, "exclusiveMinimum", bag.exclusiveMinimum);
+  if (bag.maximum !== undefined)
+    narrowMax(agg, "maximum", bag.maximum);
+  if (bag.exclusiveMaximum !== undefined)
+    narrowMax(agg, "exclusiveMaximum", bag.exclusiveMaximum);
+  if (bag.multipleOf !== undefined)
+    addDivisor(agg, bag.multipleOf);
+  if (bag.format !== undefined) {
+    agg.format ?? (agg.format = bag.format);
+    if (bag.format.includes("int"))
+      agg.isInt = true;
+  }
+  if (bag.mime)
+    intersectMime(agg, bag.mime);
+  for (const pattern of bag.patterns ?? [])
+    addPattern(agg, pattern);
+  return agg;
+}
 function inputOptin(schema) {
   const def = schema._zod.def;
   if (def.type === "pipe" && def.in._zod.traits.has("$ZodTransform")) {
@@ -6020,10 +6184,37 @@ function serializeDefaultValue(value, schema, ctx, json, params) {
   handleUnrepresentable(schema, ctx, json, params, "BigInt defaults cannot be represented in JSON Schema");
   return UNREPRESENTABLE_DEFAULT;
 }
-var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
+var narrowMin = (agg, key, value) => {
+  if (agg[key] === undefined || value > agg[key])
+    agg[key] = value;
+}, narrowMax = (agg, key, value) => {
+  if (agg[key] === undefined || value < agg[key])
+    agg[key] = value;
+}, narrowBoth = (agg, value) => {
+  narrowMin(agg, "minimum", value);
+  narrowMax(agg, "maximum", value);
+}, addDivisor = (agg, value) => {
+  agg.multipleOf ?? (agg.multipleOf = []);
+  if (!agg.multipleOf.includes(value))
+    agg.multipleOf.push(value);
+}, addPattern = (agg, pattern) => {
+  agg.patterns ?? (agg.patterns = new Set);
+  agg.patterns.add(pattern);
+}, intersectMime = (agg, mime) => {
+  agg.mime = agg.mime ? agg.mime.filter((m) => mime.includes(m)) : [...mime];
+}, setFormat = (agg, format) => {
+  agg.format = format;
+  if (format.includes("int"))
+    agg.isInt = true;
+}, minContributor = (agg, def) => narrowMin(agg, "minimum", def.minimum), maxContributor = (agg, def) => narrowMax(agg, "maximum", def.maximum), formatContributor = (ranges) => (agg, def) => {
+  setFormat(agg, def.format);
+  const [minimum, maximum] = ranges[def.format];
+  narrowMin(agg, "minimum", minimum);
+  narrowMax(agg, "maximum", maximum);
+}, contributors, formatMap, exactPatterns, exactPattern = (p) => exactPatterns.get(p) ?? p, stringProcessor = (schema, ctx, _json, _params) => {
   const json = _json;
   json.type = "string";
-  const { minimum, maximum, format, patterns, contentEncoding, laxFormat } = schema._zod.bag;
+  const { minimum, maximum, format, patterns, contentEncoding, laxFormat } = aggregateChecks(schema);
   if (typeof minimum === "number")
     json.minLength = minimum;
   if (typeof maximum === "number")
@@ -6039,7 +6230,7 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   if (contentEncoding)
     json.contentEncoding = contentEncoding;
   if (patterns && patterns.size > 0) {
-    const patternList = [...patterns];
+    const patternList = [...patterns].map(exactPattern);
     if (patternList.length === 1)
       json.pattern = patternList[0].source;
     else if (patternList.length > 1) {
@@ -6053,11 +6244,8 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   }
 }, numberProcessor = (schema, ctx, _json, params) => {
   const json = _json;
-  const { minimum, maximum, format, multipleOf, exclusiveMaximum, exclusiveMinimum } = schema._zod.bag;
-  if (typeof format === "string" && format.includes("int"))
-    json.type = "integer";
-  else
-    json.type = "number";
+  const { minimum, maximum, multipleOf, exclusiveMaximum, exclusiveMinimum, isInt } = aggregateChecks(schema);
+  json.type = isInt ? "integer" : "number";
   const exMin = typeof exclusiveMinimum === "number" && exclusiveMinimum >= (minimum ?? Number.NEGATIVE_INFINITY);
   const exMax = typeof exclusiveMaximum === "number" && exclusiveMaximum <= (maximum ?? Number.POSITIVE_INFINITY);
   const legacy = ctx.target === "draft-04" || ctx.target === "openapi-3.0";
@@ -6081,11 +6269,19 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   } else if (typeof maximum === "number") {
     json.maximum = maximum;
   }
-  if (typeof multipleOf === "number") {
-    if (Number.isFinite(multipleOf) && multipleOf !== 0)
-      json.multipleOf = Math.abs(multipleOf);
-    else
-      handleUnrepresentable(schema, ctx, json, params, `A multipleOf divisor of ${multipleOf} cannot be represented in JSON Schema`);
+  if (multipleOf) {
+    const divisors = new Set;
+    for (const divisor of multipleOf) {
+      if (Number.isFinite(divisor) && divisor !== 0)
+        divisors.add(Math.abs(divisor));
+      else
+        handleUnrepresentable(schema, ctx, json, params, `A multipleOf divisor of ${divisor} cannot be represented in JSON Schema`);
+    }
+    const [first, ...rest] = divisors;
+    if (first !== undefined)
+      json.multipleOf = first;
+    if (rest.length)
+      json.allOf = [...json.allOf ?? [], ...rest.map((m) => ({ multipleOf: m }))];
   }
 }, booleanProcessor = (_schema, _ctx, json, _params) => {
   json.type = "boolean";
@@ -6148,13 +6344,13 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
 }, arrayProcessor = (schema, ctx, _json, params) => {
   const json = _json;
   const def = schema._zod.def;
-  const { minimum, maximum } = schema._zod.bag;
+  const { minimum, maximum } = aggregateChecks(schema);
   if (typeof minimum === "number")
     json.minItems = minimum;
   if (typeof maximum === "number")
     json.maxItems = maximum;
   json.type = "array";
-  json.items = process2(def.element, ctx, {
+  json.items = processSchema(def.element, ctx, {
     ...params,
     path: [...params.path, "items"]
   });
@@ -6169,22 +6365,20 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   json.type = "object";
   json.properties = {};
   for (const key in shape) {
-    assignProp(json.properties, key, process2(shape[key], ctx, {
+    assignProp(json.properties, key, processSchema(shape[key], ctx, {
       ...params,
       path: [...params.path, "properties", key]
     }));
   }
-  const allKeys = new Set(Object.keys(shape));
-  const requiredKeys = new Set([...allKeys].filter((key) => {
+  const requiredKeys = [];
+  for (const key of Object.keys(shape)) {
     const field = def.shape[key];
-    if (ctx.io === "input") {
-      return inputOptin(field) === undefined;
-    } else {
-      return field._zod.optout === undefined;
+    if (ctx.io === "input" ? inputOptin(field) === undefined : field._zod.optout === undefined) {
+      requiredKeys.push(key);
     }
-  }));
-  if (requiredKeys.size > 0) {
-    json.required = Array.from(requiredKeys);
+  }
+  if (requiredKeys.length > 0) {
+    json.required = requiredKeys;
   }
   if (def.catchall?._zod.def.type === "never") {
     json.additionalProperties = false;
@@ -6192,7 +6386,7 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
     if (ctx.io === "output")
       json.additionalProperties = false;
   } else if (def.catchall) {
-    json.additionalProperties = process2(def.catchall, ctx, {
+    json.additionalProperties = processSchema(def.catchall, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
@@ -6200,7 +6394,7 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
 }, unionProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
   const isExclusive = def.inclusive === false;
-  const options = def.options.map((x, i) => process2(x, ctx, {
+  const options = def.options.map((x, i) => processSchema(x, ctx, {
     ...params,
     path: [...params.path, isExclusive ? "oneOf" : "anyOf", i]
   }));
@@ -6211,11 +6405,11 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   }
 }, intersectionProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
-  const a = process2(def.left, ctx, {
+  const a = processSchema(def.left, ctx, {
     ...params,
     path: [...params.path, "allOf", 0]
   });
-  const b = process2(def.right, ctx, {
+  const b = processSchema(def.right, ctx, {
     ...params,
     path: [...params.path, "allOf", 1]
   });
@@ -6231,20 +6425,19 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   const def = schema._zod.def;
   json.type = "object";
   const keyType = def.keyType;
-  const keyBag = keyType._zod.bag;
-  const patterns = keyBag?.patterns;
+  const patterns = aggregateChecks(keyType).patterns;
   if (def.mode === "loose" && patterns && patterns.size > 0) {
-    const valueSchema = process2(def.valueType, ctx, {
+    const valueSchema = processSchema(def.valueType, ctx, {
       ...params,
       path: [...params.path, "patternProperties", "*"]
     });
     json.patternProperties = {};
     for (const pattern of patterns) {
-      assignProp(json.patternProperties, pattern.source, valueSchema);
+      assignProp(json.patternProperties, exactPattern(pattern).source, valueSchema);
     }
   } else {
     if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") {
-      json.propertyNames = process2(def.keyType, ctx, {
+      json.propertyNames = processSchema(def.keyType, ctx, {
         ...params,
         path: [...params.path, "propertyNames"]
       });
@@ -6256,7 +6449,7 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
       }
       pending.push(schema);
     }
-    json.additionalProperties = process2(def.valueType, ctx, {
+    json.additionalProperties = processSchema(def.valueType, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
@@ -6271,7 +6464,7 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   }
 }, nullableProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
-  const inner = process2(def.innerType, ctx, params);
+  const inner = processSchema(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   if (ctx.target === "openapi-3.0") {
     seen.ref = def.innerType;
@@ -6281,12 +6474,12 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   }
 }, nonoptionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process2(def.innerType, ctx, params);
+  processSchema(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 }, UNREPRESENTABLE_DEFAULT, defaultProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
-  process2(def.innerType, ctx, params);
+  processSchema(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   const value = serializeDefaultValue(def.defaultValue, schema, ctx, json, params);
@@ -6294,7 +6487,7 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
     json.default = value;
 }, prefaultProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
-  process2(def.innerType, ctx, params);
+  processSchema(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   if (ctx.io !== "input")
@@ -6304,7 +6497,7 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
     json._prefault = value;
 }, catchProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
-  process2(def.innerType, ctx, params);
+  processSchema(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   let catchValue;
@@ -6319,25 +6512,49 @@ var formatMap, stringProcessor = (schema, ctx, _json, _params) => {
   const def = schema._zod.def;
   const inIsTransform = def.in._zod.traits.has("$ZodTransform");
   const innerType = ctx.io === "input" ? inIsTransform ? def.out : def.in : def.out;
-  process2(innerType, ctx, params);
+  processSchema(innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 }, readonlyProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
-  process2(def.innerType, ctx, params);
+  processSchema(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   json.readOnly = true;
 }, optionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process2(def.innerType, ctx, params);
+  processSchema(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
 var init_json_schema_processors = __esm(() => {
   init_regexes();
+  init_schemas();
   init_to_json_schema();
   init_util();
+  contributors = {
+    greater_than: (agg, def) => narrowMin(agg, def.inclusive ? "minimum" : "exclusiveMinimum", def.value),
+    less_than: (agg, def) => narrowMax(agg, def.inclusive ? "maximum" : "exclusiveMaximum", def.value),
+    multiple_of: (agg, def) => addDivisor(agg, def.value),
+    number_format: formatContributor(NUMBER_FORMAT_RANGES),
+    bigint_format: formatContributor(BIGINT_FORMAT_RANGES),
+    min_length: minContributor,
+    max_length: maxContributor,
+    length_equals: (agg, def) => narrowBoth(agg, def.length),
+    min_size: minContributor,
+    max_size: maxContributor,
+    size_equals: (agg, def) => narrowBoth(agg, def.size),
+    string_format: (agg, def) => {
+      setFormat(agg, def.format);
+      if (def.pattern)
+        addPattern(agg, def.pattern);
+      if (def.format === "base64" || def.format === "base64url")
+        agg.contentEncoding = def.format;
+      if (def.local || def.precision === -1)
+        agg.laxFormat = true;
+    },
+    mime_type: (agg, def) => intersectMime(agg, def.mime)
+  };
   formatMap = {
     guid: "uuid",
     url: "uri",
@@ -6345,6 +6562,10 @@ var init_json_schema_processors = __esm(() => {
     json_string: "json-string",
     regex: ""
   };
+  exactPatterns = new Map([
+    [base64Charset, base64],
+    [base64urlCharset, base64url]
+  ]);
   pendingRecords = new WeakMap;
   UNREPRESENTABLE_DEFAULT = Symbol();
 });
@@ -6427,14 +6648,15 @@ var init_errors2 = __esm(() => {
 });
 
 // node_modules/zod/v4/classic/parse.js
-var parse3, parseAsync2, safeParse2, safeParseAsync2, encode, decode, encodeAsync, decodeAsync, safeEncode, safeDecode, safeEncodeAsync, safeDecodeAsync;
+var parse2, parseAsync, safeParse, safeParseAsync, encode, decode, encodeAsync, decodeAsync, safeEncode, safeDecode, safeEncodeAsync, safeDecodeAsync;
 var init_parse2 = __esm(() => {
   init_core2();
   init_errors2();
-  parse3 = /* @__PURE__ */ _parse(ZodRealError);
-  parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
-  safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
-  safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
+  init_core2();
+  parse2 = /* @__PURE__ */ _parse(ZodRealError);
+  parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
+  safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
+  safeParseAsync = /* @__PURE__ */ _safeParseAsync(ZodRealError);
   encode = /* @__PURE__ */ _encode(ZodRealError);
   decode = /* @__PURE__ */ _decode(ZodRealError);
   encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
@@ -6737,16 +6959,16 @@ var init_schemas2 = __esm(() => {
       own(this, "~standard", value);
     },
     parse: function _parse(data, params) {
-      return parse3(this, data, params, { callee: _parse });
+      return parse2(this, data, params, { callee: _parse });
     },
     parseAsync: async function _parseAsync(data, params) {
-      return await parseAsync2(this, data, params, { callee: _parseAsync });
+      return await parseAsync(this, data, params, { callee: _parseAsync });
     },
     safeParse(data, params) {
-      return safeParse2(this, data, params);
+      return safeParse(this, data, params);
     },
     async safeParseAsync(data, params) {
-      return safeParseAsync2(this, data, params);
+      return safeParseAsync(this, data, params);
     },
     get spa() {
       return this?.safeParseAsync;
@@ -6754,6 +6976,12 @@ var init_schemas2 = __esm(() => {
     set spa(value) {
       own(this, "spa", value);
     },
+    validate(data, params) {
+      return validate(this, data, params);
+    },
+    validateAsync(data, params) {
+      return validateAsync(this, data, params);
+    },
     encode: function _encode(data, params) {
       return encode(this, data, params, { callee: _encode });
     },
@@ -6792,10 +7020,10 @@ var init_schemas2 = __esm(() => {
     $ZodString.init(inst, def);
     ZodType.init(inst, def);
     inst._zod.processJSONSchema = (ctx, json, params) => stringProcessor(inst, ctx, json, params);
-    const bag = inst._zod.bag;
-    inst.format = bag.format ?? null;
-    inst.minLength = bag.minimum ?? null;
-    inst.maxLength = bag.maximum ?? null;
+  }, /* @__PURE__ */ derived({
+    format: (inst) => aggregateChecks(inst).format ?? null,
+    minLength: (inst) => aggregateChecks(inst).minimum ?? null,
+    maxLength: (inst) => aggregateChecks(inst).maximum ?? null
   }, {
     regex(...args) {
       return this.check(_regex(...args));
@@ -6842,7 +7070,7 @@ var init_schemas2 = __esm(() => {
     slugify() {
       return this.check(_slugify());
     }
-  });
+  }));
   ZodString = /* @__PURE__ */ $constructor("ZodString", (inst, def) => {
     $ZodString.init(inst, def);
     _ZodString.init(inst, def);
@@ -7026,12 +7254,21 @@ var init_schemas2 = __esm(() => {
     $ZodNumber.init(inst, def);
     ZodType.init(inst, def);
     inst._zod.processJSONSchema = (ctx, json, params) => numberProcessor(inst, ctx, json, params);
-    const bag = inst._zod.bag;
-    inst.minValue = Math.max(bag.minimum ?? Number.NEGATIVE_INFINITY, bag.exclusiveMinimum ?? Number.NEGATIVE_INFINITY) ?? null;
-    inst.maxValue = Math.min(bag.maximum ?? Number.POSITIVE_INFINITY, bag.exclusiveMaximum ?? Number.POSITIVE_INFINITY) ?? null;
-    inst.isInt = (bag.format ?? "").includes("int") || Number.isSafeInteger(bag.multipleOf ?? 0.5);
     inst.isFinite = true;
-    inst.format = bag.format ?? null;
+  }, /* @__PURE__ */ derived({
+    minValue: (inst) => {
+      const { minimum, exclusiveMinimum } = aggregateChecks(inst);
+      return Math.max(minimum ?? Number.NEGATIVE_INFINITY, exclusiveMinimum ?? Number.NEGATIVE_INFINITY);
+    },
+    maxValue: (inst) => {
+      const { maximum, exclusiveMaximum } = aggregateChecks(inst);
+      return Math.min(maximum ?? Number.POSITIVE_INFINITY, exclusiveMaximum ?? Number.POSITIVE_INFINITY);
+    },
+    isInt: (inst) => {
+      const { isInt, multipleOf } = aggregateChecks(inst);
+      return !!isInt || !!multipleOf?.some(Number.isSafeInteger);
+    },
+    format: (inst) => aggregateChecks(inst).format ?? null
   }, {
     gt(value, params) {
       return this.check(_gt(value, params));
@@ -7078,7 +7315,7 @@ var init_schemas2 = __esm(() => {
     finite() {
       return this;
     }
-  });
+  }));
   ZodNumberFormat = /* @__PURE__ */ $constructor("ZodNumberFormat", (inst, def) => {
     $ZodNumberFormat.init(inst, def);
     ZodNumber.init(inst, def);
@@ -7132,19 +7369,19 @@ var init_schemas2 = __esm(() => {
       return _enum(Object.keys(this._zod.def.shape));
     },
     catchall(catchall) {
-      return this.clone({ ...this._zod.def, catchall });
+      return this.clone(mergeDefs(this._zod.def, { catchall }));
     },
     passthrough() {
-      return this.clone({ ...this._zod.def, catchall: unknown() });
+      return this.clone(mergeDefs(this._zod.def, { catchall: unknown() }));
     },
     loose() {
-      return this.clone({ ...this._zod.def, catchall: unknown() });
+      return this.clone(mergeDefs(this._zod.def, { catchall: unknown() }));
     },
     strict() {
-      return this.clone({ ...this._zod.def, catchall: never() });
+      return this.clone(mergeDefs(this._zod.def, { catchall: never() }));
     },
     strip() {
-      return this.clone({ ...this._zod.def, catchall: undefined });
+      return this.clone(mergeDefs(this._zod.def, { catchall: undefined }));
     },
     extend(incoming) {
       return extend(this, incoming);
@@ -7199,7 +7436,7 @@ var init_schemas2 = __esm(() => {
     ZodType.init(inst, def);
     inst._zod.processJSONSchema = (ctx, json, params) => enumProcessor(inst, ctx, json, params);
     inst.enum = def.entries;
-    inst.options = Object.values(def.entries);
+    inst.options = [...inst._zod.values];
     const keys = new Set(Object.keys(def.entries));
     inst.extract = (values, params) => {
       const newEntries = {};
@@ -7380,7 +7617,7 @@ var init_zod = __esm(() => {
 import { createHash, randomUUID } from "node:crypto";
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
-    return failure("unsupported_version", "unsupported schema version", { operation: family });
+    return failure2("unsupported_version", "unsupported schema version", { operation: family });
   const compiled = compiledOperationSchemas[family].safeParse(input);
   const parsed = compiled.success ? operationSchemas[family].safeParse(input) : compiled;
   if (parsed.success)
@@ -7389,7 +7626,7 @@ function parseOperation(family, input) {
     path: issue.code === "unrecognized_keys" ? issue.keys.join(".") : issue.path.join("."),
     reason: issue.message
   }));
-  return failure("invalid_input", "operation input is invalid", { fields });
+  return failure2("invalid_input", "operation input is invalid", { fields });
 }
 function canonical(value, seen) {
   if (value === null || typeof value === "boolean" || typeof value === "string") {
@@ -7421,7 +7658,7 @@ function canonical(value, seen) {
       throw new TypeError("symbol key is not JSON");
     if (Object.keys(value).some((key) => invalidUnicode(key)))
       throw new TypeError("invalid Unicode");
-    result = Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key], seen)]));
+    result = Object.fromEntries(Object.keys(value).toSorted().map((key) => [key, canonical(value[key], seen)]));
   }
   seen.delete(value);
   return result;
@@ -7452,14 +7689,14 @@ function decisionDigest(input) {
 function candidateDigest(input) {
   const normalizedScope = {
     description: input.scope.description,
-    paths: [...input.scope.paths].sort(compareCodeUnits),
-    exclusions: [...input.scope.exclusions].sort(compareCodeUnits)
+    paths: [...input.scope.paths].toSorted(compareCodeUnits),
+    exclusions: [...input.scope.exclusions].toSorted(compareCodeUnits)
   };
   return sha256({
     scope: normalizedScope,
     completeness: input.completeness,
-    files: [...input.files].sort((left, right) => compareCodeUnits(left.path, right.path) || compareCodeUnits(left.kind, right.kind) || compareNullableText(left.digest, right.digest) || compareBooleanNullable(left.executable, right.executable)),
-    environment: input.environment.map(({ name, value }) => ({ name, value })).sort((left, right) => compareCodeUnits(left.name, right.name) || compareNullableText(left.value, right.value)),
+    files: [...input.files].toSorted((left, right) => compareCodeUnits(left.path, right.path) || compareCodeUnits(left.kind, right.kind) || compareNullableText(left.digest, right.digest) || compareBooleanNullable(left.executable, right.executable)),
+    environment: input.environment.map(({ name, value }) => ({ name, value })).toSorted((left, right) => compareCodeUnits(left.name, right.name) || compareNullableText(left.value, right.value)),
     head: input.head
   });
 }
@@ -7468,8 +7705,8 @@ function requirementId(input) {
     ...input,
     scope: {
       description: input.scope.description,
-      paths: [...input.scope.paths].sort(compareCodeUnits),
-      exclusions: [...input.scope.exclusions].sort(compareCodeUnits)
+      paths: [...input.scope.paths].toSorted(compareCodeUnits),
+      exclusions: [...input.scope.exclusions].toSorted(compareCodeUnits)
     }
   });
 }
@@ -7593,7 +7830,7 @@ var SCHEMA_VERSION = 1, POLICY_VERSION = "1.0.0", OPERATION_FAMILIES, uuidPatter
   revision: revisionValue,
   workspaceRevision: workspaceRevisionValue,
   data
-}), failure = (code, error, details = {}) => ({ ok: false, schemaVersion: 1, code, error, details }), compareCodeUnits = (left, right) => {
+}), failure2 = (code, error, details = {}) => ({ ok: false, schemaVersion: 1, code, error, details }), compareCodeUnits = (left, right) => {
   const length = Math.min(left.length, right.length);
   for (let index = 0;index < length; index += 1) {
     const difference = left.charCodeAt(index) - right.charCodeAt(index);
@@ -8908,18 +9145,18 @@ class TaskStore {
   }
   readTask(taskId) {
     if (!validId(taskId))
-      return failure("invalid_input", "task ID is invalid", { taskId });
+      return failure2("invalid_input", "task ID is invalid", { taskId });
     const result = this.readRecord(path4.join(this.tasksDir, `${taskId}.json`), taskRecordSchema);
     if (!result.exists)
-      return failure("not_found", "task not found", { taskId });
+      return failure2("not_found", "task not found", { taskId });
     if (result.result.ok && result.result.data.id !== taskId)
-      return failure("recovery_required", "task filename and record ID differ", { taskId });
+      return failure2("recovery_required", "task filename and record ID differ", { taskId });
     if (result.result.ok) {
       const workspace = this.readWorkspace();
       if (!workspace.ok)
         return workspace;
       if (!workspace.data || result.result.data.workspaceId !== workspace.data.id)
-        return failure("recovery_required", "task workspace binding is invalid", { taskId });
+        return failure2("recovery_required", "task workspace binding is invalid", { taskId });
     }
     return result.result;
   }
@@ -8930,7 +9167,7 @@ class TaskStore {
     try {
       names = fs4.readdirSync(this.tasksDir).filter((name) => name.endsWith(".json"));
     } catch (error) {
-      return failure("storage_error", `unable to list tasks: ${String(error)}`, {
+      return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
         path: this.tasksDir
       });
     }
@@ -8938,20 +9175,20 @@ class TaskStore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("recovery_required", "task workspace binding is invalid", {
+      return failure2("recovery_required", "task workspace binding is invalid", {
         path: this.workspacePath
       });
     const tasks = [];
-    for (const name of names.sort()) {
+    for (const name of names.toSorted()) {
       const item = this.readRecord(path4.join(this.tasksDir, name), taskRecordSchema);
       if (!item.exists)
         continue;
       if (!item.result.ok)
         return item.result;
       if (!validId(name.slice(0, -5)) || item.result.data.id !== name.slice(0, -5))
-        return failure("recovery_required", "task filename and record ID differ", { path: name });
+        return failure2("recovery_required", "task filename and record ID differ", { path: name });
       if (item.result.data.workspaceId !== workspace.data.id)
-        return failure("recovery_required", "task workspace binding is invalid", { path: name });
+        return failure2("recovery_required", "task workspace binding is invalid", { path: name });
       tasks.push(item.result.data);
     }
     return success(null, null, tasks);
@@ -8963,7 +9200,7 @@ class TaskStore {
     try {
       names = fs4.readdirSync(this.tasksDir).filter((name) => name.endsWith(".json"));
     } catch (error) {
-      return failure("storage_error", `unable to list tasks: ${String(error)}`, {
+      return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
         path: this.tasksDir
       });
     }
@@ -8971,13 +9208,13 @@ class TaskStore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("recovery_required", "task workspace binding is invalid", {
+      return failure2("recovery_required", "task workspace binding is invalid", {
         path: this.workspacePath
       });
     const stored = this.readIndex(workspace.data.id);
     const entries = [];
     let changed = Object.keys(stored).length !== names.length;
-    for (const name of names.sort()) {
+    for (const name of names.toSorted()) {
       const file = path4.join(this.tasksDir, name);
       const signature = fileSignature(file);
       if (signature === null) {
@@ -8995,9 +9232,9 @@ class TaskStore {
       if (!item.result.ok)
         return item.result;
       if (!validId(name.slice(0, -5)) || item.result.data.id !== name.slice(0, -5))
-        return failure("recovery_required", "task filename and record ID differ", { path: name });
+        return failure2("recovery_required", "task filename and record ID differ", { path: name });
       if (item.result.data.workspaceId !== workspace.data.id)
-        return failure("recovery_required", "task workspace binding is invalid", { path: name });
+        return failure2("recovery_required", "task workspace binding is invalid", { path: name });
       const entry = indexEntry(item.result.data, signature);
       if (!cached || canonicalJson(cached) !== canonicalJson(entry))
         changed = true;
@@ -9012,7 +9249,7 @@ class TaskStore {
     if (!item.exists)
       return success(null, null, null);
     if (item.result.ok && item.result.data.root !== this.root && !sameDirectoryIdentity(item.result.data.root, this.root))
-      return failure("recovery_required", "workspace root binding is invalid", {
+      return failure2("recovery_required", "workspace root binding is invalid", {
         path: this.workspacePath
       });
     return item.result;
@@ -9028,18 +9265,18 @@ class TaskStore {
       if (!current.ok)
         return current;
       if (current.data ? value.expectedWorkspaceRevision !== current.data.revision : value.expectedWorkspaceRevision !== null) {
-        return failure("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
+        return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
           expectedWorkspaceRevision: value.expectedWorkspaceRevision,
           actualWorkspaceRevision: current.data?.revision ?? null
         });
       }
       if (!value.provenance)
-        return failure("invalid_input", "provenance is required");
+        return failure2("invalid_input", "provenance is required");
       if (!intentSchema.safeParse(value.intent).success || !provenanceSchema.safeParse(value.provenance).success)
-        return failure("invalid_input", "task intent or provenance is invalid");
+        return failure2("invalid_input", "task intent or provenance is invalid");
       const previousWorkspaceBytes = current.data ? this.snapshotBytes(this.workspacePath) : null;
       if (current.data && !previousWorkspaceBytes)
-        return failure("storage_error", "workspace snapshot disappeared during creation");
+        return failure2("storage_error", "workspace snapshot disappeared during creation");
       const workspace = current.data ? {
         ...current.data,
         revision: newRevision(),
@@ -9090,9 +9327,9 @@ class TaskStore {
         if (current.data && previousWorkspaceBytes) {
           const restored = this.replaceSnapshot(this.workspacePath, current.data, this.snapshotBytes(this.workspacePath));
           if (!restored.ok)
-            return failure("external_outcome_unknown", "task creation failed and workspace restoration is uncertain", { operation: "create", outcome: "unknown" });
+            return failure2("external_outcome_unknown", "task creation failed and workspace restoration is uncertain", { operation: "create", outcome: "unknown" });
         }
-        return failure("external_outcome_unknown", "workspace created but task write is uncertain", { operation: "create", outcome: "unknown" });
+        return failure2("external_outcome_unknown", "workspace created but task write is uncertain", { operation: "create", outcome: "unknown" });
       }
       return success(task.revision, workspace.revision, task);
     });
@@ -9110,29 +9347,29 @@ class TaskStore {
             return success(source.data.revision, current.data.revision, source.data);
           if (source.code !== "not_found")
             return source;
-          return failure("not_found", "source task is not present in this shared workspace");
+          return failure2("not_found", "source task is not present in this shared workspace");
         }
         const tasks = this.listTasks();
         if (!tasks.ok)
           return tasks;
         const prior = tasks.data.filter((task) => task.origin?.workspaceId === origin.workspaceId && task.origin?.taskId === origin.taskId);
         if (prior.length > 1)
-          return failure("recovery_required", `source task has multiple imported mappings: ${prior.map((task) => task.id).join(", ")}`);
+          return failure2("recovery_required", `source task has multiple imported mappings: ${prior.map((task) => task.id).join(", ")}`);
         if (prior.length === 1) {
           const existing = prior[0];
           if (existing.origin.exportDigest !== origin.exportDigest)
-            return failure("revision_conflict", "source task export changed; reconcile the mapped destination task before importing", { taskId: existing.id });
+            return failure2("revision_conflict", "source task export changed; reconcile the mapped destination task before importing", { taskId: existing.id });
           return success(existing.revision, current.data.revision, existing);
         }
       }
       if (current.data ? input.expectedWorkspaceRevision !== current.data.revision : input.expectedWorkspaceRevision !== null)
-        return failure("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
+        return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
           expectedWorkspaceRevision: input.expectedWorkspaceRevision,
           actualWorkspaceRevision: current.data?.revision ?? null
         });
       const previousWorkspaceBytes = current.data ? this.snapshotBytes(this.workspacePath) : null;
       if (current.data && !previousWorkspaceBytes)
-        return failure("storage_error", "workspace snapshot disappeared during import");
+        return failure2("storage_error", "workspace snapshot disappeared during import");
       const timestamp = input.now ?? now();
       const workspace = current.data ? {
         ...current.data,
@@ -9160,7 +9397,7 @@ class TaskStore {
       };
       const validTask = taskRecordSchema.safeParse(task);
       if (!validTask.success)
-        return failure("invalid_input", "imported task does not satisfy its schema");
+        return failure2("invalid_input", "imported task does not satisfy its schema");
       const writtenWorkspace = this.replaceSnapshot(this.workspacePath, workspace, previousWorkspaceBytes);
       if (!writtenWorkspace.ok)
         return writtenWorkspace;
@@ -9169,9 +9406,9 @@ class TaskStore {
         if (current.data && previousWorkspaceBytes) {
           const restored = this.replaceSnapshot(this.workspacePath, current.data, this.snapshotBytes(this.workspacePath));
           if (!restored.ok)
-            return failure("external_outcome_unknown", "import failed and workspace restoration is uncertain", { operation: "import", outcome: "unknown" });
+            return failure2("external_outcome_unknown", "import failed and workspace restoration is uncertain", { operation: "import", outcome: "unknown" });
         }
-        return failure("external_outcome_unknown", `workspace created but task import is uncertain: ${writtenTask.error}`, {
+        return failure2("external_outcome_unknown", `workspace created but task import is uncertain: ${writtenTask.error}`, {
           operation: "import",
           outcome: "unknown",
           path: writtenTask.details.path
@@ -9189,13 +9426,13 @@ class TaskStore {
         return this.conflict(expected, current.data.revision);
       const previousBytes = this.snapshotBytes(this.taskPath(taskId));
       if (!previousBytes)
-        return failure("storage_error", "task snapshot disappeared during mutation");
+        return failure2("storage_error", "task snapshot disappeared during mutation");
       const context = { now: timestamp ?? now(), revision: newRevision() };
       let changed;
       try {
         changed = update(current.data, Object.freeze({ ...context }));
       } catch (error) {
-        return failure("storage_error", `task mutation failed: ${String(error)}`);
+        return failure2("storage_error", `task mutation failed: ${String(error)}`);
       }
       if (!changed.ok)
         return changed;
@@ -9210,7 +9447,7 @@ class TaskStore {
       };
       const valid = taskRecordSchema.safeParse(record);
       if (!valid.success)
-        return failure("invalid_input", "task mutation produced an invalid record");
+        return failure2("invalid_input", "task mutation produced an invalid record");
       const written = this.replaceSnapshot(this.taskPath(taskId), valid.data, previousBytes);
       return written.ok ? success(valid.data.revision, null, valid.data) : written;
     });
@@ -9221,18 +9458,18 @@ class TaskStore {
       if (!current.ok)
         return current;
       if (!current.data)
-        return failure("not_found", "workspace not found");
+        return failure2("not_found", "workspace not found");
       if (current.data.revision !== expected)
         return this.conflict(expected, current.data.revision);
       const previousBytes = this.snapshotBytes(this.workspacePath);
       if (!previousBytes)
-        return failure("storage_error", "workspace snapshot disappeared during mutation");
+        return failure2("storage_error", "workspace snapshot disappeared during mutation");
       const context = { now: now(), revision: newRevision() };
       let changed;
       try {
         changed = update(current.data, Object.freeze({ ...context }));
       } catch (error) {
-        return failure("storage_error", `workspace mutation failed: ${String(error)}`);
+        return failure2("storage_error", `workspace mutation failed: ${String(error)}`);
       }
       if (!changed.ok)
         return changed;
@@ -9245,7 +9482,7 @@ class TaskStore {
       };
       const valid = workspaceRecordSchema.safeParse(record);
       if (!valid.success)
-        return failure("invalid_input", "workspace mutation produced an invalid record");
+        return failure2("invalid_input", "workspace mutation produced an invalid record");
       const written = this.replaceSnapshot(this.workspacePath, valid.data, previousBytes);
       return written.ok ? success(valid.data.revision, valid.data.revision, valid.data) : written;
     });
@@ -9259,10 +9496,10 @@ class TaskStore {
       if (!workspace.ok)
         return workspace;
       if (!workspace.data)
-        return failure("not_found", "workspace not found");
+        return failure2("not_found", "workspace not found");
       const expected = input.expectedRevision;
       if (!expected)
-        return failure("invalid_input", "task revision is required");
+        return failure2("invalid_input", "task revision is required");
       if (task.data.revision !== expected)
         return this.conflict(expected, task.data.revision);
       if (workspace.data.revision !== input.expectedWorkspaceRevision)
@@ -9270,13 +9507,13 @@ class TaskStore {
       const previousWorkspaceBytes = this.snapshotBytes(this.workspacePath);
       const previousTaskBytes = this.snapshotBytes(this.taskPath(input.taskId));
       if (!previousWorkspaceBytes || !previousTaskBytes)
-        return failure("storage_error", "snapshot disappeared during coupled mutation");
+        return failure2("storage_error", "snapshot disappeared during coupled mutation");
       const workspaceContext = { now: input.now ?? now(), revision: newRevision() };
       let changedWorkspace;
       try {
         changedWorkspace = input.workspace(workspace.data, Object.freeze({ ...workspaceContext }));
       } catch (error) {
-        return failure("storage_error", `workspace mutation failed: ${String(error)}`);
+        return failure2("storage_error", `workspace mutation failed: ${String(error)}`);
       }
       if (!changedWorkspace.ok)
         return changedWorkspace;
@@ -9288,7 +9525,7 @@ class TaskStore {
         runtime: stampNew(workspace.data)
       });
       if (!nextWorkspace.success)
-        return failure("invalid_input", "workspace mutation produced an invalid record");
+        return failure2("invalid_input", "workspace mutation produced an invalid record");
       const reserved = this.replaceSnapshot(this.workspacePath, nextWorkspace.data, previousWorkspaceBytes);
       if (!reserved.ok)
         return reserved;
@@ -9298,11 +9535,11 @@ class TaskStore {
         changedTask = input.task(task.data, Object.freeze({ ...taskContext }));
       } catch (error) {
         this.markUncertain(nextWorkspace.data);
-        return failure("external_outcome_unknown", `workspace reserved but task mutation threw: ${String(error)}`, { operation: "coupled_mutation", outcome: "unknown" });
+        return failure2("external_outcome_unknown", `workspace reserved but task mutation threw: ${String(error)}`, { operation: "coupled_mutation", outcome: "unknown" });
       }
       if (!changedTask.ok) {
         this.markUncertain(nextWorkspace.data);
-        return failure("external_outcome_unknown", "workspace reserved but task update is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
+        return failure2("external_outcome_unknown", "workspace reserved but task update is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
       }
       const nextTask = taskRecordSchema.safeParse({
         ...changedTask.data,
@@ -9315,12 +9552,12 @@ class TaskStore {
       });
       if (!nextTask.success) {
         this.markUncertain(nextWorkspace.data);
-        return failure("external_outcome_unknown", "workspace reserved but task update is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
+        return failure2("external_outcome_unknown", "workspace reserved but task update is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
       }
       const written = this.replaceSnapshot(this.taskPath(input.taskId), nextTask.data, previousTaskBytes);
       if (!written.ok) {
         this.markUncertain(nextWorkspace.data);
-        return failure("external_outcome_unknown", "workspace reserved but task replacement is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
+        return failure2("external_outcome_unknown", "workspace reserved but task replacement is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
       }
       return success(nextTask.data.revision, nextWorkspace.data.revision, {
         task: nextTask.data,
@@ -9344,7 +9581,7 @@ class TaskStore {
       }
       return success(null, null, candidates);
     } catch (error) {
-      return failure("storage_error", `unable to list recovery: ${String(error)}`, {
+      return failure2("storage_error", `unable to list recovery: ${String(error)}`, {
         path: this.recoveryDir
       });
     }
@@ -9357,11 +9594,11 @@ class TaskStore {
   }
   recover(target, taskId, input) {
     if (taskId !== null && !validId(taskId))
-      return failure("invalid_input", "task ID is invalid", { taskId });
+      return failure2("invalid_input", "task ID is invalid", { taskId });
     if (!input.reason || !Array.isArray(input.authorityRefs) || typeof input.processEvidence !== "function" || !validDigest(input.expectedBytes) || !validDigest(input.snapshotDigest))
-      return failure("invalid_input", "recovery authority is invalid");
+      return failure2("invalid_input", "recovery authority is invalid");
     if (input.authorityRefs.some((ref) => !refSchema.safeParse(ref).success))
-      return failure("invalid_input", "recovery references are invalid");
+      return failure2("invalid_input", "recovery references are invalid");
     try {
       const workspace = this.readWorkspace();
       if (!workspace.ok && target === "task")
@@ -9372,14 +9609,14 @@ class TaskStore {
       const file = target === "workspace" ? this.workspacePath : this.taskPath(taskId);
       const currentBytes = this.snapshotBytes(file);
       if (!currentBytes)
-        return failure("not_found", "snapshot not found");
+        return failure2("not_found", "snapshot not found");
       if (digestBytes(currentBytes) !== input.expectedBytes)
-        return failure("revision_conflict", "snapshot bytes do not match expected bytes");
+        return failure2("revision_conflict", "snapshot bytes do not match expected bytes");
       let selectedBytes = currentBytes;
       if (digestBytes(currentBytes) !== input.snapshotDigest) {
         const candidate = this.findRecovery(target, taskId, input.snapshotDigest, workspaceValue);
         if (!candidate)
-          return failure("recovery_required", "validated recovery snapshot not found");
+          return failure2("recovery_required", "validated recovery snapshot not found");
         selectedBytes = candidate;
       }
       const selectedRecord = target === "workspace" ? this.parseBytes(selectedBytes, workspaceRecordSchema) : this.parseBytes(selectedBytes, taskRecordSchema);
@@ -9388,11 +9625,11 @@ class TaskStore {
       if (target === "workspace") {
         const parsed = selectedRecord;
         if (!parsed.ok || parsed.data.root !== this.root)
-          return failure("recovery_required", "workspace recovery binding is invalid");
+          return failure2("recovery_required", "workspace recovery binding is invalid");
       } else {
         const parsed = selectedRecord;
         if (!parsed.ok || parsed.data.id !== taskId || !workspaceValue || parsed.data.workspaceId !== workspaceValue.id)
-          return failure("recovery_required", "task recovery binding is invalid");
+          return failure2("recovery_required", "task recovery binding is invalid");
       }
       const lock = this.readLockSnapshot();
       if (!lock.ok)
@@ -9402,28 +9639,28 @@ class TaskStore {
       if (!evidence.ok)
         return evidence;
       if (lock.data && (evidence.data.pid !== lock.data.data.pid || evidence.data.processStart !== lock.data.data.processStart))
-        return failure("recovery_required", "process evidence does not match metadata lock");
+        return failure2("recovery_required", "process evidence does not match metadata lock");
       if (writer && (evidence.data.state !== "accounted_for" || evidence.data.ownerDigest !== sha256(canonicalJson(writer))))
-        return failure("recovery_required", "workspace writer is not accounted for");
+        return failure2("recovery_required", "workspace writer is not accounted for");
       const recoveryGate = { reclaimed: false };
       const result = this.withLock((handle) => {
         if (lock.data && !recoveryGate.reclaimed)
-          return failure("recovery_required", "metadata lock changed during recovery", {
+          return failure2("recovery_required", "metadata lock changed during recovery", {
             path: this.lockPath
           });
         if (!handle.verifyStillHeld())
-          return failure("recovery_required", "metadata lock was compromised", {
+          return failure2("recovery_required", "metadata lock was compromised", {
             path: this.lockPath
           });
         const reacquiredBytes = this.snapshotBytes(file);
         if (!reacquiredBytes)
-          return failure("recovery_required", "snapshot disappeared during recovery");
+          return failure2("recovery_required", "snapshot disappeared during recovery");
         if (digestBytes(reacquiredBytes) !== input.expectedBytes)
-          return failure("revision_conflict", "snapshot changed during recovery");
+          return failure2("revision_conflict", "snapshot changed during recovery");
         if (target === "task") {
           const currentWorkspace = this.readWorkspace();
           if (!currentWorkspace.ok || !currentWorkspace.data)
-            return failure("recovery_required", "workspace changed during recovery");
+            return failure2("recovery_required", "workspace changed during recovery");
           if (currentWorkspace.data.revision !== input.expectedWorkspaceRevision)
             return this.conflict(input.expectedWorkspaceRevision, currentWorkspace.data.revision);
         }
@@ -9449,7 +9686,7 @@ class TaskStore {
       }, this.recoveryLockOptions(lock.data, evidence.data, recoveryGate));
       return result;
     } catch (error) {
-      return failure("recovery_required", `recovery protocol failed: ${String(error)}`);
+      return failure2("recovery_required", `recovery protocol failed: ${String(error)}`);
     }
   }
   processEvidence(input, lock, writer) {
@@ -9460,15 +9697,15 @@ class TaskStore {
     try {
       const result = input.processEvidence(lockCopy, writerCopy);
       if (lockCopy && sha256(canonicalJson(lockCopy)) !== lockDigest)
-        return failure("recovery_required", "process evidence mutated lock identity");
+        return failure2("recovery_required", "process evidence mutated lock identity");
       if (writerCopy && sha256(canonicalJson(writerCopy)) !== writerDigest)
-        return failure("recovery_required", "process evidence mutated writer identity");
+        return failure2("recovery_required", "process evidence mutated writer identity");
       if (!result.ok)
         return result;
       const parsed = processEvidenceSchema.safeParse(result.data);
-      return parsed.success ? success(null, null, parsed.data) : failure("recovery_required", "process evidence is invalid");
+      return parsed.success ? success(null, null, parsed.data) : failure2("recovery_required", "process evidence is invalid");
     } catch (error) {
-      return failure("recovery_required", `process evidence failed: ${String(error)}`);
+      return failure2("recovery_required", `process evidence failed: ${String(error)}`);
     }
   }
   deepFreeze(value) {
@@ -9483,7 +9720,7 @@ class TaskStore {
     try {
       const stat = fs4.lstatSync(this.lockPath);
       if (!stat.isFile() || stat.isSymbolicLink())
-        return failure("recovery_required", "metadata lock is not a regular file", {
+        return failure2("recovery_required", "metadata lock is not a regular file", {
           path: this.lockPath
         });
       const raw = fs4.readFileSync(this.lockPath, "utf8");
@@ -9491,7 +9728,7 @@ class TaskStore {
     } catch (error) {
       if (error?.code === "ENOENT")
         return success(null, null, null);
-      return failure("recovery_required", `metadata lock is invalid: ${String(error)}`, {
+      return failure2("recovery_required", `metadata lock is invalid: ${String(error)}`, {
         path: this.lockPath
       });
     }
@@ -9524,7 +9761,7 @@ class TaskStore {
     try {
       this.initializeMutationStorage();
     } catch (error) {
-      return failure("storage_error", `unable to initialize store: ${String(error)}`, {
+      return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.workitDir
       });
     }
@@ -9537,7 +9774,7 @@ class TaskStore {
     let result;
     try {
       if (!handle.verifyStillHeld())
-        result = failure("recovery_required", "metadata lock was compromised", {
+        result = failure2("recovery_required", "metadata lock was compromised", {
           path: this.lockPath
         });
       else {
@@ -9545,25 +9782,25 @@ class TaskStore {
           const run = () => operation();
           result = await (reentrant ? externalActionLockRoots.run(new Set([...activeRoots ?? [], this.root]), run) : run());
         } catch {
-          result = failure("external_outcome_unknown", "external action outcome is unknown", {
+          result = failure2("external_outcome_unknown", "external action outcome is unknown", {
             outcome: "unknown"
           });
         }
         try {
           if (!handle.verifyStillHeld())
-            result = failure("external_outcome_unknown", "metadata lock was compromised", {
+            result = failure2("external_outcome_unknown", "metadata lock was compromised", {
               outcome: "unknown",
               path: this.lockPath
             });
         } catch {
-          result = failure("external_outcome_unknown", "metadata lock could not be verified", {
+          result = failure2("external_outcome_unknown", "metadata lock could not be verified", {
             outcome: "unknown",
             path: this.lockPath
           });
         }
       }
     } catch {
-      result = failure("external_outcome_unknown", "external action lock operation failed", {
+      result = failure2("external_outcome_unknown", "external action lock operation failed", {
         outcome: "unknown",
         path: this.lockPath
       });
@@ -9573,10 +9810,10 @@ class TaskStore {
     } catch (error) {
       const released = this.lockFailure(error);
       const releaseError = released.ok ? "metadata lock release failed" : released.error;
-      return result.ok ? failure("external_outcome_unknown", "external action metadata lock release is uncertain", {
+      return result.ok ? failure2("external_outcome_unknown", "external action metadata lock release is uncertain", {
         outcome: "unknown",
         path: this.lockPath
-      }) : failure("recovery_required", `${result.error}; ${releaseError}`, result.details);
+      }) : failure2("recovery_required", `${result.error}; ${releaseError}`, result.details);
     }
     return result;
   }
@@ -9607,12 +9844,12 @@ class TaskStore {
     try {
       this.initializeMutationStorage();
     } catch (error) {
-      return failure("storage_error", `unable to initialize store: ${String(error)}`, {
+      return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.workitDir
       });
     }
     let handle;
-    let result = failure("storage_error", "metadata lock operation did not produce a result");
+    let result = failure2("storage_error", "metadata lock operation did not produce a result");
     try {
       handle = acquireFileLockSync(this.workspacePath, options);
     } catch (error) {
@@ -9621,14 +9858,14 @@ class TaskStore {
     if (handle) {
       try {
         if (!handle.verifyStillHeld())
-          result = failure("recovery_required", "metadata lock was compromised", {
+          result = failure2("recovery_required", "metadata lock was compromised", {
             path: this.lockPath
           });
         else {
           try {
             result = operation(handle);
           } catch (error) {
-            result = failure("storage_error", `mutation failed: ${String(error)}`);
+            result = failure2("storage_error", `mutation failed: ${String(error)}`);
           }
         }
       } catch (error) {
@@ -9641,7 +9878,7 @@ class TaskStore {
       } catch (error) {
         const releaseFailure = this.lockFailure(error);
         const releaseError = releaseFailure.ok ? "metadata lock release failed" : releaseFailure.error;
-        result = result.ok ? releaseFailure : failure("recovery_required", `${result.error}; ${releaseError}`, result.details);
+        result = result.ok ? releaseFailure : failure2("recovery_required", `${result.error}; ${releaseError}`, result.details);
       }
     }
     return result;
@@ -9652,13 +9889,13 @@ class TaskStore {
     if (code === "EEXIST" || code === "file_lock_timeout") {
       const lock = this.readLockSnapshot();
       if (lock.ok && lock.data?.data.externalAction)
-        return failure("writer_conflict", "workspace is reserved by a managed external action", {
+        return failure2("writer_conflict", "workspace is reserved by a managed external action", {
           outcome: "not_started",
           path: this.lockPath
         });
     }
     const recovery = code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || code === "metadata_lock_invalid" || code === "not-file" || /metadata lock|file lock|reclaim/i.test(String(value?.message ?? error));
-    return failure(recovery ? "recovery_required" : "storage_error", `metadata lock operation failed: ${String(error)}`, { path: this.lockPath });
+    return failure2(recovery ? "recovery_required" : "storage_error", `metadata lock operation failed: ${String(error)}`, { path: this.lockPath });
   }
   initializeMutationStorage() {
     fs4.mkdirSync(this.tasksDir, { recursive: true });
@@ -9690,7 +9927,7 @@ class TaskStore {
         this.indexTaskWrite(file, value);
       return success(null, null, value);
     } catch (error) {
-      return failure("storage_error", `snapshot replacement failed: ${String(error)}`, {
+      return failure2("storage_error", `snapshot replacement failed: ${String(error)}`, {
         path: file
       });
     } finally {
@@ -9846,7 +10083,7 @@ class TaskStore {
         return { exists: false, result: success(null, null, null) };
       return {
         exists: true,
-        result: failure("recovery_required", `snapshot cannot be read: ${String(error)}`, {
+        result: failure2("recovery_required", `snapshot cannot be read: ${String(error)}`, {
           path: file
         })
       };
@@ -9857,17 +10094,17 @@ class TaskStore {
     try {
       value = JSON.parse(typeof bytes === "string" ? bytes : bytes.toString("utf8"));
     } catch {
-      return failure("recovery_required", "snapshot JSON is corrupt");
+      return failure2("recovery_required", "snapshot JSON is corrupt");
     }
     if (isObject2(value) && "schemaVersion" in value && value.schemaVersion !== SCHEMA_VERSION)
-      return failure("unsupported_version", "unsupported snapshot schema version");
+      return failure2("unsupported_version", "unsupported snapshot schema version");
     const parsed = schema.safeParse(value);
     if (parsed.success)
       return success(null, null, parsed.data);
     const writerVersion = isObject2(value) && isObject2(value.runtime) ? value.runtime.updatedWith : null;
     if (typeof writerVersion === "string" && isNewerVersion(writerVersion, runtimeVersion()))
-      return failure("recovery_required", `snapshot was written by workit ${writerVersion}; upgrade Workit before mutating this checkout`);
-    return failure("recovery_required", "snapshot does not satisfy its schema");
+      return failure2("recovery_required", `snapshot was written by workit ${writerVersion}; upgrade Workit before mutating this checkout`);
+    return failure2("recovery_required", "snapshot does not satisfy its schema");
   }
   processStart(pid) {
     try {
@@ -9877,7 +10114,7 @@ class TaskStore {
     }
   }
   conflict(expected, actual) {
-    return failure("revision_conflict", "snapshot revision does not match; omit expectedRevision to use the current record", {
+    return failure2("revision_conflict", "snapshot revision does not match; omit expectedRevision to use the current record", {
       expectedRevision: expected,
       actualRevision: actual
     });
@@ -9955,10 +10192,10 @@ var processEvidenceSchema, metadataLockSchema, INDEX_VERSION = 1, hostSession =
   updatedWith: runtimeVersion()
 }), isNewerVersion = (candidate, current) => {
   const parts = (value) => value.split("-")[0].split(".").map((item) => Number.parseInt(item, 10) || 0);
-  const [next, now] = [parts(candidate), parts(current)];
+  const [candidateParts, currentParts] = [parts(candidate), parts(current)];
   for (let index = 0;index < 3; index += 1) {
-    const left = next[index] ?? 0;
-    const right = now[index] ?? 0;
+    const left = candidateParts[index] ?? 0;
+    const right = currentParts[index] ?? 0;
     if (left !== right)
       return left > right;
   }
@@ -10406,7 +10643,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
-    throw new Error(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Error(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
   let parsed;
   try {
@@ -10766,9 +11003,9 @@ var init_branch = __esm(() => {
 // packages/workit-core/src/core/workers.ts
 function assertProductWriteAllowed(input) {
   if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
-    return failure("invalid_input", "invalid product write path");
+    return failure2("invalid_input", "invalid product write path");
   if (!input.store)
-    return failure("permission_denied", "write authorization requires core state");
+    return failure2("permission_denied", "write authorization requires core state");
   const task = input.store.readTask(input.task.id);
   if (!task.ok)
     return task;
@@ -10776,29 +11013,29 @@ function assertProductWriteAllowed(input) {
   if (!workspace.ok)
     return workspace;
   if (!workspace.data)
-    return failure("not_found", "workspace not found");
+    return failure2("not_found", "workspace not found");
   const workspaceRecord = workspace.data;
   if (task.data.status !== "active")
-    return failure("invalid_transition", "paused or closed tasks cannot own product writes");
+    return failure2("invalid_transition", "paused or closed tasks cannot own product writes");
   if (workspaceRecord.id !== task.data.workspaceId || workspaceRecord.root.length === 0)
-    return failure("recovery_required", "task and workspace bindings are invalid");
+    return failure2("recovery_required", "task and workspace bindings are invalid");
   const writer = workspaceRecord.writer;
   if (!writer)
-    return failure("permission_denied", "checkout has no writer owner");
+    return failure2("permission_denied", "checkout has no writer owner");
   if (writer.state === "uncertain")
-    return failure("recovery_required", "checkout writer requires recovery", {
+    return failure2("recovery_required", "checkout writer requires recovery", {
       owner: writer.owner
     });
   const caller = callerValue(input.caller);
   const workerId = workerIdOf(input.caller);
   const owner = writer.owner;
   if (owner.taskId !== task.data.id || owner.workerId !== workerId || owner.session.host !== caller.host || owner.session.handle !== caller.actor)
-    return failure("writer_conflict", "checkout is owned by another validated actor", { owner });
+    return failure2("writer_conflict", "checkout is owned by another validated actor", { owner });
   const worker = workerId === null ? null : task.data.workers.find((entry) => entry.id === workerId);
   if (workerId !== null && (!worker || worker.data.assignment.role !== "implementer"))
-    return failure("permission_denied", "only implementers can own product writes");
+    return failure2("permission_denied", "only implementers can own product writes");
   if (workerId !== null && (!worker?.data.session || worker.data.state === "cancelling" || worker.data.state === "unknown" || worker.data.state === "stopped" || !same(worker.data.session, callerSession(input.caller))))
-    return failure("recovery_required", "worker session is not an active writer");
+    return failure2("recovery_required", "worker session is not an active writer");
   return success(null, workspaceRecord.revision, owner);
 }
 var same = (left, right) => {
@@ -10807,7 +11044,7 @@ var same = (left, right) => {
   } catch {
     return false;
   }
-}, UNCERTAIN_WORKER_STATES, isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state), workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state), callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor }, validPath = (value) => typeof value === "string" && value.length > 0 && ![...value].some((char) => {
+}, UNCERTAIN_WORKER_STATES, isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state), workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state), callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor }, validPath = (value) => typeof value === "string" && value.length > 0 && !Array.from(value).some((char) => {
   const code = char.charCodeAt(0);
   return code < 32 || code === 127;
 }) && !value.split(/[\\/]/).includes(".."), callerValue = (value) => ({ host: value.host, actor: value.actor }), workerIdOf = (value) => value.workerId ?? null, currentWriterOwnsTask = (task, workspace, caller) => {
@@ -10898,15 +11135,15 @@ var AUTO_CLASSES, OPERATION_CLASS, operationAutoClass = (operation) => typeof op
   };
 }, verifyStandingApproval = (root, task, caller, binding) => {
   if (task.status !== "active")
-    return failure("invalid_transition", "only active tasks can authorize actions");
+    return failure2("invalid_transition", "only active tasks can authorize actions");
   const workspace = new TaskStore(root).readWorkspace();
   if (!workspace.ok)
     return workspace;
   if (!workspace.data || !currentWriterOwnsTask(task, workspace.data, caller))
-    return failure("permission_denied", "standing approval requires the current writer session");
+    return failure2("permission_denied", "standing approval requires the current writer session");
   const standing = binding.standing;
   if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
-    return failure("invalid_input", "standing approval needs a workspace and class");
+    return failure2("invalid_input", "standing approval needs a workspace and class");
   let operation;
   try {
     operation = typeof binding.approvedContent === "string" ? JSON.parse(binding.approvedContent).operation : null;
@@ -10915,22 +11152,22 @@ var AUTO_CLASSES, OPERATION_CLASS, operationAutoClass = (operation) => typeof op
   }
   const cls = operationAutoClass(operation);
   if (!cls || cls !== standing.class)
-    return failure("permission_denied", "standing approval does not cover this operation");
+    return failure2("permission_denied", "standing approval does not cover this operation");
   const target = targetOf(root, binding.approvedContent);
   if (!target)
-    return failure("permission_denied", "standing action target is invalid");
+    return failure2("permission_denied", "standing action target is invalid");
   const resolved = resolveAutoApproval(target);
   if (resolved.status !== "on" || resolved.workspace !== standing.workspace || !resolved.classes.includes(cls))
-    return failure("permission_denied", "standing auto-approval is not live for this operation");
+    return failure2("permission_denied", "standing auto-approval is not live for this operation");
   if (cls === "push") {
-    const workspace = resolveWorkspaceFrom(target, configDir());
-    const provider = workspace?.vcs?.provider;
+    const targetWorkspace = resolveWorkspaceFrom(target, configDir());
+    const provider = targetWorkspace?.vcs?.provider;
     const account = resolved.account;
     if (!provider || !account)
-      return failure("permission_denied", "auto-push requires a workspace provider and area account");
+      return failure2("permission_denied", "auto-push requires a workspace provider and area account");
     const identity = verifyPushIdentity(target, provider, account);
     if (!identity.ok)
-      return failure("permission_denied", identity.error);
+      return failure2("permission_denied", identity.error);
   }
   return success(null, null, {
     kind: "host_observed",
@@ -10968,22 +11205,22 @@ function applicableDecision(task, purpose, binding, checkoutRoot) {
 }
 function reserveAction(input) {
   if (!input.store || !input.expectedRevision || !input.expectedWorkspaceRevision)
-    return failure("invalid_input", "action reservation preconditions are required");
+    return failure2("invalid_input", "action reservation preconditions are required");
   const authority = takeAuthority(input.authority, {
     owner: input.authorityOwner,
     store: input.store,
     root: input.store.root
   }, input.authorityCaller);
   if (!authority)
-    return failure("permission_denied", "native reservation authority is not verified");
+    return failure2("permission_denied", "native reservation authority is not verified");
   const changed = input.store.mutateTask(input.taskId, input.expectedRevision, (current, mutation) => {
     const workspace = input.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     if (workspace.data.revision !== input.expectedWorkspaceRevision)
-      return failure("revision_conflict", "workspace revision does not match", {
+      return failure2("revision_conflict", "workspace revision does not match", {
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         actualWorkspaceRevision: workspace.data.revision
       });
@@ -10993,19 +11230,19 @@ function reserveAction(input) {
     const { entry, workflow } = valid.data;
     const existing = entry.data.consumption;
     if (existing?.state === "uncertain")
-      return failure("external_outcome_unknown", "previous action outcome is unknown", {
+      return failure2("external_outcome_unknown", "previous action outcome is unknown", {
         operation: "reserve_action",
         outcome: "unknown"
       });
     if (existing?.state === "consumed")
-      return failure("permission_denied", "action approval is consumed");
+      return failure2("permission_denied", "action approval is consumed");
     if (existing?.state === "reserved" && workflow.completed.length === 0)
-      return failure("permission_denied", "action approval is already reserved");
+      return failure2("permission_denied", "action approval is already reserved");
     const requestedStep = input.step ?? workflow.steps[workflow.completed.length];
     if (workflow.steps.length && (!requestedStep || requestedStep !== workflow.steps[workflow.completed.length]))
-      return failure("permission_denied", "action step is outside the approved remaining workflow");
+      return failure2("permission_denied", "action step is outside the approved remaining workflow");
     if (requestedStep && workflow.completed.includes(requestedStep))
-      return failure("permission_denied", "action step was already completed");
+      return failure2("permission_denied", "action step was already completed");
     const nextDecision = {
       ...entry.data,
       consumption: { state: "reserved", at: mutation.now, actionRef: input.actionRef }
@@ -11028,10 +11265,10 @@ function reserveAction(input) {
     return changed;
   const workspace = input.store.readWorkspace();
   if (!workspace.ok || !workspace.data)
-    return failure("recovery_required", "workspace disappeared after reservation");
+    return failure2("recovery_required", "workspace disappeared after reservation");
   const entry = changed.data.decisions.find((candidate) => candidate.id === input.decisionId);
   if (!entry)
-    return failure("recovery_required", "reserved decision disappeared");
+    return failure2("recovery_required", "reserved decision disappeared");
   const workflow = changed.data.actionProgress?.find((progress) => progress.decisionId === input.decisionId) ?? {
     steps: [],
     completedSteps: []
@@ -11048,16 +11285,16 @@ function reserveAction(input) {
 }
 function settleAction(input) {
   if (!input.store || !input.taskRevision || !input.workspaceRevision)
-    return failure("invalid_input", "action settlement preconditions are required");
+    return failure2("invalid_input", "action settlement preconditions are required");
   const authority = takeAuthority(input.authority, {
     owner: input.authorityOwner,
     store: input.store,
     root: input.store.root
   }, input.authorityCaller);
   if (!authority)
-    return failure("permission_denied", "native settlement authority is not verified");
+    return failure2("permission_denied", "native settlement authority is not verified");
   if (!refSchema.safeParse(input.actionRef).success)
-    return failure("invalid_input", "action reference is invalid");
+    return failure2("invalid_input", "action reference is invalid");
   if (!authorityMatches(authority, {
     taskId: input.taskId,
     workspaceId: authority.workspaceId,
@@ -11067,14 +11304,14 @@ function settleAction(input) {
     workspaceRevision: input.workspaceRevision,
     outcome: input.outcome
   }))
-    return failure("permission_denied", "native settlement authority is not verified");
+    return failure2("permission_denied", "native settlement authority is not verified");
   let outcomeResult = null;
   const changed = input.store.mutateTask(input.taskId, input.taskRevision, (current, mutation) => {
     const workspace = input.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     if (!authorityMatches(authority, {
       taskId: input.taskId,
       workspaceId: workspace.data.id,
@@ -11084,39 +11321,39 @@ function settleAction(input) {
       workspaceRevision: input.workspaceRevision,
       outcome: input.outcome
     }))
-      return failure("permission_denied", "native settlement authority does not match context");
+      return failure2("permission_denied", "native settlement authority does not match context");
     if (workspace.data.revision !== input.workspaceRevision)
-      return failure("revision_conflict", "workspace revision does not match", {
+      return failure2("revision_conflict", "workspace revision does not match", {
         expectedWorkspaceRevision: input.workspaceRevision,
         actualWorkspaceRevision: workspace.data.revision
       });
     const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
     if (!entry)
-      return failure("not_found", "decision not found");
+      return failure2("not_found", "decision not found");
     if (!authorityDecisionMatches(authority, entry.data))
-      return failure("permission_denied", "native settlement authority does not match decision");
+      return failure2("permission_denied", "native settlement authority does not match decision");
     if (!approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
-      return failure("permission_denied", "native settlement caller does not match approval");
+      return failure2("permission_denied", "native settlement caller does not match approval");
     if (entry.data.purpose !== "action" || entry.data.digest !== decisionDigest(entry.data))
-      return failure("permission_denied", "decision binding is invalid");
+      return failure2("permission_denied", "decision binding is invalid");
     if (entry.data.consumption?.state === "uncertain")
-      return failure("external_outcome_unknown", "previous action outcome is unknown", {
+      return failure2("external_outcome_unknown", "previous action outcome is unknown", {
         operation: "settle_action",
         outcome: "unknown"
       });
     if (entry.data.consumption?.state !== "reserved")
-      return failure("permission_denied", "action is not reserved");
+      return failure2("permission_denied", "action is not reserved");
     if (canonicalJson(entry.data.consumption.actionRef) !== canonicalJson(input.actionRef))
-      return failure("permission_denied", "settlement reference does not match reservation");
+      return failure2("permission_denied", "settlement reference does not match reservation");
     const stored = current.actionProgress?.find((progress) => progress.decisionId === input.decisionId);
     const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: [], completed: [] };
     if (entry.data.binding.approvedContent && !stored && (parseSteps(entry.data.binding.approvedContent) ?? []).length)
-      return failure("recovery_required", "bounded action progress is missing");
+      return failure2("recovery_required", "bounded action progress is missing");
     const currentStep = input.step ?? workflow.steps[workflow.completed.length];
     if (workflow.steps.length && (!currentStep || currentStep !== workflow.steps[workflow.completed.length]))
-      return failure("permission_denied", "settlement step is outside the approved workflow");
+      return failure2("permission_denied", "settlement step is outside the approved workflow");
     if (input.outcome === "unknown") {
-      outcomeResult = failure("external_outcome_unknown", "external action outcome is unknown", {
+      outcomeResult = failure2("external_outcome_unknown", "external action outcome is unknown", {
         operation: "settle_action",
         outcome: "unknown"
       });
@@ -11168,45 +11405,45 @@ function settleAction(input) {
     return changed;
   const entry = changed.data.decisions.find((candidate) => candidate.id === input.decisionId);
   if (!entry)
-    return failure("recovery_required", "settled decision disappeared");
+    return failure2("recovery_required", "settled decision disappeared");
   if (outcomeResult)
     return outcomeResult;
   return success(changed.data.revision, input.workspaceRevision, entry);
 }
 function reconcileAction(input) {
   if (!input.store || !input.taskRevision || !input.workspaceRevision || !input.evidenceDigest)
-    return failure("invalid_input", "action reconciliation preconditions are required");
+    return failure2("invalid_input", "action reconciliation preconditions are required");
   const authority = takeAuthority(input.authority, { owner: input.authorityOwner, store: input.store, root: input.store.root }, input.authorityCaller);
   if (!authority || authority.kind !== "reconciliation")
-    return failure("permission_denied", "native reconciliation authority is not verified");
+    return failure2("permission_denied", "native reconciliation authority is not verified");
   if (authority.taskId !== input.taskId || authority.decisionId !== input.decisionId || !sameRef(authority.actionRef, input.actionRef) || authority.taskRevision !== input.taskRevision || authority.workspaceRevision !== input.workspaceRevision || authority.outcome !== input.outcome || authority.evidenceDigest !== input.evidenceDigest || authority.step !== input.step)
-    return failure("permission_denied", "native reconciliation authority is not bound");
+    return failure2("permission_denied", "native reconciliation authority is not bound");
   const changed = input.store.mutateTask(input.taskId, input.taskRevision, (current, mutation) => {
     const workspace = input.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     if (authority.workspaceId !== workspace.data.id)
-      return failure("permission_denied", "native reconciliation workspace does not match");
+      return failure2("permission_denied", "native reconciliation workspace does not match");
     if (workspace.data.revision !== input.workspaceRevision)
-      return failure("revision_conflict", "workspace revision does not match");
+      return failure2("revision_conflict", "workspace revision does not match");
     const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
     if (!entry || entry.data.purpose !== "action")
-      return failure("not_found", "decision not found");
+      return failure2("not_found", "decision not found");
     if (!authorityDecisionMatches(authority, entry.data) || !approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
-      return failure("permission_denied", "native reconciliation caller does not match approval");
+      return failure2("permission_denied", "native reconciliation caller does not match approval");
     if (entry.data.response !== "approved" || entry.data.revoked !== null || entry.data.digest !== decisionDigest(entry.data) || entry.data.binding.taskId !== current.id || entry.data.binding.workspaceId !== current.workspaceId || entry.data.binding.workspaceId !== workspace.data.id)
-      return failure("permission_denied", "reconciliation decision binding is invalid");
+      return failure2("permission_denied", "reconciliation decision binding is invalid");
     if (entry.data.consumption?.state !== "uncertain")
-      return failure("external_outcome_unknown", "only an uncertain action can be reconciled");
+      return failure2("external_outcome_unknown", "only an uncertain action can be reconciled");
     if (!sameRef(entry.data.consumption.actionRef, input.actionRef))
-      return failure("permission_denied", "reconciliation reference does not match reservation");
+      return failure2("permission_denied", "reconciliation reference does not match reservation");
     const stored = current.actionProgress?.find((progress) => progress.decisionId === input.decisionId);
     const workflow = stored ? { steps: [...stored.steps], completed: [...stored.completedSteps] } : { steps: [], completed: [] };
     const currentStep = input.step ?? workflow.steps[workflow.completed.length];
     if (workflow.steps.length && (!currentStep || currentStep !== workflow.steps[workflow.completed.length]))
-      return failure("permission_denied", "reconciliation step is outside the approved workflow");
+      return failure2("permission_denied", "reconciliation step is outside the approved workflow");
     if (input.outcome === "not_started") {
       return success(mutation.revision, null, {
         ...current,
@@ -11237,7 +11474,7 @@ function reconcileAction(input) {
   if (!changed.ok)
     return changed;
   const entry = changed.data.decisions.find((candidate) => candidate.id === input.decisionId);
-  return entry ? success(changed.data.revision, input.workspaceRevision, entry) : failure("recovery_required", "reconciled decision disappeared");
+  return entry ? success(changed.data.revision, input.workspaceRevision, entry) : failure2("recovery_required", "reconciled decision disappeared");
 }
 var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding, caller) => {
   const token = {};
@@ -11294,10 +11531,10 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   return provenance.kind === "host_observed" && provenance.host === caller.host && provenance.session?.kind === "host" && provenance.session.host === caller.host && provenance.session.handle === caller.actor && provenance.receipts.some((receipt) => receipt.kind === "host" && receipt.host === caller.host);
 }, verifyNativeDecision = (verifier, input, binding) => {
   if (!verifier)
-    return failure("permission_denied", "native authority verifier is unavailable");
+    return failure2("permission_denied", "native authority verifier is unavailable");
   const result = verifier.verifyDecision(input);
   if (!result.ok || !validProvenance(result.data, input.caller))
-    return failure("permission_denied", "native decision observation was not attested");
+    return failure2("permission_denied", "native decision observation was not attested");
   return success(null, null, trustedAuthority("decision", result.data, {
     taskId: input.expected.taskId,
     workspaceId: input.expected.workspaceId,
@@ -11310,10 +11547,10 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   }, binding, input.caller));
 }, verifyNativeAction = (verifier, input, binding) => {
   if (!verifier)
-    return failure("permission_denied", "native authority verifier is unavailable");
+    return failure2("permission_denied", "native authority verifier is unavailable");
   const result = verifier.verifyAction(input);
   if (!result.ok || !validProvenance(result.data, input.caller))
-    return failure("permission_denied", "native action observation was not attested");
+    return failure2("permission_denied", "native action observation was not attested");
   return success(null, null, trustedAuthority("action", result.data, {
     taskId: input.expected.taskId,
     workspaceId: input.expected.workspaceId,
@@ -11330,10 +11567,10 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   }, binding, input.caller));
 }, verifyNativeReconciliation = (verifier, input, binding) => {
   if (!verifier?.verifyReconciliation)
-    return failure("permission_denied", "native reconciliation authority is unavailable");
+    return failure2("permission_denied", "native reconciliation authority is unavailable");
   const result = verifier.verifyReconciliation(input);
   if (!result.ok || !validProvenance(result.data, input.caller))
-    return failure("permission_denied", "native reconciliation observation was not attested");
+    return failure2("permission_denied", "native reconciliation observation was not attested");
   return success(null, null, trustedAuthority("reconciliation", result.data, {
     taskId: input.expected.taskId,
     workspaceId: input.expected.workspaceId,
@@ -11367,16 +11604,16 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   try {
     root = fs6.realpathSync(checkoutRoot);
   } catch {
-    return failure("permission_denied", "checkout root is unavailable");
+    return failure2("permission_denied", "checkout root is unavailable");
   }
   for (const reference of binding.contentRefs) {
     if (reference.kind !== "file")
       continue;
     if (!reference.digest)
-      return failure("invalid_input", "document references require a byte digest");
+      return failure2("invalid_input", "document references require a byte digest");
     const target = path9.resolve(root, reference.path);
     if (target !== root && !target.startsWith(`${root}${path9.sep}`))
-      return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
+      return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
@@ -11391,7 +11628,7 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
         const stat = fs6.lstatSync(current);
         const real = fs6.realpathSync(current);
         if (real !== root && !real.startsWith(`${root}${path9.sep}`))
-          return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
+          return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
                 path: "contentRefs.path",
@@ -11400,16 +11637,16 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
             ]
           });
         if (stat.isSymbolicLink())
-          return failure("invalid_input", "document reference uses a symlink");
+          return failure2("invalid_input", "document reference uses a symlink");
         if (current === target && !stat.isFile())
-          return failure("invalid_input", "document reference is not a regular file");
+          return failure2("invalid_input", "document reference is not a regular file");
         if (current !== target && !stat.isDirectory())
-          return failure("invalid_input", "document reference ancestor is not a directory");
+          return failure2("invalid_input", "document reference ancestor is not a directory");
       }
       if (digestBytes2(fs6.readFileSync(target)) !== reference.digest)
-        return failure("permission_denied", "approved document bytes have changed");
+        return failure2("permission_denied", "approved document bytes have changed");
     } catch {
-      return failure("invalid_input", "approved document is unavailable");
+      return failure2("invalid_input", "approved document is unavailable");
     }
   }
   return success(null, null, null);
@@ -11428,15 +11665,15 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   });
 }, validateAction = (store, task, workspaceId, input, authority) => {
   if (task.status !== "active")
-    return failure("invalid_transition", "only active tasks can authorize actions");
+    return failure2("invalid_transition", "only active tasks can authorize actions");
   if (!refSchema.safeParse(input.actionRef).success)
-    return failure("invalid_input", "action reference is invalid");
+    return failure2("invalid_input", "action reference is invalid");
   const entry = task.decisions.find((candidate) => candidate.id === input.decisionId);
   if (!entry)
-    return failure("not_found", "decision not found");
+    return failure2("not_found", "decision not found");
   const decision = entry.data;
   if (decision.purpose !== "action")
-    return failure("permission_denied", "decision is not an action approval");
+    return failure2("permission_denied", "decision is not an action approval");
   if (!authorityMatches(authority, {
     taskId: task.id,
     workspaceId,
@@ -11446,13 +11683,13 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
     workspaceRevision: input.expectedWorkspaceRevision,
     outcome: "reserve"
   }))
-    return failure("permission_denied", "native reservation authority is not bound");
+    return failure2("permission_denied", "native reservation authority is not bound");
   if (!authorityDecisionMatches(authority, decision))
-    return failure("permission_denied", "native reservation authority does not match decision");
+    return failure2("permission_denied", "native reservation authority does not match decision");
   if (decision.response !== "approved")
-    return failure("permission_denied", "decision was rejected");
+    return failure2("permission_denied", "decision was rejected");
   if (!approvalAuthorityMatches(store, task, entry.provenance, authority.provenance))
-    return failure("permission_denied", "action approval lacks native receipt assurance");
+    return failure2("permission_denied", "action approval lacks native receipt assurance");
   const receipts = entry.provenance.receipts;
   const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
   const questionBacked = receipts.some((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "host");
@@ -11465,28 +11702,28 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
     }
     const cls = operationAutoClass(operation);
     if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls, undefined, decision.binding.approvedContent)))
-      return failure("permission_denied", "standing auto-approval is not live for this operation");
+      return failure2("permission_denied", "standing auto-approval is not live for this operation");
   }
   if (decision.revoked)
-    return failure("permission_denied", "decision is revoked");
+    return failure2("permission_denied", "decision is revoked");
   if (decision.digest !== decisionDigest(decision))
-    return failure("permission_denied", "decision binding is invalid");
+    return failure2("permission_denied", "decision binding is invalid");
   if (decision.binding.taskId !== task.id || decision.binding.workspaceId !== workspaceId)
-    return failure("permission_denied", "decision task or workspace binding is invalid");
+    return failure2("permission_denied", "decision task or workspace binding is invalid");
   if (input.binding && canonicalJson(input.binding) !== canonicalJson(decision.binding))
-    return failure("permission_denied", "action binding does not match the approved decision");
+    return failure2("permission_denied", "action binding does not match the approved decision");
   const content = verifyContentRefs(store, decision.binding);
   if (!content.ok)
     return content;
   const requestedSteps = parseSteps(decision.binding.approvedContent);
   if (requestedSteps === null)
-    return failure("invalid_input", "bounded action steps must be a unique non-empty array");
+    return failure2("invalid_input", "bounded action steps must be a unique non-empty array");
   if (input.steps && canonicalJson(input.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
-    return failure("permission_denied", "bounded action steps do not match approved content");
+    return failure2("permission_denied", "bounded action steps do not match approved content");
   const stored = task.actionProgress?.find((item) => item.decisionId === input.decisionId);
   const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: requestedSteps.map(chainStepKey), completed: [] };
   if (workflow.steps.length && requestedSteps.length && canonicalJson(workflow.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
-    return failure("permission_denied", "bounded action scope changed");
+    return failure2("permission_denied", "bounded action scope changed");
   return success(null, null, { entry, workflow });
 }, bindingCovers, verifyDecisionContent;
 var init_authority = __esm(() => {
@@ -11502,11 +11739,11 @@ var init_authority = __esm(() => {
 function normalizeResolverInput(input) {
   const parsed = resolverInputSchema.safeParse(input);
   if (!parsed.success)
-    return failure("invalid_input", "resolver input is invalid", invalidFields(parsed.error));
+    return failure2("invalid_input", "resolver input is invalid", invalidFields(parsed.error));
   const value = parsed.data;
   const signals = value.assessment.signals;
   if (signals.behaviorChange.value === true && signals.mechanicalLowRisk.value === true)
-    return failure("invalid_input", "behavioral change cannot be wholly mechanical", {
+    return failure2("invalid_input", "behavioral change cannot be wholly mechanical", {
       fields: [
         {
           path: "assessment.signals",
@@ -11516,11 +11753,11 @@ function normalizeResolverInput(input) {
     });
   const ids = value.constraints.map((constraint) => constraint.id);
   if (new Set(ids).size !== ids.length)
-    return failure("invalid_input", "constraint IDs must be unique", {
+    return failure2("invalid_input", "constraint IDs must be unique", {
       fields: [{ path: "constraints", reason: "duplicate constraint id" }]
     });
   if (value.preferences?.fast && value.preferences.thorough)
-    return failure("invalid_input", "fast and thorough preferences contradict", {
+    return failure2("invalid_input", "fast and thorough preferences contradict", {
       fields: [{ path: "preferences", reason: "fast and thorough cannot both be enabled" }]
     });
   const normalized = {
@@ -11693,7 +11930,7 @@ function resolvePolicy(input) {
   };
   const parsed = policySchema.safeParse(policy);
   if (!parsed.success)
-    return failure("invalid_input", "resolved policy is invalid", invalidFields(parsed.error));
+    return failure2("invalid_input", "resolved policy is invalid", invalidFields(parsed.error));
   return success(null, null, parsed.data);
 }
 function diffPolicy(previous, next, reason, now) {
@@ -11701,10 +11938,10 @@ function diffPolicy(previous, next, reason, now) {
     throw new TypeError("previous policy is invalid");
   if (!policySchema.safeParse(next).success)
     throw new TypeError("next policy is invalid");
-  const oldIds = new Set(previous?.requirements.map((requirement) => requirement.id) ?? []);
-  const newIds = new Set(next.requirements.map((requirement) => requirement.id));
-  const added = [...newIds].filter((id) => !oldIds.has(id)).sort(compareCodeUnits2);
-  const retired = [...oldIds].filter((id) => !newIds.has(id)).sort(compareCodeUnits2);
+  const oldIds = new Set(previous?.requirements.map((item) => item.id) ?? []);
+  const newIds = new Set(next.requirements.map((item) => item.id));
+  const added = [...newIds].filter((id) => !oldIds.has(id)).toSorted(compareCodeUnits2);
+  const retired = [...oldIds].filter((id) => !newIds.has(id)).toSorted(compareCodeUnits2);
   if (added.length === 0 && retired.length === 0)
     return null;
   const normalizedReason = reason.trim();
@@ -11730,7 +11967,7 @@ var resolverInputSchema, compareCodeUnits2 = (left, right) => {
       return difference;
   }
   return left.length - right.length;
-}, stableUnique = (values) => [...new Set(values)].sort(compareCodeUnits2), stableList = (values) => [...values].sort((left, right) => compareCodeUnits2(canonicalJson(left), canonicalJson(right))), normalizedScope = (scope) => ({
+}, stableUnique = (values) => [...new Set(values)].toSorted(compareCodeUnits2), stableList = (values) => [...values].toSorted((left, right) => compareCodeUnits2(canonicalJson(left), canonicalJson(right))), normalizedScope = (scope) => ({
   description: scope.description,
   paths: stableUnique(scope.paths),
   exclusions: stableUnique(scope.exclusions)
@@ -11827,11 +12064,11 @@ function captureCandidate(root, scope, environment = []) {
   try {
     checkout = fs7.realpathSync(root);
   } catch {
-    return failure("invalid_input", "candidate root does not exist");
+    return failure2("invalid_input", "candidate root does not exist");
   }
   const normalizedScope = canonicalScope(scope);
   if (!normalizedScope)
-    return failure("invalid_input", "candidate scope is invalid: paths must be checkout-relative — to work in another repository, keep this task here and coordinate a separate linked task in that checkout", { fields: [{ path: "scope.paths", reason: "must be checkout-relative" }] });
+    return failure2("invalid_input", "candidate scope is invalid: paths must be checkout-relative — to work in another repository, keep this task here and coordinate a separate linked task in that checkout", { fields: [{ path: "scope.paths", reason: "must be checkout-relative" }] });
   const roots = scopeRoots(checkout, normalizedScope);
   if (!roots.ok)
     return roots;
@@ -11860,7 +12097,7 @@ function captureCandidate(root, scope, environment = []) {
       names.add(item);
   const files = [];
   let completeness = uncertain ? "uncertain" : "known";
-  for (const item of [...names].sort()) {
+  for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
     const target = path10.join(checkout, item);
@@ -11894,8 +12131,8 @@ function captureCandidate(root, scope, environment = []) {
   }));
   const namesByEnvironment = supplied.map(({ name }) => name);
   if (new Set(namesByEnvironment).size !== namesByEnvironment.length || namesByEnvironment.some((name) => typeof name !== "string" || !name))
-    return failure("invalid_input", "candidate environment names must be unique and non-empty");
-  const values = supplied.sort((left, right) => compareCodeUnits3(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
+    return failure2("invalid_input", "candidate environment names must be unique and non-empty");
+  const values = supplied.toSorted((left, right) => compareCodeUnits3(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
   if (values.some(({ value }) => value === null))
     completeness = "uncertain";
   const headResult = spawnSync2("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
@@ -11912,7 +12149,7 @@ function captureCandidate(root, scope, environment = []) {
   };
   const candidate = { ...partial, id: candidateDigest(partial) };
   const parsed = candidateSchema.safeParse(candidate);
-  return parsed.success ? success(null, null, parsed.data) : failure("invalid_input", "captured candidate is invalid");
+  return parsed.success ? success(null, null, parsed.data) : failure2("invalid_input", "captured candidate is invalid");
 }
 function evaluateEvidence(task, candidate) {
   const current = candidate ?? task.candidates.at(-1) ?? null;
@@ -12055,13 +12292,13 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
 }
 function evaluateClosure(requestedOutcome, view) {
   if (requestedOutcome !== "stopped" && !view.task.policy)
-    return failure("requirements_unsatisfied", "task has not been assessed");
+    return failure2("requirements_unsatisfied", "task has not been assessed");
   if (view.task.policy && view.task.policy.policyVersion !== POLICY_VERSION)
-    return failure("requirements_unsatisfied", "stored policy version is unsupported; reassessment is required");
+    return failure2("requirements_unsatisfied", "stored policy version is unsupported; reassessment is required");
   const evaluations = view.requirements;
   const openFindings = view.task.findings.filter((entry) => entry.data.disposition === "open");
   if (requestedOutcome !== "stopped" && openFindings.length)
-    return failure("requirements_unsatisfied", "open findings must be resolved before closure");
+    return failure2("requirements_unsatisfied", "open findings must be resolved before closure");
   if (requestedOutcome !== "stopped") {
     const evidenceById = new Map(view.evidence.map((entry) => [entry.evidenceId, entry.status]));
     for (const entry of view.task.findings) {
@@ -12077,7 +12314,7 @@ function evaluateClosure(requestedOutcome, view) {
           });
         });
         if (!verified)
-          return failure("requirements_unsatisfied", "fixed findings require current verification");
+          return failure2("requirements_unsatisfied", "fixed findings require current verification");
       }
       if (entry.data.disposition === "deferred") {
         const valid = entry.data.resolution?.decisionIds.some((id) => {
@@ -12086,7 +12323,7 @@ function evaluateClosure(requestedOutcome, view) {
           return Boolean(decision && decisionEntry?.provenance.kind !== "imported" && decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.digest === decisionDigest(decision) && verifyDecisionContentAtRoot(view.workspace.root, decision.binding).ok && decision.binding.taskId === view.task.id && decision.binding.workspaceId === view.workspace.id && scopeCovers2(decision.binding.scope, entry.data.scope) && decision.requirementIds.some((requirementId) => view.task.policy?.requirements.some((requirement) => requirement.id === requirementId && requirement.acceptanceAllowed)));
         });
         if (!valid)
-          return failure("requirements_unsatisfied", "deferred findings require an approved limitation decision that references an acceptanceAllowed requirement and covers the finding scope");
+          return failure2("requirements_unsatisfied", "deferred findings require an approved limitation decision that references an acceptanceAllowed requirement and covers the finding scope");
       }
     }
   }
@@ -12097,7 +12334,7 @@ function evaluateClosure(requestedOutcome, view) {
     return !requirement || requirement.before === "close";
   });
   if (requestedOutcome !== "stopped" && blocking.length)
-    return failure("requirements_unsatisfied", "applicable requirements are unsatisfied", {
+    return failure2("requirements_unsatisfied", "applicable requirements are unsatisfied", {
       requirementIds: blocking.map((item) => item.requirementId),
       requirements: blocking.map((item) => {
         const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
@@ -12112,7 +12349,7 @@ function evaluateClosure(requestedOutcome, view) {
     });
   const accepted = evaluations.filter((item) => item.status === "accepted_limitation");
   if (requestedOutcome === "verified" && accepted.length)
-    return failure("requirements_unsatisfied", "accepted limitations cannot be reported as verified", {
+    return failure2("requirements_unsatisfied", "accepted limitations cannot be reported as verified", {
       requirementIds: accepted.map((item) => item.requirementId)
     });
   const evidenceIds = [
@@ -12178,7 +12415,7 @@ var digestBytes3 = (value) => createHash6("sha256").update(value).digest("hex"),
     return {
       paths: [],
       uncertain: !/not a git repository/i.test(stderr),
-      git: /not a git repository/i.test(stderr) ? false : true
+      git: !/not a git repository/i.test(stderr)
     };
   }
   const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")) : [];
@@ -12221,15 +12458,15 @@ var digestBytes3 = (value) => createHash6("sha256").update(value).digest("hex"),
   for (const item of scope.paths.length ? scope.paths : ["."]) {
     const target = path10.resolve(root, item);
     if (!inside(root, target))
-      return failure("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
+      return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs7.existsSync(ancestor) && ancestor !== root)
       ancestor = path10.dirname(ancestor);
     try {
       if (!inside(root, fs7.realpathSync(ancestor)))
-        return failure("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
+        return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
-      return failure("invalid_input", `candidate scope cannot be inspected: ${item}`);
+      return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
     }
     roots.push(target);
   }
@@ -12424,7 +12661,7 @@ var init_methods = __esm(() => {
 // packages/workit-core/src/core/task-context.ts
 function reconcileResume(view, observations = []) {
   if (observations.length > 0)
-    return failure("permission_denied", "worker observations require native host verification");
+    return failure2("permission_denied", "worker observations require native host verification");
   const candidate = captureCandidate(view.workspace.root, view.task.intent.data.scope, []);
   if (!candidate.ok)
     return candidate;
@@ -12445,7 +12682,7 @@ function reconcileResume(view, observations = []) {
   });
 }
 function compactTaskContext(view) {
-  const decisions = view.task.decisions.slice().sort((left, right) => {
+  const decisions = view.task.decisions.slice().toSorted((left, right) => {
     const leftAt = compactTimestamp(left.recordedAt);
     const rightAt = compactTimestamp(right.recordedAt);
     if (leftAt !== rightAt)
@@ -12468,7 +12705,7 @@ function compactTaskContext(view) {
     ...view.evidence.filter((entry) => entry.status === "stale").map((entry) => `stale evidence: ${entry.evidenceId}`),
     ...view.requirements.filter((entry) => entry.status !== "satisfied").map((entry) => entry.reason),
     ...view.task.progress.blockers.map((entry) => entry.reason)
-  ])).sort().slice(0, COMPACT_MAX_ITEMS).map((gap) => compactText(gap, COMPACT_TEXT_BYTES));
+  ])).toSorted().slice(0, COMPACT_MAX_ITEMS).map((gap) => compactText(gap, COMPACT_TEXT_BYTES));
   const context = {
     objective: compactText(view.task.intent.data.objective, COMPACT_TEXT_BYTES) ?? "",
     status: view.task.status,
@@ -12551,9 +12788,9 @@ class WorkitCore {
   contextRootError() {
     try {
       if (realpathSync6(this.context.root) !== this.store.root)
-        return failure("invalid_input", "operation context root does not match the task store root");
+        return failure2("invalid_input", "operation context root does not match the task store root");
     } catch {
-      return failure("invalid_input", "operation context root cannot be resolved");
+      return failure2("invalid_input", "operation context root cannot be resolved");
     }
     return success(null, null, null);
   }
@@ -12572,16 +12809,16 @@ class WorkitCore {
   helperEntry(task, requireSession = false, requireActive = false) {
     const workerId = this.context.workerId ?? null;
     if (workerId === null)
-      return failure("permission_denied", "operation is lead-only");
+      return failure2("permission_denied", "operation is lead-only");
     const worker = task.workers.find((entry) => entry.id === workerId);
     if (!worker)
-      return failure("permission_denied", "worker is not assigned to this task");
+      return failure2("permission_denied", "worker is not assigned to this task");
     if (worker.data.session && !sameSession2(worker.data.session, this.context))
-      return failure("permission_denied", "worker session does not match the caller");
+      return failure2("permission_denied", "worker session does not match the caller");
     if (requireSession && (!worker.data.session || !sameSession2(worker.data.session, this.context)))
-      return failure("permission_denied", "worker session has not been observed");
+      return failure2("permission_denied", "worker session has not been observed");
     if (requireActive && worker.data.state !== "running")
-      return failure("permission_denied", "worker is not active");
+      return failure2("permission_denied", "worker is not active");
     return success(null, null, worker);
   }
   helperTaskGuard(task, allowRead = false) {
@@ -12590,13 +12827,13 @@ class WorkitCore {
     const worker = this.helperEntry(task);
     if (!worker.ok)
       return worker;
-    return allowRead ? success(null, null, null) : failure("permission_denied", "helpers cannot control task lifecycle or scope");
+    return allowRead ? success(null, null, null) : failure2("permission_denied", "helpers cannot control task lifecycle or scope");
   }
   activeWorkerBlocker(task, workspace) {
     if (workspace.writer)
-      return failure("recovery_required", "writer ownership must be released first");
+      return failure2("recovery_required", "writer ownership must be released first");
     if (task.workers.some((entry) => workerBlocksTransition("close", entry.data.state)))
-      return failure("recovery_required", "worker state requires reconciliation");
+      return failure2("recovery_required", "worker state requires reconciliation");
     return null;
   }
   state(request) {
@@ -12604,7 +12841,7 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot control task state");
+      return failure2("permission_denied", "helpers cannot control task state");
     const parsed = parseOperation("state", request);
     if (!parsed.ok)
       return parsed;
@@ -12617,10 +12854,10 @@ class WorkitCore {
       if (!workspace.ok)
         return workspace;
       if (!workspace.data)
-        return failure("not_found", "workspace not found");
+        return failure2("not_found", "workspace not found");
       const portable = taskRecordSchema.safeParse(portableTask(task.data));
       if (!portable.success)
-        return failure("storage_error", "portable task is invalid after sanitization");
+        return failure2("storage_error", "portable task is invalid after sanitization");
       const bundle = {
         schemaVersion: 1,
         exportedAt: trustedNow(this.context),
@@ -12632,13 +12869,13 @@ class WorkitCore {
         digest: exportDigest(bundle)
       });
       if (!checked.success)
-        return failure("storage_error", "portable export bundle is invalid");
+        return failure2("storage_error", "portable export bundle is invalid");
       return success(task.data.revision, workspace.data.revision, checked.data);
     }
     if (input.action === "import") {
       const checked = exportBundleSchema.safeParse(input.bundle);
       if (!checked.success)
-        return failure("invalid_input", "export bundle is invalid");
+        return failure2("invalid_input", "export bundle is invalid");
       const bundle = checked.data;
       if (bundle.sourceWorkspaceId !== bundle.task.workspaceId || exportDigest({
         schemaVersion: bundle.schemaVersion,
@@ -12646,7 +12883,7 @@ class WorkitCore {
         sourceWorkspaceId: bundle.sourceWorkspaceId,
         task: bundle.task
       }) !== bundle.digest)
-        return failure("invalid_input", "export bundle digest is invalid");
+        return failure2("invalid_input", "export bundle digest is invalid");
       const workspace = this.store.readWorkspace();
       if (!workspace.ok)
         return workspace;
@@ -12665,7 +12902,7 @@ class WorkitCore {
       return this.summary(imported.data);
     }
     if (!this.context.nativeRecovery)
-      return failure("permission_denied", "native recovery authority is unavailable");
+      return failure2("permission_denied", "native recovery authority is unavailable");
     const processEvidence = (lock, writer) => this.context.nativeRecovery({
       lock,
       writer,
@@ -12685,12 +12922,12 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     this.fillRevisions(input, undefined, workspace.data);
     if (input.target === "workspace" && input.taskId !== undefined)
-      return failure("invalid_input", "workspace recovery takes no task ID");
+      return failure2("invalid_input", "workspace recovery takes no task ID");
     if (input.target === "task" && input.taskId === undefined)
-      return failure("invalid_input", "task recovery requires a task ID");
+      return failure2("invalid_input", "task recovery requires a task ID");
     return this.store.recoverTask(input.taskId, {
       expectedBytes: input.expectedBytes,
       snapshotDigest: input.snapshotDigest,
@@ -12710,7 +12947,7 @@ class WorkitCore {
     const input = parsed.data;
     if ((this.context.workerId ?? null) !== null) {
       if (input.action !== "inspect" && input.action !== "list")
-        return failure("permission_denied", "helpers cannot control task lifecycle or scope");
+        return failure2("permission_denied", "helpers cannot control task lifecycle or scope");
     }
     switch (input.action) {
       case "start": {
@@ -12747,14 +12984,14 @@ class WorkitCore {
           objective: task.intent.data.objective,
           progress: task.progress,
           decisions: task.decisions.map(({ data }) => data)
-        }).toLowerCase().includes(term))).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
+        }).toLowerCase().includes(term))).toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
         if (selected.length === 0)
           return success(null, null, []);
         const workspace = this.store.readWorkspace();
         if (!workspace.ok)
           return workspace;
         if (!workspace.data)
-          return failure("not_found", "workspace not found");
+          return failure2("not_found", "workspace not found");
         const tasks = selected.map((task) => ({
           id: task.id,
           revision: task.revision,
@@ -12796,7 +13033,7 @@ class WorkitCore {
       case "close":
         return this.close(input);
       default:
-        return failure("invalid_transition", `task action ${input.action} is not implemented`);
+        return failure2("invalid_transition", `task action ${input.action} is not implemented`);
     }
   }
   policy(request) {
@@ -12813,7 +13050,7 @@ class WorkitCore {
     if (input.action === "explain")
       return success(task.data.revision, null, task.data.policy);
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot change task requirements");
+      return failure2("permission_denied", "helpers cannot change task requirements");
     this.fillRevisions(input, task.data);
     const resolved = this.resolve(task.data, input.assessment);
     if (!resolved.ok)
@@ -12821,10 +13058,10 @@ class WorkitCore {
     if (input.action === "preview")
       return success(null, null, resolved.data);
     if (input.action !== "assess")
-      return failure("invalid_transition", "unsupported policy action");
+      return failure2("invalid_transition", "unsupported policy action");
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
       if (current.status === "closed")
-        return failure("invalid_transition", "closed task cannot be assessed");
+        return failure2("invalid_transition", "closed task cannot be assessed");
       const nextChange = diffPolicy(current.policy, resolved.data, "policy reassessed", mutation.now);
       const assessment = {
         id: newId(),
@@ -12857,17 +13094,17 @@ class WorkitCore {
     if (!task.ok)
       return task;
     if (task.data.status === "closed")
-      return failure("invalid_transition", "closed task cannot record evidence");
+      return failure2("invalid_transition", "closed task cannot record evidence");
     this.fillRevisions(input, task.data);
     const helper = (this.context.workerId ?? null) === null ? null : this.helperEntry(task.data, true, true);
     if (helper && !helper.ok)
       return helper;
     const evidence = input.evidence;
     if ((evidence.result === "missing" || evidence.result === "skipped") && !evidence.summary.trim())
-      return failure("invalid_input", "missing or skipped evidence requires a reason");
+      return failure2("invalid_input", "missing or skipped evidence requires a reason");
     if (evidence.kind === "review") {
       if (!sameSession2(evidence.reviewContext, this.context))
-        return failure("invalid_input", "review context must match the trusted caller session");
+        return failure2("invalid_input", "review context must match the trusted caller session");
     }
     const currentCandidate = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
     if (!currentCandidate.ok)
@@ -12877,12 +13114,12 @@ class WorkitCore {
     if (helper?.ok) {
       const assignment = helper.data.data.assignment;
       if (evidence.requirementIds.some((id) => !assignment.requirementIds.includes(id)) || !checkPin(assignment, bound.beforeCandidateId, bound.candidateId) || !refsWithinScope(evidence.refs, assignment.scope) || !refsWithinScope(evidence.refs, task.data.intent.data.scope))
-        return failure("permission_denied", "evidence is outside the worker assignment");
+        return failure2("permission_denied", "evidence is outside the worker assignment");
     }
     const knownCandidates = new Set(task.data.candidates.map((candidate) => candidate.id));
     for (const candidateId of [bound.beforeCandidateId, bound.candidateId]) {
       if (candidateId && candidateId !== currentCandidate.data.id && !knownCandidates.has(candidateId))
-        return failure("invalid_input", "evidence candidate is not a captured candidate");
+        return failure2("invalid_input", "evidence candidate is not a captured candidate");
     }
     const boundEvidence = { ...evidence, ...bound };
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
@@ -12939,38 +13176,38 @@ class WorkitCore {
       return parsed;
     const input = parsed.data;
     if (nativeRequired && input.action !== "record")
-      return failure("permission_denied", "native observation is only valid for recording decisions");
+      return failure2("permission_denied", "native observation is only valid for recording decisions");
     const stated = input.action === "record" && input.response === "stated";
     if (stated && input.purpose === "action")
-      return failure("permission_denied", "stated choices cannot authorize mutating actions");
+      return failure2("permission_denied", "stated choices cannot authorize mutating actions");
     if (stated && !input.binding?.statedChoice)
-      return failure("invalid_input", "stated choices require binding.statedChoice");
+      return failure2("invalid_input", "stated choices require binding.statedChoice");
     if (nativeRequired && nativeObservation === undefined && !stated && !standing)
-      return failure("permission_denied", "native decision observation is required");
+      return failure2("permission_denied", "native decision observation is required");
     if (standing && (!input.binding?.standing || input.purpose !== "action" || input.response !== "approved"))
-      return failure("invalid_input", "standing approvals need an approved action binding with a standing rule");
+      return failure2("invalid_input", "standing approvals need an approved action binding with a standing rule");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot record or revoke decisions");
+      return failure2("permission_denied", "helpers cannot record or revoke decisions");
     this.fillRevisions(input, task.data);
     if (input.action === "record") {
       if (task.data.status === "closed")
-        return failure("invalid_transition", "closed task cannot record a decision");
+        return failure2("invalid_transition", "closed task cannot record a decision");
       const workspace = this.store.readWorkspace();
       if (!workspace.ok)
         return workspace;
       if (!workspace.data)
-        return failure("not_found", "workspace not found");
+        return failure2("not_found", "workspace not found");
       if (input.binding.taskId !== task.data.id || input.binding.workspaceId !== workspace.data.id)
-        return failure("permission_denied", "decision task or workspace binding is invalid");
+        return failure2("permission_denied", "decision task or workspace binding is invalid");
       const content = verifyDecisionContent(this.store, input.binding);
       if (!content.ok)
         return content;
       const knownRequirements = new Set(task.data.policy?.requirements.map((item) => item.id) ?? []);
       if (input.requirementIds.some((id) => !knownRequirements.has(id)))
-        return failure("invalid_input", "decision references an unknown requirement");
+        return failure2("invalid_input", "decision references an unknown requirement");
       const base = {
         purpose: input.purpose,
         binding: input.binding,
@@ -13001,16 +13238,16 @@ class WorkitCore {
         return native;
       const nativeProvenance = native?.ok ? retireNativeAuthority(native.data) : null;
       if (native?.ok && !nativeProvenance)
-        return failure("permission_denied", "native decision authority was retired");
+        return failure2("permission_denied", "native decision authority was retired");
       const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
-        const content = verifyDecisionContent(this.store, input.binding);
-        if (!content.ok)
-          return content;
+        const latestContent = verifyDecisionContent(this.store, input.binding);
+        if (!latestContent.ok)
+          return latestContent;
         const known = new Set(current.policy?.requirements.map((item) => item.id) ?? []);
         if (input.requirementIds.some((id) => !known.has(id)))
-          return failure("invalid_input", "decision references an unknown requirement");
+          return failure2("invalid_input", "decision references an unknown requirement");
         if (nativeProvenance && current.decisions.some((entry) => entry.provenance.receipts.some((existingReceipt) => nativeProvenance.receipts.some((receipt) => canonicalJson(receipt) === canonicalJson(existingReceipt)))))
-          return failure("permission_denied", "native decision receipt was already consumed");
+          return failure2("permission_denied", "native decision receipt was already consumed");
         const entry = {
           id: newId(),
           recordedAt: mutation.now,
@@ -13028,21 +13265,21 @@ class WorkitCore {
     }
     const decision = task.data.decisions.find((entry) => entry.id === input.decisionId);
     if (!decision)
-      return failure("not_found", "decision not found");
+      return failure2("not_found", "decision not found");
     if (!input.reason.trim())
-      return failure("invalid_input", "decision revocation requires a reason");
+      return failure2("invalid_input", "decision revocation requires a reason");
     if (decision.data.revoked)
-      return failure("invalid_transition", "decision is already revoked");
+      return failure2("invalid_transition", "decision is already revoked");
     if (decision.data.consumption)
-      return failure("permission_denied", "consumed decision cannot be revoked");
+      return failure2("permission_denied", "consumed decision cannot be revoked");
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
       const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
       if (!entry)
-        return failure("not_found", "decision not found");
+        return failure2("not_found", "decision not found");
       if (entry.data.revoked)
-        return failure("invalid_transition", "decision is already revoked");
+        return failure2("invalid_transition", "decision is already revoked");
       if (entry.data.consumption)
-        return failure("permission_denied", "consumed decision cannot be revoked");
+        return failure2("permission_denied", "consumed decision cannot be revoked");
       const data = {
         ...entry.data,
         revoked: { at: mutation.now, reason: input.reason }
@@ -13056,7 +13293,7 @@ class WorkitCore {
     if (!changed.ok)
       return changed;
     const entry = changed.data.decisions.find((candidate) => candidate.id === input.decisionId);
-    return entry ? success(changed.data.revision, null, entry) : failure("recovery_required", "decision disappeared");
+    return entry ? success(changed.data.revision, null, entry) : failure2("recovery_required", "decision disappeared");
   }
   finding(request) {
     const root = this.contextRootError();
@@ -13070,7 +13307,7 @@ class WorkitCore {
     if (!task.ok)
       return task;
     if (task.data.status === "closed")
-      return failure("invalid_transition", "closed task cannot mutate findings");
+      return failure2("invalid_transition", "closed task cannot mutate findings");
     this.fillRevisions(input, task.data);
     const helper = (this.context.workerId ?? null) === null ? null : this.helperEntry(task.data, true, true);
     if (helper && !helper.ok)
@@ -13079,10 +13316,10 @@ class WorkitCore {
       if (helper?.ok) {
         const assignment = helper.data.data.assignment;
         if (!bindingCovers(assignment.scope, input.scope) || !bindingCovers(task.data.intent.data.scope, input.scope) || !checkPin(assignment, null, input.candidateId ?? null) || !refsWithinScope(input.refs, assignment.scope) || !refsWithinScope(input.refs, task.data.intent.data.scope))
-          return failure("permission_denied", "finding is outside the worker assignment");
+          return failure2("permission_denied", "finding is outside the worker assignment");
       }
       if (input.candidateId && !task.data.candidates.some((candidate) => candidate.id === input.candidateId))
-        return failure("invalid_input", "finding candidate is not a captured candidate");
+        return failure2("invalid_input", "finding candidate is not a captured candidate");
       const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
         const entry = {
           id: newId(),
@@ -13108,16 +13345,16 @@ class WorkitCore {
       return success(changed.data.revision, null, changed.data.findings.at(-1));
     }
     if (helper?.ok)
-      return failure("permission_denied", "helpers cannot resolve findings");
+      return failure2("permission_denied", "helpers cannot resolve findings");
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding)
-      return failure("not_found", "finding not found");
+      return failure2("not_found", "finding not found");
     if (!input.reason.trim())
-      return failure("invalid_input", "finding resolution requires a reason");
+      return failure2("invalid_input", "finding resolution requires a reason");
     const evidence = task.data.evidence.filter((entry) => input.evidenceIds.includes(entry.id));
     const decisions = task.data.decisions.filter((entry) => input.decisionIds.includes(entry.id));
     if (evidence.length !== input.evidenceIds.length || decisions.length !== input.decisionIds.length)
-      return failure("invalid_input", "finding resolution references an unknown record");
+      return failure2("invalid_input", "finding resolution references an unknown record");
     if (input.disposition === "fixed") {
       const current = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
       if (!current.ok)
@@ -13132,10 +13369,10 @@ class WorkitCore {
         });
       });
       if (!verified)
-        return failure("permission_denied", "fixed findings require passing verification evidence");
+        return failure2("permission_denied", "fixed findings require passing verification evidence");
     }
     if (input.disposition === "dismissed" && evidence.length === 0)
-      return failure("permission_denied", "dismissal requires supporting evidence");
+      return failure2("permission_denied", "dismissal requires supporting evidence");
     if (input.disposition === "dismissed") {
       const relevant = evidence.every((entry) => {
         if (entry.data.result === "missing" || entry.data.result === "skipped")
@@ -13145,22 +13382,22 @@ class WorkitCore {
         return candidateMatches && (referenceMatches || entry.data.claim === finding.data.claim);
       });
       if (!relevant)
-        return failure("permission_denied", "dismissal evidence is unrelated to the finding");
+        return failure2("permission_denied", "dismissal evidence is unrelated to the finding");
     }
     if (input.disposition === "deferred") {
       const workspace = this.store.readWorkspace();
       if (!workspace.ok)
         return workspace;
       if (!workspace.data)
-        return failure("not_found", "workspace not found");
+        return failure2("not_found", "workspace not found");
       const allowed = decisions.some((entry) => entry.provenance.kind !== "imported" && entry.data.purpose === "limitation" && entry.data.response === "approved" && entry.data.revoked === null && entry.data.digest === decisionDigest(entry.data) && verifyDecisionContent(this.store, entry.data.binding).ok && entry.data.binding.taskId === task.data.id && entry.data.binding.workspaceId === workspace.data.id && bindingCovers(entry.data.binding.scope, finding.data.scope) && entry.data.requirementIds.some((id) => task.data.policy?.requirements.some((requirement) => requirement.id === id && requirement.acceptanceAllowed)));
       if (!allowed)
-        return failure("permission_denied", "deferred findings require an approved limitation decision that references an acceptanceAllowed requirement and covers the finding scope");
+        return failure2("permission_denied", "deferred findings require an approved limitation decision that references an acceptanceAllowed requirement and covers the finding scope");
     }
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
       const existing = current.findings.find((entry) => entry.id === input.findingId);
       if (!existing)
-        return failure("not_found", "finding not found");
+        return failure2("not_found", "finding not found");
       const data = input.disposition === "open" ? { ...existing.data, disposition: "open", resolution: null } : {
         ...existing.data,
         disposition: input.disposition,
@@ -13179,7 +13416,7 @@ class WorkitCore {
     if (!changed.ok)
       return changed;
     const entry = changed.data.findings.find((candidate) => candidate.id === input.findingId);
-    return entry ? success(changed.data.revision, null, entry) : failure("recovery_required", "finding disappeared");
+    return entry ? success(changed.data.revision, null, entry) : failure2("recovery_required", "finding disappeared");
   }
   worker(request) {
     const root = this.contextRootError();
@@ -13196,16 +13433,16 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     this.fillRevisions(input, task.data, workspace.data);
     const helperId = this.context.workerId ?? null;
     if (input.action === "assign") {
       if (helperId !== null)
-        return failure("permission_denied", "helpers cannot assign workers");
+        return failure2("permission_denied", "helpers cannot assign workers");
       if (task.data.status !== "active")
-        return failure("invalid_transition", "paused or closed tasks cannot assign workers");
+        return failure2("invalid_transition", "paused or closed tasks cannot assign workers");
       if (!bindingCovers(task.data.intent.data.scope, input.assignment.scope))
-        return failure("permission_denied", "worker assignment is outside task scope", {
+        return failure2("permission_denied", "worker assignment is outside task scope", {
           fields: [
             {
               path: "assignment.scope",
@@ -13218,14 +13455,14 @@ class WorkitCore {
           ]
         });
       if (input.assignment.decisionIds.some((id) => !task.data.decisions.some((entry) => entry.id === id)))
-        return failure("invalid_input", "worker assignment references an unknown decision");
+        return failure2("invalid_input", "worker assignment references an unknown decision");
       if (input.assignment.requirementIds.some((id) => !task.data.policy?.requirements.some((requirement) => requirement.id === id)))
-        return failure("invalid_input", "worker assignment references an unknown requirement");
+        return failure2("invalid_input", "worker assignment references an unknown requirement");
       const reviewRequirements = (task.data.policy?.requirements ?? []).filter((requirement) => requirement.dimension === "review");
       if (input.assignment.role === "reviewer" && input.assignment.requirementIds.length === 0 && reviewRequirements.length)
-        return failure("invalid_input", "reviewer assignment needs the review requirement ids it will evidence", { requirementIds: reviewRequirements.map((requirement) => requirement.id) });
+        return failure2("invalid_input", "reviewer assignment needs the review requirement ids it will evidence", { requirementIds: reviewRequirements.map((requirement) => requirement.id) });
       if (input.assignment.candidateId && !task.data.candidates.some((candidate) => candidate.id === input.assignment.candidateId))
-        return failure("invalid_input", "worker assignment references an unknown candidate");
+        return failure2("invalid_input", "worker assignment references an unknown candidate");
       input.assignment.candidateId ??= null;
       const workerId = newId();
       const changed = this.store.mutateTaskAndWorkspace({
@@ -13253,19 +13490,19 @@ class WorkitCore {
     }
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
-      return failure("not_found", "worker not found");
+      return failure2("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure("permission_denied", "workers can submit only their own report");
+        return failure2("permission_denied", "workers can submit only their own report");
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok)
         return helper;
       const evidence = task.data.evidence.filter((candidate) => input.report.evidenceIds.includes(candidate.id));
       const findings = task.data.findings.filter((candidate) => input.report.findingIds.includes(candidate.id));
       if (evidence.length !== input.report.evidenceIds.length || findings.length !== input.report.findingIds.length)
-        return failure("invalid_input", "worker report references an unknown record");
+        return failure2("invalid_input", "worker report references an unknown record");
       if (evidence.some((candidate) => candidate.provenance.workerId !== helperId) || findings.some((candidate) => candidate.provenance.workerId !== helperId) || evidence.some((candidate) => !refsWithinScope(candidate.data.refs, helper.data.data.assignment.scope) || !refsWithinScope(candidate.data.refs, task.data.intent.data.scope)) || findings.some((candidate) => !refsWithinScope(candidate.data.refs, helper.data.data.assignment.scope) || !refsWithinScope(candidate.data.refs, task.data.intent.data.scope)))
-        return failure("permission_denied", "worker report is outside the worker assignment");
+        return failure2("permission_denied", "worker report is outside the worker assignment");
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
         expectedRevision: input.expectedRevision,
@@ -13284,14 +13521,14 @@ class WorkitCore {
       if (!changed.ok)
         return changed;
       const updated = changed.data.task.workers.find((candidate) => candidate.id === input.workerId);
-      return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure("recovery_required", "worker disappeared during report");
+      return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during report");
     }
     if (helperId !== null)
-      return failure("permission_denied", "helpers cannot cancel or control workers");
+      return failure2("permission_denied", "helpers cannot cancel or control workers");
     if (task.data.status === "closed")
-      return failure("invalid_transition", "closed task cannot cancel workers");
+      return failure2("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "unknown")
-      return failure("recovery_required", "worker state requires recovery");
+      return failure2("recovery_required", "worker state requires recovery");
     if (entry.data.state === "stopped") {
       const stopped = task.data.workers.find((candidate) => candidate.id === input.workerId);
       return success(task.data.revision, workspace.data.revision, stopped);
@@ -13323,7 +13560,7 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if (this.context.workerId !== undefined && this.context.workerId !== null && this.context.workerId !== input.workerId)
-      return failure("permission_denied", "worker observation does not match the caller");
+      return failure2("permission_denied", "worker observation does not match the caller");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
@@ -13331,7 +13568,7 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const authority = verifyNativeWorker(this.context.nativeWorker, {
       observation: input.observation,
       expected: { ...input, workspaceId: workspace.data.id },
@@ -13357,7 +13594,7 @@ class WorkitCore {
   verifyDispatch(stage, input, workspaceId) {
     const verifier = this.context.nativeWorker?.verifyDispatch;
     if (!verifier)
-      return failure("permission_denied", "native worker dispatch attestation is unavailable");
+      return failure2("permission_denied", "native worker dispatch attestation is unavailable");
     let result;
     try {
       result = verifier({
@@ -13373,10 +13610,10 @@ class WorkitCore {
         caller: this.context.caller
       });
     } catch (error) {
-      return failure("permission_denied", `native worker dispatch failed: ${String(error)}`);
+      return failure2("permission_denied", `native worker dispatch failed: ${String(error)}`);
     }
     if (!result.ok || !validDispatchProvenance(result.data, this.context.caller, input.workerId))
-      return failure("permission_denied", "worker dispatch was not attested by the host");
+      return failure2("permission_denied", "worker dispatch was not attested by the host");
     return result;
   }
   prepareWorkerDispatch(input) {
@@ -13384,7 +13621,7 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot dispatch workers");
+      return failure2("permission_denied", "helpers cannot dispatch workers");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
@@ -13392,16 +13629,16 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     if (task.data.workspaceId !== workspace.data.id)
-      return failure("recovery_required", "worker workspace binding is invalid");
+      return failure2("recovery_required", "worker workspace binding is invalid");
     if (task.data.status !== "active")
-      return failure("invalid_transition", "paused or closed tasks cannot dispatch workers");
+      return failure2("invalid_transition", "paused or closed tasks cannot dispatch workers");
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
-      return failure("not_found", "worker not found");
+      return failure2("not_found", "worker not found");
     if (entry.data.state !== "assigned" || entry.data.session !== null)
-      return failure("invalid_transition", "worker is not awaiting dispatch");
+      return failure2("invalid_transition", "worker is not awaiting dispatch");
     const attested = this.verifyDispatch("prepare", input, workspace.data.id);
     if (!attested.ok)
       return attested;
@@ -13414,9 +13651,9 @@ class WorkitCore {
       task: (current, mutation) => {
         const candidate = current.workers.find((item) => item.id === input.workerId);
         if (!candidate)
-          return failure("not_found", "worker not found");
+          return failure2("not_found", "worker not found");
         if (candidate.data.state !== "assigned" || candidate.data.session !== null)
-          return failure("invalid_transition", "worker is not awaiting dispatch");
+          return failure2("invalid_transition", "worker is not awaiting dispatch");
         return success(mutation.revision, null, {
           ...current,
           workers: current.workers.map((item) => item.id === input.workerId ? {
@@ -13455,17 +13692,17 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot dispatch workers");
+      return failure2("permission_denied", "helpers cannot dispatch workers");
     const reservation = dispatchReservations.get(input.dispatch);
     if (!reservation || reservation.owner !== this.authorityOwner || reservation.store !== this.store || reservation.root !== this.store.root || !sameValue(reservation.caller, this.context.caller) || reservation.taskId !== input.taskId || reservation.workerId !== input.workerId)
-      return failure("permission_denied", "worker dispatch reservation is not live");
+      return failure2("permission_denied", "worker dispatch reservation is not live");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     if (workspace.data.id !== reservation.workspaceId)
-      return failure("recovery_required", "worker workspace binding is invalid");
+      return failure2("recovery_required", "worker workspace binding is invalid");
     const observation = {
       taskId: input.taskId,
       workerId: input.workerId,
@@ -13478,7 +13715,7 @@ class WorkitCore {
     let authority;
     if (input.outcome === "started") {
       if (!input.session)
-        return failure("invalid_input", "a started worker requires a session");
+        return failure2("invalid_input", "a started worker requires a session");
       const verified = verifyNativeWorker(this.context.nativeWorker, {
         observation: input.observation,
         expected: { ...observation, workspaceId: workspace.data.id },
@@ -13494,7 +13731,7 @@ class WorkitCore {
       authority = verified.data;
     } else {
       if (input.session !== null)
-        return failure("invalid_input", "a never-dispatched worker stops with no session");
+        return failure2("invalid_input", "a never-dispatched worker stops with no session");
       const attested = this.verifyDispatch("not_started", input, workspace.data.id);
       if (!attested.ok)
         return attested;
@@ -13543,31 +13780,31 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     if (task.data.status !== "active")
-      return failure("invalid_transition", "paused or closed tasks cannot own product writes");
+      return failure2("invalid_transition", "paused or closed tasks cannot own product writes");
     this.fillRevisions(input, task.data, workspace.data);
     const helperId = this.context.workerId ?? null;
     if (input.action === "acquire") {
       if (input.workerId === undefined)
         input.workerId = helperId;
       if (input.workerId !== helperId)
-        return failure("permission_denied", "writer identity does not match the caller");
+        return failure2("permission_denied", "writer identity does not match the caller");
       if (workspace.data.writer) {
         if (workspace.data.writer.state === "uncertain")
-          return failure("recovery_required", "checkout writer requires recovery", {
+          return failure2("recovery_required", "checkout writer requires recovery", {
             owner: workspace.data.writer.owner
           });
         const currentOwner = workspace.data.writer.owner;
         if (currentOwner.workerId) {
           const ownerWorker = task.data.workers.find((candidate) => candidate.id === currentOwner.workerId);
           if (ownerWorker?.data.state === "cancelling" || ownerWorker?.data.state === "unknown")
-            return failure("recovery_required", "current worker has not stopped", {
+            return failure2("recovery_required", "current worker has not stopped", {
               owner: currentOwner
             });
         }
         if (currentOwner.workerId !== null || helperId !== null)
-          return failure("writer_conflict", "checkout already has a writer", {
+          return failure2("writer_conflict", "checkout already has a writer", {
             owner: currentOwner
           });
       }
@@ -13576,17 +13813,17 @@ class WorkitCore {
         if (!helper.ok)
           return helper;
         if (helper.data.data.assignment.role !== "implementer")
-          return failure("permission_denied", "only implementers can own product writes");
+          return failure2("permission_denied", "only implementers can own product writes");
         if (helper.data.data.state !== "running" || !helper.data.data.session)
-          return failure("permission_denied", "writer ownership requires an observed running worker");
+          return failure2("permission_denied", "writer ownership requires an observed running worker");
         if (!sameSession2(helper.data.data.session, this.context))
-          return failure("permission_denied", "worker session does not match the caller");
+          return failure2("permission_denied", "worker session does not match the caller");
       }
       const gate = this.view(task.data);
       if (gate.ok) {
         const writeGates = (task.data.policy?.requirements ?? []).filter((requirement) => requirement.before === "write" && gate.data.requirements.some((evaluation) => evaluation.requirementId === requirement.id && (evaluation.status === "unsatisfied" || evaluation.status === "unavailable")));
         if (writeGates.length)
-          return failure("requirements_unsatisfied", "writer ownership is gated by unsatisfied requirements; record their evidence or an approved limitation waiver first", { requirementIds: writeGates.map((requirement) => requirement.id) });
+          return failure2("requirements_unsatisfied", "writer ownership is gated by unsatisfied requirements; record their evidence or an approved limitation waiver first", { requirementIds: writeGates.map((requirement) => requirement.id) });
       }
       const owner = {
         taskId: task.data.id,
@@ -13614,19 +13851,19 @@ class WorkitCore {
     }
     const current = workspace.data.writer;
     if (!current)
-      return failure("permission_denied", "checkout has no writer owner");
+      return failure2("permission_denied", "checkout has no writer owner");
     if (current.state === "uncertain")
-      return failure("recovery_required", "checkout writer requires recovery", {
+      return failure2("recovery_required", "checkout writer requires recovery", {
         owner: current.owner
       });
     if (current.owner.taskId !== task.data.id || current.owner.workerId !== helperId || !sameSession2(current.owner.session, this.context))
-      return failure("permission_denied", "only the current writer can release ownership");
+      return failure2("permission_denied", "only the current writer can release ownership");
     if (helperId !== null) {
       const helper = this.helperEntry(task.data);
       if (!helper.ok)
         return helper;
       if (helper.data.data.state !== "running")
-        return failure("recovery_required", "worker must be observed stopped before release");
+        return failure2("recovery_required", "worker must be observed stopped before release");
     }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
@@ -13658,9 +13895,9 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot reserve external actions");
+      return failure2("permission_denied", "helpers cannot reserve external actions");
     if (input.observation === undefined)
-      return failure("invalid_input", "native action observation is required");
+      return failure2("invalid_input", "native action observation is required");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
@@ -13668,10 +13905,10 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const decision = task.data.decisions.find((entry) => entry.id === input.decisionId);
     if (!decision)
-      return failure("not_found", "decision not found");
+      return failure2("not_found", "decision not found");
     const authority = verifyNativeAction(this.context.nativeAuthority, {
       observation: input.observation,
       expected: {
@@ -13696,7 +13933,7 @@ class WorkitCore {
       const evaluations = new Map(view.data.requirements.map((entry) => [entry.requirementId, entry.status]));
       const blocked = (view.data.task.policy?.requirements ?? []).filter((requirement) => requirement.dependentAction === operation && (evaluations.get(requirement.id) === "unsatisfied" || evaluations.get(requirement.id) === "unavailable"));
       if (blocked.length)
-        return failure("requirements_unsatisfied", `${operation} is gated by unsatisfied requirements; record their evidence or an approved limitation waiver first`, { operation, requirementIds: blocked.map((requirement) => requirement.id) });
+        return failure2("requirements_unsatisfied", `${operation} is gated by unsatisfied requirements; record their evidence or an approved limitation waiver first`, { operation, requirementIds: blocked.map((requirement) => requirement.id) });
     }
     return reserveAction({
       ...input,
@@ -13712,9 +13949,9 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot settle external actions");
+      return failure2("permission_denied", "helpers cannot settle external actions");
     if (input.observation === undefined)
-      return failure("invalid_input", "native action observation is required");
+      return failure2("invalid_input", "native action observation is required");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
@@ -13722,10 +13959,10 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const decision = task.data.decisions.find((entry) => entry.id === input.decisionId);
     if (!decision)
-      return failure("not_found", "decision not found");
+      return failure2("not_found", "decision not found");
     const authority = verifyNativeAction(this.context.nativeAuthority, {
       observation: input.observation,
       expected: {
@@ -13756,7 +13993,7 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot reconcile external actions");
+      return failure2("permission_denied", "helpers cannot reconcile external actions");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
@@ -13764,10 +14001,10 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const decision = task.data.decisions.find((entry) => entry.id === input.decisionId);
     if (!decision)
-      return failure("not_found", "decision not found");
+      return failure2("not_found", "decision not found");
     const authority = verifyNativeReconciliation(this.context.nativeAuthority, {
       observation: input.observation,
       expected: {
@@ -13814,7 +14051,7 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
     const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
@@ -13857,7 +14094,7 @@ class WorkitCore {
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
     const current = historical ? success(null, null, historical) : capture ? captureCandidate(this.store.root, task.intent.data.scope, environment()) : success(null, null, task.candidates.at(-1) ?? null);
     if (!current.ok)
@@ -13877,14 +14114,14 @@ class WorkitCore {
     if (!root.ok)
       return root;
     if ((this.context.workerId ?? null) !== null)
-      return failure("permission_denied", "helpers cannot reconcile task workers");
+      return failure2("permission_denied", "helpers cannot reconcile task workers");
     if (view.task.workspaceId !== view.workspace.id)
-      return failure("invalid_input", "task and workspace bindings are invalid");
+      return failure2("invalid_input", "task and workspace bindings are invalid");
     try {
       if (realpathSync6(view.workspace.root) !== this.store.root)
-        return failure("invalid_input", "task view root does not match the task store");
+        return failure2("invalid_input", "task view root does not match the task store");
     } catch {
-      return failure("invalid_input", "task view root cannot be resolved");
+      return failure2("invalid_input", "task view root cannot be resolved");
     }
     const updates = [];
     const seen = new Set;
@@ -13896,7 +14133,7 @@ class WorkitCore {
     };
     for (const observation of observations) {
       if (seen.has(observation.workerId))
-        return failure("invalid_input", "worker observations must be unique");
+        return failure2("invalid_input", "worker observations must be unique");
       seen.add(observation.workerId);
       const freshTask = this.store.readTask(view.task.id);
       const freshWorkspace = this.store.readWorkspace();
@@ -13905,11 +14142,11 @@ class WorkitCore {
       if (!freshWorkspace.ok)
         return freshWorkspace;
       if (!freshWorkspace.data)
-        return failure("not_found", "workspace not found");
+        return failure2("not_found", "workspace not found");
       if (observation.taskId !== view.task.id || observation.expectedRevision !== freshTask.data.revision || observation.expectedWorkspaceRevision !== freshWorkspace.data.revision)
-        return failure("revision_conflict", "worker observation is stale");
+        return failure2("revision_conflict", "worker observation is stale");
       if (!view.task.workers.some((entry) => entry.id === observation.workerId))
-        return failure("permission_denied", "worker observation is not assigned");
+        return failure2("permission_denied", "worker observation is not assigned");
       const verified = verifyNativeWorker(this.context.nativeWorker, {
         observation: observation.observation,
         expected: { ...observation, workspaceId: view.workspace.id },
@@ -13918,7 +14155,7 @@ class WorkitCore {
       if (!verified.ok)
         return verified;
       if (!takeWorker(verified.data, binding, observation))
-        return failure("permission_denied", "worker observation authority was not retained");
+        return failure2("permission_denied", "worker observation authority was not retained");
       updates.push(observation);
     }
     const observedStates = new Map(updates.map((entry) => [entry.workerId, entry.state]));
@@ -13956,19 +14193,19 @@ class WorkitCore {
     if (!helper.ok)
       return helper;
     if (status === "paused" && task.data.status !== "active" || status === "active" && task.data.status !== "paused")
-      return failure("invalid_transition", `cannot transition ${task.data.status} to ${status}`);
+      return failure2("invalid_transition", `cannot transition ${task.data.status} to ${status}`);
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     this.fillRevisions(input, task.data, workspace.data);
     let resumeCandidate = null;
     if (status === "active" && task.data.origin) {
       if (!task.data.policy)
-        return failure("needs_input", "imported task requires a current policy");
+        return failure2("needs_input", "imported task requires a current policy");
       if (task.data.policy.policyVersion !== POLICY_VERSION)
-        return failure("needs_input", "stored policy version is unsupported; reassessment is required");
+        return failure2("needs_input", "stored policy version is unsupported; reassessment is required");
       const view = this.view(task.data);
       if (!view.ok)
         return view;
@@ -13977,20 +14214,20 @@ class WorkitCore {
         return current;
       const requirements = view.data.requirements;
       if (requirements.some((requirement) => requirement.status === "unsatisfied" || requirement.status === "unavailable"))
-        return failure("requirements_unsatisfied", "imported task requires current requirements", {
+        return failure2("requirements_unsatisfied", "imported task requires current requirements", {
           requirementIds: requirements.filter((requirement) => requirement.status === "unsatisfied" || requirement.status === "unavailable").map((requirement) => requirement.requirementId)
         });
       if (current.data.reassessmentRequired)
-        return failure("needs_input", "imported task requires destination policy reassessment");
+        return failure2("needs_input", "imported task requires destination policy reassessment");
       if (current.data.staleEvidenceIds.length)
-        return failure("needs_input", "imported task requires fresh destination evidence");
+        return failure2("needs_input", "imported task requires fresh destination evidence");
       if (current.data.blockers.some((blocker) => blocker.dependentAction === "resume" || blocker.reason === "worker state requires reconciliation"))
-        return failure("recovery_required", "imported task requires resume reconciliation");
+        return failure2("recovery_required", "imported task requires resume reconciliation");
       if (!validResumeApproval(task.data, workspace.data, input.authorityRefs ?? [], this.context))
-        return failure("permission_denied", "imported resume requires native destination approval");
+        return failure2("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
-    const blocker = status === "paused" ? workspace.data.writer ? failure("recovery_required", "writer ownership must be released first") : null : this.activeWorkerBlocker(task.data, workspace.data);
+    const blocker = status === "paused" ? workspace.data.writer ? failure2("recovery_required", "writer ownership must be released first") : null : this.activeWorkerBlocker(task.data, workspace.data);
     if (blocker)
       return blocker;
     let pauseCandidate = null;
@@ -14005,7 +14242,7 @@ class WorkitCore {
       expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
-      workspace: (workspace, context) => success(context.revision, context.revision, workspace),
+      workspace: (unchanged, context) => success(context.revision, context.revision, unchanged),
       task: (current, context) => success(context.revision, null, {
         ...current,
         status,
@@ -14026,7 +14263,7 @@ class WorkitCore {
     if (!helper.ok)
       return helper;
     if (task.data.status === "closed")
-      return failure("invalid_transition", "closed task cannot update progress");
+      return failure2("invalid_transition", "closed task cannot update progress");
     this.fillRevisions(input, task.data);
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, context) => success(context.revision, null, { ...current, progress: input.progress }), trustedNow(this.context));
     if (!changed.ok)
@@ -14041,12 +14278,12 @@ class WorkitCore {
     if (!helper.ok)
       return helper;
     if (task.data.status === "closed")
-      return failure("invalid_transition", "closed task cannot be revised");
+      return failure2("invalid_transition", "closed task cannot be revised");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const revisionBlocker = this.activeWorkerBlocker(task.data, workspace.data);
     if (revisionBlocker)
       return revisionBlocker;
@@ -14056,7 +14293,7 @@ class WorkitCore {
       expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
-      workspace: (workspace, context) => success(context.revision, context.revision, workspace),
+      workspace: (unchanged, context) => success(context.revision, context.revision, unchanged),
       task: (current, context) => success(context.revision, null, {
         ...current,
         intent: {
@@ -14081,12 +14318,12 @@ class WorkitCore {
     if (!helper.ok)
       return helper;
     if (task.data.status !== "active" && task.data.status !== "paused")
-      return failure("invalid_transition", "closed task cannot be reopened or closed again");
+      return failure2("invalid_transition", "closed task cannot be reopened or closed again");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
-      return failure("not_found", "workspace not found");
+      return failure2("not_found", "workspace not found");
     const blocker = this.activeWorkerBlocker(task.data, workspace.data);
     if (blocker)
       return blocker;
@@ -14153,13 +14390,13 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
 }, validNativeProvenance = (value, caller, expected) => {
   if (!provenanceSchema.safeParse(value).success)
     return false;
-  const provenance = value;
-  return provenance.kind === "host_observed" && provenance.host === caller.host && provenance.workerId === expected.workerId && sameValue(provenance.session, expected.session) && provenance.receipts.some((receipt) => receipt.kind === "host" && receipt.host === caller.host);
+  const observed = value;
+  return observed.kind === "host_observed" && observed.host === caller.host && observed.workerId === expected.workerId && sameValue(observed.session, expected.session) && observed.receipts.some((receipt) => receipt.kind === "host" && receipt.host === caller.host);
 }, validDispatchProvenance = (value, caller, workerId) => {
   if (!provenanceSchema.safeParse(value).success)
     return false;
-  const provenance = value;
-  return provenance.kind === "host_observed" && provenance.host === caller.host && provenance.workerId === workerId && provenance.session?.kind === "host" && provenance.session.host === caller.host && provenance.session.handle === caller.actor && provenance.receipts.some((receipt) => receipt.kind === "host" && receipt.host === caller.host);
+  const observed = value;
+  return observed.kind === "host_observed" && observed.host === caller.host && observed.workerId === workerId && observed.session?.kind === "host" && observed.session.host === caller.host && observed.session.handle === caller.actor && observed.receipts.some((receipt) => receipt.kind === "host" && receipt.host === caller.host);
 }, validResumeApproval = (task, workspace, authorityRefs, context) => authorityRefs.some((ref) => {
   if (ref.kind !== "record" || ref.collection !== "decisions")
     return false;
@@ -14174,16 +14411,16 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
   return ["design", "action"].some((purpose) => applicableDecision(task, purpose, decision.binding, workspace.root).some((candidate) => candidate.digest === decision.digest));
 }), verifyNativeWorker = (verifier, input, binding) => {
   if (!verifier)
-    return failure("permission_denied", "native worker verifier is unavailable");
+    return failure2("permission_denied", "native worker verifier is unavailable");
   let result;
   try {
     result = verifier.verifyWorker(input);
   } catch (error) {
-    return failure("permission_denied", `native worker observation failed: ${String(error)}`);
+    return failure2("permission_denied", `native worker observation failed: ${String(error)}`);
   }
   const expected = input.expected;
   if (!result.ok || !validNativeProvenance(result.data, input.caller, expected))
-    return failure("permission_denied", "native worker observation was not attested");
+    return failure2("permission_denied", "native worker observation was not attested");
   const token = {};
   verifiedWorkers.set(token, {
     taskId: expected.taskId,
@@ -14208,7 +14445,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
   return value;
 }, applyWorkerLifecycle = (input) => {
   if (!input.store || !input.authority || !input.authorityOwner)
-    return failure("invalid_input", "native worker observation preconditions are required");
+    return failure2("invalid_input", "native worker observation preconditions are required");
   const authority = takeWorker(input.authority, {
     owner: input.authorityOwner,
     store: input.store,
@@ -14216,7 +14453,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     caller: input.caller
   }, input);
   if (!authority)
-    return failure("permission_denied", "native worker observation is not verified");
+    return failure2("permission_denied", "native worker observation is not verified");
   const task = input.store.readTask(input.taskId);
   if (!task.ok)
     return task;
@@ -14224,35 +14461,35 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
   if (!workspace.ok)
     return workspace;
   if (!workspace.data)
-    return failure("not_found", "workspace not found");
+    return failure2("not_found", "workspace not found");
   if (task.data.workspaceId !== authority.workspaceId || workspace.data.id !== authority.workspaceId)
-    return failure("recovery_required", "worker workspace binding is invalid");
+    return failure2("recovery_required", "worker workspace binding is invalid");
   const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
   if (!entry)
-    return failure("not_found", "worker not found");
+    return failure2("not_found", "worker not found");
   if (task.data.status === "closed")
-    return failure("invalid_transition", "closed task cannot observe workers");
+    return failure2("invalid_transition", "closed task cannot observe workers");
   if (task.data.status === "paused" && (input.state === "running" || input.state === "cancelling"))
-    return failure("invalid_transition", "paused task cannot run a worker");
+    return failure2("invalid_transition", "paused task cannot run a worker");
   const notStarted = input.dispatch === true;
   if (notStarted && entry.data.state === "stopped" && input.session === null)
     return success(task.data.revision, workspace.data.revision, entry);
   if (notStarted && (input.state !== "stopped" || input.session !== null))
-    return failure("invalid_input", "a never-dispatched worker stops with no session");
+    return failure2("invalid_input", "a never-dispatched worker stops with no session");
   if (notStarted && entry.data.session !== null)
-    return failure("invalid_transition", "worker already has an observed session");
+    return failure2("invalid_transition", "worker already has an observed session");
   if (notStarted && !["dispatching", "cancelling"].includes(entry.data.state))
-    return failure("invalid_transition", "worker launch was not claimed");
+    return failure2("invalid_transition", "worker launch was not claimed");
   if (input.report && input.state !== "stopped")
-    return failure("invalid_input", "worker reports require a stopped worker");
+    return failure2("invalid_input", "worker reports require a stopped worker");
   if ((input.state === "running" || input.state === "cancelling" || input.state === "stopped" && !notStarted) && !input.session)
-    return failure("invalid_input", "running worker observations require a session");
+    return failure2("invalid_input", "running worker observations require a session");
   if (entry.data.session && !sameValue(entry.data.session, input.session))
-    return failure("permission_denied", "worker session does not match its assignment");
+    return failure2("permission_denied", "worker session does not match its assignment");
   if (input.state !== "running" && entry.data.state === "assigned" && input.state !== "stopped")
-    return failure("invalid_transition", "worker has not started");
+    return failure2("invalid_transition", "worker has not started");
   if (input.state === "running" && entry.data.state === "stopped")
-    return failure("invalid_transition", "stopped worker cannot run again");
+    return failure2("invalid_transition", "stopped worker cannot run again");
   const terminalCancel = entry.data.state === "cancelling" && input.state === "running";
   const nextEntry = {
     ...entry,
@@ -14286,7 +14523,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
   if (!changed.ok)
     return changed;
   const updated = changed.data.task.workers.find((candidate) => candidate.id === input.workerId);
-  return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure("recovery_required", "worker disappeared during lifecycle observation");
+  return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during lifecycle observation");
 }, refsWithinScope = (refs, scope) => refs.every((ref) => ref.kind !== "file" || bindingCovers(scope, { description: "", paths: [ref.path], exclusions: [] })), trustedNow = (context) => typeof context.now === "function" ? context.now() : context.now, mapRef = (ref, ids) => {
   if (ref.kind !== "record")
     return ref;
@@ -14360,13 +14597,13 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
   ])
     allocate(entry.id);
   const fresh = (id) => allocate(id);
-  const provenance = importedProvenance(context);
+  const imported = importedProvenance(context);
   const remap = (ref) => mapRef(ref, ids);
   const intent = {
     ...source.intent,
     id: fresh(source.intent.id),
     recordedAt: timestamp,
-    provenance,
+    provenance: imported,
     data: rewriteRecordRefs(source.intent.data, intentSchema, remap)
   };
   const assessments = source.assessments.map((entry) => {
@@ -14375,7 +14612,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
       ...entry,
       id: fresh(entry.id),
       recordedAt: timestamp,
-      provenance,
+      provenance: imported,
       data: rewriteRecordRefs(data, assessmentSchema, remap)
     };
   });
@@ -14383,14 +14620,14 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     ...entry,
     id: fresh(entry.id),
     recordedAt: timestamp,
-    provenance,
+    provenance: imported,
     data: rewriteRecordRefs(entry.data, evidenceSchema, remap)
   }));
   const decisions = source.decisions.map((entry) => ({
     ...entry,
     id: fresh(entry.id),
     recordedAt: timestamp,
-    provenance
+    provenance: imported
   }));
   const findings = source.findings.map((entry) => {
     const data = rewriteRecordRefs(entry.data, findingSchema, remap);
@@ -14398,7 +14635,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
       ...entry,
       id: fresh(entry.id),
       recordedAt: timestamp,
-      provenance,
+      provenance: imported,
       data: {
         ...data,
         resolution: data.resolution ? {
@@ -14413,7 +14650,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     ...entry,
     id: fresh(entry.id),
     recordedAt: timestamp,
-    provenance,
+    provenance: imported,
     data: {
       ...entry.data,
       state: "stopped",
@@ -14783,7 +15020,7 @@ var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapa
     const listed = new TaskStore(root).listTasks();
     if (!listed.ok)
       return null;
-    const tasks = listed.data.filter((task) => task.id !== excludedTaskId && task.status !== "closed" && !(task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "cursor" && task.intent.provenance.session.handle === session) && !task.workers.some((worker) => worker.data.session?.kind === "host" && worker.data.session.host === "cursor" && worker.data.session.handle === session)).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, 3);
+    const tasks = listed.data.filter((task) => task.id !== excludedTaskId && task.status !== "closed" && !(task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "cursor" && task.intent.provenance.session.handle === session) && !task.workers.some((worker) => worker.data.session?.kind === "host" && worker.data.session.host === "cursor" && worker.data.session.handle === session)).toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, 3);
     if (tasks.length === 0)
       return null;
     const quote = (value) => JSON.stringify(value.replace(/[<>]/g, " ").slice(0, 120));
@@ -14803,9 +15040,9 @@ ${tasks.map((task) => `- ${task.id} [${task.status}; source ${task.intent.proven
     const parentId = input.parent_conversation_id;
     const observation = expected && input.subagent_id ? { subagent_id: subagentId, parent_conversation_id: parentId } : null;
     if (!observation || !subagentId || !parentId || caller.host !== "cursor" || caller.actor !== parentId)
-      return failure("permission_denied", "native subagent observation is unavailable");
+      return failure2("permission_denied", "native subagent observation is unavailable");
     if (expected.session?.kind !== "host" || expected.session.host !== "cursor" || expected.session.handle !== subagentId)
-      return failure("permission_denied", "native subagent identity does not match");
+      return failure2("permission_denied", "native subagent identity does not match");
     return success(null, null, {
       kind: "host_observed",
       host: "cursor",