@voltro/plan 0.83.1 → 0.85.0

package/dist/index.js

@@ -1,7 +1,7 @@
-import { Either as e, ParseResult as t, Schema as n } from "effect";
+import { Cause as e, Exit as t, Schema as n, SchemaIssue as r } from "effect";
 //#region src/ids.ts
-var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
-	if (!r.test(e)) throw Error(`plan id prefix "${e}" is not 2 to 10 capital letters or digits, starting with a letter`);
+var i = /^[A-Z][A-Z0-9]{1,9}$/, a = (e) => {
+	if (!i.test(e)) throw Error(`plan id prefix "${e}" is not 2 to 10 capital letters or digits, starting with a letter`);
 	return {
 		prefix: e,
 		plan: RegExp(`^${e}-PLAN-[0-9]{2}$`),
@@ -15,24 +15,24 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		closureRun: RegExp(`^CLR-${e}-[0-9]{2}-[0-9]{3}$`),
 		certificate: RegExp(`^CRT-${e}-[0-9]{2}-[0-9]{3}$`)
 	};
-}, a = (e) => {
+}, o = (e) => {
 	let t = /-(?:PLAN-)?([0-9]{2})(?:-|$)/.exec(e);
 	return t === null ? null : t[1];
-}, o = (e, t) => {
+}, s = (e, t) => {
 	let n = RegExp(`(?:^|-)(${e.prefix}-[0-9]{2}-[0-9]{3})(?:-|$)`).exec(t);
 	return n === null ? null : n[1];
-}, s = (e) => JSON.stringify(c(e)), c = (e) => {
-	if (Array.isArray(e)) return e.map(c);
+}, c = (e) => JSON.stringify(l(e)), l = (e) => {
+	if (Array.isArray(e)) return e.map(l);
 	if (typeof e == "object" && e) {
 		let t = {};
 		for (let n of Object.keys(e).sort()) {
 			let r = e[n];
-			r !== void 0 && (t[n] = c(r));
+			r !== void 0 && (t[n] = l(r));
 		}
 		return t;
 	}
 	return e;
-}, l = new Uint32Array([
+}, u = new Uint32Array([
 	1116352408,
 	1899447441,
 	3049323471,
@@ -97,7 +97,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	2756734187,
 	3204031479,
 	3329325298
-]), u = (e) => {
+]), d = (e) => {
 	let t = new TextEncoder().encode(e), n = t.length * 8, r = new Uint8Array(t.length + 9 + 63 >> 6 << 6);
 	r.set(t), r[t.length] = 128;
 	let i = new DataView(r.buffer);
@@ -118,7 +118,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 			let t = s(o[e - 15], 7) ^ s(o[e - 15], 18) ^ o[e - 15] >>> 3, n = s(o[e - 2], 17) ^ s(o[e - 2], 19) ^ o[e - 2] >>> 10;
 			o[e] = o[e - 16] + t + o[e - 7] + n >>> 0;
 		}
-		let [t, n, r, c, u, d, f, p] = [
+		let [t, n, r, c, l, d, f, p] = [
 			a[0],
 			a[1],
 			a[2],
@@ -129,20 +129,20 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 			a[7]
 		];
 		for (let e = 0; e < 64; e++) {
-			let i = p + (s(u, 6) ^ s(u, 11) ^ s(u, 25)) + (u & d ^ ~u & f) + l[e] + o[e] >>> 0, a = (s(t, 2) ^ s(t, 13) ^ s(t, 22)) + (t & n ^ t & r ^ n & r) >>> 0;
-			p = f, f = d, d = u, u = c + i >>> 0, c = r, r = n, n = t, t = i + a >>> 0;
+			let i = p + (s(l, 6) ^ s(l, 11) ^ s(l, 25)) + (l & d ^ ~l & f) + u[e] + o[e] >>> 0, a = (s(t, 2) ^ s(t, 13) ^ s(t, 22)) + (t & n ^ t & r ^ n & r) >>> 0;
+			p = f, f = d, d = l, l = c + i >>> 0, c = r, r = n, n = t, t = i + a >>> 0;
 		}
-		a[0] = a[0] + t >>> 0, a[1] = a[1] + n >>> 0, a[2] = a[2] + r >>> 0, a[3] = a[3] + c >>> 0, a[4] = a[4] + u >>> 0, a[5] = a[5] + d >>> 0, a[6] = a[6] + f >>> 0, a[7] = a[7] + p >>> 0;
+		a[0] = a[0] + t >>> 0, a[1] = a[1] + n >>> 0, a[2] = a[2] + r >>> 0, a[3] = a[3] + c >>> 0, a[4] = a[4] + l >>> 0, a[5] = a[5] + d >>> 0, a[6] = a[6] + f >>> 0, a[7] = a[7] + p >>> 0;
 	}
 	return [...a].map((e) => e.toString(16).padStart(8, "0")).join("");
-}, d = (e) => `sha256:${u(s(e))}`, f = n.String.pipe(n.minLength(1)), p = n.String.pipe(n.pattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/)), m = n.String.pipe(n.pattern(/^sha256:[a-f0-9]{64}$/)), h = (e) => n.Array(e).pipe(n.filter((e) => new Set(e).size === e.length || "items are listed twice")), g = (e) => n.Array(e).pipe(n.minItems(1)), _ = n.String.pipe(n.pattern(/^[a-z0-9]+(?:[.:/-][a-z0-9]+)*$/)), v = [
+}, f = (e) => `sha256:${d(c(e))}`, p = n.String.pipe(n.check(n.isMinLength(1))), m = n.String.pipe(n.check(n.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/))), h = n.String.pipe(n.check(n.isPattern(/^sha256:[a-f0-9]{64}$/))), g = (e) => n.Array(e).pipe(n.check(n.makeFilter((e) => new Set(e).size === e.length || "items are listed twice"))), _ = (e) => n.Array(e).pipe(n.check(n.isMinLength(1))), v = n.String.pipe(n.check(n.isPattern(/^[a-z0-9]+(?:[.:/-][a-z0-9]+)*$/))), y = [
 	"proposed",
 	"ready",
 	"active",
 	"blocked",
 	"verified",
 	"closed"
-], y = [
+], b = [
 	"proposed",
 	"decomposing",
 	"ready",
@@ -151,7 +151,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	"closure-1",
 	"closure-2",
 	"complete"
-], b = [
+], x = [
 	"commit",
 	"typecheck",
 	"unit-test",
@@ -173,7 +173,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	"research",
 	"review",
 	"artifact"
-], x = [
+], ee = [
 	"P0",
 	"P1",
 	"P2",
@@ -189,134 +189,168 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	"documentation",
 	"research",
 	"tooling"
-], C = (e) => n.String.pipe(n.pattern(e)), w = (e) => {
-	let t = e.grammar, r = h(C(t.evidence)), i = n.Struct({
+], C = (e) => n.String.pipe(n.check(n.isPattern(e))), w = (e) => {
+	let t = e.grammar, r = g(C(t.evidence)), i = n.Struct({
 		id: C(t.source),
-		uri: f,
-		locator: f,
-		excerpt: f,
-		lineHint: n.optional(n.Int.pipe(n.greaterThanOrEqualTo(1))),
-		contentHash: m,
-		disposition: n.Literal("owned-by", "referenced-by", "decision", "non-goal"),
-		targetId: n.optional(n.Union(C(t.workItem), C(t.adr)))
+		uri: p,
+		locator: p,
+		excerpt: p,
+		lineHint: n.optional(n.Int.pipe(n.check(n.isGreaterThanOrEqualTo(1)))),
+		contentHash: h,
+		disposition: n.Literals([
+			"owned-by",
+			"referenced-by",
+			"decision",
+			"non-goal"
+		]),
+		targetId: n.optional(n.Union([C(t.workItem), C(t.adr)]))
 	}), a = n.Struct({
 		id: C(t.acceptance),
-		statement: f,
-		status: n.Literal("pending", "passed", "failed"),
+		statement: p,
+		status: n.Literals([
+			"pending",
+			"passed",
+			"failed"
+		]),
 		evidenceRefs: r
 	}), o = n.Struct({
-		rationale: f,
-		reviewer: f,
-		expiresAt: p,
-		compensatingControl: f
+		rationale: p,
+		reviewer: p,
+		expiresAt: m,
+		compensatingControl: p
 	}), s = n.Struct({
 		id: C(t.requirement),
-		statement: f,
-		kinds: g(n.Literal(...b)),
-		status: n.Literal("open", "satisfied", "waived"),
+		statement: p,
+		kinds: _(n.Literals(x)),
+		status: n.Literals([
+			"open",
+			"satisfied",
+			"waived"
+		]),
 		evidenceRefs: r,
 		waiver: n.optional(o)
 	}), c = n.Struct({
-		capabilities: n.Array(f),
-		journeys: n.Array(f),
-		adrs: h(C(t.adr)),
-		risks: n.Array(f),
-		relatedTo: h(C(t.workItem))
+		capabilities: n.Array(p),
+		journeys: n.Array(p),
+		adrs: g(C(t.adr)),
+		risks: n.Array(p),
+		relatedTo: g(C(t.workItem))
 	}), l = n.Struct({
-		reason: f,
-		owner: f,
-		nextAction: f,
-		recheckTrigger: f,
-		since: p
+		reason: p,
+		owner: p,
+		nextAction: p,
+		recheckTrigger: p,
+		since: m
 	}), u = n.Struct({
-		from: n.NullOr(n.Literal(...v)),
-		to: n.Literal(...v),
-		reason: f,
-		actor: f,
-		at: p,
+		from: n.NullOr(n.Literals(y)),
+		to: n.Literals(y),
+		reason: p,
+		actor: p,
+		at: m,
 		evidenceRefs: r
 	}), d = n.Struct({
 		id: C(t.workItem),
-		title: f,
+		title: p,
 		ownerPlan: C(t.plan),
-		slice: f,
-		kind: n.Literal(...S),
-		priority: n.Literal(...x),
+		slice: p,
+		kind: n.Literals(S),
+		priority: n.Literals(ee),
 		mandatory: n.Boolean,
-		status: n.Literal(...v),
-		owners: n.Array(f),
-		repos: g(n.Literal(...e.repos)),
-		sourceRefs: g(i),
-		dependsOn: h(C(t.workItem)),
+		status: n.Literals(y),
+		owners: n.Array(p),
+		repos: _(n.Literals(e.repos)),
+		sourceRefs: _(i),
+		dependsOn: g(C(t.workItem)),
 		links: c,
-		acceptance: g(a),
-		evidenceRequirements: g(s),
+		acceptance: _(a),
+		evidenceRequirements: _(s),
 		evidenceRefs: r,
-		impactTags: g(_),
-		statusHistory: g(u),
+		impactTags: _(v),
+		statusHistory: _(u),
 		blocker: n.optional(l),
 		supersededBy: n.optional(C(t.workItem)),
-		createdAt: p,
-		updatedAt: p
-	}), w = n.Struct({
+		createdAt: m,
+		updatedAt: m
+	}), f = n.Struct({
 		id: C(t.plan),
-		number: n.String.pipe(n.pattern(/^[0-9]{2}$/)),
-		title: f,
-		source: f,
-		sourceRevision: m,
-		status: n.Literal(...y),
+		number: n.String.pipe(n.check(n.isPattern(/^[0-9]{2}$/))),
+		title: p,
+		source: p,
+		sourceRevision: h,
+		status: n.Literals(b),
 		decompositionComplete: n.Boolean,
-		updatedAt: p
+		updatedAt: m
+	}), w = n.Struct({
+		rulesVersion: p,
+		sourceRevision: h,
+		blockKinds: n.Array(p),
+		extractedAt: m
 	}), T = n.Struct({
-		rulesVersion: f,
-		sourceRevision: m,
-		blockKinds: n.Array(f),
-		extractedAt: p
-	}), E = n.Struct({
 		extractedSources: n.Int,
 		disposedSources: n.Int,
 		unmatchedSources: n.Int,
 		duplicateSources: n.Int,
-		sourceIdsHash: m,
-		result: n.Literal("complete", "incomplete")
+		sourceIdsHash: h,
+		result: n.Literals(["complete", "incomplete"])
 	});
 	return n.Struct({
 		schemaVersion: n.Literal(e.instanceVersion),
-		plan: w,
-		extraction: T,
+		plan: f,
+		extraction: w,
 		workItems: n.Array(d),
-		coverage: E
+		coverage: T
 	});
 }, T = (e) => n.Struct({
 	id: C(e.grammar.evidence),
-	kind: n.Literal(...b),
-	title: f,
-	uri: f,
-	fingerprint: n.optional(m),
-	result: n.Literal("passed", "failed", "informational"),
-	subjectRefs: n.Array(f),
-	command: n.optional(f),
-	environment: n.optional(f),
-	producedBy: f,
-	reviewedBy: n.optional(f),
-	observedAt: p,
-	idempotencyKey: n.optional(f)
+	kind: n.Literals(x),
+	title: p,
+	uri: p,
+	fingerprint: n.optional(h),
+	result: n.Literals([
+		"passed",
+		"failed",
+		"informational"
+	]),
+	subjectRefs: n.Array(p),
+	command: n.optional(p),
+	environment: n.optional(p),
+	producedBy: p,
+	reviewedBy: n.optional(p),
+	observedAt: m,
+	idempotencyKey: n.optional(p)
 }), E = (e) => n.Struct({
 	id: C(e.grammar.finding),
-	title: f,
-	severity: n.Literal("critical", "high", "medium", "low"),
-	status: n.Literal("open", "resolved", "accepted-risk"),
-	source: n.Literal("contract-reconciliation", "adversarial-audit", "test", "incident", "research", "review", "production"),
-	targetWorkItems: g(C(e.grammar.workItem)),
-	impactTags: n.Array(f),
-	evidenceRefs: n.optional(h(C(e.grammar.evidence))),
-	openedAt: p,
-	resolvedAt: n.optional(p)
+	title: p,
+	severity: n.Literals([
+		"critical",
+		"high",
+		"medium",
+		"low"
+	]),
+	status: n.Literals([
+		"open",
+		"resolved",
+		"accepted-risk"
+	]),
+	source: n.Literals([
+		"contract-reconciliation",
+		"adversarial-audit",
+		"test",
+		"incident",
+		"research",
+		"review",
+		"production"
+	]),
+	targetWorkItems: _(C(e.grammar.workItem)),
+	impactTags: n.Array(p),
+	evidenceRefs: n.optional(g(C(e.grammar.evidence))),
+	openedAt: m,
+	resolvedAt: n.optional(m)
 }), D = {
 	security: 0,
 	error: 1,
 	warning: 2
-}, O = (e, t) => (e ?? "") < (t ?? "") ? -1 : +((e ?? "") > (t ?? "")), k = (e) => [...e].sort((e, t) => D[e.severity] - D[t.severity] || O(e.locator.plan, t.locator.plan) || O(e.locator.workItem, t.locator.workItem) || O(e.ruleId, t.ruleId) || O(e.locator.file, t.locator.file) || O(e.locator.path, t.locator.path) || O(e.message, t.message)), ee = (e, t = !1) => e.some((e) => e.severity !== "warning" || t), A = {
+}, O = (e, t) => (e ?? "") < (t ?? "") ? -1 : +((e ?? "") > (t ?? "")), te = (e) => [...e].sort((e, t) => D[e.severity] - D[t.severity] || O(e.locator.plan, t.locator.plan) || O(e.locator.workItem, t.locator.workItem) || O(e.ruleId, t.ruleId) || O(e.locator.file, t.locator.file) || O(e.locator.path, t.locator.path) || O(e.message, t.message)), ne = (e, t = !1) => e.some((e) => e.severity !== "warning" || t), k = {
 	proposed: ["ready", "blocked"],
 	ready: [
 		"active",
@@ -335,9 +369,12 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	],
 	verified: ["closed", "active"],
 	closed: ["active"]
-}, j = /* @__PURE__ */ new Set(["verified", "closed"]), M = (e, t) => {
+}, A = /* @__PURE__ */ new Set(["verified", "closed"]), j = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
-	for (let e of t) if (e.status === "open") for (let t of e.targetWorkItems) n.set(t, [...n.get(t) ?? [], e]);
+	for (let e of t) if (e.status === "open") for (let t of e.targetWorkItems) {
+		let r = n.get(t);
+		r === void 0 ? n.set(t, [e]) : r.push(e);
+	}
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) for (let e of new Set(t.subjectRefs)) {
 		let n = r.get(e);
@@ -348,50 +385,65 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		bySubject: r,
 		openFindings: n
 	};
-}, N = (e, t, n, r) => e.result === "passed" && e.subjectRefs.includes(n) && (r === void 0 || r.includes(e.kind)) && Date.parse(e.observedAt) >= Date.parse(t.updatedAt), P = (e, t, n, r) => {
-	let i = [], a = t.bySubject.get(e.id) ?? [], o = (n, r) => n.some((n) => {
+}, M = (e, t, n, r) => e.result === "passed" && e.subjectRefs.includes(n) && (r === void 0 || r.includes(e.kind)) && Date.parse(e.observedAt) >= Date.parse(t.updatedAt), N = (e, t, n, r) => {
+	let i = [], a = t.bySubject.get(e.id) ?? [], o;
+	if (e.acceptance.length > 4 || e.acceptance.length + e.evidenceRequirements.length > 4 && e.acceptance.length + e.evidenceRequirements.filter((e) => e.status !== "waived").length > 4) {
+		let t = /* @__PURE__ */ new Set([...e.acceptance.map((e) => e.id), ...e.evidenceRequirements.filter((e) => e.status !== "waived").map((e) => e.id)]);
+		o = /* @__PURE__ */ new Map();
+		let n = Date.parse(e.updatedAt);
+		for (let e of a) if (e.result === "passed" && Date.parse(e.observedAt) >= n) for (let n of e.subjectRefs) {
+			if (!t.has(n)) continue;
+			let r = o.get(n);
+			r === void 0 ? o.set(n, /* @__PURE__ */ new Set([e.kind])) : r.add(e.kind);
+		}
+	}
+	let s = (t, n) => {
+		if (o === void 0) return a.some((r) => M(r, e, t, n));
+		let r = o.get(t);
+		return r !== void 0 && (n === void 0 || n.some((e) => r.has(e)));
+	}, c = (n, r) => n.some((n) => {
 		let i = t.evidence.get(n);
-		return i !== void 0 && N(i, e, e.id, r);
+		return i !== void 0 && M(i, e, e.id, r);
 	});
-	for (let t of e.acceptance) !a.some((n) => N(n, e, t.id)) && !(t.status === "passed" && o(t.evidenceRefs)) && i.push(`acceptance ${t.id} has no passing evidence`);
-	for (let t of e.evidenceRequirements) t.status === "waived" ? (t.waiver === void 0 || Date.parse(t.waiver.expiresAt) <= r.now().getTime()) && i.push(`the waiver of ${t.id} has expired`) : !a.some((n) => N(n, e, t.id, t.kinds)) && !o(t.evidenceRefs, t.kinds) && i.push(`requirement ${t.id} has no passing ${t.kinds.join("/")} evidence`);
+	for (let t of e.acceptance) !s(t.id) && !(t.status === "passed" && c(t.evidenceRefs)) && i.push(`acceptance ${t.id} has no passing evidence`);
+	for (let t of e.evidenceRequirements) t.status === "waived" ? (t.waiver === void 0 || Date.parse(t.waiver.expiresAt) <= r.now().getTime()) && i.push(`the waiver of ${t.id} has expired`) : !s(t.id, t.kinds) && !c(t.evidenceRefs, t.kinds) && i.push(`requirement ${t.id} has no passing ${t.kinds.join("/")} evidence`);
 	for (let n of t.openFindings.get(e.id) ?? []) i.push(`finding ${n.id} is open`);
 	for (let t of e.dependsOn) {
 		let e = n(t);
 		e !== "verified" && e !== "closed" && i.push(`dependency ${t} is ${e ?? "missing"}`);
 	}
 	return i;
-}, F = (e, t) => t.length === 0 ? "verified" : j.has(e.status) ? "active" : e.status, I = "voltro-plan-closure/v1", L = n.String.pipe(n.minLength(1)), R = n.String.pipe(n.pattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/)), te = n.String.pipe(n.pattern(/^sha256:[a-f0-9]{64}$/)), z = (e) => {
-	let t = e.grammar, r = (e) => n.String.pipe(n.pattern(e)), i = n.Struct({
+}, P = (e, t) => t.length === 0 ? "verified" : A.has(e.status) ? "active" : e.status, F = "voltro-plan-closure/v1", I = n.String.pipe(n.check(n.isMinLength(1))), L = n.String.pipe(n.check(n.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/))), R = n.String.pipe(n.check(n.isPattern(/^sha256:[a-f0-9]{64}$/))), z = (e) => {
+	let t = e.grammar, r = (e) => n.String.pipe(n.check(n.isPattern(e))), i = n.Struct({
 		id: r(t.closureRun),
-		pass: n.Literal("contract", "adversarial"),
-		reviewer: L,
-		reviewContext: L,
-		planRevision: te,
-		completedAt: R,
+		pass: n.Literals(["contract", "adversarial"]),
+		reviewer: I,
+		reviewContext: I,
+		planRevision: R,
+		completedAt: L,
 		findingRefs: n.Array(r(t.finding)),
-		result: n.Literal("passed", "findings"),
-		toolVersion: L
+		result: n.Literals(["passed", "findings"]),
+		toolVersion: I
 	}), a = n.Struct({
 		id: r(t.certificate),
 		plan: r(t.plan),
-		planRevision: te,
+		planRevision: R,
 		workItems: n.Array(r(t.workItem)),
 		evidenceRefs: n.Array(r(t.evidence)),
-		closureRuns: n.Array(r(t.closureRun)).pipe(n.itemsCount(2)),
-		confirmedBy: L,
-		issuedAt: R,
-		toolVersion: L
+		closureRuns: n.Array(r(t.closureRun)).pipe(n.check(n.isBetweenLength(2, 2))),
+		confirmedBy: I,
+		issuedAt: L,
+		toolVersion: I
 	});
 	return n.Struct({
-		schemaVersion: n.Literal(I),
+		schemaVersion: n.Literal(F),
 		plan: r(t.plan),
 		runs: n.Array(i),
 		certificates: n.Array(a)
 	});
 }, B = (e, t, n, r = () => void 0, i = /* @__PURE__ */ new Map()) => {
 	let a = new Set(e.workItems.map((e) => e.id));
-	return d({
+	return f({
 		instance: e,
 		dependencies: [...new Set(e.workItems.flatMap((e) => e.dependsOn).filter((e) => !a.has(e)))].sort().map((e) => {
 			let t = r(e);
@@ -423,7 +475,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		related: [],
 		nextAction: n
 	}
-}), U = (e, t) => `${e}${String(Math.max(0, ...t.filter((t) => t.startsWith(e)).map((t) => Number(t.slice(e.length)))) + 1).padStart(3, "0")}`, ne = (e, t, n, r, i, a, o, s) => {
+}), U = (e, t) => `${e}${String(Math.max(0, ...t.filter((t) => t.startsWith(e)).map((t) => Number(t.slice(e.length)))) + 1).padStart(3, "0")}`, re = (e, t, n, r, i, a, o, s) => {
 	let c = t.plan.id, l = t.workItems.filter((e) => e.mandatory && e.supersededBy === void 0), u = l.filter((e) => i(e.id) !== "verified" && i(e.id) !== "closed");
 	if (s.findings.length === 0 && u.length > 0) return H("closure/unverified-items", `${u.length} of ${l.length} mandatory items of ${c} are not verified (${u.slice(0, 3).map((e) => e.id).join(", ")}${u.length > 3 ? ", …" : ""})`, "Verify every mandatory item first: voltro plan status, voltro plan evidence add.", c);
 	let d = new Set(t.workItems.map((e) => e.id)), f = o.filter((e) => e.status === "open" && e.targetWorkItems.some((e) => d.has(e)));
@@ -463,7 +515,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	return {
 		outcome: "recorded",
 		file: {
-			schemaVersion: I,
+			schemaVersion: F,
 			plan: c,
 			runs: [...p, h],
 			certificates: [...n?.certificates ?? [], ...g === null ? [] : [g]]
@@ -478,27 +530,34 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	locator: r,
 	related: [...a].sort(),
 	nextAction: i
-}), G = (r, i, a, o) => {
-	let s = n.decodeUnknownEither(i, {
+}), ie = r.makeFormatterStandardSchemaV1(), G = (r, i, a, o) => {
+	let s = n.decodeUnknownExit(i, {
 		onExcessProperty: "error",
 		errors: "all"
 	}), c = [];
 	for (let n of r) {
 		let r = s(n.content);
-		if (e.isRight(r)) {
+		if (t.isSuccess(r)) {
 			c.push({
 				file: n.file,
-				value: r.right
+				value: r.value
 			});
 			continue;
 		}
-		for (let e of t.ArrayFormatter.formatErrorSync(r.left)) o.push(W("schema/invalid", "error", `${a}: ${e.message}`, {
-			file: n.file,
-			path: e.path.join(".") || "(root)"
-		}, "Correct the field to the v1 contract; unknown fields are not allowed."));
+		let i = e.findErrorOption(r.cause), l = i._tag === "Some" ? ie(i.value.issue).issues : [{
+			message: e.pretty(r.cause),
+			path: []
+		}];
+		for (let e of l) {
+			let t = (e.path ?? []).map((e) => String(typeof e == "object" ? e.key : e));
+			o.push(W("schema/invalid", "error", `${a}: ${e.message}`, {
+				file: n.file,
+				path: t.join(".") || "(root)"
+			}, "Correct the field to the v1 contract; unknown fields are not allowed."));
+		}
 	}
 	return c;
-}, re = [
+}, ae = [
 	["private key", /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
 	["Stripe key", /\b[sr]k_(live|test)_[A-Za-z0-9]{16,}/],
 	["GitHub token", /\bgh[pousr]_[A-Za-z0-9]{30,}/],
@@ -506,7 +565,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	["Slack token", /\bxox[abprs]-[A-Za-z0-9-]{10,}/],
 	["bearer token", /\bBearer\s+[A-Za-z0-9._~+/-]{20,}/]
 ], K = (e, t, n, r) => {
-	if (typeof e == "string") for (let [i, a] of re) a.test(e) && r.push(W("security/secret", "security", `a ${i} is in the plan artefact`, {
+	if (typeof e == "string") for (let [i, a] of ae) a.test(e) && r.push(W("security/secret", "security", `a ${i} is in the plan artefact`, {
 		file: t,
 		path: n
 	}, "Remove the secret, rotate it, and reference where it is kept instead."));
@@ -528,7 +587,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	};
 	for (let n of [...e.keys()].sort()) t.has(n) || r(n);
 	return [...n.values()].sort((e, t) => e.join(">") < t.join(">") ? -1 : 1);
-}, ie = (e) => {
+}, oe = (e) => {
 	let { shape: t, clock: n } = e, r = t.grammar, i = [];
 	for (let t of [
 		...e.instances,
@@ -536,7 +595,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		...e.findings ?? [],
 		...e.closures ?? []
 	]) K(t.content, t.file, "", i);
-	let s = G(e.instances, w(t), "plan instance", i).map(({ file: e, value: t }) => ({
+	let a = G(e.instances, w(t), "plan instance", i).map(({ file: e, value: t }) => ({
 		file: e,
 		instance: t
 	})), c = (e.evidence ?? []).flatMap((e) => G(Array.isArray(e.content) ? e.content.map((t, n) => ({
@@ -546,53 +605,53 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		file: `${e.file}#${n}`,
 		content: t
 	})) : [e], E(t), "finding", i).map((e) => e.value)), u = /* @__PURE__ */ new Map(), d = /* @__PURE__ */ new Map(), f = /* @__PURE__ */ new Map();
-	for (let { file: t, instance: n } of s) {
-		let s = n.plan;
-		u.has(s.id) && i.push(W("identity/duplicate-plan", "error", `${s.id} is declared in two files`, {
+	for (let { file: t, instance: n } of a) {
+		let a = n.plan;
+		u.has(a.id) && i.push(W("identity/duplicate-plan", "error", `${a.id} is declared in two files`, {
 			file: t,
-			plan: s.id
-		}, "Keep one instance file per plan.", [u.get(s.id)])), u.set(s.id, t), a(s.id) !== s.number && i.push(W("identity/plan-number", "error", `${s.id} has number ${s.number}`, {
+			plan: a.id
+		}, "Keep one instance file per plan.", [u.get(a.id)])), u.set(a.id, t), o(a.id) !== a.number && i.push(W("identity/plan-number", "error", `${a.id} has number ${a.number}`, {
 			file: t,
-			plan: s.id,
+			plan: a.id,
 			path: "plan.number"
 		}, "Make the number match the plan id."));
 		for (let e of n.workItems) {
 			let n = {
 				file: t,
-				plan: s.id,
+				plan: a.id,
 				workItem: e.id
 			};
 			d.has(e.id) ? i.push(W("identity/duplicate-work-item", "error", `${e.id} is declared twice`, n, "Give the second item its own id; ids are never reused.", [d.get(e.id).file])) : d.set(e.id, {
 				file: t,
 				item: e
-			}), (e.ownerPlan !== s.id || a(e.id) !== s.number) && i.push(W("identity/owner-mismatch", "error", `${e.id} is owned by ${e.ownerPlan} but lives in ${s.id}`, n, "Move the item to its plan’s file or correct ownerPlan."));
+			}), (e.ownerPlan !== a.id || o(e.id) !== a.number) && i.push(W("identity/owner-mismatch", "error", `${e.id} is owned by ${e.ownerPlan} but lives in ${a.id}`, n, "Move the item to its plan’s file or correct ownerPlan."));
 			let c = [
 				...e.acceptance.map((e) => e.id),
 				...e.evidenceRequirements.map((e) => e.id),
 				...e.sourceRefs.map((e) => e.id)
 			];
-			for (let t of c) o(r, t) !== e.id && i.push(W("identity/child-id", "error", `${t} does not belong to ${e.id}`, n, `Number it under ${e.id}.`));
+			for (let t of c) s(r, t) !== e.id && i.push(W("identity/child-id", "error", `${t} does not belong to ${e.id}`, n, `Number it under ${e.id}.`));
 			for (let t of e.sourceRefs) f.has(t.id) && i.push(W("source/duplicate", "error", `source ${t.id} is disposed twice`, n, "Dispose each source block exactly once.", [f.get(t.id)])), f.set(t.id, e.id), t.disposition !== "owned-by" && t.targetId === void 0 && i.push(W("source/missing-target", "error", `source ${t.id} is ${t.disposition} without a target`, {
 				...n,
 				path: `sourceRefs.${t.id}`
 			}, "Name the work item or decision it points to."));
 		}
 		if (e.sources !== void 0) {
-			let r = e.sources.get(s.source);
-			r == null ? i.push(W("source/missing", "error", `${s.id}'s source ${s.source} cannot be read`, {
+			let r = e.sources.get(a.source);
+			r == null ? i.push(W("source/missing", "error", `${a.id}'s source ${a.source} cannot be read`, {
 				file: t,
-				plan: s.id,
+				plan: a.id,
 				path: "plan.source"
-			}, "Restore the source or point the plan at it.")) : (r !== s.sourceRevision || r !== n.extraction.sourceRevision) && i.push(W("source/stale", "error", `${s.source} changed since ${s.id} was decomposed (${s.sourceRevision.slice(0, 19)}… → ${r.slice(0, 19)}…)`, {
+			}, "Restore the source or point the plan at it.")) : (r !== a.sourceRevision || r !== n.extraction.sourceRevision) && i.push(W("source/stale", "error", `${a.source} changed since ${a.id} was decomposed (${a.sourceRevision.slice(0, 19)}… → ${r.slice(0, 19)}…)`, {
 				file: t,
-				plan: s.id,
+				plan: a.id,
 				path: "plan.sourceRevision"
 			}, "Regenerate the plan’s decomposition from its source; closure waits until then."));
 		}
 		let c = n.workItems.reduce((e, t) => e + t.sourceRefs.length, 0);
-		(n.coverage.disposedSources !== c || n.coverage.unmatchedSources > 0 || n.coverage.duplicateSources > 0 || s.decompositionComplete && n.coverage.result !== "complete") && i.push(W("source/coverage", "error", `${s.id} claims ${n.coverage.disposedSources} disposed sources (${n.coverage.unmatchedSources} unmatched, ${n.coverage.duplicateSources} duplicate, ${n.coverage.result}) and holds ${c}`, {
+		(n.coverage.disposedSources !== c || n.coverage.unmatchedSources > 0 || n.coverage.duplicateSources > 0 || a.decompositionComplete && n.coverage.result !== "complete") && i.push(W("source/coverage", "error", `${a.id} claims ${n.coverage.disposedSources} disposed sources (${n.coverage.unmatchedSources} unmatched, ${n.coverage.duplicateSources} duplicate, ${n.coverage.result}) and holds ${c}`, {
 			file: t,
-			plan: s.id,
+			plan: a.id,
 			path: "coverage"
 		}, "Regenerate the plan’s decomposition from its source."));
 	}
@@ -643,15 +702,15 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 			path: e.id
 		}, "Write the waiver: rationale, reviewer, expiry and compensating control."));
 	}
-	let m = M(c, l), h = /* @__PURE__ */ new Map(), g = /* @__PURE__ */ new Map(), _ = /* @__PURE__ */ new Set(), v = (e) => {
+	let m = j(c, l), h = /* @__PURE__ */ new Map(), g = /* @__PURE__ */ new Map(), _ = /* @__PURE__ */ new Set(), v = (e) => {
 		let t = h.get(e);
 		if (t !== void 0) return t;
 		let r = d.get(e);
 		if (r === void 0 || _.has(e)) return;
 		_.add(e);
-		let i = P(r.item, m, v, n);
+		let i = N(r.item, m, v, n);
 		_.delete(e);
-		let a = F(r.item, i);
+		let a = P(r.item, i);
 		return h.set(e, a), g.set(e, i), a;
 	};
 	for (let { file: e, item: t } of [...d.values()].sort((e, t) => e.item.id < t.item.id ? -1 : 1)) {
@@ -661,10 +720,10 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 			workItem: t.id
 		}, r = null;
 		t.statusHistory.forEach((e, a) => {
-			e.from === r ? e.from !== null && !A[e.from].includes(e.to) && i.push(W("state/forbidden-transition", "error", `${t.id} went ${e.from} → ${e.to}`, {
+			e.from === r ? e.from !== null && !k[e.from].includes(e.to) && i.push(W("state/forbidden-transition", "error", `${t.id} went ${e.from} → ${e.to}`, {
 				...n,
 				path: `statusHistory[${a}]`
-			}, `From ${e.from} an item goes to ${A[e.from].join(", ")}.`)) : i.push(W("state/history-break", "error", `${t.id} history step ${a + 1} starts at ${e.from ?? "nothing"}, after ${r ?? "nothing"}`, {
+			}, `From ${e.from} an item goes to ${k[e.from].join(", ")}.`)) : i.push(W("state/history-break", "error", `${t.id} history step ${a + 1} starts at ${e.from ?? "nothing"}, after ${r ?? "nothing"}`, {
 				...n,
 				path: `statusHistory[${a}]`
 			}, "Record every transition in order.")), r = e.to;
@@ -691,7 +750,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		plan: r.plan
 	}, "Remove it or correct the plan id."));
 	let b = /* @__PURE__ */ new Map(), x = /* @__PURE__ */ new Map();
-	for (let { instance: t } of s) {
+	for (let { instance: t } of a) {
 		let n = B(t, c, l, (e) => h.get(e), e.decisions);
 		b.set(t.plan.id, n);
 		let r = y.get(t.plan.id), a = V(r?.record, n);
@@ -706,7 +765,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	}
 	for (let { file: e, item: t } of [...d.values()].sort((e, t) => e.item.id < t.item.id ? -1 : 1)) {
 		let n = h.get(t.id);
-		j.has(t.status) && n !== t.status && (t.status !== "verified" || n !== "closed") && i.push(W("state/manual-derived", "error", `${t.id} says ${t.status}; the evidence says ${n}: ${(g.get(t.id) ?? []).slice(0, 3).join("; ") || "its plan holds no certificate on its current revision"}`, {
+		A.has(t.status) && n !== t.status && (t.status !== "verified" || n !== "closed") && i.push(W("state/manual-derived", "error", `${t.id} says ${t.status}; the evidence says ${n}: ${(g.get(t.id) ?? []).slice(0, 3).join("; ") || "its plan holds no certificate on its current revision"}`, {
 			file: e,
 			plan: t.ownerPlan,
 			workItem: t.id,
@@ -715,7 +774,7 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	}
 	return {
 		program: {
-			instances: s,
+			instances: a,
 			items: d,
 			evidence: c,
 			findings: l,
@@ -725,9 +784,9 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 			revisions: b,
 			closure: x
 		},
-		diagnostics: k(i)
+		diagnostics: te(i)
 	};
-}, J = () => Object.fromEntries(v.map((e) => [e, 0])), ae = (e) => {
+}, J = () => Object.fromEntries(y.map((e) => [e, 0])), se = (e) => {
 	let t = J();
 	return {
 		plans: e.instances.map(({ file: n, instance: r }) => {
@@ -757,12 +816,12 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		mandatory: t,
 		items: e.items.size
 	};
-}, oe = {
+}, ce = {
 	P0: 0,
 	P1: 1,
 	P2: 2,
 	P3: 3
-}, se = (e, t, n) => {
+}, le = (e, t, n) => {
 	if (n) return {
 		outcome: "invalid",
 		reason: "lint reports blocking diagnostics; fix them first (`voltro plan lint`)"
@@ -775,39 +834,49 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	if (a.every(({ item: e }) => ["verified", "closed"].includes(r(e.id) ?? ""))) return { outcome: "complete" };
 	let o = (e) => e.dependsOn.every((e) => ["verified", "closed"].includes(r(e) ?? "")), s = (e) => [
 		r(e.id) === "active" ? 0 : 1,
-		oe[e.priority],
+		ce[e.priority],
 		e.kind === "security" ? 0 : 1,
 		+!i.has(e.ownerPlan),
 		+!o(e),
 		e.id
 	], c = (e, t) => {
-		let [n, r] = [s(e.item), s(t.item)];
-		for (let e = 0; e < n.length; e++) if (n[e] !== r[e]) return n[e] < r[e] ? -1 : 1;
-		return 0;
-	}, l = a.filter(({ item: e }) => ["active", "ready"].includes(r(e.id) ?? "")).sort(c)[0];
-	if (l !== void 0) {
-		let e = r(l.item.id);
+		for (let n = 0; n < e.length; n++) if (e[n] !== t[n]) return e[n] < t[n];
+		return !1;
+	}, l = (e) => {
+		let t;
+		for (let n of a) {
+			if (!e.includes(r(n.item.id) ?? "")) continue;
+			let i = s(n.item);
+			(t === void 0 || c(i, t.rank)) && (t = {
+				entry: n,
+				rank: i
+			});
+		}
+		return t;
+	}, u = l(["active", "ready"]);
+	if (u !== void 0) {
+		let e = u.entry, t = r(e.item.id);
 		return {
 			outcome: "item",
-			workItem: l.item,
-			file: l.file,
+			workItem: e.item,
+			file: e.file,
 			why: [
-				e === "active" ? "it is already active" : "it is ready",
-				`priority ${l.item.priority}`,
-				...l.item.kind === "security" ? ["security work comes first"] : [],
-				i.has(l.item.ownerPlan) ? `${l.item.ownerPlan} is already under way` : "no started plan has workable items",
-				o(l.item) ? "its dependencies are verified" : "no dependency-ready item is left, so it waits on its dependencies"
+				t === "active" ? "it is already active" : "it is ready",
+				`priority ${e.item.priority}`,
+				...e.item.kind === "security" ? ["security work comes first"] : [],
+				i.has(e.item.ownerPlan) ? `${e.item.ownerPlan} is already under way` : "no started plan has workable items",
+				u.rank[4] === 0 ? "its dependencies are verified" : "no dependency-ready item is left, so it waits on its dependencies"
 			]
 		};
 	}
-	let u = a.filter(({ item: e }) => r(e.id) === "proposed").sort(c), d = a.filter(({ item: e }) => r(e.id) === "blocked").length;
+	let d = l(["proposed"]), f = a.filter(({ item: e }) => r(e.id) === "proposed").length, p = a.filter(({ item: e }) => r(e.id) === "blocked").length;
 	return {
 		outcome: "blocked",
-		reason: `no mandatory item is active or ready: ${u.length} proposed await readiness${d > 0 ? `, ${d} blocked` : ""}`,
-		prepare: u[0]?.item ?? null,
-		file: u[0]?.file ?? null
+		reason: `no mandatory item is active or ready: ${f} proposed await readiness${p > 0 ? `, ${p} blocked` : ""}`,
+		prepare: d?.entry.item ?? null,
+		file: d?.entry.file ?? null
 	};
-}, Y = "voltro-plan-command/v1", ce = (e) => ({
+}, Y = "voltro-plan-command/v1", ue = (e) => ({
 	schemaVersion: Y,
 	...e
 }), X = {
@@ -819,12 +888,12 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	provider: 5,
 	security: 6,
 	internal: 70
-}, Z = "voltro-plan-manifest/v1", Q = n.String.pipe(n.minLength(1), n.filter((e) => !e.startsWith("/") && !/^[A-Za-z]:/.test(e) && !e.split("/").includes("..") || "a path stays inside the project root")), le = n.Struct({
+}, Z = "voltro-plan-manifest/v1", Q = n.String.pipe(n.check(n.isMinLength(1)), n.check(n.makeFilter((e) => !e.startsWith("/") && !/^[A-Za-z]:/.test(e) && !e.split("/").includes("..") || "a path stays inside the project root"))), de = n.Struct({
 	schemaVersion: n.Literal(Z),
-	prefix: n.String.pipe(n.pattern(/^[A-Z][A-Z0-9]{1,9}$/)),
-	instanceVersion: n.String.pipe(n.minLength(1)),
-	repos: n.Array(n.String.pipe(n.minLength(1))).pipe(n.minItems(1)),
-	instances: n.Array(Q).pipe(n.minItems(1)),
+	prefix: n.String.pipe(n.check(n.isPattern(/^[A-Z][A-Z0-9]{1,9}$/))),
+	instanceVersion: n.String.pipe(n.check(n.isMinLength(1))),
+	repos: n.Array(n.String.pipe(n.check(n.isMinLength(1)))).pipe(n.check(n.isMinLength(1))),
+	instances: n.Array(Q).pipe(n.check(n.isMinLength(1))),
 	evidence: n.optional(n.Array(Q)),
 	evidenceDir: n.optional(Q),
 	closureDir: n.optional(Q),
@@ -841,14 +910,14 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		related: [],
 		nextAction: r
 	}
-}), ue = [
+}), fe = [
 	/-----BEGIN [A-Z ]*PRIVATE KEY-----/,
 	/\b[sr]k_(live|test)_[A-Za-z0-9]{16,}/,
 	/\bgh[pousr]_[A-Za-z0-9]{30,}/,
 	/\bAKIA[0-9A-Z]{16}\b/,
 	/\bxox[abprs]-[A-Za-z0-9-]{10,}/,
 	/\bBearer\s+[A-Za-z0-9._~+/-]{20,}/
-], de = (e, t, n) => {
+], pe = (e, t, n) => {
 	let r = e.items.get(n.workItem)?.item;
 	if (r === void 0) return $("evidence/unknown-target", "error", `${n.workItem} is not a work item of this program`, "Name an existing work item.", n.workItem, X.failed);
 	if ([
@@ -857,8 +926,8 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 		n.producedBy,
 		n.command ?? "",
 		n.environment ?? ""
-	].some((e) => ue.some((t) => t.test(e))) || /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]*:[^/@\s]*@/i.test(n.uri)) return $("security/secret", "security", "the evidence carries a secret or a credential", "Remove it; reference where the result is kept, never a key.", r.id, X.security);
-	if (!b.includes(n.kind)) return $("evidence/kind", "error", `"${n.kind}" is not an evidence kind`, `Use one of: ${b.join(", ")}.`, r.id, X.usage);
+	].some((e) => fe.some((t) => t.test(e))) || /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]*:[^/@\s]*@/i.test(n.uri)) return $("security/secret", "security", "the evidence carries a secret or a credential", "Remove it; reference where the result is kept, never a key.", r.id, X.security);
+	if (!x.includes(n.kind)) return $("evidence/kind", "error", `"${n.kind}" is not an evidence kind`, `Use one of: ${x.join(", ")}.`, r.id, X.usage);
 	if (/^http:\/\//i.test(n.uri)) return $("evidence/uri", "error", `${n.uri} is not https`, "Reference evidence over https, git: or a project-relative path.", r.id, X.failed);
 	if (n.uri.startsWith("/") || /^[A-Za-z]:[\\/]/.test(n.uri) || n.uri.split("/").includes("..")) return $("evidence/uri", "error", `${n.uri} is not portable`, "Use a path relative to the project root, or a URL.", r.id, X.failed);
 	let i = [r.id];
@@ -882,14 +951,14 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 	if (n.idempotencyKey !== void 0) {
 		let t = e.evidence.find((e) => e.idempotencyKey === n.idempotencyKey);
 		if (t !== void 0) {
-			let { id: e, observedAt: i, idempotencyKey: o, ...c } = t;
-			return s(c) === s(a) ? {
+			let { id: e, observedAt: i, idempotencyKey: o, ...s } = t;
+			return c(s) === c(a) ? {
 				outcome: "same",
 				evidence: t
 			} : $("evidence/idempotency-conflict", "error", `the key "${n.idempotencyKey}" was used for other evidence (${t.id})`, "Use a new key for new evidence.", r.id, X.conflict);
 		}
 	}
-	let o = `EVD-${r.id}-`, c = e.evidence.filter((e) => e.id.startsWith(o)).map((e) => Number(e.id.slice(o.length))), l = String(Math.max(0, ...c) + 1).padStart(3, "0");
+	let o = `EVD-${r.id}-`, s = e.evidence.filter((e) => e.id.startsWith(o)).map((e) => Number(e.id.slice(o.length))), l = String(Math.max(0, ...s) + 1).padStart(3, "0");
 	return t.evidence.test(`${o}${l}`) ? {
 		outcome: "add",
 		evidence: {
@@ -899,35 +968,48 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 			...n.idempotencyKey === void 0 ? {} : { idempotencyKey: n.idempotencyKey }
 		}
 	} : $("evidence/exhausted", "error", `${r.id} has no evidence number left`, "Supersede the item.", r.id, X.failed);
-}, fe = [
+}, me = [
 	".",
 	":",
 	"/",
 	"-"
-], pe = (e, t) => e === t || fe.some((n) => t.startsWith(e + n) || e.startsWith(t + n)), me = (e, t) => {
+], he = (e, t) => e === t || me.some((n) => t.startsWith(e + n) || e.startsWith(t + n)), ge = (e, t) => {
 	let n = /* @__PURE__ */ new Map(), r = (e, t) => {
 		let r = n.get(e) ?? /* @__PURE__ */ new Set();
 		r.add(t), n.set(e, r);
 	};
-	for (let { item: n } of e.items.values()) for (let e of t.tags) for (let t of n.impactTags) pe(e, t) && r(n.id, `tag ${t}`);
-	let i = [], a = new Map(e.instances.map(({ file: e, instance: t }) => [e, t]));
-	for (let n of [...new Set(t.files)].sort()) {
-		let t = !1, o = a.get(n);
-		if (o !== void 0) {
+	for (let { item: n } of e.items.values()) for (let e of t.tags) for (let t of n.impactTags) he(e, t) && r(n.id, `tag ${t}`);
+	let i = [], a = new Map(e.instances.map(({ file: e, instance: t }) => [e, t])), o = /* @__PURE__ */ new Map();
+	for (let { item: t } of e.items.values()) for (let e of t.sourceRefs) {
+		let n = o.get(e.uri);
+		n === void 0 && (n = /* @__PURE__ */ new Set(), o.set(e.uri, n)), n.add(t.id);
+	}
+	for (let e of [...new Set(t.files)].sort()) {
+		let t = !1, n = a.get(e);
+		if (n !== void 0) {
 			t = !0;
-			for (let e of o.workItems) r(e.id, `its plan file ${n} changed`);
+			for (let t of n.workItems) r(t.id, `its plan file ${e} changed`);
 		}
-		for (let { item: i } of e.items.values()) i.sourceRefs.some((e) => e.uri === n) && (t = !0, r(i.id, `its source ${n} changed`));
-		t || i.push(n);
+		for (let n of o.get(e) ?? []) t = !0, r(n, `its source ${e} changed`);
+		t || i.push(e);
 	}
-	let o = /* @__PURE__ */ new Map();
-	for (let { item: t } of e.items.values()) for (let e of t.dependsOn) o.set(e, [...o.get(e) ?? [], t.id]);
-	let s = /* @__PURE__ */ new Map(), c = [...n.keys()].sort().map((e) => [e]), l = new Set(n.keys());
-	for (; c.length > 0;) {
-		let e = c.shift();
-		for (let t of [...o.get(e.at(-1)) ?? []].sort()) l.has(t) || (l.add(t), s.set(t, [...e, t]), c.push([...e, t]));
+	let s = /* @__PURE__ */ new Map();
+	for (let { item: t } of e.items.values()) for (let e of t.dependsOn) {
+		let n = s.get(e);
+		n === void 0 && (n = [], s.set(e, n)), n.push(t.id);
+	}
+	for (let e of s.values()) e.sort();
+	let c = /* @__PURE__ */ new Map(), l = [...n.keys()].sort().map((e) => [e]), u = new Set(n.keys());
+	for (let e = 0; e < l.length; e++) {
+		let t = l[e];
+		for (let e of s.get(t.at(-1)) ?? []) {
+			if (u.has(e)) continue;
+			u.add(e);
+			let n = [...t, e];
+			c.set(e, n), l.push(n);
+		}
 	}
-	let u = [...l], d = [...new Set(u.map((t) => e.items.get(t).item.ownerPlan))].sort(), f = d.flatMap((t) => {
+	let d = [...u], f = [...new Set(d.map((t) => e.items.get(t).item.ownerPlan))].sort(), p = f.flatMap((t) => {
 		let n = e.closure.get(t);
 		return n?.state === "certified" ? [{
 			plan: t,
@@ -939,14 +1021,14 @@ var r = /^[A-Z][A-Z0-9]{1,9}$/, i = (e) => {
 			workItem: e,
 			because: [...t].sort()
 		})).sort((e, t) => e.workItem < t.workItem ? -1 : 1),
-		transitive: [...s.entries()].map(([e, t]) => ({
+		transitive: [...c.entries()].map(([e, t]) => ({
 			workItem: e,
 			path: t
 		})).sort((e, t) => e.workItem < t.workItem ? -1 : 1),
-		plans: d,
-		certificates: f,
+		plans: f,
+		certificates: p,
 		unknown: i
 	};
 };
 //#endregion
-export { I as CLOSURE_SCHEMA_VERSION, Y as COMMAND_SCHEMA_VERSION, j as DERIVED, b as EVIDENCE_KINDS, X as EXIT, S as ITEM_KINDS, Z as MANIFEST_SCHEMA_VERSION, le as Manifest, y as PLAN_STATUSES, x as PRIORITIES, A as TRANSITIONS, v as WORK_ITEM_STATUSES, ee as blocks, s as canonicalJson, z as closureFileSchema, V as closureState, ne as decideClosure, de as decideEvidence, q as dependencyCycles, F as derivedStatus, ce as envelope, T as evidenceSchema, E as findingSchema, d as fingerprint, i as idGrammar, me as impactOf, M as indexEvidence, ie as lintProgram, se as nextItem, o as ownerItemOf, w as planInstanceSchema, a as planNumberOf, B as planRevision, ae as programStatus, u as sha256Hex, k as sortDiagnostics, P as verificationGaps };
+export { F as CLOSURE_SCHEMA_VERSION, Y as COMMAND_SCHEMA_VERSION, A as DERIVED, x as EVIDENCE_KINDS, X as EXIT, S as ITEM_KINDS, Z as MANIFEST_SCHEMA_VERSION, de as Manifest, b as PLAN_STATUSES, ee as PRIORITIES, k as TRANSITIONS, y as WORK_ITEM_STATUSES, ne as blocks, c as canonicalJson, z as closureFileSchema, V as closureState, re as decideClosure, pe as decideEvidence, q as dependencyCycles, P as derivedStatus, ue as envelope, T as evidenceSchema, E as findingSchema, f as fingerprint, a as idGrammar, ge as impactOf, j as indexEvidence, oe as lintProgram, le as nextItem, s as ownerItemOf, w as planInstanceSchema, o as planNumberOf, B as planRevision, se as programStatus, d as sha256Hex, te as sortDiagnostics, N as verificationGaps };