diff --git a/apps/web/app/auth/callback/route.test.ts b/apps/web/app/auth/callback/route.test.ts
new file mode 100644
index 00000000..b25a38e6
--- /dev/null
+++ b/apps/web/app/auth/callback/route.test.ts
@@ -0,0 +1,139 @@
+import { NextRequest } from "next/server";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  cookieStore: new Map<string, string>(),
+  resolveWorkosIdentity: vi.fn(),
+}));
+
+vi.mock("next/headers", () => ({
+  cookies: () =>
+    Promise.resolve({
+      set: (name: string, value: string) => mocks.cookieStore.set(name, value),
+    }),
+}));
+vi.mock("@clockwork/db", () => ({
+  resolveWorkosIdentity: mocks.resolveWorkosIdentity,
+}));
+vi.mock("@/src/db/service", () => ({
+  getServiceDatabase: () => ({ kind: "test-database" }),
+}));
+
+vi.stubEnv("WORKOS_API_KEY", "sk_test_callback");
+vi.stubEnv("WORKOS_CLIENT_ID", "client_test_callback");
+vi.stubEnv(
+  "WORKOS_COOKIE_PASSWORD",
+  "callback-test-password-at-least-32-characters",
+);
+vi.stubEnv("APP_ORIGIN", "https://commerce.example.test");
+
+// Exercise AuthKit's real state validation, session persistence and callback
+// error handling. Only the provider's code exchange and commerce DB are faked.
+const { getSignInUrl, getWorkOS } = await import("@workos-inc/authkit-nextjs");
+const { GET } = await import("./route");
+
+beforeEach(() => {
+  mocks.cookieStore.clear();
+  mocks.resolveWorkosIdentity.mockReset();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+async function callbackRequest(returnTo?: string) {
+  const authorizationUrl = new URL(
+    await getSignInUrl({
+      redirectUri: "https://commerce.example.test/auth/callback",
+      ...(returnTo ? { returnTo } : {}),
+    }),
+  );
+  const callbackUrl = new URL("http://container:3000/auth/callback");
+  callbackUrl.searchParams.set("code", "test-authorization-code");
+  const state = authorizationUrl.searchParams.get("state");
+  if (!state) throw new Error("AuthKit did not generate OAuth state");
+  callbackUrl.searchParams.set("state", state);
+  const request = new NextRequest(callbackUrl);
+  for (const [name, value] of mocks.cookieStore)
+    request.cookies.set(name, value);
+  return request;
+}
+
+function successfulCodeExchange(organizationId: string | undefined) {
+  return vi
+    .spyOn(getWorkOS().userManagement, "authenticateWithCode")
+    .mockResolvedValue({
+      accessToken: "test-access-token",
+      refreshToken: "test-refresh-token",
+      authenticationMethod: "MagicAuth",
+      ...(organizationId ? { organizationId } : {}),
+      user: {
+        object: "user",
+        id: "user_callback",
+        email: "person@example.test",
+        emailVerified: true,
+        firstName: null,
+        lastName: null,
+        name: null,
+        locale: null,
+        profilePictureUrl: null,
+        lastSignInAt: null,
+        createdAt: "2026-01-01T00:00:00.000Z",
+        updatedAt: "2026-01-01T00:00:00.000Z",
+        externalId: null,
+        metadata: {},
+      },
+    });
+}
+
+it.each(["org_callback", undefined])(
+  "redirects a verified login without consulting commerce membership (organization: %s)",
+  async (organizationId) => {
+    successfulCodeExchange(organizationId);
+    mocks.resolveWorkosIdentity.mockRejectedValue(
+      new Error("Commerce database unavailable"),
+    );
+    const response = await GET(await callbackRequest());
+
+    expect(mocks.cookieStore.get("wos-session")).toBeTruthy();
+    expect(response.status).toBe(307);
+    expect(response.headers.get("location")).toBe(
+      "https://commerce.example.test/",
+    );
+    expect(response.headers.get("cache-control")).toContain("no-store");
+    expect(response.headers.get("set-cookie")).toContain("wos-auth-verifier-");
+    expect(mocks.resolveWorkosIdentity).not.toHaveBeenCalled();
+  },
+);
+
+it("preserves the requested destination on the configured public origin", async () => {
+  successfulCodeExchange("org_callback");
+  const response = await GET(await callbackRequest("/internal?tab=activity"));
+  expect(response.headers.get("location")).toBe(
+    "https://commerce.example.test/internal?tab=activity",
+  );
+});
+
+it("does not create a session or redirect when the provider rejects the code", async () => {
+  vi.spyOn(console, "error").mockImplementation(() => undefined);
+  vi.spyOn(
+    getWorkOS().userManagement,
+    "authenticateWithCode",
+  ).mockRejectedValue(new Error("Invalid code"));
+  const response = await GET(await callbackRequest());
+  expect(response.status).toBeGreaterThanOrEqual(400);
+  expect(response.headers.get("location")).toBeNull();
+  expect(mocks.cookieStore.has("wos-session")).toBe(false);
+});
+
+it("rejects mismatched OAuth state before exchanging the code", async () => {
+  vi.spyOn(console, "error").mockImplementation(() => undefined);
+  const exchange = successfulCodeExchange("org_callback");
+  const request = await callbackRequest();
+  for (const cookie of request.cookies.getAll())
+    request.cookies.set(cookie.name, "wrong-state");
+  const response = await GET(request);
+  expect(response.status).toBeGreaterThanOrEqual(400);
+  expect(mocks.cookieStore.has("wos-session")).toBe(false);
+  expect(exchange).not.toHaveBeenCalled();
+});
diff --git a/apps/web/app/auth/callback/route.ts b/apps/web/app/auth/callback/route.ts
index 68d9834a..8531e46a 100644
--- a/apps/web/app/auth/callback/route.ts
+++ b/apps/web/app/auth/callback/route.ts
@@ -1,10 +1,6 @@
 import { handleAuth } from "@workos-inc/authkit-nextjs";
 import { NextResponse } from "next/server";
 
-import { resolveWorkosIdentity } from "@clockwork/db";
-
-import { getServiceDatabase } from "@/src/db/service";
-
 const configured = Boolean(
   process.env.WORKOS_API_KEY &&
   process.env.WORKOS_CLIENT_ID &&
@@ -14,13 +10,9 @@ export const GET = configured
   ? handleAuth({
       returnPathname: "/",
       ...(process.env.APP_ORIGIN ? { baseURL: process.env.APP_ORIGIN } : {}),
-      onSuccess: async ({ organizationId, user }) => {
-        if (!organizationId) return;
-        await resolveWorkosIdentity(getServiceDatabase(), {
-          workosUserId: user.id,
-          workosOrganizationId: organizationId,
-          requestId: `auth-callback:${crypto.randomUUID()}`,
-        });
-      },
+      // AuthKit saves the session before onSuccess; a lookup failure there
+      // turns a successful login into an error response with a live cookie.
+      // Commerce membership and permissions are checked by getCommerceSession
+      // on the destination page and every protected operation.
     })
   : (request: Request) => NextResponse.redirect(new URL("/", request.url));
diff --git a/apps/web/src/auth/session.test.ts b/apps/web/src/auth/session.test.ts
index a903cca3..f0348faf 100644
--- a/apps/web/src/auth/session.test.ts
+++ b/apps/web/src/auth/session.test.ts
@@ -231,6 +231,26 @@ describe("WorkOS commerce session mapping", () => {
     vi.unstubAllEnvs();
   });
 
+  it.each([
+    "WorkOS identity is not linked to exactly one commerce membership",
+    "Commerce database unavailable",
+  ])(
+    "denies commerce access after a verified login when %s",
+    async (message) => {
+      const failure = new Error(message);
+      authMocks.resolveWorkosIdentity.mockRejectedValue(failure);
+
+      await expect(getCommerceSession()).rejects.toBe(failure);
+      expect(authMocks.resolveWorkosIdentity).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({
+          workosUserId: fixture.workosUserId,
+          workosOrganizationId: fixture.workosOrganizationId,
+        }),
+      );
+    },
+  );
+
   it("accepts an actual session-bound MFA receipt when WorkOS omits assurance claims", async () => {
     authMocks.getTokenClaims.mockResolvedValue({});
     authMocks.findMfaReceipt.mockResolvedValue(Date.now());
diff --git a/apps/web/vitest.config.ts b/apps/web/vitest.config.ts
index 240255a1..a9e3a64d 100644
--- a/apps/web/vitest.config.ts
+++ b/apps/web/vitest.config.ts
@@ -13,6 +13,8 @@ export default defineConfig({
     },
   },
   test: {
+    // AuthKit's extensionless Next imports need the same bundling as the app.
+    server: { deps: { inline: ["@workos-inc/authkit-nextjs"] } },
     environment: "jsdom",
     include: ["{src,app}/**/*.test.{ts,tsx}"],
     exclude: [
diff --git a/docs/operations/dependency-chain-upgrades.md b/docs/operations/dependency-chain-upgrades.md
index d6ecd2a2..438b3862 100644
--- a/docs/operations/dependency-chain-upgrades.md
+++ b/docs/operations/dependency-chain-upgrades.md
@@ -17,11 +17,13 @@ the disposable OpenAPI dry-run are release assertions.
 
 ## Trigger/OpenTelemetry chain
 
-The repository’s Trigger SDK/core remains 4.5.9. Only dependencies below
-`@trigger.dev/core@4.5.9` are aligned: stable OpenTelemetry packages use 2.10.0
-and the matching experimental log/exporter/instrumentation packages use 0.221.0.
-The lockfile contains neither `@opentelemetry/core@2.7.1` nor the prior
-experimental 0.218.0 family.
+Trigger SDK/core is 4.6.4, which supports Zod 4 and includes the 4.6.x Zod
+import fix. Its Zod dependency is pinned to 4.6.6 to remove the vulnerable Zod 3
+dependency without forcing Zod 4 into an incompatible consumer. The application
+catalog also uses Zod 4.6.6. Dependencies below `@trigger.dev/core@4.6.4` remain
+aligned: stable OpenTelemetry packages use 2.10.0 and the matching experimental
+log/exporter/instrumentation packages use 0.221.0. The lockfile contains neither
+`@opentelemetry/core@2.7.1` nor the prior experimental 0.218.0 family.
 
 Each override names both the Trigger parent and the individual OpenTelemetry
 package. There is no blanket `@opentelemetry/*` override, so an incompatible
diff --git a/package.json b/package.json
index f256f880..7b51e7ff 100644
--- a/package.json
+++ b/package.json
@@ -63,7 +63,7 @@
     "@netlify/plugin-nextjs": "5.15.13",
     "@secretlint/secretlint-rule-pattern": "13.0.4",
     "@secretlint/secretlint-rule-preset-recommend": "13.0.4",
-    "@trigger.dev/sdk": "4.5.9",
+    "@trigger.dev/sdk": "4.6.4",
     "@types/node": "24.13.3",
     "dependency-cruiser": "18.1.0",
     "esbuild": "0.28.1",
@@ -96,17 +96,17 @@
       "vite@>=8 <8.2.4": "8.2.4",
       "@esbuild-kit/core-utils@3.3.2>esbuild": "0.25.12",
       "netlify-cli@27.1.1>@opentelemetry/api": "1.8.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/api-logs": "0.221.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/core": "2.10.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/exporter-logs-otlp-http": "0.221.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/exporter-metrics-otlp-http": "0.221.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/exporter-trace-otlp-http": "0.221.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/instrumentation": "0.221.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/resources": "2.10.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/sdk-logs": "0.221.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/sdk-metrics": "2.10.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/sdk-trace-base": "2.10.0",
-      "@trigger.dev/core@4.5.9>@opentelemetry/sdk-trace-node": "2.10.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/api-logs": "0.221.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/core": "2.10.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/exporter-logs-otlp-http": "0.221.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/exporter-metrics-otlp-http": "0.221.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/exporter-trace-otlp-http": "0.221.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/instrumentation": "0.221.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/resources": "2.10.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/sdk-logs": "0.221.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/sdk-metrics": "2.10.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/sdk-trace-base": "2.10.0",
+      "@trigger.dev/core@4.6.4>@opentelemetry/sdk-trace-node": "2.10.0",
       "brace-expansion": "5.0.12",
       "nanoid@<3.3.18": "3.3.18",
       "postcss@<8.5.17": "8.5.25",
@@ -118,7 +118,10 @@
       "sharp@<0.35.5": "0.35.5",
       "image-size@<2.0.4": "2.0.4",
       "svgo@>=4 <4.1.0": "4.1.0",
-      "undici@>=8 <8.10.2": "8.10.2",
+      "undici@>=8 <8.12.2": "8.12.2",
+      "body-parser@>=2 <2.4.0": "2.4.0",
+      "@trigger.dev/core@4.6.4>zod": "4.6.6",
+      "zod@>=4 <4.6.6": "4.6.6",
       "engine.io@<6.6.11": "6.6.11",
       "fast-uri@>=3 <3.1.8": "3.1.8",
       "fast-uri@>=4 <4.1.5": "4.1.5",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7bcbd112..7d2ccf69 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -22,8 +22,8 @@ catalogs:
       specifier: 4.5.1
       version: 4.5.1
     '@trigger.dev/sdk':
-      specifier: 4.5.9
-      version: 4.5.9
+      specifier: 4.6.4
+      version: 4.6.4
     '@types/node':
       specifier: 24.13.3
       version: 24.13.3
@@ -73,24 +73,24 @@ catalogs:
       specifier: 4.1.11
       version: 4.1.11
     zod:
-      specifier: 4.4.3
-      version: 4.4.3
+      specifier: 4.6.6
+      version: 4.6.6
 
 overrides:
   vite@>=8 <8.2.4: 8.2.4
   '@esbuild-kit/core-utils@3.3.2>esbuild': 0.25.12
   netlify-cli@27.1.1>@opentelemetry/api: 1.8.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/api-logs': 0.221.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/core': 2.10.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/exporter-logs-otlp-http': 0.221.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/exporter-metrics-otlp-http': 0.221.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/exporter-trace-otlp-http': 0.221.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/instrumentation': 0.221.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/resources': 2.10.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/sdk-logs': 0.221.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/sdk-metrics': 2.10.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/sdk-trace-base': 2.10.0
-  '@trigger.dev/core@4.5.9>@opentelemetry/sdk-trace-node': 2.10.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/api-logs': 0.221.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/core': 2.10.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/exporter-logs-otlp-http': 0.221.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/exporter-metrics-otlp-http': 0.221.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/exporter-trace-otlp-http': 0.221.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/instrumentation': 0.221.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/resources': 2.10.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/sdk-logs': 0.221.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/sdk-metrics': 2.10.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/sdk-trace-base': 2.10.0
+  '@trigger.dev/core@4.6.4>@opentelemetry/sdk-trace-node': 2.10.0
   brace-expansion: 5.0.12
   nanoid@<3.3.18: 3.3.18
   postcss@<8.5.17: 8.5.25
@@ -102,7 +102,10 @@ overrides:
   sharp@<0.35.5: 0.35.5
   image-size@<2.0.4: 2.0.4
   svgo@>=4 <4.1.0: 4.1.0
-  undici@>=8 <8.10.2: 8.10.2
+  undici@>=8 <8.12.2: 8.12.2
+  body-parser@>=2 <2.4.0: 2.4.0
+  '@trigger.dev/core@4.6.4>zod': 4.6.6
+  zod@>=4 <4.6.6: 4.6.6
   engine.io@<6.6.11: 6.6.11
   fast-uri@>=3 <3.1.8: 3.1.8
   fast-uri@>=4 <4.1.5: 4.1.5
@@ -137,8 +140,8 @@ importers:
         specifier: 13.0.4
         version: 13.0.4
       '@trigger.dev/sdk':
-        specifier: 4.5.9
-        version: 4.5.9(react@19.3.0)(zod@4.4.3)
+        specifier: 4.6.4
+        version: 4.6.4(react@19.3.0)(zod@4.6.6)
       '@types/node':
         specifier: 24.13.3
         version: 24.13.3
@@ -259,7 +262,7 @@ importers:
         version: link:../../packages/workflows
       '@modelcontextprotocol/sdk':
         specifier: 1.32.0
-        version: 1.32.0(zod@4.4.3)
+        version: 1.32.0(zod@4.6.6)
       '@netlify/blobs':
         specifier: 10.7.11
         version: 10.7.11(supports-color@10.2.2)
@@ -289,7 +292,7 @@ importers:
         version: 19.2.8(react@19.2.8)
       zod:
         specifier: 'catalog:'
-        version: 4.4.3
+        version: 4.6.6
     devDependencies:
       '@axe-core/playwright':
         specifier: 4.12.1
@@ -374,7 +377,7 @@ importers:
         version: link:../workflows
       '@hono/zod-openapi':
         specifier: 'catalog:'
-        version: 1.5.1(hono@4.13.7)(zod@4.4.3)
+        version: 1.5.1(hono@4.13.7)(zod@4.6.6)
       hono:
         specifier: 'catalog:'
         version: 4.13.7
@@ -383,7 +386,7 @@ importers:
         version: 0.17.0
       zod:
         specifier: 'catalog:'
-        version: 4.4.3
+        version: 4.6.6
     devDependencies:
       openapi-typescript:
         specifier: 7.13.0
@@ -402,7 +405,7 @@ importers:
     dependencies:
       zod:
         specifier: 'catalog:'
-        version: 4.4.3
+        version: 4.6.6
     devDependencies:
       typescript:
         specifier: 'catalog:'
@@ -427,7 +430,7 @@ importers:
         version: 3.4.9
       zod:
         specifier: 'catalog:'
-        version: 4.4.3
+        version: 4.6.6
     devDependencies:
       drizzle-kit:
         specifier: 0.31.10
@@ -474,7 +477,7 @@ importers:
         version: link:../contracts
       zod:
         specifier: 'catalog:'
-        version: 4.4.3
+        version: 4.6.6
     devDependencies:
       fast-check:
         specifier: 'catalog:'
@@ -508,7 +511,7 @@ importers:
         version: 22.4.0(@types/node@24.13.3)
       zod:
         specifier: 'catalog:'
-        version: 4.4.3
+        version: 4.6.6
     devDependencies:
       typescript:
         specifier: 'catalog:'
@@ -613,13 +616,13 @@ importers:
         version: link:../integrations
       '@trigger.dev/sdk':
         specifier: 'catalog:'
-        version: 4.5.9(react@19.3.0)(zod@4.4.3)
+        version: 4.6.4(react@19.3.0)(zod@4.6.6)
       drizzle-orm:
         specifier: 'catalog:'
         version: 0.45.2(@electric-sql/pglite@0.3.16)(@opentelemetry/api@1.9.1)(pg@8.23.0)(postgres@3.4.9)
       zod:
         specifier: 'catalog:'
-        version: 4.4.3
+        version: 4.6.6
     devDependencies:
       typescript:
         specifier: 'catalog:'
@@ -648,7 +651,7 @@ packages:
   '@asteasolutions/zod-to-openapi@8.5.0':
     resolution: {integrity: sha512-SABbKiObg5dLRiTFnqiW1WWwGcg1BJfmHtT2asIBnBHg6Smy/Ms2KHc650+JI4Hw7lSkdiNebEGXpwoxfben8Q==}
     peerDependencies:
-      zod: ^4.0.0
+      zod: 4.6.6
 
   '@aws-sdk/checksums@3.1000.24':
     resolution: {integrity: sha512-7TWLjypP8kk3savsDBRuhZJx7mBuFFA2136BQhwwLllsAnO4Tmq/p+SXZaNxbuulkzUFz3BZzj0bb4YzexZcNQ==}
@@ -1366,13 +1369,13 @@ packages:
     engines: {node: '>=16.0.0'}
     peerDependencies:
       hono: '>=4.10.0'
-      zod: ^4.0.0
+      zod: 4.6.6
 
   '@hono/zod-validator@0.9.0':
     resolution: {integrity: sha512-n0ZSXmCiHVIp4Y5wlOOyZCeTd/rsawA/qW1cipB8QOYKZ9N8Tk0nZUZCXho9cu374AN4JpDNKioNKBJ/W+LBug==}
     peerDependencies:
       hono: '>=4.11.2'
-      zod: ^3.25.0 || ^4.0.0
+      zod: 4.6.6
 
   '@humanfs/core@0.19.2':
     resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
@@ -1669,7 +1672,7 @@ packages:
     engines: {node: '>=18'}
     peerDependencies:
       '@cfworker/json-schema': ^4.1.1
-      zod: ^3.25 || ^4.0
+      zod: 4.6.6
     peerDependenciesMeta:
       '@cfworker/json-schema':
         optional: true
@@ -3082,8 +3085,8 @@ packages:
   '@rtsao/scc@1.1.0':
     resolution: {integrity: sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==}
 
-  '@s2-dev/streamstore@0.22.10':
-    resolution: {integrity: sha512-dtm+oFHVE8szINwOUoNQdx9xpGSJOrcAEvsxspPFvomjYKGnmhIRmU4OX8o6kxcPoiK76S1tPeU0smjZdmOngA==}
+  '@s2-dev/streamstore@0.25.0':
+    resolution: {integrity: sha512-oB8OJObT/s2Q68Tr01NLfDnQPFJp/Kn2pP3seWybgP7VrjQ+j1efXReOsyVCDsUBVMxkyPlzt75o/+GuL5Q3vg==}
 
   '@sec-ant/readable-stream@0.4.1':
     resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
@@ -3521,18 +3524,20 @@ packages:
   '@textlint/types@15.7.1':
     resolution: {integrity: sha512-Vye/GmFNBTgVzZFtIFJTmLB+s2A7oIADxNG6r9UhfPuY+Czv0z5G3xeyFZZudPlfxURsKUyPIU5XsjOFqVp33A==}
 
-  '@trigger.dev/core@4.5.9':
-    resolution: {integrity: sha512-tXmIxg31Z5cPAXZozvTxLhHY8r8dbDNIFsaKZAcPYLSnaPMCK7uwJufYDLpvLmfNStPvs9x4DNAD4UW3ClyUIA==}
+  '@trigger.dev/core@4.6.4':
+    resolution: {integrity: sha512-N0Z7NnOM10HjCc4sTpDgbn7IwBqpgb8cN9KNSEzJBmwc6/Es3vQUG7cPqDK+qPqDvXXOd/FYVzljOncezqvnAA==}
     engines: {node: '>=18.20.0'}
+    peerDependencies:
+      zod: 4.6.6
 
-  '@trigger.dev/sdk@4.5.9':
-    resolution: {integrity: sha512-YZ7Re6ys6E52Pt0siWtDw5rJodUbSl0DieChHH57Wtvqx/UF6dm2v6cf2wzCbtFAHxkNg33kPiAmz+FI74ZrJg==}
+  '@trigger.dev/sdk@4.6.4':
+    resolution: {integrity: sha512-kPhiWkN0hiWHM23sSqo6Hrs++KOzkhbiu76EkV+tq7/MZpzUvq6gVxaj6sUNwHctN6DqMZPy3ANfymgz9o1uow==}
     engines: {node: '>=18.20.0'}
     peerDependencies:
       '@ai-sdk/otel': '>=1.0.0-0 <2'
       ai: ^5.0.0 || ^6.0.0 || >=7.0.0-canary <8
       react: ^18.0 || ^19.0
-      zod: ^3.0.0 || ^4.0.0
+      zod: 4.6.6
     peerDependenciesMeta:
       '@ai-sdk/otel':
         optional: true
@@ -3604,9 +3609,6 @@ packages:
   '@types/chai@5.2.3':
     resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
 
-  '@types/cors@2.8.19':
-    resolution: {integrity: sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg==}
-
   '@types/deep-eql@4.0.2':
     resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
 
@@ -3657,9 +3659,6 @@ packages:
   '@types/triple-beam@1.3.5':
     resolution: {integrity: sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==}
 
-  '@types/ws@8.18.2':
-    resolution: {integrity: sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==}
-
   '@types/yauzl@2.10.3':
     resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==}
 
@@ -3966,10 +3965,6 @@ packages:
   abstract-logging@2.0.1:
     resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
 
-  accepts@1.3.8:
-    resolution: {integrity: sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==}
-    engines: {node: '>= 0.6'}
-
   accepts@2.0.0:
     resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
     engines: {node: '>= 0.6'}
@@ -4230,10 +4225,6 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  base64id@2.0.0:
-    resolution: {integrity: sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog==}
-    engines: {node: ^4.5.0 || >= 5.9}
-
   baseline-browser-mapping@2.11.9:
     resolution: {integrity: sha512-cp447VUsGS07+n1Dqf7YSQ8maeJrjEhaDxTm1ZefbqDtypHBC5GzGMQbklR6IPR13Y8OAJRHZWEMtZipJLCttg==}
     engines: {node: '>=6.0.0'}
@@ -4264,8 +4255,8 @@ packages:
   bl@4.1.0:
     resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==}
 
-  body-parser@2.3.0:
-    resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
+  body-parser@2.4.0:
+    resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==}
     engines: {node: '>=18'}
 
   boolbase@1.0.0:
@@ -4592,10 +4583,6 @@ packages:
     engines: {node: '>=12.0.0'}
     deprecated: v4 is no longer maintained, upgrade to v5
 
-  cronstrue@2.59.0:
-    resolution: {integrity: sha512-YKGmAy84hKH+hHIIER07VCAHf9u0Ldelx1uU6EBxsRPDXIA1m5fsKmJfyC3xBhw6cVC/1i83VdbL4PvepTrt8A==}
-    hasBin: true
-
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -5007,10 +4994,6 @@ packages:
     resolution: {integrity: sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==}
     engines: {node: '>=10.0.0'}
 
-  engine.io@6.6.11:
-    resolution: {integrity: sha512-z34mGpLoY/82ZbkX1LqGMIaf3wjVMPL6gVC681QDqnmzJ26synI8qAE32P+a7UazmpJZ8UGrFIeAavgRfXzYrg==}
-    engines: {node: '>=10.2.0'}
-
   enhanced-resolve@5.24.2:
     resolution: {integrity: sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw==}
     engines: {node: '>=10.13.0'}
@@ -5273,9 +5256,6 @@ packages:
     resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
     engines: {node: '>=18.0.0'}
 
-  evt@2.5.9:
-    resolution: {integrity: sha512-GpjX476FSlttEGWHT8BdVMoI8wGXQGbEOtKcP4E+kggg+yJzXBZN2n4x7TS/zPBJ1DZqWI+rguZZApjjzQ0HpA==}
-
   execa@5.1.1:
     resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
     engines: {node: '>=10'}
@@ -6633,18 +6613,10 @@ packages:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
 
-  mime-db@1.52.0:
-    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
-    engines: {node: '>= 0.6'}
-
   mime-db@1.54.0:
     resolution: {integrity: sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
     engines: {node: '>= 0.6'}
 
-  mime-types@2.1.35:
-    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
-    engines: {node: '>= 0.6'}
-
   mime-types@3.0.2:
     resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==}
     engines: {node: '>=18'}
@@ -6670,9 +6642,6 @@ packages:
     resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==}
     engines: {node: '>=4'}
 
-  minimal-polyfills@2.2.3:
-    resolution: {integrity: sha512-oxdmJ9cL+xV72h0xYxp4tP2d5/fTBpP45H8DIOn9pASuF8a3IYTf+25fMGDYGiWW+MFsuog6KD6nfmhZJQ+uUw==}
-
   minimatch@10.2.6:
     resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
     engines: {node: 18 || 20 || >=22}
@@ -6766,10 +6735,6 @@ packages:
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
-  negotiator@0.6.3:
-    resolution: {integrity: sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==}
-    engines: {node: '>= 0.6'}
-
   negotiator@1.0.0:
     resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==}
     engines: {node: '>= 0.6'}
@@ -7418,6 +7383,7 @@ packages:
   prom-client@15.1.3:
     resolution: {integrity: sha512-6ZiOBfCywsD4k1BN9IX0uZhF+tJkV8q8llP64G5Hajs4JOeVLPCwpPVcpXy3BwYiUGgyJzsJJQeOIv7+hDSq8g==}
     engines: {node: ^16 || ^18 || >=20}
+    deprecated: prom-client has been replaced by @prometheus-io/client
 
   prompts@2.4.2:
     resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==}
@@ -7458,6 +7424,10 @@ packages:
     resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==}
     engines: {node: '>=0.6'}
 
+  qs@6.16.1:
+    resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==}
+    engines: {node: '>=0.6'}
+
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
@@ -7721,9 +7691,6 @@ packages:
     resolution: {integrity: sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==}
     engines: {node: '>=0.12.0'}
 
-  run-exclusive@2.2.19:
-    resolution: {integrity: sha512-K3mdoAi7tjJ/qT7Flj90L7QyPozwUaAG+CVhkdDje4HLKXUYC3N/Jzkau3flHVDLQVhiHBtcimVodMjN9egYbA==}
-
   run-parallel@1.2.0:
     resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
 
@@ -7900,16 +7867,10 @@ packages:
     resolution: {integrity: sha512-stxByr12oeeOyY2BlviTNQlYV5xOj47GirPr4yA1hE9JCtxfQN0+tVbkxwCtYDQWhEKWFHsEK48ORg5jrouCAg==}
     engines: {node: '>=20'}
 
-  slug@6.1.0:
-    resolution: {integrity: sha512-x6vLHCMasg4DR2LPiyFGI0gJJhywY6DTiGhCrOMzb3SOk/0JVLIaL4UhyFSHu04SD3uAavrKY/K3zZ3i6iRcgA==}
-
   smol-toml@1.9.0:
     resolution: {integrity: sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ==}
     engines: {node: '>= 18'}
 
-  socket.io-adapter@2.5.8:
-    resolution: {integrity: sha512-6Oy52pbg+kvdCVvjcN+FnY7BvxZ7cIHNScbvztT/It5d0vbwoJoVZmF2gjJmnV0/4WlXRfG15zc45ySk9Ah8bw==}
-
   socket.io-client@4.7.5:
     resolution: {integrity: sha512-sJ/tqHOCe7Z50JCBCXrsY3I2k03iOiUe+tj1OmKeD2lXPiGH/RUCdTZFoqVyN7l1MnpIzPrGtLcijffmeouNlQ==}
     engines: {node: '>=10.0.0'}
@@ -7918,10 +7879,6 @@ packages:
     resolution: {integrity: sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==}
     engines: {node: '>=10.0.0'}
 
-  socket.io@4.7.4:
-    resolution: {integrity: sha512-DcotgfP1Zg9iP/dH9zvAQcWrE0TtbMVwXmlV4T4mqsvY+gw+LqUGPfx2AoVyRk0FLME+GQhufDMyacFmw7ksqw==}
-    engines: {node: '>=10.2.0'}
-
   sonic-boom@4.2.1:
     resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
 
@@ -8323,9 +8280,6 @@ packages:
       '@swc/wasm':
         optional: true
 
-  tsafe@1.8.12:
-    resolution: {integrity: sha512-nFRqW0ttu/2o6XTXsHiVZWJBCOaxhVqZLg7dgs3coZNsCMPXPfwz+zPHAQA+70fNnVJLAPg1EgGIqK9Q84tvAw==}
-
   tsconfck@3.1.6:
     resolution: {integrity: sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w==}
     engines: {node: ^18 || >=20}
@@ -8418,10 +8372,6 @@ packages:
     resolution: {integrity: sha512-KPHm4VL5dDXKz01UuEd88Df+KzynaohSL9fBh096KWAxSKZQDI2uBrVqtvRM4rwrIrRRKsdLNML/lnaaVSRioA==}
     engines: {node: '>= 0.8'}
 
-  ulid@2.4.0:
-    resolution: {integrity: sha512-fIRiVTJNcSRmXKPZtGzFQv9WRrZ3M9eoptl/teFJvjOzmpU+/K/JH6HZ8deBfb5vMEpicJcLn7JmvdknlMq7Zg==}
-    hasBin: true
-
   ulid@3.0.2:
     resolution: {integrity: sha512-yu26mwteFYzBAot7KVMqFGCVpsF6g8wXfJzQUHvu1no3+rRRSFcSV2nKeYvNPLD2J4b08jYBDhHUjeH0ygIl9w==}
     hasBin: true
@@ -8440,8 +8390,8 @@ packages:
   undici-types@7.18.2:
     resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
 
-  undici@8.10.2:
-    resolution: {integrity: sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==}
+  undici@8.12.2:
+    resolution: {integrity: sha512-XtuDWVdqTLr3NAxm2ly9/hU6kUsJOgGh1RASzMBbsw6aWCOaQzHdW+QQDfdERjfJ2V5vL5pRPa4RetO9UfivDg==}
     engines: {node: '>=22.19.0'}
 
   unicode-properties@1.4.1:
@@ -8973,25 +8923,19 @@ packages:
     resolution: {integrity: sha512-dSvYKdvLsAHCDqPOhIwk/q5CvuWtTB3Dgpoe0uVEFjTzIOAmsQpprX25InCvrvJsirEbu1OHyy67n/kAj1Sw/w==}
     engines: {node: '>=18'}
 
-  zod-error@1.5.0:
-    resolution: {integrity: sha512-zzopKZ/skI9iXpqCEPj+iLCKl9b88E43ehcU+sbRoHuwGd9F1IDVGQ70TyO6kmfiRL1g4IXkjsXK+g1gLYl4WQ==}
-
   zod-to-json-schema@3.25.2:
     resolution: {integrity: sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==}
     peerDependencies:
-      zod: ^3.25.28 || ^4
+      zod: 4.6.6
 
-  zod-validation-error@1.5.0:
-    resolution: {integrity: sha512-/7eFkAI4qV0tcxMBB/3+d2c1P6jzzZYdYSlBuAklzMuCrJu5bzJfHS0yVAS87dRHVlhftd6RFJDIvv03JgkSbw==}
-    engines: {node: '>=16.0.0'}
+  zod-validation-error@5.0.0:
+    resolution: {integrity: sha512-hmk+pkyKq7Q71PiWVSDUc3VfpzpvcRHZ3QPw9yEMVvmtCekaMeOHnbr3WbxfrgEnQTv6haGP4cmv0Ojmihzsxw==}
+    engines: {node: '>=18.0.0'}
     peerDependencies:
-      zod: ^3.18.0
-
-  zod@3.25.76:
-    resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
+      zod: 4.6.6
 
-  zod@4.4.3:
-    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+  zod@4.6.6:
+    resolution: {integrity: sha512-4UmzQUF5fxvfcYHlbjBmejU+w+hbDnWFx4aS8kBx7nPBHcO2SqPbpAG8snbdg+Xse4pRefR98hgjFgIMCI/UhA==}
 
 snapshots:
 
@@ -9014,10 +8958,10 @@ snapshots:
       is-potential-custom-element-name: 1.0.1
       lru-cache: 11.5.2
 
-  '@asteasolutions/zod-to-openapi@8.5.0(zod@4.4.3)':
+  '@asteasolutions/zod-to-openapi@8.5.0(zod@4.6.6)':
     dependencies:
       openapi3-ts: 4.6.1
-      zod: 4.4.3
+      zod: 4.6.6
 
   '@aws-sdk/checksums@3.1000.24':
     dependencies:
@@ -9759,18 +9703,18 @@ snapshots:
     dependencies:
       hono: 4.13.7
 
-  '@hono/zod-openapi@1.5.1(hono@4.13.7)(zod@4.4.3)':
+  '@hono/zod-openapi@1.5.1(hono@4.13.7)(zod@4.6.6)':
     dependencies:
-      '@asteasolutions/zod-to-openapi': 8.5.0(zod@4.4.3)
-      '@hono/zod-validator': 0.9.0(hono@4.13.7)(zod@4.4.3)
+      '@asteasolutions/zod-to-openapi': 8.5.0(zod@4.6.6)
+      '@hono/zod-validator': 0.9.0(hono@4.13.7)(zod@4.6.6)
       hono: 4.13.7
       openapi3-ts: 4.6.1
-      zod: 4.4.3
+      zod: 4.6.6
 
-  '@hono/zod-validator@0.9.0(hono@4.13.7)(zod@4.4.3)':
+  '@hono/zod-validator@0.9.0(hono@4.13.7)(zod@4.6.6)':
     dependencies:
       hono: 4.13.7
-      zod: 4.4.3
+      zod: 4.6.6
 
   '@humanfs/core@0.19.2':
     dependencies:
@@ -10002,7 +9946,7 @@ snapshots:
 
   '@microsoft/fetch-event-source@2.0.1': {}
 
-  '@modelcontextprotocol/sdk@1.32.0(zod@4.4.3)':
+  '@modelcontextprotocol/sdk@1.32.0(zod@4.6.6)':
     dependencies:
       '@hono/node-server': 2.1.4(hono@4.13.7)
       ajv: 8.20.0
@@ -10019,8 +9963,8 @@ snapshots:
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
-      zod: 4.4.3
-      zod-to-json-schema: 3.25.2(zod@4.4.3)
+      zod: 4.6.6
+      zod-to-json-schema: 3.25.2(zod@4.6.6)
     transitivePeerDependencies:
       - supports-color
 
@@ -10149,7 +10093,7 @@ snapshots:
       typescript: 5.9.3
       yaml: 2.9.0
       yargs: 17.7.3
-      zod: 4.4.3
+      zod: 4.6.6
     transitivePeerDependencies:
       - '@swc/core'
       - '@swc/wasm'
@@ -10198,7 +10142,7 @@ snapshots:
       validate-npm-package-name: 5.0.1
       yaml: 2.9.0
       yargs: 17.7.3
-      zod: 4.4.3
+      zod: 4.6.6
 
   '@netlify/database-dev@0.10.1':
     dependencies:
@@ -10606,7 +10550,7 @@ snapshots:
       unixify: 1.0.0
       urlpattern-polyfill: 8.0.2
       yargs: 17.7.3
-      zod: 4.4.3
+      zod: 4.6.6
     transitivePeerDependencies:
       - bare-abort-controller
       - bare-buffer
@@ -11572,7 +11516,7 @@ snapshots:
 
   '@rtsao/scc@1.1.0': {}
 
-  '@s2-dev/streamstore@0.22.10':
+  '@s2-dev/streamstore@0.25.0':
     dependencies:
       '@protobuf-ts/runtime': 2.11.1
       debug: 4.4.3(supports-color@10.2.2)
@@ -12067,7 +12011,7 @@ snapshots:
     dependencies:
       '@textlint/ast-node-types': 15.7.1
 
-  '@trigger.dev/core@4.5.9':
+  '@trigger.dev/core@4.6.4(zod@4.6.6)':
     dependencies:
       '@bugsnag/cuid': 3.2.2
       '@electric-sql/client': 1.0.14
@@ -12086,43 +12030,32 @@ snapshots:
       '@opentelemetry/sdk-metrics': 2.10.0(@opentelemetry/api@1.9.1)
       '@opentelemetry/sdk-trace-base': 2.10.0(@opentelemetry/api@1.9.1)
       '@opentelemetry/sdk-trace-node': 2.10.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      '@s2-dev/streamstore': 0.22.10
+      '@s2-dev/streamstore': 0.25.0
       dequal: 2.0.3
       eventsource: 3.0.7
       eventsource-parser: 3.1.0
-      execa: 8.0.1
       humanize-duration: 3.34.0
       jose: 5.10.0
       nanoid: 3.3.18
       prom-client: 15.1.3
-      socket.io: 4.7.4
       socket.io-client: 4.7.5
       std-env: 3.10.0
       tinyexec: 0.3.2
       uncrypto: 0.1.3
-      zod: 3.25.76
-      zod-error: 1.5.0
-      zod-validation-error: 1.5.0(zod@3.25.76)
+      zod: 4.6.6
+      zod-validation-error: 5.0.0(zod@4.6.6)
     transitivePeerDependencies:
       - bufferutil
       - supports-color
       - utf-8-validate
 
-  '@trigger.dev/sdk@4.5.9(react@19.3.0)(zod@4.4.3)':
+  '@trigger.dev/sdk@4.6.4(react@19.3.0)(zod@4.6.6)':
     dependencies:
       '@opentelemetry/api': 1.9.1
       '@opentelemetry/semantic-conventions': 1.41.1
-      '@trigger.dev/core': 4.5.9
-      chalk: 5.6.2
-      cronstrue: 2.59.0
-      debug: 4.4.3(supports-color@10.2.2)
-      evt: 2.5.9
-      slug: 6.1.0
-      ulid: 2.4.0
+      '@trigger.dev/core': 4.6.4(zod@4.6.6)
       uncrypto: 0.1.3
-      ws: 8.21.0
-      zod: 4.4.3
+      zod: 4.6.6
     optionalDependencies:
       react: 19.3.0
     transitivePeerDependencies:
@@ -12189,10 +12122,6 @@ snapshots:
       '@types/deep-eql': 4.0.2
       assertion-error: 2.0.1
 
-  '@types/cors@2.8.19':
-    dependencies:
-      '@types/node': 24.13.3
-
   '@types/deep-eql@4.0.2': {}
 
   '@types/doctrine@0.0.9': {}
@@ -12235,10 +12164,6 @@ snapshots:
 
   '@types/triple-beam@1.3.5': {}
 
-  '@types/ws@8.18.2':
-    dependencies:
-      '@types/node': 24.13.3
-
   '@types/yauzl@2.10.3':
     dependencies:
       '@types/node': 24.13.3
@@ -12583,11 +12508,6 @@ snapshots:
 
   abstract-logging@2.0.1: {}
 
-  accepts@1.3.8:
-    dependencies:
-      mime-types: 2.1.35
-      negotiator: 0.6.3
-
   accepts@2.0.0:
     dependencies:
       mime-types: 3.0.2
@@ -12841,8 +12761,6 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  base64id@2.0.0: {}
-
   baseline-browser-mapping@2.11.9: {}
 
   before-after-hook@4.0.0: {}
@@ -12876,7 +12794,7 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.2
 
-  body-parser@2.3.0:
+  body-parser@2.4.0:
     dependencies:
       bytes: 3.1.2
       content-type: 2.1.0
@@ -12884,7 +12802,7 @@ snapshots:
       http-errors: 2.0.1
       iconv-lite: 0.7.3
       on-finished: 2.4.1
-      qs: 6.16.0
+      qs: 6.16.1
       raw-body: 3.0.2
       type-is: 2.1.0
     transitivePeerDependencies:
@@ -13179,8 +13097,6 @@ snapshots:
     dependencies:
       luxon: 3.7.2
 
-  cronstrue@2.59.0: {}
-
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -13515,22 +13431,6 @@ snapshots:
 
   engine.io-parser@5.2.3: {}
 
-  engine.io@6.6.11:
-    dependencies:
-      '@types/cors': 2.8.19
-      '@types/node': 24.13.3
-      '@types/ws': 8.18.2
-      accepts: 1.3.8
-      cookie: 0.7.2
-      cors: 2.8.6
-      debug: 4.4.3(supports-color@10.2.2)
-      engine.io-parser: 5.2.3
-      ws: 8.21.1
-    transitivePeerDependencies:
-      - bufferutil
-      - supports-color
-      - utf-8-validate
-
   enhanced-resolve@5.24.2:
     dependencies:
       graceful-fs: 4.2.11
@@ -13907,12 +13807,6 @@ snapshots:
     dependencies:
       eventsource-parser: 3.1.0
 
-  evt@2.5.9:
-    dependencies:
-      minimal-polyfills: 2.2.3
-      run-exclusive: 2.2.19
-      tsafe: 1.8.12
-
   execa@5.1.1:
     dependencies:
       cross-spawn: 7.0.6
@@ -13954,7 +13848,7 @@ snapshots:
   express@5.2.1:
     dependencies:
       accepts: 2.0.0
-      body-parser: 2.3.0
+      body-parser: 2.4.0
       content-disposition: 1.1.0
       content-type: 1.0.5
       cookie: 0.7.2
@@ -14914,7 +14808,7 @@ snapshots:
       saxes: 6.0.0
       symbol-tree: 3.2.4
       tough-cookie: 6.0.2
-      undici: 8.10.2
+      undici: 8.12.2
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
@@ -15003,7 +14897,7 @@ snapshots:
       tinyglobby: 0.2.17
       unbash: 4.0.12
       yaml: 2.9.1
-      zod: 4.4.3
+      zod: 4.6.6
 
   kuler@2.0.0: {}
 
@@ -15349,14 +15243,8 @@ snapshots:
       braces: 3.0.3
       picomatch: 2.3.2
 
-  mime-db@1.52.0: {}
-
   mime-db@1.54.0: {}
 
-  mime-types@2.1.35:
-    dependencies:
-      mime-db: 1.52.0
-
   mime-types@3.0.2:
     dependencies:
       mime-db: 1.54.0
@@ -15371,8 +15259,6 @@ snapshots:
 
   min-indent@1.0.1: {}
 
-  minimal-polyfills@2.2.3: {}
-
   minimatch@10.2.6:
     dependencies:
       brace-expansion: 5.0.12
@@ -15464,8 +15350,6 @@ snapshots:
 
   natural-compare@1.4.0: {}
 
-  negotiator@0.6.3: {}
-
   negotiator@1.0.0: {}
 
   netlify-cli@27.1.1(@types/node@24.13.3)(picomatch@4.0.7):
@@ -16330,6 +16214,11 @@ snapshots:
       es-define-property: 1.0.1
       side-channel: 1.1.1
 
+  qs@6.16.1:
+    dependencies:
+      es-define-property: 1.0.1
+      side-channel: 1.1.1
+
   queue-microtask@1.2.3: {}
 
   queue@6.0.2:
@@ -16640,10 +16529,6 @@ snapshots:
 
   run-async@2.4.1: {}
 
-  run-exclusive@2.2.19:
-    dependencies:
-      minimal-polyfills: 2.2.3
-
   run-parallel@1.2.0:
     dependencies:
       queue-microtask: 1.2.3
@@ -16873,19 +16758,8 @@ snapshots:
       ansi-styles: 6.2.3
       is-fullwidth-code-point: 5.1.0
 
-  slug@6.1.0: {}
-
   smol-toml@1.9.0: {}
 
-  socket.io-adapter@2.5.8:
-    dependencies:
-      debug: 4.4.3(supports-color@10.2.2)
-      ws: 8.21.1
-    transitivePeerDependencies:
-      - bufferutil
-      - supports-color
-      - utf-8-validate
-
   socket.io-client@4.7.5:
     dependencies:
       '@socket.io/component-emitter': 3.1.2
@@ -16904,20 +16778,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  socket.io@4.7.4:
-    dependencies:
-      accepts: 1.3.8
-      base64id: 2.0.0
-      cors: 2.8.6
-      debug: 4.3.7
-      engine.io: 6.6.11
-      socket.io-adapter: 2.5.8
-      socket.io-parser: 4.2.7
-    transitivePeerDependencies:
-      - bufferutil
-      - supports-color
-      - utf-8-validate
-
   sonic-boom@4.2.1:
     dependencies:
       atomic-sleep: 1.0.0
@@ -17329,8 +17189,6 @@ snapshots:
       v8-compile-cache-lib: 3.0.1
       yn: 3.1.1
 
-  tsafe@1.8.12: {}
-
   tsconfck@3.1.6(typescript@5.9.3):
     optionalDependencies:
       typescript: 5.9.3
@@ -17444,8 +17302,6 @@ snapshots:
     dependencies:
       random-bytes: 1.0.0
 
-  ulid@2.4.0: {}
-
   ulid@3.0.2: {}
 
   unbash@4.0.12: {}
@@ -17461,7 +17317,7 @@ snapshots:
 
   undici-types@7.18.2: {}
 
-  undici@8.10.2: {}
+  undici@8.12.2: {}
 
   unicode-properties@1.4.1:
     dependencies:
@@ -17951,18 +17807,12 @@ snapshots:
       normalize-path: 3.0.0
       readable-stream: 4.7.0
 
-  zod-error@1.5.0:
+  zod-to-json-schema@3.25.2(zod@4.6.6):
     dependencies:
-      zod: 3.25.76
+      zod: 4.6.6
 
-  zod-to-json-schema@3.25.2(zod@4.4.3):
+  zod-validation-error@5.0.0(zod@4.6.6):
     dependencies:
-      zod: 4.4.3
-
-  zod-validation-error@1.5.0(zod@3.25.76):
-    dependencies:
-      zod: 3.25.76
-
-  zod@3.25.76: {}
+      zod: 4.6.6
 
-  zod@4.4.3: {}
+  zod@4.6.6: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 3d37208a..8fa3b15e 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -8,7 +8,7 @@ catalog:
   "@aws-sdk/client-sqs": 3.1100.0
   "@hono/zod-openapi": 1.5.1
   "@react-pdf/renderer": 4.5.1
-  "@trigger.dev/sdk": 4.5.9
+  "@trigger.dev/sdk": 4.6.4
   "@types/node": 24.13.3
   "@types/react": 19.2.18
   "@types/react-dom": 19.2.4
@@ -25,7 +25,7 @@ catalog:
   typescript: 5.9.3
   vite: 8.2.4
   vitest: 4.1.11
-  zod: 4.4.3
+  zod: 4.6.6
 
 onlyBuiltDependencies:
   - esbuild
diff --git a/scripts/dependency-advisories.test.mjs b/scripts/dependency-advisories.test.mjs
index 98dd14cb..6add29b4 100644
--- a/scripts/dependency-advisories.test.mjs
+++ b/scripts/dependency-advisories.test.mjs
@@ -35,6 +35,8 @@ const acceptedAdvisories = new Map([
 // `pnpm.overrides` block. If an override is dropped the resolved version slides
 // back under the advisory's vulnerable range and this catches it.
 const pinnedTransitives = [
+  { name: "body-parser", minimum: "2.4.0", override: "body-parser@>=2 <2.4.0" },
+  { name: "undici", minimum: "8.12.2", override: "undici@>=8 <8.12.2" },
   {
     name: "@fastify/busboy",
     minimum: "3.2.2",
@@ -60,6 +62,7 @@ const pinnedTransitives = [
 // Direct catalog dependencies. Vite also has an override so test tooling's
 // transitive copy cannot retain a vulnerable version.
 const catalogFloors = [
+  { name: "zod", minimum: "4.6.6" },
   { name: "hono", minimum: "4.13.7" },
   { name: "vite", minimum: "8.2.4" },
 ];