@bensandee/tooling 0.56.0 → 0.57.1

package/dist/bin.mjs

@@ -1575,12 +1575,12 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1591,12 +1591,12 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1607,12 +1607,12 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1623,12 +1623,12 @@ const PER_PACKAGE_DEV_DEPS = {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1642,12 +1642,12 @@ const ROOT_DEV_DEPS = {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1658,12 +1658,12 @@ const ROOT_DEV_DEPS = {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1674,12 +1674,12 @@ const ROOT_DEV_DEPS = {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1715,12 +1715,12 @@ function addReleaseDeps(deps, config) {
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.2",
 				"commit-and-tag-version": "12.7.1",
-				"knip": "6.6.2",
+				"knip": "6.9.0",
 				"lefthook": "2.1.6",
-				"oxfmt": "0.46.0",
-				"oxlint": "1.61.0",
+				"oxfmt": "0.47.0",
+				"oxlint": "1.62.0",
 				"prettier": "3.8.3",
-				"release-it": "20.0.0",
+				"release-it": "20.0.1",
 				"tsdown": "0.21.10",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
@@ -1731,12 +1731,12 @@ function addReleaseDeps(deps, config) {
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.2",
 				"commit-and-tag-version": "12.7.1",
-				"knip": "6.6.2",
+				"knip": "6.9.0",
 				"lefthook": "2.1.6",
-				"oxfmt": "0.46.0",
-				"oxlint": "1.61.0",
+				"oxfmt": "0.47.0",
+				"oxlint": "1.62.0",
 				"prettier": "3.8.3",
-				"release-it": "20.0.0",
+				"release-it": "20.0.1",
 				"tsdown": "0.21.10",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
@@ -1749,12 +1749,12 @@ function addReleaseDeps(deps, config) {
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.2",
 				"commit-and-tag-version": "12.7.1",
-				"knip": "6.6.2",
+				"knip": "6.9.0",
 				"lefthook": "2.1.6",
-				"oxfmt": "0.46.0",
-				"oxlint": "1.61.0",
+				"oxfmt": "0.47.0",
+				"oxlint": "1.62.0",
 				"prettier": "3.8.3",
-				"release-it": "20.0.0",
+				"release-it": "20.0.1",
 				"tsdown": "0.21.10",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
@@ -1767,12 +1767,12 @@ function addReleaseDeps(deps, config) {
 				"@release-it/bumper": "7.0.5",
 				"@types/node": "24.12.2",
 				"commit-and-tag-version": "12.7.1",
-				"knip": "6.6.2",
+				"knip": "6.9.0",
 				"lefthook": "2.1.6",
-				"oxfmt": "0.46.0",
-				"oxlint": "1.61.0",
+				"oxfmt": "0.47.0",
+				"oxlint": "1.62.0",
 				"prettier": "3.8.3",
-				"release-it": "20.0.0",
+				"release-it": "20.0.1",
 				"tsdown": "0.21.10",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
@@ -1800,19 +1800,19 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.10.2";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.56.0";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.57.1";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.12.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.31.0",
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1823,12 +1823,12 @@ async function generatePackageJson(ctx) {
 		"@release-it/bumper": "7.0.5",
 		"@types/node": "24.12.2",
 		"commit-and-tag-version": "12.7.1",
-		"knip": "6.6.2",
+		"knip": "6.9.0",
 		"lefthook": "2.1.6",
-		"oxfmt": "0.46.0",
-		"oxlint": "1.61.0",
+		"oxfmt": "0.47.0",
+		"oxlint": "1.62.0",
 		"prettier": "3.8.3",
-		"release-it": "20.0.0",
+		"release-it": "20.0.1",
 		"tsdown": "0.21.10",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
@@ -1917,12 +1917,12 @@ async function generatePackageJson(ctx) {
 			"@release-it/bumper": "7.0.5",
 			"@types/node": "24.12.2",
 			"commit-and-tag-version": "12.7.1",
-			"knip": "6.6.2",
+			"knip": "6.9.0",
 			"lefthook": "2.1.6",
-			"oxfmt": "0.46.0",
-			"oxlint": "1.61.0",
+			"oxfmt": "0.47.0",
+			"oxlint": "1.62.0",
 			"prettier": "3.8.3",
-			"release-it": "20.0.0",
+			"release-it": "20.0.1",
 			"tsdown": "0.21.10",
 			"typescript": "6.0.3",
 			"vitest": "4.1.5",
@@ -2104,239 +2104,598 @@ function generateMonorepoPackageTsconfigs(ctx) {
 	return results;
 }
 //#endregion
-//#region src/generators/vitest.ts
-const VITEST_CONFIG = `import { defineConfig } from "vitest/config";
-
-export default defineConfig({
-  test: {
-    include: ["test/**/*.test.ts"],
-    coverage: {
-      provider: "v8",
-      reporter: ["text", "html", "lcov", "json-summary"],
-    },
-  },
+//#region src/coverage-tracking/compare.ts
+const TOTAL_KEYS = [
+	"lines",
+	"statements",
+	"branches",
+	"functions"
+];
+const DEFAULT_TOLERANCE_PP = .1;
+/** Round to 2 decimal places to keep diff output stable across runs. */
+function round2$1(n) {
+	return Math.round(n * 100) / 100;
+}
+/**
+* Compare a current run against a baseline across the four overall totals.
+* A total passes when current >= baseline OR (baseline - current) <= tolerancePp.
+*/
+function compareTotals(baseline, current, tolerancePp = DEFAULT_TOLERANCE_PP) {
+	const totals = TOTAL_KEYS.map((key) => {
+		const b = baseline[key];
+		const c = current[key];
+		return {
+			key,
+			baseline: b,
+			current: c,
+			delta: round2$1(c - b),
+			pass: c >= b || b - c <= tolerancePp
+		};
+	});
+	return {
+		pass: totals.every((t) => t.pass),
+		tolerancePp,
+		totals
+	};
+}
+/** True iff every total is flat-or-up (delta >= 0). Used to gate baseline updates. */
+function isFlatOrUp(baseline, current) {
+	return TOTAL_KEYS.every((key) => current[key] >= baseline[key]);
+}
+//#endregion
+//#region src/coverage-tracking/parse.ts
+const TotalEntrySchema = z.object({
+	total: z.number(),
+	covered: z.number(),
+	skipped: z.number().optional(),
+	pct: z.number()
 });
-`;
-const STARTER_TEST = `import { describe, it, expect } from "vitest";
-
-describe("example", () => {
-  it("should pass a basic assertion", () => {
-    expect(1 + 1).toBe(2);
-  });
+const FileEntrySchema = z.object({
+	lines: TotalEntrySchema,
+	statements: TotalEntrySchema,
+	branches: TotalEntrySchema,
+	functions: TotalEntrySchema
 });
-`;
-async function generateVitest(ctx) {
-	const results = [];
-	if (!ctx.config.setupVitest) return [{
-		filePath: "vitest.config.ts",
-		action: "skipped",
-		description: "Vitest setup not requested"
-	}];
-	if (ctx.config.structure === "monorepo") return [{
-		filePath: "vitest.config.ts",
-		action: "skipped",
-		description: "Monorepo: vitest config belongs in individual packages"
-	}];
-	const configPath = "vitest.config.ts";
-	if (ctx.exists(configPath)) if (ctx.read(configPath) === VITEST_CONFIG) results.push({
-		filePath: configPath,
-		action: "skipped",
-		description: "Config already up to date"
-	});
-	else if (await ctx.confirmOverwrite(configPath) === "skip") results.push({
-		filePath: configPath,
-		action: "skipped",
-		description: "Existing config preserved"
-	});
-	else {
-		ctx.write(configPath, VITEST_CONFIG);
-		results.push({
-			filePath: configPath,
-			action: "updated",
-			description: "Replaced vitest config"
-		});
+/**
+* Schema for v8 / istanbul `coverage/coverage-summary.json`. The "total" key
+* holds the grand totals; every other key is a per-file path → entry mapping.
+*/
+const V8CoverageSummarySchema = z.object({ total: FileEntrySchema }).catchall(FileEntrySchema);
+const TotalsSchema = z.object({
+	lines: z.number(),
+	statements: z.number(),
+	branches: z.number(),
+	functions: z.number()
+});
+const PackageEntrySchema = z.object({
+	lines: z.number(),
+	branches: z.number()
+});
+/** Coverage record without identity fields — body shape for `coverage-baseline.json`. */
+const CoverageBaselineSchema = z.object({
+	totals: TotalsSchema,
+	packages: z.record(z.string(), PackageEntrySchema)
+});
+/** Full trimmed record — appended to `coverage-history.jsonl` and emitted by `coverage:summary`. */
+const CoverageRecordSchema = CoverageBaselineSchema.extend({
+	sha: z.string(),
+	timestamp: z.string()
+});
+/** Parse a v8 `coverage-summary.json` blob; throws FatalError on malformed input. */
+function parseV8Summary(raw) {
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch (error) {
+		throw new FatalError(`coverage-summary.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	else {
-		ctx.write(configPath, VITEST_CONFIG);
-		results.push({
-			filePath: configPath,
-			action: "created",
-			description: "Generated vitest.config.ts"
-		});
+	const result = V8CoverageSummarySchema.safeParse(json);
+	if (!result.success) throw new FatalError(`coverage-summary.json shape doesn't match v8 / istanbul output: ${result.error.message}`);
+	return result.data;
+}
+/** Parse a `coverage-baseline.json` blob; throws FatalError on malformed input. */
+function parseBaseline(raw) {
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch (error) {
+		throw new FatalError(`coverage-baseline.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	const testPath = "test/example.test.ts";
-	if (!ctx.exists("test")) {
-		ctx.write(testPath, STARTER_TEST);
-		results.push({
-			filePath: testPath,
-			action: "created",
-			description: "Generated starter test file"
-		});
+	const result = CoverageBaselineSchema.safeParse(json);
+	if (!result.success) throw new FatalError(`coverage-baseline.json has unexpected shape: ${result.error.message}`);
+	return result.data;
+}
+/** Parse a single line of `coverage-history.jsonl`; returns undefined for malformed lines. */
+function parseHistoryLine(line) {
+	let json;
+	try {
+		json = JSON.parse(line);
+	} catch (_error) {
+		return;
 	}
-	return results;
+	const result = CoverageRecordSchema.safeParse(json);
+	return result.success ? result.data : void 0;
 }
 //#endregion
-//#region src/generators/oxlint.ts
-const IGNORE_PATTERNS_SPREAD = "...(recommended.ignorePatterns ?? [])";
-const CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlint/recommended";
-import { defineConfig } from "oxlint";
-
-export default defineConfig({
-  extends: [recommended],
-  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],
-});
-`;
-const CONFIG_PRESET_ONLY = `import { presetRules, recommended } from "@bensandee/config/oxlint";
-import { defineConfig } from "oxlint";
-
-export default defineConfig({
-  rules: presetRules,
-  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],
-});
-`;
-function addIgnorePatterns(content) {
-	if (content.includes("ignorePatterns")) return void 0;
-	const match = content.match(/defineConfig\(\{(\r?\n)/);
-	if (!match) return void 0;
-	const insertPos = (match.index ?? 0) + match[0].length;
-	return content.slice(0, insertPos) + `  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],\n` + content.slice(insertPos);
+//#region src/coverage-tracking/history.ts
+const DEFAULT_HISTORY_BRANCH = "bst/coverage-metrics";
+const HISTORY_FILE = "coverage-history.jsonl";
+const MAX_PUSH_ATTEMPTS = 5;
+function remoteRef(config) {
+	return `refs/remotes/${config.remote ?? "origin"}/${config.historyBranch}`;
 }
-async function generateOxlint(ctx) {
-	const filePath = "oxlint.config.ts";
-	const content = ctx.config.useEslintPlugin ? CONFIG_WITH_LINT_RULES : CONFIG_PRESET_ONLY;
-	const existing = ctx.read(filePath);
-	if (existing) {
-		if (existing === content) return {
-			filePath,
-			action: "skipped",
-			description: "Already configured"
-		};
-		if (existing.includes("@bensandee/config/oxlint")) {
-			const updated = addIgnorePatterns(existing);
-			if (!updated) return {
-				filePath,
-				action: "skipped",
-				description: "Already configured"
-			};
-			ctx.write(filePath, updated);
-			return {
-				filePath,
-				action: "updated",
-				description: "Added ignorePatterns"
-			};
-		}
-		if (await ctx.confirmOverwrite(filePath) === "skip") return {
-			filePath,
-			action: "skipped",
-			description: "User chose to keep existing"
-		};
-	}
-	ctx.write(filePath, content);
+function fetchBranch(executor, config) {
+	const remote = config.remote ?? "origin";
+	if (executor.exec("git", [
+		"fetch",
+		remote,
+		`${config.historyBranch}:${remoteRef(config)}`
+	], { cwd: config.cwd }).exitCode !== 0) return { exists: false };
+	const revParse = executor.exec("git", [
+		"rev-parse",
+		"--quiet",
+		"--verify",
+		remoteRef(config)
+	], { cwd: config.cwd });
+	if (revParse.exitCode !== 0) return { exists: false };
 	return {
-		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated oxlint.config.ts"
+		exists: true,
+		parentSha: revParse.stdout.trim()
 	};
 }
-//#endregion
-//#region src/generators/formatter.ts
-/** Ignore patterns that must always be present in .oxfmtrc.json. */
-const BASE_IGNORE_PATTERNS = [".claude"];
-/** Extra ignore patterns when a release strategy generates CHANGELOGs. */
-const RELEASE_IGNORE_PATTERNS = ["**/CHANGELOG.md"];
-function requiredIgnorePatterns(releaseStrategy) {
-	if (releaseStrategy === "none") return BASE_IGNORE_PATTERNS;
-	return [...BASE_IGNORE_PATTERNS, ...RELEASE_IGNORE_PATTERNS];
-}
-const PRETTIER_CONFIG = `{
-  "semi": true,
-  "singleQuote": false,
-  "trailingComma": "all",
-  "tabWidth": 2,
-  "printWidth": 120
+function readRemoteHistory(executor, config) {
+	const showResult = executor.exec("git", ["show", `${remoteRef(config)}:${HISTORY_FILE}`], { cwd: config.cwd });
+	if (showResult.exitCode !== 0) return "";
+	return showResult.stdout;
 }
-`;
-async function generateFormatter(ctx) {
-	if (ctx.config.formatter === "oxfmt") return generateOxfmt(ctx);
-	return generatePrettier(ctx);
+function makeBlob(executor, cwd, content) {
+	const result = executor.exec("git", [
+		"hash-object",
+		"-w",
+		"--stdin"
+	], {
+		cwd,
+		input: content
+	});
+	if (result.exitCode !== 0) throw new FatalError(`git hash-object failed: ${result.stderr.trim() || "unknown error"}`);
+	return result.stdout.trim();
 }
-async function generateOxfmt(ctx) {
-	const filePath = ".oxfmtrc.json";
-	const required = requiredIgnorePatterns(ctx.config.releaseStrategy);
-	const existing = ctx.read(filePath);
-	if (!existing) {
-		const config = { ignorePatterns: required };
-		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
-		return {
-			filePath,
-			action: "created",
-			description: "Generated .oxfmtrc.json"
-		};
+function makeTree(executor, cwd, blobSha) {
+	const treeInput = `100644 blob ${blobSha}\t${HISTORY_FILE}\n`;
+	const result = executor.exec("git", ["mktree"], {
+		cwd,
+		input: treeInput
+	});
+	if (result.exitCode !== 0) throw new FatalError(`git mktree failed: ${result.stderr.trim() || "unknown error"}`);
+	return result.stdout.trim();
+}
+function makeCommit(executor, config, treeSha, parentSha, message) {
+	const env = {};
+	if (config.authorName) {
+		env["GIT_AUTHOR_NAME"] = config.authorName;
+		env["GIT_COMMITTER_NAME"] = config.authorName;
 	}
-	const OxfmtConfigSchema = z.record(z.string(), z.unknown());
-	let jsonValue;
-	try {
-		jsonValue = JSON.parse(existing);
-	} catch {
-		const config = { ignorePatterns: required };
-		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
-		return {
-			filePath,
-			action: "updated",
-			description: "Replaced malformed .oxfmtrc.json"
-		};
+	if (config.authorEmail) {
+		env["GIT_AUTHOR_EMAIL"] = config.authorEmail;
+		env["GIT_COMMITTER_EMAIL"] = config.authorEmail;
 	}
-	const parseResult = OxfmtConfigSchema.safeParse(jsonValue);
-	if (!parseResult.success) {
-		const config = { ignorePatterns: required };
-		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
-		return {
-			filePath,
-			action: "updated",
-			description: "Replaced malformed .oxfmtrc.json"
+	const args = parentSha ? [
+		"commit-tree",
+		"-p",
+		parentSha,
+		"-m",
+		message,
+		treeSha
+	] : [
+		"commit-tree",
+		"-m",
+		message,
+		treeSha
+	];
+	const result = executor.exec("git", args, {
+		cwd: config.cwd,
+		env
+	});
+	if (result.exitCode !== 0) throw new FatalError(`git commit-tree failed: ${result.stderr.trim() || "unknown error"}`);
+	return result.stdout.trim();
+}
+function pushCommit(executor, config, commitSha, parentSha) {
+	const remote = config.remote ?? "origin";
+	const refSpec = `${commitSha}:refs/heads/${config.historyBranch}`;
+	if (parentSha === void 0) return executor.exec("git", [
+		"push",
+		remote,
+		refSpec
+	], { cwd: config.cwd });
+	const lease = `--force-with-lease=refs/heads/${config.historyBranch}:${parentSha}`;
+	return executor.exec("git", [
+		"push",
+		lease,
+		remote,
+		refSpec
+	], { cwd: config.cwd });
+}
+function shortSha(sha) {
+	return sha.slice(0, 7);
+}
+/**
+* Append a coverage record to the orphan branch. Bootstraps the branch on first run.
+* Uses pure git plumbing (no worktree / no checkout) so the working tree stays untouched.
+* On push conflict (concurrent record), refetches and rebuilds the commit (up to MAX_PUSH_ATTEMPTS).
+*/
+function appendRecord(executor, config, record) {
+	const line = JSON.stringify(record) + "\n";
+	let lastError = "";
+	for (let attempt = 1; attempt <= MAX_PUSH_ATTEMPTS; attempt++) {
+		const fetched = fetchBranch(executor, config);
+		const newContent = (fetched.exists ? readRemoteHistory(executor, config) : "") + line;
+		const blobSha = makeBlob(executor, config.cwd, newContent);
+		const treeSha = makeTree(executor, config.cwd, blobSha);
+		const message = `chore(coverage): record ${shortSha(record.sha)} [skip ci]`;
+		const commitSha = makeCommit(executor, config, treeSha, fetched.parentSha, message);
+		const pushResult = pushCommit(executor, config, commitSha, fetched.parentSha);
+		if (pushResult.exitCode === 0) return {
+			commitSha,
+			bootstrapped: !fetched.exists,
+			attempts: attempt
 		};
+		lastError = pushResult.stderr.trim() || pushResult.stdout.trim() || "unknown push error";
 	}
-	const parsed = parseResult.data;
-	const ignorePatterns = Array.isArray(parsed["ignorePatterns"]) ? parsed["ignorePatterns"] : [];
-	const existingSet = new Set(ignorePatterns.filter((p) => typeof p === "string"));
-	const missing = required.filter((p) => !existingSet.has(p));
-	if (missing.length === 0) return {
-		filePath,
-		action: "skipped",
-		description: "Existing oxfmt config already has required ignorePatterns"
-	};
-	parsed["ignorePatterns"] = [...ignorePatterns, ...missing];
-	ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
-	return {
-		filePath,
-		action: "updated",
-		description: `Added ignorePatterns: ${missing.join(", ")}`
-	};
+	throw new FatalError(`Failed to push to ${config.historyBranch} after ${MAX_PUSH_ATTEMPTS} attempts: ${lastError}`);
 }
-async function generatePrettier(ctx) {
-	const filePath = ".prettierrc";
-	if (ctx.exists(filePath)) return {
-		filePath,
-		action: "skipped",
-		description: "Existing prettier config preserved"
+/**
+* Read all records from the orphan branch (read-only). Performs a shallow fetch and
+* reads via `git show` — no working-tree disruption, no local branch creation.
+* Returns an empty array if the branch doesn't exist yet.
+*/
+function readRecords(executor, config) {
+	if (!fetchBranch(executor, config).exists) return [];
+	const raw = readRemoteHistory(executor, config);
+	const records = [];
+	for (const line of raw.split("\n")) {
+		if (line.trim() === "") continue;
+		const parsed = parseHistoryLine(line);
+		if (parsed) records.push(parsed);
+	}
+	return records;
+}
+//#endregion
+//#region src/coverage-tracking/config.ts
+/** Resolve the effective coverage configuration from explicit inputs (testable). */
+function resolveFromInputs(inputs) {
+	if (inputs.coverage === false) return {
+		enabled: false,
+		historyEnabled: false,
+		historyBranch: DEFAULT_HISTORY_BRANCH,
+		tolerancePp: DEFAULT_TOLERANCE_PP,
+		gateOnPullRequests: false
 	};
-	ctx.write(filePath, PRETTIER_CONFIG);
+	const enabled = inputs.hasVitestConfig || inputs.setupVitest;
+	const overrides = inputs.coverage ?? {};
 	return {
-		filePath,
-		action: "created",
-		description: "Generated .prettierrc"
+		enabled,
+		historyEnabled: enabled && overrides.history !== "none",
+		historyBranch: overrides.historyBranch ?? "bst/coverage-metrics",
+		tolerancePp: overrides.tolerancePp ?? .1,
+		gateOnPullRequests: overrides.gateOnPullRequests ?? false
 	};
 }
+/**
+* Resolve from the real filesystem (used by CLI commands).
+* Default-on when a vitest config is detected and `.tooling.json#coverage` is not `false`.
+*/
+function resolveCoverageConfig(targetDir) {
+	const tooling = safeLoadToolingConfig(targetDir);
+	return resolveFromInputs({
+		hasVitestConfig: existsSync(path.join(targetDir, "vitest.config.ts")) || existsSync(path.join(targetDir, "vitest.config.mts")),
+		setupVitest: tooling?.setupVitest === true,
+		coverage: tooling?.coverage
+	});
+}
+const CoverageOverridesShape = z.object({
+	history: z.enum(["orphan-branch", "none"]).optional(),
+	historyBranch: z.string().optional(),
+	tolerancePp: z.number().nonnegative().optional(),
+	gateOnPullRequests: z.boolean().optional()
+});
+const CoverageFieldSchema = z.union([z.literal(false), CoverageOverridesShape]);
+const ToolingShallowSchema = z.object({
+	setupVitest: z.boolean().optional(),
+	coverage: CoverageFieldSchema.optional()
+});
+/** Resolve from a generator context (used by generators for mock-friendly testing). */
+function resolveCoverageConfigFromContext(reader, fallbackSetupVitest) {
+	const toolingRaw = reader.read(".tooling.json");
+	let setupVitest = fallbackSetupVitest;
+	let coverage;
+	if (toolingRaw) try {
+		const result = ToolingShallowSchema.safeParse(JSON.parse(toolingRaw));
+		if (result.success) {
+			if (typeof result.data.setupVitest === "boolean") setupVitest = result.data.setupVitest;
+			coverage = result.data.coverage;
+		}
+	} catch (_error) {}
+	return resolveFromInputs({
+		hasVitestConfig: reader.exists("vitest.config.ts") || reader.exists("vitest.config.mts"),
+		setupVitest,
+		coverage
+	});
+}
+/** Like loadToolingConfig but returns undefined on any error so commands can degrade gracefully. */
+function safeLoadToolingConfig(targetDir) {
+	try {
+		return loadToolingConfig(targetDir);
+	} catch (_error) {
+		return;
+	}
+}
 //#endregion
-//#region src/generators/tsdown.ts
-const TSDOWN_CONFIG = `import { defineConfig } from "tsdown";
+//#region src/generators/vitest.ts
+const VITEST_CONFIG = `import { defineConfig } from "vitest/config";
 
 export default defineConfig({
-  entry: ["src/index.ts"],
+  test: {
+    include: ["test/**/*.test.ts"],
+    coverage: {
+      provider: "v8",
+      reporter: ["text", "html", "lcov", "json-summary"],
+    },
+  },
 });
 `;
-async function generateTsdown(ctx) {
-	const filePath = "tsdown.config.ts";
+const STARTER_TEST = `import { describe, it, expect } from "vitest";
+
+describe("example", () => {
+  it("should pass a basic assertion", () => {
+    expect(1 + 1).toBe(2);
+  });
+});
+`;
+const ROOT_CONFIG_PATHS = ["vitest.config.ts", "vitest.config.mts"];
+function findJsonSummaryIssue(content) {
+	if (!/\bcoverage\s*:\s*\{/.test(content)) return "missing-coverage";
+	const reporterMatch = /\breporter\s*:\s*\[([\s\S]*?)\]/.exec(content);
+	if (!reporterMatch) return "missing-reporter";
+	if (!reporterMatch[1]?.includes("json-summary")) return "missing-json-summary";
+}
+function describeIssue(issue) {
+	switch (issue) {
+		case "missing-coverage": return "no `coverage` block found";
+		case "missing-reporter": return "no `reporter` array inside `coverage` block";
+		case "missing-json-summary": return "`coverage.reporter` does not include \"json-summary\"";
+	}
+}
+function warnIfMissingJsonSummary(ctx) {
+	if (!resolveCoverageConfigFromContext(ctx, ctx.config.setupVitest).enabled) return;
+	for (const rel of ROOT_CONFIG_PATHS) {
+		if (!ctx.exists(rel)) continue;
+		const content = ctx.read(rel);
+		if (content === void 0) continue;
+		const issue = findJsonSummaryIssue(content);
+		if (issue === void 0) return;
+		log.warn(`${rel}: ${describeIssue(issue)} — coverage tracking (bst coverage:summary / coverage:check) requires the "json-summary" reporter to read coverage/coverage-summary.json.`);
+		return;
+	}
+}
+async function generateVitest(ctx) {
+	const results = [];
+	if (!ctx.config.setupVitest) {
+		warnIfMissingJsonSummary(ctx);
+		return [{
+			filePath: "vitest.config.ts",
+			action: "skipped",
+			description: "Vitest setup not requested"
+		}];
+	}
+	if (ctx.config.structure === "monorepo") {
+		warnIfMissingJsonSummary(ctx);
+		return [{
+			filePath: "vitest.config.ts",
+			action: "skipped",
+			description: "Monorepo: vitest config belongs in individual packages"
+		}];
+	}
+	const configPath = "vitest.config.ts";
+	if (ctx.exists(configPath)) if (ctx.read(configPath) === VITEST_CONFIG) results.push({
+		filePath: configPath,
+		action: "skipped",
+		description: "Config already up to date"
+	});
+	else if (await ctx.confirmOverwrite(configPath) === "skip") results.push({
+		filePath: configPath,
+		action: "skipped",
+		description: "Existing config preserved"
+	});
+	else {
+		ctx.write(configPath, VITEST_CONFIG);
+		results.push({
+			filePath: configPath,
+			action: "updated",
+			description: "Replaced vitest config"
+		});
+	}
+	else {
+		ctx.write(configPath, VITEST_CONFIG);
+		results.push({
+			filePath: configPath,
+			action: "created",
+			description: "Generated vitest.config.ts"
+		});
+	}
+	const testPath = "test/example.test.ts";
+	if (!ctx.exists("test")) {
+		ctx.write(testPath, STARTER_TEST);
+		results.push({
+			filePath: testPath,
+			action: "created",
+			description: "Generated starter test file"
+		});
+	}
+	warnIfMissingJsonSummary(ctx);
+	return results;
+}
+//#endregion
+//#region src/generators/oxlint.ts
+const IGNORE_PATTERNS_SPREAD = "...(recommended.ignorePatterns ?? [])";
+const CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlint/recommended";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({
+  extends: [recommended],
+  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],
+});
+`;
+const CONFIG_PRESET_ONLY = `import { presetRules, recommended } from "@bensandee/config/oxlint";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({
+  rules: presetRules,
+  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],
+});
+`;
+function addIgnorePatterns(content) {
+	if (content.includes("ignorePatterns")) return void 0;
+	const match = content.match(/defineConfig\(\{(\r?\n)/);
+	if (!match) return void 0;
+	const insertPos = (match.index ?? 0) + match[0].length;
+	return content.slice(0, insertPos) + `  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],\n` + content.slice(insertPos);
+}
+async function generateOxlint(ctx) {
+	const filePath = "oxlint.config.ts";
+	const content = ctx.config.useEslintPlugin ? CONFIG_WITH_LINT_RULES : CONFIG_PRESET_ONLY;
+	const existing = ctx.read(filePath);
+	if (existing) {
+		if (existing === content) return {
+			filePath,
+			action: "skipped",
+			description: "Already configured"
+		};
+		if (existing.includes("@bensandee/config/oxlint")) {
+			const updated = addIgnorePatterns(existing);
+			if (!updated) return {
+				filePath,
+				action: "skipped",
+				description: "Already configured"
+			};
+			ctx.write(filePath, updated);
+			return {
+				filePath,
+				action: "updated",
+				description: "Added ignorePatterns"
+			};
+		}
+		if (await ctx.confirmOverwrite(filePath) === "skip") return {
+			filePath,
+			action: "skipped",
+			description: "User chose to keep existing"
+		};
+	}
+	ctx.write(filePath, content);
+	return {
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated oxlint.config.ts"
+	};
+}
+//#endregion
+//#region src/generators/formatter.ts
+/** Ignore patterns that must always be present in .oxfmtrc.json. */
+const BASE_IGNORE_PATTERNS = [".claude"];
+/** Extra ignore patterns when a release strategy generates CHANGELOGs. */
+const RELEASE_IGNORE_PATTERNS = ["**/CHANGELOG.md"];
+function requiredIgnorePatterns(releaseStrategy) {
+	if (releaseStrategy === "none") return BASE_IGNORE_PATTERNS;
+	return [...BASE_IGNORE_PATTERNS, ...RELEASE_IGNORE_PATTERNS];
+}
+const PRETTIER_CONFIG = `{
+  "semi": true,
+  "singleQuote": false,
+  "trailingComma": "all",
+  "tabWidth": 2,
+  "printWidth": 120
+}
+`;
+async function generateFormatter(ctx) {
+	if (ctx.config.formatter === "oxfmt") return generateOxfmt(ctx);
+	return generatePrettier(ctx);
+}
+async function generateOxfmt(ctx) {
+	const filePath = ".oxfmtrc.json";
+	const required = requiredIgnorePatterns(ctx.config.releaseStrategy);
+	const existing = ctx.read(filePath);
+	if (!existing) {
+		const config = { ignorePatterns: required };
+		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
+		return {
+			filePath,
+			action: "created",
+			description: "Generated .oxfmtrc.json"
+		};
+	}
+	const OxfmtConfigSchema = z.record(z.string(), z.unknown());
+	let jsonValue;
+	try {
+		jsonValue = JSON.parse(existing);
+	} catch {
+		const config = { ignorePatterns: required };
+		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
+		return {
+			filePath,
+			action: "updated",
+			description: "Replaced malformed .oxfmtrc.json"
+		};
+	}
+	const parseResult = OxfmtConfigSchema.safeParse(jsonValue);
+	if (!parseResult.success) {
+		const config = { ignorePatterns: required };
+		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
+		return {
+			filePath,
+			action: "updated",
+			description: "Replaced malformed .oxfmtrc.json"
+		};
+	}
+	const parsed = parseResult.data;
+	const ignorePatterns = Array.isArray(parsed["ignorePatterns"]) ? parsed["ignorePatterns"] : [];
+	const existingSet = new Set(ignorePatterns.filter((p) => typeof p === "string"));
+	const missing = required.filter((p) => !existingSet.has(p));
+	if (missing.length === 0) return {
+		filePath,
+		action: "skipped",
+		description: "Existing oxfmt config already has required ignorePatterns"
+	};
+	parsed["ignorePatterns"] = [...ignorePatterns, ...missing];
+	ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
+	return {
+		filePath,
+		action: "updated",
+		description: `Added ignorePatterns: ${missing.join(", ")}`
+	};
+}
+async function generatePrettier(ctx) {
+	const filePath = ".prettierrc";
+	if (ctx.exists(filePath)) return {
+		filePath,
+		action: "skipped",
+		description: "Existing prettier config preserved"
+	};
+	ctx.write(filePath, PRETTIER_CONFIG);
+	return {
+		filePath,
+		action: "created",
+		description: "Generated .prettierrc"
+	};
+}
+//#endregion
+//#region src/generators/tsdown.ts
+const TSDOWN_CONFIG = `import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  entry: ["src/index.ts"],
+});
+`;
+async function generateTsdown(ctx) {
+	const filePath = "tsdown.config.ts";
 	if (ctx.config.structure === "monorepo") return {
 		filePath,
 		action: "skipped",
@@ -2952,1431 +3311,1105 @@ async function generateGitignore(ctx) {
 			action: "skipped",
 			description: "Already has all standard entries"
 		};
-		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
-		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
-		ctx.write(filePath, updated);
-		if (missingRequired.length === 0) return {
-			filePath,
-			action: "skipped",
-			description: "Only optional entries missing"
-		};
-		return {
-			filePath,
-			action: "updated",
-			description: `Appended ${String(missing.length)} missing entries`
-		};
-	}
-	ctx.write(filePath, allEntries.join("\n") + "\n");
-	return {
-		filePath,
-		action: "created",
-		description: "Generated .gitignore"
-	};
-}
-//#endregion
-//#region src/generators/release-ci.ts
-const DEFAULT_POST_RELEASE_COMMAND = ["pnpm exec bst webhook:send", " \"$POST_RELEASE_HOOK_URL\""].join("");
-/** Build env vars for hook secrets to inject into a workflow step. */
-function hookSecretEnv(secrets) {
-	const env = {
-		POST_RELEASE_HOOK_URL: actionsExpr("vars.POST_RELEASE_HOOK_URL || secrets.POST_RELEASE_HOOK_URL"),
-		WEBHOOK_SECRET: actionsExpr("secrets.POST_RELEASE_HOOK_SECRET")
-	};
-	for (const name of secrets ?? []) env[name] = actionsExpr(`secrets.${name}`);
-	return env;
-}
-/** Step that runs after release with post-release webhook env wired up. */
-function postReleaseHookStep(opts) {
-	const ifCondition = opts?.condition ?? (opts?.guardMain ? "github.ref == 'refs/heads/main'" : void 0);
-	return { step: {
-		name: "Post-release hook",
-		...ifCondition && { if: ifCondition },
-		env: hookSecretEnv(opts?.secrets),
-		run: opts?.command ?? DEFAULT_POST_RELEASE_COMMAND
-	} };
-}
-/** Common setup steps shared by release-it and simple strategies. */
-function commonSteps(nodeVersionYaml, publishesNpm) {
-	return [
-		{ step: {
-			uses: "actions/checkout@v6",
-			with: { "fetch-depth": 0 }
-		} },
-		{ step: { uses: "pnpm/action-setup@v5" } },
-		{ step: {
-			uses: "actions/setup-node@v6",
-			with: {
-				...nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" },
-				cache: "pnpm",
-				...publishesNpm && { "registry-url": actionsExpr("vars.NPM_REGISTRY_URL || 'https://registry.npmjs.org'") }
-			}
-		} },
-		{ step: { run: "pnpm install --frozen-lockfile" } }
-	];
-}
-function releaseItSteps(ci, nodeVersionYaml, publishesNpm) {
-	const tokenEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : { RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN") };
-	const npmEnv = publishesNpm ? { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") } : {};
-	return [...commonSteps(nodeVersionYaml, publishesNpm), { step: {
-		run: "pnpm release-it --ci",
-		env: {
-			...tokenEnv,
-			...npmEnv,
-			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-		}
-	} }];
-}
-/** Build the workflow_dispatch trigger with optional inputs for the simple strategy. */
-function simpleWorkflowDispatchTrigger() {
-	return { workflow_dispatch: { inputs: {
-		bump: {
-			description: "Version bump type (default: conventional-commits auto-detect)",
-			required: false,
-			type: "choice",
-			default: "auto",
-			options: [
-				"auto",
-				"major",
-				"minor",
-				"patch",
-				"first-release"
-			]
-		},
-		prerelease: {
-			description: "Create a prerelease with the given tag (e.g., beta, alpha)",
-			required: false,
-			type: "string"
-		}
-	} } };
-}
-/** Env vars that forward workflow dispatch inputs to the release:simple CLI. */
-function simpleReleaseEnv() {
-	return {
-		RELEASE_BUMP: actionsExpr("inputs.bump"),
-		RELEASE_PRERELEASE: actionsExpr("inputs.prerelease")
-	};
-}
-function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable) {
-	const releaseEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : {
-		FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
-		FORGEJO_REPOSITORY: actionsExpr("github.repository"),
-		RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN")
-	};
-	const pushedIf = "steps.release.outputs.pushed == 'true'";
-	const releaseStep = { step: {
-		id: "release",
-		name: "Release",
-		env: {
-			...releaseEnv,
-			...simpleReleaseEnv(),
-			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-		},
-		run: "pnpm exec bst release:simple"
-	} };
-	const assetsStep = { step: {
-		name: "Upload Release Assets",
-		if: pushedIf,
-		env: releaseEnv,
-		run: "pnpm exec bst release:assets"
-	} };
-	const dockerStep = { step: {
-		name: "Publish Docker images",
-		if: pushedIf,
-		env: dockerPublishEnv(registryDerivable),
-		run: "pnpm exec bst docker:publish"
-	} };
-	return [
-		...commonSteps(nodeVersionYaml, publishesNpm),
-		releaseStep,
-		...hasAssets ? [assetsStep] : [],
-		...hasDocker ? [dockerStep] : []
-	];
-}
-function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable) {
-	switch (strategy) {
-		case "release-it": return releaseItSteps(ci, nodeVersionYaml, publishesNpm);
-		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable);
-		default: return null;
-	}
-}
-async function generateReleaseCi(ctx) {
-	const filePath = "release-ci";
-	if (ctx.config.releaseStrategy === "none" || ctx.config.ci === "none") return {
-		filePath,
-		action: "skipped",
-		description: "Release CI workflow not applicable"
-	};
-	const publishesNpm = ctx.config.publishNpm === true;
-	if (ctx.config.releaseStrategy === "changesets") return {
-		filePath,
-		action: "skipped",
-		description: "Release step included in CI workflow"
-	};
-	const isGitHub = ctx.config.ci === "github";
-	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
-	const nodeVersionYaml = computeNodeVersionYaml(ctx);
-	const hasDocker = hasDockerPackages(ctx);
-	const hasAssets = hasReleaseAssets(ctx);
-	const registryDerivable = hasRepositoryUrl(ctx);
-	const hookSecrets = getPostReleaseHookSecrets(ctx);
-	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable);
-	if (!steps) return {
-		filePath,
-		action: "skipped",
-		description: "Release CI workflow not applicable"
-	};
-	if (ctx.config.releaseStrategy === "release-it") steps.push(postReleaseHookStep({
-		command: getPostReleaseHookCommand(ctx),
-		secrets: hookSecrets
-	}));
-	else if (ctx.config.releaseStrategy === "simple") steps.push(postReleaseHookStep({
-		command: getPostReleaseHookCommand(ctx),
-		secrets: hookSecrets,
-		condition: "steps.release.outputs.pushed == 'true'"
-	}));
-	const on = ctx.config.releaseStrategy === "simple" ? simpleWorkflowDispatchTrigger() : { workflow_dispatch: null };
-	const content = buildWorkflowYaml({
-		ci: ctx.config.ci,
-		name: "Release",
-		on,
-		...isGitHub && { permissions: { contents: "write" } },
-		jobName: "release",
-		steps
-	});
-	const alreadyExists = ctx.exists(workflowPath);
-	const existing = alreadyExists ? ctx.read(workflowPath) : void 0;
-	if (existing) {
-		if (isToolingIgnored(existing)) return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Release workflow has ignore comment"
-		};
-		if (normalizeWorkflow(existing) === normalizeWorkflow(content)) return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Release workflow already up to date"
-		};
-	}
-	const withPinnedActions = preservePinnedActions(preserveDevBinaryPath(content, existing), existing);
-	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
-	ctx.write(workflowPath, final);
-	return {
-		filePath: workflowPath,
-		action: alreadyExists ? "updated" : "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions release workflow`
-	};
-}
-//#endregion
-//#region src/generators/ci.ts
-/** Build the release step for the check job (changesets strategy). */
-function changesetsReleaseStep(ci, publishesNpm) {
-	if (ci === "github") return { step: {
-		id: "release",
-		uses: "changesets/action@v1",
-		if: "github.ref == 'refs/heads/main'",
-		with: {
-			publish: "pnpm changeset publish",
-			version: "pnpm changeset version"
-		},
-		env: {
-			GITHUB_TOKEN: actionsExpr("github.token"),
-			...publishesNpm && { NPM_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
-		}
-	} };
-	return { step: {
-		id: "release",
-		name: "Release",
-		env: {
-			FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
-			FORGEJO_REPOSITORY: actionsExpr("github.repository"),
-			RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
-			...publishesNpm && { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") },
-			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-		},
-		run: "pnpm exec bst release:changesets"
-	} };
-}
-const CI_CONCURRENCY = {
-	group: `ci-${actionsExpr("github.ref")}`,
-	"cancel-in-progress": actionsExpr("github.ref != 'refs/heads/main'")
-};
-function checkSteps(nodeVersionYaml, publishesNpm) {
-	return [
-		{ step: {
-			uses: "actions/checkout@v6",
-			with: { "fetch-depth": 0 }
-		} },
-		{ step: { uses: "pnpm/action-setup@v5" } },
-		{ step: {
-			uses: "actions/setup-node@v6",
-			with: {
-				...nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" },
-				cache: "pnpm",
-				...publishesNpm && { "registry-url": actionsExpr("vars.NPM_REGISTRY_URL || 'https://registry.npmjs.org'") }
-			}
-		} },
-		{ step: { run: "pnpm install --frozen-lockfile" } },
-		{ step: {
-			name: "Run all checks",
-			run: "pnpm ci:check"
-		} }
-	];
-}
-/** Resolve the CI workflow filename based on release strategy. */
-function ciWorkflowPath(ci, releaseStrategy) {
-	return `${ci === "github" ? ".github/workflows" : ".forgejo/workflows"}/${releaseStrategy === "changesets" ? "ci.yml" : "check.yml"}`;
-}
-async function generateCi(ctx) {
-	if (ctx.config.ci === "none") return {
-		filePath: "ci",
-		action: "skipped",
-		description: "CI workflow not requested"
-	};
-	const isGitHub = ctx.config.ci === "github";
-	const isForgejo = !isGitHub;
-	const isChangesets = ctx.config.releaseStrategy === "changesets";
-	const nodeVersionYaml = computeNodeVersionYaml(ctx);
-	const publishesNpm = ctx.config.publishNpm === true;
-	const hookCommand = getPostReleaseHookCommand(ctx);
-	const hookSecrets = getPostReleaseHookSecrets(ctx);
-	const hasDocker = isChangesets && hasDockerPackages(ctx);
-	const hasAssets = isChangesets && hasReleaseAssets(ctx);
-	const registryDerivable = hasDocker && hasRepositoryUrl(ctx);
-	const publishedIf = "steps.release.outputs.published == 'true'";
-	const releaseEnv = {};
-	if (isGitHub) releaseEnv["GITHUB_TOKEN"] = actionsExpr("github.token");
-	else {
-		releaseEnv["FORGEJO_SERVER_URL"] = actionsExpr("github.server_url");
-		releaseEnv["FORGEJO_REPOSITORY"] = actionsExpr("github.repository");
-		releaseEnv["RELEASE_TOKEN"] = actionsExpr("secrets.RELEASE_TOKEN");
-	}
-	const steps = [
-		...checkSteps(nodeVersionYaml, isChangesets && publishesNpm),
-		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm)] : [],
-		...hasAssets ? [{ step: {
-			name: "Upload Release Assets",
-			if: publishedIf,
-			env: releaseEnv,
-			run: "pnpm exec bst release:assets"
-		} }] : [],
-		...hasDocker ? [{ step: {
-			name: "Publish Docker images",
-			if: publishedIf,
-			env: dockerPublishEnv(registryDerivable),
-			run: "pnpm exec bst docker:publish"
-		} }] : [],
-		...isChangesets ? [postReleaseHookStep({
-			command: hookCommand,
-			secrets: hookSecrets,
-			condition: publishedIf
-		})] : []
-	];
-	const content = buildWorkflowYaml({
-		ci: ctx.config.ci,
-		name: "CI",
-		on: {
-			push: {
-				branches: ["main"],
-				"tags-ignore": ["**"]
-			},
-			pull_request: null
-		},
-		enableEmailNotifications: isForgejo,
-		...isChangesets && { concurrency: CI_CONCURRENCY },
-		jobName: "check",
-		steps
-	});
-	const filePath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
-	const alreadyExists = ctx.exists(filePath);
-	const existing = alreadyExists ? ctx.read(filePath) : void 0;
-	if (existing) {
-		if (isToolingIgnored(existing)) return {
-			filePath,
-			action: "skipped",
-			description: "CI workflow has ignore comment"
-		};
-		if (normalizeWorkflow(existing) === normalizeWorkflow(content)) return {
-			filePath,
-			action: "skipped",
-			description: "CI workflow already up to date"
-		};
-	}
-	const withPinnedActions = preservePinnedActions(preserveDevBinaryPath(content, existing), existing);
-	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
-	ctx.write(filePath, final);
-	return {
-		filePath,
-		action: alreadyExists ? "updated" : "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions CI workflow`
-	};
-}
-//#endregion
-//#region src/generators/knip.ts
-const KNIP_CONFIG_SINGLE = `import type { KnipConfig } from "knip";
-
-export default {
-  entry: ["src/index.ts"],
-  project: ["src/**/*.ts"],
-  ignore: ["dist/**", ".claude/hooks/**"],
-} satisfies KnipConfig;
-`;
-const KNIP_CONFIG_MONOREPO = `import type { KnipConfig } from "knip";
-
-export default {
-  ignore: [".claude/hooks/**"],
-  workspaces: {
-    ".": {
-      entry: [],
-      project: [],
-    },
-    "packages/*": {
-      entry: ["src/index.ts", "src/bin.ts"],
-      project: ["src/**/*.ts"],
-      ignore: ["dist/**"],
-    },
-  },
-} satisfies KnipConfig;
-`;
-const REQUIRED_IGNORE = ".claude/hooks/**";
-/** All known knip config file locations, in priority order. */
-const KNIP_CONFIG_PATHS = [
-	"knip.config.ts",
-	"knip.config.mts",
-	"knip.json",
-	"knip.jsonc",
-	"knip.ts",
-	"knip.mts"
-];
-const JSON_EXTENSIONS = new Set([".json", ".jsonc"]);
-function isJsonConfig(path) {
-	const dot = path.lastIndexOf(".");
-	return dot !== -1 && JSON_EXTENSIONS.has(path.slice(dot));
-}
-/**
-* Try to add the required ignore pattern to an existing knip config.
-* Returns the updated content, or undefined if no change was needed.
-*/
-function ensureIgnorePattern(content, path) {
-	if (content.includes(".claude/hooks")) return void 0;
-	if (isJsonConfig(path)) return ensureIgnoreInJson(content);
-	return ensureIgnoreInTs(content);
-}
-const KnipJsonSchema = z.object({ ignore: z.array(z.string()).optional() }).passthrough();
-function ensureIgnoreInJson(content) {
-	const result = KnipJsonSchema.safeParse(JSON.parse(content));
-	if (!result.success) return void 0;
-	const parsed = result.data;
-	const ignore = parsed.ignore ?? [];
-	ignore.push(REQUIRED_IGNORE);
-	parsed.ignore = ignore;
-	return JSON.stringify(parsed, null, 2) + "\n";
-}
-function ensureIgnoreInTs(content) {
-	const ignoreArrayPattern = /(ignore:\s*\[)/;
-	if (ignoreArrayPattern.exec(content)) return content.replace(ignoreArrayPattern, `$1"${REQUIRED_IGNORE}", `);
-	const exportPattern = /(export default\s*\{)\n/;
-	if (exportPattern.exec(content)) return content.replace(exportPattern, `$1\n  ignore: ["${REQUIRED_IGNORE}"],\n`);
-}
-async function generateKnip(ctx) {
-	const filePath = "knip.config.ts";
-	const isMonorepo = ctx.config.structure === "monorepo";
-	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
-	if (existingPath) {
-		const content = ctx.read(existingPath);
-		if (content) {
-			const updated = ensureIgnorePattern(content, existingPath);
-			if (updated) {
-				ctx.write(existingPath, updated);
-				return {
-					filePath: existingPath,
-					action: "updated",
-					description: "Added \".claude/hooks/**\" to ignore"
-				};
-			}
-		}
-		return {
-			filePath: existingPath,
-			action: "skipped",
-			description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
-		};
-	}
-	const config = isMonorepo ? KNIP_CONFIG_MONOREPO : KNIP_CONFIG_SINGLE;
-	ctx.write(filePath, config);
-	return {
-		filePath,
-		action: "created",
-		description: "Generated knip.config.ts for dead code analysis"
-	};
-}
-//#endregion
-//#region src/generators/renovate.ts
-const SHARED_PRESET = "local>bensandee/tooling";
-/** Deprecated npm-based preset to migrate away from. */
-const LEGACY_PRESET = "@bensandee/config";
-/** All known renovate config file locations, in priority order. */
-const RENOVATE_CONFIG_PATHS = [
-	"renovate.json",
-	"renovate.json5",
-	".renovaterc",
-	".renovaterc.json",
-	".github/renovate.json",
-	".github/renovate.json5"
-];
-async function generateRenovate(ctx) {
-	const defaultPath = "renovate.json";
-	if (!ctx.config.setupRenovate) return {
-		filePath: defaultPath,
-		action: "skipped",
-		description: "Renovate not requested"
-	};
-	const existingPath = RENOVATE_CONFIG_PATHS.find((p) => ctx.exists(p));
-	if (existingPath) {
-		const existing = ctx.read(existingPath);
-		if (existing) {
-			const parsed = parseRenovateJson(existing);
-			const existingExtends = parsed.extends ?? [];
-			const legacyIndex = existingExtends.indexOf(LEGACY_PRESET);
-			if (legacyIndex !== -1) {
-				existingExtends[legacyIndex] = SHARED_PRESET;
-				parsed.extends = existingExtends;
-				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
-				return {
-					filePath: existingPath,
-					action: "updated",
-					description: `Migrated extends: ${LEGACY_PRESET} → ${SHARED_PRESET}`
-				};
-			}
-			if (!existingExtends.includes(SHARED_PRESET)) {
-				existingExtends.unshift(SHARED_PRESET);
-				parsed.extends = existingExtends;
-				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
-				return {
-					filePath: existingPath,
-					action: "updated",
-					description: `Added extends: ${SHARED_PRESET}`
-				};
-			}
-			return {
-				filePath: existingPath,
-				action: "skipped",
-				description: "Already extends shared config"
-			};
-		}
+		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
+		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
+		ctx.write(filePath, updated);
+		if (missingRequired.length === 0) return {
+			filePath,
+			action: "skipped",
+			description: "Only optional entries missing"
+		};
+		return {
+			filePath,
+			action: "updated",
+			description: `Appended ${String(missing.length)} missing entries`
+		};
 	}
-	const config = {
-		$schema: "https://docs.renovatebot.com/renovate-schema.json",
-		extends: [SHARED_PRESET]
-	};
-	ctx.write(defaultPath, JSON.stringify(config, null, 2) + "\n");
+	ctx.write(filePath, allEntries.join("\n") + "\n");
 	return {
-		filePath: defaultPath,
+		filePath,
 		action: "created",
-		description: "Generated renovate.json extending shared config"
+		description: "Generated .gitignore"
 	};
 }
 //#endregion
-//#region src/generators/pnpm-workspace.ts
-const WORKSPACE_YAML = `packages:
-  - "packages/*"
-`;
-async function generatePnpmWorkspace(ctx) {
-	const filePath = "pnpm-workspace.yaml";
-	if (ctx.config.structure !== "monorepo") return {
-		filePath,
-		action: "skipped",
-		description: "Not a monorepo"
-	};
-	if (ctx.exists(filePath)) return {
-		filePath,
-		action: "skipped",
-		description: "pnpm-workspace.yaml already exists"
+//#region src/generators/release-ci.ts
+const DEFAULT_POST_RELEASE_COMMAND = ["pnpm exec bst webhook:send", " \"$POST_RELEASE_HOOK_URL\""].join("");
+/** Build env vars for hook secrets to inject into a workflow step. */
+function hookSecretEnv(secrets) {
+	const env = {
+		POST_RELEASE_HOOK_URL: actionsExpr("vars.POST_RELEASE_HOOK_URL || secrets.POST_RELEASE_HOOK_URL"),
+		WEBHOOK_SECRET: actionsExpr("secrets.POST_RELEASE_HOOK_SECRET")
 	};
-	ctx.write(filePath, WORKSPACE_YAML);
+	for (const name of secrets ?? []) env[name] = actionsExpr(`secrets.${name}`);
+	return env;
+}
+/** Step that runs after release with post-release webhook env wired up. */
+function postReleaseHookStep(opts) {
+	const ifCondition = opts?.condition ?? (opts?.guardMain ? "github.ref == 'refs/heads/main'" : void 0);
+	return { step: {
+		name: "Post-release hook",
+		...ifCondition && { if: ifCondition },
+		env: hookSecretEnv(opts?.secrets),
+		run: opts?.command ?? DEFAULT_POST_RELEASE_COMMAND
+	} };
+}
+/** Common setup steps shared by release-it and simple strategies. */
+function commonSteps(nodeVersionYaml, publishesNpm) {
+	return [
+		{ step: {
+			uses: "actions/checkout@v6",
+			with: { "fetch-depth": 0 }
+		} },
+		{ step: { uses: "pnpm/action-setup@v5" } },
+		{ step: {
+			uses: "actions/setup-node@v6",
+			with: {
+				...nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" },
+				cache: "pnpm",
+				...publishesNpm && { "registry-url": actionsExpr("vars.NPM_REGISTRY_URL || 'https://registry.npmjs.org'") }
+			}
+		} },
+		{ step: { run: "pnpm install --frozen-lockfile" } }
+	];
+}
+function releaseItSteps(ci, nodeVersionYaml, publishesNpm) {
+	const tokenEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : { RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN") };
+	const npmEnv = publishesNpm ? { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") } : {};
+	return [...commonSteps(nodeVersionYaml, publishesNpm), { step: {
+		run: "pnpm release-it --ci",
+		env: {
+			...tokenEnv,
+			...npmEnv,
+			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+		}
+	} }];
+}
+/** Build the workflow_dispatch trigger with optional inputs for the simple strategy. */
+function simpleWorkflowDispatchTrigger() {
+	return { workflow_dispatch: { inputs: {
+		bump: {
+			description: "Version bump type (default: conventional-commits auto-detect)",
+			required: false,
+			type: "choice",
+			default: "auto",
+			options: [
+				"auto",
+				"major",
+				"minor",
+				"patch",
+				"first-release"
+			]
+		},
+		prerelease: {
+			description: "Create a prerelease with the given tag (e.g., beta, alpha)",
+			required: false,
+			type: "string"
+		}
+	} } };
+}
+/** Env vars that forward workflow dispatch inputs to the release:simple CLI. */
+function simpleReleaseEnv() {
 	return {
-		filePath,
-		action: "created",
-		description: "Generated pnpm-workspace.yaml"
+		RELEASE_BUMP: actionsExpr("inputs.bump"),
+		RELEASE_PRERELEASE: actionsExpr("inputs.prerelease")
 	};
 }
-//#endregion
-//#region src/generators/claude-hooks.ts
-const HOOK_PATH = ".claude/hooks/bst-hook.mjs";
-const GUIDE_PATH = ".claude/hooks/bst-hook-guide.md";
-function writeIfChanged(ctx, filePath, content, label) {
-	const existing = ctx.read(filePath);
-	if (existing === content) return {
+function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable) {
+	const releaseEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : {
+		FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
+		FORGEJO_REPOSITORY: actionsExpr("github.repository"),
+		RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN")
+	};
+	const pushedIf = "steps.release.outputs.pushed == 'true'";
+	const releaseStep = { step: {
+		id: "release",
+		name: "Release",
+		env: {
+			...releaseEnv,
+			...simpleReleaseEnv(),
+			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+		},
+		run: "pnpm exec bst release:simple"
+	} };
+	const assetsStep = { step: {
+		name: "Upload Release Assets",
+		if: pushedIf,
+		env: releaseEnv,
+		run: "pnpm exec bst release:assets"
+	} };
+	const dockerStep = { step: {
+		name: "Publish Docker images",
+		if: pushedIf,
+		env: dockerPublishEnv(registryDerivable),
+		run: "pnpm exec bst docker:publish"
+	} };
+	return [
+		...commonSteps(nodeVersionYaml, publishesNpm),
+		releaseStep,
+		...hasAssets ? [assetsStep] : [],
+		...hasDocker ? [dockerStep] : []
+	];
+}
+function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable) {
+	switch (strategy) {
+		case "release-it": return releaseItSteps(ci, nodeVersionYaml, publishesNpm);
+		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable);
+		default: return null;
+	}
+}
+async function generateReleaseCi(ctx) {
+	const filePath = "release-ci";
+	if (ctx.config.releaseStrategy === "none" || ctx.config.ci === "none") return {
 		filePath,
 		action: "skipped",
-		description: `${label} is up to date`
+		description: "Release CI workflow not applicable"
 	};
-	ctx.write(filePath, content);
-	return {
+	const publishesNpm = ctx.config.publishNpm === true;
+	if (ctx.config.releaseStrategy === "changesets") return {
 		filePath,
-		action: existing ? "updated" : "created",
-		description: existing ? `Updated ${label}` : `Generated ${label}`
+		action: "skipped",
+		description: "Release step included in CI workflow"
 	};
-}
-async function generateClaudeHooks(ctx) {
-	return [writeIfChanged(ctx, HOOK_PATH, "/**\n * bst-hook — Claude Code PreToolUse hook\n * @bensandee/claude-hooks v0.7.2\n * https://github.com/bensandee/tooling\n *\n * Auto-generated by @bensandee/tooling repo:sync — do not edit manually.\n */\nimport * as fs from \"node:fs\";\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { execFileSync } from \"node:child_process\";\nimport * as os from \"node:os\";\n\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/core.js\n/** A special constant with type `never` */\nconst NEVER = Object.freeze({ status: \"aborted\" });\nfunction $constructor(name, initializer, params) {\n	function init(inst, def) {\n		if (!inst._zod) Object.defineProperty(inst, \"_zod\", {\n			value: {\n				def,\n				constr: _,\n				traits: /* @__PURE__ */ new Set()\n			},\n			enumerable: false\n		});\n		if (inst._zod.traits.has(name)) return;\n		inst._zod.traits.add(name);\n		initializer(inst, def);\n		const proto = _.prototype;\n		const keys = Object.keys(proto);\n		for (let i = 0; i < keys.length; i++) {\n			const k = keys[i];\n			if (!(k in inst)) inst[k] = proto[k].bind(inst);\n		}\n	}\n	const Parent = params?.Parent ?? Object;\n	class Definition extends Parent {}\n	Object.defineProperty(Definition, \"name\", { value: name });\n	function _(def) {\n		var _a;\n		const inst = params?.Parent ? new Definition() : this;\n		init(inst, def);\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		for (const fn of inst._zod.deferred) fn();\n		return inst;\n	}\n	Object.defineProperty(_, \"init\", { value: init });\n	Object.defineProperty(_, Symbol.hasInstance, { value: (inst) => {\n		if (params?.Parent && inst instanceof params.Parent) return true;\n		return inst?._zod?.traits?.has(name);\n	} });\n	Object.defineProperty(_, \"name\", { value: name });\n	return _;\n}\nvar $ZodAsyncError = class extends Error {\n	constructor() {\n		super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);\n	}\n};\nvar $ZodEncodeError = class extends Error {\n	constructor(name) {\n		super(`Encountered unidirectional transform during encode: ${name}`);\n		this.name = \"ZodEncodeError\";\n	}\n};\nconst globalConfig = {};\nfunction config(newConfig) {\n	if (newConfig) Object.assign(globalConfig, newConfig);\n	return globalConfig;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/util.js\nfunction getEnumValues(entries) {\n	const numericValues = Object.values(entries).filter((v) => typeof v === \"number\");\n	return Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);\n}\nfunction jsonStringifyReplacer(_, value) {\n	if (typeof value === \"bigint\") return value.toString();\n	return value;\n}\nfunction cached(getter) {\n	return { get value() {\n		{\n			const value = getter();\n			Object.defineProperty(this, \"value\", { value });\n			return value;\n		}\n		throw new Error(\"cached value already set\");\n	} };\n}\nfunction nullish(input) {\n	return input === null || input === void 0;\n}\nfunction cleanRegex(source) {\n	const start = source.startsWith(\"^\") ? 1 : 0;\n	const end = source.endsWith(\"$\") ? source.length - 1 : source.length;\n	return source.slice(start, end);\n}\nconst EVALUATING = Symbol(\"evaluating\");\nfunction defineLazy(object, key, getter) {\n	let value = void 0;\n	Object.defineProperty(object, key, {\n		get() {\n			if (value === EVALUATING) return;\n			if (value === void 0) {\n				value = EVALUATING;\n				value = getter();\n			}\n			return value;\n		},\n		set(v) {\n			Object.defineProperty(object, key, { value: v });\n		},\n		configurable: true\n	});\n}\nfunction assignProp(target, prop, value) {\n	Object.defineProperty(target, prop, {\n		value,\n		writable: true,\n		enumerable: true,\n		configurable: true\n	});\n}\nfunction mergeDefs(...defs) {\n	const mergedDescriptors = {};\n	for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));\n	return Object.defineProperties({}, mergedDescriptors);\n}\nfunction esc(str) {\n	return JSON.stringify(str);\n}\nfunction slugify(input) {\n	return input.toLowerCase().trim().replace(/[^\\w\\s-]/g, \"\").replace(/[\\s_-]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n}\nconst captureStackTrace = \"captureStackTrace\" in Error ? Error.captureStackTrace : (..._args) => {};\nfunction isObject(data) {\n	return typeof data === \"object\" && data !== null && !Array.isArray(data);\n}\nconst allowsEval = cached(() => {\n	if (typeof navigator !== \"undefined\" && navigator?.userAgent?.includes(\"Cloudflare\")) return false;\n	try {\n		new Function(\"\");\n		return true;\n	} catch (_) {\n		return false;\n	}\n});\nfunction isPlainObject(o) {\n	if (isObject(o) === false) return false;\n	const ctor = o.constructor;\n	if (ctor === void 0) return true;\n	if (typeof ctor !== \"function\") return true;\n	const prot = ctor.prototype;\n	if (isObject(prot) === false) return false;\n	if (Object.prototype.hasOwnProperty.call(prot, \"isPrototypeOf\") === false) return false;\n	return true;\n}\nfunction shallowClone(o) {\n	if (isPlainObject(o)) return { ...o };\n	if (Array.isArray(o)) return [...o];\n	return o;\n}\nconst propertyKeyTypes = new Set([\n	\"string\",\n	\"number\",\n	\"symbol\"\n]);\nfunction escapeRegex(str) {\n	return str.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\nfunction clone(inst, def, params) {\n	const cl = new inst._zod.constr(def ?? inst._zod.def);\n	if (!def || params?.parent) cl._zod.parent = inst;\n	return cl;\n}\nfunction normalizeParams(_params) {\n	const params = _params;\n	if (!params) return {};\n	if (typeof params === \"string\") return { error: () => params };\n	if (params?.message !== void 0) {\n		if (params?.error !== void 0) throw new Error(\"Cannot specify both `message` and `error` params\");\n		params.error = params.message;\n	}\n	delete params.message;\n	if (typeof params.error === \"string\") return {\n		...params,\n		error: () => params.error\n	};\n	return params;\n}\nfunction optionalKeys(shape) {\n	return Object.keys(shape).filter((k) => {\n		return shape[k]._zod.optin === \"optional\" && shape[k]._zod.optout === \"optional\";\n	});\n}\nconst NUMBER_FORMAT_RANGES = {\n	safeint: [Number.MIN_SAFE_INTEGER, Number.MAX_SAFE_INTEGER],\n	int32: [-2147483648, 2147483647],\n	uint32: [0, 4294967295],\n	float32: [-34028234663852886e22, 34028234663852886e22],\n	float64: [-Number.MAX_VALUE, Number.MAX_VALUE]\n};\nfunction pick(schema, mask) {\n	const currDef = schema._zod.def;\n	const checks = currDef.checks;\n	if (checks && checks.length > 0) throw new Error(\".pick() cannot be used on object schemas containing refinements\");\n	return clone(schema, mergeDefs(schema._zod.def, {\n		get shape() {\n			const newShape = {};\n			for (const key in mask) {\n				if (!(key in currDef.shape)) throw new Error(`Unrecognized key: \"${key}\"`);\n				if (!mask[key]) continue;\n				newShape[key] = currDef.shape[key];\n			}\n			assignProp(this, \"shape\", newShape);\n			return newShape;\n		},\n		checks: []\n	}));\n}\nfunction omit(schema, mask) {\n	const currDef = schema._zod.def;\n	const checks = currDef.checks;\n	if (checks && checks.length > 0) throw new Error(\".omit() cannot be used on object schemas containing refinements\");\n	return clone(schema, mergeDefs(schema._zod.def, {\n		get shape() {\n			const newShape = { ...schema._zod.def.shape };\n			for (const key in mask) {\n				if (!(key in currDef.shape)) throw new Error(`Unrecognized key: \"${key}\"`);\n				if (!mask[key]) continue;\n				delete newShape[key];\n			}\n			assignProp(this, \"shape\", newShape);\n			return newShape;\n		},\n		checks: []\n	}));\n}\nfunction extend(schema, shape) {\n	if (!isPlainObject(shape)) throw new Error(\"Invalid input to extend: expected a plain object\");\n	const checks = schema._zod.def.checks;\n	if (checks && checks.length > 0) {\n		const existingShape = schema._zod.def.shape;\n		for (const key in shape) if (Object.getOwnPropertyDescriptor(existingShape, key) !== void 0) throw new Error(\"Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.\");\n	}\n	return clone(schema, mergeDefs(schema._zod.def, { get shape() {\n		const _shape = {\n			...schema._zod.def.shape,\n			...shape\n		};\n		assignProp(this, \"shape\", _shape);\n		return _shape;\n	} }));\n}\nfunction safeExtend(schema, shape) {\n	if (!isPlainObject(shape)) throw new Error(\"Invalid input to safeExtend: expected a plain object\");\n	return clone(schema, mergeDefs(schema._zod.def, { get shape() {\n		const _shape = {\n			...schema._zod.def.shape,\n			...shape\n		};\n		assignProp(this, \"shape\", _shape);\n		return _shape;\n	} }));\n}\nfunction merge(a, b) {\n	return clone(a, mergeDefs(a._zod.def, {\n		get shape() {\n			const _shape = {\n				...a._zod.def.shape,\n				...b._zod.def.shape\n			};\n			assignProp(this, \"shape\", _shape);\n			return _shape;\n		},\n		get catchall() {\n			return b._zod.def.catchall;\n		},\n		checks: []\n	}));\n}\nfunction partial(Class, schema, mask) {\n	const checks = schema._zod.def.checks;\n	if (checks && checks.length > 0) throw new Error(\".partial() cannot be used on object schemas containing refinements\");\n	return clone(schema, mergeDefs(schema._zod.def, {\n		get shape() {\n			const oldShape = schema._zod.def.shape;\n			const shape = { ...oldShape };\n			if (mask) for (const key in mask) {\n				if (!(key in oldShape)) throw new Error(`Unrecognized key: \"${key}\"`);\n				if (!mask[key]) continue;\n				shape[key] = Class ? new Class({\n					type: \"optional\",\n					innerType: oldShape[key]\n				}) : oldShape[key];\n			}\n			else for (const key in oldShape) shape[key] = Class ? new Class({\n				type: \"optional\",\n				innerType: oldShape[key]\n			}) : oldShape[key];\n			assignProp(this, \"shape\", shape);\n			return shape;\n		},\n		checks: []\n	}));\n}\nfunction required(Class, schema, mask) {\n	return clone(schema, mergeDefs(schema._zod.def, { get shape() {\n		const oldShape = schema._zod.def.shape;\n		const shape = { ...oldShape };\n		if (mask) for (const key in mask) {\n			if (!(key in shape)) throw new Error(`Unrecognized key: \"${key}\"`);\n			if (!mask[key]) continue;\n			shape[key] = new Class({\n				type: \"nonoptional\",\n				innerType: oldShape[key]\n			});\n		}\n		else for (const key in oldShape) shape[key] = new Class({\n			type: \"nonoptional\",\n			innerType: oldShape[key]\n		});\n		assignProp(this, \"shape\", shape);\n		return shape;\n	} }));\n}\nfunction aborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue !== true) return true;\n	return false;\n}\nfunction prefixIssues(path, issues) {\n	return issues.map((iss) => {\n		var _a;\n		(_a = iss).path ?? (_a.path = []);\n		iss.path.unshift(path);\n		return iss;\n	});\n}\nfunction unwrapMessage(message) {\n	return typeof message === \"string\" ? message : message?.message;\n}\nfunction finalizeIssue(iss, ctx, config) {\n	const full = {\n		...iss,\n		path: iss.path ?? []\n	};\n	if (!iss.message) full.message = unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? \"Invalid input\";\n	delete full.inst;\n	delete full.continue;\n	if (!ctx?.reportInput) delete full.input;\n	return full;\n}\nfunction getLengthableOrigin(input) {\n	if (Array.isArray(input)) return \"array\";\n	if (typeof input === \"string\") return \"string\";\n	return \"unknown\";\n}\nfunction issue(...args) {\n	const [iss, input, inst] = args;\n	if (typeof iss === \"string\") return {\n		message: iss,\n		code: \"custom\",\n		input,\n		inst\n	};\n	return { ...iss };\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/errors.js\nconst initializer$1 = (inst, def) => {\n	inst.name = \"$ZodError\";\n	Object.defineProperty(inst, \"_zod\", {\n		value: inst._zod,\n		enumerable: false\n	});\n	Object.defineProperty(inst, \"issues\", {\n		value: def,\n		enumerable: false\n	});\n	inst.message = JSON.stringify(def, jsonStringifyReplacer, 2);\n	Object.defineProperty(inst, \"toString\", {\n		value: () => inst.message,\n		enumerable: false\n	});\n};\nconst $ZodError = $constructor(\"$ZodError\", initializer$1);\nconst $ZodRealError = $constructor(\"$ZodError\", initializer$1, { Parent: Error });\nfunction flattenError(error, mapper = (issue) => issue.message) {\n	const fieldErrors = {};\n	const formErrors = [];\n	for (const sub of error.issues) if (sub.path.length > 0) {\n		fieldErrors[sub.path[0]] = fieldErrors[sub.path[0]] || [];\n		fieldErrors[sub.path[0]].push(mapper(sub));\n	} else formErrors.push(mapper(sub));\n	return {\n		formErrors,\n		fieldErrors\n	};\n}\nfunction formatError(error, mapper = (issue) => issue.message) {\n	const fieldErrors = { _errors: [] };\n	const processError = (error) => {\n		for (const issue of error.issues) if (issue.code === \"invalid_union\" && issue.errors.length) issue.errors.map((issues) => processError({ issues }));\n		else if (issue.code === \"invalid_key\") processError({ issues: issue.issues });\n		else if (issue.code === \"invalid_element\") processError({ issues: issue.issues });\n		else if (issue.path.length === 0) fieldErrors._errors.push(mapper(issue));\n		else {\n			let curr = fieldErrors;\n			let i = 0;\n			while (i < issue.path.length) {\n				const el = issue.path[i];\n				if (!(i === issue.path.length - 1)) curr[el] = curr[el] || { _errors: [] };\n				else {\n					curr[el] = curr[el] || { _errors: [] };\n					curr[el]._errors.push(mapper(issue));\n				}\n				curr = curr[el];\n				i++;\n			}\n		}\n	};\n	processError(error);\n	return fieldErrors;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/parse.js\nconst _parse = (_Err) => (schema, value, _ctx, _params) => {\n	const ctx = _ctx ? Object.assign(_ctx, { async: false }) : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	if (result.issues.length) {\n		const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n		captureStackTrace(e, _params?.callee);\n		throw e;\n	}\n	return result.value;\n};\nconst _parseAsync = (_Err) => async (schema, value, _ctx, params) => {\n	const ctx = _ctx ? Object.assign(_ctx, { async: true }) : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	if (result.issues.length) {\n		const e = new (params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n		captureStackTrace(e, params?.callee);\n		throw e;\n	}\n	return result.value;\n};\nconst _safeParse = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: false\n	} : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	return result.issues.length ? {\n		success: false,\n		error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))\n	} : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParse$1 = /* @__PURE__ */ _safeParse($ZodRealError);\nconst _safeParseAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? Object.assign(_ctx, { async: true }) : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	return result.issues.length ? {\n		success: false,\n		error: new _Err(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))\n	} : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParseAsync$1 = /* @__PURE__ */ _safeParseAsync($ZodRealError);\nconst _encode = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? Object.assign(_ctx, { direction: \"backward\" }) : { direction: \"backward\" };\n	return _parse(_Err)(schema, value, ctx);\n};\nconst _decode = (_Err) => (schema, value, _ctx) => {\n	return _parse(_Err)(schema, value, _ctx);\n};\nconst _encodeAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? Object.assign(_ctx, { direction: \"backward\" }) : { direction: \"backward\" };\n	return _parseAsync(_Err)(schema, value, ctx);\n};\nconst _decodeAsync = (_Err) => async (schema, value, _ctx) => {\n	return _parseAsync(_Err)(schema, value, _ctx);\n};\nconst _safeEncode = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? Object.assign(_ctx, { direction: \"backward\" }) : { direction: \"backward\" };\n	return _safeParse(_Err)(schema, value, ctx);\n};\nconst _safeDecode = (_Err) => (schema, value, _ctx) => {\n	return _safeParse(_Err)(schema, value, _ctx);\n};\nconst _safeEncodeAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? Object.assign(_ctx, { direction: \"backward\" }) : { direction: \"backward\" };\n	return _safeParseAsync(_Err)(schema, value, ctx);\n};\nconst _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {\n	return _safeParseAsync(_Err)(schema, value, _ctx);\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/regexes.js\nconst cuid = /^[cC][^\\s-]{8,}$/;\nconst cuid2 = /^[0-9a-z]+$/;\nconst ulid = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;\nconst xid = /^[0-9a-vA-V]{20}$/;\nconst ksuid = /^[A-Za-z0-9]{27}$/;\nconst nanoid = /^[a-zA-Z0-9_-]{21}$/;\n/** ISO 8601-1 duration regex. Does not support the 8601-2 extensions like negative durations or fractional/negative components. */\nconst duration$1 = /^P(?:(\\d+W)|(?!.*W)(?=\\d|T\\d)(\\d+Y)?(\\d+M)?(\\d+D)?(T(?=\\d)(\\d+H)?(\\d+M)?(\\d+([.,]\\d+)?S)?)?)$/;\n/** A regex for any UUID-like identifier: 8-4-4-4-12 hex pattern */\nconst guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;\n/** Returns a regex for validating an RFC 9562/4122 UUID.\n*\n* @param version Optionally specify a version 1-8. If no version is specified, all versions are supported. */\nconst uuid = (version) => {\n	if (!version) return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;\n	return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);\n};\n/** Practical email validation */\nconst email = /^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/;\nconst _emoji$1 = `^(\\\\p{Extended_Pictographic}|\\\\p{Emoji_Component})+$`;\nfunction emoji() {\n	return new RegExp(_emoji$1, \"u\");\n}\nconst ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;\nconst ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;\nconst cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\/([0-9]|[1-2][0-9]|3[0-2])$/;\nconst cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;\nconst base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;\nconst base64url = /^[A-Za-z0-9_-]*$/;\nconst e164 = /^\\+[1-9]\\d{6,14}$/;\nconst dateSource = `(?:(?:\\\\d\\\\d[2468][048]|\\\\d\\\\d[13579][26]|\\\\d\\\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\\\d|30)|(?:02)-(?:0[1-9]|1\\\\d|2[0-8])))`;\nconst date$1 = /* @__PURE__ */ new RegExp(`^${dateSource}$`);\nfunction timeSource(args) {\n	const hhmm = `(?:[01]\\\\d|2[0-3]):[0-5]\\\\d`;\n	return typeof args.precision === \"number\" ? args.precision === -1 ? `${hhmm}` : args.precision === 0 ? `${hhmm}:[0-5]\\\\d` : `${hhmm}:[0-5]\\\\d\\\\.\\\\d{${args.precision}}` : `${hhmm}(?::[0-5]\\\\d(?:\\\\.\\\\d+)?)?`;\n}\nfunction time$1(args) {\n	return new RegExp(`^${timeSource(args)}$`);\n}\nfunction datetime$1(args) {\n	const time = timeSource({ precision: args.precision });\n	const opts = [\"Z\"];\n	if (args.local) opts.push(\"\");\n	if (args.offset) opts.push(`([+-](?:[01]\\\\d|2[0-3]):[0-5]\\\\d)`);\n	const timeRegex = `${time}(?:${opts.join(\"|\")})`;\n	return new RegExp(`^${dateSource}T(?:${timeRegex})$`);\n}\nconst string$1 = (params) => {\n	const regex = params ? `[\\\\s\\\\S]{${params?.minimum ?? 0},${params?.maximum ?? \"\"}}` : `[\\\\s\\\\S]*`;\n	return new RegExp(`^${regex}$`);\n};\nconst number = /^-?\\d+(?:\\.\\d+)?$/;\nconst lowercase = /^[^A-Z]*$/;\nconst uppercase = /^[^a-z]*$/;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/checks.js\nconst $ZodCheck = /* @__PURE__ */ $constructor(\"$ZodCheck\", (inst, def) => {\n	var _a;\n	inst._zod ?? (inst._zod = {});\n	inst._zod.def = def;\n	(_a = inst._zod).onattach ?? (_a.onattach = []);\n});\nconst $ZodCheckMaxLength = /* @__PURE__ */ $constructor(\"$ZodCheckMaxLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = (payload) => {\n		const val = payload.value;\n		return !nullish(val) && val.length !== void 0;\n	});\n	inst._zod.onattach.push((inst) => {\n		const curr = inst._zod.bag.maximum ?? Number.POSITIVE_INFINITY;\n		if (def.maximum < curr) inst._zod.bag.maximum = def.maximum;\n	});\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		if (input.length <= def.maximum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_big\",\n			maximum: def.maximum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckMinLength = /* @__PURE__ */ $constructor(\"$ZodCheckMinLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = (payload) => {\n		const val = payload.value;\n		return !nullish(val) && val.length !== void 0;\n	});\n	inst._zod.onattach.push((inst) => {\n		const curr = inst._zod.bag.minimum ?? Number.NEGATIVE_INFINITY;\n		if (def.minimum > curr) inst._zod.bag.minimum = def.minimum;\n	});\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		if (input.length >= def.minimum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_small\",\n			minimum: def.minimum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckLengthEquals = /* @__PURE__ */ $constructor(\"$ZodCheckLengthEquals\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = (payload) => {\n		const val = payload.value;\n		return !nullish(val) && val.length !== void 0;\n	});\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.minimum = def.length;\n		bag.maximum = def.length;\n		bag.length = def.length;\n	});\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const length = input.length;\n		if (length === def.length) return;\n		const origin = getLengthableOrigin(input);\n		const tooBig = length > def.length;\n		payload.issues.push({\n			origin,\n			...tooBig ? {\n				code: \"too_big\",\n				maximum: def.length\n			} : {\n				code: \"too_small\",\n				minimum: def.length\n			},\n			inclusive: true,\n			exact: true,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckStringFormat = /* @__PURE__ */ $constructor(\"$ZodCheckStringFormat\", (inst, def) => {\n	var _a, _b;\n	$ZodCheck.init(inst, def);\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.format = def.format;\n		if (def.pattern) {\n			bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n			bag.patterns.add(def.pattern);\n		}\n	});\n	if (def.pattern) (_a = inst._zod).check ?? (_a.check = (payload) => {\n		def.pattern.lastIndex = 0;\n		if (def.pattern.test(payload.value)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: def.format,\n			input: payload.value,\n			...def.pattern ? { pattern: def.pattern.toString() } : {},\n			inst,\n			continue: !def.abort\n		});\n	});\n	else (_b = inst._zod).check ?? (_b.check = () => {});\n});\nconst $ZodCheckRegex = /* @__PURE__ */ $constructor(\"$ZodCheckRegex\", (inst, def) => {\n	$ZodCheckStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		def.pattern.lastIndex = 0;\n		if (def.pattern.test(payload.value)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"regex\",\n			input: payload.value,\n			pattern: def.pattern.toString(),\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckLowerCase = /* @__PURE__ */ $constructor(\"$ZodCheckLowerCase\", (inst, def) => {\n	def.pattern ?? (def.pattern = lowercase);\n	$ZodCheckStringFormat.init(inst, def);\n});\nconst $ZodCheckUpperCase = /* @__PURE__ */ $constructor(\"$ZodCheckUpperCase\", (inst, def) => {\n	def.pattern ?? (def.pattern = uppercase);\n	$ZodCheckStringFormat.init(inst, def);\n});\nconst $ZodCheckIncludes = /* @__PURE__ */ $constructor(\"$ZodCheckIncludes\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	const escapedRegex = escapeRegex(def.includes);\n	const pattern = new RegExp(typeof def.position === \"number\" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);\n	def.pattern = pattern;\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n		bag.patterns.add(pattern);\n	});\n	inst._zod.check = (payload) => {\n		if (payload.value.includes(def.includes, def.position)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"includes\",\n			includes: def.includes,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckStartsWith = /* @__PURE__ */ $constructor(\"$ZodCheckStartsWith\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);\n	def.pattern ?? (def.pattern = pattern);\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n		bag.patterns.add(pattern);\n	});\n	inst._zod.check = (payload) => {\n		if (payload.value.startsWith(def.prefix)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"starts_with\",\n			prefix: def.prefix,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckEndsWith = /* @__PURE__ */ $constructor(\"$ZodCheckEndsWith\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);\n	def.pattern ?? (def.pattern = pattern);\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n		bag.patterns.add(pattern);\n	});\n	inst._zod.check = (payload) => {\n		if (payload.value.endsWith(def.suffix)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"ends_with\",\n			suffix: def.suffix,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckOverwrite = /* @__PURE__ */ $constructor(\"$ZodCheckOverwrite\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	inst._zod.check = (payload) => {\n		payload.value = def.tx(payload.value);\n	};\n});\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/doc.js\nvar Doc = class {\n	constructor(args = []) {\n		this.content = [];\n		this.indent = 0;\n		if (this) this.args = args;\n	}\n	indented(fn) {\n		this.indent += 1;\n		fn(this);\n		this.indent -= 1;\n	}\n	write(arg) {\n		if (typeof arg === \"function\") {\n			arg(this, { execution: \"sync\" });\n			arg(this, { execution: \"async\" });\n			return;\n		}\n		const lines = arg.split(\"\\n\").filter((x) => x);\n		const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));\n		const dedented = lines.map((x) => x.slice(minIndent)).map((x) => \" \".repeat(this.indent * 2) + x);\n		for (const line of dedented) this.content.push(line);\n	}\n	compile() {\n		const F = Function;\n		const args = this?.args;\n		const lines = [...(this?.content ?? [``]).map((x) => `  ${x}`)];\n		return new F(...args, lines.join(\"\\n\"));\n	}\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/versions.js\nconst version = {\n	major: 4,\n	minor: 3,\n	patch: 6\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/schemas.js\nconst $ZodType = /* @__PURE__ */ $constructor(\"$ZodType\", (inst, def) => {\n	var _a;\n	inst ?? (inst = {});\n	inst._zod.def = def;\n	inst._zod.bag = inst._zod.bag || {};\n	inst._zod.version = version;\n	const checks = [...inst._zod.def.checks ?? []];\n	if (inst._zod.traits.has(\"$ZodCheck\")) checks.unshift(inst);\n	for (const ch of checks) for (const fn of ch._zod.onattach) fn(inst);\n	if (checks.length === 0) {\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		inst._zod.deferred?.push(() => {\n			inst._zod.run = inst._zod.parse;\n		});\n	} else {\n		const runChecks = (payload, checks, ctx) => {\n			let isAborted = aborted(payload);\n			let asyncResult;\n			for (const ch of checks) {\n				if (ch._zod.def.when) {\n					if (!ch._zod.def.when(payload)) continue;\n				} else if (isAborted) continue;\n				const currLen = payload.issues.length;\n				const _ = ch._zod.check(payload);\n				if (_ instanceof Promise && ctx?.async === false) throw new $ZodAsyncError();\n				if (asyncResult || _ instanceof Promise) asyncResult = (asyncResult ?? Promise.resolve()).then(async () => {\n					await _;\n					if (payload.issues.length === currLen) return;\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				});\n				else {\n					if (payload.issues.length === currLen) continue;\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				}\n			}\n			if (asyncResult) return asyncResult.then(() => {\n				return payload;\n			});\n			return payload;\n		};\n		const handleCanaryResult = (canary, payload, ctx) => {\n			if (aborted(canary)) {\n				canary.aborted = true;\n				return canary;\n			}\n			const checkResult = runChecks(payload, checks, ctx);\n			if (checkResult instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return checkResult.then((checkResult) => inst._zod.parse(checkResult, ctx));\n			}\n			return inst._zod.parse(checkResult, ctx);\n		};\n		inst._zod.run = (payload, ctx) => {\n			if (ctx.skipChecks) return inst._zod.parse(payload, ctx);\n			if (ctx.direction === \"backward\") {\n				const canary = inst._zod.parse({\n					value: payload.value,\n					issues: []\n				}, {\n					...ctx,\n					skipChecks: true\n				});\n				if (canary instanceof Promise) return canary.then((canary) => {\n					return handleCanaryResult(canary, payload, ctx);\n				});\n				return handleCanaryResult(canary, payload, ctx);\n			}\n			const result = inst._zod.parse(payload, ctx);\n			if (result instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return result.then((result) => runChecks(result, checks, ctx));\n			}\n			return runChecks(result, checks, ctx);\n		};\n	}\n	defineLazy(inst, \"~standard\", () => ({\n		validate: (value) => {\n			try {\n				const r = safeParse$1(inst, value);\n				return r.success ? { value: r.data } : { issues: r.error?.issues };\n			} catch (_) {\n				return safeParseAsync$1(inst, value).then((r) => r.success ? { value: r.data } : { issues: r.error?.issues });\n			}\n		},\n		vendor: \"zod\",\n		version: 1\n	}));\n});\nconst $ZodString = /* @__PURE__ */ $constructor(\"$ZodString\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.pattern = [...inst?._zod.bag?.patterns ?? []].pop() ?? string$1(inst._zod.bag);\n	inst._zod.parse = (payload, _) => {\n		if (def.coerce) try {\n			payload.value = String(payload.value);\n		} catch (_) {}\n		if (typeof payload.value === \"string\") return payload;\n		payload.issues.push({\n			expected: \"string\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodStringFormat = /* @__PURE__ */ $constructor(\"$ZodStringFormat\", (inst, def) => {\n	$ZodCheckStringFormat.init(inst, def);\n	$ZodString.init(inst, def);\n});\nconst $ZodGUID = /* @__PURE__ */ $constructor(\"$ZodGUID\", (inst, def) => {\n	def.pattern ?? (def.pattern = guid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodUUID = /* @__PURE__ */ $constructor(\"$ZodUUID\", (inst, def) => {\n	if (def.version) {\n		const v = {\n			v1: 1,\n			v2: 2,\n			v3: 3,\n			v4: 4,\n			v5: 5,\n			v6: 6,\n			v7: 7,\n			v8: 8\n		}[def.version];\n		if (v === void 0) throw new Error(`Invalid UUID version: \"${def.version}\"`);\n		def.pattern ?? (def.pattern = uuid(v));\n	} else def.pattern ?? (def.pattern = uuid());\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodEmail = /* @__PURE__ */ $constructor(\"$ZodEmail\", (inst, def) => {\n	def.pattern ?? (def.pattern = email);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodURL = /* @__PURE__ */ $constructor(\"$ZodURL\", (inst, def) => {\n	$ZodStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		try {\n			const trimmed = payload.value.trim();\n			const url = new URL(trimmed);\n			if (def.hostname) {\n				def.hostname.lastIndex = 0;\n				if (!def.hostname.test(url.hostname)) payload.issues.push({\n					code: \"invalid_format\",\n					format: \"url\",\n					note: \"Invalid hostname\",\n					pattern: def.hostname.source,\n					input: payload.value,\n					inst,\n					continue: !def.abort\n				});\n			}\n			if (def.protocol) {\n				def.protocol.lastIndex = 0;\n				if (!def.protocol.test(url.protocol.endsWith(\":\") ? url.protocol.slice(0, -1) : url.protocol)) payload.issues.push({\n					code: \"invalid_format\",\n					format: \"url\",\n					note: \"Invalid protocol\",\n					pattern: def.protocol.source,\n					input: payload.value,\n					inst,\n					continue: !def.abort\n				});\n			}\n			if (def.normalize) payload.value = url.href;\n			else payload.value = trimmed;\n			return;\n		} catch (_) {\n			payload.issues.push({\n				code: \"invalid_format\",\n				format: \"url\",\n				input: payload.value,\n				inst,\n				continue: !def.abort\n			});\n		}\n	};\n});\nconst $ZodEmoji = /* @__PURE__ */ $constructor(\"$ZodEmoji\", (inst, def) => {\n	def.pattern ?? (def.pattern = emoji());\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodNanoID = /* @__PURE__ */ $constructor(\"$ZodNanoID\", (inst, def) => {\n	def.pattern ?? (def.pattern = nanoid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodCUID = /* @__PURE__ */ $constructor(\"$ZodCUID\", (inst, def) => {\n	def.pattern ?? (def.pattern = cuid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodCUID2 = /* @__PURE__ */ $constructor(\"$ZodCUID2\", (inst, def) => {\n	def.pattern ?? (def.pattern = cuid2);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodULID = /* @__PURE__ */ $constructor(\"$ZodULID\", (inst, def) => {\n	def.pattern ?? (def.pattern = ulid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodXID = /* @__PURE__ */ $constructor(\"$ZodXID\", (inst, def) => {\n	def.pattern ?? (def.pattern = xid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodKSUID = /* @__PURE__ */ $constructor(\"$ZodKSUID\", (inst, def) => {\n	def.pattern ?? (def.pattern = ksuid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISODateTime = /* @__PURE__ */ $constructor(\"$ZodISODateTime\", (inst, def) => {\n	def.pattern ?? (def.pattern = datetime$1(def));\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISODate = /* @__PURE__ */ $constructor(\"$ZodISODate\", (inst, def) => {\n	def.pattern ?? (def.pattern = date$1);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISOTime = /* @__PURE__ */ $constructor(\"$ZodISOTime\", (inst, def) => {\n	def.pattern ?? (def.pattern = time$1(def));\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISODuration = /* @__PURE__ */ $constructor(\"$ZodISODuration\", (inst, def) => {\n	def.pattern ?? (def.pattern = duration$1);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodIPv4 = /* @__PURE__ */ $constructor(\"$ZodIPv4\", (inst, def) => {\n	def.pattern ?? (def.pattern = ipv4);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.format = `ipv4`;\n});\nconst $ZodIPv6 = /* @__PURE__ */ $constructor(\"$ZodIPv6\", (inst, def) => {\n	def.pattern ?? (def.pattern = ipv6);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.format = `ipv6`;\n	inst._zod.check = (payload) => {\n		try {\n			new URL(`http://[${payload.value}]`);\n		} catch {\n			payload.issues.push({\n				code: \"invalid_format\",\n				format: \"ipv6\",\n				input: payload.value,\n				inst,\n				continue: !def.abort\n			});\n		}\n	};\n});\nconst $ZodCIDRv4 = /* @__PURE__ */ $constructor(\"$ZodCIDRv4\", (inst, def) => {\n	def.pattern ?? (def.pattern = cidrv4);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodCIDRv6 = /* @__PURE__ */ $constructor(\"$ZodCIDRv6\", (inst, def) => {\n	def.pattern ?? (def.pattern = cidrv6);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		const parts = payload.value.split(\"/\");\n		try {\n			if (parts.length !== 2) throw new Error();\n			const [address, prefix] = parts;\n			if (!prefix) throw new Error();\n			const prefixNum = Number(prefix);\n			if (`${prefixNum}` !== prefix) throw new Error();\n			if (prefixNum < 0 || prefixNum > 128) throw new Error();\n			new URL(`http://[${address}]`);\n		} catch {\n			payload.issues.push({\n				code: \"invalid_format\",\n				format: \"cidrv6\",\n				input: payload.value,\n				inst,\n				continue: !def.abort\n			});\n		}\n	};\n});\nfunction isValidBase64(data) {\n	if (data === \"\") return true;\n	if (data.length % 4 !== 0) return false;\n	try {\n		atob(data);\n		return true;\n	} catch {\n		return false;\n	}\n}\nconst $ZodBase64 = /* @__PURE__ */ $constructor(\"$ZodBase64\", (inst, def) => {\n	def.pattern ?? (def.pattern = base64);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.contentEncoding = \"base64\";\n	inst._zod.check = (payload) => {\n		if (isValidBase64(payload.value)) return;\n		payload.issues.push({\n			code: \"invalid_format\",\n			format: \"base64\",\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nfunction isValidBase64URL(data) {\n	if (!base64url.test(data)) return false;\n	const base64 = data.replace(/[-_]/g, (c) => c === \"-\" ? \"+\" : \"/\");\n	return isValidBase64(base64.padEnd(Math.ceil(base64.length / 4) * 4, \"=\"));\n}\nconst $ZodBase64URL = /* @__PURE__ */ $constructor(\"$ZodBase64URL\", (inst, def) => {\n	def.pattern ?? (def.pattern = base64url);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.contentEncoding = \"base64url\";\n	inst._zod.check = (payload) => {\n		if (isValidBase64URL(payload.value)) return;\n		payload.issues.push({\n			code: \"invalid_format\",\n			format: \"base64url\",\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodE164 = /* @__PURE__ */ $constructor(\"$ZodE164\", (inst, def) => {\n	def.pattern ?? (def.pattern = e164);\n	$ZodStringFormat.init(inst, def);\n});\nfunction isValidJWT(token, algorithm = null) {\n	try {\n		const tokensParts = token.split(\".\");\n		if (tokensParts.length !== 3) return false;\n		const [header] = tokensParts;\n		if (!header) return false;\n		const parsedHeader = JSON.parse(atob(header));\n		if (\"typ\" in parsedHeader && parsedHeader?.typ !== \"JWT\") return false;\n		if (!parsedHeader.alg) return false;\n		if (algorithm && (!(\"alg\" in parsedHeader) || parsedHeader.alg !== algorithm)) return false;\n		return true;\n	} catch {\n		return false;\n	}\n}\nconst $ZodJWT = /* @__PURE__ */ $constructor(\"$ZodJWT\", (inst, def) => {\n	$ZodStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		if (isValidJWT(payload.value, def.alg)) return;\n		payload.issues.push({\n			code: \"invalid_format\",\n			format: \"jwt\",\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodUnknown = /* @__PURE__ */ $constructor(\"$ZodUnknown\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload) => payload;\n});\nconst $ZodNever = /* @__PURE__ */ $constructor(\"$ZodNever\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, _ctx) => {\n		payload.issues.push({\n			expected: \"never\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nfunction handleArrayResult(result, final, index) {\n	if (result.issues.length) final.issues.push(...prefixIssues(index, result.issues));\n	final.value[index] = result.value;\n}\nconst $ZodArray = /* @__PURE__ */ $constructor(\"$ZodArray\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!Array.isArray(input)) {\n			payload.issues.push({\n				expected: \"array\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = Array(input.length);\n		const proms = [];\n		for (let i = 0; i < input.length; i++) {\n			const item = input[i];\n			const result = def.element._zod.run({\n				value: item,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) proms.push(result.then((result) => handleArrayResult(result, payload, i)));\n			else handleArrayResult(result, payload, i);\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nfunction handlePropertyResult(result, final, key, input, isOptionalOut) {\n	if (result.issues.length) {\n		if (isOptionalOut && !(key in input)) return;\n		final.issues.push(...prefixIssues(key, result.issues));\n	}\n	if (result.value === void 0) {\n		if (key in input) final.value[key] = void 0;\n	} else final.value[key] = result.value;\n}\nfunction normalizeDef(def) {\n	const keys = Object.keys(def.shape);\n	for (const k of keys) if (!def.shape?.[k]?._zod?.traits?.has(\"$ZodType\")) throw new Error(`Invalid element at key \"${k}\": expected a Zod schema`);\n	const okeys = optionalKeys(def.shape);\n	return {\n		...def,\n		keys,\n		keySet: new Set(keys),\n		numKeys: keys.length,\n		optionalKeys: new Set(okeys)\n	};\n}\nfunction handleCatchall(proms, input, payload, ctx, def, inst) {\n	const unrecognized = [];\n	const keySet = def.keySet;\n	const _catchall = def.catchall._zod;\n	const t = _catchall.def.type;\n	const isOptionalOut = _catchall.optout === \"optional\";\n	for (const key in input) {\n		if (keySet.has(key)) continue;\n		if (t === \"never\") {\n			unrecognized.push(key);\n			continue;\n		}\n		const r = _catchall.run({\n			value: input[key],\n			issues: []\n		}, ctx);\n		if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, isOptionalOut)));\n		else handlePropertyResult(r, payload, key, input, isOptionalOut);\n	}\n	if (unrecognized.length) payload.issues.push({\n		code: \"unrecognized_keys\",\n		keys: unrecognized,\n		input,\n		inst\n	});\n	if (!proms.length) return payload;\n	return Promise.all(proms).then(() => {\n		return payload;\n	});\n}\nconst $ZodObject = /* @__PURE__ */ $constructor(\"$ZodObject\", (inst, def) => {\n	$ZodType.init(inst, def);\n	if (!Object.getOwnPropertyDescriptor(def, \"shape\")?.get) {\n		const sh = def.shape;\n		Object.defineProperty(def, \"shape\", { get: () => {\n			const newSh = { ...sh };\n			Object.defineProperty(def, \"shape\", { value: newSh });\n			return newSh;\n		} });\n	}\n	const _normalized = cached(() => normalizeDef(def));\n	defineLazy(inst._zod, \"propValues\", () => {\n		const shape = def.shape;\n		const propValues = {};\n		for (const key in shape) {\n			const field = shape[key]._zod;\n			if (field.values) {\n				propValues[key] ?? (propValues[key] = /* @__PURE__ */ new Set());\n				for (const v of field.values) propValues[key].add(v);\n			}\n		}\n		return propValues;\n	});\n	const isObject$2 = isObject;\n	const catchall = def.catchall;\n	let value;\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$2(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = {};\n		const proms = [];\n		const shape = value.shape;\n		for (const key of value.keys) {\n			const el = shape[key];\n			const isOptionalOut = el._zod.optout === \"optional\";\n			const r = el._zod.run({\n				value: input[key],\n				issues: []\n			}, ctx);\n			if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, isOptionalOut)));\n			else handlePropertyResult(r, payload, key, input, isOptionalOut);\n		}\n		if (!catchall) return proms.length ? Promise.all(proms).then(() => payload) : payload;\n		return handleCatchall(proms, input, payload, ctx, _normalized.value, inst);\n	};\n});\nconst $ZodObjectJIT = /* @__PURE__ */ $constructor(\"$ZodObjectJIT\", (inst, def) => {\n	$ZodObject.init(inst, def);\n	const superParse = inst._zod.parse;\n	const _normalized = cached(() => normalizeDef(def));\n	const generateFastpass = (shape) => {\n		const doc = new Doc([\n			\"shape\",\n			\"payload\",\n			\"ctx\"\n		]);\n		const normalized = _normalized.value;\n		const parseStr = (key) => {\n			const k = esc(key);\n			return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;\n		};\n		doc.write(`const input = payload.value;`);\n		const ids = Object.create(null);\n		let counter = 0;\n		for (const key of normalized.keys) ids[key] = `key_${counter++}`;\n		doc.write(`const newResult = {};`);\n		for (const key of normalized.keys) {\n			const id = ids[key];\n			const k = esc(key);\n			const isOptionalOut = shape[key]?._zod?.optout === \"optional\";\n			doc.write(`const ${id} = ${parseStr(key)};`);\n			if (isOptionalOut) doc.write(`\n        if (${id}.issues.length) {\n          if (${k} in input) {\n            payload.issues = payload.issues.concat(${id}.issues.map(iss => ({\n              ...iss,\n              path: iss.path ? [${k}, ...iss.path] : [${k}]\n            })));\n          }\n        }\n        \n        if (${id}.value === undefined) {\n          if (${k} in input) {\n            newResult[${k}] = undefined;\n          }\n        } else {\n          newResult[${k}] = ${id}.value;\n        }\n        \n      `);\n			else doc.write(`\n        if (${id}.issues.length) {\n          payload.issues = payload.issues.concat(${id}.issues.map(iss => ({\n            ...iss,\n            path: iss.path ? [${k}, ...iss.path] : [${k}]\n          })));\n        }\n        \n        if (${id}.value === undefined) {\n          if (${k} in input) {\n            newResult[${k}] = undefined;\n          }\n        } else {\n          newResult[${k}] = ${id}.value;\n        }\n        \n      `);\n		}\n		doc.write(`payload.value = newResult;`);\n		doc.write(`return payload;`);\n		const fn = doc.compile();\n		return (payload, ctx) => fn(shape, payload, ctx);\n	};\n	let fastpass;\n	const isObject$1 = isObject;\n	const jit = !globalConfig.jitless;\n	const allowsEval$1 = allowsEval;\n	const fastEnabled = jit && allowsEval$1.value;\n	const catchall = def.catchall;\n	let value;\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$1(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		if (jit && fastEnabled && ctx?.async === false && ctx.jitless !== true) {\n			if (!fastpass) fastpass = generateFastpass(def.shape);\n			payload = fastpass(payload, ctx);\n			if (!catchall) return payload;\n			return handleCatchall([], input, payload, ctx, value, inst);\n		}\n		return superParse(payload, ctx);\n	};\n});\nfunction handleUnionResults(results, final, inst, ctx) {\n	for (const result of results) if (result.issues.length === 0) {\n		final.value = result.value;\n		return final;\n	}\n	const nonaborted = results.filter((r) => !aborted(r));\n	if (nonaborted.length === 1) {\n		final.value = nonaborted[0].value;\n		return nonaborted[0];\n	}\n	final.issues.push({\n		code: \"invalid_union\",\n		input: final.value,\n		inst,\n		errors: results.map((result) => result.issues.map((iss) => finalizeIssue(iss, ctx, config())))\n	});\n	return final;\n}\nconst $ZodUnion = /* @__PURE__ */ $constructor(\"$ZodUnion\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"optin\", () => def.options.some((o) => o._zod.optin === \"optional\") ? \"optional\" : void 0);\n	defineLazy(inst._zod, \"optout\", () => def.options.some((o) => o._zod.optout === \"optional\") ? \"optional\" : void 0);\n	defineLazy(inst._zod, \"values\", () => {\n		if (def.options.every((o) => o._zod.values)) return new Set(def.options.flatMap((option) => Array.from(option._zod.values)));\n	});\n	defineLazy(inst._zod, \"pattern\", () => {\n		if (def.options.every((o) => o._zod.pattern)) {\n			const patterns = def.options.map((o) => o._zod.pattern);\n			return new RegExp(`^(${patterns.map((p) => cleanRegex(p.source)).join(\"|\")})$`);\n		}\n	});\n	const single = def.options.length === 1;\n	const first = def.options[0]._zod.run;\n	inst._zod.parse = (payload, ctx) => {\n		if (single) return first(payload, ctx);\n		let async = false;\n		const results = [];\n		for (const option of def.options) {\n			const result = option._zod.run({\n				value: payload.value,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) {\n				results.push(result);\n				async = true;\n			} else {\n				if (result.issues.length === 0) return result;\n				results.push(result);\n			}\n		}\n		if (!async) return handleUnionResults(results, payload, inst, ctx);\n		return Promise.all(results).then((results) => {\n			return handleUnionResults(results, payload, inst, ctx);\n		});\n	};\n});\nconst $ZodIntersection = /* @__PURE__ */ $constructor(\"$ZodIntersection\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		const left = def.left._zod.run({\n			value: input,\n			issues: []\n		}, ctx);\n		const right = def.right._zod.run({\n			value: input,\n			issues: []\n		}, ctx);\n		if (left instanceof Promise || right instanceof Promise) return Promise.all([left, right]).then(([left, right]) => {\n			return handleIntersectionResults(payload, left, right);\n		});\n		return handleIntersectionResults(payload, left, right);\n	};\n});\nfunction mergeValues(a, b) {\n	if (a === b) return {\n		valid: true,\n		data: a\n	};\n	if (a instanceof Date && b instanceof Date && +a === +b) return {\n		valid: true,\n		data: a\n	};\n	if (isPlainObject(a) && isPlainObject(b)) {\n		const bKeys = Object.keys(b);\n		const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);\n		const newObj = {\n			...a,\n			...b\n		};\n		for (const key of sharedKeys) {\n			const sharedValue = mergeValues(a[key], b[key]);\n			if (!sharedValue.valid) return {\n				valid: false,\n				mergeErrorPath: [key, ...sharedValue.mergeErrorPath]\n			};\n			newObj[key] = sharedValue.data;\n		}\n		return {\n			valid: true,\n			data: newObj\n		};\n	}\n	if (Array.isArray(a) && Array.isArray(b)) {\n		if (a.length !== b.length) return {\n			valid: false,\n			mergeErrorPath: []\n		};\n		const newArray = [];\n		for (let index = 0; index < a.length; index++) {\n			const itemA = a[index];\n			const itemB = b[index];\n			const sharedValue = mergeValues(itemA, itemB);\n			if (!sharedValue.valid) return {\n				valid: false,\n				mergeErrorPath: [index, ...sharedValue.mergeErrorPath]\n			};\n			newArray.push(sharedValue.data);\n		}\n		return {\n			valid: true,\n			data: newArray\n		};\n	}\n	return {\n		valid: false,\n		mergeErrorPath: []\n	};\n}\nfunction handleIntersectionResults(result, left, right) {\n	const unrecKeys = /* @__PURE__ */ new Map();\n	let unrecIssue;\n	for (const iss of left.issues) if (iss.code === \"unrecognized_keys\") {\n		unrecIssue ?? (unrecIssue = iss);\n		for (const k of iss.keys) {\n			if (!unrecKeys.has(k)) unrecKeys.set(k, {});\n			unrecKeys.get(k).l = true;\n		}\n	} else result.issues.push(iss);\n	for (const iss of right.issues) if (iss.code === \"unrecognized_keys\") for (const k of iss.keys) {\n		if (!unrecKeys.has(k)) unrecKeys.set(k, {});\n		unrecKeys.get(k).r = true;\n	}\n	else result.issues.push(iss);\n	const bothKeys = [...unrecKeys].filter(([, f]) => f.l && f.r).map(([k]) => k);\n	if (bothKeys.length && unrecIssue) result.issues.push({\n		...unrecIssue,\n		keys: bothKeys\n	});\n	if (aborted(result)) return result;\n	const merged = mergeValues(left.value, right.value);\n	if (!merged.valid) throw new Error(`Unmergable intersection. Error path: ${JSON.stringify(merged.mergeErrorPath)}`);\n	result.value = merged.data;\n	return result;\n}\nconst $ZodRecord = /* @__PURE__ */ $constructor(\"$ZodRecord\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!isPlainObject(input)) {\n			payload.issues.push({\n				expected: \"record\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		const proms = [];\n		const values = def.keyType._zod.values;\n		if (values) {\n			payload.value = {};\n			const recordKeys = /* @__PURE__ */ new Set();\n			for (const key of values) if (typeof key === \"string\" || typeof key === \"number\" || typeof key === \"symbol\") {\n				recordKeys.add(typeof key === \"number\" ? key.toString() : key);\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[key] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[key] = result.value;\n				}\n			}\n			let unrecognized;\n			for (const key in input) if (!recordKeys.has(key)) {\n				unrecognized = unrecognized ?? [];\n				unrecognized.push(key);\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized\n			});\n		} else {\n			payload.value = {};\n			for (const key of Reflect.ownKeys(input)) {\n				if (key === \"__proto__\") continue;\n				let keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (typeof key === \"string\" && number.test(key) && keyResult.issues.length) {\n					const retryResult = def.keyType._zod.run({\n						value: Number(key),\n						issues: []\n					}, ctx);\n					if (retryResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n					if (retryResult.issues.length === 0) keyResult = retryResult;\n				}\n				if (keyResult.issues.length) {\n					if (def.mode === \"loose\") payload.value[key] = input[key];\n					else payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[keyResult.value] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[keyResult.value] = result.value;\n				}\n			}\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nconst $ZodEnum = /* @__PURE__ */ $constructor(\"$ZodEnum\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const values = getEnumValues(def.entries);\n	const valuesSet = new Set(values);\n	inst._zod.values = valuesSet;\n	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === \"string\" ? escapeRegex(o) : o.toString()).join(\"|\")})$`);\n	inst._zod.parse = (payload, _ctx) => {\n		const input = payload.value;\n		if (valuesSet.has(input)) return payload;\n		payload.issues.push({\n			code: \"invalid_value\",\n			values,\n			input,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodTransform = /* @__PURE__ */ $constructor(\"$ZodTransform\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") throw new $ZodEncodeError(inst.constructor.name);\n		const _out = def.transform(payload.value, payload);\n		if (ctx.async) return (_out instanceof Promise ? _out : Promise.resolve(_out)).then((output) => {\n			payload.value = output;\n			return payload;\n		});\n		if (_out instanceof Promise) throw new $ZodAsyncError();\n		payload.value = _out;\n		return payload;\n	};\n});\nfunction handleOptionalResult(result, input) {\n	if (result.issues.length && input === void 0) return {\n		issues: [],\n		value: void 0\n	};\n	return result;\n}\nconst $ZodOptional = /* @__PURE__ */ $constructor(\"$ZodOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"optional\";\n	inst._zod.optout = \"optional\";\n	defineLazy(inst._zod, \"values\", () => {\n		return def.innerType._zod.values ? new Set([...def.innerType._zod.values, void 0]) : void 0;\n	});\n	defineLazy(inst._zod, \"pattern\", () => {\n		const pattern = def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (def.innerType._zod.optin === \"optional\") {\n			const result = def.innerType._zod.run(payload, ctx);\n			if (result instanceof Promise) return result.then((r) => handleOptionalResult(r, payload.value));\n			return handleOptionalResult(result, payload.value);\n		}\n		if (payload.value === void 0) return payload;\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodExactOptional = /* @__PURE__ */ $constructor(\"$ZodExactOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	defineLazy(inst._zod, \"pattern\", () => def.innerType._zod.pattern);\n	inst._zod.parse = (payload, ctx) => {\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodNullable = /* @__PURE__ */ $constructor(\"$ZodNullable\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"optin\", () => def.innerType._zod.optin);\n	defineLazy(inst._zod, \"optout\", () => def.innerType._zod.optout);\n	defineLazy(inst._zod, \"pattern\", () => {\n		const pattern = def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)}|null)$`) : void 0;\n	});\n	defineLazy(inst._zod, \"values\", () => {\n		return def.innerType._zod.values ? new Set([...def.innerType._zod.values, null]) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (payload.value === null) return payload;\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodDefault = /* @__PURE__ */ $constructor(\"$ZodDefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"optional\";\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) {\n			payload.value = def.defaultValue;\n			/**\n			* $ZodDefault returns the default value immediately in forward direction.\n			* It doesn't pass the default value into the validator (\"prefault\"). There's no reason to pass the default value through validation. The validity of the default is enforced by TypeScript statically. Otherwise, it's the responsibility of the user to ensure the default is valid. In the case of pipes with divergent in/out types, you can specify the default on the `in` schema of your ZodPipe to set a \"prefault\" for the pipe.   */\n			return payload;\n		}\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleDefaultResult(result, def));\n		return handleDefaultResult(result, def);\n	};\n});\nfunction handleDefaultResult(payload, def) {\n	if (payload.value === void 0) payload.value = def.defaultValue;\n	return payload;\n}\nconst $ZodPrefault = /* @__PURE__ */ $constructor(\"$ZodPrefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"optional\";\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) payload.value = def.defaultValue;\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodNonOptional = /* @__PURE__ */ $constructor(\"$ZodNonOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"values\", () => {\n		const v = def.innerType._zod.values;\n		return v ? new Set([...v].filter((x) => x !== void 0)) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleNonOptionalResult(result, inst));\n		return handleNonOptionalResult(result, inst);\n	};\n});\nfunction handleNonOptionalResult(payload, inst) {\n	if (!payload.issues.length && payload.value === void 0) payload.issues.push({\n		code: \"invalid_type\",\n		expected: \"nonoptional\",\n		input: payload.value,\n		inst\n	});\n	return payload;\n}\nconst $ZodCatch = /* @__PURE__ */ $constructor(\"$ZodCatch\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"optin\", () => def.innerType._zod.optin);\n	defineLazy(inst._zod, \"optout\", () => def.innerType._zod.optout);\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => {\n			payload.value = result.value;\n			if (result.issues.length) {\n				payload.value = def.catchValue({\n					...payload,\n					error: { issues: result.issues.map((iss) => finalizeIssue(iss, ctx, config())) },\n					input: payload.value\n				});\n				payload.issues = [];\n			}\n			return payload;\n		});\n		payload.value = result.value;\n		if (result.issues.length) {\n			payload.value = def.catchValue({\n				...payload,\n				error: { issues: result.issues.map((iss) => finalizeIssue(iss, ctx, config())) },\n				input: payload.value\n			});\n			payload.issues = [];\n		}\n		return payload;\n	};\n});\nconst $ZodPipe = /* @__PURE__ */ $constructor(\"$ZodPipe\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"values\", () => def.in._zod.values);\n	defineLazy(inst._zod, \"optin\", () => def.in._zod.optin);\n	defineLazy(inst._zod, \"optout\", () => def.out._zod.optout);\n	defineLazy(inst._zod, \"propValues\", () => def.in._zod.propValues);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") {\n			const right = def.out._zod.run(payload, ctx);\n			if (right instanceof Promise) return right.then((right) => handlePipeResult(right, def.in, ctx));\n			return handlePipeResult(right, def.in, ctx);\n		}\n		const left = def.in._zod.run(payload, ctx);\n		if (left instanceof Promise) return left.then((left) => handlePipeResult(left, def.out, ctx));\n		return handlePipeResult(left, def.out, ctx);\n	};\n});\nfunction handlePipeResult(left, next, ctx) {\n	if (left.issues.length) {\n		left.aborted = true;\n		return left;\n	}\n	return next._zod.run({\n		value: left.value,\n		issues: left.issues\n	}, ctx);\n}\nconst $ZodReadonly = /* @__PURE__ */ $constructor(\"$ZodReadonly\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"propValues\", () => def.innerType._zod.propValues);\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	defineLazy(inst._zod, \"optin\", () => def.innerType?._zod?.optin);\n	defineLazy(inst._zod, \"optout\", () => def.innerType?._zod?.optout);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then(handleReadonlyResult);\n		return handleReadonlyResult(result);\n	};\n});\nfunction handleReadonlyResult(payload) {\n	payload.value = Object.freeze(payload.value);\n	return payload;\n}\nconst $ZodCustom = /* @__PURE__ */ $constructor(\"$ZodCustom\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, _) => {\n		return payload;\n	};\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const r = def.fn(input);\n		if (r instanceof Promise) return r.then((r) => handleRefineResult(r, payload, input, inst));\n		handleRefineResult(r, payload, input, inst);\n	};\n});\nfunction handleRefineResult(result, payload, input, inst) {\n	if (!result) {\n		const _iss = {\n			code: \"custom\",\n			input,\n			inst,\n			path: [...inst._zod.def.path ?? []],\n			continue: !inst._zod.def.abort\n		};\n		if (inst._zod.def.params) _iss.params = inst._zod.def.params;\n		payload.issues.push(issue(_iss));\n	}\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/registries.js\nvar _a;\nvar $ZodRegistry = class {\n	constructor() {\n		this._map = /* @__PURE__ */ new WeakMap();\n		this._idmap = /* @__PURE__ */ new Map();\n	}\n	add(schema, ..._meta) {\n		const meta = _meta[0];\n		this._map.set(schema, meta);\n		if (meta && typeof meta === \"object\" && \"id\" in meta) this._idmap.set(meta.id, schema);\n		return this;\n	}\n	clear() {\n		this._map = /* @__PURE__ */ new WeakMap();\n		this._idmap = /* @__PURE__ */ new Map();\n		return this;\n	}\n	remove(schema) {\n		const meta = this._map.get(schema);\n		if (meta && typeof meta === \"object\" && \"id\" in meta) this._idmap.delete(meta.id);\n		this._map.delete(schema);\n		return this;\n	}\n	get(schema) {\n		const p = schema._zod.parent;\n		if (p) {\n			const pm = { ...this.get(p) ?? {} };\n			delete pm.id;\n			const f = {\n				...pm,\n				...this._map.get(schema)\n			};\n			return Object.keys(f).length ? f : void 0;\n		}\n		return this._map.get(schema);\n	}\n	has(schema) {\n		return this._map.has(schema);\n	}\n};\nfunction registry() {\n	return new $ZodRegistry();\n}\n(_a = globalThis).__zod_globalRegistry ?? (_a.__zod_globalRegistry = registry());\nconst globalRegistry = globalThis.__zod_globalRegistry;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/api.js\n/* @__NO_SIDE_EFFECTS__ */\nfunction _string(Class, params) {\n	return new Class({\n		type: \"string\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _email(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"email\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _guid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"guid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuidv4(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		version: \"v4\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuidv6(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		version: \"v6\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuidv7(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		version: \"v7\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _url(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"url\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _emoji(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"emoji\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _nanoid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"nanoid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cuid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cuid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cuid2(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cuid2\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ulid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ulid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _xid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"xid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ksuid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ksuid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ipv4(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ipv4\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ipv6(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ipv6\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cidrv4(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cidrv4\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cidrv6(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cidrv6\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _base64(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"base64\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _base64url(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"base64url\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _e164(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"e164\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _jwt(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"jwt\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoDateTime(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"datetime\",\n		check: \"string_format\",\n		offset: false,\n		local: false,\n		precision: null,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoDate(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"date\",\n		check: \"string_format\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoTime(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"time\",\n		check: \"string_format\",\n		precision: null,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoDuration(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"duration\",\n		check: \"string_format\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _unknown(Class) {\n	return new Class({ type: \"unknown\" });\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _never(Class, params) {\n	return new Class({\n		type: \"never\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _maxLength(maximum, params) {\n	return new $ZodCheckMaxLength({\n		check: \"max_length\",\n		...normalizeParams(params),\n		maximum\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _minLength(minimum, params) {\n	return new $ZodCheckMinLength({\n		check: \"min_length\",\n		...normalizeParams(params),\n		minimum\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _length(length, params) {\n	return new $ZodCheckLengthEquals({\n		check: \"length_equals\",\n		...normalizeParams(params),\n		length\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _regex(pattern, params) {\n	return new $ZodCheckRegex({\n		check: \"string_format\",\n		format: \"regex\",\n		...normalizeParams(params),\n		pattern\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _lowercase(params) {\n	return new $ZodCheckLowerCase({\n		check: \"string_format\",\n		format: \"lowercase\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uppercase(params) {\n	return new $ZodCheckUpperCase({\n		check: \"string_format\",\n		format: \"uppercase\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _includes(includes, params) {\n	return new $ZodCheckIncludes({\n		check: \"string_format\",\n		format: \"includes\",\n		...normalizeParams(params),\n		includes\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _startsWith(prefix, params) {\n	return new $ZodCheckStartsWith({\n		check: \"string_format\",\n		format: \"starts_with\",\n		...normalizeParams(params),\n		prefix\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _endsWith(suffix, params) {\n	return new $ZodCheckEndsWith({\n		check: \"string_format\",\n		format: \"ends_with\",\n		...normalizeParams(params),\n		suffix\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _overwrite(tx) {\n	return new $ZodCheckOverwrite({\n		check: \"overwrite\",\n		tx\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _normalize(form) {\n	return /* @__PURE__ */ _overwrite((input) => input.normalize(form));\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _trim() {\n	return /* @__PURE__ */ _overwrite((input) => input.trim());\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _toLowerCase() {\n	return /* @__PURE__ */ _overwrite((input) => input.toLowerCase());\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _toUpperCase() {\n	return /* @__PURE__ */ _overwrite((input) => input.toUpperCase());\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _slugify() {\n	return /* @__PURE__ */ _overwrite((input) => slugify(input));\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _array(Class, element, params) {\n	return new Class({\n		type: \"array\",\n		element,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _refine(Class, fn, _params) {\n	return new Class({\n		type: \"custom\",\n		check: \"custom\",\n		fn,\n		...normalizeParams(_params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _superRefine(fn) {\n	const ch = /* @__PURE__ */ _check((payload) => {\n		payload.addIssue = (issue$2) => {\n			if (typeof issue$2 === \"string\") payload.issues.push(issue(issue$2, payload.value, ch._zod.def));\n			else {\n				const _issue = issue$2;\n				if (_issue.fatal) _issue.continue = false;\n				_issue.code ?? (_issue.code = \"custom\");\n				_issue.input ?? (_issue.input = payload.value);\n				_issue.inst ?? (_issue.inst = ch);\n				_issue.continue ?? (_issue.continue = !ch._zod.def.abort);\n				payload.issues.push(issue(_issue));\n			}\n		};\n		return fn(payload.value, payload);\n	});\n	return ch;\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _check(fn, params) {\n	const ch = new $ZodCheck({\n		check: \"custom\",\n		...normalizeParams(params)\n	});\n	ch._zod.check = fn;\n	return ch;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/to-json-schema.js\nfunction initializeContext(params) {\n	let target = params?.target ?? \"draft-2020-12\";\n	if (target === \"draft-4\") target = \"draft-04\";\n	if (target === \"draft-7\") target = \"draft-07\";\n	return {\n		processors: params.processors ?? {},\n		metadataRegistry: params?.metadata ?? globalRegistry,\n		target,\n		unrepresentable: params?.unrepresentable ?? \"throw\",\n		override: params?.override ?? (() => {}),\n		io: params?.io ?? \"output\",\n		counter: 0,\n		seen: /* @__PURE__ */ new Map(),\n		cycles: params?.cycles ?? \"ref\",\n		reused: params?.reused ?? \"inline\",\n		external: params?.external ?? void 0\n	};\n}\nfunction process$1(schema, ctx, _params = {\n	path: [],\n	schemaPath: []\n}) {\n	var _a;\n	const def = schema._zod.def;\n	const seen = ctx.seen.get(schema);\n	if (seen) {\n		seen.count++;\n		if (_params.schemaPath.includes(schema)) seen.cycle = _params.path;\n		return seen.schema;\n	}\n	const result = {\n		schema: {},\n		count: 1,\n		cycle: void 0,\n		path: _params.path\n	};\n	ctx.seen.set(schema, result);\n	const overrideSchema = schema._zod.toJSONSchema?.();\n	if (overrideSchema) result.schema = overrideSchema;\n	else {\n		const params = {\n			..._params,\n			schemaPath: [..._params.schemaPath, schema],\n			path: _params.path\n		};\n		if (schema._zod.processJSONSchema) schema._zod.processJSONSchema(ctx, result.schema, params);\n		else {\n			const _json = result.schema;\n			const processor = ctx.processors[def.type];\n			if (!processor) throw new Error(`[toJSONSchema]: Non-representable type encountered: ${def.type}`);\n			processor(schema, ctx, _json, params);\n		}\n		const parent = schema._zod.parent;\n		if (parent) {\n			if (!result.ref) result.ref = parent;\n			process$1(parent, ctx, params);\n			ctx.seen.get(parent).isParent = true;\n		}\n	}\n	const meta = ctx.metadataRegistry.get(schema);\n	if (meta) Object.assign(result.schema, meta);\n	if (ctx.io === \"input\" && isTransforming(schema)) {\n		delete result.schema.examples;\n		delete result.schema.default;\n	}\n	if (ctx.io === \"input\" && result.schema._prefault) (_a = result.schema).default ?? (_a.default = result.schema._prefault);\n	delete result.schema._prefault;\n	return ctx.seen.get(schema).schema;\n}\nfunction extractDefs(ctx, schema) {\n	const root = ctx.seen.get(schema);\n	if (!root) throw new Error(\"Unprocessed schema. This is a bug in Zod.\");\n	const idToSchema = /* @__PURE__ */ new Map();\n	for (const entry of ctx.seen.entries()) {\n		const id = ctx.metadataRegistry.get(entry[0])?.id;\n		if (id) {\n			const existing = idToSchema.get(id);\n			if (existing && existing !== entry[0]) throw new Error(`Duplicate schema id \"${id}\" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);\n			idToSchema.set(id, entry[0]);\n		}\n	}\n	const makeURI = (entry) => {\n		const defsSegment = ctx.target === \"draft-2020-12\" ? \"$defs\" : \"definitions\";\n		if (ctx.external) {\n			const externalId = ctx.external.registry.get(entry[0])?.id;\n			const uriGenerator = ctx.external.uri ?? ((id) => id);\n			if (externalId) return { ref: uriGenerator(externalId) };\n			const id = entry[1].defId ?? entry[1].schema.id ?? `schema${ctx.counter++}`;\n			entry[1].defId = id;\n			return {\n				defId: id,\n				ref: `${uriGenerator(\"__shared\")}#/${defsSegment}/${id}`\n			};\n		}\n		if (entry[1] === root) return { ref: \"#\" };\n		const defUriPrefix = `#/${defsSegment}/`;\n		const defId = entry[1].schema.id ?? `__schema${ctx.counter++}`;\n		return {\n			defId,\n			ref: defUriPrefix + defId\n		};\n	};\n	const extractToDef = (entry) => {\n		if (entry[1].schema.$ref) return;\n		const seen = entry[1];\n		const { ref, defId } = makeURI(entry);\n		seen.def = { ...seen.schema };\n		if (defId) seen.defId = defId;\n		const schema = seen.schema;\n		for (const key in schema) delete schema[key];\n		schema.$ref = ref;\n	};\n	if (ctx.cycles === \"throw\") for (const entry of ctx.seen.entries()) {\n		const seen = entry[1];\n		if (seen.cycle) throw new Error(`Cycle detected: #/${seen.cycle?.join(\"/\")}/<root>\n\nSet the \\`cycles\\` parameter to \\`\"ref\"\\` to resolve cyclical schemas with defs.`);\n	}\n	for (const entry of ctx.seen.entries()) {\n		const seen = entry[1];\n		if (schema === entry[0]) {\n			extractToDef(entry);\n			continue;\n		}\n		if (ctx.external) {\n			const ext = ctx.external.registry.get(entry[0])?.id;\n			if (schema !== entry[0] && ext) {\n				extractToDef(entry);\n				continue;\n			}\n		}\n		if (ctx.metadataRegistry.get(entry[0])?.id) {\n			extractToDef(entry);\n			continue;\n		}\n		if (seen.cycle) {\n			extractToDef(entry);\n			continue;\n		}\n		if (seen.count > 1) {\n			if (ctx.reused === \"ref\") {\n				extractToDef(entry);\n				continue;\n			}\n		}\n	}\n}\nfunction finalize(ctx, schema) {\n	const root = ctx.seen.get(schema);\n	if (!root) throw new Error(\"Unprocessed schema. This is a bug in Zod.\");\n	const flattenRef = (zodSchema) => {\n		const seen = ctx.seen.get(zodSchema);\n		if (seen.ref === null) return;\n		const schema = seen.def ?? seen.schema;\n		const _cached = { ...schema };\n		const ref = seen.ref;\n		seen.ref = null;\n		if (ref) {\n			flattenRef(ref);\n			const refSeen = ctx.seen.get(ref);\n			const refSchema = refSeen.schema;\n			if (refSchema.$ref && (ctx.target === \"draft-07\" || ctx.target === \"draft-04\" || ctx.target === \"openapi-3.0\")) {\n				schema.allOf = schema.allOf ?? [];\n				schema.allOf.push(refSchema);\n			} else Object.assign(schema, refSchema);\n			Object.assign(schema, _cached);\n			if (zodSchema._zod.parent === ref) for (const key in schema) {\n				if (key === \"$ref\" || key === \"allOf\") continue;\n				if (!(key in _cached)) delete schema[key];\n			}\n			if (refSchema.$ref && refSeen.def) for (const key in schema) {\n				if (key === \"$ref\" || key === \"allOf\") continue;\n				if (key in refSeen.def && JSON.stringify(schema[key]) === JSON.stringify(refSeen.def[key])) delete schema[key];\n			}\n		}\n		const parent = zodSchema._zod.parent;\n		if (parent && parent !== ref) {\n			flattenRef(parent);\n			const parentSeen = ctx.seen.get(parent);\n			if (parentSeen?.schema.$ref) {\n				schema.$ref = parentSeen.schema.$ref;\n				if (parentSeen.def) for (const key in schema) {\n					if (key === \"$ref\" || key === \"allOf\") continue;\n					if (key in parentSeen.def && JSON.stringify(schema[key]) === JSON.stringify(parentSeen.def[key])) delete schema[key];\n				}\n			}\n		}\n		ctx.override({\n			zodSchema,\n			jsonSchema: schema,\n			path: seen.path ?? []\n		});\n	};\n	for (const entry of [...ctx.seen.entries()].reverse()) flattenRef(entry[0]);\n	const result = {};\n	if (ctx.target === \"draft-2020-12\") result.$schema = \"https://json-schema.org/draft/2020-12/schema\";\n	else if (ctx.target === \"draft-07\") result.$schema = \"http://json-schema.org/draft-07/schema#\";\n	else if (ctx.target === \"draft-04\") result.$schema = \"http://json-schema.org/draft-04/schema#\";\n	else if (ctx.target === \"openapi-3.0\") {}\n	if (ctx.external?.uri) {\n		const id = ctx.external.registry.get(schema)?.id;\n		if (!id) throw new Error(\"Schema is missing an `id` property\");\n		result.$id = ctx.external.uri(id);\n	}\n	Object.assign(result, root.def ?? root.schema);\n	const defs = ctx.external?.defs ?? {};\n	for (const entry of ctx.seen.entries()) {\n		const seen = entry[1];\n		if (seen.def && seen.defId) defs[seen.defId] = seen.def;\n	}\n	if (ctx.external) {} else if (Object.keys(defs).length > 0) if (ctx.target === \"draft-2020-12\") result.$defs = defs;\n	else result.definitions = defs;\n	try {\n		const finalized = JSON.parse(JSON.stringify(result));\n		Object.defineProperty(finalized, \"~standard\", {\n			value: {\n				...schema[\"~standard\"],\n				jsonSchema: {\n					input: createStandardJSONSchemaMethod(schema, \"input\", ctx.processors),\n					output: createStandardJSONSchemaMethod(schema, \"output\", ctx.processors)\n				}\n			},\n			enumerable: false,\n			writable: false\n		});\n		return finalized;\n	} catch (_err) {\n		throw new Error(\"Error converting schema to JSON.\");\n	}\n}\nfunction isTransforming(_schema, _ctx) {\n	const ctx = _ctx ?? { seen: /* @__PURE__ */ new Set() };\n	if (ctx.seen.has(_schema)) return false;\n	ctx.seen.add(_schema);\n	const def = _schema._zod.def;\n	if (def.type === \"transform\") return true;\n	if (def.type === \"array\") return isTransforming(def.element, ctx);\n	if (def.type === \"set\") return isTransforming(def.valueType, ctx);\n	if (def.type === \"lazy\") return isTransforming(def.getter(), ctx);\n	if (def.type === \"promise\" || def.type === \"optional\" || def.type === \"nonoptional\" || def.type === \"nullable\" || def.type === \"readonly\" || def.type === \"default\" || def.type === \"prefault\") return isTransforming(def.innerType, ctx);\n	if (def.type === \"intersection\") return isTransforming(def.left, ctx) || isTransforming(def.right, ctx);\n	if (def.type === \"record\" || def.type === \"map\") return isTransforming(def.keyType, ctx) || isTransforming(def.valueType, ctx);\n	if (def.type === \"pipe\") return isTransforming(def.in, ctx) || isTransforming(def.out, ctx);\n	if (def.type === \"object\") {\n		for (const key in def.shape) if (isTransforming(def.shape[key], ctx)) return true;\n		return false;\n	}\n	if (def.type === \"union\") {\n		for (const option of def.options) if (isTransforming(option, ctx)) return true;\n		return false;\n	}\n	if (def.type === \"tuple\") {\n		for (const item of def.items) if (isTransforming(item, ctx)) return true;\n		if (def.rest && isTransforming(def.rest, ctx)) return true;\n		return false;\n	}\n	return false;\n}\n/**\n* Creates a toJSONSchema method for a schema instance.\n* This encapsulates the logic of initializing context, processing, extracting defs, and finalizing.\n*/\nconst createToJSONSchemaMethod = (schema, processors = {}) => (params) => {\n	const ctx = initializeContext({\n		...params,\n		processors\n	});\n	process$1(schema, ctx);\n	extractDefs(ctx, schema);\n	return finalize(ctx, schema);\n};\nconst createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {\n	const { libraryOptions, target } = params ?? {};\n	const ctx = initializeContext({\n		...libraryOptions ?? {},\n		target,\n		io,\n		processors\n	});\n	process$1(schema, ctx);\n	extractDefs(ctx, schema);\n	return finalize(ctx, schema);\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/json-schema-processors.js\nconst formatMap = {\n	guid: \"uuid\",\n	url: \"uri\",\n	datetime: \"date-time\",\n	json_string: \"json-string\",\n	regex: \"\"\n};\nconst stringProcessor = (schema, ctx, _json, _params) => {\n	const json = _json;\n	json.type = \"string\";\n	const { minimum, maximum, format, patterns, contentEncoding } = schema._zod.bag;\n	if (typeof minimum === \"number\") json.minLength = minimum;\n	if (typeof maximum === \"number\") json.maxLength = maximum;\n	if (format) {\n		json.format = formatMap[format] ?? format;\n		if (json.format === \"\") delete json.format;\n		if (format === \"time\") delete json.format;\n	}\n	if (contentEncoding) json.contentEncoding = contentEncoding;\n	if (patterns && patterns.size > 0) {\n		const regexes = [...patterns];\n		if (regexes.length === 1) json.pattern = regexes[0].source;\n		else if (regexes.length > 1) json.allOf = [...regexes.map((regex) => ({\n			...ctx.target === \"draft-07\" || ctx.target === \"draft-04\" || ctx.target === \"openapi-3.0\" ? { type: \"string\" } : {},\n			pattern: regex.source\n		}))];\n	}\n};\nconst neverProcessor = (_schema, _ctx, json, _params) => {\n	json.not = {};\n};\nconst unknownProcessor = (_schema, _ctx, _json, _params) => {};\nconst enumProcessor = (schema, _ctx, json, _params) => {\n	const def = schema._zod.def;\n	const values = getEnumValues(def.entries);\n	if (values.every((v) => typeof v === \"number\")) json.type = \"number\";\n	if (values.every((v) => typeof v === \"string\")) json.type = \"string\";\n	json.enum = values;\n};\nconst customProcessor = (_schema, ctx, _json, _params) => {\n	if (ctx.unrepresentable === \"throw\") throw new Error(\"Custom types cannot be represented in JSON Schema\");\n};\nconst transformProcessor = (_schema, ctx, _json, _params) => {\n	if (ctx.unrepresentable === \"throw\") throw new Error(\"Transforms cannot be represented in JSON Schema\");\n};\nconst arrayProcessor = (schema, ctx, _json, params) => {\n	const json = _json;\n	const def = schema._zod.def;\n	const { minimum, maximum } = schema._zod.bag;\n	if (typeof minimum === \"number\") json.minItems = minimum;\n	if (typeof maximum === \"number\") json.maxItems = maximum;\n	json.type = \"array\";\n	json.items = process$1(def.element, ctx, {\n		...params,\n		path: [...params.path, \"items\"]\n	});\n};\nconst objectProcessor = (schema, ctx, _json, params) => {\n	const json = _json;\n	const def = schema._zod.def;\n	json.type = \"object\";\n	json.properties = {};\n	const shape = def.shape;\n	for (const key in shape) json.properties[key] = process$1(shape[key], ctx, {\n		...params,\n		path: [\n			...params.path,\n			\"properties\",\n			key\n		]\n	});\n	const allKeys = new Set(Object.keys(shape));\n	const requiredKeys = new Set([...allKeys].filter((key) => {\n		const v = def.shape[key]._zod;\n		if (ctx.io === \"input\") return v.optin === void 0;\n		else return v.optout === void 0;\n	}));\n	if (requiredKeys.size > 0) json.required = Array.from(requiredKeys);\n	if (def.catchall?._zod.def.type === \"never\") json.additionalProperties = false;\n	else if (!def.catchall) {\n		if (ctx.io === \"output\") json.additionalProperties = false;\n	} else if (def.catchall) json.additionalProperties = process$1(def.catchall, ctx, {\n		...params,\n		path: [...params.path, \"additionalProperties\"]\n	});\n};\nconst unionProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	const isExclusive = def.inclusive === false;\n	const options = def.options.map((x, i) => process$1(x, ctx, {\n		...params,\n		path: [\n			...params.path,\n			isExclusive ? \"oneOf\" : \"anyOf\",\n			i\n		]\n	}));\n	if (isExclusive) json.oneOf = options;\n	else json.anyOf = options;\n};\nconst intersectionProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	const a = process$1(def.left, ctx, {\n		...params,\n		path: [\n			...params.path,\n			\"allOf\",\n			0\n		]\n	});\n	const b = process$1(def.right, ctx, {\n		...params,\n		path: [\n			...params.path,\n			\"allOf\",\n			1\n		]\n	});\n	const isSimpleIntersection = (val) => \"allOf\" in val && Object.keys(val).length === 1;\n	json.allOf = [...isSimpleIntersection(a) ? a.allOf : [a], ...isSimpleIntersection(b) ? b.allOf : [b]];\n};\nconst recordProcessor = (schema, ctx, _json, params) => {\n	const json = _json;\n	const def = schema._zod.def;\n	json.type = \"object\";\n	const keyType = def.keyType;\n	const patterns = keyType._zod.bag?.patterns;\n	if (def.mode === \"loose\" && patterns && patterns.size > 0) {\n		const valueSchema = process$1(def.valueType, ctx, {\n			...params,\n			path: [\n				...params.path,\n				\"patternProperties\",\n				\"*\"\n			]\n		});\n		json.patternProperties = {};\n		for (const pattern of patterns) json.patternProperties[pattern.source] = valueSchema;\n	} else {\n		if (ctx.target === \"draft-07\" || ctx.target === \"draft-2020-12\") json.propertyNames = process$1(def.keyType, ctx, {\n			...params,\n			path: [...params.path, \"propertyNames\"]\n		});\n		json.additionalProperties = process$1(def.valueType, ctx, {\n			...params,\n			path: [...params.path, \"additionalProperties\"]\n		});\n	}\n	const keyValues = keyType._zod.values;\n	if (keyValues) {\n		const validKeyValues = [...keyValues].filter((v) => typeof v === \"string\" || typeof v === \"number\");\n		if (validKeyValues.length > 0) json.required = validKeyValues;\n	}\n};\nconst nullableProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	const inner = process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	if (ctx.target === \"openapi-3.0\") {\n		seen.ref = def.innerType;\n		json.nullable = true;\n	} else json.anyOf = [inner, { type: \"null\" }];\n};\nconst nonoptionalProcessor = (schema, ctx, _json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n};\nconst defaultProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	json.default = JSON.parse(JSON.stringify(def.defaultValue));\n};\nconst prefaultProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	if (ctx.io === \"input\") json._prefault = JSON.parse(JSON.stringify(def.defaultValue));\n};\nconst catchProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	let catchValue;\n	try {\n		catchValue = def.catchValue(void 0);\n	} catch {\n		throw new Error(\"Dynamic catch values are not supported in JSON Schema\");\n	}\n	json.default = catchValue;\n};\nconst pipeProcessor = (schema, ctx, _json, params) => {\n	const def = schema._zod.def;\n	const innerType = ctx.io === \"input\" ? def.in._zod.def.type === \"transform\" ? def.out : def.in : def.out;\n	process$1(innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = innerType;\n};\nconst readonlyProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	json.readOnly = true;\n};\nconst optionalProcessor = (schema, ctx, _json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/iso.js\nconst ZodISODateTime = /* @__PURE__ */ $constructor(\"ZodISODateTime\", (inst, def) => {\n	$ZodISODateTime.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction datetime(params) {\n	return _isoDateTime(ZodISODateTime, params);\n}\nconst ZodISODate = /* @__PURE__ */ $constructor(\"ZodISODate\", (inst, def) => {\n	$ZodISODate.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction date(params) {\n	return _isoDate(ZodISODate, params);\n}\nconst ZodISOTime = /* @__PURE__ */ $constructor(\"ZodISOTime\", (inst, def) => {\n	$ZodISOTime.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction time(params) {\n	return _isoTime(ZodISOTime, params);\n}\nconst ZodISODuration = /* @__PURE__ */ $constructor(\"ZodISODuration\", (inst, def) => {\n	$ZodISODuration.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction duration(params) {\n	return _isoDuration(ZodISODuration, params);\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/errors.js\nconst initializer = (inst, issues) => {\n	$ZodError.init(inst, issues);\n	inst.name = \"ZodError\";\n	Object.defineProperties(inst, {\n		format: { value: (mapper) => formatError(inst, mapper) },\n		flatten: { value: (mapper) => flattenError(inst, mapper) },\n		addIssue: { value: (issue) => {\n			inst.issues.push(issue);\n			inst.message = JSON.stringify(inst.issues, jsonStringifyReplacer, 2);\n		} },\n		addIssues: { value: (issues) => {\n			inst.issues.push(...issues);\n			inst.message = JSON.stringify(inst.issues, jsonStringifyReplacer, 2);\n		} },\n		isEmpty: { get() {\n			return inst.issues.length === 0;\n		} }\n	});\n};\nconst ZodError = $constructor(\"ZodError\", initializer);\nconst ZodRealError = $constructor(\"ZodError\", initializer, { Parent: Error });\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/parse.js\nconst parse = /* @__PURE__ */ _parse(ZodRealError);\nconst parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);\nconst safeParse = /* @__PURE__ */ _safeParse(ZodRealError);\nconst safeParseAsync = /* @__PURE__ */ _safeParseAsync(ZodRealError);\nconst encode = /* @__PURE__ */ _encode(ZodRealError);\nconst decode = /* @__PURE__ */ _decode(ZodRealError);\nconst encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);\nconst decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);\nconst safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);\nconst safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);\nconst safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);\nconst safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/schemas.js\nconst ZodType = /* @__PURE__ */ $constructor(\"ZodType\", (inst, def) => {\n	$ZodType.init(inst, def);\n	Object.assign(inst[\"~standard\"], { jsonSchema: {\n		input: createStandardJSONSchemaMethod(inst, \"input\"),\n		output: createStandardJSONSchemaMethod(inst, \"output\")\n	} });\n	inst.toJSONSchema = createToJSONSchemaMethod(inst, {});\n	inst.def = def;\n	inst.type = def.type;\n	Object.defineProperty(inst, \"_def\", { value: def });\n	inst.check = (...checks) => {\n		return inst.clone(mergeDefs(def, { checks: [...def.checks ?? [], ...checks.map((ch) => typeof ch === \"function\" ? { _zod: {\n			check: ch,\n			def: { check: \"custom\" },\n			onattach: []\n		} } : ch)] }), { parent: true });\n	};\n	inst.with = inst.check;\n	inst.clone = (def, params) => clone(inst, def, params);\n	inst.brand = () => inst;\n	inst.register = ((reg, meta) => {\n		reg.add(inst, meta);\n		return inst;\n	});\n	inst.parse = (data, params) => parse(inst, data, params, { callee: inst.parse });\n	inst.safeParse = (data, params) => safeParse(inst, data, params);\n	inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });\n	inst.safeParseAsync = async (data, params) => safeParseAsync(inst, data, params);\n	inst.spa = inst.safeParseAsync;\n	inst.encode = (data, params) => encode(inst, data, params);\n	inst.decode = (data, params) => decode(inst, data, params);\n	inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);\n	inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);\n	inst.safeEncode = (data, params) => safeEncode(inst, data, params);\n	inst.safeDecode = (data, params) => safeDecode(inst, data, params);\n	inst.safeEncodeAsync = async (data, params) => safeEncodeAsync(inst, data, params);\n	inst.safeDecodeAsync = async (data, params) => safeDecodeAsync(inst, data, params);\n	inst.refine = (check, params) => inst.check(refine(check, params));\n	inst.superRefine = (refinement) => inst.check(superRefine(refinement));\n	inst.overwrite = (fn) => inst.check(_overwrite(fn));\n	inst.optional = () => optional(inst);\n	inst.exactOptional = () => exactOptional(inst);\n	inst.nullable = () => nullable(inst);\n	inst.nullish = () => optional(nullable(inst));\n	inst.nonoptional = (params) => nonoptional(inst, params);\n	inst.array = () => array(inst);\n	inst.or = (arg) => union([inst, arg]);\n	inst.and = (arg) => intersection(inst, arg);\n	inst.transform = (tx) => pipe(inst, transform(tx));\n	inst.default = (def) => _default(inst, def);\n	inst.prefault = (def) => prefault(inst, def);\n	inst.catch = (params) => _catch(inst, params);\n	inst.pipe = (target) => pipe(inst, target);\n	inst.readonly = () => readonly(inst);\n	inst.describe = (description) => {\n		const cl = inst.clone();\n		globalRegistry.add(cl, { description });\n		return cl;\n	};\n	Object.defineProperty(inst, \"description\", {\n		get() {\n			return globalRegistry.get(inst)?.description;\n		},\n		configurable: true\n	});\n	inst.meta = (...args) => {\n		if (args.length === 0) return globalRegistry.get(inst);\n		const cl = inst.clone();\n		globalRegistry.add(cl, args[0]);\n		return cl;\n	};\n	inst.isOptional = () => inst.safeParse(void 0).success;\n	inst.isNullable = () => inst.safeParse(null).success;\n	inst.apply = (fn) => fn(inst);\n	return inst;\n});\n/** @internal */\nconst _ZodString = /* @__PURE__ */ $constructor(\"_ZodString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => stringProcessor(inst, ctx, json, params);\n	const bag = inst._zod.bag;\n	inst.format = bag.format ?? null;\n	inst.minLength = bag.minimum ?? null;\n	inst.maxLength = bag.maximum ?? null;\n	inst.regex = (...args) => inst.check(_regex(...args));\n	inst.includes = (...args) => inst.check(_includes(...args));\n	inst.startsWith = (...args) => inst.check(_startsWith(...args));\n	inst.endsWith = (...args) => inst.check(_endsWith(...args));\n	inst.min = (...args) => inst.check(_minLength(...args));\n	inst.max = (...args) => inst.check(_maxLength(...args));\n	inst.length = (...args) => inst.check(_length(...args));\n	inst.nonempty = (...args) => inst.check(_minLength(1, ...args));\n	inst.lowercase = (params) => inst.check(_lowercase(params));\n	inst.uppercase = (params) => inst.check(_uppercase(params));\n	inst.trim = () => inst.check(_trim());\n	inst.normalize = (...args) => inst.check(_normalize(...args));\n	inst.toLowerCase = () => inst.check(_toLowerCase());\n	inst.toUpperCase = () => inst.check(_toUpperCase());\n	inst.slugify = () => inst.check(_slugify());\n});\nconst ZodString = /* @__PURE__ */ $constructor(\"ZodString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	_ZodString.init(inst, def);\n	inst.email = (params) => inst.check(_email(ZodEmail, params));\n	inst.url = (params) => inst.check(_url(ZodURL, params));\n	inst.jwt = (params) => inst.check(_jwt(ZodJWT, params));\n	inst.emoji = (params) => inst.check(_emoji(ZodEmoji, params));\n	inst.guid = (params) => inst.check(_guid(ZodGUID, params));\n	inst.uuid = (params) => inst.check(_uuid(ZodUUID, params));\n	inst.uuidv4 = (params) => inst.check(_uuidv4(ZodUUID, params));\n	inst.uuidv6 = (params) => inst.check(_uuidv6(ZodUUID, params));\n	inst.uuidv7 = (params) => inst.check(_uuidv7(ZodUUID, params));\n	inst.nanoid = (params) => inst.check(_nanoid(ZodNanoID, params));\n	inst.guid = (params) => inst.check(_guid(ZodGUID, params));\n	inst.cuid = (params) => inst.check(_cuid(ZodCUID, params));\n	inst.cuid2 = (params) => inst.check(_cuid2(ZodCUID2, params));\n	inst.ulid = (params) => inst.check(_ulid(ZodULID, params));\n	inst.base64 = (params) => inst.check(_base64(ZodBase64, params));\n	inst.base64url = (params) => inst.check(_base64url(ZodBase64URL, params));\n	inst.xid = (params) => inst.check(_xid(ZodXID, params));\n	inst.ksuid = (params) => inst.check(_ksuid(ZodKSUID, params));\n	inst.ipv4 = (params) => inst.check(_ipv4(ZodIPv4, params));\n	inst.ipv6 = (params) => inst.check(_ipv6(ZodIPv6, params));\n	inst.cidrv4 = (params) => inst.check(_cidrv4(ZodCIDRv4, params));\n	inst.cidrv6 = (params) => inst.check(_cidrv6(ZodCIDRv6, params));\n	inst.e164 = (params) => inst.check(_e164(ZodE164, params));\n	inst.datetime = (params) => inst.check(datetime(params));\n	inst.date = (params) => inst.check(date(params));\n	inst.time = (params) => inst.check(time(params));\n	inst.duration = (params) => inst.check(duration(params));\n});\nfunction string(params) {\n	return _string(ZodString, params);\n}\nconst ZodStringFormat = /* @__PURE__ */ $constructor(\"ZodStringFormat\", (inst, def) => {\n	$ZodStringFormat.init(inst, def);\n	_ZodString.init(inst, def);\n});\nconst ZodEmail = /* @__PURE__ */ $constructor(\"ZodEmail\", (inst, def) => {\n	$ZodEmail.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodGUID = /* @__PURE__ */ $constructor(\"ZodGUID\", (inst, def) => {\n	$ZodGUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodUUID = /* @__PURE__ */ $constructor(\"ZodUUID\", (inst, def) => {\n	$ZodUUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodURL = /* @__PURE__ */ $constructor(\"ZodURL\", (inst, def) => {\n	$ZodURL.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodEmoji = /* @__PURE__ */ $constructor(\"ZodEmoji\", (inst, def) => {\n	$ZodEmoji.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodNanoID = /* @__PURE__ */ $constructor(\"ZodNanoID\", (inst, def) => {\n	$ZodNanoID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodCUID = /* @__PURE__ */ $constructor(\"ZodCUID\", (inst, def) => {\n	$ZodCUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodCUID2 = /* @__PURE__ */ $constructor(\"ZodCUID2\", (inst, def) => {\n	$ZodCUID2.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodULID = /* @__PURE__ */ $constructor(\"ZodULID\", (inst, def) => {\n	$ZodULID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodXID = /* @__PURE__ */ $constructor(\"ZodXID\", (inst, def) => {\n	$ZodXID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodKSUID = /* @__PURE__ */ $constructor(\"ZodKSUID\", (inst, def) => {\n	$ZodKSUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodIPv4 = /* @__PURE__ */ $constructor(\"ZodIPv4\", (inst, def) => {\n	$ZodIPv4.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodIPv6 = /* @__PURE__ */ $constructor(\"ZodIPv6\", (inst, def) => {\n	$ZodIPv6.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodCIDRv4 = /* @__PURE__ */ $constructor(\"ZodCIDRv4\", (inst, def) => {\n	$ZodCIDRv4.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodCIDRv6 = /* @__PURE__ */ $constructor(\"ZodCIDRv6\", (inst, def) => {\n	$ZodCIDRv6.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodBase64 = /* @__PURE__ */ $constructor(\"ZodBase64\", (inst, def) => {\n	$ZodBase64.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodBase64URL = /* @__PURE__ */ $constructor(\"ZodBase64URL\", (inst, def) => {\n	$ZodBase64URL.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodE164 = /* @__PURE__ */ $constructor(\"ZodE164\", (inst, def) => {\n	$ZodE164.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodJWT = /* @__PURE__ */ $constructor(\"ZodJWT\", (inst, def) => {\n	$ZodJWT.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodUnknown = /* @__PURE__ */ $constructor(\"ZodUnknown\", (inst, def) => {\n	$ZodUnknown.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => unknownProcessor(inst, ctx, json, params);\n});\nfunction unknown() {\n	return _unknown(ZodUnknown);\n}\nconst ZodNever = /* @__PURE__ */ $constructor(\"ZodNever\", (inst, def) => {\n	$ZodNever.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => neverProcessor(inst, ctx, json, params);\n});\nfunction never(params) {\n	return _never(ZodNever, params);\n}\nconst ZodArray = /* @__PURE__ */ $constructor(\"ZodArray\", (inst, def) => {\n	$ZodArray.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => arrayProcessor(inst, ctx, json, params);\n	inst.element = def.element;\n	inst.min = (minLength, params) => inst.check(_minLength(minLength, params));\n	inst.nonempty = (params) => inst.check(_minLength(1, params));\n	inst.max = (maxLength, params) => inst.check(_maxLength(maxLength, params));\n	inst.length = (len, params) => inst.check(_length(len, params));\n	inst.unwrap = () => inst.element;\n});\nfunction array(element, params) {\n	return _array(ZodArray, element, params);\n}\nconst ZodObject = /* @__PURE__ */ $constructor(\"ZodObject\", (inst, def) => {\n	$ZodObjectJIT.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => objectProcessor(inst, ctx, json, params);\n	defineLazy(inst, \"shape\", () => {\n		return def.shape;\n	});\n	inst.keyof = () => _enum(Object.keys(inst._zod.def.shape));\n	inst.catchall = (catchall) => inst.clone({\n		...inst._zod.def,\n		catchall\n	});\n	inst.passthrough = () => inst.clone({\n		...inst._zod.def,\n		catchall: unknown()\n	});\n	inst.loose = () => inst.clone({\n		...inst._zod.def,\n		catchall: unknown()\n	});\n	inst.strict = () => inst.clone({\n		...inst._zod.def,\n		catchall: never()\n	});\n	inst.strip = () => inst.clone({\n		...inst._zod.def,\n		catchall: void 0\n	});\n	inst.extend = (incoming) => {\n		return extend(inst, incoming);\n	};\n	inst.safeExtend = (incoming) => {\n		return safeExtend(inst, incoming);\n	};\n	inst.merge = (other) => merge(inst, other);\n	inst.pick = (mask) => pick(inst, mask);\n	inst.omit = (mask) => omit(inst, mask);\n	inst.partial = (...args) => partial(ZodOptional, inst, args[0]);\n	inst.required = (...args) => required(ZodNonOptional, inst, args[0]);\n});\nfunction object(shape, params) {\n	return new ZodObject({\n		type: \"object\",\n		shape: shape ?? {},\n		...normalizeParams(params)\n	});\n}\nconst ZodUnion = /* @__PURE__ */ $constructor(\"ZodUnion\", (inst, def) => {\n	$ZodUnion.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => unionProcessor(inst, ctx, json, params);\n	inst.options = def.options;\n});\nfunction union(options, params) {\n	return new ZodUnion({\n		type: \"union\",\n		options,\n		...normalizeParams(params)\n	});\n}\nconst ZodIntersection = /* @__PURE__ */ $constructor(\"ZodIntersection\", (inst, def) => {\n	$ZodIntersection.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => intersectionProcessor(inst, ctx, json, params);\n});\nfunction intersection(left, right) {\n	return new ZodIntersection({\n		type: \"intersection\",\n		left,\n		right\n	});\n}\nconst ZodRecord = /* @__PURE__ */ $constructor(\"ZodRecord\", (inst, def) => {\n	$ZodRecord.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => recordProcessor(inst, ctx, json, params);\n	inst.keyType = def.keyType;\n	inst.valueType = def.valueType;\n});\nfunction record(keyType, valueType, params) {\n	return new ZodRecord({\n		type: \"record\",\n		keyType,\n		valueType,\n		...normalizeParams(params)\n	});\n}\nconst ZodEnum = /* @__PURE__ */ $constructor(\"ZodEnum\", (inst, def) => {\n	$ZodEnum.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => enumProcessor(inst, ctx, json, params);\n	inst.enum = def.entries;\n	inst.options = Object.values(def.entries);\n	const keys = new Set(Object.keys(def.entries));\n	inst.extract = (values, params) => {\n		const newEntries = {};\n		for (const value of values) if (keys.has(value)) newEntries[value] = def.entries[value];\n		else throw new Error(`Key ${value} not found in enum`);\n		return new ZodEnum({\n			...def,\n			checks: [],\n			...normalizeParams(params),\n			entries: newEntries\n		});\n	};\n	inst.exclude = (values, params) => {\n		const newEntries = { ...def.entries };\n		for (const value of values) if (keys.has(value)) delete newEntries[value];\n		else throw new Error(`Key ${value} not found in enum`);\n		return new ZodEnum({\n			...def,\n			checks: [],\n			...normalizeParams(params),\n			entries: newEntries\n		});\n	};\n});\nfunction _enum(values, params) {\n	return new ZodEnum({\n		type: \"enum\",\n		entries: Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values,\n		...normalizeParams(params)\n	});\n}\nconst ZodTransform = /* @__PURE__ */ $constructor(\"ZodTransform\", (inst, def) => {\n	$ZodTransform.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => transformProcessor(inst, ctx, json, params);\n	inst._zod.parse = (payload, _ctx) => {\n		if (_ctx.direction === \"backward\") throw new $ZodEncodeError(inst.constructor.name);\n		payload.addIssue = (issue$1) => {\n			if (typeof issue$1 === \"string\") payload.issues.push(issue(issue$1, payload.value, def));\n			else {\n				const _issue = issue$1;\n				if (_issue.fatal) _issue.continue = false;\n				_issue.code ?? (_issue.code = \"custom\");\n				_issue.input ?? (_issue.input = payload.value);\n				_issue.inst ?? (_issue.inst = inst);\n				payload.issues.push(issue(_issue));\n			}\n		};\n		const output = def.transform(payload.value, payload);\n		if (output instanceof Promise) return output.then((output) => {\n			payload.value = output;\n			return payload;\n		});\n		payload.value = output;\n		return payload;\n	};\n});\nfunction transform(fn) {\n	return new ZodTransform({\n		type: \"transform\",\n		transform: fn\n	});\n}\nconst ZodOptional = /* @__PURE__ */ $constructor(\"ZodOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => optionalProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction optional(innerType) {\n	return new ZodOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodExactOptional = /* @__PURE__ */ $constructor(\"ZodExactOptional\", (inst, def) => {\n	$ZodExactOptional.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => optionalProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction exactOptional(innerType) {\n	return new ZodExactOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodNullable = /* @__PURE__ */ $constructor(\"ZodNullable\", (inst, def) => {\n	$ZodNullable.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => nullableProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction nullable(innerType) {\n	return new ZodNullable({\n		type: \"nullable\",\n		innerType\n	});\n}\nconst ZodDefault = /* @__PURE__ */ $constructor(\"ZodDefault\", (inst, def) => {\n	$ZodDefault.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => defaultProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n	inst.removeDefault = inst.unwrap;\n});\nfunction _default(innerType, defaultValue) {\n	return new ZodDefault({\n		type: \"default\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\nconst ZodPrefault = /* @__PURE__ */ $constructor(\"ZodPrefault\", (inst, def) => {\n	$ZodPrefault.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => prefaultProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction prefault(innerType, defaultValue) {\n	return new ZodPrefault({\n		type: \"prefault\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\nconst ZodNonOptional = /* @__PURE__ */ $constructor(\"ZodNonOptional\", (inst, def) => {\n	$ZodNonOptional.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => nonoptionalProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction nonoptional(innerType, params) {\n	return new ZodNonOptional({\n		type: \"nonoptional\",\n		innerType,\n		...normalizeParams(params)\n	});\n}\nconst ZodCatch = /* @__PURE__ */ $constructor(\"ZodCatch\", (inst, def) => {\n	$ZodCatch.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => catchProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n	inst.removeCatch = inst.unwrap;\n});\nfunction _catch(innerType, catchValue) {\n	return new ZodCatch({\n		type: \"catch\",\n		innerType,\n		catchValue: typeof catchValue === \"function\" ? catchValue : () => catchValue\n	});\n}\nconst ZodPipe = /* @__PURE__ */ $constructor(\"ZodPipe\", (inst, def) => {\n	$ZodPipe.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => pipeProcessor(inst, ctx, json, params);\n	inst.in = def.in;\n	inst.out = def.out;\n});\nfunction pipe(in_, out) {\n	return new ZodPipe({\n		type: \"pipe\",\n		in: in_,\n		out\n	});\n}\nconst ZodReadonly = /* @__PURE__ */ $constructor(\"ZodReadonly\", (inst, def) => {\n	$ZodReadonly.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => readonlyProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction readonly(innerType) {\n	return new ZodReadonly({\n		type: \"readonly\",\n		innerType\n	});\n}\nconst ZodCustom = /* @__PURE__ */ $constructor(\"ZodCustom\", (inst, def) => {\n	$ZodCustom.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);\n});\nfunction refine(fn, _params = {}) {\n	return _refine(ZodCustom, fn, _params);\n}\nfunction superRefine(fn) {\n	return _superRefine(fn);\n}\n\n//#endregion\n//#region src/lib/hook-io.ts\nconst HookInputSchema = object({\n	session_id: string(),\n	transcript_path: string(),\n	cwd: string(),\n	permission_mode: string(),\n	hook_event_name: string(),\n	tool_name: string(),\n	tool_input: record(string(), unknown())\n});\n/**\n* Read and parse the full stdin as JSON.\n* Returns a result with the validated HookInput, or the raw data and error on failure.\n*/\nasync function readHookInput() {\n	const chunks = [];\n	for await (const chunk of process.stdin) chunks.push(typeof chunk === \"string\" ? chunk : String(chunk));\n	let parsed;\n	try {\n		parsed = JSON.parse(chunks.join(\"\"));\n	} catch (_error) {\n		return {\n			ok: false,\n			raw: chunks.join(\"\").slice(0, 200),\n			error: \"invalid JSON\"\n		};\n	}\n	const result = HookInputSchema.safeParse(parsed);\n	if (!result.success) return {\n		ok: false,\n		raw: parsed,\n		error: result.error.message\n	};\n	return {\n		ok: true,\n		data: result.data\n	};\n}\nconst BashInputSchema = object({\n	command: string(),\n	description: optional(string())\n});\nconst FilePathInputSchema = object({ file_path: string() });\nconst SearchInputSchema = object({\n	pattern: string(),\n	path: optional(string())\n});\n/** Parse tool_input as Bash input. Returns null if invalid. */\nfunction parseBashInput(toolInput) {\n	const result = BashInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\n/** Parse tool_input as file-path input (Read, Write, Edit). Returns null if invalid. */\nfunction parseFilePathInput(toolInput) {\n	const result = FilePathInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\n/** Parse tool_input as search input (Glob, Grep). Returns null if invalid. */\nfunction parseSearchInput(toolInput) {\n	const result = SearchInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction writeDecision(action, reason) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		permissionDecision: action,\n		...action === \"deny\" && reason ? { permissionDecisionReason: reason } : {}\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\n\n//#endregion\n//#region src/lib/audit.ts\nconst MAX_LOG_SIZE = 1048576;\n/**\n* Resolve the audit log path relative to the hook's own location.\n* Co-located at `.claude/hooks/bst-hook.audit.local.jsonl`.\n*/\nfunction getLogPath() {\n	const hookDir = path.dirname(fileURLToPath(import.meta.url));\n	return path.join(hookDir, \"bst-hook.audit.local.jsonl\");\n}\n/**\n* Rotate the log file if it exceeds MAX_LOG_SIZE.\n* Renames current log to `.1` and starts fresh.\n* Safe against concurrent rotation — ENOENT on rename is expected and ignored.\n*/\nfunction rotateIfNeeded(logPath) {\n	try {\n		if (fs.statSync(logPath).size > MAX_LOG_SIZE) {\n			const rotatedPath = `${logPath}.1`;\n			fs.renameSync(logPath, rotatedPath);\n		}\n	} catch (_error) {}\n}\n/** Whether rotation has been checked this session */\nlet rotationChecked = false;\n/**\n* Append an audit entry to the JSONL log.\n* Never throws — audit failures log to stderr and continue.\n*/\nfunction audit(entry) {\n	try {\n		const logPath = getLogPath();\n		if (!rotationChecked) {\n			rotateIfNeeded(logPath);\n			rotationChecked = true;\n		}\n		const record = {\n			timestamp: (/* @__PURE__ */ new Date()).toISOString(),\n			...entry\n		};\n		fs.appendFileSync(logPath, JSON.stringify(record) + \"\\n\");\n	} catch (err) {\n		process.stderr.write(`[bst-hook] audit write failed: ${err instanceof Error ? err.message : String(err)}\\n`);\n	}\n}\n\n//#endregion\n//#region src/lib/shell-tokenizer.ts\n/**\n* Quote-aware shell tokenizer (shlex port).\n*\n* Given a single command segment (no &&/||/;/|), tokenize it into words:\n* - Single quotes: literal, no escape processing\n* - Double quotes: allow \\\", \\\\, \\$, \\` escapes\n* - Backslash outside quotes: escapes next character\n* - Unquoted whitespace splits tokens\n*/\nfunction tokenize(input) {\n	const tokens = [];\n	let current = \"\";\n	let i = 0;\n	let inToken = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"'\") {\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated single quote\"\n			};\n			i++;\n		} else if (ch === \"\\\"\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"\\\"\") {\n				if (input[i] === \"\\\\\" && i + 1 < input.length) {\n					const next = input[i + 1];\n					if (next === \"\\\"\" || next === \"\\\\\" || next === \"$\" || next === \"`\") {\n						current += next;\n						i += 2;\n						continue;\n					}\n				}\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated double quote\"\n			};\n			i++;\n		} else if (ch === \"\\\\\" && i + 1 < input.length) {\n			inToken = true;\n			current += input[i + 1];\n			i += 2;\n		} else if (ch === \" \" || ch === \"	\") {\n			if (inToken) {\n				tokens.push(current);\n				current = \"\";\n				inToken = false;\n			}\n			i++;\n		} else {\n			inToken = true;\n			current += ch;\n			i++;\n		}\n	}\n	if (inToken) tokens.push(current);\n	return {\n		ok: true,\n		tokens\n	};\n}\n/**\n* Characters safe to leave unquoted when re-emitting a token. Anything outside\n* this set could be interpreted by the shell-splitter or tokenizer on a\n* subsequent pass (operators, whitespace, quotes, globs, vars, etc.).\n*/\nconst SAFE_UNQUOTED_RE = /^[A-Za-z0-9_\\-./=:@%+,]+$/;\n/** Single-quote-wrap a token unless it only contains safe characters. */\nfunction quoteToken(token) {\n	if (token.length > 0 && SAFE_UNQUOTED_RE.test(token)) return token;\n	return \"'\" + token.replace(/'/g, \"'\\\\''\") + \"'\";\n}\n/**\n* Inverse of `tokenize`: join tokens into a command string that survives\n* round-tripping through `splitCommand` and `tokenize`.\n*\n* Naive `tokens.join(\" \")` is lossy: any token that was originally quoted\n* loses its quote wrapper and may be mis-parsed when split/tokenized again\n* (e.g. `--testPathPattern=a|b` would split on the embedded `|`).\n*/\nfunction joinTokens(tokens) {\n	return tokens.map(quoteToken).join(\" \");\n}\n\n//#endregion\n//#region src/lib/shell-splitter.ts\n/**\n* Split a raw command string into segments on unquoted &&, ||, ;, and | operators.\n* Quote-aware: operators inside single or double quotes are not split points.\n*\n* Returns segments with the operator that follows each one (null for the last segment).\n*/\nfunction splitCommand(input) {\n	if (!input || !input.trim()) return [];\n	const segments = [];\n	let current = \"\";\n	let i = 0;\n	let inSingleQuote = false;\n	let inDoubleQuote = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\" && !inDoubleQuote) {\n			inSingleQuote = !inSingleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\"\" && !inSingleQuote) {\n			inDoubleQuote = !inDoubleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\\\" && !inSingleQuote && i + 1 < input.length) {\n			current += ch + input[i + 1];\n			i += 2;\n			continue;\n		}\n		if (!inSingleQuote && !inDoubleQuote) {\n			if (ch === \"&\" && i + 1 < input.length && input[i + 1] === \"&\") {\n				pushSegment(segments, current, \"&&\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"&\" && !(i + 1 < input.length && input[i + 1] === \">\") && !(i > 0 && (input[i - 1] === \">\" || input[i - 1] === \"<\"))) {\n				pushSegment(segments, current, \"&\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \"|\" && i + 1 < input.length && input[i + 1] === \"|\") {\n				pushSegment(segments, current, \"||\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"|\") {\n				pushSegment(segments, current, \"|\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \";\") {\n				pushSegment(segments, current, \";\");\n				current = \"\";\n				i++;\n				continue;\n			}\n		}\n		current += ch;\n		i++;\n	}\n	const trimmed = current.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator: null\n	});\n	return segments;\n}\nfunction pushSegment(segments, text, operator) {\n	const trimmed = text.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator\n	});\n}\n\n//#endregion\n//#region src/lib/injection-guard.ts\n/** Safe redirect patterns that don't constitute file writes */\nconst SAFE_REDIRECTS = new Set([\n	\"2>&1\",\n	\"2>/dev/null\",\n	\">/dev/null\",\n	\"1>/dev/null\"\n]);\n/**\n* Detect dangerous patterns in tokenized command segments.\n*\n* Checks for:\n* - Command substitution (`$(...)`, backticks)\n* - Process substitution (`<(...)`, `>(...)`)\n* - File redirects (`>`, `>>`, `<` to non-/dev/null targets) — skipped when `skipRedirects` is true\n* - Newlines in raw segment (injection via line splitting)\n*\n* @param skipRedirects When true, skip redirect analysis (used for trusted resolved scripts)\n*/\nfunction checkInjection(tokens, rawSegment, skipRedirects = false) {\n	if (/[\\n\\r]/.test(rawSegment)) return {\n		safe: false,\n		reason: \"unquoted newline in command\"\n	};\n	for (const token of tokens) {\n		if (token === \"`\") return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"$(\")) return {\n			safe: false,\n			reason: \"dollar command substitution\"\n		};\n		if (token.includes(\"`\")) return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n		if (token.includes(\">(\") && !SAFE_REDIRECTS.has(token)) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n	}\n	if (!skipRedirects) for (let i = 0; i < tokens.length; i++) {\n		const token = tokens[i];\n		if (SAFE_REDIRECTS.has(token)) continue;\n		if (token.includes(\"<\") && !token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"input redirect\"\n		};\n		if (token.includes(\">\")) {\n			if (token.endsWith(\">/dev/null\")) continue;\n			if (token.match(/^(&>>|&>|>>|>|1>|2>)$/)) {\n				if (tokens[i + 1] === \"/dev/null\") continue;\n			}\n			return {\n				safe: false,\n				reason: \"output redirect to file\"\n			};\n		}\n	}\n	return { safe: true };\n}\n\n//#endregion\n//#region src/lib/env-file.ts\n/**\n* File extensions considered safe documentation templates.\n* Files ending with these suffixes are NOT treated as secret .env files.\n*/\nconst ENV_SAFE_SUFFIXES = [\n	\".sample\",\n	\".example\",\n	\".template\"\n];\n/**\n* Pattern matching .env files: `.env`, `.env.local`, `.env.production`, etc.\n* Does NOT match `.env.sample`, `.env.example`, `.env.template`.\n*/\nconst ENV_FILE_PATTERN = /(^|[/\\\\])(\\.env(\\..*)?|.*\\.env(\\..*)?|\\.env)$/;\n/** Check if a filename is a safe .env documentation template. */\nfunction isEnvSafeSuffix(filename) {\n	return ENV_SAFE_SUFFIXES.some((suffix) => filename.endsWith(suffix));\n}\n/**\n* Check if a path targets a .env file (excluding safe templates).\n* Works with both bare filenames and full paths.\n*/\nfunction isEnvFile(filePath) {\n	if (isEnvSafeSuffix(path.basename(filePath))) return false;\n	return ENV_FILE_PATTERN.test(filePath);\n}\n/**\n* Check if any non-flag token in a Bash command targets a .env file.\n* Used by Bash deny rules for cat, head, tail, grep, etc.\n*/\nfunction tokensTargetEnvFile(tokens) {\n	return tokens.slice(1).some((t) => !t.startsWith(\"-\") && isEnvFile(t));\n}\n\n//#endregion\n//#region src/rules.ts\nconst GIT_READ_OPS = new Set([\n	\"status\",\n	\"log\",\n	\"diff\",\n	\"show\",\n	\"blame\",\n	\"grep\",\n	\"shortlog\",\n	\"range-diff\",\n	\"describe\",\n	\"branch\",\n	\"remote\",\n	\"fetch\",\n	\"ls-files\",\n	\"ls-tree\",\n	\"ls-remote\",\n	\"show-ref\",\n	\"for-each-ref\",\n	\"rev-parse\",\n	\"rev-list\",\n	\"cat-file\",\n	\"diff-tree\",\n	\"name-rev\",\n	\"merge-base\",\n	\"check-ignore\"\n]);\n/** Git subcommands that modify the working tree, index, or history. */\nconst GIT_WRITE_OPS = new Set([\n	\"push\",\n	\"add\",\n	\"commit\",\n	\"reset\",\n	\"merge\",\n	\"rebase\",\n	\"cherry-pick\",\n	\"checkout\",\n	\"switch\",\n	\"stash\",\n	\"tag\",\n	\"revert\",\n	\"clean\",\n	\"rm\",\n	\"mv\"\n]);\n/** Flags on git that enable arbitrary code execution */\nconst GIT_DANGEROUS_FLAGS = new Set([\n	\"-c\",\n	\"--exec-path\",\n	\"--pager\",\n	\"--upload-pack\",\n	\"--receive-pack\"\n]);\n/** Git global flags that consume the next token as an argument. */\nconst GIT_FLAGS_WITH_ARG = new Set([\n	\"-C\",\n	\"-c\",\n	\"--git-dir\",\n	\"--work-tree\"\n]);\n/** Extract the git subcommand (first non-flag token after \"git\"), skipping flag arguments. */\nfunction getGitSubcommand(tokens) {\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return t;\n	}\n}\nfunction isGitReadOp(tokens) {\n	for (const t of tokens.slice(1)) {\n		if (GIT_DANGEROUS_FLAGS.has(t) || t === \"-o\" || t.startsWith(\"--output\")) return false;\n		if (t.startsWith(\"--exec-path=\") || t.startsWith(\"--pager=\") || t.startsWith(\"--upload-pack=\") || t.startsWith(\"--receive-pack=\") || t.startsWith(\"-o=\") || t.startsWith(\"--output=\")) return false;\n	}\n	const sub = getGitSubcommand(tokens);\n	if (!sub) return false;\n	if (sub === \"stash\") {\n		const stashAction = tokens[tokens.indexOf(\"stash\") + 1];\n		return stashAction === \"list\" || stashAction === void 0;\n	}\n	return GIT_READ_OPS.has(sub);\n}\nfunction isGitWriteOp(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (!sub) return false;\n	if (sub === \"stash\") {\n		const stashAction = tokens[tokens.indexOf(\"stash\") + 1];\n		if (stashAction === \"list\" || stashAction === void 0) return false;\n	}\n	return GIT_WRITE_OPS.has(sub);\n}\n/** Safe stash actions that don't risk data loss. */\nconst STASH_SAFE_ACTIONS = new Set([\n	\"push\",\n	\"pop\",\n	\"apply\",\n	\"show\"\n]);\n/**\n* Git write operations that are safe to auto-approve:\n* - `git add` — staging is trivially reversible\n* - `git checkout -b/-B` — branch creation\n* - `git switch -c/-C` — branch creation\n* - `git switch <branch>` — branch switching (switch only handles branches, unlike checkout)\n* - `git stash` / `git stash push|pop|apply|show` — reversible stash operations\n*/\nfunction isGitSafeWriteOp(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (!sub) return false;\n	if (sub === \"add\") return true;\n	if (sub === \"checkout\") return tokens.slice(tokens.indexOf(\"checkout\") + 1).some((t) => t === \"-b\" || t === \"-B\");\n	if (sub === \"switch\") return true;\n	if (sub === \"stash\") {\n		const stashAction = tokens[tokens.indexOf(\"stash\") + 1];\n		if (stashAction === void 0) return true;\n		return STASH_SAFE_ACTIONS.has(stashAction);\n	}\n	return false;\n}\n/** pnpm built-in subcommands (not user-defined scripts) */\nconst PNPM_BUILTINS = new Set([\n	\"install\",\n	\"i\",\n	\"add\",\n	\"remove\",\n	\"rm\",\n	\"uninstall\",\n	\"un\",\n	\"update\",\n	\"up\",\n	\"upgrade\",\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\",\n	\"audit\",\n	\"licenses\",\n	\"init\",\n	\"create\",\n	\"link\",\n	\"unlink\",\n	\"pack\",\n	\"publish\",\n	\"config\",\n	\"set\",\n	\"get\",\n	\"store\",\n	\"cache\",\n	\"rebuild\",\n	\"rb\",\n	\"prune\",\n	\"dedupe\",\n	\"dlx\",\n	\"exec\",\n	\"run\",\n	\"patch\",\n	\"patch-commit\",\n	\"recursive\",\n	\"-r\"\n]);\n/** Read-only pnpm commands that are always safe */\nconst PNPM_SAFE_BUILTINS = new Set([\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\"\n]);\nfunction isPnpmSafe(tokens) {\n	const subTokens = tokens.slice(1);\n	let subcommand;\n	for (const t of subTokens) {\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		subcommand = t;\n		break;\n	}\n	if (!subcommand) return false;\n	if (PNPM_SAFE_BUILTINS.has(subcommand)) return true;\n	if (subcommand === \"install\" || subcommand === \"i\") return subTokens.slice(subTokens.indexOf(subcommand) + 1).every((t) => t.startsWith(\"-\"));\n	return false;\n}\nconst NPM_READ_OPS = new Set([\n	\"view\",\n	\"info\",\n	\"show\"\n]);\nfunction isNpmReadOp(tokens) {\n	const sub = tokens[1];\n	return sub !== void 0 && NPM_READ_OPS.has(sub);\n}\n/** Map npm subcommand to a pnpm redirect message */\nfunction getNpmRedirectReason(tokens) {\n	const sub = tokens[1];\n	const BASE = \"This project uses pnpm.\";\n	if (!sub) return `${BASE} Use \\`pnpm\\` instead of npm.`;\n	if (sub === \"install\" || sub === \"i\" || sub === \"ci\") {\n		if (tokens.slice(2).some((t) => !t.startsWith(\"-\"))) return `${BASE} Use \\`pnpm add <pkg>\\` instead of \\`npm install <pkg>\\`.`;\n		return `${BASE} Use \\`pnpm install\\` instead of npm.`;\n	}\n	if (sub === \"add\") return `${BASE} Use \\`pnpm add <pkg>\\` instead of npm.`;\n	if (sub === \"uninstall\" || sub === \"remove\" || sub === \"rm\" || sub === \"un\" || sub === \"r\") return `${BASE} Use \\`pnpm remove <pkg>\\` instead of npm.`;\n	if (sub === \"run\" || sub === \"run-script\") return `${BASE} Use \\`pnpm run <script>\\` or \\`pnpm <script>\\` instead of npm.`;\n	if (sub === \"test\" || sub === \"t\" || sub === \"tst\") return `${BASE} Use \\`pnpm test\\` instead of npm.`;\n	if (sub === \"start\") return `${BASE} Use \\`pnpm start\\` instead of npm.`;\n	if (sub === \"stop\") return `${BASE} Use \\`pnpm stop\\` instead of npm.`;\n	if (sub === \"restart\") return `${BASE} Use \\`pnpm restart\\` instead of npm.`;\n	if (sub === \"exec\") return `${BASE} Use \\`pnpm exec <cmd>\\` instead of npm.`;\n	if (sub === \"list\" || sub === \"ls\" || sub === \"ll\" || sub === \"la\") return `${BASE} Use \\`pnpm list\\` instead of npm.`;\n	if (sub === \"why\") return `${BASE} Use \\`pnpm why\\` instead of npm.`;\n	if (sub === \"outdated\") return `${BASE} Use \\`pnpm outdated\\` instead of npm.`;\n	if (sub === \"audit\") return `${BASE} Use \\`pnpm audit\\` instead of npm.`;\n	if (sub === \"update\" || sub === \"up\" || sub === \"upgrade\") return `${BASE} Use \\`pnpm update\\` instead of npm.`;\n	if (sub === \"init\") return `${BASE} Use \\`pnpm init\\` instead of npm.`;\n	if (sub === \"publish\") return `${BASE} Use \\`pnpm publish\\` instead of npm.`;\n	if (sub === \"link\") return `${BASE} Use \\`pnpm link\\` instead of npm.`;\n	if (sub === \"unlink\") return `${BASE} Use \\`pnpm unlink\\` instead of npm.`;\n	if (sub === \"pack\") return `${BASE} Use \\`pnpm pack\\` instead of npm.`;\n	if (sub === \"cache\") return `${BASE} Use \\`pnpm store\\` instead of \\`npm cache\\`.`;\n	if (sub === \"config\" || sub === \"set\" || sub === \"get\") return `${BASE} Use \\`pnpm config\\` instead of npm.`;\n	return `${BASE} Use the equivalent pnpm command instead of npm.`;\n}\nfunction arePathArgsSafe(tokens, ctx) {\n	for (const t of tokens.slice(1)) {\n		if (t.startsWith(\"-\")) {\n			if (t === \"-t\" || t.startsWith(\"--target-directory\")) return false;\n			continue;\n		}\n		if (path.basename(t).startsWith(\".\")) return false;\n		if (t.startsWith(\"~/\") || t === \"~\") return false;\n		const resolvedPath = path.resolve(ctx.cwd, t);\n		if (resolvedPath !== ctx.cwd && !resolvedPath.startsWith(ctx.cwd + path.sep)) return false;\n	}\n	return true;\n}\nconst FIND_ALWAYS_DANGEROUS = new Set([\n	\"-ok\",\n	\"-okdir\",\n	\"-delete\",\n	\"-fprint\",\n	\"-fprint0\",\n	\"-fprintf\",\n	\"-fls\"\n]);\nconst FIND_EXEC_SAFE_COMMANDS = new Set([\n	\"cat\",\n	\"head\",\n	\"tail\",\n	\"grep\",\n	\"egrep\",\n	\"fgrep\",\n	\"ls\",\n	\"wc\",\n	\"file\",\n	\"stat\",\n	\"basename\",\n	\"dirname\",\n	\"realpath\",\n	\"readlink\",\n	\"sha256sum\",\n	\"sha1sum\",\n	\"md5sum\",\n	\"echo\"\n]);\n/**\n* Extracts the command name from a `-exec` or `-execdir` block.\n* Returns the basename of the first token after `-exec`/`-execdir`,\n* or undefined if the block is malformed.\n*/\nfunction findExecCommand(tokens, startIdx) {\n	const cmdToken = tokens[startIdx + 1];\n	if (!cmdToken || cmdToken === \"{}\" || cmdToken === \";\" || cmdToken === \"+\") return void 0;\n	return path.basename(cmdToken);\n}\nfunction isFindSafe(tokens) {\n	for (let i = 0; i < tokens.length; i++) {\n		const t = tokens[i];\n		if (t === void 0) continue;\n		if (FIND_ALWAYS_DANGEROUS.has(t)) return false;\n		if (t === \"-exec\" || t === \"-execdir\") {\n			const cmd = findExecCommand(tokens, i);\n			if (!cmd || !FIND_EXEC_SAFE_COMMANDS.has(cmd)) return false;\n		}\n	}\n	return true;\n}\nfunction isSortSafe(tokens) {\n	return !tokens.includes(\"-o\") && !tokens.some((t) => t.startsWith(\"--output\"));\n}\nfunction isRmRecursive(tokens) {\n	const rmIdx = tokens.findIndex((t) => path.basename(t) === \"rm\");\n	if (rmIdx === -1) return false;\n	const afterRm = tokens.slice(rmIdx + 1);\n	const shortFlags = afterRm.filter((t) => t.startsWith(\"-\") && !t.startsWith(\"--\"));\n	const longFlags = afterRm.filter((t) => t.startsWith(\"--\"));\n	const hasRecursiveShort = shortFlags.some((f) => /[rR]/.test(f));\n	const hasRecursiveLong = longFlags.includes(\"--recursive\");\n	return hasRecursiveShort || hasRecursiveLong;\n}\nfunction isChmod777(tokens) {\n	return tokens.some((t) => t === \"777\" || t === \"0777\");\n}\nfunction isGitForcePush(tokens) {\n	const pushIdx = tokens.indexOf(\"push\");\n	if (pushIdx === -1) return false;\n	const afterPush = tokens.slice(pushIdx + 1);\n	return afterPush.some((t) => t === \"--force\" || t === \"-f\" && !afterPush.includes(\"--force-with-lease\"));\n}\nfunction isGitResetHardOnMain(tokens) {\n	if (!(tokens.includes(\"reset\") && tokens.includes(\"--hard\"))) return false;\n	if (tokens.some((t) => t === \"main\" || t === \"master\")) return true;\n	const positionalArgs = tokens.filter((t) => t !== \"git\" && t !== \"reset\" && !t.startsWith(\"-\"));\n	return positionalArgs.length === 0 || positionalArgs.includes(\"HEAD\");\n}\n/** bst subcommands that are safe to auto-approve (read-only or local-only). */\nconst BST_SAFE_SUBCOMMANDS = new Set([\n	\"checks:run\",\n	\"hooks:audit\",\n	\"docker:build\",\n	\"docker:check\",\n	\"repo:sync\"\n]);\nfunction isBstSafe(tokens) {\n	const sub = tokens[1];\n	if (!sub) return false;\n	return BST_SAFE_SUBCOMMANDS.has(sub);\n}\nconst denyRules = [\n	{\n		name: \"rm-recursive\",\n		match: /^rm$/,\n		action: \"deny\",\n		when: (tokens) => isRmRecursive(tokens),\n		reason: \"Don't use recursive `rm`. Use more targeted deletes, or remove specific files/directories.\"\n	},\n	{\n		name: \"sudo\",\n		match: /^sudo$/,\n		action: \"deny\",\n		reason: \"Don't use sudo. If you need elevated permissions, ask me to do it manually.\"\n	},\n	{\n		name: \"git-force-push\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitForcePush(tokens),\n		reason: \"Use `git push --force-with-lease` instead of `--force`.\"\n	},\n	{\n		name: \"git-reset-hard\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitResetHardOnMain(tokens),\n		reason: \"Don't `reset --hard` on main. Create a branch first.\"\n	},\n	{\n		name: \"git-write\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitWriteOp(tokens) && !isGitSafeWriteOp(tokens),\n		reason: \"Git write operations (push, commit, reset, merge, etc.) are not allowed. Ask the user to run these manually.\"\n	},\n	{\n		name: \"chmod-777\",\n		match: /^chmod$/,\n		action: \"deny\",\n		when: (tokens) => isChmod777(tokens),\n		reason: \"Don't use 777 permissions. Use more restrictive permissions.\"\n	},\n	{\n		name: \"env-file-read\",\n		match: /^(cat|head|tail|less|more|grep)$/,\n		action: \"deny\",\n		when: (tokens) => tokensTargetEnvFile(tokens),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"npx-redirect\",\n		match: /^npx$/,\n		action: \"deny\",\n		reason: \"This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\"\n	}\n];\nconst allowRules = [\n	{\n		name: \"vitest\",\n		match: /^vitest$/,\n		action: \"allow\"\n	},\n	{\n		name: \"jest\",\n		match: /^jest$/,\n		action: \"allow\"\n	},\n	{\n		name: \"tsc\",\n		match: /^tsc$/,\n		action: \"allow\"\n	},\n	{\n		name: \"tsdown\",\n		match: /^tsdown$/,\n		action: \"allow\"\n	},\n	{\n		name: \"bst\",\n		match: /^bst$/,\n		action: \"allow\",\n		when: (tokens) => isBstSafe(tokens)\n	},\n	{\n		name: \"oxlint\",\n		match: /^oxlint$/,\n		action: \"allow\"\n	},\n	{\n		name: \"oxfmt\",\n		match: /^oxfmt$/,\n		action: \"allow\"\n	},\n	{\n		name: \"eslint\",\n		match: /^eslint$/,\n		action: \"allow\"\n	},\n	{\n		name: \"prettier\",\n		match: /^prettier$/,\n		action: \"allow\"\n	},\n	{\n		name: \"biome\",\n		match: /^biome$/,\n		action: \"allow\"\n	},\n	{\n		name: \"knip\",\n		match: /^knip$/,\n		action: \"allow\"\n	},\n	{\n		name: \"cat\",\n		match: /^cat$/,\n		action: \"allow\"\n	},\n	{\n		name: \"head\",\n		match: /^head$/,\n		action: \"allow\"\n	},\n	{\n		name: \"tail\",\n		match: /^tail$/,\n		action: \"allow\"\n	},\n	{\n		name: \"grep\",\n		match: /^grep$/,\n		action: \"allow\"\n	},\n	{\n		name: \"ls\",\n		match: /^ls$/,\n		action: \"allow\"\n	},\n	{\n		name: \"wc\",\n		match: /^wc$/,\n		action: \"allow\"\n	},\n	{\n		name: \"uniq\",\n		match: /^uniq$/,\n		action: \"allow\"\n	},\n	{\n		name: \"diff\",\n		match: /^diff$/,\n		action: \"allow\"\n	},\n	{\n		name: \"echo\",\n		match: /^echo$/,\n		action: \"allow\"\n	},\n	{\n		name: \"pwd\",\n		match: /^pwd$/,\n		action: \"allow\"\n	},\n	{\n		name: \"which\",\n		match: /^which$/,\n		action: \"allow\"\n	},\n	{\n		name: \"dirname\",\n		match: /^dirname$/,\n		action: \"allow\"\n	},\n	{\n		name: \"basename\",\n		match: /^basename$/,\n		action: \"allow\"\n	},\n	{\n		name: \"realpath\",\n		match: /^realpath$/,\n		action: \"allow\"\n	},\n	{\n		name: \"npm\",\n		match: /^npm$/,\n		action: \"allow\",\n		when: (tokens) => isNpmReadOp(tokens)\n	},\n	{\n		name: \"test\",\n		match: /^test$/,\n		action: \"allow\"\n	},\n	{\n		name: \"bracket-test\",\n		match: /^\\[$/,\n		action: \"allow\"\n	},\n	{\n		name: \"cd\",\n		match: /^cd$/,\n		action: \"allow\"\n	},\n	{\n		name: \"true\",\n		match: /^true$/,\n		action: \"allow\"\n	},\n	{\n		name: \"colon\",\n		match: /^:$/,\n		action: \"allow\"\n	},\n	{\n		name: \"find\",\n		match: /^find$/,\n		action: \"allow\",\n		when: (tokens) => isFindSafe(tokens)\n	},\n	{\n		name: \"sort\",\n		match: /^sort$/,\n		action: \"allow\",\n		when: (tokens) => isSortSafe(tokens)\n	},\n	{\n		name: \"git\",\n		match: /^git$/,\n		action: \"allow\",\n		when: (tokens) => isGitReadOp(tokens)\n	},\n	{\n		name: \"git-safe-write\",\n		match: /^git$/,\n		action: \"allow\",\n		when: (tokens) => isGitSafeWriteOp(tokens)\n	},\n	{\n		name: \"pnpm\",\n		match: /^pnpm$/,\n		action: \"allow\",\n		when: (tokens) => isPnpmSafe(tokens)\n	},\n	{\n		name: \"cp\",\n		match: /^cp$/,\n		action: \"allow\",\n		when: (tokens, ctx) => arePathArgsSafe(tokens, ctx)\n	},\n	{\n		name: \"mkdir\",\n		match: /^mkdir$/,\n		action: \"allow\",\n		when: (tokens, ctx) => arePathArgsSafe(tokens, ctx)\n	},\n	{\n		name: \"touch\",\n		match: /^touch$/,\n		action: \"allow\",\n		when: (tokens, ctx) => arePathArgsSafe(tokens, ctx)\n	}\n];\n\n//#endregion\n//#region src/lib/settings.ts\nconst SETTINGS_PATH = \".claude/hooks/bst-hook.settings.json\";\nconst BstHookSettingsSchema = object({ allow: array(string()) });\n/**\n* Check whether a file at `relativePath` inside `cwd` is tracked and\n* unmodified in git (no staged or unstaged changes vs HEAD).\n*\n* Returns false on any error — safe default is to not trust the file.\n*/\nfunction isFileClean(cwd, relativePath) {\n	try {\n		execFileSync(\"git\", [\n			\"ls-files\",\n			\"--error-unmatch\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\"\n		});\n		execFileSync(\"git\", [\n			\"diff\",\n			\"--quiet\",\n			\"HEAD\",\n			\"--\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\"\n		});\n		return true;\n	} catch {\n		return false;\n	}\n}\n/**\n* Load repo-level allow patterns from `.claude/hooks/bst-hook.settings.json`.\n*\n* Walks up from `cwd` to find the workspace root (or uses `cwd` directly),\n* reads the settings file, validates it, and checks that the file is\n* git-tracked and unmodified before trusting it.\n*\n* Returns an empty array if the file is missing, invalid, or untrusted.\n*/\nfunction loadRepoSettings(cwd) {\n	const root = findWorkspaceRoot(cwd) ?? cwd;\n	const settingsFile = join(root, SETTINGS_PATH);\n	if (!existsSync(settingsFile)) return [];\n	if (!isFileClean(root, SETTINGS_PATH)) return [];\n	try {\n		const raw = readFileSync(settingsFile, \"utf-8\");\n		const parsed = JSON.parse(raw);\n		const result = BstHookSettingsSchema.safeParse(parsed);\n		if (!result.success) return [];\n		return result.data.allow.filter((s) => typeof s === \"string\" && s.length > 0);\n	} catch {\n		return [];\n	}\n}\n/**\n* Check whether a command matches a repo-level allow pattern.\n*\n* Pattern format: `\"<command> [arg1] [arg2] ...\"`\n* - First token is matched exactly against the command basename\n* - Remaining tokens (if any) must match positionally as prefixes of the actual arguments\n*\n* Examples:\n* - `\"tooling\"` matches `tooling repo:sync --yes`\n* - `\"node packages/foo/dist/bin.mjs\"` matches `node packages/foo/dist/bin.mjs run`\n* - `\"node packages/foo/dist/bin.mjs\"` does NOT match `node packages/bar/dist/bin.mjs`\n*/\nfunction matchesRepoPattern(cmdName, tokens, pattern) {\n	const parts = pattern.split(/\\s+/).filter(Boolean);\n	if (parts.length === 0) return false;\n	if (parts[0] !== cmdName) return false;\n	const patternArgs = parts.slice(1);\n	const actualArgs = tokens.slice(1);\n	for (let i = 0; i < patternArgs.length; i++) {\n		if (i >= actualArgs.length) return false;\n		if (actualArgs[i] !== patternArgs[i]) return false;\n	}\n	return true;\n}\n\n//#endregion\n//#region src/lib/script-resolver.ts\nconst PackageJsonSchema = object({ scripts: record(string(), unknown()) });\n/**\n* Resolve a pnpm script name to its actual command(s) by reading package.json.\n*\n* Returns null if the script cannot be resolved (missing package.json,\n* missing script name, parse error).\n*/\nfunction resolveScript(scriptName, cwd) {\n	const scripts = readScripts(cwd);\n	if (!scripts) return null;\n	const main = scripts[scriptName];\n	if (typeof main !== \"string\") return null;\n	const pre = scripts[`pre${scriptName}`];\n	const post = scripts[`post${scriptName}`];\n	return {\n		pre: typeof pre === \"string\" ? pre : null,\n		main,\n		post: typeof post === \"string\" ? post : null\n	};\n}\n/**\n* Resolve a script in a specific workspace package identified by --filter.\n*\n* Reads pnpm-workspace.yaml, scans workspace directories to match filterPkg\n* against package.json#name fields, then resolves the script in that package's directory.\n*\n* Returns null if the package or script cannot be resolved.\n*/\nfunction resolveFilteredScript(scriptName, filterPkg, cwd) {\n	const pkgDir = findWorkspacePackageDir(filterPkg, cwd);\n	if (!pkgDir) return null;\n	const script = resolveScript(scriptName, pkgDir);\n	if (!script) return null;\n	return {\n		...script,\n		pkgDir\n	};\n}\n/**\n* Resolve a script name across all workspace packages (for `pnpm -r <script>`).\n*\n* Returns an array of resolved scripts (one per workspace package that defines the script),\n* each with a `pkgDir` field. Returns null if workspace patterns can't be read.\n* Packages that don't define the script are silently skipped.\n*/\nfunction resolveRecursiveScripts(scriptName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	const results = [];\n	for (const pkgDir of pkgDirs) {\n		const resolved = resolveScript(scriptName, pkgDir);\n		if (resolved) results.push({\n			...resolved,\n			pkgDir\n		});\n	}\n	return results;\n}\n/**\n* Find the pnpm workspace root by walking up from `cwd` until a\n* `pnpm-workspace.yaml` file is found. Returns `null` if none is found\n* before reaching the filesystem root.\n*/\nfunction findWorkspaceRoot(cwd) {\n	let dir = resolve(cwd);\n	while (true) {\n		if (existsSync(join(dir, \"pnpm-workspace.yaml\"))) return dir;\n		const parent = dirname(dir);\n		if (parent === dir) return null;\n		dir = parent;\n	}\n}\n/**\n* List all workspace package directories.\n*/\nfunction listWorkspacePackageDirs(rootDir) {\n	const patterns = readWorkspacePatterns(rootDir);\n	if (!patterns) return null;\n	const dirs = [];\n	for (const pattern of patterns) {\n		if (!pattern.endsWith(\"/*\")) continue;\n		const parentDir = resolve(rootDir, pattern.slice(0, -2));\n		let entries;\n		try {\n			entries = readdirSync(parentDir);\n		} catch {\n			continue;\n		}\n		for (const entry of entries) {\n			const entryDir = join(parentDir, entry);\n			try {\n				if (!statSync(entryDir).isDirectory()) continue;\n			} catch {\n				continue;\n			}\n			dirs.push(entryDir);\n		}\n	}\n	return dirs.length > 0 ? dirs : null;\n}\n/**\n* Find the directory of a workspace package by name.\n* Reads pnpm-workspace.yaml for glob patterns, then scans matching directories.\n*/\nfunction findWorkspacePackageDir(pkgName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	for (const entryDir of pkgDirs) {\n		const name = readPackageName(entryDir);\n		if (name === pkgName || name === `@${pkgName}`) return entryDir;\n		if (entryDir.split(\"/\").pop() === pkgName) return entryDir;\n		if (name) {\n			if ((name.startsWith(\"@\") ? name.split(\"/\")[1] : name) === pkgName) return entryDir;\n		}\n	}\n	return null;\n}\n/**\n* Read workspace glob patterns from pnpm-workspace.yaml.\n*/\nfunction readWorkspacePatterns(rootDir) {\n	try {\n		const lines = readFileSync(join(rootDir, \"pnpm-workspace.yaml\"), \"utf-8\").split(\"\\n\");\n		const packagesIdx = lines.findIndex((l) => /^packages\\s*:/.test(l));\n		if (packagesIdx === -1) return null;\n		const patterns = [];\n		for (let i = packagesIdx + 1; i < lines.length; i++) {\n			const line = lines[i];\n			const match = /^\\s+-\\s+(.+)$/.exec(line);\n			if (!match) break;\n			patterns.push(match[1].trim().replace(/['\"`]/g, \"\"));\n		}\n		return patterns.length > 0 ? patterns : null;\n	} catch {\n		return null;\n	}\n}\nconst PackageNameSchema = object({ name: string() });\n/**\n* Read the name field from package.json in the given directory.\n*/\nfunction readPackageName(dir) {\n	try {\n		const raw = readFileSync(join(dir, \"package.json\"), \"utf-8\");\n		const result = PackageNameSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.name;\n	} catch {\n		return null;\n	}\n}\n/**\n* Read the scripts field from package.json in the given directory.\n* Returns null on any failure (missing file, parse error, no scripts field).\n*/\nfunction readScripts(cwd) {\n	try {\n		const raw = readFileSync(join(cwd, \"package.json\"), \"utf-8\");\n		const result = PackageJsonSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.scripts;\n	} catch {\n		return null;\n	}\n}\n/**\n* Check whether the package.json in the given directory is clean in git\n* (no staged or unstaged changes compared to HEAD).\n*\n* Returns true only when the file is tracked and unmodified. Returns false\n* on any error (not a git repo, untracked file, no HEAD, etc.) — safe default\n* is to not trust the scripts.\n*/\nfunction isPackageJsonClean(pkgDir) {\n	return isFileClean(pkgDir, \"package.json\");\n}\n\n//#endregion\n//#region src/evaluate.ts\nconst MAX_EVAL_DEPTH = 5;\n/** Environment variables that enable code injection */\nconst DANGEROUS_ENV_VARS = new Set([\n	\"LD_PRELOAD\",\n	\"LD_LIBRARY_PATH\",\n	\"DYLD_INSERT_LIBRARIES\",\n	\"NODE_OPTIONS\",\n	\"PYTHONPATH\",\n	\"PYTHONSTARTUP\",\n	\"PERL5OPT\",\n	\"PERL5LIB\",\n	\"RUBYOPT\",\n	\"RUBYLIB\",\n	\"BASH_ENV\",\n	\"ENV\",\n	\"npm_config_prefix\",\n	\"npm_config_registry\",\n	\"EDITOR\",\n	\"VISUAL\"\n]);\n/** Git config env vars use prefix matching */\nconst DANGEROUS_GIT_ENV_PREFIXES = [\n	\"GIT_CONFIG_\",\n	\"GIT_PAGER\",\n	\"GIT_SSH_COMMAND\",\n	\"GIT_EDITOR\",\n	\"GIT_EXEC_PATH\"\n];\nfunction isDangerousEnvVar(name) {\n	if (DANGEROUS_ENV_VARS.has(name)) return true;\n	return DANGEROUS_GIT_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));\n}\n/**\n* Extract the target directory from a `cd <dir>` segment.\n* Returns the resolved absolute path, or null if the segment isn't a simple `cd`.\n*/\nfunction extractCdDir(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok || tokenResult.tokens.length !== 2) return null;\n	const tokens = tokenResult.tokens;\n	if (tokens[0] !== \"cd\") return null;\n	const dir = tokens[1];\n	if (path.isAbsolute(dir)) return dir;\n	return path.resolve(ctx.cwd, dir);\n}\n/**\n* Evaluate a full command string. Splits on operators and evaluates each segment.\n*\n* This is the single reentrant entry point. Called at depth 0 for top-level\n* commands and at depth 1+ for derived commands (resolved scripts, exec tails, etc.).\n*/\nfunction evaluateCommand(command, ctx) {\n	if (ctx.depth >= MAX_EVAL_DEPTH) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"max evaluation depth exceeded\"\n	};\n	const trimmed = command.trim();\n	if (!trimmed) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const segments = splitCommand(trimmed);\n	if (segments.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	let firstPassthrough = null;\n	let lastAllow = null;\n	const currentCtx = { ...ctx };\n	for (const segment of segments) {\n		if (segment.operator === \"&&\") {\n			const cdDir = extractCdDir(segment.command, currentCtx);\n			if (cdDir) currentCtx.cwd = cdDir;\n		}\n		const result = evaluateSegment(segment.command, currentCtx);\n		if (result.action === \"deny\") return result;\n		if (result.action === \"passthrough\") {\n			if (!firstPassthrough) firstPassthrough = result;\n		}\n		if (result.action === \"allow\") lastAllow = result;\n	}\n	if (firstPassthrough) return firstPassthrough;\n	if (segments.length === 1 && lastAllow) return lastAllow;\n	return {\n		action: \"allow\",\n		rule: \"all-segments\",\n		reason: null\n	};\n}\n/**\n* Helper to evaluate a resolved script with its pre and post hooks.\n*\n* When the source package.json is clean in git, sets `insideResolvedScript`\n* on the context so downstream evaluation trusts file redirects and\n* unmatched commands (user-authored scripts). Deny rules still apply.\n*/\nfunction evaluateResolvedScript(resolved, ctx) {\n	const pkgDir = resolved.pkgDir ?? ctx.cwd;\n	const innerCtx = ctx.insideResolvedScript ?? isPackageJsonClean(pkgDir) ? {\n		...ctx,\n		insideResolvedScript: true\n	} : ctx;\n	if (resolved.pre) {\n		const preResult = evaluateCommand(resolved.pre, innerCtx);\n		if (preResult.action !== \"allow\") return preResult;\n	}\n	const mainResult = evaluateCommand(resolved.main, innerCtx);\n	if (mainResult.action !== \"allow\") return mainResult;\n	if (resolved.post) {\n		const postResult = evaluateCommand(resolved.post, innerCtx);\n		if (postResult.action !== \"allow\") return postResult;\n	}\n	return \"allow\";\n}\n/**\n* Evaluate a single command segment (no operators).\n* May recurse into evaluateCommand() for indirection constructs.\n*/\nfunction evaluateSegment(rawSegment, ctx) {\n	const trimmed = rawSegment.trim();\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const tokenResult = tokenize(rawSegment);\n	if (!tokenResult.ok) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: tokenResult.error\n	};\n	let tokens = tokenResult.tokens;\n	if (tokens.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) {\n		const varName = tokens[envSkipped].split(\"=\")[0];\n		if (isDangerousEnvVar(varName)) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: `dangerous env var: ${varName}`\n		};\n		envSkipped++;\n	}\n	if (envSkipped >= tokens.length) return {\n		action: \"allow\",\n		rule: \"env-only\",\n		reason: null\n	};\n	tokens = tokens.slice(envSkipped);\n	const injection = checkInjection(tokens, rawSegment, ctx.insideResolvedScript);\n	if (!injection.safe) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: injection.reason\n	};\n	if (!ctx.insideResolvedScript) for (let i = 0; i < tokens.length; i++) {\n		const token = tokens[i];\n		if (token === \"2>&1\" || token === \"2>/dev/null\" || token === \">/dev/null\" || token === \"1>/dev/null\") continue;\n		if (token === \">\" || token === \">>\") {\n			if (tokens[i + 1] === \"/dev/null\") continue;\n			return {\n				action: \"passthrough\",\n				rule: null,\n				reason: \"output redirect to file\"\n			};\n		}\n		if (token === \"<\") return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"input redirect\"\n		};\n	}\n	const SAFE_REDIRECT_TOKENS = new Set([\n		\"2>&1\",\n		\"2>/dev/null\",\n		\">/dev/null\",\n		\"1>/dev/null\"\n	]);\n	tokens = tokens.filter((t, i) => {\n		if (SAFE_REDIRECT_TOKENS.has(t)) return false;\n		if ((t === \">\" || t === \">>\") && tokens[i + 1] === \"/dev/null\") return false;\n		if (t === \"/dev/null\" && i > 0 && (tokens[i - 1] === \">\" || tokens[i - 1] === \">>\")) return false;\n		return true;\n	});\n	const cmdName = path.basename(tokens[0]);\n	if (cmdName === \"command\" && tokens.length > 1) return evaluateCommand(joinTokens(tokens.slice(1)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (cmdName === \"env\") {\n		let envIdx = 1;\n		while (envIdx < tokens.length && /^\\w+=/.test(tokens[envIdx])) {\n			const varName = tokens[envIdx].split(\"=\")[0];\n			if (isDangerousEnvVar(varName)) return {\n				action: \"passthrough\",\n				rule: null,\n				reason: `dangerous env var: ${varName}`\n			};\n			envIdx++;\n		}\n		if (envIdx >= tokens.length) return {\n			action: \"allow\",\n			rule: \"env-only\",\n			reason: null\n		};\n		return evaluateCommand(joinTokens(tokens.slice(envIdx)), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"pnpm\") return evaluatePnpm(tokens, ctx);\n	if (cmdName === \"npm\") return evaluateNpm(tokens);\n	if (cmdName === \"bash\" || cmdName === \"sh\" || cmdName === \"zsh\") return evaluateShellC(tokens, ctx);\n	if (cmdName === \"xargs\") return evaluateXargs(tokens, ctx);\n	if (cmdName === \"node\" && (tokens.includes(\"-e\") || tokens.includes(\"-p\") || tokens.includes(\"--eval\") || tokens.includes(\"--print\"))) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"node eval\"\n	};\n	if (cmdName === \"mv\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"mv\"\n	};\n	for (const rule of denyRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"deny\",\n			rule: rule.name,\n			reason: rule.reason ?? null\n		};\n	}\n	for (const rule of allowRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"allow\",\n			rule: rule.name,\n			reason: null\n		};\n	}\n	if (ctx.repoAllowPatterns) {\n		for (const pattern of ctx.repoAllowPatterns) if (matchesRepoPattern(cmdName, tokens, pattern)) return {\n			action: \"allow\",\n			rule: `repo:${cmdName}`,\n			reason: null\n		};\n	}\n	if (ctx.insideResolvedScript) return {\n		action: \"allow\",\n		rule: \"resolved-script\",\n		reason: null\n	};\n	return {\n		action: \"passthrough\",\n		rule: null,\n		reason: `no rule matched: ${cmdName}`\n	};\n}\n/**\n* Scan pnpm subTokens starting at `from`, skipping and accumulating flags\n* (--filter, -r, -w, -C, and generic --flags). Returns the first non-flag\n* token as `name`, or `undefined` if none found. Returns `\"filter\"` as a\n* sentinel when --filter is encountered (caller must handle).\n*/\nfunction scanPnpmFlags(subTokens, from, state) {\n	for (let i = from; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t.startsWith(\"--filter=\")) return {\n			name: void 0,\n			filterIdx: i\n		};\n		if (t === \"-r\" || t === \"--recursive\") {\n			state.isRecursive = true;\n			continue;\n		}\n		if (t === \"-w\" || t === \"--workspace-root\") {\n			state.isWorkspaceRoot = true;\n			continue;\n		}\n		if (t === \"-C\" || t === \"--dir\") {\n			state.dirOverride = subTokens[++i];\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			state.dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		return { name: t };\n	}\n	return { name: void 0 };\n}\n/**\n* Evaluate a pnpm command. Classifies the subcommand as built-in, exec, or script.\n* Script commands are resolved via package.json and recursively evaluated.\n*/\nfunction evaluatePnpm(tokens, ctx) {\n	const subTokens = tokens.slice(1);\n	const state = {\n		isRecursive: false,\n		isWorkspaceRoot: false,\n		dirOverride: void 0\n	};\n	const scan = scanPnpmFlags(subTokens, 0, state);\n	if (scan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, scan.filterIdx, ctx);\n	const subcommand = scan.name;\n	const subcommandIdx = subcommand ? subTokens.indexOf(subcommand) : -1;\n	if (!subcommand) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	if (subcommand === \"dlx\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (subcommand === \"add\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (subcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcommandIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName;\n	let { isRecursive, isWorkspaceRoot, dirOverride } = state;\n	if (subcommand === \"run\") {\n		const runScan = scanPnpmFlags(subTokens, subcommandIdx + 1, state);\n		({isRecursive, isWorkspaceRoot, dirOverride} = state);\n		if (runScan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, runScan.filterIdx, ctx);\n		if (!runScan.name) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"pnpm run without script name\"\n		};\n		scriptName = runScan.name;\n	} else if (!PNPM_BUILTINS.has(subcommand)) scriptName = subcommand;\n	else {\n		for (const rule of allowRules) if (rule.match.test(\"pnpm\")) {\n			if (!rule.when || rule.when(tokens, ctx)) return {\n				action: \"allow\",\n				rule: rule.name,\n				reason: null\n			};\n		}\n		return {\n			action: \"passthrough\",\n			rule: null,\n			reason: null\n		};\n	}\n	if (isRecursive) return evaluatePnpmRecursive(scriptName, ctx);\n	if (isWorkspaceRoot) {\n		const root = findWorkspaceRoot(ctx.cwd);\n		if (!root) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"workspace root not found\"\n		};\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: root\n		});\n	}\n	if (dirOverride) {\n		const resolved = path.resolve(ctx.cwd, dirOverride);\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: resolved\n		});\n	}\n	return evaluatePnpmScript(scriptName, ctx);\n}\n/**\n* Resolve a pnpm script name via package.json and recursively evaluate\n* the resolved command(s) including pre/post scripts.\n*/\nfunction evaluatePnpmScript(scriptName, ctx) {\n	const resolved = resolveScript(scriptName, ctx.cwd);\n	if (!resolved) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"script resolution failed\"\n	};\n	const res = evaluateResolvedScript(resolved, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (res !== \"allow\") return res;\n	return {\n		action: \"allow\",\n		rule: `pnpm-script:${scriptName}`,\n		reason: null\n	};\n}\n/**\n* Evaluate `pnpm -r <script>` by resolving the script in each workspace package.\n*\n* Unlike `evaluatePnpmScript` (which resolves from the root package.json and would\n* cycle back to `pnpm -r <script>`), this resolves against each workspace package's\n* own package.json, breaking the recursion.\n*/\nfunction evaluatePnpmRecursive(scriptName, ctx) {\n	const resolved = resolveRecursiveScripts(scriptName, ctx.cwd);\n	if (!resolved || resolved.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm recursive\"\n	};\n	for (const pkg of resolved) {\n		const res = evaluateResolvedScript(pkg, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: pkg.pkgDir ?? ctx.cwd\n		});\n		if (res !== \"allow\") return res;\n	}\n	return {\n		action: \"allow\",\n		rule: `pnpm-recursive:${scriptName}`,\n		reason: null\n	};\n}\n/**\n* Evaluate an npm command. Read-only ops (view/info/show) are allowed.\n* Everything else is denied with a redirect message to the pnpm equivalent.\n*/\nfunction evaluateNpm(tokens) {\n	for (const rule of allowRules) if (rule.match.test(\"npm\")) {\n		if (!rule.when || rule.when(tokens, {\n			cwd: \"\",\n			depth: 0\n		})) return {\n			action: \"allow\",\n			rule: rule.name,\n			reason: null\n		};\n	}\n	return {\n		action: \"deny\",\n		rule: \"npm-redirect\",\n		reason: getNpmRedirectReason(tokens)\n	};\n}\n/**\n* Evaluate `pnpm --filter <pkg> [--filter <pkg> ...] <subcommand>`.\n*\n* Collects every `--filter` flag (both `--filter <pkg>` and `--filter=<pkg>`\n* forms), resolves each against pnpm-workspace.yaml, then classifies the\n* subcommand as built-in or script. Script commands are resolved and evaluated\n* in each filtered package — all must allow.\n*\n* Falls back to passthrough if workspace resolution fails.\n*/\nfunction evaluatePnpmFilter(_tokens, subTokens, filterIdx, ctx) {\n	const filterPkgs = [];\n	let cursor = filterIdx;\n	while (cursor < subTokens.length) {\n		const t = subTokens[cursor];\n		if (t === \"--filter\") {\n			const pkg = subTokens[cursor + 1];\n			if (!pkg || pkg.startsWith(\"-\")) return {\n				action: \"passthrough\",\n				rule: null,\n				reason: \"pnpm --filter without package\"\n			};\n			filterPkgs.push(pkg);\n			cursor += 2;\n		} else if (t.startsWith(\"--filter=\")) {\n			const pkg = t.slice(9);\n			if (!pkg) return {\n				action: \"passthrough\",\n				rule: null,\n				reason: \"pnpm --filter without package\"\n			};\n			filterPkgs.push(pkg);\n			cursor += 1;\n		} else break;\n	}\n	if (filterPkgs.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	let filterSubcommand;\n	let subcmdIdx = -1;\n	for (let i = cursor; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\") {\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"--filter=\")) continue;\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		filterSubcommand = t;\n		subcmdIdx = i;\n		break;\n	}\n	if (!filterSubcommand) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm --filter without subcommand\"\n	};\n	if (filterSubcommand === \"install\" || filterSubcommand === \"i\") {\n		if (!subTokens.slice(subcmdIdx + 1).every((t) => t.startsWith(\"-\"))) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"pnpm --filter install with package arg\"\n		};\n		return {\n			action: \"allow\",\n			rule: \"pnpm\",\n			reason: null\n		};\n	}\n	if (filterSubcommand === \"dlx\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (filterSubcommand === \"add\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (new Set([\n		\"list\",\n		\"ls\",\n		\"ll\",\n		\"la\",\n		\"why\",\n		\"view\",\n		\"info\",\n		\"show\",\n		\"outdated\",\n		\"licenses\",\n		\"audit\"\n	]).has(filterSubcommand)) return {\n		action: \"allow\",\n		rule: \"pnpm\",\n		reason: null\n	};\n	if (filterSubcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcmdIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	const scriptName = filterSubcommand === \"run\" ? subTokens[subcmdIdx + 1] : filterSubcommand;\n	if (!scriptName || scriptName.startsWith(\"-\")) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm --filter run without script name\"\n	};\n	if (PNPM_BUILTINS.has(scriptName) && scriptName !== \"run\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	for (const pkg of filterPkgs) {\n		const resolved = resolveFilteredScript(scriptName, pkg, ctx.cwd);\n		if (!resolved) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"filtered script resolution failed\"\n		};\n		const res = evaluateResolvedScript(resolved, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: resolved.pkgDir ?? ctx.cwd\n		});\n		if (res !== \"allow\") return res;\n	}\n	return {\n		action: \"allow\",\n		rule: `pnpm-filter:${filterPkgs.join(\",\")}:${scriptName}`,\n		reason: null\n	};\n}\n/** Flags that modify shell behavior beyond simple command execution */\nconst SHELL_UNSAFE_FLAGS = new Set([\n	\"-i\",\n	\"--interactive\",\n	\"-l\",\n	\"--login\",\n	\"--init-file\",\n	\"--rcfile\",\n	\"--norc\",\n	\"--noprofile\",\n	\"-s\",\n	\"--stdin\"\n]);\n/**\n* Evaluate `bash -c` / `sh -c` / `zsh -c` commands.\n*\n* Only unwraps when the tokens are exactly: `<shell> -c <command-string>`.\n* Any additional flags, extra positional args, or missing -c → passthrough.\n*/\nfunction evaluateShellC(tokens, ctx) {\n	const cIdx = tokens.indexOf(\"-c\");\n	if (cIdx === -1) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell without -c\"\n	};\n	for (let i = 1; i < tokens.length; i++) {\n		if (i === cIdx) continue;\n		if (i === cIdx + 1) continue;\n		const t = tokens[i];\n		if (t.startsWith(\"-\") || SHELL_UNSAFE_FLAGS.has(t)) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"shell -c with extra flags\"\n		};\n	}\n	const cmdArg = tokens[cIdx + 1];\n	if (!cmdArg) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell -c without command\"\n	};\n	if (tokens.length > cIdx + 2) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell -c with positional args\"\n	};\n	if (cIdx !== 1) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell -c with extra flags\"\n	};\n	return evaluateCommand(cmdArg, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n/** xargs flags that consume the next token as an argument */\nconst XARGS_ARG_FLAGS = new Set([\n	\"-I\",\n	\"-d\",\n	\"-n\",\n	\"-P\",\n	\"-s\",\n	\"-L\",\n	\"-E\",\n	\"-a\",\n	\"--max-args\",\n	\"--max-procs\",\n	\"--delimiter\",\n	\"--replace\",\n	\"--max-lines\",\n	\"--max-chars\",\n	\"--arg-file\",\n	\"--process-slot-var\"\n]);\n/** xargs flags that are boolean (no argument) */\nconst XARGS_BOOL_FLAGS = new Set([\n	\"-0\",\n	\"--null\",\n	\"-t\",\n	\"--verbose\",\n	\"-r\",\n	\"--no-run-if-empty\",\n	\"-p\",\n	\"--interactive\",\n	\"-x\",\n	\"--exit\",\n	\"--show-limits\"\n]);\n/**\n* Evaluate `xargs <cmd>` commands.\n*\n* Skips xargs flags to find the inner command, then recursively evaluates it.\n* Passthrough if no command follows the flags or if unrecognised flags are found.\n*/\nfunction evaluateXargs(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length) {\n		const t = tokens[i];\n		if (!t.startsWith(\"-\")) break;\n		if (XARGS_ARG_FLAGS.has(t)) {\n			i += 2;\n			continue;\n		}\n		const eqIdx = t.indexOf(\"=\");\n		if (eqIdx !== -1) {\n			const flagName = t.slice(0, eqIdx);\n			if (XARGS_ARG_FLAGS.has(flagName)) {\n				i++;\n				continue;\n			}\n		}\n		if (t.length > 2 && XARGS_ARG_FLAGS.has(t.slice(0, 2))) {\n			i++;\n			continue;\n		}\n		if (XARGS_BOOL_FLAGS.has(t)) {\n			i++;\n			continue;\n		}\n		return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"xargs with unrecognised flags\"\n		};\n	}\n	if (i >= tokens.length) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"xargs without command\"\n	};\n	return evaluateCommand(joinTokens(tokens.slice(i)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n\n//#endregion\n//#region src/file-rules.ts\nconst READ_TOOLS = new Set([\n	\"Read\",\n	\"Glob\",\n	\"Grep\"\n]);\nconst WRITE_TOOLS = new Set([\"Write\", \"Edit\"]);\nconst fileDenyRules = [\n	{\n		name: \"env-file-read\",\n		tools: READ_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"hooks-folder-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = path.resolve(ctx.cwd, filePath);\n			const hooksDir = path.join(ctx.cwd, \".claude\", \"hooks\");\n			return resolved.startsWith(hooksDir + path.sep) || resolved === hooksDir;\n		},\n		reason: \"Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"claude-settings-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			return path.resolve(ctx.cwd, filePath) === path.join(ctx.cwd, \".claude\", \"settings.json\");\n		},\n		reason: \"Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"outside-cwd-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = path.resolve(ctx.cwd, filePath);\n			if (resolved === ctx.cwd || resolved.startsWith(ctx.cwd + path.sep)) return false;\n			const homeClaudeDir = path.join(os.homedir(), \".claude\");\n			if (resolved === homeClaudeDir || resolved.startsWith(homeClaudeDir + path.sep)) return false;\n			return true;\n		},\n		reason: \"Don't write files outside the project directory.\"\n	}\n];\nconst fileAllowRules = [{\n	name: \"cwd-read\",\n	tools: READ_TOOLS,\n	action: \"allow\",\n	when: (filePath, ctx) => {\n		const resolved = path.resolve(ctx.cwd, filePath);\n		return resolved === ctx.cwd || resolved.startsWith(ctx.cwd + path.sep);\n	}\n}, {\n	name: \"cwd-write\",\n	tools: WRITE_TOOLS,\n	action: \"allow\",\n	when: (filePath, ctx) => {\n		const resolved = path.resolve(ctx.cwd, filePath);\n		return resolved === ctx.cwd || resolved.startsWith(ctx.cwd + path.sep);\n	}\n}];\n\n//#endregion\n//#region src/evaluate-tool.ts\n/** Tools whose input contains a `file_path` field. */\nconst FILE_PATH_TOOLS = new Set([\n	\"Read\",\n	\"Write\",\n	\"Edit\"\n]);\n/** Tools whose input contains a `path` field (search root, optional). */\nconst SEARCH_TOOLS = new Set([\"Glob\", \"Grep\"]);\n/**\n* Extract the relevant file path from tool input based on tool name.\n* Returns null if the input shape doesn't match expectations.\n*/\nfunction extractPath(toolName, toolInput, cwd) {\n	if (FILE_PATH_TOOLS.has(toolName)) return parseFilePathInput(toolInput)?.file_path ?? null;\n	if (SEARCH_TOOLS.has(toolName)) return parseSearchInput(toolInput)?.path ?? cwd;\n	return null;\n}\n/**\n* Evaluate a non-Bash tool invocation against file-tool rules.\n* Returns allow, deny, or passthrough.\n*/\nfunction evaluateToolUse(toolName, toolInput, ctx) {\n	const filePath = extractPath(toolName, toolInput, ctx.cwd);\n	if (filePath === null) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"unknown tool input shape\"\n	};\n	for (const rule of fileDenyRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx)) return {\n		action: \"deny\",\n		rule: rule.name,\n		reason: rule.reason ?? null\n	};\n	for (const rule of fileAllowRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx)) return {\n		action: \"allow\",\n		rule: rule.name,\n		reason: null\n	};\n	return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"no file rule matched\"\n	};\n}\n\n//#endregion\n//#region src/index.ts\nconst inputResult = await readHookInput();\nif (!inputResult.ok) {\n	process.stderr.write(`[bst-hook] invalid hook input: ${inputResult.error}\\n`);\n	audit({\n		sessionId: \"unknown\",\n		cwd: \"unknown\",\n		command: `<invalid input: ${inputResult.error}>`,\n		decision: \"passthrough\",\n		rule: null,\n		reason: `validation failed: ${inputResult.error}`\n	});\n	process.exit(0);\n}\nconst input = inputResult.data;\nif (input.hook_event_name !== \"PreToolUse\") process.exit(0);\nif (!new Set([\n	\"Bash\",\n	\"Read\",\n	\"Write\",\n	\"Edit\",\n	\"Glob\",\n	\"Grep\"\n]).has(input.tool_name)) process.exit(0);\nconst repoAllowPatterns = loadRepoSettings(input.cwd);\nlet decision;\nlet auditCommand;\nif (input.tool_name === \"Bash\") {\n	const bashInput = parseBashInput(input.tool_input);\n	if (!bashInput) {\n		audit({\n			sessionId: input.session_id,\n			cwd: input.cwd,\n			toolName: input.tool_name,\n			command: `<invalid Bash input: ${JSON.stringify(input.tool_input).slice(0, 200)}>`,\n			decision: \"passthrough\",\n			rule: null,\n			reason: \"Bash tool_input missing or invalid 'command' field\"\n		});\n		process.exit(0);\n	}\n	decision = evaluateCommand(bashInput.command, {\n		cwd: input.cwd,\n		depth: 0,\n		repoAllowPatterns\n	});\n	auditCommand = bashInput.command;\n} else {\n	const projectDir = findWorkspaceRoot(input.cwd) ?? process.env[\"CLAUDE_PROJECT_DIR\"] ?? input.cwd;\n	decision = evaluateToolUse(input.tool_name, input.tool_input, { cwd: projectDir });\n	const filePath = String(input.tool_input[\"file_path\"] ?? input.tool_input[\"path\"] ?? \"\");\n	auditCommand = `${input.tool_name} ${filePath}`;\n}\naudit({\n	sessionId: input.session_id,\n	cwd: input.cwd,\n	toolName: input.tool_name,\n	command: auditCommand,\n	decision: decision.action,\n	rule: decision.rule,\n	reason: decision.reason\n});\nif (decision.action === \"allow\") writeDecision(\"allow\");\nelse if (decision.action === \"deny\") writeDecision(\"deny\", decision.reason);\n\n//#endregion\nexport {  };", "bst-hook.mjs"), writeIfChanged(ctx, GUIDE_PATH, "# bst-hook Permission Guide\n\nThis project uses a PreToolUse hook (`bst-hook`) that evaluates Bash commands\nand file tool operations before execution. Commands fall into three tiers:\n\n- **Denied** — blocked with a redirect message\n- **Allowed** — auto-approved, no prompt\n- **Passthrough** — falls through to Claude Code's normal permission prompt\n\n## Denied commands\n\nThese are blocked. The hook tells you what to do instead.\n\n### Bash\n\n- **rm-recursive**: Don't use recursive `rm`. Use more targeted deletes, or remove specific files/directories.\n- **sudo**: Don't use sudo. If you need elevated permissions, ask me to do it manually.\n- **git-force-push**: Use `git push --force-with-lease` instead of `--force`.\n- **git-reset-hard**: Don't `reset --hard` on main. Create a branch first.\n- **git-write**: Git write operations (push, commit, reset, merge, etc.) are not allowed. Ask the user to run these manually.\n- **chmod-777**: Don't use 777 permissions. Use more restrictive permissions.\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **npx-redirect**: This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\n\n### File tools (Read, Write, Edit, Glob, Grep)\n\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **hooks-folder-write**: Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\n- **claude-settings-write**: Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\n- **outside-cwd-write**: Don't write files outside the project directory.\n\n## Auto-approved commands\n\nThese run without prompting.\n\n### Bash\n\n- **Test runners**: vitest, jest\n- **Type checking**: tsc\n- **Build tools**: tsdown\n- **Tooling CLI**: bst (checks:run, hooks:audit, docker:build, docker:check, repo:sync)\n- **Linters & formatters**: oxlint, oxfmt, eslint, prettier, biome, knip\n- **Read-only commands**: cat, head, tail, grep, ls, wc, uniq, diff, echo, pwd, which, dirname, basename, realpath\n- **Package managers (read-only)**: npm (view, info, show only)\n- **Shell builtins**: test, bracket-test\n- **Navigation**: cd, true, colon\n- **Conditional commands**: find (without -exec, -delete), sort (without -o / --output)\n- **Git read operations**: git (status, log, diff, show, blame, branch, remote, fetch, rev-parse, etc.)\n- **Git safe writes**: git-safe-write (add, switch -c, checkout -b, stash push/pop/apply/show)\n- **pnpm (safe built-ins)**: pnpm (list, why, view, info, show, outdated, install (bare only))\n- **File operations (within project)**: cp (paths must be within project directory), mkdir (paths must be within project directory), touch (paths must be within project directory)\n\n### File tools\n\n- **Read/Glob/Grep**: Allowed within project directory\n- **Write/Edit**: Allowed within project directory\n\n## Passthrough\n\nEverything not listed above triggers Claude Code's normal permission prompt.\nCommon examples:\n\n- `pnpm add <pkg>`, `pnpm dlx <pkg>` (dependency changes)\n- `mv` (file moves)\n- `node`, `npx` scripts\n- Commands with output redirection (`> file`)\n- Any unrecognized command\n\n## How commands are evaluated\n\n- **Pipelines and chains**: every segment must be allowed; any deny blocks the whole command.\n- **pnpm scripts**: `pnpm <script>` resolves against `package.json` (including pre/post hooks and `--filter` workspaces) and evaluates the resolved command recursively.\n- **cd propagation**: `cd dir && cmd` evaluates `cmd` relative to the new directory.\n- **Audit log**: all decisions are logged to `.claude/hooks/bst-hook.audit.local.jsonl`.\n", "bst-hook-guide.md")];
-}
-//#endregion
-//#region src/generators/claude-settings.ts
-const HookEntrySchema = z.object({
-	type: z.string(),
-	command: z.string()
-});
-const HookMatcherSchema = z.object({
-	matcher: z.string(),
-	hooks: z.array(HookEntrySchema).default([])
-});
-const ClaudeSettingsSchema = z.object({
-	permissions: z.object({
-		allow: z.array(z.string()).default([]),
-		deny: z.array(z.string()).default([])
-	}).default({
-		allow: [],
-		deny: []
-	}),
-	hooks: z.record(z.string(), z.array(HookMatcherSchema)).default({}),
-	instructions: z.array(z.string()).default([]),
-	enabledPlugins: z.record(z.string(), z.boolean()).default({}),
-	extraKnownMarketplaces: z.record(z.string(), z.record(z.string(), z.unknown())).default({})
-});
-function parseClaudeSettings(raw) {
-	try {
-		const json = JSON.parse(raw);
-		const rawResult = z.record(z.string(), z.unknown()).safeParse(json);
-		const settingsResult = ClaudeSettingsSchema.safeParse(json);
-		if (!rawResult.success || !settingsResult.success) return void 0;
-		return {
-			settings: settingsResult.data,
-			rawJson: rawResult.data
-		};
-	} catch {
-		return;
-	}
-}
-function buildSettings(ctx) {
-	const allow = [];
-	const enabledPlugins = { "code-simplifier@claude-plugins-official": true };
-	const extraKnownMarketplaces = {};
-	if (ctx.config.structure === "monorepo") {
-		if (getMonorepoPackages(ctx.targetDir).some((pkg) => hasWebUIDeps(pkg.dir))) enabledPlugins["frontend-design@claude-plugins-official"] = true;
-	} else if (ctx.packageJson ? packageHasWebUIDeps(ctx.packageJson) : false) enabledPlugins["frontend-design@claude-plugins-official"] = true;
-	return {
-		permissions: {
-			allow,
-			deny: []
-		},
-		hooks: { PreToolUse: [{
-			matcher: "Bash|Read|Write|Edit|Glob|Grep",
-			hooks: [{
-				type: "command",
-				command: `node "$(git rev-parse --show-toplevel)/.claude/hooks/bst-hook.mjs"`
-			}]
-		}] },
-		instructions: [
-			"Use pnpm, not npm/yarn/npx. Run binaries with `pnpm exec`.",
-			"No typecasts (as/any). Use zod schemas, type guards, or narrowing instead.",
-			"Fix lint violations instead of suppressing them. Only add disable comments when suppression is genuinely the best option. For no-empty-function: add a `{ /* no-op */ }` comment body instead of a disable comment.",
-			"Prefer extensionless imports; if an extension is required, use .ts over .js.",
-			"The bst-hook manages Bash/file permissions. See .claude/hooks/bst-hook-guide.md for auto-approved, denied, and passthrough commands."
-		],
-		enabledPlugins,
-		extraKnownMarketplaces
+	const isGitHub = ctx.config.ci === "github";
+	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
+	const hasDocker = hasDockerPackages(ctx);
+	const hasAssets = hasReleaseAssets(ctx);
+	const registryDerivable = hasRepositoryUrl(ctx);
+	const hookSecrets = getPostReleaseHookSecrets(ctx);
+	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker, hasAssets, registryDerivable);
+	if (!steps) return {
+		filePath,
+		action: "skipped",
+		description: "Release CI workflow not applicable"
 	};
-}
-const BST_HOOK_MARKER = "bst-hook.mjs";
-/** Remove old per-tool bst-hook entries that are now covered by a consolidated matcher. */
-function removeObsoleteBstHookEntries(matchers, consolidatedMatcher) {
-	const consolidatedTools = new Set(consolidatedMatcher.split("|"));
-	return matchers.filter((m) => {
-		if (!consolidatedTools.has(m.matcher)) return true;
-		if (!m.hooks.some((h) => h.command.includes(BST_HOOK_MARKER))) return true;
-		return false;
+	if (ctx.config.releaseStrategy === "release-it") steps.push(postReleaseHookStep({
+		command: getPostReleaseHookCommand(ctx),
+		secrets: hookSecrets
+	}));
+	else if (ctx.config.releaseStrategy === "simple") steps.push(postReleaseHookStep({
+		command: getPostReleaseHookCommand(ctx),
+		secrets: hookSecrets,
+		condition: "steps.release.outputs.pushed == 'true'"
+	}));
+	const on = ctx.config.releaseStrategy === "simple" ? simpleWorkflowDispatchTrigger() : { workflow_dispatch: null };
+	const content = buildWorkflowYaml({
+		ci: ctx.config.ci,
+		name: "Release",
+		on,
+		...isGitHub && { permissions: { contents: "write" } },
+		jobName: "release",
+		steps
 	});
-}
-/** Remove enabledPlugins/extraKnownMarketplaces/hooks when empty to keep the file clean. */
-function serializeSettings$1(settings) {
-	const { enabledPlugins, extraKnownMarketplaces, hooks, ...rest } = settings;
-	const out = { ...rest };
-	if (Object.keys(hooks).length > 0) out["hooks"] = hooks;
-	if (Object.keys(enabledPlugins).length > 0) out["enabledPlugins"] = enabledPlugins;
-	if (Object.keys(extraKnownMarketplaces).length > 0) out["extraKnownMarketplaces"] = extraKnownMarketplaces;
-	return JSON.stringify(out, null, 2) + "\n";
-}
-function writeOrMergeSettings(ctx, filePath, generated) {
-	const existing = ctx.read(filePath);
+	const alreadyExists = ctx.exists(workflowPath);
+	const existing = alreadyExists ? ctx.read(workflowPath) : void 0;
 	if (existing) {
-		const parsed = parseClaudeSettings(existing);
-		if (!parsed) return {
-			filePath,
+		if (isToolingIgnored(existing)) return {
+			filePath: workflowPath,
 			action: "skipped",
-			description: "Could not parse existing settings"
+			description: "Release workflow has ignore comment"
 		};
-		const { settings, rawJson } = parsed;
-		const missingAllow = generated.permissions.allow.filter((rule) => !settings.permissions.allow.includes(rule));
-		const missingDeny = generated.permissions.deny.filter((rule) => !settings.permissions.deny.includes(rule));
-		const mergedInstructions = [...settings.instructions];
-		let instructionChanges = 0;
-		for (const inst of generated.instructions) {
-			if (mergedInstructions.includes(inst)) continue;
-			const prefixIdx = mergedInstructions.findIndex((e) => inst.startsWith(e) || e.startsWith(inst));
-			if (prefixIdx !== -1) mergedInstructions[prefixIdx] = inst;
-			else mergedInstructions.push(inst);
-			instructionChanges++;
-		}
-		let hookChanges = 0;
-		const mergedHooks = { ...settings.hooks };
-		for (const [event, generatedMatchers] of Object.entries(generated.hooks)) {
-			const existingMatchers = mergedHooks[event] ?? [];
-			for (const gm of generatedMatchers) {
-				const existingIdx = existingMatchers.findIndex((m) => m.matcher === gm.matcher && m.hooks.some((h) => h.command.includes(BST_HOOK_MARKER)));
-				if (existingIdx !== -1) {
-					const existingEntry = existingMatchers[existingIdx];
-					const genCommand = gm.hooks.find((h) => h.command.includes(BST_HOOK_MARKER))?.command;
-					const curCommand = existingEntry.hooks.find((h) => h.command.includes(BST_HOOK_MARKER))?.command;
-					if (genCommand && curCommand && genCommand !== curCommand) {
-						const target = (mergedHooks[event] ?? [])[existingIdx];
-						target.hooks = target.hooks.map((h) => h.command.includes(BST_HOOK_MARKER) ? Object.assign(h, { command: genCommand }) : h);
-						hookChanges++;
-					}
-					continue;
-				}
-				if (gm.matcher.includes("|")) {
-					const before = (mergedHooks[event] ?? []).length;
-					mergedHooks[event] = removeObsoleteBstHookEntries(mergedHooks[event] ?? [], gm.matcher);
-					const removed = before - (mergedHooks[event] ?? []).length;
-					if (removed > 0) hookChanges += removed;
-				}
-				mergedHooks[event] = [...mergedHooks[event] ?? [], gm];
-				hookChanges++;
-			}
-		}
-		const missingPlugins = Object.entries(generated.enabledPlugins).filter(([key]) => !(key in settings.enabledPlugins));
-		const missingMarketplaces = Object.entries(generated.extraKnownMarketplaces).filter(([key]) => !(key in settings.extraKnownMarketplaces));
-		const changed = missingAllow.length + missingDeny.length + hookChanges + instructionChanges + missingPlugins.length + missingMarketplaces.length;
-		if (changed === 0) return {
-			filePath,
+		if (normalizeWorkflow(existing) === normalizeWorkflow(content)) return {
+			filePath: workflowPath,
 			action: "skipped",
-			description: "Already has all rules and instructions"
-		};
-		rawJson["permissions"] = {
-			allow: [...settings.permissions.allow, ...missingAllow],
-			deny: [...settings.permissions.deny, ...missingDeny]
-		};
-		if (Object.keys(mergedHooks).length > 0) rawJson["hooks"] = mergedHooks;
-		rawJson["instructions"] = mergedInstructions;
-		const updatedPlugins = { ...settings.enabledPlugins };
-		for (const [key, value] of missingPlugins) updatedPlugins[key] = value;
-		const updatedMarketplaces = { ...settings.extraKnownMarketplaces };
-		for (const [key, value] of missingMarketplaces) updatedMarketplaces[key] = value;
-		if (Object.keys(updatedPlugins).length > 0) rawJson["enabledPlugins"] = updatedPlugins;
-		else delete rawJson["enabledPlugins"];
-		if (Object.keys(updatedMarketplaces).length > 0) rawJson["extraKnownMarketplaces"] = updatedMarketplaces;
-		else delete rawJson["extraKnownMarketplaces"];
-		ctx.write(filePath, JSON.stringify(rawJson, null, 2) + "\n");
-		return {
-			filePath,
-			action: "updated",
-			description: `Updated ${String(changed)} rules/instructions`
+			description: "Release workflow already up to date"
 		};
 	}
-	ctx.write(filePath, serializeSettings$1(generated));
+	const withPinnedActions = preservePinnedActions(preserveDevBinaryPath(content, existing), existing);
+	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
+	ctx.write(workflowPath, final);
 	return {
-		filePath,
-		action: "created",
-		description: `Generated ${filePath}`
+		filePath: workflowPath,
+		action: alreadyExists ? "updated" : "created",
+		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions release workflow`
 	};
 }
-async function generateClaudeSettings(ctx) {
-	const results = [];
-	results.push(writeOrMergeSettings(ctx, ".claude/settings.json", buildSettings(ctx)));
-	if (ctx.config.structure === "monorepo") for (const pkg of getMonorepoPackages(ctx.targetDir)) {
-		const pkgRelDir = path.relative(ctx.targetDir, pkg.dir);
-		const claudeDir = path.join(pkgRelDir, ".claude");
-		if (ctx.exists(claudeDir)) {
-			ctx.remove(claudeDir);
-			results.push({
-				filePath: claudeDir,
-				action: "removed",
-				description: `Removed subpackage ${claudeDir} (plugins consolidated at root)`
-			});
+//#endregion
+//#region src/generators/ci.ts
+/** Build the release step for the check job (changesets strategy). */
+function changesetsReleaseStep(ci, publishesNpm) {
+	if (ci === "github") return { step: {
+		id: "release",
+		uses: "changesets/action@v1",
+		if: "github.ref == 'refs/heads/main'",
+		with: {
+			publish: "pnpm changeset publish",
+			version: "pnpm changeset version"
+		},
+		env: {
+			GITHUB_TOKEN: actionsExpr("github.token"),
+			...publishesNpm && { NPM_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
 		}
-	}
-	return results;
+	} };
+	return { step: {
+		id: "release",
+		name: "Release",
+		env: {
+			FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
+			FORGEJO_REPOSITORY: actionsExpr("github.repository"),
+			RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
+			...publishesNpm && { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") },
+			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+		},
+		run: "pnpm exec bst release:changesets"
+	} };
 }
-//#endregion
-//#region src/generators/release-it.ts
-function buildConfig$3(ci, isMonorepo) {
-	const config = {
-		$schema: "https://unpkg.com/release-it/schema/release-it.json",
-		git: {
-			commitMessage: "chore: release v${version}",
-			tagName: "v${version}"
+const CI_CONCURRENCY = {
+	group: `ci-${actionsExpr("github.ref")}`,
+	"cancel-in-progress": actionsExpr("github.ref != 'refs/heads/main'")
+};
+function checkSteps(nodeVersionYaml, publishesNpm) {
+	return [
+		{ step: {
+			uses: "actions/checkout@v6",
+			with: { "fetch-depth": 0 }
+		} },
+		{ step: { uses: "pnpm/action-setup@v5" } },
+		{ step: {
+			uses: "actions/setup-node@v6",
+			with: {
+				...nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" },
+				cache: "pnpm",
+				...publishesNpm && { "registry-url": actionsExpr("vars.NPM_REGISTRY_URL || 'https://registry.npmjs.org'") }
+			}
+		} },
+		{ step: { run: "pnpm install --frozen-lockfile" } },
+		{ step: {
+			name: "Run all checks",
+			run: "pnpm ci:check"
+		} }
+	];
+}
+/** Resolve the CI workflow filename based on release strategy. */
+function ciWorkflowPath(ci, releaseStrategy) {
+	return `${ci === "github" ? ".github/workflows" : ".forgejo/workflows"}/${releaseStrategy === "changesets" ? "ci.yml" : "check.yml"}`;
+}
+async function generateCi(ctx) {
+	if (ctx.config.ci === "none") return {
+		filePath: "ci",
+		action: "skipped",
+		description: "CI workflow not requested"
+	};
+	const isGitHub = ctx.config.ci === "github";
+	const isForgejo = !isGitHub;
+	const isChangesets = ctx.config.releaseStrategy === "changesets";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
+	const publishesNpm = ctx.config.publishNpm === true;
+	const hookCommand = getPostReleaseHookCommand(ctx);
+	const hookSecrets = getPostReleaseHookSecrets(ctx);
+	const hasDocker = isChangesets && hasDockerPackages(ctx);
+	const hasAssets = isChangesets && hasReleaseAssets(ctx);
+	const registryDerivable = hasDocker && hasRepositoryUrl(ctx);
+	const publishedIf = "steps.release.outputs.published == 'true'";
+	const releaseEnv = {};
+	if (isGitHub) releaseEnv["GITHUB_TOKEN"] = actionsExpr("github.token");
+	else {
+		releaseEnv["FORGEJO_SERVER_URL"] = actionsExpr("github.server_url");
+		releaseEnv["FORGEJO_REPOSITORY"] = actionsExpr("github.repository");
+		releaseEnv["RELEASE_TOKEN"] = actionsExpr("secrets.RELEASE_TOKEN");
+	}
+	const steps = [
+		...checkSteps(nodeVersionYaml, isChangesets && publishesNpm),
+		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm)] : [],
+		...hasAssets ? [{ step: {
+			name: "Upload Release Assets",
+			if: publishedIf,
+			env: releaseEnv,
+			run: "pnpm exec bst release:assets"
+		} }] : [],
+		...hasDocker ? [{ step: {
+			name: "Publish Docker images",
+			if: publishedIf,
+			env: dockerPublishEnv(registryDerivable),
+			run: "pnpm exec bst docker:publish"
+		} }] : [],
+		...isChangesets ? [postReleaseHookStep({
+			command: hookCommand,
+			secrets: hookSecrets,
+			condition: publishedIf
+		})] : []
+	];
+	const content = buildWorkflowYaml({
+		ci: ctx.config.ci,
+		name: "CI",
+		on: {
+			push: {
+				branches: ["main"],
+				"tags-ignore": ["**"]
+			},
+			pull_request: null
 		},
-		npm: { publish: true }
-	};
-	if (ci === "github") config["github"] = { release: true };
-	const plugins = {};
-	if (isMonorepo) {
-		config["npm"] = {
-			publish: true,
-			allowSameVersion: true
-		};
-		plugins["@release-it/bumper"] = { out: "packages/*/package.json" };
-	}
-	if (Object.keys(plugins).length > 0) config["plugins"] = plugins;
-	return config;
-}
-async function generateReleaseIt(ctx) {
-	const filePath = ".release-it.json";
-	if (ctx.config.releaseStrategy !== "release-it") return {
-		filePath,
-		action: "skipped",
-		description: "release-it not requested"
-	};
-	const content = JSON.stringify(buildConfig$3(ctx.config.ci, ctx.config.structure === "monorepo"), null, 2) + "\n";
-	const existing = ctx.read(filePath);
+		enableEmailNotifications: isForgejo,
+		...isChangesets && { concurrency: CI_CONCURRENCY },
+		jobName: "check",
+		steps
+	});
+	const filePath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
+	const alreadyExists = ctx.exists(filePath);
+	const existing = alreadyExists ? ctx.read(filePath) : void 0;
 	if (existing) {
-		if (contentEqual(filePath, existing, content)) return {
+		if (isToolingIgnored(existing)) return {
 			filePath,
 			action: "skipped",
-			description: "Already configured"
+			description: "CI workflow has ignore comment"
 		};
-		if (await ctx.confirmOverwrite(filePath) === "skip") return {
+		if (normalizeWorkflow(existing) === normalizeWorkflow(content)) return {
 			filePath,
 			action: "skipped",
-			description: "Existing release-it config preserved"
+			description: "CI workflow already up to date"
 		};
 	}
-	ctx.write(filePath, content);
-	return {
-		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated .release-it.json"
-	};
-}
-//#endregion
-//#region src/generators/changesets.ts
-function buildConfig$2() {
-	return {
-		$schema: "https://unpkg.com/@changesets/config@3.1.1/schema.json",
-		changelog: "@changesets/cli/changelog",
-		commit: false,
-		fixed: [],
-		linked: [],
-		access: "public",
-		baseBranch: "main",
-		updateInternalDependencies: "patch",
-		ignore: []
-	};
-}
-async function generateChangesets(ctx) {
-	const filePath = ".changeset/config.json";
-	if (ctx.config.releaseStrategy !== "changesets") return {
-		filePath,
-		action: "skipped",
-		description: "Changesets not requested"
-	};
-	const content = JSON.stringify(buildConfig$2(), null, 2) + "\n";
-	const existing = ctx.read(filePath);
-	if (existing) return {
-		filePath,
-		action: "skipped",
-		description: "Existing changesets config preserved"
-	};
-	ctx.write(filePath, content);
+	const withPinnedActions = preservePinnedActions(preserveDevBinaryPath(content, existing), existing);
+	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
+	ctx.write(filePath, final);
 	return {
 		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated .changeset/config.json"
+		action: alreadyExists ? "updated" : "created",
+		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions CI workflow`
 	};
 }
 //#endregion
-//#region src/generators/lefthook.ts
-const LINT_COMMAND = "pnpm exec oxlint --no-error-on-unmatched-pattern {staged_files}";
-function formatCommandFor(formatter) {
-	return formatter === "prettier" ? "pnpm exec prettier --ignore-unknown --no-error-on-unmatched-pattern --write {staged_files}" : "pnpm exec oxfmt --no-error-on-unmatched-pattern {staged_files}";
-}
-function requiredCommands(formatter) {
-	return {
-		lint: { run: LINT_COMMAND },
-		format: {
-			run: formatCommandFor(formatter),
-			stage_fixed: true
-		}
-	};
+//#region src/generators/knip.ts
+const KNIP_CONFIG_SINGLE = `import type { KnipConfig } from "knip";
+
+export default {
+  entry: ["src/index.ts"],
+  project: ["src/**/*.ts"],
+  ignore: ["dist/**", ".claude/hooks/**"],
+} satisfies KnipConfig;
+`;
+const KNIP_CONFIG_MONOREPO = `import type { KnipConfig } from "knip";
+
+export default {
+  ignore: [".claude/hooks/**"],
+  workspaces: {
+    ".": {
+      entry: [],
+      project: [],
+    },
+    "packages/*": {
+      entry: ["src/index.ts", "src/bin.ts"],
+      project: ["src/**/*.ts"],
+      ignore: ["dist/**"],
+    },
+  },
+} satisfies KnipConfig;
+`;
+const REQUIRED_IGNORE = ".claude/hooks/**";
+/** All known knip config file locations, in priority order. */
+const KNIP_CONFIG_PATHS = [
+	"knip.config.ts",
+	"knip.config.mts",
+	"knip.json",
+	"knip.jsonc",
+	"knip.ts",
+	"knip.mts"
+];
+const JSON_EXTENSIONS = new Set([".json", ".jsonc"]);
+function isJsonConfig(path) {
+	const dot = path.lastIndexOf(".");
+	return dot !== -1 && JSON_EXTENSIONS.has(path.slice(dot));
 }
-function buildConfig$1(formatter) {
-	return [
-		"pre-commit:",
-		"  commands:",
-		"    lint:",
-		`      run: ${LINT_COMMAND}`,
-		"    format:",
-		`      run: ${formatCommandFor(formatter)}`,
-		"      stage_fixed: true",
-		""
-	].join("\n");
+/**
+* Try to add the required ignore pattern to an existing knip config.
+* Returns the updated content, or undefined if no change was needed.
+*/
+function ensureIgnorePattern(content, path) {
+	if (content.includes(".claude/hooks")) return void 0;
+	if (isJsonConfig(path)) return ensureIgnoreInJson(content);
+	return ensureIgnoreInTs(content);
 }
-const ARCHIVE_DIR = ".tooling-archived";
-/** Common client-side git hooks that husky may have configured. */
-const HUSKY_HOOK_NAMES = [
-	"pre-commit",
-	"commit-msg",
-	"pre-push",
-	"post-merge",
-	"post-checkout",
-	"prepare-commit-msg"
-];
-/** All known lint-staged config file locations to archive. */
-const LINT_STAGED_CONFIG_PATHS = [
-	"lint-staged.config.mjs",
-	"lint-staged.config.js",
-	"lint-staged.config.cjs",
-	".lintstagedrc",
-	".lintstagedrc.json",
-	".lintstagedrc.yaml",
-	".lintstagedrc.yml",
-	".lintstagedrc.mjs",
-	".lintstagedrc.cjs"
-];
-/** All known lefthook config file locations, in priority order. */
-const LEFTHOOK_CONFIG_PATHS = ["lefthook.yml", ".lefthook.yml"];
-/** Archive all husky hook files found in .husky/ */
-function archiveHuskyHooks(ctx, results) {
-	let found = false;
-	for (const hook of HUSKY_HOOK_NAMES) {
-		const huskyPath = `.husky/${hook}`;
-		const existing = ctx.read(huskyPath);
-		if (existing !== void 0) {
-			ctx.write(`${ARCHIVE_DIR}/${huskyPath}`, existing);
-			ctx.remove(huskyPath);
-			results.push({
-				filePath: huskyPath,
-				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR}/${huskyPath}`
-			});
-			found = true;
-		}
-	}
-	return found;
+const KnipJsonSchema = z.object({ ignore: z.array(z.string()).optional() }).passthrough();
+function ensureIgnoreInJson(content) {
+	const result = KnipJsonSchema.safeParse(JSON.parse(content));
+	if (!result.success) return void 0;
+	const parsed = result.data;
+	const ignore = parsed.ignore ?? [];
+	ignore.push(REQUIRED_IGNORE);
+	parsed.ignore = ignore;
+	return JSON.stringify(parsed, null, 2) + "\n";
 }
-/** Archive all lint-staged config files. */
-function archiveLintStagedConfigs(ctx, results) {
-	let found = false;
-	for (const lsPath of LINT_STAGED_CONFIG_PATHS) {
-		const existing = ctx.read(lsPath);
-		if (existing !== void 0) {
-			ctx.write(`${ARCHIVE_DIR}/${lsPath}`, existing);
-			ctx.remove(lsPath);
-			results.push({
-				filePath: lsPath,
-				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR}/${lsPath}`
-			});
-			found = true;
-		}
-	}
-	return found;
+function ensureIgnoreInTs(content) {
+	const ignoreArrayPattern = /(ignore:\s*\[)/;
+	if (ignoreArrayPattern.exec(content)) return content.replace(ignoreArrayPattern, `$1"${REQUIRED_IGNORE}", `);
+	const exportPattern = /(export default\s*\{)\n/;
+	if (exportPattern.exec(content)) return content.replace(exportPattern, `$1\n  ignore: ["${REQUIRED_IGNORE}"],\n`);
 }
-/** Remove husky/lint-staged from package.json devDependencies and fix prepare script. */
-function cleanPackageJson(ctx, results) {
-	const raw = ctx.read("package.json");
-	if (!raw) return;
-	const pkg = parsePackageJson(raw);
-	if (!pkg) return;
-	const changes = [];
-	if (pkg.devDependencies) {
-		if ("husky" in pkg.devDependencies) {
-			delete pkg.devDependencies["husky"];
-			changes.push("removed devDependency: husky");
-		}
-		if ("lint-staged" in pkg.devDependencies) {
-			delete pkg.devDependencies["lint-staged"];
-			changes.push("removed devDependency: lint-staged");
+async function generateKnip(ctx) {
+	const filePath = "knip.config.ts";
+	const isMonorepo = ctx.config.structure === "monorepo";
+	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
+	if (existingPath) {
+		const content = ctx.read(existingPath);
+		if (content) {
+			const updated = ensureIgnorePattern(content, existingPath);
+			if (updated) {
+				ctx.write(existingPath, updated);
+				return {
+					filePath: existingPath,
+					action: "updated",
+					description: "Added \".claude/hooks/**\" to ignore"
+				};
+			}
 		}
+		return {
+			filePath: existingPath,
+			action: "skipped",
+			description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
+		};
 	}
-	if (pkg.scripts?.["prepare"] && /\bhusky\b/.test(pkg.scripts["prepare"])) {
-		delete pkg.scripts["prepare"];
-		changes.push("removed husky prepare script");
-	}
-	if (changes.length === 0) return;
-	ctx.write("package.json", JSON.stringify(pkg, null, 2) + "\n");
-	results.push({
-		filePath: "package.json",
-		action: "updated",
-		description: changes.join(", ")
-	});
+	const config = isMonorepo ? KNIP_CONFIG_MONOREPO : KNIP_CONFIG_SINGLE;
+	ctx.write(filePath, config);
+	return {
+		filePath,
+		action: "created",
+		description: "Generated knip.config.ts for dead code analysis"
+	};
 }
-async function generateLefthook(ctx) {
-	const filePath = "lefthook.yml";
-	const content = buildConfig$1(ctx.config.formatter);
-	const results = [];
-	archiveHuskyHooks(ctx, results);
-	archiveLintStagedConfigs(ctx, results);
-	cleanPackageJson(ctx, results);
-	const existingPath = LEFTHOOK_CONFIG_PATHS.find((p) => ctx.exists(p));
+//#endregion
+//#region src/generators/renovate.ts
+const SHARED_PRESET = "local>bensandee/tooling";
+/** Deprecated npm-based preset to migrate away from. */
+const LEGACY_PRESET = "@bensandee/config";
+/** All known renovate config file locations, in priority order. */
+const RENOVATE_CONFIG_PATHS = [
+	"renovate.json",
+	"renovate.json5",
+	".renovaterc",
+	".renovaterc.json",
+	".github/renovate.json",
+	".github/renovate.json5"
+];
+async function generateRenovate(ctx) {
+	const defaultPath = "renovate.json";
+	if (!ctx.config.setupRenovate) return {
+		filePath: defaultPath,
+		action: "skipped",
+		description: "Renovate not requested"
+	};
+	const existingPath = RENOVATE_CONFIG_PATHS.find((p) => ctx.exists(p));
 	if (existingPath) {
 		const existing = ctx.read(existingPath);
 		if (existing) {
-			const merged = mergeLefthookCommands(existing, requiredCommands(ctx.config.formatter));
-			if (merged.changed) {
-				ctx.write(existingPath, merged.content);
-				results.push({
+			const parsed = parseRenovateJson(existing);
+			const existingExtends = parsed.extends ?? [];
+			const legacyIndex = existingExtends.indexOf(LEGACY_PRESET);
+			if (legacyIndex !== -1) {
+				existingExtends[legacyIndex] = SHARED_PRESET;
+				parsed.extends = existingExtends;
+				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
+				return {
 					filePath: existingPath,
 					action: "updated",
-					description: "Added missing pre-commit commands"
-				});
-			} else results.push({
+					description: `Migrated extends: ${LEGACY_PRESET} → ${SHARED_PRESET}`
+				};
+			}
+			if (!existingExtends.includes(SHARED_PRESET)) {
+				existingExtends.unshift(SHARED_PRESET);
+				parsed.extends = existingExtends;
+				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
+				return {
+					filePath: existingPath,
+					action: "updated",
+					description: `Added extends: ${SHARED_PRESET}`
+				};
+			}
+			return {
 				filePath: existingPath,
 				action: "skipped",
-				description: "Lefthook config already up to date"
-			});
-		} else results.push({
-			filePath: existingPath,
-			action: "skipped",
-			description: "Could not read existing lefthook config"
-		});
-		return results;
+				description: "Already extends shared config"
+			};
+		}
 	}
-	ctx.write(filePath, content);
-	results.push({
+	const config = {
+		$schema: "https://docs.renovatebot.com/renovate-schema.json",
+		extends: [SHARED_PRESET]
+	};
+	ctx.write(defaultPath, JSON.stringify(config, null, 2) + "\n");
+	return {
+		filePath: defaultPath,
+		action: "created",
+		description: "Generated renovate.json extending shared config"
+	};
+}
+//#endregion
+//#region src/generators/pnpm-workspace.ts
+const WORKSPACE_YAML = `packages:
+  - "packages/*"
+`;
+async function generatePnpmWorkspace(ctx) {
+	const filePath = "pnpm-workspace.yaml";
+	if (ctx.config.structure !== "monorepo") return {
+		filePath,
+		action: "skipped",
+		description: "Not a monorepo"
+	};
+	if (ctx.exists(filePath)) return {
+		filePath,
+		action: "skipped",
+		description: "pnpm-workspace.yaml already exists"
+	};
+	ctx.write(filePath, WORKSPACE_YAML);
+	return {
 		filePath,
 		action: "created",
-		description: "Generated lefthook pre-commit config"
-	});
-	return results;
+		description: "Generated pnpm-workspace.yaml"
+	};
 }
 //#endregion
-//#region src/generators/vscode-settings.ts
-const SCHEMA_NPM_PATH = "@bensandee/config/schemas/forgejo-workflow.schema.json";
-const SCHEMA_LOCAL_PATH = ".vscode/forgejo-workflow.schema.json";
-const SETTINGS_PATH = ".vscode/settings.json";
-const SCHEMA_GLOB = ".forgejo/workflows/*.{yml,yaml}";
-const VscodeSettingsSchema = z.looseObject({ "yaml.schemas": z.record(z.string(), z.unknown()).default({}) });
-function readSchemaFromNodeModules(targetDir) {
-	const candidate = path.join(targetDir, "node_modules", SCHEMA_NPM_PATH);
-	if (!existsSync(candidate)) return void 0;
-	return readFileSync(candidate, "utf-8");
+//#region src/generators/claude-hooks.ts
+const HOOK_PATH = ".claude/hooks/bst-hook.mjs";
+const GUIDE_PATH = ".claude/hooks/bst-hook-guide.md";
+function writeIfChanged(ctx, filePath, content, label) {
+	const existing = ctx.read(filePath);
+	if (existing === content) return {
+		filePath,
+		action: "skipped",
+		description: `${label} is up to date`
+	};
+	ctx.write(filePath, content);
+	return {
+		filePath,
+		action: existing ? "updated" : "created",
+		description: existing ? `Updated ${label}` : `Generated ${label}`
+	};
 }
-function serializeSettings(settings) {
-	return JSON.stringify(settings, null, 2) + "\n";
+async function generateClaudeHooks(ctx) {
+	return [writeIfChanged(ctx, HOOK_PATH, "/**\n * bst-hook — Claude Code PreToolUse hook\n * @bensandee/claude-hooks v0.7.3\n * https://github.com/bensandee/tooling\n *\n * Auto-generated by @bensandee/tooling repo:sync — do not edit manually.\n */\nimport * as fs from \"node:fs\";\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { execFileSync } from \"node:child_process\";\nimport * as os from \"node:os\";\n\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/core.js\nvar _a$1;\nfunction $constructor(name, initializer, params) {\n	function init(inst, def) {\n		if (!inst._zod) Object.defineProperty(inst, \"_zod\", {\n			value: {\n				def,\n				constr: _,\n				traits: /* @__PURE__ */ new Set()\n			},\n			enumerable: false\n		});\n		if (inst._zod.traits.has(name)) return;\n		inst._zod.traits.add(name);\n		initializer(inst, def);\n		const proto = _.prototype;\n		const keys = Object.keys(proto);\n		for (let i = 0; i < keys.length; i++) {\n			const k = keys[i];\n			if (!(k in inst)) inst[k] = proto[k].bind(inst);\n		}\n	}\n	const Parent = params?.Parent ?? Object;\n	class Definition extends Parent {}\n	Object.defineProperty(Definition, \"name\", { value: name });\n	function _(def) {\n		var _a;\n		const inst = params?.Parent ? new Definition() : this;\n		init(inst, def);\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		for (const fn of inst._zod.deferred) fn();\n		return inst;\n	}\n	Object.defineProperty(_, \"init\", { value: init });\n	Object.defineProperty(_, Symbol.hasInstance, { value: (inst) => {\n		if (params?.Parent && inst instanceof params.Parent) return true;\n		return inst?._zod?.traits?.has(name);\n	} });\n	Object.defineProperty(_, \"name\", { value: name });\n	return _;\n}\nvar $ZodAsyncError = class extends Error {\n	constructor() {\n		super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);\n	}\n};\nvar $ZodEncodeError = class extends Error {\n	constructor(name) {\n		super(`Encountered unidirectional transform during encode: ${name}`);\n		this.name = \"ZodEncodeError\";\n	}\n};\n(_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});\nconst globalConfig = globalThis.__zod_globalConfig;\nfunction config(newConfig) {\n	if (newConfig) Object.assign(globalConfig, newConfig);\n	return globalConfig;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/util.js\nfunction getEnumValues(entries) {\n	const numericValues = Object.values(entries).filter((v) => typeof v === \"number\");\n	return Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);\n}\nfunction jsonStringifyReplacer(_, value) {\n	if (typeof value === \"bigint\") return value.toString();\n	return value;\n}\nfunction cached(getter) {\n	return { get value() {\n		{\n			const value = getter();\n			Object.defineProperty(this, \"value\", { value });\n			return value;\n		}\n		throw new Error(\"cached value already set\");\n	} };\n}\nfunction nullish(input) {\n	return input === null || input === void 0;\n}\nfunction cleanRegex(source) {\n	const start = source.startsWith(\"^\") ? 1 : 0;\n	const end = source.endsWith(\"$\") ? source.length - 1 : source.length;\n	return source.slice(start, end);\n}\nconst EVALUATING = /* @__PURE__ */ Symbol(\"evaluating\");\nfunction defineLazy(object, key, getter) {\n	let value = void 0;\n	Object.defineProperty(object, key, {\n		get() {\n			if (value === EVALUATING) return;\n			if (value === void 0) {\n				value = EVALUATING;\n				value = getter();\n			}\n			return value;\n		},\n		set(v) {\n			Object.defineProperty(object, key, { value: v });\n		},\n		configurable: true\n	});\n}\nfunction assignProp(target, prop, value) {\n	Object.defineProperty(target, prop, {\n		value,\n		writable: true,\n		enumerable: true,\n		configurable: true\n	});\n}\nfunction mergeDefs(...defs) {\n	const mergedDescriptors = {};\n	for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));\n	return Object.defineProperties({}, mergedDescriptors);\n}\nfunction esc(str) {\n	return JSON.stringify(str);\n}\nfunction slugify(input) {\n	return input.toLowerCase().trim().replace(/[^\\w\\s-]/g, \"\").replace(/[\\s_-]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n}\nconst captureStackTrace = \"captureStackTrace\" in Error ? Error.captureStackTrace : (..._args) => {};\nfunction isObject(data) {\n	return typeof data === \"object\" && data !== null && !Array.isArray(data);\n}\nconst allowsEval = /* @__PURE__ */ cached(() => {\n	if (globalConfig.jitless) return false;\n	if (typeof navigator !== \"undefined\" && navigator?.userAgent?.includes(\"Cloudflare\")) return false;\n	try {\n		new Function(\"\");\n		return true;\n	} catch (_) {\n		return false;\n	}\n});\nfunction isPlainObject(o) {\n	if (isObject(o) === false) return false;\n	const ctor = o.constructor;\n	if (ctor === void 0) return true;\n	if (typeof ctor !== \"function\") return true;\n	const prot = ctor.prototype;\n	if (isObject(prot) === false) return false;\n	if (Object.prototype.hasOwnProperty.call(prot, \"isPrototypeOf\") === false) return false;\n	return true;\n}\nfunction shallowClone(o) {\n	if (isPlainObject(o)) return { ...o };\n	if (Array.isArray(o)) return [...o];\n	if (o instanceof Map) return new Map(o);\n	if (o instanceof Set) return new Set(o);\n	return o;\n}\nconst propertyKeyTypes = /* @__PURE__ */ new Set([\n	\"string\",\n	\"number\",\n	\"symbol\"\n]);\nfunction escapeRegex(str) {\n	return str.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\nfunction clone(inst, def, params) {\n	const cl = new inst._zod.constr(def ?? inst._zod.def);\n	if (!def || params?.parent) cl._zod.parent = inst;\n	return cl;\n}\nfunction normalizeParams(_params) {\n	const params = _params;\n	if (!params) return {};\n	if (typeof params === \"string\") return { error: () => params };\n	if (params?.message !== void 0) {\n		if (params?.error !== void 0) throw new Error(\"Cannot specify both `message` and `error` params\");\n		params.error = params.message;\n	}\n	delete params.message;\n	if (typeof params.error === \"string\") return {\n		...params,\n		error: () => params.error\n	};\n	return params;\n}\nfunction optionalKeys(shape) {\n	return Object.keys(shape).filter((k) => {\n		return shape[k]._zod.optin === \"optional\" && shape[k]._zod.optout === \"optional\";\n	});\n}\nconst NUMBER_FORMAT_RANGES = {\n	safeint: [Number.MIN_SAFE_INTEGER, Number.MAX_SAFE_INTEGER],\n	int32: [-2147483648, 2147483647],\n	uint32: [0, 4294967295],\n	float32: [-34028234663852886e22, 34028234663852886e22],\n	float64: [-Number.MAX_VALUE, Number.MAX_VALUE]\n};\nfunction pick(schema, mask) {\n	const currDef = schema._zod.def;\n	const checks = currDef.checks;\n	if (checks && checks.length > 0) throw new Error(\".pick() cannot be used on object schemas containing refinements\");\n	return clone(schema, mergeDefs(schema._zod.def, {\n		get shape() {\n			const newShape = {};\n			for (const key in mask) {\n				if (!(key in currDef.shape)) throw new Error(`Unrecognized key: \"${key}\"`);\n				if (!mask[key]) continue;\n				newShape[key] = currDef.shape[key];\n			}\n			assignProp(this, \"shape\", newShape);\n			return newShape;\n		},\n		checks: []\n	}));\n}\nfunction omit(schema, mask) {\n	const currDef = schema._zod.def;\n	const checks = currDef.checks;\n	if (checks && checks.length > 0) throw new Error(\".omit() cannot be used on object schemas containing refinements\");\n	return clone(schema, mergeDefs(schema._zod.def, {\n		get shape() {\n			const newShape = { ...schema._zod.def.shape };\n			for (const key in mask) {\n				if (!(key in currDef.shape)) throw new Error(`Unrecognized key: \"${key}\"`);\n				if (!mask[key]) continue;\n				delete newShape[key];\n			}\n			assignProp(this, \"shape\", newShape);\n			return newShape;\n		},\n		checks: []\n	}));\n}\nfunction extend(schema, shape) {\n	if (!isPlainObject(shape)) throw new Error(\"Invalid input to extend: expected a plain object\");\n	const checks = schema._zod.def.checks;\n	if (checks && checks.length > 0) {\n		const existingShape = schema._zod.def.shape;\n		for (const key in shape) if (Object.getOwnPropertyDescriptor(existingShape, key) !== void 0) throw new Error(\"Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.\");\n	}\n	return clone(schema, mergeDefs(schema._zod.def, { get shape() {\n		const _shape = {\n			...schema._zod.def.shape,\n			...shape\n		};\n		assignProp(this, \"shape\", _shape);\n		return _shape;\n	} }));\n}\nfunction safeExtend(schema, shape) {\n	if (!isPlainObject(shape)) throw new Error(\"Invalid input to safeExtend: expected a plain object\");\n	return clone(schema, mergeDefs(schema._zod.def, { get shape() {\n		const _shape = {\n			...schema._zod.def.shape,\n			...shape\n		};\n		assignProp(this, \"shape\", _shape);\n		return _shape;\n	} }));\n}\nfunction merge(a, b) {\n	if (a._zod.def.checks?.length) throw new Error(\".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.\");\n	return clone(a, mergeDefs(a._zod.def, {\n		get shape() {\n			const _shape = {\n				...a._zod.def.shape,\n				...b._zod.def.shape\n			};\n			assignProp(this, \"shape\", _shape);\n			return _shape;\n		},\n		get catchall() {\n			return b._zod.def.catchall;\n		},\n		checks: b._zod.def.checks ?? []\n	}));\n}\nfunction partial(Class, schema, mask) {\n	const checks = schema._zod.def.checks;\n	if (checks && checks.length > 0) throw new Error(\".partial() cannot be used on object schemas containing refinements\");\n	return clone(schema, mergeDefs(schema._zod.def, {\n		get shape() {\n			const oldShape = schema._zod.def.shape;\n			const shape = { ...oldShape };\n			if (mask) for (const key in mask) {\n				if (!(key in oldShape)) throw new Error(`Unrecognized key: \"${key}\"`);\n				if (!mask[key]) continue;\n				shape[key] = Class ? new Class({\n					type: \"optional\",\n					innerType: oldShape[key]\n				}) : oldShape[key];\n			}\n			else for (const key in oldShape) shape[key] = Class ? new Class({\n				type: \"optional\",\n				innerType: oldShape[key]\n			}) : oldShape[key];\n			assignProp(this, \"shape\", shape);\n			return shape;\n		},\n		checks: []\n	}));\n}\nfunction required(Class, schema, mask) {\n	return clone(schema, mergeDefs(schema._zod.def, { get shape() {\n		const oldShape = schema._zod.def.shape;\n		const shape = { ...oldShape };\n		if (mask) for (const key in mask) {\n			if (!(key in shape)) throw new Error(`Unrecognized key: \"${key}\"`);\n			if (!mask[key]) continue;\n			shape[key] = new Class({\n				type: \"nonoptional\",\n				innerType: oldShape[key]\n			});\n		}\n		else for (const key in oldShape) shape[key] = new Class({\n			type: \"nonoptional\",\n			innerType: oldShape[key]\n		});\n		assignProp(this, \"shape\", shape);\n		return shape;\n	} }));\n}\nfunction aborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue !== true) return true;\n	return false;\n}\nfunction explicitlyAborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue === false) return true;\n	return false;\n}\nfunction prefixIssues(path, issues) {\n	return issues.map((iss) => {\n		var _a;\n		(_a = iss).path ?? (_a.path = []);\n		iss.path.unshift(path);\n		return iss;\n	});\n}\nfunction unwrapMessage(message) {\n	return typeof message === \"string\" ? message : message?.message;\n}\nfunction finalizeIssue(iss, ctx, config) {\n	const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? \"Invalid input\";\n	const { inst: _inst, continue: _continue, input: _input, ...rest } = iss;\n	rest.path ?? (rest.path = []);\n	rest.message = message;\n	if (ctx?.reportInput) rest.input = _input;\n	return rest;\n}\nfunction getLengthableOrigin(input) {\n	if (Array.isArray(input)) return \"array\";\n	if (typeof input === \"string\") return \"string\";\n	return \"unknown\";\n}\nfunction issue(...args) {\n	const [iss, input, inst] = args;\n	if (typeof iss === \"string\") return {\n		message: iss,\n		code: \"custom\",\n		input,\n		inst\n	};\n	return { ...iss };\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/errors.js\nconst initializer$1 = (inst, def) => {\n	inst.name = \"$ZodError\";\n	Object.defineProperty(inst, \"_zod\", {\n		value: inst._zod,\n		enumerable: false\n	});\n	Object.defineProperty(inst, \"issues\", {\n		value: def,\n		enumerable: false\n	});\n	inst.message = JSON.stringify(def, jsonStringifyReplacer, 2);\n	Object.defineProperty(inst, \"toString\", {\n		value: () => inst.message,\n		enumerable: false\n	});\n};\nconst $ZodError = $constructor(\"$ZodError\", initializer$1);\nconst $ZodRealError = $constructor(\"$ZodError\", initializer$1, { Parent: Error });\nfunction flattenError(error, mapper = (issue) => issue.message) {\n	const fieldErrors = {};\n	const formErrors = [];\n	for (const sub of error.issues) if (sub.path.length > 0) {\n		fieldErrors[sub.path[0]] = fieldErrors[sub.path[0]] || [];\n		fieldErrors[sub.path[0]].push(mapper(sub));\n	} else formErrors.push(mapper(sub));\n	return {\n		formErrors,\n		fieldErrors\n	};\n}\nfunction formatError(error, mapper = (issue) => issue.message) {\n	const fieldErrors = { _errors: [] };\n	const processError = (error, path = []) => {\n		for (const issue of error.issues) if (issue.code === \"invalid_union\" && issue.errors.length) issue.errors.map((issues) => processError({ issues }, [...path, ...issue.path]));\n		else if (issue.code === \"invalid_key\") processError({ issues: issue.issues }, [...path, ...issue.path]);\n		else if (issue.code === \"invalid_element\") processError({ issues: issue.issues }, [...path, ...issue.path]);\n		else {\n			const fullpath = [...path, ...issue.path];\n			if (fullpath.length === 0) fieldErrors._errors.push(mapper(issue));\n			else {\n				let curr = fieldErrors;\n				let i = 0;\n				while (i < fullpath.length) {\n					const el = fullpath[i];\n					if (!(i === fullpath.length - 1)) curr[el] = curr[el] || { _errors: [] };\n					else {\n						curr[el] = curr[el] || { _errors: [] };\n						curr[el]._errors.push(mapper(issue));\n					}\n					curr = curr[el];\n					i++;\n				}\n			}\n		}\n	};\n	processError(error);\n	return fieldErrors;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/parse.js\nconst _parse = (_Err) => (schema, value, _ctx, _params) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: false\n	} : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	if (result.issues.length) {\n		const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n		captureStackTrace(e, _params?.callee);\n		throw e;\n	}\n	return result.value;\n};\nconst _parseAsync = (_Err) => async (schema, value, _ctx, params) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: true\n	} : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	if (result.issues.length) {\n		const e = new (params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n		captureStackTrace(e, params?.callee);\n		throw e;\n	}\n	return result.value;\n};\nconst _safeParse = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: false\n	} : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	return result.issues.length ? {\n		success: false,\n		error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))\n	} : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParse$1 = /* @__PURE__ */ _safeParse($ZodRealError);\nconst _safeParseAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: true\n	} : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	return result.issues.length ? {\n		success: false,\n		error: new _Err(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))\n	} : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParseAsync$1 = /* @__PURE__ */ _safeParseAsync($ZodRealError);\nconst _encode = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		direction: \"backward\"\n	} : { direction: \"backward\" };\n	return _parse(_Err)(schema, value, ctx);\n};\nconst _decode = (_Err) => (schema, value, _ctx) => {\n	return _parse(_Err)(schema, value, _ctx);\n};\nconst _encodeAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		direction: \"backward\"\n	} : { direction: \"backward\" };\n	return _parseAsync(_Err)(schema, value, ctx);\n};\nconst _decodeAsync = (_Err) => async (schema, value, _ctx) => {\n	return _parseAsync(_Err)(schema, value, _ctx);\n};\nconst _safeEncode = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		direction: \"backward\"\n	} : { direction: \"backward\" };\n	return _safeParse(_Err)(schema, value, ctx);\n};\nconst _safeDecode = (_Err) => (schema, value, _ctx) => {\n	return _safeParse(_Err)(schema, value, _ctx);\n};\nconst _safeEncodeAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		direction: \"backward\"\n	} : { direction: \"backward\" };\n	return _safeParseAsync(_Err)(schema, value, ctx);\n};\nconst _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {\n	return _safeParseAsync(_Err)(schema, value, _ctx);\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/regexes.js\n/**\n* @deprecated CUID v1 is deprecated by its authors due to information leakage\n* (timestamps embedded in the id). Use {@link cuid2} instead.\n* See https://github.com/paralleldrive/cuid.\n*/\nconst cuid = /^[cC][0-9a-z]{6,}$/;\nconst cuid2 = /^[0-9a-z]+$/;\nconst ulid = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;\nconst xid = /^[0-9a-vA-V]{20}$/;\nconst ksuid = /^[A-Za-z0-9]{27}$/;\nconst nanoid = /^[a-zA-Z0-9_-]{21}$/;\n/** ISO 8601-1 duration regex. Does not support the 8601-2 extensions like negative durations or fractional/negative components. */\nconst duration$1 = /^P(?:(\\d+W)|(?!.*W)(?=\\d|T\\d)(\\d+Y)?(\\d+M)?(\\d+D)?(T(?=\\d)(\\d+H)?(\\d+M)?(\\d+([.,]\\d+)?S)?)?)$/;\n/** A regex for any UUID-like identifier: 8-4-4-4-12 hex pattern */\nconst guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;\n/** Returns a regex for validating an RFC 9562/4122 UUID.\n*\n* @param version Optionally specify a version 1-8. If no version is specified, all versions are supported. */\nconst uuid = (version) => {\n	if (!version) return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;\n	return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);\n};\n/** Practical email validation */\nconst email = /^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/;\nconst _emoji$1 = `^(\\\\p{Extended_Pictographic}|\\\\p{Emoji_Component})+$`;\nfunction emoji() {\n	return new RegExp(_emoji$1, \"u\");\n}\nconst ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;\nconst ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;\nconst cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\/([0-9]|[1-2][0-9]|3[0-2])$/;\nconst cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;\nconst base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;\nconst base64url = /^[A-Za-z0-9_-]*$/;\nconst httpProtocol = /^https?$/;\nconst e164 = /^\\+[1-9]\\d{6,14}$/;\nconst dateSource = `(?:(?:\\\\d\\\\d[2468][048]|\\\\d\\\\d[13579][26]|\\\\d\\\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\\\d|30)|(?:02)-(?:0[1-9]|1\\\\d|2[0-8])))`;\nconst date$1 = /* @__PURE__ */ new RegExp(`^${dateSource}$`);\nfunction timeSource(args) {\n	const hhmm = `(?:[01]\\\\d|2[0-3]):[0-5]\\\\d`;\n	return typeof args.precision === \"number\" ? args.precision === -1 ? `${hhmm}` : args.precision === 0 ? `${hhmm}:[0-5]\\\\d` : `${hhmm}:[0-5]\\\\d\\\\.\\\\d{${args.precision}}` : `${hhmm}(?::[0-5]\\\\d(?:\\\\.\\\\d+)?)?`;\n}\nfunction time$1(args) {\n	return new RegExp(`^${timeSource(args)}$`);\n}\nfunction datetime$1(args) {\n	const time = timeSource({ precision: args.precision });\n	const opts = [\"Z\"];\n	if (args.local) opts.push(\"\");\n	if (args.offset) opts.push(`([+-](?:[01]\\\\d|2[0-3]):[0-5]\\\\d)`);\n	const timeRegex = `${time}(?:${opts.join(\"|\")})`;\n	return new RegExp(`^${dateSource}T(?:${timeRegex})$`);\n}\nconst string$1 = (params) => {\n	const regex = params ? `[\\\\s\\\\S]{${params?.minimum ?? 0},${params?.maximum ?? \"\"}}` : `[\\\\s\\\\S]*`;\n	return new RegExp(`^${regex}$`);\n};\nconst number = /^-?\\d+(?:\\.\\d+)?$/;\nconst lowercase = /^[^A-Z]*$/;\nconst uppercase = /^[^a-z]*$/;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/checks.js\nconst $ZodCheck = /* @__PURE__ */ $constructor(\"$ZodCheck\", (inst, def) => {\n	var _a;\n	inst._zod ?? (inst._zod = {});\n	inst._zod.def = def;\n	(_a = inst._zod).onattach ?? (_a.onattach = []);\n});\nconst $ZodCheckMaxLength = /* @__PURE__ */ $constructor(\"$ZodCheckMaxLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = (payload) => {\n		const val = payload.value;\n		return !nullish(val) && val.length !== void 0;\n	});\n	inst._zod.onattach.push((inst) => {\n		const curr = inst._zod.bag.maximum ?? Number.POSITIVE_INFINITY;\n		if (def.maximum < curr) inst._zod.bag.maximum = def.maximum;\n	});\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		if (input.length <= def.maximum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_big\",\n			maximum: def.maximum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckMinLength = /* @__PURE__ */ $constructor(\"$ZodCheckMinLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = (payload) => {\n		const val = payload.value;\n		return !nullish(val) && val.length !== void 0;\n	});\n	inst._zod.onattach.push((inst) => {\n		const curr = inst._zod.bag.minimum ?? Number.NEGATIVE_INFINITY;\n		if (def.minimum > curr) inst._zod.bag.minimum = def.minimum;\n	});\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		if (input.length >= def.minimum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_small\",\n			minimum: def.minimum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckLengthEquals = /* @__PURE__ */ $constructor(\"$ZodCheckLengthEquals\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = (payload) => {\n		const val = payload.value;\n		return !nullish(val) && val.length !== void 0;\n	});\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.minimum = def.length;\n		bag.maximum = def.length;\n		bag.length = def.length;\n	});\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const length = input.length;\n		if (length === def.length) return;\n		const origin = getLengthableOrigin(input);\n		const tooBig = length > def.length;\n		payload.issues.push({\n			origin,\n			...tooBig ? {\n				code: \"too_big\",\n				maximum: def.length\n			} : {\n				code: \"too_small\",\n				minimum: def.length\n			},\n			inclusive: true,\n			exact: true,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckStringFormat = /* @__PURE__ */ $constructor(\"$ZodCheckStringFormat\", (inst, def) => {\n	var _a, _b;\n	$ZodCheck.init(inst, def);\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.format = def.format;\n		if (def.pattern) {\n			bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n			bag.patterns.add(def.pattern);\n		}\n	});\n	if (def.pattern) (_a = inst._zod).check ?? (_a.check = (payload) => {\n		def.pattern.lastIndex = 0;\n		if (def.pattern.test(payload.value)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: def.format,\n			input: payload.value,\n			...def.pattern ? { pattern: def.pattern.toString() } : {},\n			inst,\n			continue: !def.abort\n		});\n	});\n	else (_b = inst._zod).check ?? (_b.check = () => {});\n});\nconst $ZodCheckRegex = /* @__PURE__ */ $constructor(\"$ZodCheckRegex\", (inst, def) => {\n	$ZodCheckStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		def.pattern.lastIndex = 0;\n		if (def.pattern.test(payload.value)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"regex\",\n			input: payload.value,\n			pattern: def.pattern.toString(),\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckLowerCase = /* @__PURE__ */ $constructor(\"$ZodCheckLowerCase\", (inst, def) => {\n	def.pattern ?? (def.pattern = lowercase);\n	$ZodCheckStringFormat.init(inst, def);\n});\nconst $ZodCheckUpperCase = /* @__PURE__ */ $constructor(\"$ZodCheckUpperCase\", (inst, def) => {\n	def.pattern ?? (def.pattern = uppercase);\n	$ZodCheckStringFormat.init(inst, def);\n});\nconst $ZodCheckIncludes = /* @__PURE__ */ $constructor(\"$ZodCheckIncludes\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	const escapedRegex = escapeRegex(def.includes);\n	const pattern = new RegExp(typeof def.position === \"number\" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);\n	def.pattern = pattern;\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n		bag.patterns.add(pattern);\n	});\n	inst._zod.check = (payload) => {\n		if (payload.value.includes(def.includes, def.position)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"includes\",\n			includes: def.includes,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckStartsWith = /* @__PURE__ */ $constructor(\"$ZodCheckStartsWith\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);\n	def.pattern ?? (def.pattern = pattern);\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n		bag.patterns.add(pattern);\n	});\n	inst._zod.check = (payload) => {\n		if (payload.value.startsWith(def.prefix)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"starts_with\",\n			prefix: def.prefix,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckEndsWith = /* @__PURE__ */ $constructor(\"$ZodCheckEndsWith\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);\n	def.pattern ?? (def.pattern = pattern);\n	inst._zod.onattach.push((inst) => {\n		const bag = inst._zod.bag;\n		bag.patterns ?? (bag.patterns = /* @__PURE__ */ new Set());\n		bag.patterns.add(pattern);\n	});\n	inst._zod.check = (payload) => {\n		if (payload.value.endsWith(def.suffix)) return;\n		payload.issues.push({\n			origin: \"string\",\n			code: \"invalid_format\",\n			format: \"ends_with\",\n			suffix: def.suffix,\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodCheckOverwrite = /* @__PURE__ */ $constructor(\"$ZodCheckOverwrite\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	inst._zod.check = (payload) => {\n		payload.value = def.tx(payload.value);\n	};\n});\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/doc.js\nvar Doc = class {\n	constructor(args = []) {\n		this.content = [];\n		this.indent = 0;\n		if (this) this.args = args;\n	}\n	indented(fn) {\n		this.indent += 1;\n		fn(this);\n		this.indent -= 1;\n	}\n	write(arg) {\n		if (typeof arg === \"function\") {\n			arg(this, { execution: \"sync\" });\n			arg(this, { execution: \"async\" });\n			return;\n		}\n		const lines = arg.split(\"\\n\").filter((x) => x);\n		const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));\n		const dedented = lines.map((x) => x.slice(minIndent)).map((x) => \" \".repeat(this.indent * 2) + x);\n		for (const line of dedented) this.content.push(line);\n	}\n	compile() {\n		const F = Function;\n		const args = this?.args;\n		const lines = [...(this?.content ?? [``]).map((x) => `  ${x}`)];\n		return new F(...args, lines.join(\"\\n\"));\n	}\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/versions.js\nconst version = {\n	major: 4,\n	minor: 4,\n	patch: 1\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/schemas.js\nconst $ZodType = /* @__PURE__ */ $constructor(\"$ZodType\", (inst, def) => {\n	var _a;\n	inst ?? (inst = {});\n	inst._zod.def = def;\n	inst._zod.bag = inst._zod.bag || {};\n	inst._zod.version = version;\n	const checks = [...inst._zod.def.checks ?? []];\n	if (inst._zod.traits.has(\"$ZodCheck\")) checks.unshift(inst);\n	for (const ch of checks) for (const fn of ch._zod.onattach) fn(inst);\n	if (checks.length === 0) {\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		inst._zod.deferred?.push(() => {\n			inst._zod.run = inst._zod.parse;\n		});\n	} else {\n		const runChecks = (payload, checks, ctx) => {\n			let isAborted = aborted(payload);\n			let asyncResult;\n			for (const ch of checks) {\n				if (ch._zod.def.when) {\n					if (explicitlyAborted(payload)) continue;\n					if (!ch._zod.def.when(payload)) continue;\n				} else if (isAborted) continue;\n				const currLen = payload.issues.length;\n				const _ = ch._zod.check(payload);\n				if (_ instanceof Promise && ctx?.async === false) throw new $ZodAsyncError();\n				if (asyncResult || _ instanceof Promise) asyncResult = (asyncResult ?? Promise.resolve()).then(async () => {\n					await _;\n					if (payload.issues.length === currLen) return;\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				});\n				else {\n					if (payload.issues.length === currLen) continue;\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				}\n			}\n			if (asyncResult) return asyncResult.then(() => {\n				return payload;\n			});\n			return payload;\n		};\n		const handleCanaryResult = (canary, payload, ctx) => {\n			if (aborted(canary)) {\n				canary.aborted = true;\n				return canary;\n			}\n			const checkResult = runChecks(payload, checks, ctx);\n			if (checkResult instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return checkResult.then((checkResult) => inst._zod.parse(checkResult, ctx));\n			}\n			return inst._zod.parse(checkResult, ctx);\n		};\n		inst._zod.run = (payload, ctx) => {\n			if (ctx.skipChecks) return inst._zod.parse(payload, ctx);\n			if (ctx.direction === \"backward\") {\n				const canary = inst._zod.parse({\n					value: payload.value,\n					issues: []\n				}, {\n					...ctx,\n					skipChecks: true\n				});\n				if (canary instanceof Promise) return canary.then((canary) => {\n					return handleCanaryResult(canary, payload, ctx);\n				});\n				return handleCanaryResult(canary, payload, ctx);\n			}\n			const result = inst._zod.parse(payload, ctx);\n			if (result instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return result.then((result) => runChecks(result, checks, ctx));\n			}\n			return runChecks(result, checks, ctx);\n		};\n	}\n	defineLazy(inst, \"~standard\", () => ({\n		validate: (value) => {\n			try {\n				const r = safeParse$1(inst, value);\n				return r.success ? { value: r.data } : { issues: r.error?.issues };\n			} catch (_) {\n				return safeParseAsync$1(inst, value).then((r) => r.success ? { value: r.data } : { issues: r.error?.issues });\n			}\n		},\n		vendor: \"zod\",\n		version: 1\n	}));\n});\nconst $ZodString = /* @__PURE__ */ $constructor(\"$ZodString\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.pattern = [...inst?._zod.bag?.patterns ?? []].pop() ?? string$1(inst._zod.bag);\n	inst._zod.parse = (payload, _) => {\n		if (def.coerce) try {\n			payload.value = String(payload.value);\n		} catch (_) {}\n		if (typeof payload.value === \"string\") return payload;\n		payload.issues.push({\n			expected: \"string\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodStringFormat = /* @__PURE__ */ $constructor(\"$ZodStringFormat\", (inst, def) => {\n	$ZodCheckStringFormat.init(inst, def);\n	$ZodString.init(inst, def);\n});\nconst $ZodGUID = /* @__PURE__ */ $constructor(\"$ZodGUID\", (inst, def) => {\n	def.pattern ?? (def.pattern = guid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodUUID = /* @__PURE__ */ $constructor(\"$ZodUUID\", (inst, def) => {\n	if (def.version) {\n		const v = {\n			v1: 1,\n			v2: 2,\n			v3: 3,\n			v4: 4,\n			v5: 5,\n			v6: 6,\n			v7: 7,\n			v8: 8\n		}[def.version];\n		if (v === void 0) throw new Error(`Invalid UUID version: \"${def.version}\"`);\n		def.pattern ?? (def.pattern = uuid(v));\n	} else def.pattern ?? (def.pattern = uuid());\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodEmail = /* @__PURE__ */ $constructor(\"$ZodEmail\", (inst, def) => {\n	def.pattern ?? (def.pattern = email);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodURL = /* @__PURE__ */ $constructor(\"$ZodURL\", (inst, def) => {\n	$ZodStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		try {\n			const trimmed = payload.value.trim();\n			if (!def.normalize && def.protocol?.source === httpProtocol.source) {\n				if (!/^https?:\\/\\//i.test(trimmed)) {\n					payload.issues.push({\n						code: \"invalid_format\",\n						format: \"url\",\n						note: \"Invalid URL format\",\n						input: payload.value,\n						inst,\n						continue: !def.abort\n					});\n					return;\n				}\n			}\n			const url = new URL(trimmed);\n			if (def.hostname) {\n				def.hostname.lastIndex = 0;\n				if (!def.hostname.test(url.hostname)) payload.issues.push({\n					code: \"invalid_format\",\n					format: \"url\",\n					note: \"Invalid hostname\",\n					pattern: def.hostname.source,\n					input: payload.value,\n					inst,\n					continue: !def.abort\n				});\n			}\n			if (def.protocol) {\n				def.protocol.lastIndex = 0;\n				if (!def.protocol.test(url.protocol.endsWith(\":\") ? url.protocol.slice(0, -1) : url.protocol)) payload.issues.push({\n					code: \"invalid_format\",\n					format: \"url\",\n					note: \"Invalid protocol\",\n					pattern: def.protocol.source,\n					input: payload.value,\n					inst,\n					continue: !def.abort\n				});\n			}\n			if (def.normalize) payload.value = url.href;\n			else payload.value = trimmed;\n			return;\n		} catch (_) {\n			payload.issues.push({\n				code: \"invalid_format\",\n				format: \"url\",\n				input: payload.value,\n				inst,\n				continue: !def.abort\n			});\n		}\n	};\n});\nconst $ZodEmoji = /* @__PURE__ */ $constructor(\"$ZodEmoji\", (inst, def) => {\n	def.pattern ?? (def.pattern = emoji());\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodNanoID = /* @__PURE__ */ $constructor(\"$ZodNanoID\", (inst, def) => {\n	def.pattern ?? (def.pattern = nanoid);\n	$ZodStringFormat.init(inst, def);\n});\n/**\n* @deprecated CUID v1 is deprecated by its authors due to information leakage\n* (timestamps embedded in the id). Use {@link $ZodCUID2} instead.\n* See https://github.com/paralleldrive/cuid.\n*/\nconst $ZodCUID = /* @__PURE__ */ $constructor(\"$ZodCUID\", (inst, def) => {\n	def.pattern ?? (def.pattern = cuid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodCUID2 = /* @__PURE__ */ $constructor(\"$ZodCUID2\", (inst, def) => {\n	def.pattern ?? (def.pattern = cuid2);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodULID = /* @__PURE__ */ $constructor(\"$ZodULID\", (inst, def) => {\n	def.pattern ?? (def.pattern = ulid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodXID = /* @__PURE__ */ $constructor(\"$ZodXID\", (inst, def) => {\n	def.pattern ?? (def.pattern = xid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodKSUID = /* @__PURE__ */ $constructor(\"$ZodKSUID\", (inst, def) => {\n	def.pattern ?? (def.pattern = ksuid);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISODateTime = /* @__PURE__ */ $constructor(\"$ZodISODateTime\", (inst, def) => {\n	def.pattern ?? (def.pattern = datetime$1(def));\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISODate = /* @__PURE__ */ $constructor(\"$ZodISODate\", (inst, def) => {\n	def.pattern ?? (def.pattern = date$1);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISOTime = /* @__PURE__ */ $constructor(\"$ZodISOTime\", (inst, def) => {\n	def.pattern ?? (def.pattern = time$1(def));\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodISODuration = /* @__PURE__ */ $constructor(\"$ZodISODuration\", (inst, def) => {\n	def.pattern ?? (def.pattern = duration$1);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodIPv4 = /* @__PURE__ */ $constructor(\"$ZodIPv4\", (inst, def) => {\n	def.pattern ?? (def.pattern = ipv4);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.format = `ipv4`;\n});\nconst $ZodIPv6 = /* @__PURE__ */ $constructor(\"$ZodIPv6\", (inst, def) => {\n	def.pattern ?? (def.pattern = ipv6);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.format = `ipv6`;\n	inst._zod.check = (payload) => {\n		try {\n			new URL(`http://[${payload.value}]`);\n		} catch {\n			payload.issues.push({\n				code: \"invalid_format\",\n				format: \"ipv6\",\n				input: payload.value,\n				inst,\n				continue: !def.abort\n			});\n		}\n	};\n});\nconst $ZodCIDRv4 = /* @__PURE__ */ $constructor(\"$ZodCIDRv4\", (inst, def) => {\n	def.pattern ?? (def.pattern = cidrv4);\n	$ZodStringFormat.init(inst, def);\n});\nconst $ZodCIDRv6 = /* @__PURE__ */ $constructor(\"$ZodCIDRv6\", (inst, def) => {\n	def.pattern ?? (def.pattern = cidrv6);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		const parts = payload.value.split(\"/\");\n		try {\n			if (parts.length !== 2) throw new Error();\n			const [address, prefix] = parts;\n			if (!prefix) throw new Error();\n			const prefixNum = Number(prefix);\n			if (`${prefixNum}` !== prefix) throw new Error();\n			if (prefixNum < 0 || prefixNum > 128) throw new Error();\n			new URL(`http://[${address}]`);\n		} catch {\n			payload.issues.push({\n				code: \"invalid_format\",\n				format: \"cidrv6\",\n				input: payload.value,\n				inst,\n				continue: !def.abort\n			});\n		}\n	};\n});\nfunction isValidBase64(data) {\n	if (data === \"\") return true;\n	if (/\\s/.test(data)) return false;\n	if (data.length % 4 !== 0) return false;\n	try {\n		atob(data);\n		return true;\n	} catch {\n		return false;\n	}\n}\nconst $ZodBase64 = /* @__PURE__ */ $constructor(\"$ZodBase64\", (inst, def) => {\n	def.pattern ?? (def.pattern = base64);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.contentEncoding = \"base64\";\n	inst._zod.check = (payload) => {\n		if (isValidBase64(payload.value)) return;\n		payload.issues.push({\n			code: \"invalid_format\",\n			format: \"base64\",\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nfunction isValidBase64URL(data) {\n	if (!base64url.test(data)) return false;\n	const base64 = data.replace(/[-_]/g, (c) => c === \"-\" ? \"+\" : \"/\");\n	return isValidBase64(base64.padEnd(Math.ceil(base64.length / 4) * 4, \"=\"));\n}\nconst $ZodBase64URL = /* @__PURE__ */ $constructor(\"$ZodBase64URL\", (inst, def) => {\n	def.pattern ?? (def.pattern = base64url);\n	$ZodStringFormat.init(inst, def);\n	inst._zod.bag.contentEncoding = \"base64url\";\n	inst._zod.check = (payload) => {\n		if (isValidBase64URL(payload.value)) return;\n		payload.issues.push({\n			code: \"invalid_format\",\n			format: \"base64url\",\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodE164 = /* @__PURE__ */ $constructor(\"$ZodE164\", (inst, def) => {\n	def.pattern ?? (def.pattern = e164);\n	$ZodStringFormat.init(inst, def);\n});\nfunction isValidJWT(token, algorithm = null) {\n	try {\n		const tokensParts = token.split(\".\");\n		if (tokensParts.length !== 3) return false;\n		const [header] = tokensParts;\n		if (!header) return false;\n		const parsedHeader = JSON.parse(atob(header));\n		if (\"typ\" in parsedHeader && parsedHeader?.typ !== \"JWT\") return false;\n		if (!parsedHeader.alg) return false;\n		if (algorithm && (!(\"alg\" in parsedHeader) || parsedHeader.alg !== algorithm)) return false;\n		return true;\n	} catch {\n		return false;\n	}\n}\nconst $ZodJWT = /* @__PURE__ */ $constructor(\"$ZodJWT\", (inst, def) => {\n	$ZodStringFormat.init(inst, def);\n	inst._zod.check = (payload) => {\n		if (isValidJWT(payload.value, def.alg)) return;\n		payload.issues.push({\n			code: \"invalid_format\",\n			format: \"jwt\",\n			input: payload.value,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\nconst $ZodUnknown = /* @__PURE__ */ $constructor(\"$ZodUnknown\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload) => payload;\n});\nconst $ZodNever = /* @__PURE__ */ $constructor(\"$ZodNever\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, _ctx) => {\n		payload.issues.push({\n			expected: \"never\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nfunction handleArrayResult(result, final, index) {\n	if (result.issues.length) final.issues.push(...prefixIssues(index, result.issues));\n	final.value[index] = result.value;\n}\nconst $ZodArray = /* @__PURE__ */ $constructor(\"$ZodArray\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!Array.isArray(input)) {\n			payload.issues.push({\n				expected: \"array\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = Array(input.length);\n		const proms = [];\n		for (let i = 0; i < input.length; i++) {\n			const item = input[i];\n			const result = def.element._zod.run({\n				value: item,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) proms.push(result.then((result) => handleArrayResult(result, payload, i)));\n			else handleArrayResult(result, payload, i);\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nfunction handlePropertyResult(result, final, key, input, isOptionalIn, isOptionalOut) {\n	const isPresent = key in input;\n	if (result.issues.length) {\n		if (isOptionalIn && isOptionalOut && !isPresent) return;\n		final.issues.push(...prefixIssues(key, result.issues));\n	}\n	if (!isPresent && !isOptionalIn) {\n		if (!result.issues.length) final.issues.push({\n			code: \"invalid_type\",\n			expected: \"nonoptional\",\n			input: void 0,\n			path: [key]\n		});\n		return;\n	}\n	if (result.value === void 0) {\n		if (isPresent) final.value[key] = void 0;\n	} else final.value[key] = result.value;\n}\nfunction normalizeDef(def) {\n	const keys = Object.keys(def.shape);\n	for (const k of keys) if (!def.shape?.[k]?._zod?.traits?.has(\"$ZodType\")) throw new Error(`Invalid element at key \"${k}\": expected a Zod schema`);\n	const okeys = optionalKeys(def.shape);\n	return {\n		...def,\n		keys,\n		keySet: new Set(keys),\n		numKeys: keys.length,\n		optionalKeys: new Set(okeys)\n	};\n}\nfunction handleCatchall(proms, input, payload, ctx, def, inst) {\n	const unrecognized = [];\n	const keySet = def.keySet;\n	const _catchall = def.catchall._zod;\n	const t = _catchall.def.type;\n	const isOptionalIn = _catchall.optin === \"optional\";\n	const isOptionalOut = _catchall.optout === \"optional\";\n	for (const key in input) {\n		if (key === \"__proto__\") continue;\n		if (keySet.has(key)) continue;\n		if (t === \"never\") {\n			unrecognized.push(key);\n			continue;\n		}\n		const r = _catchall.run({\n			value: input[key],\n			issues: []\n		}, ctx);\n		if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut)));\n		else handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);\n	}\n	if (unrecognized.length) payload.issues.push({\n		code: \"unrecognized_keys\",\n		keys: unrecognized,\n		input,\n		inst\n	});\n	if (!proms.length) return payload;\n	return Promise.all(proms).then(() => {\n		return payload;\n	});\n}\nconst $ZodObject = /* @__PURE__ */ $constructor(\"$ZodObject\", (inst, def) => {\n	$ZodType.init(inst, def);\n	if (!Object.getOwnPropertyDescriptor(def, \"shape\")?.get) {\n		const sh = def.shape;\n		Object.defineProperty(def, \"shape\", { get: () => {\n			const newSh = { ...sh };\n			Object.defineProperty(def, \"shape\", { value: newSh });\n			return newSh;\n		} });\n	}\n	const _normalized = cached(() => normalizeDef(def));\n	defineLazy(inst._zod, \"propValues\", () => {\n		const shape = def.shape;\n		const propValues = {};\n		for (const key in shape) {\n			const field = shape[key]._zod;\n			if (field.values) {\n				propValues[key] ?? (propValues[key] = /* @__PURE__ */ new Set());\n				for (const v of field.values) propValues[key].add(v);\n			}\n		}\n		return propValues;\n	});\n	const isObject$1 = isObject;\n	const catchall = def.catchall;\n	let value;\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$1(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = {};\n		const proms = [];\n		const shape = value.shape;\n		for (const key of value.keys) {\n			const el = shape[key];\n			const isOptionalIn = el._zod.optin === \"optional\";\n			const isOptionalOut = el._zod.optout === \"optional\";\n			const r = el._zod.run({\n				value: input[key],\n				issues: []\n			}, ctx);\n			if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut)));\n			else handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);\n		}\n		if (!catchall) return proms.length ? Promise.all(proms).then(() => payload) : payload;\n		return handleCatchall(proms, input, payload, ctx, _normalized.value, inst);\n	};\n});\nconst $ZodObjectJIT = /* @__PURE__ */ $constructor(\"$ZodObjectJIT\", (inst, def) => {\n	$ZodObject.init(inst, def);\n	const superParse = inst._zod.parse;\n	const _normalized = cached(() => normalizeDef(def));\n	const generateFastpass = (shape) => {\n		const doc = new Doc([\n			\"shape\",\n			\"payload\",\n			\"ctx\"\n		]);\n		const normalized = _normalized.value;\n		const parseStr = (key) => {\n			const k = esc(key);\n			return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;\n		};\n		doc.write(`const input = payload.value;`);\n		const ids = Object.create(null);\n		let counter = 0;\n		for (const key of normalized.keys) ids[key] = `key_${counter++}`;\n		doc.write(`const newResult = {};`);\n		for (const key of normalized.keys) {\n			const id = ids[key];\n			const k = esc(key);\n			const schema = shape[key];\n			const isOptionalIn = schema?._zod?.optin === \"optional\";\n			const isOptionalOut = schema?._zod?.optout === \"optional\";\n			doc.write(`const ${id} = ${parseStr(key)};`);\n			if (isOptionalIn && isOptionalOut) doc.write(`\n        if (${id}.issues.length) {\n          if (${k} in input) {\n            payload.issues = payload.issues.concat(${id}.issues.map(iss => ({\n              ...iss,\n              path: iss.path ? [${k}, ...iss.path] : [${k}]\n            })));\n          }\n        }\n        \n        if (${id}.value === undefined) {\n          if (${k} in input) {\n            newResult[${k}] = undefined;\n          }\n        } else {\n          newResult[${k}] = ${id}.value;\n        }\n        \n      `);\n			else if (!isOptionalIn) doc.write(`\n        const ${id}_present = ${k} in input;\n        if (${id}.issues.length) {\n          payload.issues = payload.issues.concat(${id}.issues.map(iss => ({\n            ...iss,\n            path: iss.path ? [${k}, ...iss.path] : [${k}]\n          })));\n        }\n        if (!${id}_present && !${id}.issues.length) {\n          payload.issues.push({\n            code: \"invalid_type\",\n            expected: \"nonoptional\",\n            input: undefined,\n            path: [${k}]\n          });\n        }\n\n        if (${id}_present) {\n          if (${id}.value === undefined) {\n            newResult[${k}] = undefined;\n          } else {\n            newResult[${k}] = ${id}.value;\n          }\n        }\n\n      `);\n			else doc.write(`\n        if (${id}.issues.length) {\n          payload.issues = payload.issues.concat(${id}.issues.map(iss => ({\n            ...iss,\n            path: iss.path ? [${k}, ...iss.path] : [${k}]\n          })));\n        }\n        \n        if (${id}.value === undefined) {\n          if (${k} in input) {\n            newResult[${k}] = undefined;\n          }\n        } else {\n          newResult[${k}] = ${id}.value;\n        }\n        \n      `);\n		}\n		doc.write(`payload.value = newResult;`);\n		doc.write(`return payload;`);\n		const fn = doc.compile();\n		return (payload, ctx) => fn(shape, payload, ctx);\n	};\n	let fastpass;\n	const isObject$2 = isObject;\n	const jit = !globalConfig.jitless;\n	const allowsEval$1 = allowsEval;\n	const fastEnabled = jit && allowsEval$1.value;\n	const catchall = def.catchall;\n	let value;\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$2(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		if (jit && fastEnabled && ctx?.async === false && ctx.jitless !== true) {\n			if (!fastpass) fastpass = generateFastpass(def.shape);\n			payload = fastpass(payload, ctx);\n			if (!catchall) return payload;\n			return handleCatchall([], input, payload, ctx, value, inst);\n		}\n		return superParse(payload, ctx);\n	};\n});\nfunction handleUnionResults(results, final, inst, ctx) {\n	for (const result of results) if (result.issues.length === 0) {\n		final.value = result.value;\n		return final;\n	}\n	const nonaborted = results.filter((r) => !aborted(r));\n	if (nonaborted.length === 1) {\n		final.value = nonaborted[0].value;\n		return nonaborted[0];\n	}\n	final.issues.push({\n		code: \"invalid_union\",\n		input: final.value,\n		inst,\n		errors: results.map((result) => result.issues.map((iss) => finalizeIssue(iss, ctx, config())))\n	});\n	return final;\n}\nconst $ZodUnion = /* @__PURE__ */ $constructor(\"$ZodUnion\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"optin\", () => def.options.some((o) => o._zod.optin === \"optional\") ? \"optional\" : void 0);\n	defineLazy(inst._zod, \"optout\", () => def.options.some((o) => o._zod.optout === \"optional\") ? \"optional\" : void 0);\n	defineLazy(inst._zod, \"values\", () => {\n		if (def.options.every((o) => o._zod.values)) return new Set(def.options.flatMap((option) => Array.from(option._zod.values)));\n	});\n	defineLazy(inst._zod, \"pattern\", () => {\n		if (def.options.every((o) => o._zod.pattern)) {\n			const patterns = def.options.map((o) => o._zod.pattern);\n			return new RegExp(`^(${patterns.map((p) => cleanRegex(p.source)).join(\"|\")})$`);\n		}\n	});\n	const first = def.options.length === 1 ? def.options[0]._zod.run : null;\n	inst._zod.parse = (payload, ctx) => {\n		if (first) return first(payload, ctx);\n		let async = false;\n		const results = [];\n		for (const option of def.options) {\n			const result = option._zod.run({\n				value: payload.value,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) {\n				results.push(result);\n				async = true;\n			} else {\n				if (result.issues.length === 0) return result;\n				results.push(result);\n			}\n		}\n		if (!async) return handleUnionResults(results, payload, inst, ctx);\n		return Promise.all(results).then((results) => {\n			return handleUnionResults(results, payload, inst, ctx);\n		});\n	};\n});\nconst $ZodIntersection = /* @__PURE__ */ $constructor(\"$ZodIntersection\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		const left = def.left._zod.run({\n			value: input,\n			issues: []\n		}, ctx);\n		const right = def.right._zod.run({\n			value: input,\n			issues: []\n		}, ctx);\n		if (left instanceof Promise || right instanceof Promise) return Promise.all([left, right]).then(([left, right]) => {\n			return handleIntersectionResults(payload, left, right);\n		});\n		return handleIntersectionResults(payload, left, right);\n	};\n});\nfunction mergeValues(a, b) {\n	if (a === b) return {\n		valid: true,\n		data: a\n	};\n	if (a instanceof Date && b instanceof Date && +a === +b) return {\n		valid: true,\n		data: a\n	};\n	if (isPlainObject(a) && isPlainObject(b)) {\n		const bKeys = Object.keys(b);\n		const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);\n		const newObj = {\n			...a,\n			...b\n		};\n		for (const key of sharedKeys) {\n			const sharedValue = mergeValues(a[key], b[key]);\n			if (!sharedValue.valid) return {\n				valid: false,\n				mergeErrorPath: [key, ...sharedValue.mergeErrorPath]\n			};\n			newObj[key] = sharedValue.data;\n		}\n		return {\n			valid: true,\n			data: newObj\n		};\n	}\n	if (Array.isArray(a) && Array.isArray(b)) {\n		if (a.length !== b.length) return {\n			valid: false,\n			mergeErrorPath: []\n		};\n		const newArray = [];\n		for (let index = 0; index < a.length; index++) {\n			const itemA = a[index];\n			const itemB = b[index];\n			const sharedValue = mergeValues(itemA, itemB);\n			if (!sharedValue.valid) return {\n				valid: false,\n				mergeErrorPath: [index, ...sharedValue.mergeErrorPath]\n			};\n			newArray.push(sharedValue.data);\n		}\n		return {\n			valid: true,\n			data: newArray\n		};\n	}\n	return {\n		valid: false,\n		mergeErrorPath: []\n	};\n}\nfunction handleIntersectionResults(result, left, right) {\n	const unrecKeys = /* @__PURE__ */ new Map();\n	let unrecIssue;\n	for (const iss of left.issues) if (iss.code === \"unrecognized_keys\") {\n		unrecIssue ?? (unrecIssue = iss);\n		for (const k of iss.keys) {\n			if (!unrecKeys.has(k)) unrecKeys.set(k, {});\n			unrecKeys.get(k).l = true;\n		}\n	} else result.issues.push(iss);\n	for (const iss of right.issues) if (iss.code === \"unrecognized_keys\") for (const k of iss.keys) {\n		if (!unrecKeys.has(k)) unrecKeys.set(k, {});\n		unrecKeys.get(k).r = true;\n	}\n	else result.issues.push(iss);\n	const bothKeys = [...unrecKeys].filter(([, f]) => f.l && f.r).map(([k]) => k);\n	if (bothKeys.length && unrecIssue) result.issues.push({\n		...unrecIssue,\n		keys: bothKeys\n	});\n	if (aborted(result)) return result;\n	const merged = mergeValues(left.value, right.value);\n	if (!merged.valid) throw new Error(`Unmergable intersection. Error path: ${JSON.stringify(merged.mergeErrorPath)}`);\n	result.value = merged.data;\n	return result;\n}\nconst $ZodRecord = /* @__PURE__ */ $constructor(\"$ZodRecord\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!isPlainObject(input)) {\n			payload.issues.push({\n				expected: \"record\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		const proms = [];\n		const values = def.keyType._zod.values;\n		if (values) {\n			payload.value = {};\n			const recordKeys = /* @__PURE__ */ new Set();\n			for (const key of values) if (typeof key === \"string\" || typeof key === \"number\" || typeof key === \"symbol\") {\n				recordKeys.add(typeof key === \"number\" ? key.toString() : key);\n				const keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (keyResult.issues.length) {\n					payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			let unrecognized;\n			for (const key in input) if (!recordKeys.has(key)) {\n				unrecognized = unrecognized ?? [];\n				unrecognized.push(key);\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized\n			});\n		} else {\n			payload.value = {};\n			for (const key of Reflect.ownKeys(input)) {\n				if (key === \"__proto__\") continue;\n				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;\n				let keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (typeof key === \"string\" && number.test(key) && keyResult.issues.length) {\n					const retryResult = def.keyType._zod.run({\n						value: Number(key),\n						issues: []\n					}, ctx);\n					if (retryResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n					if (retryResult.issues.length === 0) keyResult = retryResult;\n				}\n				if (keyResult.issues.length) {\n					if (def.mode === \"loose\") payload.value[key] = input[key];\n					else payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[keyResult.value] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[keyResult.value] = result.value;\n				}\n			}\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nconst $ZodEnum = /* @__PURE__ */ $constructor(\"$ZodEnum\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const values = getEnumValues(def.entries);\n	const valuesSet = new Set(values);\n	inst._zod.values = valuesSet;\n	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === \"string\" ? escapeRegex(o) : o.toString()).join(\"|\")})$`);\n	inst._zod.parse = (payload, _ctx) => {\n		const input = payload.value;\n		if (valuesSet.has(input)) return payload;\n		payload.issues.push({\n			code: \"invalid_value\",\n			values,\n			input,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodTransform = /* @__PURE__ */ $constructor(\"$ZodTransform\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") throw new $ZodEncodeError(inst.constructor.name);\n		const _out = def.transform(payload.value, payload);\n		if (ctx.async) return (_out instanceof Promise ? _out : Promise.resolve(_out)).then((output) => {\n			payload.value = output;\n			return payload;\n		});\n		if (_out instanceof Promise) throw new $ZodAsyncError();\n		payload.value = _out;\n		return payload;\n	};\n});\nfunction handleOptionalResult(result, input) {\n	if (result.issues.length && input === void 0) return {\n		issues: [],\n		value: void 0\n	};\n	return result;\n}\nconst $ZodOptional = /* @__PURE__ */ $constructor(\"$ZodOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"optional\";\n	inst._zod.optout = \"optional\";\n	defineLazy(inst._zod, \"values\", () => {\n		return def.innerType._zod.values ? new Set([...def.innerType._zod.values, void 0]) : void 0;\n	});\n	defineLazy(inst._zod, \"pattern\", () => {\n		const pattern = def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (def.innerType._zod.optin === \"optional\") {\n			const result = def.innerType._zod.run(payload, ctx);\n			if (result instanceof Promise) return result.then((r) => handleOptionalResult(r, payload.value));\n			return handleOptionalResult(result, payload.value);\n		}\n		if (payload.value === void 0) return payload;\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodExactOptional = /* @__PURE__ */ $constructor(\"$ZodExactOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	defineLazy(inst._zod, \"pattern\", () => def.innerType._zod.pattern);\n	inst._zod.parse = (payload, ctx) => {\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodNullable = /* @__PURE__ */ $constructor(\"$ZodNullable\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"optin\", () => def.innerType._zod.optin);\n	defineLazy(inst._zod, \"optout\", () => def.innerType._zod.optout);\n	defineLazy(inst._zod, \"pattern\", () => {\n		const pattern = def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)}|null)$`) : void 0;\n	});\n	defineLazy(inst._zod, \"values\", () => {\n		return def.innerType._zod.values ? new Set([...def.innerType._zod.values, null]) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (payload.value === null) return payload;\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodDefault = /* @__PURE__ */ $constructor(\"$ZodDefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"optional\";\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) {\n			payload.value = def.defaultValue;\n			/**\n			* $ZodDefault returns the default value immediately in forward direction.\n			* It doesn't pass the default value into the validator (\"prefault\"). There's no reason to pass the default value through validation. The validity of the default is enforced by TypeScript statically. Otherwise, it's the responsibility of the user to ensure the default is valid. In the case of pipes with divergent in/out types, you can specify the default on the `in` schema of your ZodPipe to set a \"prefault\" for the pipe.   */\n			return payload;\n		}\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleDefaultResult(result, def));\n		return handleDefaultResult(result, def);\n	};\n});\nfunction handleDefaultResult(payload, def) {\n	if (payload.value === void 0) payload.value = def.defaultValue;\n	return payload;\n}\nconst $ZodPrefault = /* @__PURE__ */ $constructor(\"$ZodPrefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"optional\";\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) payload.value = def.defaultValue;\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodNonOptional = /* @__PURE__ */ $constructor(\"$ZodNonOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"values\", () => {\n		const v = def.innerType._zod.values;\n		return v ? new Set([...v].filter((x) => x !== void 0)) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleNonOptionalResult(result, inst));\n		return handleNonOptionalResult(result, inst);\n	};\n});\nfunction handleNonOptionalResult(payload, inst) {\n	if (!payload.issues.length && payload.value === void 0) payload.issues.push({\n		code: \"invalid_type\",\n		expected: \"nonoptional\",\n		input: payload.value,\n		inst\n	});\n	return payload;\n}\nconst $ZodCatch = /* @__PURE__ */ $constructor(\"$ZodCatch\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"optin\", () => def.innerType._zod.optin);\n	defineLazy(inst._zod, \"optout\", () => def.innerType._zod.optout);\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => {\n			payload.value = result.value;\n			if (result.issues.length) {\n				payload.value = def.catchValue({\n					...payload,\n					error: { issues: result.issues.map((iss) => finalizeIssue(iss, ctx, config())) },\n					input: payload.value\n				});\n				payload.issues = [];\n			}\n			return payload;\n		});\n		payload.value = result.value;\n		if (result.issues.length) {\n			payload.value = def.catchValue({\n				...payload,\n				error: { issues: result.issues.map((iss) => finalizeIssue(iss, ctx, config())) },\n				input: payload.value\n			});\n			payload.issues = [];\n		}\n		return payload;\n	};\n});\nconst $ZodPipe = /* @__PURE__ */ $constructor(\"$ZodPipe\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"values\", () => def.in._zod.values);\n	defineLazy(inst._zod, \"optin\", () => def.in._zod.optin);\n	defineLazy(inst._zod, \"optout\", () => def.out._zod.optout);\n	defineLazy(inst._zod, \"propValues\", () => def.in._zod.propValues);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") {\n			const right = def.out._zod.run(payload, ctx);\n			if (right instanceof Promise) return right.then((right) => handlePipeResult(right, def.in, ctx));\n			return handlePipeResult(right, def.in, ctx);\n		}\n		const left = def.in._zod.run(payload, ctx);\n		if (left instanceof Promise) return left.then((left) => handlePipeResult(left, def.out, ctx));\n		return handlePipeResult(left, def.out, ctx);\n	};\n});\nfunction handlePipeResult(left, next, ctx) {\n	if (left.issues.length) {\n		left.aborted = true;\n		return left;\n	}\n	return next._zod.run({\n		value: left.value,\n		issues: left.issues\n	}, ctx);\n}\nconst $ZodReadonly = /* @__PURE__ */ $constructor(\"$ZodReadonly\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazy(inst._zod, \"propValues\", () => def.innerType._zod.propValues);\n	defineLazy(inst._zod, \"values\", () => def.innerType._zod.values);\n	defineLazy(inst._zod, \"optin\", () => def.innerType?._zod?.optin);\n	defineLazy(inst._zod, \"optout\", () => def.innerType?._zod?.optout);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then(handleReadonlyResult);\n		return handleReadonlyResult(result);\n	};\n});\nfunction handleReadonlyResult(payload) {\n	payload.value = Object.freeze(payload.value);\n	return payload;\n}\nconst $ZodCustom = /* @__PURE__ */ $constructor(\"$ZodCustom\", (inst, def) => {\n	$ZodCheck.init(inst, def);\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload, _) => {\n		return payload;\n	};\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const r = def.fn(input);\n		if (r instanceof Promise) return r.then((r) => handleRefineResult(r, payload, input, inst));\n		handleRefineResult(r, payload, input, inst);\n	};\n});\nfunction handleRefineResult(result, payload, input, inst) {\n	if (!result) {\n		const _iss = {\n			code: \"custom\",\n			input,\n			inst,\n			path: [...inst._zod.def.path ?? []],\n			continue: !inst._zod.def.abort\n		};\n		if (inst._zod.def.params) _iss.params = inst._zod.def.params;\n		payload.issues.push(issue(_iss));\n	}\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/registries.js\nvar _a;\nvar $ZodRegistry = class {\n	constructor() {\n		this._map = /* @__PURE__ */ new WeakMap();\n		this._idmap = /* @__PURE__ */ new Map();\n	}\n	add(schema, ..._meta) {\n		const meta = _meta[0];\n		this._map.set(schema, meta);\n		if (meta && typeof meta === \"object\" && \"id\" in meta) this._idmap.set(meta.id, schema);\n		return this;\n	}\n	clear() {\n		this._map = /* @__PURE__ */ new WeakMap();\n		this._idmap = /* @__PURE__ */ new Map();\n		return this;\n	}\n	remove(schema) {\n		const meta = this._map.get(schema);\n		if (meta && typeof meta === \"object\" && \"id\" in meta) this._idmap.delete(meta.id);\n		this._map.delete(schema);\n		return this;\n	}\n	get(schema) {\n		const p = schema._zod.parent;\n		if (p) {\n			const pm = { ...this.get(p) ?? {} };\n			delete pm.id;\n			const f = {\n				...pm,\n				...this._map.get(schema)\n			};\n			return Object.keys(f).length ? f : void 0;\n		}\n		return this._map.get(schema);\n	}\n	has(schema) {\n		return this._map.has(schema);\n	}\n};\nfunction registry() {\n	return new $ZodRegistry();\n}\n(_a = globalThis).__zod_globalRegistry ?? (_a.__zod_globalRegistry = registry());\nconst globalRegistry = globalThis.__zod_globalRegistry;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/api.js\n/* @__NO_SIDE_EFFECTS__ */\nfunction _string(Class, params) {\n	return new Class({\n		type: \"string\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _email(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"email\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _guid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"guid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuidv4(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		version: \"v4\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuidv6(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		version: \"v6\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uuidv7(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"uuid\",\n		check: \"string_format\",\n		abort: false,\n		version: \"v7\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _url(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"url\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _emoji(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"emoji\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _nanoid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"nanoid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/**\n* @deprecated CUID v1 is deprecated by its authors due to information leakage\n* (timestamps embedded in the id). Use {@link _cuid2} instead.\n* See https://github.com/paralleldrive/cuid.\n*/\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cuid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cuid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cuid2(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cuid2\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ulid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ulid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _xid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"xid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ksuid(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ksuid\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ipv4(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ipv4\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _ipv6(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"ipv6\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cidrv4(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cidrv4\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _cidrv6(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"cidrv6\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _base64(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"base64\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _base64url(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"base64url\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _e164(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"e164\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _jwt(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"jwt\",\n		check: \"string_format\",\n		abort: false,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoDateTime(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"datetime\",\n		check: \"string_format\",\n		offset: false,\n		local: false,\n		precision: null,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoDate(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"date\",\n		check: \"string_format\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoTime(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"time\",\n		check: \"string_format\",\n		precision: null,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _isoDuration(Class, params) {\n	return new Class({\n		type: \"string\",\n		format: \"duration\",\n		check: \"string_format\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _unknown(Class) {\n	return new Class({ type: \"unknown\" });\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _never(Class, params) {\n	return new Class({\n		type: \"never\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _maxLength(maximum, params) {\n	return new $ZodCheckMaxLength({\n		check: \"max_length\",\n		...normalizeParams(params),\n		maximum\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _minLength(minimum, params) {\n	return new $ZodCheckMinLength({\n		check: \"min_length\",\n		...normalizeParams(params),\n		minimum\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _length(length, params) {\n	return new $ZodCheckLengthEquals({\n		check: \"length_equals\",\n		...normalizeParams(params),\n		length\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _regex(pattern, params) {\n	return new $ZodCheckRegex({\n		check: \"string_format\",\n		format: \"regex\",\n		...normalizeParams(params),\n		pattern\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _lowercase(params) {\n	return new $ZodCheckLowerCase({\n		check: \"string_format\",\n		format: \"lowercase\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _uppercase(params) {\n	return new $ZodCheckUpperCase({\n		check: \"string_format\",\n		format: \"uppercase\",\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _includes(includes, params) {\n	return new $ZodCheckIncludes({\n		check: \"string_format\",\n		format: \"includes\",\n		...normalizeParams(params),\n		includes\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _startsWith(prefix, params) {\n	return new $ZodCheckStartsWith({\n		check: \"string_format\",\n		format: \"starts_with\",\n		...normalizeParams(params),\n		prefix\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _endsWith(suffix, params) {\n	return new $ZodCheckEndsWith({\n		check: \"string_format\",\n		format: \"ends_with\",\n		...normalizeParams(params),\n		suffix\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _overwrite(tx) {\n	return new $ZodCheckOverwrite({\n		check: \"overwrite\",\n		tx\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _normalize(form) {\n	return /* @__PURE__ */ _overwrite((input) => input.normalize(form));\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _trim() {\n	return /* @__PURE__ */ _overwrite((input) => input.trim());\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _toLowerCase() {\n	return /* @__PURE__ */ _overwrite((input) => input.toLowerCase());\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _toUpperCase() {\n	return /* @__PURE__ */ _overwrite((input) => input.toUpperCase());\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _slugify() {\n	return /* @__PURE__ */ _overwrite((input) => slugify(input));\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _array(Class, element, params) {\n	return new Class({\n		type: \"array\",\n		element,\n		...normalizeParams(params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _refine(Class, fn, _params) {\n	return new Class({\n		type: \"custom\",\n		check: \"custom\",\n		fn,\n		...normalizeParams(_params)\n	});\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _superRefine(fn, params) {\n	const ch = /* @__PURE__ */ _check((payload) => {\n		payload.addIssue = (issue$2) => {\n			if (typeof issue$2 === \"string\") payload.issues.push(issue(issue$2, payload.value, ch._zod.def));\n			else {\n				const _issue = issue$2;\n				if (_issue.fatal) _issue.continue = false;\n				_issue.code ?? (_issue.code = \"custom\");\n				_issue.input ?? (_issue.input = payload.value);\n				_issue.inst ?? (_issue.inst = ch);\n				_issue.continue ?? (_issue.continue = !ch._zod.def.abort);\n				payload.issues.push(issue(_issue));\n			}\n		};\n		return fn(payload.value, payload);\n	}, params);\n	return ch;\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction _check(fn, params) {\n	const ch = new $ZodCheck({\n		check: \"custom\",\n		...normalizeParams(params)\n	});\n	ch._zod.check = fn;\n	return ch;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/to-json-schema.js\nfunction initializeContext(params) {\n	let target = params?.target ?? \"draft-2020-12\";\n	if (target === \"draft-4\") target = \"draft-04\";\n	if (target === \"draft-7\") target = \"draft-07\";\n	return {\n		processors: params.processors ?? {},\n		metadataRegistry: params?.metadata ?? globalRegistry,\n		target,\n		unrepresentable: params?.unrepresentable ?? \"throw\",\n		override: params?.override ?? (() => {}),\n		io: params?.io ?? \"output\",\n		counter: 0,\n		seen: /* @__PURE__ */ new Map(),\n		cycles: params?.cycles ?? \"ref\",\n		reused: params?.reused ?? \"inline\",\n		external: params?.external ?? void 0\n	};\n}\nfunction process$1(schema, ctx, _params = {\n	path: [],\n	schemaPath: []\n}) {\n	var _a;\n	const def = schema._zod.def;\n	const seen = ctx.seen.get(schema);\n	if (seen) {\n		seen.count++;\n		if (_params.schemaPath.includes(schema)) seen.cycle = _params.path;\n		return seen.schema;\n	}\n	const result = {\n		schema: {},\n		count: 1,\n		cycle: void 0,\n		path: _params.path\n	};\n	ctx.seen.set(schema, result);\n	const overrideSchema = schema._zod.toJSONSchema?.();\n	if (overrideSchema) result.schema = overrideSchema;\n	else {\n		const params = {\n			..._params,\n			schemaPath: [..._params.schemaPath, schema],\n			path: _params.path\n		};\n		if (schema._zod.processJSONSchema) schema._zod.processJSONSchema(ctx, result.schema, params);\n		else {\n			const _json = result.schema;\n			const processor = ctx.processors[def.type];\n			if (!processor) throw new Error(`[toJSONSchema]: Non-representable type encountered: ${def.type}`);\n			processor(schema, ctx, _json, params);\n		}\n		const parent = schema._zod.parent;\n		if (parent) {\n			if (!result.ref) result.ref = parent;\n			process$1(parent, ctx, params);\n			ctx.seen.get(parent).isParent = true;\n		}\n	}\n	const meta = ctx.metadataRegistry.get(schema);\n	if (meta) Object.assign(result.schema, meta);\n	if (ctx.io === \"input\" && isTransforming(schema)) {\n		delete result.schema.examples;\n		delete result.schema.default;\n	}\n	if (ctx.io === \"input\" && \"_prefault\" in result.schema) (_a = result.schema).default ?? (_a.default = result.schema._prefault);\n	delete result.schema._prefault;\n	return ctx.seen.get(schema).schema;\n}\nfunction extractDefs(ctx, schema) {\n	const root = ctx.seen.get(schema);\n	if (!root) throw new Error(\"Unprocessed schema. This is a bug in Zod.\");\n	const idToSchema = /* @__PURE__ */ new Map();\n	for (const entry of ctx.seen.entries()) {\n		const id = ctx.metadataRegistry.get(entry[0])?.id;\n		if (id) {\n			const existing = idToSchema.get(id);\n			if (existing && existing !== entry[0]) throw new Error(`Duplicate schema id \"${id}\" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);\n			idToSchema.set(id, entry[0]);\n		}\n	}\n	const makeURI = (entry) => {\n		const defsSegment = ctx.target === \"draft-2020-12\" ? \"$defs\" : \"definitions\";\n		if (ctx.external) {\n			const externalId = ctx.external.registry.get(entry[0])?.id;\n			const uriGenerator = ctx.external.uri ?? ((id) => id);\n			if (externalId) return { ref: uriGenerator(externalId) };\n			const id = entry[1].defId ?? entry[1].schema.id ?? `schema${ctx.counter++}`;\n			entry[1].defId = id;\n			return {\n				defId: id,\n				ref: `${uriGenerator(\"__shared\")}#/${defsSegment}/${id}`\n			};\n		}\n		if (entry[1] === root) return { ref: \"#\" };\n		const defUriPrefix = `#/${defsSegment}/`;\n		const defId = entry[1].schema.id ?? `__schema${ctx.counter++}`;\n		return {\n			defId,\n			ref: defUriPrefix + defId\n		};\n	};\n	const extractToDef = (entry) => {\n		if (entry[1].schema.$ref) return;\n		const seen = entry[1];\n		const { ref, defId } = makeURI(entry);\n		seen.def = { ...seen.schema };\n		if (defId) seen.defId = defId;\n		const schema = seen.schema;\n		for (const key in schema) delete schema[key];\n		schema.$ref = ref;\n	};\n	if (ctx.cycles === \"throw\") for (const entry of ctx.seen.entries()) {\n		const seen = entry[1];\n		if (seen.cycle) throw new Error(`Cycle detected: #/${seen.cycle?.join(\"/\")}/<root>\n\nSet the \\`cycles\\` parameter to \\`\"ref\"\\` to resolve cyclical schemas with defs.`);\n	}\n	for (const entry of ctx.seen.entries()) {\n		const seen = entry[1];\n		if (schema === entry[0]) {\n			extractToDef(entry);\n			continue;\n		}\n		if (ctx.external) {\n			const ext = ctx.external.registry.get(entry[0])?.id;\n			if (schema !== entry[0] && ext) {\n				extractToDef(entry);\n				continue;\n			}\n		}\n		if (ctx.metadataRegistry.get(entry[0])?.id) {\n			extractToDef(entry);\n			continue;\n		}\n		if (seen.cycle) {\n			extractToDef(entry);\n			continue;\n		}\n		if (seen.count > 1) {\n			if (ctx.reused === \"ref\") {\n				extractToDef(entry);\n				continue;\n			}\n		}\n	}\n}\nfunction finalize(ctx, schema) {\n	const root = ctx.seen.get(schema);\n	if (!root) throw new Error(\"Unprocessed schema. This is a bug in Zod.\");\n	const flattenRef = (zodSchema) => {\n		const seen = ctx.seen.get(zodSchema);\n		if (seen.ref === null) return;\n		const schema = seen.def ?? seen.schema;\n		const _cached = { ...schema };\n		const ref = seen.ref;\n		seen.ref = null;\n		if (ref) {\n			flattenRef(ref);\n			const refSeen = ctx.seen.get(ref);\n			const refSchema = refSeen.schema;\n			if (refSchema.$ref && (ctx.target === \"draft-07\" || ctx.target === \"draft-04\" || ctx.target === \"openapi-3.0\")) {\n				schema.allOf = schema.allOf ?? [];\n				schema.allOf.push(refSchema);\n			} else Object.assign(schema, refSchema);\n			Object.assign(schema, _cached);\n			if (zodSchema._zod.parent === ref) for (const key in schema) {\n				if (key === \"$ref\" || key === \"allOf\") continue;\n				if (!(key in _cached)) delete schema[key];\n			}\n			if (refSchema.$ref && refSeen.def) for (const key in schema) {\n				if (key === \"$ref\" || key === \"allOf\") continue;\n				if (key in refSeen.def && JSON.stringify(schema[key]) === JSON.stringify(refSeen.def[key])) delete schema[key];\n			}\n		}\n		const parent = zodSchema._zod.parent;\n		if (parent && parent !== ref) {\n			flattenRef(parent);\n			const parentSeen = ctx.seen.get(parent);\n			if (parentSeen?.schema.$ref) {\n				schema.$ref = parentSeen.schema.$ref;\n				if (parentSeen.def) for (const key in schema) {\n					if (key === \"$ref\" || key === \"allOf\") continue;\n					if (key in parentSeen.def && JSON.stringify(schema[key]) === JSON.stringify(parentSeen.def[key])) delete schema[key];\n				}\n			}\n		}\n		ctx.override({\n			zodSchema,\n			jsonSchema: schema,\n			path: seen.path ?? []\n		});\n	};\n	for (const entry of [...ctx.seen.entries()].reverse()) flattenRef(entry[0]);\n	const result = {};\n	if (ctx.target === \"draft-2020-12\") result.$schema = \"https://json-schema.org/draft/2020-12/schema\";\n	else if (ctx.target === \"draft-07\") result.$schema = \"http://json-schema.org/draft-07/schema#\";\n	else if (ctx.target === \"draft-04\") result.$schema = \"http://json-schema.org/draft-04/schema#\";\n	else if (ctx.target === \"openapi-3.0\") {}\n	if (ctx.external?.uri) {\n		const id = ctx.external.registry.get(schema)?.id;\n		if (!id) throw new Error(\"Schema is missing an `id` property\");\n		result.$id = ctx.external.uri(id);\n	}\n	Object.assign(result, root.def ?? root.schema);\n	const rootMetaId = ctx.metadataRegistry.get(schema)?.id;\n	if (rootMetaId !== void 0 && result.id === rootMetaId) delete result.id;\n	const defs = ctx.external?.defs ?? {};\n	for (const entry of ctx.seen.entries()) {\n		const seen = entry[1];\n		if (seen.def && seen.defId) {\n			if (seen.def.id === seen.defId) delete seen.def.id;\n			defs[seen.defId] = seen.def;\n		}\n	}\n	if (ctx.external) {} else if (Object.keys(defs).length > 0) if (ctx.target === \"draft-2020-12\") result.$defs = defs;\n	else result.definitions = defs;\n	try {\n		const finalized = JSON.parse(JSON.stringify(result));\n		Object.defineProperty(finalized, \"~standard\", {\n			value: {\n				...schema[\"~standard\"],\n				jsonSchema: {\n					input: createStandardJSONSchemaMethod(schema, \"input\", ctx.processors),\n					output: createStandardJSONSchemaMethod(schema, \"output\", ctx.processors)\n				}\n			},\n			enumerable: false,\n			writable: false\n		});\n		return finalized;\n	} catch (_err) {\n		throw new Error(\"Error converting schema to JSON.\");\n	}\n}\nfunction isTransforming(_schema, _ctx) {\n	const ctx = _ctx ?? { seen: /* @__PURE__ */ new Set() };\n	if (ctx.seen.has(_schema)) return false;\n	ctx.seen.add(_schema);\n	const def = _schema._zod.def;\n	if (def.type === \"transform\") return true;\n	if (def.type === \"array\") return isTransforming(def.element, ctx);\n	if (def.type === \"set\") return isTransforming(def.valueType, ctx);\n	if (def.type === \"lazy\") return isTransforming(def.getter(), ctx);\n	if (def.type === \"promise\" || def.type === \"optional\" || def.type === \"nonoptional\" || def.type === \"nullable\" || def.type === \"readonly\" || def.type === \"default\" || def.type === \"prefault\") return isTransforming(def.innerType, ctx);\n	if (def.type === \"intersection\") return isTransforming(def.left, ctx) || isTransforming(def.right, ctx);\n	if (def.type === \"record\" || def.type === \"map\") return isTransforming(def.keyType, ctx) || isTransforming(def.valueType, ctx);\n	if (def.type === \"pipe\") return isTransforming(def.in, ctx) || isTransforming(def.out, ctx);\n	if (def.type === \"object\") {\n		for (const key in def.shape) if (isTransforming(def.shape[key], ctx)) return true;\n		return false;\n	}\n	if (def.type === \"union\") {\n		for (const option of def.options) if (isTransforming(option, ctx)) return true;\n		return false;\n	}\n	if (def.type === \"tuple\") {\n		for (const item of def.items) if (isTransforming(item, ctx)) return true;\n		if (def.rest && isTransforming(def.rest, ctx)) return true;\n		return false;\n	}\n	return false;\n}\n/**\n* Creates a toJSONSchema method for a schema instance.\n* This encapsulates the logic of initializing context, processing, extracting defs, and finalizing.\n*/\nconst createToJSONSchemaMethod = (schema, processors = {}) => (params) => {\n	const ctx = initializeContext({\n		...params,\n		processors\n	});\n	process$1(schema, ctx);\n	extractDefs(ctx, schema);\n	return finalize(ctx, schema);\n};\nconst createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {\n	const { libraryOptions, target } = params ?? {};\n	const ctx = initializeContext({\n		...libraryOptions ?? {},\n		target,\n		io,\n		processors\n	});\n	process$1(schema, ctx);\n	extractDefs(ctx, schema);\n	return finalize(ctx, schema);\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/core/json-schema-processors.js\nconst formatMap = {\n	guid: \"uuid\",\n	url: \"uri\",\n	datetime: \"date-time\",\n	json_string: \"json-string\",\n	regex: \"\"\n};\nconst stringProcessor = (schema, ctx, _json, _params) => {\n	const json = _json;\n	json.type = \"string\";\n	const { minimum, maximum, format, patterns, contentEncoding } = schema._zod.bag;\n	if (typeof minimum === \"number\") json.minLength = minimum;\n	if (typeof maximum === \"number\") json.maxLength = maximum;\n	if (format) {\n		json.format = formatMap[format] ?? format;\n		if (json.format === \"\") delete json.format;\n		if (format === \"time\") delete json.format;\n	}\n	if (contentEncoding) json.contentEncoding = contentEncoding;\n	if (patterns && patterns.size > 0) {\n		const regexes = [...patterns];\n		if (regexes.length === 1) json.pattern = regexes[0].source;\n		else if (regexes.length > 1) json.allOf = [...regexes.map((regex) => ({\n			...ctx.target === \"draft-07\" || ctx.target === \"draft-04\" || ctx.target === \"openapi-3.0\" ? { type: \"string\" } : {},\n			pattern: regex.source\n		}))];\n	}\n};\nconst neverProcessor = (_schema, _ctx, json, _params) => {\n	json.not = {};\n};\nconst unknownProcessor = (_schema, _ctx, _json, _params) => {};\nconst enumProcessor = (schema, _ctx, json, _params) => {\n	const def = schema._zod.def;\n	const values = getEnumValues(def.entries);\n	if (values.every((v) => typeof v === \"number\")) json.type = \"number\";\n	if (values.every((v) => typeof v === \"string\")) json.type = \"string\";\n	json.enum = values;\n};\nconst customProcessor = (_schema, ctx, _json, _params) => {\n	if (ctx.unrepresentable === \"throw\") throw new Error(\"Custom types cannot be represented in JSON Schema\");\n};\nconst transformProcessor = (_schema, ctx, _json, _params) => {\n	if (ctx.unrepresentable === \"throw\") throw new Error(\"Transforms cannot be represented in JSON Schema\");\n};\nconst arrayProcessor = (schema, ctx, _json, params) => {\n	const json = _json;\n	const def = schema._zod.def;\n	const { minimum, maximum } = schema._zod.bag;\n	if (typeof minimum === \"number\") json.minItems = minimum;\n	if (typeof maximum === \"number\") json.maxItems = maximum;\n	json.type = \"array\";\n	json.items = process$1(def.element, ctx, {\n		...params,\n		path: [...params.path, \"items\"]\n	});\n};\nconst objectProcessor = (schema, ctx, _json, params) => {\n	const json = _json;\n	const def = schema._zod.def;\n	json.type = \"object\";\n	json.properties = {};\n	const shape = def.shape;\n	for (const key in shape) json.properties[key] = process$1(shape[key], ctx, {\n		...params,\n		path: [\n			...params.path,\n			\"properties\",\n			key\n		]\n	});\n	const allKeys = new Set(Object.keys(shape));\n	const requiredKeys = new Set([...allKeys].filter((key) => {\n		const v = def.shape[key]._zod;\n		if (ctx.io === \"input\") return v.optin === void 0;\n		else return v.optout === void 0;\n	}));\n	if (requiredKeys.size > 0) json.required = Array.from(requiredKeys);\n	if (def.catchall?._zod.def.type === \"never\") json.additionalProperties = false;\n	else if (!def.catchall) {\n		if (ctx.io === \"output\") json.additionalProperties = false;\n	} else if (def.catchall) json.additionalProperties = process$1(def.catchall, ctx, {\n		...params,\n		path: [...params.path, \"additionalProperties\"]\n	});\n};\nconst unionProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	const isExclusive = def.inclusive === false;\n	const options = def.options.map((x, i) => process$1(x, ctx, {\n		...params,\n		path: [\n			...params.path,\n			isExclusive ? \"oneOf\" : \"anyOf\",\n			i\n		]\n	}));\n	if (isExclusive) json.oneOf = options;\n	else json.anyOf = options;\n};\nconst intersectionProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	const a = process$1(def.left, ctx, {\n		...params,\n		path: [\n			...params.path,\n			\"allOf\",\n			0\n		]\n	});\n	const b = process$1(def.right, ctx, {\n		...params,\n		path: [\n			...params.path,\n			\"allOf\",\n			1\n		]\n	});\n	const isSimpleIntersection = (val) => \"allOf\" in val && Object.keys(val).length === 1;\n	json.allOf = [...isSimpleIntersection(a) ? a.allOf : [a], ...isSimpleIntersection(b) ? b.allOf : [b]];\n};\nconst recordProcessor = (schema, ctx, _json, params) => {\n	const json = _json;\n	const def = schema._zod.def;\n	json.type = \"object\";\n	const keyType = def.keyType;\n	const patterns = keyType._zod.bag?.patterns;\n	if (def.mode === \"loose\" && patterns && patterns.size > 0) {\n		const valueSchema = process$1(def.valueType, ctx, {\n			...params,\n			path: [\n				...params.path,\n				\"patternProperties\",\n				\"*\"\n			]\n		});\n		json.patternProperties = {};\n		for (const pattern of patterns) json.patternProperties[pattern.source] = valueSchema;\n	} else {\n		if (ctx.target === \"draft-07\" || ctx.target === \"draft-2020-12\") json.propertyNames = process$1(def.keyType, ctx, {\n			...params,\n			path: [...params.path, \"propertyNames\"]\n		});\n		json.additionalProperties = process$1(def.valueType, ctx, {\n			...params,\n			path: [...params.path, \"additionalProperties\"]\n		});\n	}\n	const keyValues = keyType._zod.values;\n	if (keyValues) {\n		const validKeyValues = [...keyValues].filter((v) => typeof v === \"string\" || typeof v === \"number\");\n		if (validKeyValues.length > 0) json.required = validKeyValues;\n	}\n};\nconst nullableProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	const inner = process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	if (ctx.target === \"openapi-3.0\") {\n		seen.ref = def.innerType;\n		json.nullable = true;\n	} else json.anyOf = [inner, { type: \"null\" }];\n};\nconst nonoptionalProcessor = (schema, ctx, _json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n};\nconst defaultProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	json.default = JSON.parse(JSON.stringify(def.defaultValue));\n};\nconst prefaultProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	if (ctx.io === \"input\") json._prefault = JSON.parse(JSON.stringify(def.defaultValue));\n};\nconst catchProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	let catchValue;\n	try {\n		catchValue = def.catchValue(void 0);\n	} catch {\n		throw new Error(\"Dynamic catch values are not supported in JSON Schema\");\n	}\n	json.default = catchValue;\n};\nconst pipeProcessor = (schema, ctx, _json, params) => {\n	const def = schema._zod.def;\n	const innerType = ctx.io === \"input\" ? def.in._zod.def.type === \"transform\" ? def.out : def.in : def.out;\n	process$1(innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = innerType;\n};\nconst readonlyProcessor = (schema, ctx, json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n	json.readOnly = true;\n};\nconst optionalProcessor = (schema, ctx, _json, params) => {\n	const def = schema._zod.def;\n	process$1(def.innerType, ctx, params);\n	const seen = ctx.seen.get(schema);\n	seen.ref = def.innerType;\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/classic/iso.js\nconst ZodISODateTime = /* @__PURE__ */ $constructor(\"ZodISODateTime\", (inst, def) => {\n	$ZodISODateTime.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction datetime(params) {\n	return _isoDateTime(ZodISODateTime, params);\n}\nconst ZodISODate = /* @__PURE__ */ $constructor(\"ZodISODate\", (inst, def) => {\n	$ZodISODate.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction date(params) {\n	return _isoDate(ZodISODate, params);\n}\nconst ZodISOTime = /* @__PURE__ */ $constructor(\"ZodISOTime\", (inst, def) => {\n	$ZodISOTime.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction time(params) {\n	return _isoTime(ZodISOTime, params);\n}\nconst ZodISODuration = /* @__PURE__ */ $constructor(\"ZodISODuration\", (inst, def) => {\n	$ZodISODuration.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nfunction duration(params) {\n	return _isoDuration(ZodISODuration, params);\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/classic/errors.js\nconst initializer = (inst, issues) => {\n	$ZodError.init(inst, issues);\n	inst.name = \"ZodError\";\n	Object.defineProperties(inst, {\n		format: { value: (mapper) => formatError(inst, mapper) },\n		flatten: { value: (mapper) => flattenError(inst, mapper) },\n		addIssue: { value: (issue) => {\n			inst.issues.push(issue);\n			inst.message = JSON.stringify(inst.issues, jsonStringifyReplacer, 2);\n		} },\n		addIssues: { value: (issues) => {\n			inst.issues.push(...issues);\n			inst.message = JSON.stringify(inst.issues, jsonStringifyReplacer, 2);\n		} },\n		isEmpty: { get() {\n			return inst.issues.length === 0;\n		} }\n	});\n};\nconst ZodRealError = /* @__PURE__ */ $constructor(\"ZodError\", initializer, { Parent: Error });\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/classic/parse.js\nconst parse = /* @__PURE__ */ _parse(ZodRealError);\nconst parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);\nconst safeParse = /* @__PURE__ */ _safeParse(ZodRealError);\nconst safeParseAsync = /* @__PURE__ */ _safeParseAsync(ZodRealError);\nconst encode = /* @__PURE__ */ _encode(ZodRealError);\nconst decode = /* @__PURE__ */ _decode(ZodRealError);\nconst encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);\nconst decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);\nconst safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);\nconst safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);\nconst safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);\nconst safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/classic/schemas.js\nconst _installedGroups = /* @__PURE__ */ new WeakMap();\nfunction _installLazyMethods(inst, group, methods) {\n	const proto = Object.getPrototypeOf(inst);\n	let installed = _installedGroups.get(proto);\n	if (!installed) {\n		installed = /* @__PURE__ */ new Set();\n		_installedGroups.set(proto, installed);\n	}\n	if (installed.has(group)) return;\n	installed.add(group);\n	for (const key in methods) {\n		const fn = methods[key];\n		Object.defineProperty(proto, key, {\n			configurable: true,\n			enumerable: false,\n			get() {\n				const bound = fn.bind(this);\n				Object.defineProperty(this, key, {\n					configurable: true,\n					writable: true,\n					enumerable: true,\n					value: bound\n				});\n				return bound;\n			},\n			set(v) {\n				Object.defineProperty(this, key, {\n					configurable: true,\n					writable: true,\n					enumerable: true,\n					value: v\n				});\n			}\n		});\n	}\n}\nconst ZodType = /* @__PURE__ */ $constructor(\"ZodType\", (inst, def) => {\n	$ZodType.init(inst, def);\n	Object.assign(inst[\"~standard\"], { jsonSchema: {\n		input: createStandardJSONSchemaMethod(inst, \"input\"),\n		output: createStandardJSONSchemaMethod(inst, \"output\")\n	} });\n	inst.toJSONSchema = createToJSONSchemaMethod(inst, {});\n	inst.def = def;\n	inst.type = def.type;\n	Object.defineProperty(inst, \"_def\", { value: def });\n	inst.parse = (data, params) => parse(inst, data, params, { callee: inst.parse });\n	inst.safeParse = (data, params) => safeParse(inst, data, params);\n	inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });\n	inst.safeParseAsync = async (data, params) => safeParseAsync(inst, data, params);\n	inst.spa = inst.safeParseAsync;\n	inst.encode = (data, params) => encode(inst, data, params);\n	inst.decode = (data, params) => decode(inst, data, params);\n	inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);\n	inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);\n	inst.safeEncode = (data, params) => safeEncode(inst, data, params);\n	inst.safeDecode = (data, params) => safeDecode(inst, data, params);\n	inst.safeEncodeAsync = async (data, params) => safeEncodeAsync(inst, data, params);\n	inst.safeDecodeAsync = async (data, params) => safeDecodeAsync(inst, data, params);\n	_installLazyMethods(inst, \"ZodType\", {\n		check(...chks) {\n			const def = this.def;\n			return this.clone(mergeDefs(def, { checks: [...def.checks ?? [], ...chks.map((ch) => typeof ch === \"function\" ? { _zod: {\n				check: ch,\n				def: { check: \"custom\" },\n				onattach: []\n			} } : ch)] }), { parent: true });\n		},\n		with(...chks) {\n			return this.check(...chks);\n		},\n		clone(def, params) {\n			return clone(this, def, params);\n		},\n		brand() {\n			return this;\n		},\n		register(reg, meta) {\n			reg.add(this, meta);\n			return this;\n		},\n		refine(check, params) {\n			return this.check(refine(check, params));\n		},\n		superRefine(refinement, params) {\n			return this.check(superRefine(refinement, params));\n		},\n		overwrite(fn) {\n			return this.check(_overwrite(fn));\n		},\n		optional() {\n			return optional(this);\n		},\n		exactOptional() {\n			return exactOptional(this);\n		},\n		nullable() {\n			return nullable(this);\n		},\n		nullish() {\n			return optional(nullable(this));\n		},\n		nonoptional(params) {\n			return nonoptional(this, params);\n		},\n		array() {\n			return array(this);\n		},\n		or(arg) {\n			return union([this, arg]);\n		},\n		and(arg) {\n			return intersection(this, arg);\n		},\n		transform(tx) {\n			return pipe(this, transform(tx));\n		},\n		default(d) {\n			return _default(this, d);\n		},\n		prefault(d) {\n			return prefault(this, d);\n		},\n		catch(params) {\n			return _catch(this, params);\n		},\n		pipe(target) {\n			return pipe(this, target);\n		},\n		readonly() {\n			return readonly(this);\n		},\n		describe(description) {\n			const cl = this.clone();\n			globalRegistry.add(cl, { description });\n			return cl;\n		},\n		meta(...args) {\n			if (args.length === 0) return globalRegistry.get(this);\n			const cl = this.clone();\n			globalRegistry.add(cl, args[0]);\n			return cl;\n		},\n		isOptional() {\n			return this.safeParse(void 0).success;\n		},\n		isNullable() {\n			return this.safeParse(null).success;\n		},\n		apply(fn) {\n			return fn(this);\n		}\n	});\n	Object.defineProperty(inst, \"description\", {\n		get() {\n			return globalRegistry.get(inst)?.description;\n		},\n		configurable: true\n	});\n	return inst;\n});\n/** @internal */\nconst _ZodString = /* @__PURE__ */ $constructor(\"_ZodString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => stringProcessor(inst, ctx, json, params);\n	const bag = inst._zod.bag;\n	inst.format = bag.format ?? null;\n	inst.minLength = bag.minimum ?? null;\n	inst.maxLength = bag.maximum ?? null;\n	_installLazyMethods(inst, \"_ZodString\", {\n		regex(...args) {\n			return this.check(_regex(...args));\n		},\n		includes(...args) {\n			return this.check(_includes(...args));\n		},\n		startsWith(...args) {\n			return this.check(_startsWith(...args));\n		},\n		endsWith(...args) {\n			return this.check(_endsWith(...args));\n		},\n		min(...args) {\n			return this.check(_minLength(...args));\n		},\n		max(...args) {\n			return this.check(_maxLength(...args));\n		},\n		length(...args) {\n			return this.check(_length(...args));\n		},\n		nonempty(...args) {\n			return this.check(_minLength(1, ...args));\n		},\n		lowercase(params) {\n			return this.check(_lowercase(params));\n		},\n		uppercase(params) {\n			return this.check(_uppercase(params));\n		},\n		trim() {\n			return this.check(_trim());\n		},\n		normalize(...args) {\n			return this.check(_normalize(...args));\n		},\n		toLowerCase() {\n			return this.check(_toLowerCase());\n		},\n		toUpperCase() {\n			return this.check(_toUpperCase());\n		},\n		slugify() {\n			return this.check(_slugify());\n		}\n	});\n});\nconst ZodString = /* @__PURE__ */ $constructor(\"ZodString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	_ZodString.init(inst, def);\n	inst.email = (params) => inst.check(_email(ZodEmail, params));\n	inst.url = (params) => inst.check(_url(ZodURL, params));\n	inst.jwt = (params) => inst.check(_jwt(ZodJWT, params));\n	inst.emoji = (params) => inst.check(_emoji(ZodEmoji, params));\n	inst.guid = (params) => inst.check(_guid(ZodGUID, params));\n	inst.uuid = (params) => inst.check(_uuid(ZodUUID, params));\n	inst.uuidv4 = (params) => inst.check(_uuidv4(ZodUUID, params));\n	inst.uuidv6 = (params) => inst.check(_uuidv6(ZodUUID, params));\n	inst.uuidv7 = (params) => inst.check(_uuidv7(ZodUUID, params));\n	inst.nanoid = (params) => inst.check(_nanoid(ZodNanoID, params));\n	inst.guid = (params) => inst.check(_guid(ZodGUID, params));\n	inst.cuid = (params) => inst.check(_cuid(ZodCUID, params));\n	inst.cuid2 = (params) => inst.check(_cuid2(ZodCUID2, params));\n	inst.ulid = (params) => inst.check(_ulid(ZodULID, params));\n	inst.base64 = (params) => inst.check(_base64(ZodBase64, params));\n	inst.base64url = (params) => inst.check(_base64url(ZodBase64URL, params));\n	inst.xid = (params) => inst.check(_xid(ZodXID, params));\n	inst.ksuid = (params) => inst.check(_ksuid(ZodKSUID, params));\n	inst.ipv4 = (params) => inst.check(_ipv4(ZodIPv4, params));\n	inst.ipv6 = (params) => inst.check(_ipv6(ZodIPv6, params));\n	inst.cidrv4 = (params) => inst.check(_cidrv4(ZodCIDRv4, params));\n	inst.cidrv6 = (params) => inst.check(_cidrv6(ZodCIDRv6, params));\n	inst.e164 = (params) => inst.check(_e164(ZodE164, params));\n	inst.datetime = (params) => inst.check(datetime(params));\n	inst.date = (params) => inst.check(date(params));\n	inst.time = (params) => inst.check(time(params));\n	inst.duration = (params) => inst.check(duration(params));\n});\nfunction string(params) {\n	return _string(ZodString, params);\n}\nconst ZodStringFormat = /* @__PURE__ */ $constructor(\"ZodStringFormat\", (inst, def) => {\n	$ZodStringFormat.init(inst, def);\n	_ZodString.init(inst, def);\n});\nconst ZodEmail = /* @__PURE__ */ $constructor(\"ZodEmail\", (inst, def) => {\n	$ZodEmail.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodGUID = /* @__PURE__ */ $constructor(\"ZodGUID\", (inst, def) => {\n	$ZodGUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodUUID = /* @__PURE__ */ $constructor(\"ZodUUID\", (inst, def) => {\n	$ZodUUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodURL = /* @__PURE__ */ $constructor(\"ZodURL\", (inst, def) => {\n	$ZodURL.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodEmoji = /* @__PURE__ */ $constructor(\"ZodEmoji\", (inst, def) => {\n	$ZodEmoji.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodNanoID = /* @__PURE__ */ $constructor(\"ZodNanoID\", (inst, def) => {\n	$ZodNanoID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\n/**\n* @deprecated CUID v1 is deprecated by its authors due to information leakage\n* (timestamps embedded in the id). Use {@link ZodCUID2} instead.\n* See https://github.com/paralleldrive/cuid.\n*/\nconst ZodCUID = /* @__PURE__ */ $constructor(\"ZodCUID\", (inst, def) => {\n	$ZodCUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodCUID2 = /* @__PURE__ */ $constructor(\"ZodCUID2\", (inst, def) => {\n	$ZodCUID2.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodULID = /* @__PURE__ */ $constructor(\"ZodULID\", (inst, def) => {\n	$ZodULID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodXID = /* @__PURE__ */ $constructor(\"ZodXID\", (inst, def) => {\n	$ZodXID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodKSUID = /* @__PURE__ */ $constructor(\"ZodKSUID\", (inst, def) => {\n	$ZodKSUID.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodIPv4 = /* @__PURE__ */ $constructor(\"ZodIPv4\", (inst, def) => {\n	$ZodIPv4.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodIPv6 = /* @__PURE__ */ $constructor(\"ZodIPv6\", (inst, def) => {\n	$ZodIPv6.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodCIDRv4 = /* @__PURE__ */ $constructor(\"ZodCIDRv4\", (inst, def) => {\n	$ZodCIDRv4.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodCIDRv6 = /* @__PURE__ */ $constructor(\"ZodCIDRv6\", (inst, def) => {\n	$ZodCIDRv6.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodBase64 = /* @__PURE__ */ $constructor(\"ZodBase64\", (inst, def) => {\n	$ZodBase64.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodBase64URL = /* @__PURE__ */ $constructor(\"ZodBase64URL\", (inst, def) => {\n	$ZodBase64URL.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodE164 = /* @__PURE__ */ $constructor(\"ZodE164\", (inst, def) => {\n	$ZodE164.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodJWT = /* @__PURE__ */ $constructor(\"ZodJWT\", (inst, def) => {\n	$ZodJWT.init(inst, def);\n	ZodStringFormat.init(inst, def);\n});\nconst ZodUnknown = /* @__PURE__ */ $constructor(\"ZodUnknown\", (inst, def) => {\n	$ZodUnknown.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => unknownProcessor(inst, ctx, json, params);\n});\nfunction unknown() {\n	return _unknown(ZodUnknown);\n}\nconst ZodNever = /* @__PURE__ */ $constructor(\"ZodNever\", (inst, def) => {\n	$ZodNever.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => neverProcessor(inst, ctx, json, params);\n});\nfunction never(params) {\n	return _never(ZodNever, params);\n}\nconst ZodArray = /* @__PURE__ */ $constructor(\"ZodArray\", (inst, def) => {\n	$ZodArray.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => arrayProcessor(inst, ctx, json, params);\n	inst.element = def.element;\n	_installLazyMethods(inst, \"ZodArray\", {\n		min(n, params) {\n			return this.check(_minLength(n, params));\n		},\n		nonempty(params) {\n			return this.check(_minLength(1, params));\n		},\n		max(n, params) {\n			return this.check(_maxLength(n, params));\n		},\n		length(n, params) {\n			return this.check(_length(n, params));\n		},\n		unwrap() {\n			return this.element;\n		}\n	});\n});\nfunction array(element, params) {\n	return _array(ZodArray, element, params);\n}\nconst ZodObject = /* @__PURE__ */ $constructor(\"ZodObject\", (inst, def) => {\n	$ZodObjectJIT.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => objectProcessor(inst, ctx, json, params);\n	defineLazy(inst, \"shape\", () => {\n		return def.shape;\n	});\n	_installLazyMethods(inst, \"ZodObject\", {\n		keyof() {\n			return _enum(Object.keys(this._zod.def.shape));\n		},\n		catchall(catchall) {\n			return this.clone({\n				...this._zod.def,\n				catchall\n			});\n		},\n		passthrough() {\n			return this.clone({\n				...this._zod.def,\n				catchall: unknown()\n			});\n		},\n		loose() {\n			return this.clone({\n				...this._zod.def,\n				catchall: unknown()\n			});\n		},\n		strict() {\n			return this.clone({\n				...this._zod.def,\n				catchall: never()\n			});\n		},\n		strip() {\n			return this.clone({\n				...this._zod.def,\n				catchall: void 0\n			});\n		},\n		extend(incoming) {\n			return extend(this, incoming);\n		},\n		safeExtend(incoming) {\n			return safeExtend(this, incoming);\n		},\n		merge(other) {\n			return merge(this, other);\n		},\n		pick(mask) {\n			return pick(this, mask);\n		},\n		omit(mask) {\n			return omit(this, mask);\n		},\n		partial(...args) {\n			return partial(ZodOptional, this, args[0]);\n		},\n		required(...args) {\n			return required(ZodNonOptional, this, args[0]);\n		}\n	});\n});\nfunction object(shape, params) {\n	return new ZodObject({\n		type: \"object\",\n		shape: shape ?? {},\n		...normalizeParams(params)\n	});\n}\nconst ZodUnion = /* @__PURE__ */ $constructor(\"ZodUnion\", (inst, def) => {\n	$ZodUnion.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => unionProcessor(inst, ctx, json, params);\n	inst.options = def.options;\n});\nfunction union(options, params) {\n	return new ZodUnion({\n		type: \"union\",\n		options,\n		...normalizeParams(params)\n	});\n}\nconst ZodIntersection = /* @__PURE__ */ $constructor(\"ZodIntersection\", (inst, def) => {\n	$ZodIntersection.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => intersectionProcessor(inst, ctx, json, params);\n});\nfunction intersection(left, right) {\n	return new ZodIntersection({\n		type: \"intersection\",\n		left,\n		right\n	});\n}\nconst ZodRecord = /* @__PURE__ */ $constructor(\"ZodRecord\", (inst, def) => {\n	$ZodRecord.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => recordProcessor(inst, ctx, json, params);\n	inst.keyType = def.keyType;\n	inst.valueType = def.valueType;\n});\nfunction record(keyType, valueType, params) {\n	if (!valueType || !valueType._zod) return new ZodRecord({\n		type: \"record\",\n		keyType: string(),\n		valueType: keyType,\n		...normalizeParams(valueType)\n	});\n	return new ZodRecord({\n		type: \"record\",\n		keyType,\n		valueType,\n		...normalizeParams(params)\n	});\n}\nconst ZodEnum = /* @__PURE__ */ $constructor(\"ZodEnum\", (inst, def) => {\n	$ZodEnum.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => enumProcessor(inst, ctx, json, params);\n	inst.enum = def.entries;\n	inst.options = Object.values(def.entries);\n	const keys = new Set(Object.keys(def.entries));\n	inst.extract = (values, params) => {\n		const newEntries = {};\n		for (const value of values) if (keys.has(value)) newEntries[value] = def.entries[value];\n		else throw new Error(`Key ${value} not found in enum`);\n		return new ZodEnum({\n			...def,\n			checks: [],\n			...normalizeParams(params),\n			entries: newEntries\n		});\n	};\n	inst.exclude = (values, params) => {\n		const newEntries = { ...def.entries };\n		for (const value of values) if (keys.has(value)) delete newEntries[value];\n		else throw new Error(`Key ${value} not found in enum`);\n		return new ZodEnum({\n			...def,\n			checks: [],\n			...normalizeParams(params),\n			entries: newEntries\n		});\n	};\n});\nfunction _enum(values, params) {\n	return new ZodEnum({\n		type: \"enum\",\n		entries: Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values,\n		...normalizeParams(params)\n	});\n}\nconst ZodTransform = /* @__PURE__ */ $constructor(\"ZodTransform\", (inst, def) => {\n	$ZodTransform.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => transformProcessor(inst, ctx, json, params);\n	inst._zod.parse = (payload, _ctx) => {\n		if (_ctx.direction === \"backward\") throw new $ZodEncodeError(inst.constructor.name);\n		payload.addIssue = (issue$1) => {\n			if (typeof issue$1 === \"string\") payload.issues.push(issue(issue$1, payload.value, def));\n			else {\n				const _issue = issue$1;\n				if (_issue.fatal) _issue.continue = false;\n				_issue.code ?? (_issue.code = \"custom\");\n				_issue.input ?? (_issue.input = payload.value);\n				_issue.inst ?? (_issue.inst = inst);\n				payload.issues.push(issue(_issue));\n			}\n		};\n		const output = def.transform(payload.value, payload);\n		if (output instanceof Promise) return output.then((output) => {\n			payload.value = output;\n			return payload;\n		});\n		payload.value = output;\n		return payload;\n	};\n});\nfunction transform(fn) {\n	return new ZodTransform({\n		type: \"transform\",\n		transform: fn\n	});\n}\nconst ZodOptional = /* @__PURE__ */ $constructor(\"ZodOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => optionalProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction optional(innerType) {\n	return new ZodOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodExactOptional = /* @__PURE__ */ $constructor(\"ZodExactOptional\", (inst, def) => {\n	$ZodExactOptional.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => optionalProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction exactOptional(innerType) {\n	return new ZodExactOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodNullable = /* @__PURE__ */ $constructor(\"ZodNullable\", (inst, def) => {\n	$ZodNullable.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => nullableProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction nullable(innerType) {\n	return new ZodNullable({\n		type: \"nullable\",\n		innerType\n	});\n}\nconst ZodDefault = /* @__PURE__ */ $constructor(\"ZodDefault\", (inst, def) => {\n	$ZodDefault.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => defaultProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n	inst.removeDefault = inst.unwrap;\n});\nfunction _default(innerType, defaultValue) {\n	return new ZodDefault({\n		type: \"default\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\nconst ZodPrefault = /* @__PURE__ */ $constructor(\"ZodPrefault\", (inst, def) => {\n	$ZodPrefault.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => prefaultProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction prefault(innerType, defaultValue) {\n	return new ZodPrefault({\n		type: \"prefault\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\nconst ZodNonOptional = /* @__PURE__ */ $constructor(\"ZodNonOptional\", (inst, def) => {\n	$ZodNonOptional.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => nonoptionalProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction nonoptional(innerType, params) {\n	return new ZodNonOptional({\n		type: \"nonoptional\",\n		innerType,\n		...normalizeParams(params)\n	});\n}\nconst ZodCatch = /* @__PURE__ */ $constructor(\"ZodCatch\", (inst, def) => {\n	$ZodCatch.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => catchProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n	inst.removeCatch = inst.unwrap;\n});\nfunction _catch(innerType, catchValue) {\n	return new ZodCatch({\n		type: \"catch\",\n		innerType,\n		catchValue: typeof catchValue === \"function\" ? catchValue : () => catchValue\n	});\n}\nconst ZodPipe = /* @__PURE__ */ $constructor(\"ZodPipe\", (inst, def) => {\n	$ZodPipe.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => pipeProcessor(inst, ctx, json, params);\n	inst.in = def.in;\n	inst.out = def.out;\n});\nfunction pipe(in_, out) {\n	return new ZodPipe({\n		type: \"pipe\",\n		in: in_,\n		out\n	});\n}\nconst ZodReadonly = /* @__PURE__ */ $constructor(\"ZodReadonly\", (inst, def) => {\n	$ZodReadonly.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => readonlyProcessor(inst, ctx, json, params);\n	inst.unwrap = () => inst._zod.def.innerType;\n});\nfunction readonly(innerType) {\n	return new ZodReadonly({\n		type: \"readonly\",\n		innerType\n	});\n}\nconst ZodCustom = /* @__PURE__ */ $constructor(\"ZodCustom\", (inst, def) => {\n	$ZodCustom.init(inst, def);\n	ZodType.init(inst, def);\n	inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);\n});\nfunction refine(fn, _params = {}) {\n	return _refine(ZodCustom, fn, _params);\n}\nfunction superRefine(fn, params) {\n	return _superRefine(fn, params);\n}\n\n//#endregion\n//#region src/lib/hook-io.ts\nconst HookInputSchema = object({\n	session_id: string(),\n	transcript_path: string(),\n	cwd: string(),\n	permission_mode: string(),\n	hook_event_name: string(),\n	tool_name: string(),\n	tool_input: record(string(), unknown())\n});\n/**\n* Read and parse the full stdin as JSON.\n* Returns a result with the validated HookInput, or the raw data and error on failure.\n*/\nasync function readHookInput() {\n	const chunks = [];\n	for await (const chunk of process.stdin) chunks.push(typeof chunk === \"string\" ? chunk : String(chunk));\n	let parsed;\n	try {\n		parsed = JSON.parse(chunks.join(\"\"));\n	} catch (_error) {\n		return {\n			ok: false,\n			raw: chunks.join(\"\").slice(0, 200),\n			error: \"invalid JSON\"\n		};\n	}\n	const result = HookInputSchema.safeParse(parsed);\n	if (!result.success) return {\n		ok: false,\n		raw: parsed,\n		error: result.error.message\n	};\n	return {\n		ok: true,\n		data: result.data\n	};\n}\nconst BashInputSchema = object({\n	command: string(),\n	description: optional(string())\n});\nconst FilePathInputSchema = object({ file_path: string() });\nconst SearchInputSchema = object({\n	pattern: string(),\n	path: optional(string())\n});\n/** Parse tool_input as Bash input. Returns null if invalid. */\nfunction parseBashInput(toolInput) {\n	const result = BashInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\n/** Parse tool_input as file-path input (Read, Write, Edit). Returns null if invalid. */\nfunction parseFilePathInput(toolInput) {\n	const result = FilePathInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\n/** Parse tool_input as search input (Glob, Grep). Returns null if invalid. */\nfunction parseSearchInput(toolInput) {\n	const result = SearchInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction writeDecision(action, reason) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		permissionDecision: action,\n		...action === \"deny\" && reason ? { permissionDecisionReason: reason } : {}\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\n\n//#endregion\n//#region src/lib/audit.ts\nconst MAX_LOG_SIZE = 1048576;\n/**\n* Resolve the audit log path relative to the hook's own location.\n* Co-located at `.claude/hooks/bst-hook.audit.local.jsonl`.\n*/\nfunction getLogPath() {\n	const hookDir = path.dirname(fileURLToPath(import.meta.url));\n	return path.join(hookDir, \"bst-hook.audit.local.jsonl\");\n}\n/**\n* Rotate the log file if it exceeds MAX_LOG_SIZE.\n* Renames current log to `.1` and starts fresh.\n* Safe against concurrent rotation — ENOENT on rename is expected and ignored.\n*/\nfunction rotateIfNeeded(logPath) {\n	try {\n		if (fs.statSync(logPath).size > MAX_LOG_SIZE) {\n			const rotatedPath = `${logPath}.1`;\n			fs.renameSync(logPath, rotatedPath);\n		}\n	} catch (_error) {}\n}\n/** Whether rotation has been checked this session */\nlet rotationChecked = false;\n/**\n* Append an audit entry to the JSONL log.\n* Never throws — audit failures log to stderr and continue.\n*/\nfunction audit(entry) {\n	try {\n		const logPath = getLogPath();\n		if (!rotationChecked) {\n			rotateIfNeeded(logPath);\n			rotationChecked = true;\n		}\n		const record = {\n			timestamp: (/* @__PURE__ */ new Date()).toISOString(),\n			...entry\n		};\n		fs.appendFileSync(logPath, JSON.stringify(record) + \"\\n\");\n	} catch (err) {\n		process.stderr.write(`[bst-hook] audit write failed: ${err instanceof Error ? err.message : String(err)}\\n`);\n	}\n}\n\n//#endregion\n//#region src/lib/shell-tokenizer.ts\n/**\n* Quote-aware shell tokenizer (shlex port).\n*\n* Given a single command segment (no &&/||/;/|), tokenize it into words:\n* - Single quotes: literal, no escape processing\n* - Double quotes: allow \\\", \\\\, \\$, \\` escapes\n* - Backslash outside quotes: escapes next character\n* - Unquoted whitespace splits tokens\n*/\nfunction tokenize(input) {\n	const tokens = [];\n	let current = \"\";\n	let i = 0;\n	let inToken = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"'\") {\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated single quote\"\n			};\n			i++;\n		} else if (ch === \"\\\"\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"\\\"\") {\n				if (input[i] === \"\\\\\" && i + 1 < input.length) {\n					const next = input[i + 1];\n					if (next === \"\\\"\" || next === \"\\\\\" || next === \"$\" || next === \"`\") {\n						current += next;\n						i += 2;\n						continue;\n					}\n				}\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated double quote\"\n			};\n			i++;\n		} else if (ch === \"\\\\\" && i + 1 < input.length) {\n			inToken = true;\n			current += input[i + 1];\n			i += 2;\n		} else if (ch === \" \" || ch === \"	\") {\n			if (inToken) {\n				tokens.push(current);\n				current = \"\";\n				inToken = false;\n			}\n			i++;\n		} else {\n			inToken = true;\n			current += ch;\n			i++;\n		}\n	}\n	if (inToken) tokens.push(current);\n	return {\n		ok: true,\n		tokens\n	};\n}\n/**\n* Characters safe to leave unquoted when re-emitting a token. Anything outside\n* this set could be interpreted by the shell-splitter or tokenizer on a\n* subsequent pass (operators, whitespace, quotes, globs, vars, etc.).\n*/\nconst SAFE_UNQUOTED_RE = /^[A-Za-z0-9_\\-./=:@%+,]+$/;\n/** Single-quote-wrap a token unless it only contains safe characters. */\nfunction quoteToken(token) {\n	if (token.length > 0 && SAFE_UNQUOTED_RE.test(token)) return token;\n	return \"'\" + token.replace(/'/g, \"'\\\\''\") + \"'\";\n}\n/**\n* Inverse of `tokenize`: join tokens into a command string that survives\n* round-tripping through `splitCommand` and `tokenize`.\n*\n* Naive `tokens.join(\" \")` is lossy: any token that was originally quoted\n* loses its quote wrapper and may be mis-parsed when split/tokenized again\n* (e.g. `--testPathPattern=a|b` would split on the embedded `|`).\n*/\nfunction joinTokens(tokens) {\n	return tokens.map(quoteToken).join(\" \");\n}\n\n//#endregion\n//#region src/lib/shell-splitter.ts\n/**\n* Split a raw command string into segments on unquoted &&, ||, ;, and | operators.\n* Quote-aware: operators inside single or double quotes are not split points.\n*\n* Returns segments with the operator that follows each one (null for the last segment).\n*/\nfunction splitCommand(input) {\n	if (!input || !input.trim()) return [];\n	const segments = [];\n	let current = \"\";\n	let i = 0;\n	let inSingleQuote = false;\n	let inDoubleQuote = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\" && !inDoubleQuote) {\n			inSingleQuote = !inSingleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\"\" && !inSingleQuote) {\n			inDoubleQuote = !inDoubleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\\\" && !inSingleQuote && i + 1 < input.length) {\n			current += ch + input[i + 1];\n			i += 2;\n			continue;\n		}\n		if (!inSingleQuote && !inDoubleQuote) {\n			if (ch === \"&\" && i + 1 < input.length && input[i + 1] === \"&\") {\n				pushSegment(segments, current, \"&&\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"&\" && !(i + 1 < input.length && input[i + 1] === \">\") && !(i > 0 && (input[i - 1] === \">\" || input[i - 1] === \"<\"))) {\n				pushSegment(segments, current, \"&\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \"|\" && i + 1 < input.length && input[i + 1] === \"|\") {\n				pushSegment(segments, current, \"||\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"|\") {\n				pushSegment(segments, current, \"|\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \";\") {\n				pushSegment(segments, current, \";\");\n				current = \"\";\n				i++;\n				continue;\n			}\n		}\n		current += ch;\n		i++;\n	}\n	const trimmed = current.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator: null\n	});\n	return segments;\n}\nfunction pushSegment(segments, text, operator) {\n	const trimmed = text.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator\n	});\n}\n\n//#endregion\n//#region src/lib/injection-guard.ts\n/** Safe redirect patterns that don't constitute file writes */\nconst SAFE_REDIRECTS = new Set([\n	\"2>&1\",\n	\"2>/dev/null\",\n	\">/dev/null\",\n	\"1>/dev/null\"\n]);\n/**\n* Detect dangerous patterns in tokenized command segments.\n*\n* Checks for:\n* - Command substitution (`$(...)`, backticks)\n* - Process substitution (`<(...)`, `>(...)`)\n* - File redirects (`>`, `>>`, `<` to non-/dev/null targets) — skipped when `skipRedirects` is true\n* - Newlines in raw segment (injection via line splitting)\n*\n* @param skipRedirects When true, skip redirect analysis (used for trusted resolved scripts)\n*/\nfunction checkInjection(tokens, rawSegment, skipRedirects = false) {\n	if (/[\\n\\r]/.test(rawSegment)) return {\n		safe: false,\n		reason: \"unquoted newline in command\"\n	};\n	for (const token of tokens) {\n		if (token === \"`\") return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"$(\")) return {\n			safe: false,\n			reason: \"dollar command substitution\"\n		};\n		if (token.includes(\"`\")) return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n		if (token.includes(\">(\") && !SAFE_REDIRECTS.has(token)) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n	}\n	if (!skipRedirects) for (let i = 0; i < tokens.length; i++) {\n		const token = tokens[i];\n		if (SAFE_REDIRECTS.has(token)) continue;\n		if (token.includes(\"<\") && !token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"input redirect\"\n		};\n		if (token.includes(\">\")) {\n			if (token.endsWith(\">/dev/null\")) continue;\n			if (token.match(/^(&>>|&>|>>|>|1>|2>)$/)) {\n				if (tokens[i + 1] === \"/dev/null\") continue;\n			}\n			return {\n				safe: false,\n				reason: \"output redirect to file\"\n			};\n		}\n	}\n	return { safe: true };\n}\n\n//#endregion\n//#region src/lib/env-file.ts\n/**\n* File extensions considered safe documentation templates.\n* Files ending with these suffixes are NOT treated as secret .env files.\n*/\nconst ENV_SAFE_SUFFIXES = [\n	\".sample\",\n	\".example\",\n	\".template\"\n];\n/**\n* Pattern matching .env files: `.env`, `.env.local`, `.env.production`, etc.\n* Does NOT match `.env.sample`, `.env.example`, `.env.template`.\n*/\nconst ENV_FILE_PATTERN = /(^|[/\\\\])(\\.env(\\..*)?|.*\\.env(\\..*)?|\\.env)$/;\n/** Check if a filename is a safe .env documentation template. */\nfunction isEnvSafeSuffix(filename) {\n	return ENV_SAFE_SUFFIXES.some((suffix) => filename.endsWith(suffix));\n}\n/**\n* Check if a path targets a .env file (excluding safe templates).\n* Works with both bare filenames and full paths.\n*/\nfunction isEnvFile(filePath) {\n	if (isEnvSafeSuffix(path.basename(filePath))) return false;\n	return ENV_FILE_PATTERN.test(filePath);\n}\n/**\n* Check if any non-flag token in a Bash command targets a .env file.\n* Used by Bash deny rules for cat, head, tail, grep, etc.\n*/\nfunction tokensTargetEnvFile(tokens) {\n	return tokens.slice(1).some((t) => !t.startsWith(\"-\") && isEnvFile(t));\n}\n\n//#endregion\n//#region src/rules.ts\nconst GIT_READ_OPS = new Set([\n	\"status\",\n	\"log\",\n	\"diff\",\n	\"show\",\n	\"blame\",\n	\"grep\",\n	\"shortlog\",\n	\"range-diff\",\n	\"describe\",\n	\"branch\",\n	\"remote\",\n	\"fetch\",\n	\"ls-files\",\n	\"ls-tree\",\n	\"ls-remote\",\n	\"show-ref\",\n	\"for-each-ref\",\n	\"rev-parse\",\n	\"rev-list\",\n	\"cat-file\",\n	\"diff-tree\",\n	\"name-rev\",\n	\"merge-base\",\n	\"check-ignore\"\n]);\n/** Git subcommands that modify the working tree, index, or history. */\nconst GIT_WRITE_OPS = new Set([\n	\"push\",\n	\"add\",\n	\"commit\",\n	\"reset\",\n	\"merge\",\n	\"rebase\",\n	\"cherry-pick\",\n	\"checkout\",\n	\"switch\",\n	\"stash\",\n	\"tag\",\n	\"revert\",\n	\"clean\",\n	\"rm\",\n	\"mv\"\n]);\n/** Flags on git that enable arbitrary code execution */\nconst GIT_DANGEROUS_FLAGS = new Set([\n	\"-c\",\n	\"--exec-path\",\n	\"--pager\",\n	\"--upload-pack\",\n	\"--receive-pack\"\n]);\n/** Git global flags that consume the next token as an argument. */\nconst GIT_FLAGS_WITH_ARG = new Set([\n	\"-C\",\n	\"-c\",\n	\"--git-dir\",\n	\"--work-tree\"\n]);\n/** Extract the git subcommand (first non-flag token after \"git\"), skipping flag arguments. */\nfunction getGitSubcommand(tokens) {\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return t;\n	}\n}\nfunction isGitReadOp(tokens) {\n	for (const t of tokens.slice(1)) {\n		if (GIT_DANGEROUS_FLAGS.has(t) || t === \"-o\" || t.startsWith(\"--output\")) return false;\n		if (t.startsWith(\"--exec-path=\") || t.startsWith(\"--pager=\") || t.startsWith(\"--upload-pack=\") || t.startsWith(\"--receive-pack=\") || t.startsWith(\"-o=\") || t.startsWith(\"--output=\")) return false;\n	}\n	const sub = getGitSubcommand(tokens);\n	if (!sub) return false;\n	if (sub === \"stash\") {\n		const stashAction = tokens[tokens.indexOf(\"stash\") + 1];\n		return stashAction === \"list\" || stashAction === void 0;\n	}\n	return GIT_READ_OPS.has(sub);\n}\nfunction isGitWriteOp(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (!sub) return false;\n	if (sub === \"stash\") {\n		const stashAction = tokens[tokens.indexOf(\"stash\") + 1];\n		if (stashAction === \"list\" || stashAction === void 0) return false;\n	}\n	return GIT_WRITE_OPS.has(sub);\n}\n/** Safe stash actions that don't risk data loss. */\nconst STASH_SAFE_ACTIONS = new Set([\n	\"push\",\n	\"pop\",\n	\"apply\",\n	\"show\"\n]);\n/**\n* Git write operations that are safe to auto-approve:\n* - `git add` — staging is trivially reversible\n* - `git checkout -b/-B` — branch creation\n* - `git switch -c/-C` — branch creation\n* - `git switch <branch>` — branch switching (switch only handles branches, unlike checkout)\n* - `git stash` / `git stash push|pop|apply|show` — reversible stash operations\n*/\nfunction isGitSafeWriteOp(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (!sub) return false;\n	if (sub === \"add\") return true;\n	if (sub === \"checkout\") return tokens.slice(tokens.indexOf(\"checkout\") + 1).some((t) => t === \"-b\" || t === \"-B\");\n	if (sub === \"switch\") return true;\n	if (sub === \"stash\") {\n		const stashAction = tokens[tokens.indexOf(\"stash\") + 1];\n		if (stashAction === void 0) return true;\n		return STASH_SAFE_ACTIONS.has(stashAction);\n	}\n	return false;\n}\n/** pnpm built-in subcommands (not user-defined scripts) */\nconst PNPM_BUILTINS = new Set([\n	\"install\",\n	\"i\",\n	\"add\",\n	\"remove\",\n	\"rm\",\n	\"uninstall\",\n	\"un\",\n	\"update\",\n	\"up\",\n	\"upgrade\",\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\",\n	\"audit\",\n	\"licenses\",\n	\"init\",\n	\"create\",\n	\"link\",\n	\"unlink\",\n	\"pack\",\n	\"publish\",\n	\"config\",\n	\"set\",\n	\"get\",\n	\"store\",\n	\"cache\",\n	\"rebuild\",\n	\"rb\",\n	\"prune\",\n	\"dedupe\",\n	\"dlx\",\n	\"exec\",\n	\"run\",\n	\"patch\",\n	\"patch-commit\",\n	\"recursive\",\n	\"-r\"\n]);\n/** Read-only pnpm commands that are always safe */\nconst PNPM_SAFE_BUILTINS = new Set([\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\"\n]);\nfunction isPnpmSafe(tokens) {\n	const subTokens = tokens.slice(1);\n	let subcommand;\n	for (const t of subTokens) {\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		subcommand = t;\n		break;\n	}\n	if (!subcommand) return false;\n	if (PNPM_SAFE_BUILTINS.has(subcommand)) return true;\n	if (subcommand === \"install\" || subcommand === \"i\") return subTokens.slice(subTokens.indexOf(subcommand) + 1).every((t) => t.startsWith(\"-\"));\n	return false;\n}\nconst NPM_READ_OPS = new Set([\n	\"view\",\n	\"info\",\n	\"show\"\n]);\nfunction isNpmReadOp(tokens) {\n	const sub = tokens[1];\n	return sub !== void 0 && NPM_READ_OPS.has(sub);\n}\n/** Map npm subcommand to a pnpm redirect message */\nfunction getNpmRedirectReason(tokens) {\n	const sub = tokens[1];\n	const BASE = \"This project uses pnpm.\";\n	if (!sub) return `${BASE} Use \\`pnpm\\` instead of npm.`;\n	if (sub === \"install\" || sub === \"i\" || sub === \"ci\") {\n		if (tokens.slice(2).some((t) => !t.startsWith(\"-\"))) return `${BASE} Use \\`pnpm add <pkg>\\` instead of \\`npm install <pkg>\\`.`;\n		return `${BASE} Use \\`pnpm install\\` instead of npm.`;\n	}\n	if (sub === \"add\") return `${BASE} Use \\`pnpm add <pkg>\\` instead of npm.`;\n	if (sub === \"uninstall\" || sub === \"remove\" || sub === \"rm\" || sub === \"un\" || sub === \"r\") return `${BASE} Use \\`pnpm remove <pkg>\\` instead of npm.`;\n	if (sub === \"run\" || sub === \"run-script\") return `${BASE} Use \\`pnpm run <script>\\` or \\`pnpm <script>\\` instead of npm.`;\n	if (sub === \"test\" || sub === \"t\" || sub === \"tst\") return `${BASE} Use \\`pnpm test\\` instead of npm.`;\n	if (sub === \"start\") return `${BASE} Use \\`pnpm start\\` instead of npm.`;\n	if (sub === \"stop\") return `${BASE} Use \\`pnpm stop\\` instead of npm.`;\n	if (sub === \"restart\") return `${BASE} Use \\`pnpm restart\\` instead of npm.`;\n	if (sub === \"exec\") return `${BASE} Use \\`pnpm exec <cmd>\\` instead of npm.`;\n	if (sub === \"list\" || sub === \"ls\" || sub === \"ll\" || sub === \"la\") return `${BASE} Use \\`pnpm list\\` instead of npm.`;\n	if (sub === \"why\") return `${BASE} Use \\`pnpm why\\` instead of npm.`;\n	if (sub === \"outdated\") return `${BASE} Use \\`pnpm outdated\\` instead of npm.`;\n	if (sub === \"audit\") return `${BASE} Use \\`pnpm audit\\` instead of npm.`;\n	if (sub === \"update\" || sub === \"up\" || sub === \"upgrade\") return `${BASE} Use \\`pnpm update\\` instead of npm.`;\n	if (sub === \"init\") return `${BASE} Use \\`pnpm init\\` instead of npm.`;\n	if (sub === \"publish\") return `${BASE} Use \\`pnpm publish\\` instead of npm.`;\n	if (sub === \"link\") return `${BASE} Use \\`pnpm link\\` instead of npm.`;\n	if (sub === \"unlink\") return `${BASE} Use \\`pnpm unlink\\` instead of npm.`;\n	if (sub === \"pack\") return `${BASE} Use \\`pnpm pack\\` instead of npm.`;\n	if (sub === \"cache\") return `${BASE} Use \\`pnpm store\\` instead of \\`npm cache\\`.`;\n	if (sub === \"config\" || sub === \"set\" || sub === \"get\") return `${BASE} Use \\`pnpm config\\` instead of npm.`;\n	return `${BASE} Use the equivalent pnpm command instead of npm.`;\n}\nfunction arePathArgsSafe(tokens, ctx) {\n	for (const t of tokens.slice(1)) {\n		if (t.startsWith(\"-\")) {\n			if (t === \"-t\" || t.startsWith(\"--target-directory\")) return false;\n			continue;\n		}\n		if (path.basename(t).startsWith(\".\")) return false;\n		if (t.startsWith(\"~/\") || t === \"~\") return false;\n		const resolvedPath = path.resolve(ctx.cwd, t);\n		if (resolvedPath !== ctx.cwd && !resolvedPath.startsWith(ctx.cwd + path.sep)) return false;\n	}\n	return true;\n}\nconst FIND_ALWAYS_DANGEROUS = new Set([\n	\"-ok\",\n	\"-okdir\",\n	\"-delete\",\n	\"-fprint\",\n	\"-fprint0\",\n	\"-fprintf\",\n	\"-fls\"\n]);\nconst FIND_EXEC_SAFE_COMMANDS = new Set([\n	\"cat\",\n	\"head\",\n	\"tail\",\n	\"grep\",\n	\"egrep\",\n	\"fgrep\",\n	\"ls\",\n	\"wc\",\n	\"file\",\n	\"stat\",\n	\"basename\",\n	\"dirname\",\n	\"realpath\",\n	\"readlink\",\n	\"sha256sum\",\n	\"sha1sum\",\n	\"md5sum\",\n	\"echo\"\n]);\n/**\n* Extracts the command name from a `-exec` or `-execdir` block.\n* Returns the basename of the first token after `-exec`/`-execdir`,\n* or undefined if the block is malformed.\n*/\nfunction findExecCommand(tokens, startIdx) {\n	const cmdToken = tokens[startIdx + 1];\n	if (!cmdToken || cmdToken === \"{}\" || cmdToken === \";\" || cmdToken === \"+\") return void 0;\n	return path.basename(cmdToken);\n}\nfunction isFindSafe(tokens) {\n	for (let i = 0; i < tokens.length; i++) {\n		const t = tokens[i];\n		if (t === void 0) continue;\n		if (FIND_ALWAYS_DANGEROUS.has(t)) return false;\n		if (t === \"-exec\" || t === \"-execdir\") {\n			const cmd = findExecCommand(tokens, i);\n			if (!cmd || !FIND_EXEC_SAFE_COMMANDS.has(cmd)) return false;\n		}\n	}\n	return true;\n}\nfunction isSortSafe(tokens) {\n	return !tokens.includes(\"-o\") && !tokens.some((t) => t.startsWith(\"--output\"));\n}\nfunction isRmRecursive(tokens) {\n	const rmIdx = tokens.findIndex((t) => path.basename(t) === \"rm\");\n	if (rmIdx === -1) return false;\n	const afterRm = tokens.slice(rmIdx + 1);\n	const shortFlags = afterRm.filter((t) => t.startsWith(\"-\") && !t.startsWith(\"--\"));\n	const longFlags = afterRm.filter((t) => t.startsWith(\"--\"));\n	const hasRecursiveShort = shortFlags.some((f) => /[rR]/.test(f));\n	const hasRecursiveLong = longFlags.includes(\"--recursive\");\n	return hasRecursiveShort || hasRecursiveLong;\n}\nfunction isChmod777(tokens) {\n	return tokens.some((t) => t === \"777\" || t === \"0777\");\n}\nfunction isGitForcePush(tokens) {\n	const pushIdx = tokens.indexOf(\"push\");\n	if (pushIdx === -1) return false;\n	const afterPush = tokens.slice(pushIdx + 1);\n	return afterPush.some((t) => t === \"--force\" || t === \"-f\" && !afterPush.includes(\"--force-with-lease\"));\n}\nfunction isGitResetHardOnMain(tokens) {\n	if (!(tokens.includes(\"reset\") && tokens.includes(\"--hard\"))) return false;\n	if (tokens.some((t) => t === \"main\" || t === \"master\")) return true;\n	const positionalArgs = tokens.filter((t) => t !== \"git\" && t !== \"reset\" && !t.startsWith(\"-\"));\n	return positionalArgs.length === 0 || positionalArgs.includes(\"HEAD\");\n}\n/** bst subcommands that are safe to auto-approve (read-only or local-only). */\nconst BST_SAFE_SUBCOMMANDS = new Set([\n	\"checks:run\",\n	\"hooks:audit\",\n	\"hooks:sync\",\n	\"docker:build\",\n	\"docker:check\",\n	\"repo:sync\",\n	\"coverage:check\",\n	\"coverage:summary\",\n	\"coverage:status\"\n]);\nfunction isBstSafe(tokens) {\n	const sub = tokens[1];\n	if (!sub) return false;\n	return BST_SAFE_SUBCOMMANDS.has(sub);\n}\nconst denyRules = [\n	{\n		name: \"rm-recursive\",\n		match: /^rm$/,\n		action: \"deny\",\n		when: (tokens) => isRmRecursive(tokens),\n		reason: \"Don't use recursive `rm`. Use more targeted deletes, or remove specific files/directories.\"\n	},\n	{\n		name: \"sudo\",\n		match: /^sudo$/,\n		action: \"deny\",\n		reason: \"Don't use sudo. If you need elevated permissions, ask me to do it manually.\"\n	},\n	{\n		name: \"git-force-push\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitForcePush(tokens),\n		reason: \"Use `git push --force-with-lease` instead of `--force`.\"\n	},\n	{\n		name: \"git-reset-hard\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitResetHardOnMain(tokens),\n		reason: \"Don't `reset --hard` on main. Create a branch first.\"\n	},\n	{\n		name: \"git-write\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitWriteOp(tokens) && !isGitSafeWriteOp(tokens),\n		reason: \"Git write operations (push, commit, reset, merge, etc.) are not allowed. Ask the user to run these manually.\"\n	},\n	{\n		name: \"chmod-777\",\n		match: /^chmod$/,\n		action: \"deny\",\n		when: (tokens) => isChmod777(tokens),\n		reason: \"Don't use 777 permissions. Use more restrictive permissions.\"\n	},\n	{\n		name: \"env-file-read\",\n		match: /^(cat|head|tail|less|more|grep)$/,\n		action: \"deny\",\n		when: (tokens) => tokensTargetEnvFile(tokens),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"npx-redirect\",\n		match: /^npx$/,\n		action: \"deny\",\n		reason: \"This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\"\n	}\n];\nconst allowRules = [\n	{\n		name: \"vitest\",\n		match: /^vitest$/,\n		action: \"allow\"\n	},\n	{\n		name: \"jest\",\n		match: /^jest$/,\n		action: \"allow\"\n	},\n	{\n		name: \"tsc\",\n		match: /^tsc$/,\n		action: \"allow\"\n	},\n	{\n		name: \"tsdown\",\n		match: /^tsdown$/,\n		action: \"allow\"\n	},\n	{\n		name: \"bst\",\n		match: /^bst$/,\n		action: \"allow\",\n		when: (tokens) => isBstSafe(tokens)\n	},\n	{\n		name: \"oxlint\",\n		match: /^oxlint$/,\n		action: \"allow\"\n	},\n	{\n		name: \"oxfmt\",\n		match: /^oxfmt$/,\n		action: \"allow\"\n	},\n	{\n		name: \"eslint\",\n		match: /^eslint$/,\n		action: \"allow\"\n	},\n	{\n		name: \"prettier\",\n		match: /^prettier$/,\n		action: \"allow\"\n	},\n	{\n		name: \"biome\",\n		match: /^biome$/,\n		action: \"allow\"\n	},\n	{\n		name: \"knip\",\n		match: /^knip$/,\n		action: \"allow\"\n	},\n	{\n		name: \"cat\",\n		match: /^cat$/,\n		action: \"allow\"\n	},\n	{\n		name: \"head\",\n		match: /^head$/,\n		action: \"allow\"\n	},\n	{\n		name: \"tail\",\n		match: /^tail$/,\n		action: \"allow\"\n	},\n	{\n		name: \"grep\",\n		match: /^grep$/,\n		action: \"allow\"\n	},\n	{\n		name: \"ls\",\n		match: /^ls$/,\n		action: \"allow\"\n	},\n	{\n		name: \"wc\",\n		match: /^wc$/,\n		action: \"allow\"\n	},\n	{\n		name: \"uniq\",\n		match: /^uniq$/,\n		action: \"allow\"\n	},\n	{\n		name: \"diff\",\n		match: /^diff$/,\n		action: \"allow\"\n	},\n	{\n		name: \"echo\",\n		match: /^echo$/,\n		action: \"allow\"\n	},\n	{\n		name: \"pwd\",\n		match: /^pwd$/,\n		action: \"allow\"\n	},\n	{\n		name: \"which\",\n		match: /^which$/,\n		action: \"allow\"\n	},\n	{\n		name: \"dirname\",\n		match: /^dirname$/,\n		action: \"allow\"\n	},\n	{\n		name: \"basename\",\n		match: /^basename$/,\n		action: \"allow\"\n	},\n	{\n		name: \"realpath\",\n		match: /^realpath$/,\n		action: \"allow\"\n	},\n	{\n		name: \"npm\",\n		match: /^npm$/,\n		action: \"allow\",\n		when: (tokens) => isNpmReadOp(tokens)\n	},\n	{\n		name: \"test\",\n		match: /^test$/,\n		action: \"allow\"\n	},\n	{\n		name: \"bracket-test\",\n		match: /^\\[$/,\n		action: \"allow\"\n	},\n	{\n		name: \"cd\",\n		match: /^cd$/,\n		action: \"allow\"\n	},\n	{\n		name: \"true\",\n		match: /^true$/,\n		action: \"allow\"\n	},\n	{\n		name: \"colon\",\n		match: /^:$/,\n		action: \"allow\"\n	},\n	{\n		name: \"find\",\n		match: /^find$/,\n		action: \"allow\",\n		when: (tokens) => isFindSafe(tokens)\n	},\n	{\n		name: \"sort\",\n		match: /^sort$/,\n		action: \"allow\",\n		when: (tokens) => isSortSafe(tokens)\n	},\n	{\n		name: \"git\",\n		match: /^git$/,\n		action: \"allow\",\n		when: (tokens) => isGitReadOp(tokens)\n	},\n	{\n		name: \"git-safe-write\",\n		match: /^git$/,\n		action: \"allow\",\n		when: (tokens) => isGitSafeWriteOp(tokens)\n	},\n	{\n		name: \"pnpm\",\n		match: /^pnpm$/,\n		action: \"allow\",\n		when: (tokens) => isPnpmSafe(tokens)\n	},\n	{\n		name: \"cp\",\n		match: /^cp$/,\n		action: \"allow\",\n		when: (tokens, ctx) => arePathArgsSafe(tokens, ctx)\n	},\n	{\n		name: \"mkdir\",\n		match: /^mkdir$/,\n		action: \"allow\",\n		when: (tokens, ctx) => arePathArgsSafe(tokens, ctx)\n	},\n	{\n		name: \"touch\",\n		match: /^touch$/,\n		action: \"allow\",\n		when: (tokens, ctx) => arePathArgsSafe(tokens, ctx)\n	}\n];\n\n//#endregion\n//#region src/lib/settings.ts\nconst SETTINGS_PATH = \".claude/hooks/bst-hook.settings.json\";\nconst BstHookSettingsSchema = object({ allow: array(string()) });\n/**\n* Check whether a file at `relativePath` inside `cwd` is tracked and\n* unmodified in git (no staged or unstaged changes vs HEAD).\n*\n* Returns false on any error — safe default is to not trust the file.\n*/\nfunction isFileClean(cwd, relativePath) {\n	try {\n		execFileSync(\"git\", [\n			\"ls-files\",\n			\"--error-unmatch\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\"\n		});\n		execFileSync(\"git\", [\n			\"diff\",\n			\"--quiet\",\n			\"HEAD\",\n			\"--\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\"\n		});\n		return true;\n	} catch {\n		return false;\n	}\n}\n/**\n* Load repo-level allow patterns from `.claude/hooks/bst-hook.settings.json`.\n*\n* Walks up from `cwd` to find the workspace root (or uses `cwd` directly),\n* reads the settings file, validates it, and checks that the file is\n* git-tracked and unmodified before trusting it.\n*\n* Returns an empty array if the file is missing, invalid, or untrusted.\n*/\nfunction loadRepoSettings(cwd) {\n	const root = findWorkspaceRoot(cwd) ?? cwd;\n	const settingsFile = join(root, SETTINGS_PATH);\n	if (!existsSync(settingsFile)) return [];\n	if (!isFileClean(root, SETTINGS_PATH)) return [];\n	try {\n		const raw = readFileSync(settingsFile, \"utf-8\");\n		const parsed = JSON.parse(raw);\n		const result = BstHookSettingsSchema.safeParse(parsed);\n		if (!result.success) return [];\n		return result.data.allow.filter((s) => typeof s === \"string\" && s.length > 0);\n	} catch {\n		return [];\n	}\n}\n/**\n* Check whether a command matches a repo-level allow pattern.\n*\n* Pattern format: `\"<command> [arg1] [arg2] ...\"`\n* - First token is matched exactly against the command basename\n* - Remaining tokens (if any) must match positionally as prefixes of the actual arguments\n*\n* Examples:\n* - `\"tooling\"` matches `tooling repo:sync --yes`\n* - `\"node packages/foo/dist/bin.mjs\"` matches `node packages/foo/dist/bin.mjs run`\n* - `\"node packages/foo/dist/bin.mjs\"` does NOT match `node packages/bar/dist/bin.mjs`\n*/\nfunction matchesRepoPattern(cmdName, tokens, pattern) {\n	const parts = pattern.split(/\\s+/).filter(Boolean);\n	if (parts.length === 0) return false;\n	if (parts[0] !== cmdName) return false;\n	const patternArgs = parts.slice(1);\n	const actualArgs = tokens.slice(1);\n	for (let i = 0; i < patternArgs.length; i++) {\n		if (i >= actualArgs.length) return false;\n		if (actualArgs[i] !== patternArgs[i]) return false;\n	}\n	return true;\n}\n\n//#endregion\n//#region src/lib/script-resolver.ts\nconst PackageJsonSchema = object({ scripts: record(string(), unknown()) });\n/**\n* Resolve a pnpm script name to its actual command(s) by reading package.json.\n*\n* Returns null if the script cannot be resolved (missing package.json,\n* missing script name, parse error).\n*/\nfunction resolveScript(scriptName, cwd) {\n	const scripts = readScripts(cwd);\n	if (!scripts) return null;\n	const main = scripts[scriptName];\n	if (typeof main !== \"string\") return null;\n	const pre = scripts[`pre${scriptName}`];\n	const post = scripts[`post${scriptName}`];\n	return {\n		pre: typeof pre === \"string\" ? pre : null,\n		main,\n		post: typeof post === \"string\" ? post : null\n	};\n}\n/**\n* Resolve a script in a specific workspace package identified by --filter.\n*\n* Reads pnpm-workspace.yaml, scans workspace directories to match filterPkg\n* against package.json#name fields, then resolves the script in that package's directory.\n*\n* Returns null if the package or script cannot be resolved.\n*/\nfunction resolveFilteredScript(scriptName, filterPkg, cwd) {\n	const pkgDir = findWorkspacePackageDir(filterPkg, cwd);\n	if (!pkgDir) return null;\n	const script = resolveScript(scriptName, pkgDir);\n	if (!script) return null;\n	return {\n		...script,\n		pkgDir\n	};\n}\n/**\n* Resolve a script name across all workspace packages (for `pnpm -r <script>`).\n*\n* Returns an array of resolved scripts (one per workspace package that defines the script),\n* each with a `pkgDir` field. Returns null if workspace patterns can't be read.\n* Packages that don't define the script are silently skipped.\n*/\nfunction resolveRecursiveScripts(scriptName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	const results = [];\n	for (const pkgDir of pkgDirs) {\n		const resolved = resolveScript(scriptName, pkgDir);\n		if (resolved) results.push({\n			...resolved,\n			pkgDir\n		});\n	}\n	return results;\n}\n/**\n* Find the pnpm workspace root by walking up from `cwd` until a\n* `pnpm-workspace.yaml` file is found. Returns `null` if none is found\n* before reaching the filesystem root.\n*/\nfunction findWorkspaceRoot(cwd) {\n	let dir = resolve(cwd);\n	while (true) {\n		if (existsSync(join(dir, \"pnpm-workspace.yaml\"))) return dir;\n		const parent = dirname(dir);\n		if (parent === dir) return null;\n		dir = parent;\n	}\n}\n/**\n* List all workspace package directories.\n*/\nfunction listWorkspacePackageDirs(rootDir) {\n	const patterns = readWorkspacePatterns(rootDir);\n	if (!patterns) return null;\n	const dirs = [];\n	for (const pattern of patterns) {\n		if (!pattern.endsWith(\"/*\")) continue;\n		const parentDir = resolve(rootDir, pattern.slice(0, -2));\n		let entries;\n		try {\n			entries = readdirSync(parentDir);\n		} catch {\n			continue;\n		}\n		for (const entry of entries) {\n			const entryDir = join(parentDir, entry);\n			try {\n				if (!statSync(entryDir).isDirectory()) continue;\n			} catch {\n				continue;\n			}\n			dirs.push(entryDir);\n		}\n	}\n	return dirs.length > 0 ? dirs : null;\n}\n/**\n* Find the directory of a workspace package by name.\n* Reads pnpm-workspace.yaml for glob patterns, then scans matching directories.\n*/\nfunction findWorkspacePackageDir(pkgName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	for (const entryDir of pkgDirs) {\n		const name = readPackageName(entryDir);\n		if (name === pkgName || name === `@${pkgName}`) return entryDir;\n		if (entryDir.split(\"/\").pop() === pkgName) return entryDir;\n		if (name) {\n			if ((name.startsWith(\"@\") ? name.split(\"/\")[1] : name) === pkgName) return entryDir;\n		}\n	}\n	return null;\n}\n/**\n* Read workspace glob patterns from pnpm-workspace.yaml.\n*/\nfunction readWorkspacePatterns(rootDir) {\n	try {\n		const lines = readFileSync(join(rootDir, \"pnpm-workspace.yaml\"), \"utf-8\").split(\"\\n\");\n		const packagesIdx = lines.findIndex((l) => /^packages\\s*:/.test(l));\n		if (packagesIdx === -1) return null;\n		const patterns = [];\n		for (let i = packagesIdx + 1; i < lines.length; i++) {\n			const line = lines[i];\n			const match = /^\\s+-\\s+(.+)$/.exec(line);\n			if (!match) break;\n			patterns.push(match[1].trim().replace(/['\"`]/g, \"\"));\n		}\n		return patterns.length > 0 ? patterns : null;\n	} catch {\n		return null;\n	}\n}\nconst PackageNameSchema = object({ name: string() });\n/**\n* Read the name field from package.json in the given directory.\n*/\nfunction readPackageName(dir) {\n	try {\n		const raw = readFileSync(join(dir, \"package.json\"), \"utf-8\");\n		const result = PackageNameSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.name;\n	} catch {\n		return null;\n	}\n}\n/**\n* Read the scripts field from package.json in the given directory.\n* Returns null on any failure (missing file, parse error, no scripts field).\n*/\nfunction readScripts(cwd) {\n	try {\n		const raw = readFileSync(join(cwd, \"package.json\"), \"utf-8\");\n		const result = PackageJsonSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.scripts;\n	} catch {\n		return null;\n	}\n}\n/**\n* Check whether the package.json in the given directory is clean in git\n* (no staged or unstaged changes compared to HEAD).\n*\n* Returns true only when the file is tracked and unmodified. Returns false\n* on any error (not a git repo, untracked file, no HEAD, etc.) — safe default\n* is to not trust the scripts.\n*/\nfunction isPackageJsonClean(pkgDir) {\n	return isFileClean(pkgDir, \"package.json\");\n}\n\n//#endregion\n//#region src/evaluate.ts\nconst MAX_EVAL_DEPTH = 5;\n/** Environment variables that enable code injection */\nconst DANGEROUS_ENV_VARS = new Set([\n	\"LD_PRELOAD\",\n	\"LD_LIBRARY_PATH\",\n	\"DYLD_INSERT_LIBRARIES\",\n	\"NODE_OPTIONS\",\n	\"PYTHONPATH\",\n	\"PYTHONSTARTUP\",\n	\"PERL5OPT\",\n	\"PERL5LIB\",\n	\"RUBYOPT\",\n	\"RUBYLIB\",\n	\"BASH_ENV\",\n	\"ENV\",\n	\"npm_config_prefix\",\n	\"npm_config_registry\",\n	\"EDITOR\",\n	\"VISUAL\"\n]);\n/** Git config env vars use prefix matching */\nconst DANGEROUS_GIT_ENV_PREFIXES = [\n	\"GIT_CONFIG_\",\n	\"GIT_PAGER\",\n	\"GIT_SSH_COMMAND\",\n	\"GIT_EDITOR\",\n	\"GIT_EXEC_PATH\"\n];\nfunction isDangerousEnvVar(name) {\n	if (DANGEROUS_ENV_VARS.has(name)) return true;\n	return DANGEROUS_GIT_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));\n}\n/**\n* Extract the target directory from a `cd <dir>` segment.\n* Returns the resolved absolute path, or null if the segment isn't a simple `cd`.\n*/\nfunction extractCdDir(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok || tokenResult.tokens.length !== 2) return null;\n	const tokens = tokenResult.tokens;\n	if (tokens[0] !== \"cd\") return null;\n	const dir = tokens[1];\n	if (path.isAbsolute(dir)) return dir;\n	return path.resolve(ctx.cwd, dir);\n}\n/**\n* Evaluate a full command string. Splits on operators and evaluates each segment.\n*\n* This is the single reentrant entry point. Called at depth 0 for top-level\n* commands and at depth 1+ for derived commands (resolved scripts, exec tails, etc.).\n*/\nfunction evaluateCommand(command, ctx) {\n	if (ctx.depth >= MAX_EVAL_DEPTH) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"max evaluation depth exceeded\"\n	};\n	const trimmed = command.trim();\n	if (!trimmed) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const segments = splitCommand(trimmed);\n	if (segments.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	let firstPassthrough = null;\n	let lastAllow = null;\n	const currentCtx = { ...ctx };\n	for (const segment of segments) {\n		if (segment.operator === \"&&\") {\n			const cdDir = extractCdDir(segment.command, currentCtx);\n			if (cdDir) currentCtx.cwd = cdDir;\n		}\n		const result = evaluateSegment(segment.command, currentCtx);\n		if (result.action === \"deny\") return result;\n		if (result.action === \"passthrough\") {\n			if (!firstPassthrough) firstPassthrough = result;\n		}\n		if (result.action === \"allow\") lastAllow = result;\n	}\n	if (firstPassthrough) return firstPassthrough;\n	if (segments.length === 1 && lastAllow) return lastAllow;\n	return {\n		action: \"allow\",\n		rule: \"all-segments\",\n		reason: null\n	};\n}\n/**\n* Helper to evaluate a resolved script with its pre and post hooks.\n*\n* When the source package.json is clean in git, sets `insideResolvedScript`\n* on the context so downstream evaluation trusts file redirects and\n* unmatched commands (user-authored scripts). Deny rules still apply.\n*/\nfunction evaluateResolvedScript(resolved, ctx) {\n	const pkgDir = resolved.pkgDir ?? ctx.cwd;\n	const innerCtx = ctx.insideResolvedScript ?? isPackageJsonClean(pkgDir) ? {\n		...ctx,\n		insideResolvedScript: true\n	} : ctx;\n	if (resolved.pre) {\n		const preResult = evaluateCommand(resolved.pre, innerCtx);\n		if (preResult.action !== \"allow\") return preResult;\n	}\n	const mainResult = evaluateCommand(resolved.main, innerCtx);\n	if (mainResult.action !== \"allow\") return mainResult;\n	if (resolved.post) {\n		const postResult = evaluateCommand(resolved.post, innerCtx);\n		if (postResult.action !== \"allow\") return postResult;\n	}\n	return \"allow\";\n}\n/**\n* Evaluate a single command segment (no operators).\n* May recurse into evaluateCommand() for indirection constructs.\n*/\nfunction evaluateSegment(rawSegment, ctx) {\n	const trimmed = rawSegment.trim();\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const tokenResult = tokenize(rawSegment);\n	if (!tokenResult.ok) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: tokenResult.error\n	};\n	let tokens = tokenResult.tokens;\n	if (tokens.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) {\n		const varName = tokens[envSkipped].split(\"=\")[0];\n		if (isDangerousEnvVar(varName)) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: `dangerous env var: ${varName}`\n		};\n		envSkipped++;\n	}\n	if (envSkipped >= tokens.length) return {\n		action: \"allow\",\n		rule: \"env-only\",\n		reason: null\n	};\n	tokens = tokens.slice(envSkipped);\n	const injection = checkInjection(tokens, rawSegment, ctx.insideResolvedScript);\n	if (!injection.safe) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: injection.reason\n	};\n	if (!ctx.insideResolvedScript) for (let i = 0; i < tokens.length; i++) {\n		const token = tokens[i];\n		if (token === \"2>&1\" || token === \"2>/dev/null\" || token === \">/dev/null\" || token === \"1>/dev/null\") continue;\n		if (token === \">\" || token === \">>\") {\n			if (tokens[i + 1] === \"/dev/null\") continue;\n			return {\n				action: \"passthrough\",\n				rule: null,\n				reason: \"output redirect to file\"\n			};\n		}\n		if (token === \"<\") return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"input redirect\"\n		};\n	}\n	const SAFE_REDIRECT_TOKENS = new Set([\n		\"2>&1\",\n		\"2>/dev/null\",\n		\">/dev/null\",\n		\"1>/dev/null\"\n	]);\n	tokens = tokens.filter((t, i) => {\n		if (SAFE_REDIRECT_TOKENS.has(t)) return false;\n		if ((t === \">\" || t === \">>\") && tokens[i + 1] === \"/dev/null\") return false;\n		if (t === \"/dev/null\" && i > 0 && (tokens[i - 1] === \">\" || tokens[i - 1] === \">>\")) return false;\n		return true;\n	});\n	const cmdName = path.basename(tokens[0]);\n	if (cmdName === \"command\" && tokens.length > 1) return evaluateCommand(joinTokens(tokens.slice(1)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (cmdName === \"env\") {\n		let envIdx = 1;\n		while (envIdx < tokens.length && /^\\w+=/.test(tokens[envIdx])) {\n			const varName = tokens[envIdx].split(\"=\")[0];\n			if (isDangerousEnvVar(varName)) return {\n				action: \"passthrough\",\n				rule: null,\n				reason: `dangerous env var: ${varName}`\n			};\n			envIdx++;\n		}\n		if (envIdx >= tokens.length) return {\n			action: \"allow\",\n			rule: \"env-only\",\n			reason: null\n		};\n		return evaluateCommand(joinTokens(tokens.slice(envIdx)), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"pnpm\") return evaluatePnpm(tokens, ctx);\n	if (cmdName === \"npm\") return evaluateNpm(tokens);\n	if (cmdName === \"bash\" || cmdName === \"sh\" || cmdName === \"zsh\") return evaluateShellC(tokens, ctx);\n	if (cmdName === \"xargs\") return evaluateXargs(tokens, ctx);\n	if (cmdName === \"node\" && (tokens.includes(\"-e\") || tokens.includes(\"-p\") || tokens.includes(\"--eval\") || tokens.includes(\"--print\"))) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"node eval\"\n	};\n	if (cmdName === \"mv\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"mv\"\n	};\n	for (const rule of denyRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"deny\",\n			rule: rule.name,\n			reason: rule.reason ?? null\n		};\n	}\n	for (const rule of allowRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"allow\",\n			rule: rule.name,\n			reason: null\n		};\n	}\n	if (ctx.repoAllowPatterns) {\n		for (const pattern of ctx.repoAllowPatterns) if (matchesRepoPattern(cmdName, tokens, pattern)) return {\n			action: \"allow\",\n			rule: `repo:${cmdName}`,\n			reason: null\n		};\n	}\n	if (ctx.insideResolvedScript) return {\n		action: \"allow\",\n		rule: \"resolved-script\",\n		reason: null\n	};\n	return {\n		action: \"passthrough\",\n		rule: null,\n		reason: `no rule matched: ${cmdName}`\n	};\n}\n/**\n* Scan pnpm subTokens starting at `from`, skipping and accumulating flags\n* (--filter, -r, -w, -C, and generic --flags). Returns the first non-flag\n* token as `name`, or `undefined` if none found. Returns `\"filter\"` as a\n* sentinel when --filter is encountered (caller must handle).\n*/\nfunction scanPnpmFlags(subTokens, from, state) {\n	for (let i = from; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t.startsWith(\"--filter=\")) return {\n			name: void 0,\n			filterIdx: i\n		};\n		if (t === \"-r\" || t === \"--recursive\") {\n			state.isRecursive = true;\n			continue;\n		}\n		if (t === \"-w\" || t === \"--workspace-root\") {\n			state.isWorkspaceRoot = true;\n			continue;\n		}\n		if (t === \"-C\" || t === \"--dir\") {\n			state.dirOverride = subTokens[++i];\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			state.dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		return { name: t };\n	}\n	return { name: void 0 };\n}\n/**\n* Evaluate a pnpm command. Classifies the subcommand as built-in, exec, or script.\n* Script commands are resolved via package.json and recursively evaluated.\n*/\nfunction evaluatePnpm(tokens, ctx) {\n	const subTokens = tokens.slice(1);\n	const state = {\n		isRecursive: false,\n		isWorkspaceRoot: false,\n		dirOverride: void 0\n	};\n	const scan = scanPnpmFlags(subTokens, 0, state);\n	if (scan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, scan.filterIdx, ctx);\n	const subcommand = scan.name;\n	const subcommandIdx = subcommand ? subTokens.indexOf(subcommand) : -1;\n	if (!subcommand) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	if (subcommand === \"dlx\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (subcommand === \"add\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (subcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcommandIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName;\n	let { isRecursive, isWorkspaceRoot, dirOverride } = state;\n	if (subcommand === \"run\") {\n		const runScan = scanPnpmFlags(subTokens, subcommandIdx + 1, state);\n		({isRecursive, isWorkspaceRoot, dirOverride} = state);\n		if (runScan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, runScan.filterIdx, ctx);\n		if (!runScan.name) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"pnpm run without script name\"\n		};\n		scriptName = runScan.name;\n	} else if (!PNPM_BUILTINS.has(subcommand)) scriptName = subcommand;\n	else {\n		for (const rule of allowRules) if (rule.match.test(\"pnpm\")) {\n			if (!rule.when || rule.when(tokens, ctx)) return {\n				action: \"allow\",\n				rule: rule.name,\n				reason: null\n			};\n		}\n		return {\n			action: \"passthrough\",\n			rule: null,\n			reason: null\n		};\n	}\n	if (isRecursive) return evaluatePnpmRecursive(scriptName, ctx);\n	if (isWorkspaceRoot) {\n		const root = findWorkspaceRoot(ctx.cwd);\n		if (!root) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"workspace root not found\"\n		};\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: root\n		});\n	}\n	if (dirOverride) {\n		const resolved = path.resolve(ctx.cwd, dirOverride);\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: resolved\n		});\n	}\n	return evaluatePnpmScript(scriptName, ctx);\n}\n/**\n* Resolve a pnpm script name via package.json and recursively evaluate\n* the resolved command(s) including pre/post scripts.\n*/\nfunction evaluatePnpmScript(scriptName, ctx) {\n	const resolved = resolveScript(scriptName, ctx.cwd);\n	if (!resolved) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"script resolution failed\"\n	};\n	const res = evaluateResolvedScript(resolved, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (res !== \"allow\") return res;\n	return {\n		action: \"allow\",\n		rule: `pnpm-script:${scriptName}`,\n		reason: null\n	};\n}\n/**\n* Evaluate `pnpm -r <script>` by resolving the script in each workspace package.\n*\n* Unlike `evaluatePnpmScript` (which resolves from the root package.json and would\n* cycle back to `pnpm -r <script>`), this resolves against each workspace package's\n* own package.json, breaking the recursion.\n*/\nfunction evaluatePnpmRecursive(scriptName, ctx) {\n	const resolved = resolveRecursiveScripts(scriptName, ctx.cwd);\n	if (!resolved || resolved.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm recursive\"\n	};\n	for (const pkg of resolved) {\n		const res = evaluateResolvedScript(pkg, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: pkg.pkgDir ?? ctx.cwd\n		});\n		if (res !== \"allow\") return res;\n	}\n	return {\n		action: \"allow\",\n		rule: `pnpm-recursive:${scriptName}`,\n		reason: null\n	};\n}\n/**\n* Evaluate an npm command. Read-only ops (view/info/show) are allowed.\n* Everything else is denied with a redirect message to the pnpm equivalent.\n*/\nfunction evaluateNpm(tokens) {\n	for (const rule of allowRules) if (rule.match.test(\"npm\")) {\n		if (!rule.when || rule.when(tokens, {\n			cwd: \"\",\n			depth: 0\n		})) return {\n			action: \"allow\",\n			rule: rule.name,\n			reason: null\n		};\n	}\n	return {\n		action: \"deny\",\n		rule: \"npm-redirect\",\n		reason: getNpmRedirectReason(tokens)\n	};\n}\n/**\n* Evaluate `pnpm --filter <pkg> [--filter <pkg> ...] <subcommand>`.\n*\n* Collects every `--filter` flag (both `--filter <pkg>` and `--filter=<pkg>`\n* forms), resolves each against pnpm-workspace.yaml, then classifies the\n* subcommand as built-in or script. Script commands are resolved and evaluated\n* in each filtered package — all must allow.\n*\n* Falls back to passthrough if workspace resolution fails.\n*/\nfunction evaluatePnpmFilter(_tokens, subTokens, filterIdx, ctx) {\n	const filterPkgs = [];\n	let cursor = filterIdx;\n	while (cursor < subTokens.length) {\n		const t = subTokens[cursor];\n		if (t === \"--filter\") {\n			const pkg = subTokens[cursor + 1];\n			if (!pkg || pkg.startsWith(\"-\")) return {\n				action: \"passthrough\",\n				rule: null,\n				reason: \"pnpm --filter without package\"\n			};\n			filterPkgs.push(pkg);\n			cursor += 2;\n		} else if (t.startsWith(\"--filter=\")) {\n			const pkg = t.slice(9);\n			if (!pkg) return {\n				action: \"passthrough\",\n				rule: null,\n				reason: \"pnpm --filter without package\"\n			};\n			filterPkgs.push(pkg);\n			cursor += 1;\n		} else break;\n	}\n	if (filterPkgs.length === 0) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	let filterSubcommand;\n	let subcmdIdx = -1;\n	for (let i = cursor; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\") {\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"--filter=\")) continue;\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		filterSubcommand = t;\n		subcmdIdx = i;\n		break;\n	}\n	if (!filterSubcommand) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm --filter without subcommand\"\n	};\n	if (filterSubcommand === \"install\" || filterSubcommand === \"i\") {\n		if (!subTokens.slice(subcmdIdx + 1).every((t) => t.startsWith(\"-\"))) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"pnpm --filter install with package arg\"\n		};\n		return {\n			action: \"allow\",\n			rule: \"pnpm\",\n			reason: null\n		};\n	}\n	if (filterSubcommand === \"dlx\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (filterSubcommand === \"add\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (new Set([\n		\"list\",\n		\"ls\",\n		\"ll\",\n		\"la\",\n		\"why\",\n		\"view\",\n		\"info\",\n		\"show\",\n		\"outdated\",\n		\"licenses\",\n		\"audit\"\n	]).has(filterSubcommand)) return {\n		action: \"allow\",\n		rule: \"pnpm\",\n		reason: null\n	};\n	if (filterSubcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcmdIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	const scriptName = filterSubcommand === \"run\" ? subTokens[subcmdIdx + 1] : filterSubcommand;\n	if (!scriptName || scriptName.startsWith(\"-\")) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"pnpm --filter run without script name\"\n	};\n	if (PNPM_BUILTINS.has(scriptName) && scriptName !== \"run\") return {\n		action: \"passthrough\",\n		rule: null,\n		reason: null\n	};\n	for (const pkg of filterPkgs) {\n		const resolved = resolveFilteredScript(scriptName, pkg, ctx.cwd);\n		if (!resolved) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"filtered script resolution failed\"\n		};\n		const res = evaluateResolvedScript(resolved, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: resolved.pkgDir ?? ctx.cwd\n		});\n		if (res !== \"allow\") return res;\n	}\n	return {\n		action: \"allow\",\n		rule: `pnpm-filter:${filterPkgs.join(\",\")}:${scriptName}`,\n		reason: null\n	};\n}\n/** Flags that modify shell behavior beyond simple command execution */\nconst SHELL_UNSAFE_FLAGS = new Set([\n	\"-i\",\n	\"--interactive\",\n	\"-l\",\n	\"--login\",\n	\"--init-file\",\n	\"--rcfile\",\n	\"--norc\",\n	\"--noprofile\",\n	\"-s\",\n	\"--stdin\"\n]);\n/**\n* Evaluate `bash -c` / `sh -c` / `zsh -c` commands.\n*\n* Only unwraps when the tokens are exactly: `<shell> -c <command-string>`.\n* Any additional flags, extra positional args, or missing -c → passthrough.\n*/\nfunction evaluateShellC(tokens, ctx) {\n	const cIdx = tokens.indexOf(\"-c\");\n	if (cIdx === -1) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell without -c\"\n	};\n	for (let i = 1; i < tokens.length; i++) {\n		if (i === cIdx) continue;\n		if (i === cIdx + 1) continue;\n		const t = tokens[i];\n		if (t.startsWith(\"-\") || SHELL_UNSAFE_FLAGS.has(t)) return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"shell -c with extra flags\"\n		};\n	}\n	const cmdArg = tokens[cIdx + 1];\n	if (!cmdArg) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell -c without command\"\n	};\n	if (tokens.length > cIdx + 2) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell -c with positional args\"\n	};\n	if (cIdx !== 1) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"shell -c with extra flags\"\n	};\n	return evaluateCommand(cmdArg, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n/** xargs flags that consume the next token as an argument */\nconst XARGS_ARG_FLAGS = new Set([\n	\"-I\",\n	\"-d\",\n	\"-n\",\n	\"-P\",\n	\"-s\",\n	\"-L\",\n	\"-E\",\n	\"-a\",\n	\"--max-args\",\n	\"--max-procs\",\n	\"--delimiter\",\n	\"--replace\",\n	\"--max-lines\",\n	\"--max-chars\",\n	\"--arg-file\",\n	\"--process-slot-var\"\n]);\n/** xargs flags that are boolean (no argument) */\nconst XARGS_BOOL_FLAGS = new Set([\n	\"-0\",\n	\"--null\",\n	\"-t\",\n	\"--verbose\",\n	\"-r\",\n	\"--no-run-if-empty\",\n	\"-p\",\n	\"--interactive\",\n	\"-x\",\n	\"--exit\",\n	\"--show-limits\"\n]);\n/**\n* Evaluate `xargs <cmd>` commands.\n*\n* Skips xargs flags to find the inner command, then recursively evaluates it.\n* Passthrough if no command follows the flags or if unrecognised flags are found.\n*/\nfunction evaluateXargs(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length) {\n		const t = tokens[i];\n		if (!t.startsWith(\"-\")) break;\n		if (XARGS_ARG_FLAGS.has(t)) {\n			i += 2;\n			continue;\n		}\n		const eqIdx = t.indexOf(\"=\");\n		if (eqIdx !== -1) {\n			const flagName = t.slice(0, eqIdx);\n			if (XARGS_ARG_FLAGS.has(flagName)) {\n				i++;\n				continue;\n			}\n		}\n		if (t.length > 2 && XARGS_ARG_FLAGS.has(t.slice(0, 2))) {\n			i++;\n			continue;\n		}\n		if (XARGS_BOOL_FLAGS.has(t)) {\n			i++;\n			continue;\n		}\n		return {\n			action: \"passthrough\",\n			rule: null,\n			reason: \"xargs with unrecognised flags\"\n		};\n	}\n	if (i >= tokens.length) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"xargs without command\"\n	};\n	return evaluateCommand(joinTokens(tokens.slice(i)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n\n//#endregion\n//#region src/file-rules.ts\nconst READ_TOOLS = new Set([\n	\"Read\",\n	\"Glob\",\n	\"Grep\"\n]);\nconst WRITE_TOOLS = new Set([\"Write\", \"Edit\"]);\nconst fileDenyRules = [\n	{\n		name: \"env-file-read\",\n		tools: READ_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"hooks-folder-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = path.resolve(ctx.cwd, filePath);\n			const hooksDir = path.join(ctx.cwd, \".claude\", \"hooks\");\n			return resolved.startsWith(hooksDir + path.sep) || resolved === hooksDir;\n		},\n		reason: \"Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"claude-settings-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			return path.resolve(ctx.cwd, filePath) === path.join(ctx.cwd, \".claude\", \"settings.json\");\n		},\n		reason: \"Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"outside-cwd-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = path.resolve(ctx.cwd, filePath);\n			if (resolved === ctx.cwd || resolved.startsWith(ctx.cwd + path.sep)) return false;\n			const homeClaudeDir = path.join(os.homedir(), \".claude\");\n			if (resolved === homeClaudeDir || resolved.startsWith(homeClaudeDir + path.sep)) return false;\n			return true;\n		},\n		reason: \"Don't write files outside the project directory.\"\n	}\n];\nconst fileAllowRules = [{\n	name: \"cwd-read\",\n	tools: READ_TOOLS,\n	action: \"allow\",\n	when: (filePath, ctx) => {\n		const resolved = path.resolve(ctx.cwd, filePath);\n		return resolved === ctx.cwd || resolved.startsWith(ctx.cwd + path.sep);\n	}\n}, {\n	name: \"cwd-write\",\n	tools: WRITE_TOOLS,\n	action: \"allow\",\n	when: (filePath, ctx) => {\n		const resolved = path.resolve(ctx.cwd, filePath);\n		return resolved === ctx.cwd || resolved.startsWith(ctx.cwd + path.sep);\n	}\n}];\n\n//#endregion\n//#region src/evaluate-tool.ts\n/** Tools whose input contains a `file_path` field. */\nconst FILE_PATH_TOOLS = new Set([\n	\"Read\",\n	\"Write\",\n	\"Edit\"\n]);\n/** Tools whose input contains a `path` field (search root, optional). */\nconst SEARCH_TOOLS = new Set([\"Glob\", \"Grep\"]);\n/**\n* Extract the relevant file path from tool input based on tool name.\n* Returns null if the input shape doesn't match expectations.\n*/\nfunction extractPath(toolName, toolInput, cwd) {\n	if (FILE_PATH_TOOLS.has(toolName)) return parseFilePathInput(toolInput)?.file_path ?? null;\n	if (SEARCH_TOOLS.has(toolName)) return parseSearchInput(toolInput)?.path ?? cwd;\n	return null;\n}\n/**\n* Evaluate a non-Bash tool invocation against file-tool rules.\n* Returns allow, deny, or passthrough.\n*/\nfunction evaluateToolUse(toolName, toolInput, ctx) {\n	const filePath = extractPath(toolName, toolInput, ctx.cwd);\n	if (filePath === null) return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"unknown tool input shape\"\n	};\n	for (const rule of fileDenyRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx)) return {\n		action: \"deny\",\n		rule: rule.name,\n		reason: rule.reason ?? null\n	};\n	for (const rule of fileAllowRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx)) return {\n		action: \"allow\",\n		rule: rule.name,\n		reason: null\n	};\n	return {\n		action: \"passthrough\",\n		rule: null,\n		reason: \"no file rule matched\"\n	};\n}\n\n//#endregion\n//#region src/index.ts\nconst inputResult = await readHookInput();\nif (!inputResult.ok) {\n	process.stderr.write(`[bst-hook] invalid hook input: ${inputResult.error}\\n`);\n	audit({\n		sessionId: \"unknown\",\n		cwd: \"unknown\",\n		command: `<invalid input: ${inputResult.error}>`,\n		decision: \"passthrough\",\n		rule: null,\n		reason: `validation failed: ${inputResult.error}`\n	});\n	process.exit(0);\n}\nconst input = inputResult.data;\nif (input.hook_event_name !== \"PreToolUse\") process.exit(0);\nif (!new Set([\n	\"Bash\",\n	\"Read\",\n	\"Write\",\n	\"Edit\",\n	\"Glob\",\n	\"Grep\"\n]).has(input.tool_name)) process.exit(0);\nconst repoAllowPatterns = loadRepoSettings(input.cwd);\nlet decision;\nlet auditCommand;\nif (input.tool_name === \"Bash\") {\n	const bashInput = parseBashInput(input.tool_input);\n	if (!bashInput) {\n		audit({\n			sessionId: input.session_id,\n			cwd: input.cwd,\n			toolName: input.tool_name,\n			command: `<invalid Bash input: ${JSON.stringify(input.tool_input).slice(0, 200)}>`,\n			decision: \"passthrough\",\n			rule: null,\n			reason: \"Bash tool_input missing or invalid 'command' field\"\n		});\n		process.exit(0);\n	}\n	decision = evaluateCommand(bashInput.command, {\n		cwd: input.cwd,\n		depth: 0,\n		repoAllowPatterns\n	});\n	auditCommand = bashInput.command;\n} else {\n	const projectDir = findWorkspaceRoot(input.cwd) ?? process.env[\"CLAUDE_PROJECT_DIR\"] ?? input.cwd;\n	decision = evaluateToolUse(input.tool_name, input.tool_input, { cwd: projectDir });\n	const filePath = String(input.tool_input[\"file_path\"] ?? input.tool_input[\"path\"] ?? \"\");\n	auditCommand = `${input.tool_name} ${filePath}`;\n}\naudit({\n	sessionId: input.session_id,\n	cwd: input.cwd,\n	toolName: input.tool_name,\n	command: auditCommand,\n	decision: decision.action,\n	rule: decision.rule,\n	reason: decision.reason\n});\nif (decision.action === \"allow\") writeDecision(\"allow\");\nelse if (decision.action === \"deny\") writeDecision(\"deny\", decision.reason);\n\n//#endregion\nexport {  };", "bst-hook.mjs"), writeIfChanged(ctx, GUIDE_PATH, "# bst-hook Permission Guide\n\nThis project uses a PreToolUse hook (`bst-hook`) that evaluates Bash commands\nand file tool operations before execution. Commands fall into three tiers:\n\n- **Denied** — blocked with a redirect message\n- **Allowed** — auto-approved, no prompt\n- **Passthrough** — falls through to Claude Code's normal permission prompt\n\n## Denied commands\n\nThese are blocked. The hook tells you what to do instead.\n\n### Bash\n\n- **rm-recursive**: Don't use recursive `rm`. Use more targeted deletes, or remove specific files/directories.\n- **sudo**: Don't use sudo. If you need elevated permissions, ask me to do it manually.\n- **git-force-push**: Use `git push --force-with-lease` instead of `--force`.\n- **git-reset-hard**: Don't `reset --hard` on main. Create a branch first.\n- **git-write**: Git write operations (push, commit, reset, merge, etc.) are not allowed. Ask the user to run these manually.\n- **chmod-777**: Don't use 777 permissions. Use more restrictive permissions.\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **npx-redirect**: This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\n\n### File tools (Read, Write, Edit, Glob, Grep)\n\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **hooks-folder-write**: Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\n- **claude-settings-write**: Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\n- **outside-cwd-write**: Don't write files outside the project directory.\n\n## Auto-approved commands\n\nThese run without prompting.\n\n### Bash\n\n- **Test runners**: vitest, jest\n- **Type checking**: tsc\n- **Build tools**: tsdown\n- **Tooling CLI**: bst (checks:run, hooks:audit, docker:build, docker:check, repo:sync)\n- **Linters & formatters**: oxlint, oxfmt, eslint, prettier, biome, knip\n- **Read-only commands**: cat, head, tail, grep, ls, wc, uniq, diff, echo, pwd, which, dirname, basename, realpath\n- **Package managers (read-only)**: npm (view, info, show only)\n- **Shell builtins**: test, bracket-test\n- **Navigation**: cd, true, colon\n- **Conditional commands**: find (without -exec, -delete), sort (without -o / --output)\n- **Git read operations**: git (status, log, diff, show, blame, branch, remote, fetch, rev-parse, etc.)\n- **Git safe writes**: git-safe-write (add, switch -c, checkout -b, stash push/pop/apply/show)\n- **pnpm (safe built-ins)**: pnpm (list, why, view, info, show, outdated, install (bare only))\n- **File operations (within project)**: cp (paths must be within project directory), mkdir (paths must be within project directory), touch (paths must be within project directory)\n\n### File tools\n\n- **Read/Glob/Grep**: Allowed within project directory\n- **Write/Edit**: Allowed within project directory\n\n## Passthrough\n\nEverything not listed above triggers Claude Code's normal permission prompt.\nCommon examples:\n\n- `pnpm add <pkg>`, `pnpm dlx <pkg>` (dependency changes)\n- `mv` (file moves)\n- `node`, `npx` scripts\n- Commands with output redirection (`> file`)\n- Any unrecognized command\n\n## How commands are evaluated\n\n- **Pipelines and chains**: every segment must be allowed; any deny blocks the whole command.\n- **pnpm scripts**: `pnpm <script>` resolves against `package.json` (including pre/post hooks and `--filter` workspaces) and evaluates the resolved command recursively.\n- **cd propagation**: `cd dir && cmd` evaluates `cmd` relative to the new directory.\n- **Audit log**: all decisions are logged to `.claude/hooks/bst-hook.audit.local.jsonl`.\n", "bst-hook-guide.md")];
 }
-const YamlSchemasSchema = z.record(z.string(), z.unknown());
-/** Merge yaml.schemas into a settings object. Returns the result and whether anything changed. */
-function mergeYamlSchemas(settings) {
-	const parsed = YamlSchemasSchema.safeParse(settings["yaml.schemas"]);
-	const yamlSchemas = parsed.success ? { ...parsed.data } : {};
-	if (SCHEMA_LOCAL_PATH in yamlSchemas) return {
-		merged: settings,
-		changed: false
-	};
-	yamlSchemas[SCHEMA_LOCAL_PATH] = SCHEMA_GLOB;
+//#endregion
+//#region src/generators/claude-settings.ts
+const HookEntrySchema = z.object({
+	type: z.string(),
+	command: z.string()
+});
+const HookMatcherSchema = z.object({
+	matcher: z.string(),
+	hooks: z.array(HookEntrySchema).default([])
+});
+const ClaudeSettingsSchema = z.object({
+	permissions: z.object({
+		allow: z.array(z.string()).default([]),
+		deny: z.array(z.string()).default([])
+	}).default({
+		allow: [],
+		deny: []
+	}),
+	hooks: z.record(z.string(), z.array(HookMatcherSchema)).default({}),
+	instructions: z.array(z.string()).default([]),
+	enabledPlugins: z.record(z.string(), z.boolean()).default({}),
+	extraKnownMarketplaces: z.record(z.string(), z.record(z.string(), z.unknown())).default({})
+});
+function parseClaudeSettings(raw) {
+	try {
+		const json = JSON.parse(raw);
+		const rawResult = z.record(z.string(), z.unknown()).safeParse(json);
+		const settingsResult = ClaudeSettingsSchema.safeParse(json);
+		if (!rawResult.success || !settingsResult.success) return void 0;
+		return {
+			settings: settingsResult.data,
+			rawJson: rawResult.data
+		};
+	} catch {
+		return;
+	}
+}
+function buildSettings(ctx) {
+	const allow = [];
+	const enabledPlugins = { "code-simplifier@claude-plugins-official": true };
+	const extraKnownMarketplaces = {};
+	if (ctx.config.structure === "monorepo") {
+		if (getMonorepoPackages(ctx.targetDir).some((pkg) => hasWebUIDeps(pkg.dir))) enabledPlugins["frontend-design@claude-plugins-official"] = true;
+	} else if (ctx.packageJson ? packageHasWebUIDeps(ctx.packageJson) : false) enabledPlugins["frontend-design@claude-plugins-official"] = true;
 	return {
-		merged: {
-			...settings,
-			"yaml.schemas": yamlSchemas
+		permissions: {
+			allow,
+			deny: []
 		},
-		changed: true
+		hooks: { PreToolUse: [{
+			matcher: "Bash|Read|Write|Edit|Glob|Grep",
+			hooks: [{
+				type: "command",
+				command: `node "$(git rev-parse --show-toplevel)/.claude/hooks/bst-hook.mjs"`
+			}]
+		}] },
+		instructions: [
+			"Use pnpm, not npm/yarn/npx. Run binaries with `pnpm exec`.",
+			"No typecasts (as/any). Use zod schemas, type guards, or narrowing instead.",
+			"Fix lint violations instead of suppressing them. Only add disable comments when suppression is genuinely the best option. For no-empty-function: add a `{ /* no-op */ }` comment body instead of a disable comment.",
+			"Prefer extensionless imports; if an extension is required, use .ts over .js.",
+			"The bst-hook manages Bash/file permissions. See .claude/hooks/bst-hook-guide.md for auto-approved, denied, and passthrough commands."
+		],
+		enabledPlugins,
+		extraKnownMarketplaces
 	};
 }
-function writeSchemaToSettings(ctx) {
-	if (ctx.exists(SETTINGS_PATH)) {
-		const raw = ctx.read(SETTINGS_PATH);
-		if (!raw) return {
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Could not read existing settings"
-		};
-		const parsed = VscodeSettingsSchema.safeParse(parse(raw));
-		if (!parsed.success) return {
-			filePath: SETTINGS_PATH,
+const BST_HOOK_MARKER = "bst-hook.mjs";
+/** Remove old per-tool bst-hook entries that are now covered by a consolidated matcher. */
+function removeObsoleteBstHookEntries(matchers, consolidatedMatcher) {
+	const consolidatedTools = new Set(consolidatedMatcher.split("|"));
+	return matchers.filter((m) => {
+		if (!consolidatedTools.has(m.matcher)) return true;
+		if (!m.hooks.some((h) => h.command.includes(BST_HOOK_MARKER))) return true;
+		return false;
+	});
+}
+/** Remove enabledPlugins/extraKnownMarketplaces/hooks when empty to keep the file clean. */
+function serializeSettings$1(settings) {
+	const { enabledPlugins, extraKnownMarketplaces, hooks, ...rest } = settings;
+	const out = { ...rest };
+	if (Object.keys(hooks).length > 0) out["hooks"] = hooks;
+	if (Object.keys(enabledPlugins).length > 0) out["enabledPlugins"] = enabledPlugins;
+	if (Object.keys(extraKnownMarketplaces).length > 0) out["extraKnownMarketplaces"] = extraKnownMarketplaces;
+	return JSON.stringify(out, null, 2) + "\n";
+}
+function writeOrMergeSettings(ctx, filePath, generated) {
+	const existing = ctx.read(filePath);
+	if (existing) {
+		const parsed = parseClaudeSettings(existing);
+		if (!parsed) return {
+			filePath,
 			action: "skipped",
 			description: "Could not parse existing settings"
 		};
-		const { merged, changed } = mergeYamlSchemas(parsed.data);
-		if (!changed) return {
-			filePath: SETTINGS_PATH,
+		const { settings, rawJson } = parsed;
+		const missingAllow = generated.permissions.allow.filter((rule) => !settings.permissions.allow.includes(rule));
+		const missingDeny = generated.permissions.deny.filter((rule) => !settings.permissions.deny.includes(rule));
+		const mergedInstructions = [...settings.instructions];
+		let instructionChanges = 0;
+		for (const inst of generated.instructions) {
+			if (mergedInstructions.includes(inst)) continue;
+			const prefixIdx = mergedInstructions.findIndex((e) => inst.startsWith(e) || e.startsWith(inst));
+			if (prefixIdx !== -1) mergedInstructions[prefixIdx] = inst;
+			else mergedInstructions.push(inst);
+			instructionChanges++;
+		}
+		let hookChanges = 0;
+		const mergedHooks = { ...settings.hooks };
+		for (const [event, generatedMatchers] of Object.entries(generated.hooks)) {
+			const existingMatchers = mergedHooks[event] ?? [];
+			for (const gm of generatedMatchers) {
+				const existingIdx = existingMatchers.findIndex((m) => m.matcher === gm.matcher && m.hooks.some((h) => h.command.includes(BST_HOOK_MARKER)));
+				if (existingIdx !== -1) {
+					const existingEntry = existingMatchers[existingIdx];
+					const genCommand = gm.hooks.find((h) => h.command.includes(BST_HOOK_MARKER))?.command;
+					const curCommand = existingEntry.hooks.find((h) => h.command.includes(BST_HOOK_MARKER))?.command;
+					if (genCommand && curCommand && genCommand !== curCommand) {
+						const target = (mergedHooks[event] ?? [])[existingIdx];
+						target.hooks = target.hooks.map((h) => h.command.includes(BST_HOOK_MARKER) ? Object.assign(h, { command: genCommand }) : h);
+						hookChanges++;
+					}
+					continue;
+				}
+				if (gm.matcher.includes("|")) {
+					const before = (mergedHooks[event] ?? []).length;
+					mergedHooks[event] = removeObsoleteBstHookEntries(mergedHooks[event] ?? [], gm.matcher);
+					const removed = before - (mergedHooks[event] ?? []).length;
+					if (removed > 0) hookChanges += removed;
+				}
+				mergedHooks[event] = [...mergedHooks[event] ?? [], gm];
+				hookChanges++;
+			}
+		}
+		const missingPlugins = Object.entries(generated.enabledPlugins).filter(([key]) => !(key in settings.enabledPlugins));
+		const missingMarketplaces = Object.entries(generated.extraKnownMarketplaces).filter(([key]) => !(key in settings.extraKnownMarketplaces));
+		const changed = missingAllow.length + missingDeny.length + hookChanges + instructionChanges + missingPlugins.length + missingMarketplaces.length;
+		if (changed === 0) return {
+			filePath,
 			action: "skipped",
-			description: "Already has Forgejo schema mapping"
+			description: "Already has all rules and instructions"
 		};
-		ctx.write(SETTINGS_PATH, serializeSettings(merged));
+		rawJson["permissions"] = {
+			allow: [...settings.permissions.allow, ...missingAllow],
+			deny: [...settings.permissions.deny, ...missingDeny]
+		};
+		if (Object.keys(mergedHooks).length > 0) rawJson["hooks"] = mergedHooks;
+		rawJson["instructions"] = mergedInstructions;
+		const updatedPlugins = { ...settings.enabledPlugins };
+		for (const [key, value] of missingPlugins) updatedPlugins[key] = value;
+		const updatedMarketplaces = { ...settings.extraKnownMarketplaces };
+		for (const [key, value] of missingMarketplaces) updatedMarketplaces[key] = value;
+		if (Object.keys(updatedPlugins).length > 0) rawJson["enabledPlugins"] = updatedPlugins;
+		else delete rawJson["enabledPlugins"];
+		if (Object.keys(updatedMarketplaces).length > 0) rawJson["extraKnownMarketplaces"] = updatedMarketplaces;
+		else delete rawJson["extraKnownMarketplaces"];
+		ctx.write(filePath, JSON.stringify(rawJson, null, 2) + "\n");
 		return {
-			filePath: SETTINGS_PATH,
+			filePath,
 			action: "updated",
-			description: "Added Forgejo workflow schema mapping"
+			description: `Updated ${String(changed)} rules/instructions`
 		};
 	}
-	ctx.write(SETTINGS_PATH, serializeSettings({ "yaml.schemas": { [SCHEMA_LOCAL_PATH]: SCHEMA_GLOB } }));
+	ctx.write(filePath, serializeSettings$1(generated));
 	return {
-		filePath: SETTINGS_PATH,
+		filePath,
 		action: "created",
-		description: "Generated .vscode/settings.json with Forgejo workflow schema"
+		description: `Generated ${filePath}`
 	};
 }
-async function generateVscodeSettings(ctx) {
+async function generateClaudeSettings(ctx) {
 	const results = [];
-	if (ctx.config.ci !== "forgejo") {
-		results.push({
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Not a Forgejo project"
-		});
-		return results;
-	}
-	const schemaContent = readSchemaFromNodeModules(ctx.targetDir);
-	if (!schemaContent) {
-		results.push({
-			filePath: SCHEMA_LOCAL_PATH,
-			action: "skipped",
-			description: "Could not find @bensandee/config schema in node_modules"
-		});
-		return results;
-	}
-	const existingSchema = ctx.read(SCHEMA_LOCAL_PATH);
-	if (existingSchema !== void 0 && contentEqual(SCHEMA_LOCAL_PATH, existingSchema, schemaContent)) results.push({
-		filePath: SCHEMA_LOCAL_PATH,
-		action: "skipped",
-		description: "Schema already up to date"
-	});
-	else {
-		ctx.write(SCHEMA_LOCAL_PATH, schemaContent);
-		results.push({
-			filePath: SCHEMA_LOCAL_PATH,
-			action: existingSchema ? "updated" : "created",
-			description: "Copied Forgejo workflow schema from @bensandee/config"
-		});
+	results.push(writeOrMergeSettings(ctx, ".claude/settings.json", buildSettings(ctx)));
+	if (ctx.config.structure === "monorepo") for (const pkg of getMonorepoPackages(ctx.targetDir)) {
+		const pkgRelDir = path.relative(ctx.targetDir, pkg.dir);
+		const claudeDir = path.join(pkgRelDir, ".claude");
+		if (ctx.exists(claudeDir)) {
+			ctx.remove(claudeDir);
+			results.push({
+				filePath: claudeDir,
+				action: "removed",
+				description: `Removed subpackage ${claudeDir} (plugins consolidated at root)`
+			});
+		}
 	}
-	results.push(writeSchemaToSettings(ctx));
 	return results;
 }
 //#endregion
-//#region src/coverage-tracking/compare.ts
-const TOTAL_KEYS = [
-	"lines",
-	"statements",
-	"branches",
-	"functions"
-];
-const DEFAULT_TOLERANCE_PP = .1;
-/** Round to 2 decimal places to keep diff output stable across runs. */
-function round2$1(n) {
-	return Math.round(n * 100) / 100;
-}
-/**
-* Compare a current run against a baseline across the four overall totals.
-* A total passes when current >= baseline OR (baseline - current) <= tolerancePp.
-*/
-function compareTotals(baseline, current, tolerancePp = DEFAULT_TOLERANCE_PP) {
-	const totals = TOTAL_KEYS.map((key) => {
-		const b = baseline[key];
-		const c = current[key];
-		return {
-			key,
-			baseline: b,
-			current: c,
-			delta: round2$1(c - b),
-			pass: c >= b || b - c <= tolerancePp
-		};
-	});
-	return {
-		pass: totals.every((t) => t.pass),
-		tolerancePp,
-		totals
+//#region src/generators/release-it.ts
+function buildConfig$3(ci, isMonorepo) {
+	const config = {
+		$schema: "https://unpkg.com/release-it/schema/release-it.json",
+		git: {
+			commitMessage: "chore: release v${version}",
+			tagName: "v${version}"
+		},
+		npm: { publish: true }
 	};
-}
-/** True iff every total is flat-or-up (delta >= 0). Used to gate baseline updates. */
-function isFlatOrUp(baseline, current) {
-	return TOTAL_KEYS.every((key) => current[key] >= baseline[key]);
-}
-//#endregion
-//#region src/coverage-tracking/parse.ts
-const TotalEntrySchema = z.object({
-	total: z.number(),
-	covered: z.number(),
-	skipped: z.number().optional(),
-	pct: z.number()
-});
-const FileEntrySchema = z.object({
-	lines: TotalEntrySchema,
-	statements: TotalEntrySchema,
-	branches: TotalEntrySchema,
-	functions: TotalEntrySchema
-});
-/**
-* Schema for v8 / istanbul `coverage/coverage-summary.json`. The "total" key
-* holds the grand totals; every other key is a per-file path → entry mapping.
-*/
-const V8CoverageSummarySchema = z.object({ total: FileEntrySchema }).catchall(FileEntrySchema);
-const TotalsSchema = z.object({
-	lines: z.number(),
-	statements: z.number(),
-	branches: z.number(),
-	functions: z.number()
-});
-const PackageEntrySchema = z.object({
-	lines: z.number(),
-	branches: z.number()
-});
-/** Coverage record without identity fields — body shape for `coverage-baseline.json`. */
-const CoverageBaselineSchema = z.object({
-	totals: TotalsSchema,
-	packages: z.record(z.string(), PackageEntrySchema)
-});
-/** Full trimmed record — appended to `coverage-history.jsonl` and emitted by `coverage:summary`. */
-const CoverageRecordSchema = CoverageBaselineSchema.extend({
-	sha: z.string(),
-	timestamp: z.string()
-});
-/** Parse a v8 `coverage-summary.json` blob; throws FatalError on malformed input. */
-function parseV8Summary(raw) {
-	let json;
-	try {
-		json = JSON.parse(raw);
-	} catch (error) {
-		throw new FatalError(`coverage-summary.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	const result = V8CoverageSummarySchema.safeParse(json);
-	if (!result.success) throw new FatalError(`coverage-summary.json shape doesn't match v8 / istanbul output: ${result.error.message}`);
-	return result.data;
-}
-/** Parse a `coverage-baseline.json` blob; throws FatalError on malformed input. */
-function parseBaseline(raw) {
-	let json;
-	try {
-		json = JSON.parse(raw);
-	} catch (error) {
-		throw new FatalError(`coverage-baseline.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+	if (ci === "github") config["github"] = { release: true };
+	const plugins = {};
+	if (isMonorepo) {
+		config["npm"] = {
+			publish: true,
+			allowSameVersion: true
+		};
+		plugins["@release-it/bumper"] = { out: "packages/*/package.json" };
 	}
-	const result = CoverageBaselineSchema.safeParse(json);
-	if (!result.success) throw new FatalError(`coverage-baseline.json has unexpected shape: ${result.error.message}`);
-	return result.data;
+	if (Object.keys(plugins).length > 0) config["plugins"] = plugins;
+	return config;
 }
-/** Parse a single line of `coverage-history.jsonl`; returns undefined for malformed lines. */
-function parseHistoryLine(line) {
-	let json;
-	try {
-		json = JSON.parse(line);
-	} catch (_error) {
-		return;
+async function generateReleaseIt(ctx) {
+	const filePath = ".release-it.json";
+	if (ctx.config.releaseStrategy !== "release-it") return {
+		filePath,
+		action: "skipped",
+		description: "release-it not requested"
+	};
+	const content = JSON.stringify(buildConfig$3(ctx.config.ci, ctx.config.structure === "monorepo"), null, 2) + "\n";
+	const existing = ctx.read(filePath);
+	if (existing) {
+		if (contentEqual(filePath, existing, content)) return {
+			filePath,
+			action: "skipped",
+			description: "Already configured"
+		};
+		if (await ctx.confirmOverwrite(filePath) === "skip") return {
+			filePath,
+			action: "skipped",
+			description: "Existing release-it config preserved"
+		};
 	}
-	const result = CoverageRecordSchema.safeParse(json);
-	return result.success ? result.data : void 0;
+	ctx.write(filePath, content);
+	return {
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated .release-it.json"
+	};
 }
 //#endregion
-//#region src/coverage-tracking/history.ts
-const DEFAULT_HISTORY_BRANCH = "bst/coverage-metrics";
-const HISTORY_FILE = "coverage-history.jsonl";
-const MAX_PUSH_ATTEMPTS = 5;
-function remoteRef(config) {
-	return `refs/remotes/${config.remote ?? "origin"}/${config.historyBranch}`;
+//#region src/generators/changesets.ts
+function buildConfig$2() {
+	return {
+		$schema: "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+		changelog: "@changesets/cli/changelog",
+		commit: false,
+		fixed: [],
+		linked: [],
+		access: "public",
+		baseBranch: "main",
+		updateInternalDependencies: "patch",
+		ignore: []
+	};
 }
-function fetchBranch(executor, config) {
-	const remote = config.remote ?? "origin";
-	if (executor.exec("git", [
-		"fetch",
-		remote,
-		`${config.historyBranch}:${remoteRef(config)}`
-	], { cwd: config.cwd }).exitCode !== 0) return { exists: false };
-	const revParse = executor.exec("git", [
-		"rev-parse",
-		"--quiet",
-		"--verify",
-		remoteRef(config)
-	], { cwd: config.cwd });
-	if (revParse.exitCode !== 0) return { exists: false };
+async function generateChangesets(ctx) {
+	const filePath = ".changeset/config.json";
+	if (ctx.config.releaseStrategy !== "changesets") return {
+		filePath,
+		action: "skipped",
+		description: "Changesets not requested"
+	};
+	const content = JSON.stringify(buildConfig$2(), null, 2) + "\n";
+	const existing = ctx.read(filePath);
+	if (existing) return {
+		filePath,
+		action: "skipped",
+		description: "Existing changesets config preserved"
+	};
+	ctx.write(filePath, content);
 	return {
-		exists: true,
-		parentSha: revParse.stdout.trim()
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated .changeset/config.json"
 	};
 }
-function readRemoteHistory(executor, config) {
-	const showResult = executor.exec("git", ["show", `${remoteRef(config)}:${HISTORY_FILE}`], { cwd: config.cwd });
-	if (showResult.exitCode !== 0) return "";
-	return showResult.stdout;
+//#endregion
+//#region src/generators/lefthook.ts
+const LINT_COMMAND = "pnpm exec oxlint --no-error-on-unmatched-pattern {staged_files}";
+function formatCommandFor(formatter) {
+	return formatter === "prettier" ? "pnpm exec prettier --ignore-unknown --no-error-on-unmatched-pattern --write {staged_files}" : "pnpm exec oxfmt --no-error-on-unmatched-pattern {staged_files}";
 }
-function makeBlob(executor, cwd, content) {
-	const result = executor.exec("git", [
-		"hash-object",
-		"-w",
-		"--stdin"
-	], {
-		cwd,
-		input: content
-	});
-	if (result.exitCode !== 0) throw new FatalError(`git hash-object failed: ${result.stderr.trim() || "unknown error"}`);
-	return result.stdout.trim();
+function requiredCommands(formatter) {
+	return {
+		lint: { run: LINT_COMMAND },
+		format: {
+			run: formatCommandFor(formatter),
+			stage_fixed: true
+		}
+	};
 }
-function makeTree(executor, cwd, blobSha) {
-	const treeInput = `100644 blob ${blobSha}\t${HISTORY_FILE}\n`;
-	const result = executor.exec("git", ["mktree"], {
-		cwd,
-		input: treeInput
-	});
-	if (result.exitCode !== 0) throw new FatalError(`git mktree failed: ${result.stderr.trim() || "unknown error"}`);
-	return result.stdout.trim();
+function buildConfig$1(formatter) {
+	return [
+		"pre-commit:",
+		"  commands:",
+		"    lint:",
+		`      run: ${LINT_COMMAND}`,
+		"    format:",
+		`      run: ${formatCommandFor(formatter)}`,
+		"      stage_fixed: true",
+		""
+	].join("\n");
 }
-function makeCommit(executor, config, treeSha, parentSha, message) {
-	const env = {};
-	if (config.authorName) {
-		env["GIT_AUTHOR_NAME"] = config.authorName;
-		env["GIT_COMMITTER_NAME"] = config.authorName;
-	}
-	if (config.authorEmail) {
-		env["GIT_AUTHOR_EMAIL"] = config.authorEmail;
-		env["GIT_COMMITTER_EMAIL"] = config.authorEmail;
+const ARCHIVE_DIR = ".tooling-archived";
+/** Common client-side git hooks that husky may have configured. */
+const HUSKY_HOOK_NAMES = [
+	"pre-commit",
+	"commit-msg",
+	"pre-push",
+	"post-merge",
+	"post-checkout",
+	"prepare-commit-msg"
+];
+/** All known lint-staged config file locations to archive. */
+const LINT_STAGED_CONFIG_PATHS = [
+	"lint-staged.config.mjs",
+	"lint-staged.config.js",
+	"lint-staged.config.cjs",
+	".lintstagedrc",
+	".lintstagedrc.json",
+	".lintstagedrc.yaml",
+	".lintstagedrc.yml",
+	".lintstagedrc.mjs",
+	".lintstagedrc.cjs"
+];
+/** All known lefthook config file locations, in priority order. */
+const LEFTHOOK_CONFIG_PATHS = ["lefthook.yml", ".lefthook.yml"];
+/** Archive all husky hook files found in .husky/ */
+function archiveHuskyHooks(ctx, results) {
+	let found = false;
+	for (const hook of HUSKY_HOOK_NAMES) {
+		const huskyPath = `.husky/${hook}`;
+		const existing = ctx.read(huskyPath);
+		if (existing !== void 0) {
+			ctx.write(`${ARCHIVE_DIR}/${huskyPath}`, existing);
+			ctx.remove(huskyPath);
+			results.push({
+				filePath: huskyPath,
+				action: "archived",
+				description: `Moved to ${ARCHIVE_DIR}/${huskyPath}`
+			});
+			found = true;
+		}
 	}
-	const args = parentSha ? [
-		"commit-tree",
-		"-p",
-		parentSha,
-		"-m",
-		message,
-		treeSha
-	] : [
-		"commit-tree",
-		"-m",
-		message,
-		treeSha
-	];
-	const result = executor.exec("git", args, {
-		cwd: config.cwd,
-		env
-	});
-	if (result.exitCode !== 0) throw new FatalError(`git commit-tree failed: ${result.stderr.trim() || "unknown error"}`);
-	return result.stdout.trim();
-}
-function pushCommit(executor, config, commitSha, parentSha) {
-	const remote = config.remote ?? "origin";
-	const refSpec = `${commitSha}:refs/heads/${config.historyBranch}`;
-	if (parentSha === void 0) return executor.exec("git", [
-		"push",
-		remote,
-		refSpec
-	], { cwd: config.cwd });
-	const lease = `--force-with-lease=refs/heads/${config.historyBranch}:${parentSha}`;
-	return executor.exec("git", [
-		"push",
-		lease,
-		remote,
-		refSpec
-	], { cwd: config.cwd });
-}
-function shortSha(sha) {
-	return sha.slice(0, 7);
-}
-/**
-* Append a coverage record to the orphan branch. Bootstraps the branch on first run.
-* Uses pure git plumbing (no worktree / no checkout) so the working tree stays untouched.
-* On push conflict (concurrent record), refetches and rebuilds the commit (up to MAX_PUSH_ATTEMPTS).
-*/
-function appendRecord(executor, config, record) {
-	const line = JSON.stringify(record) + "\n";
-	let lastError = "";
-	for (let attempt = 1; attempt <= MAX_PUSH_ATTEMPTS; attempt++) {
-		const fetched = fetchBranch(executor, config);
-		const newContent = (fetched.exists ? readRemoteHistory(executor, config) : "") + line;
-		const blobSha = makeBlob(executor, config.cwd, newContent);
-		const treeSha = makeTree(executor, config.cwd, blobSha);
-		const message = `chore(coverage): record ${shortSha(record.sha)} [skip ci]`;
-		const commitSha = makeCommit(executor, config, treeSha, fetched.parentSha, message);
-		const pushResult = pushCommit(executor, config, commitSha, fetched.parentSha);
-		if (pushResult.exitCode === 0) return {
-			commitSha,
-			bootstrapped: !fetched.exists,
-			attempts: attempt
-		};
-		lastError = pushResult.stderr.trim() || pushResult.stdout.trim() || "unknown push error";
+	return found;
+}
+/** Archive all lint-staged config files. */
+function archiveLintStagedConfigs(ctx, results) {
+	let found = false;
+	for (const lsPath of LINT_STAGED_CONFIG_PATHS) {
+		const existing = ctx.read(lsPath);
+		if (existing !== void 0) {
+			ctx.write(`${ARCHIVE_DIR}/${lsPath}`, existing);
+			ctx.remove(lsPath);
+			results.push({
+				filePath: lsPath,
+				action: "archived",
+				description: `Moved to ${ARCHIVE_DIR}/${lsPath}`
+			});
+			found = true;
+		}
 	}
-	throw new FatalError(`Failed to push to ${config.historyBranch} after ${MAX_PUSH_ATTEMPTS} attempts: ${lastError}`);
+	return found;
 }
-/**
-* Read all records from the orphan branch (read-only). Performs a shallow fetch and
-* reads via `git show` — no working-tree disruption, no local branch creation.
-* Returns an empty array if the branch doesn't exist yet.
-*/
-function readRecords(executor, config) {
-	if (!fetchBranch(executor, config).exists) return [];
-	const raw = readRemoteHistory(executor, config);
-	const records = [];
-	for (const line of raw.split("\n")) {
-		if (line.trim() === "") continue;
-		const parsed = parseHistoryLine(line);
-		if (parsed) records.push(parsed);
+/** Remove husky/lint-staged from package.json devDependencies and fix prepare script. */
+function cleanPackageJson(ctx, results) {
+	const raw = ctx.read("package.json");
+	if (!raw) return;
+	const pkg = parsePackageJson(raw);
+	if (!pkg) return;
+	const changes = [];
+	if (pkg.devDependencies) {
+		if ("husky" in pkg.devDependencies) {
+			delete pkg.devDependencies["husky"];
+			changes.push("removed devDependency: husky");
+		}
+		if ("lint-staged" in pkg.devDependencies) {
+			delete pkg.devDependencies["lint-staged"];
+			changes.push("removed devDependency: lint-staged");
+		}
 	}
-	return records;
+	if (pkg.scripts?.["prepare"] && /\bhusky\b/.test(pkg.scripts["prepare"])) {
+		delete pkg.scripts["prepare"];
+		changes.push("removed husky prepare script");
+	}
+	if (changes.length === 0) return;
+	ctx.write("package.json", JSON.stringify(pkg, null, 2) + "\n");
+	results.push({
+		filePath: "package.json",
+		action: "updated",
+		description: changes.join(", ")
+	});
+}
+async function generateLefthook(ctx) {
+	const filePath = "lefthook.yml";
+	const content = buildConfig$1(ctx.config.formatter);
+	const results = [];
+	archiveHuskyHooks(ctx, results);
+	archiveLintStagedConfigs(ctx, results);
+	cleanPackageJson(ctx, results);
+	const existingPath = LEFTHOOK_CONFIG_PATHS.find((p) => ctx.exists(p));
+	if (existingPath) {
+		const existing = ctx.read(existingPath);
+		if (existing) {
+			const merged = mergeLefthookCommands(existing, requiredCommands(ctx.config.formatter));
+			if (merged.changed) {
+				ctx.write(existingPath, merged.content);
+				results.push({
+					filePath: existingPath,
+					action: "updated",
+					description: "Added missing pre-commit commands"
+				});
+			} else results.push({
+				filePath: existingPath,
+				action: "skipped",
+				description: "Lefthook config already up to date"
+			});
+		} else results.push({
+			filePath: existingPath,
+			action: "skipped",
+			description: "Could not read existing lefthook config"
+		});
+		return results;
+	}
+	ctx.write(filePath, content);
+	results.push({
+		filePath,
+		action: "created",
+		description: "Generated lefthook pre-commit config"
+	});
+	return results;
 }
 //#endregion
-//#region src/coverage-tracking/config.ts
-/** Resolve the effective coverage configuration from explicit inputs (testable). */
-function resolveFromInputs(inputs) {
-	if (inputs.coverage === false) return {
-		enabled: false,
-		historyEnabled: false,
-		historyBranch: DEFAULT_HISTORY_BRANCH,
-		tolerancePp: DEFAULT_TOLERANCE_PP,
-		gateOnPullRequests: false
+//#region src/generators/vscode-settings.ts
+const SCHEMA_NPM_PATH = "@bensandee/config/schemas/forgejo-workflow.schema.json";
+const SCHEMA_LOCAL_PATH = ".vscode/forgejo-workflow.schema.json";
+const SETTINGS_PATH = ".vscode/settings.json";
+const SCHEMA_GLOB = ".forgejo/workflows/*.{yml,yaml}";
+const VscodeSettingsSchema = z.looseObject({ "yaml.schemas": z.record(z.string(), z.unknown()).default({}) });
+function readSchemaFromNodeModules(targetDir) {
+	const candidate = path.join(targetDir, "node_modules", SCHEMA_NPM_PATH);
+	if (!existsSync(candidate)) return void 0;
+	return readFileSync(candidate, "utf-8");
+}
+function serializeSettings(settings) {
+	return JSON.stringify(settings, null, 2) + "\n";
+}
+const YamlSchemasSchema = z.record(z.string(), z.unknown());
+/** Merge yaml.schemas into a settings object. Returns the result and whether anything changed. */
+function mergeYamlSchemas(settings) {
+	const parsed = YamlSchemasSchema.safeParse(settings["yaml.schemas"]);
+	const yamlSchemas = parsed.success ? { ...parsed.data } : {};
+	if (SCHEMA_LOCAL_PATH in yamlSchemas) return {
+		merged: settings,
+		changed: false
 	};
-	const enabled = inputs.hasVitestConfig || inputs.setupVitest;
-	const overrides = inputs.coverage ?? {};
+	yamlSchemas[SCHEMA_LOCAL_PATH] = SCHEMA_GLOB;
 	return {
-		enabled,
-		historyEnabled: enabled && overrides.history !== "none",
-		historyBranch: overrides.historyBranch ?? "bst/coverage-metrics",
-		tolerancePp: overrides.tolerancePp ?? .1,
-		gateOnPullRequests: overrides.gateOnPullRequests ?? false
+		merged: {
+			...settings,
+			"yaml.schemas": yamlSchemas
+		},
+		changed: true
 	};
 }
-/**
-* Resolve from the real filesystem (used by CLI commands).
-* Default-on when a vitest config is detected and `.tooling.json#coverage` is not `false`.
-*/
-function resolveCoverageConfig(targetDir) {
-	const tooling = safeLoadToolingConfig(targetDir);
-	return resolveFromInputs({
-		hasVitestConfig: existsSync(path.join(targetDir, "vitest.config.ts")) || existsSync(path.join(targetDir, "vitest.config.mts")),
-		setupVitest: tooling?.setupVitest === true,
-		coverage: tooling?.coverage
-	});
+function writeSchemaToSettings(ctx) {
+	if (ctx.exists(SETTINGS_PATH)) {
+		const raw = ctx.read(SETTINGS_PATH);
+		if (!raw) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Could not read existing settings"
+		};
+		const parsed = VscodeSettingsSchema.safeParse(parse(raw));
+		if (!parsed.success) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Could not parse existing settings"
+		};
+		const { merged, changed } = mergeYamlSchemas(parsed.data);
+		if (!changed) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Already has Forgejo schema mapping"
+		};
+		ctx.write(SETTINGS_PATH, serializeSettings(merged));
+		return {
+			filePath: SETTINGS_PATH,
+			action: "updated",
+			description: "Added Forgejo workflow schema mapping"
+		};
+	}
+	ctx.write(SETTINGS_PATH, serializeSettings({ "yaml.schemas": { [SCHEMA_LOCAL_PATH]: SCHEMA_GLOB } }));
+	return {
+		filePath: SETTINGS_PATH,
+		action: "created",
+		description: "Generated .vscode/settings.json with Forgejo workflow schema"
+	};
 }
-const CoverageOverridesShape = z.object({
-	history: z.enum(["orphan-branch", "none"]).optional(),
-	historyBranch: z.string().optional(),
-	tolerancePp: z.number().nonnegative().optional(),
-	gateOnPullRequests: z.boolean().optional()
-});
-const CoverageFieldSchema = z.union([z.literal(false), CoverageOverridesShape]);
-const ToolingShallowSchema = z.object({
-	setupVitest: z.boolean().optional(),
-	coverage: CoverageFieldSchema.optional()
-});
-/** Resolve from a generator context (used by generators for mock-friendly testing). */
-function resolveCoverageConfigFromContext(reader, fallbackSetupVitest) {
-	const toolingRaw = reader.read(".tooling.json");
-	let setupVitest = fallbackSetupVitest;
-	let coverage;
-	if (toolingRaw) try {
-		const result = ToolingShallowSchema.safeParse(JSON.parse(toolingRaw));
-		if (result.success) {
-			if (typeof result.data.setupVitest === "boolean") setupVitest = result.data.setupVitest;
-			coverage = result.data.coverage;
-		}
-	} catch (_error) {}
-	return resolveFromInputs({
-		hasVitestConfig: reader.exists("vitest.config.ts") || reader.exists("vitest.config.mts"),
-		setupVitest,
-		coverage
+async function generateVscodeSettings(ctx) {
+	const results = [];
+	if (ctx.config.ci !== "forgejo") {
+		results.push({
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Not a Forgejo project"
+		});
+		return results;
+	}
+	const schemaContent = readSchemaFromNodeModules(ctx.targetDir);
+	if (!schemaContent) {
+		results.push({
+			filePath: SCHEMA_LOCAL_PATH,
+			action: "skipped",
+			description: "Could not find @bensandee/config schema in node_modules"
+		});
+		return results;
+	}
+	const existingSchema = ctx.read(SCHEMA_LOCAL_PATH);
+	if (existingSchema !== void 0 && contentEqual(SCHEMA_LOCAL_PATH, existingSchema, schemaContent)) results.push({
+		filePath: SCHEMA_LOCAL_PATH,
+		action: "skipped",
+		description: "Schema already up to date"
 	});
-}
-/** Like loadToolingConfig but returns undefined on any error so commands can degrade gracefully. */
-function safeLoadToolingConfig(targetDir) {
-	try {
-		return loadToolingConfig(targetDir);
-	} catch (_error) {
-		return;
+	else {
+		ctx.write(SCHEMA_LOCAL_PATH, schemaContent);
+		results.push({
+			filePath: SCHEMA_LOCAL_PATH,
+			action: existingSchema ? "updated" : "created",
+			description: "Copied Forgejo workflow schema from @bensandee/config"
+		});
 	}
+	results.push(writeSchemaToSettings(ctx));
+	return results;
 }
 //#endregion
 //#region src/generators/coverage-ci.ts
@@ -4395,6 +4428,10 @@ function coverageSteps(nodeVersionYaml) {
 			}
 		} },
 		{ step: { run: "pnpm install --frozen-lockfile" } },
+		{ step: {
+			name: "Build",
+			run: "pnpm build"
+		} },
 		{ step: {
 			name: "Run tests with coverage",
 			run: "pnpm test:coverage"
@@ -4674,7 +4711,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.56.0 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.57.1 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -8088,7 +8125,7 @@ const out = (msg) => console.log(msg);
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.56.0",
+		version: "0.57.1",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -8160,7 +8197,7 @@ const main = defineCommand({
 		})
 	}
 });
-console.log(`@bensandee/tooling v0.56.0`);
+console.log(`@bensandee/tooling v0.57.1`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);