@brainervirus/workit-codex 8.22.2 → 8.23.0

package/dist/{workit-hook-aq4zdwdp.js → workit-hook-hegafjtc.js}

@@ -1393,8 +1393,6 @@ var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/
 var base64url = /^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2,3})?$/;
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
-var creditCard = /^\d(?:[ -]?\d){11,18}$/;
-var iban = /^[A-Z]{2}(?!00|01|99)\d{2}[A-Z0-9]{11,30}$/;
 var dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
 function anchor(source) {
   return new RegExp(`^${source}$`);
@@ -2240,41 +2238,6 @@ var $ZodE164 = /* @__PURE__ */ $constructor("$ZodE164", (inst, def) => {
   def.pattern ?? (def.pattern = e164);
   $ZodStringFormat.init(inst, def);
 });
-var CC_SANITIZE = /[- ]/g;
-function isLuhnAlgo(digits) {
-  let length = digits.length;
-  let bit = 1;
-  let sum = 0;
-  while (length) {
-    const value = digits.charCodeAt(--length) - 48;
-    bit ^= 1;
-    sum += bit ? [0, 2, 4, 6, 8, 1, 3, 5, 7, 9][value] : value;
-  }
-  return sum % 10 === 0;
-}
-function isValidCreditCard(input) {
-  if (!creditCard.test(input))
-    return false;
-  return isLuhnAlgo(input.replace(CC_SANITIZE, ""));
-}
-function isIso7064Mod97(iban2) {
-  let remainder = 0;
-  const len = iban2.length;
-  for (let i = 4;i < len; i++) {
-    const code = iban2.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
-  }
-  for (let i = 0;i < 4; i++) {
-    const code = iban2.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
-  }
-  return remainder === 1;
-}
-function isValidIBAN(input) {
-  if (!iban.test(input))
-    return false;
-  return isIso7064Mod97(input);
-}
 function isValidJWT(token, algorithm = null) {
   try {
     const tokensParts = token.split(".");
@@ -3587,9 +3550,6 @@ function settle(inst, answer) {
     recursive.set(inst, answer === PROVEN);
   return answer;
 }
-function isRecursiveSchema(inst) {
-  return isRecursive(inst, new Set, true) !== NONE;
-}
 function bucketFor(state, inst) {
   let bucket = state.buckets.get(inst);
   if (!bucket) {
@@ -3829,1651 +3789,53 @@ function en_default() {
     localeError: error()
   };
 }
-// node_modules/zod/v4/core/registries.js
-var _a2;
-class $ZodRegistry {
-  constructor() {
-    this._map = new WeakMap;
-    this._idmap = new Map;
-  }
-  add(schema, ..._meta) {
-    const meta = _meta[0];
-    this._map.set(schema, meta);
-    if (meta && typeof meta === "object" && "id" in meta) {
-      this._idmap.set(meta.id, schema);
-    }
-    return this;
-  }
-  clear() {
-    this._map = new WeakMap;
-    this._idmap = new Map;
-    return this;
-  }
-  remove(schema) {
-    const meta = this._map.get(schema);
-    if (meta && typeof meta === "object" && "id" in meta) {
-      this._idmap.delete(meta.id);
-    }
-    this._map.delete(schema);
-    return this;
-  }
-  get(schema) {
-    const p = schema._zod.parent;
-    if (p) {
-      const pm = { ...this.get(p) ?? {} };
-      delete pm.id;
-      const f = { ...pm, ...this._map.get(schema) };
-      return Object.keys(f).length ? f : undefined;
-    }
-    return this._map.get(schema);
-  }
-  has(schema) {
-    return this._map.has(schema);
-  }
-}
-function registry() {
-  return new $ZodRegistry;
-}
-(_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
-var globalRegistry = globalThis.__zod_globalRegistry;
-// node_modules/zod/v4/core/compile.js
-var INVALID = Symbol.for("zod.compile.invalid");
-var FALLBACK_FLAG = Symbol.for("zod.compile.fallback");
-
-class ZodCompileAsyncError extends Error {
-  constructor(message = "z.compile does not support async refinements, transforms, or checks") {
-    super(message);
-    this.name = "ZodCompileAsyncError";
-  }
-}
-
-class ZodCompileUnsupportedError extends Error {
-  constructor(feature, islandable = true) {
-    super(`z.compile does not support ${feature}; this schema must use the runtime parser`);
-    this.name = "ZodCompileUnsupportedError";
-    this.islandable = islandable;
-  }
-}
-function compileValidator(schema, parser) {
-  try {
-    return compileFn(schema, { assertOnly: true });
-  } catch {
-    return parser;
-  }
-}
-function compile(schema, options) {
-  try {
-    const parser = compileFn(schema);
-    const clone = withParser(schema, parser);
-    clone._zod.bag.validator = compileValidator(schema, parser);
-    return clone;
-  } catch (err) {
-    if (options?.strict)
-      throw err;
-    return schema;
-  }
-}
-function withParser(schema, parser) {
-  if (isRecursiveSchema(schema)) {
-    throw new ZodCompileUnsupportedError("a schema whose subtree contains a reference cycle");
-  }
-  const clone2 = clone(schema);
-  const liveRun = schema._zod.run;
-  const originalRun = liveRun.__originalRun ?? liveRun;
-  const wrapped = (payload, ctx) => {
-    if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks || ctx?.[FALLBACK_FLAG]) {
-      return originalRun(payload, ctx);
-    }
-    if (ctx && isBackEdge(ctx, payload.value)) {
-      return originalRun(payload, ctx);
-    }
-    const out = parser(payload.value);
-    if (out !== INVALID) {
-      payload.value = out;
-      return payload;
-    }
-    if (ctx)
-      ctx[FALLBACK_FLAG] = true;
-    return originalRun(payload, ctx);
-  };
-  wrapped.__originalRun = originalRun;
-  clone2._zod.bag.fallbackRun = originalRun;
-  clone2._zod.bag.validator = parser;
-  clone2._zod.run = wrapped;
-  if (!liveRun.__originalRun)
-    installCompiledUserMethods(clone2, schema, parser);
-  return clone2;
-}
-function installCompiledUserMethods(target, source, parser) {
-  const targetAny = target;
-  const sourceAny = source;
-  if (typeof sourceAny.safeParse === "function") {
-    const originalSafeParse = sourceAny.safeParse;
-    targetAny.safeParse = (data, params) => {
-      const out = parser(data);
-      if (out !== INVALID) {
-        return { success: true, data: out };
-      }
-      return originalSafeParse(data, params);
-    };
-  }
-  if (typeof sourceAny.parse === "function") {
-    const originalParse = sourceAny.parse;
-    targetAny.parse = (data, params) => {
-      const out = parser(data);
-      if (out !== INVALID) {
-        return out;
-      }
-      return originalParse(data, params);
-    };
-  }
-}
-function compileFn(schema, options) {
-  let recursive = true;
-  try {
-    recursive = isRecursiveSchema(schema);
-  } catch {}
-  if (recursive) {
-    throw new ZodCompileUnsupportedError("a schema whose subtree contains a reference cycle");
-  }
-  const ctx = {
-    constants: new Map,
-    constantCounter: 0,
-    varCounter: 0,
-    definite: true
-  };
-  const doc = new Doc(["input"]);
-  const outputAccessor = generateCheck(doc, ctx, schema, "input", !options?.assertOnly);
-  doc.write(outputAccessor === null ? `return true;` : `return ${outputAccessor};`);
-  const constantNames = ["INVALID", ...ctx.constants.keys()];
-  const constantValues = [INVALID, ...ctx.constants.values()];
-  const code = doc.content.join(`
-`);
-  const fullCode = options?.debug ? constantNames.length > 0 ? `// Constants: ${constantNames.join(", ")}
-${code}` : code : "";
-  const F = Function;
-  const factoryCode = `return (input) => {
-${code}
-}`;
-  let fn;
-  try {
-    const factory = new F(...constantNames, factoryCode);
-    fn = factory(...constantValues);
-  } catch (err) {
-    throw new ZodCompileUnsupportedError(`this schema (generated code failed to evaluate: ${err.message})`);
-  }
-  if (options?.debug) {
-    fn.code = fullCode;
-  }
-  fn.definite = ctx.definite;
-  return fn;
-}
-function addConstant(ctx, value) {
-  for (const [name, v] of ctx.constants) {
-    if (v === value)
-      return name;
-  }
-  const name = `c${ctx.constantCounter++}`;
-  ctx.constants.set(name, value);
-  return name;
-}
-function addUserConstant(ctx, fn) {
-  ctx.definite = false;
-  return addConstant(ctx, fn);
-}
-function newVar(ctx) {
-  return `v${ctx.varCounter++}`;
-}
-function runtimeRun(schema, value) {
-  const result = schema._zod.run({ value, issues: [] }, {});
-  if (result && typeof result.then === "function")
-    return INVALID;
-  const r = result;
-  return r.issues.length === 0 ? r.value : INVALID;
-}
-function compileChild(doc, ctx, schema, accessor, needsValue = true) {
-  const contentLen = doc.content.length;
-  const constantCount = ctx.constants.size;
-  const constantCounter = ctx.constantCounter;
-  const varCounter = ctx.varCounter;
-  try {
-    return generateCheck(doc, ctx, schema, accessor, needsValue);
-  } catch (err) {
-    if (!(err instanceof ZodCompileUnsupportedError) || !err.islandable)
-      throw err;
-    doc.content.length = contentLen;
-    if (ctx.constants.size > constantCount) {
-      const trailing = Array.from(ctx.constants.keys()).slice(constantCount);
-      for (const k of trailing)
-        ctx.constants.delete(k);
-    }
-    ctx.constantCounter = constantCounter;
-    ctx.varCounter = varCounter;
-    return emitRuntimeIsland(doc, ctx, schema, accessor);
-  }
-}
-function emitRuntimeIsland(doc, ctx, schema, accessor) {
-  ctx.definite = false;
-  const schemaConst = addConstant(ctx, schema);
-  const runConst = addConstant(ctx, runtimeRun);
-  const outVar = newVar(ctx);
-  doc.write(`const ${outVar} = ${runConst}(${schemaConst}, ${accessor});`);
-  doc.write(`if (${outVar} === INVALID) return INVALID;`);
-  return outVar;
-}
-var WHEN_DEFAULTED_CHECKS = new Set([
-  "max_size",
-  "min_size",
-  "size_equals",
-  "max_length",
-  "min_length",
-  "length_equals"
-]);
-function generateChecks(doc, ctx, schema, accessor) {
-  const schemaChecks = schema._zod.def.checks;
-  if (!schemaChecks || schemaChecks.length === 0)
-    return accessor;
-  let currentAccessor = accessor;
-  for (const check of schemaChecks) {
-    const def = check._zod.def;
-    if (def.when && !WHEN_DEFAULTED_CHECKS.has(def.check)) {
-      throw new ZodCompileUnsupportedError(`check with a custom "when" condition`);
-    }
-    switch (def.check) {
-      case "greater_than":
-        generateGreaterThanCheck(doc, ctx, def, currentAccessor);
-        break;
-      case "less_than":
-        generateLessThanCheck(doc, ctx, def, currentAccessor);
-        break;
-      case "multiple_of":
-        generateMultipleOfCheck(doc, ctx, def, currentAccessor);
-        break;
-      case "number_format":
-        generateNumberFormatCheck(doc, def, currentAccessor);
-        break;
-      case "min_length": {
-        const min = numericOperand(def.minimum, "min_length");
-        const len = codePointLengthVar(doc, ctx, currentAccessor, `${currentAccessor}.length >= ${min} && ${currentAccessor}.length < ${def.minimum * 2}`);
-        doc.write(`if (${len} < ${min}) return INVALID;`);
-        break;
-      }
-      case "max_length": {
-        const max = numericOperand(def.maximum, "max_length");
-        const len = codePointLengthVar(doc, ctx, currentAccessor, `${currentAccessor}.length > ${max}`);
-        doc.write(`if (${len} > ${max}) return INVALID;`);
-        break;
-      }
-      case "length_equals": {
-        const exact = numericOperand(def.length, "length_equals");
-        const len = codePointLengthVar(doc, ctx, currentAccessor, `${currentAccessor}.length >= ${exact} && ${currentAccessor}.length <= ${def.length * 2}`);
-        doc.write(`if (${len} !== ${exact}) return INVALID;`);
-        break;
-      }
-      case "min_size":
-        doc.write(`if (${currentAccessor}.size < ${numericOperand(def.minimum, "min_size")}) return INVALID;`);
-        break;
-      case "max_size":
-        doc.write(`if (${currentAccessor}.size > ${numericOperand(def.maximum, "max_size")}) return INVALID;`);
-        break;
-      case "size_equals":
-        doc.write(`if (${currentAccessor}.size !== ${numericOperand(def.size, "size_equals")}) return INVALID;`);
-        break;
-      case "string_format":
-        currentAccessor = generateStringFormatCheck(doc, ctx, def, currentAccessor);
-        break;
-      case "custom":
-        currentAccessor = generateCustomRefineCheck(doc, ctx, check, currentAccessor);
-        break;
-      case "bigint_format":
-        generateBigIntFormatCheck(doc, def, currentAccessor);
-        break;
-      case "mime_type":
-        generateMimeTypeCheck(doc, ctx, def, currentAccessor);
-        break;
-      case "property":
-        generatePropertyCheck(doc, ctx, def, currentAccessor);
-        break;
-      case "properties":
-        generatePropertiesChecks(doc, ctx, def, currentAccessor);
-        break;
-      case "overwrite": {
-        const newAccessor = newVar(ctx);
-        generateOverwriteCheck(doc, ctx, check, currentAccessor, newAccessor);
-        currentAccessor = newAccessor;
-        break;
-      }
-      default: {
-        throw new ZodCompileUnsupportedError(`check type ${def.check}`);
-      }
-    }
-  }
-  return currentAccessor;
-}
-function codePointLengthVar(doc, ctx, accessor, inDoubt) {
-  const cpLen = addConstant(ctx, codePointLength);
-  const v = newVar(ctx);
-  doc.write(`const ${v} = typeof ${accessor} === "string" && ${inDoubt} ? ${cpLen}(${accessor}) : ${accessor}.length;`);
-  return v;
-}
-function numericOperand(value, label) {
-  if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new ZodCompileUnsupportedError(`${label} bound of type ${typeof value}`);
-  }
-  return `${value}`;
-}
-function comparisonOperand(ctx, value) {
-  if (typeof value === "bigint")
-    return `${value}n`;
-  if (typeof value === "number") {
-    if (Number.isNaN(value))
-      throw new ZodCompileUnsupportedError("comparison check with NaN bound");
-    return `${value}`;
-  }
-  if (value instanceof Date) {
-    if (Number.isNaN(value.getTime())) {
-      throw new ZodCompileUnsupportedError("comparison check with Invalid Date bound");
-    }
-    return addConstant(ctx, value);
-  }
-  throw new ZodCompileUnsupportedError(`comparison check bound of type ${typeof value}`);
-}
-function generateGreaterThanCheck(doc, ctx, def, accessor) {
-  const op = def.inclusive ? "<" : "<=";
-  doc.write(`if (${accessor} ${op} ${comparisonOperand(ctx, def.value)}) return INVALID;`);
-}
-function generateLessThanCheck(doc, ctx, def, accessor) {
-  const op = def.inclusive ? ">" : ">=";
-  doc.write(`if (${accessor} ${op} ${comparisonOperand(ctx, def.value)}) return INVALID;`);
-}
-function generateMultipleOfCheck(doc, ctx, def, accessor) {
-  if (typeof def.value === "bigint") {
-    if (def.value === BigInt(0))
-      throw new ZodCompileUnsupportedError("multiple_of check with a zero divisor");
-    doc.write(`if (${accessor} % ${def.value}n !== 0n) return INVALID;`);
-  } else {
-    const remainder = addConstant(ctx, floatSafeRemainder);
-    doc.write(`if (${remainder}(${accessor}, ${numericOperand(def.value, "multiple_of")}) !== 0) return INVALID;`);
-  }
-}
-function generateNumberFormatCheck(doc, def, accessor) {
-  const format = def.format;
-  switch (format) {
-    case "safeint":
-      doc.write(`if (!Number.isSafeInteger(${accessor})) return INVALID;`);
-      break;
-    case "int32":
-      doc.write(`if (!Number.isInteger(${accessor}) || ${accessor} < -2147483648 || ${accessor} > 2147483647) return INVALID;`);
-      break;
-    case "uint32":
-      doc.write(`if (!Number.isInteger(${accessor}) || ${accessor} < 0 || ${accessor} > 4294967295) return INVALID;`);
-      break;
-    case "float32":
-      doc.write(`if (!Number.isFinite(${accessor}) || ${accessor} < -3.4028234663852886e38 || ${accessor} > 3.4028234663852886e38) return INVALID;`);
-      break;
-    case "float64":
-      doc.write(`if (!Number.isFinite(${accessor})) return INVALID;`);
-      break;
-    default: {
-      throw new ZodCompileUnsupportedError(`number format ${format}`);
-    }
-  }
-}
-function generateBigIntFormatCheck(doc, def, accessor) {
-  const format = def.format;
-  if (!format)
-    return;
-  switch (format) {
-    case "int64":
-      doc.write(`if (${accessor} < -9223372036854775808n || ${accessor} > 9223372036854775807n) return INVALID;`);
-      break;
-    case "uint64":
-      doc.write(`if (${accessor} < 0n || ${accessor} > 18446744073709551615n) return INVALID;`);
-      break;
-    default: {
-      throw new ZodCompileUnsupportedError(`bigint format ${format}`);
-    }
-  }
-}
-function generateMimeTypeCheck(doc, ctx, def, accessor) {
-  const mimeTypes = def.mime;
-  if (mimeTypes && mimeTypes.length > 0) {
-    const mimeSet = addConstant(ctx, new Set(mimeTypes));
-    doc.write(`if (!${mimeSet}.has(${accessor}.type)) return INVALID;`);
-  }
-}
-function generatePropertiesChecks(doc, ctx, def, accessor) {
-  if (def.when) {
-    throw new ZodCompileUnsupportedError(`check with a custom "when" condition`);
-  }
-  doc.write(`if (${accessor} == null) return INVALID;`);
-  const shape = def.shape;
-  for (const key of Reflect.ownKeys(shape)) {
-    const keyExpr = typeof key === "symbol" ? addConstant(ctx, key) : esc(key);
-    const inputVar = newVar(ctx);
-    doc.write(`const ${inputVar} = ${accessor}[${keyExpr}];`);
-    compileChild(doc, ctx, shape[key], inputVar, false);
-  }
-}
-function generatePropertyCheck(doc, ctx, def, accessor) {
-  const propAccessor = `${accessor}[${JSON.stringify(def.property)}]`;
-  generateCheck(doc, ctx, def.schema, propAccessor);
-}
-function generateOverwriteCheck(doc, ctx, check, currentAccessor, newAccessor) {
-  const tx = check._zod.def.tx;
-  if (!tx) {
-    throw new ZodCompileUnsupportedError("overwrite check without a transform function");
-  }
-  if (isAsyncFunction(tx)) {
-    throw new ZodCompileAsyncError("z.compile: async overwrite transforms are not supported");
-  }
-  const txConst = addConstant(ctx, tx);
-  doc.write(`const ${newAccessor} = ${txConst}(${currentAccessor});`);
-}
-function throwAsync() {
-  throw new $ZodAsyncError;
-}
-function pushIssue(issue) {
-  this.issues.push(issue);
-}
-function generateCustomRefineCheck(doc, ctx, check, accessor) {
-  const def = check._zod.def;
-  if (def.fn) {
-    if (isAsyncFunction(def.fn)) {
-      throw new ZodCompileAsyncError("z.compile: async .refine() predicates are not supported");
-    }
-    const fnConst = addUserConstant(ctx, def.fn);
-    const throwAsyncConst = addConstant(ctx, throwAsync);
-    const resVar = newVar(ctx);
-    doc.write(`const ${resVar} = ${fnConst}(${accessor});`);
-    doc.write(`if (${resVar} instanceof Promise) ${throwAsyncConst}();`);
-    doc.write(`if (!${resVar}) return INVALID;`);
-    return accessor;
-  }
-  if (check._zod.check) {
-    if (isAsyncFunction(check._zod.check)) {
-      throw new ZodCompileAsyncError("z.compile: async .superRefine() / check functions are not supported");
-    }
-    const checkFn = check._zod.check;
-    const helperFn = (value) => {
-      const fakePayload = { value, issues: [], addIssue: pushIssue };
-      const result = checkFn(fakePayload);
-      if (result instanceof Promise)
-        throwAsync();
-      return fakePayload.issues.length === 0 ? fakePayload.value : INVALID;
-    };
-    const helperConst = addUserConstant(ctx, helperFn);
-    const outVar = newVar(ctx);
-    doc.write(`const ${outVar} = ${helperConst}(${accessor});`);
-    doc.write(`if (${outVar} === INVALID) return INVALID;`);
-    return outVar;
-  }
-  throw new ZodCompileUnsupportedError("custom check without a predicate or check function");
-}
-var PATTERN_IS_COMPLETE = new Set([
-  "cidrv4",
-  "cuid",
-  "cuid2",
-  "date",
-  "datetime",
-  "duration",
-  "e164",
-  "email",
-  "emoji",
-  "ends_with",
-  "guid",
-  "includes",
-  "ipv4",
-  "ksuid",
-  "lowercase",
-  "mac",
-  "nanoid",
-  "regex",
-  "starts_with",
-  "time",
-  "ulid",
-  "uppercase",
-  "uuid",
-  "xid"
-]);
-function generateStringFormatCheck(doc, ctx, def, accessor, needsValue = true) {
-  const fmt = def.format;
-  if (fmt === "base64") {
-    const validator = addConstant(ctx, isValidBase64);
-    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  if (fmt === "base64url") {
-    const validator = addConstant(ctx, isValidBase64URL);
-    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  if (fmt === "jwt") {
-    const validator = addConstant(ctx, isValidJWT);
-    const alg = addConstant(ctx, def.alg ?? null);
-    doc.write(`if (!${validator}(${accessor}, ${alg})) return INVALID;`);
-    return accessor;
-  }
-  if (fmt === "ipv6") {
-    const validator = addConstant(ctx, isValidIPv6);
-    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  if (fmt === "cidrv6") {
-    const validator = addConstant(ctx, isValidCIDRv6);
-    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  if (fmt === "credit_card") {
-    const validator = addConstant(ctx, isValidCreditCard);
-    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  if (fmt === "iban") {
-    const validator = addConstant(ctx, isValidIBAN);
-    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  const formatDef = def;
-  if (fmt === "url" || fmt === "httpurl" || formatDef.normalize || formatDef.hostname !== undefined || formatDef.protocol !== undefined) {
-    const parseConst = addConstant(ctx, validateURL);
-    const defConst = addConstant(ctx, def);
-    const trimVar = newVar(ctx);
-    const urlVar = newVar(ctx);
-    doc.write(`const ${trimVar} = ${accessor}.trim();`);
-    doc.write(`const ${urlVar} = ${parseConst}(${trimVar}, ${defConst});`);
-    doc.write(`if (typeof ${urlVar} === "number") return INVALID;`);
-    if (formatDef.hostname !== undefined) {
-      const hostnameConst = addConstant(ctx, urlHostnameOk);
-      doc.write(`if (!${hostnameConst}(${urlVar}, ${defConst}.hostname)) return INVALID;`);
-    }
-    if (formatDef.protocol !== undefined) {
-      const protocolConst = addConstant(ctx, urlProtocolOk);
-      doc.write(`if (!${protocolConst}(${urlVar}, ${defConst}.protocol)) return INVALID;`);
-    }
-    if (!needsValue)
-      return null;
-    const outputVar = newVar(ctx);
-    const outputExpr = formatDef.normalize ? `${urlVar}.href` : `${addConstant(ctx, stripTabAndNewline)}(${trimVar})`;
-    doc.write(`const ${outputVar} = ${outputExpr};`);
-    return outputVar;
-  }
-  const customFn = def.fn;
-  if (customFn) {
-    if (isAsyncFunction(customFn))
-      throw new ZodCompileUnsupportedError(`async string format ${fmt}`);
-    const fnConst = addConstant(ctx, customFn);
-    doc.write(`if (!${fnConst}(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  if (PATTERN_IS_COMPLETE.has(fmt) && def.pattern) {
-    const patternConst = addConstant(ctx, def.pattern);
-    doc.write(`${patternConst}.lastIndex = 0;`);
-    doc.write(`if (!${patternConst}.test(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  const format = def.format;
-  switch (format) {
-    case "regex":
-      throw new ZodCompileUnsupportedError("regex format without a pattern");
-    case "lowercase":
-      doc.write(`if (${accessor} !== ${accessor}.toLowerCase()) return INVALID;`);
-      break;
-    case "uppercase":
-      doc.write(`if (${accessor} !== ${accessor}.toUpperCase()) return INVALID;`);
-      break;
-    case "includes":
-      doc.write(`if (!${accessor}.includes(${esc(def.includes)})) return INVALID;`);
-      break;
-    case "starts_with": {
-      const prefix = def.prefix;
-      doc.write(`if (${accessor}.slice(0, ${prefix.length}) !== ${esc(prefix)}) return INVALID;`);
-      break;
-    }
-    case "ends_with": {
-      const suffix = def.suffix;
-      doc.write(`if (${accessor}.slice(-${suffix.length}) !== ${esc(suffix)}) return INVALID;`);
-      break;
-    }
-    default: {
-      throw new ZodCompileUnsupportedError(`string format ${format}`);
-    }
-  }
-  return accessor;
-}
-function generateCheck(doc, ctx, schema, accessor, needsValue = true) {
-  const def = schema._zod.def;
-  const type = def.type;
-  if (def.coerce) {
-    throw new ZodCompileUnsupportedError(`coercion (z.coerce.${type}())`);
-  }
-  const buildsValue = needsValue || !!def.checks?.length;
-  let typeAccessor;
-  switch (type) {
-    case "string":
-      typeAccessor = generateStringCheck(doc, ctx, schema, accessor, buildsValue);
-      break;
-    case "number":
-      typeAccessor = generateNumberCheck(doc, schema, accessor);
-      break;
-    case "boolean":
-      typeAccessor = generateBooleanCheck(doc, accessor);
-      break;
-    case "bigint":
-      typeAccessor = generateBigIntCheck(doc, schema, accessor);
-      break;
-    case "symbol":
-      typeAccessor = generateSymbolCheck(doc, accessor);
-      break;
-    case "undefined":
-      typeAccessor = generateUndefinedCheck(doc, accessor);
-      break;
-    case "null":
-      typeAccessor = generateNullCheck(doc, accessor);
-      break;
-    case "any":
-    case "unknown":
-      typeAccessor = accessor;
-      break;
-    case "never":
-      doc.write("return INVALID;");
-      typeAccessor = accessor;
-      break;
-    case "void":
-      typeAccessor = generateVoidCheck(doc, accessor);
-      break;
-    case "nan":
-      typeAccessor = generateNaNCheck(doc, accessor);
-      break;
-    case "date":
-      typeAccessor = generateDateCheck(doc, accessor);
-      break;
-    case "object":
-      typeAccessor = generateObjectCheck(doc, ctx, schema, accessor, buildsValue);
-      break;
-    case "optional":
-      typeAccessor = generateOptionalCheck(doc, ctx, schema, accessor, buildsValue);
-      break;
-    case "nullable":
-      typeAccessor = generateNullableCheck(doc, ctx, schema, accessor, buildsValue);
-      break;
-    case "array":
-      typeAccessor = generateArrayCheck(doc, ctx, schema, accessor, buildsValue);
-      break;
-    case "literal":
-      typeAccessor = generateLiteralCheck(doc, ctx, schema, accessor);
-      break;
-    case "enum":
-      typeAccessor = generateEnumCheck(doc, ctx, schema, accessor);
-      break;
-    case "readonly": {
-      const innerOut = generateWrapperCheck(doc, ctx, schema, accessor);
-      const frozenVar = newVar(ctx);
-      doc.write(`const ${frozenVar} = Object.freeze(${innerOut});`);
-      typeAccessor = frozenVar;
-      break;
-    }
-    case "success":
-      generateWrapperCheck(doc, ctx, schema, accessor);
-      typeAccessor = "true";
-      break;
-    case "default":
-    case "prefault":
-      typeAccessor = generateDefaultCheck(doc, ctx, schema, accessor);
-      break;
-    case "nonoptional":
-      typeAccessor = generateNonOptionalCheck(doc, ctx, schema, accessor);
-      break;
-    case "tuple":
-      typeAccessor = generateTupleCheck(doc, ctx, schema, accessor);
-      break;
-    case "union":
-      typeAccessor = generateUnionCheck(doc, ctx, schema, accessor);
-      break;
-    case "intersection":
-      typeAccessor = generateIntersectionCheck(doc, ctx, schema, accessor);
-      break;
-    case "record":
-      typeAccessor = generateRecordCheck(doc, ctx, schema, accessor);
-      break;
-    case "map":
-      typeAccessor = generateMapCheck(doc, ctx, schema, accessor);
-      break;
-    case "set":
-      typeAccessor = generateSetCheck(doc, ctx, schema, accessor);
-      break;
-    case "file":
-      typeAccessor = generateFileCheck(doc, accessor);
-      break;
-    case "template_literal":
-      typeAccessor = generateTemplateLiteralCheck(doc, ctx, schema, accessor);
-      break;
-    case "lazy":
-      typeAccessor = generateLazyCheck(doc, ctx, schema, accessor);
-      break;
-    case "pipe":
-      typeAccessor = generatePipeCheck(doc, ctx, schema, accessor);
-      break;
-    case "custom":
-      typeAccessor = generateCustomCheck(doc, ctx, schema, accessor);
-      break;
-    case "transform":
-      typeAccessor = generateTransformCheck(doc, ctx, schema, accessor);
-      break;
-    case "catch":
-      typeAccessor = generateCatchCheck(doc, ctx, schema, accessor);
-      break;
-    default: {
-      throw new ZodCompileUnsupportedError(`schema type ${type}`);
-    }
-  }
-  if (typeAccessor === null)
-    return null;
-  return generateChecks(doc, ctx, schema, typeAccessor);
-}
-function generateStringCheck(doc, ctx, schema, accessor, needsValue = true) {
-  doc.write(`if (typeof ${accessor} !== "string") return INVALID;`);
-  const def = schema._zod.def;
-  if (def.format === undefined)
-    return accessor;
-  return generateStringFormatCheck(doc, ctx, def, accessor, needsValue);
-}
-function generateNumberCheck(doc, schema, accessor) {
-  doc.write(`if (typeof ${accessor} !== "number" || !Number.isFinite(${accessor})) return INVALID;`);
-  const def = schema._zod.def;
-  if (def.check === "number_format" && def.format) {
-    generateNumberFormatCheck(doc, { format: def.format }, accessor);
-  }
-  return accessor;
-}
-function generateBooleanCheck(doc, accessor) {
-  doc.write(`if (typeof ${accessor} !== "boolean") return INVALID;`);
-  return accessor;
-}
-function generateBigIntCheck(doc, schema, accessor) {
-  doc.write(`if (typeof ${accessor} !== "bigint") return INVALID;`);
-  const def = schema._zod.def;
-  if (def.format) {
-    switch (def.format) {
-      case "int64":
-        doc.write(`if (${accessor} < -9223372036854775808n || ${accessor} > 9223372036854775807n) return INVALID;`);
-        break;
-      case "uint64":
-        doc.write(`if (${accessor} < 0n || ${accessor} > 18446744073709551615n) return INVALID;`);
-        break;
-    }
-  }
-  return accessor;
-}
-function generateSymbolCheck(doc, accessor) {
-  doc.write(`if (typeof ${accessor} !== "symbol") return INVALID;`);
-  return accessor;
-}
-function generateUndefinedCheck(doc, accessor) {
-  doc.write(`if (${accessor} !== undefined) return INVALID;`);
-  return accessor;
-}
-function generateNullCheck(doc, accessor) {
-  doc.write(`if (${accessor} !== null) return INVALID;`);
-  return accessor;
-}
-function generateVoidCheck(doc, accessor) {
-  doc.write(`if (${accessor} !== undefined) return INVALID;`);
-  return accessor;
-}
-function generateNaNCheck(doc, accessor) {
-  doc.write(`if (typeof ${accessor} !== "number" || !Number.isNaN(${accessor})) return INVALID;`);
-  return accessor;
-}
-function generateDateCheck(doc, accessor) {
-  doc.write(`if (!(${accessor} instanceof Date) || Number.isNaN(${accessor}.getTime())) return INVALID;`);
-  return accessor;
-}
-function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
-  const def = schema._zod.def;
-  doc.write(`if (typeof ${accessor} !== "object" || ${accessor} === null || Array.isArray(${accessor})) return INVALID;`);
-  const shape = def.shape;
-  const keys = Object.keys(shape);
-  const symbolKeys = Object.getOwnPropertySymbols(shape);
-  const allKeys = symbolKeys.length ? [...keys, ...symbolKeys] : keys;
-  const keyExpr = (k) => typeof k === "symbol" ? addConstant(ctx, k) : esc(k);
-  const propKey = (k) => typeof k === "symbol" ? `[${keyExpr(k)}]` : esc(k);
-  const propShape = shape;
-  if (keys.includes("__proto__")) {
-    throw new ZodCompileUnsupportedError('object shape key "__proto__"');
-  }
-  const propOutputs = new Map;
-  for (const key of allKeys) {
-    const propSchema = propShape[key];
-    const kx = keyExpr(key);
-    const inputVar = newVar(ctx);
-    doc.write(`const ${inputVar} = ${accessor}[${kx}];`);
-    if (propSchema._zod.optin !== undefined) {
-      const outputVar = newVar(ctx);
-      doc.write(`let ${outputVar} = (() => {`);
-      doc.indented((d) => {
-        const outputAccessor = compileChild(d, ctx, propSchema, inputVar);
-        d.write(`return ${outputAccessor};`);
-      });
-      doc.write(`})();`);
-      if (propSchema._zod.optout === "optional") {
-        doc.write(`if (${outputVar} === INVALID) {`);
-        doc.indented((d) => {
-          d.write(`if (${kx} in ${accessor}) return INVALID;`);
-          d.write(`${outputVar} = undefined;`);
-        });
-        doc.write(`}`);
-      } else {
-        doc.write(`if (${outputVar} === INVALID) return INVALID;`);
-      }
-      propOutputs.set(key, outputVar);
-    } else {
-      if (requiresPresenceCheck(propSchema)) {
-        doc.write(`if (!(${kx} in ${accessor})) return INVALID;`);
-      }
-      const outputAccessor = compileChild(doc, ctx, propSchema, inputVar, buildsValue);
-      if (outputAccessor !== null)
-        propOutputs.set(key, outputAccessor);
-    }
-  }
-  const catchall = def.catchall;
-  let unknownKeysMode = "none";
-  if (catchall) {
-    const catchallType = catchall._zod.def.type;
-    if (catchallType === "never") {
-      const condition = keys.map((k) => `k !== ${esc(k)}`).join(" && ") || "true";
-      doc.write(`for (const k in ${accessor}) {`);
-      doc.indented((d) => {
-        d.write(`if (${condition}) return INVALID;`);
-      });
-      doc.write(`}`);
-    } else if ((catchallType === "unknown" || catchallType === "any") && !catchall._zod.def.checks?.length) {
-      unknownKeysMode = "passthrough";
-    } else {
-      unknownKeysMode = "schema";
-    }
-  }
-  const outputVar = newVar(ctx);
-  const hasConditionalKeys = allKeys.some((k) => mayOmitUndefined(propShape[k]) || dropsWhenAbsent(propShape[k]));
-  if (!buildsValue) {
-    if (unknownKeysMode === "schema") {
-      const knownSet = keys.length > 0 ? addConstant(ctx, new Set(keys)) : null;
-      doc.write(`for (const k in ${accessor}) {`);
-      doc.indented((d) => {
-        d.write(`if (k === "__proto__") continue;`);
-        if (knownSet)
-          d.write(`if (${knownSet}.has(k)) continue;`);
-        const valVar = newVar(ctx);
-        d.write(`const ${valVar} = ${accessor}[k];`);
-        compileChild(d, ctx, catchall, valVar, false);
-      });
-      doc.write(`}`);
-    }
-    return null;
-  }
-  if (!hasConditionalKeys) {
-    const propLiterals = allKeys.map((k) => `${propKey(k)}: ${propOutputs.get(k)}`).join(", ");
-    doc.write(`const ${outputVar} = { ${propLiterals} };`);
-  } else {
-    doc.write(`const ${outputVar} = {};`);
-    for (const k of allKeys) {
-      const kx = keyExpr(k);
-      const out = propOutputs.get(k);
-      if (dropsWhenAbsent(propShape[k])) {
-        doc.write(`if (${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
-      } else if (mayOmitUndefined(propShape[k])) {
-        doc.write(`if (${out} !== undefined || ${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
-      } else {
-        doc.write(`${outputVar}[${kx}] = ${out};`);
-      }
-    }
-  }
-  if (unknownKeysMode !== "none") {
-    const knownSet = keys.length > 0 ? addConstant(ctx, new Set(keys)) : null;
-    doc.write(`for (const k in ${accessor}) {`);
-    doc.indented((d) => {
-      d.write(`if (k === "__proto__") continue;`);
-      if (knownSet)
-        d.write(`if (${knownSet}.has(k)) continue;`);
-      if (unknownKeysMode === "passthrough") {
-        d.write(`${outputVar}[k] = ${accessor}[k];`);
-      } else {
-        const valVar = newVar(ctx);
-        d.write(`const ${valVar} = ${accessor}[k];`);
-        const catchallOut = compileChild(d, ctx, catchall, valVar);
-        d.write(`${outputVar}[k] = ${catchallOut};`);
-      }
-    });
-    doc.write(`}`);
-  }
-  return outputVar;
-}
-function generateOptionalCheck(doc, ctx, schema, accessor, buildsValue = true) {
-  const def = schema._zod.def;
-  if (isExactOptional(schema)) {
-    return generateCheck(doc, ctx, def.innerType, accessor, buildsValue);
-  }
-  if (def.innerType._zod.optin === "defaulted") {
-    const outputVar = newVar(ctx);
-    const branchVar = newVar(ctx);
-    doc.write(`let ${outputVar};`);
-    doc.write(`if (${accessor} === undefined) {`);
-    doc.indented((d) => {
-      d.write(`const ${branchVar} = (() => {`);
-      d.indented((d2) => {
-        const innerOutput = generateCheck(d2, ctx, def.innerType, accessor);
-        d2.write(`return ${innerOutput};`);
-      });
-      d.write(`})();`);
-      d.write(`if (${branchVar} !== INVALID) ${outputVar} = ${branchVar};`);
-    });
-    doc.write(`} else {`);
-    doc.indented((d) => {
-      const innerOutput = generateCheck(d, ctx, def.innerType, accessor);
-      d.write(`${outputVar} = ${innerOutput};`);
-    });
-    doc.write(`}`);
-    return outputVar;
-  }
-  const outputVar = buildsValue ? newVar(ctx) : null;
-  if (outputVar)
-    doc.write(`let ${outputVar};`);
-  doc.write(`if (${accessor} !== undefined) {`);
-  doc.indented((d) => {
-    const innerOutput = generateCheck(d, ctx, def.innerType, accessor, buildsValue);
-    if (outputVar && innerOutput !== null)
-      d.write(`${outputVar} = ${innerOutput};`);
-  });
-  doc.write(`}`);
-  return outputVar;
-}
-function isExactOptional(schema) {
-  return schema._zod.traits?.has("$ZodExactOptional") === true;
-}
-function requiresPresenceCheck(schema) {
-  return schema._zod.optin === undefined && fastPathAcceptsAbsence(schema);
-}
-function fastPathAcceptsAbsence(schema) {
-  if (schema._zod.def.coerce)
-    return true;
-  const def = schema._zod.def;
-  switch (def.type) {
-    case "any":
-    case "unknown":
-    case "undefined":
-    case "void":
-    case "default":
-    case "prefault":
-    case "transform":
-    case "custom":
-    case "lazy":
-      return true;
-    case "string":
-    case "number":
-    case "boolean":
-    case "bigint":
-    case "symbol":
-    case "null":
-    case "never":
-    case "nan":
-    case "date":
-    case "object":
-    case "array":
-    case "tuple":
-    case "record":
-    case "map":
-    case "set":
-    case "file":
-    case "template_literal":
-      return false;
-    case "nonoptional":
-      return def.innerType ? fastPathAcceptsAbsence(def.innerType) : false;
-    case "literal":
-      return !!def.values?.includes(undefined);
-    case "enum":
-      return !!schema._zod.values?.has(undefined);
-    case "optional":
-    case "nullable":
-    case "readonly":
-    case "success":
-      return def.innerType ? fastPathAcceptsAbsence(def.innerType) : true;
-    case "catch":
-      return true;
-    case "union":
-      return def.options ? def.options.some(fastPathAcceptsAbsence) : true;
-    case "intersection":
-      if (!def.left || !def.right)
-        return true;
-      return fastPathAcceptsAbsence(def.left) && fastPathAcceptsAbsence(def.right);
-    case "pipe":
-      return def.in ? fastPathAcceptsAbsence(def.in) : true;
-    default:
-      return true;
-  }
-}
-function dropsWhenAbsent(schema) {
-  return schema._zod.optin === "optional" && schema._zod.optout === "optional";
-}
-function mayOmitUndefined(schema) {
-  return (schema._zod.optin !== "defaulted" || schema._zod.optout === "optional") && mayOutputUndefined(schema);
-}
-function mayOutputUndefined(schema) {
-  const def = schema._zod.def;
-  switch (def.type) {
-    case "string":
-    case "number":
-    case "boolean":
-    case "bigint":
-    case "symbol":
-    case "null":
-    case "nan":
-    case "date":
-    case "object":
-    case "array":
-    case "tuple":
-    case "record":
-    case "map":
-    case "set":
-    case "file":
-    case "template_literal":
-    case "never":
-    case "success":
-      return false;
-    case "literal":
-      return !!def.values?.includes(undefined);
-    case "enum":
-      return !!schema._zod.values?.has(undefined);
-    case "optional":
-      return true;
-    case "nullable":
-    case "readonly":
-    case "nonoptional":
-      return def.innerType ? mayOutputUndefined(def.innerType) : true;
-    case "union":
-      return def.options ? def.options.some(mayOutputUndefined) : true;
-    case "intersection":
-      return !def.left || !def.right || mayOutputUndefined(def.left) || mayOutputUndefined(def.right);
-    case "pipe":
-      return def.out ? mayOutputUndefined(def.out) : true;
-    default:
-      return true;
-  }
-}
-function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
-  const def = schema._zod.def;
-  const outputVar = buildsValue ? newVar(ctx) : null;
-  if (outputVar)
-    doc.write(`let ${outputVar} = null;`);
-  doc.write(`if (${accessor} !== null) {`);
-  doc.indented((d) => {
-    const innerOutput = generateCheck(d, ctx, def.innerType, accessor, buildsValue);
-    if (outputVar && innerOutput !== null)
-      d.write(`${outputVar} = ${innerOutput};`);
-  });
-  doc.write(`}`);
-  return outputVar;
-}
-function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
-  const def = schema._zod.def;
-  doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
-  const outputVar = buildsValue ? newVar(ctx) : null;
-  const iVar = newVar(ctx);
-  const elemVar = newVar(ctx);
-  if (outputVar)
-    doc.write(`const ${outputVar} = new Array(${accessor}.length);`);
-  doc.write(`for (let ${iVar} = 0; ${iVar} < ${accessor}.length; ${iVar}++) {`);
-  doc.indented((d) => {
-    d.write(`const ${elemVar} = ${accessor}[${iVar}];`);
-    const elemOutput = compileChild(d, ctx, def.element, elemVar, buildsValue);
-    if (outputVar && elemOutput !== null)
-      d.write(`${outputVar}[${iVar}] = ${elemOutput};`);
-  });
-  doc.write(`}`);
-  return outputVar;
-}
-function generateLiteralCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const values = def.values;
-  if (values.length !== 1) {
-    const literalSet = addConstant(ctx, new Set(values));
-    doc.write(`if (!${literalSet}.has(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  const value = values[0];
-  if (typeof value === "number" && Number.isNaN(value)) {
-    const literalSet = addConstant(ctx, new Set(values));
-    doc.write(`if (!${literalSet}.has(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  if (typeof value === "string") {
-    doc.write(`if (${accessor} !== ${esc(value)}) return INVALID;`);
-  } else if (typeof value === "number" || typeof value === "boolean") {
-    doc.write(`if (${accessor} !== ${value}) return INVALID;`);
-  } else if (value === null) {
-    doc.write(`if (${accessor} !== null) return INVALID;`);
-  } else if (value === undefined) {
-    doc.write(`if (${accessor} !== undefined) return INVALID;`);
-  } else if (typeof value === "bigint") {
-    doc.write(`if (${accessor} !== ${value}n) return INVALID;`);
-  } else {
-    throw new ZodCompileUnsupportedError(`literal type ${typeof value}`);
-  }
-  return accessor;
-}
-function generateEnumCheck(doc, ctx, schema, accessor) {
-  const values = schema._zod.values;
-  if (!values) {
-    throw new ZodCompileUnsupportedError("enum schema without enumerated values");
-  }
-  const enumSet = addConstant(ctx, values);
-  doc.write(`if (!${enumSet}.has(${accessor})) return INVALID;`);
-  return accessor;
-}
-function generateWrapperCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  return generateCheck(doc, ctx, def.innerType, accessor);
-}
-function generateDefaultCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const descriptor = Object.getOwnPropertyDescriptor(schema._zod.def, "defaultValue");
-  const defaultGetter = descriptor ? () => schema._zod.def.defaultValue : undefined;
-  if (schema._zod.def.type === "prefault") {
-    if (!defaultGetter) {
-      return generateCheck(doc, ctx, def.innerType, accessor);
-    }
-    const defaultFn = addConstant(ctx, defaultGetter);
-    const inputVar = newVar(ctx);
-    doc.write(`let ${inputVar} = ${accessor};`);
-    doc.write(`if (${accessor} === undefined) ${inputVar} = ${defaultFn}();`);
-    return generateCheck(doc, ctx, def.innerType, inputVar);
-  }
-  const outputVar = newVar(ctx);
-  if (defaultGetter) {
-    const defaultFn = addConstant(ctx, defaultGetter);
-    const cloneFn = addConstant(ctx, shallowClone);
-    doc.write(`let ${outputVar};`);
-    doc.write(`if (${accessor} === undefined) {`);
-    doc.indented((d) => {
-      d.write(`${outputVar} = ${cloneFn}(${defaultFn}());`);
-    });
-    doc.write(`} else {`);
-    doc.indented((d) => {
-      const innerOutput = generateCheck(d, ctx, def.innerType, accessor);
-      d.write(`${outputVar} = ${innerOutput} === undefined ? ${cloneFn}(${defaultFn}()) : ${innerOutput};`);
-    });
-    doc.write(`}`);
-  } else {
-    doc.write(`let ${outputVar};`);
-    doc.write(`if (${accessor} !== undefined) {`);
-    doc.indented((d) => {
-      const innerOutput = generateCheck(d, ctx, def.innerType, accessor);
-      d.write(`${outputVar} = ${innerOutput};`);
-    });
-    doc.write(`}`);
-  }
-  return outputVar;
-}
-function generateNonOptionalCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const innerOutput = generateCheck(doc, ctx, def.innerType, accessor);
-  const outputVar = newVar(ctx);
-  doc.write(`const ${outputVar} = ${innerOutput};`);
-  doc.write(`if (${outputVar} === undefined) return INVALID;`);
-  return outputVar;
-}
-function generateTupleCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const items = def.items;
-  const rest = def.rest;
-  doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
-  const optinStart = getTupleOptStart(items, "optin");
-  const optoutStart = getTupleOptStart(items, "optout");
-  if (rest) {
-    doc.write(`if (${accessor}.length < ${optinStart}) return INVALID;`);
-  } else {
-    doc.write(`if (${accessor}.length < ${optinStart} || ${accessor}.length > ${items.length}) return INVALID;`);
-  }
-  const outputVar = newVar(ctx);
-  doc.write(`const ${outputVar} = [];`);
-  for (let i = 0;i < items.length; i++) {
-    const itemSchema = items[i];
-    if (i >= optoutStart) {
-      doc.write(`if (${outputVar}.length === ${i}) {`);
-      doc.indented((d) => {
-        d.write(`if (${i} < ${accessor}.length) {`);
-        d.indented((d2) => {
-          const elemVar = newVar(ctx);
-          d2.write(`const ${elemVar} = ${accessor}[${i}];`);
-          const elemOutput = compileChild(d2, ctx, itemSchema, elemVar);
-          d2.write(`${outputVar}[${i}] = ${elemOutput};`);
-        });
-        d.write(`} else {`);
-        d.indented((d2) => {
-          if (dropsWhenAbsent(itemSchema)) {
-            d2.write(`${outputVar}.length = ${i};`);
-            return;
-          }
-          const elemVar = newVar(ctx);
-          const branchVar = newVar(ctx);
-          d2.write(`const ${elemVar} = undefined;`);
-          d2.write(`const ${branchVar} = (() => {`);
-          d2.indented((d3) => {
-            const elemOutput = compileChild(d3, ctx, itemSchema, elemVar);
-            d3.write(`return ${elemOutput};`);
-          });
-          d2.write(`})();`);
-          d2.write(`if (${branchVar} === INVALID || ${branchVar} === undefined) ${outputVar}.length = ${i};`);
-          d2.write(`else ${outputVar}[${i}] = ${branchVar};`);
-        });
-        d.write(`}`);
-      });
-      doc.write(`}`);
-    } else {
-      const elemVar = newVar(ctx);
-      doc.write(`const ${elemVar} = ${accessor}[${i}];`);
-      const elemOutput = compileChild(doc, ctx, itemSchema, elemVar);
-      doc.write(`${outputVar}[${i}] = ${elemOutput};`);
-    }
-  }
-  if (rest) {
-    const iVar = newVar(ctx);
-    const elemVar = newVar(ctx);
-    doc.write(`for (let ${iVar} = ${items.length}; ${iVar} < ${accessor}.length; ${iVar}++) {`);
-    doc.indented((d) => {
-      d.write(`const ${elemVar} = ${accessor}[${iVar}];`);
-      const elemOutput = compileChild(d, ctx, rest, elemVar);
-      d.write(`${outputVar}[${iVar}] = ${elemOutput};`);
-    });
-    doc.write(`}`);
-  }
-  return outputVar;
-}
-function getTupleOptStart(items, key) {
-  for (let i = items.length - 1;i >= 0; i--) {
-    const omittable = key === "optin" ? items[i]._zod.optin !== undefined : items[i]._zod.optout === "optional";
-    if (!omittable)
-      return i + 1;
+// node_modules/zod/v4/core/registries.js
+var _a2;
+class $ZodRegistry {
+  constructor() {
+    this._map = new WeakMap;
+    this._idmap = new Map;
   }
-  return 0;
-}
-function generateUnionCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const options = def.options;
-  if (def.discriminator) {
-    return generateDiscriminatedUnionCheck(doc, ctx, def, accessor);
-  }
-  if (def.inclusive === false) {
-    throw new ZodCompileUnsupportedError("exclusive unions (z.xor)");
-  }
-  if (options.length === 0) {
-    doc.write("return INVALID;");
-    return accessor;
-  }
-  if (options.length === 1) {
-    return generateCheck(doc, ctx, options[0], accessor);
-  }
-  const allLiterals = options.every((opt) => opt._zod.def.type === "literal" && !opt._zod.def.checks?.length);
-  if (allLiterals) {
-    const values = new Set(options.flatMap((opt) => opt._zod.def.values));
-    const valuesConst = addConstant(ctx, values);
-    doc.write(`if (!${valuesConst}.has(${accessor})) return INVALID;`);
-    return accessor;
-  }
-  const outputVar = newVar(ctx);
-  doc.write(`let ${outputVar};`);
-  for (let i = 0;i < options.length; i++) {
-    const opt = options[i];
-    if (i === 0) {
-      doc.write(`${outputVar} = (() => {`);
-    } else {
-      doc.write(`if (${outputVar} === INVALID) ${outputVar} = (() => {`);
+  add(schema, ..._meta) {
+    const meta = _meta[0];
+    this._map.set(schema, meta);
+    if (meta && typeof meta === "object" && "id" in meta) {
+      this._idmap.set(meta.id, schema);
     }
-    doc.indented((d) => {
-      const branchOutput = generateCheck(d, ctx, opt, accessor);
-      d.write(`return ${branchOutput};`);
-    });
-    doc.write(`})();`);
-  }
-  doc.write(`if (${outputVar} === INVALID) return INVALID;`);
-  return outputVar;
-}
-function generateDiscriminatedUnionCheck(doc, ctx, def, accessor) {
-  if (def.unionFallback) {
-    throw new ZodCompileUnsupportedError("discriminated union with unionFallback");
+    return this;
   }
-  if (def.options.length === 0) {
-    doc.write("return INVALID;");
-    return accessor;
+  clear() {
+    this._map = new WeakMap;
+    this._idmap = new Map;
+    return this;
   }
-  const discVar = newVar(ctx);
-  const outputVar = newVar(ctx);
-  doc.write(`const ${discVar} = ${accessor}?.[${esc(def.discriminator)}];`);
-  doc.write(`let ${outputVar};`);
-  let firstBranch = true;
-  const claimed = new Set;
-  for (const option of def.options) {
-    const values = option._zod.propValues?.[def.discriminator];
-    if (!values || values.size === 0) {
-      throw new ZodCompileUnsupportedError("discriminated union option without static discriminator values");
+  remove(schema) {
+    const meta = this._map.get(schema);
+    if (meta && typeof meta === "object" && "id" in meta) {
+      this._idmap.delete(meta.id);
     }
-    for (const value of values) {
-      if (claimed.has(value)) {
-        throw new ZodCompileUnsupportedError(`duplicate discriminator value ${String(value)}`);
-      }
-      claimed.add(value);
-    }
-    const conditions = Array.from(values, (value) => literalEquality(ctx, discVar, value));
-    const prefix = firstBranch ? "if" : "else if";
-    doc.write(`${prefix} (${conditions.join(" || ")}) {`);
-    doc.indented((d) => {
-      const branchOutput = generateCheck(d, ctx, option, accessor);
-      d.write(`${outputVar} = ${branchOutput};`);
-    });
-    doc.write(`}`);
-    firstBranch = false;
-  }
-  doc.write(`else { return INVALID; }`);
-  return outputVar;
-}
-function literalEquality(ctx, accessor, value) {
-  if (typeof value === "string")
-    return `${accessor} === ${esc(value)}`;
-  if (typeof value === "number") {
-    if (Number.isNaN(value))
-      return `Number.isNaN(${accessor})`;
-    return `${accessor} === ${value}`;
-  }
-  if (typeof value === "boolean")
-    return `${accessor} === ${value}`;
-  if (value === null)
-    return `${accessor} === null`;
-  if (value === undefined)
-    return `${accessor} === undefined`;
-  if (typeof value === "bigint")
-    return `${accessor} === ${value}n`;
-  if (typeof value === "symbol") {
-    const symbolConst = addConstant(ctx, value);
-    return `${accessor} === ${symbolConst}`;
-  }
-  throw new ZodCompileUnsupportedError(`literal discriminator value ${String(value)}`);
-}
-function generateIntersectionCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  ctx.definite = false;
-  const leftOutput = compileChild(doc, ctx, def.left, accessor);
-  const rightOutput = compileChild(doc, ctx, def.right, accessor);
-  const mergeConst = addConstant(ctx, mergeValues);
-  const mergedVar = newVar(ctx);
-  doc.write(`const ${mergedVar} = ${mergeConst}(${leftOutput}, ${rightOutput});`);
-  doc.write(`if (!${mergedVar}.valid) return INVALID;`);
-  return `${mergedVar}.data`;
-}
-function generateRecordCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const isPlainObjectConst = addConstant(ctx, isPlainObject);
-  doc.write(`if (!${isPlainObjectConst}(${accessor})) return INVALID;`);
-  const outputVar = newVar(ctx);
-  const kVar = newVar(ctx);
-  const valVar = newVar(ctx);
-  doc.write(`const ${outputVar} = {};`);
-  const recordDef = def;
-  const keyValues = recordDef.partial ? undefined : def.keyType._zod.values;
-  if (keyValues) {
-    const inputKeys = [];
-    for (const key of keyValues) {
-      if (!(typeof key === "string" || typeof key === "number" || typeof key === "symbol")) {
-        throw new ZodCompileUnsupportedError(`record key value ${String(key)}`);
-      }
-      const inputKey = typeof key === "number" ? key.toString() : key;
-      if (inputKey === "__proto__") {
-        throw new ZodCompileUnsupportedError('record key "__proto__"');
-      }
-      inputKeys.push(inputKey);
-      const keyConst = addConstant(ctx, key);
-      const outKey = generateCheck(doc, ctx, def.keyType, keyConst);
-      const valueVar = newVar(ctx);
-      doc.write(`const ${valueVar} = ${accessor}[${literalPropertyKey(ctx, inputKey)}];`);
-      const valOutput = compileChild(doc, ctx, def.valueType, valueVar);
-      doc.write(`${outputVar}[${outKey}] = ${valOutput};`);
-    }
-    const knownKeysConst = addConstant(ctx, new Set(inputKeys));
-    doc.write(`for (const ${kVar} in ${accessor}) {`);
-    doc.indented((d) => {
-      d.write(`if (${knownKeysConst}.has(${kVar})) continue;`);
-      if (recordDef.mode === "loose") {
-        d.write(`if (${kVar} !== "__proto__") ${outputVar}[${kVar}] = ${accessor}[${kVar}];`);
-      } else {
-        d.write(`return INVALID;`);
-      }
-    });
-    doc.write(`}`);
-    return outputVar;
-  }
-  const keyDef = def.keyType._zod.def;
-  const keyIsBareString = keyDef.type === "string" && keyDef.format === undefined && !keyDef.coerce && (keyDef.checks?.length ?? 0) === 0;
-  if (!keyIsBareString) {
-    const isLoose = def.mode === "loose";
-    const keyFn = compileFn(def.keyType);
-    if (keyFn.definite === false)
-      ctx.definite = false;
-    const keyFast = addConstant(ctx, keyFn);
-    const numericConst = addConstant(ctx, number);
-    const outKeyVar = newVar(ctx);
-    emitOwnKeys(doc, ctx, accessor, kVar, (d) => {
-      d.write(`let ${outKeyVar} = ${keyFast}(${kVar});`);
-      d.write(`if (${outKeyVar} === INVALID && typeof ${kVar} === "string" && ${numericConst}.test(${kVar})) ${outKeyVar} = ${keyFast}(Number(${kVar}));`);
-      if (isLoose) {
-        d.write(`if (${outKeyVar} === INVALID) { ${outputVar}[${kVar}] = ${accessor}[${kVar}]; continue; }`);
-      } else {
-        d.write(`if (${outKeyVar} === INVALID) return INVALID;`);
-      }
-      d.write(`if (${outKeyVar} === "__proto__") continue;`);
-      const valueVar = newVar(ctx);
-      d.write(`const ${valueVar} = ${accessor}[${kVar}];`);
-      const valOutput = compileChild(d, ctx, def.valueType, valueVar);
-      d.write(`${outputVar}[${outKeyVar}] = ${valOutput};`);
-    });
-    return outputVar;
-  }
-  emitOwnKeys(doc, ctx, accessor, kVar, (d) => {
-    d.write(`const ${valVar} = ${accessor}[${kVar}];`);
-    const valOutput = compileChild(d, ctx, def.valueType, valVar);
-    d.write(`${outputVar}[${kVar}] = ${valOutput};`);
-  }, `return INVALID;`);
-  return outputVar;
-}
-function emitOwnKeys(doc, ctx, accessor, kVar, body, onSymbol) {
-  const propIsEnumerableConst = addConstant(ctx, Object.prototype.propertyIsEnumerable);
-  const symsVar = newVar(ctx);
-  const keysVar = newVar(ctx);
-  const iVar = newVar(ctx);
-  doc.write(`const ${symsVar} = Object.getOwnPropertySymbols(${accessor});`);
-  doc.write(`const ${keysVar} = Object.getOwnPropertyNames(${accessor});`);
-  doc.write(`for (let ${iVar} = 0; ${iVar} < ${keysVar}.length; ${iVar}++) {`);
-  doc.indented((d) => {
-    d.write(`const ${kVar} = ${keysVar}[${iVar}];`);
-    d.write(`if (${kVar} === "__proto__" || !${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
-    body(d);
-  });
-  doc.write(`}`);
-  doc.write(`for (let ${iVar} = 0; ${iVar} < ${symsVar}.length; ${iVar}++) {`);
-  doc.indented((d) => {
-    d.write(`const ${kVar} = ${symsVar}[${iVar}];`);
-    d.write(`if (!${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
-    if (onSymbol)
-      d.write(onSymbol);
-    else
-      body(d);
-  });
-  doc.write(`}`);
-}
-function literalPropertyKey(ctx, key) {
-  if (typeof key === "string")
-    return esc(key);
-  return addConstant(ctx, key);
-}
-function generateMapCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
-  const outputVar = newVar(ctx);
-  const kVar = newVar(ctx);
-  const valVar = newVar(ctx);
-  doc.write(`const ${outputVar} = new Map();`);
-  doc.write(`for (const [${kVar}, ${valVar}] of ${accessor}) {`);
-  doc.indented((d) => {
-    const keyOutput = generateCheck(d, ctx, def.keyType, kVar);
-    const valOutput = generateCheck(d, ctx, def.valueType, valVar);
-    d.write(`${outputVar}.set(${keyOutput}, ${valOutput});`);
-  });
-  doc.write(`}`);
-  return outputVar;
-}
-function generateSetCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
-  const outputVar = newVar(ctx);
-  const valVar = newVar(ctx);
-  doc.write(`const ${outputVar} = new Set();`);
-  doc.write(`for (const ${valVar} of ${accessor}) {`);
-  doc.indented((d) => {
-    const valOutput = generateCheck(d, ctx, def.valueType, valVar);
-    d.write(`${outputVar}.add(${valOutput});`);
-  });
-  doc.write(`}`);
-  return outputVar;
-}
-function generateFileCheck(doc, accessor) {
-  doc.write(`if (!(${accessor} instanceof File)) return INVALID;`);
-  return accessor;
-}
-function generateTemplateLiteralCheck(doc, ctx, schema, accessor) {
-  doc.write(`if (typeof ${accessor} !== "string") return INVALID;`);
-  const pattern = schema._zod.pattern;
-  if (pattern) {
-    const patternConst = addConstant(ctx, pattern);
-    doc.write(`${patternConst}.lastIndex = 0;`);
-    doc.write(`if (!${patternConst}.test(${accessor})) return INVALID;`);
+    this._map.delete(schema);
+    return this;
   }
-  return accessor;
-}
-function generateLazyCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const getterConst = addUserConstant(ctx, def.getter);
-  const cacheConst = addConstant(ctx, { parser: null });
-  doc.write(`if (!${cacheConst}.parser) {`);
-  doc.indented((d) => {
-    d.write(`const inner = ${getterConst}();`);
-    d.write(`${cacheConst}.parser = function(input) {`);
-    d.indented((d2) => {
-      d2.write(`const result = inner._zod.run({ value: input, issues: [] }, {});`);
-      d2.write(`return result.issues.length === 0 ? result.value : INVALID;`);
-    });
-    d.write(`};`);
-  });
-  doc.write(`}`);
-  const outputVar = newVar(ctx);
-  doc.write(`const ${outputVar} = ${cacheConst}.parser(${accessor});`);
-  doc.write(`if (${outputVar} === INVALID) return INVALID;`);
-  return outputVar;
-}
-function generatePipeCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  const inputOutput = generateCheck(doc, ctx, def.in, accessor);
-  if (def.transform) {
-    if (isAsyncFunction(def.transform)) {
-      throw new ZodCompileAsyncError("z.compile: async transforms in pipes are not supported");
-    }
-    const transformFn = def.transform;
-    const helperFn = (value) => {
-      const fakePayload = { value, issues: [], addIssue: pushIssue };
-      const result = transformFn(value, fakePayload);
-      if (result instanceof Promise)
-        return INVALID;
-      return fakePayload.issues.length === 0 ? result : INVALID;
-    };
-    const helperConst = addUserConstant(ctx, helperFn);
-    const transformedVar = newVar(ctx);
-    doc.write(`const ${transformedVar} = ${helperConst}(${inputOutput});`);
-    doc.write(`if (${transformedVar} === INVALID) return INVALID;`);
-    return generateCheck(doc, ctx, def.out, transformedVar);
-  } else {
-    return generateCheck(doc, ctx, def.out, inputOutput);
+  get(schema) {
+    const p = schema._zod.parent;
+    if (p) {
+      const pm = { ...this.get(p) ?? {} };
+      delete pm.id;
+      const f = { ...pm, ...this._map.get(schema) };
+      return Object.keys(f).length ? f : undefined;
+    }
+    return this._map.get(schema);
   }
-}
-function isAsyncFunction(fn) {
-  return typeof fn === "function" && (fn.constructor.name === "AsyncFunction" || fn[Symbol.toStringTag] === "AsyncFunction");
-}
-function generateCustomCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  if (def.fn) {
-    if (isAsyncFunction(def.fn)) {
-      throw new ZodCompileAsyncError("z.compile: async custom predicates are not supported");
-    }
-    const fnConst = addUserConstant(ctx, def.fn);
-    const throwAsyncConst = addConstant(ctx, throwAsync);
-    const resVar = newVar(ctx);
-    doc.write(`const ${resVar} = ${fnConst}(${accessor});`);
-    doc.write(`if (${resVar} instanceof Promise) ${throwAsyncConst}();`);
-    doc.write(`if (!${resVar}) return INVALID;`);
-  } else {
-    throw new ZodCompileUnsupportedError("custom schema without a predicate function");
+  has(schema) {
+    return this._map.has(schema);
   }
-  return accessor;
 }
-function runtimeCatch(innerSchema, catchValue, value) {
-  const result = innerSchema._zod.run({ value, issues: [] }, {});
-  if (result && typeof result.then === "function")
-    return INVALID;
-  const r = result;
-  if (r.issues.length === 0)
-    return r.value;
-  return catchValue();
-}
-function generateCatchCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  if (!def.catchValue[CONSTANT_CATCH]) {
-    throw new ZodCompileUnsupportedError("catch with a callback (only a constant catch value compiles)", false);
-  }
-  const outputVar = newVar(ctx);
-  doc.write(`let ${outputVar} = (() => {`);
-  doc.indented((d) => {
-    const innerOut = compileChild(d, ctx, def.innerType, accessor);
-    d.write(`return ${innerOut};`);
-  });
-  doc.write(`})();`);
-  const innerConst = addConstant(ctx, def.innerType);
-  const catchConst = addUserConstant(ctx, def.catchValue);
-  const catchHelperConst = addConstant(ctx, runtimeCatch);
-  doc.write(`if (${outputVar} === INVALID) {`);
-  doc.indented((d) => {
-    d.write(`${outputVar} = ${catchHelperConst}(${innerConst}, ${catchConst}, ${accessor});`);
-    d.write(`if (${outputVar} === INVALID) return INVALID;`);
-  });
-  doc.write(`}`);
-  return outputVar;
-}
-function generateTransformCheck(doc, ctx, schema, accessor) {
-  const def = schema._zod.def;
-  if (def.transform) {
-    if (isAsyncFunction(def.transform)) {
-      throw new ZodCompileAsyncError("z.compile: async transforms are not supported");
-    }
-    const transformFn = def.transform;
-    const helperFn = (value) => {
-      const fakePayload = { value, issues: [], addIssue: pushIssue };
-      const result = transformFn(value, fakePayload);
-      if (result instanceof Promise)
-        return INVALID;
-      return fakePayload.issues.length === 0 ? result : INVALID;
-    };
-    const helperConst = addUserConstant(ctx, helperFn);
-    const outputVar = newVar(ctx);
-    doc.write(`const ${outputVar} = ${helperConst}(${accessor});`);
-    doc.write(`if (${outputVar} === INVALID) return INVALID;`);
-    return outputVar;
-  }
-  return accessor;
+function registry() {
+  return new $ZodRegistry;
 }
+(_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
+var globalRegistry = globalThis.__zod_globalRegistry;
 // node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
@@ -7954,15 +6316,6 @@ function superRefine(fn, params) {
 // packages/workit-core/src/core/task-contract.ts
 var SCHEMA_VERSION = 1;
 var POLICY_VERSION = "1.0.0";
-var OPERATION_FAMILIES = [
-  "task",
-  "policy",
-  "evidence",
-  "finding",
-  "decision",
-  "worker",
-  "state"
-];
 var uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var digestPattern = /^[0-9a-f]{64}$/;
 var invalidUnicode = (value) => {
@@ -8698,7 +7051,6 @@ var advertisedOperationSchemas = {
   worker: advertised(workerOperations),
   state: advertised(stateOperations)
 };
-var compiledOperationSchemas = Object.fromEntries(OPERATION_FAMILIES.map((family) => [family, compile(operationSchemas[family])]));
 var success = (revisionValue, workspaceRevisionValue, data) => ({
   ok: true,
   schemaVersion: 1,
@@ -8720,8 +7072,7 @@ function resolveIdRef(kind, ref, ids) {
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
     return failure2("unsupported_version", "unsupported schema version", { operation: family });
-  const compiled = compiledOperationSchemas[family].safeParse(input);
-  const parsed = compiled.success ? operationSchemas[family].safeParse(input) : compiled;
+  const parsed = operationSchemas[family].safeParse(input);
   if (parsed.success)
     return success(null, null, parsed.data);
   const fields = parsed.error.issues.map((issue) => ({
@@ -19332,6 +17683,24 @@ function workitInvocations(command, dialect = "posix", depth = 0) {
   }
   return found;
 }
+var WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
+function skipWorkitGlobals(args) {
+  let cwd = null;
+  let at = 0;
+  for (;at < args.length; at++) {
+    const match = WORKIT_GLOBAL.exec(args[at]);
+    if (match?.[1] === "=") {
+      if (args[at].startsWith("--cwd="))
+        cwd = args[at].slice(6);
+    } else if (match && args[at + 1] !== undefined) {
+      if (args[at] === "--cwd")
+        cwd = args[at + 1];
+      at++;
+    } else if (args[at] !== "--json")
+      break;
+  }
+  return { rest: args.slice(at), cwd };
+}
 var PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
 var CURRENT_BRANCH = /^\$\(\s*git\s+(?:branch\s+--show-current|rev-parse\s+--abbrev-ref\s+HEAD|symbolic-ref\s+--short\s+HEAD)\s*\)$/;
 var pushDestination = (destination) => {
@@ -21092,7 +19461,7 @@ var splitDenial = (plan) => ({
   unblock: plan.unblock
 });
 // packages/workit-core/src/hooks/write-gate.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
 import os9 from "node:os";
 import path24 from "node:path";
 
@@ -21321,7 +19690,7 @@ var exempt = (cwd, root, file, plans) => {
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
-var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
+var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs", "busybox"]);
 var operands = (words) => words.filter((item) => !item.startsWith("-"));
 var SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
 var wrappedScript = (input) => {
@@ -21333,9 +19702,9 @@ var wrappedScript = (input) => {
     return null;
   if ("script" in tail)
     return tail.script;
-  const [shell, flag, script] = tail.argv;
-  if (SCRIPT_SHELLS.has((shell.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && /^-[a-z]*c$/.test(flag ?? ""))
-    return script ?? null;
+  const script = shellScript2(tail.argv);
+  if (SCRIPT_SHELLS.has((tail.argv[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && script)
+    return script;
   return tail.argv.map(quoteWord2).join(" ");
 };
 var editsOf = (input) => {
@@ -21414,6 +19783,94 @@ var editsOf = (input) => {
       return [];
   }
 };
+var shellScript2 = (words) => {
+  if (!SCRIPT_SHELLS.has((words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()))
+    return null;
+  for (let index = 1;index < words.length; index++) {
+    const word = words[index];
+    if (/^-[a-z]*c$/.test(word))
+      return words[index + 1] ?? null;
+    if (/^[-+][oO]$/.test(word))
+      index++;
+    else if (!/^[-+]/.test(word))
+      return null;
+  }
+  return null;
+};
+var XARGS_VALUE = /^-[IinLPdsEa]$/;
+var runsWriter = (words) => {
+  const filled = [...words.filter((word) => word !== "{}" && word !== ";" && word !== "+"), "x"];
+  const edits = editsOf(filled);
+  return edits === null || edits.length > 0 || opaqueWrites(filled) !== null;
+};
+var opaqueWrites = (input) => {
+  let words = input;
+  while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0]))) {
+    if (words[0] === "xargs") {
+      let at = 1;
+      while (words[at]?.startsWith("-"))
+        at += XARGS_VALUE.test(words[at]) ? 2 : 1;
+      return runsWriter(words.slice(at)) ? ["."] : null;
+    }
+    words = words.slice(1);
+  }
+  const [verb, ...args] = words;
+  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+  const files = operands(args);
+  const has = (pattern) => args.some((arg) => pattern.test(arg));
+  const listed = (named) => named.length ? named : ["."];
+  if (name === "unlink" || name === "shred")
+    return listed(files);
+  if (/^(?:chmod|chown|chgrp|chattr)$/.test(name))
+    return listed(has(/^--reference/) ? files : files.slice(1));
+  if (name === "rsync") {
+    const dest = files.at(-1);
+    const remote = /^[\w.@-]*:/.test(dest ?? "") && !/^[A-Za-z]:[\\/]/.test(dest ?? "");
+    return dest === undefined ? ["."] : remote ? [] : [dest];
+  }
+  if (name === "find") {
+    const exec = args.findIndex((arg) => /^-(?:exec|execdir|ok|okdir)$/.test(arg));
+    const writes = has(/^-(?:delete|fprint\w*|fls)$/) || exec >= 0 && runsWriter(args.slice(exec + 1));
+    const end = args.findIndex((arg) => /^[-(!]/.test(arg));
+    return writes ? listed(end < 0 ? args : args.slice(0, end)) : null;
+  }
+  if (/^g?awk$/.test(name)) {
+    if (!has(/^-i|^--include/))
+      return null;
+    const named = [];
+    let program = !has(/^-f$|^--file/);
+    for (let index = 0;index < args.length; index++)
+      if (/^(?:-[ifvF]|--(?:include|file|assign|field-separator))$/.test(args[index]))
+        index++;
+      else if (args[index].startsWith("-"))
+        continue;
+      else if (program)
+        program = false;
+      else
+        named.push(args[index]);
+    return listed(named);
+  }
+  if (name === "perl")
+    return has(/^-[a-zA-Z]*[eE]/) ? ["."] : null;
+  if (/^(?:python[\d.]*|node|bun|deno|ruby|php)$/.test(name))
+    return has(/^-[a-zA-Z]*[ce]$|^--eval$|^-p$/) ? ["."] : null;
+  return shellScript2(words) === null ? null : ["."];
+};
+var linkSources = (args, at) => {
+  const names = operands([...args]);
+  const into = args.indexOf("-t");
+  const dest = into >= 0 ? args[into + 1] : names.length > 1 ? names.at(-1) : ".";
+  const sources = names.filter((name, index) => into >= 0 ? name !== dest : index < names.length - 1 || names.length === 1);
+  const target = dest === undefined ? null : at(dest);
+  const symbolic = args.some((arg) => /^-[a-zA-Z]*s|^--symbolic$/.test(arg));
+  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync7(target) || /[\\/]$/.test(dest ?? "") ? target : path24.dirname(target);
+  return sources.flatMap((source) => {
+    if (symbolic && base !== null && !path24.isAbsolute(homeExpanded(source)))
+      return [path24.resolve(base, source)];
+    const resolved = at(source);
+    return resolved ? [resolved] : [];
+  });
+};
 var shellWrites = (command, depth = 0) => {
   const targets = [];
   let unknown = false;
@@ -21523,11 +19980,15 @@ var gitMutationDirs = (cwd, command, dialect) => {
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
-var cdInto = (dir, words) => {
+var UNKNOWN_DIR = path24.resolve(path24.parse(process.cwd()).root, ".workit-unknown-dir");
+var cdInto = (dir, words, strict = false) => {
+  const lost = strict ? UNKNOWN_DIR : undefined;
   const named = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
   const target = named === undefined ? undefined : homeExpanded(named);
-  if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
-    return;
+  if (target === "-" || target && /^~|[$`*?]/.test(target))
+    return lost;
+  if (dir === undefined)
+    return lost;
   return target === undefined ? os9.homedir() : path24.resolve(dir, target);
 };
 var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
@@ -21535,7 +19996,7 @@ var homeExpanded = (file) => {
   const match = /^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/.exec(file);
   return match ? (process.env.HOME || os9.homedir()) + file.slice(match[0].length) : file;
 };
-var segmentTargets = (cwd, command, dialect, depth = 0) => {
+var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
   const targets = [];
   let dir = cwd;
   let stack = [];
@@ -21559,21 +20020,35 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
     const words = lead < 0 ? [] : segment.words.slice(lead);
     const name = (words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
     if (CD2.has(name)) {
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (PUSHD2.has(name)) {
       stack.push(dir);
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (POPD2.has(name)) {
-      dir = stack.length ? stack.pop() : undefined;
+      dir = stack.length ? stack.pop() : strict ? UNKNOWN_DIR : undefined;
       continue;
     }
-    const inner = depth < 4 ? wrappedScript(words) : null;
+    const inner = depth < 4 ? wrappedScript(words) ?? (strict ? shellScript2(words) : null) : null;
     if (inner !== null && dir !== undefined)
-      targets.push(...segmentTargets(dir, inner, "posix", depth + 1));
+      targets.push(...segmentTargets(dir, inner, "posix", depth + 1, strict));
+    if (strict && dir !== undefined) {
+      const runIn = dir;
+      for (const sub of depth < 4 ? segment.subs ?? [] : [])
+        targets.push(...segmentTargets(runIn, sub, dialect, depth + 1, true));
+      const opaque = segment.unanalyzable ? ["."] : inner === null ? opaqueWrites(words) : null;
+      for (const file of opaque ?? []) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(file === "." ? path24.join(resolved, DIR_TARGET) : resolved);
+      }
+      const ln = words.findIndex((word) => /^ln$/i.test(word.split(/[\\/]/).at(-1) ?? ""));
+      if (ln >= 0 && words.slice(0, ln).every((word) => PREFIXES2.has(word)))
+        targets.push(...linkSources(words.slice(ln + 1), at));
+    }
     for (const file of segment.redirects)
       if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
         const resolved = at(file);
@@ -21590,11 +20065,29 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
         if (resolved)
           targets.push(resolved);
       }
-    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord2).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
-      targets.push(path24.join(dir, DIR_TARGET));
+    if (dir !== undefined)
+      for (const invocation of workitInvocations(segment.words.map(quoteWord2).join(" "), "posix")) {
+        const { at: runsIn, args } = workitCwd(dir, invocation);
+        if (args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), ""))
+          targets.push(path24.join(runsIn, DIR_TARGET));
+      }
   }
   return targets;
 };
+var workitCwd = (dir, args) => {
+  const { rest, cwd } = skipWorkitGlobals(args);
+  return { at: cwd === null ? dir : path24.resolve(dir, homeExpanded(cwd)), args: rest };
+};
+var shellMutationTargets = (cwd, command, dialect = "posix", strict = false) => {
+  try {
+    return [
+      ...segmentTargets(cwd, command, dialect, 0, strict),
+      ...gitMutationDirs(cwd, command, dialect).map((dir) => path24.join(dir, DIR_TARGET))
+    ];
+  } catch {
+    return [];
+  }
+};
 var overridden = (command, dialect) => {
   const segments = segmentsOf(command, dialect);
   if (segments.length !== 1 || segments[0].group || segments[0].subs?.length)
@@ -21700,16 +20193,8 @@ function shellGate(cwd, command, owner, dialect = "posix", deps) {
   } catch {}
   const writes = shellWrites(command);
   let targets = [];
-  if (owner) {
-    try {
-      targets = [
-        ...segmentTargets(cwd, command, dialect),
-        ...gitMutationDirs(cwd, command, dialect).map((dir) => path24.join(dir, DIR_TARGET))
-      ];
-    } catch {
-      targets = [];
-    }
-  }
+  if (owner)
+    targets = shellMutationTargets(cwd, command, dialect);
   if (owner && targets.length) {
     const live = liveGate(owner, targets, deps);
     if (live.kind !== "none") {
@@ -22176,13 +20661,13 @@ ${line}` };
   return decision;
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
-import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync8, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
 import path25 from "node:path";
 var isRecord5 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path25.isAbsolute(value) || !existsSync7(value))
+  if (!nonEmpty2(value) || !path25.isAbsolute(value) || !existsSync8(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -22385,9 +20870,266 @@ var cwdRewrite = (command) => {
   return `workit --cwd ${dir} ${rest.slice("workit".length).trimStart()}`.trimEnd();
 };
 
+// packages/workit-core/src/hooks/worktree-confine.ts
+import { createHash as createHash16 } from "node:crypto";
+import fs20 from "node:fs";
+import path27 from "node:path";
+var FANOUT_TOKEN_FILE = "workit-fanout-token";
+var NONE5 = { kind: "none" };
+var CASE_INSENSITIVE2 = process.platform === "darwin" || process.platform === "win32";
+var canonical3 = (file) => {
+  let rest = "";
+  for (let dir = path27.resolve(file);; dir = path27.dirname(dir)) {
+    try {
+      return path27.join(fs20.realpathSync.native(dir), rest);
+    } catch {
+      if (path27.dirname(dir) === dir)
+        return path27.resolve(file);
+      rest = rest ? path27.join(path27.basename(dir), rest) : path27.basename(dir);
+    }
+  }
+};
+var within = (child, parent) => {
+  const fold = (value) => CASE_INSENSITIVE2 ? value.toLowerCase() : value;
+  const relative = path27.relative(fold(parent), fold(child));
+  return relative === "" || !relative.startsWith("..") && !path27.isAbsolute(relative);
+};
+var checkoutOf2 = (file) => {
+  for (let dir = canonical3(file);; dir = path27.dirname(dir)) {
+    const dotGit = path27.join(dir, ".git");
+    if (fs20.existsSync(dotGit)) {
+      if (!fs20.statSync(dotGit).isFile())
+        return { root: dir, workit: false };
+      const admin = /^gitdir:\s*(.+)$/mu.exec(fs20.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+      return {
+        root: dir,
+        workit: Boolean(admin) && fs20.existsSync(path27.join(path27.resolve(dir, admin), FANOUT_TOKEN_FILE))
+      };
+    }
+    if (path27.dirname(dir) === dir)
+      return null;
+  }
+};
+var workitWorktreeOf = (file) => {
+  try {
+    const checkout = checkoutOf2(file);
+    return checkout?.workit ? checkout.root : null;
+  } catch {
+    return null;
+  }
+};
+var bindingDir = () => path27.join(resolveStateDir(), "worktree-bind");
+var bindingFile = (session, agentId) => path27.join(bindingDir(), `${createHash16("sha256").update(`${session}\x00${agentId}`).digest("hex").slice(0, 32)}.json`);
+var readBinding = (file) => {
+  try {
+    const value = JSON.parse(fs20.readFileSync(file, "utf8"));
+    return typeof value.worktree === "string" ? value : null;
+  } catch {
+    return null;
+  }
+};
+var boundWorktree = (input) => {
+  const agentId = input.session.agentId;
+  if (!agentId)
+    return null;
+  const binding = readBinding(bindingFile(input.session.id, agentId));
+  return binding && workitWorktreeOf(binding.worktree) === binding.worktree ? binding.worktree : null;
+};
+var bind = (input, worktree) => {
+  const agentId = input.session.agentId;
+  const file = bindingFile(input.session.id, agentId);
+  const binding = {
+    worktree,
+    session: input.session.id,
+    agentId,
+    at: new Date().toISOString()
+  };
+  fs20.mkdirSync(path27.dirname(file), { recursive: true });
+  fs20.writeFileSync(file, JSON.stringify(binding));
+  try {
+    if (inWorkitWorkspace(input.cwd))
+      appendHookObserved(input.cwd, {
+        type: "worktree.bound",
+        actor: { host: input.host, session: input.session.id, agentId },
+        agentType: input.session.agentType,
+        worktree
+      });
+  } catch {}
+};
+var hostIsolated = (cwd, agentId) => {
+  try {
+    if (agentId === null)
+      return false;
+    const checkout = checkoutOf2(cwd);
+    if (!checkout)
+      return false;
+    const dotGit = path27.join(checkout.root, ".git");
+    if (!fs20.statSync(dotGit).isFile())
+      return false;
+    const admin = /^gitdir:\s*(.+)$/mu.exec(fs20.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+    if (!admin)
+      return false;
+    const adminDir = path27.resolve(checkout.root, admin);
+    const back = fs20.readFileSync(path27.join(adminDir, "gitdir"), "utf8").trim();
+    if (path27.relative(canonical3(path27.resolve(adminDir, back)), canonical3(dotGit)) !== "")
+      return false;
+    const common = path27.join(adminDir, "commondir");
+    const gitDir = fs20.existsSync(common) ? path27.resolve(adminDir, fs20.readFileSync(common, "utf8").trim()) : adminDir;
+    const expected = path27.join(path27.dirname(canonical3(gitDir)), ".claude", "worktrees", `agent-${agentId}`);
+    return path27.relative(canonical3(expected), checkout.root) === "";
+  } catch {
+    return false;
+  }
+};
+var shown = (target) => path27.basename(target) === ".workit-live-target" ? path27.dirname(target) : target;
+var unboundDeny = (input, target) => {
+  const unblock = "Work only in the worktree your brief names, which the lead made with `workit fanout worktree create <slice>`: edit files under it and run one verb per call against it (`workit --cwd <worktree> git commit -m … -- <paths>`, `workit --cwd <worktree> check <name>`). If your brief names no worktree, stop and report that to the lead.";
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} is not working in a Workit worktree yet, and ${shown(target)} is outside every worktree \`workit fanout worktree create\` made, so it would change the lead's checkout. ${unblock}`,
+    unblock
+  };
+};
+var outsideDeny = (input, worktree, target) => {
+  const unblock = `Edit only under ${worktree} and run git there, one verb per call: \`workit --cwd ${worktree} git commit -m … -- <paths>\`, \`workit --cwd ${worktree} check <name>\` (or \`git -C ${worktree} …\`); a command whose writes Workit cannot see is judged by the directory it runs in. Anything outside it is a follow-up for your report.`;
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} is bound to the worktree ${worktree}, and ${shown(target)} is outside it. ${unblock}`,
+    unblock
+  };
+};
+var unknownDirDeny = (input, worktree) => {
+  const wt = worktree ?? "<worktree>";
+  const unblock = `Workit cannot resolve \`cd -\`, \`cd "$X"\` or \`popd\`: write by absolute path, \`git -C ${wt}\` or \`workit --cwd ${wt}\`.`;
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} writes after an unknown directory change. ${unblock}`,
+    unblock
+  };
+};
+function confineImplementer(input, targets) {
+  try {
+    if (!input.session.agentId || hostIsolated(input.cwd, input.session.agentId))
+      return NONE5;
+    if (targets.some((target) => within(path27.resolve(target), UNKNOWN_DIR)))
+      return unknownDirDeny(input, boundWorktree(input));
+    const bindings = canonical3(bindingDir());
+    const judged = targets.map((named) => ({ named, real: canonical3(named) })).filter(({ real }) => within(real, bindings) || checkoutOf2(real) !== null);
+    if (judged.length === 0)
+      return NONE5;
+    let worktree = boundWorktree(input);
+    if (!worktree) {
+      for (const { real } of judged) {
+        worktree = within(real, bindings) ? null : workitWorktreeOf(real);
+        if (worktree)
+          break;
+      }
+      if (!worktree)
+        return unboundDeny(input, judged[0].named);
+      bind(input, worktree);
+    }
+    const root = canonical3(worktree);
+    const outside = judged.find(({ real }) => !within(real, root) || within(real, bindings));
+    return outside ? outsideDeny(input, worktree, outside.named) : NONE5;
+  } catch {
+    return NONE5;
+  }
+}
+var MUTATING_REMOTE = new Set([
+  "add",
+  "remove",
+  "rm",
+  "rename",
+  "set-url",
+  "set-head",
+  "set-branches",
+  "prune"
+]);
+var CONFIG_READ = /^(?:--get(?:-all|-regexp|-urlmatch)?|--list|-l|get|list)$/;
+var CONFIG_WRITE = /^(?:--(?:unset(?:-all)?|add|replace-all|rename-section|remove-section|edit)|-e|set|unset|rename-section|remove-section|edit)$/;
+var CONFIG_VALUE = /^(?:--file|-f|--blob|--type|--default|--comment)$/;
+var leadOwnedGit = (args) => {
+  const [sub = "", ...rest] = args;
+  if (rest.some((arg) => arg === "--help" || arg === "-h"))
+    return false;
+  const names = rest.filter((arg) => !arg.startsWith("-"));
+  const flag = (pattern) => rest.some((arg) => pattern.test(arg));
+  switch (sub) {
+    case "worktree":
+      return names[0] !== undefined && names[0] !== "list";
+    case "update-ref":
+      return true;
+    case "symbolic-ref":
+      return names.length > 1 || flag(/^(?:-d|--delete)$/);
+    case "branch":
+      return flag(/^-[a-zA-Z]*[dDfmMcC]|^--(?:delete|force|move|copy)$/);
+    case "tag":
+      return flag(/^-[a-zA-Z]*[df]|^--(?:delete|force)$/);
+    case "push": {
+      if (flag(/^(?:-d|--delete|--mirror|--prune)$/))
+        return true;
+      const refspecs = names.slice(1);
+      return refspecs.some((name) => name.includes(":") || name.startsWith("+")) || refspecs.length > 0 && flag(/^-[a-zA-Z]*f|^--force/);
+    }
+    case "replace":
+    case "filter-branch":
+    case "gc":
+    case "prune":
+    case "repack":
+    case "sparse-checkout":
+      return true;
+    case "notes":
+    case "reflog":
+    case "submodule":
+      return !/^(?:list|show|status|exists)$/.test(names[0] ?? "list");
+    case "stash":
+      return names[0] === "drop" || names[0] === "clear";
+    case "remote":
+      return MUTATING_REMOTE.has(names[0] ?? "");
+    case "config": {
+      if (rest.some((arg) => CONFIG_READ.test(arg)))
+        return false;
+      if (rest.some((arg) => CONFIG_WRITE.test(arg)))
+        return true;
+      let operands = 0;
+      for (let index = 0;index < rest.length; index++)
+        if (CONFIG_VALUE.test(rest[index]))
+          index++;
+        else if (!rest[index].startsWith("-"))
+          operands++;
+      return operands > 1;
+    }
+    default:
+      return false;
+  }
+};
+var leadOwnedWorkit = (args) => !args.includes("--help") && args.some((_, start) => {
+  if (start > 0 && !/(?:^|[\\/])workit(?:\.exe|\.cmd)?$/.test(args[start - 1]))
+    return false;
+  const [verb, sub] = skipWorkitGlobals(args.slice(start)).rest;
+  return verb === "fanout" && /^(?:plan|worktree)$/.test(sub ?? "");
+});
+var leadOwnedDeny = (input, command) => {
+  const unblock = "Worktrees, branches other than your own, refs, tags, remotes, git config, the shared stash and the fan-out plan belong to the lead: report what you need changed as a follow-up instead.";
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} may not run \`${command.slice(0, 160)}\`. ${unblock}`,
+    unblock
+  };
+};
+function confineImplementerShell(input, command, dialect = "posix") {
+  try {
+    if (!input.session.agentId || hostIsolated(input.cwd, input.session.agentId))
+      return NONE5;
+    if (rawInvocations(command, dialect).some((invocation) => invocation.tool === "git" && leadOwnedGit(invocation.args)) || workitInvocations(command, dialect).some(leadOwnedWorkit))
+      return leadOwnedDeny(input, command);
+  } catch {}
+  return confineImplementer(input, shellMutationTargets(input.cwd, command, dialect, true));
+}
+
 // packages/workit-core/src/hooks/handle.ts
 var usable2 = (value) => value === "native" || value === "partial";
-var NONE5 = { kind: "none" };
+var NONE6 = { kind: "none" };
 var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
 var offered = new Set;
 var ROLES = {
@@ -22400,6 +21142,7 @@ var workitRole = (descriptor, agentType) => {
   const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
   return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
 };
+var implementerAgent = (input, descriptor) => Boolean(input.session.agentId) && input.session.agentType !== null && workitRole(descriptor, input.session.agentType) === "implementer";
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
 var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
 var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
@@ -22407,7 +21150,7 @@ var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
   const role = workitRole(descriptor, event.agentType);
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
-  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
+  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(input.cwd, event.agentId) : CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
     return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
@@ -22415,7 +21158,7 @@ var subagentStartText = (input, descriptor, event) => {
     return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
-    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit --cwd <worktree> git commit -m "<message>" -- <paths>\`, \`workit --cwd <worktree> check <name>\`. The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit --cwd <worktree> git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
@@ -22446,7 +21189,7 @@ function decide(input, deps) {
   switch (event.kind) {
     case "session.start": {
       if (!usable2(descriptor.context.sessionStart))
-        return NONE5;
+        return NONE6;
       const key = input.session.id ? `${input.host}\x00${input.session.id}` : null;
       const offer = event.source === "startup" && (key === null || !offered.has(key));
       if (offer && key !== null)
@@ -22461,26 +21204,31 @@ function decide(input, deps) {
     }
     case "context.turn": {
       if (!usable2(descriptor.context.perTurn))
-        return NONE5;
+        return NONE6;
       const current = turnContextText(input, descriptor);
       const text = resendsOnChange(descriptor) ? changedTurnContext(input, current) : current;
-      return withContextLine(text ? { kind: "context", text } : NONE5, promptNudge(input, event.prompt));
+      return withContextLine(text ? { kind: "context", text } : NONE6, promptNudge(input, event.prompt));
     }
     case "shell.pre": {
       const skillRead = skillReadIn(event.command, event.dialect);
       if (skillRead)
         recordSkillLoad(input, skillRead, "read");
       const canDeny = usable2(descriptor.shellPolicy.deny);
-      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE5;
+      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE6;
       if (policy.kind !== "none")
         return policy;
       const postTool = usable2(descriptor.events["shell.post"].support);
       if (!postTool)
         settlePendingCommit(input);
-      const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE5;
+      const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE6;
       if (raw.kind === "deny")
         return raw;
-      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE5;
+      if (canDeny && implementerAgent(input, descriptor)) {
+        const confined = confineImplementerShell(input, event.command, event.dialect);
+        if (confined.kind === "deny")
+          return confined;
+      }
+      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE6;
       if (gate.kind === "deny")
         return gate;
       const plan = heavyGate(input.cwd, event.command, {
@@ -22503,10 +21251,10 @@ function decide(input, deps) {
         command: rewrittenTo,
         input: event.toolInput ? { ...event.toolInput, command: rewrittenTo } : null,
         text
-      } : NONE5;
+      } : NONE6;
       if (descriptor.transport !== "hook-process")
         return rewritten(null);
-      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE5, aside), shipNudge(input, event.command));
+      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE6, aside), shipNudge(input, event.command));
       if (!lease)
         return cwdCommand && nudged.kind !== "deny" ? rewritten(nudged.kind === "context" ? nudged.text : null) : nudged;
       return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`
@@ -22515,9 +21263,17 @@ function decide(input, deps) {
     case "shell.post":
       if (usable2(descriptor.events["shell.post"].support))
         rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
-      return NONE5;
-    case "write.pre":
-      return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport)) : NONE5;
+      return NONE6;
+    case "write.pre": {
+      if (!usable2(descriptor.events["write.pre"].support))
+        return NONE6;
+      if (implementerAgent(input, descriptor)) {
+        const confined = confineImplementer(input, liveTargets(input.cwd, event.paths));
+        if (confined.kind === "deny")
+          return confined;
+      }
+      return writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport));
+    }
     case "subagent.start":
       if (workitRole(descriptor, event.agentType) === "judge")
         trackJudge(input, event.agentId, true);
@@ -22534,22 +21290,22 @@ function decide(input, deps) {
     case "tool.pre":
       if (event.skill)
         recordSkillLoad(input, event.skill, "tool");
-      return NONE5;
+      return NONE6;
     case "stop":
-      return usable2(descriptor.events.stop.support) ? stopDecision(input, descriptor) : NONE5;
+      return usable2(descriptor.events.stop.support) ? stopDecision(input, descriptor) : NONE6;
     case "subagent.stop":
       trackJudge(input, event.agentId, false);
-      return NONE5;
+      return NONE6;
     case "prompt.submit":
-      return NONE5;
+      return NONE6;
   }
 }
 var failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
-    return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE5;
+    return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE6;
   if (event === "session.start" || event === "subagent.start")
     return { kind: "context", text: `[workit diagnostic: ${error}]` };
-  return NONE5;
+  return NONE6;
 };
 var dispatchHook = (adapter, raw, env = process.env) => {
   const parsed = adapter.parse(raw, env);
@@ -22575,7 +21331,7 @@ var dispatchHook = (adapter, raw, env = process.env) => {
 };
 // packages/workit-core/src/hooks/deadline.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 var HOOK_SKIP_TEXT = "workit context skipped: host under load";
 var HOOK_DEADLINE_MS = 8000;
 var HOST_DEADLINES = {
@@ -22593,7 +21349,7 @@ var hookDeadlineMs = (env, host = "", native) => {
   const row = HOST_DEADLINES[host];
   return override(env) ?? (row ? native === undefined ? Math.min(...Object.values(row)) : row[native] ?? row[""] : HOOK_DEADLINE_MS);
 };
-var skipsFile = (stateDir) => path27.join(stateDir, HOOK_SKIPS_FILE);
+var skipsFile = (stateDir) => path28.join(stateDir, HOOK_SKIPS_FILE);
 var recordHookSkip = (skip, stateDir = resolveStateDir()) => {
   try {
     mkdirSync3(stateDir, { recursive: true });
@@ -22611,7 +21367,7 @@ var QUIET = new Set([
 ]);
 var skipDecision = (event) => QUIET.has(event) ? { kind: "none" } : { kind: "context", text: HOOK_SKIP_TEXT };
 var TIMED_OUT = Symbol("timed out");
-var within = async (work, ms) => {
+var within2 = async (work, ms) => {
   let timer;
   const expired = new Promise((resolve) => {
     timer = setTimeout(() => resolve(TIMED_OUT), Math.max(0, ms));
@@ -22642,7 +21398,7 @@ var readWithin = async (stdin, budget) => {
       text += String(chunk);
     return text;
   })();
-  const text = await within(read, budget.startedAt + budget.deadlineMs - budget.now());
+  const text = await within2(read, budget.startedAt + budget.deadlineMs - budget.now());
   return isTimedOut(text) ? null : text;
 };
 var note = (adapter, raw, env, budget, outcome, stage) => {
@@ -22671,7 +21427,7 @@ var dispatchWithin = async (adapter, raw, env, budget, dispatch = dispatchHook)
   if (budget.host !== null && typeof native === "string")
     budget.deadlineMs = hookDeadlineMs(env, budget.host, native);
   const remaining = () => budget.startedAt + budget.deadlineMs - budget.now();
-  const result = remaining() > 0 ? await within(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
+  const result = remaining() > 0 ? await within2(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
   if (isTimedOut(result))
     return skippedHook(adapter, raw, env, budget, "dispatch");
   if (remaining() < 0)
@@ -23237,8 +21993,8 @@ var codexAdapter = {
 };
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import fs20 from "node:fs";
-import path28 from "node:path";
+import fs21 from "node:fs";
+import path29 from "node:path";
 var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -23435,17 +22191,17 @@ var protocolEvent2 = (input) => {
 };
 var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var lastAssistantText = (file) => {
-  if (!file || !path28.isAbsolute(file))
+  if (!file || !path29.isAbsolute(file))
     return null;
   try {
-    const size = fs20.statSync(file).size;
+    const size = fs21.statSync(file).size;
     const start = Math.max(0, size - TRANSCRIPT_TAIL_BYTES);
     const buffer = Buffer.alloc(size - start);
-    const fd = fs20.openSync(file, "r");
+    const fd = fs21.openSync(file, "r");
     try {
-      fs20.readSync(fd, buffer, 0, buffer.length, start);
+      fs21.readSync(fd, buffer, 0, buffer.length, start);
     } finally {
-      fs20.closeSync(fd);
+      fs21.closeSync(fd);
     }
     const lines = buffer.toString("utf8").split(`
 `);
@@ -23472,7 +22228,7 @@ var lastAssistantText = (file) => {
     return null;
   }
 };
-var within2 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path28.sep) ? root : `${root}${path28.sep}`);
+var within3 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path29.sep) ? root : `${root}${path29.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
@@ -23481,7 +22237,7 @@ var hookCwd = (input) => {
 };
 var cursorWorkspaceRoot = (input) => {
   const cwd = existingDirectory(input.cwd);
-  return cwd && input.workspace_roots.find((root) => within2(root, cwd)) || input.workspace_roots[0];
+  return cwd && input.workspace_roots.find((root) => within3(root, cwd)) || input.workspace_roots[0];
 };
 var cursorDeny = (reason) => ({
   permission: "deny",