heyspex 0.1.0 → 0.2.0

package/dist/cli/hs-env.mjs

@@ -12,6 +12,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __commonJS = (cb, mod2) => function __require2() {
   return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
 };
@@ -109,8 +112,8 @@ var require_main = __commonJS({
   "node_modules/dotenv/lib/main.js"(exports, module) {
     "use strict";
     var fs = __require("fs");
-    var path6 = __require("path");
-    var os = __require("os");
+    var path7 = __require("path");
+    var os2 = __require("os");
     var crypto3 = __require("crypto");
     var packageJson = require_package();
     var version = packageJson.version;
@@ -225,7 +228,7 @@ var require_main = __commonJS({
           possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
         }
       } else {
-        possibleVaultPath = path6.resolve(process.cwd(), ".env.vault");
+        possibleVaultPath = path7.resolve(process.cwd(), ".env.vault");
       }
       if (fs.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
@@ -233,7 +236,7 @@ var require_main = __commonJS({
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path6.join(os.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path7.join(os2.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options) {
       const debug = Boolean(options && options.debug);
@@ -250,7 +253,7 @@ var require_main = __commonJS({
       return { parsed };
     }
     function configDotenv(options) {
-      const dotenvPath2 = path6.resolve(process.cwd(), ".env");
+      const dotenvPath2 = path7.resolve(process.cwd(), ".env");
       let encoding = "utf8";
       const debug = Boolean(options && options.debug);
       const quiet = options && "quiet" in options ? options.quiet : true;
@@ -274,13 +277,13 @@ var require_main = __commonJS({
       }
       let lastError;
       const parsedAll = {};
-      for (const path7 of optionPaths) {
+      for (const path8 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs.readFileSync(path7, { encoding }));
+          const parsed = DotenvModule.parse(fs.readFileSync(path8, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e) {
           if (debug) {
-            _debug(`Failed to load ${path7} ${e.message}`);
+            _debug(`Failed to load ${path8} ${e.message}`);
           }
           lastError = e;
         }
@@ -295,7 +298,7 @@ var require_main = __commonJS({
         const shortPaths = [];
         for (const filePath of optionPaths) {
           try {
-            const relative = path6.relative(process.cwd(), filePath);
+            const relative = path7.relative(process.cwd(), filePath);
             shortPaths.push(relative);
           } catch (e) {
             if (debug) {
@@ -472,17 +475,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path6) {
-      const ctrl = callVisitor(key, node, visitor, path6);
+    function visit_(key, node, visitor, path7) {
+      const ctrl = callVisitor(key, node, visitor, path7);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path6, ctrl);
-        return visit_(key, ctrl, visitor, path6);
+        replaceNode(key, path7, ctrl);
+        return visit_(key, ctrl, visitor, path7);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path6 = Object.freeze(path6.concat(node));
+          path7 = Object.freeze(path7.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path6);
+            const ci = visit_(i, node.items[i], visitor, path7);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -493,13 +496,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path6 = Object.freeze(path6.concat(node));
-          const ck = visit_("key", node.key, visitor, path6);
+          path7 = Object.freeze(path7.concat(node));
+          const ck = visit_("key", node.key, visitor, path7);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path6);
+          const cv = visit_("value", node.value, visitor, path7);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -520,17 +523,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path6) {
-      const ctrl = await callVisitor(key, node, visitor, path6);
+    async function visitAsync_(key, node, visitor, path7) {
+      const ctrl = await callVisitor(key, node, visitor, path7);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path6, ctrl);
-        return visitAsync_(key, ctrl, visitor, path6);
+        replaceNode(key, path7, ctrl);
+        return visitAsync_(key, ctrl, visitor, path7);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path6 = Object.freeze(path6.concat(node));
+          path7 = Object.freeze(path7.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path6);
+            const ci = await visitAsync_(i, node.items[i], visitor, path7);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -541,13 +544,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path6 = Object.freeze(path6.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path6);
+          path7 = Object.freeze(path7.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path7);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path6);
+          const cv = await visitAsync_("value", node.value, visitor, path7);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -574,23 +577,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path6) {
+    function callVisitor(key, node, visitor, path7) {
       if (typeof visitor === "function")
-        return visitor(key, node, path6);
+        return visitor(key, node, path7);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path6);
+        return visitor.Map?.(key, node, path7);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path6);
+        return visitor.Seq?.(key, node, path7);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path6);
+        return visitor.Pair?.(key, node, path7);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path6);
+        return visitor.Scalar?.(key, node, path7);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path6);
+        return visitor.Alias?.(key, node, path7);
       return void 0;
     }
-    function replaceNode(key, path6, node) {
-      const parent = path6[path6.length - 1];
+    function replaceNode(key, path7, node) {
+      const parent = path7[path7.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -1200,10 +1203,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path6, value) {
+    function collectionFromPath(schema, path7, value) {
       let v = value;
-      for (let i = path6.length - 1; i >= 0; --i) {
-        const k = path6[i];
+      for (let i = path7.length - 1; i >= 0; --i) {
+        const k = path7[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -1222,7 +1225,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path6) => path6 == null || typeof path6 === "object" && !!path6[Symbol.iterator]().next().done;
+    var isEmptyPath = (path7) => path7 == null || typeof path7 === "object" && !!path7[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -1252,11 +1255,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path6, value) {
-        if (isEmptyPath(path6))
+      addIn(path7, value) {
+        if (isEmptyPath(path7))
           this.add(value);
         else {
-          const [key, ...rest] = path6;
+          const [key, ...rest] = path7;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -1270,8 +1273,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path6) {
-        const [key, ...rest] = path6;
+      deleteIn(path7) {
+        const [key, ...rest] = path7;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -1285,8 +1288,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path6, keepScalar) {
-        const [key, ...rest] = path6;
+      getIn(path7, keepScalar) {
+        const [key, ...rest] = path7;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -1304,8 +1307,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path6) {
-        const [key, ...rest] = path6;
+      hasIn(path7) {
+        const [key, ...rest] = path7;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -1315,8 +1318,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path6, value) {
-        const [key, ...rest] = path6;
+      setIn(path7, value) {
+        const [key, ...rest] = path7;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -3831,9 +3834,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path6, value) {
+      addIn(path7, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path6, value);
+          this.contents.addIn(path7, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3908,14 +3911,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path6) {
-        if (Collection.isEmptyPath(path6)) {
+      deleteIn(path7) {
+        if (Collection.isEmptyPath(path7)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path6) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path7) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3930,10 +3933,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path6, keepScalar) {
-        if (Collection.isEmptyPath(path6))
+      getIn(path7, keepScalar) {
+        if (Collection.isEmptyPath(path7))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path6, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path7, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3944,10 +3947,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path6) {
-        if (Collection.isEmptyPath(path6))
+      hasIn(path7) {
+        if (Collection.isEmptyPath(path7))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path6) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path7) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3964,13 +3967,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path6, value) {
-        if (Collection.isEmptyPath(path6)) {
+      setIn(path7, value) {
+        if (Collection.isEmptyPath(path7)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path6), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path7), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path6, value);
+          this.contents.setIn(path7, value);
         }
       }
       /**
@@ -4356,10 +4359,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep, value } = collItem;
+        const { start, key, sep: sep2, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key ?? sep2?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -4373,7 +4376,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep) {
+          if (!keyProps.anchor && !keyProps.tag && !sep2) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -4397,7 +4400,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep ?? [], {
+        const valueProps = resolveProps.resolveProps(sep2 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -4413,7 +4416,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep2, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -4504,7 +4507,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep = "";
+        let sep2 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -4518,13 +4521,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep + cb;
-              sep = "";
+                comment += sep2 + cb;
+              sep2 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep += source;
+                sep2 += source;
               hasSpace = true;
               break;
             default:
@@ -4567,18 +4570,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep, value } = collItem;
+        const { start, key, sep: sep2, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key ?? sep2?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep && !value) {
+          if (!props.anchor && !props.tag && !sep2 && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -4632,8 +4635,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep, null, props, onError);
+        if (!isMap && !sep2 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep2, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -4645,7 +4648,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep ?? [], {
+          const valueProps = resolveProps.resolveProps(sep2 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -4656,8 +4659,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep)
-                for (const st of sep) {
+              if (sep2)
+                for (const st of sep2) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -4674,7 +4677,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep2, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -4854,7 +4857,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep = "";
+      let sep2 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -4871,24 +4874,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep + indent.slice(trimIndent) + content;
-          sep = "\n";
+          value += sep2 + indent.slice(trimIndent) + content;
+          sep2 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep === " ")
-            sep = "\n";
-          else if (!prevMoreIndented && sep === "\n")
-            sep = "\n\n";
-          value += sep + indent.slice(trimIndent) + content;
-          sep = "\n";
+          if (sep2 === " ")
+            sep2 = "\n";
+          else if (!prevMoreIndented && sep2 === "\n")
+            sep2 = "\n\n";
+          value += sep2 + indent.slice(trimIndent) + content;
+          sep2 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep === "\n")
+          if (sep2 === "\n")
             value += "\n";
           else
-            sep = "\n";
+            sep2 = "\n";
         } else {
-          value += sep + content;
-          sep = " ";
+          value += sep2 + content;
+          sep2 = " ";
           prevMoreIndented = false;
         }
       }
@@ -5070,25 +5073,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep = " ";
+      let sep2 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep === "\n")
-            res += sep;
+          if (sep2 === "\n")
+            res += sep2;
           else
-            sep = "\n";
+            sep2 = "\n";
         } else {
-          res += sep + match[1];
-          sep = " ";
+          res += sep2 + match[1];
+          sep2 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep + (match?.[1] ?? "");
+      return res + sep2 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -5898,14 +5901,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep, value }) {
+    function stringifyItem({ start, key, sep: sep2, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep)
-        for (const st of sep)
+      if (sep2)
+        for (const st of sep2)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -5930,9 +5933,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path6) => {
+    visit.itemAtPath = (cst, path7) => {
       let item = cst;
-      for (const [field, index] of path6) {
+      for (const [field, index] of path7) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5941,23 +5944,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path6) => {
-      const parent = visit.itemAtPath(cst, path6.slice(0, -1));
-      const field = path6[path6.length - 1][0];
+    visit.parentCollection = (cst, path7) => {
+      const parent = visit.itemAtPath(cst, path7.slice(0, -1));
+      const field = path7[path7.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path6, item, visitor) {
-      let ctrl = visitor(item, path6);
+    function _visit(path7, item, visitor) {
+      let ctrl = visitor(item, path7);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path6.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path7.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5968,10 +5971,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path6);
+            ctrl = ctrl(item, path7);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path6) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path7) : ctrl;
     }
     exports.visit = visit;
   }
@@ -7072,18 +7075,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep;
+          let sep2;
           if (scalar.end) {
-            sep = scalar.end;
-            sep.push(this.sourceToken);
+            sep2 = scalar.end;
+            sep2.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep = [this.sourceToken];
+            sep2 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep }]
+            items: [{ start, key: scalar, sep: sep2 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -7236,15 +7239,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep = it.sep;
-                  sep.push(this.sourceToken);
+                  const sep2 = it.sep;
+                  sep2.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep }]
+                    items: [{ start: start2, key, sep: sep2 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -7438,13 +7441,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep = fc.end.splice(1, fc.end.length);
-            sep.push(this.sourceToken);
+            const sep2 = fc.end.splice(1, fc.end.length);
+            sep2.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep }]
+              items: [{ start, key: fc, sep: sep2 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -9826,11 +9829,11 @@ var require_baseGet = __commonJS({
     "use strict";
     var castPath = require_castPath();
     var toKey = require_toKey();
-    function baseGet(object, path6) {
-      path6 = castPath(path6, object);
-      var index = 0, length = path6.length;
+    function baseGet(object, path7) {
+      path7 = castPath(path7, object);
+      var index = 0, length = path7.length;
       while (object != null && index < length) {
-        object = object[toKey(path6[index++])];
+        object = object[toKey(path7[index++])];
       }
       return index && index == length ? object : void 0;
     }
@@ -9843,8 +9846,8 @@ var require_get = __commonJS({
   "node_modules/lodash/get.js"(exports, module) {
     "use strict";
     var baseGet = require_baseGet();
-    function get2(object, path6, defaultValue) {
-      var result = object == null ? void 0 : baseGet(object, path6);
+    function get2(object, path7, defaultValue) {
+      var result = object == null ? void 0 : baseGet(object, path7);
       return result === void 0 ? defaultValue : result;
     }
     module.exports = get2;
@@ -21774,13 +21777,52 @@ var require_lib2 = __commonJS({
   }
 });
 
+// vendor/heyspex-mcp/credentials.mjs
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import os, { homedir as homedir3 } from "node:os";
+import { dirname, join as join5, resolve as resolve2 } from "node:path";
+var init_credentials = __esm({
+  "vendor/heyspex-mcp/credentials.mjs"() {
+    "use strict";
+  }
+});
+
+// scripts/lib/dev-mode.mjs
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join6 } from "node:path";
+var init_dev_mode = __esm({
+  "scripts/lib/dev-mode.mjs"() {
+    "use strict";
+    init_credentials();
+  }
+});
+
 // spex-console/bin/hs-env.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { networkInterfaces } from "node:os";
-import path5 from "node:path";
-import process2 from "node:process";
-import { fileURLToPath } from "node:url";
+import path6 from "node:path";
+import process3 from "node:process";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// scripts/lib/shared-path-helpers.mjs
+import { isAbsolute, resolve, sep } from "node:path";
+function resolveCodeRoot({
+  explicit,
+  packageRoot,
+  vaultRoot,
+  env = process.env
+} = {}) {
+  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
+  if (fromExplicit) return fromExplicit;
+  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
+  if (fromEnv) return fromEnv;
+  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
+  if (fromPackage) return fromPackage;
+  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
+  return fromVault;
+}
 
 // spex-console/src/lib/env-vault/audit.ts
 import { appendFileSync } from "node:fs";
@@ -24685,20 +24727,20 @@ async function doRun(args, deps) {
   }
   const spawnCommand = useShell ? [quoteProgramForCmd(command), ...rest.map(quoteForCmd)].join(" ") : command;
   const spawnArgs = useShell ? [] : rest;
-  return await new Promise((resolve) => {
+  return await new Promise((resolve5) => {
     const child = deps.spawn(spawnCommand, spawnArgs, {
       stdio: "inherit",
       env: { ...deps.env, ...decrypted },
       ...useShell ? { shell: true } : {}
     });
     child.on("error", (err) => {
-      resolve({
+      resolve5({
         code: EXIT.RUNTIME,
         message: `hs env run: failed to spawn ${command}: ${err.message}`
       });
     });
     child.on("exit", (code, signal) => {
-      resolve({ code: signal ? EXIT.RUNTIME : code ?? EXIT.OK });
+      resolve5({ code: signal ? EXIT.RUNTIME : code ?? EXIT.OK });
     });
   });
 }
@@ -25990,12 +26032,12 @@ async function runVerifyStep(command, deps) {
   });
   if (resolved.kind === "empty") return { code: EXIT.OK };
   if (resolved.kind === "unsafe") return { code: EXIT.RUNTIME, error: resolved.reason };
-  return await new Promise((resolve) => {
+  return await new Promise((resolve5) => {
     let settled = false;
     const done = (r) => {
       if (!settled) {
         settled = true;
-        resolve(r);
+        resolve5(r);
       }
     };
     const child = deps.spawn(resolved.command, resolved.args, {
@@ -26247,17 +26289,17 @@ import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomBytes as randomBytes5 } from "node:crypto";
 import {
   chmodSync,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync7,
   readdirSync,
-  readFileSync as readFileSync6,
-  renameSync as renameSync4,
+  readFileSync as readFileSync11,
+  renameSync as renameSync6,
   statSync as statSync3,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import path4 from "node:path";
+import { homedir as homedir10 } from "node:os";
+import path5 from "node:path";
 
 // node_modules/sops-age/dist/index.js
 var import_dotenv = __toESM(require_main(), 1);
@@ -26741,8 +26783,8 @@ function getErrorMap() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path6, errorMaps, issueData } = params;
-  const fullPath = [...path6, ...issueData.path || []];
+  const { data, path: path7, errorMaps, issueData } = params;
+  const fullPath = [...path7, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -26858,11 +26900,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path6, key) {
+  constructor(parent, value, path7, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path6;
+    this._path = path7;
     this._key = key;
   }
   get path() {
@@ -34931,18 +34973,18 @@ import { homedir as homedir2, platform } from "node:os";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 var import_sshpk = __toESM(require_lib2(), 1);
-async function loadFromFile(path6) {
+async function loadFromFile(path7) {
   if (globalThis.Deno) {
-    return Deno.readTextFile(path6);
+    return Deno.readTextFile(path7);
   }
   if (globalThis.Bun) {
-    return Bun.file(path6).text();
+    return Bun.file(path7).text();
   }
   if (typeof process !== "undefined" && process.versions?.node) {
     const fs = await import("fs/promises");
-    return fs.readFile(path6, "utf-8");
+    return fs.readFile(path7, "utf-8");
   }
-  throw new Error(`Unable to determine method to load file "${path6}"`);
+  throw new Error(`Unable to determine method to load file "${path7}"`);
 }
 function isSopsInput(value) {
   if (!value) {
@@ -35050,13 +35092,13 @@ async function parseSops(input, sopsFileType) {
     });
   }
 }
-async function loadSopsFile(path6, sopsFileType) {
+async function loadSopsFile(path7, sopsFileType) {
   try {
-    const content = await loadFromFile(path6);
+    const content = await loadFromFile(path7);
     return await parseSops(content, sopsFileType);
   } catch (err) {
     throw new Error(
-      `Failed to load SOPS file '${path6}': ${err.message}`,
+      `Failed to load SOPS file '${path7}': ${err.message}`,
       {
         cause: err
       }
@@ -35473,15 +35515,15 @@ async function getSopsEncryptionKey(sops, secretKeys) {
 ${errors.join("\n")}`
   );
 }
-function path2gopath(path6) {
-  return `${path6.filter((x) => !/^\d+$/.test(x)).join(":")}:`;
+function path2gopath(path7) {
+  return `${path7.filter((x) => !/^\d+$/.test(x)).join(":")}:`;
 }
-function decryptSOPSValue(ciphertext, decryptionKey, path6) {
+function decryptSOPSValue(ciphertext, decryptionKey, path7) {
   if (!ciphertext) {
     return "";
   }
   const encryptedValue = parse(ciphertext);
-  const aad = path2gopath(path6);
+  const aad = path2gopath(path7);
   let decrypted;
   try {
     decrypted = decryptAesGcm(
@@ -35491,22 +35533,22 @@ function decryptSOPSValue(ciphertext, decryptionKey, path6) {
     );
   } catch (err) {
     throw new Error(
-      `AES-GCM decryption failed at path ${JSON.stringify(path6)} for value "${ciphertext}": ${err instanceof Error ? err.message : String(err)}`
+      `AES-GCM decryption failed at path ${JSON.stringify(path7)} for value "${ciphertext}": ${err instanceof Error ? err.message : String(err)}`
     );
   }
   const decryptedValue = new TextDecoder().decode(decrypted);
   return convertDecryptedValue(decryptedValue, encryptedValue.datatype);
 }
-function decryptObject(obj, decryptionKey, path6 = []) {
+function decryptObject(obj, decryptionKey, path7 = []) {
   if (typeof obj !== "object" || obj === null) {
     return obj;
   }
   for (const key of Object.keys(obj)) {
     const value = obj[key];
     if (typeof value === "string" && value.startsWith("ENC[AES256_GCM,data:")) {
-      obj[key] = decryptSOPSValue(value, decryptionKey, [...path6, key]);
+      obj[key] = decryptSOPSValue(value, decryptionKey, [...path7, key]);
     } else if (typeof value === "object") {
-      obj[key] = decryptObject(value, decryptionKey, [...path6, key]);
+      obj[key] = decryptObject(value, decryptionKey, [...path7, key]);
     }
   }
   return obj;
@@ -35578,69 +35620,72 @@ async function decryptSops(inputOrOptions, options) {
 import { randomUUID } from "node:crypto";
 
 // scripts/lib/console-url-resolver.mjs
-import { readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { join as join5 } from "node:path";
-var DEFAULT_CONSOLE_URL = "https://app.heyspex.com";
-function trimTrailingSlash(url) {
-  return url.replace(/\/+$/, "");
-}
-function readCredentialsConsoleUrl({ homeDir = homedir3() } = {}) {
+init_dev_mode();
+import { readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join7 } from "node:path";
+
+// spex-console/src/lib/cli/control-shared.ts
+import path4 from "node:path";
+
+// scripts/lib/hs-command.mjs
+import { existsSync as existsSync5 } from "node:fs";
+import { delimiter, dirname as dirname2, join as join8 } from "node:path";
+import { fileURLToPath } from "node:url";
+var HS_BIN_NAME = "hs";
+var HS_DISPATCHER_PATH = (() => {
   try {
-    const raw = readFileSync4(join5(homeDir, ".heyspex", "credentials.yaml"), "utf8");
-    const match = raw.match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
-    const value = match?.[1]?.trim();
-    return value && value.length > 0 ? trimTrailingSlash(value) : null;
+    const here = dirname2(fileURLToPath(import.meta.url));
+    return join8(dirname2(dirname2(here)), "bin", "hs.mjs");
   } catch {
     return null;
   }
-}
-function readDiscoveryFileConsoleUrl(repoRoot) {
-  if (!repoRoot) return null;
-  for (const name of [
-    "console-url",
-    "cockpit-url"
-    /* legacy-cockpit */
-  ]) {
-    try {
-      const discovery = readFileSync4(join5(repoRoot, ".heyspex", name), "utf8").trim();
-      if (discovery.length > 0) return trimTrailingSlash(discovery);
-    } catch {
-    }
-  }
-  return null;
-}
-var ConsoleUrlUnresolvedError = class extends Error {
-  constructor() {
-    super(
-      `resolveConsoleUrl: no HEYSPEX_CONSOLE_URL/HEYSPEX_COCKPIT_URL env, no console_url: in ~/.heyspex/credentials.yaml, and no .heyspex/console-url discovery file \u2014 refusing to silently fall back to the ${DEFAULT_CONSOLE_URL} default in strict mode.`
-    );
-    this.name = "ConsoleUrlUnresolvedError";
-  }
-};
-function resolveConsoleUrl({
-  repoRoot,
-  env = process.env,
-  homeDir = homedir3(),
-  strict = false
-} = {}) {
-  const envUrl = (env.HEYSPEX_CONSOLE_URL ?? env.HEYSPEX_COCKPIT_URL)?.trim();
-  if (envUrl) return trimTrailingSlash(envUrl);
-  const credentialsUrl = readCredentialsConsoleUrl({ homeDir });
-  if (credentialsUrl) return credentialsUrl;
-  const discoveryUrl = readDiscoveryFileConsoleUrl(repoRoot);
-  if (discoveryUrl) return discoveryUrl;
-  if (strict) throw new ConsoleUrlUnresolvedError();
-  return DEFAULT_CONSOLE_URL;
-}
+})();
+function shellQuote(p) {
+  return /[\\\s]/.test(p) ? `"${p}"` : p;
+}
+var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER_PATH)}` : HS_BIN_NAME;
+
+// vendor/heyspex-mcp/console-fetch.mjs
+init_credentials();
+import { readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join11 } from "node:path";
+
+// vendor/heyspex-mcp/session-owner.mjs
+init_credentials();
+import { readFileSync as readFileSync7 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join9 } from "node:path";
+
+// vendor/heyspex-mcp/vault-less-endpoints.mjs
+var VAULT_LESS_ENDPOINTS = Object.freeze([
+  "* /api/mcp/session",
+  "* /api/mcp/pairing-codes",
+  "POST /api/vaults",
+  "GET /api/vaults",
+  "POST /api/workspaces",
+  "GET /api/workspaces",
+  "* /api/admin/dev-mode"
+]);
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
+import { homedir as homedir7, tmpdir } from "node:os";
+import { dirname as dirname3, join as join10, resolve as resolve3 } from "node:path";
+
+// vendor/heyspex-mcp/console-fetch.mjs
+var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
 
 // spex-console/src/lib/cli/control-shared.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join6 } from "node:path";
+init_credentials();
+
+// spex-console/src/lib/vault-registry/registry-file.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync10, renameSync as renameSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname4, join as join12, resolve as resolve4 } from "node:path";
 
 // spex-console/src/lib/cli/init.ts
-var DEFAULT_CONSOLE_URL2 = resolveConsoleUrl();
 function parseVaultId(content) {
   const m = content.match(/^vault_id:\s*(.+?)\s*$/m);
   if (!m) return null;
@@ -35652,27 +35697,38 @@ var HELP2 = [
   "Usage:",
   "  hs init [--console-url <url>] [--vault-root <path>] [--force] [--json]",
   "  hs init --customer-vault <dir> [--console-url <url>] [--principles <all|none|a,b>]",
-  "                          [--vault-name <name>] [--no-git] [--json]",
+  "                          [--vault-name <name>] [--git] [--json]",
   "",
   "Write the top-level heyspex.yaml vault marker (schema_version, console_url,",
-  "vault_root, vault_id) \u2014 the committed file the console / web companion read",
+  "vault_root, vault_id; `hs connect` also records `account:`, the account id the",
+  "repo was connected under) \u2014 the committed file the console / web companion read",
   "to bootstrap a vault. Idempotent: an existing marker is left untouched unless",
   "--force, EXCEPT a missing vault_id is backfilled in place either way (backward",
   "compatible \u2014 no schema_version bump). vault_id is reused exactly when already",
   "present; a fresh one is minted only when absent.",
-  "Does not modify .heyspex/config.yaml or its templates (ADR-0009).",
+  "Also scaffolds the vault_root folder and seeds .heyspex/config.yaml (the",
+  "HeySpex workflow settings, ADR-0009) from the shipped template",
+  "(vendor/heyspex-mcp/config-seed.yaml) when that file is absent. An existing",
+  ".heyspex/config.yaml is never rewritten \u2014 not even with --force; change its",
+  "values with `hs settings set <key> <value>`.",
   "",
   "--customer-vault <dir> scaffolds a REAL customer vault at <dir> instead: the",
-  "specs/ folder tree, heyspex.yaml, and every row of the template shipping",
-  "manifest (spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
+  "specs/ folder tree, heyspex.yaml, the seeded .heyspex/config.yaml, and every",
+  "row of the template shipping manifest",
+  "(spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
   "copied verbatim, template-shape docs written as author-prompt skeletons \u2014",
-  "plus a generated CLAUDE.md, the kept-principles index, and (unless --no-git)",
-  "one initial `git init` + commit pinning the template version. Refuses a",
-  "non-empty <dir> with a plain error. See init.customer-vault.ts.",
+  "plus a generated CLAUDE.md, the kept-principles index, and the template_version",
+  "pin; with --git, one initial `git init` + commit. Rerunnable: a <dir> that already",
+  "holds heyspex.yaml and an empty/placeholder-only specs/ is accepted, existing",
+  "files are never overwritten (an existing CLAUDE.md gets a CLAUDE.md.template",
+  "beside it), and the result lists each manifest row as created or kept. Refuses a",
+  "non-empty <dir> without heyspex.yaml, or a specs/ holding managed specs.",
+  "See init.customer-vault.ts.",
   "",
   "Flags:",
-  "  --console-url <url>  console_url value (default: $HEYSPEX_CONSOLE_URL or",
-  "                       https://console.heyspex.local).",
+  "  --console-url <url>  console_url value (default: the mode-aware console --",
+  "                       $HEYSPEX_CONSOLE_URL, else the signed-in console, else",
+  "                       https://app.heyspex.com in prod mode).",
   "  --vault-root <path>  vault_root value (default: specs/).",
   "  --customer-vault <dir> Scaffold a new customer vault at <dir> (see above).",
   "  --principles <all|none|a,b> Which universal principle docs to ship",
@@ -35680,8 +35736,9 @@ var HELP2 = [
   "                       keep/skip prompt per principle. Omitted + no TTY: all.",
   "  --vault-name <name>  Display name for the scaffolded vault (--customer-vault",
   "                       only; default: <dir>'s basename).",
-  "  --no-git             Skip git init + the initial commit (--customer-vault only).",
-  "  --force              Overwrite an existing heyspex.yaml.",
+  "  --git                Also run git init + one initial commit (--customer-vault only;",
+  "                       default: no git). --no-git is accepted as a no-op.",
+  "  --force              Overwrite an existing heyspex.yaml (never .heyspex/config.yaml).",
   "  --json               Emit a machine-readable JSON result.",
   "  --help, -h           Show this help.",
   "",
@@ -35697,8 +35754,11 @@ function scopedProfileName(profileName, vaultId) {
   const short = vaultId.replace(/[^A-Za-z0-9]/g, "").slice(0, 8).toUpperCase();
   return short.length === 0 ? profileName : `${profileName}__V${short}`;
 }
+function sanitizedProfileToken(profileName) {
+  return profileName.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+}
 function keysEnvVarName(profileName) {
-  return ENV_VAR_PREFIX + profileName.toUpperCase();
+  return ENV_VAR_PREFIX + sanitizedProfileToken(profileName);
 }
 function looksLikePrivateKey(value) {
   if (typeof value !== "string") return false;
@@ -35736,7 +35796,7 @@ function upsertKeysLine(contentOrNull, profileName, privateKey, vaultId) {
   const matchesProfile = (raw) => {
     const bare = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
     const m = KEYS_LINE.exec(bare);
-    return m !== null && m[1].toUpperCase() === effective.toUpperCase();
+    return m !== null && m[1].toUpperCase() === sanitizedProfileToken(effective);
   };
   const lines = [];
   let replaced = false;
@@ -35758,7 +35818,7 @@ function upsertKeysLine(contentOrNull, profileName, privateKey, vaultId) {
 }
 function existingKeyInSlot(contentOrNull, profileName, vaultId) {
   const effective = scopedProfileName(profileName, vaultId);
-  return parseKeysFile(contentOrNull ?? "")[effective.toLowerCase()] ?? null;
+  return parseKeysFile(contentOrNull ?? "")[sanitizedProfileToken(effective).toLowerCase()] ?? null;
 }
 function dateStamp(when) {
   return when.toISOString().slice(0, 10).replace(/-/g, "");
@@ -35820,7 +35880,7 @@ function resolvePrivateKey(args) {
     if (!source.content) continue;
     const parsed = parseKeysFile(source.content);
     for (const candidate of candidateProfileNames(args)) {
-      const fromFile = parsed[candidate.toLowerCase()];
+      const fromFile = parsed[sanitizedProfileToken(candidate).toLowerCase()];
       if (!fromFile) continue;
       if (!looksLikePrivateKey(fromFile)) {
         throw new EnvVaultConfigError(
@@ -35969,23 +36029,23 @@ function isExpiredDate(expires, today = todayIso()) {
   return expires !== null && today > expires;
 }
 function envDir(vaultRoot) {
-  return path4.join(vaultRoot, ".heyspex", "env");
+  return path5.join(vaultRoot, ".heyspex", "env");
 }
 function profilePath(vaultRoot, name) {
-  return path4.join(envDir(vaultRoot), `${name}.env`);
+  return path5.join(envDir(vaultRoot), `${name}.env`);
 }
 function keysPath(vaultRoot) {
-  return path4.join(vaultRoot, ".heyspex", "env.keys");
+  return path5.join(vaultRoot, ".heyspex", "env.keys");
 }
 function homeKeysPath() {
-  return path4.join(process.env.HEYSPEX_ENV_KEYS_HOME || homedir5(), ".heyspex", "env.keys");
+  return path5.join(process.env.HEYSPEX_ENV_KEYS_HOME || homedir10(), ".heyspex", "env.keys");
 }
 function dotenvPath(vaultRoot) {
-  return path4.join(vaultRoot, ".env");
+  return path5.join(vaultRoot, ".env");
 }
 function readOrNull(file) {
   try {
-    return readFileSync6(file, "utf-8");
+    return readFileSync11(file, "utf-8");
   } catch {
     return null;
   }
@@ -35999,7 +36059,7 @@ function renameWithRetry(tmp, file) {
   const retryable = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
   for (let attempt = 0; ; attempt++) {
     try {
-      renameSync4(tmp, file);
+      renameSync6(tmp, file);
       return;
     } catch (err) {
       const code = err.code ?? "";
@@ -36016,15 +36076,15 @@ function unlinkQuiet(file) {
 }
 function atomicWrite(file, content, mode = 420) {
   const secret = mode === SECRET_MODE;
-  const dir = path4.dirname(file);
-  mkdirSync4(dir, { recursive: true, ...secret ? { mode: SECRET_DIR_MODE } : {} });
-  const tmp = path4.join(
+  const dir = path5.dirname(file);
+  mkdirSync7(dir, { recursive: true, ...secret ? { mode: SECRET_DIR_MODE } : {} });
+  const tmp = path5.join(
     dir,
-    `.${path4.basename(file)}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`
+    `.${path5.basename(file)}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`
   );
   let renamed = false;
   try {
-    writeFileSync4(tmp, content, { encoding: "utf-8", mode });
+    writeFileSync7(tmp, content, { encoding: "utf-8", mode });
     if (secret) chmodOwnerOnly(tmp);
     renameWithRetry(tmp, file);
     renamed = true;
@@ -36038,11 +36098,11 @@ var LOCK_RETRY_MS3 = 50;
 var LOCK_STALE_MS3 = 5e3;
 function withFileLock(file, fn) {
   const lock = `${file}.lock`;
-  mkdirSync4(path4.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
+  mkdirSync7(path5.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
   let held = false;
   for (let attempt = 0; attempt < LOCK_RETRIES && !held; attempt++) {
     try {
-      writeFileSync4(lock, `${process.pid}
+      writeFileSync7(lock, `${process.pid}
 `, { flag: "wx" });
       held = true;
     } catch (err) {
@@ -36091,7 +36151,7 @@ function writeHomeKeyLine(profileName, privateKey, vaultId) {
 }
 function readVaultId(vaultRoot) {
   try {
-    const raw = readOrNull(path4.join(vaultRoot, "heyspex.yaml"));
+    const raw = readOrNull(path5.join(vaultRoot, "heyspex.yaml"));
     return raw === null ? null : parseVaultId(raw);
   } catch {
     return null;
@@ -36234,7 +36294,7 @@ function legacyDecryptAllSync(vaultRoot, name) {
 }
 function initProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   const pFile = profilePath(vaultRoot, name);
-  if (existsSync5(pFile) && !opts.force) {
+  if (existsSync8(pFile) && !opts.force) {
     throw new EnvVaultConfigError(
       `Env profile "${name}" already exists at ${pFile}. Pass --force to re-key it (this discards existing values and mints a new keypair).`
     );
@@ -36620,7 +36680,7 @@ function removeGrant(vaultRoot, profileName, name, opts = {}) {
 }
 async function exportProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   const target = dotenvPath(vaultRoot);
-  if (existsSync5(target) && !opts.force) {
+  if (existsSync8(target) && !opts.force) {
     throw new EnvVaultConfigError(
       `${target} already exists. Pass --force to overwrite it (it is disposable \u2014 the encrypted profile is the system of record).`
     );
@@ -36632,10 +36692,10 @@ async function exportProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   return { path: target };
 }
 function resolveVaultPath(vaultRoot, filePath) {
-  const root = path4.resolve(vaultRoot);
-  const resolved = path4.resolve(root, filePath);
-  const rel = path4.relative(root, resolved);
-  if (path4.isAbsolute(filePath) || path4.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path4.sep}`)) {
+  const root = path5.resolve(vaultRoot);
+  const resolved = path5.resolve(root, filePath);
+  const rel = path5.relative(root, resolved);
+  if (path5.isAbsolute(filePath) || path5.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path5.sep}`)) {
     throw new EnvVaultConfigError(
       `Refusing to touch "${filePath}" \u2014 it resolves outside the vault root (${root}). Vault file paths must stay inside the repo (no "..", no absolute paths).`
     );
@@ -36649,7 +36709,7 @@ function writeTextFile(vaultRoot, filePath, content) {
   atomicWrite(resolveVaultPath(vaultRoot, filePath), content, SECRET_MODE);
 }
 function pathExists(vaultRoot, filePath) {
-  return existsSync5(resolveVaultPath(vaultRoot, filePath));
+  return existsSync8(resolveVaultPath(vaultRoot, filePath));
 }
 function fileMtime(vaultRoot, filePath) {
   const resolved = resolveVaultPath(vaultRoot, filePath);
@@ -36683,7 +36743,7 @@ function listRepoSourceFiles(vaultRoot) {
     for (const entry of entries) {
       const childRel = rel === "" ? entry.name : `${rel}/${entry.name}`;
       if (entry.isDirectory()) {
-        if (!WALK_SKIP_DIRS.has(entry.name)) walk(path4.join(dir, entry.name), childRel);
+        if (!WALK_SKIP_DIRS.has(entry.name)) walk(path5.join(dir, entry.name), childRel);
       } else if (entry.isFile()) {
         out.push(childRel);
       }
@@ -36709,7 +36769,7 @@ function isKeysFileGitignored(vaultRoot) {
     if (res.status === 1) return false;
   } catch {
   }
-  const gitignore = readOrNull(path4.join(vaultRoot, ".gitignore"));
+  const gitignore = readOrNull(path5.join(vaultRoot, ".gitignore"));
   if (gitignore === null) return false;
   const ignorePatterns = /* @__PURE__ */ new Set([
     ".heyspex/env.keys",
@@ -36739,16 +36799,44 @@ async function httpPostJson(url, body) {
   return { status: res.status, body: parsed };
 }
 
+// spex-console/bin/run-entry.ts
+import process2 from "node:process";
+var BinExit = class extends Error {
+  code;
+  constructor(code) {
+    super(`exit ${code}`);
+    this.name = "BinExit";
+    this.code = code;
+  }
+};
+function runEntry(name, main2, options = {}) {
+  const { fallbackCode = 1, unhandledLabel = "unhandled" } = options;
+  void (async () => {
+    try {
+      await main2();
+    } catch (err) {
+      if (err instanceof BinExit) {
+        process2.exitCode = err.code;
+        return;
+      }
+      const message = err instanceof Error ? err.message : String(err);
+      process2.stderr.write(`${name}: ${unhandledLabel}: ${message}
+`);
+      process2.exitCode = fallbackCode;
+    }
+  })();
+}
+
 // spex-console/bin/hs-env.ts
 function hsSelfCommand() {
-  const here = path5.dirname(fileURLToPath(import.meta.url));
-  const pkgRoot = process2.env.HS_PKG_ROOT?.trim();
+  const here = path6.dirname(fileURLToPath2(import.meta.url));
+  const pkgRoot = resolveCodeRoot({});
   const candidates = [
-    ...pkgRoot ? [path5.join(pkgRoot, "bin", "hs.mjs")] : [],
-    path5.resolve(here, "..", "..", "bin", "hs.mjs")
+    ...pkgRoot ? [path6.join(pkgRoot, "bin", "hs.mjs")] : [],
+    path6.resolve(here, "..", "..", "bin", "hs.mjs")
   ];
-  const launcher = candidates.find((c) => existsSync6(c));
-  return launcher ? [process2.execPath, launcher] : null;
+  const launcher = candidates.find((c) => existsSync9(c));
+  return launcher ? [process3.execPath, launcher] : null;
 }
 var VIRTUAL_ADAPTER = /nordlynx|tailscale|zerotier|hamachi|wireguard|openvpn|proton|tap-|tun\d|vethernet|\bwsl\b|hyper-v|docker|vmware|virtualbox|vbox|utun|bridge/i;
 function lanCandidates() {
@@ -36773,36 +36861,39 @@ function lanIp() {
   return lanCandidates()[0]?.address ?? null;
 }
 function readStdin() {
-  if (process2.stdin.isTTY) {
-    const eof = process2.platform === "win32" ? "Ctrl+Z then Enter" : "Ctrl+D";
-    process2.stderr.write(`Paste the value, press Enter, then ${eof} to finish (Ctrl+C cancels):
+  if (process3.stdin.isTTY) {
+    const eof = process3.platform === "win32" ? "Ctrl+Z then Enter" : "Ctrl+D";
+    process3.stderr.write(`Paste the value, press Enter, then ${eof} to finish (Ctrl+C cancels):
 `);
   }
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve5, reject) => {
     const chunks = [];
-    process2.stdin.on("data", (c) => chunks.push(c));
-    process2.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-    process2.stdin.on("error", reject);
+    process3.stdin.on("data", (c) => chunks.push(c));
+    process3.stdin.on("end", () => resolve5(Buffer.concat(chunks).toString("utf-8")));
+    process3.stdin.on("error", reject);
   });
 }
 async function main() {
-  const vaultRoot = process2.env.HS_VAULT_ROOT;
+  const vaultRoot = process3.env.HS_VAULT_ROOT;
   if (!vaultRoot) {
-    process2.stderr.write(
+    process3.stderr.write(
       "hs env: HS_VAULT_ROOT is not set (the dispatcher must resolve and pass it).\n"
     );
-    process2.exit(EXIT.USAGE);
+    process3.exitCode = EXIT.USAGE;
+    return;
   }
-  const parsed = parseEnvArgs(process2.argv.slice(3));
+  const parsed = parseEnvArgs(process3.argv.slice(3));
   if ("help" in parsed) {
-    process2.stdout.write(`${HELP}
+    process3.stdout.write(`${HELP}
 `);
-    process2.exit(EXIT.OK);
+    process3.exitCode = EXIT.OK;
+    return;
   }
   if ("error" in parsed) {
-    process2.stderr.write(`hs env: ${parsed.error.message}
+    process3.stderr.write(`hs env: ${parsed.error.message}
 `);
-    process2.exit(parsed.error.code);
+    process3.exitCode = parsed.error.code;
+    return;
   }
   const result = await runEnv(parsed.args, {
     vaultRoot,
@@ -36817,29 +36908,24 @@ async function main() {
       // `resolveVerifyCommand`) so no manifest text is shell-interpolated.
       ...options.shell === true ? { shell: true } : {}
     }),
-    stdout: (s) => process2.stdout.write(s),
-    stderr: (s) => process2.stderr.write(s),
-    env: process2.env,
+    stdout: (s) => process3.stdout.write(s),
+    stderr: (s) => process3.stderr.write(s),
+    env: process3.env,
     audit: (event) => void appendEnvVaultAudit(vaultRoot, event),
     readStdin,
-    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
     httpPostJson,
     pairingConsoleCandidates: defaultPairingConsoleCandidates,
     lanIp,
     lanCandidates,
-    platform: process2.platform,
+    platform: process3.platform,
     hsSelfCommand: hsSelfCommand()
   });
   if (result.message) {
-    const sink = result.code === EXIT.OK ? process2.stdout : process2.stderr;
+    const sink = result.code === EXIT.OK ? process3.stdout : process3.stderr;
     sink.write(`${result.message}
 `);
   }
-  process2.exit(result.code);
+  process3.exitCode = result.code;
 }
-main().catch((err) => {
-  const message = err instanceof Error ? err.message : String(err);
-  process2.stderr.write(`hs env: unhandled: ${message}
-`);
-  process2.exit(EXIT.RUNTIME);
-});
+runEntry("hs env", main, { fallbackCode: EXIT.RUNTIME });