heyspex 0.1.0

package/dist/cli/hs-vault.mjs

@@ -0,0 +1,4166 @@
+import { createRequire as __hsCreateRequire } from 'node:module';
+const require = __hsCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// dist/cli/._sql-orm-inert.cli-shim.mjs
+var inert, sql, and, eq, ne, isNull, isNotNull, inArray, bigint, bigserial, boolean, foreignKey, index, integer, jsonb, pgEnum, pgTable, primaryKey, text, timestamp, uniqueIndex;
+var init_sql_orm_inert_cli_shim = __esm({
+  "dist/cli/._sql-orm-inert.cli-shim.mjs"() {
+    "use strict";
+    inert = new Proxy(function inert2() {
+      return inert2;
+    }, {
+      get(_target, prop) {
+        if (prop === "then" || prop === Symbol.toPrimitive || prop === Symbol.iterator) return void 0;
+        return inert;
+      },
+      apply() {
+        return inert;
+      },
+      construct() {
+        return inert;
+      }
+    });
+    sql = inert;
+    and = inert;
+    eq = inert;
+    ne = inert;
+    isNull = inert;
+    isNotNull = inert;
+    inArray = inert;
+    bigint = inert;
+    bigserial = inert;
+    boolean = inert;
+    foreignKey = inert;
+    index = inert;
+    integer = inert;
+    jsonb = inert;
+    pgEnum = inert;
+    pgTable = inert;
+    primaryKey = inert;
+    text = inert;
+    timestamp = inert;
+    uniqueIndex = inert;
+  }
+});
+
+// dist/cli/._postgres-client.cli-shim.mjs
+function isPostgresConfigured() {
+  return false;
+}
+function getPostgresDb() {
+  throw new Error(
+    "getPostgresDb() is unavailable in a published install -- this build ships no direct database connection."
+  );
+}
+function inertClient() {
+  return false;
+}
+var isPostgresUsable;
+var init_postgres_client_cli_shim = __esm({
+  "dist/cli/._postgres-client.cli-shim.mjs"() {
+    "use strict";
+    isPostgresUsable = inertClient;
+  }
+});
+
+// spex-console/src/lib/db/schema/interfaces.ts
+var SINGLE_USER_ID, DEFAULT_VAULT_ID;
+var init_interfaces = __esm({
+  "spex-console/src/lib/db/schema/interfaces.ts"() {
+    "use strict";
+    SINGLE_USER_ID = "pwher";
+    DEFAULT_VAULT_ID = "default";
+  }
+});
+
+// spex-console/src/lib/db/schema/postgres.ts
+var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, specs, tags, edges, wikilinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, wipLedger, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements;
+var init_postgres = __esm({
+  "spex-console/src/lib/db/schema/postgres.ts"() {
+    "use strict";
+    init_sql_orm_inert_cli_shim();
+    init_sql_orm_inert_cli_shim();
+    init_interfaces();
+    edgeTypeEnum = pgEnum("edge_type", [
+      "blocks",
+      "related",
+      "parent_child",
+      "discovered_from"
+    ]);
+    validationSeverityEnum = pgEnum("validation_severity", ["error", "warning"]);
+    outboxOpEnum = pgEnum("outbox_op", ["upsert", "delete"]);
+    specs = pgTable(
+      "specs",
+      {
+        id: text("id").notNull(),
+        name: text("name").notNull(),
+        type: text("type").notNull(),
+        status: text("status").notNull(),
+        priority: integer("priority"),
+        owner: text("owner"),
+        created: text("created").notNull(),
+        // ISO date YYYY-MM-DD
+        updated: text("updated").notNull(),
+        // ISO date YYYY-MM-DD
+        relPath: text("rel_path").notNull(),
+        // Vault-relative POSIX path
+        bodyHash: text("body_hash").notNull(),
+        // SHA-256 of full file (frontmatter + body) for change detection
+        // Canonical authored body — re-added in 0020 ([[HS-TASK-UGUD]]); reverses the 0005 drop.
+        // Nullable until the write path ([[HS-TASK-X724]]) always populates it; UGUD backfills
+        // existing rows from the disk vault. NO read-path change yet (reads stay on disk until 4PH9).
+        bodyText: text("body_text"),
+        indexedAt: timestamp("indexed_at", { withTimezone: true }).notNull(),
+        // NOTE: `body_text` + `body_tsvector` were dropped in migration 0005
+        // ([[HS-EPIC-NLOC]]); the `embedding vector(1536)` column was dropped in
+        // 0004 (HS-EPIC-VSTR). HeySpex retrieval is lexical-only and LOCAL — no read
+        // tier in Neon — per [[retrieval-substrate-lexical-not-embeddings-gate-b-no]].
+        // WRT3 §Schema — single-user sentinel today; future multi-user routing.
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Index-isolation scope ([[HS-Z2KC-TASK]]): every index-table row is scoped
+        // by vault so >1 vault can share one Neon database without colliding on the
+        // specs PK or the (rel_path, user_id) unique index. DEFAULT keeps the ALTER
+        // safe on populated tables and single-vault installs under one bucket.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        // WRT3 §Soft-delete — null = active. No hard-delete API is exposed.
+        deletedAt: timestamp("deleted_at", { withTimezone: true }),
+        // Explicit family key (Naming V3 step 1, [[HS-8O69-EPIC-LKF9-relational-family-graph-authoring]]):
+        // nullable until the backfill script runs; the indexer writes the frontmatter
+        // `family:` field when present, else derives it via `familyOf` (parse
+        // fallback from `id`/basename). Nothing should string-parse family from `id`
+        // once this column is populated — see `dev-factory/handoffs/NAMING-V3-MIGRATION-BRIEF.md`.
+        family: text("family")
+      },
+      (table) => [
+        // Composite PK (vault_id, id): the same HS-XXXX id may exist once PER VAULT.
+        primaryKey({ columns: [table.vaultId, table.id] }),
+        // SpexConsole main list views filter by type + status
+        index("specs_type_status_idx").on(table.type, table.status),
+        // Family-graph lookups (Naming V3 step 1) — group specs by family key.
+        index("specs_family_idx").on(table.family),
+        // Per-user + per-vault lookups + filtering out soft-deleted rows in the hot path
+        index("specs_user_active_idx").on(table.userId, table.vaultId).where(sql`${table.deletedAt} IS NULL`),
+        // One-file-one-row guarantee: at most one ACTIVE row per (rel_path, user,
+        // vault). Without this two rows could share a rel_path under different id
+        // forms (bare vs full-slug) and render as a duplicate-key error. Partial
+        // (deleted_at IS NULL) so soft-deleted orphans don't block re-indexing. The
+        // upsert path soft-deletes any conflicting row first. Scoped by vault so the
+        // same rel_path can be indexed independently under two vaults.
+        uniqueIndex("specs_relpath_user_uq").on(table.relPath, table.userId, table.vaultId).where(sql`${table.deletedAt} IS NULL`)
+      ]
+    );
+    tags = pgTable(
+      "tags",
+      {
+        specId: text("spec_id").notNull(),
+        tag: text("tag").notNull(),
+        inFrontmatter: boolean("in_frontmatter").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.specId, table.tag] }),
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade")
+      ]
+    );
+    edges = pgTable(
+      "edges",
+      {
+        fromId: text("from_id").notNull(),
+        toId: text("to_id").notNull(),
+        edgeType: edgeTypeEnum("edge_type").notNull().$type(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.fromId, table.toId, table.edgeType] }),
+        foreignKey({
+          columns: [table.vaultId, table.fromId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        foreignKey({
+          columns: [table.vaultId, table.toId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        // Forward dependency lookups (what does this spec block?)
+        index("edges_from_type_idx").on(table.fromId, table.edgeType),
+        // Reverse dependency lookups (what blocks this spec?)
+        index("edges_to_type_idx").on(table.toId, table.edgeType)
+      ]
+    );
+    wikilinks = pgTable(
+      "wikilinks",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        fromId: text("from_id").notNull(),
+        targetBasename: text("target_basename").notNull(),
+        resolvedId: text("resolved_id"),
+        inFrontmatter: boolean("in_frontmatter").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        // Surrogate PK `id` stays; the composite FKs scope both link ends to the
+        // owning vault's specs. resolvedId is nullable, so its composite FK is only
+        // enforced when BOTH columns are non-null (MATCH SIMPLE — Postgres default),
+        // which lets an unresolved forward reference keep resolvedId NULL.
+        foreignKey({
+          columns: [table.vaultId, table.fromId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        // CAUTION (migration 0049): in the live DB this constraint carries a PG-15+
+        // column list — ON DELETE SET NULL ("resolved_id") — because a plain
+        // composite SET NULL nulls vault_id too (NOT NULL → 23502 on any delete of
+        // a spec with inbound resolved links). Drizzle cannot express the column
+        // list, so this declaration is the closest approximation: do NOT let a
+        // future drizzle-kit generate "correct" the constraint back to plain
+        // SET NULL — that reintroduces the delete-blocking bug.
+        foreignKey({
+          columns: [table.vaultId, table.resolvedId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("set null"),
+        // Backlink queries: find all specs linking to a target
+        index("wikilinks_target_idx").on(table.targetBasename)
+      ]
+    );
+    aliases = pgTable(
+      "aliases",
+      {
+        specId: text("spec_id").notNull(),
+        alias: text("alias").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.specId, table.alias] }),
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade")
+      ]
+    );
+    validationIssues = pgTable(
+      "validation_issues",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        specId: text("spec_id").notNull(),
+        severity: validationSeverityEnum("severity").notNull().$type(),
+        code: text("code").notNull(),
+        // e.g. "unresolved_wikilink", "missing_frontmatter"
+        message: text("message").notNull(),
+        detectedAt: timestamp("detected_at", { withTimezone: true }).notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        // Surrogate PK `id` stays; the composite FK scopes issues to the owning
+        // vault's specs.
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        // Query issues by spec
+        index("validation_issues_spec_idx").on(table.specId),
+        // Query issues by severity (e.g., show all errors)
+        index("validation_issues_severity_idx").on(table.severity)
+      ]
+    );
+    indexMeta = pgTable(
+      "index_meta",
+      {
+        key: text("key").notNull(),
+        // e.g. "schema_version", "last_indexed_commit"
+        value: text("value").notNull(),
+        // Scope indexer state (last_indexed_commit, schema_version, last_rebuild_at,
+        // and the progress_relay:<userId> KV) per vault so two vaults keep
+        // independent commit pointers. Composite PK (vault_id, key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.key] })]
+    );
+    frontmatterFields = pgTable(
+      "frontmatter_fields",
+      {
+        specId: text("spec_id").notNull(),
+        field: text("field").notNull(),
+        value: jsonb("value"),
+        // JSON value for flexible storage
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.specId, table.field] }),
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade")
+      ]
+    );
+    eventOutbox = pgTable(
+      "event_outbox",
+      {
+        seq: bigserial("seq", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull(),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: `seq` (bigserial) stays the PK; consumers that need to filter
+        // by owning vault (e.g. a per-vault snapshot job) can now do so — the
+        // global PartyKit / snapshot drains stay unfiltered by design (they drain
+        // every vault's outbox).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        specId: text("spec_id").notNull(),
+        op: outboxOpEnum("op").notNull().$type(),
+        payload: jsonb("payload").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        publishedAt: timestamp("published_at", { withTimezone: true }),
+        snapshottedAt: timestamp("snapshotted_at", { withTimezone: true })
+      },
+      (table) => [
+        // PartyKit fan-out drain — unpublished rows in monotonic order
+        index("event_outbox_unpublished_idx").on(table.seq).where(sql`${table.publishedAt} IS NULL`),
+        // Snapshot-to-git drain — unsnapshotted rows in monotonic order
+        index("event_outbox_unsnapshotted_idx").on(table.seq).where(sql`${table.snapshottedAt} IS NULL`),
+        // Per-vault-per-user catch-up (`WHERE vault_id = ? AND user_id = ? AND seq > ?`)
+        index("event_outbox_user_seq_idx").on(table.vaultId, table.userId, table.seq)
+      ]
+    );
+    captureSessions = pgTable(
+      "capture_sessions",
+      {
+        id: text("id").primaryKey(),
+        // HS-CAP-XXXX, minted by the writer
+        ownerUserId: text("owner_user_id").notNull(),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] of [[HS-TNTI-EPIC-saas-multi-tenant-isolation]]).
+        // Mirrors `specs.vault_id` EXACTLY (text, NOT NULL, DEFAULT 'default', no FK
+        // — `vaults` rows can be provisioned in Neon after an index row exists, so a
+        // hard FK would break the boot order; the id is the isolation key, not an
+        // entity reference). The PK stays the globally-minted `id` (capture ids are
+        // random tokens, not per-vault sequences); `vault_id` is the READ/WRITE
+        // filter so one user's two vaults never see each other's captures.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        openedBy: text("opened_by").$type().notNull(),
+        openedBySession: text("opened_by_session").notNull(),
+        mode: text("mode").$type().notNull().default("attended"),
+        status: text("status").$type().notNull().default("pending"),
+        specPath: text("spec_path"),
+        contentBuffer: jsonb("content_buffer").notNull().default(sql`'{}'::jsonb`),
+        attachedAgents: jsonb("attached_agents").notNull().default(sql`'[]'::jsonb`),
+        captureChannel: text("capture_channel"),
+        traceId: text("trace_id"),
+        sourceUrl: text("source_url"),
+        /**
+         * Provenance columns for a capture created from the Agent Mirror canvas
+         * ([[HS-1ROV-EPIC-session-mirror-platform-claude-code]] §Stage 6a). Both
+         * nullable — every pre-existing writer (modal/agent/companion) leaves
+         * them unset. No FK (session/launch rows can expire or predate this
+         * column); `agent_session_id` is `agent_sessions.session_id`,
+         * `launch_id` is `launch_intents.id` by convention only.
+         */
+        agentSessionId: text("agent_session_id"),
+        launchId: text("launch_id"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastActivityAt: timestamp("last_activity_at", { withTimezone: true }).notNull().default(sql`now()`),
+        materializedAt: timestamp("materialized_at", { withTimezone: true }),
+        abandonedAt: timestamp("abandoned_at", { withTimezone: true })
+      },
+      (table) => [
+        // Per-vault + per-user lookup of in-flight captures (e.g. `/hs-capture` attach)
+        index("capture_sessions_pending_by_user").on(table.vaultId, table.ownerUserId, table.status).where(sql`${table.status} = 'pending'`),
+        // Companion `heyspex.capture/0.1` trace correlation
+        index("capture_sessions_companion_by_trace").on(table.traceId).where(sql`${table.traceId} IS NOT NULL`)
+      ]
+    );
+    handoffContext = pgTable(
+      "handoff_context",
+      {
+        laneKey: text("lane_key").notNull(),
+        // agent/lane identifier — upsert key
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Part of the widened upsert key below: two vaults must keep independent
+        // CURRENT rows for the same (user, lane_key), not fight over one row.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        agentId: text("agent_id").notNull(),
+        specId: text("spec_id"),
+        // current spec; plain text, no FK (id-form may be bare vs full-slug)
+        phase: text("phase"),
+        blockers: jsonb("blockers").notNull().default(sql`'[]'::jsonb`),
+        estimatedTime: text("estimated_time"),
+        links: jsonb("links").notNull().default(sql`'[]'::jsonb`),
+        schemaVersion: integer("schema_version").notNull().default(1),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // TTL — server-set on every upsert; reads filter `expires_at > now()`.
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Self-purge upsert key: one CURRENT row per (vault, user, lane). Widened
+        // ([[HS-ZP5H-TASK]] GAP 2) from (user, lane) — two vaults sharing the
+        // owner's user_id must not fight over one lane row.
+        uniqueIndex("handoff_context_user_lane_uq").on(table.vaultId, table.userId, table.laneKey),
+        // List-active-lanes read path (parallel-agent off-on-deck — PA7H).
+        index("handoff_context_user_expiry_idx").on(table.vaultId, table.userId, table.expiresAt)
+      ]
+    );
+    claimEventKindEnum = pgEnum("claim_event_kind", [
+      "acquired",
+      "released",
+      "expired",
+      "stolen",
+      "status_updated",
+      // Sequencer decision log ([[HS-DO05-4U1E-EPIC-session-sequencer-in-the-console]]
+      // AC4): appended in the same transaction as the sequence assignment so the
+      // replay epic can reconstruct the order from events alone.
+      "sequence_assigned"
+    ]);
+    activeClaimStatusEnum = pgEnum("active_claim_status", [
+      "working",
+      "pending",
+      "blocked"
+    ]);
+    pendingReasonEnum = pgEnum("pending_reason", [
+      "question",
+      "permission",
+      "planning",
+      "response"
+    ]);
+    focusEventKindEnum = pgEnum("focus_event_kind", ["set", "cleared"]);
+    specEventKindEnum = pgEnum("spec_event_kind", [
+      "status_change",
+      "wikilink_added",
+      "wikilink_removed",
+      "review_requested",
+      "review_resolved",
+      "priority_change",
+      "parent_change",
+      "claim_acquired",
+      "claim_released"
+    ]);
+    focusPin = pgTable(
+      "focus_pin",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. The
+        // singleton is per (vault, user), not per user: one user with two vaults
+        // pins independently in each.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        pinnedBy: text("pinned_by").notNull(),
+        // agent identifier
+        pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // Silent fuse — null means no expiry; reads treat `expires_at <= now()` as cleared.
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        // Cross-milestone "do the prerequisite first, then come back" return target
+        // ([[HS-EPIC-QQBD]]): when the spec named by `return_on_close_of` closes, the
+        // status route re-pins `return_to_spec_id` and clears both. Both null = an
+        // ordinary pin with no auto-return. Nullable + additive (no data backfill).
+        returnToSpecId: text("return_to_spec_id"),
+        returnOnCloseOf: text("return_on_close_of"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    captureFocusPin = pgTable(
+      "capture_focus_pin",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        pinnedBy: text("pinned_by").notNull(),
+        pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        // Kept structurally identical to {@link focusPin} (pins.ts casts one table to
+        // the other); the capture flow never populates these return-target columns.
+        returnToSpecId: text("return_to_spec_id"),
+        returnOnCloseOf: text("return_on_close_of"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    captureFocusSelection = pgTable(
+      "capture_focus_selection",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // The resolved spec path of the current capture on deck (layer-2 core).
+        specPath: text("spec_path"),
+        // Capture kind — "idea" today; text, validated app-side, kept open.
+        kind: text("kind"),
+        // Free-form note for why this capture is pinned (e.g. "Pinned from console").
+        reason: text("reason"),
+        // The agent display name currently claiming the capture (doc-claim-badge).
+        claimedBy: text("claimed_by"),
+        // The claiming agent's session id (claim refresh surface).
+        claimSession: text("claim_session"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    focusSelection = pgTable(
+      "focus_selection",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // The resolved spec path of the current focus (layer-2 core; scheduler tier #2).
+        specPath: text("spec_path"),
+        // Grain: "milestone" | "epic" | "task" (FocusKind). Text, not an enum — the
+        // vocabulary is validated app-side and kept open for forward grains.
+        kind: text("kind"),
+        // Provenance: "human" | "algorithm" | "human_switched_from_blocker" (FocusProvenance).
+        pickedBy: text("picked_by"),
+        pickedAt: timestamp("picked_at", { withTimezone: true }),
+        // The FocusReason object (trigger / formula / score / runners_up[]) as JSONB.
+        pickedReason: jsonb("picked_reason"),
+        // The blocked epic switched away from (only when picked_by = human_switched_from_blocker).
+        blockerOrigin: text("blocker_origin"),
+        // Free-form note when a human overrides the algorithm pick (Why-Now panel).
+        overrideReason: text("override_reason"),
+        // Legacy FocusState fields kept for backcompat with pre-Phase-3 writers.
+        reason: text("reason"),
+        expires: timestamp("expires", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    focusSkips = pgTable(
+      "focus_skips",
+      {
+        // Insertion-order key — reads order by this so the skip set keeps file order.
+        id: bigserial("id", { mode: "number" }).notNull().unique(),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // PK widened to (vault_id, user_id, spec_id): the same HS-XXXX id exists once
+        // PER VAULT, so a skip in vault A must not collide with (or hide) the same id
+        // in vault B. Strict superset of the old (user_id, spec_id) key — existing
+        // rows stay unique under it.
+        primaryKey({ columns: [table.vaultId, table.userId, table.specId] }),
+        // "this vault+user's skips in insertion order" — the list query.
+        index("focus_skips_user_order_idx").on(table.vaultId, table.userId, table.id)
+      ]
+    );
+    activeClaims = pgTable(
+      "active_claims",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. Part
+        // of the PK, so the atomic-acquire UNIQUE is per (vault, user, spec): vault A
+        // holding HS-XXXX no longer blocks vault B from claiming ITS OWN HS-XXXX.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        agentId: text("agent_id").notNull(),
+        sessionId: text("session_id").notNull(),
+        claimedAt: timestamp("claimed_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        // Live agent-lifecycle signals — mirror the file-side `ActiveClaim` shape from
+        // [[HS-TASK-0LU3]] so the On-Deck v2 surface can distinguish Working / Pending /
+        // Stale / Blocked when claims migrate off `.heyspex/active-claims.json` ([[HS-TASK-ACLM]]).
+        // `effectiveStatus` + `staleAt` stay derived at read time (not persisted).
+        status: activeClaimStatusEnum("status").notNull().default("working"),
+        lastActivityAt: timestamp("last_activity_at", { withTimezone: true }).notNull().default(sql`now()`),
+        /** Fast-death heartbeat ([[HS-TASK-A3FE]]); distinct from minutes-scale `expires_at` lease. */
+        heartbeatAt: timestamp("heartbeat_at", { withTimezone: true }),
+        pendingReason: pendingReasonEnum("pending_reason"),
+        pendingExcerpt: text("pending_excerpt"),
+        errorMessage: text("error_message"),
+        // Live agent work-stage ([[HS-EPIC-... What's Next Phase 2]]): the
+        // present-progressive verb the agent reports as it works (one of WORK_STAGES,
+        // e.g. "Drafting") and the 0-based acceptance-criterion index it is currently
+        // on. Both nullable — a claim need not report progress. Plain text/integer (not
+        // a pg enum) so the verb vocabulary can evolve without an enum migration; the
+        // closed list is enforced in code (src/lib/work-stages.ts) at the write route.
+        currentStage: text("current_stage"),
+        acProgress: integer("ac_progress"),
+        // Durable agent identity↔session binding ([[HS-EPIC-96YK]] AC#2): the
+        // identity `name` slug this claim is operating as (e.g. "code-reviewer"),
+        // so the Agents surface binds presence to the named identity instead of the
+        // best-effort agent-string match. Nullable — a claim need not declare one.
+        agentProfile: text("agent_profile"),
+        // Close-out verification gate ([[HS-EPIC-P2TR]]). `close_permitted` blocks the
+        // `in_review` flip until an independent verifier (or the deterministic manifest
+        // runner) grants it via the verification API — the implementer's self-reported
+        // `ac_progress` is demoted to a display-only claim. `close_granted_by` records
+        // the granting authority (agent id or "human"); `verification_ac_state` holds
+        // the per-criterion `AcCriterionState[]` provenance array.
+        closePermitted: boolean("close_permitted").notNull().default(false),
+        closeGrantedAt: timestamp("close_granted_at", { withTimezone: true }),
+        closeGrantedBy: text("close_granted_by"),
+        verificationAcState: jsonb("verification_ac_state").$type().notNull().default(sql`'[]'::jsonb`),
+        // Session-sequencer global order ([[HS-DO05-4U1E-EPIC-session-sequencer-in-the-console]] AC1):
+        // database-minted, strictly increasing across the table — therefore strictly
+        // increasing within every vault (gaps allowed; ordering is the contract).
+        sequence: bigserial("sequence", { mode: "number" }).notNull().unique(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId, table.specId] })]
+    );
+    claimWaiters = pgTable(
+      "claim_waiters",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        agentId: text("agent_id").notNull(),
+        sessionId: text("session_id").notNull(),
+        // Shared global order: DEFAULT nextval on the claims sequence, not a
+        // per-table bigserial (which would mint a second, unrelated counter).
+        sequence: bigint("sequence", { mode: "number" }).notNull().default(sql`nextval('active_claims_sequence_seq')`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "who is queued behind this spec, in order" — the grant + position query.
+        index("claim_waiters_spec_seq_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.sequence
+        )
+      ]
+    );
+    claimEvents = pgTable(
+      "claim_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: claimEventKindEnum("event_kind").notNull(),
+        specId: text("spec_id").notNull(),
+        agentId: text("agent_id").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "events for this spec, newest first" — the common query (NCPS §indexes).
+        index("claim_events_spec_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.timestamp.desc()
+        )
+      ]
+    );
+    focusEvents = pgTable(
+      "focus_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: focusEventKindEnum("event_kind").notNull(),
+        specId: text("spec_id"),
+        // null for `cleared`
+        actor: text("actor").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        index("focus_events_spec_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.timestamp.desc()
+        )
+      ]
+    );
+    focusAreas = pgTable(
+      "focus_areas",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. The
+        // band is per (vault, user): a tag band set in vault A must not lift specs
+        // in vault B.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        version: integer("version").notNull().default(1),
+        rationale: text("rationale"),
+        // The tag set the focus-band pipeline stage matches against (jsonb string[]).
+        tags: jsonb("tags").notNull().default(sql`'[]'::jsonb`),
+        updatedBy: text("updated_by"),
+        // agent · session that last wrote the band
+        // Reserved fuse — null means no expiry. A2 writes it; enforcement is deferred.
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    focusAreasEvents = pgTable(
+      "focus_areas_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: focusEventKindEnum("event_kind").notNull(),
+        actor: text("actor").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        index("focus_areas_events_ts_idx").on(table.vaultId, table.userId, table.timestamp.desc())
+      ]
+    );
+    specEvents = pgTable(
+      "spec_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: specEventKindEnum("event_kind").notNull(),
+        specId: text("spec_id").notNull(),
+        actor: text("actor").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // High-traffic "events for spec X" query (<50ms target — NCPS AC #5).
+        index("spec_events_spec_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.timestamp.desc()
+        ),
+        // `?kind=` filtered query.
+        index("spec_events_spec_kind_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.eventKind,
+          table.timestamp.desc()
+        )
+      ]
+    );
+    rateLimitBuckets = pgTable(
+      "rate_limit_buckets",
+      {
+        userId: text("user_id").notNull(),
+        bucket: text("bucket").notNull(),
+        windowStart: timestamp("window_start", { withTimezone: true }).notNull(),
+        count: integer("count").notNull().default(0),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        primaryKey({ columns: [table.userId, table.bucket, table.windowStart] }),
+        // Background reaper / dashboards: enumerate stale rows by `window_start`
+        // older than the longest live window. The hot path uses the composite PK.
+        index("rate_limit_buckets_window_idx").on(table.windowStart)
+      ]
+    );
+    userVaults = pgTable("user_vaults", {
+      userId: text("user_id").primaryKey(),
+      vaultRepo: text("vault_repo").notNull(),
+      /** GitHub App installation id — set by `/api/github/callback` before a vault is linked. */
+      installationId: integer("installation_id"),
+      vaultLocalPath: text("vault_local_path"),
+      repoName: text("repo_name"),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+    });
+    milestoneSnapshots = pgTable(
+      "milestone_snapshots",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. Part
+        // of the PK: two vaults each hold their own frozen rank for the same
+        // milestone id.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        milestoneId: text("milestone_id").notNull(),
+        snapshotVersion: integer("snapshot_version").notNull().default(1),
+        snapshotAt: timestamp("snapshot_at", { withTimezone: true }).notNull().defaultNow(),
+        schedulerInputDigest: text("scheduler_input_digest"),
+        epicOrder: jsonb("epic_order").$type().notNull(),
+        appendedAfterSnapshot: jsonb("appended_after_snapshot").$type().notNull().default(sql`'{"epics":[],"tasks_by_epic":{}}'::jsonb`),
+        dormantAt: timestamp("dormant_at", { withTimezone: true })
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.userId, table.milestoneId] }),
+        // "active snapshot for vault+user" hot lookup — only non-dormant rows.
+        index("ms_user_active_idx").on(table.vaultId, table.userId).where(sql`${table.dormantAt} IS NULL`)
+      ]
+    );
+    modelRegistryEntries = pgTable(
+      "model_registry_entries",
+      {
+        id: text("id").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        model: text("model").notNull(),
+        agent: text("agent").notNull(),
+        shell: text("shell").notNull(),
+        enabled: boolean("enabled").notNull().default(true),
+        isDefault: boolean("is_default").notNull().default(false),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        primaryKey({ columns: [table.userId, table.id] }),
+        index("model_registry_entries_user_default_idx").on(table.userId, table.isDefault)
+      ]
+    );
+    launchIntentStatusEnum = pgEnum("launch_intent_status", [
+      "pending",
+      // emitted by the browser, not yet claimed by a companion
+      "claimed",
+      // a companion poller took it (claim-on-read) and is spawning
+      "done",
+      // the companion ACKed after spawning the local agent
+      "failed"
+      // the companion claimed it but the local spawn threw (see last_error)
+    ]);
+    launchIntents = pgTable(
+      "launch_intents",
+      {
+        id: text("id").primaryKey(),
+        // uuid, client-opaque intent id
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: `id` (a caller-minted uuid) stays the PK; `vault_id` is the
+        // READ/WRITE filter so the SAME owner's two vaults never drain each
+        // other's spawn/mint/mirror-send intents.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        // The `/hs-next <id>` target spec (idempotency key for the optimistic
+        // "Launching…" face); null for a bare `/hs-next` launch.
+        specId: text("spec_id"),
+        prompt: text("prompt").notNull(),
+        // the `/hs-next …` prompt to seed the agent
+        registryEntryId: text("registry_entry_id"),
+        agent: text("agent"),
+        /** When false, companion uses `cmd /c` on Windows so the tab closes when the agent exits. */
+        keepTerminalOpen: boolean("keep_terminal_open").notNull().default(true),
+        // Resolved launch target ([[HS-EPIC-JLTL]] model+effort assignment). Nullable
+        // and additive: an old companion simply ignores them and spawns with CLI
+        // defaults — exactly the pre-column behavior.
+        model: text("model"),
+        reasoningEffort: text("reasoning_effort"),
+        // Companion-reported spawn failure detail (status `failed`) — the write-back
+        // channel that lets the cloud UI stop toasting optimistic success.
+        lastError: text("last_error"),
+        status: launchIntentStatusEnum("status").notNull().default("pending"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // Set when a companion claims the intent (pending → claimed).
+        claimedAt: timestamp("claimed_at", { withTimezone: true }),
+        // TTL fuse — server-set on emit; the drain filters `expires_at > now()` and
+        // emit reaps already-expired rows so a dead browser tab can't strand work.
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Drain query: "oldest pending (non-expired) intents for this vault+user".
+        index("launch_intents_user_status_idx").on(
+          table.vaultId,
+          table.userId,
+          table.status,
+          table.createdAt
+        )
+      ]
+    );
+    companionRelayPresence = pgTable(
+      "companion_relay_presence",
+      {
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull()
+      },
+      (table) => [primaryKey({ columns: [table.userId, table.vaultId] })]
+    );
+    companionSettingsStore = pgTable(
+      "companion_settings",
+      {
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        settings: jsonb("settings").notNull(),
+        telemetry: jsonb("telemetry"),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.userId, table.vaultId] })]
+    );
+    wipLedger = pgTable(
+      "wip_ledger",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        /** Epic/spec id the hand-off belongs to (short id, e.g. "HS-COYG"). */
+        specId: text("spec_id").notNull(),
+        /** The full WipEntry blob — see `WipEntry` in `src/lib/wip-state.ts`. */
+        payload: jsonb("payload").notNull(),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.specId] })]
+    );
+    gatherResults = pgTable(
+      "gather_results",
+      {
+        jobId: text("job_id").notNull(),
+        idempotencyKey: text("idempotency_key").notNull(),
+        /** Per-page result entries — `[{ url, state: "cleaned"|"blocked"|"failed", ... }]`. */
+        pages: jsonb("pages").notNull(),
+        /**
+         * A research job's engine-level search account — `{ query,
+         * enginesAttempted, enginesAnswered, resultsFound, resultsGathered,
+         * summary, engines: [{ engine, answered, results, reason?, httpStatus? }] }`.
+         * Null for plain gather/crawl jobs (nothing was searched) and for uploads
+         * from Companions built before the report existed. This is what lets a
+         * zero-page search result say WHY it is empty
+         * ([[HS-RIZN-DIL5-DIAG-spexcrawl-search-returns-zero-pages-on]]).
+         */
+        search: jsonb("search"),
+        createdAt: timestamp("created_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.jobId, table.idempotencyKey] })]
+    );
+    agentSessions = pgTable(
+      "agent_sessions",
+      {
+        sessionId: text("session_id").primaryKey(),
+        // FK-by-convention to launch_intents.id — no hard FK, intents expire/sweep
+        // while the session row (and its usage history) must outlive them.
+        launchId: text("launch_id"),
+        ownerUserId: text("owner_user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. The
+        // PK stays the vendor-minted `session_id` (a globally-unique uuid, not a
+        // per-vault sequence); `vault_id` is the READ/WRITE filter.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        vendor: text("vendor").notNull(),
+        // "claude-code" now; enum grows later (read-only viewer vendors)
+        machine: text("machine"),
+        cwd: text("cwd"),
+        transcriptPath: text("transcript_path"),
+        // Session-chain lineage after /clear, /branch, /rewind, --fork-session.
+        parentSessionId: text("parent_session_id"),
+        status: text("status").notNull().default("live"),
+        // live | ended | stale
+        startedAt: timestamp("started_at", { withTimezone: true }).notNull().default(sql`now()`),
+        endedAt: timestamp("ended_at", { withTimezone: true }),
+        lastEventAt: timestamp("last_event_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // Launch drill-down: "sessions bound to this launch".
+        index("agent_sessions_launch_idx").on(table.launchId),
+        // "Live sessions on this machine" attach flow, scoped per vault.
+        index("agent_sessions_owner_status_idx").on(table.vaultId, table.ownerUserId, table.status)
+      ]
+    );
+    usageEvents = pgTable(
+      "usage_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        sessionId: text("session_id").notNull(),
+        launchId: text("launch_id"),
+        requestId: text("request_id").notNull(),
+        model: text("model").notNull(),
+        lane: text("lane").notNull(),
+        // subscription | api | bundled_local
+        inputTokens: integer("input_tokens").notNull(),
+        outputTokens: integer("output_tokens").notNull(),
+        cacheReadTokens: integer("cache_read_tokens").notNull(),
+        cacheCreationTokens: integer("cache_creation_tokens").notNull(),
+        cacheCreation5m: integer("cache_creation_5m"),
+        cacheCreation1h: integer("cache_creation_1h"),
+        isSidechain: boolean("is_sidechain").notNull().default(false),
+        at: timestamp("at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Keep-last dedupe key — the ingest route upserts on this so a re-POST of
+        // the same request_id overwrites rather than duplicates.
+        uniqueIndex("usage_events_session_request_idx").on(table.sessionId, table.requestId),
+        // Launch drill-down: "usage rows for this launch, in order".
+        index("usage_events_launch_at_idx").on(table.launchId, table.at)
+      ]
+    );
+    streamEvents = pgTable(
+      "stream_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        streamId: text("stream_id").notNull(),
+        // "mirror_session" now; "build" | "api" | "council" join later (HS-31Z5).
+        streamKind: text("stream_kind").notNull(),
+        // Producer-assigned dedupe key — stable across retries/transport hot-swaps.
+        eventUuid: text("event_uuid").notNull(),
+        eventType: text("event_type").notNull(),
+        // e.g. "turn" | "status"
+        payload: jsonb("payload").notNull(),
+        at: timestamp("at", { withTimezone: true }).notNull(),
+        // Short-retention TTL fuse — default now()+6h at insert; swept by cron.
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Producer dedupe — replays/hot-swaps land exactly once per (stream, uuid).
+        uniqueIndex("stream_events_stream_uuid_idx").on(table.streamId, table.eventUuid),
+        // Snapshot-on-connect: "rows for this stream, in order, after a cursor".
+        index("stream_events_stream_id_idx").on(table.streamId, table.id)
+      ]
+    );
+    jobStreams = pgTable(
+      "job_streams",
+      {
+        jobId: text("job_id").primaryKey(),
+        kind: text("kind").notNull(),
+        // build | api | council
+        // FK-by-convention to launch_intents.id — no hard FK, same reasoning as
+        // agent_sessions.launch_id (intents expire/sweep, the job row must outlive them).
+        launchId: text("launch_id"),
+        provider: text("provider"),
+        // e.g. "deepseek" — the tile's `source`
+        model: text("model"),
+        seat: text("seat"),
+        // routing-table seat name (dev-factory/routing-table.json)
+        machine: text("machine"),
+        status: text("status").notNull().default("queued"),
+        // queued | running | done | failed
+        startedAt: timestamp("started_at", { withTimezone: true }).notNull().default(sql`now()`),
+        endedAt: timestamp("ended_at", { withTimezone: true }),
+        lastEventAt: timestamp("last_event_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "Live-ish jobs" read for the unioned stream list.
+        index("job_streams_status_idx").on(table.status),
+        // Launch drill-down: "job streams bound to this launch".
+        index("job_streams_launch_idx").on(table.launchId)
+      ]
+    );
+    resolutionStatusEnum = pgEnum("resolution_status", [
+      "open",
+      "resolved",
+      "dismissed",
+      "deferred"
+    ]);
+    resolutionFocusPin = pgTable(
+      "resolution_focus_pin",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        itemKey: text("item_key").notNull(),
+        pinnedBy: text("pinned_by").notNull(),
+        pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    resolutionLedger = pgTable(
+      "resolution_ledger",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        itemKey: text("item_key").notNull(),
+        status: resolutionStatusEnum("status").$type().notNull(),
+        reason: text("reason"),
+        deferUntil: timestamp("defer_until", { withTimezone: true }),
+        at: timestamp("at", { withTimezone: true }).notNull().default(sql`now()`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // Fold-on-read hot path: newest status row per (vault, user, item_key).
+        index("resolution_ledger_user_item_at_idx").on(
+          table.vaultId,
+          table.userId,
+          table.itemKey,
+          table.at.desc()
+        )
+      ]
+    );
+    workspaces = pgTable("workspaces", {
+      id: text("id").primaryKey(),
+      accountId: text("account_id").notNull(),
+      displayName: text("display_name").notNull(),
+      githubOrg: text("github_org"),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      /**
+       * Reversible soft-remove flag (Close-is-not-Destroy,
+       * [[HS-NBV9-EKLJ-TASK-archive-restore-and-the-close-is-not]]) — distinct
+       * from `DELETE /api/workspaces/:id` unregister, which drops the row
+       * entirely. An archived workspace stays in Neon/registry.json but is
+       * excluded from the default active list.
+       */
+      archived: boolean("archived").notNull().default(false)
+    });
+    vaults = pgTable("vaults", {
+      id: text("id").primaryKey(),
+      workspaceId: text("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+      accountId: text("account_id").notNull(),
+      displayName: text("display_name").notNull(),
+      repoRootAbs: text("repo_root_abs"),
+      githubRemote: text("github_remote"),
+      schemaVersion: integer("schema_version").notNull().default(1),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`),
+      /** Vault equivalent of `workspaces.archived` — see that column's doc comment. */
+      archived: boolean("archived").notNull().default(false)
+    });
+    accountSettings = pgTable("account_settings", {
+      accountId: text("account_id").primaryKey(),
+      activeWorkspaceId: text("active_workspace_id").references(() => workspaces.id, {
+        onDelete: "set null"
+      }),
+      activeVaultId: text("active_vault_id").references(() => vaults.id, { onDelete: "set null" }),
+      // Admin dev/prod mode control (epic HS-Q6M2): the CLOUD rung of the dev-mode
+      // resolution order (env → ~/.heyspex/dev-mode.json → THIS → default prod).
+      // Shape: { mode: "prod"|"dev", reliance: "local"|"cloud", updated_at, source }.
+      // Readers/writers MUST tolerate the column being absent (migration 0050 may
+      // not have run yet on a given database) — catch 42703 and treat as unset.
+      devMode: jsonb("dev_mode"),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+    });
+    vaultGrants = pgTable(
+      "vault_grants",
+      {
+        vaultId: text("vault_id").notNull().references(() => vaults.id, { onDelete: "cascade" }),
+        accountId: text("account_id").notNull(),
+        access: text("access").notNull().default("read"),
+        grantedBy: text("granted_by").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.accountId] })]
+    );
+    githubInstallations = pgTable(
+      "github_installations",
+      {
+        accountId: text("account_id").notNull(),
+        githubAccountLogin: text("github_account_login").notNull(),
+        installationId: integer("installation_id").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.accountId, table.githubAccountLogin] })]
+    );
+    fleetMachines = pgTable(
+      "fleet_machines",
+      {
+        machineKey: text("machine_key").primaryKey(),
+        label: text("label"),
+        gpu: text("gpu"),
+        vramMb: integer("vram_mb"),
+        ramMb: integer("ram_mb"),
+        architecture: text("architecture"),
+        // cuda | rocm | cpu
+        os: text("os"),
+        companionVersion: text("companion_version"),
+        /**
+         * Owning account, stamped from the redeemed join code's issuer at
+         * `POST /api/fleet/join` ([[HS-DOD0-DIAG-fleet-tables-have-no-account-linkage]]).
+         * Nullable: bearer-only `POST /api/fleet/register` registrations and
+         * pre-migration machines have no attributable account ("unattributed" is the
+         * honest state, not a fabricated owner default). The upsert COALESCEs so a
+         * bearer re-register never overwrites a set account_id with null. Prerequisite
+         * for per-account fleet isolation ([[HS-TNTI-EPIC-saas-multi-tenant-isolation]]).
+         */
+        accountId: text("account_id"),
+        /**
+         * Task kinds this machine is willing to run ([[HS-60Z1-EPIC]]). NULL = any kind
+         * (the pre-existing behavior, preserved for machines registered before this
+         * column existed). Eligibility used to be model-only, so a build box could claim
+         * a `research` task it had no way to execute — `claimNextTask` now also filters
+         * on this list when it is set.
+         */
+        eligibleKinds: text("eligible_kinds").array(),
+        lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+        registeredAt: timestamp("registered_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [index("fleet_machines_account_idx").on(table.accountId)]
+    );
+    fleetTasks = pgTable(
+      "fleet_tasks",
+      {
+        taskId: text("task_id").primaryKey(),
+        kind: text("kind").notNull(),
+        // build | breakdown | research | ...
+        modelId: text("model_id"),
+        spec: jsonb("spec").notNull(),
+        target: text("target"),
+        budgetMaxSeconds: integer("budget_max_seconds"),
+        status: text("status").notNull().default("queued"),
+        // queued|claimed|running|done|failed|cancelled
+        claimedBy: text("claimed_by").references(() => fleetMachines.machineKey),
+        claimedAt: timestamp("claimed_at", { withTimezone: true }),
+        lastProgressAt: timestamp("last_progress_at", { withTimezone: true }),
+        /**
+         * The fleet-queue lane ([[HS-60Z1-EPIC]]) — a free-form name for a gated resource
+         * whose work waits its turn (`research-firecrawl`, `build-gpu0`, …). Deliberately
+         * NOT folded into `kind`: `kind` is an existing taxonomy (build|breakdown|research)
+         * that the companion's model-eligibility matching already consumes, and overloading
+         * it would change what shipped callers claim. NULL = a plain dispatch task with no
+         * lane, i.e. every task written before this column existed.
+         */
+        lane: text("lane"),
+        /** Who asked for this work (agent id / session). First-class so the queue can be filtered by requester. */
+        requestedBy: text("requested_by"),
+        /**
+         * Stale-claim provenance. The stall sweep resets `claimed_by` to NULL so a healthy
+         * machine can re-claim; without these two columns the identity of the machine that
+         * dropped the task is erased, and "who had it before it went stale" is unanswerable.
+         * The sweep copies claimed_by/claimed_at here before nulling them, so a reclaim is
+         * visible (`reclaimed: true`) rather than silent.
+         */
+        lastClaimant: text("last_claimant"),
+        lastClaimedAt: timestamp("last_claimed_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [
+        index("fleet_tasks_status_created_idx").on(table.status, table.createdAt),
+        // Lane-scoped peek / rank / list — the fleet-queue read path ([[HS-60Z1-EPIC]]).
+        index("fleet_tasks_lane_status_created_idx").on(table.lane, table.status, table.createdAt)
+      ]
+    );
+    fleetResults = pgTable(
+      "fleet_results",
+      {
+        taskId: text("task_id").references(() => fleetTasks.taskId),
+        idempotencyKey: text("idempotency_key").notNull(),
+        machineKey: text("machine_key").references(() => fleetMachines.machineKey),
+        status: text("status").notNull(),
+        // done | failed
+        reason: text("reason"),
+        result: jsonb("result"),
+        artifacts: jsonb("artifacts"),
+        commitSha: text("commit_sha"),
+        reportedAt: timestamp("reported_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.taskId, table.idempotencyKey] })]
+    );
+    userApiKeys = pgTable(
+      "user_api_keys",
+      {
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        /** Provider id — validated app-side against `API_KEY_PROVIDERS`. */
+        provider: text("provider").notNull(),
+        // Envelope-encryption fields (all base64). See lib/keys/crypto.ts.
+        ciphertext: text("ciphertext").notNull(),
+        iv: text("iv").notNull(),
+        authTag: text("auth_tag").notNull(),
+        wrappedDek: text("wrapped_dek").notNull(),
+        wrapIv: text("wrap_iv").notNull(),
+        wrapAuthTag: text("wrap_auth_tag").notNull(),
+        /** Which KEK version wrapped the data key (rotation selector). */
+        keyVersion: integer("key_version").notNull().default(1),
+        /** Trailing 4 chars of the plaintext — masked-display projection only. */
+        last4: text("last4").notNull(),
+        /** Best-effort verify-on-save result: unverified | valid | invalid. */
+        verificationStatus: text("verification_status").notNull().default("unverified"),
+        verifiedAt: timestamp("verified_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.userId, table.provider] })]
+    );
+    apiKeys = pgTable(
+      "api_keys",
+      {
+        id: text("id").primaryKey(),
+        // opaque key id (uuid), minted at creation — never the raw key
+        keyHash: text("key_hash").notNull(),
+        // SHA-256 hex digest of the raw key; the raw key itself is never stored
+        keyPrefix: text("key_prefix").notNull(),
+        // short non-secret prefix for masked display + lookup
+        scopes: text("scopes").array().notNull(),
+        accountId: text("account_id").notNull().default(SINGLE_USER_ID),
+        status: text("status").notNull().default("active"),
+        // active | expiring | revoked
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+        expiresAt: timestamp("expires_at", { withTimezone: true })
+      },
+      (table) => [
+        // Presented-key lookup path: verifyApiKey resolves by prefix, then
+        // compares the hash. One key can never collide with another's prefix.
+        uniqueIndex("api_keys_prefix_uq").on(table.keyPrefix),
+        // Per-account listing + the max-active-keys-per-account enforcement scan.
+        index("api_keys_account_status_idx").on(table.accountId, table.status)
+      ]
+    );
+    mcpSessions = pgTable(
+      "mcp_sessions",
+      {
+        id: text("id").primaryKey(),
+        // first 12 hex chars of the token hash — list/revoke/audit reference
+        tokenHash: text("token_hash").notNull(),
+        // SHA-256 hex digest of the raw `hsmcp_...` token
+        userId: text("user_id").notNull(),
+        // Clerk userId (or SINGLE_USER_ID) the token authenticates as
+        label: text("label"),
+        // optional human label ("laptop MCP", "CI runner", …)
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+        revokedAt: timestamp("revoked_at", { withTimezone: true })
+      },
+      (table) => [
+        // Presented-token lookup: verify hashes the FULL presented token and scans
+        // for a match — this index is for per-account listing, not the verify path
+        // (the verify path has no indexable prefix to look up by; the sessions
+        // table is expected to stay small — one row per paired machine/agent).
+        index("mcp_sessions_user_idx").on(table.userId)
+      ]
+    );
+    pairingCodes = pgTable(
+      "pairing_codes",
+      {
+        id: text("id").primaryKey(),
+        // first 8 hex chars of the code hash — audit/revoke reference
+        hash: text("hash").notNull(),
+        // SHA-256 hex digest of the plaintext code
+        userId: text("user_id").notNull(),
+        // Clerk userId (or SINGLE_USER_ID) that minted the code
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+        usedAt: timestamp("used_at", { withTimezone: true }),
+        usedBy: text("used_by"),
+        // machineKey that redeemed the code, if supplied
+        revokedAt: timestamp("revoked_at", { withTimezone: true }),
+        note: text("note")
+        // display/audit hint only ("mcp", …) — no effect on redemption
+      },
+      (table) => [index("pairing_codes_user_idx").on(table.userId)]
+    );
+    companionSessions = pgTable(
+      "companion_sessions",
+      {
+        id: text("id").primaryKey(),
+        // first 12 hex chars of the token hash — list/revoke/audit reference
+        tokenHash: text("token_hash").notNull(),
+        // SHA-256 hex digest of the raw `hscmp_...` token
+        userId: text("user_id").notNull(),
+        machineKey: text("machine_key"),
+        // machineKey presented at pairing, if any
+        label: text("label"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+        revokedAt: timestamp("revoked_at", { withTimezone: true })
+      },
+      (table) => [index("companion_sessions_user_idx").on(table.userId)]
+    );
+    inviteRequests = pgTable(
+      "invite_requests",
+      {
+        id: text("id").primaryKey(),
+        // uuid minted by the webhook receiver
+        email: text("email").notNull(),
+        name: text("name"),
+        /** Plan the requester expects to need: free | pro | team. A planning signal, not a commitment. */
+        tier: text("tier").notNull().default("free"),
+        /** Optional free-text context: what they are building / how they use agents. */
+        building: text("building"),
+        status: text("status").notNull().default("new"),
+        // new | invited | declined
+        /** Clerk invitation id, set when an approval actually issues one. */
+        clerkInvitationId: text("clerk_invitation_id"),
+        /** Account id of the admin who approved/declined — audit trail for the decision. */
+        reviewedBy: text("reviewed_by"),
+        reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
+        /** Intake metadata forwarded from the Worker, for spam triage. */
+        sourceIp: text("source_ip"),
+        userAgent: text("user_agent"),
+        /**
+         * Double opt-in completion. Rows only reach this table AFTER the requester
+         * clicked the confirmation link, so in practice this is always set — it is
+         * stored anyway because "when did they verify?" is part of the consent
+         * evidence, and a future intake path might relax that ordering.
+         */
+        confirmedAt: timestamp("confirmed_at", { withTimezone: true }),
+        /**
+         * The OPTIONAL marketing opt-in — deliberately distinct from the required
+         * privacy agreement, which is a condition of using the form and therefore
+         * not evidence of marketing consent. Only this flag may be used to justify
+         * sending marketing email.
+         */
+        marketingConsent: boolean("marketing_consent").notNull().default(false),
+        /**
+         * Version tag of the exact on-page wording the requester agreed to
+         * (`CONSENT_TEXT_VERSION` in heyspex-com/src/lib/consent-text.ts). Without
+         * this, editing the copy would silently rewrite what every historical row
+         * appears to have consented to.
+         */
+        consentTextVersion: text("consent_text_version"),
+        /** When the marketing site recorded it (NOT when the webhook landed). */
+        requestedAt: timestamp("requested_at", { withTimezone: true }).notNull().default(sql`now()`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // The upsert key — one row per requester, re-submits update in place.
+        uniqueIndex("invite_requests_email_uq").on(table.email),
+        // The admin surface's default read: pending first, newest first.
+        index("invite_requests_status_requested_idx").on(table.status, table.requestedAt)
+      ]
+    );
+    notifications = pgTable(
+      "notifications",
+      {
+        id: text("id").primaryKey(),
+        // uuid
+        /** Recipient. Every read path filters on this — notifications are never global. */
+        accountId: text("account_id").notNull().default(SINGLE_USER_ID),
+        /** Event type, e.g. `invite_request`. Open vocabulary by design (see above). */
+        kind: text("kind").notNull(),
+        title: text("title").notNull(),
+        /** One-line supporting detail shown under the title in the dropdown. */
+        body: text("body"),
+        /** Where clicking the notification should take the user (in-app path). */
+        href: text("href"),
+        /**
+         * Kind-specific structured data (e.g. `{ inviteRequestId, email, tier }`).
+         * Keeps the table stable as new kinds arrive.
+         */
+        payload: jsonb("payload"),
+        /**
+         * Idempotency key for the producing event (e.g. `invite_request:<email>`).
+         * A webhook retry must surface ONE bell item, not one per delivery attempt.
+         */
+        dedupeKey: text("dedupe_key"),
+        readAt: timestamp("read_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // The bell's two queries: unread count, and the recent list — both scoped
+        // to the recipient and ordered newest-first.
+        index("notifications_account_created_idx").on(table.accountId, table.createdAt),
+        // Retry-safe producers: one row per (recipient, event).
+        uniqueIndex("notifications_account_dedupe_uq").on(table.accountId, table.dedupeKey)
+      ]
+    );
+    webhookIngestions = pgTable(
+      "webhook_ingestions",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        repo: text("repo").notNull(),
+        // `owner/repo`, from `repository.full_name`
+        branch: text("branch").notNull(),
+        // from `ref`, `refs/heads/` stripped
+        commitSha: text("commit_sha").notNull(),
+        message: text("message").notNull(),
+        authorName: text("author_name").notNull(),
+        authorEmail: text("author_email").notNull(),
+        path: text("path").notNull(),
+        // changed file's repo-relative path
+        ingestedAt: timestamp("ingested_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // A retried/duplicate delivery for the same (repo, commit, path) must not
+        // record twice — GitHub does redeliver on timeout/5xx.
+        uniqueIndex("webhook_ingestions_repo_commit_path_uq").on(
+          table.repo,
+          table.commitSha,
+          table.path
+        )
+      ]
+    );
+    specSettlements = pgTable(
+      "spec_settlements",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        specId: text("spec_id").notNull(),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        repo: text("repo").notNull(),
+        // `owner/name`
+        branch: text("branch").notNull(),
+        commitSha: text("commit_sha").notNull(),
+        settledAt: timestamp("settled_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "latest settlement for this spec" — the read path's only query.
+        index("spec_settlements_spec_settled_idx").on(table.specId, table.settledAt.desc())
+      ]
+    );
+  }
+});
+
+// spex-console/src/lib/vault-registry/neon-probe.ts
+function positiveIntFromEnv(name) {
+  const raw = process.env[name]?.trim();
+  if (!raw) return null;
+  const value = Number.parseInt(raw, 10);
+  return Number.isInteger(value) && value > 0 ? value : null;
+}
+function bootNeonProbeOptions(onFailure) {
+  return {
+    timeoutMs: positiveIntFromEnv("HEYSPEX_NEON_BOOT_PROBE_TIMEOUT_MS") ?? NEON_BOOT_PROBE_TIMEOUT_MS,
+    backoffMs: NEON_BOOT_PROBE_BACKOFF_MS,
+    deadlineMs: positiveIntFromEnv("HEYSPEX_NEON_BOOT_PROBE_DEADLINE_MS") ?? NEON_BOOT_PROBE_DEADLINE_MS,
+    onFailure
+  };
+}
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new NeonProbeTimeoutError(label, ms)), ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    );
+  });
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function emitProbeFailure(options, failure) {
+  try {
+    options?.onFailure?.(failure);
+  } catch {
+  }
+}
+async function runNeonReachabilityProbe(attempt, options = {}, label = "Neon reachability probe") {
+  const timeoutMs = options.timeoutMs ?? NEON_PROBE_TIMEOUT_MS;
+  const backoffMs = options.backoffMs ?? [];
+  const deadlineMs = options.deadlineMs ?? Number.POSITIVE_INFINITY;
+  const attempts = backoffMs.length + 1;
+  let startedAt = Date.now();
+  let suspensions = 0;
+  for (let i = 0; i < attempts; i++) {
+    const attemptStartedAt = Date.now();
+    try {
+      await withTimeout(Promise.resolve().then(attempt), timeoutMs, label);
+      return true;
+    } catch (err) {
+      const elapsedMs = Date.now() - attemptStartedAt;
+      const suspended = elapsedMs >= timeoutMs * SUSPENSION_ELAPSED_FACTOR && elapsedMs - timeoutMs >= SUSPENSION_MIN_OVERSHOOT_MS;
+      if (suspended && suspensions < MAX_SUSPENSION_RETRIES) {
+        suspensions += 1;
+        emitProbeFailure(options, {
+          reason: "suspended",
+          attempt: i + 1,
+          attempts,
+          timeoutMs,
+          elapsedMs,
+          willRetry: true,
+          error: err
+        });
+        startedAt = Date.now();
+        i -= 1;
+        continue;
+      }
+      const isLast = i === attempts - 1;
+      const pastDeadline = Date.now() - startedAt >= deadlineMs;
+      const willRetry = !isLast && !pastDeadline;
+      emitProbeFailure(options, {
+        reason: err instanceof NeonProbeTimeoutError ? "timeout" : "error",
+        attempt: i + 1,
+        attempts,
+        timeoutMs,
+        elapsedMs,
+        willRetry,
+        error: err
+      });
+      if (!willRetry) return false;
+      await sleep(backoffMs[i]);
+    }
+  }
+  return false;
+}
+var NEON_PROBE_TIMEOUT_MS, NEON_BOOT_PROBE_TIMEOUT_MS, NEON_BOOT_PROBE_BACKOFF_MS, NEON_BOOT_PROBE_DEADLINE_MS, SUSPENSION_ELAPSED_FACTOR, SUSPENSION_MIN_OVERSHOOT_MS, MAX_SUSPENSION_RETRIES, NeonProbeTimeoutError;
+var init_neon_probe = __esm({
+  "spex-console/src/lib/vault-registry/neon-probe.ts"() {
+    "use strict";
+    NEON_PROBE_TIMEOUT_MS = 1500;
+    NEON_BOOT_PROBE_TIMEOUT_MS = 12e3;
+    NEON_BOOT_PROBE_BACKOFF_MS = [1e3, 3e3];
+    NEON_BOOT_PROBE_DEADLINE_MS = 2e4;
+    SUSPENSION_ELAPSED_FACTOR = 3;
+    SUSPENSION_MIN_OVERSHOOT_MS = 5e3;
+    MAX_SUSPENSION_RETRIES = 2;
+    NeonProbeTimeoutError = class _NeonProbeTimeoutError extends Error {
+      timeoutMs;
+      constructor(label, timeoutMs) {
+        super(`${label} timed out after ${timeoutMs}ms`);
+        this.name = "NeonProbeTimeoutError";
+        this.timeoutMs = timeoutMs;
+        Object.setPrototypeOf(this, _NeonProbeTimeoutError.prototype);
+      }
+    };
+  }
+});
+
+// spex-console/src/lib/vault-registry/types.ts
+function emptyVaultRegistry() {
+  return {
+    schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    workspaces: [],
+    vaults: [],
+    active_workspace_id: null,
+    active_vault_id: null
+  };
+}
+var VAULT_REGISTRY_SCHEMA_VERSION;
+var init_types = __esm({
+  "spex-console/src/lib/vault-registry/types.ts"() {
+    "use strict";
+    VAULT_REGISTRY_SCHEMA_VERSION = 1;
+  }
+});
+
+// spex-console/src/lib/vault-registry/registry-file.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync4, renameSync, writeFileSync } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname, join as join3 } from "node:path";
+function vaultRegistryDir(opts = {}) {
+  return opts.registryDir ?? join3(homedir3(), ".heyspex");
+}
+function vaultRegistryFilePath(opts = {}) {
+  return join3(vaultRegistryDir(opts), "registry.json");
+}
+function isNonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+function normalizeWorkspace(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  if (!isNonEmptyString(o.id)) return null;
+  if (!isNonEmptyString(o.display_name)) return null;
+  if (!isNonEmptyString(o.created_at)) return null;
+  const record = {
+    id: o.id,
+    display_name: o.display_name,
+    created_at: o.created_at,
+    archived: o.archived === true
+  };
+  if (isNonEmptyString(o.github_org)) record.github_org = o.github_org;
+  return record;
+}
+function normalizeVault(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  if (!isNonEmptyString(o.id)) return null;
+  if (!isNonEmptyString(o.workspace_id)) return null;
+  if (!isNonEmptyString(o.display_name)) return null;
+  if (!isNonEmptyString(o.repo_root_abs)) return null;
+  if (typeof o.schema_version !== "number") return null;
+  if (!isNonEmptyString(o.registered_at)) return null;
+  const record = {
+    id: o.id,
+    workspace_id: o.workspace_id,
+    display_name: o.display_name,
+    repo_root_abs: o.repo_root_abs,
+    schema_version: o.schema_version,
+    registered_at: o.registered_at,
+    archived: o.archived === true
+  };
+  if (isNonEmptyString(o.github_remote)) record.github_remote = o.github_remote;
+  return record;
+}
+function parseVaultRegistryFile(json) {
+  const fallback = emptyVaultRegistry();
+  if (!json || typeof json !== "object") return fallback;
+  const o = json;
+  const workspacesRaw = Array.isArray(o.workspaces) ? o.workspaces : [];
+  const workspaces2 = workspacesRaw.map(normalizeWorkspace).filter((w) => w !== null);
+  const vaultsRaw = Array.isArray(o.vaults) ? o.vaults : [];
+  const vaults2 = vaultsRaw.map(normalizeVault).filter((v) => v !== null);
+  const active_workspace_id = isNonEmptyString(o.active_workspace_id) ? o.active_workspace_id : null;
+  const active_vault_id = isNonEmptyString(o.active_vault_id) ? o.active_vault_id : null;
+  return {
+    schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    workspaces: workspaces2,
+    vaults: vaults2,
+    active_workspace_id,
+    active_vault_id
+  };
+}
+function loadVaultRegistry(opts = {}) {
+  const filePath = vaultRegistryFilePath(opts);
+  if (!existsSync(filePath)) return emptyVaultRegistry();
+  try {
+    const raw = readFileSync4(filePath, "utf8");
+    return parseVaultRegistryFile(JSON.parse(raw));
+  } catch {
+    return emptyVaultRegistry();
+  }
+}
+function writeVaultRegistry(registry, opts = {}) {
+  const filePath = vaultRegistryFilePath(opts);
+  mkdirSync(dirname(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp`;
+  writeFileSync(tmpPath, `${JSON.stringify(registry, null, 2)}
+`, "utf8");
+  renameSync(tmpPath, filePath);
+}
+function isValidId(id) {
+  if (!isNonEmptyString(id)) return false;
+  if (id.includes("/") || id.includes("\\")) return false;
+  if (id === "." || id === "..") return false;
+  return true;
+}
+function registerWorkspace(record, opts = {}) {
+  if (!isValidId(record.id)) {
+    throw new Error(`registerWorkspace: invalid workspace id "${record.id}"`);
+  }
+  const registry = loadVaultRegistry(opts);
+  const idx = registry.workspaces.findIndex((w) => w.id === record.id);
+  if (idx >= 0) {
+    registry.workspaces[idx] = { ...record };
+  } else {
+    registry.workspaces.push({ ...record });
+  }
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+function registerVault(record, opts = {}) {
+  if (!isValidId(record.id)) {
+    throw new Error(`registerVault: invalid vault id "${record.id}"`);
+  }
+  if (!isValidId(record.workspace_id)) {
+    throw new Error(`registerVault: invalid workspace_id "${record.workspace_id}"`);
+  }
+  if (!isNonEmptyString(record.repo_root_abs)) {
+    throw new Error("registerVault: repo_root_abs is required");
+  }
+  const registry = loadVaultRegistry(opts);
+  const isSameVault = (v) => v.id === record.id || v.repo_root_abs === record.repo_root_abs;
+  const idx = registry.vaults.findIndex(isSameVault);
+  if (idx >= 0) {
+    registry.vaults[idx] = { ...record };
+    registry.vaults = registry.vaults.filter((v, i) => i === idx || !isSameVault(v));
+  } else {
+    registry.vaults.push({ ...record });
+  }
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+function setActiveVaultId(vaultId, opts = {}) {
+  const registry = loadVaultRegistry(opts);
+  registry.active_vault_id = vaultId;
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+function setActiveWorkspaceId(workspaceId, opts = {}) {
+  const registry = loadVaultRegistry(opts);
+  registry.active_workspace_id = workspaceId;
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+function removeVault(id, opts = {}) {
+  const registry = loadVaultRegistry(opts);
+  registry.vaults = registry.vaults.filter((v) => v.id !== id);
+  if (registry.active_vault_id === id) {
+    registry.active_vault_id = null;
+  }
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+var init_registry_file = __esm({
+  "spex-console/src/lib/vault-registry/registry-file.ts"() {
+    "use strict";
+    init_types();
+    init_types();
+  }
+});
+
+// spex-console/src/lib/vault-registry/account-pointer.ts
+var account_pointer_exports = {};
+__export(account_pointer_exports, {
+  UnknownVaultIdError: () => UnknownVaultIdError,
+  UnknownWorkspaceIdError: () => UnknownWorkspaceIdError,
+  clearActiveVault: () => clearActiveVault,
+  clearActiveWorkspace: () => clearActiveWorkspace,
+  getActiveVault: () => getActiveVault,
+  getActiveWorkspace: () => getActiveWorkspace,
+  hasLocalVault: () => hasLocalVault,
+  isVaultOwnedByAccount: () => isVaultOwnedByAccount,
+  setActiveVault: () => setActiveVault,
+  setActiveWorkspace: () => setActiveWorkspace
+});
+async function isNeonReachable(deps) {
+  if (deps.neonReachable !== void 0) return deps.neonReachable;
+  const usingInjectedDb = deps.db !== void 0;
+  if (!usingInjectedDb && !isPostgresConfigured()) {
+    emitProbeFailure(deps.probe, {
+      reason: "not-configured",
+      attempt: 1,
+      attempts: 1,
+      timeoutMs: 0,
+      elapsedMs: 0,
+      willRetry: false,
+      error: new Error(
+        "isPostgresConfigured() is false \u2014 no DATABASE_URL env var and no usable ~/.heyspex/credentials.yaml. Neon was never contacted."
+      )
+    });
+    return false;
+  }
+  return runNeonReachabilityProbe(async () => {
+    const db = deps.db ?? getPostgresDb();
+    await db.execute(sql`select 1`);
+  }, deps.probe);
+}
+async function accountSettingsRow(accountId2, db) {
+  const rows = await db.select().from(accountSettings).where(eq(accountSettings.accountId, accountId2)).limit(1);
+  return rows[0] ?? null;
+}
+async function upsertAccountSettings(accountId2, patch, db) {
+  const now = /* @__PURE__ */ new Date();
+  await db.insert(accountSettings).values({ accountId: accountId2, ...patch, createdAt: now, updatedAt: now }).onConflictDoUpdate({
+    target: accountSettings.accountId,
+    set: { ...patch, updatedAt: now }
+  });
+}
+async function vaultExistsInNeon(accountId2, vaultId, db) {
+  const rows = await db.select({ id: vaults.id }).from(vaults).where(and(eq(vaults.id, vaultId), eq(vaults.accountId, accountId2))).limit(1);
+  return rows.length > 0;
+}
+async function workspaceExistsInNeon(accountId2, workspaceId, db) {
+  const rows = await db.select({ id: workspaces.id }).from(workspaces).where(and(eq(workspaces.id, workspaceId), eq(workspaces.accountId, accountId2))).limit(1);
+  return rows.length > 0;
+}
+async function vaultGrantedToAccount(accountId2, vaultId, db) {
+  const rows = await db.select({ vaultId: vaultGrants.vaultId }).from(vaultGrants).where(and(eq(vaultGrants.vaultId, vaultId), eq(vaultGrants.accountId, accountId2))).limit(1);
+  return rows.length > 0;
+}
+async function vaultReachableByAccount(accountId2, vaultId, db) {
+  if (await vaultExistsInNeon(accountId2, vaultId, db)) return true;
+  return vaultGrantedToAccount(accountId2, vaultId, db);
+}
+function vaultExistsInRegistry(vaultId, opts) {
+  return loadVaultRegistry(opts).vaults.some((v) => v.id === vaultId);
+}
+function workspaceExistsInRegistry(workspaceId, opts) {
+  return loadVaultRegistry(opts).workspaces.some((w) => w.id === workspaceId);
+}
+async function isVaultOwnedByAccount(accountId2, vaultId, deps = {}) {
+  if (!await isNeonReachable(deps)) return false;
+  const db = deps.db ?? getPostgresDb();
+  return vaultExistsInNeon(accountId2, vaultId, db);
+}
+async function hasLocalVault(accountId2, deps = {}) {
+  try {
+    if (!await isNeonReachable(deps)) return false;
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.select({ id: vaults.id }).from(vaults).where(
+      and(
+        eq(vaults.accountId, accountId2),
+        isNotNull(vaults.repoRootAbs),
+        eq(vaults.archived, false)
+      )
+    ).limit(1);
+    return rows.length > 0;
+  } catch (err) {
+    console.warn("[account-pointer] hasLocalVault lookup failed, treating as NOT connected:", err);
+    return false;
+  }
+}
+async function getActiveVault(accountId2, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    const row = await accountSettingsRow(accountId2, db);
+    if (row?.activeVaultId) return row.activeVaultId;
+    const owned = await db.select({ id: vaults.id }).from(vaults).where(eq(vaults.accountId, accountId2)).limit(2);
+    if (owned.length === 1) {
+      await upsertAccountSettings(accountId2, { activeVaultId: owned[0].id }, db);
+      return owned[0].id;
+    }
+    return null;
+  }
+  const registry = loadVaultRegistry(deps.registryOpts);
+  if (registry.active_vault_id) return registry.active_vault_id;
+  if (registry.vaults.length === 1) {
+    setActiveVaultId(registry.vaults[0].id, deps.registryOpts ?? {});
+    return registry.vaults[0].id;
+  }
+  return null;
+}
+async function getActiveWorkspace(accountId2, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    const row = await accountSettingsRow(accountId2, db);
+    return row?.activeWorkspaceId ?? null;
+  }
+  return loadVaultRegistry(deps.registryOpts).active_workspace_id;
+}
+async function setActiveVault(accountId2, vaultId, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    if (!await vaultReachableByAccount(accountId2, vaultId, db)) {
+      throw new UnknownVaultIdError(vaultId);
+    }
+    await upsertAccountSettings(accountId2, { activeVaultId: vaultId }, db);
+    return;
+  }
+  const registryOpts = deps.registryOpts ?? {};
+  if (!vaultExistsInRegistry(vaultId, registryOpts)) {
+    throw new UnknownVaultIdError(vaultId);
+  }
+  setActiveVaultId(vaultId, registryOpts);
+}
+async function setActiveWorkspace(accountId2, workspaceId, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    if (!await workspaceExistsInNeon(accountId2, workspaceId, db)) {
+      throw new UnknownWorkspaceIdError(workspaceId);
+    }
+    await upsertAccountSettings(accountId2, { activeWorkspaceId: workspaceId }, db);
+    return;
+  }
+  const registryOpts = deps.registryOpts ?? {};
+  if (!workspaceExistsInRegistry(workspaceId, registryOpts)) {
+    throw new UnknownWorkspaceIdError(workspaceId);
+  }
+  setActiveWorkspaceId(workspaceId, registryOpts);
+}
+async function clearActiveVault(accountId2, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    await upsertAccountSettings(accountId2, { activeVaultId: null }, db);
+    return;
+  }
+  setActiveVaultId(null, deps.registryOpts ?? {});
+}
+async function clearActiveWorkspace(accountId2, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    await upsertAccountSettings(accountId2, { activeWorkspaceId: null }, db);
+    return;
+  }
+  setActiveWorkspaceId(null, deps.registryOpts ?? {});
+}
+var UnknownVaultIdError, UnknownWorkspaceIdError;
+var init_account_pointer = __esm({
+  "spex-console/src/lib/vault-registry/account-pointer.ts"() {
+    "use strict";
+    init_sql_orm_inert_cli_shim();
+    init_postgres_client_cli_shim();
+    init_postgres();
+    init_neon_probe();
+    init_registry_file();
+    UnknownVaultIdError = class extends Error {
+      vaultId;
+      constructor(vaultId) {
+        super(
+          `setActiveVault: unknown vault id "${vaultId}" \u2014 no matching row in Neon "vaults" or registry.json's vaults[] list. Nothing was written.`
+        );
+        this.name = "UnknownVaultIdError";
+        this.vaultId = vaultId;
+      }
+    };
+    UnknownWorkspaceIdError = class extends Error {
+      workspaceId;
+      constructor(workspaceId) {
+        super(
+          `setActiveWorkspace: unknown workspace id "${workspaceId}" \u2014 no matching row in Neon "workspaces" or registry.json's workspaces[] list. Nothing was written.`
+        );
+        this.name = "UnknownWorkspaceIdError";
+        this.workspaceId = workspaceId;
+      }
+    };
+  }
+});
+
+// spex-console/src/lib/vault-registry/repo-identity.ts
+import path2 from "node:path";
+function normalizeRepoRoot(p) {
+  let resolved = path2.resolve(p);
+  while (resolved.length > 1 && (resolved.endsWith("/") || resolved.endsWith("\\"))) {
+    resolved = resolved.slice(0, -1);
+  }
+  return resolved.toLowerCase();
+}
+function repoRootCandidates(p) {
+  const norm = normalizeRepoRoot(p);
+  const candidates = [norm];
+  if (path2.basename(norm) === "specs") {
+    const parent = path2.dirname(norm);
+    if (parent !== norm) candidates.push(parent);
+  }
+  return candidates;
+}
+function repoRootsEquivalent(a, b) {
+  if (!a || !b) return false;
+  const aCands = repoRootCandidates(a);
+  const bCands = new Set(repoRootCandidates(b));
+  return aCands.some((c) => bCands.has(c));
+}
+var init_repo_identity = __esm({
+  "spex-console/src/lib/vault-registry/repo-identity.ts"() {
+    "use strict";
+  }
+});
+
+// spex-console/src/lib/cli/vault-workspace-shared.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+function resolveCliAccountId(opts = {}) {
+  const env = opts.env ?? process.env;
+  const fromEnv = env.HS_ACCOUNT_ID?.trim();
+  if (fromEnv) return fromEnv;
+  try {
+    const homeDir = opts.homeDir ?? os2.homedir();
+    const readFile2 = opts.readFile ?? ((p) => readFileSync5(p, "utf-8"));
+    const config = readFile2(path3.join(homeDir, ".heyspex", "config.yaml"));
+    const match = config.match(/^account_id:\s*["']?([^"'\r\n#]+)/m);
+    const value = match?.[1]?.trim();
+    if (value && value.length > 0) return value;
+  } catch {
+  }
+  return DEFAULT_ACCOUNT_ID;
+}
+async function cloudHttpRequest(http, method, path7, body) {
+  try {
+    const res = await http.fetchImpl(`${http.consoleUrl}${path7}`, {
+      method,
+      headers: {
+        "content-type": "application/json",
+        ...http.token ? { authorization: `Bearer ${http.token}` } : {}
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { ok: res.ok, status: res.status, json };
+  } catch {
+    return { ok: false, status: 0, json: null };
+  }
+}
+function shouldUseCloudHttp(deps) {
+  return deps.db === void 0 && deps.http !== void 0 && !isPostgresConfigured();
+}
+async function upsertWorkspaceHttp(record, http) {
+  const res = await cloudHttpRequest(http, "POST", "/api/workspaces", {
+    id: record.id,
+    display_name: record.displayName,
+    ...record.githubOrg ? { github_org: record.githubOrg } : {}
+  });
+  return res.status === 201 || res.status === 409;
+}
+async function upsertVaultHttp(record, http) {
+  const res = await cloudHttpRequest(http, "POST", "/api/vaults", {
+    id: record.id,
+    workspace_id: record.workspaceId,
+    display_name: record.displayName,
+    repo_root_abs: record.repoRootAbs,
+    schema_version: record.schemaVersion,
+    ...record.githubRemote ? { github_remote: record.githubRemote } : {}
+  });
+  return res.ok;
+}
+async function isNeonReachableForWrite(deps) {
+  if (deps.neonReachable !== void 0) return deps.neonReachable;
+  const usingInjectedDb = deps.db !== void 0;
+  if (!usingInjectedDb && !isPostgresConfigured()) {
+    emitProbeFailure(deps.probe, {
+      reason: "not-configured",
+      attempt: 1,
+      attempts: 1,
+      timeoutMs: 0,
+      elapsedMs: 0,
+      willRetry: false,
+      error: new Error(
+        "isPostgresConfigured() is false \u2014 no DATABASE_URL env var and no usable ~/.heyspex/credentials.yaml. Neon was never contacted."
+      )
+    });
+    return false;
+  }
+  return runNeonReachabilityProbe(async () => {
+    const db = deps.db ?? getPostgresDb();
+    await db.execute(sql`select 1`);
+  }, deps.probe);
+}
+async function upsertWorkspaceNeon(record, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) return upsertWorkspaceHttp(record, deps.http);
+  if (!await isNeonReachableForWrite(deps)) return false;
+  try {
+    const db = deps.db ?? getPostgresDb();
+    await db.insert(workspaces).values({
+      id: record.id,
+      accountId: accountId2,
+      displayName: record.displayName,
+      ...record.githubOrg ? { githubOrg: record.githubOrg } : {}
+    }).onConflictDoUpdate({
+      target: workspaces.id,
+      set: {
+        displayName: record.displayName,
+        ...record.githubOrg ? { githubOrg: record.githubOrg } : {}
+      }
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function upsertVaultNeon(record, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) return upsertVaultHttp(record, deps.http);
+  if (!await isNeonReachableForWrite(deps)) return false;
+  try {
+    const db = deps.db ?? getPostgresDb();
+    await db.insert(vaults).values({
+      id: record.id,
+      workspaceId: record.workspaceId,
+      accountId: accountId2,
+      displayName: record.displayName,
+      repoRootAbs: record.repoRootAbs,
+      schemaVersion: record.schemaVersion,
+      ...record.githubRemote ? { githubRemote: record.githubRemote } : {}
+    }).onConflictDoUpdate({
+      target: vaults.id,
+      set: {
+        workspaceId: record.workspaceId,
+        displayName: record.displayName,
+        repoRootAbs: record.repoRootAbs,
+        schemaVersion: record.schemaVersion,
+        updatedAt: /* @__PURE__ */ new Date(),
+        ...record.githubRemote ? { githubRemote: record.githubRemote } : {}
+      }
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findVaultWorkspaceIdNeon(vaultId, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return null;
+  const db = deps.db ?? getPostgresDb();
+  try {
+    const rows = await db.select({ workspaceId: vaults.workspaceId }).from(vaults).where(eq(vaults.id, vaultId)).limit(1);
+    return rows[0]?.workspaceId ?? null;
+  } catch {
+    return null;
+  }
+}
+async function findVaultRowByIdNeon(vaultId, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return null;
+  const db = deps.db ?? getPostgresDb();
+  try {
+    const rows = await db.select({ id: vaults.id, repoRootAbs: vaults.repoRootAbs }).from(vaults).where(eq(vaults.id, vaultId)).limit(1);
+    const row = rows[0];
+    return row ? { id: row.id, repoRootAbs: row.repoRootAbs } : null;
+  } catch {
+    return null;
+  }
+}
+async function listVaultsNeon(accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return null;
+  const db = deps.db ?? getPostgresDb();
+  try {
+    const ownedRows = await db.select({
+      id: vaults.id,
+      workspaceId: vaults.workspaceId,
+      displayName: vaults.displayName,
+      repoRootAbs: vaults.repoRootAbs,
+      githubRemote: vaults.githubRemote,
+      schemaVersion: vaults.schemaVersion,
+      createdAt: vaults.createdAt
+    }).from(vaults).where(eq(vaults.accountId, accountId2));
+    const grantedRows = await db.select({
+      id: vaults.id,
+      workspaceId: vaults.workspaceId,
+      displayName: vaults.displayName,
+      repoRootAbs: vaults.repoRootAbs,
+      githubRemote: vaults.githubRemote,
+      schemaVersion: vaults.schemaVersion,
+      createdAt: vaults.createdAt
+    }).from(vaultGrants).innerJoin(vaults, eq(vaults.id, vaultGrants.vaultId)).where(and(eq(vaultGrants.accountId, accountId2), ne(vaults.accountId, accountId2)));
+    const toRecord = (r, granted) => ({
+      id: r.id,
+      workspace_id: r.workspaceId,
+      display_name: r.displayName,
+      // Registry-file rows require repo_root_abs; a cloud-only vault has none.
+      // Surface it as an empty string so the row still lists (the switch
+      // validation, not this list, decides selectability).
+      repo_root_abs: r.repoRootAbs ?? "",
+      schema_version: r.schemaVersion,
+      registered_at: (r.createdAt instanceof Date ? r.createdAt : /* @__PURE__ */ new Date()).toISOString(),
+      ...r.githubRemote ? { github_remote: r.githubRemote } : {},
+      ...granted ? { granted: true } : {}
+    });
+    return [
+      ...ownedRows.map((r) => toRecord(r, false)),
+      ...grantedRows.map((r) => toRecord(r, true))
+    ];
+  } catch {
+    return null;
+  }
+}
+async function renameVaultNeon(id, displayName, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.update(vaults).set({ displayName, updatedAt: /* @__PURE__ */ new Date() }).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).returning({ id: vaults.id });
+    return rows.length > 0 ? "updated" : "not_found";
+  } catch {
+    return "unreachable";
+  }
+}
+async function moveVaultNeon(id, workspaceId, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.update(vaults).set({ workspaceId, updatedAt: /* @__PURE__ */ new Date() }).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).returning({ id: vaults.id });
+    return rows.length > 0 ? "updated" : "not_found";
+  } catch {
+    return "unreachable";
+  }
+}
+async function setVaultArchivedNeon(id, archived, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.update(vaults).set({ archived, updatedAt: /* @__PURE__ */ new Date() }).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).returning({ id: vaults.id });
+    return rows.length > 0 ? "updated" : "not_found";
+  } catch {
+    return "unreachable";
+  }
+}
+async function deleteVaultNeon(id, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.delete(vaults).where(and(eq(vaults.id, id), eq(vaults.accountId, accountId2))).returning({ id: vaults.id });
+    return rows.length > 0 ? "deleted" : "not_found";
+  } catch {
+    return "unreachable";
+  }
+}
+var DEFAULT_ACCOUNT_ID;
+var init_vault_workspace_shared = __esm({
+  "spex-console/src/lib/cli/vault-workspace-shared.ts"() {
+    "use strict";
+    init_sql_orm_inert_cli_shim();
+    init_postgres_client_cli_shim();
+    init_interfaces();
+    init_postgres();
+    init_neon_probe();
+    init_repo_identity();
+    DEFAULT_ACCOUNT_ID = SINGLE_USER_ID;
+  }
+});
+
+// spex-console/src/lib/vault-resolve/index.ts
+import { existsSync as existsSync2 } from "node:fs";
+import path4 from "node:path";
+async function defaultRegistryLookup() {
+  return null;
+}
+async function defaultAccountPointerLookup() {
+  return null;
+}
+function finalize(vaultId, repoRootAbs, source) {
+  const resolvedRoot = path4.resolve(repoRootAbs);
+  return {
+    vaultId,
+    repoRootAbs: resolvedRoot,
+    // Always derived the same way regardless of which layer resolved the
+    // root, per this task's acceptance criteria.
+    specsDirAbs: path4.join(resolvedRoot, "specs"),
+    source
+  };
+}
+async function resolveActiveVaultRoot(options = {}) {
+  const registryLookup = options.registryLookup ?? defaultRegistryLookup;
+  const accountPointerLookup = options.accountPointerLookup ?? defaultAccountPointerLookup;
+  const registryLookupByRoot = options.registryLookupByRoot ?? (() => null);
+  const onTier = (event) => {
+    try {
+      options.onTier?.(event);
+    } catch {
+    }
+  };
+  const finalizePathTier = async (repoRootAbs, source) => {
+    const resolvedRoot = path4.resolve(repoRootAbs);
+    const recovered = await registryLookupByRoot(resolvedRoot);
+    if (recovered) return finalize(recovered.id, resolvedRoot, source);
+    return finalize(UNREGISTERED_VAULT_ID, resolvedRoot, source);
+  };
+  if (!options.vaultId) {
+    onTier({ tier: "explicit", outcome: "skipped", detail: "no explicit vaultId given" });
+  }
+  if (options.vaultId) {
+    const record = await registryLookup(options.vaultId);
+    if (record) {
+      onTier({ tier: "explicit", outcome: "resolved", detail: record.id });
+      return finalize(record.id, record.repoRootAbs, "explicit");
+    }
+    onTier({
+      tier: "explicit",
+      outcome: "no-registry-row",
+      detail: `explicit vaultId "${options.vaultId}" has no registry.json row and no Neon row`
+    });
+  }
+  const pointerVaultId = await accountPointerLookup(options.accountId);
+  if (pointerVaultId) {
+    const record = await registryLookup(pointerVaultId);
+    if (record) {
+      onTier({ tier: "account-pointer", outcome: "resolved", detail: record.id });
+      return finalize(record.id, record.repoRootAbs, "account-pointer");
+    }
+    onTier({
+      tier: "account-pointer",
+      outcome: "no-registry-row",
+      detail: `account pointer says "${pointerVaultId}" but no registry.json / Neon row backs it`
+    });
+  } else {
+    onTier({
+      tier: "account-pointer",
+      outcome: "empty",
+      detail: `no active_vault_id for account "${options.accountId ?? "(default)"}" (Neon account_settings unreachable/unset, and registry.json had none)`
+    });
+  }
+  const envRoot = process.env.HEYSPEX_VAULT_ROOT;
+  if (envRoot) {
+    onTier({ tier: "env-vault-root", outcome: "resolved", detail: envRoot });
+    return finalizePathTier(path4.resolve(envRoot), "env-vault-root");
+  }
+  onTier({ tier: "env-vault-root", outcome: "skipped", detail: "HEYSPEX_VAULT_ROOT unset" });
+  const envDir = process.env.HEYSPEX_VAULT_DIR;
+  if (envDir) {
+    const specsDirFromEnv = path4.resolve(envDir);
+    onTier({ tier: "env-vault-dir", outcome: "resolved", detail: envDir });
+    return finalizePathTier(path4.dirname(specsDirFromEnv), "env-vault-dir");
+  }
+  onTier({ tier: "env-vault-dir", outcome: "skipped", detail: "HEYSPEX_VAULT_DIR unset" });
+  const cwdAbs = path4.resolve(options.cwd ?? process.cwd());
+  if (existsSync2(path4.join(cwdAbs, "specs"))) {
+    onTier({ tier: "cwd-heuristic", outcome: "resolved", detail: cwdAbs });
+    return finalizePathTier(cwdAbs, "cwd-heuristic");
+  }
+  const parentAbs = path4.resolve(cwdAbs, "..");
+  if (existsSync2(path4.join(parentAbs, "specs"))) {
+    onTier({ tier: "cwd-heuristic", outcome: "resolved", detail: parentAbs });
+    return finalizePathTier(parentAbs, "cwd-heuristic");
+  }
+  onTier({
+    tier: "cwd-heuristic",
+    outcome: "empty",
+    detail: `no specs/ directory at ${cwdAbs} or ${parentAbs}`
+  });
+  throw new NoActiveVaultError();
+}
+var UNREGISTERED_VAULT_ID, NoActiveVaultError;
+var init_vault_resolve = __esm({
+  "spex-console/src/lib/vault-resolve/index.ts"() {
+    "use strict";
+    UNREGISTERED_VAULT_ID = "unregistered";
+    NoActiveVaultError = class _NoActiveVaultError extends Error {
+      constructor(message = "resolveActiveVaultRoot: no active vault found -- no explicit vaultId, no account active_vault_id, no HEYSPEX_VAULT_ROOT/HEYSPEX_VAULT_DIR env, and no specs/ directory found at cwd or its parent. Run `hs vault register` to register a vault.") {
+        super(message);
+        this.name = "NoActiveVaultError";
+        Object.setPrototypeOf(this, _NoActiveVaultError.prototype);
+      }
+    };
+  }
+});
+
+// spex-console/src/lib/vault-resolve/resolve-status.ts
+function emptyStatus() {
+  return {
+    state: "never-attempted",
+    context: null,
+    attempts: 0,
+    resolvedVaultId: null,
+    resolvedSource: null,
+    lastError: null,
+    tierTrace: [],
+    probeFailures: [],
+    startedAt: null,
+    updatedAt: null
+  };
+}
+function getVaultResolveStatus() {
+  return carrier.status;
+}
+function markVaultResolveStarted(context, attempt) {
+  const status = carrier.status;
+  status.state = "in-progress";
+  status.context = context;
+  status.attempts = attempt;
+  status.updatedAt = Date.now();
+  if (attempt <= 1) {
+    status.startedAt = Date.now();
+    status.tierTrace = [];
+    status.probeFailures = [];
+    status.lastError = null;
+  }
+}
+function recordVaultResolveTier(event) {
+  if (carrier.status.tierTrace.length >= 64) return;
+  carrier.status.tierTrace.push(event);
+}
+function recordNeonProbeFailure(failure) {
+  if (carrier.status.probeFailures.length >= 32) return;
+  carrier.status.probeFailures.push(failure);
+}
+function markVaultResolveSucceeded(resolved) {
+  const status = carrier.status;
+  status.state = "resolved";
+  status.resolvedVaultId = resolved.vaultId;
+  status.resolvedSource = resolved.source;
+  status.lastError = null;
+  status.updatedAt = Date.now();
+}
+function markVaultResolveFailed(err) {
+  const status = carrier.status;
+  status.state = "failed";
+  status.resolvedVaultId = null;
+  status.resolvedSource = null;
+  status.lastError = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
+  status.updatedAt = Date.now();
+}
+function formatProbeFailure(f) {
+  return `attempt ${f.attempt}/${f.attempts} ${f.reason} after ${f.elapsedMs}ms (budget ${f.timeoutMs}ms, willRetry=${f.willRetry}): ${f.message}`;
+}
+function formatVaultResolveEvidence(status = carrier.status) {
+  const lines = [];
+  lines.push(
+    `  state=${status.state} context=${status.context ?? "n/a"} attempts=${status.attempts}` + (status.startedAt && status.updatedAt ? ` elapsed=${status.updatedAt - status.startedAt}ms` : "")
+  );
+  if (status.lastError) lines.push(`  error: ${status.lastError}`);
+  if (status.tierTrace.length > 0) {
+    lines.push("  precedence tiers tried:");
+    for (const t of status.tierTrace) {
+      lines.push(`    - ${t.tier}: ${t.outcome}${t.detail ? ` (${t.detail})` : ""}`);
+    }
+  } else {
+    lines.push("  precedence tiers tried: (none recorded \u2014 no resolve ran in this process)");
+  }
+  if (status.probeFailures.length > 0) {
+    lines.push("  Neon reachability probe failures:");
+    for (const f of status.probeFailures) lines.push(`    - ${formatProbeFailure(f)}`);
+  }
+  return lines.join("\n");
+}
+function reportVaultResolveFailure(context, err) {
+  const header = context === "boot" ? `[vault-resolve] BOOT VAULT RESOLVE FAILED \u2014 ${CONSEQUENCE}` : `[vault-resolve] VAULT RESOLVE FAILED (context=${context}).`;
+  const detail = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
+  console.error(`${header}
+  thrown: ${detail}
+${formatVaultResolveEvidence()}
+${FIX_HINT}`);
+}
+function reportVaultResolveSuccess(context, resolved) {
+  const status = carrier.status;
+  console.log(
+    `[vault-resolve] ${context} resolved vault "${resolved.vaultId}" via ${resolved.source} (root=${resolved.repoRootAbs}, attempts=${status.attempts})`
+  );
+}
+function reportColdVaultScopeOnce() {
+  if (carrier.coldScopeReported) return;
+  carrier.coldScopeReported = true;
+  if (process.env.VITEST) return;
+  const status = carrier.status;
+  const cause = status.state === "failed" ? "the boot resolve was ATTEMPTED AND FAILED" : status.state === "in-progress" ? "the boot resolve is STILL RUNNING (this request beat it)" : status.state === "resolved" ? "a resolve SUCCEEDED but the sync cache was cleared afterwards" : "NO resolve has run in this process yet (deferred boot has not fired)";
+  console.error(
+    `[vault-resolve] COLD VAULT SCOPE \u2014 a read fell back to vault_id="default" because ${cause}. ${CONSEQUENCE}
+${formatVaultResolveEvidence()}
+${FIX_HINT}`
+  );
+}
+var STATUS_KEY, carrier, CONSEQUENCE, FIX_HINT;
+var init_resolve_status = __esm({
+  "spex-console/src/lib/vault-resolve/resolve-status.ts"() {
+    "use strict";
+    STATUS_KEY = Symbol.for("heyspex.vaultResolveStatus");
+    carrier = (() => {
+      const g = globalThis;
+      if (!g[STATUS_KEY]) g[STATUS_KEY] = { status: emptyStatus(), coldScopeReported: false };
+      return g[STATUS_KEY];
+    })();
+    CONSEQUENCE = 'Reads on this process serve vault_id="default" \u2014 an EMPTY bucket \u2014 so process-scoped reads 404/serve empty until a resolve lands. Cold reads kick a background self-heal resolve (gap-limited), so this heals in-place instead of waiting for the instance to be replaced.';
+    FIX_HINT = "  Fix: confirm DATABASE_URL is set for this deployment and that Neon account_settings.active_vault_id is populated for the account above. If the probe failures show connect timeouts, the Neon compute is waking from scale-to-zero \u2014 raise HEYSPEX_NEON_BOOT_PROBE_TIMEOUT_MS / HEYSPEX_NEON_BOOT_PROBE_DEADLINE_MS.";
+  }
+});
+
+// spex-console/src/lib/vault-resolve/active.ts
+import { existsSync as existsSync3 } from "node:fs";
+import path5 from "node:path";
+async function defaultNeonReadTierEnabled() {
+  const { isNeonReadTierEnabled: isNeonReadTierEnabled2 } = await Promise.resolve().then(() => (init_spec_read_service(), spec_read_service_exports));
+  return isNeonReadTierEnabled2();
+}
+async function defaultNeonVaultLookup(vaultId, deps) {
+  if (deps.neonReachable === false) return null;
+  return findVaultRowByIdNeon(vaultId, deps);
+}
+function instrumentedProbeOptions(options) {
+  const inner = options.neonProbe;
+  return {
+    ...inner,
+    onFailure: (failure) => {
+      recordNeonProbeFailure({
+        reason: failure.reason,
+        attempt: failure.attempt,
+        attempts: failure.attempts,
+        timeoutMs: failure.timeoutMs,
+        elapsedMs: failure.elapsedMs,
+        willRetry: failure.willRetry,
+        message: failure.error instanceof Error ? failure.error.message : String(failure.error)
+      });
+      inner?.onFailure?.(failure);
+    }
+  };
+}
+function buildRegistryLookup(options) {
+  const { registryOpts, neonReachable } = options;
+  const neonVaultLookup = options.neonVaultLookup ?? defaultNeonVaultLookup;
+  const neonReadTierEnabled = options.neonReadTierEnabled ?? defaultNeonReadTierEnabled;
+  const probe = instrumentedProbeOptions(options);
+  return async (vaultId) => {
+    const registry = loadVaultRegistry(registryOpts);
+    const record = registry.vaults.find((v) => v.id === vaultId);
+    if (record) return { id: record.id, repoRootAbs: record.repo_root_abs };
+    const neonRow = await neonVaultLookup(vaultId, { neonReachable, probe });
+    if (!neonRow) return null;
+    if (neonRow.repoRootAbs && existsSync3(neonRow.repoRootAbs)) {
+      return { id: neonRow.id, repoRootAbs: neonRow.repoRootAbs };
+    }
+    if (await neonReadTierEnabled()) {
+      return { id: neonRow.id, repoRootAbs: fallbackRepoRoot() };
+    }
+    return neonRow.repoRootAbs ? { id: neonRow.id, repoRootAbs: neonRow.repoRootAbs } : null;
+  };
+}
+function buildRegistryLookupByRoot(registryOpts) {
+  return (repoRootAbs) => {
+    const registry = loadVaultRegistry(registryOpts);
+    const record = registry.vaults.find((v) => repoRootsEquivalent(v.repo_root_abs, repoRootAbs));
+    return record ? { id: record.id, repoRootAbs: record.repo_root_abs } : null;
+  };
+}
+function buildAccountPointerLookup(accountId2, options) {
+  const { registryOpts, neonReachable } = options;
+  const probe = instrumentedProbeOptions(options);
+  return (accId) => getActiveVault(accId ?? accountId2, { registryOpts, neonReachable, probe });
+}
+async function ensureActiveVaultResolved(options = {}) {
+  if (cacheStore.value && !options.force) return cacheStore.value;
+  const accountId2 = options.accountId ?? SINGLE_USER_ID;
+  markVaultResolveStarted(options.context ?? "unknown", options.attempt ?? 1);
+  let resolved;
+  try {
+    resolved = await resolveActiveVaultRoot({
+      vaultId: options.vaultId,
+      accountId: accountId2,
+      cwd: options.cwd,
+      registryLookup: buildRegistryLookup(options),
+      accountPointerLookup: buildAccountPointerLookup(accountId2, options),
+      registryLookupByRoot: buildRegistryLookupByRoot(options.registryOpts),
+      onTier: recordVaultResolveTier
+    });
+  } catch (err) {
+    markVaultResolveFailed(err);
+    throw err;
+  }
+  if (resolved.vaultId === UNREGISTERED_VAULT_ID) {
+    console.error(
+      `[vault-resolve] ACTIVE VAULT IS UNREGISTERED \u2014 resolved ${resolved.repoRootAbs} via ${resolved.source} with no matching registry row. Specs will be indexed under the "unregistered" sentinel and INVISIBLE to registered-vault reads. Fix: \`hs vault register\` this repo (or reconcile the vault id across ~/.heyspex/registry.json and Neon \`vaults\` \u2014 one repo, one id).`
+    );
+  }
+  markVaultResolveSucceeded(resolved);
+  cacheStore.value = resolved;
+  return resolved;
+}
+function fallbackSpecsDir() {
+  const override = process.env.HEYSPEX_VAULT_DIR;
+  if (override) return path5.resolve(override);
+  return path5.resolve(process.cwd(), "..", "specs");
+}
+function fallbackRepoRoot() {
+  return path5.resolve(fallbackSpecsDir(), "..");
+}
+function getActiveVaultId() {
+  return cacheStore.value ? cacheStore.value.vaultId : null;
+}
+var ACTIVE_VAULT_CACHE_KEY, cacheStore;
+var init_active = __esm({
+  "spex-console/src/lib/vault-resolve/active.ts"() {
+    "use strict";
+    init_vault_workspace_shared();
+    init_interfaces();
+    init_account_pointer();
+    init_registry_file();
+    init_repo_identity();
+    init_vault_resolve();
+    init_resolve_status();
+    ACTIVE_VAULT_CACHE_KEY = Symbol.for("heyspex.activeVaultCache");
+    cacheStore = (() => {
+      const carrier2 = globalThis;
+      if (!carrier2[ACTIVE_VAULT_CACHE_KEY]) carrier2[ACTIVE_VAULT_CACHE_KEY] = { value: null };
+      return carrier2[ACTIVE_VAULT_CACHE_KEY];
+    })();
+  }
+});
+
+// spex-console/src/lib/vault-resolve/rebind.ts
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function resolveWithBootRetry(options, context) {
+  const { vaultId, boot = false } = options;
+  if (!boot) {
+    return ensureActiveVaultResolved({ force: true, vaultId, context });
+  }
+  const backoffMs = options.bootRetryBackoffMs ?? BOOT_RESOLVE_BACKOFF_MS;
+  const attempts = vaultId ? 1 : backoffMs.length + 1;
+  const startedAt = Date.now();
+  let lastErr;
+  for (let i = 0; i < attempts; i++) {
+    try {
+      return await ensureActiveVaultResolved({
+        vaultId,
+        context,
+        attempt: i + 1,
+        neonProbe: bootNeonProbeOptions()
+      });
+    } catch (err) {
+      lastErr = err;
+      const isLast = i === attempts - 1;
+      if (isLast || Date.now() - startedAt >= BOOT_RESOLVE_DEADLINE_MS) break;
+      console.warn(
+        `[rebindActiveVault] boot vault resolve attempt ${i + 1}/${attempts} failed (${err instanceof Error ? err.message : String(err)}) \u2014 retrying in ${backoffMs[i]}ms`
+      );
+      await sleep2(backoffMs[i]);
+    }
+  }
+  throw lastErr;
+}
+function startBootVaultResolve(options = {}) {
+  const run = async () => {
+    try {
+      const resolved = await resolveWithBootRetry({ ...options, boot: true }, "boot");
+      reportVaultResolveSuccess("boot", resolved);
+      return { resolved, error: null };
+    } catch (err) {
+      reportVaultResolveFailure("boot", err);
+      return { resolved: null, error: err };
+    }
+  };
+  if (options.vaultId) return run();
+  if (bootResolveCarrier.inflight) return bootResolveCarrier.inflight;
+  const inflight = run().finally(() => {
+    if (bootResolveCarrier.inflight === inflight) bootResolveCarrier.inflight = null;
+  });
+  bootResolveCarrier.inflight = inflight;
+  return inflight;
+}
+function kickVaultResolveSelfHeal() {
+  if (process.env.VITEST) return;
+  if (process.env.NEXT_RUNTIME !== "nodejs") return;
+  if (bootResolveCarrier.inflight) return;
+  if (getVaultResolveStatus().state === "in-progress") return;
+  const now = Date.now();
+  if (now < bootResolveCarrier.nextSelfHealAt) return;
+  bootResolveCarrier.nextSelfHealAt = now + SELF_HEAL_RETRY_GAP_MS;
+  void startBootVaultResolve();
+}
+var BOOT_RESOLVE_BACKOFF_MS, BOOT_RESOLVE_DEADLINE_MS, BOOT_RESOLVE_KEY, bootResolveCarrier, SELF_HEAL_RETRY_GAP_MS;
+var init_rebind = __esm({
+  "spex-console/src/lib/vault-resolve/rebind.ts"() {
+    "use strict";
+    init_neon_probe();
+    init_active();
+    init_resolve_status();
+    BOOT_RESOLVE_BACKOFF_MS = [1e3, 4e3];
+    BOOT_RESOLVE_DEADLINE_MS = 45e3;
+    BOOT_RESOLVE_KEY = Symbol.for("heyspex.bootVaultResolve");
+    bootResolveCarrier = (() => {
+      const g = globalThis;
+      if (!g[BOOT_RESOLVE_KEY]) g[BOOT_RESOLVE_KEY] = { inflight: null, nextSelfHealAt: 0 };
+      return g[BOOT_RESOLVE_KEY];
+    })();
+    SELF_HEAL_RETRY_GAP_MS = 3e4;
+  }
+});
+
+// spex-console/src/lib/vault-resolve/scope.ts
+function resolveVaultScopeId() {
+  const active = getActiveVaultId();
+  if (active !== null) return active;
+  kickVaultResolveSelfHeal();
+  reportColdVaultScopeOnce();
+  return DEFAULT_VAULT_ID;
+}
+var init_scope = __esm({
+  "spex-console/src/lib/vault-resolve/scope.ts"() {
+    "use strict";
+    init_interfaces();
+    init_active();
+    init_rebind();
+    init_resolve_status();
+  }
+});
+
+// spex-console/src/lib/scheduler/types.ts
+var init_types2 = __esm({
+  "spex-console/src/lib/scheduler/types.ts"() {
+    "use strict";
+  }
+});
+
+// spex-console/src/lib/scheduler/comparators.ts
+var init_comparators = __esm({
+  "spex-console/src/lib/scheduler/comparators.ts"() {
+    "use strict";
+    init_types2();
+  }
+});
+
+// spex-console/src/lib/vault-id.ts
+var init_vault_id = __esm({
+  "spex-console/src/lib/vault-id.ts"() {
+    "use strict";
+  }
+});
+
+// spex-console/src/lib/scheduler/toposort.ts
+var init_toposort = __esm({
+  "spex-console/src/lib/scheduler/toposort.ts"() {
+    "use strict";
+    init_vault_id();
+  }
+});
+
+// spex-console/src/lib/scheduler/criticality.ts
+var init_criticality = __esm({
+  "spex-console/src/lib/scheduler/criticality.ts"() {
+    "use strict";
+    init_toposort();
+  }
+});
+
+// spex-console/src/lib/scheduler/explanation.ts
+var init_explanation = __esm({
+  "spex-console/src/lib/scheduler/explanation.ts"() {
+    "use strict";
+    init_comparators();
+    init_types2();
+  }
+});
+
+// spex-console/src/lib/scheduler/pipeline.ts
+var init_pipeline = __esm({
+  "spex-console/src/lib/scheduler/pipeline.ts"() {
+    "use strict";
+    init_comparators();
+    init_criticality();
+    init_explanation();
+    init_toposort();
+    init_types2();
+  }
+});
+
+// spex-console/src/lib/scheduler/index.ts
+var init_scheduler = __esm({
+  "spex-console/src/lib/scheduler/index.ts"() {
+    "use strict";
+    init_comparators();
+    init_criticality();
+    init_explanation();
+    init_pipeline();
+    init_toposort();
+    init_types2();
+  }
+});
+
+// spex-console/src/lib/db/repositories/helpers.ts
+function buildFrontmatter(row, tags2, aliases2, extraFields) {
+  const fm = {
+    id: row.id,
+    name: row.name,
+    type: row.type,
+    status: row.status,
+    ...row.owner ? { owner: row.owner } : {},
+    created: row.created,
+    updated: row.updated,
+    ...tags2.length > 0 ? { tags: tags2 } : {},
+    ...aliases2.length > 0 ? { aliases: aliases2 } : {}
+  };
+  for (const [field, value] of Object.entries(extraFields)) {
+    if (fm[field] !== void 0) continue;
+    fm[field] = value;
+  }
+  return fm;
+}
+var init_helpers = __esm({
+  "spex-console/src/lib/db/repositories/helpers.ts"() {
+    "use strict";
+    init_scheduler();
+  }
+});
+
+// spex-console/src/lib/db/repositories/spec-read-service.ts
+var spec_read_service_exports = {};
+__export(spec_read_service_exports, {
+  fetchAllSpecBundlesFromNeon: () => fetchAllSpecBundlesFromNeon,
+  frontmatterFromNeonBundle: () => frontmatterFromNeonBundle,
+  isNeonReadTierEnabled: () => isNeonReadTierEnabled,
+  resolveReadTier: () => resolveReadTier
+});
+function resolveReadTier() {
+  const raw = process.env.HEYSPEX_READ_TIER?.trim().toLowerCase();
+  return raw === "neon" ? "neon" : "disk";
+}
+function isNeonReadTierEnabled() {
+  return resolveReadTier() === "neon" && isPostgresUsable();
+}
+async function fmTagsForMany(db, specIds, vaultScopeId) {
+  const out = /* @__PURE__ */ new Map();
+  if (specIds.length === 0) return out;
+  const rows = await db.select({ specId: tags.specId, tag: tags.tag }).from(tags).where(
+    and(
+      eq(tags.vaultId, vaultScopeId),
+      inArray(tags.specId, specIds),
+      eq(tags.inFrontmatter, true)
+    )
+  );
+  for (const r of rows) {
+    const bucket = out.get(r.specId);
+    if (bucket) bucket.push(r.tag);
+    else out.set(r.specId, [r.tag]);
+  }
+  return out;
+}
+async function aliasesForMany(db, specIds, vaultScopeId) {
+  const out = /* @__PURE__ */ new Map();
+  if (specIds.length === 0) return out;
+  const rows = await db.select({ specId: aliases.specId, alias: aliases.alias }).from(aliases).where(
+    and(eq(aliases.vaultId, vaultScopeId), inArray(aliases.specId, specIds))
+  );
+  for (const r of rows) {
+    const bucket = out.get(r.specId);
+    if (bucket) bucket.push(r.alias);
+    else out.set(r.specId, [r.alias]);
+  }
+  return out;
+}
+async function extrasForMany(db, specIds, vaultScopeId) {
+  const out = /* @__PURE__ */ new Map();
+  if (specIds.length === 0) return out;
+  const rows = await db.select({
+    specId: frontmatterFields.specId,
+    field: frontmatterFields.field,
+    value: frontmatterFields.value
+  }).from(frontmatterFields).where(
+    and(
+      eq(frontmatterFields.vaultId, vaultScopeId),
+      inArray(frontmatterFields.specId, specIds)
+    )
+  );
+  for (const r of rows) {
+    let bucket = out.get(r.specId);
+    if (!bucket) {
+      bucket = {};
+      out.set(r.specId, bucket);
+    }
+    bucket[r.field] = r.value;
+  }
+  return out;
+}
+async function fetchAllSpecBundlesFromNeon(db = getPostgresDb(), vaultScopeId = resolveVaultScopeId()) {
+  const rows = await db.select({
+    id: specs.id,
+    name: specs.name,
+    type: specs.type,
+    status: specs.status,
+    priority: specs.priority,
+    owner: specs.owner,
+    created: specs.created,
+    updated: specs.updated,
+    relPath: specs.relPath,
+    bodyText: specs.bodyText
+  }).from(specs).where(and(eq(specs.vaultId, vaultScopeId), isNull(specs.deletedAt)));
+  if (rows.length === 0) return [];
+  const ids = rows.map((r) => r.id);
+  const [tagsMap, aliasesMap, extrasMap] = await Promise.all([
+    fmTagsForMany(db, ids, vaultScopeId),
+    aliasesForMany(db, ids, vaultScopeId),
+    extrasForMany(db, ids, vaultScopeId)
+  ]);
+  return rows.map((row) => ({
+    row,
+    tags: tagsMap.get(row.id) ?? [],
+    aliases: aliasesMap.get(row.id) ?? [],
+    extras: extrasMap.get(row.id) ?? {},
+    bodyText: row.bodyText ?? ""
+  }));
+}
+function frontmatterFromNeonBundle(bundle) {
+  return buildFrontmatter(bundle.row, bundle.tags, bundle.aliases, bundle.extras);
+}
+var init_spec_read_service = __esm({
+  "spex-console/src/lib/db/repositories/spec-read-service.ts"() {
+    "use strict";
+    init_sql_orm_inert_cli_shim();
+    init_scope();
+    init_postgres_client_cli_shim();
+    init_postgres();
+    init_helpers();
+  }
+});
+
+// spex-console/bin/hs-vault.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "node:fs";
+import path6 from "node:path";
+import process2 from "node:process";
+import { createInterface } from "node:readline/promises";
+
+// spex-console/src/lib/cli/control-shared.ts
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var EXIT = {
+  /** Success. */
+  OK: 0,
+  /** Usage error — unknown subcommand/flag, or a missing required argument. */
+  USAGE: 1,
+  /** Claim race lost — the spec is already claimed by another agent (409). */
+  CONFLICT: 9,
+  /** Target not found — release of an unheld claim, etc. (404). */
+  NOT_FOUND: 10,
+  /** Invalid argument — bad `--ttl`, unknown `--kind`, unparseable date. */
+  INVALID_ARG: 11,
+  /** SpexConsole unreachable (network error reaching the dev server). */
+  CONSOLE_UNREACHABLE: 12,
+  /** Server failure — a non-OK response that isn't 400/402/404/409. */
+  WRITE_FAILED: 13,
+  /** Neon control plane absent — the endpoint returned 402 (upgrade required). */
+  NEON_REQUIRED: 14,
+  /**
+   * A cross-account `--account <id>` override was refused — the caller is
+   * not a builder/admin (`resolveScopedAccountId`'s `forbidden_account_override`,
+   * [[HS-X3GB-EKLJ-TASK-hs-cli-account-flag-for-cross-account]]). Distinct
+   * from `USAGE`/`INVALID_ARG` — this is an authorization refusal, not a
+   * malformed command.
+   */
+  FORBIDDEN: 15
+};
+function readPairedToken() {
+  try {
+    const raw = readFileSync(join(homedir(), ".heyspex", "credentials.yaml"), "utf-8");
+    const match = raw.match(/\b(hsmcp_[A-Za-z0-9_-]+|hscmp_[A-Za-z0-9_-]+)\b/);
+    return match?.[1];
+  } catch {
+    return void 0;
+  }
+}
+
+// spex-console/src/lib/cli/defer.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// scripts/lib/console-url-resolver.mjs
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+var DEFAULT_CONSOLE_URL = "https://app.heyspex.com";
+function trimTrailingSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+function readCredentialsConsoleUrl({ homeDir = homedir2() } = {}) {
+  try {
+    const raw = readFileSync2(join2(homeDir, ".heyspex", "credentials.yaml"), "utf8");
+    const match = raw.match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
+    const value = match?.[1]?.trim();
+    return value && value.length > 0 ? trimTrailingSlash(value) : null;
+  } catch {
+    return null;
+  }
+}
+function readDiscoveryFileConsoleUrl(repoRoot) {
+  if (!repoRoot) return null;
+  for (const name of [
+    "console-url",
+    "cockpit-url"
+    /* legacy-cockpit */
+  ]) {
+    try {
+      const discovery = readFileSync2(join2(repoRoot, ".heyspex", name), "utf8").trim();
+      if (discovery.length > 0) return trimTrailingSlash(discovery);
+    } catch {
+    }
+  }
+  return null;
+}
+var ConsoleUrlUnresolvedError = class extends Error {
+  constructor() {
+    super(
+      `resolveConsoleUrl: no HEYSPEX_CONSOLE_URL/HEYSPEX_COCKPIT_URL env, no console_url: in ~/.heyspex/credentials.yaml, and no .heyspex/console-url discovery file \u2014 refusing to silently fall back to the ${DEFAULT_CONSOLE_URL} default in strict mode.`
+    );
+    this.name = "ConsoleUrlUnresolvedError";
+  }
+};
+function resolveConsoleUrl({
+  repoRoot,
+  env = process.env,
+  homeDir = homedir2(),
+  strict = false
+} = {}) {
+  const envUrl = (env.HEYSPEX_CONSOLE_URL ?? env.HEYSPEX_COCKPIT_URL)?.trim();
+  if (envUrl) return trimTrailingSlash(envUrl);
+  const credentialsUrl = readCredentialsConsoleUrl({ homeDir });
+  if (credentialsUrl) return credentialsUrl;
+  const discoveryUrl = readDiscoveryFileConsoleUrl(repoRoot);
+  if (discoveryUrl) return discoveryUrl;
+  if (strict) throw new ConsoleUrlUnresolvedError();
+  return DEFAULT_CONSOLE_URL;
+}
+
+// spex-console/src/lib/cli/defer.ts
+function resolveSpexConsoleUrl(vaultRoot, readDiscovery, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = (env.HEYSPEX_CONSOLE_URL ?? env.HEYSPEX_COCKPIT_URL)?.trim();
+  if (raw && raw.length > 0) return raw.replace(/\/+$/, "");
+  try {
+    const homeDir = opts.homeDir ?? os.homedir();
+    const readFile2 = opts.readFile ?? ((p) => readFileSync3(p, "utf-8"));
+    const credentials = readFile2(path.join(homeDir, ".heyspex", "credentials.yaml"));
+    const match = credentials.match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
+    const value = match?.[1]?.trim();
+    if (value && value.length > 0) return value.replace(/\/+$/, "");
+  } catch {
+  }
+  for (const name of ["console-url", "cockpit-url"]) {
+    try {
+      const discovery = readDiscovery(`${vaultRoot}/.heyspex/${name}`);
+      if (discovery && discovery.trim().length > 0) {
+        return discovery.trim().replace(/\/+$/, "");
+      }
+    } catch {
+    }
+  }
+  return DEFAULT_CONSOLE_URL;
+}
+var HELP = [
+  "Usage:",
+  "  hs defer <spec-id> [--until <when>] [--json] [--no-daemon]",
+  "  hs undefer <spec-id> [--json] [--no-daemon]",
+  "",
+  "Time-shift a spec via its `defer_until` frontmatter field. A deferred spec is",
+  "scheduler-invisible until the date passes, then auto-revives.",
+  "",
+  "Arguments:",
+  "  <spec-id>        The spec to defer/undefer (e.g. HS-TASK-EWL5).",
+  "",
+  "Flags:",
+  "  --until <when>   ISO date, or relative offset +Nd / +Nw / +Nm / +Ny.",
+  "                   Defaults to +1y (matches the console Defer button).",
+  "                   Ignored by `undefer` (which always clears the field).",
+  "  --json           Emit a machine-readable JSON result.",
+  "  --no-daemon      Write straight to the vault (no console needed; CI path).",
+  "  --help, -h       Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 10 not-found \xB7 11 bad-arg \xB7 12 console-unreachable \xB7 13 write-failed"
+].join("\n");
+
+// spex-console/src/lib/cli/vault.ts
+init_account_pointer();
+
+// dist/cli/._admin-scope-inert.cli-shim.mjs
+async function resolveScopedAccountId(callerAccountId, requestedAccountId) {
+  const target = requestedAccountId == null ? "" : String(requestedAccountId).trim();
+  if (!target || target === callerAccountId) {
+    return { ok: true, accountId: callerAccountId };
+  }
+  return {
+    ok: false,
+    code: "forbidden_account_override",
+    message: "Only a builder/admin may act on another account's workspaces or vaults."
+  };
+}
+
+// spex-console/src/lib/vault-registry/archive.ts
+init_vault_workspace_shared();
+
+// spex-console/src/lib/vault-registry/active-repoint.ts
+init_account_pointer();
+init_registry_file();
+function pointerDeps(deps) {
+  return deps.accountPointer ?? { registryOpts: deps.registryOpts };
+}
+async function repointActiveVaultOnRemoval(accountId2, removedVaultId, removedVaultWorkspaceId, deps = {}) {
+  const pDeps = pointerDeps(deps);
+  const activeId = await getActiveVault(accountId2, pDeps);
+  if (activeId !== removedVaultId) {
+    return { repointed: false, newActiveId: activeId };
+  }
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const candidate = registry.vaults.find(
+    (v) => v.id !== removedVaultId && v.workspace_id === removedVaultWorkspaceId && !v.archived
+  );
+  if (!candidate) {
+    await clearActiveVault(accountId2, pDeps);
+    return { repointed: true, newActiveId: null };
+  }
+  await setActiveVault(accountId2, candidate.id, pDeps);
+  return { repointed: true, newActiveId: candidate.id };
+}
+
+// spex-console/src/lib/vault-registry/archive.ts
+init_registry_file();
+function vaultNotFound(id) {
+  return { ok: false, code: "vault_not_found", message: `vault "${id}" not found` };
+}
+async function setVaultArchivedState(input, archived, deps = {}) {
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.vaults.find((v) => v.id === input.id);
+  if (!existing) return vaultNotFound(input.id);
+  const neonResult = await setVaultArchivedNeon(
+    input.id,
+    archived,
+    input.accountId,
+    deps.neon ?? {}
+  );
+  if (neonResult === "not_found") return vaultNotFound(input.id);
+  if (archived) {
+    await repointActiveVaultOnRemoval(input.accountId, input.id, existing.workspace_id, {
+      registryOpts: deps.registryOpts,
+      accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
+    });
+  }
+  registerVault({ ...existing, archived }, deps.registryOpts);
+  return {
+    ok: true,
+    vault: {
+      id: input.id,
+      archived,
+      neon_written: neonResult === "updated",
+      registry_written: true
+    }
+  };
+}
+async function archiveVault(input, deps = {}) {
+  return setVaultArchivedState(input, true, deps);
+}
+async function restoreVault(input, deps = {}) {
+  return setVaultArchivedState(input, false, deps);
+}
+
+// spex-console/src/lib/vault-registry/close-not-destroy.ts
+var CLOSE_NOT_DESTROY_STATEMENT = "This only removes it from HeySpex. The repo files on disk are not deleted.";
+var KIND_LABEL = {
+  workspace: "workspace",
+  vault: "vault"
+};
+function buildCloseNotDestroyConfirm(kind, verb, displayName) {
+  const kindLabel = KIND_LABEL[kind];
+  const name = displayName.trim() || kindLabel;
+  if (verb === "archive") {
+    return {
+      title: `Archive "${name}"?`,
+      message: `Archiving hides the ${kindLabel} from your active list. ${CLOSE_NOT_DESTROY_STATEMENT} You can restore it any time.`,
+      confirmLabel: "Archive",
+      cancelLabel: "Cancel",
+      removesRegistryRow: false
+    };
+  }
+  return {
+    title: `Remove "${name}" from HeySpex?`,
+    message: `${CLOSE_NOT_DESTROY_STATEMENT} It will need to be re-registered to appear here again.`,
+    confirmLabel: "Remove from HeySpex",
+    cancelLabel: "Cancel",
+    removesRegistryRow: true
+  };
+}
+
+// spex-console/src/lib/vault-registry/list.ts
+init_vault_workspace_shared();
+init_account_pointer();
+init_registry_file();
+import { existsSync as existsSync4 } from "node:fs";
+async function defaultNeonReadTierEnabled2() {
+  const { isNeonReadTierEnabled: isNeonReadTierEnabled2 } = await Promise.resolve().then(() => (init_spec_read_service(), spec_read_service_exports));
+  return isNeonReadTierEnabled2();
+}
+function pointerDeps2(deps) {
+  return deps.accountPointer ?? { registryOpts: deps.registryOpts };
+}
+function localVaultRows(deps) {
+  return loadVaultRegistry(deps.registryOpts).vaults;
+}
+async function listVaultsForWorkspace(accountId2, workspaceId, deps = {}) {
+  const pDeps = pointerDeps2(deps);
+  const neonRows = await (deps.neonListVaults ?? listVaultsNeon)(accountId2, {
+    db: pDeps.db,
+    neonReachable: pDeps.neonReachable
+  });
+  const allRows = neonRows ?? (deps.allowLocalRegistryFallback ? localVaultRows(deps) : []);
+  const activeId = await getActiveVault(accountId2, pDeps);
+  const rows = deps.includeArchived ? allRows : allRows.filter((v) => !v.archived);
+  const scoped = workspaceId ? rows.filter((v) => v.workspace_id === workspaceId) : rows;
+  const pathExists = deps.pathExists ?? existsSync4;
+  const anyPathUnusable = scoped.some((v) => !v.repo_root_abs || !pathExists(v.repo_root_abs));
+  const neonBackedServeable = anyPathUnusable && neonRows !== null ? await (deps.neonReadTierEnabled ?? defaultNeonReadTierEnabled2)() : false;
+  return {
+    vaults: scoped.map((v) => ({
+      ...v,
+      active: v.id === activeId,
+      ...serveability(v, pathExists, neonBackedServeable)
+    })),
+    active_vault_id: activeId,
+    workspace_id: workspaceId ?? null
+  };
+}
+function serveability(v, pathExists, neonBackedServeable) {
+  if (neonBackedServeable) return { serveable: true };
+  if (!v.repo_root_abs) {
+    return {
+      serveable: false,
+      unserveable_reason: "No local path registered on this machine."
+    };
+  }
+  if (!pathExists(v.repo_root_abs)) {
+    return {
+      serveable: false,
+      unserveable_reason: `Local path not found on this machine: ${v.repo_root_abs}`
+    };
+  }
+  return { serveable: true };
+}
+
+// spex-console/src/lib/cli/vault.ts
+init_registry_file();
+
+// spex-console/src/lib/vault-registry/vault-manage.ts
+init_vault_workspace_shared();
+init_registry_file();
+var MAX_DISPLAY_NAME_LEN = 60;
+function isValidId2(id) {
+  if (typeof id !== "string" || id.trim() === "") return false;
+  if (id.includes("/") || id.includes("\\")) return false;
+  if (id === "." || id === "..") return false;
+  return true;
+}
+function notFound(id) {
+  return { ok: false, code: "vault_not_found", message: `vault "${id}" not found` };
+}
+async function renameVault(input, deps = {}) {
+  const trimmedName = input.displayName.trim();
+  if (trimmedName.length < 1 || trimmedName.length > MAX_DISPLAY_NAME_LEN) {
+    return {
+      ok: false,
+      code: "invalid_display_name",
+      message: `display name must be 1-${MAX_DISPLAY_NAME_LEN} characters (trimmed)`
+    };
+  }
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.vaults.find((v) => v.id === input.id);
+  if (!existing) return notFound(input.id);
+  const neonResult = await renameVaultNeon(input.id, trimmedName, input.accountId, deps.neon ?? {});
+  if (neonResult === "not_found") return notFound(input.id);
+  registerVault({ ...existing, display_name: trimmedName }, deps.registryOpts);
+  return {
+    ok: true,
+    vault: {
+      id: input.id,
+      display_name: trimmedName,
+      neon_written: neonResult === "updated",
+      registry_written: true
+    }
+  };
+}
+async function moveVault(input, deps = {}) {
+  if (!isValidId2(input.workspaceId)) {
+    return {
+      ok: false,
+      code: "invalid_workspace_id",
+      message: `invalid workspace id "${String(input.workspaceId)}" -- must be non-empty with no path separators`
+    };
+  }
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.vaults.find((v) => v.id === input.id);
+  if (!existing) return notFound(input.id);
+  const neonResult = await moveVaultNeon(
+    input.id,
+    input.workspaceId,
+    input.accountId,
+    deps.neon ?? {}
+  );
+  if (neonResult === "not_found") return notFound(input.id);
+  registerVault({ ...existing, workspace_id: input.workspaceId }, deps.registryOpts);
+  return {
+    ok: true,
+    vault: {
+      id: input.id,
+      workspace_id: input.workspaceId,
+      neon_written: neonResult === "updated",
+      registry_written: true
+    }
+  };
+}
+async function unregisterVault(input, deps = {}) {
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.vaults.find((v) => v.id === input.id);
+  if (!existing) return notFound(input.id);
+  const neonResult = await deleteVaultNeon(input.id, input.accountId, deps.neon ?? {});
+  if (neonResult === "not_found") return notFound(input.id);
+  await repointActiveVaultOnRemoval(input.accountId, input.id, existing.workspace_id, {
+    registryOpts: deps.registryOpts,
+    accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
+  });
+  removeVault(input.id, deps.registryOpts);
+  return {
+    ok: true,
+    vault: {
+      id: input.id,
+      neon_written: neonResult === "deleted",
+      registry_written: true
+    }
+  };
+}
+
+// spex-console/src/lib/cli/vault.ts
+init_vault_resolve();
+
+// spex-console/src/lib/cli/init.ts
+import { randomUUID } from "node:crypto";
+var DEFAULT_CONSOLE_URL2 = resolveConsoleUrl();
+function parseVaultId(content) {
+  const m = content.match(/^vault_id:\s*(.+?)\s*$/m);
+  if (!m) return null;
+  const raw = m[1].trim();
+  const unquoted = raw.replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1");
+  return unquoted.length > 0 ? unquoted : null;
+}
+var HELP2 = [
+  "Usage:",
+  "  hs init [--console-url <url>] [--vault-root <path>] [--force] [--json]",
+  "  hs init --customer-vault <dir> [--console-url <url>] [--principles <all|none|a,b>]",
+  "                          [--vault-name <name>] [--no-git] [--json]",
+  "",
+  "Write the top-level heyspex.yaml vault marker (schema_version, console_url,",
+  "vault_root, vault_id) \u2014 the committed file the console / web companion read",
+  "to bootstrap a vault. Idempotent: an existing marker is left untouched unless",
+  "--force, EXCEPT a missing vault_id is backfilled in place either way (backward",
+  "compatible \u2014 no schema_version bump). vault_id is reused exactly when already",
+  "present; a fresh one is minted only when absent.",
+  "Does not modify .heyspex/config.yaml or its templates (ADR-0009).",
+  "",
+  "--customer-vault <dir> scaffolds a REAL customer vault at <dir> instead: the",
+  "specs/ folder tree, heyspex.yaml, and every row of the template shipping",
+  "manifest (spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
+  "copied verbatim, template-shape docs written as author-prompt skeletons \u2014",
+  "plus a generated CLAUDE.md, the kept-principles index, and (unless --no-git)",
+  "one initial `git init` + commit pinning the template version. Refuses a",
+  "non-empty <dir> with a plain error. See init.customer-vault.ts.",
+  "",
+  "Flags:",
+  "  --console-url <url>  console_url value (default: $HEYSPEX_CONSOLE_URL or",
+  "                       https://console.heyspex.local).",
+  "  --vault-root <path>  vault_root value (default: specs/).",
+  "  --customer-vault <dir> Scaffold a new customer vault at <dir> (see above).",
+  "  --principles <all|none|a,b> Which universal principle docs to ship",
+  "                       (--customer-vault only). Omitted + a TTY: interactive",
+  "                       keep/skip prompt per principle. Omitted + no TTY: all.",
+  "  --vault-name <name>  Display name for the scaffolded vault (--customer-vault",
+  "                       only; default: <dir>'s basename).",
+  "  --no-git             Skip git init + the initial commit (--customer-vault only).",
+  "  --force              Overwrite an existing heyspex.yaml.",
+  "  --json               Emit a machine-readable JSON result.",
+  "  --help, -h           Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 11 bad-arg \xB7 13 write-failed"
+].join("\n");
+
+// spex-console/src/lib/cli/install-conflicts.ts
+var INSTALL_CONFLICT_REGISTRY = [
+  {
+    id: "beads-directory",
+    label: "Beads (`.beads/`)",
+    severity: "blocker",
+    why: "Beads and HeySpex both claim to be the agent queue; dual SSOT causes hook + status drift.",
+    remediation: "Remove `.beads/` and retire bd hooks (`hs install` documents manual steps; future: `hs install --remediate beads`)."
+  },
+  {
+    id: "beads-agents-md",
+    label: "Beads block in AGENTS.md",
+    severity: "warning",
+    why: "Agents still receive `bd prime` / `bd ready` instructions alongside HeySpex.",
+    remediation: "Replace the `<!-- BEGIN BEADS INTEGRATION -->` block with HeySpex agent rules."
+  },
+  {
+    id: "beads-claude-md",
+    label: "Beads block in CLAUDE.md",
+    severity: "warning",
+    why: "Claude Code session hooks and close-out still reference beads.",
+    remediation: "Replace beads integration with the HeySpex vault section."
+  },
+  {
+    id: "beads-claude-hooks",
+    label: "Claude Code `bd prime` hooks",
+    severity: "blocker",
+    why: "SessionStart runs `bd prime` every turn \u2014 fights HeySpex MCP recall/on-deck.",
+    remediation: "Clear `.claude/settings.json` hooks or remove `bd prime` entries."
+  },
+  {
+    id: "workflow-pm",
+    label: "workflow-pm / wfpm (beads PM dashboard)",
+    severity: "warning",
+    why: "PM scripts assume `bd` as queue truth.",
+    remediation: "Remove `workflow-pm` devDependency and `pm:*` npm scripts."
+  },
+  {
+    id: "parallel-issue-tracker",
+    label: "Alternate markdown issue tracker under `issues/` or `.github/ISSUE_TEMPLATE` only",
+    severity: "warning",
+    why: "Agents may file work outside `specs/` if instructions mention GitHub Issues as primary.",
+    remediation: "Point agent docs at `specs/` only; keep GitHub Issues optional for humans."
+  }
+];
+function includesAny(haystack, needles) {
+  return needles.some((n) => haystack.includes(n));
+}
+function scanInstallConflicts(targetDir, deps) {
+  const hits = [];
+  const rule = (id) => INSTALL_CONFLICT_REGISTRY.find((r) => r.id === id);
+  const beadsDir = deps.joinPath(targetDir, ".beads");
+  if (deps.fileExists(beadsDir)) {
+    const r = rule("beads-directory");
+    hits.push({ ...r, signal: beadsDir });
+  }
+  const agentsMd = deps.joinPath(targetDir, "AGENTS.md");
+  const agentsText = deps.readFile(agentsMd);
+  if (agentsText && includesAny(agentsText, [
+    "BEGIN BEADS INTEGRATION",
+    "Use `bd` for ALL task tracking",
+    "Run `bd prime`"
+  ])) {
+    const r = rule("beads-agents-md");
+    hits.push({ ...r, signal: agentsMd });
+  }
+  const claudeMd = deps.joinPath(targetDir, "CLAUDE.md");
+  const claudeText = deps.readFile(claudeMd);
+  if (claudeText && includesAny(claudeText, ["BEGIN BEADS INTEGRATION", "bd prime", "bd dolt push"])) {
+    const r = rule("beads-claude-md");
+    hits.push({ ...r, signal: claudeMd });
+  }
+  const claudeSettings = deps.joinPath(targetDir, ".claude", "settings.json");
+  const settingsText = deps.readFile(claudeSettings);
+  if (settingsText && settingsText.includes("bd prime")) {
+    const r = rule("beads-claude-hooks");
+    hits.push({ ...r, signal: claudeSettings });
+  }
+  const pkgJson = deps.joinPath(targetDir, "package.json");
+  const pkgText = deps.readFile(pkgJson);
+  if (pkgText && includesAny(pkgText, ["workflow-pm", '"wfpm"'])) {
+    const r = rule("workflow-pm");
+    hits.push({ ...r, signal: pkgJson });
+  }
+  return hits;
+}
+function formatConflictReport(hits) {
+  if (hits.length === 0) {
+    return "Conflict scan: no known tooling conflicts detected.";
+  }
+  const lines = [
+    `Conflict scan: ${hits.length} known conflict(s) detected \u2014 resolve before relying on HeySpex as the only queue.`,
+    ""
+  ];
+  for (const hit of hits) {
+    lines.push(
+      `[${hit.severity.toUpperCase()}] ${hit.label} (${hit.id})`,
+      `  Signal: ${hit.signal}`,
+      `  Why: ${hit.why}`,
+      `  Fix: ${hit.remediation}`,
+      ""
+    );
+  }
+  lines.push(
+    "Registry SSOT: specs/protocols/customer-vault-local-install-protocol.md",
+    "Future: `hs install --remediate <id>` for safe auto-fix paths."
+  );
+  return lines.join("\n");
+}
+
+// spex-console/src/lib/cli/vault.ts
+init_vault_workspace_shared();
+function parseVaultArgs(argv) {
+  const subRaw = argv[0];
+  if (subRaw === "--help" || subRaw === "-h" || subRaw === void 0) {
+    return { help: true };
+  }
+  const KNOWN_SUBCOMMANDS = [
+    "list",
+    "register",
+    "switch",
+    "active",
+    "rename",
+    "move",
+    "unregister",
+    "archive",
+    "restore"
+  ];
+  if (!KNOWN_SUBCOMMANDS.includes(subRaw)) {
+    return { error: { code: EXIT.USAGE, message: `unknown subcommand: ${subRaw}` } };
+  }
+  let json = false;
+  let yes = false;
+  let pathArg;
+  let id;
+  let name;
+  let workspaceId;
+  let account;
+  let positional;
+  for (let i = 1; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") return { help: true };
+    else if (arg === "--json") json = true;
+    else if (arg === "--yes" || arg === "-y") yes = true;
+    else if (arg === "--path" || arg.startsWith("--path=")) {
+      const v = arg === "--path" ? argv[++i] : arg.slice("--path=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--path requires a value" } };
+      }
+      pathArg = v;
+    } else if (arg === "--id" || arg.startsWith("--id=")) {
+      const v = arg === "--id" ? argv[++i] : arg.slice("--id=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--id requires a value" } };
+      }
+      id = v;
+    } else if (arg === "--name" || arg.startsWith("--name=")) {
+      const v = arg === "--name" ? argv[++i] : arg.slice("--name=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--name requires a value" } };
+      }
+      name = v;
+    } else if (arg === "--workspace" || arg.startsWith("--workspace=")) {
+      const v = arg === "--workspace" ? argv[++i] : arg.slice("--workspace=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--workspace requires a value" } };
+      }
+      workspaceId = v;
+    } else if (arg === "--account" || arg.startsWith("--account=")) {
+      const v = arg === "--account" ? argv[++i] : arg.slice("--account=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--account requires a value" } };
+      }
+      account = v;
+    } else if (arg.startsWith("-")) {
+      return { error: { code: EXIT.USAGE, message: `unknown flag: ${arg}` } };
+    } else if (positional === void 0) {
+      positional = arg;
+    } else {
+      return { error: { code: EXIT.USAGE, message: `unexpected argument: ${arg}` } };
+    }
+  }
+  if (subRaw === "list") return { args: { sub: "list", json, account } };
+  if (subRaw === "active") return { args: { sub: "active", json } };
+  if (subRaw === "switch") {
+    if (!positional) {
+      return { error: { code: EXIT.USAGE, message: "vault switch requires a vault id" } };
+    }
+    return { args: { sub: "switch", id: positional, json } };
+  }
+  if (subRaw === "rename") {
+    const targetId = id ?? positional;
+    if (!targetId) {
+      return { error: { code: EXIT.USAGE, message: "vault rename requires a vault id" } };
+    }
+    if (!name) {
+      return {
+        error: { code: EXIT.USAGE, message: 'vault rename requires --name "<display name>"' }
+      };
+    }
+    return { args: { sub: "rename", id: targetId, name, json, account } };
+  }
+  if (subRaw === "move") {
+    const targetId = id ?? positional;
+    if (!targetId) {
+      return { error: { code: EXIT.USAGE, message: "vault move requires a vault id" } };
+    }
+    if (!workspaceId) {
+      return { error: { code: EXIT.USAGE, message: "vault move requires --workspace <id>" } };
+    }
+    return { args: { sub: "move", id: targetId, workspaceId, json, account } };
+  }
+  if (subRaw === "unregister") {
+    const targetId = id ?? positional;
+    if (!targetId) {
+      return { error: { code: EXIT.USAGE, message: "vault unregister requires a vault id" } };
+    }
+    return { args: { sub: "unregister", id: targetId, yes, json, account } };
+  }
+  if (subRaw === "archive") {
+    const targetId = id ?? positional;
+    if (!targetId) {
+      return { error: { code: EXIT.USAGE, message: "vault archive requires a vault id" } };
+    }
+    return { args: { sub: "archive", id: targetId, yes, json, account } };
+  }
+  if (subRaw === "restore") {
+    const targetId = id ?? positional;
+    if (!targetId) {
+      return { error: { code: EXIT.USAGE, message: "vault restore requires a vault id" } };
+    }
+    return { args: { sub: "restore", id: targetId, json, account } };
+  }
+  const effectivePath = pathArg ?? positional;
+  if (!effectivePath) {
+    return { error: { code: EXIT.USAGE, message: "vault register requires --path <dir>" } };
+  }
+  return { args: { sub: "register", path: effectivePath, id, name, workspaceId, json } };
+}
+function accountPointerDeps(deps) {
+  return { registryOpts: deps.registryOpts, ...deps.neon ?? {} };
+}
+function accountId(deps) {
+  return deps.accountId ?? resolveCliAccountId();
+}
+async function resolveEffectiveAccountId(deps, requestedAccount, verb) {
+  const scope = await resolveScopedAccountId(accountId(deps), requestedAccount);
+  if (scope.ok) return { ok: true, accountId: scope.accountId };
+  return {
+    ok: false,
+    result: {
+      code: EXIT.FORBIDDEN,
+      message: `hs vault ${verb}: ${scope.message}`,
+      payload: { ok: false, error: scope.code, message: scope.message },
+      isError: true
+    }
+  };
+}
+function slugFromPath(p) {
+  const base = p.split(/[\\/]/).filter(Boolean).pop() ?? "";
+  const slug = base.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug;
+}
+function buildRegistryLookup2(deps) {
+  return (vaultId) => {
+    const registry = loadVaultRegistry(deps.registryOpts);
+    const record = registry.vaults.find((v) => v.id === vaultId);
+    return record ? { id: record.id, repoRootAbs: record.repo_root_abs } : null;
+  };
+}
+function buildAccountPointerLookup2(deps) {
+  return (accId) => getActiveVault(accId ?? accountId(deps), accountPointerDeps(deps));
+}
+function formatVaultRow(v, activeId) {
+  const marker = v.id === activeId ? "* " : "  ";
+  return `${marker}${v.id}  (workspace: ${v.workspace_id})  ${v.repo_root_abs}`;
+}
+async function runList(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "list");
+  if (!scoped.ok) return scoped.result;
+  const { vaults: vaults2, active_vault_id } = await listVaultsForWorkspace(scoped.accountId, void 0, {
+    registryOpts: deps.registryOpts,
+    accountPointer: accountPointerDeps(deps),
+    // The CLI runs on this machine AS this machine's owner, so the local
+    // registry.json IS this caller's own data — the one place the offline
+    // fallback is correct. A route handler must never pass this. NOT true
+    // any more once `--account` targets someone ELSE's account (see
+    // `workspace.ts`'s identical `runList` comment for why).
+    allowLocalRegistryFallback: scoped.accountId === accountId(deps)
+  });
+  if (args.json) {
+    return {
+      code: EXIT.OK,
+      message: "",
+      payload: { ok: true, vaults: vaults2, active_vault_id },
+      isError: false
+    };
+  }
+  const lines = vaults2.length ? vaults2.map((v) => formatVaultRow(v, active_vault_id)).join("\n") : "  (no vaults registered -- run `hs vault register --path <dir>`)";
+  return {
+    code: EXIT.OK,
+    message: `${vaults2.length} registered vault(s):
+${lines}`,
+    payload: { ok: true, vaults: vaults2, active_vault_id },
+    isError: false
+  };
+}
+async function runRegister(args, deps) {
+  const resolvedPath = deps.resolvePath(args.path);
+  const specsDir = deps.joinPath(resolvedPath, "specs");
+  if (!deps.fileExists(specsDir)) {
+    return {
+      code: EXIT.INVALID_ARG,
+      message: `hs vault register: no specs/ directory found at ${specsDir} -- this does not look like a HeySpex vault. Run \`hs install\` first, or pass --path at the repo root (the directory that CONTAINS specs/).`,
+      payload: { ok: false, error: "no_specs_dir", path: resolvedPath },
+      isError: true
+    };
+  }
+  let id = args.id;
+  let schemaVersion = 1;
+  const yamlPath = deps.joinPath(resolvedPath, "heyspex.yaml");
+  if (deps.fileExists(yamlPath)) {
+    const content = deps.readFile(yamlPath);
+    if (content) {
+      if (!id) {
+        const existingId = parseVaultId(content);
+        if (existingId) id = existingId;
+      }
+      const versionMatch = content.match(/^schema_version:\s*(\d+)\s*$/m);
+      if (versionMatch) schemaVersion = Number(versionMatch[1]);
+    }
+  }
+  if (!id) id = slugFromPath(resolvedPath);
+  if (!id) {
+    return {
+      code: EXIT.INVALID_ARG,
+      message: `hs vault register: could not derive a vault id from ${resolvedPath} -- pass --id explicitly.`,
+      payload: { ok: false, error: "no_derivable_id", path: resolvedPath },
+      isError: true
+    };
+  }
+  const displayName = args.name ?? deps.basename(resolvedPath);
+  const now = deps.now();
+  const registryBefore = loadVaultRegistry(deps.registryOpts);
+  const existingVaultRow = registryBefore.vaults.find(
+    (v) => v.id === id || v.repo_root_abs === resolvedPath
+  );
+  const workspaceId = args.workspaceId ?? existingVaultRow?.workspace_id ?? "default";
+  const workspaceExisted = registryBefore.workspaces.some((w) => w.id === workspaceId);
+  if (!workspaceExisted) {
+    registerWorkspace(
+      { id: workspaceId, display_name: workspaceId, created_at: now },
+      deps.registryOpts
+    );
+  }
+  registerVault(
+    {
+      id,
+      workspace_id: workspaceId,
+      display_name: displayName,
+      repo_root_abs: resolvedPath,
+      schema_version: schemaVersion,
+      registered_at: now
+    },
+    deps.registryOpts
+  );
+  const neonWorkspaceWritten = workspaceExisted ? false : await upsertWorkspaceNeon(
+    { id: workspaceId, displayName: workspaceId },
+    accountId(deps),
+    deps.neon
+  );
+  const neonVaultWritten = await upsertVaultNeon(
+    { id, workspaceId, displayName, repoRootAbs: resolvedPath, schemaVersion },
+    accountId(deps),
+    deps.neon
+  );
+  let conflictReport = null;
+  let conflictHits = [];
+  if (deps.conflictScan) {
+    conflictHits = scanInstallConflicts(resolvedPath, deps.conflictScan);
+    conflictReport = formatConflictReport(conflictHits);
+  }
+  const payload = {
+    ok: true,
+    id,
+    workspace_id: workspaceId,
+    workspace_created: !workspaceExisted,
+    display_name: displayName,
+    repo_root_abs: resolvedPath,
+    schema_version: schemaVersion,
+    neon_workspace_written: neonWorkspaceWritten,
+    neon_vault_written: neonVaultWritten,
+    conflicts: conflictHits
+  };
+  const message = [
+    `Registered vault "${id}" (workspace: ${workspaceId}) -> ${resolvedPath}`,
+    ...conflictReport && conflictHits.length > 0 ? ["", conflictReport] : []
+  ].join("\n");
+  return { code: EXIT.OK, message, payload, isError: false };
+}
+async function runSwitch(args, deps) {
+  try {
+    await setActiveVault(accountId(deps), args.id, accountPointerDeps(deps));
+  } catch (err) {
+    if (err instanceof UnknownVaultIdError) {
+      return {
+        code: EXIT.NOT_FOUND,
+        message: `hs vault switch: unknown vault id "${args.id}" -- run \`hs vault list\` to see registered vaults. Nothing was changed.`,
+        payload: { ok: false, error: "unknown_vault_id", vault_id: args.id },
+        isError: true
+      };
+    }
+    throw err;
+  }
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const local = registry.vaults.find((v) => v.id === args.id);
+  const workspaceId = local?.workspace_id ?? await findVaultWorkspaceIdNeon(args.id, deps.neon);
+  let workspaceSwitched = false;
+  if (workspaceId) {
+    try {
+      const { setActiveWorkspace: setActiveWorkspace2 } = await Promise.resolve().then(() => (init_account_pointer(), account_pointer_exports));
+      await setActiveWorkspace2(accountId(deps), workspaceId, accountPointerDeps(deps));
+      workspaceSwitched = true;
+    } catch {
+    }
+  }
+  return {
+    code: EXIT.OK,
+    message: `Switched active vault to "${args.id}"${workspaceSwitched ? ` (workspace: ${workspaceId})` : ""}.`,
+    payload: { ok: true, vault_id: args.id, workspace_id: workspaceSwitched ? workspaceId : null },
+    isError: false
+  };
+}
+async function activeVaultSelection(deps, effectiveAccountId = accountId(deps)) {
+  const vaultId = await getActiveVault(effectiveAccountId, accountPointerDeps(deps));
+  const workspaceId = await getActiveWorkspace(effectiveAccountId, accountPointerDeps(deps));
+  const line = vaultId ? `Active vault: ${vaultId}${workspaceId ? ` (workspace: ${workspaceId})` : ""}` : "Active vault: (none)";
+  return { line, vaultId, workspaceId };
+}
+function statusForVaultManageError(code) {
+  return code === "vault_not_found" ? EXIT.NOT_FOUND : EXIT.INVALID_ARG;
+}
+async function runRename(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "rename");
+  if (!scoped.ok) return scoped.result;
+  const result = await renameVault(
+    { accountId: scoped.accountId, id: args.id, displayName: args.name },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: statusForVaultManageError(result.code),
+      message: `hs vault rename: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeVaultSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Renamed vault "${result.vault.id}" to "${result.vault.display_name}".
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.vault.id,
+      display_name: result.vault.display_name,
+      active_vault_id: selection.vaultId,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function runMove(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "move");
+  if (!scoped.ok) return scoped.result;
+  const result = await moveVault(
+    { accountId: scoped.accountId, id: args.id, workspaceId: args.workspaceId },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: statusForVaultManageError(result.code),
+      message: `hs vault move: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeVaultSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Moved vault "${result.vault.id}" to workspace "${result.vault.workspace_id}".
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.vault.id,
+      workspace_id: result.vault.workspace_id,
+      active_vault_id: selection.vaultId,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function confirmRemoval(deps, displayName, verb, yes) {
+  if (yes) return true;
+  const confirm2 = buildCloseNotDestroyConfirm("vault", verb, displayName);
+  if (!deps.confirm) return false;
+  return deps.confirm(`${confirm2.message} ${confirm2.confirmLabel}? (y/n) `);
+}
+function cancelledResult(kind) {
+  return {
+    code: EXIT.USAGE,
+    message: `Stopped before making changes -- re-run with --yes, or answer "y", to ${kind}.`,
+    payload: { ok: false, aborted: true },
+    isError: true
+  };
+}
+async function runUnregister(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "unregister");
+  if (!scoped.ok) return scoped.result;
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.vaults.find((v) => v.id === args.id);
+  const displayName = existing?.display_name ?? args.id;
+  const proceed = await confirmRemoval(deps, displayName, "unregister", args.yes);
+  if (!proceed) return cancelledResult("unregister");
+  const result = await unregisterVault(
+    { accountId: scoped.accountId, id: args.id },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: statusForVaultManageError(result.code),
+      message: `hs vault unregister: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeVaultSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Removed vault "${result.vault.id}" from HeySpex. ${CLOSE_NOT_DESTROY_STATEMENT}
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.vault.id,
+      active_vault_id: selection.vaultId,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function runArchive(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "archive");
+  if (!scoped.ok) return scoped.result;
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.vaults.find((v) => v.id === args.id);
+  const displayName = existing?.display_name ?? args.id;
+  const proceed = await confirmRemoval(deps, displayName, "archive", args.yes);
+  if (!proceed) return cancelledResult("archive");
+  const result = await archiveVault(
+    { accountId: scoped.accountId, id: args.id },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: EXIT.NOT_FOUND,
+      message: `hs vault archive: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeVaultSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Archived vault "${result.vault.id}". ${CLOSE_NOT_DESTROY_STATEMENT}
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.vault.id,
+      archived: result.vault.archived,
+      active_vault_id: selection.vaultId,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function runRestore(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "restore");
+  if (!scoped.ok) return scoped.result;
+  const result = await restoreVault(
+    { accountId: scoped.accountId, id: args.id },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: EXIT.NOT_FOUND,
+      message: `hs vault restore: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeVaultSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Restored vault "${result.vault.id}".
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.vault.id,
+      archived: result.vault.archived,
+      active_vault_id: selection.vaultId,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function runActive(args, deps) {
+  if (args.vaultIdOverride !== void 0 && await buildRegistryLookup2(deps)(args.vaultIdOverride) === null) {
+    const message = `hs vault: unknown vault id "${args.vaultIdOverride}" -- run \`hs vault list\` to see registered vaults.`;
+    return {
+      code: EXIT.NOT_FOUND,
+      message,
+      payload: { ok: false, error: "unknown_vault_id", message },
+      isError: true
+    };
+  }
+  try {
+    const resolved = await resolveActiveVaultRoot({
+      vaultId: args.vaultIdOverride,
+      accountId: accountId(deps),
+      cwd: deps.cwd,
+      registryLookup: buildRegistryLookup2(deps),
+      accountPointerLookup: buildAccountPointerLookup2(deps)
+    });
+    const workspaceId = await getActiveWorkspace(accountId(deps), accountPointerDeps(deps));
+    const payload = {
+      ok: true,
+      vaultId: resolved.vaultId,
+      repoRootAbs: resolved.repoRootAbs,
+      specsDirAbs: resolved.specsDirAbs,
+      source: resolved.source,
+      workspaceId
+    };
+    const message = [
+      `vault:      ${resolved.vaultId}`,
+      `workspace:  ${workspaceId ?? "(none)"}`,
+      `repo root:  ${resolved.repoRootAbs}`,
+      `specs dir:  ${resolved.specsDirAbs}`,
+      `source:     ${resolved.source}`
+    ].join("\n");
+    return { code: EXIT.OK, message, payload, isError: false };
+  } catch (err) {
+    if (err instanceof NoActiveVaultError) {
+      return {
+        code: EXIT.NOT_FOUND,
+        message: err.message,
+        payload: { ok: false, error: "no_active_vault", message: err.message },
+        isError: true
+      };
+    }
+    throw err;
+  }
+}
+async function runVault(args, deps, vaultIdOverride) {
+  if (args.sub === "list") return runList(args, deps);
+  if (args.sub === "register") return runRegister(args, deps);
+  if (args.sub === "switch") return runSwitch(args, deps);
+  if (args.sub === "rename") return runRename(args, deps);
+  if (args.sub === "move") return runMove(args, deps);
+  if (args.sub === "unregister") return runUnregister(args, deps);
+  if (args.sub === "archive") return runArchive(args, deps);
+  if (args.sub === "restore") return runRestore(args, deps);
+  return runActive({ json: args.json, vaultIdOverride }, deps);
+}
+var HELP3 = [
+  "Usage:",
+  "  hs vault list [--json]                                   List registered vaults, mark active",
+  '  hs vault register --path <dir> [--id <slug>] [--name "..."] [--workspace <id>]',
+  "                                                            Register a vault (idempotent by path)",
+  "  hs vault switch <id> [--json]                             Set the active vault (+ active workspace)",
+  "  hs vault active [--json]                                  Show the active workspace + vault + paths",
+  '  hs vault rename <id> --name "<name>"                      Rename a vault',
+  "  hs vault move <id> --workspace <id>                       Move a vault to another workspace",
+  "  hs vault unregister <id> [--yes]                          Remove a vault from HeySpex (files untouched)",
+  "  hs vault archive <id> [--yes]                             Archive a vault (reversible)",
+  "  hs vault restore <id>                                     Restore an archived vault",
+  "",
+  "'workspace' = company container; 'vault' = one repo's specs/. Never used interchangeably.",
+  "",
+  "Global one-shot override (any hs subcommand):",
+  "  hs --vault <id> <subcommand>    Use <id> for this invocation only; does not persist a new default.",
+  "",
+  "register validates <dir>/specs/ exists (no write otherwise), re-runs the install",
+  "conflict scan (warn-only), and creates the --workspace inline if it doesn't exist yet.",
+  "switch fails closed on an unknown id (no pointer mutation) and names `hs vault list` as the fix.",
+  "rename/move/unregister/archive/restore call the SAME REST core as the console app",
+  "switcher (PATCH|DELETE /api/vaults/:id) -- no separate CLI-only path. unregister and",
+  "archive show the shared Close-is-not-Destroy confirm (files on disk are never touched);",
+  "--yes skips the prompt only, it never changes what the verb does. Every management verb",
+  "prints the resulting active vault (+ workspace) afterward, since a removal or archive of",
+  "the active vault may re-point the active pointer server-side.",
+  "",
+  "Flags:",
+  "  --path <dir>       Repo root to register (register).",
+  "  --id <slug>        Vault id (register; default: heyspex.yaml's vault_id, else a slug from --path).",
+  "  --name <name>      Display name (register/rename; default on register: the directory basename).",
+  '  --workspace <id>   Owning workspace id (register/move; default on register: "default").',
+  "  --yes, -y          Skip the removal confirm prompt (unregister/archive).",
+  "  --account <id>     Act on a DIFFERENT account's vault instead of your own",
+  "                     (list/rename/move/unregister/archive/restore only) -- builder/admin-gated",
+  "                     server-side; refused for a non-builder caller (exit 15).",
+  "  --json             Emit a machine-readable JSON result.",
+  "  --help, -h         Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 10 not-found \xB7 11 bad-arg \xB7 15 forbidden (--account)"
+].join("\n");
+
+// spex-console/bin/hs-vault.ts
+function readFile(p) {
+  try {
+    return readFileSync6(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+var INTERACTIVE = process2.stdin.isTTY === true;
+async function confirm(question) {
+  if (!INTERACTIVE) return false;
+  const rl = createInterface({ input: process2.stdin, output: process2.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "y" || answer === "yes" || answer === "proceed";
+  } finally {
+    rl.close();
+  }
+}
+async function main() {
+  const parsed = parseVaultArgs(process2.argv.slice(3));
+  if (parsed.help) {
+    process2.stdout.write(`${HELP3}
+`);
+    process2.exit(EXIT.OK);
+  }
+  if (parsed.error) {
+    process2.stderr.write(`hs vault: ${parsed.error.message}
+`);
+    process2.exit(parsed.error.code);
+  }
+  const vaultIdOverride = process2.env.HS_VAULT_ID_OVERRIDE?.trim() || void 0;
+  const cwd = process2.env.HS_VAULT_ROOT ? path6.resolve(process2.env.HS_VAULT_ROOT) : process2.cwd();
+  const invokedCwd = process2.env.HS_INVOKED_CWD?.trim() || process2.cwd();
+  const consoleUrl = resolveSpexConsoleUrl(cwd, readFile);
+  const result = await runVault(
+    parsed.args,
+    {
+      fileExists: (p) => existsSync5(p),
+      readFile,
+      resolvePath: (p) => path6.resolve(invokedCwd, p),
+      joinPath: (...s) => path6.join(...s),
+      basename: (p) => path6.basename(p),
+      now: () => (/* @__PURE__ */ new Date()).toISOString(),
+      cwd,
+      conflictScan: {
+        fileExists: (p) => existsSync5(p),
+        readFile,
+        joinPath: (...s) => path6.join(...s)
+      },
+      confirm,
+      neon: { http: { fetchImpl: fetch, consoleUrl, token: readPairedToken() } }
+    },
+    vaultIdOverride
+  );
+  const sink = result.isError ? process2.stderr : process2.stdout;
+  sink.write(`${parsed.args.json ? JSON.stringify(result.payload) : result.message}
+`);
+  process2.exit(result.code);
+}
+main().catch((err) => {
+  const message = err instanceof Error ? err.message : String(err);
+  process2.stderr.write(`hs vault: unhandled: ${message}
+`);
+  process2.exit(EXIT.WRITE_FAILED);
+});