heyspex 0.1.0

package/dist/cli/hs-workspace.mjs

@@ -0,0 +1,2898 @@
+import { createRequire as __hsCreateRequire } from 'node:module';
+const require = __hsCreateRequire(import.meta.url);
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+
+// dist/cli/._sql-orm-inert.cli-shim.mjs
+var inert, sql, and, eq, bigint, bigserial, boolean, foreignKey, index, integer, jsonb, pgEnum, pgTable, primaryKey, text, timestamp, uniqueIndex;
+var init_sql_orm_inert_cli_shim = __esm({
+  "dist/cli/._sql-orm-inert.cli-shim.mjs"() {
+    "use strict";
+    inert = new Proxy(function inert2() {
+      return inert2;
+    }, {
+      get(_target, prop) {
+        if (prop === "then" || prop === Symbol.toPrimitive || prop === Symbol.iterator) return void 0;
+        return inert;
+      },
+      apply() {
+        return inert;
+      },
+      construct() {
+        return inert;
+      }
+    });
+    sql = inert;
+    and = inert;
+    eq = inert;
+    bigint = inert;
+    bigserial = inert;
+    boolean = inert;
+    foreignKey = inert;
+    index = inert;
+    integer = inert;
+    jsonb = inert;
+    pgEnum = inert;
+    pgTable = inert;
+    primaryKey = inert;
+    text = inert;
+    timestamp = inert;
+    uniqueIndex = inert;
+  }
+});
+
+// dist/cli/._postgres-client.cli-shim.mjs
+function isPostgresConfigured() {
+  return false;
+}
+function getPostgresDb() {
+  throw new Error(
+    "getPostgresDb() is unavailable in a published install -- this build ships no direct database connection."
+  );
+}
+var init_postgres_client_cli_shim = __esm({
+  "dist/cli/._postgres-client.cli-shim.mjs"() {
+    "use strict";
+  }
+});
+
+// spex-console/src/lib/db/schema/interfaces.ts
+var SINGLE_USER_ID, DEFAULT_VAULT_ID;
+var init_interfaces = __esm({
+  "spex-console/src/lib/db/schema/interfaces.ts"() {
+    "use strict";
+    SINGLE_USER_ID = "pwher";
+    DEFAULT_VAULT_ID = "default";
+  }
+});
+
+// spex-console/src/lib/db/schema/postgres.ts
+var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, specs, tags, edges, wikilinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, wipLedger, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements;
+var init_postgres = __esm({
+  "spex-console/src/lib/db/schema/postgres.ts"() {
+    "use strict";
+    init_sql_orm_inert_cli_shim();
+    init_sql_orm_inert_cli_shim();
+    init_interfaces();
+    edgeTypeEnum = pgEnum("edge_type", [
+      "blocks",
+      "related",
+      "parent_child",
+      "discovered_from"
+    ]);
+    validationSeverityEnum = pgEnum("validation_severity", ["error", "warning"]);
+    outboxOpEnum = pgEnum("outbox_op", ["upsert", "delete"]);
+    specs = pgTable(
+      "specs",
+      {
+        id: text("id").notNull(),
+        name: text("name").notNull(),
+        type: text("type").notNull(),
+        status: text("status").notNull(),
+        priority: integer("priority"),
+        owner: text("owner"),
+        created: text("created").notNull(),
+        // ISO date YYYY-MM-DD
+        updated: text("updated").notNull(),
+        // ISO date YYYY-MM-DD
+        relPath: text("rel_path").notNull(),
+        // Vault-relative POSIX path
+        bodyHash: text("body_hash").notNull(),
+        // SHA-256 of full file (frontmatter + body) for change detection
+        // Canonical authored body — re-added in 0020 ([[HS-TASK-UGUD]]); reverses the 0005 drop.
+        // Nullable until the write path ([[HS-TASK-X724]]) always populates it; UGUD backfills
+        // existing rows from the disk vault. NO read-path change yet (reads stay on disk until 4PH9).
+        bodyText: text("body_text"),
+        indexedAt: timestamp("indexed_at", { withTimezone: true }).notNull(),
+        // NOTE: `body_text` + `body_tsvector` were dropped in migration 0005
+        // ([[HS-EPIC-NLOC]]); the `embedding vector(1536)` column was dropped in
+        // 0004 (HS-EPIC-VSTR). HeySpex retrieval is lexical-only and LOCAL — no read
+        // tier in Neon — per [[retrieval-substrate-lexical-not-embeddings-gate-b-no]].
+        // WRT3 §Schema — single-user sentinel today; future multi-user routing.
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Index-isolation scope ([[HS-Z2KC-TASK]]): every index-table row is scoped
+        // by vault so >1 vault can share one Neon database without colliding on the
+        // specs PK or the (rel_path, user_id) unique index. DEFAULT keeps the ALTER
+        // safe on populated tables and single-vault installs under one bucket.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        // WRT3 §Soft-delete — null = active. No hard-delete API is exposed.
+        deletedAt: timestamp("deleted_at", { withTimezone: true }),
+        // Explicit family key (Naming V3 step 1, [[HS-8O69-EPIC-LKF9-relational-family-graph-authoring]]):
+        // nullable until the backfill script runs; the indexer writes the frontmatter
+        // `family:` field when present, else derives it via `familyOf` (parse
+        // fallback from `id`/basename). Nothing should string-parse family from `id`
+        // once this column is populated — see `dev-factory/handoffs/NAMING-V3-MIGRATION-BRIEF.md`.
+        family: text("family")
+      },
+      (table) => [
+        // Composite PK (vault_id, id): the same HS-XXXX id may exist once PER VAULT.
+        primaryKey({ columns: [table.vaultId, table.id] }),
+        // SpexConsole main list views filter by type + status
+        index("specs_type_status_idx").on(table.type, table.status),
+        // Family-graph lookups (Naming V3 step 1) — group specs by family key.
+        index("specs_family_idx").on(table.family),
+        // Per-user + per-vault lookups + filtering out soft-deleted rows in the hot path
+        index("specs_user_active_idx").on(table.userId, table.vaultId).where(sql`${table.deletedAt} IS NULL`),
+        // One-file-one-row guarantee: at most one ACTIVE row per (rel_path, user,
+        // vault). Without this two rows could share a rel_path under different id
+        // forms (bare vs full-slug) and render as a duplicate-key error. Partial
+        // (deleted_at IS NULL) so soft-deleted orphans don't block re-indexing. The
+        // upsert path soft-deletes any conflicting row first. Scoped by vault so the
+        // same rel_path can be indexed independently under two vaults.
+        uniqueIndex("specs_relpath_user_uq").on(table.relPath, table.userId, table.vaultId).where(sql`${table.deletedAt} IS NULL`)
+      ]
+    );
+    tags = pgTable(
+      "tags",
+      {
+        specId: text("spec_id").notNull(),
+        tag: text("tag").notNull(),
+        inFrontmatter: boolean("in_frontmatter").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.specId, table.tag] }),
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade")
+      ]
+    );
+    edges = pgTable(
+      "edges",
+      {
+        fromId: text("from_id").notNull(),
+        toId: text("to_id").notNull(),
+        edgeType: edgeTypeEnum("edge_type").notNull().$type(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.fromId, table.toId, table.edgeType] }),
+        foreignKey({
+          columns: [table.vaultId, table.fromId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        foreignKey({
+          columns: [table.vaultId, table.toId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        // Forward dependency lookups (what does this spec block?)
+        index("edges_from_type_idx").on(table.fromId, table.edgeType),
+        // Reverse dependency lookups (what blocks this spec?)
+        index("edges_to_type_idx").on(table.toId, table.edgeType)
+      ]
+    );
+    wikilinks = pgTable(
+      "wikilinks",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        fromId: text("from_id").notNull(),
+        targetBasename: text("target_basename").notNull(),
+        resolvedId: text("resolved_id"),
+        inFrontmatter: boolean("in_frontmatter").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        // Surrogate PK `id` stays; the composite FKs scope both link ends to the
+        // owning vault's specs. resolvedId is nullable, so its composite FK is only
+        // enforced when BOTH columns are non-null (MATCH SIMPLE — Postgres default),
+        // which lets an unresolved forward reference keep resolvedId NULL.
+        foreignKey({
+          columns: [table.vaultId, table.fromId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        // CAUTION (migration 0049): in the live DB this constraint carries a PG-15+
+        // column list — ON DELETE SET NULL ("resolved_id") — because a plain
+        // composite SET NULL nulls vault_id too (NOT NULL → 23502 on any delete of
+        // a spec with inbound resolved links). Drizzle cannot express the column
+        // list, so this declaration is the closest approximation: do NOT let a
+        // future drizzle-kit generate "correct" the constraint back to plain
+        // SET NULL — that reintroduces the delete-blocking bug.
+        foreignKey({
+          columns: [table.vaultId, table.resolvedId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("set null"),
+        // Backlink queries: find all specs linking to a target
+        index("wikilinks_target_idx").on(table.targetBasename)
+      ]
+    );
+    aliases = pgTable(
+      "aliases",
+      {
+        specId: text("spec_id").notNull(),
+        alias: text("alias").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.specId, table.alias] }),
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade")
+      ]
+    );
+    validationIssues = pgTable(
+      "validation_issues",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        specId: text("spec_id").notNull(),
+        severity: validationSeverityEnum("severity").notNull().$type(),
+        code: text("code").notNull(),
+        // e.g. "unresolved_wikilink", "missing_frontmatter"
+        message: text("message").notNull(),
+        detectedAt: timestamp("detected_at", { withTimezone: true }).notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        // Surrogate PK `id` stays; the composite FK scopes issues to the owning
+        // vault's specs.
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade"),
+        // Query issues by spec
+        index("validation_issues_spec_idx").on(table.specId),
+        // Query issues by severity (e.g., show all errors)
+        index("validation_issues_severity_idx").on(table.severity)
+      ]
+    );
+    indexMeta = pgTable(
+      "index_meta",
+      {
+        key: text("key").notNull(),
+        // e.g. "schema_version", "last_indexed_commit"
+        value: text("value").notNull(),
+        // Scope indexer state (last_indexed_commit, schema_version, last_rebuild_at,
+        // and the progress_relay:<userId> KV) per vault so two vaults keep
+        // independent commit pointers. Composite PK (vault_id, key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.key] })]
+    );
+    frontmatterFields = pgTable(
+      "frontmatter_fields",
+      {
+        specId: text("spec_id").notNull(),
+        field: text("field").notNull(),
+        value: jsonb("value"),
+        // JSON value for flexible storage
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID)
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.specId, table.field] }),
+        foreignKey({
+          columns: [table.vaultId, table.specId],
+          foreignColumns: [specs.vaultId, specs.id]
+        }).onDelete("cascade")
+      ]
+    );
+    eventOutbox = pgTable(
+      "event_outbox",
+      {
+        seq: bigserial("seq", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull(),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: `seq` (bigserial) stays the PK; consumers that need to filter
+        // by owning vault (e.g. a per-vault snapshot job) can now do so — the
+        // global PartyKit / snapshot drains stay unfiltered by design (they drain
+        // every vault's outbox).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        specId: text("spec_id").notNull(),
+        op: outboxOpEnum("op").notNull().$type(),
+        payload: jsonb("payload").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        publishedAt: timestamp("published_at", { withTimezone: true }),
+        snapshottedAt: timestamp("snapshotted_at", { withTimezone: true })
+      },
+      (table) => [
+        // PartyKit fan-out drain — unpublished rows in monotonic order
+        index("event_outbox_unpublished_idx").on(table.seq).where(sql`${table.publishedAt} IS NULL`),
+        // Snapshot-to-git drain — unsnapshotted rows in monotonic order
+        index("event_outbox_unsnapshotted_idx").on(table.seq).where(sql`${table.snapshottedAt} IS NULL`),
+        // Per-vault-per-user catch-up (`WHERE vault_id = ? AND user_id = ? AND seq > ?`)
+        index("event_outbox_user_seq_idx").on(table.vaultId, table.userId, table.seq)
+      ]
+    );
+    captureSessions = pgTable(
+      "capture_sessions",
+      {
+        id: text("id").primaryKey(),
+        // HS-CAP-XXXX, minted by the writer
+        ownerUserId: text("owner_user_id").notNull(),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] of [[HS-TNTI-EPIC-saas-multi-tenant-isolation]]).
+        // Mirrors `specs.vault_id` EXACTLY (text, NOT NULL, DEFAULT 'default', no FK
+        // — `vaults` rows can be provisioned in Neon after an index row exists, so a
+        // hard FK would break the boot order; the id is the isolation key, not an
+        // entity reference). The PK stays the globally-minted `id` (capture ids are
+        // random tokens, not per-vault sequences); `vault_id` is the READ/WRITE
+        // filter so one user's two vaults never see each other's captures.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        openedBy: text("opened_by").$type().notNull(),
+        openedBySession: text("opened_by_session").notNull(),
+        mode: text("mode").$type().notNull().default("attended"),
+        status: text("status").$type().notNull().default("pending"),
+        specPath: text("spec_path"),
+        contentBuffer: jsonb("content_buffer").notNull().default(sql`'{}'::jsonb`),
+        attachedAgents: jsonb("attached_agents").notNull().default(sql`'[]'::jsonb`),
+        captureChannel: text("capture_channel"),
+        traceId: text("trace_id"),
+        sourceUrl: text("source_url"),
+        /**
+         * Provenance columns for a capture created from the Agent Mirror canvas
+         * ([[HS-1ROV-EPIC-session-mirror-platform-claude-code]] §Stage 6a). Both
+         * nullable — every pre-existing writer (modal/agent/companion) leaves
+         * them unset. No FK (session/launch rows can expire or predate this
+         * column); `agent_session_id` is `agent_sessions.session_id`,
+         * `launch_id` is `launch_intents.id` by convention only.
+         */
+        agentSessionId: text("agent_session_id"),
+        launchId: text("launch_id"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastActivityAt: timestamp("last_activity_at", { withTimezone: true }).notNull().default(sql`now()`),
+        materializedAt: timestamp("materialized_at", { withTimezone: true }),
+        abandonedAt: timestamp("abandoned_at", { withTimezone: true })
+      },
+      (table) => [
+        // Per-vault + per-user lookup of in-flight captures (e.g. `/hs-capture` attach)
+        index("capture_sessions_pending_by_user").on(table.vaultId, table.ownerUserId, table.status).where(sql`${table.status} = 'pending'`),
+        // Companion `heyspex.capture/0.1` trace correlation
+        index("capture_sessions_companion_by_trace").on(table.traceId).where(sql`${table.traceId} IS NOT NULL`)
+      ]
+    );
+    handoffContext = pgTable(
+      "handoff_context",
+      {
+        laneKey: text("lane_key").notNull(),
+        // agent/lane identifier — upsert key
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Part of the widened upsert key below: two vaults must keep independent
+        // CURRENT rows for the same (user, lane_key), not fight over one row.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        agentId: text("agent_id").notNull(),
+        specId: text("spec_id"),
+        // current spec; plain text, no FK (id-form may be bare vs full-slug)
+        phase: text("phase"),
+        blockers: jsonb("blockers").notNull().default(sql`'[]'::jsonb`),
+        estimatedTime: text("estimated_time"),
+        links: jsonb("links").notNull().default(sql`'[]'::jsonb`),
+        schemaVersion: integer("schema_version").notNull().default(1),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // TTL — server-set on every upsert; reads filter `expires_at > now()`.
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Self-purge upsert key: one CURRENT row per (vault, user, lane). Widened
+        // ([[HS-ZP5H-TASK]] GAP 2) from (user, lane) — two vaults sharing the
+        // owner's user_id must not fight over one lane row.
+        uniqueIndex("handoff_context_user_lane_uq").on(table.vaultId, table.userId, table.laneKey),
+        // List-active-lanes read path (parallel-agent off-on-deck — PA7H).
+        index("handoff_context_user_expiry_idx").on(table.vaultId, table.userId, table.expiresAt)
+      ]
+    );
+    claimEventKindEnum = pgEnum("claim_event_kind", [
+      "acquired",
+      "released",
+      "expired",
+      "stolen",
+      "status_updated",
+      // Sequencer decision log ([[HS-DO05-4U1E-EPIC-session-sequencer-in-the-console]]
+      // AC4): appended in the same transaction as the sequence assignment so the
+      // replay epic can reconstruct the order from events alone.
+      "sequence_assigned"
+    ]);
+    activeClaimStatusEnum = pgEnum("active_claim_status", [
+      "working",
+      "pending",
+      "blocked"
+    ]);
+    pendingReasonEnum = pgEnum("pending_reason", [
+      "question",
+      "permission",
+      "planning",
+      "response"
+    ]);
+    focusEventKindEnum = pgEnum("focus_event_kind", ["set", "cleared"]);
+    specEventKindEnum = pgEnum("spec_event_kind", [
+      "status_change",
+      "wikilink_added",
+      "wikilink_removed",
+      "review_requested",
+      "review_resolved",
+      "priority_change",
+      "parent_change",
+      "claim_acquired",
+      "claim_released"
+    ]);
+    focusPin = pgTable(
+      "focus_pin",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. The
+        // singleton is per (vault, user), not per user: one user with two vaults
+        // pins independently in each.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        pinnedBy: text("pinned_by").notNull(),
+        // agent identifier
+        pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // Silent fuse — null means no expiry; reads treat `expires_at <= now()` as cleared.
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        // Cross-milestone "do the prerequisite first, then come back" return target
+        // ([[HS-EPIC-QQBD]]): when the spec named by `return_on_close_of` closes, the
+        // status route re-pins `return_to_spec_id` and clears both. Both null = an
+        // ordinary pin with no auto-return. Nullable + additive (no data backfill).
+        returnToSpecId: text("return_to_spec_id"),
+        returnOnCloseOf: text("return_on_close_of"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    captureFocusPin = pgTable(
+      "capture_focus_pin",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        pinnedBy: text("pinned_by").notNull(),
+        pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        // Kept structurally identical to {@link focusPin} (pins.ts casts one table to
+        // the other); the capture flow never populates these return-target columns.
+        returnToSpecId: text("return_to_spec_id"),
+        returnOnCloseOf: text("return_on_close_of"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    captureFocusSelection = pgTable(
+      "capture_focus_selection",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // The resolved spec path of the current capture on deck (layer-2 core).
+        specPath: text("spec_path"),
+        // Capture kind — "idea" today; text, validated app-side, kept open.
+        kind: text("kind"),
+        // Free-form note for why this capture is pinned (e.g. "Pinned from console").
+        reason: text("reason"),
+        // The agent display name currently claiming the capture (doc-claim-badge).
+        claimedBy: text("claimed_by"),
+        // The claiming agent's session id (claim refresh surface).
+        claimSession: text("claim_session"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    focusSelection = pgTable(
+      "focus_selection",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // The resolved spec path of the current focus (layer-2 core; scheduler tier #2).
+        specPath: text("spec_path"),
+        // Grain: "milestone" | "epic" | "task" (FocusKind). Text, not an enum — the
+        // vocabulary is validated app-side and kept open for forward grains.
+        kind: text("kind"),
+        // Provenance: "human" | "algorithm" | "human_switched_from_blocker" (FocusProvenance).
+        pickedBy: text("picked_by"),
+        pickedAt: timestamp("picked_at", { withTimezone: true }),
+        // The FocusReason object (trigger / formula / score / runners_up[]) as JSONB.
+        pickedReason: jsonb("picked_reason"),
+        // The blocked epic switched away from (only when picked_by = human_switched_from_blocker).
+        blockerOrigin: text("blocker_origin"),
+        // Free-form note when a human overrides the algorithm pick (Why-Now panel).
+        overrideReason: text("override_reason"),
+        // Legacy FocusState fields kept for backcompat with pre-Phase-3 writers.
+        reason: text("reason"),
+        expires: timestamp("expires", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    focusSkips = pgTable(
+      "focus_skips",
+      {
+        // Insertion-order key — reads order by this so the skip set keeps file order.
+        id: bigserial("id", { mode: "number" }).notNull().unique(),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // PK widened to (vault_id, user_id, spec_id): the same HS-XXXX id exists once
+        // PER VAULT, so a skip in vault A must not collide with (or hide) the same id
+        // in vault B. Strict superset of the old (user_id, spec_id) key — existing
+        // rows stay unique under it.
+        primaryKey({ columns: [table.vaultId, table.userId, table.specId] }),
+        // "this vault+user's skips in insertion order" — the list query.
+        index("focus_skips_user_order_idx").on(table.vaultId, table.userId, table.id)
+      ]
+    );
+    activeClaims = pgTable(
+      "active_claims",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. Part
+        // of the PK, so the atomic-acquire UNIQUE is per (vault, user, spec): vault A
+        // holding HS-XXXX no longer blocks vault B from claiming ITS OWN HS-XXXX.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        agentId: text("agent_id").notNull(),
+        sessionId: text("session_id").notNull(),
+        claimedAt: timestamp("claimed_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        // Live agent-lifecycle signals — mirror the file-side `ActiveClaim` shape from
+        // [[HS-TASK-0LU3]] so the On-Deck v2 surface can distinguish Working / Pending /
+        // Stale / Blocked when claims migrate off `.heyspex/active-claims.json` ([[HS-TASK-ACLM]]).
+        // `effectiveStatus` + `staleAt` stay derived at read time (not persisted).
+        status: activeClaimStatusEnum("status").notNull().default("working"),
+        lastActivityAt: timestamp("last_activity_at", { withTimezone: true }).notNull().default(sql`now()`),
+        /** Fast-death heartbeat ([[HS-TASK-A3FE]]); distinct from minutes-scale `expires_at` lease. */
+        heartbeatAt: timestamp("heartbeat_at", { withTimezone: true }),
+        pendingReason: pendingReasonEnum("pending_reason"),
+        pendingExcerpt: text("pending_excerpt"),
+        errorMessage: text("error_message"),
+        // Live agent work-stage ([[HS-EPIC-... What's Next Phase 2]]): the
+        // present-progressive verb the agent reports as it works (one of WORK_STAGES,
+        // e.g. "Drafting") and the 0-based acceptance-criterion index it is currently
+        // on. Both nullable — a claim need not report progress. Plain text/integer (not
+        // a pg enum) so the verb vocabulary can evolve without an enum migration; the
+        // closed list is enforced in code (src/lib/work-stages.ts) at the write route.
+        currentStage: text("current_stage"),
+        acProgress: integer("ac_progress"),
+        // Durable agent identity↔session binding ([[HS-EPIC-96YK]] AC#2): the
+        // identity `name` slug this claim is operating as (e.g. "code-reviewer"),
+        // so the Agents surface binds presence to the named identity instead of the
+        // best-effort agent-string match. Nullable — a claim need not declare one.
+        agentProfile: text("agent_profile"),
+        // Close-out verification gate ([[HS-EPIC-P2TR]]). `close_permitted` blocks the
+        // `in_review` flip until an independent verifier (or the deterministic manifest
+        // runner) grants it via the verification API — the implementer's self-reported
+        // `ac_progress` is demoted to a display-only claim. `close_granted_by` records
+        // the granting authority (agent id or "human"); `verification_ac_state` holds
+        // the per-criterion `AcCriterionState[]` provenance array.
+        closePermitted: boolean("close_permitted").notNull().default(false),
+        closeGrantedAt: timestamp("close_granted_at", { withTimezone: true }),
+        closeGrantedBy: text("close_granted_by"),
+        verificationAcState: jsonb("verification_ac_state").$type().notNull().default(sql`'[]'::jsonb`),
+        // Session-sequencer global order ([[HS-DO05-4U1E-EPIC-session-sequencer-in-the-console]] AC1):
+        // database-minted, strictly increasing across the table — therefore strictly
+        // increasing within every vault (gaps allowed; ordering is the contract).
+        sequence: bigserial("sequence", { mode: "number" }).notNull().unique(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId, table.specId] })]
+    );
+    claimWaiters = pgTable(
+      "claim_waiters",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        specId: text("spec_id").notNull(),
+        agentId: text("agent_id").notNull(),
+        sessionId: text("session_id").notNull(),
+        // Shared global order: DEFAULT nextval on the claims sequence, not a
+        // per-table bigserial (which would mint a second, unrelated counter).
+        sequence: bigint("sequence", { mode: "number" }).notNull().default(sql`nextval('active_claims_sequence_seq')`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "who is queued behind this spec, in order" — the grant + position query.
+        index("claim_waiters_spec_seq_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.sequence
+        )
+      ]
+    );
+    claimEvents = pgTable(
+      "claim_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: claimEventKindEnum("event_kind").notNull(),
+        specId: text("spec_id").notNull(),
+        agentId: text("agent_id").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "events for this spec, newest first" — the common query (NCPS §indexes).
+        index("claim_events_spec_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.timestamp.desc()
+        )
+      ]
+    );
+    focusEvents = pgTable(
+      "focus_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: focusEventKindEnum("event_kind").notNull(),
+        specId: text("spec_id"),
+        // null for `cleared`
+        actor: text("actor").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        index("focus_events_spec_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.timestamp.desc()
+        )
+      ]
+    );
+    focusAreas = pgTable(
+      "focus_areas",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. The
+        // band is per (vault, user): a tag band set in vault A must not lift specs
+        // in vault B.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        version: integer("version").notNull().default(1),
+        rationale: text("rationale"),
+        // The tag set the focus-band pipeline stage matches against (jsonb string[]).
+        tags: jsonb("tags").notNull().default(sql`'[]'::jsonb`),
+        updatedBy: text("updated_by"),
+        // agent · session that last wrote the band
+        // Reserved fuse — null means no expiry. A2 writes it; enforcement is deferred.
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    focusAreasEvents = pgTable(
+      "focus_areas_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: focusEventKindEnum("event_kind").notNull(),
+        actor: text("actor").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        index("focus_areas_events_ts_idx").on(table.vaultId, table.userId, table.timestamp.desc())
+      ]
+    );
+    specEvents = pgTable(
+      "spec_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        eventKind: specEventKindEnum("event_kind").notNull(),
+        specId: text("spec_id").notNull(),
+        actor: text("actor").notNull(),
+        timestamp: timestamp("timestamp", { withTimezone: true }).notNull().default(sql`now()`),
+        metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // High-traffic "events for spec X" query (<50ms target — NCPS AC #5).
+        index("spec_events_spec_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.timestamp.desc()
+        ),
+        // `?kind=` filtered query.
+        index("spec_events_spec_kind_ts_idx").on(
+          table.vaultId,
+          table.userId,
+          table.specId,
+          table.eventKind,
+          table.timestamp.desc()
+        )
+      ]
+    );
+    rateLimitBuckets = pgTable(
+      "rate_limit_buckets",
+      {
+        userId: text("user_id").notNull(),
+        bucket: text("bucket").notNull(),
+        windowStart: timestamp("window_start", { withTimezone: true }).notNull(),
+        count: integer("count").notNull().default(0),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        primaryKey({ columns: [table.userId, table.bucket, table.windowStart] }),
+        // Background reaper / dashboards: enumerate stale rows by `window_start`
+        // older than the longest live window. The hot path uses the composite PK.
+        index("rate_limit_buckets_window_idx").on(table.windowStart)
+      ]
+    );
+    userVaults = pgTable("user_vaults", {
+      userId: text("user_id").primaryKey(),
+      vaultRepo: text("vault_repo").notNull(),
+      /** GitHub App installation id — set by `/api/github/callback` before a vault is linked. */
+      installationId: integer("installation_id"),
+      vaultLocalPath: text("vault_local_path"),
+      repoName: text("repo_name"),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+    });
+    milestoneSnapshots = pgTable(
+      "milestone_snapshots",
+      {
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. Part
+        // of the PK: two vaults each hold their own frozen rank for the same
+        // milestone id.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        milestoneId: text("milestone_id").notNull(),
+        snapshotVersion: integer("snapshot_version").notNull().default(1),
+        snapshotAt: timestamp("snapshot_at", { withTimezone: true }).notNull().defaultNow(),
+        schedulerInputDigest: text("scheduler_input_digest"),
+        epicOrder: jsonb("epic_order").$type().notNull(),
+        appendedAfterSnapshot: jsonb("appended_after_snapshot").$type().notNull().default(sql`'{"epics":[],"tasks_by_epic":{}}'::jsonb`),
+        dormantAt: timestamp("dormant_at", { withTimezone: true })
+      },
+      (table) => [
+        primaryKey({ columns: [table.vaultId, table.userId, table.milestoneId] }),
+        // "active snapshot for vault+user" hot lookup — only non-dormant rows.
+        index("ms_user_active_idx").on(table.vaultId, table.userId).where(sql`${table.dormantAt} IS NULL`)
+      ]
+    );
+    modelRegistryEntries = pgTable(
+      "model_registry_entries",
+      {
+        id: text("id").notNull(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        model: text("model").notNull(),
+        agent: text("agent").notNull(),
+        shell: text("shell").notNull(),
+        enabled: boolean("enabled").notNull().default(true),
+        isDefault: boolean("is_default").notNull().default(false),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        primaryKey({ columns: [table.userId, table.id] }),
+        index("model_registry_entries_user_default_idx").on(table.userId, table.isDefault)
+      ]
+    );
+    launchIntentStatusEnum = pgEnum("launch_intent_status", [
+      "pending",
+      // emitted by the browser, not yet claimed by a companion
+      "claimed",
+      // a companion poller took it (claim-on-read) and is spawning
+      "done",
+      // the companion ACKed after spawning the local agent
+      "failed"
+      // the companion claimed it but the local spawn threw (see last_error)
+    ]);
+    launchIntents = pgTable(
+      "launch_intents",
+      {
+        id: text("id").primaryKey(),
+        // uuid, client-opaque intent id
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: `id` (a caller-minted uuid) stays the PK; `vault_id` is the
+        // READ/WRITE filter so the SAME owner's two vaults never drain each
+        // other's spawn/mint/mirror-send intents.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        // The `/hs-next <id>` target spec (idempotency key for the optimistic
+        // "Launching…" face); null for a bare `/hs-next` launch.
+        specId: text("spec_id"),
+        prompt: text("prompt").notNull(),
+        // the `/hs-next …` prompt to seed the agent
+        registryEntryId: text("registry_entry_id"),
+        agent: text("agent"),
+        /** When false, companion uses `cmd /c` on Windows so the tab closes when the agent exits. */
+        keepTerminalOpen: boolean("keep_terminal_open").notNull().default(true),
+        // Resolved launch target ([[HS-EPIC-JLTL]] model+effort assignment). Nullable
+        // and additive: an old companion simply ignores them and spawns with CLI
+        // defaults — exactly the pre-column behavior.
+        model: text("model"),
+        reasoningEffort: text("reasoning_effort"),
+        // Companion-reported spawn failure detail (status `failed`) — the write-back
+        // channel that lets the cloud UI stop toasting optimistic success.
+        lastError: text("last_error"),
+        status: launchIntentStatusEnum("status").notNull().default("pending"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // Set when a companion claims the intent (pending → claimed).
+        claimedAt: timestamp("claimed_at", { withTimezone: true }),
+        // TTL fuse — server-set on emit; the drain filters `expires_at > now()` and
+        // emit reaps already-expired rows so a dead browser tab can't strand work.
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Drain query: "oldest pending (non-expired) intents for this vault+user".
+        index("launch_intents_user_status_idx").on(
+          table.vaultId,
+          table.userId,
+          table.status,
+          table.createdAt
+        )
+      ]
+    );
+    companionRelayPresence = pgTable(
+      "companion_relay_presence",
+      {
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull()
+      },
+      (table) => [primaryKey({ columns: [table.userId, table.vaultId] })]
+    );
+    companionSettingsStore = pgTable(
+      "companion_settings",
+      {
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        settings: jsonb("settings").notNull(),
+        telemetry: jsonb("telemetry"),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.userId, table.vaultId] })]
+    );
+    wipLedger = pgTable(
+      "wip_ledger",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        /** Epic/spec id the hand-off belongs to (short id, e.g. "HS-COYG"). */
+        specId: text("spec_id").notNull(),
+        /** The full WipEntry blob — see `WipEntry` in `src/lib/wip-state.ts`. */
+        payload: jsonb("payload").notNull(),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.specId] })]
+    );
+    gatherResults = pgTable(
+      "gather_results",
+      {
+        jobId: text("job_id").notNull(),
+        idempotencyKey: text("idempotency_key").notNull(),
+        /** Per-page result entries — `[{ url, state: "cleaned"|"blocked"|"failed", ... }]`. */
+        pages: jsonb("pages").notNull(),
+        /**
+         * A research job's engine-level search account — `{ query,
+         * enginesAttempted, enginesAnswered, resultsFound, resultsGathered,
+         * summary, engines: [{ engine, answered, results, reason?, httpStatus? }] }`.
+         * Null for plain gather/crawl jobs (nothing was searched) and for uploads
+         * from Companions built before the report existed. This is what lets a
+         * zero-page search result say WHY it is empty
+         * ([[HS-RIZN-DIL5-DIAG-spexcrawl-search-returns-zero-pages-on]]).
+         */
+        search: jsonb("search"),
+        createdAt: timestamp("created_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.jobId, table.idempotencyKey] })]
+    );
+    agentSessions = pgTable(
+      "agent_sessions",
+      {
+        sessionId: text("session_id").primaryKey(),
+        // FK-by-convention to launch_intents.id — no hard FK, intents expire/sweep
+        // while the session row (and its usage history) must outlive them.
+        launchId: text("launch_id"),
+        ownerUserId: text("owner_user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]]) — mirrors `specs.vault_id`. The
+        // PK stays the vendor-minted `session_id` (a globally-unique uuid, not a
+        // per-vault sequence); `vault_id` is the READ/WRITE filter.
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        vendor: text("vendor").notNull(),
+        // "claude-code" now; enum grows later (read-only viewer vendors)
+        machine: text("machine"),
+        cwd: text("cwd"),
+        transcriptPath: text("transcript_path"),
+        // Session-chain lineage after /clear, /branch, /rewind, --fork-session.
+        parentSessionId: text("parent_session_id"),
+        status: text("status").notNull().default("live"),
+        // live | ended | stale
+        startedAt: timestamp("started_at", { withTimezone: true }).notNull().default(sql`now()`),
+        endedAt: timestamp("ended_at", { withTimezone: true }),
+        lastEventAt: timestamp("last_event_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // Launch drill-down: "sessions bound to this launch".
+        index("agent_sessions_launch_idx").on(table.launchId),
+        // "Live sessions on this machine" attach flow, scoped per vault.
+        index("agent_sessions_owner_status_idx").on(table.vaultId, table.ownerUserId, table.status)
+      ]
+    );
+    usageEvents = pgTable(
+      "usage_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        sessionId: text("session_id").notNull(),
+        launchId: text("launch_id"),
+        requestId: text("request_id").notNull(),
+        model: text("model").notNull(),
+        lane: text("lane").notNull(),
+        // subscription | api | bundled_local
+        inputTokens: integer("input_tokens").notNull(),
+        outputTokens: integer("output_tokens").notNull(),
+        cacheReadTokens: integer("cache_read_tokens").notNull(),
+        cacheCreationTokens: integer("cache_creation_tokens").notNull(),
+        cacheCreation5m: integer("cache_creation_5m"),
+        cacheCreation1h: integer("cache_creation_1h"),
+        isSidechain: boolean("is_sidechain").notNull().default(false),
+        at: timestamp("at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Keep-last dedupe key — the ingest route upserts on this so a re-POST of
+        // the same request_id overwrites rather than duplicates.
+        uniqueIndex("usage_events_session_request_idx").on(table.sessionId, table.requestId),
+        // Launch drill-down: "usage rows for this launch, in order".
+        index("usage_events_launch_at_idx").on(table.launchId, table.at)
+      ]
+    );
+    streamEvents = pgTable(
+      "stream_events",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        streamId: text("stream_id").notNull(),
+        // "mirror_session" now; "build" | "api" | "council" join later (HS-31Z5).
+        streamKind: text("stream_kind").notNull(),
+        // Producer-assigned dedupe key — stable across retries/transport hot-swaps.
+        eventUuid: text("event_uuid").notNull(),
+        eventType: text("event_type").notNull(),
+        // e.g. "turn" | "status"
+        payload: jsonb("payload").notNull(),
+        at: timestamp("at", { withTimezone: true }).notNull(),
+        // Short-retention TTL fuse — default now()+6h at insert; swept by cron.
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        // Producer dedupe — replays/hot-swaps land exactly once per (stream, uuid).
+        uniqueIndex("stream_events_stream_uuid_idx").on(table.streamId, table.eventUuid),
+        // Snapshot-on-connect: "rows for this stream, in order, after a cursor".
+        index("stream_events_stream_id_idx").on(table.streamId, table.id)
+      ]
+    );
+    jobStreams = pgTable(
+      "job_streams",
+      {
+        jobId: text("job_id").primaryKey(),
+        kind: text("kind").notNull(),
+        // build | api | council
+        // FK-by-convention to launch_intents.id — no hard FK, same reasoning as
+        // agent_sessions.launch_id (intents expire/sweep, the job row must outlive them).
+        launchId: text("launch_id"),
+        provider: text("provider"),
+        // e.g. "deepseek" — the tile's `source`
+        model: text("model"),
+        seat: text("seat"),
+        // routing-table seat name (dev-factory/routing-table.json)
+        machine: text("machine"),
+        status: text("status").notNull().default("queued"),
+        // queued | running | done | failed
+        startedAt: timestamp("started_at", { withTimezone: true }).notNull().default(sql`now()`),
+        endedAt: timestamp("ended_at", { withTimezone: true }),
+        lastEventAt: timestamp("last_event_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "Live-ish jobs" read for the unioned stream list.
+        index("job_streams_status_idx").on(table.status),
+        // Launch drill-down: "job streams bound to this launch".
+        index("job_streams_launch_idx").on(table.launchId)
+      ]
+    );
+    resolutionStatusEnum = pgEnum("resolution_status", [
+      "open",
+      "resolved",
+      "dismissed",
+      "deferred"
+    ]);
+    resolutionFocusPin = pgTable(
+      "resolution_focus_pin",
+      {
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        itemKey: text("item_key").notNull(),
+        pinnedBy: text("pinned_by").notNull(),
+        pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.userId] })]
+    );
+    resolutionLedger = pgTable(
+      "resolution_ledger",
+      {
+        id: bigserial("id", { mode: "number" }).primaryKey(),
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        // Tenant-isolation scope ([[HS-ZP5H-TASK]] GAP 2) — mirrors `specs.vault_id`.
+        // Additive: the `id` PK is untouched (append-only log, no upsert key).
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        itemKey: text("item_key").notNull(),
+        status: resolutionStatusEnum("status").$type().notNull(),
+        reason: text("reason"),
+        deferUntil: timestamp("defer_until", { withTimezone: true }),
+        at: timestamp("at", { withTimezone: true }).notNull().default(sql`now()`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // Fold-on-read hot path: newest status row per (vault, user, item_key).
+        index("resolution_ledger_user_item_at_idx").on(
+          table.vaultId,
+          table.userId,
+          table.itemKey,
+          table.at.desc()
+        )
+      ]
+    );
+    workspaces = pgTable("workspaces", {
+      id: text("id").primaryKey(),
+      accountId: text("account_id").notNull(),
+      displayName: text("display_name").notNull(),
+      githubOrg: text("github_org"),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      /**
+       * Reversible soft-remove flag (Close-is-not-Destroy,
+       * [[HS-NBV9-EKLJ-TASK-archive-restore-and-the-close-is-not]]) — distinct
+       * from `DELETE /api/workspaces/:id` unregister, which drops the row
+       * entirely. An archived workspace stays in Neon/registry.json but is
+       * excluded from the default active list.
+       */
+      archived: boolean("archived").notNull().default(false)
+    });
+    vaults = pgTable("vaults", {
+      id: text("id").primaryKey(),
+      workspaceId: text("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+      accountId: text("account_id").notNull(),
+      displayName: text("display_name").notNull(),
+      repoRootAbs: text("repo_root_abs"),
+      githubRemote: text("github_remote"),
+      schemaVersion: integer("schema_version").notNull().default(1),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`),
+      /** Vault equivalent of `workspaces.archived` — see that column's doc comment. */
+      archived: boolean("archived").notNull().default(false)
+    });
+    accountSettings = pgTable("account_settings", {
+      accountId: text("account_id").primaryKey(),
+      activeWorkspaceId: text("active_workspace_id").references(() => workspaces.id, {
+        onDelete: "set null"
+      }),
+      activeVaultId: text("active_vault_id").references(() => vaults.id, { onDelete: "set null" }),
+      // Admin dev/prod mode control (epic HS-Q6M2): the CLOUD rung of the dev-mode
+      // resolution order (env → ~/.heyspex/dev-mode.json → THIS → default prod).
+      // Shape: { mode: "prod"|"dev", reliance: "local"|"cloud", updated_at, source }.
+      // Readers/writers MUST tolerate the column being absent (migration 0050 may
+      // not have run yet on a given database) — catch 42703 and treat as unset.
+      devMode: jsonb("dev_mode"),
+      createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+      updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+    });
+    vaultGrants = pgTable(
+      "vault_grants",
+      {
+        vaultId: text("vault_id").notNull().references(() => vaults.id, { onDelete: "cascade" }),
+        accountId: text("account_id").notNull(),
+        access: text("access").notNull().default("read"),
+        grantedBy: text("granted_by").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.vaultId, table.accountId] })]
+    );
+    githubInstallations = pgTable(
+      "github_installations",
+      {
+        accountId: text("account_id").notNull(),
+        githubAccountLogin: text("github_account_login").notNull(),
+        installationId: integer("installation_id").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.accountId, table.githubAccountLogin] })]
+    );
+    fleetMachines = pgTable(
+      "fleet_machines",
+      {
+        machineKey: text("machine_key").primaryKey(),
+        label: text("label"),
+        gpu: text("gpu"),
+        vramMb: integer("vram_mb"),
+        ramMb: integer("ram_mb"),
+        architecture: text("architecture"),
+        // cuda | rocm | cpu
+        os: text("os"),
+        companionVersion: text("companion_version"),
+        /**
+         * Owning account, stamped from the redeemed join code's issuer at
+         * `POST /api/fleet/join` ([[HS-DOD0-DIAG-fleet-tables-have-no-account-linkage]]).
+         * Nullable: bearer-only `POST /api/fleet/register` registrations and
+         * pre-migration machines have no attributable account ("unattributed" is the
+         * honest state, not a fabricated owner default). The upsert COALESCEs so a
+         * bearer re-register never overwrites a set account_id with null. Prerequisite
+         * for per-account fleet isolation ([[HS-TNTI-EPIC-saas-multi-tenant-isolation]]).
+         */
+        accountId: text("account_id"),
+        /**
+         * Task kinds this machine is willing to run ([[HS-60Z1-EPIC]]). NULL = any kind
+         * (the pre-existing behavior, preserved for machines registered before this
+         * column existed). Eligibility used to be model-only, so a build box could claim
+         * a `research` task it had no way to execute — `claimNextTask` now also filters
+         * on this list when it is set.
+         */
+        eligibleKinds: text("eligible_kinds").array(),
+        lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+        registeredAt: timestamp("registered_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [index("fleet_machines_account_idx").on(table.accountId)]
+    );
+    fleetTasks = pgTable(
+      "fleet_tasks",
+      {
+        taskId: text("task_id").primaryKey(),
+        kind: text("kind").notNull(),
+        // build | breakdown | research | ...
+        modelId: text("model_id"),
+        spec: jsonb("spec").notNull(),
+        target: text("target"),
+        budgetMaxSeconds: integer("budget_max_seconds"),
+        status: text("status").notNull().default("queued"),
+        // queued|claimed|running|done|failed|cancelled
+        claimedBy: text("claimed_by").references(() => fleetMachines.machineKey),
+        claimedAt: timestamp("claimed_at", { withTimezone: true }),
+        lastProgressAt: timestamp("last_progress_at", { withTimezone: true }),
+        /**
+         * The fleet-queue lane ([[HS-60Z1-EPIC]]) — a free-form name for a gated resource
+         * whose work waits its turn (`research-firecrawl`, `build-gpu0`, …). Deliberately
+         * NOT folded into `kind`: `kind` is an existing taxonomy (build|breakdown|research)
+         * that the companion's model-eligibility matching already consumes, and overloading
+         * it would change what shipped callers claim. NULL = a plain dispatch task with no
+         * lane, i.e. every task written before this column existed.
+         */
+        lane: text("lane"),
+        /** Who asked for this work (agent id / session). First-class so the queue can be filtered by requester. */
+        requestedBy: text("requested_by"),
+        /**
+         * Stale-claim provenance. The stall sweep resets `claimed_by` to NULL so a healthy
+         * machine can re-claim; without these two columns the identity of the machine that
+         * dropped the task is erased, and "who had it before it went stale" is unanswerable.
+         * The sweep copies claimed_by/claimed_at here before nulling them, so a reclaim is
+         * visible (`reclaimed: true`) rather than silent.
+         */
+        lastClaimant: text("last_claimant"),
+        lastClaimedAt: timestamp("last_claimed_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [
+        index("fleet_tasks_status_created_idx").on(table.status, table.createdAt),
+        // Lane-scoped peek / rank / list — the fleet-queue read path ([[HS-60Z1-EPIC]]).
+        index("fleet_tasks_lane_status_created_idx").on(table.lane, table.status, table.createdAt)
+      ]
+    );
+    fleetResults = pgTable(
+      "fleet_results",
+      {
+        taskId: text("task_id").references(() => fleetTasks.taskId),
+        idempotencyKey: text("idempotency_key").notNull(),
+        machineKey: text("machine_key").references(() => fleetMachines.machineKey),
+        status: text("status").notNull(),
+        // done | failed
+        reason: text("reason"),
+        result: jsonb("result"),
+        artifacts: jsonb("artifacts"),
+        commitSha: text("commit_sha"),
+        reportedAt: timestamp("reported_at", { withTimezone: true }).default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.taskId, table.idempotencyKey] })]
+    );
+    userApiKeys = pgTable(
+      "user_api_keys",
+      {
+        userId: text("user_id").notNull().default(SINGLE_USER_ID),
+        /** Provider id — validated app-side against `API_KEY_PROVIDERS`. */
+        provider: text("provider").notNull(),
+        // Envelope-encryption fields (all base64). See lib/keys/crypto.ts.
+        ciphertext: text("ciphertext").notNull(),
+        iv: text("iv").notNull(),
+        authTag: text("auth_tag").notNull(),
+        wrappedDek: text("wrapped_dek").notNull(),
+        wrapIv: text("wrap_iv").notNull(),
+        wrapAuthTag: text("wrap_auth_tag").notNull(),
+        /** Which KEK version wrapped the data key (rotation selector). */
+        keyVersion: integer("key_version").notNull().default(1),
+        /** Trailing 4 chars of the plaintext — masked-display projection only. */
+        last4: text("last4").notNull(),
+        /** Best-effort verify-on-save result: unverified | valid | invalid. */
+        verificationStatus: text("verification_status").notNull().default("unverified"),
+        verifiedAt: timestamp("verified_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [primaryKey({ columns: [table.userId, table.provider] })]
+    );
+    apiKeys = pgTable(
+      "api_keys",
+      {
+        id: text("id").primaryKey(),
+        // opaque key id (uuid), minted at creation — never the raw key
+        keyHash: text("key_hash").notNull(),
+        // SHA-256 hex digest of the raw key; the raw key itself is never stored
+        keyPrefix: text("key_prefix").notNull(),
+        // short non-secret prefix for masked display + lookup
+        scopes: text("scopes").array().notNull(),
+        accountId: text("account_id").notNull().default(SINGLE_USER_ID),
+        status: text("status").notNull().default("active"),
+        // active | expiring | revoked
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+        expiresAt: timestamp("expires_at", { withTimezone: true })
+      },
+      (table) => [
+        // Presented-key lookup path: verifyApiKey resolves by prefix, then
+        // compares the hash. One key can never collide with another's prefix.
+        uniqueIndex("api_keys_prefix_uq").on(table.keyPrefix),
+        // Per-account listing + the max-active-keys-per-account enforcement scan.
+        index("api_keys_account_status_idx").on(table.accountId, table.status)
+      ]
+    );
+    mcpSessions = pgTable(
+      "mcp_sessions",
+      {
+        id: text("id").primaryKey(),
+        // first 12 hex chars of the token hash — list/revoke/audit reference
+        tokenHash: text("token_hash").notNull(),
+        // SHA-256 hex digest of the raw `hsmcp_...` token
+        userId: text("user_id").notNull(),
+        // Clerk userId (or SINGLE_USER_ID) the token authenticates as
+        label: text("label"),
+        // optional human label ("laptop MCP", "CI runner", …)
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+        revokedAt: timestamp("revoked_at", { withTimezone: true })
+      },
+      (table) => [
+        // Presented-token lookup: verify hashes the FULL presented token and scans
+        // for a match — this index is for per-account listing, not the verify path
+        // (the verify path has no indexable prefix to look up by; the sessions
+        // table is expected to stay small — one row per paired machine/agent).
+        index("mcp_sessions_user_idx").on(table.userId)
+      ]
+    );
+    pairingCodes = pgTable(
+      "pairing_codes",
+      {
+        id: text("id").primaryKey(),
+        // first 8 hex chars of the code hash — audit/revoke reference
+        hash: text("hash").notNull(),
+        // SHA-256 hex digest of the plaintext code
+        userId: text("user_id").notNull(),
+        // Clerk userId (or SINGLE_USER_ID) that minted the code
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+        usedAt: timestamp("used_at", { withTimezone: true }),
+        usedBy: text("used_by"),
+        // machineKey that redeemed the code, if supplied
+        revokedAt: timestamp("revoked_at", { withTimezone: true }),
+        note: text("note")
+        // display/audit hint only ("mcp", …) — no effect on redemption
+      },
+      (table) => [index("pairing_codes_user_idx").on(table.userId)]
+    );
+    companionSessions = pgTable(
+      "companion_sessions",
+      {
+        id: text("id").primaryKey(),
+        // first 12 hex chars of the token hash — list/revoke/audit reference
+        tokenHash: text("token_hash").notNull(),
+        // SHA-256 hex digest of the raw `hscmp_...` token
+        userId: text("user_id").notNull(),
+        machineKey: text("machine_key"),
+        // machineKey presented at pairing, if any
+        label: text("label"),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`),
+        lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+        revokedAt: timestamp("revoked_at", { withTimezone: true })
+      },
+      (table) => [index("companion_sessions_user_idx").on(table.userId)]
+    );
+    inviteRequests = pgTable(
+      "invite_requests",
+      {
+        id: text("id").primaryKey(),
+        // uuid minted by the webhook receiver
+        email: text("email").notNull(),
+        name: text("name"),
+        /** Plan the requester expects to need: free | pro | team. A planning signal, not a commitment. */
+        tier: text("tier").notNull().default("free"),
+        /** Optional free-text context: what they are building / how they use agents. */
+        building: text("building"),
+        status: text("status").notNull().default("new"),
+        // new | invited | declined
+        /** Clerk invitation id, set when an approval actually issues one. */
+        clerkInvitationId: text("clerk_invitation_id"),
+        /** Account id of the admin who approved/declined — audit trail for the decision. */
+        reviewedBy: text("reviewed_by"),
+        reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
+        /** Intake metadata forwarded from the Worker, for spam triage. */
+        sourceIp: text("source_ip"),
+        userAgent: text("user_agent"),
+        /**
+         * Double opt-in completion. Rows only reach this table AFTER the requester
+         * clicked the confirmation link, so in practice this is always set — it is
+         * stored anyway because "when did they verify?" is part of the consent
+         * evidence, and a future intake path might relax that ordering.
+         */
+        confirmedAt: timestamp("confirmed_at", { withTimezone: true }),
+        /**
+         * The OPTIONAL marketing opt-in — deliberately distinct from the required
+         * privacy agreement, which is a condition of using the form and therefore
+         * not evidence of marketing consent. Only this flag may be used to justify
+         * sending marketing email.
+         */
+        marketingConsent: boolean("marketing_consent").notNull().default(false),
+        /**
+         * Version tag of the exact on-page wording the requester agreed to
+         * (`CONSENT_TEXT_VERSION` in heyspex-com/src/lib/consent-text.ts). Without
+         * this, editing the copy would silently rewrite what every historical row
+         * appears to have consented to.
+         */
+        consentTextVersion: text("consent_text_version"),
+        /** When the marketing site recorded it (NOT when the webhook landed). */
+        requestedAt: timestamp("requested_at", { withTimezone: true }).notNull().default(sql`now()`),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // The upsert key — one row per requester, re-submits update in place.
+        uniqueIndex("invite_requests_email_uq").on(table.email),
+        // The admin surface's default read: pending first, newest first.
+        index("invite_requests_status_requested_idx").on(table.status, table.requestedAt)
+      ]
+    );
+    notifications = pgTable(
+      "notifications",
+      {
+        id: text("id").primaryKey(),
+        // uuid
+        /** Recipient. Every read path filters on this — notifications are never global. */
+        accountId: text("account_id").notNull().default(SINGLE_USER_ID),
+        /** Event type, e.g. `invite_request`. Open vocabulary by design (see above). */
+        kind: text("kind").notNull(),
+        title: text("title").notNull(),
+        /** One-line supporting detail shown under the title in the dropdown. */
+        body: text("body"),
+        /** Where clicking the notification should take the user (in-app path). */
+        href: text("href"),
+        /**
+         * Kind-specific structured data (e.g. `{ inviteRequestId, email, tier }`).
+         * Keeps the table stable as new kinds arrive.
+         */
+        payload: jsonb("payload"),
+        /**
+         * Idempotency key for the producing event (e.g. `invite_request:<email>`).
+         * A webhook retry must surface ONE bell item, not one per delivery attempt.
+         */
+        dedupeKey: text("dedupe_key"),
+        readAt: timestamp("read_at", { withTimezone: true }),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // The bell's two queries: unread count, and the recent list — both scoped
+        // to the recipient and ordered newest-first.
+        index("notifications_account_created_idx").on(table.accountId, table.createdAt),
+        // Retry-safe producers: one row per (recipient, event).
+        uniqueIndex("notifications_account_dedupe_uq").on(table.accountId, table.dedupeKey)
+      ]
+    );
+    webhookIngestions = pgTable(
+      "webhook_ingestions",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        repo: text("repo").notNull(),
+        // `owner/repo`, from `repository.full_name`
+        branch: text("branch").notNull(),
+        // from `ref`, `refs/heads/` stripped
+        commitSha: text("commit_sha").notNull(),
+        message: text("message").notNull(),
+        authorName: text("author_name").notNull(),
+        authorEmail: text("author_email").notNull(),
+        path: text("path").notNull(),
+        // changed file's repo-relative path
+        ingestedAt: timestamp("ingested_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // A retried/duplicate delivery for the same (repo, commit, path) must not
+        // record twice — GitHub does redeliver on timeout/5xx.
+        uniqueIndex("webhook_ingestions_repo_commit_path_uq").on(
+          table.repo,
+          table.commitSha,
+          table.path
+        )
+      ]
+    );
+    specSettlements = pgTable(
+      "spec_settlements",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        specId: text("spec_id").notNull(),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        repo: text("repo").notNull(),
+        // `owner/name`
+        branch: text("branch").notNull(),
+        commitSha: text("commit_sha").notNull(),
+        settledAt: timestamp("settled_at", { withTimezone: true }).notNull().default(sql`now()`)
+      },
+      (table) => [
+        // "latest settlement for this spec" — the read path's only query.
+        index("spec_settlements_spec_settled_idx").on(table.specId, table.settledAt.desc())
+      ]
+    );
+  }
+});
+
+// spex-console/src/lib/vault-registry/neon-probe.ts
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new NeonProbeTimeoutError(label, ms)), ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    );
+  });
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function emitProbeFailure(options, failure) {
+  try {
+    options?.onFailure?.(failure);
+  } catch {
+  }
+}
+async function runNeonReachabilityProbe(attempt, options = {}, label = "Neon reachability probe") {
+  const timeoutMs = options.timeoutMs ?? NEON_PROBE_TIMEOUT_MS;
+  const backoffMs = options.backoffMs ?? [];
+  const deadlineMs = options.deadlineMs ?? Number.POSITIVE_INFINITY;
+  const attempts = backoffMs.length + 1;
+  let startedAt = Date.now();
+  let suspensions = 0;
+  for (let i = 0; i < attempts; i++) {
+    const attemptStartedAt = Date.now();
+    try {
+      await withTimeout(Promise.resolve().then(attempt), timeoutMs, label);
+      return true;
+    } catch (err) {
+      const elapsedMs = Date.now() - attemptStartedAt;
+      const suspended = elapsedMs >= timeoutMs * SUSPENSION_ELAPSED_FACTOR && elapsedMs - timeoutMs >= SUSPENSION_MIN_OVERSHOOT_MS;
+      if (suspended && suspensions < MAX_SUSPENSION_RETRIES) {
+        suspensions += 1;
+        emitProbeFailure(options, {
+          reason: "suspended",
+          attempt: i + 1,
+          attempts,
+          timeoutMs,
+          elapsedMs,
+          willRetry: true,
+          error: err
+        });
+        startedAt = Date.now();
+        i -= 1;
+        continue;
+      }
+      const isLast = i === attempts - 1;
+      const pastDeadline = Date.now() - startedAt >= deadlineMs;
+      const willRetry = !isLast && !pastDeadline;
+      emitProbeFailure(options, {
+        reason: err instanceof NeonProbeTimeoutError ? "timeout" : "error",
+        attempt: i + 1,
+        attempts,
+        timeoutMs,
+        elapsedMs,
+        willRetry,
+        error: err
+      });
+      if (!willRetry) return false;
+      await sleep(backoffMs[i]);
+    }
+  }
+  return false;
+}
+var NEON_PROBE_TIMEOUT_MS, SUSPENSION_ELAPSED_FACTOR, SUSPENSION_MIN_OVERSHOOT_MS, MAX_SUSPENSION_RETRIES, NeonProbeTimeoutError;
+var init_neon_probe = __esm({
+  "spex-console/src/lib/vault-registry/neon-probe.ts"() {
+    "use strict";
+    NEON_PROBE_TIMEOUT_MS = 1500;
+    SUSPENSION_ELAPSED_FACTOR = 3;
+    SUSPENSION_MIN_OVERSHOOT_MS = 5e3;
+    MAX_SUSPENSION_RETRIES = 2;
+    NeonProbeTimeoutError = class _NeonProbeTimeoutError extends Error {
+      timeoutMs;
+      constructor(label, timeoutMs) {
+        super(`${label} timed out after ${timeoutMs}ms`);
+        this.name = "NeonProbeTimeoutError";
+        this.timeoutMs = timeoutMs;
+        Object.setPrototypeOf(this, _NeonProbeTimeoutError.prototype);
+      }
+    };
+  }
+});
+
+// spex-console/src/lib/vault-registry/types.ts
+function emptyVaultRegistry() {
+  return {
+    schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    workspaces: [],
+    vaults: [],
+    active_workspace_id: null,
+    active_vault_id: null
+  };
+}
+var VAULT_REGISTRY_SCHEMA_VERSION;
+var init_types = __esm({
+  "spex-console/src/lib/vault-registry/types.ts"() {
+    "use strict";
+    VAULT_REGISTRY_SCHEMA_VERSION = 1;
+  }
+});
+
+// spex-console/src/lib/vault-registry/registry-file.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync4, renameSync, writeFileSync } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname, join as join3 } from "node:path";
+function vaultRegistryDir(opts = {}) {
+  return opts.registryDir ?? join3(homedir3(), ".heyspex");
+}
+function vaultRegistryFilePath(opts = {}) {
+  return join3(vaultRegistryDir(opts), "registry.json");
+}
+function isNonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+function normalizeWorkspace(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  if (!isNonEmptyString(o.id)) return null;
+  if (!isNonEmptyString(o.display_name)) return null;
+  if (!isNonEmptyString(o.created_at)) return null;
+  const record = {
+    id: o.id,
+    display_name: o.display_name,
+    created_at: o.created_at,
+    archived: o.archived === true
+  };
+  if (isNonEmptyString(o.github_org)) record.github_org = o.github_org;
+  return record;
+}
+function normalizeVault(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  if (!isNonEmptyString(o.id)) return null;
+  if (!isNonEmptyString(o.workspace_id)) return null;
+  if (!isNonEmptyString(o.display_name)) return null;
+  if (!isNonEmptyString(o.repo_root_abs)) return null;
+  if (typeof o.schema_version !== "number") return null;
+  if (!isNonEmptyString(o.registered_at)) return null;
+  const record = {
+    id: o.id,
+    workspace_id: o.workspace_id,
+    display_name: o.display_name,
+    repo_root_abs: o.repo_root_abs,
+    schema_version: o.schema_version,
+    registered_at: o.registered_at,
+    archived: o.archived === true
+  };
+  if (isNonEmptyString(o.github_remote)) record.github_remote = o.github_remote;
+  return record;
+}
+function parseVaultRegistryFile(json) {
+  const fallback = emptyVaultRegistry();
+  if (!json || typeof json !== "object") return fallback;
+  const o = json;
+  const workspacesRaw = Array.isArray(o.workspaces) ? o.workspaces : [];
+  const workspaces2 = workspacesRaw.map(normalizeWorkspace).filter((w) => w !== null);
+  const vaultsRaw = Array.isArray(o.vaults) ? o.vaults : [];
+  const vaults2 = vaultsRaw.map(normalizeVault).filter((v) => v !== null);
+  const active_workspace_id = isNonEmptyString(o.active_workspace_id) ? o.active_workspace_id : null;
+  const active_vault_id = isNonEmptyString(o.active_vault_id) ? o.active_vault_id : null;
+  return {
+    schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    workspaces: workspaces2,
+    vaults: vaults2,
+    active_workspace_id,
+    active_vault_id
+  };
+}
+function loadVaultRegistry(opts = {}) {
+  const filePath = vaultRegistryFilePath(opts);
+  if (!existsSync(filePath)) return emptyVaultRegistry();
+  try {
+    const raw = readFileSync4(filePath, "utf8");
+    return parseVaultRegistryFile(JSON.parse(raw));
+  } catch {
+    return emptyVaultRegistry();
+  }
+}
+function writeVaultRegistry(registry, opts = {}) {
+  const filePath = vaultRegistryFilePath(opts);
+  mkdirSync(dirname(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp`;
+  writeFileSync(tmpPath, `${JSON.stringify(registry, null, 2)}
+`, "utf8");
+  renameSync(tmpPath, filePath);
+}
+function isValidId(id) {
+  if (!isNonEmptyString(id)) return false;
+  if (id.includes("/") || id.includes("\\")) return false;
+  if (id === "." || id === "..") return false;
+  return true;
+}
+function registerWorkspace(record, opts = {}) {
+  if (!isValidId(record.id)) {
+    throw new Error(`registerWorkspace: invalid workspace id "${record.id}"`);
+  }
+  const registry = loadVaultRegistry(opts);
+  const idx = registry.workspaces.findIndex((w) => w.id === record.id);
+  if (idx >= 0) {
+    registry.workspaces[idx] = { ...record };
+  } else {
+    registry.workspaces.push({ ...record });
+  }
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+function setActiveWorkspaceId(workspaceId, opts = {}) {
+  const registry = loadVaultRegistry(opts);
+  registry.active_workspace_id = workspaceId;
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+function removeWorkspace(id, opts = {}) {
+  const registry = loadVaultRegistry(opts);
+  registry.workspaces = registry.workspaces.filter((w) => w.id !== id);
+  if (registry.active_workspace_id === id) {
+    registry.active_workspace_id = null;
+  }
+  writeVaultRegistry(registry, opts);
+  return registry;
+}
+var init_registry_file = __esm({
+  "spex-console/src/lib/vault-registry/registry-file.ts"() {
+    "use strict";
+    init_types();
+    init_types();
+  }
+});
+
+// spex-console/src/lib/vault-registry/account-pointer.ts
+async function isNeonReachable(deps) {
+  if (deps.neonReachable !== void 0) return deps.neonReachable;
+  const usingInjectedDb = deps.db !== void 0;
+  if (!usingInjectedDb && !isPostgresConfigured()) {
+    emitProbeFailure(deps.probe, {
+      reason: "not-configured",
+      attempt: 1,
+      attempts: 1,
+      timeoutMs: 0,
+      elapsedMs: 0,
+      willRetry: false,
+      error: new Error(
+        "isPostgresConfigured() is false \u2014 no DATABASE_URL env var and no usable ~/.heyspex/credentials.yaml. Neon was never contacted."
+      )
+    });
+    return false;
+  }
+  return runNeonReachabilityProbe(async () => {
+    const db = deps.db ?? getPostgresDb();
+    await db.execute(sql`select 1`);
+  }, deps.probe);
+}
+async function accountSettingsRow(accountId2, db) {
+  const rows = await db.select().from(accountSettings).where(eq(accountSettings.accountId, accountId2)).limit(1);
+  return rows[0] ?? null;
+}
+async function upsertAccountSettings(accountId2, patch, db) {
+  const now = /* @__PURE__ */ new Date();
+  await db.insert(accountSettings).values({ accountId: accountId2, ...patch, createdAt: now, updatedAt: now }).onConflictDoUpdate({
+    target: accountSettings.accountId,
+    set: { ...patch, updatedAt: now }
+  });
+}
+async function workspaceExistsInNeon(accountId2, workspaceId, db) {
+  const rows = await db.select({ id: workspaces.id }).from(workspaces).where(and(eq(workspaces.id, workspaceId), eq(workspaces.accountId, accountId2))).limit(1);
+  return rows.length > 0;
+}
+function workspaceExistsInRegistry(workspaceId, opts) {
+  return loadVaultRegistry(opts).workspaces.some((w) => w.id === workspaceId);
+}
+async function getActiveWorkspace(accountId2, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    const row = await accountSettingsRow(accountId2, db);
+    return row?.activeWorkspaceId ?? null;
+  }
+  return loadVaultRegistry(deps.registryOpts).active_workspace_id;
+}
+async function setActiveWorkspace(accountId2, workspaceId, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    if (!await workspaceExistsInNeon(accountId2, workspaceId, db)) {
+      throw new UnknownWorkspaceIdError(workspaceId);
+    }
+    await upsertAccountSettings(accountId2, { activeWorkspaceId: workspaceId }, db);
+    return;
+  }
+  const registryOpts = deps.registryOpts ?? {};
+  if (!workspaceExistsInRegistry(workspaceId, registryOpts)) {
+    throw new UnknownWorkspaceIdError(workspaceId);
+  }
+  setActiveWorkspaceId(workspaceId, registryOpts);
+}
+async function clearActiveWorkspace(accountId2, deps = {}) {
+  if (await isNeonReachable(deps)) {
+    const db = deps.db ?? getPostgresDb();
+    await upsertAccountSettings(accountId2, { activeWorkspaceId: null }, db);
+    return;
+  }
+  setActiveWorkspaceId(null, deps.registryOpts ?? {});
+}
+var UnknownWorkspaceIdError;
+var init_account_pointer = __esm({
+  "spex-console/src/lib/vault-registry/account-pointer.ts"() {
+    "use strict";
+    init_sql_orm_inert_cli_shim();
+    init_postgres_client_cli_shim();
+    init_postgres();
+    init_neon_probe();
+    init_registry_file();
+    UnknownWorkspaceIdError = class extends Error {
+      workspaceId;
+      constructor(workspaceId) {
+        super(
+          `setActiveWorkspace: unknown workspace id "${workspaceId}" \u2014 no matching row in Neon "workspaces" or registry.json's workspaces[] list. Nothing was written.`
+        );
+        this.name = "UnknownWorkspaceIdError";
+        this.workspaceId = workspaceId;
+      }
+    };
+  }
+});
+
+// spex-console/src/lib/vault-registry/repo-identity.ts
+import path2 from "node:path";
+var init_repo_identity = __esm({
+  "spex-console/src/lib/vault-registry/repo-identity.ts"() {
+    "use strict";
+  }
+});
+
+// spex-console/src/lib/cli/vault-workspace-shared.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+function resolveCliAccountId(opts = {}) {
+  const env = opts.env ?? process.env;
+  const fromEnv = env.HS_ACCOUNT_ID?.trim();
+  if (fromEnv) return fromEnv;
+  try {
+    const homeDir = opts.homeDir ?? os2.homedir();
+    const readFile2 = opts.readFile ?? ((p) => readFileSync5(p, "utf-8"));
+    const config = readFile2(path3.join(homeDir, ".heyspex", "config.yaml"));
+    const match = config.match(/^account_id:\s*["']?([^"'\r\n#]+)/m);
+    const value = match?.[1]?.trim();
+    if (value && value.length > 0) return value;
+  } catch {
+  }
+  return DEFAULT_ACCOUNT_ID;
+}
+async function cloudHttpRequest(http, method, path5, body) {
+  try {
+    const res = await http.fetchImpl(`${http.consoleUrl}${path5}`, {
+      method,
+      headers: {
+        "content-type": "application/json",
+        ...http.token ? { authorization: `Bearer ${http.token}` } : {}
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { ok: res.ok, status: res.status, json };
+  } catch {
+    return { ok: false, status: 0, json: null };
+  }
+}
+function shouldUseCloudHttp(deps) {
+  return deps.db === void 0 && deps.http !== void 0 && !isPostgresConfigured();
+}
+async function upsertWorkspaceHttp(record, http) {
+  const res = await cloudHttpRequest(http, "POST", "/api/workspaces", {
+    id: record.id,
+    display_name: record.displayName,
+    ...record.githubOrg ? { github_org: record.githubOrg } : {}
+  });
+  return res.status === 201 || res.status === 409;
+}
+async function insertWorkspaceStrictHttp(record, http) {
+  const res = await cloudHttpRequest(http, "POST", "/api/workspaces", {
+    id: record.id,
+    display_name: record.displayName,
+    ...record.githubOrg ? { github_org: record.githubOrg } : {}
+  });
+  if (res.status === 201) return "inserted";
+  if (res.status === 409) return "conflict";
+  return "unreachable";
+}
+async function isNeonReachableForWrite(deps) {
+  if (deps.neonReachable !== void 0) return deps.neonReachable;
+  const usingInjectedDb = deps.db !== void 0;
+  if (!usingInjectedDb && !isPostgresConfigured()) {
+    emitProbeFailure(deps.probe, {
+      reason: "not-configured",
+      attempt: 1,
+      attempts: 1,
+      timeoutMs: 0,
+      elapsedMs: 0,
+      willRetry: false,
+      error: new Error(
+        "isPostgresConfigured() is false \u2014 no DATABASE_URL env var and no usable ~/.heyspex/credentials.yaml. Neon was never contacted."
+      )
+    });
+    return false;
+  }
+  return runNeonReachabilityProbe(async () => {
+    const db = deps.db ?? getPostgresDb();
+    await db.execute(sql`select 1`);
+  }, deps.probe);
+}
+async function upsertWorkspaceNeon(record, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) return upsertWorkspaceHttp(record, deps.http);
+  if (!await isNeonReachableForWrite(deps)) return false;
+  try {
+    const db = deps.db ?? getPostgresDb();
+    await db.insert(workspaces).values({
+      id: record.id,
+      accountId: accountId2,
+      displayName: record.displayName,
+      ...record.githubOrg ? { githubOrg: record.githubOrg } : {}
+    }).onConflictDoUpdate({
+      target: workspaces.id,
+      set: {
+        displayName: record.displayName,
+        ...record.githubOrg ? { githubOrg: record.githubOrg } : {}
+      }
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function insertWorkspaceNeonStrict(record, accountId2, deps = {}) {
+  if (shouldUseCloudHttp(deps)) return insertWorkspaceStrictHttp(record, deps.http);
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.insert(workspaces).values({
+      id: record.id,
+      accountId: accountId2,
+      displayName: record.displayName,
+      ...record.githubOrg ? { githubOrg: record.githubOrg } : {}
+    }).onConflictDoNothing({ target: workspaces.id }).returning({ id: workspaces.id });
+    return rows.length > 0 ? "inserted" : "conflict";
+  } catch {
+    return "unreachable";
+  }
+}
+async function listWorkspacesNeon(accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return null;
+  const db = deps.db ?? getPostgresDb();
+  try {
+    const rows = await db.select({
+      id: workspaces.id,
+      displayName: workspaces.displayName,
+      githubOrg: workspaces.githubOrg,
+      createdAt: workspaces.createdAt
+    }).from(workspaces).where(eq(workspaces.accountId, accountId2));
+    return rows.map((r) => ({
+      id: r.id,
+      display_name: r.displayName,
+      created_at: (r.createdAt instanceof Date ? r.createdAt : /* @__PURE__ */ new Date()).toISOString(),
+      ...r.githubOrg ? { github_org: r.githubOrg } : {}
+    }));
+  } catch {
+    return null;
+  }
+}
+async function renameWorkspaceNeon(id, displayName, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.update(workspaces).set({ displayName }).where(and(eq(workspaces.id, id), eq(workspaces.accountId, accountId2))).returning({ id: workspaces.id });
+    return rows.length > 0 ? "updated" : "not_found";
+  } catch {
+    return "unreachable";
+  }
+}
+async function setWorkspaceArchivedNeon(id, archived, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.update(workspaces).set({ archived }).where(and(eq(workspaces.id, id), eq(workspaces.accountId, accountId2))).returning({ id: workspaces.id });
+    return rows.length > 0 ? "updated" : "not_found";
+  } catch {
+    return "unreachable";
+  }
+}
+async function deleteWorkspaceNeon(id, accountId2, deps = {}) {
+  if (!await isNeonReachableForWrite(deps)) return "unreachable";
+  try {
+    const db = deps.db ?? getPostgresDb();
+    const rows = await db.delete(workspaces).where(and(eq(workspaces.id, id), eq(workspaces.accountId, accountId2))).returning({ id: workspaces.id });
+    return rows.length > 0 ? "deleted" : "not_found";
+  } catch {
+    return "unreachable";
+  }
+}
+var DEFAULT_ACCOUNT_ID;
+var init_vault_workspace_shared = __esm({
+  "spex-console/src/lib/cli/vault-workspace-shared.ts"() {
+    "use strict";
+    init_sql_orm_inert_cli_shim();
+    init_postgres_client_cli_shim();
+    init_interfaces();
+    init_postgres();
+    init_neon_probe();
+    init_repo_identity();
+    DEFAULT_ACCOUNT_ID = SINGLE_USER_ID;
+  }
+});
+
+// spex-console/bin/hs-workspace.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+import path4 from "node:path";
+import process2 from "node:process";
+import { createInterface } from "node:readline/promises";
+
+// spex-console/src/lib/cli/control-shared.ts
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var EXIT = {
+  /** Success. */
+  OK: 0,
+  /** Usage error — unknown subcommand/flag, or a missing required argument. */
+  USAGE: 1,
+  /** Claim race lost — the spec is already claimed by another agent (409). */
+  CONFLICT: 9,
+  /** Target not found — release of an unheld claim, etc. (404). */
+  NOT_FOUND: 10,
+  /** Invalid argument — bad `--ttl`, unknown `--kind`, unparseable date. */
+  INVALID_ARG: 11,
+  /** SpexConsole unreachable (network error reaching the dev server). */
+  CONSOLE_UNREACHABLE: 12,
+  /** Server failure — a non-OK response that isn't 400/402/404/409. */
+  WRITE_FAILED: 13,
+  /** Neon control plane absent — the endpoint returned 402 (upgrade required). */
+  NEON_REQUIRED: 14,
+  /**
+   * A cross-account `--account <id>` override was refused — the caller is
+   * not a builder/admin (`resolveScopedAccountId`'s `forbidden_account_override`,
+   * [[HS-X3GB-EKLJ-TASK-hs-cli-account-flag-for-cross-account]]). Distinct
+   * from `USAGE`/`INVALID_ARG` — this is an authorization refusal, not a
+   * malformed command.
+   */
+  FORBIDDEN: 15
+};
+function readPairedToken() {
+  try {
+    const raw = readFileSync(join(homedir(), ".heyspex", "credentials.yaml"), "utf-8");
+    const match = raw.match(/\b(hsmcp_[A-Za-z0-9_-]+|hscmp_[A-Za-z0-9_-]+)\b/);
+    return match?.[1];
+  } catch {
+    return void 0;
+  }
+}
+
+// spex-console/src/lib/cli/defer.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// scripts/lib/console-url-resolver.mjs
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+var DEFAULT_CONSOLE_URL = "https://app.heyspex.com";
+
+// spex-console/src/lib/cli/defer.ts
+function resolveSpexConsoleUrl(vaultRoot, readDiscovery, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = (env.HEYSPEX_CONSOLE_URL ?? env.HEYSPEX_COCKPIT_URL)?.trim();
+  if (raw && raw.length > 0) return raw.replace(/\/+$/, "");
+  try {
+    const homeDir = opts.homeDir ?? os.homedir();
+    const readFile2 = opts.readFile ?? ((p) => readFileSync3(p, "utf-8"));
+    const credentials = readFile2(path.join(homeDir, ".heyspex", "credentials.yaml"));
+    const match = credentials.match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
+    const value = match?.[1]?.trim();
+    if (value && value.length > 0) return value.replace(/\/+$/, "");
+  } catch {
+  }
+  for (const name of ["console-url", "cockpit-url"]) {
+    try {
+      const discovery = readDiscovery(`${vaultRoot}/.heyspex/${name}`);
+      if (discovery && discovery.trim().length > 0) {
+        return discovery.trim().replace(/\/+$/, "");
+      }
+    } catch {
+    }
+  }
+  return DEFAULT_CONSOLE_URL;
+}
+var HELP = [
+  "Usage:",
+  "  hs defer <spec-id> [--until <when>] [--json] [--no-daemon]",
+  "  hs undefer <spec-id> [--json] [--no-daemon]",
+  "",
+  "Time-shift a spec via its `defer_until` frontmatter field. A deferred spec is",
+  "scheduler-invisible until the date passes, then auto-revives.",
+  "",
+  "Arguments:",
+  "  <spec-id>        The spec to defer/undefer (e.g. HS-TASK-EWL5).",
+  "",
+  "Flags:",
+  "  --until <when>   ISO date, or relative offset +Nd / +Nw / +Nm / +Ny.",
+  "                   Defaults to +1y (matches the console Defer button).",
+  "                   Ignored by `undefer` (which always clears the field).",
+  "  --json           Emit a machine-readable JSON result.",
+  "  --no-daemon      Write straight to the vault (no console needed; CI path).",
+  "  --help, -h       Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 10 not-found \xB7 11 bad-arg \xB7 12 console-unreachable \xB7 13 write-failed"
+].join("\n");
+
+// spex-console/src/lib/cli/workspace.ts
+init_account_pointer();
+
+// dist/cli/._admin-scope-inert.cli-shim.mjs
+async function resolveScopedAccountId(callerAccountId, requestedAccountId) {
+  const target = requestedAccountId == null ? "" : String(requestedAccountId).trim();
+  if (!target || target === callerAccountId) {
+    return { ok: true, accountId: callerAccountId };
+  }
+  return {
+    ok: false,
+    code: "forbidden_account_override",
+    message: "Only a builder/admin may act on another account's workspaces or vaults."
+  };
+}
+
+// spex-console/src/lib/vault-registry/archive.ts
+init_vault_workspace_shared();
+
+// spex-console/src/lib/vault-registry/active-repoint.ts
+init_account_pointer();
+init_registry_file();
+function pointerDeps(deps) {
+  return deps.accountPointer ?? { registryOpts: deps.registryOpts };
+}
+async function repointActiveWorkspaceOnRemoval(accountId2, removedWorkspaceId, deps = {}) {
+  const pDeps = pointerDeps(deps);
+  const activeId = await getActiveWorkspace(accountId2, pDeps);
+  if (activeId !== removedWorkspaceId) {
+    return { repointed: false, newActiveId: activeId };
+  }
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const candidate = registry.workspaces.find((w) => w.id !== removedWorkspaceId && !w.archived);
+  if (!candidate) {
+    await clearActiveWorkspace(accountId2, pDeps);
+    return { repointed: true, newActiveId: null };
+  }
+  await setActiveWorkspace(accountId2, candidate.id, pDeps);
+  return { repointed: true, newActiveId: candidate.id };
+}
+
+// spex-console/src/lib/vault-registry/archive.ts
+init_registry_file();
+function workspaceNotFound(id) {
+  return { ok: false, code: "workspace_not_found", message: `workspace "${id}" not found` };
+}
+async function setWorkspaceArchivedState(input, archived, deps = {}) {
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.workspaces.find((w) => w.id === input.id);
+  if (!existing) return workspaceNotFound(input.id);
+  const neonResult = await setWorkspaceArchivedNeon(
+    input.id,
+    archived,
+    input.accountId,
+    deps.neon ?? {}
+  );
+  if (neonResult === "not_found") return workspaceNotFound(input.id);
+  if (archived) {
+    await repointActiveWorkspaceOnRemoval(input.accountId, input.id, {
+      registryOpts: deps.registryOpts,
+      accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
+    });
+  }
+  registerWorkspace({ ...existing, archived }, deps.registryOpts);
+  return {
+    ok: true,
+    workspace: {
+      id: input.id,
+      archived,
+      neon_written: neonResult === "updated",
+      registry_written: true
+    }
+  };
+}
+async function archiveWorkspace(input, deps = {}) {
+  return setWorkspaceArchivedState(input, true, deps);
+}
+async function restoreWorkspace(input, deps = {}) {
+  return setWorkspaceArchivedState(input, false, deps);
+}
+
+// spex-console/src/lib/vault-registry/close-not-destroy.ts
+var CLOSE_NOT_DESTROY_STATEMENT = "This only removes it from HeySpex. The repo files on disk are not deleted.";
+var KIND_LABEL = {
+  workspace: "workspace",
+  vault: "vault"
+};
+function buildCloseNotDestroyConfirm(kind, verb, displayName) {
+  const kindLabel = KIND_LABEL[kind];
+  const name = displayName.trim() || kindLabel;
+  if (verb === "archive") {
+    return {
+      title: `Archive "${name}"?`,
+      message: `Archiving hides the ${kindLabel} from your active list. ${CLOSE_NOT_DESTROY_STATEMENT} You can restore it any time.`,
+      confirmLabel: "Archive",
+      cancelLabel: "Cancel",
+      removesRegistryRow: false
+    };
+  }
+  return {
+    title: `Remove "${name}" from HeySpex?`,
+    message: `${CLOSE_NOT_DESTROY_STATEMENT} It will need to be re-registered to appear here again.`,
+    confirmLabel: "Remove from HeySpex",
+    cancelLabel: "Cancel",
+    removesRegistryRow: true
+  };
+}
+
+// spex-console/src/lib/vault-registry/list.ts
+init_vault_workspace_shared();
+init_account_pointer();
+init_registry_file();
+import { existsSync as existsSync2 } from "node:fs";
+function pointerDeps2(deps) {
+  return deps.accountPointer ?? { registryOpts: deps.registryOpts };
+}
+function localWorkspaceRows(deps) {
+  return loadVaultRegistry(deps.registryOpts).workspaces;
+}
+async function listWorkspaces(accountId2, deps = {}) {
+  const pDeps = pointerDeps2(deps);
+  const neonRows = await (deps.neonListWorkspaces ?? listWorkspacesNeon)(accountId2, {
+    db: pDeps.db,
+    neonReachable: pDeps.neonReachable
+  });
+  const rows = neonRows ?? (deps.allowLocalRegistryFallback ? localWorkspaceRows(deps) : []);
+  const activeId = await getActiveWorkspace(accountId2, pDeps);
+  const scoped = deps.includeArchived ? rows : rows.filter((w) => !w.archived);
+  return {
+    workspaces: scoped.map((w) => ({ ...w, active: w.id === activeId })),
+    active_workspace_id: activeId
+  };
+}
+
+// spex-console/src/lib/cli/workspace.ts
+init_registry_file();
+
+// spex-console/src/lib/vault-registry/workspace-create.ts
+init_vault_workspace_shared();
+init_registry_file();
+var MAX_DISPLAY_NAME_LEN = 60;
+var MAX_SLUG_LEN = 40;
+var MAX_SLUG_SUFFIX = 9;
+function isValidExplicitId(id) {
+  if (typeof id !== "string" || id.trim() === "") return false;
+  if (id.includes("/") || id.includes("\\")) return false;
+  if (id === "." || id === "..") return false;
+  return true;
+}
+function truncateSlugAtWordBoundary(slug, maxLen) {
+  if (slug.length <= maxLen) return slug;
+  const cut = slug.slice(0, maxLen);
+  const lastDash = cut.lastIndexOf("-");
+  return lastDash > 0 ? cut.slice(0, lastDash) : cut.replace(/-$/, "");
+}
+function deriveWorkspaceSlug(displayName) {
+  const slug = displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return truncateSlugAtWordBoundary(slug || "workspace", MAX_SLUG_LEN);
+}
+function derivedCandidates(trimmedName) {
+  const base = deriveWorkspaceSlug(trimmedName);
+  return {
+    base,
+    candidates: [
+      base,
+      ...Array.from({ length: MAX_SLUG_SUFFIX - 1 }, (_, i) => `${base}-${i + 2}`)
+    ]
+  };
+}
+function exhaustedSlugError(trimmedName, base) {
+  return {
+    ok: false,
+    code: "duplicate_workspace",
+    message: `could not find a free slug for "${trimmedName}" -- ${base} through ${base}-${MAX_SLUG_SUFFIX} are all taken`
+  };
+}
+function createOffline(input, trimmedName, now, deps) {
+  const existingIds = new Set(loadVaultRegistry(deps.registryOpts).workspaces.map((w) => w.id));
+  let id;
+  if (input.id !== void 0) {
+    if (existingIds.has(input.id)) {
+      return {
+        ok: false,
+        code: "duplicate_workspace",
+        message: `workspace "${input.id}" already exists`
+      };
+    }
+    id = input.id;
+  } else {
+    const { base, candidates } = derivedCandidates(trimmedName);
+    const free = candidates.find((candidate) => !existingIds.has(candidate));
+    if (!free) return exhaustedSlugError(trimmedName, base);
+    id = free;
+  }
+  registerWorkspace({ id, display_name: trimmedName, created_at: now }, deps.registryOpts);
+  return {
+    ok: true,
+    workspace: { id, display_name: trimmedName, neon_written: false, registry_written: true }
+  };
+}
+async function createWorkspace(input, deps = {}) {
+  const trimmedName = input.displayName.trim();
+  if (trimmedName.length < 1 || trimmedName.length > MAX_DISPLAY_NAME_LEN) {
+    return {
+      ok: false,
+      code: "invalid_display_name",
+      message: `display name must be 1-${MAX_DISPLAY_NAME_LEN} characters (trimmed)`
+    };
+  }
+  const now = (deps.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))();
+  if (deps.allowIdUpsert && input.id !== void 0) {
+    if (!isValidExplicitId(input.id)) {
+      return {
+        ok: false,
+        code: "invalid_workspace_id",
+        message: `invalid workspace id "${input.id}" -- must be non-empty with no path separators`
+      };
+    }
+    const id = input.id;
+    registerWorkspace({ id, display_name: trimmedName, created_at: now }, deps.registryOpts);
+    const neonWritten = await upsertWorkspaceNeon(
+      { id, displayName: trimmedName },
+      input.accountId,
+      deps.neon
+    );
+    return {
+      ok: true,
+      workspace: {
+        id,
+        display_name: trimmedName,
+        neon_written: neonWritten,
+        registry_written: true
+      }
+    };
+  }
+  if (input.id !== void 0 && !isValidExplicitId(input.id)) {
+    return {
+      ok: false,
+      code: "invalid_workspace_id",
+      message: `invalid workspace id "${input.id}" -- must be non-empty with no path separators`
+    };
+  }
+  const { base, candidates } = input.id !== void 0 ? { base: input.id, candidates: [input.id] } : derivedCandidates(trimmedName);
+  for (const candidate of candidates) {
+    const result = await insertWorkspaceNeonStrict(
+      { id: candidate, displayName: trimmedName },
+      input.accountId,
+      deps.neon ?? {}
+    );
+    if (result === "inserted") {
+      registerWorkspace(
+        { id: candidate, display_name: trimmedName, created_at: now },
+        deps.registryOpts
+      );
+      return {
+        ok: true,
+        workspace: {
+          id: candidate,
+          display_name: trimmedName,
+          neon_written: true,
+          registry_written: true
+        }
+      };
+    }
+    if (result === "unreachable") {
+      return createOffline(input, trimmedName, now, deps);
+    }
+    if (input.id !== void 0) {
+      return {
+        ok: false,
+        code: "duplicate_workspace",
+        message: `workspace "${input.id}" already exists`
+      };
+    }
+  }
+  return exhaustedSlugError(trimmedName, base);
+}
+
+// spex-console/src/lib/vault-registry/workspace-manage.ts
+init_vault_workspace_shared();
+init_registry_file();
+var MAX_DISPLAY_NAME_LEN2 = 60;
+function notFound(id) {
+  return { ok: false, code: "workspace_not_found", message: `workspace "${id}" not found` };
+}
+async function renameWorkspace(input, deps = {}) {
+  const trimmedName = input.displayName.trim();
+  if (trimmedName.length < 1 || trimmedName.length > MAX_DISPLAY_NAME_LEN2) {
+    return {
+      ok: false,
+      code: "invalid_display_name",
+      message: `display name must be 1-${MAX_DISPLAY_NAME_LEN2} characters (trimmed)`
+    };
+  }
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.workspaces.find((w) => w.id === input.id);
+  if (!existing) return notFound(input.id);
+  const neonResult = await renameWorkspaceNeon(
+    input.id,
+    trimmedName,
+    input.accountId,
+    deps.neon ?? {}
+  );
+  if (neonResult === "not_found") return notFound(input.id);
+  registerWorkspace(
+    {
+      ...existing,
+      display_name: trimmedName
+    },
+    deps.registryOpts
+  );
+  return {
+    ok: true,
+    workspace: {
+      id: input.id,
+      display_name: trimmedName,
+      neon_written: neonResult === "updated",
+      registry_written: true
+    }
+  };
+}
+async function unregisterWorkspace(input, deps = {}) {
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.workspaces.find((w) => w.id === input.id);
+  if (!existing) return notFound(input.id);
+  const neonResult = await deleteWorkspaceNeon(input.id, input.accountId, deps.neon ?? {});
+  if (neonResult === "not_found") return notFound(input.id);
+  await repointActiveWorkspaceOnRemoval(input.accountId, input.id, {
+    registryOpts: deps.registryOpts,
+    accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
+  });
+  removeWorkspace(input.id, deps.registryOpts);
+  return {
+    ok: true,
+    workspace: {
+      id: input.id,
+      neon_written: neonResult === "deleted",
+      registry_written: true
+    }
+  };
+}
+
+// spex-console/src/lib/cli/workspace.ts
+init_vault_workspace_shared();
+function parseWorkspaceArgs(argv) {
+  const subRaw = argv[0];
+  if (subRaw === "--help" || subRaw === "-h" || subRaw === void 0) {
+    return { help: true };
+  }
+  const KNOWN_SUBCOMMANDS = [
+    "list",
+    "create",
+    "switch",
+    "rename",
+    "unregister",
+    "archive",
+    "restore"
+  ];
+  if (!KNOWN_SUBCOMMANDS.includes(subRaw)) {
+    return { error: { code: EXIT.USAGE, message: `unknown subcommand: ${subRaw}` } };
+  }
+  let json = false;
+  let yes = false;
+  let id;
+  let name;
+  let account;
+  let positional;
+  for (let i = 1; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") return { help: true };
+    else if (arg === "--json") json = true;
+    else if (arg === "--yes" || arg === "-y") yes = true;
+    else if (arg === "--id" || arg.startsWith("--id=")) {
+      const v = arg === "--id" ? argv[++i] : arg.slice("--id=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--id requires a value" } };
+      }
+      id = v;
+    } else if (arg === "--name" || arg.startsWith("--name=")) {
+      const v = arg === "--name" ? argv[++i] : arg.slice("--name=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--name requires a value" } };
+      }
+      name = v;
+    } else if (arg === "--account" || arg.startsWith("--account=")) {
+      const v = arg === "--account" ? argv[++i] : arg.slice("--account=".length);
+      if (v === void 0 || v.trim() === "") {
+        return { error: { code: EXIT.INVALID_ARG, message: "--account requires a value" } };
+      }
+      account = v;
+    } else if (arg.startsWith("-")) {
+      return { error: { code: EXIT.USAGE, message: `unknown flag: ${arg}` } };
+    } else if (positional === void 0) {
+      positional = arg;
+    } else {
+      return { error: { code: EXIT.USAGE, message: `unexpected argument: ${arg}` } };
+    }
+  }
+  if (subRaw === "list") return { args: { sub: "list", json, account } };
+  if (subRaw === "switch") {
+    const targetId2 = positional ?? id;
+    if (!targetId2) {
+      return { error: { code: EXIT.USAGE, message: "workspace switch requires a workspace id" } };
+    }
+    return { args: { sub: "switch", id: targetId2, json } };
+  }
+  if (subRaw === "rename") {
+    const targetId2 = id ?? positional;
+    if (!targetId2) {
+      return { error: { code: EXIT.USAGE, message: "workspace rename requires a workspace id" } };
+    }
+    if (!name) {
+      return {
+        error: { code: EXIT.USAGE, message: 'workspace rename requires --name "<display name>"' }
+      };
+    }
+    return { args: { sub: "rename", id: targetId2, name, json, account } };
+  }
+  if (subRaw === "unregister") {
+    const targetId2 = id ?? positional;
+    if (!targetId2) {
+      return {
+        error: { code: EXIT.USAGE, message: "workspace unregister requires a workspace id" }
+      };
+    }
+    return { args: { sub: "unregister", id: targetId2, yes, json, account } };
+  }
+  if (subRaw === "archive") {
+    const targetId2 = id ?? positional;
+    if (!targetId2) {
+      return { error: { code: EXIT.USAGE, message: "workspace archive requires a workspace id" } };
+    }
+    return { args: { sub: "archive", id: targetId2, yes, json, account } };
+  }
+  if (subRaw === "restore") {
+    const targetId2 = id ?? positional;
+    if (!targetId2) {
+      return { error: { code: EXIT.USAGE, message: "workspace restore requires a workspace id" } };
+    }
+    return { args: { sub: "restore", id: targetId2, json, account } };
+  }
+  const targetId = id ?? positional;
+  if (!targetId) {
+    return { error: { code: EXIT.USAGE, message: "workspace create requires --id <slug>" } };
+  }
+  if (!name) {
+    return {
+      error: { code: EXIT.USAGE, message: 'workspace create requires --name "<display name>"' }
+    };
+  }
+  return { args: { sub: "create", id: targetId, name, json } };
+}
+function accountPointerDeps(deps) {
+  return { registryOpts: deps.registryOpts, ...deps.neon ?? {} };
+}
+function accountId(deps) {
+  return deps.accountId ?? resolveCliAccountId();
+}
+async function resolveEffectiveAccountId(deps, requestedAccount, verb) {
+  const scope = await resolveScopedAccountId(accountId(deps), requestedAccount);
+  if (scope.ok) return { ok: true, accountId: scope.accountId };
+  return {
+    ok: false,
+    result: {
+      code: EXIT.FORBIDDEN,
+      message: `hs workspace ${verb}: ${scope.message}`,
+      payload: { ok: false, error: scope.code, message: scope.message },
+      isError: true
+    }
+  };
+}
+async function runList(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "list");
+  if (!scoped.ok) return scoped.result;
+  const { workspaces: workspaces2, active_workspace_id } = await listWorkspaces(scoped.accountId, {
+    registryOpts: deps.registryOpts,
+    accountPointer: accountPointerDeps(deps),
+    // The CLI runs on this machine AS this machine's owner, so the local
+    // registry.json IS this caller's own data — the one place the offline
+    // fallback is correct. A route handler must never pass this. NOT true
+    // any more once `--account` targets someone ELSE's account: registry.json
+    // carries no account field at all (see `list.ts`'s
+    // `allowLocalRegistryFallback` doc comment), so falling back to it while
+    // impersonating another account would serve THIS machine's own rows
+    // mislabeled as the target's.
+    allowLocalRegistryFallback: scoped.accountId === accountId(deps)
+  });
+  if (args.json) {
+    return {
+      code: EXIT.OK,
+      message: "",
+      payload: { ok: true, workspaces: workspaces2, active_workspace_id },
+      isError: false
+    };
+  }
+  const lines = workspaces2.length ? workspaces2.map((w) => `${w.active ? "* " : "  "}${w.id}  ${w.display_name}`).join("\n") : '  (no workspaces registered -- run `hs workspace create --id <slug> --name "..."`)';
+  return {
+    code: EXIT.OK,
+    message: `${workspaces2.length} registered workspace(s):
+${lines}`,
+    payload: { ok: true, workspaces: workspaces2, active_workspace_id },
+    isError: false
+  };
+}
+async function runCreate(args, deps) {
+  const result = await createWorkspace(
+    { accountId: accountId(deps), id: args.id, displayName: args.name },
+    { registryOpts: deps.registryOpts, neon: deps.neon, now: deps.now, allowIdUpsert: true }
+  );
+  if (!result.ok) {
+    const code = result.code === "duplicate_workspace" ? EXIT.CONFLICT : EXIT.INVALID_ARG;
+    return {
+      code,
+      message: `hs workspace create: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const { id, display_name, neon_written, registry_written } = result.workspace;
+  return {
+    code: EXIT.OK,
+    message: `Created workspace "${id}" (${display_name})` + (neon_written ? " in Neon + registry.json." : " in registry.json (Neon unreachable -- registry.json only)."),
+    payload: { ok: true, id, display_name, neon_written, registry_written },
+    isError: false
+  };
+}
+async function runSwitch(args, deps) {
+  try {
+    await setActiveWorkspace(accountId(deps), args.id, accountPointerDeps(deps));
+  } catch (err) {
+    if (err instanceof UnknownWorkspaceIdError) {
+      return {
+        code: EXIT.NOT_FOUND,
+        message: `hs workspace switch: unknown workspace id "${args.id}" -- run \`hs workspace list\` to see registered workspaces. Nothing was changed.`,
+        payload: { ok: false, error: "unknown_workspace_id", workspace_id: args.id },
+        isError: true
+      };
+    }
+    throw err;
+  }
+  return {
+    code: EXIT.OK,
+    message: `Switched active workspace to "${args.id}".`,
+    payload: { ok: true, workspace_id: args.id },
+    isError: false
+  };
+}
+async function activeWorkspaceSelection(deps, effectiveAccountId = accountId(deps)) {
+  const workspaceId = await getActiveWorkspace(effectiveAccountId, accountPointerDeps(deps));
+  return { line: `Active workspace: ${workspaceId ?? "(none)"}`, workspaceId };
+}
+function statusForWorkspaceManageError(code) {
+  return code === "workspace_not_found" ? EXIT.NOT_FOUND : EXIT.INVALID_ARG;
+}
+async function runRename(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "rename");
+  if (!scoped.ok) return scoped.result;
+  const result = await renameWorkspace(
+    { accountId: scoped.accountId, id: args.id, displayName: args.name },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: statusForWorkspaceManageError(result.code),
+      message: `hs workspace rename: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeWorkspaceSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Renamed workspace "${result.workspace.id}" to "${result.workspace.display_name}".
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.workspace.id,
+      display_name: result.workspace.display_name,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function confirmRemoval(deps, displayName, verb, yes) {
+  if (yes) return true;
+  const confirm2 = buildCloseNotDestroyConfirm("workspace", verb, displayName);
+  if (!deps.confirm) return false;
+  return deps.confirm(`${confirm2.message} ${confirm2.confirmLabel}? (y/n) `);
+}
+function cancelledResult(kind) {
+  return {
+    code: EXIT.USAGE,
+    message: `Stopped before making changes -- re-run with --yes, or answer "y", to ${kind}.`,
+    payload: { ok: false, aborted: true },
+    isError: true
+  };
+}
+async function runUnregister(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "unregister");
+  if (!scoped.ok) return scoped.result;
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.workspaces.find((w) => w.id === args.id);
+  const displayName = existing?.display_name ?? args.id;
+  const proceed = await confirmRemoval(deps, displayName, "unregister", args.yes);
+  if (!proceed) return cancelledResult("unregister");
+  const result = await unregisterWorkspace(
+    { accountId: scoped.accountId, id: args.id },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: statusForWorkspaceManageError(result.code),
+      message: `hs workspace unregister: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeWorkspaceSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Removed workspace "${result.workspace.id}" from HeySpex. ${CLOSE_NOT_DESTROY_STATEMENT}
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.workspace.id,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function runArchive(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "archive");
+  if (!scoped.ok) return scoped.result;
+  const registry = loadVaultRegistry(deps.registryOpts);
+  const existing = registry.workspaces.find((w) => w.id === args.id);
+  const displayName = existing?.display_name ?? args.id;
+  const proceed = await confirmRemoval(deps, displayName, "archive", args.yes);
+  if (!proceed) return cancelledResult("archive");
+  const result = await archiveWorkspace(
+    { accountId: scoped.accountId, id: args.id },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: EXIT.NOT_FOUND,
+      message: `hs workspace archive: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeWorkspaceSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Archived workspace "${result.workspace.id}". ${CLOSE_NOT_DESTROY_STATEMENT}
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.workspace.id,
+      archived: result.workspace.archived,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function runRestore(args, deps) {
+  const scoped = await resolveEffectiveAccountId(deps, args.account, "restore");
+  if (!scoped.ok) return scoped.result;
+  const result = await restoreWorkspace(
+    { accountId: scoped.accountId, id: args.id },
+    { registryOpts: deps.registryOpts, neon: deps.neon }
+  );
+  if (!result.ok) {
+    return {
+      code: EXIT.NOT_FOUND,
+      message: `hs workspace restore: ${result.message}`,
+      payload: { ok: false, error: result.code, message: result.message },
+      isError: true
+    };
+  }
+  const selection = await activeWorkspaceSelection(deps, scoped.accountId);
+  return {
+    code: EXIT.OK,
+    message: `Restored workspace "${result.workspace.id}".
+${selection.line}`,
+    payload: {
+      ok: true,
+      id: result.workspace.id,
+      archived: result.workspace.archived,
+      active_workspace_id: selection.workspaceId
+    },
+    isError: false
+  };
+}
+async function runWorkspace(args, deps) {
+  if (args.sub === "list") return runList(args, deps);
+  if (args.sub === "create") return runCreate(args, deps);
+  if (args.sub === "switch") return runSwitch(args, deps);
+  if (args.sub === "rename") return runRename(args, deps);
+  if (args.sub === "unregister") return runUnregister(args, deps);
+  if (args.sub === "archive") return runArchive(args, deps);
+  return runRestore(args, deps);
+}
+var HELP2 = [
+  "Usage:",
+  "  hs workspace list [--json]                          List registered workspaces, mark active",
+  '  hs workspace create --id <slug> --name "<name>"      Create a workspace (Neon + registry.json)',
+  "  hs workspace switch <id> [--json]                    Set the active workspace",
+  '  hs workspace rename <id> --name "<name>"             Rename a workspace',
+  "  hs workspace unregister <id> [--yes]                 Remove a workspace from HeySpex (files untouched)",
+  "  hs workspace archive <id> [--yes]                    Archive a workspace (reversible)",
+  "  hs workspace restore <id>                            Restore an archived workspace",
+  "",
+  "'workspace' = company/org container (Linear-style); 'vault' = one repo's specs/",
+  "(see `hs vault`). Never used interchangeably.",
+  "",
+  "create writes to BOTH Neon `workspaces` (best-effort, when reachable) and",
+  "~/.heyspex/registry.json (always) -- idempotent by id (rerun updates in place).",
+  "switch fails closed on an unknown id (no pointer mutation) and names `hs workspace list` as the fix.",
+  "rename/unregister/archive/restore call the SAME REST core as the console app switcher",
+  "(PATCH|DELETE /api/workspaces/:id) -- no separate CLI-only path. unregister and archive",
+  "show the shared Close-is-not-Destroy confirm (files on disk are never touched); --yes skips",
+  "the prompt only, it never changes what the verb does. Every management verb prints the",
+  "resulting active workspace afterward, since a removal or archive of the active workspace",
+  "may re-point the active pointer server-side.",
+  "",
+  "Flags:",
+  "  --id <slug>       Workspace id (create/switch).",
+  "  --name <name>     Display name (create/rename, required, 1-60 characters after trim).",
+  "  --yes, -y         Skip the removal confirm prompt (unregister/archive).",
+  "  --account <id>    Act on a DIFFERENT account's workspace instead of your own",
+  "                    (list/rename/unregister/archive/restore only) -- builder/admin-gated",
+  "                    server-side; refused for a non-builder caller (exit 15).",
+  "  --json            Emit a machine-readable JSON result.",
+  "  --help, -h        Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 9 conflict \xB7 10 not-found \xB7 11 bad-arg \xB7 15 forbidden (--account)"
+].join("\n");
+
+// spex-console/bin/hs-workspace.ts
+function readFile(p) {
+  try {
+    return readFileSync6(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+var INTERACTIVE = process2.stdin.isTTY === true;
+async function confirm(question) {
+  if (!INTERACTIVE) return false;
+  const rl = createInterface({ input: process2.stdin, output: process2.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "y" || answer === "yes" || answer === "proceed";
+  } finally {
+    rl.close();
+  }
+}
+async function main() {
+  const parsed = parseWorkspaceArgs(process2.argv.slice(3));
+  if (parsed.help) {
+    process2.stdout.write(`${HELP2}
+`);
+    process2.exit(EXIT.OK);
+  }
+  if (parsed.error) {
+    process2.stderr.write(`hs workspace: ${parsed.error.message}
+`);
+    process2.exit(parsed.error.code);
+  }
+  const vaultRoot = process2.env.HS_VAULT_ROOT ? path4.resolve(process2.env.HS_VAULT_ROOT) : process2.cwd();
+  const consoleUrl = resolveSpexConsoleUrl(vaultRoot, readFile);
+  const result = await runWorkspace(parsed.args, {
+    now: () => (/* @__PURE__ */ new Date()).toISOString(),
+    confirm,
+    neon: { http: { fetchImpl: fetch, consoleUrl, token: readPairedToken() } }
+  });
+  const sink = result.isError ? process2.stderr : process2.stdout;
+  sink.write(`${parsed.args.json ? JSON.stringify(result.payload) : result.message}
+`);
+  process2.exit(result.code);
+}
+main().catch((err) => {
+  const message = err instanceof Error ? err.message : String(err);
+  process2.stderr.write(`hs workspace: unhandled: ${message}
+`);
+  process2.exit(EXIT.WRITE_FAILED);
+});