heyspex 0.2.2 → 0.2.3

package/dist/cli/hs-vault-pull.mjs

@@ -165,9 +165,9 @@ function parseCredentialsStore(raw) {
     accounts
   };
 }
-function readTextOrNull(read, path15) {
+function readTextOrNull(read, path16) {
   try {
-    const raw = read(path15);
+    const raw = read(path16);
     return typeof raw === "string" ? raw : null;
   } catch {
     return null;
@@ -219,14 +219,14 @@ var init_session_owner = __esm({
 });
 
 // vendor/heyspex-mcp/vault-less-endpoints.mjs
-function pathnameOf(path15) {
-  const raw = String(path15 ?? "").split("?")[0].split("#")[0];
+function pathnameOf(path16) {
+  const raw = String(path16 ?? "").split("?")[0].split("#")[0];
   const noTrailing = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
   return noTrailing || "/";
 }
-function isVaultLessEndpoint(method, path15) {
+function isVaultLessEndpoint(method, path16) {
   const m = String(method || "GET").toUpperCase();
-  const pathname = pathnameOf(path15);
+  const pathname = pathnameOf(path16);
   return VAULT_LESS_ENDPOINTS.some((row) => {
     const [rowMethod, rowPath] = row.split(" ");
     return rowPath === pathname && (rowMethod === "*" || rowMethod === m);
@@ -249,7 +249,9 @@ var init_vault_less_endpoints = __esm({
 });
 
 // scripts/lib/shared-path-helpers.mjs
+import { realpathSync } from "node:fs";
 import { isAbsolute, resolve as resolve2, sep } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 var init_shared_path_helpers = __esm({
   "scripts/lib/shared-path-helpers.mjs"() {
     "use strict";
@@ -274,20 +276,52 @@ var init_write_outbox = __esm({
   }
 });
 
+// vendor/heyspex-mcp/usable-dir-env.mjs
+import { statSync } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
+var init_usable_dir_env = __esm({
+  "vendor/heyspex-mcp/usable-dir-env.mjs"() {
+    "use strict";
+  }
+});
+
+// vendor/heyspex-mcp/vault-binding.mjs
+import {
+  copyFileSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
+  realpathSync as realpathSync2,
+  renameSync as renameSync3,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import path from "node:path";
+var init_vault_binding = __esm({
+  "vendor/heyspex-mcp/vault-binding.mjs"() {
+    "use strict";
+  }
+});
+
 // vendor/heyspex-mcp/vault-resolve.mjs
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4, tmpdir } from "node:os";
-import { dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
+import { homedir as homedir5, tmpdir } from "node:os";
+import { basename as basename2, dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
 var init_vault_resolve = __esm({
   "vendor/heyspex-mcp/vault-resolve.mjs"() {
     "use strict";
     init_heyspex_home();
+    init_usable_dir_env();
+    init_vault_binding();
+    init_vault_binding();
   }
 });
 
 // vendor/heyspex-mcp/console-fetch.mjs
-import { readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
 import { join as join6 } from "node:path";
 function isCloudVaultId(value) {
   return typeof value === "string" && CLOUD_VAULT_ID_RE.test(value.trim());
@@ -309,13 +343,13 @@ var init_console_fetch = __esm({
 });
 
 // spex-console/src/lib/heyspex-home.ts
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 function heyspexHome2(env = process.env) {
   const override = env?.HEYSPEX_HOME;
   if (typeof override === "string" && override.trim().length > 0) {
     return override.trim();
   }
-  return homedir6();
+  return homedir7();
 }
 var init_heyspex_home2 = __esm({
   "spex-console/src/lib/heyspex-home.ts"() {
@@ -343,7 +377,7 @@ var init_types = __esm({
 });
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
 function vaultRegistryDir(opts = {}) {
   return opts.registryDir ?? join7(heyspexHome2(), ".heyspex");
@@ -450,9 +484,9 @@ function parseVaultRegistryFile(json) {
 }
 function readRegistryJson(opts) {
   const filePath = vaultRegistryFilePath(opts);
-  if (!existsSync4(filePath)) return { kind: "missing" };
+  if (!existsSync5(filePath)) return { kind: "missing" };
   try {
-    const raw = readFileSync6(filePath, "utf8");
+    const raw = readFileSync7(filePath, "utf8");
     const json = JSON.parse(raw);
     if (registryFileSchemaOf(json) === null) return { kind: "unreadable" };
     return { kind: "ok", raw, json };
@@ -488,8 +522,8 @@ var init_registry_file = __esm({
 });
 
 // scripts/lib/dev-mode.mjs
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
 import { join as join8 } from "node:path";
 var init_dev_mode = __esm({
   "scripts/lib/dev-mode.mjs"() {
@@ -500,8 +534,8 @@ var init_dev_mode = __esm({
 });
 
 // scripts/lib/console-url-resolver.mjs
-import { readFileSync as readFileSync8 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 import { join as join9 } from "node:path";
 var init_console_url_resolver = __esm({
   "scripts/lib/console-url-resolver.mjs"() {
@@ -512,9 +546,9 @@ var init_console_url_resolver = __esm({
 });
 
 // spex-console/src/lib/vault-registry/repo-identity.ts
-import path2 from "node:path";
+import path3 from "node:path";
 function normalizeRepoRoot(p) {
-  let resolved = path2.resolve(p);
+  let resolved = path3.resolve(p);
   while (resolved.length > 1 && (resolved.endsWith("/") || resolved.endsWith("\\"))) {
     resolved = resolved.slice(0, -1);
   }
@@ -523,8 +557,8 @@ function normalizeRepoRoot(p) {
 function repoRootCandidates(p) {
   const norm = normalizeRepoRoot(p);
   const candidates = [norm];
-  if (path2.basename(norm) === "specs") {
-    const parent = path2.dirname(norm);
+  if (path3.basename(norm) === "specs") {
+    const parent = path3.dirname(norm);
     if (parent !== norm) candidates.push(parent);
   }
   return candidates;
@@ -549,22 +583,22 @@ var init_default_workspace = __esm({
 });
 
 // spex-console/src/lib/cli/vault-workspace-shared.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 function resolveConfiguredAccountId(opts = {}) {
   return resolveSessionOwnerUncached({
     env: opts.env ?? process.env,
     homeDir: opts.homeDir ?? heyspexHome2(),
-    readFile: opts.readFile ?? ((p) => readFileSync9(p, "utf-8"))
+    readFile: opts.readFile ?? ((p) => readFileSync10(p, "utf-8"))
   });
 }
 function resolveCloudAccountIdOrRefuse(opts = {}) {
   const accountId = resolveConfiguredAccountId(opts);
   return accountId ? { ok: true, accountId } : { ok: false, message: CLOUD_ACCOUNT_ID_REQUIRED_MESSAGE };
 }
-async function cloudHttpRequest(http, method, path15, body) {
-  const scopeHeaders = http.scope ? http.scope.headersFor(method, path15) : {};
+async function cloudHttpRequest(http, method, path16, body) {
+  const scopeHeaders = http.scope ? http.scope.headersFor(method, path16) : {};
   try {
-    const res = await http.fetchImpl(`${http.consoleUrl}${path15}`, {
+    const res = await http.fetchImpl(`${http.consoleUrl}${path16}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -3177,9 +3211,9 @@ var init_satellite = __esm({
 });
 
 // spex-console/src/lib/vault-resolve/index.ts
-import { existsSync as existsSync5, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync12, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import path4 from "node:path";
+import path5 from "node:path";
 var init_vault_resolve2 = __esm({
   "spex-console/src/lib/vault-resolve/index.ts"() {
     "use strict";
@@ -3216,12 +3250,12 @@ var init_resolve_status = __esm({
 });
 
 // spex-console/src/lib/vault-resolve/active.ts
-import { existsSync as existsSync6 } from "node:fs";
-import path5 from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import path6 from "node:path";
 function fallbackSpecsDir() {
   const override = process.env.HEYSPEX_VAULT_DIR;
-  if (override) return path5.resolve(override);
-  return path5.resolve(process.cwd(), "..", "specs");
+  if (override) return path6.resolve(override);
+  return path6.resolve(process.cwd(), "..", "specs");
 }
 function getActiveSpecsDir() {
   return cacheStore.value ? cacheStore.value.specsDirAbs : fallbackSpecsDir();
@@ -3250,7 +3284,7 @@ var init_active = __esm({
 
 // spex-console/src/lib/control-plane/statusline-focus-cache.ts
 import fs4 from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
 var init_statusline_focus_cache = __esm({
   "spex-console/src/lib/control-plane/statusline-focus-cache.ts"() {
     "use strict";
@@ -4002,10 +4036,10 @@ function trashPathFor(relPath, now) {
   const normalized = relPath.split("\\").join("/");
   const slashIdx = normalized.lastIndexOf("/");
   const folder = slashIdx === -1 ? "" : normalized.slice(0, slashIdx);
-  const basename4 = slashIdx === -1 ? normalized : normalized.slice(slashIdx + 1);
+  const basename5 = slashIdx === -1 ? normalized : normalized.slice(slashIdx + 1);
   const stamp = now.toISOString().replace(/[:.]/g, "-");
   const trashDir = folder ? `${folder}/.trash` : ".trash";
-  return `${trashDir}/${stamp}-${basename4}`;
+  return `${trashDir}/${stamp}-${basename5}`;
 }
 function materializeSpecMarkdown(bundle) {
   return stringifySpecMarkdown(bundle.bodyText, bundle.frontmatter);
@@ -4127,10 +4161,10 @@ var init_export_status = __esm({
 function isGitHubFailure(value) {
   return typeof value === "object" && value !== null && "status" in value;
 }
-async function githubJson(path15, target, fetchImpl, init) {
+async function githubJson(path16, target, fetchImpl, init) {
   let response;
   try {
-    response = await fetchImpl(`${GITHUB_API_BASE2}${path15}`, {
+    response = await fetchImpl(`${GITHUB_API_BASE2}${path16}`, {
       ...init,
       headers: {
         ...githubHeaders(target.token),
@@ -5008,7 +5042,7 @@ var init_diagnose_spawned = __esm({
 
 // spex-console/src/lib/guardrail-naming.ts
 import fs5 from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 var init_guardrail_naming = __esm({
   "spex-console/src/lib/guardrail-naming.ts"() {
     "use strict";
@@ -5018,7 +5052,7 @@ var init_guardrail_naming = __esm({
 // spex-console/src/lib/indexer/parser.ts
 import { createHash as createHash3 } from "node:crypto";
 import { promises as fs6 } from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 var import_gray_matter2;
 var init_parser = __esm({
   "spex-console/src/lib/indexer/parser.ts"() {
@@ -5125,7 +5159,7 @@ var init_scoped_context = __esm({
 // spex-console/src/lib/indexer/indexer-service.ts
 import { spawnSync } from "node:child_process";
 import { promises as fs7 } from "node:fs";
-import path9 from "node:path";
+import path10 from "node:path";
 var init_indexer_service = __esm({
   "spex-console/src/lib/indexer/indexer-service.ts"() {
     "use strict";
@@ -5144,7 +5178,7 @@ var init_indexer_service = __esm({
 
 // spex-console/src/lib/indexer/outbox-index-feeder.ts
 import { promises as fs8 } from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 var init_outbox_index_feeder = __esm({
   "spex-console/src/lib/indexer/outbox-index-feeder.ts"() {
     "use strict";
@@ -5423,7 +5457,7 @@ var init_list_filter = __esm({
 });
 
 // spex-console/src/lib/specs/list-query.ts
-import path11 from "node:path";
+import path12 from "node:path";
 var init_list_query = __esm({
   "spex-console/src/lib/specs/list-query.ts"() {
     "use strict";
@@ -5466,7 +5500,7 @@ var init_pipeline_neighborhood = __esm({
 });
 
 // spex-console/src/lib/specs/spec-by-id.ts
-import path12 from "node:path";
+import path13 from "node:path";
 var init_spec_by_id = __esm({
   "spex-console/src/lib/specs/spec-by-id.ts"() {
     "use strict";
@@ -5523,9 +5557,9 @@ var init_search_body_hit = __esm({
 
 // spex-console/src/lib/vault.ts
 import { spawn } from "node:child_process";
-import { readdirSync as readdirSync2, readFileSync as readFileSync12, statSync } from "node:fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync13, statSync as statSync5 } from "node:fs";
 import { promises as fs9 } from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 import yaml3 from "js-yaml";
 function normalizeDateField(value) {
   let d = null;
@@ -5566,18 +5600,18 @@ function extractBodyLinks(body) {
   return links;
 }
 function toSummary(absPath, root, fm, body) {
-  const basename4 = path13.basename(absPath).replace(/\.md$/i, "");
-  const relPath = path13.relative(root, absPath).split(path13.sep).join("/");
+  const basename5 = path14.basename(absPath).replace(/\.md$/i, "");
+  const relPath = path14.relative(root, absPath).split(path14.sep).join("/");
   return {
-    id: typeof fm.id === "string" && fm.id ? fm.id : basename4,
-    name: typeof fm.name === "string" && fm.name ? fm.name : basename4,
+    id: typeof fm.id === "string" && fm.id ? fm.id : basename5,
+    name: typeof fm.name === "string" && fm.name ? fm.name : basename5,
     type: typeof fm.type === "string" ? fm.type : "unknown",
     status: typeof fm.status === "string" ? fm.status : "unknown",
     effort: typeof fm.effort === "number" ? fm.effort : null,
     owner: typeof fm.owner === "string" ? fm.owner : null,
     tags: Array.isArray(fm.tags) ? fm.tags.map(String) : [],
     archived: fm.archived === true,
-    basename: basename4,
+    basename: basename5,
     relPath,
     links: extractBodyLinks(body),
     created: normalizeDateField(fm.created),
@@ -5663,9 +5697,9 @@ function invalidateVaultCacheForFile(absPath) {
   else evictProcessVaultHotRows();
 }
 function specIdFromAbsPath(absPath) {
-  const basename4 = path13.basename(absPath).replace(/\.md$/i, "");
-  if (!basename4) return null;
-  const parsed = parseSpecId(basename4);
+  const basename5 = path14.basename(absPath).replace(/\.md$/i, "");
+  if (!basename5) return null;
+  const parsed = parseSpecId(basename5);
   if (parsed?.era === 3 && parsed.fileKey) return `HS-${parsed.fileKey.toUpperCase()}`;
   return null;
 }
@@ -5754,8 +5788,8 @@ function isLocalVaultMode() {
 }
 async function writeSpecBytesToVault(relPath, content) {
   try {
-    const absPath = path13.join(vaultRoot(), relPath);
-    const dir = path13.dirname(absPath);
+    const absPath = path14.join(vaultRoot(), relPath);
+    const dir = path14.dirname(absPath);
     await fs9.mkdir(dir, { recursive: true });
     await fs9.writeFile(absPath, content, "utf8");
   } catch (err) {
@@ -6009,7 +6043,7 @@ var init_esm = __esm({
         this._directoryFilter = normalizeFilter(opts.directoryFilter);
         const statMethod = opts.lstat ? lstat : stat;
         if (wantBigintFsStats) {
-          this._stat = (path15) => statMethod(path15, { bigint: true });
+          this._stat = (path16) => statMethod(path16, { bigint: true });
         } else {
           this._stat = statMethod;
         }
@@ -6034,8 +6068,8 @@ var init_esm = __esm({
             const par = this.parent;
             const fil = par && par.files;
             if (fil && fil.length > 0) {
-              const { path: path15, depth } = par;
-              const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path15));
+              const { path: path16, depth } = par;
+              const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path16));
               const awaited = await Promise.all(slice);
               for (const entry of awaited) {
                 if (!entry)
@@ -6075,21 +6109,21 @@ var init_esm = __esm({
           this.reading = false;
         }
       }
-      async _exploreDir(path15, depth) {
+      async _exploreDir(path16, depth) {
         let files;
         try {
-          files = await readdir(path15, this._rdOptions);
+          files = await readdir(path16, this._rdOptions);
         } catch (error) {
           this._onError(error);
         }
-        return { files, depth, path: path15 };
+        return { files, depth, path: path16 };
       }
-      async _formatEntry(dirent, path15) {
+      async _formatEntry(dirent, path16) {
         let entry;
-        const basename4 = this._isDirent ? dirent.name : dirent;
+        const basename5 = this._isDirent ? dirent.name : dirent;
         try {
-          const fullPath = presolve(pjoin(path15, basename4));
-          entry = { path: prelative(this._root, fullPath), fullPath, basename: basename4 };
+          const fullPath = presolve(pjoin(path16, basename5));
+          entry = { path: prelative(this._root, fullPath), fullPath, basename: basename5 };
           entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
         } catch (err) {
           this._onError(err);
@@ -6149,16 +6183,16 @@ import { watchFile, unwatchFile, watch as fs_watch } from "fs";
 import { open, stat as stat2, lstat as lstat2, realpath as fsrealpath } from "fs/promises";
 import * as sysPath from "path";
 import { type as osType } from "os";
-function createFsWatchInstance(path15, options2, listener, errHandler, emitRaw) {
+function createFsWatchInstance(path16, options2, listener, errHandler, emitRaw) {
   const handleEvent = (rawEvent, evPath) => {
-    listener(path15);
-    emitRaw(rawEvent, evPath, { watchedPath: path15 });
-    if (evPath && path15 !== evPath) {
-      fsWatchBroadcast(sysPath.resolve(path15, evPath), KEY_LISTENERS, sysPath.join(path15, evPath));
+    listener(path16);
+    emitRaw(rawEvent, evPath, { watchedPath: path16 });
+    if (evPath && path16 !== evPath) {
+      fsWatchBroadcast(sysPath.resolve(path16, evPath), KEY_LISTENERS, sysPath.join(path16, evPath));
     }
   };
   try {
-    return fs_watch(path15, {
+    return fs_watch(path16, {
       persistent: options2.persistent
     }, handleEvent);
   } catch (error) {
@@ -6503,12 +6537,12 @@ var init_handler = __esm({
         listener(val1, val2, val3);
       });
     };
-    setFsWatchListener = (path15, fullPath, options2, handlers) => {
+    setFsWatchListener = (path16, fullPath, options2, handlers) => {
       const { listener, errHandler, rawEmitter } = handlers;
       let cont = FsWatchInstances.get(fullPath);
       let watcher;
       if (!options2.persistent) {
-        watcher = createFsWatchInstance(path15, options2, listener, errHandler, rawEmitter);
+        watcher = createFsWatchInstance(path16, options2, listener, errHandler, rawEmitter);
         if (!watcher)
           return;
         return watcher.close.bind(watcher);
@@ -6519,7 +6553,7 @@ var init_handler = __esm({
         addAndConvert(cont, KEY_RAW, rawEmitter);
       } else {
         watcher = createFsWatchInstance(
-          path15,
+          path16,
           options2,
           fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS),
           errHandler,
@@ -6534,7 +6568,7 @@ var init_handler = __esm({
             cont.watcherUnusable = true;
           if (isWindows && error.code === "EPERM") {
             try {
-              const fd = await open(path15, "r");
+              const fd = await open(path16, "r");
               await fd.close();
               broadcastErr(error);
             } catch (err) {
@@ -6565,7 +6599,7 @@ var init_handler = __esm({
       };
     };
     FsWatchFileInstances = /* @__PURE__ */ new Map();
-    setFsWatchFileListener = (path15, fullPath, options2, handlers) => {
+    setFsWatchFileListener = (path16, fullPath, options2, handlers) => {
       const { listener, rawEmitter } = handlers;
       let cont = FsWatchFileInstances.get(fullPath);
       const copts = cont && cont.options;
@@ -6587,7 +6621,7 @@ var init_handler = __esm({
             });
             const currmtime = curr.mtimeMs;
             if (curr.size !== prev.size || currmtime > prev.mtimeMs || currmtime === 0) {
-              foreach(cont.listeners, (listener2) => listener2(path15, curr));
+              foreach(cont.listeners, (listener2) => listener2(path16, curr));
             }
           })
         };
@@ -6615,13 +6649,13 @@ var init_handler = __esm({
        * @param listener on fs change
        * @returns closer for the watcher instance
        */
-      _watchWithNodeFs(path15, listener) {
+      _watchWithNodeFs(path16, listener) {
         const opts = this.fsw.options;
-        const directory = sysPath.dirname(path15);
-        const basename4 = sysPath.basename(path15);
+        const directory = sysPath.dirname(path16);
+        const basename5 = sysPath.basename(path16);
         const parent = this.fsw._getWatchedDir(directory);
-        parent.add(basename4);
-        const absolutePath = sysPath.resolve(path15);
+        parent.add(basename5);
+        const absolutePath = sysPath.resolve(path16);
         const options2 = {
           persistent: opts.persistent
         };
@@ -6630,13 +6664,13 @@ var init_handler = __esm({
         let closer;
         if (opts.usePolling) {
           const enableBin = opts.interval !== opts.binaryInterval;
-          options2.interval = enableBin && isBinaryPath(basename4) ? opts.binaryInterval : opts.interval;
-          closer = setFsWatchFileListener(path15, absolutePath, options2, {
+          options2.interval = enableBin && isBinaryPath(basename5) ? opts.binaryInterval : opts.interval;
+          closer = setFsWatchFileListener(path16, absolutePath, options2, {
             listener,
             rawEmitter: this.fsw._emitRaw
           });
         } else {
-          closer = setFsWatchListener(path15, absolutePath, options2, {
+          closer = setFsWatchListener(path16, absolutePath, options2, {
             listener,
             errHandler: this._boundHandleError,
             rawEmitter: this.fsw._emitRaw
@@ -6653,12 +6687,12 @@ var init_handler = __esm({
           return;
         }
         const dirname7 = sysPath.dirname(file);
-        const basename4 = sysPath.basename(file);
+        const basename5 = sysPath.basename(file);
         const parent = this.fsw._getWatchedDir(dirname7);
         let prevStats = stats;
-        if (parent.has(basename4))
+        if (parent.has(basename5))
           return;
-        const listener = async (path15, newStats) => {
+        const listener = async (path16, newStats) => {
           if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5))
             return;
           if (!newStats || newStats.mtimeMs === 0) {
@@ -6672,18 +6706,18 @@ var init_handler = __esm({
                 this.fsw._emit(EV.CHANGE, file, newStats2);
               }
               if ((isMacos || isLinux || isFreeBSD) && prevStats.ino !== newStats2.ino) {
-                this.fsw._closeFile(path15);
+                this.fsw._closeFile(path16);
                 prevStats = newStats2;
                 const closer2 = this._watchWithNodeFs(file, listener);
                 if (closer2)
-                  this.fsw._addPathCloser(path15, closer2);
+                  this.fsw._addPathCloser(path16, closer2);
               } else {
                 prevStats = newStats2;
               }
             } catch (error) {
-              this.fsw._remove(dirname7, basename4);
+              this.fsw._remove(dirname7, basename5);
             }
-          } else if (parent.has(basename4)) {
+          } else if (parent.has(basename5)) {
             const at = newStats.atimeMs;
             const mt = newStats.mtimeMs;
             if (!at || at <= mt || mt !== prevStats.mtimeMs) {
@@ -6708,7 +6742,7 @@ var init_handler = __esm({
        * @param item basename of this item
        * @returns true if no more processing is needed for this entry.
        */
-      async _handleSymlink(entry, directory, path15, item) {
+      async _handleSymlink(entry, directory, path16, item) {
         if (this.fsw.closed) {
           return;
         }
@@ -6718,7 +6752,7 @@ var init_handler = __esm({
           this.fsw._incrReadyCount();
           let linkPath;
           try {
-            linkPath = await fsrealpath(path15);
+            linkPath = await fsrealpath(path16);
           } catch (e) {
             this.fsw._emitReady();
             return true;
@@ -6728,12 +6762,12 @@ var init_handler = __esm({
           if (dir.has(item)) {
             if (this.fsw._symlinkPaths.get(full) !== linkPath) {
               this.fsw._symlinkPaths.set(full, linkPath);
-              this.fsw._emit(EV.CHANGE, path15, entry.stats);
+              this.fsw._emit(EV.CHANGE, path16, entry.stats);
             }
           } else {
             dir.add(item);
             this.fsw._symlinkPaths.set(full, linkPath);
-            this.fsw._emit(EV.ADD, path15, entry.stats);
+            this.fsw._emit(EV.ADD, path16, entry.stats);
           }
           this.fsw._emitReady();
           return true;
@@ -6762,9 +6796,9 @@ var init_handler = __esm({
             return;
           }
           const item = entry.path;
-          let path15 = sysPath.join(directory, item);
+          let path16 = sysPath.join(directory, item);
           current.add(item);
-          if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path15, item)) {
+          if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path16, item)) {
             return;
           }
           if (this.fsw.closed) {
@@ -6773,8 +6807,8 @@ var init_handler = __esm({
           }
           if (item === target || !target && !previous.has(item)) {
             this.fsw._incrReadyCount();
-            path15 = sysPath.join(dir, sysPath.relative(dir, path15));
-            this._addToNodeFs(path15, initialAdd, wh, depth + 1);
+            path16 = sysPath.join(dir, sysPath.relative(dir, path16));
+            this._addToNodeFs(path16, initialAdd, wh, depth + 1);
           }
         }).on(EV.ERROR, this._boundHandleError);
         return new Promise((resolve7, reject) => {
@@ -6843,13 +6877,13 @@ var init_handler = __esm({
        * @param depth Child path actually targeted for watch
        * @param target Child path actually targeted for watch
        */
-      async _addToNodeFs(path15, initialAdd, priorWh, depth, target) {
+      async _addToNodeFs(path16, initialAdd, priorWh, depth, target) {
         const ready = this.fsw._emitReady;
-        if (this.fsw._isIgnored(path15) || this.fsw.closed) {
+        if (this.fsw._isIgnored(path16) || this.fsw.closed) {
           ready();
           return false;
         }
-        const wh = this.fsw._getWatchHelpers(path15);
+        const wh = this.fsw._getWatchHelpers(path16);
         if (priorWh) {
           wh.filterPath = (entry) => priorWh.filterPath(entry);
           wh.filterDir = (entry) => priorWh.filterDir(entry);
@@ -6865,8 +6899,8 @@ var init_handler = __esm({
           const follow = this.fsw.options.followSymlinks;
           let closer;
           if (stats.isDirectory()) {
-            const absPath = sysPath.resolve(path15);
-            const targetPath = follow ? await fsrealpath(path15) : path15;
+            const absPath = sysPath.resolve(path16);
+            const targetPath = follow ? await fsrealpath(path16) : path16;
             if (this.fsw.closed)
               return;
             closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
@@ -6876,29 +6910,29 @@ var init_handler = __esm({
               this.fsw._symlinkPaths.set(absPath, targetPath);
             }
           } else if (stats.isSymbolicLink()) {
-            const targetPath = follow ? await fsrealpath(path15) : path15;
+            const targetPath = follow ? await fsrealpath(path16) : path16;
             if (this.fsw.closed)
               return;
             const parent = sysPath.dirname(wh.watchPath);
             this.fsw._getWatchedDir(parent).add(wh.watchPath);
             this.fsw._emit(EV.ADD, wh.watchPath, stats);
-            closer = await this._handleDir(parent, stats, initialAdd, depth, path15, wh, targetPath);
+            closer = await this._handleDir(parent, stats, initialAdd, depth, path16, wh, targetPath);
             if (this.fsw.closed)
               return;
             if (targetPath !== void 0) {
-              this.fsw._symlinkPaths.set(sysPath.resolve(path15), targetPath);
+              this.fsw._symlinkPaths.set(sysPath.resolve(path16), targetPath);
             }
           } else {
             closer = this._handleFile(wh.watchPath, stats, initialAdd);
           }
           ready();
           if (closer)
-            this.fsw._addPathCloser(path15, closer);
+            this.fsw._addPathCloser(path16, closer);
           return false;
         } catch (error) {
           if (this.fsw._handleError(error)) {
             ready();
-            return path15;
+            return path16;
           }
         }
       }
@@ -6944,26 +6978,26 @@ function createPattern(matcher) {
   }
   return () => false;
 }
-function normalizePath(path15) {
-  if (typeof path15 !== "string")
+function normalizePath(path16) {
+  if (typeof path16 !== "string")
     throw new Error("string expected");
-  path15 = sysPath2.normalize(path15);
-  path15 = path15.replace(/\\/g, "/");
+  path16 = sysPath2.normalize(path16);
+  path16 = path16.replace(/\\/g, "/");
   let prepend = false;
-  if (path15.startsWith("//"))
+  if (path16.startsWith("//"))
     prepend = true;
   const DOUBLE_SLASH_RE2 = /\/\//;
-  while (path15.match(DOUBLE_SLASH_RE2))
-    path15 = path15.replace(DOUBLE_SLASH_RE2, "/");
+  while (path16.match(DOUBLE_SLASH_RE2))
+    path16 = path16.replace(DOUBLE_SLASH_RE2, "/");
   if (prepend)
-    path15 = "/" + path15;
-  return path15;
+    path16 = "/" + path16;
+  return path16;
 }
 function matchPatterns(patterns, testString, stats) {
-  const path15 = normalizePath(testString);
+  const path16 = normalizePath(testString);
   for (let index2 = 0; index2 < patterns.length; index2++) {
     const pattern = patterns[index2];
-    if (pattern(path15, stats)) {
+    if (pattern(path16, stats)) {
       return true;
     }
   }
@@ -7024,19 +7058,19 @@ var init_esm2 = __esm({
       }
       return str2;
     };
-    normalizePathToUnix = (path15) => toUnix(sysPath2.normalize(toUnix(path15)));
-    normalizeIgnored = (cwd = "") => (path15) => {
-      if (typeof path15 === "string") {
-        return normalizePathToUnix(sysPath2.isAbsolute(path15) ? path15 : sysPath2.join(cwd, path15));
+    normalizePathToUnix = (path16) => toUnix(sysPath2.normalize(toUnix(path16)));
+    normalizeIgnored = (cwd = "") => (path16) => {
+      if (typeof path16 === "string") {
+        return normalizePathToUnix(sysPath2.isAbsolute(path16) ? path16 : sysPath2.join(cwd, path16));
       } else {
-        return path15;
+        return path16;
       }
     };
-    getAbsolutePath = (path15, cwd) => {
-      if (sysPath2.isAbsolute(path15)) {
-        return path15;
+    getAbsolutePath = (path16, cwd) => {
+      if (sysPath2.isAbsolute(path16)) {
+        return path16;
       }
-      return sysPath2.join(cwd, path15);
+      return sysPath2.join(cwd, path16);
     };
     EMPTY_SET = Object.freeze(/* @__PURE__ */ new Set());
     DirEntry = class {
@@ -7091,10 +7125,10 @@ var init_esm2 = __esm({
     STAT_METHOD_F = "stat";
     STAT_METHOD_L = "lstat";
     WatchHelper = class {
-      constructor(path15, follow, fsw) {
+      constructor(path16, follow, fsw) {
         this.fsw = fsw;
-        const watchPath = path15;
-        this.path = path15 = path15.replace(REPLACER_RE, "");
+        const watchPath = path16;
+        this.path = path16 = path16.replace(REPLACER_RE, "");
         this.watchPath = watchPath;
         this.fullWatchPath = sysPath2.resolve(watchPath);
         this.dirParts = [];
@@ -7216,20 +7250,20 @@ var init_esm2 = __esm({
         this._closePromise = void 0;
         let paths = unifyPaths(paths_);
         if (cwd) {
-          paths = paths.map((path15) => {
-            const absPath = getAbsolutePath(path15, cwd);
+          paths = paths.map((path16) => {
+            const absPath = getAbsolutePath(path16, cwd);
             return absPath;
           });
         }
-        paths.forEach((path15) => {
-          this._removeIgnoredPath(path15);
+        paths.forEach((path16) => {
+          this._removeIgnoredPath(path16);
         });
         this._userIgnored = void 0;
         if (!this._readyCount)
           this._readyCount = 0;
         this._readyCount += paths.length;
-        Promise.all(paths.map(async (path15) => {
-          const res = await this._nodeFsHandler._addToNodeFs(path15, !_internal, void 0, 0, _origAdd);
+        Promise.all(paths.map(async (path16) => {
+          const res = await this._nodeFsHandler._addToNodeFs(path16, !_internal, void 0, 0, _origAdd);
           if (res)
             this._emitReady();
           return res;
@@ -7251,17 +7285,17 @@ var init_esm2 = __esm({
           return this;
         const paths = unifyPaths(paths_);
         const { cwd } = this.options;
-        paths.forEach((path15) => {
-          if (!sysPath2.isAbsolute(path15) && !this._closers.has(path15)) {
+        paths.forEach((path16) => {
+          if (!sysPath2.isAbsolute(path16) && !this._closers.has(path16)) {
             if (cwd)
-              path15 = sysPath2.join(cwd, path15);
-            path15 = sysPath2.resolve(path15);
+              path16 = sysPath2.join(cwd, path16);
+            path16 = sysPath2.resolve(path16);
           }
-          this._closePath(path15);
-          this._addIgnoredPath(path15);
-          if (this._watched.has(path15)) {
+          this._closePath(path16);
+          this._addIgnoredPath(path16);
+          if (this._watched.has(path16)) {
             this._addIgnoredPath({
-              path: path15,
+              path: path16,
               recursive: true
             });
           }
@@ -7325,38 +7359,38 @@ var init_esm2 = __esm({
        * @param stats arguments to be passed with event
        * @returns the error if defined, otherwise the value of the FSWatcher instance's `closed` flag
        */
-      async _emit(event, path15, stats) {
+      async _emit(event, path16, stats) {
         if (this.closed)
           return;
         const opts = this.options;
         if (isWindows)
-          path15 = sysPath2.normalize(path15);
+          path16 = sysPath2.normalize(path16);
         if (opts.cwd)
-          path15 = sysPath2.relative(opts.cwd, path15);
-        const args = [path15];
+          path16 = sysPath2.relative(opts.cwd, path16);
+        const args = [path16];
         if (stats != null)
           args.push(stats);
         const awf = opts.awaitWriteFinish;
         let pw;
-        if (awf && (pw = this._pendingWrites.get(path15))) {
+        if (awf && (pw = this._pendingWrites.get(path16))) {
           pw.lastChange = /* @__PURE__ */ new Date();
           return this;
         }
         if (opts.atomic) {
           if (event === EVENTS.UNLINK) {
-            this._pendingUnlinks.set(path15, [event, ...args]);
+            this._pendingUnlinks.set(path16, [event, ...args]);
             setTimeout(() => {
-              this._pendingUnlinks.forEach((entry, path16) => {
+              this._pendingUnlinks.forEach((entry, path17) => {
                 this.emit(...entry);
                 this.emit(EVENTS.ALL, ...entry);
-                this._pendingUnlinks.delete(path16);
+                this._pendingUnlinks.delete(path17);
               });
             }, typeof opts.atomic === "number" ? opts.atomic : 100);
             return this;
           }
-          if (event === EVENTS.ADD && this._pendingUnlinks.has(path15)) {
+          if (event === EVENTS.ADD && this._pendingUnlinks.has(path16)) {
             event = EVENTS.CHANGE;
-            this._pendingUnlinks.delete(path15);
+            this._pendingUnlinks.delete(path16);
           }
         }
         if (awf && (event === EVENTS.ADD || event === EVENTS.CHANGE) && this._readyEmitted) {
@@ -7374,16 +7408,16 @@ var init_esm2 = __esm({
               this.emitWithAll(event, args);
             }
           };
-          this._awaitWriteFinish(path15, awf.stabilityThreshold, event, awfEmit);
+          this._awaitWriteFinish(path16, awf.stabilityThreshold, event, awfEmit);
           return this;
         }
         if (event === EVENTS.CHANGE) {
-          const isThrottled = !this._throttle(EVENTS.CHANGE, path15, 50);
+          const isThrottled = !this._throttle(EVENTS.CHANGE, path16, 50);
           if (isThrottled)
             return this;
         }
         if (opts.alwaysStat && stats === void 0 && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-          const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path15) : path15;
+          const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path16) : path16;
           let stats2;
           try {
             stats2 = await stat3(fullPath);
@@ -7414,23 +7448,23 @@ var init_esm2 = __esm({
        * @param timeout duration of time to suppress duplicate actions
        * @returns tracking object or false if action should be suppressed
        */
-      _throttle(actionType, path15, timeout) {
+      _throttle(actionType, path16, timeout) {
         if (!this._throttled.has(actionType)) {
           this._throttled.set(actionType, /* @__PURE__ */ new Map());
         }
         const action = this._throttled.get(actionType);
         if (!action)
           throw new Error("invalid throttle");
-        const actionPath = action.get(path15);
+        const actionPath = action.get(path16);
         if (actionPath) {
           actionPath.count++;
           return false;
         }
         let timeoutObject;
         const clear = () => {
-          const item = action.get(path15);
+          const item = action.get(path16);
           const count2 = item ? item.count : 0;
-          action.delete(path15);
+          action.delete(path16);
           clearTimeout(timeoutObject);
           if (item)
             clearTimeout(item.timeoutObject);
@@ -7438,7 +7472,7 @@ var init_esm2 = __esm({
         };
         timeoutObject = setTimeout(clear, timeout);
         const thr = { timeoutObject, clear, count: 0 };
-        action.set(path15, thr);
+        action.set(path16, thr);
         return thr;
       }
       _incrReadyCount() {
@@ -7452,44 +7486,44 @@ var init_esm2 = __esm({
        * @param event
        * @param awfEmit Callback to be called when ready for event to be emitted.
        */
-      _awaitWriteFinish(path15, threshold, event, awfEmit) {
+      _awaitWriteFinish(path16, threshold, event, awfEmit) {
         const awf = this.options.awaitWriteFinish;
         if (typeof awf !== "object")
           return;
         const pollInterval = awf.pollInterval;
         let timeoutHandler;
-        let fullPath = path15;
-        if (this.options.cwd && !sysPath2.isAbsolute(path15)) {
-          fullPath = sysPath2.join(this.options.cwd, path15);
+        let fullPath = path16;
+        if (this.options.cwd && !sysPath2.isAbsolute(path16)) {
+          fullPath = sysPath2.join(this.options.cwd, path16);
         }
         const now = /* @__PURE__ */ new Date();
         const writes = this._pendingWrites;
         function awaitWriteFinishFn(prevStat) {
           statcb(fullPath, (err, curStat) => {
-            if (err || !writes.has(path15)) {
+            if (err || !writes.has(path16)) {
               if (err && err.code !== "ENOENT")
                 awfEmit(err);
               return;
             }
             const now2 = Number(/* @__PURE__ */ new Date());
             if (prevStat && curStat.size !== prevStat.size) {
-              writes.get(path15).lastChange = now2;
+              writes.get(path16).lastChange = now2;
             }
-            const pw = writes.get(path15);
+            const pw = writes.get(path16);
             const df = now2 - pw.lastChange;
             if (df >= threshold) {
-              writes.delete(path15);
+              writes.delete(path16);
               awfEmit(void 0, curStat);
             } else {
               timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval, curStat);
             }
           });
         }
-        if (!writes.has(path15)) {
-          writes.set(path15, {
+        if (!writes.has(path16)) {
+          writes.set(path16, {
             lastChange: now,
             cancelWait: () => {
-              writes.delete(path15);
+              writes.delete(path16);
               clearTimeout(timeoutHandler);
               return event;
             }
@@ -7500,8 +7534,8 @@ var init_esm2 = __esm({
       /**
        * Determines whether user has asked to ignore this path.
        */
-      _isIgnored(path15, stats) {
-        if (this.options.atomic && DOT_RE.test(path15))
+      _isIgnored(path16, stats) {
+        if (this.options.atomic && DOT_RE.test(path16))
           return true;
         if (!this._userIgnored) {
           const { cwd } = this.options;
@@ -7511,17 +7545,17 @@ var init_esm2 = __esm({
           const list = [...ignoredPaths.map(normalizeIgnored(cwd)), ...ignored];
           this._userIgnored = anymatch(list, void 0);
         }
-        return this._userIgnored(path15, stats);
+        return this._userIgnored(path16, stats);
       }
-      _isntIgnored(path15, stat4) {
-        return !this._isIgnored(path15, stat4);
+      _isntIgnored(path16, stat4) {
+        return !this._isIgnored(path16, stat4);
       }
       /**
        * Provides a set of common helpers and properties relating to symlink handling.
        * @param path file or directory pattern being watched
        */
-      _getWatchHelpers(path15) {
-        return new WatchHelper(path15, this.options.followSymlinks, this);
+      _getWatchHelpers(path16) {
+        return new WatchHelper(path16, this.options.followSymlinks, this);
       }
       // Directory helpers
       // -----------------
@@ -7553,63 +7587,63 @@ var init_esm2 = __esm({
        * @param item      base path of item/directory
        */
       _remove(directory, item, isDirectory) {
-        const path15 = sysPath2.join(directory, item);
-        const fullPath = sysPath2.resolve(path15);
-        isDirectory = isDirectory != null ? isDirectory : this._watched.has(path15) || this._watched.has(fullPath);
-        if (!this._throttle("remove", path15, 100))
+        const path16 = sysPath2.join(directory, item);
+        const fullPath = sysPath2.resolve(path16);
+        isDirectory = isDirectory != null ? isDirectory : this._watched.has(path16) || this._watched.has(fullPath);
+        if (!this._throttle("remove", path16, 100))
           return;
         if (!isDirectory && this._watched.size === 1) {
           this.add(directory, item, true);
         }
-        const wp = this._getWatchedDir(path15);
+        const wp = this._getWatchedDir(path16);
         const nestedDirectoryChildren = wp.getChildren();
-        nestedDirectoryChildren.forEach((nested) => this._remove(path15, nested));
+        nestedDirectoryChildren.forEach((nested) => this._remove(path16, nested));
         const parent = this._getWatchedDir(directory);
         const wasTracked = parent.has(item);
         parent.remove(item);
         if (this._symlinkPaths.has(fullPath)) {
           this._symlinkPaths.delete(fullPath);
         }
-        let relPath = path15;
+        let relPath = path16;
         if (this.options.cwd)
-          relPath = sysPath2.relative(this.options.cwd, path15);
+          relPath = sysPath2.relative(this.options.cwd, path16);
         if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
           const event = this._pendingWrites.get(relPath).cancelWait();
           if (event === EVENTS.ADD)
             return;
         }
-        this._watched.delete(path15);
+        this._watched.delete(path16);
         this._watched.delete(fullPath);
         const eventName = isDirectory ? EVENTS.UNLINK_DIR : EVENTS.UNLINK;
-        if (wasTracked && !this._isIgnored(path15))
-          this._emit(eventName, path15);
-        this._closePath(path15);
+        if (wasTracked && !this._isIgnored(path16))
+          this._emit(eventName, path16);
+        this._closePath(path16);
       }
       /**
        * Closes all watchers for a path
        */
-      _closePath(path15) {
-        this._closeFile(path15);
-        const dir = sysPath2.dirname(path15);
-        this._getWatchedDir(dir).remove(sysPath2.basename(path15));
+      _closePath(path16) {
+        this._closeFile(path16);
+        const dir = sysPath2.dirname(path16);
+        this._getWatchedDir(dir).remove(sysPath2.basename(path16));
       }
       /**
        * Closes only file-specific watchers
        */
-      _closeFile(path15) {
-        const closers = this._closers.get(path15);
+      _closeFile(path16) {
+        const closers = this._closers.get(path16);
         if (!closers)
           return;
         closers.forEach((closer) => closer());
-        this._closers.delete(path15);
+        this._closers.delete(path16);
       }
-      _addPathCloser(path15, closer) {
+      _addPathCloser(path16, closer) {
         if (!closer)
           return;
-        let list = this._closers.get(path15);
+        let list = this._closers.get(path16);
         if (!list) {
           list = [];
-          this._closers.set(path15, list);
+          this._closers.set(path16, list);
         }
         list.push(closer);
       }
@@ -7636,8 +7670,8 @@ var init_esm2 = __esm({
 });
 
 // spex-console/bin/hs-vault-pull.ts
-import { readFileSync as readFileSync13 } from "node:fs";
-import path14 from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import path15 from "node:path";
 import process4 from "node:process";
 
 // spex-console/src/lib/cli/control-shared.ts
@@ -7647,14 +7681,14 @@ init_credentials();
 init_session_owner();
 init_vault_less_endpoints();
 init_registry_file();
-import path from "node:path";
+import path2 from "node:path";
 var VAULT_ID_HEADER = "x-heyspex-vault-id";
 var ACCOUNT_ID_HEADER = "x-heyspex-account-id";
-function scopeHeadersFor(scope, method, path15) {
+function scopeHeadersFor(scope, method, path16) {
   if (scope === "none") {
-    if (!isVaultLessEndpoint(method, path15)) {
+    if (!isVaultLessEndpoint(method, path16)) {
       throw new Error(
-        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path15} is vault-scoped and must name { accountId, vaultId }.`
+        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path16} is vault-scoped and must name { accountId, vaultId }.`
       );
     }
     return {};
@@ -7665,7 +7699,7 @@ function cloudRequestScope(scope) {
   const named = { accountId: scope.accountId, vaultId: scope.vaultId };
   return {
     ...named,
-    headersFor: (method, path15) => isVaultLessEndpoint(method, path15) ? {} : scopeHeadersFor(named, method, path15)
+    headersFor: (method, path16) => isVaultLessEndpoint(method, path16) ? {} : scopeHeadersFor(named, method, path16)
   };
 }
 
@@ -7704,12 +7738,15 @@ var HELP = [
   "(spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
   "copied verbatim, template-shape docs written as author-prompt skeletons \u2014",
   "plus a generated CLAUDE.md, the kept-principles index, and the template_version",
-  "pin; with --git, one initial `git init` + commit. Rerunnable: a <dir> that already",
-  "holds heyspex.yaml and an empty/placeholder-only specs/ is accepted, existing",
-  "files are never overwritten (an existing CLAUDE.md gets a CLAUDE.md.template",
-  "beside it), and the result lists each manifest row as created or kept. Refuses a",
-  "non-empty <dir> without heyspex.yaml, or a specs/ holding managed specs.",
-  "See init.customer-vault.ts.",
+  "pin; with --git, one initial `git init` + commit. On an EXISTING vault (<dir>",
+  "holds heyspex.yaml with a vault_id) it is a REFRESH \u2014 the repair `hs doctor`'s",
+  "vault-template row names: only missing shipped files are added, template_version",
+  "is written/updated in heyspex.yaml (every other byte and the vault_id kept),",
+  "nothing existing is ever overwritten (an existing CLAUDE.md gets a",
+  "CLAUDE.md.template beside it), the result lists each manifest row as created or",
+  "kept, and a second run writes nothing. <dir> may be any path (a satellite repo",
+  "names its vault, e.g. `hs init --customer-vault ../my-specs`). Refuses only a",
+  "non-empty <dir> that has no heyspex.yaml. See init.customer-vault.ts.",
   "",
   "Flags:",
   "  --console-url <url>  console_url value (default: the mode-aware console --",
@@ -7769,7 +7806,8 @@ var PULL_HELP = [
   "  0   Done (or plan reported)",
   "  1   Runtime failure (unreadable source, a spec failed to write)",
   "  2   Usage error",
-  "  11  No vault could be resolved, or --apply would write another vault into this repo",
+  "  11  No vault could be resolved, or --apply would write another vault into this repo,",
+  "      or this repo is a satellite / repo-binding code repo (its specs/ live in the vault)",
   "",
   "Without --push: cloud \u2192 disk only; never deletes. A spec already on disk is",
   "skipped and reported, except one the last sync wrote and nobody edited since",
@@ -7883,7 +7921,7 @@ init_console_fetch();
 init_registry_file();
 init_repo_identity();
 import { promises as fs } from "node:fs";
-import path3 from "node:path";
+import path4 from "node:path";
 init_vault_workspace_shared();
 var SYNC_VAULT_EXIT_UNRESOLVED = 11;
 function refuse(message) {
@@ -7934,7 +7972,7 @@ async function resolveSyncVaultTargetFromEnv(deps) {
   let markerVaultId = null;
   try {
     markerVaultId = parseVaultId(
-      await fs.readFile(path3.join(deps.vaultRoot, "heyspex.yaml"), "utf8")
+      await fs.readFile(path4.join(deps.vaultRoot, "heyspex.yaml"), "utf8")
     );
   } catch {
     markerVaultId = null;
@@ -8126,6 +8164,28 @@ function watchDirtyMarker(vaultRoot2, onDirty, { debounceMs = 100 } = {}) {
 }
 
 // spex-console/src/lib/vault-sync/pull.ts
+function detectEol(text2) {
+  const crlf = (text2.match(/\r\n/g) ?? []).length;
+  const all = (text2.match(/\n/g) ?? []).length;
+  if (all === 0) return null;
+  return crlf * 2 >= all ? "\r\n" : "\n";
+}
+function normalizeEol(text2, eol) {
+  return text2.replace(/\r\n|\r|\n/g, eol);
+}
+function classifyHeyspexYaml(text2) {
+  if (text2 === null) return "none";
+  if (/^vault_path:[ \t]*[^\s#]/m.test(text2)) return "satellite";
+  if (/^kind:[ \t]*["']?repo-binding["']?[ \t]*$/m.test(text2)) return "repo-binding";
+  const markerKey = /^(vault_id|vault_root):/m.test(text2);
+  if (!markerKey && /^vault:/m.test(text2)) return "repo-binding";
+  return "vault";
+}
+function pullTargetRefusal(repoRoot, markerText) {
+  const kind = classifyHeyspexYaml(markerText);
+  if (kind !== "satellite" && kind !== "repo-binding") return null;
+  return `refusing to write specs/ into ${repoRoot}: its heyspex.yaml is a ${kind} marker (a code repo that names its vault elsewhere), not a vault checkout. Nothing was written. Run \`hs pull\` inside the vault's own checkout (\`hs vault resolve\` shows which one this repo is bound to).`;
+}
 function normalizeSpecRelPath(raw) {
   if (typeof raw !== "string") return null;
   let p = raw.trim();
@@ -8157,11 +8217,11 @@ function selectRemoteRefs(remote, only) {
   const selected = [];
   for (const ref of remote) {
     const id = (ref.id ?? "").toLowerCase();
-    const basename4 = (ref.basename ?? "").toLowerCase();
+    const basename5 = (ref.basename ?? "").toLowerCase();
     let hit = null;
     for (const sel of selectors) {
       const s = sel.toLowerCase();
-      if (id === s || basename4 === s || id.startsWith(`${s}-`) || basename4.startsWith(`${s}-`)) {
+      if (id === s || basename5 === s || id.startsWith(`${s}-`) || basename5.startsWith(`${s}-`)) {
         hit = sel;
         break;
       }
@@ -8212,7 +8272,7 @@ function decidePullPlan({
       });
       continue;
     }
-    const basename4 = basenameOfRelPath(relPath);
+    const basename5 = basenameOfRelPath(relPath);
     if (hasDotSegment(relPath)) {
       skip2.push({
         id: ref.id,
@@ -8228,7 +8288,7 @@ function decidePullPlan({
         pull.push({
           id: ref.id,
           relPath,
-          basename: basename4,
+          basename: basename5,
           overwrites: true,
           remoteUpdatedAt: ref.updatedAt ?? void 0
         });
@@ -8236,7 +8296,7 @@ function decidePullPlan({
         pull.push({
           id: ref.id,
           relPath,
-          basename: basename4,
+          basename: basename5,
           overwrites: true,
           remoteUpdatedAt: ref.updatedAt ?? void 0,
           fastForwardFromHash: ffHash
@@ -8246,7 +8306,7 @@ function decidePullPlan({
       }
       continue;
     }
-    const elsewhere = localByBasename.get(basename4.toLowerCase());
+    const elsewhere = localByBasename.get(basename5.toLowerCase());
     if (elsewhere) {
       skip2.push({
         id: ref.id,
@@ -8259,7 +8319,7 @@ function decidePullPlan({
     pull.push({
       id: ref.id,
       relPath,
-      basename: basename4,
+      basename: basename5,
       overwrites: false,
       remoteUpdatedAt: ref.updatedAt ?? void 0
     });
@@ -8320,7 +8380,8 @@ async function runVaultPull(deps, options2 = {}) {
           });
           continue;
         }
-        const bytes = deps.serialize(content.body, content.frontmatter);
+        const serialized = deps.serialize(content.body, content.frontmatter);
+        const bytes = deps.eolFor ? normalizeEol(serialized, await deps.eolFor(item.relPath)) : serialized;
         if (item.fastForwardFromHash && deps.hashLocal) {
           const nowHash = await deps.hashLocal(item.relPath);
           if (nowHash !== item.fastForwardFromHash) {
@@ -8434,16 +8495,17 @@ function formatPullSummary(result, { detail = false, sampleSize = 5 } = {}) {
 }
 
 // spex-console/src/lib/vault-sync/pull-io.ts
-import { promises as fs10 } from "node:fs";
+import { promises as fs10, readFileSync as readFileSync14 } from "node:fs";
+import { EOL } from "node:os";
 import nodePath3 from "node:path";
 
 // spex-console/src/lib/dev-mode.ts
 init_heyspex_home2();
 init_credentials();
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join10 } from "node:path";
 var CLOUD_CONSOLE_URL2 = "https://app.heyspex.com";
-var defaultReadFile = (p) => readFileSync10(p, "utf8");
+var defaultReadFile = (p) => readFileSync11(p, "utf8");
 function readCredentialsMcpToken({
   homeDir = heyspexHome2(),
   readFile = defaultReadFile
@@ -8461,6 +8523,30 @@ function readCredentialsMcpToken({
 init_heyspex_home2();
 init_vault();
 init_vault_frontmatter();
+var DEFAULT_PULL_EOL = EOL === "\r\n" ? "\r\n" : "\n";
+async function eolForPath(abs, fallback = DEFAULT_PULL_EOL) {
+  try {
+    return detectEol(await fs10.readFile(abs, "utf8")) ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+var PullTargetNotVaultError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PullTargetNotVaultError";
+  }
+};
+function assertPullTargetIsVault(repoRoot) {
+  let text2;
+  try {
+    text2 = readFileSync14(nodePath3.join(repoRoot, "heyspex.yaml"), "utf8");
+  } catch {
+    text2 = null;
+  }
+  const refusal = pullTargetRefusal(repoRoot, text2);
+  if (refusal) throw new PullTargetNotVaultError(refusal);
+}
 var LIST_FIELDS = "id,basename,relPath,type,status,updated,updatedAt";
 var PULL_LIST_PAGE_LIMIT = 500;
 var PULL_LIST_MAX_PAGES = 2e3;
@@ -8484,10 +8570,10 @@ function resolvePullSourceUrl(explicit) {
   const raw = explicit?.trim() || process.env.HEYSPEX_PULL_SOURCE_URL?.trim() || CLOUD_CONSOLE_URL2;
   return raw.replace(/\/+$/, "");
 }
-async function getJson({ baseUrl, token, fetchImpl = fetch, scopeHeaders = {} }, path15) {
+async function getJson({ baseUrl, token, fetchImpl = fetch, scopeHeaders = {} }, path16) {
   const headers = { Accept: "application/json", ...scopeHeaders };
   if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetchImpl(`${baseUrl}/${path15.replace(/^\/+/, "")}`, { headers });
+  const res = await fetchImpl(`${baseUrl}/${path16.replace(/^\/+/, "")}`, { headers });
   const text2 = await res.text();
   let json = null;
   try {
@@ -8652,6 +8738,12 @@ function createVaultPullDeps({
 }) {
   const http = { baseUrl, token, fetchImpl, scopeHeaders };
   const prefetched = /* @__PURE__ */ new Map();
+  let targetChecked = false;
+  const guardTarget = () => {
+    if (!localRoot || targetChecked) return;
+    assertPullTargetIsVault(nodePath3.dirname(localRoot));
+    targetChecked = true;
+  };
   return {
     listRemote: () => listRemoteSpecs(http),
     getRemoteRef: async (selector) => {
@@ -8673,7 +8765,9 @@ function createVaultPullDeps({
     finish: ledger ? () => ledger.flush() : void 0,
     listLocal: () => listLocalSpecRelPaths(localRoot ?? vaultRoot()),
     serialize: stringifySpecMarkdown,
+    eolFor: (relPath) => eolForPath(nodePath3.join(localRoot ?? vaultRoot(), relPath)),
     writeSpec: localRoot ? async (relPath, content, opts) => {
+      guardTarget();
       const abs = nodePath3.join(localRoot, relPath);
       await fs10.mkdir(nodePath3.dirname(abs), { recursive: true });
       onLocalWrite?.(relPath);
@@ -8923,9 +9017,9 @@ async function runVaultPush(deps, options2 = {}) {
       result.skipped.push(item(pre.reason, pre.detail));
       continue;
     }
-    const basename4 = basenameOfRelPath(relPath);
+    const basename5 = basenameOfRelPath(relPath);
     if (remoteIndex) {
-      const stamp = remoteIndex.get(basename4.toLowerCase());
+      const stamp = remoteIndex.get(basename5.toLowerCase());
       if (stamp === void 0) {
         result.skipped.push(
           item("new-on-disk", "no remote row - hs never creates cloud specs from a disk file")
@@ -8944,7 +9038,7 @@ async function runVaultPush(deps, options2 = {}) {
     }
     let remote;
     try {
-      remote = await deps.fetchRemote(basename4);
+      remote = await deps.fetchRemote(basename5);
     } catch (err) {
       result.failed.push({
         relPath,
@@ -8992,7 +9086,7 @@ async function runVaultPush(deps, options2 = {}) {
     puts += 1;
     let put;
     try {
-      put = await deps.putRemote(basename4, {
+      put = await deps.putRemote(basename5, {
         frontmatter: payload.frontmatter,
         body: payload.body
       });
@@ -9046,7 +9140,7 @@ import nodePath4 from "node:path";
 init_vault_frontmatter();
 async function putRemoteSpec(http, id, payload) {
   const { baseUrl, token, fetchImpl = fetch } = http;
-  const path15 = `/api/specs/${encodeURIComponent(id)}`;
+  const path16 = `/api/specs/${encodeURIComponent(id)}`;
   const scope = http.accountId && http.vaultId ? cloudRequestScope({ accountId: http.accountId, vaultId: http.vaultId }).headersFor(
     "PUT",
     "/api/specs/:id"
@@ -9057,7 +9151,7 @@ async function putRemoteSpec(http, id, payload) {
     ...scope
   };
   if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetchImpl(`${baseUrl}${path15}`, {
+  const res = await fetchImpl(`${baseUrl}${path16}`, {
     method: "PUT",
     headers,
     body: JSON.stringify({ frontmatter: payload.frontmatter, body: payload.body })
@@ -9073,7 +9167,7 @@ async function putRemoteSpec(http, id, payload) {
     return {
       ok: false,
       status: res.status,
-      error: `PUT ${path15} returned ${res.status}: ${text2.slice(0, 200)}`,
+      error: `PUT ${path16} returned ${res.status}: ${text2.slice(0, 200)}`,
       ...res.status === 429 && Number.isFinite(retry) && retry > 0 ? { retryAfterSec: retry } : {}
     };
   }
@@ -9085,19 +9179,19 @@ async function putRemoteSpec(http, id, payload) {
     statusIgnored: json?.status_ignored === true
   };
 }
-async function fetchPushRemote(http, basename4) {
-  const { status, json, text: text2 } = await getJson(http, `api/specs/${encodeURIComponent(basename4)}`);
+async function fetchPushRemote(http, basename5) {
+  const { status, json, text: text2 } = await getJson(http, `api/specs/${encodeURIComponent(basename5)}`);
   if (status === 404) return null;
   if (status !== 200) {
     throw new VaultPullSourceError(
-      `GET /api/specs/${basename4} returned ${status}: ${text2.slice(0, 200)}`,
+      `GET /api/specs/${basename5} returned ${status}: ${text2.slice(0, 200)}`,
       status
     );
   }
   const spec = json?.spec;
   const fm = spec?.frontmatter && typeof spec.frontmatter === "object" ? spec.frontmatter : null;
   if (!spec || typeof spec.body !== "string" || !fm) {
-    throw new VaultPullSourceError(`GET /api/specs/${basename4} returned no usable spec`, status);
+    throw new VaultPullSourceError(`GET /api/specs/${basename5} returned no usable spec`, status);
   }
   return {
     id: String(spec.id ?? fm.id ?? ""),
@@ -9139,10 +9233,10 @@ function createVaultPushDeps({
       }
     },
     readLedger: () => ledger.snapshot(),
-    fetchRemote: (basename4) => fetchPushRemote(http, basename4),
+    fetchRemote: (basename5) => fetchPushRemote(http, basename5),
     listRemote: withListIndex ? () => listRemoteSpecs(http) : void 0,
     serialize: stringifySpecMarkdown,
-    putRemote: (basename4, payload) => putRemoteSpec(http, basename4, payload),
+    putRemote: (basename5, payload) => putRemoteSpec(http, basename5, payload),
     recordLedger: (relPath, entry) => ledger.record(relPath, entry),
     flushLedger: () => ledger.flush(),
     markDirty
@@ -9348,7 +9442,7 @@ function makeSleeper() {
 }
 function readMarkerVaultId(vaultRoot2) {
   try {
-    return parseVaultId(readFileSync13(path14.join(vaultRoot2, "heyspex.yaml"), "utf8"));
+    return parseVaultId(readFileSync15(path15.join(vaultRoot2, "heyspex.yaml"), "utf8"));
   } catch {
     return null;
   }
@@ -9386,6 +9480,17 @@ ${PULL_HELP}
     process4.exitCode = PULL_EXIT.RUNTIME;
     return;
   }
+  if (args.apply) {
+    try {
+      assertPullTargetIsVault(vaultRoot2);
+    } catch (err) {
+      if (!(err instanceof PullTargetNotVaultError)) throw err;
+      process4.stderr.write(`hs pull: ${err.message}
+`);
+      process4.exitCode = PULL_EXIT.VAULT_UNRESOLVED;
+      return;
+    }
+  }
   const baseUrl = resolvePullSourceUrl(args.from);
   const token = resolvePullToken();
   if (!token && /^https:/i.test(baseUrl)) {
@@ -9414,7 +9519,7 @@ ${PULL_HELP}
   const markerVaultId = readMarkerVaultId(vaultRoot2);
   if (args.apply && markerVaultId && markerVaultId !== target.vaultId) {
     process4.stderr.write(
-      `hs pull: refusing --apply: it would write vault ${target.vaultId} into ${path14.join(vaultRoot2, "specs")}, but that repo's heyspex.yaml names vault ${markerVaultId}. Nothing was written.
+      `hs pull: refusing --apply: it would write vault ${target.vaultId} into ${path15.join(vaultRoot2, "specs")}, but that repo's heyspex.yaml names vault ${markerVaultId}. Nothing was written.
     Drop --vault to pull ${markerVaultId}, or run from the repo that holds ${target.vaultId}.
 `
     );
@@ -9431,7 +9536,7 @@ ${PULL_HELP}
     baseUrl,
     token,
     scopeHeaders,
-    localRoot: path14.join(vaultRoot2, "specs"),
+    localRoot: path15.join(vaultRoot2, "specs"),
     ledger,
     onLocalWrite: (relPath) => pushScheduler?.notePullWrite(relPath)
   });
@@ -9499,7 +9604,7 @@ watch: every ${args.intervalSec}s while active, backing off to ${Math.round(Math
           `relay: push startup sweep failed \u2014 ${err instanceof Error ? err.message : String(err)}`
         );
       }
-      closePushWatch = await startPushFileWatch(path14.join(vaultRoot2, "specs"), pushScheduler);
+      closePushWatch = await startPushFileWatch(path15.join(vaultRoot2, "specs"), pushScheduler);
     }
     const summary = await runPullWatch(
       {