heyspex 0.2.2 → 0.2.4

package/dist/cli/hs-env.mjs

@@ -112,7 +112,7 @@ var require_main = __commonJS({
   "node_modules/dotenv/lib/main.js"(exports, module) {
     "use strict";
     var fs = __require("fs");
-    var path7 = __require("path");
+    var path8 = __require("path");
     var os2 = __require("os");
     var crypto3 = __require("crypto");
     var packageJson = require_package();
@@ -228,7 +228,7 @@ var require_main = __commonJS({
           possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
         }
       } else {
-        possibleVaultPath = path7.resolve(process.cwd(), ".env.vault");
+        possibleVaultPath = path8.resolve(process.cwd(), ".env.vault");
       }
       if (fs.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
@@ -236,7 +236,7 @@ var require_main = __commonJS({
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path7.join(os2.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path8.join(os2.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options) {
       const debug = Boolean(options && options.debug);
@@ -253,7 +253,7 @@ var require_main = __commonJS({
       return { parsed };
     }
     function configDotenv(options) {
-      const dotenvPath2 = path7.resolve(process.cwd(), ".env");
+      const dotenvPath2 = path8.resolve(process.cwd(), ".env");
       let encoding = "utf8";
       const debug = Boolean(options && options.debug);
       const quiet = options && "quiet" in options ? options.quiet : true;
@@ -277,13 +277,13 @@ var require_main = __commonJS({
       }
       let lastError;
       const parsedAll = {};
-      for (const path8 of optionPaths) {
+      for (const path9 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs.readFileSync(path8, { encoding }));
+          const parsed = DotenvModule.parse(fs.readFileSync(path9, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e) {
           if (debug) {
-            _debug(`Failed to load ${path8} ${e.message}`);
+            _debug(`Failed to load ${path9} ${e.message}`);
           }
           lastError = e;
         }
@@ -298,7 +298,7 @@ var require_main = __commonJS({
         const shortPaths = [];
         for (const filePath of optionPaths) {
           try {
-            const relative = path7.relative(process.cwd(), filePath);
+            const relative = path8.relative(process.cwd(), filePath);
             shortPaths.push(relative);
           } catch (e) {
             if (debug) {
@@ -475,17 +475,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path7) {
-      const ctrl = callVisitor(key, node, visitor, path7);
+    function visit_(key, node, visitor, path8) {
+      const ctrl = callVisitor(key, node, visitor, path8);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path7, ctrl);
-        return visit_(key, ctrl, visitor, path7);
+        replaceNode(key, path8, ctrl);
+        return visit_(key, ctrl, visitor, path8);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path7 = Object.freeze(path7.concat(node));
+          path8 = Object.freeze(path8.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path7);
+            const ci = visit_(i, node.items[i], visitor, path8);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -496,13 +496,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path7 = Object.freeze(path7.concat(node));
-          const ck = visit_("key", node.key, visitor, path7);
+          path8 = Object.freeze(path8.concat(node));
+          const ck = visit_("key", node.key, visitor, path8);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path7);
+          const cv = visit_("value", node.value, visitor, path8);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -523,17 +523,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path7) {
-      const ctrl = await callVisitor(key, node, visitor, path7);
+    async function visitAsync_(key, node, visitor, path8) {
+      const ctrl = await callVisitor(key, node, visitor, path8);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path7, ctrl);
-        return visitAsync_(key, ctrl, visitor, path7);
+        replaceNode(key, path8, ctrl);
+        return visitAsync_(key, ctrl, visitor, path8);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path7 = Object.freeze(path7.concat(node));
+          path8 = Object.freeze(path8.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path7);
+            const ci = await visitAsync_(i, node.items[i], visitor, path8);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -544,13 +544,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path7 = Object.freeze(path7.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path7);
+          path8 = Object.freeze(path8.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path8);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path7);
+          const cv = await visitAsync_("value", node.value, visitor, path8);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -577,23 +577,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path7) {
+    function callVisitor(key, node, visitor, path8) {
       if (typeof visitor === "function")
-        return visitor(key, node, path7);
+        return visitor(key, node, path8);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path7);
+        return visitor.Map?.(key, node, path8);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path7);
+        return visitor.Seq?.(key, node, path8);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path7);
+        return visitor.Pair?.(key, node, path8);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path7);
+        return visitor.Scalar?.(key, node, path8);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path7);
+        return visitor.Alias?.(key, node, path8);
       return void 0;
     }
-    function replaceNode(key, path7, node) {
-      const parent = path7[path7.length - 1];
+    function replaceNode(key, path8, node) {
+      const parent = path8[path8.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -1203,10 +1203,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path7, value) {
+    function collectionFromPath(schema, path8, value) {
       let v = value;
-      for (let i = path7.length - 1; i >= 0; --i) {
-        const k = path7[i];
+      for (let i = path8.length - 1; i >= 0; --i) {
+        const k = path8[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -1225,7 +1225,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path7) => path7 == null || typeof path7 === "object" && !!path7[Symbol.iterator]().next().done;
+    var isEmptyPath = (path8) => path8 == null || typeof path8 === "object" && !!path8[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -1255,11 +1255,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path7, value) {
-        if (isEmptyPath(path7))
+      addIn(path8, value) {
+        if (isEmptyPath(path8))
           this.add(value);
         else {
-          const [key, ...rest] = path7;
+          const [key, ...rest] = path8;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -1273,8 +1273,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path7) {
-        const [key, ...rest] = path7;
+      deleteIn(path8) {
+        const [key, ...rest] = path8;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -1288,8 +1288,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path7, keepScalar) {
-        const [key, ...rest] = path7;
+      getIn(path8, keepScalar) {
+        const [key, ...rest] = path8;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -1307,8 +1307,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path7) {
-        const [key, ...rest] = path7;
+      hasIn(path8) {
+        const [key, ...rest] = path8;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -1318,8 +1318,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path7, value) {
-        const [key, ...rest] = path7;
+      setIn(path8, value) {
+        const [key, ...rest] = path8;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -3834,9 +3834,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path7, value) {
+      addIn(path8, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path7, value);
+          this.contents.addIn(path8, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3911,14 +3911,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path7) {
-        if (Collection.isEmptyPath(path7)) {
+      deleteIn(path8) {
+        if (Collection.isEmptyPath(path8)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path7) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path8) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3933,10 +3933,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path7, keepScalar) {
-        if (Collection.isEmptyPath(path7))
+      getIn(path8, keepScalar) {
+        if (Collection.isEmptyPath(path8))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path7, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path8, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3947,10 +3947,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path7) {
-        if (Collection.isEmptyPath(path7))
+      hasIn(path8) {
+        if (Collection.isEmptyPath(path8))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path7) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path8) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3967,13 +3967,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path7, value) {
-        if (Collection.isEmptyPath(path7)) {
+      setIn(path8, value) {
+        if (Collection.isEmptyPath(path8)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path7), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path8), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path7, value);
+          this.contents.setIn(path8, value);
         }
       }
       /**
@@ -5933,9 +5933,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path7) => {
+    visit.itemAtPath = (cst, path8) => {
       let item = cst;
-      for (const [field, index] of path7) {
+      for (const [field, index] of path8) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5944,23 +5944,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path7) => {
-      const parent = visit.itemAtPath(cst, path7.slice(0, -1));
-      const field = path7[path7.length - 1][0];
+    visit.parentCollection = (cst, path8) => {
+      const parent = visit.itemAtPath(cst, path8.slice(0, -1));
+      const field = path8[path8.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path7, item, visitor) {
-      let ctrl = visitor(item, path7);
+    function _visit(path8, item, visitor) {
+      let ctrl = visitor(item, path8);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path7.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path8.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5971,10 +5971,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path7);
+            ctrl = ctrl(item, path8);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path7) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path8) : ctrl;
     }
     exports.visit = visit;
   }
@@ -9829,11 +9829,11 @@ var require_baseGet = __commonJS({
     "use strict";
     var castPath = require_castPath();
     var toKey = require_toKey();
-    function baseGet(object, path7) {
-      path7 = castPath(path7, object);
-      var index = 0, length = path7.length;
+    function baseGet(object, path8) {
+      path8 = castPath(path8, object);
+      var index = 0, length = path8.length;
       while (object != null && index < length) {
-        object = object[toKey(path7[index++])];
+        object = object[toKey(path8[index++])];
       }
       return index && index == length ? object : void 0;
     }
@@ -9846,8 +9846,8 @@ var require_get = __commonJS({
   "node_modules/lodash/get.js"(exports, module) {
     "use strict";
     var baseGet = require_baseGet();
-    function get2(object, path7, defaultValue) {
-      var result = object == null ? void 0 : baseGet(object, path7);
+    function get2(object, path8, defaultValue) {
+      var result = object == null ? void 0 : baseGet(object, path8);
       return result === void 0 ? defaultValue : result;
     }
     module.exports = get2;
@@ -21810,14 +21810,16 @@ var init_dev_mode = __esm({
 
 // spex-console/bin/hs-env.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { networkInterfaces } from "node:os";
-import path6 from "node:path";
+import path7 from "node:path";
 import process3 from "node:process";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // scripts/lib/shared-path-helpers.mjs
+import { realpathSync } from "node:fs";
 import { isAbsolute, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 function resolveCodeRoot({
   explicit,
   packageRoot,
@@ -26299,17 +26301,17 @@ import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomBytes as randomBytes5 } from "node:crypto";
 import {
   chmodSync,
-  existsSync as existsSync9,
-  mkdirSync as mkdirSync8,
+  existsSync as existsSync10,
+  mkdirSync as mkdirSync9,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync12,
-  renameSync as renameSync7,
-  statSync as statSync3,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync8
+  readFileSync as readFileSync13,
+  renameSync as renameSync8,
+  statSync as statSync6,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync9
 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import path5 from "node:path";
+import { homedir as homedir12 } from "node:os";
+import path6 from "node:path";
 
 // node_modules/sops-age/dist/index.js
 var import_dotenv = __toESM(require_main(), 1);
@@ -26793,8 +26795,8 @@ function getErrorMap() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path7, errorMaps, issueData } = params;
-  const fullPath = [...path7, ...issueData.path || []];
+  const { data, path: path8, errorMaps, issueData } = params;
+  const fullPath = [...path8, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -26910,11 +26912,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path7, key) {
+  constructor(parent, value, path8, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path7;
+    this._path = path8;
     this._key = key;
   }
   get path() {
@@ -34983,18 +34985,18 @@ import { homedir as homedir2, platform } from "node:os";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 var import_sshpk = __toESM(require_lib2(), 1);
-async function loadFromFile(path7) {
+async function loadFromFile(path8) {
   if (globalThis.Deno) {
-    return Deno.readTextFile(path7);
+    return Deno.readTextFile(path8);
   }
   if (globalThis.Bun) {
-    return Bun.file(path7).text();
+    return Bun.file(path8).text();
   }
   if (typeof process !== "undefined" && process.versions?.node) {
     const fs = await import("fs/promises");
-    return fs.readFile(path7, "utf-8");
+    return fs.readFile(path8, "utf-8");
   }
-  throw new Error(`Unable to determine method to load file "${path7}"`);
+  throw new Error(`Unable to determine method to load file "${path8}"`);
 }
 function isSopsInput(value) {
   if (!value) {
@@ -35102,13 +35104,13 @@ async function parseSops(input, sopsFileType) {
     });
   }
 }
-async function loadSopsFile(path7, sopsFileType) {
+async function loadSopsFile(path8, sopsFileType) {
   try {
-    const content = await loadFromFile(path7);
+    const content = await loadFromFile(path8);
     return await parseSops(content, sopsFileType);
   } catch (err) {
     throw new Error(
-      `Failed to load SOPS file '${path7}': ${err.message}`,
+      `Failed to load SOPS file '${path8}': ${err.message}`,
       {
         cause: err
       }
@@ -35525,15 +35527,15 @@ async function getSopsEncryptionKey(sops, secretKeys) {
 ${errors.join("\n")}`
   );
 }
-function path2gopath(path7) {
-  return `${path7.filter((x) => !/^\d+$/.test(x)).join(":")}:`;
+function path2gopath(path8) {
+  return `${path8.filter((x) => !/^\d+$/.test(x)).join(":")}:`;
 }
-function decryptSOPSValue(ciphertext, decryptionKey, path7) {
+function decryptSOPSValue(ciphertext, decryptionKey, path8) {
   if (!ciphertext) {
     return "";
   }
   const encryptedValue = parse(ciphertext);
-  const aad = path2gopath(path7);
+  const aad = path2gopath(path8);
   let decrypted;
   try {
     decrypted = decryptAesGcm(
@@ -35543,22 +35545,22 @@ function decryptSOPSValue(ciphertext, decryptionKey, path7) {
     );
   } catch (err) {
     throw new Error(
-      `AES-GCM decryption failed at path ${JSON.stringify(path7)} for value "${ciphertext}": ${err instanceof Error ? err.message : String(err)}`
+      `AES-GCM decryption failed at path ${JSON.stringify(path8)} for value "${ciphertext}": ${err instanceof Error ? err.message : String(err)}`
     );
   }
   const decryptedValue = new TextDecoder().decode(decrypted);
   return convertDecryptedValue(decryptedValue, encryptedValue.datatype);
 }
-function decryptObject(obj, decryptionKey, path7 = []) {
+function decryptObject(obj, decryptionKey, path8 = []) {
   if (typeof obj !== "object" || obj === null) {
     return obj;
   }
   for (const key of Object.keys(obj)) {
     const value = obj[key];
     if (typeof value === "string" && value.startsWith("ENC[AES256_GCM,data:")) {
-      obj[key] = decryptSOPSValue(value, decryptionKey, [...path7, key]);
+      obj[key] = decryptSOPSValue(value, decryptionKey, [...path8, key]);
     } else if (typeof value === "object") {
-      obj[key] = decryptObject(value, decryptionKey, [...path7, key]);
+      obj[key] = decryptObject(value, decryptionKey, [...path8, key]);
     }
   }
   return obj;
@@ -35637,16 +35639,16 @@ import { homedir as homedir6 } from "node:os";
 import { join as join7 } from "node:path";
 
 // spex-console/src/lib/cli/control-shared.ts
-import path4 from "node:path";
+import path5 from "node:path";
 
 // scripts/lib/hs-command.mjs
 import { existsSync as existsSync5 } from "node:fs";
 import { delimiter, dirname as dirname2, join as join8 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 var HS_BIN_NAME = "hs";
 var HS_DISPATCHER_PATH = (() => {
   try {
-    const here = dirname2(fileURLToPath(import.meta.url));
+    const here = dirname2(fileURLToPath2(import.meta.url));
     return join8(dirname2(dirname2(here)), "bin", "hs.mjs");
   } catch {
     return null;
@@ -35660,8 +35662,8 @@ var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER
 // vendor/heyspex-mcp/console-fetch.mjs
 init_heyspex_home();
 init_credentials();
-import { readFileSync as readFileSync10 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
+import { readFileSync as readFileSync11 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
 import { join as join12 } from "node:path";
 
 // vendor/heyspex-mcp/session-owner.mjs
@@ -35696,9 +35698,30 @@ import { basename, join as join10, isAbsolute as isAbsolute2 } from "node:path";
 
 // vendor/heyspex-mcp/vault-resolve.mjs
 init_heyspex_home();
-import { existsSync as existsSync7, readFileSync as readFileSync9 } from "node:fs";
-import { homedir as homedir8, tmpdir } from "node:os";
-import { dirname as dirname3, join as join11, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync10, realpathSync as realpathSync3, statSync as statSync5 } from "node:fs";
+import { homedir as homedir9, tmpdir } from "node:os";
+
+// vendor/heyspex-mcp/usable-dir-env.mjs
+import { statSync as statSync3 } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+import { basename as basename2, dirname as dirname3, join as join11, resolve as resolve3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-binding.mjs
+import {
+  copyFileSync,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync9,
+  realpathSync as realpathSync2,
+  renameSync as renameSync6,
+  statSync as statSync4,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import path4 from "node:path";
 
 // vendor/heyspex-mcp/console-fetch.mjs
 var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
@@ -35707,11 +35730,11 @@ var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMAT
 init_credentials();
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync11, renameSync as renameSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync as renameSync7, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname4, join as join13, resolve as resolve4 } from "node:path";
 
 // spex-console/src/lib/heyspex-home.ts
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 
 // spex-console/src/lib/cli/init.ts
 function parseVaultId(content) {
@@ -35746,12 +35769,15 @@ var HELP2 = [
   "(spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
   "copied verbatim, template-shape docs written as author-prompt skeletons \u2014",
   "plus a generated CLAUDE.md, the kept-principles index, and the template_version",
-  "pin; with --git, one initial `git init` + commit. Rerunnable: a <dir> that already",
-  "holds heyspex.yaml and an empty/placeholder-only specs/ is accepted, existing",
-  "files are never overwritten (an existing CLAUDE.md gets a CLAUDE.md.template",
-  "beside it), and the result lists each manifest row as created or kept. Refuses a",
-  "non-empty <dir> without heyspex.yaml, or a specs/ holding managed specs.",
-  "See init.customer-vault.ts.",
+  "pin; with --git, one initial `git init` + commit. On an EXISTING vault (<dir>",
+  "holds heyspex.yaml with a vault_id) it is a REFRESH \u2014 the repair `hs doctor`'s",
+  "vault-template row names: only missing shipped files are added, template_version",
+  "is written/updated in heyspex.yaml (every other byte and the vault_id kept),",
+  "nothing existing is ever overwritten (an existing CLAUDE.md gets a",
+  "CLAUDE.md.template beside it), the result lists each manifest row as created or",
+  "kept, and a second run writes nothing. <dir> may be any path (a satellite repo",
+  "names its vault, e.g. `hs init --customer-vault ../my-specs`). Refuses only a",
+  "non-empty <dir> that has no heyspex.yaml. See init.customer-vault.ts.",
   "",
   "Flags:",
   "  --console-url <url>  console_url value (default: the mode-aware console --",
@@ -36057,23 +36083,23 @@ function isExpiredDate(expires, today = todayIso()) {
   return expires !== null && today > expires;
 }
 function envDir(vaultRoot) {
-  return path5.join(vaultRoot, ".heyspex", "env");
+  return path6.join(vaultRoot, ".heyspex", "env");
 }
 function profilePath(vaultRoot, name) {
-  return path5.join(envDir(vaultRoot), `${name}.env`);
+  return path6.join(envDir(vaultRoot), `${name}.env`);
 }
 function keysPath(vaultRoot) {
-  return path5.join(vaultRoot, ".heyspex", "env.keys");
+  return path6.join(vaultRoot, ".heyspex", "env.keys");
 }
 function homeKeysPath() {
-  return path5.join(process.env.HEYSPEX_ENV_KEYS_HOME || homedir11(), ".heyspex", "env.keys");
+  return path6.join(process.env.HEYSPEX_ENV_KEYS_HOME || homedir12(), ".heyspex", "env.keys");
 }
 function dotenvPath(vaultRoot) {
-  return path5.join(vaultRoot, ".env");
+  return path6.join(vaultRoot, ".env");
 }
 function readOrNull(file) {
   try {
-    return readFileSync12(file, "utf-8");
+    return readFileSync13(file, "utf-8");
   } catch {
     return null;
   }
@@ -36087,7 +36113,7 @@ function renameWithRetry(tmp, file) {
   const retryable = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
   for (let attempt = 0; ; attempt++) {
     try {
-      renameSync7(tmp, file);
+      renameSync8(tmp, file);
       return;
     } catch (err) {
       const code = err.code ?? "";
@@ -36098,21 +36124,21 @@ function renameWithRetry(tmp, file) {
 }
 function unlinkQuiet(file) {
   try {
-    unlinkSync3(file);
+    unlinkSync4(file);
   } catch {
   }
 }
 function atomicWrite(file, content, mode = 420) {
   const secret = mode === SECRET_MODE;
-  const dir = path5.dirname(file);
-  mkdirSync8(dir, { recursive: true, ...secret ? { mode: SECRET_DIR_MODE } : {} });
-  const tmp = path5.join(
+  const dir = path6.dirname(file);
+  mkdirSync9(dir, { recursive: true, ...secret ? { mode: SECRET_DIR_MODE } : {} });
+  const tmp = path6.join(
     dir,
-    `.${path5.basename(file)}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`
+    `.${path6.basename(file)}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`
   );
   let renamed = false;
   try {
-    writeFileSync8(tmp, content, { encoding: "utf-8", mode });
+    writeFileSync9(tmp, content, { encoding: "utf-8", mode });
     if (secret) chmodOwnerOnly(tmp);
     renameWithRetry(tmp, file);
     renamed = true;
@@ -36126,18 +36152,18 @@ var LOCK_RETRY_MS3 = 50;
 var LOCK_STALE_MS3 = 5e3;
 function withFileLock(file, fn) {
   const lock = `${file}.lock`;
-  mkdirSync8(path5.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
+  mkdirSync9(path6.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
   let held = false;
   for (let attempt = 0; attempt < LOCK_RETRIES && !held; attempt++) {
     try {
-      writeFileSync8(lock, `${process.pid}
+      writeFileSync9(lock, `${process.pid}
 `, { flag: "wx" });
       held = true;
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       let ageMs = Infinity;
       try {
-        ageMs = Date.now() - statSync3(lock).mtimeMs;
+        ageMs = Date.now() - statSync6(lock).mtimeMs;
       } catch {
         ageMs = Infinity;
       }
@@ -36179,7 +36205,7 @@ function writeHomeKeyLine(profileName, privateKey, vaultId) {
 }
 function readVaultId(vaultRoot) {
   try {
-    const raw = readOrNull(path5.join(vaultRoot, "heyspex.yaml"));
+    const raw = readOrNull(path6.join(vaultRoot, "heyspex.yaml"));
     return raw === null ? null : parseVaultId(raw);
   } catch {
     return null;
@@ -36322,7 +36348,7 @@ function legacyDecryptAllSync(vaultRoot, name) {
 }
 function initProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   const pFile = profilePath(vaultRoot, name);
-  if (existsSync9(pFile) && !opts.force) {
+  if (existsSync10(pFile) && !opts.force) {
     throw new EnvVaultConfigError(
       `Env profile "${name}" already exists at ${pFile}. Pass --force to re-key it (this discards existing values and mints a new keypair).`
     );
@@ -36364,7 +36390,7 @@ function saveProfile(vaultRoot, name, profile) {
 function listProfiles(vaultRoot) {
   const dir = envDir(vaultRoot);
   try {
-    if (!statSync3(dir).isDirectory()) return [];
+    if (!statSync6(dir).isDirectory()) return [];
   } catch {
     return [];
   }
@@ -36708,7 +36734,7 @@ function removeGrant(vaultRoot, profileName, name, opts = {}) {
 }
 async function exportProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   const target = dotenvPath(vaultRoot);
-  if (existsSync9(target) && !opts.force) {
+  if (existsSync10(target) && !opts.force) {
     throw new EnvVaultConfigError(
       `${target} already exists. Pass --force to overwrite it (it is disposable \u2014 the encrypted profile is the system of record).`
     );
@@ -36720,10 +36746,10 @@ async function exportProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   return { path: target };
 }
 function resolveVaultPath(vaultRoot, filePath) {
-  const root = path5.resolve(vaultRoot);
-  const resolved = path5.resolve(root, filePath);
-  const rel = path5.relative(root, resolved);
-  if (path5.isAbsolute(filePath) || path5.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path5.sep}`)) {
+  const root = path6.resolve(vaultRoot);
+  const resolved = path6.resolve(root, filePath);
+  const rel = path6.relative(root, resolved);
+  if (path6.isAbsolute(filePath) || path6.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path6.sep}`)) {
     throw new EnvVaultConfigError(
       `Refusing to touch "${filePath}" \u2014 it resolves outside the vault root (${root}). Vault file paths must stay inside the repo (no "..", no absolute paths).`
     );
@@ -36737,12 +36763,12 @@ function writeTextFile(vaultRoot, filePath, content) {
   atomicWrite(resolveVaultPath(vaultRoot, filePath), content, SECRET_MODE);
 }
 function pathExists(vaultRoot, filePath) {
-  return existsSync9(resolveVaultPath(vaultRoot, filePath));
+  return existsSync10(resolveVaultPath(vaultRoot, filePath));
 }
 function fileMtime(vaultRoot, filePath) {
   const resolved = resolveVaultPath(vaultRoot, filePath);
   try {
-    return statSync3(resolved).mtimeMs;
+    return statSync6(resolved).mtimeMs;
   } catch {
     return null;
   }
@@ -36771,7 +36797,7 @@ function listRepoSourceFiles(vaultRoot) {
     for (const entry of entries) {
       const childRel = rel === "" ? entry.name : `${rel}/${entry.name}`;
       if (entry.isDirectory()) {
-        if (!WALK_SKIP_DIRS.has(entry.name)) walk(path5.join(dir, entry.name), childRel);
+        if (!WALK_SKIP_DIRS.has(entry.name)) walk(path6.join(dir, entry.name), childRel);
       } else if (entry.isFile()) {
         out.push(childRel);
       }
@@ -36797,7 +36823,7 @@ function isKeysFileGitignored(vaultRoot) {
     if (res.status === 1) return false;
   } catch {
   }
-  const gitignore = readOrNull(path5.join(vaultRoot, ".gitignore"));
+  const gitignore = readOrNull(path6.join(vaultRoot, ".gitignore"));
   if (gitignore === null) return false;
   const ignorePatterns = /* @__PURE__ */ new Set([
     ".heyspex/env.keys",
@@ -36857,13 +36883,13 @@ function runEntry(name, main2, options = {}) {
 
 // spex-console/bin/hs-env.ts
 function hsSelfCommand() {
-  const here = path6.dirname(fileURLToPath2(import.meta.url));
+  const here = path7.dirname(fileURLToPath3(import.meta.url));
   const pkgRoot = resolveCodeRoot({});
   const candidates = [
-    ...pkgRoot ? [path6.join(pkgRoot, "bin", "hs.mjs")] : [],
-    path6.resolve(here, "..", "..", "bin", "hs.mjs")
+    ...pkgRoot ? [path7.join(pkgRoot, "bin", "hs.mjs")] : [],
+    path7.resolve(here, "..", "..", "bin", "hs.mjs")
   ];
-  const launcher = candidates.find((c) => existsSync10(c));
+  const launcher = candidates.find((c) => existsSync11(c));
   return launcher ? [process3.execPath, launcher] : null;
 }
 var VIRTUAL_ADAPTER = /nordlynx|tailscale|zerotier|hamachi|wireguard|openvpn|proton|tap-|tun\d|vethernet|\bwsl\b|hyper-v|docker|vmware|virtualbox|vbox|utun|bridge/i;