heyspex 0.2.4 → 0.2.6

package/dist/cli/hs-revalidate.mjs

@@ -0,0 +1,3257 @@
+import { createRequire as __hsCreateRequire } from 'node:module';
+const require = __hsCreateRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// scripts/lib/heyspex-home.mjs
+import { homedir } from "node:os";
+function heyspexHome(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir();
+}
+var init_heyspex_home = __esm({
+  "scripts/lib/heyspex-home.mjs"() {
+    "use strict";
+  }
+});
+
+// vendor/heyspex-mcp/credentials.mjs
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import os, { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+function credentialsFilePath(homeDir = heyspexHome()) {
+  return join2(homeDir, ".heyspex", "credentials.yaml");
+}
+function parseMcpToken(raw) {
+  if (typeof raw !== "string" || raw.length === 0) return null;
+  const token = raw.match(MCP_TOKEN_LINE_RE)?.[1]?.trim();
+  return token ? token : null;
+}
+function isValidAccountId(id) {
+  return typeof id === "string" && ACCOUNT_ID_RE.test(id);
+}
+function topLevelScalar(raw, key) {
+  const re = new RegExp(`^${key}:[ \\t]*["']?([^"'\\r\\n#]+)`, "m");
+  const value = raw.match(re)?.[1]?.trim();
+  return value ? value : null;
+}
+function decodeScalar(text) {
+  const t = text.trim();
+  if (t === "" || t === "null" || t === "~") return null;
+  if (t.startsWith('"')) {
+    try {
+      const v = JSON.parse(t);
+      return typeof v === "string" && v ? v : null;
+    } catch {
+      return t.replace(/^"|"$/g, "") || null;
+    }
+  }
+  if (t.startsWith("'")) return t.replace(/^'|'$/g, "") || null;
+  const bare = t.replace(/\s+#.*$/, "").trim();
+  return bare || null;
+}
+function emptyAccount() {
+  return { mcp_token: null, console_url: null, email: null, paired_at: null };
+}
+function findAccountsBlock(lines) {
+  const start = lines.findIndex((l) => /^accounts:[ \t]*(#.*)?$/.test(l));
+  if (start < 0) return null;
+  let end = start + 1;
+  while (end < lines.length && (lines[end].trim() === "" || /^[ \t]/.test(lines[end]))) end += 1;
+  while (end > start + 1 && lines[end - 1].trim() === "") end -= 1;
+  return { start, end };
+}
+function parseAccountsBlock(lines) {
+  const accounts = {};
+  const block = findAccountsBlock(lines);
+  if (!block) return accounts;
+  let current = null;
+  for (const line of lines.slice(block.start + 1, block.end)) {
+    const header = line.match(/^ {2}([^\s:#][^:]*):[ \t]*(#.*)?$/);
+    if (header) {
+      const id = decodeScalar(header[1]);
+      current = isValidAccountId(id) ? id : null;
+      if (current) accounts[current] = emptyAccount();
+      continue;
+    }
+    const field = line.match(/^ {4}([a-z_]+):(.*)$/);
+    if (field && current && ACCOUNT_FIELDS.includes(field[1])) {
+      accounts[current][field[1]] = decodeScalar(field[2]);
+    }
+  }
+  return accounts;
+}
+function parseCredentialsStore(raw) {
+  const text = typeof raw === "string" ? raw : "";
+  if (topLevelScalar(text, "schema_version") !== String(CREDENTIALS_SCHEMA_VERSION)) {
+    const token = parseMcpToken(text);
+    if (!token) return { schemaVersion: 1, currentAccountId: null, accounts: {} };
+    return {
+      schemaVersion: 1,
+      currentAccountId: LEGACY_ACCOUNT_ID,
+      accounts: {
+        [LEGACY_ACCOUNT_ID]: { ...emptyAccount(), mcp_token: token, console_url: topLevelScalar(text, "console_url") }
+      }
+    };
+  }
+  const accounts = parseAccountsBlock(text.split(/\r?\n/));
+  const current = topLevelScalar(text, "current_account_id");
+  return {
+    schemaVersion: 2,
+    currentAccountId: current && accounts[current] ? current : null,
+    accounts
+  };
+}
+function resolveBearer({ envToken, credentialsText, accountId, legacyAccountId } = {}) {
+  const fromEnv = typeof envToken === "string" ? envToken.trim() : "";
+  if (fromEnv) return { token: fromEnv, source: "env" };
+  const store = parseCredentialsStore(credentialsText);
+  let entry;
+  if (typeof accountId === "string" && accountId.trim()) {
+    const wanted = accountId.trim();
+    entry = store.accounts[wanted];
+    if (!entry && store.schemaVersion === 1 && legacyAccountId && wanted === legacyAccountId) {
+      entry = store.accounts[LEGACY_ACCOUNT_ID];
+    }
+  } else {
+    entry = store.currentAccountId ? store.accounts[store.currentAccountId] : void 0;
+  }
+  if (entry?.mcp_token) return { token: entry.mcp_token, source: "credentials-file" };
+  return { token: null, source: null };
+}
+function readTextOrNull(read, path4) {
+  try {
+    const raw = read(path4);
+    return typeof raw === "string" ? raw : null;
+  } catch {
+    return null;
+  }
+}
+function readLegacyConfigAccountId(read, homeDir) {
+  const raw = readTextOrNull(read, join2(homeDir, ".heyspex", "config.yaml"));
+  const value = raw?.match(CONFIG_ACCOUNT_ID_RE)?.[1]?.trim() ?? "";
+  return value || null;
+}
+function readBearer({ env = process.env, homeDir = heyspexHome(), readFile, accountId } = {}) {
+  const read = readFile ?? ((p) => readFileSync(p, "utf8"));
+  const credentialsText = readTextOrNull(read, credentialsFilePath(homeDir));
+  const named = typeof accountId === "string" && accountId.trim() ? accountId.trim() : null;
+  const legacyAccountId = named && parseCredentialsStore(credentialsText).schemaVersion === 1 ? readLegacyConfigAccountId(read, homeDir) : null;
+  return resolveBearer({ envToken: env?.[MCP_TOKEN_ENV], credentialsText, accountId: named, legacyAccountId });
+}
+function readCurrentAccountId({ homeDir = heyspexHome(), readFile } = {}) {
+  const read = readFile ?? ((p) => readFileSync(p, "utf8"));
+  const store = parseCredentialsStore(readTextOrNull(read, credentialsFilePath(homeDir)));
+  if (store.schemaVersion === 2 && store.currentAccountId && store.currentAccountId !== LEGACY_ACCOUNT_ID) {
+    return store.currentAccountId;
+  }
+  if (store.schemaVersion === 2 && store.currentAccountId === null) return null;
+  return readLegacyConfigAccountId(read, homeDir);
+}
+var MCP_TOKEN_ENV, MCP_TOKEN_LINE_RE, CREDENTIALS_SCHEMA_VERSION, LEGACY_ACCOUNT_ID, ACCOUNT_FIELDS, ACCOUNT_ID_RE, CONFIG_ACCOUNT_ID_RE;
+var init_credentials = __esm({
+  "vendor/heyspex-mcp/credentials.mjs"() {
+    "use strict";
+    init_heyspex_home();
+    MCP_TOKEN_ENV = "HEYSPEX_MCP_TOKEN";
+    MCP_TOKEN_LINE_RE = /^mcp_token:[ \t]*["']?([^"'\r\n#]+)/m;
+    CREDENTIALS_SCHEMA_VERSION = 2;
+    LEGACY_ACCOUNT_ID = "legacy";
+    ACCOUNT_FIELDS = ["mcp_token", "console_url", "email", "paired_at"];
+    ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_.@+-]*$/;
+    CONFIG_ACCOUNT_ID_RE = /^account_id:\s*["']?([^"'\r\n#]+)/m;
+  }
+});
+
+// scripts/lib/dev-mode.mjs
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join8 } from "node:path";
+function devModeFilePath(homeDir = heyspexHome()) {
+  return join8(homeDir, ".heyspex", DEV_MODE_FILENAME);
+}
+function normalizeMode(raw) {
+  const v = String(raw ?? "").trim().toLowerCase();
+  if (v === "prod" || v === "production") return { mode: "prod", reliance: "cloud" };
+  if (v === "dev") return { mode: "dev", reliance: null };
+  if (v === "local") return { mode: "dev", reliance: "local" };
+  if (v === "cloud") return { mode: "dev", reliance: "cloud" };
+  return null;
+}
+function normalizeReliance(raw) {
+  const v = String(raw ?? "").trim().toLowerCase();
+  return v === "local" || v === "cloud" ? v : null;
+}
+function deriveSemantics(mode, reliance) {
+  const effectiveReliance = mode === "prod" ? "cloud" : reliance ?? "local";
+  const local = mode === "dev" && effectiveReliance === "local";
+  return {
+    reliance: effectiveReliance,
+    consoleUrl: local ? LOCAL_CONSOLE_URL : CLOUD_CONSOLE_URL,
+    readTier: local ? "disk" : "neon",
+    vaultWriteMode: local ? "local" : "cloud"
+  };
+}
+function readLocalDevModeRecord({ homeDir = heyspexHome(), readFile = defaultReadFile } = {}) {
+  let raw;
+  try {
+    raw = readFile(devModeFilePath(homeDir));
+  } catch {
+    return { record: null, parseError: null };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const mode = parsed?.mode === "prod" || parsed?.mode === "dev" ? parsed.mode : null;
+    const reliance = normalizeReliance(parsed?.reliance);
+    if (!mode || mode === "dev" && !reliance) {
+      return { record: null, parseError: `invalid dev-mode record: ${JSON.stringify(parsed)}` };
+    }
+    return {
+      record: {
+        mode,
+        reliance: mode === "prod" ? "cloud" : reliance,
+        console_url: typeof parsed.console_url === "string" ? parsed.console_url : null,
+        updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : null,
+        source: typeof parsed.source === "string" ? parsed.source : null
+      },
+      parseError: null
+    };
+  } catch (err) {
+    return { record: null, parseError: `unparseable dev-mode.json: ${String(err?.message ?? err)}` };
+  }
+}
+function overrideCloudCheck(source, cloudKnown, staleAgainstCloud) {
+  if (source !== "local-override") return "not-applicable";
+  if (!cloudKnown) return "unverified";
+  return staleAgainstCloud ? "stale" : "in-sync";
+}
+function resolveDevMode({
+  env = process.env,
+  homeDir = heyspexHome(),
+  readFile = defaultReadFile,
+  cloudSetting = void 0
+} = {}) {
+  const local = readLocalDevModeRecord({ homeDir, readFile });
+  const cloudKnown = cloudSetting !== void 0;
+  const cloudValue = cloudKnown && cloudSetting ? {
+    mode: cloudSetting.mode === "dev" ? "dev" : "prod",
+    reliance: normalizeReliance(cloudSetting.reliance) ?? "cloud"
+  } : null;
+  let mode;
+  let reliance;
+  let source;
+  let relianceSource;
+  const envParsed = normalizeMode(env.HEYSPEX_DEV_MODE);
+  if (envParsed) {
+    mode = envParsed.mode;
+    const envReliance = envParsed.reliance ?? normalizeReliance(env.HEYSPEX_DEV_RELIANCE);
+    reliance = envReliance ?? "local";
+    source = "env";
+    relianceSource = envReliance ? "env" : "assumed-local";
+  } else if (local.record) {
+    mode = local.record.mode;
+    reliance = local.record.reliance;
+    source = "local-override";
+  } else if (cloudValue) {
+    mode = cloudValue.mode;
+    reliance = cloudValue.reliance;
+    source = "cloud-setting";
+  } else {
+    mode = "prod";
+    reliance = "cloud";
+    source = "default";
+  }
+  const semantics = deriveSemantics(mode, reliance);
+  const consoleUrl = source === "local-override" && local.record?.console_url ? local.record.console_url.replace(/\/+$/, "") : semantics.consoleUrl;
+  const staleAgainstCloud = source === "local-override" && cloudValue !== null && (cloudValue.mode !== mode || mode === "dev" && cloudValue.reliance !== semantics.reliance);
+  const cloudCheck = overrideCloudCheck(source, cloudKnown, staleAgainstCloud);
+  return {
+    mode,
+    reliance: semantics.reliance,
+    consoleUrl,
+    readTier: semantics.readTier,
+    vaultWriteMode: semantics.vaultWriteMode,
+    sources: {
+      mode: source,
+      reliance: relianceSource ?? source,
+      consoleUrl: source === "local-override" && local.record?.console_url ? "local-override" : "derived",
+      readTier: "derived",
+      vaultWriteMode: "derived"
+    },
+    localOverride: {
+      present: local.record !== null,
+      record: local.record,
+      parseError: local.parseError,
+      staleAgainstCloud,
+      cloudCheck
+    },
+    cloudSetting: { known: cloudKnown, value: cloudValue }
+  };
+}
+var CLOUD_CONSOLE_URL, LOCAL_CONSOLE_URL, DEV_MODE_FILENAME, defaultReadFile;
+var init_dev_mode = __esm({
+  "scripts/lib/dev-mode.mjs"() {
+    "use strict";
+    init_heyspex_home();
+    init_credentials();
+    CLOUD_CONSOLE_URL = "https://app.heyspex.com";
+    LOCAL_CONSOLE_URL = "http://localhost:3000";
+    DEV_MODE_FILENAME = "dev-mode.json";
+    defaultReadFile = (p) => readFileSync8(p, "utf8");
+  }
+});
+
+// node_modules/kind-of/index.js
+var require_kind_of = __commonJS({
+  "node_modules/kind-of/index.js"(exports2, module2) {
+    "use strict";
+    var toString = Object.prototype.toString;
+    module2.exports = function kindOf(val) {
+      if (val === void 0) return "undefined";
+      if (val === null) return "null";
+      var type = typeof val;
+      if (type === "boolean") return "boolean";
+      if (type === "string") return "string";
+      if (type === "number") return "number";
+      if (type === "symbol") return "symbol";
+      if (type === "function") {
+        return isGeneratorFn(val) ? "generatorfunction" : "function";
+      }
+      if (isArray(val)) return "array";
+      if (isBuffer(val)) return "buffer";
+      if (isArguments(val)) return "arguments";
+      if (isDate(val)) return "date";
+      if (isError(val)) return "error";
+      if (isRegexp(val)) return "regexp";
+      switch (ctorName(val)) {
+        case "Symbol":
+          return "symbol";
+        case "Promise":
+          return "promise";
+        // Set, Map, WeakSet, WeakMap
+        case "WeakMap":
+          return "weakmap";
+        case "WeakSet":
+          return "weakset";
+        case "Map":
+          return "map";
+        case "Set":
+          return "set";
+        // 8-bit typed arrays
+        case "Int8Array":
+          return "int8array";
+        case "Uint8Array":
+          return "uint8array";
+        case "Uint8ClampedArray":
+          return "uint8clampedarray";
+        // 16-bit typed arrays
+        case "Int16Array":
+          return "int16array";
+        case "Uint16Array":
+          return "uint16array";
+        // 32-bit typed arrays
+        case "Int32Array":
+          return "int32array";
+        case "Uint32Array":
+          return "uint32array";
+        case "Float32Array":
+          return "float32array";
+        case "Float64Array":
+          return "float64array";
+      }
+      if (isGeneratorObj(val)) {
+        return "generator";
+      }
+      type = toString.call(val);
+      switch (type) {
+        case "[object Object]":
+          return "object";
+        // iterators
+        case "[object Map Iterator]":
+          return "mapiterator";
+        case "[object Set Iterator]":
+          return "setiterator";
+        case "[object String Iterator]":
+          return "stringiterator";
+        case "[object Array Iterator]":
+          return "arrayiterator";
+      }
+      return type.slice(8, -1).toLowerCase().replace(/\s/g, "");
+    };
+    function ctorName(val) {
+      return typeof val.constructor === "function" ? val.constructor.name : null;
+    }
+    function isArray(val) {
+      if (Array.isArray) return Array.isArray(val);
+      return val instanceof Array;
+    }
+    function isError(val) {
+      return val instanceof Error || typeof val.message === "string" && val.constructor && typeof val.constructor.stackTraceLimit === "number";
+    }
+    function isDate(val) {
+      if (val instanceof Date) return true;
+      return typeof val.toDateString === "function" && typeof val.getDate === "function" && typeof val.setDate === "function";
+    }
+    function isRegexp(val) {
+      if (val instanceof RegExp) return true;
+      return typeof val.flags === "string" && typeof val.ignoreCase === "boolean" && typeof val.multiline === "boolean" && typeof val.global === "boolean";
+    }
+    function isGeneratorFn(name, val) {
+      return ctorName(name) === "GeneratorFunction";
+    }
+    function isGeneratorObj(val) {
+      return typeof val.throw === "function" && typeof val.return === "function" && typeof val.next === "function";
+    }
+    function isArguments(val) {
+      try {
+        if (typeof val.length === "number" && typeof val.callee === "function") {
+          return true;
+        }
+      } catch (err) {
+        if (err.message.indexOf("callee") !== -1) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function isBuffer(val) {
+      if (val.constructor && typeof val.constructor.isBuffer === "function") {
+        return val.constructor.isBuffer(val);
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/is-extendable/index.js
+var require_is_extendable = __commonJS({
+  "node_modules/is-extendable/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function isExtendable(val) {
+      return typeof val !== "undefined" && val !== null && (typeof val === "object" || typeof val === "function");
+    };
+  }
+});
+
+// node_modules/extend-shallow/index.js
+var require_extend_shallow = __commonJS({
+  "node_modules/extend-shallow/index.js"(exports2, module2) {
+    "use strict";
+    var isObject = require_is_extendable();
+    module2.exports = function extend(o) {
+      if (!isObject(o)) {
+        o = {};
+      }
+      var len = arguments.length;
+      for (var i = 1; i < len; i++) {
+        var obj = arguments[i];
+        if (isObject(obj)) {
+          assign(o, obj);
+        }
+      }
+      return o;
+    };
+    function assign(a, b) {
+      for (var key in b) {
+        if (hasOwn(b, key)) {
+          a[key] = b[key];
+        }
+      }
+    }
+    function hasOwn(obj, key) {
+      return Object.prototype.hasOwnProperty.call(obj, key);
+    }
+  }
+});
+
+// node_modules/section-matter/index.js
+var require_section_matter = __commonJS({
+  "node_modules/section-matter/index.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var extend = require_extend_shallow();
+    module2.exports = function(input, options2) {
+      if (typeof options2 === "function") {
+        options2 = { parse: options2 };
+      }
+      var file = toObject(input);
+      var defaults = { section_delimiter: "---", parse: identity };
+      var opts = extend({}, defaults, options2);
+      var delim = opts.section_delimiter;
+      var lines = file.content.split(/\r?\n/);
+      var sections = null;
+      var section = createSection();
+      var content = [];
+      var stack = [];
+      function initSections(val) {
+        file.content = val;
+        sections = [];
+        content = [];
+      }
+      function closeSection(val) {
+        if (stack.length) {
+          section.key = getKey(stack[0], delim);
+          section.content = val;
+          opts.parse(section, sections);
+          sections.push(section);
+          section = createSection();
+          content = [];
+          stack = [];
+        }
+      }
+      for (var i = 0; i < lines.length; i++) {
+        var line = lines[i];
+        var len = stack.length;
+        var ln = line.trim();
+        if (isDelimiter(ln, delim)) {
+          if (ln.length === 3 && i !== 0) {
+            if (len === 0 || len === 2) {
+              content.push(line);
+              continue;
+            }
+            stack.push(ln);
+            section.data = content.join("\n");
+            content = [];
+            continue;
+          }
+          if (sections === null) {
+            initSections(content.join("\n"));
+          }
+          if (len === 2) {
+            closeSection(content.join("\n"));
+          }
+          stack.push(ln);
+          continue;
+        }
+        content.push(line);
+      }
+      if (sections === null) {
+        initSections(content.join("\n"));
+      } else {
+        closeSection(content.join("\n"));
+      }
+      file.sections = sections;
+      return file;
+    };
+    function isDelimiter(line, delim) {
+      if (line.slice(0, delim.length) !== delim) {
+        return false;
+      }
+      if (line.charAt(delim.length + 1) === delim.slice(-1)) {
+        return false;
+      }
+      return true;
+    }
+    function toObject(input) {
+      if (typeOf(input) !== "object") {
+        input = { content: input };
+      }
+      if (typeof input.content !== "string" && !isBuffer(input.content)) {
+        throw new TypeError("expected a buffer or string");
+      }
+      input.content = input.content.toString();
+      input.sections = [];
+      return input;
+    }
+    function getKey(val, delim) {
+      return val ? val.slice(delim.length).trim() : "";
+    }
+    function createSection() {
+      return { key: "", data: "", content: "" };
+    }
+    function identity(val) {
+      return val;
+    }
+    function isBuffer(val) {
+      if (val && val.constructor && typeof val.constructor.isBuffer === "function") {
+        return val.constructor.isBuffer(val);
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/engines.js
+var require_engines = __commonJS({
+  "node_modules/gray-matter/lib/engines.js"(exports, module) {
+    "use strict";
+    var yaml = __require("js-yaml");
+    var engines = exports = module.exports;
+    engines.yaml = {
+      parse: yaml.safeLoad.bind(yaml),
+      stringify: yaml.safeDump.bind(yaml)
+    };
+    engines.json = {
+      parse: JSON.parse.bind(JSON),
+      stringify: function(obj, options2) {
+        const opts = Object.assign({ replacer: null, space: 2 }, options2);
+        return JSON.stringify(obj, opts.replacer, opts.space);
+      }
+    };
+    engines.javascript = {
+      parse: function parse(str, options, wrap) {
+        try {
+          if (wrap !== false) {
+            str = "(function() {\nreturn " + str.trim() + ";\n}());";
+          }
+          return eval(str) || {};
+        } catch (err) {
+          if (wrap !== false && /(unexpected|identifier)/i.test(err.message)) {
+            return parse(str, options, false);
+          }
+          throw new SyntaxError(err);
+        }
+      },
+      stringify: function() {
+        throw new Error("stringifying JavaScript is not supported");
+      }
+    };
+  }
+});
+
+// node_modules/strip-bom-string/index.js
+var require_strip_bom_string = __commonJS({
+  "node_modules/strip-bom-string/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function(str2) {
+      if (typeof str2 === "string" && str2.charAt(0) === "\uFEFF") {
+        return str2.slice(1);
+      }
+      return str2;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/utils.js
+var require_utils = __commonJS({
+  "node_modules/gray-matter/lib/utils.js"(exports2) {
+    "use strict";
+    var stripBom = require_strip_bom_string();
+    var typeOf = require_kind_of();
+    exports2.define = function(obj, key, val) {
+      Reflect.defineProperty(obj, key, {
+        enumerable: false,
+        configurable: true,
+        writable: true,
+        value: val
+      });
+    };
+    exports2.isBuffer = function(val) {
+      return typeOf(val) === "buffer";
+    };
+    exports2.isObject = function(val) {
+      return typeOf(val) === "object";
+    };
+    exports2.toBuffer = function(input) {
+      return typeof input === "string" ? Buffer.from(input) : input;
+    };
+    exports2.toString = function(input) {
+      if (exports2.isBuffer(input)) return stripBom(String(input));
+      if (typeof input !== "string") {
+        throw new TypeError("expected input to be a string or buffer");
+      }
+      return stripBom(input);
+    };
+    exports2.arrayify = function(val) {
+      return val ? Array.isArray(val) ? val : [val] : [];
+    };
+    exports2.startsWith = function(str2, substr, len) {
+      if (typeof len !== "number") len = substr.length;
+      return str2.slice(0, len) === substr;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/defaults.js
+var require_defaults = __commonJS({
+  "node_modules/gray-matter/lib/defaults.js"(exports2, module2) {
+    "use strict";
+    var engines2 = require_engines();
+    var utils = require_utils();
+    module2.exports = function(options2) {
+      const opts = Object.assign({}, options2);
+      opts.delimiters = utils.arrayify(opts.delims || opts.delimiters || "---");
+      if (opts.delimiters.length === 1) {
+        opts.delimiters.push(opts.delimiters[0]);
+      }
+      opts.language = (opts.language || opts.lang || "yaml").toLowerCase();
+      opts.engines = Object.assign({}, engines2, opts.parsers, opts.engines);
+      return opts;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/engine.js
+var require_engine = __commonJS({
+  "node_modules/gray-matter/lib/engine.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function(name, options2) {
+      let engine = options2.engines[name] || options2.engines[aliase(name)];
+      if (typeof engine === "undefined") {
+        throw new Error('gray-matter engine "' + name + '" is not registered');
+      }
+      if (typeof engine === "function") {
+        engine = { parse: engine };
+      }
+      return engine;
+    };
+    function aliase(name) {
+      switch (name.toLowerCase()) {
+        case "js":
+        case "javascript":
+          return "javascript";
+        case "coffee":
+        case "coffeescript":
+        case "cson":
+          return "coffee";
+        case "yaml":
+        case "yml":
+          return "yaml";
+        default: {
+          return name;
+        }
+      }
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/stringify.js
+var require_stringify = __commonJS({
+  "node_modules/gray-matter/lib/stringify.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var getEngine = require_engine();
+    var defaults = require_defaults();
+    module2.exports = function(file, data, options2) {
+      if (data == null && options2 == null) {
+        switch (typeOf(file)) {
+          case "object":
+            data = file.data;
+            options2 = {};
+            break;
+          case "string":
+            return file;
+          default: {
+            throw new TypeError("expected file to be a string or object");
+          }
+        }
+      }
+      const str2 = file.content;
+      const opts = defaults(options2);
+      if (data == null) {
+        if (!opts.data) return file;
+        data = opts.data;
+      }
+      const language = file.language || opts.language;
+      const engine = getEngine(language, opts);
+      if (typeof engine.stringify !== "function") {
+        throw new TypeError('expected "' + language + '.stringify" to be a function');
+      }
+      data = Object.assign({}, file.data, data);
+      const open = opts.delimiters[0];
+      const close = opts.delimiters[1];
+      const matter3 = engine.stringify(data, options2).trim();
+      let buf = "";
+      if (matter3 !== "{}") {
+        buf = newline(open) + newline(matter3) + newline(close);
+      }
+      if (typeof file.excerpt === "string" && file.excerpt !== "") {
+        if (str2.indexOf(file.excerpt.trim()) === -1) {
+          buf += newline(file.excerpt) + newline(close);
+        }
+      }
+      return buf + newline(str2);
+    };
+    function newline(str2) {
+      return str2.slice(-1) !== "\n" ? str2 + "\n" : str2;
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/excerpt.js
+var require_excerpt = __commonJS({
+  "node_modules/gray-matter/lib/excerpt.js"(exports2, module2) {
+    "use strict";
+    var defaults = require_defaults();
+    module2.exports = function(file, options2) {
+      const opts = defaults(options2);
+      if (file.data == null) {
+        file.data = {};
+      }
+      if (typeof opts.excerpt === "function") {
+        return opts.excerpt(file, opts);
+      }
+      const sep2 = file.data.excerpt_separator || opts.excerpt_separator;
+      if (sep2 == null && (opts.excerpt === false || opts.excerpt == null)) {
+        return file;
+      }
+      const delimiter2 = typeof opts.excerpt === "string" ? opts.excerpt : sep2 || opts.delimiters[0];
+      const idx = file.content.indexOf(delimiter2);
+      if (idx !== -1) {
+        file.excerpt = file.content.slice(0, idx);
+      }
+      return file;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/to-file.js
+var require_to_file = __commonJS({
+  "node_modules/gray-matter/lib/to-file.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var stringify = require_stringify();
+    var utils = require_utils();
+    module2.exports = function(file) {
+      if (typeOf(file) !== "object") {
+        file = { content: file };
+      }
+      if (typeOf(file.data) !== "object") {
+        file.data = {};
+      }
+      if (file.contents && file.content == null) {
+        file.content = file.contents;
+      }
+      utils.define(file, "orig", utils.toBuffer(file.content));
+      utils.define(file, "language", file.language || "");
+      utils.define(file, "matter", file.matter || "");
+      utils.define(file, "stringify", function(data, options2) {
+        if (options2 && options2.language) {
+          file.language = options2.language;
+        }
+        return stringify(file, data, options2);
+      });
+      file.content = utils.toString(file.content);
+      file.isEmpty = false;
+      file.excerpt = "";
+      return file;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/parse.js
+var require_parse = __commonJS({
+  "node_modules/gray-matter/lib/parse.js"(exports2, module2) {
+    "use strict";
+    var getEngine = require_engine();
+    var defaults = require_defaults();
+    module2.exports = function(language, str2, options2) {
+      const opts = defaults(options2);
+      const engine = getEngine(language, opts);
+      if (typeof engine.parse !== "function") {
+        throw new TypeError('expected "' + language + '.parse" to be a function');
+      }
+      return engine.parse(str2, opts);
+    };
+  }
+});
+
+// node_modules/gray-matter/index.js
+var require_gray_matter = __commonJS({
+  "node_modules/gray-matter/index.js"(exports2, module2) {
+    "use strict";
+    var fs = __require("fs");
+    var sections = require_section_matter();
+    var defaults = require_defaults();
+    var stringify = require_stringify();
+    var excerpt = require_excerpt();
+    var engines2 = require_engines();
+    var toFile = require_to_file();
+    var parse2 = require_parse();
+    var utils = require_utils();
+    function matter3(input, options2) {
+      if (input === "") {
+        return { data: {}, content: input, excerpt: "", orig: input };
+      }
+      let file = toFile(input);
+      const cached2 = matter3.cache[file.content];
+      if (!options2) {
+        if (cached2) {
+          file = Object.assign({}, cached2);
+          file.orig = cached2.orig;
+          return file;
+        }
+        matter3.cache[file.content] = file;
+      }
+      return parseMatter(file, options2);
+    }
+    function parseMatter(file, options2) {
+      const opts = defaults(options2);
+      const open = opts.delimiters[0];
+      const close = "\n" + opts.delimiters[1];
+      let str2 = file.content;
+      if (opts.language) {
+        file.language = opts.language;
+      }
+      const openLen = open.length;
+      if (!utils.startsWith(str2, open, openLen)) {
+        excerpt(file, opts);
+        return file;
+      }
+      if (str2.charAt(openLen) === open.slice(-1)) {
+        return file;
+      }
+      str2 = str2.slice(openLen);
+      const len = str2.length;
+      const language = matter3.language(str2, opts);
+      if (language.name) {
+        file.language = language.name;
+        str2 = str2.slice(language.raw.length);
+      }
+      let closeIndex = str2.indexOf(close);
+      if (closeIndex === -1) {
+        closeIndex = len;
+      }
+      file.matter = str2.slice(0, closeIndex);
+      const block = file.matter.replace(/^\s*#[^\n]+/gm, "").trim();
+      if (block === "") {
+        file.isEmpty = true;
+        file.empty = file.content;
+        file.data = {};
+      } else {
+        file.data = parse2(file.language, file.matter, opts);
+      }
+      if (closeIndex === len) {
+        file.content = "";
+      } else {
+        file.content = str2.slice(closeIndex + close.length);
+        if (file.content[0] === "\r") {
+          file.content = file.content.slice(1);
+        }
+        if (file.content[0] === "\n") {
+          file.content = file.content.slice(1);
+        }
+      }
+      excerpt(file, opts);
+      if (opts.sections === true || typeof opts.section === "function") {
+        sections(file, opts.section);
+      }
+      return file;
+    }
+    matter3.engines = engines2;
+    matter3.stringify = function(file, data, options2) {
+      if (typeof file === "string") file = matter3(file, options2);
+      return stringify(file, data, options2);
+    };
+    matter3.read = function(filepath, options2) {
+      const str2 = fs.readFileSync(filepath, "utf8");
+      const file = matter3(str2, options2);
+      file.path = filepath;
+      return file;
+    };
+    matter3.test = function(str2, options2) {
+      return utils.startsWith(str2, defaults(options2).delimiters[0]);
+    };
+    matter3.language = function(str2, options2) {
+      const opts = defaults(options2);
+      const open = opts.delimiters[0];
+      if (matter3.test(str2)) {
+        str2 = str2.slice(open.length);
+      }
+      const language = str2.slice(0, str2.search(/\r?\n/));
+      return {
+        raw: language,
+        name: language ? language.trim() : ""
+      };
+    };
+    matter3.cache = {};
+    matter3.clearCache = function() {
+      matter3.cache = {};
+    };
+    module2.exports = matter3;
+  }
+});
+
+// spex-console/bin/hs-revalidate.ts
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync10, statSync as statSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import path3 from "node:path";
+import process3 from "node:process";
+
+// scripts/lib/shared-path-helpers.mjs
+import { realpathSync } from "node:fs";
+import { isAbsolute, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+function resolveCodeRoot({
+  explicit,
+  packageRoot,
+  vaultRoot,
+  env = process.env
+} = {}) {
+  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
+  if (fromExplicit) return fromExplicit;
+  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
+  if (fromEnv) return fromEnv;
+  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
+  if (fromPackage) return fromPackage;
+  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
+  return fromVault;
+}
+
+// spex-console/src/lib/cli/checks-manifest.ts
+var KIND_ALIASES = {
+  tests: "test",
+  unit: "test",
+  grep: "command",
+  diff: "command",
+  live: "command"
+};
+function joinUnderRoot(root, rel) {
+  if (rel === "" || rel === ".") return root;
+  if (/^(?:[a-zA-Z]:[\\/]|[\\/])/.test(rel)) return rel;
+  const sep2 = root.includes("\\") && !root.includes("/") ? "\\" : "/";
+  return `${root.replace(/[\\/]+$/, "")}${sep2}${rel.replace(/^[\\/]+/, "")}`;
+}
+function resolveCheckCwds(check, roots) {
+  if (typeof check.cwd === "string" && check.cwd.trim() !== "") {
+    const raw = check.cwd.trim();
+    const vaultMatch = /^vault:(.*)$/.exec(raw);
+    if (vaultMatch) {
+      return [joinUnderRoot(roots.vaultRoot ?? roots.repoRoot, vaultMatch[1].trim())];
+    }
+    return [joinUnderRoot(roots.repoRoot, raw)];
+  }
+  return roots.repoRoot === roots.consoleRoot ? [roots.repoRoot] : [roots.repoRoot, roots.consoleRoot];
+}
+var VALID_METHODS = /* @__PURE__ */ new Set([
+  "machine",
+  "property",
+  "human"
+]);
+var VALID_KINDS = /* @__PURE__ */ new Set([
+  "test",
+  "lint",
+  "types",
+  "command",
+  "guard"
+]);
+var VALID_EXPECTS = /* @__PURE__ */ new Set([
+  "exit-0",
+  "no-net-new",
+  "empty-output"
+]);
+function parseChecksManifest(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    return {
+      error: `manifest is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (typeof raw !== "object" || raw === null) {
+    return { error: "manifest must be an object" };
+  }
+  const rec = raw;
+  if (typeof rec.spec !== "string" || rec.spec.trim() === "") {
+    return { error: 'manifest is missing a non-empty "spec"' };
+  }
+  if (!Array.isArray(rec.criteria)) {
+    return { error: 'manifest must have a "criteria" array' };
+  }
+  const criteria = [];
+  for (let i = 0; i < rec.criteria.length; i++) {
+    const c = rec.criteria[i];
+    if (typeof c !== "object" || c === null) {
+      return { error: `criteria[${i}] must be an object` };
+    }
+    const cr = c;
+    const ac = typeof cr.ac === "number" ? cr.ac : i + 1;
+    const ctext = typeof cr.text === "string" ? cr.text : "";
+    const method = cr.method;
+    if (typeof method !== "string" || !VALID_METHODS.has(method)) {
+      return { error: `criteria[${i}].method must be one of machine|property|human` };
+    }
+    const rawChecks = cr.checks ?? [];
+    if (!Array.isArray(rawChecks)) {
+      return { error: `criteria[${i}].checks must be an array` };
+    }
+    if (method === "human" && rawChecks.length > 0) {
+      return {
+        error: `criteria[${i}] is method:human but has checks \u2014 judgment-only criteria carry none`
+      };
+    }
+    if (method !== "human" && rawChecks.length === 0) {
+      return { error: `criteria[${i}] is method:${method} but has no checks to run` };
+    }
+    const checks = [];
+    for (let j = 0; j < rawChecks.length; j++) {
+      const t = rawChecks[j];
+      if (typeof t !== "object" || t === null) {
+        return { error: `criteria[${i}].checks[${j}] must be an object` };
+      }
+      const tr = t;
+      if (typeof tr.kind !== "string") {
+        return {
+          error: `criteria[${i}].checks[${j}].kind must be one of test|lint|types|command|guard`
+        };
+      }
+      const kind = KIND_ALIASES[tr.kind] ?? tr.kind;
+      if (!VALID_KINDS.has(kind)) {
+        return {
+          error: `criteria[${i}].checks[${j}].kind must be one of test|lint|types|command|guard`
+        };
+      }
+      if (typeof tr.run !== "string" || tr.run.trim() === "") {
+        return { error: `criteria[${i}].checks[${j}] is missing a non-empty "run"` };
+      }
+      const expectRaw = tr.expect ?? "exit-0";
+      if (typeof expectRaw !== "string" || !VALID_EXPECTS.has(expectRaw)) {
+        return {
+          error: `criteria[${i}].checks[${j}].expect must be one of exit-0|no-net-new|empty-output`
+        };
+      }
+      const baseline = typeof tr.baseline === "number" && Number.isFinite(tr.baseline) ? tr.baseline : 0;
+      const cwd = typeof tr.cwd === "string" && tr.cwd.trim() !== "" ? tr.cwd.trim() : void 0;
+      checks.push({
+        kind,
+        run: tr.run,
+        expect: expectRaw,
+        baseline,
+        ...cwd ? { cwd } : {}
+      });
+    }
+    criteria.push({ ac, text: ctext, method, checks });
+  }
+  const frozenAt = rec.frozen_at ?? rec.frozenAt;
+  const authoredBy = rec.authored_by ?? rec.authoredBy;
+  return {
+    manifest: {
+      spec: rec.spec,
+      frozenAt: typeof frozenAt === "string" && frozenAt.trim() !== "" ? frozenAt : null,
+      authoredBy: typeof authoredBy === "string" && authoredBy.trim() !== "" ? authoredBy : null,
+      criteria
+    }
+  };
+}
+var ZERO_MATCH_RE = /Passed:\s*0\b|No test is available|No test files found|No test matches the given testcase filter|^\s*(?:ℹ|#)\s*(?:tests|pass)\s+0\s*$/i;
+var NODE_TEST_FILE_PASS_RE = /^\s*(?:✔|ok\s+\d+\s+-)\s+\S*\.(?:test|spec)\.[cm]?[jt]sx?\s*(?:\(|$)/;
+var NODE_TEST_FILTER_RE = /--test-(?:name|skip)-pattern/;
+function detectZeroMatch(rawOutput, run) {
+  if (!rawOutput) return null;
+  const filtered = run !== void 0 && NODE_TEST_FILTER_RE.test(run);
+  const line = rawOutput.split(/\r?\n/).find((l) => ZERO_MATCH_RE.test(l) || filtered && NODE_TEST_FILE_PASS_RE.test(l));
+  return line ? line.trim() : null;
+}
+function evaluateCheck(check, outcome) {
+  if (detectZeroMatch(outcome.rawOutput, check.run) !== null) return false;
+  if (check.expect === "no-net-new") {
+    return (outcome.errorCount ?? 0) <= check.baseline;
+  }
+  if (check.expect === "empty-output") {
+    return outcome.exitCode === 0 && (outcome.stdout ?? "\0").trim() === "";
+  }
+  return outcome.exitCode === 0;
+}
+async function runChecksManifest(manifest, deps) {
+  const criteria = [];
+  let durationMs = 0;
+  for (const entry of manifest.criteria) {
+    if (entry.method === "human") {
+      criteria.push({
+        ac: entry.ac,
+        text: entry.text,
+        method: entry.method,
+        verdict: "judgment_only",
+        checks: []
+      });
+      continue;
+    }
+    const checkResults = [];
+    for (const check of entry.checks) {
+      let outcome;
+      try {
+        outcome = await deps.runCheck(check);
+      } catch (err) {
+        outcome = {
+          exitCode: -1,
+          durationMs: 0,
+          message: err instanceof Error ? err.message : String(err)
+        };
+      }
+      const passed = evaluateCheck(check, outcome);
+      durationMs += outcome.durationMs;
+      checkResults.push({
+        check,
+        passed,
+        durationMs: outcome.durationMs,
+        message: passed ? void 0 : outcome.message ?? failureMessage(check, outcome)
+      });
+    }
+    const verdict = checkResults.every((r) => r.passed) ? "pass" : "fail";
+    criteria.push({
+      ac: entry.ac,
+      text: entry.text,
+      method: entry.method,
+      verdict,
+      checks: checkResults
+    });
+  }
+  const passedCount = criteria.filter((c) => c.verdict === "pass").length;
+  const failedCount = criteria.filter((c) => c.verdict === "fail").length;
+  const judgmentOnlyCount = criteria.filter((c) => c.verdict === "judgment_only").length;
+  return {
+    spec: manifest.spec,
+    frozenAt: manifest.frozenAt,
+    authoredBy: manifest.authoredBy,
+    criteria,
+    passed: failedCount === 0,
+    total: criteria.length,
+    passedCount,
+    failedCount,
+    judgmentOnlyCount,
+    durationMs
+  };
+}
+function failureMessage(check, outcome) {
+  const zeroMatch = detectZeroMatch(outcome.rawOutput);
+  if (zeroMatch !== null) {
+    return `zero-match: the check's filter matched nothing to run \u2014 "${zeroMatch}"`;
+  }
+  if (check.expect === "no-net-new") {
+    return `${outcome.errorCount ?? "?"} errors exceeds baseline ${check.baseline}`;
+  }
+  return `command exited ${outcome.exitCode}`;
+}
+var HELP = [
+  "Usage:",
+  "  hs check run <spec-id|manifest.json> [--json]",
+  "",
+  "Verify a spec's acceptance criteria against its frozen checks manifest, and",
+  "report pass/fail PER CRITERION against the real working tree (HS-EPIC-DCEP).",
+  "Machine criteria run their checks; method:human criteria are reported",
+  "judgment-only and handed to the council \u2014 never silently auto-passed.",
+  "",
+  "Manifest shape (specs/checks/<spec-id>.checks.json):",
+  '  { "spec": "[[HS-EPIC-XYZ]]", "frozen_at": "...", "authored_by": "...",',
+  '    "criteria": [ { "ac": 1, "text": "...", "method": "machine",',
+  '                    "checks": [ { "kind": "types", "run": "npx tsc --noEmit",',
+  '                                  "expect": "no-net-new", "baseline": 60 } ] } ] }',
+  "",
+  "Arguments:",
+  "  <spec-id|manifest.json>  A manifest path, or a spec id resolved to",
+  "                           specs/checks/<id>.checks.json under the vault root.",
+  "",
+  "Flags:",
+  "  --manifest <p>   Manifest path (alias for the positional argument).",
+  "  --report         PATCH the verdict to the spec's active claim (the PCFL gate).",
+  "                   Requires a spec-id target (identifies the claim). The verify",
+  "                   exit code is unchanged; reporting is a side effect.",
+  "  --unattended     Declare that no human is present at this flip (pipeline",
+  "                   caller). Rides --report: the server's no-manifest",
+  "                   self-report fallback then fails closed instead of shipping.",
+  "  --json           Emit a machine-readable JSON result (the gate's input shape).",
+  "  --help, -h       Show this help.",
+  "",
+  "Exit codes:",
+  "  0 ok \xB7 1 usage \xB7 10 not-found \xB7 11 bad-manifest \xB7 12 runner-missing \xB7 20 checks-failed"
+].join("\n");
+
+// spex-console/src/lib/cli/control-shared.ts
+import path2 from "node:path";
+
+// scripts/lib/hs-command.mjs
+import { existsSync } from "node:fs";
+import { delimiter, dirname, join } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var HS_BIN_NAME = "hs";
+var HS_DISPATCHER_PATH = (() => {
+  try {
+    const here = dirname(fileURLToPath2(import.meta.url));
+    return join(dirname(dirname(here)), "bin", "hs.mjs");
+  } catch {
+    return null;
+  }
+})();
+function shellQuote(p) {
+  return /[\\\s]/.test(p) ? `"${p}"` : p;
+}
+var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER_PATH)}` : HS_BIN_NAME;
+function candidateNames(name, env) {
+  if (process.platform !== "win32") return [name];
+  const pathext = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim().toLowerCase()).filter(Boolean);
+  const extensions = [.../* @__PURE__ */ new Set([...pathext, ".ps1"])];
+  return [name, ...extensions.map((ext) => name + ext)];
+}
+function findOnPath(name, { env = process.env, exists = existsSync } = {}) {
+  try {
+    const raw = env.PATH ?? env.Path ?? env.path ?? "";
+    for (const dir of String(raw).split(delimiter)) {
+      const trimmed = dir.trim().replace(/^"(.*)"$/, "$1");
+      if (!trimmed) continue;
+      for (const candidate of candidateNames(name, env)) {
+        const full = join(trimmed, candidate);
+        try {
+          if (exists(full)) return full;
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+var cached = null;
+var HS_ON_PATH_OVERRIDE_ENV = "HEYSPEX_HS_ON_PATH";
+function onPathOverride(env) {
+  const raw = String(env?.[HS_ON_PATH_OVERRIDE_ENV] ?? "");
+  if (raw === "1") return true;
+  if (raw === "0") return false;
+  return void 0;
+}
+function describeHsCommand({ env, exists, useCache = true } = {}) {
+  const injected = env !== void 0 || exists !== void 0;
+  const effectiveEnv = env ?? process.env;
+  const override = onPathOverride(effectiveEnv);
+  if (override !== void 0) {
+    return {
+      onPath: override,
+      prefix: override ? HS_BIN_NAME : HS_DISPATCHER_PREFIX,
+      resolvedPath: null,
+      dispatcherPath: HS_DISPATCHER_PATH
+    };
+  }
+  if (useCache && !injected && cached) return cached;
+  const resolvedPath = findOnPath(HS_BIN_NAME, {
+    env: env ?? process.env,
+    exists: exists ?? existsSync
+  });
+  const answer = {
+    onPath: resolvedPath !== null,
+    prefix: resolvedPath !== null ? HS_BIN_NAME : HS_DISPATCHER_PREFIX,
+    resolvedPath,
+    dispatcherPath: HS_DISPATCHER_PATH
+  };
+  if (useCache && !injected) cached = answer;
+  return answer;
+}
+function hsCommand(args = "", options2 = {}) {
+  let prefix = HS_DISPATCHER_PREFIX;
+  try {
+    prefix = describeHsCommand(options2).prefix;
+  } catch {
+  }
+  const tail = String(args ?? "").trim();
+  return tail ? `${prefix} ${tail}` : prefix;
+}
+
+// vendor/heyspex-mcp/console-fetch.mjs
+init_heyspex_home();
+init_credentials();
+import { readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join6 } from "node:path";
+
+// vendor/heyspex-mcp/session-owner.mjs
+init_heyspex_home();
+init_credentials();
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join3 } from "node:path";
+function resolveSessionOwnerUncached({ env = process.env, homeDir = heyspexHome(), readFile } = {}) {
+  const fromEnv = typeof env?.HS_ACCOUNT_ID === "string" ? env.HS_ACCOUNT_ID.trim() : "";
+  if (fromEnv) return fromEnv;
+  return readCurrentAccountId({ homeDir, readFile });
+}
+
+// vendor/heyspex-mcp/vault-less-endpoints.mjs
+var VAULT_LESS_ENDPOINTS = Object.freeze([
+  "* /api/mcp/session",
+  "* /api/mcp/pairing-codes",
+  "POST /api/vaults",
+  "GET /api/vaults",
+  "POST /api/workspaces",
+  "GET /api/workspaces",
+  "* /api/admin/dev-mode"
+]);
+function pathnameOf(path4) {
+  const raw = String(path4 ?? "").split("?")[0].split("#")[0];
+  const noTrailing = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
+  return noTrailing || "/";
+}
+function isVaultLessEndpoint(method, path4) {
+  const m = String(method || "GET").toUpperCase();
+  const pathname = pathnameOf(path4);
+  return VAULT_LESS_ENDPOINTS.some((row) => {
+    const [rowMethod, rowPath] = row.split(" ");
+    return rowPath === pathname && (rowMethod === "*" || rowMethod === m);
+  });
+}
+
+// vendor/heyspex-mcp/write-outbox.mjs
+import {
+  readdirSync,
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync2,
+  mkdirSync as mkdirSync2,
+  existsSync as existsSync2,
+  renameSync as renameSync2,
+  rmSync
+} from "node:fs";
+import { basename, join as join4, isAbsolute as isAbsolute2 } from "node:path";
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+init_heyspex_home();
+import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
+import { homedir as homedir5, tmpdir } from "node:os";
+
+// vendor/heyspex-mcp/usable-dir-env.mjs
+import { statSync } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+import { basename as basename2, dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-binding.mjs
+import {
+  copyFileSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
+  realpathSync as realpathSync2,
+  renameSync as renameSync3,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import path from "node:path";
+
+// vendor/heyspex-mcp/console-fetch.mjs
+var VAULT_NOT_REGISTERED = "VAULT_NOT_REGISTERED";
+var VaultNotRegisteredError = class extends Error {
+  /**
+   * @param {string | null | undefined} repoRootAbs the root the resolver settled on
+   * @param {string | null | undefined} source the resolver tier that produced it
+   * @param {{ reason?: 'unregistered' | 'legacy-id', legacyId?: string | null }} [detail]
+   */
+  constructor(repoRootAbs, source, { reason = "unregistered", legacyId = null } = {}) {
+    const root = typeof repoRootAbs === "string" && repoRootAbs.trim() ? repoRootAbs.trim() : null;
+    const where = root ? ` (${root})` : "";
+    const why = reason === "legacy-id" ? `This repo${where} is registered on this machine under a legacy id (\`${legacyId}\`), not the vault id the console knows, and its heyspex.yaml carries no \`vault_id\` to stand in for it, ` : `This repo${where} is not connected to a HeySpex vault on this machine (\`hs connect\` has not registered it), `;
+    super(
+      why + `so the console call was refused before it was sent. Run \`${hsCommand("connect")}\`${root ? ` in ${root}` : ""} to ${reason === "legacy-id" ? "re-register" : "connect"} it, then try again. Nothing was sent.`
+    );
+    this.name = "VaultNotRegisteredError";
+    this.code = VAULT_NOT_REGISTERED;
+    this.reason = reason;
+    this.repoRootAbs = root;
+    this.source = typeof source === "string" ? source : null;
+    this.legacyId = legacyId;
+  }
+};
+var CLOUD_VAULT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isCloudVaultId(value) {
+  return typeof value === "string" && CLOUD_VAULT_ID_RE.test(value.trim());
+}
+var MARKER_VAULT_ID_RE = /^vault_id:[ \t]*["']?([^"'\r\n#]+)/m;
+function readMarkerVaultId(repoRootAbs, { readFile } = {}) {
+  if (typeof repoRootAbs !== "string" || !repoRootAbs.trim()) return null;
+  const read = readFile ?? ((p) => readFileSync6(p, "utf8"));
+  try {
+    const raw = read(join6(repoRootAbs, "heyspex.yaml"));
+    const value = String(raw ?? "").match(MARKER_VAULT_ID_RE)?.[1]?.trim() ?? "";
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+function cloudVaultIdFor(resolved, { readMarkerVaultId: readMarker = readMarkerVaultId } = {}) {
+  const rowId = resolved.vaultId.trim();
+  if (isCloudVaultId(rowId)) return rowId;
+  const marker = readMarker(resolved.repoRootAbs);
+  if (isCloudVaultId(marker)) return marker.trim();
+  throw new VaultNotRegisteredError(resolved.repoRootAbs, resolved.source, { reason: "legacy-id", legacyId: rowId });
+}
+var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
+
+// spex-console/src/lib/cli/control-shared.ts
+init_credentials();
+
+// spex-console/src/lib/vault-registry/registry-file.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
+
+// spex-console/src/lib/heyspex-home.ts
+import { homedir as homedir7 } from "node:os";
+function heyspexHome2(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir7();
+}
+
+// spex-console/src/lib/vault-registry/types.ts
+var LEGACY_REGISTRY_ACCOUNT_ID = "legacy";
+var VAULT_REGISTRY_SCHEMA_VERSION = 2;
+function emptyVaultRegistry() {
+  return {
+    schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    current_account_id: null,
+    accounts: {},
+    workspaces: [],
+    vaults: []
+  };
+}
+
+// spex-console/src/lib/vault-registry/registry-file.ts
+function vaultRegistryDir(opts = {}) {
+  return opts.registryDir ?? join7(heyspexHome2(), ".heyspex");
+}
+function vaultRegistryFilePath(opts = {}) {
+  return join7(vaultRegistryDir(opts), "registry.json");
+}
+function isNonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+function accountOf(o) {
+  return isNonEmptyString(o.account_id) ? o.account_id : LEGACY_REGISTRY_ACCOUNT_ID;
+}
+function normalizeWorkspace(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  if (!isNonEmptyString(o.id)) return null;
+  if (!isNonEmptyString(o.display_name)) return null;
+  if (!isNonEmptyString(o.created_at)) return null;
+  const record = {
+    id: o.id,
+    display_name: o.display_name,
+    created_at: o.created_at,
+    archived: o.archived === true,
+    account_id: accountOf(o)
+  };
+  if (isNonEmptyString(o.github_org)) record.github_org = o.github_org;
+  return record;
+}
+function normalizeVault(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  if (!isNonEmptyString(o.id)) return null;
+  if (!isNonEmptyString(o.workspace_id)) return null;
+  if (!isNonEmptyString(o.display_name)) return null;
+  if (!isNonEmptyString(o.repo_root_abs)) return null;
+  if (typeof o.schema_version !== "number") return null;
+  if (!isNonEmptyString(o.registered_at)) return null;
+  const record = {
+    id: o.id,
+    workspace_id: o.workspace_id,
+    display_name: o.display_name,
+    repo_root_abs: o.repo_root_abs,
+    schema_version: o.schema_version,
+    registered_at: o.registered_at,
+    archived: o.archived === true,
+    account_id: accountOf(o)
+  };
+  if (isNonEmptyString(o.github_remote)) record.github_remote = o.github_remote;
+  return record;
+}
+function normalizeStoredPointers(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  const out = {};
+  for (const field of ["active_vault_id", "active_workspace_id"]) {
+    const v = o[field];
+    if (v === null || isNonEmptyString(v)) out[field] = v;
+  }
+  return out;
+}
+function normalizePointers(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  return {
+    active_vault_id: isNonEmptyString(o.active_vault_id) ? o.active_vault_id : null,
+    active_workspace_id: isNonEmptyString(o.active_workspace_id) ? o.active_workspace_id : null
+  };
+}
+function registryFileSchemaOf(json) {
+  if (!json || typeof json !== "object" || Array.isArray(json)) return null;
+  return json.schema_version === 2 ? 2 : 1;
+}
+function parseVaultRegistryFile(json) {
+  const schema = registryFileSchemaOf(json);
+  if (schema === null) return emptyVaultRegistry();
+  const o = json;
+  const workspacesRaw = Array.isArray(o.workspaces) ? o.workspaces : [];
+  const workspaces = workspacesRaw.map(normalizeWorkspace).filter((w) => w !== null);
+  const vaultsRaw = Array.isArray(o.vaults) ? o.vaults : [];
+  const vaults = vaultsRaw.map(normalizeVault).filter((v) => v !== null);
+  if (schema === 1) {
+    const legacy = normalizePointers(o);
+    const hasLegacyState = legacy.active_vault_id !== null || legacy.active_workspace_id !== null || workspaces.length > 0 || vaults.length > 0;
+    return {
+      schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+      current_account_id: hasLegacyState ? LEGACY_REGISTRY_ACCOUNT_ID : null,
+      accounts: hasLegacyState ? { [LEGACY_REGISTRY_ACCOUNT_ID]: legacy } : {},
+      workspaces,
+      vaults
+    };
+  }
+  const accounts = {};
+  if (o.accounts && typeof o.accounts === "object" && !Array.isArray(o.accounts)) {
+    for (const [id, pointers] of Object.entries(o.accounts)) {
+      if (isNonEmptyString(id)) accounts[id] = normalizeStoredPointers(pointers);
+    }
+  }
+  return {
+    schema_version: VAULT_REGISTRY_SCHEMA_VERSION,
+    current_account_id: isNonEmptyString(o.current_account_id) ? o.current_account_id : null,
+    accounts,
+    workspaces,
+    vaults
+  };
+}
+function readRegistryJson(opts) {
+  const filePath = vaultRegistryFilePath(opts);
+  if (!existsSync5(filePath)) return { kind: "missing" };
+  try {
+    const raw = readFileSync7(filePath, "utf8");
+    const json = JSON.parse(raw);
+    if (registryFileSchemaOf(json) === null) return { kind: "unreadable" };
+    return { kind: "ok", raw, json };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+function inspectVaultRegistry(opts = {}) {
+  const read = readRegistryJson(opts);
+  if (read.kind !== "ok") {
+    return {
+      registry: emptyVaultRegistry(),
+      file_schema_version: null,
+      registry_unreadable: read.kind === "unreadable"
+    };
+  }
+  return {
+    registry: parseVaultRegistryFile(read.json),
+    file_schema_version: registryFileSchemaOf(read.json),
+    registry_unreadable: false
+  };
+}
+function loadVaultRegistry(opts = {}) {
+  return inspectVaultRegistry(opts).registry;
+}
+
+// spex-console/src/lib/cli/control-shared.ts
+var EXIT = {
+  /** Success. */
+  OK: 0,
+  /**
+   * A read-only CHECK ran correctly and its answer is "no" — `hs connect
+   * --check` on an unconnected repo. Distinct from {@link EXIT.USAGE} so a
+   * script can tell "you typed the command wrong" from "the command worked,
+   * the repo is not connected". Both were `1` until 2026-09-18, which made
+   * `--check` unusable in a conditional: every caller had to parse stdout to
+   * find out which of the two had happened.
+   */
+  CHECK_FAILED: 2,
+  /** Usage error — unknown subcommand/flag, or a missing required argument. */
+  USAGE: 1,
+  /** Claim race lost — the spec is already claimed by another agent (409). */
+  CONFLICT: 9,
+  /** Target not found — release of an unheld claim, etc. (404). */
+  NOT_FOUND: 10,
+  /** Invalid argument — bad `--ttl`, unknown `--kind`, unparseable date. */
+  INVALID_ARG: 11,
+  /** SpexConsole unreachable (network error reaching the dev server). */
+  CONSOLE_UNREACHABLE: 12,
+  /** Server failure — a non-OK response that isn't 400/402/404/409. */
+  WRITE_FAILED: 13,
+  /** Neon control plane absent — the endpoint returned 402 (upgrade required). */
+  NEON_REQUIRED: 14,
+  /**
+   * A cross-account `--account <id>` override was refused — the caller is
+   * not a builder/admin (`resolveScopedAccountId`'s `forbidden_account_override`,
+   * [[HS-X3GB-EKLJ-TASK-hs-cli-account-flag-for-cross-account]]). Distinct
+   * from `USAGE`/`INVALID_ARG` — this is an authorization refusal, not a
+   * malformed command.
+   */
+  FORBIDDEN: 15,
+  /**
+   * A CLOUD write refused because no account id could be resolved (no
+   * `HS_ACCOUNT_ID` env var, no `account_id:` in `~/.heyspex/config.yaml`) --
+   * `resolveCloudAccountIdOrRefuse` in `vault-workspace-shared.ts`
+   * ([[HS-YU1S-UAGY-TASK-cloud-writes-refuse-without-a]]). Distinct from
+   * `FORBIDDEN` -- this is "not signed in at all", not "signed in but not
+   * authorized for this override".
+   */
+  SIGN_IN_REQUIRED: 16,
+  /**
+   * Signed in, but the account a repo would be attached to was not confirmed:
+   * a non-interactive install/connect with no matching `--account` / `--yes`,
+   * an `account_id` that disagrees with the bearer's user, or the human
+   * aborting the identity prompt (`install-identity.ts`,
+   * [[HS-HAQI-KODY-DIAG-hs-install-and-hs-connect-bind-a-new]]).
+   */
+  IDENTITY_UNCONFIRMED: 17,
+  /**
+   * The repo this verb runs in is not registered on this machine (no
+   * `~/.heyspex/registry.json` row for its root, or a legacy slug row with no
+   * cloud `vault_id` in its heyspex.yaml), so the call was refused LOCALLY —
+   * nothing was sent. Names `hs connect`
+   * ([[HS-MVG4-WW9R-TASK-mcp-and-hs-name-account-vault-on-every]]).
+   */
+  VAULT_NOT_REGISTERED: 18,
+  /**
+   * The local half of a setup verb (`hs connect`, `hs vault *`, `hs workspace
+   * *`) was written but the CLOUD half did not land -- the console refused
+   * it or was never reached. The verb's receipt names the failed half and the
+   * exact command to re-run
+   * ([[HS-STCY-WW9R-TASK-add-a-shared-receipt-that-reads-back]], invariant 6).
+   * Distinct from {@link EXIT.WRITE_FAILED} so a script can tell "re-run to
+   * sync the cloud" from a generic server failure.
+   */
+  CLOUD_WRITE_FAILED: 19,
+  /**
+   * The repo's committed `heyspex.yaml` records `account: <A>` but the machine
+   * is signed in as another account, so `hs connect` refused and wrote
+   * nothing (marker, registry, cloud). Repair: `hs login --switch-account <A>`
+   * ([[HS-VWUD-WW9R-TASK-record-the-connecting-account-in]], invariant 4).
+   */
+  ACCOUNT_MISMATCH: 20,
+  /**
+   * Both sides of a setup verb's receipt were read back and still DISAGREE
+   * after a short bounded re-read of the cloud side (a briefly stale read is
+   * absorbed first). The write may well have landed; what the verb cannot
+   * claim is that this machine and the console now say the same thing. The
+   * receipt prints the diffs and the command to re-run
+   * ([[HS-FKSR-WW9R-TASK-make-one-hs-connect-run-create-a-cloud]], invariant 6).
+   * Distinct from {@link EXIT.CLOUD_WRITE_FAILED} (a write that did not land).
+   */
+  RECEIPT_DISAGREE: 21
+};
+var VAULT_ID_HEADER = "x-heyspex-vault-id";
+var ACCOUNT_ID_HEADER = "x-heyspex-account-id";
+function readPairedBearer(opts = {}) {
+  return readBearer(opts);
+}
+function readPairedToken(opts = {}) {
+  return readPairedBearer(opts).token ?? void 0;
+}
+function bearerHeaderFor(consoleUrl, opts = {}) {
+  try {
+    const host = new URL(consoleUrl).hostname;
+    if (host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1") {
+      return {};
+    }
+    const token = readPairedToken(opts);
+    return token ? { authorization: `Bearer ${token}` } : {};
+  } catch {
+    return {};
+  }
+}
+function scopeHeadersFor(scope, method, path4) {
+  if (scope === "none") {
+    if (!isVaultLessEndpoint(method, path4)) {
+      throw new Error(
+        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path4} is vault-scoped and must name { accountId, vaultId }.`
+      );
+    }
+    return {};
+  }
+  return { [VAULT_ID_HEADER]: scope.vaultId, [ACCOUNT_ID_HEADER]: scope.accountId };
+}
+async function controlRequest(deps, req) {
+  const url = `${deps.consoleUrl}${req.path}`;
+  const scopeHeaders = scopeHeadersFor(deps.scope, req.method, req.path);
+  let res;
+  try {
+    res = await deps.fetchImpl(url, {
+      method: req.method,
+      headers: {
+        "content-type": "application/json",
+        // A remote console (cloud vault write mode, [[HS-PH7O-ILNC-DIAG-hs-check-report-cannot-authenticate]])
+        // authenticates every control call; loopback never asked, so the header
+        // is attached only when the target is non-loopback and a paired token
+        // exists. Same `hsmcp_` bearer the MCP server presents.
+        ...bearerHeaderFor(deps.consoleUrl),
+        // Invariant 2: name the vault and the account on every call, or the
+        // console serves whatever its leftover pointer says.
+        ...scopeHeaders
+      },
+      ...req.body !== void 0 ? { body: JSON.stringify(req.body) } : {}
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      error: {
+        code: EXIT.CONSOLE_UNREACHABLE,
+        message: `could not reach console at ${deps.consoleUrl}: ${message}
+  Start the dev server or set HEYSPEX_CONSOLE_URL.`,
+        payload: {
+          ok: false,
+          error: "console_unreachable",
+          url: deps.consoleUrl,
+          message
+        },
+        isError: true
+      }
+    };
+  }
+  let parsed = null;
+  try {
+    parsed = await res.json();
+  } catch {
+  }
+  if (res.status === 402) {
+    return {
+      ok: false,
+      error: {
+        code: EXIT.NEON_REQUIRED,
+        message: "this command requires the Neon control plane, which is not configured (console returned 402).",
+        payload: {
+          ok: false,
+          error: "neon_required",
+          status: 402,
+          console_response: parsed
+        },
+        isError: true
+      }
+    };
+  }
+  return { ok: true, status: res.status, body: parsed };
+}
+function normalizeRoot(p) {
+  return path2.resolve(p).replace(/[\\/]+/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function resolveControlScope(input) {
+  const target = normalizeRoot(input.vaultRoot);
+  const row = input.vaults.find((v) => normalizeRoot(v.repo_root_abs) === target) ?? null;
+  if (!row) {
+    return {
+      ok: false,
+      error: {
+        code: EXIT.VAULT_NOT_REGISTERED,
+        message: `this repo (${input.vaultRoot}) is not connected to a HeySpex vault on this machine (\`hs connect\` has not registered it), so the call was refused before it was sent. Run \`${hsCommand("connect")}\` in ${input.vaultRoot}, then try again.`,
+        payload: {
+          ok: false,
+          error: "vault_not_registered",
+          reason: "unregistered",
+          vault_root: input.vaultRoot
+        },
+        isError: true
+      }
+    };
+  }
+  let vaultId;
+  try {
+    vaultId = cloudVaultIdFor(
+      { vaultId: row.id, repoRootAbs: row.repo_root_abs, source: "registry" },
+      input.readMarkerVaultId ? { readMarkerVaultId: input.readMarkerVaultId } : {}
+    );
+  } catch (err) {
+    if (!(err instanceof VaultNotRegisteredError)) throw err;
+    const refused = err;
+    return {
+      ok: false,
+      error: {
+        code: EXIT.VAULT_NOT_REGISTERED,
+        message: refused.message,
+        payload: {
+          ok: false,
+          error: "vault_not_registered",
+          reason: refused.reason ?? "legacy-id",
+          vault_root: input.vaultRoot,
+          legacy_id: refused.legacyId ?? row.id
+        },
+        isError: true
+      }
+    };
+  }
+  const accountId = input.accountId?.trim() ?? "";
+  if (!accountId) {
+    return {
+      ok: false,
+      error: {
+        code: EXIT.SIGN_IN_REQUIRED,
+        message: `no HeySpex account is configured on this machine (\`hs login\` has not been run), so the call was refused before it was sent. Run \`${hsCommand("login")}\` on this machine, then try again.`,
+        payload: { ok: false, error: "sign_in_required", vault_root: input.vaultRoot },
+        isError: true
+      }
+    };
+  }
+  return { ok: true, scope: { accountId, vaultId } };
+}
+function resolveControlScopeFromMachine(vaultRoot, opts = {}) {
+  const registry = loadVaultRegistry(opts.registry);
+  const accountId = resolveSessionOwnerUncached({ env: opts.env, homeDir: opts.homeDir });
+  return resolveControlScope({ vaultRoot, accountId, vaults: registry.vaults });
+}
+
+// scripts/lib/console-url-resolver.mjs
+init_heyspex_home();
+init_dev_mode();
+import { readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { join as join9 } from "node:path";
+var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
+function trimTrailingSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]", "0.0.0.0"]);
+function isLoopbackConsoleUrl(url) {
+  if (typeof url !== "string" || !url) return false;
+  try {
+    return LOOPBACK_HOSTS.has(new URL(url).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+var staleLoopbackCredentialsWarned = false;
+function warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log }) {
+  if (staleLoopbackCredentialsWarned) return;
+  staleLoopbackCredentialsWarned = true;
+  try {
+    log(
+      `[heyspex] ignoring console_url ${credentialsUrl} from ~/.heyspex/credentials.yaml: the resolved reliance is cloud, and a loopback console cannot serve it \u2014 using ${derivedUrl} (set HEYSPEX_CONSOLE_URL to override explicitly, or run \`hs dev mode:local\` to go back to a local console).
+`
+    );
+  } catch {
+  }
+}
+function readCredentialsConsoleUrl({ homeDir = heyspexHome(), readFile = defaultReadFile2 } = {}) {
+  try {
+    const raw = readFile(join9(homeDir, ".heyspex", "credentials.yaml"));
+    const match = String(raw ?? "").match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
+    const value = match?.[1]?.trim();
+    return value && value.length > 0 ? trimTrailingSlash(value) : null;
+  } catch {
+    return null;
+  }
+}
+function defaultReadFile2(p) {
+  return readFileSync9(p, "utf8");
+}
+function readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery = defaultReadFile2 } = {}) {
+  if (!repoRoot) return null;
+  try {
+    const discovery = String(readDiscovery(join9(repoRoot, ".heyspex", "console-url")) ?? "").trim();
+    if (discovery.length > 0) return trimTrailingSlash(discovery);
+  } catch {
+  }
+  return null;
+}
+var ConsoleUrlUnresolvedError = class extends Error {
+  constructor() {
+    super(
+      "resolveConsoleUrl: local reliance with no HEYSPEX_CONSOLE_URL env, no console_url: in ~/.heyspex/credentials.yaml, and no .heyspex/console-url discovery file \u2014 refusing to silently fall back to the localhost:3000 default in strict mode."
+    );
+    this.name = "ConsoleUrlUnresolvedError";
+  }
+};
+function resolveModeEnvelope({ env, homeDir }) {
+  try {
+    const resolved = resolveDevMode({ env, homeDir });
+    return {
+      reliance: resolved.reliance === "cloud" ? "cloud" : "local",
+      consoleUrl: resolved.consoleUrl || DEFAULT_CONSOLE_URL
+    };
+  } catch {
+    return { reliance: "local", consoleUrl: DEFAULT_CONSOLE_URL };
+  }
+}
+function resolveConsoleUrl({
+  repoRoot,
+  env = process.env,
+  homeDir = heyspexHome(),
+  strict = false,
+  devMode,
+  log = (line) => process.stderr.write(line),
+  readFile = defaultReadFile2,
+  readDiscovery = defaultReadFile2
+} = {}) {
+  const envUrl = env.HEYSPEX_CONSOLE_URL?.trim();
+  if (envUrl) return trimTrailingSlash(envUrl);
+  const mode = devMode ?? resolveModeEnvelope({ env, homeDir });
+  const cloud = mode.reliance === "cloud";
+  const derivedUrl = trimTrailingSlash(
+    cloud && isLoopbackConsoleUrl(mode.consoleUrl) ? CLOUD_CONSOLE_URL : mode.consoleUrl || DEFAULT_CONSOLE_URL
+  );
+  const credentialsUrl = readCredentialsConsoleUrl({ homeDir, readFile });
+  if (credentialsUrl) {
+    if (cloud && isLoopbackConsoleUrl(credentialsUrl)) {
+      warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log });
+    } else {
+      return credentialsUrl;
+    }
+  }
+  if (!cloud) {
+    const discoveryUrl = readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery });
+    if (discoveryUrl) return discoveryUrl;
+    if (strict) throw new ConsoleUrlUnresolvedError();
+  }
+  return derivedUrl;
+}
+
+// spex-console/src/lib/cli/defer.ts
+function resolveSpexConsoleUrl(vaultRoot, readDiscovery, opts = {}) {
+  return resolveConsoleUrl({
+    repoRoot: vaultRoot,
+    env: opts.env,
+    homeDir: opts.homeDir,
+    readFile: opts.readFile,
+    readDiscovery,
+    log: opts.log
+  });
+}
+var HELP2 = [
+  "Usage:",
+  "  hs defer <spec-id> [--until <when>] [--json] [--no-daemon]",
+  "  hs undefer <spec-id> [--json] [--no-daemon]",
+  "",
+  "Time-shift a spec via its `defer_until` frontmatter field. A deferred spec is",
+  "scheduler-invisible until the date passes, then auto-revives.",
+  "",
+  "Arguments:",
+  "  <spec-id>        The spec to defer/undefer (e.g. HS-TASK-EWL5).",
+  "",
+  "Flags:",
+  "  --until <when>   ISO date, or relative offset +Nd / +Nw / +Nm / +Ny.",
+  "                   Defaults to +1y (matches the console Defer button).",
+  "                   Ignored by `undefer` (which always clears the field).",
+  "  --json           Emit a machine-readable JSON result.",
+  "  --no-daemon      Write straight to the vault (no console needed; CI path).",
+  "  --help, -h       Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 10 not-found \xB7 11 bad-arg \xB7 12 console-unreachable \xB7 13 write-failed"
+].join("\n");
+
+// spex-console/src/lib/cli/revalidate-sweep.ts
+var REVALIDATE_EXIT = {
+  /** Swept clean — no spec is red (no-win items do not fail the pass). */
+  OK: 0,
+  /** Usage error — unknown flag or bad verb. */
+  USAGE: 1,
+  /** Nothing to sweep — no stamped spec has a manifest. */
+  NOT_FOUND: 10,
+  /** The pass ran and at least one stamped spec's frozen checks are red. */
+  DECAY_FOUND: 20
+};
+var STAMPED_STATUSES = /* @__PURE__ */ new Set(["review_pending", "in_review"]);
+var DIAGNOSE_CLOSED_STATUSES = /* @__PURE__ */ new Set([
+  "closed",
+  "shipped",
+  "in_review",
+  "archived",
+  "cancelled",
+  "duplicate",
+  "hibernated",
+  "superseded"
+]);
+function isDiagnoseOpen(status) {
+  return !DIAGNOSE_CLOSED_STATUSES.has(status.trim().toLowerCase());
+}
+var DECAY_TAG = "stamp-decay";
+function computeCoverage(input) {
+  const percent = input.stamped === 0 ? 0 : Math.round(input.checkable / input.stamped * 1e3) / 10;
+  return { ...input, percent };
+}
+var CHECK_KIND_ALIASES = {
+  tests: "test",
+  unit: "test",
+  grep: "command",
+  live: "command",
+  diff: "command",
+  evidence: "command"
+};
+function loadSweepManifest(spec, text) {
+  const aliased = [];
+  const originalKinds = {};
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    return {
+      spec,
+      error: `manifest is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      aliased,
+      originalKinds
+    };
+  }
+  if (typeof raw === "object" && raw !== null) {
+    const criteria = raw.criteria;
+    if (Array.isArray(criteria)) {
+      for (const criterion of criteria) {
+        if (typeof criterion !== "object" || criterion === null) continue;
+        const checks = criterion.checks;
+        if (!Array.isArray(checks)) continue;
+        for (const check of checks) {
+          if (typeof check !== "object" || check === null) continue;
+          const rec = check;
+          const kind = rec.kind;
+          if (typeof kind !== "string") continue;
+          const canonical = CHECK_KIND_ALIASES[kind];
+          if (!canonical) continue;
+          if (typeof rec.run === "string") {
+            originalKinds[keyOf(rec.run, typeof rec.cwd === "string" ? rec.cwd : void 0)] = kind;
+          }
+          rec.kind = canonical;
+          aliased.push(kind);
+        }
+      }
+    }
+  }
+  const { manifest, error } = parseChecksManifest(JSON.stringify(raw));
+  return { spec, manifest, error, aliased: [...new Set(aliased)].sort(), originalKinds };
+}
+function commandKey(check) {
+  return keyOf(check.run, check.cwd);
+}
+function keyOf(run, cwd) {
+  return `${cwd?.trim() || "*"}\0${run.trim()}`;
+}
+function planCommands(loaded) {
+  const byKey = /* @__PURE__ */ new Map();
+  let checkInstances = 0;
+  for (const entry of loaded) {
+    if (!entry.manifest) continue;
+    for (const criterion of entry.manifest.criteria) {
+      for (const check of criterion.checks) {
+        checkInstances++;
+        const key = commandKey(check);
+        let planned = byKey.get(key);
+        if (!planned) {
+          planned = {
+            key,
+            run: check.run,
+            cwd: check.cwd ?? null,
+            kind: entry.originalKinds[key] ?? check.kind,
+            uses: [],
+            noWin: classifyNoWin(check)
+          };
+          byKey.set(key, planned);
+        }
+        planned.uses.push({ specId: entry.spec.id, ac: criterion.ac, check });
+      }
+    }
+  }
+  return { commands: [...byKey.values()], checkInstances };
+}
+function makeReplayDeps(outcomes) {
+  return {
+    runCheck: async (check) => {
+      const outcome = outcomes.get(commandKey(check));
+      if (outcome) return outcome;
+      return {
+        exitCode: -1,
+        durationMs: 0,
+        message: `internal: no recorded outcome for \`${check.run}\` (command was never planned)`
+      };
+    }
+  };
+}
+function pickAttempt(attempts) {
+  if (attempts.length === 0) {
+    return { cwd: "(none)", outcome: { exitCode: -1, durationMs: 0, message: "no attempt made" } };
+  }
+  return attempts.find((a) => a.outcome.exitCode === 0) ?? attempts[0];
+}
+function needsSerialConfirmation(outcome) {
+  return outcome.exitCode !== 0;
+}
+function resolveExecution(parallel, confirmation) {
+  if (!needsSerialConfirmation(parallel)) return { outcome: parallel, parallelismArtifact: false };
+  if (!confirmation) return { outcome: parallel, parallelismArtifact: false };
+  return {
+    outcome: confirmation,
+    parallelismArtifact: !needsSerialConfirmation(confirmation)
+  };
+}
+var RUNNER_RE = /(?:^|[\\/])(vitest(?:\.m?js)?|jest(?:\.m?js)?)$/i;
+var VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-t",
+  "--testNamePattern",
+  "--reporter",
+  "--project",
+  "--config",
+  "-c",
+  "--environment",
+  "--pool",
+  "--prefix"
+]);
+var COMPOUND_RE = /[|;&]|\$\(|`|\|\|/;
+var COUNT_PINNED_PATTERNS = [
+  { re: /\bexactly[=\s]+\d+\b/i, label: "an `exactly <n>` assertion" },
+  { re: /\s-eq\s+\d{2,}\b/, label: "a shell `-eq <n>` comparison against a literal count" },
+  { re: /--count[=\s]+\d{2,}\b/, label: "a `--count <n>` assertion" },
+  { re: /\.length\s*===?\s*\d{2,}\b/, label: "a `.length === <n>` assertion" }
+];
+function classifyNoWin(check) {
+  const run = check.run.trim();
+  if (check.expect === "exit-0" && isWholeSuiteInvocation(run)) {
+    return {
+      reason: "whole-suite-exit-0",
+      detail: "pins the entire test suite to exit 0 \u2014 it goes red whenever any unrelated test in the repo is red, so no change to this spec can make it pass"
+    };
+  }
+  for (const { re, label } of COUNT_PINNED_PATTERNS) {
+    if (re.test(run)) {
+      return {
+        reason: "count-pinned",
+        detail: `${label} \u2014 it goes red as soon as the counted thing grows, independently of this spec`
+      };
+    }
+  }
+  return null;
+}
+function isWholeSuiteInvocation(run) {
+  if (COMPOUND_RE.test(run)) return false;
+  const tokens = run.split(/\s+/).filter(Boolean);
+  if (tokens[0] === "npm") {
+    const rest = tokens.slice(1).filter((t) => !t.startsWith("-"));
+    const script = rest[0] === "run" ? rest[1] : rest[0];
+    return (script === "test" || script === "tests") && !tokens.includes("--");
+  }
+  const runnerAt = tokens.findIndex((t) => RUNNER_RE.test(t));
+  if (runnerAt === -1) return false;
+  let i = runnerAt + 1;
+  if (tokens[i] === "run" || tokens[i] === "watch") i++;
+  for (; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (VALUE_FLAGS.has(token)) {
+      i++;
+      continue;
+    }
+    if (token.startsWith("-")) continue;
+    return false;
+  }
+  return true;
+}
+function scoreSpec(loaded, report, noWinByKey, artifactKeys) {
+  const base = {
+    specId: loaded.spec.id,
+    title: loaded.spec.title,
+    status: loaded.spec.status
+  };
+  if (!report) {
+    return {
+      ...base,
+      verdict: "unparsable",
+      error: loaded.error ?? "manifest could not be loaded",
+      failures: [],
+      noWin: [],
+      parallelismArtifacts: []
+    };
+  }
+  const failures = [];
+  const noWin = [];
+  const artifacts = /* @__PURE__ */ new Set();
+  for (const criterion of report.criteria) {
+    for (const result of criterion.checks) {
+      const key = commandKey(result.check);
+      if (artifactKeys.has(key)) artifacts.add(result.check.run);
+      if (result.passed) continue;
+      const finding = noWinByKey.get(key);
+      if (finding) {
+        noWin.push({
+          ac: criterion.ac,
+          run: result.check.run,
+          reason: finding.reason,
+          detail: finding.detail
+        });
+      } else {
+        failures.push({
+          ac: criterion.ac,
+          run: result.check.run,
+          message: result.message ?? "check failed"
+        });
+      }
+    }
+  }
+  const verdict = failures.length > 0 ? "fail" : noWin.length > 0 ? "no-win" : "pass";
+  return { ...base, verdict, report, failures, noWin, parallelismArtifacts: [...artifacts] };
+}
+var EMPTY_SWEEP_STATE = { lastRunAt: null, noWin: {} };
+function recordNoWin(state, commands, now) {
+  const noWin = { ...state.noWin };
+  const items = [];
+  for (const command of commands) {
+    if (!command.noWin) continue;
+    const known = noWin[command.key];
+    const firstReportedAt = known?.firstReportedAt ?? now;
+    if (!known) noWin[command.key] = { reason: command.noWin.reason, firstReportedAt };
+    items.push({
+      key: command.key,
+      run: command.run,
+      reason: command.noWin.reason,
+      detail: command.noWin.detail,
+      specIds: [...new Set(command.uses.map((u) => u.specId))].sort(),
+      firstSeen: !known,
+      firstReportedAt
+    });
+  }
+  return { state: { ...state, noWin, lastRunAt: now }, items };
+}
+function shouldRunNow(state, now, minIntervalHours) {
+  if (!state.lastRunAt) return { run: true, hoursSinceLast: null };
+  const last = Date.parse(state.lastRunAt);
+  if (Number.isNaN(last)) return { run: true, hoursSinceLast: null };
+  const hours = (now.getTime() - last) / 36e5;
+  if (minIntervalHours === null) return { run: true, hoursSinceLast: hours };
+  return { run: hours >= minIntervalHours, hoursSinceLast: hours };
+}
+function detectSideEffects(before, after) {
+  const beforeByPath = new Map(before.map((f) => [f.path, f]));
+  const afterByPath = new Map(after.map((f) => [f.path, f]));
+  const effects = [];
+  for (const file of after) {
+    const prior = beforeByPath.get(file.path);
+    if (!prior) {
+      effects.push({ path: file.path, change: "added", contentIdentical: false });
+    } else if (prior.sha !== file.sha) {
+      effects.push({
+        path: file.path,
+        change: "modified",
+        contentIdentical: prior.normalizedSha === file.normalizedSha
+      });
+    }
+  }
+  for (const file of before) {
+    if (!afterByPath.has(file.path)) {
+      effects.push({ path: file.path, change: "removed", contentIdentical: false });
+    }
+  }
+  return effects.sort((a, b) => a.path.localeCompare(b.path));
+}
+function desiredDiagnoseRows(results) {
+  return results.filter((r) => r.verdict === "fail").map((result) => {
+    const acs = [...new Set(result.failures.map((f) => f.ac))].sort((a, b) => a - b);
+    const commands = [...new Set(result.failures.map((f) => f.run))];
+    return {
+      subjectSpecId: result.specId,
+      name: `Frozen checks for ${result.specId} are red \u2014 the completion stamp no longer holds`,
+      summary: `${result.specId} is at \`${result.status}\` but ${result.failures.length} of its frozen checks now fail (AC${acs.join(", AC")}). The stamp asserted these commands passed; re-running them says they do not.`,
+      severity: "error",
+      tags: [DECAY_TAG, "quality-gate", "checks-manifest"],
+      related: [`[[${result.specId}]]`],
+      body: renderDecayBody(result, commands)
+    };
+  });
+}
+function tableCell(text, max = 200) {
+  const flat = text.replace(/\s*\r?\n\s*/g, " ").trim();
+  const clipped = flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+  return clipped.replace(/\|/g, "\\|");
+}
+function renderDecayBody(result, commands) {
+  const lines = [
+    `# Frozen checks for ${result.specId} are red`,
+    "",
+    "## Symptom",
+    "",
+    `${result.specId} (${result.title}) sits at \`${result.status}\` with a frozen checks manifest whose commands no longer pass. Filed by the scheduled re-verification pass (\`hs revalidate\`, [[HS-R5LF-36QL-EPIC-stamped-work-is-re-verified-on-a]]).`,
+    "",
+    "## Failing checks",
+    "",
+    "| AC | command | detail |",
+    "|---|---|---|"
+  ];
+  for (const failure of result.failures) {
+    lines.push(
+      `| AC${failure.ac} | \`${tableCell(failure.run)}\` | ${tableCell(failure.message)} |`
+    );
+  }
+  lines.push(
+    "",
+    "## Reproduction",
+    "",
+    "```",
+    ...commands,
+    "```",
+    "",
+    "## Root cause",
+    "",
+    "Unknown until triaged. The HS-PEAG sweep found **zero** reds caused by broken shipped code \u2014 every one was a stale *check* \u2014 so start by asking whether the check still describes the work, not whether the work regressed.",
+    "",
+    "## Acceptance criteria",
+    "",
+    `1. Every command above exits 0, or the frozen check is corrected with a recorded reason.`,
+    `2. \`hs revalidate\` reports ${result.specId} green on the next pass.`
+  );
+  return lines.join("\n");
+}
+function reconcileDiagnoses(open, desired) {
+  const openBySubject = /* @__PURE__ */ new Map();
+  for (const row of open) {
+    if (!isDiagnoseOpen(row.status)) continue;
+    const list = openBySubject.get(row.subjectSpecId) ?? [];
+    list.push(row);
+    openBySubject.set(row.subjectSpecId, list);
+  }
+  for (const list of openBySubject.values()) {
+    list.sort((a, b) => a.diagnoseId.localeCompare(b.diagnoseId));
+  }
+  const actions = [];
+  const desiredSubjects = /* @__PURE__ */ new Set();
+  for (const row of desired) {
+    desiredSubjects.add(row.subjectSpecId);
+    const existing = openBySubject.get(row.subjectSpecId) ?? [];
+    if (existing.length === 0) {
+      actions.push({ kind: "file", subjectSpecId: row.subjectSpecId, row });
+      continue;
+    }
+    const [canonical, ...duplicates] = existing;
+    actions.push({
+      kind: "update",
+      subjectSpecId: row.subjectSpecId,
+      diagnoseId: canonical.diagnoseId,
+      row
+    });
+    for (const duplicate of duplicates) {
+      actions.push({
+        kind: "close",
+        subjectSpecId: row.subjectSpecId,
+        diagnoseId: duplicate.diagnoseId,
+        reason: `duplicate decay row \u2014 ${canonical.diagnoseId} is the open row for ${row.subjectSpecId}`
+      });
+    }
+  }
+  for (const [subjectSpecId, rows] of openBySubject) {
+    if (desiredSubjects.has(subjectSpecId)) continue;
+    for (const row of rows) {
+      actions.push({
+        kind: "close",
+        subjectSpecId,
+        diagnoseId: row.diagnoseId,
+        reason: `${subjectSpecId} is green \u2014 its frozen checks pass again`
+      });
+    }
+  }
+  return actions;
+}
+function scopeOpenDiagnoses(rows, onlySpecIds) {
+  if (onlySpecIds.length === 0) return [...rows];
+  const scope = new Set(onlySpecIds);
+  return rows.filter((row) => scope.has(row.subjectSpecId));
+}
+function makeDiagnoseWriter(deps) {
+  const call = async (method, apiPath, body) => {
+    const res = await controlRequest(deps, { method, path: apiPath, ...body ? { body } : {} });
+    if (!res.ok) return { ok: false, error: res.error.message };
+    if (res.status >= 300) {
+      const detail = res.body ?? null;
+      const reason = [detail?.error, detail?.message].filter((v) => typeof v === "string").join(": ");
+      return { ok: false, error: `console returned ${res.status}${reason ? ` \u2014 ${reason}` : ""}` };
+    }
+    return { ok: true, body: res.body };
+  };
+  return {
+    async fileDiagnose(row) {
+      const res = await call("POST", "/api/specs", {
+        type: "diagnose",
+        name: row.name,
+        summary: row.summary,
+        frontmatter: { severity: row.severity, tags: row.tags, related: row.related },
+        body: row.body
+      });
+      if (!res.ok) return { ok: false, error: res.error };
+      const spec = res.body?.spec;
+      if (!spec?.id) return { ok: false, error: "console accepted the create but returned no id" };
+      return { ok: true, diagnoseId: spec.id };
+    },
+    async updateDiagnose(diagnoseId, row) {
+      const current = await call("GET", `/api/specs/${encodeURIComponent(diagnoseId)}`);
+      if (!current.ok) return { ok: false, error: current.error };
+      const existing = current.body?.spec?.frontmatter ?? {};
+      const res = await call("PUT", `/api/specs/${encodeURIComponent(diagnoseId)}`, {
+        frontmatter: { ...existing, summary: row.summary },
+        body: row.body
+      });
+      return { ok: res.ok, error: res.error };
+    },
+    async closeDiagnose(diagnoseId, reason) {
+      const res = await call("PATCH", `/api/specs/${encodeURIComponent(diagnoseId)}/status`, {
+        status: "closed",
+        close_reason: reason
+      });
+      return { ok: res.ok, error: res.error };
+    }
+  };
+}
+async function applyReconciliation(actions, writer) {
+  const applied = [];
+  for (const action of actions) {
+    try {
+      if (action.kind === "file") {
+        const res = await writer.fileDiagnose(action.row);
+        applied.push({ action, ok: res.ok, diagnoseId: res.diagnoseId, error: res.error });
+      } else if (action.kind === "update") {
+        const res = await writer.updateDiagnose(action.diagnoseId, action.row);
+        applied.push({ action, ok: res.ok, diagnoseId: action.diagnoseId, error: res.error });
+      } else {
+        const res = await writer.closeDiagnose(action.diagnoseId, action.reason);
+        applied.push({ action, ok: res.ok, diagnoseId: action.diagnoseId, error: res.error });
+      }
+    } catch (err) {
+      applied.push({
+        action,
+        ok: false,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return applied;
+}
+async function buildSweepReport(input) {
+  const noWinByKey = /* @__PURE__ */ new Map();
+  for (const command of input.plan.commands) {
+    if (command.noWin) noWinByKey.set(command.key, command.noWin);
+  }
+  const deps = makeReplayDeps(input.outcomes);
+  const results = [];
+  for (const entry of input.loaded) {
+    const report = entry.manifest ? await runChecksManifest(entry.manifest, deps) : void 0;
+    results.push(scoreSpec(entry, report, noWinByKey, input.parallelismArtifacts));
+  }
+  const unparsable = results.filter((r) => r.verdict === "unparsable").map((r) => ({ specId: r.specId, error: r.error ?? "unknown" }));
+  const coverage = computeCoverage({
+    stamped: input.loaded.length + input.uncovered.length,
+    checkable: results.filter((r) => r.verdict !== "unparsable").length,
+    uncovered: input.uncovered.length,
+    unparsable: unparsable.length
+  });
+  const artifacts = input.plan.commands.filter((c) => input.parallelismArtifacts.has(c.key)).map((c) => ({ run: c.run, specIds: [...new Set(c.uses.map((u) => u.specId))].sort() }));
+  const reconciliation = reconcileDiagnoses(input.openDiagnoses, desiredDiagnoseRows(results));
+  return {
+    startedAt: input.startedAt,
+    durationMs: input.durationMs,
+    coverage,
+    checkInstances: input.plan.checkInstances,
+    distinctCommands: input.plan.commands.length,
+    results,
+    noWin: [...input.noWinItems],
+    parallelismArtifacts: artifacts,
+    sideEffects: [...input.sideEffects],
+    unparsable,
+    cwdResolution: input.plan.commands.map((c) => ({
+      run: c.run,
+      declared: c.cwd,
+      resolved: input.resolvedCwds.get(c.key) ?? "(not run)"
+    })),
+    reconciliation,
+    applied: null,
+    redCount: results.filter((r) => r.verdict === "fail").length,
+    greenCount: results.filter((r) => r.verdict === "pass").length
+  };
+}
+function sweepExitCode(report) {
+  return report.redCount > 0 ? REVALIDATE_EXIT.DECAY_FOUND : REVALIDATE_EXIT.OK;
+}
+function formatSweepReport(report) {
+  const lines = [];
+  const { coverage } = report;
+  lines.push(
+    `Re-verification pass \u2014 ${report.startedAt} (${Math.round(report.durationMs / 1e3)}s)`
+  );
+  lines.push("");
+  lines.push(
+    `Coverage: ${coverage.checkable}/${coverage.stamped} stamped specs checkable (${coverage.percent}%) \xB7 ${coverage.uncovered} have no manifest` + (coverage.unparsable > 0 ? ` \xB7 ${coverage.unparsable} manifest unusable` : "")
+  );
+  lines.push(
+    `Commands: ${report.checkInstances} check instances \u2192 ${report.distinctCommands} distinct, each run once`
+  );
+  const declared = report.cwdResolution.filter((c) => c.declared !== null).length;
+  lines.push(
+    `Working dirs: ${declared} declared a cwd \xB7 ${report.cwdResolution.length - declared} resolved by trying both roots`
+  );
+  lines.push(
+    `Verdict: ${report.redCount} red \xB7 ${report.greenCount} green \xB7 ${report.results.filter((r) => r.verdict === "no-win").length} no-win`
+  );
+  const red = report.results.filter((r) => r.verdict === "fail");
+  if (red.length > 0) {
+    lines.push("");
+    lines.push("RED \u2014 the stamp no longer holds:");
+    for (const result of red) {
+      lines.push(`  ${result.specId} (${result.status}) \u2014 ${result.title}`);
+      for (const failure of result.failures) {
+        lines.push(`      AC${failure.ac}  ${failure.run}`);
+        lines.push(`            ${failure.message.split("\n")[0].slice(0, 160)}`);
+      }
+    }
+  }
+  if (report.noWin.length > 0) {
+    lines.push("");
+    lines.push("NO-WIN \u2014 cannot pass for reasons the spec does not own (not filed):");
+    for (const item of report.noWin) {
+      const seen = item.firstSeen ? "new" : `first reported ${item.firstReportedAt}`;
+      lines.push(`  [${item.reason}] ${item.run}  (${seen})`);
+      lines.push(`      ${item.detail}`);
+      lines.push(`      affects: ${item.specIds.join(", ")}`);
+    }
+  }
+  if (report.parallelismArtifacts.length > 0) {
+    lines.push("");
+    lines.push("PARALLELISM ARTIFACTS \u2014 red under fan-out, green on the serial re-run:");
+    for (const artifact of report.parallelismArtifacts) {
+      lines.push(`  ${artifact.run}  (would have false-reported ${artifact.specIds.join(", ")})`);
+    }
+  }
+  if (report.unparsable.length > 0) {
+    lines.push("");
+    lines.push("UNUSABLE MANIFESTS \u2014 present but the parser rejected them:");
+    for (const item of report.unparsable) lines.push(`  ${item.specId}: ${item.error}`);
+  }
+  if (report.sideEffects.length > 0) {
+    lines.push("");
+    lines.push(
+      "SIDE EFFECTS \u2014 files that changed while the pass ran (nothing was reverted;",
+      "               attribution is by timing, so ambient writes can appear here):"
+    );
+    for (const effect of report.sideEffects) {
+      const note = effect.contentIdentical ? " (content identical \u2014 line endings only)" : "";
+      lines.push(`  ${effect.change} ${effect.path}${note}`);
+    }
+  }
+  lines.push("");
+  const verb = report.applied ? "applied" : "planned (dry run \u2014 pass --apply to execute)";
+  lines.push(`Resolution lane: ${report.reconciliation.length} action(s) ${verb}`);
+  for (const action of report.reconciliation) {
+    const target = action.kind === "file" ? action.subjectSpecId : action.diagnoseId;
+    lines.push(`  ${action.kind} ${target}`);
+  }
+  return lines.join("\n");
+}
+function sweepReportToJson(report) {
+  return {
+    ok: report.redCount === 0,
+    startedAt: report.startedAt,
+    durationMs: report.durationMs,
+    coverage: report.coverage,
+    checkInstances: report.checkInstances,
+    distinctCommands: report.distinctCommands,
+    red: report.redCount,
+    green: report.greenCount,
+    noWinSpecs: report.results.filter((r) => r.verdict === "no-win").length,
+    results: report.results.map((r) => ({
+      spec: r.specId,
+      status: r.status,
+      verdict: r.verdict,
+      failures: r.failures,
+      noWin: r.noWin,
+      ...r.error ? { error: r.error } : {}
+    })),
+    noWin: report.noWin,
+    parallelismArtifacts: report.parallelismArtifacts,
+    sideEffects: report.sideEffects,
+    unparsable: report.unparsable,
+    cwdResolution: report.cwdResolution,
+    reconciliation: report.reconciliation.map((a) => ({
+      kind: a.kind,
+      spec: a.subjectSpecId,
+      ...a.kind === "file" ? {} : { diagnose: a.diagnoseId },
+      ...a.kind === "close" ? { reason: a.reason } : {}
+    })),
+    applied: report.applied
+  };
+}
+function parseRevalidateArgs(argv) {
+  const args = {
+    json: false,
+    apply: false,
+    concurrency: 3,
+    minIntervalHours: null,
+    only: [],
+    planOnly: false,
+    timeoutSeconds: 420
+  };
+  const numeric = (raw, flag) => {
+    if (raw === void 0) return { error: `${flag} requires a value` };
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value <= 0)
+      return { error: `${flag} must be a positive number` };
+    return value;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") return { help: true };
+    else if (arg === "--json") args.json = true;
+    else if (arg === "--apply") args.apply = true;
+    else if (arg === "--plan-only") args.planOnly = true;
+    else if (arg === "--concurrency" || arg.startsWith("--concurrency=")) {
+      const raw = arg.includes("=") ? arg.split("=")[1] : argv[++i];
+      const value = numeric(raw, "--concurrency");
+      if (typeof value !== "number")
+        return { error: { code: REVALIDATE_EXIT.USAGE, message: value.error } };
+      args.concurrency = Math.floor(value);
+    } else if (arg === "--timeout" || arg.startsWith("--timeout=")) {
+      const raw = arg.includes("=") ? arg.split("=")[1] : argv[++i];
+      const value = numeric(raw, "--timeout");
+      if (typeof value !== "number")
+        return { error: { code: REVALIDATE_EXIT.USAGE, message: value.error } };
+      args.timeoutSeconds = Math.floor(value);
+    } else if (arg === "--if-older-than" || arg.startsWith("--if-older-than=")) {
+      const raw = arg.includes("=") ? arg.split("=")[1] : argv[++i];
+      const value = numeric(raw, "--if-older-than");
+      if (typeof value !== "number")
+        return { error: { code: REVALIDATE_EXIT.USAGE, message: value.error } };
+      args.minIntervalHours = value;
+    } else if (arg === "--spec" || arg.startsWith("--spec=")) {
+      const raw = arg.includes("=") ? arg.split("=")[1] : argv[++i];
+      if (raw === void 0) {
+        return { error: { code: REVALIDATE_EXIT.USAGE, message: "--spec requires a value" } };
+      }
+      args.only.push(
+        ...raw.split(",").map((s) => s.trim()).filter(Boolean)
+      );
+    } else if (arg.startsWith("-")) {
+      return { error: { code: REVALIDATE_EXIT.USAGE, message: `unknown flag: ${arg}` } };
+    } else {
+      return { error: { code: REVALIDATE_EXIT.USAGE, message: `unexpected argument: ${arg}` } };
+    }
+  }
+  return { args };
+}
+var REVALIDATE_HELP = [
+  "Usage:",
+  "  hs revalidate [--json] [--apply] [--spec <id>] [--concurrency N] [--timeout S]",
+  "                [--if-older-than H]",
+  "",
+  "Re-run the FROZEN checks of work already stamped `review_pending`/`in_review`",
+  "and report what has decayed since the stamp was earned",
+  "([[HS-R5LF-36QL-EPIC-stamped-work-is-re-verified-on-a]]).",
+  "",
+  "A stamp says 'these commands passed THEN'. Nothing else re-asserts it: a sweep",
+  "of 94 stamped tasks found 19 red and zero broken features \u2014 every red a stale",
+  "check, one of them red within a day of being audited clean by hand.",
+  "",
+  "The pass is read-only with respect to the repo: no git writes, no spec status",
+  "changes. Files a check mutates as a side effect are detected and named, never",
+  "reverted. The Resolution plan is printed and NOT executed unless --apply.",
+  "",
+  "Flags:",
+  "  --json              Machine-readable report.",
+  "  --apply             Execute the Resolution plan (file/update/close diagnose rows).",
+  "  --plan-only         Enumerate, dedupe and report coverage without running anything.",
+  "  --spec <id[,id]>    Sweep only these specs.",
+  "  --concurrency N     Commands in flight during the fan-out pass (default 3).",
+  "                      Re-confirmation of every red is always serial.",
+  "  --timeout S         Per-command timeout in seconds (default 420).",
+  "  --if-older-than H   No-op unless the last pass was more than H hours ago \u2014",
+  "                      lets a frequent timer drive a daily sweep.",
+  "  --help, -h          Show this help.",
+  "",
+  "Exit codes:",
+  "  0 clean \xB7 1 usage \xB7 10 nothing to sweep \xB7 20 decay found"
+].join("\n");
+
+// spex-console/src/lib/vault-frontmatter.ts
+var import_gray_matter2 = __toESM(require_gray_matter(), 1);
+
+// spex-console/src/lib/safe-yaml.ts
+var import_gray_matter = __toESM(require_gray_matter(), 1);
+import yaml2 from "js-yaml";
+var SAFE_YAML_SCHEMA = yaml2.DEFAULT_SAFE_SCHEMA ?? yaml2.DEFAULT_SCHEMA;
+var grayMatterYamlStringify = (() => {
+  const engine = import_gray_matter.default.engines?.yaml;
+  return typeof engine?.stringify === "function" ? engine.stringify : void 0;
+})();
+var YAML_FAILSAFE_SCHEMA = yaml2.FAILSAFE_SCHEMA;
+
+// spex-console/src/lib/vault-frontmatter.ts
+function parseSpecMarkdown(raw) {
+  return (0, import_gray_matter2.default)(raw);
+}
+
+// spex-console/bin/run-entry.ts
+import process2 from "node:process";
+var BinExit = class extends Error {
+  code;
+  constructor(code) {
+    super(`exit ${code}`);
+    this.name = "BinExit";
+    this.code = code;
+  }
+};
+function runEntry(name, main2, options2 = {}) {
+  const { fallbackCode = 1, unhandledLabel = "unhandled" } = options2;
+  void (async () => {
+    try {
+      await main2();
+    } catch (err) {
+      if (err instanceof BinExit) {
+        process2.exitCode = err.code;
+        return;
+      }
+      const message = err instanceof Error ? err.message : String(err);
+      process2.stderr.write(`${name}: ${unhandledLabel}: ${message}
+`);
+      process2.exitCode = fallbackCode;
+    }
+  })();
+}
+
+// spex-console/bin/hs-revalidate.ts
+var STATE_RELATIVE_PATH = path3.join(".tmp", "revalidate-state.json");
+function specFiles(specsDir) {
+  const out = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      const abs = path3.join(dir, entry.name);
+      if (entry.isDirectory()) walk(abs);
+      else if (entry.isFile() && entry.name.endsWith(".md")) out.push(abs);
+    }
+  };
+  if (existsSync6(specsDir)) walk(specsDir);
+  return out;
+}
+function readStampedSpecs(specsDir) {
+  const specs = [];
+  for (const file of specFiles(specsDir)) {
+    let raw;
+    try {
+      raw = readFileSync10(file, "utf-8");
+    } catch {
+      continue;
+    }
+    const head = raw.slice(0, 4e3);
+    if (!/status:\s*['"]?(review_pending|in_review)\b/.test(head)) continue;
+    let data;
+    try {
+      data = parseSpecMarkdown(raw).data ?? {};
+    } catch {
+      continue;
+    }
+    const id = typeof data.id === "string" ? data.id : null;
+    const status = typeof data.status === "string" ? data.status : "";
+    if (!id || !STAMPED_STATUSES.has(status)) continue;
+    specs.push({
+      id,
+      status,
+      title: typeof data.name === "string" ? data.name : id
+    });
+  }
+  return specs.sort((a, b) => a.id.localeCompare(b.id));
+}
+function readOpenDecayDiagnoses(specsDir) {
+  const dir = path3.join(specsDir, "diagnoses");
+  if (!existsSync6(dir)) return [];
+  const rows = [];
+  for (const entry of readdirSync2(dir)) {
+    if (!entry.endsWith(".md")) continue;
+    let data;
+    try {
+      data = parseSpecMarkdown(readFileSync10(path3.join(dir, entry), "utf-8")).data ?? {};
+    } catch {
+      continue;
+    }
+    const tags = Array.isArray(data.tags) ? data.tags.map(String) : [];
+    if (!tags.includes(DECAY_TAG)) continue;
+    const diagnoseId = typeof data.id === "string" ? data.id : null;
+    const status = typeof data.status === "string" ? data.status : "open";
+    if (!diagnoseId || !isDiagnoseOpen(status)) continue;
+    const related = Array.isArray(data.related) ? data.related.map(String) : [];
+    const subject = related.map((ref) => /^\[\[([^\]|#]+)/.exec(ref.trim())?.[1]?.trim()).find((ref) => Boolean(ref));
+    if (!subject) continue;
+    rows.push({ diagnoseId, subjectSpecId: subject.split("-").slice(0, 2).join("-"), status });
+  }
+  return rows;
+}
+var sha = (buf) => createHash("sha256").update(buf).digest("hex");
+var normalize = (text) => text.replace(/\r\n/g, "\n");
+function dirtyPaths(repoRoot) {
+  const res = spawnSync("git", ["status", "--porcelain"], {
+    cwd: repoRoot,
+    encoding: "utf-8",
+    windowsHide: true,
+    maxBuffer: 32 * 1024 * 1024
+  });
+  if (res.status !== 0 || typeof res.stdout !== "string") return [];
+  return res.stdout.split(/\r?\n/).map((line) => line.slice(3).trim()).filter(Boolean).map((entry) => entry.includes(" -> ") ? entry.split(" -> ")[1] : entry).map((entry) => entry.replace(/^"(.*)"$/, "$1"));
+}
+function hashFile(repoRoot, rel) {
+  const abs = path3.join(repoRoot, rel);
+  try {
+    if (!existsSync6(abs) || !statSync4(abs).isFile()) return null;
+    const raw = readFileSync10(abs);
+    return { path: rel, sha: sha(raw), normalizedSha: sha(normalize(raw.toString("utf-8"))) };
+  } catch {
+    return null;
+  }
+}
+function hashFromHead(repoRoot, rel) {
+  const res = spawnSync("git", ["show", `HEAD:${rel}`], {
+    cwd: repoRoot,
+    encoding: "buffer",
+    windowsHide: true,
+    maxBuffer: 32 * 1024 * 1024
+  });
+  if (res.status !== 0 || !res.stdout) return null;
+  const raw = res.stdout;
+  return { path: rel, sha: sha(raw), normalizedSha: sha(normalize(raw.toString("utf-8"))) };
+}
+var VAULT_PATH_PREFIX = "vault:";
+function snapshotRoots(roots) {
+  const vault = roots.vaultRoot ?? roots.repoRoot;
+  const code = { root: roots.repoRoot, prefix: "" };
+  return vault === roots.repoRoot ? [code] : [code, { root: vault, prefix: VAULT_PATH_PREFIX }];
+}
+function snapshot(entry) {
+  const paths = dirtyPaths(entry.root);
+  const files = [];
+  for (const rel of paths) {
+    const file = hashFile(entry.root, rel);
+    if (file) files.push({ ...file, path: `${entry.prefix}${rel}` });
+  }
+  return { paths, files };
+}
+var cachedPosixShell;
+function resolveWindowsPosixShell() {
+  if (cachedPosixShell !== void 0) return cachedPosixShell;
+  const candidates = [
+    process3.env.HEYSPEX_CHECK_SHELL,
+    "C:\\Program Files\\Git\\bin\\bash.exe"
+  ].filter((c) => typeof c === "string" && c.length > 0);
+  for (const candidate of candidates) {
+    if (existsSync6(candidate)) return cachedPosixShell = candidate;
+  }
+  const where = spawnSync("where", ["bash"], { encoding: "utf8", windowsHide: true });
+  if (where.status === 0 && where.stdout) {
+    const hit = where.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).find((line) => !/\\system32\\/i.test(line));
+    if (hit && existsSync6(hit)) return cachedPosixShell = hit;
+  }
+  return cachedPosixShell = null;
+}
+var MISSING_BINARY_RE = /command not found|is not recognized as an internal or external command/i;
+var countTscErrors = (output) => (output.match(/error TS\d+/g) ?? []).length;
+function runOnce(run, cwd, timeoutSeconds) {
+  return new Promise((resolve5) => {
+    const started = Date.now();
+    const posixShell = process3.platform === "win32" ? resolveWindowsPosixShell() : null;
+    const child = posixShell ? spawn(posixShell, ["-lc", run], {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    }) : spawn(run, { shell: true, cwd, stdio: ["ignore", "pipe", "pipe"] });
+    let captured = "";
+    const collect = (chunk) => {
+      if (captured.length < 2e5) captured += chunk.toString();
+    };
+    child.stdout?.on("data", collect);
+    child.stderr?.on("data", collect);
+    let settled = false;
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve5(outcome);
+    };
+    const timer = setTimeout(() => {
+      child.kill();
+      finish({
+        exitCode: 124,
+        durationMs: Date.now() - started,
+        message: `timed out after ${timeoutSeconds}s`
+      });
+    }, timeoutSeconds * 1e3);
+    child.on(
+      "error",
+      (err) => finish({ exitCode: -1, durationMs: Date.now() - started, message: err.message })
+    );
+    child.on("close", (code) => {
+      const durationMs = Date.now() - started;
+      let exitCode = code ?? -1;
+      const missingBinary = exitCode === 0 && MISSING_BINARY_RE.test(captured);
+      if (missingBinary) exitCode = 127;
+      const trimmed = captured.trim();
+      finish({
+        exitCode,
+        durationMs,
+        errorCount: countTscErrors(captured),
+        // HS-IRCO: feed the same zero-match detection `hs check run` uses —
+        // this sweep re-verifies the same frozen manifests through the same
+        // shared `evaluateCheck`, so a "Passed: 0" / "No test files found"
+        // false-green must be caught here too, not only on first verify.
+        rawOutput: captured,
+        ...exitCode === 0 ? {} : {
+          message: missingBinary ? "errored, not ok \u2014 shell reported a missing binary" : trimmed.split("\n").slice(-3).join(" ").slice(0, 400) || `command exited ${exitCode}`
+        }
+      });
+    });
+  });
+}
+async function runCommand(command, roots, timeoutSeconds) {
+  const probe = command.uses[0].check;
+  const attempts = [];
+  for (const cwd of resolveCheckCwds(probe, roots)) {
+    const outcome = await runOnce(command.run, cwd, timeoutSeconds);
+    attempts.push({ cwd, outcome });
+    if (outcome.exitCode === 0) break;
+  }
+  return pickAttempt(attempts);
+}
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+    for (; ; ) {
+      const index = next++;
+      if (index >= items.length) return;
+      results[index] = await fn(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+function readState(statePath) {
+  try {
+    const parsed = JSON.parse(readFileSync10(statePath, "utf-8"));
+    return {
+      lastRunAt: typeof parsed.lastRunAt === "string" ? parsed.lastRunAt : null,
+      noWin: typeof parsed.noWin === "object" && parsed.noWin !== null ? parsed.noWin : {}
+    };
+  } catch {
+    return EMPTY_SWEEP_STATE;
+  }
+}
+function writeState(statePath, state) {
+  try {
+    mkdirSync6(path3.dirname(statePath), { recursive: true });
+    writeFileSync6(statePath, `${JSON.stringify(state, null, 2)}
+`, "utf-8");
+  } catch (err) {
+    process3.stderr.write(
+      `hs revalidate: could not persist state (${err instanceof Error ? err.message : String(err)}).
+`
+    );
+  }
+}
+async function main() {
+  const vaultRoot = process3.env.HS_VAULT_ROOT;
+  if (!vaultRoot) {
+    process3.stderr.write(
+      "hs revalidate: HS_VAULT_ROOT is not set (the dispatcher must resolve and pass it).\n"
+    );
+    process3.exitCode = REVALIDATE_EXIT.USAGE;
+    return;
+  }
+  const parsed = parseRevalidateArgs(process3.argv.slice(3));
+  if (parsed.help) {
+    process3.stdout.write(`${REVALIDATE_HELP}
+`);
+    process3.exitCode = REVALIDATE_EXIT.OK;
+    return;
+  }
+  if (parsed.error) {
+    process3.stderr.write(`hs revalidate: ${parsed.error.message}
+`);
+    process3.exitCode = parsed.error.code;
+    return;
+  }
+  const args = parsed.args;
+  const codeRoot = resolveCodeRoot({ vaultRoot });
+  const roots = {
+    repoRoot: codeRoot,
+    consoleRoot: path3.join(codeRoot, "spex-console"),
+    vaultRoot
+  };
+  const specsDir = path3.join(vaultRoot, "specs");
+  const statePath = path3.join(vaultRoot, STATE_RELATIVE_PATH);
+  const state = readState(statePath);
+  if (args.minIntervalHours !== null) {
+    const gate = shouldRunNow(state, /* @__PURE__ */ new Date(), args.minIntervalHours);
+    if (!gate.run) {
+      process3.stdout.write(
+        `hs revalidate: last pass was ${gate.hoursSinceLast?.toFixed(1)}h ago (< ${args.minIntervalHours}h) \u2014 skipping.
+`
+      );
+      process3.exitCode = REVALIDATE_EXIT.OK;
+      return;
+    }
+  }
+  const only = new Set(args.only);
+  const allStamped = readStampedSpecs(specsDir);
+  const stamped = only.size > 0 ? allStamped.filter((s) => only.has(s.id)) : allStamped;
+  const manifestPath = (id) => path3.join(specsDir, "checks", `${id}.checks.json`);
+  const checkable = [];
+  const uncovered = [];
+  for (const spec of stamped)
+    (existsSync6(manifestPath(spec.id)) ? checkable : uncovered).push(spec);
+  if (checkable.length === 0) {
+    process3.stderr.write(
+      `hs revalidate: nothing to sweep \u2014 none of the ${stamped.length} stamped spec(s) has a frozen manifest.
+`
+    );
+    process3.exitCode = REVALIDATE_EXIT.NOT_FOUND;
+    return;
+  }
+  const loaded = checkable.map(
+    (spec) => loadSweepManifest(spec, readFileSync10(manifestPath(spec.id), "utf-8"))
+  );
+  const plan = planCommands(loaded);
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const startedMs = Date.now();
+  process3.stderr.write(
+    `hs revalidate: ${checkable.length} stamped spec(s) with a manifest \xB7 ${plan.checkInstances} check instances \u2192 ${plan.commands.length} distinct commands
+`
+  );
+  if (args.planOnly) {
+    const unusable = loaded.filter((entry) => !entry.manifest);
+    const coverage = computeCoverage({
+      stamped: stamped.length,
+      checkable: loaded.length - unusable.length,
+      uncovered: uncovered.length,
+      unparsable: unusable.length
+    });
+    const noWinCount = plan.commands.filter((c) => c.noWin).length;
+    const payload = {
+      coverage,
+      checkInstances: plan.checkInstances,
+      distinctCommands: plan.commands.length,
+      declaredCwd: plan.commands.filter((c) => c.cwd !== null).length,
+      noWinCommands: noWinCount,
+      unusable: unusable.map((entry) => ({ spec: entry.spec.id, error: entry.error }))
+    };
+    process3.stdout.write(
+      args.json ? `${JSON.stringify(payload, null, 2)}
+` : [
+        `Plan only \u2014 nothing was executed.`,
+        `Coverage: ${coverage.checkable}/${coverage.stamped} stamped specs checkable (${coverage.percent}%) \xB7 ${coverage.uncovered} have no manifest \xB7 ${coverage.unparsable} manifest unusable`,
+        `Commands: ${plan.checkInstances} check instances \u2192 ${plan.commands.length} distinct`,
+        `Working dirs: ${payload.declaredCwd} declare a cwd \xB7 ${plan.commands.length - payload.declaredCwd} would try both roots`,
+        `no-win commands: ${noWinCount}`,
+        ...unusable.map((entry) => `  unusable ${entry.spec.id}: ${entry.error}`)
+      ].join("\n") + "\n"
+    );
+    process3.exitCode = REVALIDATE_EXIT.OK;
+    return;
+  }
+  const watched = snapshotRoots(roots);
+  const before = watched.flatMap((entry) => snapshot(entry).files);
+  const attempts = await mapWithConcurrency(
+    plan.commands,
+    args.concurrency,
+    (command) => runCommand(command, roots, args.timeoutSeconds)
+  );
+  const outcomes = /* @__PURE__ */ new Map();
+  const resolvedCwds = /* @__PURE__ */ new Map();
+  const parallelismArtifacts = /* @__PURE__ */ new Set();
+  const suspect = plan.commands.map((command, index) => ({ command, attempt: attempts[index] })).filter(({ attempt }) => needsSerialConfirmation(attempt.outcome));
+  if (suspect.length > 0) {
+    process3.stderr.write(
+      `hs revalidate: ${suspect.length} non-zero result(s) \u2014 re-running each serially before believing it
+`
+    );
+  }
+  const confirmations = /* @__PURE__ */ new Map();
+  for (const { command } of suspect) {
+    confirmations.set(command.key, await runCommand(command, roots, args.timeoutSeconds));
+  }
+  plan.commands.forEach((command, index) => {
+    const parallel = attempts[index];
+    const confirmation = confirmations.get(command.key);
+    const resolved = resolveExecution(parallel.outcome, confirmation?.outcome);
+    outcomes.set(command.key, resolved.outcome);
+    resolvedCwds.set(command.key, (confirmation ?? parallel).cwd);
+    if (resolved.parallelismArtifact) parallelismArtifacts.add(command.key);
+  });
+  const beforePaths = new Set(before.map((f) => f.path));
+  const after = [];
+  for (const entry of watched) {
+    const snap = snapshot(entry);
+    after.push(...snap.files);
+    const afterByPath = new Set(snap.files.map((f) => f.path));
+    for (const rel of snap.paths) {
+      const labelled = `${entry.prefix}${rel}`;
+      if (beforePaths.has(labelled) || !afterByPath.has(labelled)) continue;
+      const head = hashFromHead(entry.root, rel);
+      if (head) before.push({ ...head, path: labelled });
+    }
+  }
+  const sideEffects = detectSideEffects(before, after);
+  const recorded = recordNoWin(state, plan.commands, startedAt);
+  const report = await buildSweepReport({
+    startedAt,
+    loaded,
+    uncovered,
+    plan,
+    outcomes,
+    parallelismArtifacts,
+    resolvedCwds,
+    noWinItems: recorded.items,
+    sideEffects,
+    // A `--spec`-scoped pass reconciles ONLY the rows it actually re-ran; the
+    // lane's other rows were never checked, so closing them would be a false green.
+    openDiagnoses: scopeOpenDiagnoses(readOpenDecayDiagnoses(specsDir), args.only),
+    durationMs: Date.now() - startedMs
+  });
+  if (args.apply && report.reconciliation.length > 0) {
+    const consoleUrl = resolveSpexConsoleUrl(vaultRoot, (p) => {
+      try {
+        return readFileSync10(p, "utf-8");
+      } catch {
+        return null;
+      }
+    });
+    const scoped = resolveControlScopeFromMachine(vaultRoot);
+    if (!scoped.ok) {
+      process3.stderr.write(
+        `hs revalidate: Resolution actions not applied \u2014 ${scoped.error.message}
+`
+      );
+    } else {
+      report.applied = await applyReconciliation(
+        report.reconciliation,
+        makeDiagnoseWriter({ fetchImpl: fetch, consoleUrl, scope: scoped.scope })
+      );
+      const failed = report.applied.filter((a) => !a.ok);
+      if (failed.length > 0) {
+        process3.stderr.write(
+          `hs revalidate: ${failed.length} Resolution action(s) failed \u2014 ${failed[0].error ?? "unknown"}
+`
+        );
+      }
+    }
+  }
+  const sink = report.redCount === 0 ? process3.stdout : process3.stderr;
+  sink.write(
+    args.json ? `${JSON.stringify(sweepReportToJson(report), null, 2)}
+` : `${formatSweepReport(report)}
+`
+  );
+  writeState(statePath, recorded.state);
+  process3.exitCode = sweepExitCode(report);
+  closeIdleConnections();
+}
+function closeIdleConnections() {
+  try {
+    const dispatcher = globalThis[Symbol.for("undici.globalDispatcher.1")];
+    void dispatcher?.destroy?.();
+  } catch {
+  }
+}
+runEntry("hs revalidate", main, { fallbackCode: REVALIDATE_EXIT.USAGE });