@devrouter/cli 0.0.1

package/dist/dev.js

@@ -0,0 +1,2772 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/core/repo-config.ts
+function ensureObject(value, pathLabel) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${pathLabel} must be an object.`);
+  }
+  return value;
+}
+function ensureAllowedKeys(value, allowedKeys, pathLabel) {
+  const allowed = new Set(allowedKeys);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) {
+      throw new Error(`${pathLabel}.${key} is not supported.`);
+    }
+  }
+}
+function toStringOrThrow(value, pathLabel) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(`${pathLabel} must be a non-empty string.`);
+  }
+  return value.trim();
+}
+function toStringArray(value, pathLabel) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    throw new Error(`${pathLabel} must be an array of strings.`);
+  }
+  return value.map((item, index) => toStringOrThrow(item, `${pathLabel}[${index}]`));
+}
+function toIntegerOrThrow(value, pathLabel) {
+  const numberValue = Number(value);
+  if (!Number.isInteger(numberValue) || numberValue <= 0) {
+    throw new Error(`${pathLabel} must be a positive integer.`);
+  }
+  return numberValue;
+}
+function parseDependencies(value, pathLabel) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    throw new Error(`${pathLabel} must be an array.`);
+  }
+  return value.map((entry, index) => {
+    const objectValue = ensureObject(entry, `${pathLabel}[${index}]`);
+    ensureAllowedKeys(objectValue, ["app"], `${pathLabel}[${index}]`);
+    return { app: toStringOrThrow(objectValue.app, `${pathLabel}[${index}].app`) };
+  });
+}
+function parseHostStrategy(value, pathLabel) {
+  if (value === void 0) {
+    return { ...DEFAULT_HOST_STRATEGY };
+  }
+  const objectValue = ensureObject(value, pathLabel);
+  ensureAllowedKeys(objectValue, ["type", "denyPorts", "allowPortRange"], pathLabel);
+  const type = toStringOrThrow(objectValue.type ?? "auto", `${pathLabel}.type`);
+  if (type !== "auto") {
+    throw new Error(`${pathLabel}.type must be 'auto'.`);
+  }
+  let denyPorts = [...DEFAULT_HOST_STRATEGY.denyPorts];
+  if (objectValue.denyPorts !== void 0) {
+    if (!Array.isArray(objectValue.denyPorts)) {
+      throw new Error(`${pathLabel}.denyPorts must be an array.`);
+    }
+    denyPorts = objectValue.denyPorts.map(
+      (entry, index) => toIntegerOrThrow(entry, `${pathLabel}.denyPorts[${index}]`)
+    );
+  }
+  const allowPortRange = objectValue.allowPortRange === void 0 ? DEFAULT_HOST_STRATEGY.allowPortRange : toStringOrThrow(objectValue.allowPortRange, `${pathLabel}.allowPortRange`);
+  return {
+    type: "auto",
+    denyPorts,
+    allowPortRange
+  };
+}
+function parseDockerConfig(value, pathLabel) {
+  const objectValue = ensureObject(value, pathLabel);
+  ensureAllowedKeys(objectValue, ["service", "internalPort", "composeFiles", "router"], pathLabel);
+  const composeFiles = toStringArray(objectValue.composeFiles, `${pathLabel}.composeFiles`);
+  return {
+    service: toStringOrThrow(objectValue.service, `${pathLabel}.service`),
+    internalPort: toIntegerOrThrow(objectValue.internalPort, `${pathLabel}.internalPort`),
+    composeFiles: composeFiles.length > 0 ? composeFiles : ["docker-compose.yml"],
+    router: objectValue.router === void 0 ? void 0 : toStringOrThrow(objectValue.router, `${pathLabel}.router`)
+  };
+}
+function parseApp(value, index) {
+  const pathLabel = `apps[${index}]`;
+  const objectValue = ensureObject(value, pathLabel);
+  ensureAllowedKeys(
+    objectValue,
+    ["name", "host", "protocol", "runtime", "hostRun", "docker", "tcpProtocol", "dependencies"],
+    pathLabel
+  );
+  const name = toStringOrThrow(objectValue.name, `${pathLabel}.name`);
+  const host = toStringOrThrow(objectValue.host, `${pathLabel}.host`).toLowerCase();
+  if (!host.endsWith(".localhost")) {
+    throw new Error(`${pathLabel}.host must end with .localhost.`);
+  }
+  if (!VALID_HOSTNAME_RE.test(host)) {
+    throw new Error(`${pathLabel}.host contains invalid characters. Only lowercase alphanumerics and hyphens are allowed.`);
+  }
+  const protocol = toStringOrThrow(objectValue.protocol, `${pathLabel}.protocol`);
+  const runtime = toStringOrThrow(objectValue.runtime, `${pathLabel}.runtime`);
+  const dependencies = parseDependencies(objectValue.dependencies, `${pathLabel}.dependencies`);
+  if (runtime === "host") {
+    if (protocol !== "http") {
+      throw new Error(`${pathLabel}: host runtime currently supports only protocol=http.`);
+    }
+    const hostRun = ensureObject(objectValue.hostRun, `${pathLabel}.hostRun`);
+    ensureAllowedKeys(hostRun, ["command", "cwd", "strategy"], `${pathLabel}.hostRun`);
+    const command = toStringOrThrow(hostRun.command, `${pathLabel}.hostRun.command`);
+    if (command.length > MAX_COMMAND_LENGTH) {
+      throw new Error(`${pathLabel}.hostRun.command exceeds maximum length of ${MAX_COMMAND_LENGTH} characters.`);
+    }
+    return {
+      name,
+      host,
+      protocol: "http",
+      runtime: "host",
+      dependencies,
+      hostRun: {
+        command,
+        cwd: hostRun.cwd === void 0 ? "." : toStringOrThrow(hostRun.cwd, `${pathLabel}.hostRun.cwd`),
+        strategy: parseHostStrategy(hostRun.strategy, `${pathLabel}.hostRun.strategy`)
+      }
+    };
+  }
+  if (runtime === "docker") {
+    const docker = parseDockerConfig(objectValue.docker, `${pathLabel}.docker`);
+    if (protocol === "http") {
+      return {
+        name,
+        host,
+        protocol: "http",
+        runtime: "docker",
+        dependencies,
+        docker
+      };
+    }
+    if (protocol === "tcp") {
+      const tcpProtocol = toStringOrThrow(objectValue.tcpProtocol, `${pathLabel}.tcpProtocol`);
+      if (tcpProtocol !== "postgres") {
+        throw new Error(`${pathLabel}.tcpProtocol must be 'postgres' for protocol=tcp.`);
+      }
+      return {
+        name,
+        host,
+        protocol: "tcp",
+        tcpProtocol: "postgres",
+        runtime: "docker",
+        dependencies,
+        docker
+      };
+    }
+  }
+  throw new Error(`${pathLabel} has unsupported protocol/runtime combination.`);
+}
+function parseConfig(raw, configPath) {
+  const root = ensureObject(raw, configPath);
+  ensureAllowedKeys(root, ["version", "project", "apps"], configPath);
+  const version = toIntegerOrThrow(root.version, `${configPath}.version`);
+  if (version !== 1) {
+    throw new Error(`${configPath}.version must be 1.`);
+  }
+  if (root.project !== void 0) {
+    const project = ensureObject(root.project, `${configPath}.project`);
+    ensureAllowedKeys(project, ["name"], `${configPath}.project`);
+    if (project.name !== void 0 && typeof project.name !== "string") {
+      throw new Error(`${configPath}.project.name must be a string.`);
+    }
+  }
+  if (!Array.isArray(root.apps)) {
+    throw new Error(`${configPath}.apps must be an array.`);
+  }
+  const apps = root.apps.map((app, index) => parseApp(app, index));
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const app of apps) {
+    if (seenNames.has(app.name)) {
+      throw new Error(`${configPath}.apps has duplicate name '${app.name}'.`);
+    }
+    seenNames.add(app.name);
+  }
+  return {
+    version: 1,
+    project: root.project && typeof root.project === "object" ? { name: root.project.name } : void 0,
+    apps
+  };
+}
+function renderConfig(config) {
+  return import_yaml.default.stringify(config, { lineWidth: 0 });
+}
+function resolveRepoPath(repoPath) {
+  return import_node_path.default.resolve(repoPath ?? process.cwd());
+}
+function getRepoConfigPath(repoPath) {
+  return import_node_path.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+}
+function loadRepoConfig(repoPath) {
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const configPath = getRepoConfigPath(resolvedRepoPath);
+  if (!import_node_fs.default.existsSync(configPath)) {
+    throw new Error(
+      `Missing ${CONFIG_FILE_NAME} in ${resolvedRepoPath}. Run 'dev repo init --repo ${resolvedRepoPath}' first.`
+    );
+  }
+  const raw = import_node_fs.default.readFileSync(configPath, "utf-8");
+  const parsed = import_yaml.default.parse(raw);
+  return parseConfig(parsed ?? {}, configPath);
+}
+function saveRepoConfig(repoPath, config) {
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const configPath = getRepoConfigPath(resolvedRepoPath);
+  const validated = parseConfig(config, configPath);
+  import_node_fs.default.writeFileSync(configPath, renderConfig(validated), "utf-8");
+}
+function initRepoConfig(repoPath) {
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const configPath = getRepoConfigPath(resolvedRepoPath);
+  if (import_node_fs.default.existsSync(configPath)) {
+    return { repoPath: resolvedRepoPath, configPath, created: false };
+  }
+  const initialConfig = {
+    version: 1,
+    project: {
+      name: import_node_path.default.basename(resolvedRepoPath)
+    },
+    apps: []
+  };
+  import_node_fs.default.writeFileSync(configPath, renderConfig(initialConfig), "utf-8");
+  return { repoPath: resolvedRepoPath, configPath, created: true };
+}
+function buildAppFromOptions(options) {
+  const host = options.host.toLowerCase();
+  if (!host.endsWith(".localhost")) {
+    throw new Error("--host must end with .localhost");
+  }
+  if (!VALID_HOSTNAME_RE.test(host)) {
+    throw new Error("--host contains invalid characters. Only lowercase alphanumerics and hyphens are allowed.");
+  }
+  const dependencies = options.dependsOn.map((app) => ({ app }));
+  if (options.runtime === "host") {
+    if (options.protocol !== "http") {
+      throw new Error("--runtime host currently supports only --protocol http");
+    }
+    if (!options.command) {
+      throw new Error("--command is required when --runtime host");
+    }
+    return {
+      name: options.name,
+      host,
+      protocol: "http",
+      runtime: "host",
+      dependencies,
+      hostRun: {
+        command: options.command,
+        cwd: options.cwd ?? ".",
+        strategy: { ...DEFAULT_HOST_STRATEGY }
+      }
+    };
+  }
+  if (!options.service) {
+    throw new Error("--service is required when --runtime docker");
+  }
+  if (!options.port || !Number.isInteger(options.port) || options.port <= 0) {
+    throw new Error("--port must be a positive integer when --runtime docker");
+  }
+  const docker = {
+    service: options.service,
+    internalPort: options.port,
+    composeFiles: options.composeFiles.length > 0 ? options.composeFiles : ["docker-compose.yml"],
+    router: options.router
+  };
+  if (options.protocol === "http") {
+    return {
+      name: options.name,
+      host,
+      protocol: "http",
+      runtime: "docker",
+      dependencies,
+      docker
+    };
+  }
+  const tcpProtocol = options.tcpProtocol ?? "postgres";
+  if (tcpProtocol !== "postgres") {
+    throw new Error("--tcp-protocol must be postgres for --protocol tcp");
+  }
+  return {
+    name: options.name,
+    host,
+    protocol: "tcp",
+    tcpProtocol: "postgres",
+    runtime: "docker",
+    dependencies,
+    docker
+  };
+}
+function upsertRepoApp(repoPath, options) {
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const config = loadRepoConfig(resolvedRepoPath);
+  const app = buildAppFromOptions(options);
+  const apps = config.apps.filter((existing) => existing.name !== app.name);
+  apps.push(app);
+  apps.sort((a, b) => a.name.localeCompare(b.name));
+  const next = {
+    ...config,
+    apps
+  };
+  saveRepoConfig(resolvedRepoPath, next);
+  return {
+    configPath: getRepoConfigPath(resolvedRepoPath),
+    app
+  };
+}
+function removeRepoApp(repoPath, name) {
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const config = loadRepoConfig(resolvedRepoPath);
+  const apps = config.apps.filter((app) => app.name !== name);
+  const removed = apps.length !== config.apps.length;
+  if (!removed) {
+    return {
+      configPath: getRepoConfigPath(resolvedRepoPath),
+      removed: false
+    };
+  }
+  saveRepoConfig(resolvedRepoPath, {
+    ...config,
+    apps
+  });
+  return {
+    configPath: getRepoConfigPath(resolvedRepoPath),
+    removed: true
+  };
+}
+function resolveAppByName(repoPath, name) {
+  const config = loadRepoConfig(repoPath);
+  const app = config.apps.find((entry) => entry.name === name);
+  if (!app) {
+    const available = config.apps.map((entry) => entry.name).join(", ");
+    throw new Error(`App '${name}' not found in ${getRepoConfigPath(repoPath)}. Available: ${available || "(none)"}`);
+  }
+  return { config, app };
+}
+function resolveAppDependencies(config, app) {
+  const results = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visiting = /* @__PURE__ */ new Set([app.name]);
+  const byName = new Map(config.apps.map((entry) => [entry.name, entry]));
+  const visit = (name, chain) => {
+    if (visiting.has(name)) {
+      throw new Error(`Dependency cycle detected: ${[...chain, name].join(" -> ")}`);
+    }
+    if (seen.has(name)) {
+      return;
+    }
+    visiting.add(name);
+    const dependency = byName.get(name);
+    if (!dependency) {
+      throw new Error(`Dependency '${name}' referenced by '${app.name}' does not exist in config.`);
+    }
+    results.push(dependency);
+    for (const nested of dependency.dependencies) {
+      visit(nested.app, [...chain, name]);
+    }
+    visiting.delete(name);
+    seen.add(name);
+  };
+  for (const dependency of app.dependencies) {
+    visit(dependency.app, [app.name]);
+  }
+  return results;
+}
+var import_node_fs, import_node_path, import_yaml, CONFIG_FILE_NAME, VALID_HOSTNAME_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY;
+var init_repo_config = __esm({
+  "src/core/repo-config.ts"() {
+    "use strict";
+    import_node_fs = __toESM(require("fs"));
+    import_node_path = __toESM(require("path"));
+    import_yaml = __toESM(require("yaml"));
+    CONFIG_FILE_NAME = ".devrouter.yml";
+    VALID_HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\.localhost$/;
+    MAX_COMMAND_LENGTH = 4096;
+    DEFAULT_HOST_STRATEGY = {
+      type: "auto",
+      denyPorts: [80, 443, 5432],
+      allowPortRange: "1024-65535"
+    };
+  }
+});
+
+// src/core/ai-prompt.ts
+function normalizeEntriesJson(input2) {
+  if (!input2) {
+    return "<JSON_ARRAY_OF_APP_ENTRIES>";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(input2);
+  } catch {
+    throw new Error("--entries-json must be valid JSON.");
+  }
+  if (!Array.isArray(parsed)) {
+    throw new Error("--entries-json must be a JSON array.");
+  }
+  return JSON.stringify(parsed);
+}
+function renderCommandIntentSection() {
+  const lines = COMMAND_INTENTS.map((entry) => `- ${entry.command}: ${entry.purpose}`);
+  return ["Command intent reference:", ...lines].join("\n");
+}
+function buildOnboardingPrompt(options = {}) {
+  const repoPath = resolveRepoPath(options.repo);
+  const entriesJson = normalizeEntriesJson(options.entriesJson);
+  return [
+    "You are adapting an existing repository to devrouter using the unified .devrouter.yml model.",
+    "",
+    "Objective:",
+    "- Configure stable local hostnames (*.localhost) for app/database access through the shared devrouter.",
+    "- Avoid manual/random host ports for app access.",
+    "- Keep repo changes minimal, explicit, and reproducible.",
+    "",
+    "How devrouter works (must respect):",
+    "- Shared Traefik router owns host ports 80 (HTTP), 443 (HTTPS), and 5432 (Postgres TCP).",
+    "- Per-repo source of truth is REPO_PATH/.devrouter.yml only.",
+    "- Global generated/runtime artifacts are managed under ~/.config/devrouter (do not edit these manually).",
+    "",
+    "Inputs:",
+    `- REPO_PATH=${repoPath}`,
+    `- ENTRIES_JSON=${entriesJson}`,
+    "",
+    "Entry schema (each object):",
+    "- name: string (unique in repo)",
+    "- host: <name>.localhost",
+    '- protocol: "http" | "tcp"',
+    '- runtime: "host" | "docker"',
+    '- dependencies: [{ app: "<name>" }] (optional)',
+    "- if runtime=host:",
+    "  - hostRun.command: string",
+    "  - hostRun.cwd: string",
+    '  - hostRun.strategy.type: "auto"',
+    "  - hostRun.strategy.denyPorts: [80, 443, 5432]",
+    '  - hostRun.strategy.allowPortRange: "1024-65535"',
+    "- if runtime=docker:",
+    "  - docker.service: string",
+    "  - docker.internalPort: number",
+    "  - docker.composeFiles: string[]",
+    "  - optional docker.router: string",
+    "- if protocol=tcp:",
+    '  - tcpProtocol: "postgres"',
+    "",
+    "Validation rules to enforce:",
+    "- host must end with .localhost",
+    "- runtime=host supports protocol=http only",
+    "- protocol=tcp requires runtime=docker and tcpProtocol=postgres",
+    "- unknown keys are not allowed (strict schema)",
+    "",
+    "Runtime behavior to account for:",
+    "- Docker dependencies can be auto-started by dev app run.",
+    "- Host-runtime dependencies are NOT auto-started in v1 (must be started manually).",
+    "- Postgres multiplexing on shared :5432 requires TLS/SNI.",
+    "- For TCP/Postgres, expect clients to use sslmode=require (or stricter).",
+    "",
+    "Required workflow:",
+    "1) Inspect repository structure first (compose files, scripts, app folders, existing dev docs).",
+    "2) Create/update only REPO_PATH/.devrouter.yml.",
+    "3) Keep edits minimal and idempotent.",
+    "4) Do not modify unrelated files/services.",
+    "5) If required info is missing or ambiguous, stop and ask targeted questions.",
+    "",
+    "Validation commands to run/report:",
+    "- dev app ls --repo <REPO_PATH>",
+    "- For each entry (when safe): dev app run <name> --repo <REPO_PATH> --yes",
+    "- dev doctor --repo <REPO_PATH> --json",
+    "- dev ls",
+    "- For HTTP entries: curl -I http://<host>",
+    '- For TCP postgres entries: provide connection hint (example: psql "... sslmode=require")',
+    "",
+    "Output format (strict):",
+    "1) Repository structure summary relevant to routing.",
+    "2) Proposed app mapping (name/host/protocol/runtime/deps) with assumptions.",
+    "3) Exact file changes made to .devrouter.yml.",
+    "4) Concise diff summary.",
+    "5) Validation commands run + key outputs.",
+    "6) Unresolved questions/risks (if any).",
+    "7) Definition-of-done checklist status:",
+    "   - .devrouter.yml exists and validates",
+    "   - dev app ls matches expected entries",
+    "   - dev ls exposes expected endpoints",
+    "   - HTTP routes reachable",
+    "   - TCP Postgres route configured with TLS requirement noted",
+    "",
+    renderCommandIntentSection()
+  ].join("\n");
+}
+var COMMAND_INTENTS;
+var init_ai_prompt = __esm({
+  "src/core/ai-prompt.ts"() {
+    "use strict";
+    init_repo_config();
+    COMMAND_INTENTS = [
+      { command: "dev init", purpose: "Print the AI onboarding prompt template for a repository." },
+      { command: "dev up", purpose: "Start shared Traefik and ensure the shared devnet network." },
+      { command: "dev down", purpose: "Stop the shared Traefik router stack." },
+      { command: "dev status", purpose: "Show router/container/network/TLS health and bound ports." },
+      { command: "dev doctor", purpose: "Run deep diagnostics across global router state and repo config." },
+      { command: "dev ls", purpose: "List active HTTP and TCP routes resolved by devrouter." },
+      { command: "dev open <name>", purpose: "Open HTTP routes or print connection hints for TCP routes." },
+      { command: "dev tls install", purpose: "Install mkcert certs and enable TLS/HTTPS for local routing." },
+      { command: "dev repo init", purpose: "Create `.devrouter.yml` in a target repository." },
+      { command: "dev app add", purpose: "Add or update one app entry in `.devrouter.yml`." },
+      { command: "dev app ls", purpose: "List app entries from `.devrouter.yml`." },
+      { command: "dev app run", purpose: "Run one configured app and reconcile its route at runtime." },
+      { command: "dev app rm", purpose: "Remove one app entry from `.devrouter.yml`." }
+    ];
+  }
+});
+
+// src/util/timeago.ts
+function formatAge(createdAtSeconds) {
+  const ageMs = Date.now() - createdAtSeconds * 1e3;
+  if (ageMs < 0) {
+    return "0s";
+  }
+  const seconds = Math.floor(ageMs / 1e3);
+  if (seconds < 60) {
+    return `${seconds}s`;
+  }
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) {
+    return `${minutes}m`;
+  }
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) {
+    return `${hours}h`;
+  }
+  const days = Math.floor(hours / 24);
+  return `${days}d`;
+}
+var init_timeago = __esm({
+  "src/util/timeago.ts"() {
+    "use strict";
+  }
+});
+
+// src/util/table.ts
+function pad(value, width) {
+  if (value.length >= width) {
+    return value;
+  }
+  return value + " ".repeat(width - value.length);
+}
+function renderTable(headers, rows) {
+  if (headers.length === 0) {
+    return "";
+  }
+  const widths = headers.map((header, index) => {
+    const rowWidth = rows.reduce((max, row) => {
+      const cell = row[index] ?? "";
+      return Math.max(max, cell.length);
+    }, 0);
+    return Math.max(header.length, rowWidth);
+  });
+  const headerLine = headers.map((header, idx) => pad(header, widths[idx])).join("  ");
+  const separator = widths.map((w) => "-".repeat(w)).join("  ");
+  const body = rows.map((row) => row.map((cell, idx) => pad(cell ?? "", widths[idx])).join("  ")).join("\n");
+  if (!body) {
+    return `${headerLine}
+${separator}`;
+  }
+  return `${headerLine}
+${separator}
+${body}`;
+}
+var init_table = __esm({
+  "src/util/table.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/output.ts
+function printJSON(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function printStatus(status) {
+  const rows = [
+    ["Docker context", status.dockerContext],
+    ["Router running", status.routerRunning ? "yes" : "no"],
+    ["Router container", status.routerContainerName],
+    ["Port 80 bound", status.boundPorts.web80 ? "yes" : "no"],
+    ["Port 443 bound", status.boundPorts.web443 ? "yes" : "no"],
+    ["Port 5432 bound", status.boundPorts.postgres5432 ? "yes" : "no"],
+    ["Dashboard 8080 bound", status.boundPorts.dashboard8080 ? "yes" : "no"],
+    ["devnet exists", status.networkExists ? "yes" : "no"],
+    ["TLS configured", status.tlsConfigured ? "yes" : "no"],
+    ["TLS certs present", status.certPresent ? "yes" : "no"],
+    ["TLS enabled", status.tlsEnabled ? "yes" : "no"],
+    ["HTTP routing ready", status.insights.httpRoutingReady ? "yes" : "no"],
+    ["TCP routing ready", status.insights.tcpRoutingReady ? "yes" : "no"]
+  ];
+  if (status.repo) {
+    rows.push(["Repo path", status.repo.path]);
+    rows.push(["Repo config", status.repo.exists ? status.repo.configPath : "missing"]);
+    rows.push([
+      "Repo config valid",
+      status.repo.valid ? "yes" : `no (${status.repo.error ?? "validation failed"})`
+    ]);
+    rows.push(["Repo apps", String(status.repo.appCount)]);
+  }
+  process.stdout.write(`${renderTable(["FIELD", "VALUE"], rows)}
+`);
+  if (status.insights.nextSteps.length > 0) {
+    process.stdout.write("\nNext steps:\n");
+    for (const step of status.insights.nextSteps) {
+      process.stdout.write(`- ${step}
+`);
+    }
+  }
+}
+function printRoutes(routes, duplicateHosts) {
+  if (routes.length === 0) {
+    process.stdout.write("No routes found.\n");
+    return;
+  }
+  const rows = routes.slice().sort((a, b) => a.serviceName.localeCompare(b.serviceName) || a.source.localeCompare(b.source)).map((route) => [
+    route.serviceName,
+    route.projectName,
+    route.protocol,
+    route.urls.join(","),
+    route.health === "unknown" ? route.status : `${route.status}/${route.health}`,
+    formatAge(route.createdAt)
+  ]);
+  process.stdout.write(
+    `${renderTable(["NAME", "PROJECT", "PROTOCOL", "ENDPOINTS", "STATUS", "AGE"], rows)}
+`
+  );
+  if (duplicateHosts.length > 0) {
+    process.stdout.write(`
+Warning: duplicate hostnames detected: ${duplicateHosts.join(", ")}
+`);
+  }
+}
+function printConfigApps(repoPath, apps) {
+  if (apps.length === 0) {
+    process.stdout.write(`No apps configured in ${repoPath}.
+`);
+    return;
+  }
+  const rows = apps.slice().sort((a, b) => a.name.localeCompare(b.name)).map((app) => {
+    if (app.runtime === "host") {
+      return [
+        app.name,
+        app.protocol,
+        app.runtime,
+        app.host,
+        app.hostRun.command,
+        app.dependencies.map((dependency) => dependency.app).join(",")
+      ];
+    }
+    const protocol = app.protocol === "tcp" ? `tcp/${app.tcpProtocol}` : app.protocol;
+    return [
+      app.name,
+      protocol,
+      app.runtime,
+      app.host,
+      `${app.docker.service}:${app.docker.internalPort}`,
+      app.dependencies.map((dependency) => dependency.app).join(",")
+    ];
+  });
+  process.stdout.write(
+    `${renderTable(["NAME", "PROTOCOL", "RUNTIME", "HOST", "TARGET", "DEPS"], rows)}
+`
+  );
+}
+function printDoctorReport(report) {
+  const summaryRows = [
+    ["Generated", report.generatedAt],
+    ["Repo path", report.repoPath ?? "-"],
+    ["OK", String(report.summary.ok)],
+    ["WARN", String(report.summary.warn)],
+    ["ERROR", String(report.summary.error)]
+  ];
+  process.stdout.write(`${renderTable(["FIELD", "VALUE"], summaryRows)}
+
+`);
+  const rows = report.checks.map((check) => [
+    check.id,
+    check.level.toUpperCase(),
+    check.summary,
+    check.suggestion ?? "-"
+  ]);
+  process.stdout.write(
+    `${renderTable(["CHECK", "LEVEL", "SUMMARY", "SUGGESTION"], rows)}
+`
+  );
+  const detailedChecks = report.checks.filter((check) => check.details);
+  if (detailedChecks.length > 0) {
+    process.stdout.write("\nDetails:\n");
+    for (const check of detailedChecks) {
+      process.stdout.write(`- ${check.id}: ${check.details}
+`);
+    }
+  }
+  if (report.nextSteps.length > 0) {
+    process.stdout.write("\nRecommended next steps:\n");
+    for (const step of report.nextSteps) {
+      process.stdout.write(`- ${step}
+`);
+    }
+  }
+}
+var init_output = __esm({
+  "src/core/output.ts"() {
+    "use strict";
+    init_timeago();
+    init_table();
+  }
+});
+
+// src/commands/init.ts
+var init_exports = {};
+__export(init_exports, {
+  runInitCommand: () => runInitCommand
+});
+async function runInitCommand(options) {
+  const prompt = buildOnboardingPrompt({ repo: options.repo, entriesJson: options.entriesJson });
+  if (options.json) {
+    printJSON({
+      prompt,
+      commandIntents: COMMAND_INTENTS
+    });
+    return;
+  }
+  process.stdout.write(`${prompt}
+`);
+}
+var init_init = __esm({
+  "src/commands/init.ts"() {
+    "use strict";
+    init_ai_prompt();
+    init_output();
+  }
+});
+
+// src/core/docker.ts
+async function getDockerodeConstructor() {
+  if (!dockerodeConstructorPromise) {
+    dockerodeConstructorPromise = import("dockerode").then((module2) => {
+      const maybeDefault = module2;
+      return maybeDefault.default ?? module2;
+    });
+  }
+  return dockerodeConstructorPromise;
+}
+function runDockerContextCommand(args) {
+  const result = (0, import_node_child_process.spawnSync)("docker", ["context", ...args], {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0) {
+    const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    throw new Error(`docker context command failed: ${details || "unknown error"}`);
+  }
+  return result.stdout.trim();
+}
+function getCurrentDockerContext() {
+  return runDockerContextCommand(["show"]);
+}
+function getDockerHostFromContext(context) {
+  const result = (0, import_node_child_process.spawnSync)(
+    "docker",
+    ["context", "inspect", context, "--format", "{{ .Endpoints.docker.Host }}"],
+    { encoding: "utf-8" }
+  );
+  if (result.status === 0) {
+    const value = result.stdout.trim();
+    if (value && value !== "<no value>") {
+      return value;
+    }
+  }
+  if (process.env.DOCKER_HOST) {
+    return process.env.DOCKER_HOST;
+  }
+  return "unix:///var/run/docker.sock";
+}
+async function createDockerClient() {
+  const DockerodeClass = await getDockerodeConstructor();
+  const context = getCurrentDockerContext();
+  const host = getDockerHostFromContext(context);
+  if (host.startsWith("unix://")) {
+    return new DockerodeClass({ socketPath: host.replace("unix://", "") });
+  }
+  if (host.startsWith("tcp://") || host.startsWith("http://") || host.startsWith("https://")) {
+    const normalized = host.startsWith("tcp://") ? host.replace("tcp://", "http://") : host;
+    const url = new URL(normalized);
+    return new DockerodeClass({
+      host: url.hostname,
+      port: Number(url.port || 2375),
+      protocol: url.protocol.replace(":", "")
+    });
+  }
+  throw new Error(`Unsupported docker host from context: ${host}`);
+}
+async function listContainers(all = true) {
+  const docker = await createDockerClient();
+  return docker.listContainers({ all });
+}
+async function findContainerByName(name) {
+  const containers = await listContainers(true);
+  return containers.find((container) => container.Names?.some((n) => n === `/${name}`));
+}
+async function isContainerRunning(name) {
+  const container = await findContainerByName(name);
+  return container?.State === "running";
+}
+async function ensureNetwork(name) {
+  const docker = await createDockerClient();
+  try {
+    await docker.getNetwork(name).inspect();
+    return;
+  } catch {
+  }
+  await docker.createNetwork({
+    Name: name,
+    Driver: "bridge",
+    Attachable: true
+  });
+}
+async function networkExists(name) {
+  const docker = await createDockerClient();
+  try {
+    await docker.getNetwork(name).inspect();
+    return true;
+  } catch {
+    return false;
+  }
+}
+var import_node_child_process, dockerodeConstructorPromise;
+var init_docker = __esm({
+  "src/core/docker.ts"() {
+    "use strict";
+    import_node_child_process = require("child_process");
+    dockerodeConstructorPromise = null;
+  }
+});
+
+// src/core/router.ts
+function renderComposeYml() {
+  return `services:
+  traefik:
+    image: traefik:v2.11
+    container_name: ${ROUTER_CONTAINER_NAME}
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "5432:5432"
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "${TRAEFIK_STATIC_FILE}:/etc/traefik/traefik.yml:ro"
+      - "${TRAEFIK_DYNAMIC_DIR}:/etc/traefik/dynamic:ro"
+      - "${CERTS_DIR}:/certs:ro"
+    networks:
+      - ${DEVNET_NAME}
+
+networks:
+  ${DEVNET_NAME}:
+    external: true
+`;
+}
+function renderTraefikStaticYml() {
+  return `api:
+  dashboard: true
+  insecure: true
+
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+  postgres:
+    address: ":5432"
+  traefik:
+    address: ":8080"
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+    network: ${DEVNET_NAME}
+  file:
+    directory: /etc/traefik/dynamic
+    watch: true
+
+accessLog: {}
+`;
+}
+function renderTraefikBaseDynamicYml(tlsEnabled) {
+  if (!tlsEnabled) {
+    return `http: {}
+
+tls: {}
+`;
+  }
+  return `http:
+  middlewares:
+    redirect-to-https:
+      redirectScheme:
+        scheme: https
+        permanent: false
+  routers:
+    redirect-http-to-https:
+      entryPoints:
+        - web
+      rule: "HostRegexp(\`{host:.+\\\\.localhost}\`)"
+      middlewares:
+        - redirect-to-https
+      service: noop@internal
+
+tls:
+  certificates:
+    - certFile: /certs/localhost.pem
+      keyFile: /certs/localhost-key.pem
+`;
+}
+function renderHostRoutesDynamicYml() {
+  return `http:
+  routers: {}
+  services: {}
+`;
+}
+function renderHostRouteState() {
+  return "[]\n";
+}
+function renderRouterReadme() {
+  return `# devrouter state
+
+This folder is managed by the devrouter CLI.
+
+## Files
+
+- compose.yml: shared Traefik stack
+- traefik/traefik.yml: Traefik static config
+- traefik/dynamic/base.yml: TLS + redirect config
+- traefik/dynamic/host-routes.yml: generated host-run routes
+- host-routes-state.json: host-run route metadata
+- certs/: mkcert output files
+
+## Commands
+
+- dev init
+- dev up
+- dev down
+- dev status
+- dev doctor
+- dev ls
+- dev repo init
+- dev app add --name <name> --host <host.localhost> --protocol <http|tcp> --runtime <host|docker>
+- dev app run <name>
+- dev app ls
+- dev app rm <name>
+- dev tls install
+
+## Troubleshooting
+
+If dev up fails with port conflicts on 80/443/5432, run:
+
+- lsof -nP -iTCP:80 -sTCP:LISTEN
+- lsof -nP -iTCP:443 -sTCP:LISTEN
+- lsof -nP -iTCP:5432 -sTCP:LISTEN
+`;
+}
+function ensureRouterFiles() {
+  import_node_fs2.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs2.default.mkdirSync(TRAEFIK_DIR, { recursive: true });
+  import_node_fs2.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
+  import_node_fs2.default.mkdirSync(CERTS_DIR, { recursive: true });
+  import_node_fs2.default.mkdirSync(BIN_DIR, { recursive: true });
+  import_node_fs2.default.mkdirSync(CACHE_DIR, { recursive: true });
+  import_node_fs2.default.writeFileSync(COMPOSE_FILE, renderComposeYml(), "utf-8");
+  import_node_fs2.default.writeFileSync(TRAEFIK_STATIC_FILE, renderTraefikStaticYml(), "utf-8");
+  if (!import_node_fs2.default.existsSync(TRAEFIK_DYNAMIC_BASE_FILE)) {
+    if (import_node_fs2.default.existsSync(LEGACY_TRAEFIK_DYNAMIC_FILE)) {
+      import_node_fs2.default.copyFileSync(LEGACY_TRAEFIK_DYNAMIC_FILE, TRAEFIK_DYNAMIC_BASE_FILE);
+    } else {
+      import_node_fs2.default.writeFileSync(TRAEFIK_DYNAMIC_BASE_FILE, renderTraefikBaseDynamicYml(false), "utf-8");
+    }
+  }
+  if (!import_node_fs2.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
+    import_node_fs2.default.writeFileSync(TRAEFIK_HOST_ROUTES_FILE, renderHostRoutesDynamicYml(), "utf-8");
+  }
+  if (!import_node_fs2.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+    import_node_fs2.default.writeFileSync(HOST_ROUTES_STATE_FILE, renderHostRouteState(), "utf-8");
+  }
+  import_node_fs2.default.writeFileSync(ROUTER_README_FILE, renderRouterReadme(), "utf-8");
+}
+function setTLSEnabled(enabled) {
+  ensureRouterFiles();
+  import_node_fs2.default.writeFileSync(TRAEFIK_DYNAMIC_BASE_FILE, renderTraefikBaseDynamicYml(enabled), "utf-8");
+}
+function isTLSConfigured() {
+  if (!import_node_fs2.default.existsSync(TRAEFIK_DYNAMIC_BASE_FILE)) {
+    return false;
+  }
+  const content = import_node_fs2.default.readFileSync(TRAEFIK_DYNAMIC_BASE_FILE, "utf-8");
+  return content.includes("certificates:") && content.includes("/certs/localhost.pem");
+}
+function areTLSCertsPresent() {
+  return import_node_fs2.default.existsSync(CERT_FILE) && import_node_fs2.default.existsSync(CERT_KEY_FILE);
+}
+function isTLSEnabled() {
+  return areTLSCertsPresent() && isTLSConfigured();
+}
+function getRouterFileLayout() {
+  const required = [...ROUTER_REQUIRED_FILES];
+  const missing = required.filter((filePath) => !import_node_fs2.default.existsSync(filePath));
+  return { required, missing };
+}
+function runDockerCompose(args) {
+  const result = (0, import_node_child_process2.spawnSync)("docker", ["compose", "-f", COMPOSE_FILE, ...args], {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0) {
+    const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    throw new Error(`docker compose failed: ${details || "unknown error"}`);
+  }
+}
+function startRouterStack() {
+  runDockerCompose(["up", "-d"]);
+}
+function stopRouterStack() {
+  runDockerCompose(["down"]);
+}
+var import_node_fs2, import_node_os, import_node_path2, import_node_child_process2, DEVNET_NAME, ROUTER_CONTAINER_NAME, DEVROUTER_HOME, TRAEFIK_DIR, TRAEFIK_DYNAMIC_DIR, CERTS_DIR, BIN_DIR, CACHE_DIR, COMPOSE_FILE, TRAEFIK_STATIC_FILE, TRAEFIK_DYNAMIC_BASE_FILE, TRAEFIK_HOST_ROUTES_FILE, HOST_ROUTES_STATE_FILE, ROUTER_README_FILE, LEGACY_TRAEFIK_DYNAMIC_FILE, CERT_FILE, CERT_KEY_FILE, ROUTER_REQUIRED_FILES;
+var init_router = __esm({
+  "src/core/router.ts"() {
+    "use strict";
+    import_node_fs2 = __toESM(require("fs"));
+    import_node_os = __toESM(require("os"));
+    import_node_path2 = __toESM(require("path"));
+    import_node_child_process2 = require("child_process");
+    DEVNET_NAME = "devnet";
+    ROUTER_CONTAINER_NAME = "devrouter-traefik";
+    DEVROUTER_HOME = import_node_path2.default.join(import_node_os.default.homedir(), ".config", "devrouter");
+    TRAEFIK_DIR = import_node_path2.default.join(DEVROUTER_HOME, "traefik");
+    TRAEFIK_DYNAMIC_DIR = import_node_path2.default.join(TRAEFIK_DIR, "dynamic");
+    CERTS_DIR = import_node_path2.default.join(DEVROUTER_HOME, "certs");
+    BIN_DIR = import_node_path2.default.join(DEVROUTER_HOME, "bin");
+    CACHE_DIR = import_node_path2.default.join(DEVROUTER_HOME, "cache");
+    COMPOSE_FILE = import_node_path2.default.join(DEVROUTER_HOME, "compose.yml");
+    TRAEFIK_STATIC_FILE = import_node_path2.default.join(TRAEFIK_DIR, "traefik.yml");
+    TRAEFIK_DYNAMIC_BASE_FILE = import_node_path2.default.join(TRAEFIK_DYNAMIC_DIR, "base.yml");
+    TRAEFIK_HOST_ROUTES_FILE = import_node_path2.default.join(TRAEFIK_DYNAMIC_DIR, "host-routes.yml");
+    HOST_ROUTES_STATE_FILE = import_node_path2.default.join(DEVROUTER_HOME, "host-routes-state.json");
+    ROUTER_README_FILE = import_node_path2.default.join(DEVROUTER_HOME, "README.md");
+    LEGACY_TRAEFIK_DYNAMIC_FILE = import_node_path2.default.join(TRAEFIK_DIR, "dynamic.yml");
+    CERT_FILE = import_node_path2.default.join(CERTS_DIR, "localhost.pem");
+    CERT_KEY_FILE = import_node_path2.default.join(CERTS_DIR, "localhost-key.pem");
+    ROUTER_REQUIRED_FILES = [
+      COMPOSE_FILE,
+      TRAEFIK_STATIC_FILE,
+      TRAEFIK_DYNAMIC_BASE_FILE,
+      TRAEFIK_HOST_ROUTES_FILE,
+      HOST_ROUTES_STATE_FILE
+    ];
+  }
+});
+
+// src/util/ports.ts
+function findPortListeners(port) {
+  const result = (0, import_node_child_process3.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0 || !result.stdout.trim()) {
+    return [];
+  }
+  const lines = result.stdout.trim().split(/\r?\n/);
+  if (lines.length <= 1) {
+    return [];
+  }
+  return lines.slice(1).map((line) => {
+    const parts = line.trim().split(/\s+/);
+    const command = parts[0] ?? "?";
+    const pid = parts[1] ?? "?";
+    const user = parts[2] ?? "?";
+    const address = parts.slice(-2).join(" ") || "?";
+    return {
+      port,
+      command,
+      pid,
+      user,
+      address
+    };
+  });
+}
+var import_node_child_process3;
+var init_ports = __esm({
+  "src/util/ports.ts"() {
+    "use strict";
+    import_node_child_process3 = require("child_process");
+  }
+});
+
+// src/commands/up.ts
+var up_exports = {};
+__export(up_exports, {
+  runUpCommand: () => runUpCommand
+});
+function buildPortConflictMessage() {
+  const listeners = [...findPortListeners(80), ...findPortListeners(443), ...findPortListeners(5432)];
+  if (listeners.length === 0) {
+    return "";
+  }
+  const details = listeners.map((listener) => {
+    return `- port ${listener.port}: ${listener.command} (pid ${listener.pid}, user ${listener.user}, ${listener.address})`;
+  }).join("\n");
+  return `Cannot start devrouter because host ports 80/443/5432 are already in use:
+${details}
+
+Mitigation:
+1) Stop the conflicting process/container
+2) Re-run: dev up
+
+Debug commands:
+- lsof -nP -iTCP:80 -sTCP:LISTEN
+- lsof -nP -iTCP:443 -sTCP:LISTEN
+- lsof -nP -iTCP:5432 -sTCP:LISTEN`;
+}
+async function runUpCommand() {
+  await ensureNetwork(DEVNET_NAME);
+  ensureRouterFiles();
+  const routerRunning = await isContainerRunning(ROUTER_CONTAINER_NAME);
+  if (!routerRunning) {
+    const message = buildPortConflictMessage();
+    if (message) {
+      throw new Error(message);
+    }
+  }
+  startRouterStack();
+  process.stdout.write("devrouter is up.\n");
+}
+var init_up = __esm({
+  "src/commands/up.ts"() {
+    "use strict";
+    init_docker();
+    init_router();
+    init_ports();
+  }
+});
+
+// src/commands/down.ts
+var down_exports = {};
+__export(down_exports, {
+  runDownCommand: () => runDownCommand
+});
+async function runDownCommand() {
+  stopRouterStack();
+  process.stdout.write("devrouter is down.\n");
+}
+var init_down = __esm({
+  "src/commands/down.ts"() {
+    "use strict";
+    init_router();
+  }
+});
+
+// src/core/status.ts
+function hasPortBinding(ports, privatePort, publicPort) {
+  if (!ports) {
+    return false;
+  }
+  return ports.some((port) => port.PrivatePort === privatePort && port.PublicPort === publicPort);
+}
+function toRepoStatus(repoPath) {
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const configPath = getRepoConfigPath(resolvedRepoPath);
+  const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
+  const configExists = import_node_fs3.default.existsSync(configPath);
+  if (!explicitRepo && !configExists) {
+    return void 0;
+  }
+  if (!configExists) {
+    return {
+      path: resolvedRepoPath,
+      configPath,
+      exists: false,
+      valid: false,
+      appCount: 0,
+      tcpAppCount: 0,
+      error: `Missing .devrouter.yml in ${resolvedRepoPath}`
+    };
+  }
+  try {
+    const config = loadRepoConfig(resolvedRepoPath);
+    const tcpAppCount = config.apps.filter((app) => app.protocol === "tcp").length;
+    return {
+      path: resolvedRepoPath,
+      configPath,
+      exists: true,
+      valid: true,
+      appCount: config.apps.length,
+      tcpAppCount
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      path: resolvedRepoPath,
+      configPath,
+      exists: true,
+      valid: false,
+      appCount: 0,
+      tcpAppCount: 0,
+      error: message
+    };
+  }
+}
+async function collectRouterStatus(repoPath) {
+  const repo = toRepoStatus(repoPath);
+  const tlsEnabled = isTLSEnabled();
+  let container;
+  let networkIsPresent = false;
+  let dockerContext = "unknown";
+  let dockerUnavailableMessage;
+  try {
+    dockerContext = getCurrentDockerContext();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    dockerContext = `unavailable (${message})`;
+    dockerUnavailableMessage = message;
+  }
+  try {
+    container = await findContainerByName(ROUTER_CONTAINER_NAME);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    dockerUnavailableMessage = dockerUnavailableMessage ?? message;
+  }
+  try {
+    networkIsPresent = await networkExists(DEVNET_NAME);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    dockerUnavailableMessage = dockerUnavailableMessage ?? message;
+  }
+  const boundPorts = {
+    web80: hasPortBinding(container?.Ports, 80, 80),
+    web443: hasPortBinding(container?.Ports, 443, 443),
+    postgres5432: hasPortBinding(container?.Ports, 5432, 5432),
+    dashboard8080: hasPortBinding(container?.Ports, 8080, 8080)
+  };
+  const nextSteps = [];
+  const httpRoutingReady = container?.State === "running" && boundPorts.web80;
+  const tcpRoutingReady = container?.State === "running" && boundPorts.postgres5432 && tlsEnabled;
+  if (!container || container.State !== "running") {
+    nextSteps.push("Run: dev up");
+  }
+  if (dockerUnavailableMessage) {
+    nextSteps.push("Ensure Docker is running and reachable from the active Docker context");
+  }
+  if (!tlsEnabled) {
+    nextSteps.push("Run: dev tls install (required for tcp/postgres, recommended for http)");
+  }
+  if (repo && !repo.exists) {
+    nextSteps.push(`Run: dev repo init --repo ${repo.path}`);
+  } else if (repo && !repo.valid) {
+    nextSteps.push("Fix .devrouter.yml validation errors and re-run `dev doctor --repo <path>`");
+  } else if (repo && repo.valid && repo.appCount === 0) {
+    nextSteps.push(`Run: dev app add --name <name> --host <name>.localhost --protocol http --runtime host --repo ${repo.path}`);
+  } else if (repo && repo.valid) {
+    nextSteps.push(`Run: dev app ls --repo ${repo.path}`);
+    nextSteps.push("Run: dev app run <name> --repo <path> --yes");
+    nextSteps.push("Run: dev ls");
+  }
+  const files = getRouterFileLayout();
+  if (files.missing.length > 0) {
+    nextSteps.push("Run: dev up to re-create missing global router files");
+  }
+  return {
+    dockerContext,
+    routerRunning: container?.State === "running",
+    routerContainerName: ROUTER_CONTAINER_NAME,
+    boundPorts,
+    tlsConfigured: isTLSConfigured(),
+    certPresent: areTLSCertsPresent(),
+    tlsEnabled,
+    networkExists: networkIsPresent,
+    repo,
+    insights: {
+      httpRoutingReady,
+      tcpRoutingReady,
+      nextSteps: Array.from(new Set(nextSteps))
+    }
+  };
+}
+var import_node_fs3;
+var init_status = __esm({
+  "src/core/status.ts"() {
+    "use strict";
+    import_node_fs3 = __toESM(require("fs"));
+    init_docker();
+    init_router();
+    init_repo_config();
+  }
+});
+
+// src/commands/status.ts
+var status_exports = {};
+__export(status_exports, {
+  runStatusCommand: () => runStatusCommand
+});
+async function runStatusCommand(options) {
+  const status = await collectRouterStatus(options.repo);
+  if (options.json) {
+    printJSON(status);
+    return;
+  }
+  printStatus(status);
+}
+var init_status2 = __esm({
+  "src/commands/status.ts"() {
+    "use strict";
+    init_output();
+    init_status();
+  }
+});
+
+// src/core/host-routes.ts
+function isPidRunning(pid) {
+  if (!pid || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function buildHostRouteId(repoPath, name) {
+  return `${repoPath}::${name}`;
+}
+function sanitizeKey(value) {
+  return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function writeHostRoutesDynamicFile(routes, tlsEnabled) {
+  const routers = {};
+  const services = {};
+  for (const route of routes) {
+    const key = `host-${sanitizeKey(route.id)}`;
+    const router = {
+      rule: `Host(\`${route.host}\`)`,
+      entryPoints: tlsEnabled ? ["web", "websecure"] : ["web"],
+      service: key
+    };
+    if (tlsEnabled) {
+      router.tls = true;
+    }
+    routers[key] = router;
+    services[key] = {
+      loadBalancer: {
+        servers: [{ url: `http://host.docker.internal:${route.port}` }]
+      }
+    };
+  }
+  const document = {
+    http: {
+      routers,
+      services
+    }
+  };
+  import_node_fs4.default.writeFileSync(TRAEFIK_HOST_ROUTES_FILE, import_yaml2.default.stringify(document, { lineWidth: 0 }), "utf-8");
+}
+function ensureHostRouteStorage() {
+  import_node_fs4.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs4.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
+  if (!import_node_fs4.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
+    import_node_fs4.default.writeFileSync(
+      TRAEFIK_HOST_ROUTES_FILE,
+      import_yaml2.default.stringify({ http: { routers: {}, services: {} } }, { lineWidth: 0 }),
+      "utf-8"
+    );
+  }
+  if (!import_node_fs4.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+    import_node_fs4.default.writeFileSync(HOST_ROUTES_STATE_FILE, "[]\n", "utf-8");
+  }
+}
+function writeState(routes) {
+  ensureHostRouteStorage();
+  import_node_fs4.default.writeFileSync(HOST_ROUTES_STATE_FILE, `${JSON.stringify(routes, null, 2)}
+`, "utf-8");
+  writeHostRoutesDynamicFile(routes, isTLSEnabled());
+}
+function refreshHostRoutesDynamicFile() {
+  const routes = listHostRouteState();
+  writeHostRoutesDynamicFile(routes, isTLSEnabled());
+}
+function listHostRouteState() {
+  ensureHostRouteStorage();
+  if (!import_node_fs4.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+    return [];
+  }
+  try {
+    const raw = import_node_fs4.default.readFileSync(HOST_ROUTES_STATE_FILE, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed.filter((item) => item && typeof item === "object").map((item) => item);
+  } catch {
+    return [];
+  }
+}
+function upsertHostRoute(input2) {
+  const routes = listHostRouteState();
+  const id = buildHostRouteId(input2.repoPath, input2.name);
+  const existing = routes.find((route) => route.id === id);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const next = {
+    id,
+    name: input2.name,
+    host: input2.host,
+    protocol: input2.protocol ?? "http",
+    repoPath: input2.repoPath,
+    port: input2.port,
+    mode: input2.mode,
+    pid: input2.pid,
+    command: input2.command,
+    createdAt: existing?.createdAt ?? now,
+    updatedAt: now
+  };
+  const remaining = routes.filter((route) => route.id !== id);
+  remaining.push(next);
+  remaining.sort((a, b) => a.name.localeCompare(b.name) || a.repoPath.localeCompare(b.repoPath));
+  writeState(remaining);
+  return next;
+}
+function removeHostRouteById(id) {
+  const routes = listHostRouteState();
+  const next = routes.filter((route) => route.id !== id);
+  if (next.length === routes.length) {
+    return false;
+  }
+  writeState(next);
+  return true;
+}
+function removeHostRouteByName(name, repoPath) {
+  const routes = listHostRouteState();
+  const matches = routes.filter((route) => {
+    if (route.name !== name) {
+      return false;
+    }
+    if (repoPath && route.repoPath !== repoPath) {
+      return false;
+    }
+    return true;
+  });
+  if (matches.length === 0) {
+    throw new Error(`No host route named '${name}' found.`);
+  }
+  if (matches.length > 1 && !repoPath) {
+    const refs = matches.map((route) => `${route.name} (${route.repoPath})`).join(", ");
+    throw new Error(
+      `Multiple host routes named '${name}' exist. Re-run with --repo to disambiguate: ${refs}`
+    );
+  }
+  const match = matches[0];
+  const next = routes.filter((route) => route.id !== match.id);
+  writeState(next);
+  return match;
+}
+function listHostRoutes(tlsEnabled) {
+  const routes = listHostRouteState();
+  const scheme = tlsEnabled ? "https" : "http";
+  return routes.map((route) => ({
+    id: route.id,
+    source: "host",
+    protocol: "http",
+    serviceName: route.name,
+    projectName: import_node_path3.default.basename(route.repoPath),
+    hosts: [route.host],
+    urls: [`${scheme}://${route.host}`],
+    status: isPidRunning(route.pid) ? "running" : "stopped",
+    health: "unknown",
+    createdAt: Math.floor(new Date(route.createdAt).getTime() / 1e3)
+  }));
+}
+var import_node_fs4, import_node_path3, import_yaml2;
+var init_host_routes = __esm({
+  "src/core/host-routes.ts"() {
+    "use strict";
+    import_node_fs4 = __toESM(require("fs"));
+    import_node_path3 = __toESM(require("path"));
+    import_yaml2 = __toESM(require("yaml"));
+    init_router();
+  }
+});
+
+// src/core/routes.ts
+function normalizeContainerName(name) {
+  if (!name) {
+    return "unknown";
+  }
+  return name.startsWith("/") ? name.slice(1) : name;
+}
+function parseHostsFromMatcher(rule, matcherName) {
+  const hosts = [];
+  const matcherRegex = new RegExp(`${matcherName}\\(([^)]+)\\)`, "g");
+  const hostBlocks = rule.matchAll(matcherRegex);
+  for (const block of hostBlocks) {
+    const inner = block[1];
+    const parts = inner.split(",");
+    for (const part of parts) {
+      const clean = part.trim().replaceAll("`", "").replaceAll('"', "").replaceAll("'", "");
+      if (clean.length > 0) {
+        hosts.push(clean);
+      }
+    }
+  }
+  return Array.from(new Set(hosts));
+}
+function isOnNetwork(container, networkName) {
+  const networks = container.NetworkSettings?.Networks ?? {};
+  return Object.prototype.hasOwnProperty.call(networks, networkName);
+}
+function buildRoute(container, routerId, hosts, protocol, tlsEnabled) {
+  const labels = container.Labels ?? {};
+  const containerName = normalizeContainerName(container.Names?.[0]);
+  const serviceName = labels["com.docker.compose.service"] ?? containerName;
+  const projectName = labels["com.docker.compose.project"] ?? "-";
+  const status = container.State ?? "unknown";
+  const statusText = container.Status ?? "";
+  let health = "unknown";
+  if (statusText.includes("healthy")) {
+    health = "healthy";
+  } else if (statusText.includes("unhealthy")) {
+    health = "unhealthy";
+  }
+  return {
+    id: routerId,
+    source: "docker",
+    protocol,
+    containerId: container.Id,
+    containerName,
+    serviceName,
+    projectName,
+    hosts,
+    urls: protocol === "http" ? hosts.map((host) => `${tlsEnabled ? "https" : "http"}://${host}`) : hosts.map((host) => `postgres://${host}:5432 (tls required)`),
+    status,
+    health,
+    createdAt: container.Created
+  };
+}
+function discoverRoutes(containers, tlsEnabled, networkName) {
+  const routes = [];
+  for (const container of containers) {
+    if (!isOnNetwork(container, networkName)) {
+      continue;
+    }
+    const labels = container.Labels ?? {};
+    if (labels["traefik.enable"] !== "true") {
+      continue;
+    }
+    for (const [key, value] of Object.entries(labels)) {
+      if (!value) {
+        continue;
+      }
+      const httpMatch = key.match(HTTP_ROUTER_RULE_KEY);
+      if (httpMatch) {
+        const routerId2 = httpMatch[1];
+        const hosts2 = parseHostsFromMatcher(value, "Host");
+        if (hosts2.length > 0) {
+          routes.push(buildRoute(container, routerId2, hosts2, "http", tlsEnabled));
+        }
+        continue;
+      }
+      const tcpMatch = key.match(TCP_ROUTER_RULE_KEY);
+      if (!tcpMatch) {
+        continue;
+      }
+      const routerId = tcpMatch[1];
+      const hosts = parseHostsFromMatcher(value, "HostSNI").filter((host) => host !== "*");
+      if (hosts.length === 0) {
+        continue;
+      }
+      routes.push(buildRoute(container, routerId, hosts, "tcp/postgres", tlsEnabled));
+    }
+  }
+  return { routes, duplicateHosts: findDuplicateHosts(routes) };
+}
+function findDuplicateHosts(routes) {
+  const hostCount = /* @__PURE__ */ new Map();
+  for (const route of routes) {
+    for (const host of route.hosts) {
+      hostCount.set(host, (hostCount.get(host) ?? 0) + 1);
+    }
+  }
+  return Array.from(hostCount.entries()).filter(([, count]) => count > 1).map(([host]) => host).sort();
+}
+function resolveRouteByName(routes, name) {
+  const target = name.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  const matches = routes.filter((route) => {
+    if (route.serviceName === target) {
+      return true;
+    }
+    if (route.containerName && route.containerName === target) {
+      return true;
+    }
+    if (route.hosts.includes(target)) {
+      return true;
+    }
+    return route.hosts.some((host) => host.replace(/\.localhost$/, "") === target);
+  });
+  if (matches.length === 0) {
+    throw new Error(`No route found for '${name}'. Run 'dev ls' to view available routes.`);
+  }
+  if (matches.length > 1) {
+    const names = matches.map((route) => `${route.serviceName} (${route.hosts.join(",")})`).join("; ");
+    throw new Error(`Route name '${name}' is ambiguous: ${names}`);
+  }
+  return matches[0];
+}
+var HTTP_ROUTER_RULE_KEY, TCP_ROUTER_RULE_KEY;
+var init_routes = __esm({
+  "src/core/routes.ts"() {
+    "use strict";
+    HTTP_ROUTER_RULE_KEY = /^traefik\.http\.routers\.([^.]+)\.rule$/;
+    TCP_ROUTER_RULE_KEY = /^traefik\.tcp\.routers\.([^.]+)\.rule$/;
+  }
+});
+
+// src/core/doctor.ts
+function isPidRunning2(pid) {
+  if (!pid || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function addCheck(checks, check) {
+  checks.push(check);
+}
+function collectSummary(checks) {
+  return checks.reduce(
+    (acc, check) => {
+      acc[check.level] += 1;
+      return acc;
+    },
+    { ok: 0, warn: 0, error: 0 }
+  );
+}
+function collectNextSteps(checks, statusNextSteps) {
+  const steps = /* @__PURE__ */ new Set();
+  for (const check of checks) {
+    if (check.level === "ok") {
+      continue;
+    }
+    if (check.suggestion) {
+      steps.add(check.suggestion);
+    }
+  }
+  for (const step of statusNextSteps) {
+    steps.add(step);
+  }
+  return Array.from(steps.values());
+}
+async function buildDoctorReport(options = {}) {
+  const checks = [];
+  const fileLayout = getRouterFileLayout();
+  const resolvedRepoPath = resolveRepoPath(options.repo);
+  const explicitRepo = typeof options.repo === "string" && options.repo.trim().length > 0;
+  if (fileLayout.missing.length === 0) {
+    addCheck(checks, {
+      id: "global.router-files",
+      level: "ok",
+      summary: "Global router files are present."
+    });
+  } else {
+    addCheck(checks, {
+      id: "global.router-files",
+      level: "warn",
+      summary: `Missing ${fileLayout.missing.length} global router file(s).`,
+      details: fileLayout.missing.join(", "),
+      suggestion: "Run: dev up"
+    });
+  }
+  let statusNextSteps = [];
+  try {
+    const status = await collectRouterStatus(options.repo);
+    statusNextSteps = status.insights.nextSteps;
+    addCheck(checks, {
+      id: "global.docker-context",
+      level: "ok",
+      summary: `Docker context: ${status.dockerContext}`
+    });
+    addCheck(checks, {
+      id: "global.router-running",
+      level: status.routerRunning ? "ok" : "warn",
+      summary: status.routerRunning ? "Router container is running." : "Router container is not running.",
+      suggestion: status.routerRunning ? void 0 : "Run: dev up"
+    });
+    if (status.routerRunning) {
+      const missingPorts = [];
+      if (!status.boundPorts.web80) {
+        missingPorts.push("80");
+      }
+      if (!status.boundPorts.web443) {
+        missingPorts.push("443");
+      }
+      if (!status.boundPorts.postgres5432) {
+        missingPorts.push("5432");
+      }
+      addCheck(checks, {
+        id: "global.port-bindings",
+        level: missingPorts.length === 0 ? "ok" : "error",
+        summary: missingPorts.length === 0 ? "Router has required port bindings (80/443/5432)." : `Router is running but missing bound port(s): ${missingPorts.join(", ")}.`,
+        suggestion: missingPorts.length === 0 ? void 0 : "Restart router: dev down && dev up"
+      });
+    }
+    addCheck(checks, {
+      id: "global.devnet",
+      level: status.networkExists ? "ok" : "error",
+      summary: status.networkExists ? "Shared network devnet exists." : "Shared network devnet is missing.",
+      suggestion: status.networkExists ? void 0 : "Run: dev up"
+    });
+    if (status.tlsEnabled) {
+      addCheck(checks, {
+        id: "global.tls",
+        level: "ok",
+        summary: "TLS is enabled (certs + Traefik TLS config)."
+      });
+    } else if (status.certPresent || status.tlsConfigured) {
+      addCheck(checks, {
+        id: "global.tls",
+        level: "warn",
+        summary: "TLS is partially configured.",
+        details: `certPresent=${status.certPresent}, tlsConfigured=${status.tlsConfigured}`,
+        suggestion: "Run: dev tls install"
+      });
+    } else {
+      addCheck(checks, {
+        id: "global.tls",
+        level: "warn",
+        summary: "TLS is not enabled.",
+        suggestion: "Run: dev tls install"
+      });
+    }
+    const repo = status.repo;
+    if (!repo) {
+      addCheck(checks, {
+        id: "repo.config",
+        level: "warn",
+        summary: "No .devrouter.yml found in current directory.",
+        suggestion: `Run: dev repo init --repo ${resolvedRepoPath}`
+      });
+    } else if (!repo.exists) {
+      addCheck(checks, {
+        id: "repo.config",
+        level: explicitRepo ? "error" : "warn",
+        summary: `Missing .devrouter.yml in ${repo.path}.`,
+        suggestion: `Run: dev repo init --repo ${repo.path}`
+      });
+    } else if (!repo.valid) {
+      addCheck(checks, {
+        id: "repo.config",
+        level: "error",
+        summary: ".devrouter.yml exists but is invalid.",
+        details: repo.error,
+        suggestion: "Fix config errors and re-run: dev doctor --repo <path>"
+      });
+    } else {
+      addCheck(checks, {
+        id: "repo.config",
+        level: "ok",
+        summary: `.devrouter.yml is valid (${repo.appCount} app(s)).`
+      });
+      if (repo.appCount === 0) {
+        addCheck(checks, {
+          id: "repo.apps",
+          level: "warn",
+          summary: "No apps are configured in .devrouter.yml.",
+          suggestion: "Run: dev app add --name <name> --host <name>.localhost --protocol http --runtime host"
+        });
+      }
+      const config = loadRepoConfig(repo.path);
+      const appNames = new Set(config.apps.map((app) => app.name));
+      const missingDependencies = config.apps.flatMap(
+        (app) => app.dependencies.filter((dependency) => !appNames.has(dependency.app)).map((dependency) => `${app.name}->${dependency.app}`)
+      );
+      addCheck(checks, {
+        id: "repo.dependencies",
+        level: missingDependencies.length === 0 ? "ok" : "error",
+        summary: missingDependencies.length === 0 ? "All app dependencies resolve to configured app names." : `Missing dependency target(s): ${missingDependencies.join(", ")}.`,
+        suggestion: missingDependencies.length === 0 ? void 0 : "Fix dependencies in .devrouter.yml"
+      });
+      const missingComposeFiles = config.apps.filter((app) => app.runtime === "docker").flatMap((app) => app.docker.composeFiles.map((filePath) => ({
+        app: app.name,
+        filePath,
+        absolutePath: import_node_path4.default.resolve(repo.path, filePath)
+      }))).filter((entry) => !import_node_fs5.default.existsSync(entry.absolutePath));
+      addCheck(checks, {
+        id: "repo.compose-files",
+        level: missingComposeFiles.length === 0 ? "ok" : "error",
+        summary: missingComposeFiles.length === 0 ? "All referenced docker compose files exist." : `${missingComposeFiles.length} compose file reference(s) are missing.`,
+        details: missingComposeFiles.length > 0 ? missingComposeFiles.map((entry) => `${entry.app}: ${entry.filePath}`).join(", ") : void 0,
+        suggestion: missingComposeFiles.length === 0 ? void 0 : "Fix docker.composeFiles paths in .devrouter.yml"
+      });
+      const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
+        app: app.name,
+        cwd: app.hostRun.cwd,
+        absolutePath: import_node_path4.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs5.default.existsSync(entry.absolutePath));
+      addCheck(checks, {
+        id: "repo.host-cwd",
+        level: missingHostCwds.length === 0 ? "ok" : "error",
+        summary: missingHostCwds.length === 0 ? "All host runtime cwd paths exist." : `${missingHostCwds.length} host runtime cwd path(s) are missing.`,
+        details: missingHostCwds.length > 0 ? missingHostCwds.map((entry) => `${entry.app}: ${entry.cwd}`).join(", ") : void 0,
+        suggestion: missingHostCwds.length === 0 ? void 0 : "Fix hostRun.cwd paths in .devrouter.yml"
+      });
+      if (repo.tcpAppCount > 0 && !status.tlsEnabled) {
+        addCheck(checks, {
+          id: "repo.tcp-tls",
+          level: "error",
+          summary: `Repo defines ${repo.tcpAppCount} tcp/postgres app(s), but TLS is not enabled.`,
+          suggestion: "Run: dev tls install"
+        });
+      } else if (repo.tcpAppCount > 0) {
+        addCheck(checks, {
+          id: "repo.tcp-tls",
+          level: "ok",
+          summary: `TLS is ready for ${repo.tcpAppCount} tcp/postgres app(s).`
+        });
+      }
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    addCheck(checks, {
+      id: "global.status",
+      level: "error",
+      summary: "Failed to collect router status diagnostics.",
+      details: message
+    });
+  }
+  try {
+    const tlsEnabled = isTLSEnabled();
+    const containers = await listContainers(true);
+    const dockerRoutes = discoverRoutes(containers, tlsEnabled, "devnet").routes;
+    const hostRoutes = listHostRoutes(tlsEnabled);
+    const duplicates = findDuplicateHosts([...dockerRoutes, ...hostRoutes]);
+    addCheck(checks, {
+      id: "routes.duplicates",
+      level: duplicates.length === 0 ? "ok" : "error",
+      summary: duplicates.length === 0 ? "No duplicate hostnames detected across active routes." : `Duplicate hostname(s): ${duplicates.join(", ")}.`,
+      suggestion: duplicates.length === 0 ? void 0 : "Rename hosts in .devrouter.yml so each hostname is unique"
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    addCheck(checks, {
+      id: "routes.duplicates",
+      level: "warn",
+      summary: "Could not evaluate duplicate hostnames.",
+      details: message
+    });
+  }
+  const staleHostRoutes = listHostRouteState().filter(
+    (route) => route.pid ? !isPidRunning2(route.pid) : true
+  );
+  addCheck(checks, {
+    id: "routes.host-state",
+    level: staleHostRoutes.length === 0 ? "ok" : "warn",
+    summary: staleHostRoutes.length === 0 ? "Host route state contains only running process entries." : `${staleHostRoutes.length} host route entr${staleHostRoutes.length === 1 ? "y is" : "ies are"} stale (process not running).`,
+    suggestion: staleHostRoutes.length === 0 ? void 0 : "Re-run the affected host app(s): dev app run <name> --repo <path>"
+  });
+  const summary = collectSummary(checks);
+  const nextSteps = collectNextSteps(checks, statusNextSteps);
+  return {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    repoPath: resolvedRepoPath,
+    summary,
+    checks,
+    nextSteps
+  };
+}
+var import_node_fs5, import_node_path4;
+var init_doctor = __esm({
+  "src/core/doctor.ts"() {
+    "use strict";
+    import_node_fs5 = __toESM(require("fs"));
+    import_node_path4 = __toESM(require("path"));
+    init_docker();
+    init_host_routes();
+    init_repo_config();
+    init_router();
+    init_status();
+    init_routes();
+  }
+});
+
+// src/commands/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  runDoctorCommand: () => runDoctorCommand
+});
+async function runDoctorCommand(options) {
+  const report = await buildDoctorReport({ repo: options.repo });
+  if (options.json) {
+    printJSON(report);
+    return;
+  }
+  printDoctorReport(report);
+}
+var init_doctor2 = __esm({
+  "src/commands/doctor.ts"() {
+    "use strict";
+    init_doctor();
+    init_output();
+  }
+});
+
+// src/commands/ls.ts
+var ls_exports = {};
+__export(ls_exports, {
+  runLsCommand: () => runLsCommand
+});
+async function runLsCommand(json) {
+  const containers = await listContainers(true);
+  const tlsEnabled = isTLSEnabled();
+  const docker = discoverRoutes(containers, tlsEnabled, DEVNET_NAME);
+  const host = listHostRoutes(tlsEnabled);
+  const routes = [...docker.routes, ...host];
+  const duplicateHosts = findDuplicateHosts(routes);
+  const result = { routes, duplicateHosts };
+  if (json) {
+    printJSON(result);
+    return;
+  }
+  printRoutes(result.routes, result.duplicateHosts);
+}
+var init_ls = __esm({
+  "src/commands/ls.ts"() {
+    "use strict";
+    init_docker();
+    init_host_routes();
+    init_output();
+    init_routes();
+    init_router();
+  }
+});
+
+// src/commands/open.ts
+var open_exports = {};
+__export(open_exports, {
+  runOpenCommand: () => runOpenCommand
+});
+async function runOpenCommand(name) {
+  const containers = await listContainers(true);
+  const tlsEnabled = isTLSEnabled();
+  const { routes: dockerRoutes } = discoverRoutes(containers, tlsEnabled, DEVNET_NAME);
+  const hostRoutes = listHostRoutes(tlsEnabled);
+  const route = resolveRouteByName([...dockerRoutes, ...hostRoutes], name);
+  const url = route.urls[0];
+  if (!url) {
+    throw new Error(`Route '${name}' has no URL.`);
+  }
+  if (route.protocol !== "http") {
+    process.stdout.write(`Route '${route.serviceName}' is ${route.protocol}: ${url}
+`);
+    process.stdout.write(
+      'Use a TLS-enabled Postgres client (for example: psql "host=<host> port=5432 sslmode=require ...").\n'
+    );
+    return;
+  }
+  const result = (0, import_node_child_process4.spawnSync)("open", [url], { encoding: "utf-8" });
+  if (result.status !== 0) {
+    const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
+  }
+  process.stdout.write(`Opened ${url}
+`);
+}
+var import_node_child_process4;
+var init_open = __esm({
+  "src/commands/open.ts"() {
+    "use strict";
+    import_node_child_process4 = require("child_process");
+    init_docker();
+    init_host_routes();
+    init_routes();
+    init_router();
+  }
+});
+
+// src/commands/repo-init.ts
+var repo_init_exports = {};
+__export(repo_init_exports, {
+  runRepoInitCommand: () => runRepoInitCommand
+});
+async function runRepoInitCommand(options) {
+  const repoPath = resolveRepoPath(options.repo);
+  const result = initRepoConfig(repoPath);
+  if (!result.created) {
+    process.stdout.write(`Already exists: ${getRepoConfigPath(repoPath)}
+`);
+    return;
+  }
+  process.stdout.write(`Created ${result.configPath}
+`);
+  process.stdout.write("Next: dev app add --name <name> --host <host.localhost> --protocol <http|tcp> --runtime <host|docker>\n");
+}
+var init_repo_init = __esm({
+  "src/commands/repo-init.ts"() {
+    "use strict";
+    init_repo_config();
+  }
+});
+
+// src/commands/app-add.ts
+var app_add_exports = {};
+__export(app_add_exports, {
+  runAppAddCommand: () => runAppAddCommand
+});
+function normalizeOptions(options) {
+  return {
+    name: options.name,
+    host: options.host,
+    protocol: options.protocol,
+    runtime: options.runtime,
+    service: options.service,
+    port: options.port,
+    composeFiles: options.composeFile ?? [],
+    router: options.router,
+    tcpProtocol: options.tcpProtocol,
+    command: options.command,
+    cwd: options.cwd,
+    dependsOn: options.dependsOn ?? []
+  };
+}
+async function runAppAddCommand(options) {
+  const repoPath = resolveRepoPath(options.repo);
+  const result = upsertRepoApp(repoPath, normalizeOptions(options));
+  process.stdout.write(`Updated ${result.configPath}
+`);
+  process.stdout.write(
+    `App '${result.app.name}' (${result.app.protocol}/${result.app.runtime}) -> ${result.app.host}
+`
+  );
+  process.stdout.write(`Run: dev app run ${result.app.name} --repo ${repoPath}
+`);
+}
+var init_app_add = __esm({
+  "src/commands/app-add.ts"() {
+    "use strict";
+    init_repo_config();
+  }
+});
+
+// src/commands/app-ls.ts
+var app_ls_exports = {};
+__export(app_ls_exports, {
+  runAppLsCommand: () => runAppLsCommand
+});
+async function runAppLsCommand(options) {
+  const repoPath = resolveRepoPath(options.repo);
+  const config = loadRepoConfig(repoPath);
+  if (options.json) {
+    printJSON({
+      repoPath,
+      configPath: `${repoPath}/.devrouter.yml`,
+      apps: config.apps
+    });
+    return;
+  }
+  printConfigApps(repoPath, config.apps);
+}
+var init_app_ls = __esm({
+  "src/commands/app-ls.ts"() {
+    "use strict";
+    init_output();
+    init_repo_config();
+  }
+});
+
+// src/core/paths.ts
+function assertPathWithinRepo(filePath, repoRoot, label) {
+  const resolvedRoot = import_node_path5.default.resolve(repoRoot);
+  const resolved = import_node_path5.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path5.default.sep)) {
+    throw new Error(`${label} path '${filePath}' escapes the repository root.`);
+  }
+  return resolved;
+}
+var import_node_path5;
+var init_paths = __esm({
+  "src/core/paths.ts"() {
+    "use strict";
+    import_node_path5 = __toESM(require("path"));
+  }
+});
+
+// src/core/docker-run.ts
+function sanitizeRouterId(value) {
+  return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function repoHash(repoPath) {
+  return (0, import_node_crypto.createHash)("sha1").update(import_node_path6.default.resolve(repoPath)).digest("hex").slice(0, 12);
+}
+function asDockerApp(app) {
+  return app.runtime === "docker";
+}
+function ensureComposeFiles(dockerApps) {
+  const files = [];
+  for (const app of dockerApps) {
+    for (const file of app.docker.composeFiles) {
+      if (!files.includes(file)) {
+        files.push(file);
+      }
+    }
+  }
+  return files.length > 0 ? files : ["docker-compose.yml"];
+}
+function buildOverlayDocument(dockerApps) {
+  const services = {};
+  for (const app of dockerApps) {
+    const routerId = sanitizeRouterId(app.docker.router ?? app.name);
+    const labels = {
+      "traefik.enable": "true",
+      "traefik.docker.network": "devnet"
+    };
+    if (app.protocol === "http") {
+      labels[`traefik.http.routers.${routerId}.rule`] = `Host(\`${app.host}\`)`;
+      labels[`traefik.http.routers.${routerId}.entrypoints`] = "web,websecure";
+      labels[`traefik.http.routers.${routerId}.tls`] = "true";
+      labels[`traefik.http.services.${routerId}.loadbalancer.server.port`] = String(
+        app.docker.internalPort
+      );
+    } else {
+      labels[`traefik.tcp.routers.${routerId}.rule`] = `HostSNI(\`${app.host}\`)`;
+      labels[`traefik.tcp.routers.${routerId}.entrypoints`] = "postgres";
+      labels[`traefik.tcp.routers.${routerId}.tls`] = "true";
+      labels[`traefik.tcp.services.${routerId}.loadbalancer.server.port`] = String(
+        app.docker.internalPort
+      );
+    }
+    services[app.docker.service] = {
+      networks: ["devnet"],
+      labels
+    };
+  }
+  return {
+    services,
+    networks: {
+      devnet: {
+        external: true
+      }
+    }
+  };
+}
+function prepareDockerOverlay(repoPath, appName, apps) {
+  const dockerApps = apps.filter(asDockerApp);
+  if (dockerApps.length === 0) {
+    throw new Error("No docker apps selected to prepare compose overlay.");
+  }
+  const cachePath = import_node_path6.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs6.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path6.default.join(cachePath, "compose.devrouter.yml");
+  const overlayDocument = buildOverlayDocument(dockerApps);
+  import_node_fs6.default.writeFileSync(overlayPath, import_yaml3.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  return {
+    overlayPath,
+    composeFiles: ensureComposeFiles(dockerApps),
+    dockerApps
+  };
+}
+function runDockerComposeUp(repoPath, composeFiles, overlayPath, services) {
+  const fileArgs = [];
+  for (const composeFile of composeFiles) {
+    const resolved = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
+    fileArgs.push("-f", resolved);
+  }
+  const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", ...services];
+  const result = (0, import_node_child_process5.spawnSync)("docker", args, {
+    encoding: "utf-8",
+    cwd: repoPath
+  });
+  if (result.status !== 0) {
+    const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    throw new Error(`docker compose up failed: ${details || "unknown error"}`);
+  }
+}
+var import_node_fs6, import_node_path6, import_node_crypto, import_node_child_process5, import_yaml3;
+var init_docker_run = __esm({
+  "src/core/docker-run.ts"() {
+    "use strict";
+    import_node_fs6 = __toESM(require("fs"));
+    import_node_path6 = __toESM(require("path"));
+    import_node_crypto = require("crypto");
+    import_node_child_process5 = require("child_process");
+    import_yaml3 = __toESM(require("yaml"));
+    init_router();
+    init_paths();
+  }
+});
+
+// src/core/app-run.ts
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+function toError(error) {
+  if (error instanceof Error) {
+    return error;
+  }
+  return new Error(String(error));
+}
+function isProcessRunning(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readProcessTree(rootPid) {
+  const result = (0, import_node_child_process6.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  if (result.status !== 0) {
+    return [rootPid];
+  }
+  const childrenByParent = /* @__PURE__ */ new Map();
+  for (const line of result.stdout.split("\n")) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 2) {
+      continue;
+    }
+    const pid = Number(parts[0]);
+    const ppid = Number(parts[1]);
+    if (!Number.isInteger(pid) || !Number.isInteger(ppid)) {
+      continue;
+    }
+    const children = childrenByParent.get(ppid) ?? [];
+    children.push(pid);
+    childrenByParent.set(ppid, children);
+  }
+  const found = /* @__PURE__ */ new Set([rootPid]);
+  const queue = [rootPid];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    if (current === void 0) {
+      continue;
+    }
+    for (const child of childrenByParent.get(current) ?? []) {
+      if (found.has(child)) {
+        continue;
+      }
+      found.add(child);
+      queue.push(child);
+    }
+  }
+  return Array.from(found.values());
+}
+function killProcessTree(rootPid, signal) {
+  const pids = readProcessTree(rootPid).sort((a, b) => b - a);
+  for (const pid of pids) {
+    if (!isProcessRunning(pid)) {
+      continue;
+    }
+    try {
+      process.kill(pid, signal);
+    } catch {
+    }
+  }
+}
+async function terminateProcessTree(rootPid) {
+  if (!isProcessRunning(rootPid)) {
+    return;
+  }
+  killProcessTree(rootPid, "SIGTERM");
+  const deadline = Date.now() + PROCESS_TERMINATION_GRACE_MS;
+  while (Date.now() < deadline) {
+    if (!isProcessRunning(rootPid)) {
+      return;
+    }
+    await sleep(100);
+  }
+  if (isProcessRunning(rootPid)) {
+    killProcessTree(rootPid, "SIGKILL");
+  }
+}
+function parseListeningPorts(outputText) {
+  const ports = /* @__PURE__ */ new Set();
+  for (const line of outputText.split("\n")) {
+    const match = line.match(/:(\d+)\s+\(LISTEN\)\s*$/);
+    if (!match) {
+      continue;
+    }
+    const port = Number(match[1]);
+    if (Number.isInteger(port) && port > 0) {
+      ports.add(port);
+    }
+  }
+  return Array.from(ports.values()).sort((a, b) => a - b);
+}
+function detectListeningPorts(pids) {
+  if (pids.length === 0) {
+    return [];
+  }
+  const result = (0, import_node_child_process6.spawnSync)(
+    "lsof",
+    ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")],
+    { encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    return [];
+  }
+  return parseListeningPorts(result.stdout);
+}
+function parseAllowedPortRange(value) {
+  const match = value.trim().match(/^(\d+)-(\d+)$/);
+  if (!match) {
+    return { min: 1024, max: 65535 };
+  }
+  const min = Number(match[1]);
+  const max = Number(match[2]);
+  if (!Number.isInteger(min) || !Number.isInteger(max) || min < 1 || max > 65535 || min > max) {
+    return { min: 1024, max: 65535 };
+  }
+  return { min, max };
+}
+function selectAllowedPort(ports, app) {
+  const denyPorts = /* @__PURE__ */ new Set([80, 443, 5432, ...app.hostRun.strategy.denyPorts]);
+  const deniedPort = ports.find((port) => denyPorts.has(port));
+  if (deniedPort !== void 0) {
+    throw new Error(
+      `Detected forbidden host app port ${deniedPort}. Traefik owns 80/443/5432.`
+    );
+  }
+  const range = parseAllowedPortRange(app.hostRun.strategy.allowPortRange);
+  return ports.find((port) => port >= range.min && port <= range.max && !denyPorts.has(port));
+}
+async function runHostApp(repoPath, app) {
+  const routeId = buildHostRouteId(repoPath, app.name);
+  const commandCwd = assertPathWithinRepo(app.hostRun.cwd, repoPath, "hostRun.cwd");
+  const child = (0, import_node_child_process6.spawn)(app.hostRun.command, {
+    cwd: commandCwd,
+    stdio: "inherit",
+    shell: true
+  });
+  if (!child.pid) {
+    throw new Error(`Failed to start command '${app.hostRun.command}'.`);
+  }
+  process.stdout.write(`Started '${app.hostRun.command}' for '${app.name}' in ${commandCwd}
+`);
+  const childExit = new Promise((resolve) => {
+    child.once("exit", (code) => resolve({ code }));
+  });
+  let stopRequested = false;
+  let fatalError = null;
+  let currentPort;
+  const startedAt = Date.now();
+  const onSignal = (signal) => {
+    stopRequested = true;
+    if (isProcessRunning(child.pid)) {
+      killProcessTree(child.pid, signal);
+    }
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  try {
+    while (true) {
+      if (stopRequested) {
+        break;
+      }
+      if (!isProcessRunning(child.pid)) {
+        break;
+      }
+      const ports = detectListeningPorts(readProcessTree(child.pid));
+      const selectedPort = selectAllowedPort(ports, app);
+      if (selectedPort !== void 0 && selectedPort !== currentPort) {
+        currentPort = selectedPort;
+        upsertHostRoute({
+          name: app.name,
+          host: app.host,
+          protocol: "http",
+          repoPath,
+          port: selectedPort,
+          mode: "run",
+          pid: child.pid,
+          command: app.hostRun.command
+        });
+        process.stdout.write(`Route ${app.host} -> http://host.docker.internal:${selectedPort}
+`);
+      } else if (!currentPort && Date.now() - startedAt > INITIAL_PORT_TIMEOUT_MS) {
+        throw new Error(
+          `No listening TCP port detected for '${app.name}' after ${Math.floor(
+            INITIAL_PORT_TIMEOUT_MS / 1e3
+          )}s.`
+        );
+      }
+      await sleep(POLL_INTERVAL_MS);
+    }
+  } catch (error) {
+    fatalError = toError(error);
+    stopRequested = true;
+    await terminateProcessTree(child.pid);
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+    const processStillRunning = isProcessRunning(child.pid);
+    if (stopRequested || fatalError || !processStillRunning) {
+      removeHostRouteById(routeId);
+    }
+  }
+  const exit = await childExit;
+  if (fatalError) {
+    throw fatalError;
+  }
+  if (exit.code !== null && exit.code !== 0) {
+    throw new Error(`Host command for '${app.name}' exited with code ${exit.code}.`);
+  }
+}
+function uniqueApps(apps) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const app of apps) {
+    byName.set(app.name, app);
+  }
+  return Array.from(byName.values());
+}
+function dependencyNames(apps) {
+  return apps.map((entry) => entry.name).sort();
+}
+async function shouldStartDependencies(appName, dependencies, yes) {
+  if (dependencies.length === 0) {
+    return false;
+  }
+  if (yes) {
+    return true;
+  }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error(
+      `App '${appName}' has dependencies (${dependencyNames(
+        dependencies
+      ).join(", ")}). Re-run with --yes in non-interactive mode.`
+    );
+  }
+  const rl = (0, import_promises.createInterface)({ input: import_node_process.stdin, output: import_node_process.stdout });
+  try {
+    const answer = await rl.question(
+      `Start dependencies for '${appName}' (${dependencyNames(dependencies).join(", ")})? [y/N] `
+    );
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+async function runConfiguredApp(options) {
+  ensureRouterFiles();
+  await ensureNetwork(DEVNET_NAME);
+  const repoPath = resolveRepoPath(options.repoPath);
+  const { config, app } = resolveAppByName(repoPath, options.name);
+  const dependencies = resolveAppDependencies(config, app);
+  const unsupportedDependencies = dependencies.filter((entry) => entry.runtime !== "docker");
+  if (unsupportedDependencies.length > 0) {
+    throw new Error(
+      `App '${app.name}' has host-runtime dependencies (${dependencyNames(
+        unsupportedDependencies
+      ).join(", ")}). v1 only auto-starts docker dependencies. Start host dependencies manually before running this app.`
+    );
+  }
+  const startDependencies = await shouldStartDependencies(
+    app.name,
+    dependencies,
+    Boolean(options.yes)
+  );
+  const selectedApps = uniqueApps(
+    startDependencies ? [app, ...dependencies] : [app]
+  );
+  const selectedDockerApps = selectedApps.filter(
+    (entry) => entry.runtime === "docker"
+  );
+  const startedServices = [];
+  if (selectedDockerApps.length > 0) {
+    const overlay = prepareDockerOverlay(repoPath, app.name, selectedDockerApps);
+    const services = selectedDockerApps.map((entry) => entry.docker.service);
+    runDockerComposeUp(repoPath, overlay.composeFiles, overlay.overlayPath, services);
+    startedServices.push(...services);
+  }
+  if (app.runtime === "host") {
+    await runHostApp(repoPath, app);
+  } else if (app.protocol === "tcp") {
+    process.stdout.write(
+      `TCP route ready: postgres://${app.host}:5432 (tls required, e.g. sslmode=require)
+`
+    );
+  }
+  return {
+    repoPath,
+    appName: app.name,
+    mode: app.runtime,
+    startedServices,
+    dependencyApps: startDependencies ? dependencyNames(dependencies) : []
+  };
+}
+var import_promises, import_node_child_process6, import_node_process, POLL_INTERVAL_MS, INITIAL_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var init_app_run = __esm({
+  "src/core/app-run.ts"() {
+    "use strict";
+    import_promises = require("readline/promises");
+    import_node_child_process6 = require("child_process");
+    import_node_process = require("process");
+    init_docker_run();
+    init_repo_config();
+    init_host_routes();
+    init_docker();
+    init_router();
+    init_paths();
+    POLL_INTERVAL_MS = 1e3;
+    INITIAL_PORT_TIMEOUT_MS = 3e4;
+    PROCESS_TERMINATION_GRACE_MS = 3e3;
+  }
+});
+
+// src/commands/app-run.ts
+var app_run_exports = {};
+__export(app_run_exports, {
+  runAppRunCommand: () => runAppRunCommand
+});
+async function runAppRunCommand(options) {
+  const result = await runConfiguredApp({
+    name: options.name,
+    repoPath: options.repo,
+    yes: options.yes
+  });
+  if (result.startedServices.length > 0) {
+    process.stdout.write(
+      `Started docker services: ${result.startedServices.join(", ")}
+`
+    );
+  }
+  if (result.dependencyApps.length > 0) {
+    process.stdout.write(`Configured dependencies: ${result.dependencyApps.join(", ")}
+`);
+  }
+  process.stdout.write(`App '${result.appName}' is running in ${result.mode} mode.
+`);
+}
+var init_app_run2 = __esm({
+  "src/commands/app-run.ts"() {
+    "use strict";
+    init_app_run();
+  }
+});
+
+// src/commands/app-rm.ts
+var app_rm_exports = {};
+__export(app_rm_exports, {
+  runAppRmCommand: () => runAppRmCommand
+});
+async function runAppRmCommand(options) {
+  const repoPath = resolveRepoPath(options.repo);
+  const result = removeRepoApp(repoPath, options.name);
+  if (!result.removed) {
+    throw new Error(`App '${options.name}' not found in ${result.configPath}.`);
+  }
+  try {
+    removeHostRouteByName(options.name, repoPath);
+  } catch {
+  }
+  process.stdout.write(`Removed '${options.name}' from ${result.configPath}
+`);
+}
+var init_app_rm = __esm({
+  "src/commands/app-rm.ts"() {
+    "use strict";
+    init_host_routes();
+    init_repo_config();
+  }
+});
+
+// src/core/tls.ts
+function runOrThrow(command, args) {
+  const result = (0, import_node_child_process7.spawnSync)(command, args, {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0) {
+    const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    throw new Error(`${command} ${args.join(" ")} failed: ${details || "unknown error"}`);
+  }
+}
+function commandExists(command) {
+  const result = (0, import_node_child_process7.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  return result.status === 0;
+}
+function ensureMkcert() {
+  if (commandExists("mkcert")) {
+    return;
+  }
+  if (!commandExists("brew")) {
+    throw new Error("mkcert is missing and Homebrew is not available.");
+  }
+  runOrThrow("brew", ["install", "mkcert"]);
+}
+async function installTLS() {
+  ensureRouterFiles();
+  const alreadyEnabled = isTLSEnabled();
+  ensureMkcert();
+  runOrThrow("mkcert", ["-install"]);
+  runOrThrow("mkcert", [
+    "-cert-file",
+    CERT_FILE,
+    "-key-file",
+    CERT_KEY_FILE,
+    "localhost",
+    "*.localhost"
+  ]);
+  setTLSEnabled(true);
+  refreshHostRoutesDynamicFile();
+  const routerContainer = await findContainerByName("devrouter-traefik");
+  if (routerContainer && await isContainerRunning("devrouter-traefik")) {
+    startRouterStack();
+  }
+  return { alreadyEnabled };
+}
+var import_node_child_process7;
+var init_tls = __esm({
+  "src/core/tls.ts"() {
+    "use strict";
+    import_node_child_process7 = require("child_process");
+    init_router();
+    init_docker();
+    init_host_routes();
+  }
+});
+
+// src/commands/tls.ts
+var tls_exports = {};
+__export(tls_exports, {
+  runTLSInstallCommand: () => runTLSInstallCommand
+});
+async function runTLSInstallCommand() {
+  const result = await installTLS();
+  if (result.alreadyEnabled) {
+    process.stdout.write("TLS was already enabled and has been refreshed.\n");
+    return;
+  }
+  process.stdout.write("TLS is now enabled for localhost and *.localhost.\n");
+}
+var init_tls2 = __esm({
+  "src/commands/tls.ts"() {
+    "use strict";
+    init_tls();
+  }
+});
+
+// src/cli.ts
+var import_commander = require("commander");
+function withErrorHandling(action) {
+  return async (...args) => {
+    try {
+      await action(...args);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exitCode = 1;
+    }
+  };
+}
+var program = new import_commander.Command();
+program.name("dev").description("Local dev router CLI for stable .localhost routing across repositories").version("0.1.0").showSuggestionAfterError(true).showHelpAfterError();
+program.command("init").description("Print an AI onboarding prompt template for adapting a repository to devrouter").option("--repo <path>", "Repository path to embed in the prompt (defaults to current directory)").option("--entries-json <json>", "Optional JSON array of app entries to embed in the prompt").option("--json", "Output prompt and command intents as JSON").action(withErrorHandling(async (options) => {
+  const { runInitCommand: runInitCommand2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+  await runInitCommand2(options);
+}));
+program.command("up").description("Ensure devnet and start shared Traefik (reserves 80/443/5432)").action(withErrorHandling(async () => {
+  const { runUpCommand: runUpCommand2 } = await Promise.resolve().then(() => (init_up(), up_exports));
+  await runUpCommand2();
+}));
+program.command("down").description("Stop the shared Traefik router stack").action(withErrorHandling(async () => {
+  const { runDownCommand: runDownCommand2 } = await Promise.resolve().then(() => (init_down(), down_exports));
+  await runDownCommand2();
+}));
+program.command("status").description("Show router/container/network/TLS status and bound ports").option("--json", "Output JSON").option("--repo <path>", "Repository path for repo-specific readiness insights").action(withErrorHandling(async (options) => {
+  const { runStatusCommand: runStatusCommand2 } = await Promise.resolve().then(() => (init_status2(), status_exports));
+  await runStatusCommand2(options);
+}));
+program.command("doctor").alias("verify").description("Run global + repo diagnostics with actionable fixes for humans and AI agents").option("--repo <path>", "Repository path to validate (defaults to current directory)").option("--json", "Output JSON").action(withErrorHandling(async (options) => {
+  const { runDoctorCommand: runDoctorCommand2 } = await Promise.resolve().then(() => (init_doctor2(), doctor_exports));
+  await runDoctorCommand2(options);
+}));
+program.command("ls").alias("list").description("List active HTTP and TCP routes from Docker labels and host runtime state").option("--json", "Output JSON").action(withErrorHandling(async (options) => {
+  const { runLsCommand: runLsCommand2 } = await Promise.resolve().then(() => (init_ls(), ls_exports));
+  await runLsCommand2(Boolean(options.json));
+}));
+program.command("open").description("Open HTTP routes in browser or show TCP connection hints by name/host").argument("<name>", "service name or host").action(withErrorHandling(async (name) => {
+  const { runOpenCommand: runOpenCommand2 } = await Promise.resolve().then(() => (init_open(), open_exports));
+  await runOpenCommand2(name);
+}));
+var repoCommand = program.command("repo").description("Create and manage `.devrouter.yml` in repositories");
+repoCommand.command("init").description("Initialize `.devrouter.yml` in a repository").option("--repo <path>", "Repository path (defaults to current directory)").action(withErrorHandling(async (options) => {
+  const { runRepoInitCommand: runRepoInitCommand2 } = await Promise.resolve().then(() => (init_repo_init(), repo_init_exports));
+  await runRepoInitCommand2(options);
+}));
+var appCommand = program.command("app").description("Manage app entries and runtime actions from `.devrouter.yml`");
+appCommand.command("add").description("Add or update one app definition in `.devrouter.yml`").requiredOption("--name <name>", "App name").requiredOption("--host <host>", "Hostname ending with .localhost").requiredOption("--protocol <protocol>", "http or tcp").requiredOption("--runtime <runtime>", "host or docker").option("--service <service>", "Docker service name (runtime=docker)").option("--port <port>", "Internal port (runtime=docker)", (value) => Number(value)).option("--compose-file <file>", "Compose file path (repeatable)", (value, prev) => {
+  const next = prev ?? [];
+  next.push(value);
+  return next;
+}).option("--router <id>", "Optional Traefik router ID").option("--tcp-protocol <protocol>", "tcp protocol (postgres)").option("--command <command>", "Host command (runtime=host)").option("--cwd <path>", "Host command working directory (runtime=host)").option("--depends-on <app>", "Dependency app name (repeatable)", (value, prev) => {
+  const next = prev ?? [];
+  next.push(value);
+  return next;
+}).option("--repo <path>", "Repository path (defaults to current directory)").action(withErrorHandling(async (options) => {
+  const { runAppAddCommand: runAppAddCommand2 } = await Promise.resolve().then(() => (init_app_add(), app_add_exports));
+  await runAppAddCommand2(options);
+}));
+appCommand.command("ls").description("List app definitions from `.devrouter.yml`").option("--repo <path>", "Repository path (defaults to current directory)").option("--json", "Output JSON").action(withErrorHandling(async (options) => {
+  const { runAppLsCommand: runAppLsCommand2 } = await Promise.resolve().then(() => (init_app_ls(), app_ls_exports));
+  await runAppLsCommand2(options);
+}));
+appCommand.command("run").description("Run one configured app and reconcile its active route").argument("<name>", "Configured app name").option("--repo <path>", "Repository path (defaults to current directory)").option("--yes", "Auto-start dependencies without prompt").action(withErrorHandling(async (name, _options, command) => {
+  const options = command.opts();
+  const { runAppRunCommand: runAppRunCommand2 } = await Promise.resolve().then(() => (init_app_run2(), app_run_exports));
+  await runAppRunCommand2({ name, repo: options.repo, yes: Boolean(options.yes) });
+}));
+appCommand.command("rm").description("Remove one app definition from `.devrouter.yml`").argument("<name>", "Configured app name").option("--repo <path>", "Repository path (defaults to current directory)").action(withErrorHandling(async (name, _options, command) => {
+  const options = command.opts();
+  const { runAppRmCommand: runAppRmCommand2 } = await Promise.resolve().then(() => (init_app_rm(), app_rm_exports));
+  await runAppRmCommand2({ name, repo: options.repo });
+}));
+var tlsCommand = program.command("tls").description("TLS helpers for HTTPS and Postgres SNI routing");
+tlsCommand.command("install").description("Install mkcert certs and enable HTTPS + TLS redirect behavior").action(withErrorHandling(async () => {
+  const { runTLSInstallCommand: runTLSInstallCommand2 } = await Promise.resolve().then(() => (init_tls2(), tls_exports));
+  await runTLSInstallCommand2();
+}));
+program.parseAsync(process.argv);