@quatronic/qore 0.1.0 → 0.1.1

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
 
 // src/cli/io.ts
-import { select } from "@inquirer/prompts";
+import { confirm, select } from "@inquirer/prompts";
 import { createInterface } from "readline";
 
 // src/platform/browser.ts
@@ -25,8 +25,11 @@ var EXIT = {
   QORE_INTERNAL: 1,
   QORE_KEYCHAIN_UNAVAILABLE: 1,
   QORE_KEYCHAIN_DENIED: 1,
+  QORE_GIT_UNAVAILABLE: 1,
   QORE_CONTEXT_REQUIRED: 2,
   QORE_CONTEXT_INVALID: 2,
+  QORE_CONTEXT_UNSUPPORTED: 2,
+  QORE_APP_AMBIGUOUS: 2,
   QORE_NOT_LOGGED_IN: 4,
   QORE_SESSION_EXPIRED: 4,
   QORE_LOGIN_EXPIRED: 4,
@@ -109,12 +112,20 @@ function processIo(interactive) {
         throw e;
       }
     },
+    async confirm(message) {
+      try {
+        return await confirm({ message, default: false });
+      } catch (e) {
+        if (e.name === "ExitPromptError") throw new CancelledError();
+        throw e;
+      }
+    },
     waitForEnter: createWaitForEnter(process.stdin, process.stderr),
     openUrl: openBrowser
   };
 }
 function createWaitForEnter(input, output) {
-  return (message, signal) => new Promise((resolve, reject) => {
+  return (message, signal) => new Promise((resolve3, reject) => {
     const rl = createInterface({ input, output, terminal: true });
     const onAbort = () => {
       rl.close();
@@ -123,7 +134,7 @@ function createWaitForEnter(input, output) {
     const done = () => {
       signal.removeEventListener("abort", onAbort);
       rl.close();
-      resolve();
+      resolve3();
     };
     signal.addEventListener("abort", onAbort, { once: true });
     rl.on("SIGINT", () => {
@@ -181,7 +192,10 @@ var BY_SERVER_CODE = {
   "app.access.denied": "QORE_ACCESS_DENIED",
   "auth.scope.insufficient": "QORE_ACCESS_DENIED",
   "cli.upgrade_required": "QORE_UPGRADE_REQUIRED",
-  "rate_limited": "QORE_RATE_LIMITED"
+  "rate_limited": "QORE_RATE_LIMITED",
+  "module.not_found": "QORE_RESOURCE_NOT_FOUND",
+  "tenant.not_found": "QORE_RESOURCE_NOT_FOUND",
+  "module.app_ambiguous": "QORE_APP_AMBIGUOUS"
 };
 function byStatus(status) {
   if (status === 403) return "QORE_ACCESS_DENIED";
@@ -202,18 +216,22 @@ async function problemToError(res) {
   const requestId = res.headers.get("x-request-id") ?? void 0;
   const details = {};
   if (body.detail && typeof body.detail === "object") Object.assign(details, body.detail);
-  const detail = typeof body.detail === "string" && body.detail ? body.detail : void 0;
-  if (detail) details.detail = detail;
+  const detail2 = typeof body.detail === "string" && body.detail ? body.detail : void 0;
+  if (detail2) details.detail = detail2;
   const retry = res.headers.get("retry-after");
   if (retry && /^\d+$/.test(retry)) details.retryAfter = Number(retry);
-  const hint = code === "QORE_UPGRADE_REQUIRED" ? "Run: npm i -g @quatronic/qore" : code === "QORE_RATE_LIMITED" ? `Wait ${details.retryAfter ?? "a moment"} s and retry.` : code === "QORE_API_UNAVAILABLE" ? "Qore is temporarily unavailable; retry in a minute." : void 0;
+  const hint = code === "QORE_UPGRADE_REQUIRED" ? "Run: npm i -g @quatronic/qore" : code === "QORE_RATE_LIMITED" ? `Wait ${details.retryAfter ?? "a moment"} s and retry.` : code === "QORE_API_UNAVAILABLE" ? "Qore is temporarily unavailable; retry in a minute." : code === "QORE_APP_AMBIGUOUS" ? "Pass --app <slug>." : void 0;
+  const apps = body.detail?.apps;
+  const candidates = code === "QORE_APP_AMBIGUOUS" && Array.isArray(apps) ? apps.map((a) => ({ kind: "app", id: a.id, slug: a.slug, name: a.name })) : void 0;
+  if (candidates) delete details.apps;
   const genericTitle = !body.title || body.title === "HTTP error" || body.title === serverCode;
-  const message = genericTitle && detail || body.title || `Request failed (${res.status})`;
+  const message = genericTitle && detail2 || body.title || `Request failed (${res.status})`;
   return new QoreError(code, message, {
     status: res.status,
     requestId,
     serverCode,
     hint,
+    candidates,
     details: Object.keys(details).length ? details : void 0
   });
 }
@@ -243,15 +261,19 @@ function renderError(io2, err, json2, colorEnabled = pc.isColorSupported) {
 }
 
 // src/cli/program.ts
+function argvBeforeSeparator(argv2) {
+  const i = argv2.indexOf("--");
+  return i === -1 ? argv2 : argv2.slice(0, i);
+}
 function jsonFromArgv(argv2) {
-  return argv2.some((a) => a === "--json" || a.startsWith("--json="));
+  return argvBeforeSeparator(argv2).some((a) => a === "--json" || a.startsWith("--json="));
 }
 function requestLog(ctx) {
   return ctx.opts().verbose ? (line) => ctx.io.err(line) : void 0;
 }
-function buildProgram(deps2, io2, signal, register) {
+function buildProgram(deps2, io2, signal, register, setExitCode) {
   const program = new Command("qore").description("Qore developer CLI").option("--portal <name|url>", "prod, staging, or a portal URL (default: the portal you last logged in to, else prod)").option("--json", "print exactly one JSON document on stdout").option("--no-input", "never prompt").option("--verbose", "log request lines (never secrets)").option("--no-color", "disable colours").exitOverride().configureOutput({ writeOut: (s) => io2.out(s.trimEnd()), writeErr: (s) => io2.err(s.trimEnd()) });
-  const ctx = { deps: deps2, io: io2, signal, opts: () => program.opts() };
+  const ctx = { deps: deps2, io: io2, signal, opts: () => program.opts(), setExitCode };
   for (const r of register) r(program, ctx);
   return program;
 }
@@ -259,10 +281,13 @@ async function run(argv2, deps2, io2, signal, register) {
   const json2 = jsonFromArgv(argv2);
   const parseIo = json2 ? { ...io2, err: () => {
   } } : io2;
-  const program = buildProgram(deps2, parseIo, signal, register);
+  const state = {};
+  const program = buildProgram(deps2, parseIo, signal, register, (code) => {
+    state.exitCode = code;
+  });
   try {
     await program.parseAsync(argv2, { from: "user" });
-    return 0;
+    return state.exitCode ?? 0;
   } catch (caught) {
     const e = signal.aborted && isAbortError(caught) ? new CancelledError() : caught;
     if (e instanceof CommanderError) {
@@ -276,6 +301,56 @@ async function run(argv2, deps2, io2, signal, register) {
   }
 }
 
+// src/cli/commands/env.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { chmod as chmod2, readFile as readFile3, realpath as realpath3, rename as rename2, unlink, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2, dirname as dirname3, join as join6, relative as relative2 } from "path";
+
+// src/core/context/repoConfig.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var invalid = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
+function moduleDefaults(type) {
+  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
+}
+async function readRepoConfig(root) {
+  let raw;
+  try {
+    raw = await readFile(join(root, ".qore.json"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return {};
+    throw e;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    throw invalid("not valid JSON");
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid("must be an object");
+  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
+  if (!Number.isInteger(v) || v < 1) throw invalid("schemaVersion must be a positive integer");
+  if (v > 1) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
+  }
+  for (const f of FORBIDDEN) if (f in doc) throw invalid(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
+  const out = {};
+  if (doc.envFile !== void 0) {
+    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid("envFile must be a non-empty string");
+    out.envFile = doc.envFile;
+  }
+  if (doc.localSecrets !== void 0) {
+    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
+      throw invalid("localSecrets must be a list of env key names");
+    }
+    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid("localSecrets must not contain duplicates");
+    out.localSecrets = doc.localSecrets;
+  }
+  return out;
+}
+
 // src/core/api/meta.ts
 var SUPPORTED = ["v1"];
 var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/;
@@ -326,7 +401,997 @@ function negotiate(meta, portal, cliVersion) {
       hint: "Run: npm i -g @quatronic/qore"
     });
   }
-  return { apiVersion };
+  return { apiVersion };
+}
+
+// src/core/api/capabilities.ts
+var TTL_MS = 36e5;
+function isMeta(doc) {
+  return !!doc && typeof doc === "object" && Array.isArray(doc.capabilities);
+}
+async function loadMeta(deps2, apiOrigin, refresh) {
+  const cached = (await deps2.config.read()).profiles[apiOrigin]?.meta;
+  if (!refresh && cached && isMeta(cached.doc) && deps2.now().getTime() - new Date(cached.fetchedAt).getTime() < TTL_MS) {
+    return { meta: cached.doc, cached: true };
+  }
+  const meta = await fetchMeta(deps2.fetch, apiOrigin);
+  await deps2.config.update((c) => {
+    const p = c.profiles[apiOrigin];
+    if (p) p.meta = { fetchedAt: deps2.now().toISOString(), doc: meta };
+  });
+  return { meta, cached: false };
+}
+async function ensureCapability(deps2, apiOrigin, capability) {
+  const first = await loadMeta(deps2, apiOrigin, false);
+  let meta = first.meta;
+  if (!meta.capabilities.includes(capability) && first.cached) meta = (await loadMeta(deps2, apiOrigin, true)).meta;
+  requireCapability(meta, capability, apiOrigin);
+  return meta;
+}
+function requireCapability(meta, capability, apiOrigin) {
+  if (meta.capabilities.includes(capability)) return;
+  throw new QoreError("QORE_UNSUPPORTED_BY_SERVER", `This portal does not support ${capability} yet`, {
+    hint: `The portal at ${apiOrigin} is older than this qore. Try again once it has been updated.`,
+    details: { capability, portal: apiOrigin }
+  });
+}
+
+// src/core/context/resolver.ts
+import { join as join5 } from "path";
+
+// src/core/auth/tokenStore.ts
+var TokenStore = class {
+  constructor(kc, hash) {
+    this.kc = kc;
+    this.hash = hash;
+  }
+  kc;
+  hash;
+  async read(suffix) {
+    const raw = await this.kc.get(`${this.hash}:${suffix}`);
+    if (raw === null) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  getRefresh() {
+    return this.read("refresh");
+  }
+  getAccess() {
+    return this.read("access");
+  }
+  setRefresh(v) {
+    return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v));
+  }
+  setAccess(v) {
+    return this.kc.set(`${this.hash}:access`, JSON.stringify(v));
+  }
+  async clear() {
+    await this.kc.delete(`${this.hash}:access`);
+    await this.kc.delete(`${this.hash}:refresh`);
+  }
+};
+
+// src/core/profiles.ts
+import { createHash } from "crypto";
+var BUILTIN_PORTALS = {
+  prod: {
+    apiOrigin: "https://api.quatronic.app",
+    pinnedIssuer: "https://auth.quatronic.app/realms/platform-prod"
+  },
+  staging: {
+    apiOrigin: "https://p01--portal-api-staging--hcywmtb2vksv.code.run",
+    pinnedIssuer: "https://auth-staging.quatronic.app/realms/platform-staging"
+  }
+};
+function builtinFor(origin) {
+  for (const [name, p] of Object.entries(BUILTIN_PORTALS)) {
+    if (p.apiOrigin === origin) return { ...p, builtin: name };
+  }
+  return null;
+}
+function toOrigin(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new QoreError("QORE_CONTEXT_INVALID", `Not a portal name or URL: ${raw}`, {
+      hint: "Use --portal prod, --portal staging or --portal https://\u2026"
+    });
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new QoreError("QORE_CONTEXT_INVALID", "A portal URL must use https (http only for localhost)");
+  }
+  return url.origin.toLowerCase();
+}
+function resolvePortal(arg, defaultProfile) {
+  const chosen = arg ?? defaultProfile;
+  if (chosen === void 0 || chosen === "prod") return { ...BUILTIN_PORTALS.prod, builtin: "prod" };
+  if (chosen === "staging") return { ...BUILTIN_PORTALS.staging, builtin: "staging" };
+  const origin = toOrigin(chosen);
+  return builtinFor(origin) ?? { apiOrigin: origin, pinnedIssuer: null, builtin: null };
+}
+function profileHash(apiOrigin, issuer) {
+  return createHash("sha256").update(`${apiOrigin}|${issuer}`).digest("hex").slice(0, 16);
+}
+
+// src/core/api/client.ts
+var QoreApiClient = class {
+  constructor(o) {
+    this.o = o;
+  }
+  o;
+  async once(method, path, body, force) {
+    const token = await this.o.token(force);
+    const headers = {
+      authorization: `Bearer ${token}`,
+      accept: "application/json",
+      "qore-cli-version": this.o.cliVersion,
+      "qore-command": this.o.command,
+      "user-agent": `qore/${this.o.cliVersion} (${this.o.platform})`
+    };
+    if (body !== void 0) headers["content-type"] = "application/json";
+    let res;
+    try {
+      res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {
+        method,
+        headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body)
+      });
+    } catch (e) {
+      throw fetchError(e, new URL(this.o.apiOrigin).host);
+    }
+    const rid = res.headers.get("x-request-id");
+    this.o.onRequest?.(`${method} ${path} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
+    return res;
+  }
+  async request(method, path, body) {
+    let res = await this.once(method, path, body, false);
+    if (res.status === 401) {
+      res = await this.once(method, path, body, true);
+      if (res.status === 401) {
+        throw new QoreError("QORE_SESSION_EXPIRED", "The portal no longer accepts your session", {
+          hint: "Run `qore login`.",
+          status: 401,
+          requestId: res.headers.get("x-request-id") ?? void 0
+        });
+      }
+    }
+    if (!res.ok) throw await problemToError(res);
+    return await res.json();
+  }
+  get(path) {
+    return this.request("GET", path);
+  }
+  post(path, body) {
+    return this.request("POST", path, body);
+  }
+};
+
+// src/core/auth/refresh.ts
+var SKEW_MS = 6e4;
+var RefreshCoordinator = class {
+  constructor(o) {
+    this.o = o;
+  }
+  o;
+  fresh(expiresAt) {
+    return new Date(expiresAt).getTime() - this.o.now().getTime() > SKEW_MS;
+  }
+  async rotate(scope) {
+    let stored = await this.o.store.getRefresh();
+    if (!stored) throw new QoreError("QORE_NOT_LOGGED_IN", "Not logged in", { hint: "Run `qore login`." });
+    let t;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        t = await (await this.o.oidc()).refresh(stored.rt, scope);
+        break;
+      } catch (e) {
+        if (!(e instanceof QoreError && e.code === "QORE_SESSION_EXPIRED")) throw e;
+        const now = await this.o.store.getRefresh();
+        if (now && now.rt !== stored.rt) {
+          if (attempt === 0) {
+            stored = now;
+            continue;
+          }
+          throw e;
+        }
+        await this.o.store.clear();
+        throw e;
+      }
+    }
+    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope ?? stored.scope), obtainedAt: this.o.now().toISOString() });
+    return t;
+  }
+  async accessToken(opts = {}) {
+    const seen = await this.o.store.getAccess();
+    if (!opts.force && seen && this.fresh(seen.expiresAt)) return seen.at;
+    return this.o.withLock(this.o.lockName, async () => {
+      const again = await this.o.store.getAccess();
+      if (again && again.at !== seen?.at && this.fresh(again.expiresAt)) return again.at;
+      const t = await this.rotate();
+      await this.o.store.setAccess({ at: t.accessToken, expiresAt: new Date(this.o.now().getTime() + t.expiresIn * 1e3).toISOString() });
+      return t.accessToken;
+    });
+  }
+  /** A token carrying only `scopes`, held in memory by the caller (qore mcp). */
+  async downscoped(scopes) {
+    return this.o.withLock(this.o.lockName, async () => (await this.rotate(scopes.join(" "))).accessToken);
+  }
+};
+
+// src/core/session.ts
+function loginHint(portal) {
+  return portal.builtin === "prod" ? "Run `qore login`." : `Run \`qore login --portal ${portal.builtin ?? portal.apiOrigin}\`.`;
+}
+async function openSession(deps2, portal, command, onRequest) {
+  const profile = (await deps2.config.read()).profiles[portal.apiOrigin];
+  if (!profile) throw new QoreError("QORE_NOT_LOGGED_IN", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) });
+  const hash = profileHash(profile.apiOrigin, profile.issuer);
+  const tokens = new TokenStore(deps2.keychain, hash);
+  if (!await tokens.getRefresh()) throw new QoreError("QORE_NOT_LOGGED_IN", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) });
+  const refresh = new RefreshCoordinator({ store: tokens, oidc: () => deps2.oidcFor(profile.issuer), withLock: deps2.withLock, lockName: hash, now: deps2.now });
+  const api = new QoreApiClient({
+    apiOrigin: profile.apiOrigin,
+    fetch: deps2.fetch,
+    token: (force) => refresh.accessToken({ force }),
+    cliVersion: deps2.version,
+    command,
+    platform: `${deps2.platform} ${process.arch}; node ${process.versions.node}`,
+    onRequest
+  });
+  return { profile, api, tokens, refresh };
+}
+
+// src/core/context/cache.ts
+import { join as join3 } from "path";
+
+// src/core/jsonFile.ts
+import { chmod, mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
+import { join as join2 } from "path";
+import { randomBytes } from "crypto";
+async function readJson(file) {
+  let raw;
+  try {
+    raw = await readFile2(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+  return JSON.parse(raw);
+}
+async function writeJsonAtomic(dir2, name, data) {
+  await mkdir(dir2, { recursive: true, mode: 448 });
+  const tmp = join2(dir2, `.${name}.${randomBytes(6).toString("hex")}.tmp`);
+  await writeFile(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+  await chmod(tmp, 384);
+  await rename(tmp, join2(dir2, name));
+}
+
+// src/core/context/cache.ts
+var TTL_MS2 = 24 * 36e5;
+var ResolutionCache = class {
+  constructor(dir2, now) {
+    this.dir = dir2;
+    this.now = now;
+  }
+  dir;
+  now;
+  async load() {
+    try {
+      const f = await readJson(join3(this.dir, "repos.json"));
+      if (f && f.schemaVersion === 1 && typeof f.entries === "object" && f.entries) return f;
+    } catch {
+    }
+    return { schemaVersion: 1, entries: {} };
+  }
+  fresh(e) {
+    return !!e && this.now().getTime() - new Date(e.resolvedAt).getTime() < TTL_MS2;
+  }
+  async get(origin, key) {
+    const e = (await this.load()).entries[`${origin}|${key}`];
+    return this.fresh(e) ? e.moduleId : null;
+  }
+  /** Never throws: a read-only config dir, a full disk or a Windows EPERM on rename
+   * (another qore holding the file) must not fail a command that already resolved. */
+  async put(origin, key, moduleId) {
+    const f = await this.load();
+    f.entries[`${origin}|${key}`] = { moduleId, resolvedAt: this.now().toISOString() };
+    for (const [k, e] of Object.entries(f.entries)) if (!this.fresh(e)) delete f.entries[k];
+    await this.save(f);
+  }
+  /** Never throws, like `put`. */
+  async drop(origin, key) {
+    const f = await this.load();
+    if (!(`${origin}|${key}` in f.entries)) return;
+    delete f.entries[`${origin}|${key}`];
+    await this.save(f);
+  }
+  async save(f) {
+    try {
+      await writeJsonAtomic(this.dir, "repos.json", f);
+    } catch {
+    }
+  }
+  async originsFor(keys) {
+    const f = await this.load();
+    const hits = [];
+    for (const [k, e] of Object.entries(f.entries)) {
+      const sep2 = k.lastIndexOf("|");
+      if (keys.includes(k.slice(sep2 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep2), at: new Date(e.resolvedAt).getTime() });
+    }
+    hits.sort((a, b) => b.at - a.at);
+    return [...new Set(hits.map((h) => h.origin))];
+  }
+};
+
+// src/core/context/repoKey.ts
+var SCP = /^(?:[^@/]+@)?([^:/]+):([^/].*)$/;
+var SCHEMES = /* @__PURE__ */ new Set(["https:", "http:", "ssh:", "git:"]);
+var DOT_SEGMENTS = /* @__PURE__ */ new Set([".", "..", "%2e", "%2e%2e", ".%2e", "%2e."]);
+var hasDotSegment = (pieces) => pieces.some((p) => DOT_SEGMENTS.has(p.toLowerCase()));
+function repoKey(url) {
+  let raw = url.trim();
+  if (raw.startsWith("git+")) raw = raw.slice(4);
+  if (!raw || raw.includes("\\")) return null;
+  let host;
+  let path;
+  if (raw.includes("://")) {
+    if (hasDotSegment(raw.slice(raw.indexOf("://") + 3).split("/").slice(1))) return null;
+    let u;
+    try {
+      u = new URL(raw);
+    } catch {
+      return null;
+    }
+    if (!SCHEMES.has(u.protocol.toLowerCase())) return null;
+    host = u.hostname;
+    path = u.pathname;
+  } else {
+    const m = SCP.exec(raw);
+    if (!m) return null;
+    host = m[1];
+    path = m[2];
+  }
+  const segments = path.split("/").filter(Boolean);
+  if (!host || segments.length !== 2 || hasDotSegment(segments)) return null;
+  const owner = segments[0];
+  let repo = segments[1];
+  if (repo.toLowerCase().endsWith(".git")) repo = repo.slice(0, -4);
+  if (!repo) return null;
+  return `${host.toLowerCase()}/${owner.toLowerCase()}/${repo.toLowerCase()}`;
+}
+
+// src/core/context/repoRoot.ts
+import { stat } from "fs/promises";
+import { dirname, join as join4, resolve } from "path";
+async function findRepoRoot(start) {
+  let dir2 = resolve(start);
+  for (; ; ) {
+    try {
+      await stat(join4(dir2, ".git"));
+      return dir2;
+    } catch {
+    }
+    const up = dirname(dir2);
+    if (up === dir2) return null;
+    dir2 = up;
+  }
+}
+
+// src/core/context/resolver.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var HINT_FLAG = "cd into a module repository, or pass --module <slug|id>.";
+var RESOLVE = "/api/cli/v1/repos/resolve";
+var SKIPPABLE = /* @__PURE__ */ new Set([
+  "QORE_API_UNREACHABLE",
+  "QORE_API_UNAVAILABLE",
+  "QORE_AUTH_UNAVAILABLE",
+  "QORE_NOT_LOGGED_IN",
+  "QORE_SESSION_EXPIRED"
+]);
+var label = (p) => p.builtin ?? p.apiOrigin;
+function byPreference(remotes) {
+  const rank = (r) => r.name === "origin" ? 0 : r.name === "upstream" ? 1 : 2;
+  return [...remotes].sort((a, b) => rank(a) - rank(b));
+}
+var preferred = (remotes) => byPreference(remotes)[0];
+async function repoRemotes(deps2) {
+  const root = await findRepoRoot(deps2.cwd);
+  if (!root) return null;
+  let remotes;
+  try {
+    remotes = await deps2.git.remotes(root);
+  } catch (e) {
+    if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") return { root, keyed: [], gitError: e };
+    throw e;
+  }
+  const keyed = remotes.map((r) => ({ ...r, key: repoKey(r.url) })).filter((r) => r.key !== null);
+  return { root, keyed };
+}
+function detail(session, id) {
+  return session.api.get(`/api/cli/v1/modules/${encodeURIComponent(id)}`);
+}
+async function flagOverrides(deps2, session, portal, cache, moduleId) {
+  try {
+    const keyed = (await repoRemotes(deps2))?.keyed ?? [];
+    const derived = /* @__PURE__ */ new Map();
+    const uncached = [];
+    for (const key of new Set(keyed.map((r) => r.key))) {
+      const id = await cache.get(portal.apiOrigin, key);
+      if (id) derived.set(key, /* @__PURE__ */ new Set([id]));
+      else uncached.push(key);
+    }
+    if (uncached.length > 0) {
+      try {
+        const { matches } = await session.api.post(RESOLVE, { repoKeys: uncached });
+        for (const m of matches) derived.set(m.repoKey, (derived.get(m.repoKey) ?? /* @__PURE__ */ new Set()).add(m.module.id));
+        const ids = new Set(matches.map((m) => m.module.id));
+        if (ids.size === 1) for (const m of matches) await cache.put(portal.apiOrigin, m.repoKey, m.module.id);
+      } catch (e) {
+        if (e instanceof CancelledError) throw e;
+      }
+    }
+    return byPreference(keyed).find((r) => [...derived.get(r.key) ?? []].some((id) => id !== moduleId))?.name;
+  } catch (e) {
+    if (e instanceof CancelledError) throw e;
+    return void 0;
+  }
+}
+async function byFlag(deps2, o, cache) {
+  const cfg = await deps2.config.read();
+  const portal = resolvePortal(o.portal, cfg.defaultProfile);
+  const session = await openSession(deps2, portal, o.command, o.onRequest);
+  await ensureCapability(deps2, portal.apiOrigin, "repo.resolve");
+  let id = o.module;
+  if (!UUID.test(id)) {
+    let tenantId = o.tenant ?? session.profile.activeTenant?.id;
+    if (!tenantId) {
+      const me = await session.api.get("/api/cli/v1/me");
+      if (me.tenants.length === 0) {
+        throw new QoreError("QORE_NO_DEVELOPER_ACCESS", "Your account is not a developer in any organisation", {
+          hint: "Ask an admin to invite you as a developer."
+        });
+      }
+      if (me.tenants.length > 1) {
+        const candidates = me.tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
+        throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${id}" in?`, {
+          hint: "Run `qore tenant use <slug>`, or pass the module id.",
+          candidates
+        });
+      }
+      tenantId = me.tenants[0].id;
+    }
+    id = (await session.api.get(
+      `/api/cli/v1/tenants/${encodeURIComponent(tenantId)}/modules/resolve?slug=${encodeURIComponent(id)}`
+    )).id;
+  }
+  const module = await detail(session, id);
+  const overrides = await flagOverrides(deps2, session, portal, cache, module.id);
+  const repoRoot = await findRepoRoot(deps2.cwd);
+  return { portal, session, module, source: overrides ? { kind: "flag", overrides } : { kind: "flag" }, repoRoot };
+}
+function profileOrder(cfg, cachedOrigins, portalArg) {
+  if (portalArg) return [resolvePortal(portalArg, cfg.defaultProfile)];
+  const rank = (o) => o === BUILTIN_PORTALS.prod.apiOrigin ? 0 : o === BUILTIN_PORTALS.staging.apiOrigin ? 1 : 2;
+  const rest = Object.keys(cfg.profiles).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+  const cached = cachedOrigins.filter((c) => cfg.profiles[c]);
+  const origins = [...cached, resolvePortal(void 0, cfg.defaultProfile).apiOrigin, ...rest];
+  return [...new Set(origins)].filter((c) => cfg.profiles[c]).map((c) => resolvePortal(c, void 0));
+}
+function withDetails(e, extra, hint) {
+  return new QoreError(e.code, e.message, {
+    hint: hint ?? e.hint,
+    status: e.status,
+    requestId: e.requestId,
+    candidates: e.candidates,
+    serverCode: e.serverCode,
+    details: { ...e.details, ...extra },
+    cause: e
+  });
+}
+async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, unsupported) {
+  const session = await openSession(deps2, portal, o.command, o.onRequest);
+  try {
+    await ensureCapability(deps2, portal.apiOrigin, "repo.resolve");
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_UNSUPPORTED_BY_SERVER") throw e;
+    unsupported(e);
+    return null;
+  }
+  const hits = [];
+  for (const r of byPreference(keyed)) {
+    const id2 = await cache.get(portal.apiOrigin, r.key);
+    if (id2) hits.push({ remote: r, id: id2 });
+  }
+  if (hits.length > 0 && hits.every((h) => h.id === hits[0].id)) {
+    const { remote: r, id: id2 } = hits[0];
+    try {
+      return { portal, session, module: await detail(session, id2), source: { kind: "remote", remote: r.name, url: r.url }, repoRoot };
+    } catch (e) {
+      if (!(e instanceof QoreError) || e.code !== "QORE_RESOURCE_NOT_FOUND") throw e;
+      for (const h of hits) await cache.drop(portal.apiOrigin, h.remote.key);
+    }
+  }
+  const { matches } = await session.api.post(RESOLVE, { repoKeys: keys });
+  const ids = [...new Set(matches.map((m) => m.module.id))];
+  if (ids.length === 0) return null;
+  let id = ids[0];
+  if (ids.length > 1) {
+    if (o.choose && ids.includes(o.choose)) id = o.choose;
+    else {
+      const candidates = ids.map((mid) => {
+        const own = matches.filter((m2) => m2.module.id === mid);
+        const m = own[0];
+        const remote2 = preferred(keyed.filter((r) => own.some((x) => x.repoKey === r.key))).name;
+        return { kind: "module", id: m.module.id, slug: m.module.slug, name: m.module.name, remote: remote2, tenant: m.tenant.slug };
+      });
+      throw new QoreError("QORE_CONTEXT_REQUIRED", "This repository's remotes match several modules", {
+        hint: "Pass --module <slug|id>.",
+        candidates
+      });
+    }
+  }
+  const matchedKeys = new Set(matches.filter((m) => m.module.id === id).map((m) => m.repoKey));
+  if (ids.length === 1) for (const k of matchedKeys) await cache.put(portal.apiOrigin, k, id);
+  const remote = preferred(keyed.filter((r) => matchedKeys.has(r.key)));
+  return { portal, session, module: await detail(session, id), source: { kind: "remote", remote: remote.name, url: remote.url }, repoRoot };
+}
+async function anyLoggedIn(deps2, cfg) {
+  for (const p of Object.values(cfg.profiles)) {
+    if (await new TokenStore(deps2.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return true;
+  }
+  return false;
+}
+async function resolveModuleContext(deps2, o) {
+  const cache = new ResolutionCache(join5(deps2.config.dir, "cache"), deps2.now);
+  if (o.module) return byFlag(deps2, o, cache);
+  const cfg = await deps2.config.read();
+  const first = resolvePortal(o.portal, cfg.defaultProfile);
+  if (o.portal || !await anyLoggedIn(deps2, cfg)) {
+    await openSession(deps2, first, o.command);
+  }
+  const repo = await repoRemotes(deps2);
+  if (repo === null) throw new QoreError("QORE_CONTEXT_REQUIRED", "Not inside a module repository", { hint: HINT_FLAG });
+  const { root, keyed, gitError } = repo;
+  if (keyed.length === 0) {
+    const said = gitError?.hint;
+    throw new QoreError("QORE_CONTEXT_REQUIRED", "This repository has no remote Qore can match", {
+      hint: said ? `${HINT_FLAG} git said: ${said}` : HINT_FLAG,
+      details: gitError ? { git: said ?? gitError.message } : void 0,
+      cause: gitError
+    });
+  }
+  const keys = [...new Set(keyed.map((r) => r.key))];
+  const tried = [];
+  const answered = [];
+  const skipped = [];
+  const skipErrors = [];
+  let unsupported;
+  for (const portal of profileOrder(cfg, await cache.originsFor(keys), o.portal)) {
+    tried.push(label(portal));
+    let capabilityMissing = false;
+    try {
+      const mc = await onProfile(deps2, o, cache, portal, keyed, keys, root, (e) => {
+        capabilityMissing = true;
+        unsupported ??= e;
+        skipped.push({ profile: label(portal), code: e.code, message: e.message });
+      });
+      if (mc) return mc;
+      if (!capabilityMissing) answered.push(label(portal));
+    } catch (e) {
+      if (!(e instanceof QoreError) || !SKIPPABLE.has(e.code)) throw e;
+      skipped.push({ profile: label(portal), code: e.code, message: e.message });
+      skipErrors.push(e);
+    }
+  }
+  const details = { triedProfiles: tried };
+  if (skipped.length > 0) details.skippedProfiles = skipped;
+  if (answered.length === 0) {
+    const cause = skipErrors[0] ?? unsupported;
+    if (cause) throw withDetails(cause, details);
+  }
+  const unchecked = skipped.length ? ` ${skipped.map((s) => s.profile).join(", ")} could not be checked (${skipped.map((s) => s.code).join(", ")}).` : "";
+  const stagingLoggedIn = Boolean(cfg.profiles[BUILTIN_PORTALS.staging.apiOrigin]) && !skipped.some((s) => s.profile === "staging" && (s.code === "QORE_NOT_LOGGED_IN" || s.code === "QORE_SESSION_EXPIRED"));
+  throw new QoreError("QORE_CONTEXT_REQUIRED", "No module selected", {
+    hint: `This repository's remotes match no module you can access on ${answered.join(", ")}; pass --module <slug|id>.` + unchecked + (stagingLoggedIn ? "" : " If it is a staging repository, run `qore login --portal staging`."),
+    details
+  });
+}
+var appCandidates = (apps) => apps.map((a) => ({ kind: "app", id: a.id, slug: a.slug, name: a.name }));
+function pickApp(mc, app) {
+  const apps = mc.module.apps;
+  if (app) {
+    const found = apps.find((a) => a.id === app || a.slug === app);
+    if (!found) {
+      throw new QoreError("QORE_RESOURCE_NOT_FOUND", `${mc.module.slug} is not part of an app "${app}" you can read`, {
+        candidates: appCandidates(apps)
+      });
+    }
+    return found;
+  }
+  if (apps.length === 1) return apps[0];
+  if (apps.length === 0) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `${mc.module.slug} is not part of an app you can read`);
+  throw new QoreError("QORE_APP_AMBIGUOUS", `${mc.module.slug} is part of several apps`, { hint: "Pass --app <slug>.", candidates: appCandidates(apps) });
+}
+
+// src/core/env/fetch.ts
+async function fetchLocalEnv(deps2, mc, app) {
+  await ensureCapability(deps2, mc.portal.apiOrigin, "module.local-env");
+  try {
+    return await mc.session.api.get(
+      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`
+    );
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_ACCESS_DENIED") throw e;
+    if (e.serverCode === "app.access.denied") {
+      throw withDetails(
+        e,
+        { required: "write", have: mc.module.access },
+        `You have ${mc.module.access} on ${mc.module.slug}; local secrets need write. Ask a maintainer of the app's dev team for write access.`
+      );
+    }
+    if (e.serverCode === "auth.scope.insufficient") throw withDetails(e, {}, "Run `qore login` again.");
+    throw e;
+  }
+}
+
+// src/core/env/merge.ts
+function parseEnv(contents) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of contents.split("\n")) {
+    const m = line.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (m?.[1] !== void 0 && m[2] !== void 0) map.set(m[1], m[2]);
+  }
+  return map;
+}
+function isManagedKey(key, managed) {
+  for (const pattern of managed) {
+    if (pattern.endsWith("*")) {
+      if (key.startsWith(pattern.slice(0, -1))) return true;
+    } else if (key === pattern) return true;
+  }
+  return false;
+}
+function planEnvUpdate({
+  current,
+  fetched,
+  choices = {},
+  defaultChoice = "keep",
+  managed = []
+}) {
+  const merged = new Map(current);
+  const conflicts = [];
+  const added = [];
+  const unchanged = [];
+  const overwritten = [];
+  for (const [key, portalValue] of Object.entries(fetched)) {
+    const hasLocal = current.has(key);
+    const localValue = current.get(key);
+    const localEmpty = !hasLocal || localValue === "" || localValue === '""' || localValue === "''";
+    if (localEmpty) {
+      merged.set(key, portalValue);
+      added.push(key);
+      continue;
+    }
+    if (localValue === portalValue) {
+      unchanged.push(key);
+      continue;
+    }
+    if (isManagedKey(key, managed)) {
+      merged.set(key, portalValue);
+      overwritten.push(key);
+      continue;
+    }
+    conflicts.push(key);
+    const choice = choices[key] ?? defaultChoice;
+    merged.set(key, choice === "use-portal" ? portalValue : localValue);
+  }
+  return { merged, conflicts, added, unchanged, overwritten };
+}
+function renderEnv(original, merged) {
+  const seen = /* @__PURE__ */ new Set();
+  const lines = original.split("\n");
+  const out = lines.map((line) => {
+    const m = line.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!m?.[1]) return line;
+    const key = m[1];
+    if (!merged.has(key)) return line;
+    seen.add(key);
+    return `${key}=${merged.get(key) ?? ""}`;
+  });
+  const appended = [];
+  for (const [key, value] of merged) {
+    if (!seen.has(key)) appended.push(`${key}=${value}`);
+  }
+  let text = out.join("\n");
+  if (appended.length) {
+    if (text.length && !text.endsWith("\n")) text += "\n";
+    text += appended.join("\n") + "\n";
+  }
+  return text;
+}
+
+// src/core/env/pull.ts
+import { lstat, realpath } from "fs/promises";
+import { basename, dirname as dirname2, isAbsolute, relative, resolve as resolve2, sep } from "path";
+var outside = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file must be inside the repository (got ${target})`, {
+  hint: "Use a path inside the repository for --target or .qore.json envFile."
+});
+var symlinked = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file target must not be a symlink (got ${target})`, {
+  hint: "Use a path inside the repository for --target or .qore.json envFile."
+});
+function inside(root, p) {
+  const rel = relative(root, p);
+  return rel !== "" && rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute(rel);
+}
+async function resolveTarget(root, target, base = root) {
+  const realRoot = await realpath(root);
+  const realBase = base === root ? realRoot : await realpath(base);
+  const abs = resolve2(realBase, target);
+  if (!isAbsolute(target) && !inside(realRoot, abs)) throw outside(target);
+  let parent;
+  try {
+    parent = await realpath(dirname2(abs));
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+    throw new QoreError("QORE_CONTEXT_INVALID", `The directory for ${target} does not exist`, {
+      hint: "Create the parent directory, or point --target / .qore.json envFile at an existing one."
+    });
+  }
+  const final = resolve2(parent, basename(abs));
+  if (!inside(realRoot, final)) throw outside(target);
+  try {
+    const st = await lstat(final);
+    if (st.isSymbolicLink()) throw symlinked(target);
+    const realFinal = await realpath(final);
+    if (!inside(realRoot, realFinal)) throw outside(target);
+  } catch (e) {
+    if (e instanceof QoreError) throw e;
+    if (e.code !== "ENOENT") throw e;
+  }
+  return final;
+}
+function planPull(o) {
+  const original = o.existing ?? o.example ?? "";
+  const current = parseEnv(original);
+  const r = planEnvUpdate({ current, fetched: o.fetched, choices: o.choices ?? {}, defaultChoice: o.defaultChoice, managed: o.managed });
+  const choiceOf = (k) => o.choices?.[k] ?? o.defaultChoice;
+  const generated = [];
+  for (const key of o.localSecrets) {
+    const v = r.merged.get(key);
+    if (v === void 0 || v === "" || v === '""' || v === "''") {
+      r.merged.set(key, o.random());
+      generated.push(key);
+    }
+  }
+  return {
+    text: renderEnv(original, r.merged),
+    created: o.existing === null,
+    seededFromExample: o.existing === null && o.example !== null,
+    added: r.added,
+    updated: r.overwritten,
+    unchanged: r.unchanged,
+    conflicts: r.conflicts,
+    kept: r.conflicts.filter((k) => choiceOf(k) === "keep"),
+    replaced: r.conflicts.filter((k) => choiceOf(k) === "use-portal"),
+    generated
+  };
+}
+
+// src/cli/context.ts
+var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
+async function moduleContextFor(ctx, flags, command) {
+  const g = ctx.opts();
+  const onRequest = g.verbose ? (l) => ctx.io.err(l) : void 0;
+  const base = { portal: g.portal, module: flags.module, command, onRequest };
+  try {
+    return await resolveModuleContext(ctx.deps, base);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" || !ctx.io.interactive) throw e;
+    if (allOfKind(e.candidates, "module")) {
+      const choose = await ctx.io.select(
+        "Select a module",
+        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : ""}${c.slug}  (${c.remote})`, value: c.id }))
+      );
+      return resolveModuleContext(ctx.deps, { ...base, choose });
+    }
+    if (allOfKind(e.candidates, "tenant")) {
+      const tenant = await ctx.io.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
+      return resolveModuleContext(ctx.deps, { ...base, tenant });
+    }
+    throw e;
+  }
+}
+async function appFor(ctx, mc, app) {
+  try {
+    return pickApp(mc, app);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
+    const id = await ctx.io.select("Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
+    return pickApp(mc, id);
+  }
+}
+function sourceText(mc) {
+  if (mc.source.kind === "remote") return mc.source.remote;
+  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : "--module";
+}
+function contextLine(mc, app) {
+  const parts = [mc.module.tenant.name, ...app ? [app.name] : [], mc.module.slug];
+  return `\u2192 ${parts.join(" / ")}  (${sourceText(mc)})`;
+}
+function contextJson(mc, app) {
+  const { id, slug, name, type, access } = mc.module;
+  return {
+    portal: mc.portal.builtin ?? mc.portal.apiOrigin,
+    tenant: mc.module.tenant,
+    app: app ?? null,
+    module: { id, slug, name, type, access },
+    source: mc.source.kind === "remote" ? mc.source.remote : "--module",
+    ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
+  };
+}
+
+// src/core/trust.ts
+import { realpath as realpath2 } from "fs/promises";
+function trustKey(root, platform) {
+  return platform === "win32" ? root.toLowerCase() : root;
+}
+async function keyOf(deps2, root) {
+  let real = root;
+  try {
+    real = await realpath2(root);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  return trustKey(real, deps2.platform);
+}
+async function isTrusted(deps2, root, moduleId) {
+  const cfg = await deps2.config.read();
+  return (cfg.trustedRepos?.[await keyOf(deps2, root)] ?? []).includes(moduleId);
+}
+async function trust(deps2, root, moduleId) {
+  const key = await keyOf(deps2, root);
+  await deps2.config.update((c) => {
+    const repos = c.trustedRepos ??= {};
+    const list = new Set(repos[key] ?? []);
+    list.add(moduleId);
+    repos[key] = [...list];
+  });
+}
+
+// src/cli/trustPrompt.ts
+async function ensureTrusted(ctx, mc, app, o) {
+  const root = mc.repoRoot ?? ctx.deps.cwd;
+  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
+  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
+  if (o.yes) {
+    await trust(ctx.deps, root, mc.module.id);
+    return;
+  }
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `This repository is not trusted for ${mc.module.slug} yet`, {
+      hint: "Run interactively once, or pass --yes.",
+      details: { reason: "untrusted", repository: root }
+    });
+  }
+  if (mc.source.kind === "remote") {
+    const key = repoKey(mc.source.url);
+    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? "(unparsable remote URL)"}`);
+  }
+  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
+  await trust(ctx.deps, root, mc.module.id);
+}
+
+// src/cli/commands/env.ts
+var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
+async function readOrNull(p) {
+  try {
+    return await readFile3(p, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+async function writeSecurely(target, text) {
+  const base = basename2(target);
+  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes2(6).toString("hex")}.local` : `${base}.qore-${randomBytes2(6).toString("hex")}.tmp`;
+  const tmp = join6(dirname3(target), tmpName);
+  try {
+    await writeFile2(tmp, text, { mode: 384, flag: "wx" });
+    await chmod2(tmp, 384);
+    await rename2(tmp, target);
+  } finally {
+    await unlink(tmp).catch(() => {
+    });
+  }
+}
+function registerEnv(program, ctx) {
+  const env = program.command("env").description("Local environment");
+  env.command("pull").description("Write this module's local secrets into its env file").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--target <path>", "env file to write (inside the repository)").option("--use-portal", "take the portal's value for keys that differ locally").option("--yes", "trust this repository without asking").action(async (f) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const mc = await moduleContextFor(ctx, f, "env pull");
+    if (!mc.repoRoot) {
+      throw new QoreError("QORE_CONTEXT_REQUIRED", "env pull writes into a module repository", { hint: "cd into the module's repository." });
+    }
+    const app = await appFor(ctx, mc, f.app);
+    const cfg = await readRepoConfig(mc.repoRoot);
+    const defaults = moduleDefaults(mc.module.type);
+    const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
+    await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    const existing = await readOrNull(target);
+    const example = existing === null ? await readOrNull(join6(dirname3(target), ".env.example")) : null;
+    const local = await fetchLocalEnv(deps2, mc, app);
+    const inputs = {
+      existing,
+      example,
+      fetched: local.env,
+      managed: local.managedKeys,
+      localSecrets: cfg.localSecrets ?? defaults.localSecrets,
+      defaultChoice: f.usePortal ? "use-portal" : "keep",
+      random: () => randomBytes2(32).toString("hex")
+    };
+    let plan = planPull(inputs);
+    if (plan.conflicts.length && io2.interactive && !f.usePortal) {
+      const current = parseEnv(existing ?? example ?? "");
+      const choices = {};
+      let bulk;
+      for (const key of plan.conflicts) {
+        if (bulk) {
+          choices[key] = bulk;
+          continue;
+        }
+        const pick = await io2.select(
+          `${key} differs  (local ${maskLen(current.get(key))}, portal ${maskLen(local.env[key])})`,
+          [
+            { name: "keep local", value: "keep" },
+            { name: "use portal", value: "portal" },
+            { name: "use portal for all", value: "all" },
+            { name: "keep local for all", value: "skip" }
+          ]
+        );
+        if (pick === "all") bulk = "use-portal";
+        if (pick === "skip") bulk = "keep";
+        choices[key] = pick === "portal" || pick === "all" ? "use-portal" : "keep";
+      }
+      plan = planPull({ ...inputs, choices });
+    }
+    if (existing !== null && plan.text === existing) {
+      await chmod2(target, 384);
+    } else {
+      await writeSecurely(target, plan.text);
+    }
+    const rel = relative2(await realpath3(mc.repoRoot), target);
+    if (g.json) {
+      const names = {
+        created: plan.created,
+        seededFromExample: plan.seededFromExample,
+        added: plan.added,
+        updated: plan.updated,
+        kept: plan.kept,
+        replaced: plan.replaced,
+        unchanged: plan.unchanged,
+        generated: plan.generated
+      };
+      renderJson(io2, { context: contextJson(mc, app), target: rel, ...names });
+      return;
+    }
+    if (plan.kept.length && !io2.interactive) {
+      io2.err(`! ${plan.kept.length} key(s) differ locally and were kept: ${plan.kept.join(", ")} \u2014 --use-portal takes the portal's values`);
+    }
+    const parts = [
+      plan.added.length && `${plan.added.length} added`,
+      plan.updated.length && `${plan.updated.length} updated (managed)`,
+      plan.replaced.length && `${plan.replaced.length} replaced`,
+      plan.kept.length && `${plan.kept.length} kept (differs locally; --use-portal to overwrite)`,
+      plan.generated.length && `${plan.generated.length} generated`
+    ].filter(Boolean);
+    io2.out(`\u2713 ${rel}${plan.seededFromExample ? " (created from .env.example)" : ""} \u2014 ${parts.length ? parts.join(", ") : "up to date"}`);
+  });
 }
 
 // src/core/auth/oidc.ts
@@ -458,202 +1523,6 @@ async function deviceLogin(opts) {
   return t;
 }
 
-// src/core/auth/tokenStore.ts
-var TokenStore = class {
-  constructor(kc, hash) {
-    this.kc = kc;
-    this.hash = hash;
-  }
-  kc;
-  hash;
-  async read(suffix) {
-    const raw = await this.kc.get(`${this.hash}:${suffix}`);
-    if (raw === null) return null;
-    try {
-      return JSON.parse(raw);
-    } catch {
-      return null;
-    }
-  }
-  getRefresh() {
-    return this.read("refresh");
-  }
-  getAccess() {
-    return this.read("access");
-  }
-  setRefresh(v) {
-    return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v));
-  }
-  setAccess(v) {
-    return this.kc.set(`${this.hash}:access`, JSON.stringify(v));
-  }
-  async clear() {
-    await this.kc.delete(`${this.hash}:access`);
-    await this.kc.delete(`${this.hash}:refresh`);
-  }
-};
-
-// src/core/profiles.ts
-import { createHash } from "crypto";
-var BUILTIN_PORTALS = {
-  prod: {
-    apiOrigin: "https://api.quatronic.app",
-    pinnedIssuer: "https://auth.quatronic.app/realms/platform-prod"
-  },
-  staging: {
-    apiOrigin: "https://p01--portal-api-staging--hcywmtb2vksv.code.run",
-    pinnedIssuer: "https://auth-staging.quatronic.app/realms/platform-staging"
-  }
-};
-function builtinFor(origin) {
-  for (const [name, p] of Object.entries(BUILTIN_PORTALS)) {
-    if (p.apiOrigin === origin) return { ...p, builtin: name };
-  }
-  return null;
-}
-function toOrigin(raw) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new QoreError("QORE_CONTEXT_INVALID", `Not a portal name or URL: ${raw}`, {
-      hint: "Use --portal prod, --portal staging or --portal https://\u2026"
-    });
-  }
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
-    throw new QoreError("QORE_CONTEXT_INVALID", "A portal URL must use https (http only for localhost)");
-  }
-  return url.origin.toLowerCase();
-}
-function resolvePortal(arg, defaultProfile) {
-  const chosen = arg ?? defaultProfile;
-  if (chosen === void 0 || chosen === "prod") return { ...BUILTIN_PORTALS.prod, builtin: "prod" };
-  if (chosen === "staging") return { ...BUILTIN_PORTALS.staging, builtin: "staging" };
-  const origin = toOrigin(chosen);
-  return builtinFor(origin) ?? { apiOrigin: origin, pinnedIssuer: null, builtin: null };
-}
-function profileHash(apiOrigin, issuer) {
-  return createHash("sha256").update(`${apiOrigin}|${issuer}`).digest("hex").slice(0, 16);
-}
-
-// src/core/api/client.ts
-var QoreApiClient = class {
-  constructor(o) {
-    this.o = o;
-  }
-  o;
-  async once(path, force) {
-    const token = await this.o.token(force);
-    let res;
-    try {
-      res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {
-        headers: {
-          authorization: `Bearer ${token}`,
-          accept: "application/json",
-          "qore-cli-version": this.o.cliVersion,
-          "qore-command": this.o.command,
-          "user-agent": `qore/${this.o.cliVersion} (${this.o.platform})`
-        }
-      });
-    } catch (e) {
-      throw fetchError(e, new URL(this.o.apiOrigin).host);
-    }
-    this.o.onRequest?.(`GET ${path} \u2192 ${res.status}${res.headers.get("x-request-id") ? ` (${res.headers.get("x-request-id")})` : ""}`);
-    return res;
-  }
-  async get(path) {
-    let res = await this.once(path, false);
-    if (res.status === 401) {
-      res = await this.once(path, true);
-      if (res.status === 401) {
-        throw new QoreError("QORE_SESSION_EXPIRED", "The portal no longer accepts your session", {
-          hint: "Run `qore login`.",
-          status: 401,
-          requestId: res.headers.get("x-request-id") ?? void 0
-        });
-      }
-    }
-    if (!res.ok) throw await problemToError(res);
-    return await res.json();
-  }
-};
-
-// src/core/auth/refresh.ts
-var SKEW_MS = 6e4;
-var RefreshCoordinator = class {
-  constructor(o) {
-    this.o = o;
-  }
-  o;
-  fresh(expiresAt) {
-    return new Date(expiresAt).getTime() - this.o.now().getTime() > SKEW_MS;
-  }
-  async rotate(scope) {
-    let stored = await this.o.store.getRefresh();
-    if (!stored) throw new QoreError("QORE_NOT_LOGGED_IN", "Not logged in", { hint: "Run `qore login`." });
-    let t;
-    for (let attempt = 0; ; attempt++) {
-      try {
-        t = await (await this.o.oidc()).refresh(stored.rt, scope);
-        break;
-      } catch (e) {
-        if (!(e instanceof QoreError && e.code === "QORE_SESSION_EXPIRED")) throw e;
-        const now = await this.o.store.getRefresh();
-        if (now && now.rt !== stored.rt) {
-          if (attempt === 0) {
-            stored = now;
-            continue;
-          }
-          throw e;
-        }
-        await this.o.store.clear();
-        throw e;
-      }
-    }
-    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope ?? stored.scope), obtainedAt: this.o.now().toISOString() });
-    return t;
-  }
-  async accessToken(opts = {}) {
-    const seen = await this.o.store.getAccess();
-    if (!opts.force && seen && this.fresh(seen.expiresAt)) return seen.at;
-    return this.o.withLock(this.o.lockName, async () => {
-      const again = await this.o.store.getAccess();
-      if (again && again.at !== seen?.at && this.fresh(again.expiresAt)) return again.at;
-      const t = await this.rotate();
-      await this.o.store.setAccess({ at: t.accessToken, expiresAt: new Date(this.o.now().getTime() + t.expiresIn * 1e3).toISOString() });
-      return t.accessToken;
-    });
-  }
-  /** A token carrying only `scopes`, held in memory by the caller (qore mcp). */
-  async downscoped(scopes) {
-    return this.o.withLock(this.o.lockName, async () => (await this.rotate(scopes.join(" "))).accessToken);
-  }
-};
-
-// src/core/session.ts
-function loginHint(portal) {
-  return portal.builtin === "prod" ? "Run `qore login`." : `Run \`qore login --portal ${portal.builtin ?? portal.apiOrigin}\`.`;
-}
-async function openSession(deps2, portal, command, onRequest) {
-  const profile = (await deps2.config.read()).profiles[portal.apiOrigin];
-  if (!profile) throw new QoreError("QORE_NOT_LOGGED_IN", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) });
-  const hash = profileHash(profile.apiOrigin, profile.issuer);
-  const tokens = new TokenStore(deps2.keychain, hash);
-  if (!await tokens.getRefresh()) throw new QoreError("QORE_NOT_LOGGED_IN", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) });
-  const refresh = new RefreshCoordinator({ store: tokens, oidc: () => deps2.oidcFor(profile.issuer), withLock: deps2.withLock, lockName: hash, now: deps2.now });
-  const api = new QoreApiClient({
-    apiOrigin: profile.apiOrigin,
-    fetch: deps2.fetch,
-    token: (force) => refresh.accessToken({ force }),
-    cliVersion: deps2.version,
-    command,
-    platform: `${deps2.platform} ${process.arch}; node ${process.versions.node}`,
-    onRequest
-  });
-  return { profile, api, tokens, refresh };
-}
-
 // src/cli/commands/login.ts
 function registerLogin(program, ctx) {
   program.command("login").description("Log in with your Qore account").option("--no-browser", "only print the URL").action(async (cmd) => {
@@ -724,9 +1593,9 @@ function registerLogin(program, ctx) {
     await deps2.config.update((c) => {
       c.profiles[portal.apiOrigin].activeTenant = active;
     });
-    const label = portal.builtin ?? portal.apiOrigin;
-    if (g.json) renderJson(io2, { portal: label, email: me.email, activeTenant: active ?? null });
-    else io2.out(`\u2713 Logged in as ${me.email} (${label})`);
+    const label2 = portal.builtin ?? portal.apiOrigin;
+    if (g.json) renderJson(io2, { portal: label2, email: me.email, activeTenant: active ?? null });
+    else io2.out(`\u2713 Logged in as ${me.email} (${label2})`);
   });
 }
 
@@ -762,6 +1631,92 @@ function registerLogout(program, ctx) {
   });
 }
 
+// src/cli/commands/run.ts
+import { constants } from "os";
+var childRunning = { current: false };
+function registerRun(program, ctx) {
+  program.command("run").description("Run a command with this module's local secrets in its environment").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--yes", "trust this repository without asking").argument("<command>", "the command to run (after --)").argument("[args...]", "its arguments, passed verbatim").action(async (cmd, args, f) => {
+    const { deps: deps2 } = ctx;
+    if (ctx.opts().json) {
+      throw new QoreError("QORE_CONTEXT_INVALID", "run has no --json output", {
+        hint: "Drop --json; the child's own output passes through."
+      });
+    }
+    const mc = await moduleContextFor(ctx, f, "run");
+    const app = await appFor(ctx, mc, f.app);
+    await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    const local = await fetchLocalEnv(deps2, mc, app);
+    childRunning.current = true;
+    let exit;
+    try {
+      exit = await deps2.spawn.run(cmd, args, { ...deps2.env, ...local.env });
+    } finally {
+      childRunning.current = false;
+    }
+    if (exit.signal) {
+      deps2.raise(exit.signal);
+      ctx.setExitCode(128 + (constants.signals[exit.signal] ?? 0));
+      return;
+    }
+    ctx.setExitCode(exit.code ?? 1);
+  });
+}
+
+// src/cli/format.ts
+function ago(iso, now) {
+  if (!iso) return "\u2013";
+  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1e3));
+  if (s < 60) return "just now";
+  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
+  return `${Math.floor(s / 86400)}d ago`;
+}
+var pct = (f) => String(Number((f * 100).toFixed(2)));
+function uptime(h) {
+  if (!h) return "\u2013";
+  const kind = h.cause && h.kind !== "up" ? `${h.kind}: ${h.cause}` : h.kind;
+  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`;
+}
+function table(rows) {
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => (r[i] ?? "").length)));
+  return rows.map((r) => "  " + r.map((c, i) => i === r.length - 1 ? c : c.padEnd(widths[i])).join("  "));
+}
+
+// src/cli/commands/status.ts
+function registerStatus(program, ctx) {
+  program.command("status").description("Deployment and health per environment for this module").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").action(async (flags) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const mc = await moduleContextFor(ctx, flags, "status");
+    await ensureCapability(deps2, mc.portal.apiOrigin, "module.status");
+    const app = await appFor(ctx, mc, flags.app);
+    if (!g.json) io2.err(contextLine(mc, app));
+    const st = await mc.session.api.get(
+      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/status?app_id=${encodeURIComponent(app.id)}`
+    );
+    if (g.json) {
+      renderJson(io2, { context: contextJson(mc, app), environments: st.environments });
+      return;
+    }
+    if (st.environments.length === 0) {
+      io2.out("No environments yet.");
+      return;
+    }
+    const now = deps2.now();
+    const rows = [
+      ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"],
+      ...st.environments.map((e) => [
+        e.name,
+        e.paused ? "paused" : e.status,
+        e.commit?.sha ?? "\u2013",
+        ago(e.commit?.deployedAt ?? null, now),
+        uptime(e.health)
+      ])
+    ];
+    for (const line of table(rows)) io2.out(line);
+  });
+}
+
 // src/cli/commands/tenant.ts
 function registerTenant(program, ctx) {
   const tenant = program.command("tenant").description("Manage the active tenant");
@@ -789,7 +1744,7 @@ function registerTenant(program, ctx) {
     const portal = resolvePortal(g.portal, cfg.defaultProfile);
     const { api } = await openSession(deps2, portal, "tenant use", requestLog(ctx));
     const me = await api.get("/api/cli/v1/me");
-    const candidates = me.tenants.map((t) => t.slug);
+    const candidates = me.tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
     let chosen;
     if (slug) {
       const found = me.tenants.find((t) => t.slug === slug);
@@ -827,11 +1782,11 @@ function registerVersion(program, ctx) {
       return;
     }
     io2.out(`qore ${deps2.version}`);
-    const label = portal.builtin ?? portal.apiOrigin;
+    const label2 = portal.builtin ?? portal.apiOrigin;
     if (portalInfo) {
-      io2.out(`portal ${label}: api ${portalInfo.apiVersions.join(",")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`);
+      io2.out(`portal ${label2}: api ${portalInfo.apiVersions.join(",")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`);
     } else {
-      io2.out(`portal ${label}: unreachable`);
+      io2.out(`portal ${label2}: unreachable`);
     }
   });
 }
@@ -849,12 +1804,12 @@ function registerWhoami(program, ctx) {
     if (activeTenant && !me.tenants.some((t) => t.id === activeTenant.id)) {
       io2.err(`! You no longer have developer access to ${activeTenant.slug}`);
     }
-    const label = portal.builtin ?? portal.apiOrigin;
+    const label2 = portal.builtin ?? portal.apiOrigin;
     if (g.json) {
-      renderJson(io2, { portal: label, activeTenant: activeTenant ?? null, me });
+      renderJson(io2, { portal: label2, activeTenant: activeTenant ?? null, me });
       return;
     }
-    io2.out(`${me.email} (${label})`);
+    io2.out(`${me.email} (${label2})`);
     for (const t of me.tenants) {
       const mark = activeTenant?.id === t.id ? "*" : " ";
       io2.out(`${mark} ${t.name}  ${t.role}`);
@@ -869,7 +1824,16 @@ function registerWhoami(program, ctx) {
 }
 
 // src/cli/commands/index.ts
-var COMMANDS = [registerLogin, registerLogout, registerWhoami, registerTenant, registerVersion];
+var COMMANDS = [
+  registerLogin,
+  registerLogout,
+  registerWhoami,
+  registerTenant,
+  registerStatus,
+  registerEnv,
+  registerRun,
+  registerVersion
+];
 
 // src/cli/updateCheck.ts
 var REGISTRY_URL = "https://registry.npmjs.org/@quatronic%2Fqore/latest";
@@ -903,9 +1867,8 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 }
 
 // src/core/config.ts
-import { mkdir, readFile, rename, writeFile, chmod } from "fs/promises";
-import { join } from "path";
-import { randomBytes } from "crypto";
+import { readFile as readFile4 } from "fs/promises";
+import { join as join7 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -913,12 +1876,12 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join(this.dir, "config.json");
+    return join7(this.dir, "config.json");
   }
   async read() {
     let raw;
     try {
-      raw = await readFile(this.file, "utf8");
+      raw = await readFile4(this.file, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return empty();
       throw e;
@@ -937,15 +1900,58 @@ var ConfigStore = class {
   async update(fn) {
     const current = await this.read();
     const next = fn(current) ?? current;
-    await mkdir(this.dir, { recursive: true, mode: 448 });
-    const tmp = join(this.dir, `.config.${randomBytes(6).toString("hex")}.tmp`);
-    await writeFile(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
-    await chmod(tmp, 384);
-    await rename(tmp, this.file);
+    await writeJsonAtomic(this.dir, "config.json", next);
     return next;
   }
 };
 
+// src/platform/git.ts
+import { execFile } from "child_process";
+import { homedir } from "os";
+function parseRemotes(stdout) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const line of stdout.split(/\r?\n/)) {
+    const m = /^(\S+)\t(.+) \(fetch\)$/.exec(line);
+    if (!m || seen.has(m[1])) continue;
+    seen.add(m[1]);
+    out.push({ name: m[1], url: m[2] });
+  }
+  return out;
+}
+function gitExecOptions() {
+  return { cwd: homedir(), env: { ...process.env, LC_ALL: "C" }, windowsHide: true };
+}
+var systemGit = {
+  remotes(repoRoot) {
+    return new Promise((resolve3, reject) => {
+      execFile(
+        "git",
+        ["-C", repoRoot, "remote", "-v"],
+        gitExecOptions(),
+        (err, stdout, stderr) => {
+          if (err) {
+            if (err.code === "ENOENT") {
+              reject(new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
+                hint: "Install git (https://git-scm.com/downloads) and open a new terminal."
+              }));
+              return;
+            }
+            const last = String(stderr).trim().split(/\r?\n/).pop() ?? "";
+            reject(new QoreError("QORE_INTERNAL", `git remote -v failed in ${repoRoot}`, {
+              hint: last || void 0,
+              details: { command: "git remote -v", cwd: repoRoot },
+              cause: err
+            }));
+            return;
+          }
+          resolve3(parseRemotes(String(stdout)));
+        }
+      );
+    });
+  }
+};
+
 // src/platform/keychain.ts
 import { Entry } from "@napi-rs/keyring";
 var SERVICE = "qore";
@@ -1001,15 +2007,15 @@ var OsKeychain = class {
 };
 
 // src/platform/lock.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { join as join2 } from "path";
+import { mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
+import { join as join8 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join2(dir2, "locks");
+    const locks = join8(dir2, "locks");
     await mkdir2(locks, { recursive: true, mode: 448 });
-    const target = join2(locks, `${name}.lock`);
-    await writeFile2(target, "", { flag: "a" });
+    const target = join8(locks, `${name}.lock`);
+    await writeFile3(target, "", { flag: "a" });
     let release;
     let compromised;
     try {
@@ -1042,17 +2048,63 @@ function configDir(env, platform, home) {
   return posix.join(xdg ?? posix.join(home, ".config"), "qore");
 }
 
+// src/platform/spawn.ts
+import spawn from "cross-spawn";
+function signalsFor(platform) {
+  return platform === "win32" ? { ignore: ["SIGINT", "SIGBREAK"], forward: [] } : { ignore: ["SIGINT", "SIGQUIT"], forward: ["SIGTERM", "SIGHUP"] };
+}
+var { ignore: IGNORE, forward: FORWARD } = signalsFor(process.platform);
+function makeSpawner(spawnFn, proc) {
+  return {
+    run(cmd, args, env) {
+      return new Promise((resolve3, reject) => {
+        let child;
+        try {
+          child = spawnFn(cmd, args, { stdio: "inherit", shell: false, env, windowsHide: true });
+        } catch (e) {
+          reject(new QoreError("QORE_INTERNAL", `Could not start ${cmd}: ${e.code ?? "error"}`));
+          return;
+        }
+        const ignore = () => {
+        };
+        const forwarders = FORWARD.map((sig) => [sig, () => {
+          child.kill(sig);
+        }]);
+        for (const sig of IGNORE) proc.on(sig, ignore);
+        for (const [sig, fn] of forwarders) proc.on(sig, fn);
+        const cleanup = () => {
+          for (const sig of IGNORE) proc.off(sig, ignore);
+          for (const [sig, fn] of forwarders) proc.off(sig, fn);
+        };
+        child.once("error", (e) => {
+          cleanup();
+          reject(e.code === "ENOENT" ? new QoreError("QORE_INTERNAL", `Command not found: ${cmd}`, { hint: "Check the command after --; it runs without a shell." }) : new QoreError("QORE_INTERNAL", `Could not start ${cmd}: ${e.code ?? "error"}`));
+        });
+        child.once("exit", (code, signal) => {
+          cleanup();
+          resolve3({ code, signal });
+        });
+      });
+    }
+  };
+}
+var crossSpawner = makeSpawner(spawn, process);
+
 // src/version.ts
-var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var VERSION = true ? "0.1.1" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
-var dir = configDir(process.env, process.platform, homedir());
+var dir = configDir(process.env, process.platform, homedir2());
 var argv = process.argv.slice(2);
-var json = argv.includes("--json");
+var preSeparatorArgv = argvBeforeSeparator(argv);
+var json = preSeparatorArgv.includes("--json");
 var ac = new AbortController();
 process.on("SIGINT", () => {
-  if (ac.signal.aborted) process.exit(130);
+  if (ac.signal.aborted) {
+    if (childRunning.current) return;
+    process.exit(130);
+  }
   ac.abort();
 });
 var fetch = abortableFetch(globalThis.fetch, ac.signal);
@@ -1065,13 +2117,20 @@ var deps = {
   oidcFor: (issuer) => createOidc({ issuer, clientId: "qore-cli", fetch }),
   env: process.env,
   platform: process.platform,
-  version: VERSION
+  version: VERSION,
+  cwd: process.cwd(),
+  git: systemGit,
+  spawn: crossSpawner,
+  raise: (signal) => {
+    process.removeAllListeners(signal);
+    process.kill(process.pid, signal);
+  }
 };
 var io = processIo(isInteractive({
   stdinTTY: Boolean(process.stdin.isTTY),
   stdoutTTY: Boolean(process.stdout.isTTY),
   json,
-  noInput: argv.includes("--no-input"),
+  noInput: preSeparatorArgv.includes("--no-input"),
   env: process.env
 }));
 process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS);