@quatronic/qore 0.1.0 → 0.1.2

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
 
 // src/cli/io.ts
-import { select } from "@inquirer/prompts";
+import { confirm, select } from "@inquirer/prompts";
 import { createInterface } from "readline";
 
 // src/platform/browser.ts
@@ -25,8 +25,11 @@ var EXIT = {
   QORE_INTERNAL: 1,
   QORE_KEYCHAIN_UNAVAILABLE: 1,
   QORE_KEYCHAIN_DENIED: 1,
+  QORE_GIT_UNAVAILABLE: 1,
   QORE_CONTEXT_REQUIRED: 2,
   QORE_CONTEXT_INVALID: 2,
+  QORE_CONTEXT_UNSUPPORTED: 2,
+  QORE_APP_AMBIGUOUS: 2,
   QORE_NOT_LOGGED_IN: 4,
   QORE_SESSION_EXPIRED: 4,
   QORE_LOGIN_EXPIRED: 4,
@@ -36,6 +39,11 @@ var EXIT = {
   QORE_RESOURCE_NOT_FOUND: 5,
   QORE_ACCESS_DENIED: 5,
   QORE_NO_DEVELOPER_ACCESS: 5,
+  QORE_GITHUB_NOT_LINKED: 5,
+  QORE_REPO_NO_ACCESS: 5,
+  QORE_REPO_ACCESS_PENDING: 5,
+  QORE_GIT_AUTH: 5,
+  QORE_WORKSPACE_CONFLICT: 2,
   QORE_AUTH_UNAVAILABLE: 6,
   QORE_AUTH_BUSY: 6,
   QORE_API_UNREACHABLE: 6,
@@ -109,12 +117,20 @@ function processIo(interactive) {
         throw e;
       }
     },
+    async confirm(message) {
+      try {
+        return await confirm({ message, default: false });
+      } catch (e) {
+        if (e.name === "ExitPromptError") throw new CancelledError();
+        throw e;
+      }
+    },
     waitForEnter: createWaitForEnter(process.stdin, process.stderr),
     openUrl: openBrowser
   };
 }
 function createWaitForEnter(input, output) {
-  return (message, signal) => new Promise((resolve, reject) => {
+  return (message, signal) => new Promise((resolve5, reject) => {
     const rl = createInterface({ input, output, terminal: true });
     const onAbort = () => {
       rl.close();
@@ -123,7 +139,7 @@ function createWaitForEnter(input, output) {
     const done = () => {
       signal.removeEventListener("abort", onAbort);
       rl.close();
-      resolve();
+      resolve5();
     };
     signal.addEventListener("abort", onAbort, { once: true });
     rl.on("SIGINT", () => {
@@ -139,8 +155,8 @@ function createWaitForEnter(input, output) {
 import { Command, CommanderError } from "commander";
 
 // src/core/api/http.ts
-function abortableFetch(fetch2, signal) {
-  return (input, init) => fetch2(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal });
+function abortableFetch(fetch3, signal) {
+  return (input, init) => fetch3(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal });
 }
 var TLS = /* @__PURE__ */ new Set([
   "SELF_SIGNED_CERT_IN_CHAIN",
@@ -181,14 +197,17 @@ var BY_SERVER_CODE = {
   "app.access.denied": "QORE_ACCESS_DENIED",
   "auth.scope.insufficient": "QORE_ACCESS_DENIED",
   "cli.upgrade_required": "QORE_UPGRADE_REQUIRED",
-  "rate_limited": "QORE_RATE_LIMITED"
+  "rate_limited": "QORE_RATE_LIMITED",
+  "module.not_found": "QORE_RESOURCE_NOT_FOUND",
+  "tenant.not_found": "QORE_RESOURCE_NOT_FOUND",
+  "module.app_ambiguous": "QORE_APP_AMBIGUOUS"
 };
-function byStatus(status) {
-  if (status === 403) return "QORE_ACCESS_DENIED";
-  if (status === 404) return "QORE_RESOURCE_NOT_FOUND";
-  if (status === 426) return "QORE_UPGRADE_REQUIRED";
-  if (status === 429) return "QORE_RATE_LIMITED";
-  if (status === 502 || status === 503 || status === 504) return "QORE_API_UNAVAILABLE";
+function byStatus(status2) {
+  if (status2 === 403) return "QORE_ACCESS_DENIED";
+  if (status2 === 404) return "QORE_RESOURCE_NOT_FOUND";
+  if (status2 === 426) return "QORE_UPGRADE_REQUIRED";
+  if (status2 === 429) return "QORE_RATE_LIMITED";
+  if (status2 === 502 || status2 === 503 || status2 === 504) return "QORE_API_UNAVAILABLE";
   return "QORE_INTERNAL";
 }
 async function problemToError(res) {
@@ -202,18 +221,22 @@ async function problemToError(res) {
   const requestId = res.headers.get("x-request-id") ?? void 0;
   const details = {};
   if (body.detail && typeof body.detail === "object") Object.assign(details, body.detail);
-  const detail = typeof body.detail === "string" && body.detail ? body.detail : void 0;
-  if (detail) details.detail = detail;
+  const detail2 = typeof body.detail === "string" && body.detail ? body.detail : void 0;
+  if (detail2) details.detail = detail2;
   const retry = res.headers.get("retry-after");
   if (retry && /^\d+$/.test(retry)) details.retryAfter = Number(retry);
-  const hint = code === "QORE_UPGRADE_REQUIRED" ? "Run: npm i -g @quatronic/qore" : code === "QORE_RATE_LIMITED" ? `Wait ${details.retryAfter ?? "a moment"} s and retry.` : code === "QORE_API_UNAVAILABLE" ? "Qore is temporarily unavailable; retry in a minute." : void 0;
+  const hint = code === "QORE_UPGRADE_REQUIRED" ? "Run: npm i -g @quatronic/qore" : code === "QORE_RATE_LIMITED" ? `Wait ${details.retryAfter ?? "a moment"} s and retry.` : code === "QORE_API_UNAVAILABLE" ? "Qore is temporarily unavailable; retry in a minute." : code === "QORE_APP_AMBIGUOUS" ? "Pass --app <slug>." : void 0;
+  const apps = body.detail?.apps;
+  const candidates = code === "QORE_APP_AMBIGUOUS" && Array.isArray(apps) ? apps.map((a) => ({ kind: "app", id: a.id, slug: a.slug, name: a.name })) : void 0;
+  if (candidates) delete details.apps;
   const genericTitle = !body.title || body.title === "HTTP error" || body.title === serverCode;
-  const message = genericTitle && detail || body.title || `Request failed (${res.status})`;
+  const message = genericTitle && detail2 || body.title || `Request failed (${res.status})`;
   return new QoreError(code, message, {
     status: res.status,
     requestId,
     serverCode,
     hint,
+    candidates,
     details: Object.keys(details).length ? details : void 0
   });
 }
@@ -243,15 +266,19 @@ function renderError(io2, err, json2, colorEnabled = pc.isColorSupported) {
 }
 
 // src/cli/program.ts
+function argvBeforeSeparator(argv2) {
+  const i = argv2.indexOf("--");
+  return i === -1 ? argv2 : argv2.slice(0, i);
+}
 function jsonFromArgv(argv2) {
-  return argv2.some((a) => a === "--json" || a.startsWith("--json="));
+  return argvBeforeSeparator(argv2).some((a) => a === "--json" || a.startsWith("--json="));
 }
 function requestLog(ctx) {
-  return ctx.opts().verbose ? (line) => ctx.io.err(line) : void 0;
+  return ctx.opts().verbose ? (line2) => ctx.io.err(line2) : void 0;
 }
-function buildProgram(deps2, io2, signal, register) {
+function buildProgram(deps2, io2, signal, register, setExitCode) {
   const program = new Command("qore").description("Qore developer CLI").option("--portal <name|url>", "prod, staging, or a portal URL (default: the portal you last logged in to, else prod)").option("--json", "print exactly one JSON document on stdout").option("--no-input", "never prompt").option("--verbose", "log request lines (never secrets)").option("--no-color", "disable colours").exitOverride().configureOutput({ writeOut: (s) => io2.out(s.trimEnd()), writeErr: (s) => io2.err(s.trimEnd()) });
-  const ctx = { deps: deps2, io: io2, signal, opts: () => program.opts() };
+  const ctx = { deps: deps2, io: io2, signal, opts: () => program.opts(), setExitCode };
   for (const r of register) r(program, ctx);
   return program;
 }
@@ -259,10 +286,13 @@ async function run(argv2, deps2, io2, signal, register) {
   const json2 = jsonFromArgv(argv2);
   const parseIo = json2 ? { ...io2, err: () => {
   } } : io2;
-  const program = buildProgram(deps2, parseIo, signal, register);
+  const state = {};
+  const program = buildProgram(deps2, parseIo, signal, register, (code) => {
+    state.exitCode = code;
+  });
   try {
     await program.parseAsync(argv2, { from: "user" });
-    return 0;
+    return state.exitCode ?? 0;
   } catch (caught) {
     const e = signal.aborted && isAbortError(caught) ? new CancelledError() : caught;
     if (e instanceof CommanderError) {
@@ -276,6 +306,10 @@ async function run(argv2, deps2, io2, signal, register) {
   }
 }
 
+// src/cli/commands/clone.ts
+import { join as join6, relative as relative2, resolve as resolve2 } from "path";
+import { Option } from "commander";
+
 // src/core/api/meta.ts
 var SUPPORTED = ["v1"];
 var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/;
@@ -290,10 +324,10 @@ function compareVersions(a, b) {
   if (!pa[4] && pb[4]) return 1;
   return 0;
 }
-async function fetchMeta(fetch2, apiOrigin) {
+async function fetchMeta(fetch3, apiOrigin) {
   let res;
   try {
-    res = await fetch2(`${apiOrigin}/api/cli/meta`, { headers: { accept: "application/json" } });
+    res = await fetch3(`${apiOrigin}/api/cli/meta`, { headers: { accept: "application/json" } });
   } catch (e) {
     throw fetchError(e, new URL(apiOrigin).host);
   }
@@ -329,170 +363,38 @@ function negotiate(meta, portal, cliVersion) {
   return { apiVersion };
 }
 
-// src/core/auth/oidc.ts
-import * as oc from "openid-client";
-var LOGIN_SCOPE = "openid profile email offline_access qore:read qore:local-env";
-function decodeSub(accessToken) {
-  const part = accessToken.split(".")[1] ?? "";
-  const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
-  return { sub: claims.sub, email: claims.email };
-}
-function toTokenSet(t, fallbackRt) {
-  const rt = t.refresh_token ?? fallbackRt;
-  if (!rt) throw new QoreError("QORE_INTERNAL", "Keycloak returned no refresh token");
-  return {
-    accessToken: t.access_token,
-    refreshToken: rt,
-    expiresIn: t.expires_in ?? 600,
-    scope: t.scope ?? "",
-    ...decodeSub(t.access_token)
-  };
-}
-function unreachable(e, host) {
-  const n = networkError(e, host);
-  return new QoreError("QORE_AUTH_UNAVAILABLE", n.message, { hint: n.hint, details: n.details, cause: e });
+// src/core/api/capabilities.ts
+var TTL_MS = 36e5;
+function isMeta(doc) {
+  return !!doc && typeof doc === "object" && Array.isArray(doc.capabilities);
 }
-function mapOidcError(e, host) {
-  if (e instanceof QoreError || e instanceof CancelledError) return e;
-  if (isAbortError(e) || e?.code === "OAUTH_ABORT" || isAbortError(e?.cause)) {
-    return new CancelledError();
+async function loadMeta(deps2, apiOrigin, refresh) {
+  const cached = (await deps2.config.read()).profiles[apiOrigin]?.meta;
+  if (!refresh && cached && isMeta(cached.doc) && deps2.now().getTime() - new Date(cached.fetchedAt).getTime() < TTL_MS) {
+    return { meta: cached.doc, cached: true };
   }
-  const err = e.error;
-  if (err === "access_denied") return new QoreError("QORE_LOGIN_DENIED", "The login was denied in the browser");
-  if (err === "expired_token") return new QoreError("QORE_LOGIN_EXPIRED", "The login code expired", { hint: "Run `qore login` again." });
-  if (err === "invalid_grant") return new QoreError("QORE_SESSION_EXPIRED", "Your session has ended", { hint: "Run `qore login`." });
-  const status = e.status;
-  if (status && status >= 500) return new QoreError("QORE_AUTH_UNAVAILABLE", "Keycloak is unavailable", { cause: e });
-  if (e instanceof TypeError) return unreachable(e, host);
-  const cause = e?.cause;
-  if (cause instanceof TypeError) return unreachable(cause, host);
-  return new QoreError("QORE_AUTH_UNAVAILABLE", "Login failed", { cause: e });
+  const meta = await fetchMeta(deps2.fetch, apiOrigin);
+  await deps2.config.update((c) => {
+    const p = c.profiles[apiOrigin];
+    if (p) p.meta = { fetchedAt: deps2.now().toISOString(), doc: meta };
+  });
+  return { meta, cached: false };
 }
-async function createOidc(opts) {
-  const host = new URL(opts.issuer).host;
-  const execute = new URL(opts.issuer).protocol === "http:" ? [oc.allowInsecureRequests] : [];
-  let config;
-  try {
-    config = await oc.discovery(new URL(opts.issuer), opts.clientId, void 0, oc.None(), {
-      execute,
-      [oc.customFetch]: opts.fetch
-    });
-  } catch (e) {
-    throw mapOidcError(e, host);
-  }
-  return {
-    async startDevice(scope) {
-      try {
-        const r = await oc.initiateDeviceAuthorization(config, { scope });
-        return {
-          userCode: r.user_code,
-          verificationUri: r.verification_uri,
-          verificationUriComplete: r.verification_uri_complete,
-          expiresIn: r.expires_in,
-          handle: r
-        };
-      } catch (e) {
-        throw mapOidcError(e, host);
-      }
-    },
-    async pollDevice(start, signal) {
-      try {
-        const t = await oc.pollDeviceAuthorizationGrant(config, start.handle, void 0, { signal });
-        return toTokenSet(t);
-      } catch (e) {
-        throw mapOidcError(e, host);
-      }
-    },
-    async refresh(rt, scope) {
-      try {
-        const t = await oc.refreshTokenGrant(config, rt, scope ? { scope } : void 0);
-        return toTokenSet(t, rt);
-      } catch (e) {
-        throw mapOidcError(e, host);
-      }
-    },
-    async revoke(rt) {
-      try {
-        await oc.tokenRevocation(config, rt, { token_type_hint: "refresh_token" });
-      } catch (e) {
-        throw mapOidcError(e, host);
-      }
-    }
-  };
+async function ensureCapability(deps2, apiOrigin, capability) {
+  const first = await loadMeta(deps2, apiOrigin, false);
+  let meta = first.meta;
+  if (!meta.capabilities.includes(capability) && first.cached) meta = (await loadMeta(deps2, apiOrigin, true)).meta;
+  requireCapability(meta, capability, apiOrigin);
+  return meta;
 }
-
-// src/core/auth/login.ts
-async function deviceLogin(opts) {
-  await opts.store.getRefresh();
-  const start = await opts.oidc.startDevice(LOGIN_SCOPE);
-  const stopPoll = new AbortController();
-  const settled = new AbortController();
-  const poll = opts.oidc.pollDevice(start, AbortSignal.any([opts.signal, stopPoll.signal])).finally(() => settled.abort());
-  poll.catch(() => {
+function requireCapability(meta, capability, apiOrigin) {
+  if (meta.capabilities.includes(capability)) return;
+  throw new QoreError("QORE_UNSUPPORTED_BY_SERVER", `This portal does not support ${capability} yet`, {
+    hint: `The portal at ${apiOrigin} is older than this qore. Try again once it has been updated.`,
+    details: { capability, portal: apiOrigin }
   });
-  try {
-    await opts.onCode(start, settled.signal);
-  } catch (e) {
-    stopPoll.abort();
-    const late = await poll.catch(() => null);
-    if (late) await opts.oidc.revoke(late.refreshToken).catch(() => {
-    });
-    throw e;
-  }
-  const t = await poll;
-  const at = opts.now();
-  const write = async () => {
-    await opts.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope, obtainedAt: at.toISOString() });
-    await opts.store.setAccess({ at: t.accessToken, expiresAt: new Date(at.getTime() + t.expiresIn * 1e3).toISOString() });
-  };
-  try {
-    if (opts.withLock && opts.lockName) await opts.withLock(opts.lockName, write);
-    else await write();
-  } catch (e) {
-    await opts.oidc.revoke(t.refreshToken).catch(() => {
-    });
-    await opts.store.clear().catch(() => {
-    });
-    throw e;
-  }
-  return t;
 }
 
-// src/core/auth/tokenStore.ts
-var TokenStore = class {
-  constructor(kc, hash) {
-    this.kc = kc;
-    this.hash = hash;
-  }
-  kc;
-  hash;
-  async read(suffix) {
-    const raw = await this.kc.get(`${this.hash}:${suffix}`);
-    if (raw === null) return null;
-    try {
-      return JSON.parse(raw);
-    } catch {
-      return null;
-    }
-  }
-  getRefresh() {
-    return this.read("refresh");
-  }
-  getAccess() {
-    return this.read("access");
-  }
-  setRefresh(v) {
-    return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v));
-  }
-  setAccess(v) {
-    return this.kc.set(`${this.hash}:access`, JSON.stringify(v));
-  }
-  async clear() {
-    await this.kc.delete(`${this.hash}:access`);
-    await this.kc.delete(`${this.hash}:refresh`);
-  }
-};
-
 // src/core/profiles.ts
 import { createHash } from "crypto";
 var BUILTIN_PORTALS = {
@@ -543,29 +445,34 @@ var QoreApiClient = class {
     this.o = o;
   }
   o;
-  async once(path, force) {
+  async once(method, path, body, force) {
     const token = await this.o.token(force);
+    const headers = {
+      authorization: `Bearer ${token}`,
+      accept: "application/json",
+      "qore-cli-version": this.o.cliVersion,
+      "qore-command": this.o.command,
+      "user-agent": `qore/${this.o.cliVersion} (${this.o.platform})`
+    };
+    if (body !== void 0) headers["content-type"] = "application/json";
     let res;
     try {
       res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {
-        headers: {
-          authorization: `Bearer ${token}`,
-          accept: "application/json",
-          "qore-cli-version": this.o.cliVersion,
-          "qore-command": this.o.command,
-          "user-agent": `qore/${this.o.cliVersion} (${this.o.platform})`
-        }
+        method,
+        headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body)
       });
     } catch (e) {
       throw fetchError(e, new URL(this.o.apiOrigin).host);
     }
-    this.o.onRequest?.(`GET ${path} \u2192 ${res.status}${res.headers.get("x-request-id") ? ` (${res.headers.get("x-request-id")})` : ""}`);
+    const rid = res.headers.get("x-request-id");
+    this.o.onRequest?.(`${method} ${path} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
     return res;
   }
-  async get(path) {
-    let res = await this.once(path, false);
+  async request(method, path, body) {
+    let res = await this.once(method, path, body, false);
     if (res.status === 401) {
-      res = await this.once(path, true);
+      res = await this.once(method, path, body, true);
       if (res.status === 401) {
         throw new QoreError("QORE_SESSION_EXPIRED", "The portal no longer accepts your session", {
           hint: "Run `qore login`.",
@@ -577,6 +484,12 @@ var QoreApiClient = class {
     if (!res.ok) throw await problemToError(res);
     return await res.json();
   }
+  get(path) {
+    return this.request("GET", path);
+  }
+  post(path, body) {
+    return this.request("POST", path, body);
+  }
 };
 
 // src/core/auth/refresh.ts
@@ -631,6 +544,41 @@ var RefreshCoordinator = class {
   }
 };
 
+// src/core/auth/tokenStore.ts
+var TokenStore = class {
+  constructor(kc, hash) {
+    this.kc = kc;
+    this.hash = hash;
+  }
+  kc;
+  hash;
+  async read(suffix) {
+    const raw = await this.kc.get(`${this.hash}:${suffix}`);
+    if (raw === null) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  getRefresh() {
+    return this.read("refresh");
+  }
+  getAccess() {
+    return this.read("access");
+  }
+  setRefresh(v) {
+    return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v));
+  }
+  setAccess(v) {
+    return this.kc.set(`${this.hash}:access`, JSON.stringify(v));
+  }
+  async clear() {
+    await this.kc.delete(`${this.hash}:access`);
+    await this.kc.delete(`${this.hash}:refresh`);
+  }
+};
+
 // src/core/session.ts
 function loginHint(portal) {
   return portal.builtin === "prod" ? "Run `qore login`." : `Run \`qore login --portal ${portal.builtin ?? portal.apiOrigin}\`.`;
@@ -654,56 +602,1580 @@ async function openSession(deps2, portal, command, onRequest) {
   return { profile, api, tokens, refresh };
 }
 
-// src/cli/commands/login.ts
-function registerLogin(program, ctx) {
-  program.command("login").description("Log in with your Qore account").option("--no-browser", "only print the URL").action(async (cmd) => {
-    const { deps: deps2, io: io2, signal } = ctx;
-    const g = ctx.opts();
-    const cfg = await deps2.config.read();
-    const portal = resolvePortal(g.portal, cfg.defaultProfile);
-    const meta = await fetchMeta(deps2.fetch, portal.apiOrigin);
-    const known = cfg.profiles[portal.apiOrigin]?.issuer;
-    const pinned = { ...portal, pinnedIssuer: portal.pinnedIssuer ?? known ?? null };
-    if (!pinned.pinnedIssuer && portal.builtin === null) {
-      io2.err(`! Logging in to ${portal.apiOrigin}, identity provider ${meta.auth.issuer}`);
+// src/core/workspace/apps.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var tenantCandidates = (tenants) => tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
+async function resolveAppRef(deps2, session, arg, tenantFlag) {
+  if (UUID.test(arg)) return { appId: arg, tenant: null };
+  const me = await session.api.get("/api/cli/v1/me");
+  let tenant;
+  if (tenantFlag) {
+    const found = me.tenants.find((t) => t.slug === tenantFlag);
+    if (!found) {
+      throw new QoreError("QORE_RESOURCE_NOT_FOUND", `No tenant "${tenantFlag}" for this account`, {
+        candidates: tenantCandidates(me.tenants)
+      });
     }
-    negotiate(meta, pinned, deps2.version);
-    const issuer = pinned.pinnedIssuer ?? meta.auth.issuer;
-    const hash = profileHash(portal.apiOrigin, issuer);
-    const store = new TokenStore(deps2.keychain, hash);
-    const t = await deviceLogin({
-      oidc: await deps2.oidcFor(issuer),
-      store,
-      now: deps2.now,
-      signal,
-      withLock: deps2.withLock,
-      lockName: hash,
-      onCode: async (s, settled) => {
-        const url = s.verificationUriComplete ?? s.verificationUri;
-        io2.err(`! First copy your one-time code: ${s.userCode}`);
-        if (io2.interactive && cmd.browser) {
-          try {
-            await io2.waitForEnter(`  Press Enter to open ${url} (or open it yourself)`, AbortSignal.any([signal, settled]));
-          } catch (e) {
-            if (settled.aborted && !signal.aborted) return;
-            throw e;
-          }
-          if (settled.aborted) return;
-          if (!await io2.openUrl(url)) io2.err(`  Open ${url} in a browser`);
-        } else {
-          io2.err(`  Open ${url} in a browser`);
-        }
-      }
+    tenant = { id: found.id, slug: found.slug };
+  } else if (session.profile.activeTenant) {
+    const active = session.profile.activeTenant;
+    const found = me.tenants.find((t) => t.id === active.id);
+    if (!found) {
+      throw new QoreError("QORE_TENANT_ACCESS_LOST", `You no longer have developer access to ${active.slug}`, {
+        hint: "Run `qore tenant use <slug>`.",
+        candidates: tenantCandidates(me.tenants)
+      });
+    }
+    tenant = { id: found.id, slug: found.slug };
+  } else if (me.tenants.length === 1) {
+    tenant = { id: me.tenants[0].id, slug: me.tenants[0].slug };
+  } else {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${arg}" in?`, {
+      hint: "Run `qore tenant use <slug>`, or pass --tenant <slug>.",
+      candidates: tenantCandidates(me.tenants)
     });
-    await deps2.config.update((c) => {
-      c.profiles[portal.apiOrigin] = {
-        ...c.profiles[portal.apiOrigin],
-        apiOrigin: portal.apiOrigin,
-        issuer,
-        sub: t.sub,
-        email: t.email,
-        meta: { fetchedAt: deps2.now().toISOString(), doc: meta }
-      };
+  }
+  try {
+    const { id } = await session.api.get(
+      `/api/cli/v1/tenants/${encodeURIComponent(tenant.id)}/apps/resolve?slug=${encodeURIComponent(arg)}`
+    );
+    return { appId: id, tenant };
+  } catch (e) {
+    if (e instanceof QoreError && e.code === "QORE_RESOURCE_NOT_FOUND" && !e.hint) {
+      throw new QoreError(e.code, e.message, {
+        hint: "Check the slug; `qore whoami` lists the apps you can see.",
+        status: e.status,
+        requestId: e.requestId,
+        candidates: e.candidates,
+        serverCode: e.serverCode,
+        details: e.details,
+        cause: e.cause
+      });
+    }
+    throw e;
+  }
+}
+
+// src/core/workspace/apply.ts
+import { join as join4, relative } from "path";
+
+// src/core/context/cache.ts
+import { join as join2 } from "path";
+
+// src/core/jsonFile.ts
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { join } from "path";
+import { randomBytes } from "crypto";
+async function readJson(file) {
+  let raw;
+  try {
+    raw = await readFile(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+  return JSON.parse(raw);
+}
+async function writeJsonAtomic(dir2, name, data) {
+  await mkdir(dir2, { recursive: true, mode: 448 });
+  const tmp = join(dir2, `.${name}.${randomBytes(6).toString("hex")}.tmp`);
+  await writeFile(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+  await chmod(tmp, 384);
+  await rename(tmp, join(dir2, name));
+}
+
+// src/core/context/cache.ts
+var TTL_MS2 = 24 * 36e5;
+var ResolutionCache = class {
+  constructor(dir2, now) {
+    this.dir = dir2;
+    this.now = now;
+  }
+  dir;
+  now;
+  async load() {
+    try {
+      const f = await readJson(join2(this.dir, "repos.json"));
+      if (f && f.schemaVersion === 1 && typeof f.entries === "object" && f.entries) return f;
+    } catch {
+    }
+    return { schemaVersion: 1, entries: {} };
+  }
+  fresh(e) {
+    return !!e && this.now().getTime() - new Date(e.resolvedAt).getTime() < TTL_MS2;
+  }
+  async get(origin, key) {
+    const e = (await this.load()).entries[`${origin}|${key}`];
+    return this.fresh(e) ? e.moduleId : null;
+  }
+  /** Never throws: a read-only config dir, a full disk or a Windows EPERM on rename
+   * (another qore holding the file) must not fail a command that already resolved. */
+  async put(origin, key, moduleId) {
+    const f = await this.load();
+    f.entries[`${origin}|${key}`] = { moduleId, resolvedAt: this.now().toISOString() };
+    for (const [k, e] of Object.entries(f.entries)) if (!this.fresh(e)) delete f.entries[k];
+    await this.save(f);
+  }
+  /** Never throws, like `put`. */
+  async drop(origin, key) {
+    const f = await this.load();
+    if (!(`${origin}|${key}` in f.entries)) return;
+    delete f.entries[`${origin}|${key}`];
+    await this.save(f);
+  }
+  async save(f) {
+    try {
+      await writeJsonAtomic(this.dir, "repos.json", f);
+    } catch {
+    }
+  }
+  async originsFor(keys) {
+    const f = await this.load();
+    const hits = [];
+    for (const [k, e] of Object.entries(f.entries)) {
+      const sep2 = k.lastIndexOf("|");
+      if (keys.includes(k.slice(sep2 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep2), at: new Date(e.resolvedAt).getTime() });
+    }
+    hits.sort((a, b) => b.at - a.at);
+    return [...new Set(hits.map((h) => h.origin))];
+  }
+};
+
+// src/core/context/repoKey.ts
+var SCP = /^(?:[^@/]+@)?([^:/]+):([^/].*)$/;
+var SCHEMES = /* @__PURE__ */ new Set(["https:", "http:", "ssh:", "git:"]);
+var DOT_SEGMENTS = /* @__PURE__ */ new Set([".", "..", "%2e", "%2e%2e", ".%2e", "%2e."]);
+var hasDotSegment = (pieces) => pieces.some((p) => DOT_SEGMENTS.has(p.toLowerCase()));
+function repoKey(url) {
+  let raw = url.trim();
+  if (raw.startsWith("git+")) raw = raw.slice(4);
+  if (!raw || raw.includes("\\")) return null;
+  let host;
+  let path;
+  if (raw.includes("://")) {
+    if (hasDotSegment(raw.slice(raw.indexOf("://") + 3).split("/").slice(1))) return null;
+    let u;
+    try {
+      u = new URL(raw);
+    } catch {
+      return null;
+    }
+    if (!SCHEMES.has(u.protocol.toLowerCase())) return null;
+    host = u.hostname;
+    path = u.pathname;
+  } else {
+    const m = SCP.exec(raw);
+    if (!m) return null;
+    host = m[1];
+    path = m[2];
+  }
+  const segments = path.split("/").filter(Boolean);
+  if (!host || segments.length !== 2 || hasDotSegment(segments)) return null;
+  const owner = segments[0];
+  let repo = segments[1];
+  if (repo.toLowerCase().endsWith(".git")) repo = repo.slice(0, -4);
+  if (!repo) return null;
+  return `${host.toLowerCase()}/${owner.toLowerCase()}/${repo.toLowerCase()}`;
+}
+
+// src/core/trust.ts
+import { realpath } from "fs/promises";
+function trustKey(root, platform) {
+  return platform === "win32" ? root.toLowerCase() : root;
+}
+async function keyOf(deps2, root) {
+  let real = root;
+  try {
+    real = await realpath(root);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  return trustKey(real, deps2.platform);
+}
+async function isTrusted(deps2, root, moduleId) {
+  const cfg = await deps2.config.read();
+  return (cfg.trustedRepos?.[await keyOf(deps2, root)] ?? []).includes(moduleId);
+}
+async function trust(deps2, root, moduleId) {
+  const key = await keyOf(deps2, root);
+  await deps2.config.update((c) => {
+    const repos = c.trustedRepos ??= {};
+    const list = new Set(repos[key] ?? []);
+    list.add(moduleId);
+    repos[key] = [...list];
+  });
+}
+
+// src/core/workspace/plan.ts
+import { join as join3 } from "path";
+var SEGMENT = /^[A-Za-z0-9_.-]+$/;
+function isSupportedRepoUrl(repoUrl) {
+  let u;
+  try {
+    u = new URL(repoUrl);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" || !u.hostname || u.hostname.startsWith("-")) return false;
+  if (u.username || u.password || u.search || u.hash) return false;
+  const segments = u.pathname.replace(/\/+$/, "").split("/").slice(1);
+  return segments.length === 2 && segments.every((s) => SEGMENT.test(s) && !s.startsWith("-") && s !== "." && s !== "..");
+}
+function unsupportedRepoUrlError(slug, repoUrl) {
+  return new QoreError("QORE_INTERNAL", `${slug}: unsupported repository URL ${JSON.stringify(repoUrl)}`, {
+    hint: "This looks like a portal bug \u2014 please report it."
+  });
+}
+function cloneUrl(repoUrl, protocol) {
+  if (!isSupportedRepoUrl(repoUrl)) throw unsupportedRepoUrlError("module", repoUrl);
+  if (protocol === "https") return repoUrl;
+  const u = new URL(repoUrl);
+  return `git@${u.hostname}:${u.pathname.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/, "")}.git`;
+}
+function planWorkspace(root, modules, dirs, strayRepos2) {
+  const actions = modules.map((module) => {
+    const dir2 = join3(root, module.slug);
+    if (!module.repoUrl) return { module, dir: dir2, kind: "no-repo", reason: "no repository yet" };
+    if (!isSupportedRepoUrl(module.repoUrl)) return { module, dir: dir2, kind: "unsupported", reason: "unsupported repository URL" };
+    const info = dirs[module.slug] ?? { exists: false, empty: false, isRepo: false, remotes: [] };
+    if (!info.exists || info.empty) return { module, dir: dir2, kind: "clone" };
+    if (!info.isRepo) return { module, dir: dir2, kind: "conflict", reason: "not a git repository" };
+    const want = repoKey(module.repoUrl);
+    const origin = info.remotes.find((r) => r.name === "origin");
+    if (want !== null && origin && repoKey(origin.url) === want) return { module, dir: dir2, kind: "present" };
+    return { module, dir: dir2, kind: "conflict", reason: `re-pointed: ${origin?.url ?? "no origin remote"}`, origin: origin?.url ?? null };
+  });
+  const slugs = new Set(modules.map((m) => m.slug));
+  return { actions, removed: strayRepos2.filter((s) => !slugs.has(s)) };
+}
+
+// src/core/workspace/diagnose.ts
+var ACCESS_CODES = /* @__PURE__ */ new Set(["QORE_GITHUB_NOT_LINKED", "QORE_REPO_NO_ACCESS", "QORE_REPO_ACCESS_PENDING"]);
+var lastLines = (s, n) => s.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(-n);
+function classifyCloneFailure(stderr, m, app, protocol) {
+  const url = isSupportedRepoUrl(m.repoUrl) ? cloneUrl(m.repoUrl, protocol) : m.repoUrl;
+  const details = { module: m.slug, protocol, url };
+  if (/SAML SSO|single sign-on/i.test(stderr)) {
+    const link = /https:\/\/\S+/.exec(stderr)?.[0];
+    return new QoreError("QORE_GIT_AUTH", `GitHub wants SSO authorisation for ${m.slug}`, {
+      hint: `Authorise your ${protocol === "ssh" ? "SSH key" : "token"} for the organisation${link ? `: ${link}` : ""}.`,
+      details: { ...details, reason: "sso" }
+    });
+  }
+  if (/Host key verification failed/.test(stderr)) {
+    const host = /\bfor ([\w.-]+) and you have requested strict checking/.exec(stderr)?.[1] ?? "github.com";
+    return new QoreError("QORE_GIT_AUTH", `ssh could not verify ${host}'s host key (${m.slug})`, {
+      hint: `Run \`ssh -T git@${host}\` once to accept its host key (or to see why it changed), then run \`qore sync\`.`,
+      details: { ...details, protocol: "ssh", reason: "host-key" }
+    });
+  }
+  if (/Permission denied \(publickey\)/.test(stderr)) {
+    return new QoreError("QORE_GIT_AUTH", `GitHub refused your SSH key for ${m.slug}`, {
+      hint: "Check with `ssh -T git@github.com`, or clone over https: `--protocol https` after `gh auth login`.",
+      details: { ...details, protocol: "ssh" }
+    });
+  }
+  if (/could not read Username|Authentication failed|Invalid username or (password|token)/i.test(stderr)) {
+    return new QoreError("QORE_GIT_AUTH", `git has no GitHub credentials for ${m.slug}`, {
+      hint: "`gh auth login` sets up git credentials; or use `--protocol ssh`.",
+      details: { ...details, protocol: "https" }
+    });
+  }
+  if (/Repository not found|repository '.*' not found/i.test(stderr)) {
+    if (!m.githubLinked) {
+      return new QoreError("QORE_GITHUB_NOT_LINKED", `Your GitHub account is not linked in Qore (${m.slug})`, {
+        hint: `Link your GitHub account at ${app.accountUrl}, then run \`qore sync\`.`,
+        details
+      });
+    }
+    if (m.repoAccess === "none") {
+      const filtered = m.devTeamIds?.length ? app.devTeams.filter((t) => m.devTeamIds.includes(t.id)) : [];
+      const moduleTeams = filtered.length ? filtered : app.devTeams;
+      const teams = moduleTeams.map((t) => `"${t.name}"`).join(" or ");
+      const emails = [...new Set(moduleTeams.flatMap((t) => t.maintainers))].join(", ");
+      return new QoreError("QORE_REPO_NO_ACCESS", `No repository access to ${m.slug}`, {
+        hint: teams ? `Ask a maintainer of dev team ${teams} for a seat${emails ? `: ${emails}` : ""}.` : `Ask your tenant owner which dev team builds ${m.slug}.`,
+        details: { ...details, devTeams: moduleTeams.map((t) => t.name) }
+      });
+    }
+    const owner = repoKey(m.repoUrl)?.split("/")[1];
+    const invitation = owner ? ` https://github.com/orgs/${owner}/invitation` : "";
+    return new QoreError("QORE_REPO_ACCESS_PENDING", `GitHub does not grant ${m.slug} yet`, {
+      hint: `Access was granted recently, or your invitation to the GitHub organisation is not accepted yet:${invitation} \u2014 then retry in a minute.`,
+      details
+    });
+  }
+  return new QoreError("QORE_INTERNAL", `Cloning ${m.slug} failed`, {
+    hint: [...lastLines(stderr, 3), `\`git clone ${url}\``].join("\n"),
+    details
+  });
+}
+function classifyPullFailure(stderr) {
+  if (/Not possible to fast-forward/i.test(stderr)) return "diverged";
+  return lastLines(stderr, 1)[0] ?? "pull failed";
+}
+
+// src/core/workspace/apply.ts
+function toFailure(slug, e) {
+  if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
+    return { slug, status: "failed", error: { code: e.code, message: e.message, hint: e.hint } };
+  }
+  throw e;
+}
+function conflictResult(deps2, action) {
+  const dir2 = relative(deps2.cwd, action.dir) || ".";
+  const what = action.reason === "not a git repository" ? "it is not a git repository" : action.origin ? `its origin is ${action.origin}, not ${action.module.repoUrl}` : "it has no origin remote";
+  const message = action.reason === "not a git repository" ? `${dir2} is not a git repository` : action.origin ? `${dir2} holds another repository (its origin is ${action.origin}, not ${action.module.repoUrl})` : `${dir2} has no origin remote`;
+  return {
+    slug: action.module.slug,
+    status: "conflict",
+    reason: action.reason,
+    error: { code: "QORE_WORKSPACE_CONFLICT", message, hint: `Move ${dir2} aside (${what}), then run \`qore sync\`.` }
+  };
+}
+async function applyActions(deps2, o) {
+  const cache = new ResolutionCache(join4(deps2.config.dir, "cache"), deps2.now);
+  const results = [];
+  for (const action of o.actions) {
+    let result;
+    switch (action.kind) {
+      case "present":
+        result = { slug: action.module.slug, status: "present" };
+        break;
+      case "conflict":
+        result = conflictResult(deps2, action);
+        break;
+      case "unsupported": {
+        const e = unsupportedRepoUrlError(action.module.slug, action.module.repoUrl ?? "");
+        result = { slug: action.module.slug, status: "failed", reason: action.reason, error: { code: e.code, message: e.message, hint: e.hint } };
+        break;
+      }
+      case "no-repo":
+        result = { slug: action.module.slug, status: "no-repo", reason: action.reason };
+        break;
+      case "clone": {
+        try {
+          const url = cloneUrl(action.module.repoUrl, o.protocol);
+          const r = await deps2.git.clone(url, action.dir);
+          if (r.ok) {
+            await trust(deps2, action.dir, action.module.id);
+            const key = repoKey(action.module.repoUrl);
+            if (key) await cache.put(o.portal.apiOrigin, key, action.module.id);
+            result = { slug: action.module.slug, status: "cloned", dir: action.dir };
+          } else {
+            const err = classifyCloneFailure(r.stderr, action.module, o.app, o.protocol);
+            result = { slug: action.module.slug, status: "failed", error: { code: err.code, message: err.message, hint: err.hint } };
+          }
+        } catch (e) {
+          result = toFailure(action.module.slug, e);
+        }
+        break;
+      }
+    }
+    results.push(result);
+    o.onResult(result);
+  }
+  return results;
+}
+async function syncPresent(deps2, results, actions, pull, ctx) {
+  const bySlug = new Map(actions.map((a) => [a.module.slug, a]));
+  for (const result of results) {
+    if (result.status !== "present") continue;
+    const action = bySlug.get(result.slug);
+    if (!action) continue;
+    let fetchRes;
+    try {
+      fetchRes = await deps2.git.fetch(action.dir);
+    } catch (e) {
+      Object.assign(result, toFailure(result.slug, e));
+      continue;
+    }
+    if (!fetchRes.ok) {
+      const err = classifyCloneFailure(fetchRes.stderr, action.module, ctx.app, ctx.protocol);
+      result.status = "failed";
+      result.error = { code: err.code, message: err.message, hint: err.hint };
+      continue;
+    }
+    result.status = "fetched";
+    if (!pull) continue;
+    let st;
+    try {
+      st = await deps2.git.status(action.dir);
+    } catch (e) {
+      Object.assign(result, toFailure(result.slug, e));
+      continue;
+    }
+    if (!st.ok) {
+      result.status = "skipped";
+      result.reason = classifyPullFailure(st.stderr);
+      continue;
+    }
+    if (st.dirty) {
+      result.status = "skipped";
+      result.reason = "uncommitted changes";
+      continue;
+    }
+    if (!st.upstream) {
+      result.status = "skipped";
+      result.reason = "no upstream branch";
+      continue;
+    }
+    let pullRes;
+    try {
+      pullRes = await deps2.git.pullFfOnly(action.dir);
+    } catch (e) {
+      Object.assign(result, toFailure(result.slug, e));
+      continue;
+    }
+    if (!pullRes.ok) {
+      result.status = "skipped";
+      result.reason = classifyPullFailure(pullRes.stderr);
+      continue;
+    }
+    result.status = "pulled";
+  }
+}
+
+// src/core/workspace/file.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm, writeFile as writeFile2 } from "fs/promises";
+import { dirname, join as join5, resolve } from "path";
+var WORKSPACE_FILE = "qore.workspace.json";
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var invalid = (file, msg) => new QoreError("QORE_CONTEXT_INVALID", `${file}: ${msg}`, { hint: "Fix or delete the file; `qore clone <app>` writes a fresh one." });
+async function readAt(dir2) {
+  const file = join5(dir2, WORKSPACE_FILE);
+  let raw;
+  try {
+    raw = await readFile2(file, "utf8");
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw new QoreError("QORE_CONTEXT_INVALID", `${file}: cannot be read (${code ?? "unknown error"})`, {
+      hint: "Fix its permissions, or remove it; `qore clone <app>` writes a fresh one.",
+      cause: e
+    });
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    throw invalid(file, "not valid JSON");
+  }
+  const v = doc?.schemaVersion;
+  if (!Number.isInteger(v) || v < 1) throw invalid(file, "schemaVersion must be a positive integer");
+  if (v > 1) throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `${file} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
+  if (typeof doc.portal !== "string" || !/^https?:\/\//.test(doc.portal)) throw invalid(file, "portal must be a portal URL");
+  if (typeof doc.appId !== "string" || !UUID2.test(doc.appId)) throw invalid(file, "appId must be an app id");
+  return { root: dir2, portal: new URL(doc.portal).origin.toLowerCase(), appId: doc.appId };
+}
+async function readWorkspace(dir2) {
+  return readAt(dir2);
+}
+async function findWorkspace(start, home) {
+  let dir2 = resolve(start);
+  const stop = resolve(home);
+  for (; ; ) {
+    const ws = await readAt(dir2);
+    if (ws) return ws;
+    const up = dirname(dir2);
+    if (dir2 === stop || up === dir2) return null;
+    dir2 = up;
+  }
+}
+async function writeWorkspace(root, o) {
+  await mkdir2(root, { recursive: true });
+  const tmp = join5(root, `.${WORKSPACE_FILE}.${randomBytes2(6).toString("hex")}.tmp`);
+  try {
+    await writeFile2(tmp, JSON.stringify({ schemaVersion: 1, portal: o.portal, appId: o.appId }, null, 2) + "\n", { mode: 438 });
+    await rename2(tmp, join5(root, WORKSPACE_FILE));
+  } catch (e) {
+    await rm(tmp, { force: true }).catch(() => {
+    });
+    throw new QoreError("QORE_INTERNAL", `could not write ${join5(root, WORKSPACE_FILE)}`, { cause: e });
+  }
+}
+async function workspacePortal(deps2, ws) {
+  const portal = resolvePortal(ws.portal, void 0);
+  const label2 = portal.builtin ?? portal.apiOrigin;
+  const profile = (await deps2.config.read()).profiles[portal.apiOrigin];
+  const loggedIn = profile && await new TokenStore(deps2.keychain, profileHash(profile.apiOrigin, profile.issuer)).getRefresh();
+  if (!loggedIn) {
+    throw new QoreError("QORE_NOT_LOGGED_IN", `This workspace belongs to ${label2}, which you are not logged in to`, {
+      hint: `Run \`qore login --portal ${label2}\`.`
+    });
+  }
+  return portal;
+}
+
+// src/core/workspace/safety.ts
+var SAFE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/;
+var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/;
+function isSafeSlug(slug) {
+  return SAFE_SEGMENT.test(slug) && !WINDOWS_RESERVED.test(slug);
+}
+function unsafeSlugError(slug) {
+  return new QoreError("QORE_INTERNAL", `"${slug}" is not a safe directory name`, {
+    hint: "This looks like a portal bug \u2014 please report it."
+  });
+}
+
+// src/cli/workspaceReport.ts
+function exitFor(results) {
+  const failures = results.filter((r) => r.status === "failed" || r.status === "conflict");
+  if (failures.length === 0) return null;
+  const ok = results.some((r) => ["cloned", "present", "fetched", "pulled", "skipped"].includes(r.status));
+  const code = (r) => r.status === "conflict" ? "QORE_WORKSPACE_CONFLICT" : r.error?.code ?? "QORE_INTERNAL";
+  const nonAccess = failures.find((r) => !ACCESS_CODES.has(code(r)));
+  if (ok && !nonAccess) return null;
+  const first = nonAccess ?? failures[0];
+  const moduleCount = results.filter((r) => r.status !== "removed").length;
+  return new QoreError(code(first), `${failures.length} of ${moduleCount} modules need attention`, {
+    hint: first.error?.hint,
+    details: { results }
+  });
+}
+var FAILURE_LABELS = {
+  QORE_GITHUB_NOT_LINKED: "GitHub not linked",
+  QORE_REPO_NO_ACCESS: "no repository access",
+  QORE_REPO_ACCESS_PENDING: "access pending",
+  QORE_GIT_AUTH: "git authentication"
+};
+function firstSentenceLower(hint) {
+  if (!hint) return "";
+  let sentence = hint;
+  const re = /\. (?=\S)/g;
+  let m;
+  while (m = re.exec(hint)) {
+    const before = hint.slice(0, m.index);
+    const backtickCount = (before.match(/`/g) ?? []).length;
+    if (backtickCount % 2 === 0) {
+      sentence = hint.slice(0, m.index + 1);
+      break;
+    }
+  }
+  sentence = sentence.trim();
+  return sentence.length ? sentence[0].toLowerCase() + sentence.slice(1) : sentence;
+}
+function failedLine(r) {
+  const label2 = FAILURE_LABELS[r.error?.code ?? ""] ?? "failed";
+  const detail2 = firstSentenceLower(r.error?.hint);
+  return `\u2717 ${r.slug}   ${label2}${detail2 ? ` \u2014 ${detail2}` : ""}`;
+}
+function line(r, conflictCount) {
+  switch (r.status) {
+    case "cloned":
+      return `\u2713 ${r.slug}   cloned${r.dir ? `  \u2192 ${r.dir}` : ""}`;
+    case "pulled":
+      return `\u2713 ${r.slug}   pulled`;
+    case "present":
+      return `  ${r.slug}   present`;
+    case "skipped":
+      return `! ${r.slug}   skipped \u2014 ${r.reason}`;
+    case "no-repo":
+      return `  ${r.slug}   ${r.reason ?? "no repository yet"}`;
+    case "removed":
+      return `! ${r.slug}   not a module of this app \u2014 left in place`;
+    case "conflict": {
+      const detail2 = conflictCount > 1 ? firstSentenceLower(r.error?.hint) : "";
+      return `\u2717 ${r.slug}   ${r.reason ?? "conflict"}${detail2 ? ` \u2014 ${detail2}` : ""}`;
+    }
+    case "failed":
+      return failedLine(r);
+    case "fetched":
+      return `  ${r.slug}   fetched`;
+  }
+}
+function renderResults(io2, results, json2) {
+  if (json2) {
+    renderJson(io2, { results });
+    return;
+  }
+  const conflictCount = results.filter((r) => r.status === "conflict").length;
+  let i = 0;
+  while (i < results.length) {
+    const r = results[i];
+    if (r.status === "fetched" || r.status === "pulled") {
+      const group = [r];
+      let j = i + 1;
+      while (j < results.length && results[j].status === r.status) {
+        group.push(results[j]);
+        j++;
+      }
+      io2.out(`  ${group.map((g) => g.slug).join(", ")}   ${r.status}`);
+      i = j;
+      continue;
+    }
+    io2.out(line(r, conflictCount));
+    i++;
+  }
+}
+function reportWorkspaceRun(io2, results, json2) {
+  const err = exitFor(results);
+  if (!err || !json2) renderResults(io2, results, json2);
+  return err;
+}
+
+// src/cli/commands/clone.ts
+function asFailure(slug, e) {
+  if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
+    return { slug, status: "failed", error: { code: e.code, message: e.message, hint: e.hint } };
+  }
+  throw e;
+}
+async function resolveApp(deps2, io2, session, appArg, tenantFlag) {
+  try {
+    return await resolveAppRef(deps2, session, appArg, tenantFlag);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" && e.code !== "QORE_TENANT_ACCESS_LOST") throw e;
+    if (!io2.interactive || !e.candidates?.length) throw e;
+    const slug = await io2.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.slug })));
+    return resolveAppRef(deps2, session, appArg, slug);
+  }
+}
+function registerClone(program, ctx) {
+  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("<app>", "app slug or id").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+    const session = await openSession(deps2, portal, "clone", onRequest);
+    await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+    const ref = await resolveApp(deps2, io2, session, appArg, flags.tenant);
+    const app = await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ref.appId)}/modules`);
+    if (dirArg === void 0 && !isSafeSlug(app.app.slug)) throw unsafeSlugError(app.app.slug);
+    const dirLabel = dirArg ?? app.app.slug;
+    const root = resolve2(deps2.cwd, dirLabel);
+    const info = await deps2.git.inspect(root);
+    if (info.exists && !info.empty) {
+      const ws = await readWorkspace(root);
+      if (!ws || ws.appId !== app.app.id || ws.portal !== portal.apiOrigin) {
+        throw new QoreError("QORE_WORKSPACE_CONFLICT", `${root} exists and is not the workspace of ${app.app.slug}`, {
+          hint: `Pick another directory: qore clone ${appArg} <dir>.`
+        });
+      }
+    }
+    await writeWorkspace(root, { portal: portal.apiOrigin, appId: app.app.id });
+    const dirs = {};
+    const modulesForPlan = [];
+    const earlyFailures = [];
+    for (const m of app.modules) {
+      if (!isSafeSlug(m.slug)) {
+        earlyFailures.push(asFailure(m.slug, unsafeSlugError(m.slug)));
+        continue;
+      }
+      try {
+        dirs[m.slug] = await deps2.git.inspect(join6(root, m.slug));
+        modulesForPlan.push(m);
+      } catch (e) {
+        earlyFailures.push(asFailure(m.slug, e));
+      }
+    }
+    const { actions } = planWorkspace(root, modulesForPlan, dirs, []);
+    const applied = await applyActions(deps2, { portal, app, actions, protocol: flags.protocol, onResult: () => {
+    } });
+    for (const r of applied) {
+      if (r.status === "cloned" && r.dir) r.dir = relative2(deps2.cwd, r.dir) || ".";
+    }
+    const results = [...earlyFailures, ...applied];
+    const err = reportWorkspaceRun(io2, results, Boolean(g.json));
+    if (!g.json) {
+      io2.out(`\u2713 Wrote ${join6(dirLabel, "qore.workspace.json")}`);
+      const first = results.find((r) => r.status === "cloned" || r.status === "present");
+      if (first && !err) io2.out(`Next: cd ${join6(dirLabel, first.slug)} && qore env pull`);
+    }
+    if (err) throw err;
+  });
+}
+
+// src/cli/commands/env.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { chmod as chmod2, readFile as readFile4, realpath as realpath3, rename as rename3, unlink, writeFile as writeFile3 } from "fs/promises";
+import { basename as basename2, dirname as dirname4, join as join10, relative as relative5 } from "path";
+
+// src/core/context/repoConfig.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join7 } from "path";
+var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var invalid2 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
+function moduleDefaults(type) {
+  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
+}
+async function readRepoConfig(root) {
+  let raw;
+  try {
+    raw = await readFile3(join7(root, ".qore.json"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return {};
+    throw e;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    throw invalid2("not valid JSON");
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid2("must be an object");
+  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
+  if (!Number.isInteger(v) || v < 1) throw invalid2("schemaVersion must be a positive integer");
+  if (v > 1) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
+  }
+  for (const f of FORBIDDEN) if (f in doc) throw invalid2(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
+  const out = {};
+  if (doc.envFile !== void 0) {
+    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid2("envFile must be a non-empty string");
+    out.envFile = doc.envFile;
+  }
+  if (doc.localSecrets !== void 0) {
+    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
+      throw invalid2("localSecrets must be a list of env key names");
+    }
+    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid2("localSecrets must not contain duplicates");
+    out.localSecrets = doc.localSecrets;
+  }
+  return out;
+}
+
+// src/core/context/resolver.ts
+import { isAbsolute, join as join9, relative as relative3 } from "path";
+
+// src/core/context/repoRoot.ts
+import { stat } from "fs/promises";
+import { dirname as dirname2, join as join8, resolve as resolve3 } from "path";
+async function findRepoRoot(start) {
+  let dir2 = resolve3(start);
+  for (; ; ) {
+    try {
+      await stat(join8(dir2, ".git"));
+      return dir2;
+    } catch {
+    }
+    const up = dirname2(dir2);
+    if (up === dir2) return null;
+    dir2 = up;
+  }
+}
+
+// src/core/context/resolver.ts
+var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var HINT_FLAG = "cd into a module repository, or pass --module <slug|id>.";
+var RESOLVE = "/api/cli/v1/repos/resolve";
+var SKIPPABLE = /* @__PURE__ */ new Set([
+  "QORE_API_UNREACHABLE",
+  "QORE_API_UNAVAILABLE",
+  "QORE_AUTH_UNAVAILABLE",
+  "QORE_NOT_LOGGED_IN",
+  "QORE_SESSION_EXPIRED"
+]);
+var label = (p) => p.builtin ?? p.apiOrigin;
+function byPreference(remotes2) {
+  const rank = (r) => r.name === "origin" ? 0 : r.name === "upstream" ? 1 : 2;
+  return [...remotes2].sort((a, b) => rank(a) - rank(b));
+}
+var preferred = (remotes2) => byPreference(remotes2)[0];
+async function repoRemotes(deps2) {
+  const root = await findRepoRoot(deps2.cwd);
+  if (!root) return null;
+  let remotes2;
+  try {
+    remotes2 = await deps2.git.remotes(root);
+  } catch (e) {
+    if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") return { root, keyed: [], gitError: e };
+    throw e;
+  }
+  const keyed = remotes2.map((r) => ({ ...r, key: repoKey(r.url) })).filter((r) => r.key !== null);
+  return { root, keyed };
+}
+function detail(session, id) {
+  return session.api.get(`/api/cli/v1/modules/${encodeURIComponent(id)}`);
+}
+async function flagOverrides(deps2, session, portal, cache, moduleId) {
+  try {
+    const keyed = (await repoRemotes(deps2))?.keyed ?? [];
+    const derived = /* @__PURE__ */ new Map();
+    const uncached = [];
+    for (const key of new Set(keyed.map((r) => r.key))) {
+      const id = await cache.get(portal.apiOrigin, key);
+      if (id) derived.set(key, /* @__PURE__ */ new Set([id]));
+      else uncached.push(key);
+    }
+    if (uncached.length > 0) {
+      try {
+        const { matches } = await session.api.post(RESOLVE, { repoKeys: uncached });
+        for (const m of matches) derived.set(m.repoKey, (derived.get(m.repoKey) ?? /* @__PURE__ */ new Set()).add(m.module.id));
+        const ids = new Set(matches.map((m) => m.module.id));
+        if (ids.size === 1) for (const m of matches) await cache.put(portal.apiOrigin, m.repoKey, m.module.id);
+      } catch (e) {
+        if (e instanceof CancelledError) throw e;
+      }
+    }
+    return byPreference(keyed).find((r) => [...derived.get(r.key) ?? []].some((id) => id !== moduleId))?.name;
+  } catch (e) {
+    if (e instanceof CancelledError) throw e;
+    return void 0;
+  }
+}
+async function flagPortal(deps2, portalArg, ws) {
+  if (!portalArg && ws) return workspacePortal(deps2, ws);
+  return resolvePortal(portalArg, (await deps2.config.read()).defaultProfile);
+}
+async function workspaceAppModules(session, portal, ws) {
+  try {
+    return await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ws.appId)}/modules`);
+  } catch (e) {
+    if (e instanceof QoreError && e.code === "QORE_RESOURCE_NOT_FOUND" && portal.apiOrigin !== ws.portal) {
+      const p = resolvePortal(ws.portal, void 0);
+      const name = p.builtin ?? p.apiOrigin;
+      throw withDetails(e, { workspacePortal: p.apiOrigin }, `This workspace belongs to ${name}; drop --portal, or pass --portal ${name}.`);
+    }
+    throw e;
+  }
+}
+async function byFlag(deps2, o, cache, ws) {
+  const portal = await flagPortal(deps2, o.portal, ws);
+  const session = await openSession(deps2, portal, o.command, o.onRequest);
+  await ensureCapability(deps2, portal.apiOrigin, "repo.resolve");
+  let id = o.module;
+  if (!UUID3.test(id)) {
+    let tenantId = o.tenant ?? session.profile.activeTenant?.id;
+    if (!tenantId) {
+      const me = await session.api.get("/api/cli/v1/me");
+      if (me.tenants.length === 0) {
+        throw new QoreError("QORE_NO_DEVELOPER_ACCESS", "Your account is not a developer in any organisation", {
+          hint: "Ask an admin to invite you as a developer."
+        });
+      }
+      if (me.tenants.length > 1) {
+        const candidates = me.tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
+        throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${id}" in?`, {
+          hint: "Run `qore tenant use <slug>`, or pass the module id.",
+          candidates
+        });
+      }
+      tenantId = me.tenants[0].id;
+    }
+    id = (await session.api.get(
+      `/api/cli/v1/tenants/${encodeURIComponent(tenantId)}/modules/resolve?slug=${encodeURIComponent(id)}`
+    )).id;
+  }
+  const module = await detail(session, id);
+  const overrides = await flagOverrides(deps2, session, portal, cache, module.id);
+  const repoRoot = await findRepoRoot(deps2.cwd);
+  return { portal, session, module, source: overrides ? { kind: "flag", overrides } : { kind: "flag" }, repoRoot, workspace: ws };
+}
+var isBelow = (root, dir2) => {
+  const rel = relative3(root, dir2);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+};
+async function inWorkspaceRoot(deps2, ws) {
+  if (!ws) return false;
+  const repoRoot = await findRepoRoot(deps2.cwd);
+  return repoRoot === null || isBelow(repoRoot, ws.root);
+}
+async function inWorkspace(deps2, o, ws, portal) {
+  const session = await openSession(deps2, portal, o.command, o.onRequest);
+  if (o.choose) {
+    return { portal, session, module: await detail(session, o.choose), source: { kind: "workspace" }, repoRoot: null, workspace: ws };
+  }
+  await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+  const app = await workspaceAppModules(session, portal, ws);
+  const candidates = app.modules.map((m) => ({
+    kind: "module",
+    id: m.id,
+    slug: m.slug,
+    name: m.name,
+    tenant: app.app.tenant.slug,
+    remote: "workspace"
+  }));
+  throw new QoreError("QORE_CONTEXT_REQUIRED", "In a workspace root \u2014 which module?", {
+    hint: "cd into a module, or pass --module <slug>.",
+    candidates
+  });
+}
+async function workspaceRoot(deps2) {
+  const ws = await readWorkspace(deps2.cwd);
+  return ws && await inWorkspaceRoot(deps2, ws) ? ws : null;
+}
+function profileOrder(cfg, cachedOrigins, portalArg, wsPortal) {
+  if (portalArg) return [resolvePortal(portalArg, cfg.defaultProfile)];
+  const rank = (o) => o === BUILTIN_PORTALS.prod.apiOrigin ? 0 : o === BUILTIN_PORTALS.staging.apiOrigin ? 1 : 2;
+  const rest = Object.keys(cfg.profiles).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+  const cached = cachedOrigins.filter((c) => cfg.profiles[c]);
+  const origins = [...wsPortal ? [wsPortal.apiOrigin] : [], ...cached, resolvePortal(void 0, cfg.defaultProfile).apiOrigin, ...rest];
+  return [...new Set(origins)].filter((c) => cfg.profiles[c]).map((c) => resolvePortal(c, void 0));
+}
+function withDetails(e, extra, hint) {
+  return new QoreError(e.code, e.message, {
+    hint: hint ?? e.hint,
+    status: e.status,
+    requestId: e.requestId,
+    candidates: e.candidates,
+    serverCode: e.serverCode,
+    details: { ...e.details, ...extra },
+    cause: e
+  });
+}
+async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, workspace, unsupported) {
+  const session = await openSession(deps2, portal, o.command, o.onRequest);
+  try {
+    await ensureCapability(deps2, portal.apiOrigin, "repo.resolve");
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_UNSUPPORTED_BY_SERVER") throw e;
+    unsupported(e);
+    return null;
+  }
+  const hits = [];
+  for (const r of byPreference(keyed)) {
+    const id2 = await cache.get(portal.apiOrigin, r.key);
+    if (id2) hits.push({ remote: r, id: id2 });
+  }
+  if (hits.length > 0 && hits.every((h) => h.id === hits[0].id)) {
+    const { remote: r, id: id2 } = hits[0];
+    try {
+      return { portal, session, module: await detail(session, id2), source: { kind: "remote", remote: r.name, url: r.url }, repoRoot, workspace };
+    } catch (e) {
+      if (!(e instanceof QoreError) || e.code !== "QORE_RESOURCE_NOT_FOUND") throw e;
+      for (const h of hits) await cache.drop(portal.apiOrigin, h.remote.key);
+    }
+  }
+  const { matches } = await session.api.post(RESOLVE, { repoKeys: keys });
+  const ids = [...new Set(matches.map((m) => m.module.id))];
+  if (ids.length === 0) return null;
+  let id = ids[0];
+  if (ids.length > 1) {
+    if (o.choose && ids.includes(o.choose)) id = o.choose;
+    else {
+      const candidates = ids.map((mid) => {
+        const own = matches.filter((m2) => m2.module.id === mid);
+        const m = own[0];
+        const remote2 = preferred(keyed.filter((r) => own.some((x) => x.repoKey === r.key))).name;
+        return { kind: "module", id: m.module.id, slug: m.module.slug, name: m.module.name, remote: remote2, tenant: m.tenant.slug };
+      });
+      throw new QoreError("QORE_CONTEXT_REQUIRED", "This repository's remotes match several modules", {
+        hint: "Pass --module <slug|id>.",
+        candidates
+      });
+    }
+  }
+  const matchedKeys = new Set(matches.filter((m) => m.module.id === id).map((m) => m.repoKey));
+  if (ids.length === 1) for (const k of matchedKeys) await cache.put(portal.apiOrigin, k, id);
+  const remote = preferred(keyed.filter((r) => matchedKeys.has(r.key)));
+  return { portal, session, module: await detail(session, id), source: { kind: "remote", remote: remote.name, url: remote.url }, repoRoot, workspace };
+}
+async function anyLoggedIn(deps2, cfg) {
+  for (const p of Object.values(cfg.profiles)) {
+    if (await new TokenStore(deps2.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return true;
+  }
+  return false;
+}
+async function resolveModuleContext(deps2, o) {
+  const cache = new ResolutionCache(join9(deps2.config.dir, "cache"), deps2.now);
+  const ws = await findWorkspace(deps2.cwd, deps2.home);
+  if (o.module) return byFlag(deps2, o, cache, ws);
+  const cfg = await deps2.config.read();
+  const first = resolvePortal(o.portal, cfg.defaultProfile);
+  const wsPortal = ws && !o.portal ? await workspacePortal(deps2, ws) : void 0;
+  if (o.portal || !await anyLoggedIn(deps2, cfg)) {
+    await openSession(deps2, first, o.command);
+  }
+  if (ws && await inWorkspaceRoot(deps2, ws)) return inWorkspace(deps2, o, ws, wsPortal ?? first);
+  const repo = await repoRemotes(deps2);
+  if (repo === null) throw new QoreError("QORE_CONTEXT_REQUIRED", "Not inside a module repository", { hint: HINT_FLAG });
+  const { root, keyed, gitError } = repo;
+  if (keyed.length === 0) {
+    const said = gitError?.hint;
+    throw new QoreError("QORE_CONTEXT_REQUIRED", "This repository has no remote Qore can match", {
+      hint: said ? `${HINT_FLAG} git said: ${said}` : HINT_FLAG,
+      details: gitError ? { git: said ?? gitError.message } : void 0,
+      cause: gitError
+    });
+  }
+  const keys = [...new Set(keyed.map((r) => r.key))];
+  const tried = [];
+  const answered = [];
+  const skipped = [];
+  const skipErrors = [];
+  let unsupported;
+  for (const portal of profileOrder(cfg, await cache.originsFor(keys), o.portal, wsPortal)) {
+    tried.push(label(portal));
+    let capabilityMissing = false;
+    try {
+      const mc = await onProfile(deps2, o, cache, portal, keyed, keys, root, ws, (e) => {
+        capabilityMissing = true;
+        unsupported ??= e;
+        skipped.push({ profile: label(portal), code: e.code, message: e.message });
+      });
+      if (mc) return mc;
+      if (!capabilityMissing) answered.push(label(portal));
+    } catch (e) {
+      if (!(e instanceof QoreError) || !SKIPPABLE.has(e.code)) throw e;
+      skipped.push({ profile: label(portal), code: e.code, message: e.message });
+      skipErrors.push(e);
+    }
+  }
+  const details = { triedProfiles: tried };
+  if (skipped.length > 0) details.skippedProfiles = skipped;
+  if (answered.length === 0) {
+    const cause = skipErrors[0] ?? unsupported;
+    if (cause) throw withDetails(cause, details);
+  }
+  const unchecked = skipped.length ? ` ${skipped.map((s) => s.profile).join(", ")} could not be checked (${skipped.map((s) => s.code).join(", ")}).` : "";
+  const stagingLoggedIn = Boolean(cfg.profiles[BUILTIN_PORTALS.staging.apiOrigin]) && !skipped.some((s) => s.profile === "staging" && (s.code === "QORE_NOT_LOGGED_IN" || s.code === "QORE_SESSION_EXPIRED"));
+  throw new QoreError("QORE_CONTEXT_REQUIRED", "No module selected", {
+    hint: `This repository's remotes match no module you can access on ${answered.join(", ")}; pass --module <slug|id>.` + unchecked + (stagingLoggedIn ? "" : " If it is a staging repository, run `qore login --portal staging`."),
+    details
+  });
+}
+var appCandidates = (apps) => apps.map((a) => ({ kind: "app", id: a.id, slug: a.slug, name: a.name }));
+function pickApp(mc, app) {
+  const apps = mc.module.apps;
+  if (app) {
+    const found = apps.find((a) => a.id === app || a.slug === app);
+    if (!found) {
+      throw new QoreError("QORE_RESOURCE_NOT_FOUND", `${mc.module.slug} is not part of an app "${app}" you can read`, {
+        candidates: appCandidates(apps)
+      });
+    }
+    return found;
+  }
+  if (apps.length === 1) return apps[0];
+  if (apps.length === 0) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `${mc.module.slug} is not part of an app you can read`);
+  const wsApp = mc.workspace && apps.find((a) => a.id === mc.workspace.appId);
+  if (wsApp) return wsApp;
+  throw new QoreError("QORE_APP_AMBIGUOUS", `${mc.module.slug} is part of several apps`, { hint: "Pass --app <slug>.", candidates: appCandidates(apps) });
+}
+
+// src/core/env/fetch.ts
+async function fetchLocalEnv(deps2, mc, app) {
+  await ensureCapability(deps2, mc.portal.apiOrigin, "module.local-env");
+  try {
+    return await mc.session.api.get(
+      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`
+    );
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_ACCESS_DENIED") throw e;
+    if (e.serverCode === "app.access.denied") {
+      throw withDetails(
+        e,
+        { required: "write", have: mc.module.access },
+        `You have ${mc.module.access} on ${mc.module.slug}; local secrets need write. Ask a maintainer of the app's dev team for write access.`
+      );
+    }
+    if (e.serverCode === "auth.scope.insufficient") throw withDetails(e, {}, "Run `qore login` again.");
+    throw e;
+  }
+}
+
+// src/core/env/merge.ts
+function parseEnv(contents) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line2 of contents.split("\n")) {
+    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (m?.[1] !== void 0 && m[2] !== void 0) map.set(m[1], m[2]);
+  }
+  return map;
+}
+function isManagedKey(key, managed) {
+  for (const pattern of managed) {
+    if (pattern.endsWith("*")) {
+      if (key.startsWith(pattern.slice(0, -1))) return true;
+    } else if (key === pattern) return true;
+  }
+  return false;
+}
+function planEnvUpdate({
+  current,
+  fetched,
+  choices = {},
+  defaultChoice = "keep",
+  managed = []
+}) {
+  const merged = new Map(current);
+  const conflicts = [];
+  const added = [];
+  const unchanged = [];
+  const overwritten = [];
+  for (const [key, portalValue] of Object.entries(fetched)) {
+    const hasLocal = current.has(key);
+    const localValue = current.get(key);
+    const localEmpty = !hasLocal || localValue === "" || localValue === '""' || localValue === "''";
+    if (localEmpty) {
+      merged.set(key, portalValue);
+      added.push(key);
+      continue;
+    }
+    if (localValue === portalValue) {
+      unchanged.push(key);
+      continue;
+    }
+    if (isManagedKey(key, managed)) {
+      merged.set(key, portalValue);
+      overwritten.push(key);
+      continue;
+    }
+    conflicts.push(key);
+    const choice = choices[key] ?? defaultChoice;
+    merged.set(key, choice === "use-portal" ? portalValue : localValue);
+  }
+  return { merged, conflicts, added, unchanged, overwritten };
+}
+function renderEnv(original, merged) {
+  const seen = /* @__PURE__ */ new Set();
+  const lines = original.split("\n");
+  const out = lines.map((line2) => {
+    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!m?.[1]) return line2;
+    const key = m[1];
+    if (!merged.has(key)) return line2;
+    seen.add(key);
+    return `${key}=${merged.get(key) ?? ""}`;
+  });
+  const appended = [];
+  for (const [key, value] of merged) {
+    if (!seen.has(key)) appended.push(`${key}=${value}`);
+  }
+  let text = out.join("\n");
+  if (appended.length) {
+    if (text.length && !text.endsWith("\n")) text += "\n";
+    text += appended.join("\n") + "\n";
+  }
+  return text;
+}
+
+// src/core/env/pull.ts
+import { lstat, realpath as realpath2 } from "fs/promises";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "path";
+var outside = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file must be inside the repository (got ${target})`, {
+  hint: "Use a path inside the repository for --target or .qore.json envFile."
+});
+var symlinked = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file target must not be a symlink (got ${target})`, {
+  hint: "Use a path inside the repository for --target or .qore.json envFile."
+});
+function inside(root, p) {
+  const rel = relative4(root, p);
+  return rel !== "" && rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute2(rel);
+}
+async function resolveTarget(root, target, base = root) {
+  const realRoot = await realpath2(root);
+  const realBase = base === root ? realRoot : await realpath2(base);
+  const abs = resolve4(realBase, target);
+  if (!isAbsolute2(target) && !inside(realRoot, abs)) throw outside(target);
+  let parent;
+  try {
+    parent = await realpath2(dirname3(abs));
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+    throw new QoreError("QORE_CONTEXT_INVALID", `The directory for ${target} does not exist`, {
+      hint: "Create the parent directory, or point --target / .qore.json envFile at an existing one."
+    });
+  }
+  const final = resolve4(parent, basename(abs));
+  if (!inside(realRoot, final)) throw outside(target);
+  try {
+    const st = await lstat(final);
+    if (st.isSymbolicLink()) throw symlinked(target);
+    const realFinal = await realpath2(final);
+    if (!inside(realRoot, realFinal)) throw outside(target);
+  } catch (e) {
+    if (e instanceof QoreError) throw e;
+    if (e.code !== "ENOENT") throw e;
+  }
+  return final;
+}
+function planPull(o) {
+  const original = o.existing ?? o.example ?? "";
+  const current = parseEnv(original);
+  const r = planEnvUpdate({ current, fetched: o.fetched, choices: o.choices ?? {}, defaultChoice: o.defaultChoice, managed: o.managed });
+  const choiceOf = (k) => o.choices?.[k] ?? o.defaultChoice;
+  const generated = [];
+  for (const key of o.localSecrets) {
+    const v = r.merged.get(key);
+    if (v === void 0 || v === "" || v === '""' || v === "''") {
+      r.merged.set(key, o.random());
+      generated.push(key);
+    }
+  }
+  return {
+    text: renderEnv(original, r.merged),
+    created: o.existing === null,
+    seededFromExample: o.existing === null && o.example !== null,
+    added: r.added,
+    updated: r.overwritten,
+    unchanged: r.unchanged,
+    conflicts: r.conflicts,
+    kept: r.conflicts.filter((k) => choiceOf(k) === "keep"),
+    replaced: r.conflicts.filter((k) => choiceOf(k) === "use-portal"),
+    generated
+  };
+}
+
+// src/cli/context.ts
+var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
+async function moduleContextFor(ctx, flags, command) {
+  const g = ctx.opts();
+  const onRequest = g.verbose ? (l) => ctx.io.err(l) : void 0;
+  const base = { portal: g.portal, module: flags.module, command, onRequest };
+  try {
+    return await resolveModuleContext(ctx.deps, base);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" || !ctx.io.interactive) throw e;
+    if (allOfKind(e.candidates, "module")) {
+      const choose = await ctx.io.select(
+        "Select a module",
+        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : ""}${c.slug}  (${c.remote})`, value: c.id }))
+      );
+      return resolveModuleContext(ctx.deps, { ...base, choose });
+    }
+    if (allOfKind(e.candidates, "tenant")) {
+      const tenant = await ctx.io.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
+      return resolveModuleContext(ctx.deps, { ...base, tenant });
+    }
+    throw e;
+  }
+}
+async function appFor(ctx, mc, app) {
+  try {
+    return pickApp(mc, app);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
+    const id = await ctx.io.select("Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
+    return pickApp(mc, id);
+  }
+}
+function sourceText(mc) {
+  if (mc.source.kind === "remote") return mc.source.remote;
+  if (mc.source.kind === "workspace") return WORKSPACE_FILE;
+  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : "--module";
+}
+function contextLine(mc, app) {
+  const parts = [mc.module.tenant.name, ...app ? [app.name] : [], mc.module.slug];
+  return `\u2192 ${parts.join(" / ")}  (${sourceText(mc)})`;
+}
+function contextJson(mc, app) {
+  const { id, slug, name, type, access } = mc.module;
+  return {
+    portal: mc.portal.builtin ?? mc.portal.apiOrigin,
+    tenant: mc.module.tenant,
+    app: app ?? null,
+    module: { id, slug, name, type, access },
+    source: mc.source.kind === "remote" ? mc.source.remote : mc.source.kind === "workspace" ? WORKSPACE_FILE : "--module",
+    ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
+  };
+}
+
+// src/cli/trustPrompt.ts
+async function ensureTrusted(ctx, mc, app, o) {
+  const root = mc.repoRoot ?? ctx.deps.cwd;
+  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
+  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
+  if (o.yes) {
+    await trust(ctx.deps, root, mc.module.id);
+    return;
+  }
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `This repository is not trusted for ${mc.module.slug} yet`, {
+      hint: "Run interactively once, or pass --yes.",
+      details: { reason: "untrusted", repository: root }
+    });
+  }
+  if (mc.source.kind === "remote") {
+    const key = repoKey(mc.source.url);
+    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? "(unparsable remote URL)"}`);
+  }
+  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
+  await trust(ctx.deps, root, mc.module.id);
+}
+
+// src/cli/commands/env.ts
+var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
+async function readOrNull(p) {
+  try {
+    return await readFile4(p, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+async function writeSecurely(target, text) {
+  const base = basename2(target);
+  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes3(6).toString("hex")}.local` : `${base}.qore-${randomBytes3(6).toString("hex")}.tmp`;
+  const tmp = join10(dirname4(target), tmpName);
+  try {
+    await writeFile3(tmp, text, { mode: 384, flag: "wx" });
+    await chmod2(tmp, 384);
+    await rename3(tmp, target);
+  } finally {
+    await unlink(tmp).catch(() => {
+    });
+  }
+}
+function registerEnv(program, ctx) {
+  const env = program.command("env").description("Local environment");
+  env.command("pull").description("Write this module's local secrets into its env file").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--target <path>", "env file to write (inside the repository)").option("--use-portal", "take the portal's value for keys that differ locally").option("--yes", "trust this repository without asking").action(async (f) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const mc = await moduleContextFor(ctx, f, "env pull");
+    if (!mc.repoRoot) {
+      throw new QoreError("QORE_CONTEXT_REQUIRED", "env pull writes into a module repository", { hint: "cd into the module's repository." });
+    }
+    const app = await appFor(ctx, mc, f.app);
+    const cfg = await readRepoConfig(mc.repoRoot);
+    const defaults = moduleDefaults(mc.module.type);
+    const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
+    await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    const existing = await readOrNull(target);
+    const example = existing === null ? await readOrNull(join10(dirname4(target), ".env.example")) : null;
+    const local = await fetchLocalEnv(deps2, mc, app);
+    const inputs = {
+      existing,
+      example,
+      fetched: local.env,
+      managed: local.managedKeys,
+      localSecrets: cfg.localSecrets ?? defaults.localSecrets,
+      defaultChoice: f.usePortal ? "use-portal" : "keep",
+      random: () => randomBytes3(32).toString("hex")
+    };
+    let plan = planPull(inputs);
+    if (plan.conflicts.length && io2.interactive && !f.usePortal) {
+      const current = parseEnv(existing ?? example ?? "");
+      const choices = {};
+      let bulk;
+      for (const key of plan.conflicts) {
+        if (bulk) {
+          choices[key] = bulk;
+          continue;
+        }
+        const pick = await io2.select(
+          `${key} differs  (local ${maskLen(current.get(key))}, portal ${maskLen(local.env[key])})`,
+          [
+            { name: "keep local", value: "keep" },
+            { name: "use portal", value: "portal" },
+            { name: "use portal for all", value: "all" },
+            { name: "keep local for all", value: "skip" }
+          ]
+        );
+        if (pick === "all") bulk = "use-portal";
+        if (pick === "skip") bulk = "keep";
+        choices[key] = pick === "portal" || pick === "all" ? "use-portal" : "keep";
+      }
+      plan = planPull({ ...inputs, choices });
+    }
+    if (existing !== null && plan.text === existing) {
+      await chmod2(target, 384);
+    } else {
+      await writeSecurely(target, plan.text);
+    }
+    const rel = relative5(await realpath3(mc.repoRoot), target);
+    if (g.json) {
+      const names = {
+        created: plan.created,
+        seededFromExample: plan.seededFromExample,
+        added: plan.added,
+        updated: plan.updated,
+        kept: plan.kept,
+        replaced: plan.replaced,
+        unchanged: plan.unchanged,
+        generated: plan.generated
+      };
+      renderJson(io2, { context: contextJson(mc, app), target: rel, ...names });
+      return;
+    }
+    if (plan.kept.length && !io2.interactive) {
+      io2.err(`! ${plan.kept.length} key(s) differ locally and were kept: ${plan.kept.join(", ")} \u2014 --use-portal takes the portal's values`);
+    }
+    const parts = [
+      plan.added.length && `${plan.added.length} added`,
+      plan.updated.length && `${plan.updated.length} updated (managed)`,
+      plan.replaced.length && `${plan.replaced.length} replaced`,
+      plan.kept.length && `${plan.kept.length} kept (differs locally; --use-portal to overwrite)`,
+      plan.generated.length && `${plan.generated.length} generated`
+    ].filter(Boolean);
+    io2.out(`\u2713 ${rel}${plan.seededFromExample ? " (created from .env.example)" : ""} \u2014 ${parts.length ? parts.join(", ") : "up to date"}`);
+  });
+}
+
+// src/core/auth/oidc.ts
+import * as oc from "openid-client";
+var LOGIN_SCOPE = "openid profile email offline_access qore:read qore:local-env";
+function decodeSub(accessToken) {
+  const part = accessToken.split(".")[1] ?? "";
+  const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+  return { sub: claims.sub, email: claims.email };
+}
+function toTokenSet(t, fallbackRt) {
+  const rt = t.refresh_token ?? fallbackRt;
+  if (!rt) throw new QoreError("QORE_INTERNAL", "Keycloak returned no refresh token");
+  return {
+    accessToken: t.access_token,
+    refreshToken: rt,
+    expiresIn: t.expires_in ?? 600,
+    scope: t.scope ?? "",
+    ...decodeSub(t.access_token)
+  };
+}
+function unreachable(e, host) {
+  const n = networkError(e, host);
+  return new QoreError("QORE_AUTH_UNAVAILABLE", n.message, { hint: n.hint, details: n.details, cause: e });
+}
+function mapOidcError(e, host) {
+  if (e instanceof QoreError || e instanceof CancelledError) return e;
+  if (isAbortError(e) || e?.code === "OAUTH_ABORT" || isAbortError(e?.cause)) {
+    return new CancelledError();
+  }
+  const err = e.error;
+  if (err === "access_denied") return new QoreError("QORE_LOGIN_DENIED", "The login was denied in the browser");
+  if (err === "expired_token") return new QoreError("QORE_LOGIN_EXPIRED", "The login code expired", { hint: "Run `qore login` again." });
+  if (err === "invalid_grant") return new QoreError("QORE_SESSION_EXPIRED", "Your session has ended", { hint: "Run `qore login`." });
+  const status2 = e.status;
+  if (status2 && status2 >= 500) return new QoreError("QORE_AUTH_UNAVAILABLE", "Keycloak is unavailable", { cause: e });
+  if (e instanceof TypeError) return unreachable(e, host);
+  const cause = e?.cause;
+  if (cause instanceof TypeError) return unreachable(cause, host);
+  return new QoreError("QORE_AUTH_UNAVAILABLE", "Login failed", { cause: e });
+}
+async function createOidc(opts) {
+  const host = new URL(opts.issuer).host;
+  const execute = new URL(opts.issuer).protocol === "http:" ? [oc.allowInsecureRequests] : [];
+  let config;
+  try {
+    config = await oc.discovery(new URL(opts.issuer), opts.clientId, void 0, oc.None(), {
+      execute,
+      [oc.customFetch]: opts.fetch
+    });
+  } catch (e) {
+    throw mapOidcError(e, host);
+  }
+  return {
+    async startDevice(scope) {
+      try {
+        const r = await oc.initiateDeviceAuthorization(config, { scope });
+        return {
+          userCode: r.user_code,
+          verificationUri: r.verification_uri,
+          verificationUriComplete: r.verification_uri_complete,
+          expiresIn: r.expires_in,
+          handle: r
+        };
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    },
+    async pollDevice(start, signal) {
+      try {
+        const t = await oc.pollDeviceAuthorizationGrant(config, start.handle, void 0, { signal });
+        return toTokenSet(t);
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    },
+    async refresh(rt, scope) {
+      try {
+        const t = await oc.refreshTokenGrant(config, rt, scope ? { scope } : void 0);
+        return toTokenSet(t, rt);
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    },
+    async revoke(rt) {
+      try {
+        await oc.tokenRevocation(config, rt, { token_type_hint: "refresh_token" });
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    }
+  };
+}
+
+// src/core/auth/login.ts
+async function deviceLogin(opts) {
+  await opts.store.getRefresh();
+  const start = await opts.oidc.startDevice(LOGIN_SCOPE);
+  const stopPoll = new AbortController();
+  const settled = new AbortController();
+  const poll = opts.oidc.pollDevice(start, AbortSignal.any([opts.signal, stopPoll.signal])).finally(() => settled.abort());
+  poll.catch(() => {
+  });
+  try {
+    await opts.onCode(start, settled.signal);
+  } catch (e) {
+    stopPoll.abort();
+    const late = await poll.catch(() => null);
+    if (late) await opts.oidc.revoke(late.refreshToken).catch(() => {
+    });
+    throw e;
+  }
+  const t = await poll;
+  const at = opts.now();
+  const write = async () => {
+    await opts.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope, obtainedAt: at.toISOString() });
+    await opts.store.setAccess({ at: t.accessToken, expiresAt: new Date(at.getTime() + t.expiresIn * 1e3).toISOString() });
+  };
+  try {
+    if (opts.withLock && opts.lockName) await opts.withLock(opts.lockName, write);
+    else await write();
+  } catch (e) {
+    await opts.oidc.revoke(t.refreshToken).catch(() => {
+    });
+    await opts.store.clear().catch(() => {
+    });
+    throw e;
+  }
+  return t;
+}
+
+// src/cli/commands/login.ts
+function registerLogin(program, ctx) {
+  program.command("login").description("Log in with your Qore account").option("--no-browser", "only print the URL").action(async (cmd) => {
+    const { deps: deps2, io: io2, signal } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    const meta = await fetchMeta(deps2.fetch, portal.apiOrigin);
+    const known = cfg.profiles[portal.apiOrigin]?.issuer;
+    const pinned = { ...portal, pinnedIssuer: portal.pinnedIssuer ?? known ?? null };
+    if (!pinned.pinnedIssuer && portal.builtin === null) {
+      io2.err(`! Logging in to ${portal.apiOrigin}, identity provider ${meta.auth.issuer}`);
+    }
+    negotiate(meta, pinned, deps2.version);
+    const issuer = pinned.pinnedIssuer ?? meta.auth.issuer;
+    const hash = profileHash(portal.apiOrigin, issuer);
+    const store = new TokenStore(deps2.keychain, hash);
+    const t = await deviceLogin({
+      oidc: await deps2.oidcFor(issuer),
+      store,
+      now: deps2.now,
+      signal,
+      withLock: deps2.withLock,
+      lockName: hash,
+      onCode: async (s, settled) => {
+        const url = s.verificationUriComplete ?? s.verificationUri;
+        io2.err(`! First copy your one-time code: ${s.userCode}`);
+        if (io2.interactive && cmd.browser) {
+          try {
+            await io2.waitForEnter(`  Press Enter to open ${url} (or open it yourself)`, AbortSignal.any([signal, settled]));
+          } catch (e) {
+            if (settled.aborted && !signal.aborted) return;
+            throw e;
+          }
+          if (settled.aborted) return;
+          if (!await io2.openUrl(url)) io2.err(`  Open ${url} in a browser`);
+        } else {
+          io2.err(`  Open ${url} in a browser`);
+        }
+      }
+    });
+    await deps2.config.update((c) => {
+      c.profiles[portal.apiOrigin] = {
+        ...c.profiles[portal.apiOrigin],
+        apiOrigin: portal.apiOrigin,
+        issuer,
+        sub: t.sub,
+        email: t.email,
+        meta: { fetchedAt: deps2.now().toISOString(), doc: meta }
+      };
       if (g.portal || !c.defaultProfile) c.defaultProfile = portal.apiOrigin;
     });
     const { api } = await openSession(deps2, { ...portal, pinnedIssuer: issuer }, "login", requestLog(ctx));
@@ -724,9 +2196,9 @@ function registerLogin(program, ctx) {
     await deps2.config.update((c) => {
       c.profiles[portal.apiOrigin].activeTenant = active;
     });
-    const label = portal.builtin ?? portal.apiOrigin;
-    if (g.json) renderJson(io2, { portal: label, email: me.email, activeTenant: active ?? null });
-    else io2.out(`\u2713 Logged in as ${me.email} (${label})`);
+    const label2 = portal.builtin ?? portal.apiOrigin;
+    if (g.json) renderJson(io2, { portal: label2, email: me.email, activeTenant: active ?? null });
+    else io2.out(`\u2713 Logged in as ${me.email} (${label2})`);
   });
 }
 
@@ -762,6 +2234,200 @@ function registerLogout(program, ctx) {
   });
 }
 
+// src/cli/commands/run.ts
+import { constants } from "os";
+var childRunning = { current: false };
+function registerRun(program, ctx) {
+  program.command("run").description("Run a command with this module's local secrets in its environment").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--yes", "trust this repository without asking").argument("<command>", "the command to run (after --)").argument("[args...]", "its arguments, passed verbatim").action(async (cmd, args, f) => {
+    const { deps: deps2 } = ctx;
+    if (ctx.opts().json) {
+      throw new QoreError("QORE_CONTEXT_INVALID", "run has no --json output", {
+        hint: "Drop --json; the child's own output passes through."
+      });
+    }
+    const mc = await moduleContextFor(ctx, f, "run");
+    const app = await appFor(ctx, mc, f.app);
+    await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    const local = await fetchLocalEnv(deps2, mc, app);
+    childRunning.current = true;
+    let exit;
+    try {
+      exit = await deps2.spawn.run(cmd, args, { ...deps2.env, ...local.env });
+    } finally {
+      childRunning.current = false;
+    }
+    if (exit.signal) {
+      deps2.raise(exit.signal);
+      ctx.setExitCode(128 + (constants.signals[exit.signal] ?? 0));
+      return;
+    }
+    ctx.setExitCode(exit.code ?? 1);
+  });
+}
+
+// src/cli/format.ts
+function ago(iso, now) {
+  if (!iso) return "\u2013";
+  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1e3));
+  if (s < 60) return "just now";
+  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
+  return `${Math.floor(s / 86400)}d ago`;
+}
+var pct = (f) => String(Number((f * 100).toFixed(2)));
+function uptime(h) {
+  if (!h) return "\u2013";
+  const kind = h.cause && h.kind !== "up" ? `${h.kind}: ${h.cause}` : h.kind;
+  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`;
+}
+function table(rows) {
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => (r[i] ?? "").length)));
+  return rows.map((r) => "  " + r.map((c, i) => i === r.length - 1 ? c : c.padEnd(widths[i])).join("  "));
+}
+
+// src/cli/commands/status.ts
+var HEAD = ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"];
+var envRow = (e, now) => [e.name, e.paused ? "paused" : e.status, e.commit?.sha ?? "\u2013", ago(e.commit?.deployedAt ?? null, now), uptime(e.health)];
+async function appStatus(ctx, ws, appFlag) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const portal = await flagPortal(deps2, g.portal, ws);
+  const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+  const session = await openSession(deps2, portal, "status", onRequest);
+  await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+  await ensureCapability(deps2, portal.apiOrigin, "module.status");
+  const am = await workspaceAppModules(session, portal, ws);
+  const { tenant, ...app } = am.app;
+  if (appFlag && appFlag !== app.id && appFlag !== app.slug) {
+    throw new QoreError("QORE_RESOURCE_NOT_FOUND", `This workspace is for ${app.slug}, not "${appFlag}"`, {
+      hint: "Pass --module <slug> --app <slug>."
+    });
+  }
+  if (!g.json) io2.err(`\u2192 ${tenant.name} / ${app.name}  (${WORKSPACE_FILE})`);
+  const modules = [];
+  for (const m of am.modules.filter((x) => x.repoUrl !== null)) {
+    const st = await session.api.get(
+      `/api/cli/v1/modules/${encodeURIComponent(m.id)}/status?app_id=${encodeURIComponent(app.id)}`
+    );
+    modules.push({ module: { id: m.id, slug: m.slug, name: m.name, type: m.type }, environments: st.environments });
+  }
+  if (g.json) {
+    renderJson(io2, { context: { portal: portal.builtin ?? portal.apiOrigin, tenant, app, source: WORKSPACE_FILE }, modules });
+    return;
+  }
+  if (modules.length === 0) {
+    io2.out("No modules with a repository yet.");
+    return;
+  }
+  const now = deps2.now();
+  const rows = [["MODULE", ...HEAD], ...modules.flatMap(({ module, environments }) => environments.length === 0 ? [[module.slug, "\u2013", "no environments yet", "\u2013", "\u2013", "\u2013"]] : environments.map((e) => [module.slug, ...envRow(e, now)]))];
+  for (const line2 of table(rows)) io2.out(line2);
+}
+function registerStatus(program, ctx) {
+  program.command("status").description("Deployment and health per environment for this module (or, in a workspace root, the app)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").action(async (flags) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    if (!flags.module) {
+      const ws = await workspaceRoot(deps2);
+      if (ws) {
+        await appStatus(ctx, ws, flags.app);
+        return;
+      }
+    }
+    const mc = await moduleContextFor(ctx, flags, "status");
+    await ensureCapability(deps2, mc.portal.apiOrigin, "module.status");
+    const app = await appFor(ctx, mc, flags.app);
+    if (!g.json) io2.err(contextLine(mc, app));
+    const st = await mc.session.api.get(
+      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/status?app_id=${encodeURIComponent(app.id)}`
+    );
+    if (g.json) {
+      renderJson(io2, { context: contextJson(mc, app), environments: st.environments });
+      return;
+    }
+    if (st.environments.length === 0) {
+      io2.out("No environments yet.");
+      return;
+    }
+    const now = deps2.now();
+    const rows = [HEAD, ...st.environments.map((e) => envRow(e, now))];
+    for (const line2 of table(rows)) io2.out(line2);
+  });
+}
+
+// src/cli/commands/sync.ts
+import { lstat as lstat2, readdir } from "fs/promises";
+import { join as join11, relative as relative6 } from "path";
+import { Option as Option2 } from "commander";
+function asFailure2(slug, e) {
+  if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
+    return { slug, status: "failed", error: { code: e.code, message: e.message, hint: e.hint } };
+  }
+  throw e;
+}
+async function strayRepos(root, slugs) {
+  let entries;
+  try {
+    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+  const names = [];
+  for (const name of entries) {
+    if (slugs.has(name)) continue;
+    try {
+      await lstat2(join11(root, name, ".git"));
+      names.push(name);
+    } catch {
+    }
+  }
+  return names.sort();
+}
+function registerSync(program, ctx) {
+  program.command("sync").description("Clone new modules, fetch present ones, report removed and re-pointed ones").option("--pull", "fast-forward every clean present repository with an upstream").addOption(new Option2("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (flags) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const ws = await findWorkspace(deps2.cwd, deps2.home);
+    if (!ws) {
+      throw new QoreError("QORE_CONTEXT_REQUIRED", "Not inside a workspace", { hint: "Run `qore clone <app>` first." });
+    }
+    const portal = await flagPortal(deps2, g.portal, ws);
+    const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+    const session = await openSession(deps2, portal, "sync", onRequest);
+    await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+    const app = await workspaceAppModules(session, portal, ws);
+    if (!g.json) io2.err(`\u2192 ${app.app.tenant.name} / ${app.app.name}  (qore.workspace.json)`);
+    const slugs = new Set(app.modules.map((m) => m.slug));
+    const dirs = {};
+    const earlyFailures = [];
+    const modulesForPlan = [];
+    for (const m of app.modules) {
+      if (!isSafeSlug(m.slug)) {
+        earlyFailures.push(asFailure2(m.slug, unsafeSlugError(m.slug)));
+        continue;
+      }
+      try {
+        dirs[m.slug] = await deps2.git.inspect(join11(ws.root, m.slug));
+        modulesForPlan.push(m);
+      } catch (e) {
+        earlyFailures.push(asFailure2(m.slug, e));
+      }
+    }
+    const strays = await strayRepos(ws.root, slugs);
+    const { actions, removed } = planWorkspace(ws.root, modulesForPlan, dirs, strays);
+    const applied = await applyActions(deps2, { portal, app, actions, protocol: flags.protocol, onResult: () => {
+    } });
+    await syncPresent(deps2, applied, actions, Boolean(flags.pull), { app, protocol: flags.protocol });
+    for (const r of applied) {
+      if (r.status === "cloned" && r.dir) r.dir = relative6(deps2.cwd, r.dir) || ".";
+    }
+    const removedResults = removed.map((slug) => ({ slug, status: "removed", reason: "not a module of this app \u2014 left in place" }));
+    const results = [...earlyFailures, ...applied, ...removedResults];
+    const err = reportWorkspaceRun(io2, results, Boolean(g.json));
+    if (err) throw err;
+  });
+}
+
 // src/cli/commands/tenant.ts
 function registerTenant(program, ctx) {
   const tenant = program.command("tenant").description("Manage the active tenant");
@@ -789,7 +2455,7 @@ function registerTenant(program, ctx) {
     const portal = resolvePortal(g.portal, cfg.defaultProfile);
     const { api } = await openSession(deps2, portal, "tenant use", requestLog(ctx));
     const me = await api.get("/api/cli/v1/me");
-    const candidates = me.tenants.map((t) => t.slug);
+    const candidates = me.tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
     let chosen;
     if (slug) {
       const found = me.tenants.find((t) => t.slug === slug);
@@ -827,11 +2493,11 @@ function registerVersion(program, ctx) {
       return;
     }
     io2.out(`qore ${deps2.version}`);
-    const label = portal.builtin ?? portal.apiOrigin;
+    const label2 = portal.builtin ?? portal.apiOrigin;
     if (portalInfo) {
-      io2.out(`portal ${label}: api ${portalInfo.apiVersions.join(",")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`);
+      io2.out(`portal ${label2}: api ${portalInfo.apiVersions.join(",")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`);
     } else {
-      io2.out(`portal ${label}: unreachable`);
+      io2.out(`portal ${label2}: unreachable`);
     }
   });
 }
@@ -849,12 +2515,12 @@ function registerWhoami(program, ctx) {
     if (activeTenant && !me.tenants.some((t) => t.id === activeTenant.id)) {
       io2.err(`! You no longer have developer access to ${activeTenant.slug}`);
     }
-    const label = portal.builtin ?? portal.apiOrigin;
+    const label2 = portal.builtin ?? portal.apiOrigin;
     if (g.json) {
-      renderJson(io2, { portal: label, activeTenant: activeTenant ?? null, me });
+      renderJson(io2, { portal: label2, activeTenant: activeTenant ?? null, me });
       return;
     }
-    io2.out(`${me.email} (${label})`);
+    io2.out(`${me.email} (${label2})`);
     for (const t of me.tenants) {
       const mark = activeTenant?.id === t.id ? "*" : " ";
       io2.out(`${mark} ${t.name}  ${t.role}`);
@@ -869,7 +2535,18 @@ function registerWhoami(program, ctx) {
 }
 
 // src/cli/commands/index.ts
-var COMMANDS = [registerLogin, registerLogout, registerWhoami, registerTenant, registerVersion];
+var COMMANDS = [
+  registerLogin,
+  registerLogout,
+  registerWhoami,
+  registerTenant,
+  registerStatus,
+  registerEnv,
+  registerRun,
+  registerClone,
+  registerSync,
+  registerVersion
+];
 
 // src/cli/updateCheck.ts
 var REGISTRY_URL = "https://registry.npmjs.org/@quatronic%2Fqore/latest";
@@ -903,9 +2580,8 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 }
 
 // src/core/config.ts
-import { mkdir, readFile, rename, writeFile, chmod } from "fs/promises";
-import { join } from "path";
-import { randomBytes } from "crypto";
+import { readFile as readFile5 } from "fs/promises";
+import { join as join12 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -913,12 +2589,12 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join(this.dir, "config.json");
+    return join12(this.dir, "config.json");
   }
   async read() {
     let raw;
     try {
-      raw = await readFile(this.file, "utf8");
+      raw = await readFile5(this.file, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return empty();
       throw e;
@@ -937,15 +2613,143 @@ var ConfigStore = class {
   async update(fn) {
     const current = await this.read();
     const next = fn(current) ?? current;
-    await mkdir(this.dir, { recursive: true, mode: 448 });
-    const tmp = join(this.dir, `.config.${randomBytes(6).toString("hex")}.tmp`);
-    await writeFile(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
-    await chmod(tmp, 384);
-    await rename(tmp, this.file);
+    await writeJsonAtomic(this.dir, "config.json", next);
     return next;
   }
 };
 
+// src/platform/git.ts
+import { execFile, execFileSync } from "child_process";
+import { mkdir as mkdir3, readdir as readdir2, stat as stat2 } from "fs/promises";
+import { homedir } from "os";
+import { dirname as dirname5, join as join13 } from "path";
+function parseRemotes(stdout) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const line2 of stdout.split(/\r?\n/)) {
+    const m = /^(\S+)\t(.+) \(fetch\)$/.exec(line2);
+    if (!m || seen.has(m[1])) continue;
+    seen.add(m[1]);
+    out.push({ name: m[1], url: m[2] });
+  }
+  return out;
+}
+var configuredSshCommand = /* @__PURE__ */ new Map();
+function hasConfiguredSshCommand(repoDir) {
+  const key = repoDir ?? "";
+  let v = configuredSshCommand.get(key);
+  if (v === void 0) {
+    const args = repoDir ? ["-C", repoDir, "config", "--get", "core.sshCommand"] : ["config", "--get", "core.sshCommand"];
+    try {
+      v = execFileSync("git", args, {
+        cwd: homedir(),
+        env: { ...process.env, LC_ALL: "C", GIT_TERMINAL_PROMPT: "0" },
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
+        timeout: 5e3
+      }).toString().trim().length > 0;
+    } catch {
+      v = false;
+    }
+    configuredSshCommand.set(key, v);
+  }
+  return v;
+}
+function gitExecOptions(repoDir) {
+  const env = { ...process.env, LC_ALL: "C", GIT_TERMINAL_PROMPT: "0" };
+  if (!env.GIT_HTTP_LOW_SPEED_LIMIT) env.GIT_HTTP_LOW_SPEED_LIMIT = "1000";
+  if (!env.GIT_HTTP_LOW_SPEED_TIME) env.GIT_HTTP_LOW_SPEED_TIME = "60";
+  if (!env.GIT_SSH_COMMAND && !env.GIT_SSH && !hasConfiguredSshCommand(repoDir)) {
+    env.GIT_SSH_COMMAND = "ssh -o BatchMode=yes";
+  }
+  return { cwd: homedir(), env, windowsHide: true, maxBuffer: 8 * 1024 * 1024 };
+}
+function runGit(args, repoDir) {
+  return new Promise((resolve5, reject) => {
+    execFile("git", args, gitExecOptions(repoDir), (err, stdout, stderr) => {
+      if (err && err.code === "ENOENT") {
+        reject(new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
+          hint: "Install git (https://git-scm.com/downloads) and open a new terminal."
+        }));
+        return;
+      }
+      const code = err ? typeof err.code === "number" ? err.code : 1 : 0;
+      resolve5({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
+    });
+  });
+}
+var toResult = (r, command) => r.code === 0 ? { ok: true } : { ok: false, stderr: r.stderr, command };
+async function remotes(repoRoot) {
+  const r = await runGit(["-C", repoRoot, "remote", "-v"], repoRoot);
+  if (r.code !== 0) {
+    const last = r.stderr.trim().split(/\r?\n/).pop() ?? "";
+    throw new QoreError("QORE_INTERNAL", `git remote -v failed in ${repoRoot}`, {
+      hint: last || void 0,
+      details: { command: "git remote -v", cwd: repoRoot },
+      cause: r.err
+    });
+  }
+  return parseRemotes(r.stdout);
+}
+async function clone(url, dir2) {
+  await mkdir3(dirname5(dir2), { recursive: true });
+  const r = await runGit(["clone", "--", url, dir2]);
+  return toResult(r, "git clone");
+}
+async function fetch(repoRoot) {
+  const r = await runGit(["-C", repoRoot, "fetch"], repoRoot);
+  return toResult(r, "git fetch");
+}
+async function pullFfOnly(repoRoot) {
+  const r = await runGit(["-C", repoRoot, "pull", "--no-rebase", "--ff-only"], repoRoot);
+  return toResult(r, "git pull --no-rebase --ff-only");
+}
+async function status(repoRoot) {
+  const command = "git status --porcelain=v2 --branch";
+  const r = await runGit(["--no-optional-locks", "-C", repoRoot, "status", "--porcelain=v2", "--branch"], repoRoot);
+  if (r.code !== 0) return { ok: false, stderr: r.stderr, command };
+  let branch = null;
+  let upstream = false;
+  let dirty = false;
+  for (const line2 of r.stdout.split(/\r?\n/)) {
+    if (line2.startsWith("# branch.head ")) {
+      const name = line2.slice("# branch.head ".length).trim();
+      branch = name === "(detached)" ? null : name;
+    } else if (line2.startsWith("# branch.upstream ")) {
+      upstream = true;
+    } else if (line2.startsWith("#")) {
+      continue;
+    } else if (line2.trim().length > 0) {
+      dirty = true;
+    }
+  }
+  return { ok: true, dirty, branch, upstream };
+}
+async function statOrThrow(path) {
+  try {
+    return await stat2(path);
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new QoreError("QORE_INTERNAL", `could not stat ${path}`, { cause: err });
+  }
+}
+async function inspect(dir2) {
+  const st = await statOrThrow(dir2);
+  if (!st) return { exists: false, empty: false, isRepo: false, remotes: [] };
+  if (!st.isDirectory()) return { exists: true, empty: false, isRepo: false, remotes: [] };
+  let entries;
+  try {
+    entries = await readdir2(dir2);
+  } catch (err) {
+    throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
+  }
+  const empty2 = entries.length === 0;
+  const isRepo = await statOrThrow(join13(dir2, ".git")) !== void 0;
+  const dirRemotes = isRepo ? await remotes(dir2) : [];
+  return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
+}
+var systemGit = { remotes, clone, fetch, pullFfOnly, status, inspect };
+
 // src/platform/keychain.ts
 import { Entry } from "@napi-rs/keyring";
 var SERVICE = "qore";
@@ -1001,15 +2805,15 @@ var OsKeychain = class {
 };
 
 // src/platform/lock.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { join as join2 } from "path";
+import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { join as join14 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join2(dir2, "locks");
-    await mkdir2(locks, { recursive: true, mode: 448 });
-    const target = join2(locks, `${name}.lock`);
-    await writeFile2(target, "", { flag: "a" });
+    const locks = join14(dir2, "locks");
+    await mkdir4(locks, { recursive: true, mode: 448 });
+    const target = join14(locks, `${name}.lock`);
+    await writeFile4(target, "", { flag: "a" });
     let release;
     let compromised;
     try {
@@ -1042,36 +2846,90 @@ function configDir(env, platform, home) {
   return posix.join(xdg ?? posix.join(home, ".config"), "qore");
 }
 
+// src/platform/spawn.ts
+import spawn from "cross-spawn";
+function signalsFor(platform) {
+  return platform === "win32" ? { ignore: ["SIGINT", "SIGBREAK"], forward: [] } : { ignore: ["SIGINT", "SIGQUIT"], forward: ["SIGTERM", "SIGHUP"] };
+}
+var { ignore: IGNORE, forward: FORWARD } = signalsFor(process.platform);
+function makeSpawner(spawnFn, proc) {
+  return {
+    run(cmd, args, env) {
+      return new Promise((resolve5, reject) => {
+        let child;
+        try {
+          child = spawnFn(cmd, args, { stdio: "inherit", shell: false, env, windowsHide: true });
+        } catch (e) {
+          reject(new QoreError("QORE_INTERNAL", `Could not start ${cmd}: ${e.code ?? "error"}`));
+          return;
+        }
+        const ignore = () => {
+        };
+        const forwarders = FORWARD.map((sig) => [sig, () => {
+          child.kill(sig);
+        }]);
+        for (const sig of IGNORE) proc.on(sig, ignore);
+        for (const [sig, fn] of forwarders) proc.on(sig, fn);
+        const cleanup = () => {
+          for (const sig of IGNORE) proc.off(sig, ignore);
+          for (const [sig, fn] of forwarders) proc.off(sig, fn);
+        };
+        child.once("error", (e) => {
+          cleanup();
+          reject(e.code === "ENOENT" ? new QoreError("QORE_INTERNAL", `Command not found: ${cmd}`, { hint: "Check the command after --; it runs without a shell." }) : new QoreError("QORE_INTERNAL", `Could not start ${cmd}: ${e.code ?? "error"}`));
+        });
+        child.once("exit", (code, signal) => {
+          cleanup();
+          resolve5({ code, signal });
+        });
+      });
+    }
+  };
+}
+var crossSpawner = makeSpawner(spawn, process);
+
 // src/version.ts
-var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var VERSION = true ? "0.1.2" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
-var dir = configDir(process.env, process.platform, homedir());
+var dir = configDir(process.env, process.platform, homedir2());
 var argv = process.argv.slice(2);
-var json = argv.includes("--json");
+var preSeparatorArgv = argvBeforeSeparator(argv);
+var json = preSeparatorArgv.includes("--json");
 var ac = new AbortController();
 process.on("SIGINT", () => {
-  if (ac.signal.aborted) process.exit(130);
+  if (ac.signal.aborted) {
+    if (childRunning.current) return;
+    process.exit(130);
+  }
   ac.abort();
 });
-var fetch = abortableFetch(globalThis.fetch, ac.signal);
+var fetch2 = abortableFetch(globalThis.fetch, ac.signal);
 var deps = {
-  fetch,
+  fetch: fetch2,
   keychain: new OsKeychain(),
   config: new ConfigStore(dir),
   withLock: fileLock(dir),
   now: () => /* @__PURE__ */ new Date(),
-  oidcFor: (issuer) => createOidc({ issuer, clientId: "qore-cli", fetch }),
+  oidcFor: (issuer) => createOidc({ issuer, clientId: "qore-cli", fetch: fetch2 }),
   env: process.env,
   platform: process.platform,
-  version: VERSION
+  version: VERSION,
+  cwd: process.cwd(),
+  home: homedir2(),
+  git: systemGit,
+  spawn: crossSpawner,
+  raise: (signal) => {
+    process.removeAllListeners(signal);
+    process.kill(process.pid, signal);
+  }
 };
 var io = processIo(isInteractive({
   stdinTTY: Boolean(process.stdin.isTTY),
   stdoutTTY: Boolean(process.stdout.isTTY),
   json,
-  noInput: argv.includes("--no-input"),
+  noInput: preSeparatorArgv.includes("--no-input"),
   env: process.env
 }));
 process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS);