@quatronic/qore 0.1.2 → 0.1.4

package/dist/cli.js

@@ -5,7 +5,7 @@ import { homedir as homedir2 } from "os";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
 
 // src/cli/io.ts
-import { confirm, select } from "@inquirer/prompts";
+import { confirm, search, select } from "@inquirer/prompts";
 import { createInterface } from "readline";
 
 // src/platform/browser.ts
@@ -52,7 +52,17 @@ var EXIT = {
   QORE_UNSUPPORTED_BY_SERVER: 7,
   QORE_UPGRADE_REQUIRED: 7,
   QORE_PORTAL_UNTRUSTED: 7,
-  QORE_RATE_LIMITED: 8
+  QORE_RATE_LIMITED: 8,
+  QORE_PORT_IN_USE: 2,
+  QORE_DEV_UNSUPPORTED: 2,
+  QORE_INSTALL_FAILED: 1,
+  QORE_PACKAGE_MANAGER: 1,
+  QORE_DOCKER_MISSING: 1,
+  QORE_DOCKER_NOT_RUNNING: 1,
+  QORE_DOCKER_COMPOSE_MISSING: 1,
+  QORE_SERVICE_DATA_INCOMPATIBLE: 1,
+  QORE_NODE_VERSION: 1,
+  QORE_SERVICE_UNHEALTHY: 1
 };
 var QoreError = class extends Error {
   code;
@@ -100,7 +110,7 @@ function toJsonError(err) {
 function isInteractive(o) {
   return o.stdinTTY && o.stdoutTTY && !o.json && !o.noInput && !o.env.CI;
 }
-function processIo(interactive) {
+function processIo(interactive, stderrTTY = Boolean(process.stderr.isTTY)) {
   return {
     out: (s) => {
       process.stdout.write(s + "\n");
@@ -109,6 +119,8 @@ function processIo(interactive) {
       process.stderr.write(s + "\n");
     },
     interactive,
+    stderrTTY,
+    stderrRaw: process.stderr,
     async select(message, choices) {
       try {
         return await select({ message, choices });
@@ -117,14 +129,22 @@ function processIo(interactive) {
         throw e;
       }
     },
-    async confirm(message) {
+    async search(message, source) {
       try {
-        return await confirm({ message, default: false });
+        return await search({ message, source: (term) => source(term ?? "") });
       } catch (e) {
         if (e.name === "ExitPromptError") throw new CancelledError();
         throw e;
       }
     },
+    async confirm(message, signal, o) {
+      try {
+        return await confirm({ message, default: o?.default ?? false }, { signal });
+      } catch (e) {
+        if (e.name === "ExitPromptError" || e.name === "AbortPromptError") throw new CancelledError();
+        throw e;
+      }
+    },
     waitForEnter: createWaitForEnter(process.stdin, process.stderr),
     openUrl: openBrowser
   };
@@ -176,7 +196,11 @@ function isAbortError(e) {
 function fetchError(e, host) {
   return isAbortError(e) ? new CancelledError() : networkError(e, host);
 }
-function networkError(e, host) {
+function proxyHint(proxy, platform) {
+  const cmd = platform === "win32" ? `set HTTPS_PROXY=http://${proxy}` : `export HTTPS_PROXY=http://${proxy}`;
+  return `Your system uses the proxy ${proxy}, but qore reads only HTTPS_PROXY. Run: ${cmd}`;
+}
+function networkError(e, host, systemProxy2) {
   const code = causeCode(e) ?? "";
   let reason = "connect";
   let hint = "Check your network or VPN.";
@@ -188,10 +212,24 @@ function networkError(e, host) {
     hint = "A proxy is re-signing TLS. Point NODE_EXTRA_CA_CERTS at your organisation's CA certificate.";
   } else if (code.includes("TIMEOUT") || code === "ETIMEDOUT") {
     reason = "timeout";
+  } else if (systemProxy2) {
+    reason = "proxy";
+    hint = proxyHint(systemProxy2);
   } else if (!process.env.HTTPS_PROXY && !process.env.https_proxy) {
     hint = "Check your network. Behind a corporate proxy, set HTTPS_PROXY.";
   }
-  return new QoreError("QORE_API_UNREACHABLE", `Could not reach ${host}`, { hint, details: { reason, host, errno: code || void 0 }, cause: e });
+  const details = { reason, host, errno: code || void 0 };
+  if (systemProxy2) details.proxy = systemProxy2;
+  return new QoreError("QORE_API_UNREACHABLE", `Could not reach ${host}`, { hint, details, cause: e });
+}
+function withSystemProxy(err, proxy, platform) {
+  return new QoreError(err.code, err.message, {
+    status: err.status,
+    requestId: err.requestId,
+    cause: err.cause,
+    details: { ...err.details, reason: "proxy", proxy },
+    hint: proxyHint(proxy, platform)
+  });
 }
 var BY_SERVER_CODE = {
   "app.access.denied": "QORE_ACCESS_DENIED",
@@ -263,6 +301,98 @@ function renderError(io2, err, json2, colorEnabled = pc.isColorSupported) {
   io2.err(c.red(`Error: ${e.message}`));
   if (e.hint) io2.err(e.hint);
   io2.err(c.dim(`Code: ${e.code}${e.requestId ? ` (request ${e.requestId})` : ""}`));
+  if (e.code === "QORE_SERVICE_UNHEALTHY" && Array.isArray(e.details?.logs)) {
+    for (const l of e.details.logs) io2.err(c.dim(`  ${String(l)}`));
+  }
+}
+function renderDoctorJson(io2, report) {
+  const failing = report.results.filter((r) => r.status === "fail");
+  if (failing.length === 0) {
+    io2.out(JSON.stringify({ ok: true, data: report }));
+    return false;
+  }
+  const first = failing.find((r) => r.error);
+  const code = first?.error?.code ?? "QORE_INTERNAL";
+  const message = first?.error?.message ?? `${failing.length} of ${report.results.length} checks failed`;
+  const hint = first?.error?.hint;
+  const err = new QoreError(code, message, { hint, details: { results: report.results, context: report.context } });
+  io2.out(JSON.stringify({ ok: false, error: toJsonError(err) }));
+  return true;
+}
+var SYMBOL = { ok: "\u2713", warn: "!", fail: "\u2717" };
+var TOOL_IDS = ["qore", "node", "git", "github-ssh", "docker"];
+var ROW_WIDTH = 80;
+var COL_B = 36;
+function rawLine(r) {
+  return `${SYMBOL[r.status]} ${r.label}`;
+}
+function colorFor(c, status2) {
+  return status2 === "ok" ? c.green : status2 === "warn" ? c.yellow : c.red;
+}
+function coloredLine(c, r) {
+  return `${colorFor(c, r.status)(SYMBOL[r.status])} ${r.label}`;
+}
+function printCheck(io2, c, indent, r) {
+  io2.out(`${indent}${coloredLine(c, r)}`);
+  const hint = r.status === "fail" ? r.error?.hint : void 0;
+  if (typeof hint === "string") io2.out(c.dim(`${indent}  ${hint}`));
+}
+function toolRows(io2, c, tools) {
+  for (let i = 0; i < tools.length; i += 2) {
+    const a = tools[i];
+    const b = tools[i + 1];
+    if (!b) {
+      printCheck(io2, c, "", a);
+      continue;
+    }
+    const rawA = rawLine(a);
+    const rawB = rawLine(b);
+    const colB = Math.max(COL_B, rawA.length + 2);
+    if (colB + rawB.length > ROW_WIDTH) {
+      printCheck(io2, c, "", a);
+      printCheck(io2, c, "", b);
+      continue;
+    }
+    const pad = " ".repeat(colB - rawA.length);
+    io2.out(`${coloredLine(c, a)}${pad}${coloredLine(c, b)}`);
+    if (a.status === "fail" && typeof a.error?.hint === "string") io2.out(c.dim(`  ${a.error.hint}`));
+    if (b.status === "fail" && typeof b.error?.hint === "string") io2.out(c.dim(`  ${b.error.hint}`));
+  }
+}
+function groupByModule(results) {
+  const order = [];
+  const groups = /* @__PURE__ */ new Map();
+  for (const r of results) {
+    const key = r.module ?? r.id;
+    if (!groups.has(key)) {
+      groups.set(key, []);
+      order.push(key);
+    }
+    groups.get(key).push(r);
+  }
+  const isSub = (r) => r.id.startsWith("pm:") || r.id.startsWith("node:");
+  return order.flatMap((key) => {
+    const g = groups.get(key);
+    return [...g.filter((r) => !isSub(r)), ...g.filter(isSub)];
+  });
+}
+function renderDoctorHuman(io2, report, colorEnabled = pc.isColorSupported) {
+  const c = createColors(colorEnabled);
+  const byId = new Map(report.results.map((r) => [r.id, r]));
+  const tools = TOOL_IDS.map((id) => byId.get(id)).filter((r) => r !== void 0);
+  toolRows(io2, c, tools);
+  for (const r of report.results.filter((r2) => r2.group === "session")) printCheck(io2, c, "", r);
+  const clock = byId.get("clock");
+  if (clock) printCheck(io2, c, "", clock);
+  const workspace = groupByModule(report.results.filter((r) => r.group === "workspace"));
+  if (workspace.length === 0) return;
+  if (report.context.kind !== "none") {
+    io2.out(`\u2192 ${report.context.kind === "workspace" ? "Workspace" : "Module"} ${report.context.label ?? ""}`);
+  }
+  for (const r of workspace) {
+    const indent = r.id.startsWith("pm:") || r.id.startsWith("node:") ? "    " : "  ";
+    printCheck(io2, c, indent, r);
+  }
 }
 
 // src/cli/program.ts
@@ -273,9 +403,32 @@ function argvBeforeSeparator(argv2) {
 function jsonFromArgv(argv2) {
   return argvBeforeSeparator(argv2).some((a) => a === "--json" || a.startsWith("--json="));
 }
+var DOCTOR_CODES = /* @__PURE__ */ new Set([
+  "QORE_DOCKER_MISSING",
+  "QORE_DOCKER_NOT_RUNNING",
+  "QORE_DOCKER_COMPOSE_MISSING",
+  "QORE_NODE_VERSION",
+  "QORE_PACKAGE_MANAGER",
+  "QORE_INSTALL_FAILED",
+  "QORE_PORT_IN_USE",
+  "QORE_SERVICE_UNHEALTHY"
+]);
+var machineFailure = (e) => DOCTOR_CODES.has(e.code) && !(e.code === "QORE_PORT_IN_USE" && e.details?.owner === "qore");
+function needsDoctor(e) {
+  if (!(e instanceof QoreError)) return false;
+  const problems = e.details?.problems;
+  if (Array.isArray(problems)) return problems.some((p) => machineFailure(p));
+  return machineFailure(e);
+}
 function requestLog(ctx) {
   return ctx.opts().verbose ? (line2) => ctx.io.err(line2) : void 0;
 }
+async function withProxyHint(deps2, e) {
+  if (!(e instanceof QoreError) || e.code !== "QORE_API_UNREACHABLE" || e.details?.reason !== "connect") return e;
+  if (deps2.env.HTTPS_PROXY || deps2.env.https_proxy || deps2.env.HTTP_PROXY || deps2.env.http_proxy) return e;
+  const proxy = await deps2.systemProxy();
+  return proxy ? withSystemProxy(e, proxy, deps2.platform) : e;
+}
 function buildProgram(deps2, io2, signal, register, setExitCode) {
   const program = new Command("qore").description("Qore developer CLI").option("--portal <name|url>", "prod, staging, or a portal URL (default: the portal you last logged in to, else prod)").option("--json", "print exactly one JSON document on stdout").option("--no-input", "never prompt").option("--verbose", "log request lines (never secrets)").option("--no-color", "disable colours").exitOverride().configureOutput({ writeOut: (s) => io2.out(s.trimEnd()), writeErr: (s) => io2.err(s.trimEnd()) });
   const ctx = { deps: deps2, io: io2, signal, opts: () => program.opts(), setExitCode };
@@ -290,11 +443,14 @@ async function run(argv2, deps2, io2, signal, register) {
   const program = buildProgram(deps2, parseIo, signal, register, (code) => {
     state.exitCode = code;
   });
+  program.hook("preAction", (_program, action) => {
+    state.command = action.name();
+  });
   try {
     await program.parseAsync(argv2, { from: "user" });
     return state.exitCode ?? 0;
   } catch (caught) {
-    const e = signal.aborted && isAbortError(caught) ? new CancelledError() : caught;
+    const e = await withProxyHint(deps2, signal.aborted && isAbortError(caught) ? new CancelledError() : caught);
     if (e instanceof CommanderError) {
       if (e.exitCode === 0) return 0;
       if (json2) io2.out(JSON.stringify({ ok: false, error: { code: "QORE_CONTEXT_INVALID", message: e.message } }));
@@ -302,6 +458,7 @@ async function run(argv2, deps2, io2, signal, register) {
     }
     const opts = program.opts();
     renderError(io2, e, Boolean(opts.json), pc2.isColorSupported && opts.color !== false);
+    if (!opts.json && needsDoctor(e) && state.command !== "doctor") io2.err("Run qore doctor for a full check of your machine.");
     return exitCodeFor(e);
   }
 }
@@ -325,6 +482,9 @@ function compareVersions(a, b) {
   return 0;
 }
 async function fetchMeta(fetch3, apiOrigin) {
+  return (await fetchMetaWithDate(fetch3, apiOrigin)).meta;
+}
+async function fetchMetaWithDate(fetch3, apiOrigin) {
   let res;
   try {
     res = await fetch3(`${apiOrigin}/api/cli/meta`, { headers: { accept: "application/json" } });
@@ -339,7 +499,9 @@ async function fetchMeta(fetch3, apiOrigin) {
     });
   }
   if (!res.ok) throw await problemToError(res);
-  return await res.json();
+  const header = res.headers.get("date");
+  const ms = header ? Date.parse(header) : NaN;
+  return { meta: await res.json(), date: Number.isNaN(ms) ? null : new Date(ms) };
 }
 function negotiate(meta, portal, cliVersion) {
   if (portal.pinnedIssuer && meta.auth.issuer !== portal.pinnedIssuer) {
@@ -369,9 +531,9 @@ function isMeta(doc) {
   return !!doc && typeof doc === "object" && Array.isArray(doc.capabilities);
 }
 async function loadMeta(deps2, apiOrigin, refresh) {
-  const cached = (await deps2.config.read()).profiles[apiOrigin]?.meta;
-  if (!refresh && cached && isMeta(cached.doc) && deps2.now().getTime() - new Date(cached.fetchedAt).getTime() < TTL_MS) {
-    return { meta: cached.doc, cached: true };
+  const cached2 = (await deps2.config.read()).profiles[apiOrigin]?.meta;
+  if (!refresh && cached2 && isMeta(cached2.doc) && deps2.now().getTime() - new Date(cached2.fetchedAt).getTime() < TTL_MS) {
+    return { meta: cached2.doc, cached: true };
   }
   const meta = await fetchMeta(deps2.fetch, apiOrigin);
   await deps2.config.update((c) => {
@@ -380,6 +542,9 @@ async function loadMeta(deps2, apiOrigin, refresh) {
   });
   return { meta, cached: false };
 }
+async function metaFor(deps2, apiOrigin) {
+  return (await loadMeta(deps2, apiOrigin, false)).meta;
+}
 async function ensureCapability(deps2, apiOrigin, capability) {
   const first = await loadMeta(deps2, apiOrigin, false);
   let meta = first.meta;
@@ -440,6 +605,12 @@ function profileHash(apiOrigin, issuer) {
 }
 
 // src/core/api/client.ts
+function clockSkewSeconds(dateHeader, now) {
+  if (!dateHeader) return null;
+  const serverMs = Date.parse(dateHeader);
+  if (Number.isNaN(serverMs)) return null;
+  return Math.round((serverMs - now.getTime()) / 1e3);
+}
 var QoreApiClient = class {
   constructor(o) {
     this.o = o;
@@ -474,6 +645,15 @@ var QoreApiClient = class {
     if (res.status === 401) {
       res = await this.once(method, path, body, true);
       if (res.status === 401) {
+        const skew = clockSkewSeconds(res.headers.get("date"), (this.o.now ?? (() => /* @__PURE__ */ new Date()))());
+        if (skew !== null && Math.abs(skew) > 60) {
+          const minutes = Math.max(1, Math.round(Math.abs(skew) / 60));
+          throw new QoreError("QORE_CLOCK_SKEW", `Your clock is off by ${minutes} min; tokens look expired`, {
+            hint: "Turn on automatic date and time, then run the command again.",
+            status: 401,
+            details: { skewSeconds: skew }
+          });
+        }
         throw new QoreError("QORE_SESSION_EXPIRED", "The portal no longer accepts your session", {
           hint: "Run `qore login`.",
           status: 401,
@@ -597,7 +777,8 @@ async function openSession(deps2, portal, command, onRequest) {
     cliVersion: deps2.version,
     command,
     platform: `${deps2.platform} ${process.arch}; node ${process.versions.node}`,
-    onRequest
+    onRequest,
+    now: deps2.now
   });
   return { profile, api, tokens, refresh };
 }
@@ -605,8 +786,7 @@ async function openSession(deps2, portal, command, onRequest) {
 // src/core/workspace/apps.ts
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var tenantCandidates = (tenants) => tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
-async function resolveAppRef(deps2, session, arg, tenantFlag) {
-  if (UUID.test(arg)) return { appId: arg, tenant: null };
+async function resolveTenant(deps2, session, tenantFlag, whatFor) {
   const me = await session.api.get("/api/cli/v1/me");
   let tenant;
   if (tenantFlag) {
@@ -630,11 +810,16 @@ async function resolveAppRef(deps2, session, arg, tenantFlag) {
   } else if (me.tenants.length === 1) {
     tenant = { id: me.tenants[0].id, slug: me.tenants[0].slug };
   } else {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${arg}" in?`, {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${whatFor}" in?`, {
       hint: "Run `qore tenant use <slug>`, or pass --tenant <slug>.",
       candidates: tenantCandidates(me.tenants)
     });
   }
+  return { tenant, me };
+}
+async function resolveAppRef(deps2, session, arg, tenantFlag) {
+  if (UUID.test(arg)) return { appId: arg, tenant: null };
+  const { tenant } = await resolveTenant(deps2, session, tenantFlag, arg);
   try {
     const { id } = await session.api.get(
       `/api/cli/v1/tenants/${encodeURIComponent(tenant.id)}/apps/resolve?slug=${encodeURIComponent(arg)}`
@@ -657,7 +842,7 @@ async function resolveAppRef(deps2, session, arg, tenantFlag) {
 }
 
 // src/core/workspace/apply.ts
-import { join as join4, relative } from "path";
+import { join as join4 } from "path";
 
 // src/core/context/cache.ts
 import { join as join2 } from "path";
@@ -807,7 +992,7 @@ async function trust(deps2, root, moduleId) {
 }
 
 // src/core/workspace/plan.ts
-import { join as join3 } from "path";
+import { join as join3, relative } from "path";
 var SEGMENT = /^[A-Za-z0-9_.-]+$/;
 function isSupportedRepoUrl(repoUrl) {
   let u;
@@ -832,6 +1017,13 @@ function cloneUrl(repoUrl, protocol) {
   const u = new URL(repoUrl);
   return `git@${u.hostname}:${u.pathname.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/, "")}.git`;
 }
+function conflictText(cwd, action) {
+  const dir2 = relative(cwd, action.dir) || ".";
+  const notRepo = action.reason === "not a git repository";
+  const what = notRepo ? "it is not a git repository" : action.origin ? `its origin is ${action.origin}, not ${action.module.repoUrl}` : "it has no origin remote";
+  const message = notRepo ? `${dir2} is not a git repository` : action.origin ? `${dir2} holds another repository (its origin is ${action.origin}, not ${action.module.repoUrl})` : `${dir2} has no origin remote`;
+  return { message, hint: `Move ${dir2} aside (${what}), then run \`qore sync\`.` };
+}
 function planWorkspace(root, modules, dirs, strayRepos2) {
   const actions = modules.map((module) => {
     const dir2 = join3(root, module.slug);
@@ -848,6 +1040,10 @@ function planWorkspace(root, modules, dirs, strayRepos2) {
   const slugs = new Set(modules.map((m) => m.slug));
   return { actions, removed: strayRepos2.filter((s) => !slugs.has(s)) };
 }
+function cloneProtocol(dirs) {
+  const origins = Object.values(dirs).flatMap((d) => d.remotes.filter((r) => r.name === "origin").map((r) => r.url));
+  return origins.some((u) => /^(git@|ssh:\/\/)/.test(u)) ? "ssh" : "https";
+}
 
 // src/core/workspace/diagnose.ts
 var ACCESS_CODES = /* @__PURE__ */ new Set(["QORE_GITHUB_NOT_LINKED", "QORE_REPO_NO_ACCESS", "QORE_REPO_ACCESS_PENDING"]);
@@ -923,15 +1119,8 @@ function toFailure(slug, e) {
   throw e;
 }
 function conflictResult(deps2, action) {
-  const dir2 = relative(deps2.cwd, action.dir) || ".";
-  const what = action.reason === "not a git repository" ? "it is not a git repository" : action.origin ? `its origin is ${action.origin}, not ${action.module.repoUrl}` : "it has no origin remote";
-  const message = action.reason === "not a git repository" ? `${dir2} is not a git repository` : action.origin ? `${dir2} holds another repository (its origin is ${action.origin}, not ${action.module.repoUrl})` : `${dir2} has no origin remote`;
-  return {
-    slug: action.module.slug,
-    status: "conflict",
-    reason: action.reason,
-    error: { code: "QORE_WORKSPACE_CONFLICT", message, hint: `Move ${dir2} aside (${what}), then run \`qore sync\`.` }
-  };
+  const { message, hint } = conflictText(deps2.cwd, action);
+  return { slug: action.module.slug, status: "conflict", reason: action.reason, error: { code: "QORE_WORKSPACE_CONFLICT", message, hint } };
 }
 async function applyActions(deps2, o) {
   const cache = new ResolutionCache(join4(deps2.config.dir, "cache"), deps2.now);
@@ -1124,10 +1313,10 @@ function unsafeSlugError(slug) {
 function exitFor(results) {
   const failures = results.filter((r) => r.status === "failed" || r.status === "conflict");
   if (failures.length === 0) return null;
-  const ok = results.some((r) => ["cloned", "present", "fetched", "pulled", "skipped"].includes(r.status));
+  const ok2 = results.some((r) => ["cloned", "present", "fetched", "pulled", "skipped"].includes(r.status));
   const code = (r) => r.status === "conflict" ? "QORE_WORKSPACE_CONFLICT" : r.error?.code ?? "QORE_INTERNAL";
   const nonAccess = failures.find((r) => !ACCESS_CODES.has(code(r)));
-  if (ok && !nonAccess) return null;
+  if (ok2 && !nonAccess) return null;
   const first = nonAccess ?? failures[0];
   const moduleCount = results.filter((r) => r.status !== "removed").length;
   return new QoreError(code(first), `${failures.length} of ${moduleCount} modules need attention`, {
@@ -1233,8 +1422,34 @@ async function resolveApp(deps2, io2, session, appArg, tenantFlag) {
     return resolveAppRef(deps2, session, appArg, slug);
   }
 }
+async function pickApp(deps2, io2, session, tenantFlag) {
+  if (!io2.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", "An app is required", {
+      hint: "Pass an app slug: `qore clone <app>`. Interactively, omitting it opens a picker."
+    });
+  }
+  let tenant, me;
+  try {
+    ({ tenant, me } = await resolveTenant(deps2, session, tenantFlag, "the app you want to clone"));
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" && e.code !== "QORE_TENANT_ACCESS_LOST" || !e.candidates?.length) throw e;
+    const slug = await io2.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.slug })));
+    ({ tenant, me } = await resolveTenant(deps2, session, slug, "the app you want to clone"));
+  }
+  const apps = me.tenants.find((t) => t.id === tenant.id)?.apps ?? [];
+  if (apps.length === 0) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `No apps in ${tenant.slug} to clone`, {
+      hint: "Run `qore whoami` to see what you have access to."
+    });
+  }
+  const app = await io2.search("Select an app", (term) => {
+    const q = term.toLowerCase();
+    return apps.filter((a) => !q || a.slug.toLowerCase().includes(q) || a.name.toLowerCase().includes(q)).map((a) => ({ name: `${a.name} (${a.slug})`, value: a.slug }));
+  });
+  return { tenant: tenant.slug, app };
+}
 function registerClone(program, ctx) {
-  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("<app>", "app slug or id").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
+  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("[app]", "app slug or id (omit to pick one interactively)").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
     const { deps: deps2, io: io2 } = ctx;
     const g = ctx.opts();
     const cfg = await deps2.config.read();
@@ -1242,7 +1457,9 @@ function registerClone(program, ctx) {
     const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
     const session = await openSession(deps2, portal, "clone", onRequest);
     await ensureCapability(deps2, portal.apiOrigin, "app.modules");
-    const ref = await resolveApp(deps2, io2, session, appArg, flags.tenant);
+    const picked = appArg === void 0 ? await pickApp(deps2, io2, session, flags.tenant) : void 0;
+    const appSlug = picked?.app ?? appArg;
+    const ref = await resolveApp(deps2, io2, session, appSlug, picked?.tenant ?? flags.tenant);
     const app = await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ref.appId)}/modules`);
     if (dirArg === void 0 && !isSafeSlug(app.app.slug)) throw unsafeSlugError(app.app.slug);
     const dirLabel = dirArg ?? app.app.slug;
@@ -1252,7 +1469,7 @@ function registerClone(program, ctx) {
       const ws = await readWorkspace(root);
       if (!ws || ws.appId !== app.app.id || ws.portal !== portal.apiOrigin) {
         throw new QoreError("QORE_WORKSPACE_CONFLICT", `${root} exists and is not the workspace of ${app.app.slug}`, {
-          hint: `Pick another directory: qore clone ${appArg} <dir>.`
+          hint: `Pick another directory: qore clone ${appSlug} <dir>.`
         });
       }
     }
@@ -1289,16 +1506,19 @@ function registerClone(program, ctx) {
   });
 }
 
-// src/cli/commands/env.ts
-import { randomBytes as randomBytes3 } from "crypto";
-import { chmod as chmod2, readFile as readFile4, realpath as realpath3, rename as rename3, unlink, writeFile as writeFile3 } from "fs/promises";
-import { basename as basename2, dirname as dirname4, join as join10, relative as relative5 } from "path";
+// src/cli/commands/dev.ts
+import { randomBytes as randomBytes5 } from "crypto";
+import { realpath as realpath5 } from "fs/promises";
+import { constants as constants3 } from "os";
+import { dirname as dirname6, join as join18, relative as relative6 } from "path";
+import { StringDecoder } from "string_decoder";
 
 // src/core/context/repoConfig.ts
 import { readFile as readFile3 } from "fs/promises";
 import { join as join7 } from "path";
 var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
 var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var SCRIPT = /^[A-Za-z0-9:_.-]+$/;
 var invalid2 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
 function moduleDefaults(type) {
   return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
@@ -1336,12 +1556,30 @@ async function readRepoConfig(root) {
     if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid2("localSecrets must not contain duplicates");
     out.localSecrets = doc.localSecrets;
   }
+  if (doc.dev !== void 0) {
+    const d = doc.dev;
+    if (!d || typeof d !== "object" || Array.isArray(d)) throw invalid2("dev must be an object");
+    const dev = {};
+    if (d.install !== void 0) {
+      if (typeof d.install !== "boolean") throw invalid2("dev.install must be true or false");
+      dev.install = d.install;
+    }
+    if (d.services !== void 0) {
+      if (!Array.isArray(d.services) || !d.services.every((s) => typeof s === "string" && SCRIPT.test(s))) {
+        throw invalid2("dev.services must be a list of script names");
+      }
+      if (new Set(d.services).size !== d.services.length) throw invalid2("dev.services must not contain duplicates");
+      dev.services = d.services;
+    }
+    if (d.script !== void 0) {
+      if (typeof d.script !== "string" || !SCRIPT.test(d.script)) throw invalid2("dev.script must be a script name");
+      dev.script = d.script;
+    }
+    out.dev = dev;
+  }
   return out;
 }
 
-// src/core/context/resolver.ts
-import { isAbsolute, join as join9, relative as relative3 } from "path";
-
 // src/core/context/repoRoot.ts
 import { stat } from "fs/promises";
 import { dirname as dirname2, join as join8, resolve as resolve3 } from "path";
@@ -1360,6 +1598,7 @@ async function findRepoRoot(start) {
 }
 
 // src/core/context/resolver.ts
+import { isAbsolute, join as join9, relative as relative3 } from "path";
 var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HINT_FLAG = "cd into a module repository, or pass --module <slug|id>.";
 var RESOLVE = "/api/cli/v1/repos/resolve";
@@ -1503,8 +1742,8 @@ function profileOrder(cfg, cachedOrigins, portalArg, wsPortal) {
   if (portalArg) return [resolvePortal(portalArg, cfg.defaultProfile)];
   const rank = (o) => o === BUILTIN_PORTALS.prod.apiOrigin ? 0 : o === BUILTIN_PORTALS.staging.apiOrigin ? 1 : 2;
   const rest = Object.keys(cfg.profiles).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
-  const cached = cachedOrigins.filter((c) => cfg.profiles[c]);
-  const origins = [...wsPortal ? [wsPortal.apiOrigin] : [], ...cached, resolvePortal(void 0, cfg.defaultProfile).apiOrigin, ...rest];
+  const cached2 = cachedOrigins.filter((c) => cfg.profiles[c]);
+  const origins = [...wsPortal ? [wsPortal.apiOrigin] : [], ...cached2, resolvePortal(void 0, cfg.defaultProfile).apiOrigin, ...rest];
   return [...new Set(origins)].filter((c) => cfg.profiles[c]).map((c) => resolvePortal(c, void 0));
 }
 function withDetails(e, extra, hint) {
@@ -1518,13 +1757,13 @@ function withDetails(e, extra, hint) {
     cause: e
   });
 }
-async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, workspace, unsupported) {
+async function onProfile(deps2, o, cache, portal, keyed, keys, repoRoot, workspace, unsupported2) {
   const session = await openSession(deps2, portal, o.command, o.onRequest);
   try {
     await ensureCapability(deps2, portal.apiOrigin, "repo.resolve");
   } catch (e) {
     if (!(e instanceof QoreError) || e.code !== "QORE_UNSUPPORTED_BY_SERVER") throw e;
-    unsupported(e);
+    unsupported2(e);
     return null;
   }
   const hits = [];
@@ -1598,14 +1837,14 @@ async function resolveModuleContext(deps2, o) {
   const answered = [];
   const skipped = [];
   const skipErrors = [];
-  let unsupported;
+  let unsupported2;
   for (const portal of profileOrder(cfg, await cache.originsFor(keys), o.portal, wsPortal)) {
     tried.push(label(portal));
     let capabilityMissing = false;
     try {
       const mc = await onProfile(deps2, o, cache, portal, keyed, keys, root, ws, (e) => {
         capabilityMissing = true;
-        unsupported ??= e;
+        unsupported2 ??= e;
         skipped.push({ profile: label(portal), code: e.code, message: e.message });
       });
       if (mc) return mc;
@@ -1619,7 +1858,7 @@ async function resolveModuleContext(deps2, o) {
   const details = { triedProfiles: tried };
   if (skipped.length > 0) details.skippedProfiles = skipped;
   if (answered.length === 0) {
-    const cause = skipErrors[0] ?? unsupported;
+    const cause = skipErrors[0] ?? unsupported2;
     if (cause) throw withDetails(cause, details);
   }
   const unchecked = skipped.length ? ` ${skipped.map((s) => s.profile).join(", ")} could not be checked (${skipped.map((s) => s.code).join(", ")}).` : "";
@@ -1630,7 +1869,7 @@ async function resolveModuleContext(deps2, o) {
   });
 }
 var appCandidates = (apps) => apps.map((a) => ({ kind: "app", id: a.id, slug: a.slug, name: a.name }));
-function pickApp(mc, app) {
+function pickApp2(mc, app) {
   const apps = mc.module.apps;
   if (app) {
     const found = apps.find((a) => a.id === app || a.slug === app);
@@ -1648,6 +1887,83 @@ function pickApp(mc, app) {
   throw new QoreError("QORE_APP_AMBIGUOUS", `${mc.module.slug} is part of several apps`, { hint: "Pass --app <slug>.", candidates: appCandidates(apps) });
 }
 
+// src/core/diagnostics/node.ts
+var KEEP_LINES = 50;
+function exitHint(tail, h) {
+  const text2 = tail.join("\n");
+  const missing = text2.match(/Cannot find (?:module|package) '([^']+)'/);
+  if (missing) {
+    return { reason: "missing-module", hint: `A dependency is missing (${missing[1]}). Run \`${h.installCommand}\`, then qore dev again.` };
+  }
+  if (/ZodError:/.test(text2)) {
+    const keys = [...text2.matchAll(/"path":\s*\[\s*"([^"]+)"/g)].map((m) => m[1]);
+    if (keys.length > 0) {
+      return {
+        reason: "invalid-env",
+        keys,
+        hint: `Missing or invalid environment variables: ${keys.join(", ")}. Set them in the portal's local secrets (then qore env pull), or in your env file.`
+      };
+    }
+  }
+  const addrInUse = text2.match(/listen EADDRINUSE: address already in use (?:\S*:)?(\d+)/);
+  if (addrInUse) {
+    const port = Number(addrInUse[1]);
+    return {
+      reason: "port-in-use",
+      port,
+      hint: `Port ${port} was taken while the server started. Run qore dev again; if it repeats, lsof -iTCP:${port} -sTCP:LISTEN names the holder.`
+    };
+  }
+  if (/ECONNREFUSED/.test(text2)) {
+    const m = text2.match(/ECONNREFUSED\s+\S*:(\d+)/) ?? text2.match(/code: 'ECONNREFUSED'[^}]*?port: (\d+)/);
+    if (!m) return { reason: "conn-refused", hint: "A connection was refused (ECONNREFUSED) \u2014 a service this module calls is not running." };
+    const port = Number(m[1]);
+    const role = h.ports.get(port);
+    if (role?.kind === "database") {
+      const up = h.runCommand("db:up");
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `The database on :${port} is not accepting connections (ECONNREFUSED). ` + (up ? `Fix: ${up}  (docker compose ps shows its state)` : "docker compose ps shows its state.")
+      };
+    }
+    if (role?.kind === "provider") {
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `${role.key} points at :${port}, where nothing listens (ECONNREFUSED). Start that module \u2014 qore dev in the workspace root starts providers first.`
+      };
+    }
+    return { reason: "conn-refused", port, hint: `Nothing listens on :${port} (ECONNREFUSED) \u2014 a service this module calls is not running.` };
+  }
+  const auth = text2.match(/password authentication failed for user "([^"]+)"/);
+  if (auth) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-auth",
+      hint: `The local database was created with other credentials than the portal now provides (user ${auth[1]}).` + (reset ? ` Fix: ${reset} \u2014 this wipes local data.` : "")
+    };
+  }
+  const relation = text2.match(/relation "([^"]+)" does not exist/);
+  if (relation) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-schema",
+      hint: `The database schema is behind the code (relation ${relation[1]} does not exist). Migrations run when the app starts; if they failed above, that error is the cause.` + (reset ? ` To start clean: ${reset} (wipes local data).` : "")
+    };
+  }
+  if (/ENOSPC: System limit for number of file watchers reached/.test(text2)) {
+    return {
+      reason: "watcher-limit",
+      hint: "Linux ran out of file watchers. Raise the limit: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p"
+    };
+  }
+  return null;
+}
+
+// src/core/dev/env.ts
+import { dirname as dirname5, join as join12 } from "path";
+
 // src/core/env/fetch.ts
 async function fetchLocalEnv(deps2, mc, app) {
   await ensureCapability(deps2, mc.portal.apiOrigin, "module.local-env");
@@ -1737,12 +2053,12 @@ function renderEnv(original, merged) {
   for (const [key, value] of merged) {
     if (!seen.has(key)) appended.push(`${key}=${value}`);
   }
-  let text = out.join("\n");
+  let text2 = out.join("\n");
   if (appended.length) {
-    if (text.length && !text.endsWith("\n")) text += "\n";
-    text += appended.join("\n") + "\n";
+    if (text2.length && !text2.endsWith("\n")) text2 += "\n";
+    text2 += appended.join("\n") + "\n";
   }
-  return text;
+  return text2;
 }
 
 // src/core/env/pull.ts
@@ -1812,6 +2128,730 @@ function planPull(o) {
   };
 }
 
+// src/core/env/write.ts
+import { chmod as chmod2, readFile as readFile4, rename as rename3, unlink, writeFile as writeFile3 } from "fs/promises";
+import { randomBytes as randomBytes3 } from "crypto";
+import { basename as basename2, dirname as dirname4, join as join10 } from "path";
+async function readOrNull(p) {
+  try {
+    return await readFile4(p, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+async function writeSecurely(target, text2) {
+  const base = basename2(target);
+  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes3(6).toString("hex")}.local` : `${base}.qore-${randomBytes3(6).toString("hex")}.tmp`;
+  const tmp = join10(dirname4(target), tmpName);
+  try {
+    await writeFile3(tmp, text2, { mode: 384, flag: "wx" });
+    await chmod2(tmp, 384);
+    await rename3(tmp, target);
+  } finally {
+    await unlink(tmp).catch(() => {
+    });
+  }
+}
+async function syncEnvFile(o) {
+  const existing = await readOrNull(o.target);
+  const plan = planPull({
+    existing,
+    example: existing === null ? o.example : null,
+    fetched: o.fetched,
+    managed: o.managed,
+    localSecrets: o.localSecrets,
+    defaultChoice: "keep",
+    random: o.random
+  });
+  if (existing !== null && plan.text === existing) await chmod2(o.target, 384);
+  else await writeSecurely(o.target, plan.text);
+  return { created: plan.created, kept: plan.kept };
+}
+
+// src/core/dev/lastStart.ts
+import { createHash as createHash2 } from "crypto";
+import { realpath as realpath3 } from "fs/promises";
+import { join as join11 } from "path";
+var NETWORK_REASONS = /* @__PURE__ */ new Set(["connect", "dns", "tls", "timeout"]);
+function isOffline(e) {
+  if (!(e instanceof QoreError)) return false;
+  if (e.code === "QORE_API_UNREACHABLE" || e.code === "QORE_API_UNAVAILABLE") return true;
+  if (e.code !== "QORE_AUTH_UNAVAILABLE") return false;
+  return (e.status ?? 0) >= 500 || NETWORK_REASONS.has(String(e.details?.reason));
+}
+async function stateKey(deps2, root) {
+  const real = await realpath3(root).catch(() => root);
+  return createHash2("sha256").update(trustKey(real, deps2.platform)).digest("hex").slice(0, 16);
+}
+async function saveLastStart(deps2, root, rec) {
+  await writeJsonAtomic(join11(deps2.config.dir, "dev"), `${await stateKey(deps2, root)}.json`, rec);
+}
+async function loadLastStart(deps2, root) {
+  const rec = await readJson(join11(deps2.config.dir, "dev", `${await stateKey(deps2, root)}.json`)).catch(() => null);
+  return rec && rec.schemaVersion === 1 ? rec : null;
+}
+
+// src/core/dev/env.ts
+function envPort(env, key) {
+  const raw = env[key];
+  if (raw === void 0) return null;
+  const v = raw.trim().replace(/^["']|["']$/g, "");
+  if (!/^\d+$/.test(v)) return null;
+  const n = Number(v);
+  return n >= 1024 && n <= 65535 ? n : null;
+}
+async function devEnv(deps2, o) {
+  const defaults = moduleDefaults(o.type);
+  const target = await resolveTarget(o.root, o.cfg.envFile ?? defaults.envFile);
+  let cause = null;
+  if (o.mc && o.app) {
+    try {
+      const local = await fetchLocalEnv(deps2, o.mc, o.app);
+      const example = await readOrNull(join12(dirname5(target), ".env.example"));
+      const w = await syncEnvFile({
+        target,
+        example,
+        fetched: local.env,
+        managed: local.managedKeys,
+        localSecrets: o.cfg.localSecrets ?? defaults.localSecrets,
+        random: o.random
+      });
+      return {
+        env: local.env,
+        offline: false,
+        envFile: target,
+        port: envPort(local.env, "PORT"),
+        dbPort: envPort(local.env, "DB_PORT"),
+        ...w
+      };
+    } catch (e) {
+      if (!isOffline(e)) throw e;
+      cause = e;
+    }
+  }
+  const text2 = await readOrNull(target);
+  if (text2 === null || !await isTrusted(deps2, o.root, o.moduleId)) {
+    throw cause ?? new QoreError("QORE_API_UNREACHABLE", "The portal is unreachable", {
+      hint: "The portal is unreachable and there is no env file to start from yet."
+    });
+  }
+  const env = Object.fromEntries(parseEnv(text2));
+  return { env, offline: true, envFile: target, port: envPort(env, "PORT"), dbPort: envPort(env, "DB_PORT"), created: false, kept: [] };
+}
+
+// src/core/workspace/access.ts
+function devTeamsOf(am, m) {
+  const own = m.devTeamIds?.length ? am.devTeams.filter((t) => m.devTeamIds.includes(t.id)) : [];
+  return own.length ? own : am.devTeams;
+}
+function askMaintainer(am, m) {
+  const teams = devTeamsOf(am, m);
+  const names = teams.map((t) => t.name);
+  const maintainers = [...new Set(teams.flatMap((t) => t.maintainers))];
+  const who = names.length ? names.join(", ") : "the app's dev team";
+  return { teams: names, maintainers, text: `ask a maintainer of ${who}${maintainers.length ? ` (${maintainers.join(", ")})` : ""}` };
+}
+function notClonedReason(m, am) {
+  if (am && !m.githubLinked) return `GitHub account not linked (${am.accountUrl})`;
+  if (am && m.repoAccess === "none") {
+    const names = devTeamsOf(am, m).map((t) => t.name);
+    return names.length ? `no repository access (dev team ${names.join(", ")})` : "no repository access (ask your tenant owner)";
+  }
+  return "run qore sync";
+}
+
+// src/core/dev/findings.ts
+var plural = (n, one, many) => n === 1 ? one : many;
+function modulesMissing(o) {
+  const actionFor = new Map(o.actions.map((a) => [a.module.slug, a]));
+  const findings = [];
+  const fixable = [];
+  const blocked = [];
+  const reasons = {};
+  const own = (m, reason, rest) => {
+    reasons[m.slug] = reason;
+    return { code: "dev.modules-missing", severity: "warn", module: m.slug, modules: [m.slug], message: `${m.slug} is not cloned \u2014 ${reason}`, ...rest };
+  };
+  for (const m of o.missing) {
+    const a = actionFor.get(m.slug);
+    if (a && a.kind !== "clone") {
+      if (a.kind === "conflict") {
+        const c = conflictText(o.cwd, a);
+        blocked.push(own(m, c.message, { action: { command: c.hint } }));
+      } else if (a.kind === "unsupported") {
+        blocked.push(own(m, "its repository URL is not supported", { action: { command: unsupportedRepoUrlError(m.slug, "").hint } }));
+      } else {
+        blocked.push(own(m, a.reason ?? "no repository yet", { why: "It will not run in this session." }));
+      }
+    } else if (o.am !== null && (!m.githubLinked || m.repoAccess === "none")) {
+      const am = o.am;
+      blocked.push(own(m, notClonedReason(m, am), { action: { command: !m.githubLinked ? `Link your GitHub account: ${am.accountUrl}` : askMaintainer(am, m).text } }));
+    } else fixable.push(m);
+  }
+  if (fixable.length > 0) {
+    const slugs = fixable.map((m) => m.slug);
+    const deps2 = slugs.flatMap((s) => (o.consumers[s] ?? []).map((c) => `${c} depends on ${s}`));
+    findings.push({
+      code: "dev.modules-missing",
+      severity: "warn",
+      message: `${fixable.length} ${plural(fixable.length, "module of this app is", "modules of this app are")} not cloned: ${slugs.join(", ")}`,
+      why: deps2.length > 0 ? `${deps2.join("; ")}.` : `${plural(fixable.length, "It", "They")} will not run in this session.`,
+      modules: slugs,
+      action: o.am ? { command: "qore sync", fix: "sync" } : { command: "qore sync" }
+    });
+  }
+  return { findings: [...findings, ...blocked], fixable, reasons };
+}
+function strayClone(name, appName) {
+  return { code: "dev.stray-clone", severity: "info", module: name, message: `${name} is no longer part of ${appName} \u2014 you can remove the directory.` };
+}
+function repoBehind(slug, s, o) {
+  if (!s.ok || !s.upstream || !s.behind) return null;
+  return {
+    code: "dev.repo-behind",
+    severity: "warn",
+    module: slug,
+    message: `${slug} is ${s.behind} ${plural(s.behind, "commit", "commits")} behind ${s.upstreamRef ?? "its upstream"} (as of your last fetch).`,
+    action: { command: o.workspace ? "qore sync --pull" : "git pull" }
+  };
+}
+function servicesMissing(slug, env, recipe, o) {
+  const db = envPort(env, "DB_PORT");
+  if (db === null || recipe.services.length > 0 || !o.servicesFlag || o.configured) return null;
+  return {
+    code: "dev.services-missing",
+    severity: "warn",
+    module: slug,
+    message: `The portal gives ${slug} a database (DB_PORT=${db}), but ${slug} has no db:up script \u2014 no database will be started.`,
+    why: "This repository is probably older than its template.",
+    action: { command: 'add a "db:up" script (see the current app template), or set dev.services in .qore.json' }
+  };
+}
+function providerDown(o) {
+  const single = o.providers.length === 1 && o.keys.length === 1;
+  return {
+    code: "dev.provider-down",
+    severity: "warn",
+    module: o.slug,
+    modules: o.providers,
+    message: single ? `${o.providers[0]} is not running \u2014 ${o.keys[0]} points at :${o.ports.get(o.keys[0])}, where nothing listens.` : `${o.keys.join(", ")} ${plural(o.keys.length, "points", "point")} at ports nothing listens on (depends on: ${o.providers.join(", ")}).`,
+    why: single ? `${o.slug} will start, but calls to ${o.providers[0]} will fail. Qore does not fall back to staging.` : `${o.slug} will start, but calls through ${o.keys.join(", ")} will fail. Qore does not fall back to staging.`,
+    action: { command: o.fix }
+  };
+}
+
+// src/core/dev/project.ts
+import { access, readFile as readFile5 } from "fs/promises";
+import { join as join13 } from "path";
+var LEGACY_DEV_SCRIPTS = ["node --env-file=.env --import ./dist/instrumentation.js dist/index.js"];
+var LOCKFILES = [["pnpm-lock.yaml", "pnpm"], ["package-lock.json", "npm"], ["yarn.lock", "yarn"]];
+var exists = (p) => access(p).then(() => true, () => false);
+var unsupported = (message, hint, details) => new QoreError("QORE_DEV_UNSUPPORTED", message, { hint, details });
+async function readPackageJson(root) {
+  let raw;
+  try {
+    raw = await readFile5(join13(root, "package.json"), "utf8");
+  } catch {
+    throw unsupported("This repository has no package.json", "qore dev starts Node repositories through their package.json scripts.");
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw unsupported("package.json is not valid JSON", "Fix package.json, then run qore dev again.");
+  }
+}
+async function detectPackageManager(root, pkg) {
+  if (typeof pkg.packageManager === "string") {
+    const m = /^(pnpm|npm|yarn)@(.+)$/.exec(pkg.packageManager.trim());
+    if (!m) throw unsupported(`packageManager "${pkg.packageManager}" is not pnpm, npm or yarn`, "qore dev supports pnpm, npm and yarn.");
+    return { name: m[1], version: m[2].split("+")[0] };
+  }
+  for (const [file, name] of LOCKFILES) if (await exists(join13(root, file))) return { name, version: null };
+  throw unsupported("No package manager declared and no lockfile found", 'Add "packageManager": "pnpm@<version>" to package.json.');
+}
+function planRecipe(o) {
+  const scripts = o.pkg.scripts ?? {};
+  const script = o.cfg.dev?.script ?? "dev";
+  const found = scripts[script];
+  if (found === void 0) {
+    throw unsupported(`${o.slug} has no "${script}" script in package.json`, 'Add a "dev" script, or set dev.script in .qore.json.', { script });
+  }
+  if (LEGACY_DEV_SCRIPTS.includes(found.trim())) {
+    throw unsupported(
+      `${o.slug}'s dev script is the old backend one, which needs a build and a .env first`,
+      'Update it to the current template: "dev": "node scripts/dev.mjs" plus scripts/dev.mjs.',
+      { script, found }
+    );
+  }
+  const configured = o.cfg.dev?.services;
+  for (const s of configured ?? []) {
+    if (scripts[s] === void 0) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `.qore.json: dev.services names "${s}", which is not a script in package.json`, {
+        hint: "Fix dev.services in .qore.json."
+      });
+    }
+  }
+  const services = !o.flags.services ? [] : configured ?? (scripts["db:up"] !== void 0 ? ["db:up"] : []);
+  return {
+    root: o.root,
+    pm: o.pm,
+    script,
+    services,
+    install: (o.cfg.dev?.install ?? true) && o.flags.install,
+    dockerServices: services.some((s) => /\bdocker\b/.test(scripts[s] ?? ""))
+  };
+}
+function runArgs(pm, script) {
+  return { cmd: pm.name, args: ["run", script] };
+}
+function installArgs(pm) {
+  return { cmd: pm.name, args: ["install"] };
+}
+
+// src/core/dev/install.ts
+import { stat as stat2 } from "fs/promises";
+import { join as join14 } from "path";
+var MARKERS = {
+  pnpm: [".modules.yaml"],
+  npm: [".package-lock.json"],
+  yarn: [".yarn-state.yml", ".yarn-integrity"]
+};
+var LOCK = { pnpm: "pnpm-lock.yaml", npm: "package-lock.json", yarn: "yarn.lock" };
+var mtime = (p) => stat2(p).then((s) => s.mtimeMs, () => null);
+async function needsInstall(root, pm) {
+  if (await mtime(join14(root, "node_modules")) === null) return true;
+  let marker = null;
+  for (const m of MARKERS[pm.name]) marker ??= await mtime(join14(root, "node_modules", m));
+  if (marker === null) return true;
+  const lock = await mtime(join14(root, LOCK[pm.name]));
+  return lock !== null && lock > marker;
+}
+
+// src/core/diagnostics/docker.ts
+function dockerInstallUrl(platform) {
+  if (platform === "darwin") return "https://docs.docker.com/desktop/setup/install/mac-install/";
+  if (platform === "win32") return "https://docs.docker.com/desktop/setup/install/windows-install/";
+  return "https://docs.docker.com/engine/install/";
+}
+function classifyDockerInfo(r, platform) {
+  if (r.spawnError === "ENOENT") {
+    return new QoreError("QORE_DOCKER_MISSING", "Docker is not installed", {
+      hint: `Install Docker: ${dockerInstallUrl(platform)} \u2014 or run qore dev --no-services.`
+    });
+  }
+  if (r.code === 0) return null;
+  const hint = "Start Docker Desktop, then run qore dev again \u2014 or qore dev --no-services.";
+  if (/Cannot connect to the Docker daemon|Is the docker daemon running|error during connect/i.test(r.tail.join("\n"))) {
+    return new QoreError("QORE_DOCKER_NOT_RUNNING", "Docker is not running", { hint, details: { reason: "daemon" } });
+  }
+  return new QoreError("QORE_DOCKER_NOT_RUNNING", "Docker is not running", { hint, details: { stderr: r.tail } });
+}
+function classifyComposeVersion(r) {
+  if (r.code === 0) return null;
+  const hint = "Update Docker Desktop (or install the compose plugin). The legacy docker-compose v1 is not supported.";
+  if (/unknown command: docker compose|'compose' is not a docker command/.test(r.tail.join("\n"))) {
+    return new QoreError("QORE_DOCKER_COMPOSE_MISSING", "Docker Compose v2 is missing", { hint });
+  }
+  return new QoreError("QORE_DOCKER_COMPOSE_MISSING", "Docker Compose v2 is missing", { hint, details: { stderr: r.tail } });
+}
+
+// src/core/diagnostics/postgres.ts
+var INCOMPATIBLE = /database files are incompatible with server|Counter to that, there appears to be PostgreSQL data in|in 18\+, these Docker images are configured to store database data/;
+function classifyComposeLogs(logs, o) {
+  const text2 = logs.join("\n");
+  if (!INCOMPATIBLE.test(text2)) return null;
+  const details = { reason: "pg-data-version" };
+  const m = text2.match(/initialized by PostgreSQL version (\d+).*this version (\d+)/);
+  if (m) {
+    details.found = m[1];
+    details.expected = m[2];
+  }
+  return new QoreError("QORE_SERVICE_DATA_INCOMPATIBLE", `The local database volume of ${o.slug} was created by another Postgres version`, {
+    hint: "pnpm db:reset recreates it \u2014 this deletes all local data in it. Qore never runs it for you.",
+    details
+  });
+}
+
+// src/core/diagnostics/ports.ts
+function parseDockerPs(stdout) {
+  const line2 = stdout.split(/\r?\n/).find((l) => l.trim());
+  if (!line2) return null;
+  const [id, name, project, workingDir] = line2.split("	");
+  if (!id || !name) return null;
+  return { id, name, project: project || null, workingDir: workingDir || null };
+}
+function parseLsofCwd(stdout) {
+  const m = stdout.match(/^fcwd\nn(.+)$/m);
+  return m ? m[1] : null;
+}
+function parseEtime(s) {
+  const m = s.trim().match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/);
+  if (!m) return null;
+  const days = m[1] ? Number(m[1]) : 0;
+  const hours = m[2] ? Number(m[2]) : 0;
+  const minutes = Number(m[3]);
+  const seconds = Number(m[4]);
+  return days * 86400 + hours * 3600 + minutes * 60 + seconds;
+}
+function humanAge(seconds) {
+  if (seconds < 60) return `${seconds} s`;
+  if (seconds < 3600) return `${Math.round(seconds / 60)} min`;
+  if (seconds < 86400) return `${Math.round(seconds / 3600)} h`;
+  return `${Math.round(seconds / 86400)} d`;
+}
+
+// src/core/diagnostics/pm.ts
+function pmVersionMismatch(pm, printed) {
+  if (pm.version === null) return null;
+  const lines = printed.split("\n");
+  let found = null;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line2 = lines[i].trim();
+    if (/^\d+\.\d+\.\d+/.test(line2)) {
+      found = line2;
+      break;
+    }
+  }
+  if (found === null) return null;
+  if (found.split(".")[0] === pm.version.split(".")[0]) return null;
+  return new QoreError("QORE_PACKAGE_MANAGER", `${pm.name} ${found} does not match the pinned ${pm.name}@${pm.version}`, {
+    hint: `Install the pinned major: npm i -g ${pm.name}@${pm.version.split(".")[0]}. (pnpm \u2265 9.7 switches to the pinned version by itself.)`,
+    details: { found, pinned: pm.version }
+  });
+}
+function classifyInstall(tail, command, root) {
+  const joined = tail.join("\n");
+  if (/ERR_PNPM_OUTDATED_LOCKFILE/.test(joined)) {
+    return new QoreError("QORE_INSTALL_FAILED", "The lockfile does not match package.json", {
+      hint: `Someone committed one without the other. Run \`${command} --no-frozen-lockfile\` in ${root} and commit the lockfile.`,
+      details: { reason: "outdated-lockfile", command, stderr: tail }
+    });
+  }
+  return new QoreError("QORE_INSTALL_FAILED", `${command} failed`, {
+    hint: `Run \`${command}\` in ${root} to see the full output.`,
+    details: { command, stderr: tail }
+  });
+}
+
+// src/core/diagnostics/versions.ts
+import semver from "semver";
+function nodeSatisfies(found, range) {
+  if (semver.validRange(range) === null) return null;
+  return semver.satisfies(found, range);
+}
+function nodeVersionError(found, range, slug) {
+  const min = semver.minVersion(range);
+  const major = min ? min.major : range;
+  return new QoreError("QORE_NODE_VERSION", `${slug} needs Node ${range}, found ${found}`, {
+    hint: `nvm install ${major} / fnm use ${major}, then run qore dev again.`,
+    details: { found, required: range }
+  });
+}
+
+// src/core/dev/preflight.ts
+var pmMajor = (v) => v ? v.split(".")[0] : "latest";
+var GRACE_MS = 1e4;
+var secs = (ms) => `${Math.round(ms / 1e3)} s`;
+async function runTool(deps2, cmd, args, o) {
+  if (o.signal.aborted) throw new CancelledError();
+  const tail = [];
+  const c = deps2.launch.launch(cmd, args, { cwd: o.cwd, env: { ...o.env, LC_ALL: "C" }, onLine: (l) => {
+    tail.push(l.line);
+    if (tail.length > 50) tail.shift();
+    o.onLine(l);
+  } });
+  let kill;
+  const onAbort = () => {
+    c.stop("SIGTERM");
+    kill = setTimeout(() => c.stop("SIGKILL"), GRACE_MS);
+  };
+  o.signal.addEventListener("abort", onAbort, { once: true });
+  let exit;
+  try {
+    exit = await c.exited;
+  } finally {
+    o.signal.removeEventListener("abort", onAbort);
+    clearTimeout(kill);
+  }
+  if (o.signal.aborted) throw new CancelledError();
+  return { code: exit.code, spawnError: exit.spawnError, tail };
+}
+async function checkPackageManager(deps2, r, onLine, signal) {
+  const res = await runTool(deps2, r.pm.name, ["--version"], { cwd: r.root, env: deps2.env, onLine, signal });
+  const hint = `Install it: npm i -g ${r.pm.name}@${pmMajor(r.pm.version)}`;
+  if (res.spawnError === "ENOENT") {
+    throw new QoreError("QORE_PACKAGE_MANAGER", `${r.pm.name} is not installed`, { hint, details: { packageManager: r.pm } });
+  }
+  if (res.code !== 0) {
+    throw new QoreError("QORE_PACKAGE_MANAGER", `${r.pm.name} is not installed`, { hint, details: { packageManager: r.pm, stderr: res.tail } });
+  }
+  const mismatch = pmVersionMismatch(r.pm, res.tail.join("\n"));
+  if (mismatch) throw mismatch;
+  return res.tail.map((l) => l.trim()).findLast((l) => /^\d+\.\d+\.\d+/.test(l)) ?? null;
+}
+async function checkNode(deps2, r, pkg, slug, signal) {
+  const range = pkg.engines?.node;
+  if (!range) return null;
+  const res = await runTool(deps2, "node", ["--version"], { cwd: r.root, env: deps2.env, onLine: () => {
+  }, signal });
+  if (res.spawnError === "ENOENT") {
+    throw new QoreError("QORE_NODE_VERSION", "node is not on PATH", {
+      hint: "Install Node (https://nodejs.org) or run nvm use, then reinstall qore.",
+      details: { required: range }
+    });
+  }
+  if (res.spawnError || res.code !== 0) {
+    throw new QoreError("QORE_NODE_VERSION", "node --version failed", { details: { required: range, stderr: res.tail } });
+  }
+  const found = (res.tail.at(-1) ?? "").trim().replace(/^v/, "");
+  if (nodeSatisfies(found, range) === false) throw nodeVersionError(found, range, slug);
+  return found;
+}
+async function installIfNeeded(deps2, r, slug, onLine, report, signal) {
+  if (!r.install) {
+    report({ module: slug, step: "install", status: "skip", detail: "disabled" });
+    return;
+  }
+  if (!await needsInstall(r.root, r.pm)) {
+    report({ module: slug, step: "install", status: "skip", detail: "up to date" });
+    return;
+  }
+  report({ module: slug, step: "install", status: "start" });
+  const began = deps2.now().getTime();
+  const { cmd, args } = installArgs(r.pm);
+  const res = await runTool(deps2, cmd, args, { cwd: r.root, env: deps2.env, onLine, signal });
+  if (res.code !== 0) {
+    const command = [cmd, ...args].join(" ");
+    const err = classifyInstall(res.tail, command, r.root);
+    if (err.details?.reason === "outdated-lockfile") throw err;
+    throw new QoreError("QORE_INSTALL_FAILED", `${command} failed in ${slug}`, { hint: err.hint, details: err.details });
+  }
+  report({ module: slug, step: "install", status: "done", detail: secs(deps2.now().getTime() - began) });
+}
+async function portInUseError(deps2, o) {
+  const owner = await deps2.ports.owner(o.port);
+  const qoreRun = (o.runs ?? []).find((r) => r.children.some((c) => c.port === o.port) || owner !== null && (r.qorePid === owner.pid || r.children.some((c) => c.pid === owner.pid)));
+  if (qoreRun) {
+    return new QoreError("QORE_PORT_IN_USE", `A previous qore dev is still running (pid ${qoreRun.qorePid})`, {
+      hint: `Stop it (Ctrl+C in its terminal, or kill ${qoreRun.qorePid}), then run qore dev again.`,
+      details: { port: o.port, module: o.slug, key: o.key, owner: "qore", pid: qoreRun.qorePid }
+    });
+  }
+  if (owner) {
+    if (/^(com\.docker\.backend|com\.docker\.vpnkit|docker-proxy|vpnkit|dockerd)$/.test(owner.command)) {
+      const pub = await deps2.ports.dockerPublisher(o.port);
+      if (pub) {
+        return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is held by the Docker container ${pub.name} (needed by ${o.slug})`, {
+          hint: `It belongs to compose project ${pub.project} in ${pub.workingDir} \u2014 typically another module's or tenant's database. Stop it there with docker compose down, or docker stop ${pub.name}.`,
+          details: { port: o.port, module: o.slug, key: o.key, owner: "docker", ...pub }
+        });
+      }
+    }
+    const detail2 = await deps2.ports.ownerDetail(owner.pid);
+    const extras = [];
+    if (detail2.ageSeconds !== null) extras.push(`started ${humanAge(detail2.ageSeconds)} ago`);
+    if (detail2.cwd !== null) {
+      const cwd = deps2.home && detail2.cwd.startsWith(deps2.home) ? `~${detail2.cwd.slice(deps2.home.length)}` : detail2.cwd;
+      extras.push(`in ${cwd}`);
+    }
+    const suffix = extras.length ? `, ${extras.join(" ")}` : "";
+    return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is already in use (needed by ${o.slug})`, {
+      hint: `Held by: ${owner.command} (pid ${owner.pid})${suffix}. Stop that process. Qore never moves a port: other modules and the local login rely on ${o.port}.`,
+      details: {
+        port: o.port,
+        module: o.slug,
+        key: o.key,
+        owner: "process",
+        pid: owner.pid,
+        command: owner.command,
+        ...detail2.cwd !== null ? { cwd: detail2.cwd } : {},
+        ...detail2.ageSeconds !== null ? { ageSeconds: detail2.ageSeconds } : {}
+      }
+    });
+  }
+  const findHint = deps2.platform === "win32" ? `netstat -ano | findstr :${o.port}` : `lsof -iTCP:${o.port} -sTCP:LISTEN`;
+  return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is already in use (needed by ${o.slug})`, {
+    hint: `Find it with: ${findHint}`,
+    details: { port: o.port, module: o.slug, key: o.key }
+  });
+}
+async function composeFailure(deps2, r, slug, env, signal, message, command, stderr) {
+  if (!r.dockerServices) {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", message, { details: { command, stderr } });
+  }
+  const logs = await runTool(deps2, "docker", ["compose", "logs", "--no-color", "--tail", "50"], { cwd: r.root, env, onLine: () => {
+  }, signal });
+  const dataErr = classifyComposeLogs(logs.tail, { slug, script: "db:up" });
+  if (dataErr) return dataErr;
+  return new QoreError("QORE_SERVICE_UNHEALTHY", message, {
+    hint: `The last lines of docker compose logs are in details.logs; run \`docker compose logs\` in ${r.root} for all of them.`,
+    details: { command, stderr, logs: logs.tail.slice(-20) }
+  });
+}
+async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine, report) {
+  if (r.services.length === 0) {
+    report({ module: slug, step: "services", status: "skip" });
+    return;
+  }
+  report({ module: slug, step: "services", status: "start", ...dbPort !== null ? { detail: `:${dbPort}` } : {} });
+  const began = deps2.now().getTime();
+  if (r.dockerServices) {
+    const res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: r.root, env, onLine, signal });
+    const dockerErr = classifyDockerInfo(res, deps2.platform);
+    if (dockerErr) throw dockerErr;
+    const compose = await runTool(deps2, "docker", ["compose", "version"], { cwd: r.root, env, onLine: () => {
+    }, signal });
+    const composeErr = classifyComposeVersion(compose);
+    if (composeErr) throw composeErr;
+  }
+  for (const script of r.services) {
+    const { cmd, args } = runArgs(r.pm, script);
+    const res = await runTool(deps2, cmd, args, { cwd: r.root, env, onLine, signal });
+    if (res.code !== 0) {
+      if (dbPort !== null && /port is already allocated|address already in use/i.test(res.tail.join("\n"))) {
+        throw await portInUseError(deps2, { slug, port: dbPort, key: "DB_PORT" });
+      }
+      throw await composeFailure(deps2, r, slug, env, signal, `${script} failed in ${slug}`, `${cmd} ${args.join(" ")}`, res.tail);
+    }
+  }
+  if (dbPort !== null) {
+    const ok2 = await deps2.ports.waitFor(dbPort, waitMs, signal);
+    if (signal.aborted) throw new CancelledError();
+    if (!ok2) {
+      throw await composeFailure(
+        deps2,
+        r,
+        slug,
+        env,
+        signal,
+        `The database for ${slug} did not accept connections on port ${dbPort} within ${waitMs / 1e3} s`,
+        void 0,
+        []
+      );
+    }
+  }
+  const took = secs(deps2.now().getTime() - began);
+  report({ module: slug, step: "services", status: "done", detail: dbPort !== null ? `:${dbPort} (${took})` : `(${took})` });
+}
+async function checkPort(deps2, o) {
+  if (o.port === null) return;
+  if (!await deps2.ports.inUse(o.port)) return;
+  throw await portInUseError(deps2, { slug: o.slug, port: o.port, key: o.key, runs: o.runs });
+}
+function abortableDelay(signal) {
+  return (ms) => new Promise((resolve5) => {
+    const done = () => {
+      clearTimeout(t);
+      signal.removeEventListener("abort", done);
+      resolve5();
+    };
+    const t = setTimeout(done, ms);
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+async function waitForDocker(deps2, o) {
+  const delay = o.delay ?? abortableDelay(o.signal);
+  const now = o.now ?? Date.now;
+  const deadline = now() + o.timeoutMs;
+  for (; ; ) {
+    await delay(Math.min(o.pollMs, Math.max(0, deadline - now())));
+    if (o.signal.aborted) throw new CancelledError();
+    const remaining = deadline - now();
+    if (remaining <= 0) return false;
+    const poll = AbortSignal.any([o.signal, AbortSignal.timeout(remaining)]);
+    let res;
+    try {
+      res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: o.cwd, env: o.env ?? deps2.env, onLine: () => {
+      }, signal: poll });
+    } catch (e) {
+      if (e instanceof CancelledError && !o.signal.aborted) return false;
+      throw e;
+    }
+    if (classifyDockerInfo(res, deps2.platform) === null) return true;
+  }
+}
+var MAX_PARENT_HOPS = 10;
+var AGE_SLACK_S = 5;
+async function leftoverOwnsPort(deps2, run4, port) {
+  if (deps2.platform === "win32" || !deps2.launch.signal(run4.qorePid, 0)) return false;
+  const { ageSeconds } = await deps2.ports.ownerDetail(run4.qorePid);
+  const recordAge = (deps2.now().getTime() - Date.parse(run4.startedAt)) / 1e3;
+  if (ageSeconds === null || !Number.isFinite(recordAge) || ageSeconds < recordAge - AGE_SLACK_S) return false;
+  const ours = /* @__PURE__ */ new Set([run4.qorePid, ...run4.children.map((c) => c.pid).filter((p) => p !== null)]);
+  let pid = (await deps2.ports.owner(port))?.pid ?? null;
+  for (let hop = 0; pid !== null && pid > 1 && hop <= MAX_PARENT_HOPS; hop++) {
+    if (ours.has(pid)) return true;
+    pid = await deps2.ports.parentPid(pid);
+  }
+  return false;
+}
+
+// src/core/dev/providers.ts
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function connPorts(env) {
+  const out = [];
+  for (const key of Object.keys(env).sort()) {
+    const m = /^CONN_(.+)_URL$/.exec(key);
+    if (!m) continue;
+    let url;
+    try {
+      url = new URL(env[key].trim().replace(/^["']|["']$/g, ""));
+    } catch {
+      continue;
+    }
+    const port = Number(url.port);
+    if (port > 0 && LOCAL_HOSTS.has(url.hostname)) out.push({ key, alias: m[1], port });
+  }
+  return out;
+}
+function deadAliases(env, listening) {
+  return connPorts(env).filter((c) => !listening.has(c.port)).map((c) => c.key);
+}
+function hintContext(recipe, pkg, env) {
+  const { cmd, args } = installArgs(recipe.pm);
+  const ports = /* @__PURE__ */ new Map();
+  for (const c of connPorts(env)) ports.set(c.port, { kind: "provider", key: c.key });
+  const db = envPort(env, "DB_PORT");
+  if (db !== null) ports.set(db, { kind: "database" });
+  return {
+    installCommand: [cmd, ...args].join(" "),
+    runCommand: (script) => {
+      if (pkg.scripts?.[script] === void 0) return null;
+      const r = runArgs(recipe.pm, script);
+      return [r.cmd, ...r.args].join(" ");
+    },
+    ports
+  };
+}
+
+// src/core/dev/runFile.ts
+import { unlink as unlink2 } from "fs/promises";
+import { join as join15 } from "path";
+async function runFilePath(deps2, root) {
+  const dir2 = join15(deps2.config.dir, "run");
+  const name = `${await stateKey(deps2, root)}.json`;
+  return { dir: dir2, name, path: join15(dir2, name) };
+}
+async function writeRunFile(deps2, root, rec) {
+  const { dir: dir2, name } = await runFilePath(deps2, root);
+  await writeJsonAtomic(dir2, name, rec);
+}
+async function removeRunFile(deps2, root) {
+  const { path } = await runFilePath(deps2, root);
+  await unlink2(path).catch(() => {
+  });
+}
+async function leftoverRun(deps2, root, o = {}) {
+  const { path } = await runFilePath(deps2, root);
+  const rec = await readJson(path).catch(() => null);
+  if (!rec || rec.schemaVersion !== 1) return null;
+  if (deps2.launch.isAlive(rec.qorePid)) return rec;
+  if (o.prune !== false) await unlink2(path).catch(() => {
+  });
+  return null;
+}
+
 // src/cli/context.ts
 var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
 async function moduleContextFor(ctx, flags, command) {
@@ -1838,11 +2878,11 @@ async function moduleContextFor(ctx, flags, command) {
 }
 async function appFor(ctx, mc, app) {
   try {
-    return pickApp(mc, app);
+    return pickApp2(mc, app);
   } catch (e) {
     if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
     const id = await ctx.io.select("Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
-    return pickApp(mc, id);
+    return pickApp2(mc, id);
   }
 }
 function sourceText(mc) {
@@ -1855,63 +2895,1704 @@ function contextLine(mc, app) {
   return `\u2192 ${parts.join(" / ")}  (${sourceText(mc)})`;
 }
 function contextJson(mc, app) {
-  const { id, slug, name, type, access } = mc.module;
+  const { id, slug, name, type, access: access2 } = mc.module;
   return {
     portal: mc.portal.builtin ?? mc.portal.apiOrigin,
     tenant: mc.module.tenant,
     app: app ?? null,
-    module: { id, slug, name, type, access },
+    module: { id, slug, name, type, access: access2 },
     source: mc.source.kind === "remote" ? mc.source.remote : mc.source.kind === "workspace" ? WORKSPACE_FILE : "--module",
     ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
   };
 }
 
-// src/cli/trustPrompt.ts
-async function ensureTrusted(ctx, mc, app, o) {
-  const root = mc.repoRoot ?? ctx.deps.cwd;
-  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
-  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
-  if (o.yes) {
-    await trust(ctx.deps, root, mc.module.id);
-    return;
-  }
+// src/cli/findings.ts
+function canOffer(ctx) {
+  const g = ctx.opts();
+  return ctx.io.interactive && !g.json && g.input !== false;
+}
+function findingEvent(f) {
+  const { severity, ...rest } = f;
+  return { type: severity === "info" ? "info" : "warning", ...rest };
+}
+function renderFinding(ctx, f) {
+  if (ctx.opts().json) {
+    ctx.io.out(JSON.stringify(findingEvent(f)));
+    return;
+  }
+  ctx.io.err(`${f.severity === "info" ? "\u2192" : "!"} ${f.message}`);
+  if (f.why) ctx.io.err(`  ${f.why}`);
+  if (f.action) ctx.io.err(`  Fix: ${f.action.command}`);
+}
+async function offerFix(ctx, question, o) {
+  if (!canOffer(ctx)) return false;
+  return ctx.io.confirm(question, o.signal, { default: o.default });
+}
+
+// src/cli/devRecover.ts
+var DOCKER_WAIT = { timeoutMs: 12e4, pollMs: 2e3 };
+var STOP_WAIT_MS = 1e4;
+var daemonDown = (e) => e instanceof QoreError && e.code === "QORE_DOCKER_NOT_RUNNING" && e.details?.reason === "daemon";
+function dockerRecovery(ctx, signal) {
+  let answer;
+  return async (at, fn) => {
+    try {
+      await fn();
+    } catch (e) {
+      if (!daemonDown(e) || !canOffer(ctx)) throw e;
+      answer ??= (async () => {
+        if (!await offerFix(ctx, "Docker is not running. Wait for it to start?", { default: true, signal })) return false;
+        ctx.io.err("Waiting for Docker\u2026 (Ctrl+C to stop)");
+        const ok2 = await waitForDocker(ctx.deps, { ...at, signal, ...DOCKER_WAIT });
+        if (ok2) ctx.io.err("\u2713 Docker is running");
+        return ok2;
+      })();
+      if (!await answer) throw e;
+      await fn();
+    }
+  };
+}
+async function stopLeftover(ctx, e, runs, signal) {
+  const { deps: deps2, io: io2 } = ctx;
+  const port = e.details?.port;
+  const run4 = runs.find((r) => r.qorePid === e.details?.pid);
+  if (!run4 || typeof port !== "number" || !await leftoverOwnsPort(deps2, run4, port)) return false;
+  if (!await offerFix(ctx, `Stop the previous qore dev (pid ${run4.qorePid})?`, { default: false, signal })) return false;
+  if (!deps2.launch.signal(run4.qorePid, "SIGTERM")) {
+    io2.err(`! pid ${run4.qorePid} could not be signalled`);
+    return false;
+  }
+  if (await deps2.ports.waitFree(port, STOP_WAIT_MS, signal)) return true;
+  if (!signal.aborted) io2.err(`! pid ${run4.qorePid} did not exit within ${STOP_WAIT_MS / 1e3} s`);
+  return false;
+}
+async function checkPortOrStopLeftover(ctx, o, signal) {
+  try {
+    await checkPort(ctx.deps, o);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_PORT_IN_USE" || e.details?.owner !== "qore" || !canOffer(ctx)) throw e;
+    const freed = await stopLeftover(ctx, e, o.runs, signal);
+    if (signal.aborted) throw new CancelledError();
+    if (!freed) throw e;
+    await checkPort(ctx.deps, o);
+  }
+}
+
+// src/cli/progress.ts
+function text(e, o) {
+  switch (`${e.step}:${e.status}`) {
+    case "pm:done":
+      return `\u2713 ${e.detail}`;
+    case "install:skip":
+      return e.detail === "up to date" ? "\u2713 dependencies up to date" : `- install skipped (${o.installFlag ? "dev.install is false in .qore.json" : "--no-install"})`;
+    case "install:start":
+      return "\u22EF installing dependencies\u2026";
+    case "install:done":
+      return `\u2713 dependencies installed (${e.detail})`;
+    case "env:done":
+      return `\u2713 env  ${e.detail}`;
+    case "services:skip":
+      return o.servicesFlag ? null : "- services skipped (--no-services)";
+    case "services:start":
+      return e.detail ? `\u22EF database  waiting for ${e.detail}\u2026` : "\u22EF starting services\u2026";
+    case "services:done":
+      return e.detail?.startsWith(":") ? `\u2713 database ready on ${e.detail}` : `\u2713 services up ${e.detail}`;
+    case "ports:done":
+      return `\u2713 port ${e.detail} free`;
+    default:
+      return null;
+  }
+}
+function progressReporter(ctx, o) {
+  return (e) => {
+    if (ctx.opts().json) {
+      ctx.io.out(JSON.stringify({ type: "step", ...e }));
+      return;
+    }
+    const line2 = text(e, o);
+    if (line2 !== null) ctx.io.err(o.prefix ? o.prefix(e.module, line2) : line2);
+  };
+}
+
+// src/cli/termination.ts
+var preflightHook = {};
+function preflightTermination(abort, raise) {
+  let by;
+  preflightHook.onSignal = (sig) => {
+    by ??= sig;
+    abort();
+  };
+  return { reRaise: async (flush) => {
+    if (!by) return;
+    await flush();
+    raise(by);
+  } };
+}
+async function inPreflight(signals, outer, fn) {
+  const ac2 = new AbortController();
+  const onOuter = () => ac2.abort();
+  outer.addEventListener("abort", onOuter);
+  if (outer.aborted) ac2.abort();
+  const handlers = ["SIGTERM", "SIGHUP"].map((sig) => [sig, () => {
+    preflightHook.onSignal?.(sig);
+    ac2.abort();
+  }]);
+  let armed = false;
+  const arm = () => {
+    if (armed) return;
+    armed = true;
+    for (const [sig, h] of handlers) signals.on(sig, h);
+  };
+  try {
+    return await fn({ signal: ac2.signal, arm });
+  } finally {
+    if (armed) for (const [sig, h] of handlers) signals.off(sig, h);
+    outer.removeEventListener("abort", onOuter);
+  }
+}
+
+// src/cli/trustPrompt.ts
+async function ensureTrusted(ctx, mc, app, o) {
+  const root = mc.repoRoot ?? ctx.deps.cwd;
+  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
+  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
+  if (o.yes) {
+    await trust(ctx.deps, root, mc.module.id);
+    return;
+  }
   if (!ctx.io.interactive) {
     throw new QoreError("QORE_CONTEXT_REQUIRED", `This repository is not trusted for ${mc.module.slug} yet`, {
       hint: "Run interactively once, or pass --yes.",
       details: { reason: "untrusted", repository: root }
     });
   }
-  if (mc.source.kind === "remote") {
-    const key = repoKey(mc.source.url);
-    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? "(unparsable remote URL)"}`);
+  if (mc.source.kind === "remote") {
+    const key = repoKey(mc.source.url);
+    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? "(unparsable remote URL)"}`);
+  }
+  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
+  await trust(ctx.deps, root, mc.module.id);
+}
+
+// src/cli/commands/devWorkspace.ts
+import { randomBytes as randomBytes4 } from "crypto";
+import { realpath as realpath4 } from "fs/promises";
+import { join as join17, relative as relative5 } from "path";
+
+// src/core/dev/order.ts
+function selectSkips(modules, sel) {
+  if (sel.only && sel.skip) {
+    throw new QoreError("QORE_CONTEXT_INVALID", "--only and --skip cannot be used together", {
+      hint: "Pass either --only or --skip, not both."
+    });
+  }
+  const slugs = modules.map((m) => m.slug).sort();
+  const known = new Set(slugs);
+  for (const s of [...sel.only ?? [], ...sel.skip ?? []]) {
+    if (!known.has(s)) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Unknown module: ${s}`, {
+        hint: `Valid slugs: ${slugs.join(", ")}`
+      });
+    }
+  }
+  const onlySet = sel.only ? new Set(sel.only) : null;
+  const skipSet = sel.skip ? new Set(sel.skip) : null;
+  const reasons = /* @__PURE__ */ new Map();
+  for (const m of modules) {
+    if (onlySet && !onlySet.has(m.slug) || skipSet && skipSet.has(m.slug)) {
+      reasons.set(m.slug, "excluded");
+    } else if (!m.present) {
+      reasons.set(m.slug, "not-cloned");
+    } else if (!m.canWrite) {
+      reasons.set(m.slug, "no-write");
+    }
+  }
+  return reasons;
+}
+function tarjanSccs(starting, byId, startingIds) {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const lowlink = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Map();
+  const stack = [];
+  const sccs = [];
+  function strongconnect(id) {
+    indices.set(id, index);
+    lowlink.set(id, index);
+    index++;
+    stack.push(id);
+    onStack.set(id, true);
+    const m = byId.get(id);
+    for (const dep of m.dependsOn) {
+      if (!startingIds.has(dep)) continue;
+      if (!indices.has(dep)) {
+        strongconnect(dep);
+        lowlink.set(id, Math.min(lowlink.get(id), lowlink.get(dep)));
+      } else if (onStack.get(dep)) {
+        lowlink.set(id, Math.min(lowlink.get(id), indices.get(dep)));
+      }
+    }
+    if (lowlink.get(id) === indices.get(id)) {
+      const comp = [];
+      let w;
+      do {
+        w = stack.pop();
+        onStack.set(w, false);
+        comp.push(w);
+      } while (w !== id);
+      sccs.push(comp);
+    }
+  }
+  for (const m of starting) {
+    if (!indices.has(m.id)) strongconnect(m.id);
+  }
+  return sccs;
+}
+function planDev(modules, sel) {
+  const reasons = selectSkips(modules, sel);
+  const byId = new Map(modules.map((m) => [m.id, m]));
+  const starting = modules.filter((m) => !reasons.has(m.slug));
+  const startingIds = new Set(starting.map((m) => m.id));
+  const sccs = tarjanSccs(starting, byId, startingIds);
+  const sccOf = /* @__PURE__ */ new Map();
+  const sccSlugs = sccs.map((comp) => comp.map((id) => byId.get(id).slug).sort());
+  sccs.forEach((comp, i) => comp.forEach((id) => sccOf.set(id, i)));
+  const cycles = sccSlugs.filter((slugs, i) => slugs.length > 1 || sccs[i].some((id) => byId.get(id).dependsOn.includes(id))).map((slugs) => slugs);
+  const providerSccsOf = /* @__PURE__ */ new Map();
+  sccs.forEach((comp, i) => {
+    const set = /* @__PURE__ */ new Set();
+    for (const id of comp) {
+      for (const dep of byId.get(id).dependsOn) {
+        if (!startingIds.has(dep)) continue;
+        const j = sccOf.get(dep);
+        if (j !== i) set.add(j);
+      }
+    }
+    providerSccsOf.set(i, set);
+  });
+  const minSlug = sccSlugs.map((slugs) => slugs[0]);
+  const visited = new Array(sccs.length).fill(false);
+  const orderedSccIndices = [];
+  function visit(i) {
+    if (visited[i]) return;
+    visited[i] = true;
+    const providers = [...providerSccsOf.get(i)].sort((a, b) => minSlug[a].localeCompare(minSlug[b]));
+    for (const p of providers) visit(p);
+    orderedSccIndices.push(i);
+  }
+  const order = sccs.map((_, i) => i).sort((a, b) => minSlug[a].localeCompare(minSlug[b]));
+  for (const i of order) visit(i);
+  const start = [];
+  for (const i of orderedSccIndices) start.push(...sccSlugs[i]);
+  const waitFor = {};
+  for (const m of starting) {
+    const mySccId = sccOf.get(m.id);
+    const providers = m.dependsOn.filter((d) => startingIds.has(d) && sccOf.get(d) !== mySccId).map((d) => byId.get(d).slug);
+    waitFor[m.slug] = [...new Set(providers)].sort();
+  }
+  const skipped = [...reasons.entries()].map(([slug, reason]) => ({ slug, reason })).sort((a, b) => a.slug.localeCompare(b.slug));
+  const missingProviders = {};
+  for (const m of starting) {
+    const missing = m.dependsOn.map((d) => byId.get(d)).filter((dep) => dep !== void 0 && reasons.has(dep.slug)).map((dep) => dep.slug);
+    if (missing.length > 0) {
+      missingProviders[m.slug] = [...new Set(missing)].sort();
+    }
+  }
+  return { start, waitFor, cycles, skipped, missingProviders };
+}
+
+// src/core/dev/supervisor.ts
+import { constants } from "os";
+var EARLY_MS = 1e4;
+var GRACE_MS2 = 1e4;
+function exitCode(e) {
+  if (e.spawnError) return 1;
+  if (e.code !== null) return e.code;
+  const n = e.signal ? constants.signals[e.signal] : void 0;
+  return n === void 0 ? 1 : 128 + n;
+}
+function supervise(o) {
+  const now = o.now ?? Date.now;
+  const delay = o.delay ?? ((ms) => new Promise((r) => {
+    setTimeout(r, ms).unref();
+  }));
+  const abort = new AbortController();
+  const emit = (e) => {
+    try {
+      o.onEvent(e);
+    } catch {
+    }
+  };
+  const running = [];
+  const tails = /* @__PURE__ */ new Map();
+  let unlaunched = o.modules.length;
+  let stopCode = null;
+  let firstFailure = null;
+  let resolveDone;
+  const done = new Promise((r) => {
+    resolveDone = r;
+  });
+  const readiness = /* @__PURE__ */ new Map();
+  for (const m of o.modules) {
+    let resolve5;
+    let settled = false;
+    const promise = new Promise((r) => {
+      resolve5 = r;
+    });
+    readiness.set(m.slug, { promise, settle: (r) => {
+      if (settled) return false;
+      settled = true;
+      resolve5(r);
+      return true;
+    } });
+  }
+  const live = () => running.filter((c) => c.alive);
+  const checkDone = () => {
+    if (live().length > 0) return;
+    if (stopCode !== null) resolveDone(stopCode);
+    else if (unlaunched === 0) resolveDone(firstFailure ?? 0);
+  };
+  const beginStop = (reason, code) => {
+    if (stopCode !== null) return;
+    stopCode = code;
+    abort.abort();
+    for (const r of readiness.values()) r.settle("timeout");
+    emit({ type: "stopping", reason });
+    const targets = live().reverse();
+    for (const c of targets) c.launched.stop("SIGTERM");
+    if (targets.length > 0) {
+      void delay(GRACE_MS2).then(() => {
+        for (const c of live().reverse()) c.launched.stop("SIGKILL");
+      });
+    }
+    checkDone();
+  };
+  const launch = (m) => {
+    unlaunched--;
+    const ready = readiness.get(m.slug);
+    const startedAt = now();
+    const launched = o.launcher.launch(m.cmd, m.args, {
+      cwd: m.cwd,
+      env: m.env,
+      onLine: (l) => {
+        const tail = tails.get(m.slug) ?? [];
+        tail.push(l.line);
+        if (tail.length > KEEP_LINES) tail.shift();
+        tails.set(m.slug, tail);
+        emit({ type: "line", module: m.slug, stream: l.stream, line: l.line });
+      }
+    });
+    const child = { mod: m, launched, alive: true };
+    running.push(child);
+    emit({ type: "start", module: m.slug, pid: launched.pid });
+    if (m.port === null) ready.settle("ready");
+    else {
+      const port = m.port;
+      void o.ports.waitFor(port, o.waitMs, abort.signal).then((ok2) => {
+        if (ready.settle(ok2 ? "ready" : "timeout") && ok2) emit({ type: "ready", module: m.slug, port });
+      });
+    }
+    void launched.exited.then((e) => {
+      child.alive = false;
+      ready.settle("exited");
+      const code = exitCode(e);
+      const early = !!e.spawnError || now() - startedAt < EARLY_MS;
+      const rawCode = e.spawnError ? null : e.code;
+      const rawSignal = e.spawnError ? null : e.signal;
+      const hint = stopCode === null && rawSignal === null && rawCode !== null && rawCode !== 0 ? exitHint(tails.get(m.slug) ?? [], m.hint) ?? void 0 : void 0;
+      emit({ type: "exit", module: m.slug, code: rawCode, signal: rawSignal, early, hint });
+      if (code !== 0 && firstFailure === null) firstFailure = code;
+      if (o.killOthers) beginStop("kill-others", code);
+      checkDone();
+    });
+  };
+  const start = async (m) => {
+    const providers = m.waitFor.filter((p) => readiness.has(p));
+    const results = await Promise.all(providers.map((p) => readiness.get(p).promise));
+    if (stopCode !== null) return;
+    providers.forEach((p, i) => {
+      const why = results[i];
+      if (why !== "ready") emit({ type: "provider-missing", module: m.slug, provider: p, why });
+    });
+    launch(m);
+  };
+  for (const m of o.modules) void start(m);
+  checkDone();
+  return {
+    done,
+    stop(reason) {
+      if (reason === "interrupt") beginStop("interrupt", 130);
+      else beginStop("signal", 128 + constants.signals[reason]);
+    },
+    escalate() {
+      beginStop("interrupt", 130);
+      for (const c of live().reverse()) c.launched.stop("SIGKILL");
+    },
+    children: () => live().map((c) => ({ module: c.mod.slug, pid: c.launched.pid, port: c.mod.port }))
+  };
+}
+
+// src/core/workspace/stray.ts
+import { lstat as lstat2, readdir } from "fs/promises";
+import { join as join16 } from "path";
+async function strayRepos(root, slugs) {
+  let entries;
+  try {
+    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+  const names = [];
+  for (const name of entries) {
+    if (slugs.has(name)) continue;
+    try {
+      await lstat2(join16(root, name, ".git"));
+      names.push(name);
+    } catch {
+    }
+  }
+  return names.sort();
+}
+
+// src/cli/devOutput.ts
+import { createColors as createColors2 } from "picocolors";
+function renderProblems(io2, problems, color) {
+  problems.forEach((p, i) => {
+    if (i > 0) io2.err("");
+    renderError(io2, p, false, color);
+  });
+}
+function combineProblems(problems) {
+  if (problems.length === 0) throw new Error("combineProblems needs at least one problem");
+  if (problems.length === 1) return problems[0];
+  const first = problems[0];
+  return new QoreError(first.code, `${problems.length} problems before starting`, {
+    details: { problems: problems.map((p) => toJsonError(p)) }
+  });
+}
+function prefixer(slugs, color) {
+  const c = createColors2(color);
+  const palette = [c.cyan, c.magenta, c.yellow, c.green, c.blue, c.red];
+  const sorted = [...new Set(slugs)].sort();
+  const width = Math.max(0, ...sorted.map((s) => s.length));
+  return (slug, line2) => {
+    const i = sorted.indexOf(slug);
+    const paint = i === -1 ? (s) => s : palette[i % palette.length];
+    return `${paint(slug.padEnd(width))} \u2502 ${line2}`;
+  };
+}
+
+// src/cli/commands/run.ts
+import { constants as constants2 } from "os";
+var childRunning = { current: false };
+function registerRun(program, ctx) {
+  program.command("run").description("Run a command with this module's local secrets in its environment").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--yes", "trust this repository without asking").argument("<command>", "the command to run (after --)").argument("[args...]", "its arguments, passed verbatim").action(async (cmd, args, f) => {
+    const { deps: deps2 } = ctx;
+    if (ctx.opts().json) {
+      throw new QoreError("QORE_CONTEXT_INVALID", "run has no --json output", {
+        hint: "Drop --json; the child's own output passes through."
+      });
+    }
+    const mc = await moduleContextFor(ctx, f, "run");
+    const app = await appFor(ctx, mc, f.app);
+    await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    const local = await fetchLocalEnv(deps2, mc, app);
+    childRunning.current = true;
+    let exit;
+    try {
+      exit = await deps2.spawn.run(cmd, args, { ...deps2.env, ...local.env });
+    } finally {
+      childRunning.current = false;
+    }
+    if (exit.signal) {
+      deps2.raise(exit.signal);
+      ctx.setExitCode(128 + (constants2.signals[exit.signal] ?? 0));
+      return;
+    }
+    ctx.setExitCode(exit.code ?? 1);
+  });
+}
+
+// src/cli/commands/devWorkspace.ts
+var INSTALL_PARALLELISM = 4;
+var str = (v) => typeof v === "string" && v.length > 0;
+var slugList = (raw) => raw?.split(",").map((s) => s.trim()).filter(Boolean);
+function usableLast(last, appId) {
+  if (!last || last.kind !== "workspace") return false;
+  const a = last.app;
+  return str(last.savedAt) && !!a && a.id === appId && str(a.slug) && str(a.name) && !!a.tenant && str(a.tenant.name) && Array.isArray(last.modules) && last.modules.every((m) => !!m && str(m.id) && str(m.slug) && str(m.type) && str(m.access) && Array.isArray(m.dependsOn));
+}
+async function workspaceContext(ctx, ws) {
+  const { deps: deps2 } = ctx;
+  try {
+    const portal = await flagPortal(deps2, ctx.opts().portal, ws);
+    const session = await openSession(deps2, portal, "dev", requestLog(ctx));
+    await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+    await ensureCapability(deps2, portal.apiOrigin, "module.local-env");
+    return { am: await workspaceAppModules(session, portal, ws), online: { portal, session }, offlineCause: null };
+  } catch (e) {
+    if (!isOffline(e)) throw e;
+    const last = await loadLastStart(deps2, ws.root);
+    if (!usableLast(last, ws.appId)) throw e;
+    const modules = last.modules.map((m) => ({
+      id: m.id,
+      slug: m.slug,
+      name: m.name,
+      type: m.type,
+      access: m.access,
+      repoUrl: m.repoUrl,
+      repoAccess: "none",
+      githubLinked: false,
+      dependsOn: m.dependsOn
+    }));
+    if (!ctx.opts().json) ctx.io.err(`\u2192 ${last.app.tenant.name} / ${last.app.name}  (offline \u2014 last started ${last.savedAt})`);
+    return { am: { app: last.app, accountUrl: "", devTeams: [], modules }, online: null, offlineCause: e };
+  }
+}
+async function pool(items, n, fn) {
+  let next = 0;
+  const results = await Promise.allSettled(Array.from({ length: Math.min(n, items.length) }, async () => {
+    while (next < items.length) await fn(items[next++]);
+  }));
+  const failed = results.find((r) => r.status === "rejected");
+  if (failed) throw failed.reason;
+}
+async function workspaceDev(ctx, ws, f, waitTimeout) {
+  const ready = await inPreflight(ctx.deps.signals, ctx.signal, (p) => prepareWorkspace(ctx, ws, f, waitTimeout, p));
+  await superviseAll(ctx, ws, ready.units, ready.waitFor, ready.o, ready.notRunning);
+}
+async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const json2 = Boolean(g.json);
+  if (f.app !== void 0) {
+    throw new QoreError("QORE_CONTEXT_INVALID", "--app is for a module repository", {
+      hint: "Drop --app; a workspace root starts the modules of its own app."
+    });
+  }
+  const note = (human, event) => json2 ? io2.out(JSON.stringify(event)) : io2.err(human);
+  const warn = (message, extra = {}) => note(`! ${message}`, { type: "warning", ...extra, message });
+  const { am, online, offlineCause } = await workspaceContext(ctx, ws);
+  if (online && !json2) io2.err(`\u2192 ${am.app.tenant.name} / ${am.app.name}  (qore.workspace.json)`);
+  if (!online) warn("The portal is unreachable \u2014 starting every module from its env file as last written; values may be stale.");
+  const color = !json2 && g.color !== false && !deps2.env.NO_COLOR;
+  const problems = [];
+  const attempt = async (slug, fn) => {
+    try {
+      await fn();
+      return true;
+    } catch (e) {
+      if (!(e instanceof QoreError)) throw e;
+      problems.push(withDetails(e, { module: slug }));
+      return false;
+    }
+  };
+  const fail = async (last) => {
+    const all = last ? [...problems, last] : problems;
+    const enriched = await Promise.all(all.map((p2) => withProxyHint(deps2, p2)));
+    if (!json2 && enriched.length > 1) {
+      renderProblems(io2, enriched, color);
+      io2.err("");
+    }
+    throw combineProblems(enriched);
+  };
+  const dirs = {};
+  const safe = [];
+  for (const m of am.modules) {
+    if (!isSafeSlug(m.slug)) {
+      warn(`${JSON.stringify(m.slug)} is not a safe directory name \u2014 skipped`, { module: m.slug });
+      continue;
+    }
+    try {
+      dirs[m.slug] = await deps2.git.inspect(join17(ws.root, m.slug));
+      safe.push(m);
+    } catch (e) {
+      if (!(e instanceof QoreError) || e.code === "QORE_GIT_UNAVAILABLE") throw e;
+      problems.push(withDetails(e, { module: m.slug }));
+    }
+  }
+  const bySlug = new Map(safe.map((m) => [m.slug, m]));
+  const computePlan = () => {
+    const present2 = new Map(planWorkspace(ws.root, safe, dirs, []).actions.filter((a) => a.kind === "present").map((a) => [a.module.slug, a.dir]));
+    const plan2 = planDev(safe.map((m) => ({
+      id: m.id,
+      slug: m.slug,
+      present: present2.has(m.slug),
+      canWrite: m.access === "write" || m.access === "maintain",
+      dependsOn: m.dependsOn
+    })), { only: slugList(f.only), skip: slugList(f.skip) });
+    return { present: present2, plan: plan2 };
+  };
+  let { present, plan } = computePlan();
+  const missingFindings = () => {
+    const missing2 = plan.skipped.filter((s) => s.reason === "not-cloned").map((s) => bySlug.get(s.slug));
+    const consumers = {};
+    for (const [consumer, providers] of Object.entries(plan.missingProviders)) {
+      for (const p2 of providers) (consumers[p2] ??= []).push(consumer);
+    }
+    const actions = planWorkspace(ws.root, missing2, dirs, []).actions;
+    return modulesMissing({ missing: missing2, actions, cwd: deps2.cwd, consumers, am: online ? am : null });
+  };
+  const missing = missingFindings();
+  for (const finding of missing.findings) renderFinding(ctx, finding);
+  const canSync = online !== null && missing.findings.some((x) => x.action?.fix === "sync");
+  if (canSync && await offerFix(ctx, `Clone ${missing.fixable.map((m) => m.slug).join(", ")} now with qore sync?`, { default: true, signal: ctx.signal })) {
+    const actions = planWorkspace(ws.root, missing.fixable, dirs, []).actions;
+    const results = await applyActions(deps2, { portal: online.portal, app: am, actions, protocol: cloneProtocol(dirs), onResult: () => {
+    } });
+    renderResults(io2, results, false);
+    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join17(ws.root, r.slug));
+    ({ present, plan } = computePlan());
+  }
+  for (const name of await strayRepos(ws.root, new Set(am.modules.map((m) => m.slug)))) renderFinding(ctx, strayClone(name, am.app.name));
+  if (ctx.signal.aborted) throw new CancelledError();
+  for (const s of plan.skipped) {
+    const m = bySlug.get(s.slug);
+    if (s.reason === "no-write") {
+      const ask = askMaintainer(am, m);
+      note(
+        `- ${s.slug}  no write access \u2014 local secrets need write; ${ask.text}`,
+        { type: "skip", module: s.slug, reason: s.reason, devTeams: ask.teams, maintainers: ask.maintainers }
+      );
+    } else if (s.reason === "not-cloned") {
+      if (json2) io2.out(JSON.stringify({ type: "skip", module: s.slug, reason: s.reason }));
+    } else {
+      note(`- ${s.slug}  excluded`, { type: "skip", module: s.slug, reason: s.reason });
+    }
+  }
+  for (const c of plan.cycles) warn(`${c.join(", ")} depend on each other \u2014 they start together, without waiting`, { modules: c });
+  if (plan.start.length === 0) {
+    await fail(new QoreError("QORE_CONTEXT_REQUIRED", "No module of this workspace can be started", {
+      hint: "Clone the modules with qore sync, or change --only / --skip.",
+      details: { skipped: plan.skipped }
+    }));
+  }
+  const units = plan.start.map((slug) => ({ m: bySlug.get(slug), dir: present.get(slug) }));
+  if (online) {
+    const untrusted = [];
+    for (const u of units) if (!await isTrusted(deps2, u.dir, u.m.id)) untrusted.push(u);
+    if (untrusted.length > 0) {
+      const names = untrusted.map((u) => u.m.slug).join(", ");
+      if (!f.yes) {
+        if (!io2.interactive) {
+          await fail(new QoreError("QORE_CONTEXT_REQUIRED", `These repositories are not trusted yet: ${names}`, {
+            hint: "Run interactively once, or pass --yes.",
+            details: { reason: "untrusted", modules: untrusted.map((u) => u.m.slug) }
+          }));
+        }
+        if (!await io2.confirm(`Pull local secrets for ${names} into their repositories?`)) throw new CancelledError();
+      }
+      for (const u of untrusted) await trust(deps2, u.dir, u.m.id);
+    }
+  }
+  p.arm();
+  const prefix = prefixer(plan.start, color);
+  const onLine = (slug) => (l) => {
+    if (json2) io2.out(JSON.stringify({ type: "line", module: slug, stream: l.stream, line: l.line }));
+    else if (l.stream === "stdout") io2.out(prefix(slug, l.line));
+    else io2.err(prefix(slug, l.line));
+  };
+  const report = progressReporter(ctx, { prefix: json2 ? void 0 : prefix, installFlag: f.install, servicesFlag: f.services });
+  for (const u of units) {
+    await attempt(u.m.slug, async () => {
+      u.cfg = await readRepoConfig(u.dir);
+      u.pkg = await readPackageJson(u.dir);
+      u.recipe = planRecipe({
+        root: u.dir,
+        pkg: u.pkg,
+        pm: await detectPackageManager(u.dir, u.pkg),
+        cfg: u.cfg,
+        slug: u.m.slug,
+        flags: { install: f.install, services: f.services }
+      });
+    });
+  }
+  for (const u of units) {
+    u.trusted = !offlineCause || await isTrusted(deps2, u.dir, u.m.id);
+    if (!u.trusted) problems.push(withDetails(offlineCause, { module: u.m.slug }));
+  }
+  const withRecipe = units.filter((u) => u.recipe && u.trusted);
+  for (const name of [...new Set(withRecipe.map((u) => u.recipe.pm.name))]) {
+    const users = withRecipe.filter((u) => u.recipe.pm.name === name);
+    let version = null;
+    const pmOk = await attempt(users[0].m.slug, async () => {
+      version = await checkPackageManager(deps2, users[0].recipe, () => {
+      }, p.signal);
+    });
+    for (const u of users) {
+      u.pmOk = pmOk;
+      u.pmVersion = version;
+    }
+  }
+  for (const u of withRecipe) {
+    const nodeOk = await attempt(u.m.slug, async () => {
+      u.node = await checkNode(deps2, u.recipe, u.pkg, u.m.slug, p.signal);
+    });
+    u.pmOk = u.pmOk && nodeOk;
+    if (u.pmOk) report({
+      module: u.m.slug,
+      step: "pm",
+      status: "done",
+      detail: `${u.recipe.pm.name}${u.pmVersion ? ` ${u.pmVersion}` : ""}${u.node ? ` \xB7 node ${u.node}` : ""}`
+    });
+  }
+  await pool(units.filter((u) => u.pmOk && u.trusted), INSTALL_PARALLELISM, async (u) => {
+    u.installed = await attempt(u.m.slug, () => installIfNeeded(deps2, u.recipe, u.m.slug, onLine(u.m.slug), report, p.signal));
+  });
+  const runs = [await leftoverRun(deps2, ws.root)].filter((r) => r !== null);
+  const appRef = { id: am.app.id, slug: am.app.slug, name: am.app.name };
+  const mcFor = (u) => ({
+    portal: online.portal,
+    session: online.session,
+    source: { kind: "workspace" },
+    repoRoot: u.dir,
+    workspace: ws,
+    module: { id: u.m.id, slug: u.m.slug, name: u.m.name, type: u.m.type, access: u.m.access, tenant: am.app.tenant, apps: [appRef] }
+  });
+  const rootReal = await realpath4(ws.root);
+  const withDocker = dockerRecovery(ctx, p.signal);
+  for (const u of units.filter((x) => x.recipe && x.trusted)) {
+    const slug = u.m.slug;
+    await attempt(slug, async () => {
+      try {
+        u.dev = await devEnv(deps2, {
+          mc: online ? mcFor(u) : null,
+          app: online ? appRef : null,
+          root: u.dir,
+          type: u.m.type,
+          moduleId: u.m.id,
+          cfg: u.cfg,
+          random: () => randomBytes4(32).toString("hex")
+        });
+      } catch (e) {
+        if (offlineCause && isOffline(e)) throw offlineCause;
+        throw e;
+      }
+    });
+    const dev = u.dev;
+    if (!dev) continue;
+    if (online && dev.offline) {
+      warn(`${slug}: the portal is unreachable \u2014 starting from ${relative5(rootReal, dev.envFile)} as last written; values may be stale.`, { module: slug });
+    }
+    if (dev.kept.length) {
+      warn(
+        `${slug}: ${dev.kept.length} key(s) differ locally and were kept: ${dev.kept.join(", ")} \u2014 qore env pull --use-portal takes the portal's values`,
+        { module: slug, keys: dev.kept }
+      );
+    }
+    report({ module: slug, step: "env", status: "done", detail: relative5(rootReal, dev.envFile) });
+    const services = servicesMissing(slug, dev.env, u.recipe, { servicesFlag: f.services, configured: u.cfg.dev?.services !== void 0 });
+    if (services) renderFinding(ctx, services);
+    try {
+      const behind = repoBehind(slug, await deps2.git.status(u.dir), { workspace: true });
+      if (behind) renderFinding(ctx, behind);
+    } catch {
+    }
+    if (u.installed) {
+      const env = { ...deps2.env, ...dev.env };
+      await attempt(slug, () => withDocker({ cwd: u.dir, env }, () => startServices(deps2, u.recipe, slug, env, dev.dbPort, waitTimeout * 1e3, p.signal, onLine(slug), report)));
+    }
+    if (await attempt(slug, () => checkPortOrStopLeftover(ctx, { slug, port: dev.port, key: "PORT", runs }, p.signal)) && dev.port !== null) {
+      report({ module: slug, step: "ports", status: "done", detail: String(dev.port) });
+    }
+  }
+  if (p.signal.aborted) throw new CancelledError();
+  const byPort = /* @__PURE__ */ new Map();
+  for (const u of units) if (u.dev?.port != null) byPort.set(u.dev.port, [...byPort.get(u.dev.port) ?? [], u.m.slug]);
+  for (const [port, slugs] of byPort) {
+    if (slugs.length < 2) continue;
+    problems.push(new QoreError("QORE_PORT_IN_USE", `${slugs.slice(0, -1).join(", ")} and ${slugs.at(-1)} both have port ${port}`, {
+      hint: "Ports are unique per organisation; a module from another organisation can share one. Run one of them (--only / --skip).",
+      details: { port, module: slugs[0], modules: slugs }
+    }));
+  }
+  if (problems.length > 0) await fail();
+  const listening = new Set(units.map((u) => u.dev.port).filter((p2) => p2 !== null));
+  for (const [consumer, providers] of Object.entries(plan.missingProviders)) {
+    const env = units.find((u) => u.m.slug === consumer).dev.env;
+    const aliases = providers.length === 1 ? deadAliases(env, listening) : [];
+    for (const provider of providers) {
+      const what = aliases.length ? `${aliases.join(", ")} ${aliases.length === 1 ? "points" : "point"}` : "its CONN_*_URL points";
+      warn(
+        `${consumer}: ${provider} will not run \u2014 ${what} at a port nothing listens on. Qore does not fall back to staging.`,
+        { module: consumer, provider, aliases }
+      );
+    }
+  }
+  if (online && units.every((u) => !u.dev.offline)) {
+    const envFile = (m) => {
+      const u = units.find((x) => x.m.id === m.id);
+      return u ? relative5(rootReal, u.dev.envFile) : join17(m.slug, moduleDefaults(m.type).envFile);
+    };
+    await saveLastStart(deps2, ws.root, {
+      schemaVersion: 1,
+      kind: "workspace",
+      portal: online.portal.apiOrigin,
+      savedAt: deps2.now().toISOString(),
+      app: { ...appRef, tenant: { id: am.app.tenant.id, slug: am.app.tenant.slug, name: am.app.tenant.name } },
+      modules: safe.map((m) => ({
+        id: m.id,
+        slug: m.slug,
+        name: m.name,
+        type: m.type,
+        access: m.access,
+        repoUrl: m.repoUrl,
+        dependsOn: m.dependsOn,
+        envFile: envFile(m)
+      }))
+    });
+  }
+  if (p.signal.aborted) throw new CancelledError();
+  const { reasons } = missingFindings();
+  const notRunning = plan.skipped.filter((s) => s.reason !== "excluded").map((s) => {
+    const m = bySlug.get(s.slug);
+    return { slug: s.slug, reason: s.reason === "no-write" ? `no write access \u2014 ${askMaintainer(am, m).text}` : `not cloned \u2014 ${reasons[s.slug] ?? "Fix: qore sync"}` };
+  });
+  return { units, waitFor: plan.waitFor, notRunning, o: { waitTimeout, killOthers: Boolean(f.killOthers), json: json2, color, prefix } };
+}
+async function superviseAll(ctx, ws, units, waitFor, o, notRunning) {
+  const { deps: deps2, io: io2 } = ctx;
+  const startedAt = deps2.now().toISOString();
+  const began = /* @__PURE__ */ new Map();
+  const ref = {};
+  let stopping = false;
+  let runWrite = Promise.resolve();
+  const writeRun = () => {
+    runWrite = runWrite.then(() => writeRunFile(deps2, ws.root, {
+      schemaVersion: 1,
+      qorePid: deps2.pid,
+      root: ws.root,
+      startedAt,
+      children: ref.sup?.children() ?? []
+    })).catch(() => {
+    });
+  };
+  const render = (e) => {
+    switch (e.type) {
+      case "line":
+        return e.stream === "stdout" ? io2.out(o.prefix(e.module, e.line)) : io2.err(o.prefix(e.module, e.line));
+      case "start":
+        return io2.err(`\u25B6 starting ${e.module}${e.pid === null ? "" : ` (pid ${e.pid})`}`);
+      case "ready":
+        return io2.err(`\u2713 ${e.module} ready`);
+      case "provider-missing":
+        return io2.err(`! ${e.provider} did not come up within ${o.waitTimeout} s (or exited); starting ${e.module} anyway \u2014 see its output above`);
+      case "stopping":
+        return io2.err("\u25A0 stopping");
+      case "exit": {
+        if (stopping) return io2.err(`\u25A0 ${e.module} stopped`);
+        if (e.code === null && e.signal === null) return io2.err(`\u2717 ${e.module} could not be started`);
+        const after = e.early ? ` after ${Math.round((deps2.now().getTime() - (began.get(e.module) ?? deps2.now().getTime())) / 1e3)} s` : "";
+        const how = e.signal ? `was ended by ${e.signal}` : `exited with code ${e.code}`;
+        io2.err(`${e.code === 0 ? "\u25A0" : "\u2717"} ${e.module} ${how}${after}`);
+        if (e.hint) io2.err(`  \u2192 ${e.hint.hint}`);
+        if (e.code !== 0 && !o.killOthers && (ref.sup?.children().length ?? 0) > 0) {
+          io2.err(`  Restart it on its own: qore dev --only ${e.module}   (in another terminal; the others keep running)`);
+        }
+        return;
+      }
+    }
+  };
+  const withPort = new Set(units.filter((u) => u.dev.port !== null).map((u) => u.m.slug));
+  const readyPorts = /* @__PURE__ */ new Map();
+  let summarized = false;
+  const summarize = () => {
+    if (summarized || o.json || readyPorts.size < withPort.size) return;
+    summarized = true;
+    const width = Math.max(0, ...[...readyPorts.keys(), ...notRunning.map((n) => n.slug)].map((s2) => s2.length));
+    io2.err(notRunning.length === 0 ? "\u2714 All modules running:" : "\u2714 Running:");
+    for (const slug of [...readyPorts.keys()].sort()) io2.err(`  ${slug.padEnd(width)}   http://localhost:${readyPorts.get(slug)}`);
+    if (notRunning.length > 0) {
+      io2.err("! Not running:");
+      for (const n of notRunning) io2.err(`  ${n.slug.padEnd(width)}   ${n.reason}`);
+    }
+  };
+  const crashed = /* @__PURE__ */ new Map();
+  const onEvent = (e) => {
+    if (e.type === "start") {
+      began.set(e.module, deps2.now().getTime());
+      writeRun();
+    }
+    if (e.type === "stopping") stopping = true;
+    if (e.type === "ready") readyPorts.set(e.module, e.port);
+    if (e.type === "exit" && !stopping && (e.code !== 0 || e.signal !== null)) {
+      crashed.set(e.module, { code: e.code, signal: e.signal, ms: deps2.now().getTime() - (began.get(e.module) ?? deps2.now().getTime()) });
+    }
+    if (o.json) io2.out(JSON.stringify(e));
+    else render(e);
+    if (e.type === "ready") summarize();
+  };
+  const s = ref.sup = supervise({
+    modules: units.map((u) => {
+      const { cmd, args } = runArgs(u.recipe.pm, u.recipe.script);
+      return {
+        slug: u.m.slug,
+        cmd,
+        args,
+        cwd: u.dir,
+        port: u.dev.port,
+        waitFor: waitFor[u.m.slug] ?? [],
+        hint: hintContext(u.recipe, u.pkg, u.dev.env),
+        env: { ...deps2.env, ...u.dev.env, ...o.color ? { FORCE_COLOR: "1" } : {} }
+      };
+    }),
+    launcher: deps2.launch,
+    ports: deps2.ports,
+    waitMs: o.waitTimeout * 1e3,
+    killOthers: o.killOthers,
+    onEvent
+  });
+  const onTerm = () => s.stop("SIGTERM");
+  const onHup = () => s.stop("SIGHUP");
+  const onAbort = () => s.stop("interrupt");
+  deps2.signals.on("SIGTERM", onTerm);
+  deps2.signals.on("SIGHUP", onHup);
+  ctx.signal.addEventListener("abort", onAbort);
+  childRunning.current = true;
+  childRunning.onInterrupt = () => s.escalate();
+  try {
+    if (ctx.signal.aborted) onAbort();
+    writeRun();
+    ctx.setExitCode(await s.done);
+    if (!o.json && crashed.size > 0) {
+      const stopped = units.map((u) => u.m.slug).filter((s2) => !crashed.has(s2)).sort();
+      const what = [...crashed].map(([s2, c]) => `${s2} (${c.code === null && c.signal === null ? "could not be started" : `${c.signal ?? `code ${c.code}`}, after ${humanAge(Math.round(c.ms / 1e3))}`})`).join(", ");
+      io2.err(`${stopped.length ? `\u25A0 stopped: ${stopped.join(", ")}   ` : ""}\u2717 crashed: ${what}`);
+    }
+  } finally {
+    deps2.signals.off("SIGTERM", onTerm);
+    deps2.signals.off("SIGHUP", onHup);
+    ctx.signal.removeEventListener("abort", onAbort);
+    childRunning.current = false;
+    childRunning.onInterrupt = void 0;
+    await runWrite;
+    await removeRunFile(deps2, ws.root);
+  }
+}
+
+// src/cli/commands/dev.ts
+var EARLY_EXIT_MS = 1e4;
+function makeStderrTee(sink) {
+  const decoder = new StringDecoder("utf8");
+  let buf = "";
+  let forwarding = true;
+  const tail = [];
+  const record = (line2) => {
+    tail.push(line2);
+    if (tail.length > KEEP_LINES) tail.shift();
+  };
+  const onError = () => {
+    forwarding = false;
+  };
+  sink.on("error", onError);
+  return {
+    push: (chunk) => {
+      if (forwarding) {
+        try {
+          sink.write(chunk);
+        } catch {
+          forwarding = false;
+        }
+      }
+      buf += decoder.write(chunk);
+      let i;
+      while ((i = buf.indexOf("\n")) >= 0) {
+        record(buf.slice(0, i).replace(/\r$/, ""));
+        buf = buf.slice(i + 1);
+      }
+    },
+    lines: () => {
+      const rest = (buf + decoder.end()).replace(/\r$/, "");
+      return rest ? [...tail, rest].slice(-KEEP_LINES) : tail.slice();
+    },
+    dispose: () => {
+      sink.removeListener("error", onError);
+    }
+  };
+}
+function registerDev(program, ctx) {
+  program.command("dev").description("Start this module's dev server \u2014 or, in a workspace root, every module of the app").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--only <slugs>", "workspace: start only these modules (comma-separated)").option("--skip <slugs>", "workspace: start all but these modules (comma-separated)").option("--no-install", "do not run the package manager's install").option("--no-services", "do not start local services (db:up)").option("--kill-others", "workspace: the first module to exit stops the rest").option("--wait-timeout <s>", "workspace: seconds to wait for a provider's port", "60").option("--yes", "trust the repositories without asking").action(async (f) => {
+    const waitTimeout = parseWaitTimeout(f.waitTimeout);
+    const ws = await workspaceRoot(ctx.deps);
+    if (ws && f.module === void 0) return workspaceDev(ctx, ws, f, waitTimeout);
+    return moduleDev(ctx, f, waitTimeout);
+  });
+}
+function parseWaitTimeout(raw) {
+  const n = /^\d+$/.test(raw.trim()) ? Number(raw.trim()) : NaN;
+  if (!Number.isInteger(n) || n < 1 || n > 600) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `--wait-timeout must be a whole number of seconds from 1 to 600, not "${raw}"`, {
+      hint: "Pass e.g. --wait-timeout 60."
+    });
+  }
+  return n;
+}
+var str2 = (v) => typeof v === "string" && v.length > 0;
+var SHELL_SAFE = /^[A-Za-z0-9_./,:@%+=-]*$/;
+var shellQuote = (s) => SHELL_SAFE.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
+function cdAndDev(home, dir2) {
+  if (/^[A-Za-z]:[\\/]|^\\\\/.test(dir2)) return `cd ${/\s/.test(dir2) ? `"${dir2}"` : dir2} && qore dev`;
+  const h = home.length > 1 ? home.replace(/\/+$/, "") : home;
+  let target = shellQuote(dir2);
+  if (h && dir2 === h) target = "~";
+  else if (h && dir2.startsWith(h + "/")) target = `~/${shellQuote(dir2.slice(h.length + 1))}`;
+  return `cd ${target} && qore dev`;
+}
+async function providerFindings(ctx, root, mc, app, env) {
+  const { deps: deps2 } = ctx;
+  try {
+    if (!(await metaFor(deps2, mc.portal.apiOrigin)).capabilities.includes("app.modules")) return null;
+    const am = await mc.session.api.get(`/api/cli/v1/apps/${encodeURIComponent(app.id)}/modules`);
+    const self = am.modules.find((m) => m.id === mc.module.id);
+    const providers = am.modules.filter((m) => self?.dependsOn.includes(m.id));
+    if (providers.length === 0) return null;
+    const conns = connPorts(env);
+    const listening = /* @__PURE__ */ new Set();
+    for (const c of conns) if (await deps2.ports.inUse(c.port)) listening.add(c.port);
+    const keys = deadAliases(env, listening);
+    if (keys.length === 0) return null;
+    const ws = await findWorkspace(root, deps2.home);
+    let fix = `qore clone ${app.slug}`;
+    if (ws && ws.appId === app.id) fix = cdAndDev(deps2.home, ws.root);
+    else if (providers.length === 1) {
+      const sibling = join18(dirname6(root), providers[0].slug);
+      if ((await deps2.git.inspect(sibling)).isRepo) fix = cdAndDev(deps2.home, sibling);
+    }
+    return providerDown({
+      slug: mc.module.slug,
+      providers: providers.map((p) => p.slug),
+      keys,
+      ports: new Map(conns.map((c) => [c.key, c.port])),
+      fix
+    });
+  } catch (e) {
+    if (e instanceof QoreError) return null;
+    throw e;
+  }
+}
+function usableLast2(last) {
+  if (!last || last.kind !== "module") return false;
+  const m = last.module;
+  return str2(last.savedAt) && !!m && str2(m.id) && str2(m.slug) && str2(m.type) && !!m.tenant && str2(m.tenant.name) && !!last.app && str2(last.app.id) && str2(last.app.slug) && str2(last.app.name);
+}
+async function devContext(ctx, f, root) {
+  let mc;
+  try {
+    mc = await moduleContextFor(ctx, f, "dev");
+  } catch (e) {
+    if (!isOffline(e) || f.module) throw e;
+    const last = await loadLastStart(ctx.deps, root);
+    if (!usableLast2(last)) throw e;
+    if (f.app && f.app !== last.app.id && f.app !== last.app.slug) throw e;
+    if (!await isTrusted(ctx.deps, root, last.module.id)) throw e;
+    ctx.io.err(`\u2192 ${last.module.tenant.name} / ${last.app.name} / ${last.module.slug}  (offline \u2014 last started ${last.savedAt})`);
+    return { online: null, module: last.module, offlineCause: e };
+  }
+  const app = await appFor(ctx, mc, f.app);
+  await ensureTrusted(ctx, mc, app, { yes: f.yes });
+  return { online: { mc, app }, module: mc.module, offlineCause: null };
+}
+async function moduleDev(ctx, f, waitTimeout) {
+  const { deps: deps2, io: io2 } = ctx;
+  const { root, slug, recipe, env, port, pkg, devEnv: devEnv2 } = await inPreflight(deps2.signals, ctx.signal, (p) => prepareModule(ctx, f, waitTimeout, p));
+  const { cmd, args } = runArgs(recipe.pm, recipe.script);
+  io2.err(`\u25B6 starting ${slug}${port === null ? "" : ` \u2014 http://localhost:${port}`}`);
+  const startedAt = deps2.now();
+  await writeRunFile(deps2, root, {
+    schemaVersion: 1,
+    qorePid: deps2.pid,
+    root,
+    startedAt: startedAt.toISOString(),
+    children: [{ module: slug, pid: null, port }]
+  });
+  childRunning.current = true;
+  const tee = makeStderrTee(io2.stderrRaw);
+  const spawnEnv = ctx.opts().color !== false && io2.stderrTTY && env.FORCE_COLOR === void 0 && env.NO_COLOR === void 0 ? { ...env, FORCE_COLOR: "1" } : env;
+  let exit;
+  try {
+    exit = await deps2.spawn.run(cmd, args, spawnEnv, { cwd: root, onStderr: tee.push });
+  } finally {
+    tee.dispose();
+    childRunning.current = false;
+    await removeRunFile(deps2, root);
+  }
+  const ms = deps2.now().getTime() - startedAt.getTime();
+  if (exit.code !== 0 && exit.signal === null) {
+    io2.err(ms < EARLY_EXIT_MS ? `\u2717 ${slug} exited after ${Math.round(ms / 1e3)} s with code ${exit.code ?? 1} \u2014 its output above says why.` : `\u2717 ${slug} exited with code ${exit.code ?? 1}.`);
+    const hint = exitHint(tee.lines(), hintContext(recipe, pkg, devEnv2));
+    if (hint) io2.err(`  \u2192 ${hint.hint}`);
+  }
+  if (exit.signal) {
+    deps2.raise(exit.signal);
+    ctx.setExitCode(128 + (constants3.signals[exit.signal] ?? 0));
+    return;
+  }
+  ctx.setExitCode(exit.code ?? 1);
+}
+async function prepareModule(ctx, f, waitTimeout, p) {
+  const { deps: deps2, io: io2 } = ctx;
+  if (ctx.opts().json) {
+    throw new QoreError("QORE_CONTEXT_INVALID", "dev in a module repository has no --json; the dev server's output passes through", {
+      hint: "Drop --json."
+    });
+  }
+  for (const [flag, set] of [["--only", f.only !== void 0], ["--skip", f.skip !== void 0], ["--kill-others", Boolean(f.killOthers)]]) {
+    if (set) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `${flag} is for a workspace root`, {
+        hint: `Drop ${flag}, or run qore dev in the workspace root (where qore.workspace.json is).`
+      });
+    }
+  }
+  const root = await findRepoRoot(deps2.cwd);
+  if (!root) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", "Not inside a module repository", {
+      hint: "cd into a module repository, or run qore dev in a workspace root."
+    });
+  }
+  const c = await devContext(ctx, f, root);
+  p.arm();
+  const slug = c.module.slug;
+  const cfg = await readRepoConfig(root);
+  const pkg = await readPackageJson(root);
+  const recipe = planRecipe({
+    root,
+    pkg,
+    pm: await detectPackageManager(root, pkg),
+    cfg,
+    slug,
+    flags: { install: f.install, services: f.services }
+  });
+  const runs = [await leftoverRun(deps2, root)].filter((r) => r !== null);
+  const onLine = (l) => l.stream === "stdout" ? io2.out(l.line) : io2.err(l.line);
+  const report = progressReporter(ctx, { installFlag: f.install, servicesFlag: f.services });
+  const pmVersion = await checkPackageManager(deps2, recipe, () => {
+  }, p.signal);
+  const nodeVersion = await checkNode(deps2, recipe, pkg, slug, p.signal);
+  report({
+    module: slug,
+    step: "pm",
+    status: "done",
+    detail: `${recipe.pm.name}${pmVersion ? ` ${pmVersion}` : ""}${nodeVersion ? ` \xB7 node ${nodeVersion}` : ""}`
+  });
+  await installIfNeeded(deps2, recipe, slug, onLine, report, p.signal);
+  let dev;
+  try {
+    dev = await devEnv(deps2, {
+      mc: c.online?.mc ?? null,
+      app: c.online?.app ?? null,
+      root,
+      type: c.module.type,
+      moduleId: c.module.id,
+      cfg,
+      random: () => randomBytes5(32).toString("hex")
+    });
+  } catch (e) {
+    if (c.offlineCause && isOffline(e)) throw c.offlineCause;
+    throw e;
+  }
+  const envFile = relative6(await realpath5(root), dev.envFile);
+  if (dev.offline) io2.err(`! The portal is unreachable \u2014 starting from ${envFile} as last written; values may be stale.`);
+  if (dev.kept.length) {
+    io2.err(`! ${dev.kept.length} key(s) differ locally and were kept: ${dev.kept.join(", ")} \u2014 qore env pull --use-portal takes the portal's values`);
+  }
+  report({ module: slug, step: "env", status: "done", detail: dev.offline ? `${envFile}  (as last written \u2014 offline)` : envFile });
+  const env = { ...deps2.env, ...dev.env };
+  await dockerRecovery(ctx, p.signal)({ cwd: root, env }, () => startServices(deps2, recipe, slug, env, dev.dbPort, waitTimeout * 1e3, p.signal, onLine, report));
+  await checkPortOrStopLeftover(ctx, { slug, port: dev.port, key: "PORT", runs }, p.signal);
+  if (dev.port !== null) report({ module: slug, step: "ports", status: "done", detail: String(dev.port) });
+  if (c.online && !dev.offline) {
+    const provider = await providerFindings(ctx, root, c.online.mc, c.online.app, dev.env);
+    if (provider) renderFinding(ctx, provider);
+  }
+  const services = servicesMissing(slug, dev.env, recipe, { servicesFlag: f.services, configured: cfg.dev?.services !== void 0 });
+  if (services) renderFinding(ctx, services);
+  try {
+    const behind = repoBehind(slug, await deps2.git.status(root), { workspace: false });
+    if (behind) renderFinding(ctx, behind);
+  } catch {
+  }
+  if (c.online && !dev.offline) {
+    const { mc, app } = c.online;
+    const { id, name, type, access: access2, tenant, apps } = mc.module;
+    await saveLastStart(deps2, root, {
+      schemaVersion: 1,
+      kind: "module",
+      portal: mc.portal.apiOrigin,
+      savedAt: deps2.now().toISOString(),
+      module: {
+        id,
+        slug,
+        name,
+        type,
+        access: access2,
+        tenant: { id: tenant.id, slug: tenant.slug, name: tenant.name },
+        apps: apps.map((a) => ({ id: a.id, slug: a.slug, name: a.name }))
+      },
+      app: { id: app.id, slug: app.slug, name: app.name },
+      envFile
+    });
+  }
+  if (p.signal.aborted) throw new CancelledError();
+  return { root, slug, recipe, env, port: dev.port, pkg, devEnv: dev.env };
+}
+
+// src/cli/commands/doctor.ts
+import pc3 from "picocolors";
+
+// src/core/doctor/checks.ts
+import { realpath as realpath6 } from "fs/promises";
+import { basename as basename3, join as join19 } from "path";
+
+// src/core/diagnostics/ssh.ts
+var SSH_TEST_ARGS = ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "git@github.com"];
+var COMMAND = "ssh -T git@github.com";
+function classifySshTest(r) {
+  const text2 = r.tail.join("\n");
+  const hi = /Hi ([^!\s]+)! You've successfully authenticated/.exec(text2);
+  if (hi) return { ok: true, user: hi[1] };
+  const details = { protocol: "ssh" };
+  if (r.spawnError) {
+    return { ok: false, error: new QoreError("QORE_GIT_AUTH", "ssh is not installed or not on PATH", {
+      hint: "Clone over https instead (the default for qore clone and qore sync).",
+      details: { ...details, reason: "ssh-missing" }
+    }) };
+  }
+  if (/Permission denied \(publickey\)/.test(text2)) {
+    return { ok: false, error: new QoreError("QORE_GIT_AUTH", "GitHub refused your SSH key", {
+      hint: "Add your key to GitHub (https://github.com/settings/keys) and your ssh agent, or keep cloning over https.",
+      details
+    }) };
   }
-  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
-  await trust(ctx.deps, root, mc.module.id);
+  if (/Host key verification failed/.test(text2)) {
+    return { ok: false, error: new QoreError("QORE_GIT_AUTH", "ssh could not verify github.com's host key", {
+      hint: `Run \`${COMMAND}\` once to accept its host key (or to see why it changed).`,
+      details: { ...details, reason: "host-key" }
+    }) };
+  }
+  const last = r.tail.map((l) => l.trim()).filter(Boolean).slice(-3);
+  return { ok: false, error: new QoreError("QORE_GIT_AUTH", "GitHub SSH did not answer as expected", {
+    hint: [...last, `\`${COMMAND}\``].join("\n"),
+    details: { ...details, stderr: r.tail }
+  }) };
 }
 
-// src/cli/commands/env.ts
-var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
-async function readOrNull(p) {
+// src/core/doctor/checks.ts
+var NODE_RANGE = ">=22";
+var SKEW_S = 60;
+var TOOL_TIMEOUT_MS = 1e4;
+var IDLE_DAYS = 30;
+var DAY_MS = 864e5;
+var UPGRADE = "npm i -g @quatronic/qore";
+var RANK = { ok: 0, warn: 1, fail: 2 };
+var noop = () => {
+};
+var ok = (label2, details) => ({ status: "ok", label: label2, ...details ? { details } : {} });
+var withError = (status2, label2, e) => ({ status: status2, label: label2, error: toJsonError(e) });
+var isCancel = (e, signal) => e instanceof CancelledError || signal.aborted;
+var portalLabel = (p) => p.builtin ?? p.apiOrigin;
+var ToolTimeout = class extends Error {
+  constructor(tool, ms) {
+    super(`${tool} did not answer within ${Math.round(ms / 1e3)} s`);
+    this.tool = tool;
+    this.ms = ms;
+  }
+  tool;
+  ms;
+};
+async function timed(tool, signal, ms, fn) {
   try {
-    return await readFile4(p, "utf8");
+    return await fn(AbortSignal.any([signal, AbortSignal.timeout(ms)]));
   } catch (e) {
-    if (e.code === "ENOENT") return null;
+    if (e instanceof CancelledError && !signal.aborted) throw new ToolTimeout(tool, ms);
     throw e;
   }
 }
-async function writeSecurely(target, text) {
-  const base = basename2(target);
-  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes3(6).toString("hex")}.local` : `${base}.qore-${randomBytes3(6).toString("hex")}.tmp`;
-  const tmp = join10(dirname4(target), tmpName);
+function errorLabel(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function checkQore(deps2, meta) {
+  const v = deps2.version;
+  if (!meta.ok) return withError("warn", `qore ${v} \u2014 could not check for updates`, meta.error);
+  const { minCliVersion: min, latestCliVersion: latest } = meta.meta;
+  if (!v.endsWith("-dev") && compareVersions(v, min) < 0) {
+    const e = new QoreError("QORE_UPGRADE_REQUIRED", `qore ${v} is too old for this portal (needs ${min})`, { hint: `Run: ${UPGRADE}` });
+    return withError("fail", `qore ${v} is too old for this portal (needs ${min}) \u2014 ${UPGRADE}`, e);
+  }
+  if (!v.endsWith("-dev") && compareVersions(v, latest) < 0) {
+    return { status: "warn", label: `qore ${v} \u2014 ${latest} is available (${UPGRADE})`, details: { latest } };
+  }
+  return ok(`qore ${v} (latest)`);
+}
+function checkOwnNode(deps2) {
+  const v = deps2.nodeVersion;
+  if (nodeSatisfies(v, NODE_RANGE) === false) {
+    const e = new QoreError("QORE_NODE_VERSION", `qore needs Node ${NODE_RANGE}, found ${v}`, {
+      hint: "nvm install 22 / fnm use 22, then reinstall qore.",
+      details: { found: v, required: NODE_RANGE }
+    });
+    return withError("fail", e.message, e);
+  }
+  return ok(`Node ${v} (\u226522 required)`);
+}
+async function checkGit(deps2, signal, ms) {
+  const res = await timed("git", signal, ms, (s) => runTool(deps2, "git", ["--version"], { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
+  if (res.spawnError === "ENOENT") {
+    const e = new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
+      hint: "Install git (https://git-scm.com/downloads) and open a new terminal."
+    });
+    return withError("fail", e.message, e);
+  }
+  if (res.code !== 0) {
+    const e = new QoreError("QORE_GIT_UNAVAILABLE", "git --version failed", { details: { stderr: res.tail } });
+    return withError("fail", e.message, e);
+  }
+  const m = /git version (\d+)\.(\d+)/.exec(res.tail.join("\n"));
+  return ok(m ? `git ${m[1]}.${m[2]}` : "git");
+}
+async function checkGithubSsh(deps2, signal, ms) {
+  const res = await timed("ssh", signal, ms, (s) => runTool(deps2, "ssh", SSH_TEST_ARGS, { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
+  const r = classifySshTest(res);
+  if (r.ok) return ok(`GitHub SSH ok (${r.user})`, { user: r.user });
+  return withError("warn", `GitHub SSH: ${r.error.message} (https still works)`, r.error);
+}
+async function checkDocker(deps2, signal, ms) {
+  return timed("docker", signal, ms, async (s) => {
+    const o = { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s };
+    const info = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], o);
+    const infoErr = classifyDockerInfo(info, deps2.platform);
+    if (infoErr) return withError("warn", `${infoErr.message} (only needed for db:up)`, infoErr);
+    const compose = await runTool(deps2, "docker", ["compose", "version"], o);
+    return dockerBody(info.tail, compose);
+  });
+}
+function dockerBody(infoTail, compose) {
+  const composeErr = classifyComposeVersion(compose);
+  if (composeErr) return withError("fail", composeErr.message, composeErr);
+  const version = infoTail.map((l) => l.trim()).findLast(Boolean) ?? "";
+  const major = /v?(\d+)\.\d+/.exec(compose.tail.join("\n"))?.[1];
+  return ok(`Docker ${version} running \xB7 compose ${major ? `v${major}` : "ok"}`);
+}
+function jwtExp(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
   try {
-    await writeFile3(tmp, text, { mode: 384, flag: "wx" });
-    await chmod2(tmp, 384);
-    await rename3(tmp, target);
-  } finally {
-    await unlink(tmp).catch(() => {
+    const exp = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).exp;
+    return typeof exp === "number" && exp > 0 ? exp : null;
+  } catch {
+    return null;
+  }
+}
+function validDays(rt, now) {
+  const exp = jwtExp(rt.rt);
+  const end = exp !== null ? exp * 1e3 : Date.parse(rt.obtainedAt) + IDLE_DAYS * DAY_MS;
+  if (Number.isNaN(end)) return null;
+  return Math.max(0, Math.floor((end - now.getTime()) / DAY_MS));
+}
+async function checkSession(deps2, portal, onRequest, sessions, selected, signal) {
+  try {
+    const session = await openSession(deps2, portal, "doctor", onRequest);
+    const me = await session.api.get("/api/cli/v1/me");
+    sessions.set(portal.apiOrigin, session);
+    const rt = await session.tokens.getRefresh();
+    const days = rt ? validDays(rt, deps2.now()) : null;
+    const valid = days === null ? "" : ` \xB7 session valid ${days} ${days === 1 ? "day" : "days"}`;
+    return ok(`Logged in to ${portalLabel(portal)} as ${me.email}${valid}`, { email: me.email, ...days !== null ? { validDays: days } : {} });
+  } catch (e) {
+    if (isCancel(e, signal) || selected) throw e;
+    return withError("warn", `${portalLabel(portal)}: ${errorLabel(e)}`, e);
+  }
+}
+function checkClock(meta) {
+  if (!meta.ok) return withError("warn", "Clock \u2014 could not check (the portal did not answer)", meta.error);
+  if (!meta.date) return { status: "warn", label: "Clock \u2014 could not check (no Date header)" };
+  const skew = Math.round((meta.date.getTime() - meta.fetchedAt.getTime()) / 1e3);
+  if (Math.abs(skew) > SKEW_S) {
+    const minutes = Math.max(1, Math.round(Math.abs(skew) / 60));
+    const e = new QoreError("QORE_CLOCK_SKEW", `Your clock is off by ${minutes} min`, {
+      hint: "Turn on automatic date and time.",
+      details: { skewSeconds: skew }
+    });
+    return withError("fail", e.message, e);
+  }
+  return ok("Clock in sync", { skewSeconds: skew });
+}
+function ownerText(e) {
+  const d = e.details ?? {};
+  if (d.owner === "process") return ` by ${String(d.command)} (pid ${String(d.pid)})`;
+  if (d.owner === "docker") return ` by the Docker container ${String(d.name)}`;
+  if (d.owner === "qore") return ` by a previous qore dev (pid ${String(d.pid)})`;
+  return "";
+}
+var sameDir = async (a, b) => await realpath6(a).catch(() => a) === await realpath6(b).catch(() => b);
+async function moduleBody(deps2, m, runs, signal) {
+  const parts = [];
+  const part = async (fn) => {
+    try {
+      parts.push(await fn());
+    } catch (e) {
+      if (isCancel(e, signal)) throw e;
+      parts.push({ status: "fail", label: errorLabel(e), error: e });
+    }
+  };
+  const cfg = await readRepoConfig(m.root);
+  let env = null;
+  await part(async () => {
+    const target = await resolveTarget(m.root, cfg.envFile ?? moduleDefaults(m.type).envFile);
+    const text2 = await readOrNull(target);
+    if (text2 === null) return { status: "warn", label: "port unknown (run qore env pull)" };
+    env = Object.fromEntries(parseEnv(text2));
+    const port = envPort(env, "PORT");
+    if (port === null) return { status: "warn", label: `port unknown (no PORT in ${basename3(target)})` };
+    if (!await deps2.ports.inUse(port)) return { status: "ok", label: `port ${port} free` };
+    const e = await portInUseError(deps2, { slug: m.slug, port, key: "PORT", runs: await runs() });
+    return { status: "fail", label: `port ${port} in use${ownerText(e)}`, error: e };
+  });
+  await part(() => m.access === "write" || m.access === "maintain" ? { status: "ok", label: "write" } : { status: "warn", label: m.access === "read" ? "read only \u2014 qore dev needs write" : `${m.access} access \u2014 qore dev needs write` });
+  let recipe;
+  let pkg;
+  await part(async () => {
+    pkg = await readPackageJson(m.root);
+    recipe = planRecipe({
+      root: m.root,
+      pkg,
+      pm: await detectPackageManager(m.root, pkg),
+      cfg,
+      slug: m.slug,
+      flags: { install: true, services: true }
+    });
+    if (recipe.services.length === 0) return { status: "ok", label: "db none" };
+    const dbPort = env ? envPort(env, "DB_PORT") : null;
+    if (dbPort === null) return { status: "warn", label: "db port unknown (run qore env pull)" };
+    if (!await deps2.ports.inUse(dbPort)) return { status: "ok", label: `db:up (DB_PORT ${dbPort} free)` };
+    const pub = await deps2.ports.dockerPublisher(dbPort);
+    if (pub?.workingDir && await sameDir(pub.workingDir, m.root)) return { status: "ok", label: "db running" };
+    const e = await portInUseError(deps2, { slug: m.slug, port: dbPort, key: "DB_PORT" });
+    return { status: "fail", label: `DB_PORT ${dbPort} in use${ownerText(e)}`, error: e };
+  });
+  const status2 = parts.reduce((w, p) => RANK[p.status] > RANK[w] ? p.status : w, "ok");
+  const shown = parts.filter((p) => p.status !== "ok");
+  const first = parts.find((p) => p.status === "fail" && p.error) ?? parts.find((p) => p.error);
+  return {
+    recipe,
+    pkg,
+    body: {
+      status: status2,
+      label: (shown.length ? shown : parts).map((p) => p.label).join(" \xB7 "),
+      ...first ? { error: toJsonError(first.error) } : {},
+      details: { parts: parts.map((p) => ({ status: p.status, label: p.label, ...p.error ? { error: toJsonError(p.error) } : {} })) }
+    }
+  };
+}
+function runsAt(deps2, root) {
+  let p;
+  return () => p ??= leftoverRun(deps2, root, { prune: false }).then((r) => r ? [r] : []);
+}
+var UNTRUSTED = { status: "warn", label: "not checked (repository not trusted)" };
+async function checkRepoPm(deps2, m, recipe, signal, ms) {
+  if (!await isTrusted(deps2, m.root, m.id)) return UNTRUSTED;
+  const found = await timed(recipe.pm.name, signal, ms, (s) => checkPackageManager(deps2, recipe, noop, s));
+  const { name, version } = recipe.pm;
+  if (found === null) return ok(`${name} (version unknown)`);
+  return ok(version ? `${name} ${found} (matches)` : `${name} ${found}`, { found, ...version ? { pinned: version } : {} });
+}
+async function checkRepoNode(deps2, m, recipe, pkg, signal, ms) {
+  if (!await isTrusted(deps2, m.root, m.id)) return UNTRUSTED;
+  const found = await timed("node", signal, ms, (s) => checkNode(deps2, recipe, pkg, m.slug, s));
+  return ok(`Node ${found ?? "?"} (engines ${pkg.engines.node})`);
+}
+async function loggedInPortals(deps2, profiles) {
+  const rank = (o) => o === BUILTIN_PORTALS.prod.apiOrigin ? 0 : o === BUILTIN_PORTALS.staging.apiOrigin ? 1 : 2;
+  const out = [];
+  for (const origin of Object.keys(profiles).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b))) {
+    const p = profiles[origin];
+    if (await new TokenStore(deps2.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) out.push(resolvePortal(origin, void 0));
+  }
+  return out;
+}
+async function resolveRepoModule(deps2, session, portal, meta, root) {
+  if (meta.ok) requireCapability(meta.meta, "repo.resolve", portal.apiOrigin);
+  const keys = [...new Set((await deps2.git.remotes(root)).map((r) => repoKey(r.url)).filter((k) => k !== null))];
+  if (keys.length === 0) return { status: "warn", label: "this repository has no remote Qore can match" };
+  const { matches } = await session.api.post("/api/cli/v1/repos/resolve", { repoKeys: keys });
+  const ids = [...new Set(matches.map((x) => x.module.id))];
+  if (ids.length === 0) return { status: "warn", label: `this repository matches no module on ${portalLabel(portal)}` };
+  if (ids.length > 1) {
+    return { status: "warn", label: `this repository matches several modules (${[...new Set(matches.map((x) => x.module.slug))].join(", ")})` };
+  }
+  return session.api.get(`/api/cli/v1/modules/${encodeURIComponent(ids[0])}`);
+}
+async function runDoctor(deps2, o = {}) {
+  const signal = o.signal ?? new AbortController().signal;
+  const toolMs = o.toolTimeoutMs ?? TOOL_TIMEOUT_MS;
+  const results = [];
+  const context = { kind: "none" };
+  const push = async (id, group, fn, module) => {
+    let body;
+    try {
+      body = await fn();
+    } catch (e) {
+      if (e instanceof ToolTimeout) body = { status: "warn", label: e.message, details: { timeoutMs: e.ms } };
+      else if (isCancel(e, signal)) throw e;
+      else body = withError("fail", errorLabel(e), e);
+    }
+    const r = { id, group, ...module ? { module } : {}, ...body };
+    results.push(r);
+    return r;
+  };
+  let cfg;
+  try {
+    cfg = await deps2.config.read();
+  } catch (e) {
+    if (isCancel(e, signal)) throw e;
+    await push("config", "tools", () => withError("fail", errorLabel(e), e));
+    cfg = { schemaVersion: 1, profiles: {} };
+  }
+  let ws = null;
+  let wsError = null;
+  try {
+    ws = await findWorkspace(deps2.cwd, deps2.home);
+  } catch (e) {
+    wsError = e;
+  }
+  const portal = o.portal ? resolvePortal(o.portal, cfg.defaultProfile) : ws ? resolvePortal(ws.portal, void 0) : resolvePortal(void 0, cfg.defaultProfile);
+  let meta;
+  try {
+    meta = { ok: true, ...await fetchMetaWithDate(deps2.fetch, portal.apiOrigin), fetchedAt: deps2.now() };
+  } catch (e) {
+    if (isCancel(e, signal)) throw e;
+    meta = { ok: false, error: e };
+  }
+  await push("qore", "tools", () => checkQore(deps2, meta));
+  await push("node", "tools", () => checkOwnNode(deps2));
+  await push("git", "tools", () => checkGit(deps2, signal, toolMs));
+  await push("github-ssh", "tools", () => checkGithubSsh(deps2, signal, toolMs));
+  await push("docker", "tools", () => checkDocker(deps2, signal, toolMs));
+  const sessions = /* @__PURE__ */ new Map();
+  let loggedIn = [];
+  try {
+    loggedIn = await loggedInPortals(deps2, cfg.profiles);
+    if (loggedIn.length === 0) await push("session", "session", () => ({ status: "warn", label: "not logged in \u2014 qore login" }));
+  } catch (e) {
+    if (isCancel(e, signal)) throw e;
+    await push("session", "session", () => {
+      throw e;
+    });
+  }
+  for (const p of loggedIn) {
+    await push(
+      `session:${portalLabel(p)}`,
+      "session",
+      () => checkSession(deps2, p, o.onRequest, sessions, p.apiOrigin === portal.apiOrigin, signal)
+    );
+  }
+  await push("clock", "tools", () => checkClock(meta));
+  const session = sessions.get(portal.apiOrigin);
+  const notChecked = () => push(
+    "modules",
+    "workspace",
+    () => ({ status: "warn", label: `modules not checked \u2014 no working session for ${portalLabel(portal)}` })
+  );
+  const perModule = async (m, prepared) => {
+    if (!prepared?.recipe) return;
+    const { recipe, pkg } = prepared;
+    await push(`pm:${m.slug}`, "workspace", () => checkRepoPm(deps2, m, recipe, signal, toolMs), m.slug);
+    if (pkg?.engines?.node) await push(`node:${m.slug}`, "workspace", () => checkRepoNode(deps2, m, recipe, pkg, signal, toolMs), m.slug);
+  };
+  if (wsError) {
+    await push("context", "workspace", () => {
+      throw wsError;
     });
+    return { results, context };
+  }
+  const wsRoot = ws ? await workspaceRoot(deps2).catch(() => null) : null;
+  const repoRoot = wsRoot ? null : await findRepoRoot(deps2.cwd);
+  if (wsRoot) {
+    context.kind = "workspace";
+    context.label = basename3(wsRoot.root);
+    if (!session) {
+      await notChecked();
+      return { results, context };
+    }
+    let am;
+    try {
+      if (meta.ok) requireCapability(meta.meta, "app.modules", portal.apiOrigin);
+      am = await workspaceAppModules(session, portal, wsRoot);
+    } catch (e) {
+      await push("modules", "workspace", () => {
+        throw e;
+      });
+      return { results, context };
+    }
+    context.label = `${am.app.slug} (${am.app.tenant.name} / ${am.app.name})`;
+    const runs = runsAt(deps2, wsRoot.root);
+    for (const m of am.modules) await workspaceModule(deps2, wsRoot, am, m, runs, signal, push, perModule);
+  } else if (repoRoot) {
+    context.kind = "module";
+    context.label = basename3(repoRoot);
+    if (!session) {
+      await notChecked();
+      return { results, context };
+    }
+    let d = null;
+    try {
+      const resolved = await resolveRepoModule(deps2, session, portal, meta, repoRoot);
+      if ("status" in resolved) await push("module", "workspace", () => resolved);
+      else d = resolved;
+    } catch (e) {
+      if (isCancel(e, signal)) throw e;
+      await push("module", "workspace", () => {
+        throw e;
+      });
+    }
+    if (!d) return { results, context };
+    context.label = `${d.tenant.name} / ${d.slug}`;
+    const m = { root: repoRoot, slug: d.slug, type: d.type, id: d.id, access: d.access };
+    const runs = runsAt(deps2, repoRoot);
+    let prepared = null;
+    await push(`module:${m.slug}`, "workspace", async () => (prepared = await moduleBody(deps2, m, runs, signal)).body, m.slug);
+    await perModule(m, prepared);
+  }
+  return { results, context };
+}
+async function workspaceModule(deps2, ws, am, m, runs, signal, push, perModule) {
+  if (!isSafeSlug(m.slug)) {
+    await push(`module:${m.slug}`, "workspace", () => ({ status: "warn", label: "not a safe directory name \u2014 skipped" }), m.slug);
+    return;
   }
+  const mod = { root: join19(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
+  let prepared = null;
+  await push(`module:${m.slug}`, "workspace", async () => {
+    const info = await deps2.git.inspect(mod.root);
+    const action = planWorkspace(ws.root, [m], { [m.slug]: info }, []).actions[0];
+    if (action.kind === "clone") return { status: "warn", label: `not cloned \u2014 ${notClonedReason(m, am)}` };
+    if (action.kind !== "present") return { status: "warn", label: action.reason ?? action.kind };
+    prepared = await moduleBody(deps2, mod, runs, signal);
+    return prepared.body;
+  }, m.slug);
+  await perModule(mod, prepared);
+}
+
+// src/cli/commands/doctor.ts
+function registerDoctor(program, ctx) {
+  program.command("doctor").description("Check qore's own health: tools, session, and this workspace or module").action(async () => {
+    const { deps: deps2, io: io2, signal } = ctx;
+    const g = ctx.opts();
+    const report = await runDoctor(deps2, { portal: g.portal, onRequest: requestLog(ctx), signal });
+    const failed = report.results.some((r) => r.status === "fail");
+    if (g.json) {
+      renderDoctorJson(io2, report);
+    } else {
+      renderDoctorHuman(io2, report, pc3.isColorSupported && g.color !== false);
+    }
+    ctx.setExitCode(failed ? 1 : 0);
+  });
 }
+
+// src/cli/commands/env.ts
+import { randomBytes as randomBytes6 } from "crypto";
+import { chmod as chmod3, realpath as realpath7 } from "fs/promises";
+import { dirname as dirname7, join as join20, relative as relative7 } from "path";
+var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
 function registerEnv(program, ctx) {
   const env = program.command("env").description("Local environment");
   env.command("pull").description("Write this module's local secrets into its env file").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--target <path>", "env file to write (inside the repository)").option("--use-portal", "take the portal's value for keys that differ locally").option("--yes", "trust this repository without asking").action(async (f) => {
@@ -1927,7 +4608,7 @@ function registerEnv(program, ctx) {
     const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
     await ensureTrusted(ctx, mc, app, { yes: f.yes });
     const existing = await readOrNull(target);
-    const example = existing === null ? await readOrNull(join10(dirname4(target), ".env.example")) : null;
+    const example = existing === null ? await readOrNull(join20(dirname7(target), ".env.example")) : null;
     const local = await fetchLocalEnv(deps2, mc, app);
     const inputs = {
       existing,
@@ -1936,7 +4617,7 @@ function registerEnv(program, ctx) {
       managed: local.managedKeys,
       localSecrets: cfg.localSecrets ?? defaults.localSecrets,
       defaultChoice: f.usePortal ? "use-portal" : "keep",
-      random: () => randomBytes3(32).toString("hex")
+      random: () => randomBytes6(32).toString("hex")
     };
     let plan = planPull(inputs);
     if (plan.conflicts.length && io2.interactive && !f.usePortal) {
@@ -1964,11 +4645,11 @@ function registerEnv(program, ctx) {
       plan = planPull({ ...inputs, choices });
     }
     if (existing !== null && plan.text === existing) {
-      await chmod2(target, 384);
+      await chmod3(target, 384);
     } else {
       await writeSecurely(target, plan.text);
     }
-    const rel = relative5(await realpath3(mc.repoRoot), target);
+    const rel = relative7(await realpath7(mc.repoRoot), target);
     if (g.json) {
       const names = {
         created: plan.created,
@@ -2029,8 +4710,9 @@ function mapOidcError(e, host) {
   if (err === "access_denied") return new QoreError("QORE_LOGIN_DENIED", "The login was denied in the browser");
   if (err === "expired_token") return new QoreError("QORE_LOGIN_EXPIRED", "The login code expired", { hint: "Run `qore login` again." });
   if (err === "invalid_grant") return new QoreError("QORE_SESSION_EXPIRED", "Your session has ended", { hint: "Run `qore login`." });
-  const status2 = e.status;
-  if (status2 && status2 >= 500) return new QoreError("QORE_AUTH_UNAVAILABLE", "Keycloak is unavailable", { cause: e });
+  const res = e.code === "OAUTH_RESPONSE_IS_NOT_CONFORM" ? e.cause : void 0;
+  const status2 = e.status ?? (res instanceof Response ? res.status : void 0);
+  if (status2 && status2 >= 500) return new QoreError("QORE_AUTH_UNAVAILABLE", "Keycloak is unavailable", { status: status2, cause: e });
   if (e instanceof TypeError) return unreachable(e, host);
   const cause = e?.cause;
   if (cause instanceof TypeError) return unreachable(cause, host);
@@ -2234,37 +4916,6 @@ function registerLogout(program, ctx) {
   });
 }
 
-// src/cli/commands/run.ts
-import { constants } from "os";
-var childRunning = { current: false };
-function registerRun(program, ctx) {
-  program.command("run").description("Run a command with this module's local secrets in its environment").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--yes", "trust this repository without asking").argument("<command>", "the command to run (after --)").argument("[args...]", "its arguments, passed verbatim").action(async (cmd, args, f) => {
-    const { deps: deps2 } = ctx;
-    if (ctx.opts().json) {
-      throw new QoreError("QORE_CONTEXT_INVALID", "run has no --json output", {
-        hint: "Drop --json; the child's own output passes through."
-      });
-    }
-    const mc = await moduleContextFor(ctx, f, "run");
-    const app = await appFor(ctx, mc, f.app);
-    await ensureTrusted(ctx, mc, app, { yes: f.yes });
-    const local = await fetchLocalEnv(deps2, mc, app);
-    childRunning.current = true;
-    let exit;
-    try {
-      exit = await deps2.spawn.run(cmd, args, { ...deps2.env, ...local.env });
-    } finally {
-      childRunning.current = false;
-    }
-    if (exit.signal) {
-      deps2.raise(exit.signal);
-      ctx.setExitCode(128 + (constants.signals[exit.signal] ?? 0));
-      return;
-    }
-    ctx.setExitCode(exit.code ?? 1);
-  });
-}
-
 // src/cli/format.ts
 function ago(iso, now) {
   if (!iso) return "\u2013";
@@ -2356,8 +5007,7 @@ function registerStatus(program, ctx) {
 }
 
 // src/cli/commands/sync.ts
-import { lstat as lstat2, readdir } from "fs/promises";
-import { join as join11, relative as relative6 } from "path";
+import { join as join21, relative as relative8 } from "path";
 import { Option as Option2 } from "commander";
 function asFailure2(slug, e) {
   if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
@@ -2365,24 +5015,6 @@ function asFailure2(slug, e) {
   }
   throw e;
 }
-async function strayRepos(root, slugs) {
-  let entries;
-  try {
-    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
-  } catch {
-    return [];
-  }
-  const names = [];
-  for (const name of entries) {
-    if (slugs.has(name)) continue;
-    try {
-      await lstat2(join11(root, name, ".git"));
-      names.push(name);
-    } catch {
-    }
-  }
-  return names.sort();
-}
 function registerSync(program, ctx) {
   program.command("sync").description("Clone new modules, fetch present ones, report removed and re-pointed ones").option("--pull", "fast-forward every clean present repository with an upstream").addOption(new Option2("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (flags) => {
     const { deps: deps2, io: io2 } = ctx;
@@ -2407,7 +5039,7 @@ function registerSync(program, ctx) {
         continue;
       }
       try {
-        dirs[m.slug] = await deps2.git.inspect(join11(ws.root, m.slug));
+        dirs[m.slug] = await deps2.git.inspect(join21(ws.root, m.slug));
         modulesForPlan.push(m);
       } catch (e) {
         earlyFailures.push(asFailure2(m.slug, e));
@@ -2419,7 +5051,7 @@ function registerSync(program, ctx) {
     } });
     await syncPresent(deps2, applied, actions, Boolean(flags.pull), { app, protocol: flags.protocol });
     for (const r of applied) {
-      if (r.status === "cloned" && r.dir) r.dir = relative6(deps2.cwd, r.dir) || ".";
+      if (r.status === "cloned" && r.dir) r.dir = relative8(deps2.cwd, r.dir) || ".";
     }
     const removedResults = removed.map((slug) => ({ slug, status: "removed", reason: "not a module of this app \u2014 left in place" }));
     const results = [...earlyFailures, ...applied, ...removedResults];
@@ -2543,20 +5175,22 @@ var COMMANDS = [
   registerStatus,
   registerEnv,
   registerRun,
+  registerDev,
   registerClone,
   registerSync,
-  registerVersion
+  registerVersion,
+  registerDoctor
 ];
 
 // src/cli/updateCheck.ts
 var REGISTRY_URL = "https://registry.npmjs.org/@quatronic%2Fqore/latest";
-var DAY_MS = 24 * 60 * 60 * 1e3;
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
 var DEFAULT_TIMEOUT_MS = 1500;
 async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS) {
   if (o.json || deps2.env.CI || deps2.env.QORE_NO_UPDATE_CHECK === "1" || !io2.interactive) return;
   const cfg = await deps2.config.read();
   const last = cfg.updateCheck?.lastCheckedAt;
-  if (last && deps2.now().getTime() - new Date(last).getTime() < DAY_MS) return;
+  if (last && deps2.now().getTime() - new Date(last).getTime() < DAY_MS2) return;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   let latest;
@@ -2580,8 +5214,8 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 }
 
 // src/core/config.ts
-import { readFile as readFile5 } from "fs/promises";
-import { join as join12 } from "path";
+import { readFile as readFile6 } from "fs/promises";
+import { join as join22 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -2589,12 +5223,12 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join12(this.dir, "config.json");
+    return join22(this.dir, "config.json");
   }
   async read() {
     let raw;
     try {
-      raw = await readFile5(this.file, "utf8");
+      raw = await readFile6(this.file, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return empty();
       throw e;
@@ -2620,9 +5254,9 @@ var ConfigStore = class {
 
 // src/platform/git.ts
 import { execFile, execFileSync } from "child_process";
-import { mkdir as mkdir3, readdir as readdir2, stat as stat2 } from "fs/promises";
+import { mkdir as mkdir3, readdir as readdir2, stat as stat3 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname5, join as join13 } from "path";
+import { dirname as dirname8, join as join23 } from "path";
 function parseRemotes(stdout) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -2634,6 +5268,30 @@ function parseRemotes(stdout) {
   }
   return out;
 }
+function parseStatus(stdout) {
+  const s = { ok: true, dirty: false, branch: null, upstream: false };
+  for (const raw of stdout.split("\n")) {
+    const line2 = raw.replace(/\r$/, "");
+    if (line2.startsWith("# branch.head ")) {
+      const name = line2.slice("# branch.head ".length).trim();
+      s.branch = name === "(detached)" ? null : name;
+    } else if (line2.startsWith("# branch.upstream ")) {
+      s.upstream = true;
+      s.upstreamRef = line2.slice("# branch.upstream ".length).trim();
+    } else if (line2.startsWith("# branch.ab ")) {
+      const m = /^# branch\.ab \+(\d+) -(\d+)$/.exec(line2.trim());
+      if (m) {
+        s.ahead = Number(m[1]);
+        s.behind = Number(m[2]);
+      }
+    } else if (line2.startsWith("#")) {
+      continue;
+    } else if (line2.trim().length > 0) {
+      s.dirty = true;
+    }
+  }
+  return s;
+}
 var configuredSshCommand = /* @__PURE__ */ new Map();
 function hasConfiguredSshCommand(repoDir) {
   const key = repoDir ?? "";
@@ -2692,7 +5350,7 @@ async function remotes(repoRoot) {
   return parseRemotes(r.stdout);
 }
 async function clone(url, dir2) {
-  await mkdir3(dirname5(dir2), { recursive: true });
+  await mkdir3(dirname8(dir2), { recursive: true });
   const r = await runGit(["clone", "--", url, dir2]);
   return toResult(r, "git clone");
 }
@@ -2708,26 +5366,11 @@ async function status(repoRoot) {
   const command = "git status --porcelain=v2 --branch";
   const r = await runGit(["--no-optional-locks", "-C", repoRoot, "status", "--porcelain=v2", "--branch"], repoRoot);
   if (r.code !== 0) return { ok: false, stderr: r.stderr, command };
-  let branch = null;
-  let upstream = false;
-  let dirty = false;
-  for (const line2 of r.stdout.split(/\r?\n/)) {
-    if (line2.startsWith("# branch.head ")) {
-      const name = line2.slice("# branch.head ".length).trim();
-      branch = name === "(detached)" ? null : name;
-    } else if (line2.startsWith("# branch.upstream ")) {
-      upstream = true;
-    } else if (line2.startsWith("#")) {
-      continue;
-    } else if (line2.trim().length > 0) {
-      dirty = true;
-    }
-  }
-  return { ok: true, dirty, branch, upstream };
+  return parseStatus(r.stdout);
 }
 async function statOrThrow(path) {
   try {
-    return await stat2(path);
+    return await stat3(path);
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
     throw new QoreError("QORE_INTERNAL", `could not stat ${path}`, { cause: err });
@@ -2744,7 +5387,7 @@ async function inspect(dir2) {
     throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
   }
   const empty2 = entries.length === 0;
-  const isRepo = await statOrThrow(join13(dir2, ".git")) !== void 0;
+  const isRepo = await statOrThrow(join23(dir2, ".git")) !== void 0;
   const dirRemotes = isRepo ? await remotes(dir2) : [];
   return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
 }
@@ -2806,13 +5449,13 @@ var OsKeychain = class {
 
 // src/platform/lock.ts
 import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join24 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join14(dir2, "locks");
+    const locks = join24(dir2, "locks");
     await mkdir4(locks, { recursive: true, mode: 448 });
-    const target = join14(locks, `${name}.lock`);
+    const target = join24(locks, `${name}.lock`);
     await writeFile4(target, "", { flag: "a" });
     let release;
     let compromised;
@@ -2852,17 +5495,25 @@ function signalsFor(platform) {
   return platform === "win32" ? { ignore: ["SIGINT", "SIGBREAK"], forward: [] } : { ignore: ["SIGINT", "SIGQUIT"], forward: ["SIGTERM", "SIGHUP"] };
 }
 var { ignore: IGNORE, forward: FORWARD } = signalsFor(process.platform);
+var STDERR_DRAIN_MS = 500;
 function makeSpawner(spawnFn, proc) {
   return {
-    run(cmd, args, env) {
+    run(cmd, args, env, o) {
       return new Promise((resolve5, reject) => {
         let child;
         try {
-          child = spawnFn(cmd, args, { stdio: "inherit", shell: false, env, windowsHide: true });
+          child = spawnFn(cmd, args, {
+            stdio: o?.onStderr ? ["inherit", "inherit", "pipe"] : "inherit",
+            shell: false,
+            env,
+            windowsHide: true,
+            cwd: o?.cwd
+          });
         } catch (e) {
           reject(new QoreError("QORE_INTERNAL", `Could not start ${cmd}: ${e.code ?? "error"}`));
           return;
         }
+        if (o?.onStderr) child.stderr?.on("data", o.onStderr);
         const ignore = () => {
         };
         const forwarders = FORWARD.map((sig) => [sig, () => {
@@ -2880,7 +5531,22 @@ function makeSpawner(spawnFn, proc) {
         });
         child.once("exit", (code, signal) => {
           cleanup();
-          resolve5({ code, signal });
+          const stderr = child.stderr;
+          if (!o?.onStderr || !stderr || stderr.readableEnded) {
+            resolve5({ code, signal });
+            return;
+          }
+          let settled = false;
+          const finish = () => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            resolve5({ code, signal });
+          };
+          const timer = setTimeout(finish, STDERR_DRAIN_MS);
+          timer.unref?.();
+          stderr.once("end", finish);
+          stderr.once("close", finish);
         });
       });
     }
@@ -2888,8 +5554,243 @@ function makeSpawner(spawnFn, proc) {
 }
 var crossSpawner = makeSpawner(spawn, process);
 
+// src/platform/launch.ts
+import spawn2 from "cross-spawn";
+var RESET_OR_CLEAR = /\x1Bc|\x1B\[[23]J/g;
+function stripScreenClears(line2) {
+  return line2.includes("\x1B") ? line2.replace(RESET_OR_CLEAR, "") : line2;
+}
+function lineSplitter(stream, onLine) {
+  let buf = "";
+  return {
+    push(chunk) {
+      buf += chunk;
+      let i;
+      while ((i = buf.indexOf("\n")) >= 0) {
+        onLine({ stream, line: stripScreenClears(buf.slice(0, i).replace(/\r$/, "")) });
+        buf = buf.slice(i + 1);
+      }
+    },
+    flush() {
+      if (buf) {
+        onLine({ stream, line: stripScreenClears(buf.replace(/\r$/, "")) });
+        buf = "";
+      }
+    }
+  };
+}
+var systemLauncher = {
+  launch(cmd, args, o) {
+    const posix2 = process.platform !== "win32";
+    let child;
+    try {
+      child = spawn2(cmd, args, { cwd: o.cwd, env: o.env, stdio: ["ignore", "pipe", "pipe"], shell: false, detached: posix2, windowsHide: true });
+    } catch (e) {
+      return { pid: null, exited: Promise.resolve({ code: null, signal: null, spawnError: e.code ?? "error" }), stop() {
+      } };
+    }
+    const out = lineSplitter("stdout", o.onLine);
+    const err = lineSplitter("stderr", o.onLine);
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", (c) => out.push(c));
+    child.stderr?.on("data", (c) => err.push(c));
+    let closed = false;
+    const exited = new Promise((resolve5) => {
+      child.once("error", (e) => resolve5({ code: null, signal: null, spawnError: e.code ?? "error" }));
+      child.once("close", (code, signal) => {
+        closed = true;
+        out.flush();
+        err.flush();
+        resolve5({ code, signal });
+      });
+    });
+    return {
+      pid: child.pid ?? null,
+      exited,
+      stop(signal) {
+        if (child.pid === void 0 || closed) return;
+        if (posix2) {
+          try {
+            process.kill(-child.pid, signal);
+          } catch {
+          }
+        } else {
+          spawn2(
+            "taskkill",
+            ["/pid", String(child.pid), "/T", ...signal === "SIGKILL" ? ["/F"] : []],
+            { stdio: "ignore", windowsHide: true }
+          ).on("error", () => {
+          });
+        }
+      }
+    };
+  },
+  isAlive(pid) {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (e) {
+      return e.code === "EPERM";
+    }
+  },
+  signal(pid, sig) {
+    try {
+      process.kill(pid, sig);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/platform/ports.ts
+import { execFile as execFile2 } from "child_process";
+import { connect } from "net";
+function accepts(host, port) {
+  return new Promise((resolve5) => {
+    const s = connect({ host, port });
+    const done = (v) => {
+      s.destroy();
+      resolve5(v);
+    };
+    s.setTimeout(500, () => done(false));
+    s.once("connect", () => done(true));
+    s.once("error", () => done(false));
+  });
+}
+function run2(cmd, args) {
+  return new Promise((resolve5) => {
+    execFile2(
+      cmd,
+      args,
+      { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
+      (e, stdout) => resolve5(e && !stdout ? null : String(stdout))
+    );
+  });
+}
+var systemPorts = {
+  async inUse(port) {
+    return await accepts("127.0.0.1", port) || await accepts("::1", port);
+  },
+  async waitFor(port, timeoutMs, signal) {
+    const until = Date.now() + timeoutMs;
+    while (!signal.aborted) {
+      if (await this.inUse(port)) return true;
+      if (Date.now() >= until) return false;
+      await new Promise((r) => setTimeout(r, 250));
+    }
+    return false;
+  },
+  async waitFree(port, timeoutMs, signal) {
+    const until = Date.now() + timeoutMs;
+    while (!signal.aborted) {
+      if (!await this.inUse(port)) return true;
+      if (Date.now() >= until) return false;
+      await new Promise((r) => setTimeout(r, 250));
+    }
+    return false;
+  },
+  async owner(port) {
+    if (process.platform === "win32") {
+      const out2 = await run2("netstat", ["-ano", "-p", "TCP"]);
+      const line2 = out2?.split(/\r?\n/).find((l) => /LISTENING/.test(l) && new RegExp(`[:.]${port}\\s`).test(l));
+      const pid2 = line2 ? Number(line2.trim().split(/\s+/).pop()) : NaN;
+      if (!Number.isInteger(pid2) || pid2 <= 0) return null;
+      const task = await run2("tasklist", ["/FI", `PID eq ${pid2}`, "/FO", "CSV", "/NH"]);
+      return { pid: pid2, command: task?.split(",")[0]?.replace(/"/g, "").trim() || "unknown" };
+    }
+    const out = await run2("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-Fpc"]);
+    const pid = Number(out?.match(/^p(\d+)$/m)?.[1]);
+    if (!Number.isInteger(pid) || pid <= 0) return null;
+    return { pid, command: out?.match(/^c(.+)$/m)?.[1] ?? "unknown" };
+  },
+  async ownerDetail(pid) {
+    if (process.platform === "win32") return { cwd: null, ageSeconds: null };
+    const lsof = await run2("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"]);
+    const ps = await run2("ps", ["-o", "etime=", "-p", String(pid)]);
+    return { cwd: lsof ? parseLsofCwd(lsof) : null, ageSeconds: ps ? parseEtime(ps.trim()) : null };
+  },
+  async dockerPublisher(port) {
+    const out = await run2("docker", [
+      "ps",
+      "--filter",
+      `publish=${port}`,
+      "--format",
+      '{{.ID}}	{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.working_dir"}}'
+    ]);
+    return out ? parseDockerPs(out) : null;
+  },
+  async parentPid(pid) {
+    if (process.platform === "win32") return null;
+    const n = Number((await run2("ps", ["-o", "ppid=", "-p", String(pid)]))?.trim());
+    return Number.isInteger(n) && n > 0 ? n : null;
+  }
+};
+
+// src/platform/proxy.ts
+import { execFile as execFile3 } from "child_process";
+
+// src/core/diagnostics/proxy.ts
+function parseScutilProxy(stdout) {
+  const value = (key) => stdout.match(new RegExp(`^\\s*${key}\\s*:\\s*(.+)$`, "m"))?.[1]?.trim();
+  if (value("HTTPSEnable") === "1") {
+    const host = value("HTTPSProxy");
+    const port = value("HTTPSPort");
+    if (host && port) return `${host}:${port}`;
+  }
+  if (value("HTTPEnable") === "1") {
+    const host = value("HTTPProxy");
+    const port = value("HTTPPort");
+    if (host && port) return `${host}:${port}`;
+  }
+  return null;
+}
+function parseRegProxy(stdout) {
+  const enabled = /ProxyEnable\s+REG_DWORD\s+(0x[0-9a-fA-F]+)/.exec(stdout)?.[1];
+  if (enabled?.toLowerCase() !== "0x1") return null;
+  return /ProxyServer\s+REG_SZ\s+(\S+)/.exec(stdout)?.[1] ?? null;
+}
+
+// src/platform/proxy.ts
+function run3(cmd, args) {
+  return new Promise((resolve5) => {
+    execFile3(
+      cmd,
+      args,
+      { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
+      (e, stdout) => resolve5(e && !stdout ? null : String(stdout))
+    );
+  });
+}
+async function detect(platform) {
+  try {
+    if (platform === "darwin") {
+      const out = await run3("scutil", ["--proxy"]);
+      return out ? parseScutilProxy(out) : null;
+    }
+    if (platform === "win32") {
+      const key = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
+      const [enable, server] = await Promise.all([
+        run3("reg", ["query", key, "/v", "ProxyEnable"]),
+        run3("reg", ["query", key, "/v", "ProxyServer"])
+      ]);
+      const combined = [enable, server].filter(Boolean).join("\n");
+      return combined ? parseRegProxy(combined) : null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+var cached;
+function systemProxy(platform = process.platform) {
+  if (!cached) cached = detect(platform).catch(() => null);
+  return cached;
+}
+
 // src/version.ts
-var VERSION = true ? "0.1.2" : "0.0.0-dev";
+var VERSION = true ? "0.1.4" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -2900,7 +5801,10 @@ var json = preSeparatorArgv.includes("--json");
 var ac = new AbortController();
 process.on("SIGINT", () => {
   if (ac.signal.aborted) {
-    if (childRunning.current) return;
+    if (childRunning.current) {
+      childRunning.onInterrupt?.();
+      return;
+    }
     process.exit(130);
   }
   ac.abort();
@@ -2916,15 +5820,22 @@ var deps = {
   env: process.env,
   platform: process.platform,
   version: VERSION,
+  nodeVersion: process.versions.node,
   cwd: process.cwd(),
   home: homedir2(),
   git: systemGit,
   spawn: crossSpawner,
+  launch: systemLauncher,
+  ports: systemPorts,
+  signals: process,
   raise: (signal) => {
     process.removeAllListeners(signal);
     process.kill(process.pid, signal);
-  }
+  },
+  pid: process.pid,
+  systemProxy: () => systemProxy(process.platform)
 };
+var termination = preflightTermination(() => ac.abort(), deps.raise);
 var io = processIo(isInteractive({
   stdinTTY: Boolean(process.stdin.isTTY),
   stdoutTTY: Boolean(process.stdout.isTTY),
@@ -2933,6 +5844,11 @@ var io = processIo(isInteractive({
   env: process.env
 }));
 process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS);
+await termination.reRaise(async () => {
+  await Promise.all([process.stdout, process.stderr].map((s) => new Promise((r) => {
+    s.write("", () => r());
+  })));
+});
 if (!ac.signal.aborted) {
   try {
     await maybeNotifyUpdate(deps, io, { json });