@quatronic/qore 0.1.5 → 0.1.7

package/dist/cli.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a70250c5-daf4-5ff3-b490-5556ac377549")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bf813c0e-4054-532d-9e74-62fbe8673876")}catch(e){}}();
 import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
 import {
   addSecretValues,
   buildScrubContext
-} from "./chunk-QYBDINUC.js";
+} from "./chunk-OAU6HJHZ.js";
 
 // src/cli.ts
 import { homedir as homedir2 } from "os";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
 
 // src/cli/io.ts
-import { confirm, search, select } from "@inquirer/prompts";
+import { confirm, input, search, select } from "@inquirer/prompts";
 import { createInterface } from "readline";
 
 // src/platform/browser.ts
@@ -51,6 +51,10 @@ var EXIT = {
   QORE_REPO_ACCESS_PENDING: 5,
   QORE_GIT_AUTH: 5,
   QORE_WORKSPACE_CONFLICT: 2,
+  QORE_ROOT_NOT_SET: 2,
+  QORE_ROOT_INVALID: 2,
+  QORE_ROOT_NOT_WRITABLE: 1,
+  QORE_PROJECT_NOT_FOUND: 2,
   QORE_AUTH_UNAVAILABLE: 6,
   QORE_AUTH_BUSY: 6,
   QORE_API_UNREACHABLE: 6,
@@ -152,13 +156,21 @@ function processIo(interactive, stderrTTY = Boolean(process.stderr.isTTY)) {
         throw e;
       }
     },
+    async input(message, o) {
+      try {
+        return await input({ message, default: o?.default });
+      } catch (e) {
+        if (e.name === "ExitPromptError") throw new CancelledError();
+        throw e;
+      }
+    },
     waitForEnter: createWaitForEnter(process.stdin, process.stderr),
     openUrl: openBrowser
   };
 }
-function createWaitForEnter(input, output) {
-  return (message, signal) => new Promise((resolve5, reject) => {
-    const rl = createInterface({ input, output, terminal: true });
+function createWaitForEnter(input2, output) {
+  return (message, signal) => new Promise((resolve6, reject) => {
+    const rl = createInterface({ input: input2, output, terminal: true });
     const onAbort = () => {
       rl.close();
       reject(new CancelledError());
@@ -166,7 +178,7 @@ function createWaitForEnter(input, output) {
     const done = () => {
       signal.removeEventListener("abort", onAbort);
       rl.close();
-      resolve5();
+      resolve6();
     };
     signal.addEventListener("abort", onAbort, { once: true });
     rl.on("SIGINT", () => {
@@ -183,7 +195,7 @@ import { Command, CommanderError } from "commander";
 
 // src/core/api/http.ts
 function abortableFetch(fetch3, signal) {
-  return (input, init) => fetch3(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal });
+  return (input2, init) => fetch3(input2, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal });
 }
 var TLS = /* @__PURE__ */ new Set([
   "SELF_SIGNED_CERT_IN_CHAIN",
@@ -490,7 +502,7 @@ async function run(argv2, deps2, io2, signal, register, hooks = {}) {
 }
 
 // src/cli/commands/clone.ts
-import { join as join6, relative as relative2, resolve as resolve2 } from "path";
+import { join as join9, relative as relative3, resolve as resolve4 } from "path";
 import { Option } from "commander";
 
 // src/core/api/meta.ts
@@ -526,8 +538,8 @@ async function fetchMetaWithDate(fetch3, apiOrigin) {
   }
   if (!res.ok) throw await problemToError(res);
   const header = res.headers.get("date");
-  const ms = header ? Date.parse(header) : NaN;
-  return { meta: await res.json(), date: Number.isNaN(ms) ? null : new Date(ms) };
+  const ms2 = header ? Date.parse(header) : NaN;
+  return { meta: await res.json(), date: Number.isNaN(ms2) ? null : new Date(ms2) };
 }
 function negotiate(meta, portal, cliVersion) {
   if (portal.pinnedIssuer && meta.auth.issuer !== portal.pinnedIssuer) {
@@ -666,7 +678,7 @@ var QoreApiClient = class {
     this.o.onRequest?.(`${method} ${path} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
     return res;
   }
-  async request(method, path, body) {
+  async request(method, path, body, parse2 = (r) => r.json()) {
     let res = await this.once(method, path, body, false);
     if (res.status === 401) {
       res = await this.once(method, path, body, true);
@@ -688,11 +700,14 @@ var QoreApiClient = class {
       }
     }
     if (!res.ok) throw await problemToError(res);
-    return await res.json();
+    return parse2(res);
   }
   get(path) {
     return this.request("GET", path);
   }
+  getText(path) {
+    return this.request("GET", path, void 0, (r) => r.text());
+  }
   post(path, body) {
     return this.request("POST", path, body);
   }
@@ -708,13 +723,13 @@ var RefreshCoordinator = class {
   fresh(expiresAt) {
     return new Date(expiresAt).getTime() - this.o.now().getTime() > SKEW_MS;
   }
-  async rotate(scope) {
+  async rotate(scope2) {
     let stored = await this.o.store.getRefresh();
     if (!stored) throw new QoreError("QORE_NOT_LOGGED_IN", "Not logged in", { hint: "Run `qore login`." });
     let t;
     for (let attempt = 0; ; attempt++) {
       try {
-        t = await (await this.o.oidc()).refresh(stored.rt, scope);
+        t = await (await this.o.oidc()).refresh(stored.rt, scope2);
         break;
       } catch (e) {
         if (!(e instanceof QoreError && e.code === "QORE_SESSION_EXPIRED")) throw e;
@@ -730,7 +745,7 @@ var RefreshCoordinator = class {
         throw e;
       }
     }
-    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope ?? stored.scope), obtainedAt: this.o.now().toISOString() });
+    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope2 ?? stored.scope), obtainedAt: this.o.now().toISOString() });
     return t;
   }
   async accessToken(opts = {}) {
@@ -944,8 +959,8 @@ var ResolutionCache = class {
     const f = await this.load();
     const hits = [];
     for (const [k, e] of Object.entries(f.entries)) {
-      const sep2 = k.lastIndexOf("|");
-      if (keys.includes(k.slice(sep2 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep2), at: new Date(e.resolvedAt).getTime() });
+      const sep3 = k.lastIndexOf("|");
+      if (keys.includes(k.slice(sep3 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep3), at: new Date(e.resolvedAt).getTime() });
     }
     hits.sort((a, b) => b.at - a.at);
     return [...new Set(hits.map((h) => h.origin))];
@@ -1251,6 +1266,13 @@ async function syncPresent(deps2, results, actions, pull, ctx) {
   }
 }
 
+// src/core/projects/registry.ts
+import { realpath as realpath4 } from "fs/promises";
+
+// src/core/projects/discover.ts
+import { readdir, realpath as realpath2 } from "fs/promises";
+import { join as join6 } from "path";
+
 // src/core/workspace/file.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm, writeFile as writeFile2 } from "fs/promises";
@@ -1312,17 +1334,225 @@ async function writeWorkspace(root, o) {
 }
 async function workspacePortal(deps2, ws) {
   const portal = resolvePortal(ws.portal, void 0);
-  const label2 = portal.builtin ?? portal.apiOrigin;
+  const label3 = portal.builtin ?? portal.apiOrigin;
   const profile = (await deps2.config.read()).profiles[portal.apiOrigin];
   const loggedIn = profile && await new TokenStore(deps2.keychain, profileHash(profile.apiOrigin, profile.issuer)).getRefresh();
   if (!loggedIn) {
-    throw new QoreError("QORE_NOT_LOGGED_IN", `This workspace belongs to ${label2}, which you are not logged in to`, {
-      hint: `Run \`qore login --portal ${label2}\`.`
+    throw new QoreError("QORE_NOT_LOGGED_IN", `This workspace belongs to ${label3}, which you are not logged in to`, {
+      hint: `Run \`qore login --portal ${label3}\`.`
     });
   }
   return portal;
 }
 
+// src/core/projects/discover.ts
+var SKIP = (name) => name.startsWith(".") || name === "node_modules";
+async function subdirs(dir2) {
+  try {
+    return (await readdir(dir2, { withFileTypes: true })).filter((d) => d.isDirectory() && !SKIP(d.name)).map((d) => d.name);
+  } catch {
+    return [];
+  }
+}
+async function scanRoot(root) {
+  const out = [];
+  for (const tenant of (await subdirs(root)).sort()) {
+    for (const app of (await subdirs(join6(root, tenant))).sort()) {
+      const path = join6(root, tenant, app);
+      try {
+        const ws = await readWorkspace(path);
+        if (ws) out.push({ kind: "workspace", path, portal: ws.portal, tenantSlug: tenant, appId: ws.appId, appSlug: app });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+var GONE = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+async function stillValid(e) {
+  try {
+    const real = await realpath2(e.path);
+    if (e.kind === "workspace") {
+      const ws = await readWorkspace(real);
+      return ws && ws.appId === e.appId ? real : "gone";
+    }
+    return real;
+  } catch (err) {
+    if (err instanceof CancelledError) throw err;
+    return GONE.has(err.code ?? "") ? "gone" : "unknown";
+  }
+}
+async function knownProjects(deps2, o = {}) {
+  const cfg = await deps2.config.read();
+  const root = cfg.projectsRoot ? await realpath2(cfg.projectsRoot).catch(() => cfg.projectsRoot) : void 0;
+  const out = root ? (await scanRoot(root)).map((p) => ({ ...p, source: "root" })) : [];
+  const seen = new Set(out.map((p) => p.path));
+  const stale = [];
+  for (const e of cfg.projects ?? []) {
+    const real = await stillValid(e);
+    if (real === "gone") {
+      stale.push(e.path);
+      continue;
+    }
+    if (real === "unknown") continue;
+    if (seen.has(real)) continue;
+    seen.add(real);
+    out.push({ ...e, path: real, source: "registry" });
+  }
+  if (stale.length > 0) await forget(deps2, stale);
+  return o.portal ? out.filter((p) => p.portal === o.portal) : out;
+}
+
+// src/core/projects/root.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { mkdir as mkdir3, realpath as realpath3, rm as rm2, stat as stat2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, isAbsolute, join as join8, parse, relative as relative2, resolve as resolve3, sep } from "path";
+
+// src/core/context/repoRoot.ts
+import { stat } from "fs/promises";
+import { dirname as dirname2, join as join7, resolve as resolve2 } from "path";
+async function findRepoRoot(start2) {
+  let dir2 = resolve2(start2);
+  for (; ; ) {
+    try {
+      await stat(join7(dir2, ".git"));
+      return dir2;
+    } catch {
+    }
+    const up = dirname2(dir2);
+    if (up === dir2) return null;
+    dir2 = up;
+  }
+}
+
+// src/core/projects/root.ts
+var NOT_WRITABLE = /* @__PURE__ */ new Set(["EACCES", "EPERM", "EROFS"]);
+function expandPath(deps2, input2) {
+  const s = input2.trim();
+  if (s === "~") return deps2.home;
+  if (s.startsWith("~/") || s.startsWith("~\\")) return trimSeparator(join8(deps2.home, s.slice(2)));
+  return resolve3(deps2.cwd, s);
+}
+function trimSeparator(p) {
+  const root = parse(p).root;
+  let end = p.length;
+  while (end > root.length && (p[end - 1] === "/" || p[end - 1] === "\\")) end--;
+  return p.slice(0, end);
+}
+async function underAFile(path) {
+  for (let p = dirname3(path); ; p = dirname3(p)) {
+    const s = await stat2(p).catch((e) => e.code === "ENOENT" ? void 0 : null);
+    if (s === null) return false;
+    if (s) return !s.isDirectory();
+    if (dirname3(p) === p) return false;
+  }
+}
+function isInside(parent, child) {
+  const rel = relative2(parent, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function scannedBy(root, e) {
+  if (e.kind !== "workspace" || !isInside(root, e.path)) return false;
+  return relative2(root, e.path).split(sep).filter(Boolean).length === 2;
+}
+async function writableError(path) {
+  const probe = join8(path, `.qore-write-test-${randomBytes3(6).toString("hex")}`);
+  try {
+    await writeFile3(probe, "");
+    await rm2(probe, { force: true });
+    return null;
+  } catch (e) {
+    return e;
+  }
+}
+var invalid2 = (path, why) => new QoreError("QORE_ROOT_INVALID", `${path} cannot be the projects root: ${why}`, { hint: "Pick another folder: qore init --root <path>." });
+var notWritable = (path, e) => new QoreError("QORE_ROOT_NOT_WRITABLE", `${path} is not writable (${e.code ?? e.message})`, {
+  hint: "Fix its permissions, or pick another folder: qore init --root <path>.",
+  cause: e
+});
+async function checkRoot(deps2, input2) {
+  const path = expandPath(deps2, input2);
+  if (dirname3(path) === path) throw invalid2(path, "it is the filesystem root");
+  try {
+    if (!(await stat2(path)).isDirectory()) throw invalid2(path, "it is a file");
+  } catch (e) {
+    if (e instanceof QoreError) throw e;
+    const err = e;
+    if (err.code === "ENOTDIR") throw invalid2(path, "a parent of it is a file");
+    if (NOT_WRITABLE.has(err.code ?? "")) throw notWritable(path, err);
+    if (err.code !== "ENOENT") throw e;
+    if (await underAFile(path)) throw invalid2(path, "a parent of it is a file");
+  }
+  const repo = await findRepoRoot(path);
+  if (await findWorkspace(path, deps2.home) || repo && !isInside(repo, deps2.home)) {
+    throw invalid2(path, "it lies inside a project (an app workspace or a git repository)");
+  }
+  return path;
+}
+async function createRoot(path) {
+  try {
+    await mkdir3(path, { recursive: true });
+  } catch (e) {
+    const err2 = e;
+    if (NOT_WRITABLE.has(err2.code ?? "")) throw notWritable(path, err2);
+    if (err2.code === "ENOTDIR" || err2.code === "EEXIST") throw invalid2(path, "a parent of it is a file");
+    throw e;
+  }
+  const err = await writableError(path);
+  if (err) throw notWritable(path, err);
+  return realpath3(path);
+}
+async function validateRoot(deps2, input2) {
+  return createRoot(await checkRoot(deps2, input2));
+}
+
+// src/core/projects/registry.ts
+var LOCK = "projects";
+var same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+async function quietly(fn) {
+  try {
+    await fn();
+  } catch (e) {
+    if (e instanceof CancelledError) throw e;
+  }
+}
+async function remember(deps2, e) {
+  await quietly(async () => {
+    const path = await realpath4(e.path);
+    const entry = { ...e, path };
+    const cfg = await deps2.config.read();
+    const root = cfg.projectsRoot ? await realpath4(cfg.projectsRoot).catch(() => cfg.projectsRoot) : void 0;
+    if (root && scannedBy(root, entry)) return;
+    const current = cfg.projects?.find((p) => p.path === path);
+    if (current && same(current, entry)) return;
+    await deps2.withLock(LOCK, () => deps2.config.update((c) => {
+      c.projects = [...(c.projects ?? []).filter((p) => p.path !== path), entry];
+    }).then(() => void 0));
+  });
+}
+async function forget(deps2, paths) {
+  const drop = new Set(paths);
+  await quietly(() => deps2.withLock(LOCK, () => deps2.config.update((c) => {
+    if (c.projects) c.projects = c.projects.filter((p) => !drop.has(p.path));
+  }).then(() => void 0)));
+}
+async function setRoot(deps2, next) {
+  let registered = 0;
+  await deps2.withLock(LOCK, async () => {
+    const old = (await deps2.config.read()).projectsRoot;
+    const carried = old && old !== next ? await scanRoot(old) : [];
+    const keep = carried.filter((p) => !next || !scannedBy(next, p));
+    registered = keep.length;
+    await deps2.config.update((c) => {
+      c.projectsRoot = next;
+      if (next === void 0) delete c.projectsRoot;
+      const rest = (c.projects ?? []).filter((p) => !keep.some((k) => k.path === p.path));
+      if (rest.length + keep.length > 0) c.projects = [...rest, ...keep];
+    });
+  });
+  return { registered };
+}
+
 // src/core/workspace/safety.ts
 var SAFE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/;
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/;
@@ -1373,9 +1603,9 @@ function firstSentenceLower(hint) {
   return sentence.length ? sentence[0].toLowerCase() + sentence.slice(1) : sentence;
 }
 function failedLine(r) {
-  const label2 = FAILURE_LABELS[r.error?.code ?? ""] ?? "failed";
+  const label3 = FAILURE_LABELS[r.error?.code ?? ""] ?? "failed";
   const detail2 = firstSentenceLower(r.error?.hint);
-  return `\u2717 ${r.slug}   ${label2}${detail2 ? ` \u2014 ${detail2}` : ""}`;
+  return `\u2717 ${r.slug}   ${label3}${detail2 ? ` \u2014 ${detail2}` : ""}`;
 }
 function line(r, conflictCount) {
   switch (r.status) {
@@ -1474,61 +1704,76 @@ async function pickApp(deps2, io2, session, tenantFlag) {
   });
   return { tenant: tenant.slug, app };
 }
-function registerClone(program, ctx) {
-  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("[app]", "app slug or id (omit to pick one interactively)").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
-    const { deps: deps2, io: io2 } = ctx;
-    const g = ctx.opts();
-    const cfg = await deps2.config.read();
-    const portal = resolvePortal(g.portal, cfg.defaultProfile);
-    const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
-    const session = await openSession(deps2, portal, "clone", onRequest);
-    await ensureCapability(deps2, portal.apiOrigin, "app.modules");
-    const picked = appArg === void 0 ? await pickApp(deps2, io2, session, flags.tenant) : void 0;
-    const appSlug = picked?.app ?? appArg;
-    const ref = await resolveApp(deps2, io2, session, appSlug, picked?.tenant ?? flags.tenant);
-    const app = await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ref.appId)}/modules`);
-    if (dirArg === void 0 && !isSafeSlug(app.app.slug)) throw unsafeSlugError(app.app.slug);
-    const dirLabel = dirArg ?? app.app.slug;
-    const root = resolve2(deps2.cwd, dirLabel);
-    const info = await deps2.git.inspect(root);
-    if (info.exists && !info.empty) {
-      const ws = await readWorkspace(root);
-      if (!ws || ws.appId !== app.app.id || ws.portal !== portal.apiOrigin) {
-        throw new QoreError("QORE_WORKSPACE_CONFLICT", `${root} exists and is not the workspace of ${app.app.slug}`, {
-          hint: `Pick another directory: qore clone ${appSlug} <dir>.`
-        });
-      }
-    }
-    await writeWorkspace(root, { portal: portal.apiOrigin, appId: app.app.id });
-    const dirs = {};
-    const modulesForPlan = [];
-    const earlyFailures = [];
-    for (const m of app.modules) {
-      if (!isSafeSlug(m.slug)) {
-        earlyFailures.push(asFailure(m.slug, unsafeSlugError(m.slug)));
-        continue;
-      }
-      try {
-        dirs[m.slug] = await deps2.git.inspect(join6(root, m.slug));
-        modulesForPlan.push(m);
-      } catch (e) {
-        earlyFailures.push(asFailure(m.slug, e));
-      }
+async function cloneApp(ctx, appArg, dirArg, flags) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const cfg = await deps2.config.read();
+  const portal = resolvePortal(g.portal, cfg.defaultProfile);
+  const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+  const session = await openSession(deps2, portal, "clone", onRequest);
+  await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+  const picked = appArg === void 0 ? await pickApp(deps2, io2, session, flags.tenant) : void 0;
+  const appSlug = picked?.app ?? appArg;
+  const ref = await resolveApp(deps2, io2, session, appSlug, picked?.tenant ?? flags.tenant);
+  const app = await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ref.appId)}/modules`);
+  const projectsRoot = cfg.projectsRoot;
+  if (dirArg === void 0 && !isSafeSlug(app.app.slug)) throw unsafeSlugError(app.app.slug);
+  if (dirArg === void 0 && projectsRoot && !isSafeSlug(app.app.tenant.slug)) throw unsafeSlugError(app.app.tenant.slug);
+  const root = dirArg !== void 0 ? resolve4(deps2.cwd, dirArg) : projectsRoot ? join9(projectsRoot, app.app.tenant.slug, app.app.slug) : resolve4(deps2.cwd, app.app.slug);
+  const dirLabel = dirArg ?? (projectsRoot ? root : app.app.slug);
+  const info = await deps2.git.inspect(root);
+  if (info.exists && !info.empty) {
+    const ws = await readWorkspace(root);
+    if (!ws || ws.appId !== app.app.id || ws.portal !== portal.apiOrigin) {
+      throw new QoreError("QORE_WORKSPACE_CONFLICT", `${root} exists and is not the workspace of ${app.app.slug}`, {
+        hint: `Pick another directory: qore clone ${appSlug} <dir>.`
+      });
     }
-    const { actions } = planWorkspace(root, modulesForPlan, dirs, []);
-    const applied = await applyActions(deps2, { portal, app, actions, protocol: flags.protocol, onResult: () => {
-    } });
-    for (const r of applied) {
-      if (r.status === "cloned" && r.dir) r.dir = relative2(deps2.cwd, r.dir) || ".";
+  }
+  await writeWorkspace(root, { portal: portal.apiOrigin, appId: app.app.id });
+  await remember(deps2, {
+    kind: "workspace",
+    path: root,
+    portal: portal.apiOrigin,
+    tenantSlug: app.app.tenant.slug,
+    appId: app.app.id,
+    appSlug: app.app.slug
+  });
+  const dirs = {};
+  const modulesForPlan = [];
+  const earlyFailures = [];
+  for (const m of app.modules) {
+    if (!isSafeSlug(m.slug)) {
+      earlyFailures.push(asFailure(m.slug, unsafeSlugError(m.slug)));
+      continue;
     }
-    const results = [...earlyFailures, ...applied];
-    const err = reportWorkspaceRun(io2, results, Boolean(g.json));
-    if (!g.json) {
-      io2.out(`\u2713 Wrote ${join6(dirLabel, "qore.workspace.json")}`);
-      const first = results.find((r) => r.status === "cloned" || r.status === "present");
-      if (first && !err) io2.out(`Next: cd ${join6(dirLabel, first.slug)} && qore env pull`);
+    try {
+      dirs[m.slug] = await deps2.git.inspect(join9(root, m.slug));
+      modulesForPlan.push(m);
+    } catch (e) {
+      earlyFailures.push(asFailure(m.slug, e));
     }
-    if (err) throw err;
+  }
+  const { actions } = planWorkspace(root, modulesForPlan, dirs, []);
+  const applied = await applyActions(deps2, { portal, app, actions, protocol: flags.protocol, onResult: () => {
+  } });
+  for (const r of applied) {
+    if (r.status === "cloned" && r.dir && isInside(deps2.cwd, r.dir)) r.dir = relative3(deps2.cwd, r.dir) || ".";
+  }
+  const results = [...earlyFailures, ...applied];
+  const err = reportWorkspaceRun(io2, results, Boolean(g.json));
+  if (!g.json) {
+    io2.out(`\u2713 Wrote ${join9(dirLabel, "qore.workspace.json")}`);
+    const first = results.find((r) => r.status === "cloned" || r.status === "present");
+    if (first && !err) io2.out(`Next: cd ${join9(dirLabel, first.slug)} && qore env pull`);
+  }
+  if (!g.json && dirArg === void 0 && !projectsRoot) io2.err("Tip: run `qore init` to always clone into one projects folder.");
+  if (err) throw err;
+  return { root, appSlug: app.app.slug };
+}
+function registerClone(program, ctx) {
+  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("[app]", "app slug or id (omit to pick one interactively)").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
+    await cloneApp(ctx, appArg, dirArg, flags);
   });
 }
 
@@ -1553,6 +1798,13 @@ function describeConsent(consent, built) {
 }
 
 // src/cli/commands/config.ts
+async function describeRoot(deps2) {
+  const known = await knownProjects(deps2);
+  return {
+    root: (await deps2.config.read()).projectsRoot ?? null,
+    projects: { inRoot: known.filter((p) => p.source === "root").length, registered: known.filter((p) => p.source === "registry").length }
+  };
+}
 function registerConfig(program, ctx) {
   const config = program.command("config").description("Change qore's own settings");
   config.command("telemetry").description("Show or set crash reporting").argument("[state]", "on or off").action(async (state) => {
@@ -1572,29 +1824,44 @@ function registerConfig(program, ctx) {
     io2.out(describeConsent(consent, built));
     if (state && consent.source !== "config") io2.err(`${consent.source} in your environment overrides this setting.`);
   });
+  config.command("root").description("Show or set the projects folder qore clones into (see qore init)").argument("[path]", "the new projects folder").option("--unset", "clear it; projects already there stay findable").action(async (path, f) => {
+    const { deps: deps2, io: io2 } = ctx;
+    if (path !== void 0 && f.unset) {
+      throw new QoreError("QORE_CONTEXT_INVALID", "Pass a path or --unset, not both", { hint: "qore config root <path> | qore config root --unset" });
+    }
+    if (path !== void 0) await setRoot(deps2, await validateRoot(deps2, path));
+    if (f.unset) await setRoot(deps2, void 0);
+    const d = await describeRoot(deps2);
+    if (ctx.opts().json) {
+      renderJson(io2, d);
+      return;
+    }
+    io2.out(d.root ? `Projects root: ${d.root}` : "Projects root: not set \u2014 run qore init");
+    io2.out(`Known projects: ${d.projects.inRoot} in the root, ${d.projects.registered} elsewhere`);
+  });
 }
 
 // src/cli/commands/dev.ts
-import { randomBytes as randomBytes5 } from "crypto";
-import { realpath as realpath5 } from "fs/promises";
+import { randomBytes as randomBytes6 } from "crypto";
+import { realpath as realpath8 } from "fs/promises";
 import { constants as constants3 } from "os";
-import { dirname as dirname6, join as join18, relative as relative6 } from "path";
+import { dirname as dirname7, join as join21, relative as relative7 } from "path";
 import { StringDecoder } from "string_decoder";
 
 // src/core/context/repoConfig.ts
 import { readFile as readFile3 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join10 } from "path";
 var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
 var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var SCRIPT = /^[A-Za-z0-9:_.-]+$/;
-var invalid2 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
+var invalid3 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
 function moduleDefaults(type) {
   return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
 }
 async function readRepoConfig(root) {
   let raw;
   try {
-    raw = await readFile3(join7(root, ".qore.json"), "utf8");
+    raw = await readFile3(join10(root, ".qore.json"), "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return {};
     throw e;
@@ -1603,44 +1870,44 @@ async function readRepoConfig(root) {
   try {
     doc = JSON.parse(raw);
   } catch {
-    throw invalid2("not valid JSON");
+    throw invalid3("not valid JSON");
   }
-  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid2("must be an object");
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid3("must be an object");
   const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
-  if (!Number.isInteger(v) || v < 1) throw invalid2("schemaVersion must be a positive integer");
+  if (!Number.isInteger(v) || v < 1) throw invalid3("schemaVersion must be a positive integer");
   if (v > 1) {
     throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
   }
-  for (const f of FORBIDDEN) if (f in doc) throw invalid2(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
+  for (const f of FORBIDDEN) if (f in doc) throw invalid3(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
   const out = {};
   if (doc.envFile !== void 0) {
-    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid2("envFile must be a non-empty string");
+    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid3("envFile must be a non-empty string");
     out.envFile = doc.envFile;
   }
   if (doc.localSecrets !== void 0) {
     if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
-      throw invalid2("localSecrets must be a list of env key names");
+      throw invalid3("localSecrets must be a list of env key names");
     }
-    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid2("localSecrets must not contain duplicates");
+    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid3("localSecrets must not contain duplicates");
     out.localSecrets = doc.localSecrets;
   }
   if (doc.dev !== void 0) {
     const d = doc.dev;
-    if (!d || typeof d !== "object" || Array.isArray(d)) throw invalid2("dev must be an object");
+    if (!d || typeof d !== "object" || Array.isArray(d)) throw invalid3("dev must be an object");
     const dev = {};
     if (d.install !== void 0) {
-      if (typeof d.install !== "boolean") throw invalid2("dev.install must be true or false");
+      if (typeof d.install !== "boolean") throw invalid3("dev.install must be true or false");
       dev.install = d.install;
     }
     if (d.services !== void 0) {
       if (!Array.isArray(d.services) || !d.services.every((s) => typeof s === "string" && SCRIPT.test(s))) {
-        throw invalid2("dev.services must be a list of script names");
+        throw invalid3("dev.services must be a list of script names");
       }
-      if (new Set(d.services).size !== d.services.length) throw invalid2("dev.services must not contain duplicates");
+      if (new Set(d.services).size !== d.services.length) throw invalid3("dev.services must not contain duplicates");
       dev.services = d.services;
     }
     if (d.script !== void 0) {
-      if (typeof d.script !== "string" || !SCRIPT.test(d.script)) throw invalid2("dev.script must be a script name");
+      if (typeof d.script !== "string" || !SCRIPT.test(d.script)) throw invalid3("dev.script must be a script name");
       dev.script = d.script;
     }
     out.dev = dev;
@@ -1648,25 +1915,8 @@ async function readRepoConfig(root) {
   return out;
 }
 
-// src/core/context/repoRoot.ts
-import { stat } from "fs/promises";
-import { dirname as dirname2, join as join8, resolve as resolve3 } from "path";
-async function findRepoRoot(start2) {
-  let dir2 = resolve3(start2);
-  for (; ; ) {
-    try {
-      await stat(join8(dir2, ".git"));
-      return dir2;
-    } catch {
-    }
-    const up = dirname2(dir2);
-    if (up === dir2) return null;
-    dir2 = up;
-  }
-}
-
 // src/core/context/resolver.ts
-import { isAbsolute, join as join9, relative as relative3 } from "path";
+import { isAbsolute as isAbsolute2, join as join11, relative as relative4 } from "path";
 var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HINT_FLAG = "cd into a module repository, or pass --module <slug|id>.";
 var RESOLVE = "/api/cli/v1/repos/resolve";
@@ -1774,8 +2024,8 @@ async function byFlag(deps2, o, cache, ws) {
   return { portal, session, module, source: overrides ? { kind: "flag", overrides } : { kind: "flag" }, repoRoot, workspace: ws };
 }
 var isBelow = (root, dir2) => {
-  const rel = relative3(root, dir2);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+  const rel = relative4(root, dir2);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 };
 async function inWorkspaceRoot(deps2, ws) {
   if (!ws) return false;
@@ -1878,8 +2128,9 @@ async function anyLoggedIn(deps2, cfg) {
   }
   return false;
 }
+var isForeignRepo = (e) => e instanceof QoreError && e.code === "QORE_CONTEXT_REQUIRED" && e.details?.foreignRepo === true;
 async function resolveModuleContext(deps2, o) {
-  const cache = new ResolutionCache(join9(deps2.config.dir, "cache"), deps2.now);
+  const cache = new ResolutionCache(join11(deps2.config.dir, "cache"), deps2.now);
   const ws = await findWorkspace(deps2.cwd, deps2.home);
   if (o.module) return byFlag(deps2, o, cache, ws);
   const cfg = await deps2.config.read();
@@ -1896,7 +2147,7 @@ async function resolveModuleContext(deps2, o) {
     const said = gitError?.hint;
     throw new QoreError("QORE_CONTEXT_REQUIRED", "This repository has no remote Qore can match", {
       hint: said ? `${HINT_FLAG} git said: ${said}` : HINT_FLAG,
-      details: gitError ? { git: said ?? gitError.message } : void 0,
+      details: gitError ? { git: said ?? gitError.message } : { foreignRepo: true },
       cause: gitError
     });
   }
@@ -1925,6 +2176,7 @@ async function resolveModuleContext(deps2, o) {
   }
   const details = { triedProfiles: tried };
   if (skipped.length > 0) details.skippedProfiles = skipped;
+  if (answered.length > 0) details.foreignRepo = true;
   if (answered.length === 0) {
     const cause = skipErrors[0] ?? unsupported2;
     if (cause) throw withDetails(cause, details);
@@ -2030,7 +2282,7 @@ function exitHint(tail, h) {
 }
 
 // src/core/dev/env.ts
-import { dirname as dirname5, join as join12 } from "path";
+import { dirname as dirname6, join as join14 } from "path";
 
 // src/core/env/fetch.ts
 async function fetchLocalEnv(deps2, mc, app) {
@@ -2132,8 +2384,8 @@ function renderEnv(original, merged) {
 }
 
 // src/core/env/pull.ts
-import { lstat, realpath as realpath2 } from "fs/promises";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "path";
+import { lstat, realpath as realpath5 } from "fs/promises";
+import { basename, dirname as dirname4, isAbsolute as isAbsolute3, relative as relative5, resolve as resolve5, sep as sep2 } from "path";
 var outside = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file must be inside the repository (got ${target})`, {
   hint: "Use a path inside the repository for --target or .qore.json envFile."
 });
@@ -2141,29 +2393,29 @@ var symlinked = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file
   hint: "Use a path inside the repository for --target or .qore.json envFile."
 });
 function inside(root, p) {
-  const rel = relative4(root, p);
-  return rel !== "" && rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute2(rel);
+  const rel = relative5(root, p);
+  return rel !== "" && rel !== ".." && !rel.startsWith(".." + sep2) && !isAbsolute3(rel);
 }
 async function resolveTarget(root, target, base = root) {
-  const realRoot = await realpath2(root);
-  const realBase = base === root ? realRoot : await realpath2(base);
-  const abs = resolve4(realBase, target);
-  if (!isAbsolute2(target) && !inside(realRoot, abs)) throw outside(target);
+  const realRoot = await realpath5(root);
+  const realBase = base === root ? realRoot : await realpath5(base);
+  const abs = resolve5(realBase, target);
+  if (!isAbsolute3(target) && !inside(realRoot, abs)) throw outside(target);
   let parent;
   try {
-    parent = await realpath2(dirname3(abs));
+    parent = await realpath5(dirname4(abs));
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
     throw new QoreError("QORE_CONTEXT_INVALID", `The directory for ${target} does not exist`, {
       hint: "Create the parent directory, or point --target / .qore.json envFile at an existing one."
     });
   }
-  const final = resolve4(parent, basename(abs));
+  const final = resolve5(parent, basename(abs));
   if (!inside(realRoot, final)) throw outside(target);
   try {
     const st = await lstat(final);
     if (st.isSymbolicLink()) throw symlinked(target);
-    const realFinal = await realpath2(final);
+    const realFinal = await realpath5(final);
     if (!inside(realRoot, realFinal)) throw outside(target);
   } catch (e) {
     if (e instanceof QoreError) throw e;
@@ -2199,9 +2451,9 @@ function planPull(o) {
 }
 
 // src/core/env/write.ts
-import { chmod as chmod2, readFile as readFile4, rename as rename3, unlink, writeFile as writeFile3 } from "fs/promises";
-import { randomBytes as randomBytes3 } from "crypto";
-import { basename as basename2, dirname as dirname4, join as join10 } from "path";
+import { chmod as chmod2, readFile as readFile4, rename as rename3, unlink, writeFile as writeFile4 } from "fs/promises";
+import { randomBytes as randomBytes4 } from "crypto";
+import { basename as basename2, dirname as dirname5, join as join12 } from "path";
 async function readOrNull(p) {
   try {
     return await readFile4(p, "utf8");
@@ -2212,10 +2464,10 @@ async function readOrNull(p) {
 }
 async function writeSecurely(target, text2) {
   const base = basename2(target);
-  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes3(6).toString("hex")}.local` : `${base}.qore-${randomBytes3(6).toString("hex")}.tmp`;
-  const tmp = join10(dirname4(target), tmpName);
+  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes4(6).toString("hex")}.local` : `${base}.qore-${randomBytes4(6).toString("hex")}.tmp`;
+  const tmp = join12(dirname5(target), tmpName);
   try {
-    await writeFile3(tmp, text2, { mode: 384, flag: "wx" });
+    await writeFile4(tmp, text2, { mode: 384, flag: "wx" });
     await chmod2(tmp, 384);
     await rename3(tmp, target);
   } finally {
@@ -2241,8 +2493,8 @@ async function syncEnvFile(o) {
 
 // src/core/dev/lastStart.ts
 import { createHash as createHash2 } from "crypto";
-import { realpath as realpath3 } from "fs/promises";
-import { join as join11 } from "path";
+import { realpath as realpath6 } from "fs/promises";
+import { join as join13 } from "path";
 var NETWORK_REASONS = /* @__PURE__ */ new Set(["connect", "dns", "tls", "timeout"]);
 function isOffline(e) {
   if (!(e instanceof QoreError)) return false;
@@ -2251,14 +2503,14 @@ function isOffline(e) {
   return (e.status ?? 0) >= 500 || NETWORK_REASONS.has(String(e.details?.reason));
 }
 async function stateKey(deps2, root) {
-  const real = await realpath3(root).catch(() => root);
+  const real = await realpath6(root).catch(() => root);
   return createHash2("sha256").update(trustKey(real, deps2.platform)).digest("hex").slice(0, 16);
 }
 async function saveLastStart(deps2, root, rec) {
-  await writeJsonAtomic(join11(deps2.config.dir, "dev"), `${await stateKey(deps2, root)}.json`, rec);
+  await writeJsonAtomic(join13(deps2.config.dir, "dev"), `${await stateKey(deps2, root)}.json`, rec);
 }
 async function loadLastStart(deps2, root) {
-  const rec = await readJson(join11(deps2.config.dir, "dev", `${await stateKey(deps2, root)}.json`)).catch(() => null);
+  const rec = await readJson(join13(deps2.config.dir, "dev", `${await stateKey(deps2, root)}.json`)).catch(() => null);
   return rec && rec.schemaVersion === 1 ? rec : null;
 }
 
@@ -2278,7 +2530,7 @@ async function devEnv(deps2, o) {
   if (o.mc && o.app) {
     try {
       const local = await fetchLocalEnv(deps2, o.mc, o.app);
-      const example = await readOrNull(join12(dirname5(target), ".env.example"));
+      const example = await readOrNull(join14(dirname6(target), ".env.example"));
       const w = await syncEnvFile({
         target,
         example,
@@ -2332,7 +2584,7 @@ function notClonedReason(m, am) {
 }
 
 // src/core/dev/findings.ts
-var plural = (n, one, many) => n === 1 ? one : many;
+var plural = (n, one2, many) => n === 1 ? one2 : many;
 function modulesMissing(o) {
   const actionFor = new Map(o.actions.map((a) => [a.module.slug, a]));
   const findings = [];
@@ -2413,7 +2665,7 @@ function providerDown(o) {
 
 // src/core/dev/project.ts
 import { access, readFile as readFile5 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join15 } from "path";
 var LEGACY_DEV_SCRIPTS = ["node --env-file=.env --import ./dist/instrumentation.js dist/index.js"];
 var LOCKFILES = [["pnpm-lock.yaml", "pnpm"], ["package-lock.json", "npm"], ["yarn.lock", "yarn"]];
 var exists = (p) => access(p).then(() => true, () => false);
@@ -2421,7 +2673,7 @@ var unsupported = (message, hint, details) => new QoreError("QORE_DEV_UNSUPPORTE
 async function readPackageJson(root) {
   let raw;
   try {
-    raw = await readFile5(join13(root, "package.json"), "utf8");
+    raw = await readFile5(join15(root, "package.json"), "utf8");
   } catch {
     throw unsupported("This repository has no package.json", "qore dev starts Node repositories through their package.json scripts.");
   }
@@ -2437,7 +2689,7 @@ async function detectPackageManager(root, pkg) {
     if (!m) throw unsupported(`packageManager "${pkg.packageManager}" is not pnpm, npm or yarn`, "qore dev supports pnpm, npm and yarn.");
     return { name: m[1], version: m[2].split("+")[0] };
   }
-  for (const [file, name] of LOCKFILES) if (await exists(join13(root, file))) return { name, version: null };
+  for (const [file, name] of LOCKFILES) if (await exists(join15(root, file))) return { name, version: null };
   throw unsupported("No package manager declared and no lockfile found", 'Add "packageManager": "pnpm@<version>" to package.json.');
 }
 function planRecipe(o) {
@@ -2480,21 +2732,21 @@ function installArgs(pm) {
 }
 
 // src/core/dev/install.ts
-import { stat as stat2 } from "fs/promises";
-import { join as join14 } from "path";
+import { stat as stat3 } from "fs/promises";
+import { join as join16 } from "path";
 var MARKERS = {
   pnpm: [".modules.yaml"],
   npm: [".package-lock.json"],
   yarn: [".yarn-state.yml", ".yarn-integrity"]
 };
-var LOCK = { pnpm: "pnpm-lock.yaml", npm: "package-lock.json", yarn: "yarn.lock" };
-var mtime = (p) => stat2(p).then((s) => s.mtimeMs, () => null);
+var LOCK2 = { pnpm: "pnpm-lock.yaml", npm: "package-lock.json", yarn: "yarn.lock" };
+var mtime = (p) => stat3(p).then((s) => s.mtimeMs, () => null);
 async function needsInstall(root, pm) {
-  if (await mtime(join14(root, "node_modules")) === null) return true;
+  if (await mtime(join16(root, "node_modules")) === null) return true;
   let marker = null;
-  for (const m of MARKERS[pm.name]) marker ??= await mtime(join14(root, "node_modules", m));
+  for (const m of MARKERS[pm.name]) marker ??= await mtime(join16(root, "node_modules", m));
   if (marker === null) return true;
-  const lock = await mtime(join14(root, LOCK[pm.name]));
+  const lock = await mtime(join16(root, LOCK2[pm.name]));
   return lock !== null && lock > marker;
 }
 
@@ -2622,7 +2874,7 @@ function nodeVersionError(found, range, slug) {
 // src/core/dev/preflight.ts
 var pmMajor = (v) => v ? v.split(".")[0] : "latest";
 var GRACE_MS = 1e4;
-var secs = (ms) => `${Math.round(ms / 1e3)} s`;
+var secs = (ms2) => `${Math.round(ms2 / 1e3)} s`;
 async function runTool(deps2, cmd, args, o) {
   if (o.signal.aborted) throw new CancelledError();
   const tail = [];
@@ -2810,13 +3062,13 @@ async function checkPort(deps2, o) {
   throw await portInUseError(deps2, { slug: o.slug, port: o.port, key: o.key, runs: o.runs });
 }
 function abortableDelay(signal) {
-  return (ms) => new Promise((resolve5) => {
+  return (ms2) => new Promise((resolve6) => {
     const done = () => {
       clearTimeout(t);
       signal.removeEventListener("abort", done);
-      resolve5();
+      resolve6();
     };
-    const t = setTimeout(done, ms);
+    const t = setTimeout(done, ms2);
     signal.addEventListener("abort", done, { once: true });
   });
 }
@@ -2897,11 +3149,11 @@ function hintContext(recipe, pkg, env) {
 
 // src/core/dev/runFile.ts
 import { unlink as unlink2 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join17 } from "path";
 async function runFilePath(deps2, root) {
-  const dir2 = join15(deps2.config.dir, "run");
+  const dir2 = join17(deps2.config.dir, "run");
   const name = `${await stateKey(deps2, root)}.json`;
-  return { dir: dir2, name, path: join15(dir2, name) };
+  return { dir: dir2, name, path: join17(dir2, name) };
 }
 async function writeRunFile(deps2, root, rec) {
   const { dir: dir2, name } = await runFilePath(deps2, root);
@@ -2922,8 +3174,197 @@ async function leftoverRun(deps2, root, o = {}) {
   return null;
 }
 
+// src/cli/project.ts
+import { readdir as readdir2, stat as stat4 } from "fs/promises";
+import { join as join18 } from "path";
+
+// src/core/projects/match.ts
+function readings(ref) {
+  const s = ref.split("/").map((x) => x.trim());
+  if (s.some((x) => x === "")) return [];
+  if (s.length === 1) return [{ app: s[0] }];
+  if (s.length === 2) return [{ app: s[0], module: s[1] }, { tenant: s[0], app: s[1] }];
+  if (s.length === 3) return [{ tenant: s[0], app: s[1], module: s[2] }];
+  return [];
+}
+function hit(p, w) {
+  if (p.appSlug !== w.app || w.tenant !== void 0 && p.tenantSlug !== w.tenant) return null;
+  if (p.kind === "module") return w.module === p.moduleSlug ? { project: p } : null;
+  return w.module ? { project: p, module: w.module } : { project: p };
+}
+function matchProjects(projects, ref) {
+  const out = [];
+  for (const w of readings(ref)) {
+    for (const p of projects) {
+      const m = hit(p, w);
+      if (m) out.push(m);
+    }
+  }
+  return out;
+}
+
+// src/cli/project.ts
+async function loggedInAs(ctx) {
+  const cfg = await ctx.deps.config.read();
+  const portal = resolvePortal(ctx.opts().portal, cfg.defaultProfile);
+  const p = cfg.profiles[portal.apiOrigin];
+  if (!p || !await new TokenStore(ctx.deps.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return null;
+  return p.email ?? p.sub ?? portal.apiOrigin;
+}
+var isDir = async (p) => (await stat4(p).catch(() => null))?.isDirectory() ?? false;
+var label2 = (p) => `${p.tenantSlug} / ${p.appSlug}${p.kind === "module" ? ` / ${p.moduleSlug}` : ""}${p.source === "registry" ? `  (${p.path})` : ""}`;
+var candidate = (p) => p.kind === "module" ? { kind: "module", id: p.moduleId, slug: p.moduleSlug, tenant: p.tenantSlug, name: p.path } : { kind: "app", slug: p.appSlug, tenant: p.tenantSlug, name: p.path };
+var withCwd = (ctx, cwd) => ({ ...ctx, deps: { ...ctx.deps, cwd } });
+async function standingIn(ctx) {
+  if (await findWorkspace(ctx.deps.cwd, ctx.deps.home)) return "workspace";
+  const repo = await findRepoRoot(ctx.deps.cwd);
+  return repo !== null && !isInside(repo, ctx.deps.home) ? { repo } : null;
+}
+async function isForeign(ctx, command) {
+  const g = ctx.opts();
+  try {
+    await resolveModuleContext(ctx.deps, { portal: g.portal, command, onRequest: g.verbose ? (l) => ctx.io.err(l) : void 0 });
+    return false;
+  } catch (e) {
+    if (e instanceof CancelledError) throw e;
+    return isForeignRepo(e);
+  }
+}
+async function moduleDirs(wsPath) {
+  const out = [];
+  for (const d of await readdir2(wsPath, { withFileTypes: true }).catch(() => [])) {
+    if (d.isDirectory() && !d.name.startsWith(".") && await stat4(join18(wsPath, d.name, ".git")).catch(() => null)) out.push(d.name);
+  }
+  return out.sort();
+}
+async function pathFor(ctx, m, needModule) {
+  const p = m.project;
+  if (p.kind === "module") return p.path;
+  if (m.module) {
+    const dir2 = join18(p.path, m.module);
+    if (!await isDir(dir2)) {
+      throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no checkout of module ${m.module} in ${p.path}`, {
+        hint: `Run \`qore sync\` in ${p.path} to clone the app's missing modules.`
+      });
+    }
+    return dir2;
+  }
+  if (!needModule) return p.path;
+  const dirs = await moduleDirs(p.path);
+  if (dirs.length === 1) return join18(p.path, dirs[0]);
+  if (dirs.length === 0) {
+    throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no module checkouts in ${p.path}`, {
+      hint: `Run \`qore sync\` in ${p.path}.`
+    });
+  }
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `${p.appSlug} has several modules \u2014 which one?`, {
+      hint: `Pass ${p.appSlug}/<module>.`,
+      candidates: dirs.map((slug) => ({ kind: "module", slug, tenant: p.tenantSlug, name: join18(p.path, slug) }))
+    });
+  }
+  return join18(p.path, await ctx.io.select("Select a module", dirs.map((d) => ({ name: d, value: d }))));
+}
+async function liveMatches(matches) {
+  const live = [];
+  for (const m of matches) {
+    if (m.project.kind === "workspace" && m.module && !await isDir(join18(m.project.path, m.module))) continue;
+    live.push(m);
+  }
+  return live.length > 0 ? live : matches;
+}
+async function choose(ctx, matches, what, explicit) {
+  if (explicit && matches.length === 1) return matches[0];
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", what, {
+      hint: "Pass a more specific reference: tenant/app or app/module.",
+      candidates: matches.map((m) => candidate(m.project))
+    });
+  }
+  const i = await ctx.io.select("Select a project", matches.map((m, idx) => ({
+    name: m.module ? `${label2(m.project)} / ${m.module}` : label2(m.project),
+    value: idx
+  })));
+  return matches[i];
+}
+async function projectCtx(ctx, o) {
+  const g = ctx.opts();
+  const cfg = await ctx.deps.config.read();
+  const portal = g.portal ? resolvePortal(g.portal, cfg.defaultProfile).apiOrigin : void 0;
+  if (o.ref) {
+    const matches = matchProjects(await knownProjects(ctx.deps, { portal }), o.ref);
+    if (matches.length === 0) {
+      const parts = o.ref.split("/");
+      const app = parts.length === 1 ? o.ref : parts.length === 3 ? parts[1] : "<app>";
+      throw new QoreError("QORE_PROJECT_NOT_FOUND", `No local project "${o.ref}"`, {
+        hint: cfg.projectsRoot ? `Run \`qore clone ${app}\`.` : `Run \`qore init\`, or \`qore clone ${app}\`.`
+      });
+    }
+    const m2 = await choose(ctx, await liveMatches(matches), `"${o.ref}" matches several projects`, true);
+    return relocate(ctx, await pathFor(ctx, m2, o.needModule));
+  }
+  if (o.module || o.app) return ctx;
+  const here = await standingIn(ctx);
+  if (here === "workspace") return ctx;
+  const known = await knownProjects(ctx.deps, { portal });
+  if (here && (known.length === 0 || known.some((p) => isInside(p.path, here.repo)) || !await isForeign(ctx, o.command ?? "project"))) return ctx;
+  if (known.length === 0) {
+    if (!cfg.projectsRoot) {
+      if (!await loggedInAs(ctx)) return ctx;
+      throw new QoreError("QORE_ROOT_NOT_SET", "Not inside a project, and qore knows no projects yet", {
+        hint: "Run `qore init` to choose a projects folder, or cd into a project."
+      });
+    }
+    throw new QoreError("QORE_PROJECT_NOT_FOUND", `Not inside a project, and ${cfg.projectsRoot} holds none yet`, {
+      hint: "Run `qore clone <app>`."
+    });
+  }
+  const what = here ? "This repository is not a Qore module \u2014 which project?" : "Not inside a project \u2014 which one?";
+  const m = await choose(ctx, known.map((project) => ({ project })), what, false);
+  return relocate(ctx, await pathFor(ctx, m, o.needModule));
+}
+function relocate(ctx, path) {
+  if (path === ctx.deps.cwd) return ctx;
+  if (!ctx.opts().json) ctx.io.err(`\u2192 in ${path}`);
+  return withCwd(ctx, path);
+}
+async function rememberContext(ctx, mc, app) {
+  const tenantSlug = mc.module.tenant.slug;
+  if (mc.workspace && mc.workspace.appId === app.id) {
+    await remember(ctx.deps, {
+      kind: "workspace",
+      path: mc.workspace.root,
+      portal: mc.workspace.portal,
+      tenantSlug,
+      appId: app.id,
+      appSlug: app.slug
+    });
+    return;
+  }
+  if (mc.repoRoot) {
+    await remember(ctx.deps, {
+      kind: "module",
+      path: mc.repoRoot,
+      portal: mc.portal.apiOrigin,
+      tenantSlug,
+      appId: app.id,
+      appSlug: app.slug,
+      moduleId: mc.module.id,
+      moduleSlug: mc.module.slug
+    });
+  }
+}
+async function rememberWorkspace(ctx, ws, app) {
+  if (ws.appId !== app.id) return;
+  await remember(ctx.deps, { kind: "workspace", path: ws.root, portal: ws.portal, tenantSlug: app.tenant.slug, appId: app.id, appSlug: app.slug });
+}
+
 // src/cli/context.ts
 var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
+async function pick(ctx, err, message, choices) {
+  if (!ctx.io.interactive) throw err;
+  return ctx.io.select(message, choices);
+}
 async function moduleContextFor(ctx, flags, command) {
   const g = ctx.opts();
   const onRequest = g.verbose ? (l) => ctx.io.err(l) : void 0;
@@ -2933,14 +3374,16 @@ async function moduleContextFor(ctx, flags, command) {
   } catch (e) {
     if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" || !ctx.io.interactive) throw e;
     if (allOfKind(e.candidates, "module")) {
-      const choose = await ctx.io.select(
+      const choose2 = await pick(
+        ctx,
+        e,
         "Select a module",
         e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : ""}${c.slug}  (${c.remote})`, value: c.id }))
       );
-      return resolveModuleContext(ctx.deps, { ...base, choose });
+      return resolveModuleContext(ctx.deps, { ...base, choose: choose2 });
     }
     if (allOfKind(e.candidates, "tenant")) {
-      const tenant = await ctx.io.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
+      const tenant = await pick(ctx, e, "Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
       return resolveModuleContext(ctx.deps, { ...base, tenant });
     }
     throw e;
@@ -2951,7 +3394,7 @@ async function appFor(ctx, mc, app) {
     return pickApp2(mc, app);
   } catch (e) {
     if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
-    const id = await ctx.io.select("Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
+    const id = await pick(ctx, e, "Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
     return pickApp2(mc, id);
   }
 }
@@ -3145,9 +3588,9 @@ async function ensureTrusted(ctx, mc, app, o) {
 }
 
 // src/cli/commands/devWorkspace.ts
-import { randomBytes as randomBytes4 } from "crypto";
-import { realpath as realpath4 } from "fs/promises";
-import { join as join17, relative as relative5 } from "path";
+import { randomBytes as randomBytes5 } from "crypto";
+import { realpath as realpath7 } from "fs/promises";
+import { join as join20, relative as relative6 } from "path";
 
 // src/core/dev/order.ts
 function selectSkips(modules, sel) {
@@ -3283,8 +3726,8 @@ function exitCode(e) {
 }
 function supervise(o) {
   const now = o.now ?? Date.now;
-  const delay = o.delay ?? ((ms) => new Promise((r) => {
-    setTimeout(r, ms).unref();
+  const delay = o.delay ?? ((ms2) => new Promise((r) => {
+    setTimeout(r, ms2).unref();
   }));
   const abort = new AbortController();
   const emit = (e) => {
@@ -3304,15 +3747,15 @@ function supervise(o) {
   });
   const readiness = /* @__PURE__ */ new Map();
   for (const m of o.modules) {
-    let resolve5;
+    let resolve6;
     let settled = false;
     const promise = new Promise((r) => {
-      resolve5 = r;
+      resolve6 = r;
     });
     readiness.set(m.slug, { promise, settle: (r) => {
       if (settled) return false;
       settled = true;
-      resolve5(r);
+      resolve6(r);
       return true;
     } });
   }
@@ -3403,12 +3846,12 @@ function supervise(o) {
 }
 
 // src/core/workspace/stray.ts
-import { lstat as lstat2, readdir } from "fs/promises";
-import { join as join16 } from "path";
+import { lstat as lstat2, readdir as readdir3 } from "fs/promises";
+import { join as join19 } from "path";
 async function strayRepos(root, slugs) {
   let entries;
   try {
-    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = (await readdir3(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
@@ -3416,7 +3859,7 @@ async function strayRepos(root, slugs) {
   for (const name of entries) {
     if (slugs.has(name)) continue;
     try {
-      await lstat2(join16(root, name, ".git"));
+      await lstat2(join19(root, name, ".git"));
       names.push(name);
     } catch {
     }
@@ -3456,16 +3899,18 @@ function prefixer(slugs, color) {
 import { constants as constants2 } from "os";
 var childRunning = { current: false };
 function registerRun(program, ctx) {
-  program.command("run").description("Run a command with this module's local secrets in its environment").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--yes", "trust this repository without asking").argument("<command>", "the command to run (after --)").argument("[args...]", "its arguments, passed verbatim").action(async (cmd, args, f) => {
-    const { deps: deps2 } = ctx;
+  program.command("run").description("Run a command with this module's local secrets in its environment").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "the project whose secrets to use, from anywhere (see qore init)").option("--yes", "trust this repository without asking").argument("<command>", "the command to run (after --)").argument("[args...]", "its arguments, passed verbatim").action(async (cmd, args, f) => {
     if (ctx.opts().json) {
       throw new QoreError("QORE_CONTEXT_INVALID", "run has no --json output", {
         hint: "Drop --json; the child's own output passes through."
       });
     }
-    const mc = await moduleContextFor(ctx, f, "run");
-    const app = await appFor(ctx, mc, f.app);
-    await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true, command: "run" });
+    const { deps: deps2 } = c;
+    const mc = await moduleContextFor(c, f, "run");
+    const app = await appFor(c, mc, f.app);
+    await rememberContext(c, mc, app);
+    await ensureTrusted(c, mc, app, { yes: f.yes });
     const local = await fetchLocalEnv(deps2, mc, app);
     childRunning.current = true;
     let exit;
@@ -3499,7 +3944,9 @@ async function workspaceContext(ctx, ws) {
     const session = await openSession(deps2, portal, "dev", requestLog(ctx));
     await ensureCapability(deps2, portal.apiOrigin, "app.modules");
     await ensureCapability(deps2, portal.apiOrigin, "module.local-env");
-    return { am: await workspaceAppModules(session, portal, ws), online: { portal, session }, offlineCause: null };
+    const am = await workspaceAppModules(session, portal, ws);
+    await rememberWorkspace(ctx, ws, am.app);
+    return { am, online: { portal, session }, offlineCause: null };
   } catch (e) {
     if (!isOffline(e)) throw e;
     const last = await loadLastStart(deps2, ws.root);
@@ -3574,7 +4021,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
       continue;
     }
     try {
-      dirs[m.slug] = await deps2.git.inspect(join17(ws.root, m.slug));
+      dirs[m.slug] = await deps2.git.inspect(join20(ws.root, m.slug));
       safe.push(m);
     } catch (e) {
       if (!(e instanceof QoreError) || e.code === "QORE_GIT_UNAVAILABLE") throw e;
@@ -3611,7 +4058,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
     const results = await applyActions(deps2, { portal: online.portal, app: am, actions, protocol: cloneProtocol(dirs), onResult: () => {
     } });
     renderResults(io2, results, false);
-    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join17(ws.root, r.slug));
+    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join20(ws.root, r.slug));
     ({ present, plan } = computePlan());
   }
   for (const name of await strayRepos(ws.root, new Set(am.modules.map((m) => m.slug)))) renderFinding(ctx, strayClone(name, am.app.name));
@@ -3719,7 +4166,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
     workspace: ws,
     module: { id: u.m.id, slug: u.m.slug, name: u.m.name, type: u.m.type, access: u.m.access, tenant: am.app.tenant, apps: [appRef] }
   });
-  const rootReal = await realpath4(ws.root);
+  const rootReal = await realpath7(ws.root);
   const withDocker = dockerRecovery(ctx, p.signal);
   for (const u of units.filter((x) => x.recipe && x.trusted)) {
     const slug = u.m.slug;
@@ -3732,7 +4179,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
           type: u.m.type,
           moduleId: u.m.id,
           cfg: u.cfg,
-          random: () => randomBytes4(32).toString("hex")
+          random: () => randomBytes5(32).toString("hex")
         });
       } catch (e) {
         if (offlineCause && isOffline(e)) throw offlineCause;
@@ -3742,7 +4189,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
     const dev = u.dev;
     if (!dev) continue;
     if (online && dev.offline) {
-      warn(`${slug}: the portal is unreachable \u2014 starting from ${relative5(rootReal, dev.envFile)} as last written; values may be stale.`, { module: slug });
+      warn(`${slug}: the portal is unreachable \u2014 starting from ${relative6(rootReal, dev.envFile)} as last written; values may be stale.`, { module: slug });
     }
     if (dev.kept.length) {
       warn(
@@ -3750,7 +4197,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
         { module: slug, keys: dev.kept }
       );
     }
-    report({ module: slug, step: "env", status: "done", detail: relative5(rootReal, dev.envFile) });
+    report({ module: slug, step: "env", status: "done", detail: relative6(rootReal, dev.envFile) });
     const services = servicesMissing(slug, dev.env, u.recipe, { servicesFlag: f.services, configured: u.cfg.dev?.services !== void 0 });
     if (services) renderFinding(ctx, services);
     try {
@@ -3792,7 +4239,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
   if (online && units.every((u) => !u.dev.offline)) {
     const envFile = (m) => {
       const u = units.find((x) => x.m.id === m.id);
-      return u ? relative5(rootReal, u.dev.envFile) : join17(m.slug, moduleDefaults(m.type).envFile);
+      return u ? relative6(rootReal, u.dev.envFile) : join20(m.slug, moduleDefaults(m.type).envFile);
     };
     await saveLastStart(deps2, ws.root, {
       schemaVersion: 1,
@@ -3981,11 +4428,17 @@ function makeStderrTee(sink) {
   };
 }
 function registerDev(program, ctx) {
-  program.command("dev").description("Start this module's dev server \u2014 or, in a workspace root, every module of the app").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--only <slugs>", "workspace: start only these modules (comma-separated)").option("--skip <slugs>", "workspace: start all but these modules (comma-separated)").option("--no-install", "do not run the package manager's install").option("--no-services", "do not start local services (db:up)").option("--kill-others", "workspace: the first module to exit stops the rest").option("--wait-timeout <s>", "workspace: seconds to wait for a provider's port", "60").option("--yes", "trust the repositories without asking").action(async (f) => {
+  program.command("dev").description("Start this module's dev server \u2014 or, in a workspace root, every module of the app").argument("[project]", "app or app/module to start, from anywhere (see qore init)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "same as the [project] argument").option("--only <slugs>", "workspace: start only these modules (comma-separated)").option("--skip <slugs>", "workspace: start all but these modules (comma-separated)").option("--no-install", "do not run the package manager's install").option("--no-services", "do not start local services (db:up)").option("--kill-others", "workspace: the first module to exit stops the rest").option("--wait-timeout <s>", "workspace: seconds to wait for a provider's port", "60").option("--yes", "trust the repositories without asking").action(async (project, f) => {
     const waitTimeout = parseWaitTimeout(f.waitTimeout);
-    const ws = await workspaceRoot(ctx.deps);
-    if (ws && f.module === void 0) return workspaceDev(ctx, ws, f, waitTimeout);
-    return moduleDev(ctx, f, waitTimeout);
+    if (project !== void 0 && f.project !== void 0 && project !== f.project) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Pass the project once: "${project}" and --project "${f.project}" differ`, {
+        hint: "qore dev <project> | qore dev --project <project>"
+      });
+    }
+    const c = await projectCtx(ctx, { ref: project ?? f.project, module: f.module, app: f.app, needModule: false, command: "dev" });
+    const ws = await workspaceRoot(c.deps);
+    if (ws && f.module === void 0) return workspaceDev(c, ws, f, waitTimeout);
+    return moduleDev(c, f, waitTimeout);
   });
 }
 function parseWaitTimeout(raw) {
@@ -4025,7 +4478,7 @@ async function providerFindings(ctx, root, mc, app, env) {
     let fix = `qore clone ${app.slug}`;
     if (ws && ws.appId === app.id) fix = cdAndDev(deps2.home, ws.root);
     else if (providers.length === 1) {
-      const sibling = join18(dirname6(root), providers[0].slug);
+      const sibling = join21(dirname7(root), providers[0].slug);
       if ((await deps2.git.inspect(sibling)).isRepo) fix = cdAndDev(deps2.home, sibling);
     }
     return providerDown({
@@ -4059,6 +4512,7 @@ async function devContext(ctx, f, root) {
     return { online: null, module: last.module, offlineCause: e };
   }
   const app = await appFor(ctx, mc, f.app);
+  await rememberContext(ctx, mc, app);
   await ensureTrusted(ctx, mc, app, { yes: f.yes });
   return { online: { mc, app }, module: mc.module, offlineCause: null };
 }
@@ -4086,9 +4540,9 @@ async function moduleDev(ctx, f, waitTimeout) {
     childRunning.current = false;
     await removeRunFile(deps2, root);
   }
-  const ms = deps2.now().getTime() - startedAt.getTime();
+  const ms2 = deps2.now().getTime() - startedAt.getTime();
   if (exit.code !== 0 && exit.signal === null) {
-    io2.err(ms < EARLY_EXIT_MS ? `\u2717 ${slug} exited after ${Math.round(ms / 1e3)} s with code ${exit.code ?? 1} \u2014 its output above says why.` : `\u2717 ${slug} exited with code ${exit.code ?? 1}.`);
+    io2.err(ms2 < EARLY_EXIT_MS ? `\u2717 ${slug} exited after ${Math.round(ms2 / 1e3)} s with code ${exit.code ?? 1} \u2014 its output above says why.` : `\u2717 ${slug} exited with code ${exit.code ?? 1}.`);
     const hint = exitHint(tee.lines(), hintContext(recipe, pkg, devEnv2));
     if (hint) io2.err(`  \u2192 ${hint.hint}`);
   }
@@ -4154,13 +4608,13 @@ async function prepareModule(ctx, f, waitTimeout, p) {
       type: c.module.type,
       moduleId: c.module.id,
       cfg,
-      random: () => randomBytes5(32).toString("hex")
+      random: () => randomBytes6(32).toString("hex")
     });
   } catch (e) {
     if (c.offlineCause && isOffline(e)) throw c.offlineCause;
     throw e;
   }
-  const envFile = relative6(await realpath5(root), dev.envFile);
+  const envFile = relative7(await realpath8(root), dev.envFile);
   if (dev.offline) io2.err(`! The portal is unreachable \u2014 starting from ${envFile} as last written; values may be stale.`);
   if (dev.kept.length) {
     io2.err(`! ${dev.kept.length} key(s) differ locally and were kept: ${dev.kept.join(", ")} \u2014 qore env pull --use-portal takes the portal's values`);
@@ -4218,8 +4672,8 @@ function registerDebugTelemetry(program, ctx) {
 import pc3 from "picocolors";
 
 // src/core/doctor/checks.ts
-import { realpath as realpath6 } from "fs/promises";
-import { basename as basename3, join as join19 } from "path";
+import { realpath as realpath9, stat as stat5 } from "fs/promises";
+import { basename as basename3, join as join22 } from "path";
 
 // src/core/diagnostics/ssh.ts
 var SSH_TEST_ARGS = ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "git@github.com"];
@@ -4264,24 +4718,24 @@ var UPGRADE = "npm i -g @quatronic/qore";
 var RANK = { ok: 0, warn: 1, fail: 2 };
 var noop = () => {
 };
-var ok = (label2, details) => ({ status: "ok", label: label2, ...details ? { details } : {} });
-var withError = (status2, label2, e) => ({ status: status2, label: label2, error: toJsonError(e) });
+var ok = (label3, details) => ({ status: "ok", label: label3, ...details ? { details } : {} });
+var withError = (status2, label3, e) => ({ status: status2, label: label3, error: toJsonError(e) });
 var isCancel = (e, signal) => e instanceof CancelledError || signal.aborted;
 var portalLabel = (p) => p.builtin ?? p.apiOrigin;
 var ToolTimeout = class extends Error {
-  constructor(tool, ms) {
-    super(`${tool} did not answer within ${Math.round(ms / 1e3)} s`);
+  constructor(tool, ms2) {
+    super(`${tool} did not answer within ${Math.round(ms2 / 1e3)} s`);
     this.tool = tool;
-    this.ms = ms;
+    this.ms = ms2;
   }
   tool;
   ms;
 };
-async function timed(tool, signal, ms, fn) {
+async function timed(tool, signal, ms2, fn) {
   try {
-    return await fn(AbortSignal.any([signal, AbortSignal.timeout(ms)]));
+    return await fn(AbortSignal.any([signal, AbortSignal.timeout(ms2)]));
   } catch (e) {
-    if (e instanceof CancelledError && !signal.aborted) throw new ToolTimeout(tool, ms);
+    if (e instanceof CancelledError && !signal.aborted) throw new ToolTimeout(tool, ms2);
     throw e;
   }
 }
@@ -4312,8 +4766,8 @@ function checkOwnNode(deps2) {
   }
   return ok(`Node ${v} (\u226522 required)`);
 }
-async function checkGit(deps2, signal, ms) {
-  const res = await timed("git", signal, ms, (s) => runTool(deps2, "git", ["--version"], { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
+async function checkGit(deps2, signal, ms2) {
+  const res = await timed("git", signal, ms2, (s) => runTool(deps2, "git", ["--version"], { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
   if (res.spawnError === "ENOENT") {
     const e = new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
       hint: "Install git (https://git-scm.com/downloads) and open a new terminal."
@@ -4327,14 +4781,14 @@ async function checkGit(deps2, signal, ms) {
   const m = /git version (\d+)\.(\d+)/.exec(res.tail.join("\n"));
   return ok(m ? `git ${m[1]}.${m[2]}` : "git");
 }
-async function checkGithubSsh(deps2, signal, ms) {
-  const res = await timed("ssh", signal, ms, (s) => runTool(deps2, "ssh", SSH_TEST_ARGS, { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
+async function checkGithubSsh(deps2, signal, ms2) {
+  const res = await timed("ssh", signal, ms2, (s) => runTool(deps2, "ssh", SSH_TEST_ARGS, { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
   const r = classifySshTest(res);
   if (r.ok) return ok(`GitHub SSH ok (${r.user})`, { user: r.user });
   return withError("warn", `GitHub SSH: ${r.error.message} (https still works)`, r.error);
 }
-async function checkDocker(deps2, signal, ms) {
-  return timed("docker", signal, ms, async (s) => {
+async function checkDocker(deps2, signal, ms2) {
+  return timed("docker", signal, ms2, async (s) => {
     const o = { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s };
     const info = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], o);
     const infoErr = classifyDockerInfo(info, deps2.platform);
@@ -4401,7 +4855,7 @@ function ownerText(e) {
   if (d.owner === "qore") return ` by a previous qore dev (pid ${String(d.pid)})`;
   return "";
 }
-var sameDir = async (a, b) => await realpath6(a).catch(() => a) === await realpath6(b).catch(() => b);
+var sameDir = async (a, b) => await realpath9(a).catch(() => a) === await realpath9(b).catch(() => b);
 async function moduleBody(deps2, m, runs, signal) {
   const parts = [];
   const part = async (fn) => {
@@ -4466,16 +4920,16 @@ function runsAt(deps2, root) {
   return () => p ??= leftoverRun(deps2, root, { prune: false }).then((r) => r ? [r] : []);
 }
 var UNTRUSTED = { status: "warn", label: "not checked (repository not trusted)" };
-async function checkRepoPm(deps2, m, recipe, signal, ms) {
+async function checkRepoPm(deps2, m, recipe, signal, ms2) {
   if (!await isTrusted(deps2, m.root, m.id)) return UNTRUSTED;
-  const found = await timed(recipe.pm.name, signal, ms, (s) => checkPackageManager(deps2, recipe, noop, s));
+  const found = await timed(recipe.pm.name, signal, ms2, (s) => checkPackageManager(deps2, recipe, noop, s));
   const { name, version } = recipe.pm;
   if (found === null) return ok(`${name} (version unknown)`);
   return ok(version ? `${name} ${found} (matches)` : `${name} ${found}`, { found, ...version ? { pinned: version } : {} });
 }
-async function checkRepoNode(deps2, m, recipe, pkg, signal, ms) {
+async function checkRepoNode(deps2, m, recipe, pkg, signal, ms2) {
   if (!await isTrusted(deps2, m.root, m.id)) return UNTRUSTED;
-  const found = await timed("node", signal, ms, (s) => checkNode(deps2, recipe, pkg, m.slug, s));
+  const found = await timed("node", signal, ms2, (s) => checkNode(deps2, recipe, pkg, m.slug, s));
   return ok(`Node ${found ?? "?"} (engines ${pkg.engines.node})`);
 }
 async function loggedInPortals(deps2, profiles) {
@@ -4499,6 +4953,15 @@ async function resolveRepoModule(deps2, session, portal, meta, root) {
   }
   return session.api.get(`/api/cli/v1/modules/${encodeURIComponent(ids[0])}`);
 }
+async function checkProjectsRoot(cfg) {
+  const root = cfg?.projectsRoot;
+  if (!root) return ok("projects folder not set (optional \u2014 qore init)");
+  const s = await stat5(root).catch(() => null);
+  if (!s?.isDirectory()) return { status: "warn", label: `projects folder ${root} does not exist \u2014 qore init` };
+  const e = await writableError(root);
+  if (e) return { status: "fail", label: `projects folder ${root} is not writable (${e.code ?? e.message})` };
+  return ok(`projects folder ${root}`);
+}
 function checkTelemetry(deps2, cfg) {
   const built = deps2.sentryDsn !== "";
   if (!cfg) return ok("crash reports off (config unreadable)", { enabled: false, source: "config", reason: "unreadable", built });
@@ -4554,6 +5017,7 @@ async function runDoctor(deps2, o = {}) {
   await push("github-ssh", "tools", () => checkGithubSsh(deps2, signal, toolMs));
   await push("docker", "tools", () => checkDocker(deps2, signal, toolMs));
   await push("telemetry", "tools", () => checkTelemetry(deps2, cfgReadable ? cfg : null));
+  await push("projects-root", "tools", () => checkProjectsRoot(cfgReadable ? cfg : null));
   const sessions = /* @__PURE__ */ new Map();
   let loggedIn = [];
   try {
@@ -4646,7 +5110,7 @@ async function workspaceModule(deps2, ws, am, m, runs, signal, push, perModule)
     await push(`module:${m.slug}`, "workspace", () => ({ status: "warn", label: "not a safe directory name \u2014 skipped" }), m.slug);
     return;
   }
-  const mod = { root: join19(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
+  const mod = { root: join22(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
   let prepared = null;
   await push(`module:${m.slug}`, "workspace", async () => {
     const info = await deps2.git.inspect(mod.root);
@@ -4676,26 +5140,28 @@ function registerDoctor(program, ctx) {
 }
 
 // src/cli/commands/env.ts
-import { randomBytes as randomBytes6 } from "crypto";
-import { chmod as chmod3, realpath as realpath7 } from "fs/promises";
-import { dirname as dirname7, join as join20, relative as relative7 } from "path";
+import { randomBytes as randomBytes7 } from "crypto";
+import { chmod as chmod3, realpath as realpath10 } from "fs/promises";
+import { dirname as dirname8, join as join23, relative as relative8 } from "path";
 var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
 function registerEnv(program, ctx) {
   const env = program.command("env").description("Local environment");
-  env.command("pull").description("Write this module's local secrets into its env file").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--target <path>", "env file to write (inside the repository)").option("--use-portal", "take the portal's value for keys that differ locally").option("--yes", "trust this repository without asking").action(async (f) => {
-    const { deps: deps2, io: io2 } = ctx;
-    const g = ctx.opts();
-    const mc = await moduleContextFor(ctx, f, "env pull");
+  env.command("pull").description("Write this module's local secrets into its env file").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "the project to pull for, from anywhere (see qore init)").option("--target <path>", "env file to write (inside the repository)").option("--use-portal", "take the portal's value for keys that differ locally").option("--yes", "trust this repository without asking").action(async (f) => {
+    const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true, command: "env pull" });
+    const { deps: deps2, io: io2 } = c;
+    const g = c.opts();
+    const mc = await moduleContextFor(c, f, "env pull");
     if (!mc.repoRoot) {
       throw new QoreError("QORE_CONTEXT_REQUIRED", "env pull writes into a module repository", { hint: "cd into the module's repository." });
     }
-    const app = await appFor(ctx, mc, f.app);
+    const app = await appFor(c, mc, f.app);
+    await rememberContext(c, mc, app);
     const cfg = await readRepoConfig(mc.repoRoot);
     const defaults = moduleDefaults(mc.module.type);
     const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
-    await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    await ensureTrusted(c, mc, app, { yes: f.yes });
     const existing = await readOrNull(target);
-    const example = existing === null ? await readOrNull(join20(dirname7(target), ".env.example")) : null;
+    const example = existing === null ? await readOrNull(join23(dirname8(target), ".env.example")) : null;
     const local = await fetchLocalEnv(deps2, mc, app);
     const inputs = {
       existing,
@@ -4704,7 +5170,7 @@ function registerEnv(program, ctx) {
       managed: local.managedKeys,
       localSecrets: cfg.localSecrets ?? defaults.localSecrets,
       defaultChoice: f.usePortal ? "use-portal" : "keep",
-      random: () => randomBytes6(32).toString("hex")
+      random: () => randomBytes7(32).toString("hex")
     };
     let plan = planPull(inputs);
     if (plan.conflicts.length && io2.interactive && !f.usePortal) {
@@ -4716,7 +5182,7 @@ function registerEnv(program, ctx) {
           choices[key] = bulk;
           continue;
         }
-        const pick = await io2.select(
+        const pick2 = await io2.select(
           `${key} differs  (local ${maskLen(current.get(key))}, portal ${maskLen(local.env[key])})`,
           [
             { name: "keep local", value: "keep" },
@@ -4725,9 +5191,9 @@ function registerEnv(program, ctx) {
             { name: "keep local for all", value: "skip" }
           ]
         );
-        if (pick === "all") bulk = "use-portal";
-        if (pick === "skip") bulk = "keep";
-        choices[key] = pick === "portal" || pick === "all" ? "use-portal" : "keep";
+        if (pick2 === "all") bulk = "use-portal";
+        if (pick2 === "skip") bulk = "keep";
+        choices[key] = pick2 === "portal" || pick2 === "all" ? "use-portal" : "keep";
       }
       plan = planPull({ ...inputs, choices });
     }
@@ -4736,7 +5202,7 @@ function registerEnv(program, ctx) {
     } else {
       await writeSecurely(target, plan.text);
     }
-    const rel = relative7(await realpath7(mc.repoRoot), target);
+    const rel = relative8(await realpath10(mc.repoRoot), target);
     if (g.json) {
       const names = {
         created: plan.created,
@@ -4765,9 +5231,486 @@ function registerEnv(program, ctx) {
   });
 }
 
+// src/core/observability/compose.ts
+function pageWarnings(...pages) {
+  return pages.some((p) => p.ingestPaused) ? ["ingest_paused"] : [];
+}
+function scope(q) {
+  const s = { env: q.env };
+  if (q.since !== void 0) s.since = q.since;
+  if (q.start !== void 0) s.start = q.start;
+  if (q.end !== void 0) s.end = q.end;
+  return s;
+}
+async function errorDetail(c, id, q, withs) {
+  const w = scope(q);
+  const markdown = await c.issueMarkdown(id, w);
+  const event = await c.issueEvent(id, w);
+  const out = { issue: { markdown, event }, warnings: [] };
+  if (withs.size === 0) return out;
+  if (!event.traceId) {
+    out.warnings.push("no_trace_id");
+    return out;
+  }
+  if (withs.has("trace")) out.trace = await c.trace(event.traceId, w);
+  if (withs.has("logs")) {
+    const logs = await c.logs({ ...w, trace: event.traceId, limit: 100 });
+    out.logs = logs.items;
+    out.warnings.push(...pageWarnings(logs));
+  }
+  return out;
+}
+async function traceDetail(c, id, q, withs) {
+  const w = scope(q);
+  const out = { trace: await c.trace(id, w), warnings: [] };
+  const pages = [];
+  if (withs.has("logs")) {
+    const p = await c.logs({ ...w, trace: id, limit: 100 });
+    out.logs = p.items;
+    pages.push(p);
+  }
+  if (withs.has("errors")) {
+    const p = await c.issues({ ...w, trace: id, status: "all" });
+    out.errors = p.items;
+    pages.push(p);
+  }
+  out.warnings.push(...pageWarnings(...pages));
+  return out;
+}
+
+// src/core/observability/client.ts
+var MAX_RETRY_WAIT_S = 30;
+var NOT_PROVISIONED = "observability_not_provisioned";
+var wait = (ms2) => new Promise((r) => setTimeout(r, ms2));
+var ObsClient = class {
+  constructor(api, moduleId, sleep = wait, slug = moduleId) {
+    this.api = api;
+    this.moduleId = moduleId;
+    this.sleep = sleep;
+    this.slug = slug;
+  }
+  api;
+  moduleId;
+  sleep;
+  slug;
+  path(resource, o, extra = {}) {
+    const p = new URLSearchParams();
+    const all = { env: o.env, since: o.since, start: o.start, end: o.end, q: o.q, limit: o.limit, ...extra };
+    for (const [k, v] of Object.entries(all)) if (v !== void 0 && v !== "") p.set(k, String(v));
+    return `/api/cli/v1/modules/${encodeURIComponent(this.moduleId)}/observability/${resource}?${p}`;
+  }
+  async call(fn) {
+    try {
+      return await this.retryOnce(fn);
+    } catch (e) {
+      if (e instanceof QoreError && e.code === "QORE_ACCESS_DENIED" && e.serverCode === "auth.scope.insufficient") {
+        throw new QoreError("QORE_ACCESS_DENIED", "This login predates `qore errors/traces/logs`", {
+          hint: "Run `qore login` again.",
+          status: e.status,
+          requestId: e.requestId,
+          serverCode: e.serverCode
+        });
+      }
+      if (e instanceof QoreError && e.serverCode === NOT_PROVISIONED) {
+        throw new QoreError("QORE_RESOURCE_NOT_FOUND", `Module "${this.slug}" does not report to Sentry yet`, {
+          hint: "Its Sentry project is not provisioned; pick another module with --module.",
+          status: e.status,
+          requestId: e.requestId,
+          serverCode: e.serverCode,
+          details: e.details
+        });
+      }
+      throw e;
+    }
+  }
+  async retryOnce(fn) {
+    try {
+      return await fn();
+    } catch (e) {
+      if (!(e instanceof QoreError) || e.code !== "QORE_RATE_LIMITED") throw e;
+      const secs2 = typeof e.details?.retryAfter === "number" ? e.details.retryAfter : 1;
+      await this.sleep(Math.min(secs2, MAX_RETRY_WAIT_S) * 1e3);
+      return fn();
+    }
+  }
+  issues(o) {
+    return this.call(() => this.api.get(this.path("issues", o, { status: o.status, sort: o.sort, trace: o.trace })));
+  }
+  issueMarkdown(id, o) {
+    return this.call(() => this.api.getText(this.path(`issues/${encodeURIComponent(id)}/markdown`, { env: o.env, since: o.since, start: o.start, end: o.end }, { event: "recommended" })));
+  }
+  issueEvent(id, o) {
+    return this.call(() => this.api.get(this.path(`issues/${encodeURIComponent(id)}/events/recommended`, { env: o.env, since: o.since, start: o.start, end: o.end })));
+  }
+  logs(o) {
+    return this.call(() => this.api.get(this.path("logs", o, { level: o.level, trace: o.trace })));
+  }
+  spans(o) {
+    return this.call(() => this.api.get(this.path("spans", o, { sort: o.sort })));
+  }
+  trace(id, o) {
+    return this.call(() => this.api.get(this.path(`traces/${encodeURIComponent(id)}`, { env: o.env, since: o.since, start: o.start, end: o.end })));
+  }
+};
+
+// src/core/observability/query.ts
+var ROOT_SPAN_FILTER = "is_transaction:true";
+var DURATION = /^\d{1,6}(ms|s|m)$/;
+var SINCE = /^(\d{1,4})([mhdw])$/;
+var SECONDS = { m: 60, h: 3600, d: 86400, w: 604800 };
+function parseDuration(s) {
+  if (!DURATION.test(s)) throw new QoreError("QORE_CONTEXT_INVALID", `"${s}" is not a duration`, { hint: "Use e.g. 500ms, 1s or 2m." });
+  return s;
+}
+function parseSince(s) {
+  const m = SINCE.exec(s);
+  if (!m || Number(m[1]) * SECONDS[m[2]] > 90 * 86400) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `"${s}" is not a time window`, { hint: "Use a count plus m, h, d or w, at most 90 days (e.g. 24h, 7d)." });
+  }
+  return s;
+}
+function joinQuery(...parts) {
+  const q = parts.filter((p) => typeof p === "string" && p.length > 0).join(" ");
+  return q || void 0;
+}
+
+// src/cli/observability/context.ts
+var ALL = { kind: "module", slug: "all", name: "All modules" };
+var modCandidates = (mods, withAll) => [...mods.map((m) => ({ kind: "module", id: m.id, slug: m.slug, name: m.name })), ...withAll ? [ALL] : []];
+function withRepo(mods) {
+  const r = mods.filter((m) => m.repoUrl !== null);
+  if (r.length === 0) throw new QoreError("QORE_RESOURCE_NOT_FOUND", "No modules with a repository in this app");
+  return r;
+}
+function windowOf(f) {
+  if (Boolean(f.start) !== Boolean(f.end)) throw new QoreError("QORE_CONTEXT_INVALID", "--start and --end go together; pass both");
+  if (f.start || f.end) return { start: f.start, end: f.end };
+  return { since: parseSince(f.since ?? "24h") };
+}
+var windowText = (w) => w.since ? `last ${w.since}` : `${w.start ?? "\u2026"} \u2013 ${w.end ?? "now"}`;
+async function chooseModule(ctx, mods, flag, single) {
+  if (flag === "all" && !single) return mods;
+  if (flag && flag !== "all") {
+    const m = mods.find((x) => x.slug === flag || x.id === flag);
+    if (m) return [m];
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `No module "${flag}" in this app`, { candidates: modCandidates(mods, !single) });
+  }
+  const err = new QoreError(
+    "QORE_CONTEXT_REQUIRED",
+    single && flag === "all" ? "A detail view needs one module" : "Which module?",
+    { candidates: modCandidates(mods, !single), hint: "Pass --module <slug>" + (single ? "." : " or --module all.") }
+  );
+  if (flag === "all") throw err;
+  const choice = await pick(
+    ctx,
+    err,
+    "Select a module",
+    [...mods.map((m) => ({ name: m.slug, value: m.id })), ...single ? [] : [{ name: "All modules", value: "all" }]]
+  );
+  return choice === "all" ? mods : mods.filter((m) => m.id === choice);
+}
+async function chooseEnv(ctx, api, moduleId, appId, flag) {
+  const st = await api.get(`/api/cli/v1/modules/${encodeURIComponent(moduleId)}/status?app_id=${encodeURIComponent(appId)}`);
+  const names = st.environments.map((e) => e.name);
+  if (names.length === 0) throw new QoreError("QORE_RESOURCE_NOT_FOUND", "No environments yet");
+  const candidates = names.map((n) => ({ kind: "env", slug: n }));
+  if (flag) {
+    if (names.includes(flag)) return flag;
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `Unknown environment "${flag}"`, { candidates, hint: `Pass --env ${names.join("|")}.` });
+  }
+  const err = new QoreError("QORE_CONTEXT_REQUIRED", "Which environment?", { candidates, hint: `Pass --env ${names.join("|")}.` });
+  return pick(ctx, err, "Select an environment", names.map((n) => ({ name: n, value: n })));
+}
+async function obsContext(ctx, flags, command, o) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const window = windowOf(flags);
+  const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+  const ws = flags.module === void 0 || flags.module === "all" ? await workspaceRoot(deps2) : null;
+  let api, tenant, app, mods, base, apiOrigin;
+  if (ws) {
+    const portal = await flagPortal(deps2, g.portal, ws);
+    apiOrigin = portal.apiOrigin;
+    const session = await openSession(deps2, portal, command, onRequest);
+    await ensureCapability(deps2, apiOrigin, "module.observability");
+    await ensureCapability(deps2, apiOrigin, "app.modules");
+    const am = await workspaceAppModules(session, portal, ws);
+    api = session.api;
+    ({ tenant } = am.app);
+    app = { id: am.app.id, slug: am.app.slug, name: am.app.name };
+    mods = await chooseModule(ctx, withRepo(am.modules), flags.module, o.single);
+    base = { portal: portal.builtin ?? portal.apiOrigin, tenant, app, source: WORKSPACE_FILE };
+  } else {
+    const mc = await moduleContextFor(ctx, { module: flags.module === "all" ? void 0 : flags.module }, command);
+    apiOrigin = mc.portal.apiOrigin;
+    await ensureCapability(deps2, apiOrigin, "module.observability");
+    app = await appFor(ctx, mc, flags.app);
+    api = mc.session.api;
+    tenant = mc.module.tenant;
+    if (flags.module === "all") {
+      if (o.single) throw new QoreError(
+        "QORE_CONTEXT_REQUIRED",
+        "A detail view needs one module",
+        { candidates: [{ kind: "module", id: mc.module.id, slug: mc.module.slug, name: mc.module.name }] }
+      );
+      await ensureCapability(deps2, apiOrigin, "app.modules");
+      const am = await api.get(`/api/cli/v1/apps/${encodeURIComponent(app.id)}/modules`);
+      mods = withRepo(am.modules);
+    } else {
+      mods = [mc.module];
+    }
+    base = contextJson(mc, app);
+    delete base.module;
+  }
+  await ensureCapability(deps2, apiOrigin, "module.status");
+  const env = await chooseEnv(ctx, api, mods[0].id, app.id, flags.env);
+  const fanOut2 = mods.length > 1 || flags.module === "all";
+  const targets = mods.map((m) => ({ module: { id: m.id, slug: m.slug, name: m.name, type: m.type, access: m.access }, client: new ObsClient(api, m.id, void 0, m.slug) }));
+  const where = fanOut2 ? "all modules" : mods[0].slug;
+  return {
+    targets,
+    fanOut: fanOut2,
+    env,
+    window,
+    header: `\u2192 ${tenant.name} / ${app.name} / ${where}  \xB7  ${env}  \xB7  ${windowText(window)}`,
+    json: { ...base, ...fanOut2 ? { modules: targets.map((t) => t.module) } : { module: targets[0].module }, env, window }
+  };
+}
+
+// src/cli/format.ts
+function ago(iso, now) {
+  if (!iso) return "\u2013";
+  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1e3));
+  if (s < 60) return "just now";
+  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
+  return `${Math.floor(s / 86400)}d ago`;
+}
+var pct = (f) => String(Number((f * 100).toFixed(2)));
+function uptime(h) {
+  if (!h) return "\u2013";
+  const kind = h.cause && h.kind !== "up" ? `${h.kind}: ${h.cause}` : h.kind;
+  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`;
+}
+function table(rows) {
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => (r[i] ?? "").length)));
+  return rows.map((r) => "  " + r.map((c, i) => i === r.length - 1 ? c : c.padEnd(widths[i])).join("  "));
+}
+
+// src/cli/observability/render.ts
+var CONTROL = /[\x00-\x08\x0b-\x1f\x7f\x80-\x9f]/g;
+var clean = (s) => s.replace(CONTROL, "");
+function fence(content) {
+  const lines = content.map(clean);
+  const longest = Math.max(0, ...lines.flatMap((l) => (l.match(/`+/g) ?? []).map((r) => r.length)));
+  const ticks = "`".repeat(Math.max(3, longest + 1));
+  return [`${ticks}untrusted-data`, ...lines, ticks];
+}
+function ms(n) {
+  return n < 1e3 ? `${Math.round(n)}ms` : `${(n / 1e3).toFixed(1)}s`;
+}
+var oneLine = (s) => clean((s ?? "").replace(/\s+/g, " ")).trim();
+function issuesTable(items, now, withModule) {
+  const head = ["ID", "LEVEL", "EVENTS", "USERS", "LAST SEEN", "TITLE"];
+  const rows = items.map((i) => [oneLine(i.shortId), oneLine(i.level), String(i.count), String(i.userCount), ago(i.lastSeen, now), oneLine(i.title)]);
+  return table(withModule ? [["MODULE", ...head], ...rows.map((r, n) => [oneLine(items[n].module.slug), ...r])] : [head, ...rows]);
+}
+function spansTable(items, now, withModule) {
+  const head = ["TRACE", "DURATION", "ROOT", "WHEN"];
+  const rows = items.map((s) => [oneLine(s.traceId), ms(s.durationMs), oneLine(s.transaction ?? s.description ?? s.name), ago(s.timestamp, now)]);
+  return table(withModule ? [["MODULE", ...head], ...rows.map((r, n) => [oneLine(items[n].module.slug), ...r])] : [head, ...rows]);
+}
+function logLines(items, withModule) {
+  return items.map((l) => [oneLine(l.timestamp), oneLine(l.severity).toUpperCase(), ...withModule ? [oneLine(l.module.slug)] : [], oneLine(l.message)].join(" "));
+}
+function spanTree(t) {
+  const all = [];
+  const walk = (n) => {
+    all.push(n);
+    n.children.forEach(walk);
+  };
+  t.roots.forEach(walk);
+  const slowest = all.reduce((a, n) => !a || n.end - n.start > a.end - a.start ? n : a, null);
+  const out = [];
+  const line2 = (n, depth) => {
+    const label3 = [oneLine(n.op), oneLine(n.description ?? n.transaction)].filter(Boolean).join(" ");
+    const errs = n.errors.map((e) => `\u2716 ${oneLine(e.shortId ?? e.eventId)}`).join(" ");
+    out.push([
+      `${"  ".repeat(depth)}${label3}`,
+      ms((n.end - n.start) * 1e3),
+      `[${oneLine(n.module.slug)}]`,
+      ...n === slowest ? ["\u25C0 slowest"] : [],
+      ...errs ? [errs] : []
+    ].join("  "));
+    n.children.forEach((c) => line2(c, depth + 1));
+  };
+  t.roots.forEach((r) => line2(r, 0));
+  return out;
+}
+var WARN = {
+  ingest_paused: "! This tenant's Sentry quota is reached; new events are not being recorded.",
+  no_trace_id: "! This error has no trace id, so there is no trace or trace logs to show.",
+  sort_unavailable: "! Sorting by duration is not available here; showing the slowest of the most recent matches.",
+  module_not_provisioned: "! Skipped, not reporting to Sentry yet:"
+};
+function warningLines(w, skipped = []) {
+  return [...new Set(w)].map((k) => k === "module_not_provisioned" ? `${WARN[k]} ${skipped.join(", ")}` : WARN[k]);
+}
+
+// src/cli/observability/flags.ts
+function addObsFlags(cmd) {
+  return cmd.option("--env <name>", "the environment (required; prompted when interactive)").option("--module <slug|all>", "the module (default: this repository); all = every module of the app").option("--app <slug|id>", "the app, when the module is part of several").option("--since <window>", "time window, e.g. 1h, 24h, 7d (default 24h)").option("--start <iso>", "window start (use with --end, instead of --since)").option("--end <iso>", "window end (use with --start, instead of --since)").option("--query <search>", "Sentry search syntax, appended to the filter").option("--limit <n>", "rows per module, 1-100 (default 25)");
+}
+function limitOf(s) {
+  if (s === void 0) return 25;
+  const n = Number(s);
+  if (!Number.isInteger(n) || n < 1 || n > 100) throw new QoreError("QORE_CONTEXT_INVALID", `--limit must be 1-100, not "${s}"`);
+  return n;
+}
+function withList(s, allowed) {
+  if (!s) return /* @__PURE__ */ new Set();
+  const parts = s.split(",").map((p) => p.trim()).filter(Boolean);
+  const bad = parts.filter((p) => !allowed.includes(p));
+  if (bad.length) throw new QoreError("QORE_CONTEXT_INVALID", `--with accepts ${allowed.join(", ")}; not ${bad.join(", ")}`);
+  return new Set(parts);
+}
+function one(flag, value, allowed) {
+  if (!allowed.includes(value)) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `${flag} must be ${allowed.join("|")}, not "${value}"`);
+  }
+  return value;
+}
+async function fanOut(oc2, fn) {
+  const out = { results: [], skipped: [] };
+  let last;
+  for (const target of oc2.targets) {
+    try {
+      out.results.push({ target, result: await fn(target) });
+    } catch (e) {
+      if (oc2.targets.length < 2 || !(e instanceof QoreError) || e.serverCode !== NOT_PROVISIONED) throw e;
+      out.skipped.push({ id: target.module.id, slug: target.module.slug });
+      last = e;
+    }
+  }
+  if (out.results.length === 0 && last) {
+    throw new QoreError("QORE_RESOURCE_NOT_FOUND", "No module of this app reports to Sentry yet", {
+      serverCode: NOT_PROVISIONED,
+      details: { modules: out.skipped.map((m) => m.slug) }
+    });
+  }
+  return out;
+}
+var skipWarnings = (f) => f.skipped.length ? ["module_not_provisioned"] : [];
+var skipJson = (f) => f.skipped.length ? { unprovisionedModules: f.skipped } : {};
+function printWarnings(io2, w, json2, skipped = []) {
+  if (!json2) for (const l of warningLines(w, skipped.map((m) => m.slug))) io2.err(l);
+}
+
+// src/cli/commands/errors.ts
+var WITHS = ["trace", "logs"];
+var STATUSES = ["unresolved", "resolved", "all"];
+var SORTS = ["date", "freq", "new"];
+var MERGE = {
+  date: (a, b) => b.lastSeen.localeCompare(a.lastSeen),
+  freq: (a, b) => b.count - a.count,
+  new: (a, b) => b.firstSeen.localeCompare(a.firstSeen)
+};
+function printDetail(ctx, oc2, d, showIssue) {
+  const { io: io2 } = ctx;
+  printWarnings(io2, d.warnings, false);
+  if (showIssue) for (const l of fence(d.issue.markdown.split("\n"))) io2.out(l);
+  if (d.trace) {
+    io2.out("");
+    io2.out("Trace");
+    for (const l of fence(spanTree(d.trace))) io2.out(l);
+  }
+  if (d.logs) {
+    io2.out("");
+    io2.out(`Logs (${d.logs.length})`);
+    for (const l of fence(logLines(d.logs, oc2.fanOut))) io2.out(l);
+  }
+}
+async function interactiveDetail(ctx, oc2, c, id) {
+  const first = await errorDetail(c, id, { env: oc2.env, ...oc2.window }, /* @__PURE__ */ new Set());
+  printDetail(ctx, oc2, first, true);
+  const traceId = first.issue.event.traceId;
+  if (!traceId) return;
+  const scope2 = { env: oc2.env, ...oc2.window };
+  for (; ; ) {
+    const next = await ctx.io.select("Next?", [
+      { name: `Show trace ${oneLine(traceId).slice(0, 8)}`, value: "trace" },
+      { name: "Logs of this trace", value: "logs" },
+      { name: "Done", value: "done" }
+    ]);
+    if (next === "done") return;
+    const extra = { issue: first.issue, warnings: [] };
+    if (next === "trace") extra.trace = await c.trace(traceId, scope2);
+    else {
+      const p = await c.logs({ ...scope2, trace: traceId, limit: 100 });
+      extra.logs = p.items;
+      extra.warnings.push(...pageWarnings(p));
+    }
+    printDetail(ctx, oc2, extra, false);
+  }
+}
+function registerErrors(program, ctx) {
+  addObsFlags(program.command("errors [id]").description("Errors of a deployed environment, or one error with its stack trace (requires --env)")).option("--with <list>", `with an id: also show ${WITHS.join(",")}`).option("--status <status>", `${STATUSES.join("|")} (default unresolved)`).option("--sort <sort>", `${SORTS.join("|")} (default date)`).action(async (id, flags) => {
+    const { io: io2, deps: deps2 } = ctx;
+    const g = ctx.opts();
+    const withs = withList(flags.with, WITHS);
+    const status2 = one("--status", flags.status ?? "unresolved", STATUSES);
+    const sort = one("--sort", flags.sort ?? "date", SORTS);
+    const limit = limitOf(flags.limit);
+    const oc2 = await obsContext(ctx, flags, "errors", { single: id !== void 0 });
+    const q = { env: oc2.env, ...oc2.window, q: flags.query, limit };
+    if (id) {
+      const c2 = oc2.targets[0].client;
+      if (g.json) {
+        renderJson(io2, { context: oc2.json, ...await errorDetail(c2, id, q, withs) });
+        return;
+      }
+      io2.err(oc2.header);
+      if (io2.interactive && withs.size === 0) {
+        await interactiveDetail(ctx, oc2, c2, id);
+        return;
+      }
+      printDetail(ctx, oc2, await errorDetail(c2, id, q, withs), true);
+      return;
+    }
+    const f = await fanOut(oc2, (t) => t.client.issues({ ...q, status: status2, sort }));
+    const pages = f.results.map((r) => r.result);
+    const items = pages.flatMap((p) => p.items);
+    if (pages.length > 1) items.sort(MERGE[sort]);
+    const warnings = [...pageWarnings(...pages), ...skipWarnings(f)];
+    if (g.json) {
+      renderJson(io2, { context: oc2.json, items, warnings, ...skipJson(f) });
+      return;
+    }
+    io2.err(oc2.header);
+    printWarnings(io2, warnings, false, f.skipped);
+    if (items.length === 0) {
+      io2.out(`No ${status2 === "all" ? "" : `${status2} `}errors in ${oc2.env} (${windowText(oc2.window)}).`);
+      return;
+    }
+    for (const l of fence(issuesTable(items, deps2.now(), oc2.fanOut))) io2.out(l);
+    if (!io2.interactive) return;
+    const picked = await io2.select(
+      "Which error to open?",
+      [...items.map((i) => ({ name: `${oneLine(i.shortId)}  ${oneLine(i.title)}`.slice(0, 100), value: i })), { name: "(none)", value: null }]
+    );
+    if (!picked) return;
+    const c = oc2.targets.find((t) => t.module.id === picked.module.id)?.client;
+    if (!c) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `module ${picked.module.slug} is not among the queried modules`);
+    await interactiveDetail(ctx, oc2, c, picked.shortId);
+  });
+}
+
+// src/cli/commands/init.ts
+import { realpath as realpath11 } from "fs/promises";
+
 // src/core/auth/oidc.ts
 import * as oc from "openid-client";
-var LOGIN_SCOPE = "openid profile email offline_access qore:read qore:local-env";
+var LOGIN_SCOPE = "openid profile email offline_access qore:read qore:local-env qore:observability";
 function decodeSub(accessToken) {
   const part = accessToken.split(".")[1] ?? "";
   const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
@@ -4818,9 +5761,9 @@ async function createOidc(opts) {
     throw mapOidcError(e, host);
   }
   return {
-    async startDevice(scope) {
+    async startDevice(scope2) {
       try {
-        const r = await oc.initiateDeviceAuthorization(config, { scope });
+        const r = await oc.initiateDeviceAuthorization(config, { scope: scope2 });
         return {
           userCode: r.user_code,
           verificationUri: r.verification_uri,
@@ -4840,9 +5783,9 @@ async function createOidc(opts) {
         throw mapOidcError(e, host);
       }
     },
-    async refresh(rt, scope) {
+    async refresh(rt, scope2) {
       try {
-        const t = await oc.refreshTokenGrant(config, rt, scope ? { scope } : void 0);
+        const t = await oc.refreshTokenGrant(config, rt, scope2 ? { scope: scope2 } : void 0);
         return toTokenSet(t, rt);
       } catch (e) {
         throw mapOidcError(e, host);
@@ -4896,78 +5839,229 @@ async function deviceLogin(opts) {
 }
 
 // src/cli/commands/login.ts
+var NO_TENANTS = "Your account is not a developer in any organisation. Ask an admin to invite you as developer.";
+async function loginFlow(ctx, cmd) {
+  const { deps: deps2, io: io2, signal } = ctx;
+  const g = ctx.opts();
+  const cfg = await deps2.config.read();
+  const portal = resolvePortal(g.portal, cfg.defaultProfile);
+  const meta = await fetchMeta(deps2.fetch, portal.apiOrigin);
+  const known = cfg.profiles[portal.apiOrigin]?.issuer;
+  const pinned = { ...portal, pinnedIssuer: portal.pinnedIssuer ?? known ?? null };
+  if (!pinned.pinnedIssuer && portal.builtin === null) {
+    io2.err(`! Logging in to ${portal.apiOrigin}, identity provider ${meta.auth.issuer}`);
+  }
+  negotiate(meta, pinned, deps2.version);
+  const issuer = pinned.pinnedIssuer ?? meta.auth.issuer;
+  const hash = profileHash(portal.apiOrigin, issuer);
+  const store = new TokenStore(deps2.keychain, hash);
+  const t = await deviceLogin({
+    oidc: await deps2.oidcFor(issuer),
+    store,
+    now: deps2.now,
+    signal,
+    withLock: deps2.withLock,
+    lockName: hash,
+    onCode: async (s, settled) => {
+      const url = s.verificationUriComplete ?? s.verificationUri;
+      io2.err(`! First copy your one-time code: ${s.userCode}`);
+      if (io2.interactive && cmd.browser) {
+        try {
+          await io2.waitForEnter(`  Press Enter to open ${url} (or open it yourself)`, AbortSignal.any([signal, settled]));
+        } catch (e) {
+          if (settled.aborted && !signal.aborted) return;
+          throw e;
+        }
+        if (settled.aborted) return;
+        if (!await io2.openUrl(url)) io2.err(`  Open ${url} in a browser`);
+      } else {
+        io2.err(`  Open ${url} in a browser`);
+      }
+    }
+  });
+  await deps2.config.update((c) => {
+    c.profiles[portal.apiOrigin] = {
+      ...c.profiles[portal.apiOrigin],
+      apiOrigin: portal.apiOrigin,
+      issuer,
+      sub: t.sub,
+      email: t.email,
+      meta: { fetchedAt: deps2.now().toISOString(), doc: meta }
+    };
+    if (g.portal || !c.defaultProfile) c.defaultProfile = portal.apiOrigin;
+  });
+  const { api } = await openSession(deps2, { ...portal, pinnedIssuer: issuer }, "login", requestLog(ctx));
+  const me = await api.get("/api/cli/v1/me");
+  const prev = cfg.profiles[portal.apiOrigin];
+  let active = prev?.sub === t.sub && prev.activeTenant && me.tenants.some((x) => x.id === prev.activeTenant.id) ? prev.activeTenant : void 0;
+  if (active) {
+  } else if (me.tenants.length === 0) {
+    io2.err(`! ${NO_TENANTS}`);
+  } else if (me.tenants.length === 1) {
+    active = { id: me.tenants[0].id, slug: me.tenants[0].slug };
+    io2.err(`\u2713 Using tenant ${me.tenants[0].name}`);
+  } else if (io2.interactive) {
+    active = await io2.select("Select a tenant", me.tenants.map((x) => ({ name: `${x.name}  ${x.role}`, value: { id: x.id, slug: x.slug } })));
+  } else {
+    io2.err(`! You belong to ${me.tenants.length} tenants; choose one with \`qore tenant use <slug>\``);
+  }
+  await deps2.config.update((c) => {
+    c.profiles[portal.apiOrigin].activeTenant = active;
+  });
+  const label3 = portal.builtin ?? portal.apiOrigin;
+  if (g.json) renderJson(io2, { portal: label3, email: me.email, activeTenant: active ?? null });
+  else io2.out(`\u2713 Logged in as ${me.email} (${label3})`);
+}
 function registerLogin(program, ctx) {
-  program.command("login").description("Log in with your Qore account").option("--no-browser", "only print the URL").action(async (cmd) => {
-    const { deps: deps2, io: io2, signal } = ctx;
+  program.command("login").description("Log in with your Qore account").option("--no-browser", "only print the URL").action(async (cmd) => loginFlow(ctx, cmd));
+}
+
+// src/cli/commands/tenant.ts
+function registerTenant(program, ctx) {
+  const tenant = program.command("tenant").description("Manage the active tenant");
+  tenant.command("list").description("List tenants you have access to").action(async () => {
+    const { deps: deps2, io: io2 } = ctx;
     const g = ctx.opts();
     const cfg = await deps2.config.read();
     const portal = resolvePortal(g.portal, cfg.defaultProfile);
-    const meta = await fetchMeta(deps2.fetch, portal.apiOrigin);
-    const known = cfg.profiles[portal.apiOrigin]?.issuer;
-    const pinned = { ...portal, pinnedIssuer: portal.pinnedIssuer ?? known ?? null };
-    if (!pinned.pinnedIssuer && portal.builtin === null) {
-      io2.err(`! Logging in to ${portal.apiOrigin}, identity provider ${meta.auth.issuer}`);
-    }
-    negotiate(meta, pinned, deps2.version);
-    const issuer = pinned.pinnedIssuer ?? meta.auth.issuer;
-    const hash = profileHash(portal.apiOrigin, issuer);
-    const store = new TokenStore(deps2.keychain, hash);
-    const t = await deviceLogin({
-      oidc: await deps2.oidcFor(issuer),
-      store,
-      now: deps2.now,
-      signal,
-      withLock: deps2.withLock,
-      lockName: hash,
-      onCode: async (s, settled) => {
-        const url = s.verificationUriComplete ?? s.verificationUri;
-        io2.err(`! First copy your one-time code: ${s.userCode}`);
-        if (io2.interactive && cmd.browser) {
-          try {
-            await io2.waitForEnter(`  Press Enter to open ${url} (or open it yourself)`, AbortSignal.any([signal, settled]));
-          } catch (e) {
-            if (settled.aborted && !signal.aborted) return;
-            throw e;
-          }
-          if (settled.aborted) return;
-          if (!await io2.openUrl(url)) io2.err(`  Open ${url} in a browser`);
-        } else {
-          io2.err(`  Open ${url} in a browser`);
-        }
-      }
-    });
-    await deps2.config.update((c) => {
-      c.profiles[portal.apiOrigin] = {
-        ...c.profiles[portal.apiOrigin],
-        apiOrigin: portal.apiOrigin,
-        issuer,
-        sub: t.sub,
-        email: t.email,
-        meta: { fetchedAt: deps2.now().toISOString(), doc: meta }
-      };
-      if (g.portal || !c.defaultProfile) c.defaultProfile = portal.apiOrigin;
-    });
-    const { api } = await openSession(deps2, { ...portal, pinnedIssuer: issuer }, "login", requestLog(ctx));
+    const { profile, api } = await openSession(deps2, portal, "tenant list", requestLog(ctx));
     const me = await api.get("/api/cli/v1/me");
-    const prev = cfg.profiles[portal.apiOrigin];
-    let active = prev?.sub === t.sub && prev.activeTenant && me.tenants.some((x) => x.id === prev.activeTenant.id) ? prev.activeTenant : void 0;
-    if (active) {
-    } else if (me.tenants.length === 0) {
-      io2.err("! Your account is not a developer in any organisation. Ask an admin to invite you as developer.");
-    } else if (me.tenants.length === 1) {
-      active = { id: me.tenants[0].id, slug: me.tenants[0].slug };
-      io2.err(`\u2713 Using tenant ${me.tenants[0].name}`);
-    } else if (io2.interactive) {
-      active = await io2.select("Select a tenant", me.tenants.map((x) => ({ name: `${x.name}  ${x.role}`, value: { id: x.id, slug: x.slug } })));
-    } else {
-      io2.err(`! You belong to ${me.tenants.length} tenants; choose one with \`qore tenant use <slug>\``);
+    const activeId = profile.activeTenant?.id;
+    if (g.json) {
+      renderJson(io2, { tenants: me.tenants.map((t) => ({ ...t, active: t.id === activeId })) });
+      return;
+    }
+    for (const t of me.tenants) {
+      const mark = t.id === activeId ? "*" : " ";
+      io2.out(`${mark} ${t.name}  ${t.role}`);
     }
-    await deps2.config.update((c) => {
-      c.profiles[portal.apiOrigin].activeTenant = active;
-    });
-    const label2 = portal.builtin ?? portal.apiOrigin;
-    if (g.json) renderJson(io2, { portal: label2, email: me.email, activeTenant: active ?? null });
-    else io2.out(`\u2713 Logged in as ${me.email} (${label2})`);
+  });
+  tenant.command("use").description("Set the active tenant").argument("[slug]", "tenant slug").action(async (slug) => {
+    const chosen = await useTenant(ctx, slug);
+    if (ctx.opts().json) renderJson(ctx.io, { activeTenant: chosen });
+    else ctx.io.out(`\u2713 Using tenant ${chosen.slug}`);
+  });
+}
+async function useTenant(ctx, slug, known) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const cfg = await deps2.config.read();
+  const portal = resolvePortal(g.portal, cfg.defaultProfile);
+  const me = known ?? await (await openSession(deps2, portal, "tenant use", requestLog(ctx))).api.get("/api/cli/v1/me");
+  const candidates = me.tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
+  let chosen;
+  if (slug) {
+    const found = me.tenants.find((t) => t.slug === slug);
+    if (!found) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `No tenant "${slug}" for this account`, { candidates });
+    chosen = { id: found.id, slug: found.slug };
+  } else if (io2.interactive) {
+    chosen = await io2.select("Select a tenant", me.tenants.map((t) => ({ name: `${t.name}  ${t.role}`, value: { id: t.id, slug: t.slug } })));
+  } else {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", "Which tenant? Pass a slug or run interactively.", { candidates });
+  }
+  await deps2.config.update((c) => {
+    c.profiles[portal.apiOrigin].activeTenant = chosen;
+  });
+  return chosen;
+}
+
+// src/cli/commands/init.ts
+var step = (status2, detail2) => detail2 === void 0 ? { status: status2 } : { status: status2, detail: detail2 };
+async function rootStep(ctx, f) {
+  const { deps: deps2, io: io2 } = ctx;
+  const current = (await deps2.config.read()).projectsRoot;
+  let input2 = f.root;
+  if (input2 === void 0) {
+    if (!io2.interactive) {
+      if (current) return step("already", current);
+      throw new QoreError("QORE_ROOT_NOT_SET", "No projects folder chosen", { hint: "Pass one: qore init --root <path>." });
+    }
+    input2 = await io2.input("Projects folder", { default: current ?? "~/qore" }) || current || "~/qore";
+  }
+  const wanted = await checkRoot(deps2, input2);
+  const asked = await realpath11(wanted).catch(() => wanted);
+  if (current && asked !== current && io2.interactive && !await io2.confirm(`Change the projects folder from ${current} to ${asked}? Nothing is moved.`, ctx.signal)) {
+    return step("skipped", current);
+  }
+  const next = await createRoot(wanted);
+  if (next === current) return step("already", current);
+  await setRoot(deps2, next);
+  return step("done", next);
+}
+async function activeTenant(ctx) {
+  const cfg = await ctx.deps.config.read();
+  return cfg.profiles[resolvePortal(ctx.opts().portal, cfg.defaultProfile).apiOrigin]?.activeTenant?.slug ?? null;
+}
+async function tenantStep(ctx) {
+  const cfg = await ctx.deps.config.read();
+  const portal = resolvePortal(ctx.opts().portal, cfg.defaultProfile);
+  const { api } = await openSession(ctx.deps, portal, "init", requestLog(ctx));
+  const me = await api.get("/api/cli/v1/me");
+  if (me.tenants.length === 0) return step("skipped", NO_TENANTS);
+  return step("done", (await useTenant(ctx, me.tenants.length === 1 ? me.tenants[0].slug : void 0, me)).slug);
+}
+function registerInit(program, ctx) {
+  program.command("init").description("Set up qore: a projects folder, login, tenant and a first app").option("--root <path>", "the projects folder (default: ask, ~/qore)").option("--clone <app>", "clone this app into the projects folder").option("--tenant <slug>", "tenant the --clone app belongs to").action(async (f) => {
+    const { io: io2 } = ctx;
+    const json2 = Boolean(ctx.opts().json);
+    const sub = json2 ? { ...ctx, io: { ...io2, out: io2.err }, opts: () => ({ ...ctx.opts(), json: false }) } : ctx;
+    const steps = {
+      root: await rootStep(ctx, f),
+      login: step("skipped"),
+      tenant: step("skipped"),
+      clone: step("skipped")
+    };
+    const who = await loggedInAs(ctx);
+    if (who) steps.login = step("already", who);
+    else if (io2.interactive) {
+      await loginFlow(sub, { browser: true });
+      steps.login = step("done", await loggedInAs(ctx) ?? void 0);
+    } else steps.login = step("skipped", "run qore login");
+    const tenant = await activeTenant(ctx);
+    if (tenant) steps.tenant = step(steps.login.status === "done" ? "done" : "already", tenant);
+    else if (steps.login.status !== "skipped" && io2.interactive) steps.tenant = await tenantStep(sub);
+    else steps.tenant = step("skipped", "run qore tenant use <slug>");
+    if (f.clone) {
+      steps.clone = step("done", (await cloneApp(sub, f.clone, void 0, { tenant: f.tenant, protocol: "https" })).root);
+    } else if (io2.interactive && steps.login.status !== "skipped" && steps.tenant.status !== "skipped" && await io2.confirm("Clone an app now?", ctx.signal)) {
+      steps.clone = step("done", (await cloneApp(sub, void 0, void 0, { tenant: f.tenant, protocol: "https" })).root);
+    }
+    const projectsRoot = (await ctx.deps.config.read()).projectsRoot ?? null;
+    if (json2) {
+      renderJson(io2, { projectsRoot, steps });
+      return;
+    }
+    const mark = (s) => s.status === "skipped" ? "\u2013" : "\u2713";
+    for (const [name, s] of Object.entries(steps)) io2.out(`${mark(s)} ${name.padEnd(6)} ${s.status}${s.detail ? `  ${s.detail}` : ""}`);
+    if (projectsRoot) io2.out(`Next: qore dev <app> works from any directory.`);
+  });
+}
+
+// src/cli/commands/logs.ts
+var LEVELS = ["error", "warn", "info", "debug"];
+function registerLogs(program, ctx) {
+  addObsFlags(program.command("logs").description("Logs of a deployed environment (requires --env)")).option("--level <level>", `exactly this severity: ${LEVELS.join("|")}`).option("--trace <id>", "only the logs of one trace").action(async (flags) => {
+    const { io: io2 } = ctx;
+    const g = ctx.opts();
+    const limit = limitOf(flags.limit);
+    const level = flags.level === void 0 ? void 0 : one("--level", flags.level, LEVELS);
+    const oc2 = await obsContext(ctx, flags, "logs", { single: false });
+    const q = { env: oc2.env, ...oc2.window, q: flags.query, limit, level, trace: flags.trace };
+    const f = await fanOut(oc2, (t) => t.client.logs(q));
+    const pages = f.results.map((r) => r.result);
+    const items = pages.flatMap((p) => p.items).sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+    const warnings = [...pageWarnings(...pages), ...skipWarnings(f)];
+    if (g.json) {
+      renderJson(io2, { context: oc2.json, items, warnings, ...skipJson(f) });
+      return;
+    }
+    io2.err(oc2.header);
+    printWarnings(io2, warnings, false, f.skipped);
+    if (items.length === 0) {
+      io2.out(`No logs in ${oc2.env} (${windowText(oc2.window)}).`);
+      return;
+    }
+    for (const l of fence(logLines(items, oc2.fanOut))) io2.out(l);
   });
 }
 
@@ -5003,26 +6097,6 @@ function registerLogout(program, ctx) {
   });
 }
 
-// src/cli/format.ts
-function ago(iso, now) {
-  if (!iso) return "\u2013";
-  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1e3));
-  if (s < 60) return "just now";
-  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
-  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
-  return `${Math.floor(s / 86400)}d ago`;
-}
-var pct = (f) => String(Number((f * 100).toFixed(2)));
-function uptime(h) {
-  if (!h) return "\u2013";
-  const kind = h.cause && h.kind !== "up" ? `${h.kind}: ${h.cause}` : h.kind;
-  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`;
-}
-function table(rows) {
-  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => (r[i] ?? "").length)));
-  return rows.map((r) => "  " + r.map((c, i) => i === r.length - 1 ? c : c.padEnd(widths[i])).join("  "));
-}
-
 // src/cli/commands/status.ts
 var HEAD = ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"];
 var envRow = (e, now) => [e.name, e.paused ? "paused" : e.status, e.commit?.sha ?? "\u2013", ago(e.commit?.deployedAt ?? null, now), uptime(e.health)];
@@ -5035,6 +6109,7 @@ async function appStatus(ctx, ws, appFlag) {
   await ensureCapability(deps2, portal.apiOrigin, "app.modules");
   await ensureCapability(deps2, portal.apiOrigin, "module.status");
   const am = await workspaceAppModules(session, portal, ws);
+  await rememberWorkspace(ctx, ws, am.app);
   const { tenant, ...app } = am.app;
   if (appFlag && appFlag !== app.id && appFlag !== app.slug) {
     throw new QoreError("QORE_RESOURCE_NOT_FOUND", `This workspace is for ${app.slug}, not "${appFlag}"`, {
@@ -5062,19 +6137,21 @@ async function appStatus(ctx, ws, appFlag) {
   for (const line2 of table(rows)) io2.out(line2);
 }
 function registerStatus(program, ctx) {
-  program.command("status").description("Deployment and health per environment for this module (or, in a workspace root, the app)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").action(async (flags) => {
-    const { deps: deps2, io: io2 } = ctx;
-    const g = ctx.opts();
+  program.command("status").description("Deployment and health per environment for this module (or, in a workspace root, the app)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "the app or module, from anywhere (see qore init)").action(async (flags) => {
+    const c = await projectCtx(ctx, { ref: flags.project, module: flags.module, app: flags.app, needModule: false, command: "status" });
+    const { deps: deps2, io: io2 } = c;
+    const g = c.opts();
     if (!flags.module) {
       const ws = await workspaceRoot(deps2);
       if (ws) {
-        await appStatus(ctx, ws, flags.app);
+        await appStatus(c, ws, flags.app);
         return;
       }
     }
-    const mc = await moduleContextFor(ctx, flags, "status");
+    const mc = await moduleContextFor(c, flags, "status");
     await ensureCapability(deps2, mc.portal.apiOrigin, "module.status");
-    const app = await appFor(ctx, mc, flags.app);
+    const app = await appFor(c, mc, flags.app);
+    await rememberContext(c, mc, app);
     if (!g.json) io2.err(contextLine(mc, app));
     const st = await mc.session.api.get(
       `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/status?app_id=${encodeURIComponent(app.id)}`
@@ -5094,7 +6171,7 @@ function registerStatus(program, ctx) {
 }
 
 // src/cli/commands/sync.ts
-import { join as join21, relative as relative8 } from "path";
+import { join as join24, relative as relative9 } from "path";
 import { Option as Option2 } from "commander";
 function asFailure2(slug, e) {
   if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
@@ -5126,7 +6203,7 @@ function registerSync(program, ctx) {
         continue;
       }
       try {
-        dirs[m.slug] = await deps2.git.inspect(join21(ws.root, m.slug));
+        dirs[m.slug] = await deps2.git.inspect(join24(ws.root, m.slug));
         modulesForPlan.push(m);
       } catch (e) {
         earlyFailures.push(asFailure2(m.slug, e));
@@ -5138,7 +6215,7 @@ function registerSync(program, ctx) {
     } });
     await syncPresent(deps2, applied, actions, Boolean(flags.pull), { app, protocol: flags.protocol });
     for (const r of applied) {
-      if (r.status === "cloned" && r.dir) r.dir = relative8(deps2.cwd, r.dir) || ".";
+      if (r.status === "cloned" && r.dir) r.dir = relative9(deps2.cwd, r.dir) || ".";
     }
     const removedResults = removed.map((slug) => ({ slug, status: "removed", reason: "not a module of this app \u2014 left in place" }));
     const results = [...earlyFailures, ...applied, ...removedResults];
@@ -5147,49 +6224,106 @@ function registerSync(program, ctx) {
   });
 }
 
-// src/cli/commands/tenant.ts
-function registerTenant(program, ctx) {
-  const tenant = program.command("tenant").description("Manage the active tenant");
-  tenant.command("list").description("List tenants you have access to").action(async () => {
-    const { deps: deps2, io: io2 } = ctx;
+// src/cli/commands/traces.ts
+var WITHS2 = ["logs", "errors"];
+async function spansOf(c, q, sort, warnings) {
+  try {
+    return await c.spans({ ...q, sort });
+  } catch (e) {
+    if (sort === "-duration" && e instanceof QoreError && e.serverCode === "observability.sort_unsupported") {
+      warnings.push("sort_unavailable");
+      return c.spans(q);
+    }
+    throw e;
+  }
+}
+function registerTraces(program, ctx) {
+  addObsFlags(program.command("traces [id]").description("Slow or recent requests, or one trace as a span tree (requires --env)")).option("--slower-than <duration>", "only requests slower than this, slowest first (e.g. 500ms, 1s)").option("--with <list>", `with a trace id: also show ${WITHS2.join(",")}`).action(async (id, flags) => {
+    const { io: io2, deps: deps2 } = ctx;
     const g = ctx.opts();
-    const cfg = await deps2.config.read();
-    const portal = resolvePortal(g.portal, cfg.defaultProfile);
-    const { profile, api } = await openSession(deps2, portal, "tenant list", requestLog(ctx));
-    const me = await api.get("/api/cli/v1/me");
-    const activeId = profile.activeTenant?.id;
+    const withs = withList(flags.with, WITHS2);
+    const slower = flags.slowerThan === void 0 ? void 0 : parseDuration(flags.slowerThan);
+    const limit = limitOf(flags.limit);
+    const oc2 = await obsContext(ctx, flags, "traces", { single: id !== void 0 });
+    const q = { env: oc2.env, ...oc2.window, limit };
+    const scope2 = { env: oc2.env, ...oc2.window };
+    const printLogs = (items2) => {
+      io2.out("");
+      io2.out(`Logs (${items2.length})`);
+      for (const l of fence(logLines(items2, oc2.fanOut))) io2.out(l);
+    };
+    const printErrors = (items2) => {
+      io2.out("");
+      io2.out(`Errors (${items2.length})`);
+      for (const l of fence(issuesTable(items2, deps2.now(), oc2.fanOut))) io2.out(l);
+    };
+    const printTree = (trace2) => {
+      for (const l of fence(spanTree(trace2))) io2.out(l);
+    };
+    const more = async (c2, traceId, w) => {
+      const f2 = { ...scope2, trace: traceId };
+      if (w === "logs") {
+        const p = await c2.logs({ ...f2, limit: 100 });
+        printWarnings(io2, pageWarnings(p), false);
+        printLogs(p.items);
+      } else {
+        const p = await c2.issues({ ...f2, status: "all" });
+        printWarnings(io2, pageWarnings(p), false);
+        printErrors(p.items);
+      }
+    };
+    if (id) {
+      const c2 = oc2.targets[0].client;
+      const b = await traceDetail(c2, id, q, withs);
+      if (g.json) {
+        renderJson(io2, { context: oc2.json, ...b });
+        return;
+      }
+      io2.err(oc2.header);
+      printWarnings(io2, b.warnings, false);
+      printTree(b.trace);
+      if (b.logs) printLogs(b.logs);
+      if (b.errors) printErrors(b.errors);
+      return;
+    }
+    const warnings = [];
+    const listQ = { ...q, q: joinQuery(ROOT_SPAN_FILTER, slower && `span.duration:>${slower}`, flags.query) };
+    const sort = slower ? "-duration" : "-timestamp";
+    const f = await fanOut(oc2, (t) => spansOf(t.client, listQ, sort, warnings));
+    const pages = f.results.map((r) => r.result);
+    warnings.push(...pageWarnings(...pages), ...skipWarnings(f));
+    const items = pages.flatMap((p) => p.items).sort((a, b) => slower ? b.durationMs - a.durationMs : b.timestamp.localeCompare(a.timestamp));
+    const uniq = [...new Set(warnings)];
     if (g.json) {
-      renderJson(io2, { tenants: me.tenants.map((t) => ({ ...t, active: t.id === activeId })) });
+      renderJson(io2, { context: oc2.json, items, warnings: uniq, ...skipJson(f) });
       return;
     }
-    for (const t of me.tenants) {
-      const mark = t.id === activeId ? "*" : " ";
-      io2.out(`${mark} ${t.name}  ${t.role}`);
+    io2.err(oc2.header);
+    printWarnings(io2, uniq, false, f.skipped);
+    if (items.length === 0) {
+      io2.out(`No ${slower ? `requests slower than ${slower}` : "traces"} in ${oc2.env} (${windowText(oc2.window)}).`);
+      return;
     }
-  });
-  tenant.command("use").description("Set the active tenant").argument("[slug]", "tenant slug").action(async (slug) => {
-    const { deps: deps2, io: io2 } = ctx;
-    const g = ctx.opts();
-    const cfg = await deps2.config.read();
-    const portal = resolvePortal(g.portal, cfg.defaultProfile);
-    const { api } = await openSession(deps2, portal, "tenant use", requestLog(ctx));
-    const me = await api.get("/api/cli/v1/me");
-    const candidates = me.tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
-    let chosen;
-    if (slug) {
-      const found = me.tenants.find((t) => t.slug === slug);
-      if (!found) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `No tenant "${slug}" for this account`, { candidates });
-      chosen = { id: found.id, slug: found.slug };
-    } else if (io2.interactive) {
-      chosen = await io2.select("Select a tenant", me.tenants.map((t) => ({ name: `${t.name}  ${t.role}`, value: { id: t.id, slug: t.slug } })));
-    } else {
-      throw new QoreError("QORE_CONTEXT_REQUIRED", "Which tenant? Pass a slug or run interactively.", { candidates });
+    for (const l of fence(spansTable(items, deps2.now(), oc2.fanOut))) io2.out(l);
+    if (!io2.interactive) return;
+    const picked = await io2.select(
+      "Which trace to open?",
+      [...items.map((s) => ({ name: `${oneLine(s.traceId).slice(0, 8)}  ${oneLine(s.transaction ?? s.op)}`, value: s })), { name: "(none)", value: null }]
+    );
+    if (!picked) return;
+    const c = oc2.targets.find((t) => t.module.id === picked.module.id)?.client;
+    if (!c) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `module ${picked.module.slug} is not among the queried modules`);
+    const { trace } = await traceDetail(c, picked.traceId, q, /* @__PURE__ */ new Set());
+    printTree(trace);
+    for (; ; ) {
+      const next = await io2.select("Next?", [
+        { name: "Logs of this trace", value: "logs" },
+        { name: "Errors in this trace", value: "errors" },
+        { name: "Done", value: "done" }
+      ]);
+      if (next === "done") return;
+      await more(c, picked.traceId, next);
     }
-    await deps2.config.update((c) => {
-      c.profiles[portal.apiOrigin].activeTenant = chosen;
-    });
-    if (g.json) renderJson(io2, { activeTenant: chosen });
-    else io2.out(`\u2713 Using tenant ${chosen.slug}`);
   });
 }
 
@@ -5212,11 +6346,11 @@ function registerVersion(program, ctx) {
       return;
     }
     io2.out(`qore ${deps2.version}`);
-    const label2 = portal.builtin ?? portal.apiOrigin;
+    const label3 = portal.builtin ?? portal.apiOrigin;
     if (portalInfo) {
-      io2.out(`portal ${label2}: api ${portalInfo.apiVersions.join(",")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`);
+      io2.out(`portal ${label3}: api ${portalInfo.apiVersions.join(",")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`);
     } else {
-      io2.out(`portal ${label2}: unreachable`);
+      io2.out(`portal ${label3}: unreachable`);
     }
   });
 }
@@ -5230,18 +6364,18 @@ function registerWhoami(program, ctx) {
     const portal = resolvePortal(g.portal, cfg.defaultProfile);
     const { profile, api } = await openSession(deps2, portal, "whoami", requestLog(ctx));
     const me = await api.get("/api/cli/v1/me");
-    const activeTenant = profile.activeTenant;
-    if (activeTenant && !me.tenants.some((t) => t.id === activeTenant.id)) {
-      io2.err(`! You no longer have developer access to ${activeTenant.slug}`);
+    const activeTenant2 = profile.activeTenant;
+    if (activeTenant2 && !me.tenants.some((t) => t.id === activeTenant2.id)) {
+      io2.err(`! You no longer have developer access to ${activeTenant2.slug}`);
     }
-    const label2 = portal.builtin ?? portal.apiOrigin;
+    const label3 = portal.builtin ?? portal.apiOrigin;
     if (g.json) {
-      renderJson(io2, { portal: label2, activeTenant: activeTenant ?? null, me });
+      renderJson(io2, { portal: label3, activeTenant: activeTenant2 ?? null, me });
       return;
     }
-    io2.out(`${me.email} (${label2})`);
+    io2.out(`${me.email} (${label3})`);
     for (const t of me.tenants) {
-      const mark = activeTenant?.id === t.id ? "*" : " ";
+      const mark = activeTenant2?.id === t.id ? "*" : " ";
       io2.out(`${mark} ${t.name}  ${t.role}`);
       for (const a of t.apps) {
         io2.out(`  ${a.slug}  ${a.access}`);
@@ -5255,11 +6389,15 @@ function registerWhoami(program, ctx) {
 
 // src/cli/commands/index.ts
 var COMMANDS = [
+  registerInit,
   registerLogin,
   registerLogout,
   registerWhoami,
   registerTenant,
   registerStatus,
+  registerLogs,
+  registerTraces,
+  registerErrors,
   registerEnv,
   registerRun,
   registerDev,
@@ -5294,7 +6432,7 @@ async function showNoticeOnce(deps2, io2, o) {
 // src/cli/telemetry/index.ts
 var CRASH_FLUSH_MS = 2e3;
 var CLEAN_FLUSH_MS = 200;
-var loadSentry = async () => (await import("./sentry-B3MDCAOI.js")).createSdk;
+var loadSentry = async () => (await import("./sentry-GMM4X3FT.js")).createSdk;
 function createTelemetry(deps2, o) {
   const load = o.load ?? loadSentry;
   const flushMs = o.flushMs ?? { crash: CRASH_FLUSH_MS, clean: CLEAN_FLUSH_MS };
@@ -5319,13 +6457,13 @@ function createTelemetry(deps2, o) {
     },
     async end(signal) {
       if (!sdk) return { drained: true };
-      const ms = crashed ? flushMs.crash : flushMs.clean;
+      const ms2 = crashed ? flushMs.crash : flushMs.clean;
       const work = sdk.then(async (s) => {
         if (!s) return true;
         if (crashed) s.crash(crashed.e);
-        return s.end(ms);
+        return s.end(ms2);
       }).catch(() => false);
-      return { drained: await withDeadline(work, ms, signal) };
+      return { drained: await withDeadline(work, ms2, signal) };
     }
   };
 }
@@ -5346,16 +6484,16 @@ async function start(deps2, argv2, command, load, onScrub) {
   sdk.start();
   return sdk;
 }
-function withDeadline(work, ms, signal) {
+function withDeadline(work, ms2, signal) {
   if (signal?.aborted) return Promise.resolve(false);
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const done = (v) => {
       clearTimeout(timer);
       signal?.removeEventListener("abort", onAbort);
-      resolve5(v);
+      resolve6(v);
     };
     const onAbort = () => done(false);
-    const timer = setTimeout(() => done(false), ms);
+    const timer = setTimeout(() => done(false), ms2);
     signal?.addEventListener("abort", onAbort, { once: true });
     work.then(done, () => done(false));
   });
@@ -5404,7 +6542,7 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 
 // src/core/config.ts
 import { readFile as readFile6 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join25 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -5412,7 +6550,7 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join22(this.dir, "config.json");
+    return join25(this.dir, "config.json");
   }
   async read() {
     let raw;
@@ -5443,9 +6581,9 @@ var ConfigStore = class {
 
 // src/platform/git.ts
 import { execFile, execFileSync } from "child_process";
-import { mkdir as mkdir3, readdir as readdir2, stat as stat3 } from "fs/promises";
+import { mkdir as mkdir4, readdir as readdir4, stat as stat6 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname8, join as join23 } from "path";
+import { dirname as dirname9, join as join26 } from "path";
 function parseRemotes(stdout) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -5512,7 +6650,7 @@ function gitExecOptions(repoDir) {
   return { cwd: homedir(), env, windowsHide: true, maxBuffer: 8 * 1024 * 1024 };
 }
 function runGit(args, repoDir) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     execFile("git", args, gitExecOptions(repoDir), (err, stdout, stderr) => {
       if (err && err.code === "ENOENT") {
         reject(new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
@@ -5521,7 +6659,7 @@ function runGit(args, repoDir) {
         return;
       }
       const code = err ? typeof err.code === "number" ? err.code : 1 : 0;
-      resolve5({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
+      resolve6({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
     });
   });
 }
@@ -5539,7 +6677,7 @@ async function remotes(repoRoot) {
   return parseRemotes(r.stdout);
 }
 async function clone(url, dir2) {
-  await mkdir3(dirname8(dir2), { recursive: true });
+  await mkdir4(dirname9(dir2), { recursive: true });
   const r = await runGit(["clone", "--", url, dir2]);
   return toResult(r, "git clone");
 }
@@ -5559,7 +6697,7 @@ async function status(repoRoot) {
 }
 async function statOrThrow(path) {
   try {
-    return await stat3(path);
+    return await stat6(path);
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
     throw new QoreError("QORE_INTERNAL", `could not stat ${path}`, { cause: err });
@@ -5571,12 +6709,12 @@ async function inspect(dir2) {
   if (!st.isDirectory()) return { exists: true, empty: false, isRepo: false, remotes: [] };
   let entries;
   try {
-    entries = await readdir2(dir2);
+    entries = await readdir4(dir2);
   } catch (err) {
     throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
   }
   const empty2 = entries.length === 0;
-  const isRepo = await statOrThrow(join23(dir2, ".git")) !== void 0;
+  const isRepo = await statOrThrow(join26(dir2, ".git")) !== void 0;
   const dirRemotes = isRepo ? await remotes(dir2) : [];
   return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
 }
@@ -5637,15 +6775,15 @@ var OsKeychain = class {
 };
 
 // src/platform/lock.ts
-import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
-import { join as join24 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
+import { join as join27 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join24(dir2, "locks");
-    await mkdir4(locks, { recursive: true, mode: 448 });
-    const target = join24(locks, `${name}.lock`);
-    await writeFile4(target, "", { flag: "a" });
+    const locks = join27(dir2, "locks");
+    await mkdir5(locks, { recursive: true, mode: 448 });
+    const target = join27(locks, `${name}.lock`);
+    await writeFile5(target, "", { flag: "a" });
     let release;
     let compromised;
     try {
@@ -5688,7 +6826,7 @@ var STDERR_DRAIN_MS = 500;
 function makeSpawner(spawnFn, proc) {
   return {
     run(cmd, args, env, o) {
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         let child;
         try {
           child = spawnFn(cmd, args, {
@@ -5722,7 +6860,7 @@ function makeSpawner(spawnFn, proc) {
           cleanup();
           const stderr = child.stderr;
           if (!o?.onStderr || !stderr || stderr.readableEnded) {
-            resolve5({ code, signal });
+            resolve6({ code, signal });
             return;
           }
           let settled = false;
@@ -5730,7 +6868,7 @@ function makeSpawner(spawnFn, proc) {
             if (settled) return;
             settled = true;
             clearTimeout(timer);
-            resolve5({ code, signal });
+            resolve6({ code, signal });
           };
           const timer = setTimeout(finish, STDERR_DRAIN_MS);
           timer.unref?.();
@@ -5785,13 +6923,13 @@ var systemLauncher = {
     child.stdout?.on("data", (c) => out.push(c));
     child.stderr?.on("data", (c) => err.push(c));
     let closed = false;
-    const exited = new Promise((resolve5) => {
-      child.once("error", (e) => resolve5({ code: null, signal: null, spawnError: e.code ?? "error" }));
+    const exited = new Promise((resolve6) => {
+      child.once("error", (e) => resolve6({ code: null, signal: null, spawnError: e.code ?? "error" }));
       child.once("close", (code, signal) => {
         closed = true;
         out.flush();
         err.flush();
-        resolve5({ code, signal });
+        resolve6({ code, signal });
       });
     });
     return {
@@ -5837,11 +6975,11 @@ var systemLauncher = {
 import { execFile as execFile2 } from "child_process";
 import { connect } from "net";
 function accepts(host, port) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const s = connect({ host, port });
     const done = (v) => {
       s.destroy();
-      resolve5(v);
+      resolve6(v);
     };
     s.setTimeout(500, () => done(false));
     s.once("connect", () => done(true));
@@ -5849,12 +6987,12 @@ function accepts(host, port) {
   });
 }
 function run2(cmd, args) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     execFile2(
       cmd,
       args,
       { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
-      (e, stdout) => resolve5(e && !stdout ? null : String(stdout))
+      (e, stdout) => resolve6(e && !stdout ? null : String(stdout))
     );
   });
 }
@@ -5947,12 +7085,12 @@ function parseRegProxy(stdout) {
 
 // src/platform/proxy.ts
 function run3(cmd, args) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     execFile3(
       cmd,
       args,
       { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
-      (e, stdout) => resolve5(e && !stdout ? null : String(stdout))
+      (e, stdout) => resolve6(e && !stdout ? null : String(stdout))
     );
   });
 }
@@ -5983,7 +7121,7 @@ function systemProxy(platform = process.platform) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.5" : "0.0.0-dev";
+var VERSION = true ? "0.1.7" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -6061,4 +7199,4 @@ if (!drained) {
   process.exit();
 }
 //# sourceMappingURL=cli.js.map
-//# debugId=a70250c5-daf4-5ff3-b490-5556ac377549
+//# debugId=bf813c0e-4054-532d-9e74-62fbe8673876