@quatronic/qore 0.1.6 → 0.1.8

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="28c91dc8-dbb9-5c0a-91e3-f368931a4ed3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c4bda056-b13b-52b5-831f-2afd3f6c6867")}catch(e){}}();
 import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
 import {
   addSecretValues,
@@ -9,6 +9,7 @@ import {
 
 // src/cli.ts
 import { homedir as homedir2 } from "os";
+import { fileURLToPath } from "url";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
 
 // src/cli/io.ts
@@ -169,7 +170,7 @@ function processIo(interactive, stderrTTY = Boolean(process.stderr.isTTY)) {
   };
 }
 function createWaitForEnter(input2, output) {
-  return (message, signal) => new Promise((resolve6, reject) => {
+  return (message, signal) => new Promise((resolve7, reject) => {
     const rl = createInterface({ input: input2, output, terminal: true });
     const onAbort = () => {
       rl.close();
@@ -178,7 +179,7 @@ function createWaitForEnter(input2, output) {
     const done = () => {
       signal.removeEventListener("abort", onAbort);
       rl.close();
-      resolve6();
+      resolve7();
     };
     signal.addEventListener("abort", onAbort, { once: true });
     rl.on("SIGINT", () => {
@@ -382,16 +383,16 @@ function groupByModule(results) {
   const order = [];
   const groups = /* @__PURE__ */ new Map();
   for (const r of results) {
-    const key = r.module ?? r.id;
-    if (!groups.has(key)) {
-      groups.set(key, []);
-      order.push(key);
+    const key2 = r.module ?? r.id;
+    if (!groups.has(key2)) {
+      groups.set(key2, []);
+      order.push(key2);
     }
-    groups.get(key).push(r);
+    groups.get(key2).push(r);
   }
   const isSub = (r) => r.id.startsWith("pm:") || r.id.startsWith("node:");
-  return order.flatMap((key) => {
-    const g = groups.get(key);
+  return order.flatMap((key2) => {
+    const g = groups.get(key2);
     return [...g.filter((r) => !isSub(r)), ...g.filter(isSub)];
   });
 }
@@ -538,8 +539,8 @@ async function fetchMetaWithDate(fetch3, apiOrigin) {
   }
   if (!res.ok) throw await problemToError(res);
   const header = res.headers.get("date");
-  const ms = header ? Date.parse(header) : NaN;
-  return { meta: await res.json(), date: Number.isNaN(ms) ? null : new Date(ms) };
+  const ms2 = header ? Date.parse(header) : NaN;
+  return { meta: await res.json(), date: Number.isNaN(ms2) ? null : new Date(ms2) };
 }
 function negotiate(meta, portal, cliVersion) {
   if (portal.pinnedIssuer && meta.auth.issuer !== portal.pinnedIssuer) {
@@ -678,7 +679,7 @@ var QoreApiClient = class {
     this.o.onRequest?.(`${method} ${path} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
     return res;
   }
-  async request(method, path, body) {
+  async request(method, path, body, parse2 = (r) => r.json()) {
     let res = await this.once(method, path, body, false);
     if (res.status === 401) {
       res = await this.once(method, path, body, true);
@@ -700,11 +701,14 @@ var QoreApiClient = class {
       }
     }
     if (!res.ok) throw await problemToError(res);
-    return await res.json();
+    return parse2(res);
   }
   get(path) {
     return this.request("GET", path);
   }
+  getText(path) {
+    return this.request("GET", path, void 0, (r) => r.text());
+  }
   post(path, body) {
     return this.request("POST", path, body);
   }
@@ -720,13 +724,13 @@ var RefreshCoordinator = class {
   fresh(expiresAt) {
     return new Date(expiresAt).getTime() - this.o.now().getTime() > SKEW_MS;
   }
-  async rotate(scope) {
+  async rotate(scope2) {
     let stored = await this.o.store.getRefresh();
     if (!stored) throw new QoreError("QORE_NOT_LOGGED_IN", "Not logged in", { hint: "Run `qore login`." });
     let t;
     for (let attempt = 0; ; attempt++) {
       try {
-        t = await (await this.o.oidc()).refresh(stored.rt, scope);
+        t = await (await this.o.oidc()).refresh(stored.rt, scope2);
         break;
       } catch (e) {
         if (!(e instanceof QoreError && e.code === "QORE_SESSION_EXPIRED")) throw e;
@@ -742,7 +746,7 @@ var RefreshCoordinator = class {
         throw e;
       }
     }
-    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope ?? stored.scope), obtainedAt: this.o.now().toISOString() });
+    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope2 ?? stored.scope), obtainedAt: this.o.now().toISOString() });
     return t;
   }
   async accessToken(opts = {}) {
@@ -927,23 +931,23 @@ var ResolutionCache = class {
   fresh(e) {
     return !!e && this.now().getTime() - new Date(e.resolvedAt).getTime() < TTL_MS2;
   }
-  async get(origin, key) {
-    const e = (await this.load()).entries[`${origin}|${key}`];
+  async get(origin, key2) {
+    const e = (await this.load()).entries[`${origin}|${key2}`];
     return this.fresh(e) ? e.moduleId : null;
   }
   /** Never throws: a read-only config dir, a full disk or a Windows EPERM on rename
    * (another qore holding the file) must not fail a command that already resolved. */
-  async put(origin, key, moduleId) {
+  async put(origin, key2, moduleId) {
     const f = await this.load();
-    f.entries[`${origin}|${key}`] = { moduleId, resolvedAt: this.now().toISOString() };
+    f.entries[`${origin}|${key2}`] = { moduleId, resolvedAt: this.now().toISOString() };
     for (const [k, e] of Object.entries(f.entries)) if (!this.fresh(e)) delete f.entries[k];
     await this.save(f);
   }
   /** Never throws, like `put`. */
-  async drop(origin, key) {
+  async drop(origin, key2) {
     const f = await this.load();
-    if (!(`${origin}|${key}` in f.entries)) return;
-    delete f.entries[`${origin}|${key}`];
+    if (!(`${origin}|${key2}` in f.entries)) return;
+    delete f.entries[`${origin}|${key2}`];
     await this.save(f);
   }
   async save(f) {
@@ -956,8 +960,8 @@ var ResolutionCache = class {
     const f = await this.load();
     const hits = [];
     for (const [k, e] of Object.entries(f.entries)) {
-      const sep3 = k.lastIndexOf("|");
-      if (keys.includes(k.slice(sep3 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep3), at: new Date(e.resolvedAt).getTime() });
+      const sep4 = k.lastIndexOf("|");
+      if (keys.includes(k.slice(sep4 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep4), at: new Date(e.resolvedAt).getTime() });
     }
     hits.sort((a, b) => b.at - a.at);
     return [...new Set(hits.map((h) => h.origin))];
@@ -1020,12 +1024,12 @@ async function isTrusted(deps2, root, moduleId) {
   return (cfg.trustedRepos?.[await keyOf(deps2, root)] ?? []).includes(moduleId);
 }
 async function trust(deps2, root, moduleId) {
-  const key = await keyOf(deps2, root);
+  const key2 = await keyOf(deps2, root);
   await deps2.config.update((c) => {
     const repos = c.trustedRepos ??= {};
-    const list = new Set(repos[key] ?? []);
+    const list = new Set(repos[key2] ?? []);
     list.add(moduleId);
-    repos[key] = [...list];
+    repos[key2] = [...list];
   });
 }
 
@@ -1186,8 +1190,8 @@ async function applyActions(deps2, o) {
           const r = await deps2.git.clone(url, action.dir);
           if (r.ok) {
             await trust(deps2, action.dir, action.module.id);
-            const key = repoKey(action.module.repoUrl);
-            if (key) await cache.put(o.portal.apiOrigin, key, action.module.id);
+            const key2 = repoKey(action.module.repoUrl);
+            if (key2) await cache.put(o.portal.apiOrigin, key2, action.module.id);
             result = { slug: action.module.slug, status: "cloned", dir: action.dir };
           } else {
             const err = classifyCloneFailure(r.stderr, action.module, o.app, o.protocol);
@@ -1432,9 +1436,9 @@ function expandPath(deps2, input2) {
 }
 function trimSeparator(p) {
   const root = parse(p).root;
-  let end = p.length;
-  while (end > root.length && (p[end - 1] === "/" || p[end - 1] === "\\")) end--;
-  return p.slice(0, end);
+  let end2 = p.length;
+  while (end2 > root.length && (p[end2 - 1] === "/" || p[end2 - 1] === "\\")) end2--;
+  return p.slice(0, end2);
 }
 async function underAFile(path) {
   for (let p = dirname3(path); ; p = dirname3(p)) {
@@ -1838,82 +1842,13 @@ function registerConfig(program, ctx) {
   });
 }
 
-// src/cli/commands/dev.ts
-import { randomBytes as randomBytes6 } from "crypto";
-import { realpath as realpath8 } from "fs/promises";
-import { constants as constants3 } from "os";
-import { dirname as dirname7, join as join21, relative as relative7 } from "path";
-import { StringDecoder } from "string_decoder";
-
-// src/core/context/repoConfig.ts
-import { readFile as readFile3 } from "fs/promises";
-import { join as join10 } from "path";
-var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
-var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var SCRIPT = /^[A-Za-z0-9:_.-]+$/;
-var invalid3 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
-function moduleDefaults(type) {
-  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
-}
-async function readRepoConfig(root) {
-  let raw;
-  try {
-    raw = await readFile3(join10(root, ".qore.json"), "utf8");
-  } catch (e) {
-    if (e.code === "ENOENT") return {};
-    throw e;
-  }
-  let doc;
-  try {
-    doc = JSON.parse(raw);
-  } catch {
-    throw invalid3("not valid JSON");
-  }
-  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid3("must be an object");
-  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
-  if (!Number.isInteger(v) || v < 1) throw invalid3("schemaVersion must be a positive integer");
-  if (v > 1) {
-    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
-  }
-  for (const f of FORBIDDEN) if (f in doc) throw invalid3(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
-  const out = {};
-  if (doc.envFile !== void 0) {
-    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid3("envFile must be a non-empty string");
-    out.envFile = doc.envFile;
-  }
-  if (doc.localSecrets !== void 0) {
-    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
-      throw invalid3("localSecrets must be a list of env key names");
-    }
-    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid3("localSecrets must not contain duplicates");
-    out.localSecrets = doc.localSecrets;
-  }
-  if (doc.dev !== void 0) {
-    const d = doc.dev;
-    if (!d || typeof d !== "object" || Array.isArray(d)) throw invalid3("dev must be an object");
-    const dev = {};
-    if (d.install !== void 0) {
-      if (typeof d.install !== "boolean") throw invalid3("dev.install must be true or false");
-      dev.install = d.install;
-    }
-    if (d.services !== void 0) {
-      if (!Array.isArray(d.services) || !d.services.every((s) => typeof s === "string" && SCRIPT.test(s))) {
-        throw invalid3("dev.services must be a list of script names");
-      }
-      if (new Set(d.services).size !== d.services.length) throw invalid3("dev.services must not contain duplicates");
-      dev.services = d.services;
-    }
-    if (d.script !== void 0) {
-      if (typeof d.script !== "string" || !SCRIPT.test(d.script)) throw invalid3("dev.script must be a script name");
-      dev.script = d.script;
-    }
-    out.dev = dev;
-  }
-  return out;
-}
+// src/cli/commands/db.ts
+import { stat as stat4 } from "fs/promises";
+import { basename as basename3, join as join15 } from "path";
+import { InvalidArgumentError } from "commander";
 
 // src/core/context/resolver.ts
-import { isAbsolute as isAbsolute2, join as join11, relative as relative4 } from "path";
+import { isAbsolute as isAbsolute2, join as join10, relative as relative4 } from "path";
 var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HINT_FLAG = "cd into a module repository, or pass --module <slug|id>.";
 var RESOLVE = "/api/cli/v1/repos/resolve";
@@ -1951,10 +1886,10 @@ async function flagOverrides(deps2, session, portal, cache, moduleId) {
     const keyed = (await repoRemotes(deps2))?.keyed ?? [];
     const derived = /* @__PURE__ */ new Map();
     const uncached = [];
-    for (const key of new Set(keyed.map((r) => r.key))) {
-      const id = await cache.get(portal.apiOrigin, key);
-      if (id) derived.set(key, /* @__PURE__ */ new Set([id]));
-      else uncached.push(key);
+    for (const key2 of new Set(keyed.map((r) => r.key))) {
+      const id = await cache.get(portal.apiOrigin, key2);
+      if (id) derived.set(key2, /* @__PURE__ */ new Set([id]));
+      else uncached.push(key2);
     }
     if (uncached.length > 0) {
       try {
@@ -2125,8 +2060,9 @@ async function anyLoggedIn(deps2, cfg) {
   }
   return false;
 }
+var isForeignRepo = (e) => e instanceof QoreError && e.code === "QORE_CONTEXT_REQUIRED" && e.details?.foreignRepo === true;
 async function resolveModuleContext(deps2, o) {
-  const cache = new ResolutionCache(join11(deps2.config.dir, "cache"), deps2.now);
+  const cache = new ResolutionCache(join10(deps2.config.dir, "cache"), deps2.now);
   const ws = await findWorkspace(deps2.cwd, deps2.home);
   if (o.module) return byFlag(deps2, o, cache, ws);
   const cfg = await deps2.config.read();
@@ -2143,7 +2079,7 @@ async function resolveModuleContext(deps2, o) {
     const said = gitError?.hint;
     throw new QoreError("QORE_CONTEXT_REQUIRED", "This repository has no remote Qore can match", {
       hint: said ? `${HINT_FLAG} git said: ${said}` : HINT_FLAG,
-      details: gitError ? { git: said ?? gitError.message } : void 0,
+      details: gitError ? { git: said ?? gitError.message } : { foreignRepo: true },
       cause: gitError
     });
   }
@@ -2172,6 +2108,7 @@ async function resolveModuleContext(deps2, o) {
   }
   const details = { triedProfiles: tried };
   if (skipped.length > 0) details.skippedProfiles = skipped;
+  if (answered.length > 0) details.foreignRepo = true;
   if (answered.length === 0) {
     const cause = skipErrors[0] ?? unsupported2;
     if (cause) throw withDetails(cause, details);
@@ -2202,183 +2139,457 @@ function pickApp2(mc, app) {
   throw new QoreError("QORE_APP_AMBIGUOUS", `${mc.module.slug} is part of several apps`, { hint: "Pass --app <slug>.", candidates: appCandidates(apps) });
 }
 
-// src/core/diagnostics/node.ts
-var KEEP_LINES = 50;
-function exitHint(tail, h) {
-  const text2 = tail.join("\n");
-  const missing = text2.match(/Cannot find (?:module|package) '([^']+)'/);
-  if (missing) {
-    return { reason: "missing-module", hint: `A dependency is missing (${missing[1]}). Run \`${h.installCommand}\`, then qore dev again.` };
-  }
-  if (/ZodError:/.test(text2)) {
-    const keys = [...text2.matchAll(/"path":\s*\[\s*"([^"]+)"/g)].map((m) => m[1]);
-    if (keys.length > 0) {
-      return {
-        reason: "invalid-env",
-        keys,
-        hint: `Missing or invalid environment variables: ${keys.join(", ")}. Set them in the portal's local secrets (then qore env pull), or in your env file.`
-      };
-    }
-  }
-  const addrInUse = text2.match(/listen EADDRINUSE: address already in use (?:\S*:)?(\d+)/);
-  if (addrInUse) {
-    const port = Number(addrInUse[1]);
-    return {
-      reason: "port-in-use",
-      port,
-      hint: `Port ${port} was taken while the server started. Run qore dev again; if it repeats, lsof -iTCP:${port} -sTCP:LISTEN names the holder.`
-    };
+// src/core/erd/dbErrors.ts
+function dbPort(url) {
+  try {
+    const u = new URL(url);
+    return u.port ? Number(u.port) : 5432;
+  } catch {
+    return null;
   }
-  if (/ECONNREFUSED/.test(text2)) {
-    const m = text2.match(/ECONNREFUSED\s+\S*:(\d+)/) ?? text2.match(/code: 'ECONNREFUSED'[^}]*?port: (\d+)/);
-    if (!m) return { reason: "conn-refused", hint: "A connection was refused (ECONNREFUSED) \u2014 a service this module calls is not running." };
-    const port = Number(m[1]);
-    const role = h.ports.get(port);
-    if (role?.kind === "database") {
-      const up = h.runCommand("db:up");
-      return {
-        reason: "conn-refused",
-        port,
-        hint: `The database on :${port} is not accepting connections (ECONNREFUSED). ` + (up ? `Fix: ${up}  (docker compose ps shows its state)` : "docker compose ps shows its state.")
-      };
-    }
-    if (role?.kind === "provider") {
-      return {
-        reason: "conn-refused",
-        port,
-        hint: `${role.key} points at :${port}, where nothing listens (ECONNREFUSED). Start that module \u2014 qore dev in the workspace root starts providers first.`
-      };
-    }
-    return { reason: "conn-refused", port, hint: `Nothing listens on :${port} (ECONNREFUSED) \u2014 a service this module calls is not running.` };
+}
+function connectionOf(url) {
+  try {
+    const u = new URL(url);
+    return { host: u.hostname, port: u.port ? Number(u.port) : 5432, database: decodeURIComponent(u.pathname.replace(/^\//, "")) };
+  } catch {
+    return { host: "", port: 0, database: "" };
   }
-  const auth = text2.match(/password authentication failed for user "([^"]+)"/);
-  if (auth) {
-    const reset = h.runCommand("db:reset");
-    return {
-      reason: "db-auth",
-      hint: `The local database was created with other credentials than the portal now provides (user ${auth[1]}).` + (reset ? ` Fix: ${reset} \u2014 this wipes local data.` : "")
-    };
+}
+function classifyDbError(e, url) {
+  const { code, message } = e;
+  const port = dbPort(url);
+  const where = port === null ? "The database" : `The database on :${port}`;
+  if (code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "ETIMEDOUT" || /timeout expired/i.test(message ?? "")) {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", `${where} is not accepting connections`, {
+      hint: "Start it with `qore dev` (or `pnpm db:up`), then run qore db erd again.",
+      details: { reason: "conn-refused", port }
+    });
   }
-  const relation = text2.match(/relation "([^"]+)" does not exist/);
-  if (relation) {
-    const reset = h.runCommand("db:reset");
-    return {
-      reason: "db-schema",
-      hint: `The database schema is behind the code (relation ${relation[1]} does not exist). Migrations run when the app starts; if they failed above, that error is the cause.` + (reset ? ` To start clean: ${reset} (wipes local data).` : "")
-    };
+  if (code === "28P01" || code === "28000") {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", `${where} rejected the credentials in DATABASE_URL`, {
+      hint: "The local database was created with other credentials than the portal now provides. `pnpm db:reset` recreates it \u2014 this deletes local data.",
+      details: { reason: "db-auth", port }
+    });
   }
-  if (/ENOSPC: System limit for number of file watchers reached/.test(text2)) {
-    return {
-      reason: "watcher-limit",
-      hint: "Linux ran out of file watchers. Raise the limit: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p"
-    };
+  if (code === "3D000") {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", "The database named in DATABASE_URL does not exist", {
+      hint: "Start the app once with `qore dev` so its migrations create it, or run `pnpm db:reset`.",
+      details: { reason: "db-schema", port }
+    });
   }
-  return null;
+  return new QoreError("QORE_SERVICE_UNHEALTHY", `Could not read the database: ${message ?? String(e)}`, {
+    hint: "Check DATABASE_URL in the env file, then run qore db erd again.",
+    details: { port }
+  });
 }
 
-// src/core/dev/env.ts
-import { dirname as dirname6, join as join14 } from "path";
-
-// src/core/env/fetch.ts
-async function fetchLocalEnv(deps2, mc, app) {
-  await ensureCapability(deps2, mc.portal.apiOrigin, "module.local-env");
-  try {
-    const local = await mc.session.api.get(
-      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`
-    );
-    deps2.registerSecrets(Object.values(local.env));
-    return local;
-  } catch (e) {
-    if (!(e instanceof QoreError) || e.code !== "QORE_ACCESS_DENIED") throw e;
-    if (e.serverCode === "app.access.denied") {
-      throw withDetails(
-        e,
-        { required: "write", have: mc.module.access },
-        `You have ${mc.module.access} on ${mc.module.slug}; local secrets need write. Ask a maintainer of the app's dev team for write access.`
-      );
+// src/core/erd/app.ts
+function orderModules(modules) {
+  const bySlug = new Map(modules.map((m) => [m.slug, m]));
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (m, trail) => {
+    if (seen.has(m.slug) || trail.has(m.slug)) return;
+    trail.add(m.slug);
+    for (const dep of m.dependsOn) {
+      const d = bySlug.get(dep);
+      if (d) visit(d, trail);
     }
-    if (e.serverCode === "auth.scope.insufficient") throw withDetails(e, {}, "Run `qore login` again.");
-    throw e;
+    seen.add(m.slug);
+    out.push(m);
+  };
+  for (const m of modules) visit(m, /* @__PURE__ */ new Set());
+  return out;
+}
+function groupDatabases(modules) {
+  const groups = [];
+  for (const m of modules) {
+    if (!m.url) continue;
+    const c = connectionOf(m.url);
+    const same2 = groups.find((g) => g.connection.host === c.host && g.connection.port === c.port && g.connection.database === c.database);
+    if (same2) {
+      same2.modules.push(m.slug);
+      continue;
+    }
+    groups.push({ key: m.slug, modules: [m.slug], url: m.url, connection: c });
   }
+  return groups;
 }
-
-// src/core/env/merge.ts
-function parseEnv(contents) {
-  const map = /* @__PURE__ */ new Map();
-  for (const line2 of contents.split("\n")) {
-    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
-    if (m?.[1] !== void 0 && m[2] !== void 0) map.set(m[1], m[2]);
+var REF = /(?:^|\s)->\s*(?:([A-Za-z0-9_-]+):)?([A-Za-z_][\w]*)\.([A-Za-z_][\w]*)\.([A-Za-z_][\w]*)/;
+function parseRef(comment) {
+  const m = comment ? REF.exec(comment) : null;
+  return m ? { module: m[1] ?? null, schema: m[2], table: m[3], column: m[4] } : null;
+}
+function findEnd(dbs, ref, from) {
+  const has = (d) => d.model?.tables.some((t) => t.schema === ref.schema && t.name === ref.table && t.columns.some((c) => c.name === ref.column)) ?? false;
+  const candidates = ref.module ? dbs.filter((d) => d.modules.includes(ref.module)) : [...dbs.filter((d) => d.key !== from), ...dbs.filter((d) => d.key === from)];
+  const hit2 = candidates.find(has);
+  return hit2 ? { database: hit2.key, schema: ref.schema, table: ref.table, column: ref.column } : null;
+}
+function resolveRefs(dbs) {
+  const refs = [];
+  for (const d of dbs) for (const t of d.model?.tables ?? []) for (const c of t.columns) {
+    const ref = parseRef(c.comment);
+    const to = ref && findEnd(dbs, ref, d.key);
+    if (to) refs.push({ from: { database: d.key, schema: t.schema, table: t.name, column: c.name }, to });
   }
-  return map;
+  return refs;
 }
-function isManagedKey(key, managed) {
-  for (const pattern of managed) {
-    if (pattern.endsWith("*")) {
-      if (key.startsWith(pattern.slice(0, -1))) return true;
-    } else if (key === pattern) return true;
+function combineModels(dbs) {
+  return {
+    tables: dbs.flatMap((d) => (d.model?.tables ?? []).map((t) => ({ ...t, database: d.key }))),
+    enums: dbs.flatMap((d) => (d.model?.enums ?? []).map((e) => ({ ...e, database: d.key }))),
+    databases: dbs.map((d) => ({
+      key: d.key,
+      modules: d.modules,
+      connection: d.connection,
+      ...d.error ? { error: d.error } : {},
+      ...d.migrations ? { migrations: d.migrations } : {}
+    })),
+    refs: resolveRefs(dbs)
+  };
+}
+
+// src/core/erd/introspect.ts
+var USER_SCHEMAS = `n.nspname not in ('pg_catalog', 'information_schema') and n.nspname not like 'pg_toast%' and n.nspname not like 'pg_temp%'`;
+var TABLE_KIND = `c.relkind in ('r', 'p') and not c.relispartition`;
+var TABLES = `
+select n.nspname as schema, c.relname as name, obj_description(c.oid, 'pg_class') as comment
+from pg_class c join pg_namespace n on n.oid = c.relnamespace
+where ${TABLE_KIND} and ${USER_SCHEMAS}
+order by 1, 2`;
+var COLUMNS = `
+select n.nspname as schema, c.relname as table, a.attname as name,
+       format_type(a.atttypid, a.atttypmod) as type, a.attnotnull as not_null,
+       pg_get_expr(d.adbin, d.adrelid) as "default", col_description(c.oid, a.attnum) as comment
+from pg_attribute a
+join pg_class c on c.oid = a.attrelid
+join pg_namespace n on n.oid = c.relnamespace
+left join pg_attrdef d on d.adrelid = a.attrelid and d.adnum = a.attnum
+where ${TABLE_KIND} and a.attnum > 0 and not a.attisdropped and ${USER_SCHEMAS}
+order by n.nspname, c.relname, a.attnum`;
+var CONSTRAINTS = `
+select n.nspname as schema, c.relname as table, con.conname as name, con.contype::text as type,
+       (select array_agg(a.attname::text order by k.ord)
+          from unnest(con.conkey) with ordinality as k(attnum, ord)
+          join pg_attribute a on a.attrelid = con.conrelid and a.attnum = k.attnum) as columns,
+       fn.nspname as target_schema, fc.relname as target_table,
+       (select array_agg(a.attname::text order by k.ord)
+          from unnest(con.confkey) with ordinality as k(attnum, ord)
+          join pg_attribute a on a.attrelid = con.confrelid and a.attnum = k.attnum) as target_columns,
+       con.confupdtype::text as on_update, con.confdeltype::text as on_delete,
+       pg_get_constraintdef(con.oid) as definition
+from pg_constraint con
+join pg_class c on c.oid = con.conrelid
+join pg_namespace n on n.oid = c.relnamespace
+left join pg_class fc on fc.oid = con.confrelid
+left join pg_namespace fn on fn.oid = fc.relnamespace
+where con.contype in ('p', 'u', 'f', 'c') and not c.relispartition and ${USER_SCHEMAS}
+order by n.nspname, c.relname, con.conname`;
+var INDEXES = `
+select n.nspname as schema, c.relname as table, ic.relname as name, i.indisunique as "unique", am.amname as method,
+       (select array_agg(pg_get_indexdef(i.indexrelid, k.n, true) order by k.n)
+          from generate_series(1, i.indnkeyatts) as k(n)) as columns
+from pg_index i
+join pg_class c on c.oid = i.indrelid
+join pg_class ic on ic.oid = i.indexrelid
+join pg_namespace n on n.oid = c.relnamespace
+join pg_am am on am.oid = ic.relam
+where ${TABLE_KIND} and not i.indisprimary
+  and not exists (select 1 from pg_constraint x where x.conindid = i.indexrelid and x.contype in ('p', 'u'))
+  and ${USER_SCHEMAS}
+order by n.nspname, c.relname, ic.relname`;
+var ENUMS = `
+select n.nspname as schema, t.typname as name, array_agg(e.enumlabel::text order by e.enumsortorder) as "values"
+from pg_type t
+join pg_namespace n on n.oid = t.typnamespace
+join pg_enum e on e.enumtypid = t.oid
+where t.typtype = 'e' and ${USER_SCHEMAS}
+group by 1, 2 order by 1, 2`;
+var FK_ACTION = { a: "NO_ACTION", r: "RESTRICT", c: "CASCADE", n: "SET_NULL", d: "SET_DEFAULT" };
+var str = (v) => String(v);
+var strOrNull = (v) => v === null || v === void 0 ? null : String(v);
+function strArray(v) {
+  if (Array.isArray(v)) return v.map(str);
+  if (typeof v === "string" && v.startsWith("{") && v.endsWith("}")) {
+    return v.length === 2 ? [] : v.slice(1, -1).split(",").map((s) => s.replace(/^"|"$/g, ""));
   }
-  return false;
+  return [];
 }
-function planEnvUpdate({
-  current,
-  fetched,
-  choices = {},
-  defaultChoice = "keep",
-  managed = []
-}) {
-  const merged = new Map(current);
-  const conflicts = [];
-  const added = [];
-  const unchanged = [];
-  const overwritten = [];
-  for (const [key, portalValue] of Object.entries(fetched)) {
-    const hasLocal = current.has(key);
-    const localValue = current.get(key);
-    const localEmpty = !hasLocal || localValue === "" || localValue === '""' || localValue === "''";
-    if (localEmpty) {
-      merged.set(key, portalValue);
-      added.push(key);
-      continue;
-    }
-    if (localValue === portalValue) {
-      unchanged.push(key);
-      continue;
-    }
-    if (isManagedKey(key, managed)) {
-      merged.set(key, portalValue);
-      overwritten.push(key);
-      continue;
+var key = (r) => `${str(r.schema)}.${str(r.table)}`;
+var checkExpression = (definition) => definition.replace(/^CHECK \((.*)\)$/s, "$1");
+async function introspect(query) {
+  const rows = [];
+  for (const sql of [TABLES, COLUMNS, CONSTRAINTS, INDEXES, ENUMS]) rows.push((await query(sql)).rows);
+  const [tables, columns, constraints, indexes, enums] = rows;
+  const byKey = /* @__PURE__ */ new Map();
+  for (const r of tables) {
+    const t = {
+      schema: str(r.schema),
+      name: str(r.name),
+      comment: strOrNull(r.comment),
+      columns: [],
+      primaryKey: null,
+      uniques: [],
+      foreignKeys: [],
+      checks: [],
+      indexes: []
+    };
+    byKey.set(`${t.schema}.${t.name}`, t);
+  }
+  for (const r of columns) {
+    byKey.get(key(r))?.columns.push({
+      name: str(r.name),
+      type: str(r.type),
+      notNull: Boolean(r.not_null),
+      default: strOrNull(r.default),
+      comment: strOrNull(r.comment)
+    });
+  }
+  for (const r of constraints) {
+    const t = byKey.get(key(r));
+    if (!t) continue;
+    const name = str(r.name);
+    const cols = strArray(r.columns);
+    switch (str(r.type)) {
+      case "p":
+        t.primaryKey = { name, columns: cols };
+        break;
+      case "u":
+        t.uniques.push({ name, columns: cols });
+        break;
+      case "c":
+        t.checks.push({ name, expression: checkExpression(str(r.definition)) });
+        break;
+      case "f":
+        t.foreignKeys.push({
+          name,
+          columns: cols,
+          targetSchema: str(r.target_schema),
+          targetTable: str(r.target_table),
+          targetColumns: strArray(r.target_columns),
+          onUpdate: FK_ACTION[str(r.on_update)] ?? "NO_ACTION",
+          onDelete: FK_ACTION[str(r.on_delete)] ?? "NO_ACTION"
+        });
+        break;
     }
-    conflicts.push(key);
-    const choice = choices[key] ?? defaultChoice;
-    merged.set(key, choice === "use-portal" ? portalValue : localValue);
   }
-  return { merged, conflicts, added, unchanged, overwritten };
+  for (const r of indexes) {
+    byKey.get(key(r))?.indexes.push({ name: str(r.name), unique: Boolean(r.unique), columns: strArray(r.columns), method: str(r.method) });
+  }
+  return {
+    tables: [...byKey.values()],
+    enums: enums.map((r) => ({ schema: str(r.schema), name: str(r.name), values: strArray(r.values) }))
+  };
 }
-function renderEnv(original, merged) {
-  const seen = /* @__PURE__ */ new Set();
-  const lines = original.split("\n");
-  const out = lines.map((line2) => {
-    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
-    if (!m?.[1]) return line2;
-    const key = m[1];
-    if (!merged.has(key)) return line2;
-    seen.add(key);
-    return `${key}=${merged.get(key) ?? ""}`;
-  });
-  const appended = [];
-  for (const [key, value] of merged) {
-    if (!seen.has(key)) appended.push(`${key}=${value}`);
+
+// src/core/erd/migrations.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join11 } from "path";
+var JOURNAL = join11("src", "db", "migrations", "meta", "_journal.json");
+async function readJournal(repoRoot) {
+  let text2;
+  try {
+    text2 = await readFile3(join11(repoRoot, JOURNAL), "utf8");
+  } catch {
+    return null;
   }
-  let text2 = out.join("\n");
-  if (appended.length) {
-    if (text2.length && !text2.endsWith("\n")) text2 += "\n";
-    text2 += appended.join("\n") + "\n";
+  try {
+    return JSON.parse(text2).entries ?? [];
+  } catch {
+    return null;
   }
-  return text2;
+}
+async function appliedMigrations(query) {
+  const { rows: [ledger] } = await query(`select to_regclass('drizzle.__drizzle_migrations') is not null as present`);
+  if (!ledger?.present) return [];
+  const { rows } = await query(`select created_at::text as at from drizzle.__drizzle_migrations`);
+  return rows.map((r) => Number(r.at));
+}
+function compareMigrations(journal, applied) {
+  const latest = applied.reduce((a, b) => Math.max(a, b), 0);
+  const done = new Set(applied);
+  const known = new Set(journal.map((e) => e.when));
+  const missing = journal.filter((e) => !done.has(e.when));
+  return {
+    pending: missing.filter((e) => e.when > latest).map((e) => e.tag),
+    skipped: missing.filter((e) => e.when <= latest).map((e) => e.tag),
+    unknown: applied.filter((a) => !known.has(a)).length
+  };
+}
+async function checkMigrations(repoRoot, query) {
+  const journal = repoRoot ? await readJournal(repoRoot) : null;
+  return journal ? compareMigrations(journal, await appliedMigrations(query)) : void 0;
 }
 
-// src/core/env/pull.ts
+// src/core/context/repoConfig.ts
+import { readFile as readFile4 } from "fs/promises";
+import { join as join12 } from "path";
+var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var SCRIPT = /^[A-Za-z0-9:_.-]+$/;
+var invalid3 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
+function moduleDefaults(type) {
+  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
+}
+async function readRepoConfig(root) {
+  let raw;
+  try {
+    raw = await readFile4(join12(root, ".qore.json"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return {};
+    throw e;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    throw invalid3("not valid JSON");
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid3("must be an object");
+  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
+  if (!Number.isInteger(v) || v < 1) throw invalid3("schemaVersion must be a positive integer");
+  if (v > 1) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
+  }
+  for (const f of FORBIDDEN) if (f in doc) throw invalid3(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
+  const out = {};
+  if (doc.envFile !== void 0) {
+    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid3("envFile must be a non-empty string");
+    out.envFile = doc.envFile;
+  }
+  if (doc.localSecrets !== void 0) {
+    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
+      throw invalid3("localSecrets must be a list of env key names");
+    }
+    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid3("localSecrets must not contain duplicates");
+    out.localSecrets = doc.localSecrets;
+  }
+  if (doc.dev !== void 0) {
+    const d = doc.dev;
+    if (!d || typeof d !== "object" || Array.isArray(d)) throw invalid3("dev must be an object");
+    const dev = {};
+    if (d.install !== void 0) {
+      if (typeof d.install !== "boolean") throw invalid3("dev.install must be true or false");
+      dev.install = d.install;
+    }
+    if (d.services !== void 0) {
+      if (!Array.isArray(d.services) || !d.services.every((s) => typeof s === "string" && SCRIPT.test(s))) {
+        throw invalid3("dev.services must be a list of script names");
+      }
+      if (new Set(d.services).size !== d.services.length) throw invalid3("dev.services must not contain duplicates");
+      dev.services = d.services;
+    }
+    if (d.script !== void 0) {
+      if (typeof d.script !== "string" || !SCRIPT.test(d.script)) throw invalid3("dev.script must be a script name");
+      dev.script = d.script;
+    }
+    out.dev = dev;
+  }
+  return out;
+}
+
+// src/core/env/fetch.ts
+async function fetchLocalEnv(deps2, mc, app) {
+  await ensureCapability(deps2, mc.portal.apiOrigin, "module.local-env");
+  try {
+    const local = await mc.session.api.get(
+      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`
+    );
+    deps2.registerSecrets(Object.values(local.env));
+    return local;
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_ACCESS_DENIED") throw e;
+    if (e.serverCode === "app.access.denied") {
+      throw withDetails(
+        e,
+        { required: "write", have: mc.module.access },
+        `You have ${mc.module.access} on ${mc.module.slug}; local secrets need write. Ask a maintainer of the app's dev team for write access.`
+      );
+    }
+    if (e.serverCode === "auth.scope.insufficient") throw withDetails(e, {}, "Run `qore login` again.");
+    throw e;
+  }
+}
+
+// src/core/env/merge.ts
+function parseEnv(contents) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line2 of contents.split("\n")) {
+    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (m?.[1] !== void 0 && m[2] !== void 0) map.set(m[1], m[2]);
+  }
+  return map;
+}
+function isManagedKey(key2, managed) {
+  for (const pattern of managed) {
+    if (pattern.endsWith("*")) {
+      if (key2.startsWith(pattern.slice(0, -1))) return true;
+    } else if (key2 === pattern) return true;
+  }
+  return false;
+}
+function planEnvUpdate({
+  current,
+  fetched,
+  choices = {},
+  defaultChoice = "keep",
+  managed = []
+}) {
+  const merged = new Map(current);
+  const conflicts = [];
+  const added = [];
+  const unchanged = [];
+  const overwritten = [];
+  for (const [key2, portalValue] of Object.entries(fetched)) {
+    const hasLocal = current.has(key2);
+    const localValue = current.get(key2);
+    const localEmpty = !hasLocal || localValue === "" || localValue === '""' || localValue === "''";
+    if (localEmpty) {
+      merged.set(key2, portalValue);
+      added.push(key2);
+      continue;
+    }
+    if (localValue === portalValue) {
+      unchanged.push(key2);
+      continue;
+    }
+    if (isManagedKey(key2, managed)) {
+      merged.set(key2, portalValue);
+      overwritten.push(key2);
+      continue;
+    }
+    conflicts.push(key2);
+    const choice = choices[key2] ?? defaultChoice;
+    merged.set(key2, choice === "use-portal" ? portalValue : localValue);
+  }
+  return { merged, conflicts, added, unchanged, overwritten };
+}
+function renderEnv(original, merged) {
+  const seen = /* @__PURE__ */ new Set();
+  const lines = original.split("\n");
+  const out = lines.map((line2) => {
+    const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!m?.[1]) return line2;
+    const key2 = m[1];
+    if (!merged.has(key2)) return line2;
+    seen.add(key2);
+    return `${key2}=${merged.get(key2) ?? ""}`;
+  });
+  const appended = [];
+  for (const [key2, value] of merged) {
+    if (!seen.has(key2)) appended.push(`${key2}=${value}`);
+  }
+  let text2 = out.join("\n");
+  if (appended.length) {
+    if (text2.length && !text2.endsWith("\n")) text2 += "\n";
+    text2 += appended.join("\n") + "\n";
+  }
+  return text2;
+}
+
+// src/core/env/pull.ts
 import { lstat, realpath as realpath5 } from "fs/promises";
 import { basename, dirname as dirname4, isAbsolute as isAbsolute3, relative as relative5, resolve as resolve5, sep as sep2 } from "path";
 var outside = (target) => new QoreError("QORE_CONTEXT_INVALID", `The env file must be inside the repository (got ${target})`, {
@@ -2424,11 +2635,11 @@ function planPull(o) {
   const r = planEnvUpdate({ current, fetched: o.fetched, choices: o.choices ?? {}, defaultChoice: o.defaultChoice, managed: o.managed });
   const choiceOf = (k) => o.choices?.[k] ?? o.defaultChoice;
   const generated = [];
-  for (const key of o.localSecrets) {
-    const v = r.merged.get(key);
+  for (const key2 of o.localSecrets) {
+    const v = r.merged.get(key2);
     if (v === void 0 || v === "" || v === '""' || v === "''") {
-      r.merged.set(key, o.random());
-      generated.push(key);
+      r.merged.set(key2, o.random());
+      generated.push(key2);
     }
   }
   return {
@@ -2446,50 +2657,720 @@ function planPull(o) {
 }
 
 // src/core/env/write.ts
-import { chmod as chmod2, readFile as readFile4, rename as rename3, unlink, writeFile as writeFile4 } from "fs/promises";
+import { chmod as chmod2, readFile as readFile5, rename as rename3, unlink, writeFile as writeFile4 } from "fs/promises";
 import { randomBytes as randomBytes4 } from "crypto";
-import { basename as basename2, dirname as dirname5, join as join12 } from "path";
+import { basename as basename2, dirname as dirname5, join as join13 } from "path";
 async function readOrNull(p) {
   try {
-    return await readFile4(p, "utf8");
+    return await readFile5(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
   }
-}
-async function writeSecurely(target, text2) {
-  const base = basename2(target);
-  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes4(6).toString("hex")}.local` : `${base}.qore-${randomBytes4(6).toString("hex")}.tmp`;
-  const tmp = join12(dirname5(target), tmpName);
-  try {
-    await writeFile4(tmp, text2, { mode: 384, flag: "wx" });
-    await chmod2(tmp, 384);
-    await rename3(tmp, target);
-  } finally {
-    await unlink(tmp).catch(() => {
-    });
+}
+async function writeSecurely(target, text2) {
+  const base = basename2(target);
+  const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes4(6).toString("hex")}.local` : `${base}.qore-${randomBytes4(6).toString("hex")}.tmp`;
+  const tmp = join13(dirname5(target), tmpName);
+  try {
+    await writeFile4(tmp, text2, { mode: 384, flag: "wx" });
+    await chmod2(tmp, 384);
+    await rename3(tmp, target);
+  } finally {
+    await unlink(tmp).catch(() => {
+    });
+  }
+}
+async function syncEnvFile(o) {
+  const existing = await readOrNull(o.target);
+  const plan = planPull({
+    existing,
+    example: existing === null ? o.example : null,
+    fetched: o.fetched,
+    managed: o.managed,
+    localSecrets: o.localSecrets,
+    defaultChoice: "keep",
+    random: o.random
+  });
+  if (existing !== null && plan.text === existing) await chmod2(o.target, 384);
+  else await writeSecurely(o.target, plan.text);
+  return { created: plan.created, kept: plan.kept };
+}
+
+// src/core/erd/source.ts
+function noDatabase(slug) {
+  return new QoreError("QORE_CONTEXT_UNSUPPORTED", `${slug} has no database`, {
+    hint: "qore db erd shows a module's own Postgres (DATABASE_URL); this module declares none."
+  });
+}
+async function resolveDatabaseUrl(deps2, mc, app) {
+  if (mc.repoRoot) {
+    const cfg = await readRepoConfig(mc.repoRoot);
+    const envFile = await resolveTarget(mc.repoRoot, cfg.envFile ?? moduleDefaults(mc.module.type).envFile);
+    const text2 = await readOrNull(envFile);
+    const url2 = text2 === null ? void 0 : parseEnv(text2).get("DATABASE_URL")?.trim().replace(/^["']|["']$/g, "");
+    if (url2) {
+      deps2.registerSecrets([url2]);
+      return { url: url2, source: "env-file", envFile };
+    }
+  }
+  const local = await fetchLocalEnv(deps2, mc, app);
+  const url = local.env.DATABASE_URL?.trim();
+  if (!url) throw noDatabase(mc.module.slug);
+  return { url, source: "portal", envFile: null };
+}
+
+// src/platform/httpServe.ts
+import { readFile as readFile6 } from "fs/promises";
+import { createServer } from "http";
+import { extname, resolve as resolve6, sep as sep3 } from "path";
+var TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json",
+  ".ico": "image/x-icon",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+async function serveErd(o) {
+  const root = resolve6(o.dir);
+  let port = 0;
+  const server = createServer((req, res) => {
+    void handle(req, res);
+  });
+  await new Promise((ok2, fail) => {
+    server.once("error", fail);
+    server.listen(o.port, "127.0.0.1", () => {
+      server.off("error", fail);
+      ok2();
+    });
+  });
+  port = server.address().port;
+  async function handle(req, res) {
+    try {
+      await route(req, res);
+    } catch (e) {
+      if (res.headersSent) res.destroy();
+      else end(res, e instanceof TypeError ? 400 : 500);
+    }
+  }
+  async function route(req, res) {
+    const host = req.headers.host;
+    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return end(res, 403);
+    if (req.method !== "GET" && req.method !== "HEAD") return end(res, 405);
+    const path = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+    const produce = o.routes[path];
+    if (produce) {
+      try {
+        const body = JSON.stringify(await produce());
+        res.writeHead(200, { "content-type": TYPES[".json"], "cache-control": "no-store" });
+        res.end(body);
+        return;
+      } catch (e) {
+        try {
+          o.onError(e);
+        } catch {
+        }
+        res.writeHead(500, { "content-type": TYPES[".json"] });
+        res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+        return;
+      }
+    }
+    const file = resolve6(root, `.${path === "/" ? "/index.html" : path}`);
+    if (file !== root && !file.startsWith(root + sep3)) return end(res, 404);
+    try {
+      const body = await readFile6(file);
+      res.writeHead(200, { "content-type": TYPES[extname(file)] ?? "application/octet-stream" });
+      res.end(body);
+    } catch {
+      end(res, 404);
+    }
+  }
+  return {
+    port,
+    close: () => new Promise((ok2) => {
+      server.closeAllConnections();
+      server.close(() => ok2());
+    })
+  };
+}
+function end(res, status2) {
+  res.writeHead(status2);
+  res.end();
+}
+
+// src/cli/context.ts
+var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
+async function pick(ctx, err, message, choices) {
+  if (!ctx.io.interactive) throw err;
+  return ctx.io.select(message, choices);
+}
+async function moduleContextFor(ctx, flags, command) {
+  const g = ctx.opts();
+  const onRequest = g.verbose ? (l) => ctx.io.err(l) : void 0;
+  const base = { portal: g.portal, module: flags.module, command, onRequest };
+  try {
+    return await resolveModuleContext(ctx.deps, base);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" || !ctx.io.interactive) throw e;
+    if (allOfKind(e.candidates, "module")) {
+      const choose2 = await pick(
+        ctx,
+        e,
+        "Select a module",
+        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : ""}${c.slug}  (${c.remote})`, value: c.id }))
+      );
+      return resolveModuleContext(ctx.deps, { ...base, choose: choose2 });
+    }
+    if (allOfKind(e.candidates, "tenant")) {
+      const tenant = await pick(ctx, e, "Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
+      return resolveModuleContext(ctx.deps, { ...base, tenant });
+    }
+    throw e;
+  }
+}
+async function appFor(ctx, mc, app) {
+  try {
+    return pickApp2(mc, app);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
+    const id = await pick(ctx, e, "Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
+    return pickApp2(mc, id);
+  }
+}
+function sourceText(mc) {
+  if (mc.source.kind === "remote") return mc.source.remote;
+  if (mc.source.kind === "workspace") return WORKSPACE_FILE;
+  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : "--module";
+}
+function contextLine(mc, app) {
+  const parts = [mc.module.tenant.name, ...app ? [app.name] : [], mc.module.slug];
+  return `\u2192 ${parts.join(" / ")}  (${sourceText(mc)})`;
+}
+function contextJson(mc, app) {
+  const { id, slug, name, type, access: access2 } = mc.module;
+  return {
+    portal: mc.portal.builtin ?? mc.portal.apiOrigin,
+    tenant: mc.module.tenant,
+    app: app ?? null,
+    module: { id, slug, name, type, access: access2 },
+    source: mc.source.kind === "remote" ? mc.source.remote : mc.source.kind === "workspace" ? WORKSPACE_FILE : "--module",
+    ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
+  };
+}
+
+// src/cli/project.ts
+import { readdir as readdir2, stat as stat3 } from "fs/promises";
+import { join as join14 } from "path";
+
+// src/core/projects/match.ts
+function readings(ref) {
+  const s = ref.split("/").map((x) => x.trim());
+  if (s.some((x) => x === "")) return [];
+  if (s.length === 1) return [{ app: s[0] }];
+  if (s.length === 2) return [{ app: s[0], module: s[1] }, { tenant: s[0], app: s[1] }];
+  if (s.length === 3) return [{ tenant: s[0], app: s[1], module: s[2] }];
+  return [];
+}
+function hit(p, w) {
+  if (p.appSlug !== w.app || w.tenant !== void 0 && p.tenantSlug !== w.tenant) return null;
+  if (p.kind === "module") return w.module === p.moduleSlug ? { project: p } : null;
+  return w.module ? { project: p, module: w.module } : { project: p };
+}
+function matchProjects(projects, ref) {
+  const out = [];
+  for (const w of readings(ref)) {
+    for (const p of projects) {
+      const m = hit(p, w);
+      if (m) out.push(m);
+    }
+  }
+  return out;
+}
+
+// src/cli/project.ts
+async function loggedInAs(ctx) {
+  const cfg = await ctx.deps.config.read();
+  const portal = resolvePortal(ctx.opts().portal, cfg.defaultProfile);
+  const p = cfg.profiles[portal.apiOrigin];
+  if (!p || !await new TokenStore(ctx.deps.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return null;
+  return p.email ?? p.sub ?? portal.apiOrigin;
+}
+var isDir = async (p) => (await stat3(p).catch(() => null))?.isDirectory() ?? false;
+var label2 = (p) => `${p.tenantSlug} / ${p.appSlug}${p.kind === "module" ? ` / ${p.moduleSlug}` : ""}${p.source === "registry" ? `  (${p.path})` : ""}`;
+var candidate = (p) => p.kind === "module" ? { kind: "module", id: p.moduleId, slug: p.moduleSlug, tenant: p.tenantSlug, name: p.path } : { kind: "app", slug: p.appSlug, tenant: p.tenantSlug, name: p.path };
+var withCwd = (ctx, cwd) => ({ ...ctx, deps: { ...ctx.deps, cwd } });
+async function standingIn(ctx) {
+  if (await findWorkspace(ctx.deps.cwd, ctx.deps.home)) return "workspace";
+  const repo = await findRepoRoot(ctx.deps.cwd);
+  return repo !== null && !isInside(repo, ctx.deps.home) ? { repo } : null;
+}
+async function isForeign(ctx, command) {
+  const g = ctx.opts();
+  try {
+    await resolveModuleContext(ctx.deps, { portal: g.portal, command, onRequest: g.verbose ? (l) => ctx.io.err(l) : void 0 });
+    return false;
+  } catch (e) {
+    if (e instanceof CancelledError) throw e;
+    return isForeignRepo(e);
+  }
+}
+async function moduleDirs(wsPath) {
+  const out = [];
+  for (const d of await readdir2(wsPath, { withFileTypes: true }).catch(() => [])) {
+    if (d.isDirectory() && !d.name.startsWith(".") && await stat3(join14(wsPath, d.name, ".git")).catch(() => null)) out.push(d.name);
+  }
+  return out.sort();
+}
+async function pathFor(ctx, m, needModule) {
+  const p = m.project;
+  if (p.kind === "module") return p.path;
+  if (m.module) {
+    const dir2 = join14(p.path, m.module);
+    if (!await isDir(dir2)) {
+      throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no checkout of module ${m.module} in ${p.path}`, {
+        hint: `Run \`qore sync\` in ${p.path} to clone the app's missing modules.`
+      });
+    }
+    return dir2;
+  }
+  if (!needModule) return p.path;
+  const dirs = await moduleDirs(p.path);
+  if (dirs.length === 1) return join14(p.path, dirs[0]);
+  if (dirs.length === 0) {
+    throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no module checkouts in ${p.path}`, {
+      hint: `Run \`qore sync\` in ${p.path}.`
+    });
+  }
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `${p.appSlug} has several modules \u2014 which one?`, {
+      hint: `Pass ${p.appSlug}/<module>.`,
+      candidates: dirs.map((slug) => ({ kind: "module", slug, tenant: p.tenantSlug, name: join14(p.path, slug) }))
+    });
+  }
+  return join14(p.path, await ctx.io.select("Select a module", dirs.map((d) => ({ name: d, value: d }))));
+}
+async function liveMatches(matches) {
+  const live = [];
+  for (const m of matches) {
+    if (m.project.kind === "workspace" && m.module && !await isDir(join14(m.project.path, m.module))) continue;
+    live.push(m);
+  }
+  return live.length > 0 ? live : matches;
+}
+async function choose(ctx, matches, what, explicit) {
+  if (explicit && matches.length === 1) return matches[0];
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", what, {
+      hint: "Pass a more specific reference: tenant/app or app/module.",
+      candidates: matches.map((m) => candidate(m.project))
+    });
+  }
+  const i = await ctx.io.select("Select a project", matches.map((m, idx) => ({
+    name: m.module ? `${label2(m.project)} / ${m.module}` : label2(m.project),
+    value: idx
+  })));
+  return matches[i];
+}
+async function projectCtx(ctx, o) {
+  const g = ctx.opts();
+  const cfg = await ctx.deps.config.read();
+  const portal = g.portal ? resolvePortal(g.portal, cfg.defaultProfile).apiOrigin : void 0;
+  if (o.ref) {
+    const matches = matchProjects(await knownProjects(ctx.deps, { portal }), o.ref);
+    if (matches.length === 0) {
+      const parts = o.ref.split("/");
+      const app = parts.length === 1 ? o.ref : parts.length === 3 ? parts[1] : "<app>";
+      throw new QoreError("QORE_PROJECT_NOT_FOUND", `No local project "${o.ref}"`, {
+        hint: cfg.projectsRoot ? `Run \`qore clone ${app}\`.` : `Run \`qore init\`, or \`qore clone ${app}\`.`
+      });
+    }
+    const m2 = await choose(ctx, await liveMatches(matches), `"${o.ref}" matches several projects`, true);
+    return relocate(ctx, await pathFor(ctx, m2, o.needModule));
+  }
+  if (o.module || o.app) return ctx;
+  const here = await standingIn(ctx);
+  if (here === "workspace") return ctx;
+  const known = await knownProjects(ctx.deps, { portal });
+  if (here && (known.length === 0 || known.some((p) => isInside(p.path, here.repo)) || !await isForeign(ctx, o.command ?? "project"))) return ctx;
+  if (known.length === 0) {
+    if (!cfg.projectsRoot) {
+      if (!await loggedInAs(ctx)) return ctx;
+      throw new QoreError("QORE_ROOT_NOT_SET", "Not inside a project, and qore knows no projects yet", {
+        hint: "Run `qore init` to choose a projects folder, or cd into a project."
+      });
+    }
+    throw new QoreError("QORE_PROJECT_NOT_FOUND", `Not inside a project, and ${cfg.projectsRoot} holds none yet`, {
+      hint: "Run `qore clone <app>`."
+    });
+  }
+  const what = here ? "This repository is not a Qore module \u2014 which project?" : "Not inside a project \u2014 which one?";
+  const m = await choose(ctx, known.map((project) => ({ project })), what, false);
+  return relocate(ctx, await pathFor(ctx, m, o.needModule));
+}
+function relocate(ctx, path) {
+  if (path === ctx.deps.cwd) return ctx;
+  if (!ctx.opts().json) ctx.io.err(`\u2192 in ${path}`);
+  return withCwd(ctx, path);
+}
+async function rememberContext(ctx, mc, app) {
+  const tenantSlug = mc.module.tenant.slug;
+  if (mc.workspace && mc.workspace.appId === app.id) {
+    await remember(ctx.deps, {
+      kind: "workspace",
+      path: mc.workspace.root,
+      portal: mc.workspace.portal,
+      tenantSlug,
+      appId: app.id,
+      appSlug: app.slug
+    });
+    return;
+  }
+  if (mc.repoRoot) {
+    await remember(ctx.deps, {
+      kind: "module",
+      path: mc.repoRoot,
+      portal: mc.portal.apiOrigin,
+      tenantSlug,
+      appId: app.id,
+      appSlug: app.slug,
+      moduleId: mc.module.id,
+      moduleSlug: mc.module.slug
+    });
+  }
+}
+async function rememberWorkspace(ctx, ws, app) {
+  if (ws.appId !== app.id) return;
+  await remember(ctx.deps, { kind: "workspace", path: ws.root, portal: ws.portal, tenantSlug: app.tenant.slug, appId: app.id, appSlug: app.slug });
+}
+
+// src/cli/trustPrompt.ts
+async function ensureTrusted(ctx, mc, app, o) {
+  const root = mc.repoRoot ?? ctx.deps.cwd;
+  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
+  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
+  if (o.yes) {
+    await trust(ctx.deps, root, mc.module.id);
+    return;
+  }
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `This repository is not trusted for ${mc.module.slug} yet`, {
+      hint: "Run interactively once, or pass --yes.",
+      details: { reason: "untrusted", repository: root }
+    });
+  }
+  if (mc.source.kind === "remote") {
+    const key2 = repoKey(mc.source.url);
+    ctx.io.err(`  from remote ${mc.source.remote}: ${key2 ?? "(unparsable remote URL)"}`);
+  }
+  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
+  await trust(ctx.deps, root, mc.module.id);
+}
+
+// src/cli/commands/db.ts
+var isDir2 = async (p) => stat4(p).then((s) => s.isDirectory(), () => false);
+function parsePort(raw) {
+  const n = /^\d+$/.test(raw) ? Number(raw) : NaN;
+  if (!Number.isInteger(n) || n < 1 || n > 65535) throw new InvalidArgumentError("a port is a number from 1 to 65535");
+  return n;
+}
+var aborted = (signal) => signal.aborted ? Promise.resolve() : new Promise((r) => signal.addEventListener("abort", () => r(), { once: true }));
+var plural = (n) => `${n} migration${n === 1 ? "" : "s"}`;
+function migrationLines(m, who) {
+  if (!m) return [];
+  const lines = [];
+  if (m.pending.length) lines.push(`${who} lacks ${plural(m.pending.length)} of this checkout (${m.pending.join(", ")}); they apply on the next start of \`qore dev\`.`);
+  if (m.skipped.length) lines.push(`${who} lacks ${plural(m.skipped.length)} older than its latest (${m.skipped.join(", ")}); Drizzle never applies those, so reset it with \`pnpm db:reset\`.`);
+  if (m.unknown) lines.push(`${who} has ${plural(m.unknown)} this checkout does not know; applied from another branch?`);
+  return lines;
+}
+var portInUse = (port) => new QoreError("QORE_PORT_IN_USE", `Port ${port} is already in use`, { hint: "Pick another --port, or leave it out to get a free one." });
+function registerDb(program, ctx) {
+  const db = program.command("db").description("Work with the local databases of a module or an app");
+  db.command("erd").description("Show this module's data model in the browser \u2014 or, in a workspace root, the whole app's").argument("[project]", "app or app/module to show, from anywhere (see qore init)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "same as the [project] argument").option("--yes", "trust this repository without asking").option("--port <n>", "listen on this port (default: a free one)", parsePort).option("--no-open", "print the URL, do not open a browser").action(async (project, f) => {
+    if (project !== void 0 && f.project !== void 0 && project !== f.project) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Pass the project once: "${project}" and --project "${f.project}" differ`, {
+        hint: "qore db erd <project> | qore db erd --project <project>"
+      });
+    }
+    await erd(ctx, { ...f, project: project ?? f.project });
+  });
+}
+async function erd(outer, f) {
+  const json2 = Boolean(outer.opts().json);
+  if (json2 && (f.port !== void 0 || !f.open)) {
+    throw new QoreError("QORE_CONTEXT_INVALID", "--json writes the model and starts no server", {
+      hint: "Drop --port and --no-open, or drop --json."
+    });
+  }
+  if (f.port !== void 0 && await outer.deps.ports.inUse(f.port)) throw portInUse(f.port);
+  const ctx = await projectCtx(outer, { ref: f.project, module: f.module, app: f.app, needModule: false, command: "db erd" });
+  const { deps: deps2, io: io2 } = ctx;
+  if (!f.module) {
+    const chosen = Boolean(f.project) || ctx !== outer || Boolean(f.app);
+    const ws = await workspaceRoot(deps2) ?? (chosen ? null : await wholeAppWanted(ctx));
+    if (ws) {
+      await erdApp(ctx, f, ws);
+      return;
+    }
+  }
+  const mc = await moduleContextFor(ctx, f, "db erd");
+  const app = await appFor(ctx, mc, f.app);
+  await ensureTrusted(ctx, mc, app, { yes: f.yes });
+  const src = await resolveDatabaseUrl(deps2, mc, app);
+  const model = async () => {
+    const conn = await deps2.postgres(src.url, { timeoutMs: 3e3 });
+    try {
+      const m = await introspect(conn.query);
+      const migrations = await checkMigrations(mc.repoRoot, conn.query);
+      return migrations ? { ...m, migrations } : m;
+    } finally {
+      await conn.close().catch(() => {
+      });
+    }
+  };
+  const fresh = () => model().catch((e) => {
+    throw classifyDbError(e, src.url);
+  });
+  const first = await model().catch((e) => {
+    throw ctx.signal.aborted ? new CancelledError() : classifyDbError(e, src.url);
+  });
+  if (json2) {
+    renderJson(io2, { context: contextJson(mc, app), source: src.source, model: first });
+    return;
+  }
+  if (first.tables.length === 0) io2.err("No tables yet \u2014 have the migrations run? Start the app once with `qore dev`.");
+  for (const line2 of migrationLines(first.migrations, "The database")) io2.err(line2);
+  if (ctx.signal.aborted) throw new CancelledError();
+  const meta = { context: contextJson(mc, app), connection: connectionOf(src.url) };
+  const server = await serveErd({
+    dir: deps2.viewerDir,
+    port: f.port ?? 0,
+    routes: { "/model.json": fresh, "/meta.json": async () => meta },
+    onError: (e) => {
+      if (!ctx.signal.aborted) io2.err(`Could not refresh the model: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }).catch((e) => {
+    const code = e.code;
+    throw f.port !== void 0 && (code === "EADDRINUSE" || code === "EACCES") ? portInUse(f.port) : e;
+  });
+  await serve(ctx, f, server);
+}
+async function wholeAppWanted(ctx) {
+  if (!ctx.io.interactive) return null;
+  const ws = await findWorkspace(ctx.deps.cwd, ctx.deps.home);
+  const repo = ws && await findRepoRoot(ctx.deps.cwd);
+  if (!ws || !repo || repo === ws.root || !isInside(ws.root, repo)) return null;
+  const pick2 = await ctx.io.select("Which data model?", [
+    { name: "the whole app", value: "app" },
+    { name: `only ${basename3(repo)}`, value: "module" }
+  ]);
+  return pick2 === "app" ? ws : null;
+}
+async function serve(ctx, f, server) {
+  try {
+    const url = `http://127.0.0.1:${server.port}`;
+    ctx.io.err(`\u2192 ${url}  (Ctrl+C stops)`);
+    if (f.open) await ctx.io.openUrl(url);
+    await aborted(ctx.signal);
+    throw new CancelledError();
+  } finally {
+    await server.close();
+  }
+}
+async function erdApp(ctx, f, ws) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const json2 = Boolean(g.json);
+  const portal = await flagPortal(deps2, g.portal, ws);
+  const session = await openSession(deps2, portal, "db erd", g.verbose ? (l) => io2.err(l) : void 0);
+  await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+  const am = await workspaceAppModules(session, portal, ws);
+  const { tenant, ...app } = am.app;
+  if (f.app && f.app !== app.id && f.app !== app.slug) {
+    throw new QoreError("QORE_RESOURCE_NOT_FOUND", `This workspace is for ${app.slug}, not "${f.app}"`, { hint: "Pass --module <slug> --app <slug>." });
+  }
+  const modules = [];
+  const sources = /* @__PURE__ */ new Map();
+  const roots = /* @__PURE__ */ new Map();
+  for (const m of orderModules(am.modules)) {
+    const dir2 = join15(ws.root, m.slug);
+    const repoRoot = isSafeSlug(m.slug) && await isDir2(dir2) ? dir2 : null;
+    const mc = { portal, session, module: { ...m, tenant, apps: [app] }, source: { kind: "workspace" }, repoRoot, workspace: ws };
+    roots.set(m.slug, repoRoot);
+    if (repoRoot) await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    try {
+      const src = await resolveDatabaseUrl(deps2, mc, app);
+      modules.push({ slug: m.slug, dependsOn: m.dependsOn, url: src.url });
+      sources.set(m.slug, src.source);
+    } catch (e) {
+      if (e instanceof QoreError && e.code === "QORE_CONTEXT_UNSUPPORTED") {
+        modules.push({ slug: m.slug, dependsOn: m.dependsOn, url: null });
+        continue;
+      }
+      if (!json2 && e instanceof QoreError && e.code === "QORE_ACCESS_DENIED") {
+        io2.err(`${m.slug} is left out: ${e.message}${e.hint ? `
+  ${e.hint}` : ""}`);
+        modules.push({ slug: m.slug, dependsOn: m.dependsOn, url: null });
+        continue;
+      }
+      throw e;
+    }
+  }
+  const groups = groupDatabases(modules);
+  if (groups.length === 0) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `${app.slug} has no module with a database`, {
+      hint: "qore db erd shows the Postgres of an app's modules; none of them declares a DATABASE_URL."
+    });
+  }
+  for (const gdb of groups) deps2.registerSecrets([gdb.url]);
+  if (!json2) for (const { modules: mods, connection: c } of groups) {
+    if (mods.length > 1) io2.err(`${mods.join(" and ")} use the same database (${c.host}:${c.port}/${c.database}); each module normally has its own \u2014 check their DATABASE_URL.`);
+  }
+  const readAll = (strict) => Promise.all(groups.map(async (gdb) => {
+    try {
+      const conn = await deps2.postgres(gdb.url, { timeoutMs: 3e3 });
+      try {
+        const model = await introspect(conn.query);
+        const migrations = gdb.modules.length === 1 ? await checkMigrations(roots.get(gdb.modules[0]) ?? null, conn.query) : void 0;
+        return { ...gdb, model, ...migrations ? { migrations } : {} };
+      } finally {
+        await conn.close().catch(() => {
+        });
+      }
+    } catch (e) {
+      const err = classifyDbError(e, gdb.url);
+      if (strict) throw err;
+      return { ...gdb, model: null, error: err.message };
+    }
+  }));
+  const first = await readAll(json2).catch((e) => {
+    throw ctx.signal.aborted ? new CancelledError() : e;
+  });
+  if (first.every((d) => d.model === null)) throw new QoreError("QORE_SERVICE_UNHEALTHY", `No database of ${app.slug} is reachable`, { hint: first.map((d) => `${d.key}: ${d.error}`).join("\n") });
+  const context = {
+    portal: portal.builtin ?? portal.apiOrigin,
+    tenant,
+    app,
+    module: null,
+    source: WORKSPACE_FILE,
+    modules: am.modules.map(({ id, slug, name, type }) => ({ id, slug, name, type, database: groups.find((gdb) => gdb.modules.includes(slug))?.key ?? null }))
+  };
+  const databases = groups.map(({ key: key2, modules: mods, connection }) => ({ key: key2, modules: mods, connection, source: sources.get(mods[0]) }));
+  if (json2) {
+    renderJson(io2, { context, databases, model: combineModels(first) });
+    return;
+  }
+  for (const d of first) if (d.error) io2.err(`${d.key} (${d.modules.join(", ")}): ${d.error}`);
+  for (const d of first) for (const line2 of migrationLines(d.migrations, `The database of ${d.modules.join(", ")}`)) io2.err(line2);
+  if (first.every((d) => !d.model || d.model.tables.length === 0)) io2.err("No tables yet \u2014 have the migrations run? Start the app once with `qore dev`.");
+  if (ctx.signal.aborted) throw new CancelledError();
+  const meta = { context, connection: null, databases: databases.map(({ key: key2, modules: mods, connection }) => ({ key: key2, modules: mods, connection })) };
+  const server = await serveErd({
+    dir: deps2.viewerDir,
+    port: f.port ?? 0,
+    routes: { "/model.json": () => readAll(false).then(combineModels), "/meta.json": async () => meta },
+    onError: (e) => {
+      if (!ctx.signal.aborted) io2.err(`Could not refresh the model: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }).catch((e) => {
+    const code = e.code;
+    throw f.port !== void 0 && (code === "EADDRINUSE" || code === "EACCES") ? portInUse(f.port) : e;
+  });
+  await serve(ctx, f, server);
+}
+
+// src/cli/commands/dev.ts
+import { randomBytes as randomBytes6 } from "crypto";
+import { realpath as realpath8 } from "fs/promises";
+import { constants as constants3 } from "os";
+import { dirname as dirname7, join as join23, relative as relative7 } from "path";
+import { StringDecoder } from "string_decoder";
+
+// src/core/diagnostics/node.ts
+var KEEP_LINES = 50;
+function exitHint(tail, h) {
+  const text2 = tail.join("\n");
+  const missing = text2.match(/Cannot find (?:module|package) '([^']+)'/);
+  if (missing) {
+    return { reason: "missing-module", hint: `A dependency is missing (${missing[1]}). Run \`${h.installCommand}\`, then qore dev again.` };
+  }
+  if (/ZodError:/.test(text2)) {
+    const keys = [...text2.matchAll(/"path":\s*\[\s*"([^"]+)"/g)].map((m) => m[1]);
+    if (keys.length > 0) {
+      return {
+        reason: "invalid-env",
+        keys,
+        hint: `Missing or invalid environment variables: ${keys.join(", ")}. Set them in the portal's local secrets (then qore env pull), or in your env file.`
+      };
+    }
+  }
+  const addrInUse = text2.match(/listen EADDRINUSE: address already in use (?:\S*:)?(\d+)/);
+  if (addrInUse) {
+    const port = Number(addrInUse[1]);
+    return {
+      reason: "port-in-use",
+      port,
+      hint: `Port ${port} was taken while the server started. Run qore dev again; if it repeats, lsof -iTCP:${port} -sTCP:LISTEN names the holder.`
+    };
+  }
+  if (/ECONNREFUSED/.test(text2)) {
+    const m = text2.match(/ECONNREFUSED\s+\S*:(\d+)/) ?? text2.match(/code: 'ECONNREFUSED'[^}]*?port: (\d+)/);
+    if (!m) return { reason: "conn-refused", hint: "A connection was refused (ECONNREFUSED) \u2014 a service this module calls is not running." };
+    const port = Number(m[1]);
+    const role = h.ports.get(port);
+    if (role?.kind === "database") {
+      const up = h.runCommand("db:up");
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `The database on :${port} is not accepting connections (ECONNREFUSED). ` + (up ? `Fix: ${up}  (docker compose ps shows its state)` : "docker compose ps shows its state.")
+      };
+    }
+    if (role?.kind === "provider") {
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `${role.key} points at :${port}, where nothing listens (ECONNREFUSED). Start that module \u2014 qore dev in the workspace root starts providers first.`
+      };
+    }
+    return { reason: "conn-refused", port, hint: `Nothing listens on :${port} (ECONNREFUSED) \u2014 a service this module calls is not running.` };
+  }
+  const auth = text2.match(/password authentication failed for user "([^"]+)"/);
+  if (auth) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-auth",
+      hint: `The local database was created with other credentials than the portal now provides (user ${auth[1]}).` + (reset ? ` Fix: ${reset} \u2014 this wipes local data.` : "")
+    };
+  }
+  const relation = text2.match(/relation "([^"]+)" does not exist/);
+  if (relation) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-schema",
+      hint: `The database schema is behind the code (relation ${relation[1]} does not exist). Migrations run when the app starts; if they failed above, that error is the cause.` + (reset ? ` To start clean: ${reset} (wipes local data).` : "")
+    };
+  }
+  if (/ENOSPC: System limit for number of file watchers reached/.test(text2)) {
+    return {
+      reason: "watcher-limit",
+      hint: "Linux ran out of file watchers. Raise the limit: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p"
+    };
   }
-}
-async function syncEnvFile(o) {
-  const existing = await readOrNull(o.target);
-  const plan = planPull({
-    existing,
-    example: existing === null ? o.example : null,
-    fetched: o.fetched,
-    managed: o.managed,
-    localSecrets: o.localSecrets,
-    defaultChoice: "keep",
-    random: o.random
-  });
-  if (existing !== null && plan.text === existing) await chmod2(o.target, 384);
-  else await writeSecurely(o.target, plan.text);
-  return { created: plan.created, kept: plan.kept };
+  return null;
 }
 
+// src/core/dev/env.ts
+import { dirname as dirname6, join as join17 } from "path";
+
 // src/core/dev/lastStart.ts
 import { createHash as createHash2 } from "crypto";
 import { realpath as realpath6 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join16 } from "path";
 var NETWORK_REASONS = /* @__PURE__ */ new Set(["connect", "dns", "tls", "timeout"]);
 function isOffline(e) {
   if (!(e instanceof QoreError)) return false;
@@ -2502,16 +3383,16 @@ async function stateKey(deps2, root) {
   return createHash2("sha256").update(trustKey(real, deps2.platform)).digest("hex").slice(0, 16);
 }
 async function saveLastStart(deps2, root, rec) {
-  await writeJsonAtomic(join13(deps2.config.dir, "dev"), `${await stateKey(deps2, root)}.json`, rec);
+  await writeJsonAtomic(join16(deps2.config.dir, "dev"), `${await stateKey(deps2, root)}.json`, rec);
 }
 async function loadLastStart(deps2, root) {
-  const rec = await readJson(join13(deps2.config.dir, "dev", `${await stateKey(deps2, root)}.json`)).catch(() => null);
+  const rec = await readJson(join16(deps2.config.dir, "dev", `${await stateKey(deps2, root)}.json`)).catch(() => null);
   return rec && rec.schemaVersion === 1 ? rec : null;
 }
 
 // src/core/dev/env.ts
-function envPort(env, key) {
-  const raw = env[key];
+function envPort(env, key2) {
+  const raw = env[key2];
   if (raw === void 0) return null;
   const v = raw.trim().replace(/^["']|["']$/g, "");
   if (!/^\d+$/.test(v)) return null;
@@ -2525,7 +3406,7 @@ async function devEnv(deps2, o) {
   if (o.mc && o.app) {
     try {
       const local = await fetchLocalEnv(deps2, o.mc, o.app);
-      const example = await readOrNull(join14(dirname6(target), ".env.example"));
+      const example = await readOrNull(join17(dirname6(target), ".env.example"));
       const w = await syncEnvFile({
         target,
         example,
@@ -2579,7 +3460,7 @@ function notClonedReason(m, am) {
 }
 
 // src/core/dev/findings.ts
-var plural = (n, one, many) => n === 1 ? one : many;
+var plural2 = (n, one2, many) => n === 1 ? one2 : many;
 function modulesMissing(o) {
   const actionFor = new Map(o.actions.map((a) => [a.module.slug, a]));
   const findings = [];
@@ -2612,8 +3493,8 @@ function modulesMissing(o) {
     findings.push({
       code: "dev.modules-missing",
       severity: "warn",
-      message: `${fixable.length} ${plural(fixable.length, "module of this app is", "modules of this app are")} not cloned: ${slugs.join(", ")}`,
-      why: deps2.length > 0 ? `${deps2.join("; ")}.` : `${plural(fixable.length, "It", "They")} will not run in this session.`,
+      message: `${fixable.length} ${plural2(fixable.length, "module of this app is", "modules of this app are")} not cloned: ${slugs.join(", ")}`,
+      why: deps2.length > 0 ? `${deps2.join("; ")}.` : `${plural2(fixable.length, "It", "They")} will not run in this session.`,
       modules: slugs,
       action: o.am ? { command: "qore sync", fix: "sync" } : { command: "qore sync" }
     });
@@ -2629,7 +3510,7 @@ function repoBehind(slug, s, o) {
     code: "dev.repo-behind",
     severity: "warn",
     module: slug,
-    message: `${slug} is ${s.behind} ${plural(s.behind, "commit", "commits")} behind ${s.upstreamRef ?? "its upstream"} (as of your last fetch).`,
+    message: `${slug} is ${s.behind} ${plural2(s.behind, "commit", "commits")} behind ${s.upstreamRef ?? "its upstream"} (as of your last fetch).`,
     action: { command: o.workspace ? "qore sync --pull" : "git pull" }
   };
 }
@@ -2652,15 +3533,15 @@ function providerDown(o) {
     severity: "warn",
     module: o.slug,
     modules: o.providers,
-    message: single ? `${o.providers[0]} is not running \u2014 ${o.keys[0]} points at :${o.ports.get(o.keys[0])}, where nothing listens.` : `${o.keys.join(", ")} ${plural(o.keys.length, "points", "point")} at ports nothing listens on (depends on: ${o.providers.join(", ")}).`,
+    message: single ? `${o.providers[0]} is not running \u2014 ${o.keys[0]} points at :${o.ports.get(o.keys[0])}, where nothing listens.` : `${o.keys.join(", ")} ${plural2(o.keys.length, "points", "point")} at ports nothing listens on (depends on: ${o.providers.join(", ")}).`,
     why: single ? `${o.slug} will start, but calls to ${o.providers[0]} will fail. Qore does not fall back to staging.` : `${o.slug} will start, but calls through ${o.keys.join(", ")} will fail. Qore does not fall back to staging.`,
     action: { command: o.fix }
   };
 }
 
 // src/core/dev/project.ts
-import { access, readFile as readFile5 } from "fs/promises";
-import { join as join15 } from "path";
+import { access, readFile as readFile7 } from "fs/promises";
+import { join as join18 } from "path";
 var LEGACY_DEV_SCRIPTS = ["node --env-file=.env --import ./dist/instrumentation.js dist/index.js"];
 var LOCKFILES = [["pnpm-lock.yaml", "pnpm"], ["package-lock.json", "npm"], ["yarn.lock", "yarn"]];
 var exists = (p) => access(p).then(() => true, () => false);
@@ -2668,7 +3549,7 @@ var unsupported = (message, hint, details) => new QoreError("QORE_DEV_UNSUPPORTE
 async function readPackageJson(root) {
   let raw;
   try {
-    raw = await readFile5(join15(root, "package.json"), "utf8");
+    raw = await readFile7(join18(root, "package.json"), "utf8");
   } catch {
     throw unsupported("This repository has no package.json", "qore dev starts Node repositories through their package.json scripts.");
   }
@@ -2684,7 +3565,7 @@ async function detectPackageManager(root, pkg) {
     if (!m) throw unsupported(`packageManager "${pkg.packageManager}" is not pnpm, npm or yarn`, "qore dev supports pnpm, npm and yarn.");
     return { name: m[1], version: m[2].split("+")[0] };
   }
-  for (const [file, name] of LOCKFILES) if (await exists(join15(root, file))) return { name, version: null };
+  for (const [file, name] of LOCKFILES) if (await exists(join18(root, file))) return { name, version: null };
   throw unsupported("No package manager declared and no lockfile found", 'Add "packageManager": "pnpm@<version>" to package.json.');
 }
 function planRecipe(o) {
@@ -2727,21 +3608,21 @@ function installArgs(pm) {
 }
 
 // src/core/dev/install.ts
-import { stat as stat3 } from "fs/promises";
-import { join as join16 } from "path";
+import { stat as stat5 } from "fs/promises";
+import { join as join19 } from "path";
 var MARKERS = {
   pnpm: [".modules.yaml"],
   npm: [".package-lock.json"],
   yarn: [".yarn-state.yml", ".yarn-integrity"]
 };
 var LOCK2 = { pnpm: "pnpm-lock.yaml", npm: "package-lock.json", yarn: "yarn.lock" };
-var mtime = (p) => stat3(p).then((s) => s.mtimeMs, () => null);
+var mtime = (p) => stat5(p).then((s) => s.mtimeMs, () => null);
 async function needsInstall(root, pm) {
-  if (await mtime(join16(root, "node_modules")) === null) return true;
+  if (await mtime(join19(root, "node_modules")) === null) return true;
   let marker = null;
-  for (const m of MARKERS[pm.name]) marker ??= await mtime(join16(root, "node_modules", m));
+  for (const m of MARKERS[pm.name]) marker ??= await mtime(join19(root, "node_modules", m));
   if (marker === null) return true;
-  const lock = await mtime(join16(root, LOCK2[pm.name]));
+  const lock = await mtime(join19(root, LOCK2[pm.name]));
   return lock !== null && lock > marker;
 }
 
@@ -2869,7 +3750,7 @@ function nodeVersionError(found, range, slug) {
 // src/core/dev/preflight.ts
 var pmMajor = (v) => v ? v.split(".")[0] : "latest";
 var GRACE_MS = 1e4;
-var secs = (ms) => `${Math.round(ms / 1e3)} s`;
+var secs = (ms2) => `${Math.round(ms2 / 1e3)} s`;
 async function runTool(deps2, cmd, args, o) {
   if (o.signal.aborted) throw new CancelledError();
   const tail = [];
@@ -3006,12 +3887,12 @@ async function composeFailure(deps2, r, slug, env, signal, message, command, std
     details: { command, stderr, logs: logs.tail.slice(-20) }
   });
 }
-async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine, report) {
+async function startServices(deps2, r, slug, env, dbPort2, waitMs, signal, onLine, report) {
   if (r.services.length === 0) {
     report({ module: slug, step: "services", status: "skip" });
     return;
   }
-  report({ module: slug, step: "services", status: "start", ...dbPort !== null ? { detail: `:${dbPort}` } : {} });
+  report({ module: slug, step: "services", status: "start", ...dbPort2 !== null ? { detail: `:${dbPort2}` } : {} });
   const began = deps2.now().getTime();
   if (r.dockerServices) {
     const res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: r.root, env, onLine, signal });
@@ -3026,14 +3907,14 @@ async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine
     const { cmd, args } = runArgs(r.pm, script);
     const res = await runTool(deps2, cmd, args, { cwd: r.root, env, onLine, signal });
     if (res.code !== 0) {
-      if (dbPort !== null && /port is already allocated|address already in use/i.test(res.tail.join("\n"))) {
-        throw await portInUseError(deps2, { slug, port: dbPort, key: "DB_PORT" });
+      if (dbPort2 !== null && /port is already allocated|address already in use/i.test(res.tail.join("\n"))) {
+        throw await portInUseError(deps2, { slug, port: dbPort2, key: "DB_PORT" });
       }
       throw await composeFailure(deps2, r, slug, env, signal, `${script} failed in ${slug}`, `${cmd} ${args.join(" ")}`, res.tail);
     }
   }
-  if (dbPort !== null) {
-    const ok2 = await deps2.ports.waitFor(dbPort, waitMs, signal);
+  if (dbPort2 !== null) {
+    const ok2 = await deps2.ports.waitFor(dbPort2, waitMs, signal);
     if (signal.aborted) throw new CancelledError();
     if (!ok2) {
       throw await composeFailure(
@@ -3042,14 +3923,14 @@ async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine
         slug,
         env,
         signal,
-        `The database for ${slug} did not accept connections on port ${dbPort} within ${waitMs / 1e3} s`,
+        `The database for ${slug} did not accept connections on port ${dbPort2} within ${waitMs / 1e3} s`,
         void 0,
         []
       );
     }
   }
   const took = secs(deps2.now().getTime() - began);
-  report({ module: slug, step: "services", status: "done", detail: dbPort !== null ? `:${dbPort} (${took})` : `(${took})` });
+  report({ module: slug, step: "services", status: "done", detail: dbPort2 !== null ? `:${dbPort2} (${took})` : `(${took})` });
 }
 async function checkPort(deps2, o) {
   if (o.port === null) return;
@@ -3057,13 +3938,13 @@ async function checkPort(deps2, o) {
   throw await portInUseError(deps2, { slug: o.slug, port: o.port, key: o.key, runs: o.runs });
 }
 function abortableDelay(signal) {
-  return (ms) => new Promise((resolve6) => {
+  return (ms2) => new Promise((resolve7) => {
     const done = () => {
       clearTimeout(t);
       signal.removeEventListener("abort", done);
-      resolve6();
+      resolve7();
     };
-    const t = setTimeout(done, ms);
+    const t = setTimeout(done, ms2);
     signal.addEventListener("abort", done, { once: true });
   });
 }
@@ -3108,17 +3989,17 @@ async function leftoverOwnsPort(deps2, run4, port) {
 var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function connPorts(env) {
   const out = [];
-  for (const key of Object.keys(env).sort()) {
-    const m = /^CONN_(.+)_URL$/.exec(key);
+  for (const key2 of Object.keys(env).sort()) {
+    const m = /^CONN_(.+)_URL$/.exec(key2);
     if (!m) continue;
     let url;
     try {
-      url = new URL(env[key].trim().replace(/^["']|["']$/g, ""));
+      url = new URL(env[key2].trim().replace(/^["']|["']$/g, ""));
     } catch {
       continue;
     }
     const port = Number(url.port);
-    if (port > 0 && LOCAL_HOSTS.has(url.hostname)) out.push({ key, alias: m[1], port });
+    if (port > 0 && LOCAL_HOSTS.has(url.hostname)) out.push({ key: key2, alias: m[1], port });
   }
   return out;
 }
@@ -3139,259 +4020,34 @@ function hintContext(recipe, pkg, env) {
       return [r.cmd, ...r.args].join(" ");
     },
     ports
-  };
-}
-
-// src/core/dev/runFile.ts
-import { unlink as unlink2 } from "fs/promises";
-import { join as join17 } from "path";
-async function runFilePath(deps2, root) {
-  const dir2 = join17(deps2.config.dir, "run");
-  const name = `${await stateKey(deps2, root)}.json`;
-  return { dir: dir2, name, path: join17(dir2, name) };
-}
-async function writeRunFile(deps2, root, rec) {
-  const { dir: dir2, name } = await runFilePath(deps2, root);
-  await writeJsonAtomic(dir2, name, rec);
-}
-async function removeRunFile(deps2, root) {
-  const { path } = await runFilePath(deps2, root);
-  await unlink2(path).catch(() => {
-  });
-}
-async function leftoverRun(deps2, root, o = {}) {
-  const { path } = await runFilePath(deps2, root);
-  const rec = await readJson(path).catch(() => null);
-  if (!rec || rec.schemaVersion !== 1) return null;
-  if (deps2.launch.isAlive(rec.qorePid)) return rec;
-  if (o.prune !== false) await unlink2(path).catch(() => {
-  });
-  return null;
-}
-
-// src/cli/project.ts
-import { readdir as readdir2, stat as stat4 } from "fs/promises";
-import { join as join18 } from "path";
-
-// src/core/projects/match.ts
-function readings(ref) {
-  const s = ref.split("/").map((x) => x.trim());
-  if (s.some((x) => x === "")) return [];
-  if (s.length === 1) return [{ app: s[0] }];
-  if (s.length === 2) return [{ app: s[0], module: s[1] }, { tenant: s[0], app: s[1] }];
-  if (s.length === 3) return [{ tenant: s[0], app: s[1], module: s[2] }];
-  return [];
-}
-function hit(p, w) {
-  if (p.appSlug !== w.app || w.tenant !== void 0 && p.tenantSlug !== w.tenant) return null;
-  if (p.kind === "module") return w.module === p.moduleSlug ? { project: p } : null;
-  return w.module ? { project: p, module: w.module } : { project: p };
-}
-function matchProjects(projects, ref) {
-  const out = [];
-  for (const w of readings(ref)) {
-    for (const p of projects) {
-      const m = hit(p, w);
-      if (m) out.push(m);
-    }
-  }
-  return out;
-}
-
-// src/cli/project.ts
-async function loggedInAs(ctx) {
-  const cfg = await ctx.deps.config.read();
-  const portal = resolvePortal(ctx.opts().portal, cfg.defaultProfile);
-  const p = cfg.profiles[portal.apiOrigin];
-  if (!p || !await new TokenStore(ctx.deps.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return null;
-  return p.email ?? p.sub ?? portal.apiOrigin;
-}
-var isDir = async (p) => (await stat4(p).catch(() => null))?.isDirectory() ?? false;
-var label2 = (p) => `${p.tenantSlug} / ${p.appSlug}${p.kind === "module" ? ` / ${p.moduleSlug}` : ""}${p.source === "registry" ? `  (${p.path})` : ""}`;
-var candidate = (p) => p.kind === "module" ? { kind: "module", id: p.moduleId, slug: p.moduleSlug, tenant: p.tenantSlug, name: p.path } : { kind: "app", slug: p.appSlug, tenant: p.tenantSlug, name: p.path };
-var withCwd = (ctx, cwd) => ({ ...ctx, deps: { ...ctx.deps, cwd } });
-async function inProject(ctx) {
-  if (await findWorkspace(ctx.deps.cwd, ctx.deps.home)) return true;
-  const repo = await findRepoRoot(ctx.deps.cwd);
-  return repo !== null && !isInside(repo, ctx.deps.home);
-}
-async function moduleDirs(wsPath) {
-  const out = [];
-  for (const d of await readdir2(wsPath, { withFileTypes: true }).catch(() => [])) {
-    if (d.isDirectory() && !d.name.startsWith(".") && await stat4(join18(wsPath, d.name, ".git")).catch(() => null)) out.push(d.name);
-  }
-  return out.sort();
-}
-async function pathFor(ctx, m, needModule) {
-  const p = m.project;
-  if (p.kind === "module") return p.path;
-  if (m.module) {
-    const dir2 = join18(p.path, m.module);
-    if (!await isDir(dir2)) {
-      throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no checkout of module ${m.module} in ${p.path}`, {
-        hint: `Run \`qore sync\` in ${p.path} to clone the app's missing modules.`
-      });
-    }
-    return dir2;
-  }
-  if (!needModule) return p.path;
-  const dirs = await moduleDirs(p.path);
-  if (dirs.length === 1) return join18(p.path, dirs[0]);
-  if (dirs.length === 0) {
-    throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no module checkouts in ${p.path}`, {
-      hint: `Run \`qore sync\` in ${p.path}.`
-    });
-  }
-  if (!ctx.io.interactive) {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", `${p.appSlug} has several modules \u2014 which one?`, {
-      hint: `Pass ${p.appSlug}/<module>.`,
-      candidates: dirs.map((slug) => ({ kind: "module", slug, tenant: p.tenantSlug, name: join18(p.path, slug) }))
-    });
-  }
-  return join18(p.path, await ctx.io.select("Select a module", dirs.map((d) => ({ name: d, value: d }))));
-}
-async function liveMatches(matches) {
-  const live = [];
-  for (const m of matches) {
-    if (m.project.kind === "workspace" && m.module && !await isDir(join18(m.project.path, m.module))) continue;
-    live.push(m);
-  }
-  return live.length > 0 ? live : matches;
-}
-async function choose(ctx, matches, what, explicit) {
-  if (explicit && matches.length === 1) return matches[0];
-  if (!ctx.io.interactive) {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", what, {
-      hint: "Pass a more specific reference: tenant/app or app/module.",
-      candidates: matches.map((m) => candidate(m.project))
-    });
-  }
-  const i = await ctx.io.select("Select a project", matches.map((m, idx) => ({
-    name: m.module ? `${label2(m.project)} / ${m.module}` : label2(m.project),
-    value: idx
-  })));
-  return matches[i];
-}
-async function projectCtx(ctx, o) {
-  const g = ctx.opts();
-  const cfg = await ctx.deps.config.read();
-  const portal = g.portal ? resolvePortal(g.portal, cfg.defaultProfile).apiOrigin : void 0;
-  if (o.ref) {
-    const matches = matchProjects(await knownProjects(ctx.deps, { portal }), o.ref);
-    if (matches.length === 0) {
-      const parts = o.ref.split("/");
-      const app = parts.length === 1 ? o.ref : parts.length === 3 ? parts[1] : "<app>";
-      throw new QoreError("QORE_PROJECT_NOT_FOUND", `No local project "${o.ref}"`, {
-        hint: cfg.projectsRoot ? `Run \`qore clone ${app}\`.` : `Run \`qore init\`, or \`qore clone ${app}\`.`
-      });
-    }
-    const m2 = await choose(ctx, await liveMatches(matches), `"${o.ref}" matches several projects`, true);
-    return relocate(ctx, await pathFor(ctx, m2, o.needModule));
-  }
-  if (o.module || o.app || await inProject(ctx)) return ctx;
-  const known = await knownProjects(ctx.deps, { portal });
-  if (known.length === 0) {
-    if (!cfg.projectsRoot) {
-      if (!await loggedInAs(ctx)) return ctx;
-      throw new QoreError("QORE_ROOT_NOT_SET", "Not inside a project, and qore knows no projects yet", {
-        hint: "Run `qore init` to choose a projects folder, or cd into a project."
-      });
-    }
-    throw new QoreError("QORE_PROJECT_NOT_FOUND", `Not inside a project, and ${cfg.projectsRoot} holds none yet`, {
-      hint: "Run `qore clone <app>`."
-    });
-  }
-  const m = await choose(ctx, known.map((project) => ({ project })), "Not inside a project \u2014 which one?", false);
-  return relocate(ctx, await pathFor(ctx, m, o.needModule));
-}
-function relocate(ctx, path) {
-  if (path === ctx.deps.cwd) return ctx;
-  if (!ctx.opts().json) ctx.io.err(`\u2192 in ${path}`);
-  return withCwd(ctx, path);
-}
-async function rememberContext(ctx, mc, app) {
-  const tenantSlug = mc.module.tenant.slug;
-  if (mc.workspace && mc.workspace.appId === app.id) {
-    await remember(ctx.deps, {
-      kind: "workspace",
-      path: mc.workspace.root,
-      portal: mc.workspace.portal,
-      tenantSlug,
-      appId: app.id,
-      appSlug: app.slug
-    });
-    return;
-  }
-  if (mc.repoRoot) {
-    await remember(ctx.deps, {
-      kind: "module",
-      path: mc.repoRoot,
-      portal: mc.portal.apiOrigin,
-      tenantSlug,
-      appId: app.id,
-      appSlug: app.slug,
-      moduleId: mc.module.id,
-      moduleSlug: mc.module.slug
-    });
-  }
-}
-async function rememberWorkspace(ctx, ws, app) {
-  if (ws.appId !== app.id) return;
-  await remember(ctx.deps, { kind: "workspace", path: ws.root, portal: ws.portal, tenantSlug: app.tenant.slug, appId: app.id, appSlug: app.slug });
-}
-
-// src/cli/context.ts
-var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
-async function moduleContextFor(ctx, flags, command) {
-  const g = ctx.opts();
-  const onRequest = g.verbose ? (l) => ctx.io.err(l) : void 0;
-  const base = { portal: g.portal, module: flags.module, command, onRequest };
-  try {
-    return await resolveModuleContext(ctx.deps, base);
-  } catch (e) {
-    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" || !ctx.io.interactive) throw e;
-    if (allOfKind(e.candidates, "module")) {
-      const choose2 = await ctx.io.select(
-        "Select a module",
-        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : ""}${c.slug}  (${c.remote})`, value: c.id }))
-      );
-      return resolveModuleContext(ctx.deps, { ...base, choose: choose2 });
-    }
-    if (allOfKind(e.candidates, "tenant")) {
-      const tenant = await ctx.io.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
-      return resolveModuleContext(ctx.deps, { ...base, tenant });
-    }
-    throw e;
-  }
-}
-async function appFor(ctx, mc, app) {
-  try {
-    return pickApp2(mc, app);
-  } catch (e) {
-    if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
-    const id = await ctx.io.select("Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
-    return pickApp2(mc, id);
-  }
+  };
 }
-function sourceText(mc) {
-  if (mc.source.kind === "remote") return mc.source.remote;
-  if (mc.source.kind === "workspace") return WORKSPACE_FILE;
-  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : "--module";
+
+// src/core/dev/runFile.ts
+import { unlink as unlink2 } from "fs/promises";
+import { join as join20 } from "path";
+async function runFilePath(deps2, root) {
+  const dir2 = join20(deps2.config.dir, "run");
+  const name = `${await stateKey(deps2, root)}.json`;
+  return { dir: dir2, name, path: join20(dir2, name) };
 }
-function contextLine(mc, app) {
-  const parts = [mc.module.tenant.name, ...app ? [app.name] : [], mc.module.slug];
-  return `\u2192 ${parts.join(" / ")}  (${sourceText(mc)})`;
+async function writeRunFile(deps2, root, rec) {
+  const { dir: dir2, name } = await runFilePath(deps2, root);
+  await writeJsonAtomic(dir2, name, rec);
 }
-function contextJson(mc, app) {
-  const { id, slug, name, type, access: access2 } = mc.module;
-  return {
-    portal: mc.portal.builtin ?? mc.portal.apiOrigin,
-    tenant: mc.module.tenant,
-    app: app ?? null,
-    module: { id, slug, name, type, access: access2 },
-    source: mc.source.kind === "remote" ? mc.source.remote : mc.source.kind === "workspace" ? WORKSPACE_FILE : "--module",
-    ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
-  };
+async function removeRunFile(deps2, root) {
+  const { path } = await runFilePath(deps2, root);
+  await unlink2(path).catch(() => {
+  });
+}
+async function leftoverRun(deps2, root, o = {}) {
+  const { path } = await runFilePath(deps2, root);
+  const rec = await readJson(path).catch(() => null);
+  if (!rec || rec.schemaVersion !== 1) return null;
+  if (deps2.launch.isAlive(rec.qorePid)) return rec;
+  if (o.prune !== false) await unlink2(path).catch(() => {
+  });
+  return null;
 }
 
 // src/cli/findings.ts
@@ -3539,33 +4195,10 @@ async function inPreflight(signals, outer, fn) {
   }
 }
 
-// src/cli/trustPrompt.ts
-async function ensureTrusted(ctx, mc, app, o) {
-  const root = mc.repoRoot ?? ctx.deps.cwd;
-  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
-  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
-  if (o.yes) {
-    await trust(ctx.deps, root, mc.module.id);
-    return;
-  }
-  if (!ctx.io.interactive) {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", `This repository is not trusted for ${mc.module.slug} yet`, {
-      hint: "Run interactively once, or pass --yes.",
-      details: { reason: "untrusted", repository: root }
-    });
-  }
-  if (mc.source.kind === "remote") {
-    const key = repoKey(mc.source.url);
-    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? "(unparsable remote URL)"}`);
-  }
-  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
-  await trust(ctx.deps, root, mc.module.id);
-}
-
 // src/cli/commands/devWorkspace.ts
 import { randomBytes as randomBytes5 } from "crypto";
 import { realpath as realpath7 } from "fs/promises";
-import { join as join20, relative as relative6 } from "path";
+import { join as join22, relative as relative6 } from "path";
 
 // src/core/dev/order.ts
 function selectSkips(modules, sel) {
@@ -3701,8 +4334,8 @@ function exitCode(e) {
 }
 function supervise(o) {
   const now = o.now ?? Date.now;
-  const delay = o.delay ?? ((ms) => new Promise((r) => {
-    setTimeout(r, ms).unref();
+  const delay = o.delay ?? ((ms2) => new Promise((r) => {
+    setTimeout(r, ms2).unref();
   }));
   const abort = new AbortController();
   const emit = (e) => {
@@ -3722,15 +4355,15 @@ function supervise(o) {
   });
   const readiness = /* @__PURE__ */ new Map();
   for (const m of o.modules) {
-    let resolve6;
+    let resolve7;
     let settled = false;
     const promise = new Promise((r) => {
-      resolve6 = r;
+      resolve7 = r;
     });
     readiness.set(m.slug, { promise, settle: (r) => {
       if (settled) return false;
       settled = true;
-      resolve6(r);
+      resolve7(r);
       return true;
     } });
   }
@@ -3822,7 +4455,7 @@ function supervise(o) {
 
 // src/core/workspace/stray.ts
 import { lstat as lstat2, readdir as readdir3 } from "fs/promises";
-import { join as join19 } from "path";
+import { join as join21 } from "path";
 async function strayRepos(root, slugs) {
   let entries;
   try {
@@ -3834,7 +4467,7 @@ async function strayRepos(root, slugs) {
   for (const name of entries) {
     if (slugs.has(name)) continue;
     try {
-      await lstat2(join19(root, name, ".git"));
+      await lstat2(join21(root, name, ".git"));
       names.push(name);
     } catch {
     }
@@ -3880,7 +4513,7 @@ function registerRun(program, ctx) {
         hint: "Drop --json; the child's own output passes through."
       });
     }
-    const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true });
+    const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true, command: "run" });
     const { deps: deps2 } = c;
     const mc = await moduleContextFor(c, f, "run");
     const app = await appFor(c, mc, f.app);
@@ -3905,12 +4538,12 @@ function registerRun(program, ctx) {
 
 // src/cli/commands/devWorkspace.ts
 var INSTALL_PARALLELISM = 4;
-var str = (v) => typeof v === "string" && v.length > 0;
+var str2 = (v) => typeof v === "string" && v.length > 0;
 var slugList = (raw) => raw?.split(",").map((s) => s.trim()).filter(Boolean);
 function usableLast(last, appId) {
   if (!last || last.kind !== "workspace") return false;
   const a = last.app;
-  return str(last.savedAt) && !!a && a.id === appId && str(a.slug) && str(a.name) && !!a.tenant && str(a.tenant.name) && Array.isArray(last.modules) && last.modules.every((m) => !!m && str(m.id) && str(m.slug) && str(m.type) && str(m.access) && Array.isArray(m.dependsOn));
+  return str2(last.savedAt) && !!a && a.id === appId && str2(a.slug) && str2(a.name) && !!a.tenant && str2(a.tenant.name) && Array.isArray(last.modules) && last.modules.every((m) => !!m && str2(m.id) && str2(m.slug) && str2(m.type) && str2(m.access) && Array.isArray(m.dependsOn));
 }
 async function workspaceContext(ctx, ws) {
   const { deps: deps2 } = ctx;
@@ -3996,7 +4629,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
       continue;
     }
     try {
-      dirs[m.slug] = await deps2.git.inspect(join20(ws.root, m.slug));
+      dirs[m.slug] = await deps2.git.inspect(join22(ws.root, m.slug));
       safe.push(m);
     } catch (e) {
       if (!(e instanceof QoreError) || e.code === "QORE_GIT_UNAVAILABLE") throw e;
@@ -4033,7 +4666,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
     const results = await applyActions(deps2, { portal: online.portal, app: am, actions, protocol: cloneProtocol(dirs), onResult: () => {
     } });
     renderResults(io2, results, false);
-    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join20(ws.root, r.slug));
+    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join22(ws.root, r.slug));
     ({ present, plan } = computePlan());
   }
   for (const name of await strayRepos(ws.root, new Set(am.modules.map((m) => m.slug)))) renderFinding(ctx, strayClone(name, am.app.name));
@@ -4214,7 +4847,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
   if (online && units.every((u) => !u.dev.offline)) {
     const envFile = (m) => {
       const u = units.find((x) => x.m.id === m.id);
-      return u ? relative6(rootReal, u.dev.envFile) : join20(m.slug, moduleDefaults(m.type).envFile);
+      return u ? relative6(rootReal, u.dev.envFile) : join22(m.slug, moduleDefaults(m.type).envFile);
     };
     await saveLastStart(deps2, ws.root, {
       schemaVersion: 1,
@@ -4410,7 +5043,7 @@ function registerDev(program, ctx) {
         hint: "qore dev <project> | qore dev --project <project>"
       });
     }
-    const c = await projectCtx(ctx, { ref: project ?? f.project, module: f.module, app: f.app, needModule: false });
+    const c = await projectCtx(ctx, { ref: project ?? f.project, module: f.module, app: f.app, needModule: false, command: "dev" });
     const ws = await workspaceRoot(c.deps);
     if (ws && f.module === void 0) return workspaceDev(c, ws, f, waitTimeout);
     return moduleDev(c, f, waitTimeout);
@@ -4425,7 +5058,7 @@ function parseWaitTimeout(raw) {
   }
   return n;
 }
-var str2 = (v) => typeof v === "string" && v.length > 0;
+var str3 = (v) => typeof v === "string" && v.length > 0;
 var SHELL_SAFE = /^[A-Za-z0-9_./,:@%+=-]*$/;
 var shellQuote = (s) => SHELL_SAFE.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
 function cdAndDev(home, dir2) {
@@ -4453,7 +5086,7 @@ async function providerFindings(ctx, root, mc, app, env) {
     let fix = `qore clone ${app.slug}`;
     if (ws && ws.appId === app.id) fix = cdAndDev(deps2.home, ws.root);
     else if (providers.length === 1) {
-      const sibling = join21(dirname7(root), providers[0].slug);
+      const sibling = join23(dirname7(root), providers[0].slug);
       if ((await deps2.git.inspect(sibling)).isRepo) fix = cdAndDev(deps2.home, sibling);
     }
     return providerDown({
@@ -4471,7 +5104,7 @@ async function providerFindings(ctx, root, mc, app, env) {
 function usableLast2(last) {
   if (!last || last.kind !== "module") return false;
   const m = last.module;
-  return str2(last.savedAt) && !!m && str2(m.id) && str2(m.slug) && str2(m.type) && !!m.tenant && str2(m.tenant.name) && !!last.app && str2(last.app.id) && str2(last.app.slug) && str2(last.app.name);
+  return str3(last.savedAt) && !!m && str3(m.id) && str3(m.slug) && str3(m.type) && !!m.tenant && str3(m.tenant.name) && !!last.app && str3(last.app.id) && str3(last.app.slug) && str3(last.app.name);
 }
 async function devContext(ctx, f, root) {
   let mc;
@@ -4515,9 +5148,9 @@ async function moduleDev(ctx, f, waitTimeout) {
     childRunning.current = false;
     await removeRunFile(deps2, root);
   }
-  const ms = deps2.now().getTime() - startedAt.getTime();
+  const ms2 = deps2.now().getTime() - startedAt.getTime();
   if (exit.code !== 0 && exit.signal === null) {
-    io2.err(ms < EARLY_EXIT_MS ? `\u2717 ${slug} exited after ${Math.round(ms / 1e3)} s with code ${exit.code ?? 1} \u2014 its output above says why.` : `\u2717 ${slug} exited with code ${exit.code ?? 1}.`);
+    io2.err(ms2 < EARLY_EXIT_MS ? `\u2717 ${slug} exited after ${Math.round(ms2 / 1e3)} s with code ${exit.code ?? 1} \u2014 its output above says why.` : `\u2717 ${slug} exited with code ${exit.code ?? 1}.`);
     const hint = exitHint(tee.lines(), hintContext(recipe, pkg, devEnv2));
     if (hint) io2.err(`  \u2192 ${hint.hint}`);
   }
@@ -4647,8 +5280,8 @@ function registerDebugTelemetry(program, ctx) {
 import pc3 from "picocolors";
 
 // src/core/doctor/checks.ts
-import { realpath as realpath9, stat as stat5 } from "fs/promises";
-import { basename as basename3, join as join22 } from "path";
+import { realpath as realpath9, stat as stat6 } from "fs/promises";
+import { basename as basename4, join as join24 } from "path";
 
 // src/core/diagnostics/ssh.ts
 var SSH_TEST_ARGS = ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "git@github.com"];
@@ -4698,19 +5331,19 @@ var withError = (status2, label3, e) => ({ status: status2, label: label3, error
 var isCancel = (e, signal) => e instanceof CancelledError || signal.aborted;
 var portalLabel = (p) => p.builtin ?? p.apiOrigin;
 var ToolTimeout = class extends Error {
-  constructor(tool, ms) {
-    super(`${tool} did not answer within ${Math.round(ms / 1e3)} s`);
+  constructor(tool, ms2) {
+    super(`${tool} did not answer within ${Math.round(ms2 / 1e3)} s`);
     this.tool = tool;
-    this.ms = ms;
+    this.ms = ms2;
   }
   tool;
   ms;
 };
-async function timed(tool, signal, ms, fn) {
+async function timed(tool, signal, ms2, fn) {
   try {
-    return await fn(AbortSignal.any([signal, AbortSignal.timeout(ms)]));
+    return await fn(AbortSignal.any([signal, AbortSignal.timeout(ms2)]));
   } catch (e) {
-    if (e instanceof CancelledError && !signal.aborted) throw new ToolTimeout(tool, ms);
+    if (e instanceof CancelledError && !signal.aborted) throw new ToolTimeout(tool, ms2);
     throw e;
   }
 }
@@ -4741,8 +5374,8 @@ function checkOwnNode(deps2) {
   }
   return ok(`Node ${v} (\u226522 required)`);
 }
-async function checkGit(deps2, signal, ms) {
-  const res = await timed("git", signal, ms, (s) => runTool(deps2, "git", ["--version"], { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
+async function checkGit(deps2, signal, ms2) {
+  const res = await timed("git", signal, ms2, (s) => runTool(deps2, "git", ["--version"], { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
   if (res.spawnError === "ENOENT") {
     const e = new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
       hint: "Install git (https://git-scm.com/downloads) and open a new terminal."
@@ -4756,14 +5389,14 @@ async function checkGit(deps2, signal, ms) {
   const m = /git version (\d+)\.(\d+)/.exec(res.tail.join("\n"));
   return ok(m ? `git ${m[1]}.${m[2]}` : "git");
 }
-async function checkGithubSsh(deps2, signal, ms) {
-  const res = await timed("ssh", signal, ms, (s) => runTool(deps2, "ssh", SSH_TEST_ARGS, { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
+async function checkGithubSsh(deps2, signal, ms2) {
+  const res = await timed("ssh", signal, ms2, (s) => runTool(deps2, "ssh", SSH_TEST_ARGS, { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s }));
   const r = classifySshTest(res);
   if (r.ok) return ok(`GitHub SSH ok (${r.user})`, { user: r.user });
   return withError("warn", `GitHub SSH: ${r.error.message} (https still works)`, r.error);
 }
-async function checkDocker(deps2, signal, ms) {
-  return timed("docker", signal, ms, async (s) => {
+async function checkDocker(deps2, signal, ms2) {
+  return timed("docker", signal, ms2, async (s) => {
     const o = { cwd: deps2.home, env: deps2.env, onLine: noop, signal: s };
     const info = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], o);
     const infoErr = classifyDockerInfo(info, deps2.platform);
@@ -4791,9 +5424,9 @@ function jwtExp(token) {
 }
 function validDays(rt, now) {
   const exp = jwtExp(rt.rt);
-  const end = exp !== null ? exp * 1e3 : Date.parse(rt.obtainedAt) + IDLE_DAYS * DAY_MS;
-  if (Number.isNaN(end)) return null;
-  return Math.max(0, Math.floor((end - now.getTime()) / DAY_MS));
+  const end2 = exp !== null ? exp * 1e3 : Date.parse(rt.obtainedAt) + IDLE_DAYS * DAY_MS;
+  if (Number.isNaN(end2)) return null;
+  return Math.max(0, Math.floor((end2 - now.getTime()) / DAY_MS));
 }
 async function checkSession(deps2, portal, onRequest, sessions, selected, signal) {
   try {
@@ -4849,7 +5482,7 @@ async function moduleBody(deps2, m, runs, signal) {
     if (text2 === null) return { status: "warn", label: "port unknown (run qore env pull)" };
     env = Object.fromEntries(parseEnv(text2));
     const port = envPort(env, "PORT");
-    if (port === null) return { status: "warn", label: `port unknown (no PORT in ${basename3(target)})` };
+    if (port === null) return { status: "warn", label: `port unknown (no PORT in ${basename4(target)})` };
     if (!await deps2.ports.inUse(port)) return { status: "ok", label: `port ${port} free` };
     const e = await portInUseError(deps2, { slug: m.slug, port, key: "PORT", runs: await runs() });
     return { status: "fail", label: `port ${port} in use${ownerText(e)}`, error: e };
@@ -4868,13 +5501,13 @@ async function moduleBody(deps2, m, runs, signal) {
       flags: { install: true, services: true }
     });
     if (recipe.services.length === 0) return { status: "ok", label: "db none" };
-    const dbPort = env ? envPort(env, "DB_PORT") : null;
-    if (dbPort === null) return { status: "warn", label: "db port unknown (run qore env pull)" };
-    if (!await deps2.ports.inUse(dbPort)) return { status: "ok", label: `db:up (DB_PORT ${dbPort} free)` };
-    const pub = await deps2.ports.dockerPublisher(dbPort);
+    const dbPort2 = env ? envPort(env, "DB_PORT") : null;
+    if (dbPort2 === null) return { status: "warn", label: "db port unknown (run qore env pull)" };
+    if (!await deps2.ports.inUse(dbPort2)) return { status: "ok", label: `db:up (DB_PORT ${dbPort2} free)` };
+    const pub = await deps2.ports.dockerPublisher(dbPort2);
     if (pub?.workingDir && await sameDir(pub.workingDir, m.root)) return { status: "ok", label: "db running" };
-    const e = await portInUseError(deps2, { slug: m.slug, port: dbPort, key: "DB_PORT" });
-    return { status: "fail", label: `DB_PORT ${dbPort} in use${ownerText(e)}`, error: e };
+    const e = await portInUseError(deps2, { slug: m.slug, port: dbPort2, key: "DB_PORT" });
+    return { status: "fail", label: `DB_PORT ${dbPort2} in use${ownerText(e)}`, error: e };
   });
   const status2 = parts.reduce((w, p) => RANK[p.status] > RANK[w] ? p.status : w, "ok");
   const shown = parts.filter((p) => p.status !== "ok");
@@ -4895,16 +5528,16 @@ function runsAt(deps2, root) {
   return () => p ??= leftoverRun(deps2, root, { prune: false }).then((r) => r ? [r] : []);
 }
 var UNTRUSTED = { status: "warn", label: "not checked (repository not trusted)" };
-async function checkRepoPm(deps2, m, recipe, signal, ms) {
+async function checkRepoPm(deps2, m, recipe, signal, ms2) {
   if (!await isTrusted(deps2, m.root, m.id)) return UNTRUSTED;
-  const found = await timed(recipe.pm.name, signal, ms, (s) => checkPackageManager(deps2, recipe, noop, s));
+  const found = await timed(recipe.pm.name, signal, ms2, (s) => checkPackageManager(deps2, recipe, noop, s));
   const { name, version } = recipe.pm;
   if (found === null) return ok(`${name} (version unknown)`);
   return ok(version ? `${name} ${found} (matches)` : `${name} ${found}`, { found, ...version ? { pinned: version } : {} });
 }
-async function checkRepoNode(deps2, m, recipe, pkg, signal, ms) {
+async function checkRepoNode(deps2, m, recipe, pkg, signal, ms2) {
   if (!await isTrusted(deps2, m.root, m.id)) return UNTRUSTED;
-  const found = await timed("node", signal, ms, (s) => checkNode(deps2, recipe, pkg, m.slug, s));
+  const found = await timed("node", signal, ms2, (s) => checkNode(deps2, recipe, pkg, m.slug, s));
   return ok(`Node ${found ?? "?"} (engines ${pkg.engines.node})`);
 }
 async function loggedInPortals(deps2, profiles) {
@@ -4931,7 +5564,7 @@ async function resolveRepoModule(deps2, session, portal, meta, root) {
 async function checkProjectsRoot(cfg) {
   const root = cfg?.projectsRoot;
   if (!root) return ok("projects folder not set (optional \u2014 qore init)");
-  const s = await stat5(root).catch(() => null);
+  const s = await stat6(root).catch(() => null);
   if (!s?.isDirectory()) return { status: "warn", label: `projects folder ${root} does not exist \u2014 qore init` };
   const e = await writableError(root);
   if (e) return { status: "fail", label: `projects folder ${root} is not writable (${e.code ?? e.message})` };
@@ -5034,7 +5667,7 @@ async function runDoctor(deps2, o = {}) {
   const repoRoot = wsRoot ? null : await findRepoRoot(deps2.cwd);
   if (wsRoot) {
     context.kind = "workspace";
-    context.label = basename3(wsRoot.root);
+    context.label = basename4(wsRoot.root);
     if (!session) {
       await notChecked();
       return { results, context };
@@ -5054,7 +5687,7 @@ async function runDoctor(deps2, o = {}) {
     for (const m of am.modules) await workspaceModule(deps2, wsRoot, am, m, runs, signal, push, perModule);
   } else if (repoRoot) {
     context.kind = "module";
-    context.label = basename3(repoRoot);
+    context.label = basename4(repoRoot);
     if (!session) {
       await notChecked();
       return { results, context };
@@ -5085,7 +5718,7 @@ async function workspaceModule(deps2, ws, am, m, runs, signal, push, perModule)
     await push(`module:${m.slug}`, "workspace", () => ({ status: "warn", label: "not a safe directory name \u2014 skipped" }), m.slug);
     return;
   }
-  const mod = { root: join22(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
+  const mod = { root: join24(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
   let prepared = null;
   await push(`module:${m.slug}`, "workspace", async () => {
     const info = await deps2.git.inspect(mod.root);
@@ -5117,12 +5750,12 @@ function registerDoctor(program, ctx) {
 // src/cli/commands/env.ts
 import { randomBytes as randomBytes7 } from "crypto";
 import { chmod as chmod3, realpath as realpath10 } from "fs/promises";
-import { dirname as dirname8, join as join23, relative as relative8 } from "path";
+import { dirname as dirname8, join as join25, relative as relative8 } from "path";
 var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
 function registerEnv(program, ctx) {
   const env = program.command("env").description("Local environment");
   env.command("pull").description("Write this module's local secrets into its env file").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "the project to pull for, from anywhere (see qore init)").option("--target <path>", "env file to write (inside the repository)").option("--use-portal", "take the portal's value for keys that differ locally").option("--yes", "trust this repository without asking").action(async (f) => {
-    const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true });
+    const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true, command: "env pull" });
     const { deps: deps2, io: io2 } = c;
     const g = c.opts();
     const mc = await moduleContextFor(c, f, "env pull");
@@ -5136,7 +5769,7 @@ function registerEnv(program, ctx) {
     const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
     await ensureTrusted(c, mc, app, { yes: f.yes });
     const existing = await readOrNull(target);
-    const example = existing === null ? await readOrNull(join23(dirname8(target), ".env.example")) : null;
+    const example = existing === null ? await readOrNull(join25(dirname8(target), ".env.example")) : null;
     const local = await fetchLocalEnv(deps2, mc, app);
     const inputs = {
       existing,
@@ -5152,13 +5785,13 @@ function registerEnv(program, ctx) {
       const current = parseEnv(existing ?? example ?? "");
       const choices = {};
       let bulk;
-      for (const key of plan.conflicts) {
+      for (const key2 of plan.conflicts) {
         if (bulk) {
-          choices[key] = bulk;
+          choices[key2] = bulk;
           continue;
         }
-        const pick = await io2.select(
-          `${key} differs  (local ${maskLen(current.get(key))}, portal ${maskLen(local.env[key])})`,
+        const pick2 = await io2.select(
+          `${key2} differs  (local ${maskLen(current.get(key2))}, portal ${maskLen(local.env[key2])})`,
           [
             { name: "keep local", value: "keep" },
             { name: "use portal", value: "portal" },
@@ -5166,9 +5799,9 @@ function registerEnv(program, ctx) {
             { name: "keep local for all", value: "skip" }
           ]
         );
-        if (pick === "all") bulk = "use-portal";
-        if (pick === "skip") bulk = "keep";
-        choices[key] = pick === "portal" || pick === "all" ? "use-portal" : "keep";
+        if (pick2 === "all") bulk = "use-portal";
+        if (pick2 === "skip") bulk = "keep";
+        choices[key2] = pick2 === "portal" || pick2 === "all" ? "use-portal" : "keep";
       }
       plan = planPull({ ...inputs, choices });
     }
@@ -5206,12 +5839,486 @@ function registerEnv(program, ctx) {
   });
 }
 
+// src/core/observability/compose.ts
+function pageWarnings(...pages) {
+  return pages.some((p) => p.ingestPaused) ? ["ingest_paused"] : [];
+}
+function scope(q) {
+  const s = { env: q.env };
+  if (q.since !== void 0) s.since = q.since;
+  if (q.start !== void 0) s.start = q.start;
+  if (q.end !== void 0) s.end = q.end;
+  return s;
+}
+async function errorDetail(c, id, q, withs) {
+  const w = scope(q);
+  const markdown = await c.issueMarkdown(id, w);
+  const event = await c.issueEvent(id, w);
+  const out = { issue: { markdown, event }, warnings: [] };
+  if (withs.size === 0) return out;
+  if (!event.traceId) {
+    out.warnings.push("no_trace_id");
+    return out;
+  }
+  if (withs.has("trace")) out.trace = await c.trace(event.traceId, w);
+  if (withs.has("logs")) {
+    const logs = await c.logs({ ...w, trace: event.traceId, limit: 100 });
+    out.logs = logs.items;
+    out.warnings.push(...pageWarnings(logs));
+  }
+  return out;
+}
+async function traceDetail(c, id, q, withs) {
+  const w = scope(q);
+  const out = { trace: await c.trace(id, w), warnings: [] };
+  const pages = [];
+  if (withs.has("logs")) {
+    const p = await c.logs({ ...w, trace: id, limit: 100 });
+    out.logs = p.items;
+    pages.push(p);
+  }
+  if (withs.has("errors")) {
+    const p = await c.issues({ ...w, trace: id, status: "all" });
+    out.errors = p.items;
+    pages.push(p);
+  }
+  out.warnings.push(...pageWarnings(...pages));
+  return out;
+}
+
+// src/core/observability/client.ts
+var MAX_RETRY_WAIT_S = 30;
+var NOT_PROVISIONED = "observability_not_provisioned";
+var wait = (ms2) => new Promise((r) => setTimeout(r, ms2));
+var ObsClient = class {
+  constructor(api, moduleId, sleep = wait, slug = moduleId) {
+    this.api = api;
+    this.moduleId = moduleId;
+    this.sleep = sleep;
+    this.slug = slug;
+  }
+  api;
+  moduleId;
+  sleep;
+  slug;
+  path(resource, o, extra = {}) {
+    const p = new URLSearchParams();
+    const all = { env: o.env, since: o.since, start: o.start, end: o.end, q: o.q, limit: o.limit, ...extra };
+    for (const [k, v] of Object.entries(all)) if (v !== void 0 && v !== "") p.set(k, String(v));
+    return `/api/cli/v1/modules/${encodeURIComponent(this.moduleId)}/observability/${resource}?${p}`;
+  }
+  async call(fn) {
+    try {
+      return await this.retryOnce(fn);
+    } catch (e) {
+      if (e instanceof QoreError && e.code === "QORE_ACCESS_DENIED" && e.serverCode === "auth.scope.insufficient") {
+        throw new QoreError("QORE_ACCESS_DENIED", "This login predates `qore errors/traces/logs`", {
+          hint: "Run `qore login` again.",
+          status: e.status,
+          requestId: e.requestId,
+          serverCode: e.serverCode
+        });
+      }
+      if (e instanceof QoreError && e.serverCode === NOT_PROVISIONED) {
+        throw new QoreError("QORE_RESOURCE_NOT_FOUND", `Module "${this.slug}" does not report to Sentry yet`, {
+          hint: "Its Sentry project is not provisioned; pick another module with --module.",
+          status: e.status,
+          requestId: e.requestId,
+          serverCode: e.serverCode,
+          details: e.details
+        });
+      }
+      throw e;
+    }
+  }
+  async retryOnce(fn) {
+    try {
+      return await fn();
+    } catch (e) {
+      if (!(e instanceof QoreError) || e.code !== "QORE_RATE_LIMITED") throw e;
+      const secs2 = typeof e.details?.retryAfter === "number" ? e.details.retryAfter : 1;
+      await this.sleep(Math.min(secs2, MAX_RETRY_WAIT_S) * 1e3);
+      return fn();
+    }
+  }
+  issues(o) {
+    return this.call(() => this.api.get(this.path("issues", o, { status: o.status, sort: o.sort, trace: o.trace })));
+  }
+  issueMarkdown(id, o) {
+    return this.call(() => this.api.getText(this.path(`issues/${encodeURIComponent(id)}/markdown`, { env: o.env, since: o.since, start: o.start, end: o.end }, { event: "recommended" })));
+  }
+  issueEvent(id, o) {
+    return this.call(() => this.api.get(this.path(`issues/${encodeURIComponent(id)}/events/recommended`, { env: o.env, since: o.since, start: o.start, end: o.end })));
+  }
+  logs(o) {
+    return this.call(() => this.api.get(this.path("logs", o, { level: o.level, trace: o.trace })));
+  }
+  spans(o) {
+    return this.call(() => this.api.get(this.path("spans", o, { sort: o.sort })));
+  }
+  trace(id, o) {
+    return this.call(() => this.api.get(this.path(`traces/${encodeURIComponent(id)}`, { env: o.env, since: o.since, start: o.start, end: o.end })));
+  }
+};
+
+// src/core/observability/query.ts
+var ROOT_SPAN_FILTER = "is_transaction:true";
+var DURATION = /^\d{1,6}(ms|s|m)$/;
+var SINCE = /^(\d{1,4})([mhdw])$/;
+var SECONDS = { m: 60, h: 3600, d: 86400, w: 604800 };
+function parseDuration(s) {
+  if (!DURATION.test(s)) throw new QoreError("QORE_CONTEXT_INVALID", `"${s}" is not a duration`, { hint: "Use e.g. 500ms, 1s or 2m." });
+  return s;
+}
+function parseSince(s) {
+  const m = SINCE.exec(s);
+  if (!m || Number(m[1]) * SECONDS[m[2]] > 90 * 86400) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `"${s}" is not a time window`, { hint: "Use a count plus m, h, d or w, at most 90 days (e.g. 24h, 7d)." });
+  }
+  return s;
+}
+function joinQuery(...parts) {
+  const q = parts.filter((p) => typeof p === "string" && p.length > 0).join(" ");
+  return q || void 0;
+}
+
+// src/cli/observability/context.ts
+var ALL = { kind: "module", slug: "all", name: "All modules" };
+var modCandidates = (mods, withAll) => [...mods.map((m) => ({ kind: "module", id: m.id, slug: m.slug, name: m.name })), ...withAll ? [ALL] : []];
+function withRepo(mods) {
+  const r = mods.filter((m) => m.repoUrl !== null);
+  if (r.length === 0) throw new QoreError("QORE_RESOURCE_NOT_FOUND", "No modules with a repository in this app");
+  return r;
+}
+function windowOf(f) {
+  if (Boolean(f.start) !== Boolean(f.end)) throw new QoreError("QORE_CONTEXT_INVALID", "--start and --end go together; pass both");
+  if (f.start || f.end) return { start: f.start, end: f.end };
+  return { since: parseSince(f.since ?? "24h") };
+}
+var windowText = (w) => w.since ? `last ${w.since}` : `${w.start ?? "\u2026"} \u2013 ${w.end ?? "now"}`;
+async function chooseModule(ctx, mods, flag, single) {
+  if (flag === "all" && !single) return mods;
+  if (flag && flag !== "all") {
+    const m = mods.find((x) => x.slug === flag || x.id === flag);
+    if (m) return [m];
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `No module "${flag}" in this app`, { candidates: modCandidates(mods, !single) });
+  }
+  const err = new QoreError(
+    "QORE_CONTEXT_REQUIRED",
+    single && flag === "all" ? "A detail view needs one module" : "Which module?",
+    { candidates: modCandidates(mods, !single), hint: "Pass --module <slug>" + (single ? "." : " or --module all.") }
+  );
+  if (flag === "all") throw err;
+  const choice = await pick(
+    ctx,
+    err,
+    "Select a module",
+    [...mods.map((m) => ({ name: m.slug, value: m.id })), ...single ? [] : [{ name: "All modules", value: "all" }]]
+  );
+  return choice === "all" ? mods : mods.filter((m) => m.id === choice);
+}
+async function chooseEnv(ctx, api, moduleId, appId, flag) {
+  const st = await api.get(`/api/cli/v1/modules/${encodeURIComponent(moduleId)}/status?app_id=${encodeURIComponent(appId)}`);
+  const names = st.environments.map((e) => e.name);
+  if (names.length === 0) throw new QoreError("QORE_RESOURCE_NOT_FOUND", "No environments yet");
+  const candidates = names.map((n) => ({ kind: "env", slug: n }));
+  if (flag) {
+    if (names.includes(flag)) return flag;
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `Unknown environment "${flag}"`, { candidates, hint: `Pass --env ${names.join("|")}.` });
+  }
+  const err = new QoreError("QORE_CONTEXT_REQUIRED", "Which environment?", { candidates, hint: `Pass --env ${names.join("|")}.` });
+  return pick(ctx, err, "Select an environment", names.map((n) => ({ name: n, value: n })));
+}
+async function obsContext(ctx, flags, command, o) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const window = windowOf(flags);
+  const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
+  const ws = flags.module === void 0 || flags.module === "all" ? await workspaceRoot(deps2) : null;
+  let api, tenant, app, mods, base, apiOrigin;
+  if (ws) {
+    const portal = await flagPortal(deps2, g.portal, ws);
+    apiOrigin = portal.apiOrigin;
+    const session = await openSession(deps2, portal, command, onRequest);
+    await ensureCapability(deps2, apiOrigin, "module.observability");
+    await ensureCapability(deps2, apiOrigin, "app.modules");
+    const am = await workspaceAppModules(session, portal, ws);
+    api = session.api;
+    ({ tenant } = am.app);
+    app = { id: am.app.id, slug: am.app.slug, name: am.app.name };
+    mods = await chooseModule(ctx, withRepo(am.modules), flags.module, o.single);
+    base = { portal: portal.builtin ?? portal.apiOrigin, tenant, app, source: WORKSPACE_FILE };
+  } else {
+    const mc = await moduleContextFor(ctx, { module: flags.module === "all" ? void 0 : flags.module }, command);
+    apiOrigin = mc.portal.apiOrigin;
+    await ensureCapability(deps2, apiOrigin, "module.observability");
+    app = await appFor(ctx, mc, flags.app);
+    api = mc.session.api;
+    tenant = mc.module.tenant;
+    if (flags.module === "all") {
+      if (o.single) throw new QoreError(
+        "QORE_CONTEXT_REQUIRED",
+        "A detail view needs one module",
+        { candidates: [{ kind: "module", id: mc.module.id, slug: mc.module.slug, name: mc.module.name }] }
+      );
+      await ensureCapability(deps2, apiOrigin, "app.modules");
+      const am = await api.get(`/api/cli/v1/apps/${encodeURIComponent(app.id)}/modules`);
+      mods = withRepo(am.modules);
+    } else {
+      mods = [mc.module];
+    }
+    base = contextJson(mc, app);
+    delete base.module;
+  }
+  await ensureCapability(deps2, apiOrigin, "module.status");
+  const env = await chooseEnv(ctx, api, mods[0].id, app.id, flags.env);
+  const fanOut2 = mods.length > 1 || flags.module === "all";
+  const targets = mods.map((m) => ({ module: { id: m.id, slug: m.slug, name: m.name, type: m.type, access: m.access }, client: new ObsClient(api, m.id, void 0, m.slug) }));
+  const where = fanOut2 ? "all modules" : mods[0].slug;
+  return {
+    targets,
+    fanOut: fanOut2,
+    env,
+    window,
+    header: `\u2192 ${tenant.name} / ${app.name} / ${where}  \xB7  ${env}  \xB7  ${windowText(window)}`,
+    json: { ...base, ...fanOut2 ? { modules: targets.map((t) => t.module) } : { module: targets[0].module }, env, window }
+  };
+}
+
+// src/cli/format.ts
+function ago(iso, now) {
+  if (!iso) return "\u2013";
+  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1e3));
+  if (s < 60) return "just now";
+  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
+  return `${Math.floor(s / 86400)}d ago`;
+}
+var pct = (f) => String(Number((f * 100).toFixed(2)));
+function uptime(h) {
+  if (!h) return "\u2013";
+  const kind = h.cause && h.kind !== "up" ? `${h.kind}: ${h.cause}` : h.kind;
+  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`;
+}
+function table(rows) {
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => (r[i] ?? "").length)));
+  return rows.map((r) => "  " + r.map((c, i) => i === r.length - 1 ? c : c.padEnd(widths[i])).join("  "));
+}
+
+// src/cli/observability/render.ts
+var CONTROL = /[\x00-\x08\x0b-\x1f\x7f\x80-\x9f]/g;
+var clean = (s) => s.replace(CONTROL, "");
+function fence(content) {
+  const lines = content.map(clean);
+  const longest = Math.max(0, ...lines.flatMap((l) => (l.match(/`+/g) ?? []).map((r) => r.length)));
+  const ticks = "`".repeat(Math.max(3, longest + 1));
+  return [`${ticks}untrusted-data`, ...lines, ticks];
+}
+function ms(n) {
+  return n < 1e3 ? `${Math.round(n)}ms` : `${(n / 1e3).toFixed(1)}s`;
+}
+var oneLine = (s) => clean((s ?? "").replace(/\s+/g, " ")).trim();
+function issuesTable(items, now, withModule) {
+  const head = ["ID", "LEVEL", "EVENTS", "USERS", "LAST SEEN", "TITLE"];
+  const rows = items.map((i) => [oneLine(i.shortId), oneLine(i.level), String(i.count), String(i.userCount), ago(i.lastSeen, now), oneLine(i.title)]);
+  return table(withModule ? [["MODULE", ...head], ...rows.map((r, n) => [oneLine(items[n].module.slug), ...r])] : [head, ...rows]);
+}
+function spansTable(items, now, withModule) {
+  const head = ["TRACE", "DURATION", "ROOT", "WHEN"];
+  const rows = items.map((s) => [oneLine(s.traceId), ms(s.durationMs), oneLine(s.transaction ?? s.description ?? s.name), ago(s.timestamp, now)]);
+  return table(withModule ? [["MODULE", ...head], ...rows.map((r, n) => [oneLine(items[n].module.slug), ...r])] : [head, ...rows]);
+}
+function logLines(items, withModule) {
+  return items.map((l) => [oneLine(l.timestamp), oneLine(l.severity).toUpperCase(), ...withModule ? [oneLine(l.module.slug)] : [], oneLine(l.message)].join(" "));
+}
+function spanTree(t) {
+  const all = [];
+  const walk = (n) => {
+    all.push(n);
+    n.children.forEach(walk);
+  };
+  t.roots.forEach(walk);
+  const slowest = all.reduce((a, n) => !a || n.end - n.start > a.end - a.start ? n : a, null);
+  const out = [];
+  const line2 = (n, depth) => {
+    const label3 = [oneLine(n.op), oneLine(n.description ?? n.transaction)].filter(Boolean).join(" ");
+    const errs = n.errors.map((e) => `\u2716 ${oneLine(e.shortId ?? e.eventId)}`).join(" ");
+    out.push([
+      `${"  ".repeat(depth)}${label3}`,
+      ms((n.end - n.start) * 1e3),
+      `[${oneLine(n.module.slug)}]`,
+      ...n === slowest ? ["\u25C0 slowest"] : [],
+      ...errs ? [errs] : []
+    ].join("  "));
+    n.children.forEach((c) => line2(c, depth + 1));
+  };
+  t.roots.forEach((r) => line2(r, 0));
+  return out;
+}
+var WARN = {
+  ingest_paused: "! This tenant's Sentry quota is reached; new events are not being recorded.",
+  no_trace_id: "! This error has no trace id, so there is no trace or trace logs to show.",
+  sort_unavailable: "! Sorting by duration is not available here; showing the slowest of the most recent matches.",
+  module_not_provisioned: "! Skipped, not reporting to Sentry yet:"
+};
+function warningLines(w, skipped = []) {
+  return [...new Set(w)].map((k) => k === "module_not_provisioned" ? `${WARN[k]} ${skipped.join(", ")}` : WARN[k]);
+}
+
+// src/cli/observability/flags.ts
+function addObsFlags(cmd) {
+  return cmd.option("--env <name>", "the environment (required; prompted when interactive)").option("--module <slug|all>", "the module (default: this repository); all = every module of the app").option("--app <slug|id>", "the app, when the module is part of several").option("--since <window>", "time window, e.g. 1h, 24h, 7d (default 24h)").option("--start <iso>", "window start (use with --end, instead of --since)").option("--end <iso>", "window end (use with --start, instead of --since)").option("--query <search>", "Sentry search syntax, appended to the filter").option("--limit <n>", "rows per module, 1-100 (default 25)");
+}
+function limitOf(s) {
+  if (s === void 0) return 25;
+  const n = Number(s);
+  if (!Number.isInteger(n) || n < 1 || n > 100) throw new QoreError("QORE_CONTEXT_INVALID", `--limit must be 1-100, not "${s}"`);
+  return n;
+}
+function withList(s, allowed) {
+  if (!s) return /* @__PURE__ */ new Set();
+  const parts = s.split(",").map((p) => p.trim()).filter(Boolean);
+  const bad = parts.filter((p) => !allowed.includes(p));
+  if (bad.length) throw new QoreError("QORE_CONTEXT_INVALID", `--with accepts ${allowed.join(", ")}; not ${bad.join(", ")}`);
+  return new Set(parts);
+}
+function one(flag, value, allowed) {
+  if (!allowed.includes(value)) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `${flag} must be ${allowed.join("|")}, not "${value}"`);
+  }
+  return value;
+}
+async function fanOut(oc2, fn) {
+  const out = { results: [], skipped: [] };
+  let last;
+  for (const target of oc2.targets) {
+    try {
+      out.results.push({ target, result: await fn(target) });
+    } catch (e) {
+      if (oc2.targets.length < 2 || !(e instanceof QoreError) || e.serverCode !== NOT_PROVISIONED) throw e;
+      out.skipped.push({ id: target.module.id, slug: target.module.slug });
+      last = e;
+    }
+  }
+  if (out.results.length === 0 && last) {
+    throw new QoreError("QORE_RESOURCE_NOT_FOUND", "No module of this app reports to Sentry yet", {
+      serverCode: NOT_PROVISIONED,
+      details: { modules: out.skipped.map((m) => m.slug) }
+    });
+  }
+  return out;
+}
+var skipWarnings = (f) => f.skipped.length ? ["module_not_provisioned"] : [];
+var skipJson = (f) => f.skipped.length ? { unprovisionedModules: f.skipped } : {};
+function printWarnings(io2, w, json2, skipped = []) {
+  if (!json2) for (const l of warningLines(w, skipped.map((m) => m.slug))) io2.err(l);
+}
+
+// src/cli/commands/errors.ts
+var WITHS = ["trace", "logs"];
+var STATUSES = ["unresolved", "resolved", "all"];
+var SORTS = ["date", "freq", "new"];
+var MERGE = {
+  date: (a, b) => b.lastSeen.localeCompare(a.lastSeen),
+  freq: (a, b) => b.count - a.count,
+  new: (a, b) => b.firstSeen.localeCompare(a.firstSeen)
+};
+function printDetail(ctx, oc2, d, showIssue) {
+  const { io: io2 } = ctx;
+  printWarnings(io2, d.warnings, false);
+  if (showIssue) for (const l of fence(d.issue.markdown.split("\n"))) io2.out(l);
+  if (d.trace) {
+    io2.out("");
+    io2.out("Trace");
+    for (const l of fence(spanTree(d.trace))) io2.out(l);
+  }
+  if (d.logs) {
+    io2.out("");
+    io2.out(`Logs (${d.logs.length})`);
+    for (const l of fence(logLines(d.logs, oc2.fanOut))) io2.out(l);
+  }
+}
+async function interactiveDetail(ctx, oc2, c, id) {
+  const first = await errorDetail(c, id, { env: oc2.env, ...oc2.window }, /* @__PURE__ */ new Set());
+  printDetail(ctx, oc2, first, true);
+  const traceId = first.issue.event.traceId;
+  if (!traceId) return;
+  const scope2 = { env: oc2.env, ...oc2.window };
+  for (; ; ) {
+    const next = await ctx.io.select("Next?", [
+      { name: `Show trace ${oneLine(traceId).slice(0, 8)}`, value: "trace" },
+      { name: "Logs of this trace", value: "logs" },
+      { name: "Done", value: "done" }
+    ]);
+    if (next === "done") return;
+    const extra = { issue: first.issue, warnings: [] };
+    if (next === "trace") extra.trace = await c.trace(traceId, scope2);
+    else {
+      const p = await c.logs({ ...scope2, trace: traceId, limit: 100 });
+      extra.logs = p.items;
+      extra.warnings.push(...pageWarnings(p));
+    }
+    printDetail(ctx, oc2, extra, false);
+  }
+}
+function registerErrors(program, ctx) {
+  addObsFlags(program.command("errors [id]").description("Errors of a deployed environment, or one error with its stack trace (requires --env)")).option("--with <list>", `with an id: also show ${WITHS.join(",")}`).option("--status <status>", `${STATUSES.join("|")} (default unresolved)`).option("--sort <sort>", `${SORTS.join("|")} (default date)`).action(async (id, flags) => {
+    const { io: io2, deps: deps2 } = ctx;
+    const g = ctx.opts();
+    const withs = withList(flags.with, WITHS);
+    const status2 = one("--status", flags.status ?? "unresolved", STATUSES);
+    const sort = one("--sort", flags.sort ?? "date", SORTS);
+    const limit = limitOf(flags.limit);
+    const oc2 = await obsContext(ctx, flags, "errors", { single: id !== void 0 });
+    const q = { env: oc2.env, ...oc2.window, q: flags.query, limit };
+    if (id) {
+      const c2 = oc2.targets[0].client;
+      if (g.json) {
+        renderJson(io2, { context: oc2.json, ...await errorDetail(c2, id, q, withs) });
+        return;
+      }
+      io2.err(oc2.header);
+      if (io2.interactive && withs.size === 0) {
+        await interactiveDetail(ctx, oc2, c2, id);
+        return;
+      }
+      printDetail(ctx, oc2, await errorDetail(c2, id, q, withs), true);
+      return;
+    }
+    const f = await fanOut(oc2, (t) => t.client.issues({ ...q, status: status2, sort }));
+    const pages = f.results.map((r) => r.result);
+    const items = pages.flatMap((p) => p.items);
+    if (pages.length > 1) items.sort(MERGE[sort]);
+    const warnings = [...pageWarnings(...pages), ...skipWarnings(f)];
+    if (g.json) {
+      renderJson(io2, { context: oc2.json, items, warnings, ...skipJson(f) });
+      return;
+    }
+    io2.err(oc2.header);
+    printWarnings(io2, warnings, false, f.skipped);
+    if (items.length === 0) {
+      io2.out(`No ${status2 === "all" ? "" : `${status2} `}errors in ${oc2.env} (${windowText(oc2.window)}).`);
+      return;
+    }
+    for (const l of fence(issuesTable(items, deps2.now(), oc2.fanOut))) io2.out(l);
+    if (!io2.interactive) return;
+    const picked = await io2.select(
+      "Which error to open?",
+      [...items.map((i) => ({ name: `${oneLine(i.shortId)}  ${oneLine(i.title)}`.slice(0, 100), value: i })), { name: "(none)", value: null }]
+    );
+    if (!picked) return;
+    const c = oc2.targets.find((t) => t.module.id === picked.module.id)?.client;
+    if (!c) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `module ${picked.module.slug} is not among the queried modules`);
+    await interactiveDetail(ctx, oc2, c, picked.shortId);
+  });
+}
+
 // src/cli/commands/init.ts
 import { realpath as realpath11 } from "fs/promises";
 
 // src/core/auth/oidc.ts
 import * as oc from "openid-client";
-var LOGIN_SCOPE = "openid profile email offline_access qore:read qore:local-env";
+var LOGIN_SCOPE = "openid profile email offline_access qore:read qore:local-env qore:observability";
 function decodeSub(accessToken) {
   const part = accessToken.split(".")[1] ?? "";
   const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
@@ -5262,9 +6369,9 @@ async function createOidc(opts) {
     throw mapOidcError(e, host);
   }
   return {
-    async startDevice(scope) {
+    async startDevice(scope2) {
       try {
-        const r = await oc.initiateDeviceAuthorization(config, { scope });
+        const r = await oc.initiateDeviceAuthorization(config, { scope: scope2 });
         return {
           userCode: r.user_code,
           verificationUri: r.verification_uri,
@@ -5284,9 +6391,9 @@ async function createOidc(opts) {
         throw mapOidcError(e, host);
       }
     },
-    async refresh(rt, scope) {
+    async refresh(rt, scope2) {
       try {
-        const t = await oc.refreshTokenGrant(config, rt, scope ? { scope } : void 0);
+        const t = await oc.refreshTokenGrant(config, rt, scope2 ? { scope: scope2 } : void 0);
         return toTokenSet(t, rt);
       } catch (e) {
         throw mapOidcError(e, host);
@@ -5538,6 +6645,34 @@ function registerInit(program, ctx) {
   });
 }
 
+// src/cli/commands/logs.ts
+var LEVELS = ["error", "warn", "info", "debug"];
+function registerLogs(program, ctx) {
+  addObsFlags(program.command("logs").description("Logs of a deployed environment (requires --env)")).option("--level <level>", `exactly this severity: ${LEVELS.join("|")}`).option("--trace <id>", "only the logs of one trace").action(async (flags) => {
+    const { io: io2 } = ctx;
+    const g = ctx.opts();
+    const limit = limitOf(flags.limit);
+    const level = flags.level === void 0 ? void 0 : one("--level", flags.level, LEVELS);
+    const oc2 = await obsContext(ctx, flags, "logs", { single: false });
+    const q = { env: oc2.env, ...oc2.window, q: flags.query, limit, level, trace: flags.trace };
+    const f = await fanOut(oc2, (t) => t.client.logs(q));
+    const pages = f.results.map((r) => r.result);
+    const items = pages.flatMap((p) => p.items).sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+    const warnings = [...pageWarnings(...pages), ...skipWarnings(f)];
+    if (g.json) {
+      renderJson(io2, { context: oc2.json, items, warnings, ...skipJson(f) });
+      return;
+    }
+    io2.err(oc2.header);
+    printWarnings(io2, warnings, false, f.skipped);
+    if (items.length === 0) {
+      io2.out(`No logs in ${oc2.env} (${windowText(oc2.window)}).`);
+      return;
+    }
+    for (const l of fence(logLines(items, oc2.fanOut))) io2.out(l);
+  });
+}
+
 // src/cli/commands/logout.ts
 function registerLogout(program, ctx) {
   program.command("logout").description("End the CLI session").option("--all", "log out of every portal").action(async (cmd) => {
@@ -5570,26 +6705,6 @@ function registerLogout(program, ctx) {
   });
 }
 
-// src/cli/format.ts
-function ago(iso, now) {
-  if (!iso) return "\u2013";
-  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1e3));
-  if (s < 60) return "just now";
-  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
-  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
-  return `${Math.floor(s / 86400)}d ago`;
-}
-var pct = (f) => String(Number((f * 100).toFixed(2)));
-function uptime(h) {
-  if (!h) return "\u2013";
-  const kind = h.cause && h.kind !== "up" ? `${h.kind}: ${h.cause}` : h.kind;
-  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`;
-}
-function table(rows) {
-  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => (r[i] ?? "").length)));
-  return rows.map((r) => "  " + r.map((c, i) => i === r.length - 1 ? c : c.padEnd(widths[i])).join("  "));
-}
-
 // src/cli/commands/status.ts
 var HEAD = ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"];
 var envRow = (e, now) => [e.name, e.paused ? "paused" : e.status, e.commit?.sha ?? "\u2013", ago(e.commit?.deployedAt ?? null, now), uptime(e.health)];
@@ -5631,7 +6746,7 @@ async function appStatus(ctx, ws, appFlag) {
 }
 function registerStatus(program, ctx) {
   program.command("status").description("Deployment and health per environment for this module (or, in a workspace root, the app)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "the app or module, from anywhere (see qore init)").action(async (flags) => {
-    const c = await projectCtx(ctx, { ref: flags.project, module: flags.module, app: flags.app, needModule: false });
+    const c = await projectCtx(ctx, { ref: flags.project, module: flags.module, app: flags.app, needModule: false, command: "status" });
     const { deps: deps2, io: io2 } = c;
     const g = c.opts();
     if (!flags.module) {
@@ -5664,7 +6779,7 @@ function registerStatus(program, ctx) {
 }
 
 // src/cli/commands/sync.ts
-import { join as join24, relative as relative9 } from "path";
+import { join as join26, relative as relative9 } from "path";
 import { Option as Option2 } from "commander";
 function asFailure2(slug, e) {
   if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
@@ -5696,7 +6811,7 @@ function registerSync(program, ctx) {
         continue;
       }
       try {
-        dirs[m.slug] = await deps2.git.inspect(join24(ws.root, m.slug));
+        dirs[m.slug] = await deps2.git.inspect(join26(ws.root, m.slug));
         modulesForPlan.push(m);
       } catch (e) {
         earlyFailures.push(asFailure2(m.slug, e));
@@ -5717,6 +6832,109 @@ function registerSync(program, ctx) {
   });
 }
 
+// src/cli/commands/traces.ts
+var WITHS2 = ["logs", "errors"];
+async function spansOf(c, q, sort, warnings) {
+  try {
+    return await c.spans({ ...q, sort });
+  } catch (e) {
+    if (sort === "-duration" && e instanceof QoreError && e.serverCode === "observability.sort_unsupported") {
+      warnings.push("sort_unavailable");
+      return c.spans(q);
+    }
+    throw e;
+  }
+}
+function registerTraces(program, ctx) {
+  addObsFlags(program.command("traces [id]").description("Slow or recent requests, or one trace as a span tree (requires --env)")).option("--slower-than <duration>", "only requests slower than this, slowest first (e.g. 500ms, 1s)").option("--with <list>", `with a trace id: also show ${WITHS2.join(",")}`).action(async (id, flags) => {
+    const { io: io2, deps: deps2 } = ctx;
+    const g = ctx.opts();
+    const withs = withList(flags.with, WITHS2);
+    const slower = flags.slowerThan === void 0 ? void 0 : parseDuration(flags.slowerThan);
+    const limit = limitOf(flags.limit);
+    const oc2 = await obsContext(ctx, flags, "traces", { single: id !== void 0 });
+    const q = { env: oc2.env, ...oc2.window, limit };
+    const scope2 = { env: oc2.env, ...oc2.window };
+    const printLogs = (items2) => {
+      io2.out("");
+      io2.out(`Logs (${items2.length})`);
+      for (const l of fence(logLines(items2, oc2.fanOut))) io2.out(l);
+    };
+    const printErrors = (items2) => {
+      io2.out("");
+      io2.out(`Errors (${items2.length})`);
+      for (const l of fence(issuesTable(items2, deps2.now(), oc2.fanOut))) io2.out(l);
+    };
+    const printTree = (trace2) => {
+      for (const l of fence(spanTree(trace2))) io2.out(l);
+    };
+    const more = async (c2, traceId, w) => {
+      const f2 = { ...scope2, trace: traceId };
+      if (w === "logs") {
+        const p = await c2.logs({ ...f2, limit: 100 });
+        printWarnings(io2, pageWarnings(p), false);
+        printLogs(p.items);
+      } else {
+        const p = await c2.issues({ ...f2, status: "all" });
+        printWarnings(io2, pageWarnings(p), false);
+        printErrors(p.items);
+      }
+    };
+    if (id) {
+      const c2 = oc2.targets[0].client;
+      const b = await traceDetail(c2, id, q, withs);
+      if (g.json) {
+        renderJson(io2, { context: oc2.json, ...b });
+        return;
+      }
+      io2.err(oc2.header);
+      printWarnings(io2, b.warnings, false);
+      printTree(b.trace);
+      if (b.logs) printLogs(b.logs);
+      if (b.errors) printErrors(b.errors);
+      return;
+    }
+    const warnings = [];
+    const listQ = { ...q, q: joinQuery(ROOT_SPAN_FILTER, slower && `span.duration:>${slower}`, flags.query) };
+    const sort = slower ? "-duration" : "-timestamp";
+    const f = await fanOut(oc2, (t) => spansOf(t.client, listQ, sort, warnings));
+    const pages = f.results.map((r) => r.result);
+    warnings.push(...pageWarnings(...pages), ...skipWarnings(f));
+    const items = pages.flatMap((p) => p.items).sort((a, b) => slower ? b.durationMs - a.durationMs : b.timestamp.localeCompare(a.timestamp));
+    const uniq = [...new Set(warnings)];
+    if (g.json) {
+      renderJson(io2, { context: oc2.json, items, warnings: uniq, ...skipJson(f) });
+      return;
+    }
+    io2.err(oc2.header);
+    printWarnings(io2, uniq, false, f.skipped);
+    if (items.length === 0) {
+      io2.out(`No ${slower ? `requests slower than ${slower}` : "traces"} in ${oc2.env} (${windowText(oc2.window)}).`);
+      return;
+    }
+    for (const l of fence(spansTable(items, deps2.now(), oc2.fanOut))) io2.out(l);
+    if (!io2.interactive) return;
+    const picked = await io2.select(
+      "Which trace to open?",
+      [...items.map((s) => ({ name: `${oneLine(s.traceId).slice(0, 8)}  ${oneLine(s.transaction ?? s.op)}`, value: s })), { name: "(none)", value: null }]
+    );
+    if (!picked) return;
+    const c = oc2.targets.find((t) => t.module.id === picked.module.id)?.client;
+    if (!c) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `module ${picked.module.slug} is not among the queried modules`);
+    const { trace } = await traceDetail(c, picked.traceId, q, /* @__PURE__ */ new Set());
+    printTree(trace);
+    for (; ; ) {
+      const next = await io2.select("Next?", [
+        { name: "Logs of this trace", value: "logs" },
+        { name: "Errors in this trace", value: "errors" },
+        { name: "Done", value: "done" }
+      ]);
+      if (next === "done") return;
+      await more(c, picked.traceId, next);
+    }
+  });
+}
+
 // src/cli/commands/version.ts
 function registerVersion(program, ctx) {
   program.command("version").description("Show the CLI and portal version").action(async () => {
@@ -5785,9 +7003,13 @@ var COMMANDS = [
   registerWhoami,
   registerTenant,
   registerStatus,
+  registerLogs,
+  registerTraces,
+  registerErrors,
   registerEnv,
   registerRun,
   registerDev,
+  registerDb,
   registerClone,
   registerSync,
   registerVersion,
@@ -5844,13 +7066,13 @@ function createTelemetry(deps2, o) {
     },
     async end(signal) {
       if (!sdk) return { drained: true };
-      const ms = crashed ? flushMs.crash : flushMs.clean;
+      const ms2 = crashed ? flushMs.crash : flushMs.clean;
       const work = sdk.then(async (s) => {
         if (!s) return true;
         if (crashed) s.crash(crashed.e);
-        return s.end(ms);
+        return s.end(ms2);
       }).catch(() => false);
-      return { drained: await withDeadline(work, ms, signal) };
+      return { drained: await withDeadline(work, ms2, signal) };
     }
   };
 }
@@ -5871,16 +7093,16 @@ async function start(deps2, argv2, command, load, onScrub) {
   sdk.start();
   return sdk;
 }
-function withDeadline(work, ms, signal) {
+function withDeadline(work, ms2, signal) {
   if (signal?.aborted) return Promise.resolve(false);
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const done = (v) => {
       clearTimeout(timer);
       signal?.removeEventListener("abort", onAbort);
-      resolve6(v);
+      resolve7(v);
     };
     const onAbort = () => done(false);
-    const timer = setTimeout(() => done(false), ms);
+    const timer = setTimeout(() => done(false), ms2);
     signal?.addEventListener("abort", onAbort, { once: true });
     work.then(done, () => done(false));
   });
@@ -5928,8 +7150,8 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 }
 
 // src/core/config.ts
-import { readFile as readFile6 } from "fs/promises";
-import { join as join25 } from "path";
+import { readFile as readFile8 } from "fs/promises";
+import { join as join27 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -5937,12 +7159,12 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join25(this.dir, "config.json");
+    return join27(this.dir, "config.json");
   }
   async read() {
     let raw;
     try {
-      raw = await readFile6(this.file, "utf8");
+      raw = await readFile8(this.file, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return empty();
       throw e;
@@ -5968,9 +7190,9 @@ var ConfigStore = class {
 
 // src/platform/git.ts
 import { execFile, execFileSync } from "child_process";
-import { mkdir as mkdir4, readdir as readdir4, stat as stat6 } from "fs/promises";
+import { mkdir as mkdir4, readdir as readdir4, stat as stat7 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname9, join as join26 } from "path";
+import { dirname as dirname9, join as join28 } from "path";
 function parseRemotes(stdout) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -6008,8 +7230,8 @@ function parseStatus(stdout) {
 }
 var configuredSshCommand = /* @__PURE__ */ new Map();
 function hasConfiguredSshCommand(repoDir) {
-  const key = repoDir ?? "";
-  let v = configuredSshCommand.get(key);
+  const key2 = repoDir ?? "";
+  let v = configuredSshCommand.get(key2);
   if (v === void 0) {
     const args = repoDir ? ["-C", repoDir, "config", "--get", "core.sshCommand"] : ["config", "--get", "core.sshCommand"];
     try {
@@ -6023,7 +7245,7 @@ function hasConfiguredSshCommand(repoDir) {
     } catch {
       v = false;
     }
-    configuredSshCommand.set(key, v);
+    configuredSshCommand.set(key2, v);
   }
   return v;
 }
@@ -6037,7 +7259,7 @@ function gitExecOptions(repoDir) {
   return { cwd: homedir(), env, windowsHide: true, maxBuffer: 8 * 1024 * 1024 };
 }
 function runGit(args, repoDir) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     execFile("git", args, gitExecOptions(repoDir), (err, stdout, stderr) => {
       if (err && err.code === "ENOENT") {
         reject(new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
@@ -6046,7 +7268,7 @@ function runGit(args, repoDir) {
         return;
       }
       const code = err ? typeof err.code === "number" ? err.code : 1 : 0;
-      resolve6({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
+      resolve7({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
     });
   });
 }
@@ -6084,7 +7306,7 @@ async function status(repoRoot) {
 }
 async function statOrThrow(path) {
   try {
-    return await stat6(path);
+    return await stat7(path);
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
     throw new QoreError("QORE_INTERNAL", `could not stat ${path}`, { cause: err });
@@ -6101,7 +7323,7 @@ async function inspect(dir2) {
     throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
   }
   const empty2 = entries.length === 0;
-  const isRepo = await statOrThrow(join26(dir2, ".git")) !== void 0;
+  const isRepo = await statOrThrow(join28(dir2, ".git")) !== void 0;
   const dirRemotes = isRepo ? await remotes(dir2) : [];
   return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
 }
@@ -6163,13 +7385,13 @@ var OsKeychain = class {
 
 // src/platform/lock.ts
 import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join27(dir2, "locks");
+    const locks = join29(dir2, "locks");
     await mkdir5(locks, { recursive: true, mode: 448 });
-    const target = join27(locks, `${name}.lock`);
+    const target = join29(locks, `${name}.lock`);
     await writeFile5(target, "", { flag: "a" });
     let release;
     let compromised;
@@ -6213,7 +7435,7 @@ var STDERR_DRAIN_MS = 500;
 function makeSpawner(spawnFn, proc) {
   return {
     run(cmd, args, env, o) {
-      return new Promise((resolve6, reject) => {
+      return new Promise((resolve7, reject) => {
         let child;
         try {
           child = spawnFn(cmd, args, {
@@ -6247,7 +7469,7 @@ function makeSpawner(spawnFn, proc) {
           cleanup();
           const stderr = child.stderr;
           if (!o?.onStderr || !stderr || stderr.readableEnded) {
-            resolve6({ code, signal });
+            resolve7({ code, signal });
             return;
           }
           let settled = false;
@@ -6255,7 +7477,7 @@ function makeSpawner(spawnFn, proc) {
             if (settled) return;
             settled = true;
             clearTimeout(timer);
-            resolve6({ code, signal });
+            resolve7({ code, signal });
           };
           const timer = setTimeout(finish, STDERR_DRAIN_MS);
           timer.unref?.();
@@ -6310,13 +7532,13 @@ var systemLauncher = {
     child.stdout?.on("data", (c) => out.push(c));
     child.stderr?.on("data", (c) => err.push(c));
     let closed = false;
-    const exited = new Promise((resolve6) => {
-      child.once("error", (e) => resolve6({ code: null, signal: null, spawnError: e.code ?? "error" }));
+    const exited = new Promise((resolve7) => {
+      child.once("error", (e) => resolve7({ code: null, signal: null, spawnError: e.code ?? "error" }));
       child.once("close", (code, signal) => {
         closed = true;
         out.flush();
         err.flush();
-        resolve6({ code, signal });
+        resolve7({ code, signal });
       });
     });
     return {
@@ -6362,11 +7584,11 @@ var systemLauncher = {
 import { execFile as execFile2 } from "child_process";
 import { connect } from "net";
 function accepts(host, port) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const s = connect({ host, port });
     const done = (v) => {
       s.destroy();
-      resolve6(v);
+      resolve7(v);
     };
     s.setTimeout(500, () => done(false));
     s.once("connect", () => done(true));
@@ -6374,12 +7596,12 @@ function accepts(host, port) {
   });
 }
 function run2(cmd, args) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     execFile2(
       cmd,
       args,
       { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
-      (e, stdout) => resolve6(e && !stdout ? null : String(stdout))
+      (e, stdout) => resolve7(e && !stdout ? null : String(stdout))
     );
   });
 }
@@ -6442,6 +7664,26 @@ var systemPorts = {
   }
 };
 
+// src/platform/postgres.ts
+import pg from "pg";
+async function connectPostgres(url, o) {
+  const client = new pg.Client({ connectionString: url, connectionTimeoutMillis: o.timeoutMs });
+  client.on("error", () => {
+  });
+  try {
+    await client.connect();
+    await client.query("set default_transaction_read_only = on");
+  } catch (e) {
+    await client.end().catch(() => {
+    });
+    throw e;
+  }
+  return {
+    query: async (sql, params) => ({ rows: (await client.query(sql, params)).rows }),
+    close: () => client.end()
+  };
+}
+
 // src/buildInfo.ts
 var SENTRY_DSN = true ? "https://50b592efb53dbc1a31cb10d3945c6d52@o4512129906049024.ingest.de.sentry.io/4512174341750864" : "";
 var SENTRY_ENVIRONMENT = true ? "production" : "development";
@@ -6451,7 +7693,7 @@ import { execFile as execFile3 } from "child_process";
 
 // src/core/diagnostics/proxy.ts
 function parseScutilProxy(stdout) {
-  const value = (key) => stdout.match(new RegExp(`^\\s*${key}\\s*:\\s*(.+)$`, "m"))?.[1]?.trim();
+  const value = (key2) => stdout.match(new RegExp(`^\\s*${key2}\\s*:\\s*(.+)$`, "m"))?.[1]?.trim();
   if (value("HTTPSEnable") === "1") {
     const host = value("HTTPSProxy");
     const port = value("HTTPSPort");
@@ -6472,12 +7714,12 @@ function parseRegProxy(stdout) {
 
 // src/platform/proxy.ts
 function run3(cmd, args) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     execFile3(
       cmd,
       args,
       { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
-      (e, stdout) => resolve6(e && !stdout ? null : String(stdout))
+      (e, stdout) => resolve7(e && !stdout ? null : String(stdout))
     );
   });
 }
@@ -6488,10 +7730,10 @@ async function detect(platform) {
       return out ? parseScutilProxy(out) : null;
     }
     if (platform === "win32") {
-      const key = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
+      const key2 = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
       const [enable, server] = await Promise.all([
-        run3("reg", ["query", key, "/v", "ProxyEnable"]),
-        run3("reg", ["query", key, "/v", "ProxyServer"])
+        run3("reg", ["query", key2, "/v", "ProxyEnable"]),
+        run3("reg", ["query", key2, "/v", "ProxyServer"])
       ]);
       const combined = [enable, server].filter(Boolean).join("\n");
       return combined ? parseRegProxy(combined) : null;
@@ -6508,7 +7750,7 @@ function systemProxy(platform = process.platform) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.6" : "0.0.0-dev";
+var VERSION = true ? "0.1.8" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -6556,7 +7798,9 @@ var deps = {
   },
   sentryDsn: SENTRY_DSN,
   sentryEnvironment: SENTRY_ENVIRONMENT,
-  systemProxy: () => systemProxy(process.platform)
+  systemProxy: () => systemProxy(process.platform),
+  viewerDir: fileURLToPath(new URL("../viewer/dist/", import.meta.url)),
+  postgres: connectPostgres
 };
 var termination = preflightTermination(() => ac.abort(), deps.raise);
 var io = processIo(isInteractive({
@@ -6586,4 +7830,4 @@ if (!drained) {
   process.exit();
 }
 //# sourceMappingURL=cli.js.map
-//# debugId=28c91dc8-dbb9-5c0a-91e3-f368931a4ed3
+//# debugId=c4bda056-b13b-52b5-831f-2afd3f6c6867