@quatronic/qore 0.1.7 → 0.1.9

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bf813c0e-4054-532d-9e74-62fbe8673876")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f7b490f6-b0af-5874-9ffa-f8010e3ba137")}catch(e){}}();
 import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
 import {
   addSecretValues,
@@ -9,6 +9,7 @@ import {
 
 // src/cli.ts
 import { homedir as homedir2 } from "os";
+import { fileURLToPath } from "url";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
 
 // src/cli/io.ts
@@ -169,7 +170,7 @@ function processIo(interactive, stderrTTY = Boolean(process.stderr.isTTY)) {
   };
 }
 function createWaitForEnter(input2, output) {
-  return (message, signal) => new Promise((resolve6, reject) => {
+  return (message, signal) => new Promise((resolve7, reject) => {
     const rl = createInterface({ input: input2, output, terminal: true });
     const onAbort = () => {
       rl.close();
@@ -178,7 +179,7 @@ function createWaitForEnter(input2, output) {
     const done = () => {
       signal.removeEventListener("abort", onAbort);
       rl.close();
-      resolve6();
+      resolve7();
     };
     signal.addEventListener("abort", onAbort, { once: true });
     rl.on("SIGINT", () => {
@@ -382,16 +383,16 @@ function groupByModule(results) {
   const order = [];
   const groups = /* @__PURE__ */ new Map();
   for (const r of results) {
-    const key = r.module ?? r.id;
-    if (!groups.has(key)) {
-      groups.set(key, []);
-      order.push(key);
+    const key2 = r.module ?? r.id;
+    if (!groups.has(key2)) {
+      groups.set(key2, []);
+      order.push(key2);
     }
-    groups.get(key).push(r);
+    groups.get(key2).push(r);
   }
   const isSub = (r) => r.id.startsWith("pm:") || r.id.startsWith("node:");
-  return order.flatMap((key) => {
-    const g = groups.get(key);
+  return order.flatMap((key2) => {
+    const g = groups.get(key2);
     return [...g.filter((r) => !isSub(r)), ...g.filter(isSub)];
   });
 }
@@ -654,7 +655,7 @@ var QoreApiClient = class {
     this.o = o;
   }
   o;
-  async once(method, path, body, force) {
+  async once(method, path2, body, force) {
     const token = await this.o.token(force);
     const headers = {
       authorization: `Bearer ${token}`,
@@ -666,7 +667,7 @@ var QoreApiClient = class {
     if (body !== void 0) headers["content-type"] = "application/json";
     let res;
     try {
-      res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {
+      res = await this.o.fetch(`${this.o.apiOrigin}${path2}`, {
         method,
         headers,
         body: body === void 0 ? void 0 : JSON.stringify(body)
@@ -675,13 +676,13 @@ var QoreApiClient = class {
       throw fetchError(e, new URL(this.o.apiOrigin).host);
     }
     const rid = res.headers.get("x-request-id");
-    this.o.onRequest?.(`${method} ${path} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
+    this.o.onRequest?.(`${method} ${path2} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
     return res;
   }
-  async request(method, path, body, parse2 = (r) => r.json()) {
-    let res = await this.once(method, path, body, false);
+  async request(method, path2, body, parse2 = (r) => r.json()) {
+    let res = await this.once(method, path2, body, false);
     if (res.status === 401) {
-      res = await this.once(method, path, body, true);
+      res = await this.once(method, path2, body, true);
       if (res.status === 401) {
         const skew = clockSkewSeconds(res.headers.get("date"), (this.o.now ?? (() => /* @__PURE__ */ new Date()))());
         if (skew !== null && Math.abs(skew) > 60) {
@@ -702,14 +703,14 @@ var QoreApiClient = class {
     if (!res.ok) throw await problemToError(res);
     return parse2(res);
   }
-  get(path) {
-    return this.request("GET", path);
+  get(path2) {
+    return this.request("GET", path2);
   }
-  getText(path) {
-    return this.request("GET", path, void 0, (r) => r.text());
+  getText(path2) {
+    return this.request("GET", path2, void 0, (r) => r.text());
   }
-  post(path, body) {
-    return this.request("POST", path, body);
+  post(path2, body) {
+    return this.request("POST", path2, body);
   }
 };
 
@@ -930,23 +931,23 @@ var ResolutionCache = class {
   fresh(e) {
     return !!e && this.now().getTime() - new Date(e.resolvedAt).getTime() < TTL_MS2;
   }
-  async get(origin, key) {
-    const e = (await this.load()).entries[`${origin}|${key}`];
+  async get(origin, key2) {
+    const e = (await this.load()).entries[`${origin}|${key2}`];
     return this.fresh(e) ? e.moduleId : null;
   }
   /** Never throws: a read-only config dir, a full disk or a Windows EPERM on rename
    * (another qore holding the file) must not fail a command that already resolved. */
-  async put(origin, key, moduleId) {
+  async put(origin, key2, moduleId) {
     const f = await this.load();
-    f.entries[`${origin}|${key}`] = { moduleId, resolvedAt: this.now().toISOString() };
+    f.entries[`${origin}|${key2}`] = { moduleId, resolvedAt: this.now().toISOString() };
     for (const [k, e] of Object.entries(f.entries)) if (!this.fresh(e)) delete f.entries[k];
     await this.save(f);
   }
   /** Never throws, like `put`. */
-  async drop(origin, key) {
+  async drop(origin, key2) {
     const f = await this.load();
-    if (!(`${origin}|${key}` in f.entries)) return;
-    delete f.entries[`${origin}|${key}`];
+    if (!(`${origin}|${key2}` in f.entries)) return;
+    delete f.entries[`${origin}|${key2}`];
     await this.save(f);
   }
   async save(f) {
@@ -959,8 +960,8 @@ var ResolutionCache = class {
     const f = await this.load();
     const hits = [];
     for (const [k, e] of Object.entries(f.entries)) {
-      const sep3 = k.lastIndexOf("|");
-      if (keys.includes(k.slice(sep3 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep3), at: new Date(e.resolvedAt).getTime() });
+      const sep4 = k.lastIndexOf("|");
+      if (keys.includes(k.slice(sep4 + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep4), at: new Date(e.resolvedAt).getTime() });
     }
     hits.sort((a, b) => b.at - a.at);
     return [...new Set(hits.map((h) => h.origin))];
@@ -977,7 +978,7 @@ function repoKey(url) {
   if (raw.startsWith("git+")) raw = raw.slice(4);
   if (!raw || raw.includes("\\")) return null;
   let host;
-  let path;
+  let path2;
   if (raw.includes("://")) {
     if (hasDotSegment(raw.slice(raw.indexOf("://") + 3).split("/").slice(1))) return null;
     let u;
@@ -988,14 +989,14 @@ function repoKey(url) {
     }
     if (!SCHEMES.has(u.protocol.toLowerCase())) return null;
     host = u.hostname;
-    path = u.pathname;
+    path2 = u.pathname;
   } else {
     const m = SCP.exec(raw);
     if (!m) return null;
     host = m[1];
-    path = m[2];
+    path2 = m[2];
   }
-  const segments = path.split("/").filter(Boolean);
+  const segments = path2.split("/").filter(Boolean);
   if (!host || segments.length !== 2 || hasDotSegment(segments)) return null;
   const owner = segments[0];
   let repo = segments[1];
@@ -1023,12 +1024,12 @@ async function isTrusted(deps2, root, moduleId) {
   return (cfg.trustedRepos?.[await keyOf(deps2, root)] ?? []).includes(moduleId);
 }
 async function trust(deps2, root, moduleId) {
-  const key = await keyOf(deps2, root);
+  const key2 = await keyOf(deps2, root);
   await deps2.config.update((c) => {
     const repos = c.trustedRepos ??= {};
-    const list = new Set(repos[key] ?? []);
+    const list = new Set(repos[key2] ?? []);
     list.add(moduleId);
-    repos[key] = [...list];
+    repos[key2] = [...list];
   });
 }
 
@@ -1189,8 +1190,8 @@ async function applyActions(deps2, o) {
           const r = await deps2.git.clone(url, action.dir);
           if (r.ok) {
             await trust(deps2, action.dir, action.module.id);
-            const key = repoKey(action.module.repoUrl);
-            if (key) await cache.put(o.portal.apiOrigin, key, action.module.id);
+            const key2 = repoKey(action.module.repoUrl);
+            if (key2) await cache.put(o.portal.apiOrigin, key2, action.module.id);
             result = { slug: action.module.slug, status: "cloned", dir: action.dir };
           } else {
             const err = classifyCloneFailure(r.stderr, action.module, o.app, o.protocol);
@@ -1358,10 +1359,10 @@ async function scanRoot(root) {
   const out = [];
   for (const tenant of (await subdirs(root)).sort()) {
     for (const app of (await subdirs(join6(root, tenant))).sort()) {
-      const path = join6(root, tenant, app);
+      const path2 = join6(root, tenant, app);
       try {
-        const ws = await readWorkspace(path);
-        if (ws) out.push({ kind: "workspace", path, portal: ws.portal, tenantSlug: tenant, appId: ws.appId, appSlug: app });
+        const ws = await readWorkspace(path2);
+        if (ws) out.push({ kind: "workspace", path: path2, portal: ws.portal, tenantSlug: tenant, appId: ws.appId, appSlug: app });
       } catch {
       }
     }
@@ -1435,12 +1436,12 @@ function expandPath(deps2, input2) {
 }
 function trimSeparator(p) {
   const root = parse(p).root;
-  let end = p.length;
-  while (end > root.length && (p[end - 1] === "/" || p[end - 1] === "\\")) end--;
-  return p.slice(0, end);
+  let end2 = p.length;
+  while (end2 > root.length && (p[end2 - 1] === "/" || p[end2 - 1] === "\\")) end2--;
+  return p.slice(0, end2);
 }
-async function underAFile(path) {
-  for (let p = dirname3(path); ; p = dirname3(p)) {
+async function underAFile(path2) {
+  for (let p = dirname3(path2); ; p = dirname3(p)) {
     const s = await stat2(p).catch((e) => e.code === "ENOENT" ? void 0 : null);
     if (s === null) return false;
     if (s) return !s.isDirectory();
@@ -1455,8 +1456,8 @@ function scannedBy(root, e) {
   if (e.kind !== "workspace" || !isInside(root, e.path)) return false;
   return relative2(root, e.path).split(sep).filter(Boolean).length === 2;
 }
-async function writableError(path) {
-  const probe = join8(path, `.qore-write-test-${randomBytes3(6).toString("hex")}`);
+async function writableError(path2) {
+  const probe = join8(path2, `.qore-write-test-${randomBytes3(6).toString("hex")}`);
   try {
     await writeFile3(probe, "");
     await rm2(probe, { force: true });
@@ -1465,42 +1466,42 @@ async function writableError(path) {
     return e;
   }
 }
-var invalid2 = (path, why) => new QoreError("QORE_ROOT_INVALID", `${path} cannot be the projects root: ${why}`, { hint: "Pick another folder: qore init --root <path>." });
-var notWritable = (path, e) => new QoreError("QORE_ROOT_NOT_WRITABLE", `${path} is not writable (${e.code ?? e.message})`, {
+var invalid2 = (path2, why) => new QoreError("QORE_ROOT_INVALID", `${path2} cannot be the projects root: ${why}`, { hint: "Pick another folder: qore init --root <path>." });
+var notWritable = (path2, e) => new QoreError("QORE_ROOT_NOT_WRITABLE", `${path2} is not writable (${e.code ?? e.message})`, {
   hint: "Fix its permissions, or pick another folder: qore init --root <path>.",
   cause: e
 });
 async function checkRoot(deps2, input2) {
-  const path = expandPath(deps2, input2);
-  if (dirname3(path) === path) throw invalid2(path, "it is the filesystem root");
+  const path2 = expandPath(deps2, input2);
+  if (dirname3(path2) === path2) throw invalid2(path2, "it is the filesystem root");
   try {
-    if (!(await stat2(path)).isDirectory()) throw invalid2(path, "it is a file");
+    if (!(await stat2(path2)).isDirectory()) throw invalid2(path2, "it is a file");
   } catch (e) {
     if (e instanceof QoreError) throw e;
     const err = e;
-    if (err.code === "ENOTDIR") throw invalid2(path, "a parent of it is a file");
-    if (NOT_WRITABLE.has(err.code ?? "")) throw notWritable(path, err);
+    if (err.code === "ENOTDIR") throw invalid2(path2, "a parent of it is a file");
+    if (NOT_WRITABLE.has(err.code ?? "")) throw notWritable(path2, err);
     if (err.code !== "ENOENT") throw e;
-    if (await underAFile(path)) throw invalid2(path, "a parent of it is a file");
+    if (await underAFile(path2)) throw invalid2(path2, "a parent of it is a file");
   }
-  const repo = await findRepoRoot(path);
-  if (await findWorkspace(path, deps2.home) || repo && !isInside(repo, deps2.home)) {
-    throw invalid2(path, "it lies inside a project (an app workspace or a git repository)");
+  const repo = await findRepoRoot(path2);
+  if (await findWorkspace(path2, deps2.home) || repo && !isInside(repo, deps2.home)) {
+    throw invalid2(path2, "it lies inside a project (an app workspace or a git repository)");
   }
-  return path;
+  return path2;
 }
-async function createRoot(path) {
+async function createRoot(path2) {
   try {
-    await mkdir3(path, { recursive: true });
+    await mkdir3(path2, { recursive: true });
   } catch (e) {
     const err2 = e;
-    if (NOT_WRITABLE.has(err2.code ?? "")) throw notWritable(path, err2);
-    if (err2.code === "ENOTDIR" || err2.code === "EEXIST") throw invalid2(path, "a parent of it is a file");
+    if (NOT_WRITABLE.has(err2.code ?? "")) throw notWritable(path2, err2);
+    if (err2.code === "ENOTDIR" || err2.code === "EEXIST") throw invalid2(path2, "a parent of it is a file");
     throw e;
   }
-  const err = await writableError(path);
-  if (err) throw notWritable(path, err);
-  return realpath3(path);
+  const err = await writableError(path2);
+  if (err) throw notWritable(path2, err);
+  return realpath3(path2);
 }
 async function validateRoot(deps2, input2) {
   return createRoot(await checkRoot(deps2, input2));
@@ -1518,15 +1519,15 @@ async function quietly(fn) {
 }
 async function remember(deps2, e) {
   await quietly(async () => {
-    const path = await realpath4(e.path);
-    const entry = { ...e, path };
+    const path2 = await realpath4(e.path);
+    const entry = { ...e, path: path2 };
     const cfg = await deps2.config.read();
     const root = cfg.projectsRoot ? await realpath4(cfg.projectsRoot).catch(() => cfg.projectsRoot) : void 0;
     if (root && scannedBy(root, entry)) return;
-    const current = cfg.projects?.find((p) => p.path === path);
+    const current = cfg.projects?.find((p) => p.path === path2);
     if (current && same(current, entry)) return;
     await deps2.withLock(LOCK, () => deps2.config.update((c) => {
-      c.projects = [...(c.projects ?? []).filter((p) => p.path !== path), entry];
+      c.projects = [...(c.projects ?? []).filter((p) => p.path !== path2), entry];
     }).then(() => void 0));
   });
 }
@@ -1824,12 +1825,12 @@ function registerConfig(program, ctx) {
     io2.out(describeConsent(consent, built));
     if (state && consent.source !== "config") io2.err(`${consent.source} in your environment overrides this setting.`);
   });
-  config.command("root").description("Show or set the projects folder qore clones into (see qore init)").argument("[path]", "the new projects folder").option("--unset", "clear it; projects already there stay findable").action(async (path, f) => {
+  config.command("root").description("Show or set the projects folder qore clones into (see qore init)").argument("[path]", "the new projects folder").option("--unset", "clear it; projects already there stay findable").action(async (path2, f) => {
     const { deps: deps2, io: io2 } = ctx;
-    if (path !== void 0 && f.unset) {
+    if (path2 !== void 0 && f.unset) {
       throw new QoreError("QORE_CONTEXT_INVALID", "Pass a path or --unset, not both", { hint: "qore config root <path> | qore config root --unset" });
     }
-    if (path !== void 0) await setRoot(deps2, await validateRoot(deps2, path));
+    if (path2 !== void 0) await setRoot(deps2, await validateRoot(deps2, path2));
     if (f.unset) await setRoot(deps2, void 0);
     const d = await describeRoot(deps2);
     if (ctx.opts().json) {
@@ -1841,82 +1842,13 @@ function registerConfig(program, ctx) {
   });
 }
 
-// src/cli/commands/dev.ts
-import { randomBytes as randomBytes6 } from "crypto";
-import { realpath as realpath8 } from "fs/promises";
-import { constants as constants3 } from "os";
-import { dirname as dirname7, join as join21, relative as relative7 } from "path";
-import { StringDecoder } from "string_decoder";
-
-// src/core/context/repoConfig.ts
-import { readFile as readFile3 } from "fs/promises";
-import { join as join10 } from "path";
-var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
-var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var SCRIPT = /^[A-Za-z0-9:_.-]+$/;
-var invalid3 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
-function moduleDefaults(type) {
-  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
-}
-async function readRepoConfig(root) {
-  let raw;
-  try {
-    raw = await readFile3(join10(root, ".qore.json"), "utf8");
-  } catch (e) {
-    if (e.code === "ENOENT") return {};
-    throw e;
-  }
-  let doc;
-  try {
-    doc = JSON.parse(raw);
-  } catch {
-    throw invalid3("not valid JSON");
-  }
-  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid3("must be an object");
-  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
-  if (!Number.isInteger(v) || v < 1) throw invalid3("schemaVersion must be a positive integer");
-  if (v > 1) {
-    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
-  }
-  for (const f of FORBIDDEN) if (f in doc) throw invalid3(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
-  const out = {};
-  if (doc.envFile !== void 0) {
-    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid3("envFile must be a non-empty string");
-    out.envFile = doc.envFile;
-  }
-  if (doc.localSecrets !== void 0) {
-    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
-      throw invalid3("localSecrets must be a list of env key names");
-    }
-    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid3("localSecrets must not contain duplicates");
-    out.localSecrets = doc.localSecrets;
-  }
-  if (doc.dev !== void 0) {
-    const d = doc.dev;
-    if (!d || typeof d !== "object" || Array.isArray(d)) throw invalid3("dev must be an object");
-    const dev = {};
-    if (d.install !== void 0) {
-      if (typeof d.install !== "boolean") throw invalid3("dev.install must be true or false");
-      dev.install = d.install;
-    }
-    if (d.services !== void 0) {
-      if (!Array.isArray(d.services) || !d.services.every((s) => typeof s === "string" && SCRIPT.test(s))) {
-        throw invalid3("dev.services must be a list of script names");
-      }
-      if (new Set(d.services).size !== d.services.length) throw invalid3("dev.services must not contain duplicates");
-      dev.services = d.services;
-    }
-    if (d.script !== void 0) {
-      if (typeof d.script !== "string" || !SCRIPT.test(d.script)) throw invalid3("dev.script must be a script name");
-      dev.script = d.script;
-    }
-    out.dev = dev;
-  }
-  return out;
-}
+// src/cli/commands/db.ts
+import { stat as stat4 } from "fs/promises";
+import { basename as basename3, join as join15 } from "path";
+import { InvalidArgumentError } from "commander";
 
 // src/core/context/resolver.ts
-import { isAbsolute as isAbsolute2, join as join11, relative as relative4 } from "path";
+import { isAbsolute as isAbsolute2, join as join10, relative as relative4 } from "path";
 var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HINT_FLAG = "cd into a module repository, or pass --module <slug|id>.";
 var RESOLVE = "/api/cli/v1/repos/resolve";
@@ -1954,10 +1886,10 @@ async function flagOverrides(deps2, session, portal, cache, moduleId) {
     const keyed = (await repoRemotes(deps2))?.keyed ?? [];
     const derived = /* @__PURE__ */ new Map();
     const uncached = [];
-    for (const key of new Set(keyed.map((r) => r.key))) {
-      const id = await cache.get(portal.apiOrigin, key);
-      if (id) derived.set(key, /* @__PURE__ */ new Set([id]));
-      else uncached.push(key);
+    for (const key2 of new Set(keyed.map((r) => r.key))) {
+      const id = await cache.get(portal.apiOrigin, key2);
+      if (id) derived.set(key2, /* @__PURE__ */ new Set([id]));
+      else uncached.push(key2);
     }
     if (uncached.length > 0) {
       try {
@@ -2130,7 +2062,7 @@ async function anyLoggedIn(deps2, cfg) {
 }
 var isForeignRepo = (e) => e instanceof QoreError && e.code === "QORE_CONTEXT_REQUIRED" && e.details?.foreignRepo === true;
 async function resolveModuleContext(deps2, o) {
-  const cache = new ResolutionCache(join11(deps2.config.dir, "cache"), deps2.now);
+  const cache = new ResolutionCache(join10(deps2.config.dir, "cache"), deps2.now);
   const ws = await findWorkspace(deps2.cwd, deps2.home);
   if (o.module) return byFlag(deps2, o, cache, ws);
   const cfg = await deps2.config.read();
@@ -2207,82 +2139,356 @@ function pickApp2(mc, app) {
   throw new QoreError("QORE_APP_AMBIGUOUS", `${mc.module.slug} is part of several apps`, { hint: "Pass --app <slug>.", candidates: appCandidates(apps) });
 }
 
-// src/core/diagnostics/node.ts
-var KEEP_LINES = 50;
-function exitHint(tail, h) {
-  const text2 = tail.join("\n");
-  const missing = text2.match(/Cannot find (?:module|package) '([^']+)'/);
-  if (missing) {
-    return { reason: "missing-module", hint: `A dependency is missing (${missing[1]}). Run \`${h.installCommand}\`, then qore dev again.` };
+// src/core/erd/dbErrors.ts
+function dbPort(url) {
+  try {
+    const u = new URL(url);
+    return u.port ? Number(u.port) : 5432;
+  } catch {
+    return null;
   }
-  if (/ZodError:/.test(text2)) {
-    const keys = [...text2.matchAll(/"path":\s*\[\s*"([^"]+)"/g)].map((m) => m[1]);
-    if (keys.length > 0) {
-      return {
-        reason: "invalid-env",
-        keys,
-        hint: `Missing or invalid environment variables: ${keys.join(", ")}. Set them in the portal's local secrets (then qore env pull), or in your env file.`
-      };
-    }
+}
+function connectionOf(url) {
+  try {
+    const u = new URL(url);
+    return { host: u.hostname, port: u.port ? Number(u.port) : 5432, database: decodeURIComponent(u.pathname.replace(/^\//, "")) };
+  } catch {
+    return { host: "", port: 0, database: "" };
   }
-  const addrInUse = text2.match(/listen EADDRINUSE: address already in use (?:\S*:)?(\d+)/);
-  if (addrInUse) {
-    const port = Number(addrInUse[1]);
-    return {
-      reason: "port-in-use",
-      port,
-      hint: `Port ${port} was taken while the server started. Run qore dev again; if it repeats, lsof -iTCP:${port} -sTCP:LISTEN names the holder.`
-    };
+}
+function classifyDbError(e, url) {
+  const { code, message } = e;
+  const port = dbPort(url);
+  const where = port === null ? "The database" : `The database on :${port}`;
+  if (code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "ETIMEDOUT" || /timeout expired/i.test(message ?? "")) {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", `${where} is not accepting connections`, {
+      hint: "Start it with `qore dev` (or `pnpm db:up`), then run qore db erd again.",
+      details: { reason: "conn-refused", port }
+    });
   }
-  if (/ECONNREFUSED/.test(text2)) {
-    const m = text2.match(/ECONNREFUSED\s+\S*:(\d+)/) ?? text2.match(/code: 'ECONNREFUSED'[^}]*?port: (\d+)/);
-    if (!m) return { reason: "conn-refused", hint: "A connection was refused (ECONNREFUSED) \u2014 a service this module calls is not running." };
-    const port = Number(m[1]);
-    const role = h.ports.get(port);
-    if (role?.kind === "database") {
-      const up = h.runCommand("db:up");
-      return {
-        reason: "conn-refused",
-        port,
-        hint: `The database on :${port} is not accepting connections (ECONNREFUSED). ` + (up ? `Fix: ${up}  (docker compose ps shows its state)` : "docker compose ps shows its state.")
-      };
+  if (code === "28P01" || code === "28000") {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", `${where} rejected the credentials in DATABASE_URL`, {
+      hint: "The local database was created with other credentials than the portal now provides. `pnpm db:reset` recreates it \u2014 this deletes local data.",
+      details: { reason: "db-auth", port }
+    });
+  }
+  if (code === "3D000") {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", "The database named in DATABASE_URL does not exist", {
+      hint: "Start the app once with `qore dev` so its migrations create it, or run `pnpm db:reset`.",
+      details: { reason: "db-schema", port }
+    });
+  }
+  return new QoreError("QORE_SERVICE_UNHEALTHY", `Could not read the database: ${message ?? String(e)}`, {
+    hint: "Check DATABASE_URL in the env file, then run qore db erd again.",
+    details: { port }
+  });
+}
+
+// src/core/erd/app.ts
+function orderModules(modules) {
+  const bySlug = new Map(modules.map((m) => [m.slug, m]));
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (m, trail) => {
+    if (seen.has(m.slug) || trail.has(m.slug)) return;
+    trail.add(m.slug);
+    for (const dep of m.dependsOn) {
+      const d = bySlug.get(dep);
+      if (d) visit(d, trail);
     }
-    if (role?.kind === "provider") {
-      return {
-        reason: "conn-refused",
-        port,
-        hint: `${role.key} points at :${port}, where nothing listens (ECONNREFUSED). Start that module \u2014 qore dev in the workspace root starts providers first.`
-      };
+    seen.add(m.slug);
+    out.push(m);
+  };
+  for (const m of modules) visit(m, /* @__PURE__ */ new Set());
+  return out;
+}
+function groupDatabases(modules) {
+  const groups = [];
+  for (const m of modules) {
+    if (!m.url) continue;
+    const c = connectionOf(m.url);
+    const same2 = groups.find((g) => g.connection.host === c.host && g.connection.port === c.port && g.connection.database === c.database);
+    if (same2) {
+      same2.modules.push(m.slug);
+      continue;
     }
-    return { reason: "conn-refused", port, hint: `Nothing listens on :${port} (ECONNREFUSED) \u2014 a service this module calls is not running.` };
+    groups.push({ key: m.slug, modules: [m.slug], url: m.url, connection: c });
   }
-  const auth = text2.match(/password authentication failed for user "([^"]+)"/);
-  if (auth) {
-    const reset = h.runCommand("db:reset");
-    return {
-      reason: "db-auth",
-      hint: `The local database was created with other credentials than the portal now provides (user ${auth[1]}).` + (reset ? ` Fix: ${reset} \u2014 this wipes local data.` : "")
-    };
+  return groups;
+}
+var REF = /(?:^|\s)->\s*(?:([A-Za-z0-9_-]+):)?([A-Za-z_][\w]*)\.([A-Za-z_][\w]*)\.([A-Za-z_][\w]*)/;
+function parseRef(comment) {
+  const m = comment ? REF.exec(comment) : null;
+  return m ? { module: m[1] ?? null, schema: m[2], table: m[3], column: m[4] } : null;
+}
+function findEnd(dbs, ref, from) {
+  const has = (d) => d.model?.tables.some((t) => t.schema === ref.schema && t.name === ref.table && t.columns.some((c) => c.name === ref.column)) ?? false;
+  const candidates = ref.module ? dbs.filter((d) => d.modules.includes(ref.module)) : [...dbs.filter((d) => d.key !== from), ...dbs.filter((d) => d.key === from)];
+  const hit2 = candidates.find(has);
+  return hit2 ? { database: hit2.key, schema: ref.schema, table: ref.table, column: ref.column } : null;
+}
+function resolveRefs(dbs) {
+  const refs = [];
+  for (const d of dbs) for (const t of d.model?.tables ?? []) for (const c of t.columns) {
+    const ref = parseRef(c.comment);
+    const to = ref && findEnd(dbs, ref, d.key);
+    if (to) refs.push({ from: { database: d.key, schema: t.schema, table: t.name, column: c.name }, to });
   }
-  const relation = text2.match(/relation "([^"]+)" does not exist/);
-  if (relation) {
-    const reset = h.runCommand("db:reset");
-    return {
-      reason: "db-schema",
-      hint: `The database schema is behind the code (relation ${relation[1]} does not exist). Migrations run when the app starts; if they failed above, that error is the cause.` + (reset ? ` To start clean: ${reset} (wipes local data).` : "")
-    };
+  return refs;
+}
+function combineModels(dbs) {
+  return {
+    tables: dbs.flatMap((d) => (d.model?.tables ?? []).map((t) => ({ ...t, database: d.key }))),
+    enums: dbs.flatMap((d) => (d.model?.enums ?? []).map((e) => ({ ...e, database: d.key }))),
+    databases: dbs.map((d) => ({
+      key: d.key,
+      modules: d.modules,
+      connection: d.connection,
+      ...d.error ? { error: d.error } : {},
+      ...d.migrations ? { migrations: d.migrations } : {}
+    })),
+    refs: resolveRefs(dbs)
+  };
+}
+
+// src/core/erd/introspect.ts
+var USER_SCHEMAS = `n.nspname not in ('pg_catalog', 'information_schema') and n.nspname not like 'pg_toast%' and n.nspname not like 'pg_temp%'`;
+var TABLE_KIND = `c.relkind in ('r', 'p') and not c.relispartition`;
+var TABLES = `
+select n.nspname as schema, c.relname as name, obj_description(c.oid, 'pg_class') as comment
+from pg_class c join pg_namespace n on n.oid = c.relnamespace
+where ${TABLE_KIND} and ${USER_SCHEMAS}
+order by 1, 2`;
+var COLUMNS = `
+select n.nspname as schema, c.relname as table, a.attname as name,
+       format_type(a.atttypid, a.atttypmod) as type, a.attnotnull as not_null,
+       pg_get_expr(d.adbin, d.adrelid) as "default", col_description(c.oid, a.attnum) as comment
+from pg_attribute a
+join pg_class c on c.oid = a.attrelid
+join pg_namespace n on n.oid = c.relnamespace
+left join pg_attrdef d on d.adrelid = a.attrelid and d.adnum = a.attnum
+where ${TABLE_KIND} and a.attnum > 0 and not a.attisdropped and ${USER_SCHEMAS}
+order by n.nspname, c.relname, a.attnum`;
+var CONSTRAINTS = `
+select n.nspname as schema, c.relname as table, con.conname as name, con.contype::text as type,
+       (select array_agg(a.attname::text order by k.ord)
+          from unnest(con.conkey) with ordinality as k(attnum, ord)
+          join pg_attribute a on a.attrelid = con.conrelid and a.attnum = k.attnum) as columns,
+       fn.nspname as target_schema, fc.relname as target_table,
+       (select array_agg(a.attname::text order by k.ord)
+          from unnest(con.confkey) with ordinality as k(attnum, ord)
+          join pg_attribute a on a.attrelid = con.confrelid and a.attnum = k.attnum) as target_columns,
+       con.confupdtype::text as on_update, con.confdeltype::text as on_delete,
+       pg_get_constraintdef(con.oid) as definition
+from pg_constraint con
+join pg_class c on c.oid = con.conrelid
+join pg_namespace n on n.oid = c.relnamespace
+left join pg_class fc on fc.oid = con.confrelid
+left join pg_namespace fn on fn.oid = fc.relnamespace
+where con.contype in ('p', 'u', 'f', 'c') and not c.relispartition and ${USER_SCHEMAS}
+order by n.nspname, c.relname, con.conname`;
+var INDEXES = `
+select n.nspname as schema, c.relname as table, ic.relname as name, i.indisunique as "unique", am.amname as method,
+       (select array_agg(pg_get_indexdef(i.indexrelid, k.n, true) order by k.n)
+          from generate_series(1, i.indnkeyatts) as k(n)) as columns
+from pg_index i
+join pg_class c on c.oid = i.indrelid
+join pg_class ic on ic.oid = i.indexrelid
+join pg_namespace n on n.oid = c.relnamespace
+join pg_am am on am.oid = ic.relam
+where ${TABLE_KIND} and not i.indisprimary
+  and not exists (select 1 from pg_constraint x where x.conindid = i.indexrelid and x.contype in ('p', 'u'))
+  and ${USER_SCHEMAS}
+order by n.nspname, c.relname, ic.relname`;
+var ENUMS = `
+select n.nspname as schema, t.typname as name, array_agg(e.enumlabel::text order by e.enumsortorder) as "values"
+from pg_type t
+join pg_namespace n on n.oid = t.typnamespace
+join pg_enum e on e.enumtypid = t.oid
+where t.typtype = 'e' and ${USER_SCHEMAS}
+group by 1, 2 order by 1, 2`;
+var FK_ACTION = { a: "NO_ACTION", r: "RESTRICT", c: "CASCADE", n: "SET_NULL", d: "SET_DEFAULT" };
+var str = (v) => String(v);
+var strOrNull = (v) => v === null || v === void 0 ? null : String(v);
+function strArray(v) {
+  if (Array.isArray(v)) return v.map(str);
+  if (typeof v === "string" && v.startsWith("{") && v.endsWith("}")) {
+    return v.length === 2 ? [] : v.slice(1, -1).split(",").map((s) => s.replace(/^"|"$/g, ""));
   }
-  if (/ENOSPC: System limit for number of file watchers reached/.test(text2)) {
-    return {
-      reason: "watcher-limit",
-      hint: "Linux ran out of file watchers. Raise the limit: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p"
+  return [];
+}
+var key = (r) => `${str(r.schema)}.${str(r.table)}`;
+var checkExpression = (definition) => definition.replace(/^CHECK \((.*)\)$/s, "$1");
+async function introspect(query) {
+  const rows = [];
+  for (const sql of [TABLES, COLUMNS, CONSTRAINTS, INDEXES, ENUMS]) rows.push((await query(sql)).rows);
+  const [tables, columns, constraints, indexes, enums] = rows;
+  const byKey = /* @__PURE__ */ new Map();
+  for (const r of tables) {
+    const t = {
+      schema: str(r.schema),
+      name: str(r.name),
+      comment: strOrNull(r.comment),
+      columns: [],
+      primaryKey: null,
+      uniques: [],
+      foreignKeys: [],
+      checks: [],
+      indexes: []
     };
+    byKey.set(`${t.schema}.${t.name}`, t);
+  }
+  for (const r of columns) {
+    byKey.get(key(r))?.columns.push({
+      name: str(r.name),
+      type: str(r.type),
+      notNull: Boolean(r.not_null),
+      default: strOrNull(r.default),
+      comment: strOrNull(r.comment)
+    });
   }
-  return null;
+  for (const r of constraints) {
+    const t = byKey.get(key(r));
+    if (!t) continue;
+    const name = str(r.name);
+    const cols = strArray(r.columns);
+    switch (str(r.type)) {
+      case "p":
+        t.primaryKey = { name, columns: cols };
+        break;
+      case "u":
+        t.uniques.push({ name, columns: cols });
+        break;
+      case "c":
+        t.checks.push({ name, expression: checkExpression(str(r.definition)) });
+        break;
+      case "f":
+        t.foreignKeys.push({
+          name,
+          columns: cols,
+          targetSchema: str(r.target_schema),
+          targetTable: str(r.target_table),
+          targetColumns: strArray(r.target_columns),
+          onUpdate: FK_ACTION[str(r.on_update)] ?? "NO_ACTION",
+          onDelete: FK_ACTION[str(r.on_delete)] ?? "NO_ACTION"
+        });
+        break;
+    }
+  }
+  for (const r of indexes) {
+    byKey.get(key(r))?.indexes.push({ name: str(r.name), unique: Boolean(r.unique), columns: strArray(r.columns), method: str(r.method) });
+  }
+  return {
+    tables: [...byKey.values()],
+    enums: enums.map((r) => ({ schema: str(r.schema), name: str(r.name), values: strArray(r.values) }))
+  };
 }
 
-// src/core/dev/env.ts
-import { dirname as dirname6, join as join14 } from "path";
+// src/core/erd/migrations.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join11 } from "path";
+var JOURNAL = join11("src", "db", "migrations", "meta", "_journal.json");
+async function readJournal(repoRoot) {
+  let text2;
+  try {
+    text2 = await readFile3(join11(repoRoot, JOURNAL), "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    return JSON.parse(text2).entries ?? [];
+  } catch {
+    return null;
+  }
+}
+async function appliedMigrations(query) {
+  const { rows: [ledger] } = await query(`select to_regclass('drizzle.__drizzle_migrations') is not null as present`);
+  if (!ledger?.present) return [];
+  const { rows } = await query(`select created_at::text as at from drizzle.__drizzle_migrations`);
+  return rows.map((r) => Number(r.at));
+}
+function compareMigrations(journal, applied) {
+  const latest = applied.reduce((a, b) => Math.max(a, b), 0);
+  const done = new Set(applied);
+  const known = new Set(journal.map((e) => e.when));
+  const missing = journal.filter((e) => !done.has(e.when));
+  return {
+    pending: missing.filter((e) => e.when > latest).map((e) => e.tag),
+    skipped: missing.filter((e) => e.when <= latest).map((e) => e.tag),
+    unknown: applied.filter((a) => !known.has(a)).length
+  };
+}
+async function checkMigrations(repoRoot, query) {
+  const journal = repoRoot ? await readJournal(repoRoot) : null;
+  return journal ? compareMigrations(journal, await appliedMigrations(query)) : void 0;
+}
+
+// src/core/context/repoConfig.ts
+import { readFile as readFile4 } from "fs/promises";
+import { join as join12 } from "path";
+var FORBIDDEN = ["portal", "api", "apiOrigin", "issuer", "tenant", "tenantId", "app", "appId", "module", "moduleId"];
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var SCRIPT = /^[A-Za-z0-9:_.-]+$/;
+var invalid3 = (msg, details) => new QoreError("QORE_CONTEXT_INVALID", `.qore.json: ${msg}`, { hint: "Fix .qore.json in the repository root; see the $schema it names.", details });
+function moduleDefaults(type) {
+  return type === "frontend" ? { envFile: ".env.local", localSecrets: ["SESSION_COOKIE_SECRET"] } : { envFile: ".env", localSecrets: [] };
+}
+async function readRepoConfig(root) {
+  let raw;
+  try {
+    raw = await readFile4(join12(root, ".qore.json"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return {};
+    throw e;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    throw invalid3("not valid JSON");
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) throw invalid3("must be an object");
+  const v = doc.schemaVersion === void 0 ? 1 : doc.schemaVersion;
+  if (!Number.isInteger(v) || v < 1) throw invalid3("schemaVersion must be a positive integer");
+  if (v > 1) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: "Run: npm i -g @quatronic/qore" });
+  }
+  for (const f of FORBIDDEN) if (f in doc) throw invalid3(`"${f}" is not allowed \u2014 .qore.json never selects a portal or a resource`, { field: f });
+  const out = {};
+  if (doc.envFile !== void 0) {
+    if (typeof doc.envFile !== "string" || !doc.envFile) throw invalid3("envFile must be a non-empty string");
+    out.envFile = doc.envFile;
+  }
+  if (doc.localSecrets !== void 0) {
+    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === "string" && KEY.test(k))) {
+      throw invalid3("localSecrets must be a list of env key names");
+    }
+    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid3("localSecrets must not contain duplicates");
+    out.localSecrets = doc.localSecrets;
+  }
+  if (doc.dev !== void 0) {
+    const d = doc.dev;
+    if (!d || typeof d !== "object" || Array.isArray(d)) throw invalid3("dev must be an object");
+    const dev = {};
+    if (d.install !== void 0) {
+      if (typeof d.install !== "boolean") throw invalid3("dev.install must be true or false");
+      dev.install = d.install;
+    }
+    if (d.services !== void 0) {
+      if (!Array.isArray(d.services) || !d.services.every((s) => typeof s === "string" && SCRIPT.test(s))) {
+        throw invalid3("dev.services must be a list of script names");
+      }
+      if (new Set(d.services).size !== d.services.length) throw invalid3("dev.services must not contain duplicates");
+      dev.services = d.services;
+    }
+    if (d.script !== void 0) {
+      if (typeof d.script !== "string" || !SCRIPT.test(d.script)) throw invalid3("dev.script must be a script name");
+      dev.script = d.script;
+    }
+    out.dev = dev;
+  }
+  return out;
+}
 
 // src/core/env/fetch.ts
 async function fetchLocalEnv(deps2, mc, app) {
@@ -2316,11 +2522,11 @@ function parseEnv(contents) {
   }
   return map;
 }
-function isManagedKey(key, managed) {
+function isManagedKey(key2, managed) {
   for (const pattern of managed) {
     if (pattern.endsWith("*")) {
-      if (key.startsWith(pattern.slice(0, -1))) return true;
-    } else if (key === pattern) return true;
+      if (key2.startsWith(pattern.slice(0, -1))) return true;
+    } else if (key2 === pattern) return true;
   }
   return false;
 }
@@ -2336,27 +2542,27 @@ function planEnvUpdate({
   const added = [];
   const unchanged = [];
   const overwritten = [];
-  for (const [key, portalValue] of Object.entries(fetched)) {
-    const hasLocal = current.has(key);
-    const localValue = current.get(key);
+  for (const [key2, portalValue] of Object.entries(fetched)) {
+    const hasLocal = current.has(key2);
+    const localValue = current.get(key2);
     const localEmpty = !hasLocal || localValue === "" || localValue === '""' || localValue === "''";
     if (localEmpty) {
-      merged.set(key, portalValue);
-      added.push(key);
+      merged.set(key2, portalValue);
+      added.push(key2);
       continue;
     }
     if (localValue === portalValue) {
-      unchanged.push(key);
+      unchanged.push(key2);
       continue;
     }
-    if (isManagedKey(key, managed)) {
-      merged.set(key, portalValue);
-      overwritten.push(key);
+    if (isManagedKey(key2, managed)) {
+      merged.set(key2, portalValue);
+      overwritten.push(key2);
       continue;
     }
-    conflicts.push(key);
-    const choice = choices[key] ?? defaultChoice;
-    merged.set(key, choice === "use-portal" ? portalValue : localValue);
+    conflicts.push(key2);
+    const choice = choices[key2] ?? defaultChoice;
+    merged.set(key2, choice === "use-portal" ? portalValue : localValue);
   }
   return { merged, conflicts, added, unchanged, overwritten };
 }
@@ -2366,14 +2572,14 @@ function renderEnv(original, merged) {
   const out = lines.map((line2) => {
     const m = line2.replace(/\r$/, "").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
     if (!m?.[1]) return line2;
-    const key = m[1];
-    if (!merged.has(key)) return line2;
-    seen.add(key);
-    return `${key}=${merged.get(key) ?? ""}`;
+    const key2 = m[1];
+    if (!merged.has(key2)) return line2;
+    seen.add(key2);
+    return `${key2}=${merged.get(key2) ?? ""}`;
   });
   const appended = [];
-  for (const [key, value] of merged) {
-    if (!seen.has(key)) appended.push(`${key}=${value}`);
+  for (const [key2, value] of merged) {
+    if (!seen.has(key2)) appended.push(`${key2}=${value}`);
   }
   let text2 = out.join("\n");
   if (appended.length) {
@@ -2429,11 +2635,11 @@ function planPull(o) {
   const r = planEnvUpdate({ current, fetched: o.fetched, choices: o.choices ?? {}, defaultChoice: o.defaultChoice, managed: o.managed });
   const choiceOf = (k) => o.choices?.[k] ?? o.defaultChoice;
   const generated = [];
-  for (const key of o.localSecrets) {
-    const v = r.merged.get(key);
+  for (const key2 of o.localSecrets) {
+    const v = r.merged.get(key2);
     if (v === void 0 || v === "" || v === '""' || v === "''") {
-      r.merged.set(key, o.random());
-      generated.push(key);
+      r.merged.set(key2, o.random());
+      generated.push(key2);
     }
   }
   return {
@@ -2451,12 +2657,12 @@ function planPull(o) {
 }
 
 // src/core/env/write.ts
-import { chmod as chmod2, readFile as readFile4, rename as rename3, unlink, writeFile as writeFile4 } from "fs/promises";
+import { chmod as chmod2, readFile as readFile5, rename as rename3, unlink, writeFile as writeFile4 } from "fs/promises";
 import { randomBytes as randomBytes4 } from "crypto";
-import { basename as basename2, dirname as dirname5, join as join12 } from "path";
+import { basename as basename2, dirname as dirname5, join as join13 } from "path";
 async function readOrNull(p) {
   try {
-    return await readFile4(p, "utf8");
+    return await readFile5(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -2465,7 +2671,7 @@ async function readOrNull(p) {
 async function writeSecurely(target, text2) {
   const base = basename2(target);
   const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes4(6).toString("hex")}.local` : `${base}.qore-${randomBytes4(6).toString("hex")}.tmp`;
-  const tmp = join12(dirname5(target), tmpName);
+  const tmp = join13(dirname5(target), tmpName);
   try {
     await writeFile4(tmp, text2, { mode: 384, flag: "wx" });
     await chmod2(tmp, 384);
@@ -2491,934 +2697,1359 @@ async function syncEnvFile(o) {
   return { created: plan.created, kept: plan.kept };
 }
 
-// src/core/dev/lastStart.ts
-import { createHash as createHash2 } from "crypto";
-import { realpath as realpath6 } from "fs/promises";
-import { join as join13 } from "path";
-var NETWORK_REASONS = /* @__PURE__ */ new Set(["connect", "dns", "tls", "timeout"]);
-function isOffline(e) {
-  if (!(e instanceof QoreError)) return false;
-  if (e.code === "QORE_API_UNREACHABLE" || e.code === "QORE_API_UNAVAILABLE") return true;
-  if (e.code !== "QORE_AUTH_UNAVAILABLE") return false;
-  return (e.status ?? 0) >= 500 || NETWORK_REASONS.has(String(e.details?.reason));
-}
-async function stateKey(deps2, root) {
-  const real = await realpath6(root).catch(() => root);
-  return createHash2("sha256").update(trustKey(real, deps2.platform)).digest("hex").slice(0, 16);
-}
-async function saveLastStart(deps2, root, rec) {
-  await writeJsonAtomic(join13(deps2.config.dir, "dev"), `${await stateKey(deps2, root)}.json`, rec);
+// src/core/erd/source.ts
+function noDatabase(slug) {
+  return new QoreError("QORE_CONTEXT_UNSUPPORTED", `${slug} has no database`, {
+    hint: "qore db erd shows a module's own Postgres (DATABASE_URL); this module declares none."
+  });
 }
-async function loadLastStart(deps2, root) {
-  const rec = await readJson(join13(deps2.config.dir, "dev", `${await stateKey(deps2, root)}.json`)).catch(() => null);
-  return rec && rec.schemaVersion === 1 ? rec : null;
+async function resolveDatabaseUrl(deps2, mc, app) {
+  if (mc.repoRoot) {
+    const cfg = await readRepoConfig(mc.repoRoot);
+    const envFile = await resolveTarget(mc.repoRoot, cfg.envFile ?? moduleDefaults(mc.module.type).envFile);
+    const text2 = await readOrNull(envFile);
+    const url2 = text2 === null ? void 0 : parseEnv(text2).get("DATABASE_URL")?.trim().replace(/^["']|["']$/g, "");
+    if (url2) {
+      deps2.registerSecrets([url2]);
+      return { url: url2, source: "env-file", envFile };
+    }
+  }
+  const local = await fetchLocalEnv(deps2, mc, app);
+  const url = local.env.DATABASE_URL?.trim();
+  if (!url) throw noDatabase(mc.module.slug);
+  return { url, source: "portal", envFile: null };
 }
 
-// src/core/dev/env.ts
-function envPort(env, key) {
-  const raw = env[key];
-  if (raw === void 0) return null;
-  const v = raw.trim().replace(/^["']|["']$/g, "");
-  if (!/^\d+$/.test(v)) return null;
-  const n = Number(v);
-  return n >= 1024 && n <= 65535 ? n : null;
-}
-async function devEnv(deps2, o) {
-  const defaults = moduleDefaults(o.type);
-  const target = await resolveTarget(o.root, o.cfg.envFile ?? defaults.envFile);
-  let cause = null;
-  if (o.mc && o.app) {
+// src/platform/httpServe.ts
+import { readFile as readFile6 } from "fs/promises";
+import { createServer } from "http";
+import { extname, resolve as resolve6, sep as sep3 } from "path";
+var TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json",
+  ".ico": "image/x-icon",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+async function serveErd(o) {
+  const root = resolve6(o.dir);
+  let port = 0;
+  const server = createServer((req, res) => {
+    void handle(req, res);
+  });
+  await new Promise((ok2, fail) => {
+    server.once("error", fail);
+    server.listen(o.port, "127.0.0.1", () => {
+      server.off("error", fail);
+      ok2();
+    });
+  });
+  port = server.address().port;
+  async function handle(req, res) {
     try {
-      const local = await fetchLocalEnv(deps2, o.mc, o.app);
-      const example = await readOrNull(join14(dirname6(target), ".env.example"));
-      const w = await syncEnvFile({
-        target,
-        example,
-        fetched: local.env,
-        managed: local.managedKeys,
-        localSecrets: o.cfg.localSecrets ?? defaults.localSecrets,
-        random: o.random
-      });
-      return {
-        env: local.env,
-        offline: false,
-        envFile: target,
-        port: envPort(local.env, "PORT"),
-        dbPort: envPort(local.env, "DB_PORT"),
-        ...w
-      };
+      await route(req, res);
     } catch (e) {
-      if (!isOffline(e)) throw e;
-      cause = e;
+      if (res.headersSent) res.destroy();
+      else end(res, e instanceof TypeError ? 400 : 500);
     }
   }
-  const text2 = await readOrNull(target);
-  if (text2 === null || !await isTrusted(deps2, o.root, o.moduleId)) {
-    throw cause ?? new QoreError("QORE_API_UNREACHABLE", "The portal is unreachable", {
-      hint: "The portal is unreachable and there is no env file to start from yet."
-    });
+  async function route(req, res) {
+    const host = req.headers.host;
+    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return end(res, 403);
+    if (req.method !== "GET" && req.method !== "HEAD") return end(res, 405);
+    const path2 = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+    const produce = o.routes[path2];
+    if (produce) {
+      try {
+        const body = JSON.stringify(await produce());
+        res.writeHead(200, { "content-type": TYPES[".json"], "cache-control": "no-store" });
+        res.end(body);
+        return;
+      } catch (e) {
+        try {
+          o.onError(e);
+        } catch {
+        }
+        res.writeHead(500, { "content-type": TYPES[".json"] });
+        res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+        return;
+      }
+    }
+    const file = resolve6(root, `.${path2 === "/" ? "/index.html" : path2}`);
+    if (file !== root && !file.startsWith(root + sep3)) return end(res, 404);
+    try {
+      const body = await readFile6(file);
+      res.writeHead(200, { "content-type": TYPES[extname(file)] ?? "application/octet-stream" });
+      res.end(body);
+    } catch {
+      end(res, 404);
+    }
   }
-  const env = Object.fromEntries(parseEnv(text2));
-  return { env, offline: true, envFile: target, port: envPort(env, "PORT"), dbPort: envPort(env, "DB_PORT"), created: false, kept: [] };
+  return {
+    port,
+    close: () => new Promise((ok2) => {
+      server.closeAllConnections();
+      server.close(() => ok2());
+    })
+  };
 }
-
-// src/core/workspace/access.ts
-function devTeamsOf(am, m) {
-  const own = m.devTeamIds?.length ? am.devTeams.filter((t) => m.devTeamIds.includes(t.id)) : [];
-  return own.length ? own : am.devTeams;
+function end(res, status2) {
+  res.writeHead(status2);
+  res.end();
 }
-function askMaintainer(am, m) {
-  const teams = devTeamsOf(am, m);
-  const names = teams.map((t) => t.name);
-  const maintainers = [...new Set(teams.flatMap((t) => t.maintainers))];
-  const who = names.length ? names.join(", ") : "the app's dev team";
-  return { teams: names, maintainers, text: `ask a maintainer of ${who}${maintainers.length ? ` (${maintainers.join(", ")})` : ""}` };
+
+// src/cli/context.ts
+var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
+async function pick(ctx, err, message, choices) {
+  if (!ctx.io.interactive) throw err;
+  return ctx.io.select(message, choices);
 }
-function notClonedReason(m, am) {
-  if (am && !m.githubLinked) return `GitHub account not linked (${am.accountUrl})`;
-  if (am && m.repoAccess === "none") {
-    const names = devTeamsOf(am, m).map((t) => t.name);
-    return names.length ? `no repository access (dev team ${names.join(", ")})` : "no repository access (ask your tenant owner)";
+async function moduleContextFor(ctx, flags, command) {
+  const g = ctx.opts();
+  const onRequest = g.verbose ? (l) => ctx.io.err(l) : void 0;
+  const base = { portal: g.portal, module: flags.module, command, onRequest };
+  try {
+    return await resolveModuleContext(ctx.deps, base);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" || !ctx.io.interactive) throw e;
+    if (allOfKind(e.candidates, "module")) {
+      const choose2 = await pick(
+        ctx,
+        e,
+        "Select a module",
+        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : ""}${c.slug}  (${c.remote})`, value: c.id }))
+      );
+      return resolveModuleContext(ctx.deps, { ...base, choose: choose2 });
+    }
+    if (allOfKind(e.candidates, "tenant")) {
+      const tenant = await pick(ctx, e, "Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
+      return resolveModuleContext(ctx.deps, { ...base, tenant });
+    }
+    throw e;
   }
-  return "run qore sync";
 }
-
-// src/core/dev/findings.ts
-var plural = (n, one2, many) => n === 1 ? one2 : many;
-function modulesMissing(o) {
-  const actionFor = new Map(o.actions.map((a) => [a.module.slug, a]));
-  const findings = [];
-  const fixable = [];
-  const blocked = [];
-  const reasons = {};
-  const own = (m, reason, rest) => {
-    reasons[m.slug] = reason;
-    return { code: "dev.modules-missing", severity: "warn", module: m.slug, modules: [m.slug], message: `${m.slug} is not cloned \u2014 ${reason}`, ...rest };
-  };
-  for (const m of o.missing) {
-    const a = actionFor.get(m.slug);
-    if (a && a.kind !== "clone") {
-      if (a.kind === "conflict") {
-        const c = conflictText(o.cwd, a);
-        blocked.push(own(m, c.message, { action: { command: c.hint } }));
-      } else if (a.kind === "unsupported") {
-        blocked.push(own(m, "its repository URL is not supported", { action: { command: unsupportedRepoUrlError(m.slug, "").hint } }));
-      } else {
-        blocked.push(own(m, a.reason ?? "no repository yet", { why: "It will not run in this session." }));
-      }
-    } else if (o.am !== null && (!m.githubLinked || m.repoAccess === "none")) {
-      const am = o.am;
-      blocked.push(own(m, notClonedReason(m, am), { action: { command: !m.githubLinked ? `Link your GitHub account: ${am.accountUrl}` : askMaintainer(am, m).text } }));
-    } else fixable.push(m);
-  }
-  if (fixable.length > 0) {
-    const slugs = fixable.map((m) => m.slug);
-    const deps2 = slugs.flatMap((s) => (o.consumers[s] ?? []).map((c) => `${c} depends on ${s}`));
-    findings.push({
-      code: "dev.modules-missing",
-      severity: "warn",
-      message: `${fixable.length} ${plural(fixable.length, "module of this app is", "modules of this app are")} not cloned: ${slugs.join(", ")}`,
-      why: deps2.length > 0 ? `${deps2.join("; ")}.` : `${plural(fixable.length, "It", "They")} will not run in this session.`,
-      modules: slugs,
-      action: o.am ? { command: "qore sync", fix: "sync" } : { command: "qore sync" }
-    });
+async function appFor(ctx, mc, app) {
+  try {
+    return pickApp2(mc, app);
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
+    const id = await pick(ctx, e, "Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
+    return pickApp2(mc, id);
   }
-  return { findings: [...findings, ...blocked], fixable, reasons };
-}
-function strayClone(name, appName) {
-  return { code: "dev.stray-clone", severity: "info", module: name, message: `${name} is no longer part of ${appName} \u2014 you can remove the directory.` };
 }
-function repoBehind(slug, s, o) {
-  if (!s.ok || !s.upstream || !s.behind) return null;
-  return {
-    code: "dev.repo-behind",
-    severity: "warn",
-    module: slug,
-    message: `${slug} is ${s.behind} ${plural(s.behind, "commit", "commits")} behind ${s.upstreamRef ?? "its upstream"} (as of your last fetch).`,
-    action: { command: o.workspace ? "qore sync --pull" : "git pull" }
-  };
+function sourceText(mc) {
+  if (mc.source.kind === "remote") return mc.source.remote;
+  if (mc.source.kind === "workspace") return WORKSPACE_FILE;
+  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : "--module";
 }
-function servicesMissing(slug, env, recipe, o) {
-  const db = envPort(env, "DB_PORT");
-  if (db === null || recipe.services.length > 0 || !o.servicesFlag || o.configured) return null;
-  return {
-    code: "dev.services-missing",
-    severity: "warn",
-    module: slug,
-    message: `The portal gives ${slug} a database (DB_PORT=${db}), but ${slug} has no db:up script \u2014 no database will be started.`,
-    why: "This repository is probably older than its template.",
-    action: { command: 'add a "db:up" script (see the current app template), or set dev.services in .qore.json' }
-  };
+function contextLine(mc, app) {
+  const parts = [mc.module.tenant.name, ...app ? [app.name] : [], mc.module.slug];
+  return `\u2192 ${parts.join(" / ")}  (${sourceText(mc)})`;
 }
-function providerDown(o) {
-  const single = o.providers.length === 1 && o.keys.length === 1;
+function contextJson(mc, app) {
+  const { id, slug, name, type, access: access2 } = mc.module;
   return {
-    code: "dev.provider-down",
-    severity: "warn",
-    module: o.slug,
-    modules: o.providers,
-    message: single ? `${o.providers[0]} is not running \u2014 ${o.keys[0]} points at :${o.ports.get(o.keys[0])}, where nothing listens.` : `${o.keys.join(", ")} ${plural(o.keys.length, "points", "point")} at ports nothing listens on (depends on: ${o.providers.join(", ")}).`,
-    why: single ? `${o.slug} will start, but calls to ${o.providers[0]} will fail. Qore does not fall back to staging.` : `${o.slug} will start, but calls through ${o.keys.join(", ")} will fail. Qore does not fall back to staging.`,
-    action: { command: o.fix }
+    portal: mc.portal.builtin ?? mc.portal.apiOrigin,
+    tenant: mc.module.tenant,
+    app: app ?? null,
+    module: { id, slug, name, type, access: access2 },
+    source: mc.source.kind === "remote" ? mc.source.remote : mc.source.kind === "workspace" ? WORKSPACE_FILE : "--module",
+    ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
   };
 }
 
-// src/core/dev/project.ts
-import { access, readFile as readFile5 } from "fs/promises";
-import { join as join15 } from "path";
-var LEGACY_DEV_SCRIPTS = ["node --env-file=.env --import ./dist/instrumentation.js dist/index.js"];
-var LOCKFILES = [["pnpm-lock.yaml", "pnpm"], ["package-lock.json", "npm"], ["yarn.lock", "yarn"]];
-var exists = (p) => access(p).then(() => true, () => false);
-var unsupported = (message, hint, details) => new QoreError("QORE_DEV_UNSUPPORTED", message, { hint, details });
-async function readPackageJson(root) {
-  let raw;
-  try {
-    raw = await readFile5(join15(root, "package.json"), "utf8");
-  } catch {
-    throw unsupported("This repository has no package.json", "qore dev starts Node repositories through their package.json scripts.");
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    throw unsupported("package.json is not valid JSON", "Fix package.json, then run qore dev again.");
-  }
+// src/cli/project.ts
+import { readdir as readdir2, stat as stat3 } from "fs/promises";
+import { join as join14 } from "path";
+
+// src/core/projects/match.ts
+function readings(ref) {
+  const s = ref.split("/").map((x) => x.trim());
+  if (s.some((x) => x === "")) return [];
+  if (s.length === 1) return [{ app: s[0] }];
+  if (s.length === 2) return [{ app: s[0], module: s[1] }, { tenant: s[0], app: s[1] }];
+  if (s.length === 3) return [{ tenant: s[0], app: s[1], module: s[2] }];
+  return [];
 }
-async function detectPackageManager(root, pkg) {
-  if (typeof pkg.packageManager === "string") {
-    const m = /^(pnpm|npm|yarn)@(.+)$/.exec(pkg.packageManager.trim());
-    if (!m) throw unsupported(`packageManager "${pkg.packageManager}" is not pnpm, npm or yarn`, "qore dev supports pnpm, npm and yarn.");
-    return { name: m[1], version: m[2].split("+")[0] };
-  }
-  for (const [file, name] of LOCKFILES) if (await exists(join15(root, file))) return { name, version: null };
-  throw unsupported("No package manager declared and no lockfile found", 'Add "packageManager": "pnpm@<version>" to package.json.');
+function hit(p, w) {
+  if (p.appSlug !== w.app || w.tenant !== void 0 && p.tenantSlug !== w.tenant) return null;
+  if (p.kind === "module") return w.module === p.moduleSlug ? { project: p } : null;
+  return w.module ? { project: p, module: w.module } : { project: p };
 }
-function planRecipe(o) {
-  const scripts = o.pkg.scripts ?? {};
-  const script = o.cfg.dev?.script ?? "dev";
-  const found = scripts[script];
-  if (found === void 0) {
-    throw unsupported(`${o.slug} has no "${script}" script in package.json`, 'Add a "dev" script, or set dev.script in .qore.json.', { script });
-  }
-  if (LEGACY_DEV_SCRIPTS.includes(found.trim())) {
-    throw unsupported(
-      `${o.slug}'s dev script is the old backend one, which needs a build and a .env first`,
-      'Update it to the current template: "dev": "node scripts/dev.mjs" plus scripts/dev.mjs.',
-      { script, found }
-    );
-  }
-  const configured = o.cfg.dev?.services;
-  for (const s of configured ?? []) {
-    if (scripts[s] === void 0) {
-      throw new QoreError("QORE_CONTEXT_INVALID", `.qore.json: dev.services names "${s}", which is not a script in package.json`, {
-        hint: "Fix dev.services in .qore.json."
-      });
+function matchProjects(projects, ref) {
+  const out = [];
+  for (const w of readings(ref)) {
+    for (const p of projects) {
+      const m = hit(p, w);
+      if (m) out.push(m);
     }
   }
-  const services = !o.flags.services ? [] : configured ?? (scripts["db:up"] !== void 0 ? ["db:up"] : []);
-  return {
-    root: o.root,
-    pm: o.pm,
-    script,
-    services,
-    install: (o.cfg.dev?.install ?? true) && o.flags.install,
-    dockerServices: services.some((s) => /\bdocker\b/.test(scripts[s] ?? ""))
-  };
+  return out;
 }
-function runArgs(pm, script) {
-  return { cmd: pm.name, args: ["run", script] };
+
+// src/cli/project.ts
+async function loggedInAs(ctx) {
+  const cfg = await ctx.deps.config.read();
+  const portal = resolvePortal(ctx.opts().portal, cfg.defaultProfile);
+  const p = cfg.profiles[portal.apiOrigin];
+  if (!p || !await new TokenStore(ctx.deps.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return null;
+  return p.email ?? p.sub ?? portal.apiOrigin;
 }
-function installArgs(pm) {
-  return { cmd: pm.name, args: ["install"] };
+var isDir = async (p) => (await stat3(p).catch(() => null))?.isDirectory() ?? false;
+var label2 = (p) => `${p.tenantSlug} / ${p.appSlug}${p.kind === "module" ? ` / ${p.moduleSlug}` : ""}${p.source === "registry" ? `  (${p.path})` : ""}`;
+var candidate = (p) => p.kind === "module" ? { kind: "module", id: p.moduleId, slug: p.moduleSlug, tenant: p.tenantSlug, name: p.path } : { kind: "app", slug: p.appSlug, tenant: p.tenantSlug, name: p.path };
+var withCwd = (ctx, cwd) => ({ ...ctx, deps: { ...ctx.deps, cwd } });
+async function standingIn(ctx) {
+  if (await findWorkspace(ctx.deps.cwd, ctx.deps.home)) return "workspace";
+  const repo = await findRepoRoot(ctx.deps.cwd);
+  return repo !== null && !isInside(repo, ctx.deps.home) ? { repo } : null;
 }
-
-// src/core/dev/install.ts
-import { stat as stat3 } from "fs/promises";
-import { join as join16 } from "path";
-var MARKERS = {
-  pnpm: [".modules.yaml"],
-  npm: [".package-lock.json"],
-  yarn: [".yarn-state.yml", ".yarn-integrity"]
-};
-var LOCK2 = { pnpm: "pnpm-lock.yaml", npm: "package-lock.json", yarn: "yarn.lock" };
-var mtime = (p) => stat3(p).then((s) => s.mtimeMs, () => null);
-async function needsInstall(root, pm) {
-  if (await mtime(join16(root, "node_modules")) === null) return true;
-  let marker = null;
-  for (const m of MARKERS[pm.name]) marker ??= await mtime(join16(root, "node_modules", m));
-  if (marker === null) return true;
-  const lock = await mtime(join16(root, LOCK2[pm.name]));
-  return lock !== null && lock > marker;
+async function isForeign(ctx, command) {
+  const g = ctx.opts();
+  try {
+    await resolveModuleContext(ctx.deps, { portal: g.portal, command, onRequest: g.verbose ? (l) => ctx.io.err(l) : void 0 });
+    return false;
+  } catch (e) {
+    if (e instanceof CancelledError) throw e;
+    return isForeignRepo(e);
+  }
 }
-
-// src/core/diagnostics/docker.ts
-function dockerInstallUrl(platform) {
-  if (platform === "darwin") return "https://docs.docker.com/desktop/setup/install/mac-install/";
-  if (platform === "win32") return "https://docs.docker.com/desktop/setup/install/windows-install/";
-  return "https://docs.docker.com/engine/install/";
+async function moduleDirs(wsPath) {
+  const out = [];
+  for (const d of await readdir2(wsPath, { withFileTypes: true }).catch(() => [])) {
+    if (d.isDirectory() && !d.name.startsWith(".") && await stat3(join14(wsPath, d.name, ".git")).catch(() => null)) out.push(d.name);
+  }
+  return out.sort();
 }
-function classifyDockerInfo(r, platform) {
-  if (r.spawnError === "ENOENT") {
-    return new QoreError("QORE_DOCKER_MISSING", "Docker is not installed", {
-      hint: `Install Docker: ${dockerInstallUrl(platform)} \u2014 or run qore dev --no-services.`
+async function pathFor(ctx, m, needModule) {
+  const p = m.project;
+  if (p.kind === "module") return p.path;
+  if (m.module) {
+    const dir2 = join14(p.path, m.module);
+    if (!await isDir(dir2)) {
+      throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no checkout of module ${m.module} in ${p.path}`, {
+        hint: `Run \`qore sync\` in ${p.path} to clone the app's missing modules.`
+      });
+    }
+    return dir2;
+  }
+  if (!needModule) return p.path;
+  const dirs = await moduleDirs(p.path);
+  if (dirs.length === 1) return join14(p.path, dirs[0]);
+  if (dirs.length === 0) {
+    throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no module checkouts in ${p.path}`, {
+      hint: `Run \`qore sync\` in ${p.path}.`
     });
   }
-  if (r.code === 0) return null;
-  const hint = "Start Docker Desktop, then run qore dev again \u2014 or qore dev --no-services.";
-  if (/Cannot connect to the Docker daemon|Is the docker daemon running|error during connect/i.test(r.tail.join("\n"))) {
-    return new QoreError("QORE_DOCKER_NOT_RUNNING", "Docker is not running", { hint, details: { reason: "daemon" } });
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `${p.appSlug} has several modules \u2014 which one?`, {
+      hint: `Pass ${p.appSlug}/<module>.`,
+      candidates: dirs.map((slug) => ({ kind: "module", slug, tenant: p.tenantSlug, name: join14(p.path, slug) }))
+    });
   }
-  return new QoreError("QORE_DOCKER_NOT_RUNNING", "Docker is not running", { hint, details: { stderr: r.tail } });
+  return join14(p.path, await ctx.io.select("Select a module", dirs.map((d) => ({ name: d, value: d }))));
 }
-function classifyComposeVersion(r) {
-  if (r.code === 0) return null;
-  const hint = "Update Docker Desktop (or install the compose plugin). The legacy docker-compose v1 is not supported.";
-  if (/unknown command: docker compose|'compose' is not a docker command/.test(r.tail.join("\n"))) {
-    return new QoreError("QORE_DOCKER_COMPOSE_MISSING", "Docker Compose v2 is missing", { hint });
+async function liveMatches(matches) {
+  const live = [];
+  for (const m of matches) {
+    if (m.project.kind === "workspace" && m.module && !await isDir(join14(m.project.path, m.module))) continue;
+    live.push(m);
   }
-  return new QoreError("QORE_DOCKER_COMPOSE_MISSING", "Docker Compose v2 is missing", { hint, details: { stderr: r.tail } });
+  return live.length > 0 ? live : matches;
 }
-
-// src/core/diagnostics/postgres.ts
-var INCOMPATIBLE = /database files are incompatible with server|Counter to that, there appears to be PostgreSQL data in|in 18\+, these Docker images are configured to store database data/;
-function classifyComposeLogs(logs, o) {
-  const text2 = logs.join("\n");
-  if (!INCOMPATIBLE.test(text2)) return null;
-  const details = { reason: "pg-data-version" };
-  const m = text2.match(/initialized by PostgreSQL version (\d+).*this version (\d+)/);
-  if (m) {
-    details.found = m[1];
-    details.expected = m[2];
+async function choose(ctx, matches, what, explicit) {
+  if (explicit && matches.length === 1) return matches[0];
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", what, {
+      hint: "Pass a more specific reference: tenant/app or app/module.",
+      candidates: matches.map((m) => candidate(m.project))
+    });
   }
-  return new QoreError("QORE_SERVICE_DATA_INCOMPATIBLE", `The local database volume of ${o.slug} was created by another Postgres version`, {
-    hint: "pnpm db:reset recreates it \u2014 this deletes all local data in it. Qore never runs it for you.",
-    details
-  });
-}
-
-// src/core/diagnostics/ports.ts
-function parseDockerPs(stdout) {
-  const line2 = stdout.split(/\r?\n/).find((l) => l.trim());
-  if (!line2) return null;
-  const [id, name, project, workingDir] = line2.split("	");
-  if (!id || !name) return null;
-  return { id, name, project: project || null, workingDir: workingDir || null };
-}
-function parseLsofCwd(stdout) {
-  const m = stdout.match(/^fcwd\nn(.+)$/m);
-  return m ? m[1] : null;
-}
-function parseEtime(s) {
-  const m = s.trim().match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/);
-  if (!m) return null;
-  const days = m[1] ? Number(m[1]) : 0;
-  const hours = m[2] ? Number(m[2]) : 0;
-  const minutes = Number(m[3]);
-  const seconds = Number(m[4]);
-  return days * 86400 + hours * 3600 + minutes * 60 + seconds;
-}
-function humanAge(seconds) {
-  if (seconds < 60) return `${seconds} s`;
-  if (seconds < 3600) return `${Math.round(seconds / 60)} min`;
-  if (seconds < 86400) return `${Math.round(seconds / 3600)} h`;
-  return `${Math.round(seconds / 86400)} d`;
+  const i = await ctx.io.select("Select a project", matches.map((m, idx) => ({
+    name: m.module ? `${label2(m.project)} / ${m.module}` : label2(m.project),
+    value: idx
+  })));
+  return matches[i];
 }
-
-// src/core/diagnostics/pm.ts
-function pmVersionMismatch(pm, printed) {
-  if (pm.version === null) return null;
-  const lines = printed.split("\n");
-  let found = null;
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const line2 = lines[i].trim();
-    if (/^\d+\.\d+\.\d+/.test(line2)) {
-      found = line2;
-      break;
+async function projectCtx(ctx, o) {
+  const g = ctx.opts();
+  const cfg = await ctx.deps.config.read();
+  const portal = g.portal ? resolvePortal(g.portal, cfg.defaultProfile).apiOrigin : void 0;
+  if (o.ref) {
+    const matches = matchProjects(await knownProjects(ctx.deps, { portal }), o.ref);
+    if (matches.length === 0) {
+      const parts = o.ref.split("/");
+      const app = parts.length === 1 ? o.ref : parts.length === 3 ? parts[1] : "<app>";
+      throw new QoreError("QORE_PROJECT_NOT_FOUND", `No local project "${o.ref}"`, {
+        hint: cfg.projectsRoot ? `Run \`qore clone ${app}\`.` : `Run \`qore init\`, or \`qore clone ${app}\`.`
+      });
     }
+    const m2 = await choose(ctx, await liveMatches(matches), `"${o.ref}" matches several projects`, true);
+    return relocate(ctx, await pathFor(ctx, m2, o.needModule));
   }
-  if (found === null) return null;
-  if (found.split(".")[0] === pm.version.split(".")[0]) return null;
-  return new QoreError("QORE_PACKAGE_MANAGER", `${pm.name} ${found} does not match the pinned ${pm.name}@${pm.version}`, {
-    hint: `Install the pinned major: npm i -g ${pm.name}@${pm.version.split(".")[0]}. (pnpm \u2265 9.7 switches to the pinned version by itself.)`,
-    details: { found, pinned: pm.version }
-  });
-}
-function classifyInstall(tail, command, root) {
-  const joined = tail.join("\n");
-  if (/ERR_PNPM_OUTDATED_LOCKFILE/.test(joined)) {
-    return new QoreError("QORE_INSTALL_FAILED", "The lockfile does not match package.json", {
-      hint: `Someone committed one without the other. Run \`${command} --no-frozen-lockfile\` in ${root} and commit the lockfile.`,
-      details: { reason: "outdated-lockfile", command, stderr: tail }
+  if (o.module || o.app) return ctx;
+  const here = await standingIn(ctx);
+  if (here === "workspace") return ctx;
+  const known = await knownProjects(ctx.deps, { portal });
+  if (here && (known.length === 0 || known.some((p) => isInside(p.path, here.repo)) || !await isForeign(ctx, o.command ?? "project"))) return ctx;
+  if (known.length === 0) {
+    if (!cfg.projectsRoot) {
+      if (!await loggedInAs(ctx)) return ctx;
+      throw new QoreError("QORE_ROOT_NOT_SET", "Not inside a project, and qore knows no projects yet", {
+        hint: "Run `qore init` to choose a projects folder, or cd into a project."
+      });
+    }
+    throw new QoreError("QORE_PROJECT_NOT_FOUND", `Not inside a project, and ${cfg.projectsRoot} holds none yet`, {
+      hint: "Run `qore clone <app>`."
     });
   }
-  return new QoreError("QORE_INSTALL_FAILED", `${command} failed`, {
-    hint: `Run \`${command}\` in ${root} to see the full output.`,
-    details: { command, stderr: tail }
-  });
-}
-
-// src/core/diagnostics/versions.ts
-import semver from "semver";
-function nodeSatisfies(found, range) {
-  if (semver.validRange(range) === null) return null;
-  return semver.satisfies(found, range);
+  const what = here ? "This repository is not a Qore module \u2014 which project?" : "Not inside a project \u2014 which one?";
+  const m = await choose(ctx, known.map((project) => ({ project })), what, false);
+  return relocate(ctx, await pathFor(ctx, m, o.needModule));
 }
-function nodeVersionError(found, range, slug) {
-  const min = semver.minVersion(range);
-  const major = min ? min.major : range;
-  return new QoreError("QORE_NODE_VERSION", `${slug} needs Node ${range}, found ${found}`, {
-    hint: `nvm install ${major} / fnm use ${major}, then run qore dev again.`,
-    details: { found, required: range }
-  });
+function relocate(ctx, path2) {
+  if (path2 === ctx.deps.cwd) return ctx;
+  if (!ctx.opts().json) ctx.io.err(`\u2192 in ${path2}`);
+  return withCwd(ctx, path2);
 }
-
-// src/core/dev/preflight.ts
-var pmMajor = (v) => v ? v.split(".")[0] : "latest";
-var GRACE_MS = 1e4;
-var secs = (ms2) => `${Math.round(ms2 / 1e3)} s`;
-async function runTool(deps2, cmd, args, o) {
-  if (o.signal.aborted) throw new CancelledError();
-  const tail = [];
-  const c = deps2.launch.launch(cmd, args, { cwd: o.cwd, env: { ...o.env, LC_ALL: "C" }, onLine: (l) => {
-    tail.push(l.line);
-    if (tail.length > 50) tail.shift();
-    o.onLine(l);
-  } });
-  let kill;
-  const onAbort = () => {
-    c.stop("SIGTERM");
-    kill = setTimeout(() => c.stop("SIGKILL"), GRACE_MS);
-  };
-  o.signal.addEventListener("abort", onAbort, { once: true });
-  let exit;
-  try {
-    exit = await c.exited;
-  } finally {
-    o.signal.removeEventListener("abort", onAbort);
-    clearTimeout(kill);
-  }
-  if (o.signal.aborted) throw new CancelledError();
-  return { code: exit.code, spawnError: exit.spawnError, tail };
-}
-async function checkPackageManager(deps2, r, onLine, signal) {
-  const res = await runTool(deps2, r.pm.name, ["--version"], { cwd: r.root, env: deps2.env, onLine, signal });
-  const hint = `Install it: npm i -g ${r.pm.name}@${pmMajor(r.pm.version)}`;
-  if (res.spawnError === "ENOENT") {
-    throw new QoreError("QORE_PACKAGE_MANAGER", `${r.pm.name} is not installed`, { hint, details: { packageManager: r.pm } });
+async function rememberContext(ctx, mc, app) {
+  const tenantSlug = mc.module.tenant.slug;
+  if (mc.workspace && mc.workspace.appId === app.id) {
+    await remember(ctx.deps, {
+      kind: "workspace",
+      path: mc.workspace.root,
+      portal: mc.workspace.portal,
+      tenantSlug,
+      appId: app.id,
+      appSlug: app.slug
+    });
+    return;
   }
-  if (res.code !== 0) {
-    throw new QoreError("QORE_PACKAGE_MANAGER", `${r.pm.name} is not installed`, { hint, details: { packageManager: r.pm, stderr: res.tail } });
+  if (mc.repoRoot) {
+    await remember(ctx.deps, {
+      kind: "module",
+      path: mc.repoRoot,
+      portal: mc.portal.apiOrigin,
+      tenantSlug,
+      appId: app.id,
+      appSlug: app.slug,
+      moduleId: mc.module.id,
+      moduleSlug: mc.module.slug
+    });
   }
-  const mismatch = pmVersionMismatch(r.pm, res.tail.join("\n"));
-  if (mismatch) throw mismatch;
-  return res.tail.map((l) => l.trim()).findLast((l) => /^\d+\.\d+\.\d+/.test(l)) ?? null;
 }
-async function checkNode(deps2, r, pkg, slug, signal) {
-  const range = pkg.engines?.node;
-  if (!range) return null;
-  const res = await runTool(deps2, "node", ["--version"], { cwd: r.root, env: deps2.env, onLine: () => {
-  }, signal });
-  if (res.spawnError === "ENOENT") {
-    throw new QoreError("QORE_NODE_VERSION", "node is not on PATH", {
-      hint: "Install Node (https://nodejs.org) or run nvm use, then reinstall qore.",
-      details: { required: range }
+async function rememberWorkspace(ctx, ws, app) {
+  if (ws.appId !== app.id) return;
+  await remember(ctx.deps, { kind: "workspace", path: ws.root, portal: ws.portal, tenantSlug: app.tenant.slug, appId: app.id, appSlug: app.slug });
+}
+
+// src/cli/trustPrompt.ts
+async function ensureTrusted(ctx, mc, app, o) {
+  const root = mc.repoRoot ?? ctx.deps.cwd;
+  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
+  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
+  if (o.yes) {
+    await trust(ctx.deps, root, mc.module.id);
+    return;
+  }
+  if (!ctx.io.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `This repository is not trusted for ${mc.module.slug} yet`, {
+      hint: "Run interactively once, or pass --yes.",
+      details: { reason: "untrusted", repository: root }
     });
   }
-  if (res.spawnError || res.code !== 0) {
-    throw new QoreError("QORE_NODE_VERSION", "node --version failed", { details: { required: range, stderr: res.tail } });
+  if (mc.source.kind === "remote") {
+    const key2 = repoKey(mc.source.url);
+    ctx.io.err(`  from remote ${mc.source.remote}: ${key2 ?? "(unparsable remote URL)"}`);
   }
-  const found = (res.tail.at(-1) ?? "").trim().replace(/^v/, "");
-  if (nodeSatisfies(found, range) === false) throw nodeVersionError(found, range, slug);
-  return found;
+  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
+  await trust(ctx.deps, root, mc.module.id);
 }
-async function installIfNeeded(deps2, r, slug, onLine, report, signal) {
-  if (!r.install) {
-    report({ module: slug, step: "install", status: "skip", detail: "disabled" });
-    return;
+
+// src/cli/commands/db.ts
+var isDir2 = async (p) => stat4(p).then((s) => s.isDirectory(), () => false);
+function parsePort(raw) {
+  const n = /^\d+$/.test(raw) ? Number(raw) : NaN;
+  if (!Number.isInteger(n) || n < 1 || n > 65535) throw new InvalidArgumentError("a port is a number from 1 to 65535");
+  return n;
+}
+var aborted = (signal) => signal.aborted ? Promise.resolve() : new Promise((r) => signal.addEventListener("abort", () => r(), { once: true }));
+var plural = (n) => `${n} migration${n === 1 ? "" : "s"}`;
+function migrationLines(m, who) {
+  if (!m) return [];
+  const lines = [];
+  if (m.pending.length) lines.push(`${who} lacks ${plural(m.pending.length)} of this checkout (${m.pending.join(", ")}); they apply on the next start of \`qore dev\`.`);
+  if (m.skipped.length) lines.push(`${who} lacks ${plural(m.skipped.length)} older than its latest (${m.skipped.join(", ")}); Drizzle never applies those, so reset it with \`pnpm db:reset\`.`);
+  if (m.unknown) lines.push(`${who} has ${plural(m.unknown)} this checkout does not know; applied from another branch?`);
+  return lines;
+}
+var portInUse = (port) => new QoreError("QORE_PORT_IN_USE", `Port ${port} is already in use`, { hint: "Pick another --port, or leave it out to get a free one." });
+function registerDb(program, ctx) {
+  const db = program.command("db").description("Work with the local databases of a module or an app");
+  db.command("erd").description("Show this module's data model in the browser \u2014 or, in a workspace root, the whole app's").argument("[project]", "app or app/module to show, from anywhere (see qore init)").option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "same as the [project] argument").option("--yes", "trust this repository without asking").option("--port <n>", "listen on this port (default: a free one)", parsePort).option("--no-open", "print the URL, do not open a browser").action(async (project, f) => {
+    if (project !== void 0 && f.project !== void 0 && project !== f.project) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Pass the project once: "${project}" and --project "${f.project}" differ`, {
+        hint: "qore db erd <project> | qore db erd --project <project>"
+      });
+    }
+    await erd(ctx, { ...f, project: project ?? f.project });
+  });
+}
+async function erd(outer, f) {
+  const json2 = Boolean(outer.opts().json);
+  if (json2 && (f.port !== void 0 || !f.open)) {
+    throw new QoreError("QORE_CONTEXT_INVALID", "--json writes the model and starts no server", {
+      hint: "Drop --port and --no-open, or drop --json."
+    });
   }
-  if (!await needsInstall(r.root, r.pm)) {
-    report({ module: slug, step: "install", status: "skip", detail: "up to date" });
+  if (f.port !== void 0 && await outer.deps.ports.inUse(f.port)) throw portInUse(f.port);
+  const ctx = await projectCtx(outer, { ref: f.project, module: f.module, app: f.app, needModule: false, command: "db erd" });
+  const { deps: deps2, io: io2 } = ctx;
+  if (!f.module) {
+    const chosen = Boolean(f.project) || ctx !== outer || Boolean(f.app);
+    const ws = await workspaceRoot(deps2) ?? (chosen ? null : await wholeAppWanted(ctx));
+    if (ws) {
+      await erdApp(ctx, f, ws);
+      return;
+    }
+  }
+  const mc = await moduleContextFor(ctx, f, "db erd");
+  const app = await appFor(ctx, mc, f.app);
+  await ensureTrusted(ctx, mc, app, { yes: f.yes });
+  const src = await resolveDatabaseUrl(deps2, mc, app);
+  const model = async () => {
+    const conn = await deps2.postgres(src.url, { timeoutMs: 3e3 });
+    try {
+      const m = await introspect(conn.query);
+      const migrations = await checkMigrations(mc.repoRoot, conn.query);
+      return migrations ? { ...m, migrations } : m;
+    } finally {
+      await conn.close().catch(() => {
+      });
+    }
+  };
+  const fresh = () => model().catch((e) => {
+    throw classifyDbError(e, src.url);
+  });
+  const first = await model().catch((e) => {
+    throw ctx.signal.aborted ? new CancelledError() : classifyDbError(e, src.url);
+  });
+  if (json2) {
+    renderJson(io2, { context: contextJson(mc, app), source: src.source, model: first });
     return;
   }
-  report({ module: slug, step: "install", status: "start" });
-  const began = deps2.now().getTime();
-  const { cmd, args } = installArgs(r.pm);
-  const res = await runTool(deps2, cmd, args, { cwd: r.root, env: deps2.env, onLine, signal });
-  if (res.code !== 0) {
-    const command = [cmd, ...args].join(" ");
-    const err = classifyInstall(res.tail, command, r.root);
-    if (err.details?.reason === "outdated-lockfile") throw err;
-    throw new QoreError("QORE_INSTALL_FAILED", `${command} failed in ${slug}`, { hint: err.hint, details: err.details });
+  if (first.tables.length === 0) io2.err("No tables yet \u2014 have the migrations run? Start the app once with `qore dev`.");
+  for (const line2 of migrationLines(first.migrations, "The database")) io2.err(line2);
+  if (ctx.signal.aborted) throw new CancelledError();
+  const meta = { context: contextJson(mc, app), connection: connectionOf(src.url) };
+  const server = await serveErd({
+    dir: deps2.viewerDir,
+    port: f.port ?? 0,
+    routes: { "/model.json": fresh, "/meta.json": async () => meta },
+    onError: (e) => {
+      if (!ctx.signal.aborted) io2.err(`Could not refresh the model: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }).catch((e) => {
+    const code = e.code;
+    throw f.port !== void 0 && (code === "EADDRINUSE" || code === "EACCES") ? portInUse(f.port) : e;
+  });
+  await serve(ctx, f, server);
+}
+async function wholeAppWanted(ctx) {
+  if (!ctx.io.interactive) return null;
+  const ws = await findWorkspace(ctx.deps.cwd, ctx.deps.home);
+  const repo = ws && await findRepoRoot(ctx.deps.cwd);
+  if (!ws || !repo || repo === ws.root || !isInside(ws.root, repo)) return null;
+  const pick2 = await ctx.io.select("Which data model?", [
+    { name: "the whole app", value: "app" },
+    { name: `only ${basename3(repo)}`, value: "module" }
+  ]);
+  return pick2 === "app" ? ws : null;
+}
+async function serve(ctx, f, server) {
+  try {
+    const url = `http://127.0.0.1:${server.port}`;
+    ctx.io.err(`\u2192 ${url}  (Ctrl+C stops)`);
+    if (f.open) await ctx.io.openUrl(url);
+    await aborted(ctx.signal);
+    throw new CancelledError();
+  } finally {
+    await server.close();
   }
-  report({ module: slug, step: "install", status: "done", detail: secs(deps2.now().getTime() - began) });
 }
-async function portInUseError(deps2, o) {
-  const owner = await deps2.ports.owner(o.port);
-  const qoreRun = (o.runs ?? []).find((r) => r.children.some((c) => c.port === o.port) || owner !== null && (r.qorePid === owner.pid || r.children.some((c) => c.pid === owner.pid)));
-  if (qoreRun) {
-    return new QoreError("QORE_PORT_IN_USE", `A previous qore dev is still running (pid ${qoreRun.qorePid})`, {
-      hint: `Stop it (Ctrl+C in its terminal, or kill ${qoreRun.qorePid}), then run qore dev again.`,
-      details: { port: o.port, module: o.slug, key: o.key, owner: "qore", pid: qoreRun.qorePid }
-    });
+async function erdApp(ctx, f, ws) {
+  const { deps: deps2, io: io2 } = ctx;
+  const g = ctx.opts();
+  const json2 = Boolean(g.json);
+  const portal = await flagPortal(deps2, g.portal, ws);
+  const session = await openSession(deps2, portal, "db erd", g.verbose ? (l) => io2.err(l) : void 0);
+  await ensureCapability(deps2, portal.apiOrigin, "app.modules");
+  const am = await workspaceAppModules(session, portal, ws);
+  const { tenant, ...app } = am.app;
+  if (f.app && f.app !== app.id && f.app !== app.slug) {
+    throw new QoreError("QORE_RESOURCE_NOT_FOUND", `This workspace is for ${app.slug}, not "${f.app}"`, { hint: "Pass --module <slug> --app <slug>." });
   }
-  if (owner) {
-    if (/^(com\.docker\.backend|com\.docker\.vpnkit|docker-proxy|vpnkit|dockerd)$/.test(owner.command)) {
-      const pub = await deps2.ports.dockerPublisher(o.port);
-      if (pub) {
-        return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is held by the Docker container ${pub.name} (needed by ${o.slug})`, {
-          hint: `It belongs to compose project ${pub.project} in ${pub.workingDir} \u2014 typically another module's or tenant's database. Stop it there with docker compose down, or docker stop ${pub.name}.`,
-          details: { port: o.port, module: o.slug, key: o.key, owner: "docker", ...pub }
-        });
+  const modules = [];
+  const sources = /* @__PURE__ */ new Map();
+  const roots = /* @__PURE__ */ new Map();
+  for (const m of orderModules(am.modules)) {
+    const dir2 = join15(ws.root, m.slug);
+    const repoRoot = isSafeSlug(m.slug) && await isDir2(dir2) ? dir2 : null;
+    const mc = { portal, session, module: { ...m, tenant, apps: [app] }, source: { kind: "workspace" }, repoRoot, workspace: ws };
+    roots.set(m.slug, repoRoot);
+    if (repoRoot) await ensureTrusted(ctx, mc, app, { yes: f.yes });
+    try {
+      const src = await resolveDatabaseUrl(deps2, mc, app);
+      modules.push({ slug: m.slug, dependsOn: m.dependsOn, url: src.url });
+      sources.set(m.slug, src.source);
+    } catch (e) {
+      if (e instanceof QoreError && e.code === "QORE_CONTEXT_UNSUPPORTED") {
+        modules.push({ slug: m.slug, dependsOn: m.dependsOn, url: null });
+        continue;
       }
-    }
-    const detail2 = await deps2.ports.ownerDetail(owner.pid);
-    const extras = [];
-    if (detail2.ageSeconds !== null) extras.push(`started ${humanAge(detail2.ageSeconds)} ago`);
-    if (detail2.cwd !== null) {
-      const cwd = deps2.home && detail2.cwd.startsWith(deps2.home) ? `~${detail2.cwd.slice(deps2.home.length)}` : detail2.cwd;
-      extras.push(`in ${cwd}`);
-    }
-    const suffix = extras.length ? `, ${extras.join(" ")}` : "";
-    return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is already in use (needed by ${o.slug})`, {
-      hint: `Held by: ${owner.command} (pid ${owner.pid})${suffix}. Stop that process. Qore never moves a port: other modules and the local login rely on ${o.port}.`,
-      details: {
-        port: o.port,
-        module: o.slug,
-        key: o.key,
-        owner: "process",
-        pid: owner.pid,
-        command: owner.command,
-        ...detail2.cwd !== null ? { cwd: detail2.cwd } : {},
-        ...detail2.ageSeconds !== null ? { ageSeconds: detail2.ageSeconds } : {}
+      if (!json2 && e instanceof QoreError && e.code === "QORE_ACCESS_DENIED") {
+        io2.err(`${m.slug} is left out: ${e.message}${e.hint ? `
+  ${e.hint}` : ""}`);
+        modules.push({ slug: m.slug, dependsOn: m.dependsOn, url: null });
+        continue;
       }
+      throw e;
+    }
+  }
+  const groups = groupDatabases(modules);
+  if (groups.length === 0) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `${app.slug} has no module with a database`, {
+      hint: "qore db erd shows the Postgres of an app's modules; none of them declares a DATABASE_URL."
     });
   }
-  const findHint = deps2.platform === "win32" ? `netstat -ano | findstr :${o.port}` : `lsof -iTCP:${o.port} -sTCP:LISTEN`;
-  return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is already in use (needed by ${o.slug})`, {
-    hint: `Find it with: ${findHint}`,
-    details: { port: o.port, module: o.slug, key: o.key }
+  for (const gdb of groups) deps2.registerSecrets([gdb.url]);
+  if (!json2) for (const { modules: mods, connection: c } of groups) {
+    if (mods.length > 1) io2.err(`${mods.join(" and ")} use the same database (${c.host}:${c.port}/${c.database}); each module normally has its own \u2014 check their DATABASE_URL.`);
+  }
+  const readAll = (strict) => Promise.all(groups.map(async (gdb) => {
+    try {
+      const conn = await deps2.postgres(gdb.url, { timeoutMs: 3e3 });
+      try {
+        const model = await introspect(conn.query);
+        const migrations = gdb.modules.length === 1 ? await checkMigrations(roots.get(gdb.modules[0]) ?? null, conn.query) : void 0;
+        return { ...gdb, model, ...migrations ? { migrations } : {} };
+      } finally {
+        await conn.close().catch(() => {
+        });
+      }
+    } catch (e) {
+      const err = classifyDbError(e, gdb.url);
+      if (strict) throw err;
+      return { ...gdb, model: null, error: err.message };
+    }
+  }));
+  const first = await readAll(json2).catch((e) => {
+    throw ctx.signal.aborted ? new CancelledError() : e;
   });
-}
-async function composeFailure(deps2, r, slug, env, signal, message, command, stderr) {
-  if (!r.dockerServices) {
-    return new QoreError("QORE_SERVICE_UNHEALTHY", message, { details: { command, stderr } });
+  if (first.every((d) => d.model === null)) throw new QoreError("QORE_SERVICE_UNHEALTHY", `No database of ${app.slug} is reachable`, { hint: first.map((d) => `${d.key}: ${d.error}`).join("\n") });
+  const context = {
+    portal: portal.builtin ?? portal.apiOrigin,
+    tenant,
+    app,
+    module: null,
+    source: WORKSPACE_FILE,
+    modules: am.modules.map(({ id, slug, name, type }) => ({ id, slug, name, type, database: groups.find((gdb) => gdb.modules.includes(slug))?.key ?? null }))
+  };
+  const databases = groups.map(({ key: key2, modules: mods, connection }) => ({ key: key2, modules: mods, connection, source: sources.get(mods[0]) }));
+  if (json2) {
+    renderJson(io2, { context, databases, model: combineModels(first) });
+    return;
   }
-  const logs = await runTool(deps2, "docker", ["compose", "logs", "--no-color", "--tail", "50"], { cwd: r.root, env, onLine: () => {
-  }, signal });
-  const dataErr = classifyComposeLogs(logs.tail, { slug, script: "db:up" });
-  if (dataErr) return dataErr;
-  return new QoreError("QORE_SERVICE_UNHEALTHY", message, {
-    hint: `The last lines of docker compose logs are in details.logs; run \`docker compose logs\` in ${r.root} for all of them.`,
-    details: { command, stderr, logs: logs.tail.slice(-20) }
+  for (const d of first) if (d.error) io2.err(`${d.key} (${d.modules.join(", ")}): ${d.error}`);
+  for (const d of first) for (const line2 of migrationLines(d.migrations, `The database of ${d.modules.join(", ")}`)) io2.err(line2);
+  if (first.every((d) => !d.model || d.model.tables.length === 0)) io2.err("No tables yet \u2014 have the migrations run? Start the app once with `qore dev`.");
+  if (ctx.signal.aborted) throw new CancelledError();
+  const meta = { context, connection: null, databases: databases.map(({ key: key2, modules: mods, connection }) => ({ key: key2, modules: mods, connection })) };
+  const server = await serveErd({
+    dir: deps2.viewerDir,
+    port: f.port ?? 0,
+    routes: { "/model.json": () => readAll(false).then(combineModels), "/meta.json": async () => meta },
+    onError: (e) => {
+      if (!ctx.signal.aborted) io2.err(`Could not refresh the model: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }).catch((e) => {
+    const code = e.code;
+    throw f.port !== void 0 && (code === "EADDRINUSE" || code === "EACCES") ? portInUse(f.port) : e;
   });
+  await serve(ctx, f, server);
 }
-async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine, report) {
-  if (r.services.length === 0) {
-    report({ module: slug, step: "services", status: "skip" });
-    return;
+
+// src/cli/commands/dev.ts
+import { randomBytes as randomBytes6 } from "crypto";
+import { realpath as realpath8 } from "fs/promises";
+import { constants as constants3 } from "os";
+import { dirname as dirname7, join as join23, relative as relative7 } from "path";
+import { StringDecoder } from "string_decoder";
+
+// src/core/diagnostics/node.ts
+var KEEP_LINES = 50;
+function exitHint(tail, h) {
+  const text2 = tail.join("\n");
+  const missing = text2.match(/Cannot find (?:module|package) '([^']+)'/);
+  if (missing) {
+    return { reason: "missing-module", hint: `A dependency is missing (${missing[1]}). Run \`${h.installCommand}\`, then qore dev again.` };
   }
-  report({ module: slug, step: "services", status: "start", ...dbPort !== null ? { detail: `:${dbPort}` } : {} });
-  const began = deps2.now().getTime();
-  if (r.dockerServices) {
-    const res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: r.root, env, onLine, signal });
-    const dockerErr = classifyDockerInfo(res, deps2.platform);
-    if (dockerErr) throw dockerErr;
-    const compose = await runTool(deps2, "docker", ["compose", "version"], { cwd: r.root, env, onLine: () => {
-    }, signal });
-    const composeErr = classifyComposeVersion(compose);
-    if (composeErr) throw composeErr;
+  if (/ZodError:/.test(text2)) {
+    const keys = [...text2.matchAll(/"path":\s*\[\s*"([^"]+)"/g)].map((m) => m[1]);
+    if (keys.length > 0) {
+      return {
+        reason: "invalid-env",
+        keys,
+        hint: `Missing or invalid environment variables: ${keys.join(", ")}. Set them in the portal's local secrets (then qore env pull), or in your env file.`
+      };
+    }
   }
-  for (const script of r.services) {
-    const { cmd, args } = runArgs(r.pm, script);
-    const res = await runTool(deps2, cmd, args, { cwd: r.root, env, onLine, signal });
-    if (res.code !== 0) {
-      if (dbPort !== null && /port is already allocated|address already in use/i.test(res.tail.join("\n"))) {
-        throw await portInUseError(deps2, { slug, port: dbPort, key: "DB_PORT" });
-      }
-      throw await composeFailure(deps2, r, slug, env, signal, `${script} failed in ${slug}`, `${cmd} ${args.join(" ")}`, res.tail);
+  const addrInUse = text2.match(/listen EADDRINUSE: address already in use (?:\S*:)?(\d+)/);
+  if (addrInUse) {
+    const port = Number(addrInUse[1]);
+    return {
+      reason: "port-in-use",
+      port,
+      hint: `Port ${port} was taken while the server started. Run qore dev again; if it repeats, lsof -iTCP:${port} -sTCP:LISTEN names the holder.`
+    };
+  }
+  if (/ECONNREFUSED/.test(text2)) {
+    const m = text2.match(/ECONNREFUSED\s+\S*:(\d+)/) ?? text2.match(/code: 'ECONNREFUSED'[^}]*?port: (\d+)/);
+    if (!m) return { reason: "conn-refused", hint: "A connection was refused (ECONNREFUSED) \u2014 a service this module calls is not running." };
+    const port = Number(m[1]);
+    const role = h.ports.get(port);
+    if (role?.kind === "database") {
+      const up = h.runCommand("db:up");
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `The database on :${port} is not accepting connections (ECONNREFUSED). ` + (up ? `Fix: ${up}  (docker compose ps shows its state)` : "docker compose ps shows its state.")
+      };
     }
+    if (role?.kind === "provider") {
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `${role.key} points at :${port}, where nothing listens (ECONNREFUSED). Start that module \u2014 qore dev in the workspace root starts providers first.`
+      };
+    }
+    return { reason: "conn-refused", port, hint: `Nothing listens on :${port} (ECONNREFUSED) \u2014 a service this module calls is not running.` };
   }
-  if (dbPort !== null) {
-    const ok2 = await deps2.ports.waitFor(dbPort, waitMs, signal);
-    if (signal.aborted) throw new CancelledError();
-    if (!ok2) {
-      throw await composeFailure(
-        deps2,
-        r,
-        slug,
-        env,
-        signal,
-        `The database for ${slug} did not accept connections on port ${dbPort} within ${waitMs / 1e3} s`,
-        void 0,
-        []
-      );
+  const auth = text2.match(/password authentication failed for user "([^"]+)"/);
+  if (auth) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-auth",
+      hint: `The local database was created with other credentials than the portal now provides (user ${auth[1]}).` + (reset ? ` Fix: ${reset} \u2014 this wipes local data.` : "")
+    };
+  }
+  const relation = text2.match(/relation "([^"]+)" does not exist/);
+  if (relation) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-schema",
+      hint: `The database schema is behind the code (relation ${relation[1]} does not exist). Migrations run when the app starts; if they failed above, that error is the cause.` + (reset ? ` To start clean: ${reset} (wipes local data).` : "")
+    };
+  }
+  if (/ENOSPC: System limit for number of file watchers reached/.test(text2)) {
+    return {
+      reason: "watcher-limit",
+      hint: "Linux ran out of file watchers. Raise the limit: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p"
+    };
+  }
+  return null;
+}
+
+// src/core/dev/env.ts
+import { dirname as dirname6, join as join17 } from "path";
+
+// src/core/dev/lastStart.ts
+import { createHash as createHash2 } from "crypto";
+import { realpath as realpath6 } from "fs/promises";
+import { join as join16 } from "path";
+var NETWORK_REASONS = /* @__PURE__ */ new Set(["connect", "dns", "tls", "timeout"]);
+function isOffline(e) {
+  if (!(e instanceof QoreError)) return false;
+  if (e.code === "QORE_API_UNREACHABLE" || e.code === "QORE_API_UNAVAILABLE") return true;
+  if (e.code !== "QORE_AUTH_UNAVAILABLE") return false;
+  return (e.status ?? 0) >= 500 || NETWORK_REASONS.has(String(e.details?.reason));
+}
+async function stateKey(deps2, root) {
+  const real = await realpath6(root).catch(() => root);
+  return createHash2("sha256").update(trustKey(real, deps2.platform)).digest("hex").slice(0, 16);
+}
+async function saveLastStart(deps2, root, rec) {
+  await writeJsonAtomic(join16(deps2.config.dir, "dev"), `${await stateKey(deps2, root)}.json`, rec);
+}
+async function loadLastStart(deps2, root) {
+  const rec = await readJson(join16(deps2.config.dir, "dev", `${await stateKey(deps2, root)}.json`)).catch(() => null);
+  return rec && rec.schemaVersion === 1 ? rec : null;
+}
+
+// src/core/dev/env.ts
+function envPort(env, key2) {
+  const raw = env[key2];
+  if (raw === void 0) return null;
+  const v = raw.trim().replace(/^["']|["']$/g, "");
+  if (!/^\d+$/.test(v)) return null;
+  const n = Number(v);
+  return n >= 1024 && n <= 65535 ? n : null;
+}
+async function devEnv(deps2, o) {
+  const defaults = moduleDefaults(o.type);
+  const target = await resolveTarget(o.root, o.cfg.envFile ?? defaults.envFile);
+  let cause = null;
+  if (o.mc && o.app) {
+    try {
+      const local = await fetchLocalEnv(deps2, o.mc, o.app);
+      const example = await readOrNull(join17(dirname6(target), ".env.example"));
+      const w = await syncEnvFile({
+        target,
+        example,
+        fetched: local.env,
+        managed: local.managedKeys,
+        localSecrets: o.cfg.localSecrets ?? defaults.localSecrets,
+        random: o.random
+      });
+      return {
+        env: local.env,
+        offline: false,
+        envFile: target,
+        port: envPort(local.env, "PORT"),
+        dbPort: envPort(local.env, "DB_PORT"),
+        ...w
+      };
+    } catch (e) {
+      if (!isOffline(e)) throw e;
+      cause = e;
     }
   }
-  const took = secs(deps2.now().getTime() - began);
-  report({ module: slug, step: "services", status: "done", detail: dbPort !== null ? `:${dbPort} (${took})` : `(${took})` });
+  const text2 = await readOrNull(target);
+  if (text2 === null || !await isTrusted(deps2, o.root, o.moduleId)) {
+    throw cause ?? new QoreError("QORE_API_UNREACHABLE", "The portal is unreachable", {
+      hint: "The portal is unreachable and there is no env file to start from yet."
+    });
+  }
+  const env = Object.fromEntries(parseEnv(text2));
+  return { env, offline: true, envFile: target, port: envPort(env, "PORT"), dbPort: envPort(env, "DB_PORT"), created: false, kept: [] };
 }
-async function checkPort(deps2, o) {
-  if (o.port === null) return;
-  if (!await deps2.ports.inUse(o.port)) return;
-  throw await portInUseError(deps2, { slug: o.slug, port: o.port, key: o.key, runs: o.runs });
+
+// src/core/workspace/access.ts
+function devTeamsOf(am, m) {
+  const own = m.devTeamIds?.length ? am.devTeams.filter((t) => m.devTeamIds.includes(t.id)) : [];
+  return own.length ? own : am.devTeams;
 }
-function abortableDelay(signal) {
-  return (ms2) => new Promise((resolve6) => {
-    const done = () => {
-      clearTimeout(t);
-      signal.removeEventListener("abort", done);
-      resolve6();
-    };
-    const t = setTimeout(done, ms2);
-    signal.addEventListener("abort", done, { once: true });
-  });
+function askMaintainer(am, m) {
+  const teams = devTeamsOf(am, m);
+  const names = teams.map((t) => t.name);
+  const maintainers = [...new Set(teams.flatMap((t) => t.maintainers))];
+  const who = names.length ? names.join(", ") : "the app's dev team";
+  return { teams: names, maintainers, text: `ask a maintainer of ${who}${maintainers.length ? ` (${maintainers.join(", ")})` : ""}` };
+}
+function notClonedReason(m, am) {
+  if (am && !m.githubLinked) return `GitHub account not linked (${am.accountUrl})`;
+  if (am && m.repoAccess === "none") {
+    const names = devTeamsOf(am, m).map((t) => t.name);
+    return names.length ? `no repository access (dev team ${names.join(", ")})` : "no repository access (ask your tenant owner)";
+  }
+  return "run qore sync";
+}
+
+// src/core/dev/findings.ts
+var plural2 = (n, one2, many) => n === 1 ? one2 : many;
+function modulesMissing(o) {
+  const actionFor = new Map(o.actions.map((a) => [a.module.slug, a]));
+  const findings = [];
+  const fixable = [];
+  const blocked = [];
+  const reasons = {};
+  const own = (m, reason, rest) => {
+    reasons[m.slug] = reason;
+    return { code: "dev.modules-missing", severity: "warn", module: m.slug, modules: [m.slug], message: `${m.slug} is not cloned \u2014 ${reason}`, ...rest };
+  };
+  for (const m of o.missing) {
+    const a = actionFor.get(m.slug);
+    if (a && a.kind !== "clone") {
+      if (a.kind === "conflict") {
+        const c = conflictText(o.cwd, a);
+        blocked.push(own(m, c.message, { action: { command: c.hint } }));
+      } else if (a.kind === "unsupported") {
+        blocked.push(own(m, "its repository URL is not supported", { action: { command: unsupportedRepoUrlError(m.slug, "").hint } }));
+      } else {
+        blocked.push(own(m, a.reason ?? "no repository yet", { why: "It will not run in this session." }));
+      }
+    } else if (o.am !== null && (!m.githubLinked || m.repoAccess === "none")) {
+      const am = o.am;
+      blocked.push(own(m, notClonedReason(m, am), { action: { command: !m.githubLinked ? `Link your GitHub account: ${am.accountUrl}` : askMaintainer(am, m).text } }));
+    } else fixable.push(m);
+  }
+  if (fixable.length > 0) {
+    const slugs = fixable.map((m) => m.slug);
+    const deps2 = slugs.flatMap((s) => (o.consumers[s] ?? []).map((c) => `${c} depends on ${s}`));
+    findings.push({
+      code: "dev.modules-missing",
+      severity: "warn",
+      message: `${fixable.length} ${plural2(fixable.length, "module of this app is", "modules of this app are")} not cloned: ${slugs.join(", ")}`,
+      why: deps2.length > 0 ? `${deps2.join("; ")}.` : `${plural2(fixable.length, "It", "They")} will not run in this session.`,
+      modules: slugs,
+      action: o.am ? { command: "qore sync", fix: "sync" } : { command: "qore sync" }
+    });
+  }
+  return { findings: [...findings, ...blocked], fixable, reasons };
+}
+function strayClone(name, appName) {
+  return { code: "dev.stray-clone", severity: "info", module: name, message: `${name} is no longer part of ${appName} \u2014 you can remove the directory.` };
+}
+function repoBehind(slug, s, o) {
+  if (!s.ok || !s.upstream || !s.behind) return null;
+  return {
+    code: "dev.repo-behind",
+    severity: "warn",
+    module: slug,
+    message: `${slug} is ${s.behind} ${plural2(s.behind, "commit", "commits")} behind ${s.upstreamRef ?? "its upstream"} (as of your last fetch).`,
+    action: { command: o.workspace ? "qore sync --pull" : "git pull" }
+  };
+}
+function servicesMissing(slug, env, recipe, o) {
+  const db = envPort(env, "DB_PORT");
+  if (db === null || recipe.services.length > 0 || !o.servicesFlag || o.configured) return null;
+  return {
+    code: "dev.services-missing",
+    severity: "warn",
+    module: slug,
+    message: `The portal gives ${slug} a database (DB_PORT=${db}), but ${slug} has no db:up script \u2014 no database will be started.`,
+    why: "This repository is probably older than its template.",
+    action: { command: 'add a "db:up" script (see the current app template), or set dev.services in .qore.json' }
+  };
+}
+function providerDown(o) {
+  const single = o.providers.length === 1 && o.keys.length === 1;
+  return {
+    code: "dev.provider-down",
+    severity: "warn",
+    module: o.slug,
+    modules: o.providers,
+    message: single ? `${o.providers[0]} is not running \u2014 ${o.keys[0]} points at :${o.ports.get(o.keys[0])}, where nothing listens.` : `${o.keys.join(", ")} ${plural2(o.keys.length, "points", "point")} at ports nothing listens on (depends on: ${o.providers.join(", ")}).`,
+    why: single ? `${o.slug} will start, but calls to ${o.providers[0]} will fail. Qore does not fall back to staging.` : `${o.slug} will start, but calls through ${o.keys.join(", ")} will fail. Qore does not fall back to staging.`,
+    action: { command: o.fix }
+  };
 }
-async function waitForDocker(deps2, o) {
-  const delay = o.delay ?? abortableDelay(o.signal);
-  const now = o.now ?? Date.now;
-  const deadline = now() + o.timeoutMs;
-  for (; ; ) {
-    await delay(Math.min(o.pollMs, Math.max(0, deadline - now())));
-    if (o.signal.aborted) throw new CancelledError();
-    const remaining = deadline - now();
-    if (remaining <= 0) return false;
-    const poll = AbortSignal.any([o.signal, AbortSignal.timeout(remaining)]);
-    let res;
-    try {
-      res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: o.cwd, env: o.env ?? deps2.env, onLine: () => {
-      }, signal: poll });
-    } catch (e) {
-      if (e instanceof CancelledError && !o.signal.aborted) return false;
-      throw e;
-    }
-    if (classifyDockerInfo(res, deps2.platform) === null) return true;
+
+// src/core/dev/project.ts
+import { access, readFile as readFile7 } from "fs/promises";
+import { join as join18 } from "path";
+var LEGACY_DEV_SCRIPTS = ["node --env-file=.env --import ./dist/instrumentation.js dist/index.js"];
+var LOCKFILES = [["pnpm-lock.yaml", "pnpm"], ["package-lock.json", "npm"], ["yarn.lock", "yarn"]];
+var exists = (p) => access(p).then(() => true, () => false);
+var unsupported = (message, hint, details) => new QoreError("QORE_DEV_UNSUPPORTED", message, { hint, details });
+async function readPackageJson(root) {
+  let raw;
+  try {
+    raw = await readFile7(join18(root, "package.json"), "utf8");
+  } catch {
+    throw unsupported("This repository has no package.json", "qore dev starts Node repositories through their package.json scripts.");
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw unsupported("package.json is not valid JSON", "Fix package.json, then run qore dev again.");
   }
 }
-var MAX_PARENT_HOPS = 10;
-var AGE_SLACK_S = 5;
-async function leftoverOwnsPort(deps2, run4, port) {
-  if (deps2.platform === "win32" || !deps2.launch.signal(run4.qorePid, 0)) return false;
-  const { ageSeconds } = await deps2.ports.ownerDetail(run4.qorePid);
-  const recordAge = (deps2.now().getTime() - Date.parse(run4.startedAt)) / 1e3;
-  if (ageSeconds === null || !Number.isFinite(recordAge) || ageSeconds < recordAge - AGE_SLACK_S) return false;
-  const ours = /* @__PURE__ */ new Set([run4.qorePid, ...run4.children.map((c) => c.pid).filter((p) => p !== null)]);
-  let pid = (await deps2.ports.owner(port))?.pid ?? null;
-  for (let hop = 0; pid !== null && pid > 1 && hop <= MAX_PARENT_HOPS; hop++) {
-    if (ours.has(pid)) return true;
-    pid = await deps2.ports.parentPid(pid);
+async function detectPackageManager(root, pkg) {
+  if (typeof pkg.packageManager === "string") {
+    const m = /^(pnpm|npm|yarn)@(.+)$/.exec(pkg.packageManager.trim());
+    if (!m) throw unsupported(`packageManager "${pkg.packageManager}" is not pnpm, npm or yarn`, "qore dev supports pnpm, npm and yarn.");
+    return { name: m[1], version: m[2].split("+")[0] };
   }
-  return false;
+  for (const [file, name] of LOCKFILES) if (await exists(join18(root, file))) return { name, version: null };
+  throw unsupported("No package manager declared and no lockfile found", 'Add "packageManager": "pnpm@<version>" to package.json.');
 }
-
-// src/core/dev/providers.ts
-var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-function connPorts(env) {
-  const out = [];
-  for (const key of Object.keys(env).sort()) {
-    const m = /^CONN_(.+)_URL$/.exec(key);
-    if (!m) continue;
-    let url;
-    try {
-      url = new URL(env[key].trim().replace(/^["']|["']$/g, ""));
-    } catch {
-      continue;
+function planRecipe(o) {
+  const scripts = o.pkg.scripts ?? {};
+  const script = o.cfg.dev?.script ?? "dev";
+  const found = scripts[script];
+  if (found === void 0) {
+    throw unsupported(`${o.slug} has no "${script}" script in package.json`, 'Add a "dev" script, or set dev.script in .qore.json.', { script });
+  }
+  if (LEGACY_DEV_SCRIPTS.includes(found.trim())) {
+    throw unsupported(
+      `${o.slug}'s dev script is the old backend one, which needs a build and a .env first`,
+      'Update it to the current template: "dev": "node scripts/dev.mjs" plus scripts/dev.mjs.',
+      { script, found }
+    );
+  }
+  const configured = o.cfg.dev?.services;
+  for (const s of configured ?? []) {
+    if (scripts[s] === void 0) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `.qore.json: dev.services names "${s}", which is not a script in package.json`, {
+        hint: "Fix dev.services in .qore.json."
+      });
     }
-    const port = Number(url.port);
-    if (port > 0 && LOCAL_HOSTS.has(url.hostname)) out.push({ key, alias: m[1], port });
   }
-  return out;
-}
-function deadAliases(env, listening) {
-  return connPorts(env).filter((c) => !listening.has(c.port)).map((c) => c.key);
-}
-function hintContext(recipe, pkg, env) {
-  const { cmd, args } = installArgs(recipe.pm);
-  const ports = /* @__PURE__ */ new Map();
-  for (const c of connPorts(env)) ports.set(c.port, { kind: "provider", key: c.key });
-  const db = envPort(env, "DB_PORT");
-  if (db !== null) ports.set(db, { kind: "database" });
+  const services = !o.flags.services ? [] : configured ?? (scripts["db:up"] !== void 0 ? ["db:up"] : []);
   return {
-    installCommand: [cmd, ...args].join(" "),
-    runCommand: (script) => {
-      if (pkg.scripts?.[script] === void 0) return null;
-      const r = runArgs(recipe.pm, script);
-      return [r.cmd, ...r.args].join(" ");
-    },
-    ports
+    root: o.root,
+    pm: o.pm,
+    script,
+    services,
+    install: (o.cfg.dev?.install ?? true) && o.flags.install,
+    dockerServices: services.some((s) => /\bdocker\b/.test(scripts[s] ?? ""))
   };
 }
+function runArgs(pm, script) {
+  return { cmd: pm.name, args: ["run", script] };
+}
+function installArgs(pm) {
+  return { cmd: pm.name, args: ["install"] };
+}
 
-// src/core/dev/runFile.ts
-import { unlink as unlink2 } from "fs/promises";
-import { join as join17 } from "path";
-async function runFilePath(deps2, root) {
-  const dir2 = join17(deps2.config.dir, "run");
-  const name = `${await stateKey(deps2, root)}.json`;
-  return { dir: dir2, name, path: join17(dir2, name) };
+// src/core/dev/install.ts
+import { stat as stat5 } from "fs/promises";
+import { join as join19 } from "path";
+var MARKERS = {
+  pnpm: [".modules.yaml"],
+  npm: [".package-lock.json"],
+  yarn: [".yarn-state.yml", ".yarn-integrity"]
+};
+var LOCK2 = { pnpm: "pnpm-lock.yaml", npm: "package-lock.json", yarn: "yarn.lock" };
+var mtime = (p) => stat5(p).then((s) => s.mtimeMs, () => null);
+async function needsInstall(root, pm) {
+  if (await mtime(join19(root, "node_modules")) === null) return true;
+  let marker = null;
+  for (const m of MARKERS[pm.name]) marker ??= await mtime(join19(root, "node_modules", m));
+  if (marker === null) return true;
+  const lock = await mtime(join19(root, LOCK2[pm.name]));
+  return lock !== null && lock > marker;
 }
-async function writeRunFile(deps2, root, rec) {
-  const { dir: dir2, name } = await runFilePath(deps2, root);
-  await writeJsonAtomic(dir2, name, rec);
+
+// src/core/diagnostics/docker.ts
+function dockerInstallUrl(platform) {
+  if (platform === "darwin") return "https://docs.docker.com/desktop/setup/install/mac-install/";
+  if (platform === "win32") return "https://docs.docker.com/desktop/setup/install/windows-install/";
+  return "https://docs.docker.com/engine/install/";
 }
-async function removeRunFile(deps2, root) {
-  const { path } = await runFilePath(deps2, root);
-  await unlink2(path).catch(() => {
-  });
+function classifyDockerInfo(r, platform) {
+  if (r.spawnError === "ENOENT") {
+    return new QoreError("QORE_DOCKER_MISSING", "Docker is not installed", {
+      hint: `Install Docker: ${dockerInstallUrl(platform)} \u2014 or run qore dev --no-services.`
+    });
+  }
+  if (r.code === 0) return null;
+  const hint = "Start Docker Desktop, then run qore dev again \u2014 or qore dev --no-services.";
+  if (/Cannot connect to the Docker daemon|Is the docker daemon running|error during connect/i.test(r.tail.join("\n"))) {
+    return new QoreError("QORE_DOCKER_NOT_RUNNING", "Docker is not running", { hint, details: { reason: "daemon" } });
+  }
+  return new QoreError("QORE_DOCKER_NOT_RUNNING", "Docker is not running", { hint, details: { stderr: r.tail } });
 }
-async function leftoverRun(deps2, root, o = {}) {
-  const { path } = await runFilePath(deps2, root);
-  const rec = await readJson(path).catch(() => null);
-  if (!rec || rec.schemaVersion !== 1) return null;
-  if (deps2.launch.isAlive(rec.qorePid)) return rec;
-  if (o.prune !== false) await unlink2(path).catch(() => {
-  });
-  return null;
+function classifyComposeVersion(r) {
+  if (r.code === 0) return null;
+  const hint = "Update Docker Desktop (or install the compose plugin). The legacy docker-compose v1 is not supported.";
+  if (/unknown command: docker compose|'compose' is not a docker command/.test(r.tail.join("\n"))) {
+    return new QoreError("QORE_DOCKER_COMPOSE_MISSING", "Docker Compose v2 is missing", { hint });
+  }
+  return new QoreError("QORE_DOCKER_COMPOSE_MISSING", "Docker Compose v2 is missing", { hint, details: { stderr: r.tail } });
 }
 
-// src/cli/project.ts
-import { readdir as readdir2, stat as stat4 } from "fs/promises";
-import { join as join18 } from "path";
+// src/core/diagnostics/postgres.ts
+var INCOMPATIBLE = /database files are incompatible with server|Counter to that, there appears to be PostgreSQL data in|in 18\+, these Docker images are configured to store database data/;
+function classifyComposeLogs(logs, o) {
+  const text2 = logs.join("\n");
+  if (!INCOMPATIBLE.test(text2)) return null;
+  const details = { reason: "pg-data-version" };
+  const m = text2.match(/initialized by PostgreSQL version (\d+).*this version (\d+)/);
+  if (m) {
+    details.found = m[1];
+    details.expected = m[2];
+  }
+  return new QoreError("QORE_SERVICE_DATA_INCOMPATIBLE", `The local database volume of ${o.slug} was created by another Postgres version`, {
+    hint: "pnpm db:reset recreates it \u2014 this deletes all local data in it. Qore never runs it for you.",
+    details
+  });
+}
 
-// src/core/projects/match.ts
-function readings(ref) {
-  const s = ref.split("/").map((x) => x.trim());
-  if (s.some((x) => x === "")) return [];
-  if (s.length === 1) return [{ app: s[0] }];
-  if (s.length === 2) return [{ app: s[0], module: s[1] }, { tenant: s[0], app: s[1] }];
-  if (s.length === 3) return [{ tenant: s[0], app: s[1], module: s[2] }];
-  return [];
+// src/core/diagnostics/ports.ts
+function parseDockerPs(stdout) {
+  const line2 = stdout.split(/\r?\n/).find((l) => l.trim());
+  if (!line2) return null;
+  const [id, name, project, workingDir] = line2.split("	");
+  if (!id || !name) return null;
+  return { id, name, project: project || null, workingDir: workingDir || null };
 }
-function hit(p, w) {
-  if (p.appSlug !== w.app || w.tenant !== void 0 && p.tenantSlug !== w.tenant) return null;
-  if (p.kind === "module") return w.module === p.moduleSlug ? { project: p } : null;
-  return w.module ? { project: p, module: w.module } : { project: p };
+function parseLsofCwd(stdout) {
+  const m = stdout.match(/^fcwd\nn(.+)$/m);
+  return m ? m[1] : null;
 }
-function matchProjects(projects, ref) {
-  const out = [];
-  for (const w of readings(ref)) {
-    for (const p of projects) {
-      const m = hit(p, w);
-      if (m) out.push(m);
+function parseEtime(s) {
+  const m = s.trim().match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/);
+  if (!m) return null;
+  const days = m[1] ? Number(m[1]) : 0;
+  const hours = m[2] ? Number(m[2]) : 0;
+  const minutes = Number(m[3]);
+  const seconds = Number(m[4]);
+  return days * 86400 + hours * 3600 + minutes * 60 + seconds;
+}
+function humanAge(seconds) {
+  if (seconds < 60) return `${seconds} s`;
+  if (seconds < 3600) return `${Math.round(seconds / 60)} min`;
+  if (seconds < 86400) return `${Math.round(seconds / 3600)} h`;
+  return `${Math.round(seconds / 86400)} d`;
+}
+
+// src/core/diagnostics/pm.ts
+function pmVersionMismatch(pm, printed) {
+  if (pm.version === null) return null;
+  const lines = printed.split("\n");
+  let found = null;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line2 = lines[i].trim();
+    if (/^\d+\.\d+\.\d+/.test(line2)) {
+      found = line2;
+      break;
     }
   }
-  return out;
+  if (found === null) return null;
+  if (found.split(".")[0] === pm.version.split(".")[0]) return null;
+  return new QoreError("QORE_PACKAGE_MANAGER", `${pm.name} ${found} does not match the pinned ${pm.name}@${pm.version}`, {
+    hint: `Install the pinned major: npm i -g ${pm.name}@${pm.version.split(".")[0]}. (pnpm \u2265 9.7 switches to the pinned version by itself.)`,
+    details: { found, pinned: pm.version }
+  });
+}
+function classifyInstall(tail, command, root) {
+  const joined = tail.join("\n");
+  if (/ERR_PNPM_OUTDATED_LOCKFILE/.test(joined)) {
+    return new QoreError("QORE_INSTALL_FAILED", "The lockfile does not match package.json", {
+      hint: `Someone committed one without the other. Run \`${command} --no-frozen-lockfile\` in ${root} and commit the lockfile.`,
+      details: { reason: "outdated-lockfile", command, stderr: tail }
+    });
+  }
+  return new QoreError("QORE_INSTALL_FAILED", `${command} failed`, {
+    hint: `Run \`${command}\` in ${root} to see the full output.`,
+    details: { command, stderr: tail }
+  });
 }
 
-// src/cli/project.ts
-async function loggedInAs(ctx) {
-  const cfg = await ctx.deps.config.read();
-  const portal = resolvePortal(ctx.opts().portal, cfg.defaultProfile);
-  const p = cfg.profiles[portal.apiOrigin];
-  if (!p || !await new TokenStore(ctx.deps.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return null;
-  return p.email ?? p.sub ?? portal.apiOrigin;
+// src/core/diagnostics/versions.ts
+import semver from "semver";
+function nodeSatisfies(found, range) {
+  if (semver.validRange(range) === null) return null;
+  return semver.satisfies(found, range);
 }
-var isDir = async (p) => (await stat4(p).catch(() => null))?.isDirectory() ?? false;
-var label2 = (p) => `${p.tenantSlug} / ${p.appSlug}${p.kind === "module" ? ` / ${p.moduleSlug}` : ""}${p.source === "registry" ? `  (${p.path})` : ""}`;
-var candidate = (p) => p.kind === "module" ? { kind: "module", id: p.moduleId, slug: p.moduleSlug, tenant: p.tenantSlug, name: p.path } : { kind: "app", slug: p.appSlug, tenant: p.tenantSlug, name: p.path };
-var withCwd = (ctx, cwd) => ({ ...ctx, deps: { ...ctx.deps, cwd } });
-async function standingIn(ctx) {
-  if (await findWorkspace(ctx.deps.cwd, ctx.deps.home)) return "workspace";
-  const repo = await findRepoRoot(ctx.deps.cwd);
-  return repo !== null && !isInside(repo, ctx.deps.home) ? { repo } : null;
+function nodeVersionError(found, range, slug) {
+  const min = semver.minVersion(range);
+  const major = min ? min.major : range;
+  return new QoreError("QORE_NODE_VERSION", `${slug} needs Node ${range}, found ${found}`, {
+    hint: `nvm install ${major} / fnm use ${major}, then run qore dev again.`,
+    details: { found, required: range }
+  });
 }
-async function isForeign(ctx, command) {
-  const g = ctx.opts();
+
+// src/core/dev/preflight.ts
+var pmMajor = (v) => v ? v.split(".")[0] : "latest";
+var GRACE_MS = 1e4;
+var secs = (ms2) => `${Math.round(ms2 / 1e3)} s`;
+async function runTool(deps2, cmd, args, o) {
+  if (o.signal.aborted) throw new CancelledError();
+  const tail = [];
+  const c = deps2.launch.launch(cmd, args, { cwd: o.cwd, env: { ...o.env, LC_ALL: "C" }, onLine: (l) => {
+    tail.push(l.line);
+    if (tail.length > 50) tail.shift();
+    o.onLine(l);
+  } });
+  let kill;
+  const onAbort = () => {
+    c.stop("SIGTERM");
+    kill = setTimeout(() => c.stop("SIGKILL"), GRACE_MS);
+  };
+  o.signal.addEventListener("abort", onAbort, { once: true });
+  let exit;
   try {
-    await resolveModuleContext(ctx.deps, { portal: g.portal, command, onRequest: g.verbose ? (l) => ctx.io.err(l) : void 0 });
-    return false;
-  } catch (e) {
-    if (e instanceof CancelledError) throw e;
-    return isForeignRepo(e);
+    exit = await c.exited;
+  } finally {
+    o.signal.removeEventListener("abort", onAbort);
+    clearTimeout(kill);
   }
+  if (o.signal.aborted) throw new CancelledError();
+  return { code: exit.code, spawnError: exit.spawnError, tail };
 }
-async function moduleDirs(wsPath) {
-  const out = [];
-  for (const d of await readdir2(wsPath, { withFileTypes: true }).catch(() => [])) {
-    if (d.isDirectory() && !d.name.startsWith(".") && await stat4(join18(wsPath, d.name, ".git")).catch(() => null)) out.push(d.name);
+async function checkPackageManager(deps2, r, onLine, signal) {
+  const res = await runTool(deps2, r.pm.name, ["--version"], { cwd: r.root, env: deps2.env, onLine, signal });
+  const hint = `Install it: npm i -g ${r.pm.name}@${pmMajor(r.pm.version)}`;
+  if (res.spawnError === "ENOENT") {
+    throw new QoreError("QORE_PACKAGE_MANAGER", `${r.pm.name} is not installed`, { hint, details: { packageManager: r.pm } });
   }
-  return out.sort();
-}
-async function pathFor(ctx, m, needModule) {
-  const p = m.project;
-  if (p.kind === "module") return p.path;
-  if (m.module) {
-    const dir2 = join18(p.path, m.module);
-    if (!await isDir(dir2)) {
-      throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no checkout of module ${m.module} in ${p.path}`, {
-        hint: `Run \`qore sync\` in ${p.path} to clone the app's missing modules.`
-      });
-    }
-    return dir2;
+  if (res.code !== 0) {
+    throw new QoreError("QORE_PACKAGE_MANAGER", `${r.pm.name} is not installed`, { hint, details: { packageManager: r.pm, stderr: res.tail } });
   }
-  if (!needModule) return p.path;
-  const dirs = await moduleDirs(p.path);
-  if (dirs.length === 1) return join18(p.path, dirs[0]);
-  if (dirs.length === 0) {
-    throw new QoreError("QORE_PROJECT_NOT_FOUND", `${p.appSlug} has no module checkouts in ${p.path}`, {
-      hint: `Run \`qore sync\` in ${p.path}.`
+  const mismatch = pmVersionMismatch(r.pm, res.tail.join("\n"));
+  if (mismatch) throw mismatch;
+  return res.tail.map((l) => l.trim()).findLast((l) => /^\d+\.\d+\.\d+/.test(l)) ?? null;
+}
+async function checkNode(deps2, r, pkg, slug, signal) {
+  const range = pkg.engines?.node;
+  if (!range) return null;
+  const res = await runTool(deps2, "node", ["--version"], { cwd: r.root, env: deps2.env, onLine: () => {
+  }, signal });
+  if (res.spawnError === "ENOENT") {
+    throw new QoreError("QORE_NODE_VERSION", "node is not on PATH", {
+      hint: "Install Node (https://nodejs.org) or run nvm use, then reinstall qore.",
+      details: { required: range }
     });
   }
-  if (!ctx.io.interactive) {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", `${p.appSlug} has several modules \u2014 which one?`, {
-      hint: `Pass ${p.appSlug}/<module>.`,
-      candidates: dirs.map((slug) => ({ kind: "module", slug, tenant: p.tenantSlug, name: join18(p.path, slug) }))
-    });
+  if (res.spawnError || res.code !== 0) {
+    throw new QoreError("QORE_NODE_VERSION", "node --version failed", { details: { required: range, stderr: res.tail } });
   }
-  return join18(p.path, await ctx.io.select("Select a module", dirs.map((d) => ({ name: d, value: d }))));
+  const found = (res.tail.at(-1) ?? "").trim().replace(/^v/, "");
+  if (nodeSatisfies(found, range) === false) throw nodeVersionError(found, range, slug);
+  return found;
 }
-async function liveMatches(matches) {
-  const live = [];
-  for (const m of matches) {
-    if (m.project.kind === "workspace" && m.module && !await isDir(join18(m.project.path, m.module))) continue;
-    live.push(m);
+async function installIfNeeded(deps2, r, slug, onLine, report, signal) {
+  if (!r.install) {
+    report({ module: slug, step: "install", status: "skip", detail: "disabled" });
+    return;
   }
-  return live.length > 0 ? live : matches;
+  if (!await needsInstall(r.root, r.pm)) {
+    report({ module: slug, step: "install", status: "skip", detail: "up to date" });
+    return;
+  }
+  report({ module: slug, step: "install", status: "start" });
+  const began = deps2.now().getTime();
+  const { cmd, args } = installArgs(r.pm);
+  const res = await runTool(deps2, cmd, args, { cwd: r.root, env: deps2.env, onLine, signal });
+  if (res.code !== 0) {
+    const command = [cmd, ...args].join(" ");
+    const err = classifyInstall(res.tail, command, r.root);
+    if (err.details?.reason === "outdated-lockfile") throw err;
+    throw new QoreError("QORE_INSTALL_FAILED", `${command} failed in ${slug}`, { hint: err.hint, details: err.details });
+  }
+  report({ module: slug, step: "install", status: "done", detail: secs(deps2.now().getTime() - began) });
 }
-async function choose(ctx, matches, what, explicit) {
-  if (explicit && matches.length === 1) return matches[0];
-  if (!ctx.io.interactive) {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", what, {
-      hint: "Pass a more specific reference: tenant/app or app/module.",
-      candidates: matches.map((m) => candidate(m.project))
+async function portInUseError(deps2, o) {
+  const owner = await deps2.ports.owner(o.port);
+  const qoreRun = (o.runs ?? []).find((r) => r.children.some((c) => c.port === o.port) || owner !== null && (r.qorePid === owner.pid || r.children.some((c) => c.pid === owner.pid)));
+  if (qoreRun) {
+    return new QoreError("QORE_PORT_IN_USE", `A previous qore dev is still running (pid ${qoreRun.qorePid})`, {
+      hint: `Stop it (Ctrl+C in its terminal, or kill ${qoreRun.qorePid}), then run qore dev again.`,
+      details: { port: o.port, module: o.slug, key: o.key, owner: "qore", pid: qoreRun.qorePid }
     });
   }
-  const i = await ctx.io.select("Select a project", matches.map((m, idx) => ({
-    name: m.module ? `${label2(m.project)} / ${m.module}` : label2(m.project),
-    value: idx
-  })));
-  return matches[i];
-}
-async function projectCtx(ctx, o) {
-  const g = ctx.opts();
-  const cfg = await ctx.deps.config.read();
-  const portal = g.portal ? resolvePortal(g.portal, cfg.defaultProfile).apiOrigin : void 0;
-  if (o.ref) {
-    const matches = matchProjects(await knownProjects(ctx.deps, { portal }), o.ref);
-    if (matches.length === 0) {
-      const parts = o.ref.split("/");
-      const app = parts.length === 1 ? o.ref : parts.length === 3 ? parts[1] : "<app>";
-      throw new QoreError("QORE_PROJECT_NOT_FOUND", `No local project "${o.ref}"`, {
-        hint: cfg.projectsRoot ? `Run \`qore clone ${app}\`.` : `Run \`qore init\`, or \`qore clone ${app}\`.`
-      });
+  if (owner) {
+    if (/^(com\.docker\.backend|com\.docker\.vpnkit|docker-proxy|vpnkit|dockerd)$/.test(owner.command)) {
+      const pub = await deps2.ports.dockerPublisher(o.port);
+      if (pub) {
+        return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is held by the Docker container ${pub.name} (needed by ${o.slug})`, {
+          hint: `It belongs to compose project ${pub.project} in ${pub.workingDir} \u2014 typically another module's or tenant's database. Stop it there with docker compose down, or docker stop ${pub.name}.`,
+          details: { port: o.port, module: o.slug, key: o.key, owner: "docker", ...pub }
+        });
+      }
     }
-    const m2 = await choose(ctx, await liveMatches(matches), `"${o.ref}" matches several projects`, true);
-    return relocate(ctx, await pathFor(ctx, m2, o.needModule));
-  }
-  if (o.module || o.app) return ctx;
-  const here = await standingIn(ctx);
-  if (here === "workspace") return ctx;
-  const known = await knownProjects(ctx.deps, { portal });
-  if (here && (known.length === 0 || known.some((p) => isInside(p.path, here.repo)) || !await isForeign(ctx, o.command ?? "project"))) return ctx;
-  if (known.length === 0) {
-    if (!cfg.projectsRoot) {
-      if (!await loggedInAs(ctx)) return ctx;
-      throw new QoreError("QORE_ROOT_NOT_SET", "Not inside a project, and qore knows no projects yet", {
-        hint: "Run `qore init` to choose a projects folder, or cd into a project."
-      });
+    const detail2 = await deps2.ports.ownerDetail(owner.pid);
+    const extras = [];
+    if (detail2.ageSeconds !== null) extras.push(`started ${humanAge(detail2.ageSeconds)} ago`);
+    if (detail2.cwd !== null) {
+      const cwd = deps2.home && detail2.cwd.startsWith(deps2.home) ? `~${detail2.cwd.slice(deps2.home.length)}` : detail2.cwd;
+      extras.push(`in ${cwd}`);
     }
-    throw new QoreError("QORE_PROJECT_NOT_FOUND", `Not inside a project, and ${cfg.projectsRoot} holds none yet`, {
-      hint: "Run `qore clone <app>`."
+    const suffix = extras.length ? `, ${extras.join(" ")}` : "";
+    return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is already in use (needed by ${o.slug})`, {
+      hint: `Held by: ${owner.command} (pid ${owner.pid})${suffix}. Stop that process. Qore never moves a port: other modules and the local login rely on ${o.port}.`,
+      details: {
+        port: o.port,
+        module: o.slug,
+        key: o.key,
+        owner: "process",
+        pid: owner.pid,
+        command: owner.command,
+        ...detail2.cwd !== null ? { cwd: detail2.cwd } : {},
+        ...detail2.ageSeconds !== null ? { ageSeconds: detail2.ageSeconds } : {}
+      }
     });
   }
-  const what = here ? "This repository is not a Qore module \u2014 which project?" : "Not inside a project \u2014 which one?";
-  const m = await choose(ctx, known.map((project) => ({ project })), what, false);
-  return relocate(ctx, await pathFor(ctx, m, o.needModule));
+  const findHint = deps2.platform === "win32" ? `netstat -ano | findstr :${o.port}` : `lsof -iTCP:${o.port} -sTCP:LISTEN`;
+  return new QoreError("QORE_PORT_IN_USE", `Port ${o.port} is already in use (needed by ${o.slug})`, {
+    hint: `Find it with: ${findHint}`,
+    details: { port: o.port, module: o.slug, key: o.key }
+  });
 }
-function relocate(ctx, path) {
-  if (path === ctx.deps.cwd) return ctx;
-  if (!ctx.opts().json) ctx.io.err(`\u2192 in ${path}`);
-  return withCwd(ctx, path);
+async function composeFailure(deps2, r, slug, env, signal, message, command, stderr) {
+  if (!r.dockerServices) {
+    return new QoreError("QORE_SERVICE_UNHEALTHY", message, { details: { command, stderr } });
+  }
+  const logs = await runTool(deps2, "docker", ["compose", "logs", "--no-color", "--tail", "50"], { cwd: r.root, env, onLine: () => {
+  }, signal });
+  const dataErr = classifyComposeLogs(logs.tail, { slug, script: "db:up" });
+  if (dataErr) return dataErr;
+  return new QoreError("QORE_SERVICE_UNHEALTHY", message, {
+    hint: `The last lines of docker compose logs are in details.logs; run \`docker compose logs\` in ${r.root} for all of them.`,
+    details: { command, stderr, logs: logs.tail.slice(-20) }
+  });
 }
-async function rememberContext(ctx, mc, app) {
-  const tenantSlug = mc.module.tenant.slug;
-  if (mc.workspace && mc.workspace.appId === app.id) {
-    await remember(ctx.deps, {
-      kind: "workspace",
-      path: mc.workspace.root,
-      portal: mc.workspace.portal,
-      tenantSlug,
-      appId: app.id,
-      appSlug: app.slug
-    });
+async function startServices(deps2, r, slug, env, dbPort2, waitMs, signal, onLine, report) {
+  if (r.services.length === 0) {
+    report({ module: slug, step: "services", status: "skip" });
     return;
   }
-  if (mc.repoRoot) {
-    await remember(ctx.deps, {
-      kind: "module",
-      path: mc.repoRoot,
-      portal: mc.portal.apiOrigin,
-      tenantSlug,
-      appId: app.id,
-      appSlug: app.slug,
-      moduleId: mc.module.id,
-      moduleSlug: mc.module.slug
-    });
+  report({ module: slug, step: "services", status: "start", ...dbPort2 !== null ? { detail: `:${dbPort2}` } : {} });
+  const began = deps2.now().getTime();
+  if (r.dockerServices) {
+    const res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: r.root, env, onLine, signal });
+    const dockerErr = classifyDockerInfo(res, deps2.platform);
+    if (dockerErr) throw dockerErr;
+    const compose = await runTool(deps2, "docker", ["compose", "version"], { cwd: r.root, env, onLine: () => {
+    }, signal });
+    const composeErr = classifyComposeVersion(compose);
+    if (composeErr) throw composeErr;
+  }
+  for (const script of r.services) {
+    const { cmd, args } = runArgs(r.pm, script);
+    const res = await runTool(deps2, cmd, args, { cwd: r.root, env, onLine, signal });
+    if (res.code !== 0) {
+      if (dbPort2 !== null && /port is already allocated|address already in use/i.test(res.tail.join("\n"))) {
+        throw await portInUseError(deps2, { slug, port: dbPort2, key: "DB_PORT" });
+      }
+      throw await composeFailure(deps2, r, slug, env, signal, `${script} failed in ${slug}`, `${cmd} ${args.join(" ")}`, res.tail);
+    }
+  }
+  if (dbPort2 !== null) {
+    const ok2 = await deps2.ports.waitFor(dbPort2, waitMs, signal);
+    if (signal.aborted) throw new CancelledError();
+    if (!ok2) {
+      throw await composeFailure(
+        deps2,
+        r,
+        slug,
+        env,
+        signal,
+        `The database for ${slug} did not accept connections on port ${dbPort2} within ${waitMs / 1e3} s`,
+        void 0,
+        []
+      );
+    }
   }
+  const took = secs(deps2.now().getTime() - began);
+  report({ module: slug, step: "services", status: "done", detail: dbPort2 !== null ? `:${dbPort2} (${took})` : `(${took})` });
 }
-async function rememberWorkspace(ctx, ws, app) {
-  if (ws.appId !== app.id) return;
-  await remember(ctx.deps, { kind: "workspace", path: ws.root, portal: ws.portal, tenantSlug: app.tenant.slug, appId: app.id, appSlug: app.slug });
+async function checkPort(deps2, o) {
+  if (o.port === null) return;
+  if (!await deps2.ports.inUse(o.port)) return;
+  throw await portInUseError(deps2, { slug: o.slug, port: o.port, key: o.key, runs: o.runs });
 }
-
-// src/cli/context.ts
-var allOfKind = (c, kind) => !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === "string");
-async function pick(ctx, err, message, choices) {
-  if (!ctx.io.interactive) throw err;
-  return ctx.io.select(message, choices);
+function abortableDelay(signal) {
+  return (ms2) => new Promise((resolve7) => {
+    const done = () => {
+      clearTimeout(t);
+      signal.removeEventListener("abort", done);
+      resolve7();
+    };
+    const t = setTimeout(done, ms2);
+    signal.addEventListener("abort", done, { once: true });
+  });
 }
-async function moduleContextFor(ctx, flags, command) {
-  const g = ctx.opts();
-  const onRequest = g.verbose ? (l) => ctx.io.err(l) : void 0;
-  const base = { portal: g.portal, module: flags.module, command, onRequest };
-  try {
-    return await resolveModuleContext(ctx.deps, base);
-  } catch (e) {
-    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" || !ctx.io.interactive) throw e;
-    if (allOfKind(e.candidates, "module")) {
-      const choose2 = await pick(
-        ctx,
-        e,
-        "Select a module",
-        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : ""}${c.slug}  (${c.remote})`, value: c.id }))
-      );
-      return resolveModuleContext(ctx.deps, { ...base, choose: choose2 });
-    }
-    if (allOfKind(e.candidates, "tenant")) {
-      const tenant = await pick(ctx, e, "Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })));
-      return resolveModuleContext(ctx.deps, { ...base, tenant });
+async function waitForDocker(deps2, o) {
+  const delay = o.delay ?? abortableDelay(o.signal);
+  const now = o.now ?? Date.now;
+  const deadline = now() + o.timeoutMs;
+  for (; ; ) {
+    await delay(Math.min(o.pollMs, Math.max(0, deadline - now())));
+    if (o.signal.aborted) throw new CancelledError();
+    const remaining = deadline - now();
+    if (remaining <= 0) return false;
+    const poll = AbortSignal.any([o.signal, AbortSignal.timeout(remaining)]);
+    let res;
+    try {
+      res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: o.cwd, env: o.env ?? deps2.env, onLine: () => {
+      }, signal: poll });
+    } catch (e) {
+      if (e instanceof CancelledError && !o.signal.aborted) return false;
+      throw e;
     }
-    throw e;
+    if (classifyDockerInfo(res, deps2.platform) === null) return true;
   }
 }
-async function appFor(ctx, mc, app) {
-  try {
-    return pickApp2(mc, app);
-  } catch (e) {
-    if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
-    const id = await pick(ctx, e, "Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
-    return pickApp2(mc, id);
+var MAX_PARENT_HOPS = 10;
+var AGE_SLACK_S = 5;
+async function leftoverOwnsPort(deps2, run4, port) {
+  if (deps2.platform === "win32" || !deps2.launch.signal(run4.qorePid, 0)) return false;
+  const { ageSeconds } = await deps2.ports.ownerDetail(run4.qorePid);
+  const recordAge = (deps2.now().getTime() - Date.parse(run4.startedAt)) / 1e3;
+  if (ageSeconds === null || !Number.isFinite(recordAge) || ageSeconds < recordAge - AGE_SLACK_S) return false;
+  const ours = /* @__PURE__ */ new Set([run4.qorePid, ...run4.children.map((c) => c.pid).filter((p) => p !== null)]);
+  let pid = (await deps2.ports.owner(port))?.pid ?? null;
+  for (let hop = 0; pid !== null && pid > 1 && hop <= MAX_PARENT_HOPS; hop++) {
+    if (ours.has(pid)) return true;
+    pid = await deps2.ports.parentPid(pid);
   }
+  return false;
 }
-function sourceText(mc) {
-  if (mc.source.kind === "remote") return mc.source.remote;
-  if (mc.source.kind === "workspace") return WORKSPACE_FILE;
-  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : "--module";
+
+// src/core/dev/providers.ts
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function connPorts(env) {
+  const out = [];
+  for (const key2 of Object.keys(env).sort()) {
+    const m = /^CONN_(.+)_URL$/.exec(key2);
+    if (!m) continue;
+    let url;
+    try {
+      url = new URL(env[key2].trim().replace(/^["']|["']$/g, ""));
+    } catch {
+      continue;
+    }
+    const port = Number(url.port);
+    if (port > 0 && LOCAL_HOSTS.has(url.hostname)) out.push({ key: key2, alias: m[1], port });
+  }
+  return out;
 }
-function contextLine(mc, app) {
-  const parts = [mc.module.tenant.name, ...app ? [app.name] : [], mc.module.slug];
-  return `\u2192 ${parts.join(" / ")}  (${sourceText(mc)})`;
+function deadAliases(env, listening) {
+  return connPorts(env).filter((c) => !listening.has(c.port)).map((c) => c.key);
 }
-function contextJson(mc, app) {
-  const { id, slug, name, type, access: access2 } = mc.module;
+function hintContext(recipe, pkg, env) {
+  const { cmd, args } = installArgs(recipe.pm);
+  const ports = /* @__PURE__ */ new Map();
+  for (const c of connPorts(env)) ports.set(c.port, { kind: "provider", key: c.key });
+  const db = envPort(env, "DB_PORT");
+  if (db !== null) ports.set(db, { kind: "database" });
   return {
-    portal: mc.portal.builtin ?? mc.portal.apiOrigin,
-    tenant: mc.module.tenant,
-    app: app ?? null,
-    module: { id, slug, name, type, access: access2 },
-    source: mc.source.kind === "remote" ? mc.source.remote : mc.source.kind === "workspace" ? WORKSPACE_FILE : "--module",
-    ...mc.source.kind === "flag" && mc.source.overrides ? { overrides: mc.source.overrides } : {}
+    installCommand: [cmd, ...args].join(" "),
+    runCommand: (script) => {
+      if (pkg.scripts?.[script] === void 0) return null;
+      const r = runArgs(recipe.pm, script);
+      return [r.cmd, ...r.args].join(" ");
+    },
+    ports
   };
 }
 
+// src/core/dev/runFile.ts
+import { unlink as unlink2 } from "fs/promises";
+import { join as join20 } from "path";
+async function runFilePath(deps2, root) {
+  const dir2 = join20(deps2.config.dir, "run");
+  const name = `${await stateKey(deps2, root)}.json`;
+  return { dir: dir2, name, path: join20(dir2, name) };
+}
+async function writeRunFile(deps2, root, rec) {
+  const { dir: dir2, name } = await runFilePath(deps2, root);
+  await writeJsonAtomic(dir2, name, rec);
+}
+async function removeRunFile(deps2, root) {
+  const { path: path2 } = await runFilePath(deps2, root);
+  await unlink2(path2).catch(() => {
+  });
+}
+async function leftoverRun(deps2, root, o = {}) {
+  const { path: path2 } = await runFilePath(deps2, root);
+  const rec = await readJson(path2).catch(() => null);
+  if (!rec || rec.schemaVersion !== 1) return null;
+  if (deps2.launch.isAlive(rec.qorePid)) return rec;
+  if (o.prune !== false) await unlink2(path2).catch(() => {
+  });
+  return null;
+}
+
 // src/cli/findings.ts
 function canOffer(ctx) {
   const g = ctx.opts();
@@ -3564,33 +4195,10 @@ async function inPreflight(signals, outer, fn) {
   }
 }
 
-// src/cli/trustPrompt.ts
-async function ensureTrusted(ctx, mc, app, o) {
-  const root = mc.repoRoot ?? ctx.deps.cwd;
-  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app));
-  if (await isTrusted(ctx.deps, root, mc.module.id)) return;
-  if (o.yes) {
-    await trust(ctx.deps, root, mc.module.id);
-    return;
-  }
-  if (!ctx.io.interactive) {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", `This repository is not trusted for ${mc.module.slug} yet`, {
-      hint: "Run interactively once, or pass --yes.",
-      details: { reason: "untrusted", repository: root }
-    });
-  }
-  if (mc.source.kind === "remote") {
-    const key = repoKey(mc.source.url);
-    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? "(unparsable remote URL)"}`);
-  }
-  if (!await ctx.io.confirm("Pull local secrets for this module into this repository?")) throw new CancelledError();
-  await trust(ctx.deps, root, mc.module.id);
-}
-
 // src/cli/commands/devWorkspace.ts
 import { randomBytes as randomBytes5 } from "crypto";
 import { realpath as realpath7 } from "fs/promises";
-import { join as join20, relative as relative6 } from "path";
+import { join as join22, relative as relative6 } from "path";
 
 // src/core/dev/order.ts
 function selectSkips(modules, sel) {
@@ -3747,15 +4355,15 @@ function supervise(o) {
   });
   const readiness = /* @__PURE__ */ new Map();
   for (const m of o.modules) {
-    let resolve6;
+    let resolve7;
     let settled = false;
     const promise = new Promise((r) => {
-      resolve6 = r;
+      resolve7 = r;
     });
     readiness.set(m.slug, { promise, settle: (r) => {
       if (settled) return false;
       settled = true;
-      resolve6(r);
+      resolve7(r);
       return true;
     } });
   }
@@ -3847,7 +4455,7 @@ function supervise(o) {
 
 // src/core/workspace/stray.ts
 import { lstat as lstat2, readdir as readdir3 } from "fs/promises";
-import { join as join19 } from "path";
+import { join as join21 } from "path";
 async function strayRepos(root, slugs) {
   let entries;
   try {
@@ -3859,7 +4467,7 @@ async function strayRepos(root, slugs) {
   for (const name of entries) {
     if (slugs.has(name)) continue;
     try {
-      await lstat2(join19(root, name, ".git"));
+      await lstat2(join21(root, name, ".git"));
       names.push(name);
     } catch {
     }
@@ -3930,12 +4538,12 @@ function registerRun(program, ctx) {
 
 // src/cli/commands/devWorkspace.ts
 var INSTALL_PARALLELISM = 4;
-var str = (v) => typeof v === "string" && v.length > 0;
+var str2 = (v) => typeof v === "string" && v.length > 0;
 var slugList = (raw) => raw?.split(",").map((s) => s.trim()).filter(Boolean);
 function usableLast(last, appId) {
   if (!last || last.kind !== "workspace") return false;
   const a = last.app;
-  return str(last.savedAt) && !!a && a.id === appId && str(a.slug) && str(a.name) && !!a.tenant && str(a.tenant.name) && Array.isArray(last.modules) && last.modules.every((m) => !!m && str(m.id) && str(m.slug) && str(m.type) && str(m.access) && Array.isArray(m.dependsOn));
+  return str2(last.savedAt) && !!a && a.id === appId && str2(a.slug) && str2(a.name) && !!a.tenant && str2(a.tenant.name) && Array.isArray(last.modules) && last.modules.every((m) => !!m && str2(m.id) && str2(m.slug) && str2(m.type) && str2(m.access) && Array.isArray(m.dependsOn));
 }
 async function workspaceContext(ctx, ws) {
   const { deps: deps2 } = ctx;
@@ -4021,7 +4629,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
       continue;
     }
     try {
-      dirs[m.slug] = await deps2.git.inspect(join20(ws.root, m.slug));
+      dirs[m.slug] = await deps2.git.inspect(join22(ws.root, m.slug));
       safe.push(m);
     } catch (e) {
       if (!(e instanceof QoreError) || e.code === "QORE_GIT_UNAVAILABLE") throw e;
@@ -4058,7 +4666,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
     const results = await applyActions(deps2, { portal: online.portal, app: am, actions, protocol: cloneProtocol(dirs), onResult: () => {
     } });
     renderResults(io2, results, false);
-    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join20(ws.root, r.slug));
+    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join22(ws.root, r.slug));
     ({ present, plan } = computePlan());
   }
   for (const name of await strayRepos(ws.root, new Set(am.modules.map((m) => m.slug)))) renderFinding(ctx, strayClone(name, am.app.name));
@@ -4239,7 +4847,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
   if (online && units.every((u) => !u.dev.offline)) {
     const envFile = (m) => {
       const u = units.find((x) => x.m.id === m.id);
-      return u ? relative6(rootReal, u.dev.envFile) : join20(m.slug, moduleDefaults(m.type).envFile);
+      return u ? relative6(rootReal, u.dev.envFile) : join22(m.slug, moduleDefaults(m.type).envFile);
     };
     await saveLastStart(deps2, ws.root, {
       schemaVersion: 1,
@@ -4450,7 +5058,7 @@ function parseWaitTimeout(raw) {
   }
   return n;
 }
-var str2 = (v) => typeof v === "string" && v.length > 0;
+var str3 = (v) => typeof v === "string" && v.length > 0;
 var SHELL_SAFE = /^[A-Za-z0-9_./,:@%+=-]*$/;
 var shellQuote = (s) => SHELL_SAFE.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
 function cdAndDev(home, dir2) {
@@ -4478,7 +5086,7 @@ async function providerFindings(ctx, root, mc, app, env) {
     let fix = `qore clone ${app.slug}`;
     if (ws && ws.appId === app.id) fix = cdAndDev(deps2.home, ws.root);
     else if (providers.length === 1) {
-      const sibling = join21(dirname7(root), providers[0].slug);
+      const sibling = join23(dirname7(root), providers[0].slug);
       if ((await deps2.git.inspect(sibling)).isRepo) fix = cdAndDev(deps2.home, sibling);
     }
     return providerDown({
@@ -4496,7 +5104,7 @@ async function providerFindings(ctx, root, mc, app, env) {
 function usableLast2(last) {
   if (!last || last.kind !== "module") return false;
   const m = last.module;
-  return str2(last.savedAt) && !!m && str2(m.id) && str2(m.slug) && str2(m.type) && !!m.tenant && str2(m.tenant.name) && !!last.app && str2(last.app.id) && str2(last.app.slug) && str2(last.app.name);
+  return str3(last.savedAt) && !!m && str3(m.id) && str3(m.slug) && str3(m.type) && !!m.tenant && str3(m.tenant.name) && !!last.app && str3(last.app.id) && str3(last.app.slug) && str3(last.app.name);
 }
 async function devContext(ctx, f, root) {
   let mc;
@@ -4672,8 +5280,8 @@ function registerDebugTelemetry(program, ctx) {
 import pc3 from "picocolors";
 
 // src/core/doctor/checks.ts
-import { realpath as realpath9, stat as stat5 } from "fs/promises";
-import { basename as basename3, join as join22 } from "path";
+import { realpath as realpath9, stat as stat6 } from "fs/promises";
+import { basename as basename4, join as join24 } from "path";
 
 // src/core/diagnostics/ssh.ts
 var SSH_TEST_ARGS = ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "git@github.com"];
@@ -4816,9 +5424,9 @@ function jwtExp(token) {
 }
 function validDays(rt, now) {
   const exp = jwtExp(rt.rt);
-  const end = exp !== null ? exp * 1e3 : Date.parse(rt.obtainedAt) + IDLE_DAYS * DAY_MS;
-  if (Number.isNaN(end)) return null;
-  return Math.max(0, Math.floor((end - now.getTime()) / DAY_MS));
+  const end2 = exp !== null ? exp * 1e3 : Date.parse(rt.obtainedAt) + IDLE_DAYS * DAY_MS;
+  if (Number.isNaN(end2)) return null;
+  return Math.max(0, Math.floor((end2 - now.getTime()) / DAY_MS));
 }
 async function checkSession(deps2, portal, onRequest, sessions, selected, signal) {
   try {
@@ -4874,7 +5482,7 @@ async function moduleBody(deps2, m, runs, signal) {
     if (text2 === null) return { status: "warn", label: "port unknown (run qore env pull)" };
     env = Object.fromEntries(parseEnv(text2));
     const port = envPort(env, "PORT");
-    if (port === null) return { status: "warn", label: `port unknown (no PORT in ${basename3(target)})` };
+    if (port === null) return { status: "warn", label: `port unknown (no PORT in ${basename4(target)})` };
     if (!await deps2.ports.inUse(port)) return { status: "ok", label: `port ${port} free` };
     const e = await portInUseError(deps2, { slug: m.slug, port, key: "PORT", runs: await runs() });
     return { status: "fail", label: `port ${port} in use${ownerText(e)}`, error: e };
@@ -4893,13 +5501,13 @@ async function moduleBody(deps2, m, runs, signal) {
       flags: { install: true, services: true }
     });
     if (recipe.services.length === 0) return { status: "ok", label: "db none" };
-    const dbPort = env ? envPort(env, "DB_PORT") : null;
-    if (dbPort === null) return { status: "warn", label: "db port unknown (run qore env pull)" };
-    if (!await deps2.ports.inUse(dbPort)) return { status: "ok", label: `db:up (DB_PORT ${dbPort} free)` };
-    const pub = await deps2.ports.dockerPublisher(dbPort);
+    const dbPort2 = env ? envPort(env, "DB_PORT") : null;
+    if (dbPort2 === null) return { status: "warn", label: "db port unknown (run qore env pull)" };
+    if (!await deps2.ports.inUse(dbPort2)) return { status: "ok", label: `db:up (DB_PORT ${dbPort2} free)` };
+    const pub = await deps2.ports.dockerPublisher(dbPort2);
     if (pub?.workingDir && await sameDir(pub.workingDir, m.root)) return { status: "ok", label: "db running" };
-    const e = await portInUseError(deps2, { slug: m.slug, port: dbPort, key: "DB_PORT" });
-    return { status: "fail", label: `DB_PORT ${dbPort} in use${ownerText(e)}`, error: e };
+    const e = await portInUseError(deps2, { slug: m.slug, port: dbPort2, key: "DB_PORT" });
+    return { status: "fail", label: `DB_PORT ${dbPort2} in use${ownerText(e)}`, error: e };
   });
   const status2 = parts.reduce((w, p) => RANK[p.status] > RANK[w] ? p.status : w, "ok");
   const shown = parts.filter((p) => p.status !== "ok");
@@ -4956,7 +5564,7 @@ async function resolveRepoModule(deps2, session, portal, meta, root) {
 async function checkProjectsRoot(cfg) {
   const root = cfg?.projectsRoot;
   if (!root) return ok("projects folder not set (optional \u2014 qore init)");
-  const s = await stat5(root).catch(() => null);
+  const s = await stat6(root).catch(() => null);
   if (!s?.isDirectory()) return { status: "warn", label: `projects folder ${root} does not exist \u2014 qore init` };
   const e = await writableError(root);
   if (e) return { status: "fail", label: `projects folder ${root} is not writable (${e.code ?? e.message})` };
@@ -5059,7 +5667,7 @@ async function runDoctor(deps2, o = {}) {
   const repoRoot = wsRoot ? null : await findRepoRoot(deps2.cwd);
   if (wsRoot) {
     context.kind = "workspace";
-    context.label = basename3(wsRoot.root);
+    context.label = basename4(wsRoot.root);
     if (!session) {
       await notChecked();
       return { results, context };
@@ -5079,7 +5687,7 @@ async function runDoctor(deps2, o = {}) {
     for (const m of am.modules) await workspaceModule(deps2, wsRoot, am, m, runs, signal, push, perModule);
   } else if (repoRoot) {
     context.kind = "module";
-    context.label = basename3(repoRoot);
+    context.label = basename4(repoRoot);
     if (!session) {
       await notChecked();
       return { results, context };
@@ -5110,7 +5718,7 @@ async function workspaceModule(deps2, ws, am, m, runs, signal, push, perModule)
     await push(`module:${m.slug}`, "workspace", () => ({ status: "warn", label: "not a safe directory name \u2014 skipped" }), m.slug);
     return;
   }
-  const mod = { root: join22(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
+  const mod = { root: join24(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
   let prepared = null;
   await push(`module:${m.slug}`, "workspace", async () => {
     const info = await deps2.git.inspect(mod.root);
@@ -5142,7 +5750,7 @@ function registerDoctor(program, ctx) {
 // src/cli/commands/env.ts
 import { randomBytes as randomBytes7 } from "crypto";
 import { chmod as chmod3, realpath as realpath10 } from "fs/promises";
-import { dirname as dirname8, join as join23, relative as relative8 } from "path";
+import { dirname as dirname8, join as join25, relative as relative8 } from "path";
 var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
 function registerEnv(program, ctx) {
   const env = program.command("env").description("Local environment");
@@ -5161,7 +5769,7 @@ function registerEnv(program, ctx) {
     const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
     await ensureTrusted(c, mc, app, { yes: f.yes });
     const existing = await readOrNull(target);
-    const example = existing === null ? await readOrNull(join23(dirname8(target), ".env.example")) : null;
+    const example = existing === null ? await readOrNull(join25(dirname8(target), ".env.example")) : null;
     const local = await fetchLocalEnv(deps2, mc, app);
     const inputs = {
       existing,
@@ -5177,13 +5785,13 @@ function registerEnv(program, ctx) {
       const current = parseEnv(existing ?? example ?? "");
       const choices = {};
       let bulk;
-      for (const key of plan.conflicts) {
+      for (const key2 of plan.conflicts) {
         if (bulk) {
-          choices[key] = bulk;
+          choices[key2] = bulk;
           continue;
         }
         const pick2 = await io2.select(
-          `${key} differs  (local ${maskLen(current.get(key))}, portal ${maskLen(local.env[key])})`,
+          `${key2} differs  (local ${maskLen(current.get(key2))}, portal ${maskLen(local.env[key2])})`,
           [
             { name: "keep local", value: "keep" },
             { name: "use portal", value: "portal" },
@@ -5193,7 +5801,7 @@ function registerEnv(program, ctx) {
         );
         if (pick2 === "all") bulk = "use-portal";
         if (pick2 === "skip") bulk = "keep";
-        choices[key] = pick2 === "portal" || pick2 === "all" ? "use-portal" : "keep";
+        choices[key2] = pick2 === "portal" || pick2 === "all" ? "use-portal" : "keep";
       }
       plan = planPull({ ...inputs, choices });
     }
@@ -6097,6 +6705,179 @@ function registerLogout(program, ctx) {
   });
 }
 
+// src/core/roles/api.ts
+var CAPABILITY = "module.local-roles";
+var path = (mc, app) => `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-roles?app_id=${encodeURIComponent(app.id)}`;
+async function fetchLocalRoles(deps2, mc, app) {
+  await ensureCapability(deps2, mc.portal.apiOrigin, CAPABILITY);
+  return explained(mc, () => mc.session.api.get(path(mc, app)));
+}
+async function useLocalRoles(deps2, mc, app, roles, use) {
+  await ensureCapability(deps2, mc.portal.apiOrigin, CAPABILITY);
+  return explained(mc, () => mc.session.api.post(path(mc, app), { roles, use }));
+}
+async function explained(mc, call) {
+  try {
+    return await call();
+  } catch (e) {
+    if (!(e instanceof QoreError)) throw e;
+    if (e.serverCode === "app.access.denied") {
+      throw withDetails(
+        e,
+        { required: "write", have: mc.module.access },
+        `You have ${mc.module.access} on ${mc.module.slug}; local roles need write. Ask a maintainer of the app's dev team for write access.`
+      );
+    }
+    if (e.serverCode === "membership.permission.denied") {
+      throw withDetails(e, {}, "Taking roles on this app needs write on one of its dev teams.");
+    }
+    if (e.serverCode === "auth.scope.insufficient") throw withDetails(e, {}, "Run `qore login` again.");
+    if (e.serverCode === "app.no_platform_identity") {
+      throw new QoreError("QORE_CONTEXT_UNSUPPORTED", "This app manages its own users; the portal hands out no roles for it", {
+        hint: "Give yourself the role in the app's own user admin.",
+        serverCode: e.serverCode,
+        requestId: e.requestId
+      });
+    }
+    throw e;
+  }
+}
+
+// src/core/roles/read.ts
+import { join as join26 } from "path";
+
+// src/core/roles/extract.ts
+var KNOWN = { user: "User", admin: "App admin" };
+function defaultLabel(slug) {
+  return KNOWN[slug] ?? slug.charAt(0).toUpperCase() + slug.slice(1);
+}
+async function extractRoles(source) {
+  const { default: ts } = await import("typescript");
+  const sf = ts.createSourceFile("permissions.ts", source, ts.ScriptTarget.Latest, true);
+  let obj;
+  const visit = (node) => {
+    const first = ts.isCallExpression(node) ? node.arguments[0] : void 0;
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "definePermissions" && first !== void 0 && ts.isObjectLiteralExpression(first)) {
+      obj = first;
+    }
+    if (!obj) ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  if (!obj) return null;
+  const slugs = [];
+  for (const prop of obj.properties) {
+    if (ts.isPropertyAssignment(prop) && (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
+      slugs.push(prop.name.text);
+    }
+  }
+  return slugs.map((slug) => ({ slug, label: defaultLabel(slug) }));
+}
+
+// src/core/roles/read.ts
+var PERMISSIONS_FILE = "src/lib/permissions.ts";
+var SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+var MAX_SLUG = 64;
+var MAX_ROLES = 100;
+async function readCodeRoles(repoRoot) {
+  const source = await readOrNull(join26(repoRoot, PERMISSIONS_FILE));
+  if (source === null) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `No ${PERMISSIONS_FILE} in this module`, {
+      hint: "App roles live in the app's frontend module; run this there."
+    });
+  }
+  const roles = await extractRoles(source);
+  if (!roles?.length) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `${PERMISSIONS_FILE} declares no roles in a definePermissions({ ... }) object`, {
+      hint: "The portal reads only an object literal passed straight to definePermissions \u2014 no variable, no spread, no shorthand ({ admin, user })."
+    });
+  }
+  const invalid4 = roles.filter((r) => !SLUG.test(r.slug) || r.slug.length > MAX_SLUG).map((r) => r.slug);
+  if (invalid4.length) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `The portal refuses these role names: ${invalid4.join(", ")}`, {
+      hint: `Use lowercase letters, digits, - and _, starting with a letter or digit, at most ${MAX_SLUG} characters.`,
+      details: { invalid: invalid4 }
+    });
+  }
+  const unique = [...new Map(roles.map((r) => [r.slug, r])).values()];
+  if (unique.length > MAX_ROLES) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `The portal refuses more than ${MAX_ROLES} roles; ${PERMISSIONS_FILE} declares ${unique.length}`, {
+      hint: "Merge roles that grant the same permissions.",
+      details: { count: unique.length, max: MAX_ROLES }
+    });
+  }
+  return unique;
+}
+
+// src/cli/commands/roles.ts
+async function rolesContext(ctx, f, command) {
+  const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true, command });
+  const mc = await moduleContextFor(c, f, command);
+  if (!mc.repoRoot) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `${command} reads the roles in a module repository`, {
+      hint: "cd into the app's frontend module."
+    });
+  }
+  const app = await appFor(c, mc, f.app);
+  await rememberContext(c, mc, app);
+  return { c, mc, app, code: await readCodeRoles(mc.repoRoot) };
+}
+function withFlags(cmd) {
+  return cmd.option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "the project, from anywhere (see qore init)");
+}
+function registerRoles(program, ctx) {
+  const roles = program.command("roles").description("App roles on your own machine (the local environment)");
+  withFlags(roles.command("list").description("Roles in your code, roles local knows, and yours there")).action(async (f) => {
+    const { c, mc, app, code } = await rolesContext(ctx, f, "roles list");
+    const local = await fetchLocalRoles(c.deps, mc, app);
+    if (c.opts().json) {
+      renderJson(c.io, {
+        context: contextJson(mc, app),
+        code: code.map((r) => r.slug),
+        local: local.roles,
+        direct: local.direct,
+        effective: local.effective
+      });
+      return;
+    }
+    const known = new Set(local.roles.map((r) => r.slug));
+    const fresh = code.filter((r) => !known.has(r.slug)).map((r) => r.slug);
+    c.io.err(contextLine(mc, app));
+    c.io.out(`In your code     ${code.map((r) => r.slug).join(", ")}`);
+    c.io.out(`Known on local   ${[...known].join(", ") || "\u2014"}`);
+    c.io.out(`Yours on local   ${local.effective.join(", ") || "\u2014"}`);
+    if (fresh.length) {
+      c.io.out(`New in your code: ${fresh.join(", ")} \u2014 \`qore roles use <role...>\` announces them and makes them yours on local.`);
+    }
+  });
+  withFlags(roles.command("use").description("Announce your code's roles for local and make exactly these yours there").argument("<role...>", "the roles you want on local")).action(async (wanted, f) => {
+    const { c, mc, app, code } = await rolesContext(ctx, f, "roles use");
+    const inCode = new Set(code.map((r) => r.slug));
+    const unknown = wanted.filter((r) => !inCode.has(r));
+    if (unknown.length) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Not a role in ${PERMISSIONS_FILE}: ${unknown.join(", ")}`, {
+        details: { unknown, known: [...inCode] }
+      });
+    }
+    const before = await fetchLocalRoles(c.deps, mc, app);
+    const res = await useLocalRoles(c.deps, mc, app, code, [...new Set(wanted)]);
+    const changed = !sameSet(before.direct, res.direct);
+    const viaGroups = res.effective.filter((r) => !res.direct.includes(r));
+    if (c.opts().json) {
+      renderJson(c.io, { context: contextJson(mc, app), added: res.added, direct: res.direct, effective: res.effective });
+      return;
+    }
+    c.io.err(contextLine(mc, app));
+    c.io.out(`\u2713 Your roles on local: ${res.direct.join(", ")}`);
+    if (res.added.length) c.io.out(`  New on local: ${res.added.join(", ")} \u2014 teammates can pick it in the Access tab too.`);
+    if (viaGroups.length) c.io.err(`! You also hold ${viaGroups.join(", ")} on local through a group.`);
+    if (changed) c.io.err("! Sign out and back in to your local app: your current session still has your old roles.");
+  });
+}
+function sameSet(a, b) {
+  const s = new Set(a);
+  return s.size === new Set(b).size && b.every((x) => s.has(x));
+}
+
 // src/cli/commands/status.ts
 var HEAD = ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"];
 var envRow = (e, now) => [e.name, e.paused ? "paused" : e.status, e.commit?.sha ?? "\u2013", ago(e.commit?.deployedAt ?? null, now), uptime(e.health)];
@@ -6171,7 +6952,7 @@ function registerStatus(program, ctx) {
 }
 
 // src/cli/commands/sync.ts
-import { join as join24, relative as relative9 } from "path";
+import { join as join27, relative as relative9 } from "path";
 import { Option as Option2 } from "commander";
 function asFailure2(slug, e) {
   if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
@@ -6203,7 +6984,7 @@ function registerSync(program, ctx) {
         continue;
       }
       try {
-        dirs[m.slug] = await deps2.git.inspect(join24(ws.root, m.slug));
+        dirs[m.slug] = await deps2.git.inspect(join27(ws.root, m.slug));
         modulesForPlan.push(m);
       } catch (e) {
         earlyFailures.push(asFailure2(m.slug, e));
@@ -6399,8 +7180,10 @@ var COMMANDS = [
   registerTraces,
   registerErrors,
   registerEnv,
+  registerRoles,
   registerRun,
   registerDev,
+  registerDb,
   registerClone,
   registerSync,
   registerVersion,
@@ -6486,11 +7269,11 @@ async function start(deps2, argv2, command, load, onScrub) {
 }
 function withDeadline(work, ms2, signal) {
   if (signal?.aborted) return Promise.resolve(false);
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const done = (v) => {
       clearTimeout(timer);
       signal?.removeEventListener("abort", onAbort);
-      resolve6(v);
+      resolve7(v);
     };
     const onAbort = () => done(false);
     const timer = setTimeout(() => done(false), ms2);
@@ -6541,8 +7324,8 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 }
 
 // src/core/config.ts
-import { readFile as readFile6 } from "fs/promises";
-import { join as join25 } from "path";
+import { readFile as readFile8 } from "fs/promises";
+import { join as join28 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -6550,12 +7333,12 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join25(this.dir, "config.json");
+    return join28(this.dir, "config.json");
   }
   async read() {
     let raw;
     try {
-      raw = await readFile6(this.file, "utf8");
+      raw = await readFile8(this.file, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return empty();
       throw e;
@@ -6581,9 +7364,9 @@ var ConfigStore = class {
 
 // src/platform/git.ts
 import { execFile, execFileSync } from "child_process";
-import { mkdir as mkdir4, readdir as readdir4, stat as stat6 } from "fs/promises";
+import { mkdir as mkdir4, readdir as readdir4, stat as stat7 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname9, join as join26 } from "path";
+import { dirname as dirname9, join as join29 } from "path";
 function parseRemotes(stdout) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -6621,8 +7404,8 @@ function parseStatus(stdout) {
 }
 var configuredSshCommand = /* @__PURE__ */ new Map();
 function hasConfiguredSshCommand(repoDir) {
-  const key = repoDir ?? "";
-  let v = configuredSshCommand.get(key);
+  const key2 = repoDir ?? "";
+  let v = configuredSshCommand.get(key2);
   if (v === void 0) {
     const args = repoDir ? ["-C", repoDir, "config", "--get", "core.sshCommand"] : ["config", "--get", "core.sshCommand"];
     try {
@@ -6636,7 +7419,7 @@ function hasConfiguredSshCommand(repoDir) {
     } catch {
       v = false;
     }
-    configuredSshCommand.set(key, v);
+    configuredSshCommand.set(key2, v);
   }
   return v;
 }
@@ -6650,7 +7433,7 @@ function gitExecOptions(repoDir) {
   return { cwd: homedir(), env, windowsHide: true, maxBuffer: 8 * 1024 * 1024 };
 }
 function runGit(args, repoDir) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     execFile("git", args, gitExecOptions(repoDir), (err, stdout, stderr) => {
       if (err && err.code === "ENOENT") {
         reject(new QoreError("QORE_GIT_UNAVAILABLE", "git is not installed or not on PATH", {
@@ -6659,7 +7442,7 @@ function runGit(args, repoDir) {
         return;
       }
       const code = err ? typeof err.code === "number" ? err.code : 1 : 0;
-      resolve6({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
+      resolve7({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? void 0 });
     });
   });
 }
@@ -6695,12 +7478,12 @@ async function status(repoRoot) {
   if (r.code !== 0) return { ok: false, stderr: r.stderr, command };
   return parseStatus(r.stdout);
 }
-async function statOrThrow(path) {
+async function statOrThrow(path2) {
   try {
-    return await stat6(path);
+    return await stat7(path2);
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
-    throw new QoreError("QORE_INTERNAL", `could not stat ${path}`, { cause: err });
+    throw new QoreError("QORE_INTERNAL", `could not stat ${path2}`, { cause: err });
   }
 }
 async function inspect(dir2) {
@@ -6714,7 +7497,7 @@ async function inspect(dir2) {
     throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
   }
   const empty2 = entries.length === 0;
-  const isRepo = await statOrThrow(join26(dir2, ".git")) !== void 0;
+  const isRepo = await statOrThrow(join29(dir2, ".git")) !== void 0;
   const dirRemotes = isRepo ? await remotes(dir2) : [];
   return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
 }
@@ -6776,13 +7559,13 @@ var OsKeychain = class {
 
 // src/platform/lock.ts
 import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
-import { join as join27 } from "path";
+import { join as join30 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join27(dir2, "locks");
+    const locks = join30(dir2, "locks");
     await mkdir5(locks, { recursive: true, mode: 448 });
-    const target = join27(locks, `${name}.lock`);
+    const target = join30(locks, `${name}.lock`);
     await writeFile5(target, "", { flag: "a" });
     let release;
     let compromised;
@@ -6826,7 +7609,7 @@ var STDERR_DRAIN_MS = 500;
 function makeSpawner(spawnFn, proc) {
   return {
     run(cmd, args, env, o) {
-      return new Promise((resolve6, reject) => {
+      return new Promise((resolve7, reject) => {
         let child;
         try {
           child = spawnFn(cmd, args, {
@@ -6860,7 +7643,7 @@ function makeSpawner(spawnFn, proc) {
           cleanup();
           const stderr = child.stderr;
           if (!o?.onStderr || !stderr || stderr.readableEnded) {
-            resolve6({ code, signal });
+            resolve7({ code, signal });
             return;
           }
           let settled = false;
@@ -6868,7 +7651,7 @@ function makeSpawner(spawnFn, proc) {
             if (settled) return;
             settled = true;
             clearTimeout(timer);
-            resolve6({ code, signal });
+            resolve7({ code, signal });
           };
           const timer = setTimeout(finish, STDERR_DRAIN_MS);
           timer.unref?.();
@@ -6923,13 +7706,13 @@ var systemLauncher = {
     child.stdout?.on("data", (c) => out.push(c));
     child.stderr?.on("data", (c) => err.push(c));
     let closed = false;
-    const exited = new Promise((resolve6) => {
-      child.once("error", (e) => resolve6({ code: null, signal: null, spawnError: e.code ?? "error" }));
+    const exited = new Promise((resolve7) => {
+      child.once("error", (e) => resolve7({ code: null, signal: null, spawnError: e.code ?? "error" }));
       child.once("close", (code, signal) => {
         closed = true;
         out.flush();
         err.flush();
-        resolve6({ code, signal });
+        resolve7({ code, signal });
       });
     });
     return {
@@ -6975,11 +7758,11 @@ var systemLauncher = {
 import { execFile as execFile2 } from "child_process";
 import { connect } from "net";
 function accepts(host, port) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const s = connect({ host, port });
     const done = (v) => {
       s.destroy();
-      resolve6(v);
+      resolve7(v);
     };
     s.setTimeout(500, () => done(false));
     s.once("connect", () => done(true));
@@ -6987,12 +7770,12 @@ function accepts(host, port) {
   });
 }
 function run2(cmd, args) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     execFile2(
       cmd,
       args,
       { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
-      (e, stdout) => resolve6(e && !stdout ? null : String(stdout))
+      (e, stdout) => resolve7(e && !stdout ? null : String(stdout))
     );
   });
 }
@@ -7055,6 +7838,26 @@ var systemPorts = {
   }
 };
 
+// src/platform/postgres.ts
+import pg from "pg";
+async function connectPostgres(url, o) {
+  const client = new pg.Client({ connectionString: url, connectionTimeoutMillis: o.timeoutMs });
+  client.on("error", () => {
+  });
+  try {
+    await client.connect();
+    await client.query("set default_transaction_read_only = on");
+  } catch (e) {
+    await client.end().catch(() => {
+    });
+    throw e;
+  }
+  return {
+    query: async (sql, params) => ({ rows: (await client.query(sql, params)).rows }),
+    close: () => client.end()
+  };
+}
+
 // src/buildInfo.ts
 var SENTRY_DSN = true ? "https://50b592efb53dbc1a31cb10d3945c6d52@o4512129906049024.ingest.de.sentry.io/4512174341750864" : "";
 var SENTRY_ENVIRONMENT = true ? "production" : "development";
@@ -7064,7 +7867,7 @@ import { execFile as execFile3 } from "child_process";
 
 // src/core/diagnostics/proxy.ts
 function parseScutilProxy(stdout) {
-  const value = (key) => stdout.match(new RegExp(`^\\s*${key}\\s*:\\s*(.+)$`, "m"))?.[1]?.trim();
+  const value = (key2) => stdout.match(new RegExp(`^\\s*${key2}\\s*:\\s*(.+)$`, "m"))?.[1]?.trim();
   if (value("HTTPSEnable") === "1") {
     const host = value("HTTPSProxy");
     const port = value("HTTPSPort");
@@ -7085,12 +7888,12 @@ function parseRegProxy(stdout) {
 
 // src/platform/proxy.ts
 function run3(cmd, args) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     execFile3(
       cmd,
       args,
       { timeout: 2e3, env: { ...process.env, LC_ALL: "C" }, windowsHide: true },
-      (e, stdout) => resolve6(e && !stdout ? null : String(stdout))
+      (e, stdout) => resolve7(e && !stdout ? null : String(stdout))
     );
   });
 }
@@ -7101,10 +7904,10 @@ async function detect(platform) {
       return out ? parseScutilProxy(out) : null;
     }
     if (platform === "win32") {
-      const key = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
+      const key2 = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
       const [enable, server] = await Promise.all([
-        run3("reg", ["query", key, "/v", "ProxyEnable"]),
-        run3("reg", ["query", key, "/v", "ProxyServer"])
+        run3("reg", ["query", key2, "/v", "ProxyEnable"]),
+        run3("reg", ["query", key2, "/v", "ProxyServer"])
       ]);
       const combined = [enable, server].filter(Boolean).join("\n");
       return combined ? parseRegProxy(combined) : null;
@@ -7121,7 +7924,7 @@ function systemProxy(platform = process.platform) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.7" : "0.0.0-dev";
+var VERSION = true ? "0.1.9" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -7169,7 +7972,9 @@ var deps = {
   },
   sentryDsn: SENTRY_DSN,
   sentryEnvironment: SENTRY_ENVIRONMENT,
-  systemProxy: () => systemProxy(process.platform)
+  systemProxy: () => systemProxy(process.platform),
+  viewerDir: fileURLToPath(new URL("../viewer/dist/", import.meta.url)),
+  postgres: connectPostgres
 };
 var termination = preflightTermination(() => ac.abort(), deps.raise);
 var io = processIo(isInteractive({
@@ -7199,4 +8004,4 @@ if (!drained) {
   process.exit();
 }
 //# sourceMappingURL=cli.js.map
-//# debugId=bf813c0e-4054-532d-9e74-62fbe8673876
+//# debugId=f7b490f6-b0af-5874-9ffa-f8010e3ba137