@quatronic/qore 0.1.8 → 0.1.10

package/README.md

@@ -23,6 +23,8 @@ qore version            # CLI + portal version info
 
 qore env pull           # write this module's local secrets into an env file
 qore run -- <command>   # run a command with those secrets in its environment
+qore roles list         # roles in your code, on local, and yours there
+qore roles use <role…>  # announce your code's roles for local and take these
 
 qore errors --env stag                              # recent unresolved errors
 qore errors FRONTEND-1A --env prod --with trace,logs  # one error, its trace and logs
@@ -145,6 +147,17 @@ not in the interactive conflict prompt, not in `--verbose` logs, and not in
 the portal's own audit trail, which records key names only (see
 `app.local_env.fetched`).
 
+#### `qore roles`
+
+Run in the app's frontend module. `qore roles use inspector` reads the roles in
+`src/lib/permissions.ts`, tells the portal they exist on `local` (only there —
+staging and production learn roles from the code that environment deploys:
+`main` for staging, the `production` branch for production), and makes exactly
+the named roles yours on `local`. Sign out and back in to the local app
+afterwards. `qore roles list` shows the roles in your code, the ones `local`
+knows, and yours. Needs write on the module, like `qore env pull`. An announced
+role stays on `local`; nothing removes it automatically.
+
 #### `qore run`
 
 Runs a command with this module's local secrets injected into its

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c4bda056-b13b-52b5-831f-2afd3f6c6867")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2eacac78-c916-5f6b-825a-d5af2c955f32")}catch(e){}}();
 import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
 import {
   addSecretValues,
@@ -655,7 +655,7 @@ var QoreApiClient = class {
     this.o = o;
   }
   o;
-  async once(method, path, body, force) {
+  async once(method, path2, body, force) {
     const token = await this.o.token(force);
     const headers = {
       authorization: `Bearer ${token}`,
@@ -667,7 +667,7 @@ var QoreApiClient = class {
     if (body !== void 0) headers["content-type"] = "application/json";
     let res;
     try {
-      res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {
+      res = await this.o.fetch(`${this.o.apiOrigin}${path2}`, {
         method,
         headers,
         body: body === void 0 ? void 0 : JSON.stringify(body)
@@ -676,13 +676,13 @@ var QoreApiClient = class {
       throw fetchError(e, new URL(this.o.apiOrigin).host);
     }
     const rid = res.headers.get("x-request-id");
-    this.o.onRequest?.(`${method} ${path} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
+    this.o.onRequest?.(`${method} ${path2} \u2192 ${res.status}${rid ? ` (${rid})` : ""}`);
     return res;
   }
-  async request(method, path, body, parse2 = (r) => r.json()) {
-    let res = await this.once(method, path, body, false);
+  async request(method, path2, body, parse2 = (r) => r.json()) {
+    let res = await this.once(method, path2, body, false);
     if (res.status === 401) {
-      res = await this.once(method, path, body, true);
+      res = await this.once(method, path2, body, true);
       if (res.status === 401) {
         const skew = clockSkewSeconds(res.headers.get("date"), (this.o.now ?? (() => /* @__PURE__ */ new Date()))());
         if (skew !== null && Math.abs(skew) > 60) {
@@ -703,14 +703,14 @@ var QoreApiClient = class {
     if (!res.ok) throw await problemToError(res);
     return parse2(res);
   }
-  get(path) {
-    return this.request("GET", path);
+  get(path2) {
+    return this.request("GET", path2);
   }
-  getText(path) {
-    return this.request("GET", path, void 0, (r) => r.text());
+  getText(path2) {
+    return this.request("GET", path2, void 0, (r) => r.text());
   }
-  post(path, body) {
-    return this.request("POST", path, body);
+  post(path2, body) {
+    return this.request("POST", path2, body);
   }
 };
 
@@ -978,7 +978,7 @@ function repoKey(url) {
   if (raw.startsWith("git+")) raw = raw.slice(4);
   if (!raw || raw.includes("\\")) return null;
   let host;
-  let path;
+  let path2;
   if (raw.includes("://")) {
     if (hasDotSegment(raw.slice(raw.indexOf("://") + 3).split("/").slice(1))) return null;
     let u;
@@ -989,14 +989,14 @@ function repoKey(url) {
     }
     if (!SCHEMES.has(u.protocol.toLowerCase())) return null;
     host = u.hostname;
-    path = u.pathname;
+    path2 = u.pathname;
   } else {
     const m = SCP.exec(raw);
     if (!m) return null;
     host = m[1];
-    path = m[2];
+    path2 = m[2];
   }
-  const segments = path.split("/").filter(Boolean);
+  const segments = path2.split("/").filter(Boolean);
   if (!host || segments.length !== 2 || hasDotSegment(segments)) return null;
   const owner = segments[0];
   let repo = segments[1];
@@ -1359,10 +1359,10 @@ async function scanRoot(root) {
   const out = [];
   for (const tenant of (await subdirs(root)).sort()) {
     for (const app of (await subdirs(join6(root, tenant))).sort()) {
-      const path = join6(root, tenant, app);
+      const path2 = join6(root, tenant, app);
       try {
-        const ws = await readWorkspace(path);
-        if (ws) out.push({ kind: "workspace", path, portal: ws.portal, tenantSlug: tenant, appId: ws.appId, appSlug: app });
+        const ws = await readWorkspace(path2);
+        if (ws) out.push({ kind: "workspace", path: path2, portal: ws.portal, tenantSlug: tenant, appId: ws.appId, appSlug: app });
       } catch {
       }
     }
@@ -1440,8 +1440,8 @@ function trimSeparator(p) {
   while (end2 > root.length && (p[end2 - 1] === "/" || p[end2 - 1] === "\\")) end2--;
   return p.slice(0, end2);
 }
-async function underAFile(path) {
-  for (let p = dirname3(path); ; p = dirname3(p)) {
+async function underAFile(path2) {
+  for (let p = dirname3(path2); ; p = dirname3(p)) {
     const s = await stat2(p).catch((e) => e.code === "ENOENT" ? void 0 : null);
     if (s === null) return false;
     if (s) return !s.isDirectory();
@@ -1456,8 +1456,8 @@ function scannedBy(root, e) {
   if (e.kind !== "workspace" || !isInside(root, e.path)) return false;
   return relative2(root, e.path).split(sep).filter(Boolean).length === 2;
 }
-async function writableError(path) {
-  const probe = join8(path, `.qore-write-test-${randomBytes3(6).toString("hex")}`);
+async function writableError(path2) {
+  const probe = join8(path2, `.qore-write-test-${randomBytes3(6).toString("hex")}`);
   try {
     await writeFile3(probe, "");
     await rm2(probe, { force: true });
@@ -1466,42 +1466,42 @@ async function writableError(path) {
     return e;
   }
 }
-var invalid2 = (path, why) => new QoreError("QORE_ROOT_INVALID", `${path} cannot be the projects root: ${why}`, { hint: "Pick another folder: qore init --root <path>." });
-var notWritable = (path, e) => new QoreError("QORE_ROOT_NOT_WRITABLE", `${path} is not writable (${e.code ?? e.message})`, {
+var invalid2 = (path2, why) => new QoreError("QORE_ROOT_INVALID", `${path2} cannot be the projects root: ${why}`, { hint: "Pick another folder: qore init --root <path>." });
+var notWritable = (path2, e) => new QoreError("QORE_ROOT_NOT_WRITABLE", `${path2} is not writable (${e.code ?? e.message})`, {
   hint: "Fix its permissions, or pick another folder: qore init --root <path>.",
   cause: e
 });
 async function checkRoot(deps2, input2) {
-  const path = expandPath(deps2, input2);
-  if (dirname3(path) === path) throw invalid2(path, "it is the filesystem root");
+  const path2 = expandPath(deps2, input2);
+  if (dirname3(path2) === path2) throw invalid2(path2, "it is the filesystem root");
   try {
-    if (!(await stat2(path)).isDirectory()) throw invalid2(path, "it is a file");
+    if (!(await stat2(path2)).isDirectory()) throw invalid2(path2, "it is a file");
   } catch (e) {
     if (e instanceof QoreError) throw e;
     const err = e;
-    if (err.code === "ENOTDIR") throw invalid2(path, "a parent of it is a file");
-    if (NOT_WRITABLE.has(err.code ?? "")) throw notWritable(path, err);
+    if (err.code === "ENOTDIR") throw invalid2(path2, "a parent of it is a file");
+    if (NOT_WRITABLE.has(err.code ?? "")) throw notWritable(path2, err);
     if (err.code !== "ENOENT") throw e;
-    if (await underAFile(path)) throw invalid2(path, "a parent of it is a file");
+    if (await underAFile(path2)) throw invalid2(path2, "a parent of it is a file");
   }
-  const repo = await findRepoRoot(path);
-  if (await findWorkspace(path, deps2.home) || repo && !isInside(repo, deps2.home)) {
-    throw invalid2(path, "it lies inside a project (an app workspace or a git repository)");
+  const repo = await findRepoRoot(path2);
+  if (await findWorkspace(path2, deps2.home) || repo && !isInside(repo, deps2.home)) {
+    throw invalid2(path2, "it lies inside a project (an app workspace or a git repository)");
   }
-  return path;
+  return path2;
 }
-async function createRoot(path) {
+async function createRoot(path2) {
   try {
-    await mkdir3(path, { recursive: true });
+    await mkdir3(path2, { recursive: true });
   } catch (e) {
     const err2 = e;
-    if (NOT_WRITABLE.has(err2.code ?? "")) throw notWritable(path, err2);
-    if (err2.code === "ENOTDIR" || err2.code === "EEXIST") throw invalid2(path, "a parent of it is a file");
+    if (NOT_WRITABLE.has(err2.code ?? "")) throw notWritable(path2, err2);
+    if (err2.code === "ENOTDIR" || err2.code === "EEXIST") throw invalid2(path2, "a parent of it is a file");
     throw e;
   }
-  const err = await writableError(path);
-  if (err) throw notWritable(path, err);
-  return realpath3(path);
+  const err = await writableError(path2);
+  if (err) throw notWritable(path2, err);
+  return realpath3(path2);
 }
 async function validateRoot(deps2, input2) {
   return createRoot(await checkRoot(deps2, input2));
@@ -1519,15 +1519,15 @@ async function quietly(fn) {
 }
 async function remember(deps2, e) {
   await quietly(async () => {
-    const path = await realpath4(e.path);
-    const entry = { ...e, path };
+    const path2 = await realpath4(e.path);
+    const entry = { ...e, path: path2 };
     const cfg = await deps2.config.read();
     const root = cfg.projectsRoot ? await realpath4(cfg.projectsRoot).catch(() => cfg.projectsRoot) : void 0;
     if (root && scannedBy(root, entry)) return;
-    const current = cfg.projects?.find((p) => p.path === path);
+    const current = cfg.projects?.find((p) => p.path === path2);
     if (current && same(current, entry)) return;
     await deps2.withLock(LOCK, () => deps2.config.update((c) => {
-      c.projects = [...(c.projects ?? []).filter((p) => p.path !== path), entry];
+      c.projects = [...(c.projects ?? []).filter((p) => p.path !== path2), entry];
     }).then(() => void 0));
   });
 }
@@ -1825,12 +1825,12 @@ function registerConfig(program, ctx) {
     io2.out(describeConsent(consent, built));
     if (state && consent.source !== "config") io2.err(`${consent.source} in your environment overrides this setting.`);
   });
-  config.command("root").description("Show or set the projects folder qore clones into (see qore init)").argument("[path]", "the new projects folder").option("--unset", "clear it; projects already there stay findable").action(async (path, f) => {
+  config.command("root").description("Show or set the projects folder qore clones into (see qore init)").argument("[path]", "the new projects folder").option("--unset", "clear it; projects already there stay findable").action(async (path2, f) => {
     const { deps: deps2, io: io2 } = ctx;
-    if (path !== void 0 && f.unset) {
+    if (path2 !== void 0 && f.unset) {
       throw new QoreError("QORE_CONTEXT_INVALID", "Pass a path or --unset, not both", { hint: "qore config root <path> | qore config root --unset" });
     }
-    if (path !== void 0) await setRoot(deps2, await validateRoot(deps2, path));
+    if (path2 !== void 0) await setRoot(deps2, await validateRoot(deps2, path2));
     if (f.unset) await setRoot(deps2, void 0);
     const d = await describeRoot(deps2);
     if (ctx.opts().json) {
@@ -2761,8 +2761,8 @@ async function serveErd(o) {
     const host = req.headers.host;
     if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return end(res, 403);
     if (req.method !== "GET" && req.method !== "HEAD") return end(res, 405);
-    const path = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
-    const produce = o.routes[path];
+    const path2 = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+    const produce = o.routes[path2];
     if (produce) {
       try {
         const body = JSON.stringify(await produce());
@@ -2779,7 +2779,7 @@ async function serveErd(o) {
         return;
       }
     }
-    const file = resolve6(root, `.${path === "/" ? "/index.html" : path}`);
+    const file = resolve6(root, `.${path2 === "/" ? "/index.html" : path2}`);
     if (file !== root && !file.startsWith(root + sep3)) return end(res, 404);
     try {
       const body = await readFile6(file);
@@ -3011,10 +3011,10 @@ async function projectCtx(ctx, o) {
   const m = await choose(ctx, known.map((project) => ({ project })), what, false);
   return relocate(ctx, await pathFor(ctx, m, o.needModule));
 }
-function relocate(ctx, path) {
-  if (path === ctx.deps.cwd) return ctx;
-  if (!ctx.opts().json) ctx.io.err(`\u2192 in ${path}`);
-  return withCwd(ctx, path);
+function relocate(ctx, path2) {
+  if (path2 === ctx.deps.cwd) return ctx;
+  if (!ctx.opts().json) ctx.io.err(`\u2192 in ${path2}`);
+  return withCwd(ctx, path2);
 }
 async function rememberContext(ctx, mc, app) {
   const tenantSlug = mc.module.tenant.slug;
@@ -4036,16 +4036,16 @@ async function writeRunFile(deps2, root, rec) {
   await writeJsonAtomic(dir2, name, rec);
 }
 async function removeRunFile(deps2, root) {
-  const { path } = await runFilePath(deps2, root);
-  await unlink2(path).catch(() => {
+  const { path: path2 } = await runFilePath(deps2, root);
+  await unlink2(path2).catch(() => {
   });
 }
 async function leftoverRun(deps2, root, o = {}) {
-  const { path } = await runFilePath(deps2, root);
-  const rec = await readJson(path).catch(() => null);
+  const { path: path2 } = await runFilePath(deps2, root);
+  const rec = await readJson(path2).catch(() => null);
   if (!rec || rec.schemaVersion !== 1) return null;
   if (deps2.launch.isAlive(rec.qorePid)) return rec;
-  if (o.prune !== false) await unlink2(path).catch(() => {
+  if (o.prune !== false) await unlink2(path2).catch(() => {
   });
   return null;
 }
@@ -6705,6 +6705,179 @@ function registerLogout(program, ctx) {
   });
 }
 
+// src/core/roles/api.ts
+var CAPABILITY = "module.local-roles";
+var path = (mc, app) => `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-roles?app_id=${encodeURIComponent(app.id)}`;
+async function fetchLocalRoles(deps2, mc, app) {
+  await ensureCapability(deps2, mc.portal.apiOrigin, CAPABILITY);
+  return explained(mc, () => mc.session.api.get(path(mc, app)));
+}
+async function useLocalRoles(deps2, mc, app, roles, use) {
+  await ensureCapability(deps2, mc.portal.apiOrigin, CAPABILITY);
+  return explained(mc, () => mc.session.api.post(path(mc, app), { roles, use }));
+}
+async function explained(mc, call) {
+  try {
+    return await call();
+  } catch (e) {
+    if (!(e instanceof QoreError)) throw e;
+    if (e.serverCode === "app.access.denied") {
+      throw withDetails(
+        e,
+        { required: "write", have: mc.module.access },
+        `You have ${mc.module.access} on ${mc.module.slug}; local roles need write. Ask a maintainer of the app's dev team for write access.`
+      );
+    }
+    if (e.serverCode === "membership.permission.denied") {
+      throw withDetails(e, {}, "Taking roles on this app needs write on one of its dev teams.");
+    }
+    if (e.serverCode === "auth.scope.insufficient") throw withDetails(e, {}, "Run `qore login` again.");
+    if (e.serverCode === "app.no_platform_identity") {
+      throw new QoreError("QORE_CONTEXT_UNSUPPORTED", "This app manages its own users; the portal hands out no roles for it", {
+        hint: "Give yourself the role in the app's own user admin.",
+        serverCode: e.serverCode,
+        requestId: e.requestId
+      });
+    }
+    throw e;
+  }
+}
+
+// src/core/roles/read.ts
+import { join as join26 } from "path";
+
+// src/core/roles/extract.ts
+var KNOWN = { user: "User", admin: "App admin" };
+function defaultLabel(slug) {
+  return KNOWN[slug] ?? slug.charAt(0).toUpperCase() + slug.slice(1);
+}
+async function extractRoles(source) {
+  const { default: ts } = await import("typescript");
+  const sf = ts.createSourceFile("permissions.ts", source, ts.ScriptTarget.Latest, true);
+  let obj;
+  const visit = (node) => {
+    const first = ts.isCallExpression(node) ? node.arguments[0] : void 0;
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "definePermissions" && first !== void 0 && ts.isObjectLiteralExpression(first)) {
+      obj = first;
+    }
+    if (!obj) ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  if (!obj) return null;
+  const slugs = [];
+  for (const prop of obj.properties) {
+    if (ts.isPropertyAssignment(prop) && (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
+      slugs.push(prop.name.text);
+    }
+  }
+  return slugs.map((slug) => ({ slug, label: defaultLabel(slug) }));
+}
+
+// src/core/roles/read.ts
+var PERMISSIONS_FILE = "src/lib/permissions.ts";
+var SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+var MAX_SLUG = 64;
+var MAX_ROLES = 100;
+async function readCodeRoles(repoRoot) {
+  const source = await readOrNull(join26(repoRoot, PERMISSIONS_FILE));
+  if (source === null) {
+    throw new QoreError("QORE_CONTEXT_UNSUPPORTED", `No ${PERMISSIONS_FILE} in this module`, {
+      hint: "App roles live in the app's frontend module; run this there."
+    });
+  }
+  const roles = await extractRoles(source);
+  if (!roles?.length) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `${PERMISSIONS_FILE} declares no roles in a definePermissions({ ... }) object`, {
+      hint: "The portal reads only an object literal passed straight to definePermissions \u2014 no variable, no spread, no shorthand ({ admin, user })."
+    });
+  }
+  const invalid4 = roles.filter((r) => !SLUG.test(r.slug) || r.slug.length > MAX_SLUG).map((r) => r.slug);
+  if (invalid4.length) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `The portal refuses these role names: ${invalid4.join(", ")}`, {
+      hint: `Use lowercase letters, digits, - and _, starting with a letter or digit, at most ${MAX_SLUG} characters.`,
+      details: { invalid: invalid4 }
+    });
+  }
+  const unique = [...new Map(roles.map((r) => [r.slug, r])).values()];
+  if (unique.length > MAX_ROLES) {
+    throw new QoreError("QORE_CONTEXT_INVALID", `The portal refuses more than ${MAX_ROLES} roles; ${PERMISSIONS_FILE} declares ${unique.length}`, {
+      hint: "Merge roles that grant the same permissions.",
+      details: { count: unique.length, max: MAX_ROLES }
+    });
+  }
+  return unique;
+}
+
+// src/cli/commands/roles.ts
+async function rolesContext(ctx, f, command) {
+  const c = await projectCtx(ctx, { ref: f.project, module: f.module, app: f.app, needModule: true, command });
+  const mc = await moduleContextFor(c, f, command);
+  if (!mc.repoRoot) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `${command} reads the roles in a module repository`, {
+      hint: "cd into the app's frontend module."
+    });
+  }
+  const app = await appFor(c, mc, f.app);
+  await rememberContext(c, mc, app);
+  return { c, mc, app, code: await readCodeRoles(mc.repoRoot) };
+}
+function withFlags(cmd) {
+  return cmd.option("--module <slug|id>", "the module (default: from this repository's git remote)").option("--app <slug|id>", "the app, when the module is part of several").option("--project <ref>", "the project, from anywhere (see qore init)");
+}
+function registerRoles(program, ctx) {
+  const roles = program.command("roles").description("App roles on your own machine (the local environment)");
+  withFlags(roles.command("list").description("Roles in your code, roles local knows, and yours there")).action(async (f) => {
+    const { c, mc, app, code } = await rolesContext(ctx, f, "roles list");
+    const local = await fetchLocalRoles(c.deps, mc, app);
+    if (c.opts().json) {
+      renderJson(c.io, {
+        context: contextJson(mc, app),
+        code: code.map((r) => r.slug),
+        local: local.roles,
+        direct: local.direct,
+        effective: local.effective
+      });
+      return;
+    }
+    const known = new Set(local.roles.map((r) => r.slug));
+    const fresh = code.filter((r) => !known.has(r.slug)).map((r) => r.slug);
+    c.io.err(contextLine(mc, app));
+    c.io.out(`In your code     ${code.map((r) => r.slug).join(", ")}`);
+    c.io.out(`Known on local   ${[...known].join(", ") || "\u2014"}`);
+    c.io.out(`Yours on local   ${local.effective.join(", ") || "\u2014"}`);
+    if (fresh.length) {
+      c.io.out(`New in your code: ${fresh.join(", ")} \u2014 \`qore roles use <role...>\` announces them and makes them yours on local.`);
+    }
+  });
+  withFlags(roles.command("use").description("Announce your code's roles for local and make exactly these yours there").argument("<role...>", "the roles you want on local")).action(async (wanted, f) => {
+    const { c, mc, app, code } = await rolesContext(ctx, f, "roles use");
+    const inCode = new Set(code.map((r) => r.slug));
+    const unknown = wanted.filter((r) => !inCode.has(r));
+    if (unknown.length) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Not a role in ${PERMISSIONS_FILE}: ${unknown.join(", ")}`, {
+        details: { unknown, known: [...inCode] }
+      });
+    }
+    const before = await fetchLocalRoles(c.deps, mc, app);
+    const res = await useLocalRoles(c.deps, mc, app, code, [...new Set(wanted)]);
+    const changed = !sameSet(before.direct, res.direct);
+    const viaGroups = res.effective.filter((r) => !res.direct.includes(r));
+    if (c.opts().json) {
+      renderJson(c.io, { context: contextJson(mc, app), added: res.added, direct: res.direct, effective: res.effective });
+      return;
+    }
+    c.io.err(contextLine(mc, app));
+    c.io.out(`\u2713 Your roles on local: ${res.direct.join(", ")}`);
+    if (res.added.length) c.io.out(`  New on local: ${res.added.join(", ")} \u2014 teammates can pick it in the Access tab too.`);
+    if (viaGroups.length) c.io.err(`! You also hold ${viaGroups.join(", ")} on local through a group.`);
+    if (changed) c.io.err("! Sign out and back in to your local app: your current session still has your old roles.");
+  });
+}
+function sameSet(a, b) {
+  const s = new Set(a);
+  return s.size === new Set(b).size && b.every((x) => s.has(x));
+}
+
 // src/cli/commands/status.ts
 var HEAD = ["ENV", "DEPLOY", "COMMIT", "DEPLOYED", "APP HEALTH"];
 var envRow = (e, now) => [e.name, e.paused ? "paused" : e.status, e.commit?.sha ?? "\u2013", ago(e.commit?.deployedAt ?? null, now), uptime(e.health)];
@@ -6779,7 +6952,7 @@ function registerStatus(program, ctx) {
 }
 
 // src/cli/commands/sync.ts
-import { join as join26, relative as relative9 } from "path";
+import { join as join27, relative as relative9 } from "path";
 import { Option as Option2 } from "commander";
 function asFailure2(slug, e) {
   if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
@@ -6811,7 +6984,7 @@ function registerSync(program, ctx) {
         continue;
       }
       try {
-        dirs[m.slug] = await deps2.git.inspect(join26(ws.root, m.slug));
+        dirs[m.slug] = await deps2.git.inspect(join27(ws.root, m.slug));
         modulesForPlan.push(m);
       } catch (e) {
         earlyFailures.push(asFailure2(m.slug, e));
@@ -7007,6 +7180,7 @@ var COMMANDS = [
   registerTraces,
   registerErrors,
   registerEnv,
+  registerRoles,
   registerRun,
   registerDev,
   registerDb,
@@ -7151,7 +7325,7 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 
 // src/core/config.ts
 import { readFile as readFile8 } from "fs/promises";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -7159,7 +7333,7 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join27(this.dir, "config.json");
+    return join28(this.dir, "config.json");
   }
   async read() {
     let raw;
@@ -7192,7 +7366,7 @@ var ConfigStore = class {
 import { execFile, execFileSync } from "child_process";
 import { mkdir as mkdir4, readdir as readdir4, stat as stat7 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname9, join as join28 } from "path";
+import { dirname as dirname9, join as join29 } from "path";
 function parseRemotes(stdout) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -7304,12 +7478,12 @@ async function status(repoRoot) {
   if (r.code !== 0) return { ok: false, stderr: r.stderr, command };
   return parseStatus(r.stdout);
 }
-async function statOrThrow(path) {
+async function statOrThrow(path2) {
   try {
-    return await stat7(path);
+    return await stat7(path2);
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
-    throw new QoreError("QORE_INTERNAL", `could not stat ${path}`, { cause: err });
+    throw new QoreError("QORE_INTERNAL", `could not stat ${path2}`, { cause: err });
   }
 }
 async function inspect(dir2) {
@@ -7323,7 +7497,7 @@ async function inspect(dir2) {
     throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
   }
   const empty2 = entries.length === 0;
-  const isRepo = await statOrThrow(join28(dir2, ".git")) !== void 0;
+  const isRepo = await statOrThrow(join29(dir2, ".git")) !== void 0;
   const dirRemotes = isRepo ? await remotes(dir2) : [];
   return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
 }
@@ -7356,8 +7530,64 @@ function classifyKeychainError(e, platform) {
     cause: e
   });
 }
-var OsKeychain = class {
-  constructor(platform = process.platform) {
+var MAX_ENTRY_CHARS = 1200;
+var HEAD2 = /^qore-chunked:v1:(\d+):(\d+)$/;
+var ChunkedKeychain = class {
+  constructor(store, maxChars = MAX_ENTRY_CHARS) {
+    this.store = store;
+    this.maxChars = maxChars;
+  }
+  store;
+  maxChars;
+  head(raw) {
+    const m = raw === null ? null : HEAD2.exec(raw);
+    return m ? { gen: Number(m[1]), n: Number(m[2]) } : null;
+  }
+  split(value) {
+    const parts = [];
+    for (let i = 0; i < value.length; ) {
+      let end2 = Math.min(i + this.maxChars, value.length);
+      if (end2 < value.length && /[\uD800-\uDBFF]/.test(value[end2 - 1])) end2--;
+      parts.push(value.slice(i, end2));
+      i = end2;
+    }
+    return parts;
+  }
+  async deleteChunks(account, h) {
+    for (let i = 1; i <= h.n; i++) await this.store.delete(`${account}#${h.gen}.${i}`);
+  }
+  async get(account) {
+    const raw = await this.store.get(account);
+    const h = this.head(raw);
+    if (!h) return raw;
+    let value = "";
+    for (let i = 1; i <= h.n; i++) {
+      const part = await this.store.get(`${account}#${h.gen}.${i}`);
+      if (part === null) return null;
+      value += part;
+    }
+    return value;
+  }
+  async set(account, value) {
+    const old = this.head(await this.store.get(account));
+    if (value.length <= this.maxChars) {
+      await this.store.set(account, value);
+    } else {
+      const gen = (old?.gen ?? 0) + 1;
+      const parts = this.split(value);
+      for (const [i, part] of parts.entries()) await this.store.set(`${account}#${gen}.${i + 1}`, part);
+      await this.store.set(account, `qore-chunked:v1:${gen}:${parts.length}`);
+    }
+    if (old) await this.deleteChunks(account, old);
+  }
+  async delete(account) {
+    const old = this.head(await this.store.get(account));
+    await this.store.delete(account);
+    if (old) await this.deleteChunks(account, old);
+  }
+};
+var EntryKeychain = class {
+  constructor(platform) {
     this.platform = platform;
   }
   platform;
@@ -7382,16 +7612,21 @@ var OsKeychain = class {
     });
   }
 };
+var OsKeychain = class extends ChunkedKeychain {
+  constructor(platform = process.platform) {
+    super(new EntryKeychain(platform));
+  }
+};
 
 // src/platform/lock.ts
 import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join29(dir2, "locks");
+    const locks = join30(dir2, "locks");
     await mkdir5(locks, { recursive: true, mode: 448 });
-    const target = join29(locks, `${name}.lock`);
+    const target = join30(locks, `${name}.lock`);
     await writeFile5(target, "", { flag: "a" });
     let release;
     let compromised;
@@ -7750,7 +7985,7 @@ function systemProxy(platform = process.platform) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.8" : "0.0.0-dev";
+var VERSION = true ? "0.1.10" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -7830,4 +8065,4 @@ if (!drained) {
   process.exit();
 }
 //# sourceMappingURL=cli.js.map
-//# debugId=c4bda056-b13b-52b5-831f-2afd3f6c6867
+//# debugId=2eacac78-c916-5f6b-825a-d5af2c955f32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quatronic/qore",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Qore developer CLI",
   "type": "module",
   "bin": {
@@ -47,6 +47,7 @@
     "picocolors": "^1.1.1",
     "proper-lockfile": "^4.1.2",
     "semver": "^7.8.5",
+    "typescript": "^5.9.2",
     "undici": "^7.29.1"
   },
   "devDependencies": {
@@ -74,7 +75,6 @@
     "react": "19.3.0",
     "react-dom": "19.3.0",
     "tsup": "^8.5.0",
-    "typescript": "^5.9.2",
     "typescript-eslint": "^8.40.0",
     "vite": "8.3.4",
     "vitest": "^3.2.4"