@specific.dev/cli 0.1.37 → 0.1.38

package/dist/cli.js

@@ -41,8 +41,8 @@ var require_dist = __commonJS({
       var $global, $module, $NaN = NaN;
       if ("undefined" != typeof window ? $global = window : "undefined" != typeof self ? $global = self : "undefined" != typeof global ? ($global = global).require = __require : $global = this, void 0 === $global || void 0 === $global.Array) throw new Error("no global object found");
       if ("undefined" != typeof module && ($module = module), !$global.fs && $global.require) try {
-        var fs25 = $global.require("fs");
-        "object" == typeof fs25 && null !== fs25 && 0 !== Object.keys(fs25).length && ($global.fs = fs25);
+        var fs26 = $global.require("fs");
+        "object" == typeof fs26 && null !== fs26 && 0 !== Object.keys(fs26).length && ($global.fs = fs26);
       } catch (e) {
       }
       if (!$global.fs) {
@@ -182368,36 +182368,39 @@ function installCAToTrustStore(certPath) {
     throw new Error(`Unsupported platform: ${platform5}`);
   }
 }
-function generateCertificate(domain) {
+function generateCertificate(domain, keys = []) {
   const caDir = getCADir();
   const caCertPem = fs.readFileSync(path.join(caDir, "ca.crt"), "utf-8");
   const caKeyPem = fs.readFileSync(path.join(caDir, "ca.key"), "utf-8");
   const caCert = forge.pki.certificateFromPem(caCertPem);
   const caKey = forge.pki.privateKeyFromPem(caKeyPem);
-  const keys = forge.pki.rsa.generateKeyPair(2048);
+  const certKeys = forge.pki.rsa.generateKeyPair(2048);
   const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
+  cert.publicKey = certKeys.publicKey;
   cert.serialNumber = forge.util.bytesToHex(forge.random.getBytesSync(16));
   cert.validity.notBefore = /* @__PURE__ */ new Date();
   cert.validity.notAfter = /* @__PURE__ */ new Date();
   cert.validity.notAfter.setDate(cert.validity.notBefore.getDate() + 7);
   cert.setSubject([{ name: "commonName", value: domain }]);
   cert.setIssuer(caCert.subject.attributes);
+  const altNames = [
+    { type: 2, value: domain },
+    { type: 2, value: `*.${domain}` }
+  ];
+  for (const key of keys) {
+    if (key !== "default") {
+      altNames.push({ type: 2, value: `*.${key}.${domain}` });
+    }
+  }
   cert.setExtensions([
     { name: "basicConstraints", cA: false },
     { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
     { name: "extKeyUsage", serverAuth: true },
-    {
-      name: "subjectAltName",
-      altNames: [
-        { type: 2, value: domain },
-        { type: 2, value: `*.${domain}` }
-      ]
-    }
+    { name: "subjectAltName", altNames }
   ]);
   cert.sign(caKey, forge.md.sha256.create());
   return {
-    key: Buffer.from(forge.pki.privateKeyToPem(keys.privateKey)),
+    key: Buffer.from(forge.pki.privateKeyToPem(certKeys.privateKey)),
     cert: Buffer.from(forge.pki.certificateToPem(cert))
   };
 }
@@ -182677,11 +182680,11 @@ import { join as join3, dirname } from "path";
 import { fileURLToPath } from "url";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var docsDir = join3(__dirname, "docs");
-function docsCommand(path20) {
-  const docPath = resolveDocPath(path20);
+function docsCommand(path22) {
+  const docPath = resolveDocPath(path22);
   if (!docPath) {
     console.error(
-      `Documentation not found: ${path20 || "index"}
+      `Documentation not found: ${path22 || "index"}
 
 Run 'specific docs' to see available topics.`
     );
@@ -182690,16 +182693,16 @@ Run 'specific docs' to see available topics.`
   const content = readFileSync3(docPath, "utf-8");
   console.log(content);
 }
-function resolveDocPath(path20) {
-  if (!path20) {
+function resolveDocPath(path22) {
+  if (!path22) {
     const indexPath2 = join3(docsDir, "index.md");
     return existsSync3(indexPath2) ? indexPath2 : null;
   }
-  const directPath = join3(docsDir, `${path20}.md`);
+  const directPath = join3(docsDir, `${path22}.md`);
   if (existsSync3(directPath)) {
     return directPath;
   }
-  const indexPath = join3(docsDir, path20, "index.md");
+  const indexPath = join3(docsDir, path22, "index.md");
   if (existsSync3(indexPath)) {
     return indexPath;
   }
@@ -183234,8 +183237,8 @@ function checkCommand() {
 import React3, { useState as useState3, useEffect as useEffect3, useRef } from "react";
 import { render as render3, Text as Text3, Box as Box3, useApp as useApp2, Static } from "ink";
 import Spinner3 from "ink-spinner";
-import * as fs11 from "fs";
-import * as path12 from "path";
+import * as fs12 from "fs";
+import * as path13 from "path";
 
 // node_modules/chokidar/index.js
 import { EventEmitter } from "node:events";
@@ -183327,7 +183330,7 @@ var ReaddirpStream = class extends Readable {
     this._directoryFilter = normalizeFilter(opts.directoryFilter);
     const statMethod = opts.lstat ? lstat : stat;
     if (wantBigintFsStats) {
-      this._stat = (path20) => statMethod(path20, { bigint: true });
+      this._stat = (path22) => statMethod(path22, { bigint: true });
     } else {
       this._stat = statMethod;
     }
@@ -183352,8 +183355,8 @@ var ReaddirpStream = class extends Readable {
         const par = this.parent;
         const fil = par && par.files;
         if (fil && fil.length > 0) {
-          const { path: path20, depth } = par;
-          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path20));
+          const { path: path22, depth } = par;
+          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path22));
           const awaited = await Promise.all(slice);
           for (const entry of awaited) {
             if (!entry)
@@ -183393,21 +183396,21 @@ var ReaddirpStream = class extends Readable {
       this.reading = false;
     }
   }
-  async _exploreDir(path20, depth) {
+  async _exploreDir(path22, depth) {
     let files;
     try {
-      files = await readdir(path20, this._rdOptions);
+      files = await readdir(path22, this._rdOptions);
     } catch (error) {
       this._onError(error);
     }
-    return { files, depth, path: path20 };
+    return { files, depth, path: path22 };
   }
-  async _formatEntry(dirent, path20) {
+  async _formatEntry(dirent, path22) {
     let entry;
-    const basename4 = this._isDirent ? dirent.name : dirent;
+    const basename5 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = presolve(pjoin(path20, basename4));
-      entry = { path: prelative(this._root, fullPath), fullPath, basename: basename4 };
+      const fullPath = presolve(pjoin(path22, basename5));
+      entry = { path: prelative(this._root, fullPath), fullPath, basename: basename5 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
       this._onError(err);
@@ -183806,16 +183809,16 @@ var delFromSet = (main, prop, item) => {
 };
 var isEmptySet = (val) => val instanceof Set ? val.size === 0 : !val;
 var FsWatchInstances = /* @__PURE__ */ new Map();
-function createFsWatchInstance(path20, options2, listener, errHandler, emitRaw) {
+function createFsWatchInstance(path22, options2, listener, errHandler, emitRaw) {
   const handleEvent = (rawEvent, evPath) => {
-    listener(path20);
-    emitRaw(rawEvent, evPath, { watchedPath: path20 });
-    if (evPath && path20 !== evPath) {
-      fsWatchBroadcast(sp.resolve(path20, evPath), KEY_LISTENERS, sp.join(path20, evPath));
+    listener(path22);
+    emitRaw(rawEvent, evPath, { watchedPath: path22 });
+    if (evPath && path22 !== evPath) {
+      fsWatchBroadcast(sp.resolve(path22, evPath), KEY_LISTENERS, sp.join(path22, evPath));
     }
   };
   try {
-    return fs_watch(path20, {
+    return fs_watch(path22, {
       persistent: options2.persistent
     }, handleEvent);
   } catch (error) {
@@ -183831,12 +183834,12 @@ var fsWatchBroadcast = (fullPath, listenerType, val1, val2, val3) => {
     listener(val1, val2, val3);
   });
 };
-var setFsWatchListener = (path20, fullPath, options2, handlers) => {
+var setFsWatchListener = (path22, fullPath, options2, handlers) => {
   const { listener, errHandler, rawEmitter } = handlers;
   let cont = FsWatchInstances.get(fullPath);
   let watcher;
   if (!options2.persistent) {
-    watcher = createFsWatchInstance(path20, options2, listener, errHandler, rawEmitter);
+    watcher = createFsWatchInstance(path22, options2, listener, errHandler, rawEmitter);
     if (!watcher)
       return;
     return watcher.close.bind(watcher);
@@ -183847,7 +183850,7 @@ var setFsWatchListener = (path20, fullPath, options2, handlers) => {
     addAndConvert(cont, KEY_RAW, rawEmitter);
   } else {
     watcher = createFsWatchInstance(
-      path20,
+      path22,
       options2,
       fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS),
       errHandler,
@@ -183862,7 +183865,7 @@ var setFsWatchListener = (path20, fullPath, options2, handlers) => {
         cont.watcherUnusable = true;
       if (isWindows && error.code === "EPERM") {
         try {
-          const fd = await open(path20, "r");
+          const fd = await open(path22, "r");
           await fd.close();
           broadcastErr(error);
         } catch (err) {
@@ -183893,7 +183896,7 @@ var setFsWatchListener = (path20, fullPath, options2, handlers) => {
   };
 };
 var FsWatchFileInstances = /* @__PURE__ */ new Map();
-var setFsWatchFileListener = (path20, fullPath, options2, handlers) => {
+var setFsWatchFileListener = (path22, fullPath, options2, handlers) => {
   const { listener, rawEmitter } = handlers;
   let cont = FsWatchFileInstances.get(fullPath);
   const copts = cont && cont.options;
@@ -183915,7 +183918,7 @@ var setFsWatchFileListener = (path20, fullPath, options2, handlers) => {
         });
         const currmtime = curr.mtimeMs;
         if (curr.size !== prev.size || currmtime > prev.mtimeMs || currmtime === 0) {
-          foreach(cont.listeners, (listener2) => listener2(path20, curr));
+          foreach(cont.listeners, (listener2) => listener2(path22, curr));
         }
       })
     };
@@ -183945,13 +183948,13 @@ var NodeFsHandler = class {
    * @param listener on fs change
    * @returns closer for the watcher instance
    */
-  _watchWithNodeFs(path20, listener) {
+  _watchWithNodeFs(path22, listener) {
     const opts = this.fsw.options;
-    const directory = sp.dirname(path20);
-    const basename4 = sp.basename(path20);
+    const directory = sp.dirname(path22);
+    const basename5 = sp.basename(path22);
     const parent = this.fsw._getWatchedDir(directory);
-    parent.add(basename4);
-    const absolutePath = sp.resolve(path20);
+    parent.add(basename5);
+    const absolutePath = sp.resolve(path22);
     const options2 = {
       persistent: opts.persistent
     };
@@ -183960,13 +183963,13 @@ var NodeFsHandler = class {
     let closer;
     if (opts.usePolling) {
       const enableBin = opts.interval !== opts.binaryInterval;
-      options2.interval = enableBin && isBinaryPath(basename4) ? opts.binaryInterval : opts.interval;
-      closer = setFsWatchFileListener(path20, absolutePath, options2, {
+      options2.interval = enableBin && isBinaryPath(basename5) ? opts.binaryInterval : opts.interval;
+      closer = setFsWatchFileListener(path22, absolutePath, options2, {
         listener,
         rawEmitter: this.fsw._emitRaw
       });
     } else {
-      closer = setFsWatchListener(path20, absolutePath, options2, {
+      closer = setFsWatchListener(path22, absolutePath, options2, {
         listener,
         errHandler: this._boundHandleError,
         rawEmitter: this.fsw._emitRaw
@@ -183983,12 +183986,12 @@ var NodeFsHandler = class {
       return;
     }
     const dirname8 = sp.dirname(file);
-    const basename4 = sp.basename(file);
+    const basename5 = sp.basename(file);
     const parent = this.fsw._getWatchedDir(dirname8);
     let prevStats = stats;
-    if (parent.has(basename4))
+    if (parent.has(basename5))
       return;
-    const listener = async (path20, newStats) => {
+    const listener = async (path22, newStats) => {
       if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5))
         return;
       if (!newStats || newStats.mtimeMs === 0) {
@@ -184002,18 +184005,18 @@ var NodeFsHandler = class {
             this.fsw._emit(EV.CHANGE, file, newStats2);
           }
           if ((isMacos || isLinux || isFreeBSD) && prevStats.ino !== newStats2.ino) {
-            this.fsw._closeFile(path20);
+            this.fsw._closeFile(path22);
             prevStats = newStats2;
             const closer2 = this._watchWithNodeFs(file, listener);
             if (closer2)
-              this.fsw._addPathCloser(path20, closer2);
+              this.fsw._addPathCloser(path22, closer2);
           } else {
             prevStats = newStats2;
           }
         } catch (error) {
-          this.fsw._remove(dirname8, basename4);
+          this.fsw._remove(dirname8, basename5);
         }
-      } else if (parent.has(basename4)) {
+      } else if (parent.has(basename5)) {
         const at = newStats.atimeMs;
         const mt = newStats.mtimeMs;
         if (!at || at <= mt || mt !== prevStats.mtimeMs) {
@@ -184038,7 +184041,7 @@ var NodeFsHandler = class {
    * @param item basename of this item
    * @returns true if no more processing is needed for this entry.
    */
-  async _handleSymlink(entry, directory, path20, item) {
+  async _handleSymlink(entry, directory, path22, item) {
     if (this.fsw.closed) {
       return;
     }
@@ -184048,7 +184051,7 @@ var NodeFsHandler = class {
       this.fsw._incrReadyCount();
       let linkPath;
       try {
-        linkPath = await fsrealpath(path20);
+        linkPath = await fsrealpath(path22);
       } catch (e) {
         this.fsw._emitReady();
         return true;
@@ -184058,12 +184061,12 @@ var NodeFsHandler = class {
       if (dir.has(item)) {
         if (this.fsw._symlinkPaths.get(full) !== linkPath) {
           this.fsw._symlinkPaths.set(full, linkPath);
-          this.fsw._emit(EV.CHANGE, path20, entry.stats);
+          this.fsw._emit(EV.CHANGE, path22, entry.stats);
         }
       } else {
         dir.add(item);
         this.fsw._symlinkPaths.set(full, linkPath);
-        this.fsw._emit(EV.ADD, path20, entry.stats);
+        this.fsw._emit(EV.ADD, path22, entry.stats);
       }
       this.fsw._emitReady();
       return true;
@@ -184093,9 +184096,9 @@ var NodeFsHandler = class {
         return;
       }
       const item = entry.path;
-      let path20 = sp.join(directory, item);
+      let path22 = sp.join(directory, item);
       current.add(item);
-      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path20, item)) {
+      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path22, item)) {
         return;
       }
       if (this.fsw.closed) {
@@ -184104,11 +184107,11 @@ var NodeFsHandler = class {
       }
       if (item === target || !target && !previous.has(item)) {
         this.fsw._incrReadyCount();
-        path20 = sp.join(dir, sp.relative(dir, path20));
-        this._addToNodeFs(path20, initialAdd, wh, depth + 1);
+        path22 = sp.join(dir, sp.relative(dir, path22));
+        this._addToNodeFs(path22, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       if (!stream)
         return reject();
       stream.once(STR_END, () => {
@@ -184117,7 +184120,7 @@ var NodeFsHandler = class {
           return;
         }
         const wasThrottled = throttler ? throttler.clear() : false;
-        resolve4(void 0);
+        resolve5(void 0);
         previous.getChildren().filter((item) => {
           return item !== directory && !current.has(item);
         }).forEach((item) => {
@@ -184174,13 +184177,13 @@ var NodeFsHandler = class {
    * @param depth Child path actually targeted for watch
    * @param target Child path actually targeted for watch
    */
-  async _addToNodeFs(path20, initialAdd, priorWh, depth, target) {
+  async _addToNodeFs(path22, initialAdd, priorWh, depth, target) {
     const ready = this.fsw._emitReady;
-    if (this.fsw._isIgnored(path20) || this.fsw.closed) {
+    if (this.fsw._isIgnored(path22) || this.fsw.closed) {
       ready();
       return false;
     }
-    const wh = this.fsw._getWatchHelpers(path20);
+    const wh = this.fsw._getWatchHelpers(path22);
     if (priorWh) {
       wh.filterPath = (entry) => priorWh.filterPath(entry);
       wh.filterDir = (entry) => priorWh.filterDir(entry);
@@ -184196,8 +184199,8 @@ var NodeFsHandler = class {
       const follow = this.fsw.options.followSymlinks;
       let closer;
       if (stats.isDirectory()) {
-        const absPath = sp.resolve(path20);
-        const targetPath = follow ? await fsrealpath(path20) : path20;
+        const absPath = sp.resolve(path22);
+        const targetPath = follow ? await fsrealpath(path22) : path22;
         if (this.fsw.closed)
           return;
         closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
@@ -184207,29 +184210,29 @@ var NodeFsHandler = class {
           this.fsw._symlinkPaths.set(absPath, targetPath);
         }
       } else if (stats.isSymbolicLink()) {
-        const targetPath = follow ? await fsrealpath(path20) : path20;
+        const targetPath = follow ? await fsrealpath(path22) : path22;
         if (this.fsw.closed)
           return;
         const parent = sp.dirname(wh.watchPath);
         this.fsw._getWatchedDir(parent).add(wh.watchPath);
         this.fsw._emit(EV.ADD, wh.watchPath, stats);
-        closer = await this._handleDir(parent, stats, initialAdd, depth, path20, wh, targetPath);
+        closer = await this._handleDir(parent, stats, initialAdd, depth, path22, wh, targetPath);
         if (this.fsw.closed)
           return;
         if (targetPath !== void 0) {
-          this.fsw._symlinkPaths.set(sp.resolve(path20), targetPath);
+          this.fsw._symlinkPaths.set(sp.resolve(path22), targetPath);
         }
       } else {
         closer = this._handleFile(wh.watchPath, stats, initialAdd);
       }
       ready();
       if (closer)
-        this.fsw._addPathCloser(path20, closer);
+        this.fsw._addPathCloser(path22, closer);
       return false;
     } catch (error) {
       if (this.fsw._handleError(error)) {
         ready();
-        return path20;
+        return path22;
       }
     }
   }
@@ -184272,24 +184275,24 @@ function createPattern(matcher) {
   }
   return () => false;
 }
-function normalizePath(path20) {
-  if (typeof path20 !== "string")
+function normalizePath(path22) {
+  if (typeof path22 !== "string")
     throw new Error("string expected");
-  path20 = sp2.normalize(path20);
-  path20 = path20.replace(/\\/g, "/");
+  path22 = sp2.normalize(path22);
+  path22 = path22.replace(/\\/g, "/");
   let prepend = false;
-  if (path20.startsWith("//"))
+  if (path22.startsWith("//"))
     prepend = true;
-  path20 = path20.replace(DOUBLE_SLASH_RE, "/");
+  path22 = path22.replace(DOUBLE_SLASH_RE, "/");
   if (prepend)
-    path20 = "/" + path20;
-  return path20;
+    path22 = "/" + path22;
+  return path22;
 }
 function matchPatterns(patterns, testString, stats) {
-  const path20 = normalizePath(testString);
+  const path22 = normalizePath(testString);
   for (let index = 0; index < patterns.length; index++) {
     const pattern = patterns[index];
-    if (pattern(path20, stats)) {
+    if (pattern(path22, stats)) {
       return true;
     }
   }
@@ -184327,19 +184330,19 @@ var toUnix = (string) => {
   }
   return str;
 };
-var normalizePathToUnix = (path20) => toUnix(sp2.normalize(toUnix(path20)));
-var normalizeIgnored = (cwd = "") => (path20) => {
-  if (typeof path20 === "string") {
-    return normalizePathToUnix(sp2.isAbsolute(path20) ? path20 : sp2.join(cwd, path20));
+var normalizePathToUnix = (path22) => toUnix(sp2.normalize(toUnix(path22)));
+var normalizeIgnored = (cwd = "") => (path22) => {
+  if (typeof path22 === "string") {
+    return normalizePathToUnix(sp2.isAbsolute(path22) ? path22 : sp2.join(cwd, path22));
   } else {
-    return path20;
+    return path22;
   }
 };
-var getAbsolutePath = (path20, cwd) => {
-  if (sp2.isAbsolute(path20)) {
-    return path20;
+var getAbsolutePath = (path22, cwd) => {
+  if (sp2.isAbsolute(path22)) {
+    return path22;
   }
-  return sp2.join(cwd, path20);
+  return sp2.join(cwd, path22);
 };
 var EMPTY_SET = Object.freeze(/* @__PURE__ */ new Set());
 var DirEntry = class {
@@ -184404,10 +184407,10 @@ var WatchHelper = class {
   dirParts;
   followSymlinks;
   statMethod;
-  constructor(path20, follow, fsw) {
+  constructor(path22, follow, fsw) {
     this.fsw = fsw;
-    const watchPath = path20;
-    this.path = path20 = path20.replace(REPLACER_RE, "");
+    const watchPath = path22;
+    this.path = path22 = path22.replace(REPLACER_RE, "");
     this.watchPath = watchPath;
     this.fullWatchPath = sp2.resolve(watchPath);
     this.dirParts = [];
@@ -184547,20 +184550,20 @@ var FSWatcher = class extends EventEmitter {
     this._closePromise = void 0;
     let paths = unifyPaths(paths_);
     if (cwd) {
-      paths = paths.map((path20) => {
-        const absPath = getAbsolutePath(path20, cwd);
+      paths = paths.map((path22) => {
+        const absPath = getAbsolutePath(path22, cwd);
         return absPath;
       });
     }
-    paths.forEach((path20) => {
-      this._removeIgnoredPath(path20);
+    paths.forEach((path22) => {
+      this._removeIgnoredPath(path22);
     });
     this._userIgnored = void 0;
     if (!this._readyCount)
       this._readyCount = 0;
     this._readyCount += paths.length;
-    Promise.all(paths.map(async (path20) => {
-      const res = await this._nodeFsHandler._addToNodeFs(path20, !_internal, void 0, 0, _origAdd);
+    Promise.all(paths.map(async (path22) => {
+      const res = await this._nodeFsHandler._addToNodeFs(path22, !_internal, void 0, 0, _origAdd);
       if (res)
         this._emitReady();
       return res;
@@ -184582,17 +184585,17 @@ var FSWatcher = class extends EventEmitter {
       return this;
     const paths = unifyPaths(paths_);
     const { cwd } = this.options;
-    paths.forEach((path20) => {
-      if (!sp2.isAbsolute(path20) && !this._closers.has(path20)) {
+    paths.forEach((path22) => {
+      if (!sp2.isAbsolute(path22) && !this._closers.has(path22)) {
         if (cwd)
-          path20 = sp2.join(cwd, path20);
-        path20 = sp2.resolve(path20);
+          path22 = sp2.join(cwd, path22);
+        path22 = sp2.resolve(path22);
       }
-      this._closePath(path20);
-      this._addIgnoredPath(path20);
-      if (this._watched.has(path20)) {
+      this._closePath(path22);
+      this._addIgnoredPath(path22);
+      if (this._watched.has(path22)) {
         this._addIgnoredPath({
-          path: path20,
+          path: path22,
           recursive: true
         });
       }
@@ -184656,38 +184659,38 @@ var FSWatcher = class extends EventEmitter {
    * @param stats arguments to be passed with event
    * @returns the error if defined, otherwise the value of the FSWatcher instance's `closed` flag
    */
-  async _emit(event, path20, stats) {
+  async _emit(event, path22, stats) {
     if (this.closed)
       return;
     const opts = this.options;
     if (isWindows)
-      path20 = sp2.normalize(path20);
+      path22 = sp2.normalize(path22);
     if (opts.cwd)
-      path20 = sp2.relative(opts.cwd, path20);
-    const args = [path20];
+      path22 = sp2.relative(opts.cwd, path22);
+    const args = [path22];
     if (stats != null)
       args.push(stats);
     const awf = opts.awaitWriteFinish;
     let pw;
-    if (awf && (pw = this._pendingWrites.get(path20))) {
+    if (awf && (pw = this._pendingWrites.get(path22))) {
       pw.lastChange = /* @__PURE__ */ new Date();
       return this;
     }
     if (opts.atomic) {
       if (event === EVENTS.UNLINK) {
-        this._pendingUnlinks.set(path20, [event, ...args]);
+        this._pendingUnlinks.set(path22, [event, ...args]);
         setTimeout(() => {
-          this._pendingUnlinks.forEach((entry, path21) => {
+          this._pendingUnlinks.forEach((entry, path23) => {
             this.emit(...entry);
             this.emit(EVENTS.ALL, ...entry);
-            this._pendingUnlinks.delete(path21);
+            this._pendingUnlinks.delete(path23);
           });
         }, typeof opts.atomic === "number" ? opts.atomic : 100);
         return this;
       }
-      if (event === EVENTS.ADD && this._pendingUnlinks.has(path20)) {
+      if (event === EVENTS.ADD && this._pendingUnlinks.has(path22)) {
         event = EVENTS.CHANGE;
-        this._pendingUnlinks.delete(path20);
+        this._pendingUnlinks.delete(path22);
       }
     }
     if (awf && (event === EVENTS.ADD || event === EVENTS.CHANGE) && this._readyEmitted) {
@@ -184705,16 +184708,16 @@ var FSWatcher = class extends EventEmitter {
           this.emitWithAll(event, args);
         }
       };
-      this._awaitWriteFinish(path20, awf.stabilityThreshold, event, awfEmit);
+      this._awaitWriteFinish(path22, awf.stabilityThreshold, event, awfEmit);
       return this;
     }
     if (event === EVENTS.CHANGE) {
-      const isThrottled = !this._throttle(EVENTS.CHANGE, path20, 50);
+      const isThrottled = !this._throttle(EVENTS.CHANGE, path22, 50);
       if (isThrottled)
         return this;
     }
     if (opts.alwaysStat && stats === void 0 && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-      const fullPath = opts.cwd ? sp2.join(opts.cwd, path20) : path20;
+      const fullPath = opts.cwd ? sp2.join(opts.cwd, path22) : path22;
       let stats2;
       try {
         stats2 = await stat3(fullPath);
@@ -184745,23 +184748,23 @@ var FSWatcher = class extends EventEmitter {
    * @param timeout duration of time to suppress duplicate actions
    * @returns tracking object or false if action should be suppressed
    */
-  _throttle(actionType, path20, timeout) {
+  _throttle(actionType, path22, timeout) {
     if (!this._throttled.has(actionType)) {
       this._throttled.set(actionType, /* @__PURE__ */ new Map());
     }
     const action = this._throttled.get(actionType);
     if (!action)
       throw new Error("invalid throttle");
-    const actionPath = action.get(path20);
+    const actionPath = action.get(path22);
     if (actionPath) {
       actionPath.count++;
       return false;
     }
     let timeoutObject;
     const clear = () => {
-      const item = action.get(path20);
+      const item = action.get(path22);
       const count = item ? item.count : 0;
-      action.delete(path20);
+      action.delete(path22);
       clearTimeout(timeoutObject);
       if (item)
         clearTimeout(item.timeoutObject);
@@ -184769,7 +184772,7 @@ var FSWatcher = class extends EventEmitter {
     };
     timeoutObject = setTimeout(clear, timeout);
     const thr = { timeoutObject, clear, count: 0 };
-    action.set(path20, thr);
+    action.set(path22, thr);
     return thr;
   }
   _incrReadyCount() {
@@ -184783,44 +184786,44 @@ var FSWatcher = class extends EventEmitter {
    * @param event
    * @param awfEmit Callback to be called when ready for event to be emitted.
    */
-  _awaitWriteFinish(path20, threshold, event, awfEmit) {
+  _awaitWriteFinish(path22, threshold, event, awfEmit) {
     const awf = this.options.awaitWriteFinish;
     if (typeof awf !== "object")
       return;
     const pollInterval = awf.pollInterval;
     let timeoutHandler;
-    let fullPath = path20;
-    if (this.options.cwd && !sp2.isAbsolute(path20)) {
-      fullPath = sp2.join(this.options.cwd, path20);
+    let fullPath = path22;
+    if (this.options.cwd && !sp2.isAbsolute(path22)) {
+      fullPath = sp2.join(this.options.cwd, path22);
     }
     const now = /* @__PURE__ */ new Date();
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
       statcb(fullPath, (err, curStat) => {
-        if (err || !writes.has(path20)) {
+        if (err || !writes.has(path22)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
           return;
         }
         const now2 = Number(/* @__PURE__ */ new Date());
         if (prevStat && curStat.size !== prevStat.size) {
-          writes.get(path20).lastChange = now2;
+          writes.get(path22).lastChange = now2;
         }
-        const pw = writes.get(path20);
+        const pw = writes.get(path22);
         const df = now2 - pw.lastChange;
         if (df >= threshold) {
-          writes.delete(path20);
+          writes.delete(path22);
           awfEmit(void 0, curStat);
         } else {
           timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval, curStat);
         }
       });
     }
-    if (!writes.has(path20)) {
-      writes.set(path20, {
+    if (!writes.has(path22)) {
+      writes.set(path22, {
         lastChange: now,
         cancelWait: () => {
-          writes.delete(path20);
+          writes.delete(path22);
           clearTimeout(timeoutHandler);
           return event;
         }
@@ -184831,8 +184834,8 @@ var FSWatcher = class extends EventEmitter {
   /**
    * Determines whether user has asked to ignore this path.
    */
-  _isIgnored(path20, stats) {
-    if (this.options.atomic && DOT_RE.test(path20))
+  _isIgnored(path22, stats) {
+    if (this.options.atomic && DOT_RE.test(path22))
       return true;
     if (!this._userIgnored) {
       const { cwd } = this.options;
@@ -184842,17 +184845,17 @@ var FSWatcher = class extends EventEmitter {
       const list = [...ignoredPaths.map(normalizeIgnored(cwd)), ...ignored];
       this._userIgnored = anymatch(list, void 0);
     }
-    return this._userIgnored(path20, stats);
+    return this._userIgnored(path22, stats);
   }
-  _isntIgnored(path20, stat4) {
-    return !this._isIgnored(path20, stat4);
+  _isntIgnored(path22, stat4) {
+    return !this._isIgnored(path22, stat4);
   }
   /**
    * Provides a set of common helpers and properties relating to symlink handling.
    * @param path file or directory pattern being watched
    */
-  _getWatchHelpers(path20) {
-    return new WatchHelper(path20, this.options.followSymlinks, this);
+  _getWatchHelpers(path22) {
+    return new WatchHelper(path22, this.options.followSymlinks, this);
   }
   // Directory helpers
   // -----------------
@@ -184884,63 +184887,63 @@ var FSWatcher = class extends EventEmitter {
    * @param item      base path of item/directory
    */
   _remove(directory, item, isDirectory) {
-    const path20 = sp2.join(directory, item);
-    const fullPath = sp2.resolve(path20);
-    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path20) || this._watched.has(fullPath);
-    if (!this._throttle("remove", path20, 100))
+    const path22 = sp2.join(directory, item);
+    const fullPath = sp2.resolve(path22);
+    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path22) || this._watched.has(fullPath);
+    if (!this._throttle("remove", path22, 100))
       return;
     if (!isDirectory && this._watched.size === 1) {
       this.add(directory, item, true);
     }
-    const wp = this._getWatchedDir(path20);
+    const wp = this._getWatchedDir(path22);
     const nestedDirectoryChildren = wp.getChildren();
-    nestedDirectoryChildren.forEach((nested) => this._remove(path20, nested));
+    nestedDirectoryChildren.forEach((nested) => this._remove(path22, nested));
     const parent = this._getWatchedDir(directory);
     const wasTracked = parent.has(item);
     parent.remove(item);
     if (this._symlinkPaths.has(fullPath)) {
       this._symlinkPaths.delete(fullPath);
     }
-    let relPath = path20;
+    let relPath = path22;
     if (this.options.cwd)
-      relPath = sp2.relative(this.options.cwd, path20);
+      relPath = sp2.relative(this.options.cwd, path22);
     if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
       const event = this._pendingWrites.get(relPath).cancelWait();
       if (event === EVENTS.ADD)
         return;
     }
-    this._watched.delete(path20);
+    this._watched.delete(path22);
     this._watched.delete(fullPath);
     const eventName = isDirectory ? EVENTS.UNLINK_DIR : EVENTS.UNLINK;
-    if (wasTracked && !this._isIgnored(path20))
-      this._emit(eventName, path20);
-    this._closePath(path20);
+    if (wasTracked && !this._isIgnored(path22))
+      this._emit(eventName, path22);
+    this._closePath(path22);
   }
   /**
    * Closes all watchers for a path
    */
-  _closePath(path20) {
-    this._closeFile(path20);
-    const dir = sp2.dirname(path20);
-    this._getWatchedDir(dir).remove(sp2.basename(path20));
+  _closePath(path22) {
+    this._closeFile(path22);
+    const dir = sp2.dirname(path22);
+    this._getWatchedDir(dir).remove(sp2.basename(path22));
   }
   /**
    * Closes only file-specific watchers
    */
-  _closeFile(path20) {
-    const closers = this._closers.get(path20);
+  _closeFile(path22) {
+    const closers = this._closers.get(path22);
     if (!closers)
       return;
     closers.forEach((closer) => closer());
-    this._closers.delete(path20);
+    this._closers.delete(path22);
   }
-  _addPathCloser(path20, closer) {
+  _addPathCloser(path22, closer) {
     if (!closer)
       return;
-    let list = this._closers.get(path20);
+    let list = this._closers.get(path22);
     if (!list) {
       list = [];
-      this._closers.set(path20, list);
+      this._closers.set(path22, list);
     }
     list.push(closer);
   }
@@ -184998,8 +185001,8 @@ var StablePortAllocator = class {
   portsFilePath;
   savedPorts = {};
   usedPorts = /* @__PURE__ */ new Set();
-  constructor(projectRoot) {
-    this.portsDir = path4.join(projectRoot, ".specific");
+  constructor(projectRoot, key = "default") {
+    this.portsDir = path4.join(projectRoot, ".specific", "keys", key);
     this.portsFilePath = path4.join(this.portsDir, "ports.json");
     this.loadPorts();
   }
@@ -185185,10 +185188,10 @@ async function downloadFile(url, destPath, onProgress) {
         });
       }
     }
-    await new Promise((resolve4, reject) => {
+    await new Promise((resolve5, reject) => {
       fileStream.end((err) => {
         if (err) reject(err);
-        else resolve4();
+        else resolve5();
       });
     });
     fs5.renameSync(partPath, destPath);
@@ -185552,7 +185555,7 @@ async function startStorage(storage, port, dataDir) {
   };
 }
 async function runCommand(command, args, env2) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = spawn(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       env: env2
@@ -185563,7 +185566,7 @@ async function runCommand(command, args, env2) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4();
+        resolve5();
       } else {
         reject(new Error(`Command failed with code ${code}: ${stderr}`));
       }
@@ -185572,7 +185575,7 @@ async function runCommand(command, args, env2) {
   });
 }
 async function createPostgresDatabase(postgresPath, dataDir, dbName, env2) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = spawn(
       postgresPath,
       ["--single", "-D", dataDir, "postgres"],
@@ -185586,7 +185589,7 @@ async function createPostgresDatabase(postgresPath, dataDir, dbName, env2) {
       stderr += data.toString();
     });
     proc.on("close", (code) => {
-      resolve4();
+      resolve5();
     });
     proc.on("error", reject);
     proc.stdin?.write(`CREATE DATABASE "${dbName}";
@@ -185606,33 +185609,33 @@ async function waitForTcpPort(host, port, timeoutMs = 3e4) {
   throw new Error(`Port ${port} did not become available within timeout`);
 }
 function checkTcpPort(host, port) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const socket = new net.Socket();
     socket.setTimeout(1e3);
     socket.on("connect", () => {
       socket.destroy();
-      resolve4(true);
+      resolve5(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     socket.connect(port, host);
   });
 }
 async function stopProcess(proc) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     if (proc.killed || proc.exitCode !== null) {
-      resolve4();
+      resolve5();
       return;
     }
     proc.once("exit", () => {
       clearTimeout(forceKillTimeout);
-      resolve4();
+      resolve5();
     });
     proc.kill("SIGTERM");
     const forceKillTimeout = setTimeout(() => {
@@ -185643,7 +185646,7 @@ async function stopProcess(proc) {
   });
 }
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 
 // src/lib/dev/service-runner.ts
@@ -186041,14 +186044,14 @@ function startService(service, resources, secrets, configs, endpointPorts, servi
     ports: endpointPorts,
     process: child,
     async stop() {
-      return new Promise((resolve4) => {
+      return new Promise((resolve5) => {
         if (child.killed || child.exitCode !== null) {
-          resolve4();
+          resolve5();
           return;
         }
         child.once("exit", () => {
           clearTimeout(forceKillTimeout);
-          resolve4();
+          resolve5();
         });
         child.kill("SIGTERM");
         const forceKillTimeout = setTimeout(() => {
@@ -186069,11 +186072,16 @@ var InstanceStateManager = class {
   statePath;
   lockPath;
   ownsInstances = false;
-  constructor(projectRoot) {
-    this.stateDir = path9.join(projectRoot, ".specific");
+  key;
+  constructor(projectRoot, key = "default") {
+    this.key = key;
+    this.stateDir = path9.join(projectRoot, ".specific", "keys", key);
     this.statePath = path9.join(this.stateDir, "state.json");
     this.lockPath = path9.join(this.stateDir, "state.lock");
   }
+  getKey() {
+    return this.key;
+  }
   ensureStateDir() {
     if (!fs8.existsSync(this.stateDir)) {
       fs8.mkdirSync(this.stateDir, { recursive: true });
@@ -186124,7 +186132,7 @@ var InstanceStateManager = class {
             }
             continue;
           }
-          await new Promise((resolve4) => setTimeout(resolve4, 100));
+          await new Promise((resolve5) => setTimeout(resolve5, 100));
         } else {
           throw e;
         }
@@ -186280,7 +186288,7 @@ var HTTP_PORT = 80;
 var HTTPS_PORT = 443;
 var DOMAIN_SUFFIX = ".local.spcf.app";
 var ADMIN_DOMAIN = "local.spcf.app";
-var DRIZZLE_GATEWAY_DOMAIN = "__drizzle_gateway.local.spcf.app";
+var DRIZZLE_GATEWAY_PREFIX = "__drizzle_gateway";
 var MIME_TYPES = {
   ".html": "text/html",
   ".css": "text/css",
@@ -186295,11 +186303,31 @@ var MIME_TYPES = {
   ".woff2": "font/woff2",
   ".txt": "text/plain"
 };
-async function startHttpProxy(services, certificate, getState, drizzleGatewayPort) {
+async function startHttpProxy(services, certificate, getState, instanceKey = "default") {
   const serviceMap = /* @__PURE__ */ new Map();
+  const adminPortMap = /* @__PURE__ */ new Map();
+  const drizzleGatewayPortMap = /* @__PURE__ */ new Map();
+  const buildMapKey = (serviceName, key) => {
+    return key === "default" ? serviceName : `${serviceName}.${key}`;
+  };
   for (const svc of services) {
-    serviceMap.set(svc.name, svc.port);
+    serviceMap.set(buildMapKey(svc.name, instanceKey), svc.port);
   }
+  const updateServices = (registryServices, keys) => {
+    serviceMap.clear();
+    adminPortMap.clear();
+    drizzleGatewayPortMap.clear();
+    for (const svc of registryServices) {
+      serviceMap.set(buildMapKey(svc.serviceName, svc.key), svc.port);
+    }
+    for (const [key, registration] of Object.entries(keys)) {
+      adminPortMap.set(key, registration.adminPort);
+      if (registration.drizzleGatewayPort !== void 0) {
+        drizzleGatewayPortMap.set(key, registration.drizzleGatewayPort);
+      }
+    }
+    writeLog("proxy", `Updated service map: ${serviceMap.size} services, ${adminPortMap.size} admin instances, ${drizzleGatewayPortMap.size} drizzle gateways`);
+  };
   const { key: defaultKey, cert: defaultCert } = certificate;
   const proxy = httpProxy.createProxyServer({});
   proxy.on("error", (err, req, res) => {
@@ -186313,38 +186341,64 @@ async function startHttpProxy(services, certificate, getState, drizzleGatewayPor
   const handleRequest = (req, res) => {
     const host = req.headers.host || "";
     const hostname = host.split(":")[0];
-    if (hostname === ADMIN_DOMAIN) {
-      return handleAdminRequest(req, res, proxy, getState);
-    }
-    if (hostname === DRIZZLE_GATEWAY_DOMAIN && drizzleGatewayPort) {
-      proxy.web(req, res, {
-        target: `http://127.0.0.1:${drizzleGatewayPort}`
-      });
+    const drizzleKey = extractDrizzleGatewayKey(host);
+    if (drizzleKey !== null) {
+      const drizzlePort = drizzleGatewayPortMap.get(drizzleKey);
+      if (drizzlePort) {
+        proxy.web(req, res, {
+          target: `http://127.0.0.1:${drizzlePort}`
+        });
+        return;
+      }
+      res.writeHead(503, { "Content-Type": "text/html" });
+      res.end("<h1>Database Viewer</h1><p>No database viewer running for this instance.</p>");
       return;
     }
-    const serviceName = extractServiceName(host);
-    if (!serviceName) {
-      return sendNotFound(res, null, services);
+    const adminKey = extractAdminKey(host);
+    if (adminKey !== null) {
+      const adminPort = adminPortMap.get(adminKey);
+      if (adminPort) {
+        const url = new URL(req.url || "/", "http://localhost");
+        if (url.pathname.startsWith("/api/")) {
+          proxy.web(req, res, { target: `http://127.0.0.1:${adminPort}` });
+          return;
+        }
+        serveStaticFile(res, url.pathname);
+        return;
+      }
+      if (adminKey === "default" && hostname === ADMIN_DOMAIN) {
+        res.writeHead(503, { "Content-Type": "text/html" });
+        res.end("<h1>Admin UI</h1><p>No dev instance running. Start <code>specific dev</code> first.</p>");
+        return;
+      }
+    }
+    const route = extractServiceAndKey(host);
+    if (!route) {
+      return sendNotFound(res, null, serviceMap);
     }
-    const targetPort = serviceMap.get(serviceName);
+    const mapKey = buildMapKey(route.serviceName, route.key);
+    const targetPort = serviceMap.get(mapKey);
     if (!targetPort) {
-      return sendNotFound(res, serviceName, services);
+      return sendNotFound(res, route.serviceName, serviceMap);
     }
     proxy.web(req, res, { target: `http://127.0.0.1:${targetPort}` });
   };
   const handleUpgrade = (req, socket, head) => {
     const host = req.headers.host || "";
-    const hostname = host.split(":")[0];
-    if (hostname === ADMIN_DOMAIN) {
-      socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
-      return;
+    const adminKey = extractAdminKey(host);
+    if (adminKey !== null) {
+      if (adminPortMap.has(adminKey)) {
+        socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
+        return;
+      }
     }
-    const serviceName = extractServiceName(host);
-    if (!serviceName) {
+    const route = extractServiceAndKey(host);
+    if (!route) {
       socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
       return;
     }
-    const targetPort = serviceMap.get(serviceName);
+    const mapKey = buildMapKey(route.serviceName, route.key);
+    const targetPort = serviceMap.get(mapKey);
     if (!targetPort) {
       socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
       return;
@@ -186361,7 +186415,7 @@ async function startHttpProxy(services, certificate, getState, drizzleGatewayPor
     handleRequest
   );
   httpsServer.on("upgrade", handleUpgrade);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let httpStarted = false;
     let httpsStarted = false;
     let failed = false;
@@ -186372,17 +186426,25 @@ async function startHttpProxy(services, certificate, getState, drizzleGatewayPor
           "proxy",
           `HTTP/HTTPS proxy started on ports ${HTTP_PORT}/${HTTPS_PORT}`
         );
-        resolve4({
+        resolve5({
           httpPort: HTTP_PORT,
           httpsPort: HTTPS_PORT,
+          updateServices,
+          updateCertificate(newCert) {
+            httpsServer.setSecureContext({
+              key: newCert.key,
+              cert: newCert.cert
+            });
+            writeLog("proxy", "Certificate updated");
+          },
           async stop() {
-            return new Promise((resolve5) => {
+            return new Promise((resolve6) => {
               let closed = 0;
               const onClose = () => {
                 closed++;
                 if (closed === 2) {
                   clearTimeout(forceCloseTimeout);
-                  resolve5();
+                  resolve6();
                 }
               };
               httpServer.close(onClose);
@@ -186390,7 +186452,7 @@ async function startHttpProxy(services, certificate, getState, drizzleGatewayPor
               const forceCloseTimeout = setTimeout(() => {
                 httpServer.closeAllConnections?.();
                 httpsServer.closeAllConnections?.();
-                resolve5();
+                resolve6();
               }, 2e3);
             });
           }
@@ -186424,15 +186486,70 @@ async function startHttpProxy(services, certificate, getState, drizzleGatewayPor
     });
   });
 }
-function extractServiceName(host) {
+function extractServiceAndKey(host) {
+  const hostname = host.split(":")[0];
+  if (!hostname || !hostname.endsWith(DOMAIN_SUFFIX)) {
+    return null;
+  }
+  const prefix = hostname.slice(0, -DOMAIN_SUFFIX.length);
+  if (!prefix) {
+    return null;
+  }
+  const parts = prefix.split(".");
+  if (parts.length === 1) {
+    return { serviceName: parts[0], key: "default" };
+  } else if (parts.length === 2) {
+    return { serviceName: parts[0], key: parts[1] };
+  }
+  return null;
+}
+function extractDrizzleGatewayKey(host) {
   const hostname = host.split(":")[0];
   if (!hostname || !hostname.endsWith(DOMAIN_SUFFIX)) {
     return null;
   }
-  return hostname.slice(0, -DOMAIN_SUFFIX.length);
+  const prefix = hostname.slice(0, -DOMAIN_SUFFIX.length);
+  if (!prefix) {
+    return null;
+  }
+  const parts = prefix.split(".");
+  if (parts.length === 1 && parts[0] === DRIZZLE_GATEWAY_PREFIX) {
+    return "default";
+  } else if (parts.length === 2 && parts[0] === DRIZZLE_GATEWAY_PREFIX) {
+    return parts[1];
+  }
+  return null;
 }
-function sendNotFound(res, requestedService, availableServices) {
-  const serviceList = availableServices.map((s) => `<li>${s.name}.local.spcf.app</li>`).join("\n");
+function extractAdminKey(host) {
+  const hostname = host.split(":")[0];
+  if (!hostname) {
+    return null;
+  }
+  if (hostname === ADMIN_DOMAIN) {
+    return "default";
+  }
+  if (!hostname.endsWith(DOMAIN_SUFFIX)) {
+    return null;
+  }
+  const prefix = hostname.slice(0, -DOMAIN_SUFFIX.length);
+  if (!prefix) {
+    return null;
+  }
+  const parts = prefix.split(".");
+  if (parts.length === 1) {
+    return parts[0];
+  }
+  return null;
+}
+function sendNotFound(res, requestedService, serviceMap) {
+  const serviceList = Array.from(serviceMap.keys()).map((key) => {
+    const parts = key.split(".");
+    if (parts.length === 1) {
+      return `<li>${parts[0]}.local.spcf.app</li>`;
+    } else {
+      return `<li>${key}.local.spcf.app</li>`;
+    }
+  }).join("\n");
   const message = requestedService ? `No service named "${requestedService}" is running.` : "Invalid host header.";
   res.writeHead(404, { "Content-Type": "text/html" });
   res.end(`<!DOCTYPE html>
@@ -186441,36 +186558,11 @@ function sendNotFound(res, requestedService, availableServices) {
 <body>
   <h1>Service Not Found</h1>
   <p>${message}</p>
-  ${availableServices.length > 0 ? `<p>Available services:</p>
+  ${serviceMap.size > 0 ? `<p>Available services:</p>
   <ul>${serviceList}</ul>` : "<p>No services are currently exposed.</p>"}
 </body>
 </html>`);
 }
-function handleAdminRequest(req, res, proxy, getState) {
-  const url = new URL(req.url || "/", "http://localhost");
-  if (url.pathname.startsWith("/api/")) {
-    return handleAdminApi(req, res, url, getState);
-  }
-  serveStaticFile(res, url.pathname);
-}
-function handleAdminApi(_req, res, url, getState) {
-  res.setHeader("Content-Type", "application/json");
-  res.setHeader("Access-Control-Allow-Origin", "*");
-  const pathname = url.pathname.endsWith("/") && url.pathname.length > 1 ? url.pathname.slice(0, -1) : url.pathname;
-  if (pathname === "/api/state") {
-    if (!getState) {
-      res.writeHead(500);
-      res.end(JSON.stringify({ error: "State not available" }));
-      return;
-    }
-    const state = getState();
-    res.writeHead(200);
-    res.end(JSON.stringify(state));
-    return;
-  }
-  res.writeHead(404);
-  res.end(JSON.stringify({ error: "Not found" }));
-}
 function serveStaticFile(res, pathname) {
   let filePath = pathname;
   if (filePath === "/" || filePath.endsWith("/")) {
@@ -186522,6 +186614,48 @@ function serveFileContent(res, filePath, contentType, statusCode = 200) {
     res.end("<h1>Internal Server Error</h1>");
   }
 }
+async function startAdminServer(getState) {
+  return new Promise((resolve5, reject) => {
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url || "/", "http://localhost");
+      res.setHeader("Access-Control-Allow-Origin", "*");
+      res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      if (req.method === "OPTIONS") {
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+      const pathname = url.pathname.endsWith("/") && url.pathname.length > 1 ? url.pathname.slice(0, -1) : url.pathname;
+      if (pathname === "/api/state") {
+        res.setHeader("Content-Type", "application/json");
+        const state = getState();
+        res.writeHead(200);
+        res.end(JSON.stringify(state));
+        return;
+      }
+      res.setHeader("Content-Type", "application/json");
+      res.writeHead(404);
+      res.end(JSON.stringify({ error: "Not found" }));
+    });
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (!addr || typeof addr === "string") {
+        reject(new Error("Failed to get server address"));
+        return;
+      }
+      const port = addr.port;
+      writeLog("admin", `Admin API server started on port ${port}`);
+      resolve5({
+        port,
+        stop: () => new Promise((res, rej) => {
+          server.close((err) => err ? rej(err) : res());
+        })
+      });
+    });
+  });
+}
 
 // src/lib/dev/electric-manager.ts
 import * as net2 from "net";
@@ -186579,33 +186713,33 @@ async function waitForTcpPort2(host, port, timeoutMs = 3e4) {
   throw new Error(`Electric port ${port} did not become available within timeout`);
 }
 function checkTcpPort2(host, port) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const socket = new net2.Socket();
     socket.setTimeout(1e3);
     socket.on("connect", () => {
       socket.destroy();
-      resolve4(true);
+      resolve5(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     socket.connect(port, host);
   });
 }
 async function stopProcess2(proc) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     if (proc.killed || proc.exitCode !== null) {
-      resolve4();
+      resolve5();
       return;
     }
     proc.once("exit", () => {
       clearTimeout(forceKillTimeout);
-      resolve4();
+      resolve5();
     });
     proc.kill("SIGTERM");
     const forceKillTimeout = setTimeout(() => {
@@ -186616,7 +186750,7 @@ async function stopProcess2(proc) {
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 
 // src/lib/dev/drizzle-gateway-manager.ts
@@ -186700,33 +186834,33 @@ async function waitForTcpPort3(host, port, timeoutMs = 3e4) {
   );
 }
 function checkTcpPort3(host, port) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const socket = new net3.Socket();
     socket.setTimeout(1e3);
     socket.on("connect", () => {
       socket.destroy();
-      resolve4(true);
+      resolve5(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     socket.connect(port, host);
   });
 }
 async function stopProcess3(proc) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     if (proc.killed || proc.exitCode !== null) {
-      resolve4();
+      resolve5();
       return;
     }
     proc.once("exit", () => {
       clearTimeout(forceKillTimeout);
-      resolve4();
+      resolve5();
     });
     proc.kill("SIGTERM");
     const forceKillTimeout = setTimeout(() => {
@@ -186737,7 +186871,7 @@ async function stopProcess3(proc) {
   });
 }
 function sleep3(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 
 // src/lib/dev/sync-detector.ts
@@ -186928,19 +187062,345 @@ function watchConfigFile(configPath, debounceMs, onChange) {
   };
 }
 
+// src/lib/dev/proxy-registry.ts
+import * as fs11 from "fs";
+import * as path12 from "path";
+import * as os4 from "os";
+var ProxyRegistryManager = class {
+  proxyDir;
+  ownerPath;
+  registryPath;
+  lockPath;
+  isOwner = false;
+  registryWatcher = null;
+  constructor() {
+    this.proxyDir = path12.join(os4.homedir(), ".specific", "proxy");
+    this.ownerPath = path12.join(this.proxyDir, "owner.json");
+    this.registryPath = path12.join(this.proxyDir, "registry.json");
+    this.lockPath = path12.join(this.proxyDir, "registry.lock");
+  }
+  ensureProxyDir() {
+    if (!fs11.existsSync(this.proxyDir)) {
+      fs11.mkdirSync(this.proxyDir, { recursive: true });
+    }
+  }
+  isProcessRunning(pid) {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (e) {
+      const err = e;
+      return err.code !== "ESRCH";
+    }
+  }
+  async acquireLock(timeoutMs = 5e3) {
+    this.ensureProxyDir();
+    const startTime = Date.now();
+    while (Date.now() - startTime < timeoutMs) {
+      try {
+        const fd = fs11.openSync(
+          this.lockPath,
+          fs11.constants.O_CREAT | fs11.constants.O_EXCL | fs11.constants.O_WRONLY
+        );
+        fs11.writeSync(fd, String(process.pid));
+        fs11.closeSync(fd);
+        return () => {
+          try {
+            fs11.unlinkSync(this.lockPath);
+          } catch {
+          }
+        };
+      } catch (e) {
+        const err = e;
+        if (err.code === "EEXIST") {
+          try {
+            const lockPid = parseInt(
+              fs11.readFileSync(this.lockPath, "utf-8").trim(),
+              10
+            );
+            if (!this.isProcessRunning(lockPid)) {
+              fs11.unlinkSync(this.lockPath);
+              continue;
+            }
+          } catch {
+            try {
+              fs11.unlinkSync(this.lockPath);
+            } catch {
+            }
+            continue;
+          }
+          await new Promise((resolve5) => setTimeout(resolve5, 100));
+        } else {
+          throw e;
+        }
+      }
+    }
+    throw new Error("Failed to acquire proxy registry lock (timeout)");
+  }
+  /**
+   * Try to claim ownership of the proxy.
+   * Returns true if this process is now the owner.
+   */
+  async claimProxyOwnership(key) {
+    const releaseLock = await this.acquireLock();
+    try {
+      if (fs11.existsSync(this.ownerPath)) {
+        const content = fs11.readFileSync(this.ownerPath, "utf-8");
+        const ownerFile2 = JSON.parse(content);
+        if (this.isProcessRunning(ownerFile2.owner.pid)) {
+          return false;
+        }
+      }
+      const ownerFile = {
+        version: 1,
+        owner: {
+          pid: process.pid,
+          key,
+          startedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      };
+      this.writeFileAtomic(this.ownerPath, ownerFile);
+      this.isOwner = true;
+      return true;
+    } finally {
+      releaseLock();
+    }
+  }
+  /**
+   * Release ownership of the proxy.
+   */
+  async releaseProxyOwnership() {
+    if (!this.isOwner) {
+      return;
+    }
+    const releaseLock = await this.acquireLock();
+    try {
+      if (fs11.existsSync(this.ownerPath)) {
+        const content = fs11.readFileSync(this.ownerPath, "utf-8");
+        const ownerFile = JSON.parse(content);
+        if (ownerFile.owner.pid === process.pid) {
+          fs11.unlinkSync(this.ownerPath);
+        }
+      }
+      this.isOwner = false;
+    } finally {
+      releaseLock();
+    }
+  }
+  /**
+   * Get the current proxy owner.
+   */
+  async getProxyOwner() {
+    if (!fs11.existsSync(this.ownerPath)) {
+      return null;
+    }
+    const releaseLock = await this.acquireLock();
+    try {
+      const content = fs11.readFileSync(this.ownerPath, "utf-8");
+      const ownerFile = JSON.parse(content);
+      if (!this.isProcessRunning(ownerFile.owner.pid)) {
+        return null;
+      }
+      return ownerFile.owner;
+    } catch {
+      return null;
+    } finally {
+      releaseLock();
+    }
+  }
+  /**
+   * Check if this process is the proxy owner.
+   */
+  isProxyOwner() {
+    return this.isOwner;
+  }
+  /**
+   * Register services for a key.
+   */
+  async registerServices(key, adminPort, services, drizzleGatewayPort) {
+    const releaseLock = await this.acquireLock();
+    try {
+      const registry = this.readRegistry();
+      const registration = {
+        adminPort,
+        services
+      };
+      if (drizzleGatewayPort !== void 0) {
+        registration.drizzleGatewayPort = drizzleGatewayPort;
+      }
+      registry.keys[key] = registration;
+      registry.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
+      this.writeFileAtomic(this.registryPath, registry);
+    } finally {
+      releaseLock();
+    }
+  }
+  /**
+   * Unregister all services for a key.
+   */
+  async unregisterServices(key) {
+    const releaseLock = await this.acquireLock();
+    try {
+      const registry = this.readRegistry();
+      delete registry.keys[key];
+      registry.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
+      this.writeFileAtomic(this.registryPath, registry);
+    } finally {
+      releaseLock();
+    }
+  }
+  /**
+   * Get all registered services (flattened view for proxy routing).
+   */
+  async getAllServices() {
+    const releaseLock = await this.acquireLock();
+    try {
+      const registry = this.readRegistry();
+      const services = [];
+      for (const [key, registration] of Object.entries(registry.keys)) {
+        for (const svc of registration.services) {
+          services.push({
+            key,
+            serviceName: svc.serviceName,
+            port: svc.port
+          });
+        }
+      }
+      return services;
+    } finally {
+      releaseLock();
+    }
+  }
+  /**
+   * Get all registered keys and their admin ports.
+   */
+  async getAllKeyRegistrations() {
+    const releaseLock = await this.acquireLock();
+    try {
+      const registry = this.readRegistry();
+      return { ...registry.keys };
+    } finally {
+      releaseLock();
+    }
+  }
+  /**
+   * Watch the registry for changes. Returns a cleanup function.
+   * Callback receives both the flattened services list and all key registrations (for admin ports).
+   * Uses chokidar instead of fs.watch for reliable detection of atomic file writes on macOS.
+   */
+  watchRegistry(onChange) {
+    this.ensureProxyDir();
+    if (!fs11.existsSync(this.registryPath)) {
+      const emptyRegistry = {
+        version: 1,
+        keys: {},
+        lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      this.writeFileAtomic(this.registryPath, emptyRegistry);
+    }
+    let debounceTimer = null;
+    this.registryWatcher = chokidar_default.watch(this.registryPath, {
+      persistent: true,
+      awaitWriteFinish: {
+        stabilityThreshold: 100,
+        pollInterval: 50
+      }
+    });
+    this.registryWatcher.on("change", async () => {
+      if (debounceTimer) {
+        clearTimeout(debounceTimer);
+      }
+      debounceTimer = setTimeout(async () => {
+        try {
+          const services = await this.getAllServices();
+          const keys = await this.getAllKeyRegistrations();
+          onChange(services, keys);
+        } catch {
+        }
+      }, 50);
+    });
+    return () => {
+      if (debounceTimer) {
+        clearTimeout(debounceTimer);
+      }
+      this.registryWatcher?.close();
+      this.registryWatcher = null;
+    };
+  }
+  /**
+   * Attempt to become the proxy owner (election).
+   * This is called when the current owner is detected as dead.
+   */
+  async attemptElection(key) {
+    const releaseLock = await this.acquireLock();
+    try {
+      if (fs11.existsSync(this.ownerPath)) {
+        const content = fs11.readFileSync(this.ownerPath, "utf-8");
+        const ownerFile2 = JSON.parse(content);
+        if (this.isProcessRunning(ownerFile2.owner.pid)) {
+          return false;
+        }
+        fs11.unlinkSync(this.ownerPath);
+      }
+      const ownerFile = {
+        version: 1,
+        owner: {
+          pid: process.pid,
+          key,
+          startedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      };
+      this.writeFileAtomic(this.ownerPath, ownerFile);
+      this.isOwner = true;
+      return true;
+    } finally {
+      releaseLock();
+    }
+  }
+  readRegistry() {
+    if (!fs11.existsSync(this.registryPath)) {
+      return {
+        version: 1,
+        keys: {},
+        lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+    try {
+      const content = fs11.readFileSync(this.registryPath, "utf-8");
+      return JSON.parse(content);
+    } catch {
+      return {
+        version: 1,
+        keys: {},
+        lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  }
+  writeFileAtomic(filePath, data) {
+    this.ensureProxyDir();
+    const tmpPath = filePath + ".tmp";
+    fs11.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+    fs11.renameSync(tmpPath, filePath);
+  }
+};
+
 // src/commands/dev.tsx
 var COLORS = ["cyan", "yellow", "green", "magenta", "blue"];
-function DevUI() {
+function DevUI({ instanceKey }) {
   const { exit } = useApp2();
-  const [state, setState] = useState3(() => ({
-    status: caFilesExist() ? "loading" : "installing-ca",
-    caInstallPhase: caFilesExist() ? void 0 : "installing",
-    resources: /* @__PURE__ */ new Map(),
-    resourceStatus: /* @__PURE__ */ new Map(),
-    services: [],
-    output: [],
-    colorMap: /* @__PURE__ */ new Map()
-  }));
+  const [state, setState] = useState3(() => {
+    const caExists = caFilesExist();
+    return {
+      status: caExists ? "loading" : "installing-ca",
+      ...caExists ? {} : { caInstallPhase: "installing" },
+      resources: /* @__PURE__ */ new Map(),
+      resourceStatus: /* @__PURE__ */ new Map(),
+      services: [],
+      output: [],
+      colorMap: /* @__PURE__ */ new Map(),
+      isProxyOwner: false
+    };
+  });
   useEffect3(() => {
     if (state.status === "installing-ca" && state.caInstallPhase === "installing") {
       installCA();
@@ -186964,9 +187424,13 @@ function DevUI() {
   }
   const shuttingDown = useRef(false);
   const stateManagerRef = useRef(null);
+  const proxyRegistryRef = useRef(null);
   const electricInstancesRef = useRef([]);
   const drizzleGatewayRef = useRef(null);
+  const registryWatcherCleanupRef = useRef(null);
+  const electionIntervalRef = useRef(null);
   const proxyRef = useRef(null);
+  const adminServerRef = useRef(null);
   const servicesRef = useRef([]);
   const resourcesRef = useRef(/* @__PURE__ */ new Map());
   const [reloadTrigger, setReloadTrigger] = useState3(0);
@@ -186976,9 +187440,19 @@ function DevUI() {
     shuttingDown.current = true;
     writeLog("system", "Shutting down");
     setState((s) => ({ ...s, status: "stopping" }));
+    if (electionIntervalRef.current) {
+      clearInterval(electionIntervalRef.current);
+      electionIntervalRef.current = null;
+    }
+    if (registryWatcherCleanupRef.current) {
+      registryWatcherCleanupRef.current();
+      registryWatcherCleanupRef.current = null;
+    }
     await Promise.all([
       // Stop proxy
       proxyRef.current?.stop(),
+      // Stop admin server
+      adminServerRef.current?.stop(),
       // Stop all services
       ...servicesRef.current.map((service) => service.stop()),
       // Stop all Electric instances
@@ -186988,6 +187462,10 @@ function DevUI() {
       // Stop all resources
       ...[...resourcesRef.current.values()].map((resource) => resource.stop())
     ]);
+    if (proxyRegistryRef.current) {
+      await proxyRegistryRef.current.unregisterServices(instanceKey);
+      await proxyRegistryRef.current.releaseProxyOwnership();
+    }
     if (stateManagerRef.current) {
       await stateManagerRef.current.releaseOwnership();
     }
@@ -186999,9 +187477,19 @@ function DevUI() {
     if (shuttingDown.current || state.status === "reloading") return;
     writeLog("system", "Reloading (config changed)");
     setState((s) => ({ ...s, status: "reloading", parseError: void 0 }));
+    if (electionIntervalRef.current) {
+      clearInterval(electionIntervalRef.current);
+      electionIntervalRef.current = null;
+    }
+    if (registryWatcherCleanupRef.current) {
+      registryWatcherCleanupRef.current();
+      registryWatcherCleanupRef.current = null;
+    }
     await Promise.all([
       // Stop proxy
       proxyRef.current?.stop(),
+      // Stop admin server
+      adminServerRef.current?.stop(),
       // Stop all services
       ...servicesRef.current.map((service) => service.stop()),
       // Stop all Electric instances
@@ -187014,8 +187502,13 @@ function DevUI() {
     electricInstancesRef.current = [];
     drizzleGatewayRef.current = null;
     proxyRef.current = null;
+    adminServerRef.current = null;
     servicesRef.current = [];
     resourcesRef.current = /* @__PURE__ */ new Map();
+    if (proxyRegistryRef.current) {
+      await proxyRegistryRef.current.unregisterServices(instanceKey);
+      await proxyRegistryRef.current.releaseProxyOwnership();
+    }
     if (stateManagerRef.current) {
       await stateManagerRef.current.releaseOwnership();
     }
@@ -187026,7 +187519,8 @@ function DevUI() {
       resources: /* @__PURE__ */ new Map(),
       resourceStatus: /* @__PURE__ */ new Map(),
       services: [],
-      proxy: void 0
+      proxy: void 0,
+      isProxyOwner: false
     }));
     setReloadTrigger((t) => t + 1);
   };
@@ -187061,10 +187555,10 @@ function DevUI() {
   }, []);
   useEffect3(() => {
     if (state.status !== "running") return;
-    const configPath = path12.join(process.cwd(), "specific.hcl");
+    const configPath = path13.join(process.cwd(), "specific.hcl");
     const watcher = watchConfigFile(configPath, 1e3, () => {
       try {
-        const hcl = fs11.readFileSync(configPath, "utf-8");
+        const hcl = fs12.readFileSync(configPath, "utf-8");
         parseConfig(hcl).then(() => {
           triggerReload();
         }).catch((err) => {
@@ -187104,8 +187598,10 @@ function DevUI() {
     let startedDrizzleGateway = null;
     const startedServices = [];
     let startedProxy = null;
-    const stateManager = new InstanceStateManager(process.cwd());
+    const stateManager = new InstanceStateManager(process.cwd(), instanceKey);
     stateManagerRef.current = stateManager;
+    const proxyRegistry = new ProxyRegistryManager();
+    proxyRegistryRef.current = proxyRegistry;
     async function start() {
       writeLog("system", "Starting dev server");
       await stateManager.cleanStaleState();
@@ -187128,8 +187624,8 @@ function DevUI() {
         }));
         return;
       }
-      const configPath = path12.join(process.cwd(), "specific.hcl");
-      if (!fs11.existsSync(configPath)) {
+      const configPath = path13.join(process.cwd(), "specific.hcl");
+      if (!fs12.existsSync(configPath)) {
         writeLog("system", "Waiting for specific.hcl to appear");
         setState((s) => ({
           ...s,
@@ -187148,7 +187644,7 @@ function DevUI() {
       }
       let config2;
       try {
-        const hcl = fs11.readFileSync(configPath, "utf-8");
+        const hcl = fs12.readFileSync(configPath, "utf-8");
         config2 = await parseConfig(hcl);
       } catch (err) {
         setState((s) => ({
@@ -187181,7 +187677,7 @@ function DevUI() {
         colorIndex++;
       }
       setState((s) => ({ ...s, status: "starting", config: config2, colorMap }));
-      const portAllocator = new StablePortAllocator(process.cwd());
+      const portAllocator = new StablePortAllocator(process.cwd(), instanceKey);
       const resourceStatus = /* @__PURE__ */ new Map();
       const syncDatabases = detectSyncDatabases(config2);
       let resources2;
@@ -187190,7 +187686,7 @@ function DevUI() {
           config: config2,
           selection: { mode: "all" },
           stateManager,
-          dataDir: ".specific/data",
+          dataDir: `.specific/keys/${instanceKey}/data`,
           portAllocator,
           callbacks: {
             onResourceStarting: (name, type) => {
@@ -187254,7 +187750,7 @@ function DevUI() {
           const drizzleGateway = await startDrizzleGateway(
             postgresResources,
             drizzlePort,
-            path12.join(process.cwd(), ".specific")
+            path13.join(process.cwd(), ".specific", "keys", instanceKey)
           );
           startedDrizzleGateway = drizzleGateway;
           drizzleGatewayRef.current = drizzleGateway;
@@ -187362,6 +187858,7 @@ function DevUI() {
         }
       }
       if (cancelled) return;
+      const serviceInfos = [];
       const exposedServices = [];
       for (const service of config2.services) {
         const endpointInfos = serviceEndpoints.get(service.name) || [];
@@ -187372,6 +187869,10 @@ function DevUI() {
           if (endpointConfig?.public) {
             const proxyName = info.endpointName === "default" ? service.name : `${service.name}-${info.endpointName}`;
             exposedServices.push({ name: proxyName, port: info.port });
+            serviceInfos.push({
+              serviceName: proxyName,
+              port: info.port
+            });
           }
         }
       }
@@ -187395,26 +187896,114 @@ function DevUI() {
           syncEnabled: r.type === "postgres" && syncDatabases.has(name)
         }))
       });
-      try {
-        const certificate = generateCertificate("local.spcf.app");
-        const proxy2 = await startHttpProxy(
-          exposedServices,
-          certificate,
-          getState,
-          startedDrizzleGateway?.port
-        );
-        startedProxy = proxy2;
-        proxyRef.current = proxy2;
-        setState((s) => ({ ...s, proxy: proxy2 }));
-      } catch (err) {
-        const errorMsg = `Failed to start HTTP proxy: ${err instanceof Error ? err.message : String(err)}`;
-        writeLog("system:error", errorMsg);
-        setState((s) => ({
-          ...s,
-          status: "error",
-          error: errorMsg
-        }));
-        return;
+      const adminServer = await startAdminServer(getState);
+      adminServerRef.current = adminServer;
+      writeLog("system", `Admin API server started on port ${adminServer.port}`);
+      await proxyRegistry.registerServices(
+        instanceKey,
+        adminServer.port,
+        serviceInfos,
+        startedDrizzleGateway?.port
+      );
+      writeLog("system", `Registered ${serviceInfos.length} services with proxy registry`);
+      const becameProxyOwner = await proxyRegistry.claimProxyOwnership(instanceKey);
+      if (becameProxyOwner) {
+        writeLog("system", "Claimed proxy ownership, starting HTTP proxy");
+        try {
+          const currentServices = await proxyRegistry.getAllServices();
+          const registeredKeys = [...new Set(currentServices.map((s) => s.key))];
+          const certificate = generateCertificate("local.spcf.app", registeredKeys);
+          const proxy2 = await startHttpProxy(
+            exposedServices,
+            certificate,
+            getState,
+            instanceKey
+          );
+          startedProxy = proxy2;
+          proxyRef.current = proxy2;
+          setState((s) => ({ ...s, proxy: proxy2, isProxyOwner: true }));
+          const knownKeys = new Set(registeredKeys);
+          registryWatcherCleanupRef.current = proxyRegistry.watchRegistry(async (updatedServices, updatedKeys) => {
+            writeLog("system", `Registry updated: ${updatedServices.length} services`);
+            proxy2.updateServices(updatedServices, updatedKeys);
+            const newKeyNames = Object.keys(updatedKeys).filter((k) => !knownKeys.has(k));
+            if (newKeyNames.length > 0) {
+              writeLog("system", `New keys detected: ${newKeyNames.join(", ")} - regenerating certificate`);
+              for (const key of newKeyNames) {
+                knownKeys.add(key);
+              }
+              const allKeys = [...knownKeys];
+              const newCertificate = generateCertificate("local.spcf.app", allKeys);
+              proxy2.updateCertificate(newCertificate);
+            }
+          });
+          const currentKeys = await proxyRegistry.getAllKeyRegistrations();
+          proxy2.updateServices(currentServices, currentKeys);
+          writeLog("system", `Loaded ${currentServices.length} services from registry`);
+        } catch (err) {
+          const errorMsg = `Failed to start HTTP proxy: ${err instanceof Error ? err.message : String(err)}`;
+          writeLog("system:error", errorMsg);
+          setState((s) => ({
+            ...s,
+            status: "error",
+            error: errorMsg
+          }));
+          return;
+        }
+      } else {
+        writeLog("system", "Another instance owns the proxy, starting election watcher");
+        setState((s) => ({ ...s, isProxyOwner: false }));
+        const isProcessRunning = (pid) => {
+          try {
+            process.kill(pid, 0);
+            return true;
+          } catch {
+            return false;
+          }
+        };
+        electionIntervalRef.current = setInterval(async () => {
+          if (cancelled || shuttingDown.current) {
+            if (electionIntervalRef.current) {
+              clearInterval(electionIntervalRef.current);
+              electionIntervalRef.current = null;
+            }
+            return;
+          }
+          const owner = await proxyRegistry.getProxyOwner();
+          if (!owner || !isProcessRunning(owner.pid)) {
+            writeLog("system", "Proxy owner died, attempting election");
+            const won = await proxyRegistry.attemptElection(instanceKey);
+            if (won) {
+              writeLog("system", "Won election, starting HTTP proxy");
+              if (electionIntervalRef.current) {
+                clearInterval(electionIntervalRef.current);
+                electionIntervalRef.current = null;
+              }
+              try {
+                const electionServices = await proxyRegistry.getAllServices();
+                const electionKeyRegistrations = await proxyRegistry.getAllKeyRegistrations();
+                const electionKeyNames = Object.keys(electionKeyRegistrations);
+                const certificate = generateCertificate("local.spcf.app", electionKeyNames);
+                const proxy2 = await startHttpProxy(
+                  exposedServices,
+                  certificate,
+                  getState,
+                  instanceKey
+                );
+                startedProxy = proxy2;
+                proxyRef.current = proxy2;
+                setState((s) => ({ ...s, proxy: proxy2, isProxyOwner: true }));
+                registryWatcherCleanupRef.current = proxyRegistry.watchRegistry((updatedServices, updatedKeys) => {
+                  writeLog("system", `Registry updated: ${updatedServices.length} services`);
+                  proxy2.updateServices(updatedServices, updatedKeys);
+                });
+                proxy2.updateServices(electionServices, electionKeyRegistrations);
+              } catch (err) {
+                writeLog("system:error", `Failed to start proxy after election: ${err}`);
+              }
+            }
+          }
+        }, 1e3);
       }
       if (cancelled) return;
       writeLog("system", "Dev server running");
@@ -187423,6 +188012,14 @@ function DevUI() {
     start();
     return () => {
       cancelled = true;
+      if (electionIntervalRef.current) {
+        clearInterval(electionIntervalRef.current);
+        electionIntervalRef.current = null;
+      }
+      if (registryWatcherCleanupRef.current) {
+        registryWatcherCleanupRef.current();
+        registryWatcherCleanupRef.current = null;
+      }
       if (startedProxy) {
         startedProxy.stop().catch(() => {
         });
@@ -187443,10 +188040,14 @@ function DevUI() {
         resource.stop().catch(() => {
         });
       }
+      proxyRegistry.unregisterServices(instanceKey).catch(() => {
+      });
+      proxyRegistry.releaseProxyOwnership().catch(() => {
+      });
       stateManager.releaseOwnership().catch(() => {
       });
     };
-  }, [reloadTrigger, readyToStart]);
+  }, [reloadTrigger, readyToStart, instanceKey]);
   if (state.status === "installing-ca") {
     if (state.caInstallPhase === "installing") {
       return /* @__PURE__ */ React3.createElement(Box3, { flexDirection: "column" }, /* @__PURE__ */ React3.createElement(Text3, { bold: true, color: "cyan" }, "TLS Certificate Setup"), /* @__PURE__ */ React3.createElement(Text3, null, " "), /* @__PURE__ */ React3.createElement(Text3, null, "Installing a local certificate authority (CA) to enable HTTPS"), /* @__PURE__ */ React3.createElement(Text3, null, "for local development. The CA is limited to Specific projects."), /* @__PURE__ */ React3.createElement(Text3, null, " "), /* @__PURE__ */ React3.createElement(Text3, null, "Your password is required to add the CA to your system's trust store."), /* @__PURE__ */ React3.createElement(Text3, null, " "));
@@ -187524,17 +188125,15 @@ function DevUI() {
   const staticItems = [
     {
       key: "title",
-      content: /* @__PURE__ */ React3.createElement(Text3, null, /* @__PURE__ */ React3.createElement(Text3, { bold: true, color: "cyan" }, "Specific dev server"), /* @__PURE__ */ React3.createElement(Text3, { dimColor: true }, " (Ctrl+C to stop)"))
+      content: /* @__PURE__ */ React3.createElement(Text3, null, /* @__PURE__ */ React3.createElement(Text3, { bold: true, color: "cyan" }, "Specific dev server"), instanceKey !== "default" && /* @__PURE__ */ React3.createElement(Text3, { color: "yellow" }, " [", instanceKey, "]"), /* @__PURE__ */ React3.createElement(Text3, { dimColor: true }, " (Ctrl+C to stop)"))
     },
     { key: "space1", content: /* @__PURE__ */ React3.createElement(Text3, null, " ") },
-    // Show admin UI URL when proxy is running
-    ...proxy ? [
-      {
-        key: "admin",
-        content: /* @__PURE__ */ React3.createElement(Text3, null, /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "Admin:"), /* @__PURE__ */ React3.createElement(Text3, null, " "), /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "https://local.spcf.app"))
-      },
-      { key: "admin-space", content: /* @__PURE__ */ React3.createElement(Text3, null, " ") }
-    ] : [],
+    // Show admin UI URL
+    {
+      key: "admin",
+      content: /* @__PURE__ */ React3.createElement(Text3, null, /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "Admin:"), /* @__PURE__ */ React3.createElement(Text3, null, " "), /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "https://", instanceKey === "default" ? "" : `${instanceKey}.`, "local.spcf.app"))
+    },
+    { key: "admin-space", content: /* @__PURE__ */ React3.createElement(Text3, null, " ") },
     ...services.length > 0 ? [
       { key: "svc-header", content: /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "Services:") },
       ...services.flatMap((svc) => {
@@ -187553,17 +188152,14 @@ function DevUI() {
           const proxyName = endpoint.name === "default" ? svc.name : `${svc.name}-${endpoint.name}`;
           return {
             key: `svc-${svc.name}-${endpoint.name}`,
-            content: /* @__PURE__ */ React3.createElement(Text3, null, /* @__PURE__ */ React3.createElement(Text3, { color: "green" }, " \u25CF "), /* @__PURE__ */ React3.createElement(Text3, null, displayName), port ? endpoint.public && proxy ? /* @__PURE__ */ React3.createElement(React3.Fragment, null, /* @__PURE__ */ React3.createElement(Text3, null, " \u2192 "), /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "https://", proxyName, ".local.spcf.app"), /* @__PURE__ */ React3.createElement(Text3, { dimColor: true }, " (localhost:", port, ")")) : /* @__PURE__ */ React3.createElement(Text3, { dimColor: true }, " (localhost:", port, ")") : null)
+            content: /* @__PURE__ */ React3.createElement(Text3, null, /* @__PURE__ */ React3.createElement(Text3, { color: "green" }, " \u25CF "), /* @__PURE__ */ React3.createElement(Text3, null, displayName), port ? endpoint.public ? /* @__PURE__ */ React3.createElement(React3.Fragment, null, /* @__PURE__ */ React3.createElement(Text3, null, " \u2192 "), /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "https://", proxyName, instanceKey === "default" ? "" : `.${instanceKey}`, ".local.spcf.app"), /* @__PURE__ */ React3.createElement(Text3, { dimColor: true }, " (localhost:", port, ")")) : /* @__PURE__ */ React3.createElement(Text3, { dimColor: true }, " (localhost:", port, ")") : null)
           };
         });
       }),
       { key: "space2", content: /* @__PURE__ */ React3.createElement(Text3, null, " ") }
     ] : [],
     ...config.postgres.length > 0 ? [
-      {
-        key: "pg-header",
-        content: /* @__PURE__ */ React3.createElement(Text3, null, /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "Postgres:"), drizzleGatewayRef.current && /* @__PURE__ */ React3.createElement(Text3, null, " ", "(admin \u2192 ", /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "http://localhost:", drizzleGatewayRef.current.port), ")"))
-      },
+      { key: "pg-header", content: /* @__PURE__ */ React3.createElement(Text3, { bold: true }, "Postgres:") },
       ...config.postgres.map((pg) => {
         const instance = resources.get(pg.name);
         return {
@@ -187609,8 +188205,47 @@ function DevUI() {
   ];
   return /* @__PURE__ */ React3.createElement(Box3, { flexDirection: "column" }, /* @__PURE__ */ React3.createElement(Static, { items: staticItems }, (item) => /* @__PURE__ */ React3.createElement(Box3, { key: item.key }, item.content)));
 }
-function devCommand() {
-  render3(/* @__PURE__ */ React3.createElement(DevUI, null));
+function devCommand(instanceKey) {
+  render3(/* @__PURE__ */ React3.createElement(DevUI, { instanceKey }));
+}
+
+// src/lib/dev/git-worktree.ts
+import { execSync as execSync2 } from "child_process";
+import * as path14 from "path";
+function isInWorktree() {
+  try {
+    const commonDir = execSync2("git rev-parse --git-common-dir", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const gitDir = execSync2("git rev-parse --git-dir", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const resolvedCommonDir = path14.resolve(commonDir);
+    const resolvedGitDir = path14.resolve(gitDir);
+    return resolvedCommonDir !== resolvedGitDir;
+  } catch {
+    return false;
+  }
+}
+function getWorktreeName() {
+  if (!isInWorktree()) {
+    return null;
+  }
+  try {
+    const gitDir = execSync2("git rev-parse --git-dir", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    return path14.basename(gitDir);
+  } catch {
+    return null;
+  }
+}
+function getDefaultKey() {
+  const worktreeName = getWorktreeName();
+  return worktreeName ?? "default";
 }
 
 // src/commands/deploy.tsx
@@ -187620,30 +188255,30 @@ import Spinner5 from "ink-spinner";
 
 // ../../node_modules/open/index.js
 import process8 from "node:process";
-import path13 from "node:path";
+import path15 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import childProcess3 from "node:child_process";
-import fs16, { constants as fsConstants2 } from "node:fs/promises";
+import fs17, { constants as fsConstants2 } from "node:fs/promises";
 
 // ../../node_modules/wsl-utils/index.js
 import { promisify as promisify2 } from "node:util";
 import childProcess2 from "node:child_process";
-import fs15, { constants as fsConstants } from "node:fs/promises";
+import fs16, { constants as fsConstants } from "node:fs/promises";
 
 // ../../node_modules/is-wsl/index.js
 import process2 from "node:process";
-import os4 from "node:os";
-import fs14 from "node:fs";
+import os5 from "node:os";
+import fs15 from "node:fs";
 
 // ../../node_modules/is-inside-container/index.js
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 
 // ../../node_modules/is-docker/index.js
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 var isDockerCached;
 function hasDockerEnv() {
   try {
-    fs12.statSync("/.dockerenv");
+    fs13.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -187651,7 +188286,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return fs12.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return fs13.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -187667,7 +188302,7 @@ function isDocker() {
 var cachedResult;
 var hasContainerEnv = () => {
   try {
-    fs13.statSync("/run/.containerenv");
+    fs14.statSync("/run/.containerenv");
     return true;
   } catch {
     return false;
@@ -187685,14 +188320,14 @@ var isWsl = () => {
   if (process2.platform !== "linux") {
     return false;
   }
-  if (os4.release().toLowerCase().includes("microsoft")) {
+  if (os5.release().toLowerCase().includes("microsoft")) {
     if (isInsideContainer()) {
       return false;
     }
     return true;
   }
   try {
-    return fs14.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
+    return fs15.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
   } catch {
     return false;
   }
@@ -187760,14 +188395,14 @@ var wslDrivesMountPoint = /* @__PURE__ */ (() => {
     const configFilePath = "/etc/wsl.conf";
     let isConfigFileExists = false;
     try {
-      await fs15.access(configFilePath, fsConstants.F_OK);
+      await fs16.access(configFilePath, fsConstants.F_OK);
       isConfigFileExists = true;
     } catch {
     }
     if (!isConfigFileExists) {
       return defaultMountPoint;
     }
-    const configContent = await fs15.readFile(configFilePath, { encoding: "utf8" });
+    const configContent = await fs16.readFile(configFilePath, { encoding: "utf8" });
     const parsedMountPoint = parseMountPointFromConfig(configContent);
     if (parsedMountPoint === void 0) {
       return defaultMountPoint;
@@ -187787,7 +188422,7 @@ var canAccessPowerShell = async () => {
   canAccessPowerShellPromise ??= (async () => {
     try {
       const psPath = await powerShellPath2();
-      await fs15.access(psPath, fsConstants.X_OK);
+      await fs16.access(psPath, fsConstants.X_OK);
       return true;
     } catch {
       return false;
@@ -187801,15 +188436,15 @@ var wslDefaultBrowser = async () => {
   const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
   return stdout.trim();
 };
-var convertWslPathToWindows = async (path20) => {
-  if (/^[a-z]+:\/\//i.test(path20)) {
-    return path20;
+var convertWslPathToWindows = async (path22) => {
+  if (/^[a-z]+:\/\//i.test(path22)) {
+    return path22;
   }
   try {
-    const { stdout } = await execFile2("wslpath", ["-aw", path20], { encoding: "utf8" });
+    const { stdout } = await execFile2("wslpath", ["-aw", path22], { encoding: "utf8" });
     return stdout.trim();
   } catch {
-    return path20;
+    return path22;
   }
 };
 
@@ -187951,8 +188586,8 @@ var is_in_ssh_default = isInSsh;
 
 // ../../node_modules/open/index.js
 var fallbackAttemptSymbol = Symbol("fallbackAttempt");
-var __dirname3 = import.meta.url ? path13.dirname(fileURLToPath3(import.meta.url)) : "";
-var localXdgOpenPath = path13.join(__dirname3, "xdg-open");
+var __dirname3 = import.meta.url ? path15.dirname(fileURLToPath3(import.meta.url)) : "";
+var localXdgOpenPath = path15.join(__dirname3, "xdg-open");
 var { platform: platform4, arch: arch2 } = process8;
 var tryEachApp = async (apps2, opener) => {
   if (apps2.length === 0) {
@@ -188100,7 +188735,7 @@ var baseOpen = async (options2) => {
       const isBundled = !__dirname3 || __dirname3 === "/";
       let exeLocalXdgOpen = false;
       try {
-        await fs16.access(localXdgOpenPath, fsConstants2.X_OK);
+        await fs17.access(localXdgOpenPath, fsConstants2.X_OK);
         exeLocalXdgOpen = true;
       } catch {
       }
@@ -188123,19 +188758,19 @@ var baseOpen = async (options2) => {
   }
   const subprocess = childProcess3.spawn(command, cliArguments, childProcessOptions);
   if (options2.wait) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       subprocess.once("error", reject);
       subprocess.once("close", (exitCode) => {
         if (!options2.allowNonzeroExitCode && exitCode !== 0) {
           reject(new Error(`Exited with code ${exitCode}`));
           return;
         }
-        resolve4(subprocess);
+        resolve5(subprocess);
       });
     });
   }
   if (isFallbackAttempt) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       subprocess.once("error", reject);
       subprocess.once("spawn", () => {
         subprocess.once("close", (exitCode) => {
@@ -188145,17 +188780,17 @@ var baseOpen = async (options2) => {
             return;
           }
           subprocess.unref();
-          resolve4(subprocess);
+          resolve5(subprocess);
         });
       });
     });
   }
   subprocess.unref();
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     subprocess.once("error", reject);
     subprocess.once("spawn", () => {
       subprocess.off("error", reject);
-      resolve4(subprocess);
+      resolve5(subprocess);
     });
   });
 };
@@ -188232,35 +188867,35 @@ defineLazyProperty(apps, "safari", () => detectPlatformBinary({
 var open_default = open2;
 
 // src/commands/deploy.tsx
-import * as fs20 from "fs";
-import * as path17 from "path";
+import * as fs21 from "fs";
+import * as path19 from "path";
 
 // src/lib/deploy/build-tester.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync14 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { join as join16 } from "path";
 function getDependencyInstallCommand(build, projectDir) {
   switch (build.base) {
     case "node":
-      if (existsSync14(join15(projectDir, "pnpm-lock.yaml"))) {
+      if (existsSync15(join16(projectDir, "pnpm-lock.yaml"))) {
         return "pnpm install --frozen-lockfile";
-      } else if (existsSync14(join15(projectDir, "yarn.lock"))) {
+      } else if (existsSync15(join16(projectDir, "yarn.lock"))) {
         return "yarn install --frozen-lockfile";
-      } else if (existsSync14(join15(projectDir, "package-lock.json"))) {
+      } else if (existsSync15(join16(projectDir, "package-lock.json"))) {
         return "npm ci";
       } else {
         return "npm install";
       }
     case "python":
-      if (existsSync14(join15(projectDir, "poetry.lock"))) {
+      if (existsSync15(join16(projectDir, "poetry.lock"))) {
         return "poetry install --no-interaction";
-      } else if (existsSync14(join15(projectDir, "Pipfile.lock"))) {
+      } else if (existsSync15(join16(projectDir, "Pipfile.lock"))) {
         return "pipenv install --deploy";
-      } else if (existsSync14(join15(projectDir, "Pipfile"))) {
+      } else if (existsSync15(join16(projectDir, "Pipfile"))) {
         return "pipenv install";
-      } else if (existsSync14(join15(projectDir, "pyproject.toml"))) {
+      } else if (existsSync15(join16(projectDir, "pyproject.toml"))) {
         return "pip install .";
-      } else if (existsSync14(join15(projectDir, "requirements.txt"))) {
+      } else if (existsSync15(join16(projectDir, "requirements.txt"))) {
         return "pip install -r requirements.txt";
       }
       return null;
@@ -188274,7 +188909,7 @@ function getDependencyInstallCommand(build, projectDir) {
   }
 }
 function runCommand2(command, projectDir, buildName) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const stdout = [];
     const stderr = [];
     writeLog("build-test", `[${buildName}] Running: ${command}`);
@@ -188304,7 +188939,7 @@ function runCommand2(command, projectDir, buildName) {
     });
     child.on("error", (err) => {
       writeLog("build-test:error", `[${buildName}] Failed to start: ${err.message}`);
-      resolve4({
+      resolve5({
         success: false,
         output: `Failed to start command: ${err.message}`
       });
@@ -188313,10 +188948,10 @@ function runCommand2(command, projectDir, buildName) {
       const output = [...stdout, ...stderr].join("");
       if (code === 0) {
         writeLog("build-test", `[${buildName}] Command succeeded (exit code 0)`);
-        resolve4({ success: true, output });
+        resolve5({ success: true, output });
       } else {
         writeLog("build-test:error", `[${buildName}] Command failed with exit code ${code}`);
-        resolve4({
+        resolve5({
           success: false,
           output: output || `Exit code: ${code}`
         });
@@ -188655,13 +189290,13 @@ var ApiClient = class {
 };
 
 // src/lib/tarball/create.ts
-import { execSync as execSync2 } from "child_process";
-import * as fs17 from "fs";
-import * as path14 from "path";
+import { execSync as execSync3 } from "child_process";
+import * as fs18 from "fs";
+import * as path16 from "path";
 import { createTarPacker, createEntryItemGenerator } from "tar-vern";
 function isInsideGitRepository(dir) {
   try {
-    const result = execSync2("git rev-parse --is-inside-work-tree", {
+    const result = execSync3("git rev-parse --is-inside-work-tree", {
       cwd: dir,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -188671,50 +189306,42 @@ function isInsideGitRepository(dir) {
     return false;
   }
 }
-function getGitInfo(projectDir) {
-  const gitRoot = execSync2("git rev-parse --show-toplevel", {
-    cwd: projectDir,
-    encoding: "utf-8"
-  }).trim();
-  const relativePath = path14.relative(gitRoot, projectDir);
-  return { gitRoot, relativePath: relativePath || "." };
-}
-function createGitArchive(projectDir) {
-  writeLog("tarball", "Creating tarball using git archive");
-  const { gitRoot, relativePath } = getGitInfo(projectDir);
-  const isSubdirectory = relativePath !== ".";
-  writeLog(
-    "tarball",
-    isSubdirectory ? `Project is in subdirectory: ${relativePath}` : "Project is at git root"
-  );
-  const stashResult = execSync2("git stash create --include-untracked", {
-    cwd: gitRoot,
-    encoding: "utf-8"
-  }).trim();
-  const treeish = stashResult || "HEAD";
-  writeLog(
-    "tarball",
-    `Archiving from: ${treeish === "HEAD" ? "HEAD (no uncommitted changes)" : "stash (includes uncommitted changes)"}`
-  );
-  const archiveTarget = isSubdirectory ? `${treeish}:${relativePath}` : treeish;
-  const tarball = execSync2(
-    `git archive --format=tar.gz ${archiveTarget} -- . ":!.specific"`,
+async function createGitArchive(projectDir) {
+  writeLog("tarball", "Creating tarball using git ls-files");
+  const filesOutput = execSync3(
+    "git ls-files --cached --others --exclude-standard",
     {
-      cwd: gitRoot,
+      cwd: projectDir,
+      encoding: "utf-8",
       maxBuffer: 100 * 1024 * 1024
       // 100MB max
     }
   );
-  writeLog("tarball", `Git archive created: ${tarball.length} bytes`);
+  const allFiles = filesOutput.trim().split("\n").filter(Boolean);
+  const filteredFiles = allFiles.filter(
+    (file) => !file.startsWith(".specific/") && file !== ".specific"
+  );
+  writeLog(
+    "tarball",
+    `Found ${allFiles.length} files, ${filteredFiles.length} after filtering .specific`
+  );
+  const entryGenerator = createEntryItemGenerator(projectDir, filteredFiles);
+  const tarStream = createTarPacker(entryGenerator, "gzip");
+  const chunks = [];
+  for await (const chunk of tarStream) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const tarball = Buffer.concat(chunks);
+  writeLog("tarball", `Tarball created: ${tarball.length} bytes`);
   return tarball;
 }
 var EXCLUDED_DIRS = [".specific"];
 async function collectPaths(baseDir, currentDir, exclude) {
   const results = [];
-  const entries = await fs17.promises.readdir(currentDir, { withFileTypes: true });
+  const entries = await fs18.promises.readdir(currentDir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path14.join(currentDir, entry.name);
-    const relativePath = path14.relative(baseDir, fullPath);
+    const fullPath = path16.join(currentDir, entry.name);
+    const relativePath = path16.relative(baseDir, fullPath);
     if (entry.isDirectory()) {
       if (!exclude.includes(entry.name)) {
         results.push(relativePath);
@@ -188729,8 +189356,8 @@ async function collectPaths(baseDir, currentDir, exclude) {
 }
 async function createTarArchive(projectDir) {
   writeLog("tarball", "Creating tarball using tar-vern (non-git project)");
-  const configPath = path14.join(projectDir, "specific.hcl");
-  if (!fs17.existsSync(configPath)) {
+  const configPath = path16.join(projectDir, "specific.hcl");
+  if (!fs18.existsSync(configPath)) {
     throw new Error("specific.hcl not found in project directory");
   }
   const relativePaths = await collectPaths(projectDir, projectDir, EXCLUDED_DIRS);
@@ -188753,8 +189380,8 @@ async function createProjectTarball(projectDir) {
 }
 
 // src/lib/project/config.ts
-import * as fs18 from "fs";
-import * as path15 from "path";
+import * as fs19 from "fs";
+import * as path17 from "path";
 var PROJECT_ID_FILE = ".specific/project_id";
 var ProjectNotLinkedError = class extends Error {
   constructor() {
@@ -188769,32 +189396,32 @@ Run: specific deploy`
   }
 };
 function readProjectId(projectDir = process.cwd()) {
-  const projectIdPath = path15.join(projectDir, PROJECT_ID_FILE);
-  if (!fs18.existsSync(projectIdPath)) {
+  const projectIdPath = path17.join(projectDir, PROJECT_ID_FILE);
+  if (!fs19.existsSync(projectIdPath)) {
     throw new ProjectNotLinkedError();
   }
-  const projectId = fs18.readFileSync(projectIdPath, "utf-8").trim();
+  const projectId = fs19.readFileSync(projectIdPath, "utf-8").trim();
   if (!projectId) {
     throw new Error(`${PROJECT_ID_FILE} is empty`);
   }
   return projectId;
 }
 function hasProjectId(projectDir = process.cwd()) {
-  const projectIdPath = path15.join(projectDir, PROJECT_ID_FILE);
-  return fs18.existsSync(projectIdPath);
+  const projectIdPath = path17.join(projectDir, PROJECT_ID_FILE);
+  return fs19.existsSync(projectIdPath);
 }
 function writeProjectId(projectId, projectDir = process.cwd()) {
-  const specificDir = path15.join(projectDir, ".specific");
-  if (!fs18.existsSync(specificDir)) {
-    fs18.mkdirSync(specificDir, { recursive: true });
+  const specificDir = path17.join(projectDir, ".specific");
+  if (!fs19.existsSync(specificDir)) {
+    fs19.mkdirSync(specificDir, { recursive: true });
   }
-  fs18.writeFileSync(path15.join(specificDir, "project_id"), projectId + "\n");
+  fs19.writeFileSync(path17.join(specificDir, "project_id"), projectId + "\n");
 }
 
 // src/lib/auth/credentials.ts
-import * as fs19 from "fs";
-import * as path16 from "path";
-import * as os5 from "os";
+import * as fs20 from "fs";
+import * as path18 from "path";
+import * as os6 from "os";
 
 // src/lib/auth/errors.ts
 var RefreshTokenExpiredError = class extends Error {
@@ -188871,7 +189498,7 @@ import React4, { useState as useState4, useEffect as useEffect4 } from "react";
 import { render as render4, Box as Box4, Text as Text4, useApp as useApp3 } from "ink";
 import Spinner4 from "ink-spinner";
 function performLogin(options2 = {}) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const instance = render4(
       /* @__PURE__ */ React4.createElement(
         LoginFlow,
@@ -188879,7 +189506,7 @@ function performLogin(options2 = {}) {
           isReauthentication: options2.isReauthentication,
           onComplete: (result) => {
             instance.unmount();
-            resolve4(result);
+            resolve5(result);
           }
         }
       )
@@ -188985,18 +189612,18 @@ function LoginFlow({ isReauthentication, onComplete }) {
 
 // src/lib/auth/credentials.ts
 function getUserCredentialsDir() {
-  return path16.join(os5.homedir(), ".specific");
+  return path18.join(os6.homedir(), ".specific");
 }
 function getCredentialsPath() {
-  return path16.join(getUserCredentialsDir(), "credentials.json");
+  return path18.join(getUserCredentialsDir(), "credentials.json");
 }
 function readUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (!fs19.existsSync(credentialsPath)) {
+  if (!fs20.existsSync(credentialsPath)) {
     return null;
   }
   try {
-    const content = fs19.readFileSync(credentialsPath, "utf-8");
+    const content = fs20.readFileSync(credentialsPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -189004,18 +189631,18 @@ function readUserCredentials() {
 }
 function writeUserCredentials(credentials) {
   const dir = getUserCredentialsDir();
-  if (!fs19.existsSync(dir)) {
-    fs19.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (!fs20.existsSync(dir)) {
+    fs20.mkdirSync(dir, { recursive: true, mode: 448 });
   }
   const credentialsPath = getCredentialsPath();
-  fs19.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
+  fs20.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
     mode: 384
   });
 }
 function clearUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (fs19.existsSync(credentialsPath)) {
-    fs19.unlinkSync(credentialsPath);
+  if (fs20.existsSync(credentialsPath)) {
+    fs20.unlinkSync(credentialsPath);
   }
 }
 function isLoggedIn() {
@@ -189837,14 +190464,14 @@ ${errorMsg}`
   ), phase === "error" && /* @__PURE__ */ React5.createElement(Box5, { marginTop: 1 }, /* @__PURE__ */ React5.createElement(Text5, { color: "red" }, "Error: ", error)), phase === "success" && /* @__PURE__ */ React5.createElement(Box5, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React5.createElement(Text5, { color: "green" }, "Deployment successful!"), deployment?.publicUrls && Object.keys(deployment.publicUrls).length > 0 && /* @__PURE__ */ React5.createElement(Box5, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React5.createElement(Text5, { bold: true }, "Public URLs:"), Object.entries(deployment.publicUrls).map(([name, url]) => /* @__PURE__ */ React5.createElement(Text5, { key: name }, "  ", name, ": ", /* @__PURE__ */ React5.createElement(Text5, { color: "cyan" }, url))))));
 }
 async function deployCommand(environment, options2) {
-  const configPath = path17.join(process.cwd(), "specific.hcl");
-  if (!fs20.existsSync(configPath)) {
+  const configPath = path19.join(process.cwd(), "specific.hcl");
+  if (!fs21.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
   try {
-    const hcl = fs20.readFileSync(configPath, "utf-8");
+    const hcl = fs21.readFileSync(configPath, "utf-8");
     config = await parseConfig(hcl);
   } catch (err) {
     console.error(
@@ -189868,9 +190495,9 @@ async function deployCommand(environment, options2) {
 
 // src/commands/exec.tsx
 import { spawn as spawn6 } from "child_process";
-import * as fs21 from "fs";
-import * as path18 from "path";
-async function execCommand(serviceName, command) {
+import * as fs22 from "fs";
+import * as path20 from "path";
+async function execCommand(serviceName, command, instanceKey = "default") {
   if (command.length === 0) {
     console.error(
       "Error: No command provided. Usage: specific exec <service> -- <command>"
@@ -189897,14 +190524,14 @@ async function execCommand(serviceName, command) {
       }
     }
   };
-  const configPath = path18.join(process.cwd(), "specific.hcl");
-  if (!fs21.existsSync(configPath)) {
+  const configPath = path20.join(process.cwd(), "specific.hcl");
+  if (!fs22.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
   try {
-    const hcl = fs21.readFileSync(configPath, "utf-8");
+    const hcl = fs22.readFileSync(configPath, "utf-8");
     config = await parseConfig(hcl);
   } catch (err) {
     console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
@@ -189921,7 +190548,7 @@ async function execCommand(serviceName, command) {
   const required = findRequiredResources(service);
   let resources = /* @__PURE__ */ new Map();
   const hasRequiredResources = required.postgres.length > 0 || required.redis.length > 0 || required.storage.length > 0;
-  stateManager = new InstanceStateManager(process.cwd());
+  stateManager = new InstanceStateManager(process.cwd(), instanceKey);
   await stateManager.cleanStaleState();
   const existingInstances = await stateManager.getExistingInstances();
   if (hasRequiredResources) {
@@ -189976,7 +190603,7 @@ async function execCommand(serviceName, command) {
             storage: required.storage
           },
           stateManager,
-          dataDir: ".specific/data",
+          dataDir: `.specific/keys/${instanceKey}/data`,
           portAllocator: new PortAllocator(),
           callbacks: {
             log: (msg) => console.error(msg)
@@ -190041,8 +190668,8 @@ async function execCommand(serviceName, command) {
 
 // src/commands/psql.tsx
 import { spawn as spawn7 } from "child_process";
-async function psqlCommand(databaseName) {
-  const stateManager = new InstanceStateManager(process.cwd());
+async function psqlCommand(databaseName, instanceKey = "default") {
+  const stateManager = new InstanceStateManager(process.cwd(), instanceKey);
   await stateManager.cleanStaleState();
   const existingInstances = await stateManager.getExistingInstances();
   if (!existingInstances) {
@@ -190098,41 +190725,85 @@ async function psqlCommand(databaseName) {
 import React6, { useState as useState6, useEffect as useEffect6 } from "react";
 import { render as render6, Text as Text6, Box as Box6 } from "ink";
 import Spinner6 from "ink-spinner";
-import * as fs22 from "fs";
-import * as path19 from "path";
-function CleanUI() {
+import * as fs23 from "fs";
+import * as path21 from "path";
+function CleanUI({ instanceKey }) {
   const [state, setState] = useState6({ status: "checking" });
   useEffect6(() => {
     async function clean() {
       const projectRoot = process.cwd();
-      const specificDir = path19.join(projectRoot, ".specific");
-      if (!fs22.existsSync(specificDir)) {
+      const specificDir = path21.join(projectRoot, ".specific");
+      if (!fs23.existsSync(specificDir)) {
         setState({ status: "nothing" });
         return;
       }
-      const stateManager = new InstanceStateManager(projectRoot);
-      const existingInstances = await stateManager.getExistingInstances();
-      if (existingInstances) {
-        setState({
-          status: "error",
-          error: `Cannot clean while 'specific dev' is running (PID ${existingInstances.owner.pid}). Please stop it first.`
-        });
-        return;
-      }
-      await stateManager.cleanStaleState();
-      setState({ status: "cleaning" });
-      try {
-        fs22.rmSync(specificDir, { recursive: true, force: true });
-        setState({ status: "success" });
-      } catch (err) {
-        setState({
-          status: "error",
-          error: err instanceof Error ? err.message : String(err)
-        });
+      if (instanceKey) {
+        const keyDir = path21.join(specificDir, "keys", instanceKey);
+        if (!fs23.existsSync(keyDir)) {
+          setState({ status: "nothing" });
+          return;
+        }
+        const stateManager = new InstanceStateManager(projectRoot, instanceKey);
+        const existingInstances = await stateManager.getExistingInstances();
+        if (existingInstances) {
+          setState({
+            status: "error",
+            error: `Cannot clean while 'specific dev' is running for key "${instanceKey}" (PID ${existingInstances.owner.pid}). Please stop it first.`
+          });
+          return;
+        }
+        await stateManager.cleanStaleState();
+        setState({ status: "cleaning" });
+        try {
+          fs23.rmSync(keyDir, { recursive: true, force: true });
+          setState({ status: "success" });
+        } catch (err) {
+          setState({
+            status: "error",
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
+      } else {
+        const keysDir = path21.join(specificDir, "keys");
+        if (fs23.existsSync(keysDir)) {
+          const keys = fs23.readdirSync(keysDir).filter(
+            (f) => fs23.statSync(path21.join(keysDir, f)).isDirectory()
+          );
+          for (const key of keys) {
+            const stateManager2 = new InstanceStateManager(projectRoot, key);
+            const existingInstances2 = await stateManager2.getExistingInstances();
+            if (existingInstances2) {
+              setState({
+                status: "error",
+                error: `Cannot clean while 'specific dev' is running for key "${key}" (PID ${existingInstances2.owner.pid}). Please stop it first.`
+              });
+              return;
+            }
+          }
+        }
+        const stateManager = new InstanceStateManager(projectRoot);
+        const existingInstances = await stateManager.getExistingInstances();
+        if (existingInstances) {
+          setState({
+            status: "error",
+            error: `Cannot clean while 'specific dev' is running (PID ${existingInstances.owner.pid}). Please stop it first.`
+          });
+          return;
+        }
+        setState({ status: "cleaning" });
+        try {
+          fs23.rmSync(specificDir, { recursive: true, force: true });
+          setState({ status: "success" });
+        } catch (err) {
+          setState({
+            status: "error",
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
       }
     }
     clean();
-  }, []);
+  }, [instanceKey]);
   if (state.status === "checking") {
     return /* @__PURE__ */ React6.createElement(Box6, null, /* @__PURE__ */ React6.createElement(Text6, { color: "blue" }, /* @__PURE__ */ React6.createElement(Spinner6, { type: "dots" })), /* @__PURE__ */ React6.createElement(Text6, null, " Checking for running instances..."));
   }
@@ -190143,18 +190814,24 @@ function CleanUI() {
     return /* @__PURE__ */ React6.createElement(Text6, { color: "red" }, "Error: ", state.error);
   }
   if (state.status === "nothing") {
-    return /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, "Nothing to clean (.specific directory does not exist)");
+    const target2 = instanceKey ? `key "${instanceKey}"` : ".specific directory";
+    return /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, "Nothing to clean (", target2, " does not exist)");
   }
-  return /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, "Cleaned .specific directory");
+  const target = instanceKey ? `key "${instanceKey}"` : ".specific directory";
+  return /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, "Cleaned ", target);
 }
-function cleanCommand() {
-  render6(/* @__PURE__ */ React6.createElement(CleanUI, null));
+function cleanCommand(instanceKey) {
+  if (instanceKey) {
+    render6(/* @__PURE__ */ React6.createElement(CleanUI, { instanceKey }));
+  } else {
+    render6(/* @__PURE__ */ React6.createElement(CleanUI, null));
+  }
 }
 
 // src/commands/secrets.tsx
 import React7, { useState as useState7, useEffect as useEffect7 } from "react";
 import { render as render7, Text as Text7, Box as Box7, useInput as useInput4, useApp as useApp5 } from "ink";
-import * as fs23 from "fs";
+import * as fs24 from "fs";
 var HEADER_COMMENT = "# Do not commit this file - it contains secrets\n";
 function SetSecretUI({ secretName }) {
   const { exit } = useApp5();
@@ -190173,8 +190850,8 @@ function SetSecretUI({ secretName }) {
         const hclLine = `${secretName} = "${escapedValue}"`;
         let content = "";
         let hasHeader = false;
-        if (fs23.existsSync(SECRETS_FILE)) {
-          content = fs23.readFileSync(SECRETS_FILE, "utf-8");
+        if (fs24.existsSync(SECRETS_FILE)) {
+          content = fs24.readFileSync(SECRETS_FILE, "utf-8");
           hasHeader = content.startsWith("#");
           const lines = content.split("\n");
           const newLines = [];
@@ -190189,7 +190866,7 @@ function SetSecretUI({ secretName }) {
             }
           }
           if (found) {
-            fs23.writeFileSync(SECRETS_FILE, newLines.join("\n"));
+            fs24.writeFileSync(SECRETS_FILE, newLines.join("\n"));
             setDone(true);
             return;
           }
@@ -190202,7 +190879,7 @@ function SetSecretUI({ secretName }) {
         }
         newContent += `${hclLine}
 `;
-        fs23.writeFileSync(SECRETS_FILE, newContent);
+        fs24.writeFileSync(SECRETS_FILE, newContent);
         setDone(true);
       } catch (err) {
         setError(err instanceof Error ? err.message : String(err));
@@ -190262,7 +190939,7 @@ async function secretsCommand(action, secretName) {
 // src/commands/config.tsx
 import React8, { useState as useState8, useEffect as useEffect8 } from "react";
 import { render as render8, Text as Text8, Box as Box8, useInput as useInput5, useApp as useApp6 } from "ink";
-import * as fs24 from "fs";
+import * as fs25 from "fs";
 var HEADER_COMMENT2 = "# Configuration values for this project\n# These values override defaults defined in specific.hcl\n";
 function SetConfigUI({ configName, initialValue }) {
   const { exit } = useApp6();
@@ -190281,8 +190958,8 @@ function SetConfigUI({ configName, initialValue }) {
         const hclLine = `${configName} = "${escapedValue}"`;
         let content = "";
         let hasHeader = false;
-        if (fs24.existsSync(CONFIG_FILE)) {
-          content = fs24.readFileSync(CONFIG_FILE, "utf-8");
+        if (fs25.existsSync(CONFIG_FILE)) {
+          content = fs25.readFileSync(CONFIG_FILE, "utf-8");
           hasHeader = content.startsWith("#");
           const lines = content.split("\n");
           const newLines = [];
@@ -190297,7 +190974,7 @@ function SetConfigUI({ configName, initialValue }) {
             }
           }
           if (found) {
-            fs24.writeFileSync(CONFIG_FILE, newLines.join("\n"));
+            fs25.writeFileSync(CONFIG_FILE, newLines.join("\n"));
             setDone(true);
             return;
           }
@@ -190310,7 +190987,7 @@ function SetConfigUI({ configName, initialValue }) {
         }
         newContent += `${hclLine}
 `;
-        fs24.writeFileSync(CONFIG_FILE, newContent);
+        fs25.writeFileSync(CONFIG_FILE, newContent);
         setDone(true);
       } catch (err) {
         setError(err instanceof Error ? err.message : String(err));
@@ -190349,8 +191026,8 @@ async function configSetCommand(configName, configValue) {
       const hclLine = `${configName} = "${escapedValue}"`;
       let content = "";
       let hasHeader = false;
-      if (fs24.existsSync(CONFIG_FILE)) {
-        content = fs24.readFileSync(CONFIG_FILE, "utf-8");
+      if (fs25.existsSync(CONFIG_FILE)) {
+        content = fs25.readFileSync(CONFIG_FILE, "utf-8");
         hasHeader = content.startsWith("#");
         const lines = content.split("\n");
         const newLines = [];
@@ -190365,7 +191042,7 @@ async function configSetCommand(configName, configValue) {
           }
         }
         if (found) {
-          fs24.writeFileSync(CONFIG_FILE, newLines.join("\n"));
+          fs25.writeFileSync(CONFIG_FILE, newLines.join("\n"));
           console.log(`Config '${configName}' saved to ${CONFIG_FILE}`);
           return;
         }
@@ -190378,7 +191055,7 @@ async function configSetCommand(configName, configValue) {
       }
       newContent += `${hclLine}
 `;
-      fs24.writeFileSync(CONFIG_FILE, newContent);
+      fs25.writeFileSync(CONFIG_FILE, newContent);
       console.log(`Config '${configName}' saved to ${CONFIG_FILE}`);
     } catch (err) {
       console.error("Error:", err instanceof Error ? err.message : String(err));
@@ -190497,20 +191174,29 @@ function logoutCommand() {
 var program = new Command();
 var env = "production";
 var envLabel = env !== "production" ? `[${env.toUpperCase()}] ` : "";
-program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.37").enablePositionalOptions();
+program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.38").enablePositionalOptions();
 program.command("init").description("Initialize project for use with a coding agent").action(initCommand);
 program.command("docs [topic]").description("Fetch LLM-optimized documentation").action(docsCommand);
 program.command("check").description("Validate specific.hcl configuration").action(checkCommand);
-program.command("dev").description("Start local development environment").action(devCommand);
+program.command("dev").description("Start local development environment").option("-k, --key <key>", "Namespace for isolated dev environment (auto-detected from git worktree if not specified)").action((options2) => {
+  const key = options2.key ?? getDefaultKey();
+  devCommand(key);
+});
 program.command("deploy [environment]").description("Deploy to Specific infrastructure").option("--skip-build-test", "Skip local build testing before deploy").action((environment, options2) => {
   deployCommand(environment, options2);
 });
-program.command("exec <service> [args...]").description("Run a one-off command with service environment").passThroughOptions().action(async (service, args) => {
+program.command("exec <service> [args...]").description("Run a one-off command with service environment").option("-k, --key <key>", "Dev environment namespace (auto-detected from git worktree if not specified)").passThroughOptions().action(async (service, args, options2) => {
   const filteredArgs = args[0] === "--" ? args.slice(1) : args;
-  await execCommand(service, filteredArgs);
+  const key = options2.key ?? getDefaultKey();
+  await execCommand(service, filteredArgs, key);
+});
+program.command("psql [database]").description("Connect to a running Postgres database").option("-k, --key <key>", "Dev environment namespace (auto-detected from git worktree if not specified)").action((database, options2) => {
+  const key = options2.key ?? getDefaultKey();
+  psqlCommand(database, key);
+});
+program.command("clean").description("Remove .specific directory for a clean slate").option("-k, --key <key>", "Clean only the specified dev environment key").action((options2) => {
+  cleanCommand(options2.key);
 });
-program.command("psql [database]").description("Connect to a running Postgres database").action(psqlCommand);
-program.command("clean").description("Remove .specific directory for a clean slate").action(cleanCommand);
 program.command("secrets [action] [name]").description("Manage secrets").action(secretsCommand);
 program.command("config [action] [name] [value]").description("Manage configuration values").action(configCommand);
 program.command("login").description("Log in to Specific").action(loginCommand);