@specific.dev/cli 0.1.61 → 0.1.62

package/dist/cli.js

@@ -39,10 +39,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 function hasDockerEnv() {
   try {
-    fs4.statSync("/.dockerenv");
+    fs5.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -50,7 +50,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return fs4.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return fs5.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -68,7 +68,7 @@ var init_is_docker = __esm({
 });
 
 // node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 function isInsideContainer() {
   if (cachedResult === void 0) {
     cachedResult = hasContainerEnv() || isDocker();
@@ -81,7 +81,7 @@ var init_is_inside_container = __esm({
     init_is_docker();
     hasContainerEnv = () => {
       try {
-        fs5.statSync("/run/.containerenv");
+        fs6.statSync("/run/.containerenv");
         return true;
       } catch {
         return false;
@@ -92,8 +92,8 @@ var init_is_inside_container = __esm({
 
 // node_modules/.pnpm/is-wsl@3.1.0/node_modules/is-wsl/index.js
 import process2 from "node:process";
-import os3 from "node:os";
-import fs6 from "node:fs";
+import os4 from "node:os";
+import fs7 from "node:fs";
 var isWsl, is_wsl_default;
 var init_is_wsl = __esm({
   "node_modules/.pnpm/is-wsl@3.1.0/node_modules/is-wsl/index.js"() {
@@ -102,14 +102,14 @@ var init_is_wsl = __esm({
       if (process2.platform !== "linux") {
         return false;
       }
-      if (os3.release().toLowerCase().includes("microsoft")) {
+      if (os4.release().toLowerCase().includes("microsoft")) {
         if (isInsideContainer()) {
           return false;
         }
         return true;
       }
       try {
-        return fs6.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
+        return fs7.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
       } catch {
         return false;
       }
@@ -179,7 +179,7 @@ var init_utilities = __esm({
 // node_modules/.pnpm/wsl-utils@0.3.1/node_modules/wsl-utils/index.js
 import { promisify as promisify2 } from "node:util";
 import childProcess2 from "node:child_process";
-import fs7, { constants as fsConstants } from "node:fs/promises";
+import fs8, { constants as fsConstants } from "node:fs/promises";
 var execFile2, wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath2, canAccessPowerShellPromise, canAccessPowerShell, wslDefaultBrowser, convertWslPathToWindows;
 var init_wsl_utils = __esm({
   "node_modules/.pnpm/wsl-utils@0.3.1/node_modules/wsl-utils/index.js"() {
@@ -198,14 +198,14 @@ var init_wsl_utils = __esm({
         const configFilePath = "/etc/wsl.conf";
         let isConfigFileExists = false;
         try {
-          await fs7.access(configFilePath, fsConstants.F_OK);
+          await fs8.access(configFilePath, fsConstants.F_OK);
           isConfigFileExists = true;
         } catch {
         }
         if (!isConfigFileExists) {
           return defaultMountPoint;
         }
-        const configContent = await fs7.readFile(configFilePath, { encoding: "utf8" });
+        const configContent = await fs8.readFile(configFilePath, { encoding: "utf8" });
         const parsedMountPoint = parseMountPointFromConfig(configContent);
         if (parsedMountPoint === void 0) {
           return defaultMountPoint;
@@ -224,7 +224,7 @@ var init_wsl_utils = __esm({
       canAccessPowerShellPromise ??= (async () => {
         try {
           const psPath = await powerShellPath2();
-          await fs7.access(psPath, fsConstants.X_OK);
+          await fs8.access(psPath, fsConstants.X_OK);
           return true;
         } catch {
           return false;
@@ -238,15 +238,15 @@ var init_wsl_utils = __esm({
       const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
       return stdout.trim();
     };
-    convertWslPathToWindows = async (path26) => {
-      if (/^[a-z]+:\/\//i.test(path26)) {
-        return path26;
+    convertWslPathToWindows = async (path27) => {
+      if (/^[a-z]+:\/\//i.test(path27)) {
+        return path27;
       }
       try {
-        const { stdout } = await execFile2("wslpath", ["-aw", path26], { encoding: "utf8" });
+        const { stdout } = await execFile2("wslpath", ["-aw", path27], { encoding: "utf8" });
         return stdout.trim();
       } catch {
-        return path26;
+        return path27;
       }
     };
   }
@@ -432,10 +432,10 @@ __export(open_exports, {
   openApp: () => openApp
 });
 import process8 from "node:process";
-import path4 from "node:path";
+import path5 from "node:path";
 import { fileURLToPath } from "node:url";
 import childProcess3 from "node:child_process";
-import fs8, { constants as fsConstants2 } from "node:fs/promises";
+import fs9, { constants as fsConstants2 } from "node:fs/promises";
 function detectArchBinary(binary) {
   if (typeof binary === "string" || Array.isArray(binary)) {
     return binary;
@@ -446,16 +446,16 @@ function detectArchBinary(binary) {
   }
   return archBinary;
 }
-function detectPlatformBinary({ [platform2]: platformBinary }, { wsl } = {}) {
+function detectPlatformBinary({ [platform3]: platformBinary }, { wsl } = {}) {
   if (wsl && is_wsl_default) {
     return detectArchBinary(wsl);
   }
   if (!platformBinary) {
-    throw new Error(`${platform2} is not supported`);
+    throw new Error(`${platform3} is not supported`);
   }
   return detectArchBinary(platformBinary);
 }
-var fallbackAttemptSymbol, __dirname, localXdgOpenPath, platform2, arch, tryEachApp, baseOpen, open, openApp, apps, open_default;
+var fallbackAttemptSymbol, __dirname, localXdgOpenPath, platform3, arch, tryEachApp, baseOpen, open, openApp, apps, open_default;
 var init_open = __esm({
   "node_modules/.pnpm/open@11.0.0/node_modules/open/index.js"() {
     init_wsl_utils();
@@ -465,9 +465,9 @@ var init_open = __esm({
     init_is_inside_container();
     init_is_in_ssh();
     fallbackAttemptSymbol = Symbol("fallbackAttempt");
-    __dirname = import.meta.url ? path4.dirname(fileURLToPath(import.meta.url)) : "";
-    localXdgOpenPath = path4.join(__dirname, "xdg-open");
-    ({ platform: platform2, arch } = process8);
+    __dirname = import.meta.url ? path5.dirname(fileURLToPath(import.meta.url)) : "";
+    localXdgOpenPath = path5.join(__dirname, "xdg-open");
+    ({ platform: platform3, arch } = process8);
     tryEachApp = async (apps2, opener) => {
       if (apps2.length === 0) {
         return;
@@ -564,7 +564,7 @@ var init_open = __esm({
       if (is_wsl_default && !isInsideContainer() && !is_in_ssh_default && !app) {
         shouldUseWindowsInWsl = await canAccessPowerShell();
       }
-      if (platform2 === "darwin") {
+      if (platform3 === "darwin") {
         command = "open";
         if (options2.wait) {
           cliArguments.push("--wait-apps");
@@ -578,7 +578,7 @@ var init_open = __esm({
         if (app) {
           cliArguments.push("-a", app);
         }
-      } else if (platform2 === "win32" || shouldUseWindowsInWsl) {
+      } else if (platform3 === "win32" || shouldUseWindowsInWsl) {
         command = await powerShellPath2();
         cliArguments.push(...executePowerShell.argumentsPrefix);
         if (!is_wsl_default) {
@@ -614,11 +614,11 @@ var init_open = __esm({
           const isBundled = !__dirname || __dirname === "/";
           let exeLocalXdgOpen = false;
           try {
-            await fs8.access(localXdgOpenPath, fsConstants2.X_OK);
+            await fs9.access(localXdgOpenPath, fsConstants2.X_OK);
             exeLocalXdgOpen = true;
           } catch {
           }
-          const useSystemXdgOpen = process8.versions.electron ?? (platform2 === "android" || isBundled || !exeLocalXdgOpen);
+          const useSystemXdgOpen = process8.versions.electron ?? (platform3 === "android" || isBundled || !exeLocalXdgOpen);
           command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
         }
         if (appArguments.length > 0) {
@@ -629,7 +629,7 @@ var init_open = __esm({
           childProcessOptions.detached = true;
         }
       }
-      if (platform2 === "darwin" && appArguments.length > 0) {
+      if (platform3 === "darwin" && appArguments.length > 0) {
         cliArguments.push("--args", ...appArguments);
       }
       if (options2.target) {
@@ -754,8 +754,8 @@ var require_dist = __commonJS({
       var $global, $module, $NaN = NaN;
       if ("undefined" != typeof window ? $global = window : "undefined" != typeof self ? $global = self : "undefined" != typeof global ? ($global = global).require = __require : $global = this, void 0 === $global || void 0 === $global.Array) throw new Error("no global object found");
       if ("undefined" != typeof module && ($module = module), !$global.fs && $global.require) try {
-        var fs28 = $global.require("fs");
-        "object" == typeof fs28 && null !== fs28 && 0 !== Object.keys(fs28).length && ($global.fs = fs28);
+        var fs29 = $global.require("fs");
+        "object" == typeof fs29 && null !== fs29 && 0 !== Object.keys(fs29).length && ($global.fs = fs29);
       } catch (e) {
       }
       if (!$global.fs) {
@@ -182949,8 +182949,11 @@ import { Command } from "commander";
 import React2, { useState, useEffect } from "react";
 import { render as render2, Text as Text2, Box as Box2, useInput, useApp } from "ink";
 import "ink-spinner";
-import * as fs10 from "fs";
-import * as path6 from "path";
+import * as fs11 from "fs";
+import * as path7 from "path";
+
+// src/lib/dev/system-setup.ts
+import { execSync as execSync2 } from "child_process";
 
 // src/lib/dev/local-ca.ts
 import * as fs from "fs";
@@ -182965,6 +182968,38 @@ function caFilesExist() {
   const caDir = getCADir();
   return fs.existsSync(path.join(caDir, "ca.key")) && fs.existsSync(path.join(caDir, "ca.crt"));
 }
+function caInstalledInTrustStore() {
+  if (!caFilesExist()) {
+    return false;
+  }
+  const platform5 = os.platform();
+  const certPath = path.join(getCADir(), "ca.crt");
+  const diskCert = fs.readFileSync(certPath, "utf-8").replace(/\r\n/g, "\n").trim();
+  try {
+    if (platform5 === "darwin") {
+      const keychainCert = execSync(
+        'security find-certificate -c "Specific Local Development CA" -p /Library/Keychains/System.keychain',
+        { encoding: "utf-8" }
+      ).replace(/\r\n/g, "\n").trim();
+      return keychainCert === diskCert;
+    } else if (platform5 === "linux") {
+      const trustPaths = [
+        "/usr/local/share/ca-certificates/specific-local-ca.crt",
+        "/etc/pki/ca-trust/source/anchors/specific-local-ca.crt"
+      ];
+      for (const trustPath of trustPaths) {
+        if (fs.existsSync(trustPath)) {
+          const trustedCert = fs.readFileSync(trustPath, "utf-8").replace(/\r\n/g, "\n").trim();
+          return trustedCert === diskCert;
+        }
+      }
+      return false;
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
 function createNameConstraintsExtension(permittedDNSNames) {
   const nameConstraintsOID = "2.5.29.30";
   const permittedSubtrees = permittedDNSNames.map((dnsName) => {
@@ -183054,32 +183089,30 @@ function removeCA() {
     fs.unlinkSync(certPath);
   }
 }
-function installCAToTrustStore(certPath) {
-  const platform4 = os.platform();
-  if (platform4 === "darwin") {
-    execSync(
-      `sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`,
-      { stdio: "inherit" }
-    );
-  } else if (platform4 === "linux") {
+function getCAInstallCommands(certPath) {
+  const platform5 = os.platform();
+  if (platform5 === "darwin") {
+    return [
+      // Remove any existing cert with the same CN first — add-trusted-cert
+      // silently does nothing if a cert with the same subject already exists.
+      'security delete-certificate -c "Specific Local Development CA" /Library/Keychains/System.keychain 2>/dev/null || true',
+      `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`
+    ];
+  } else if (platform5 === "linux") {
     if (fs.existsSync("/usr/local/share/ca-certificates")) {
-      execSync(
-        `sudo cp "${certPath}" /usr/local/share/ca-certificates/specific-local-ca.crt`,
-        { stdio: "inherit" }
-      );
-      execSync("sudo update-ca-certificates", { stdio: "inherit" });
+      return [
+        `cp "${certPath}" /usr/local/share/ca-certificates/specific-local-ca.crt`,
+        "update-ca-certificates"
+      ];
     } else if (fs.existsSync("/etc/pki/ca-trust/source/anchors")) {
-      execSync(
-        `sudo cp "${certPath}" /etc/pki/ca-trust/source/anchors/specific-local-ca.crt`,
-        { stdio: "inherit" }
-      );
-      execSync("sudo update-ca-trust extract", { stdio: "inherit" });
-    } else {
-      throw new Error("Could not detect Linux certificate trust mechanism");
+      return [
+        `cp "${certPath}" /etc/pki/ca-trust/source/anchors/specific-local-ca.crt`,
+        "update-ca-trust extract"
+      ];
     }
-  } else {
-    throw new Error(`Unsupported platform: ${platform4}`);
+    throw new Error("Could not detect Linux certificate trust mechanism");
   }
+  throw new Error(`Unsupported platform: ${platform5}`);
 }
 function generateCertificate(domain, keys = []) {
   const caDir = getCADir();
@@ -183118,14 +183151,164 @@ function generateCertificate(domain, keys = []) {
   };
 }
 
+// src/lib/dev/resolver-config.ts
+import * as fs2 from "fs";
+import * as os2 from "os";
+var RESOLVER_FILE_MACOS = "/etc/resolver/local.spcf.app";
+var RESOLVER_FILE_LINUX = "/etc/systemd/resolved.conf.d/specific-local.conf";
+function resolverConfigExists() {
+  const platform5 = os2.platform();
+  if (platform5 === "darwin") {
+    return fs2.existsSync(RESOLVER_FILE_MACOS);
+  } else if (platform5 === "linux") {
+    return fs2.existsSync(RESOLVER_FILE_LINUX);
+  }
+  return false;
+}
+function getResolverInstallCommands(port) {
+  const platform5 = os2.platform();
+  if (platform5 === "darwin") {
+    return [
+      "mkdir -p /etc/resolver",
+      `printf "nameserver 127.0.0.1\\nport ${port}\\n" > ${RESOLVER_FILE_MACOS}`
+    ];
+  } else if (platform5 === "linux") {
+    if (fs2.existsSync("/etc/systemd/resolved.conf.d") || fs2.existsSync("/etc/systemd")) {
+      return [
+        "mkdir -p /etc/systemd/resolved.conf.d",
+        `printf "[Resolve]\\nDNS=127.0.0.1:${port}\\nDomains=~local.spcf.app\\n" > ${RESOLVER_FILE_LINUX}`,
+        "systemctl restart systemd-resolved"
+      ];
+    }
+    return [];
+  }
+  return [];
+}
+
+// src/lib/dev/dns-server.ts
+import DNS from "dns2";
+
+// src/lib/dev/debug-logger.ts
+import * as fs3 from "fs";
+import * as os3 from "os";
+import * as path2 from "path";
+var DEBUG_LOG_PATH = ".specific/debug.log";
+var logStream = null;
+function writeLog(source, message) {
+  const logPath = path2.join(os3.homedir(), DEBUG_LOG_PATH);
+  fs3.mkdirSync(path2.dirname(logPath), { recursive: true });
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const line = message.endsWith("\n") ? message : message + "\n";
+  fs3.appendFileSync(logPath, `[${timestamp}] [${source}] ${line}`);
+}
+function pipeProcess(source, proc) {
+  proc.stdout?.on("data", (data) => {
+    const text = data.toString();
+    const lines = text.split("\n").filter((line) => line.length > 0);
+    for (const line of lines) {
+      writeLog(source, line);
+    }
+  });
+  proc.stderr?.on("data", (data) => {
+    const text = data.toString();
+    const lines = text.split("\n").filter((line) => line.length > 0);
+    for (const line of lines) {
+      writeLog(source, line);
+    }
+  });
+  proc.on("error", (err) => {
+    writeLog(`${source}:error`, err.message);
+  });
+  proc.on("exit", (code, signal) => {
+    writeLog(source, `Process exited with code=${code} signal=${signal}`);
+  });
+}
+function closeDebugLog() {
+  if (logStream) {
+    logStream.end();
+    logStream = null;
+  }
+}
+
+// src/lib/dev/dns-server.ts
+var DNS_PORT = 15353;
+async function startDnsServer(port = DNS_PORT) {
+  const server = DNS.createServer({
+    udp: true,
+    handle: (request, send) => {
+      const response = DNS.Packet.createResponseFromRequest(request);
+      for (const question of request.questions) {
+        if (question.type === DNS.Packet.TYPE.A) {
+          response.answers.push({
+            name: question.name,
+            type: DNS.Packet.TYPE.A,
+            class: DNS.Packet.CLASS.IN,
+            ttl: 300,
+            address: "127.0.0.1"
+          });
+        }
+      }
+      send(response);
+    }
+  });
+  await server.listen({
+    udp: { port, address: "127.0.0.1" }
+  });
+  writeLog("dns", `DNS server started on 127.0.0.1:${port}`);
+  return {
+    port,
+    async stop() {
+      await server.close();
+      writeLog("dns", "DNS server stopped");
+    }
+  };
+}
+
+// src/lib/dev/system-setup.ts
+import * as path3 from "path";
+function systemSetupNeeded() {
+  return !caInstalledInTrustStore() || !resolverConfigExists();
+}
+function performSystemSetup() {
+  const needsGenerate = !caFilesExist();
+  const needsInstallCA = !caInstalledInTrustStore();
+  const needsResolver = !resolverConfigExists();
+  if (!needsInstallCA && !needsResolver) {
+    return;
+  }
+  if (needsGenerate) {
+    const { key, cert } = generateRootCA();
+    saveCA(key, cert);
+  }
+  const certPath = path3.join(getCADir(), "ca.crt");
+  const commands = [];
+  if (needsInstallCA) {
+    commands.push(...getCAInstallCommands(certPath));
+  }
+  if (needsResolver) {
+    commands.push(...getResolverInstallCommands(DNS_PORT));
+  }
+  if (commands.length === 0) {
+    return;
+  }
+  try {
+    execSync2(`sudo sh -c '${commands.join(" && ")}'`, { stdio: "inherit" });
+  } catch (err) {
+    if (needsGenerate) {
+      removeCA();
+    }
+    throw err;
+  }
+}
+
 // src/lib/analytics/index.ts
 import { PostHog } from "posthog-node";
-import * as os5 from "os";
+import * as os6 from "os";
 import * as crypto from "crypto";
 
 // src/lib/project/config.ts
-import * as fs2 from "fs";
-import * as path2 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 var PROJECT_ID_FILE = ".specific/project_id";
 var ProjectNotLinkedError = class extends Error {
   constructor() {
@@ -183140,32 +183323,32 @@ Run: specific deploy`
   }
 };
 function readProjectId(projectDir = process.cwd()) {
-  const projectIdPath = path2.join(projectDir, PROJECT_ID_FILE);
-  if (!fs2.existsSync(projectIdPath)) {
+  const projectIdPath = path4.join(projectDir, PROJECT_ID_FILE);
+  if (!fs4.existsSync(projectIdPath)) {
     throw new ProjectNotLinkedError();
   }
-  const projectId = fs2.readFileSync(projectIdPath, "utf-8").trim();
+  const projectId = fs4.readFileSync(projectIdPath, "utf-8").trim();
   if (!projectId) {
     throw new Error(`${PROJECT_ID_FILE} is empty`);
   }
   return projectId;
 }
 function hasProjectId(projectDir = process.cwd()) {
-  const projectIdPath = path2.join(projectDir, PROJECT_ID_FILE);
-  return fs2.existsSync(projectIdPath);
+  const projectIdPath = path4.join(projectDir, PROJECT_ID_FILE);
+  return fs4.existsSync(projectIdPath);
 }
 function writeProjectId(projectId, projectDir = process.cwd()) {
-  const specificDir = path2.join(projectDir, ".specific");
-  if (!fs2.existsSync(specificDir)) {
-    fs2.mkdirSync(specificDir, { recursive: true });
+  const specificDir = path4.join(projectDir, ".specific");
+  if (!fs4.existsSync(specificDir)) {
+    fs4.mkdirSync(specificDir, { recursive: true });
   }
-  fs2.writeFileSync(path2.join(specificDir, "project_id"), projectId + "\n");
+  fs4.writeFileSync(path4.join(specificDir, "project_id"), projectId + "\n");
 }
 
 // src/lib/auth/credentials.ts
-import * as fs9 from "fs";
-import * as path5 from "path";
-import * as os4 from "os";
+import * as fs10 from "fs";
+import * as path6 from "path";
+import * as os5 from "os";
 
 // src/lib/auth/errors.ts
 var RefreshTokenExpiredError = class extends Error {
@@ -183242,48 +183425,6 @@ import React from "react";
 import { render, Box, Text } from "ink";
 import Spinner from "ink-spinner";
 
-// src/lib/dev/debug-logger.ts
-import * as fs3 from "fs";
-import * as os2 from "os";
-import * as path3 from "path";
-var DEBUG_LOG_PATH = ".specific/debug.log";
-var logStream = null;
-function writeLog(source, message) {
-  const logPath = path3.join(os2.homedir(), DEBUG_LOG_PATH);
-  fs3.mkdirSync(path3.dirname(logPath), { recursive: true });
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const line = message.endsWith("\n") ? message : message + "\n";
-  fs3.appendFileSync(logPath, `[${timestamp}] [${source}] ${line}`);
-}
-function pipeProcess(source, proc) {
-  proc.stdout?.on("data", (data) => {
-    const text = data.toString();
-    const lines = text.split("\n").filter((line) => line.length > 0);
-    for (const line of lines) {
-      writeLog(source, line);
-    }
-  });
-  proc.stderr?.on("data", (data) => {
-    const text = data.toString();
-    const lines = text.split("\n").filter((line) => line.length > 0);
-    for (const line of lines) {
-      writeLog(source, line);
-    }
-  });
-  proc.on("error", (err) => {
-    writeLog(`${source}:error`, err.message);
-  });
-  proc.on("exit", (code, signal) => {
-    writeLog(source, `Process exited with code=${code} signal=${signal}`);
-  });
-}
-function closeDebugLog() {
-  if (logStream) {
-    logStream.end();
-    logStream = null;
-  }
-}
-
 // src/lib/api/client.ts
 var ApiClient = class {
   baseUrl;
@@ -183756,18 +183897,18 @@ function performLogin(options2 = {}) {
 
 // src/lib/auth/credentials.ts
 function getUserCredentialsDir() {
-  return path5.join(os4.homedir(), ".specific");
+  return path6.join(os5.homedir(), ".specific");
 }
 function getCredentialsPath() {
-  return path5.join(getUserCredentialsDir(), "credentials.json");
+  return path6.join(getUserCredentialsDir(), "credentials.json");
 }
 function readUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (!fs9.existsSync(credentialsPath)) {
+  if (!fs10.existsSync(credentialsPath)) {
     return null;
   }
   try {
-    const content = fs9.readFileSync(credentialsPath, "utf-8");
+    const content = fs10.readFileSync(credentialsPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -183775,18 +183916,18 @@ function readUserCredentials() {
 }
 function writeUserCredentials(credentials) {
   const dir = getUserCredentialsDir();
-  if (!fs9.existsSync(dir)) {
-    fs9.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true, mode: 448 });
   }
   const credentialsPath = getCredentialsPath();
-  fs9.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
+  fs10.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
     mode: 384
   });
 }
 function clearUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (fs9.existsSync(credentialsPath)) {
-    fs9.unlinkSync(credentialsPath);
+  if (fs10.existsSync(credentialsPath)) {
+    fs10.unlinkSync(credentialsPath);
   }
 }
 function isLoggedIn() {
@@ -183840,7 +183981,7 @@ function isEnabled() {
 }
 function getAnonymousId() {
   if (anonymousId) return anonymousId;
-  const machineId = `${os5.hostname()}-${os5.userInfo().username}`;
+  const machineId = `${os6.hostname()}-${os6.userInfo().username}`;
   anonymousId = crypto.createHash("sha256").update(machineId).digest("hex").slice(0, 16);
   return anonymousId;
 }
@@ -183873,7 +184014,7 @@ function trackEvent(event, properties) {
     event,
     properties: {
       ...properties,
-      cli_version: "0.1.61",
+      cli_version: "0.1.62",
       platform: process.platform,
       node_version: process.version,
       project_id: getProjectId(),
@@ -183910,67 +184051,67 @@ var options = [
   { id: "other", label: "Other / Manual" }
 ];
 function isGitProject() {
-  const gitPath = path6.join(process.cwd(), ".git");
-  return fs10.existsSync(gitPath);
+  const gitPath = path7.join(process.cwd(), ".git");
+  return fs11.existsSync(gitPath);
 }
 function detectExistingAgents() {
   const detected = {};
-  const cursorDir = path6.join(process.cwd(), ".cursor");
-  if (fs10.existsSync(cursorDir)) {
+  const cursorDir = path7.join(process.cwd(), ".cursor");
+  if (fs11.existsSync(cursorDir)) {
     detected["cursor"] = true;
   }
-  const claudeDir = path6.join(process.cwd(), ".claude");
-  const claudeMd = path6.join(process.cwd(), "CLAUDE.md");
-  if (fs10.existsSync(claudeDir) || fs10.existsSync(claudeMd)) {
+  const claudeDir = path7.join(process.cwd(), ".claude");
+  const claudeMd = path7.join(process.cwd(), "CLAUDE.md");
+  if (fs11.existsSync(claudeDir) || fs11.existsSync(claudeMd)) {
     detected["claude"] = true;
   }
-  const agentsMd = path6.join(process.cwd(), "AGENTS.md");
-  if (fs10.existsSync(agentsMd)) {
+  const agentsMd = path7.join(process.cwd(), "AGENTS.md");
+  if (fs11.existsSync(agentsMd)) {
     detected["codex"] = true;
   }
   return detected;
 }
 function appendOrCreateFile(filePath, content) {
-  if (fs10.existsSync(filePath)) {
-    const existing = fs10.readFileSync(filePath, "utf-8");
+  if (fs11.existsSync(filePath)) {
+    const existing = fs11.readFileSync(filePath, "utf-8");
     if (existing.includes("specific docs") || existing.includes("specific check")) {
       return "unchanged";
     }
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    fs10.writeFileSync(filePath, existing + separator + content + "\n");
+    fs11.writeFileSync(filePath, existing + separator + content + "\n");
     return "modified";
   } else {
-    fs10.writeFileSync(filePath, content + "\n");
+    fs11.writeFileSync(filePath, content + "\n");
     return "created";
   }
 }
 function addToGitignore() {
-  const gitignorePath = path6.join(process.cwd(), ".gitignore");
+  const gitignorePath = path7.join(process.cwd(), ".gitignore");
   const entries = [".specific", "specific.local"];
-  if (fs10.existsSync(gitignorePath)) {
-    const existing = fs10.readFileSync(gitignorePath, "utf-8");
+  if (fs11.existsSync(gitignorePath)) {
+    const existing = fs11.readFileSync(gitignorePath, "utf-8");
     const lines = existing.split("\n").map((l) => l.trim());
     const missingEntries = entries.filter((entry) => !lines.includes(entry));
     if (missingEntries.length === 0) {
       return "unchanged";
     }
     const separator = existing.endsWith("\n") ? "" : "\n";
-    fs10.writeFileSync(
+    fs11.writeFileSync(
       gitignorePath,
       existing + separator + missingEntries.join("\n") + "\n"
     );
     return "modified";
   } else {
-    fs10.writeFileSync(gitignorePath, entries.join("\n") + "\n");
+    fs11.writeFileSync(gitignorePath, entries.join("\n") + "\n");
     return "created";
   }
 }
 function configureClaudeCodePermissions() {
-  const claudeDir = path6.join(process.cwd(), ".claude");
-  const settingsPath = path6.join(claudeDir, "settings.local.json");
+  const claudeDir = path7.join(process.cwd(), ".claude");
+  const settingsPath = path7.join(claudeDir, "settings.local.json");
   const permissions = ["Bash(specific docs:*)", "Bash(specific check:*)"];
-  if (fs10.existsSync(settingsPath)) {
-    const existing = JSON.parse(fs10.readFileSync(settingsPath, "utf-8"));
+  if (fs11.existsSync(settingsPath)) {
+    const existing = JSON.parse(fs11.readFileSync(settingsPath, "utf-8"));
     const allowList = existing?.permissions?.allow || [];
     const missingPermissions = permissions.filter(
       (p) => !allowList.includes(p)
@@ -183985,39 +184126,39 @@ function configureClaudeCodePermissions() {
       existing.permissions.allow = [];
     }
     existing.permissions.allow.push(...missingPermissions);
-    fs10.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
+    fs11.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
     return "modified";
   }
-  if (!fs10.existsSync(claudeDir)) {
-    fs10.mkdirSync(claudeDir);
+  if (!fs11.existsSync(claudeDir)) {
+    fs11.mkdirSync(claudeDir);
   }
   const settings = {
     permissions: {
       allow: permissions
     }
   };
-  fs10.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  fs11.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   return "created";
 }
 function createCursorRule() {
-  const cursorDir = path6.join(process.cwd(), ".cursor");
-  const rulesDir = path6.join(cursorDir, "rules");
-  const mdcPath = path6.join(rulesDir, "specific.mdc");
-  if (fs10.existsSync(mdcPath)) {
-    const existing = fs10.readFileSync(mdcPath, "utf-8");
+  const cursorDir = path7.join(process.cwd(), ".cursor");
+  const rulesDir = path7.join(cursorDir, "rules");
+  const mdcPath = path7.join(rulesDir, "specific.mdc");
+  if (fs11.existsSync(mdcPath)) {
+    const existing = fs11.readFileSync(mdcPath, "utf-8");
     if (existing.includes("specific docs") || existing.includes("specific check")) {
       return "unchanged";
     }
-    fs10.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
+    fs11.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
     return "modified";
   }
-  if (!fs10.existsSync(cursorDir)) {
-    fs10.mkdirSync(cursorDir);
+  if (!fs11.existsSync(cursorDir)) {
+    fs11.mkdirSync(cursorDir);
   }
-  if (!fs10.existsSync(rulesDir)) {
-    fs10.mkdirSync(rulesDir);
+  if (!fs11.existsSync(rulesDir)) {
+    fs11.mkdirSync(rulesDir);
   }
-  fs10.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
+  fs11.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
   return "created";
 }
 function configureAgents(checked) {
@@ -184033,7 +184174,7 @@ function configureAgents(checked) {
       agents.filesModified.push(".cursor/rules/specific.mdc");
   }
   if (checked["claude"]) {
-    const claudeMdPath = path6.join(process.cwd(), "CLAUDE.md");
+    const claudeMdPath = path7.join(process.cwd(), "CLAUDE.md");
     const status = appendOrCreateFile(claudeMdPath, SPECIFIC_INSTRUCTIONS);
     if (status === "created") agents.filesCreated.push("CLAUDE.md");
     else if (status === "modified") agents.filesModified.push("CLAUDE.md");
@@ -184044,7 +184185,7 @@ function configureAgents(checked) {
       agents.filesModified.push(".claude/settings.local.json");
   }
   if (checked["codex"]) {
-    const agentsMdPath = path6.join(process.cwd(), "AGENTS.md");
+    const agentsMdPath = path7.join(process.cwd(), "AGENTS.md");
     const status = appendOrCreateFile(agentsMdPath, SPECIFIC_INSTRUCTIONS);
     if (status === "created") agents.filesCreated.push("AGENTS.md");
     else if (status === "modified") agents.filesModified.push("AGENTS.md");
@@ -184070,16 +184211,16 @@ function InitUI() {
     };
   });
   const [phase, setPhase] = useState(
-    () => caFilesExist() ? "agents" : "installing-ca"
+    () => !systemSetupNeeded() ? "agents" : "installing-ca"
   );
-  const [caInstallPhase, setCaInstallPhase] = useState(() => caFilesExist() ? "done" : "installing");
+  const [caInstallPhase, setCaInstallPhase] = useState(() => !systemSetupNeeded() ? "done" : "installing");
   const [focusedIndex, setFocusedIndex] = useState(initialState.focusedIndex);
   const [checked, setChecked] = useState(
     initialState.detected
   );
   const [result, setResult] = useState(null);
   const [tlsResult, setTlsResult] = useState(
-    caFilesExist() ? { status: "success" } : null
+    !systemSetupNeeded() ? { status: "success" } : null
   );
   useEffect(() => {
     if (phase === "installing-ca" && caInstallPhase === "installing") {
@@ -184088,14 +184229,11 @@ function InitUI() {
   }, [phase, caInstallPhase]);
   async function installCA() {
     try {
-      const { key, cert } = generateRootCA();
-      const certPath = saveCA(key, cert);
-      installCAToTrustStore(certPath);
+      performSystemSetup();
       setTlsResult({ status: "success" });
       setCaInstallPhase("done");
       setPhase("agents");
     } catch (err) {
-      removeCA();
       setTlsResult({
         status: "error",
         error: err instanceof Error ? err.message : String(err)
@@ -184136,16 +184274,16 @@ function InitUI() {
   }, [phase, exit]);
   if (phase === "installing-ca") {
     if (caInstallPhase === "installing") {
-      return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "TLS Certificate Setup"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Installing a local certificate authority (CA) to enable HTTPS"), /* @__PURE__ */ React2.createElement(Text2, null, "for local development. The CA is limited to Specific projects."), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Your password is required to add the CA to your system's trust store."), /* @__PURE__ */ React2.createElement(Text2, null, " "));
+      return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Local Development Setup"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Setting up TLS certificates and DNS resolution for local"), /* @__PURE__ */ React2.createElement(Text2, null, "development. This is a one-time setup for Specific projects."), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Your password is required to configure your system."), /* @__PURE__ */ React2.createElement(Text2, null, " "));
     }
   }
   if (phase === "done") {
     const selectedAgents = Object.entries(checked).filter(([, v]) => v).length;
     const agentChanges = result && (result.agents.filesCreated.length > 0 || result.agents.filesModified.length > 0);
     const gitChanges = result?.git && (result.git.filesCreated.length > 0 || result.git.filesModified.length > 0);
-    return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, tlsResult === null && /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u25CF"), " Installing TLS certificates..."), tlsResult?.status === "success" && /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS certificates installed"), tlsResult?.status === "error" && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " Failed to install TLS certificates"), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", tlsResult.error)), result && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Coding agents configured"), result.agents.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.agents.filesCreated.join(", ")), result.agents.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.agents.filesModified.join(", ")), !agentChanges && selectedAgents > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (files already configured)"), selectedAgents === 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " No agents selected")), result?.git && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Git configured"), result.git.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.git.filesCreated.join(", ")), result.git.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.git.filesModified.join(", ")), !gitChanges && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (.gitignore already configured)")), result?.showManualInstructions && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Manual configuration selected"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " Add this to your agent's system prompt:"), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, SPECIFIC_INSTRUCTIONS), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " ", "We also recommend allowing your agent to run `specific docs *`"), /* @__PURE__ */ React2.createElement(Text2, null, " and `specific check *` without confirmation.")));
+    return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, tlsResult === null && /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u25CF"), " Setting up TLS and DNS..."), tlsResult?.status === "success" && /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS and DNS configured"), tlsResult?.status === "error" && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " Failed to set up TLS and DNS"), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", tlsResult.error)), result && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Coding agents configured"), result.agents.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.agents.filesCreated.join(", ")), result.agents.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.agents.filesModified.join(", ")), !agentChanges && selectedAgents > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (files already configured)"), selectedAgents === 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " No agents selected")), result?.git && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Git configured"), result.git.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.git.filesCreated.join(", ")), result.git.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.git.filesModified.join(", ")), !gitChanges && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (.gitignore already configured)")), result?.showManualInstructions && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Manual configuration selected"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " Add this to your agent's system prompt:"), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, SPECIFIC_INSTRUCTIONS), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " ", "We also recommend allowing your agent to run `specific docs *`"), /* @__PURE__ */ React2.createElement(Text2, null, " and `specific check *` without confirmation.")));
   }
-  const tlsLine = tlsResult?.status === "success" ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS certificates installed") : tlsResult?.status === "error" ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " TLS certificates failed", " ", /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "(", tlsResult.error, ")")) : null;
+  const tlsLine = tlsResult?.status === "success" ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS and DNS configured") : tlsResult?.status === "error" ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " TLS and DNS setup failed", " ", /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "(", tlsResult.error, ")")) : null;
   return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, tlsLine, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u25CF"), " Configure coding agents", " ", /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "(space to select)")), /* @__PURE__ */ React2.createElement(Text2, null, " "), options.map((option, index) => {
     const isFocused = focusedIndex === index;
     const isChecked = checked[option.id];
@@ -184216,9 +184354,9 @@ Valid agents: ${VALID_AGENT_IDS.join(", ")}`
       console.log("  No changes needed (.gitignore already configured)");
     }
   }
-  if (!caFilesExist()) {
+  if (systemSetupNeeded()) {
     console.log(
-      "\u26A0 TLS certificates not installed (run `specific init` in a terminal to set up)"
+      "\u26A0 TLS and DNS not configured (run `specific init` in a terminal to set up)"
     );
   }
   if (result.showManualInstructions) {
@@ -184235,8 +184373,8 @@ Valid agents: ${VALID_AGENT_IDS.join(", ")}`
 }
 
 // src/commands/docs.tsx
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
-import { join as join7, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
+import { join as join8, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/beta/registry.ts
@@ -184248,12 +184386,12 @@ var BETA_REGISTRY = [
 ];
 
 // src/lib/beta/storage.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync5, mkdirSync as mkdirSync6 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync6 } from "fs";
+import { join as join7 } from "path";
 var BETAS_FILE = ".specific/betas.json";
 function loadEnabledBetas(projectDir = process.cwd()) {
-  const filePath = join6(projectDir, BETAS_FILE);
-  if (!existsSync5(filePath)) {
+  const filePath = join7(projectDir, BETAS_FILE);
+  if (!existsSync6(filePath)) {
     return [];
   }
   try {
@@ -184276,25 +184414,25 @@ function disableBeta(name, projectDir = process.cwd()) {
   saveBetas(enabled, projectDir);
 }
 function saveBetas(enabled, projectDir) {
-  const specificDir = join6(projectDir, ".specific");
-  if (!existsSync5(specificDir)) {
+  const specificDir = join7(projectDir, ".specific");
+  if (!existsSync6(specificDir)) {
     mkdirSync6(specificDir, { recursive: true });
   }
   const data = { enabled };
   writeFileSync5(
-    join6(projectDir, BETAS_FILE),
+    join7(projectDir, BETAS_FILE),
     JSON.stringify(data, null, 2) + "\n"
   );
 }
 
 // src/commands/docs.tsx
 var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
-var docsDir = join7(__dirname2, "docs");
-function docsCommand(path26) {
-  const docPath = resolveDocPath(path26);
+var docsDir = join8(__dirname2, "docs");
+function docsCommand(path27) {
+  const docPath = resolveDocPath(path27);
   if (!docPath) {
     console.error(
-      `Documentation not found: ${path26 || "index"}
+      `Documentation not found: ${path27 || "index"}
 
 Run 'specific docs' to see available topics.`
     );
@@ -184313,17 +184451,17 @@ function filterBetaTags(content, enabledBetas) {
     }
   );
 }
-function resolveDocPath(path26) {
-  if (!path26) {
-    const indexPath2 = join7(docsDir, "index.md");
-    return existsSync6(indexPath2) ? indexPath2 : null;
+function resolveDocPath(path27) {
+  if (!path27) {
+    const indexPath2 = join8(docsDir, "index.md");
+    return existsSync7(indexPath2) ? indexPath2 : null;
   }
-  const directPath = join7(docsDir, `${path26}.md`);
-  if (existsSync6(directPath)) {
+  const directPath = join8(docsDir, `${path27}.md`);
+  if (existsSync7(directPath)) {
     return directPath;
   }
-  const indexPath = join7(docsDir, path26, "index.md");
-  if (existsSync6(indexPath)) {
+  const indexPath = join8(docsDir, path27, "index.md");
+  if (existsSync7(indexPath)) {
     return indexPath;
   }
   return null;
@@ -184333,8 +184471,8 @@ function resolveDocPath(path26) {
 import React3, { useState as useState2, useEffect as useEffect2 } from "react";
 import { render as render3, Text as Text3, Box as Box3 } from "ink";
 import Spinner3 from "ink-spinner";
-import * as fs12 from "fs";
-import * as path8 from "path";
+import * as fs13 from "fs";
+import * as path9 from "path";
 import { execFile as execFile7 } from "child_process";
 
 // node_modules/.pnpm/@specific+config@file+..+config/node_modules/@specific/config/dist/parser.js
@@ -185011,32 +185149,32 @@ var ExtractionError = class extends Error {
 };
 
 // src/lib/bin/manager.ts
-import * as fs11 from "fs";
-import * as path7 from "path";
-import * as os6 from "os";
+import * as fs12 from "fs";
+import * as path8 from "path";
+import * as os7 from "os";
 import { createReadStream } from "fs";
 import { createTarExtractor, extractTo } from "tar-vern";
 function getLibraryEnv(binary) {
   if (!binary.libraryPath) {
     return {};
   }
-  const platform4 = os6.platform();
-  if (platform4 === "darwin") {
+  const platform5 = os7.platform();
+  if (platform5 === "darwin") {
     return { DYLD_LIBRARY_PATH: binary.libraryPath };
-  } else if (platform4 === "linux") {
+  } else if (platform5 === "linux") {
     return { LD_LIBRARY_PATH: binary.libraryPath };
   }
   return {};
 }
 function getBinBaseDir() {
-  return path7.join(os6.homedir(), ".specific", "bin");
+  return path8.join(os7.homedir(), ".specific", "bin");
 }
 function getPlatformInfo() {
-  const platform4 = os6.platform();
-  const arch3 = os6.arch();
-  if (platform4 !== "darwin" && platform4 !== "linux") {
+  const platform5 = os7.platform();
+  const arch3 = os7.arch();
+  if (platform5 !== "darwin" && platform5 !== "linux") {
     throw new Error(
-      `Unsupported platform: ${platform4}. Only macOS and Linux are supported.`
+      `Unsupported platform: ${platform5}. Only macOS and Linux are supported.`
     );
   }
   const archStr = arch3;
@@ -185050,10 +185188,10 @@ function getPlatformInfo() {
       `Unsupported architecture: ${arch3}. Only x64 and arm64 are supported.`
     );
   }
-  return { platform: platform4, arch: mappedArch };
+  return { platform: platform5, arch: mappedArch };
 }
 function getBinaryDir(definition, version, platformInfo) {
-  return path7.join(
+  return path8.join(
     getBinBaseDir(),
     definition.name,
     version,
@@ -185063,8 +185201,8 @@ function getBinaryDir(definition, version, platformInfo) {
 function isBinaryInstalled(definition, version, platformInfo) {
   const binDir = getBinaryDir(definition, version, platformInfo);
   for (const execPath of definition.executables) {
-    const fullPath = path7.join(binDir, execPath);
-    if (!fs11.existsSync(fullPath)) {
+    const fullPath = path8.join(binDir, execPath);
+    if (!fs12.existsSync(fullPath)) {
       return false;
     }
   }
@@ -185092,12 +185230,12 @@ async function downloadFile(url, destPath, onProgress) {
     10
   );
   let bytesDownloaded = 0;
-  const parentDir = path7.dirname(destPath);
-  if (!fs11.existsSync(parentDir)) {
-    fs11.mkdirSync(parentDir, { recursive: true });
+  const parentDir = path8.dirname(destPath);
+  if (!fs12.existsSync(parentDir)) {
+    fs12.mkdirSync(parentDir, { recursive: true });
   }
   const partPath = destPath + ".part";
-  const fileStream = fs11.createWriteStream(partPath);
+  const fileStream = fs12.createWriteStream(partPath);
   try {
     const reader = response.body.getReader();
     while (true) {
@@ -185120,12 +185258,12 @@ async function downloadFile(url, destPath, onProgress) {
         else resolve10();
       });
     });
-    fs11.renameSync(partPath, destPath);
+    fs12.renameSync(partPath, destPath);
   } catch (error) {
     try {
       fileStream.close();
-      if (fs11.existsSync(partPath)) {
-        fs11.unlinkSync(partPath);
+      if (fs12.existsSync(partPath)) {
+        fs12.unlinkSync(partPath);
       }
     } catch {
     }
@@ -185134,8 +185272,8 @@ async function downloadFile(url, destPath, onProgress) {
 }
 async function extractTarball(archivePath, destDir, definition, onProgress) {
   onProgress?.({ phase: "extracting" });
-  if (!fs11.existsSync(destDir)) {
-    fs11.mkdirSync(destDir, { recursive: true });
+  if (!fs12.existsSync(destDir)) {
+    fs12.mkdirSync(destDir, { recursive: true });
   }
   try {
     const fileStream = createReadStream(archivePath);
@@ -185143,9 +185281,9 @@ async function extractTarball(archivePath, destDir, definition, onProgress) {
     await extractTo(entries, destDir);
     onProgress?.({ phase: "finalizing" });
     for (const execPath of definition.executables) {
-      const fullPath = path7.join(destDir, execPath);
-      if (fs11.existsSync(fullPath)) {
-        fs11.chmodSync(fullPath, 493);
+      const fullPath = path8.join(destDir, execPath);
+      if (fs12.existsSync(fullPath)) {
+        fs12.chmodSync(fullPath, 493);
       }
     }
   } catch (error) {
@@ -185169,24 +185307,24 @@ async function ensureBinary(definition, version, onProgress) {
           `Binary type definitions must have exactly one executable, got ${definition.executables.length}`
         );
       }
-      if (!fs11.existsSync(binDir)) {
-        fs11.mkdirSync(binDir, { recursive: true });
+      if (!fs12.existsSync(binDir)) {
+        fs12.mkdirSync(binDir, { recursive: true });
       }
-      const execPath = path7.join(binDir, definition.executables[0]);
+      const execPath = path8.join(binDir, definition.executables[0]);
       await downloadFile(url, execPath, onProgress);
-      fs11.chmodSync(execPath, 493);
+      fs12.chmodSync(execPath, 493);
       onProgress?.({ phase: "finalizing" });
     } else {
-      const downloadDir = path7.join(getBinBaseDir(), "downloads");
+      const downloadDir = path8.join(getBinBaseDir(), "downloads");
       const archiveName = `${definition.name}-${resolvedVersion}-${platformInfo.platform}-${platformInfo.arch}.tar.gz`;
-      const archivePath = path7.join(downloadDir, archiveName);
+      const archivePath = path8.join(downloadDir, archiveName);
       try {
         await downloadFile(url, archivePath, onProgress);
         await extractTarball(archivePath, binDir, definition, onProgress);
       } finally {
         try {
-          if (fs11.existsSync(archivePath)) {
-            fs11.unlinkSync(archivePath);
+          if (fs12.existsSync(archivePath)) {
+            fs12.unlinkSync(archivePath);
           }
         } catch {
         }
@@ -185195,10 +185333,10 @@ async function ensureBinary(definition, version, onProgress) {
   }
   const executables = {};
   for (const execPath of definition.executables) {
-    const name = path7.basename(execPath);
-    executables[name] = path7.join(binDir, execPath);
+    const name = path8.basename(execPath);
+    executables[name] = path8.join(binDir, execPath);
   }
-  const libraryPath = definition.libraryDir ? path7.join(binDir, definition.libraryDir) : void 0;
+  const libraryPath = definition.libraryDir ? path8.join(binDir, definition.libraryDir) : void 0;
   return {
     rootDir: binDir,
     version: resolvedVersion,
@@ -185342,8 +185480,8 @@ function CheckUI() {
   const [state, setState] = useState2({ status: "loading" });
   useEffect2(() => {
     async function load() {
-      const configPath = path8.join(process.cwd(), "specific.hcl");
-      if (!fs12.existsSync(configPath)) {
+      const configPath = path9.join(process.cwd(), "specific.hcl");
+      if (!fs13.existsSync(configPath)) {
         setState({
           status: "error",
           error: "No specific.hcl found in current directory"
@@ -185351,16 +185489,16 @@ function CheckUI() {
         return;
       }
       try {
-        const hcl = fs12.readFileSync(configPath, "utf-8");
+        const hcl = fs13.readFileSync(configPath, "utf-8");
         const config2 = await parseConfig(hcl);
         const reshapeChecks2 = [];
         for (const pg of config2.postgres) {
           if (pg.reshape?.enabled) {
-            const migrationsDir = path8.resolve(
+            const migrationsDir = path9.resolve(
               process.cwd(),
               pg.reshape.migrations_dir ?? "migrations"
             );
-            if (!fs12.existsSync(migrationsDir)) {
+            if (!fs13.existsSync(migrationsDir)) {
               reshapeChecks2.push({
                 databaseName: pg.name,
                 migrationsDir: pg.reshape.migrations_dir ?? "migrations",
@@ -185413,8 +185551,8 @@ function checkCommand() {
 import React6, { useState as useState5, useEffect as useEffect3, useRef } from "react";
 import { render as render4, Text as Text6, Box as Box6, useApp as useApp2, Static } from "ink";
 import Spinner4 from "ink-spinner";
-import * as fs21 from "fs";
-import * as path18 from "path";
+import * as fs22 from "fs";
+import * as path19 from "path";
 
 // node_modules/.pnpm/chokidar@5.0.0/node_modules/chokidar/index.js
 import { EventEmitter } from "node:events";
@@ -185506,7 +185644,7 @@ var ReaddirpStream = class extends Readable {
     this._directoryFilter = normalizeFilter(opts.directoryFilter);
     const statMethod = opts.lstat ? lstat : stat;
     if (wantBigintFsStats) {
-      this._stat = (path26) => statMethod(path26, { bigint: true });
+      this._stat = (path27) => statMethod(path27, { bigint: true });
     } else {
       this._stat = statMethod;
     }
@@ -185531,8 +185669,8 @@ var ReaddirpStream = class extends Readable {
         const par = this.parent;
         const fil = par && par.files;
         if (fil && fil.length > 0) {
-          const { path: path26, depth } = par;
-          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path26));
+          const { path: path27, depth } = par;
+          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path27));
           const awaited = await Promise.all(slice);
           for (const entry of awaited) {
             if (!entry)
@@ -185572,20 +185710,20 @@ var ReaddirpStream = class extends Readable {
       this.reading = false;
     }
   }
-  async _exploreDir(path26, depth) {
+  async _exploreDir(path27, depth) {
     let files;
     try {
-      files = await readdir(path26, this._rdOptions);
+      files = await readdir(path27, this._rdOptions);
     } catch (error) {
       this._onError(error);
     }
-    return { files, depth, path: path26 };
+    return { files, depth, path: path27 };
   }
-  async _formatEntry(dirent, path26) {
+  async _formatEntry(dirent, path27) {
     let entry;
     const basename6 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = presolve(pjoin(path26, basename6));
+      const fullPath = presolve(pjoin(path27, basename6));
       entry = { path: prelative(this._root, fullPath), fullPath, basename: basename6 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
@@ -185985,16 +186123,16 @@ var delFromSet = (main, prop, item) => {
 };
 var isEmptySet = (val) => val instanceof Set ? val.size === 0 : !val;
 var FsWatchInstances = /* @__PURE__ */ new Map();
-function createFsWatchInstance(path26, options2, listener, errHandler, emitRaw) {
+function createFsWatchInstance(path27, options2, listener, errHandler, emitRaw) {
   const handleEvent = (rawEvent, evPath) => {
-    listener(path26);
-    emitRaw(rawEvent, evPath, { watchedPath: path26 });
-    if (evPath && path26 !== evPath) {
-      fsWatchBroadcast(sp.resolve(path26, evPath), KEY_LISTENERS, sp.join(path26, evPath));
+    listener(path27);
+    emitRaw(rawEvent, evPath, { watchedPath: path27 });
+    if (evPath && path27 !== evPath) {
+      fsWatchBroadcast(sp.resolve(path27, evPath), KEY_LISTENERS, sp.join(path27, evPath));
     }
   };
   try {
-    return fs_watch(path26, {
+    return fs_watch(path27, {
       persistent: options2.persistent
     }, handleEvent);
   } catch (error) {
@@ -186010,12 +186148,12 @@ var fsWatchBroadcast = (fullPath, listenerType, val1, val2, val3) => {
     listener(val1, val2, val3);
   });
 };
-var setFsWatchListener = (path26, fullPath, options2, handlers) => {
+var setFsWatchListener = (path27, fullPath, options2, handlers) => {
   const { listener, errHandler, rawEmitter } = handlers;
   let cont = FsWatchInstances.get(fullPath);
   let watcher;
   if (!options2.persistent) {
-    watcher = createFsWatchInstance(path26, options2, listener, errHandler, rawEmitter);
+    watcher = createFsWatchInstance(path27, options2, listener, errHandler, rawEmitter);
     if (!watcher)
       return;
     return watcher.close.bind(watcher);
@@ -186026,7 +186164,7 @@ var setFsWatchListener = (path26, fullPath, options2, handlers) => {
     addAndConvert(cont, KEY_RAW, rawEmitter);
   } else {
     watcher = createFsWatchInstance(
-      path26,
+      path27,
       options2,
       fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS),
       errHandler,
@@ -186041,7 +186179,7 @@ var setFsWatchListener = (path26, fullPath, options2, handlers) => {
         cont.watcherUnusable = true;
       if (isWindows && error.code === "EPERM") {
         try {
-          const fd = await open2(path26, "r");
+          const fd = await open2(path27, "r");
           await fd.close();
           broadcastErr(error);
         } catch (err) {
@@ -186072,7 +186210,7 @@ var setFsWatchListener = (path26, fullPath, options2, handlers) => {
   };
 };
 var FsWatchFileInstances = /* @__PURE__ */ new Map();
-var setFsWatchFileListener = (path26, fullPath, options2, handlers) => {
+var setFsWatchFileListener = (path27, fullPath, options2, handlers) => {
   const { listener, rawEmitter } = handlers;
   let cont = FsWatchFileInstances.get(fullPath);
   const copts = cont && cont.options;
@@ -186094,7 +186232,7 @@ var setFsWatchFileListener = (path26, fullPath, options2, handlers) => {
         });
         const currmtime = curr.mtimeMs;
         if (curr.size !== prev.size || currmtime > prev.mtimeMs || currmtime === 0) {
-          foreach(cont.listeners, (listener2) => listener2(path26, curr));
+          foreach(cont.listeners, (listener2) => listener2(path27, curr));
         }
       })
     };
@@ -186124,13 +186262,13 @@ var NodeFsHandler = class {
    * @param listener on fs change
    * @returns closer for the watcher instance
    */
-  _watchWithNodeFs(path26, listener) {
+  _watchWithNodeFs(path27, listener) {
     const opts = this.fsw.options;
-    const directory = sp.dirname(path26);
-    const basename6 = sp.basename(path26);
+    const directory = sp.dirname(path27);
+    const basename6 = sp.basename(path27);
     const parent = this.fsw._getWatchedDir(directory);
     parent.add(basename6);
-    const absolutePath = sp.resolve(path26);
+    const absolutePath = sp.resolve(path27);
     const options2 = {
       persistent: opts.persistent
     };
@@ -186140,12 +186278,12 @@ var NodeFsHandler = class {
     if (opts.usePolling) {
       const enableBin = opts.interval !== opts.binaryInterval;
       options2.interval = enableBin && isBinaryPath(basename6) ? opts.binaryInterval : opts.interval;
-      closer = setFsWatchFileListener(path26, absolutePath, options2, {
+      closer = setFsWatchFileListener(path27, absolutePath, options2, {
         listener,
         rawEmitter: this.fsw._emitRaw
       });
     } else {
-      closer = setFsWatchListener(path26, absolutePath, options2, {
+      closer = setFsWatchListener(path27, absolutePath, options2, {
         listener,
         errHandler: this._boundHandleError,
         rawEmitter: this.fsw._emitRaw
@@ -186167,7 +186305,7 @@ var NodeFsHandler = class {
     let prevStats = stats;
     if (parent.has(basename6))
       return;
-    const listener = async (path26, newStats) => {
+    const listener = async (path27, newStats) => {
       if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5))
         return;
       if (!newStats || newStats.mtimeMs === 0) {
@@ -186181,11 +186319,11 @@ var NodeFsHandler = class {
             this.fsw._emit(EV.CHANGE, file, newStats2);
           }
           if ((isMacos || isLinux || isFreeBSD) && prevStats.ino !== newStats2.ino) {
-            this.fsw._closeFile(path26);
+            this.fsw._closeFile(path27);
             prevStats = newStats2;
             const closer2 = this._watchWithNodeFs(file, listener);
             if (closer2)
-              this.fsw._addPathCloser(path26, closer2);
+              this.fsw._addPathCloser(path27, closer2);
           } else {
             prevStats = newStats2;
           }
@@ -186217,7 +186355,7 @@ var NodeFsHandler = class {
    * @param item basename of this item
    * @returns true if no more processing is needed for this entry.
    */
-  async _handleSymlink(entry, directory, path26, item) {
+  async _handleSymlink(entry, directory, path27, item) {
     if (this.fsw.closed) {
       return;
     }
@@ -186227,7 +186365,7 @@ var NodeFsHandler = class {
       this.fsw._incrReadyCount();
       let linkPath;
       try {
-        linkPath = await fsrealpath(path26);
+        linkPath = await fsrealpath(path27);
       } catch (e) {
         this.fsw._emitReady();
         return true;
@@ -186237,12 +186375,12 @@ var NodeFsHandler = class {
       if (dir.has(item)) {
         if (this.fsw._symlinkPaths.get(full) !== linkPath) {
           this.fsw._symlinkPaths.set(full, linkPath);
-          this.fsw._emit(EV.CHANGE, path26, entry.stats);
+          this.fsw._emit(EV.CHANGE, path27, entry.stats);
         }
       } else {
         dir.add(item);
         this.fsw._symlinkPaths.set(full, linkPath);
-        this.fsw._emit(EV.ADD, path26, entry.stats);
+        this.fsw._emit(EV.ADD, path27, entry.stats);
       }
       this.fsw._emitReady();
       return true;
@@ -186272,9 +186410,9 @@ var NodeFsHandler = class {
         return;
       }
       const item = entry.path;
-      let path26 = sp.join(directory, item);
+      let path27 = sp.join(directory, item);
       current.add(item);
-      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path26, item)) {
+      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path27, item)) {
         return;
       }
       if (this.fsw.closed) {
@@ -186283,8 +186421,8 @@ var NodeFsHandler = class {
       }
       if (item === target || !target && !previous.has(item)) {
         this.fsw._incrReadyCount();
-        path26 = sp.join(dir, sp.relative(dir, path26));
-        this._addToNodeFs(path26, initialAdd, wh, depth + 1);
+        path27 = sp.join(dir, sp.relative(dir, path27));
+        this._addToNodeFs(path27, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
     return new Promise((resolve10, reject) => {
@@ -186353,13 +186491,13 @@ var NodeFsHandler = class {
    * @param depth Child path actually targeted for watch
    * @param target Child path actually targeted for watch
    */
-  async _addToNodeFs(path26, initialAdd, priorWh, depth, target) {
+  async _addToNodeFs(path27, initialAdd, priorWh, depth, target) {
     const ready = this.fsw._emitReady;
-    if (this.fsw._isIgnored(path26) || this.fsw.closed) {
+    if (this.fsw._isIgnored(path27) || this.fsw.closed) {
       ready();
       return false;
     }
-    const wh = this.fsw._getWatchHelpers(path26);
+    const wh = this.fsw._getWatchHelpers(path27);
     if (priorWh) {
       wh.filterPath = (entry) => priorWh.filterPath(entry);
       wh.filterDir = (entry) => priorWh.filterDir(entry);
@@ -186375,8 +186513,8 @@ var NodeFsHandler = class {
       const follow = this.fsw.options.followSymlinks;
       let closer;
       if (stats.isDirectory()) {
-        const absPath = sp.resolve(path26);
-        const targetPath = follow ? await fsrealpath(path26) : path26;
+        const absPath = sp.resolve(path27);
+        const targetPath = follow ? await fsrealpath(path27) : path27;
         if (this.fsw.closed)
           return;
         closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
@@ -186386,29 +186524,29 @@ var NodeFsHandler = class {
           this.fsw._symlinkPaths.set(absPath, targetPath);
         }
       } else if (stats.isSymbolicLink()) {
-        const targetPath = follow ? await fsrealpath(path26) : path26;
+        const targetPath = follow ? await fsrealpath(path27) : path27;
         if (this.fsw.closed)
           return;
         const parent = sp.dirname(wh.watchPath);
         this.fsw._getWatchedDir(parent).add(wh.watchPath);
         this.fsw._emit(EV.ADD, wh.watchPath, stats);
-        closer = await this._handleDir(parent, stats, initialAdd, depth, path26, wh, targetPath);
+        closer = await this._handleDir(parent, stats, initialAdd, depth, path27, wh, targetPath);
         if (this.fsw.closed)
           return;
         if (targetPath !== void 0) {
-          this.fsw._symlinkPaths.set(sp.resolve(path26), targetPath);
+          this.fsw._symlinkPaths.set(sp.resolve(path27), targetPath);
         }
       } else {
         closer = this._handleFile(wh.watchPath, stats, initialAdd);
       }
       ready();
       if (closer)
-        this.fsw._addPathCloser(path26, closer);
+        this.fsw._addPathCloser(path27, closer);
       return false;
     } catch (error) {
       if (this.fsw._handleError(error)) {
         ready();
-        return path26;
+        return path27;
       }
     }
   }
@@ -186451,24 +186589,24 @@ function createPattern(matcher) {
   }
   return () => false;
 }
-function normalizePath(path26) {
-  if (typeof path26 !== "string")
+function normalizePath(path27) {
+  if (typeof path27 !== "string")
     throw new Error("string expected");
-  path26 = sp2.normalize(path26);
-  path26 = path26.replace(/\\/g, "/");
+  path27 = sp2.normalize(path27);
+  path27 = path27.replace(/\\/g, "/");
   let prepend = false;
-  if (path26.startsWith("//"))
+  if (path27.startsWith("//"))
     prepend = true;
-  path26 = path26.replace(DOUBLE_SLASH_RE, "/");
+  path27 = path27.replace(DOUBLE_SLASH_RE, "/");
   if (prepend)
-    path26 = "/" + path26;
-  return path26;
+    path27 = "/" + path27;
+  return path27;
 }
 function matchPatterns(patterns, testString, stats) {
-  const path26 = normalizePath(testString);
+  const path27 = normalizePath(testString);
   for (let index = 0; index < patterns.length; index++) {
     const pattern = patterns[index];
-    if (pattern(path26, stats)) {
+    if (pattern(path27, stats)) {
       return true;
     }
   }
@@ -186506,19 +186644,19 @@ var toUnix = (string) => {
   }
   return str;
 };
-var normalizePathToUnix = (path26) => toUnix(sp2.normalize(toUnix(path26)));
-var normalizeIgnored = (cwd = "") => (path26) => {
-  if (typeof path26 === "string") {
-    return normalizePathToUnix(sp2.isAbsolute(path26) ? path26 : sp2.join(cwd, path26));
+var normalizePathToUnix = (path27) => toUnix(sp2.normalize(toUnix(path27)));
+var normalizeIgnored = (cwd = "") => (path27) => {
+  if (typeof path27 === "string") {
+    return normalizePathToUnix(sp2.isAbsolute(path27) ? path27 : sp2.join(cwd, path27));
   } else {
-    return path26;
+    return path27;
   }
 };
-var getAbsolutePath = (path26, cwd) => {
-  if (sp2.isAbsolute(path26)) {
-    return path26;
+var getAbsolutePath = (path27, cwd) => {
+  if (sp2.isAbsolute(path27)) {
+    return path27;
   }
-  return sp2.join(cwd, path26);
+  return sp2.join(cwd, path27);
 };
 var EMPTY_SET = Object.freeze(/* @__PURE__ */ new Set());
 var DirEntry = class {
@@ -186583,10 +186721,10 @@ var WatchHelper = class {
   dirParts;
   followSymlinks;
   statMethod;
-  constructor(path26, follow, fsw) {
+  constructor(path27, follow, fsw) {
     this.fsw = fsw;
-    const watchPath = path26;
-    this.path = path26 = path26.replace(REPLACER_RE, "");
+    const watchPath = path27;
+    this.path = path27 = path27.replace(REPLACER_RE, "");
     this.watchPath = watchPath;
     this.fullWatchPath = sp2.resolve(watchPath);
     this.dirParts = [];
@@ -186726,20 +186864,20 @@ var FSWatcher = class extends EventEmitter {
     this._closePromise = void 0;
     let paths = unifyPaths(paths_);
     if (cwd) {
-      paths = paths.map((path26) => {
-        const absPath = getAbsolutePath(path26, cwd);
+      paths = paths.map((path27) => {
+        const absPath = getAbsolutePath(path27, cwd);
         return absPath;
       });
     }
-    paths.forEach((path26) => {
-      this._removeIgnoredPath(path26);
+    paths.forEach((path27) => {
+      this._removeIgnoredPath(path27);
     });
     this._userIgnored = void 0;
     if (!this._readyCount)
       this._readyCount = 0;
     this._readyCount += paths.length;
-    Promise.all(paths.map(async (path26) => {
-      const res = await this._nodeFsHandler._addToNodeFs(path26, !_internal, void 0, 0, _origAdd);
+    Promise.all(paths.map(async (path27) => {
+      const res = await this._nodeFsHandler._addToNodeFs(path27, !_internal, void 0, 0, _origAdd);
       if (res)
         this._emitReady();
       return res;
@@ -186761,17 +186899,17 @@ var FSWatcher = class extends EventEmitter {
       return this;
     const paths = unifyPaths(paths_);
     const { cwd } = this.options;
-    paths.forEach((path26) => {
-      if (!sp2.isAbsolute(path26) && !this._closers.has(path26)) {
+    paths.forEach((path27) => {
+      if (!sp2.isAbsolute(path27) && !this._closers.has(path27)) {
         if (cwd)
-          path26 = sp2.join(cwd, path26);
-        path26 = sp2.resolve(path26);
+          path27 = sp2.join(cwd, path27);
+        path27 = sp2.resolve(path27);
       }
-      this._closePath(path26);
-      this._addIgnoredPath(path26);
-      if (this._watched.has(path26)) {
+      this._closePath(path27);
+      this._addIgnoredPath(path27);
+      if (this._watched.has(path27)) {
         this._addIgnoredPath({
-          path: path26,
+          path: path27,
           recursive: true
         });
       }
@@ -186835,38 +186973,38 @@ var FSWatcher = class extends EventEmitter {
    * @param stats arguments to be passed with event
    * @returns the error if defined, otherwise the value of the FSWatcher instance's `closed` flag
    */
-  async _emit(event, path26, stats) {
+  async _emit(event, path27, stats) {
     if (this.closed)
       return;
     const opts = this.options;
     if (isWindows)
-      path26 = sp2.normalize(path26);
+      path27 = sp2.normalize(path27);
     if (opts.cwd)
-      path26 = sp2.relative(opts.cwd, path26);
-    const args = [path26];
+      path27 = sp2.relative(opts.cwd, path27);
+    const args = [path27];
     if (stats != null)
       args.push(stats);
     const awf = opts.awaitWriteFinish;
     let pw;
-    if (awf && (pw = this._pendingWrites.get(path26))) {
+    if (awf && (pw = this._pendingWrites.get(path27))) {
       pw.lastChange = /* @__PURE__ */ new Date();
       return this;
     }
     if (opts.atomic) {
       if (event === EVENTS.UNLINK) {
-        this._pendingUnlinks.set(path26, [event, ...args]);
+        this._pendingUnlinks.set(path27, [event, ...args]);
         setTimeout(() => {
-          this._pendingUnlinks.forEach((entry, path27) => {
+          this._pendingUnlinks.forEach((entry, path28) => {
             this.emit(...entry);
             this.emit(EVENTS.ALL, ...entry);
-            this._pendingUnlinks.delete(path27);
+            this._pendingUnlinks.delete(path28);
           });
         }, typeof opts.atomic === "number" ? opts.atomic : 100);
         return this;
       }
-      if (event === EVENTS.ADD && this._pendingUnlinks.has(path26)) {
+      if (event === EVENTS.ADD && this._pendingUnlinks.has(path27)) {
         event = EVENTS.CHANGE;
-        this._pendingUnlinks.delete(path26);
+        this._pendingUnlinks.delete(path27);
       }
     }
     if (awf && (event === EVENTS.ADD || event === EVENTS.CHANGE) && this._readyEmitted) {
@@ -186884,16 +187022,16 @@ var FSWatcher = class extends EventEmitter {
           this.emitWithAll(event, args);
         }
       };
-      this._awaitWriteFinish(path26, awf.stabilityThreshold, event, awfEmit);
+      this._awaitWriteFinish(path27, awf.stabilityThreshold, event, awfEmit);
       return this;
     }
     if (event === EVENTS.CHANGE) {
-      const isThrottled = !this._throttle(EVENTS.CHANGE, path26, 50);
+      const isThrottled = !this._throttle(EVENTS.CHANGE, path27, 50);
       if (isThrottled)
         return this;
     }
     if (opts.alwaysStat && stats === void 0 && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-      const fullPath = opts.cwd ? sp2.join(opts.cwd, path26) : path26;
+      const fullPath = opts.cwd ? sp2.join(opts.cwd, path27) : path27;
       let stats2;
       try {
         stats2 = await stat3(fullPath);
@@ -186924,23 +187062,23 @@ var FSWatcher = class extends EventEmitter {
    * @param timeout duration of time to suppress duplicate actions
    * @returns tracking object or false if action should be suppressed
    */
-  _throttle(actionType, path26, timeout) {
+  _throttle(actionType, path27, timeout) {
     if (!this._throttled.has(actionType)) {
       this._throttled.set(actionType, /* @__PURE__ */ new Map());
     }
     const action = this._throttled.get(actionType);
     if (!action)
       throw new Error("invalid throttle");
-    const actionPath = action.get(path26);
+    const actionPath = action.get(path27);
     if (actionPath) {
       actionPath.count++;
       return false;
     }
     let timeoutObject;
     const clear = () => {
-      const item = action.get(path26);
+      const item = action.get(path27);
       const count = item ? item.count : 0;
-      action.delete(path26);
+      action.delete(path27);
       clearTimeout(timeoutObject);
       if (item)
         clearTimeout(item.timeoutObject);
@@ -186948,7 +187086,7 @@ var FSWatcher = class extends EventEmitter {
     };
     timeoutObject = setTimeout(clear, timeout);
     const thr = { timeoutObject, clear, count: 0 };
-    action.set(path26, thr);
+    action.set(path27, thr);
     return thr;
   }
   _incrReadyCount() {
@@ -186962,44 +187100,44 @@ var FSWatcher = class extends EventEmitter {
    * @param event
    * @param awfEmit Callback to be called when ready for event to be emitted.
    */
-  _awaitWriteFinish(path26, threshold, event, awfEmit) {
+  _awaitWriteFinish(path27, threshold, event, awfEmit) {
     const awf = this.options.awaitWriteFinish;
     if (typeof awf !== "object")
       return;
     const pollInterval = awf.pollInterval;
     let timeoutHandler;
-    let fullPath = path26;
-    if (this.options.cwd && !sp2.isAbsolute(path26)) {
-      fullPath = sp2.join(this.options.cwd, path26);
+    let fullPath = path27;
+    if (this.options.cwd && !sp2.isAbsolute(path27)) {
+      fullPath = sp2.join(this.options.cwd, path27);
     }
     const now = /* @__PURE__ */ new Date();
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
       statcb(fullPath, (err, curStat) => {
-        if (err || !writes.has(path26)) {
+        if (err || !writes.has(path27)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
           return;
         }
         const now2 = Number(/* @__PURE__ */ new Date());
         if (prevStat && curStat.size !== prevStat.size) {
-          writes.get(path26).lastChange = now2;
+          writes.get(path27).lastChange = now2;
         }
-        const pw = writes.get(path26);
+        const pw = writes.get(path27);
         const df = now2 - pw.lastChange;
         if (df >= threshold) {
-          writes.delete(path26);
+          writes.delete(path27);
           awfEmit(void 0, curStat);
         } else {
           timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval, curStat);
         }
       });
     }
-    if (!writes.has(path26)) {
-      writes.set(path26, {
+    if (!writes.has(path27)) {
+      writes.set(path27, {
         lastChange: now,
         cancelWait: () => {
-          writes.delete(path26);
+          writes.delete(path27);
           clearTimeout(timeoutHandler);
           return event;
         }
@@ -187010,8 +187148,8 @@ var FSWatcher = class extends EventEmitter {
   /**
    * Determines whether user has asked to ignore this path.
    */
-  _isIgnored(path26, stats) {
-    if (this.options.atomic && DOT_RE.test(path26))
+  _isIgnored(path27, stats) {
+    if (this.options.atomic && DOT_RE.test(path27))
       return true;
     if (!this._userIgnored) {
       const { cwd } = this.options;
@@ -187021,17 +187159,17 @@ var FSWatcher = class extends EventEmitter {
       const list = [...ignoredPaths.map(normalizeIgnored(cwd)), ...ignored];
       this._userIgnored = anymatch(list, void 0);
     }
-    return this._userIgnored(path26, stats);
+    return this._userIgnored(path27, stats);
   }
-  _isntIgnored(path26, stat4) {
-    return !this._isIgnored(path26, stat4);
+  _isntIgnored(path27, stat4) {
+    return !this._isIgnored(path27, stat4);
   }
   /**
    * Provides a set of common helpers and properties relating to symlink handling.
    * @param path file or directory pattern being watched
    */
-  _getWatchHelpers(path26) {
-    return new WatchHelper(path26, this.options.followSymlinks, this);
+  _getWatchHelpers(path27) {
+    return new WatchHelper(path27, this.options.followSymlinks, this);
   }
   // Directory helpers
   // -----------------
@@ -187063,63 +187201,63 @@ var FSWatcher = class extends EventEmitter {
    * @param item      base path of item/directory
    */
   _remove(directory, item, isDirectory) {
-    const path26 = sp2.join(directory, item);
-    const fullPath = sp2.resolve(path26);
-    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path26) || this._watched.has(fullPath);
-    if (!this._throttle("remove", path26, 100))
+    const path27 = sp2.join(directory, item);
+    const fullPath = sp2.resolve(path27);
+    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path27) || this._watched.has(fullPath);
+    if (!this._throttle("remove", path27, 100))
       return;
     if (!isDirectory && this._watched.size === 1) {
       this.add(directory, item, true);
     }
-    const wp = this._getWatchedDir(path26);
+    const wp = this._getWatchedDir(path27);
     const nestedDirectoryChildren = wp.getChildren();
-    nestedDirectoryChildren.forEach((nested) => this._remove(path26, nested));
+    nestedDirectoryChildren.forEach((nested) => this._remove(path27, nested));
     const parent = this._getWatchedDir(directory);
     const wasTracked = parent.has(item);
     parent.remove(item);
     if (this._symlinkPaths.has(fullPath)) {
       this._symlinkPaths.delete(fullPath);
     }
-    let relPath = path26;
+    let relPath = path27;
     if (this.options.cwd)
-      relPath = sp2.relative(this.options.cwd, path26);
+      relPath = sp2.relative(this.options.cwd, path27);
     if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
       const event = this._pendingWrites.get(relPath).cancelWait();
       if (event === EVENTS.ADD)
         return;
     }
-    this._watched.delete(path26);
+    this._watched.delete(path27);
     this._watched.delete(fullPath);
     const eventName = isDirectory ? EVENTS.UNLINK_DIR : EVENTS.UNLINK;
-    if (wasTracked && !this._isIgnored(path26))
-      this._emit(eventName, path26);
-    this._closePath(path26);
+    if (wasTracked && !this._isIgnored(path27))
+      this._emit(eventName, path27);
+    this._closePath(path27);
   }
   /**
    * Closes all watchers for a path
    */
-  _closePath(path26) {
-    this._closeFile(path26);
-    const dir = sp2.dirname(path26);
-    this._getWatchedDir(dir).remove(sp2.basename(path26));
+  _closePath(path27) {
+    this._closeFile(path27);
+    const dir = sp2.dirname(path27);
+    this._getWatchedDir(dir).remove(sp2.basename(path27));
   }
   /**
    * Closes only file-specific watchers
    */
-  _closeFile(path26) {
-    const closers = this._closers.get(path26);
+  _closeFile(path27) {
+    const closers = this._closers.get(path27);
     if (!closers)
       return;
     closers.forEach((closer) => closer());
-    this._closers.delete(path26);
+    this._closers.delete(path27);
   }
-  _addPathCloser(path26, closer) {
+  _addPathCloser(path27, closer) {
     if (!closer)
       return;
-    let list = this._closers.get(path26);
+    let list = this._closers.get(path27);
     if (!list) {
       list = [];
-      this._closers.set(path26, list);
+      this._closers.set(path27, list);
     }
     list.push(closer);
   }
@@ -187168,8 +187306,8 @@ var PortAllocator = class {
 };
 
 // src/lib/dev/stable-port-allocator.ts
-import * as fs13 from "fs";
-import * as path9 from "path";
+import * as fs14 from "fs";
+import * as path10 from "path";
 var PORT_RANGE_START2 = 4e4;
 var PORT_RANGE_END2 = 49999;
 var StablePortAllocator = class {
@@ -187178,16 +187316,16 @@ var StablePortAllocator = class {
   savedPorts = {};
   usedPorts = /* @__PURE__ */ new Set();
   constructor(projectRoot, key = "default") {
-    this.portsDir = path9.join(projectRoot, ".specific", "keys", key);
-    this.portsFilePath = path9.join(this.portsDir, "ports.json");
+    this.portsDir = path10.join(projectRoot, ".specific", "keys", key);
+    this.portsFilePath = path10.join(this.portsDir, "ports.json");
     this.loadPorts();
   }
   loadPorts() {
-    if (!fs13.existsSync(this.portsFilePath)) {
+    if (!fs14.existsSync(this.portsFilePath)) {
       return;
     }
     try {
-      const content = fs13.readFileSync(this.portsFilePath, "utf-8");
+      const content = fs14.readFileSync(this.portsFilePath, "utf-8");
       const data = JSON.parse(content);
       if (data.version === 1 && data.ports) {
         this.savedPorts = data.ports;
@@ -187200,14 +187338,14 @@ var StablePortAllocator = class {
     }
   }
   savePorts() {
-    if (!fs13.existsSync(this.portsDir)) {
-      fs13.mkdirSync(this.portsDir, { recursive: true });
+    if (!fs14.existsSync(this.portsDir)) {
+      fs14.mkdirSync(this.portsDir, { recursive: true });
     }
     const data = {
       version: 1,
       ports: this.savedPorts
     };
-    fs13.writeFileSync(this.portsFilePath, JSON.stringify(data, null, 2));
+    fs14.writeFileSync(this.portsFilePath, JSON.stringify(data, null, 2));
   }
   allocateRandom() {
     const rangeSize = PORT_RANGE_END2 - PORT_RANGE_START2 + 1;
@@ -187234,21 +187372,21 @@ var StablePortAllocator = class {
 };
 
 // src/lib/dev/database-manager.ts
-import * as fs14 from "fs";
-import * as path10 from "path";
+import * as fs15 from "fs";
+import * as path11 from "path";
 import * as net from "net";
 import { spawn } from "child_process";
 async function startPostgres(pg, port, dataDir, onProgress) {
   const binary = await ensureBinary(postgresBinary, void 0, onProgress);
-  const dbDataPath = path10.join(process.cwd(), dataDir, pg.name);
+  const dbDataPath = path11.join(process.cwd(), dataDir, pg.name);
   const host = "127.0.0.1";
   const user = "postgres";
   const password = "postgres";
   const libraryEnv = getLibraryEnv(binary);
   const env2 = { ...process.env, ...libraryEnv };
-  const dataExists = fs14.existsSync(dbDataPath);
+  const dataExists = fs15.existsSync(dbDataPath);
   if (!dataExists) {
-    fs14.mkdirSync(dbDataPath, { recursive: true });
+    fs15.mkdirSync(dbDataPath, { recursive: true });
     await runCommand(
       binary.executables["initdb"],
       ["-D", dbDataPath, "-U", user, "--auth=trust", "--no-locale", "-E", "UTF8"],
@@ -187324,9 +187462,9 @@ async function startRedis(redis, port, onProgress) {
 }
 async function startStorage(storage, port, dataDir) {
   const S3rver = (await import("s3rver")).default;
-  const storageDataPath = path10.join(process.cwd(), dataDir, storage.name);
-  if (!fs14.existsSync(storageDataPath)) {
-    fs14.mkdirSync(storageDataPath, { recursive: true });
+  const storageDataPath = path11.join(process.cwd(), dataDir, storage.name);
+  if (!fs15.existsSync(storageDataPath)) {
+    fs15.mkdirSync(storageDataPath, { recursive: true });
   }
   const host = "127.0.0.1";
   const accessKey = "S3RVER";
@@ -187460,7 +187598,7 @@ import { spawn as spawn2 } from "child_process";
 // src/lib/local/parser.ts
 var import_hcl2_json_parser2 = __toESM(require_dist(), 1);
 import { readFile, writeFile } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 var { parseToObject: parseToObject2 } = import_hcl2_json_parser2.default;
 var LOCAL_FILE = "specific.local";
 var HEADER_COMMENT = `# Local secrets and configuration
@@ -187501,7 +187639,7 @@ async function parseLocalFile(content) {
   return { secrets, configs };
 }
 async function loadLocal() {
-  if (!existsSync11(LOCAL_FILE)) {
+  if (!existsSync12(LOCAL_FILE)) {
     return { secrets: /* @__PURE__ */ new Map(), configs: /* @__PURE__ */ new Map() };
   }
   const content = await readFile(LOCAL_FILE, "utf-8");
@@ -187541,7 +187679,7 @@ ${newLine}
 }
 async function saveLocalSecret(name, value) {
   let content = "";
-  if (existsSync11(LOCAL_FILE)) {
+  if (existsSync12(LOCAL_FILE)) {
     content = await readFile(LOCAL_FILE, "utf-8");
   } else {
     content = HEADER_COMMENT;
@@ -187551,7 +187689,7 @@ async function saveLocalSecret(name, value) {
 }
 async function saveLocalConfig(name, value) {
   let content = "";
-  if (existsSync11(LOCAL_FILE)) {
+  if (existsSync12(LOCAL_FILE)) {
     content = await readFile(LOCAL_FILE, "utf-8");
   } else {
     content = HEADER_COMMENT;
@@ -187915,8 +188053,8 @@ function startService(service, resources, secrets, configs, endpointPorts, servi
 }
 
 // src/lib/dev/instance-state.ts
-import * as fs15 from "fs";
-import * as path11 from "path";
+import * as fs16 from "fs";
+import * as path12 from "path";
 var InstanceStateManager = class {
   stateDir;
   statePath;
@@ -187925,16 +188063,16 @@ var InstanceStateManager = class {
   key;
   constructor(projectRoot, key = "default") {
     this.key = key;
-    this.stateDir = path11.join(projectRoot, ".specific", "keys", key);
-    this.statePath = path11.join(this.stateDir, "state.json");
-    this.lockPath = path11.join(this.stateDir, "state.lock");
+    this.stateDir = path12.join(projectRoot, ".specific", "keys", key);
+    this.statePath = path12.join(this.stateDir, "state.json");
+    this.lockPath = path12.join(this.stateDir, "state.lock");
   }
   getKey() {
     return this.key;
   }
   ensureStateDir() {
-    if (!fs15.existsSync(this.stateDir)) {
-      fs15.mkdirSync(this.stateDir, { recursive: true });
+    if (!fs16.existsSync(this.stateDir)) {
+      fs16.mkdirSync(this.stateDir, { recursive: true });
     }
   }
   isProcessRunning(pid) {
@@ -187951,15 +188089,15 @@ var InstanceStateManager = class {
     const startTime = Date.now();
     while (Date.now() - startTime < timeoutMs) {
       try {
-        const fd = fs15.openSync(
+        const fd = fs16.openSync(
           this.lockPath,
-          fs15.constants.O_CREAT | fs15.constants.O_EXCL | fs15.constants.O_WRONLY
+          fs16.constants.O_CREAT | fs16.constants.O_EXCL | fs16.constants.O_WRONLY
         );
-        fs15.writeSync(fd, String(process.pid));
-        fs15.closeSync(fd);
+        fs16.writeSync(fd, String(process.pid));
+        fs16.closeSync(fd);
         return () => {
           try {
-            fs15.unlinkSync(this.lockPath);
+            fs16.unlinkSync(this.lockPath);
           } catch {
           }
         };
@@ -187968,16 +188106,16 @@ var InstanceStateManager = class {
         if (err.code === "EEXIST") {
           try {
             const lockPid = parseInt(
-              fs15.readFileSync(this.lockPath, "utf-8").trim(),
+              fs16.readFileSync(this.lockPath, "utf-8").trim(),
               10
             );
             if (!this.isProcessRunning(lockPid)) {
-              fs15.unlinkSync(this.lockPath);
+              fs16.unlinkSync(this.lockPath);
               continue;
             }
           } catch {
             try {
-              fs15.unlinkSync(this.lockPath);
+              fs16.unlinkSync(this.lockPath);
             } catch {
             }
             continue;
@@ -187991,12 +188129,12 @@ var InstanceStateManager = class {
     throw new Error("Failed to acquire state lock (timeout)");
   }
   async getExistingInstances() {
-    if (!fs15.existsSync(this.statePath)) {
+    if (!fs16.existsSync(this.statePath)) {
       return null;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs15.readFileSync(this.statePath, "utf-8");
+      const content = fs16.readFileSync(this.statePath, "utf-8");
       const state = JSON.parse(content);
       if (!this.isProcessRunning(state.owner.pid)) {
         return null;
@@ -188009,21 +188147,21 @@ var InstanceStateManager = class {
     }
   }
   async cleanStaleState() {
-    if (!fs15.existsSync(this.statePath)) {
+    if (!fs16.existsSync(this.statePath)) {
       return false;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs15.readFileSync(this.statePath, "utf-8");
+      const content = fs16.readFileSync(this.statePath, "utf-8");
       const state = JSON.parse(content);
       if (!this.isProcessRunning(state.owner.pid)) {
-        fs15.unlinkSync(this.statePath);
+        fs16.unlinkSync(this.statePath);
         return true;
       }
       return false;
     } catch {
       try {
-        fs15.unlinkSync(this.statePath);
+        fs16.unlinkSync(this.statePath);
         return true;
       } catch {
       }
@@ -188035,8 +188173,8 @@ var InstanceStateManager = class {
   async claimOwnership(command) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs15.existsSync(this.statePath)) {
-        const content = fs15.readFileSync(this.statePath, "utf-8");
+      if (fs16.existsSync(this.statePath)) {
+        const content = fs16.readFileSync(this.statePath, "utf-8");
         const state2 = JSON.parse(content);
         if (this.isProcessRunning(state2.owner.pid)) {
           throw new Error(`Instances already owned by PID ${state2.owner.pid}`);
@@ -188105,8 +188243,8 @@ var InstanceStateManager = class {
     }
     const releaseLock = await this.acquireLock();
     try {
-      if (fs15.existsSync(this.statePath)) {
-        fs15.unlinkSync(this.statePath);
+      if (fs16.existsSync(this.statePath)) {
+        fs16.unlinkSync(this.statePath);
       }
       this.ownsInstances = false;
     } finally {
@@ -188114,26 +188252,26 @@ var InstanceStateManager = class {
     }
   }
   readState() {
-    const content = fs15.readFileSync(this.statePath, "utf-8");
+    const content = fs16.readFileSync(this.statePath, "utf-8");
     return JSON.parse(content);
   }
   writeStateAtomic(state) {
     this.ensureStateDir();
     const tmpPath = this.statePath + ".tmp";
-    fs15.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs15.renameSync(tmpPath, this.statePath);
+    fs16.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs16.renameSync(tmpPath, this.statePath);
   }
 };
 
 // src/lib/dev/http-proxy.ts
 import * as http from "http";
 import * as https from "https";
-import * as fs16 from "fs";
-import * as path12 from "path";
+import * as fs17 from "fs";
+import * as path13 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import httpProxy from "http-proxy";
-var __dirname3 = path12.dirname(fileURLToPath3(import.meta.url));
-var adminDir = path12.join(__dirname3, "admin");
+var __dirname3 = path13.dirname(fileURLToPath3(import.meta.url));
+var adminDir = path13.join(__dirname3, "admin");
 var HTTP_PORT = 80;
 var HTTPS_PORT = 443;
 var DOMAIN_SUFFIX = ".local.spcf.app";
@@ -188419,18 +188557,18 @@ function serveStaticFile(res, pathname) {
     filePath = filePath + "index.html";
   }
   const relativePath = filePath.startsWith("/") ? filePath.slice(1) : filePath;
-  const fullPath = path12.join(adminDir, relativePath);
-  const resolvedPath = path12.resolve(fullPath);
-  const resolvedAdminDir = path12.resolve(adminDir);
+  const fullPath = path13.join(adminDir, relativePath);
+  const resolvedPath = path13.resolve(fullPath);
+  const resolvedAdminDir = path13.resolve(adminDir);
   if (!resolvedPath.startsWith(resolvedAdminDir)) {
     res.writeHead(403, { "Content-Type": "text/html" });
     res.end("<h1>Forbidden</h1>");
     return;
   }
-  if (fs16.existsSync(resolvedPath)) {
-    if (fs16.statSync(resolvedPath).isDirectory()) {
-      const indexPath2 = path12.join(resolvedPath, "index.html");
-      if (fs16.existsSync(indexPath2)) {
+  if (fs17.existsSync(resolvedPath)) {
+    if (fs17.statSync(resolvedPath).isDirectory()) {
+      const indexPath2 = path13.join(resolvedPath, "index.html");
+      if (fs17.existsSync(indexPath2)) {
         return serveFile(res, indexPath2);
       }
     } else {
@@ -188438,28 +188576,28 @@ function serveStaticFile(res, pathname) {
     }
   }
   const htmlPath = resolvedPath + ".html";
-  if (fs16.existsSync(htmlPath)) {
+  if (fs17.existsSync(htmlPath)) {
     return serveFile(res, htmlPath);
   }
-  const indexPath = path12.join(resolvedPath, "index.html");
-  if (fs16.existsSync(indexPath)) {
+  const indexPath = path13.join(resolvedPath, "index.html");
+  if (fs17.existsSync(indexPath)) {
     return serveFile(res, indexPath);
   }
-  const notFoundPath = path12.join(adminDir, "404.html");
-  if (fs16.existsSync(notFoundPath)) {
+  const notFoundPath = path13.join(adminDir, "404.html");
+  if (fs17.existsSync(notFoundPath)) {
     return serveFileContent(res, notFoundPath, "text/html", 404);
   }
   res.writeHead(404, { "Content-Type": "text/html" });
   res.end("<h1>Not Found</h1>");
 }
 function serveFile(res, filePath) {
-  const ext = path12.extname(filePath).toLowerCase();
+  const ext = path13.extname(filePath).toLowerCase();
   const contentType = MIME_TYPES[ext] || "application/octet-stream";
   serveFileContent(res, filePath, contentType, 200);
 }
 function serveFileContent(res, filePath, contentType, statusCode = 200) {
   try {
-    const content = fs16.readFileSync(filePath);
+    const content = fs17.readFileSync(filePath);
     res.writeHead(statusCode, { "Content-Type": contentType });
     res.end(content);
   } catch (err) {
@@ -188519,8 +188657,8 @@ import { spawn as spawn3 } from "child_process";
 
 // src/lib/secrets/parser.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir } from "fs/promises";
-import { existsSync as existsSync14 } from "fs";
-import * as path13 from "path";
+import { existsSync as existsSync15 } from "fs";
+import * as path14 from "path";
 import * as crypto2 from "crypto";
 var GENERATED_SECRETS_FILE = ".specific/generated-secrets.json";
 async function loadSecrets() {
@@ -188537,7 +188675,7 @@ function generateRandomString(length = 64) {
   return result;
 }
 async function loadGeneratedSecrets() {
-  if (!existsSync14(GENERATED_SECRETS_FILE)) {
+  if (!existsSync15(GENERATED_SECRETS_FILE)) {
     return /* @__PURE__ */ new Map();
   }
   const content = await readFile2(GENERATED_SECRETS_FILE, "utf-8");
@@ -188546,13 +188684,13 @@ async function loadGeneratedSecrets() {
 }
 async function saveGeneratedSecret(name, value) {
   let secrets = {};
-  if (existsSync14(GENERATED_SECRETS_FILE)) {
+  if (existsSync15(GENERATED_SECRETS_FILE)) {
     const content = await readFile2(GENERATED_SECRETS_FILE, "utf-8");
     secrets = JSON.parse(content);
   }
   secrets[name] = value;
-  const dir = path13.dirname(GENERATED_SECRETS_FILE);
-  if (!existsSync14(dir)) {
+  const dir = path14.dirname(GENERATED_SECRETS_FILE);
+  if (!existsSync15(dir)) {
     await mkdir(dir, { recursive: true });
   }
   await writeFile2(GENERATED_SECRETS_FILE, JSON.stringify(secrets, null, 2) + "\n");
@@ -188706,8 +188844,8 @@ function sleep3(ms) {
 
 // src/lib/dev/drizzle-gateway-manager.ts
 import * as net3 from "net";
-import * as fs17 from "fs";
-import * as path14 from "path";
+import * as fs18 from "fs";
+import * as path15 from "path";
 import { spawn as spawn4 } from "child_process";
 import { randomUUID } from "crypto";
 function generateStoreJson(postgresInstances) {
@@ -188739,13 +188877,13 @@ async function startDrizzleGateway(postgresInstances, port, configDir, options2)
     options2?.onProgress
   );
   const host = "127.0.0.1";
-  const drizzleConfigDir = path14.join(configDir, "drizzle-gateway");
-  if (!fs17.existsSync(drizzleConfigDir)) {
-    fs17.mkdirSync(drizzleConfigDir, { recursive: true });
+  const drizzleConfigDir = path15.join(configDir, "drizzle-gateway");
+  if (!fs18.existsSync(drizzleConfigDir)) {
+    fs18.mkdirSync(drizzleConfigDir, { recursive: true });
   }
   const storeJson = generateStoreJson(postgresInstances);
-  const storeJsonPath = path14.join(drizzleConfigDir, "store.json");
-  fs17.writeFileSync(storeJsonPath, JSON.stringify(storeJson, null, 2));
+  const storeJsonPath = path15.join(drizzleConfigDir, "store.json");
+  fs18.writeFileSync(storeJsonPath, JSON.stringify(storeJson, null, 2));
   writeLog("drizzle-gateway", `Starting Drizzle Gateway`);
   writeLog("drizzle-gateway", `STORE_PATH: ${drizzleConfigDir}`);
   writeLog("drizzle-gateway", `PORT: ${port}`);
@@ -188847,16 +188985,16 @@ function detectSyncDatabases(config) {
 }
 
 // src/lib/dev/reshape-watcher.ts
-import * as fs18 from "fs";
-import * as path15 from "path";
+import * as fs19 from "fs";
+import * as path16 from "path";
 import { spawnSync } from "child_process";
 function getMigrationFiles(dir, log) {
   log(`Scanning migrations directory: ${dir}`);
-  if (!fs18.existsSync(dir)) {
+  if (!fs19.existsSync(dir)) {
     log(`Migrations directory does not exist: ${dir}`);
     return [];
   }
-  const files = fs18.readdirSync(dir);
+  const files = fs19.readdirSync(dir);
   log(`Found ${files.length} files in directory`);
   const tomlFiles = files.filter((f) => f.endsWith(".toml")).sort((a, b) => a.localeCompare(b));
   log(`Found ${tomlFiles.length} .toml migration files: ${tomlFiles.join(", ") || "(none)"}`);
@@ -188906,7 +189044,7 @@ function runReshape(args, databaseUrl, migrationsDir, reshapeBinaryPath, log) {
 }
 function makeReadOnly(filePath, log) {
   try {
-    fs18.chmodSync(filePath, 292);
+    fs19.chmodSync(filePath, 292);
     log(`Set file permissions to read-only (444): ${filePath}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -188967,7 +189105,7 @@ function createReshapeWatcher(options2) {
       log(`Successfully completed ${currentMigrationFiles.length - 1} migration(s)`);
       log(`Making completed migration files read-only...`);
       for (let i = 0; i < currentMigrationFiles.length - 1; i++) {
-        const filePath = path15.join(migrationsDir, currentMigrationFiles[i]);
+        const filePath = path16.join(migrationsDir, currentMigrationFiles[i]);
         makeReadOnly(filePath, log);
       }
       log(`Starting latest migration "${lastMigrationName}" (will not be completed, allowing iteration)`);
@@ -188992,9 +189130,9 @@ function createReshapeWatcher(options2) {
   };
   const startWatching = () => {
     log(`Starting file watcher for migrations directory...`);
-    if (!fs18.existsSync(migrationsDir)) {
+    if (!fs19.existsSync(migrationsDir)) {
       log(`Migrations directory does not exist, creating: ${migrationsDir}`);
-      fs18.mkdirSync(migrationsDir, { recursive: true });
+      fs19.mkdirSync(migrationsDir, { recursive: true });
     }
     log(`Watching directory: ${migrationsDir}`);
     watcher = chokidar_default.watch(migrationsDir, {
@@ -189007,7 +189145,7 @@ function createReshapeWatcher(options2) {
       }
     });
     watcher.on("change", (filePath) => {
-      const filename = path15.basename(filePath);
+      const filename = path16.basename(filePath);
       if (!filename.endsWith(".toml")) return;
       log(`File change detected: ${filename}`);
       log(`  Full path: ${filePath}`);
@@ -189038,7 +189176,7 @@ function createReshapeWatcher(options2) {
       }
     });
     watcher.on("add", (filePath) => {
-      const filename = path15.basename(filePath);
+      const filename = path16.basename(filePath);
       if (!filename.endsWith(".toml")) return;
       log(`New file detected: ${filename}`);
       log(`  Full path: ${filePath}`);
@@ -189062,7 +189200,7 @@ function createReshapeWatcher(options2) {
           return;
         }
         log(`Previous migration completed successfully`);
-        const completedPath = path15.join(migrationsDir, startedMigration);
+        const completedPath = path16.join(migrationsDir, startedMigration);
         makeReadOnly(completedPath, log);
       } else {
         log(`No previous migration was started`);
@@ -189087,7 +189225,7 @@ function createReshapeWatcher(options2) {
       onSearchPathChanged(newSearchPath);
     });
     watcher.on("unlink", (filePath) => {
-      const filename = path15.basename(filePath);
+      const filename = path16.basename(filePath);
       if (!filename.endsWith(".toml")) return;
       log(`File deleted: ${filename}`);
       log(`  Full path: ${filePath}`);
@@ -189311,24 +189449,24 @@ function watchConfigFile(configPath, debounceMs, onChange) {
 }
 
 // src/lib/dev/subdomain-generator.ts
-import * as fs19 from "fs";
-import * as path16 from "path";
+import * as fs20 from "fs";
+import * as path17 from "path";
 import { generateSlug } from "random-word-slugs";
 var StableSubdomainAllocator = class {
   tunnelsDir;
   tunnelsFilePath;
   baseSlug = null;
   constructor(projectRoot, key = "default") {
-    this.tunnelsDir = path16.join(projectRoot, ".specific", "keys", key);
-    this.tunnelsFilePath = path16.join(this.tunnelsDir, "tunnels.json");
+    this.tunnelsDir = path17.join(projectRoot, ".specific", "keys", key);
+    this.tunnelsFilePath = path17.join(this.tunnelsDir, "tunnels.json");
     this.loadTunnels();
   }
   loadTunnels() {
-    if (!fs19.existsSync(this.tunnelsFilePath)) {
+    if (!fs20.existsSync(this.tunnelsFilePath)) {
       return;
     }
     try {
-      const content = fs19.readFileSync(this.tunnelsFilePath, "utf-8");
+      const content = fs20.readFileSync(this.tunnelsFilePath, "utf-8");
       const data = JSON.parse(content);
       if (data.version === 1 && data.baseSlug) {
         this.baseSlug = data.baseSlug;
@@ -189338,14 +189476,14 @@ var StableSubdomainAllocator = class {
     }
   }
   saveTunnels() {
-    if (!fs19.existsSync(this.tunnelsDir)) {
-      fs19.mkdirSync(this.tunnelsDir, { recursive: true });
+    if (!fs20.existsSync(this.tunnelsDir)) {
+      fs20.mkdirSync(this.tunnelsDir, { recursive: true });
     }
     const data = {
       version: 1,
       baseSlug: this.baseSlug
     };
-    fs19.writeFileSync(this.tunnelsFilePath, JSON.stringify(data, null, 2));
+    fs20.writeFileSync(this.tunnelsFilePath, JSON.stringify(data, null, 2));
   }
   generateBaseSlug() {
     return generateSlug(2, {
@@ -189501,9 +189639,9 @@ async function startTunnel(serviceName, endpointName, port, subdomain, callbacks
 }
 
 // src/lib/dev/proxy-registry.ts
-import * as fs20 from "fs";
-import * as path17 from "path";
-import * as os7 from "os";
+import * as fs21 from "fs";
+import * as path18 from "path";
+import * as os8 from "os";
 import * as net5 from "net";
 var ProxyRegistryManager = class {
   proxyDir;
@@ -189513,14 +189651,14 @@ var ProxyRegistryManager = class {
   isOwner = false;
   registryWatcher = null;
   constructor() {
-    this.proxyDir = path17.join(os7.homedir(), ".specific", "proxy");
-    this.ownerPath = path17.join(this.proxyDir, "owner.json");
-    this.registryPath = path17.join(this.proxyDir, "registry.json");
-    this.lockPath = path17.join(this.proxyDir, "registry.lock");
+    this.proxyDir = path18.join(os8.homedir(), ".specific", "proxy");
+    this.ownerPath = path18.join(this.proxyDir, "owner.json");
+    this.registryPath = path18.join(this.proxyDir, "registry.json");
+    this.lockPath = path18.join(this.proxyDir, "registry.lock");
   }
   ensureProxyDir() {
-    if (!fs20.existsSync(this.proxyDir)) {
-      fs20.mkdirSync(this.proxyDir, { recursive: true });
+    if (!fs21.existsSync(this.proxyDir)) {
+      fs21.mkdirSync(this.proxyDir, { recursive: true });
     }
   }
   isProcessRunning(pid) {
@@ -189577,15 +189715,15 @@ var ProxyRegistryManager = class {
     const startTime = Date.now();
     while (Date.now() - startTime < timeoutMs) {
       try {
-        const fd = fs20.openSync(
+        const fd = fs21.openSync(
           this.lockPath,
-          fs20.constants.O_CREAT | fs20.constants.O_EXCL | fs20.constants.O_WRONLY
+          fs21.constants.O_CREAT | fs21.constants.O_EXCL | fs21.constants.O_WRONLY
         );
-        fs20.writeSync(fd, String(process.pid));
-        fs20.closeSync(fd);
+        fs21.writeSync(fd, String(process.pid));
+        fs21.closeSync(fd);
         return () => {
           try {
-            fs20.unlinkSync(this.lockPath);
+            fs21.unlinkSync(this.lockPath);
           } catch {
           }
         };
@@ -189594,16 +189732,16 @@ var ProxyRegistryManager = class {
         if (err.code === "EEXIST") {
           try {
             const lockPid = parseInt(
-              fs20.readFileSync(this.lockPath, "utf-8").trim(),
+              fs21.readFileSync(this.lockPath, "utf-8").trim(),
               10
             );
             if (!this.isProcessRunning(lockPid)) {
-              fs20.unlinkSync(this.lockPath);
+              fs21.unlinkSync(this.lockPath);
               continue;
             }
           } catch {
             try {
-              fs20.unlinkSync(this.lockPath);
+              fs21.unlinkSync(this.lockPath);
             } catch {
             }
             continue;
@@ -189623,8 +189761,8 @@ var ProxyRegistryManager = class {
   async claimProxyOwnership(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs20.existsSync(this.ownerPath)) {
-        const content = fs20.readFileSync(this.ownerPath, "utf-8");
+      if (fs21.existsSync(this.ownerPath)) {
+        const content = fs21.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
@@ -189654,11 +189792,11 @@ var ProxyRegistryManager = class {
     }
     const releaseLock = await this.acquireLock();
     try {
-      if (fs20.existsSync(this.ownerPath)) {
-        const content = fs20.readFileSync(this.ownerPath, "utf-8");
+      if (fs21.existsSync(this.ownerPath)) {
+        const content = fs21.readFileSync(this.ownerPath, "utf-8");
         const ownerFile = JSON.parse(content);
         if (ownerFile.owner.pid === process.pid) {
-          fs20.unlinkSync(this.ownerPath);
+          fs21.unlinkSync(this.ownerPath);
         }
       }
       this.isOwner = false;
@@ -189670,12 +189808,12 @@ var ProxyRegistryManager = class {
    * Get the current proxy owner.
    */
   async getProxyOwner() {
-    if (!fs20.existsSync(this.ownerPath)) {
+    if (!fs21.existsSync(this.ownerPath)) {
       return null;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs20.readFileSync(this.ownerPath, "utf-8");
+      const content = fs21.readFileSync(this.ownerPath, "utf-8");
       const ownerFile = JSON.parse(content);
       if (!await this.isProxyOwnerHealthy(ownerFile.owner.pid)) {
         return null;
@@ -189769,7 +189907,7 @@ var ProxyRegistryManager = class {
    */
   watchRegistry(onChange) {
     this.ensureProxyDir();
-    if (!fs20.existsSync(this.registryPath)) {
+    if (!fs21.existsSync(this.registryPath)) {
       const emptyRegistry = {
         version: 1,
         keys: {},
@@ -189812,13 +189950,13 @@ var ProxyRegistryManager = class {
   async attemptElection(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs20.existsSync(this.ownerPath)) {
-        const content = fs20.readFileSync(this.ownerPath, "utf-8");
+      if (fs21.existsSync(this.ownerPath)) {
+        const content = fs21.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
         }
-        fs20.unlinkSync(this.ownerPath);
+        fs21.unlinkSync(this.ownerPath);
       }
       const ownerFile = {
         version: 1,
@@ -189836,7 +189974,7 @@ var ProxyRegistryManager = class {
     }
   }
   readRegistry() {
-    if (!fs20.existsSync(this.registryPath)) {
+    if (!fs21.existsSync(this.registryPath)) {
       return {
         version: 1,
         keys: {},
@@ -189844,7 +189982,7 @@ var ProxyRegistryManager = class {
       };
     }
     try {
-      const content = fs20.readFileSync(this.registryPath, "utf-8");
+      const content = fs21.readFileSync(this.registryPath, "utf-8");
       return JSON.parse(content);
     } catch {
       return {
@@ -189857,8 +189995,8 @@ var ProxyRegistryManager = class {
   writeFileAtomic(filePath, data) {
     this.ensureProxyDir();
     const tmpPath = filePath + ".tmp";
-    fs20.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
-    fs20.renameSync(tmpPath, filePath);
+    fs21.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+    fs21.renameSync(tmpPath, filePath);
   }
 };
 
@@ -189962,10 +190100,10 @@ var COLORS = ["cyan", "yellow", "green", "magenta", "blue"];
 function DevUI({ instanceKey, tunnelEnabled }) {
   const { exit } = useApp2();
   const [state, setState] = useState5(() => {
-    const caExists = tunnelEnabled || caFilesExist();
+    const setupDone = tunnelEnabled || !systemSetupNeeded();
     return {
-      status: caExists ? "loading" : "installing-ca",
-      ...caExists ? {} : { caInstallPhase: "installing" },
+      status: setupDone ? "loading" : "installing-ca",
+      ...setupDone ? {} : { caInstallPhase: "installing" },
       resources: /* @__PURE__ */ new Map(),
       resourceStatus: /* @__PURE__ */ new Map(),
       services: [],
@@ -189978,18 +190116,15 @@ function DevUI({ instanceKey, tunnelEnabled }) {
   });
   useEffect3(() => {
     if (state.status === "installing-ca" && state.caInstallPhase === "installing") {
-      installCA();
+      installSystemConfig();
     }
   }, [state.status, state.caInstallPhase]);
-  async function installCA() {
+  async function installSystemConfig() {
     try {
-      const { key, cert } = generateRootCA();
-      const certPath = saveCA(key, cert);
-      installCAToTrustStore(certPath);
+      performSystemSetup();
       setState((s) => ({ ...s, status: "loading", caInstallPhase: "done" }));
       setReadyToStart(true);
     } catch (err) {
-      removeCA();
       setState((s) => ({
         ...s,
         caInstallPhase: "error",
@@ -190007,13 +190142,14 @@ function DevUI({ instanceKey, tunnelEnabled }) {
   const registryWatcherCleanupRef = useRef(null);
   const electionIntervalRef = useRef(null);
   const tunnelsRef = useRef([]);
+  const dnsServerRef = useRef(null);
   const proxyRef = useRef(null);
   const adminServerRef = useRef(null);
   const servicesRef = useRef([]);
   const resourcesRef = useRef(/* @__PURE__ */ new Map());
   const restartServicesRef = useRef(null);
   const [reloadTrigger, setReloadTrigger] = useState5(0);
-  const [readyToStart, setReadyToStart] = useState5(() => tunnelEnabled || caFilesExist());
+  const [readyToStart, setReadyToStart] = useState5(() => tunnelEnabled || !systemSetupNeeded());
   const shutdown2 = async () => {
     if (shuttingDown.current) return;
     shuttingDown.current = true;
@@ -190032,6 +190168,8 @@ function DevUI({ instanceKey, tunnelEnabled }) {
     await Promise.all([
       // Stop proxy
       proxyRef.current?.stop(),
+      // Stop DNS server
+      dnsServerRef.current?.stop(),
       // Stop admin server
       adminServerRef.current?.stop(),
       // Stop all services
@@ -190075,6 +190213,8 @@ function DevUI({ instanceKey, tunnelEnabled }) {
     await Promise.all([
       // Stop proxy
       proxyRef.current?.stop(),
+      // Stop DNS server
+      dnsServerRef.current?.stop(),
       // Stop admin server
       adminServerRef.current?.stop(),
       // Stop all services
@@ -190095,6 +190235,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
     restartServicesRef.current = null;
     drizzleGatewayRef.current = null;
     proxyRef.current = null;
+    dnsServerRef.current = null;
     adminServerRef.current = null;
     servicesRef.current = [];
     resourcesRef.current = /* @__PURE__ */ new Map();
@@ -190126,6 +190267,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
         writeLog("system", "Force shutting down");
         const allProcesses = [
           proxyRef.current,
+          dnsServerRef.current,
           ...servicesRef.current,
           ...electricInstancesRef.current,
           drizzleGatewayRef.current,
@@ -190167,10 +190309,10 @@ function DevUI({ instanceKey, tunnelEnabled }) {
   }, [state.status]);
   useEffect3(() => {
     if (state.status !== "running") return;
-    const configPath = path18.join(process.cwd(), "specific.hcl");
+    const configPath = path19.join(process.cwd(), "specific.hcl");
     const watcher = watchConfigFile(configPath, 1e3, () => {
       try {
-        const hcl = fs21.readFileSync(configPath, "utf-8");
+        const hcl = fs22.readFileSync(configPath, "utf-8");
         parseConfig(hcl).then(() => {
           triggerReload();
         }).catch((err) => {
@@ -190295,8 +190437,8 @@ function DevUI({ instanceKey, tunnelEnabled }) {
         }));
         return;
       }
-      const configPath = path18.join(process.cwd(), "specific.hcl");
-      if (!fs21.existsSync(configPath)) {
+      const configPath = path19.join(process.cwd(), "specific.hcl");
+      if (!fs22.existsSync(configPath)) {
         writeLog("system", "Waiting for specific.hcl to appear");
         setState((s) => ({
           ...s,
@@ -190315,7 +190457,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
       }
       let config2;
       try {
-        const hcl = fs21.readFileSync(configPath, "utf-8");
+        const hcl = fs22.readFileSync(configPath, "utf-8");
         config2 = await parseConfig(hcl);
       } catch (err) {
         setState((s) => ({
@@ -190421,7 +190563,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
           const drizzleGateway = await startDrizzleGateway(
             postgresResources,
             drizzlePort,
-            path18.join(process.cwd(), ".specific", "keys", instanceKey)
+            path19.join(process.cwd(), ".specific", "keys", instanceKey)
           );
           startedDrizzleGateway = drizzleGateway;
           drizzleGatewayRef.current = drizzleGateway;
@@ -190441,7 +190583,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
         if (pg.reshape?.enabled) {
           const resource = resources2.get(pg.name);
           if (!resource) continue;
-          const migrationsDir = path18.resolve(
+          const migrationsDir = path19.resolve(
             process.cwd(),
             pg.reshape.migrations_dir ?? "migrations"
           );
@@ -190609,10 +190751,10 @@ Add them to the config block in specific.local`);
       }
       const services2 = [];
       function resolveServiceCwd(service) {
-        if (service.root) return path18.resolve(process.cwd(), service.root);
+        if (service.root) return path19.resolve(process.cwd(), service.root);
         if (service.build) {
           const build = config2.builds.find((b) => b.name === service.build.name);
-          if (build?.root) return path18.resolve(process.cwd(), build.root);
+          if (build?.root) return path19.resolve(process.cwd(), build.root);
         }
         return process.cwd();
       }
@@ -190803,8 +190945,10 @@ Add them to the config block in specific.local`);
         writeLog("system", `Registered ${serviceInfos.length} services with proxy registry`);
         const becameProxyOwner = await proxyRegistry.claimProxyOwnership(instanceKey);
         if (becameProxyOwner) {
-          writeLog("system", "Claimed proxy ownership, starting HTTP proxy");
+          writeLog("system", "Claimed proxy ownership, starting HTTP proxy and DNS server");
           try {
+            const dnsServer = await startDnsServer();
+            dnsServerRef.current = dnsServer;
             const currentServices = await proxyRegistry.getAllServices();
             const registeredKeys = [...new Set(currentServices.map((s) => s.key))];
             const certificate = generateCertificate("local.spcf.app", registeredKeys);
@@ -190869,12 +191013,14 @@ Add them to the config block in specific.local`);
               writeLog("system", "Proxy owner died, attempting election");
               const won = await proxyRegistry.attemptElection(instanceKey);
               if (won) {
-                writeLog("system", "Won election, starting HTTP proxy");
+                writeLog("system", "Won election, starting HTTP proxy and DNS server");
                 if (electionIntervalRef.current) {
                   clearInterval(electionIntervalRef.current);
                   electionIntervalRef.current = null;
                 }
                 try {
+                  const dnsServer = await startDnsServer();
+                  dnsServerRef.current = dnsServer;
                   const electionServices = await proxyRegistry.getAllServices();
                   const electionKeyRegistrations = await proxyRegistry.getAllKeyRegistrations();
                   const electionKeyNames = Object.keys(electionKeyRegistrations);
@@ -190920,6 +191066,8 @@ Add them to the config block in specific.local`);
         startedProxy.stop().catch(() => {
         });
       }
+      dnsServerRef.current?.stop().catch(() => {
+      });
       for (const service of startedServices) {
         service.stop().catch(() => {
         });
@@ -190952,10 +191100,10 @@ Add them to the config block in specific.local`);
   }, [reloadTrigger, readyToStart, instanceKey]);
   if (state.status === "installing-ca") {
     if (state.caInstallPhase === "installing") {
-      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "TLS Certificate Setup"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Installing a local certificate authority (CA) to enable HTTPS"), /* @__PURE__ */ React6.createElement(Text6, null, "for local development. The CA is limited to Specific projects."), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Your password is required to add the CA to your system's trust store."), /* @__PURE__ */ React6.createElement(Text6, null, " "));
+      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Local Development Setup"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Setting up TLS certificates and DNS resolution for local"), /* @__PURE__ */ React6.createElement(Text6, null, "development. This is a one-time setup for Specific projects."), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Your password is required to configure your system."), /* @__PURE__ */ React6.createElement(Text6, null, " "));
     }
     if (state.caInstallPhase === "error") {
-      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { color: "red" }, "Failed to install CA: ", state.caError));
+      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { color: "red" }, "Setup failed: ", state.caError));
     }
   }
   if (state.status === "loading") {
@@ -191155,20 +191303,20 @@ function devCommand(instanceKey, tunnelEnabled = false) {
 }
 
 // src/lib/dev/git-worktree.ts
-import { execSync as execSync2 } from "child_process";
-import * as path19 from "path";
+import { execSync as execSync3 } from "child_process";
+import * as path20 from "path";
 function isInWorktree() {
   try {
-    const commonDir = execSync2("git rev-parse --git-common-dir", {
+    const commonDir = execSync3("git rev-parse --git-common-dir", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    const gitDir = execSync2("git rev-parse --git-dir", {
+    const gitDir = execSync3("git rev-parse --git-dir", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    const resolvedCommonDir = path19.resolve(commonDir);
-    const resolvedGitDir = path19.resolve(gitDir);
+    const resolvedCommonDir = path20.resolve(commonDir);
+    const resolvedGitDir = path20.resolve(gitDir);
     return resolvedCommonDir !== resolvedGitDir;
   } catch {
     return false;
@@ -191179,11 +191327,11 @@ function getWorktreeName() {
     return null;
   }
   try {
-    const gitDir = execSync2("git rev-parse --git-dir", {
+    const gitDir = execSync3("git rev-parse --git-dir", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    return path19.basename(gitDir);
+    return path20.basename(gitDir);
   } catch {
     return null;
   }
@@ -191198,36 +191346,36 @@ init_open();
 import React7, { useState as useState6, useEffect as useEffect4, useCallback } from "react";
 import { render as render5, Text as Text7, Box as Box7, useApp as useApp3, useInput as useInput5 } from "ink";
 import Spinner5 from "ink-spinner";
-import * as fs23 from "fs";
-import * as path21 from "path";
+import * as fs24 from "fs";
+import * as path22 from "path";
 
 // src/lib/deploy/build-tester.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync20 } from "fs";
-import { join as join21, resolve as resolve7 } from "path";
+import { existsSync as existsSync21 } from "fs";
+import { join as join22, resolve as resolve7 } from "path";
 function getDependencyInstallCommand(build, projectDir) {
   switch (build.base) {
     case "node":
-      if (existsSync20(join21(projectDir, "pnpm-lock.yaml"))) {
+      if (existsSync21(join22(projectDir, "pnpm-lock.yaml"))) {
         return "pnpm install --frozen-lockfile";
-      } else if (existsSync20(join21(projectDir, "yarn.lock"))) {
+      } else if (existsSync21(join22(projectDir, "yarn.lock"))) {
         return "yarn install --frozen-lockfile";
-      } else if (existsSync20(join21(projectDir, "package-lock.json"))) {
+      } else if (existsSync21(join22(projectDir, "package-lock.json"))) {
         return "npm ci";
-      } else if (existsSync20(join21(projectDir, "package.json"))) {
+      } else if (existsSync21(join22(projectDir, "package.json"))) {
         return "npm install";
       }
       return null;
     case "python":
-      if (existsSync20(join21(projectDir, "poetry.lock"))) {
+      if (existsSync21(join22(projectDir, "poetry.lock"))) {
         return "poetry install --no-interaction";
-      } else if (existsSync20(join21(projectDir, "Pipfile.lock"))) {
+      } else if (existsSync21(join22(projectDir, "Pipfile.lock"))) {
         return "pipenv install --deploy";
-      } else if (existsSync20(join21(projectDir, "Pipfile"))) {
+      } else if (existsSync21(join22(projectDir, "Pipfile"))) {
         return "pipenv install";
-      } else if (existsSync20(join21(projectDir, "pyproject.toml"))) {
+      } else if (existsSync21(join22(projectDir, "pyproject.toml"))) {
         return "pip install .";
-      } else if (existsSync20(join21(projectDir, "requirements.txt"))) {
+      } else if (existsSync21(join22(projectDir, "requirements.txt"))) {
         return "pip install -r requirements.txt";
       }
       return null;
@@ -191372,13 +191520,13 @@ async function testAllBuilds(builds, projectDir) {
 }
 
 // src/lib/tarball/create.ts
-import { execSync as execSync3 } from "child_process";
-import * as fs22 from "fs";
-import * as path20 from "path";
+import { execSync as execSync4 } from "child_process";
+import * as fs23 from "fs";
+import * as path21 from "path";
 import { createTarPacker, createEntryItemGenerator } from "tar-vern";
 function isInsideGitRepository(dir) {
   try {
-    const result = execSync3("git rev-parse --is-inside-work-tree", {
+    const result = execSync4("git rev-parse --is-inside-work-tree", {
       cwd: dir,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -191390,7 +191538,7 @@ function isInsideGitRepository(dir) {
 }
 async function createGitArchive(projectDir) {
   writeLog("tarball", "Creating tarball using git ls-files");
-  const filesOutput = execSync3(
+  const filesOutput = execSync4(
     "git ls-files --cached --others --exclude-standard",
     {
       cwd: projectDir,
@@ -191431,10 +191579,10 @@ var EXCLUDED_DIRS = [
 ];
 async function collectPaths(baseDir, currentDir, exclude) {
   const results = [];
-  const entries = await fs22.promises.readdir(currentDir, { withFileTypes: true });
+  const entries = await fs23.promises.readdir(currentDir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path20.join(currentDir, entry.name);
-    const relativePath = path20.relative(baseDir, fullPath);
+    const fullPath = path21.join(currentDir, entry.name);
+    const relativePath = path21.relative(baseDir, fullPath);
     if (entry.isDirectory()) {
       if (!exclude.includes(entry.name)) {
         results.push(relativePath);
@@ -191449,8 +191597,8 @@ async function collectPaths(baseDir, currentDir, exclude) {
 }
 async function createTarArchive(projectDir) {
   writeLog("tarball", "Creating tarball using tar-vern (non-git project)");
-  const configPath = path20.join(projectDir, "specific.hcl");
-  if (!fs22.existsSync(configPath)) {
+  const configPath = path21.join(projectDir, "specific.hcl");
+  if (!fs23.existsSync(configPath)) {
     throw new Error("specific.hcl not found in project directory");
   }
   const relativePaths = await collectPaths(projectDir, projectDir, EXCLUDED_DIRS);
@@ -191467,8 +191615,8 @@ async function createTarArchive(projectDir) {
 }
 function findWidestContext(projectDir, contexts) {
   if (contexts.length === 0) return ".";
-  const absolute = contexts.map((c) => path20.resolve(projectDir, c));
-  const segments = absolute.map((p) => p.split(path20.sep).filter(Boolean));
+  const absolute = contexts.map((c) => path21.resolve(projectDir, c));
+  const segments = absolute.map((p) => p.split(path21.sep).filter(Boolean));
   const firstSegments = segments[0];
   if (!firstSegments) return ".";
   const minLen = Math.min(...segments.map((s) => s.length));
@@ -191482,12 +191630,12 @@ function findWidestContext(projectDir, contexts) {
     }
   }
   const ancestorSegments = firstSegments.slice(0, commonLength);
-  const ancestor = path20.sep + ancestorSegments.join(path20.sep);
-  return path20.relative(projectDir, ancestor) || ".";
+  const ancestor = path21.sep + ancestorSegments.join(path21.sep);
+  return path21.relative(projectDir, ancestor) || ".";
 }
 async function createProjectTarball(projectDir, context = ".") {
-  const contextDir = path20.resolve(projectDir, context);
-  const appPath = path20.relative(contextDir, projectDir) || ".";
+  const contextDir = path21.resolve(projectDir, context);
+  const appPath = path21.relative(contextDir, projectDir) || ".";
   writeLog("tarball", `Context: ${contextDir}, appPath: ${appPath}`);
   let tarball;
   if (isInsideGitRepository(contextDir)) {
@@ -192374,14 +192522,14 @@ ${errorMsg}`
   ), phase === "error" && /* @__PURE__ */ React7.createElement(Box7, { marginTop: 1 }, /* @__PURE__ */ React7.createElement(Text7, { color: "red" }, "Error: ", error)), phase === "success" && /* @__PURE__ */ React7.createElement(Box7, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React7.createElement(Text7, { color: "green" }, "Deployment successful!"), deployment?.publicUrls && Object.keys(deployment.publicUrls).length > 0 && /* @__PURE__ */ React7.createElement(Box7, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React7.createElement(Text7, { bold: true }, "Public URLs:"), Object.entries(deployment.publicUrls).map(([name, url]) => /* @__PURE__ */ React7.createElement(Text7, { key: name }, "  ", name, ": ", /* @__PURE__ */ React7.createElement(Text7, { color: "cyan" }, url))))));
 }
 async function deployCommand(environment, options2) {
-  const configPath = path21.join(process.cwd(), "specific.hcl");
-  if (!fs23.existsSync(configPath)) {
+  const configPath = path22.join(process.cwd(), "specific.hcl");
+  if (!fs24.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
   try {
-    const hcl = fs23.readFileSync(configPath, "utf-8");
+    const hcl = fs24.readFileSync(configPath, "utf-8");
     config = await parseConfig(hcl);
   } catch (err) {
     console.error(
@@ -192405,8 +192553,8 @@ async function deployCommand(environment, options2) {
 
 // src/commands/exec.tsx
 import { spawn as spawn6 } from "child_process";
-import * as fs24 from "fs";
-import * as path22 from "path";
+import * as fs25 from "fs";
+import * as path23 from "path";
 async function execCommand(serviceName, command, instanceKey = "default") {
   if (command.length === 0) {
     console.error(
@@ -192434,14 +192582,14 @@ async function execCommand(serviceName, command, instanceKey = "default") {
       }
     }
   };
-  const configPath = path22.join(process.cwd(), "specific.hcl");
-  if (!fs24.existsSync(configPath)) {
+  const configPath = path23.join(process.cwd(), "specific.hcl");
+  if (!fs25.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
   try {
-    const hcl = fs24.readFileSync(configPath, "utf-8");
+    const hcl = fs25.readFileSync(configPath, "utf-8");
     config = await parseConfig(hcl);
   } catch (err) {
     console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
@@ -192557,11 +192705,11 @@ async function execCommand(serviceName, command, instanceKey = "default") {
   process.on("SIGTERM", () => handleSignal("SIGTERM"));
   let effectiveCwd = process.cwd();
   if (service.root) {
-    effectiveCwd = path22.resolve(process.cwd(), service.root);
+    effectiveCwd = path23.resolve(process.cwd(), service.root);
   } else if (service.build) {
     const build = config.builds.find((b) => b.name === service.build.name);
     if (build?.root) {
-      effectiveCwd = path22.resolve(process.cwd(), build.root);
+      effectiveCwd = path23.resolve(process.cwd(), build.root);
     }
   }
   child = spawn6(command[0], command.slice(1), {
@@ -192589,8 +192737,8 @@ async function execCommand(serviceName, command, instanceKey = "default") {
 
 // src/commands/psql.tsx
 import { spawn as spawn7 } from "child_process";
-import * as fs25 from "fs";
-import * as path23 from "path";
+import * as fs26 from "fs";
+import * as path24 from "path";
 async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []) {
   let startedResources = [];
   let ownsInstances = false;
@@ -192607,14 +192755,14 @@ async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []
       }
     }
   };
-  const configPath = path23.join(process.cwd(), "specific.hcl");
-  if (!fs25.existsSync(configPath)) {
+  const configPath = path24.join(process.cwd(), "specific.hcl");
+  if (!fs26.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
   try {
-    const hcl = fs25.readFileSync(configPath, "utf-8");
+    const hcl = fs26.readFileSync(configPath, "utf-8");
     config = await parseConfig(hcl);
   } catch (err) {
     console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
@@ -192736,8 +192884,8 @@ async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []
 
 // src/commands/reshape.tsx
 import { spawn as spawn8 } from "child_process";
-import * as fs26 from "fs";
-import * as path24 from "path";
+import * as fs27 from "fs";
+import * as path25 from "path";
 var VALID_ACTIONS = ["start", "complete", "status", "abort", "check"];
 var MIGRATION_SUBCOMMANDS = ["start", "complete", "abort"];
 var OFFLINE_ACTIONS = ["check"];
@@ -192749,13 +192897,13 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
     process.exit(1);
   }
   const isOfflineAction = OFFLINE_ACTIONS.includes(action);
-  const configPath = path24.join(process.cwd(), "specific.hcl");
+  const configPath = path25.join(process.cwd(), "specific.hcl");
   let config;
   let migrationsDir = "migrations";
   let targetDb;
   try {
-    if (fs26.existsSync(configPath)) {
-      const configContent = fs26.readFileSync(configPath, "utf-8");
+    if (fs27.existsSync(configPath)) {
+      const configContent = fs27.readFileSync(configPath, "utf-8");
       config = await parseConfig(configContent);
       if (databaseName) {
         const postgresConfig = config.postgres.find((p) => p.name === databaseName);
@@ -192888,9 +193036,9 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
   }
   const isMigrationSubcommand = MIGRATION_SUBCOMMANDS.includes(action);
   const reshapeArgs = isMigrationSubcommand ? ["migration", action] : [action];
-  const fullMigrationsPath = path24.join(process.cwd(), migrationsDir);
+  const fullMigrationsPath = path25.join(process.cwd(), migrationsDir);
   if (action === "check" || action === "start") {
-    if (fs26.existsSync(fullMigrationsPath)) {
+    if (fs27.existsSync(fullMigrationsPath)) {
       reshapeArgs.push("--dirs", fullMigrationsPath);
     } else if (action === "check") {
       console.error(`Error: Migrations directory not found: ${fullMigrationsPath}`);
@@ -192940,21 +193088,21 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
 import React8, { useState as useState7, useEffect as useEffect5 } from "react";
 import { render as render6, Text as Text8, Box as Box8 } from "ink";
 import Spinner6 from "ink-spinner";
-import * as fs27 from "fs";
-import * as path25 from "path";
+import * as fs28 from "fs";
+import * as path26 from "path";
 function CleanUI({ instanceKey }) {
   const [state, setState] = useState7({ status: "checking" });
   useEffect5(() => {
     async function clean() {
       const projectRoot = process.cwd();
-      const specificDir = path25.join(projectRoot, ".specific");
-      if (!fs27.existsSync(specificDir)) {
+      const specificDir = path26.join(projectRoot, ".specific");
+      if (!fs28.existsSync(specificDir)) {
         setState({ status: "nothing" });
         return;
       }
       if (instanceKey) {
-        const keyDir = path25.join(specificDir, "keys", instanceKey);
-        if (!fs27.existsSync(keyDir)) {
+        const keyDir = path26.join(specificDir, "keys", instanceKey);
+        if (!fs28.existsSync(keyDir)) {
           setState({ status: "nothing" });
           return;
         }
@@ -192970,7 +193118,7 @@ function CleanUI({ instanceKey }) {
         await stateManager.cleanStaleState();
         setState({ status: "cleaning" });
         try {
-          fs27.rmSync(keyDir, { recursive: true, force: true });
+          fs28.rmSync(keyDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -192979,13 +193127,13 @@ function CleanUI({ instanceKey }) {
           });
         }
       } else {
-        const keysDir = path25.join(specificDir, "keys");
-        if (!fs27.existsSync(keysDir)) {
+        const keysDir = path26.join(specificDir, "keys");
+        if (!fs28.existsSync(keysDir)) {
           setState({ status: "nothing" });
           return;
         }
-        const keys = fs27.readdirSync(keysDir).filter(
-          (f) => fs27.statSync(path25.join(keysDir, f)).isDirectory()
+        const keys = fs28.readdirSync(keysDir).filter(
+          (f) => fs28.statSync(path26.join(keysDir, f)).isDirectory()
         );
         for (const key of keys) {
           const stateManager2 = new InstanceStateManager(projectRoot, key);
@@ -193009,7 +193157,7 @@ function CleanUI({ instanceKey }) {
         }
         setState({ status: "cleaning" });
         try {
-          fs27.rmSync(keysDir, { recursive: true, force: true });
+          fs28.rmSync(keysDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -193172,7 +193320,7 @@ function betaCommand() {
 var program = new Command();
 var env = "production";
 var envLabel = env !== "production" ? `[${env.toUpperCase()}] ` : "";
-program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.61").enablePositionalOptions();
+program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.62").enablePositionalOptions();
 program.command("init").description("Initialize project for use with a coding agent").option("--agent <name...>", "Agents to configure (cursor, claude, codex, other)").action((options2) => initCommand(options2));
 program.command("docs [topic]").description("Fetch LLM-optimized documentation").action(docsCommand);
 program.command("check").description("Validate specific.hcl configuration").action(checkCommand);