@specific.dev/cli 0.1.80 → 0.1.82

package/dist/cli.js

@@ -39,10 +39,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 function hasDockerEnv() {
   try {
-    fs5.statSync("/.dockerenv");
+    fs6.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -50,7 +50,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return fs5.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return fs6.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -68,7 +68,7 @@ var init_is_docker = __esm({
 });
 
 // node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 function isInsideContainer() {
   if (cachedResult === void 0) {
     cachedResult = hasContainerEnv() || isDocker();
@@ -81,7 +81,7 @@ var init_is_inside_container = __esm({
     init_is_docker();
     hasContainerEnv = () => {
       try {
-        fs6.statSync("/run/.containerenv");
+        fs7.statSync("/run/.containerenv");
         return true;
       } catch {
         return false;
@@ -92,8 +92,8 @@ var init_is_inside_container = __esm({
 
 // node_modules/.pnpm/is-wsl@3.1.0/node_modules/is-wsl/index.js
 import process2 from "node:process";
-import os4 from "node:os";
-import fs7 from "node:fs";
+import os5 from "node:os";
+import fs8 from "node:fs";
 var isWsl, is_wsl_default;
 var init_is_wsl = __esm({
   "node_modules/.pnpm/is-wsl@3.1.0/node_modules/is-wsl/index.js"() {
@@ -102,14 +102,14 @@ var init_is_wsl = __esm({
       if (process2.platform !== "linux") {
         return false;
       }
-      if (os4.release().toLowerCase().includes("microsoft")) {
+      if (os5.release().toLowerCase().includes("microsoft")) {
         if (isInsideContainer()) {
           return false;
         }
         return true;
       }
       try {
-        return fs7.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
+        return fs8.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
       } catch {
         return false;
       }
@@ -179,7 +179,7 @@ var init_utilities = __esm({
 // node_modules/.pnpm/wsl-utils@0.3.1/node_modules/wsl-utils/index.js
 import { promisify as promisify2 } from "node:util";
 import childProcess2 from "node:child_process";
-import fs8, { constants as fsConstants } from "node:fs/promises";
+import fs9, { constants as fsConstants } from "node:fs/promises";
 var execFile2, wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath2, canAccessPowerShellPromise, canAccessPowerShell, wslDefaultBrowser, convertWslPathToWindows;
 var init_wsl_utils = __esm({
   "node_modules/.pnpm/wsl-utils@0.3.1/node_modules/wsl-utils/index.js"() {
@@ -198,14 +198,14 @@ var init_wsl_utils = __esm({
         const configFilePath = "/etc/wsl.conf";
         let isConfigFileExists = false;
         try {
-          await fs8.access(configFilePath, fsConstants.F_OK);
+          await fs9.access(configFilePath, fsConstants.F_OK);
           isConfigFileExists = true;
         } catch {
         }
         if (!isConfigFileExists) {
           return defaultMountPoint;
         }
-        const configContent = await fs8.readFile(configFilePath, { encoding: "utf8" });
+        const configContent = await fs9.readFile(configFilePath, { encoding: "utf8" });
         const parsedMountPoint = parseMountPointFromConfig(configContent);
         if (parsedMountPoint === void 0) {
           return defaultMountPoint;
@@ -224,7 +224,7 @@ var init_wsl_utils = __esm({
       canAccessPowerShellPromise ??= (async () => {
         try {
           const psPath = await powerShellPath2();
-          await fs8.access(psPath, fsConstants.X_OK);
+          await fs9.access(psPath, fsConstants.X_OK);
           return true;
         } catch {
           return false;
@@ -435,7 +435,7 @@ import process8 from "node:process";
 import path5 from "node:path";
 import { fileURLToPath } from "node:url";
 import childProcess3 from "node:child_process";
-import fs9, { constants as fsConstants2 } from "node:fs/promises";
+import fs10, { constants as fsConstants2 } from "node:fs/promises";
 function detectArchBinary(binary) {
   if (typeof binary === "string" || Array.isArray(binary)) {
     return binary;
@@ -446,16 +446,16 @@ function detectArchBinary(binary) {
   }
   return archBinary;
 }
-function detectPlatformBinary({ [platform3]: platformBinary }, { wsl } = {}) {
+function detectPlatformBinary({ [platform4]: platformBinary }, { wsl } = {}) {
   if (wsl && is_wsl_default) {
     return detectArchBinary(wsl);
   }
   if (!platformBinary) {
-    throw new Error(`${platform3} is not supported`);
+    throw new Error(`${platform4} is not supported`);
   }
   return detectArchBinary(platformBinary);
 }
-var fallbackAttemptSymbol, __dirname, localXdgOpenPath, platform3, arch, tryEachApp, baseOpen, open, openApp, apps, open_default;
+var fallbackAttemptSymbol, __dirname, localXdgOpenPath, platform4, arch, tryEachApp, baseOpen, open, openApp, apps, open_default;
 var init_open = __esm({
   "node_modules/.pnpm/open@11.0.0/node_modules/open/index.js"() {
     init_wsl_utils();
@@ -467,7 +467,7 @@ var init_open = __esm({
     fallbackAttemptSymbol = Symbol("fallbackAttempt");
     __dirname = import.meta.url ? path5.dirname(fileURLToPath(import.meta.url)) : "";
     localXdgOpenPath = path5.join(__dirname, "xdg-open");
-    ({ platform: platform3, arch } = process8);
+    ({ platform: platform4, arch } = process8);
     tryEachApp = async (apps2, opener) => {
       if (apps2.length === 0) {
         return;
@@ -564,7 +564,7 @@ var init_open = __esm({
       if (is_wsl_default && !isInsideContainer() && !is_in_ssh_default && !app) {
         shouldUseWindowsInWsl = await canAccessPowerShell();
       }
-      if (platform3 === "darwin") {
+      if (platform4 === "darwin") {
         command = "open";
         if (options2.wait) {
           cliArguments.push("--wait-apps");
@@ -578,7 +578,7 @@ var init_open = __esm({
         if (app) {
           cliArguments.push("-a", app);
         }
-      } else if (platform3 === "win32" || shouldUseWindowsInWsl) {
+      } else if (platform4 === "win32" || shouldUseWindowsInWsl) {
         command = await powerShellPath2();
         cliArguments.push(...executePowerShell.argumentsPrefix);
         if (!is_wsl_default) {
@@ -614,11 +614,11 @@ var init_open = __esm({
           const isBundled = !__dirname || __dirname === "/";
           let exeLocalXdgOpen = false;
           try {
-            await fs9.access(localXdgOpenPath, fsConstants2.X_OK);
+            await fs10.access(localXdgOpenPath, fsConstants2.X_OK);
             exeLocalXdgOpen = true;
           } catch {
           }
-          const useSystemXdgOpen = process8.versions.electron ?? (platform3 === "android" || isBundled || !exeLocalXdgOpen);
+          const useSystemXdgOpen = process8.versions.electron ?? (platform4 === "android" || isBundled || !exeLocalXdgOpen);
           command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
         }
         if (appArguments.length > 0) {
@@ -629,7 +629,7 @@ var init_open = __esm({
           childProcessOptions.detached = true;
         }
       }
-      if (platform3 === "darwin" && appArguments.length > 0) {
+      if (platform4 === "darwin" && appArguments.length > 0) {
         cliArguments.push("--args", ...appArguments);
       }
       if (options2.target) {
@@ -754,8 +754,8 @@ var require_dist = __commonJS({
       var $global, $module, $NaN = NaN;
       if ("undefined" != typeof window ? $global = window : "undefined" != typeof self ? $global = self : "undefined" != typeof global ? ($global = global).require = __require : $global = this, void 0 === $global || void 0 === $global.Array) throw new Error("no global object found");
       if ("undefined" != typeof module && ($module = module), !$global.fs && $global.require) try {
-        var fs32 = $global.require("fs");
-        "object" == typeof fs32 && null !== fs32 && 0 !== Object.keys(fs32).length && ($global.fs = fs32);
+        var fs33 = $global.require("fs");
+        "object" == typeof fs33 && null !== fs33 && 0 !== Object.keys(fs33).length && ($global.fs = fs33);
       } catch (e) {
       }
       if (!$global.fs) {
@@ -183430,11 +183430,14 @@ import { Command } from "commander";
 import React2, { useState, useEffect } from "react";
 import { render as render2, Text as Text2, Box as Box2, useInput, useApp } from "ink";
 import "ink-spinner";
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as path7 from "path";
+import * as os8 from "os";
 
 // src/lib/dev/system-setup.ts
 import { execSync as execSync2 } from "child_process";
+import * as fs4 from "fs";
+import * as os4 from "os";
 import * as path3 from "path";
 
 // src/lib/dev/local-ca.ts
@@ -183470,17 +183473,17 @@ function caInstalledInTrustStore() {
   if (!caFilesExist()) {
     return false;
   }
-  const platform5 = os.platform();
+  const platform8 = os.platform();
   const certPath = path.join(getCADir(), "ca.crt");
   const diskCert = fs.readFileSync(certPath, "utf-8").replace(/\r\n/g, "\n").trim();
   try {
-    if (platform5 === "darwin") {
+    if (platform8 === "darwin") {
       const keychainCert = execSync(
-        'security find-certificate -c "Specific Local Development CA" -p /Library/Keychains/System.keychain',
+        `security find-certificate -c "Specific Local Development CA" -p "${getLoginKeychainPath()}"`,
         { encoding: "utf-8" }
       ).replace(/\r\n/g, "\n").trim();
       return keychainCert === diskCert;
-    } else if (platform5 === "linux") {
+    } else if (platform8 === "linux") {
       const trustPaths = [
         "/usr/local/share/ca-certificates/specific-local-ca.crt",
         // Debian/Ubuntu
@@ -183591,16 +183594,23 @@ function removeCA() {
     fs.unlinkSync(certPath);
   }
 }
+function getLoginKeychainPath() {
+  return path.join(os.homedir(), "Library", "Keychains", "login.keychain-db");
+}
+function getCADeleteCommand() {
+  return `security delete-certificate -c "Specific Local Development CA" "${getLoginKeychainPath()}"`;
+}
+function getCATrustCommand(certPath) {
+  return `security add-trusted-cert -d -r trustRoot -k "${getLoginKeychainPath()}" "${certPath}"`;
+}
 function getCAInstallCommands(certPath) {
-  const platform5 = os.platform();
-  if (platform5 === "darwin") {
+  const platform8 = os.platform();
+  if (platform8 === "darwin") {
     return [
-      // Remove any existing cert with the same CN first — add-trusted-cert
-      // silently does nothing if a cert with the same subject already exists.
-      'security delete-certificate -c "Specific Local Development CA" /Library/Keychains/System.keychain 2>/dev/null || true',
-      `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`
+      `${getCADeleteCommand()} 2>/dev/null || true`,
+      getCATrustCommand(certPath)
     ];
-  } else if (platform5 === "linux") {
+  } else if (platform8 === "linux") {
     if (fs.existsSync("/usr/local/share/ca-certificates")) {
       return [
         `cp "${certPath}" /usr/local/share/ca-certificates/specific-local-ca.crt`,
@@ -183619,7 +183629,7 @@ function getCAInstallCommands(certPath) {
     }
     throw new Error("Could not detect Linux certificate trust mechanism");
   }
-  throw new Error(`Unsupported platform: ${platform5}`);
+  throw new Error(`Unsupported platform: ${platform8}`);
 }
 function generateCertificate(domain, keys = []) {
   const caDir = getCADir();
@@ -183665,23 +183675,23 @@ var RESOLVER_FILE_MACOS = "/etc/resolver/spcf.localhost";
 var OLD_RESOLVER_FILE_MACOS = "/etc/resolver/local.spcf.app";
 var RESOLVER_FILE_LINUX = "/etc/systemd/resolved.conf.d/specific-local.conf";
 function resolverConfigExists() {
-  const platform5 = os2.platform();
-  if (platform5 === "darwin") {
+  const platform8 = os2.platform();
+  if (platform8 === "darwin") {
     return fs2.existsSync(RESOLVER_FILE_MACOS);
-  } else if (platform5 === "linux") {
+  } else if (platform8 === "linux") {
     return fs2.existsSync(RESOLVER_FILE_LINUX);
   }
   return false;
 }
 function getResolverInstallCommands(port) {
-  const platform5 = os2.platform();
-  if (platform5 === "darwin") {
+  const platform8 = os2.platform();
+  if (platform8 === "darwin") {
     return [
       "mkdir -p /etc/resolver",
       `rm -f ${OLD_RESOLVER_FILE_MACOS}`,
       `printf "nameserver 127.0.0.1\\nport ${port}\\n" > ${RESOLVER_FILE_MACOS}`
     ];
-  } else if (platform5 === "linux") {
+  } else if (platform8 === "linux") {
     if (fs2.existsSync("/etc/systemd/resolved.conf.d") || fs2.existsSync("/etc/systemd")) {
       return [
         "mkdir -p /etc/systemd/resolved.conf.d",
@@ -183775,19 +183785,60 @@ async function startDnsServer(port = DNS_PORT) {
 
 // src/lib/dev/system-setup.ts
 function systemSetupNeeded() {
-  return !caInstalledInTrustStore() || !resolverConfigExists();
+  return dnsSetupNeeded() || tlsSetupNeeded();
+}
+function dnsSetupNeeded() {
+  return !resolverConfigExists();
+}
+function tlsSetupNeeded() {
+  return !caInstalledInTrustStore();
+}
+function ensureCAGenerated() {
+  if (caFilesExist()) {
+    return false;
+  }
+  const { key, cert } = generateRootCA();
+  saveCA(key, cert);
+  return true;
+}
+function performDnsSetup() {
+  const commands = getResolverInstallCommands(DNS_PORT);
+  if (commands.length === 0) return;
+  if (os4.platform() === "darwin") {
+    execPrivilegedMacOS(commands);
+  } else {
+    execSync2(`sudo sh -c '${commands.join(" && ")}'`, { stdio: "inherit" });
+  }
+}
+function performTlsTrust() {
+  const wasGenerated = ensureCAGenerated();
+  const certPath = path3.join(getCADir(), "ca.crt");
+  try {
+    if (os4.platform() === "darwin") {
+      execSync2(`${getCADeleteCommand()} 2>/dev/null || true`, {
+        stdio: "inherit"
+      });
+      execSync2(getCATrustCommand(certPath), { stdio: "inherit" });
+    } else {
+      execSync2(
+        `sudo sh -c '${getCAInstallCommands(certPath).join(" && ")}'`,
+        { stdio: "inherit" }
+      );
+    }
+  } catch (err) {
+    if (wasGenerated) {
+      removeCA();
+    }
+    throw err;
+  }
 }
 function performSystemSetup() {
-  const needsGenerate = !caFilesExist();
+  const wasGenerated = ensureCAGenerated();
   const needsInstallCA = !caInstalledInTrustStore();
   const needsResolver = !resolverConfigExists();
   if (!needsInstallCA && !needsResolver) {
     return;
   }
-  if (needsGenerate) {
-    const { key, cert } = generateRootCA();
-    saveCA(key, cert);
-  }
   const certPath = path3.join(getCADir(), "ca.crt");
   const commands = [];
   if (needsInstallCA) {
@@ -183802,20 +183853,45 @@ function performSystemSetup() {
   try {
     execSync2(`sudo sh -c '${commands.join(" && ")}'`, { stdio: "inherit" });
   } catch (err) {
-    if (needsGenerate) {
+    if (wasGenerated) {
       removeCA();
     }
     throw err;
   }
 }
+function execPrivilegedMacOS(commands) {
+  if (commands.length === 0) return;
+  const scriptPath = path3.join(os4.tmpdir(), "specific-setup.sh");
+  const appPath = path3.join(os4.tmpdir(), "Specific.app");
+  try {
+    fs4.writeFileSync(
+      scriptPath,
+      "#!/bin/sh\nset -e\n" + commands.join("\n") + "\n",
+      { mode: 448 }
+    );
+    execSync2(
+      `osacompile -o '${appPath}' -e 'do shell script "sh ${scriptPath}" with administrator privileges'`
+    );
+    execSync2(`'${appPath}/Contents/MacOS/applet'`, { stdio: "pipe" });
+  } finally {
+    try {
+      fs4.unlinkSync(scriptPath);
+    } catch {
+    }
+    try {
+      fs4.rmSync(appPath, { recursive: true });
+    } catch {
+    }
+  }
+}
 
 // src/lib/analytics/index.ts
 import { PostHog } from "posthog-node";
-import * as os6 from "os";
+import * as os7 from "os";
 import * as crypto from "crypto";
 
 // src/lib/project/config.ts
-import * as fs4 from "fs";
+import * as fs5 from "fs";
 import * as path4 from "path";
 var PROJECT_ID_FILE = ".specific/project_id";
 var ProjectNotLinkedError = class extends Error {
@@ -183832,10 +183908,10 @@ Run: specific deploy`
 };
 function readProjectId(projectDir = process.cwd()) {
   const projectIdPath = path4.join(projectDir, PROJECT_ID_FILE);
-  if (!fs4.existsSync(projectIdPath)) {
+  if (!fs5.existsSync(projectIdPath)) {
     throw new ProjectNotLinkedError();
   }
-  const projectId = fs4.readFileSync(projectIdPath, "utf-8").trim();
+  const projectId = fs5.readFileSync(projectIdPath, "utf-8").trim();
   if (!projectId) {
     throw new Error(`${PROJECT_ID_FILE} is empty`);
   }
@@ -183843,20 +183919,20 @@ function readProjectId(projectDir = process.cwd()) {
 }
 function hasProjectId(projectDir = process.cwd()) {
   const projectIdPath = path4.join(projectDir, PROJECT_ID_FILE);
-  return fs4.existsSync(projectIdPath);
+  return fs5.existsSync(projectIdPath);
 }
 function writeProjectId(projectId, projectDir = process.cwd()) {
   const specificDir = path4.join(projectDir, ".specific");
-  if (!fs4.existsSync(specificDir)) {
-    fs4.mkdirSync(specificDir, { recursive: true });
+  if (!fs5.existsSync(specificDir)) {
+    fs5.mkdirSync(specificDir, { recursive: true });
   }
-  fs4.writeFileSync(path4.join(specificDir, "project_id"), projectId + "\n");
+  fs5.writeFileSync(path4.join(specificDir, "project_id"), projectId + "\n");
 }
 
 // src/lib/auth/credentials.ts
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as path6 from "path";
-import * as os5 from "os";
+import * as os6 from "os";
 
 // src/lib/auth/errors.ts
 var RefreshTokenExpiredError = class extends Error {
@@ -184437,18 +184513,18 @@ var ApiClient = class {
 
 // src/lib/auth/credentials.ts
 function getUserCredentialsDir() {
-  return path6.join(os5.homedir(), ".specific");
+  return path6.join(os6.homedir(), ".specific");
 }
 function getCredentialsPath() {
   return path6.join(getUserCredentialsDir(), "credentials.json");
 }
 function readUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (!fs10.existsSync(credentialsPath)) {
+  if (!fs11.existsSync(credentialsPath)) {
     return null;
   }
   try {
-    const content = fs10.readFileSync(credentialsPath, "utf-8");
+    const content = fs11.readFileSync(credentialsPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -184456,18 +184532,18 @@ function readUserCredentials() {
 }
 function writeUserCredentials(credentials) {
   const dir = getUserCredentialsDir();
-  if (!fs10.existsSync(dir)) {
-    fs10.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (!fs11.existsSync(dir)) {
+    fs11.mkdirSync(dir, { recursive: true, mode: 448 });
   }
   const credentialsPath = getCredentialsPath();
-  fs10.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
+  fs11.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
     mode: 384
   });
 }
 function clearUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (fs10.existsSync(credentialsPath)) {
-    fs10.unlinkSync(credentialsPath);
+  if (fs11.existsSync(credentialsPath)) {
+    fs11.unlinkSync(credentialsPath);
   }
 }
 function isLoggedIn() {
@@ -184546,7 +184622,7 @@ function isEnabled() {
 }
 function getAnonymousId() {
   if (anonymousId) return anonymousId;
-  const machineId = `${os6.hostname()}-${os6.userInfo().username}`;
+  const machineId = `${os7.hostname()}-${os7.userInfo().username}`;
   anonymousId = crypto.createHash("sha256").update(machineId).digest("hex").slice(0, 16);
   return anonymousId;
 }
@@ -184593,7 +184669,7 @@ function trackEvent(event, properties) {
     event,
     properties: {
       ...properties,
-      cli_version: "0.1.80",
+      cli_version: "0.1.82",
       platform: process.platform,
       node_version: process.version,
       project_id: getProjectId()
@@ -184630,57 +184706,57 @@ var options = [
 ];
 function isGitProject() {
   const gitPath = path7.join(process.cwd(), ".git");
-  return fs11.existsSync(gitPath);
+  return fs12.existsSync(gitPath);
 }
 function detectExistingAgents() {
   const detected = {};
   const cursorDir = path7.join(process.cwd(), ".cursor");
-  if (fs11.existsSync(cursorDir)) {
+  if (fs12.existsSync(cursorDir)) {
     detected["cursor"] = true;
   }
   const claudeDir = path7.join(process.cwd(), ".claude");
   const claudeMd = path7.join(process.cwd(), "CLAUDE.md");
-  if (fs11.existsSync(claudeDir) || fs11.existsSync(claudeMd)) {
+  if (fs12.existsSync(claudeDir) || fs12.existsSync(claudeMd)) {
     detected["claude"] = true;
   }
   const agentsMd = path7.join(process.cwd(), "AGENTS.md");
-  if (fs11.existsSync(agentsMd)) {
+  if (fs12.existsSync(agentsMd)) {
     detected["codex"] = true;
   }
   return detected;
 }
 function appendOrCreateFile(filePath, content) {
-  if (fs11.existsSync(filePath)) {
-    const existing = fs11.readFileSync(filePath, "utf-8");
+  if (fs12.existsSync(filePath)) {
+    const existing = fs12.readFileSync(filePath, "utf-8");
     if (existing.includes("specific docs") || existing.includes("specific check")) {
       return "unchanged";
     }
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    fs11.writeFileSync(filePath, existing + separator + content + "\n");
+    fs12.writeFileSync(filePath, existing + separator + content + "\n");
     return "modified";
   } else {
-    fs11.writeFileSync(filePath, content + "\n");
+    fs12.writeFileSync(filePath, content + "\n");
     return "created";
   }
 }
 function addToGitignore() {
   const gitignorePath = path7.join(process.cwd(), ".gitignore");
   const entries = [".specific", "specific.local"];
-  if (fs11.existsSync(gitignorePath)) {
-    const existing = fs11.readFileSync(gitignorePath, "utf-8");
+  if (fs12.existsSync(gitignorePath)) {
+    const existing = fs12.readFileSync(gitignorePath, "utf-8");
     const lines = existing.split("\n").map((l) => l.trim());
     const missingEntries = entries.filter((entry) => !lines.includes(entry));
     if (missingEntries.length === 0) {
       return "unchanged";
     }
     const separator = existing.endsWith("\n") ? "" : "\n";
-    fs11.writeFileSync(
+    fs12.writeFileSync(
       gitignorePath,
       existing + separator + missingEntries.join("\n") + "\n"
     );
     return "modified";
   } else {
-    fs11.writeFileSync(gitignorePath, entries.join("\n") + "\n");
+    fs12.writeFileSync(gitignorePath, entries.join("\n") + "\n");
     return "created";
   }
 }
@@ -184688,8 +184764,8 @@ function configureClaudeCodePermissions() {
   const claudeDir = path7.join(process.cwd(), ".claude");
   const settingsPath = path7.join(claudeDir, "settings.local.json");
   const permissions = ["Bash(specific docs:*)", "Bash(specific check:*)"];
-  if (fs11.existsSync(settingsPath)) {
-    const existing = JSON.parse(fs11.readFileSync(settingsPath, "utf-8"));
+  if (fs12.existsSync(settingsPath)) {
+    const existing = JSON.parse(fs12.readFileSync(settingsPath, "utf-8"));
     const allowList = existing?.permissions?.allow || [];
     const missingPermissions = permissions.filter(
       (p) => !allowList.includes(p)
@@ -184704,39 +184780,39 @@ function configureClaudeCodePermissions() {
       existing.permissions.allow = [];
     }
     existing.permissions.allow.push(...missingPermissions);
-    fs11.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
+    fs12.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
     return "modified";
   }
-  if (!fs11.existsSync(claudeDir)) {
-    fs11.mkdirSync(claudeDir);
+  if (!fs12.existsSync(claudeDir)) {
+    fs12.mkdirSync(claudeDir);
   }
   const settings = {
     permissions: {
       allow: permissions
     }
   };
-  fs11.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  fs12.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   return "created";
 }
 function createCursorRule() {
   const cursorDir = path7.join(process.cwd(), ".cursor");
   const rulesDir = path7.join(cursorDir, "rules");
   const mdcPath = path7.join(rulesDir, "specific.mdc");
-  if (fs11.existsSync(mdcPath)) {
-    const existing = fs11.readFileSync(mdcPath, "utf-8");
+  if (fs12.existsSync(mdcPath)) {
+    const existing = fs12.readFileSync(mdcPath, "utf-8");
     if (existing.includes("specific docs") || existing.includes("specific check")) {
       return "unchanged";
     }
-    fs11.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
+    fs12.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
     return "modified";
   }
-  if (!fs11.existsSync(cursorDir)) {
-    fs11.mkdirSync(cursorDir);
+  if (!fs12.existsSync(cursorDir)) {
+    fs12.mkdirSync(cursorDir);
   }
-  if (!fs11.existsSync(rulesDir)) {
-    fs11.mkdirSync(rulesDir);
+  if (!fs12.existsSync(rulesDir)) {
+    fs12.mkdirSync(rulesDir);
   }
-  fs11.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
+  fs12.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
   return "created";
 }
 function configureAgents(checked) {
@@ -184777,6 +184853,19 @@ function configureAgents(checked) {
   }
   return { agents, git, showManualInstructions: !!checked["other"] };
 }
+function getInitialSetupPhase() {
+  if (!systemSetupNeeded()) return "agents";
+  if (os8.platform() === "darwin") {
+    if (dnsSetupNeeded()) return "setup-dns";
+    if (tlsSetupNeeded()) return "setup-tls";
+    return "agents";
+  }
+  return "setup-combined";
+}
+function getNextPhase(current) {
+  if (current === "setup-dns" && tlsSetupNeeded()) return "setup-tls";
+  return "agents";
+}
 function InitUI() {
   const { exit } = useApp();
   const [initialState] = useState(() => {
@@ -184785,45 +184874,92 @@ function InitUI() {
     return {
       detected,
       focusedIndex: hasDetected ? options.length : 0
-      // Focus submit if any detected
     };
   });
-  const [phase, setPhase] = useState(
-    () => !systemSetupNeeded() ? "agents" : "installing-ca"
+  const [phase, setPhase] = useState(getInitialSetupPhase);
+  const [stepPhase, setStepPhase] = useState(
+    () => getInitialSetupPhase() === "agents" ? "done" : "prompt"
   );
-  const [caInstallPhase, setCaInstallPhase] = useState(() => !systemSetupNeeded() ? "done" : "prompt");
+  const [stepError, setStepError] = useState();
   const [focusedIndex, setFocusedIndex] = useState(initialState.focusedIndex);
   const [checked, setChecked] = useState(
     initialState.detected
   );
   const [result, setResult] = useState(null);
-  const [tlsResult, setTlsResult] = useState(
-    !systemSetupNeeded() ? { status: "success" } : null
+  const [setupResult, setSetupResult] = useState(
+    () => !systemSetupNeeded() ? { dns: { status: "success" }, tls: { status: "success" } } : {}
   );
   useEffect(() => {
-    if (phase === "installing-ca" && caInstallPhase === "installing") {
-      installCA();
+    if (stepPhase !== "installing") return;
+    if (phase === "setup-dns") {
+      runSetupStep(
+        () => {
+          ensureCAGenerated();
+          performDnsSetup();
+        },
+        "dns"
+      );
+    } else if (phase === "setup-tls") {
+      runSetupStep(
+        () => {
+          ensureCAGenerated();
+          performTlsTrust();
+        },
+        "tls"
+      );
+    } else if (phase === "setup-combined") {
+      runSetupStep(
+        () => performSystemSetup(),
+        "combined"
+      );
     }
-  }, [phase, caInstallPhase]);
-  async function installCA() {
+  }, [phase, stepPhase]);
+  function runSetupStep(fn, type) {
     try {
-      performSystemSetup();
-      setTlsResult({ status: "success" });
-      setCaInstallPhase("done");
-      setPhase("agents");
+      fn();
+      if (type === "combined") {
+        setSetupResult((r) => ({
+          ...r,
+          dns: { status: "success" },
+          tls: { status: "success" }
+        }));
+      } else {
+        setSetupResult((r) => ({ ...r, [type]: { status: "success" } }));
+      }
+      setStepPhase("done");
+      const next = getNextPhase(phase);
+      setPhase(next);
+      if (next !== "agents") {
+        setStepPhase("prompt");
+      }
     } catch (err) {
-      setTlsResult({
-        status: "error",
-        error: err instanceof Error ? err.message : String(err)
-      });
-      setCaInstallPhase("error");
-      setPhase("agents");
+      const errorMsg = err instanceof Error ? err.message : String(err);
+      if (type === "combined") {
+        setSetupResult((r) => ({
+          ...r,
+          dns: { status: "error", error: errorMsg },
+          tls: { status: "error", error: errorMsg }
+        }));
+      } else {
+        setSetupResult((r) => ({
+          ...r,
+          [type]: { status: "error", error: errorMsg }
+        }));
+      }
+      setStepError(errorMsg);
+      setStepPhase("error");
+      const next = getNextPhase(phase);
+      setPhase(next);
+      if (next !== "agents") {
+        setStepPhase("prompt");
+        setStepError(void 0);
+      }
     }
   }
   const isSubmitFocused = focusedIndex === options.length;
   useInput((input, key) => {
-    if (phase === "installing-ca" && caInstallPhase === "prompt" && key.return) {
-      setCaInstallPhase("installing");
+    if ((phase === "setup-dns" || phase === "setup-tls" || phase === "setup-combined") && stepPhase === "prompt" && key.return) {
+      setStepPhase("installing");
       return;
     }
     if (phase !== "agents") return;
@@ -184854,11 +184990,13 @@ function InitUI() {
       return () => clearTimeout(timer);
     }
   }, [phase, exit]);
-  if (phase === "installing-ca") {
-    if (caInstallPhase === "prompt") {
-      return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "We need to do a one-time setup for all your Specific projects."), /* @__PURE__ */ React2.createElement(Text2, null, "This is so we can run your apps locally with secure URLs:"), /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "green" }, "https://your-app.spcf.localhost"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "You will be prompted to authorize with your password."), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Press ", /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Enter"), " to authorize."));
+  if (phase === "setup-dns" || phase === "setup-tls" || phase === "setup-combined") {
+    if (stepPhase === "prompt") {
+      const isDns = phase === "setup-dns";
+      const isTls = phase === "setup-tls";
+      return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React2.createElement(Text2, null, " "), (isDns || phase === "setup-combined") && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, "We need to do a one-time setup for all your Specific projects."), /* @__PURE__ */ React2.createElement(Text2, null, "This is so we can run your apps locally with secure URLs:"), /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "green" }, "https://your-app.spcf.localhost"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "You will be prompted to authorize with your password.")), isTls && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, "We need to trust a development certificate for HTTPS."), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "You will be prompted to authorize.")), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Press ", /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Enter"), " to continue."));
     }
-    if (caInstallPhase === "installing") {
+    if (stepPhase === "installing") {
       return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Awaiting authorization\u2026"));
     }
   }
@@ -184866,10 +185004,16 @@ function InitUI() {
     const selectedAgents = Object.entries(checked).filter(([, v]) => v).length;
     const agentChanges = result && (result.agents.filesCreated.length > 0 || result.agents.filesModified.length > 0);
     const gitChanges = result?.git && (result.git.filesCreated.length > 0 || result.git.filesModified.length > 0);
-    return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, tlsResult === null && /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u25CF"), " Setting up TLS and DNS..."), tlsResult?.status === "success" && /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS and DNS configured"), tlsResult?.status === "error" && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " Failed to set up TLS and DNS"), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", tlsResult.error)), result && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Coding agents configured"), result.agents.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.agents.filesCreated.join(", ")), result.agents.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.agents.filesModified.join(", ")), !agentChanges && selectedAgents > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (files already configured)"), selectedAgents === 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " No agents selected")), result?.git && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Git configured"), result.git.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.git.filesCreated.join(", ")), result.git.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.git.filesModified.join(", ")), !gitChanges && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (.gitignore already configured)")), result?.showManualInstructions && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Manual configuration selected"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " Add this to your agent's system prompt:"), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, SPECIFIC_INSTRUCTIONS), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " ", "We also recommend allowing your agent to run `specific docs *`"), /* @__PURE__ */ React2.createElement(Text2, null, " and `specific check *` without confirmation.")));
+    const setupSuccess2 = (!setupResult.dns || setupResult.dns.status === "success") && (!setupResult.tls || setupResult.tls.status === "success");
+    const setupError2 = setupResult.dns?.status === "error" || setupResult.tls?.status === "error";
+    const setupErrorMsg2 = setupResult.dns?.error || setupResult.tls?.error;
+    return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, setupSuccess2 && /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS and DNS configured"), setupError2 && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " Failed to set up TLS and DNS"), setupErrorMsg2 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "  ", setupErrorMsg2)), result && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Coding agents configured"), result.agents.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.agents.filesCreated.join(", ")), result.agents.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.agents.filesModified.join(", ")), !agentChanges && selectedAgents > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (files already configured)"), selectedAgents === 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " No agents selected")), result?.git && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Git configured"), result.git.filesCreated.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Created: ", result.git.filesCreated.join(", ")), result.git.filesModified.length > 0 && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "Modified: ", result.git.filesModified.join(", ")), !gitChanges && /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, " ", "No changes needed (.gitignore already configured)")), result?.showManualInstructions && /* @__PURE__ */ React2.createElement(React2.Fragment, null, /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " Manual configuration selected"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " Add this to your agent's system prompt:"), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, SPECIFIC_INSTRUCTIONS), /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, " ", "We also recommend allowing your agent to run `specific docs *`"), /* @__PURE__ */ React2.createElement(Text2, null, " and `specific check *` without confirmation.")));
   }
-  const tlsLine = tlsResult?.status === "success" ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS and DNS configured") : tlsResult?.status === "error" ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " TLS and DNS setup failed", " ", /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "(", tlsResult.error, ")")) : null;
-  return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, tlsLine, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u25CF"), " Configure coding agents", " ", /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "(space to select)")), /* @__PURE__ */ React2.createElement(Text2, null, " "), options.map((option, index) => {
+  const setupSuccess = (!setupResult.dns || setupResult.dns.status === "success") && (!setupResult.tls || setupResult.tls.status === "success");
+  const setupError = setupResult.dns?.status === "error" || setupResult.tls?.status === "error";
+  const setupErrorMsg = setupResult.dns?.error || setupResult.tls?.error;
+  const setupLine = setupSuccess ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "green" }, "\u2713"), " TLS and DNS configured") : setupError ? /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { color: "red" }, "\u2717"), " TLS and DNS setup failed", " ", /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "(", setupErrorMsg, ")")) : null;
+  return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, setupLine, /* @__PURE__ */ React2.createElement(Text2, null, /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "\u25CF"), " Configure coding agents", " ", /* @__PURE__ */ React2.createElement(Text2, { dimColor: true }, "(space to select)")), /* @__PURE__ */ React2.createElement(Text2, null, " "), options.map((option, index) => {
     const isFocused = focusedIndex === index;
     const isChecked = checked[option.id];
     return /* @__PURE__ */ React2.createElement(Box2, { key: option.id }, /* @__PURE__ */ React2.createElement(Text2, { ...isFocused && { color: "cyan" } }, isFocused ? "\u276F " : "  ", isChecked ? "[\u2713]" : "[ ]", " ", option.label));
@@ -184979,7 +185123,7 @@ var BETA_REGISTRY = [
 ];
 
 // src/lib/beta/storage.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, existsSync as existsSync6, mkdirSync as mkdirSync6 } from "fs";
 import { join as join7 } from "path";
 var BETAS_FILE = ".specific/betas.json";
 function loadEnabledBetas(projectDir = process.cwd()) {
@@ -185012,7 +185156,7 @@ function saveBetas(enabled, projectDir) {
     mkdirSync6(specificDir, { recursive: true });
   }
   const data = { enabled };
-  writeFileSync5(
+  writeFileSync6(
     join7(projectDir, BETAS_FILE),
     JSON.stringify(data, null, 2) + "\n"
   );
@@ -185079,7 +185223,7 @@ function resolveFilesystemDoc(path30) {
 import React3, { useState as useState2, useEffect as useEffect2 } from "react";
 import { render as render3, Text as Text3, Box as Box3 } from "ink";
 import Spinner3 from "ink-spinner";
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import * as path9 from "path";
 import { execFile as execFile7 } from "child_process";
 
@@ -185951,32 +186095,32 @@ var ExtractionError = class extends Error {
 };
 
 // src/lib/bin/manager.ts
-import * as fs12 from "fs";
+import * as fs13 from "fs";
 import * as path8 from "path";
-import * as os7 from "os";
+import * as os9 from "os";
 import { createReadStream } from "fs";
 import { createTarExtractor, extractTo } from "tar-vern";
 function getLibraryEnv(binary) {
   if (!binary.libraryPath) {
     return {};
   }
-  const platform5 = os7.platform();
-  if (platform5 === "darwin") {
+  const platform8 = os9.platform();
+  if (platform8 === "darwin") {
     return { DYLD_LIBRARY_PATH: binary.libraryPath };
-  } else if (platform5 === "linux") {
+  } else if (platform8 === "linux") {
     return { LD_LIBRARY_PATH: binary.libraryPath };
   }
   return {};
 }
 function getBinBaseDir() {
-  return path8.join(os7.homedir(), ".specific", "bin");
+  return path8.join(os9.homedir(), ".specific", "bin");
 }
 function getPlatformInfo() {
-  const platform5 = os7.platform();
-  const arch3 = os7.arch();
-  if (platform5 !== "darwin" && platform5 !== "linux") {
+  const platform8 = os9.platform();
+  const arch3 = os9.arch();
+  if (platform8 !== "darwin" && platform8 !== "linux") {
     throw new Error(
-      `Unsupported platform: ${platform5}. Only macOS and Linux are supported.`
+      `Unsupported platform: ${platform8}. Only macOS and Linux are supported.`
     );
   }
   const archStr = arch3;
@@ -185990,7 +186134,7 @@ function getPlatformInfo() {
       `Unsupported architecture: ${arch3}. Only x64 and arm64 are supported.`
     );
   }
-  return { platform: platform5, arch: mappedArch };
+  return { platform: platform8, arch: mappedArch };
 }
 function getBinaryDir(definition, version, platformInfo) {
   return path8.join(
@@ -186004,7 +186148,7 @@ function isBinaryInstalled(definition, version, platformInfo) {
   const binDir = getBinaryDir(definition, version, platformInfo);
   for (const execPath of definition.executables) {
     const fullPath = path8.join(binDir, execPath);
-    if (!fs12.existsSync(fullPath)) {
+    if (!fs13.existsSync(fullPath)) {
       return false;
     }
   }
@@ -186033,11 +186177,11 @@ async function downloadFile(url, destPath, onProgress) {
   );
   let bytesDownloaded = 0;
   const parentDir = path8.dirname(destPath);
-  if (!fs12.existsSync(parentDir)) {
-    fs12.mkdirSync(parentDir, { recursive: true });
+  if (!fs13.existsSync(parentDir)) {
+    fs13.mkdirSync(parentDir, { recursive: true });
   }
   const partPath = destPath + ".part";
-  const fileStream = fs12.createWriteStream(partPath);
+  const fileStream = fs13.createWriteStream(partPath);
   try {
     const reader = response.body.getReader();
     while (true) {
@@ -186060,12 +186204,12 @@ async function downloadFile(url, destPath, onProgress) {
         else resolve9();
       });
     });
-    fs12.renameSync(partPath, destPath);
+    fs13.renameSync(partPath, destPath);
   } catch (error) {
     try {
       fileStream.close();
-      if (fs12.existsSync(partPath)) {
-        fs12.unlinkSync(partPath);
+      if (fs13.existsSync(partPath)) {
+        fs13.unlinkSync(partPath);
       }
     } catch {
     }
@@ -186074,8 +186218,8 @@ async function downloadFile(url, destPath, onProgress) {
 }
 async function extractTarball(archivePath, destDir, definition, onProgress) {
   onProgress?.({ phase: "extracting" });
-  if (!fs12.existsSync(destDir)) {
-    fs12.mkdirSync(destDir, { recursive: true });
+  if (!fs13.existsSync(destDir)) {
+    fs13.mkdirSync(destDir, { recursive: true });
   }
   try {
     const fileStream = createReadStream(archivePath);
@@ -186084,8 +186228,8 @@ async function extractTarball(archivePath, destDir, definition, onProgress) {
     onProgress?.({ phase: "finalizing" });
     for (const execPath of definition.executables) {
       const fullPath = path8.join(destDir, execPath);
-      if (fs12.existsSync(fullPath)) {
-        fs12.chmodSync(fullPath, 493);
+      if (fs13.existsSync(fullPath)) {
+        fs13.chmodSync(fullPath, 493);
       }
     }
   } catch (error) {
@@ -186109,12 +186253,12 @@ async function ensureBinary(definition, version, onProgress) {
           `Binary type definitions must have exactly one executable, got ${definition.executables.length}`
         );
       }
-      if (!fs12.existsSync(binDir)) {
-        fs12.mkdirSync(binDir, { recursive: true });
+      if (!fs13.existsSync(binDir)) {
+        fs13.mkdirSync(binDir, { recursive: true });
       }
       const execPath = path8.join(binDir, definition.executables[0]);
       await downloadFile(url, execPath, onProgress);
-      fs12.chmodSync(execPath, 493);
+      fs13.chmodSync(execPath, 493);
       onProgress?.({ phase: "finalizing" });
     } else {
       const downloadDir = path8.join(getBinBaseDir(), "downloads");
@@ -186125,8 +186269,8 @@ async function ensureBinary(definition, version, onProgress) {
         await extractTarball(archivePath, binDir, definition, onProgress);
       } finally {
         try {
-          if (fs12.existsSync(archivePath)) {
-            fs12.unlinkSync(archivePath);
+          if (fs13.existsSync(archivePath)) {
+            fs13.unlinkSync(archivePath);
           }
         } catch {
         }
@@ -186302,20 +186446,20 @@ function CheckUI() {
   useEffect2(() => {
     async function load() {
       const configPath = path9.join(process.cwd(), "specific.hcl");
-      if (!fs13.existsSync(configPath)) {
+      if (!fs14.existsSync(configPath)) {
         setState({
           status: "error",
           error: "No specific.hcl found in current directory"
         });
         return;
       }
-      const hcl = fs13.readFileSync(configPath, "utf-8");
+      const hcl = fs14.readFileSync(configPath, "utf-8");
       try {
         const config2 = await parseConfig(hcl);
         for (const build of config2.builds) {
           if (build.dockerfile) {
             const dockerfilePath = path9.resolve(process.cwd(), build.dockerfile);
-            if (!fs13.existsSync(dockerfilePath)) {
+            if (!fs14.existsSync(dockerfilePath)) {
               setState({
                 status: "error",
                 error: `Build "${build.name}": Dockerfile not found at "${build.dockerfile}" (resolved to ${dockerfilePath})`
@@ -186331,7 +186475,7 @@ function CheckUI() {
               process.cwd(),
               pg.reshape.migrations_dir ?? "migrations"
             );
-            if (!fs13.existsSync(migrationsDir)) {
+            if (!fs14.existsSync(migrationsDir)) {
               reshapeChecks2.push({
                 databaseName: pg.name,
                 migrationsDir: pg.reshape.migrations_dir ?? "migrations",
@@ -186384,7 +186528,8 @@ function checkCommand() {
 import React6, { useState as useState5, useEffect as useEffect3, useRef } from "react";
 import { render as render4, Text as Text6, Box as Box6, useApp as useApp2, Static, useInput as useInput4 } from "ink";
 import Spinner4 from "ink-spinner";
-import * as fs23 from "fs";
+import * as fs24 from "fs";
+import * as os11 from "os";
 import * as path20 from "path";
 
 // node_modules/.pnpm/chokidar@5.0.0/node_modules/chokidar/index.js
@@ -188139,7 +188284,7 @@ var PortAllocator = class {
 };
 
 // src/lib/dev/stable-port-allocator.ts
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 import * as path10 from "path";
 var PORT_RANGE_START2 = 4e4;
 var PORT_RANGE_END2 = 49999;
@@ -188154,11 +188299,11 @@ var StablePortAllocator = class {
     this.loadPorts();
   }
   loadPorts() {
-    if (!fs14.existsSync(this.portsFilePath)) {
+    if (!fs15.existsSync(this.portsFilePath)) {
       return;
     }
     try {
-      const content = fs14.readFileSync(this.portsFilePath, "utf-8");
+      const content = fs15.readFileSync(this.portsFilePath, "utf-8");
       const data = JSON.parse(content);
       if (data.version === 1 && data.ports) {
         this.savedPorts = data.ports;
@@ -188171,14 +188316,14 @@ var StablePortAllocator = class {
     }
   }
   savePorts() {
-    if (!fs14.existsSync(this.portsDir)) {
-      fs14.mkdirSync(this.portsDir, { recursive: true });
+    if (!fs15.existsSync(this.portsDir)) {
+      fs15.mkdirSync(this.portsDir, { recursive: true });
     }
     const data = {
       version: 1,
       ports: this.savedPorts
     };
-    fs14.writeFileSync(this.portsFilePath, JSON.stringify(data, null, 2));
+    fs15.writeFileSync(this.portsFilePath, JSON.stringify(data, null, 2));
   }
   allocateRandom() {
     const rangeSize = PORT_RANGE_END2 - PORT_RANGE_START2 + 1;
@@ -188205,7 +188350,7 @@ var StablePortAllocator = class {
 };
 
 // src/lib/dev/database-manager.ts
-import * as fs15 from "fs";
+import * as fs16 from "fs";
 import * as path11 from "path";
 import * as net from "net";
 import { spawn } from "child_process";
@@ -188217,9 +188362,9 @@ async function startPostgres(pg, port, dataDir, onProgress) {
   const password = "postgres";
   const libraryEnv = getLibraryEnv(binary);
   const env2 = { ...process.env, ...libraryEnv };
-  const dataExists = fs15.existsSync(dbDataPath);
+  const dataExists = fs16.existsSync(dbDataPath);
   if (!dataExists) {
-    fs15.mkdirSync(dbDataPath, { recursive: true });
+    fs16.mkdirSync(dbDataPath, { recursive: true });
     await runCommand(
       binary.executables["initdb"],
       ["-D", dbDataPath, "-U", user, "--auth=trust", "--no-locale", "-E", "UTF8"],
@@ -188296,8 +188441,8 @@ async function startRedis(redis, port, onProgress) {
 async function startStorage(storage, port, dataDir) {
   const S3rver = (await import("s3rver")).default;
   const storageDataPath = path11.join(process.cwd(), dataDir, storage.name);
-  if (!fs15.existsSync(storageDataPath)) {
-    fs15.mkdirSync(storageDataPath, { recursive: true });
+  if (!fs16.existsSync(storageDataPath)) {
+    fs16.mkdirSync(storageDataPath, { recursive: true });
   }
   const host = "127.0.0.1";
   const accessKey = "S3RVER";
@@ -188827,9 +188972,11 @@ function resolveEnv(env2, resources, secrets, configs, servicePort, serviceEndpo
 }
 function resolveEnvForExec(env2, resources, secrets, configs) {
   if (!env2) {
-    return {};
+    return { env: {}, missingSecrets: [], missingConfigs: [] };
   }
   const resolved = {};
+  const missingSecrets = [];
+  const missingConfigs = [];
   for (const [key, value] of Object.entries(env2)) {
     if (typeof value === "string") {
       resolved[key] = value;
@@ -188845,12 +188992,20 @@ function resolveEnvForExec(env2, resources, secrets, configs) {
       if (hasSkippableRef) {
         continue;
       }
+    }
+    try {
       resolved[key] = resolveEnvValue(value, resources, secrets, configs);
-      continue;
+    } catch (err) {
+      if (err instanceof MissingSecretError) {
+        missingSecrets.push({ name: err.secretName, envVar: key });
+      } else if (err instanceof MissingConfigError) {
+        missingConfigs.push({ name: err.configName, envVar: key });
+      } else {
+        throw err;
+      }
     }
-    resolved[key] = resolveEnvValue(value, resources, secrets, configs);
   }
-  return resolved;
+  return { env: resolved, missingSecrets, missingConfigs };
 }
 
 // src/lib/dev/service-runner.ts
@@ -188940,7 +189095,7 @@ function startService(service, resources, secrets, configs, endpointPorts, servi
 }
 
 // src/lib/dev/instance-state.ts
-import * as fs16 from "fs";
+import * as fs17 from "fs";
 import * as path12 from "path";
 var InstanceStateManager = class {
   stateDir;
@@ -188958,8 +189113,8 @@ var InstanceStateManager = class {
     return this.key;
   }
   ensureStateDir() {
-    if (!fs16.existsSync(this.stateDir)) {
-      fs16.mkdirSync(this.stateDir, { recursive: true });
+    if (!fs17.existsSync(this.stateDir)) {
+      fs17.mkdirSync(this.stateDir, { recursive: true });
     }
   }
   isProcessRunning(pid) {
@@ -188976,15 +189131,15 @@ var InstanceStateManager = class {
     const startTime = Date.now();
     while (Date.now() - startTime < timeoutMs) {
       try {
-        const fd = fs16.openSync(
+        const fd = fs17.openSync(
           this.lockPath,
-          fs16.constants.O_CREAT | fs16.constants.O_EXCL | fs16.constants.O_WRONLY
+          fs17.constants.O_CREAT | fs17.constants.O_EXCL | fs17.constants.O_WRONLY
         );
-        fs16.writeSync(fd, String(process.pid));
-        fs16.closeSync(fd);
+        fs17.writeSync(fd, String(process.pid));
+        fs17.closeSync(fd);
         return () => {
           try {
-            fs16.unlinkSync(this.lockPath);
+            fs17.unlinkSync(this.lockPath);
           } catch {
           }
         };
@@ -188993,16 +189148,16 @@ var InstanceStateManager = class {
         if (err.code === "EEXIST") {
           try {
             const lockPid = parseInt(
-              fs16.readFileSync(this.lockPath, "utf-8").trim(),
+              fs17.readFileSync(this.lockPath, "utf-8").trim(),
               10
             );
             if (!this.isProcessRunning(lockPid)) {
-              fs16.unlinkSync(this.lockPath);
+              fs17.unlinkSync(this.lockPath);
               continue;
             }
           } catch {
             try {
-              fs16.unlinkSync(this.lockPath);
+              fs17.unlinkSync(this.lockPath);
             } catch {
             }
             continue;
@@ -189016,12 +189171,12 @@ var InstanceStateManager = class {
     throw new Error("Failed to acquire state lock (timeout)");
   }
   async getExistingInstances() {
-    if (!fs16.existsSync(this.statePath)) {
+    if (!fs17.existsSync(this.statePath)) {
       return null;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs16.readFileSync(this.statePath, "utf-8");
+      const content = fs17.readFileSync(this.statePath, "utf-8");
       const state = JSON.parse(content);
       if (!this.isProcessRunning(state.owner.pid)) {
         return null;
@@ -189034,21 +189189,21 @@ var InstanceStateManager = class {
     }
   }
   async cleanStaleState() {
-    if (!fs16.existsSync(this.statePath)) {
+    if (!fs17.existsSync(this.statePath)) {
       return false;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs16.readFileSync(this.statePath, "utf-8");
+      const content = fs17.readFileSync(this.statePath, "utf-8");
       const state = JSON.parse(content);
       if (!this.isProcessRunning(state.owner.pid)) {
-        fs16.unlinkSync(this.statePath);
+        fs17.unlinkSync(this.statePath);
         return true;
       }
       return false;
     } catch {
       try {
-        fs16.unlinkSync(this.statePath);
+        fs17.unlinkSync(this.statePath);
         return true;
       } catch {
       }
@@ -189060,8 +189215,8 @@ var InstanceStateManager = class {
   async claimOwnership(command) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs16.existsSync(this.statePath)) {
-        const content = fs16.readFileSync(this.statePath, "utf-8");
+      if (fs17.existsSync(this.statePath)) {
+        const content = fs17.readFileSync(this.statePath, "utf-8");
         const state2 = JSON.parse(content);
         if (this.isProcessRunning(state2.owner.pid)) {
           throw new Error(`Instances already owned by PID ${state2.owner.pid}`);
@@ -189130,8 +189285,8 @@ var InstanceStateManager = class {
     }
     const releaseLock = await this.acquireLock();
     try {
-      if (fs16.existsSync(this.statePath)) {
-        fs16.unlinkSync(this.statePath);
+      if (fs17.existsSync(this.statePath)) {
+        fs17.unlinkSync(this.statePath);
       }
       this.ownsInstances = false;
     } finally {
@@ -189139,21 +189294,21 @@ var InstanceStateManager = class {
     }
   }
   readState() {
-    const content = fs16.readFileSync(this.statePath, "utf-8");
+    const content = fs17.readFileSync(this.statePath, "utf-8");
     return JSON.parse(content);
   }
   writeStateAtomic(state) {
     this.ensureStateDir();
     const tmpPath = this.statePath + ".tmp";
-    fs16.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs16.renameSync(tmpPath, this.statePath);
+    fs17.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs17.renameSync(tmpPath, this.statePath);
   }
 };
 
 // src/lib/dev/http-proxy.ts
 import * as http from "http";
 import * as https from "https";
-import * as fs17 from "fs";
+import * as fs18 from "fs";
 import * as path13 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import httpProxy from "http-proxy";
@@ -189576,10 +189731,10 @@ function serveFilesystemFile(res, pathname) {
     res.end("<h1>Forbidden</h1>");
     return;
   }
-  if (fs17.existsSync(resolvedPath)) {
-    if (fs17.statSync(resolvedPath).isDirectory()) {
+  if (fs18.existsSync(resolvedPath)) {
+    if (fs18.statSync(resolvedPath).isDirectory()) {
       const indexPath2 = path13.join(resolvedPath, "index.html");
-      if (fs17.existsSync(indexPath2)) {
+      if (fs18.existsSync(indexPath2)) {
         return serveFile(res, indexPath2);
       }
     } else {
@@ -189587,15 +189742,15 @@ function serveFilesystemFile(res, pathname) {
     }
   }
   const htmlPath = resolvedPath + ".html";
-  if (fs17.existsSync(htmlPath)) {
+  if (fs18.existsSync(htmlPath)) {
     return serveFile(res, htmlPath);
   }
   const indexPath = path13.join(resolvedPath, "index.html");
-  if (fs17.existsSync(indexPath)) {
+  if (fs18.existsSync(indexPath)) {
     return serveFile(res, indexPath);
   }
   const notFoundPath = path13.join(adminDir, "404.html");
-  if (fs17.existsSync(notFoundPath)) {
+  if (fs18.existsSync(notFoundPath)) {
     return serveFileContent(res, notFoundPath, "text/html", 404);
   }
   res.writeHead(404, { "Content-Type": "text/html" });
@@ -189608,7 +189763,7 @@ function serveFile(res, filePath) {
 }
 function serveFileContent(res, filePath, contentType, statusCode = 200) {
   try {
-    const content = fs17.readFileSync(filePath);
+    const content = fs18.readFileSync(filePath);
     res.writeHead(statusCode, { "Content-Type": contentType });
     res.end(content);
   } catch (err) {
@@ -189983,7 +190138,7 @@ async function startMailServer(mail, smtpPort, apiPort) {
 
 // src/lib/dev/drizzle-gateway-manager.ts
 import * as net3 from "net";
-import * as fs18 from "fs";
+import * as fs19 from "fs";
 import * as path15 from "path";
 import { spawn as spawn4 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -190017,12 +190172,12 @@ async function startDrizzleGateway(postgresInstances, port, configDir, options2)
   );
   const host = "127.0.0.1";
   const drizzleConfigDir = path15.join(configDir, "drizzle-gateway");
-  if (!fs18.existsSync(drizzleConfigDir)) {
-    fs18.mkdirSync(drizzleConfigDir, { recursive: true });
+  if (!fs19.existsSync(drizzleConfigDir)) {
+    fs19.mkdirSync(drizzleConfigDir, { recursive: true });
   }
   const storeJson = generateStoreJson(postgresInstances);
   const storeJsonPath = path15.join(drizzleConfigDir, "store.json");
-  fs18.writeFileSync(storeJsonPath, JSON.stringify(storeJson, null, 2));
+  fs19.writeFileSync(storeJsonPath, JSON.stringify(storeJson, null, 2));
   writeLog("drizzle-gateway", `Starting Drizzle Gateway`);
   writeLog("drizzle-gateway", `STORE_PATH: ${drizzleConfigDir}`);
   writeLog("drizzle-gateway", `PORT: ${port}`);
@@ -190124,16 +190279,16 @@ function detectSyncDatabases(config) {
 }
 
 // src/lib/dev/reshape-watcher.ts
-import * as fs19 from "fs";
+import * as fs20 from "fs";
 import * as path16 from "path";
 import { spawnSync } from "child_process";
 function getMigrationFiles(dir, log) {
   log(`Scanning migrations directory: ${dir}`);
-  if (!fs19.existsSync(dir)) {
+  if (!fs20.existsSync(dir)) {
     log(`Migrations directory does not exist: ${dir}`);
     return [];
   }
-  const files = fs19.readdirSync(dir);
+  const files = fs20.readdirSync(dir);
   log(`Found ${files.length} files in directory`);
   const tomlFiles = files.filter((f) => f.endsWith(".toml")).sort((a, b) => a.localeCompare(b));
   log(`Found ${tomlFiles.length} .toml migration files: ${tomlFiles.join(", ") || "(none)"}`);
@@ -190183,7 +190338,7 @@ function runReshape(args, databaseUrl, migrationsDir, reshapeBinaryPath, log) {
 }
 function makeReadOnly(filePath, log) {
   try {
-    fs19.chmodSync(filePath, 292);
+    fs20.chmodSync(filePath, 292);
     log(`Set file permissions to read-only (444): ${filePath}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -190269,9 +190424,9 @@ function createReshapeWatcher(options2) {
   };
   const startWatching = () => {
     log(`Starting file watcher for migrations directory...`);
-    if (!fs19.existsSync(migrationsDir)) {
+    if (!fs20.existsSync(migrationsDir)) {
       log(`Migrations directory does not exist, creating: ${migrationsDir}`);
-      fs19.mkdirSync(migrationsDir, { recursive: true });
+      fs20.mkdirSync(migrationsDir, { recursive: true });
     }
     log(`Watching directory: ${migrationsDir}`);
     watcher = chokidar_default.watch(migrationsDir, {
@@ -190406,7 +190561,7 @@ function createReshapeWatcher(options2) {
 }
 
 // src/lib/dev/temporal-manager.ts
-import * as fs20 from "fs";
+import * as fs21 from "fs";
 import * as path17 from "path";
 import * as net4 from "net";
 import { spawn as spawn5 } from "child_process";
@@ -190414,8 +190569,8 @@ async function startTemporalDevServer(temporals, grpcPort, uiPort, dataDir, onPr
   const binary = await ensureBinary(temporalBinary, void 0, onProgress);
   const dbPath = path17.join(process.cwd(), dataDir, "temporal.db");
   const dbDir = path17.dirname(dbPath);
-  if (!fs20.existsSync(dbDir)) {
-    fs20.mkdirSync(dbDir, { recursive: true });
+  if (!fs21.existsSync(dbDir)) {
+    fs21.mkdirSync(dbDir, { recursive: true });
   }
   const host = "127.0.0.1";
   const namespaceArgs = temporals.flatMap((t) => ["--namespace", t.name]);
@@ -190744,7 +190899,7 @@ function watchConfigFile(configPath, debounceMs, onChange) {
 }
 
 // src/lib/dev/subdomain-generator.ts
-import * as fs21 from "fs";
+import * as fs22 from "fs";
 import * as path18 from "path";
 import { generateSlug } from "random-word-slugs";
 var StableSubdomainAllocator = class {
@@ -190757,11 +190912,11 @@ var StableSubdomainAllocator = class {
     this.loadTunnels();
   }
   loadTunnels() {
-    if (!fs21.existsSync(this.tunnelsFilePath)) {
+    if (!fs22.existsSync(this.tunnelsFilePath)) {
       return;
     }
     try {
-      const content = fs21.readFileSync(this.tunnelsFilePath, "utf-8");
+      const content = fs22.readFileSync(this.tunnelsFilePath, "utf-8");
       const data = JSON.parse(content);
       if (data.version === 1 && data.baseSlug) {
         this.baseSlug = data.baseSlug;
@@ -190771,14 +190926,14 @@ var StableSubdomainAllocator = class {
     }
   }
   saveTunnels() {
-    if (!fs21.existsSync(this.tunnelsDir)) {
-      fs21.mkdirSync(this.tunnelsDir, { recursive: true });
+    if (!fs22.existsSync(this.tunnelsDir)) {
+      fs22.mkdirSync(this.tunnelsDir, { recursive: true });
     }
     const data = {
       version: 1,
       baseSlug: this.baseSlug
     };
-    fs21.writeFileSync(this.tunnelsFilePath, JSON.stringify(data, null, 2));
+    fs22.writeFileSync(this.tunnelsFilePath, JSON.stringify(data, null, 2));
   }
   generateBaseSlug() {
     return generateSlug(2, {
@@ -190934,9 +191089,9 @@ async function startTunnel(serviceName, endpointName, port, subdomain, callbacks
 }
 
 // src/lib/dev/proxy-registry.ts
-import * as fs22 from "fs";
+import * as fs23 from "fs";
 import * as path19 from "path";
-import * as os8 from "os";
+import * as os10 from "os";
 import * as net6 from "net";
 var ProxyRegistryManager = class {
   proxyDir;
@@ -190946,14 +191101,14 @@ var ProxyRegistryManager = class {
   isOwner = false;
   registryWatcher = null;
   constructor() {
-    this.proxyDir = path19.join(os8.homedir(), ".specific", "proxy");
+    this.proxyDir = path19.join(os10.homedir(), ".specific", "proxy");
     this.ownerPath = path19.join(this.proxyDir, "owner.json");
     this.registryPath = path19.join(this.proxyDir, "registry.json");
     this.lockPath = path19.join(this.proxyDir, "registry.lock");
   }
   ensureProxyDir() {
-    if (!fs22.existsSync(this.proxyDir)) {
-      fs22.mkdirSync(this.proxyDir, { recursive: true });
+    if (!fs23.existsSync(this.proxyDir)) {
+      fs23.mkdirSync(this.proxyDir, { recursive: true });
     }
   }
   isProcessRunning(pid) {
@@ -191010,15 +191165,15 @@ var ProxyRegistryManager = class {
     const startTime = Date.now();
     while (Date.now() - startTime < timeoutMs) {
       try {
-        const fd = fs22.openSync(
+        const fd = fs23.openSync(
           this.lockPath,
-          fs22.constants.O_CREAT | fs22.constants.O_EXCL | fs22.constants.O_WRONLY
+          fs23.constants.O_CREAT | fs23.constants.O_EXCL | fs23.constants.O_WRONLY
         );
-        fs22.writeSync(fd, String(process.pid));
-        fs22.closeSync(fd);
+        fs23.writeSync(fd, String(process.pid));
+        fs23.closeSync(fd);
         return () => {
           try {
-            fs22.unlinkSync(this.lockPath);
+            fs23.unlinkSync(this.lockPath);
           } catch {
           }
         };
@@ -191027,16 +191182,16 @@ var ProxyRegistryManager = class {
         if (err.code === "EEXIST") {
           try {
             const lockPid = parseInt(
-              fs22.readFileSync(this.lockPath, "utf-8").trim(),
+              fs23.readFileSync(this.lockPath, "utf-8").trim(),
               10
             );
             if (!this.isProcessRunning(lockPid)) {
-              fs22.unlinkSync(this.lockPath);
+              fs23.unlinkSync(this.lockPath);
               continue;
             }
           } catch {
             try {
-              fs22.unlinkSync(this.lockPath);
+              fs23.unlinkSync(this.lockPath);
             } catch {
             }
             continue;
@@ -191056,8 +191211,8 @@ var ProxyRegistryManager = class {
   async claimProxyOwnership(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs22.existsSync(this.ownerPath)) {
-        const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      if (fs23.existsSync(this.ownerPath)) {
+        const content = fs23.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
@@ -191087,11 +191242,11 @@ var ProxyRegistryManager = class {
     }
     const releaseLock = await this.acquireLock();
     try {
-      if (fs22.existsSync(this.ownerPath)) {
-        const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      if (fs23.existsSync(this.ownerPath)) {
+        const content = fs23.readFileSync(this.ownerPath, "utf-8");
         const ownerFile = JSON.parse(content);
         if (ownerFile.owner.pid === process.pid) {
-          fs22.unlinkSync(this.ownerPath);
+          fs23.unlinkSync(this.ownerPath);
         }
       }
       this.isOwner = false;
@@ -191103,12 +191258,12 @@ var ProxyRegistryManager = class {
    * Get the current proxy owner.
    */
   async getProxyOwner() {
-    if (!fs22.existsSync(this.ownerPath)) {
+    if (!fs23.existsSync(this.ownerPath)) {
       return null;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      const content = fs23.readFileSync(this.ownerPath, "utf-8");
       const ownerFile = JSON.parse(content);
       if (!await this.isProxyOwnerHealthy(ownerFile.owner.pid)) {
         return null;
@@ -191205,7 +191360,7 @@ var ProxyRegistryManager = class {
    */
   watchRegistry(onChange) {
     this.ensureProxyDir();
-    if (!fs22.existsSync(this.registryPath)) {
+    if (!fs23.existsSync(this.registryPath)) {
       const emptyRegistry = {
         version: 1,
         keys: {},
@@ -191248,13 +191403,13 @@ var ProxyRegistryManager = class {
   async attemptElection(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs22.existsSync(this.ownerPath)) {
-        const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      if (fs23.existsSync(this.ownerPath)) {
+        const content = fs23.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
         }
-        fs22.unlinkSync(this.ownerPath);
+        fs23.unlinkSync(this.ownerPath);
       }
       const ownerFile = {
         version: 1,
@@ -191272,7 +191427,7 @@ var ProxyRegistryManager = class {
     }
   }
   readRegistry() {
-    if (!fs22.existsSync(this.registryPath)) {
+    if (!fs23.existsSync(this.registryPath)) {
       return {
         version: 1,
         keys: {},
@@ -191280,7 +191435,7 @@ var ProxyRegistryManager = class {
       };
     }
     try {
-      const content = fs22.readFileSync(this.registryPath, "utf-8");
+      const content = fs23.readFileSync(this.registryPath, "utf-8");
       return JSON.parse(content);
     } catch {
       return {
@@ -191293,8 +191448,8 @@ var ProxyRegistryManager = class {
   writeFileAtomic(filePath, data) {
     this.ensureProxyDir();
     const tmpPath = filePath + ".tmp";
-    fs22.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
-    fs22.renameSync(tmpPath, filePath);
+    fs23.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+    fs23.renameSync(tmpPath, filePath);
   }
 };
 
@@ -191401,9 +191556,17 @@ function DevUI({ instanceKey, tunnelEnabled }) {
   const { exit } = useApp2();
   const [state, setState] = useState5(() => {
     const setupDone = tunnelEnabled || !systemSetupNeeded();
+    let setupStep;
+    if (!setupDone) {
+      if (os11.platform() === "darwin") {
+        setupStep = dnsSetupNeeded() ? "setup-dns" : "setup-tls";
+      } else {
+        setupStep = "setup-combined";
+      }
+    }
     return {
-      status: setupDone ? "loading" : "installing-ca",
-      ...setupDone ? {} : { caInstallPhase: "prompt" },
+      status: setupDone ? "loading" : "setup",
+      ...setupStep ? { setupStep, setupStepPhase: "prompt" } : {},
       resources: /* @__PURE__ */ new Map(),
       resourceStatus: /* @__PURE__ */ new Map(),
       services: [],
@@ -191415,28 +191578,41 @@ function DevUI({ instanceKey, tunnelEnabled }) {
     };
   });
   useEffect3(() => {
-    if (state.status === "installing-ca" && state.caInstallPhase === "installing") {
-      installSystemConfig();
-    }
-  }, [state.status, state.caInstallPhase]);
-  useInput4((_input, key) => {
-    if (key.return) {
-      setState((s) => ({ ...s, caInstallPhase: "installing" }));
-    }
-  }, { isActive: state.status === "installing-ca" && state.caInstallPhase === "prompt" });
-  async function installSystemConfig() {
+    if (state.status !== "setup" || state.setupStepPhase !== "installing") return;
     try {
-      performSystemSetup();
-      setState((s) => ({ ...s, status: "loading", caInstallPhase: "done" }));
-      setReadyToStart(true);
+      if (state.setupStep === "setup-dns") {
+        ensureCAGenerated();
+        performDnsSetup();
+      } else if (state.setupStep === "setup-tls") {
+        ensureCAGenerated();
+        performTlsTrust();
+      } else if (state.setupStep === "setup-combined") {
+        performSystemSetup();
+      }
+      const nextStep = state.setupStep === "setup-dns" && tlsSetupNeeded() ? "setup-tls" : void 0;
+      if (nextStep) {
+        setState((s) => ({
+          ...s,
+          setupStep: nextStep,
+          setupStepPhase: "prompt"
+        }));
+      } else {
+        setState((s) => ({ ...s, status: "loading", setupStepPhase: "done" }));
+        setReadyToStart(true);
+      }
     } catch (err) {
       setState((s) => ({
         ...s,
-        caInstallPhase: "error",
-        caError: err instanceof Error ? err.message : String(err)
+        setupStepPhase: "error",
+        setupError: err instanceof Error ? err.message : String(err)
       }));
     }
-  }
+  }, [state.status, state.setupStepPhase]);
+  useInput4((_input, key) => {
+    if (state.status === "setup" && state.setupStepPhase === "prompt" && key.return) {
+      setState((s) => ({ ...s, setupStepPhase: "installing" }));
+    }
+  });
   const shuttingDown = useRef(false);
   const startTimeRef = useRef(null);
   const stateManagerRef = useRef(null);
@@ -191617,7 +191793,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
     const configPath = path20.join(process.cwd(), "specific.hcl");
     const watcher = watchConfigFile(configPath, 1e3, () => {
       try {
-        const hcl = fs23.readFileSync(configPath, "utf-8");
+        const hcl = fs24.readFileSync(configPath, "utf-8");
         parseConfig(hcl).then(() => {
           triggerReload();
         }).catch((err) => {
@@ -191743,7 +191919,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
         return;
       }
       const configPath = path20.join(process.cwd(), "specific.hcl");
-      if (!fs23.existsSync(configPath)) {
+      if (!fs24.existsSync(configPath)) {
         writeLog("system", "Waiting for specific.hcl to appear");
         setState((s) => ({
           ...s,
@@ -191761,7 +191937,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
         return;
       }
       let config2;
-      const hcl = fs23.readFileSync(configPath, "utf-8");
+      const hcl = fs24.readFileSync(configPath, "utf-8");
       try {
         config2 = await parseConfig(hcl);
       } catch (err) {
@@ -192088,7 +192264,7 @@ Add them to the config block in specific.local`);
           if (service.volumes) {
             for (const vol of service.volumes) {
               const volumeDir = path20.resolve(`.specific/keys/${instanceKey}/data/volumes/${service.name}/${vol.name}`);
-              fs23.mkdirSync(volumeDir, { recursive: true });
+              fs24.mkdirSync(volumeDir, { recursive: true });
               volumePaths.set(vol.name, volumeDir);
             }
           }
@@ -192144,7 +192320,7 @@ Add them to the config block in specific.local`);
             if (service.volumes) {
               for (const vol of service.volumes) {
                 const volumeDir = path20.resolve(`.specific/keys/${instanceKey}/data/volumes/${service.name}/${vol.name}`);
-                fs23.mkdirSync(volumeDir, { recursive: true });
+                fs24.mkdirSync(volumeDir, { recursive: true });
                 volumePaths.set(vol.name, volumeDir);
               }
             }
@@ -192437,15 +192613,17 @@ Add them to the config block in specific.local`);
       });
     };
   }, [reloadTrigger, readyToStart, instanceKey]);
-  if (state.status === "installing-ca") {
-    if (state.caInstallPhase === "prompt") {
-      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "We need to do a one-time setup for all your Specific projects."), /* @__PURE__ */ React6.createElement(Text6, null, "This is so we can run your apps locally with secure URLs:"), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "green" }, "https://your-app.spcf.localhost"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "You will be prompted to authorize with your password."), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Press ", /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Enter"), " to authorize."));
+  if (state.status === "setup") {
+    if (state.setupStepPhase === "prompt") {
+      const isDns = state.setupStep === "setup-dns";
+      const isTls = state.setupStep === "setup-tls";
+      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React6.createElement(Text6, null, " "), (isDns || state.setupStep === "setup-combined") && /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, null, "We need to do a one-time setup for all your Specific projects."), /* @__PURE__ */ React6.createElement(Text6, null, "This is so we can run your apps locally with secure URLs:"), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "green" }, "https://your-app.spcf.localhost"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "You will be prompted to authorize with your password.")), isTls && /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, null, "We need to trust a development certificate for HTTPS."), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "You will be prompted to authorize.")), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Press ", /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Enter"), " to continue."));
     }
-    if (state.caInstallPhase === "installing") {
+    if (state.setupStepPhase === "installing") {
       return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Awaiting authorization\u2026"));
     }
-    if (state.caInstallPhase === "error") {
-      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { color: "red" }, "Setup failed: ", state.caError));
+    if (state.setupStepPhase === "error") {
+      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { color: "red" }, "Setup failed: ", state.setupError));
     }
   }
   if (state.status === "loading") {
@@ -192724,12 +192902,12 @@ init_open();
 import React7, { useState as useState6, useEffect as useEffect4, useCallback } from "react";
 import { render as render5, Text as Text7, Box as Box7, useApp as useApp3, useInput as useInput5 } from "ink";
 import Spinner5 from "ink-spinner";
-import * as fs25 from "fs";
+import * as fs26 from "fs";
 import * as path23 from "path";
 
 // src/lib/tarball/create.ts
 import { execSync as execSync4 } from "child_process";
-import * as fs24 from "fs";
+import * as fs25 from "fs";
 import * as path22 from "path";
 import { createTarPacker, createEntryItemGenerator } from "tar-vern";
 function isInsideGitRepository(dir) {
@@ -192787,7 +192965,7 @@ var EXCLUDED_DIRS = [
 ];
 async function collectPaths(baseDir, currentDir, exclude) {
   const results = [];
-  const entries = await fs24.promises.readdir(currentDir, { withFileTypes: true });
+  const entries = await fs25.promises.readdir(currentDir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path22.join(currentDir, entry.name);
     const relativePath = path22.relative(baseDir, fullPath);
@@ -192806,7 +192984,7 @@ async function collectPaths(baseDir, currentDir, exclude) {
 async function createTarArchive(projectDir) {
   writeLog("tarball", "Creating tarball using tar-vern (non-git project)");
   const configPath = path22.join(projectDir, "specific.hcl");
-  if (!fs24.existsSync(configPath)) {
+  if (!fs25.existsSync(configPath)) {
     throw new Error("specific.hcl not found in project directory");
   }
   const relativePaths = await collectPaths(projectDir, projectDir, EXCLUDED_DIRS);
@@ -193728,12 +193906,12 @@ function DeployUI({ environment, config }) {
 }
 async function deployCommand(environment) {
   const configPath = path23.join(process.cwd(), "specific.hcl");
-  if (!fs25.existsSync(configPath)) {
+  if (!fs26.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
-  const hcl = fs25.readFileSync(configPath, "utf-8");
+  const hcl = fs26.readFileSync(configPath, "utf-8");
   try {
     config = await parseConfig(hcl);
   } catch (err) {
@@ -193754,8 +193932,21 @@ async function deployCommand(environment) {
 
 // src/commands/exec.tsx
 import { spawn as spawn6 } from "child_process";
-import * as fs26 from "fs";
+import * as fs27 from "fs";
 import * as path24 from "path";
+function startSpinner(text) {
+  const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  let i = 0;
+  const interval = setInterval(() => {
+    process.stderr.write(`\r\x1B[2K\x1B[90m${frames[i++ % frames.length]} ${text}\x1B[0m`);
+  }, 80);
+  return {
+    stop() {
+      clearInterval(interval);
+      process.stderr.write(`\r\x1B[2K`);
+    }
+  };
+}
 async function execCommand(serviceName, command, instanceKey = "default") {
   if (command.length === 0) {
     console.error(
@@ -193784,12 +193975,12 @@ async function execCommand(serviceName, command, instanceKey = "default") {
     }
   };
   const configPath = path24.join(process.cwd(), "specific.hcl");
-  if (!fs26.existsSync(configPath)) {
+  if (!fs27.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
-  const hcl = fs26.readFileSync(configPath, "utf-8");
+  const hcl = fs27.readFileSync(configPath, "utf-8");
   try {
     config = await parseConfig(hcl);
   } catch (err) {
@@ -193810,13 +194001,15 @@ async function execCommand(serviceName, command, instanceKey = "default") {
   stateManager = new InstanceStateManager(process.cwd(), instanceKey);
   await stateManager.cleanStaleState();
   const existingInstances = await stateManager.getExistingInstances();
+  let spinner = null;
   if (hasRequiredResources) {
     if (existingInstances) {
-      console.error("Using existing resource instances...");
+      spinner = startSpinner("Starting resources...");
       const allRequiredNames = [...required.postgres, ...required.redis, ...required.storage];
       for (const name of allRequiredNames) {
         const dbState = existingInstances.databases[name];
         if (!dbState) {
+          spinner?.stop();
           console.error(
             `Error: Required resource "${name}" not found in running instances`
           );
@@ -193844,11 +194037,12 @@ async function execCommand(serviceName, command, instanceKey = "default") {
         });
       }
     } else {
-      console.error("Starting resources...");
+      spinner = startSpinner("Starting resources...");
       try {
         await stateManager.claimOwnership("exec");
         ownsInstances = true;
       } catch (err) {
+        spinner?.stop();
         console.error(
           `Error: ${err instanceof Error ? err.message : String(err)}`
         );
@@ -193867,15 +194061,14 @@ async function execCommand(serviceName, command, instanceKey = "default") {
           stateManager,
           dataDir: `.specific/keys/${instanceKey}/data`,
           portAllocator: new PortAllocator(),
-          callbacks: {
-            log: (msg) => console.error(msg)
-          },
+          callbacks: {},
           startElectric: true
         });
         resources = result.resources;
         startedResources = result.startedResources;
         startedElectric = result.startedElectric;
       } catch (err) {
+        spinner?.stop();
         console.error(
           `Error: Failed to start resources: ${err instanceof Error ? err.message : String(err)}`
         );
@@ -193888,7 +194081,24 @@ async function execCommand(serviceName, command, instanceKey = "default") {
   try {
     const secrets = await prepareSecrets(config.secrets);
     const configs = await prepareConfigs(config.configs);
-    resolvedEnv = resolveEnvForExec(service.env, resources, secrets, configs);
+    const result = resolveEnvForExec(service.env, resources, secrets, configs);
+    resolvedEnv = result.env;
+    if (result.missingSecrets.length > 0 || result.missingConfigs.length > 0) {
+      if (result.missingSecrets.length > 0) {
+        console.error(`\x1B[33m\u26A0 Missing secrets (env vars will not be set):\x1B[0m`);
+        for (const { name, envVar } of result.missingSecrets) {
+          console.error(`\x1B[33m  \u2022 ${name} \u2192 ${envVar}\x1B[0m`);
+        }
+      }
+      if (result.missingConfigs.length > 0) {
+        console.error(`\x1B[33m\u26A0 Missing configs (env vars will not be set):\x1B[0m`);
+        for (const { name, envVar } of result.missingConfigs) {
+          console.error(`\x1B[33m  \u2022 ${name} \u2192 ${envVar}\x1B[0m`);
+        }
+      }
+      console.error(`\x1B[33m  Set values in specific.local to resolve.\x1B[0m`);
+      console.error("");
+    }
   } catch (err) {
     console.error(
       `Error: Failed to resolve environment variables: ${err instanceof Error ? err.message : String(err)}`
@@ -193914,6 +194124,7 @@ async function execCommand(serviceName, command, instanceKey = "default") {
       effectiveCwd = path24.resolve(process.cwd(), build.root);
     }
   }
+  spinner?.stop();
   child = spawn6(command[0], command.slice(1), {
     cwd: effectiveCwd,
     env: {
@@ -193939,7 +194150,7 @@ async function execCommand(serviceName, command, instanceKey = "default") {
 
 // src/commands/psql.tsx
 import { spawn as spawn7 } from "child_process";
-import * as fs27 from "fs";
+import * as fs28 from "fs";
 import * as path25 from "path";
 async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []) {
   let startedResources = [];
@@ -193958,12 +194169,12 @@ async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []
     }
   };
   const configPath = path25.join(process.cwd(), "specific.hcl");
-  if (!fs27.existsSync(configPath)) {
+  if (!fs28.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
-  const hcl = fs27.readFileSync(configPath, "utf-8");
+  const hcl = fs28.readFileSync(configPath, "utf-8");
   try {
     config = await parseConfig(hcl);
   } catch (err) {
@@ -194087,7 +194298,7 @@ async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []
 
 // src/commands/reshape.tsx
 import { spawn as spawn8 } from "child_process";
-import * as fs28 from "fs";
+import * as fs29 from "fs";
 import * as path26 from "path";
 var VALID_ACTIONS = ["start", "complete", "status", "abort", "check"];
 var MIGRATION_SUBCOMMANDS = ["start", "complete", "abort"];
@@ -194105,8 +194316,8 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
   let migrationsDir = "migrations";
   let targetDb;
   try {
-    if (fs28.existsSync(configPath)) {
-      const configContent = fs28.readFileSync(configPath, "utf-8");
+    if (fs29.existsSync(configPath)) {
+      const configContent = fs29.readFileSync(configPath, "utf-8");
       config = await parseConfig(configContent);
       if (databaseName) {
         const postgresConfig = config.postgres.find((p) => p.name === databaseName);
@@ -194242,7 +194453,7 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
   const reshapeArgs = isMigrationSubcommand ? ["migration", action] : [action];
   const fullMigrationsPath = path26.join(process.cwd(), migrationsDir);
   if (action === "check" || action === "start") {
-    if (fs28.existsSync(fullMigrationsPath)) {
+    if (fs29.existsSync(fullMigrationsPath)) {
       reshapeArgs.push("--dirs", fullMigrationsPath);
     } else if (action === "check") {
       console.error(`Error: Migrations directory not found: ${fullMigrationsPath}`);
@@ -194292,7 +194503,7 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
 import React8, { useState as useState7, useEffect as useEffect5 } from "react";
 import { render as render6, Text as Text8, Box as Box8 } from "ink";
 import Spinner6 from "ink-spinner";
-import * as fs29 from "fs";
+import * as fs30 from "fs";
 import * as path27 from "path";
 function CleanUI({ instanceKey }) {
   const [state, setState] = useState7({ status: "checking" });
@@ -194300,13 +194511,13 @@ function CleanUI({ instanceKey }) {
     async function clean() {
       const projectRoot = process.cwd();
       const specificDir = path27.join(projectRoot, ".specific");
-      if (!fs29.existsSync(specificDir)) {
+      if (!fs30.existsSync(specificDir)) {
         setState({ status: "nothing" });
         return;
       }
       if (instanceKey) {
         const keyDir = path27.join(specificDir, "keys", instanceKey);
-        if (!fs29.existsSync(keyDir)) {
+        if (!fs30.existsSync(keyDir)) {
           setState({ status: "nothing" });
           return;
         }
@@ -194322,7 +194533,7 @@ function CleanUI({ instanceKey }) {
         await stateManager.cleanStaleState();
         setState({ status: "cleaning" });
         try {
-          fs29.rmSync(keyDir, { recursive: true, force: true });
+          fs30.rmSync(keyDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -194332,12 +194543,12 @@ function CleanUI({ instanceKey }) {
         }
       } else {
         const keysDir = path27.join(specificDir, "keys");
-        if (!fs29.existsSync(keysDir)) {
+        if (!fs30.existsSync(keysDir)) {
           setState({ status: "nothing" });
           return;
         }
-        const keys = fs29.readdirSync(keysDir).filter(
-          (f) => fs29.statSync(path27.join(keysDir, f)).isDirectory()
+        const keys = fs30.readdirSync(keysDir).filter(
+          (f) => fs30.statSync(path27.join(keysDir, f)).isDirectory()
         );
         for (const key of keys) {
           const stateManager2 = new InstanceStateManager(projectRoot, key);
@@ -194361,7 +194572,7 @@ function CleanUI({ instanceKey }) {
         }
         setState({ status: "cleaning" });
         try {
-          fs29.rmSync(keysDir, { recursive: true, force: true });
+          fs30.rmSync(keysDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -194526,7 +194737,7 @@ import { render as render9, Text as Text11, Box as Box10, useApp as useApp6 } fr
 import Spinner7 from "ink-spinner";
 
 // src/lib/update.ts
-import * as fs30 from "fs";
+import * as fs31 from "fs";
 import * as path28 from "path";
 var BINARIES_BASE_URL = "https://binaries.specific.dev/cli";
 function compareVersions(a, b) {
@@ -194541,7 +194752,7 @@ function compareVersions(a, b) {
   return 0;
 }
 async function checkForUpdate() {
-  const currentVersion = "0.1.80";
+  const currentVersion = "0.1.82";
   const response = await fetch(`${BINARIES_BASE_URL}/latest?t=${Date.now()}`);
   if (!response.ok) {
     throw new Error(`Failed to check for updates: HTTP ${response.status}`);
@@ -194557,7 +194768,7 @@ function isBinaryWritable() {
   const binaryPath = getCurrentBinaryPath();
   const dir = path28.dirname(binaryPath);
   try {
-    fs30.accessSync(dir, fs30.constants.W_OK);
+    fs31.accessSync(dir, fs31.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -194568,21 +194779,21 @@ async function performUpdate(version, onProgress) {
   const binaryDir = path28.dirname(binaryPath);
   const tempPath = path28.join(binaryDir, `.specific-update-${process.pid}`);
   try {
-    const { platform: platform5, arch: arch3 } = getPlatformInfo();
-    const url = `${BINARIES_BASE_URL}/${version}/specific-${platform5}-${arch3}`;
+    const { platform: platform8, arch: arch3 } = getPlatformInfo();
+    const url = `${BINARIES_BASE_URL}/${version}/specific-${platform8}-${arch3}`;
     await downloadFile(url, tempPath, onProgress);
-    const stat4 = fs30.statSync(tempPath);
+    const stat4 = fs31.statSync(tempPath);
     if (stat4.size === 0) {
       throw new Error("Downloaded binary is empty");
     }
-    fs30.chmodSync(tempPath, 493);
+    fs31.chmodSync(tempPath, 493);
     onProgress?.({ phase: "finalizing" });
-    fs30.unlinkSync(binaryPath);
-    fs30.renameSync(tempPath, binaryPath);
+    fs31.unlinkSync(binaryPath);
+    fs31.renameSync(tempPath, binaryPath);
   } catch (error) {
     try {
-      if (fs30.existsSync(tempPath)) {
-        fs30.unlinkSync(tempPath);
+      if (fs31.existsSync(tempPath)) {
+        fs31.unlinkSync(tempPath);
       }
     } catch {
     }
@@ -194592,21 +194803,21 @@ async function performUpdate(version, onProgress) {
 
 // src/lib/background-update.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs31 from "fs";
+import * as fs32 from "fs";
 import * as path29 from "path";
-import * as os9 from "os";
-var SPECIFIC_DIR = path29.join(os9.homedir(), ".specific");
+import * as os12 from "os";
+var SPECIFIC_DIR = path29.join(os12.homedir(), ".specific");
 var RATE_LIMIT_FILE = path29.join(SPECIFIC_DIR, "last-update-check");
 var LOCK_FILE = path29.join(SPECIFIC_DIR, "update.lock");
 var RATE_LIMIT_MS = 60 * 60 * 1e3;
 var STALE_LOCK_MS = 10 * 60 * 1e3;
 function writeCheckTimestamp() {
-  fs31.mkdirSync(SPECIFIC_DIR, { recursive: true });
-  fs31.writeFileSync(RATE_LIMIT_FILE, String(Date.now()), "utf-8");
+  fs32.mkdirSync(SPECIFIC_DIR, { recursive: true });
+  fs32.writeFileSync(RATE_LIMIT_FILE, String(Date.now()), "utf-8");
 }
 function isRateLimited() {
   try {
-    const content = fs31.readFileSync(RATE_LIMIT_FILE, "utf-8").trim();
+    const content = fs32.readFileSync(RATE_LIMIT_FILE, "utf-8").trim();
     const lastCheck = parseInt(content, 10);
     if (isNaN(lastCheck)) return false;
     return Date.now() - lastCheck < RATE_LIMIT_MS;
@@ -194740,7 +194951,7 @@ function updateCommand() {
 var program = new Command();
 var env = "production";
 var envLabel = env !== "production" ? `[${env.toUpperCase()}] ` : "";
-program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.80").enablePositionalOptions();
+program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.82").enablePositionalOptions();
 program.command("init").description("Initialize project for use with a coding agent").option("--agent <name...>", "Agents to configure (cursor, claude, codex, other)").action((options2) => initCommand(options2));
 program.command("docs [topic]").description("Fetch LLM-optimized documentation").action(docsCommand);
 program.command("check").description("Validate specific.hcl configuration").action(checkCommand);