@bremmdev/arca-env 0.1.2 → 0.2.0

package/dist/{main-Cy_OrS0c.mjs → main-B2iLn7kM.mjs}

@@ -372,8 +372,12 @@ var ArcaError = class extends Error {
 //#region src/config.ts
 const CONFIG_FILE = "arca.json";
 const SCHEMA_REF = "./node_modules/@bremmdev/arca-env/schema.json";
-/** Profiles aren't implemented yet. Everything uses this single set internally. */
+/** The profile a project has when arca.json declares none. */
 const DEFAULT_PROFILE = "default";
+/** Lowercase because vault files are named after profiles, on case-insensitive file systems. */
+const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,39}$/;
+/** `policy.vault` sits next to the profile vaults. */
+const RESERVED_PROFILES = /* @__PURE__ */ new Set(["policy"]);
 const VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function isSensitive(decl) {
 	return decl?.sensitive !== false;
@@ -431,7 +435,7 @@ function parseProject(text, file) {
 		if (!isObject(value)) fail(`vars.${key} must be an object (use {} for no options)`);
 		vars[key] = parseDecl(key, value, fail);
 	}
-	for (const key of ["profiles", "defaultProfile"]) if (key in o) warnings.push(`"${key}" in ${CONFIG_FILE} is ignored: profiles aren't available in this version yet.`);
+	const { profiles, defaultProfile } = parseProfiles(o, fail, warnings);
 	const known = /* @__PURE__ */ new Set([
 		"$schema",
 		"id",
@@ -451,7 +455,9 @@ function parseProject(text, file) {
 			name,
 			envFiles,
 			leakGuard: { ignore },
-			vars
+			vars,
+			profiles,
+			defaultProfile
 		},
 		warnings
 	};
@@ -486,6 +492,85 @@ function parseDecl(key, v, fail) {
 	}
 	return d;
 }
+function normalizeProfile(name) {
+	return name.trim().toLowerCase();
+}
+/** Why a profile name can't be used, or null when it can. */
+function invalidProfileName(name) {
+	if (!PROFILE_NAME.test(name)) return `"${name}" is not a valid profile name (letters, digits, - and _, up to 40 characters)`;
+	if (RESERVED_PROFILES.has(name)) return `"${name}" is reserved, pick another profile name`;
+	return null;
+}
+function parseProfiles(o, fail, warnings) {
+	let defaultProfile;
+	if (o.defaultProfile !== void 0) {
+		if (typeof o.defaultProfile !== "string") fail("\"defaultProfile\" must be a profile name");
+		defaultProfile = normalizeProfile(o.defaultProfile);
+		const bad = invalidProfileName(defaultProfile);
+		if (bad) fail(`defaultProfile: ${bad}`);
+	}
+	const raw = o.profiles ?? {};
+	if (!isObject(raw)) fail("\"profiles\" must be an object like { \"ontwikkel\": {}, \"acceptatie\": { \"extends\": \"ontwikkel\" } }");
+	const profiles = {};
+	for (const [rawName, value] of Object.entries(raw)) {
+		const name = normalizeProfile(rawName);
+		const bad = invalidProfileName(name);
+		if (bad) fail(`profiles: ${bad}`);
+		if (name in profiles) fail(`profiles: "${rawName}" and another profile differ only in case. Profile names are case-insensitive.`);
+		if (!isObject(value)) fail(`profiles.${rawName} must be an object (use {} for no options)`);
+		const v = value;
+		const decl = { envFiles: [] };
+		if (v.extends !== void 0) {
+			if (typeof v.extends !== "string") fail(`profiles.${rawName}.extends must be a profile name`);
+			decl.extends = normalizeProfile(v.extends);
+		}
+		if (v.envFiles !== void 0) {
+			if (!Array.isArray(v.envFiles) || v.envFiles.some((f) => typeof f !== "string")) fail(`profiles.${rawName}.envFiles must be an array of file names`);
+			decl.envFiles = v.envFiles;
+		}
+		for (const key of Object.keys(v)) if (key !== "extends" && key !== "envFiles") warnings.push(`Unknown field "${key}" in profiles.${rawName} is ignored.`);
+		profiles[name] = decl;
+	}
+	const declared = Object.keys(profiles);
+	if (declared.length === 0) {
+		const name = defaultProfile ?? "default";
+		return {
+			profiles: { [name]: { envFiles: [] } },
+			defaultProfile: name
+		};
+	}
+	if (defaultProfile === void 0) defaultProfile = "default" in profiles ? DEFAULT_PROFILE : declared[0];
+	else if (!(defaultProfile in profiles)) fail(`"defaultProfile" is "${defaultProfile}", which isn't in "profiles" (${declared.join(", ")})`);
+	for (const [name, decl] of Object.entries(profiles)) {
+		if (decl.extends === void 0) continue;
+		if (!(decl.extends in profiles)) fail(`profiles.${name} extends "${decl.extends}", which isn't in "profiles" (${declared.join(", ")})`);
+		const seen = [name];
+		for (let p = decl.extends; p !== void 0; p = profiles[p].extends) {
+			if (seen.includes(p)) fail(`profiles: "extends" loops: ${[...seen, p].join(" → ")}`);
+			seen.push(p);
+		}
+	}
+	return {
+		profiles,
+		defaultProfile
+	};
+}
+/** The profile followed by the profiles it extends, nearest first. */
+function profileChain(config, profile) {
+	const chain = [];
+	for (let p = profile; p !== void 0 && !chain.includes(p); p = config.profiles[p]?.extends) chain.push(p);
+	return chain;
+}
+/** Config files arca loads for a profile: top-level envFiles, then the chain's, the profile's own last (later files win). */
+function profileEnvFiles(config, profile) {
+	const files = [...config.envFiles];
+	for (const p of profileChain(config, profile).reverse()) for (const f of config.profiles[p]?.envFiles ?? []) if (!files.includes(f)) files.push(f);
+	return files;
+}
+/** Profiles that extend `profile` directly. */
+function profileChildren(config, profile) {
+	return Object.entries(config.profiles).filter(([, d]) => d.extends === profile).map(([n]) => n);
+}
 function isObject(v) {
 	return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -508,6 +593,24 @@ function declareVars(file, decls) {
 		raw.vars = vars;
 	});
 }
+/**
+* Adds a profile to arca.json. A file without "profiles" gets its implicit default profile
+* written out too, so the values stored for it keep working.
+*/
+function addProfileToConfig(project, name, decl) {
+	updateConfigFile(project.file, (raw) => {
+		const profiles = isObject(raw.profiles) && Object.keys(raw.profiles).length > 0 ? raw.profiles : { [project.config.defaultProfile]: {} };
+		profiles[name] = decl.extends ? { extends: decl.extends } : {};
+		raw.profiles = profiles;
+	});
+}
+function removeProfileFromConfig(file, name) {
+	updateConfigFile(file, (raw) => {
+		if (!isObject(raw.profiles)) return;
+		const profiles = raw.profiles;
+		for (const key of Object.keys(profiles)) if (normalizeProfile(key) === name) delete profiles[key];
+	});
+}
 function newConfig(name) {
 	return {
 		$schema: SCHEMA_REF,
@@ -831,6 +934,9 @@ Secrets are stored outside the repo with arca and injected when commands run.
   which wrap commands in \`arca run\`. Ad-hoc \`arca run -- <cmd>\` is refused for agents.
   Output is always masked: secrets appear as \`[arca:NAME]\`.
 - \`npx arca list\` shows which variables exist. \`npx arca check\` verifies required ones are set.
+- A project can have several profiles (sets of values). A run that doesn't use the default
+  profile starts with an \`arca ▸ profile …\` line. Don't switch profiles with \`npx arca use\`
+  unless the user asks: it also changes what the user's own terminals use.
 - Do not try to read secret values (\`npx arca reveal\`, printing \`process.env\`, reading the
   arca store).
 - Only the user can set or change values. If a value is missing or wrong, ask the user
@@ -887,6 +993,42 @@ Type this code to continue: ${code}\n`);
 	if (answer === null || answer.trim().toUpperCase() !== code) throw new ArcaError("arca: the code did not match. Nothing was changed.");
 }
 //#endregion
+//#region src/util.ts
+function levenshtein(a, b) {
+	const dp = Array.from({ length: b.length + 1 }, (_, i) => i);
+	for (let i = 1; i <= a.length; i++) {
+		let prev = dp[0];
+		dp[0] = i;
+		for (let j = 1; j <= b.length; j++) {
+			const tmp = dp[j];
+			dp[j] = Math.min(dp[j] + 1, dp[j - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
+			prev = tmp;
+		}
+	}
+	return dp[b.length];
+}
+/** The closest candidate within a small edit distance, for "did you mean …?". */
+function suggest(input, candidates) {
+	let best = null;
+	let bestDist = Infinity;
+	for (const c of candidates) {
+		if (c === input) continue;
+		const d = levenshtein(input.toUpperCase(), c.toUpperCase());
+		if (d < bestDist) {
+			best = c;
+			bestDist = d;
+		}
+	}
+	const limit = Math.max(1, Math.min(3, Math.floor(input.length / 4)));
+	return bestDist <= limit ? best : null;
+}
+function plural(n, one, many = `${one}s`) {
+	return `${n} ${n === 1 ? one : many}`;
+}
+function shortDate(iso) {
+	return iso ? iso.slice(0, 10) : "";
+}
+//#endregion
 //#region src/runner.ts
 async function runCommand(s, opts) {
 	const { io, ctx } = s;
@@ -904,27 +1046,30 @@ async function runCommand(s, opts) {
 		const decision = decideRun(ctx, verifyScript(io, command), (await s.policy()).agentRun, display);
 		if (!decision.allow) throw new ArcaError(decision.message);
 	}
-	const envFileValues = loadEnvFiles(project.root, project.config.envFiles);
+	const envFileValues = loadEnvFiles(project.root, s.envFiles());
+	const profileEnv = { ARCA_PROFILE: s.profile };
 	if (!s.hasVault()) {
 		const env = {
 			...envFileValues,
-			...io.env
+			...io.env,
+			...profileEnv
 		};
 		const missing = missingRequired(s, project, env);
 		if (ctx.ci || opts.passthrough) {
-			if (missing.length) throw new ArcaError(missingMessage(project, missing, true));
+			if (missing.length) throw new ArcaError(missingMessage(s, missing, true));
+			banner(s, null, false);
 			return spawnChild(s, command, env, null);
 		}
-		if (missing.filter((n) => isSensitive(project.config.vars[n])).length) throw new ArcaError(missingMessage(project, missing, false));
-		s.note(s.err("dim", `arca: no secrets stored for ${project.config.name} on this machine yet. Running without them.`));
+		if (missing.filter((n) => isSensitive(project.config.vars[n])).length) throw new ArcaError(missingMessage(s, missing, false));
+		s.note(s.err("dim", `arca: no secrets stored for ${s.forWhom()} on this machine yet. Running without them.`));
 		return spawnChild(s, command, env, null);
 	}
-	const vault = await s.readVault();
+	const values = await s.resolve();
 	const only = opts.only ? new Set(opts.only) : null;
 	const vaultValues = {};
-	for (const [name, v] of Object.entries(vault.vars)) if (!only || only.has(name)) vaultValues[name] = v.value;
+	for (const [name, v] of values) if (!only || only.has(name)) vaultValues[name] = v.value;
 	if (only) {
-		const unknown = [...only].filter((n) => !(n in vault.vars));
+		const unknown = [...only].filter((n) => !values.has(n));
 		if (unknown.length) s.note(s.err("yellow", `arca: --only names not stored in arca: ${unknown.join(", ")}`));
 	}
 	const overridden = Object.keys(vaultValues).filter((k) => io.env[k] !== void 0 && io.env[k] !== vaultValues[k]);
@@ -943,19 +1088,34 @@ async function runCommand(s, opts) {
 		s.note(s.err("dim", `arca: ${names} from arca ${verb} inherited from your shell (use --no-override to keep the shell's).`));
 	}
 	const missing = missingRequired(s, project, env);
-	if (missing.length) throw new ArcaError(missingMessage(project, missing, false));
-	const secrets = s.secrets(vault);
+	if (missing.length) throw new ArcaError(missingMessage(s, missing, false));
+	const secrets = await s.allSecrets();
+	const injected = s.secretsOf(values).filter((x) => x.name in vaultValues);
 	if (!s.quiet) {
 		const findings = scanEnvFiles(project, s.envFilesForGuard(), secrets);
 		if (findings.length) s.note(s.err("yellow", summarizeFindings(findings)));
 	}
+	banner(s, injected.length, true);
+	Object.assign(env, profileEnv);
 	env.ARCA_ACTIVE = project.config.id;
 	env.ARCA_PROJECT = project.config.name;
 	delete env.ARCA_PASSPHRASE;
-	addConsoleGuard(env, secrets.map((x) => x.name));
+	addConsoleGuard(env, injected.map((x) => x.name));
 	return spawnChild(s, command, env, secrets.flatMap(needlesFor));
 }
 /**
+* One line naming the profile whenever it isn't the default, the same for every profile.
+* Information, not a warning: agents read it too, so they know which set is active.
+*/
+function banner(s, secrets, masked) {
+	if (s.quiet || s.profile === s.defaultProfile) return;
+	const via = s.profileSource === "flag" ? "--profile" : s.profileSource === "env" ? "ARCA_PROFILE" : "arca use";
+	const parts = [`profile ${s.profile} (via ${via})`];
+	if (secrets !== null) parts.push(plural(secrets, "secret"));
+	if (masked) parts.push("output masked");
+	s.note(s.err("cyan", `arca ▸ ${parts.join(" · ")}`));
+}
+/**
 * Preloads the console guard into every Node process the command starts, so values are
 * masked before in-process console wrappers (e.g. dev tools that forward server logs to the
 * browser) can see them. Only names are passed; the guard reads values from its own env.
@@ -978,15 +1138,15 @@ function missingRequired(s, project, env) {
 	let fileKeys = null;
 	return required.filter((name) => {
 		if (env[name] !== void 0 && env[name] !== "") return false;
-		fileKeys ??= new Set(s.envFilesForGuard().filter((f) => !isTemplateFile(f.name)).flatMap((f) => f.entries.filter((e) => e.value !== "").map((e) => e.key)));
+		fileKeys ??= new Set(s.envFilesFor().filter((f) => !isTemplateFile(f.name)).flatMap((f) => f.entries.filter((e) => e.value !== "").map((e) => e.key)));
 		return !fileKeys.has(name);
 	});
 }
-function missingMessage(project, missing, ci) {
+function missingMessage(s, missing, ci) {
 	const n = missing.length;
-	const head = `arca: ${n} required variable${n === 1 ? " is" : "s are"} not set for ${project.config.name}:\n  ${missing.join(", ")}`;
+	const head = `arca: ${n} required variable${n === 1 ? " is" : "s are"} not set for ${s.forWhom()}:\n  ${missing.join(", ")}`;
 	if (ci) return `${head}\nAdd ${n === 1 ? "it" : "them"} to your CI or hosting platform's environment variables.`;
-	return `${head}\nRun \`npx arca setup\` to set them. Takes about a minute. (AI agents: ask the user to run it.)`;
+	return `${head}\nRun \`npx arca setup${s.profileFlag()}\` to set them. Takes about a minute. (AI agents: ask the user to run it.)`;
 }
 /** Spawns the command. With needles, stdout and stderr are piped through the masker. */
 function spawnChild(s, command, env, needles) {
@@ -1160,6 +1320,38 @@ var Store = class {
 		}
 		return false;
 	}
+	/** Profiles with a vault file for this project. */
+	vaultProfiles(id) {
+		const dir = this.projectDir(id);
+		if (!existsSync(dir)) return [];
+		return readdirSync(dir).filter((f) => f.endsWith(".vault") && f !== "policy.vault").map((f) => f.slice(0, -6));
+	}
+	removeVault(id, profile) {
+		this.withLock(id, () => {
+			const file = this.vaultFile(id, profile);
+			rmSync(file, { force: true });
+			rmSync(`${file}.bak`, { force: true });
+		});
+	}
+	stateFile(id) {
+		return join(this.projectDir(id), "state.json");
+	}
+	readState(id) {
+		const file = this.stateFile(id);
+		if (!existsSync(file)) return {};
+		try {
+			const data = JSON.parse(readFileSync(file, "utf8"));
+			return typeof data.activeProfile === "string" ? data : {};
+		} catch {
+			return {};
+		}
+	}
+	writeState(id, state) {
+		this.withLock(id, () => {
+			if (state.activeProfile === void 0) rmSync(this.stateFile(id), { force: true });
+			else atomicWrite(this.stateFile(id), JSON.stringify(state, null, 2) + "\n");
+		});
+	}
 	projectIds() {
 		const dir = join(this.root, "projects");
 		return existsSync(dir) ? readdirSync(dir).filter((d) => d.startsWith("arc_")) : [];
@@ -1487,10 +1679,14 @@ var Session = class {
 	project;
 	out;
 	err;
-	profile = DEFAULT_PROFILE;
+	profile;
+	profileSource;
+	/** The `arca use` profile, when arca.json no longer declares it. */
+	staleActiveProfile = null;
 	quiet = false;
 	json = false;
 	master = null;
+	vaults = /* @__PURE__ */ new Map();
 	constructor(io, opts = {}) {
 		this.io = io;
 		this.store = new Store(storeRoot(io.env, io.platform));
@@ -1499,6 +1695,50 @@ var Session = class {
 		this.project = loadProject(opts.projectDir ? resolve(io.cwd, opts.projectDir) : io.cwd);
 		this.out = painter(io.stdout, io.env);
 		this.err = painter(io.stderr, io.env);
+		const picked = this.project ? this.pickProfile(this.project, opts.profile) : {
+			profile: DEFAULT_PROFILE,
+			source: "default"
+		};
+		this.profile = picked.profile;
+		this.profileSource = picked.source;
+		this.staleActiveProfile = picked.stale ?? null;
+	}
+	/** Precedence: --profile > ARCA_PROFILE > `arca use` > defaultProfile. */
+	pickProfile(project, flag) {
+		const { profiles, defaultProfile, id } = project.config;
+		if (flag !== void 0) return {
+			profile: this.checkProfile(project, flag, "--profile"),
+			source: "flag"
+		};
+		const fromEnv = this.io.env.ARCA_PROFILE;
+		const outer = this.ctx.activeProject;
+		if (fromEnv && (!outer || outer === id)) return {
+			profile: this.checkProfile(project, fromEnv, "ARCA_PROFILE"),
+			source: "env"
+		};
+		const active = this.store.readState(id).activeProfile;
+		if (active !== void 0) {
+			if (active in profiles) return {
+				profile: active,
+				source: active === defaultProfile ? "default" : "use"
+			};
+			return {
+				profile: defaultProfile,
+				source: "default",
+				stale: active
+			};
+		}
+		return {
+			profile: defaultProfile,
+			source: "default"
+		};
+	}
+	checkProfile(project, raw, via) {
+		const name = normalizeProfile(raw);
+		const names = Object.keys(project.config.profiles);
+		if (name in project.config.profiles) return name;
+		const guess = suggest(name, names);
+		throw new ArcaError(`arca: profile "${raw}" (from ${via}) isn't declared in arca.json. ${names.length === 1 ? `${project.config.name} has one profile (${names[0]}). Add one with \`npx arca profiles add ${name}\`.` : `Profiles: ${names.join(", ")}.${guess ? ` Did you mean ${guess}?` : ""}`}`, 2);
 	}
 	print(text = "") {
 		this.io.stdout.write(text + "\n");
@@ -1510,6 +1750,7 @@ var Session = class {
 	warnConfig() {
 		if (!this.project || this.quiet) return;
 		for (const w of this.project.warnings) this.note(this.err("yellow", `arca: ${w}`));
+		if (this.staleActiveProfile) this.note(this.err("yellow", `arca: the active profile "${this.staleActiveProfile}" (set with \`arca use\`) isn't in arca.json any more. Using ${this.profile}. \`npx arca use --reset\` clears it.`));
 	}
 	requireProject() {
 		if (!this.project) throw new ArcaError("arca: no arca.json found in this folder or any parent. Run `npx arca init` to set up arca for this project.");
@@ -1518,8 +1759,60 @@ var Session = class {
 	get projectId() {
 		return this.requireProject().config.id;
 	}
-	hasVault() {
-		return this.project ? this.store.hasVault(this.project.config.id, this.profile) : false;
+	/** Every declared profile, default first. */
+	get profiles() {
+		if (!this.project) return [DEFAULT_PROFILE];
+		const { profiles, defaultProfile } = this.project.config;
+		return [defaultProfile, ...Object.keys(profiles).filter((p) => p !== defaultProfile)];
+	}
+	get defaultProfile() {
+		return this.project?.config.defaultProfile ?? "default";
+	}
+	get multiProfile() {
+		return this.profiles.length > 1;
+	}
+	/** "acme-web", or "acme-web (profile acceptatie)" once a project has several profiles. */
+	forWhom(profile = this.profile) {
+		const name = this.requireProject().config.name;
+		return this.multiProfile ? `${name} (profile ${profile})` : name;
+	}
+	/** ` --profile X` for commands we tell people to run, when X isn't the default. */
+	profileFlag(profile = this.profile) {
+		return profile === this.defaultProfile ? "" : ` --profile ${profile}`;
+	}
+	chain(profile = this.profile) {
+		return this.project ? profileChain(this.project.config, profile) : [profile];
+	}
+	envFiles(profile = this.profile) {
+		return this.project ? profileEnvFiles(this.project.config, profile) : [];
+	}
+	/**
+	* A vault written before the project declared profiles is `default.vault`. When arca.json
+	* now names another default profile, those values belong to it.
+	*/
+	legacyVaultPending() {
+		const p = this.project;
+		if (!p || p.config.defaultProfile === "default" || "default" in p.config.profiles) return false;
+		return this.store.hasVault(p.config.id, "default") && !this.store.hasVault(p.config.id, p.config.defaultProfile);
+	}
+	async migrateLegacyVault() {
+		if (!this.legacyVaultPending()) return;
+		const { id, defaultProfile } = this.requireProject().config;
+		const master = await this.masterKey();
+		const data = this.store.readVault(master, id, DEFAULT_PROFILE);
+		this.store.writeVault(master, id, defaultProfile, data);
+		this.store.removeVault(id, DEFAULT_PROFILE);
+		this.note(this.err("dim", `arca: moved the values stored before this project had profiles into profile ${defaultProfile}.`));
+	}
+	/** Whether `profile` itself has stored values on this machine. */
+	ownsVault(profile) {
+		if (!this.project) return false;
+		if (this.store.hasVault(this.project.config.id, profile)) return true;
+		return profile === this.project.config.defaultProfile && this.legacyVaultPending();
+	}
+	/** Whether the profile or any profile it extends has stored values. */
+	hasVault(profile = this.profile) {
+		return this.chain(profile).some((p) => this.ownsVault(p));
 	}
 	async masterKey(create = false) {
 		if (this.master) return this.master;
@@ -1527,15 +1820,22 @@ var Session = class {
 		if (!this.master) throw new ArcaError("arca: no master key.");
 		return this.master;
 	}
-	/** The project's vault. Doesn't touch the keychain when no vault exists yet. */
-	async readVault() {
-		if (!this.hasVault()) return emptyVault();
-		return this.store.readVault(await this.masterKey(), this.projectId, this.profile);
-	}
-	async writeVault(data) {
+	/** A profile's own values. Doesn't touch the keychain when it has no vault. */
+	async readVault(profile = this.profile) {
+		const cached = this.vaults.get(profile);
+		if (cached) return cached;
+		if (!this.ownsVault(profile)) return emptyVault();
+		if (profile === this.defaultProfile) await this.migrateLegacyVault();
+		const data = this.store.readVault(await this.masterKey(), this.projectId, profile);
+		this.vaults.set(profile, data);
+		return data;
+	}
+	async writeVault(data, profile = this.profile) {
 		const project = this.requireProject();
 		const master = await this.masterKey(true);
-		this.store.writeVault(master, project.config.id, this.profile, data);
+		if (profile === this.defaultProfile) await this.migrateLegacyVault();
+		this.store.writeVault(master, project.config.id, profile, data);
+		this.vaults.set(profile, data);
 		const prev = this.store.touchRegistry(project.config.id, {
 			name: project.config.name,
 			root: project.root,
@@ -1543,6 +1843,19 @@ var Session = class {
 		});
 		this.warnCollision(prev);
 	}
+	/** The values a profile sees: its own first, then each profile up its `extends` chain. */
+	async resolve(profile = this.profile) {
+		const out = /* @__PURE__ */ new Map();
+		for (const p of this.chain(profile)) {
+			const vault = await this.readVault(p);
+			for (const [name, v] of Object.entries(vault.vars)) if (!out.has(name)) out.set(name, {
+				value: v.value,
+				profile: p,
+				updatedAt: v.updatedAt
+			});
+		}
+		return out;
+	}
 	warnCollision(prev) {
 		const project = this.project;
 		if (!project || !prev?.gitRemote) return;
@@ -1553,14 +1866,33 @@ var Session = class {
 		if (!this.project || !this.store.hasPolicy(this.project.config.id)) return { agentRun: "scripts" };
 		return this.store.readPolicy(await this.masterKey(), this.project.config.id);
 	}
-	/** Stored values that count as secrets (masking needles, leak-guard exact matches). */
-	secrets(vault) {
+	/** Stored values of `profile` (with its chain) that count as secrets. */
+	secretsOf(values) {
 		const decls = this.project?.config.vars ?? {};
-		return Object.entries(vault.vars).filter(([name]) => isSensitive(decls[name])).map(([name, v]) => ({
+		return [...values].filter(([name]) => isSensitive(decls[name])).map(([name, v]) => ({
 			name,
 			value: v.value
 		}));
 	}
+	/**
+	* Masking needles and leak-guard matches: the active profile's secrets first, then the
+	* values of every other profile, named `NAME@profile` so output says where they belong.
+	*/
+	async allSecrets(profile = this.profile) {
+		if (!this.project) return [];
+		await this.migrateLegacyVault();
+		const out = this.secretsOf(await this.resolve(profile));
+		const decls = this.project.config.vars;
+		const others = /* @__PURE__ */ new Set([...this.profiles, ...this.store.vaultProfiles(this.project.config.id)]);
+		for (const p of others) {
+			if (p === profile || !this.ownsVault(p)) continue;
+			for (const [name, v] of Object.entries((await this.readVault(p)).vars)) if (isSensitive(decls[name])) out.push({
+				name: `${name}@${p}`,
+				value: v.value
+			});
+		}
+		return out;
+	}
 	/** Nearest directory with a package.json, from cwd up to the project root. */
 	packageRoot() {
 		let dir = resolve(this.io.cwd);
@@ -1571,14 +1903,15 @@ var Session = class {
 			dir = parent;
 		}
 	}
-	/** Every .env* file the leak guard reads: project root, nearest package root, and envFiles. */
+	/** Every .env* file the leak guard reads: project root, nearest package root, and every profile's envFiles. */
 	envFilesForGuard() {
 		const project = this.requireProject();
 		const dirs = [project.root];
 		const pkg = this.packageRoot();
 		if (pkg && pkg !== project.root) dirs.push(pkg);
 		const files = findEnvFiles(dirs);
-		for (const f of project.config.envFiles) {
+		const listed = /* @__PURE__ */ new Set([...project.config.envFiles, ...Object.values(project.config.profiles).flatMap((p) => p.envFiles)]);
+		for (const f of listed) {
 			const path = resolve(project.root, f);
 			if (files.some((x) => x.path === path)) continue;
 			const file = readEnvFile(path, f);
@@ -1586,6 +1919,13 @@ var Session = class {
 		}
 		return files;
 	}
+	/** The .env* files that can provide values for `profile`: all of them, minus other profiles' own envFiles. */
+	envFilesFor(profile = this.profile) {
+		const project = this.requireProject();
+		const mine = new Set(this.envFiles(profile).map((f) => resolve(project.root, f)));
+		const others = new Set(Object.values(project.config.profiles).flatMap((p) => p.envFiles).map((f) => resolve(project.root, f)).filter((f) => !mine.has(f)));
+		return this.envFilesForGuard().filter((f) => !others.has(f.path));
+	}
 };
 function safeMarkers(store) {
 	try {
@@ -1615,42 +1955,6 @@ function gitRemote(root) {
 	}
 }
 //#endregion
-//#region src/util.ts
-function levenshtein(a, b) {
-	const dp = Array.from({ length: b.length + 1 }, (_, i) => i);
-	for (let i = 1; i <= a.length; i++) {
-		let prev = dp[0];
-		dp[0] = i;
-		for (let j = 1; j <= b.length; j++) {
-			const tmp = dp[j];
-			dp[j] = Math.min(dp[j] + 1, dp[j - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
-			prev = tmp;
-		}
-	}
-	return dp[b.length];
-}
-/** The closest candidate within a small edit distance, for "did you mean …?". */
-function suggest(input, candidates) {
-	let best = null;
-	let bestDist = Infinity;
-	for (const c of candidates) {
-		if (c === input) continue;
-		const d = levenshtein(input.toUpperCase(), c.toUpperCase());
-		if (d < bestDist) {
-			best = c;
-			bestDist = d;
-		}
-	}
-	const limit = Math.max(1, Math.min(3, Math.floor(input.length / 4)));
-	return bestDist <= limit ? best : null;
-}
-function plural(n, one, many = `${one}s`) {
-	return `${n} ${n === 1 ? one : many}`;
-}
-function shortDate(iso) {
-	return iso ? iso.slice(0, 10) : "";
-}
-//#endregion
 //#region src/commands/values.ts
 const now = () => (/* @__PURE__ */ new Date()).toISOString();
 function storeValue(vault, name, value, source) {
@@ -1677,7 +1981,7 @@ async function setCommand(s, opts) {
 	const fromStdin = opts.value === void 0 && opts.generate === void 0 && !s.io.stdinIsTTY;
 	await humanGate(s.io, s.ctx, {
 		kind: "write",
-		command: `npx arca set ${name}`,
+		command: `npx arca set ${name}${s.profileFlag()}`,
 		allowPipedStdin: fromStdin
 	});
 	const declared = project.config.vars;
@@ -1715,26 +2019,37 @@ async function setCommand(s, opts) {
 	if (isSensitive(decl) && value.length < 6) s.note(s.err("yellow", `⚠ ${name} is shorter than 6 characters, so it can't be masked in output.`));
 	if (decl && !isSensitive(decl)) s.note(s.err("dim", `arca: ${name} is declared as config (sensitive: false). It's stored in arca anyway and arca's value wins over .env.`));
 	const what = opts.generate !== void 0 ? "Generated" : existed ? "Updated" : "Set";
-	s.note(`${s.err("green", "✔")} ${what} ${name} for ${project.config.name}${existed ? " (previous value kept, `npx arca restore " + name + "` undoes this)" : ""}`);
+	const undo = existed ? ` (previous value kept, \`npx arca restore ${name}${s.profileFlag()}\` undoes this)` : "";
+	s.note(`${s.err("green", "✔")} ${what} ${name} for ${s.forWhom()}${undo}`);
 	return 0;
 }
+/** Error for a name the profile only inherits, so it can't be changed or removed there. */
+function inheritedError(s, name, from, verb) {
+	return new ArcaError(`arca: ${name} isn't stored in profile ${s.profile} itself, it's inherited from ${from}.\n  To ${verb} it for every profile that extends ${from}:  npx arca ${verb} ${name}${s.profileFlag(from)}`);
+}
 async function unsetCommand(s, rawName) {
-	const project = s.requireProject();
+	s.requireProject();
 	const name = checkName(rawName, "npx arca unset NAME");
 	await humanGate(s.io, s.ctx, {
 		kind: "write",
-		command: `npx arca unset ${name}`
+		command: `npx arca unset ${name}${s.profileFlag()}`
 	});
 	const vault = await s.readVault();
 	const v = vault.vars[name];
-	if (!v) throw new ArcaError(`arca: ${name} is not stored in arca for ${project.config.name}.`);
+	if (!v) {
+		const inherited = (await s.resolve()).get(name);
+		if (inherited) throw inheritedError(s, name, inherited.profile, "unset");
+		throw new ArcaError(`arca: ${name} is not stored in arca for ${s.forWhom()}.`);
+	}
 	vault.removed[name] = {
 		value: v.value,
 		updatedAt: v.updatedAt
 	};
 	delete vault.vars[name];
 	await s.writeVault(vault);
-	s.note(`${s.err("green", "✔")} Removed ${name}. \`npx arca restore ${name}\` brings it back.`);
+	const fallback = (await s.resolve()).get(name);
+	s.note(`${s.err("green", "✔")} Removed ${name}${s.multiProfile ? ` from profile ${s.profile}` : ""}. \`npx arca restore ${name}${s.profileFlag()}\` brings it back.`);
+	if (fallback) s.note(s.err("dim", `  ${s.profile} now inherits ${name} from ${fallback.profile}.`));
 	return 0;
 }
 async function restoreCommand(s, rawName) {
@@ -1742,7 +2057,7 @@ async function restoreCommand(s, rawName) {
 	const name = checkName(rawName, "npx arca restore NAME");
 	await humanGate(s.io, s.ctx, {
 		kind: "write",
-		command: `npx arca restore ${name}`
+		command: `npx arca restore ${name}${s.profileFlag()}`
 	});
 	const vault = await s.readVault();
 	const current = vault.vars[name];
@@ -1756,23 +2071,27 @@ async function restoreCommand(s, rawName) {
 		}
 	};
 	else if (!current && vault.removed[name]) storeValue(vault, name, vault.removed[name].value, "restore");
-	else throw new ArcaError(`arca: there's no previous value of ${name} to restore.`);
+	else {
+		const inherited = (await s.resolve()).get(name);
+		if (!current && inherited) throw inheritedError(s, name, inherited.profile, "restore");
+		throw new ArcaError(`arca: there's no previous value of ${name} to restore${s.multiProfile ? ` in profile ${s.profile}` : ""}.`);
+	}
 	await s.writeVault(vault);
 	s.note(`${s.err("green", "✔")} Restored the previous value of ${name}. Run it again to undo.`);
 	return 0;
 }
 async function revealCommand(s, rawName) {
-	const project = s.requireProject();
+	s.requireProject();
 	const name = checkName(rawName, "npx arca reveal NAME");
 	await humanGate(s.io, s.ctx, {
 		kind: "reveal",
-		command: `npx arca reveal ${name}`
+		command: `npx arca reveal ${name}${s.profileFlag()}`
 	});
-	const vault = await s.readVault();
-	const v = vault.vars[name];
+	const values = await s.resolve();
+	const v = values.get(name);
 	if (!v) {
-		const guess = suggest(name, Object.keys(vault.vars));
-		throw new ArcaError(`arca: ${name} is not stored in arca for ${project.config.name}.${guess ? ` Did you mean ${guess}?` : ""}`);
+		const guess = suggest(name, values.keys());
+		throw new ArcaError(`arca: ${name} is not stored in arca for ${s.forWhom()}.${guess ? ` Did you mean ${guess}?` : ""}`);
 	}
 	s.print(v.value);
 	return 0;
@@ -1787,10 +2106,9 @@ async function exportCommand(s, opts) {
 	].includes(format)) throw new ArcaError("arca: --format must be dotenv, json or shell.", 2);
 	await humanGate(s.io, s.ctx, {
 		kind: "reveal",
-		command: "npx arca export"
+		command: `npx arca export${s.profileFlag()}`
 	});
-	const vault = await s.readVault();
-	const entries = Object.entries(vault.vars).map(([k, v]) => [k, v.value]);
+	const entries = [...await s.resolve()].map(([k, v]) => [k, v.value]);
 	let text;
 	if (format === "json") text = JSON.stringify(Object.fromEntries(entries), null, 2);
 	else if (format === "shell") text = entries.map(([k, v]) => `export ${k}='${v.replace(/'/g, `'\\''`)}'`).join("\n");
@@ -1806,15 +2124,16 @@ async function setupCommand(s, opts) {
 	const project = s.requireProject();
 	await humanGate(s.io, s.ctx, {
 		kind: "write",
-		command: "npx arca setup"
+		command: `npx arca setup${s.profileFlag()}`
 	});
 	const vault = await s.readVault();
-	const todo = Object.entries(project.config.vars).filter(([name, d]) => isSensitive(d) && !(name in vault.vars) && (opts.all || d.required));
+	const inherited = await s.resolve();
+	const todo = Object.entries(project.config.vars).filter(([name, d]) => isSensitive(d) && !inherited.has(name) && (opts.all || d.required));
 	if (todo.length === 0) {
-		s.note(`${s.err("green", "✔")} All ${opts.all ? "declared" : "required"} secrets are set for ${project.config.name}.`);
+		s.note(`${s.err("green", "✔")} All ${opts.all ? "declared" : "required"} secrets are set for ${s.forWhom()}.`);
 		return 0;
 	}
-	s.note(`arca: ${plural(todo.length, "variable")} to set for ${project.config.name}. Leave a prompt empty to skip it.\n`);
+	s.note(`arca: ${plural(todo.length, "variable")} to set for ${s.forWhom()}. Leave a prompt empty to skip it.\n`);
 	let set = 0;
 	for (const [name, d] of todo) {
 		s.note(`${s.err("cyan", "◆")} ${s.err("bold", name)}${d.description ? `: ${d.description}` : ""}`);
@@ -1841,7 +2160,7 @@ async function setupCommand(s, opts) {
 	}
 	const left = todo.length - set;
 	if (left === 0) s.note(`\n${s.err("green", "✔")} All ${opts.all ? "declared" : "required"} variables set. Run \`npm run dev\`.`);
-	else s.note(`\narca: set ${set}, ${left} still missing. Run \`npx arca setup\` again later.`);
+	else s.note(`\narca: set ${set}, ${left} still missing. Run \`npx arca setup${s.profileFlag()}\` again later.`);
 	return left === 0 ? 0 : 1;
 }
 /** Decides which entries of which files are secrets. Shared with `arca init`. */
@@ -1897,13 +2216,14 @@ async function importCommand(s, opts) {
 	const project = s.requireProject();
 	await humanGate(s.io, s.ctx, {
 		kind: "write",
-		command: "npx arca import" + (opts.delete ? " --delete" : "")
+		command: `npx arca import${s.profileFlag()}${opts.delete ? " --delete" : ""}`
 	});
 	const files = opts.files.length ? opts.files : defaultImportFiles(s);
 	if (files.length === 0) throw new ArcaError(`arca: no .env files found in ${project.root}. Name the file: npx arca import path/to/.env`);
 	const plan = planImport(s, files, opts);
 	if (plan.sources.length === 0) throw new ArcaError(`arca: none of these files exist: ${files.join(", ")}`);
 	const vault = await s.readVault();
+	const resolved = await s.resolve();
 	const conflicts = [...plan.secrets].filter(([k, v]) => vault.vars[k] && vault.vars[k].value !== v.value).map(([k]) => k);
 	let overwrite = Boolean(opts.yes);
 	if (conflicts.length && !opts.yes) {
@@ -1912,19 +2232,29 @@ async function importCommand(s, opts) {
 		overwrite = answer;
 	}
 	const imported = [];
+	const inheritedSame = [];
+	let changed = false;
 	for (const [key, v] of plan.secrets) {
 		if (vault.vars[key]?.value === v.value) {
 			imported.push(key);
 			continue;
 		}
+		const parent = resolved.get(key);
+		if (!vault.vars[key] && parent && parent.profile !== s.profile && parent.value === v.value) {
+			imported.push(key);
+			inheritedSame.push(key);
+			continue;
+		}
 		if (vault.vars[key] && !overwrite) continue;
 		storeValue(vault, key, v.value, `import:${v.file}`);
 		imported.push(key);
+		changed = true;
 	}
-	if (imported.length) await s.writeVault(vault);
+	if (changed) await s.writeVault(vault);
 	const undeclared = imported.filter((k) => !(k in project.config.vars));
 	if (undeclared.length) declareVars(project.file, Object.fromEntries(undeclared.map((k) => [k, {}])));
-	s.note(`${s.err("green", "✔")} Imported ${plural(imported.length, "secret")} into arca${imported.length ? `: ${imported.join(", ")}` : ""}`);
+	s.note(`${s.err("green", "✔")} Imported ${plural(imported.length, "secret")} into arca${s.multiProfile ? ` (profile ${s.profile})` : ""}${imported.length ? `: ${imported.join(", ")}` : ""}`);
+	if (inheritedSame.length) s.note(s.err("dim", `  same value as the profile it extends, so still inherited: ${inheritedSame.join(", ")}`));
 	if (undeclared.length) s.note(`${s.err("green", "✔")} Declared ${undeclared.join(", ")} in arca.json`);
 	const config = plan.skipped.filter((x) => x.why !== "empty");
 	if (config.length) s.note(s.err("dim", `  stays in .env: ${config.map((x) => x.key).join(", ")}${opts.includePublic ? "" : " (use --include-public or --only to import these too)"}`));
@@ -2077,30 +2407,46 @@ async function initCommand(s, opts) {
 		for (const k of stays) decls[k] = { sensitive: false };
 		declareVars(configFile, decls);
 	}
-	if (otherFiles.length) step(`Left alone: ${otherFiles.join(", ")} (separate sets of values arrive with profiles in a later version)`);
+	const plans = await planProfiles(s, configFile, otherFiles, merged, secretKeys, ask);
+	const modeFiles = otherFiles.filter((n) => MODE_FILE.test(n));
+	const leftAlone = otherFiles.filter((n) => !modeFiles.includes(n) && !plans.some((p) => p.file.name === n));
+	if (modeFiles.length) step(`Left alone: ${modeFiles.join(", ")} (framework mode files, your framework loads them itself)`);
+	if (leftAlone.length) step(`Left alone: ${leftAlone.join(", ")}`);
 	ok(`${created ? "Created" : "Updated"} arca.json${created ? ` (id ${parseProject(readFileSync(configFile, "utf8"), configFile).config.id})` : ""}`);
 	const session = new Session(io);
 	let imported = 0;
-	if (secretKeys.length && opts.import !== false) try {
+	const profileImports = plans.filter((p) => p.store.size > 0);
+	if ((secretKeys.length || profileImports.length) && opts.import !== false) try {
 		await humanGate(io, session.ctx, {
 			kind: "write",
 			command: "npx arca import"
 		});
 		const hadKey = session.store.readGlobalConfig().keychain !== void 0;
-		const vault = await session.readVault();
-		for (const k of secretKeys) {
-			const v = merged.get(k);
-			if (v === "") continue;
-			storeValue(vault, k, v, `import:${[...devFiles].reverse().find((f) => f.entries.some((e) => e.key === k))?.name ?? ".env"}`);
-			imported++;
-		}
-		await session.writeVault(vault);
+		if (secretKeys.length) {
+			const vault = await session.readVault();
+			for (const k of secretKeys) {
+				const v = merged.get(k);
+				if (v === "") continue;
+				storeValue(vault, k, v, `import:${[...devFiles].reverse().find((f) => f.entries.some((e) => e.key === k))?.name ?? ".env"}`);
+				imported++;
+			}
+			await session.writeVault(vault);
+		}
+		for (const plan of profileImports) {
+			const ps = new Session(io, { profile: plan.name });
+			const vault = await ps.readVault();
+			for (const [k, v] of plan.store) storeValue(vault, k, v, `import:${plan.file.name}`);
+			await ps.writeVault(vault);
+			imported += plan.store.size;
+		}
 		if (!hadKey) ok(`Master key created in ${chooseBackend(session.store, io) === "os" ? keychainLabel(io.platform) : "a passphrase-protected file"}`);
-		ok(`Imported ${plural(imported, "secret")} into arca`);
+		const per = profileImports.length ? ` (${[`${session.defaultProfile}: ${secretKeys.length}`, ...profileImports.map((p) => `${p.name}: ${p.store.size}`)].join(", ")})` : "";
+		ok(`Imported ${plural(imported, "secret")} into arca${per}`);
 		ok("Your .env files were not changed");
 	} catch (e) {
 		if (!(e instanceof ArcaError)) throw e;
 		s.note(`${s.err("yellow", "✋")} Moving secret values into arca needs a human. Ask the user to run:  npx arca import`);
+		for (const p of profileImports) s.note(`   and:  npx arca import ${p.file.name} --profile ${p.name}`);
 		s.note("   (the .env files stay untouched)");
 	}
 	if (pkg?.scripts) {
@@ -2172,11 +2518,75 @@ async function initCommand(s, opts) {
 	};
 	if (pkg && !deps["@bremmdev/arca-env"]) s.note(`\nInstall arca in this project:  npm i -D @bremmdev/arca-env`);
 	if (imported) {
-		s.note("\n" + s.err("yellow", `⚠ The ${plural(imported, "secret")} still have plaintext copies in ${devFiles.map((f) => f.name).join(", ")}.`));
-		s.note("  Remove just those entries (config lines stay):   npx arca import --delete");
+		const withSecrets = plans.filter((p) => p.secrets.size > 0);
+		const files = [...secretKeys.length ? devFiles.map((f) => f.name) : [], ...withSecrets.map((p) => p.file.name)];
+		s.note("\n" + s.err("yellow", `⚠ The ${plural(imported, "secret")} still have plaintext copies in ${files.join(", ")}.`));
+		s.note("  Remove just those entries (config lines stay):");
+		if (secretKeys.length) s.note("    npx arca import --delete");
+		for (const p of withSecrets) s.note(`    npx arca import ${p.file.name} --profile ${p.name} --delete`);
 	} else if (!secretKeys.length) s.note("\nNext: npx arca set DATABASE_URL   or   npx arca setup");
+	if (plans.length) s.note(`\nSwitch profiles with  npx arca use ${plans[0].name}  (and back with  npx arca use --reset)`);
 	return 0;
 }
+/** Files Next.js and Vite load by themselves, depending on the mode. Not profiles. */
+const MODE_FILE = /^\.env\.(development|production|test)(\.local)?$/;
+/**
+* `.env.acceptatie` → profile `acceptatie`. Secrets go into the profile's vault and config lines
+* stay in the file, which the profile lists in `envFiles`. When the file shares most secrets with
+* the default set (or leaves some out), the profile extends the default and stores only what differs.
+*/
+async function planProfiles(s, configFile, candidates, defaults, defaultSecrets, ask) {
+	const config = parseProject(readFileSync(configFile, "utf8"), configFile).config;
+	const plans = [];
+	for (const fileName of candidates) {
+		const m = /^\.env\.([A-Za-z0-9_-]+)$/.exec(fileName);
+		if (!m || MODE_FILE.test(fileName)) continue;
+		const name = normalizeProfile(m[1]);
+		if (invalidProfileName(name) || name in config.profiles) continue;
+		const file = readEnvFile(join(s.io.cwd, fileName), fileName);
+		if (!file || file.entries.length === 0) continue;
+		const secrets = /* @__PURE__ */ new Map();
+		const configKeys = [];
+		for (const e of file.entries) {
+			if (e.value === "") continue;
+			const d = config.vars[e.key];
+			if (d ? isSensitive(d) : defaultSecrets.includes(e.key) || Boolean(secretReason(e.key, e.value))) secrets.set(e.key, e.value);
+			else configKeys.push(e.key);
+		}
+		const same = [...secrets].filter(([k, v]) => defaultSecrets.includes(k) && defaults.get(k) === v).length;
+		const leavesOut = defaultSecrets.some((k) => !secrets.has(k));
+		const extend = defaultSecrets.length > 0 && (leavesOut || same * 2 >= secrets.size);
+		const store = new Map([...secrets].filter(([k, v]) => !extend || !defaultSecrets.includes(k) || defaults.get(k) !== v));
+		if (!await ask(`Create profile ${name} from ${fileName} (${extend ? `extends ${config.defaultProfile}, ${plural(store.size, "secret")} of its own` : `${plural(secrets.size, "secret")}`}${configKeys.length ? `, ${plural(configKeys.length, "config line")} ${configKeys.length === 1 ? "stays" : "stay"} in the file` : ""})?`, true)) continue;
+		plans.push({
+			name,
+			file,
+			extends: extend ? config.defaultProfile : void 0,
+			secrets,
+			store,
+			config: configKeys
+		});
+	}
+	if (plans.length === 0) return plans;
+	updateConfigFile(configFile, (raw) => {
+		const profiles = raw.profiles && typeof raw.profiles === "object" && Object.keys(raw.profiles).length > 0 ? raw.profiles : { [config.defaultProfile]: {} };
+		for (const p of plans) {
+			const decl = {};
+			if (p.extends) decl.extends = p.extends;
+			if (p.config.length) decl.envFiles = [p.file.name];
+			profiles[p.name] = decl;
+		}
+		raw.profiles = profiles;
+	});
+	const decls = {};
+	for (const p of plans) {
+		for (const k of p.secrets.keys()) decls[k] ??= {};
+		for (const k of p.config) decls[k] ??= { sensitive: false };
+	}
+	declareVars(configFile, decls);
+	for (const p of plans) s.note(`${s.err("green", "✔")} Profile ${p.name}${p.extends ? ` (extends ${p.extends})` : ""}: ${p.store.size ? `${p.store.size} → arca` : "no secrets of its own"}${p.config.length ? `, config stays in ${p.file.name}` : ""}`);
+	return plans;
+}
 /** The arca section of an AGENTS.md: from its heading to the next heading or HTML comment block. */
 function findSection(text, marker) {
 	const start = text.indexOf(marker);
@@ -2239,14 +2649,16 @@ function keychainLabel(platform) {
 }
 //#endregion
 //#region src/commands/info.ts
-function rows(s, vault) {
+function rows(s, values, profile = s.profile) {
 	const project = s.requireProject();
 	const decls = project.config.vars;
-	const files = s.envFilesForGuard().filter((f) => !isTemplateFile(f.name));
-	const inFile = (name) => files.find((f) => f.entries.some((e) => e.key === name && e.value !== ""));
-	return [.../* @__PURE__ */ new Set([...Object.keys(decls), ...Object.keys(vault.vars)])].map((name) => {
+	const files = s.envFilesFor(profile).filter((f) => !isTemplateFile(f.name));
+	const loaded = s.envFiles(profile).map((f) => resolve(project.root, f));
+	const ranked = [...files].sort((a, b) => loaded.indexOf(b.path) - loaded.indexOf(a.path));
+	const inFile = (name) => ranked.find((f) => f.entries.some((e) => e.key === name && e.value !== ""));
+	return [.../* @__PURE__ */ new Set([...Object.keys(decls), ...values.keys()])].map((name) => {
 		const d = decls[name];
-		const stored = vault.vars[name];
+		const stored = values.get(name);
 		const sensitive = isSensitive(d);
 		const file = inFile(name);
 		const base = {
@@ -2259,6 +2671,8 @@ function rows(s, vault) {
 		if (stored) return {
 			...base,
 			status: "arca",
+			profile: stored.profile,
+			inherited: stored.profile !== profile,
 			updatedAt: stored.updatedAt
 		};
 		if (file) return {
@@ -2274,7 +2688,7 @@ function rows(s, vault) {
 }
 function statusText(r, p) {
 	switch (r.status) {
-		case "arca": return p("green", "✔ arca");
+		case "arca": return r.inherited ? p("green", `✔ arca ↳ ${r.profile}`) : p("green", "✔ arca");
 		case "env-file": return p("cyan", `✔ ${r.source}`);
 		case "env-file-sensitive": return p("yellow", `⚠ ${r.source} (should be in arca)`);
 		case "missing": return p("red", "✖ missing (required)");
@@ -2282,11 +2696,11 @@ function statusText(r, p) {
 	}
 }
 async function listCommand(s) {
-	const project = s.requireProject();
+	s.requireProject();
 	s.warnConfig();
-	const list = rows(s, await s.readVault());
+	const list = rows(s, await s.resolve());
 	if (s.json) {
-		s.print(JSON.stringify(list.map(({ description, ...r }) => ({
+		s.print(JSON.stringify(list.map(({ description, inherited, ...r }) => ({
 			...r,
 			description: description ?? null
 		})), null, 2));
@@ -2294,9 +2708,10 @@ async function listCommand(s) {
 	}
 	const p = s.out;
 	if (list.length === 0) {
-		s.print(`No variables declared or stored for ${project.config.name} yet. Declare them in arca.json, then run \`npx arca setup\`.`);
+		s.print(`No variables declared or stored for ${s.forWhom()} yet. Declare them in arca.json, then run \`npx arca setup${s.profileFlag()}\`.`);
 		return 0;
 	}
+	if (s.multiProfile && s.profileSource !== "flag") return listMatrix(s);
 	const w = Math.max(4, ...list.map((r) => r.name.length)) + 2;
 	const sw = Math.max(...list.map((r) => statusText(r, (_, t) => t).length)) + 2;
 	s.print(p("bold", `${pad("NAME", w)}${pad("STATUS", sw)}${pad("KIND", 9)}UPDATED`));
@@ -2307,37 +2722,108 @@ async function listCommand(s) {
 	}
 	return 0;
 }
+/**
+* The `arca list` matrix:
+*                  ontwikkel ●    acceptatie         test
+*   DATABASE_URL   ✔ set          ✔ set              ↳ ontwikkel
+*/
+async function listMatrix(s) {
+	const p = s.out;
+	const profiles = s.profiles;
+	const tables = /* @__PURE__ */ new Map();
+	for (const profile of profiles) tables.set(profile, new Map(rows(s, await s.resolve(profile), profile).map((r) => [r.name, r])));
+	const names = [...new Set([...tables.values()].flatMap((t) => [...t.keys()]))];
+	const cell = (r) => {
+		if (!r) return ["–", "dim"];
+		if (r.status === "arca") return r.inherited ? [`↳ ${r.profile}`, "green"] : ["✔ set", "green"];
+		if (r.status === "env-file") return [r.source, "cyan"];
+		if (r.status === "env-file-sensitive") return [`⚠ ${r.source}`, "yellow"];
+		if (r.status === "missing") return ["✖ missing", "red"];
+		return ["–", "dim"];
+	};
+	const heads = profiles.map((x) => x === s.profile ? `${x} ●` : x);
+	const w = Math.max(4, ...names.map((n) => n.length)) + 2;
+	const widths = profiles.map((x, i) => Math.max(heads[i].length, ...names.map((n) => cell(tables.get(x).get(n))[0].length)) + 3);
+	s.print(p("bold", (pad("", w) + heads.map((h, i) => pad(h, widths[i])).join("")).trimEnd()));
+	for (const name of names) {
+		const cells = profiles.map((x, i) => {
+			const [text, color] = cell(tables.get(x).get(name));
+			return pad(p(color, text), widths[i]);
+		});
+		const declared = [...tables.values()].some((t) => t.get(name)?.declared);
+		s.print(`${pad(name, w)}${cells.join("")}${declared ? "" : p("dim", "(undeclared)")}`.trimEnd());
+	}
+	s.print(p("dim", `\n● active profile: ${s.profile}${activeWhy(s)}. Switch with \`npx arca use <profile>\`.`));
+	return 0;
+}
+/** " (via arca use)", " (the default)", or nothing when the profile is literally called "default". */
+function activeWhy(s) {
+	if (s.profileSource !== "default") return ` (via ${sourceLabel(s)})`;
+	return s.profile === "default" ? "" : " (the default)";
+}
+function sourceLabel(s) {
+	return s.profileSource === "flag" ? "--profile" : s.profileSource === "env" ? "ARCA_PROFILE" : s.profileSource === "use" ? "arca use" : "default";
+}
+async function checkProfile(s, profile) {
+	const project = s.requireProject();
+	const values = await s.resolve(profile);
+	const files = s.envFilesFor(profile).filter((f) => !isTemplateFile(f.name));
+	const envFileValues = loadEnvFiles(project.root, s.envFiles(profile));
+	const present = (name) => values.has(name) || Boolean(s.io.env[name]) || Boolean(envFileValues[name]) || files.some((f) => f.entries.some((e) => e.key === name && e.value !== ""));
+	const required = Object.entries(project.config.vars).filter(([, d]) => d.required);
+	return {
+		profile,
+		required: required.length,
+		missing: required.filter(([n]) => !present(n)).map(([n]) => n),
+		misplaced: required.filter(([n, d]) => isSensitive(d) && !values.has(n) && !s.io.env[n] && present(n)).map(([n]) => n),
+		undeclared: [...values.keys()].filter((n) => !(n in project.config.vars))
+	};
+}
 async function checkCommand(s, opts) {
 	const project = s.requireProject();
 	s.warnConfig();
-	const vault = await s.readVault();
-	const files = s.envFilesForGuard().filter((f) => !isTemplateFile(f.name));
-	const envFileValues = loadEnvFiles(project.root, project.config.envFiles);
-	const present = (name) => name in vault.vars || Boolean(s.io.env[name]) || Boolean(envFileValues[name]) || files.some((f) => f.entries.some((e) => e.key === name && e.value !== ""));
-	const required = Object.entries(project.config.vars).filter(([, d]) => d.required);
-	const missing = required.filter(([n]) => !present(n)).map(([n]) => n);
-	const misplaced = required.filter(([n, d]) => isSensitive(d) && !(n in vault.vars) && !s.io.env[n] && present(n)).map(([n]) => n);
-	const findings = scanEnvFiles(project, s.envFilesForGuard(), s.secrets(vault));
-	const undeclared = Object.keys(vault.vars).filter((n) => !(n in project.config.vars));
-	if (s.json) s.print(JSON.stringify({
-		ok: missing.length === 0 && (!opts.strict || findings.length === 0),
-		missing,
-		inEnvFiles: misplaced,
-		undeclared,
-		leakGuard: findings
-	}, null, 2));
-	else {
+	const results = [];
+	for (const profile of opts.allProfiles ? s.profiles : [s.profile]) results.push(await checkProfile(s, profile));
+	const findings = scanEnvFiles(project, s.envFilesForGuard(), await s.allSecrets());
+	const missingAny = results.some((r) => r.missing.length > 0);
+	if (s.json) {
+		const ok = !missingAny && (!opts.strict || findings.length === 0);
+		if (opts.allProfiles) {
+			const profiles = Object.fromEntries(results.map(({ profile, required, ...r }) => [profile, {
+				ok: r.missing.length === 0,
+				...r
+			}]));
+			s.print(JSON.stringify({
+				ok,
+				profiles,
+				leakGuard: findings
+			}, null, 2));
+		} else {
+			const r = results[0];
+			s.print(JSON.stringify({
+				ok,
+				profile: r.profile,
+				missing: r.missing,
+				inEnvFiles: r.misplaced,
+				undeclared: r.undeclared,
+				leakGuard: findings
+			}, null, 2));
+		}
+	} else {
 		const p = s.out;
-		if (missing.length === 0) s.print(`${p("green", "✔")} All ${plural(required.length, "required variable")} set for ${project.config.name}`);
-		else {
-			s.print(`${p("red", "✖")} ${plural(missing.length, "required variable")} missing for ${project.config.name}: ${missing.join(", ")}`);
-			s.print(`  Run \`npx arca setup\` to set them. (AI agents: ask the user to run it.)`);
+		for (const r of results) {
+			const who = s.forWhom(r.profile);
+			if (r.missing.length === 0) s.print(`${p("green", "✔")} All ${plural(r.required, "required variable")} set for ${who}`);
+			else {
+				s.print(`${p("red", "✖")} ${plural(r.missing.length, "required variable")} missing for ${who}: ${r.missing.join(", ")}`);
+				s.print(`  Run \`npx arca setup${s.profileFlag(r.profile)}\` to set them. (AI agents: ask the user to run it.)`);
+			}
+			for (const n of r.misplaced) s.print(`${p("yellow", "⚠")} ${n} is a secret but comes from a .env file. Move it: npx arca import --only ${n} --delete${s.profileFlag(r.profile)}`);
+			if (r.undeclared.length) s.print(p("dim", `  stored but not declared in arca.json: ${r.undeclared.join(", ")}`));
 		}
-		for (const n of misplaced) s.print(`${p("yellow", "⚠")} ${n} is a secret but comes from a .env file. Move it: npx arca import --only ${n} --delete`);
-		if (undeclared.length) s.print(p("dim", `  stored but not declared in arca.json: ${undeclared.join(", ")}`));
 		if (findings.length) s.print(`${p("yellow", "⚠")} Leak guard: ${plural(findings.length, "possible secret")} in .env files (run \`npx arca doctor\` for details)`);
 	}
-	if (missing.length) return 1;
+	if (missingAny) return 1;
 	if (opts.strict && findings.length) return 1;
 	return 0;
 }
@@ -2380,20 +2866,35 @@ async function doctorCommand(s) {
 	info(`${project.config.name} (${project.config.id})`);
 	info(`Config: ${project.file}`);
 	for (const w of project.warnings) warn(w);
-	const vault = master && s.hasVault() ? s.store.readVault(master, project.config.id, s.profile) : null;
-	if (s.hasVault()) ok(`Vault: ${plural(Object.keys(vault?.vars ?? {}).length, "secret")} stored`);
-	else info("No secrets stored for this project on this machine yet");
 	const reg = s.store.readRegistry()[project.config.id];
 	const remote = gitRemote(project.root);
 	if (reg?.gitRemote && remote && reg.gitRemote !== remote) {
 		warn(`The ID is also used by ${reg.roots[0]} (git remote ${reg.gitRemote}). If these are different projects: npx arca init --new-id`);
 		problems++;
 	}
+	s.print(p("bold", s.multiProfile ? "\nProfiles" : "\nVault"));
+	if (s.multiProfile) info(`Active: ${s.profile} (${sourceLabel(s)})${s.staleActiveProfile ? `; \`arca use\` points at "${s.staleActiveProfile}", which no longer exists` : ""}`);
 	const decls = project.config.vars;
-	const short = Object.entries(vault?.vars ?? {}).filter(([n, v]) => isSensitive(decls[n]) && v.value.length < 6);
-	for (const [n] of short) warn(`${n} is shorter than 6 characters, so it isn't masked in output`);
-	const missing = Object.entries(decls).filter(([n, d]) => d.required && isSensitive(d) && !vault?.vars[n]).map(([n]) => n);
-	if (missing.length) warn(`Required secrets not stored: ${missing.join(", ")}. Run \`npx arca setup\`.`);
+	let active = null;
+	for (const profile of s.profiles) {
+		const label = s.multiProfile ? `${profile}: ` : "";
+		if (!s.hasVault(profile)) {
+			info(`${label}no secrets stored on this machine yet`);
+			const missing = Object.entries(decls).filter(([, d]) => d.required && isSensitive(d)).map(([n]) => n);
+			if (missing.length) warn(`${label}required secrets not stored: ${missing.join(", ")}. Run \`npx arca setup${s.profileFlag(profile)}\`.`);
+			continue;
+		}
+		if (!master) continue;
+		const values = await s.resolve(profile);
+		if (profile === s.profile) active = values;
+		const own = [...values.values()].filter((v) => v.profile === profile).length;
+		const inherited = values.size - own;
+		ok(`${label}${plural(own, "secret")} stored${inherited ? `, ${inherited} inherited` : ""}`);
+		const short = [...values].filter(([n, v]) => v.profile === profile && isSensitive(decls[n]) && v.value.length < 6);
+		for (const [n] of short) warn(`${label}${n} is shorter than 6 characters, so it isn't masked in output`);
+		const missing = Object.entries(decls).filter(([n, d]) => d.required && isSensitive(d) && !values.has(n)).map(([n]) => n);
+		if (missing.length) warn(`${label}required secrets not stored: ${missing.join(", ")}. Run \`npx arca setup${s.profileFlag(profile)}\`.`);
+	}
 	const pkgFile = join(s.packageRoot() ?? project.root, "package.json");
 	if (existsSync(pkgFile)) {
 		s.print(p("bold", "\nScripts"));
@@ -2404,11 +2905,12 @@ async function doctorCommand(s) {
 		else warn("No scripts use `arca run` yet, so nothing gets secrets. Run `npx arca init` to wrap them.");
 		if (unwrapped.length) info(`Not wrapped (no secrets): ${unwrapped.join(", ")}`);
 	}
-	const modeFiles = project.config.envFiles.filter((f) => /^\.env\.(development|production|test)(\.local)?$/.test(f));
+	const allEnvFiles = [...project.config.envFiles, ...Object.values(project.config.profiles).flatMap((x) => x.envFiles)];
+	const modeFiles = [...new Set(allEnvFiles)].filter((f) => /^\.env\.(development|production|test)(\.local)?$/.test(f));
 	for (const f of modeFiles) warn(`envFiles lists ${f}. arca injects it as process env, which beats the framework's own mode files (e.g. in \`next build\`). Prefer a name frameworks don't load.`);
 	s.print(p("bold", "\nLeak guard (.env files)"));
 	const files = s.envFilesForGuard();
-	const findings = scanEnvFiles(project, files, vault ? s.secrets(vault) : []);
+	const findings = scanEnvFiles(project, files, master ? await s.allSecrets() : []);
 	if (files.length === 0) info("No .env files");
 	else if (findings.length === 0) ok(`${plural(files.length, "file")} checked, no secrets found: ${files.map((f) => f.name).join(", ")}`);
 	for (const f of findings) {
@@ -2416,10 +2918,11 @@ async function doctorCommand(s) {
 		s.print(`      ${p("dim", fixFor(f))}`);
 		problems++;
 	}
-	const secretPrefixes = new Set(Object.keys(vault?.vars ?? {}).map((n) => n.split("_")[0]));
+	const stored = active ?? /* @__PURE__ */ new Map();
+	const secretPrefixes = new Set([...stored.keys()].map((n) => n.split("_")[0]));
 	for (const file of files) for (const e of file.entries) {
 		if (!/^https?:\/\//i.test(e.value) || decls[e.key]?.sensitive === true) continue;
-		if (secretPrefixes.has(e.key.split("_")[0]) && !(e.key in (vault?.vars ?? {}))) info(`${e.key} in ${file.name} is a URL next to the secret ${e.key.split("_")[0]}_… If it receives that credential, keep it in arca so only you can change it.`);
+		if (secretPrefixes.has(e.key.split("_")[0]) && !stored.has(e.key)) info(`${e.key} in ${file.name} is a URL next to the secret ${e.key.split("_")[0]}_… If it receives that credential, keep it in arca so only you can change it.`);
 	}
 	if (master) {
 		const policy = s.store.readPolicy(master, project.config.id);
@@ -2450,15 +2953,16 @@ async function statusCommand(s, version) {
 	}
 	s.warnConfig();
 	const project = s.project;
-	const vault = await s.readVault();
-	const missing = rows(s, vault).filter((r) => r.status === "missing").map((r) => r.name);
+	const values = await s.resolve();
+	const missing = rows(s, values).filter((r) => r.status === "missing").map((r) => r.name);
 	s.print(`\nProject   ${project.config.name} (${project.config.id})`);
-	s.print(`Secrets   ${plural(Object.keys(vault.vars).length, "stored")}${missing.length ? p("red", `, missing: ${missing.join(", ")}`) : ""}`);
+	if (s.multiProfile) s.print(`Profile   ${s.profile}${activeWhy(s)}  ${p("dim", `(profiles: ${s.profiles.join(", ")})`)}`);
+	s.print(`Secrets   ${values.size} stored${missing.length ? p("red", `, missing: ${missing.join(", ")}`) : ""}`);
 	const policy = await s.policy();
 	s.print(`Agents    ${policy.agentRun === "scripts" ? "package scripts only, output masked" : "denied"}`);
 	s.print(`You       ${s.ctx.agent.detected ? `AI agent (${s.ctx.agent.name} via ${s.ctx.agent.via})` : s.ctx.interactiveOutput ? "interactive terminal" : "non-interactive"}`);
 	s.print(`Store     ${s.store.root}`);
-	s.print(`\n${missing.length ? "Next: npx arca setup" : "Run your app as usual, e.g. npm run dev"}    ·    npx arca help`);
+	s.print(`\n${missing.length ? `Next: npx arca setup${s.profileFlag()}` : "Run your app as usual, e.g. npm run dev"}    ·    npx arca help`);
 	return 0;
 }
 async function policyCommand(s, args) {
@@ -2507,6 +3011,240 @@ async function projectsCommand(s, args) {
 	return 0;
 }
 //#endregion
+//#region src/commands/profiles.ts
+async function useCommand(s, opts) {
+	const project = s.requireProject();
+	const { id, name, defaultProfile } = project.config;
+	const p = s.err;
+	if (opts.reset || opts.profile !== void 0 && normalizeProfile(opts.profile) === defaultProfile) {
+		s.store.writeState(id, {});
+		s.note(`${p("green", "✔")} ${name} is back on ${defaultProfile}`);
+		envOverrideNote(s);
+		return 0;
+	}
+	if (opts.profile === void 0) {
+		if (s.json) {
+			s.print(JSON.stringify({
+				profile: s.profile,
+				source: s.profileSource,
+				defaultProfile,
+				profiles: s.profiles
+			}, null, 2));
+			return 0;
+		}
+		s.warnConfig();
+		s.print(`${s.profile}${s.out("dim", activeWhy(s))}`);
+		if (!s.multiProfile) s.note(p("dim", `${name} has one profile. Add another with \`npx arca profiles add <name>\`.`));
+		else s.note(p("dim", `Profiles: ${s.profiles.join(", ")}. Switch with \`npx arca use <profile>\`.`));
+		return 0;
+	}
+	const profile = s.checkProfile(project, opts.profile, "arca use");
+	s.store.writeState(id, {
+		activeProfile: profile,
+		setAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	s.note(`${p("green", "✔")} ${name} now uses profile ${profile} for every arca run on this machine`);
+	s.note(`  Back to ${defaultProfile}:  npx arca use --reset`);
+	const missing = await missingFor(s, profile);
+	if (missing.length) s.note(p("yellow", `⚠ ${profile} has no value for ${missing.join(", ")}. Run \`npx arca setup --profile ${profile}\`.`));
+	envOverrideNote(s);
+	return 0;
+}
+function envOverrideNote(s) {
+	if (s.profileSource === "env") s.note(s.err("yellow", `⚠ ARCA_PROFILE=${s.io.env.ARCA_PROFILE} is set in this terminal and wins over \`arca use\` here.`));
+}
+/** Required secrets the profile has no value for (names only). */
+async function missingFor(s, profile) {
+	const values = s.hasVault(profile) ? await s.resolve(profile) : /* @__PURE__ */ new Map();
+	return Object.entries(s.requireProject().config.vars).filter(([n, d]) => d.required && isSensitive(d) && !values.has(n)).map(([n]) => n);
+}
+async function profilesCommand(s, args, opts) {
+	const [action = "list", ...rest] = args;
+	switch (action) {
+		case "list":
+		case "ls": return listProfiles(s);
+		case "add": return addProfile(s, rest[0], opts);
+		case "diff": return diffProfiles(s, rest[0], rest[1]);
+		case "copy":
+		case "cp": return copyProfile(s, rest[0], rest[1], opts);
+		case "rm":
+		case "remove": return removeProfile(s, rest[0], opts);
+	}
+	throw new ArcaError("arca: usage: npx arca profiles [list]  |  add <name> [--extends p]  |  diff <a> <b>  |  copy <from> <to> [--only A,B]  |  rm <name>", 2);
+}
+async function listProfiles(s) {
+	const project = s.requireProject();
+	s.warnConfig();
+	const list = [];
+	for (const profile of s.profiles) {
+		const values = s.hasVault(profile) ? await s.resolve(profile) : /* @__PURE__ */ new Map();
+		const own = [...values.values()].filter((v) => v.profile === profile).length;
+		list.push({
+			name: profile,
+			active: profile === s.profile,
+			default: profile === project.config.defaultProfile,
+			extends: project.config.profiles[profile]?.extends ?? null,
+			envFiles: project.config.profiles[profile]?.envFiles ?? [],
+			own,
+			inherited: values.size - own,
+			missing: await missingFor(s, profile)
+		});
+	}
+	if (s.json) {
+		s.print(JSON.stringify(list, null, 2));
+		return 0;
+	}
+	const p = s.out;
+	const w = Math.max(7, ...list.map((x) => x.name.length + 2)) + 2;
+	s.print(p("bold", `${pad("PROFILE", w)}${pad("EXTENDS", 14)}${pad("VALUES", 22)}MISSING`));
+	for (const x of list) {
+		const label = `${x.active ? "●" : " "} ${x.name}`;
+		const values = `${x.own} set${x.inherited ? `, ${x.inherited} inherited` : ""}`;
+		const missing = x.missing.length ? p("red", x.missing.join(", ")) : p("dim", "–");
+		const tags = [x.default ? "default" : "", ...x.envFiles].filter(Boolean);
+		s.print(`${pad(label, w)}${pad(x.extends ?? "–", 14)}${pad(values, 22)}${missing}${tags.length ? p("dim", `  (${tags.join(", ")})`) : ""}`);
+	}
+	s.print(p("dim", `\n● active (${sourceLabel(s)}). Switch: npx arca use <profile>   Add: npx arca profiles add <name> [--extends ${project.config.defaultProfile}]`));
+	return 0;
+}
+async function addProfile(s, raw, opts) {
+	const project = s.requireProject();
+	if (!raw) throw new ArcaError("arca: missing profile name. Usage: npx arca profiles add <name> [--extends <profile>]", 2);
+	const name = normalizeProfile(raw);
+	const bad = invalidProfileName(name);
+	if (bad) throw new ArcaError(`arca: ${bad}.`, 2);
+	if (name in project.config.profiles) throw new ArcaError(`arca: profile ${name} already exists in arca.json.`);
+	const parent = opts.extends !== void 0 ? s.checkProfile(project, opts.extends, "--extends") : void 0;
+	addProfileToConfig(project, name, { extends: parent });
+	const p = s.err;
+	s.note(`${p("green", "✔")} Added profile ${name}${parent ? ` (extends ${parent}, so it only stores what differs)` : ""} to arca.json`);
+	s.note("  Next, in your own terminal:");
+	if (parent) s.note(`    npx arca set NAME --profile ${name}             override a value from ${parent}`);
+	else {
+		s.note(`    npx arca profiles copy ${project.config.defaultProfile} ${name}    start from ${project.config.defaultProfile}'s values, or`);
+		s.note(`    npx arca setup --profile ${name}               enter each value`);
+	}
+	s.note(`    npx arca use ${name}                         switch to it`);
+	return 0;
+}
+/** Names only: which values each profile sets itself, and which it inherits. */
+async function diffProfiles(s, rawA, rawB) {
+	const project = s.requireProject();
+	if (!rawA || !rawB) throw new ArcaError("arca: usage: npx arca profiles diff <a> <b>", 2);
+	const a = s.checkProfile(project, rawA, "profiles diff");
+	const b = s.checkProfile(project, rawB, "profiles diff");
+	const va = s.hasVault(a) ? await s.resolve(a) : /* @__PURE__ */ new Map();
+	const vb = s.hasVault(b) ? await s.resolve(b) : /* @__PURE__ */ new Map();
+	const names = [.../* @__PURE__ */ new Set([
+		...Object.keys(project.config.vars).filter((n) => isSensitive(project.config.vars[n])),
+		...va.keys(),
+		...vb.keys()
+	])];
+	const describe = (values, profile, name) => {
+		const v = values.get(name);
+		if (!v) return {
+			text: "– not set",
+			color: "dim",
+			kind: "missing"
+		};
+		if (v.profile === profile) return {
+			text: "✔ own value",
+			color: "green",
+			kind: "own"
+		};
+		return {
+			text: `↳ ${v.profile}`,
+			color: "cyan",
+			kind: `inherits:${v.profile}`
+		};
+	};
+	const rowsOut = names.map((name) => ({
+		name,
+		a: describe(va, a, name),
+		b: describe(vb, b, name)
+	}));
+	if (s.json) {
+		s.print(JSON.stringify(rowsOut.map((r) => ({
+			name: r.name,
+			[a]: r.a.kind,
+			[b]: r.b.kind
+		})), null, 2));
+		return 0;
+	}
+	const p = s.out;
+	const w = Math.max(4, ...names.map((n) => n.length)) + 2;
+	const cw = Math.max(a.length, ...rowsOut.map((r) => r.a.text.length)) + 3;
+	s.print(p("bold", `${pad("", w)}${pad(a, cw)}${b}`));
+	for (const r of rowsOut) s.print(`${pad(r.name, w)}${pad(p(r.a.color, r.a.text), cw)}${p(r.b.color, r.b.text)}`);
+	const ownB = rowsOut.filter((r) => r.b.kind === "own").map((r) => r.name);
+	s.print(p("dim", `\n${b} sets ${ownB.length ? ownB.join(", ") : "nothing"} itself. Names only: values are never compared or shown.`));
+	return 0;
+}
+async function copyProfile(s, rawFrom, rawTo, opts) {
+	const project = s.requireProject();
+	if (!rawFrom || !rawTo) throw new ArcaError("arca: usage: npx arca profiles copy <from> <to> [--only A,B]", 2);
+	const from = s.checkProfile(project, rawFrom, "profiles copy");
+	const to = s.checkProfile(project, rawTo, "profiles copy");
+	if (from === to) throw new ArcaError("arca: <from> and <to> are the same profile.", 2);
+	await humanGate(s.io, s.ctx, {
+		kind: "write",
+		command: `npx arca profiles copy ${from} ${to}${opts.only ? ` --only ${opts.only.join(",")}` : ""}`
+	});
+	const source = await s.resolve(from);
+	const only = opts.only ? new Set(opts.only) : null;
+	const picked = [...source].filter(([n]) => !only || only.has(n));
+	if (only) {
+		const unknown = [...only].filter((n) => !source.has(n));
+		if (unknown.length) s.note(s.err("yellow", `arca: not stored in ${from}: ${unknown.join(", ")}`));
+	}
+	if (picked.length === 0) throw new ArcaError(`arca: ${from} has no values to copy.`);
+	const target = await s.readVault(to);
+	const conflicts = picked.filter(([n, v]) => target.vars[n] && target.vars[n].value !== v.value).map(([n]) => n);
+	let overwrite = Boolean(opts.yes);
+	if (conflicts.length && !opts.yes) {
+		const answer = await s.io.prompts.confirm(`${to} already has its own ${conflicts.join(", ")}. Overwrite with ${from}'s?`, false);
+		if (answer === null) throw new ArcaError("arca: cancelled. Nothing was changed.");
+		overwrite = answer;
+	}
+	const copied = [];
+	for (const [n, v] of picked) {
+		if (target.vars[n]?.value === v.value) continue;
+		if (target.vars[n] && !overwrite) continue;
+		storeValue(target, n, v.value, `copy:${from}`);
+		copied.push(n);
+	}
+	if (copied.length) await s.writeVault(target, to);
+	const skipped = picked.length - copied.length;
+	s.note(`${s.err("green", "✔")} Copied ${plural(copied.length, "value")} from ${from} to ${to}${copied.length ? `: ${copied.join(", ")}` : ""}`);
+	if (skipped) s.note(s.err("dim", `  ${plural(skipped, "value")} left as ${to} had ${skipped === 1 ? "it" : "them"}`));
+	if (copied.length) s.note(`  Change the ones that differ:  npx arca set NAME --profile ${to}`);
+	return 0;
+}
+async function removeProfile(s, raw, opts) {
+	const project = s.requireProject();
+	if (!raw) throw new ArcaError("arca: usage: npx arca profiles rm <name>", 2);
+	const name = s.checkProfile(project, raw, "profiles rm");
+	const { id, defaultProfile } = project.config;
+	if (name === defaultProfile) throw new ArcaError(`arca: ${name} is the default profile. Set another "defaultProfile" in arca.json first.`);
+	const children = profileChildren(project.config, name);
+	if (children.length) throw new ArcaError(`arca: ${children.join(", ")} ${children.length === 1 ? "extends" : "extend"} ${name}. Change or remove ${children.length === 1 ? "it" : "them"} first.`);
+	await humanGate(s.io, s.ctx, {
+		kind: "write",
+		command: `npx arca profiles rm ${name}`
+	});
+	const stored = s.ownsVault(name) ? Object.keys((await s.readVault(name)).vars).length : 0;
+	if (!opts.yes) {
+		const what = stored ? ` and its ${plural(stored, "value")} on this machine` : "";
+		if (!await s.io.prompts.confirm(`Remove profile ${name} from arca.json${what}? This can't be undone.`, false)) throw new ArcaError("arca: cancelled. Nothing was changed.");
+	}
+	removeProfileFromConfig(project.file, name);
+	s.store.removeVault(id, name);
+	if (s.store.readState(id).activeProfile === name) s.store.writeState(id, {});
+	s.note(`${s.err("green", "✔")} Removed profile ${name}${stored ? ` and its ${plural(stored, "value")}` : ""}`);
+	s.note(s.err("dim", "  Teammates keep their own values for it until they remove it too."));
+	return 0;
+}
+//#endregion
 //#region src/main.ts
 const VERSION = "0.1.0";
 const HELP = `arca: keep secrets out of .env files and out of reach of AI agents
@@ -2520,8 +3258,17 @@ Everyday
                           --no-override   let values inherited from the shell win over arca
   list, ls                Variables and where each one comes from (names only, never values)
   check [--strict]        Exit 1 if required variables are missing (--strict: also on leak-guard findings)
+        [--all-profiles]
   doctor                  Diagnose keychain, project, scripts and .env files
 
+Profiles (sets of values for the same variables, e.g. ontwikkel and acceptatie)
+  use [profile]           Show or switch the active profile for every arca run of this project
+  use --reset             Back to the default profile
+  profiles                List profiles: active, extends, values set, missing
+  profiles add <name> [--extends p]           profiles diff <a> <b>   (names only)
+  profiles copy <from> <to> [--only A,B]      profiles rm <name>      (person only)
+  Every value command takes --profile <name> (-p). ARCA_PROFILE=<name> picks one for a terminal.
+
 Values (only a person at a terminal)
   set NAME [--generate]   Store a value (hidden prompt, or piped: … | arca set NAME)
   setup [--all]           Set every missing required variable, one prompt each
@@ -2582,6 +3329,9 @@ const COMMANDS = [
 	"export",
 	"import",
 	"init",
+	"use",
+	"profiles",
+	"profile",
 	"policy",
 	"projects",
 	"help",
@@ -2610,7 +3360,7 @@ async function dispatch(argv, io) {
 		return 0;
 	}
 	if (command === void 0 || command.startsWith("-") && command !== "--") {
-		const { values } = parse(argv);
+		const { values } = parse(argv, profileOption);
 		return statusCommand(session(io, values), VERSION);
 	}
 	if (command === "run" || command === "--") return run(command === "--" ? ["--", ...rest] : rest, io);
@@ -2627,14 +3377,42 @@ async function dispatch(argv, io) {
 		case "check": {
 			const { values } = parse(rest, {
 				strict: { type: "boolean" },
+				"all-profiles": { type: "boolean" },
 				...profileOption
 			});
-			return checkCommand(session(io, values), { strict: Boolean(values.strict) });
+			return checkCommand(session(io, values), {
+				strict: Boolean(values.strict),
+				allProfiles: Boolean(values["all-profiles"])
+			});
 		}
 		case "doctor": {
-			const { values } = parse(rest);
+			const { values } = parse(rest, profileOption);
 			return doctorCommand(session(io, values));
 		}
+		case "use": {
+			const { values, positionals } = parse(rest, { reset: { type: "boolean" } });
+			if (positionals.length > 1) throw new ArcaError("arca: too many arguments. Usage: npx arca use [profile] | npx arca use --reset", 2);
+			return useCommand(session(io, values), {
+				profile: positionals[0],
+				reset: Boolean(values.reset)
+			});
+		}
+		case "profile":
+		case "profiles": {
+			const { values, positionals } = parse(rest, {
+				extends: { type: "string" },
+				only: { type: "string" },
+				yes: {
+					type: "boolean",
+					short: "y"
+				}
+			});
+			return profilesCommand(session(io, values), positionals, {
+				extends: values.extends,
+				only: splitList(values.only),
+				yes: Boolean(values.yes)
+			});
+		}
 		case "set": {
 			const { values, positionals } = parse(rest.map((a) => a === "--generate" || a === "-g" ? "--generate=default" : a), {
 				generate: { type: "string" },
@@ -2741,8 +3519,10 @@ function session(io, values) {
 		io.stdout.write(HELP + "\n");
 		throw new ArcaError("", 0);
 	}
-	if (values.profile !== void 0) throw new ArcaError("arca: profiles are not available in this version yet. Every command uses the project's single set of values.", 2);
-	const s = new Session(io, { projectDir: values["project-dir"] });
+	const s = new Session(io, {
+		projectDir: values["project-dir"],
+		profile: values.profile
+	});
 	s.json = Boolean(values.json);
 	s.quiet = Boolean(values.quiet);
 	return s;