@jondotsoy/envs 0.1.6 → 0.1.8

package/envs.js

@@ -1,57 +1,41 @@
 #!/usr/bin/env bun
 // @bun
-
-// src/envs.ts
-import { mkdir } from "fs/promises";
-import { basename, dirname, join } from "path";
-import { stat } from "fs/promises";
-var {$ } = globalThis.Bun;
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
 
 // src/lint-rules.ts
-var SENSITIVE_KEY = /(^|_)(SECRET|PASSWORD|PASSWD|PWD|TOKEN|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?|AUTH|SALT|SIGNING)(_|$)/i;
-var WEAK_VALUES = new Set([
-  "",
-  "changeme",
-  "change-me",
-  "change_me",
-  "password",
-  "passw0rd",
-  "secret",
-  "admin",
-  "root",
-  "test",
-  "default",
-  "example",
-  "123456",
-  "12345678",
-  "qwerty",
-  "todo",
-  "xxx"
-]);
-var SECRET_PATTERNS = [
-  [/AKIA[0-9A-Z]{16}/, "an AWS access key id"],
-  [/gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
-  [/sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
-  [/xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
-  [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"]
-];
 function isSensitiveKey(key) {
   return SENSITIVE_KEY.test(key);
 }
 function entries({ values }) {
   const result = [];
-  for (const [key, value] of Object.entries(values.defaults ?? {})) {
-    result.push({ key, text: String(value), location: `defaults.${key}`, shared: true });
-  }
-  for (const [key, byWorktree] of Object.entries(values.envs ?? {})) {
-    for (const [worktree, value] of Object.entries(byWorktree ?? {})) {
-      result.push({
-        key,
-        text: String(value),
-        location: `envs.${key}.${worktree}`,
-        shared: false
-      });
+  const collect = (prefix, section) => {
+    for (const [key, value] of Object.entries(section?.defaults ?? {})) {
+      result.push({ key, text: String(value), location: `${prefix}defaults.${key}`, shared: true });
+    }
+    for (const [key, byWorktree] of Object.entries(section?.envs ?? {})) {
+      for (const [worktree, value] of Object.entries(byWorktree ?? {})) {
+        result.push({
+          key,
+          text: String(value),
+          location: `${prefix}envs.${key}.${worktree}`,
+          shared: false
+        });
+      }
     }
+  };
+  collect("", values);
+  for (const [name, profile] of Object.entries(values.profiles ?? {})) {
+    collect(`profiles.${name}.`, profile);
   }
   return result;
 }
@@ -68,185 +52,339 @@ function parseUrl(text) {
     local: /^(localhost|127\.\d+\.\d+\.\d+|::1|0\.0\.0\.0)$/.test(hostname)
   };
 }
-var valuesFile = ".envs/values.yml";
 function envFiles(ctx) {
   return [
     { location: valuesFile, mode: ctx.valuesMode },
     ...ctx.dotenvs.map((d) => ({ location: `${d.name}/.env`, mode: d.mode }))
   ];
 }
-var rules = [
-  {
-    id: "tracked-values",
-    description: "values.yml is tracked by git.",
-    async check(ctx) {
-      if (!await ctx.isTracked(ctx.root, valuesFile))
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: "values.yml is tracked by git, so its secrets are in the history. Run `git rm --cached .envs/values.yml`."
+var SENSITIVE_KEY, WEAK_VALUES, SECRET_PATTERNS, valuesFile = ".envs/values.yml", rules;
+var init_lint_rules = __esm(() => {
+  SENSITIVE_KEY = /(^|_)(SECRET|PASSWORD|PASSWD|PWD|TOKEN|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?|AUTH|SALT|SIGNING)(_|$)/i;
+  WEAK_VALUES = new Set([
+    "",
+    "changeme",
+    "change-me",
+    "change_me",
+    "password",
+    "passw0rd",
+    "secret",
+    "admin",
+    "root",
+    "test",
+    "default",
+    "example",
+    "123456",
+    "12345678",
+    "qwerty",
+    "todo",
+    "xxx"
+  ]);
+  SECRET_PATTERNS = [
+    [/AKIA[0-9A-Z]{16}/, "an AWS access key id"],
+    [/gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
+    [/sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
+    [/xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"]
+  ];
+  rules = [
+    {
+      id: "tracked-values",
+      description: "values.yml is tracked by git.",
+      async check(ctx) {
+        if (!await ctx.isTracked(ctx.root, valuesFile))
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: "values.yml is tracked by git, so its secrets are in the history. Run `git rm --cached .envs/values.yml`."
+          }
+        ];
+      }
+    },
+    {
+      id: "unignored-values",
+      description: "values.yml is neither tracked nor ignored by git.",
+      async check(ctx) {
+        if (await ctx.isTracked(ctx.root, valuesFile))
+          return [];
+        if (await ctx.isIgnored(ctx.root, valuesFile))
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: "values.yml is not ignored by git and could be committed by accident. Add `*` to .envs/.gitignore."
+          }
+        ];
+      }
+    },
+    {
+      id: "open-permissions",
+      description: "values.yml is readable by other users.",
+      check({ valuesMode }) {
+        if (valuesMode === undefined || (valuesMode & 63) === 0)
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: `values.yml is readable by other users (mode ${(valuesMode & 511).toString(8)}). Run \`chmod 600 .envs/values.yml\`.`
+          }
+        ];
+      }
+    },
+    {
+      id: "executable-files",
+      description: "values.yml or a worktree's .env has execute permission.",
+      check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 73) !== 0).map((f) => ({
+        location: f.location,
+        message: `The file is executable (mode ${(f.mode & 511).toString(8)}); env files are data and must not be. Run \`chmod -x\` on it.`
+      }))
+    },
+    {
+      id: "writable-files",
+      description: "values.yml or a worktree's .env is writable by other users.",
+      check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 18) !== 0).map((f) => ({
+        location: f.location,
+        message: `The file is writable by group or other users (mode ${(f.mode & 511).toString(8)}), who could change your environment. Run \`chmod go-w\` on it.`
+      }))
+    },
+    {
+      id: "tracked-dotenv",
+      description: "A worktree's .env is tracked by git.",
+      async check(ctx) {
+        const found = [];
+        for (const { name, path } of ctx.dotenvs) {
+          if (!await ctx.isTracked(path, ".env"))
+            continue;
+          found.push({
+            location: `${name}/.env`,
+            message: "The .env is tracked by git. Run `git rm --cached .env` and add it to .gitignore."
+          });
         }
-      ];
-    }
-  },
-  {
-    id: "unignored-values",
-    description: "values.yml is neither tracked nor ignored by git.",
-    async check(ctx) {
-      if (await ctx.isTracked(ctx.root, valuesFile))
-        return [];
-      if (await ctx.isIgnored(ctx.root, valuesFile))
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: "values.yml is not ignored by git and could be committed by accident. Add `*` to .envs/.gitignore."
+        return found;
+      }
+    },
+    {
+      id: "unignored-dotenv",
+      description: "A worktree's .env is neither tracked nor ignored by git.",
+      async check(ctx) {
+        const found = [];
+        for (const { name, path } of ctx.dotenvs) {
+          if (await ctx.isTracked(path, ".env"))
+            continue;
+          if (await ctx.isIgnored(path, ".env"))
+            continue;
+          found.push({
+            location: `${name}/.env`,
+            message: "The .env is not ignored by git. Add `.env` to .gitignore."
+          });
         }
-      ];
+        return found;
+      }
+    },
+    {
+      id: "weak-secret",
+      description: "A sensitive variable is empty or has an easily guessed value.",
+      check: (ctx) => entries(ctx).filter((e) => isSensitiveKey(e.key) && WEAK_VALUES.has(e.text.trim().toLowerCase())).map((e) => ({
+        location: e.location,
+        message: `${e.key} has an empty or easily guessed value.`
+      }))
+    },
+    {
+      id: "shared-secret",
+      description: "A sensitive variable is in defaults, so it goes to every worktree using that profile.",
+      check: (ctx) => entries(ctx).filter((e) => e.shared && isSensitiveKey(e.key)).map((e) => ({
+        location: e.location,
+        message: `${e.key} looks sensitive but is written to every worktree; set it per worktree under envs instead.`
+      }))
+    },
+    {
+      id: "secret-pattern",
+      description: "A value has the format of a well-known secret.",
+      check: (ctx) => entries(ctx).flatMap((e) => SECRET_PATTERNS.filter(([pattern]) => pattern.test(e.text)).map(([, name]) => ({
+        location: e.location,
+        message: `${e.key} looks like ${name}.`
+      })))
+    },
+    {
+      id: "url-credentials",
+      description: "A remote URL embeds a password.",
+      check: (ctx) => entries(ctx).filter((e) => {
+        const url = parseUrl(e.text);
+        return url?.hasPassword && !url.local;
+      }).map((e) => ({
+        location: e.location,
+        message: `${e.key} embeds a password in its URL.`
+      }))
+    },
+    {
+      id: "insecure-url",
+      description: "A remote URL uses an unencrypted protocol.",
+      check: (ctx) => entries(ctx).filter((e) => {
+        const url = parseUrl(e.text);
+        return url && !url.local && ["http", "ws", "ftp"].includes(url.scheme);
+      }).map((e) => ({
+        location: e.location,
+        message: `${e.key} uses ${parseUrl(e.text).scheme}:// instead of an encrypted protocol.`
+      }))
+    },
+    {
+      id: "unknown-profile",
+      description: "A worktree uses a profile that is not defined.",
+      check: ({ values }) => Object.entries(values.uses ?? {}).filter(([, profile]) => profile !== "default" && !Object.hasOwn(values.profiles ?? {}, profile)).map(([worktree, profile]) => ({
+        location: `uses.${worktree}`,
+        message: `Profile "${profile}" is not defined under profiles; \`envs edit\` creates it from default.`
+      }))
     }
-  },
-  {
-    id: "open-permissions",
-    description: "values.yml is readable by other users.",
-    check({ valuesMode }) {
-      if (valuesMode === undefined || (valuesMode & 63) === 0)
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: `values.yml is readable by other users (mode ${(valuesMode & 511).toString(8)}). Run \`chmod 600 .envs/values.yml\`.`
-        }
-      ];
+  ];
+});
+
+// src/ui/server.ts
+import { join } from "path";
+import { readdir } from "fs/promises";
+function parseBody(body) {
+  if (!isRecord(body) || !isRecord(body.uses) || !isRecord(body.profiles))
+    return;
+  if (!Object.values(body.uses).every((v) => typeof v === "string"))
+    return;
+  for (const profile of Object.values(body.profiles)) {
+    if (!isRecord(profile) || !isRecord(profile.defaults) || !isRecord(profile.envs))
+      return;
+    if (!Object.values(profile.defaults).every(isScalar))
+      return;
+    for (const byWorktree of Object.values(profile.envs)) {
+      if (!isRecord(byWorktree) || !Object.values(byWorktree).every(isScalar))
+        return;
     }
-  },
-  {
-    id: "executable-files",
-    description: "values.yml or a worktree's .env has execute permission.",
-    check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 73) !== 0).map((f) => ({
-      location: f.location,
-      message: `The file is executable (mode ${(f.mode & 511).toString(8)}); env files are data and must not be. Run \`chmod -x\` on it.`
-    }))
-  },
-  {
-    id: "writable-files",
-    description: "values.yml or a worktree's .env is writable by other users.",
-    check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 18) !== 0).map((f) => ({
-      location: f.location,
-      message: `The file is writable by group or other users (mode ${(f.mode & 511).toString(8)}), who could change your environment. Run \`chmod go-w\` on it.`
-    }))
-  },
-  {
-    id: "tracked-dotenv",
-    description: "A worktree's .env is tracked by git.",
-    async check(ctx) {
-      const found = [];
-      for (const { name, path } of ctx.dotenvs) {
-        if (!await ctx.isTracked(path, ".env"))
-          continue;
-        found.push({
-          location: `${name}/.env`,
-          message: "The .env is tracked by git. Run `git rm --cached .env` and add it to .gitignore."
-        });
+  }
+  return body;
+}
+async function loadAssets() {
+  const assets = new Map;
+  if (await Bun.file(join(import.meta.dir, "app.tsx")).exists()) {
+    const result = await Bun.build({ entrypoints: [join(import.meta.dir, "index.html")], target: "browser" });
+    if (!result.success)
+      throw new AggregateError(result.logs, "Web editor build failed");
+    for (const out of result.outputs)
+      assets.set(out.path.replace(/^\.\//, ""), out);
+  } else {
+    const dir = join(import.meta.dir, "ui");
+    for (const name of await readdir(dir))
+      assets.set(name, Bun.file(join(dir, name)));
+  }
+  return assets;
+}
+async function serveUi(ctx) {
+  const assets = await loadAssets();
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    routes: {
+      "/api/values": {
+        GET: async () => Response.json(await loadUiState(ctx)),
+        PUT: async (req) => {
+          const values = parseBody(await req.json().catch(() => {
+            return;
+          }));
+          if (!values)
+            return Response.json({ error: "Invalid values" }, { status: 400 });
+          const logs = [];
+          const errors = [];
+          const capture = {
+            ...ctx,
+            log: (m) => logs.push(m.replace(ANSI, "")),
+            error: (m) => errors.push(m.replace(ANSI, ""))
+          };
+          const { created, code } = await saveUiState(capture, values);
+          return Response.json({ ok: code === 0, created, logs, errors }, { status: code === 0 ? 200 : 500 });
+        }
       }
-      return found;
+    },
+    fetch: (req) => {
+      const path = new URL(req.url).pathname.slice(1) || "index.html";
+      const asset = assets.get(path);
+      return asset ? new Response(asset) : new Response("Not found", { status: 404 });
     }
-  },
-  {
-    id: "unignored-dotenv",
-    description: "A worktree's .env is neither tracked nor ignored by git.",
-    async check(ctx) {
-      const found = [];
-      for (const { name, path } of ctx.dotenvs) {
-        if (await ctx.isTracked(path, ".env"))
-          continue;
-        if (await ctx.isIgnored(path, ".env"))
-          continue;
-        found.push({
-          location: `${name}/.env`,
-          message: "The .env is not ignored by git. Add `.env` to .gitignore."
-        });
+  });
+  const url = `http://127.0.0.1:${server.port}`;
+  ctx.log(`Web editor running at ${url} (Ctrl+C to stop)`);
+  await ctx.openUrl?.(url);
+  await (ctx.waitForExit ?? (() => new Promise(() => {})))();
+  await server.stop(true);
+  return 0;
+}
+var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v);
+var init_server = __esm(() => {
+  init_envs();
+  ANSI = /\x1b\[[0-9;]*m/g;
+});
+
+// src/envs.ts
+import { mkdir } from "fs/promises";
+import { basename, dirname, join as join2 } from "path";
+import { stat } from "fs/promises";
+var {$ } = globalThis.Bun;
+function normalizeValues(raw) {
+  const profiles = {};
+  const add = (name, profile) => {
+    const target = profiles[name] ??= { defaults: {}, envs: {} };
+    Object.assign(target.defaults, profile?.defaults);
+    for (const [key, byWorktree] of Object.entries(profile?.envs ?? {})) {
+      Object.assign(target.envs[key] ??= {}, byWorktree);
+    }
+  };
+  add(DEFAULT_PROFILE, { defaults: raw.defaults, envs: raw.envs });
+  for (const [name, profile] of Object.entries(raw.profiles ?? {})) {
+    add(name, profile);
+  }
+  return { uses: { ...raw.uses }, profiles };
+}
+function materializeProfiles(values) {
+  const created = [];
+  for (const name of Object.values(values.uses).map(String)) {
+    if (hasProfile(values, name))
+      continue;
+    values.profiles[name] = structuredClone(values.profiles[DEFAULT_PROFILE]);
+    created.push(name);
+  }
+  return created;
+}
+function resolveEntries(values, worktree, profile, includeProfileEnvs = true) {
+  const entries = {};
+  for (const name of new Set([DEFAULT_PROFILE, profile])) {
+    const layer = values.profiles[name];
+    for (const [key, value] of Object.entries(layer.defaults)) {
+      entries[key] = String(value);
+    }
+    if (name === profile && !includeProfileEnvs)
+      continue;
+    for (const [key, byWorktree] of Object.entries(layer.envs)) {
+      if (byWorktree && worktree in byWorktree) {
+        entries[key] = String(byWorktree[worktree]);
       }
-      return found;
     }
-  },
-  {
-    id: "weak-secret",
-    description: "A sensitive variable is empty or has an easily guessed value.",
-    check: (ctx) => entries(ctx).filter((e) => isSensitiveKey(e.key) && WEAK_VALUES.has(e.text.trim().toLowerCase())).map((e) => ({
-      location: e.location,
-      message: `${e.key} has an empty or easily guessed value.`
-    }))
-  },
-  {
-    id: "shared-secret",
-    description: "A sensitive variable is in defaults, so it goes to every worktree.",
-    check: (ctx) => entries(ctx).filter((e) => e.shared && isSensitiveKey(e.key)).map((e) => ({
-      location: e.location,
-      message: `${e.key} looks sensitive but is written to every worktree; set it per worktree under envs instead.`
-    }))
-  },
-  {
-    id: "secret-pattern",
-    description: "A value has the format of a well-known secret.",
-    check: (ctx) => entries(ctx).flatMap((e) => SECRET_PATTERNS.filter(([pattern]) => pattern.test(e.text)).map(([, name]) => ({
-      location: e.location,
-      message: `${e.key} looks like ${name}.`
-    })))
-  },
-  {
-    id: "url-credentials",
-    description: "A remote URL embeds a password.",
-    check: (ctx) => entries(ctx).filter((e) => {
-      const url = parseUrl(e.text);
-      return url?.hasPassword && !url.local;
-    }).map((e) => ({
-      location: e.location,
-      message: `${e.key} embeds a password in its URL.`
-    }))
-  },
-  {
-    id: "insecure-url",
-    description: "A remote URL uses an unencrypted protocol.",
-    check: (ctx) => entries(ctx).filter((e) => {
-      const url = parseUrl(e.text);
-      return url && !url.local && ["http", "ws", "ftp"].includes(url.scheme);
-    }).map((e) => ({
-      location: e.location,
-      message: `${e.key} uses ${parseUrl(e.text).scheme}:// instead of an encrypted protocol.`
-    }))
   }
-];
-
-// src/envs.ts
-var HELP = `Usage: envs <command>
-
-Commands:
-  init    Create the .envs/ directory (.gitignore, values.yml)
-  pull    Read each worktree's .env and write it into .envs/values.yml
-  push    Write defaults and .envs/values.yml into the .env of each worktree
-  lint    Warn about insecure values and unprotected secret files
-  edit    Pull, open .envs/values.yml in VS Code (code -w), then push
-  help    Show this help message
-`;
-var colorsDisabled = () => Boolean(process.env.NO_COLOR);
-var MASK = "********";
-var isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key);
-var paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`;
-var green = (text) => paint(32, text);
-var yellow = (text) => paint(33, text);
-var defaultContext = () => ({
-  cwd: process.cwd(),
-  log: (message) => console.log(message),
-  error: (message) => console.error(message),
-  openEditor: async (path) => {
-    const proc = Bun.spawn(["code", "-w", path], {
-      env: { ...process.env },
-      stdio: ["inherit", "inherit", "inherit"]
-    });
-    return await proc.exited;
+  return entries;
+}
+function stringifyValues(values) {
+  const profiles = Object.fromEntries(Object.entries(values.profiles).map(([name, { defaults, envs }]) => {
+    const kept = Object.fromEntries(Object.entries(envs).filter(([, byWorktree]) => Object.keys(byWorktree).length > 0));
+    return [name, { defaults, envs: kept }];
+  }));
+  const out = Object.keys(values.uses).length > 0 ? { uses: values.uses, profiles } : { profiles };
+  return SCHEMA_COMMENT + Bun.YAML.stringify(out, null, 2);
+}
+function checkProfiles(ctx, values, worktrees) {
+  let ok = true;
+  for (const { name } of worktrees) {
+    const profile = values.uses[name] ?? DEFAULT_PROFILE;
+    if (hasProfile(values, profile))
+      continue;
+    ok = false;
+    ctx.error(`Unknown profile "${profile}" for worktree ${name}. Available: ${Object.keys(values.profiles).join(", ")}. Run \`envs edit\` to create it.`);
   }
-});
+  return ok;
+}
 async function findRoot(cwd) {
   const result = await $`git rev-parse --path-format=absolute --git-common-dir`.cwd(cwd).nothrow().quiet();
   if (result.exitCode !== 0)
@@ -325,7 +463,7 @@ function updateDotenv(text, entries) {
 `;
 }
 async function readValues(ctx) {
-  const path = join(await findRoot(ctx.cwd), ".envs/values.yml");
+  const path = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   if (!await Bun.file(path).exists()) {
     ctx.error(`${path} not found. Run \`envs init\` first.`);
     return;
@@ -336,10 +474,10 @@ async function readValues(ctx) {
 async function init(ctx) {
   const root = await findRoot(ctx.cwd);
   const files = { ".envs/.gitignore": `*
-`, ".envs/values.yml": "" };
-  await mkdir(join(root, ".envs"), { recursive: true });
+`, ".envs/values.yml": SCHEMA_COMMENT };
+  await mkdir(join2(root, ".envs"), { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    const path = join(root, name);
+    const path = join2(root, name);
     if (await Bun.file(path).exists()) {
       ctx.log(`${path} already exists`);
     } else {
@@ -349,24 +487,22 @@ async function init(ctx) {
   }
   return 0;
 }
-async function push(ctx) {
+async function push(ctx, only) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
-  const { values } = read;
+  const values = normalizeValues(read.values);
+  const worktrees = (await listWorktrees(ctx.cwd)).filter(({ name }) => only === undefined || name === only);
+  if (!checkProfiles(ctx, values, worktrees))
+    return 1;
   const changes = new Map;
-  for (const { name, path } of await listWorktrees(ctx.cwd)) {
-    const entries = {};
-    for (const [key, value] of Object.entries(values.defaults ?? {})) {
-      entries[key] = String(value);
-    }
-    for (const [key, byWorktree] of Object.entries(values.envs ?? {})) {
-      if (name in byWorktree)
-        entries[key] = String(byWorktree[name]);
-    }
+  for (const { name, path } of worktrees) {
+    const profile = values.uses[name] ?? DEFAULT_PROFILE;
+    const entries = resolveEntries(values, name, profile);
     if (Object.keys(entries).length === 0)
       continue;
-    const dotenv = Bun.file(join(path, ".env"));
+    const label = profile === DEFAULT_PROFILE ? name : `${name} [${profile}]`;
+    const dotenv = Bun.file(join2(path, ".env"));
     const current = await dotenv.exists() ? await dotenv.text() : "";
     const existing = parseDotenv(current);
     for (const [key, value] of Object.entries(entries)) {
@@ -374,7 +510,7 @@ async function push(ctx) {
         continue;
       const shown = isMaskedKey(key) ? MASK : formatDotenvValue(value);
       const line = `${key}=${shown}`;
-      changes.set(line, [...changes.get(line) ?? [], name]);
+      changes.set(line, [...changes.get(line) ?? [], label]);
     }
     await Bun.write(dotenv, updateDotenv(current, entries));
   }
@@ -387,27 +523,29 @@ async function pull(ctx) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
-  const { path: valuesPath, values } = read;
-  const envs = values.envs ??= {};
-  const defaults = values.defaults ?? {};
+  const values = normalizeValues(read.values);
+  const worktrees = await listWorktrees(ctx.cwd);
+  materializeProfiles(values);
   const pulledNames = [];
   const pulledKeys = new Set;
-  for (const { name, path } of await listWorktrees(ctx.cwd)) {
-    const dotenv = Bun.file(join(path, ".env"));
+  for (const { name, path } of worktrees) {
+    const profile = values.uses[name] ??= DEFAULT_PROFILE;
+    const dotenv = Bun.file(join2(path, ".env"));
     if (!await dotenv.exists())
       continue;
     const parsed = parseDotenv(await dotenv.text());
     pulledNames.push(name);
     for (const key of Object.keys(parsed))
       pulledKeys.add(key);
+    const { envs } = values.profiles[profile];
     for (const [key, byWorktree] of Object.entries(envs)) {
       if (!(key in parsed))
         delete byWorktree[name];
     }
+    const base = resolveEntries(values, name, profile, false);
     for (const [key, value] of Object.entries(parsed)) {
       const parsedValue = parseValue(value);
-      const fromDefaults = key in defaults && String(defaults[key]) === String(parsedValue);
-      if (fromDefaults) {
+      if (key in base && base[key] === String(parsedValue)) {
         if (envs[key])
           delete envs[key][name];
       } else {
@@ -415,16 +553,40 @@ async function pull(ctx) {
       }
     }
   }
-  for (const [key, byWorktree] of Object.entries(envs)) {
-    if (Object.keys(byWorktree).length === 0)
-      delete envs[key];
-  }
-  await Bun.write(valuesPath, Bun.YAML.stringify(values, null, 2));
+  await Bun.write(read.path, stringifyValues(values));
   if (pulledNames.length > 0) {
     ctx.log(green(`\u2193 pulling ${pulledNames.join(", ")} - ${pulledKeys.size} variables`));
   }
   return 0;
 }
+async function use(ctx, profile) {
+  const read = await readValues(ctx);
+  if (!read)
+    return 1;
+  const values = normalizeValues(read.values);
+  const worktrees = await listWorktrees(ctx.cwd);
+  if (profile === undefined) {
+    for (const { name } of worktrees) {
+      ctx.log(`${name}: ${values.uses[name] ?? DEFAULT_PROFILE}`);
+    }
+    return 0;
+  }
+  if (!hasProfile(values, profile)) {
+    ctx.error(`Unknown profile "${profile}". Available: ${Object.keys(values.profiles).join(", ")}. Add it in \`envs edit\` first.`);
+    return 1;
+  }
+  const top = await $`git rev-parse --show-toplevel`.cwd(ctx.cwd).nothrow().quiet();
+  const current = worktrees.find(({ path }) => path === top.stdout.toString().trim());
+  if (!current) {
+    ctx.error("Run `envs use` inside a git worktree.");
+    return 1;
+  }
+  for (const { name } of worktrees)
+    values.uses[name] ??= DEFAULT_PROFILE;
+  values.uses[current.name] = profile;
+  await Bun.write(read.path, stringifyValues(values));
+  return await push(ctx, current.name);
+}
 async function isIgnored(dir, file) {
   const result = await $`git check-ignore -q ${file}`.cwd(dir).nothrow().quiet();
   return result.exitCode === 0;
@@ -442,7 +604,7 @@ async function lint(ctx) {
   const modeOf = async (path) => process.platform === "win32" ? undefined : (await stat(path)).mode;
   const dotenvs = [];
   for (const worktree of worktrees) {
-    const path = join(worktree.path, ".env");
+    const path = join2(worktree.path, ".env");
     if (await Bun.file(path).exists()) {
       dotenvs.push({ ...worktree, mode: await modeOf(path) });
     }
@@ -470,13 +632,17 @@ async function lint(ctx) {
 ${count} warning(s) found.`);
   return 1;
 }
-async function edit(ctx) {
-  const valuesPath = join(await findRoot(ctx.cwd), ".envs/values.yml");
+async function edit(ctx, options = {}) {
+  const valuesPath = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   if (!await Bun.file(valuesPath).exists())
     await init(ctx);
   const pulled = await pull(ctx);
   if (pulled !== 0)
     return pulled;
+  if (options.ui) {
+    await Promise.resolve().then(() => init_server());
+    return await serveUi(ctx);
+  }
   const original = await Bun.file(valuesPath).text();
   await Bun.write(valuesPath, EDIT_NOTICE + original);
   const code = await ctx.openEditor(valuesPath);
@@ -486,13 +652,33 @@ async function edit(ctx) {
   }
   if (code !== 0)
     return code;
+  const raw = Bun.YAML.parse(await Bun.file(valuesPath).text()) ?? {};
+  const values = normalizeValues(raw);
+  const created = materializeProfiles(values);
+  if (created.length > 0 || !hasCompleteProfiles(raw)) {
+    await Bun.write(valuesPath, stringifyValues(values));
+  }
+  if (created.length > 0) {
+    ctx.log(green(`+ created ${created.join(", ")} from ${DEFAULT_PROFILE}`));
+  }
   return await push(ctx);
 }
-var EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-# Close this file when your changes are ready, then they are pushed.
-# To cancel the edit, press Ctrl+C in the terminal and then close this file.
-# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-`;
+async function loadUiState(ctx) {
+  const read = await readValues(ctx);
+  if (!read)
+    throw new Error("Run `envs init` first.");
+  const [main, ...others] = (await listWorktrees(ctx.cwd)).map(({ name }) => name);
+  others.sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
+  const worktrees = main === undefined ? [] : [main, ...others];
+  return { ...normalizeValues(read.values), worktrees };
+}
+async function saveUiState(ctx, input) {
+  const values = normalizeValues({ uses: input.uses, profiles: input.profiles });
+  const created = materializeProfiles(values);
+  const path = join2(await findRoot(ctx.cwd), ".envs/values.yml");
+  await Bun.write(path, stringifyValues(values));
+  return { created, code: await push(ctx) };
+}
 async function run(args, ctx = defaultContext()) {
   const [command = "help"] = args;
   switch (command) {
@@ -510,7 +696,9 @@ async function run(args, ctx = defaultContext()) {
     case "lint":
       return await lint(ctx);
     case "edit":
-      return await edit(ctx);
+      return await edit(ctx, { ui: args.includes("--ui") });
+    case "use":
+      return await use(ctx, args[1]);
     default:
       ctx.error(`Unknown command: ${command}
 
@@ -518,6 +706,48 @@ ${HELP}`);
       return 1;
   }
 }
+var HELP = `Usage: envs <command>
+
+Commands:
+  init    Create the .envs/ directory (.gitignore, values.yml)
+  pull    Read each worktree's .env and write it into .envs/values.yml
+  push    Write defaults and .envs/values.yml into the .env of each worktree
+  lint    Warn about insecure values and unprotected secret files
+  edit    Pull, open .envs/values.yml in VS Code (code -w), then push
+          With --ui, serve a web editor instead; its Save button pushes
+  use     Select the profile of the current worktree (envs use <profile>), or list them
+  help    Show this help message
+`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), defaultContext = () => ({
+  cwd: process.cwd(),
+  log: (message) => console.log(message),
+  error: (message) => console.error(message),
+  openEditor: async (path) => {
+    const proc = Bun.spawn(["code", "-w", path], {
+      env: { ...process.env },
+      stdio: ["inherit", "inherit", "inherit"]
+    });
+    return await proc.exited;
+  },
+  openUrl: async (url) => {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    try {
+      await Bun.spawn([opener, url], { stdio: ["ignore", "ignore", "ignore"] }).exited;
+    } catch {}
+  },
+  waitForExit: () => new Promise((resolve) => {
+    process.once("SIGINT", () => resolve());
+    process.once("SIGTERM", () => resolve());
+  })
+}), DEFAULT_PROFILE = "default", hasProfile = (values, name) => Object.hasOwn(values.profiles, name), hasCompleteProfiles = (raw) => Object.values(raw.profiles ?? {}).every((profile) => typeof profile?.defaults === "object" && profile.defaults !== null && typeof profile.envs === "object" && profile.envs !== null), SCHEMA_COMMENT = `# yaml-language-server: $schema=https://jondotsoy.github.io/envs/schema.json
+`, EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Close this file when your changes are ready, then they are pushed.
+# To cancel the edit, press Ctrl+C in the terminal and then close this file.
+# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`;
+var init_envs = __esm(() => {
+  init_lint_rules();
+});
 
 // src/bin/envs.ts
+init_envs();
 process.exit(await run(Bun.argv.slice(2)));