@jondotsoy/envs 0.1.7 → 0.1.8

package/envs.js

@@ -1,40 +1,18 @@
 #!/usr/bin/env bun
 // @bun
-
-// src/envs.ts
-import { mkdir } from "fs/promises";
-import { basename, dirname, join } from "path";
-import { stat } from "fs/promises";
-var {$ } = globalThis.Bun;
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
 
 // src/lint-rules.ts
-var SENSITIVE_KEY = /(^|_)(SECRET|PASSWORD|PASSWD|PWD|TOKEN|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?|AUTH|SALT|SIGNING)(_|$)/i;
-var WEAK_VALUES = new Set([
-  "",
-  "changeme",
-  "change-me",
-  "change_me",
-  "password",
-  "passw0rd",
-  "secret",
-  "admin",
-  "root",
-  "test",
-  "default",
-  "example",
-  "123456",
-  "12345678",
-  "qwerty",
-  "todo",
-  "xxx"
-]);
-var SECRET_PATTERNS = [
-  [/AKIA[0-9A-Z]{16}/, "an AWS access key id"],
-  [/gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
-  [/sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
-  [/xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
-  [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"]
-];
 function isSensitiveKey(key) {
   return SENSITIVE_KEY.test(key);
 }
@@ -74,196 +52,278 @@ function parseUrl(text) {
     local: /^(localhost|127\.\d+\.\d+\.\d+|::1|0\.0\.0\.0)$/.test(hostname)
   };
 }
-var valuesFile = ".envs/values.yml";
 function envFiles(ctx) {
   return [
     { location: valuesFile, mode: ctx.valuesMode },
     ...ctx.dotenvs.map((d) => ({ location: `${d.name}/.env`, mode: d.mode }))
   ];
 }
-var rules = [
-  {
-    id: "tracked-values",
-    description: "values.yml is tracked by git.",
-    async check(ctx) {
-      if (!await ctx.isTracked(ctx.root, valuesFile))
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: "values.yml is tracked by git, so its secrets are in the history. Run `git rm --cached .envs/values.yml`."
-        }
-      ];
-    }
-  },
-  {
-    id: "unignored-values",
-    description: "values.yml is neither tracked nor ignored by git.",
-    async check(ctx) {
-      if (await ctx.isTracked(ctx.root, valuesFile))
-        return [];
-      if (await ctx.isIgnored(ctx.root, valuesFile))
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: "values.yml is not ignored by git and could be committed by accident. Add `*` to .envs/.gitignore."
+var SENSITIVE_KEY, WEAK_VALUES, SECRET_PATTERNS, valuesFile = ".envs/values.yml", rules;
+var init_lint_rules = __esm(() => {
+  SENSITIVE_KEY = /(^|_)(SECRET|PASSWORD|PASSWD|PWD|TOKEN|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?|AUTH|SALT|SIGNING)(_|$)/i;
+  WEAK_VALUES = new Set([
+    "",
+    "changeme",
+    "change-me",
+    "change_me",
+    "password",
+    "passw0rd",
+    "secret",
+    "admin",
+    "root",
+    "test",
+    "default",
+    "example",
+    "123456",
+    "12345678",
+    "qwerty",
+    "todo",
+    "xxx"
+  ]);
+  SECRET_PATTERNS = [
+    [/AKIA[0-9A-Z]{16}/, "an AWS access key id"],
+    [/gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
+    [/sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
+    [/xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"]
+  ];
+  rules = [
+    {
+      id: "tracked-values",
+      description: "values.yml is tracked by git.",
+      async check(ctx) {
+        if (!await ctx.isTracked(ctx.root, valuesFile))
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: "values.yml is tracked by git, so its secrets are in the history. Run `git rm --cached .envs/values.yml`."
+          }
+        ];
+      }
+    },
+    {
+      id: "unignored-values",
+      description: "values.yml is neither tracked nor ignored by git.",
+      async check(ctx) {
+        if (await ctx.isTracked(ctx.root, valuesFile))
+          return [];
+        if (await ctx.isIgnored(ctx.root, valuesFile))
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: "values.yml is not ignored by git and could be committed by accident. Add `*` to .envs/.gitignore."
+          }
+        ];
+      }
+    },
+    {
+      id: "open-permissions",
+      description: "values.yml is readable by other users.",
+      check({ valuesMode }) {
+        if (valuesMode === undefined || (valuesMode & 63) === 0)
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: `values.yml is readable by other users (mode ${(valuesMode & 511).toString(8)}). Run \`chmod 600 .envs/values.yml\`.`
+          }
+        ];
+      }
+    },
+    {
+      id: "executable-files",
+      description: "values.yml or a worktree's .env has execute permission.",
+      check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 73) !== 0).map((f) => ({
+        location: f.location,
+        message: `The file is executable (mode ${(f.mode & 511).toString(8)}); env files are data and must not be. Run \`chmod -x\` on it.`
+      }))
+    },
+    {
+      id: "writable-files",
+      description: "values.yml or a worktree's .env is writable by other users.",
+      check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 18) !== 0).map((f) => ({
+        location: f.location,
+        message: `The file is writable by group or other users (mode ${(f.mode & 511).toString(8)}), who could change your environment. Run \`chmod go-w\` on it.`
+      }))
+    },
+    {
+      id: "tracked-dotenv",
+      description: "A worktree's .env is tracked by git.",
+      async check(ctx) {
+        const found = [];
+        for (const { name, path } of ctx.dotenvs) {
+          if (!await ctx.isTracked(path, ".env"))
+            continue;
+          found.push({
+            location: `${name}/.env`,
+            message: "The .env is tracked by git. Run `git rm --cached .env` and add it to .gitignore."
+          });
         }
-      ];
-    }
-  },
-  {
-    id: "open-permissions",
-    description: "values.yml is readable by other users.",
-    check({ valuesMode }) {
-      if (valuesMode === undefined || (valuesMode & 63) === 0)
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: `values.yml is readable by other users (mode ${(valuesMode & 511).toString(8)}). Run \`chmod 600 .envs/values.yml\`.`
+        return found;
+      }
+    },
+    {
+      id: "unignored-dotenv",
+      description: "A worktree's .env is neither tracked nor ignored by git.",
+      async check(ctx) {
+        const found = [];
+        for (const { name, path } of ctx.dotenvs) {
+          if (await ctx.isTracked(path, ".env"))
+            continue;
+          if (await ctx.isIgnored(path, ".env"))
+            continue;
+          found.push({
+            location: `${name}/.env`,
+            message: "The .env is not ignored by git. Add `.env` to .gitignore."
+          });
         }
-      ];
-    }
-  },
-  {
-    id: "executable-files",
-    description: "values.yml or a worktree's .env has execute permission.",
-    check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 73) !== 0).map((f) => ({
-      location: f.location,
-      message: `The file is executable (mode ${(f.mode & 511).toString(8)}); env files are data and must not be. Run \`chmod -x\` on it.`
-    }))
-  },
-  {
-    id: "writable-files",
-    description: "values.yml or a worktree's .env is writable by other users.",
-    check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 18) !== 0).map((f) => ({
-      location: f.location,
-      message: `The file is writable by group or other users (mode ${(f.mode & 511).toString(8)}), who could change your environment. Run \`chmod go-w\` on it.`
-    }))
-  },
-  {
-    id: "tracked-dotenv",
-    description: "A worktree's .env is tracked by git.",
-    async check(ctx) {
-      const found = [];
-      for (const { name, path } of ctx.dotenvs) {
-        if (!await ctx.isTracked(path, ".env"))
-          continue;
-        found.push({
-          location: `${name}/.env`,
-          message: "The .env is tracked by git. Run `git rm --cached .env` and add it to .gitignore."
-        });
+        return found;
       }
-      return found;
+    },
+    {
+      id: "weak-secret",
+      description: "A sensitive variable is empty or has an easily guessed value.",
+      check: (ctx) => entries(ctx).filter((e) => isSensitiveKey(e.key) && WEAK_VALUES.has(e.text.trim().toLowerCase())).map((e) => ({
+        location: e.location,
+        message: `${e.key} has an empty or easily guessed value.`
+      }))
+    },
+    {
+      id: "shared-secret",
+      description: "A sensitive variable is in defaults, so it goes to every worktree using that profile.",
+      check: (ctx) => entries(ctx).filter((e) => e.shared && isSensitiveKey(e.key)).map((e) => ({
+        location: e.location,
+        message: `${e.key} looks sensitive but is written to every worktree; set it per worktree under envs instead.`
+      }))
+    },
+    {
+      id: "secret-pattern",
+      description: "A value has the format of a well-known secret.",
+      check: (ctx) => entries(ctx).flatMap((e) => SECRET_PATTERNS.filter(([pattern]) => pattern.test(e.text)).map(([, name]) => ({
+        location: e.location,
+        message: `${e.key} looks like ${name}.`
+      })))
+    },
+    {
+      id: "url-credentials",
+      description: "A remote URL embeds a password.",
+      check: (ctx) => entries(ctx).filter((e) => {
+        const url = parseUrl(e.text);
+        return url?.hasPassword && !url.local;
+      }).map((e) => ({
+        location: e.location,
+        message: `${e.key} embeds a password in its URL.`
+      }))
+    },
+    {
+      id: "insecure-url",
+      description: "A remote URL uses an unencrypted protocol.",
+      check: (ctx) => entries(ctx).filter((e) => {
+        const url = parseUrl(e.text);
+        return url && !url.local && ["http", "ws", "ftp"].includes(url.scheme);
+      }).map((e) => ({
+        location: e.location,
+        message: `${e.key} uses ${parseUrl(e.text).scheme}:// instead of an encrypted protocol.`
+      }))
+    },
+    {
+      id: "unknown-profile",
+      description: "A worktree uses a profile that is not defined.",
+      check: ({ values }) => Object.entries(values.uses ?? {}).filter(([, profile]) => profile !== "default" && !Object.hasOwn(values.profiles ?? {}, profile)).map(([worktree, profile]) => ({
+        location: `uses.${worktree}`,
+        message: `Profile "${profile}" is not defined under profiles; \`envs edit\` creates it from default.`
+      }))
     }
-  },
-  {
-    id: "unignored-dotenv",
-    description: "A worktree's .env is neither tracked nor ignored by git.",
-    async check(ctx) {
-      const found = [];
-      for (const { name, path } of ctx.dotenvs) {
-        if (await ctx.isTracked(path, ".env"))
-          continue;
-        if (await ctx.isIgnored(path, ".env"))
-          continue;
-        found.push({
-          location: `${name}/.env`,
-          message: "The .env is not ignored by git. Add `.env` to .gitignore."
-        });
-      }
-      return found;
+  ];
+});
+
+// src/ui/server.ts
+import { join } from "path";
+import { readdir } from "fs/promises";
+function parseBody(body) {
+  if (!isRecord(body) || !isRecord(body.uses) || !isRecord(body.profiles))
+    return;
+  if (!Object.values(body.uses).every((v) => typeof v === "string"))
+    return;
+  for (const profile of Object.values(body.profiles)) {
+    if (!isRecord(profile) || !isRecord(profile.defaults) || !isRecord(profile.envs))
+      return;
+    if (!Object.values(profile.defaults).every(isScalar))
+      return;
+    for (const byWorktree of Object.values(profile.envs)) {
+      if (!isRecord(byWorktree) || !Object.values(byWorktree).every(isScalar))
+        return;
     }
-  },
-  {
-    id: "weak-secret",
-    description: "A sensitive variable is empty or has an easily guessed value.",
-    check: (ctx) => entries(ctx).filter((e) => isSensitiveKey(e.key) && WEAK_VALUES.has(e.text.trim().toLowerCase())).map((e) => ({
-      location: e.location,
-      message: `${e.key} has an empty or easily guessed value.`
-    }))
-  },
-  {
-    id: "shared-secret",
-    description: "A sensitive variable is in defaults, so it goes to every worktree using that profile.",
-    check: (ctx) => entries(ctx).filter((e) => e.shared && isSensitiveKey(e.key)).map((e) => ({
-      location: e.location,
-      message: `${e.key} looks sensitive but is written to every worktree; set it per worktree under envs instead.`
-    }))
-  },
-  {
-    id: "secret-pattern",
-    description: "A value has the format of a well-known secret.",
-    check: (ctx) => entries(ctx).flatMap((e) => SECRET_PATTERNS.filter(([pattern]) => pattern.test(e.text)).map(([, name]) => ({
-      location: e.location,
-      message: `${e.key} looks like ${name}.`
-    })))
-  },
-  {
-    id: "url-credentials",
-    description: "A remote URL embeds a password.",
-    check: (ctx) => entries(ctx).filter((e) => {
-      const url = parseUrl(e.text);
-      return url?.hasPassword && !url.local;
-    }).map((e) => ({
-      location: e.location,
-      message: `${e.key} embeds a password in its URL.`
-    }))
-  },
-  {
-    id: "insecure-url",
-    description: "A remote URL uses an unencrypted protocol.",
-    check: (ctx) => entries(ctx).filter((e) => {
-      const url = parseUrl(e.text);
-      return url && !url.local && ["http", "ws", "ftp"].includes(url.scheme);
-    }).map((e) => ({
-      location: e.location,
-      message: `${e.key} uses ${parseUrl(e.text).scheme}:// instead of an encrypted protocol.`
-    }))
-  },
-  {
-    id: "unknown-profile",
-    description: "A worktree uses a profile that is not defined.",
-    check: ({ values }) => Object.entries(values.uses ?? {}).filter(([, profile]) => profile !== "default" && !Object.hasOwn(values.profiles ?? {}, profile)).map(([worktree, profile]) => ({
-      location: `uses.${worktree}`,
-      message: `Profile "${profile}" is not defined under profiles; \`envs edit\` creates it from default.`
-    }))
   }
-];
-
-// src/envs.ts
-var HELP = `Usage: envs <command>
-
-Commands:
-  init    Create the .envs/ directory (.gitignore, values.yml)
-  pull    Read each worktree's .env and write it into .envs/values.yml
-  push    Write defaults and .envs/values.yml into the .env of each worktree
-  lint    Warn about insecure values and unprotected secret files
-  edit    Pull, open .envs/values.yml in VS Code (code -w), then push
-  use     Select the profile of the current worktree (envs use <profile>), or list them
-  help    Show this help message
-`;
-var colorsDisabled = () => Boolean(process.env.NO_COLOR);
-var MASK = "********";
-var isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key);
-var paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`;
-var green = (text) => paint(32, text);
-var yellow = (text) => paint(33, text);
-var defaultContext = () => ({
-  cwd: process.cwd(),
-  log: (message) => console.log(message),
-  error: (message) => console.error(message),
-  openEditor: async (path) => {
-    const proc = Bun.spawn(["code", "-w", path], {
-      env: { ...process.env },
-      stdio: ["inherit", "inherit", "inherit"]
-    });
-    return await proc.exited;
+  return body;
+}
+async function loadAssets() {
+  const assets = new Map;
+  if (await Bun.file(join(import.meta.dir, "app.tsx")).exists()) {
+    const result = await Bun.build({ entrypoints: [join(import.meta.dir, "index.html")], target: "browser" });
+    if (!result.success)
+      throw new AggregateError(result.logs, "Web editor build failed");
+    for (const out of result.outputs)
+      assets.set(out.path.replace(/^\.\//, ""), out);
+  } else {
+    const dir = join(import.meta.dir, "ui");
+    for (const name of await readdir(dir))
+      assets.set(name, Bun.file(join(dir, name)));
   }
+  return assets;
+}
+async function serveUi(ctx) {
+  const assets = await loadAssets();
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    routes: {
+      "/api/values": {
+        GET: async () => Response.json(await loadUiState(ctx)),
+        PUT: async (req) => {
+          const values = parseBody(await req.json().catch(() => {
+            return;
+          }));
+          if (!values)
+            return Response.json({ error: "Invalid values" }, { status: 400 });
+          const logs = [];
+          const errors = [];
+          const capture = {
+            ...ctx,
+            log: (m) => logs.push(m.replace(ANSI, "")),
+            error: (m) => errors.push(m.replace(ANSI, ""))
+          };
+          const { created, code } = await saveUiState(capture, values);
+          return Response.json({ ok: code === 0, created, logs, errors }, { status: code === 0 ? 200 : 500 });
+        }
+      }
+    },
+    fetch: (req) => {
+      const path = new URL(req.url).pathname.slice(1) || "index.html";
+      const asset = assets.get(path);
+      return asset ? new Response(asset) : new Response("Not found", { status: 404 });
+    }
+  });
+  const url = `http://127.0.0.1:${server.port}`;
+  ctx.log(`Web editor running at ${url} (Ctrl+C to stop)`);
+  await ctx.openUrl?.(url);
+  await (ctx.waitForExit ?? (() => new Promise(() => {})))();
+  await server.stop(true);
+  return 0;
+}
+var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v);
+var init_server = __esm(() => {
+  init_envs();
+  ANSI = /\x1b\[[0-9;]*m/g;
 });
-var DEFAULT_PROFILE = "default";
-var hasProfile = (values, name) => Object.hasOwn(values.profiles, name);
+
+// src/envs.ts
+import { mkdir } from "fs/promises";
+import { basename, dirname, join as join2 } from "path";
+import { stat } from "fs/promises";
+var {$ } = globalThis.Bun;
 function normalizeValues(raw) {
   const profiles = {};
   const add = (name, profile) => {
@@ -306,7 +366,6 @@ function resolveEntries(values, worktree, profile, includeProfileEnvs = true) {
   }
   return entries;
 }
-var hasCompleteProfiles = (raw) => Object.values(raw.profiles ?? {}).every((profile) => typeof profile?.defaults === "object" && profile.defaults !== null && typeof profile.envs === "object" && profile.envs !== null);
 function stringifyValues(values) {
   const profiles = Object.fromEntries(Object.entries(values.profiles).map(([name, { defaults, envs }]) => {
     const kept = Object.fromEntries(Object.entries(envs).filter(([, byWorktree]) => Object.keys(byWorktree).length > 0));
@@ -315,8 +374,6 @@ function stringifyValues(values) {
   const out = Object.keys(values.uses).length > 0 ? { uses: values.uses, profiles } : { profiles };
   return SCHEMA_COMMENT + Bun.YAML.stringify(out, null, 2);
 }
-var SCHEMA_COMMENT = `# yaml-language-server: $schema=https://jondotsoy.github.io/envs/schema.json
-`;
 function checkProfiles(ctx, values, worktrees) {
   let ok = true;
   for (const { name } of worktrees) {
@@ -406,7 +463,7 @@ function updateDotenv(text, entries) {
 `;
 }
 async function readValues(ctx) {
-  const path = join(await findRoot(ctx.cwd), ".envs/values.yml");
+  const path = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   if (!await Bun.file(path).exists()) {
     ctx.error(`${path} not found. Run \`envs init\` first.`);
     return;
@@ -418,9 +475,9 @@ async function init(ctx) {
   const root = await findRoot(ctx.cwd);
   const files = { ".envs/.gitignore": `*
 `, ".envs/values.yml": SCHEMA_COMMENT };
-  await mkdir(join(root, ".envs"), { recursive: true });
+  await mkdir(join2(root, ".envs"), { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    const path = join(root, name);
+    const path = join2(root, name);
     if (await Bun.file(path).exists()) {
       ctx.log(`${path} already exists`);
     } else {
@@ -445,7 +502,7 @@ async function push(ctx, only) {
     if (Object.keys(entries).length === 0)
       continue;
     const label = profile === DEFAULT_PROFILE ? name : `${name} [${profile}]`;
-    const dotenv = Bun.file(join(path, ".env"));
+    const dotenv = Bun.file(join2(path, ".env"));
     const current = await dotenv.exists() ? await dotenv.text() : "";
     const existing = parseDotenv(current);
     for (const [key, value] of Object.entries(entries)) {
@@ -473,7 +530,7 @@ async function pull(ctx) {
   const pulledKeys = new Set;
   for (const { name, path } of worktrees) {
     const profile = values.uses[name] ??= DEFAULT_PROFILE;
-    const dotenv = Bun.file(join(path, ".env"));
+    const dotenv = Bun.file(join2(path, ".env"));
     if (!await dotenv.exists())
       continue;
     const parsed = parseDotenv(await dotenv.text());
@@ -547,7 +604,7 @@ async function lint(ctx) {
   const modeOf = async (path) => process.platform === "win32" ? undefined : (await stat(path)).mode;
   const dotenvs = [];
   for (const worktree of worktrees) {
-    const path = join(worktree.path, ".env");
+    const path = join2(worktree.path, ".env");
     if (await Bun.file(path).exists()) {
       dotenvs.push({ ...worktree, mode: await modeOf(path) });
     }
@@ -575,13 +632,17 @@ async function lint(ctx) {
 ${count} warning(s) found.`);
   return 1;
 }
-async function edit(ctx) {
-  const valuesPath = join(await findRoot(ctx.cwd), ".envs/values.yml");
+async function edit(ctx, options = {}) {
+  const valuesPath = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   if (!await Bun.file(valuesPath).exists())
     await init(ctx);
   const pulled = await pull(ctx);
   if (pulled !== 0)
     return pulled;
+  if (options.ui) {
+    await Promise.resolve().then(() => init_server());
+    return await serveUi(ctx);
+  }
   const original = await Bun.file(valuesPath).text();
   await Bun.write(valuesPath, EDIT_NOTICE + original);
   const code = await ctx.openEditor(valuesPath);
@@ -602,11 +663,22 @@ async function edit(ctx) {
   }
   return await push(ctx);
 }
-var EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-# Close this file when your changes are ready, then they are pushed.
-# To cancel the edit, press Ctrl+C in the terminal and then close this file.
-# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-`;
+async function loadUiState(ctx) {
+  const read = await readValues(ctx);
+  if (!read)
+    throw new Error("Run `envs init` first.");
+  const [main, ...others] = (await listWorktrees(ctx.cwd)).map(({ name }) => name);
+  others.sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
+  const worktrees = main === undefined ? [] : [main, ...others];
+  return { ...normalizeValues(read.values), worktrees };
+}
+async function saveUiState(ctx, input) {
+  const values = normalizeValues({ uses: input.uses, profiles: input.profiles });
+  const created = materializeProfiles(values);
+  const path = join2(await findRoot(ctx.cwd), ".envs/values.yml");
+  await Bun.write(path, stringifyValues(values));
+  return { created, code: await push(ctx) };
+}
 async function run(args, ctx = defaultContext()) {
   const [command = "help"] = args;
   switch (command) {
@@ -624,7 +696,7 @@ async function run(args, ctx = defaultContext()) {
     case "lint":
       return await lint(ctx);
     case "edit":
-      return await edit(ctx);
+      return await edit(ctx, { ui: args.includes("--ui") });
     case "use":
       return await use(ctx, args[1]);
     default:
@@ -634,6 +706,48 @@ ${HELP}`);
       return 1;
   }
 }
+var HELP = `Usage: envs <command>
+
+Commands:
+  init    Create the .envs/ directory (.gitignore, values.yml)
+  pull    Read each worktree's .env and write it into .envs/values.yml
+  push    Write defaults and .envs/values.yml into the .env of each worktree
+  lint    Warn about insecure values and unprotected secret files
+  edit    Pull, open .envs/values.yml in VS Code (code -w), then push
+          With --ui, serve a web editor instead; its Save button pushes
+  use     Select the profile of the current worktree (envs use <profile>), or list them
+  help    Show this help message
+`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), defaultContext = () => ({
+  cwd: process.cwd(),
+  log: (message) => console.log(message),
+  error: (message) => console.error(message),
+  openEditor: async (path) => {
+    const proc = Bun.spawn(["code", "-w", path], {
+      env: { ...process.env },
+      stdio: ["inherit", "inherit", "inherit"]
+    });
+    return await proc.exited;
+  },
+  openUrl: async (url) => {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    try {
+      await Bun.spawn([opener, url], { stdio: ["ignore", "ignore", "ignore"] }).exited;
+    } catch {}
+  },
+  waitForExit: () => new Promise((resolve) => {
+    process.once("SIGINT", () => resolve());
+    process.once("SIGTERM", () => resolve());
+  })
+}), DEFAULT_PROFILE = "default", hasProfile = (values, name) => Object.hasOwn(values.profiles, name), hasCompleteProfiles = (raw) => Object.values(raw.profiles ?? {}).every((profile) => typeof profile?.defaults === "object" && profile.defaults !== null && typeof profile.envs === "object" && profile.envs !== null), SCHEMA_COMMENT = `# yaml-language-server: $schema=https://jondotsoy.github.io/envs/schema.json
+`, EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Close this file when your changes are ready, then they are pushed.
+# To cancel the edit, press Ctrl+C in the terminal and then close this file.
+# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`;
+var init_envs = __esm(() => {
+  init_lint_rules();
+});
 
 // src/bin/envs.ts
+init_envs();
 process.exit(await run(Bun.argv.slice(2)));