@jondotsoy/envs 0.1.7 → 0.1.9-alpha.0

package/envs.js

@@ -1,40 +1,27 @@
 #!/usr/bin/env bun
 // @bun
-
-// src/envs.ts
-import { mkdir } from "fs/promises";
-import { basename, dirname, join } from "path";
-import { stat } from "fs/promises";
-var {$ } = globalThis.Bun;
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
 
 // src/lint-rules.ts
-var SENSITIVE_KEY = /(^|_)(SECRET|PASSWORD|PASSWD|PWD|TOKEN|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?|AUTH|SALT|SIGNING)(_|$)/i;
-var WEAK_VALUES = new Set([
-  "",
-  "changeme",
-  "change-me",
-  "change_me",
-  "password",
-  "passw0rd",
-  "secret",
-  "admin",
-  "root",
-  "test",
-  "default",
-  "example",
-  "123456",
-  "12345678",
-  "qwerty",
-  "todo",
-  "xxx"
-]);
-var SECRET_PATTERNS = [
-  [/AKIA[0-9A-Z]{16}/, "an AWS access key id"],
-  [/gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
-  [/sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
-  [/xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
-  [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"]
-];
+function dotenvProblem(key, text) {
+  if (!/^[\w.-]+$/.test(key)) {
+    return "the name is not a valid variable name (only letters, digits, `_`, `.` and `-`)";
+  }
+  if (/[\r\n]/.test(text)) {
+    return "the value has a line break, which a .env file cannot hold safely (write it on one line, with `\\n` escapes if the application expects them)";
+  }
+  return;
+}
 function isSensitiveKey(key) {
   return SENSITIVE_KEY.test(key);
 }
@@ -74,223 +61,747 @@ function parseUrl(text) {
     local: /^(localhost|127\.\d+\.\d+\.\d+|::1|0\.0\.0\.0)$/.test(hostname)
   };
 }
-var valuesFile = ".envs/values.yml";
 function envFiles(ctx) {
   return [
     { location: valuesFile, mode: ctx.valuesMode },
+    ...ctx.hasHistory ? [{ location: historyFile, mode: ctx.historyMode }] : [],
     ...ctx.dotenvs.map((d) => ({ location: `${d.name}/.env`, mode: d.mode }))
   ];
 }
-var rules = [
-  {
-    id: "tracked-values",
-    description: "values.yml is tracked by git.",
-    async check(ctx) {
-      if (!await ctx.isTracked(ctx.root, valuesFile))
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: "values.yml is tracked by git, so its secrets are in the history. Run `git rm --cached .envs/values.yml`."
-        }
-      ];
-    }
-  },
-  {
-    id: "unignored-values",
-    description: "values.yml is neither tracked nor ignored by git.",
-    async check(ctx) {
-      if (await ctx.isTracked(ctx.root, valuesFile))
-        return [];
-      if (await ctx.isIgnored(ctx.root, valuesFile))
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: "values.yml is not ignored by git and could be committed by accident. Add `*` to .envs/.gitignore."
+var SENSITIVE_KEY, WEAK_VALUES, SECRET_PATTERNS, valuesFile = ".envs/values.yml", historyFile = ".envs/history.ndjson", rules;
+var init_lint_rules = __esm(() => {
+  SENSITIVE_KEY = /(^|_)(SECRET|PASSWORD|PASSWD|PWD|TOKEN|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?|AUTH|SALT|SIGNING)(_|$)/i;
+  WEAK_VALUES = new Set([
+    "",
+    "changeme",
+    "change-me",
+    "change_me",
+    "password",
+    "passw0rd",
+    "secret",
+    "admin",
+    "root",
+    "test",
+    "default",
+    "example",
+    "123456",
+    "12345678",
+    "qwerty",
+    "todo",
+    "xxx"
+  ]);
+  SECRET_PATTERNS = [
+    [/AKIA[0-9A-Z]{16}/, "an AWS access key id"],
+    [/gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
+    [/sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
+    [/xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"]
+  ];
+  rules = [
+    {
+      id: "tracked-values",
+      description: "values.yml is tracked by git.",
+      async check(ctx) {
+        if (!await ctx.isTracked(ctx.root, valuesFile))
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: "values.yml is tracked by git, so its secrets are in the history. Run `git rm --cached .envs/values.yml`."
+          }
+        ];
+      }
+    },
+    {
+      id: "unignored-values",
+      description: "values.yml is neither tracked nor ignored by git.",
+      async check(ctx) {
+        if (await ctx.isTracked(ctx.root, valuesFile))
+          return [];
+        if (await ctx.isIgnored(ctx.root, valuesFile))
+          return [];
+        return [
+          {
+            location: valuesFile,
+            message: "values.yml is not ignored by git and could be committed by accident. Add `*` to .envs/.gitignore."
+          }
+        ];
+      }
+    },
+    {
+      id: "open-permissions",
+      description: "values.yml or the history is readable by other users.",
+      check: (ctx) => [
+        { file: valuesFile, mode: ctx.valuesMode },
+        ...ctx.hasHistory ? [{ file: historyFile, mode: ctx.historyMode }] : []
+      ].filter(({ mode }) => mode !== undefined && (mode & 63) !== 0).map(({ file, mode }) => ({
+        location: file,
+        message: `${file.slice(".envs/".length)} is readable by other users (mode ${(mode & 511).toString(8)}). Run \`chmod 600 ${file}\`.`
+      }))
+    },
+    {
+      id: "executable-files",
+      description: "values.yml or a worktree's .env has execute permission.",
+      check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 73) !== 0).map((f) => ({
+        location: f.location,
+        message: `The file is executable (mode ${(f.mode & 511).toString(8)}); env files are data and must not be. Run \`chmod -x\` on it.`
+      }))
+    },
+    {
+      id: "writable-files",
+      description: "values.yml or a worktree's .env is writable by other users.",
+      check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 18) !== 0).map((f) => ({
+        location: f.location,
+        message: `The file is writable by group or other users (mode ${(f.mode & 511).toString(8)}), who could change your environment. Run \`chmod go-w\` on it.`
+      }))
+    },
+    {
+      id: "tracked-history",
+      description: "The history (.envs/history.ndjson) is tracked by git.",
+      async check(ctx) {
+        if (!ctx.hasHistory || !await ctx.isTracked(ctx.root, historyFile))
+          return [];
+        return [
+          {
+            location: historyFile,
+            message: "The history is tracked by git, and it holds the previous and the new value of every variable, secrets included. Run `git rm --cached .envs/history.ndjson`."
+          }
+        ];
+      }
+    },
+    {
+      id: "unignored-history",
+      description: "The history (.envs/history.ndjson) is neither tracked nor ignored by git.",
+      async check(ctx) {
+        if (!ctx.hasHistory)
+          return [];
+        if (await ctx.isTracked(ctx.root, historyFile))
+          return [];
+        if (await ctx.isIgnored(ctx.root, historyFile))
+          return [];
+        return [
+          {
+            location: historyFile,
+            message: "The history is not ignored by git and could be committed by accident, with its secrets. Add `*` to .envs/.gitignore."
+          }
+        ];
+      }
+    },
+    {
+      id: "tracked-dotenv",
+      description: "A worktree's .env is tracked by git.",
+      async check(ctx) {
+        const found = [];
+        for (const { name, path } of ctx.dotenvs) {
+          if (!await ctx.isTracked(path, ".env"))
+            continue;
+          found.push({
+            location: `${name}/.env`,
+            message: "The .env is tracked by git. Run `git rm --cached .env` and add it to .gitignore."
+          });
         }
-      ];
-    }
-  },
-  {
-    id: "open-permissions",
-    description: "values.yml is readable by other users.",
-    check({ valuesMode }) {
-      if (valuesMode === undefined || (valuesMode & 63) === 0)
-        return [];
-      return [
-        {
-          location: valuesFile,
-          message: `values.yml is readable by other users (mode ${(valuesMode & 511).toString(8)}). Run \`chmod 600 .envs/values.yml\`.`
+        return found;
+      }
+    },
+    {
+      id: "unignored-dotenv",
+      description: "A worktree's .env is neither tracked nor ignored by git.",
+      async check(ctx) {
+        const found = [];
+        for (const { name, path } of ctx.dotenvs) {
+          if (await ctx.isTracked(path, ".env"))
+            continue;
+          if (await ctx.isIgnored(path, ".env"))
+            continue;
+          found.push({
+            location: `${name}/.env`,
+            message: "The .env is not ignored by git. Add `.env` to .gitignore."
+          });
         }
-      ];
-    }
-  },
-  {
-    id: "executable-files",
-    description: "values.yml or a worktree's .env has execute permission.",
-    check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 73) !== 0).map((f) => ({
-      location: f.location,
-      message: `The file is executable (mode ${(f.mode & 511).toString(8)}); env files are data and must not be. Run \`chmod -x\` on it.`
-    }))
-  },
-  {
-    id: "writable-files",
-    description: "values.yml or a worktree's .env is writable by other users.",
-    check: (ctx) => envFiles(ctx).filter((f) => f.mode !== undefined && (f.mode & 18) !== 0).map((f) => ({
-      location: f.location,
-      message: `The file is writable by group or other users (mode ${(f.mode & 511).toString(8)}), who could change your environment. Run \`chmod go-w\` on it.`
-    }))
-  },
-  {
-    id: "tracked-dotenv",
-    description: "A worktree's .env is tracked by git.",
-    async check(ctx) {
-      const found = [];
-      for (const { name, path } of ctx.dotenvs) {
-        if (!await ctx.isTracked(path, ".env"))
-          continue;
-        found.push({
-          location: `${name}/.env`,
-          message: "The .env is tracked by git. Run `git rm --cached .env` and add it to .gitignore."
-        });
+        return found;
       }
-      return found;
-    }
-  },
-  {
-    id: "unignored-dotenv",
-    description: "A worktree's .env is neither tracked nor ignored by git.",
-    async check(ctx) {
-      const found = [];
-      for (const { name, path } of ctx.dotenvs) {
-        if (await ctx.isTracked(path, ".env"))
-          continue;
-        if (await ctx.isIgnored(path, ".env"))
-          continue;
-        found.push({
-          location: `${name}/.env`,
-          message: "The .env is not ignored by git. Add `.env` to .gitignore."
+    },
+    {
+      id: "weak-secret",
+      description: "A sensitive variable is empty or has an easily guessed value.",
+      check: (ctx) => entries(ctx).filter((e) => isSensitiveKey(e.key) && WEAK_VALUES.has(e.text.trim().toLowerCase())).map((e) => ({
+        location: e.location,
+        message: `${e.key} has an empty or easily guessed value.`
+      }))
+    },
+    {
+      id: "shared-secret",
+      description: "A sensitive variable is in defaults, so it goes to every worktree using that profile.",
+      check: (ctx) => entries(ctx).filter((e) => e.shared && isSensitiveKey(e.key)).map((e) => ({
+        location: e.location,
+        message: `${e.key} looks sensitive but is written to every worktree; set it per worktree under envs instead.`
+      }))
+    },
+    {
+      id: "secret-pattern",
+      description: "A value has the format of a well-known secret.",
+      check: (ctx) => entries(ctx).flatMap((e) => SECRET_PATTERNS.filter(([pattern]) => pattern.test(e.text)).map(([, name]) => ({
+        location: e.location,
+        message: `${e.key} looks like ${name}.`
+      })))
+    },
+    {
+      id: "url-credentials",
+      description: "A remote URL embeds a password.",
+      check: (ctx) => entries(ctx).filter((e) => {
+        const url = parseUrl(e.text);
+        return url?.hasPassword && !url.local;
+      }).map((e) => ({
+        location: e.location,
+        message: `${e.key} embeds a password in its URL.`
+      }))
+    },
+    {
+      id: "insecure-url",
+      description: "A remote URL uses an unencrypted protocol.",
+      check: (ctx) => entries(ctx).filter((e) => {
+        const url = parseUrl(e.text);
+        return url && !url.local && ["http", "ws", "ftp"].includes(url.scheme);
+      }).map((e) => ({
+        location: e.location,
+        message: `${e.key} uses ${parseUrl(e.text).scheme}:// instead of an encrypted protocol.`
+      }))
+    },
+    {
+      id: "unknown-profile",
+      description: "A worktree uses a profile that is not defined.",
+      check: ({ values }) => Object.entries(values.uses ?? {}).filter(([, profile]) => profile !== "default" && !Object.hasOwn(values.profiles ?? {}, profile)).map(([worktree, profile]) => ({
+        location: `uses.${worktree}`,
+        message: `Profile "${profile}" is not defined under profiles; \`envs edit\` creates it from default.`
+      }))
+    },
+    {
+      id: "unsafe-dotenv-value",
+      description: "A variable name or value cannot be written to a .env file safely (line break, invalid name).",
+      check: (ctx) => entries(ctx).flatMap((e) => {
+        const problem = dotenvProblem(e.key, e.text);
+        return problem ? [{ location: e.location, message: `${JSON.stringify(e.key)}: ${problem}.` }] : [];
+      })
+    },
+    {
+      id: "unknown-worktree",
+      description: "values.yml has values for a worktree that git does not list (deleted, or its branch was renamed).",
+      check({ values, worktrees }) {
+        if (!worktrees)
+          return [];
+        const known = new Set(worktrees);
+        const found = [];
+        const note = (location, name) => found.push({
+          location,
+          message: `"${name}" is not a git worktree anymore (it was deleted, or its branch renamed). Its values stay in values.yml but nothing uses them: remove them with \`envs edit\`.`
         });
+        for (const name of Object.keys(values.uses ?? {}))
+          if (!known.has(name))
+            note(`uses.${name}`, name);
+        const scan = (prefix, envs) => {
+          for (const [variable, byWorktree] of Object.entries(envs ?? {})) {
+            for (const name of Object.keys(byWorktree ?? {}))
+              if (!known.has(name))
+                note(`${prefix}envs.${variable}.${name}`, name);
+          }
+        };
+        scan("", values.envs);
+        for (const [profile, section] of Object.entries(values.profiles ?? {}))
+          scan(`profiles.${profile}.`, section?.envs);
+        return found;
       }
-      return found;
     }
-  },
-  {
-    id: "weak-secret",
-    description: "A sensitive variable is empty or has an easily guessed value.",
-    check: (ctx) => entries(ctx).filter((e) => isSensitiveKey(e.key) && WEAK_VALUES.has(e.text.trim().toLowerCase())).map((e) => ({
-      location: e.location,
-      message: `${e.key} has an empty or easily guessed value.`
-    }))
-  },
-  {
-    id: "shared-secret",
-    description: "A sensitive variable is in defaults, so it goes to every worktree using that profile.",
-    check: (ctx) => entries(ctx).filter((e) => e.shared && isSensitiveKey(e.key)).map((e) => ({
-      location: e.location,
-      message: `${e.key} looks sensitive but is written to every worktree; set it per worktree under envs instead.`
-    }))
-  },
-  {
-    id: "secret-pattern",
-    description: "A value has the format of a well-known secret.",
-    check: (ctx) => entries(ctx).flatMap((e) => SECRET_PATTERNS.filter(([pattern]) => pattern.test(e.text)).map(([, name]) => ({
-      location: e.location,
-      message: `${e.key} looks like ${name}.`
-    })))
-  },
-  {
-    id: "url-credentials",
-    description: "A remote URL embeds a password.",
-    check: (ctx) => entries(ctx).filter((e) => {
-      const url = parseUrl(e.text);
-      return url?.hasPassword && !url.local;
-    }).map((e) => ({
-      location: e.location,
-      message: `${e.key} embeds a password in its URL.`
-    }))
-  },
-  {
-    id: "insecure-url",
-    description: "A remote URL uses an unencrypted protocol.",
-    check: (ctx) => entries(ctx).filter((e) => {
-      const url = parseUrl(e.text);
-      return url && !url.local && ["http", "ws", "ftp"].includes(url.scheme);
-    }).map((e) => ({
-      location: e.location,
-      message: `${e.key} uses ${parseUrl(e.text).scheme}:// instead of an encrypted protocol.`
-    }))
-  },
-  {
-    id: "unknown-profile",
-    description: "A worktree uses a profile that is not defined.",
-    check: ({ values }) => Object.entries(values.uses ?? {}).filter(([, profile]) => profile !== "default" && !Object.hasOwn(values.profiles ?? {}, profile)).map(([worktree, profile]) => ({
-      location: `uses.${worktree}`,
-      message: `Profile "${profile}" is not defined under profiles; \`envs edit\` creates it from default.`
-    }))
-  }
-];
+  ];
+});
 
-// src/envs.ts
-var HELP = `Usage: envs <command>
+// src/history.ts
+function cloneProfile(profile) {
+  const copy = emptyProfile();
+  for (const [key, value] of Object.entries(profile.defaults))
+    put(copy.defaults, key, value);
+  for (const [key, byWorktree] of Object.entries(profile.envs)) {
+    const target = dict();
+    for (const [worktree, value] of Object.entries(byWorktree))
+      put(target, worktree, value);
+    put(copy.envs, key, target);
+  }
+  return copy;
+}
+function cloneState(state) {
+  const copy = emptyState();
+  for (const [worktree, profile] of Object.entries(state.uses))
+    put(copy.uses, worktree, profile);
+  for (const [name, profile] of Object.entries(state.profiles))
+    put(copy.profiles, name, cloneProfile(profile));
+  return copy;
+}
+function diffValues(before, after) {
+  const changes = [];
+  const compare = (path, a, b) => {
+    if (a !== b)
+      changes.push({ path, ...a !== undefined && { from: a }, ...b !== undefined && { to: b } });
+  };
+  for (const w of keys(before.uses, after.uses))
+    compare(["uses", w], own(before.uses, w), own(after.uses, w));
+  for (const p of keys(before.profiles, after.profiles)) {
+    const a = own(before.profiles, p);
+    const b = own(after.profiles, p);
+    if (p !== DEFAULT_PROFILE && !a && b)
+      changes.push({ path: ["profiles", p], to: true });
+    for (const k of keys(a?.defaults, b?.defaults)) {
+      compare(["profiles", p, "defaults", k], own(a?.defaults, k), own(b?.defaults, k));
+    }
+    for (const k of keys(a?.envs, b?.envs)) {
+      const ea = own(a?.envs, k);
+      const eb = own(b?.envs, k);
+      for (const w of keys(ea, eb))
+        compare(["profiles", p, "envs", k, w], own(ea, w), own(eb, w));
+    }
+    if (p !== DEFAULT_PROFILE && a && !b)
+      changes.push({ path: ["profiles", p], from: true });
+  }
+  return changes;
+}
+function applyChanges(state, changes) {
+  for (const { path, to } of changes) {
+    const [section, ...rest] = path;
+    if (section === "uses") {
+      const [worktree] = rest;
+      if (to === undefined)
+        delete state.uses[worktree];
+      else
+        put(state.uses, worktree, String(to));
+      continue;
+    }
+    const [profileName, kind, variable, worktree] = rest;
+    if (kind === undefined) {
+      if (to === undefined)
+        delete state.profiles[profileName];
+      else if (!own(state.profiles, profileName))
+        put(state.profiles, profileName, emptyProfile());
+      continue;
+    }
+    let profile = own(state.profiles, profileName);
+    if (!profile)
+      put(state.profiles, profileName, profile = emptyProfile());
+    if (kind === "defaults") {
+      if (to === undefined)
+        delete profile.defaults[variable];
+      else
+        put(profile.defaults, variable, to);
+    } else {
+      let byWorktree = own(profile.envs, variable);
+      if (!byWorktree)
+        put(profile.envs, variable, byWorktree = dict());
+      if (to === undefined)
+        delete byWorktree[worktree];
+      else
+        put(byWorktree, worktree, to);
+      if (Object.keys(byWorktree).length === 0)
+        delete profile.envs[variable];
+    }
+  }
+}
+function findHistoryPoint(points, hash) {
+  const matches = hash === "" ? [] : points.filter((point) => point.hash.startsWith(hash));
+  if (matches.length === 1)
+    return { point: matches[0] };
+  return { error: matches.length === 0 ? "none" : "ambiguous", matches: matches.length };
+}
+function withDefaults(state) {
+  for (const name of [DEFAULT_PROFILE, ...Object.values(state.uses)]) {
+    if (!own(state.profiles, name))
+      put(state.profiles, name, emptyProfile());
+  }
+  return state;
+}
+function stateAfter(points, target) {
+  const state = emptyState();
+  for (const point of points) {
+    applyChanges(state, point.changes);
+    if (point === target)
+      break;
+  }
+  withDefaults(state);
+  return state;
+}
+var DEFAULT_PROFILE = "default", REDACTED_PREFIX = "envs:redacted:", isRedacted = (value) => typeof value === "string" && value.startsWith(REDACTED_PREFIX), dict = () => Object.create(null), own = (map, key) => map !== undefined && Object.hasOwn(map, key) ? map[key] : undefined, put = (map, key, value) => void Object.defineProperty(map, key, { value, writable: true, enumerable: true, configurable: true }), emptyProfile = () => ({ defaults: dict(), envs: dict() }), emptyState = () => ({ uses: dict(), profiles: dict() }), keys = (a, b) => [...new Set([...Object.keys(a ?? {}), ...Object.keys(b ?? {})])];
 
-Commands:
-  init    Create the .envs/ directory (.gitignore, values.yml)
-  pull    Read each worktree's .env and write it into .envs/values.yml
-  push    Write defaults and .envs/values.yml into the .env of each worktree
-  lint    Warn about insecure values and unprotected secret files
-  edit    Pull, open .envs/values.yml in VS Code (code -w), then push
-  use     Select the profile of the current worktree (envs use <profile>), or list them
-  help    Show this help message
-`;
-var colorsDisabled = () => Boolean(process.env.NO_COLOR);
-var MASK = "********";
-var isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key);
-var paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`;
-var green = (text) => paint(32, text);
-var yellow = (text) => paint(33, text);
-var defaultContext = () => ({
-  cwd: process.cwd(),
-  log: (message) => console.log(message),
-  error: (message) => console.error(message),
-  openEditor: async (path) => {
-    const proc = Bun.spawn(["code", "-w", path], {
-      env: { ...process.env },
-      stdio: ["inherit", "inherit", "inherit"]
-    });
-    return await proc.exited;
+// src/ui/server.ts
+import { join } from "path";
+import { randomBytes, timingSafeEqual } from "crypto";
+import { readdir } from "fs/promises";
+function parseBody(body) {
+  if (!isRecord(body) || !isRecord(body.uses) || !isRecord(body.profiles))
+    return;
+  if (!Object.values(body.uses).every((v) => typeof v === "string"))
+    return;
+  for (const profile of Object.values(body.profiles)) {
+    if (!isRecord(profile) || !isRecord(profile.defaults) || !isRecord(profile.envs))
+      return;
+    if (!Object.values(profile.defaults).every(isScalar))
+      return;
+    for (const byWorktree of Object.values(profile.envs)) {
+      if (!isRecord(byWorktree) || !Object.values(byWorktree).every(isScalar))
+        return;
+    }
+  }
+  if (body.version !== undefined && typeof body.version !== "string")
+    return;
+  return { values: body, ...body.version !== undefined && { base: body.version } };
+}
+function parseRestoreBody(body) {
+  if (!isRecord(body) || typeof body.hash !== "string" || !/^[0-9a-f]{12}$/.test(body.hash))
+    return;
+  return body.hash;
+}
+function capture(ctx) {
+  const logs = [];
+  const errors = [];
+  const captured = {
+    ...ctx,
+    log: (m) => logs.push(m.replace(ANSI, "")),
+    error: (m) => errors.push(m.replace(ANSI, ""))
+  };
+  return { ctx: captured, logs, errors };
+}
+async function loadAssets() {
+  const assets = new Map;
+  if (await Bun.file(join(import.meta.dir, "app.tsx")).exists()) {
+    const result = await Bun.build({ entrypoints: [join(import.meta.dir, "index.html")], target: "browser" });
+    if (!result.success)
+      throw new AggregateError(result.logs, "Web editor build failed");
+    for (const out of result.outputs)
+      assets.set(out.path.replace(/^\.\//, ""), out);
+  } else {
+    const dir = join(import.meta.dir, "ui");
+    for (const name of await readdir(dir))
+      assets.set(name, Bun.file(join(dir, name)));
   }
+  return assets;
+}
+function sameToken(presented, token) {
+  if (!presented)
+    return false;
+  const a = Buffer.from(presented);
+  const b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function presentedToken(req) {
+  const header = req.headers.get("x-envs-token");
+  if (header)
+    return header;
+  return req.headers.get("cookie")?.split(";").map((c) => c.trim().split("=")).find(([name]) => name === TOKEN_COOKIE)?.[1];
+}
+async function serveUi(ctx) {
+  const assets = await loadAssets();
+  const token = randomBytes(24).toString("base64url");
+  const guard = (handler) => async (req) => {
+    const port = server.port;
+    const hosts = [`127.0.0.1:${port}`, `localhost:${port}`];
+    if (!hosts.includes(req.headers.get("host") ?? "")) {
+      return new Response("Misdirected request", { status: 421 });
+    }
+    const origin = req.headers.get("origin");
+    if (origin !== null && !hosts.some((host) => origin === `http://${host}`)) {
+      return new Response("Forbidden origin", { status: 403 });
+    }
+    const url = new URL(req.url);
+    if (url.pathname === "/" && sameToken(url.searchParams.get("token"), token)) {
+      return new Response(null, {
+        status: 302,
+        headers: {
+          location: "/",
+          "set-cookie": `${TOKEN_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/`
+        }
+      });
+    }
+    if (!sameToken(presentedToken(req), token)) {
+      return new Response("Unauthorized: open the address printed by `envs edit --ui`.", { status: 401 });
+    }
+    if (req.method !== "GET" && req.method !== "HEAD" && !req.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
+      return new Response("Unsupported media type", { status: 415 });
+    }
+    return handler(req);
+  };
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    maxRequestBodySize: MAX_BODY_BYTES,
+    routes: {
+      "/api/values": {
+        GET: guard(async () => Response.json(await loadUiState(ctx))),
+        PUT: guard(async (req) => {
+          const parsed = parseBody(await req.json().catch(() => {
+            return;
+          }));
+          if (!parsed)
+            return Response.json({ error: "Invalid values" }, { status: 400 });
+          const { ctx: captured, logs, errors } = capture(ctx);
+          const { created, code, conflict } = await saveUiState(captured, parsed.values, { base: parsed.base });
+          return Response.json({ ok: code === 0, created, logs, errors }, { status: code === 0 ? 200 : conflict ? 409 : 500 });
+        })
+      },
+      "/api/history": {
+        GET: guard(async () => Response.json(await loadUiHistory(ctx)))
+      },
+      "/api/restore": {
+        POST: guard(async (req) => {
+          const hash = parseRestoreBody(await req.json().catch(() => {
+            return;
+          }));
+          if (!hash)
+            return Response.json({ error: "Invalid hash" }, { status: 400 });
+          const root = await findRoot(ctx.cwd);
+          if (!await historyEnabled(root))
+            return Response.json({ error: "The history is off" }, { status: 409 });
+          if (!(await readHistoryPoints(root)).some((point) => point.hash === hash)) {
+            return Response.json({ error: "Unknown history point" }, { status: 404 });
+          }
+          const { ctx: captured, logs, errors } = capture(ctx);
+          const code = await restore(captured, hash);
+          return Response.json({ ok: code === 0, created: [], logs, errors }, { status: code === 0 ? 200 : 500 });
+        })
+      }
+    },
+    fetch: guard((req) => {
+      const path = new URL(req.url).pathname.slice(1) || "index.html";
+      const asset = assets.get(path);
+      return asset ? new Response(asset) : new Response("Not found", { status: 404 });
+    })
+  });
+  const url = `http://127.0.0.1:${server.port}/?token=${token}`;
+  ctx.log(`Web editor running at ${url} (Ctrl+C to stop)`);
+  await ctx.openUrl?.(url);
+  await (ctx.waitForExit ?? (() => new Promise(() => {})))();
+  await server.stop(true);
+  return 0;
+}
+var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v), TOKEN_COOKIE = "envs_token", MAX_BODY_BYTES;
+var init_server = __esm(() => {
+  init_envs();
+  ANSI = /\x1b\[[0-9;]*m/g;
+  MAX_BODY_BYTES = 5 * 1024 * 1024;
 });
-var DEFAULT_PROFILE = "default";
-var hasProfile = (values, name) => Object.hasOwn(values.profiles, name);
+
+// src/envs.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { chmod, mkdir, open, rename, unlink, writeFile } from "fs/promises";
+import { basename, dirname, join as join2 } from "path";
+import { stat } from "fs/promises";
+import { createHash, createHmac, randomBytes as randomBytes2 } from "crypto";
+import { appendFile, truncate } from "fs/promises";
+var {$ } = globalThis.Bun;
 function normalizeValues(raw) {
-  const profiles = {};
+  const profiles = dict();
   const add = (name, profile) => {
-    const target = profiles[name] ??= { defaults: {}, envs: {} };
+    const target = profiles[name] ??= { defaults: dict(), envs: dict() };
     Object.assign(target.defaults, profile?.defaults);
     for (const [key, byWorktree] of Object.entries(profile?.envs ?? {})) {
-      Object.assign(target.envs[key] ??= {}, byWorktree);
+      Object.assign(target.envs[key] ??= dict(), byWorktree);
     }
   };
   add(DEFAULT_PROFILE, { defaults: raw.defaults, envs: raw.envs });
   for (const [name, profile] of Object.entries(raw.profiles ?? {})) {
     add(name, profile);
   }
-  return { uses: { ...raw.uses }, profiles };
+  const uses = dict();
+  for (const [worktree, profile] of Object.entries(raw.uses ?? {}))
+    uses[worktree] = profile;
+  return { uses, profiles };
 }
 function materializeProfiles(values) {
   const created = [];
   for (const name of Object.values(values.uses).map(String)) {
     if (hasProfile(values, name))
       continue;
-    values.profiles[name] = structuredClone(values.profiles[DEFAULT_PROFILE]);
+    values.profiles[name] = cloneProfile(values.profiles[DEFAULT_PROFILE]);
     created.push(name);
   }
   return created;
 }
+async function keepsSecrets(root) {
+  return (await readConfig(join2(root, ".envs/config.yml")))["history.secrets"] === true;
+}
+async function historyKey(root) {
+  const path = join2(root, ".envs/history.key");
+  const read = async () => (await Bun.file(path).text()).trim();
+  if (await Bun.file(path).exists())
+    return await read();
+  await mkdir(join2(root, ".envs"), { recursive: true, mode: 448 });
+  try {
+    await writeFile(path, randomBytes2(32).toString("hex") + `
+`, { mode: 384, flag: "wx" });
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+  }
+  return await read();
+}
+async function redactor(root) {
+  if (await keepsSecrets(root))
+    return { mark: (_, value) => value, state: (state) => cloneState(state) };
+  const key = await historyKey(root);
+  const mark = (name, value) => REDACTED_PREFIX + createHmac("sha256", key).update(`${name}\x00${value}`).digest("hex").slice(0, 16);
+  const one = (name, value) => typeof value === "string" && isRedacted(value) ? value : isSecretEntry(name, String(value)) ? mark(name, String(value)) : value;
+  return {
+    mark,
+    state(state) {
+      const copy = cloneState(state);
+      for (const profile of Object.values(copy.profiles)) {
+        for (const [name, value] of Object.entries(profile.defaults))
+          profile.defaults[name] = one(name, value);
+        for (const [name, byWorktree] of Object.entries(profile.envs)) {
+          for (const [worktree, value] of Object.entries(byWorktree))
+            byWorktree[worktree] = one(name, value);
+        }
+      }
+      return copy;
+    }
+  };
+}
+function unredact(restored, current, mark) {
+  const notes = [];
+  for (const [profileName, profile] of Object.entries(restored.profiles)) {
+    const now = Object.hasOwn(current.profiles, profileName) ? current.profiles[profileName] : undefined;
+    const settle = (map, key, variable, where, currentValue) => {
+      const value = map[key];
+      if (!isRedacted(value))
+        return;
+      if (currentValue === undefined) {
+        delete map[key];
+        notes.push(`${variable} (${where}): not restored, the history does not keep its value`);
+        return;
+      }
+      map[key] = currentValue;
+      if (mark(variable, String(currentValue)) !== value) {
+        notes.push(`${variable} (${where}): kept the current value, the history does not keep the old one`);
+      }
+    };
+    for (const variable of Object.keys(profile.defaults)) {
+      const nowValue = now && Object.hasOwn(now.defaults, variable) ? now.defaults[variable] : undefined;
+      settle(profile.defaults, variable, variable, `${profileName} defaults`, nowValue);
+    }
+    for (const [variable, byWorktree] of Object.entries(profile.envs)) {
+      const nowByWorktree = now && Object.hasOwn(now.envs, variable) ? now.envs[variable] : undefined;
+      for (const worktree of Object.keys(byWorktree)) {
+        const nowValue = nowByWorktree && Object.hasOwn(nowByWorktree, worktree) ? nowByWorktree[worktree] : undefined;
+        settle(byWorktree, worktree, variable, `${profileName} ${worktree}`, nowValue);
+      }
+      if (Object.keys(byWorktree).length === 0)
+        delete profile.envs[variable];
+    }
+  }
+  return notes;
+}
+async function recordHistory(root, before, after, now = () => new Date, warn = () => {}) {
+  return await withLock(root, () => recordHistoryLocked(root, before, after, now, warn));
+}
+async function recordHistoryLocked(root, before, after, now, warn) {
+  if (!await historyEnabled(root))
+    return;
+  const historyPath = join2(root, ".envs/history.ndjson");
+  const scan = await scanHistory(root);
+  if (scan.torn)
+    warn(".envs/history.ndjson ended with an incomplete line (an interrupted write): it is ignored.");
+  if (scan.damaged.length > 0) {
+    warn(`.envs/history.ndjson has damaged lines (${scan.damaged.join(", ")}): they are ignored, so the history may be incomplete.`);
+  }
+  if (scan.broken.length > 0) {
+    warn(`.envs/history.ndjson: the hash chain is broken at ${describeBroken(scan.broken)}. The history may have been altered; \`envs restore\` refuses until it is checked.`);
+  }
+  const points = scan.points;
+  let prev = points.at(-1)?.hash ?? null;
+  let repaired = false;
+  const append = async (changes, extra = {}) => {
+    if (!repaired) {
+      repaired = true;
+      if (scan.torn)
+        await truncate(historyPath, Buffer.byteLength(scan.complete));
+      else if (!scan.endsWithNewline)
+        await appendFile(historyPath, `
+`);
+    }
+    const point = { prev, timestamp: now().toISOString(), changes, ...extra };
+    const hash = createHash("sha256").update(JSON.stringify(point)).digest("hex").slice(0, 12);
+    await appendFile(historyPath, JSON.stringify({ hash, ...point }) + `
+`, { mode: 384 });
+    prev = hash;
+    return hash;
+  };
+  const { state: redact } = await redactor(root);
+  const redactedBefore = redact(before);
+  const redactedAfter = redact(after);
+  if (points.length === 0) {
+    const changes = diffValues({ uses: {}, profiles: {} }, redactedAfter);
+    return changes.length === 0 ? undefined : await append(changes);
+  }
+  const drift = diffValues(redact(stateAfter(points, points.at(-1))), redactedBefore);
+  if (drift.length > 0)
+    await append(drift, { resync: true });
+  const changes = diffValues(redactedBefore, redactedAfter);
+  return changes.length === 0 ? undefined : await append(changes);
+}
+async function redactHistory(ctx) {
+  const root = await findRoot(ctx.cwd);
+  return await withLock(root, async () => {
+    const scan = await scanHistory(root);
+    if (scan.points.length === 0 && scan.damaged.length === 0) {
+      ctx.log("There is no history to redact.");
+      return 0;
+    }
+    if (scan.damaged.length > 0 || scan.broken.length > 0) {
+      ctx.error(".envs/history.ndjson is damaged or its hash chain is broken: check it before rewriting it.");
+      return 1;
+    }
+    const { mark } = await redactor(root);
+    let redacted = 0;
+    const redactValue = (variable, value) => {
+      if (value === undefined || isRedacted(value) || !isSecretEntry(variable, String(value)))
+        return value;
+      redacted++;
+      return mark(variable, String(value));
+    };
+    let prev = null;
+    const lines = [];
+    for (const old of scan.points) {
+      const changes = old.changes.map((change) => {
+        const [section, , kind, variable] = change.path;
+        if (section !== "profiles" || kind !== "defaults" && kind !== "envs" || variable === undefined)
+          return change;
+        const from = redactValue(variable, change.from);
+        const to = redactValue(variable, change.to);
+        return { path: change.path, ...from !== undefined && { from }, ...to !== undefined && { to } };
+      });
+      const point = { prev, timestamp: old.timestamp, changes, ...old.resync && { resync: true } };
+      const hash = createHash("sha256").update(JSON.stringify(point)).digest("hex").slice(0, 12);
+      lines.push(JSON.stringify({ hash, ...point }));
+      prev = hash;
+    }
+    if (redacted === 0) {
+      ctx.log("No secrets in clear in the history: nothing to redact.");
+      return 0;
+    }
+    const path = join2(root, ".envs/history.ndjson");
+    await writeFile(`${path}.tmp`, lines.join(`
+`) + `
+`, { mode: 384 });
+    await rename(`${path}.tmp`, path);
+    ctx.log(green(`\u2713 redacted ${redacted} secret value(s) in the history; its hash chain was rewritten (the hashes of its points changed)`));
+    return 0;
+  });
+}
+async function historyCommand(ctx, args) {
+  if (args[0] === "redact")
+    return await redactHistory(ctx);
+  ctx.error("Usage: envs history redact");
+  return 1;
+}
+async function historyEnabled(root) {
+  return (await readConfig(join2(root, ".envs/config.yml"))).history !== false;
+}
 function resolveEntries(values, worktree, profile, includeProfileEnvs = true) {
-  const entries = {};
+  const entries = dict();
   for (const name of new Set([DEFAULT_PROFILE, profile])) {
     const layer = values.profiles[name];
     for (const [key, value] of Object.entries(layer.defaults)) {
@@ -299,14 +810,13 @@ function resolveEntries(values, worktree, profile, includeProfileEnvs = true) {
     if (name === profile && !includeProfileEnvs)
       continue;
     for (const [key, byWorktree] of Object.entries(layer.envs)) {
-      if (byWorktree && worktree in byWorktree) {
+      if (byWorktree && Object.hasOwn(byWorktree, worktree)) {
         entries[key] = String(byWorktree[worktree]);
       }
     }
   }
   return entries;
 }
-var hasCompleteProfiles = (raw) => Object.values(raw.profiles ?? {}).every((profile) => typeof profile?.defaults === "object" && profile.defaults !== null && typeof profile.envs === "object" && profile.envs !== null);
 function stringifyValues(values) {
   const profiles = Object.fromEntries(Object.entries(values.profiles).map(([name, { defaults, envs }]) => {
     const kept = Object.fromEntries(Object.entries(envs).filter(([, byWorktree]) => Object.keys(byWorktree).length > 0));
@@ -315,8 +825,6 @@ function stringifyValues(values) {
   const out = Object.keys(values.uses).length > 0 ? { uses: values.uses, profiles } : { profiles };
   return SCHEMA_COMMENT + Bun.YAML.stringify(out, null, 2);
 }
-var SCHEMA_COMMENT = `# yaml-language-server: $schema=https://jondotsoy.github.io/envs/schema.json
-`;
 function checkProfiles(ctx, values, worktrees) {
   let ok = true;
   for (const { name } of worktrees) {
@@ -350,7 +858,7 @@ async function listWorktrees(cwd) {
   });
 }
 function parseDotenv(text) {
-  const result = {};
+  const result = dict();
   for (const raw of text.split(/\r?\n/)) {
     const line = raw.trim();
     if (!line || line.startsWith("#"))
@@ -386,27 +894,107 @@ function formatDotenvValue(value) {
     return value;
   return value.includes('"') ? `'${value}'` : `"${value}"`;
 }
-function updateDotenv(text, entries) {
+function updateDotenv(text, entries, remove = new Set) {
   const pending = new Map(Object.entries(entries));
   const lines = text === "" ? [] : text.replace(/\n$/, "").split(`
 `);
-  const updated = lines.map((line) => {
+  const updated = [];
+  for (const line of lines) {
     const key = line.trim().match(/^(?:export\s+)?([\w.-]+)\s*=/)?.[1];
-    if (key === undefined || !pending.has(key))
-      return line;
+    if (key !== undefined && remove.has(key) && !pending.has(key))
+      continue;
+    if (key === undefined || !pending.has(key)) {
+      updated.push(line);
+      continue;
+    }
     const value = pending.get(key);
     pending.delete(key);
-    return `${key}=${formatDotenvValue(value)}`;
-  });
+    updated.push(`${key}=${formatDotenvValue(value)}`);
+  }
   for (const [key, value] of pending) {
     updated.push(`${key}=${formatDotenvValue(value)}`);
   }
-  return updated.join(`
+  return updated.length === 0 ? "" : updated.join(`
 `) + `
 `;
 }
+async function managedVariables(root, values) {
+  const names = new Set;
+  for (const profile of Object.values(values.profiles)) {
+    for (const key of Object.keys(profile.defaults))
+      names.add(key);
+    for (const key of Object.keys(profile.envs))
+      names.add(key);
+  }
+  const points = await readHistoryPoints(root);
+  for (const { changes } of points) {
+    for (const { path } of changes) {
+      if (path[0] === "profiles" && (path[2] === "defaults" || path[2] === "envs") && path[3] !== undefined) {
+        names.add(path[3]);
+      }
+    }
+  }
+  return names;
+}
+async function hardenPermissions(root) {
+  if (process.platform === "win32")
+    return;
+  const dir = join2(root, ".envs");
+  const tighten = async (path, mode) => {
+    const current = await stat(path).catch(() => {
+      return;
+    });
+    if (current && (current.mode & 511 & ~mode) !== 0)
+      await chmod(path, mode).catch(() => {});
+  };
+  await tighten(dir, 448);
+  for (const file of ["values.yml", "history.ndjson", "history.key", "config.yml"])
+    await tighten(join2(dir, file), 384);
+}
+async function withLock(root, fn) {
+  const held = heldLocks.getStore();
+  if (held?.has(root))
+    return await fn();
+  const dir = join2(root, ".envs");
+  if (!await Bun.file(join2(dir, ".gitignore")).exists() && !await Bun.file(join2(dir, "values.yml")).exists()) {
+    return await fn();
+  }
+  await hardenPermissions(root);
+  const path = join2(dir, "lock");
+  const deadline = Date.now() + 30000;
+  for (;; ) {
+    try {
+      const handle = await open(path, "wx", 384);
+      await handle.writeFile(`${process.pid} ${Date.now()}
+`);
+      await handle.close();
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      const text = await Bun.file(path).text().catch(() => "");
+      const pid = Number(text.split(" ")[0]);
+      const age = Date.now() - ((await stat(path).catch(() => {
+        return;
+      }))?.mtimeMs ?? Date.now());
+      if (Number.isInteger(pid) && pid > 0 && !processAlive(pid) || age > 120000) {
+        await unlink(path).catch(() => {});
+        continue;
+      }
+      if (Date.now() > deadline) {
+        throw new LockError(`.envs/lock is held by another envs command (pid ${Number.isInteger(pid) ? pid : "unknown"}). Wait for it, or remove .envs/lock if it is not running.`);
+      }
+      await Bun.sleep(15 + Math.random() * 35);
+    }
+  }
+  try {
+    return await heldLocks.run(new Set([...held ?? [], root]), fn);
+  } finally {
+    await unlink(path).catch(() => {});
+  }
+}
 async function readValues(ctx) {
-  const path = join(await findRoot(ctx.cwd), ".envs/values.yml");
+  const path = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   if (!await Bun.file(path).exists()) {
     ctx.error(`${path} not found. Run \`envs init\` first.`);
     return;
@@ -418,9 +1006,9 @@ async function init(ctx) {
   const root = await findRoot(ctx.cwd);
   const files = { ".envs/.gitignore": `*
 `, ".envs/values.yml": SCHEMA_COMMENT };
-  await mkdir(join(root, ".envs"), { recursive: true });
+  await mkdir(join2(root, ".envs"), { recursive: true, mode: 448 });
   for (const [name, content] of Object.entries(files)) {
-    const path = join(root, name);
+    const path = join2(root, name);
     if (await Bun.file(path).exists()) {
       ctx.log(`${path} already exists`);
     } else {
@@ -428,9 +1016,90 @@ async function init(ctx) {
       ctx.log(`Created ${path}`);
     }
   }
+  await hardenPermissions(root);
   return 0;
 }
+async function readConfig(path) {
+  if (!await Bun.file(path).exists())
+    return {};
+  return Bun.YAML.parse(await Bun.file(path).text()) ?? {};
+}
+async function writeConfig(root, path, config) {
+  await mkdir(join2(root, ".envs"), { recursive: true, mode: 448 });
+  const gitignore = join2(root, ".envs/.gitignore");
+  if (!await Bun.file(gitignore).exists())
+    await Bun.write(gitignore, `*
+`);
+  const sorted = Object.fromEntries(Object.entries(config).sort(([a], [b]) => a.localeCompare(b)));
+  await Bun.write(path, Object.keys(sorted).length ? Bun.YAML.stringify(sorted, null, 2) + `
+` : "", { mode: 384 });
+  await chmod(path, 384);
+}
+async function config(ctx, args) {
+  const [action, key, ...rest] = args;
+  const root = await findRoot(ctx.cwd);
+  const path = join2(root, ".envs/config.yml");
+  const current = await readConfig(path);
+  switch (action) {
+    case "set": {
+      if (!key || rest.length === 0) {
+        ctx.error(`${CONFIG_USAGE}
+
+Missing key or value for \`config set\`.`);
+        return 1;
+      }
+      current[key] = parseValue(rest.join(" "));
+      await writeConfig(root, path, current);
+      ctx.log(`${key}=${current[key]}`);
+      return 0;
+    }
+    case "get": {
+      if (!key) {
+        for (const [k, v] of Object.entries(current))
+          ctx.log(`${k}=${v}`);
+        return 0;
+      }
+      if (!(key in current)) {
+        ctx.error(`Config key not found: ${key}`);
+        return 1;
+      }
+      ctx.log(String(current[key]));
+      return 0;
+    }
+    case "delete": {
+      if (!key) {
+        ctx.error(`${CONFIG_USAGE}
+
+Missing key for \`config delete\`.`);
+        return 1;
+      }
+      if (!(key in current)) {
+        ctx.error(`Config key not found: ${key}`);
+        return 1;
+      }
+      delete current[key];
+      await writeConfig(root, path, current);
+      ctx.log(`Deleted ${key}`);
+      return 0;
+    }
+    default:
+      ctx.error(CONFIG_USAGE);
+      return 1;
+  }
+}
 async function push(ctx, only) {
+  return await withLock(await findRoot(ctx.cwd), () => pushLocked(ctx, only));
+}
+async function pull(ctx) {
+  return await withLock(await findRoot(ctx.cwd), () => pullLocked(ctx));
+}
+async function use(ctx, profile) {
+  return await withLock(await findRoot(ctx.cwd), () => useLocked(ctx, profile));
+}
+async function restore(ctx, hash, options = {}) {
+  return await withLock(await findRoot(ctx.cwd), () => restoreLocked(ctx, hash, options));
+}
+async function pushLocked(ctx, only) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
@@ -438,52 +1107,83 @@ async function push(ctx, only) {
   const worktrees = (await listWorktrees(ctx.cwd)).filter(({ name }) => only === undefined || name === only);
   if (!checkProfiles(ctx, values, worktrees))
     return 1;
+  let safe = true;
+  for (const { name } of worktrees) {
+    const profile = values.uses[name] ?? DEFAULT_PROFILE;
+    for (const [key, value] of Object.entries(resolveEntries(values, name, profile))) {
+      const problem = dotenvProblem(key, value);
+      if (problem) {
+        safe = false;
+        ctx.error(`${JSON.stringify(key)} (${name}): ${problem}. Nothing was written.`);
+      }
+    }
+  }
+  if (!safe)
+    return 1;
+  const managed = await managedVariables(await findRoot(ctx.cwd), values);
   const changes = new Map;
+  const removals = new Map;
   for (const { name, path } of worktrees) {
     const profile = values.uses[name] ?? DEFAULT_PROFILE;
     const entries = resolveEntries(values, name, profile);
-    if (Object.keys(entries).length === 0)
-      continue;
     const label = profile === DEFAULT_PROFILE ? name : `${name} [${profile}]`;
-    const dotenv = Bun.file(join(path, ".env"));
+    const dotenv = Bun.file(join2(path, ".env"));
     const current = await dotenv.exists() ? await dotenv.text() : "";
     const existing = parseDotenv(current);
+    const orphans = new Set(Object.keys(existing).filter((key) => managed.has(key) && !(key in entries)));
+    if (Object.keys(entries).length === 0 && orphans.size === 0)
+      continue;
     for (const [key, value] of Object.entries(entries)) {
       if (existing[key] === value)
         continue;
-      const shown = isMaskedKey(key) ? MASK : formatDotenvValue(value);
+      const shown = displayValue(key, value);
       const line = `${key}=${shown}`;
       changes.set(line, [...changes.get(line) ?? [], label]);
     }
-    await Bun.write(dotenv, updateDotenv(current, entries));
+    for (const key of orphans)
+      removals.set(key, [...removals.get(key) ?? [], label]);
+    await writeFile(join2(path, ".env"), updateDotenv(current, entries, orphans), { mode: 384 });
   }
   for (const [line, names] of changes) {
     ctx.log(yellow(`\u21BB ${line} \u2192 ${names.join(", ")}`));
   }
+  for (const [key, names] of removals) {
+    ctx.log(red(`\u2715 ${key} removed from ${names.join(", ")}`));
+  }
   return 0;
 }
-async function pull(ctx) {
+async function pullLocked(ctx) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
   const values = normalizeValues(read.values);
+  const before = cloneState(values);
   const worktrees = await listWorktrees(ctx.cwd);
   materializeProfiles(values);
+  const missingDefaults = new Map;
   const pulledNames = [];
   const pulledKeys = new Set;
   for (const { name, path } of worktrees) {
     const profile = values.uses[name] ??= DEFAULT_PROFILE;
-    const dotenv = Bun.file(join(path, ".env"));
+    const dotenv = Bun.file(join2(path, ".env"));
     if (!await dotenv.exists())
       continue;
     const parsed = parseDotenv(await dotenv.text());
     pulledNames.push(name);
     for (const key of Object.keys(parsed))
       pulledKeys.add(key);
+    for (const layer of new Set([DEFAULT_PROFILE, profile])) {
+      for (const key of Object.keys(values.profiles[layer].defaults)) {
+        if (!(key in parsed))
+          missingDefaults.set(key, [...missingDefaults.get(key) ?? [], name]);
+      }
+    }
     const { envs } = values.profiles[profile];
-    for (const [key, byWorktree] of Object.entries(envs)) {
-      if (!(key in parsed))
-        delete byWorktree[name];
+    for (const layer of new Set([DEFAULT_PROFILE, profile])) {
+      for (const [key, byWorktree] of Object.entries(values.profiles[layer].envs)) {
+        if (!(key in parsed))
+          delete byWorktree[name];
+      }
     }
     const base = resolveEntries(values, name, profile, false);
     for (const [key, value] of Object.entries(parsed)) {
@@ -492,17 +1192,22 @@ async function pull(ctx) {
         if (envs[key])
           delete envs[key][name];
       } else {
-        (envs[key] ??= {})[name] = parsedValue;
+        (envs[key] ??= dict())[name] = parsedValue;
       }
     }
   }
   await Bun.write(read.path, stringifyValues(values));
+  const root = await findRoot(ctx.cwd);
+  await recordHistory(root, before, values, ctx.now, ctx.error);
+  for (const [key, names] of missingDefaults) {
+    ctx.log(yellow(`! ${key} is in the defaults but missing from the .env of ${names.join(", ")}: \`envs push\` writes it back. Remove it from the defaults to drop it from every worktree.`));
+  }
   if (pulledNames.length > 0) {
     ctx.log(green(`\u2193 pulling ${pulledNames.join(", ")} - ${pulledKeys.size} variables`));
   }
   return 0;
 }
-async function use(ctx, profile) {
+async function useLocked(ctx, profile) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
@@ -524,12 +1229,103 @@ async function use(ctx, profile) {
     ctx.error("Run `envs use` inside a git worktree.");
     return 1;
   }
+  const before = cloneState(values);
   for (const { name } of worktrees)
     values.uses[name] ??= DEFAULT_PROFILE;
   values.uses[current.name] = profile;
   await Bun.write(read.path, stringifyValues(values));
+  await recordHistory(await findRoot(ctx.cwd), before, values, ctx.now, ctx.error);
   return await push(ctx, current.name);
 }
+async function scanHistory(root) {
+  const file = Bun.file(join2(root, ".envs/history.ndjson"));
+  const scan = { points: [], damaged: [], torn: false, complete: "", endsWithNewline: true, broken: [] };
+  if (!await file.exists())
+    return scan;
+  const text = await file.text();
+  scan.endsWithNewline = text === "" || text.endsWith(`
+`);
+  scan.complete = text.slice(0, text.lastIndexOf(`
+`) + 1);
+  const lines = text.split(`
+`);
+  lines.forEach((line, i) => {
+    if (line.trim() === "")
+      return;
+    let value;
+    try {
+      value = JSON.parse(line);
+    } catch {
+      value = undefined;
+    }
+    if (isHistoryPoint(value))
+      scan.points.push(value);
+    else if (i === lines.length - 1 && !scan.endsWithNewline)
+      scan.torn = true;
+    else
+      scan.damaged.push(i + 1);
+  });
+  scan.broken = verifyChain(scan.points);
+  return scan;
+}
+function verifyChain(points) {
+  const broken = [];
+  let previous = null;
+  for (const point of points) {
+    if (hashOf(point) !== point.hash)
+      broken.push({ hash: point.hash, reason: "content" });
+    else if (point.prev !== previous)
+      broken.push({ hash: point.hash, reason: "prev" });
+    previous = point.hash;
+  }
+  return broken;
+}
+async function readHistoryPoints(root) {
+  return (await scanHistory(root)).points;
+}
+async function restoreLocked(ctx, hash, options = {}) {
+  if (!hash) {
+    ctx.error("Usage: envs restore <hash> [--force]");
+    return 1;
+  }
+  const read = await readValues(ctx);
+  if (!read)
+    return 1;
+  const root = await findRoot(ctx.cwd);
+  if (!await historyEnabled(root)) {
+    ctx.error("The history is off, so a restore would not be recorded. Run `envs config set history true` first.");
+    return 1;
+  }
+  const scan = await scanHistory(root);
+  if (scan.damaged.length > 0) {
+    ctx.error(`.envs/history.ndjson has damaged lines (${scan.damaged.join(", ")}), so the state of a point cannot be rebuilt exactly. Repair or remove those lines and try again.`);
+    return 1;
+  }
+  if (scan.broken.length > 0) {
+    const message = `.envs/history.ndjson: the hash chain is broken at ${describeBroken(scan.broken)}. The history may have been altered, so the state of a point cannot be trusted.`;
+    if (!options.force) {
+      ctx.error(`${message} Check the file, or run \`envs restore ${hash} --force\` to restore anyway.`);
+      return 1;
+    }
+    ctx.error(`${message} Restoring anyway (--force).`);
+  }
+  const points = scan.points;
+  const found = findHistoryPoint(points, hash);
+  if ("error" in found) {
+    ctx.error(found.error === "none" ? `No history point matches "${hash}". Run \`envs restore\` with a hash from .envs/history.ndjson.` : `"${hash}" matches ${found.matches} history points; use more characters.`);
+    return 1;
+  }
+  const target = found.point;
+  const restored = stateAfter(points, target);
+  const current = normalizeValues(read.values);
+  const notes = unredact(restored, current, (await redactor(root)).mark);
+  await Bun.write(read.path, stringifyValues(restored));
+  for (const note of notes)
+    ctx.log(yellow(`! ${note}`));
+  const added = await recordHistory(root, current, restored, ctx.now, ctx.error);
+  ctx.log(added ? green(`\u21BA restored ${target.hash} - new history point ${added}`) : `Already at ${target.hash}: nothing to restore`);
+  return await push(ctx);
+}
 async function isIgnored(dir, file) {
   const result = await $`git check-ignore -q ${file}`.cwd(dir).nothrow().quiet();
   return result.exitCode === 0;
@@ -547,15 +1343,20 @@ async function lint(ctx) {
   const modeOf = async (path) => process.platform === "win32" ? undefined : (await stat(path)).mode;
   const dotenvs = [];
   for (const worktree of worktrees) {
-    const path = join(worktree.path, ".env");
+    const path = join2(worktree.path, ".env");
     if (await Bun.file(path).exists()) {
       dotenvs.push({ ...worktree, mode: await modeOf(path) });
     }
   }
+  const historyPath = join2(root, ".envs/history.ndjson");
+  const hasHistory = await Bun.file(historyPath).exists();
   const lintContext = {
     values: read.values,
     root,
     valuesMode: await modeOf(read.path),
+    hasHistory,
+    historyMode: hasHistory ? await modeOf(historyPath) : undefined,
+    worktrees: worktrees.map(({ name }) => name),
     dotenvs,
     isTracked,
     isIgnored
@@ -575,39 +1376,128 @@ async function lint(ctx) {
 ${count} warning(s) found.`);
   return 1;
 }
-async function edit(ctx) {
-  const valuesPath = join(await findRoot(ctx.cwd), ".envs/values.yml");
+async function edit(ctx, options = {}) {
+  const valuesPath = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   if (!await Bun.file(valuesPath).exists())
     await init(ctx);
   const pulled = await pull(ctx);
   if (pulled !== 0)
     return pulled;
+  if (options.ui) {
+    await Promise.resolve().then(() => init_server());
+    return await serveUi(ctx);
+  }
   const original = await Bun.file(valuesPath).text();
+  const before = normalizeValues(Bun.YAML.parse(original) ?? {});
   await Bun.write(valuesPath, EDIT_NOTICE + original);
   const code = await ctx.openEditor(valuesPath);
   const edited = await Bun.file(valuesPath).text();
+  if (code !== 0) {
+    await Bun.write(valuesPath, original);
+    return code;
+  }
   if (edited.startsWith(EDIT_NOTICE)) {
     await Bun.write(valuesPath, edited.slice(EDIT_NOTICE.length));
   }
-  if (code !== 0)
-    return code;
-  const raw = Bun.YAML.parse(await Bun.file(valuesPath).text()) ?? {};
-  const values = normalizeValues(raw);
-  const created = materializeProfiles(values);
-  if (created.length > 0 || !hasCompleteProfiles(raw)) {
-    await Bun.write(valuesPath, stringifyValues(values));
+  return await withLock(await findRoot(ctx.cwd), async () => {
+    const raw = Bun.YAML.parse(await Bun.file(valuesPath).text()) ?? {};
+    const values = normalizeValues(raw);
+    const created = materializeProfiles(values);
+    if (created.length > 0 || !hasCompleteProfiles(raw)) {
+      await Bun.write(valuesPath, stringifyValues(values));
+    }
+    if (created.length > 0) {
+      ctx.log(green(`+ created ${created.join(", ")} from ${DEFAULT_PROFILE}`));
+    }
+    await recordHistory(await findRoot(ctx.cwd), before, values, ctx.now, ctx.error);
+    return await push(ctx);
+  });
+}
+async function loadUiState(ctx) {
+  const read = await readValues(ctx);
+  if (!read)
+    throw new Error("Run `envs init` first.");
+  const [main, ...others] = (await listWorktrees(ctx.cwd)).map(({ name }) => name);
+  others.sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
+  const worktrees = main === undefined ? [] : [main, ...others];
+  return { ...normalizeValues(read.values), worktrees, version: valuesVersion(await Bun.file(read.path).text()) };
+}
+async function loadUiHistory(ctx) {
+  const root = await findRoot(ctx.cwd);
+  const enabled = await historyEnabled(root);
+  if (!enabled)
+    return { enabled, points: [] };
+  const { points, damaged, broken } = await scanHistory(root);
+  return {
+    enabled,
+    points,
+    ...damaged.length > 0 && { damaged },
+    ...broken.length > 0 && { broken: broken.map(({ hash }) => hash) }
+  };
+}
+async function saveUiState(ctx, input, options = {}) {
+  return await withLock(await findRoot(ctx.cwd), () => saveUiStateLocked(ctx, input, options));
+}
+async function saveUiStateLocked(ctx, input, options = {}) {
+  const root = await findRoot(ctx.cwd);
+  const path = join2(root, ".envs/values.yml");
+  const currentText = await Bun.file(path).exists() ? await Bun.file(path).text() : "";
+  if (options.base !== undefined && options.base !== valuesVersion(currentText)) {
+    ctx.error("values.yml changed after the editor was loaded (another command or editor saved it). Reload the editor and apply your changes again; nothing was saved.");
+    return { created: [], code: 1, conflict: true };
   }
-  if (created.length > 0) {
-    ctx.log(green(`+ created ${created.join(", ")} from ${DEFAULT_PROFILE}`));
+  const before = normalizeValues(Bun.YAML.parse(currentText) ?? {});
+  const values = normalizeValues({ uses: input.uses, profiles: input.profiles });
+  const typed = (value, previous) => typeof value !== "string" ? value : previous !== undefined && String(previous) === value ? previous : parseValue(value);
+  for (const [name, profile] of Object.entries(values.profiles)) {
+    const old = Object.hasOwn(before.profiles, name) ? before.profiles[name] : undefined;
+    for (const [key, value] of Object.entries(profile.defaults)) {
+      profile.defaults[key] = typed(value, old && Object.hasOwn(old.defaults, key) ? old.defaults[key] : undefined);
+    }
+    for (const [key, byWorktree] of Object.entries(profile.envs)) {
+      const oldByWorktree = old && Object.hasOwn(old.envs, key) ? old.envs[key] : undefined;
+      for (const [worktree, value] of Object.entries(byWorktree)) {
+        byWorktree[worktree] = typed(value, oldByWorktree && Object.hasOwn(oldByWorktree, worktree) ? oldByWorktree[worktree] : undefined);
+      }
+    }
   }
-  return await push(ctx);
+  let safe = true;
+  for (const [profileName, profile] of Object.entries(values.profiles)) {
+    const check = (key, value, where) => {
+      const problem = dotenvProblem(key, String(value));
+      if (!problem)
+        return;
+      safe = false;
+      ctx.error(`${JSON.stringify(key)} (${where}): ${problem}. Nothing was saved.`);
+    };
+    for (const [key, value] of Object.entries(profile.defaults))
+      check(key, value, `${profileName} defaults`);
+    for (const [key, byWorktree] of Object.entries(profile.envs)) {
+      for (const [worktree, value] of Object.entries(byWorktree))
+        check(key, value, `${profileName} ${worktree}`);
+    }
+  }
+  if (!safe)
+    return { created: [], code: 1 };
+  const created = materializeProfiles(values);
+  await Bun.write(path, stringifyValues(values));
+  await recordHistory(root, before, values, ctx.now, ctx.error);
+  return { created, code: await push(ctx) };
+}
+function valuesVersion(text) {
+  return createHash("sha256").update(text).digest("hex").slice(0, 12);
 }
-var EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-# Close this file when your changes are ready, then they are pushed.
-# To cancel the edit, press Ctrl+C in the terminal and then close this file.
-# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-`;
 async function run(args, ctx = defaultContext()) {
+  try {
+    return await dispatch(args, ctx);
+  } catch (error) {
+    if (!(error instanceof LockError))
+      throw error;
+    ctx.error(error.message);
+    return 1;
+  }
+}
+async function dispatch(args, ctx) {
   const [command = "help"] = args;
   switch (command) {
     case "help":
@@ -624,9 +1514,15 @@ async function run(args, ctx = defaultContext()) {
     case "lint":
       return await lint(ctx);
     case "edit":
-      return await edit(ctx);
+      return await edit(ctx, { ui: args.includes("--ui") });
     case "use":
       return await use(ctx, args[1]);
+    case "history":
+      return await historyCommand(ctx, args.slice(1));
+    case "restore":
+      return await restore(ctx, args.slice(1).find((arg) => !arg.startsWith("--")), { force: args.includes("--force") });
+    case "config":
+      return await config(ctx, args.slice(1));
     default:
       ctx.error(`Unknown command: ${command}
 
@@ -634,6 +1530,68 @@ ${HELP}`);
       return 1;
   }
 }
+var HELP = `Usage: envs <command>
+
+Commands:
+  init    Create the .envs/ directory (.gitignore, values.yml)
+  pull    Read each worktree's .env and write it into .envs/values.yml
+  push    Write defaults and .envs/values.yml into the .env of each worktree
+  lint    Warn about insecure values and unprotected secret files
+  edit    Pull, open .envs/values.yml in VS Code (code -w), then push
+          With --ui, serve a web editor instead; its Save button pushes
+  use     Select the profile of the current worktree (envs use <profile>), or list them
+  restore Restore values.yml to the state after a history point (envs restore <hash> [--force]), adding a new point
+  history Manage the history (history redact: remove secrets in clear from an existing history)
+  config  Read or change .envs/config.yml (config set <key> <value>, config get [key], config delete <key>)
+  help    Show this help message
+`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), URL_SECRET, hasUrlSecret = (value) => URL_SECRET.test(value) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value) && sensitiveQuery(value), sensitiveQuery = (value) => [...value.matchAll(/[?&]([^=&\s#]+)=([^&\s#]*)/g)].some(([, name]) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_"))), maskUrlSecrets = (value) => value.replace(URL_SECRET, `$1${MASK}$3`).replace(/([?&])([^=&\s#]+)=([^&\s#]*)/g, (all, sep, name) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_")) ? `${sep}${name}=${MASK}` : all), isSecretEntry = (name, value) => isMaskedKey(name) || hasUrlSecret(value), displayValue = (name, value) => isMaskedKey(name) ? MASK : formatDotenvValue(maskUrlSecrets(value)), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), red = (text) => paint(31, text), defaultContext = () => ({
+  cwd: process.cwd(),
+  log: (message) => console.log(message),
+  error: (message) => console.error(message),
+  openEditor: async (path) => {
+    const proc = Bun.spawn(["code", "-w", path], {
+      env: { ...process.env },
+      stdio: ["inherit", "inherit", "inherit"]
+    });
+    return await proc.exited;
+  },
+  openUrl: async (url) => {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    try {
+      await Bun.spawn([opener, url], { stdio: ["ignore", "ignore", "ignore"] }).exited;
+    } catch {}
+  },
+  waitForExit: () => new Promise((resolve) => {
+    process.once("SIGINT", () => resolve());
+    process.once("SIGTERM", () => resolve());
+  })
+}), hasProfile = (values, name) => Object.hasOwn(values.profiles, name), hasCompleteProfiles = (raw) => Object.values(raw.profiles ?? {}).every((profile) => typeof profile?.defaults === "object" && profile.defaults !== null && typeof profile.envs === "object" && profile.envs !== null), SCHEMA_COMMENT = `# yaml-language-server: $schema=https://jondotsoy.github.io/envs/schema.json
+`, LockError, heldLocks, processAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}, CONFIG_USAGE = `Usage: envs config <set <key> <value> | get [key] | delete <key>>`, isHistoryPoint = (value) => {
+  const point = value;
+  return typeof point === "object" && point !== null && typeof point.hash === "string" && (typeof point.prev === "string" || point.prev === null) && typeof point.timestamp === "string" && Array.isArray(point.changes);
+}, hashOf = (point) => {
+  const { hash: _, ...rest } = point;
+  return createHash("sha256").update(JSON.stringify(rest)).digest("hex").slice(0, 12);
+}, describeBroken = (broken) => broken.map(({ hash, reason }) => `${hash} (${reason === "content" ? "its content does not match its hash" : "it does not follow the previous point"})`).join(", "), EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Close this file when your changes are ready, then they are pushed.
+# To cancel the edit, press Ctrl+C in the terminal and then close this file.
+# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`;
+var init_envs = __esm(() => {
+  init_lint_rules();
+  URL_SECRET = /^([a-z][a-z0-9+.-]*:\/\/[^\/\s:@]*:)([^@\/\s]+)(@)/i;
+  LockError = class LockError extends Error {
+  };
+  heldLocks = new AsyncLocalStorage;
+});
 
 // src/bin/envs.ts
+init_envs();
 process.exit(await run(Bun.argv.slice(2)));