@stacksjs/defaults 0.75.62 → 0.75.63

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.62",
+  "version": "0.75.63",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.62",
+  "version": "0.75.63",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "^0.75.62",
+    "@stacksjs/mobile": "^0.75.63",
     "@stacksjs/sanitizer": "^0.2.348",
     "ts-qr-codes": "^0.1.8"
   }

package/ide/vscode/build.ts

@@ -1,52 +0,0 @@
-/**
- * Builds the extension into dist/:
- *
- *   extension.js                the extension, for VS Code's Node host; only `vscode` is external
- *   pickier-worker.js           the Bun process that runs the project's pickier (src/pickier-worker.ts)
- *   pickier-worker.bunfig.toml  an empty bunfig, so the worker skips the project's preloads
- *   stx/                        grammar, language configuration and snippets from @stacksjs/stx-vscode
- *   stx-typescript-plugin/      the stx TypeScript server plugin from @stacksjs/stx-vscode
- *
- * `vsce package` runs this first (`vscode:prepublish`), and `files` in
- * package.json ships exactly these. tsserver loads the plugin from
- * node_modules, so a forwarder to it is written there as well, which is what
- * a development host (`--extensionDevelopmentPath`) loads; scripts/package.ts
- * adds the same forwarder to the VSIX (see scripts/ts-plugin.ts).
- */
-import { cpSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import process from 'node:process'
-import { copyTsPlugin, tsPluginName, writeTsPluginForwarder } from './scripts/ts-plugin'
-
-const here = import.meta.dir
-const dist = join(here, 'dist')
-
-rmSync(dist, { recursive: true, force: true })
-mkdirSync(dist, { recursive: true })
-
-const builds = await Promise.all([
-  // bunfig stays out: the stx utility-class engine imports it only to load a
-  // config file, which the extension never asks for, and its module-scope
-  // `await` and `import.meta.require` would make the CommonJS bundle a syntax
-  // error in VS Code's Node host. tests/build.test.ts parses the bundle.
-  Bun.build({ entrypoints: [join(here, 'src/extension.ts')], outdir: dist, target: 'node', format: 'cjs', external: ['vscode', 'bunfig'], minify: true }),
-  Bun.build({ entrypoints: [join(here, 'src/pickier-worker.ts')], outdir: dist, target: 'bun', format: 'esm' }),
-])
-
-for (const build of builds) {
-  if (!build.success) {
-    console.error(build.logs)
-    process.exit(1)
-  }
-}
-
-writeFileSync(join(dist, 'pickier-worker.bunfig.toml'), '# Intentionally empty: the pickier worker must not run the project\'s bunfig preloads.\n')
-
-const stxAssets = join(dirname(Bun.resolveSync('@stacksjs/stx-vscode/contributes.json', here)), 'assets')
-cpSync(stxAssets, join(dist, 'stx'), { recursive: true })
-
-copyTsPlugin(here)
-const { version } = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'))
-writeTsPluginForwarder(here, tsPluginName(here), version)
-
-console.log('Built dist/')

package/ide/vscode/scripts/package.ts

@@ -1,71 +0,0 @@
-/**
- * Package (and with `--publish`, publish) the extension.
- *
- *   bun scripts/package.ts [--out <file.vsix>] [--publish]
- *
- * `vsce package --no-dependencies` keeps the VSIX to what `files` lists, and it
- * leaves out everything under node_modules - including the one package the
- * extension needs there: the stx TypeScript server plugin, which tsserver will
- * only load by package name from `<extension>/node_modules` (see ts-plugin.ts).
- * So its forwarder is added to the VSIX after vsce writes it, and a publish
- * uploads that VSIX rather than letting vsce package a second time.
- */
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join, resolve } from 'node:path'
-import process from 'node:process'
-import { TS_PLUGIN_DIST, tsPluginModuleDir, tsPluginName, writeTsPluginForwarder } from './ts-plugin'
-
-const ROOT = join(import.meta.dir, '..')
-
-function run(command: string[], cwd = ROOT, capture = false): string {
-  const result = Bun.spawnSync(command, { cwd, stdout: capture ? 'pipe' : 'inherit', stderr: 'inherit', env: process.env })
-  if (result.exitCode !== 0)
-    throw new Error(`${command.join(' ')} exited with ${result.exitCode}`)
-  return capture ? String(result.stdout ?? '') : ''
-}
-
-/** Build the VSIX at `out`, with the TypeScript plugin's forwarder in it. */
-export function packageExtension(out: string): string {
-  const manifest = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
-  const name = tsPluginName(ROOT)
-
-  // vsce runs `vscode:prepublish` (the build) first.
-  run(['bun', 'x', '--bun', 'vsce', 'package', '--no-dependencies', '--out', out])
-
-  // A staging tree whose layout is the VSIX's, so zip records the paths VS
-  // Code extracts: extension/node_modules/<package>/...
-  const stage = mkdtempSync(join(tmpdir(), 'stacks-vsix-'))
-  try {
-    writeTsPluginForwarder(join(stage, 'extension'), name, manifest.version)
-    run(['zip', '-q', '-r', '-X', '-D', out, `extension/${tsPluginModuleDir(name)}`], stage)
-  }
-  finally {
-    rmSync(stage, { recursive: true, force: true })
-  }
-
-  const listing = run(['unzip', '-Z1', out], ROOT, true).split('\n')
-  for (const file of [`extension/${tsPluginModuleDir(name)}/index.js`, `extension/${TS_PLUGIN_DIST}/index.js`, `extension/${TS_PLUGIN_DIST}/typescript-stx-plugin.js`]) {
-    if (!listing.includes(file))
-      throw new Error(`${out} is missing ${file}`)
-  }
-
-  return out
-}
-
-if (import.meta.main) {
-  const args = process.argv.slice(2)
-  const outFlag = args.indexOf('--out')
-  const manifest = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
-  const out = resolve(outFlag === -1 ? join(ROOT, `${manifest.name}-${manifest.version}.vsix`) : args[outFlag + 1]!)
-
-  packageExtension(out)
-  console.log(`Packaged ${out}`)
-
-  if (args.includes('--publish')) {
-    if (!existsSync(out))
-      throw new Error(`${out} was not written`)
-    run(['bun', 'x', '--bun', 'vsce', 'publish', '--packagePath', out])
-    console.log(`Published ${manifest.publisher}.${manifest.name}@${manifest.version}`)
-  }
-}

package/ide/vscode/scripts/stx-contributes.ts

@@ -1,78 +0,0 @@
-/**
- * Keeps the stx half of package.json's `contributes` equal to what
- * `@stacksjs/stx-vscode` ships.
- *
- * VS Code reads languages, grammars, commands and settings only from the
- * manifest, so the built-in stx support needs them declared here, pointing at
- * dist/stx/ (copied there by build.ts). The library describes them in
- * `contributes.json`; this derives the manifest from it rather than keeping a
- * second copy by hand. That includes the TypeScript server plugin entry, which
- * type-checks `.stx` files (see ts-plugin.ts). Snippets are left out on purpose: the extension offers
- * them as completions only when the stx extension is not installed, because
- * a manifest entry would show every snippet twice next to it.
- *
- *   bun scripts/stx-contributes.ts --write   update package.json (`bun run sync:stx`)
- *
- * tests/manifest.test.ts fails while the two disagree.
- */
-import { readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-import process from 'node:process'
-
-export interface StxContributes {
-  languages: Array<Record<string, unknown> & { id: string, configuration: string }>
-  grammars: Array<Record<string, unknown> & { language: string, path: string }>
-  commands: Array<{ command: string, title: string, category?: string }>
-  configuration: { title: string, properties: Record<string, unknown> }
-  typescriptServerPlugins: Array<Record<string, unknown> & { name: string, languages?: string[] }>
-}
-
-const STX_DIR = './dist/stx/'
-
-function fromStx(path: string): string {
-  return STX_DIR + path.replace(/^\.\//, '')
-}
-
-/** The namespace of the extension's own commands; every other one is stx's. */
-export const OWN_COMMAND_PREFIX = 'stacks.'
-
-/**
- * `manifest` with its stx contributions replaced by the library's.
- *
- * Commands are told apart by namespace, not by the library's current list: a
- * command stx renamed or dropped is no longer in that list, and filtering by
- * it kept the old entry as if it were this extension's own (`css.reload`
- * outlived its rename to `stx.reloadUtilityClasses` that way).
- */
-export function withStxContributes(manifest: any, stx: StxContributes): any {
-  const contributes = manifest.contributes
-  const sections: Array<{ title: string }> = Array.isArray(contributes.configuration) ? contributes.configuration : [contributes.configuration]
-
-  return {
-    ...manifest,
-    contributes: {
-      ...contributes,
-      languages: stx.languages.map(language => ({ ...language, configuration: fromStx(language.configuration) })),
-      grammars: stx.grammars.map(grammar => ({ ...grammar, path: fromStx(grammar.path) })),
-      commands: [...contributes.commands.filter((command: { command: string }) => command.command.startsWith(OWN_COMMAND_PREFIX)), ...stx.commands],
-      configuration: [...sections.filter(section => section.title !== stx.configuration.title), stx.configuration],
-      typescriptServerPlugins: stx.typescriptServerPlugins,
-    },
-  }
-}
-
-export function libraryContributes(root: string): StxContributes {
-  return JSON.parse(readFileSync(Bun.resolveSync('@stacksjs/stx-vscode/contributes.json', root), 'utf8'))
-}
-
-if (import.meta.main) {
-  const root = join(import.meta.dir, '..')
-  const path = join(root, 'package.json')
-  const manifest = JSON.parse(readFileSync(path, 'utf8'))
-  const next = `${JSON.stringify(withStxContributes(manifest, libraryContributes(root)), null, 2)}\n`
-
-  if (process.argv.includes('--write'))
-    writeFileSync(path, next)
-  else
-    process.stdout.write(next)
-}

package/ide/vscode/scripts/ts-plugin.ts

@@ -1,72 +0,0 @@
-/**
- * The stx TypeScript server plugin, as this extension ships it.
- *
- * It is what type-checks the TypeScript in `.stx` files (script blocks and
- * template expressions) in the editor. `@stacksjs/stx-vscode` publishes it as a
- * complete package, `dist/typescript-plugin/`, and its `contributes.json`
- * carries the `typescriptServerPlugins` entry that `bun run sync:stx` copies
- * into package.json.
- *
- * tsserver loads a plugin only by package name, resolved from
- * `<extension>/node_modules`, the probe location VS Code passes for every
- * extension that contributes one. This extension is packaged with
- * `vsce --no-dependencies`, which leaves node_modules out of the VSIX, so:
- *
- *   dist/stx-typescript-plugin/            the package itself, copied by build.ts
- *                                          (shipped through `files`, like the rest of dist/)
- *   node_modules/<name>/{package.json,index.js}
- *                                          a forwarder to it, written by build.ts for
- *                                          a development host and added to the VSIX
- *                                          by scripts/package.ts after vsce writes it
- *
- * The stx extension (Stacks.vscode-stx) contributes the same plugin under the
- * same name. With both installed tsserver loads it twice, and the plugin
- * decorates each project only the first time (stacksjs/stx#2028).
- */
-import { cpSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { libraryContributes } from './stx-contributes'
-
-/** Where build.ts puts the plugin package, relative to the extension root. */
-export const TS_PLUGIN_DIST = 'dist/stx-typescript-plugin'
-
-/** The name the plugin is contributed and configured under. */
-export function tsPluginName(root: string): string {
-  const [plugin] = libraryContributes(root).typescriptServerPlugins
-  if (!plugin)
-    throw new Error('@stacksjs/stx-vscode contributes no TypeScript server plugin')
-  return plugin.name
-}
-
-/** Where tsserver resolves the plugin from, relative to the extension root. */
-export function tsPluginModuleDir(name: string): string {
-  return `node_modules/${name}`
-}
-
-/** The forwarder's files, relative to its directory under node_modules. */
-export function tsPluginForwarder(name: string, version: string): Record<string, string> {
-  const up = '../'.repeat(1 + name.split('/').length)
-  return {
-    'package.json': `${JSON.stringify({ name, version, private: true, main: 'index.js' }, null, 2)}\n`,
-    // tsserver calls `module.exports` as the factory, unwrapped.
-    'index.js': `module.exports = require('${up}${TS_PLUGIN_DIST}/index.js')\n`,
-  }
-}
-
-/** Write the forwarder under `<root>/node_modules`, returning its directory. */
-export function writeTsPluginForwarder(root: string, name: string, version: string): string {
-  const dir = join(root, tsPluginModuleDir(name))
-  mkdirSync(dir, { recursive: true })
-  for (const [file, content] of Object.entries(tsPluginForwarder(name, version)))
-    writeFileSync(join(dir, file), content)
-  return dir
-}
-
-/** Copy the plugin package from `@stacksjs/stx-vscode` into `<root>/dist`. */
-export function copyTsPlugin(root: string): string {
-  const source = dirname(Bun.resolveSync('@stacksjs/stx-vscode/typescript-plugin/package.json', root))
-  const target = join(root, TS_PLUGIN_DIST)
-  rmSync(target, { recursive: true, force: true })
-  cpSync(source, target, { recursive: true })
-  return target
-}

package/ide/vscode/src/env-file.ts

@@ -1,103 +0,0 @@
-/**
- * Env files, read the way Stacks reads them - the pure half of ./env.ts.
- *
- * Decryption and key lookup are not reimplemented here: they are
- * `@stacksjs/env`'s own (core/env/src), bundled into the extension, so a value
- * the hover decrypts is exactly what `./buddy env:get` prints.
- */
-import { basename } from 'node:path'
-import { envPrivateKeyNames } from '../../../../core/env/src/cli'
-import { decryptValue } from '../../../../core/env/src/crypto'
-import { parseEnvFile } from './project'
-
-/** `.env`, `.env.local`, `.env.production`, ... - not `.env.keys`, which holds the private keys themselves. */
-export function isEnvFile(path: string): boolean {
-  const name = basename(path)
-  return /^\.env(?:\..+)?$/.test(name) && name !== '.env.keys'
-}
-
-export function isEncrypted(value: string): boolean {
-  return value.startsWith('encrypted:')
-}
-
-export interface EnvEntry {
-  key: string
-  value: string
-  /** Character offsets of the value on its line, quotes excluded. */
-  start: number
-  end: number
-}
-
-/** The `KEY=value` on one line, with where its value sits, by `parseEnvFile`'s rules. */
-export function envEntryAt(line: string): EnvEntry | undefined {
-  const match = line.match(/^(\s*(?:export\s+)?([A-Z_a-z][\w.-]*)\s*=\s*)(.*)$/)
-  if (!match)
-    return undefined
-
-  const key = match[2] as string
-  const value = parseEnvFile(line)[key]
-  if (value === undefined)
-    return undefined
-
-  const rest = match[3] as string
-  const quoted = rest[0] === '"' || rest[0] === '\'' || rest[0] === '`'
-  const start = (match[1] as string).length + (quoted ? 1 : 0)
-  return { key, value, start, end: start + value.length }
-}
-
-/** Keys `.env.example` declares that the env file does not set, in example order. */
-export function missingKeys(example: string, actual: string): string[] {
-  const present = parseEnvFile(actual)
-  return Object.keys(parseEnvFile(example)).filter(key => !(key in present))
-}
-
-export interface PrivateKey {
-  name: string
-  key: string
-  from: '.env.keys' | 'environment'
-}
-
-/**
- * The private key for an env file, looked up as `./buddy env:get` does:
- * `envPrivateKeyNames` (`DOTENV_PRIVATE_KEY_<ENV>`, then `DOTENV_PRIVATE_KEY`)
- * in `.env.keys`, then in the environment, the dotenvx convention for CI and
- * servers where `.env.keys` must not exist.
- */
-export function findPrivateKey(envFile: string, keysFile: string | undefined, environment: Record<string, string | undefined>): PrivateKey | undefined {
-  const names = envPrivateKeyNames(basename(envFile))
-  const keys = keysFile === undefined ? {} : parseEnvFile(keysFile)
-
-  for (const name of names) {
-    if (keys[name])
-      return { name, key: keys[name] as string, from: '.env.keys' }
-  }
-  for (const name of names) {
-    if (environment[name])
-      return { name, key: environment[name] as string, from: 'environment' }
-  }
-  return undefined
-}
-
-export type Decryption =
-  | { ok: true, value: string, key: PrivateKey }
-  | { ok: false, reason: 'no-key', looked: string[] }
-  | { ok: false, reason: 'failed', key: PrivateKey }
-
-/** Decrypt one value in memory. The result is never cached or written anywhere. */
-export function decryptEnvValue(
-  envFile: string,
-  value: string,
-  keysFile: string | undefined,
-  environment: Record<string, string | undefined>,
-): Decryption {
-  const key = findPrivateKey(envFile, keysFile, environment)
-  if (!key)
-    return { ok: false, reason: 'no-key', looked: envPrivateKeyNames(basename(envFile)) }
-
-  try {
-    return { ok: true, value: decryptValue(value, key.key), key }
-  }
-  catch {
-    return { ok: false, reason: 'failed', key }
-  }
-}

package/ide/vscode/src/env.ts

@@ -1,241 +0,0 @@
-/**
- * Stacks env files, built in: decrypted values on hover, keys missing against
- * `.env.example`, and the `buddy env:*` commands from the Command Palette.
- *
- * Plaintext only ever exists in memory and on screen. The hover decrypts with
- * `@stacksjs/env`'s own code (./env-file.ts) and nothing is cached, logged or
- * written; the commands run the project's `./buddy` directly (no shell, so a
- * value typed for `env:set` does not land in shell history).
- */
-import type * as vscode from 'vscode'
-import { basename, dirname, join, relative } from 'node:path'
-import { decryptEnvValue, envEntryAt, isEncrypted, isEnvFile, missingKeys } from './env-file'
-
-type Vscode = typeof vscode
-
-export interface EnvHost {
-  exists: (path: string) => boolean
-  read: (path: string) => string | undefined
-  exec: (file: string, args: string[], cwd: string) => Promise<string>
-  environment: Record<string, string | undefined>
-}
-
-export const ENV_COMMANDS = {
-  get: 'stacks.env.get',
-  set: 'stacks.env.set',
-  encrypt: 'stacks.env.encrypt',
-  decrypt: 'stacks.env.decrypt',
-  rotate: 'stacks.env.rotate',
-} as const
-
-function isProject(host: EnvHost, folder: string): boolean {
-  return host.exists(join(folder, 'buddy')) || host.exists(join(folder, 'config', 'app.ts'))
-}
-
-/**
- * The `.env.keys` for an env file: beside it, else at the project root, where
- * `./buddy env:*` looks for it.
- */
-export function keysFileFor(host: EnvHost, envFile: string, root: string | undefined): string | undefined {
-  for (const dir of [dirname(envFile), root]) {
-    if (!dir)
-      continue
-    const source = host.read(join(dir, '.env.keys'))
-    if (source !== undefined)
-      return source
-  }
-  return undefined
-}
-
-/**
- * A decryptor for `loadProjectEnv`, so the preview can read an encrypted
- * `APP_URL` or `PORT` with the same keys the hover uses.
- */
-export function projectDecryptor(host: EnvHost, root: string): (file: string, value: string) => string | undefined {
-  return (file, value) => {
-    const path = join(root, file)
-    const result = decryptEnvValue(path, value, keysFileFor(host, path, root), host.environment)
-    return result.ok ? result.value : undefined
-  }
-}
-
-export function createEnvSupport(api: Vscode, host: EnvHost): {
-  activate: (context: { subscriptions: Array<{ dispose: () => unknown }> }) => void
-} {
-  const diagnostics = api.languages.createDiagnosticCollection('stacks-env')
-  const settings = () => api.workspace.getConfiguration('stacks')
-
-  function rootFor(uri: vscode.Uri): string | undefined {
-    const folder = api.workspace.getWorkspaceFolder(uri)?.uri.fsPath
-    return folder && isProject(host, folder) ? folder : undefined
-  }
-
-  function projectRoot(): string | undefined {
-    const active = api.window.activeTextEditor?.document.uri
-    const fromActive = active ? rootFor(active) : undefined
-    if (fromActive)
-      return fromActive
-    return (api.workspace.workspaceFolders ?? []).map(folder => folder.uri.fsPath).find(folder => isProject(host, folder))
-  }
-
-  const hover: vscode.HoverProvider = {
-    provideHover(document, position) {
-      if (!isEnvFile(document.uri.fsPath) || !settings().get<boolean>('env.decryptOnHover', true))
-        return undefined
-
-      const entry = envEntryAt(document.lineAt(position.line).text)
-      if (!entry || !isEncrypted(entry.value) || position.character < entry.start - 1 || position.character > entry.end + 1)
-        return undefined
-
-      const root = rootFor(document.uri)
-      const result = decryptEnvValue(document.uri.fsPath, entry.value, keysFileFor(host, document.uri.fsPath, root), host.environment)
-      const markdown = new api.MarkdownString()
-      const range = new api.Range(position.line, entry.start, position.line, entry.end)
-
-      if (result.ok) {
-        markdown.appendMarkdown(`**${entry.key}**, decrypted with \`${result.key.name}\` from ${result.key.from === '.env.keys' ? '`.env.keys`' : 'the environment'}:`)
-        markdown.appendCodeblock(result.value, 'text')
-      }
-      else if (result.reason === 'no-key') {
-        markdown.appendMarkdown(`**${entry.key}** is encrypted. No private key to decrypt it: looked for ${result.looked.map(name => `\`${name}\``).join(' and ')} in \`.env.keys\` and the environment.`)
-      }
-      else {
-        markdown.appendMarkdown(`**${entry.key}** did not decrypt with \`${result.key.name}\`. The value or the key is wrong, or it was encrypted for another key.`)
-      }
-
-      return new api.Hover(markdown, range)
-    },
-  }
-
-  function checkMissingKeys(document: vscode.TextDocument): void {
-    const path = document.uri.fsPath
-    if (basename(path) === '.env.example') {
-      const env = api.workspace.textDocuments.find(open => open.uri.fsPath === join(dirname(path), '.env'))
-      if (env)
-        checkMissingKeys(env)
-      return
-    }
-
-    if (basename(path) !== '.env' || !settings().get<boolean>('env.missingKeys', true)) {
-      diagnostics.delete(document.uri)
-      return
-    }
-
-    const example = host.read(join(dirname(path), '.env.example'))
-    if (example === undefined) {
-      diagnostics.delete(document.uri)
-      return
-    }
-
-    const top = new api.Range(0, 0, 0, Math.max(document.lineAt(0).text.length, 1))
-    diagnostics.set(document.uri, missingKeys(example, document.getText()).map((key) => {
-      const diagnostic = new api.Diagnostic(top, `${key} is in .env.example but not set here.`, api.DiagnosticSeverity.Information)
-      diagnostic.source = 'stacks'
-      diagnostic.code = 'missing-env-key'
-      return diagnostic
-    }))
-  }
-
-  /** The env file a command acts on: the open one, or `.env`. */
-  function targetFile(root: string): string {
-    const active = api.window.activeTextEditor?.document.uri.fsPath
-    return active && isEnvFile(active) && !relative(root, active).startsWith('..') ? relative(root, active) : '.env'
-  }
-
-  async function buddy(root: string, args: string[]): Promise<string | undefined> {
-    try {
-      return await host.exec(join(root, 'buddy'), args, root)
-    }
-    catch (error) {
-      // The error carries the command's stderr, never the value: values are
-      // only ever arguments, and execFile does not echo arguments.
-      void api.window.showErrorMessage(`Stacks: ./buddy ${args[0]} failed. ${error instanceof Error ? error.message.split('\n')[0] : ''}`)
-      return undefined
-    }
-  }
-
-  async function askKey(root: string, file: string, prompt: string): Promise<string | undefined> {
-    const keys = Object.keys(parseKeys(host.read(join(root, file))))
-    if (keys.length) {
-      const picked = await api.window.showQuickPick(keys, { title: `${prompt} (${file})`, placeHolder: 'Key' })
-      return picked
-    }
-    return (await api.window.showInputBox({ title: `${prompt} (${file})`, prompt: 'Key' }))?.trim() || undefined
-  }
-
-  function parseKeys(source: string | undefined): Record<string, true> {
-    const keys: Record<string, true> = {}
-    for (const line of (source ?? '').split(/\r?\n/)) {
-      const entry = envEntryAt(line)
-      if (entry && !entry.key.startsWith('DOTENV_PUBLIC_KEY'))
-        keys[entry.key] = true
-    }
-    return keys
-  }
-
-  async function getValue(): Promise<void> {
-    const root = projectRoot()
-    if (!root)
-      return
-    const file = targetFile(root)
-    const key = await askKey(root, file, 'Get an env value')
-    if (!key)
-      return
-    const value = await buddy(root, ['env:get', key, '--file', file])
-    if (value === undefined)
-      return
-    const choice = await api.window.showInformationMessage(`${key} is set in ${file}.`, 'Copy Value')
-    if (choice === 'Copy Value')
-      await api.env.clipboard.writeText(value.replace(/\r?\n$/, ''))
-  }
-
-  async function setValue(): Promise<void> {
-    const root = projectRoot()
-    if (!root)
-      return
-    const file = targetFile(root)
-    const key = (await api.window.showInputBox({ title: `Set an env value (${file})`, prompt: 'Key', validateInput: value => /^[A-Z_a-z][\w.-]*$/.test(value.trim()) ? undefined : 'Letters, digits and underscores, not starting with a digit' }))?.trim()
-    if (!key)
-      return
-    const value = await api.window.showInputBox({ title: `Set ${key} (${file})`, prompt: 'Value. It is encrypted when the file is.', password: true })
-    if (value === undefined)
-      return
-    if (await buddy(root, ['env:set', key, value, '--file', file]) !== undefined)
-      void api.window.showInformationMessage(`Stacks: set ${key} in ${file}.`)
-  }
-
-  async function wholeFile(command: 'env:encrypt' | 'env:decrypt' | 'env:rotate', warning?: string): Promise<void> {
-    const root = projectRoot()
-    if (!root)
-      return
-    const file = targetFile(root)
-    if (warning) {
-      const confirmed = await api.window.showWarningMessage(warning.replace('{file}', file), { modal: true }, 'Continue')
-      if (confirmed !== 'Continue')
-        return
-    }
-    if (await buddy(root, [command, '--file', file]) !== undefined)
-      void api.window.showInformationMessage(`Stacks: ./buddy ${command} finished for ${file}.`)
-  }
-
-  return {
-    activate(context) {
-      context.subscriptions.push(
-        diagnostics,
-        api.languages.registerHoverProvider([{ scheme: 'file', pattern: '**/.env*' }, { language: 'dotenv' }], hover),
-        api.workspace.onDidOpenTextDocument(checkMissingKeys),
-        api.workspace.onDidChangeTextDocument(event => checkMissingKeys(event.document)),
-        api.workspace.onDidSaveTextDocument(checkMissingKeys),
-        api.workspace.onDidCloseTextDocument(document => diagnostics.delete(document.uri)),
-        api.commands.registerCommand(ENV_COMMANDS.get, getValue),
-        api.commands.registerCommand(ENV_COMMANDS.set, setValue),
-        api.commands.registerCommand(ENV_COMMANDS.encrypt, () => wholeFile('env:encrypt')),
-        api.commands.registerCommand(ENV_COMMANDS.decrypt, () => wholeFile('env:decrypt', 'This writes every value in {file} to disk in plaintext. Encrypt it again before committing.')),
-        api.commands.registerCommand(ENV_COMMANDS.rotate, () => wholeFile('env:rotate', 'This generates a new keypair for {file} and re-encrypts every value with it. Deployments still holding the old private key will no longer decrypt it.')),
-      )
-
-      for (const document of api.workspace.textDocuments)
-        checkMissingKeys(document)
-    },
-  }
-}