t3code-cli 0.11.0 → 0.13.0

package/src/config/credential/cipher.ts

@@ -0,0 +1,39 @@
+import * as Context from "effect/Context";
+import type * as Effect from "effect/Effect";
+
+import type { CredentialCipherError } from "./error.ts";
+
+export const credentialCipherNonceByteLength = 12;
+export const credentialCipherTagByteLength = 16;
+
+export type AesGcmEncryptInput = {
+  readonly key: Uint8Array;
+  readonly nonce: Uint8Array;
+  readonly plaintext: Uint8Array;
+  readonly additionalData: Uint8Array;
+};
+
+export type AesGcmDecryptInput = {
+  readonly key: Uint8Array;
+  readonly nonce: Uint8Array;
+  readonly ciphertext: Uint8Array;
+  readonly tag: Uint8Array;
+  readonly additionalData: Uint8Array;
+};
+
+export type AesGcmEncryptResult = {
+  readonly ciphertext: Uint8Array;
+  readonly tag: Uint8Array;
+};
+
+export class T3CredentialCipher extends Context.Service<
+  T3CredentialCipher,
+  {
+    readonly encrypt: (
+      input: AesGcmEncryptInput,
+    ) => Effect.Effect<AesGcmEncryptResult, CredentialCipherError>;
+    readonly decrypt: (
+      input: AesGcmDecryptInput,
+    ) => Effect.Effect<Uint8Array, CredentialCipherError>;
+  }
+>()("t3cli/T3CredentialCipher") {}

package/src/config/credential/env.ts

@@ -0,0 +1,13 @@
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+
+import type { T3CliEnvShape } from "../env/env.ts";
+
+export function credentialTokenFromEnv(
+  t3CliEnv: Pick<T3CliEnvShape, "t3codeToken">,
+): Option.Option<string> {
+  return Option.flatMap(t3CliEnv.t3codeToken, (token) => {
+    const value = Redacted.value(token).trim();
+    return value.length > 0 ? Option.some(value) : Option.none();
+  });
+}

package/src/config/credential/error.ts

@@ -0,0 +1,9 @@
+import * as Schema from "effect/Schema";
+
+export class CredentialCipherError extends Schema.TaggedErrorClass<CredentialCipherError>()(
+  "CredentialCipherError",
+  {
+    operation: Schema.Literals(["encrypt", "decrypt"]),
+    cause: Schema.Defect(),
+  },
+) {}

package/src/config/credential/index.ts

@@ -0,0 +1,6 @@
+export * as Service from "./service.ts";
+export * as Cipher from "./cipher.ts";
+export * as CipherNode from "./cipher-node.ts";
+export * as CipherWeb from "./cipher-web.ts";
+export { credentialTokenFromEnv } from "./env.ts";
+export { CredentialCipherError } from "./error.ts";

package/src/config/credential/service.test-utils.ts

@@ -0,0 +1,25 @@
+import * as Layer from "effect/Layer";
+
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { ConfigPlatformLayer } from "../platform.test-utils.ts";
+import { t3CliEnvConfigLayer } from "../env/env.test-utils.ts";
+import * as CredentialCipherWeb from "./cipher-web.ts";
+import * as Keystore from "../keystore/service.test-utils.ts";
+import * as Credential from "./service.ts";
+
+export function t3CredentialCryptoDepsLayer(homeDir: string) {
+  return Credential.layer.pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        CliRuntime.layerTest({ cwd: homeDir }),
+        t3CliEnvConfigLayer(homeDir),
+        CredentialCipherWeb.layerWeb,
+        Keystore.unavailableKeystoreFactoryLayer,
+      ),
+    ),
+  );
+}
+
+export function t3CredentialCryptoLayerTest(homeDir: string) {
+  return Layer.mergeAll(ConfigPlatformLayer, t3CredentialCryptoDepsLayer(homeDir));
+}

package/src/config/credential/service.test.ts

@@ -0,0 +1,116 @@
+import "vite-plus/test/config";
+
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { assert, describe, it } from "@effect/vitest";
+
+import { ConfigPlatformLayer } from "../platform.test-utils.ts";
+import { makeTempHomeScoped } from "../temp-home.test-utils.ts";
+import { T3CredentialCrypto } from "./service.ts";
+import { t3CredentialCryptoDepsLayer } from "./service.test-utils.ts";
+
+describe("T3CredentialCrypto", () => {
+  it.effect("falls back to key file when keyring backend is unavailable", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const cryptoService = yield* Crypto.Crypto;
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const keyPath = path.join(homeDir, ".config", "t3cli", "key");
+        const masterKey = yield* cryptoService.randomBytes(32);
+        yield* fs.makeDirectory(path.dirname(keyPath), { recursive: true });
+        yield* fs.writeFileString(keyPath, `${Buffer.from(masterKey).toString("base64")}\n`, {
+          mode: 0o600,
+        });
+        const credentialCrypto = yield* T3CredentialCrypto;
+        const encrypted = yield* credentialCrypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "secret-token",
+        });
+        const token = yield* credentialCrypto.decrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: encrypted,
+        });
+        assert.equal(token, "secret-token");
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+
+  it.effect("hardens existing key file permissions to 0600 on use", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const cryptoService = yield* Crypto.Crypto;
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const keyPath = path.join(homeDir, ".config", "t3cli", "key");
+        const masterKey = yield* cryptoService.randomBytes(32);
+        yield* fs.makeDirectory(path.dirname(keyPath), { recursive: true });
+        yield* fs.writeFileString(keyPath, `${Buffer.from(masterKey).toString("base64")}\n`, {
+          mode: 0o644,
+        });
+        const credentialCrypto = yield* T3CredentialCrypto;
+        yield* credentialCrypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "secret-token",
+        });
+        const keyStat = yield* fs.stat(keyPath);
+        assert.equal(keyStat.mode & 0o777, 0o600);
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+
+  it.effect("creates key file with 0600 permissions when keyring is unavailable", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const keyPath = path.join(homeDir, ".config", "t3cli", "key");
+        const credentialCrypto = yield* T3CredentialCrypto;
+        yield* credentialCrypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "rotate-write",
+        });
+        const keyStat = yield* fs.stat(keyPath);
+        assert.equal(keyStat.mode & 0o777, 0o600);
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+
+  it.effect("fails decrypt when ciphertext AAD does not match", () =>
+    Effect.gen(function* () {
+      const homeDir = yield* makeTempHomeScoped("t3cli-credential-");
+      yield* Effect.gen(function* () {
+        const crypto = yield* T3CredentialCrypto;
+        const token = yield* crypto.encrypt({
+          environmentName: "home",
+          url: "https://home.example",
+          local: false,
+          token: "secret",
+        });
+        const result = yield* crypto
+          .decrypt({
+            environmentName: "home",
+            url: "https://tampered.example",
+            local: false,
+            token,
+          })
+          .pipe(Effect.exit);
+        assert.equal(Exit.isFailure(result), true);
+      }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)));
+    }).pipe(Effect.provide(ConfigPlatformLayer), Effect.scoped),
+  );
+});

package/src/config/credential/service.ts

@@ -0,0 +1,205 @@
+import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Encoding from "effect/Encoding";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+
+import { T3CredentialCipher, credentialCipherNonceByteLength } from "./cipher.ts";
+import type { EncryptedToken } from "../persist/schema.ts";
+import { ConfigError } from "../error.ts";
+import { CredentialCipherError } from "./error.ts";
+import { makeFileKeystore } from "../keystore/file.ts";
+import { T3MasterKeyKeystoreFactory, masterKeyByteLength } from "../keystore/service.ts";
+
+export type CredentialEncryptInput = {
+  readonly environmentName: string;
+  readonly url: string;
+  readonly local: boolean;
+  readonly token: string;
+};
+
+export type CredentialDecryptInput = {
+  readonly environmentName: string;
+  readonly url: string;
+  readonly local: boolean;
+  readonly token: EncryptedToken;
+};
+
+export class T3CredentialCrypto extends Context.Service<
+  T3CredentialCrypto,
+  {
+    readonly encrypt: (input: CredentialEncryptInput) => Effect.Effect<EncryptedToken, ConfigError>;
+    readonly decrypt: (input: CredentialDecryptInput) => Effect.Effect<string, ConfigError>;
+  }
+>()("t3cli/T3CredentialCrypto") {}
+
+const configSchemaVersion = 2;
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+
+export const make = Effect.fn("makeT3CredentialCrypto")(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const configProvider = yield* ConfigProvider.ConfigProvider;
+  const cryptoService = yield* Crypto.Crypto;
+  const cipher = yield* T3CredentialCipher;
+  const keystoreFactory = yield* T3MasterKeyKeystoreFactory;
+  const services = Layer.mergeAll(
+    Layer.succeed(FileSystem.FileSystem, fs),
+    Layer.succeed(Path.Path, path),
+    Layer.succeed(Crypto.Crypto, cryptoService),
+    Layer.succeed(ConfigProvider.ConfigProvider, configProvider),
+  );
+
+  const fileKeystore = yield* Effect.provide(makeFileKeystore(), services);
+  const primaryKeystore = yield* keystoreFactory.make().pipe(
+    Effect.catchTags({
+      KeystoreUnavailableError: () => Effect.succeed(undefined),
+    }),
+  );
+
+  const readMasterKey = Effect.fn("readMasterKey")(function* () {
+    if (primaryKeystore !== undefined) {
+      const primaryResult = yield* primaryKeystore.read();
+      if (primaryResult.kind === "present") {
+        return primaryResult.key;
+      }
+      if (primaryResult.kind === "corrupt") {
+        return yield* Effect.fail(
+          new ConfigError({
+            message: `corrupt credential key in OS keyring: ${primaryResult.message}`,
+          }),
+        );
+      }
+    }
+
+    const fileResult = yield* fileKeystore.read();
+    if (fileResult.kind === "present") {
+      return fileResult.key;
+    }
+    return undefined;
+  });
+
+  const writeMasterKey = Effect.fn("writeMasterKey")(function* (key: Uint8Array) {
+    if (primaryKeystore !== undefined) {
+      yield* primaryKeystore.write(key).pipe(
+        Effect.catchTags({
+          KeystoreUnavailableError: () => fileKeystore.write(key),
+        }),
+      );
+      return;
+    }
+    yield* fileKeystore.write(key);
+  });
+
+  const getMasterKey = Effect.fn("getMasterKey")(function* () {
+    const existing = yield* readMasterKey();
+    if (existing !== undefined) {
+      return existing;
+    }
+    const generated = yield* cryptoService.randomBytes(masterKeyByteLength).pipe(
+      Effect.mapError(
+        (error) =>
+          new ConfigError({
+            message: "failed to generate secure random bytes",
+            cause: error,
+          }),
+      ),
+    );
+    yield* writeMasterKey(generated);
+    return generated;
+  });
+
+  const encrypt: (input: CredentialEncryptInput) => Effect.Effect<EncryptedToken, ConfigError> =
+    Effect.fn("encrypt")(function* (input) {
+      const masterKey = yield* getMasterKey();
+      const nonce = yield* cryptoService.randomBytes(credentialCipherNonceByteLength).pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: "failed to generate secure random bytes",
+              cause: error,
+            }),
+        ),
+      );
+      const encrypted = yield* cipher
+        .encrypt({
+          key: masterKey,
+          nonce,
+          plaintext: encodeUtf8(input.token),
+          additionalData: buildCredentialAad(input),
+        })
+        .pipe(Effect.mapError(mapCredentialCipherError));
+      return {
+        kind: "encrypted" as const,
+        alg: "aes-256-gcm" as const,
+        key: "default" as const,
+        nonce: Encoding.encodeBase64(nonce),
+        ciphertext: Encoding.encodeBase64(encrypted.ciphertext),
+        tag: Encoding.encodeBase64(encrypted.tag),
+      };
+    });
+
+  const decrypt: (input: CredentialDecryptInput) => Effect.Effect<string, ConfigError> = Effect.fn(
+    "decrypt",
+  )(function* (input) {
+    const masterKey = yield* getMasterKey();
+    const nonce = yield* decodeBase64Field(input.token.nonce, "token nonce");
+    const ciphertext = yield* decodeBase64Field(input.token.ciphertext, "token ciphertext");
+    const tag = yield* decodeBase64Field(input.token.tag, "token tag");
+    const plaintext = yield* cipher
+      .decrypt({
+        key: masterKey,
+        nonce,
+        ciphertext,
+        tag,
+        additionalData: buildCredentialAad(input),
+      })
+      .pipe(Effect.mapError(mapCredentialCipherError));
+    return decodeUtf8(plaintext);
+  });
+
+  return { encrypt, decrypt } satisfies T3CredentialCrypto["Service"];
+});
+
+export const layer = Layer.effect(T3CredentialCrypto, make());
+
+function buildCredentialAad(input: {
+  readonly environmentName: string;
+  readonly url: string;
+  readonly local: boolean;
+}) {
+  return encodeUtf8(
+    `${configSchemaVersion}\0${input.environmentName}\0${input.url}\0${input.local}`,
+  );
+}
+
+function encodeUtf8(value: string) {
+  return textEncoder.encode(value);
+}
+
+function decodeUtf8(value: Uint8Array) {
+  return textDecoder.decode(value);
+}
+
+function decodeBase64Field(value: string, field: string) {
+  return Effect.fromResult(Encoding.decodeBase64(value)).pipe(
+    Effect.catchTags({
+      EncodingError: (error) =>
+        Effect.fail(new ConfigError({ message: `invalid encrypted token ${field}`, cause: error })),
+    }),
+  );
+}
+
+function mapCredentialCipherError(error: CredentialCipherError) {
+  return new ConfigError({
+    message:
+      error.operation === "encrypt"
+        ? "failed to encrypt credential cipher payload"
+        : "failed to decrypt credential cipher payload",
+    cause: error,
+  });
+}

package/src/config/env/env.test-utils.ts

@@ -0,0 +1,14 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+
+export function t3CliEnvConfigLayer(
+  homeDir: string,
+  env: Readonly<Record<string, string | undefined>> = {},
+) {
+  const record: Record<string, string> = { HOME: homeDir };
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined) {
+      record[key] = value;
+    }
+  }
+  return ConfigProvider.layer(ConfigProvider.fromEnv({ env: record }));
+}

package/src/config/env/env.ts

@@ -0,0 +1,81 @@
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import type * as Redacted from "effect/Redacted";
+
+export type T3CliEnvScope = {
+  readonly t3codeProjectRoot?: string | undefined;
+  readonly t3codeProjectId?: string | undefined;
+  readonly t3codeWorktreePath?: string | undefined;
+  readonly t3codeThreadId?: string | undefined;
+};
+
+export type T3CliEnvShape = {
+  readonly home: Option.Option<string>;
+  readonly xdgConfigHome: Option.Option<string>;
+  readonly t3cliEnv: Option.Option<string>;
+  readonly t3codeUrl: Option.Option<string>;
+  readonly t3codeToken: Option.Option<Redacted.Redacted>;
+  readonly t3codeHome: Option.Option<string>;
+  readonly term: Option.Option<string>;
+  readonly ci: boolean;
+  readonly codexCi: boolean;
+  readonly codexThreadId: boolean;
+  readonly t3cliAgent: boolean;
+  readonly scope: T3CliEnvScope;
+};
+
+export const T3CliEnvConfig = Config.all({
+  home: Config.string("HOME").pipe(Config.option),
+  xdgConfigHome: Config.string("XDG_CONFIG_HOME").pipe(Config.option),
+  t3cliEnv: Config.string("T3CLI_ENV").pipe(Config.option),
+  t3codeUrl: Config.string("T3CODE_URL").pipe(Config.option),
+  t3codeToken: Config.redacted("T3CODE_TOKEN").pipe(Config.option),
+  t3codeHome: Config.string("T3CODE_HOME").pipe(Config.option),
+  t3codeProjectRoot: Config.string("T3CODE_PROJECT_ROOT").pipe(Config.option),
+  t3codeProjectId: Config.string("T3CODE_PROJECT_ID").pipe(Config.option),
+  t3codeWorktreePath: Config.string("T3CODE_WORKTREE_PATH").pipe(Config.option),
+  t3codeThreadId: Config.string("T3CODE_THREAD_ID").pipe(Config.option),
+  term: Config.string("TERM").pipe(Config.option),
+  ci: Config.string("CI").pipe(Config.option, Config.map(Option.isSome)),
+  codexCi: Config.string("CODEX_CI").pipe(Config.option, Config.map(Option.isSome)),
+  codexThreadId: Config.string("CODEX_THREAD_ID").pipe(Config.option, Config.map(Option.isSome)),
+  t3cliAgent: Config.string("T3CLI_AGENT").pipe(Config.option, Config.map(Option.isSome)),
+});
+
+function toScope(loaded: {
+  readonly t3codeProjectRoot: Option.Option<string>;
+  readonly t3codeProjectId: Option.Option<string>;
+  readonly t3codeWorktreePath: Option.Option<string>;
+  readonly t3codeThreadId: Option.Option<string>;
+}): T3CliEnvScope {
+  return {
+    ...(Option.isSome(loaded.t3codeProjectRoot)
+      ? { t3codeProjectRoot: loaded.t3codeProjectRoot.value }
+      : {}),
+    ...(Option.isSome(loaded.t3codeProjectId)
+      ? { t3codeProjectId: loaded.t3codeProjectId.value }
+      : {}),
+    ...(Option.isSome(loaded.t3codeWorktreePath)
+      ? { t3codeWorktreePath: loaded.t3codeWorktreePath.value }
+      : {}),
+    ...(Option.isSome(loaded.t3codeThreadId)
+      ? { t3codeThreadId: loaded.t3codeThreadId.value }
+      : {}),
+  };
+}
+
+export const loadT3CliEnv = Effect.map(T3CliEnvConfig, (loaded) => ({
+  home: loaded.home,
+  xdgConfigHome: loaded.xdgConfigHome,
+  t3cliEnv: loaded.t3cliEnv,
+  t3codeUrl: loaded.t3codeUrl,
+  t3codeToken: loaded.t3codeToken,
+  t3codeHome: loaded.t3codeHome,
+  term: loaded.term,
+  ci: loaded.ci,
+  codexCi: loaded.codexCi,
+  codexThreadId: loaded.codexThreadId,
+  t3cliAgent: loaded.t3cliAgent,
+  scope: toScope(loaded),
+}));

package/src/config/env/index.ts

@@ -0,0 +1,2 @@
+export { loadT3CliEnv, T3CliEnvConfig, type T3CliEnvScope, type T3CliEnvShape } from "./env.ts";
+export { resolveT3BaseDir, type T3Layout } from "./layout.ts";

package/src/{layout/base-dir.ts → config/env/layout.ts}

@@ -1,4 +1,3 @@
-import { homedir } from "node:os";
 import * as Effect from "effect/Effect";
 import * as Path from "effect/Path";
 
@@ -8,14 +7,6 @@ export type T3Layout = {
   readonly t3codeHome?: string | undefined;
 };
 
-export function readT3LayoutFromNodeProcess(): T3Layout {
-  return {
-    cwd: process.cwd(),
-    homeDir: homedir(),
-    t3codeHome: process.env["T3CODE_HOME"],
-  };
-}
-
 export const resolveT3BaseDir = Effect.fn("resolveT3BaseDir")(function* (input: {
   readonly layout: T3Layout;
   readonly baseDir?: string | undefined;

package/src/config/environment-name/index.ts

@@ -0,0 +1,7 @@
+export {
+  defaultEnvironmentNameForLocal,
+  defaultEnvironmentNameFromUrl,
+  migrateV1EnvironmentName,
+  slugifyEnvironmentName,
+  validateEnvironmentName,
+} from "./name.ts";

package/src/config/environment-name/name.test.ts

@@ -0,0 +1,66 @@
+import "vite-plus/test/config";
+
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { assert, describe, it } from "@effect/vitest";
+
+import { expectFailWithMessage } from "../../effect.test-utils.ts";
+import { ConfigError } from "../error.ts";
+import {
+  defaultEnvironmentNameForLocal,
+  defaultEnvironmentNameFromUrl,
+  migrateV1EnvironmentName,
+  slugifyEnvironmentName,
+  validateEnvironmentName,
+} from "./name.ts";
+
+describe("slugifyEnvironmentName", () => {
+  it("slugifies invalid characters", () => {
+    assert.equal(slugifyEnvironmentName("app.example.com"), "app.example.com");
+    assert.equal(slugifyEnvironmentName("---"), "default");
+  });
+});
+
+describe("validateEnvironmentName", () => {
+  it.effect("rejects empty and invalid names", () =>
+    Effect.gen(function* () {
+      const empty = yield* validateEnvironmentName("").pipe(Effect.exit);
+      assert.equal(Exit.isFailure(empty), true);
+      const invalid = yield* validateEnvironmentName("bad name").pipe(Effect.exit);
+      assert.equal(Exit.isFailure(invalid), true);
+      yield* validateEnvironmentName("valid.name-1");
+    }),
+  );
+});
+
+describe("defaultEnvironmentNameFromUrl", () => {
+  it.effect("derives hostname from normalized url", () =>
+    Effect.gen(function* () {
+      const name = yield* defaultEnvironmentNameFromUrl("https://app.example.com/path");
+      assert.equal(name, "app.example.com");
+    }),
+  );
+
+  it.effect("maps invalid urls to ConfigError", () =>
+    expectFailWithMessage(defaultEnvironmentNameFromUrl("not-a-url"), ConfigError, "invalid url"),
+  );
+});
+
+describe("migrateV1EnvironmentName", () => {
+  it.effect("uses local name for local configs", () =>
+    Effect.gen(function* () {
+      const name = yield* migrateV1EnvironmentName({ local: true });
+      assert.equal(name, defaultEnvironmentNameForLocal());
+    }),
+  );
+
+  it.effect("derives name from url when present", () =>
+    Effect.gen(function* () {
+      const name = yield* migrateV1EnvironmentName({
+        url: "https://work.example",
+        local: false,
+      });
+      assert.equal(name, "work.example");
+    }),
+  );
+});

package/src/config/environment-name/name.ts

@@ -0,0 +1,49 @@
+import * as Effect from "effect/Effect";
+
+import { ConfigError } from "../error.ts";
+import { normalizeHttpBaseUrl } from "../url/url.ts";
+
+const environmentNamePattern = /^[A-Za-z0-9._-]+$/;
+
+export function slugifyEnvironmentName(value: string) {
+  const slug = value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug.length > 0 ? slug : "default";
+}
+
+export function validateEnvironmentName(name: string) {
+  if (name.length === 0 || !environmentNamePattern.test(name)) {
+    return Effect.fail(
+      new ConfigError({
+        message: `invalid environment name '${name}': use non-empty [A-Za-z0-9._-]`,
+      }),
+    );
+  }
+  return Effect.void;
+}
+
+export function defaultEnvironmentNameFromUrl(url: string) {
+  return normalizeHttpBaseUrl(url).pipe(
+    Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+    Effect.flatMap((normalized) => {
+      const hostname = slugifyEnvironmentName(new URL(normalized).hostname.trim());
+      return validateEnvironmentName(hostname).pipe(Effect.as(hostname));
+    }),
+  );
+}
+
+export function defaultEnvironmentNameForLocal() {
+  return "local" as const;
+}
+
+export function migrateV1EnvironmentName(input: {
+  readonly url?: string;
+  readonly local?: boolean;
+}) {
+  if (input.local === true) {
+    return Effect.succeed(defaultEnvironmentNameForLocal());
+  }
+  if (input.url !== undefined && input.url.length > 0) {
+    return defaultEnvironmentNameFromUrl(input.url);
+  }
+  return Effect.succeed("default");
+}