t3code-cli 0.11.0 → 0.13.0

package/src/config/persist/migration.test.ts

@@ -0,0 +1,71 @@
+import "vite-plus/test/config";
+
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Option from "effect/Option";
+import { assert, describe, it } from "@effect/vitest";
+
+import { ConfigError } from "../error.ts";
+import { T3CredentialCrypto } from "../credential/service.ts";
+import { ConfigPlatformLayer } from "../platform.test-utils.ts";
+import { makeTempHomeScoped } from "../temp-home.test-utils.ts";
+import { t3CredentialCryptoDepsLayer } from "../credential/service.test-utils.ts";
+import { migrateV1FileToEncrypted } from "./migration.ts";
+
+describe("migrateV1FileToEncrypted", () => {
+  it.effect("migrates v1 flat config and roundtrips encrypted tokens", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-migration-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const migrated = yield* migrateV1FileToEncrypted({
+            url: "https://app.example.com",
+            token: "secret-token",
+            local: false,
+          });
+          assert.equal(migrated.default, "app.example.com");
+          const crypto = yield* T3CredentialCrypto;
+          const token = yield* crypto.decrypt({
+            environmentName: "app.example.com",
+            url: "https://app.example.com",
+            local: false,
+            token: migrated.environments["app.example.com"]!.token,
+          });
+          assert.equal(token, "secret-token");
+        }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("maps invalid v1 urls to ConfigError when migrating directly", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-migrate-url-error-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const exit = yield* migrateV1FileToEncrypted({
+            url: "not-a-url",
+            token: "secret-token",
+            local: false,
+          }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)), Effect.exit);
+          assert.isTrue(Exit.isFailure(exit));
+          if (!Exit.isFailure(exit)) {
+            return;
+          }
+          const error = Cause.findErrorOption(exit.cause);
+          assert.isTrue(Option.isSome(error));
+          if (Option.isSome(error)) {
+            assert.instanceOf(error.value, ConfigError);
+            assert.equal(error.value.message, "invalid url");
+          }
+        }),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+});

package/src/config/persist/migration.ts

@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+
+import { T3CredentialCrypto } from "../credential/service.ts";
+import { migrateV1EnvironmentName, validateEnvironmentName } from "../environment-name/name.ts";
+import { ConfigError } from "../error.ts";
+import {
+  StoredConfigV1FileSchema,
+  StoredConfigV2FileSchema,
+  type StoredConfigV1File,
+} from "./schema.ts";
+import type { EncryptedConfig } from "../types.ts";
+import { normalizeHttpBaseUrl } from "../url/url.ts";
+
+export const emptyEncryptedConfig = (): EncryptedConfig => ({
+  version: 2,
+  environments: {},
+});
+
+export const readEncryptedConfigFromValue = Effect.fn("readEncryptedConfigFromValue")(function* (
+  value: unknown,
+) {
+  return yield* Effect.gen(function* () {
+    const v2 = yield* Schema.decodeUnknownEffect(StoredConfigV2FileSchema)(value).pipe(
+      Effect.option,
+    );
+    if (Option.isSome(v2)) {
+      return { config: v2.value, migratedFromV1: false as const };
+    }
+    const v1 = yield* Schema.decodeUnknownEffect(StoredConfigV1FileSchema)(value);
+    const migrated = yield* migrateV1FileToEncrypted(v1);
+    return { config: migrated, migratedFromV1: true as const };
+  }).pipe(
+    Effect.catchTags({
+      SchemaError: (error) =>
+        Effect.fail(new ConfigError({ message: "failed to read config", cause: error })),
+    }),
+  );
+});
+
+export const migrateV1FileToEncrypted = Effect.fn("migrateV1FileToEncrypted")(function* (
+  config: StoredConfigV1File,
+) {
+  if (
+    (config.url === undefined || config.url.length === 0) &&
+    (config.token === undefined || config.token.length === 0)
+  ) {
+    return emptyEncryptedConfig();
+  }
+  if (config.url === undefined || config.token === undefined) {
+    return yield* Effect.fail(
+      new ConfigError({ message: "failed to read config: incomplete v1 credentials" }),
+    );
+  }
+  const name = yield* migrateV1EnvironmentName(config).pipe(
+    Effect.flatMap((migratedName) =>
+      validateEnvironmentName(migratedName).pipe(Effect.as(migratedName)),
+    ),
+  );
+  const normalizedUrl = yield* normalizeHttpBaseUrl(config.url).pipe(
+    Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+  );
+  const crypto = yield* T3CredentialCrypto;
+  const token = yield* crypto.encrypt({
+    environmentName: name,
+    url: normalizedUrl,
+    local: config.local ?? false,
+    token: config.token,
+  });
+  return {
+    version: 2 as const,
+    default: name,
+    environments: {
+      [name]: {
+        url: normalizedUrl,
+        local: config.local ?? false,
+        token,
+      },
+    },
+  } satisfies EncryptedConfig;
+});

package/src/config/persist/persist.test.ts

@@ -0,0 +1,113 @@
+import "vite-plus/test/config";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+import { assert, describe, it } from "@effect/vitest";
+
+import { T3Config } from "../config.ts";
+import { ConfigPlatformLayer } from "../platform.test-utils.ts";
+import { makeTempHomeScoped } from "../temp-home.test-utils.ts";
+import { t3ConfigDepsLayer } from "../layer.test-utils.ts";
+import { StoredConfigV1FileJson, StoredConfigV2FileJson } from "./schema.ts";
+
+describe("config file persistence", () => {
+  it.effect("persists v1 config as encrypted v2 on first read", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-persist-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const secretToken = "legacy-plaintext-token";
+          const configPath = path.join(homeDir, ".config", "t3cli", "config.json");
+          yield* fs.makeDirectory(path.dirname(configPath), { recursive: true });
+          const legacyConfig = yield* Schema.encodeEffect(StoredConfigV1FileJson)({
+            url: "https://home.example",
+            token: secretToken,
+            local: false,
+          });
+          yield* fs.writeFileString(configPath, `${legacyConfig}\n`, { mode: 0o600 });
+          yield* Effect.gen(function* () {
+            const config = yield* T3Config;
+            yield* config.listEnvironments();
+          }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir)));
+          const raw = yield* fs.readFileString(configPath);
+          assert.equal(raw.includes(secretToken), false);
+          const persisted = yield* Schema.decodeUnknownEffect(StoredConfigV2FileJson)(raw);
+          assert.equal(persisted.version, 2);
+          const environment = Object.values(persisted.environments)[0];
+          assert.isDefined(environment);
+          assert.equal(environment.token.kind, "encrypted");
+        }),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("never writes plaintext tokens to config.json", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-persist-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const secretToken = "super-secret-token-value";
+          yield* Effect.gen(function* () {
+            const config = yield* T3Config;
+            yield* config.upsertEnvironment({
+              name: "home",
+              url: "https://home.example",
+              token: secretToken,
+              local: false,
+            });
+          }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir)));
+          const configPath = path.join(homeDir, ".config", "t3cli", "config.json");
+          const raw = yield* fs.readFileString(configPath);
+          assert.equal(raw.includes(secretToken), false);
+          const persisted = yield* Schema.decodeUnknownEffect(StoredConfigV2FileJson)(raw);
+          assert.equal(persisted.environments.home?.token.kind, "encrypted");
+        }),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("hardens existing config file permissions to 0600 on write", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-persist-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const configPath = path.join(homeDir, ".config", "t3cli", "config.json");
+          yield* fs.makeDirectory(path.dirname(configPath), { recursive: true });
+          const emptyConfig = yield* Schema.encodeEffect(StoredConfigV2FileJson)({
+            version: 2,
+            environments: {},
+          });
+          yield* fs.writeFileString(configPath, `${emptyConfig}\n`, { mode: 0o644 });
+          yield* Effect.gen(function* () {
+            const config = yield* T3Config;
+            yield* config.upsertEnvironment({
+              name: "home",
+              url: "https://home.example",
+              token: "home-token",
+              local: false,
+            });
+          }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir)));
+          const configStat = yield* fs.stat(configPath);
+          assert.equal(configStat.mode & 0o777, 0o600);
+        }),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+});

package/src/config/persist/persist.ts

@@ -0,0 +1,65 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+
+import { ConfigError, isPlatformNotFoundError } from "../error.ts";
+import { hardenPrivateFileMode } from "./file-mode.ts";
+import { emptyEncryptedConfig, readEncryptedConfigFromValue } from "./migration.ts";
+import { resolveConfigFilePath } from "../paths/paths.ts";
+import { UnknownConfigFileJson, StoredConfigV2FileJson } from "./schema.ts";
+import type { EncryptedConfig } from "../types.ts";
+
+export const readEncryptedConfigFile = Effect.fn("readEncryptedConfigFile")(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const configFilePath = yield* resolveConfigFilePath();
+  const raw = yield* fs.readFileString(configFilePath).pipe(
+    Effect.catchTags({
+      PlatformError: (error) =>
+        isPlatformNotFoundError(error)
+          ? Effect.succeed(undefined)
+          : Effect.fail(new ConfigError({ message: "failed to read config", cause: error })),
+    }),
+  );
+  if (raw === undefined) {
+    return emptyEncryptedConfig();
+  }
+  const value = yield* Schema.decodeUnknownEffect(UnknownConfigFileJson)(raw).pipe(
+    Effect.catchTags({
+      SchemaError: (error) =>
+        Effect.fail(new ConfigError({ message: "failed to read config", cause: error })),
+    }),
+  );
+  const read = yield* readEncryptedConfigFromValue(value);
+  if (read.migratedFromV1) {
+    yield* writeEncryptedConfigFile(read.config);
+  }
+  return read.config;
+});
+
+export const writeEncryptedConfigFile = Effect.fn("writeEncryptedConfigFile")(function* (
+  config: EncryptedConfig,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const configFilePath = yield* resolveConfigFilePath();
+  yield* fs.makeDirectory(path.dirname(configFilePath), { recursive: true, mode: 0o700 }).pipe(
+    Effect.catchTags({
+      PlatformError: (error) =>
+        Effect.fail(new ConfigError({ message: "failed to write config", cause: error })),
+    }),
+  );
+  const encoded = yield* Schema.encodeEffect(StoredConfigV2FileJson)(config).pipe(
+    Effect.catchTags({
+      SchemaError: (error) =>
+        Effect.fail(new ConfigError({ message: "failed to write config", cause: error })),
+    }),
+  );
+  yield* fs.writeFileString(configFilePath, `${encoded}\n`, { mode: 0o600 }).pipe(
+    Effect.catchTags({
+      PlatformError: (error) =>
+        Effect.fail(new ConfigError({ message: "failed to write config", cause: error })),
+    }),
+  );
+  yield* hardenPrivateFileMode(configFilePath, "config");
+});

package/src/config/persist/schema.ts

@@ -0,0 +1,37 @@
+import * as Schema from "effect/Schema";
+
+export const EncryptedTokenSchema = Schema.Struct({
+  kind: Schema.Literal("encrypted"),
+  alg: Schema.Literal("aes-256-gcm"),
+  key: Schema.Literal("default"),
+  nonce: Schema.String,
+  ciphertext: Schema.String,
+  tag: Schema.String,
+});
+
+export const StoredEnvironmentFileSchema = Schema.Struct({
+  url: Schema.String,
+  local: Schema.Boolean,
+  token: EncryptedTokenSchema,
+});
+
+export const StoredConfigV2FileSchema = Schema.Struct({
+  version: Schema.Literal(2),
+  default: Schema.optionalKey(Schema.String),
+  environments: Schema.Record(Schema.String, StoredEnvironmentFileSchema),
+});
+
+export const StoredConfigV1FileSchema = Schema.Struct({
+  url: Schema.optionalKey(Schema.String),
+  token: Schema.optionalKey(Schema.String),
+  local: Schema.optionalKey(Schema.Boolean),
+});
+
+export type EncryptedToken = Schema.Schema.Type<typeof EncryptedTokenSchema>;
+export type StoredEnvironmentFile = Schema.Schema.Type<typeof StoredEnvironmentFileSchema>;
+export type StoredConfigV2File = Schema.Schema.Type<typeof StoredConfigV2FileSchema>;
+export type StoredConfigV1File = Schema.Schema.Type<typeof StoredConfigV1FileSchema>;
+
+export const StoredConfigV1FileJson = Schema.fromJsonString(StoredConfigV1FileSchema);
+export const StoredConfigV2FileJson = Schema.fromJsonString(StoredConfigV2FileSchema);
+export const UnknownConfigFileJson = Schema.UnknownFromJsonString;

package/src/config/platform.test-utils.ts

@@ -0,0 +1,20 @@
+import * as Layer from "effect/Layer";
+import * as NodeChildProcessSpawner from "@effect/platform-node/NodeChildProcessSpawner";
+import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
+import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
+import * as NodePath from "@effect/platform-node/NodePath";
+import * as NodeStdio from "@effect/platform-node/NodeStdio";
+import * as NodeTerminal from "@effect/platform-node/NodeTerminal";
+
+export const ConfigPlatformLayer = Layer.mergeAll(
+  NodeFileSystem.layer,
+  NodePath.layer,
+  NodeCrypto.layer,
+);
+
+export const CliCommandPlatformLayer = Layer.mergeAll(
+  ConfigPlatformLayer,
+  NodeStdio.layer,
+  NodeTerminal.layer,
+  NodeChildProcessSpawner.layer,
+);

package/src/config/resolve/resolve.test-utils.ts

@@ -0,0 +1,20 @@
+import type { EncryptedConfig } from "../types.ts";
+
+export const sampleEncrypted = (input: {
+  readonly default?: string;
+  readonly environments?: EncryptedConfig["environments"];
+}): EncryptedConfig => ({
+  version: 2,
+  ...(input.default !== undefined ? { default: input.default } : {}),
+  environments: input.environments ?? {},
+});
+
+export const sampleEncryptedToken = () =>
+  ({
+    kind: "encrypted" as const,
+    alg: "aes-256-gcm" as const,
+    key: "default" as const,
+    nonce: "n",
+    ciphertext: "c",
+    tag: "t",
+  }) as const;

package/src/config/resolve/resolve.test.ts

@@ -0,0 +1,137 @@
+import "vite-plus/test/config";
+
+import { assert, describe, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+
+import { resolveConfiguredEnvironment } from "../selection/resolve.ts";
+import { sampleEncrypted, sampleEncryptedToken } from "./resolve.test-utils.ts";
+import {
+  buildResolvedConfigFromEnv,
+  resolveDefaultForUpsert,
+  selectEnvironmentName,
+  validateCredentialEnvVars,
+} from "./resolve.ts";
+
+describe("resolveConfiguredEnvironment", () => {
+  it("prefers cli flag over T3CLI_ENV", () => {
+    assert.equal(
+      resolveConfiguredEnvironment({
+        cliFlag: "cli",
+        t3cliEnv: "env",
+      }),
+      "cli",
+    );
+  });
+
+  it("falls back to T3CLI_ENV when cli flag is absent", () => {
+    assert.equal(
+      resolveConfiguredEnvironment({
+        t3cliEnv: "env",
+      }),
+      "env",
+    );
+  });
+});
+
+describe("selectEnvironmentName", () => {
+  it("prefers selected environment over config default", () => {
+    const selected = selectEnvironmentName({
+      selectedEnvironment: "cli",
+      defaultEnvironment: "default",
+    });
+    assert.equal(selected, "cli");
+  });
+
+  it("falls back to config default", () => {
+    assert.equal(
+      selectEnvironmentName({
+        defaultEnvironment: "default",
+      }),
+      "default",
+    );
+  });
+});
+
+describe("validateCredentialEnvVars", () => {
+  it.effect("requires both T3CODE_URL and T3CODE_TOKEN together", () =>
+    Effect.gen(function* () {
+      const onlyUrl = yield* validateCredentialEnvVars({ envUrl: "https://example.com" }).pipe(
+        Effect.exit,
+      );
+      assert.equal(Exit.isFailure(onlyUrl), true);
+
+      const onlyToken = yield* validateCredentialEnvVars({ envToken: "token" }).pipe(Effect.exit);
+      assert.equal(Exit.isFailure(onlyToken), true);
+
+      yield* validateCredentialEnvVars({
+        envUrl: "https://example.com",
+        envToken: "token",
+      });
+    }),
+  );
+});
+
+describe("buildResolvedConfigFromEnv", () => {
+  it.effect(
+    "does not inherit local=true from selected stored environment when env vars override",
+    () =>
+      Effect.gen(function* () {
+        const resolved = yield* buildResolvedConfigFromEnv({
+          envUrl: "https://remote.example",
+          envToken: "env-token",
+        });
+        assert.equal(resolved.source, "env");
+        assert.equal(resolved.local, false);
+        assert.equal(resolved.url, "https://remote.example");
+        assert.equal(resolved.token, "env-token");
+      }),
+  );
+});
+
+describe("resolveDefaultForUpsert", () => {
+  it("sets default only for the first environment", () => {
+    assert.equal(resolveDefaultForUpsert(sampleEncrypted({}), "first"), "first");
+    assert.equal(
+      resolveDefaultForUpsert(
+        sampleEncrypted({
+          default: "home",
+          environments: {
+            home: {
+              url: "https://home.example",
+              local: false,
+              token: sampleEncryptedToken(),
+            },
+          },
+        }),
+        "work",
+      ),
+      "home",
+    );
+  });
+
+  it("promotes default when makeDefault is true", () => {
+    assert.equal(
+      resolveDefaultForUpsert(
+        sampleEncrypted({
+          default: "home",
+          environments: {
+            home: {
+              url: "https://home.example",
+              local: false,
+              token: sampleEncryptedToken(),
+            },
+            work: {
+              url: "https://work.example",
+              local: false,
+              token: { ...sampleEncryptedToken(), nonce: "n2", ciphertext: "c2", tag: "t2" },
+            },
+          },
+        }),
+        "work",
+        true,
+      ),
+      "work",
+    );
+  });
+});

package/src/config/resolve/resolve.ts

@@ -0,0 +1,104 @@
+import * as Effect from "effect/Effect";
+
+import { validateEnvironmentName } from "../environment-name/name.ts";
+import { ConfigError } from "../error.ts";
+import type { EncryptedConfig, ResolvedConfig } from "../types.ts";
+import { normalizeHttpBaseUrl } from "../url/url.ts";
+
+export type ResolveSelectionInput = {
+  readonly selectedEnvironment?: string | undefined;
+  readonly defaultEnvironment?: string | undefined;
+};
+
+export function selectEnvironmentName(input: ResolveSelectionInput) {
+  if (input.selectedEnvironment !== undefined && input.selectedEnvironment.length > 0) {
+    return input.selectedEnvironment;
+  }
+  return input.defaultEnvironment;
+}
+
+export type ResolveCredentialInput = {
+  readonly envUrl?: string | undefined;
+  readonly envToken?: string | undefined;
+};
+
+export function validateCredentialEnvVars(input: ResolveCredentialInput) {
+  const hasEnvUrl = input.envUrl !== undefined && input.envUrl.length > 0;
+  const hasEnvToken = input.envToken !== undefined && input.envToken.length > 0;
+  if (hasEnvUrl !== hasEnvToken) {
+    return Effect.fail(
+      new ConfigError({
+        message: "T3CODE_URL and T3CODE_TOKEN must both be set together",
+      }),
+    );
+  }
+  return Effect.void;
+}
+
+export function resolveDefaultForUpsert(
+  encrypted: EncryptedConfig,
+  environmentName: string,
+  makeDefault?: boolean,
+): string | undefined {
+  if (makeDefault === true) {
+    return environmentName;
+  }
+  if (Object.keys(encrypted.environments).length === 0) {
+    return environmentName;
+  }
+  return encrypted.default;
+}
+
+export function summarizeEnvironments(encrypted: EncryptedConfig) {
+  return Object.entries(encrypted.environments)
+    .map(([name, environmentConfig]) => ({
+      name,
+      url: environmentConfig.url,
+      local: environmentConfig.local,
+      default: encrypted.default === name,
+    }))
+    .toSorted((left, right) => left.name.localeCompare(right.name));
+}
+
+export function buildResolvedConfigFromEnv(input: {
+  readonly envUrl: string;
+  readonly envToken: string;
+}) {
+  return normalizeHttpBaseUrl(input.envUrl).pipe(
+    Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+    Effect.map((normalizedUrl) => {
+      return {
+        url: normalizedUrl,
+        token: input.envToken,
+        source: "env" as const,
+        local: false,
+      } satisfies ResolvedConfig;
+    }),
+  );
+}
+
+export function buildResolvedConfigFromStored(input: {
+  readonly selectedName: string;
+  readonly token: string;
+  readonly encrypted: EncryptedConfig;
+}) {
+  return Effect.gen(function* () {
+    yield* validateEnvironmentName(input.selectedName);
+    const selectedEnvironment = input.encrypted.environments[input.selectedName];
+    if (selectedEnvironment === undefined) {
+      return yield* Effect.fail(
+        new ConfigError({ message: `environment not found: ${input.selectedName}` }),
+      );
+    }
+    const normalizedUrl = yield* normalizeHttpBaseUrl(selectedEnvironment.url).pipe(
+      Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+    );
+    return {
+      url: normalizedUrl,
+      token: input.token,
+      source: "config" as const,
+      local: selectedEnvironment.local,
+      environment: input.selectedName,
+    } satisfies ResolvedConfig;
+  });
+}

package/src/config/selection/index.ts

@@ -0,0 +1 @@
+export * as Service from "./service.ts";

package/src/config/selection/resolve.ts

@@ -0,0 +1,14 @@
+export function resolveConfiguredEnvironment(input: {
+  readonly cliFlag?: string | undefined;
+  readonly t3cliEnv?: string | undefined;
+}): string | undefined {
+  const fromFlag = input.cliFlag?.trim();
+  if (fromFlag !== undefined && fromFlag.length > 0) {
+    return fromFlag;
+  }
+  const fromEnv = input.t3cliEnv?.trim();
+  if (fromEnv !== undefined && fromEnv.length > 0) {
+    return fromEnv;
+  }
+  return undefined;
+}