t3code-cli 0.10.0 → 0.12.0

package/src/cli/threads/start.ts

@@ -3,16 +3,18 @@ import * as Option from "effect/Option";
 import * as Stream from "effect/Stream";
 import { Argument, Command, Flag } from "effect/unstable/cli";
 
+import { extraArgsConfig } from "../extra-args.ts";
 import { modelFlags, projectFlag, threadFormatFlag, worktreeFlag } from "../flags.ts";
 import { readInitialMessage } from "../message-input.ts";
 import { buildModelOptions } from "../model-options.ts";
 import { requireCommandProjectRef } from "../require.ts";
-import { resolveWorktreePath } from "../../scope/index.ts";
-import { formatThreadStartedHuman } from "../thread-format.ts";
+import { resolveWorktreePath } from "../scope/index.ts";
+import { formatThreadStartedHuman } from "../format/thread.ts";
 import { T3Application } from "../../application/service.ts";
-import { Environment } from "../../environment/service.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
 import { T3Input } from "../input/service.ts";
-import { canRenderLiveTerminal, resolveOutputFormat } from "../output-format.ts";
+import { canRenderLiveTerminal, resolveOutputFormat } from "../format/output.ts";
 import { T3Output } from "../output/service.ts";
 import { printWaitEventsHuman, printWaitEventsNdjson } from "../wait-events.ts";
 
@@ -29,6 +31,7 @@ export const startThreadCommand = Command.make(
     ...modelFlags,
     wait: Flag.boolean("wait"),
     format: threadFormatFlag,
+    ...extraArgsConfig,
   },
   ({
     project,
@@ -64,16 +67,13 @@ export const startThreadCommand = Command.make(
         thinking,
       });
       const application = yield* T3Application;
-      const environment = yield* Environment;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
       const output = yield* T3Output;
-      const projectRef = yield* requireCommandProjectRef({
-        project,
-        env: environment.env,
-        cwd: environment.cwd,
-      });
+      const projectRef = yield* requireCommandProjectRef({ project });
       const worktreePath = resolveWorktreePath({
         value: Option.getOrUndefined(worktree),
-        env: environment.env,
+        scope: t3CliEnv.scope,
       });
       const input = {
         message: text,
@@ -86,7 +86,12 @@ export const startThreadCommand = Command.make(
         ...(modelValue !== undefined && modelValue.length > 0 ? { model: modelValue } : {}),
         ...(options.length > 0 ? { options } : {}),
       };
-      const resolvedFormat = resolveOutputFormat(format, environment, wait ? "ndjson" : "json");
+      const resolvedFormat = resolveOutputFormat(
+        format,
+        cliRuntime,
+        t3CliEnv,
+        wait ? "ndjson" : "json",
+      );
 
       if (resolvedFormat === "ndjson") {
         const started = yield* application.startThread(input, {
@@ -117,7 +122,7 @@ export const startThreadCommand = Command.make(
         }
         yield* printWaitEventsHuman(output, application.watchThread(started.threadId), {
           threadId: started.threadId,
-          live: canRenderLiveTerminal(environment),
+          live: canRenderLiveTerminal(cliRuntime, t3CliEnv),
         });
         return;
       }

package/src/cli/threads/unarchive.ts

@@ -0,0 +1,48 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { Command } from "effect/unstable/cli";
+
+import { extraArgsConfig } from "../extra-args.ts";
+import { formatFlag, threadFlag } from "../flags.ts";
+import { MissingThreadError } from "../error.ts";
+import { resolveThreadId } from "../scope/index.ts";
+import { T3Application } from "../../application/service.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
+import { resolveOutputFormat } from "../format/output.ts";
+import { T3Output } from "../output/service.ts";
+
+export const unarchiveThreadCommand = Command.make(
+  "unarchive",
+  {
+    thread: threadFlag,
+    format: formatFlag,
+    ...extraArgsConfig,
+  },
+  ({ thread, format }) =>
+    Effect.gen(function* () {
+      const application = yield* T3Application;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
+      const output = yield* T3Output;
+      const threadId = resolveThreadId({
+        value: Option.getOrUndefined(thread),
+        scope: t3CliEnv.scope,
+      });
+      if (threadId === undefined) {
+        return yield* Effect.fail(
+          new MissingThreadError({
+            message: "thread id is required: pass --thread or set T3CODE_THREAD_ID",
+          }),
+        );
+      }
+      const resolvedFormat = resolveOutputFormat(format, cliRuntime, t3CliEnv, "json");
+      const dispatch = yield* application.unarchiveThread(threadId);
+      if (resolvedFormat === "json") {
+        return yield* output.printJson(dispatch);
+      }
+      return yield* output.printInfo(
+        `thread unarchived: ${threadId} (sequence ${dispatch.sequence})`,
+      );
+    }),
+).pipe(Command.withDescription("unarchive thread"));

package/src/cli/threads/update.ts

@@ -0,0 +1,155 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { Command, Flag } from "effect/unstable/cli";
+
+import { extraArgsConfig } from "../extra-args.ts";
+import { formatFlag, modelFlags, selfActionForceFlag, threadFlag } from "../flags.ts";
+import {
+  ConflictingUpdateFlagsError,
+  MissingThreadError,
+  MissingUpdateFieldsError,
+} from "../error.ts";
+import { requireSelfActionConfirmation } from "../interaction/self-action.ts";
+import { buildModelOptions } from "../model-options.ts";
+import { resolveThreadId } from "../scope/index.ts";
+import { T3Application } from "../../application/service.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
+import { resolveOutputFormat } from "../format/output.ts";
+import { T3Output } from "../output/service.ts";
+
+export const updateThreadCommand = Command.make(
+  "update",
+  {
+    thread: threadFlag,
+    force: selfActionForceFlag,
+    title: Flag.string("title").pipe(Flag.optional),
+    provider: Flag.string("provider").pipe(Flag.optional),
+    model: Flag.string("model").pipe(Flag.optional),
+    ...modelFlags,
+    branch: Flag.string("branch").pipe(Flag.optional),
+    clearBranch: Flag.boolean("clear-branch").pipe(Flag.optional),
+    worktree: Flag.string("worktree").pipe(Flag.optional),
+    clearWorktree: Flag.boolean("clear-worktree").pipe(Flag.optional),
+    format: formatFlag,
+    ...extraArgsConfig,
+  },
+  ({
+    thread,
+    force,
+    title,
+    provider,
+    model,
+    option,
+    reasoningEffort,
+    effort,
+    fastMode,
+    thinking,
+    branch,
+    clearBranch,
+    worktree,
+    clearWorktree,
+    format,
+  }) =>
+    Effect.gen(function* () {
+      const application = yield* T3Application;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
+      const output = yield* T3Output;
+      const threadId = resolveThreadId({
+        value: Option.getOrUndefined(thread),
+        scope: t3CliEnv.scope,
+      });
+      if (threadId === undefined) {
+        return yield* Effect.fail(
+          new MissingThreadError({
+            message: "thread id is required: pass --thread or set T3CODE_THREAD_ID",
+          }),
+        );
+      }
+
+      yield* requireSelfActionConfirmation({
+        threadId,
+        force,
+        cliRuntime,
+        t3CliEnv,
+        action: "update",
+      });
+
+      const titleValue = Option.getOrUndefined(title);
+      const providerValue = Option.getOrUndefined(provider);
+      const modelValue = Option.getOrUndefined(model);
+      const branchValue = Option.getOrUndefined(branch);
+      const worktreeValue = Option.getOrUndefined(worktree);
+      const clearBranchValue = Option.getOrUndefined(clearBranch);
+      const clearWorktreeValue = Option.getOrUndefined(clearWorktree);
+      const options = buildModelOptions({
+        option,
+        reasoningEffort,
+        effort,
+        fastMode,
+        thinking,
+      });
+
+      if (clearBranchValue === true && branchValue !== undefined) {
+        return yield* Effect.fail(
+          new ConflictingUpdateFlagsError({
+            message: "--branch and --clear-branch are mutually exclusive",
+          }),
+        );
+      }
+      if (clearWorktreeValue === true && worktreeValue !== undefined) {
+        return yield* Effect.fail(
+          new ConflictingUpdateFlagsError({
+            message: "--worktree and --clear-worktree are mutually exclusive",
+          }),
+        );
+      }
+
+      const hasTitle = titleValue !== undefined && titleValue.length > 0;
+      const hasProvider = providerValue !== undefined && providerValue.length > 0;
+      const hasModel = modelValue !== undefined && modelValue.length > 0;
+      const hasBranch = branchValue !== undefined && branchValue.length > 0;
+      const hasWorktree = worktreeValue !== undefined && worktreeValue.length > 0;
+      if (
+        !hasTitle &&
+        !hasProvider &&
+        !hasModel &&
+        options.length === 0 &&
+        !hasBranch &&
+        clearBranchValue !== true &&
+        !hasWorktree &&
+        clearWorktreeValue !== true
+      ) {
+        return yield* Effect.fail(
+          new MissingUpdateFieldsError({
+            message:
+              "at least one update field is required: --title, model flags, --branch, --clear-branch, --worktree, or --clear-worktree",
+          }),
+        );
+      }
+
+      const dispatch = yield* application.updateThread({
+        threadId,
+        ...(hasTitle ? { title: titleValue } : {}),
+        ...(hasProvider ? { provider: providerValue } : {}),
+        ...(hasModel ? { model: modelValue } : {}),
+        ...(options.length > 0 ? { options } : {}),
+        ...(clearBranchValue === true
+          ? { branch: null }
+          : hasBranch
+            ? { branch: branchValue }
+            : {}),
+        ...(clearWorktreeValue === true
+          ? { worktreePath: null }
+          : hasWorktree
+            ? { worktreePath: worktreeValue }
+            : {}),
+      });
+      const resolvedFormat = resolveOutputFormat(format, cliRuntime, t3CliEnv, "json");
+      if (resolvedFormat === "json") {
+        return yield* output.printJson(dispatch);
+      }
+      return yield* output.printInfo(`thread updated: ${threadId} (sequence ${dispatch.sequence})`);
+    }),
+).pipe(Command.withDescription("update thread metadata"));

package/src/cli/threads/wait.ts

@@ -2,12 +2,14 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import { Command } from "effect/unstable/cli";
 
+import { extraArgsConfig } from "../extra-args.ts";
 import { threadFlag, waitFormatFlag } from "../flags.ts";
 import { MissingThreadError } from "../error.ts";
-import { resolveThreadId } from "../../scope/index.ts";
-import { Environment } from "../../environment/service.ts";
+import { resolveThreadId } from "../scope/index.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
 import { T3Application } from "../../application/service.ts";
-import { canRenderLiveTerminal, resolveOutputFormat } from "../output-format.ts";
+import { canRenderLiveTerminal, resolveOutputFormat } from "../format/output.ts";
 import { T3Output } from "../output/service.ts";
 import { printWaitEventsHuman, printWaitEventsNdjson } from "../wait-events.ts";
 
@@ -16,15 +18,17 @@ export const waitForThreadCommand = Command.make(
   {
     thread: threadFlag,
     format: waitFormatFlag,
+    ...extraArgsConfig,
   },
   ({ thread, format }) =>
     Effect.gen(function* () {
       const application = yield* T3Application;
-      const environment = yield* Environment;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
       const output = yield* T3Output;
       const threadId = resolveThreadId({
         value: Option.getOrUndefined(thread),
-        env: environment.env,
+        scope: t3CliEnv.scope,
       });
       if (threadId === undefined) {
         return yield* Effect.fail(
@@ -33,13 +37,13 @@ export const waitForThreadCommand = Command.make(
           }),
         );
       }
-      const resolvedFormat = resolveOutputFormat(format, environment, "ndjson");
+      const resolvedFormat = resolveOutputFormat(format, cliRuntime, t3CliEnv, "ndjson");
       if (resolvedFormat === "ndjson") {
         return yield* printWaitEventsNdjson(output, application.watchThread(threadId));
       }
       return yield* printWaitEventsHuman(output, application.watchThread(threadId), {
         threadId,
-        live: canRenderLiveTerminal(environment),
+        live: canRenderLiveTerminal(cliRuntime, t3CliEnv),
       });
     }),
 ).pipe(Command.withDescription("wait for thread to pause"));

package/src/cli/wait-events.ts

@@ -8,7 +8,7 @@ import type { WaitEvent } from "../application/service.ts";
 import { ThreadSessionError } from "../domain/error.ts";
 import { latestAssistantMessage } from "../domain/thread-lifecycle.ts";
 import type { T3Output } from "./output/service.ts";
-import { formatWaitDoneHuman, formatWaitEventNdjson } from "./thread-format.ts";
+import { formatWaitDoneHuman, formatWaitEventNdjson } from "./format/thread.ts";
 
 export function printWaitEventsNdjson(
   output: T3Output["Service"],

package/src/config/config.ts

@@ -0,0 +1,260 @@
+import * as Context from "effect/Context";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+
+import { credentialTokenFromEnv } from "./credential/env.ts";
+import { T3CredentialCrypto } from "./credential/service.ts";
+import { loadT3CliEnv } from "./env/env.ts";
+import { validateEnvironmentName } from "./environment-name/name.ts";
+import { ConfigError } from "./error.ts";
+import { readEncryptedConfigFile, writeEncryptedConfigFile } from "./persist/persist.ts";
+import {
+  buildResolvedConfigFromEnv,
+  buildResolvedConfigFromStored,
+  resolveDefaultForUpsert,
+  selectEnvironmentName,
+  summarizeEnvironments,
+  validateCredentialEnvVars,
+} from "./resolve/resolve.ts";
+import { T3ConfigSelection } from "./selection/service.ts";
+import type { EnvironmentSummary, ResolvedConfig, UpsertEnvironmentInput } from "./types.ts";
+import { normalizeHttpBaseUrl } from "./url/url.ts";
+
+export class T3Config extends Context.Service<
+  T3Config,
+  {
+    readonly resolve: () => Effect.Effect<ResolvedConfig, ConfigError>;
+    readonly resolveActiveEnvironmentName: () => Effect.Effect<string | undefined, ConfigError>;
+    readonly listEnvironments: () => Effect.Effect<readonly EnvironmentSummary[], ConfigError>;
+    readonly upsertEnvironment: (input: UpsertEnvironmentInput) => Effect.Effect<void, ConfigError>;
+    readonly setDefaultEnvironment: (name: string) => Effect.Effect<void, ConfigError>;
+    readonly removeEnvironment: (name: string) => Effect.Effect<void, ConfigError>;
+    readonly hasEnvironment: (name: string) => Effect.Effect<boolean, ConfigError>;
+    readonly getDefaultEnvironmentName: () => Effect.Effect<string | undefined, ConfigError>;
+  }
+>()("t3cli/T3Config") {}
+
+export const make = Effect.fn("makeT3Config")(function* () {
+  const configSelection = yield* T3ConfigSelection;
+  const credentialCrypto = yield* T3CredentialCrypto;
+  const t3CliEnv = yield* loadT3CliEnv;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const configProvider = yield* ConfigProvider.ConfigProvider;
+  const services = Layer.mergeAll(
+    Layer.succeed(FileSystem.FileSystem, fs),
+    Layer.succeed(Path.Path, path),
+    Layer.succeed(T3CredentialCrypto, credentialCrypto),
+    Layer.succeed(ConfigProvider.ConfigProvider, configProvider),
+  );
+
+  const hasEnvironment = Effect.fn("T3Config.hasEnvironment")(function* (name: string) {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    return encrypted.environments[name] !== undefined;
+  });
+
+  const getDefaultEnvironmentName = Effect.fn("T3Config.getDefaultEnvironmentName")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const defaultName = encrypted.default;
+    return defaultName !== undefined && defaultName.length > 0 ? defaultName : undefined;
+  });
+
+  const resolveActiveEnvironmentName = Effect.fn("T3Config.resolveActiveEnvironmentName")(
+    function* () {
+      const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+      const envUrl = Option.getOrUndefined(t3CliEnv.t3codeUrl);
+      const envToken = Option.getOrUndefined(credentialTokenFromEnv(t3CliEnv));
+      yield* validateCredentialEnvVars({ envUrl, envToken });
+      const hasEnvCredentials = envUrl !== undefined && envToken !== undefined;
+      if (hasEnvCredentials) {
+        return undefined;
+      }
+      const configuredEnvironment = yield* configSelection.getSelectedEnvironment();
+      const selectedName = selectEnvironmentName({
+        selectedEnvironment: configuredEnvironment,
+        defaultEnvironment: encrypted.default,
+      });
+      if (selectedName === undefined || selectedName.length === 0) {
+        return undefined;
+      }
+      if (encrypted.environments[selectedName] === undefined) {
+        return undefined;
+      }
+      return selectedName;
+    },
+  );
+
+  const listEnvironments = Effect.fn("T3Config.listEnvironments")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    return summarizeEnvironments(encrypted);
+  });
+
+  const upsertEnvironment = Effect.fn("T3Config.upsertEnvironment")(function* (
+    input: UpsertEnvironmentInput,
+  ) {
+    yield* validateEnvironmentName(input.name);
+    const normalizedUrl = yield* normalizeHttpBaseUrl(input.url).pipe(
+      Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+    );
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const token = yield* credentialCrypto.encrypt({
+      environmentName: input.name,
+      url: normalizedUrl,
+      local: input.local,
+      token: input.token,
+    });
+    const defaultName = resolveDefaultForUpsert(encrypted, input.name, input.makeDefault);
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        version: 2,
+        ...(defaultName !== undefined ? { default: defaultName } : {}),
+        environments: {
+          ...encrypted.environments,
+          [input.name]: {
+            url: normalizedUrl,
+            local: input.local,
+            token,
+          },
+        },
+      }),
+      services,
+    );
+  });
+
+  const setDefaultEnvironment = Effect.fn("T3Config.setDefaultEnvironment")(function* (
+    name: string,
+  ) {
+    yield* validateEnvironmentName(name);
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    if (encrypted.environments[name] === undefined) {
+      return yield* Effect.fail(new ConfigError({ message: `environment not found: ${name}` }));
+    }
+    const selectedEnvironment = encrypted.environments[name];
+    yield* credentialCrypto
+      .decrypt({
+        environmentName: name,
+        url: selectedEnvironment.url,
+        local: selectedEnvironment.local,
+        token: selectedEnvironment.token,
+      })
+      .pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: `failed to decrypt credentials for environment '${name}'`,
+              cause: error.cause,
+            }),
+        ),
+        Effect.asVoid,
+      );
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        ...encrypted,
+        default: name,
+      }),
+      services,
+    );
+    return yield* Effect.void;
+  });
+
+  const removeEnvironment = Effect.fn("T3Config.removeEnvironment")(function* (name: string) {
+    yield* validateEnvironmentName(name);
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    if (encrypted.environments[name] === undefined) {
+      return yield* Effect.fail(new ConfigError({ message: `environment not found: ${name}` }));
+    }
+    const { [name]: _removed, ...environments } = encrypted.environments;
+    const defaultName = encrypted.default === name ? undefined : encrypted.default;
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        version: 2,
+        ...(defaultName !== undefined ? { default: defaultName } : {}),
+        environments,
+      }),
+      services,
+    );
+    return yield* Effect.void;
+  });
+
+  const resolve = Effect.fn("T3Config.resolve")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const envUrl = Option.getOrUndefined(t3CliEnv.t3codeUrl);
+    const envToken = Option.getOrUndefined(credentialTokenFromEnv(t3CliEnv));
+    yield* validateCredentialEnvVars({ envUrl, envToken });
+    const hasEnvUrl = envUrl !== undefined;
+    const configuredEnvironment = yield* configSelection.getSelectedEnvironment();
+    const selectedName = selectEnvironmentName({
+      selectedEnvironment: configuredEnvironment,
+      defaultEnvironment: encrypted.default,
+    });
+
+    if (hasEnvUrl && envToken !== undefined) {
+      if (selectedName !== undefined && selectedName.length > 0) {
+        yield* validateEnvironmentName(selectedName);
+        if (encrypted.environments[selectedName] === undefined) {
+          return yield* Effect.fail(
+            new ConfigError({ message: `environment not found: ${selectedName}` }),
+          );
+        }
+      }
+      return yield* buildResolvedConfigFromEnv({
+        envUrl,
+        envToken,
+      });
+    }
+
+    if (selectedName === undefined || selectedName.length === 0) {
+      return yield* Effect.fail(
+        new ConfigError({
+          message: "not authenticated. run: t3cli auth pair --url <pairing-url>",
+        }),
+      );
+    }
+    yield* validateEnvironmentName(selectedName);
+    if (encrypted.environments[selectedName] === undefined) {
+      return yield* Effect.fail(
+        new ConfigError({ message: `environment not found: ${selectedName}` }),
+      );
+    }
+
+    const selectedEnvironment = encrypted.environments[selectedName];
+    const token = yield* credentialCrypto
+      .decrypt({
+        environmentName: selectedName,
+        url: selectedEnvironment.url,
+        local: selectedEnvironment.local,
+        token: selectedEnvironment.token,
+      })
+      .pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: `failed to decrypt credentials for environment '${selectedName}'`,
+              cause: error.cause,
+            }),
+        ),
+      );
+    return yield* buildResolvedConfigFromStored({
+      selectedName,
+      token,
+      encrypted,
+    });
+  });
+
+  return {
+    resolve,
+    resolveActiveEnvironmentName,
+    listEnvironments,
+    upsertEnvironment,
+    setDefaultEnvironment,
+    removeEnvironment,
+    hasEnvironment,
+    getDefaultEnvironmentName,
+  } as const;
+});
+
+export const layer = Layer.effect(T3Config, make());

package/src/config/credential/cipher-node.ts

@@ -0,0 +1,40 @@
+import { createCipheriv, createDecipheriv } from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { credentialCipherTagByteLength, T3CredentialCipher } from "./cipher.ts";
+import { CredentialCipherError } from "./error.ts";
+
+const make = (): T3CredentialCipher["Service"] => ({
+  encrypt: (input) =>
+    Effect.try({
+      try: () => {
+        const cipher = createCipheriv("aes-256-gcm", input.key, input.nonce, {
+          authTagLength: credentialCipherTagByteLength,
+        });
+        cipher.setAAD(input.additionalData);
+        const ciphertext = Buffer.concat([cipher.update(input.plaintext), cipher.final()]);
+        return {
+          ciphertext: new Uint8Array(ciphertext),
+          tag: new Uint8Array(cipher.getAuthTag()),
+        };
+      },
+      catch: (cause) => new CredentialCipherError({ operation: "encrypt", cause }),
+    }),
+  decrypt: (input) =>
+    Effect.try({
+      try: () => {
+        const decipher = createDecipheriv("aes-256-gcm", input.key, input.nonce, {
+          authTagLength: credentialCipherTagByteLength,
+        });
+        decipher.setAAD(input.additionalData);
+        decipher.setAuthTag(input.tag);
+        const plaintext = Buffer.concat([decipher.update(input.ciphertext), decipher.final()]);
+        return new Uint8Array(plaintext);
+      },
+      catch: (cause) => new CredentialCipherError({ operation: "decrypt", cause }),
+    }),
+});
+
+export const layerNode = Layer.succeed(T3CredentialCipher, make());