t3code-cli 0.11.0 → 0.13.0

package/src/cli/threads/start.ts

@@ -3,16 +3,18 @@ import * as Option from "effect/Option";
 import * as Stream from "effect/Stream";
 import { Argument, Command, Flag } from "effect/unstable/cli";
 
+import { extraArgsConfig } from "../extra-args.ts";
 import { modelFlags, projectFlag, threadFormatFlag, worktreeFlag } from "../flags.ts";
 import { readInitialMessage } from "../message-input.ts";
 import { buildModelOptions } from "../model-options.ts";
 import { requireCommandProjectRef } from "../require.ts";
-import { resolveWorktreePath } from "../../scope/index.ts";
-import { formatThreadStartedHuman } from "../thread-format.ts";
+import { resolveWorktreePath } from "../scope/index.ts";
+import { formatThreadStartedHuman } from "../format/thread.ts";
 import { T3Application } from "../../application/service.ts";
-import { Environment } from "../../environment/service.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
 import { T3Input } from "../input/service.ts";
-import { canRenderLiveTerminal, resolveOutputFormat } from "../output-format.ts";
+import { canRenderLiveTerminal, resolveOutputFormat } from "../format/output.ts";
 import { T3Output } from "../output/service.ts";
 import { printWaitEventsHuman, printWaitEventsNdjson } from "../wait-events.ts";
 
@@ -29,6 +31,7 @@ export const startThreadCommand = Command.make(
     ...modelFlags,
     wait: Flag.boolean("wait"),
     format: threadFormatFlag,
+    ...extraArgsConfig,
   },
   ({
     project,
@@ -64,16 +67,13 @@ export const startThreadCommand = Command.make(
         thinking,
       });
       const application = yield* T3Application;
-      const environment = yield* Environment;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
       const output = yield* T3Output;
-      const projectRef = yield* requireCommandProjectRef({
-        project,
-        env: environment.env,
-        cwd: environment.cwd,
-      });
+      const projectRef = yield* requireCommandProjectRef({ project });
       const worktreePath = resolveWorktreePath({
         value: Option.getOrUndefined(worktree),
-        env: environment.env,
+        scope: t3CliEnv.scope,
       });
       const input = {
         message: text,
@@ -86,7 +86,12 @@ export const startThreadCommand = Command.make(
         ...(modelValue !== undefined && modelValue.length > 0 ? { model: modelValue } : {}),
         ...(options.length > 0 ? { options } : {}),
       };
-      const resolvedFormat = resolveOutputFormat(format, environment, wait ? "ndjson" : "json");
+      const resolvedFormat = resolveOutputFormat(
+        format,
+        cliRuntime,
+        t3CliEnv,
+        wait ? "ndjson" : "json",
+      );
 
       if (resolvedFormat === "ndjson") {
         const started = yield* application.startThread(input, {
@@ -117,7 +122,7 @@ export const startThreadCommand = Command.make(
         }
         yield* printWaitEventsHuman(output, application.watchThread(started.threadId), {
           threadId: started.threadId,
-          live: canRenderLiveTerminal(environment),
+          live: canRenderLiveTerminal(cliRuntime, t3CliEnv),
         });
         return;
       }

package/src/cli/threads/unarchive.ts

@@ -2,12 +2,14 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import { Command } from "effect/unstable/cli";
 
+import { extraArgsConfig } from "../extra-args.ts";
 import { formatFlag, threadFlag } from "../flags.ts";
 import { MissingThreadError } from "../error.ts";
-import { resolveThreadId } from "../../scope/index.ts";
+import { resolveThreadId } from "../scope/index.ts";
 import { T3Application } from "../../application/service.ts";
-import { Environment } from "../../environment/service.ts";
-import { resolveOutputFormat } from "../output-format.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
+import { resolveOutputFormat } from "../format/output.ts";
 import { T3Output } from "../output/service.ts";
 
 export const unarchiveThreadCommand = Command.make(
@@ -15,15 +17,17 @@ export const unarchiveThreadCommand = Command.make(
   {
     thread: threadFlag,
     format: formatFlag,
+    ...extraArgsConfig,
   },
   ({ thread, format }) =>
     Effect.gen(function* () {
       const application = yield* T3Application;
-      const environment = yield* Environment;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
       const output = yield* T3Output;
       const threadId = resolveThreadId({
         value: Option.getOrUndefined(thread),
-        env: environment.env,
+        scope: t3CliEnv.scope,
       });
       if (threadId === undefined) {
         return yield* Effect.fail(
@@ -32,13 +36,13 @@ export const unarchiveThreadCommand = Command.make(
           }),
         );
       }
-      const resolvedFormat = resolveOutputFormat(format, environment, "json");
+      const resolvedFormat = resolveOutputFormat(format, cliRuntime, t3CliEnv, "json");
       const dispatch = yield* application.unarchiveThread(threadId);
       if (resolvedFormat === "json") {
         return yield* output.printJson(dispatch);
       }
       return yield* output.printInfo(
-        `thread unarchived: ${threadId}\nsequence: ${dispatch.sequence}`,
+        `thread unarchived: ${threadId} (sequence ${dispatch.sequence})`,
       );
     }),
 ).pipe(Command.withDescription("unarchive thread"));

package/src/cli/threads/update.ts

@@ -2,18 +2,20 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import { Command, Flag } from "effect/unstable/cli";
 
+import { extraArgsConfig } from "../extra-args.ts";
 import { formatFlag, modelFlags, selfActionForceFlag, threadFlag } from "../flags.ts";
 import {
   ConflictingUpdateFlagsError,
   MissingThreadError,
   MissingUpdateFieldsError,
 } from "../error.ts";
-import { requireSelfActionConfirmation } from "../self-action.ts";
+import { requireSelfActionConfirmation } from "../interaction/self-action.ts";
 import { buildModelOptions } from "../model-options.ts";
-import { resolveThreadId } from "../../scope/index.ts";
+import { resolveThreadId } from "../scope/index.ts";
 import { T3Application } from "../../application/service.ts";
-import { Environment } from "../../environment/service.ts";
-import { resolveOutputFormat } from "../output-format.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
+import { resolveOutputFormat } from "../format/output.ts";
 import { T3Output } from "../output/service.ts";
 
 export const updateThreadCommand = Command.make(
@@ -30,6 +32,7 @@ export const updateThreadCommand = Command.make(
     worktree: Flag.string("worktree").pipe(Flag.optional),
     clearWorktree: Flag.boolean("clear-worktree").pipe(Flag.optional),
     format: formatFlag,
+    ...extraArgsConfig,
   },
   ({
     thread,
@@ -50,11 +53,12 @@ export const updateThreadCommand = Command.make(
   }) =>
     Effect.gen(function* () {
       const application = yield* T3Application;
-      const environment = yield* Environment;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
       const output = yield* T3Output;
       const threadId = resolveThreadId({
         value: Option.getOrUndefined(thread),
-        env: environment.env,
+        scope: t3CliEnv.scope,
       });
       if (threadId === undefined) {
         return yield* Effect.fail(
@@ -67,7 +71,8 @@ export const updateThreadCommand = Command.make(
       yield* requireSelfActionConfirmation({
         threadId,
         force,
-        environment,
+        cliRuntime,
+        t3CliEnv,
         action: "update",
       });
 
@@ -141,10 +146,10 @@ export const updateThreadCommand = Command.make(
             ? { worktreePath: worktreeValue }
             : {}),
       });
-      const resolvedFormat = resolveOutputFormat(format, environment, "json");
+      const resolvedFormat = resolveOutputFormat(format, cliRuntime, t3CliEnv, "json");
       if (resolvedFormat === "json") {
         return yield* output.printJson(dispatch);
       }
-      return yield* output.printInfo(`thread updated: ${threadId}\nsequence: ${dispatch.sequence}`);
+      return yield* output.printInfo(`thread updated: ${threadId} (sequence ${dispatch.sequence})`);
     }),
 ).pipe(Command.withDescription("update thread metadata"));

package/src/cli/threads/wait.ts

@@ -2,12 +2,14 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import { Command } from "effect/unstable/cli";
 
+import { extraArgsConfig } from "../extra-args.ts";
 import { threadFlag, waitFormatFlag } from "../flags.ts";
 import { MissingThreadError } from "../error.ts";
-import { resolveThreadId } from "../../scope/index.ts";
-import { Environment } from "../../environment/service.ts";
+import { resolveThreadId } from "../scope/index.ts";
+import { CliRuntime } from "../../cli/runtime/service.ts";
+import { loadT3CliEnv } from "../../config/env/env.ts";
 import { T3Application } from "../../application/service.ts";
-import { canRenderLiveTerminal, resolveOutputFormat } from "../output-format.ts";
+import { canRenderLiveTerminal, resolveOutputFormat } from "../format/output.ts";
 import { T3Output } from "../output/service.ts";
 import { printWaitEventsHuman, printWaitEventsNdjson } from "../wait-events.ts";
 
@@ -16,15 +18,17 @@ export const waitForThreadCommand = Command.make(
   {
     thread: threadFlag,
     format: waitFormatFlag,
+    ...extraArgsConfig,
   },
   ({ thread, format }) =>
     Effect.gen(function* () {
       const application = yield* T3Application;
-      const environment = yield* Environment;
+      const cliRuntime = yield* CliRuntime;
+      const t3CliEnv = yield* loadT3CliEnv;
       const output = yield* T3Output;
       const threadId = resolveThreadId({
         value: Option.getOrUndefined(thread),
-        env: environment.env,
+        scope: t3CliEnv.scope,
       });
       if (threadId === undefined) {
         return yield* Effect.fail(
@@ -33,13 +37,13 @@ export const waitForThreadCommand = Command.make(
           }),
         );
       }
-      const resolvedFormat = resolveOutputFormat(format, environment, "ndjson");
+      const resolvedFormat = resolveOutputFormat(format, cliRuntime, t3CliEnv, "ndjson");
       if (resolvedFormat === "ndjson") {
         return yield* printWaitEventsNdjson(output, application.watchThread(threadId));
       }
       return yield* printWaitEventsHuman(output, application.watchThread(threadId), {
         threadId,
-        live: canRenderLiveTerminal(environment),
+        live: canRenderLiveTerminal(cliRuntime, t3CliEnv),
       });
     }),
 ).pipe(Command.withDescription("wait for thread to pause"));

package/src/cli/wait-events.ts

@@ -8,7 +8,7 @@ import type { WaitEvent } from "../application/service.ts";
 import { ThreadSessionError } from "../domain/error.ts";
 import { latestAssistantMessage } from "../domain/thread-lifecycle.ts";
 import type { T3Output } from "./output/service.ts";
-import { formatWaitDoneHuman, formatWaitEventNdjson } from "./thread-format.ts";
+import { formatWaitDoneHuman, formatWaitEventNdjson } from "./format/thread.ts";
 
 export function printWaitEventsNdjson(
   output: T3Output["Service"],

package/src/config/config.ts

@@ -0,0 +1,260 @@
+import * as Context from "effect/Context";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+
+import { credentialTokenFromEnv } from "./credential/env.ts";
+import { T3CredentialCrypto } from "./credential/service.ts";
+import { loadT3CliEnv } from "./env/env.ts";
+import { validateEnvironmentName } from "./environment-name/name.ts";
+import { ConfigError } from "./error.ts";
+import { readEncryptedConfigFile, writeEncryptedConfigFile } from "./persist/persist.ts";
+import {
+  buildResolvedConfigFromEnv,
+  buildResolvedConfigFromStored,
+  resolveDefaultForUpsert,
+  selectEnvironmentName,
+  summarizeEnvironments,
+  validateCredentialEnvVars,
+} from "./resolve/resolve.ts";
+import { T3ConfigSelection } from "./selection/service.ts";
+import type { EnvironmentSummary, ResolvedConfig, UpsertEnvironmentInput } from "./types.ts";
+import { normalizeHttpBaseUrl } from "./url/url.ts";
+
+export class T3Config extends Context.Service<
+  T3Config,
+  {
+    readonly resolve: () => Effect.Effect<ResolvedConfig, ConfigError>;
+    readonly resolveActiveEnvironmentName: () => Effect.Effect<string | undefined, ConfigError>;
+    readonly listEnvironments: () => Effect.Effect<readonly EnvironmentSummary[], ConfigError>;
+    readonly upsertEnvironment: (input: UpsertEnvironmentInput) => Effect.Effect<void, ConfigError>;
+    readonly setDefaultEnvironment: (name: string) => Effect.Effect<void, ConfigError>;
+    readonly removeEnvironment: (name: string) => Effect.Effect<void, ConfigError>;
+    readonly hasEnvironment: (name: string) => Effect.Effect<boolean, ConfigError>;
+    readonly getDefaultEnvironmentName: () => Effect.Effect<string | undefined, ConfigError>;
+  }
+>()("t3cli/T3Config") {}
+
+export const make = Effect.fn("makeT3Config")(function* () {
+  const configSelection = yield* T3ConfigSelection;
+  const credentialCrypto = yield* T3CredentialCrypto;
+  const t3CliEnv = yield* loadT3CliEnv;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const configProvider = yield* ConfigProvider.ConfigProvider;
+  const services = Layer.mergeAll(
+    Layer.succeed(FileSystem.FileSystem, fs),
+    Layer.succeed(Path.Path, path),
+    Layer.succeed(T3CredentialCrypto, credentialCrypto),
+    Layer.succeed(ConfigProvider.ConfigProvider, configProvider),
+  );
+
+  const hasEnvironment = Effect.fn("T3Config.hasEnvironment")(function* (name: string) {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    return encrypted.environments[name] !== undefined;
+  });
+
+  const getDefaultEnvironmentName = Effect.fn("T3Config.getDefaultEnvironmentName")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const defaultName = encrypted.default;
+    return defaultName !== undefined && defaultName.length > 0 ? defaultName : undefined;
+  });
+
+  const resolveActiveEnvironmentName = Effect.fn("T3Config.resolveActiveEnvironmentName")(
+    function* () {
+      const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+      const envUrl = Option.getOrUndefined(t3CliEnv.t3codeUrl);
+      const envToken = Option.getOrUndefined(credentialTokenFromEnv(t3CliEnv));
+      yield* validateCredentialEnvVars({ envUrl, envToken });
+      const hasEnvCredentials = envUrl !== undefined && envToken !== undefined;
+      if (hasEnvCredentials) {
+        return undefined;
+      }
+      const configuredEnvironment = yield* configSelection.getSelectedEnvironment();
+      const selectedName = selectEnvironmentName({
+        selectedEnvironment: configuredEnvironment,
+        defaultEnvironment: encrypted.default,
+      });
+      if (selectedName === undefined || selectedName.length === 0) {
+        return undefined;
+      }
+      if (encrypted.environments[selectedName] === undefined) {
+        return undefined;
+      }
+      return selectedName;
+    },
+  );
+
+  const listEnvironments = Effect.fn("T3Config.listEnvironments")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    return summarizeEnvironments(encrypted);
+  });
+
+  const upsertEnvironment = Effect.fn("T3Config.upsertEnvironment")(function* (
+    input: UpsertEnvironmentInput,
+  ) {
+    yield* validateEnvironmentName(input.name);
+    const normalizedUrl = yield* normalizeHttpBaseUrl(input.url).pipe(
+      Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+    );
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const token = yield* credentialCrypto.encrypt({
+      environmentName: input.name,
+      url: normalizedUrl,
+      local: input.local,
+      token: input.token,
+    });
+    const defaultName = resolveDefaultForUpsert(encrypted, input.name, input.makeDefault);
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        version: 2,
+        ...(defaultName !== undefined ? { default: defaultName } : {}),
+        environments: {
+          ...encrypted.environments,
+          [input.name]: {
+            url: normalizedUrl,
+            local: input.local,
+            token,
+          },
+        },
+      }),
+      services,
+    );
+  });
+
+  const setDefaultEnvironment = Effect.fn("T3Config.setDefaultEnvironment")(function* (
+    name: string,
+  ) {
+    yield* validateEnvironmentName(name);
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    if (encrypted.environments[name] === undefined) {
+      return yield* Effect.fail(new ConfigError({ message: `environment not found: ${name}` }));
+    }
+    const selectedEnvironment = encrypted.environments[name];
+    yield* credentialCrypto
+      .decrypt({
+        environmentName: name,
+        url: selectedEnvironment.url,
+        local: selectedEnvironment.local,
+        token: selectedEnvironment.token,
+      })
+      .pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: `failed to decrypt credentials for environment '${name}'`,
+              cause: error.cause,
+            }),
+        ),
+        Effect.asVoid,
+      );
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        ...encrypted,
+        default: name,
+      }),
+      services,
+    );
+    return yield* Effect.void;
+  });
+
+  const removeEnvironment = Effect.fn("T3Config.removeEnvironment")(function* (name: string) {
+    yield* validateEnvironmentName(name);
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    if (encrypted.environments[name] === undefined) {
+      return yield* Effect.fail(new ConfigError({ message: `environment not found: ${name}` }));
+    }
+    const { [name]: _removed, ...environments } = encrypted.environments;
+    const defaultName = encrypted.default === name ? undefined : encrypted.default;
+    yield* Effect.provide(
+      writeEncryptedConfigFile({
+        version: 2,
+        ...(defaultName !== undefined ? { default: defaultName } : {}),
+        environments,
+      }),
+      services,
+    );
+    return yield* Effect.void;
+  });
+
+  const resolve = Effect.fn("T3Config.resolve")(function* () {
+    const encrypted = yield* Effect.provide(readEncryptedConfigFile(), services);
+    const envUrl = Option.getOrUndefined(t3CliEnv.t3codeUrl);
+    const envToken = Option.getOrUndefined(credentialTokenFromEnv(t3CliEnv));
+    yield* validateCredentialEnvVars({ envUrl, envToken });
+    const hasEnvUrl = envUrl !== undefined;
+    const configuredEnvironment = yield* configSelection.getSelectedEnvironment();
+    const selectedName = selectEnvironmentName({
+      selectedEnvironment: configuredEnvironment,
+      defaultEnvironment: encrypted.default,
+    });
+
+    if (hasEnvUrl && envToken !== undefined) {
+      if (selectedName !== undefined && selectedName.length > 0) {
+        yield* validateEnvironmentName(selectedName);
+        if (encrypted.environments[selectedName] === undefined) {
+          return yield* Effect.fail(
+            new ConfigError({ message: `environment not found: ${selectedName}` }),
+          );
+        }
+      }
+      return yield* buildResolvedConfigFromEnv({
+        envUrl,
+        envToken,
+      });
+    }
+
+    if (selectedName === undefined || selectedName.length === 0) {
+      return yield* Effect.fail(
+        new ConfigError({
+          message: "not authenticated. run: t3cli auth pair --url <pairing-url>",
+        }),
+      );
+    }
+    yield* validateEnvironmentName(selectedName);
+    if (encrypted.environments[selectedName] === undefined) {
+      return yield* Effect.fail(
+        new ConfigError({ message: `environment not found: ${selectedName}` }),
+      );
+    }
+
+    const selectedEnvironment = encrypted.environments[selectedName];
+    const token = yield* credentialCrypto
+      .decrypt({
+        environmentName: selectedName,
+        url: selectedEnvironment.url,
+        local: selectedEnvironment.local,
+        token: selectedEnvironment.token,
+      })
+      .pipe(
+        Effect.mapError(
+          (error) =>
+            new ConfigError({
+              message: `failed to decrypt credentials for environment '${selectedName}'`,
+              cause: error.cause,
+            }),
+        ),
+      );
+    return yield* buildResolvedConfigFromStored({
+      selectedName,
+      token,
+      encrypted,
+    });
+  });
+
+  return {
+    resolve,
+    resolveActiveEnvironmentName,
+    listEnvironments,
+    upsertEnvironment,
+    setDefaultEnvironment,
+    removeEnvironment,
+    hasEnvironment,
+    getDefaultEnvironmentName,
+  } as const;
+});
+
+export const layer = Layer.effect(T3Config, make());

package/src/config/credential/cipher-node.ts

@@ -0,0 +1,40 @@
+import { createCipheriv, createDecipheriv } from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { credentialCipherTagByteLength, T3CredentialCipher } from "./cipher.ts";
+import { CredentialCipherError } from "./error.ts";
+
+const make = (): T3CredentialCipher["Service"] => ({
+  encrypt: (input) =>
+    Effect.try({
+      try: () => {
+        const cipher = createCipheriv("aes-256-gcm", input.key, input.nonce, {
+          authTagLength: credentialCipherTagByteLength,
+        });
+        cipher.setAAD(input.additionalData);
+        const ciphertext = Buffer.concat([cipher.update(input.plaintext), cipher.final()]);
+        return {
+          ciphertext: new Uint8Array(ciphertext),
+          tag: new Uint8Array(cipher.getAuthTag()),
+        };
+      },
+      catch: (cause) => new CredentialCipherError({ operation: "encrypt", cause }),
+    }),
+  decrypt: (input) =>
+    Effect.try({
+      try: () => {
+        const decipher = createDecipheriv("aes-256-gcm", input.key, input.nonce, {
+          authTagLength: credentialCipherTagByteLength,
+        });
+        decipher.setAAD(input.additionalData);
+        decipher.setAuthTag(input.tag);
+        const plaintext = Buffer.concat([decipher.update(input.ciphertext), decipher.final()]);
+        return new Uint8Array(plaintext);
+      },
+      catch: (cause) => new CredentialCipherError({ operation: "decrypt", cause }),
+    }),
+});
+
+export const layerNode = Layer.succeed(T3CredentialCipher, make());

package/src/config/credential/cipher-web.ts

@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { credentialCipherTagByteLength, T3CredentialCipher } from "./cipher.ts";
+import { CredentialCipherError } from "./error.ts";
+
+const aesGcmAlgorithm = "AES-GCM";
+
+function copyBytes(bytes: Uint8Array) {
+  const copy = new Uint8Array(bytes.byteLength);
+  copy.set(bytes);
+  return copy;
+}
+
+function importAesGcmKey(key: Uint8Array, operation: "encrypt" | "decrypt") {
+  return Effect.tryPromise({
+    try: () =>
+      globalThis.crypto.subtle.importKey("raw", copyBytes(key), { name: aesGcmAlgorithm }, false, [
+        "encrypt",
+        "decrypt",
+      ]),
+    catch: (cause) => new CredentialCipherError({ operation, cause }),
+  });
+}
+
+const make = (): T3CredentialCipher["Service"] => ({
+  encrypt: (input) =>
+    Effect.gen(function* () {
+      const cryptoKey = yield* importAesGcmKey(input.key, "encrypt");
+      const encrypted = yield* Effect.tryPromise({
+        try: () =>
+          globalThis.crypto.subtle.encrypt(
+            {
+              name: aesGcmAlgorithm,
+              iv: copyBytes(input.nonce),
+              additionalData: copyBytes(input.additionalData),
+              tagLength: credentialCipherTagByteLength * 8,
+            },
+            cryptoKey,
+            copyBytes(input.plaintext),
+          ),
+        catch: (cause) => new CredentialCipherError({ operation: "encrypt", cause }),
+      });
+      const bytes = new Uint8Array(encrypted);
+      if (bytes.byteLength < credentialCipherTagByteLength) {
+        return yield* Effect.fail(
+          new CredentialCipherError({
+            operation: "encrypt",
+            cause: new Error("encrypted output shorter than auth tag"),
+          }),
+        );
+      }
+      return {
+        ciphertext: bytes.slice(0, -credentialCipherTagByteLength),
+        tag: bytes.slice(-credentialCipherTagByteLength),
+      };
+    }),
+  decrypt: (input) =>
+    Effect.gen(function* () {
+      const cryptoKey = yield* importAesGcmKey(input.key, "decrypt");
+      const combined = new Uint8Array(input.ciphertext.byteLength + input.tag.byteLength);
+      combined.set(input.ciphertext);
+      combined.set(input.tag, input.ciphertext.byteLength);
+      const plaintext = yield* Effect.tryPromise({
+        try: () =>
+          globalThis.crypto.subtle.decrypt(
+            {
+              name: aesGcmAlgorithm,
+              iv: copyBytes(input.nonce),
+              additionalData: copyBytes(input.additionalData),
+              tagLength: credentialCipherTagByteLength * 8,
+            },
+            cryptoKey,
+            combined,
+          ),
+        catch: (cause) => new CredentialCipherError({ operation: "decrypt", cause }),
+      });
+      return new Uint8Array(plaintext);
+    }),
+});
+
+export const layerWeb = Layer.succeed(T3CredentialCipher, make());