Use idiomatic Effect options for server secret reads

[cursor]

What Changed

• Changed ServerSecretStore.get to return Option<Uint8Array> instead of Uint8Array | null.
• Replaced SecretStoreError with a serializable Schema.TaggedErrorClass.
• Updated server secret consumers and focused tests to unwrap Option explicitly.

Why

This makes the server auth/cloud secret handling more idiomatic Effect by using typed absence instead of nullable values and structured tagged errors that serialize cleanly.

UI Changes

Not applicable; this is a server/internal Effect refactor.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

  

Note

Replace null returns with Option type in ServerSecretStore.get

• Changes ServerSecretStoreShape.get to return Option<Uint8Array> instead of Uint8Array | null, using Option.none for missing secrets and Option.some for found ones.
• Updates all call sites across auth, cloud, relay, and settings modules to check Option.isSome and unwrap .value before use.
• getOrCreateRandom and getOrCreateEnvironmentKeyPairFromSecretStore are rewritten to use Option.match branching instead of null checks.
• SecretStoreError is migrated from Data.TaggedError to Schema.TaggedErrorClass with an explicit schema.
• Behavioral Change: any consumer previously checking !== null on secret reads must now use Option.isSome; the new Schema.TaggedErrorClass shape may differ from the old Data.TaggedError in serialization.

^{Macroscope summarized 1365314.}

---

Note

Medium Risk
Broad refactor across auth, cloud linking, and settings secret reads; behavior should match prior null semantics, but the error class change may affect instanceof SecretStoreError at boundaries.

Overview
ServerSecretStore.get now returns Option<Uint8Array> instead of Uint8Array | null. Missing secrets are Option.none(); reads use Option.isSome / Option.isNone and .value instead of null checks.

SecretStoreError is now a Schema.TaggedErrorClass (serializable schema for message and optional cause) instead of Data.TaggedError. getOrCreateRandom and related paths use Option.match for existing vs missing secrets.

Call sites are updated across cloud/CLI/relay/settings (link state, OAuth tokens, environment keys, relay config, provider env secrets, agent awareness). Tests switch to assert from @effect/vitest and assert Option shapes.

^{Reviewed by Cursor Bugbot for commit 1365314. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🚀 Expo continuous deployment is ready!

• Project → t3-code
• Platforms → android, ios
• Scheme → t3code-preview

	🤖 Android	🍎 iOS
Fingerprint	27e228668e373d1941548dc669856ecf3fd6261f	fa880122b8876ecaafbb21281d21e292d7b09484
Build Details	Build Permalink Details Distribution: INTERNAL Build profile: preview:dev Runtime version: 27e228668e373d1941548dc669856ecf3fd6261f App version: 0.1.0 Git commit: f824b8cdb8f4e7b9c4ab8c46bb09aaf298e687f3	Build Permalink Details Distribution: INTERNAL Build profile: preview:dev Runtime version: fa880122b8876ecaafbb21281d21e292d7b09484 App version: 0.1.0 Git commit: 8ef95c479ae1c01cbd33365fe792b762398ffd5d
Update Details	Update Permalink Details Branch: pr-3110 Runtime version: 27e228668e373d1941548dc669856ecf3fd6261f Git commit: f824b8cdb8f4e7b9c4ab8c46bb09aaf298e687f3	Update Permalink Details Branch: pr-3110 Runtime version: fa880122b8876ecaafbb21281d21e292d7b09484 Git commit: f824b8cdb8f4e7b9c4ab8c46bb09aaf298e687f3
Update QR

[macroscopeapp]

Approvability

Verdict: Approved

Mechanical refactor replacing null-based optional values with Effect's idiomatic Option type throughout the secret store API. All call sites are updated with equivalent logic, and tests verify the same behaviors with updated assertions.

^{You can customize Macroscope's approvability policy. Learn more.}