[Bug]: SecretStoreError: Failed to read secret server-signing-key (username should be redacted)

[benjaminforras]

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

Not sure

Steps to reproduce

1. Run npx t3 version 0.0.16 using Node v24.11.0 and npm 11.6.1 on macOS
2. Let all migrations complete
3. Observe the error after migrations

Note: The logs below have the username removed for privacy.

Expected behavior

Migrations and secret loading should succeed without error.

Actual behavior

The following error appears:

[19:33:34.860] INFO (#1): Running all migrations...
[19:33:34.862] INFO (#1): Migrations ran successfully
  migrations: []
(node:56737) ExperimentalWarning: SQLite is an experimental feature and might change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
[19:33:34.866] ERROR (#1): SecretStoreError: Failed to read secret server-signing-key.
    at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/dist/bin.mjs:23202:214
    at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/node_modules/effect/dist/internal/effect.js:1220:96
    at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/node_modules/effect/dist/internal/effect.js:1217:76
    at ~effect/Utils/internal (file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/node_modules/effect/dist/Utils.js:69:12) {
  [cause]: PlatformError: NotFound: FileSystem.readFile (/Users/[USERNAME REDACTED]/.t3/userdata/secrets/server-signing-key.bin)
      at Module.systemError (file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/effect/dist/PlatformError.js:59:39)
      at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/@effect/platform-node-shared/dist/internal/utils.js:28:24
      at ReadFileContext.callback (file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/@effect/platform-node-shared/dist/NodeFileSystem.js:261:74)
      at FSReqCallback.readFileAfterOpen [as oncomplete] (node:fs:297:13) {
    [cause]: Error: ENOENT: no such file or directory, open '/Users/[USERNAME REDACTED]/.t3/userdata/secrets/server-signing-key.bin'
  }
}

Impact

Major degradation or frequent failure

Version or commit

npx t3 v0.0.16

Environment

macOS, Node v24.11.0, npm 11.6.1

Logs or stack traces

[19:33:34.860] INFO (#1): Running all migrations...
[19:33:34.862] INFO (#1): Migrations ran successfully
  migrations: []
(node:56737) ExperimentalWarning: SQLite is an experimental feature and might change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
[19:33:34.866] ERROR (#1): SecretStoreError: Failed to read secret server-signing-key.
    at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/dist/bin.mjs:23202:214
    at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/node_modules/effect/dist/internal/effect.js:1220:96
    at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/node_modules/effect/dist/internal/effect.js:1217:76
    at ~effect/Utils/internal (file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/t3/node_modules/effect/dist/Utils.js:69:12) {
  [cause]: PlatformError: NotFound: FileSystem.readFile (/Users/[USERNAME REDACTED]/.t3/userdata/secrets/server-signing-key.bin)
      at Module.systemError (file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/effect/dist/PlatformError.js:59:39)
      at file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/@effect/platform-node-shared/dist/internal/utils.js:28:24
      at ReadFileContext.callback (file:///Users/[USERNAME REDACTED]/.npm/_npx/5ca66e5ae19a7ff4/node_modules/@effect/platform-node-shared/dist/NodeFileSystem.js:261:74)
      at FSReqCallback.readFileAfterOpen [as oncomplete] (node:fs:297:13) {
    [cause]: Error: ENOENT: no such file or directory, open '/Users/[USERNAME REDACTED]/.t3/userdata/secrets/server-signing-key.bin'
  }
}

Screenshots, recordings, or supporting files

No response

Workaround

No workaround found-unable to proceed past this error.

[ben-vargas]

Same issue for me, t3 broken now...

Note

This root cause analysis was produced by Claude Opus 4.6 and validated by Codex (GPT 5.4). It has not been verified by a human maintainer.

Root cause: When t3@0.0.16 is installed via npx/npm, the @effect/platform-node-shared transitive dependency resolves to 4.0.0-beta.46 (because @effect/platform-node@beta.45 declares ^4.0.0-beta.45 for it), which pulls in effect@4.0.0-beta.46 at the top level. Meanwhile t3 pins effect@4.0.0-beta.45, so npm installs a second copy under t3/node_modules/effect/.

The ServerSecretStore uses instanceof PlatformError.PlatformError to detect missing-file errors. The bundle's external import resolves to effect@beta.45's class, but the filesystem layer (@effect/platform-node-shared@beta.46) creates error instances using effect@beta.46's class. Different class objects → instanceof returns false → the NotFound case isn't recognized → the signing key is never auto-generated on first run.

Fix is replacing instanceof with a structural _tag-based check.

[Yoryoboy]

I had the same issue on my machine, so it does not appear to be macOS-specific. (the workaround that fixed startup for me is below)

Environment where I reproduced it:

• OS: CachyOS Linux, Arch-like rolling distro
• Kernel: Linux 6.19.10-1-cachyos x86_64
• Node: v24.14.1
• npm: 11.11.0
• t3: v0.0.16, run via npx t3

The failure was the same:

SecretStoreError: Failed to read secret server-signing-key.
[cause]: PlatformError: NotFound: FileSystem.readFile (/home/[USERNAME]/.t3/userdata/secrets/server-signing-key.bin)
[cause]: Error: ENOENT: no such file or directory, open '/home/[USERNAME]/.t3/userdata/secrets/server-signing-key.bin'

After debugging the installed npx package tree, this looks like a dependency/version mismatch in the Effect packages rather than a corrupted local ~/.t3
directory.

In the npx install, I saw two different effect versions:

t3/node_modules/effect 4.0.0-beta.45
node_modules/effect 4.0.0-beta.46
node_modules/@effect/platform-node-shared 4.0.0-beta.46

t3@0.0.16 pins:

effect: 4.0.0-beta.45
@effect/platform-node: 4.0.0-beta.45

But @effect/platform-node@4.0.0-beta.45 depends on:

@effect/platform-node-shared: ^4.0.0-beta.45

So npm is allowed to install @effect/platform-node-shared@4.0.0-beta.46, which brings in/uses effect@4.0.0-beta.46.

The relevant t3 code appears to check the missing-secret condition with an instanceof PlatformError.PlatformError check. Since the filesystem error is coming from a different copy/version of effect, that instanceof check appears to fail. As a result, the missing first-run secret is treated as fatal instead of being handled as “secret does not exist yet, create it”.

A workaround that fixed startup for me was to manually create the local signing key file that t3 was supposed to create on first run:

 mkdir -p ~/.t3/userdata/secrets
 chmod 700 ~/.t3/userdata/secrets
 test -f ~/.t3/userdata/secrets/server-signing-key.bin || node -e "require('fs').writeFileSync(process.env.HOME + '/.t3/userdata/secrets/server-signing-
 key.bin', require('crypto').randomBytes(32), { mode: 0o600 })"
 chmod 600 ~/.t3/userdata/secrets/server-signing-key.bin

After that, npx t3 started successfully.

[AxxiD]

A workaround that fixed startup for me was to manually create the local signing key file that t3 was supposed to create on first run:

 mkdir -p ~/.t3/userdata/secrets
 chmod 700 ~/.t3/userdata/secrets
 test -f ~/.t3/userdata/secrets/server-signing-key.bin || node -e "require('fs').writeFileSync(process.env.HOME + '/.t3/userdata/secrets/server-signing-
 key.bin', require('crypto').randomBytes(32), { mode: 0o600 })"
 chmod 600 ~/.t3/userdata/secrets/server-signing-key.bin

Can confirm that the workaround by creating my own server-signing-key.bin file works and npx t3 now starts again with the new version.

Running it on Ubuntu 24.04 server.