import { describe, expect, it } from "@effect/vitest";import { Effect, Exit } from "effect"; import { IdentityProvider } from "@executor-js/api/server"; import { LOCAL_PRINCIPAL, makeLocalIdentityLayer } from "./identity"; const TOKEN = "boot-token"; const authenticate = (path: string, headers: Record<string, string> = {}) =>  Effect.flatMap(IdentityProvider.asEffect(), (provider) =>    provider.authenticate(new Request(`http://127.0.0.1${path}`, { headers })),  ).pipe(Effect.provide(makeLocalIdentityLayer(TOKEN)), Effect.exit, Effect.runPromise); describe("makeLocalIdentityLayer", () => {  it("resolves the local principal for a matching bearer token", async () => {    const exit = await authenticate("/integrations", { authorization: `Bearer ${TOKEN}` });    expect(exit).toStrictEqual(Exit.succeed(LOCAL_PRINCIPAL));  });   it("fails Unauthorized with no bearer token", async () => {    const exit = await authenticate("/integrations");    expect(Exit.isFailure(exit)).toBe(true);  });   it("fails Unauthorized with the wrong bearer token", async () => {    const exit = await authenticate("/integrations", { authorization: "Bearer wrong" });    expect(Exit.isFailure(exit)).toBe(true);  });   it("allows the OAuth callback without a bearer (state-gated)", async () => {    // The Bun shell strips the `/api` prefix before this layer runs.    const exit = await authenticate("/oauth/callback?state=abc");    expect(Exit.isSuccess(exit)).toBe(true);  });   it("still requires a bearer on the OAuth await poll", async () => {    const exit = await authenticate("/oauth/await/session-1");    expect(Exit.isFailure(exit)).toBe(true);  });});