// Secrets endpoints — set / list / status / remove round-trip// and error fidelity within a single org. import { describe, expect, it } from "@effect/vitest";import { Effect } from "effect"; import { ScopeId, SecretId } from "@executor-js/sdk"; import { asOrg, fetchForOrg, TEST_BASE_URL } from "./__test-harness__/api-harness"; describe("secrets api (HTTP)", () => {  it.effect("set → list → status round-trips a new secret without exposing plaintext", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       const setRef = yield* asOrg(org, (client) =>        client.secrets.set({          params: { scopeId: ScopeId.make(org) },          payload: { id: SecretId.make(id), name: "My API Token", value: "sk-test-abc" },        }),      );      expect(setRef.id).toBe(id);      expect(setRef.scopeId).toBe(org);       const list = yield* asOrg(org, (client) =>        client.secrets.list({ params: { scopeId: ScopeId.make(org) } }),      );      expect(list.find((s) => s.id === id)?.name).toBe("My API Token");       const status = yield* asOrg(org, (client) =>        client.secrets.status({          params: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },        }),      );      expect(status.status).toBe("resolved");    }),  );   it.effect("does not expose a plaintext resolve endpoint", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       yield* asOrg(org, (client) =>        client.secrets.set({          params: { scopeId: ScopeId.make(org) },          payload: { id: SecretId.make(id), name: "n", value: "v" },        }),      );       const response = yield* Effect.promise(() =>        fetchForOrg(org)(`${TEST_BASE_URL}/scopes/${org}/secrets/${id}/resolve`),      );      expect(response.status).toBe(404);    }),  );   it.effect("status is resolved for an existing secret, missing for an unknown id", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       yield* asOrg(org, (client) =>        client.secrets.set({          params: { scopeId: ScopeId.make(org) },          payload: { id: SecretId.make(id), name: "n", value: "v" },        }),      );       const resolvedStatus = yield* asOrg(org, (client) =>        client.secrets.status({          params: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },        }),      );      expect(resolvedStatus.status).toBe("resolved");       const missingStatus = yield* asOrg(org, (client) =>        client.secrets.status({          params: {            scopeId: ScopeId.make(org),            secretId: SecretId.make(`missing_${crypto.randomUUID().slice(0, 8)}`),          },        }),      );      expect(missingStatus.status).toBe("missing");    }),  );   it.effect("remove deletes the secret; subsequent status is missing and list drops it", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            params: { scopeId: ScopeId.make(org) },            payload: { id: SecretId.make(id), name: "n", value: "v" },          });          yield* client.secrets.remove({            params: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },          });        }),      );       const list = yield* asOrg(org, (client) =>        client.secrets.list({ params: { scopeId: ScopeId.make(org) } }),      );      expect(list.map((s) => s.id)).not.toContain(id);       const afterStatus = yield* asOrg(org, (client) =>        client.secrets.status({          params: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },        }),      );      expect(afterStatus.status).toBe("missing");    }),  );   it.effect("remove on an unknown id is a no-op (idempotent)", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const missing = `missing_${crypto.randomUUID().slice(0, 8)}`;       const result = yield* asOrg(org, (client) =>        client.secrets          .remove({ params: { scopeId: ScopeId.make(org), secretId: SecretId.make(missing) } })          .pipe(Effect.result),      );      expect(result._tag).toBe("Success");    }),  );   it.effect("set with the same id twice updates the visible metadata", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       const first = yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            params: { scopeId: ScopeId.make(org) },            payload: { id: SecretId.make(id), name: "first", value: "first-value" },          });          return yield* client.secrets.list({ params: { scopeId: ScopeId.make(org) } });        }),      );      expect(first.find((s) => s.id === id)?.name).toBe("first");       const second = yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            params: { scopeId: ScopeId.make(org) },            payload: { id: SecretId.make(id), name: "updated", value: "second-value" },          });          return yield* client.secrets.list({ params: { scopeId: ScopeId.make(org) } });        }),      );      expect(second.find((s) => s.id === id)?.name).toBe("updated");    }),  );});