import { expect, layer } from "@effect/vitest";import { Effect } from "effect";import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi"; import {  ConnectionId,  CreateConnectionInput,  TokenMaterial,  createExecutor,  Scope,  ScopeId,  SecretId,  type ConnectionProvider,  type SecretProvider,  SetSecretInput,  SetSourceCredentialBindingInput,  definePlugin,} from "@executor-js/sdk";import { makeTestWorkspaceLayer, TestWorkspace } from "@executor-js/sdk/testing";import {  addOpenApiTestSource,  serveOpenApiHttpApiTestServer,} from "@executor-js/plugin-openapi/testing"; import { openApiPlugin } from "./plugin"; const PingGroup = HttpApiGroup.make("default", { topLevel: true }).add(  HttpApiEndpoint.get("ping", "/ping"),);const UsageApi = HttpApi.make("usageScopeIsolation").add(PingGroup);const UsageGroupLive = HttpApiBuilder.group(UsageApi, "default", (handlers) =>  handlers.handle("ping", () => Effect.void),); const memorySecretsPlugin = definePlugin(() => {  const store = new Map<string, string>();   const provider: SecretProvider = {    key: "memory",    writable: true,    get: (id, scope) => Effect.sync(() => store.get(`${scope}\u0000${id}`) ?? null),    set: (id, value, scope) =>      Effect.sync(() => {        store.set(`${scope}\u0000${id}`, value);      }),    delete: (id, scope) => Effect.sync(() => store.delete(`${scope}\u0000${id}`)),  };   return {    id: "test-memory-secrets" as const,    storage: () => ({}),    secretProviders: [provider],  };}); const connectionProviderPlugin = definePlugin(() => {  const provider: ConnectionProvider = {    key: "test-oauth",  };   return {    id: "test-connection-provider" as const,    storage: () => ({}),    connectionProviders: [provider],  };}); const orgA = Scope.make({  id: ScopeId.make("org-a"),  name: "Org A",  createdAt: new Date(),});const orgB = Scope.make({  id: ScopeId.make("org-b"),  name: "Org B",  createdAt: new Date(),});const plugins = [memorySecretsPlugin(), connectionProviderPlugin(), openApiPlugin()] as const; layer(makeTestWorkspaceLayer({ scopes: [orgA], plugins }), { timeout: "15 seconds" })(  "OpenAPI usage scope isolation",  (it) => {    it.effect("secrets.usages does not expose binding rows outside the scope stack", () =>      Effect.scoped(        Effect.gen(function* () {          const server = yield* serveOpenApiHttpApiTestServer({            api: UsageApi,            handlersLayer: UsageGroupLive,          });          const { config } = yield* TestWorkspace;          const orgAExec = yield* createExecutor({ ...config, scopes: [orgA], plugins });          const orgBExec = yield* createExecutor({ ...config, scopes: [orgB], plugins });          const secretId = SecretId.make("org-a-api-key");           yield* orgAExec.secrets.set(            SetSecretInput.make({              id: secretId,              scope: orgA.id,              name: "Org A API Key",              value: "secret",              provider: "memory",            }),          );          yield* orgBExec.secrets.set(            SetSecretInput.make({              id: secretId,              scope: orgB.id,              name: "Org B API Key",              value: "different-secret",              provider: "memory",            }),          );          yield* addOpenApiTestSource(orgAExec, server, {            scope: String(orgA.id),            namespace: "secret_private_source",          });          yield* orgAExec.sources.setBinding(            SetSourceCredentialBindingInput.make({              source: { id: "secret_private_source", scope: orgA.id },              scope: orgA.id,              slotKey: "header:authorization",              value: { kind: "secret", secretId },            }),          );           const usages = yield* orgBExec.secrets.usages(secretId);          expect(usages).toEqual([]);        }),      ),    );     it.effect("connections.usages does not expose binding rows outside the scope stack", () =>      Effect.scoped(        Effect.gen(function* () {          const server = yield* serveOpenApiHttpApiTestServer({            api: UsageApi,            handlersLayer: UsageGroupLive,          });          const { config } = yield* TestWorkspace;          const orgAExec = yield* createExecutor({ ...config, scopes: [orgA], plugins });          const orgBExec = yield* createExecutor({ ...config, scopes: [orgB], plugins });          const connectionId = ConnectionId.make("org-a-connection");           yield* orgAExec.connections.create(            CreateConnectionInput.make({              id: connectionId,              scope: orgA.id,              provider: "test-oauth",              identityLabel: "Org A connection",              accessToken: TokenMaterial.make({                secretId: SecretId.make("org-a-connection-access"),                name: "Org A access",                value: "access",              }),              refreshToken: null,              expiresAt: null,              oauthScope: null,              providerState: null,            }),          );          yield* orgBExec.connections.create(            CreateConnectionInput.make({              id: connectionId,              scope: orgB.id,              provider: "test-oauth",              identityLabel: "Org B connection",              accessToken: TokenMaterial.make({                secretId: SecretId.make("org-b-connection-access"),                name: "Org B access",                value: "access",              }),              refreshToken: null,              expiresAt: null,              oauthScope: null,              providerState: null,            }),          );           yield* addOpenApiTestSource(orgAExec, server, {            scope: String(orgA.id),            namespace: "connection_private_source",          });          yield* orgAExec.sources.setBinding(            SetSourceCredentialBindingInput.make({              source: { id: "connection_private_source", scope: orgA.id },              scope: orgA.id,              slotKey: "oauth:connection",              value: { kind: "connection", connectionId },            }),          );           const usages = yield* orgBExec.connections.usages(connectionId);          expect(usages).toEqual([]);        }),      ),    );  },);