// Secrets endpoints — set / list / status / resolve / remove round-trip// and error fidelity within a single org. import { describe, expect, it } from "@effect/vitest";import { Effect } from "effect"; import { ScopeId, SecretId } from "@executor/sdk"; import { asOrg } from "./__test-harness__/api-harness"; describe("secrets api (HTTP)", () => {  it.effect("set → list → resolve round-trips a new secret", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       const setRef = yield* asOrg(org, (client) =>        client.secrets.set({          path: { scopeId: ScopeId.make(org) },          payload: { id: SecretId.make(id), name: "My API Token", value: "sk-test-abc" },        }),      );      expect(setRef.id).toBe(id);      expect(setRef.scopeId).toBe(org);       const list = yield* asOrg(org, (client) =>        client.secrets.list({ path: { scopeId: ScopeId.make(org) } }),      );      expect(list.find((s) => s.id === id)?.name).toBe("My API Token");       const resolved = yield* asOrg(org, (client) =>        client.secrets.resolve({          path: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },        }),      );      expect(resolved.value).toBe("sk-test-abc");    }),  );   it.effect("status is resolved for an existing secret, missing for an unknown id", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       yield* asOrg(org, (client) =>        client.secrets.set({          path: { scopeId: ScopeId.make(org) },          payload: { id: SecretId.make(id), name: "n", value: "v" },        }),      );       const resolvedStatus = yield* asOrg(org, (client) =>        client.secrets.status({          path: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },        }),      );      expect(resolvedStatus.status).toBe("resolved");       const missingStatus = yield* asOrg(org, (client) =>        client.secrets.status({          path: {            scopeId: ScopeId.make(org),            secretId: SecretId.make(`missing_${crypto.randomUUID().slice(0, 8)}`),          },        }),      );      expect(missingStatus.status).toBe("missing");    }),  );   it.effect("remove deletes the secret; subsequent resolve fails and list drops it", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            path: { scopeId: ScopeId.make(org) },            payload: { id: SecretId.make(id), name: "n", value: "v" },          });          yield* client.secrets.remove({            path: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },          });        }),      );       const list = yield* asOrg(org, (client) =>        client.secrets.list({ path: { scopeId: ScopeId.make(org) } }),      );      expect(list.map((s) => s.id)).not.toContain(id);       const afterResolve = yield* asOrg(org, (client) =>        client.secrets          .resolve({ path: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) } })          .pipe(Effect.either),      );      expect(afterResolve._tag).toBe("Left");    }),  );   it.effect("resolve on an unknown id fails with a typed error", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const missing = `missing_${crypto.randomUUID().slice(0, 8)}`;       const result = yield* asOrg(org, (client) =>        client.secrets          .resolve({ path: { scopeId: ScopeId.make(org), secretId: SecretId.make(missing) } })          .pipe(Effect.either),      );      expect(result._tag).toBe("Left");      if (result._tag === "Left") {        // The API declares SecretNotFoundError / SecretResolutionError        // as typed errors; either is acceptable for an unknown id.        const err = result.left as { _tag?: string };        expect(          err._tag === "SecretNotFoundError" || err._tag === "SecretResolutionError",        ).toBe(true);      }    }),  );   it.effect("remove on an unknown id is a no-op (idempotent)", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const missing = `missing_${crypto.randomUUID().slice(0, 8)}`;       const result = yield* asOrg(org, (client) =>        client.secrets          .remove({ path: { scopeId: ScopeId.make(org), secretId: SecretId.make(missing) } })          .pipe(Effect.either),      );      expect(result._tag).toBe("Right");    }),  );   it.effect("set with the same id twice updates the value (upsert)", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const id = `sec_${crypto.randomUUID().slice(0, 8)}`;       const first = yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            path: { scopeId: ScopeId.make(org) },            payload: { id: SecretId.make(id), name: "first", value: "first-value" },          });          return yield* client.secrets.resolve({            path: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },          });        }),      );      expect(first.value).toBe("first-value");       const second = yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            path: { scopeId: ScopeId.make(org) },            payload: { id: SecretId.make(id), name: "updated", value: "second-value" },          });          return yield* client.secrets.resolve({            path: { scopeId: ScopeId.make(org), secretId: SecretId.make(id) },          });        }),      );      expect(second.value).toBe("second-value");    }),  );});