import * as NodeServices from "@effect/platform-node/NodeServices";import { assert, it } from "@effect/vitest";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Option from "effect/Option";import * as PlatformError from "effect/PlatformError"; import * as ServerSecretStore from "../auth/ServerSecretStore.ts";import * as ServerConfig from "../config.ts";import { getOrCreateEnvironmentKeyPairFromSecretStore } from "./environmentKeys.ts"; const makeServerSecretStoreLayer = () =>  ServerSecretStore.layer.pipe(    Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-environment-keys-test-" })),  ); const unusedSecretStoreOperation = () => Effect.die("unused secret-store operation"); it.layer(NodeServices.layer)("getOrCreateEnvironmentKeyPairFromSecretStore", (it) => {  it.effect("persists one atomic keypair secret and reuses it", () =>    Effect.gen(function* () {      const secretStore = yield* ServerSecretStore.ServerSecretStore;       const first = yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore);      const second = yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore);       assert.deepEqual(second, first);      assert.isTrue(Option.isSome(yield* secretStore.get("cloud-link-ed25519-key-pair")));      assert.isTrue(Option.isNone(yield* secretStore.get("cloud-link-ed25519-private-key")));      assert.isTrue(Option.isNone(yield* secretStore.get("cloud-link-ed25519-public-key")));    }).pipe(Effect.provide(makeServerSecretStoreLayer())),  );   it.effect("migrates a legacy keypair into the atomic secret", () =>    Effect.gen(function* () {      const secretStore = yield* ServerSecretStore.ServerSecretStore;      yield* secretStore.set("cloud-link-ed25519-private-key", new TextEncoder().encode("private"));      yield* secretStore.set("cloud-link-ed25519-public-key", new TextEncoder().encode("public"));       assert.deepEqual(yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore), {        privateKey: "private",        publicKey: "public",      });      assert.isTrue(Option.isSome(yield* secretStore.get("cloud-link-ed25519-key-pair")));    }).pipe(Effect.provide(makeServerSecretStoreLayer())),  );   it.effect("uses the persisted keypair when a concurrent creator wins", () =>    Effect.gen(function* () {      const winner = new TextEncoder().encode(        '{"privateKey":"winner-private","publicKey":"winner-public"}',      );      let createAttempted = false;      const secretStore = {        get: (name) =>          Effect.sync(() =>            name === "cloud-link-ed25519-key-pair" && createAttempted              ? Option.some(winner)              : Option.none(),          ),        set: unusedSecretStoreOperation,        create: () =>          Effect.sync(() => {            createAttempted = true;          }).pipe(            Effect.flatMap(() =>              Effect.fail(                new ServerSecretStore.SecretStorePersistError({                  resource: "environment signing key pair",                  cause: PlatformError.systemError({                    _tag: "AlreadyExists",                    module: "FileSystem",                    method: "open",                    pathOrDescriptor: "cloud-link-ed25519-key-pair.bin",                  }),                }),              ),            ),          ),        getOrCreateRandom: unusedSecretStoreOperation,        remove: unusedSecretStoreOperation,      } satisfies ServerSecretStore.ServerSecretStore["Service"];       assert.deepEqual(yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore), {        privateKey: "winner-private",        publicKey: "winner-public",      });    }),  );});