@executor-js/sdk 1.4.28 → 1.4.30

package/dist/testing.js

@@ -1,21 +1,698 @@
 import {
-  makeTestConfig,
-  memorySecretsPlugin
-} from "./chunk-I2OEQ2GJ.js";
-import "./chunk-OIJL6F6M.js";
+  Scope,
+  collectTables,
+  createExecutor,
+  definePlugin
+} from "./chunk-BZNIRSMG.js";
+import {
+  ScopeId
+} from "./chunk-ZANQD7E2.js";
+import {
+  createSqliteTestFumaDb
+} from "./chunk-ECMCGZYE.js";
+import "./chunk-7D4SUZUM.js";
 
 // src/testing.ts
+import * as NodeHttpServer2 from "@effect/platform-node/NodeHttpServer";
+import { Context as Context3, Data as Data2, Effect as Effect3, Layer as Layer3, Predicate as Predicate2 } from "effect";
+import {
+  HttpClient as HttpClient2,
+  HttpRouter,
+  HttpServer as HttpServer2,
+  HttpServerRequest as HttpServerRequest2
+} from "effect/unstable/http";
+
+// src/test-config.ts
+import { Context, Effect, Layer } from "effect";
+import { withQueryContext } from "fumadb/query";
+var makeLazyTestFumaDb = (options) => {
+  let started;
+  const start = () => {
+    if (!started) {
+      started = import("./sqlite-test-db-OK2WQNR5.js").then(
+        ({ createSqliteTestFumaDb: createSqliteTestFumaDb2 }) => createSqliteTestFumaDb2({
+          tables: options.tables,
+          namespace: "executor_test",
+          path: options.dataDir ? `${options.dataDir}/test.db` : void 0
+        })
+      );
+    }
+    return started;
+  };
+  const internal = {
+    tables: options.tables,
+    count: async (table, value) => (await start()).db.internal.count(table, value),
+    create: async (table, values) => (await start()).db.internal.create(table, values),
+    createMany: async (table, values) => (await start()).db.internal.createMany(table, values),
+    deleteMany: async (table, value) => (await start()).db.internal.deleteMany(table, value),
+    findFirst: async (table, value) => (await start()).db.internal.findFirst(table, value),
+    findMany: async (table, value) => (await start()).db.internal.findMany(table, value),
+    transaction: async (run) => (await start()).db.internal.transaction(run),
+    updateMany: async (table, value) => (await start()).db.internal.updateMany(table, value),
+    upsert: async (table, value) => (await start()).db.internal.upsert(table, value)
+  };
+  const queryMethods = /* @__PURE__ */ new Set([
+    "count",
+    "create",
+    "createMany",
+    "deleteMany",
+    "findFirst",
+    "findMany",
+    "transaction",
+    "updateMany",
+    "upsert"
+  ]);
+  const makeDb = (context) => new Proxy(
+    { internal: context === void 0 ? internal : { ...internal, context } },
+    {
+      get(target, prop) {
+        if (prop === "internal") return target.internal;
+        if (prop === "withContext") {
+          return (nextContext) => makeDb(nextContext);
+        }
+        if (!queryMethods.has(prop)) return void 0;
+        return async (...args) => {
+          const actual = await start();
+          const actualDb = context === void 0 ? actual.db : withQueryContext(actual.db, context);
+          const method = Reflect.get(actualDb, prop);
+          return method.apply(actualDb, args);
+        };
+      }
+    }
+  );
+  const db = makeDb();
+  return {
+    db,
+    warm: async () => {
+      await start();
+    },
+    close: async () => {
+      if (!started) return;
+      await (await started).close();
+    }
+  };
+};
+var makeTestConfig = (options) => {
+  const scopes = options?.scopes ?? [
+    Scope.make({
+      id: ScopeId.make("test-scope"),
+      name: options?.scopeName ?? "test",
+      createdAt: /* @__PURE__ */ new Date()
+    })
+  ];
+  const tables = collectTables(options?.plugins ?? []);
+  const testDb = makeLazyTestFumaDb({
+    tables,
+    backend: options?.backend ?? "sqlite",
+    dataDir: options?.dataDir
+  });
+  const db = withQueryContext(testDb.db, {
+    allowedScopeIds: new Set(scopes.map((scope) => String(scope.id)))
+  });
+  return {
+    scopes,
+    db,
+    plugins: options?.plugins,
+    testDb,
+    // Tests default to auto-accepting elicitation prompts. Override via
+    // a wrapping spread if a test exercises a real handler:
+    //   { ...makeTestConfig(...), onElicitation: customHandler }
+    onElicitation: "accept-all"
+  };
+};
+var TestWorkspace = class _TestWorkspace extends Context.Service()(
+  "executor-sdk/TestWorkspace"
+) {
+  static current = () => Effect.gen(function* () {
+    const workspace = yield* _TestWorkspace;
+    return workspace;
+  });
+};
+var makeTestWorkspaceHarness = (options) => Effect.acquireRelease(
+  Effect.gen(function* () {
+    const config = makeTestConfig(options);
+    const executor = yield* createExecutor(config);
+    return {
+      config,
+      executor,
+      testDb: config.testDb,
+      scopes: config.scopes
+    };
+  }),
+  ({ executor, testDb }) => executor.close().pipe(
+    Effect.ignore,
+    Effect.andThen(Effect.promise(() => testDb.close()).pipe(Effect.ignore))
+  )
+);
+var makeTestWorkspaceLayer = (options) => Layer.effect(TestWorkspace)(
+  makeTestWorkspaceHarness(options).pipe(
+    Effect.tap(({ testDb }) => Effect.promise(() => testDb.warm()))
+  )
+);
+var makeTestExecutor = (options) => makeTestWorkspaceHarness(options).pipe(Effect.map(({ executor }) => executor));
+var memorySecretsPlugin = definePlugin(() => {
+  const store = /* @__PURE__ */ new Map();
+  const provider = {
+    key: "memory",
+    writable: true,
+    get: (id, scope) => Effect.sync(() => store.get(`${scope}\0${id}`) ?? null),
+    set: (id, value, scope) => Effect.sync(() => {
+      store.set(`${scope}\0${id}`, value);
+    }),
+    delete: (id, scope) => Effect.sync(() => store.delete(`${scope}\0${id}`)),
+    list: () => Effect.sync(
+      () => Array.from(store.keys()).map((key) => {
+        const name = key.split("\0", 2)[1] ?? key;
+        return { id: name, name };
+      })
+    )
+  };
+  return {
+    id: "memory-secrets",
+    storage: () => ({}),
+    secretProviders: [provider]
+  };
+});
+
+// src/testing/oauth-test-server.ts
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
-import { Context, Data, Effect, Layer, Predicate } from "effect";
+import { Context as Context2, Data, Effect as Effect2, Layer as Layer2, Option, Predicate, Ref, Schema } from "effect";
+import { createHash, randomUUID } from "crypto";
 import {
+  FetchHttpClient,
   HttpClient,
-  HttpRouter,
+  HttpClientRequest,
   HttpServer,
-  HttpServerRequest
+  HttpServerRequest,
+  HttpServerResponse
 } from "effect/unstable/http";
-var TestHttpServerAddressError = class extends Data.TaggedError("TestHttpServerAddressError") {
+var OAuthTestServerAddressError = class extends Data.TaggedError("OAuthTestServerAddressError") {
+};
+var OAuthTestServerFlowError = class extends Data.TaggedError("OAuthTestServerFlowError") {
+};
+var JsonObject = Schema.Record(Schema.String, Schema.Unknown);
+var decodeJsonObject = Schema.decodeUnknownOption(Schema.fromJsonString(JsonObject));
+var TokenResponse = Schema.Struct({
+  access_token: Schema.String,
+  refresh_token: Schema.optional(Schema.String),
+  token_type: Schema.String,
+  expires_in: Schema.optional(Schema.Number),
+  scope: Schema.optional(Schema.String)
+});
+var decodeTokenResponse = Schema.decodeUnknownEffect(TokenResponse);
+var defaultScopes = ["read", "write"];
+var jsonResponse = (status, body, headers = {}) => HttpServerResponse.jsonUnsafe(body, { status, headers });
+var textResponse = (status, body, headers = {}) => HttpServerResponse.text(body, {
+  status,
+  headers,
+  contentType: "text/plain; charset=utf-8"
+});
+var redirectResponse = (location) => HttpServerResponse.redirect(location);
+var parseJsonObject = (body) => {
+  const result = decodeJsonObject(body);
+  return Option.isSome(result) ? result.value : null;
+};
+var arrayOfStrings = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+var decodeBasicAuthorization = (value) => {
+  if (!value) return null;
+  const match = /^Basic\s+(.+)$/i.exec(value);
+  if (!match) return null;
+  const decoded = Buffer.from(match[1], "base64").toString("utf8");
+  const separator = decoded.indexOf(":");
+  if (separator < 0) return null;
+  return {
+    username: decoded.slice(0, separator),
+    password: decoded.slice(separator + 1)
+  };
+};
+var codeChallengeForVerifier = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+var oauthError = (status, error, errorDescription) => jsonResponse(
+  status,
+  {
+    error,
+    error_description: errorDescription
+  },
+  status === 401 ? { "www-authenticate": 'Basic realm="OAuth test server"' } : {}
+);
+var manualRedirectHttpClientLayer = FetchHttpClient.layer.pipe(
+  Layer2.provide(Layer2.succeed(FetchHttpClient.RequestInit, { redirect: "manual" }))
+);
+var executeManualRedirect = (request, requestUrl) => HttpClient.execute(request).pipe(
+  Effect2.mapError(
+    (cause) => new OAuthTestServerFlowError({
+      message: `OAuth test flow request failed for ${requestUrl}`,
+      cause
+    })
+  ),
+  Effect2.provide(manualRedirectHttpClientLayer)
+);
+var executeOAuthHttp = (request, requestUrl) => HttpClient.execute(request).pipe(
+  Effect2.mapError(
+    (cause) => new OAuthTestServerFlowError({
+      message: `OAuth test flow request failed for ${requestUrl}`,
+      cause
+    })
+  ),
+  Effect2.provide(FetchHttpClient.layer)
+);
+var requiredRedirectLocation = (response, requestUrl) => Effect2.gen(function* () {
+  if (response.status < 300 || response.status >= 400) {
+    return yield* new OAuthTestServerFlowError({
+      message: `Expected redirect from ${requestUrl}, got HTTP ${response.status}`
+    });
+  }
+  const location = response.headers.location;
+  if (!location) {
+    return yield* new OAuthTestServerFlowError({
+      message: `Expected Location header from ${requestUrl}`
+    });
+  }
+  return new URL(location, requestUrl).toString();
+});
+var serveOAuthTestHttpApp = (handler) => Effect2.gen(function* () {
+  const context = yield* Layer2.build(
+    Layer2.fresh(
+      HttpServer.serve(
+        HttpServerRequest.HttpServerRequest.asEffect().pipe(Effect2.flatMap(handler))
+      ).pipe(Layer2.provideMerge(NodeHttpServer.layerTest))
+    )
+  ).pipe(Effect2.mapError((address2) => new OAuthTestServerAddressError({ address: address2 })));
+  const server = Context2.get(context, HttpServer.HttpServer);
+  const address = server.address;
+  if (!Predicate.isTagged(address, "TcpAddress")) {
+    return yield* new OAuthTestServerAddressError({ address });
+  }
+  return { baseUrl: `http://127.0.0.1:${address.port}` };
+});
+var requestBodyText = (request) => request.text.pipe(Effect2.catch(() => Effect2.succeed("")));
+var completeAuthorizationCodeFlow = (defaults) => (input) => Effect2.gen(function* () {
+  const loginResponse = yield* executeManualRedirect(
+    HttpClientRequest.get(input.authorizationUrl),
+    input.authorizationUrl
+  );
+  const loginUrl = yield* requiredRedirectLocation(loginResponse, input.authorizationUrl);
+  const credentials = Buffer.from(
+    `${input.username ?? defaults.username}:${input.password ?? defaults.password}`
+  ).toString("base64");
+  const callbackResponse = yield* executeManualRedirect(
+    HttpClientRequest.post(loginUrl).pipe(
+      HttpClientRequest.setHeader("authorization", `Basic ${credentials}`)
+    ),
+    loginUrl
+  );
+  const callbackUrl = yield* requiredRedirectLocation(callbackResponse, loginUrl);
+  const parsed = new URL(callbackUrl);
+  const state = parsed.searchParams.get("state");
+  const code = parsed.searchParams.get("code");
+  if (!state || !code) {
+    return yield* new OAuthTestServerFlowError({
+      message: "OAuth callback did not include both state and code"
+    });
+  }
+  return { callbackUrl, state, code };
+});
+var completeAuthorizationCodeTokenFlow = (defaults) => (input = {}) => Effect2.gen(function* () {
+  const clientId = input.clientId ?? defaults.clientId;
+  const clientSecret = input.clientSecret ?? defaults.clientSecret;
+  const redirectUrl = input.redirectUrl ?? "http://127.0.0.1/callback";
+  const codeVerifier = `verifier_${randomUUID()}`;
+  const state = `state_${randomUUID()}`;
+  const authorizationUrl = new URL(defaults.authorizationEndpoint);
+  authorizationUrl.searchParams.set("response_type", "code");
+  authorizationUrl.searchParams.set("client_id", clientId);
+  authorizationUrl.searchParams.set("redirect_uri", redirectUrl);
+  authorizationUrl.searchParams.set("state", state);
+  authorizationUrl.searchParams.set("code_challenge", codeChallengeForVerifier(codeVerifier));
+  authorizationUrl.searchParams.set("code_challenge_method", "S256");
+  if (input.scopes && input.scopes.length > 0) {
+    authorizationUrl.searchParams.set("scope", input.scopes.join(" "));
+  }
+  if (input.resource) {
+    authorizationUrl.searchParams.set("resource", input.resource);
+  }
+  const callback = yield* completeAuthorizationCodeFlow({
+    username: defaults.username,
+    password: defaults.password
+  })({
+    authorizationUrl: authorizationUrl.toString(),
+    username: input.username,
+    password: input.password
+  });
+  const tokenResponse = yield* executeOAuthHttp(
+    HttpClientRequest.post(defaults.tokenEndpoint).pipe(
+      HttpClientRequest.bodyUrlParams({
+        grant_type: "authorization_code",
+        code: callback.code,
+        redirect_uri: redirectUrl,
+        client_id: clientId,
+        client_secret: clientSecret,
+        code_verifier: codeVerifier
+      })
+    ),
+    defaults.tokenEndpoint
+  );
+  if (tokenResponse.status !== 200) {
+    const body = yield* tokenResponse.text.pipe(
+      Effect2.catch(() => Effect2.succeed("<unavailable>"))
+    );
+    return yield* new OAuthTestServerFlowError({
+      message: `Expected token response HTTP 200, got HTTP ${tokenResponse.status}: ${body}`
+    });
+  }
+  const raw = yield* tokenResponse.json.pipe(
+    Effect2.mapError(
+      (cause) => new OAuthTestServerFlowError({
+        message: "OAuth token response was not valid JSON",
+        cause
+      })
+    )
+  );
+  const token = yield* decodeTokenResponse(raw).pipe(
+    Effect2.mapError(
+      (cause) => new OAuthTestServerFlowError({
+        message: "OAuth token response did not match the expected shape",
+        cause
+      })
+    )
+  );
+  return {
+    accessToken: token.access_token,
+    refreshToken: token.refresh_token,
+    tokenType: token.token_type,
+    expiresIn: token.expires_in,
+    scope: token.scope
+  };
+});
+var serveOAuthTestServer = (options = {}) => Effect2.gen(function* () {
+  const requests = yield* Ref.make([]);
+  const issuedAccessTokens = yield* Ref.make(/* @__PURE__ */ new Set());
+  const users = {
+    [options.defaultUsername ?? "alice"]: options.defaultPassword ?? "password",
+    ...options.users ?? {}
+  };
+  const supportRefresh = options.supportRefresh ?? true;
+  const scopes = options.scopes ?? defaultScopes;
+  const clients = /* @__PURE__ */ new Map();
+  const transactions = /* @__PURE__ */ new Map();
+  const authorizationCodes = /* @__PURE__ */ new Map();
+  const refreshTokens = /* @__PURE__ */ new Map();
+  const defaultClientId = options.defaultClientId ?? "test-client";
+  const defaultClientSecret = options.defaultClientSecret ?? "test-secret";
+  clients.set(defaultClientId, {
+    clientSecret: defaultClientSecret,
+    redirectUris: /* @__PURE__ */ new Set(),
+    tokenEndpointAuthMethod: "client_secret_post"
+  });
+  for (const [clientId, clientSecret] of Object.entries(options.clients ?? {})) {
+    clients.set(clientId, {
+      clientSecret,
+      redirectUris: /* @__PURE__ */ new Set(),
+      tokenEndpointAuthMethod: clientSecret === null ? "none" : "client_secret_post"
+    });
+  }
+  let issuerUrl = "";
+  const server = yield* serveOAuthTestHttpApp(
+    (request) => Effect2.gen(function* () {
+      const currentIssuerUrl = issuerUrl || "http://127.0.0.1";
+      const requestUrl = new URL(request.url, currentIssuerUrl);
+      const body = yield* requestBodyText(request);
+      const headers = request.headers;
+      yield* Ref.update(requests, (all) => [
+        ...all,
+        {
+          method: request.method,
+          url: requestUrl.toString(),
+          path: requestUrl.pathname,
+          headers,
+          body
+        }
+      ]);
+      if (requestUrl.pathname.startsWith("/.well-known/oauth-protected-resource")) {
+        const suffix = requestUrl.pathname.slice("/.well-known/oauth-protected-resource".length);
+        const resource = `${currentIssuerUrl}${suffix}`;
+        return jsonResponse(200, {
+          resource,
+          authorization_servers: [currentIssuerUrl],
+          bearer_methods_supported: ["header"],
+          scopes_supported: scopes
+        });
+      }
+      if (requestUrl.pathname === "/.well-known/oauth-authorization-server" || requestUrl.pathname === "/.well-known/openid-configuration") {
+        return jsonResponse(200, {
+          issuer: currentIssuerUrl,
+          authorization_endpoint: `${currentIssuerUrl}/authorize`,
+          token_endpoint: `${currentIssuerUrl}/token`,
+          registration_endpoint: `${currentIssuerUrl}/register`,
+          response_types_supported: ["code"],
+          grant_types_supported: ["authorization_code", "refresh_token", "client_credentials"],
+          code_challenge_methods_supported: ["S256"],
+          token_endpoint_auth_methods_supported: [
+            "none",
+            "client_secret_post",
+            "client_secret_basic"
+          ],
+          scopes_supported: scopes
+        });
+      }
+      if (requestUrl.pathname === "/register" && request.method === "POST") {
+        const json = parseJsonObject(body);
+        if (!json) {
+          return oauthError(400, "invalid_client_metadata", "Expected JSON body");
+        }
+        const requestedMethod = typeof json.token_endpoint_auth_method === "string" ? json.token_endpoint_auth_method : "none";
+        const clientId = `client_${randomUUID()}`;
+        const clientSecret = requestedMethod === "client_secret_basic" || requestedMethod === "client_secret_post" ? `secret_${randomUUID()}` : null;
+        const redirectUris = new Set(arrayOfStrings(json.redirect_uris));
+        clients.set(clientId, {
+          clientSecret,
+          redirectUris,
+          tokenEndpointAuthMethod: requestedMethod
+        });
+        return jsonResponse(
+          201,
+          {
+            client_id: clientId,
+            ...clientSecret ? { client_secret: clientSecret } : {},
+            client_id_issued_at: Math.floor(Date.now() / 1e3),
+            token_endpoint_auth_method: requestedMethod,
+            redirect_uris: [...redirectUris],
+            grant_types: arrayOfStrings(json.grant_types),
+            response_types: arrayOfStrings(json.response_types),
+            scope: typeof json.scope === "string" ? json.scope : scopes.join(" ")
+          },
+          { "cache-control": "no-store" }
+        );
+      }
+      if (requestUrl.pathname === "/authorize" && request.method === "GET") {
+        const clientId = requestUrl.searchParams.get("client_id");
+        const redirectUri = requestUrl.searchParams.get("redirect_uri");
+        const state = requestUrl.searchParams.get("state");
+        const codeChallenge = requestUrl.searchParams.get("code_challenge");
+        const responseType = requestUrl.searchParams.get("response_type");
+        if (!clientId || !redirectUri || !state || !codeChallenge || responseType !== "code") {
+          return oauthError(400, "invalid_request", "Missing authorization parameters");
+        }
+        const client = clients.get(clientId);
+        if (client && client.redirectUris.size > 0 && !client.redirectUris.has(redirectUri)) {
+          return oauthError(400, "invalid_request", "redirect_uri is not registered");
+        }
+        if (!client) {
+          clients.set(clientId, {
+            clientSecret: null,
+            redirectUris: /* @__PURE__ */ new Set([redirectUri]),
+            tokenEndpointAuthMethod: "none"
+          });
+        }
+        const transaction = `txn_${randomUUID()}`;
+        transactions.set(transaction, {
+          clientId,
+          redirectUri,
+          state,
+          codeChallenge,
+          scope: requestUrl.searchParams.get("scope"),
+          resource: requestUrl.searchParams.get("resource")
+        });
+        return redirectResponse(
+          `${currentIssuerUrl}/login?transaction=${encodeURIComponent(transaction)}`
+        );
+      }
+      if (requestUrl.pathname === "/login") {
+        const transactionId = requestUrl.searchParams.get("transaction");
+        const transaction = transactionId ? transactions.get(transactionId) : void 0;
+        if (!transactionId || !transaction) {
+          return oauthError(400, "invalid_request", "Unknown login transaction");
+        }
+        if (request.method === "GET") {
+          return textResponse(200, "OAuth test login");
+        }
+        const basic = decodeBasicAuthorization(headers.authorization);
+        if (!basic || users[basic.username] !== basic.password) {
+          return jsonResponse(
+            401,
+            { error: "access_denied" },
+            { "www-authenticate": 'Basic realm="OAuth test server"' }
+          );
+        }
+        const code = `code_${randomUUID()}`;
+        transactions.delete(transactionId);
+        authorizationCodes.set(code, { ...transaction, username: basic.username });
+        const callbackUrl = new URL(transaction.redirectUri);
+        callbackUrl.searchParams.set("code", code);
+        callbackUrl.searchParams.set("state", transaction.state);
+        return redirectResponse(callbackUrl.toString());
+      }
+      if (requestUrl.pathname === "/token" && request.method === "POST") {
+        const params = new URLSearchParams(body);
+        const basic = decodeBasicAuthorization(headers.authorization);
+        const clientId = basic?.username ?? params.get("client_id");
+        const clientSecret = basic?.password ?? params.get("client_secret");
+        const client = clientId ? clients.get(clientId) : void 0;
+        if (!clientId || !client) {
+          return oauthError(401, "invalid_client", "Unknown client");
+        }
+        if (client.clientSecret !== null && client.clientSecret !== clientSecret) {
+          return oauthError(401, "invalid_client", "Invalid client secret");
+        }
+        const grantType = params.get("grant_type");
+        if (grantType === "authorization_code") {
+          const code = params.get("code");
+          const redirectUri = params.get("redirect_uri");
+          const codeVerifier = params.get("code_verifier");
+          const record = code ? authorizationCodes.get(code) : void 0;
+          if (!code || !redirectUri || !codeVerifier || !record) {
+            return oauthError(400, "invalid_grant", "Unknown authorization code");
+          }
+          if (record.clientId !== clientId || record.redirectUri !== redirectUri || record.codeChallenge !== codeChallengeForVerifier(codeVerifier)) {
+            return oauthError(400, "invalid_grant", "Authorization code validation failed");
+          }
+          authorizationCodes.delete(code);
+          const accessToken = `at_${randomUUID()}`;
+          const refreshToken = `rt_${randomUUID()}`;
+          yield* Ref.update(issuedAccessTokens, (tokens) => /* @__PURE__ */ new Set([...tokens, accessToken]));
+          refreshTokens.set(refreshToken, {
+            clientId,
+            username: record.username,
+            scope: record.scope,
+            resource: record.resource
+          });
+          return jsonResponse(
+            200,
+            {
+              access_token: accessToken,
+              refresh_token: refreshToken,
+              token_type: "Bearer",
+              expires_in: 3600,
+              ...record.scope ? { scope: record.scope } : {}
+            },
+            { "cache-control": "no-store" }
+          );
+        }
+        if (grantType === "refresh_token") {
+          const refreshToken = params.get("refresh_token");
+          const record = refreshToken ? refreshTokens.get(refreshToken) : void 0;
+          if (!supportRefresh || !refreshToken || !record || record.clientId !== clientId) {
+            return oauthError(400, "invalid_grant", "Unknown refresh token");
+          }
+          const nextAccessToken = `at_${randomUUID()}`;
+          const nextRefreshToken = `rt_${randomUUID()}`;
+          refreshTokens.delete(refreshToken);
+          refreshTokens.set(nextRefreshToken, record);
+          yield* Ref.update(
+            issuedAccessTokens,
+            (tokens) => /* @__PURE__ */ new Set([...tokens, nextAccessToken])
+          );
+          return jsonResponse(
+            200,
+            {
+              access_token: nextAccessToken,
+              refresh_token: nextRefreshToken,
+              token_type: "Bearer",
+              expires_in: 3600,
+              ...record.scope ? { scope: record.scope } : {}
+            },
+            { "cache-control": "no-store" }
+          );
+        }
+        if (grantType === "client_credentials") {
+          const accessToken = `at_${randomUUID()}`;
+          yield* Ref.update(issuedAccessTokens, (tokens) => /* @__PURE__ */ new Set([...tokens, accessToken]));
+          return jsonResponse(
+            200,
+            {
+              access_token: accessToken,
+              token_type: "Bearer",
+              expires_in: 3600,
+              scope: params.get("scope") ?? scopes.join(" ")
+            },
+            { "cache-control": "no-store" }
+          );
+        }
+        return oauthError(400, "unsupported_grant_type", "Unsupported grant type");
+      }
+      if (requestUrl.pathname === "/mcp") {
+        const authorization = headers.authorization;
+        const token = authorization?.replace(/^Bearer\s+/i, "");
+        const valid = token ? yield* Ref.get(issuedAccessTokens).pipe(Effect2.map((tokens) => tokens.has(token))) : false;
+        if (!valid) {
+          return jsonResponse(
+            401,
+            { error: "invalid_token" },
+            {
+              "www-authenticate": `Bearer resource_metadata="${currentIssuerUrl}/.well-known/oauth-protected-resource/mcp", error="invalid_token"`
+            }
+          );
+        }
+        return jsonResponse(200, {
+          jsonrpc: "2.0",
+          id: 1,
+          result: { protocolVersion: "2025-06-18", capabilities: {} }
+        });
+      }
+      return jsonResponse(404, { error: "not_found" });
+    })
+  );
+  issuerUrl = server.baseUrl;
+  const accessTokenSet = Ref.get(issuedAccessTokens);
+  return {
+    issuerUrl,
+    authorizationEndpoint: `${issuerUrl}/authorize`,
+    tokenEndpoint: `${issuerUrl}/token`,
+    registrationEndpoint: `${issuerUrl}/register`,
+    protectedResourceMetadataUrl: `${issuerUrl}/.well-known/oauth-protected-resource`,
+    resourceUrl: issuerUrl,
+    mcpResourceUrl: `${issuerUrl}/mcp`,
+    completeAuthorizationCodeFlow: completeAuthorizationCodeFlow({
+      username: options.defaultUsername ?? "alice",
+      password: options.defaultPassword ?? "password"
+    }),
+    completeAuthorizationCodeTokenFlow: completeAuthorizationCodeTokenFlow({
+      username: options.defaultUsername ?? "alice",
+      password: options.defaultPassword ?? "password",
+      clientId: defaultClientId,
+      clientSecret: defaultClientSecret,
+      authorizationEndpoint: `${issuerUrl}/authorize`,
+      tokenEndpoint: `${issuerUrl}/token`
+    }),
+    requests: Ref.get(requests),
+    clearRequests: Ref.set(requests, []),
+    issuedAccessTokens: accessTokenSet.pipe(Effect2.map((tokens) => [...tokens])),
+    acceptsAccessToken: (token) => accessTokenSet.pipe(Effect2.map((tokens) => tokens.has(token))),
+    acceptsAuthorizationHeader: (authorization) => {
+      const token = authorization?.replace(/^Bearer\s+/i, "");
+      return token ? accessTokenSet.pipe(Effect2.map((tokens) => tokens.has(token))) : Effect2.succeed(false);
+    }
+  };
+});
+var OAuthTestServer = class _OAuthTestServer extends Context2.Service()(
+  "@executor-js/sdk/testing/OAuthTestServer"
+) {
+  static layer = (options) => Layer2.effect(_OAuthTestServer, serveOAuthTestServer(options));
 };
-var TestHttpServerServeError = class extends Data.TaggedError("TestHttpServerServeError") {
+
+// src/testing.ts
+var TestHttpServerAddressError = class extends Data2.TaggedError("TestHttpServerAddressError") {
+};
+var TestHttpServerServeError = class extends Data2.TaggedError("TestHttpServerServeError") {
 };
 var testHttpRoute = HttpRouter.route;
 var serveTestHttpRoutes = (routes) => makeTestHttpServer(
@@ -25,32 +702,43 @@ var serveTestHttpRoutes = (routes) => makeTestHttpServer(
   })
 );
 var serveTestHttpApp = (handler) => makeTestHttpServer(
-  HttpServer.serve(HttpServerRequest.HttpServerRequest.asEffect().pipe(Effect.flatMap(handler)))
+  HttpServer2.serve(HttpServerRequest2.HttpServerRequest.asEffect().pipe(Effect3.flatMap(handler)))
 );
-var makeTestHttpServer = (serverLayer) => Effect.gen(function* () {
-  const context = yield* Layer.build(
-    Layer.fresh(serverLayer.pipe(Layer.provideMerge(NodeHttpServer.layerTest)))
-  ).pipe(Effect.mapError((cause) => new TestHttpServerServeError({ cause })));
-  const server = Context.get(context, HttpServer.HttpServer);
+var serveTestHttpServerLayer = (serverLayer) => makeTestHttpServer(serverLayer);
+var makeTestHttpServer = (serverLayer) => Effect3.gen(function* () {
+  const context = yield* Layer3.build(
+    Layer3.fresh(serverLayer.pipe(Layer3.provideMerge(NodeHttpServer2.layerTest)))
+  ).pipe(Effect3.mapError((cause) => new TestHttpServerServeError({ cause })));
+  const server = Context3.get(context, HttpServer2.HttpServer);
   const address = server.address;
-  if (!Predicate.isTagged(address, "TcpAddress")) {
+  if (!Predicate2.isTagged(address, "TcpAddress")) {
     return yield* new TestHttpServerAddressError({ address });
   }
-  const client = Context.get(context, HttpClient.HttpClient);
+  const client = Context3.get(context, HttpClient2.HttpClient);
   const baseUrl = `http://127.0.0.1:${address.port}`;
   return {
     baseUrl,
-    httpClientLayer: Layer.succeed(HttpClient.HttpClient, client),
+    httpClientLayer: Layer3.succeed(HttpClient2.HttpClient, client),
     url: (path = "") => new URL(path, baseUrl).toString()
   };
 });
 export {
+  OAuthTestServer,
+  OAuthTestServerAddressError,
+  OAuthTestServerFlowError,
   TestHttpServerAddressError,
   TestHttpServerServeError,
+  TestWorkspace,
+  createSqliteTestFumaDb,
   makeTestConfig,
+  makeTestExecutor,
+  makeTestWorkspaceHarness,
+  makeTestWorkspaceLayer,
   memorySecretsPlugin,
+  serveOAuthTestServer,
   serveTestHttpApp,
   serveTestHttpRoutes,
+  serveTestHttpServerLayer,
   testHttpRoute
 };
 //# sourceMappingURL=testing.js.map