// ---------------------------------------------------------------------------// The WorkOS session + org route Layers, and the `/api`-prefixed router view// they register on.// ---------------------------------------------------------------------------//// Split out of `./routes` so BOTH planes can mount the SAME Layer values:////   - the full app plane (`../app` -> `ExecutorApp.make`'s `extensions.routes`)//   - the auth plane (`../app-auth`), the small handler `server.ts` dispatches//     session/auth traffic to without evaluating the plugin/OpenAPI/MCP graph.//// Sharing the constructors rather than re-deriving them is what makes the two// planes byte-identical on these routes: same handlers, same middleware order,// same prefixed router, same error rendering.// --------------------------------------------------------------------------- import { Effect, Layer } from "effect";import { HttpRouter } from "effect/unstable/http";import { HttpApiBuilder } from "effect/unstable/httpapi"; import { requestScopedMiddleware, type MemberDirectory } from "@executor-js/api/server"; import { UserStoreService } from "../auth/context";import { WorkOsMirror } from "../auth/workos-mirror";import {  CloudAuthPublicHandlers,  CloudSessionAuthHandlers,  NonProtectedApi,} from "../auth/handlers";import { SessionAuthLive } from "../auth/middleware-live";import { OrgHttpApi } from "../org/api";import { orgAuthMiddleware } from "../org/auth-middleware";import { OrgHandlers } from "../org/handlers";import { AutumnService } from "./billing/service";import { DbService } from "../db/db"; /** * The `/api`-prefixed `HttpRouter` view every cloud HttpApi group registers on, * so `/auth/me` serves at `/api/auth/me` (matching the protected + account * plane). Derived from the ambient router, exactly as `ExecutorApp.make` builds * its own internal prefixed view for the protected API. */export const apiPrefixedRouter = Layer.effect(HttpRouter.HttpRouter)(  Effect.map(HttpRouter.HttpRouter.asEffect(), (router) => router.prefixed("/api")),); /** The per-request layer the session + org handlers read (the postgres socket). */export type SessionRequestScoped = Layer.Layer<  DbService | UserStoreService | WorkOsMirror | MemberDirectory>; /** * Session routes (login / callback / logout / me / organizations / …). * Handlers yield `UserStoreService` directly; the per-request DB combine keeps * the postgres socket request-scoped. * * `AutumnService.Default` is provided because the `createOrganization` free-limit * gate, `deleteOrganization`, and the seat report every sign-in fires read it — * the few app-only billing touchpoints. It is NOT on the neutral boot core. */export const makeSessionRoutes = (rsLive: SessionRequestScoped) =>  HttpApiBuilder.layer(NonProtectedApi).pipe(    Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),    Layer.provide(requestScopedMiddleware(rsLive).layer),    Layer.provideMerge(SessionAuthLive),    Layer.provideMerge(AutumnService.Default),    Layer.provide(apiPrefixedRouter),  ); /** * Cloud-only WorkOS domain-verification routes; the auth middleware resolves * the URL org selector header before falling back to the session org, so slug * lookup needs the same request-scoped UserStoreService as other org-scoped * APIs. The verification-link handler gates on billing, hence `AutumnService`. */export const makeOrgRoutes = (rsLive: SessionRequestScoped) =>  HttpApiBuilder.layer(OrgHttpApi).pipe(    Layer.provide(OrgHandlers),    Layer.provide(orgAuthMiddleware(rsLive)),    Layer.provideMerge(AutumnService.Default),    Layer.provide(apiPrefixedRouter),  );