import { Data, Effect, Option, Predicate, Schema } from "effect"; export class UserStoreError extends Schema.TaggedErrorClass<UserStoreError>()(  "UserStoreError",  {},  { httpApiStatus: 500 },) {} export class WorkOSError extends Schema.TaggedErrorClass<WorkOSError>()(  "WorkOSError",  {    /**     * The upstream HTTP status WorkOS answered with, when the failure WAS an     * HTTP answer (the SDK sets `.status` on all its typed exceptions).     * Absent for network errors / timeouts. Consumers that must distinguish     * "WorkOS said no" (definitive 4xx) from "WorkOS was unreachable"     * (transient) branch on this — see `isDefinitiveWorkOSDenialStatus`.     */    status: Schema.optional(Schema.Number),  },  { httpApiStatus: 500 },) {} // Statuses that are a DEFINITIVE denial from WorkOS — a deterministic "this// request cannot be authorized" answer (invalid/revoked API key, forbidden,// resource gone), not a blip. Retrying does not help, and auth decisions built// on them must fail CLOSED. Everything else (429, 5xx, or no status at all —// network error/timeout) is transient and must stay retryable.const DEFINITIVE_DENIAL_STATUSES: ReadonlySet<number> = new Set([401, 403, 404]); export const isDefinitiveWorkOSDenialStatus = (status: number | undefined): boolean =>  status !== undefined && DEFINITIVE_DENIAL_STATUSES.has(status); // Tag-based guards (same pattern as `isOAuth2Error` in core/sdk/oauth-helpers):// the untyped failure channels these run against carry values that crossed// layer boundaries, so the discriminant is the `_tag`, not the prototype chain.const isWorkOSError = Predicate.isTagged("WorkOSError") as (error: unknown) => error is WorkOSError; /** A `WorkOSError` that is a definitive denial (see above), typed on `unknown` *  so auth code holding an untyped failure channel can branch safely. */export const isDefinitiveWorkOSDenial = (error: unknown): boolean =>  isWorkOSError(error) && isDefinitiveWorkOSDenialStatus(error.status); // Every typed exception the WorkOS node SDK throws for an HTTP answer carries a// numeric `.status` (UnauthorizedException 401, NotFoundException 404,// RateLimitExceededException 429, GenericServerException/OauthException with the// live status, ...). Network errors and timeouts throw non-SDK errors with no// status. Same extraction pattern as the workos-vault plugin's// `statusFromWorkOSCause` (packages/plugins/workos-vault/src/sdk/client.ts).const CauseWithStatusSchema = Schema.Struct({ status: Schema.Number });const decodeCauseWithStatusOption = Schema.decodeUnknownOption(CauseWithStatusSchema); export const statusFromWorkOSCause = (cause: unknown): number | undefined =>  Option.match(decodeCauseWithStatusOption(cause), {    onNone: () => undefined,    onSome: (decoded) => decoded.status,  }); /** * Build the public `WorkOSError` for a WorkOS service-adapter failure, * threading the upstream HTTP status through when the underlying SDK exception * carried one. The failure is normally the `ServiceAdapterError` wrapper from * `tryPromiseService` (SDK exception in `.cause`); a bare cause also works. */const isServiceAdapterError = Predicate.isTagged("ServiceAdapterError") as (  failure: unknown,) => failure is ServiceAdapterError; export const workosErrorFromFailure = (failure: unknown): WorkOSError =>  new WorkOSError({    status: statusFromWorkOSCause(isServiceAdapterError(failure) ? failure.cause : failure),  }); export class ApiKeyManagementError extends Schema.TaggedErrorClass<ApiKeyManagementError>()(  "ApiKeyManagementError",  { cause: Schema.Unknown },  { httpApiStatus: 500 },) {} /** * Private wrapper used by service adapters that lift Promise APIs into * Effect. `withServiceLogging` immediately remaps these into a public-facing * tagged error, so callers never observe this tag directly — its only job is * to keep the internal failure channel typed instead of `unknown` / `Error`. */export class ServiceAdapterError extends Data.TaggedError("ServiceAdapterError")<{  readonly cause: unknown;}> {} /** Lift a Promise-returning function into Effect with a typed failure channel. */export const tryPromiseService = <A>(fn: () => Promise<A>): Effect.Effect<A, ServiceAdapterError> =>  Effect.tryPromise({    try: fn,    catch: (cause) => new ServiceAdapterError({ cause }),  }); /** * Service-boundary error wrapper. Logs the full Cause chain (drizzle * query/params, pg error codes, nested Error.cause, etc.) via Effect's * structured logger, then maps to a tagged error so the HTTP wire * response contains only safe fields. * * Use this whenever a Promise-based API gets lifted into an Effect and * its failure needs both debuggable server-side logging and a safe * public shape. */export const withServiceLogging = <A, E, R>(  name: string,  // Receives the raw failure (for service adapters: the `ServiceAdapterError`  // whose `.cause` is the SDK exception) so the public error can carry safe  // classification fields (e.g. `WorkOSError.status`). Zero-arg callers that  // ignore the failure keep working unchanged.  publicError: (failure: unknown) => E,  effect: Effect.Effect<A, unknown, R>,): Effect.Effect<A, E, R> =>  effect.pipe(    Effect.tapCause((cause) => Effect.logError(`${name} failed`, cause)),    Effect.mapError(publicError),    Effect.withSpan(name),  ) as Effect.Effect<A, E, R>;