// ---------------------------------------------------------------------------// WorkOS AuthKit — Effect-native sealed session management// --------------------------------------------------------------------------- import { Context, Effect, Layer } from "effect";import { WorkOS } from "@workos-inc/node";import { WorkOSError } from "./errors";import { server } from "../env"; const COOKIE_NAME = "wos-session"; // ---------------------------------------------------------------------------// Service// ---------------------------------------------------------------------------  const make = Effect.gen(function* () {  const apiKey = server.WORKOS_API_KEY;  const clientId = server.WORKOS_CLIENT_ID;  const cookiePassword = server.WORKOS_COOKIE_PASSWORD;   if (!cookiePassword || cookiePassword.length < 32) {    return yield* Effect.die(new Error("WORKOS_COOKIE_PASSWORD must be at least 32 characters"));  }   const workos = new WorkOS(apiKey, { clientId });   const use = <A>(fn: (wos: WorkOS) => Promise<A>) =>    Effect.tryPromise({      try: () => fn(workos),      catch: (cause) => new WorkOSError({ cause }),    }).pipe(Effect.withSpan("workos"));   return {    getAuthorizationUrl: (redirectUri: string) =>      workos.userManagement.getAuthorizationUrl({        provider: "authkit",        redirectUri,        clientId,      }),     authenticateWithCode: (code: string) =>      use((wos) =>        wos.userManagement.authenticateWithCode({          code,          clientId,          session: { sealSession: true, cookiePassword },        }),      ),     authenticateRequest: (request: Request) =>      Effect.gen(function* () {        const sessionData = parseCookie(request.headers.get("cookie"), COOKIE_NAME);        if (!sessionData) return null;         const session = workos.userManagement.loadSealedSession({          sessionData,          cookiePassword,        });         const result = yield* use((wos) => session.authenticate());         if (result.authenticated) {          return {            userId: result.user.id,            email: result.user.email,            firstName: result.user.firstName,            lastName: result.user.lastName,            avatarUrl: result.user.profilePictureUrl,            sessionId: result.sessionId,            refreshedSession: undefined as string | undefined,          };        }         if (result.reason === "no_session_cookie_provided") return null;         // Try refreshing        const refreshed = yield* use((wos) => session.refresh()).pipe(          Effect.orElseSucceed(() => ({ authenticated: false as const })),        );         if (!refreshed.authenticated || !("sealedSession" in refreshed) || !refreshed.sealedSession) return null;         return {          userId: refreshed.user.id,          email: refreshed.user.email,          firstName: refreshed.user.firstName,          lastName: refreshed.user.lastName,          avatarUrl: refreshed.user.profilePictureUrl,          sessionId: refreshed.sessionId,          refreshedSession: refreshed.sealedSession,        };      }),  };}); type WorkOSAuthService = Effect.Effect.Success<typeof make>; export class WorkOSAuth extends Context.Tag("@executor/cloud/WorkOSAuth")<  WorkOSAuth,  WorkOSAuthService>() {  static Default = Layer.effect(this, make).pipe(    Layer.annotateSpans({ module: "WorkOSAuth" }),  );} const parseCookie = (cookieHeader: string | null, name: string): string | null => {  if (!cookieHeader) return null;  const match = cookieHeader    .split(";")    .map((c) => c.trim())    .find((c) => c.startsWith(`${name}=`));  if (!match) return null;  return match.slice(name.length + 1) || null;};