Function authenticateSession

apps/host-selfhost/src/mcp/auth.ts:240–248

(request: Request)

       * identity never produces — narrowed away rather than asserted, so an MCP
       * session can never bind to a subject-less credential if that changes. */
      const authenticateSession = (request: Request): Effect.Effect<Principal | null> =>
        fallback.authenticate(request).pipe(
          Effect.map((principal) => (isPlatformPrincipal(principal) ? null : principal)),
          Effect.catchTags({
            Unauthorized: () => Effect.succeed(null),
            NoOrganization: () => Effect.succeed(null),
            ReadOnlyCredential: () => Effect.succeed(null),
          }),
        );

      /**
       * Try the OAuth bearer ONLY when a Bearer header is present (no