Function verifySession

apps/cloud/src/auth/doc-gate.ts:89–103

(sealed: string)

// carries those in its Exit too) — so the login flow surfaces the real
// problem instead of 500ing every page.
const verifySession = async (sealed: string): Promise<VerifiedSession | null> => {
  const exit = await getRuntime().runPromiseExit(
    Effect.flatMap(WorkOSClient.asEffect(), (workos) => workos.authenticateSealedSession(sealed)),
  );
  if (!Exit.isSuccess(exit) || exit.value === null) return null;
  const result = exit.value;
  return {
    userId: result.userId,
    email: result.email,
    name: sealedSessionDisplayName(result),
    avatarUrl: result.avatarUrl ?? null,
    organizationId: result.organizationId ?? null,
    refreshedSession: result.refreshedSession,
  };
};

// ── Auth hint ────────────────────────────────────────────────────────────────