Function makeNonProtectedApiLive

apps/cloud/src/api/layers.ts:69–77

(
  rsLive: Layer.Layer<DbService | UserStoreService | WorkOsMirror | MemberDirectory>,
)

// handler reads it for the free-organizations-per-user limit gate — one of the
// few app-only billing touchpoints. (It is NOT on the neutral boot core.)
export const makeNonProtectedApiLive = (
  rsLive: Layer.Layer<DbService | UserStoreService | WorkOsMirror | MemberDirectory>,
) =>
  HttpApiBuilder.layer(NonProtectedApi).pipe(
    Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),
    Layer.provide(requestScopedMiddleware(rsLive).layer),
    Layer.provideMerge(SessionAuthLive),
    Layer.provideMerge(AutumnService.Default),
  );

// Cloud-only WorkOS domain-verification routes. Auth is enforced by a router
// middleware that resolves the URL org selector header before falling back to