fix(platform): preserve fiber context in HttpLayerRouter.addHttpApi so API-level middleware is applied

[syhstanley]

Summary

Fixes #6121 — @effect/platform HttpApi: middleware is skipped when using HttpLayerRouter.addHttpApi with multiple APIs combined via Layer.mergeAll.

Root Cause

In HttpLayerRouter.addHttpApi, each route handler was wrapped with:

handler: Effect.provide(route.handler, context)

Effect.provide calls fiberRefLocally(currentContext, context) which replaces the entire fiber context with the captured build-time context. This silently discards any services injected at request time — most notably the Session service provided by API-level HttpApiMiddleware via Effect.provideServiceEffect.

Fix

Replace Effect.provide with Effect.mapInputContext to merge the build-time platform services into the runtime fiber context instead of replacing it:

handler: Effect.mapInputContext(route.handler, (input) => Context.merge(context, input))

This preserves all request-time services (including Session from API-level middleware) while still ensuring the required platform services (Etag, FileSystem, HttpPlatform, Path, HttpRouter) are available. This is the same pattern already used by HttpApiBuilder.group internally.

Symptoms Fixed

• Endpoints returning 200 instead of 401 when rejecting middleware was configured (middleware was silently skipped for APIs after the first in Layer.mergeAll)
• Endpoints returning 500 "Service not found: Session" when accepting middleware was configured (Session injected by middleware was overwritten before the handler ran)

Tests

Adds packages/platform-node/test/HttpApiLayerRouterMiddleware.test.ts with 5 regression tests covering:

1. ✅ Protected endpoint returns 401 (not 200) with rejecting middleware
2. ✅ Session-using endpoint returns 401 (not 500) with rejecting middleware
3. ✅ External API routes remain accessible without authentication
4. ✅ Protected endpoint returns 200 with accepting middleware
5. ✅ Session service is injected and accessible in handler with accepting middleware

Test plan

• All 5 new regression tests pass
• All existing 20 HttpApi.test.ts tests continue to pass
• Fix verified against the reproduction pattern described in issue @effect/platform HttpApi: middleware is skipped #6121

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 5fd07e0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 31 packages

Name	Type
@effect/platform	Patch
@effect/cli	Patch
@effect/cluster	Patch
@effect/experimental	Patch
@effect/opentelemetry	Patch
@effect/platform-browser	Patch
@effect/platform-bun	Patch
@effect/platform-node-shared	Patch
@effect/platform-node	Patch
@effect/rpc	Patch
@effect/sql-clickhouse	Patch
@effect/sql-d1	Patch
@effect/sql-drizzle	Patch
@effect/sql-libsql	Patch
@effect/sql-mssql	Patch
@effect/sql-mysql2	Patch
@effect/sql-pg	Patch
@effect/sql-sqlite-bun	Patch
@effect/sql-sqlite-node	Patch
@effect/sql	Patch
@effect/workflow	Patch
@effect/ai	Patch
@effect/ai-amazon-bedrock	Patch
@effect/ai-anthropic	Patch
@effect/ai-google	Patch
@effect/ai-openai	Patch
@effect/ai-openrouter	Patch
@effect/sql-sqlite-do	Patch
@effect/sql-sqlite-react-native	Patch
@effect/sql-sqlite-wasm	Patch
@effect/sql-kysely	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR