@burdenoff/fe-libs 2026.1023.7 → 2026.1023.9

package/dist/shared/graphql/fetch.js

@@ -6,14 +6,15 @@ import { getActiveWorkspaceToken as i, resolveActiveProfileId as a, setProfileWo
 import { readActiveContextValueWithUrlPrecedence as s } from "../providers/shell/ActiveContextStorage.js";
 import { getValidAccessTokenFromStorage as c, sanitizeExtraHeaders as l, sanitizeGeography as u, validateGatewayBaseUrl as d } from "./security.js";
 import { isWorkspaceTokenValidForContext as f } from "./workspaceToken.js";
-import { dispatchBackendErrorEvent as p, markConnectionHealthy as m } from "../utils/backendErrors.js";
+import { isSameWorkspaceId as p } from "./workspaceOperationGuard.js";
+import { dispatchBackendErrorEvent as m, markConnectionHealthy as h } from "../utils/backendErrors.js";
 //#region src/shared/graphql/fetch.ts
-var h = "burdenoff:session-expired";
-function g(e) {
-	typeof window > "u" || window.dispatchEvent(new CustomEvent(h, { detail: e }));
+var g = "burdenoff:session-expired";
+function _(e) {
+	typeof window > "u" || window.dispatchEvent(new CustomEvent(g, { detail: e }));
 }
-var _ = "\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      workspaceId\n      error {\n        message\n      }\n    }\n  }\n", v = /* @__PURE__ */ new Map();
-function y() {
+var v = "\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      workspaceId\n      error {\n        message\n      }\n    }\n  }\n", y = /* @__PURE__ */ new Map();
+function b() {
 	try {
 		let e = sessionStorage.getItem("bf-active-profile");
 		return e ? c(localStorage.getItem(`bf-p-${e}-tokens`)) : null;
@@ -21,21 +22,21 @@ function y() {
 		return null;
 	}
 }
-function b() {
+function x() {
 	try {
 		return i();
 	} catch {
 		return null;
 	}
 }
-function x() {
+function S() {
 	try {
 		return sessionStorage.getItem("bf-active-profile");
 	} catch {
 		return null;
 	}
 }
-function S() {
+function C() {
 	try {
 		let e = sessionStorage.getItem("bf-active-profile");
 		if (!e) return !1;
@@ -45,7 +46,7 @@ function S() {
 		return !1;
 	}
 }
-function C(e) {
+function w(e) {
 	try {
 		let [, t] = e.split(".");
 		if (!t || typeof globalThis.atob != "function") return null;
@@ -55,11 +56,11 @@ function C(e) {
 		return null;
 	}
 }
-function w(e) {
-	let t = C(e)?.exp;
+function ee(e) {
+	let t = w(e)?.exp;
 	return typeof t == "number" ? t * 1e3 <= Date.now() + 3e4 : !1;
 }
-function ee() {
+function te() {
 	try {
 		let e = sessionStorage.getItem("bf-active-profile");
 		if (e) {
@@ -103,7 +104,7 @@ function A() {
 		return null;
 	}
 }
-function te(e) {
+function ne(e) {
 	return {
 		workspaceId: typeof e.workspaceId == "string" ? e.workspaceId : E() || void 0,
 		organizationId: typeof e.organizationId == "string" ? e.organizationId : D() || A() || void 0,
@@ -113,12 +114,19 @@ function te(e) {
 }
 function j(e, t, n) {
 	try {
-		let r = a() ?? x();
+		let r = a() ?? S();
 		if (!r) return;
 		o(r, t), sessionStorage.setItem("burdenoff-active-context-workspace", e), n && sessionStorage.setItem("burdenoff-active-context-organization", n);
 	} catch {}
 }
-function M(e, t, n) {
+function M() {
+	try {
+		return a() ?? S();
+	} catch {
+		return null;
+	}
+}
+function N(e, t, n) {
 	return t ? t.aborted ? Promise.resolve(n) : new Promise((r) => {
 		let i = () => r(n);
 		t.addEventListener("abort", i, { once: !0 }), e.then(r, () => r(n)).finally(() => {
@@ -126,29 +134,27 @@ function M(e, t, n) {
 		});
 	}) : e;
 }
-async function N(e) {
+async function P(e) {
 	let { url: t, authToken: n, workspaceId: r, organizationId: i, projectId: a, locale: o, signal: s, currentQuery: c, issuanceGuard: l } = e;
 	if (!n || c.includes("issueWorkspaceToken") || l && !l.isCurrent()) return null;
 	let u = r || E();
 	if (!u) return null;
-	let d = b(), p = E(), m = i || D() || A();
-	if (d && p === u && f(d, {
+	let d = x(), m = E(), h = i || D() || A();
+	if (d && m === u && f(d, {
 		workspaceId: u,
-		organizationId: m,
+		organizationId: h,
 		projectId: a
 	}) && (!l || l.accepts(d, u))) return d;
-	let h = JSON.stringify([
-		m ?? "",
+	let g = M(), _ = JSON.stringify([
+		h ?? "",
 		u,
 		a ?? "",
-		l ? [
-			t,
-			n,
-			l.identityKey
-		] : null
-	]), g = v.get(h);
-	if (g) return M(g, s, null);
-	let y = fetch(t, {
+		g ?? "",
+		n,
+		l ? [t, l.identityKey] : null
+	]), b = y.get(_);
+	if (b) return N(b, s, null);
+	let S = fetch(t, {
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
@@ -157,78 +163,84 @@ async function N(e) {
 			...o ? { "Accept-Language": o } : {}
 		},
 		body: JSON.stringify({
-			query: _,
+			query: v,
 			variables: { input: {
 				workspaceId: u,
-				...m ? { organizationId: m } : {},
+				...h ? { organizationId: h } : {},
 				...a ? { projectId: a } : {}
 			} }
 		})
 	}).then(async (e) => {
 		if (l && !e.ok) return null;
 		let t = await e.json(), n = t.data?.issueWorkspaceToken;
-		return l && (t.errors !== void 0 && (!Array.isArray(t.errors) || t.errors.length !== 0) || n?.success !== !0 || typeof n.token != "string" || n.token.length === 0 || n.workspaceId !== u) ? null : n?.success && n.token ? l && (!l.isCurrent() || !l.accepts(n.token, n.workspaceId || u)) ? null : (j(n.workspaceId || u, n.token, m ?? void 0), n.token) : null;
+		if (l && (t.errors !== void 0 && (!Array.isArray(t.errors) || t.errors.length !== 0) || n?.success !== !0 || typeof n.token != "string" || n.token.length === 0 || n.workspaceId !== u)) return null;
+		if (n?.success && n.token) {
+			if (l && (!l.isCurrent() || !l.accepts(n.token, n.workspaceId || u))) return null;
+			let e = n.workspaceId || u;
+			return p(e, E()) && M() === g && j(e, n.token, h ?? void 0), n.token;
+		}
+		return null;
 	}).catch(() => null).finally(() => {
-		v.delete(h);
+		y.delete(_);
 	});
-	return v.set(h, y), M(y, s, null);
+	return y.set(_, S), N(S, s, null);
 }
-function P(e, n) {
+function F(e, n) {
 	let i = r[e], a = t(), o = e === "global" ? a.globalBaseUrl : a.workspaceBaseUrl, s = n || o;
 	return `${s.endsWith("/") ? s.slice(0, -1) : s}${i.graphql}`;
 }
-function F(e) {
+function I(e) {
 	return e.reason ?? new DOMException("The operation was aborted.", "AbortError");
 }
-function I(e) {
-	if (e?.aborted) throw F(e);
+function L(e) {
+	if (e?.aborted) throw I(e);
 }
-function L() {
+function R() {
 	return globalThis;
 }
-function R() {
-	let e = L();
+function z() {
+	let e = R();
 	return e.__graphqlFetchQueues ||= /* @__PURE__ */ new Map(), e.__graphqlFetchQueues;
 }
-function z() {
-	let e = L();
+function B() {
+	let e = R();
 	return e.__graphqlFetchResponseCache ||= /* @__PURE__ */ new Map(), e.__graphqlFetchResponseCache;
 }
-function B() {
-	let e = L();
+function V() {
+	let e = R();
 	return e.__graphqlFetchPendingResponses ||= /* @__PURE__ */ new Map(), e.__graphqlFetchPendingResponses;
 }
-var V = Symbol.for("@burdenoff/fe-libs:graphql-fetch-cache-hit");
-function H(e) {
-	return !!(e && typeof e == "object" && e[V] === !0);
+var H = Symbol.for("@burdenoff/fe-libs:graphql-fetch-cache-hit");
+function re(e) {
+	return !!(e && typeof e == "object" && e[H] === !0);
 }
-function ne() {
-	z().clear(), B().clear(), n();
+function ie() {
+	B().clear(), V().clear(), n();
 }
-var re = 10, ie = 600, U = 100, ae = 1e4, W = 15e3, oe = new Set([
+var ae = 10, oe = 600, U = 100, se = 1e4, W = 15e3, ce = new Set([
 	"traceparent",
 	"tracestate",
 	"baggage"
 ]), G = "Apollo-Require-Preflight";
-function se() {
+function le() {
 	if (typeof performance > "u") return U;
-	let e = L();
-	return e.__graphqlFetchBurstStartedAt ??= performance.now(), performance.now() - e.__graphqlFetchBurstStartedAt < ae ? ie : U;
+	let e = R();
+	return e.__graphqlFetchBurstStartedAt ??= performance.now(), performance.now() - e.__graphqlFetchBurstStartedAt < se ? oe : U;
 }
-function ce(e) {
+function ue(e) {
 	return typeof e.query == "string" ? /^\s*query\b/.test(e.query) : !1;
 }
-function le(e) {
+function de(e) {
 	return typeof e.operationName == "string" && e.operationName.length > 0 ? {
 		operationName: e.operationName,
 		variables: e.variables ?? null
 	} : e;
 }
-function ue(e) {
+function fe(e) {
 	let t = /* @__PURE__ */ new Map();
 	for (let [n, r] of Object.entries(e)) {
 		let e = n.toLowerCase();
-		oe.has(e) || t.set(e, r);
+		ce.has(e) || t.set(e, r);
 	}
 	return Object.fromEntries(Array.from(t.entries()).sort(([e], [t]) => e.localeCompare(t)));
 }
@@ -241,13 +253,13 @@ function K(t) {
 	};
 }
 function q(e) {
-	return de(e) && Array.isArray(e.errors);
+	return pe(e) && Array.isArray(e.errors);
 }
 function J(e) {
 	let t = e.status;
 	return t === 401 ? "Invalid email or password." : t === 403 ? "You do not have permission to do that." : t === 404 ? "We could not find what you were looking for." : t === 408 || t === 504 ? "The server took too long to respond. Please try again." : t === 429 ? "Too many requests. Please wait a moment and try again." : t >= 500 && t < 600 ? "The server is having trouble right now. Please try again in a moment." : t >= 400 && t < 500 ? "The request could not be processed. Please refresh and try again." : "We could not reach the server. Please check your connection and try again.";
 }
-function de(e) {
+function pe(e) {
 	return typeof e == "object" && !!e && !Array.isArray(e);
 }
 async function Y(e) {
@@ -272,7 +284,7 @@ async function X(e, t, n) {
 				...r.keepalive ? { keepalive: !0 } : {}
 			}), i = await Y(n);
 			if (!n.ok && !q(i)) throw Error(J(n));
-			r.cacheKey && !q(i) && z().set(r.cacheKey, {
+			r.cacheKey && !q(i) && B().set(r.cacheKey, {
 				value: i,
 				expiresAt: Date.now() + W
 			}), r.resolve(i);
@@ -292,7 +304,7 @@ async function X(e, t, n) {
 		if (!i.ok && !q(a)) throw Error(J(i));
 		if (Array.isArray(a)) a.forEach((e, t) => {
 			let r = n[t];
-			r && (r.cacheKey && !q(e) && z().set(r.cacheKey, {
+			r && (r.cacheKey && !q(e) && B().set(r.cacheKey, {
 				value: e,
 				expiresAt: Date.now() + W
 			}), r.resolve(e));
@@ -306,18 +318,18 @@ async function X(e, t, n) {
 	}
 }
 function Z(e, t, n, r, i) {
-	let a = ue(t), o = i?.keepalive === !0, s = o ? 1 : Math.max(1, i?.batchMax ?? re), c = Math.max(0, i?.batchInterval ?? se()), l = `${e}|${JSON.stringify(a)}`, u = ce(n) ? `${l}|${JSON.stringify(le(n))}` : void 0;
-	if (r?.aborted) return Promise.reject(F(r));
+	let a = fe(t), o = i?.keepalive === !0, s = o ? 1 : Math.max(1, i?.batchMax ?? ae), c = Math.max(0, i?.batchInterval ?? le()), l = `${e}|${JSON.stringify(a)}`, u = ue(n) ? `${l}|${JSON.stringify(de(n))}` : void 0;
+	if (r?.aborted) return Promise.reject(I(r));
 	if (u) {
-		let e = z(), t = e.get(u);
+		let e = B(), t = e.get(u);
 		if (t) {
 			if (t.expiresAt > Date.now()) {
 				let e = Promise.resolve(t.value);
-				return e[V] = !0, e;
+				return e[H] = !0, e;
 			}
 			e.delete(u);
 		}
-		let n = B().get(u);
+		let n = V().get(u);
 		if (n) return n;
 	}
 	let d = new Promise((t, i) => {
@@ -332,7 +344,7 @@ function Z(e, t, n, r, i) {
 			}]);
 			return;
 		}
-		let d = R(), f = d.get(l);
+		let d = z(), f = d.get(l);
 		f || (f = {
 			requests: [],
 			timer: null,
@@ -347,115 +359,115 @@ function Z(e, t, n, r, i) {
 			cacheKey: u
 		};
 		if (f.requests.push(p), r && r.addEventListener("abort", () => {
-			let e = R().get(l), t = e ? e.requests.indexOf(p) : -1;
-			e && t >= 0 && (e.requests.splice(t, 1), e.requests.length === 0 && (e.timer && clearTimeout(e.timer), R().delete(l))), i(F(r));
+			let e = z().get(l), t = e ? e.requests.indexOf(p) : -1;
+			e && t >= 0 && (e.requests.splice(t, 1), e.requests.length === 0 && (e.timer && clearTimeout(e.timer), z().delete(l))), i(I(r));
 		}, { once: !0 }), f.requests.length >= f.batchMax) {
 			Q(e, a, l);
 			return;
 		}
 		f.timer ||= setTimeout(() => Q(e, a, l), f.batchInterval);
 	});
-	return u && !r && (B().set(u, d), d.finally(() => {
-		B().delete(u);
+	return u && !r && (V().set(u, d), d.finally(() => {
+		V().delete(u);
 	}).catch(() => {})), d;
 }
 function Q(e, t, n) {
-	let r = R(), i = r.get(n);
+	let r = z(), i = r.get(n);
 	i && (r.delete(n), i.timer &&= (clearTimeout(i.timer), null), X(e, t, i.requests));
 }
 async function $(e) {
-	let { gateway: n, query: r, variables: i, operationName: a, authToken: o, workspaceToken: s, workspaceId: c, organizationId: u, tenantId: h, projectId: _, locale: v, baseUrl: x, extraHeaders: C, signal: E, suppressGlobalErrorEvent: D, keepalive: k } = e;
-	I(E);
-	let A = d(P(n, x)), j = o && !w(o) ? o : y();
-	if (!j && !e.skipAuthRetry && typeof window < "u" && !window.location.pathname.startsWith("/auth/") && S()) {
+	let { gateway: n, query: r, variables: i, operationName: a, authToken: o, workspaceToken: s, workspaceId: c, organizationId: u, tenantId: p, projectId: g, locale: v, baseUrl: y, extraHeaders: S, signal: w, suppressGlobalErrorEvent: E, keepalive: D } = e;
+	L(w);
+	let k = d(F(n, y)), A = o && !ee(o) ? o : b();
+	if (!A && !e.skipAuthRetry && typeof window < "u" && !window.location.pathname.startsWith("/auth/") && C()) {
 		let e = await import("../utils/authErrorHandling.js");
 		await e.attemptTokenRefresh({
-			globalBaseUrl: n === "global" && x ? x : t().globalBaseUrl,
+			globalBaseUrl: n === "global" && y ? y : t().globalBaseUrl,
 			...e.getSharedTokenRefreshRefs()
-		}) ? j = y() : g({
+		}) ? A = b() : _({
 			operationName: a,
 			gateway: n
-		}), I(E);
+		}), L(w);
 	}
-	let M = v ?? T(), F = te({
+	let j = v ?? T(), M = ne({
 		workspaceId: c,
 		organizationId: u,
-		tenantId: h,
-		projectId: _
-	}), L = {
+		tenantId: p,
+		projectId: g
+	}), N = {
 		"Content-Type": "application/json",
 		[G]: "true"
 	};
-	j && (L.Authorization = `Bearer ${j}`), M && (L["Accept-Language"] = M);
-	let R = ee();
-	if (R?.country && (L["X-Geo-Country"] = R.country), R?.currency && (L["X-Geo-Currency"] = R.currency), R?.timezone && (L["X-Geo-Timezone"] = R.timezone), n === "workspace" ? s !== !1 : s) {
-		let e = typeof s == "string" ? s : b();
-		e && !f(e, F) && (e = null), !e && (s === !0 || n === "workspace" && s === void 0 || typeof s == "string") && (e = await N({
-			url: A,
-			authToken: j,
-			workspaceId: F.workspaceId,
-			organizationId: F.organizationId,
-			projectId: F.projectId,
-			locale: M,
-			signal: E,
+	A && (N.Authorization = `Bearer ${A}`), j && (N["Accept-Language"] = j);
+	let I = te();
+	if (I?.country && (N["X-Geo-Country"] = I.country), I?.currency && (N["X-Geo-Currency"] = I.currency), I?.timezone && (N["X-Geo-Timezone"] = I.timezone), n === "workspace" ? s !== !1 : s) {
+		let e = typeof s == "string" ? s : x();
+		e && !f(e, M) && (e = null), !e && (s === !0 || n === "workspace" && s === void 0 || typeof s == "string") && (e = await P({
+			url: k,
+			authToken: A,
+			workspaceId: M.workspaceId,
+			organizationId: M.organizationId,
+			projectId: M.projectId,
+			locale: j,
+			signal: w,
 			currentQuery: r
-		}), I(E)), e && (L["X-Workspace-Authorization"] = `Bearer ${e}`);
+		}), L(w)), e && (N["X-Workspace-Authorization"] = `Bearer ${e}`);
 	}
 	if (n === "workspace" || c) {
-		let e = F.workspaceId;
-		e && (L["x-workspace-id"] = e);
+		let e = M.workspaceId;
+		e && (N["x-workspace-id"] = e);
 	}
 	if (n === "global" || u) {
-		let e = F.organizationId;
-		e && (L["x-org-id"] = e);
+		let e = M.organizationId;
+		e && (N["x-org-id"] = e);
 	}
-	if (h) {
-		let e = typeof h == "string" ? h : O();
-		e && (L["x-tenant-id"] = e);
+	if (p) {
+		let e = typeof p == "string" ? p : O();
+		e && (N["x-tenant-id"] = e);
 	}
-	if (n === "workspace" || _) {
-		let e = F.projectId;
-		e && (L["x-project-id"] = e);
+	if (n === "workspace" || g) {
+		let e = M.projectId;
+		e && (N["x-project-id"] = e);
 	}
-	let z = l(C);
-	z && Object.assign(L, z);
-	let B = { query: r };
-	i && (B.variables = i), a && (B.operationName = a);
-	let V = async (r) => {
-		if (e.skipAuthRetry || !j || typeof window > "u" || !r?.length) return null;
+	let R = l(S);
+	R && Object.assign(N, R);
+	let z = { query: r };
+	i && (z.variables = i), a && (z.operationName = a);
+	let B = async (r) => {
+		if (e.skipAuthRetry || !A || typeof window > "u" || !r?.length) return null;
 		let i = await import("../utils/authErrorHandling.js");
 		return i.hasAuthGraphQLErrors(r) ? await i.attemptTokenRefresh({
-			globalBaseUrl: n === "global" && x ? x : t().globalBaseUrl,
+			globalBaseUrl: n === "global" && y ? y : t().globalBaseUrl,
 			...i.getSharedTokenRefreshRefs()
 		}) ? $({
 			...e,
 			authToken: void 0,
 			workspaceToken: typeof s == "string" ? !0 : s,
 			skipAuthRetry: !0
-		}) : (g({
+		}) : (_({
 			operationName: a,
 			gateway: n
 		}), null) : null;
 	};
 	try {
-		let e = Z(A, L, B, E, k ? { keepalive: !0 } : void 0), t = await e;
-		if (H(e) || m(), t.errors?.length) {
-			let e = await V(t.errors);
+		let e = Z(k, N, z, w, D ? { keepalive: !0 } : void 0), t = await e;
+		if (re(e) || h(), t.errors?.length) {
+			let e = await B(t.errors);
 			if (e) return e;
-			D || p({ errors: t.errors }, { operationName: a });
+			E || m({ errors: t.errors }, { operationName: a });
 		}
 		return t;
 	} catch (e) {
 		let t = e.errors;
 		if (t?.length) {
-			let e = await V(t);
+			let e = await B(t);
 			if (e) return e;
 		}
-		throw D || p(e, {
+		throw E || m(e, {
 			operationName: a,
 			fallbackMessage: "We could not reach the server. Please check your connection and try again."
 		}), e;
 	}
 }
 //#endregion
-export { h as SESSION_EXPIRED_EVENT, ne as clearGraphqlFetchResponseCache, Z as enqueueGraphQLFetch, N as ensureWorkspaceToken, y as getStoredAuthToken, T as getStoredLocale, D as getStoredOrganizationId, k as getStoredProjectId, O as getStoredTenantId, E as getStoredWorkspaceId, b as getStoredWorkspaceToken, $ as graphqlFetch, P as resolveGatewayUrl };
+export { g as SESSION_EXPIRED_EVENT, ie as clearGraphqlFetchResponseCache, Z as enqueueGraphQLFetch, P as ensureWorkspaceToken, b as getStoredAuthToken, T as getStoredLocale, D as getStoredOrganizationId, k as getStoredProjectId, O as getStoredTenantId, E as getStoredWorkspaceId, x as getStoredWorkspaceToken, $ as graphqlFetch, F as resolveGatewayUrl };

package/dist/shared/graphql/index.d.ts

@@ -1,6 +1,7 @@
 export { createGraphQLClient, initializeAppClients, getWorkspaceClient, getGlobalClient, resetAppClients, type CreateClientOptions, type AppClientConfig, type Gateway, } from './client';
 export { GatewayProvider, useGateway, useGatewayClient, useSafeGateway, useSafeGatewayClient, type GatewayContextValue, type GatewayProviderProps, } from './GatewayContext';
 export { graphqlFetch, clearGraphqlFetchResponseCache, getStoredAuthToken, getStoredWorkspaceToken, getStoredWorkspaceId, getStoredLocale, getStoredOrganizationId, getStoredProjectId, resolveGatewayUrl, type GraphQLFetchOptions, type GraphQLResponse, } from './fetch';
+export { WORKSPACE_CONTEXT_CHANGED, WORKSPACE_CONTEXT_MISMATCH_EVENT, WORKSPACE_WRITE_REFUSED_EVENT, WORKSPACE_WRITE_REFUSED_MESSAGE, WorkspaceContextChangedError, isWorkspaceContextChangedError, readContextInputWorkspaceId, type WorkspaceContextChangedDetail, type WorkspaceOperationGuardMode, } from './workspaceOperationGuard';
 export { getWorkspaceTokenPayload, isWorkspaceTokenValidForContext, type WorkspaceTokenContext, type WorkspaceTokenPayload, } from './workspaceToken';
 export { useHasAuthToken } from './useHasAuthToken';
 export { SSELink, type SSELinkOptions } from './links/sse-link';

package/dist/shared/graphql/workspaceOperationGuard.d.ts

@@ -0,0 +1,70 @@
+import { ApolloClient } from '@apollo/client/core';
+import { DocumentNode } from 'graphql';
+export declare const WORKSPACE_CONTEXT_CHANGED: "WORKSPACE_CONTEXT_CHANGED";
+/** Dispatched on `window` once per refused mutation (guard `'enforce'`). */
+export declare const WORKSPACE_WRITE_REFUSED_EVENT: "burdenoff:workspace-write-refused";
+/** Dispatched on `window` per mismatching operation that is still sent (guard `'report'`). */
+export declare const WORKSPACE_CONTEXT_MISMATCH_EVENT: "burdenoff:workspace-context-mismatch";
+/** What the user is told when a save was refused (the shell toast's English fallback). */
+export declare const WORKSPACE_WRITE_REFUSED_MESSAGE = "Not saved \u2014 workspace changed, switch back and try again";
+export type WorkspaceOperationGuardMode = 'off' | 'report' | 'enforce';
+export type GuardedOperationKind = 'query' | 'mutation' | 'subscription';
+export type WorkspaceGuardPhase = 'before-send' | 'after-token-mint';
+export interface WorkspaceContextChangedDetail {
+    operationName: string | null;
+    operationKind: GuardedOperationKind;
+    /** The workspace named in the operation's ContextInput. */
+    builtForWorkspaceId: string;
+    /** The workspace that was active when the operation would have been sent. */
+    activeWorkspaceId: string;
+    /** `after-token-mint`: the switch landed while a workspace token was being minted. */
+    phase: WorkspaceGuardPhase;
+}
+export declare class WorkspaceContextChangedError extends Error {
+    readonly code: "WORKSPACE_CONTEXT_CHANGED";
+    readonly extensions: {
+        code: "WORKSPACE_CONTEXT_CHANGED";
+    };
+    readonly detail: WorkspaceContextChangedDetail;
+    constructor(detail: WorkspaceContextChangedDetail);
+}
+/**
+ * True for a refusal by this guard. Duck-typed (name, code, `extensions.code`,
+ * then `cause`) so that an error from a second bundled copy of fe-libs, or one
+ * Apollo wrapped, still matches.
+ */
+export declare function isWorkspaceContextChangedError(error: unknown): error is WorkspaceContextChangedError;
+/** Only a mode the guard knows is honoured: anything else is `'off'`. */
+export declare function normalizeWorkspaceOperationGuardMode(value: unknown): WorkspaceOperationGuardMode;
+/**
+ * Workspace ids are UUIDs, so they compare trimmed and case-insensitively: a
+ * difference in spelling alone must never refuse an operation.
+ */
+export declare function isSameWorkspaceId(a: string | null, b: string | null): boolean;
+/** The workspace an operation was built for, from the ContextInput convention only. */
+export declare function readContextInputWorkspaceId(variables: unknown): string | null;
+export declare function operationKindOf(query: DocumentNode): GuardedOperationKind;
+/**
+ * The mismatch, or null when the operation may be sent: it names no workspace,
+ * no workspace is active, or the two are the same.
+ */
+export declare function findWorkspaceContextMismatch(operation: {
+    operationName?: string | null;
+    variables?: unknown;
+    query: DocumentNode;
+}, activeWorkspaceId: string | null, phase: WorkspaceGuardPhase): WorkspaceContextChangedDetail | null;
+/**
+ * For a refetch of active queries under the guard: false only for a query the
+ * guard would refuse (built for a workspace other than the active one). Such a
+ * query keeps showing its own workspace's data until its screen remounts.
+ */
+export declare function isQueryForActiveWorkspace(observableQuery: {
+    variables?: unknown;
+}, activeWorkspaceId: string | null): boolean;
+/**
+ * Refetch a client's active queries. Under `'enforce'` it skips the queries
+ * the guard would refuse, so a refresh (after a switch, or after a save) never
+ * re-sends a screen built for the previous workspace. Otherwise it refetches
+ * every active query, as before.
+ */
+export declare function refetchActiveQueries(client: Pick<ApolloClient, 'refetchQueries'>, guard: WorkspaceOperationGuardMode, activeWorkspaceId: () => string | null): Promise<unknown>;

package/dist/shared/graphql/workspaceOperationGuard.js

@@ -0,0 +1,62 @@
+//#region src/shared/graphql/workspaceOperationGuard.ts
+var e = "WORKSPACE_CONTEXT_CHANGED", t = "burdenoff:workspace-write-refused", n = "burdenoff:workspace-context-mismatch", r = "Not saved — workspace changed, switch back and try again", i = "Not loaded — this request was built for a workspace that is no longer active", a = class extends Error {
+	code = e;
+	extensions = { code: e };
+	detail;
+	constructor(e) {
+		super(e.operationKind === "mutation" ? r : i), this.name = "WorkspaceContextChangedError", this.detail = e;
+	}
+};
+function o(e) {
+	let t = e;
+	for (let e = 0; e < 4; e += 1) {
+		if (t instanceof a) return !0;
+		if (!t || typeof t != "object") return !1;
+		let e = t;
+		if (e.name === "WorkspaceContextChangedError" || e.code === "WORKSPACE_CONTEXT_CHANGED" || e.extensions?.code === "WORKSPACE_CONTEXT_CHANGED") return !0;
+		if (e.cause === t) return !1;
+		t = e.cause;
+	}
+	return !1;
+}
+function s(e) {
+	return e === "report" || e === "enforce" ? e : "off";
+}
+function c(e) {
+	return typeof e == "string" && e.trim() ? e.trim() : null;
+}
+function l(e, t) {
+	let n = c(e), r = c(t);
+	return n !== null && r !== null && n.toLowerCase() === r.toLowerCase();
+}
+function u(e) {
+	if (!e || typeof e != "object") return null;
+	let t = e;
+	return c(t.context?.workspaceId) ?? c(t.input?.context?.workspaceId);
+}
+function d(e) {
+	for (let t of e.definitions) if (t.kind === "OperationDefinition") return t.operation;
+	return "query";
+}
+function f(e, t, n) {
+	let r = u(e.variables), i = c(t);
+	return !r || !i || l(r, i) ? null : {
+		operationName: e.operationName || null,
+		operationKind: d(e.query),
+		builtForWorkspaceId: r,
+		activeWorkspaceId: i,
+		phase: n
+	};
+}
+function p(e, t) {
+	let n = u(e.variables);
+	return !n || !c(t) || l(n, t);
+}
+function m(e, t, n) {
+	return t === "enforce" ? e.refetchQueries({
+		include: "active",
+		onQueryUpdated: (e) => p(e, n())
+	}) : e.refetchQueries({ include: "active" });
+}
+//#endregion
+export { e as WORKSPACE_CONTEXT_CHANGED, n as WORKSPACE_CONTEXT_MISMATCH_EVENT, t as WORKSPACE_WRITE_REFUSED_EVENT, r as WORKSPACE_WRITE_REFUSED_MESSAGE, a as WorkspaceContextChangedError, f as findWorkspaceContextMismatch, l as isSameWorkspaceId, o as isWorkspaceContextChangedError, s as normalizeWorkspaceOperationGuardMode, u as readContextInputWorkspaceId, m as refetchActiveQueries };

package/dist/shared/providers/AppShellProvider.d.ts

@@ -1,4 +1,5 @@
 import { CSSProperties, ReactNode } from 'react';
+import { WorkspaceOperationGuardMode } from '../graphql/workspaceOperationGuard';
 import { Brand, ThemeMode, Density, Typography, GlassIntensity } from './shell/ThemeProvider';
 import { TranslationDictionary } from './shell/I18nProvider';
 import { BurdenoffEventName } from '../events';
@@ -127,6 +128,21 @@ export interface AppShellConfig {
     tourRouteCatalog?: readonly TourRouteCatalogEntry[];
     /** Resolve workspace RBAC above the tour runtime for permission-targeted tours. */
     enableWorkspaceTourPermissions?: boolean;
+    /**
+     * BOFF-8106: what the workspace gateway client does with an operation whose
+     * ContextInput (`variables.context.workspaceId` or
+     * `variables.input.context.workspaceId`) names a workspace other than the
+     * active one.
+     * - `'off'` (default): send it, as before.
+     * - `'report'`: send it and dispatch `burdenoff:workspace-context-mismatch`
+     *   (measure on alpha before enforcing).
+     * - `'enforce'`: do not send it. A refused save shows "Not saved — workspace
+     *   changed, switch back and try again"; a refused read ends with a
+     *   `WorkspaceContextChangedError` and no error toast. A switch no longer
+     *   re-sends screens built for the previous workspace.
+     * Opt in only after the app sends no placeholder workspace in a ContextInput.
+     */
+    workspaceOperationGuard?: WorkspaceOperationGuardMode;
 }
 export interface AppShellObservabilityConfig {
     enabled?: boolean;