@burdenoff/microfe-auth 2026.1014.1 → 2026.1014.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/auth/hooks/useContextSwitcherData.js +162 -150
  2. package/dist/auth/hooks/useContextSwitcherData.js.map +1 -1
  3. package/package.json +1 -1
package/dist/auth/hooks/useContextSwitcherData.js CHANGED
@@ -8,8 +8,8 @@ import { clearWorkspaceWideSelection as u, isWorkspaceWideSelection as d, select
8
8
  import { getUrlParam as p } from "@burdenoff/fe-libs/shared/providers/shell/ActiveContextStorage";
9
9
  import { useActiveContext as m } from "@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider";
10
10
  //#region src/auth/hooks/useContextSwitcherData.ts
11
- var h = "\n query MyOrganizations {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n }\n", g = "\n query WorkspacesByOrg {\n workspaces: myWorkspaces(limit: 100) {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n", _ = "\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success\n token\n expiresAt\n organizationId\n workspaceId\n projectId\n scopes\n error {\n code\n message\n }\n }\n }\n", v = "\n query MyProjectsForContext {\n projects: myProjects {\n total\n items {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n }\n";
12
- function y(e, t = 3e4) {
11
+ var h = "\n query MyOrganizations {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n }\n", g = "\n query WorkspacesByOrg {\n workspaces: myWorkspaces(limit: 100) {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n", ee = "\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success\n token\n expiresAt\n organizationId\n workspaceId\n projectId\n scopes\n error {\n code\n message\n }\n }\n }\n", _ = "\n query MyProjectsForContext {\n projects: myProjects {\n total\n items {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n }\n";
12
+ function v(e, t = 3e4) {
13
13
  try {
14
14
  let n = JSON.parse(atob(e.split(".")[1]));
15
15
  return n.exp ? n.exp * 1e3 < Date.now() + t : !1;
@@ -17,7 +17,7 @@ function y(e, t = 3e4) {
17
17
  return !0;
18
18
  }
19
19
  }
20
- function b(e) {
20
+ function y(e) {
21
21
  try {
22
22
  let t = JSON.parse(atob(e.split(".")[1]));
23
23
  return {
@@ -30,26 +30,26 @@ function b(e) {
30
30
  return null;
31
31
  }
32
32
  }
33
- function x(e, t) {
34
- if (!e || y(e)) return !1;
35
- let n = b(e);
33
+ function b(e, t) {
34
+ if (!e || v(e)) return !1;
35
+ let n = y(e);
36
36
  return !(!n || t.workspaceId && n.workspaceId !== t.workspaceId || t.organizationId && n.organizationId !== t.organizationId || t.workspaceWide && n.projectId || t.projectId && n.projectId !== t.projectId);
37
37
  }
38
- var S = class extends Error {
38
+ var x = class extends Error {
39
39
  constructor(e) {
40
40
  super(e), this.name = "AuthError";
41
41
  }
42
42
  };
43
- function C(e) {
43
+ function S(e) {
44
44
  return e.some((e) => e.extensions?.code === "UNAUTHENTICATED" || e.message?.toLowerCase().includes("unauthorized") || e.message?.toLowerCase().includes("not authenticated"));
45
45
  }
46
- function w() {
46
+ function C() {
47
47
  let t = e.getState().accessToken;
48
- if (t && !y(t)) return t;
48
+ if (t && !v(t)) return t;
49
49
  let n = c();
50
- return n && !y(n) ? n : t;
50
+ return n && !v(n) ? n : t;
51
51
  }
52
- function T(e) {
52
+ function w(e) {
53
53
  return Array.from(new Set(e.flatMap((e) => e.organizationId ? [e.organizationId] : []))).map((t, n) => ({
54
54
  id: t,
55
55
  name: e.find((e) => e.organizationId === t)?.name || `Organization ${n + 1}`,
@@ -57,69 +57,81 @@ function T(e) {
57
57
  tenantId: e.find((e) => e.organizationId === t)?.tenantId || ""
58
58
  }));
59
59
  }
60
- var E = new Set([
60
+ var T = new Set([
61
61
  "project.created",
62
62
  "project.updated",
63
63
  "project.deleted",
64
64
  "project.archived",
65
65
  "project.unarchived"
66
- ]), D = new Set([
66
+ ]), E = new Set([
67
67
  "workspace.created",
68
68
  "workspace.updated",
69
69
  "workspace.deleted",
70
70
  "workspace.archived",
71
71
  "workspace.reactivated"
72
72
  ]);
73
- function ee(e) {
73
+ function D(e) {
74
74
  if (e && typeof e == "object" && "workspaceId" in e) {
75
75
  let t = e.workspaceId;
76
76
  return typeof t == "string" ? t : void 0;
77
77
  }
78
78
  }
79
79
  function O(c) {
80
- let { organizationId: p, workspaceId: y, projectId: b, setContext: O } = m(), k = s(), A = e((e) => e.organizations), j = e((e) => e.currentOrganizationId), M = e((e) => e.isLoadingOrganizations), N = e((e) => e.workspaces), P = e((e) => e.currentWorkspaceId), F = e((e) => e.workspaceToken), I = e((e) => e.isLoadingWorkspaces), L = e((e) => e.projects), R = e((e) => e.currentProjectId), z = e((e) => e.isLoadingProjects), [te, B] = a(null), [V, H] = a(0), U = i(0), W = i(null), G = i(/* @__PURE__ */ new Map()), K = i(y), q = i(p);
80
+ let { organizationId: p, workspaceId: v, projectId: y, tenantId: O, setContext: k } = m(), A = s(), j = e((e) => e.organizations), M = e((e) => e.currentOrganizationId), N = e((e) => e.isLoadingOrganizations), P = e((e) => e.workspaces), F = e((e) => e.currentWorkspaceId), I = e((e) => e.workspaceToken), L = e((e) => e.isLoadingWorkspaces), te = e((e) => e.projects), ne = e((e) => e.currentProjectId), re = e((e) => e.isLoadingProjects);
81
81
  r(() => {
82
- K.current = y, q.current = p;
82
+ let e = P.find((e) => e.id === v && e.organizationId === p), t = j.find((e) => e.id === p);
83
+ !e || !t || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(e.tenantId) || e.tenantId !== t.tenantId || O === e.tenantId || k({ tenantId: e.tenantId });
84
+ }, [
85
+ p,
86
+ v,
87
+ O,
88
+ j,
89
+ P,
90
+ k
91
+ ]);
92
+ let [ie, R] = a(null), [z, B] = a(0), V = i(0), H = i(null), U = i(/* @__PURE__ */ new Map()), W = i(v), G = i(p);
93
+ r(() => {
94
+ W.current = v, G.current = p;
83
95
  });
84
- let ne = t(), J = c?.globalBaseUrl ?? ne.globalBaseUrl, Y = c?.workspaceBaseUrl ?? ne.workspaceBaseUrl, re = i(null), ie = i(null), ae = i(null), oe = i(null);
96
+ let K = t(), q = c?.globalBaseUrl ?? K.globalBaseUrl, J = c?.workspaceBaseUrl ?? K.workspaceBaseUrl, ae = i(null), Y = i(null), oe = i(null), se = i(null);
85
97
  r(() => {
86
98
  let t = e.getState();
87
- if (p && p !== t.currentOrganizationId && p !== re.current && (re.current = p, t.setCurrentOrganizationId(p), t.workspaces.length > 0 && !t.workspaces.some((e) => e.organizationId === p) && t.setWorkspaces([])), y && y !== t.currentWorkspaceId && y !== ie.current && (ie.current = y, t.setCurrentWorkspaceId(y), t.projects.length > 0 && !t.projects.some((e) => e.workspaceId === y) && (t.setProjects([]), t.setCurrentProjectId(null))), d({
99
+ if (p && p !== t.currentOrganizationId && p !== ae.current && (ae.current = p, t.setCurrentOrganizationId(p), t.workspaces.length > 0 && !t.workspaces.some((e) => e.organizationId === p) && t.setWorkspaces([])), v && v !== t.currentWorkspaceId && v !== Y.current && (Y.current = v, t.setCurrentWorkspaceId(v), t.projects.length > 0 && !t.projects.some((e) => e.workspaceId === v) && (t.setProjects([]), t.setCurrentProjectId(null))), d({
88
100
  organizationId: p,
89
- workspaceId: y
90
- }) && !b && t.currentProjectId && (t.setCurrentProjectId(null), t.setWorkspaceToken(null)), b && b !== t.currentProjectId && b !== ae.current && (ae.current = b, t.setCurrentProjectId(b)), t.workspaceToken && !x(t.workspaceToken, {
91
- workspaceId: y,
101
+ workspaceId: v
102
+ }) && !y && t.currentProjectId && (t.setCurrentProjectId(null), t.setWorkspaceToken(null)), y && y !== t.currentProjectId && y !== oe.current && (oe.current = y, t.setCurrentProjectId(y)), t.workspaceToken && !b(t.workspaceToken, {
103
+ workspaceId: v,
92
104
  organizationId: p,
93
- projectId: b,
94
- workspaceWide: !b && d({
105
+ projectId: y,
106
+ workspaceWide: !y && d({
95
107
  organizationId: p,
96
- workspaceId: y
108
+ workspaceId: v
97
109
  })
98
110
  })) {
99
- let e = `${p ?? ""}|${y ?? ""}|${b ?? ""}`;
100
- oe.current !== e && (oe.current = e, t.setWorkspaceToken(null));
111
+ let e = `${p ?? ""}|${v ?? ""}|${y ?? ""}`;
112
+ se.current !== e && (se.current = e, t.setWorkspaceToken(null));
101
113
  }
102
114
  }, [
103
115
  p,
104
- y,
105
- b
116
+ v,
117
+ y
106
118
  ]);
107
119
  let X = n(async () => {
108
- if (W.current) return W.current;
109
- let t = e.getState(), n = w();
110
- return n ? (t.setLoadingOrganizations(!0), B(null), W.current = (async () => {
120
+ if (H.current) return H.current;
121
+ let t = e.getState(), n = C();
122
+ return n ? (t.setLoadingOrganizations(!0), R(null), H.current = (async () => {
111
123
  try {
112
- let r = q.current ?? t.currentOrganizationId, i = r ? await (async () => {
124
+ let r = G.current ?? t.currentOrganizationId, i = r ? await (async () => {
113
125
  let [e, t] = await Promise.all([l({
114
126
  gateway: "global",
115
127
  query: h,
116
128
  authToken: n,
117
- baseUrl: J
129
+ baseUrl: q
118
130
  }), l({
119
131
  gateway: "global",
120
132
  query: g,
121
133
  authToken: n,
122
- baseUrl: J
134
+ baseUrl: q
123
135
  })]);
124
136
  return {
125
137
  data: e.data?.myOrganizations ? {
@@ -132,16 +144,16 @@ function O(c) {
132
144
  gateway: "global",
133
145
  query: h,
134
146
  authToken: n,
135
- baseUrl: J
147
+ baseUrl: q
136
148
  });
137
149
  if (r && i.errors?.length && i.errors.some((e) => e?.extensions?.code === "FORBIDDEN" || /not a member of this organization/i.test(e?.message ?? "") || /Cannot return null for non-nullable field Query\.myOrganizations/i.test(e?.message ?? "")) && (i = await l({
138
150
  gateway: "global",
139
151
  query: "\n query ContextSwitcherRecover {\n myOrganizations {\n total\n items { id name slug tenantId description logo website status type createdAt updatedAt }\n }\n workspaces: myWorkspaces {\n total\n items { id name slug tenantId organizationId type status region createdAt updatedAt }\n }\n }\n ",
140
152
  authToken: n,
141
- baseUrl: J
153
+ baseUrl: q
142
154
  })), i.errors?.length) {
143
155
  let e = i.errors[0]?.message ?? "GraphQL error";
144
- throw C(i.errors) ? new S(e) : (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", i.errors), Error(e));
156
+ throw S(i.errors) ? new x(e) : (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", i.errors), Error(e));
145
157
  }
146
158
  let a = i.data?.myOrganizations?.items ?? [];
147
159
  if (r && a.length === 0 && t.workspaces.length === 0) {
@@ -149,7 +161,7 @@ function O(c) {
149
161
  gateway: "global",
150
162
  query: h,
151
163
  authToken: n,
152
- baseUrl: J
164
+ baseUrl: q
153
165
  });
154
166
  if (!e.errors?.length) a = e.data?.myOrganizations?.items ?? [], i = {
155
167
  ...e,
@@ -161,13 +173,13 @@ function O(c) {
161
173
  else {
162
174
  console.warn("[ContextSwitcher] Stale-context recovery failed:", e.errors);
163
175
  let t = e.errors?.[0]?.message ?? "Failed to fetch organizations";
164
- throw C(e.errors ?? []) ? new S(t) : Error(t);
176
+ throw S(e.errors ?? []) ? new x(t) : Error(t);
165
177
  }
166
178
  }
167
- let o = a.length === 0 && t.workspaces.length > 0 ? T(t.workspaces) : [], s = o.length > 0 ? o : a;
179
+ let o = a.length === 0 && t.workspaces.length > 0 ? w(t.workspaces) : [], s = o.length > 0 ? o : a;
168
180
  t.setOrganizations(s);
169
181
  let c = r, u = c && a.some((e) => e.id === c);
170
- if (c && !u && a.length > 0 && (c = a[0].id, O({
182
+ if (c && !u && a.length > 0 && (c = a[0].id, k({
171
183
  organizationId: c,
172
184
  workspaceId: null,
173
185
  tenantId: null,
@@ -179,11 +191,11 @@ function O(c) {
179
191
  gateway: "global",
180
192
  query: g,
181
193
  authToken: n,
182
- baseUrl: J
194
+ baseUrl: q
183
195
  }).then((e) => e.errors?.length ? null : (e.data?.workspaces?.items ?? []).filter((e) => e.organizationId === c));
184
- if (e || H((e) => e + 1), e) {
196
+ if (e || B((e) => e + 1), e) {
185
197
  t.setWorkspaces(e);
186
- let n = K.current ? e.find((e) => e.id === K.current) : null;
198
+ let n = W.current ? e.find((e) => e.id === W.current) : null;
187
199
  if (n) t.setCurrentWorkspaceId(n.id);
188
200
  else if (e.length > 0) {
189
201
  let n = {
@@ -192,85 +204,85 @@ function O(c) {
192
204
  tenantId: e[0].tenantId,
193
205
  projectId: null
194
206
  };
195
- K.current ? (t.setCurrentWorkspaceId(e[0].id), t.setWorkspaceToken(null), O(n)) : t.currentWorkspaceId || (t.setCurrentWorkspaceId(e[0].id), O(n));
207
+ W.current ? (t.setCurrentWorkspaceId(e[0].id), t.setWorkspaceToken(null), k(n)) : t.currentWorkspaceId || (t.setCurrentWorkspaceId(e[0].id), k(n));
196
208
  }
197
209
  }
198
210
  } catch {
199
- H((e) => e + 1);
211
+ B((e) => e + 1);
200
212
  } finally {
201
213
  t.setLoadingWorkspaces(!1);
202
214
  }
203
215
  }
204
- return U.current = 0, s;
216
+ return V.current = 0, s;
205
217
  } catch (e) {
206
- if (e instanceof S) return [];
218
+ if (e instanceof x) return [];
207
219
  let n = e instanceof Error ? e.message : "Failed to fetch organizations";
208
- if (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", e), B(n), H((e) => e + 1), t.workspaces.length > 0) {
209
- let e = T(t.workspaces);
220
+ if (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", e), R(n), B((e) => e + 1), t.workspaces.length > 0) {
221
+ let e = w(t.workspaces);
210
222
  if (e.length > 0) return t.setOrganizations(e), t.currentOrganizationId || t.setCurrentOrganizationId(e[0].id), e;
211
223
  }
212
224
  return [];
213
225
  } finally {
214
- t.setLoadingOrganizations(!1), W.current = null;
226
+ t.setLoadingOrganizations(!1), H.current = null;
215
227
  }
216
- })(), W.current) : [];
217
- }, [J, O]);
228
+ })(), H.current) : [];
229
+ }, [q, k]);
218
230
  r(() => {
219
- if (V === 0 || U.current >= 5 || !w()) return;
220
- U.current += 1;
221
- let e = Math.min(1500 * 2 ** (U.current - 1), 12e3), t = window.setTimeout(() => {
231
+ if (z === 0 || V.current >= 5 || !C()) return;
232
+ V.current += 1;
233
+ let e = Math.min(1500 * 2 ** (V.current - 1), 12e3), t = window.setTimeout(() => {
222
234
  X();
223
235
  }, e);
224
236
  return () => {
225
237
  window.clearTimeout(t);
226
238
  };
227
- }, [V, X]), r(() => {
239
+ }, [z, X]), r(() => {
228
240
  let t = () => {
229
- e.getState().organizations.length === 0 && w() && (U.current = 0, X());
241
+ e.getState().organizations.length === 0 && C() && (V.current = 0, X());
230
242
  };
231
243
  return window.addEventListener("online", t), () => {
232
244
  window.removeEventListener("online", t);
233
245
  };
234
246
  }, [X]);
235
247
  let Z = n(async (t) => {
236
- let n = e.getState(), r = w(), i = o(), a = n.user?.id, s = JSON.stringify([
248
+ let n = e.getState(), r = C(), i = o(), a = n.user?.id, s = JSON.stringify([
237
249
  i,
238
250
  a,
239
251
  r,
240
252
  t
241
- ]), c = G.current.get(s);
253
+ ]), c = U.current.get(s);
242
254
  if (c) return c;
243
255
  let u = () => {
244
256
  let n = e.getState();
245
- return o() === i && n.user?.id === a && w() === r && n.currentOrganizationId === t;
257
+ return o() === i && n.user?.id === a && C() === r && n.currentOrganizationId === t;
246
258
  };
247
259
  if (!r) return [];
248
- n.setLoadingWorkspaces(!0), B(null);
260
+ n.setLoadingWorkspaces(!0), R(null);
249
261
  let d = (async () => {
250
262
  try {
251
263
  let e = await l({
252
264
  gateway: "global",
253
265
  query: g,
254
266
  authToken: r,
255
- baseUrl: J
267
+ baseUrl: q
256
268
  });
257
269
  if (!u()) return [];
258
270
  if (e.data?.workspaces?.items && (e.data.workspaces.items = e.data.workspaces.items.filter((e) => e.organizationId === t)), e.errors?.length) {
259
271
  let t = e.errors[0]?.message ?? "GraphQL error";
260
- throw C(e.errors) ? new S(t) : (console.error("Failed to fetch workspaces:", e.errors), Error(t));
272
+ throw S(e.errors) ? new x(t) : (console.error("Failed to fetch workspaces:", e.errors), Error(t));
261
273
  }
262
274
  let i = (e.data?.workspaces?.items ?? []).filter((e) => e.organizationId === t);
263
275
  return n.setWorkspaces(i), i;
264
276
  } catch (e) {
265
- if (!u() || e instanceof S) return [];
277
+ if (!u() || e instanceof x) return [];
266
278
  let t = e instanceof Error ? e.message : "Failed to fetch workspaces";
267
- return console.error("Failed to fetch workspaces:", e), B(t), [];
279
+ return console.error("Failed to fetch workspaces:", e), R(t), [];
268
280
  } finally {
269
- u() && n.setLoadingWorkspaces(!1), G.current.delete(s);
281
+ u() && n.setLoadingWorkspaces(!1), U.current.delete(s);
270
282
  }
271
283
  })();
272
- return G.current.set(s, d), d;
273
- }, [J]), Q = n(async (t, n, r, i) => {
284
+ return U.current.set(s, d), d;
285
+ }, [q]), Q = n(async (t, n, r, i) => {
274
286
  let a = e.getState(), s = [
275
287
  a.currentOrganizationId,
276
288
  a.currentWorkspaceId,
@@ -278,28 +290,28 @@ function O(c) {
278
290
  ], c = d({
279
291
  organizationId: t,
280
292
  workspaceId: n ?? null
281
- }), u = w(), f = o(), p = a.user?.id;
293
+ }), u = C(), f = o(), p = a.user?.id;
282
294
  if (!u) return {
283
295
  success: !1,
284
296
  error: "No valid access token available"
285
297
  };
286
- B(null);
298
+ R(null);
287
299
  try {
288
300
  let m = await l({
289
301
  gateway: "workspace",
290
- query: _,
302
+ query: ee,
291
303
  variables: { input: {
292
304
  organizationId: t,
293
305
  ...n && { workspaceId: n },
294
306
  ...r && { projectId: r }
295
307
  } },
296
308
  authToken: u,
297
- baseUrl: Y,
309
+ baseUrl: J,
298
310
  tenantId: i
299
311
  });
300
312
  if (m.errors?.length) {
301
313
  let e = m.errors[0]?.message ?? "GraphQL error";
302
- return C(m.errors) || console.error("Failed to issue workspace token:", m.errors), {
314
+ return S(m.errors) || console.error("Failed to issue workspace token:", m.errors), {
303
315
  success: !1,
304
316
  error: e
305
317
  };
@@ -307,14 +319,14 @@ function O(c) {
307
319
  let h = m.data?.issueWorkspaceToken;
308
320
  if (h?.success && h.token) {
309
321
  let i = e.getState();
310
- if (o() !== f || e.getState().user?.id !== p || w() !== u || s.some((e, t) => e !== [
322
+ if (o() !== f || e.getState().user?.id !== p || C() !== u || s.some((e, t) => e !== [
311
323
  i.currentOrganizationId,
312
324
  i.currentWorkspaceId,
313
325
  i.currentProjectId
314
326
  ][t]) || d({
315
327
  organizationId: t,
316
328
  workspaceId: n ?? null
317
- }) !== c || !x(h.token, {
329
+ }) !== c || !b(h.token, {
318
330
  organizationId: t,
319
331
  workspaceId: n,
320
332
  projectId: r,
@@ -336,50 +348,50 @@ function O(c) {
336
348
  };
337
349
  } catch (e) {
338
350
  let t = e instanceof Error ? e.message : "Failed to issue workspace token";
339
- return console.error("Failed to issue workspace token:", e), B(t), {
351
+ return console.error("Failed to issue workspace token:", e), R(t), {
340
352
  success: !1,
341
353
  error: t
342
354
  };
343
355
  }
344
- }, [Y]), $ = n(async () => {
345
- let t = e.getState(), n = w(), r = t.workspaceToken, i = t.currentWorkspaceId, a = o(), s = t.user?.id, c = t.currentOrganizationId, u = t.currentProjectId, f = d({
356
+ }, [J]), $ = n(async () => {
357
+ let t = e.getState(), n = C(), r = t.workspaceToken, i = t.currentWorkspaceId, a = o(), s = t.user?.id, c = t.currentOrganizationId, u = t.currentProjectId, f = d({
346
358
  organizationId: c,
347
359
  workspaceId: i
348
360
  }), p = () => {
349
361
  let t = e.getState();
350
- return o() === a && t.user?.id === s && w() === n && t.workspaceToken === r && t.currentOrganizationId === c && t.currentWorkspaceId === i && t.currentProjectId === u && d({
362
+ return o() === a && t.user?.id === s && C() === n && t.workspaceToken === r && t.currentOrganizationId === c && t.currentWorkspaceId === i && t.currentProjectId === u && d({
351
363
  organizationId: c,
352
364
  workspaceId: i
353
365
  }) === f;
354
366
  };
355
367
  if (!n || !r || !i) return [];
356
- t.setLoadingProjects(!0), B(null);
368
+ t.setLoadingProjects(!0), R(null);
357
369
  try {
358
370
  let e = await l({
359
371
  gateway: "workspace",
360
- query: v,
372
+ query: _,
361
373
  authToken: n,
362
374
  workspaceToken: r,
363
- baseUrl: Y
375
+ baseUrl: J
364
376
  });
365
377
  if (!p()) return [];
366
378
  if (e.errors?.length) {
367
379
  let t = e.errors[0]?.message ?? "GraphQL error";
368
- throw C(e.errors) ? new S(t) : (console.error("Failed to fetch projects:", e.errors), Error(t));
380
+ throw S(e.errors) ? new x(t) : (console.error("Failed to fetch projects:", e.errors), Error(t));
369
381
  }
370
382
  let i = e.data?.projects?.items ?? [];
371
383
  return t.setProjects(i), i;
372
384
  } catch (e) {
373
- if (e instanceof S) return [];
385
+ if (e instanceof x) return [];
374
386
  let t = e instanceof Error ? e.message : "Failed to fetch projects";
375
- return console.error("Failed to fetch projects:", e), B(t), [];
387
+ return console.error("Failed to fetch projects:", e), R(t), [];
376
388
  } finally {
377
389
  t.setLoadingProjects(!1);
378
390
  }
379
- }, [Y]), se = n(async (t) => {
391
+ }, [J]), ce = n(async (t) => {
380
392
  let n = e.getState();
381
393
  return n.setCurrentWorkspaceId(null), n.setWorkspaceToken(null), n.setProjects([]), n.setCurrentProjectId(null), n.setCurrentOrganizationId(t.id), await Z(t.id);
382
- }, [Z]), ce = n(async (t) => {
394
+ }, [Z]), le = n(async (t) => {
383
395
  let n = e.getState();
384
396
  if (n.setCurrentProjectId(null), n.setProjects([]), !t.organizationId) return console.error("Workspace missing organizationId:", t), {
385
397
  success: !1,
@@ -390,12 +402,12 @@ function O(c) {
390
402
  success: !1,
391
403
  error: r.error
392
404
  };
393
- let i = e.getState(), a = o(), s = i.user?.id, c = w(), l = i.workspaceToken, u = i.currentProjectId, f = d({
405
+ let i = e.getState(), a = o(), s = i.user?.id, c = C(), l = i.workspaceToken, u = i.currentProjectId, f = d({
394
406
  organizationId: t.organizationId,
395
407
  workspaceId: t.id
396
408
  }), p = () => {
397
409
  let n = e.getState();
398
- return o() === a && n.user?.id === s && w() === c && n.workspaceToken === l && n.currentOrganizationId === t.organizationId && n.currentWorkspaceId === t.id && n.currentProjectId === u && d({
410
+ return o() === a && n.user?.id === s && C() === c && n.workspaceToken === l && n.currentOrganizationId === t.organizationId && n.currentWorkspaceId === t.id && n.currentProjectId === u && d({
399
411
  organizationId: t.organizationId,
400
412
  workspaceId: t.id
401
413
  }) === f;
@@ -410,25 +422,25 @@ function O(c) {
410
422
  success: !1,
411
423
  error: "Context changed during selection"
412
424
  };
413
- }, [Q, $]), le = n((t) => {
425
+ }, [Q, $]), ue = n((t) => {
414
426
  let n = e.getState();
415
427
  u({
416
428
  organizationId: n.currentOrganizationId,
417
429
  workspaceId: n.currentWorkspaceId
418
- }), n.setCurrentProjectId(t.id), n.workspaceToken && !x(n.workspaceToken, {
430
+ }), n.setCurrentProjectId(t.id), n.workspaceToken && !b(n.workspaceToken, {
419
431
  workspaceId: n.currentWorkspaceId,
420
432
  organizationId: n.currentOrganizationId,
421
433
  projectId: t.id
422
434
  }) && n.setWorkspaceToken(null);
423
- }, []), ue = n(() => {
435
+ }, []), de = n(() => {
424
436
  let t = e.getState(), n = {
425
- organizationId: q.current,
426
- workspaceId: K.current
437
+ organizationId: G.current,
438
+ workspaceId: W.current
427
439
  };
428
440
  if (!n.organizationId || !n.workspaceId || t.currentOrganizationId !== n.organizationId || t.currentWorkspaceId !== n.workspaceId) throw Error("Current workspace context required");
429
441
  if (!f(n)) throw Error("Workspace-wide preference could not be saved");
430
- t.setCurrentProjectId(null), t.setWorkspaceToken(null), O({ projectId: null });
431
- }, [O]);
442
+ t.setCurrentProjectId(null), t.setWorkspaceToken(null), k({ projectId: null });
443
+ }, [k]);
432
444
  return r(() => {
433
445
  let t = !1, n = (e) => {
434
446
  let n = !1, r = !1, i = () => {
@@ -446,47 +458,47 @@ function O(c) {
446
458
  }, r = n(() => $()), i = n(() => {
447
459
  let t = e.getState().currentOrganizationId;
448
460
  return t ? Z(t) : Promise.resolve();
449
- }), a = k.onAny((t) => {
461
+ }), a = A.onAny((t) => {
450
462
  let n = t.name;
451
- if (E.has(n)) {
452
- let n = ee(t.payload), { currentWorkspaceId: i } = e.getState();
463
+ if (T.has(n)) {
464
+ let n = D(t.payload), { currentWorkspaceId: i } = e.getState();
453
465
  if (n && i && n !== i) return;
454
466
  r();
455
467
  return;
456
468
  }
457
- D.has(n) && i();
469
+ E.has(n) && i();
458
470
  });
459
471
  return () => {
460
472
  t = !0, a();
461
473
  };
462
474
  }, [
463
- k,
475
+ A,
464
476
  $,
465
477
  Z
466
478
  ]), {
467
- organizations: A,
468
- workspaces: N,
469
- projects: L,
470
- currentOrganizationId: j,
471
- currentWorkspaceId: P,
472
- currentProjectId: R,
473
- currentOrganization: A.find((e) => e.id === j),
474
- currentWorkspace: N.find((e) => e.id === P),
475
- currentProject: L.find((e) => e.id === R),
476
- workspaceToken: F,
477
- isLoadingOrganizations: M,
478
- isLoadingWorkspaces: I,
479
- isLoadingProjects: z,
480
- isLoading: M || I || z,
481
- error: te,
479
+ organizations: j,
480
+ workspaces: P,
481
+ projects: te,
482
+ currentOrganizationId: M,
483
+ currentWorkspaceId: F,
484
+ currentProjectId: ne,
485
+ currentOrganization: j.find((e) => e.id === M),
486
+ currentWorkspace: P.find((e) => e.id === F),
487
+ currentProject: te.find((e) => e.id === ne),
488
+ workspaceToken: I,
489
+ isLoadingOrganizations: N,
490
+ isLoadingWorkspaces: L,
491
+ isLoadingProjects: re,
492
+ isLoading: N || L || re,
493
+ error: ie,
482
494
  fetchOrganizations: X,
483
495
  fetchWorkspacesForOrg: Z,
484
496
  issueWorkspaceToken: Q,
485
497
  fetchProjects: $,
486
- selectOrganization: se,
487
- selectWorkspace: ce,
488
- selectProject: le,
489
- selectWorkspaceWide: ue
498
+ selectOrganization: ce,
499
+ selectWorkspace: le,
500
+ selectProject: ue,
501
+ selectWorkspaceWide: de
490
502
  };
491
503
  }
492
504
  function k(n) {
@@ -520,9 +532,9 @@ function k(n) {
520
532
  ]);
521
533
  }
522
534
  function A(n) {
523
- let s = e((e) => e.currentWorkspaceId), c = e((e) => e.currentOrganizationId), f = e((e) => e.workspaces), m = e((e) => e.projects), h = e((e) => e.currentProjectId), g = e((e) => e.workspaceToken), b = e((e) => e.accessToken), S = t(), C = n?.workspaceBaseUrl ?? S.workspaceBaseUrl, w = n?.disableProjectSync ?? !1, T = n?.skipProjectFetch ?? !1, E = i(!1), [D, ee] = a(0), O = i(null), k = i(/* @__PURE__ */ new Map()), A = i(/* @__PURE__ */ new Map()), j = 3e4;
535
+ let s = e((e) => e.currentWorkspaceId), c = e((e) => e.currentOrganizationId), f = e((e) => e.workspaces), m = e((e) => e.projects), h = e((e) => e.currentProjectId), g = e((e) => e.workspaceToken), y = e((e) => e.accessToken), x = t(), S = n?.workspaceBaseUrl ?? x.workspaceBaseUrl, C = n?.disableProjectSync ?? !1, w = n?.skipProjectFetch ?? !1, T = i(!1), [E, D] = a(0), O = i(null), k = i(/* @__PURE__ */ new Map()), A = i(/* @__PURE__ */ new Map()), j = 3e4;
524
536
  r(() => {
525
- if (w || !s || !b || E.current) return;
537
+ if (C || !s || !y || T.current) return;
526
538
  let t = A.current.get(s);
527
539
  if (t && t.count >= 8 && Date.now() - t.lastFailureAt < j) return;
528
540
  t && Date.now() - t.lastFailureAt >= j && A.current.delete(s);
@@ -535,28 +547,28 @@ function A(n) {
535
547
  organizationId: r,
536
548
  workspaceId: s
537
549
  });
538
- let a = o(), S = i.user?.id, D = d({
550
+ let a = o(), x = i.user?.id, E = d({
539
551
  organizationId: r,
540
552
  workspaceId: s
541
553
  });
542
- if (D && i.currentProjectId) {
554
+ if (E && i.currentProjectId) {
543
555
  i.setCurrentProjectId(null), i.setWorkspaceToken(null);
544
556
  return;
545
557
  }
546
- let M = !g || y(g) || !x(g, {
558
+ let M = !g || v(g) || !b(g, {
547
559
  workspaceId: s,
548
560
  organizationId: c,
549
561
  projectId: h,
550
- workspaceWide: D
562
+ workspaceWide: E
551
563
  }), N = JSON.stringify([
552
564
  a,
553
- S,
554
- b,
565
+ x,
566
+ y,
555
567
  r,
556
568
  s
557
569
  ]), P = m.some((e) => e.workspaceId === s) || O.current?.scopeKey === N && O.current.projects === m;
558
570
  if (P && !M) {
559
- if (!i.currentProjectId && !D) {
571
+ if (!i.currentProjectId && !E) {
560
572
  let e = m.find((e) => e.workspaceId === s);
561
573
  e && i.setCurrentProjectId(e.id);
562
574
  }
@@ -564,45 +576,45 @@ function A(n) {
564
576
  }
565
577
  let F = () => {
566
578
  let t = e.getState();
567
- return t.accessToken === b && t.user?.id === S && o() === a && t.currentOrganizationId === r && t.currentWorkspaceId === s && t.currentProjectId === h && d({
579
+ return t.accessToken === y && t.user?.id === x && o() === a && t.currentOrganizationId === r && t.currentWorkspaceId === s && t.currentProjectId === h && d({
568
580
  organizationId: r,
569
581
  workspaceId: s
570
- }) === D;
582
+ }) === E;
571
583
  }, I = async () => {
572
- E.current = !0, i.setLoadingProjects(!0);
584
+ T.current = !0, i.setLoadingProjects(!0);
573
585
  let t = !1;
574
586
  try {
575
587
  let n = g;
576
588
  if (M) {
577
589
  let e = await l({
578
590
  gateway: "workspace",
579
- query: _,
591
+ query: ee,
580
592
  variables: { input: {
581
593
  organizationId: r,
582
594
  workspaceId: s,
583
595
  ...h ? { projectId: h } : {}
584
596
  } },
585
- authToken: b,
586
- baseUrl: C,
597
+ authToken: y,
598
+ baseUrl: S,
587
599
  tenantId: f.find((e) => e.id === s)?.tenantId
588
600
  });
589
601
  if (e.data?.issueWorkspaceToken?.success && e.data.issueWorkspaceToken.token) {
590
- if (n = e.data.issueWorkspaceToken.token, !F() || !x(n, {
602
+ if (n = e.data.issueWorkspaceToken.token, !F() || !b(n, {
591
603
  workspaceId: s,
592
604
  organizationId: r,
593
605
  projectId: h,
594
- workspaceWide: D
606
+ workspaceWide: E
595
607
  })) return;
596
608
  i.setWorkspaceToken(n);
597
609
  } else return;
598
610
  }
599
- if (n && !P && !T) {
611
+ if (n && !P && !w) {
600
612
  let t = await l({
601
613
  gateway: "workspace",
602
- query: v,
603
- authToken: b,
614
+ query: _,
615
+ authToken: y,
604
616
  workspaceToken: n,
605
- baseUrl: C
617
+ baseUrl: S
606
618
  });
607
619
  if (!F() || t.errors?.length) return;
608
620
  let a = t.data?.projects?.items ?? [];
@@ -616,9 +628,9 @@ function A(n) {
616
628
  }
617
629
  t = !0;
618
630
  } catch {} finally {
619
- i.setLoadingProjects(!1), E.current = !1;
631
+ i.setLoadingProjects(!1), T.current = !1;
620
632
  let n = F();
621
- n || ee((e) => e + 1);
633
+ n || D((e) => e + 1);
622
634
  let r = A.current;
623
635
  if (n && t) {
624
636
  r.delete(s);
@@ -635,7 +647,7 @@ function A(n) {
635
647
  let r = Math.min(1e3 * 2 ** (t - 1), 8e3), i = setTimeout(() => {
636
648
  k.current.delete(s);
637
649
  let t = e.getState();
638
- F() && t.currentWorkspaceId === s && !t.projects.some((e) => e.workspaceId === s) && !E.current && I();
650
+ F() && t.currentWorkspaceId === s && !t.projects.some((e) => e.workspaceId === s) && !T.current && I();
639
651
  }, r);
640
652
  k.current.set(s, i);
641
653
  }
@@ -644,17 +656,17 @@ function A(n) {
644
656
  };
645
657
  I();
646
658
  }, [
647
- D,
659
+ E,
648
660
  s,
649
661
  c,
650
662
  f,
651
663
  m,
652
664
  h,
653
665
  g,
654
- b,
666
+ y,
667
+ S,
655
668
  C,
656
- w,
657
- T
669
+ w
658
670
  ]), r(() => {
659
671
  let e = k.current;
660
672
  return () => {
package/dist/auth/hooks/useContextSwitcherData.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"useContextSwitcherData.js","names":[],"sources":["../../../src/auth/hooks/useContextSwitcherData.ts"],"sourcesContent":["import {\n isWorkspaceWideSelection,\n selectWorkspaceWide as persistWorkspaceWideSelection,\n clearWorkspaceWideSelection,\n} from \"@burdenoff/fe-libs/shared/providers/shell/WorkspaceWideSelection\";\nimport { resolveActiveProfileId } from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { getUrlParam } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextStorage\";\nimport { useCallback, useState, useEffect, useRef } from \"react\";\nimport {\n graphqlFetch,\n getStoredAuthToken,\n} from \"@burdenoff/fe-libs/shared/graphql\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { Organization, Workspace, Project } from \"../types\";\nimport { resolveGatewayBaseUrls } from \"../utils/gatewayBaseUrls\";\n\n// =============================================================================\n// Hook Options\n// =============================================================================\n\nexport interface UseContextSwitcherDataOptions {\n /**\n * Optional Global API Gateway base URL override.\n * If not provided, uses GATEWAYS config from fe-libs.\n */\n globalBaseUrl?: string;\n /**\n * Optional Workspaces API Gateway base URL override.\n * If not provided, uses GATEWAYS config from fe-libs.\n */\n workspaceBaseUrl?: string;\n /** Disable initial organization/workspace bootstrap fetches */\n disableBootstrap?: boolean;\n /** Disable the workspace sync effect */\n disableWorkspaceSync?: boolean;\n /** Disable the project sync effect */\n disableProjectSync?: boolean;\n /** Only hydrate the workspace token; do not eagerly fetch projects */\n skipProjectFetch?: boolean;\n}\n\n// =============================================================================\n// GraphQL Response Types\n// =============================================================================\n\ninterface MyOrganizationsResponse {\n myOrganizations: {\n total: number;\n items: Organization[];\n };\n}\n\ninterface WorkspacesByOrgResponse {\n workspaces: {\n total: number;\n items: Workspace[];\n };\n}\n\ntype GraphQLFetchResult<T> = Awaited<ReturnType<typeof graphqlFetch<T>>>;\n\ninterface IssueWorkspaceTokenResult {\n success: boolean;\n token: string | null;\n expiresAt: string | null;\n organizationId: string | null;\n workspaceId: string | null;\n projectId: string | null;\n scopes: string[] | null;\n error: {\n code: string;\n message: string;\n } | null;\n}\n\ninterface ProjectsResponse {\n projects: {\n total: number;\n items: Project[];\n };\n}\n\n// =============================================================================\n// GraphQL Query/Mutation Strings\n// =============================================================================\n\nconst MY_ORGANIZATIONS_QUERY = `\n query MyOrganizations {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n }\n`;\n\n// Both queries below historically used `workspaces(filter: $filter)` with\n// a `WorkspaceFilterInput` to fetch workspaces for a specific organization.\n// That Query field was removed/renamed in the global subgraph; calling it\n// now throws GRAPHQL_VALIDATION_FAILED (\"Cannot query field 'workspaces'\n// on type 'Query'\") which crashes the context switcher and cascades into a\n// \"Verifying workspace access...\" stuck-spinner on every Platform module\n// route (/billing, /support, /notifications, /devportal).\n//\n// The supported field is `myWorkspaces(limit, offset)` on the global\n// subgraph — self-scoped, returns the caller's workspaces across all\n// orgs. It does NOT accept a filter, so we fetch up to 100 of \"my\"\n// workspaces and let the existing downstream auto-pick logic filter by\n// organizationId client-side. The recovery path at line ~624 already\n// uses this exact aliased pattern; we're just promoting it to the\n// primary path.\nconst WORKSPACES_BY_ORG_QUERY = `\n query WorkspacesByOrg {\n workspaces: myWorkspaces(limit: 100) {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n`;\n\nconst ISSUE_WORKSPACE_TOKEN_MUTATION = `\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success\n token\n expiresAt\n organizationId\n workspaceId\n projectId\n scopes\n error {\n code\n message\n }\n }\n }\n`;\n\n// The workspace gateway exposes `myProjects` (public RBAC, caller-scoped to\n// the active workspace via x-workspace-id) and the privileged\n// `projects(filter)` (list:project). The header has no `list:project`\n// permission seeded for the typical operator, so the privileged form\n// returns FORBIDDEN even though the caller is a member of the workspace.\n// `myProjects` is the right field for \"give me the projects I can see in\n// this workspace\" — workspace scope is already established by the\n// workspace token + x-workspace-id header that we pass with the request.\nconst PROJECTS_QUERY = `\n query MyProjectsForContext {\n projects: myProjects {\n total\n items {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n }\n`;\n\n// =============================================================================\n// Auth Helpers\n// =============================================================================\n\n/**\n * Check whether a JWT is expired (or within bufferMs of expiry).\n * Returns true if the token is expired, close to expiry, or malformed.\n */\nfunction isTokenExpired(token: string, bufferMs = 30_000): boolean {\n try {\n const payload = JSON.parse(atob(token.split(\".\")[1]));\n if (!payload.exp) return false;\n return payload.exp * 1000 < Date.now() + bufferMs;\n } catch {\n return true;\n }\n}\n\nfunction getWorkspaceTokenPayload(token: string): {\n workspaceId?: string;\n organizationId?: string;\n projectId?: string;\n exp?: number;\n} | null {\n try {\n const payload = JSON.parse(atob(token.split(\".\")[1]));\n return {\n workspaceId:\n typeof payload.workspaceId === \"string\"\n ? payload.workspaceId\n : undefined,\n organizationId:\n typeof payload.organizationId === \"string\"\n ? payload.organizationId\n : undefined,\n projectId:\n typeof payload.projectId === \"string\" ? payload.projectId : undefined,\n exp: typeof payload.exp === \"number\" ? payload.exp : undefined,\n };\n } catch {\n return null;\n }\n}\n\nfunction isWorkspaceTokenValidForContext(\n token: string | null | undefined,\n expected: {\n workspaceId?: string | null;\n organizationId?: string | null;\n projectId?: string | null;\n workspaceWide?: boolean;\n },\n): token is string {\n if (!token || isTokenExpired(token)) {\n return false;\n }\n\n const payload = getWorkspaceTokenPayload(token);\n if (!payload) {\n return false;\n }\n\n if (expected.workspaceId && payload.workspaceId !== expected.workspaceId) {\n return false;\n }\n\n if (\n expected.organizationId &&\n payload.organizationId !== expected.organizationId\n ) {\n return false;\n }\n\n if (expected.workspaceWide && payload.projectId) return false;\n\n if (expected.projectId && payload.projectId !== expected.projectId) {\n return false;\n }\n\n return true;\n}\n\n/**\n * Custom error class for auth-related failures (expired token, unauthorized, etc.).\n * Used to distinguish auth errors in outer catch blocks so they can be\n * suppressed from console.error — they are expected during token refresh cycles\n * and do not indicate application bugs.\n */\nclass AuthError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"AuthError\";\n }\n}\n\n/**\n * Detect whether a set of GraphQL errors are authentication-related.\n */\nfunction isAuthGraphQLError(\n errors: Array<{ message?: string; extensions?: { code?: string } }>,\n): boolean {\n return errors.some(\n (e) =>\n e.extensions?.code === \"UNAUTHENTICATED\" ||\n e.message?.toLowerCase().includes(\"unauthorized\") ||\n e.message?.toLowerCase().includes(\"not authenticated\"),\n );\n}\n\n/**\n * Resolve the best available access token:\n * 1. Try the zustand store token\n * 2. If expired, fall back to profile storage (may have been refreshed)\n * 3. Return null if no valid token is available\n */\nfunction resolveAccessToken(): string | null {\n const storeToken = useAuthStore.getState().accessToken;\n\n // If store token is valid (or has no exp claim), use it\n if (storeToken && !isTokenExpired(storeToken)) {\n return storeToken;\n }\n\n // Store token is expired or missing — try profile storage (may be fresher)\n const profileToken = getStoredAuthToken();\n if (profileToken && !isTokenExpired(profileToken)) {\n return profileToken;\n }\n\n // Both expired or missing — if store token exists at all, return it as a last\n // resort (the gateway will reject it and the useEffect will re-trigger after\n // token refresh). Returning null would silently swallow the first load.\n return storeToken;\n}\n\nfunction buildFallbackOrganizations(workspaces: Workspace[]): Organization[] {\n const uniqueOrgIds = Array.from(\n new Set(\n workspaces.flatMap((workspace) =>\n workspace.organizationId ? [workspace.organizationId] : [],\n ),\n ),\n );\n\n return uniqueOrgIds.map((organizationId, index) => ({\n id: organizationId,\n name:\n workspaces.find(\n (workspace) => workspace.organizationId === organizationId,\n )?.name || `Organization ${index + 1}`,\n slug: organizationId,\n tenantId:\n workspaces.find(\n (workspace) => workspace.organizationId === organizationId,\n )?.tenantId || \"\",\n }));\n}\n\n// =============================================================================\n// Hook Implementation\n// =============================================================================\n\n/**\n * Hook for managing the context switcher data (organizations, workspaces, projects)\n *\n * Data flow:\n * 1. fetchOrganizations() - Get all orgs user has access to (Global Gateway)\n * 2. selectOrganization(org) - Set current org & fetch workspaces for that org\n * 3. selectWorkspace(ws) - Issue workspace token & fetch projects\n * 4. selectProject(proj) - Set current project\n *\n * All GraphQL calls go through graphqlFetch from fe-libs which automatically\n * resolves gateway URLs and injects auth + locale headers.\n *\n * @param options - Optional configuration (gateway base URL overrides)\n */\n// Domain events emitted by microfe-workspaces that should refresh the switcher's\n// cached lists. Module-scoped so they aren't reallocated on every effect run.\nconst PROJECT_REFRESH_EVENTS = new Set<string>([\n \"project.created\",\n \"project.updated\",\n \"project.deleted\",\n \"project.archived\",\n \"project.unarchived\",\n]);\nconst WORKSPACE_REFRESH_EVENTS = new Set<string>([\n \"workspace.created\",\n \"workspace.updated\",\n \"workspace.deleted\",\n \"workspace.archived\",\n \"workspace.reactivated\",\n]);\n\n// Safely read a string `workspaceId` off a cross-MFE event payload of unknown\n// shape, rather than trusting a bare cast (the payload is produced by another\n// MFE and could drift). Returns undefined when absent or not a string.\nfunction readEventWorkspaceId(payload: unknown): string | undefined {\n if (payload && typeof payload === \"object\" && \"workspaceId\" in payload) {\n const value = (payload as { workspaceId?: unknown }).workspaceId;\n return typeof value === \"string\" ? value : undefined;\n }\n return undefined;\n}\n\nexport function useContextSwitcherData(\n options?: UseContextSwitcherDataOptions,\n) {\n const {\n organizationId: activeOrganizationId,\n workspaceId: activeWorkspaceId,\n projectId: activeProjectId,\n setContext: setActiveContext,\n } = useActiveContext();\n\n const eventBus = useEventBus();\n\n // Use selectors for reactive state\n const organizations = useAuthStore((state) => state.organizations);\n const currentOrganizationId = useAuthStore(\n (state) => state.currentOrganizationId,\n );\n const isLoadingOrganizations = useAuthStore(\n (state) => state.isLoadingOrganizations,\n );\n\n const workspaces = useAuthStore((state) => state.workspaces);\n const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n const workspaceToken = useAuthStore((state) => state.workspaceToken);\n const isLoadingWorkspaces = useAuthStore(\n (state) => state.isLoadingWorkspaces,\n );\n\n const projects = useAuthStore((state) => state.projects);\n const currentProjectId = useAuthStore((state) => state.currentProjectId);\n const isLoadingProjects = useAuthStore((state) => state.isLoadingProjects);\n\n // Local error state\n const [error, setError] = useState<string | null>(null);\n\n // Bootstrap-retry signal: incremented on every TRANSIENT bootstrap failure\n // (orgs fetch, stale-context recovery, or the inner workspace bootstrap).\n // A monotonically increasing nonce — rather than the `error` string — keys\n // the retry effect, because two consecutive failures with the identical\n // message would not re-trigger a string-keyed effect and the retry chain\n // would silently stop after one attempt.\n const [bootstrapFailureNonce, setBootstrapFailureNonce] = useState(0);\n const bootstrapRetryAttemptRef = useRef(0);\n\n // Deduplication refs to prevent duplicate GraphQL calls\n const fetchOrganizationsPromiseRef = useRef<Promise<Organization[]> | null>(\n null,\n );\n const fetchWorkspacesPromisesRef = useRef<Map<string, Promise<Workspace[]>>>(\n new Map(),\n );\n\n // Stable refs for latest context values — avoids stale closures in callbacks\n // without adding them to useCallback dep arrays (which would recreate callbacks\n // on every context change and trigger spurious fetch re-runs).\n const activeWorkspaceIdRef = useRef(activeWorkspaceId);\n const activeOrganizationIdRef = useRef(activeOrganizationId);\n useEffect(() => {\n activeWorkspaceIdRef.current = activeWorkspaceId;\n activeOrganizationIdRef.current = activeOrganizationId;\n });\n\n const resolvedBaseUrls = resolveGatewayBaseUrls();\n const globalBaseUrl =\n options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n const workspaceBaseUrl =\n options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n\n // Refs to break feedback loops with the Header's \"store → URL\" sync effect.\n // Without these the pair can ping-pong: this effect writes (URL → store),\n // Header writes (store → URL), Zustand re-fires our subscribers, and React\n // hits \"Maximum update depth exceeded\" — especially when a downstream call\n // (workspace token issuance) returns 504 and leaves the two halves in\n // disagreement. The refs record the last value we pushed for each axis;\n // identical pushes are skipped so the loop has a hard floor.\n const lastAppliedOrgIdRef = useRef<string | null>(null);\n const lastAppliedWorkspaceIdRef = useRef<string | null>(null);\n const lastAppliedProjectIdRef = useRef<string | null>(null);\n const lastClearedTokenContextRef = useRef<string | null>(null);\n\n useEffect(() => {\n const store = useAuthStore.getState();\n\n if (\n activeOrganizationId &&\n activeOrganizationId !== store.currentOrganizationId &&\n activeOrganizationId !== lastAppliedOrgIdRef.current\n ) {\n lastAppliedOrgIdRef.current = activeOrganizationId;\n store.setCurrentOrganizationId(activeOrganizationId);\n if (\n store.workspaces.length > 0 &&\n !store.workspaces.some(\n (workspace) => workspace.organizationId === activeOrganizationId,\n )\n ) {\n store.setWorkspaces([]);\n }\n }\n\n if (\n activeWorkspaceId &&\n activeWorkspaceId !== store.currentWorkspaceId &&\n activeWorkspaceId !== lastAppliedWorkspaceIdRef.current\n ) {\n lastAppliedWorkspaceIdRef.current = activeWorkspaceId;\n store.setCurrentWorkspaceId(activeWorkspaceId);\n if (\n store.projects.length > 0 &&\n !store.projects.some(\n (project) => project.workspaceId === activeWorkspaceId,\n )\n ) {\n store.setProjects([]);\n store.setCurrentProjectId(null);\n }\n }\n\n if (\n isWorkspaceWideSelection({\n organizationId: activeOrganizationId,\n workspaceId: activeWorkspaceId,\n }) &&\n !activeProjectId &&\n store.currentProjectId\n ) {\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n }\n\n if (\n activeProjectId &&\n activeProjectId !== store.currentProjectId &&\n activeProjectId !== lastAppliedProjectIdRef.current\n ) {\n lastAppliedProjectIdRef.current = activeProjectId;\n store.setCurrentProjectId(activeProjectId);\n }\n\n if (\n store.workspaceToken &&\n !isWorkspaceTokenValidForContext(store.workspaceToken, {\n workspaceId: activeWorkspaceId,\n organizationId: activeOrganizationId,\n projectId: activeProjectId,\n workspaceWide:\n !activeProjectId &&\n isWorkspaceWideSelection({\n organizationId: activeOrganizationId,\n workspaceId: activeWorkspaceId,\n }),\n })\n ) {\n // Clear-token-once-per-context guard: when the upstream gateway is\n // flaky (504s during workspace token issuance) the surrounding state\n // machine can oscillate between \"got token but invalid\" and \"clearing\n // token\". The downstream re-issue path then loops. Only clear once per\n // (org, ws, proj) tuple — a successful re-issue resets the ref via\n // setWorkspaceToken landing a new token for the same context.\n const ctxKey = `${activeOrganizationId ?? \"\"}|${activeWorkspaceId ?? \"\"}|${activeProjectId ?? \"\"}`;\n if (lastClearedTokenContextRef.current !== ctxKey) {\n lastClearedTokenContextRef.current = ctxKey;\n store.setWorkspaceToken(null);\n }\n }\n }, [activeOrganizationId, activeWorkspaceId, activeProjectId]);\n\n // ===========================================================================\n // Fetch Organizations (Global Gateway)\n // ===========================================================================\n\n const fetchOrganizations = useCallback(async (): Promise<Organization[]> => {\n // Deduplicate: if a fetch is already in progress, return the same promise\n if (fetchOrganizationsPromiseRef.current) {\n return fetchOrganizationsPromiseRef.current;\n }\n\n const store = useAuthStore.getState();\n const token = resolveAccessToken();\n\n if (!token) {\n // Not an error — user may not be authenticated yet (e.g., page load before login).\n // The useEffect in Header.tsx will re-trigger when accessToken becomes available.\n return [];\n }\n\n // NOTE: an EXPIRED token is deliberately NOT a bail-out. fe-libs\n // graphqlFetch now transparently refreshes on UNAUTHENTICATED and retries\n // the request once, and a definitive refresh failure triggers the shell's\n // forced logout (SESSION_EXPIRED_EVENT). The previous `isTokenExpired →\n // return []` short-circuit was the root cause of the persistently empty\n // context switcher: the expired token survives reloads in profile storage,\n // so every bootstrap silently produced [] — indistinguishable from \"you\n // have no organizations\" — until the user manually logged out.\n\n store.setLoadingOrganizations(true);\n setError(null);\n\n // Store the promise for deduplication before starting\n fetchOrganizationsPromiseRef.current = (async () => {\n try {\n const initialTargetOrgId =\n activeOrganizationIdRef.current ?? store.currentOrganizationId;\n let result: GraphQLFetchResult<\n MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n > = initialTargetOrgId\n ? await (async () => {\n const [organizationsResult, workspacesResult] = await Promise.all(\n [\n graphqlFetch<MyOrganizationsResponse>({\n gateway: \"global\",\n query: MY_ORGANIZATIONS_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n }),\n graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n }),\n ],\n );\n\n const data = organizationsResult.data?.myOrganizations\n ? {\n myOrganizations: organizationsResult.data.myOrganizations,\n ...(workspacesResult.data?.workspaces\n ? { workspaces: workspacesResult.data.workspaces }\n : {}),\n }\n : null;\n\n return {\n data,\n errors: [\n ...(organizationsResult.errors ?? []),\n ...(workspacesResult.errors ?? []),\n ],\n };\n })()\n : await graphqlFetch<MyOrganizationsResponse>({\n gateway: \"global\",\n query: MY_ORGANIZATIONS_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n\n // Self-heal stale-URL case: if the workspace side of the bootstrap\n // fails because the URL points at an inaccessible org/workspace, retry\n // with the organization-only query so the operator sees their actual\n // orgs and the URL params get corrected on next render.\n if (\n initialTargetOrgId &&\n result.errors?.length &&\n result.errors.some(\n (e) =>\n e?.extensions?.code === \"FORBIDDEN\" ||\n /not a member of this organization/i.test(e?.message ?? \"\") ||\n // Public gateway often drops the underlying FORBIDDEN error\n // and replaces it with the schema-level non-null violation\n // (\"Cannot return null for non-nullable field Query.myOrganizations\").\n // That happens when ANY field in the query throws — workspaces\n // here — and data:null cascades up. Treat that pattern as a\n // signal to retry without the workspaces filter.\n /Cannot return null for non-nullable field Query\\.myOrganizations/i.test(\n e?.message ?? \"\",\n ),\n )\n ) {\n // Fetch myOrganizations + ALL workspaces (no filter) so the\n // downstream auto-pick logic still has a workspace list to seed\n // context from. If we only refetched myOrganizations, the page\n // would render but every workspace-scoped query would fail with\n // \"Select a workspace…\".\n result = await graphqlFetch<\n MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n >({\n gateway: \"global\",\n query: `\n query ContextSwitcherRecover {\n myOrganizations {\n total\n items { id name slug tenantId description logo website status type createdAt updatedAt }\n }\n workspaces: myWorkspaces {\n total\n items { id name slug tenantId organizationId type status region createdAt updatedAt }\n }\n }\n `,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n }\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (isAuthGraphQLError(result.errors)) {\n // Auth errors are expected during token refresh cycles — throw AuthError\n // so the outer catch can suppress console.error.\n throw new AuthError(errorMessage);\n }\n if (store.workspaces.length === 0) {\n console.error(\"Failed to fetch organizations:\", result.errors);\n }\n throw new Error(errorMessage);\n }\n\n let orgs: Organization[] = result.data?.myOrganizations?.items ?? [];\n\n // Stale-context recovery: bootstrap query was filtered by\n // initialTargetOrgId, so when the URL/persisted org doesn't belong to\n // this user the response is empty. Re-fetch the unfiltered list of\n // *all* orgs the user can access so the guard below can pick a real\n // default. Skip the recovery when no target was set (already\n // unfiltered) or when workspaces are already in the store (the\n // existing fallback path covers that case).\n if (\n initialTargetOrgId &&\n orgs.length === 0 &&\n store.workspaces.length === 0\n ) {\n const recovery = await graphqlFetch<MyOrganizationsResponse>({\n gateway: \"global\",\n query: MY_ORGANIZATIONS_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n if (!recovery.errors?.length) {\n orgs = recovery.data?.myOrganizations?.items ?? [];\n // discard the filtered workspaces payload — it was for the\n // ghost org and would only mislead the workspace selector below.\n result = {\n ...recovery,\n data: {\n myOrganizations: recovery.data?.myOrganizations ?? {\n items: [],\n total: 0,\n },\n },\n };\n } else {\n // The filtered bootstrap returned nothing AND the unfiltered\n // recovery failed — we genuinely do not know the user's org list.\n // Treat it as the failure it is (retryable via the bootstrap-retry\n // effect) instead of falling through to setOrganizations([]),\n // which presented a transient backend error as \"you have no\n // organizations\" until re-login.\n console.warn(\n \"[ContextSwitcher] Stale-context recovery failed:\",\n recovery.errors,\n );\n const recoveryMessage =\n recovery.errors?.[0]?.message ?? \"Failed to fetch organizations\";\n if (isAuthGraphQLError(recovery.errors ?? [])) {\n throw new AuthError(recoveryMessage);\n }\n throw new Error(recoveryMessage);\n }\n }\n\n const fallbackOrganizations =\n orgs.length === 0 && store.workspaces.length > 0\n ? buildFallbackOrganizations(store.workspaces)\n : [];\n const effectiveOrganizations =\n fallbackOrganizations.length > 0 ? fallbackOrganizations : orgs;\n\n store.setOrganizations(effectiveOrganizations);\n\n // Determine which organization to use for workspace fetching\n let targetOrgId = initialTargetOrgId;\n\n // Stale-context guard: if the persisted/URL org isn't in the user's\n // accessible orgs, fall back to the first available one and clear the\n // stale workspace/project so they get re-derived. Without this, URL\n // params like ?org=<ghost-id> from a prior session leak into the new\n // user's request headers and cause \"Authentication required\" /\n // \"not a member\" errors at every subgraph.\n //\n // Check against `orgs` (freshly returned from the API in this same\n // closure) rather than `effectiveOrganizations`, which can fall back\n // to ids derived from `store.workspaces` — that fallback path could\n // contain stale ghost orgIds and mask the guard.\n const targetOrgIsAccessible =\n targetOrgId && orgs.some((org) => org.id === targetOrgId);\n if (targetOrgId && !targetOrgIsAccessible && orgs.length > 0) {\n targetOrgId = orgs[0].id;\n setActiveContext({\n organizationId: targetOrgId,\n workspaceId: null,\n tenantId: null,\n projectId: null,\n });\n store.setWorkspaces([]);\n store.setProjects([]);\n store.setCurrentWorkspaceId(null);\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n }\n\n if (targetOrgId && targetOrgId !== store.currentOrganizationId) {\n store.setCurrentOrganizationId(targetOrgId);\n }\n\n // Auto-select first organization if none is selected\n if (effectiveOrganizations.length > 0 && !targetOrgId) {\n store.setCurrentOrganizationId(effectiveOrganizations[0].id);\n targetOrgId = effectiveOrganizations[0].id;\n }\n\n // Fetch workspaces for the selected/auto-selected org if:\n // 1. We have a target org (either auto-selected or persisted from localStorage)\n // 2. AND workspaces array is empty (not persisted, or cleared)\n // This handles both initial login AND page refresh scenarios.\n // Read from useAuthStore.getState() rather than the captured `store`\n // snapshot so we see the post-guard cleared value when the org guard\n // above fired (the local `store.workspaces` ref is stale after\n // setWorkspaces([])).\n if (targetOrgId && useAuthStore.getState().workspaces.length === 0) {\n store.setLoadingWorkspaces(true);\n try {\n // myWorkspaces returns ALL workspaces the user is a member of\n // across every org. Filter to the target org client-side here.\n const bootstrappedWorkspaces =\n initialTargetOrgId === targetOrgId\n ? result.data?.workspaces?.items?.filter(\n (w) => w.organizationId === targetOrgId,\n )\n : undefined;\n const ws = bootstrappedWorkspaces\n ? (bootstrappedWorkspaces as Workspace[])\n : await graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n }).then((wsResult) =>\n wsResult.errors?.length\n ? null\n : (wsResult.data?.workspaces?.items ?? []).filter(\n (w) => w.organizationId === targetOrgId,\n ),\n );\n\n if (!ws) {\n // Workspace bootstrap failed (errored result) while orgs\n // succeeded — retryable, otherwise the org renders with no\n // workspaces until manual interaction.\n setBootstrapFailureNonce((n) => n + 1);\n }\n if (ws) {\n store.setWorkspaces(ws);\n const persistedWorkspace = activeWorkspaceIdRef.current\n ? ws.find(\n (workspace) =>\n workspace.id === activeWorkspaceIdRef.current,\n )\n : null;\n\n if (persistedWorkspace) {\n store.setCurrentWorkspaceId(persistedWorkspace.id);\n } else if (ws.length > 0) {\n const nextActiveContext = {\n organizationId: targetOrgId,\n workspaceId: ws[0].id,\n tenantId: ws[0].tenantId,\n projectId: null,\n };\n\n if (activeWorkspaceIdRef.current) {\n // Stale-context guard: URL/persisted workspace ID is not in\n // the user's accessible workspaces for the active org. Fall\n // back to the first workspace and clear the stale URL param\n // so subsequent requests don't carry the ghost ID.\n store.setCurrentWorkspaceId(ws[0].id);\n store.setWorkspaceToken(null);\n setActiveContext(nextActiveContext);\n } else if (!store.currentWorkspaceId) {\n // Auto-select first workspace only if none is currently selected\n // (preserves selection from completeAuthFlow or persistence if applicable)\n store.setCurrentWorkspaceId(ws[0].id);\n setActiveContext(nextActiveContext);\n }\n }\n }\n } catch {\n // Non-critical for THIS call (user can still select a workspace\n // manually) but worth a bounded background retry.\n setBootstrapFailureNonce((n) => n + 1);\n } finally {\n store.setLoadingWorkspaces(false);\n }\n }\n\n // Full bootstrap succeeded — re-arm the retry budget for the next\n // genuine failure.\n bootstrapRetryAttemptRef.current = 0;\n return effectiveOrganizations;\n } catch (err) {\n // Auth errors are expected during token refresh / page load cycles.\n // Suppress from console.error — the useEffect will re-trigger when the\n // auth provider refreshes the token. (A DEFINITIVELY dead session\n // never reaches here as an AuthError loop: graphqlFetch dispatches\n // SESSION_EXPIRED_EVENT and the shell force-logs-out.)\n if (err instanceof AuthError) {\n return [];\n }\n const message =\n err instanceof Error ? err.message : \"Failed to fetch organizations\";\n if (store.workspaces.length === 0) {\n console.error(\"Failed to fetch organizations:\", err);\n }\n setError(message);\n setBootstrapFailureNonce((n) => n + 1);\n\n if (store.workspaces.length > 0) {\n const fallbackOrganizations = buildFallbackOrganizations(\n store.workspaces,\n );\n if (fallbackOrganizations.length > 0) {\n store.setOrganizations(fallbackOrganizations);\n if (!store.currentOrganizationId) {\n store.setCurrentOrganizationId(fallbackOrganizations[0].id);\n }\n return fallbackOrganizations;\n }\n }\n\n return [];\n } finally {\n store.setLoadingOrganizations(false);\n fetchOrganizationsPromiseRef.current = null;\n }\n })();\n\n return fetchOrganizationsPromiseRef.current;\n }, [globalBaseUrl, setActiveContext]);\n\n // ===========================================================================\n // Bootstrap retry (transient-failure self-heal)\n // ===========================================================================\n //\n // A transient backend failure during bootstrap (cold service, gateway blip,\n // Valkey/pg hiccup) used to leave the switcher empty for the whole session —\n // the shell's Header effect only re-fires on accessToken change, so nothing\n // ever retried. Retry with exponential backoff, bounded so a genuinely down\n // backend does not hammer: 1.5s, 3s, 6s, 12s, 12s (max 5 attempts, re-armed\n // by any subsequent successful bootstrap).\n useEffect(() => {\n if (bootstrapFailureNonce === 0) return undefined;\n if (bootstrapRetryAttemptRef.current >= 5) return undefined;\n if (!resolveAccessToken()) return undefined;\n bootstrapRetryAttemptRef.current += 1;\n const delayMs = Math.min(\n 1500 * 2 ** (bootstrapRetryAttemptRef.current - 1),\n 12000,\n );\n const timer = window.setTimeout(() => {\n void fetchOrganizations();\n }, delayMs);\n return () => {\n window.clearTimeout(timer);\n };\n }, [bootstrapFailureNonce, fetchOrganizations]);\n\n // Connectivity recovery: if the browser reports we are back online and the\n // switcher is still empty, re-run the bootstrap immediately with a fresh\n // retry budget.\n useEffect(() => {\n const onOnline = () => {\n if (\n useAuthStore.getState().organizations.length === 0 &&\n resolveAccessToken()\n ) {\n bootstrapRetryAttemptRef.current = 0;\n void fetchOrganizations();\n }\n };\n window.addEventListener(\"online\", onOnline);\n return () => {\n window.removeEventListener(\"online\", onOnline);\n };\n }, [fetchOrganizations]);\n\n // ===========================================================================\n // Fetch Workspaces for Organization (Global Gateway)\n // ===========================================================================\n\n const fetchWorkspacesForOrg = useCallback(\n async (organizationId: string): Promise<Workspace[]> => {\n const store = useAuthStore.getState();\n const token = resolveAccessToken();\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n // Account-scoped in-memory deduplication; this key is never persisted or logged.\n const requestKey = JSON.stringify([\n profileId,\n userId,\n token,\n organizationId,\n ]);\n const existingPromise =\n fetchWorkspacesPromisesRef.current.get(requestKey);\n if (existingPromise) return existingPromise;\n const currentSelection = () => {\n const current = useAuthStore.getState();\n return (\n resolveActiveProfileId() === profileId &&\n current.user?.id === userId &&\n resolveAccessToken() === token &&\n current.currentOrganizationId === organizationId\n );\n };\n\n // Only bail when there is NO token at all. An expired one is handled by\n // graphqlFetch's refresh-and-retry (or ends in the shell's forced\n // logout) — silently returning [] here masked expiry as an empty list.\n if (!token) {\n return [];\n }\n\n store.setLoadingWorkspaces(true);\n setError(null);\n\n // Store the promise for deduplication before starting\n const fetchPromise = (async () => {\n try {\n const result = await graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n if (!currentSelection()) return [];\n // myWorkspaces returns workspaces across all the user's orgs;\n // filter to the requested org before handing to downstream.\n if (result.data?.workspaces?.items) {\n result.data.workspaces.items = result.data.workspaces.items.filter(\n (w) => w.organizationId === organizationId,\n );\n }\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (isAuthGraphQLError(result.errors)) {\n throw new AuthError(errorMessage);\n }\n console.error(\"Failed to fetch workspaces:\", result.errors);\n throw new Error(errorMessage);\n }\n\n // `myWorkspaces` returns every workspace the caller can see across\n // all of their orgs/tenants. The store key is per-org (selecting\n // org X then opening the dropdown should only show X's workspaces),\n // so we filter down to the requested org here. The dropdown filter\n // in ContextSwitcher.tsx is a defence-in-depth — without this\n // narrowing the store would briefly hold the caller's other-org\n // workspaces and the auto-pick logic (lines below) might select\n // one of them as the default.\n const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n const ws = allWs.filter((w) => w.organizationId === organizationId);\n store.setWorkspaces(ws);\n return ws;\n } catch (err) {\n if (!currentSelection() || err instanceof AuthError) {\n return [];\n }\n const message =\n err instanceof Error ? err.message : \"Failed to fetch workspaces\";\n console.error(\"Failed to fetch workspaces:\", err);\n setError(message);\n return [];\n } finally {\n if (currentSelection()) store.setLoadingWorkspaces(false);\n fetchWorkspacesPromisesRef.current.delete(requestKey);\n }\n })();\n\n fetchWorkspacesPromisesRef.current.set(requestKey, fetchPromise);\n return fetchPromise;\n },\n [globalBaseUrl],\n );\n\n // ===========================================================================\n // Issue Workspace Token (Workspace Gateway - wspace-auth-svc)\n // ===========================================================================\n\n const issueWorkspaceToken = useCallback(\n async (\n organizationId: string,\n workspaceId?: string,\n projectId?: string | null,\n // Target workspace's tenant. Sent as x-tenant-id so the token service can\n // resolve the tenant for a super_admin switching into a workspace not\n // mirrored into the wspace layer (whose access token carries no tenant\n // claim). Regular members resolve their tenant via membership regardless.\n tenantId?: string,\n ): Promise<{\n success: boolean;\n token?: string;\n resolvedWorkspaceId?: string;\n error?: string;\n }> => {\n const store = useAuthStore.getState();\n const originalScope = [\n store.currentOrganizationId,\n store.currentWorkspaceId,\n store.currentProjectId,\n ];\n const workspaceWide = isWorkspaceWideSelection({\n organizationId,\n workspaceId: workspaceId ?? null,\n });\n const authToken = resolveAccessToken();\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n\n // Expired tokens flow through: graphqlFetch refreshes and retries once.\n if (!authToken) {\n return { success: false, error: \"No valid access token available\" };\n }\n\n setError(null);\n\n try {\n const result = await graphqlFetch<{\n issueWorkspaceToken: IssueWorkspaceTokenResult;\n }>({\n gateway: \"workspace\",\n query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n variables: {\n input: {\n organizationId,\n ...(workspaceId && { workspaceId }),\n ...(projectId && { projectId }),\n },\n },\n authToken,\n baseUrl: workspaceBaseUrl,\n tenantId,\n });\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (!isAuthGraphQLError(result.errors)) {\n console.error(\"Failed to issue workspace token:\", result.errors);\n }\n return { success: false, error: errorMessage };\n }\n\n const tokenResult = result.data?.issueWorkspaceToken;\n\n if (tokenResult?.success && tokenResult.token) {\n const latest = useAuthStore.getState();\n if (\n resolveActiveProfileId() !== profileId ||\n useAuthStore.getState().user?.id !== userId ||\n resolveAccessToken() !== authToken ||\n originalScope.some(\n (value, index) =>\n value !==\n [\n latest.currentOrganizationId,\n latest.currentWorkspaceId,\n latest.currentProjectId,\n ][index],\n ) ||\n isWorkspaceWideSelection({\n organizationId,\n workspaceId: workspaceId ?? null,\n }) !== workspaceWide ||\n !isWorkspaceTokenValidForContext(tokenResult.token, {\n organizationId,\n workspaceId,\n projectId,\n workspaceWide,\n })\n ) {\n return {\n success: false,\n error: \"Workspace context changed during token issuance\",\n };\n }\n const resolvedWsId = tokenResult.workspaceId || workspaceId;\n if (resolvedWsId) {\n store.setCurrentWorkspaceId(resolvedWsId);\n }\n store.setWorkspaceToken(tokenResult.token);\n return {\n success: true,\n token: tokenResult.token,\n resolvedWorkspaceId: resolvedWsId || undefined,\n };\n }\n\n return {\n success: false,\n error:\n tokenResult?.error?.message ?? \"Failed to issue workspace token\",\n };\n } catch (err) {\n const message =\n err instanceof Error\n ? err.message\n : \"Failed to issue workspace token\";\n console.error(\"Failed to issue workspace token:\", err);\n setError(message);\n return { success: false, error: message };\n }\n },\n [workspaceBaseUrl],\n );\n\n // ===========================================================================\n // Fetch Projects (Workspace Gateway - requires workspace token)\n // ===========================================================================\n\n const fetchProjects = useCallback(async (): Promise<Project[]> => {\n const store = useAuthStore.getState();\n const authToken = resolveAccessToken();\n const wsToken = store.workspaceToken;\n const workspaceId = store.currentWorkspaceId;\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n const organizationId = store.currentOrganizationId;\n const projectId = store.currentProjectId;\n const wide = isWorkspaceWideSelection({ organizationId, workspaceId });\n const currentSelection = () => {\n const current = useAuthStore.getState();\n return (\n resolveActiveProfileId() === profileId &&\n current.user?.id === userId &&\n resolveAccessToken() === authToken &&\n current.workspaceToken === wsToken &&\n current.currentOrganizationId === organizationId &&\n current.currentWorkspaceId === workspaceId &&\n current.currentProjectId === projectId &&\n isWorkspaceWideSelection({ organizationId, workspaceId }) === wide\n );\n };\n\n // Expired tokens flow through: graphqlFetch refreshes and retries once.\n if (!authToken) {\n return [];\n }\n\n if (!wsToken) {\n return [];\n }\n\n if (!workspaceId) {\n return [];\n }\n\n store.setLoadingProjects(true);\n setError(null);\n\n try {\n const result = await graphqlFetch<ProjectsResponse>({\n gateway: \"workspace\",\n query: PROJECTS_QUERY,\n authToken,\n workspaceToken: wsToken,\n baseUrl: workspaceBaseUrl,\n });\n\n if (!currentSelection()) return [];\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (isAuthGraphQLError(result.errors)) {\n throw new AuthError(errorMessage);\n }\n console.error(\"Failed to fetch projects:\", result.errors);\n throw new Error(errorMessage);\n }\n\n const projs: Project[] = result.data?.projects?.items ?? [];\n store.setProjects(projs);\n return projs;\n } catch (err) {\n if (err instanceof AuthError) {\n return [];\n }\n const message =\n err instanceof Error ? err.message : \"Failed to fetch projects\";\n console.error(\"Failed to fetch projects:\", err);\n setError(message);\n return [];\n } finally {\n store.setLoadingProjects(false);\n }\n }, [workspaceBaseUrl]);\n\n // ===========================================================================\n // High-Level Selection Actions\n // ===========================================================================\n\n const selectOrganization = useCallback(\n async (org: Organization): Promise<Workspace[]> => {\n const store = useAuthStore.getState();\n\n store.setCurrentWorkspaceId(null);\n store.setWorkspaceToken(null);\n store.setProjects([]);\n store.setCurrentProjectId(null);\n store.setCurrentOrganizationId(org.id);\n\n const ws = await fetchWorkspacesForOrg(org.id);\n return ws;\n },\n [fetchWorkspacesForOrg],\n );\n\n const selectWorkspace = useCallback(\n async (\n workspace: Workspace,\n ): Promise<{\n success: boolean;\n projects?: Project[];\n error?: string;\n }> => {\n const store = useAuthStore.getState();\n\n store.setCurrentProjectId(null);\n store.setProjects([]);\n\n if (!workspace.organizationId) {\n console.error(\"Workspace missing organizationId:\", workspace);\n return {\n success: false,\n error: \"Workspace is missing organizationId\",\n };\n }\n\n const tokenResult = await issueWorkspaceToken(\n workspace.organizationId,\n workspace.id,\n undefined,\n workspace.tenantId,\n );\n\n if (!tokenResult.success) {\n return { success: false, error: tokenResult.error };\n }\n\n const selected = useAuthStore.getState();\n const profileId = resolveActiveProfileId();\n const userId = selected.user?.id;\n const accessToken = resolveAccessToken();\n const workspaceToken = selected.workspaceToken;\n const projectId = selected.currentProjectId;\n const wide = isWorkspaceWideSelection({\n organizationId: workspace.organizationId,\n workspaceId: workspace.id,\n });\n const currentSelection = () => {\n const current = useAuthStore.getState();\n return (\n resolveActiveProfileId() === profileId &&\n current.user?.id === userId &&\n resolveAccessToken() === accessToken &&\n current.workspaceToken === workspaceToken &&\n current.currentOrganizationId === workspace.organizationId &&\n current.currentWorkspaceId === workspace.id &&\n current.currentProjectId === projectId &&\n isWorkspaceWideSelection({\n organizationId: workspace.organizationId,\n workspaceId: workspace.id,\n }) === wide\n );\n };\n const projs = await fetchProjects();\n if (!currentSelection())\n return { success: false, error: \"Context changed during selection\" };\n\n if (\n projs.length > 0 &&\n !isWorkspaceWideSelection({\n organizationId: workspace.organizationId,\n workspaceId: workspace.id,\n })\n ) {\n store.setCurrentProjectId(projs[0]!.id);\n }\n\n return { success: true, projects: projs };\n },\n [issueWorkspaceToken, fetchProjects],\n );\n\n const selectProject = useCallback((project: Project): void => {\n const store = useAuthStore.getState();\n clearWorkspaceWideSelection({\n organizationId: store.currentOrganizationId,\n workspaceId: store.currentWorkspaceId,\n });\n store.setCurrentProjectId(project.id);\n if (\n store.workspaceToken &&\n !isWorkspaceTokenValidForContext(store.workspaceToken, {\n workspaceId: store.currentWorkspaceId,\n organizationId: store.currentOrganizationId,\n projectId: project.id,\n })\n ) {\n store.setWorkspaceToken(null);\n }\n }, []);\n\n const selectWorkspaceWide = useCallback((): void => {\n const store = useAuthStore.getState();\n const scope = {\n organizationId: activeOrganizationIdRef.current,\n workspaceId: activeWorkspaceIdRef.current,\n };\n if (\n !scope.organizationId ||\n !scope.workspaceId ||\n store.currentOrganizationId !== scope.organizationId ||\n store.currentWorkspaceId !== scope.workspaceId\n ) {\n throw new Error(\"Current workspace context required\");\n }\n if (!persistWorkspaceWideSelection(scope))\n throw new Error(\"Workspace-wide preference could not be saved\");\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n setActiveContext({ projectId: null });\n }, [setActiveContext]);\n\n // ===========================================================================\n // Cross-MFE refresh: keep the switcher lists current when another MFE mutates\n // org/workspace/project entities. microfe-workspaces emits these domain events\n // on the shared event bus (e.g. on project rename); without this the switcher\n // keeps showing the stale cached name until a full page reload.\n // ===========================================================================\n\n useEffect(() => {\n let cancelled = false;\n\n // Coalesce a refetch into a single in-flight run with one trailing re-run,\n // so a burst of events collapses to one request (+ one trailing) instead of\n // fanning out or being swallowed by a downstream per-key dedupe. The flag is\n // cleared on cleanup so nothing fires after the subscription is torn down.\n const makeCoalescedRefetch = (run: () => Promise<unknown>) => {\n let running = false;\n let queued = false;\n const trigger = () => {\n if (cancelled) return;\n if (running) {\n queued = true;\n return;\n }\n running = true;\n void run().finally(() => {\n running = false;\n if (!cancelled && queued) {\n queued = false;\n trigger();\n }\n });\n };\n return trigger;\n };\n\n const refreshProjects = makeCoalescedRefetch(() => fetchProjects());\n const refreshWorkspaces = makeCoalescedRefetch(() => {\n const orgId = useAuthStore.getState().currentOrganizationId;\n return orgId ? fetchWorkspacesForOrg(orgId) : Promise.resolve();\n });\n\n // Custom domain events (not in BurdenoffEventName) flow through `onAny`.\n const unsubscribe = eventBus.onAny((event) => {\n // Custom event names aren't in the BurdenoffEventName union; compare as string.\n const eventName: string = event.name;\n\n if (PROJECT_REFRESH_EVENTS.has(eventName)) {\n const eventWorkspaceId = readEventWorkspaceId(event.payload);\n const { currentWorkspaceId } = useAuthStore.getState();\n // Only refetch when the event targets the workspace currently in\n // context (events without a workspace id are treated as relevant).\n if (\n eventWorkspaceId &&\n currentWorkspaceId &&\n eventWorkspaceId !== currentWorkspaceId\n ) {\n return;\n }\n // Refetch only — a deleted project simply drops out of the list, and\n // `currentProject` resolves to undefined for it. Clearing the selection\n // here would race ActiveContext / the project sync effect (the real\n // source of truth), so we leave selection reconciliation to them.\n refreshProjects();\n return;\n }\n\n if (WORKSPACE_REFRESH_EVENTS.has(eventName)) {\n refreshWorkspaces();\n }\n });\n\n return () => {\n cancelled = true;\n unsubscribe();\n };\n }, [eventBus, fetchProjects, fetchWorkspacesForOrg]);\n\n // ===========================================================================\n // Get Current Items\n // ===========================================================================\n\n const currentOrganization = organizations.find(\n (org) => org.id === currentOrganizationId,\n );\n const currentWorkspace = workspaces.find(\n (ws) => ws.id === currentWorkspaceId,\n );\n const currentProject = projects.find((proj) => proj.id === currentProjectId);\n\n // ===========================================================================\n // Return Hook API\n // ===========================================================================\n\n return {\n organizations,\n workspaces,\n projects,\n\n currentOrganizationId,\n currentWorkspaceId,\n currentProjectId,\n\n currentOrganization,\n currentWorkspace,\n currentProject,\n\n workspaceToken,\n\n isLoadingOrganizations,\n isLoadingWorkspaces,\n isLoadingProjects,\n isLoading:\n isLoadingOrganizations || isLoadingWorkspaces || isLoadingProjects,\n\n error,\n\n fetchOrganizations,\n fetchWorkspacesForOrg,\n issueWorkspaceToken,\n fetchProjects,\n\n selectOrganization,\n selectWorkspace,\n selectProject,\n selectWorkspaceWide,\n };\n}\n\n/**\n * Hook to reactively ensure workspaces are synced with the current organization.\n *\n * This handles edge cases where the organization changes but workspaces\n * from a different org are still in the store (e.g., stale data, race conditions).\n *\n * Usage:\n * ```tsx\n * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n * useWorkspaceSyncEffect(); // Ensures workspaces stay in sync\n * // ...\n * }\n * ```\n */\nexport function useWorkspaceSyncEffect(\n options?: UseContextSwitcherDataOptions,\n) {\n const currentOrganizationId = useAuthStore(\n (state) => state.currentOrganizationId,\n );\n const workspaces = useAuthStore((state) => state.workspaces);\n const accessToken = useAuthStore((state) => state.accessToken);\n const isLoadingWorkspaces = useAuthStore(\n (state) => state.isLoadingWorkspaces,\n );\n const resolvedBaseUrls = resolveGatewayBaseUrls();\n const globalBaseUrl =\n options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n const disableWorkspaceSync = options?.disableWorkspaceSync ?? false;\n\n useEffect(() => {\n if (disableWorkspaceSync) return;\n // Skip if no org selected, no token, or already loading\n if (!currentOrganizationId || !accessToken || isLoadingWorkspaces) return;\n\n // Check if any workspace matches the current org\n const hasMatchingWorkspaces = workspaces.some(\n (ws) => ws.organizationId === currentOrganizationId,\n );\n\n // If workspaces exist but none match current org, we need to refetch\n // This can happen in edge cases with stale data or race conditions\n if (workspaces.length > 0 && !hasMatchingWorkspaces) {\n const store = useAuthStore.getState();\n store.setLoadingWorkspaces(true);\n\n // Inline fetch to avoid circular dependency with useContextSwitcherData\n graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: accessToken,\n baseUrl: globalBaseUrl,\n })\n .then((result) => {\n // myWorkspaces returns ALL my workspaces; filter to current org\n // client-side (the old server-side filter no longer exists).\n if (result.data?.workspaces?.items) {\n result.data.workspaces.items = result.data.workspaces.items.filter(\n (w) => w.organizationId === currentOrganizationId,\n );\n }\n if (!result.errors?.length) {\n const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n // Same per-org narrowing as fetchWorkspacesForOrg — see the\n // comment there for why we don't just dump the full caller-\n // visible list into the store.\n const ws = allWs.filter(\n (w) => w.organizationId === currentOrganizationId,\n );\n store.setWorkspaces(ws);\n }\n })\n .catch(() => {\n // Silent fail - user can manually refresh or select org again\n })\n .finally(() => {\n store.setLoadingWorkspaces(false);\n });\n }\n }, [\n currentOrganizationId,\n workspaces,\n accessToken,\n isLoadingWorkspaces,\n globalBaseUrl,\n disableWorkspaceSync,\n ]);\n}\n\n/**\n * Hook to reactively ensure projects are loaded when a workspace is selected.\n *\n * This handles the case where a workspace is auto-selected (from URL/localStorage)\n * but projects haven't been fetched yet. It will:\n * 1. Issue a workspace token if not present\n * 2. Fetch projects for the selected workspace\n *\n * Usage:\n * ```tsx\n * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n * useProjectSyncEffect(); // Ensures projects are loaded for selected workspace\n * // ...\n * }\n * ```\n */\nexport function useProjectSyncEffect(options?: UseContextSwitcherDataOptions) {\n const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n const currentOrganizationId = useAuthStore(\n (state) => state.currentOrganizationId,\n );\n const workspaces = useAuthStore((state) => state.workspaces);\n const projects = useAuthStore((state) => state.projects);\n const currentProjectId = useAuthStore((state) => state.currentProjectId);\n const workspaceToken = useAuthStore((state) => state.workspaceToken);\n const accessToken = useAuthStore((state) => state.accessToken);\n const resolvedBaseUrls = resolveGatewayBaseUrls();\n const workspaceBaseUrl =\n options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n const disableProjectSync = options?.disableProjectSync ?? false;\n const skipProjectFetch = options?.skipProjectFetch ?? false;\n\n // Use refs to prevent the infinite loop caused by including loading/failure\n // state in the dependency array. Without these, the cycle is:\n // setLoadingProjects(true) -> dep change -> effect re-runs (guarded) ->\n // async completes -> setLoadingProjects(false) -> dep change ->\n // effect re-runs -> starts again -> INFINITE LOOP\n const syncInProgressRef = useRef(false);\n const [syncRevision, setSyncRevision] = useState(0);\n const emptyProjectsResultRef = useRef<{\n scopeKey: string;\n projects: Project[];\n } | null>(null);\n // Pending retry timer per workspace, so transient failures (e.g. RBAC lag\n // right after workspace creation) get an automatic second chance even if no\n // dependency change re-triggers the effect.\n const retryTimerRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(\n new Map(),\n );\n // Per-workspace failure tracker — caps retry attempts when project bootstrap\n // (token issue or list) fails. An empty authorized project list is a valid\n // workspace-only context, not a provisioning failure.\n //\n // We track both count AND lastFailureAt so we can honour a \"cool-down\" window:\n // after PROJECT_SYNC_FAILURE_COOLDOWN_MS has elapsed since the last failure,\n // the counter is treated as cleared so transient backend hiccups (e.g. RBAC\n // role propagation lag right after signup) don't permanently lock a workspace\n // out of the context dropdown — the original cause of marqueue §729.\n const projectSyncFailuresRef = useRef<\n Map<string, { count: number; lastFailureAt: number }>\n >(new Map());\n const PROJECT_SYNC_MAX_FAILURES = 8;\n const PROJECT_SYNC_FAILURE_COOLDOWN_MS = 30_000;\n useEffect(() => {\n if (disableProjectSync) return;\n // Skip if no workspace selected or no access token\n if (!currentWorkspaceId || !accessToken) return;\n\n // Skip if a sync is already in progress (ref-based guard avoids dep loop)\n if (syncInProgressRef.current) return;\n\n // Stop retrying once this workspace has failed too many times in a row.\n // Counter is reset on success, on workspace switch (different key), by\n // an explicit user retry path (e.g. selectWorkspace), or after the\n // cool-down window has elapsed since the last failure (so transient\n // backend issues don't permanently wedge the dropdown).\n const failureEntry = projectSyncFailuresRef.current.get(currentWorkspaceId);\n if (\n failureEntry &&\n failureEntry.count >= PROJECT_SYNC_MAX_FAILURES &&\n Date.now() - failureEntry.lastFailureAt < PROJECT_SYNC_FAILURE_COOLDOWN_MS\n ) {\n return;\n }\n if (\n failureEntry &&\n Date.now() - failureEntry.lastFailureAt >=\n PROJECT_SYNC_FAILURE_COOLDOWN_MS\n ) {\n // Cool-down elapsed — clear the counter so we get a fresh budget.\n projectSyncFailuresRef.current.delete(currentWorkspaceId);\n }\n\n // Resolve organizationId: prefer the workspace object (if loaded), fall\n // back to the persisted currentOrganizationId. The workspaces array is\n // NOT persisted by zustand, so on page reload it is empty until\n // fetchOrganizations() completes. Using the persisted org ID lets us\n // issue the workspace token immediately instead of waiting.\n const currentWorkspace = workspaces.find(\n (ws) => ws.id === currentWorkspaceId,\n );\n\n // Guard: transient (newOrg, oldWs) divergence during org switches — token issuance always fails.\n if (\n currentWorkspace &&\n currentOrganizationId &&\n currentWorkspace.organizationId !== currentOrganizationId\n ) {\n return;\n }\n\n const organizationId =\n currentWorkspace?.organizationId ?? currentOrganizationId;\n if (!organizationId) return;\n\n const store = useAuthStore.getState();\n if (\n currentProjectId &&\n getUrlParam(\"project\") === currentProjectId &&\n getUrlParam(\"workspace\") === currentWorkspaceId &&\n getUrlParam(\"org\") === organizationId\n ) {\n clearWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n });\n }\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n const workspaceWide = isWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n });\n if (workspaceWide && store.currentProjectId) {\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n return;\n }\n\n // If we don't have a workspace token or it's expired, issue one first\n const needsToken =\n !workspaceToken ||\n isTokenExpired(workspaceToken) ||\n !isWorkspaceTokenValidForContext(workspaceToken, {\n workspaceId: currentWorkspaceId,\n organizationId: currentOrganizationId,\n projectId: currentProjectId,\n workspaceWide,\n });\n\n // Skip if projects are already loaded for this workspace AND token is valid\n const scopeKey = JSON.stringify([\n profileId,\n userId,\n accessToken,\n organizationId,\n currentWorkspaceId,\n ]);\n const hasProjectsForWorkspace =\n projects.some((p) => p.workspaceId === currentWorkspaceId) ||\n (emptyProjectsResultRef.current?.scopeKey === scopeKey &&\n emptyProjectsResultRef.current.projects === projects);\n if (hasProjectsForWorkspace && !needsToken) {\n if (!store.currentProjectId && !workspaceWide) {\n const firstProject = projects.find(\n (project) => project.workspaceId === currentWorkspaceId,\n );\n if (firstProject) {\n store.setCurrentProjectId(firstProject.id);\n }\n }\n return;\n }\n\n const contextStillCurrent = () => {\n const latest = useAuthStore.getState();\n return (\n latest.accessToken === accessToken &&\n latest.user?.id === userId &&\n resolveActiveProfileId() === profileId &&\n latest.currentOrganizationId === organizationId &&\n latest.currentWorkspaceId === currentWorkspaceId &&\n latest.currentProjectId === currentProjectId &&\n isWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n }) === workspaceWide\n );\n };\n\n const syncProjects = async () => {\n syncInProgressRef.current = true;\n store.setLoadingProjects(true);\n let succeeded = false;\n\n try {\n let wsToken = workspaceToken;\n\n // Issue workspace token if needed\n if (needsToken) {\n const tokenResult = await graphqlFetch<{\n issueWorkspaceToken: IssueWorkspaceTokenResult;\n }>({\n gateway: \"workspace\",\n query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n variables: {\n input: {\n organizationId,\n workspaceId: currentWorkspaceId,\n ...(currentProjectId ? { projectId: currentProjectId } : {}),\n },\n },\n authToken: accessToken,\n baseUrl: workspaceBaseUrl,\n // See issueWorkspaceToken: send the current workspace's tenant so a\n // super_admin (no tenant claim) can resolve it for an unmirrored ws.\n tenantId: workspaces.find((ws) => ws.id === currentWorkspaceId)\n ?.tenantId,\n });\n\n if (\n tokenResult.data?.issueWorkspaceToken?.success &&\n tokenResult.data.issueWorkspaceToken.token\n ) {\n wsToken = tokenResult.data.issueWorkspaceToken.token;\n if (\n !contextStillCurrent() ||\n !isWorkspaceTokenValidForContext(wsToken, {\n workspaceId: currentWorkspaceId,\n organizationId,\n projectId: currentProjectId,\n workspaceWide,\n })\n )\n return;\n store.setWorkspaceToken(wsToken);\n } else {\n return;\n }\n }\n\n // Fetch projects (skip if already loaded or token-only sync requested)\n if (wsToken && !hasProjectsForWorkspace && !skipProjectFetch) {\n const projectsResult = await graphqlFetch<ProjectsResponse>({\n gateway: \"workspace\",\n query: PROJECTS_QUERY,\n authToken: accessToken,\n workspaceToken: wsToken,\n baseUrl: workspaceBaseUrl,\n });\n\n if (!contextStillCurrent() || projectsResult.errors?.length) {\n return;\n }\n\n const projs: Project[] = projectsResult.data?.projects?.items ?? [];\n // myProjects lists accessible projects. An empty result does not\n // authorize creating one. Remember this result to avoid a render/\n // fetch loop; changing account or clearing the list invalidates it.\n emptyProjectsResultRef.current =\n projs.length === 0 ? { scopeKey, projects: projs } : null;\n store.setProjects(projs);\n\n // A restored/deep-linked project may have been removed or revoked.\n // Discard its token so the next sync establishes the current scope.\n if (\n currentProjectId &&\n !projs.some((project) => project.id === currentProjectId)\n ) {\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n }\n\n // Auto-select first project if none selected and projects exist\n if (\n projs.length > 0 &&\n !useAuthStore.getState().currentProjectId &&\n !isWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n })\n ) {\n store.setCurrentProjectId(projs[0].id);\n }\n }\n\n succeeded = true;\n } catch {\n // A later auth/context update should be able to retry.\n } finally {\n store.setLoadingProjects(false);\n syncInProgressRef.current = false;\n const scopeCurrent = contextStillCurrent();\n if (!scopeCurrent) setSyncRevision((revision) => revision + 1);\n const failures = projectSyncFailuresRef.current;\n if (scopeCurrent && succeeded) {\n failures.delete(currentWorkspaceId);\n const pending = retryTimerRef.current.get(currentWorkspaceId);\n if (pending) {\n clearTimeout(pending);\n retryTimerRef.current.delete(currentWorkspaceId);\n }\n } else if (scopeCurrent) {\n const existing = failures.get(currentWorkspaceId);\n const nextCount = (existing?.count ?? 0) + 1;\n failures.set(currentWorkspaceId, {\n count: nextCount,\n lastFailureAt: Date.now(),\n });\n // Schedule a backoff retry for transient backend lag (e.g. RBAC\n // role propagation right after signup → first projects() call hits\n // permission-denied). Without this, the effect would only re-run on\n // dep change and the user would be stuck staring at an empty\n // project dropdown until something else triggered a re-render.\n if (nextCount < PROJECT_SYNC_MAX_FAILURES) {\n const existingTimer = retryTimerRef.current.get(currentWorkspaceId);\n if (existingTimer) clearTimeout(existingTimer);\n const backoffMs = Math.min(1000 * 2 ** (nextCount - 1), 8000);\n const timer = setTimeout(() => {\n retryTimerRef.current.delete(currentWorkspaceId);\n // Only re-run if the workspace context is still the same and\n // a project hasn't been loaded for it in the meantime.\n const latest = useAuthStore.getState();\n if (\n contextStillCurrent() &&\n latest.currentWorkspaceId === currentWorkspaceId &&\n !latest.projects.some(\n (p) => p.workspaceId === currentWorkspaceId,\n ) &&\n !syncInProgressRef.current\n ) {\n // Bump a render by clearing then resetting workspaceToken\n // when valid, OR by re-issuing projects fetch directly. The\n // simplest robust trigger is to clear the in-progress guard\n // and call syncProjects() again with current closure values.\n void syncProjects();\n }\n }, backoffMs);\n retryTimerRef.current.set(currentWorkspaceId, timer);\n }\n }\n }\n };\n\n syncProjects();\n }, [\n syncRevision,\n currentWorkspaceId,\n currentOrganizationId,\n workspaces,\n projects,\n currentProjectId,\n workspaceToken,\n accessToken,\n workspaceBaseUrl,\n disableProjectSync,\n skipProjectFetch,\n ]);\n\n // Cleanup any pending retry timers on unmount so we don't leak stray\n // setTimeout callbacks running against stale closures.\n useEffect(() => {\n const timers = retryTimerRef.current;\n return () => {\n timers.forEach((timer) => clearTimeout(timer));\n timers.clear();\n };\n }, []);\n}\n// hmr-bust-1778064429\n"],"mappings":";;;;;;;;;;AAwFA,IAAM,IAAyB,2RAoCzB,IAA0B,oSAoB1B,IAAiC,6SA0BjC,IAAiB;AA0BvB,SAAS,EAAe,GAAe,IAAW,KAAiB;CACjE,IAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,GAAG,EAAE,EAAE,CAAC;EAEpD,OADK,EAAQ,MACN,EAAQ,MAAM,MAAO,KAAK,IAAI,IAAI,IADhB;CAE3B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,EAAyB,GAKzB;CACP,IAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,GAAG,EAAE,EAAE,CAAC;EACpD,OAAO;GACL,aACE,OAAO,EAAQ,eAAgB,WAC3B,EAAQ,cACR,KAAA;GACN,gBACE,OAAO,EAAQ,kBAAmB,WAC9B,EAAQ,iBACR,KAAA;GACN,WACE,OAAO,EAAQ,aAAc,WAAW,EAAQ,YAAY,KAAA;GAC9D,KAAK,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,KAAA;EACvD;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,EACP,GACA,GAMiB;CACjB,IAAI,CAAC,KAAS,EAAe,CAAK,GAChC,OAAO;CAGT,IAAM,IAAU,EAAyB,CAAK;CAsB9C,OAJA,EAjBI,CAAC,KAID,EAAS,eAAe,EAAQ,gBAAgB,EAAS,eAK3D,EAAS,kBACT,EAAQ,mBAAmB,EAAS,kBAKlC,EAAS,iBAAiB,EAAQ,aAElC,EAAS,aAAa,EAAQ,cAAc,EAAS;AAK3D;AAQA,IAAM,IAAN,cAAwB,MAAM;CAC5B,YAAY,GAAiB;EAE3B,AADA,MAAM,CAAO,GACb,KAAK,OAAO;CACd;AACF;AAKA,SAAS,EACP,GACS;CACT,OAAO,EAAO,MACX,MACC,EAAE,YAAY,SAAS,qBACvB,EAAE,SAAS,YAAY,EAAE,SAAS,cAAc,KAChD,EAAE,SAAS,YAAY,EAAE,SAAS,mBAAmB,CACzD;AACF;AAQA,SAAS,IAAoC;CAC3C,IAAM,IAAa,EAAa,SAAS,EAAE;CAG3C,IAAI,KAAc,CAAC,EAAe,CAAU,GAC1C,OAAO;CAIT,IAAM,IAAe,EAAmB;CAQxC,OAPI,KAAgB,CAAC,EAAe,CAAY,IACvC,IAMF;AACT;AAEA,SAAS,EAA2B,GAAyC;CAS3E,OARqB,MAAM,KACzB,IAAI,IACF,EAAW,SAAS,MAClB,EAAU,iBAAiB,CAAC,EAAU,cAAc,IAAI,CAAC,CAC3D,CACF,CAGK,EAAa,KAAK,GAAgB,OAAW;EAClD,IAAI;EACJ,MACE,EAAW,MACR,MAAc,EAAU,mBAAmB,CAC9C,GAAG,QAAQ,gBAAgB,IAAQ;EACrC,MAAM;EACN,UACE,EAAW,MACR,MAAc,EAAU,mBAAmB,CAC9C,GAAG,YAAY;CACnB,EAAE;AACJ;AAsBA,IAAM,IAAyB,IAAI,IAAY;CAC7C;CACA;CACA;CACA;CACA;AACF,CAAC,GACK,IAA2B,IAAI,IAAY;CAC/C;CACA;CACA;CACA;CACA;AACF,CAAC;AAKD,SAAS,GAAqB,GAAsC;CAClE,IAAI,KAAW,OAAO,KAAY,YAAY,iBAAiB,GAAS;EACtE,IAAM,IAAS,EAAsC;EACrD,OAAO,OAAO,KAAU,WAAW,IAAQ,KAAA;CAC7C;AAEF;AAEA,SAAgB,EACd,GACA;CACA,IAAM,EACJ,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,YAAY,MACV,EAAiB,GAEf,IAAW,EAAY,GAGvB,IAAgB,GAAc,MAAU,EAAM,aAAa,GAC3D,IAAwB,GAC3B,MAAU,EAAM,qBACnB,GACM,IAAyB,GAC5B,MAAU,EAAM,sBACnB,GAEM,IAAa,GAAc,MAAU,EAAM,UAAU,GACrD,IAAqB,GAAc,MAAU,EAAM,kBAAkB,GACrE,IAAiB,GAAc,MAAU,EAAM,cAAc,GAC7D,IAAsB,GACzB,MAAU,EAAM,mBACnB,GAEM,IAAW,GAAc,MAAU,EAAM,QAAQ,GACjD,IAAmB,GAAc,MAAU,EAAM,gBAAgB,GACjE,IAAoB,GAAc,MAAU,EAAM,iBAAiB,GAGnE,CAAC,IAAO,KAAY,EAAwB,IAAI,GAQhD,CAAC,GAAuB,KAA4B,EAAS,CAAC,GAC9D,IAA2B,EAAO,CAAC,GAGnC,IAA+B,EACnC,IACF,GACM,IAA6B,kBACjC,IAAI,IAAI,CACV,GAKM,IAAuB,EAAO,CAAiB,GAC/C,IAA0B,EAAO,CAAoB;CAC3D,QAAgB;EAEd,AADA,EAAqB,UAAU,GAC/B,EAAwB,UAAU;CACpC,CAAC;CAED,IAAM,KAAmB,EAAuB,GAC1C,IACJ,GAAS,iBAAiB,GAAiB,eACvC,IACJ,GAAS,oBAAoB,GAAiB,kBAS1C,KAAsB,EAAsB,IAAI,GAChD,KAA4B,EAAsB,IAAI,GACtD,KAA0B,EAAsB,IAAI,GACpD,KAA6B,EAAsB,IAAI;CAE7D,QAAgB;EACd,IAAM,IAAQ,EAAa,SAAS;EA0DpC,IAvDE,KACA,MAAyB,EAAM,yBAC/B,MAAyB,GAAoB,YAE7C,GAAoB,UAAU,GAC9B,EAAM,yBAAyB,CAAoB,GAEjD,EAAM,WAAW,SAAS,KAC1B,CAAC,EAAM,WAAW,MACf,MAAc,EAAU,mBAAmB,CAC9C,KAEA,EAAM,cAAc,CAAC,CAAC,IAKxB,KACA,MAAsB,EAAM,sBAC5B,MAAsB,GAA0B,YAEhD,GAA0B,UAAU,GACpC,EAAM,sBAAsB,CAAiB,GAE3C,EAAM,SAAS,SAAS,KACxB,CAAC,EAAM,SAAS,MACb,MAAY,EAAQ,gBAAgB,CACvC,MAEA,EAAM,YAAY,CAAC,CAAC,GACpB,EAAM,oBAAoB,IAAI,KAKhC,EAAyB;GACvB,gBAAgB;GAChB,aAAa;EACf,CAAC,KACD,CAAC,KACD,EAAM,qBAEN,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,IAI5B,KACA,MAAoB,EAAM,oBAC1B,MAAoB,GAAwB,YAE5C,GAAwB,UAAU,GAClC,EAAM,oBAAoB,CAAe,IAIzC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa;GACb,gBAAgB;GAChB,WAAW;GACX,eACE,CAAC,KACD,EAAyB;IACvB,gBAAgB;IAChB,aAAa;GACf,CAAC;EACL,CAAC,GACD;GAOA,IAAM,IAAS,GAAG,KAAwB,GAAG,GAAG,KAAqB,GAAG,GAAG,KAAmB;GAC9F,AAAI,GAA2B,YAAY,MACzC,GAA2B,UAAU,GACrC,EAAM,kBAAkB,IAAI;EAEhC;CACF,GAAG;EAAC;EAAsB;EAAmB;CAAe,CAAC;CAM7D,IAAM,IAAqB,EAAY,YAAqC;EAE1E,IAAI,EAA6B,SAC/B,OAAO,EAA6B;EAGtC,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAQ,EAAmB;EAuWjC,OArWK,KAeL,EAAM,wBAAwB,EAAI,GAClC,EAAS,IAAI,GAGb,EAA6B,WAAW,YAAY;GAClD,IAAI;IACF,IAAM,IACJ,EAAwB,WAAW,EAAM,uBACvC,IAEA,IACA,OAAO,YAAY;KACjB,IAAM,CAAC,GAAqB,KAAoB,MAAM,QAAQ,IAC5D,CACE,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;KACX,CAAC,GACD,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;KACX,CAAC,CACH,CACF;KAWA,OAAO;MACL,MAVW,EAAoB,MAAM,kBACnC;OACE,iBAAiB,EAAoB,KAAK;OAC1C,GAAI,EAAiB,MAAM,aACvB,EAAE,YAAY,EAAiB,KAAK,WAAW,IAC/C,CAAC;MACP,IACA;MAIF,QAAQ,CACN,GAAI,EAAoB,UAAU,CAAC,GACnC,GAAI,EAAiB,UAAU,CAAC,CAClC;KACF;IACF,GAAG,IACH,MAAM,EAAsC;KAC1C,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;IACX,CAAC;IAkDL,IA3CE,KACA,EAAO,QAAQ,UACf,EAAO,OAAO,MACX,MACC,GAAG,YAAY,SAAS,eACxB,qCAAqC,KAAK,GAAG,WAAW,EAAE,KAO1D,oEAAoE,KAClE,GAAG,WAAW,EAChB,CACJ,MAOA,IAAS,MAAM,EAEb;KACA,SAAS;KACT,OAAO;KAYP,WAAW;KACX,SAAS;IACX,CAAC,IAGC,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;KASlD,MARI,EAAmB,EAAO,MAAM,IAG5B,IAAI,EAAU,CAAY,KAE9B,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAO,MAAM,GAErD,MAAM,CAAY;IAC9B;IAEA,IAAI,IAAuB,EAAO,MAAM,iBAAiB,SAAS,CAAC;IASnE,IACE,KACA,EAAK,WAAW,KAChB,EAAM,WAAW,WAAW,GAC5B;KACA,IAAM,IAAW,MAAM,EAAsC;MAC3D,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;KACX,CAAC;KACD,IAAI,CAAC,EAAS,QAAQ,QAIpB,AAHA,IAAO,EAAS,MAAM,iBAAiB,SAAS,CAAC,GAGjD,IAAS;MACP,GAAG;MACH,MAAM,EACJ,iBAAiB,EAAS,MAAM,mBAAmB;OACjD,OAAO,CAAC;OACR,OAAO;MACT,EACF;KACF;UACK;MAOL,QAAQ,KACN,oDACA,EAAS,MACX;MACA,IAAM,IACJ,EAAS,SAAS,IAAI,WAAW;MAInC,MAHI,EAAmB,EAAS,UAAU,CAAC,CAAC,IACpC,IAAI,EAAU,CAAe,IAE3B,MAAM,CAAe;KACjC;IACF;IAEA,IAAM,IACJ,EAAK,WAAW,KAAK,EAAM,WAAW,SAAS,IAC3C,EAA2B,EAAM,UAAU,IAC3C,CAAC,GACD,IACJ,EAAsB,SAAS,IAAI,IAAwB;IAE7D,EAAM,iBAAiB,CAAsB;IAG7C,IAAI,IAAc,GAaZ,IACJ,KAAe,EAAK,MAAM,MAAQ,EAAI,OAAO,CAAW;IAkC1D,IAjCI,KAAe,CAAC,KAAyB,EAAK,SAAS,MACzD,IAAc,EAAK,GAAG,IACtB,EAAiB;KACf,gBAAgB;KAChB,aAAa;KACb,UAAU;KACV,WAAW;IACb,CAAC,GACD,EAAM,cAAc,CAAC,CAAC,GACtB,EAAM,YAAY,CAAC,CAAC,GACpB,EAAM,sBAAsB,IAAI,GAChC,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,IAG1B,KAAe,MAAgB,EAAM,yBACvC,EAAM,yBAAyB,CAAW,GAIxC,EAAuB,SAAS,KAAK,CAAC,MACxC,EAAM,yBAAyB,EAAuB,GAAG,EAAE,GAC3D,IAAc,EAAuB,GAAG,KAWtC,KAAe,EAAa,SAAS,EAAE,WAAW,WAAW,GAAG;KAClE,EAAM,qBAAqB,EAAI;KAC/B,IAAI;MAGF,IAMM,KALJ,MAAuB,IACnB,EAAO,MAAM,YAAY,OAAO,QAC7B,MAAM,EAAE,mBAAmB,CAC9B,IACA,KAAA,MAGF,MAAM,EAAsC;OAC1C,SAAS;OACT,OAAO;OACP,WAAW;OACX,SAAS;MACX,CAAC,EAAE,MAAM,MACP,EAAS,QAAQ,SACb,QACC,EAAS,MAAM,YAAY,SAAS,CAAC,GAAG,QACtC,MAAM,EAAE,mBAAmB,CAC9B,CACN;MAQJ,IANK,KAIH,GAA0B,MAAM,IAAI,CAAC,GAEnC,GAAI;OACN,EAAM,cAAc,CAAE;OACtB,IAAM,IAAqB,EAAqB,UAC5C,EAAG,MACA,MACC,EAAU,OAAO,EAAqB,OAC1C,IACA;OAEJ,IAAI,GACF,EAAM,sBAAsB,EAAmB,EAAE;YAC5C,IAAI,EAAG,SAAS,GAAG;QACxB,IAAM,IAAoB;SACxB,gBAAgB;SAChB,aAAa,EAAG,GAAG;SACnB,UAAU,EAAG,GAAG;SAChB,WAAW;QACb;QAEA,AAAI,EAAqB,WAKvB,EAAM,sBAAsB,EAAG,GAAG,EAAE,GACpC,EAAM,kBAAkB,IAAI,GAC5B,EAAiB,CAAiB,KACxB,EAAM,uBAGhB,EAAM,sBAAsB,EAAG,GAAG,EAAE,GACpC,EAAiB,CAAiB;OAEtC;MACF;KACF,QAAQ;MAGN,GAA0B,MAAM,IAAI,CAAC;KACvC,UAAU;MACR,EAAM,qBAAqB,EAAK;KAClC;IACF;IAKA,OADA,EAAyB,UAAU,GAC5B;GACT,SAAS,GAAK;IAMZ,IAAI,aAAe,GACjB,OAAO,CAAC;IAEV,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;IAOvC,IANI,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,CAAG,GAErD,EAAS,CAAO,GAChB,GAA0B,MAAM,IAAI,CAAC,GAEjC,EAAM,WAAW,SAAS,GAAG;KAC/B,IAAM,IAAwB,EAC5B,EAAM,UACR;KACA,IAAI,EAAsB,SAAS,GAKjC,OAJA,EAAM,iBAAiB,CAAqB,GACvC,EAAM,yBACT,EAAM,yBAAyB,EAAsB,GAAG,EAAE,GAErD;IAEX;IAEA,OAAO,CAAC;GACV,UAAU;IAER,AADA,EAAM,wBAAwB,EAAK,GACnC,EAA6B,UAAU;GACzC;EACF,GAAG,GAEI,EAA6B,WAlW3B,CAAC;CAmWZ,GAAG,CAAC,GAAe,CAAgB,CAAC;CAgCpC,AApBA,QAAgB;EAGd,IAFI,MAA0B,KAC1B,EAAyB,WAAW,KACpC,CAAC,EAAmB,GAAG;EAC3B,EAAyB,WAAW;EACpC,IAAM,IAAU,KAAK,IACnB,OAAO,MAAM,EAAyB,UAAU,IAChD,IACF,GACM,IAAQ,OAAO,iBAAiB;GACpC,EAAwB;EAC1B,GAAG,CAAO;EACV,aAAa;GACX,OAAO,aAAa,CAAK;EAC3B;CACF,GAAG,CAAC,GAAuB,CAAkB,CAAC,GAK9C,QAAgB;EACd,IAAM,UAAiB;GACrB,AACE,EAAa,SAAS,EAAE,cAAc,WAAW,KACjD,EAAmB,MAEnB,EAAyB,UAAU,GACnC,EAAwB;EAE5B;EAEA,OADA,OAAO,iBAAiB,UAAU,CAAQ,SAC7B;GACX,OAAO,oBAAoB,UAAU,CAAQ;EAC/C;CACF,GAAG,CAAC,CAAkB,CAAC;CAMvB,IAAM,IAAwB,EAC5B,OAAO,MAAiD;EACtD,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAQ,EAAmB,GAC3B,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM,IAErB,IAAa,KAAK,UAAU;GAChC;GACA;GACA;GACA;EACF,CAAC,GACK,IACJ,EAA2B,QAAQ,IAAI,CAAU;EACnD,IAAI,GAAiB,OAAO;EAC5B,IAAM,UAAyB;GAC7B,IAAM,IAAU,EAAa,SAAS;GACtC,OACE,EAAuB,MAAM,KAC7B,EAAQ,MAAM,OAAO,KACrB,EAAmB,MAAM,KACzB,EAAQ,0BAA0B;EAEtC;EAKA,IAAI,CAAC,GACH,OAAO,CAAC;EAIV,AADA,EAAM,qBAAqB,EAAI,GAC/B,EAAS,IAAI;EAGb,IAAM,KAAgB,YAAY;GAChC,IAAI;IACF,IAAM,IAAS,MAAM,EAAsC;KACzD,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;IACX,CAAC;IACD,IAAI,CAAC,EAAiB,GAAG,OAAO,CAAC;IASjC,IANI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,CAC9B,IAGE,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;KAKlD,MAJI,EAAmB,EAAO,MAAM,IAC5B,IAAI,EAAU,CAAY,KAElC,QAAQ,MAAM,+BAA+B,EAAO,MAAM,GAChD,MAAM,CAAY;IAC9B;IAWA,IAAM,KADqB,EAAO,MAAM,YAAY,SAAS,CAAC,GAC7C,QAAQ,MAAM,EAAE,mBAAmB,CAAc;IAElE,OADA,EAAM,cAAc,CAAE,GACf;GACT,SAAS,GAAK;IACZ,IAAI,CAAC,EAAiB,KAAK,aAAe,GACxC,OAAO,CAAC;IAEV,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;IAGvC,OAFA,QAAQ,MAAM,+BAA+B,CAAG,GAChD,EAAS,CAAO,GACT,CAAC;GACV,UAAU;IAER,AADI,EAAiB,KAAG,EAAM,qBAAqB,EAAK,GACxD,EAA2B,QAAQ,OAAO,CAAU;GACtD;EACF,GAAG;EAGH,OADA,EAA2B,QAAQ,IAAI,GAAY,CAAY,GACxD;CACT,GACA,CAAC,CAAa,CAChB,GAMM,IAAsB,EAC1B,OACE,GACA,GACA,GAKA,MAMI;EACJ,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAgB;GACpB,EAAM;GACN,EAAM;GACN,EAAM;EACR,GACM,IAAgB,EAAyB;GAC7C;GACA,aAAa,KAAe;EAC9B,CAAC,GACK,IAAY,EAAmB,GAC/B,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM;EAG3B,IAAI,CAAC,GACH,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkC;EAGpE,EAAS,IAAI;EAEb,IAAI;GACF,IAAM,IAAS,MAAM,EAElB;IACD,SAAS;IACT,OAAO;IACP,WAAW,EACT,OAAO;KACL;KACA,GAAI,KAAe,EAAE,eAAY;KACjC,GAAI,KAAa,EAAE,aAAU;IAC/B,EACF;IACA;IACA,SAAS;IACT;GACF,CAAC;GAED,IAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;IAIlD,OAHK,EAAmB,EAAO,MAAM,KACnC,QAAQ,MAAM,oCAAoC,EAAO,MAAM,GAE1D;KAAE,SAAS;KAAO,OAAO;IAAa;GAC/C;GAEA,IAAM,IAAc,EAAO,MAAM;GAEjC,IAAI,GAAa,WAAW,EAAY,OAAO;IAC7C,IAAM,IAAS,EAAa,SAAS;IACrC,IACE,EAAuB,MAAM,KAC7B,EAAa,SAAS,EAAE,MAAM,OAAO,KACrC,EAAmB,MAAM,KACzB,EAAc,MACX,GAAO,MACN,MACA;KACE,EAAO;KACP,EAAO;KACP,EAAO;IACT,EAAE,EACN,KACA,EAAyB;KACvB;KACA,aAAa,KAAe;IAC9B,CAAC,MAAM,KACP,CAAC,EAAgC,EAAY,OAAO;KAClD;KACA;KACA;KACA;IACF,CAAC,GAED,OAAO;KACL,SAAS;KACT,OAAO;IACT;IAEF,IAAM,IAAe,EAAY,eAAe;IAKhD,OAJI,KACF,EAAM,sBAAsB,CAAY,GAE1C,EAAM,kBAAkB,EAAY,KAAK,GAClC;KACL,SAAS;KACT,OAAO,EAAY;KACnB,qBAAqB,KAAgB,KAAA;IACvC;GACF;GAEA,OAAO;IACL,SAAS;IACT,OACE,GAAa,OAAO,WAAW;GACnC;EACF,SAAS,GAAK;GACZ,IAAM,IACJ,aAAe,QACX,EAAI,UACJ;GAGN,OAFA,QAAQ,MAAM,oCAAoC,CAAG,GACrD,EAAS,CAAO,GACT;IAAE,SAAS;IAAO,OAAO;GAAQ;EAC1C;CACF,GACA,CAAC,CAAgB,CACnB,GAMM,IAAgB,EAAY,YAAgC;EAChE,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAY,EAAmB,GAC/B,IAAU,EAAM,gBAChB,IAAc,EAAM,oBACpB,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM,IACrB,IAAiB,EAAM,uBACvB,IAAY,EAAM,kBAClB,IAAO,EAAyB;GAAE;GAAgB;EAAY,CAAC,GAC/D,UAAyB;GAC7B,IAAM,IAAU,EAAa,SAAS;GACtC,OACE,EAAuB,MAAM,KAC7B,EAAQ,MAAM,OAAO,KACrB,EAAmB,MAAM,KACzB,EAAQ,mBAAmB,KAC3B,EAAQ,0BAA0B,KAClC,EAAQ,uBAAuB,KAC/B,EAAQ,qBAAqB,KAC7B,EAAyB;IAAE;IAAgB;GAAY,CAAC,MAAM;EAElE;EAWA,IARI,CAAC,KAID,CAAC,KAID,CAAC,GACH,OAAO,CAAC;EAIV,AADA,EAAM,mBAAmB,EAAI,GAC7B,EAAS,IAAI;EAEb,IAAI;GACF,IAAM,IAAS,MAAM,EAA+B;IAClD,SAAS;IACT,OAAO;IACP;IACA,gBAAgB;IAChB,SAAS;GACX,CAAC;GAED,IAAI,CAAC,EAAiB,GAAG,OAAO,CAAC;GAEjC,IAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;IAKlD,MAJI,EAAmB,EAAO,MAAM,IAC5B,IAAI,EAAU,CAAY,KAElC,QAAQ,MAAM,6BAA6B,EAAO,MAAM,GAC9C,MAAM,CAAY;GAC9B;GAEA,IAAM,IAAmB,EAAO,MAAM,UAAU,SAAS,CAAC;GAE1D,OADA,EAAM,YAAY,CAAK,GAChB;EACT,SAAS,GAAK;GACZ,IAAI,aAAe,GACjB,OAAO,CAAC;GAEV,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;GAGvC,OAFA,QAAQ,MAAM,6BAA6B,CAAG,GAC9C,EAAS,CAAO,GACT,CAAC;EACV,UAAU;GACR,EAAM,mBAAmB,EAAK;EAChC;CACF,GAAG,CAAC,CAAgB,CAAC,GAMf,KAAqB,EACzB,OAAO,MAA4C;EACjD,IAAM,IAAQ,EAAa,SAAS;EASpC,OAPA,EAAM,sBAAsB,IAAI,GAChC,EAAM,kBAAkB,IAAI,GAC5B,EAAM,YAAY,CAAC,CAAC,GACpB,EAAM,oBAAoB,IAAI,GAC9B,EAAM,yBAAyB,EAAI,EAAE,GAG9B,MADU,EAAsB,EAAI,EAAE;CAE/C,GACA,CAAC,CAAqB,CACxB,GAEM,KAAkB,EACtB,OACE,MAKI;EACJ,IAAM,IAAQ,EAAa,SAAS;EAKpC,IAHA,EAAM,oBAAoB,IAAI,GAC9B,EAAM,YAAY,CAAC,CAAC,GAEhB,CAAC,EAAU,gBAEb,OADA,QAAQ,MAAM,qCAAqC,CAAS,GACrD;GACL,SAAS;GACT,OAAO;EACT;EAGF,IAAM,IAAc,MAAM,EACxB,EAAU,gBACV,EAAU,IACV,KAAA,GACA,EAAU,QACZ;EAEA,IAAI,CAAC,EAAY,SACf,OAAO;GAAE,SAAS;GAAO,OAAO,EAAY;EAAM;EAGpD,IAAM,IAAW,EAAa,SAAS,GACjC,IAAY,EAAuB,GACnC,IAAS,EAAS,MAAM,IACxB,IAAc,EAAmB,GACjC,IAAiB,EAAS,gBAC1B,IAAY,EAAS,kBACrB,IAAO,EAAyB;GACpC,gBAAgB,EAAU;GAC1B,aAAa,EAAU;EACzB,CAAC,GACK,UAAyB;GAC7B,IAAM,IAAU,EAAa,SAAS;GACtC,OACE,EAAuB,MAAM,KAC7B,EAAQ,MAAM,OAAO,KACrB,EAAmB,MAAM,KACzB,EAAQ,mBAAmB,KAC3B,EAAQ,0BAA0B,EAAU,kBAC5C,EAAQ,uBAAuB,EAAU,MACzC,EAAQ,qBAAqB,KAC7B,EAAyB;IACvB,gBAAgB,EAAU;IAC1B,aAAa,EAAU;GACzB,CAAC,MAAM;EAEX,GACM,IAAQ,MAAM,EAAc;EAclC,OAbK,EAAiB,KAIpB,EAAM,SAAS,KACf,CAAC,EAAyB;GACxB,gBAAgB,EAAU;GAC1B,aAAa,EAAU;EACzB,CAAC,KAED,EAAM,oBAAoB,EAAM,GAAI,EAAE,GAGjC;GAAE,SAAS;GAAM,UAAU;EAAM,KAZ/B;GAAE,SAAS;GAAO,OAAO;EAAmC;CAavE,GACA,CAAC,GAAqB,CAAa,CACrC,GAEM,KAAgB,GAAa,MAA2B;EAC5D,IAAM,IAAQ,EAAa,SAAS;EAMpC,AALA,EAA4B;GAC1B,gBAAgB,EAAM;GACtB,aAAa,EAAM;EACrB,CAAC,GACD,EAAM,oBAAoB,EAAQ,EAAE,GAElC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa,EAAM;GACnB,gBAAgB,EAAM;GACtB,WAAW,EAAQ;EACrB,CAAC,KAED,EAAM,kBAAkB,IAAI;CAEhC,GAAG,CAAC,CAAC,GAEC,KAAsB,QAAwB;EAClD,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAQ;GACZ,gBAAgB,EAAwB;GACxC,aAAa,EAAqB;EACpC;EACA,IACE,CAAC,EAAM,kBACP,CAAC,EAAM,eACP,EAAM,0BAA0B,EAAM,kBACtC,EAAM,uBAAuB,EAAM,aAEnC,MAAU,MAAM,oCAAoC;EAEtD,IAAI,CAAC,EAA8B,CAAK,GACtC,MAAU,MAAM,8CAA8C;EAGhE,AAFA,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,GAC5B,EAAiB,EAAE,WAAW,KAAK,CAAC;CACtC,GAAG,CAAC,CAAgB,CAAC;CA+FrB,OAtFA,QAAgB;EACd,IAAI,IAAY,IAMV,KAAwB,MAAgC;GAC5D,IAAI,IAAU,IACV,IAAS,IACP,UAAgB;IAChB,QACJ;SAAI,GAAS;MACX,IAAS;MACT;KACF;KAEA,AADA,IAAU,IACV,EAAS,EAAE,cAAc;MAEvB,AADA,IAAU,IACN,CAAC,KAAa,MAChB,IAAS,IACT,EAAQ;KAEZ,CAAC;IARD;GASF;GACA,OAAO;EACT,GAEM,IAAkB,QAA2B,EAAc,CAAC,GAC5D,IAAoB,QAA2B;GACnD,IAAM,IAAQ,EAAa,SAAS,EAAE;GACtC,OAAO,IAAQ,EAAsB,CAAK,IAAI,QAAQ,QAAQ;EAChE,CAAC,GAGK,IAAc,EAAS,OAAO,MAAU;GAE5C,IAAM,IAAoB,EAAM;GAEhC,IAAI,EAAuB,IAAI,CAAS,GAAG;IACzC,IAAM,IAAmB,GAAqB,EAAM,OAAO,GACrD,EAAE,0BAAuB,EAAa,SAAS;IAGrD,IACE,KACA,KACA,MAAqB,GAErB;IAMF,EAAgB;IAChB;GACF;GAEA,AAAI,EAAyB,IAAI,CAAS,KACxC,EAAkB;EAEtB,CAAC;EAED,aAAa;GAEX,AADA,IAAY,IACZ,EAAY;EACd;CACF,GAAG;EAAC;EAAU;EAAe;CAAqB,CAAC,GAkB5C;EACL;EACA;EACA;EAEA;EACA;EACA;EAEA,qBArB0B,EAAc,MACvC,MAAQ,EAAI,OAAO,CAoBpB;EACA,kBAnBuB,EAAW,MACjC,MAAO,EAAG,OAAO,CAkBlB;EACA,gBAjBqB,EAAS,MAAM,MAAS,EAAK,OAAO,CAiBzD;EAEA;EAEA;EACA;EACA;EACA,WACE,KAA0B,KAAuB;EAEnD;EAEA;EACA;EACA;EACA;EAEA;EACA;EACA;EACA,qBAAA;CACF;AACF;AAkBA,SAAgB,EACd,GACA;CACA,IAAM,IAAwB,GAC3B,MAAU,EAAM,qBACnB,GACM,IAAa,GAAc,MAAU,EAAM,UAAU,GACrD,IAAc,GAAc,MAAU,EAAM,WAAW,GACvD,IAAsB,GACzB,MAAU,EAAM,mBACnB,GACM,IAAmB,EAAuB,GAC1C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IAAuB,GAAS,wBAAwB;CAE9D,QAAgB;EAGd,IAFI,KAEA,CAAC,KAAyB,CAAC,KAAe,GAAqB;EAGnE,IAAM,IAAwB,EAAW,MACtC,MAAO,EAAG,mBAAmB,CAChC;EAIA,IAAI,EAAW,SAAS,KAAK,CAAC,GAAuB;GACnD,IAAM,IAAQ,EAAa,SAAS;GAIpC,AAHA,EAAM,qBAAqB,EAAI,GAG/B,EAAsC;IACpC,SAAS;IACT,OAAO;IACP,WAAW;IACX,SAAS;GACX,CAAC,EACE,MAAM,MAAW;IAQhB,IALI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,CAC9B,IAEE,CAAC,EAAO,QAAQ,QAAQ;KAK1B,IAAM,KAJqB,EAAO,MAAM,YAAY,SAAS,CAAC,GAI7C,QACd,MAAM,EAAE,mBAAmB,CAC9B;KACA,EAAM,cAAc,CAAE;IACxB;GACF,CAAC,EACA,YAAY,CAEb,CAAC,EACA,cAAc;IACb,EAAM,qBAAqB,EAAK;GAClC,CAAC;EACL;CACF,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH;AAoBA,SAAgB,EAAqB,GAAyC;CAC5E,IAAM,IAAqB,GAAc,MAAU,EAAM,kBAAkB,GACrE,IAAwB,GAC3B,MAAU,EAAM,qBACnB,GACM,IAAa,GAAc,MAAU,EAAM,UAAU,GACrD,IAAW,GAAc,MAAU,EAAM,QAAQ,GACjD,IAAmB,GAAc,MAAU,EAAM,gBAAgB,GACjE,IAAiB,GAAc,MAAU,EAAM,cAAc,GAC7D,IAAc,GAAc,MAAU,EAAM,WAAW,GACvD,IAAmB,EAAuB,GAC1C,IACJ,GAAS,oBAAoB,EAAiB,kBAC1C,IAAqB,GAAS,sBAAsB,IACpD,IAAmB,GAAS,oBAAoB,IAOhD,IAAoB,EAAO,EAAK,GAChC,CAAC,GAAc,MAAmB,EAAS,CAAC,GAC5C,IAAyB,EAGrB,IAAI,GAIR,IAAgB,kBACpB,IAAI,IAAI,CACV,GAUM,IAAyB,kBAE7B,IAAI,IAAI,CAAC,GAEL,IAAmC;CA2SzC,AA1SA,QAAgB;EAMd,IALI,KAEA,CAAC,KAAsB,CAAC,KAGxB,EAAkB,SAAS;EAO/B,IAAM,IAAe,EAAuB,QAAQ,IAAI,CAAkB;EAC1E,IACE,KACA,EAAa,SAAS,KACtB,KAAK,IAAI,IAAI,EAAa,gBAAgB,GAE1C;EAEF,AACE,KACA,KAAK,IAAI,IAAI,EAAa,iBACxB,KAGF,EAAuB,QAAQ,OAAO,CAAkB;EAQ1D,IAAM,IAAmB,EAAW,MACjC,MAAO,EAAG,OAAO,CACpB;EAGA,IACE,KACA,KACA,EAAiB,mBAAmB,GAEpC;EAGF,IAAM,IACJ,GAAkB,kBAAkB;EACtC,IAAI,CAAC,GAAgB;EAErB,IAAM,IAAQ,EAAa,SAAS;EACpC,AACE,KACA,EAAY,SAAS,MAAM,KAC3B,EAAY,WAAW,MAAM,KAC7B,EAAY,KAAK,MAAM,KAEvB,EAA4B;GAC1B;GACA,aAAa;EACf,CAAC;EAEH,IAAM,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM,IACrB,IAAgB,EAAyB;GAC7C;GACA,aAAa;EACf,CAAC;EACD,IAAI,KAAiB,EAAM,kBAAkB;GAE3C,AADA,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI;GAC5B;EACF;EAGA,IAAM,IACJ,CAAC,KACD,EAAe,CAAc,KAC7B,CAAC,EAAgC,GAAgB;GAC/C,aAAa;GACb,gBAAgB;GAChB,WAAW;GACX;EACF,CAAC,GAGG,IAAW,KAAK,UAAU;GAC9B;GACA;GACA;GACA;GACA;EACF,CAAC,GACK,IACJ,EAAS,MAAM,MAAM,EAAE,gBAAgB,CAAkB,KACxD,EAAuB,SAAS,aAAa,KAC5C,EAAuB,QAAQ,aAAa;EAChD,IAAI,KAA2B,CAAC,GAAY;GAC1C,IAAI,CAAC,EAAM,oBAAoB,CAAC,GAAe;IAC7C,IAAM,IAAe,EAAS,MAC3B,MAAY,EAAQ,gBAAgB,CACvC;IACA,AAAI,KACF,EAAM,oBAAoB,EAAa,EAAE;GAE7C;GACA;EACF;EAEA,IAAM,UAA4B;GAChC,IAAM,IAAS,EAAa,SAAS;GACrC,OACE,EAAO,gBAAgB,KACvB,EAAO,MAAM,OAAO,KACpB,EAAuB,MAAM,KAC7B,EAAO,0BAA0B,KACjC,EAAO,uBAAuB,KAC9B,EAAO,qBAAqB,KAC5B,EAAyB;IACvB;IACA,aAAa;GACf,CAAC,MAAM;EAEX,GAEM,IAAe,YAAY;GAE/B,AADA,EAAkB,UAAU,IAC5B,EAAM,mBAAmB,EAAI;GAC7B,IAAI,IAAY;GAEhB,IAAI;IACF,IAAI,IAAU;IAGd,IAAI,GAAY;KACd,IAAM,IAAc,MAAM,EAEvB;MACD,SAAS;MACT,OAAO;MACP,WAAW,EACT,OAAO;OACL;OACA,aAAa;OACb,GAAI,IAAmB,EAAE,WAAW,EAAiB,IAAI,CAAC;MAC5D,EACF;MACA,WAAW;MACX,SAAS;MAGT,UAAU,EAAW,MAAM,MAAO,EAAG,OAAO,CAAkB,GAC1D;KACN,CAAC;KAED,IACE,EAAY,MAAM,qBAAqB,WACvC,EAAY,KAAK,oBAAoB,OACrC;MAEA,IADA,IAAU,EAAY,KAAK,oBAAoB,OAE7C,CAAC,EAAoB,KACrB,CAAC,EAAgC,GAAS;OACxC,aAAa;OACb;OACA,WAAW;OACX;MACF,CAAC,GAED;MACF,EAAM,kBAAkB,CAAO;KACjC,OACE;IAEJ;IAGA,IAAI,KAAW,CAAC,KAA2B,CAAC,GAAkB;KAC5D,IAAM,IAAiB,MAAM,EAA+B;MAC1D,SAAS;MACT,OAAO;MACP,WAAW;MACX,gBAAgB;MAChB,SAAS;KACX,CAAC;KAED,IAAI,CAAC,EAAoB,KAAK,EAAe,QAAQ,QACnD;KAGF,IAAM,IAAmB,EAAe,MAAM,UAAU,SAAS,CAAC;KAmBlE,AAfA,EAAuB,UACrB,EAAM,WAAW,IAAI;MAAE;MAAU,UAAU;KAAM,IAAI,MACvD,EAAM,YAAY,CAAK,GAKrB,KACA,CAAC,EAAM,MAAM,MAAY,EAAQ,OAAO,CAAgB,MAExD,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,IAK5B,EAAM,SAAS,KACf,CAAC,EAAa,SAAS,EAAE,oBACzB,CAAC,EAAyB;MACxB;MACA,aAAa;KACf,CAAC,KAED,EAAM,oBAAoB,EAAM,GAAG,EAAE;IAEzC;IAEA,IAAY;GACd,QAAQ,CAER,UAAU;IAER,AADA,EAAM,mBAAmB,EAAK,GAC9B,EAAkB,UAAU;IAC5B,IAAM,IAAe,EAAoB;IACzC,AAAK,KAAc,IAAiB,MAAa,IAAW,CAAC;IAC7D,IAAM,IAAW,EAAuB;IACxC,IAAI,KAAgB,GAAW;KAC7B,EAAS,OAAO,CAAkB;KAClC,IAAM,IAAU,EAAc,QAAQ,IAAI,CAAkB;KAC5D,AAAI,MACF,aAAa,CAAO,GACpB,EAAc,QAAQ,OAAO,CAAkB;IAEnD,OAAO,IAAI,GAAc;KAEvB,IAAM,KADW,EAAS,IAAI,CACX,GAAU,SAAS,KAAK;KAU3C,IATA,EAAS,IAAI,GAAoB;MAC/B,OAAO;MACP,eAAe,KAAK,IAAI;KAC1B,CAAC,GAMG,IAAY,GAA2B;MACzC,IAAM,IAAgB,EAAc,QAAQ,IAAI,CAAkB;MAClE,AAAI,KAAe,aAAa,CAAa;MAC7C,IAAM,IAAY,KAAK,IAAI,MAAO,MAAM,IAAY,IAAI,GAAI,GACtD,IAAQ,iBAAiB;OAC7B,EAAc,QAAQ,OAAO,CAAkB;OAG/C,IAAM,IAAS,EAAa,SAAS;OACrC,AACE,EAAoB,KACpB,EAAO,uBAAuB,KAC9B,CAAC,EAAO,SAAS,MACd,MAAM,EAAE,gBAAgB,CAC3B,KACA,CAAC,EAAkB,WAMnB,EAAkB;MAEtB,GAAG,CAAS;MACZ,EAAc,QAAQ,IAAI,GAAoB,CAAK;KACrD;IACF;GACF;EACF;EAEA,EAAa;CACf,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,GAID,QAAgB;EACd,IAAM,IAAS,EAAc;EAC7B,aAAa;GAEX,AADA,EAAO,SAAS,MAAU,aAAa,CAAK,CAAC,GAC7C,EAAO,MAAM;EACf;CACF,GAAG,CAAC,CAAC;AACP"}
1
+ {"version":3,"file":"useContextSwitcherData.js","names":[],"sources":["../../../src/auth/hooks/useContextSwitcherData.ts"],"sourcesContent":["import {\n isWorkspaceWideSelection,\n selectWorkspaceWide as persistWorkspaceWideSelection,\n clearWorkspaceWideSelection,\n} from \"@burdenoff/fe-libs/shared/providers/shell/WorkspaceWideSelection\";\nimport { resolveActiveProfileId } from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { getUrlParam } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextStorage\";\nimport { useCallback, useState, useEffect, useRef } from \"react\";\nimport {\n graphqlFetch,\n getStoredAuthToken,\n} from \"@burdenoff/fe-libs/shared/graphql\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { Organization, Workspace, Project } from \"../types\";\nimport { resolveGatewayBaseUrls } from \"../utils/gatewayBaseUrls\";\n\n// =============================================================================\n// Hook Options\n// =============================================================================\n\nexport interface UseContextSwitcherDataOptions {\n /**\n * Optional Global API Gateway base URL override.\n * If not provided, uses GATEWAYS config from fe-libs.\n */\n globalBaseUrl?: string;\n /**\n * Optional Workspaces API Gateway base URL override.\n * If not provided, uses GATEWAYS config from fe-libs.\n */\n workspaceBaseUrl?: string;\n /** Disable initial organization/workspace bootstrap fetches */\n disableBootstrap?: boolean;\n /** Disable the workspace sync effect */\n disableWorkspaceSync?: boolean;\n /** Disable the project sync effect */\n disableProjectSync?: boolean;\n /** Only hydrate the workspace token; do not eagerly fetch projects */\n skipProjectFetch?: boolean;\n}\n\n// =============================================================================\n// GraphQL Response Types\n// =============================================================================\n\ninterface MyOrganizationsResponse {\n myOrganizations: {\n total: number;\n items: Organization[];\n };\n}\n\ninterface WorkspacesByOrgResponse {\n workspaces: {\n total: number;\n items: Workspace[];\n };\n}\n\ntype GraphQLFetchResult<T> = Awaited<ReturnType<typeof graphqlFetch<T>>>;\n\ninterface IssueWorkspaceTokenResult {\n success: boolean;\n token: string | null;\n expiresAt: string | null;\n organizationId: string | null;\n workspaceId: string | null;\n projectId: string | null;\n scopes: string[] | null;\n error: {\n code: string;\n message: string;\n } | null;\n}\n\ninterface ProjectsResponse {\n projects: {\n total: number;\n items: Project[];\n };\n}\n\n// =============================================================================\n// GraphQL Query/Mutation Strings\n// =============================================================================\n\nconst MY_ORGANIZATIONS_QUERY = `\n query MyOrganizations {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n }\n`;\n\n// Both queries below historically used `workspaces(filter: $filter)` with\n// a `WorkspaceFilterInput` to fetch workspaces for a specific organization.\n// That Query field was removed/renamed in the global subgraph; calling it\n// now throws GRAPHQL_VALIDATION_FAILED (\"Cannot query field 'workspaces'\n// on type 'Query'\") which crashes the context switcher and cascades into a\n// \"Verifying workspace access...\" stuck-spinner on every Platform module\n// route (/billing, /support, /notifications, /devportal).\n//\n// The supported field is `myWorkspaces(limit, offset)` on the global\n// subgraph — self-scoped, returns the caller's workspaces across all\n// orgs. It does NOT accept a filter, so we fetch up to 100 of \"my\"\n// workspaces and let the existing downstream auto-pick logic filter by\n// organizationId client-side. The recovery path at line ~624 already\n// uses this exact aliased pattern; we're just promoting it to the\n// primary path.\nconst WORKSPACES_BY_ORG_QUERY = `\n query WorkspacesByOrg {\n workspaces: myWorkspaces(limit: 100) {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n`;\n\nconst ISSUE_WORKSPACE_TOKEN_MUTATION = `\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success\n token\n expiresAt\n organizationId\n workspaceId\n projectId\n scopes\n error {\n code\n message\n }\n }\n }\n`;\n\n// The workspace gateway exposes `myProjects` (public RBAC, caller-scoped to\n// the active workspace via x-workspace-id) and the privileged\n// `projects(filter)` (list:project). The header has no `list:project`\n// permission seeded for the typical operator, so the privileged form\n// returns FORBIDDEN even though the caller is a member of the workspace.\n// `myProjects` is the right field for \"give me the projects I can see in\n// this workspace\" — workspace scope is already established by the\n// workspace token + x-workspace-id header that we pass with the request.\nconst PROJECTS_QUERY = `\n query MyProjectsForContext {\n projects: myProjects {\n total\n items {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n }\n`;\n\n// =============================================================================\n// Auth Helpers\n// =============================================================================\n\n/**\n * Check whether a JWT is expired (or within bufferMs of expiry).\n * Returns true if the token is expired, close to expiry, or malformed.\n */\nfunction isTokenExpired(token: string, bufferMs = 30_000): boolean {\n try {\n const payload = JSON.parse(atob(token.split(\".\")[1]));\n if (!payload.exp) return false;\n return payload.exp * 1000 < Date.now() + bufferMs;\n } catch {\n return true;\n }\n}\n\nfunction getWorkspaceTokenPayload(token: string): {\n workspaceId?: string;\n organizationId?: string;\n projectId?: string;\n exp?: number;\n} | null {\n try {\n const payload = JSON.parse(atob(token.split(\".\")[1]));\n return {\n workspaceId:\n typeof payload.workspaceId === \"string\"\n ? payload.workspaceId\n : undefined,\n organizationId:\n typeof payload.organizationId === \"string\"\n ? payload.organizationId\n : undefined,\n projectId:\n typeof payload.projectId === \"string\" ? payload.projectId : undefined,\n exp: typeof payload.exp === \"number\" ? payload.exp : undefined,\n };\n } catch {\n return null;\n }\n}\n\nfunction isWorkspaceTokenValidForContext(\n token: string | null | undefined,\n expected: {\n workspaceId?: string | null;\n organizationId?: string | null;\n projectId?: string | null;\n workspaceWide?: boolean;\n },\n): token is string {\n if (!token || isTokenExpired(token)) {\n return false;\n }\n\n const payload = getWorkspaceTokenPayload(token);\n if (!payload) {\n return false;\n }\n\n if (expected.workspaceId && payload.workspaceId !== expected.workspaceId) {\n return false;\n }\n\n if (\n expected.organizationId &&\n payload.organizationId !== expected.organizationId\n ) {\n return false;\n }\n\n if (expected.workspaceWide && payload.projectId) return false;\n\n if (expected.projectId && payload.projectId !== expected.projectId) {\n return false;\n }\n\n return true;\n}\n\n/**\n * Custom error class for auth-related failures (expired token, unauthorized, etc.).\n * Used to distinguish auth errors in outer catch blocks so they can be\n * suppressed from console.error — they are expected during token refresh cycles\n * and do not indicate application bugs.\n */\nclass AuthError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"AuthError\";\n }\n}\n\n/**\n * Detect whether a set of GraphQL errors are authentication-related.\n */\nfunction isAuthGraphQLError(\n errors: Array<{ message?: string; extensions?: { code?: string } }>,\n): boolean {\n return errors.some(\n (e) =>\n e.extensions?.code === \"UNAUTHENTICATED\" ||\n e.message?.toLowerCase().includes(\"unauthorized\") ||\n e.message?.toLowerCase().includes(\"not authenticated\"),\n );\n}\n\n/**\n * Resolve the best available access token:\n * 1. Try the zustand store token\n * 2. If expired, fall back to profile storage (may have been refreshed)\n * 3. Return null if no valid token is available\n */\nfunction resolveAccessToken(): string | null {\n const storeToken = useAuthStore.getState().accessToken;\n\n // If store token is valid (or has no exp claim), use it\n if (storeToken && !isTokenExpired(storeToken)) {\n return storeToken;\n }\n\n // Store token is expired or missing — try profile storage (may be fresher)\n const profileToken = getStoredAuthToken();\n if (profileToken && !isTokenExpired(profileToken)) {\n return profileToken;\n }\n\n // Both expired or missing — if store token exists at all, return it as a last\n // resort (the gateway will reject it and the useEffect will re-trigger after\n // token refresh). Returning null would silently swallow the first load.\n return storeToken;\n}\n\nfunction buildFallbackOrganizations(workspaces: Workspace[]): Organization[] {\n const uniqueOrgIds = Array.from(\n new Set(\n workspaces.flatMap((workspace) =>\n workspace.organizationId ? [workspace.organizationId] : [],\n ),\n ),\n );\n\n return uniqueOrgIds.map((organizationId, index) => ({\n id: organizationId,\n name:\n workspaces.find(\n (workspace) => workspace.organizationId === organizationId,\n )?.name || `Organization ${index + 1}`,\n slug: organizationId,\n tenantId:\n workspaces.find(\n (workspace) => workspace.organizationId === organizationId,\n )?.tenantId || \"\",\n }));\n}\n\n// =============================================================================\n// Hook Implementation\n// =============================================================================\n\n/**\n * Hook for managing the context switcher data (organizations, workspaces, projects)\n *\n * Data flow:\n * 1. fetchOrganizations() - Get all orgs user has access to (Global Gateway)\n * 2. selectOrganization(org) - Set current org & fetch workspaces for that org\n * 3. selectWorkspace(ws) - Issue workspace token & fetch projects\n * 4. selectProject(proj) - Set current project\n *\n * All GraphQL calls go through graphqlFetch from fe-libs which automatically\n * resolves gateway URLs and injects auth + locale headers.\n *\n * @param options - Optional configuration (gateway base URL overrides)\n */\n// Domain events emitted by microfe-workspaces that should refresh the switcher's\n// cached lists. Module-scoped so they aren't reallocated on every effect run.\nconst PROJECT_REFRESH_EVENTS = new Set<string>([\n \"project.created\",\n \"project.updated\",\n \"project.deleted\",\n \"project.archived\",\n \"project.unarchived\",\n]);\nconst WORKSPACE_REFRESH_EVENTS = new Set<string>([\n \"workspace.created\",\n \"workspace.updated\",\n \"workspace.deleted\",\n \"workspace.archived\",\n \"workspace.reactivated\",\n]);\n\n// Safely read a string `workspaceId` off a cross-MFE event payload of unknown\n// shape, rather than trusting a bare cast (the payload is produced by another\n// MFE and could drift). Returns undefined when absent or not a string.\nfunction readEventWorkspaceId(payload: unknown): string | undefined {\n if (payload && typeof payload === \"object\" && \"workspaceId\" in payload) {\n const value = (payload as { workspaceId?: unknown }).workspaceId;\n return typeof value === \"string\" ? value : undefined;\n }\n return undefined;\n}\n\nexport function useContextSwitcherData(\n options?: UseContextSwitcherDataOptions,\n) {\n const {\n organizationId: activeOrganizationId,\n workspaceId: activeWorkspaceId,\n projectId: activeProjectId,\n tenantId: activeTenantId,\n setContext: setActiveContext,\n } = useActiveContext();\n\n const eventBus = useEventBus();\n\n // Use selectors for reactive state\n const organizations = useAuthStore((state) => state.organizations);\n const currentOrganizationId = useAuthStore(\n (state) => state.currentOrganizationId,\n );\n const isLoadingOrganizations = useAuthStore(\n (state) => state.isLoadingOrganizations,\n );\n\n const workspaces = useAuthStore((state) => state.workspaces);\n const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n const workspaceToken = useAuthStore((state) => state.workspaceToken);\n const isLoadingWorkspaces = useAuthStore(\n (state) => state.isLoadingWorkspaces,\n );\n\n const projects = useAuthStore((state) => state.projects);\n const currentProjectId = useAuthStore((state) => state.currentProjectId);\n const isLoadingProjects = useAuthStore((state) => state.isLoadingProjects);\n\n // Restored workspaces can already be present in the profile store, so the\n // first-workspace bootstrap branch is not sufficient to hydrate tenant.\n // Resolve it from the selected accessible rows, never from a placeholder,\n // URL tenant value or a workspace belonging to another organization.\n useEffect(() => {\n const workspace = workspaces.find(\n (row) =>\n row.id === activeWorkspaceId &&\n row.organizationId === activeOrganizationId,\n );\n const organization = organizations.find(\n (row) => row.id === activeOrganizationId,\n );\n if (\n !workspace ||\n !organization ||\n !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(\n workspace.tenantId,\n ) ||\n workspace.tenantId !== organization.tenantId ||\n activeTenantId === workspace.tenantId\n ) {\n return;\n }\n // Updating only tenant preserves the selected project, including an\n // explicit workspace-wide (null-project) selection.\n setActiveContext({ tenantId: workspace.tenantId });\n }, [\n activeOrganizationId,\n activeWorkspaceId,\n activeTenantId,\n organizations,\n workspaces,\n setActiveContext,\n ]);\n\n // Local error state\n const [error, setError] = useState<string | null>(null);\n\n // Bootstrap-retry signal: incremented on every TRANSIENT bootstrap failure\n // (orgs fetch, stale-context recovery, or the inner workspace bootstrap).\n // A monotonically increasing nonce — rather than the `error` string — keys\n // the retry effect, because two consecutive failures with the identical\n // message would not re-trigger a string-keyed effect and the retry chain\n // would silently stop after one attempt.\n const [bootstrapFailureNonce, setBootstrapFailureNonce] = useState(0);\n const bootstrapRetryAttemptRef = useRef(0);\n\n // Deduplication refs to prevent duplicate GraphQL calls\n const fetchOrganizationsPromiseRef = useRef<Promise<Organization[]> | null>(\n null,\n );\n const fetchWorkspacesPromisesRef = useRef<Map<string, Promise<Workspace[]>>>(\n new Map(),\n );\n\n // Stable refs for latest context values — avoids stale closures in callbacks\n // without adding them to useCallback dep arrays (which would recreate callbacks\n // on every context change and trigger spurious fetch re-runs).\n const activeWorkspaceIdRef = useRef(activeWorkspaceId);\n const activeOrganizationIdRef = useRef(activeOrganizationId);\n useEffect(() => {\n activeWorkspaceIdRef.current = activeWorkspaceId;\n activeOrganizationIdRef.current = activeOrganizationId;\n });\n\n const resolvedBaseUrls = resolveGatewayBaseUrls();\n const globalBaseUrl =\n options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n const workspaceBaseUrl =\n options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n\n // Refs to break feedback loops with the Header's \"store → URL\" sync effect.\n // Without these the pair can ping-pong: this effect writes (URL → store),\n // Header writes (store → URL), Zustand re-fires our subscribers, and React\n // hits \"Maximum update depth exceeded\" — especially when a downstream call\n // (workspace token issuance) returns 504 and leaves the two halves in\n // disagreement. The refs record the last value we pushed for each axis;\n // identical pushes are skipped so the loop has a hard floor.\n const lastAppliedOrgIdRef = useRef<string | null>(null);\n const lastAppliedWorkspaceIdRef = useRef<string | null>(null);\n const lastAppliedProjectIdRef = useRef<string | null>(null);\n const lastClearedTokenContextRef = useRef<string | null>(null);\n\n useEffect(() => {\n const store = useAuthStore.getState();\n\n if (\n activeOrganizationId &&\n activeOrganizationId !== store.currentOrganizationId &&\n activeOrganizationId !== lastAppliedOrgIdRef.current\n ) {\n lastAppliedOrgIdRef.current = activeOrganizationId;\n store.setCurrentOrganizationId(activeOrganizationId);\n if (\n store.workspaces.length > 0 &&\n !store.workspaces.some(\n (workspace) => workspace.organizationId === activeOrganizationId,\n )\n ) {\n store.setWorkspaces([]);\n }\n }\n\n if (\n activeWorkspaceId &&\n activeWorkspaceId !== store.currentWorkspaceId &&\n activeWorkspaceId !== lastAppliedWorkspaceIdRef.current\n ) {\n lastAppliedWorkspaceIdRef.current = activeWorkspaceId;\n store.setCurrentWorkspaceId(activeWorkspaceId);\n if (\n store.projects.length > 0 &&\n !store.projects.some(\n (project) => project.workspaceId === activeWorkspaceId,\n )\n ) {\n store.setProjects([]);\n store.setCurrentProjectId(null);\n }\n }\n\n if (\n isWorkspaceWideSelection({\n organizationId: activeOrganizationId,\n workspaceId: activeWorkspaceId,\n }) &&\n !activeProjectId &&\n store.currentProjectId\n ) {\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n }\n\n if (\n activeProjectId &&\n activeProjectId !== store.currentProjectId &&\n activeProjectId !== lastAppliedProjectIdRef.current\n ) {\n lastAppliedProjectIdRef.current = activeProjectId;\n store.setCurrentProjectId(activeProjectId);\n }\n\n if (\n store.workspaceToken &&\n !isWorkspaceTokenValidForContext(store.workspaceToken, {\n workspaceId: activeWorkspaceId,\n organizationId: activeOrganizationId,\n projectId: activeProjectId,\n workspaceWide:\n !activeProjectId &&\n isWorkspaceWideSelection({\n organizationId: activeOrganizationId,\n workspaceId: activeWorkspaceId,\n }),\n })\n ) {\n // Clear-token-once-per-context guard: when the upstream gateway is\n // flaky (504s during workspace token issuance) the surrounding state\n // machine can oscillate between \"got token but invalid\" and \"clearing\n // token\". The downstream re-issue path then loops. Only clear once per\n // (org, ws, proj) tuple — a successful re-issue resets the ref via\n // setWorkspaceToken landing a new token for the same context.\n const ctxKey = `${activeOrganizationId ?? \"\"}|${activeWorkspaceId ?? \"\"}|${activeProjectId ?? \"\"}`;\n if (lastClearedTokenContextRef.current !== ctxKey) {\n lastClearedTokenContextRef.current = ctxKey;\n store.setWorkspaceToken(null);\n }\n }\n }, [activeOrganizationId, activeWorkspaceId, activeProjectId]);\n\n // ===========================================================================\n // Fetch Organizations (Global Gateway)\n // ===========================================================================\n\n const fetchOrganizations = useCallback(async (): Promise<Organization[]> => {\n // Deduplicate: if a fetch is already in progress, return the same promise\n if (fetchOrganizationsPromiseRef.current) {\n return fetchOrganizationsPromiseRef.current;\n }\n\n const store = useAuthStore.getState();\n const token = resolveAccessToken();\n\n if (!token) {\n // Not an error — user may not be authenticated yet (e.g., page load before login).\n // The useEffect in Header.tsx will re-trigger when accessToken becomes available.\n return [];\n }\n\n // NOTE: an EXPIRED token is deliberately NOT a bail-out. fe-libs\n // graphqlFetch now transparently refreshes on UNAUTHENTICATED and retries\n // the request once, and a definitive refresh failure triggers the shell's\n // forced logout (SESSION_EXPIRED_EVENT). The previous `isTokenExpired →\n // return []` short-circuit was the root cause of the persistently empty\n // context switcher: the expired token survives reloads in profile storage,\n // so every bootstrap silently produced [] — indistinguishable from \"you\n // have no organizations\" — until the user manually logged out.\n\n store.setLoadingOrganizations(true);\n setError(null);\n\n // Store the promise for deduplication before starting\n fetchOrganizationsPromiseRef.current = (async () => {\n try {\n const initialTargetOrgId =\n activeOrganizationIdRef.current ?? store.currentOrganizationId;\n let result: GraphQLFetchResult<\n MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n > = initialTargetOrgId\n ? await (async () => {\n const [organizationsResult, workspacesResult] = await Promise.all(\n [\n graphqlFetch<MyOrganizationsResponse>({\n gateway: \"global\",\n query: MY_ORGANIZATIONS_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n }),\n graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n }),\n ],\n );\n\n const data = organizationsResult.data?.myOrganizations\n ? {\n myOrganizations: organizationsResult.data.myOrganizations,\n ...(workspacesResult.data?.workspaces\n ? { workspaces: workspacesResult.data.workspaces }\n : {}),\n }\n : null;\n\n return {\n data,\n errors: [\n ...(organizationsResult.errors ?? []),\n ...(workspacesResult.errors ?? []),\n ],\n };\n })()\n : await graphqlFetch<MyOrganizationsResponse>({\n gateway: \"global\",\n query: MY_ORGANIZATIONS_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n\n // Self-heal stale-URL case: if the workspace side of the bootstrap\n // fails because the URL points at an inaccessible org/workspace, retry\n // with the organization-only query so the operator sees their actual\n // orgs and the URL params get corrected on next render.\n if (\n initialTargetOrgId &&\n result.errors?.length &&\n result.errors.some(\n (e) =>\n e?.extensions?.code === \"FORBIDDEN\" ||\n /not a member of this organization/i.test(e?.message ?? \"\") ||\n // Public gateway often drops the underlying FORBIDDEN error\n // and replaces it with the schema-level non-null violation\n // (\"Cannot return null for non-nullable field Query.myOrganizations\").\n // That happens when ANY field in the query throws — workspaces\n // here — and data:null cascades up. Treat that pattern as a\n // signal to retry without the workspaces filter.\n /Cannot return null for non-nullable field Query\\.myOrganizations/i.test(\n e?.message ?? \"\",\n ),\n )\n ) {\n // Fetch myOrganizations + ALL workspaces (no filter) so the\n // downstream auto-pick logic still has a workspace list to seed\n // context from. If we only refetched myOrganizations, the page\n // would render but every workspace-scoped query would fail with\n // \"Select a workspace…\".\n result = await graphqlFetch<\n MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n >({\n gateway: \"global\",\n query: `\n query ContextSwitcherRecover {\n myOrganizations {\n total\n items { id name slug tenantId description logo website status type createdAt updatedAt }\n }\n workspaces: myWorkspaces {\n total\n items { id name slug tenantId organizationId type status region createdAt updatedAt }\n }\n }\n `,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n }\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (isAuthGraphQLError(result.errors)) {\n // Auth errors are expected during token refresh cycles — throw AuthError\n // so the outer catch can suppress console.error.\n throw new AuthError(errorMessage);\n }\n if (store.workspaces.length === 0) {\n console.error(\"Failed to fetch organizations:\", result.errors);\n }\n throw new Error(errorMessage);\n }\n\n let orgs: Organization[] = result.data?.myOrganizations?.items ?? [];\n\n // Stale-context recovery: bootstrap query was filtered by\n // initialTargetOrgId, so when the URL/persisted org doesn't belong to\n // this user the response is empty. Re-fetch the unfiltered list of\n // *all* orgs the user can access so the guard below can pick a real\n // default. Skip the recovery when no target was set (already\n // unfiltered) or when workspaces are already in the store (the\n // existing fallback path covers that case).\n if (\n initialTargetOrgId &&\n orgs.length === 0 &&\n store.workspaces.length === 0\n ) {\n const recovery = await graphqlFetch<MyOrganizationsResponse>({\n gateway: \"global\",\n query: MY_ORGANIZATIONS_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n if (!recovery.errors?.length) {\n orgs = recovery.data?.myOrganizations?.items ?? [];\n // discard the filtered workspaces payload — it was for the\n // ghost org and would only mislead the workspace selector below.\n result = {\n ...recovery,\n data: {\n myOrganizations: recovery.data?.myOrganizations ?? {\n items: [],\n total: 0,\n },\n },\n };\n } else {\n // The filtered bootstrap returned nothing AND the unfiltered\n // recovery failed — we genuinely do not know the user's org list.\n // Treat it as the failure it is (retryable via the bootstrap-retry\n // effect) instead of falling through to setOrganizations([]),\n // which presented a transient backend error as \"you have no\n // organizations\" until re-login.\n console.warn(\n \"[ContextSwitcher] Stale-context recovery failed:\",\n recovery.errors,\n );\n const recoveryMessage =\n recovery.errors?.[0]?.message ?? \"Failed to fetch organizations\";\n if (isAuthGraphQLError(recovery.errors ?? [])) {\n throw new AuthError(recoveryMessage);\n }\n throw new Error(recoveryMessage);\n }\n }\n\n const fallbackOrganizations =\n orgs.length === 0 && store.workspaces.length > 0\n ? buildFallbackOrganizations(store.workspaces)\n : [];\n const effectiveOrganizations =\n fallbackOrganizations.length > 0 ? fallbackOrganizations : orgs;\n\n store.setOrganizations(effectiveOrganizations);\n\n // Determine which organization to use for workspace fetching\n let targetOrgId = initialTargetOrgId;\n\n // Stale-context guard: if the persisted/URL org isn't in the user's\n // accessible orgs, fall back to the first available one and clear the\n // stale workspace/project so they get re-derived. Without this, URL\n // params like ?org=<ghost-id> from a prior session leak into the new\n // user's request headers and cause \"Authentication required\" /\n // \"not a member\" errors at every subgraph.\n //\n // Check against `orgs` (freshly returned from the API in this same\n // closure) rather than `effectiveOrganizations`, which can fall back\n // to ids derived from `store.workspaces` — that fallback path could\n // contain stale ghost orgIds and mask the guard.\n const targetOrgIsAccessible =\n targetOrgId && orgs.some((org) => org.id === targetOrgId);\n if (targetOrgId && !targetOrgIsAccessible && orgs.length > 0) {\n targetOrgId = orgs[0].id;\n setActiveContext({\n organizationId: targetOrgId,\n workspaceId: null,\n tenantId: null,\n projectId: null,\n });\n store.setWorkspaces([]);\n store.setProjects([]);\n store.setCurrentWorkspaceId(null);\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n }\n\n if (targetOrgId && targetOrgId !== store.currentOrganizationId) {\n store.setCurrentOrganizationId(targetOrgId);\n }\n\n // Auto-select first organization if none is selected\n if (effectiveOrganizations.length > 0 && !targetOrgId) {\n store.setCurrentOrganizationId(effectiveOrganizations[0].id);\n targetOrgId = effectiveOrganizations[0].id;\n }\n\n // Fetch workspaces for the selected/auto-selected org if:\n // 1. We have a target org (either auto-selected or persisted from localStorage)\n // 2. AND workspaces array is empty (not persisted, or cleared)\n // This handles both initial login AND page refresh scenarios.\n // Read from useAuthStore.getState() rather than the captured `store`\n // snapshot so we see the post-guard cleared value when the org guard\n // above fired (the local `store.workspaces` ref is stale after\n // setWorkspaces([])).\n if (targetOrgId && useAuthStore.getState().workspaces.length === 0) {\n store.setLoadingWorkspaces(true);\n try {\n // myWorkspaces returns ALL workspaces the user is a member of\n // across every org. Filter to the target org client-side here.\n const bootstrappedWorkspaces =\n initialTargetOrgId === targetOrgId\n ? result.data?.workspaces?.items?.filter(\n (w) => w.organizationId === targetOrgId,\n )\n : undefined;\n const ws = bootstrappedWorkspaces\n ? (bootstrappedWorkspaces as Workspace[])\n : await graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n }).then((wsResult) =>\n wsResult.errors?.length\n ? null\n : (wsResult.data?.workspaces?.items ?? []).filter(\n (w) => w.organizationId === targetOrgId,\n ),\n );\n\n if (!ws) {\n // Workspace bootstrap failed (errored result) while orgs\n // succeeded — retryable, otherwise the org renders with no\n // workspaces until manual interaction.\n setBootstrapFailureNonce((n) => n + 1);\n }\n if (ws) {\n store.setWorkspaces(ws);\n const persistedWorkspace = activeWorkspaceIdRef.current\n ? ws.find(\n (workspace) =>\n workspace.id === activeWorkspaceIdRef.current,\n )\n : null;\n\n if (persistedWorkspace) {\n store.setCurrentWorkspaceId(persistedWorkspace.id);\n } else if (ws.length > 0) {\n const nextActiveContext = {\n organizationId: targetOrgId,\n workspaceId: ws[0].id,\n tenantId: ws[0].tenantId,\n projectId: null,\n };\n\n if (activeWorkspaceIdRef.current) {\n // Stale-context guard: URL/persisted workspace ID is not in\n // the user's accessible workspaces for the active org. Fall\n // back to the first workspace and clear the stale URL param\n // so subsequent requests don't carry the ghost ID.\n store.setCurrentWorkspaceId(ws[0].id);\n store.setWorkspaceToken(null);\n setActiveContext(nextActiveContext);\n } else if (!store.currentWorkspaceId) {\n // Auto-select first workspace only if none is currently selected\n // (preserves selection from completeAuthFlow or persistence if applicable)\n store.setCurrentWorkspaceId(ws[0].id);\n setActiveContext(nextActiveContext);\n }\n }\n }\n } catch {\n // Non-critical for THIS call (user can still select a workspace\n // manually) but worth a bounded background retry.\n setBootstrapFailureNonce((n) => n + 1);\n } finally {\n store.setLoadingWorkspaces(false);\n }\n }\n\n // Full bootstrap succeeded — re-arm the retry budget for the next\n // genuine failure.\n bootstrapRetryAttemptRef.current = 0;\n return effectiveOrganizations;\n } catch (err) {\n // Auth errors are expected during token refresh / page load cycles.\n // Suppress from console.error — the useEffect will re-trigger when the\n // auth provider refreshes the token. (A DEFINITIVELY dead session\n // never reaches here as an AuthError loop: graphqlFetch dispatches\n // SESSION_EXPIRED_EVENT and the shell force-logs-out.)\n if (err instanceof AuthError) {\n return [];\n }\n const message =\n err instanceof Error ? err.message : \"Failed to fetch organizations\";\n if (store.workspaces.length === 0) {\n console.error(\"Failed to fetch organizations:\", err);\n }\n setError(message);\n setBootstrapFailureNonce((n) => n + 1);\n\n if (store.workspaces.length > 0) {\n const fallbackOrganizations = buildFallbackOrganizations(\n store.workspaces,\n );\n if (fallbackOrganizations.length > 0) {\n store.setOrganizations(fallbackOrganizations);\n if (!store.currentOrganizationId) {\n store.setCurrentOrganizationId(fallbackOrganizations[0].id);\n }\n return fallbackOrganizations;\n }\n }\n\n return [];\n } finally {\n store.setLoadingOrganizations(false);\n fetchOrganizationsPromiseRef.current = null;\n }\n })();\n\n return fetchOrganizationsPromiseRef.current;\n }, [globalBaseUrl, setActiveContext]);\n\n // ===========================================================================\n // Bootstrap retry (transient-failure self-heal)\n // ===========================================================================\n //\n // A transient backend failure during bootstrap (cold service, gateway blip,\n // Valkey/pg hiccup) used to leave the switcher empty for the whole session —\n // the shell's Header effect only re-fires on accessToken change, so nothing\n // ever retried. Retry with exponential backoff, bounded so a genuinely down\n // backend does not hammer: 1.5s, 3s, 6s, 12s, 12s (max 5 attempts, re-armed\n // by any subsequent successful bootstrap).\n useEffect(() => {\n if (bootstrapFailureNonce === 0) return undefined;\n if (bootstrapRetryAttemptRef.current >= 5) return undefined;\n if (!resolveAccessToken()) return undefined;\n bootstrapRetryAttemptRef.current += 1;\n const delayMs = Math.min(\n 1500 * 2 ** (bootstrapRetryAttemptRef.current - 1),\n 12000,\n );\n const timer = window.setTimeout(() => {\n void fetchOrganizations();\n }, delayMs);\n return () => {\n window.clearTimeout(timer);\n };\n }, [bootstrapFailureNonce, fetchOrganizations]);\n\n // Connectivity recovery: if the browser reports we are back online and the\n // switcher is still empty, re-run the bootstrap immediately with a fresh\n // retry budget.\n useEffect(() => {\n const onOnline = () => {\n if (\n useAuthStore.getState().organizations.length === 0 &&\n resolveAccessToken()\n ) {\n bootstrapRetryAttemptRef.current = 0;\n void fetchOrganizations();\n }\n };\n window.addEventListener(\"online\", onOnline);\n return () => {\n window.removeEventListener(\"online\", onOnline);\n };\n }, [fetchOrganizations]);\n\n // ===========================================================================\n // Fetch Workspaces for Organization (Global Gateway)\n // ===========================================================================\n\n const fetchWorkspacesForOrg = useCallback(\n async (organizationId: string): Promise<Workspace[]> => {\n const store = useAuthStore.getState();\n const token = resolveAccessToken();\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n // Account-scoped in-memory deduplication; this key is never persisted or logged.\n const requestKey = JSON.stringify([\n profileId,\n userId,\n token,\n organizationId,\n ]);\n const existingPromise =\n fetchWorkspacesPromisesRef.current.get(requestKey);\n if (existingPromise) return existingPromise;\n const currentSelection = () => {\n const current = useAuthStore.getState();\n return (\n resolveActiveProfileId() === profileId &&\n current.user?.id === userId &&\n resolveAccessToken() === token &&\n current.currentOrganizationId === organizationId\n );\n };\n\n // Only bail when there is NO token at all. An expired one is handled by\n // graphqlFetch's refresh-and-retry (or ends in the shell's forced\n // logout) — silently returning [] here masked expiry as an empty list.\n if (!token) {\n return [];\n }\n\n store.setLoadingWorkspaces(true);\n setError(null);\n\n // Store the promise for deduplication before starting\n const fetchPromise = (async () => {\n try {\n const result = await graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: token,\n baseUrl: globalBaseUrl,\n });\n if (!currentSelection()) return [];\n // myWorkspaces returns workspaces across all the user's orgs;\n // filter to the requested org before handing to downstream.\n if (result.data?.workspaces?.items) {\n result.data.workspaces.items = result.data.workspaces.items.filter(\n (w) => w.organizationId === organizationId,\n );\n }\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (isAuthGraphQLError(result.errors)) {\n throw new AuthError(errorMessage);\n }\n console.error(\"Failed to fetch workspaces:\", result.errors);\n throw new Error(errorMessage);\n }\n\n // `myWorkspaces` returns every workspace the caller can see across\n // all of their orgs/tenants. The store key is per-org (selecting\n // org X then opening the dropdown should only show X's workspaces),\n // so we filter down to the requested org here. The dropdown filter\n // in ContextSwitcher.tsx is a defence-in-depth — without this\n // narrowing the store would briefly hold the caller's other-org\n // workspaces and the auto-pick logic (lines below) might select\n // one of them as the default.\n const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n const ws = allWs.filter((w) => w.organizationId === organizationId);\n store.setWorkspaces(ws);\n return ws;\n } catch (err) {\n if (!currentSelection() || err instanceof AuthError) {\n return [];\n }\n const message =\n err instanceof Error ? err.message : \"Failed to fetch workspaces\";\n console.error(\"Failed to fetch workspaces:\", err);\n setError(message);\n return [];\n } finally {\n if (currentSelection()) store.setLoadingWorkspaces(false);\n fetchWorkspacesPromisesRef.current.delete(requestKey);\n }\n })();\n\n fetchWorkspacesPromisesRef.current.set(requestKey, fetchPromise);\n return fetchPromise;\n },\n [globalBaseUrl],\n );\n\n // ===========================================================================\n // Issue Workspace Token (Workspace Gateway - wspace-auth-svc)\n // ===========================================================================\n\n const issueWorkspaceToken = useCallback(\n async (\n organizationId: string,\n workspaceId?: string,\n projectId?: string | null,\n // Target workspace's tenant. Sent as x-tenant-id so the token service can\n // resolve the tenant for a super_admin switching into a workspace not\n // mirrored into the wspace layer (whose access token carries no tenant\n // claim). Regular members resolve their tenant via membership regardless.\n tenantId?: string,\n ): Promise<{\n success: boolean;\n token?: string;\n resolvedWorkspaceId?: string;\n error?: string;\n }> => {\n const store = useAuthStore.getState();\n const originalScope = [\n store.currentOrganizationId,\n store.currentWorkspaceId,\n store.currentProjectId,\n ];\n const workspaceWide = isWorkspaceWideSelection({\n organizationId,\n workspaceId: workspaceId ?? null,\n });\n const authToken = resolveAccessToken();\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n\n // Expired tokens flow through: graphqlFetch refreshes and retries once.\n if (!authToken) {\n return { success: false, error: \"No valid access token available\" };\n }\n\n setError(null);\n\n try {\n const result = await graphqlFetch<{\n issueWorkspaceToken: IssueWorkspaceTokenResult;\n }>({\n gateway: \"workspace\",\n query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n variables: {\n input: {\n organizationId,\n ...(workspaceId && { workspaceId }),\n ...(projectId && { projectId }),\n },\n },\n authToken,\n baseUrl: workspaceBaseUrl,\n tenantId,\n });\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (!isAuthGraphQLError(result.errors)) {\n console.error(\"Failed to issue workspace token:\", result.errors);\n }\n return { success: false, error: errorMessage };\n }\n\n const tokenResult = result.data?.issueWorkspaceToken;\n\n if (tokenResult?.success && tokenResult.token) {\n const latest = useAuthStore.getState();\n if (\n resolveActiveProfileId() !== profileId ||\n useAuthStore.getState().user?.id !== userId ||\n resolveAccessToken() !== authToken ||\n originalScope.some(\n (value, index) =>\n value !==\n [\n latest.currentOrganizationId,\n latest.currentWorkspaceId,\n latest.currentProjectId,\n ][index],\n ) ||\n isWorkspaceWideSelection({\n organizationId,\n workspaceId: workspaceId ?? null,\n }) !== workspaceWide ||\n !isWorkspaceTokenValidForContext(tokenResult.token, {\n organizationId,\n workspaceId,\n projectId,\n workspaceWide,\n })\n ) {\n return {\n success: false,\n error: \"Workspace context changed during token issuance\",\n };\n }\n const resolvedWsId = tokenResult.workspaceId || workspaceId;\n if (resolvedWsId) {\n store.setCurrentWorkspaceId(resolvedWsId);\n }\n store.setWorkspaceToken(tokenResult.token);\n return {\n success: true,\n token: tokenResult.token,\n resolvedWorkspaceId: resolvedWsId || undefined,\n };\n }\n\n return {\n success: false,\n error:\n tokenResult?.error?.message ?? \"Failed to issue workspace token\",\n };\n } catch (err) {\n const message =\n err instanceof Error\n ? err.message\n : \"Failed to issue workspace token\";\n console.error(\"Failed to issue workspace token:\", err);\n setError(message);\n return { success: false, error: message };\n }\n },\n [workspaceBaseUrl],\n );\n\n // ===========================================================================\n // Fetch Projects (Workspace Gateway - requires workspace token)\n // ===========================================================================\n\n const fetchProjects = useCallback(async (): Promise<Project[]> => {\n const store = useAuthStore.getState();\n const authToken = resolveAccessToken();\n const wsToken = store.workspaceToken;\n const workspaceId = store.currentWorkspaceId;\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n const organizationId = store.currentOrganizationId;\n const projectId = store.currentProjectId;\n const wide = isWorkspaceWideSelection({ organizationId, workspaceId });\n const currentSelection = () => {\n const current = useAuthStore.getState();\n return (\n resolveActiveProfileId() === profileId &&\n current.user?.id === userId &&\n resolveAccessToken() === authToken &&\n current.workspaceToken === wsToken &&\n current.currentOrganizationId === organizationId &&\n current.currentWorkspaceId === workspaceId &&\n current.currentProjectId === projectId &&\n isWorkspaceWideSelection({ organizationId, workspaceId }) === wide\n );\n };\n\n // Expired tokens flow through: graphqlFetch refreshes and retries once.\n if (!authToken) {\n return [];\n }\n\n if (!wsToken) {\n return [];\n }\n\n if (!workspaceId) {\n return [];\n }\n\n store.setLoadingProjects(true);\n setError(null);\n\n try {\n const result = await graphqlFetch<ProjectsResponse>({\n gateway: \"workspace\",\n query: PROJECTS_QUERY,\n authToken,\n workspaceToken: wsToken,\n baseUrl: workspaceBaseUrl,\n });\n\n if (!currentSelection()) return [];\n\n if (result.errors?.length) {\n const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n if (isAuthGraphQLError(result.errors)) {\n throw new AuthError(errorMessage);\n }\n console.error(\"Failed to fetch projects:\", result.errors);\n throw new Error(errorMessage);\n }\n\n const projs: Project[] = result.data?.projects?.items ?? [];\n store.setProjects(projs);\n return projs;\n } catch (err) {\n if (err instanceof AuthError) {\n return [];\n }\n const message =\n err instanceof Error ? err.message : \"Failed to fetch projects\";\n console.error(\"Failed to fetch projects:\", err);\n setError(message);\n return [];\n } finally {\n store.setLoadingProjects(false);\n }\n }, [workspaceBaseUrl]);\n\n // ===========================================================================\n // High-Level Selection Actions\n // ===========================================================================\n\n const selectOrganization = useCallback(\n async (org: Organization): Promise<Workspace[]> => {\n const store = useAuthStore.getState();\n\n store.setCurrentWorkspaceId(null);\n store.setWorkspaceToken(null);\n store.setProjects([]);\n store.setCurrentProjectId(null);\n store.setCurrentOrganizationId(org.id);\n\n const ws = await fetchWorkspacesForOrg(org.id);\n return ws;\n },\n [fetchWorkspacesForOrg],\n );\n\n const selectWorkspace = useCallback(\n async (\n workspace: Workspace,\n ): Promise<{\n success: boolean;\n projects?: Project[];\n error?: string;\n }> => {\n const store = useAuthStore.getState();\n\n store.setCurrentProjectId(null);\n store.setProjects([]);\n\n if (!workspace.organizationId) {\n console.error(\"Workspace missing organizationId:\", workspace);\n return {\n success: false,\n error: \"Workspace is missing organizationId\",\n };\n }\n\n const tokenResult = await issueWorkspaceToken(\n workspace.organizationId,\n workspace.id,\n undefined,\n workspace.tenantId,\n );\n\n if (!tokenResult.success) {\n return { success: false, error: tokenResult.error };\n }\n\n const selected = useAuthStore.getState();\n const profileId = resolveActiveProfileId();\n const userId = selected.user?.id;\n const accessToken = resolveAccessToken();\n const workspaceToken = selected.workspaceToken;\n const projectId = selected.currentProjectId;\n const wide = isWorkspaceWideSelection({\n organizationId: workspace.organizationId,\n workspaceId: workspace.id,\n });\n const currentSelection = () => {\n const current = useAuthStore.getState();\n return (\n resolveActiveProfileId() === profileId &&\n current.user?.id === userId &&\n resolveAccessToken() === accessToken &&\n current.workspaceToken === workspaceToken &&\n current.currentOrganizationId === workspace.organizationId &&\n current.currentWorkspaceId === workspace.id &&\n current.currentProjectId === projectId &&\n isWorkspaceWideSelection({\n organizationId: workspace.organizationId,\n workspaceId: workspace.id,\n }) === wide\n );\n };\n const projs = await fetchProjects();\n if (!currentSelection())\n return { success: false, error: \"Context changed during selection\" };\n\n if (\n projs.length > 0 &&\n !isWorkspaceWideSelection({\n organizationId: workspace.organizationId,\n workspaceId: workspace.id,\n })\n ) {\n store.setCurrentProjectId(projs[0]!.id);\n }\n\n return { success: true, projects: projs };\n },\n [issueWorkspaceToken, fetchProjects],\n );\n\n const selectProject = useCallback((project: Project): void => {\n const store = useAuthStore.getState();\n clearWorkspaceWideSelection({\n organizationId: store.currentOrganizationId,\n workspaceId: store.currentWorkspaceId,\n });\n store.setCurrentProjectId(project.id);\n if (\n store.workspaceToken &&\n !isWorkspaceTokenValidForContext(store.workspaceToken, {\n workspaceId: store.currentWorkspaceId,\n organizationId: store.currentOrganizationId,\n projectId: project.id,\n })\n ) {\n store.setWorkspaceToken(null);\n }\n }, []);\n\n const selectWorkspaceWide = useCallback((): void => {\n const store = useAuthStore.getState();\n const scope = {\n organizationId: activeOrganizationIdRef.current,\n workspaceId: activeWorkspaceIdRef.current,\n };\n if (\n !scope.organizationId ||\n !scope.workspaceId ||\n store.currentOrganizationId !== scope.organizationId ||\n store.currentWorkspaceId !== scope.workspaceId\n ) {\n throw new Error(\"Current workspace context required\");\n }\n if (!persistWorkspaceWideSelection(scope))\n throw new Error(\"Workspace-wide preference could not be saved\");\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n setActiveContext({ projectId: null });\n }, [setActiveContext]);\n\n // ===========================================================================\n // Cross-MFE refresh: keep the switcher lists current when another MFE mutates\n // org/workspace/project entities. microfe-workspaces emits these domain events\n // on the shared event bus (e.g. on project rename); without this the switcher\n // keeps showing the stale cached name until a full page reload.\n // ===========================================================================\n\n useEffect(() => {\n let cancelled = false;\n\n // Coalesce a refetch into a single in-flight run with one trailing re-run,\n // so a burst of events collapses to one request (+ one trailing) instead of\n // fanning out or being swallowed by a downstream per-key dedupe. The flag is\n // cleared on cleanup so nothing fires after the subscription is torn down.\n const makeCoalescedRefetch = (run: () => Promise<unknown>) => {\n let running = false;\n let queued = false;\n const trigger = () => {\n if (cancelled) return;\n if (running) {\n queued = true;\n return;\n }\n running = true;\n void run().finally(() => {\n running = false;\n if (!cancelled && queued) {\n queued = false;\n trigger();\n }\n });\n };\n return trigger;\n };\n\n const refreshProjects = makeCoalescedRefetch(() => fetchProjects());\n const refreshWorkspaces = makeCoalescedRefetch(() => {\n const orgId = useAuthStore.getState().currentOrganizationId;\n return orgId ? fetchWorkspacesForOrg(orgId) : Promise.resolve();\n });\n\n // Custom domain events (not in BurdenoffEventName) flow through `onAny`.\n const unsubscribe = eventBus.onAny((event) => {\n // Custom event names aren't in the BurdenoffEventName union; compare as string.\n const eventName: string = event.name;\n\n if (PROJECT_REFRESH_EVENTS.has(eventName)) {\n const eventWorkspaceId = readEventWorkspaceId(event.payload);\n const { currentWorkspaceId } = useAuthStore.getState();\n // Only refetch when the event targets the workspace currently in\n // context (events without a workspace id are treated as relevant).\n if (\n eventWorkspaceId &&\n currentWorkspaceId &&\n eventWorkspaceId !== currentWorkspaceId\n ) {\n return;\n }\n // Refetch only — a deleted project simply drops out of the list, and\n // `currentProject` resolves to undefined for it. Clearing the selection\n // here would race ActiveContext / the project sync effect (the real\n // source of truth), so we leave selection reconciliation to them.\n refreshProjects();\n return;\n }\n\n if (WORKSPACE_REFRESH_EVENTS.has(eventName)) {\n refreshWorkspaces();\n }\n });\n\n return () => {\n cancelled = true;\n unsubscribe();\n };\n }, [eventBus, fetchProjects, fetchWorkspacesForOrg]);\n\n // ===========================================================================\n // Get Current Items\n // ===========================================================================\n\n const currentOrganization = organizations.find(\n (org) => org.id === currentOrganizationId,\n );\n const currentWorkspace = workspaces.find(\n (ws) => ws.id === currentWorkspaceId,\n );\n const currentProject = projects.find((proj) => proj.id === currentProjectId);\n\n // ===========================================================================\n // Return Hook API\n // ===========================================================================\n\n return {\n organizations,\n workspaces,\n projects,\n\n currentOrganizationId,\n currentWorkspaceId,\n currentProjectId,\n\n currentOrganization,\n currentWorkspace,\n currentProject,\n\n workspaceToken,\n\n isLoadingOrganizations,\n isLoadingWorkspaces,\n isLoadingProjects,\n isLoading:\n isLoadingOrganizations || isLoadingWorkspaces || isLoadingProjects,\n\n error,\n\n fetchOrganizations,\n fetchWorkspacesForOrg,\n issueWorkspaceToken,\n fetchProjects,\n\n selectOrganization,\n selectWorkspace,\n selectProject,\n selectWorkspaceWide,\n };\n}\n\n/**\n * Hook to reactively ensure workspaces are synced with the current organization.\n *\n * This handles edge cases where the organization changes but workspaces\n * from a different org are still in the store (e.g., stale data, race conditions).\n *\n * Usage:\n * ```tsx\n * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n * useWorkspaceSyncEffect(); // Ensures workspaces stay in sync\n * // ...\n * }\n * ```\n */\nexport function useWorkspaceSyncEffect(\n options?: UseContextSwitcherDataOptions,\n) {\n const currentOrganizationId = useAuthStore(\n (state) => state.currentOrganizationId,\n );\n const workspaces = useAuthStore((state) => state.workspaces);\n const accessToken = useAuthStore((state) => state.accessToken);\n const isLoadingWorkspaces = useAuthStore(\n (state) => state.isLoadingWorkspaces,\n );\n const resolvedBaseUrls = resolveGatewayBaseUrls();\n const globalBaseUrl =\n options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n const disableWorkspaceSync = options?.disableWorkspaceSync ?? false;\n\n useEffect(() => {\n if (disableWorkspaceSync) return;\n // Skip if no org selected, no token, or already loading\n if (!currentOrganizationId || !accessToken || isLoadingWorkspaces) return;\n\n // Check if any workspace matches the current org\n const hasMatchingWorkspaces = workspaces.some(\n (ws) => ws.organizationId === currentOrganizationId,\n );\n\n // If workspaces exist but none match current org, we need to refetch\n // This can happen in edge cases with stale data or race conditions\n if (workspaces.length > 0 && !hasMatchingWorkspaces) {\n const store = useAuthStore.getState();\n store.setLoadingWorkspaces(true);\n\n // Inline fetch to avoid circular dependency with useContextSwitcherData\n graphqlFetch<WorkspacesByOrgResponse>({\n gateway: \"global\",\n query: WORKSPACES_BY_ORG_QUERY,\n authToken: accessToken,\n baseUrl: globalBaseUrl,\n })\n .then((result) => {\n // myWorkspaces returns ALL my workspaces; filter to current org\n // client-side (the old server-side filter no longer exists).\n if (result.data?.workspaces?.items) {\n result.data.workspaces.items = result.data.workspaces.items.filter(\n (w) => w.organizationId === currentOrganizationId,\n );\n }\n if (!result.errors?.length) {\n const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n // Same per-org narrowing as fetchWorkspacesForOrg — see the\n // comment there for why we don't just dump the full caller-\n // visible list into the store.\n const ws = allWs.filter(\n (w) => w.organizationId === currentOrganizationId,\n );\n store.setWorkspaces(ws);\n }\n })\n .catch(() => {\n // Silent fail - user can manually refresh or select org again\n })\n .finally(() => {\n store.setLoadingWorkspaces(false);\n });\n }\n }, [\n currentOrganizationId,\n workspaces,\n accessToken,\n isLoadingWorkspaces,\n globalBaseUrl,\n disableWorkspaceSync,\n ]);\n}\n\n/**\n * Hook to reactively ensure projects are loaded when a workspace is selected.\n *\n * This handles the case where a workspace is auto-selected (from URL/localStorage)\n * but projects haven't been fetched yet. It will:\n * 1. Issue a workspace token if not present\n * 2. Fetch projects for the selected workspace\n *\n * Usage:\n * ```tsx\n * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n * useProjectSyncEffect(); // Ensures projects are loaded for selected workspace\n * // ...\n * }\n * ```\n */\nexport function useProjectSyncEffect(options?: UseContextSwitcherDataOptions) {\n const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n const currentOrganizationId = useAuthStore(\n (state) => state.currentOrganizationId,\n );\n const workspaces = useAuthStore((state) => state.workspaces);\n const projects = useAuthStore((state) => state.projects);\n const currentProjectId = useAuthStore((state) => state.currentProjectId);\n const workspaceToken = useAuthStore((state) => state.workspaceToken);\n const accessToken = useAuthStore((state) => state.accessToken);\n const resolvedBaseUrls = resolveGatewayBaseUrls();\n const workspaceBaseUrl =\n options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n const disableProjectSync = options?.disableProjectSync ?? false;\n const skipProjectFetch = options?.skipProjectFetch ?? false;\n\n // Use refs to prevent the infinite loop caused by including loading/failure\n // state in the dependency array. Without these, the cycle is:\n // setLoadingProjects(true) -> dep change -> effect re-runs (guarded) ->\n // async completes -> setLoadingProjects(false) -> dep change ->\n // effect re-runs -> starts again -> INFINITE LOOP\n const syncInProgressRef = useRef(false);\n const [syncRevision, setSyncRevision] = useState(0);\n const emptyProjectsResultRef = useRef<{\n scopeKey: string;\n projects: Project[];\n } | null>(null);\n // Pending retry timer per workspace, so transient failures (e.g. RBAC lag\n // right after workspace creation) get an automatic second chance even if no\n // dependency change re-triggers the effect.\n const retryTimerRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(\n new Map(),\n );\n // Per-workspace failure tracker — caps retry attempts when project bootstrap\n // (token issue or list) fails. An empty authorized project list is a valid\n // workspace-only context, not a provisioning failure.\n //\n // We track both count AND lastFailureAt so we can honour a \"cool-down\" window:\n // after PROJECT_SYNC_FAILURE_COOLDOWN_MS has elapsed since the last failure,\n // the counter is treated as cleared so transient backend hiccups (e.g. RBAC\n // role propagation lag right after signup) don't permanently lock a workspace\n // out of the context dropdown — the original cause of marqueue §729.\n const projectSyncFailuresRef = useRef<\n Map<string, { count: number; lastFailureAt: number }>\n >(new Map());\n const PROJECT_SYNC_MAX_FAILURES = 8;\n const PROJECT_SYNC_FAILURE_COOLDOWN_MS = 30_000;\n useEffect(() => {\n if (disableProjectSync) return;\n // Skip if no workspace selected or no access token\n if (!currentWorkspaceId || !accessToken) return;\n\n // Skip if a sync is already in progress (ref-based guard avoids dep loop)\n if (syncInProgressRef.current) return;\n\n // Stop retrying once this workspace has failed too many times in a row.\n // Counter is reset on success, on workspace switch (different key), by\n // an explicit user retry path (e.g. selectWorkspace), or after the\n // cool-down window has elapsed since the last failure (so transient\n // backend issues don't permanently wedge the dropdown).\n const failureEntry = projectSyncFailuresRef.current.get(currentWorkspaceId);\n if (\n failureEntry &&\n failureEntry.count >= PROJECT_SYNC_MAX_FAILURES &&\n Date.now() - failureEntry.lastFailureAt < PROJECT_SYNC_FAILURE_COOLDOWN_MS\n ) {\n return;\n }\n if (\n failureEntry &&\n Date.now() - failureEntry.lastFailureAt >=\n PROJECT_SYNC_FAILURE_COOLDOWN_MS\n ) {\n // Cool-down elapsed — clear the counter so we get a fresh budget.\n projectSyncFailuresRef.current.delete(currentWorkspaceId);\n }\n\n // Resolve organizationId: prefer the workspace object (if loaded), fall\n // back to the persisted currentOrganizationId. The workspaces array is\n // NOT persisted by zustand, so on page reload it is empty until\n // fetchOrganizations() completes. Using the persisted org ID lets us\n // issue the workspace token immediately instead of waiting.\n const currentWorkspace = workspaces.find(\n (ws) => ws.id === currentWorkspaceId,\n );\n\n // Guard: transient (newOrg, oldWs) divergence during org switches — token issuance always fails.\n if (\n currentWorkspace &&\n currentOrganizationId &&\n currentWorkspace.organizationId !== currentOrganizationId\n ) {\n return;\n }\n\n const organizationId =\n currentWorkspace?.organizationId ?? currentOrganizationId;\n if (!organizationId) return;\n\n const store = useAuthStore.getState();\n if (\n currentProjectId &&\n getUrlParam(\"project\") === currentProjectId &&\n getUrlParam(\"workspace\") === currentWorkspaceId &&\n getUrlParam(\"org\") === organizationId\n ) {\n clearWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n });\n }\n const profileId = resolveActiveProfileId();\n const userId = store.user?.id;\n const workspaceWide = isWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n });\n if (workspaceWide && store.currentProjectId) {\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n return;\n }\n\n // If we don't have a workspace token or it's expired, issue one first\n const needsToken =\n !workspaceToken ||\n isTokenExpired(workspaceToken) ||\n !isWorkspaceTokenValidForContext(workspaceToken, {\n workspaceId: currentWorkspaceId,\n organizationId: currentOrganizationId,\n projectId: currentProjectId,\n workspaceWide,\n });\n\n // Skip if projects are already loaded for this workspace AND token is valid\n const scopeKey = JSON.stringify([\n profileId,\n userId,\n accessToken,\n organizationId,\n currentWorkspaceId,\n ]);\n const hasProjectsForWorkspace =\n projects.some((p) => p.workspaceId === currentWorkspaceId) ||\n (emptyProjectsResultRef.current?.scopeKey === scopeKey &&\n emptyProjectsResultRef.current.projects === projects);\n if (hasProjectsForWorkspace && !needsToken) {\n if (!store.currentProjectId && !workspaceWide) {\n const firstProject = projects.find(\n (project) => project.workspaceId === currentWorkspaceId,\n );\n if (firstProject) {\n store.setCurrentProjectId(firstProject.id);\n }\n }\n return;\n }\n\n const contextStillCurrent = () => {\n const latest = useAuthStore.getState();\n return (\n latest.accessToken === accessToken &&\n latest.user?.id === userId &&\n resolveActiveProfileId() === profileId &&\n latest.currentOrganizationId === organizationId &&\n latest.currentWorkspaceId === currentWorkspaceId &&\n latest.currentProjectId === currentProjectId &&\n isWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n }) === workspaceWide\n );\n };\n\n const syncProjects = async () => {\n syncInProgressRef.current = true;\n store.setLoadingProjects(true);\n let succeeded = false;\n\n try {\n let wsToken = workspaceToken;\n\n // Issue workspace token if needed\n if (needsToken) {\n const tokenResult = await graphqlFetch<{\n issueWorkspaceToken: IssueWorkspaceTokenResult;\n }>({\n gateway: \"workspace\",\n query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n variables: {\n input: {\n organizationId,\n workspaceId: currentWorkspaceId,\n ...(currentProjectId ? { projectId: currentProjectId } : {}),\n },\n },\n authToken: accessToken,\n baseUrl: workspaceBaseUrl,\n // See issueWorkspaceToken: send the current workspace's tenant so a\n // super_admin (no tenant claim) can resolve it for an unmirrored ws.\n tenantId: workspaces.find((ws) => ws.id === currentWorkspaceId)\n ?.tenantId,\n });\n\n if (\n tokenResult.data?.issueWorkspaceToken?.success &&\n tokenResult.data.issueWorkspaceToken.token\n ) {\n wsToken = tokenResult.data.issueWorkspaceToken.token;\n if (\n !contextStillCurrent() ||\n !isWorkspaceTokenValidForContext(wsToken, {\n workspaceId: currentWorkspaceId,\n organizationId,\n projectId: currentProjectId,\n workspaceWide,\n })\n )\n return;\n store.setWorkspaceToken(wsToken);\n } else {\n return;\n }\n }\n\n // Fetch projects (skip if already loaded or token-only sync requested)\n if (wsToken && !hasProjectsForWorkspace && !skipProjectFetch) {\n const projectsResult = await graphqlFetch<ProjectsResponse>({\n gateway: \"workspace\",\n query: PROJECTS_QUERY,\n authToken: accessToken,\n workspaceToken: wsToken,\n baseUrl: workspaceBaseUrl,\n });\n\n if (!contextStillCurrent() || projectsResult.errors?.length) {\n return;\n }\n\n const projs: Project[] = projectsResult.data?.projects?.items ?? [];\n // myProjects lists accessible projects. An empty result does not\n // authorize creating one. Remember this result to avoid a render/\n // fetch loop; changing account or clearing the list invalidates it.\n emptyProjectsResultRef.current =\n projs.length === 0 ? { scopeKey, projects: projs } : null;\n store.setProjects(projs);\n\n // A restored/deep-linked project may have been removed or revoked.\n // Discard its token so the next sync establishes the current scope.\n if (\n currentProjectId &&\n !projs.some((project) => project.id === currentProjectId)\n ) {\n store.setCurrentProjectId(null);\n store.setWorkspaceToken(null);\n }\n\n // Auto-select first project if none selected and projects exist\n if (\n projs.length > 0 &&\n !useAuthStore.getState().currentProjectId &&\n !isWorkspaceWideSelection({\n organizationId,\n workspaceId: currentWorkspaceId,\n })\n ) {\n store.setCurrentProjectId(projs[0].id);\n }\n }\n\n succeeded = true;\n } catch {\n // A later auth/context update should be able to retry.\n } finally {\n store.setLoadingProjects(false);\n syncInProgressRef.current = false;\n const scopeCurrent = contextStillCurrent();\n if (!scopeCurrent) setSyncRevision((revision) => revision + 1);\n const failures = projectSyncFailuresRef.current;\n if (scopeCurrent && succeeded) {\n failures.delete(currentWorkspaceId);\n const pending = retryTimerRef.current.get(currentWorkspaceId);\n if (pending) {\n clearTimeout(pending);\n retryTimerRef.current.delete(currentWorkspaceId);\n }\n } else if (scopeCurrent) {\n const existing = failures.get(currentWorkspaceId);\n const nextCount = (existing?.count ?? 0) + 1;\n failures.set(currentWorkspaceId, {\n count: nextCount,\n lastFailureAt: Date.now(),\n });\n // Schedule a backoff retry for transient backend lag (e.g. RBAC\n // role propagation right after signup → first projects() call hits\n // permission-denied). Without this, the effect would only re-run on\n // dep change and the user would be stuck staring at an empty\n // project dropdown until something else triggered a re-render.\n if (nextCount < PROJECT_SYNC_MAX_FAILURES) {\n const existingTimer = retryTimerRef.current.get(currentWorkspaceId);\n if (existingTimer) clearTimeout(existingTimer);\n const backoffMs = Math.min(1000 * 2 ** (nextCount - 1), 8000);\n const timer = setTimeout(() => {\n retryTimerRef.current.delete(currentWorkspaceId);\n // Only re-run if the workspace context is still the same and\n // a project hasn't been loaded for it in the meantime.\n const latest = useAuthStore.getState();\n if (\n contextStillCurrent() &&\n latest.currentWorkspaceId === currentWorkspaceId &&\n !latest.projects.some(\n (p) => p.workspaceId === currentWorkspaceId,\n ) &&\n !syncInProgressRef.current\n ) {\n // Bump a render by clearing then resetting workspaceToken\n // when valid, OR by re-issuing projects fetch directly. The\n // simplest robust trigger is to clear the in-progress guard\n // and call syncProjects() again with current closure values.\n void syncProjects();\n }\n }, backoffMs);\n retryTimerRef.current.set(currentWorkspaceId, timer);\n }\n }\n }\n };\n\n syncProjects();\n }, [\n syncRevision,\n currentWorkspaceId,\n currentOrganizationId,\n workspaces,\n projects,\n currentProjectId,\n workspaceToken,\n accessToken,\n workspaceBaseUrl,\n disableProjectSync,\n skipProjectFetch,\n ]);\n\n // Cleanup any pending retry timers on unmount so we don't leak stray\n // setTimeout callbacks running against stale closures.\n useEffect(() => {\n const timers = retryTimerRef.current;\n return () => {\n timers.forEach((timer) => clearTimeout(timer));\n timers.clear();\n };\n }, []);\n}\n// hmr-bust-1778064429\n"],"mappings":";;;;;;;;;;AAwFA,IAAM,IAAyB,2RAoCzB,IAA0B,oSAoB1B,KAAiC,6SA0BjC,IAAiB;AA0BvB,SAAS,EAAe,GAAe,IAAW,KAAiB;CACjE,IAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,GAAG,EAAE,EAAE,CAAC;EAEpD,OADK,EAAQ,MACN,EAAQ,MAAM,MAAO,KAAK,IAAI,IAAI,IADhB;CAE3B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,EAAyB,GAKzB;CACP,IAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,GAAG,EAAE,EAAE,CAAC;EACpD,OAAO;GACL,aACE,OAAO,EAAQ,eAAgB,WAC3B,EAAQ,cACR,KAAA;GACN,gBACE,OAAO,EAAQ,kBAAmB,WAC9B,EAAQ,iBACR,KAAA;GACN,WACE,OAAO,EAAQ,aAAc,WAAW,EAAQ,YAAY,KAAA;GAC9D,KAAK,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,KAAA;EACvD;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,EACP,GACA,GAMiB;CACjB,IAAI,CAAC,KAAS,EAAe,CAAK,GAChC,OAAO;CAGT,IAAM,IAAU,EAAyB,CAAK;CAsB9C,OAJA,EAjBI,CAAC,KAID,EAAS,eAAe,EAAQ,gBAAgB,EAAS,eAK3D,EAAS,kBACT,EAAQ,mBAAmB,EAAS,kBAKlC,EAAS,iBAAiB,EAAQ,aAElC,EAAS,aAAa,EAAQ,cAAc,EAAS;AAK3D;AAQA,IAAM,IAAN,cAAwB,MAAM;CAC5B,YAAY,GAAiB;EAE3B,AADA,MAAM,CAAO,GACb,KAAK,OAAO;CACd;AACF;AAKA,SAAS,EACP,GACS;CACT,OAAO,EAAO,MACX,MACC,EAAE,YAAY,SAAS,qBACvB,EAAE,SAAS,YAAY,EAAE,SAAS,cAAc,KAChD,EAAE,SAAS,YAAY,EAAE,SAAS,mBAAmB,CACzD;AACF;AAQA,SAAS,IAAoC;CAC3C,IAAM,IAAa,EAAa,SAAS,EAAE;CAG3C,IAAI,KAAc,CAAC,EAAe,CAAU,GAC1C,OAAO;CAIT,IAAM,IAAe,EAAmB;CAQxC,OAPI,KAAgB,CAAC,EAAe,CAAY,IACvC,IAMF;AACT;AAEA,SAAS,EAA2B,GAAyC;CAS3E,OARqB,MAAM,KACzB,IAAI,IACF,EAAW,SAAS,MAClB,EAAU,iBAAiB,CAAC,EAAU,cAAc,IAAI,CAAC,CAC3D,CACF,CAGK,EAAa,KAAK,GAAgB,OAAW;EAClD,IAAI;EACJ,MACE,EAAW,MACR,MAAc,EAAU,mBAAmB,CAC9C,GAAG,QAAQ,gBAAgB,IAAQ;EACrC,MAAM;EACN,UACE,EAAW,MACR,MAAc,EAAU,mBAAmB,CAC9C,GAAG,YAAY;CACnB,EAAE;AACJ;AAsBA,IAAM,IAAyB,IAAI,IAAY;CAC7C;CACA;CACA;CACA;CACA;AACF,CAAC,GACK,IAA2B,IAAI,IAAY;CAC/C;CACA;CACA;CACA;CACA;AACF,CAAC;AAKD,SAAS,EAAqB,GAAsC;CAClE,IAAI,KAAW,OAAO,KAAY,YAAY,iBAAiB,GAAS;EACtE,IAAM,IAAS,EAAsC;EACrD,OAAO,OAAO,KAAU,WAAW,IAAQ,KAAA;CAC7C;AAEF;AAEA,SAAgB,EACd,GACA;CACA,IAAM,EACJ,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,UAAU,GACV,YAAY,MACV,EAAiB,GAEf,IAAW,EAAY,GAGvB,IAAgB,GAAc,MAAU,EAAM,aAAa,GAC3D,IAAwB,GAC3B,MAAU,EAAM,qBACnB,GACM,IAAyB,GAC5B,MAAU,EAAM,sBACnB,GAEM,IAAa,GAAc,MAAU,EAAM,UAAU,GACrD,IAAqB,GAAc,MAAU,EAAM,kBAAkB,GACrE,IAAiB,GAAc,MAAU,EAAM,cAAc,GAC7D,IAAsB,GACzB,MAAU,EAAM,mBACnB,GAEM,KAAW,GAAc,MAAU,EAAM,QAAQ,GACjD,KAAmB,GAAc,MAAU,EAAM,gBAAgB,GACjE,KAAoB,GAAc,MAAU,EAAM,iBAAiB;CAMzE,QAAgB;EACd,IAAM,IAAY,EAAW,MAC1B,MACC,EAAI,OAAO,KACX,EAAI,mBAAmB,CAC3B,GACM,IAAe,EAAc,MAChC,MAAQ,EAAI,OAAO,CACtB;EAEE,CAAC,KACD,CAAC,KACD,CAAC,kEAAkE,KACjE,EAAU,QACZ,KACA,EAAU,aAAa,EAAa,YACpC,MAAmB,EAAU,YAM/B,EAAiB,EAAE,UAAU,EAAU,SAAS,CAAC;CACnD,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CAGD,IAAM,CAAC,IAAO,KAAY,EAAwB,IAAI,GAQhD,CAAC,GAAuB,KAA4B,EAAS,CAAC,GAC9D,IAA2B,EAAO,CAAC,GAGnC,IAA+B,EACnC,IACF,GACM,IAA6B,kBACjC,IAAI,IAAI,CACV,GAKM,IAAuB,EAAO,CAAiB,GAC/C,IAA0B,EAAO,CAAoB;CAC3D,QAAgB;EAEd,AADA,EAAqB,UAAU,GAC/B,EAAwB,UAAU;CACpC,CAAC;CAED,IAAM,IAAmB,EAAuB,GAC1C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IACJ,GAAS,oBAAoB,EAAiB,kBAS1C,KAAsB,EAAsB,IAAI,GAChD,IAA4B,EAAsB,IAAI,GACtD,KAA0B,EAAsB,IAAI,GACpD,KAA6B,EAAsB,IAAI;CAE7D,QAAgB;EACd,IAAM,IAAQ,EAAa,SAAS;EA0DpC,IAvDE,KACA,MAAyB,EAAM,yBAC/B,MAAyB,GAAoB,YAE7C,GAAoB,UAAU,GAC9B,EAAM,yBAAyB,CAAoB,GAEjD,EAAM,WAAW,SAAS,KAC1B,CAAC,EAAM,WAAW,MACf,MAAc,EAAU,mBAAmB,CAC9C,KAEA,EAAM,cAAc,CAAC,CAAC,IAKxB,KACA,MAAsB,EAAM,sBAC5B,MAAsB,EAA0B,YAEhD,EAA0B,UAAU,GACpC,EAAM,sBAAsB,CAAiB,GAE3C,EAAM,SAAS,SAAS,KACxB,CAAC,EAAM,SAAS,MACb,MAAY,EAAQ,gBAAgB,CACvC,MAEA,EAAM,YAAY,CAAC,CAAC,GACpB,EAAM,oBAAoB,IAAI,KAKhC,EAAyB;GACvB,gBAAgB;GAChB,aAAa;EACf,CAAC,KACD,CAAC,KACD,EAAM,qBAEN,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,IAI5B,KACA,MAAoB,EAAM,oBAC1B,MAAoB,GAAwB,YAE5C,GAAwB,UAAU,GAClC,EAAM,oBAAoB,CAAe,IAIzC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa;GACb,gBAAgB;GAChB,WAAW;GACX,eACE,CAAC,KACD,EAAyB;IACvB,gBAAgB;IAChB,aAAa;GACf,CAAC;EACL,CAAC,GACD;GAOA,IAAM,IAAS,GAAG,KAAwB,GAAG,GAAG,KAAqB,GAAG,GAAG,KAAmB;GAC9F,AAAI,GAA2B,YAAY,MACzC,GAA2B,UAAU,GACrC,EAAM,kBAAkB,IAAI;EAEhC;CACF,GAAG;EAAC;EAAsB;EAAmB;CAAe,CAAC;CAM7D,IAAM,IAAqB,EAAY,YAAqC;EAE1E,IAAI,EAA6B,SAC/B,OAAO,EAA6B;EAGtC,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAQ,EAAmB;EAuWjC,OArWK,KAeL,EAAM,wBAAwB,EAAI,GAClC,EAAS,IAAI,GAGb,EAA6B,WAAW,YAAY;GAClD,IAAI;IACF,IAAM,IACJ,EAAwB,WAAW,EAAM,uBACvC,IAEA,IACA,OAAO,YAAY;KACjB,IAAM,CAAC,GAAqB,KAAoB,MAAM,QAAQ,IAC5D,CACE,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;KACX,CAAC,GACD,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;KACX,CAAC,CACH,CACF;KAWA,OAAO;MACL,MAVW,EAAoB,MAAM,kBACnC;OACE,iBAAiB,EAAoB,KAAK;OAC1C,GAAI,EAAiB,MAAM,aACvB,EAAE,YAAY,EAAiB,KAAK,WAAW,IAC/C,CAAC;MACP,IACA;MAIF,QAAQ,CACN,GAAI,EAAoB,UAAU,CAAC,GACnC,GAAI,EAAiB,UAAU,CAAC,CAClC;KACF;IACF,GAAG,IACH,MAAM,EAAsC;KAC1C,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;IACX,CAAC;IAkDL,IA3CE,KACA,EAAO,QAAQ,UACf,EAAO,OAAO,MACX,MACC,GAAG,YAAY,SAAS,eACxB,qCAAqC,KAAK,GAAG,WAAW,EAAE,KAO1D,oEAAoE,KAClE,GAAG,WAAW,EAChB,CACJ,MAOA,IAAS,MAAM,EAEb;KACA,SAAS;KACT,OAAO;KAYP,WAAW;KACX,SAAS;IACX,CAAC,IAGC,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;KASlD,MARI,EAAmB,EAAO,MAAM,IAG5B,IAAI,EAAU,CAAY,KAE9B,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAO,MAAM,GAErD,MAAM,CAAY;IAC9B;IAEA,IAAI,IAAuB,EAAO,MAAM,iBAAiB,SAAS,CAAC;IASnE,IACE,KACA,EAAK,WAAW,KAChB,EAAM,WAAW,WAAW,GAC5B;KACA,IAAM,IAAW,MAAM,EAAsC;MAC3D,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;KACX,CAAC;KACD,IAAI,CAAC,EAAS,QAAQ,QAIpB,AAHA,IAAO,EAAS,MAAM,iBAAiB,SAAS,CAAC,GAGjD,IAAS;MACP,GAAG;MACH,MAAM,EACJ,iBAAiB,EAAS,MAAM,mBAAmB;OACjD,OAAO,CAAC;OACR,OAAO;MACT,EACF;KACF;UACK;MAOL,QAAQ,KACN,oDACA,EAAS,MACX;MACA,IAAM,IACJ,EAAS,SAAS,IAAI,WAAW;MAInC,MAHI,EAAmB,EAAS,UAAU,CAAC,CAAC,IACpC,IAAI,EAAU,CAAe,IAE3B,MAAM,CAAe;KACjC;IACF;IAEA,IAAM,IACJ,EAAK,WAAW,KAAK,EAAM,WAAW,SAAS,IAC3C,EAA2B,EAAM,UAAU,IAC3C,CAAC,GACD,IACJ,EAAsB,SAAS,IAAI,IAAwB;IAE7D,EAAM,iBAAiB,CAAsB;IAG7C,IAAI,IAAc,GAaZ,IACJ,KAAe,EAAK,MAAM,MAAQ,EAAI,OAAO,CAAW;IAkC1D,IAjCI,KAAe,CAAC,KAAyB,EAAK,SAAS,MACzD,IAAc,EAAK,GAAG,IACtB,EAAiB;KACf,gBAAgB;KAChB,aAAa;KACb,UAAU;KACV,WAAW;IACb,CAAC,GACD,EAAM,cAAc,CAAC,CAAC,GACtB,EAAM,YAAY,CAAC,CAAC,GACpB,EAAM,sBAAsB,IAAI,GAChC,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,IAG1B,KAAe,MAAgB,EAAM,yBACvC,EAAM,yBAAyB,CAAW,GAIxC,EAAuB,SAAS,KAAK,CAAC,MACxC,EAAM,yBAAyB,EAAuB,GAAG,EAAE,GAC3D,IAAc,EAAuB,GAAG,KAWtC,KAAe,EAAa,SAAS,EAAE,WAAW,WAAW,GAAG;KAClE,EAAM,qBAAqB,EAAI;KAC/B,IAAI;MAGF,IAMM,KALJ,MAAuB,IACnB,EAAO,MAAM,YAAY,OAAO,QAC7B,MAAM,EAAE,mBAAmB,CAC9B,IACA,KAAA,MAGF,MAAM,EAAsC;OAC1C,SAAS;OACT,OAAO;OACP,WAAW;OACX,SAAS;MACX,CAAC,EAAE,MAAM,MACP,EAAS,QAAQ,SACb,QACC,EAAS,MAAM,YAAY,SAAS,CAAC,GAAG,QACtC,MAAM,EAAE,mBAAmB,CAC9B,CACN;MAQJ,IANK,KAIH,GAA0B,MAAM,IAAI,CAAC,GAEnC,GAAI;OACN,EAAM,cAAc,CAAE;OACtB,IAAM,IAAqB,EAAqB,UAC5C,EAAG,MACA,MACC,EAAU,OAAO,EAAqB,OAC1C,IACA;OAEJ,IAAI,GACF,EAAM,sBAAsB,EAAmB,EAAE;YAC5C,IAAI,EAAG,SAAS,GAAG;QACxB,IAAM,IAAoB;SACxB,gBAAgB;SAChB,aAAa,EAAG,GAAG;SACnB,UAAU,EAAG,GAAG;SAChB,WAAW;QACb;QAEA,AAAI,EAAqB,WAKvB,EAAM,sBAAsB,EAAG,GAAG,EAAE,GACpC,EAAM,kBAAkB,IAAI,GAC5B,EAAiB,CAAiB,KACxB,EAAM,uBAGhB,EAAM,sBAAsB,EAAG,GAAG,EAAE,GACpC,EAAiB,CAAiB;OAEtC;MACF;KACF,QAAQ;MAGN,GAA0B,MAAM,IAAI,CAAC;KACvC,UAAU;MACR,EAAM,qBAAqB,EAAK;KAClC;IACF;IAKA,OADA,EAAyB,UAAU,GAC5B;GACT,SAAS,GAAK;IAMZ,IAAI,aAAe,GACjB,OAAO,CAAC;IAEV,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;IAOvC,IANI,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,CAAG,GAErD,EAAS,CAAO,GAChB,GAA0B,MAAM,IAAI,CAAC,GAEjC,EAAM,WAAW,SAAS,GAAG;KAC/B,IAAM,IAAwB,EAC5B,EAAM,UACR;KACA,IAAI,EAAsB,SAAS,GAKjC,OAJA,EAAM,iBAAiB,CAAqB,GACvC,EAAM,yBACT,EAAM,yBAAyB,EAAsB,GAAG,EAAE,GAErD;IAEX;IAEA,OAAO,CAAC;GACV,UAAU;IAER,AADA,EAAM,wBAAwB,EAAK,GACnC,EAA6B,UAAU;GACzC;EACF,GAAG,GAEI,EAA6B,WAlW3B,CAAC;CAmWZ,GAAG,CAAC,GAAe,CAAgB,CAAC;CAgCpC,AApBA,QAAgB;EAGd,IAFI,MAA0B,KAC1B,EAAyB,WAAW,KACpC,CAAC,EAAmB,GAAG;EAC3B,EAAyB,WAAW;EACpC,IAAM,IAAU,KAAK,IACnB,OAAO,MAAM,EAAyB,UAAU,IAChD,IACF,GACM,IAAQ,OAAO,iBAAiB;GACpC,EAAwB;EAC1B,GAAG,CAAO;EACV,aAAa;GACX,OAAO,aAAa,CAAK;EAC3B;CACF,GAAG,CAAC,GAAuB,CAAkB,CAAC,GAK9C,QAAgB;EACd,IAAM,UAAiB;GACrB,AACE,EAAa,SAAS,EAAE,cAAc,WAAW,KACjD,EAAmB,MAEnB,EAAyB,UAAU,GACnC,EAAwB;EAE5B;EAEA,OADA,OAAO,iBAAiB,UAAU,CAAQ,SAC7B;GACX,OAAO,oBAAoB,UAAU,CAAQ;EAC/C;CACF,GAAG,CAAC,CAAkB,CAAC;CAMvB,IAAM,IAAwB,EAC5B,OAAO,MAAiD;EACtD,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAQ,EAAmB,GAC3B,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM,IAErB,IAAa,KAAK,UAAU;GAChC;GACA;GACA;GACA;EACF,CAAC,GACK,IACJ,EAA2B,QAAQ,IAAI,CAAU;EACnD,IAAI,GAAiB,OAAO;EAC5B,IAAM,UAAyB;GAC7B,IAAM,IAAU,EAAa,SAAS;GACtC,OACE,EAAuB,MAAM,KAC7B,EAAQ,MAAM,OAAO,KACrB,EAAmB,MAAM,KACzB,EAAQ,0BAA0B;EAEtC;EAKA,IAAI,CAAC,GACH,OAAO,CAAC;EAIV,AADA,EAAM,qBAAqB,EAAI,GAC/B,EAAS,IAAI;EAGb,IAAM,KAAgB,YAAY;GAChC,IAAI;IACF,IAAM,IAAS,MAAM,EAAsC;KACzD,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;IACX,CAAC;IACD,IAAI,CAAC,EAAiB,GAAG,OAAO,CAAC;IASjC,IANI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,CAC9B,IAGE,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;KAKlD,MAJI,EAAmB,EAAO,MAAM,IAC5B,IAAI,EAAU,CAAY,KAElC,QAAQ,MAAM,+BAA+B,EAAO,MAAM,GAChD,MAAM,CAAY;IAC9B;IAWA,IAAM,KADqB,EAAO,MAAM,YAAY,SAAS,CAAC,GAC7C,QAAQ,MAAM,EAAE,mBAAmB,CAAc;IAElE,OADA,EAAM,cAAc,CAAE,GACf;GACT,SAAS,GAAK;IACZ,IAAI,CAAC,EAAiB,KAAK,aAAe,GACxC,OAAO,CAAC;IAEV,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;IAGvC,OAFA,QAAQ,MAAM,+BAA+B,CAAG,GAChD,EAAS,CAAO,GACT,CAAC;GACV,UAAU;IAER,AADI,EAAiB,KAAG,EAAM,qBAAqB,EAAK,GACxD,EAA2B,QAAQ,OAAO,CAAU;GACtD;EACF,GAAG;EAGH,OADA,EAA2B,QAAQ,IAAI,GAAY,CAAY,GACxD;CACT,GACA,CAAC,CAAa,CAChB,GAMM,IAAsB,EAC1B,OACE,GACA,GACA,GAKA,MAMI;EACJ,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAgB;GACpB,EAAM;GACN,EAAM;GACN,EAAM;EACR,GACM,IAAgB,EAAyB;GAC7C;GACA,aAAa,KAAe;EAC9B,CAAC,GACK,IAAY,EAAmB,GAC/B,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM;EAG3B,IAAI,CAAC,GACH,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkC;EAGpE,EAAS,IAAI;EAEb,IAAI;GACF,IAAM,IAAS,MAAM,EAElB;IACD,SAAS;IACT,OAAO;IACP,WAAW,EACT,OAAO;KACL;KACA,GAAI,KAAe,EAAE,eAAY;KACjC,GAAI,KAAa,EAAE,aAAU;IAC/B,EACF;IACA;IACA,SAAS;IACT;GACF,CAAC;GAED,IAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;IAIlD,OAHK,EAAmB,EAAO,MAAM,KACnC,QAAQ,MAAM,oCAAoC,EAAO,MAAM,GAE1D;KAAE,SAAS;KAAO,OAAO;IAAa;GAC/C;GAEA,IAAM,IAAc,EAAO,MAAM;GAEjC,IAAI,GAAa,WAAW,EAAY,OAAO;IAC7C,IAAM,IAAS,EAAa,SAAS;IACrC,IACE,EAAuB,MAAM,KAC7B,EAAa,SAAS,EAAE,MAAM,OAAO,KACrC,EAAmB,MAAM,KACzB,EAAc,MACX,GAAO,MACN,MACA;KACE,EAAO;KACP,EAAO;KACP,EAAO;IACT,EAAE,EACN,KACA,EAAyB;KACvB;KACA,aAAa,KAAe;IAC9B,CAAC,MAAM,KACP,CAAC,EAAgC,EAAY,OAAO;KAClD;KACA;KACA;KACA;IACF,CAAC,GAED,OAAO;KACL,SAAS;KACT,OAAO;IACT;IAEF,IAAM,IAAe,EAAY,eAAe;IAKhD,OAJI,KACF,EAAM,sBAAsB,CAAY,GAE1C,EAAM,kBAAkB,EAAY,KAAK,GAClC;KACL,SAAS;KACT,OAAO,EAAY;KACnB,qBAAqB,KAAgB,KAAA;IACvC;GACF;GAEA,OAAO;IACL,SAAS;IACT,OACE,GAAa,OAAO,WAAW;GACnC;EACF,SAAS,GAAK;GACZ,IAAM,IACJ,aAAe,QACX,EAAI,UACJ;GAGN,OAFA,QAAQ,MAAM,oCAAoC,CAAG,GACrD,EAAS,CAAO,GACT;IAAE,SAAS;IAAO,OAAO;GAAQ;EAC1C;CACF,GACA,CAAC,CAAgB,CACnB,GAMM,IAAgB,EAAY,YAAgC;EAChE,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAY,EAAmB,GAC/B,IAAU,EAAM,gBAChB,IAAc,EAAM,oBACpB,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM,IACrB,IAAiB,EAAM,uBACvB,IAAY,EAAM,kBAClB,IAAO,EAAyB;GAAE;GAAgB;EAAY,CAAC,GAC/D,UAAyB;GAC7B,IAAM,IAAU,EAAa,SAAS;GACtC,OACE,EAAuB,MAAM,KAC7B,EAAQ,MAAM,OAAO,KACrB,EAAmB,MAAM,KACzB,EAAQ,mBAAmB,KAC3B,EAAQ,0BAA0B,KAClC,EAAQ,uBAAuB,KAC/B,EAAQ,qBAAqB,KAC7B,EAAyB;IAAE;IAAgB;GAAY,CAAC,MAAM;EAElE;EAWA,IARI,CAAC,KAID,CAAC,KAID,CAAC,GACH,OAAO,CAAC;EAIV,AADA,EAAM,mBAAmB,EAAI,GAC7B,EAAS,IAAI;EAEb,IAAI;GACF,IAAM,IAAS,MAAM,EAA+B;IAClD,SAAS;IACT,OAAO;IACP;IACA,gBAAgB;IAChB,SAAS;GACX,CAAC;GAED,IAAI,CAAC,EAAiB,GAAG,OAAO,CAAC;GAEjC,IAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;IAKlD,MAJI,EAAmB,EAAO,MAAM,IAC5B,IAAI,EAAU,CAAY,KAElC,QAAQ,MAAM,6BAA6B,EAAO,MAAM,GAC9C,MAAM,CAAY;GAC9B;GAEA,IAAM,IAAmB,EAAO,MAAM,UAAU,SAAS,CAAC;GAE1D,OADA,EAAM,YAAY,CAAK,GAChB;EACT,SAAS,GAAK;GACZ,IAAI,aAAe,GACjB,OAAO,CAAC;GAEV,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;GAGvC,OAFA,QAAQ,MAAM,6BAA6B,CAAG,GAC9C,EAAS,CAAO,GACT,CAAC;EACV,UAAU;GACR,EAAM,mBAAmB,EAAK;EAChC;CACF,GAAG,CAAC,CAAgB,CAAC,GAMf,KAAqB,EACzB,OAAO,MAA4C;EACjD,IAAM,IAAQ,EAAa,SAAS;EASpC,OAPA,EAAM,sBAAsB,IAAI,GAChC,EAAM,kBAAkB,IAAI,GAC5B,EAAM,YAAY,CAAC,CAAC,GACpB,EAAM,oBAAoB,IAAI,GAC9B,EAAM,yBAAyB,EAAI,EAAE,GAG9B,MADU,EAAsB,EAAI,EAAE;CAE/C,GACA,CAAC,CAAqB,CACxB,GAEM,KAAkB,EACtB,OACE,MAKI;EACJ,IAAM,IAAQ,EAAa,SAAS;EAKpC,IAHA,EAAM,oBAAoB,IAAI,GAC9B,EAAM,YAAY,CAAC,CAAC,GAEhB,CAAC,EAAU,gBAEb,OADA,QAAQ,MAAM,qCAAqC,CAAS,GACrD;GACL,SAAS;GACT,OAAO;EACT;EAGF,IAAM,IAAc,MAAM,EACxB,EAAU,gBACV,EAAU,IACV,KAAA,GACA,EAAU,QACZ;EAEA,IAAI,CAAC,EAAY,SACf,OAAO;GAAE,SAAS;GAAO,OAAO,EAAY;EAAM;EAGpD,IAAM,IAAW,EAAa,SAAS,GACjC,IAAY,EAAuB,GACnC,IAAS,EAAS,MAAM,IACxB,IAAc,EAAmB,GACjC,IAAiB,EAAS,gBAC1B,IAAY,EAAS,kBACrB,IAAO,EAAyB;GACpC,gBAAgB,EAAU;GAC1B,aAAa,EAAU;EACzB,CAAC,GACK,UAAyB;GAC7B,IAAM,IAAU,EAAa,SAAS;GACtC,OACE,EAAuB,MAAM,KAC7B,EAAQ,MAAM,OAAO,KACrB,EAAmB,MAAM,KACzB,EAAQ,mBAAmB,KAC3B,EAAQ,0BAA0B,EAAU,kBAC5C,EAAQ,uBAAuB,EAAU,MACzC,EAAQ,qBAAqB,KAC7B,EAAyB;IACvB,gBAAgB,EAAU;IAC1B,aAAa,EAAU;GACzB,CAAC,MAAM;EAEX,GACM,IAAQ,MAAM,EAAc;EAclC,OAbK,EAAiB,KAIpB,EAAM,SAAS,KACf,CAAC,EAAyB;GACxB,gBAAgB,EAAU;GAC1B,aAAa,EAAU;EACzB,CAAC,KAED,EAAM,oBAAoB,EAAM,GAAI,EAAE,GAGjC;GAAE,SAAS;GAAM,UAAU;EAAM,KAZ/B;GAAE,SAAS;GAAO,OAAO;EAAmC;CAavE,GACA,CAAC,GAAqB,CAAa,CACrC,GAEM,KAAgB,GAAa,MAA2B;EAC5D,IAAM,IAAQ,EAAa,SAAS;EAMpC,AALA,EAA4B;GAC1B,gBAAgB,EAAM;GACtB,aAAa,EAAM;EACrB,CAAC,GACD,EAAM,oBAAoB,EAAQ,EAAE,GAElC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa,EAAM;GACnB,gBAAgB,EAAM;GACtB,WAAW,EAAQ;EACrB,CAAC,KAED,EAAM,kBAAkB,IAAI;CAEhC,GAAG,CAAC,CAAC,GAEC,KAAsB,QAAwB;EAClD,IAAM,IAAQ,EAAa,SAAS,GAC9B,IAAQ;GACZ,gBAAgB,EAAwB;GACxC,aAAa,EAAqB;EACpC;EACA,IACE,CAAC,EAAM,kBACP,CAAC,EAAM,eACP,EAAM,0BAA0B,EAAM,kBACtC,EAAM,uBAAuB,EAAM,aAEnC,MAAU,MAAM,oCAAoC;EAEtD,IAAI,CAAC,EAA8B,CAAK,GACtC,MAAU,MAAM,8CAA8C;EAGhE,AAFA,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,GAC5B,EAAiB,EAAE,WAAW,KAAK,CAAC;CACtC,GAAG,CAAC,CAAgB,CAAC;CA+FrB,OAtFA,QAAgB;EACd,IAAI,IAAY,IAMV,KAAwB,MAAgC;GAC5D,IAAI,IAAU,IACV,IAAS,IACP,UAAgB;IAChB,QACJ;SAAI,GAAS;MACX,IAAS;MACT;KACF;KAEA,AADA,IAAU,IACV,EAAS,EAAE,cAAc;MAEvB,AADA,IAAU,IACN,CAAC,KAAa,MAChB,IAAS,IACT,EAAQ;KAEZ,CAAC;IARD;GASF;GACA,OAAO;EACT,GAEM,IAAkB,QAA2B,EAAc,CAAC,GAC5D,IAAoB,QAA2B;GACnD,IAAM,IAAQ,EAAa,SAAS,EAAE;GACtC,OAAO,IAAQ,EAAsB,CAAK,IAAI,QAAQ,QAAQ;EAChE,CAAC,GAGK,IAAc,EAAS,OAAO,MAAU;GAE5C,IAAM,IAAoB,EAAM;GAEhC,IAAI,EAAuB,IAAI,CAAS,GAAG;IACzC,IAAM,IAAmB,EAAqB,EAAM,OAAO,GACrD,EAAE,0BAAuB,EAAa,SAAS;IAGrD,IACE,KACA,KACA,MAAqB,GAErB;IAMF,EAAgB;IAChB;GACF;GAEA,AAAI,EAAyB,IAAI,CAAS,KACxC,EAAkB;EAEtB,CAAC;EAED,aAAa;GAEX,AADA,IAAY,IACZ,EAAY;EACd;CACF,GAAG;EAAC;EAAU;EAAe;CAAqB,CAAC,GAkB5C;EACL;EACA;EACA;EAEA;EACA;EACA;EAEA,qBArB0B,EAAc,MACvC,MAAQ,EAAI,OAAO,CAoBpB;EACA,kBAnBuB,EAAW,MACjC,MAAO,EAAG,OAAO,CAkBlB;EACA,gBAjBqB,GAAS,MAAM,MAAS,EAAK,OAAO,EAiBzD;EAEA;EAEA;EACA;EACA;EACA,WACE,KAA0B,KAAuB;EAEnD;EAEA;EACA;EACA;EACA;EAEA;EACA;EACA;EACA,qBAAA;CACF;AACF;AAkBA,SAAgB,EACd,GACA;CACA,IAAM,IAAwB,GAC3B,MAAU,EAAM,qBACnB,GACM,IAAa,GAAc,MAAU,EAAM,UAAU,GACrD,IAAc,GAAc,MAAU,EAAM,WAAW,GACvD,IAAsB,GACzB,MAAU,EAAM,mBACnB,GACM,IAAmB,EAAuB,GAC1C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IAAuB,GAAS,wBAAwB;CAE9D,QAAgB;EAGd,IAFI,KAEA,CAAC,KAAyB,CAAC,KAAe,GAAqB;EAGnE,IAAM,IAAwB,EAAW,MACtC,MAAO,EAAG,mBAAmB,CAChC;EAIA,IAAI,EAAW,SAAS,KAAK,CAAC,GAAuB;GACnD,IAAM,IAAQ,EAAa,SAAS;GAIpC,AAHA,EAAM,qBAAqB,EAAI,GAG/B,EAAsC;IACpC,SAAS;IACT,OAAO;IACP,WAAW;IACX,SAAS;GACX,CAAC,EACE,MAAM,MAAW;IAQhB,IALI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,CAC9B,IAEE,CAAC,EAAO,QAAQ,QAAQ;KAK1B,IAAM,KAJqB,EAAO,MAAM,YAAY,SAAS,CAAC,GAI7C,QACd,MAAM,EAAE,mBAAmB,CAC9B;KACA,EAAM,cAAc,CAAE;IACxB;GACF,CAAC,EACA,YAAY,CAEb,CAAC,EACA,cAAc;IACb,EAAM,qBAAqB,EAAK;GAClC,CAAC;EACL;CACF,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH;AAoBA,SAAgB,EAAqB,GAAyC;CAC5E,IAAM,IAAqB,GAAc,MAAU,EAAM,kBAAkB,GACrE,IAAwB,GAC3B,MAAU,EAAM,qBACnB,GACM,IAAa,GAAc,MAAU,EAAM,UAAU,GACrD,IAAW,GAAc,MAAU,EAAM,QAAQ,GACjD,IAAmB,GAAc,MAAU,EAAM,gBAAgB,GACjE,IAAiB,GAAc,MAAU,EAAM,cAAc,GAC7D,IAAc,GAAc,MAAU,EAAM,WAAW,GACvD,IAAmB,EAAuB,GAC1C,IACJ,GAAS,oBAAoB,EAAiB,kBAC1C,IAAqB,GAAS,sBAAsB,IACpD,IAAmB,GAAS,oBAAoB,IAOhD,IAAoB,EAAO,EAAK,GAChC,CAAC,GAAc,KAAmB,EAAS,CAAC,GAC5C,IAAyB,EAGrB,IAAI,GAIR,IAAgB,kBACpB,IAAI,IAAI,CACV,GAUM,IAAyB,kBAE7B,IAAI,IAAI,CAAC,GAEL,IAAmC;CA2SzC,AA1SA,QAAgB;EAMd,IALI,KAEA,CAAC,KAAsB,CAAC,KAGxB,EAAkB,SAAS;EAO/B,IAAM,IAAe,EAAuB,QAAQ,IAAI,CAAkB;EAC1E,IACE,KACA,EAAa,SAAS,KACtB,KAAK,IAAI,IAAI,EAAa,gBAAgB,GAE1C;EAEF,AACE,KACA,KAAK,IAAI,IAAI,EAAa,iBACxB,KAGF,EAAuB,QAAQ,OAAO,CAAkB;EAQ1D,IAAM,IAAmB,EAAW,MACjC,MAAO,EAAG,OAAO,CACpB;EAGA,IACE,KACA,KACA,EAAiB,mBAAmB,GAEpC;EAGF,IAAM,IACJ,GAAkB,kBAAkB;EACtC,IAAI,CAAC,GAAgB;EAErB,IAAM,IAAQ,EAAa,SAAS;EACpC,AACE,KACA,EAAY,SAAS,MAAM,KAC3B,EAAY,WAAW,MAAM,KAC7B,EAAY,KAAK,MAAM,KAEvB,EAA4B;GAC1B;GACA,aAAa;EACf,CAAC;EAEH,IAAM,IAAY,EAAuB,GACnC,IAAS,EAAM,MAAM,IACrB,IAAgB,EAAyB;GAC7C;GACA,aAAa;EACf,CAAC;EACD,IAAI,KAAiB,EAAM,kBAAkB;GAE3C,AADA,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI;GAC5B;EACF;EAGA,IAAM,IACJ,CAAC,KACD,EAAe,CAAc,KAC7B,CAAC,EAAgC,GAAgB;GAC/C,aAAa;GACb,gBAAgB;GAChB,WAAW;GACX;EACF,CAAC,GAGG,IAAW,KAAK,UAAU;GAC9B;GACA;GACA;GACA;GACA;EACF,CAAC,GACK,IACJ,EAAS,MAAM,MAAM,EAAE,gBAAgB,CAAkB,KACxD,EAAuB,SAAS,aAAa,KAC5C,EAAuB,QAAQ,aAAa;EAChD,IAAI,KAA2B,CAAC,GAAY;GAC1C,IAAI,CAAC,EAAM,oBAAoB,CAAC,GAAe;IAC7C,IAAM,IAAe,EAAS,MAC3B,MAAY,EAAQ,gBAAgB,CACvC;IACA,AAAI,KACF,EAAM,oBAAoB,EAAa,EAAE;GAE7C;GACA;EACF;EAEA,IAAM,UAA4B;GAChC,IAAM,IAAS,EAAa,SAAS;GACrC,OACE,EAAO,gBAAgB,KACvB,EAAO,MAAM,OAAO,KACpB,EAAuB,MAAM,KAC7B,EAAO,0BAA0B,KACjC,EAAO,uBAAuB,KAC9B,EAAO,qBAAqB,KAC5B,EAAyB;IACvB;IACA,aAAa;GACf,CAAC,MAAM;EAEX,GAEM,IAAe,YAAY;GAE/B,AADA,EAAkB,UAAU,IAC5B,EAAM,mBAAmB,EAAI;GAC7B,IAAI,IAAY;GAEhB,IAAI;IACF,IAAI,IAAU;IAGd,IAAI,GAAY;KACd,IAAM,IAAc,MAAM,EAEvB;MACD,SAAS;MACT,OAAO;MACP,WAAW,EACT,OAAO;OACL;OACA,aAAa;OACb,GAAI,IAAmB,EAAE,WAAW,EAAiB,IAAI,CAAC;MAC5D,EACF;MACA,WAAW;MACX,SAAS;MAGT,UAAU,EAAW,MAAM,MAAO,EAAG,OAAO,CAAkB,GAC1D;KACN,CAAC;KAED,IACE,EAAY,MAAM,qBAAqB,WACvC,EAAY,KAAK,oBAAoB,OACrC;MAEA,IADA,IAAU,EAAY,KAAK,oBAAoB,OAE7C,CAAC,EAAoB,KACrB,CAAC,EAAgC,GAAS;OACxC,aAAa;OACb;OACA,WAAW;OACX;MACF,CAAC,GAED;MACF,EAAM,kBAAkB,CAAO;KACjC,OACE;IAEJ;IAGA,IAAI,KAAW,CAAC,KAA2B,CAAC,GAAkB;KAC5D,IAAM,IAAiB,MAAM,EAA+B;MAC1D,SAAS;MACT,OAAO;MACP,WAAW;MACX,gBAAgB;MAChB,SAAS;KACX,CAAC;KAED,IAAI,CAAC,EAAoB,KAAK,EAAe,QAAQ,QACnD;KAGF,IAAM,IAAmB,EAAe,MAAM,UAAU,SAAS,CAAC;KAmBlE,AAfA,EAAuB,UACrB,EAAM,WAAW,IAAI;MAAE;MAAU,UAAU;KAAM,IAAI,MACvD,EAAM,YAAY,CAAK,GAKrB,KACA,CAAC,EAAM,MAAM,MAAY,EAAQ,OAAO,CAAgB,MAExD,EAAM,oBAAoB,IAAI,GAC9B,EAAM,kBAAkB,IAAI,IAK5B,EAAM,SAAS,KACf,CAAC,EAAa,SAAS,EAAE,oBACzB,CAAC,EAAyB;MACxB;MACA,aAAa;KACf,CAAC,KAED,EAAM,oBAAoB,EAAM,GAAG,EAAE;IAEzC;IAEA,IAAY;GACd,QAAQ,CAER,UAAU;IAER,AADA,EAAM,mBAAmB,EAAK,GAC9B,EAAkB,UAAU;IAC5B,IAAM,IAAe,EAAoB;IACzC,AAAK,KAAc,GAAiB,MAAa,IAAW,CAAC;IAC7D,IAAM,IAAW,EAAuB;IACxC,IAAI,KAAgB,GAAW;KAC7B,EAAS,OAAO,CAAkB;KAClC,IAAM,IAAU,EAAc,QAAQ,IAAI,CAAkB;KAC5D,AAAI,MACF,aAAa,CAAO,GACpB,EAAc,QAAQ,OAAO,CAAkB;IAEnD,OAAO,IAAI,GAAc;KAEvB,IAAM,KADW,EAAS,IAAI,CACX,GAAU,SAAS,KAAK;KAU3C,IATA,EAAS,IAAI,GAAoB;MAC/B,OAAO;MACP,eAAe,KAAK,IAAI;KAC1B,CAAC,GAMG,IAAY,GAA2B;MACzC,IAAM,IAAgB,EAAc,QAAQ,IAAI,CAAkB;MAClE,AAAI,KAAe,aAAa,CAAa;MAC7C,IAAM,IAAY,KAAK,IAAI,MAAO,MAAM,IAAY,IAAI,GAAI,GACtD,IAAQ,iBAAiB;OAC7B,EAAc,QAAQ,OAAO,CAAkB;OAG/C,IAAM,IAAS,EAAa,SAAS;OACrC,AACE,EAAoB,KACpB,EAAO,uBAAuB,KAC9B,CAAC,EAAO,SAAS,MACd,MAAM,EAAE,gBAAgB,CAC3B,KACA,CAAC,EAAkB,WAMnB,EAAkB;MAEtB,GAAG,CAAS;MACZ,EAAc,QAAQ,IAAI,GAAoB,CAAK;KACrD;IACF;GACF;EACF;EAEA,EAAa;CACf,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,GAID,QAAgB;EACd,IAAM,IAAS,EAAc;EAC7B,aAAa;GAEX,AADA,EAAO,SAAS,MAAU,aAAa,CAAK,CAAC,GAC7C,EAAO,MAAM;EACf;CACF,GAAG,CAAC,CAAC;AACP"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@burdenoff/microfe-auth",
3
- "version": "2026.1014.1",
3
+ "version": "2026.1014.2",
4
4
  "description": "Auth microfrontend for Burdenoff products",
5
5
  "type": "module",
6
6
  "imports": {