@burdenoff/microfe-auth 2026.510.127

package/dist/auth/hooks/useAuthPermissions.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Hook for auth admin RBAC permissions.
+ *
+ * Only covers admin-facing operations. Public auth flows and self-service
+ * operations don't need RBAC checks — they're either @rbac(public: true)
+ * or scoped to the current user's own data.
+ */
+export declare function useAuthPermissions(): {
+    canViewUsers: boolean;
+    canUpdateUsers: boolean;
+    canDeleteUsers: boolean;
+    canViewApps: boolean;
+    canCreateApps: boolean;
+    canUpdateApps: boolean;
+    canManageSsoConfig: boolean;
+    canManageOidcConfig: boolean;
+    canManageAuthMethods: boolean;
+    isLoading: boolean;
+};
+//# sourceMappingURL=useAuthPermissions.d.ts.map

package/dist/auth/hooks/useAuthPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthPermissions.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthPermissions.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,wBAAgB,kBAAkB;;;;;;;;;;;EAuBjC"}

package/dist/auth/hooks/useAuthPermissions.js

@@ -0,0 +1,22 @@
+import { AUTH_PERMISSIONS as e } from "../constants/permissions.js";
+import { usePermissions as t } from "@burdenoff/fe-libs/shared/providers/shell";
+//#region src/auth/hooks/useAuthPermissions.ts
+function n() {
+	let { hasPermission: n, isLoading: r } = t();
+	return {
+		canViewUsers: n(e.USER_READ),
+		canUpdateUsers: n(e.USER_UPDATE),
+		canDeleteUsers: n(e.USER_DELETE),
+		canViewApps: n(e.APP_READ),
+		canCreateApps: n(e.APP_CREATE),
+		canUpdateApps: n(e.APP_UPDATE),
+		canManageSsoConfig: n(e.SSO_CONFIG_MANAGE),
+		canManageOidcConfig: n(e.OIDC_CONFIG_MANAGE),
+		canManageAuthMethods: n(e.AUTH_METHOD_UPDATE),
+		isLoading: r
+	};
+}
+//#endregion
+export { n as useAuthPermissions };
+
+//# sourceMappingURL=useAuthPermissions.js.map

package/dist/auth/hooks/useAuthPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthPermissions.js","names":[],"sources":["../../../src/auth/hooks/useAuthPermissions.ts"],"sourcesContent":["import { usePermissions } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { AUTH_PERMISSIONS } from \"../constants/permissions\";\n\n/**\n * Hook for auth admin RBAC permissions.\n *\n * Only covers admin-facing operations. Public auth flows and self-service\n * operations don't need RBAC checks — they're either @rbac(public: true)\n * or scoped to the current user's own data.\n */\nexport function useAuthPermissions() {\n  const { hasPermission, isLoading } = usePermissions();\n\n  return {\n    // User management (admin pages)\n    canViewUsers: hasPermission(AUTH_PERMISSIONS.USER_READ),\n    canUpdateUsers: hasPermission(AUTH_PERMISSIONS.USER_UPDATE),\n    canDeleteUsers: hasPermission(AUTH_PERMISSIONS.USER_DELETE),\n\n    // OAuth app management\n    canViewApps: hasPermission(AUTH_PERMISSIONS.APP_READ),\n    canCreateApps: hasPermission(AUTH_PERMISSIONS.APP_CREATE),\n    canUpdateApps: hasPermission(AUTH_PERMISSIONS.APP_UPDATE),\n\n    // SSO/OIDC configuration\n    canManageSsoConfig: hasPermission(AUTH_PERMISSIONS.SSO_CONFIG_MANAGE),\n    canManageOidcConfig: hasPermission(AUTH_PERMISSIONS.OIDC_CONFIG_MANAGE),\n\n    // Auth method configuration\n    canManageAuthMethods: hasPermission(AUTH_PERMISSIONS.AUTH_METHOD_UPDATE),\n\n    isLoading,\n  };\n}\n"],"mappings":";;;AAUA,SAAgB,IAAqB;CACnC,IAAM,EAAE,kBAAe,iBAAc,GAAgB;AAErD,QAAO;EAEL,cAAc,EAAc,EAAiB,UAAU;EACvD,gBAAgB,EAAc,EAAiB,YAAY;EAC3D,gBAAgB,EAAc,EAAiB,YAAY;EAG3D,aAAa,EAAc,EAAiB,SAAS;EACrD,eAAe,EAAc,EAAiB,WAAW;EACzD,eAAe,EAAc,EAAiB,WAAW;EAGzD,oBAAoB,EAAc,EAAiB,kBAAkB;EACrE,qBAAqB,EAAc,EAAiB,mBAAmB;EAGvE,sBAAsB,EAAc,EAAiB,mBAAmB;EAExE;EACD"}

package/dist/auth/hooks/useCaptchaV3.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Hook for reCAPTCHA v3 invisible verification.
+ * Returns a no-op when VITE_CAPTCHA_ENABLED is not "true".
+ *
+ * When enabled, dynamically imports `react-google-recaptcha-v3` and uses
+ * the `useGoogleReCaptcha` hook from the `GoogleReCaptchaProvider` context.
+ * The provider must be mounted above this hook in the component tree
+ * (handled by CaptchaProvider in AuthRoot).
+ */
+export declare function useCaptchaV3(): {
+    executeRecaptcha: (action: string) => Promise<string | undefined>;
+};
+//# sourceMappingURL=useCaptchaV3.d.ts.map

package/dist/auth/hooks/useCaptchaV3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCaptchaV3.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useCaptchaV3.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,wBAAgB,YAAY;+BAaT,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;EA8BtD"}

package/dist/auth/hooks/useCaptchaV3.js

@@ -0,0 +1,19 @@
+import { isCaptchaEnabled as e, requireRecaptchaSiteKey as t } from "../utils/captchaConfig.js";
+import { useCallback as n, useEffect as r } from "react";
+//#region src/auth/hooks/useCaptchaV3.ts
+function i() {
+	return r(() => {
+		e() && import("../../node_modules/react-google-recaptcha-v3/dist/react-google-recaptcha-v3.esm.js").catch(() => {
+			console.warn("[captcha-v3] Failed to load react-google-recaptcha-v3");
+		});
+	}, []), { executeRecaptcha: n(async (n) => {
+		if (!e()) return;
+		let r = t(), i = window.grecaptcha;
+		if (i?.execute) return i.execute(r, { action: n });
+		console.warn("[captcha-v3] grecaptcha not yet available");
+	}, []) };
+}
+//#endregion
+export { i as useCaptchaV3 };
+
+//# sourceMappingURL=useCaptchaV3.js.map

package/dist/auth/hooks/useCaptchaV3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCaptchaV3.js","names":[],"sources":["../../../src/auth/hooks/useCaptchaV3.ts"],"sourcesContent":["import { useCallback, useEffect } from \"react\";\nimport {\n  isCaptchaEnabled,\n  requireRecaptchaSiteKey,\n} from \"../utils/captchaConfig\";\n\n/**\n * Hook for reCAPTCHA v3 invisible verification.\n * Returns a no-op when VITE_CAPTCHA_ENABLED is not \"true\".\n *\n * When enabled, dynamically imports `react-google-recaptcha-v3` and uses\n * the `useGoogleReCaptcha` hook from the `GoogleReCaptchaProvider` context.\n * The provider must be mounted above this hook in the component tree\n * (handled by CaptchaProvider in AuthRoot).\n */\nexport function useCaptchaV3() {\n  useEffect(() => {\n    if (!isCaptchaEnabled()) return;\n\n    // Dynamically import react-google-recaptcha-v3 so the provider's global\n    // grecaptcha object is initialized. We don't use the module export\n    // directly — execute() below reads from window.grecaptcha instead.\n    import(\"react-google-recaptcha-v3\").catch(() => {\n      console.warn(\"[captcha-v3] Failed to load react-google-recaptcha-v3\");\n    });\n  }, []);\n\n  const execute = useCallback(\n    async (action: string): Promise<string | undefined> => {\n      if (!isCaptchaEnabled()) {\n        return undefined;\n      }\n\n      const siteKey = requireRecaptchaSiteKey();\n\n      // Use the global grecaptcha object that GoogleReCaptchaProvider sets up\n      const grecaptcha = (window as unknown as Record<string, unknown>)[\n        \"grecaptcha\"\n      ] as\n        | {\n            execute?: (\n              siteKey: string,\n              options: { action: string },\n            ) => Promise<string>;\n          }\n        | undefined;\n\n      if (grecaptcha?.execute) {\n        return grecaptcha.execute(siteKey, { action });\n      }\n\n      console.warn(\"[captcha-v3] grecaptcha not yet available\");\n      return undefined;\n    },\n    [],\n  );\n\n  return { executeRecaptcha: execute };\n}\n"],"mappings":";;;AAeA,SAAgB,IAAe;AA0C7B,QAzCA,QAAgB;AACT,KAAkB,IAKvB,OAAO,sFAA6B,YAAY;AAC9C,WAAQ,KAAK,wDAAwD;IACrE;IACD,EAAE,CAAC,EAgCC,EAAE,kBA9BO,EACd,OAAO,MAAgD;AACrD,MAAI,CAAC,GAAkB,CACrB;EAGF,IAAM,IAAU,GAAyB,EAGnC,IAAc,OAClB;AAUF,MAAI,GAAY,QACd,QAAO,EAAW,QAAQ,GAAS,EAAE,WAAQ,CAAC;AAGhD,UAAQ,KAAK,4CAA4C;IAG3D,EAAE,CACH,EAEmC"}

package/dist/auth/hooks/useContextSwitcherData.d.ts

@@ -0,0 +1,106 @@
+import { Organization, Workspace, Project } from '../types';
+
+export interface UseContextSwitcherDataOptions {
+    /**
+     * Optional Global API Gateway base URL override.
+     * If not provided, uses GATEWAYS config from fe-libs.
+     */
+    globalBaseUrl?: string;
+    /**
+     * Optional Workspaces API Gateway base URL override.
+     * If not provided, uses GATEWAYS config from fe-libs.
+     */
+    workspaceBaseUrl?: string;
+    /** Disable initial organization/workspace bootstrap fetches */
+    disableBootstrap?: boolean;
+    /** Disable the workspace sync effect */
+    disableWorkspaceSync?: boolean;
+    /** Disable the project sync effect */
+    disableProjectSync?: boolean;
+    /** Only hydrate the workspace token; do not eagerly fetch projects */
+    skipProjectFetch?: boolean;
+}
+/**
+ * Hook for managing the context switcher data (organizations, workspaces, projects)
+ *
+ * Data flow:
+ * 1. fetchOrganizations() - Get all orgs user has access to (Global Gateway)
+ * 2. selectOrganization(org) - Set current org & fetch workspaces for that org
+ * 3. selectWorkspace(ws) - Issue workspace token & fetch projects
+ * 4. selectProject(proj) - Set current project
+ *
+ * All GraphQL calls go through graphqlFetch from fe-libs which automatically
+ * resolves gateway URLs and injects auth + locale headers.
+ *
+ * @param options - Optional configuration (gateway base URL overrides)
+ */
+export declare function useContextSwitcherData(options?: UseContextSwitcherDataOptions): {
+    organizations: Organization[];
+    workspaces: Workspace[];
+    projects: Project[];
+    currentOrganizationId: string | null;
+    currentWorkspaceId: string | null;
+    currentProjectId: string | null;
+    currentOrganization: Organization | undefined;
+    currentWorkspace: Workspace | undefined;
+    currentProject: Project | undefined;
+    workspaceToken: string | null;
+    isLoadingOrganizations: boolean;
+    isLoadingWorkspaces: boolean;
+    isLoadingProjects: boolean;
+    isLoading: boolean;
+    error: string | null;
+    fetchOrganizations: () => Promise<Organization[]>;
+    fetchWorkspacesForOrg: (organizationId: string) => Promise<Workspace[]>;
+    issueWorkspaceToken: (organizationId: string, workspaceId?: string) => Promise<{
+        success: boolean;
+        token?: string;
+        resolvedWorkspaceId?: string;
+        error?: string;
+    }>;
+    fetchProjects: () => Promise<Project[]>;
+    selectOrganization: (org: Organization) => Promise<Workspace[]>;
+    selectWorkspace: (workspace: Workspace) => Promise<{
+        success: boolean;
+        projects?: Project[];
+        error?: string;
+    }>;
+    selectProject: (project: Project) => void;
+};
+/**
+ * Hook to reactively ensure workspaces are synced with the current organization.
+ *
+ * This handles edge cases where the organization changes but workspaces
+ * from a different org are still in the store (e.g., stale data, race conditions).
+ *
+ * Usage:
+ * ```tsx
+ * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';
+ *
+ * function MyComponent() {
+ *   useWorkspaceSyncEffect(); // Ensures workspaces stay in sync
+ *   // ...
+ * }
+ * ```
+ */
+export declare function useWorkspaceSyncEffect(options?: UseContextSwitcherDataOptions): void;
+/**
+ * Hook to reactively ensure projects are loaded when a workspace is selected.
+ *
+ * This handles the case where a workspace is auto-selected (from URL/localStorage)
+ * but projects haven't been fetched yet. It will:
+ * 1. Issue a workspace token if not present
+ * 2. Fetch projects for the selected workspace
+ *
+ * Usage:
+ * ```tsx
+ * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';
+ *
+ * function MyComponent() {
+ *   useProjectSyncEffect(); // Ensures projects are loaded for selected workspace
+ *   // ...
+ * }
+ * ```
+ */
+export declare function useProjectSyncEffect(options?: UseContextSwitcherDataOptions): void;
+//# sourceMappingURL=useContextSwitcherData.d.ts.map

package/dist/auth/hooks/useContextSwitcherData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useContextSwitcherData.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useContextSwitcherData.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAOjE,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wCAAwC;IACxC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAiWD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,6BAA6B;;;;;;;;;;;;;;;;8BA0GU,OAAO,CAAC,YAAY,EAAE,CAAC;4CAmT/C,MAAM,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;0CAoElC,MAAM,gBACR,MAAM,KACnB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;yBAuEwC,OAAO,CAAC,OAAO,EAAE,CAAC;8BA8DhD,YAAY,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;iCAiBlC,SAAS,KACnB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;6BAiDwC,OAAO,KAAG,IAAI;EAqD3D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,6BAA6B,QA4DxC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,6BAA6B,QAoR3E"}

package/dist/auth/hooks/useContextSwitcherData.js

@@ -0,0 +1,466 @@
+import { useAuthStore as e } from "../store/authStore.js";
+import { resolveGatewayBaseUrls as t } from "../utils/gatewayBaseUrls.js";
+import { useCallback as n, useEffect as r, useRef as i, useState as a } from "react";
+import { getStoredAuthToken as o, graphqlFetch as s } from "@burdenoff/fe-libs/shared/graphql";
+import { useActiveContext as c } from "@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider";
+//#region src/auth/hooks/useContextSwitcherData.ts
+var l = "\n  query MyOrganizations {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", u = "\n  query WorkspacesByOrg($filter: WorkspaceFilterInput) {\n    workspaces(filter: $filter) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", d = "\n  query ContextSwitcherBootstrap($filter: WorkspaceFilterInput) {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n    workspaces(filter: $filter) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", f = "\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      expiresAt\n      organizationId\n      workspaceId\n      projectId\n      scopes\n      error {\n        code\n        message\n      }\n    }\n  }\n", p = "\n  query Projects($filter: ProjectFilterInput) {\n    projects(filter: $filter) {\n      total\n      items {\n        id\n        name\n        key\n        workspaceId\n        status\n        archived\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", m = "\n  mutation CreateDefaultProject($input: CreateProjectInput!) {\n    createProject(input: $input) {\n      id\n      name\n      key\n      workspaceId\n      status\n      archived\n      createdAt\n      updatedAt\n    }\n  }\n";
+async function h({ authToken: e, workspaceBaseUrl: t, workspaceToken: n }) {
+	let r = await s({
+		gateway: "workspace",
+		query: m,
+		variables: { input: { name: "Default Project" } },
+		authToken: e,
+		workspaceToken: n,
+		baseUrl: t
+	});
+	return r.errors?.length ? (console.warn("Failed to create default project:", r.errors), null) : r.data?.createProject ?? null;
+}
+function g(e, t = 3e4) {
+	try {
+		let n = JSON.parse(atob(e.split(".")[1]));
+		return n.exp ? n.exp * 1e3 < Date.now() + t : !1;
+	} catch {
+		return !0;
+	}
+}
+function _(e) {
+	try {
+		let t = JSON.parse(atob(e.split(".")[1]));
+		return {
+			workspaceId: typeof t.workspaceId == "string" ? t.workspaceId : void 0,
+			organizationId: typeof t.organizationId == "string" ? t.organizationId : void 0,
+			exp: typeof t.exp == "number" ? t.exp : void 0
+		};
+	} catch {
+		return null;
+	}
+}
+function v(e, t) {
+	if (!e || g(e)) return !1;
+	let n = _(e);
+	return !(!n || t.workspaceId && n.workspaceId !== t.workspaceId || t.organizationId && n.organizationId !== t.organizationId);
+}
+var y = class extends Error {
+	constructor(e) {
+		super(e), this.name = "AuthError";
+	}
+};
+function b(e) {
+	return e.some((e) => e.extensions?.code === "UNAUTHENTICATED" || e.message?.toLowerCase().includes("unauthorized") || e.message?.toLowerCase().includes("not authenticated"));
+}
+function x() {
+	let t = e.getState().accessToken;
+	if (t && !g(t)) return t;
+	let n = o();
+	return n && !g(n) ? n : t;
+}
+function S(e) {
+	return Array.from(new Set(e.map((e) => e.organizationId).filter(Boolean))).map((t, n) => ({
+		id: t,
+		name: e.find((e) => e.organizationId === t)?.name || `Organization ${n + 1}`,
+		slug: t,
+		tenantId: e.find((e) => e.organizationId === t)?.tenantId || ""
+	}));
+}
+function C(o) {
+	let { organizationId: m, workspaceId: _, projectId: C, setContext: w } = c(), T = e((e) => e.organizations), E = e((e) => e.currentOrganizationId), D = e((e) => e.isLoadingOrganizations), O = e((e) => e.workspaces), k = e((e) => e.currentWorkspaceId), A = e((e) => e.workspaceToken), j = e((e) => e.isLoadingWorkspaces), M = e((e) => e.projects), N = e((e) => e.currentProjectId), P = e((e) => e.isLoadingProjects), [F, I] = a(null), L = i(null), R = i(/* @__PURE__ */ new Map()), z = i(_), B = i(m);
+	r(() => {
+		z.current = _, B.current = m;
+	});
+	let V = t(), H = o?.globalBaseUrl ?? V.globalBaseUrl, U = o?.workspaceBaseUrl ?? V.workspaceBaseUrl;
+	r(() => {
+		let t = e.getState();
+		m && m !== t.currentOrganizationId && (t.setCurrentOrganizationId(m), t.workspaces.length > 0 && !t.workspaces.some((e) => e.organizationId === m) && t.setWorkspaces([])), _ && _ !== t.currentWorkspaceId && (t.setCurrentWorkspaceId(_), t.projects.length > 0 && !t.projects.some((e) => e.workspaceId === _) && (t.setProjects([]), t.setCurrentProjectId(null))), C && C !== t.currentProjectId && t.setCurrentProjectId(C), t.workspaceToken && !v(t.workspaceToken, {
+			workspaceId: _,
+			organizationId: m
+		}) && t.setWorkspaceToken(null);
+	}, [
+		m,
+		_,
+		C
+	]);
+	let W = n(async () => {
+		if (L.current) return L.current;
+		let t = e.getState(), n = x();
+		return !n || g(n) ? [] : (t.setLoadingOrganizations(!0), I(null), L.current = (async () => {
+			try {
+				let r = B.current ?? t.currentOrganizationId, i = await s({
+					gateway: "global",
+					query: r ? d : l,
+					variables: r ? { filter: { organizationId: r } } : void 0,
+					authToken: n,
+					baseUrl: H
+				});
+				if (r && i.errors?.length && i.errors.some((e) => e?.extensions?.code === "FORBIDDEN" || /not a member of this organization/i.test(e?.message ?? "") || /Cannot return null for non-nullable field Query\.myOrganizations/i.test(e?.message ?? "")) && (i = await s({
+					gateway: "global",
+					query: "\n              query ContextSwitcherRecover {\n                myOrganizations {\n                  total\n                  items { id name slug tenantId description logo website status type createdAt updatedAt }\n                }\n                workspaces {\n                  total\n                  items { id name slug tenantId organizationId type status region createdAt updatedAt }\n                }\n              }\n            ",
+					authToken: n,
+					baseUrl: H
+				})), i.errors?.length) {
+					let e = i.errors[0]?.message ?? "GraphQL error";
+					throw b(i.errors) ? new y(e) : (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", i.errors), Error(e));
+				}
+				let a = i.data?.myOrganizations?.items ?? [];
+				if (r && a.length === 0 && t.workspaces.length === 0) {
+					let e = await s({
+						gateway: "global",
+						query: l,
+						authToken: n,
+						baseUrl: H
+					});
+					e.errors?.length ? console.warn("[ContextSwitcher] Stale-context recovery failed:", e.errors) : (a = e.data?.myOrganizations?.items ?? [], i = {
+						...e,
+						data: { myOrganizations: e.data?.myOrganizations ?? {
+							items: [],
+							total: 0
+						} }
+					});
+				}
+				let o = a.length === 0 && t.workspaces.length > 0 ? S(t.workspaces) : [], c = o.length > 0 ? o : a;
+				t.setOrganizations(c);
+				let f = r, p = f && a.some((e) => e.id === f);
+				if (f && !p && a.length > 0 && (f = a[0].id, w({
+					organizationId: f,
+					workspaceId: null,
+					projectId: null
+				}), t.setWorkspaces([]), t.setProjects([]), t.setCurrentWorkspaceId(null), t.setCurrentProjectId(null), t.setWorkspaceToken(null)), f && f !== t.currentOrganizationId && t.setCurrentOrganizationId(f), c.length > 0 && !f && (t.setCurrentOrganizationId(c[0].id), f = c[0].id), f && e.getState().workspaces.length === 0) {
+					t.setLoadingWorkspaces(!0);
+					try {
+						let e = (r === f ? i.data?.workspaces?.items : void 0) || await s({
+							gateway: "global",
+							query: u,
+							variables: { filter: { organizationId: f } },
+							authToken: n,
+							baseUrl: H
+						}).then((e) => e.errors?.length ? null : e.data?.workspaces?.items ?? []);
+						if (e) {
+							t.setWorkspaces(e);
+							let n = z.current ? e.find((e) => e.id === z.current) : null;
+							n ? t.setCurrentWorkspaceId(n.id) : z.current && e.length > 0 ? (t.setCurrentWorkspaceId(e[0].id), t.setWorkspaceToken(null), w({
+								workspaceId: e[0].id,
+								projectId: null
+							})) : e.length > 0 && !t.currentWorkspaceId && t.setCurrentWorkspaceId(e[0].id);
+						}
+					} catch {} finally {
+						t.setLoadingWorkspaces(!1);
+					}
+				}
+				return c;
+			} catch (e) {
+				if (e instanceof y) return [];
+				let n = e instanceof Error ? e.message : "Failed to fetch organizations";
+				if (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", e), I(n), t.workspaces.length > 0) {
+					let e = S(t.workspaces);
+					if (e.length > 0) return t.setOrganizations(e), t.currentOrganizationId || t.setCurrentOrganizationId(e[0].id), e;
+				}
+				return [];
+			} finally {
+				t.setLoadingOrganizations(!1), L.current = null;
+			}
+		})(), L.current);
+	}, [H, w]), G = n(async (t) => {
+		let n = R.current.get(t);
+		if (n) return n;
+		let r = e.getState(), i = x();
+		if (!i || g(i)) return [];
+		r.setLoadingWorkspaces(!0), I(null);
+		let a = (async () => {
+			try {
+				let e = await s({
+					gateway: "global",
+					query: u,
+					variables: { filter: { organizationId: t } },
+					authToken: i,
+					baseUrl: H
+				});
+				if (e.errors?.length) {
+					let t = e.errors[0]?.message ?? "GraphQL error";
+					throw b(e.errors) ? new y(t) : (console.error("Failed to fetch workspaces:", e.errors), Error(t));
+				}
+				let n = e.data?.workspaces?.items ?? [];
+				return r.setWorkspaces(n), n;
+			} catch (e) {
+				if (e instanceof y) return [];
+				let t = e instanceof Error ? e.message : "Failed to fetch workspaces";
+				return console.error("Failed to fetch workspaces:", e), I(t), [];
+			} finally {
+				r.setLoadingWorkspaces(!1), R.current.delete(t);
+			}
+		})();
+		return R.current.set(t, a), a;
+	}, [H]), K = n(async (t, n) => {
+		let r = e.getState(), i = x();
+		if (!i || g(i)) return {
+			success: !1,
+			error: "No valid access token available"
+		};
+		I(null);
+		try {
+			let e = await s({
+				gateway: "workspace",
+				query: f,
+				variables: { input: {
+					organizationId: t,
+					...n && { workspaceId: n }
+				} },
+				authToken: i,
+				baseUrl: U
+			});
+			if (e.errors?.length) {
+				let t = e.errors[0]?.message ?? "GraphQL error";
+				return b(e.errors) || console.error("Failed to issue workspace token:", e.errors), {
+					success: !1,
+					error: t
+				};
+			}
+			let a = e.data?.issueWorkspaceToken;
+			if (a?.success && a.token) {
+				let e = a.workspaceId || n;
+				return e && r.setCurrentWorkspaceId(e), r.setWorkspaceToken(a.token), {
+					success: !0,
+					token: a.token,
+					resolvedWorkspaceId: e || void 0
+				};
+			}
+			return {
+				success: !1,
+				error: a?.error?.message ?? "Failed to issue workspace token"
+			};
+		} catch (e) {
+			let t = e instanceof Error ? e.message : "Failed to issue workspace token";
+			return console.error("Failed to issue workspace token:", e), I(t), {
+				success: !1,
+				error: t
+			};
+		}
+	}, [U]), q = n(async () => {
+		let t = e.getState(), n = x(), r = t.workspaceToken, i = t.currentWorkspaceId;
+		if (!n || g(n) || !r || !i) return [];
+		t.setLoadingProjects(!0), I(null);
+		try {
+			let e = await s({
+				gateway: "workspace",
+				query: p,
+				variables: { filter: { workspaceId: i } },
+				authToken: n,
+				workspaceToken: r,
+				baseUrl: U
+			});
+			if (e.errors?.length) {
+				let t = e.errors[0]?.message ?? "GraphQL error";
+				throw b(e.errors) ? new y(t) : (console.error("Failed to fetch projects:", e.errors), Error(t));
+			}
+			let a = e.data?.projects?.items ?? [];
+			return t.setProjects(a), a;
+		} catch (e) {
+			if (e instanceof y) return [];
+			let t = e instanceof Error ? e.message : "Failed to fetch projects";
+			return console.error("Failed to fetch projects:", e), I(t), [];
+		} finally {
+			t.setLoadingProjects(!1);
+		}
+	}, [U]), J = n(async (t) => {
+		let n = e.getState();
+		return n.setCurrentWorkspaceId(null), n.setWorkspaceToken(null), n.setProjects([]), n.setCurrentProjectId(null), n.setCurrentOrganizationId(t.id), await G(t.id);
+	}, [G]), Y = n(async (t) => {
+		let n = e.getState();
+		if (n.setCurrentProjectId(null), n.setProjects([]), !t.organizationId) return console.error("Workspace missing organizationId:", t), {
+			success: !1,
+			error: "Workspace is missing organizationId"
+		};
+		let r = await K(t.organizationId, t.id);
+		if (!r.success) return {
+			success: !1,
+			error: r.error
+		};
+		let i = await q();
+		if (i.length === 0) {
+			let t = x(), r = e.getState().workspaceToken;
+			if (t && r) {
+				let e = await h({
+					authToken: t,
+					workspaceBaseUrl: U,
+					workspaceToken: r
+				});
+				e && (i = [e], n.setProjects(i));
+			}
+		}
+		return i.length > 0 && n.setCurrentProjectId(i[0].id), {
+			success: !0,
+			projects: i
+		};
+	}, [
+		K,
+		q,
+		U
+	]), X = n((t) => {
+		e.getState().setCurrentProjectId(t.id);
+	}, []);
+	return {
+		organizations: T,
+		workspaces: O,
+		projects: M,
+		currentOrganizationId: E,
+		currentWorkspaceId: k,
+		currentProjectId: N,
+		currentOrganization: T.find((e) => e.id === E),
+		currentWorkspace: O.find((e) => e.id === k),
+		currentProject: M.find((e) => e.id === N),
+		workspaceToken: A,
+		isLoadingOrganizations: D,
+		isLoadingWorkspaces: j,
+		isLoadingProjects: P,
+		isLoading: D || j || P,
+		error: F,
+		fetchOrganizations: W,
+		fetchWorkspacesForOrg: G,
+		issueWorkspaceToken: K,
+		fetchProjects: q,
+		selectOrganization: J,
+		selectWorkspace: Y,
+		selectProject: X
+	};
+}
+function w(n) {
+	let i = e((e) => e.currentOrganizationId), a = e((e) => e.workspaces), o = e((e) => e.accessToken), c = e((e) => e.isLoadingWorkspaces), l = t(), d = n?.globalBaseUrl ?? l.globalBaseUrl, f = n?.disableWorkspaceSync ?? !1;
+	r(() => {
+		if (f || !i || !o || c) return;
+		let t = a.some((e) => e.organizationId === i);
+		if (a.length > 0 && !t) {
+			let t = e.getState();
+			t.setLoadingWorkspaces(!0), s({
+				gateway: "global",
+				query: u,
+				variables: { filter: { organizationId: i } },
+				authToken: o,
+				baseUrl: d
+			}).then((e) => {
+				if (!e.errors?.length) {
+					let n = e.data?.workspaces?.items ?? [];
+					t.setWorkspaces(n);
+				}
+			}).catch(() => {}).finally(() => {
+				t.setLoadingWorkspaces(!1);
+			});
+		}
+	}, [
+		i,
+		a,
+		o,
+		c,
+		d,
+		f
+	]);
+}
+function T(n) {
+	let a = e((e) => e.currentWorkspaceId), o = e((e) => e.currentOrganizationId), c = e((e) => e.workspaces), l = e((e) => e.projects), u = e((e) => e.workspaceToken), d = e((e) => e.accessToken), m = t(), _ = n?.workspaceBaseUrl ?? m.workspaceBaseUrl, y = n?.disableProjectSync ?? !1, b = n?.skipProjectFetch ?? !1, x = i(!1), S = i(/* @__PURE__ */ new Map()), C = i(/* @__PURE__ */ new Map()), w = 3e4;
+	r(() => {
+		if (y || !a || !d || x.current) return;
+		let t = C.current.get(a);
+		if (t && t.count >= 8 && Date.now() - t.lastFailureAt < w) return;
+		t && Date.now() - t.lastFailureAt >= w && C.current.delete(a);
+		let n = c.find((e) => e.id === a);
+		if (n && o && n.organizationId !== o) return;
+		let r = n?.organizationId ?? o;
+		if (!r) return;
+		let i = e.getState(), m = !u || g(u) || !v(u, {
+			workspaceId: a,
+			organizationId: o
+		}), T = l.some((e) => e.workspaceId === a);
+		if (T && !m) {
+			if (!i.currentProjectId) {
+				let e = l.find((e) => e.workspaceId === a);
+				e && i.setCurrentProjectId(e.id);
+			}
+			return;
+		}
+		let E = async () => {
+			x.current = !0, i.setLoadingProjects(!0);
+			let t = !1;
+			try {
+				let e = u;
+				if (m) {
+					let t = await s({
+						gateway: "workspace",
+						query: f,
+						variables: { input: {
+							organizationId: r,
+							workspaceId: a
+						} },
+						authToken: d,
+						baseUrl: _
+					});
+					if (t.data?.issueWorkspaceToken?.success && t.data.issueWorkspaceToken.token) e = t.data.issueWorkspaceToken.token, i.setWorkspaceToken(e);
+					else return;
+				}
+				if (e && !T && !b) {
+					let t = await s({
+						gateway: "workspace",
+						query: p,
+						variables: { filter: { workspaceId: a } },
+						authToken: d,
+						workspaceToken: e,
+						baseUrl: _
+					});
+					if (t.errors?.length) return;
+					let n = t.data?.projects?.items ?? [];
+					if (n.length === 0) {
+						let t = await h({
+							authToken: d,
+							workspaceBaseUrl: _,
+							workspaceToken: e
+						});
+						if (t) n = [t];
+						else return;
+					}
+					i.setProjects(n), n.length > 0 && !i.currentProjectId && i.setCurrentProjectId(n[0].id);
+				}
+				t = !0;
+			} catch {} finally {
+				i.setLoadingProjects(!1), x.current = !1;
+				let n = C.current;
+				if (t) {
+					n.delete(a);
+					let e = S.current.get(a);
+					e && (clearTimeout(e), S.current.delete(a));
+				} else {
+					let t = (n.get(a)?.count ?? 0) + 1;
+					if (n.set(a, {
+						count: t,
+						lastFailureAt: Date.now()
+					}), t < 8) {
+						let n = S.current.get(a);
+						n && clearTimeout(n);
+						let r = Math.min(1e3 * 2 ** (t - 1), 8e3), i = setTimeout(() => {
+							S.current.delete(a);
+							let t = e.getState();
+							t.currentWorkspaceId === a && !t.projects.some((e) => e.workspaceId === a) && !x.current && E();
+						}, r);
+						S.current.set(a, i);
+					}
+				}
+			}
+		};
+		E();
+	}, [
+		a,
+		o,
+		c,
+		l,
+		u,
+		d,
+		_,
+		y,
+		b
+	]), r(() => {
+		let e = S.current;
+		return () => {
+			e.forEach((e) => clearTimeout(e)), e.clear();
+		};
+	}, []);
+}
+//#endregion
+export { C as useContextSwitcherData, T as useProjectSyncEffect, w as useWorkspaceSyncEffect };
+
+//# sourceMappingURL=useContextSwitcherData.js.map