@burdenoff/microfe-auth 2026.704.1 → 2026.708.1

package/dist/auth/hooks/useContextSwitcherData.js

@@ -5,11 +5,11 @@ import { useEventBus as o } from "@burdenoff/fe-libs/shared/events";
 import { getStoredAuthToken as s, graphqlFetch as c } from "@burdenoff/fe-libs/shared/graphql";
 import { useActiveContext as l } from "@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider";
 //#region src/auth/hooks/useContextSwitcherData.ts
-var u = "\n  query MyOrganizations {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", d = "\n  query WorkspacesByOrg {\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", f = "\n  query ContextSwitcherBootstrap {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", p = "\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      expiresAt\n      organizationId\n      workspaceId\n      projectId\n      scopes\n      error {\n        code\n        message\n      }\n    }\n  }\n", m = "\n  query MyProjectsForContext {\n    projects: myProjects {\n      total\n      items {\n        id\n        name\n        key\n        workspaceId\n        status\n        archived\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", h = "\n  mutation CreateDefaultProject($input: CreateProjectInput!) {\n    createProject(input: $input) {\n      id\n      name\n      key\n      workspaceId\n      status\n      archived\n      createdAt\n      updatedAt\n    }\n  }\n";
-async function g({ authToken: e, workspaceBaseUrl: t, workspaceToken: n }) {
+var u = "\n  query MyOrganizations {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", d = "\n  query WorkspacesByOrg {\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", f = "\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      expiresAt\n      organizationId\n      workspaceId\n      projectId\n      scopes\n      error {\n        code\n        message\n      }\n    }\n  }\n", p = "\n  query MyProjectsForContext {\n    projects: myProjects {\n      total\n      items {\n        id\n        name\n        key\n        workspaceId\n        status\n        archived\n        createdAt\n        updatedAt\n      }\n    }\n  }\n", m = "\n  mutation CreateDefaultProject($input: CreateProjectInput!) {\n    createProject(input: $input) {\n      id\n      name\n      key\n      workspaceId\n      status\n      archived\n      createdAt\n      updatedAt\n    }\n  }\n";
+async function h({ authToken: e, workspaceBaseUrl: t, workspaceToken: n }) {
 	let r = await c({
 		gateway: "workspace",
-		query: h,
+		query: m,
 		variables: { input: { name: "Default Project" } },
 		authToken: e,
 		workspaceToken: n,
@@ -17,7 +17,7 @@ async function g({ authToken: e, workspaceBaseUrl: t, workspaceToken: n }) {
 	});
 	return r.errors?.length ? (console.warn("Failed to create default project:", r.errors), null) : r.data?.createProject ?? null;
 }
-function _(e, t = 3e4) {
+function g(e, t = 3e4) {
 	try {
 		let n = JSON.parse(atob(e.split(".")[1]));
 		return n.exp ? n.exp * 1e3 < Date.now() + t : !1;
@@ -25,7 +25,7 @@ function _(e, t = 3e4) {
 		return !0;
 	}
 }
-function v(e) {
+function _(e) {
 	try {
 		let t = JSON.parse(atob(e.split(".")[1]));
 		return {
@@ -38,26 +38,26 @@ function v(e) {
 		return null;
 	}
 }
-function y(e, t) {
-	if (!e || _(e)) return !1;
-	let n = v(e);
+function v(e, t) {
+	if (!e || g(e)) return !1;
+	let n = _(e);
 	return !(!n || t.workspaceId && n.workspaceId !== t.workspaceId || t.organizationId && n.organizationId !== t.organizationId || t.projectId && n.projectId !== t.projectId);
 }
-var b = class extends Error {
+var y = class extends Error {
 	constructor(e) {
 		super(e), this.name = "AuthError";
 	}
 };
-function x(e) {
+function b(e) {
 	return e.some((e) => e.extensions?.code === "UNAUTHENTICATED" || e.message?.toLowerCase().includes("unauthorized") || e.message?.toLowerCase().includes("not authenticated"));
 }
-function S() {
+function x() {
 	let t = e.getState().accessToken;
-	if (t && !_(t)) return t;
+	if (t && !g(t)) return t;
 	let n = s();
-	return n && !_(n) ? n : t;
+	return n && !g(n) ? n : t;
 }
-function C(e) {
+function S(e) {
 	return Array.from(new Set(e.flatMap((e) => e.organizationId ? [e.organizationId] : []))).map((t, n) => ({
 		id: t,
 		name: e.find((e) => e.organizationId === t)?.name || `Organization ${n + 1}`,
@@ -65,55 +65,73 @@ function C(e) {
 		tenantId: e.find((e) => e.organizationId === t)?.tenantId || ""
 	}));
 }
-var w = new Set([
+var C = new Set([
 	"project.created",
 	"project.updated",
 	"project.deleted",
 	"project.archived",
 	"project.unarchived"
-]), T = new Set([
+]), w = new Set([
 	"workspace.created",
 	"workspace.updated",
 	"workspace.deleted",
 	"workspace.archived",
 	"workspace.reactivated"
 ]);
-function E(e) {
+function T(e) {
 	if (e && typeof e == "object" && "workspaceId" in e) {
 		let t = e.workspaceId;
 		return typeof t == "string" ? t : void 0;
 	}
 }
-function D(s) {
-	let { organizationId: h, workspaceId: v, projectId: D, setContext: O } = l(), k = o(), A = e((e) => e.organizations), j = e((e) => e.currentOrganizationId), M = e((e) => e.isLoadingOrganizations), N = e((e) => e.workspaces), P = e((e) => e.currentWorkspaceId), ee = e((e) => e.workspaceToken), F = e((e) => e.isLoadingWorkspaces), I = e((e) => e.projects), L = e((e) => e.currentProjectId), R = e((e) => e.isLoadingProjects), [te, z] = a(null), B = i(null), V = i(/* @__PURE__ */ new Map()), H = i(v), U = i(h);
+function E(s) {
+	let { organizationId: m, workspaceId: _, projectId: E, setContext: D } = l(), O = o(), k = e((e) => e.organizations), A = e((e) => e.currentOrganizationId), j = e((e) => e.isLoadingOrganizations), M = e((e) => e.workspaces), N = e((e) => e.currentWorkspaceId), P = e((e) => e.workspaceToken), F = e((e) => e.isLoadingWorkspaces), I = e((e) => e.projects), L = e((e) => e.currentProjectId), R = e((e) => e.isLoadingProjects), [ee, z] = a(null), B = i(null), V = i(/* @__PURE__ */ new Map()), H = i(_), U = i(m);
 	r(() => {
-		H.current = v, U.current = h;
+		H.current = _, U.current = m;
 	});
 	let W = t(), G = s?.globalBaseUrl ?? W.globalBaseUrl, K = s?.workspaceBaseUrl ?? W.workspaceBaseUrl, q = i(null), J = i(null), Y = i(null), X = i(null);
 	r(() => {
 		let t = e.getState();
-		if (h && h !== t.currentOrganizationId && h !== q.current && (q.current = h, t.setCurrentOrganizationId(h), t.workspaces.length > 0 && !t.workspaces.some((e) => e.organizationId === h) && t.setWorkspaces([])), v && v !== t.currentWorkspaceId && v !== J.current && (J.current = v, t.setCurrentWorkspaceId(v), t.projects.length > 0 && !t.projects.some((e) => e.workspaceId === v) && (t.setProjects([]), t.setCurrentProjectId(null))), D && D !== t.currentProjectId && D !== Y.current && (Y.current = D, t.setCurrentProjectId(D)), t.workspaceToken && !y(t.workspaceToken, {
-			workspaceId: v,
-			organizationId: h,
-			projectId: D
+		if (m && m !== t.currentOrganizationId && m !== q.current && (q.current = m, t.setCurrentOrganizationId(m), t.workspaces.length > 0 && !t.workspaces.some((e) => e.organizationId === m) && t.setWorkspaces([])), _ && _ !== t.currentWorkspaceId && _ !== J.current && (J.current = _, t.setCurrentWorkspaceId(_), t.projects.length > 0 && !t.projects.some((e) => e.workspaceId === _) && (t.setProjects([]), t.setCurrentProjectId(null))), E && E !== t.currentProjectId && E !== Y.current && (Y.current = E, t.setCurrentProjectId(E)), t.workspaceToken && !v(t.workspaceToken, {
+			workspaceId: _,
+			organizationId: m,
+			projectId: E
 		})) {
-			let e = `${h ?? ""}|${v ?? ""}|${D ?? ""}`;
+			let e = `${m ?? ""}|${_ ?? ""}|${E ?? ""}`;
 			X.current !== e && (X.current = e, t.setWorkspaceToken(null));
 		}
 	}, [
-		h,
-		v,
-		D
+		m,
+		_,
+		E
 	]);
-	let ne = n(async () => {
+	let te = n(async () => {
 		if (B.current) return B.current;
-		let t = e.getState(), n = S();
-		return !n || _(n) ? [] : (t.setLoadingOrganizations(!0), z(null), B.current = (async () => {
+		let t = e.getState(), n = x();
+		return !n || g(n) ? [] : (t.setLoadingOrganizations(!0), z(null), B.current = (async () => {
 			try {
-				let r = U.current ?? t.currentOrganizationId, i = await c({
+				let r = U.current ?? t.currentOrganizationId, i = r ? await (async () => {
+					let [e, t] = await Promise.all([c({
+						gateway: "global",
+						query: u,
+						authToken: n,
+						baseUrl: G
+					}), c({
+						gateway: "global",
+						query: d,
+						authToken: n,
+						baseUrl: G
+					})]);
+					return {
+						data: e.data?.myOrganizations ? {
+							myOrganizations: e.data.myOrganizations,
+							...t.data?.workspaces ? { workspaces: t.data.workspaces } : {}
+						} : null,
+						errors: [...e.errors ?? [], ...t.errors ?? []]
+					};
+				})() : await c({
 					gateway: "global",
-					query: r ? f : u,
-					variables: void 0,
+					query: u,
 					authToken: n,
 					baseUrl: G
 				});
@@ -124,7 +142,7 @@ function D(s) {
 					baseUrl: G
 				})), i.errors?.length) {
 					let e = i.errors[0]?.message ?? "GraphQL error";
-					throw x(i.errors) ? new b(e) : (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", i.errors), Error(e));
+					throw b(i.errors) ? new y(e) : (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", i.errors), Error(e));
 				}
 				let a = i.data?.myOrganizations?.items ?? [];
 				if (r && a.length === 0 && t.workspaces.length === 0) {
@@ -142,10 +160,10 @@ function D(s) {
 						} }
 					});
 				}
-				let o = a.length === 0 && t.workspaces.length > 0 ? C(t.workspaces) : [], s = o.length > 0 ? o : a;
+				let o = a.length === 0 && t.workspaces.length > 0 ? S(t.workspaces) : [], s = o.length > 0 ? o : a;
 				t.setOrganizations(s);
-				let l = r, p = l && a.some((e) => e.id === l);
-				if (l && !p && a.length > 0 && (l = a[0].id, O({
+				let l = r, f = l && a.some((e) => e.id === l);
+				if (l && !f && a.length > 0 && (l = a[0].id, D({
 					organizationId: l,
 					workspaceId: null,
 					tenantId: null,
@@ -170,7 +188,7 @@ function D(s) {
 									tenantId: e[0].tenantId,
 									projectId: null
 								};
-								H.current ? (t.setCurrentWorkspaceId(e[0].id), t.setWorkspaceToken(null), O(n)) : t.currentWorkspaceId || (t.setCurrentWorkspaceId(e[0].id), O(n));
+								H.current ? (t.setCurrentWorkspaceId(e[0].id), t.setWorkspaceToken(null), D(n)) : t.currentWorkspaceId || (t.setCurrentWorkspaceId(e[0].id), D(n));
 							}
 						}
 					} catch {} finally {
@@ -179,10 +197,10 @@ function D(s) {
 				}
 				return s;
 			} catch (e) {
-				if (e instanceof b) return [];
+				if (e instanceof y) return [];
 				let n = e instanceof Error ? e.message : "Failed to fetch organizations";
 				if (t.workspaces.length === 0 && console.error("Failed to fetch organizations:", e), z(n), t.workspaces.length > 0) {
-					let e = C(t.workspaces);
+					let e = S(t.workspaces);
 					if (e.length > 0) return t.setOrganizations(e), t.currentOrganizationId || t.setCurrentOrganizationId(e[0].id), e;
 				}
 				return [];
@@ -190,11 +208,11 @@ function D(s) {
 				t.setLoadingOrganizations(!1), B.current = null;
 			}
 		})(), B.current);
-	}, [G, O]), Z = n(async (t) => {
+	}, [G, D]), Z = n(async (t) => {
 		let n = V.current.get(t);
 		if (n) return n;
-		let r = e.getState(), i = S();
-		if (!i || _(i)) return [];
+		let r = e.getState(), i = x();
+		if (!i || g(i)) return [];
 		r.setLoadingWorkspaces(!0), z(null);
 		let a = (async () => {
 			try {
@@ -206,12 +224,12 @@ function D(s) {
 				});
 				if (e.data?.workspaces?.items && (e.data.workspaces.items = e.data.workspaces.items.filter((e) => e.organizationId === t)), e.errors?.length) {
 					let t = e.errors[0]?.message ?? "GraphQL error";
-					throw x(e.errors) ? new b(t) : (console.error("Failed to fetch workspaces:", e.errors), Error(t));
+					throw b(e.errors) ? new y(t) : (console.error("Failed to fetch workspaces:", e.errors), Error(t));
 				}
 				let n = (e.data?.workspaces?.items ?? []).filter((e) => e.organizationId === t);
 				return r.setWorkspaces(n), n;
 			} catch (e) {
-				if (e instanceof b) return [];
+				if (e instanceof y) return [];
 				let t = e instanceof Error ? e.message : "Failed to fetch workspaces";
 				return console.error("Failed to fetch workspaces:", e), z(t), [];
 			} finally {
@@ -220,8 +238,8 @@ function D(s) {
 		})();
 		return V.current.set(t, a), a;
 	}, [G]), Q = n(async (t, n, r) => {
-		let i = e.getState(), a = S();
-		if (!a || _(a)) return {
+		let i = e.getState(), a = x();
+		if (!a || g(a)) return {
 			success: !1,
 			error: "No valid access token available"
 		};
@@ -229,7 +247,7 @@ function D(s) {
 		try {
 			let e = await c({
 				gateway: "workspace",
-				query: p,
+				query: f,
 				variables: { input: {
 					organizationId: t,
 					...n && { workspaceId: n },
@@ -240,7 +258,7 @@ function D(s) {
 			});
 			if (e.errors?.length) {
 				let t = e.errors[0]?.message ?? "GraphQL error";
-				return x(e.errors) || console.error("Failed to issue workspace token:", e.errors), {
+				return b(e.errors) || console.error("Failed to issue workspace token:", e.errors), {
 					success: !1,
 					error: t
 				};
@@ -266,34 +284,34 @@ function D(s) {
 			};
 		}
 	}, [K]), $ = n(async () => {
-		let t = e.getState(), n = S(), r = t.workspaceToken, i = t.currentWorkspaceId;
-		if (!n || _(n) || !r || !i) return [];
+		let t = e.getState(), n = x(), r = t.workspaceToken, i = t.currentWorkspaceId;
+		if (!n || g(n) || !r || !i) return [];
 		t.setLoadingProjects(!0), z(null);
 		try {
 			let e = await c({
 				gateway: "workspace",
-				query: m,
+				query: p,
 				authToken: n,
 				workspaceToken: r,
 				baseUrl: K
 			});
 			if (e.errors?.length) {
 				let t = e.errors[0]?.message ?? "GraphQL error";
-				throw x(e.errors) ? new b(t) : (console.error("Failed to fetch projects:", e.errors), Error(t));
+				throw b(e.errors) ? new y(t) : (console.error("Failed to fetch projects:", e.errors), Error(t));
 			}
 			let i = e.data?.projects?.items ?? [];
 			return t.setProjects(i), i;
 		} catch (e) {
-			if (e instanceof b) return [];
+			if (e instanceof y) return [];
 			let t = e instanceof Error ? e.message : "Failed to fetch projects";
 			return console.error("Failed to fetch projects:", e), z(t), [];
 		} finally {
 			t.setLoadingProjects(!1);
 		}
-	}, [K]), re = n(async (t) => {
+	}, [K]), ne = n(async (t) => {
 		let n = e.getState();
 		return n.setCurrentWorkspaceId(null), n.setWorkspaceToken(null), n.setProjects([]), n.setCurrentProjectId(null), n.setCurrentOrganizationId(t.id), await Z(t.id);
-	}, [Z]), ie = n(async (t) => {
+	}, [Z]), re = n(async (t) => {
 		let n = e.getState();
 		if (n.setCurrentProjectId(null), n.setProjects([]), !t.organizationId) return console.error("Workspace missing organizationId:", t), {
 			success: !1,
@@ -306,9 +324,9 @@ function D(s) {
 		};
 		let i = await $();
 		if (i.length === 0) {
-			let t = S(), r = e.getState().workspaceToken;
+			let t = x(), r = e.getState().workspaceToken;
 			if (t && r) {
-				let e = await g({
+				let e = await h({
 					authToken: t,
 					workspaceBaseUrl: K,
 					workspaceToken: r
@@ -324,9 +342,9 @@ function D(s) {
 		Q,
 		$,
 		K
-	]), ae = n((t) => {
+	]), ie = n((t) => {
 		let n = e.getState();
-		n.setCurrentProjectId(t.id), n.workspaceToken && !y(n.workspaceToken, {
+		n.setCurrentProjectId(t.id), n.workspaceToken && !v(n.workspaceToken, {
 			workspaceId: n.currentWorkspaceId,
 			organizationId: n.currentOrganizationId,
 			projectId: t.id
@@ -349,49 +367,49 @@ function D(s) {
 		}, r = n(() => $()), i = n(() => {
 			let t = e.getState().currentOrganizationId;
 			return t ? Z(t) : Promise.resolve();
-		}), a = k.onAny((t) => {
+		}), a = O.onAny((t) => {
 			let n = t.name;
-			if (w.has(n)) {
-				let n = E(t.payload), { currentWorkspaceId: i } = e.getState();
+			if (C.has(n)) {
+				let n = T(t.payload), { currentWorkspaceId: i } = e.getState();
 				if (n && i && n !== i) return;
 				r();
 				return;
 			}
-			T.has(n) && i();
+			w.has(n) && i();
 		});
 		return () => {
 			t = !0, a();
 		};
 	}, [
-		k,
+		O,
 		$,
 		Z
 	]), {
-		organizations: A,
-		workspaces: N,
+		organizations: k,
+		workspaces: M,
 		projects: I,
-		currentOrganizationId: j,
-		currentWorkspaceId: P,
+		currentOrganizationId: A,
+		currentWorkspaceId: N,
 		currentProjectId: L,
-		currentOrganization: A.find((e) => e.id === j),
-		currentWorkspace: N.find((e) => e.id === P),
+		currentOrganization: k.find((e) => e.id === A),
+		currentWorkspace: M.find((e) => e.id === N),
 		currentProject: I.find((e) => e.id === L),
-		workspaceToken: ee,
-		isLoadingOrganizations: M,
+		workspaceToken: P,
+		isLoadingOrganizations: j,
 		isLoadingWorkspaces: F,
 		isLoadingProjects: R,
-		isLoading: M || F || R,
-		error: te,
-		fetchOrganizations: ne,
+		isLoading: j || F || R,
+		error: ee,
+		fetchOrganizations: te,
 		fetchWorkspacesForOrg: Z,
 		issueWorkspaceToken: Q,
 		fetchProjects: $,
-		selectOrganization: re,
-		selectWorkspace: ie,
-		selectProject: ae
+		selectOrganization: ne,
+		selectWorkspace: re,
+		selectProject: ie
 	};
 }
-function O(n) {
+function D(n) {
 	let i = e((e) => e.currentOrganizationId), a = e((e) => e.workspaces), o = e((e) => e.accessToken), s = e((e) => e.isLoadingWorkspaces), l = t(), u = n?.globalBaseUrl ?? l.globalBaseUrl, f = n?.disableWorkspaceSync ?? !1;
 	r(() => {
 		if (f || !i || !o || s) return;
@@ -421,10 +439,10 @@ function O(n) {
 		f
 	]);
 }
-function k(n) {
-	let a = e((e) => e.currentWorkspaceId), o = e((e) => e.currentOrganizationId), s = e((e) => e.workspaces), l = e((e) => e.projects), u = e((e) => e.currentProjectId), d = e((e) => e.workspaceToken), f = e((e) => e.accessToken), h = t(), v = n?.workspaceBaseUrl ?? h.workspaceBaseUrl, b = n?.disableProjectSync ?? !1, x = n?.skipProjectFetch ?? !1, S = i(!1), C = i(/* @__PURE__ */ new Map()), w = i(/* @__PURE__ */ new Map()), T = 3e4;
+function O(n) {
+	let a = e((e) => e.currentWorkspaceId), o = e((e) => e.currentOrganizationId), s = e((e) => e.workspaces), l = e((e) => e.projects), u = e((e) => e.currentProjectId), d = e((e) => e.workspaceToken), m = e((e) => e.accessToken), _ = t(), y = n?.workspaceBaseUrl ?? _.workspaceBaseUrl, b = n?.disableProjectSync ?? !1, x = n?.skipProjectFetch ?? !1, S = i(!1), C = i(/* @__PURE__ */ new Map()), w = i(/* @__PURE__ */ new Map()), T = 3e4;
 	r(() => {
-		if (b || !a || !f || S.current) return;
+		if (b || !a || !m || S.current) return;
 		let t = w.current.get(a);
 		if (t && t.count >= 8 && Date.now() - t.lastFailureAt < T) return;
 		t && Date.now() - t.lastFailureAt >= T && w.current.delete(a);
@@ -432,12 +450,12 @@ function k(n) {
 		if (n && o && n.organizationId !== o) return;
 		let r = n?.organizationId ?? o;
 		if (!r) return;
-		let i = e.getState(), h = !d || _(d) || !y(d, {
+		let i = e.getState(), _ = !d || g(d) || !v(d, {
 			workspaceId: a,
 			organizationId: o,
 			projectId: u
 		}), E = l.some((e) => e.workspaceId === a);
-		if (E && !h) {
+		if (E && !_) {
 			if (!i.currentProjectId) {
 				let e = l.find((e) => e.workspaceId === a);
 				e && i.setCurrentProjectId(e.id);
@@ -449,17 +467,17 @@ function k(n) {
 			let t = !1;
 			try {
 				let e = d;
-				if (h) {
+				if (_) {
 					let t = await c({
 						gateway: "workspace",
-						query: p,
+						query: f,
 						variables: { input: {
 							organizationId: r,
 							workspaceId: a,
 							...u ? { projectId: u } : {}
 						} },
-						authToken: f,
-						baseUrl: v
+						authToken: m,
+						baseUrl: y
 					});
 					if (t.data?.issueWorkspaceToken?.success && t.data.issueWorkspaceToken.token) e = t.data.issueWorkspaceToken.token, i.setWorkspaceToken(e);
 					else return;
@@ -467,17 +485,17 @@ function k(n) {
 				if (e && !E && !x) {
 					let t = await c({
 						gateway: "workspace",
-						query: m,
-						authToken: f,
+						query: p,
+						authToken: m,
 						workspaceToken: e,
-						baseUrl: v
+						baseUrl: y
 					});
 					if (t.errors?.length) return;
 					let n = t.data?.projects?.items ?? [];
 					if (n.length === 0) {
-						let t = await g({
-							authToken: f,
-							workspaceBaseUrl: v,
+						let t = await h({
+							authToken: m,
+							workspaceBaseUrl: y,
 							workspaceToken: e
 						});
 						if (t) n = [t];
@@ -519,8 +537,8 @@ function k(n) {
 		l,
 		u,
 		d,
-		f,
-		v,
+		m,
+		y,
 		b,
 		x
 	]), r(() => {
@@ -531,6 +549,6 @@ function k(n) {
 	}, []);
 }
 //#endregion
-export { D as useContextSwitcherData, k as useProjectSyncEffect, O as useWorkspaceSyncEffect };
+export { E as useContextSwitcherData, O as useProjectSyncEffect, D as useWorkspaceSyncEffect };
 
 //# sourceMappingURL=useContextSwitcherData.js.map

package/dist/auth/hooks/useContextSwitcherData.js.map

@@ -1 +1 @@
-{"version":3,"file":"useContextSwitcherData.js","names":[],"sources":["../../../src/auth/hooks/useContextSwitcherData.ts"],"sourcesContent":["import { useCallback, useState, useEffect, useRef } from \"react\";\nimport {\n  graphqlFetch,\n  getStoredAuthToken,\n} from \"@burdenoff/fe-libs/shared/graphql\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { Organization, Workspace, Project } from \"../types\";\nimport { resolveGatewayBaseUrls } from \"../utils/gatewayBaseUrls\";\n\n// =============================================================================\n// Hook Options\n// =============================================================================\n\nexport interface UseContextSwitcherDataOptions {\n  /**\n   * Optional Global API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  globalBaseUrl?: string;\n  /**\n   * Optional Workspaces API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  workspaceBaseUrl?: string;\n  /** Disable initial organization/workspace bootstrap fetches */\n  disableBootstrap?: boolean;\n  /** Disable the workspace sync effect */\n  disableWorkspaceSync?: boolean;\n  /** Disable the project sync effect */\n  disableProjectSync?: boolean;\n  /** Only hydrate the workspace token; do not eagerly fetch projects */\n  skipProjectFetch?: boolean;\n}\n\n// =============================================================================\n// GraphQL Response Types\n// =============================================================================\n\ninterface MyOrganizationsResponse {\n  myOrganizations: {\n    total: number;\n    items: Organization[];\n  };\n}\n\ninterface WorkspacesByOrgResponse {\n  workspaces: {\n    total: number;\n    items: Workspace[];\n  };\n}\n\ninterface IssueWorkspaceTokenResult {\n  success: boolean;\n  token: string | null;\n  expiresAt: string | null;\n  organizationId: string | null;\n  workspaceId: string | null;\n  projectId: string | null;\n  scopes: string[] | null;\n  error: {\n    code: string;\n    message: string;\n  } | null;\n}\n\ninterface ProjectsResponse {\n  projects: {\n    total: number;\n    items: Project[];\n  };\n}\n\ninterface CreateProjectResponse {\n  createProject: Project;\n}\n\n// =============================================================================\n// GraphQL Query/Mutation Strings\n// =============================================================================\n\nconst MY_ORGANIZATIONS_QUERY = `\n  query MyOrganizations {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\n// Both queries below historically used `workspaces(filter: $filter)` with\n// a `WorkspaceFilterInput` to fetch workspaces for a specific organization.\n// That Query field was removed/renamed in the global subgraph; calling it\n// now throws GRAPHQL_VALIDATION_FAILED (\"Cannot query field 'workspaces'\n// on type 'Query'\") which crashes the context switcher and cascades into a\n// \"Verifying workspace access...\" stuck-spinner on every Platform module\n// route (/billing, /support, /notifications, /devportal).\n//\n// The supported field is `myWorkspaces(limit, offset)` on the global\n// subgraph — self-scoped, returns the caller's workspaces across all\n// orgs. It does NOT accept a filter, so we fetch up to 100 of \"my\"\n// workspaces and let the existing downstream auto-pick logic filter by\n// organizationId client-side. The recovery path at line ~624 already\n// uses this exact aliased pattern; we're just promoting it to the\n// primary path.\nconst WORKSPACES_BY_ORG_QUERY = `\n  query WorkspacesByOrg {\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst CONTEXT_SWITCHER_BOOTSTRAP_QUERY = `\n  query ContextSwitcherBootstrap {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst ISSUE_WORKSPACE_TOKEN_MUTATION = `\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      expiresAt\n      organizationId\n      workspaceId\n      projectId\n      scopes\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\n// The workspace gateway exposes `myProjects` (public RBAC, caller-scoped to\n// the active workspace via x-workspace-id) and the privileged\n// `projects(filter)` (list:project). The header has no `list:project`\n// permission seeded for the typical operator, so the privileged form\n// returns FORBIDDEN even though the caller is a member of the workspace.\n// `myProjects` is the right field for \"give me the projects I can see in\n// this workspace\" — workspace scope is already established by the\n// workspace token + x-workspace-id header that we pass with the request.\nconst PROJECTS_QUERY = `\n  query MyProjectsForContext {\n    projects: myProjects {\n      total\n      items {\n        id\n        name\n        key\n        workspaceId\n        status\n        archived\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst CREATE_DEFAULT_PROJECT_MUTATION = `\n  mutation CreateDefaultProject($input: CreateProjectInput!) {\n    createProject(input: $input) {\n      id\n      name\n      key\n      workspaceId\n      status\n      archived\n      createdAt\n      updatedAt\n    }\n  }\n`;\n\nasync function createDefaultProject({\n  authToken,\n  workspaceBaseUrl,\n  workspaceToken,\n}: {\n  authToken: string;\n  workspaceBaseUrl: string;\n  workspaceToken: string;\n}): Promise<Project | null> {\n  const result = await graphqlFetch<CreateProjectResponse>({\n    gateway: \"workspace\",\n    query: CREATE_DEFAULT_PROJECT_MUTATION,\n    variables: {\n      input: {\n        name: \"Default Project\",\n      },\n    },\n    authToken,\n    workspaceToken,\n    baseUrl: workspaceBaseUrl,\n  });\n\n  if (result.errors?.length) {\n    console.warn(\"Failed to create default project:\", result.errors);\n    return null;\n  }\n\n  return result.data?.createProject ?? null;\n}\n\n// =============================================================================\n// Auth Helpers\n// =============================================================================\n\n/**\n * Check whether a JWT is expired (or within bufferMs of expiry).\n * Returns true if the token is expired, close to expiry, or malformed.\n */\nfunction isTokenExpired(token: string, bufferMs = 30_000): boolean {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    if (!payload.exp) return false;\n    return payload.exp * 1000 < Date.now() + bufferMs;\n  } catch {\n    return true;\n  }\n}\n\nfunction getWorkspaceTokenPayload(token: string): {\n  workspaceId?: string;\n  organizationId?: string;\n  projectId?: string;\n  exp?: number;\n} | null {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    return {\n      workspaceId:\n        typeof payload.workspaceId === \"string\"\n          ? payload.workspaceId\n          : undefined,\n      organizationId:\n        typeof payload.organizationId === \"string\"\n          ? payload.organizationId\n          : undefined,\n      projectId:\n        typeof payload.projectId === \"string\" ? payload.projectId : undefined,\n      exp: typeof payload.exp === \"number\" ? payload.exp : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nfunction isWorkspaceTokenValidForContext(\n  token: string | null | undefined,\n  expected: {\n    workspaceId?: string | null;\n    organizationId?: string | null;\n    projectId?: string | null;\n  },\n): token is string {\n  if (!token || isTokenExpired(token)) {\n    return false;\n  }\n\n  const payload = getWorkspaceTokenPayload(token);\n  if (!payload) {\n    return false;\n  }\n\n  if (expected.workspaceId && payload.workspaceId !== expected.workspaceId) {\n    return false;\n  }\n\n  if (\n    expected.organizationId &&\n    payload.organizationId !== expected.organizationId\n  ) {\n    return false;\n  }\n\n  if (expected.projectId && payload.projectId !== expected.projectId) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Custom error class for auth-related failures (expired token, unauthorized, etc.).\n * Used to distinguish auth errors in outer catch blocks so they can be\n * suppressed from console.error — they are expected during token refresh cycles\n * and do not indicate application bugs.\n */\nclass AuthError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * Detect whether a set of GraphQL errors are authentication-related.\n */\nfunction isAuthGraphQLError(\n  errors: Array<{ message?: string; extensions?: { code?: string } }>,\n): boolean {\n  return errors.some(\n    (e) =>\n      e.extensions?.code === \"UNAUTHENTICATED\" ||\n      e.message?.toLowerCase().includes(\"unauthorized\") ||\n      e.message?.toLowerCase().includes(\"not authenticated\"),\n  );\n}\n\n/**\n * Resolve the best available access token:\n * 1. Try the zustand store token\n * 2. If expired, fall back to profile storage (may have been refreshed)\n * 3. Return null if no valid token is available\n */\nfunction resolveAccessToken(): string | null {\n  const storeToken = useAuthStore.getState().accessToken;\n\n  // If store token is valid (or has no exp claim), use it\n  if (storeToken && !isTokenExpired(storeToken)) {\n    return storeToken;\n  }\n\n  // Store token is expired or missing — try profile storage (may be fresher)\n  const profileToken = getStoredAuthToken();\n  if (profileToken && !isTokenExpired(profileToken)) {\n    return profileToken;\n  }\n\n  // Both expired or missing — if store token exists at all, return it as a last\n  // resort (the gateway will reject it and the useEffect will re-trigger after\n  // token refresh). Returning null would silently swallow the first load.\n  return storeToken;\n}\n\nfunction buildFallbackOrganizations(workspaces: Workspace[]): Organization[] {\n  const uniqueOrgIds = Array.from(\n    new Set(\n      workspaces.flatMap((workspace) =>\n        workspace.organizationId ? [workspace.organizationId] : [],\n      ),\n    ),\n  );\n\n  return uniqueOrgIds.map((organizationId, index) => ({\n    id: organizationId,\n    name:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.name || `Organization ${index + 1}`,\n    slug: organizationId,\n    tenantId:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.tenantId || \"\",\n  }));\n}\n\n// =============================================================================\n// Hook Implementation\n// =============================================================================\n\n/**\n * Hook for managing the context switcher data (organizations, workspaces, projects)\n *\n * Data flow:\n * 1. fetchOrganizations() - Get all orgs user has access to (Global Gateway)\n * 2. selectOrganization(org) - Set current org & fetch workspaces for that org\n * 3. selectWorkspace(ws) - Issue workspace token & fetch projects\n * 4. selectProject(proj) - Set current project\n *\n * All GraphQL calls go through graphqlFetch from fe-libs which automatically\n * resolves gateway URLs and injects auth + locale headers.\n *\n * @param options - Optional configuration (gateway base URL overrides)\n */\n// Domain events emitted by microfe-workspaces that should refresh the switcher's\n// cached lists. Module-scoped so they aren't reallocated on every effect run.\nconst PROJECT_REFRESH_EVENTS = new Set<string>([\n  \"project.created\",\n  \"project.updated\",\n  \"project.deleted\",\n  \"project.archived\",\n  \"project.unarchived\",\n]);\nconst WORKSPACE_REFRESH_EVENTS = new Set<string>([\n  \"workspace.created\",\n  \"workspace.updated\",\n  \"workspace.deleted\",\n  \"workspace.archived\",\n  \"workspace.reactivated\",\n]);\n\n// Safely read a string `workspaceId` off a cross-MFE event payload of unknown\n// shape, rather than trusting a bare cast (the payload is produced by another\n// MFE and could drift). Returns undefined when absent or not a string.\nfunction readEventWorkspaceId(payload: unknown): string | undefined {\n  if (payload && typeof payload === \"object\" && \"workspaceId\" in payload) {\n    const value = (payload as { workspaceId?: unknown }).workspaceId;\n    return typeof value === \"string\" ? value : undefined;\n  }\n  return undefined;\n}\n\nexport function useContextSwitcherData(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const {\n    organizationId: activeOrganizationId,\n    workspaceId: activeWorkspaceId,\n    projectId: activeProjectId,\n    setContext: setActiveContext,\n  } = useActiveContext();\n\n  const eventBus = useEventBus();\n\n  // Use selectors for reactive state\n  const organizations = useAuthStore((state) => state.organizations);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const isLoadingOrganizations = useAuthStore(\n    (state) => state.isLoadingOrganizations,\n  );\n\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const isLoadingProjects = useAuthStore((state) => state.isLoadingProjects);\n\n  // Local error state\n  const [error, setError] = useState<string | null>(null);\n\n  // Deduplication refs to prevent duplicate GraphQL calls\n  const fetchOrganizationsPromiseRef = useRef<Promise<Organization[]> | null>(\n    null,\n  );\n  const fetchWorkspacesPromisesRef = useRef<Map<string, Promise<Workspace[]>>>(\n    new Map(),\n  );\n\n  // Stable refs for latest context values — avoids stale closures in callbacks\n  // without adding them to useCallback dep arrays (which would recreate callbacks\n  // on every context change and trigger spurious fetch re-runs).\n  const activeWorkspaceIdRef = useRef(activeWorkspaceId);\n  const activeOrganizationIdRef = useRef(activeOrganizationId);\n  useEffect(() => {\n    activeWorkspaceIdRef.current = activeWorkspaceId;\n    activeOrganizationIdRef.current = activeOrganizationId;\n  });\n\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n\n  // Refs to break feedback loops with the Header's \"store → URL\" sync effect.\n  // Without these the pair can ping-pong: this effect writes (URL → store),\n  // Header writes (store → URL), Zustand re-fires our subscribers, and React\n  // hits \"Maximum update depth exceeded\" — especially when a downstream call\n  // (workspace token issuance) returns 504 and leaves the two halves in\n  // disagreement. The refs record the last value we pushed for each axis;\n  // identical pushes are skipped so the loop has a hard floor.\n  const lastAppliedOrgIdRef = useRef<string | null>(null);\n  const lastAppliedWorkspaceIdRef = useRef<string | null>(null);\n  const lastAppliedProjectIdRef = useRef<string | null>(null);\n  const lastClearedTokenContextRef = useRef<string | null>(null);\n\n  useEffect(() => {\n    const store = useAuthStore.getState();\n\n    if (\n      activeOrganizationId &&\n      activeOrganizationId !== store.currentOrganizationId &&\n      activeOrganizationId !== lastAppliedOrgIdRef.current\n    ) {\n      lastAppliedOrgIdRef.current = activeOrganizationId;\n      store.setCurrentOrganizationId(activeOrganizationId);\n      if (\n        store.workspaces.length > 0 &&\n        !store.workspaces.some(\n          (workspace) => workspace.organizationId === activeOrganizationId,\n        )\n      ) {\n        store.setWorkspaces([]);\n      }\n    }\n\n    if (\n      activeWorkspaceId &&\n      activeWorkspaceId !== store.currentWorkspaceId &&\n      activeWorkspaceId !== lastAppliedWorkspaceIdRef.current\n    ) {\n      lastAppliedWorkspaceIdRef.current = activeWorkspaceId;\n      store.setCurrentWorkspaceId(activeWorkspaceId);\n      if (\n        store.projects.length > 0 &&\n        !store.projects.some(\n          (project) => project.workspaceId === activeWorkspaceId,\n        )\n      ) {\n        store.setProjects([]);\n        store.setCurrentProjectId(null);\n      }\n    }\n\n    if (\n      activeProjectId &&\n      activeProjectId !== store.currentProjectId &&\n      activeProjectId !== lastAppliedProjectIdRef.current\n    ) {\n      lastAppliedProjectIdRef.current = activeProjectId;\n      store.setCurrentProjectId(activeProjectId);\n    }\n\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: activeWorkspaceId,\n        organizationId: activeOrganizationId,\n        projectId: activeProjectId,\n      })\n    ) {\n      // Clear-token-once-per-context guard: when the upstream gateway is\n      // flaky (504s during workspace token issuance) the surrounding state\n      // machine can oscillate between \"got token but invalid\" and \"clearing\n      // token\". The downstream re-issue path then loops. Only clear once per\n      // (org, ws, proj) tuple — a successful re-issue resets the ref via\n      // setWorkspaceToken landing a new token for the same context.\n      const ctxKey = `${activeOrganizationId ?? \"\"}|${activeWorkspaceId ?? \"\"}|${activeProjectId ?? \"\"}`;\n      if (lastClearedTokenContextRef.current !== ctxKey) {\n        lastClearedTokenContextRef.current = ctxKey;\n        store.setWorkspaceToken(null);\n      }\n    }\n  }, [activeOrganizationId, activeWorkspaceId, activeProjectId]);\n\n  // ===========================================================================\n  // Fetch Organizations (Global Gateway)\n  // ===========================================================================\n\n  const fetchOrganizations = useCallback(async (): Promise<Organization[]> => {\n    // Deduplicate: if a fetch is already in progress, return the same promise\n    if (fetchOrganizationsPromiseRef.current) {\n      return fetchOrganizationsPromiseRef.current;\n    }\n\n    const store = useAuthStore.getState();\n    const token = resolveAccessToken();\n\n    if (!token) {\n      // Not an error — user may not be authenticated yet (e.g., page load before login).\n      // The useEffect in Header.tsx will re-trigger when accessToken becomes available.\n      return [];\n    }\n\n    // If the token is clearly expired and no fresh fallback was found, skip the\n    // doomed request. The useEffect in Header.tsx re-triggers when the auth\n    // provider refreshes the token and updates accessToken in the store.\n    if (isTokenExpired(token)) {\n      return [];\n    }\n\n    store.setLoadingOrganizations(true);\n    setError(null);\n\n    // Store the promise for deduplication before starting\n    fetchOrganizationsPromiseRef.current = (async () => {\n      try {\n        const initialTargetOrgId =\n          activeOrganizationIdRef.current ?? store.currentOrganizationId;\n        let result = await graphqlFetch<\n          MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n        >({\n          gateway: \"global\",\n          query: initialTargetOrgId\n            ? CONTEXT_SWITCHER_BOOTSTRAP_QUERY\n            : MY_ORGANIZATIONS_QUERY,\n          // Both queries are now parameter-less (the legacy `filter` arg\n          // was for the removed `workspaces(filter:)` field; `myWorkspaces`\n          // doesn't accept it). Downstream code filters by organizationId\n          // client-side.\n          variables: undefined,\n          authToken: token,\n          baseUrl: globalBaseUrl,\n        });\n\n        // Self-heal stale-URL case: bootstrap query embeds\n        // workspaces(filter: {organizationId: <urlOrg>}) — when the user\n        // isn't a member of that org (URL was bookmarked from a different\n        // tenant, org was deleted, etc.), the workspaces resolver throws\n        // FORBIDDEN which blanks the entire data block, masking\n        // myOrganizations as the visible error. Retry with the simpler\n        // MY_ORGANIZATIONS_QUERY so the operator sees their actual orgs\n        // and the URL params get corrected on next render.\n        if (\n          initialTargetOrgId &&\n          result.errors?.length &&\n          result.errors.some(\n            (e) =>\n              e?.extensions?.code === \"FORBIDDEN\" ||\n              /not a member of this organization/i.test(e?.message ?? \"\") ||\n              // Public gateway often drops the underlying FORBIDDEN error\n              // and replaces it with the schema-level non-null violation\n              // (\"Cannot return null for non-nullable field Query.myOrganizations\").\n              // That happens when ANY field in the query throws — workspaces\n              // here — and data:null cascades up. Treat that pattern as a\n              // signal to retry without the workspaces filter.\n              /Cannot return null for non-nullable field Query\\.myOrganizations/i.test(\n                e?.message ?? \"\",\n              ),\n          )\n        ) {\n          // Fetch myOrganizations + ALL workspaces (no filter) so the\n          // downstream auto-pick logic still has a workspace list to seed\n          // context from. If we only refetched myOrganizations, the page\n          // would render but every workspace-scoped query would fail with\n          // \"Select a workspace…\".\n          result = await graphqlFetch<\n            MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n          >({\n            gateway: \"global\",\n            query: `\n              query ContextSwitcherRecover {\n                myOrganizations {\n                  total\n                  items { id name slug tenantId description logo website status type createdAt updatedAt }\n                }\n                workspaces: myWorkspaces {\n                  total\n                  items { id name slug tenantId organizationId type status region createdAt updatedAt }\n                }\n              }\n            `,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n        }\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (isAuthGraphQLError(result.errors)) {\n            // Auth errors are expected during token refresh cycles — throw AuthError\n            // so the outer catch can suppress console.error.\n            throw new AuthError(errorMessage);\n          }\n          if (store.workspaces.length === 0) {\n            console.error(\"Failed to fetch organizations:\", result.errors);\n          }\n          throw new Error(errorMessage);\n        }\n\n        let orgs: Organization[] = result.data?.myOrganizations?.items ?? [];\n\n        // Stale-context recovery: bootstrap query was filtered by\n        // initialTargetOrgId, so when the URL/persisted org doesn't belong to\n        // this user the response is empty. Re-fetch the unfiltered list of\n        // *all* orgs the user can access so the guard below can pick a real\n        // default. Skip the recovery when no target was set (already\n        // unfiltered) or when workspaces are already in the store (the\n        // existing fallback path covers that case).\n        if (\n          initialTargetOrgId &&\n          orgs.length === 0 &&\n          store.workspaces.length === 0\n        ) {\n          const recovery = await graphqlFetch<MyOrganizationsResponse>({\n            gateway: \"global\",\n            query: MY_ORGANIZATIONS_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          if (!recovery.errors?.length) {\n            orgs = recovery.data?.myOrganizations?.items ?? [];\n            // discard the filtered workspaces payload — it was for the\n            // ghost org and would only mislead the workspace selector below.\n            result = {\n              ...recovery,\n              data: {\n                myOrganizations: recovery.data?.myOrganizations ?? {\n                  items: [],\n                  total: 0,\n                },\n              },\n            };\n          } else {\n            // Surface the failure so a user reporting \"blank org list\" has\n            // something to grep for in the console. We still fall through —\n            // the guard below either picks from a fallback (workspaces in\n            // store) or no-ops, leaving the existing error path in place.\n            console.warn(\n              \"[ContextSwitcher] Stale-context recovery failed:\",\n              recovery.errors,\n            );\n          }\n        }\n\n        const fallbackOrganizations =\n          orgs.length === 0 && store.workspaces.length > 0\n            ? buildFallbackOrganizations(store.workspaces)\n            : [];\n        const effectiveOrganizations =\n          fallbackOrganizations.length > 0 ? fallbackOrganizations : orgs;\n\n        store.setOrganizations(effectiveOrganizations);\n\n        // Determine which organization to use for workspace fetching\n        let targetOrgId = initialTargetOrgId;\n\n        // Stale-context guard: if the persisted/URL org isn't in the user's\n        // accessible orgs, fall back to the first available one and clear the\n        // stale workspace/project so they get re-derived. Without this, URL\n        // params like ?org=<ghost-id> from a prior session leak into the new\n        // user's request headers and cause \"Authentication required\" /\n        // \"not a member\" errors at every subgraph.\n        //\n        // Check against `orgs` (freshly returned from the API in this same\n        // closure) rather than `effectiveOrganizations`, which can fall back\n        // to ids derived from `store.workspaces` — that fallback path could\n        // contain stale ghost orgIds and mask the guard.\n        const targetOrgIsAccessible =\n          targetOrgId && orgs.some((org) => org.id === targetOrgId);\n        if (targetOrgId && !targetOrgIsAccessible && orgs.length > 0) {\n          targetOrgId = orgs[0].id;\n          setActiveContext({\n            organizationId: targetOrgId,\n            workspaceId: null,\n            tenantId: null,\n            projectId: null,\n          });\n          store.setWorkspaces([]);\n          store.setProjects([]);\n          store.setCurrentWorkspaceId(null);\n          store.setCurrentProjectId(null);\n          store.setWorkspaceToken(null);\n        }\n\n        if (targetOrgId && targetOrgId !== store.currentOrganizationId) {\n          store.setCurrentOrganizationId(targetOrgId);\n        }\n\n        // Auto-select first organization if none is selected\n        if (effectiveOrganizations.length > 0 && !targetOrgId) {\n          store.setCurrentOrganizationId(effectiveOrganizations[0].id);\n          targetOrgId = effectiveOrganizations[0].id;\n        }\n\n        // Fetch workspaces for the selected/auto-selected org if:\n        // 1. We have a target org (either auto-selected or persisted from localStorage)\n        // 2. AND workspaces array is empty (not persisted, or cleared)\n        // This handles both initial login AND page refresh scenarios.\n        // Read from useAuthStore.getState() rather than the captured `store`\n        // snapshot so we see the post-guard cleared value when the org guard\n        // above fired (the local `store.workspaces` ref is stale after\n        // setWorkspaces([])).\n        if (targetOrgId && useAuthStore.getState().workspaces.length === 0) {\n          store.setLoadingWorkspaces(true);\n          try {\n            // myWorkspaces returns ALL workspaces the user is a member of\n            // across every org. Filter to the target org client-side here.\n            const bootstrappedWorkspaces =\n              initialTargetOrgId === targetOrgId\n                ? result.data?.workspaces?.items?.filter(\n                    (w) => w.organizationId === targetOrgId,\n                  )\n                : undefined;\n            const ws = bootstrappedWorkspaces\n              ? (bootstrappedWorkspaces as Workspace[])\n              : await graphqlFetch<WorkspacesByOrgResponse>({\n                  gateway: \"global\",\n                  query: WORKSPACES_BY_ORG_QUERY,\n                  authToken: token,\n                  baseUrl: globalBaseUrl,\n                }).then((wsResult) =>\n                  wsResult.errors?.length\n                    ? null\n                    : (wsResult.data?.workspaces?.items ?? []).filter(\n                        (w) => w.organizationId === targetOrgId,\n                      ),\n                );\n\n            if (ws) {\n              store.setWorkspaces(ws);\n              const persistedWorkspace = activeWorkspaceIdRef.current\n                ? ws.find(\n                    (workspace) =>\n                      workspace.id === activeWorkspaceIdRef.current,\n                  )\n                : null;\n\n              if (persistedWorkspace) {\n                store.setCurrentWorkspaceId(persistedWorkspace.id);\n              } else if (ws.length > 0) {\n                const nextActiveContext = {\n                  organizationId: targetOrgId,\n                  workspaceId: ws[0].id,\n                  tenantId: ws[0].tenantId,\n                  projectId: null,\n                };\n\n                if (activeWorkspaceIdRef.current) {\n                  // Stale-context guard: URL/persisted workspace ID is not in\n                  // the user's accessible workspaces for the active org. Fall\n                  // back to the first workspace and clear the stale URL param\n                  // so subsequent requests don't carry the ghost ID.\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  store.setWorkspaceToken(null);\n                  setActiveContext(nextActiveContext);\n                } else if (!store.currentWorkspaceId) {\n                  // Auto-select first workspace only if none is currently selected\n                  // (preserves selection from completeAuthFlow or persistence if applicable)\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  setActiveContext(nextActiveContext);\n                }\n              }\n            }\n          } catch {\n            // Non-critical — user can still select workspace manually\n          } finally {\n            store.setLoadingWorkspaces(false);\n          }\n        }\n\n        return effectiveOrganizations;\n      } catch (err) {\n        // Auth errors are expected during token refresh / page load cycles.\n        // Suppress from console.error — the useEffect will re-trigger when the\n        // auth provider refreshes the token.\n        if (err instanceof AuthError) {\n          return [];\n        }\n        const message =\n          err instanceof Error ? err.message : \"Failed to fetch organizations\";\n        if (store.workspaces.length === 0) {\n          console.error(\"Failed to fetch organizations:\", err);\n        }\n        setError(message);\n\n        if (store.workspaces.length > 0) {\n          const fallbackOrganizations = buildFallbackOrganizations(\n            store.workspaces,\n          );\n          if (fallbackOrganizations.length > 0) {\n            store.setOrganizations(fallbackOrganizations);\n            if (!store.currentOrganizationId) {\n              store.setCurrentOrganizationId(fallbackOrganizations[0].id);\n            }\n            return fallbackOrganizations;\n          }\n        }\n\n        return [];\n      } finally {\n        store.setLoadingOrganizations(false);\n        fetchOrganizationsPromiseRef.current = null;\n      }\n    })();\n\n    return fetchOrganizationsPromiseRef.current;\n  }, [globalBaseUrl, setActiveContext]);\n\n  // ===========================================================================\n  // Fetch Workspaces for Organization (Global Gateway)\n  // ===========================================================================\n\n  const fetchWorkspacesForOrg = useCallback(\n    async (organizationId: string): Promise<Workspace[]> => {\n      // Deduplicate: if a fetch for this org is already in progress, return the same promise\n      const existingPromise =\n        fetchWorkspacesPromisesRef.current.get(organizationId);\n      if (existingPromise) {\n        return existingPromise;\n      }\n\n      const store = useAuthStore.getState();\n      const token = resolveAccessToken();\n\n      if (!token || isTokenExpired(token)) {\n        return [];\n      }\n\n      store.setLoadingWorkspaces(true);\n      setError(null);\n\n      // Store the promise for deduplication before starting\n      const fetchPromise = (async () => {\n        try {\n          const result = await graphqlFetch<WorkspacesByOrgResponse>({\n            gateway: \"global\",\n            query: WORKSPACES_BY_ORG_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          // myWorkspaces returns workspaces across all the user's orgs;\n          // filter to the requested org before handing to downstream.\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === organizationId,\n            );\n          }\n\n          if (result.errors?.length) {\n            const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n            if (isAuthGraphQLError(result.errors)) {\n              throw new AuthError(errorMessage);\n            }\n            console.error(\"Failed to fetch workspaces:\", result.errors);\n            throw new Error(errorMessage);\n          }\n\n          // `myWorkspaces` returns every workspace the caller can see across\n          // all of their orgs/tenants. The store key is per-org (selecting\n          // org X then opening the dropdown should only show X's workspaces),\n          // so we filter down to the requested org here. The dropdown filter\n          // in ContextSwitcher.tsx is a defence-in-depth — without this\n          // narrowing the store would briefly hold the caller's other-org\n          // workspaces and the auto-pick logic (lines below) might select\n          // one of them as the default.\n          const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n          const ws = allWs.filter((w) => w.organizationId === organizationId);\n          store.setWorkspaces(ws);\n          return ws;\n        } catch (err) {\n          if (err instanceof AuthError) {\n            return [];\n          }\n          const message =\n            err instanceof Error ? err.message : \"Failed to fetch workspaces\";\n          console.error(\"Failed to fetch workspaces:\", err);\n          setError(message);\n          return [];\n        } finally {\n          store.setLoadingWorkspaces(false);\n          fetchWorkspacesPromisesRef.current.delete(organizationId);\n        }\n      })();\n\n      fetchWorkspacesPromisesRef.current.set(organizationId, fetchPromise);\n      return fetchPromise;\n    },\n    [globalBaseUrl],\n  );\n\n  // ===========================================================================\n  // Issue Workspace Token (Workspace Gateway - wspace-auth-svc)\n  // ===========================================================================\n\n  const issueWorkspaceToken = useCallback(\n    async (\n      organizationId: string,\n      workspaceId?: string,\n      projectId?: string | null,\n    ): Promise<{\n      success: boolean;\n      token?: string;\n      resolvedWorkspaceId?: string;\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n      const authToken = resolveAccessToken();\n\n      if (!authToken || isTokenExpired(authToken)) {\n        return { success: false, error: \"No valid access token available\" };\n      }\n\n      setError(null);\n\n      try {\n        const result = await graphqlFetch<{\n          issueWorkspaceToken: IssueWorkspaceTokenResult;\n        }>({\n          gateway: \"workspace\",\n          query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n          variables: {\n            input: {\n              organizationId,\n              ...(workspaceId && { workspaceId }),\n              ...(projectId && { projectId }),\n            },\n          },\n          authToken,\n          baseUrl: workspaceBaseUrl,\n        });\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (!isAuthGraphQLError(result.errors)) {\n            console.error(\"Failed to issue workspace token:\", result.errors);\n          }\n          return { success: false, error: errorMessage };\n        }\n\n        const tokenResult = result.data?.issueWorkspaceToken;\n\n        if (tokenResult?.success && tokenResult.token) {\n          const resolvedWsId = tokenResult.workspaceId || workspaceId;\n          if (resolvedWsId) {\n            store.setCurrentWorkspaceId(resolvedWsId);\n          }\n          store.setWorkspaceToken(tokenResult.token);\n          return {\n            success: true,\n            token: tokenResult.token,\n            resolvedWorkspaceId: resolvedWsId || undefined,\n          };\n        }\n\n        return {\n          success: false,\n          error:\n            tokenResult?.error?.message ?? \"Failed to issue workspace token\",\n        };\n      } catch (err) {\n        const message =\n          err instanceof Error\n            ? err.message\n            : \"Failed to issue workspace token\";\n        console.error(\"Failed to issue workspace token:\", err);\n        setError(message);\n        return { success: false, error: message };\n      }\n    },\n    [workspaceBaseUrl],\n  );\n\n  // ===========================================================================\n  // Fetch Projects (Workspace Gateway - requires workspace token)\n  // ===========================================================================\n\n  const fetchProjects = useCallback(async (): Promise<Project[]> => {\n    const store = useAuthStore.getState();\n    const authToken = resolveAccessToken();\n    const wsToken = store.workspaceToken;\n    const workspaceId = store.currentWorkspaceId;\n\n    if (!authToken || isTokenExpired(authToken)) {\n      return [];\n    }\n\n    if (!wsToken) {\n      return [];\n    }\n\n    if (!workspaceId) {\n      return [];\n    }\n\n    store.setLoadingProjects(true);\n    setError(null);\n\n    try {\n      const result = await graphqlFetch<ProjectsResponse>({\n        gateway: \"workspace\",\n        query: PROJECTS_QUERY,\n        authToken,\n        workspaceToken: wsToken,\n        baseUrl: workspaceBaseUrl,\n      });\n\n      if (result.errors?.length) {\n        const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n        if (isAuthGraphQLError(result.errors)) {\n          throw new AuthError(errorMessage);\n        }\n        console.error(\"Failed to fetch projects:\", result.errors);\n        throw new Error(errorMessage);\n      }\n\n      const projs: Project[] = result.data?.projects?.items ?? [];\n      store.setProjects(projs);\n      return projs;\n    } catch (err) {\n      if (err instanceof AuthError) {\n        return [];\n      }\n      const message =\n        err instanceof Error ? err.message : \"Failed to fetch projects\";\n      console.error(\"Failed to fetch projects:\", err);\n      setError(message);\n      return [];\n    } finally {\n      store.setLoadingProjects(false);\n    }\n  }, [workspaceBaseUrl]);\n\n  // ===========================================================================\n  // High-Level Selection Actions\n  // ===========================================================================\n\n  const selectOrganization = useCallback(\n    async (org: Organization): Promise<Workspace[]> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentWorkspaceId(null);\n      store.setWorkspaceToken(null);\n      store.setProjects([]);\n      store.setCurrentProjectId(null);\n      store.setCurrentOrganizationId(org.id);\n\n      const ws = await fetchWorkspacesForOrg(org.id);\n      return ws;\n    },\n    [fetchWorkspacesForOrg],\n  );\n\n  const selectWorkspace = useCallback(\n    async (\n      workspace: Workspace,\n    ): Promise<{\n      success: boolean;\n      projects?: Project[];\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentProjectId(null);\n      store.setProjects([]);\n\n      if (!workspace.organizationId) {\n        console.error(\"Workspace missing organizationId:\", workspace);\n        return {\n          success: false,\n          error: \"Workspace is missing organizationId\",\n        };\n      }\n\n      const tokenResult = await issueWorkspaceToken(\n        workspace.organizationId,\n        workspace.id,\n      );\n\n      if (!tokenResult.success) {\n        return { success: false, error: tokenResult.error };\n      }\n\n      let projs = await fetchProjects();\n      if (projs.length === 0) {\n        const authToken = resolveAccessToken();\n        const workspaceToken = useAuthStore.getState().workspaceToken;\n        if (authToken && workspaceToken) {\n          const defaultProject = await createDefaultProject({\n            authToken,\n            workspaceBaseUrl,\n            workspaceToken,\n          });\n          if (defaultProject) {\n            projs = [defaultProject];\n            store.setProjects(projs);\n          }\n        }\n      }\n\n      if (projs.length > 0) {\n        store.setCurrentProjectId(projs[0]!.id);\n      }\n\n      return { success: true, projects: projs };\n    },\n    [issueWorkspaceToken, fetchProjects, workspaceBaseUrl],\n  );\n\n  const selectProject = useCallback((project: Project): void => {\n    const store = useAuthStore.getState();\n    store.setCurrentProjectId(project.id);\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: store.currentWorkspaceId,\n        organizationId: store.currentOrganizationId,\n        projectId: project.id,\n      })\n    ) {\n      store.setWorkspaceToken(null);\n    }\n  }, []);\n\n  // ===========================================================================\n  // Cross-MFE refresh: keep the switcher lists current when another MFE mutates\n  // org/workspace/project entities. microfe-workspaces emits these domain events\n  // on the shared event bus (e.g. on project rename); without this the switcher\n  // keeps showing the stale cached name until a full page reload.\n  // ===========================================================================\n\n  useEffect(() => {\n    let cancelled = false;\n\n    // Coalesce a refetch into a single in-flight run with one trailing re-run,\n    // so a burst of events collapses to one request (+ one trailing) instead of\n    // fanning out or being swallowed by a downstream per-key dedupe. The flag is\n    // cleared on cleanup so nothing fires after the subscription is torn down.\n    const makeCoalescedRefetch = (run: () => Promise<unknown>) => {\n      let running = false;\n      let queued = false;\n      const trigger = () => {\n        if (cancelled) return;\n        if (running) {\n          queued = true;\n          return;\n        }\n        running = true;\n        void run().finally(() => {\n          running = false;\n          if (!cancelled && queued) {\n            queued = false;\n            trigger();\n          }\n        });\n      };\n      return trigger;\n    };\n\n    const refreshProjects = makeCoalescedRefetch(() => fetchProjects());\n    const refreshWorkspaces = makeCoalescedRefetch(() => {\n      const orgId = useAuthStore.getState().currentOrganizationId;\n      return orgId ? fetchWorkspacesForOrg(orgId) : Promise.resolve();\n    });\n\n    // Custom domain events (not in BurdenoffEventName) flow through `onAny`.\n    const unsubscribe = eventBus.onAny((event) => {\n      // Custom event names aren't in the BurdenoffEventName union; compare as string.\n      const eventName: string = event.name;\n\n      if (PROJECT_REFRESH_EVENTS.has(eventName)) {\n        const eventWorkspaceId = readEventWorkspaceId(event.payload);\n        const { currentWorkspaceId } = useAuthStore.getState();\n        // Only refetch when the event targets the workspace currently in\n        // context (events without a workspace id are treated as relevant).\n        if (\n          eventWorkspaceId &&\n          currentWorkspaceId &&\n          eventWorkspaceId !== currentWorkspaceId\n        ) {\n          return;\n        }\n        // Refetch only — a deleted project simply drops out of the list, and\n        // `currentProject` resolves to undefined for it. Clearing the selection\n        // here would race ActiveContext / the project sync effect (the real\n        // source of truth), so we leave selection reconciliation to them.\n        refreshProjects();\n        return;\n      }\n\n      if (WORKSPACE_REFRESH_EVENTS.has(eventName)) {\n        refreshWorkspaces();\n      }\n    });\n\n    return () => {\n      cancelled = true;\n      unsubscribe();\n    };\n  }, [eventBus, fetchProjects, fetchWorkspacesForOrg]);\n\n  // ===========================================================================\n  // Get Current Items\n  // ===========================================================================\n\n  const currentOrganization = organizations.find(\n    (org) => org.id === currentOrganizationId,\n  );\n  const currentWorkspace = workspaces.find(\n    (ws) => ws.id === currentWorkspaceId,\n  );\n  const currentProject = projects.find((proj) => proj.id === currentProjectId);\n\n  // ===========================================================================\n  // Return Hook API\n  // ===========================================================================\n\n  return {\n    organizations,\n    workspaces,\n    projects,\n\n    currentOrganizationId,\n    currentWorkspaceId,\n    currentProjectId,\n\n    currentOrganization,\n    currentWorkspace,\n    currentProject,\n\n    workspaceToken,\n\n    isLoadingOrganizations,\n    isLoadingWorkspaces,\n    isLoadingProjects,\n    isLoading:\n      isLoadingOrganizations || isLoadingWorkspaces || isLoadingProjects,\n\n    error,\n\n    fetchOrganizations,\n    fetchWorkspacesForOrg,\n    issueWorkspaceToken,\n    fetchProjects,\n\n    selectOrganization,\n    selectWorkspace,\n    selectProject,\n  };\n}\n\n/**\n * Hook to reactively ensure workspaces are synced with the current organization.\n *\n * This handles edge cases where the organization changes but workspaces\n * from a different org are still in the store (e.g., stale data, race conditions).\n *\n * Usage:\n * ```tsx\n * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useWorkspaceSyncEffect(); // Ensures workspaces stay in sync\n *   // ...\n * }\n * ```\n */\nexport function useWorkspaceSyncEffect(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const disableWorkspaceSync = options?.disableWorkspaceSync ?? false;\n\n  useEffect(() => {\n    if (disableWorkspaceSync) return;\n    // Skip if no org selected, no token, or already loading\n    if (!currentOrganizationId || !accessToken || isLoadingWorkspaces) return;\n\n    // Check if any workspace matches the current org\n    const hasMatchingWorkspaces = workspaces.some(\n      (ws) => ws.organizationId === currentOrganizationId,\n    );\n\n    // If workspaces exist but none match current org, we need to refetch\n    // This can happen in edge cases with stale data or race conditions\n    if (workspaces.length > 0 && !hasMatchingWorkspaces) {\n      const store = useAuthStore.getState();\n      store.setLoadingWorkspaces(true);\n\n      // Inline fetch to avoid circular dependency with useContextSwitcherData\n      graphqlFetch<WorkspacesByOrgResponse>({\n        gateway: \"global\",\n        query: WORKSPACES_BY_ORG_QUERY,\n        authToken: accessToken,\n        baseUrl: globalBaseUrl,\n      })\n        .then((result) => {\n          // myWorkspaces returns ALL my workspaces; filter to current org\n          // client-side (the old server-side filter no longer exists).\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n          }\n          if (!result.errors?.length) {\n            const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n            // Same per-org narrowing as fetchWorkspacesForOrg — see the\n            // comment there for why we don't just dump the full caller-\n            // visible list into the store.\n            const ws = allWs.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n            store.setWorkspaces(ws);\n          }\n        })\n        .catch(() => {\n          // Silent fail - user can manually refresh or select org again\n        })\n        .finally(() => {\n          store.setLoadingWorkspaces(false);\n        });\n    }\n  }, [\n    currentOrganizationId,\n    workspaces,\n    accessToken,\n    isLoadingWorkspaces,\n    globalBaseUrl,\n    disableWorkspaceSync,\n  ]);\n}\n\n/**\n * Hook to reactively ensure projects are loaded when a workspace is selected.\n *\n * This handles the case where a workspace is auto-selected (from URL/localStorage)\n * but projects haven't been fetched yet. It will:\n * 1. Issue a workspace token if not present\n * 2. Fetch projects for the selected workspace\n *\n * Usage:\n * ```tsx\n * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useProjectSyncEffect(); // Ensures projects are loaded for selected workspace\n *   // ...\n * }\n * ```\n */\nexport function useProjectSyncEffect(options?: UseContextSwitcherDataOptions) {\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n  const disableProjectSync = options?.disableProjectSync ?? false;\n  const skipProjectFetch = options?.skipProjectFetch ?? false;\n\n  // Use refs to prevent the infinite loop caused by including loading/failure\n  // state in the dependency array. Without these, the cycle is:\n  //   setLoadingProjects(true) -> dep change -> effect re-runs (guarded) ->\n  //   async completes -> setLoadingProjects(false) -> dep change ->\n  //   effect re-runs -> starts again -> INFINITE LOOP\n  const syncInProgressRef = useRef(false);\n  // Pending retry timer per workspace, so transient failures (e.g. RBAC lag\n  // right after workspace creation) get an automatic second chance even if no\n  // dependency change re-triggers the effect.\n  const retryTimerRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(\n    new Map(),\n  );\n  // Per-workspace failure tracker — caps retry attempts when project bootstrap\n  // (token issue, list, or default-create) fails. Without this, a persistent\n  // backend failure (e.g. cross-layer workspace not yet synced) causes the\n  // effect to re-fire every render: list returns empty → create-default fails\n  // → setProjects([]) → new array reference → effect re-runs → loop.\n  //\n  // We track both count AND lastFailureAt so we can honour a \"cool-down\" window:\n  // after PROJECT_SYNC_FAILURE_COOLDOWN_MS has elapsed since the last failure,\n  // the counter is treated as cleared so transient backend hiccups (e.g. RBAC\n  // role propagation lag right after signup) don't permanently lock a workspace\n  // out of the context dropdown — the original cause of marqueue §729.\n  const projectSyncFailuresRef = useRef<\n    Map<string, { count: number; lastFailureAt: number }>\n  >(new Map());\n  const PROJECT_SYNC_MAX_FAILURES = 8;\n  const PROJECT_SYNC_FAILURE_COOLDOWN_MS = 30_000;\n  useEffect(() => {\n    if (disableProjectSync) return;\n    // Skip if no workspace selected or no access token\n    if (!currentWorkspaceId || !accessToken) return;\n\n    // Skip if a sync is already in progress (ref-based guard avoids dep loop)\n    if (syncInProgressRef.current) return;\n\n    // Stop retrying once this workspace has failed too many times in a row.\n    // Counter is reset on success, on workspace switch (different key), by\n    // an explicit user retry path (e.g. selectWorkspace), or after the\n    // cool-down window has elapsed since the last failure (so transient\n    // backend issues don't permanently wedge the dropdown).\n    const failureEntry = projectSyncFailuresRef.current.get(currentWorkspaceId);\n    if (\n      failureEntry &&\n      failureEntry.count >= PROJECT_SYNC_MAX_FAILURES &&\n      Date.now() - failureEntry.lastFailureAt < PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      return;\n    }\n    if (\n      failureEntry &&\n      Date.now() - failureEntry.lastFailureAt >=\n        PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      // Cool-down elapsed — clear the counter so we get a fresh budget.\n      projectSyncFailuresRef.current.delete(currentWorkspaceId);\n    }\n\n    // Resolve organizationId: prefer the workspace object (if loaded), fall\n    // back to the persisted currentOrganizationId.  The workspaces array is\n    // NOT persisted by zustand, so on page reload it is empty until\n    // fetchOrganizations() completes.  Using the persisted org ID lets us\n    // issue the workspace token immediately instead of waiting.\n    const currentWorkspace = workspaces.find(\n      (ws) => ws.id === currentWorkspaceId,\n    );\n\n    // Guard: transient (newOrg, oldWs) divergence during org switches — token issuance always fails.\n    if (\n      currentWorkspace &&\n      currentOrganizationId &&\n      currentWorkspace.organizationId !== currentOrganizationId\n    ) {\n      return;\n    }\n\n    const organizationId =\n      currentWorkspace?.organizationId ?? currentOrganizationId;\n    if (!organizationId) return;\n\n    const store = useAuthStore.getState();\n\n    // If we don't have a workspace token or it's expired, issue one first\n    const needsToken =\n      !workspaceToken ||\n      isTokenExpired(workspaceToken) ||\n      !isWorkspaceTokenValidForContext(workspaceToken, {\n        workspaceId: currentWorkspaceId,\n        organizationId: currentOrganizationId,\n        projectId: currentProjectId,\n      });\n\n    // Skip if projects are already loaded for this workspace AND token is valid\n    const hasProjectsForWorkspace = projects.some(\n      (p) => p.workspaceId === currentWorkspaceId,\n    );\n    if (hasProjectsForWorkspace && !needsToken) {\n      if (!store.currentProjectId) {\n        const firstProject = projects.find(\n          (project) => project.workspaceId === currentWorkspaceId,\n        );\n        if (firstProject) {\n          store.setCurrentProjectId(firstProject.id);\n        }\n      }\n      return;\n    }\n\n    const syncProjects = async () => {\n      syncInProgressRef.current = true;\n      store.setLoadingProjects(true);\n      let succeeded = false;\n\n      try {\n        let wsToken = workspaceToken;\n\n        // Issue workspace token if needed\n        if (needsToken) {\n          const tokenResult = await graphqlFetch<{\n            issueWorkspaceToken: IssueWorkspaceTokenResult;\n          }>({\n            gateway: \"workspace\",\n            query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n            variables: {\n              input: {\n                organizationId,\n                workspaceId: currentWorkspaceId,\n                ...(currentProjectId ? { projectId: currentProjectId } : {}),\n              },\n            },\n            authToken: accessToken,\n            baseUrl: workspaceBaseUrl,\n          });\n\n          if (\n            tokenResult.data?.issueWorkspaceToken?.success &&\n            tokenResult.data.issueWorkspaceToken.token\n          ) {\n            wsToken = tokenResult.data.issueWorkspaceToken.token;\n            store.setWorkspaceToken(wsToken);\n          } else {\n            return;\n          }\n        }\n\n        // Fetch projects (skip if already loaded or token-only sync requested)\n        if (wsToken && !hasProjectsForWorkspace && !skipProjectFetch) {\n          const projectsResult = await graphqlFetch<ProjectsResponse>({\n            gateway: \"workspace\",\n            query: PROJECTS_QUERY,\n            authToken: accessToken,\n            workspaceToken: wsToken,\n            baseUrl: workspaceBaseUrl,\n          });\n\n          if (projectsResult.errors?.length) {\n            return;\n          }\n\n          let projs: Project[] = projectsResult.data?.projects?.items ?? [];\n          if (projs.length === 0) {\n            const defaultProject = await createDefaultProject({\n              authToken: accessToken,\n              workspaceBaseUrl,\n              workspaceToken: wsToken,\n            });\n            if (defaultProject) {\n              projs = [defaultProject];\n            } else {\n              // Default-project creation failed (e.g. workspace not yet\n              // propagated to the workspace layer). Do NOT write [] back —\n              // that would change the projects reference and re-trigger\n              // this effect on the next render.\n              return;\n            }\n          }\n\n          store.setProjects(projs);\n\n          // Auto-select first project if none selected and projects exist\n          if (projs.length > 0 && !store.currentProjectId) {\n            store.setCurrentProjectId(projs[0].id);\n          }\n        }\n\n        succeeded = true;\n      } catch {\n        // A later auth/context update should be able to retry.\n      } finally {\n        store.setLoadingProjects(false);\n        syncInProgressRef.current = false;\n        const failures = projectSyncFailuresRef.current;\n        if (succeeded) {\n          failures.delete(currentWorkspaceId);\n          const pending = retryTimerRef.current.get(currentWorkspaceId);\n          if (pending) {\n            clearTimeout(pending);\n            retryTimerRef.current.delete(currentWorkspaceId);\n          }\n        } else {\n          const existing = failures.get(currentWorkspaceId);\n          const nextCount = (existing?.count ?? 0) + 1;\n          failures.set(currentWorkspaceId, {\n            count: nextCount,\n            lastFailureAt: Date.now(),\n          });\n          // Schedule a backoff retry for transient backend lag (e.g. RBAC\n          // role propagation right after signup → first projects() call hits\n          // permission-denied). Without this, the effect would only re-run on\n          // dep change and the user would be stuck staring at an empty\n          // project dropdown until something else triggered a re-render.\n          if (nextCount < PROJECT_SYNC_MAX_FAILURES) {\n            const existingTimer = retryTimerRef.current.get(currentWorkspaceId);\n            if (existingTimer) clearTimeout(existingTimer);\n            const backoffMs = Math.min(1000 * 2 ** (nextCount - 1), 8000);\n            const timer = setTimeout(() => {\n              retryTimerRef.current.delete(currentWorkspaceId);\n              // Only re-run if the workspace context is still the same and\n              // a project hasn't been loaded for it in the meantime.\n              const latest = useAuthStore.getState();\n              if (\n                latest.currentWorkspaceId === currentWorkspaceId &&\n                !latest.projects.some(\n                  (p) => p.workspaceId === currentWorkspaceId,\n                ) &&\n                !syncInProgressRef.current\n              ) {\n                // Bump a render by clearing then resetting workspaceToken\n                // when valid, OR by re-issuing projects fetch directly. The\n                // simplest robust trigger is to clear the in-progress guard\n                // and call syncProjects() again with current closure values.\n                void syncProjects();\n              }\n            }, backoffMs);\n            retryTimerRef.current.set(currentWorkspaceId, timer);\n          }\n        }\n      }\n    };\n\n    syncProjects();\n  }, [\n    currentWorkspaceId,\n    currentOrganizationId,\n    workspaces,\n    projects,\n    currentProjectId,\n    workspaceToken,\n    accessToken,\n    workspaceBaseUrl,\n    disableProjectSync,\n    skipProjectFetch,\n  ]);\n\n  // Cleanup any pending retry timers on unmount so we don't leak stray\n  // setTimeout callbacks running against stale closures.\n  useEffect(() => {\n    const timers = retryTimerRef.current;\n    return () => {\n      timers.forEach((timer) => clearTimeout(timer));\n      timers.clear();\n    };\n  }, []);\n}\n// hmr-bust-1778064429\n"],"mappings":";;;;;;;AAmFA,IAAM,IAAyB,2RAoCzB,IAA0B,oSAoB1B,IAAmC,kiBAoCnC,IAAiC,6SA0BjC,IAAiB,uPAkBjB,IAAkC;AAexC,eAAe,EAAqB,EAClC,cACA,qBACA,qBAK0B;CAC1B,IAAM,IAAS,MAAM,EAAoC;EACvD,SAAS;EACT,OAAO;EACP,WAAW,EACT,OAAO,EACL,MAAM,mBACP,EACF;EACD;EACA;EACA,SAAS;EACV,CAAC;AAOF,QALI,EAAO,QAAQ,UACjB,QAAQ,KAAK,qCAAqC,EAAO,OAAO,EACzD,QAGF,EAAO,MAAM,iBAAiB;;AAWvC,SAAS,EAAe,GAAe,IAAW,KAAiB;AACjE,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AAErD,SADK,EAAQ,MACN,EAAQ,MAAM,MAAO,KAAK,KAAK,GAAG,IADhB;SAEnB;AACN,SAAO;;;AAIX,SAAS,EAAyB,GAKzB;AACP,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AACrD,SAAO;GACL,aACE,OAAO,EAAQ,eAAgB,WAC3B,EAAQ,cACR,KAAA;GACN,gBACE,OAAO,EAAQ,kBAAmB,WAC9B,EAAQ,iBACR,KAAA;GACN,WACE,OAAO,EAAQ,aAAc,WAAW,EAAQ,YAAY,KAAA;GAC9D,KAAK,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,KAAA;GACtD;SACK;AACN,SAAO;;;AAIX,SAAS,EACP,GACA,GAKiB;AACjB,KAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO;CAGT,IAAM,IAAU,EAAyB,EAAM;AAoB/C,QAJA,EAfI,CAAC,KAID,EAAS,eAAe,EAAQ,gBAAgB,EAAS,eAK3D,EAAS,kBACT,EAAQ,mBAAmB,EAAS,kBAKlC,EAAS,aAAa,EAAQ,cAAc,EAAS;;AAa3D,IAAM,IAAN,cAAwB,MAAM;CAC5B,YAAY,GAAiB;AAE3B,EADA,MAAM,EAAQ,EACd,KAAK,OAAO;;;AAOhB,SAAS,EACP,GACS;AACT,QAAO,EAAO,MACX,MACC,EAAE,YAAY,SAAS,qBACvB,EAAE,SAAS,aAAa,CAAC,SAAS,eAAe,IACjD,EAAE,SAAS,aAAa,CAAC,SAAS,oBAAoB,CACzD;;AASH,SAAS,IAAoC;CAC3C,IAAM,IAAa,EAAa,UAAU,CAAC;AAG3C,KAAI,KAAc,CAAC,EAAe,EAAW,CAC3C,QAAO;CAIT,IAAM,IAAe,GAAoB;AAQzC,QAPI,KAAgB,CAAC,EAAe,EAAa,GACxC,IAMF;;AAGT,SAAS,EAA2B,GAAyC;AAS3E,QARqB,MAAM,KACzB,IAAI,IACF,EAAW,SAAS,MAClB,EAAU,iBAAiB,CAAC,EAAU,eAAe,GAAG,EAAE,CAC3D,CACF,CACF,CAEmB,KAAK,GAAgB,OAAW;EAClD,IAAI;EACJ,MACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,QAAQ,gBAAgB,IAAQ;EACrC,MAAM;EACN,UACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,YAAY;EAClB,EAAE;;AAuBL,IAAM,IAAyB,IAAI,IAAY;CAC7C;CACA;CACA;CACA;CACA;CACD,CAAC,EACI,IAA2B,IAAI,IAAY;CAC/C;CACA;CACA;CACA;CACA;CACD,CAAC;AAKF,SAAS,EAAqB,GAAsC;AAClE,KAAI,KAAW,OAAO,KAAY,YAAY,iBAAiB,GAAS;EACtE,IAAM,IAAS,EAAsC;AACrD,SAAO,OAAO,KAAU,WAAW,IAAQ,KAAA;;;AAK/C,SAAgB,EACd,GACA;CACA,IAAM,EACJ,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,YAAY,MACV,GAAkB,EAEhB,IAAW,GAAa,EAGxB,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAyB,GAC5B,MAAU,EAAM,uBAClB,EAEK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,KAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAsB,GACzB,MAAU,EAAM,oBAClB,EAEK,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAoB,GAAc,MAAU,EAAM,kBAAkB,EAGpE,CAAC,IAAO,KAAY,EAAwB,KAAK,EAGjD,IAA+B,EACnC,KACD,EACK,IAA6B,kBACjC,IAAI,KAAK,CACV,EAKK,IAAuB,EAAO,EAAkB,EAChD,IAA0B,EAAO,EAAqB;AAC5D,SAAgB;AAEd,EADA,EAAqB,UAAU,GAC/B,EAAwB,UAAU;GAClC;CAEF,IAAM,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IACJ,GAAS,oBAAoB,EAAiB,kBAS1C,IAAsB,EAAsB,KAAK,EACjD,IAA4B,EAAsB,KAAK,EACvD,IAA0B,EAAsB,KAAK,EACrD,IAA6B,EAAsB,KAAK;AAE9D,SAAgB;EACd,IAAM,IAAQ,EAAa,UAAU;AA8CrC,MA3CE,KACA,MAAyB,EAAM,yBAC/B,MAAyB,EAAoB,YAE7C,EAAoB,UAAU,GAC9B,EAAM,yBAAyB,EAAqB,EAElD,EAAM,WAAW,SAAS,KAC1B,CAAC,EAAM,WAAW,MACf,MAAc,EAAU,mBAAmB,EAC7C,IAED,EAAM,cAAc,EAAE,CAAC,GAKzB,KACA,MAAsB,EAAM,sBAC5B,MAAsB,EAA0B,YAEhD,EAA0B,UAAU,GACpC,EAAM,sBAAsB,EAAkB,EAE5C,EAAM,SAAS,SAAS,KACxB,CAAC,EAAM,SAAS,MACb,MAAY,EAAQ,gBAAgB,EACtC,KAED,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,IAKjC,KACA,MAAoB,EAAM,oBAC1B,MAAoB,EAAwB,YAE5C,EAAwB,UAAU,GAClC,EAAM,oBAAoB,EAAgB,GAI1C,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EACF;GAOA,IAAM,IAAS,GAAG,KAAwB,GAAG,GAAG,KAAqB,GAAG,GAAG,KAAmB;AAC9F,GAAI,EAA2B,YAAY,MACzC,EAA2B,UAAU,GACrC,EAAM,kBAAkB,KAAK;;IAGhC;EAAC;EAAsB;EAAmB;EAAgB,CAAC;CAM9D,IAAM,KAAqB,EAAY,YAAqC;AAE1E,MAAI,EAA6B,QAC/B,QAAO,EAA6B;EAGtC,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AAsTlC,SApTI,CAAC,KASD,EAAe,EAAM,GAChB,EAAE,IAGX,EAAM,wBAAwB,GAAK,EACnC,EAAS,KAAK,EAGd,EAA6B,WAAW,YAAY;AAClD,OAAI;IACF,IAAM,IACJ,EAAwB,WAAW,EAAM,uBACvC,IAAS,MAAM,EAEjB;KACA,SAAS;KACT,OAAO,IACH,IACA;KAKJ,WAAW,KAAA;KACX,WAAW;KACX,SAAS;KACV,CAAC;AAsDF,QA3CE,KACA,EAAO,QAAQ,UACf,EAAO,OAAO,MACX,MACC,GAAG,YAAY,SAAS,eACxB,qCAAqC,KAAK,GAAG,WAAW,GAAG,IAO3D,oEAAoE,KAClE,GAAG,WAAW,GACf,CACJ,KAOD,IAAS,MAAM,EAEb;KACA,SAAS;KACT,OAAO;KAYP,WAAW;KACX,SAAS;KACV,CAAC,GAGA,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AASlD,WARI,EAAmB,EAAO,OAAO,GAG7B,IAAI,EAAU,EAAa,IAE/B,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAO,OAAO,EAEtD,MAAM,EAAa;;IAG/B,IAAI,IAAuB,EAAO,MAAM,iBAAiB,SAAS,EAAE;AASpE,QACE,KACA,EAAK,WAAW,KAChB,EAAM,WAAW,WAAW,GAC5B;KACA,IAAM,IAAW,MAAM,EAAsC;MAC3D,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC;AACF,KAAK,EAAS,QAAQ,SAkBpB,QAAQ,KACN,oDACA,EAAS,OACV,IApBD,IAAO,EAAS,MAAM,iBAAiB,SAAS,EAAE,EAGlD,IAAS;MACP,GAAG;MACH,MAAM,EACJ,iBAAiB,EAAS,MAAM,mBAAmB;OACjD,OAAO,EAAE;OACT,OAAO;OACR,EACF;MACF;;IAaL,IAAM,IACJ,EAAK,WAAW,KAAK,EAAM,WAAW,SAAS,IAC3C,EAA2B,EAAM,WAAW,GAC5C,EAAE,EACF,IACJ,EAAsB,SAAS,IAAI,IAAwB;AAE7D,MAAM,iBAAiB,EAAuB;IAG9C,IAAI,IAAc,GAaZ,IACJ,KAAe,EAAK,MAAM,MAAQ,EAAI,OAAO,EAAY;AAkC3D,QAjCI,KAAe,CAAC,KAAyB,EAAK,SAAS,MACzD,IAAc,EAAK,GAAG,IACtB,EAAiB;KACf,gBAAgB;KAChB,aAAa;KACb,UAAU;KACV,WAAW;KACZ,CAAC,EACF,EAAM,cAAc,EAAE,CAAC,EACvB,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,sBAAsB,KAAK,EACjC,EAAM,oBAAoB,KAAK,EAC/B,EAAM,kBAAkB,KAAK,GAG3B,KAAe,MAAgB,EAAM,yBACvC,EAAM,yBAAyB,EAAY,EAIzC,EAAuB,SAAS,KAAK,CAAC,MACxC,EAAM,yBAAyB,EAAuB,GAAG,GAAG,EAC5D,IAAc,EAAuB,GAAG,KAWtC,KAAe,EAAa,UAAU,CAAC,WAAW,WAAW,GAAG;AAClE,OAAM,qBAAqB,GAAK;AAChC,SAAI;MAGF,IAMM,KALJ,MAAuB,IACnB,EAAO,MAAM,YAAY,OAAO,QAC7B,MAAM,EAAE,mBAAmB,EAC7B,GACD,KAAA,MAGF,MAAM,EAAsC;OAC1C,SAAS;OACT,OAAO;OACP,WAAW;OACX,SAAS;OACV,CAAC,CAAC,MAAM,MACP,EAAS,QAAQ,SACb,QACC,EAAS,MAAM,YAAY,SAAS,EAAE,EAAE,QACtC,MAAM,EAAE,mBAAmB,EAC7B,CACN;AAEL,UAAI,GAAI;AACN,SAAM,cAAc,EAAG;OACvB,IAAM,IAAqB,EAAqB,UAC5C,EAAG,MACA,MACC,EAAU,OAAO,EAAqB,QACzC,GACD;AAEJ,WAAI,EACF,GAAM,sBAAsB,EAAmB,GAAG;gBACzC,EAAG,SAAS,GAAG;QACxB,IAAM,IAAoB;SACxB,gBAAgB;SAChB,aAAa,EAAG,GAAG;SACnB,UAAU,EAAG,GAAG;SAChB,WAAW;SACZ;AAED,QAAI,EAAqB,WAKvB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAM,kBAAkB,KAAK,EAC7B,EAAiB,EAAkB,IACzB,EAAM,uBAGhB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAiB,EAAkB;;;aAInC,WAEE;AACR,QAAM,qBAAqB,GAAM;;;AAIrC,WAAO;YACA,GAAK;AAIZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAMvC,QALI,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAI,EAEtD,EAAS,EAAQ,EAEb,EAAM,WAAW,SAAS,GAAG;KAC/B,IAAM,IAAwB,EAC5B,EAAM,WACP;AACD,SAAI,EAAsB,SAAS,EAKjC,QAJA,EAAM,iBAAiB,EAAsB,EACxC,EAAM,yBACT,EAAM,yBAAyB,EAAsB,GAAG,GAAG,EAEtD;;AAIX,WAAO,EAAE;aACD;AAER,IADA,EAAM,wBAAwB,GAAM,EACpC,EAA6B,UAAU;;MAEvC,EAEG,EAA6B;IACnC,CAAC,GAAe,EAAiB,CAAC,EAM/B,IAAwB,EAC5B,OAAO,MAAiD;EAEtD,IAAM,IACJ,EAA2B,QAAQ,IAAI,EAAe;AACxD,MAAI,EACF,QAAO;EAGT,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AAElC,MAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO,EAAE;AAIX,EADA,EAAM,qBAAqB,GAAK,EAChC,EAAS,KAAK;EAGd,IAAM,KAAgB,YAAY;AAChC,OAAI;IACF,IAAM,IAAS,MAAM,EAAsC;KACzD,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;KACV,CAAC;AASF,QANI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAGC,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,WAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,+BAA+B,EAAO,OAAO,EACjD,MAAM,EAAa;;IAY/B,IAAM,KADqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAC9C,QAAQ,MAAM,EAAE,mBAAmB,EAAe;AAEnE,WADA,EAAM,cAAc,EAAG,EAChB;YACA,GAAK;AACZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,WAFA,QAAQ,MAAM,+BAA+B,EAAI,EACjD,EAAS,EAAQ,EACV,EAAE;aACD;AAER,IADA,EAAM,qBAAqB,GAAM,EACjC,EAA2B,QAAQ,OAAO,EAAe;;MAEzD;AAGJ,SADA,EAA2B,QAAQ,IAAI,GAAgB,EAAa,EAC7D;IAET,CAAC,EAAc,CAChB,EAMK,IAAsB,EAC1B,OACE,GACA,GACA,MAMI;EACJ,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB;AAEtC,MAAI,CAAC,KAAa,EAAe,EAAU,CACzC,QAAO;GAAE,SAAS;GAAO,OAAO;GAAmC;AAGrE,IAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAElB;IACD,SAAS;IACT,OAAO;IACP,WAAW,EACT,OAAO;KACL;KACA,GAAI,KAAe,EAAE,gBAAa;KAClC,GAAI,KAAa,EAAE,cAAW;KAC/B,EACF;IACD;IACA,SAAS;IACV,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAIlD,WAHK,EAAmB,EAAO,OAAO,IACpC,QAAQ,MAAM,oCAAoC,EAAO,OAAO,EAE3D;KAAE,SAAS;KAAO,OAAO;KAAc;;GAGhD,IAAM,IAAc,EAAO,MAAM;AAEjC,OAAI,GAAa,WAAW,EAAY,OAAO;IAC7C,IAAM,IAAe,EAAY,eAAe;AAKhD,WAJI,KACF,EAAM,sBAAsB,EAAa,EAE3C,EAAM,kBAAkB,EAAY,MAAM,EACnC;KACL,SAAS;KACT,OAAO,EAAY;KACnB,qBAAqB,KAAgB,KAAA;KACtC;;AAGH,UAAO;IACL,SAAS;IACT,OACE,GAAa,OAAO,WAAW;IAClC;WACM,GAAK;GACZ,IAAM,IACJ,aAAe,QACX,EAAI,UACJ;AAGN,UAFA,QAAQ,MAAM,oCAAoC,EAAI,EACtD,EAAS,EAAQ,EACV;IAAE,SAAS;IAAO,OAAO;IAAS;;IAG7C,CAAC,EAAiB,CACnB,EAMK,IAAgB,EAAY,YAAgC;EAChE,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB,EAChC,IAAU,EAAM,gBAChB,IAAc,EAAM;AAU1B,MARI,CAAC,KAAa,EAAe,EAAU,IAIvC,CAAC,KAID,CAAC,EACH,QAAO,EAAE;AAIX,EADA,EAAM,mBAAmB,GAAK,EAC9B,EAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAA+B;IAClD,SAAS;IACT,OAAO;IACP;IACA,gBAAgB;IAChB,SAAS;IACV,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,UAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,6BAA6B,EAAO,OAAO,EAC/C,MAAM,EAAa;;GAG/B,IAAM,IAAmB,EAAO,MAAM,UAAU,SAAS,EAAE;AAE3D,UADA,EAAM,YAAY,EAAM,EACjB;WACA,GAAK;AACZ,OAAI,aAAe,EACjB,QAAO,EAAE;GAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,UAFA,QAAQ,MAAM,6BAA6B,EAAI,EAC/C,EAAS,EAAQ,EACV,EAAE;YACD;AACR,KAAM,mBAAmB,GAAM;;IAEhC,CAAC,EAAiB,CAAC,EAMhB,KAAqB,EACzB,OAAO,MAA4C;EACjD,IAAM,IAAQ,EAAa,UAAU;AASrC,SAPA,EAAM,sBAAsB,KAAK,EACjC,EAAM,kBAAkB,KAAK,EAC7B,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,EAC/B,EAAM,yBAAyB,EAAI,GAAG,EAE3B,MAAM,EAAsB,EAAI,GAAG;IAGhD,CAAC,EAAsB,CACxB,EAEK,KAAkB,EACtB,OACE,MAKI;EACJ,IAAM,IAAQ,EAAa,UAAU;AAKrC,MAHA,EAAM,oBAAoB,KAAK,EAC/B,EAAM,YAAY,EAAE,CAAC,EAEjB,CAAC,EAAU,eAEb,QADA,QAAQ,MAAM,qCAAqC,EAAU,EACtD;GACL,SAAS;GACT,OAAO;GACR;EAGH,IAAM,IAAc,MAAM,EACxB,EAAU,gBACV,EAAU,GACX;AAED,MAAI,CAAC,EAAY,QACf,QAAO;GAAE,SAAS;GAAO,OAAO,EAAY;GAAO;EAGrD,IAAI,IAAQ,MAAM,GAAe;AACjC,MAAI,EAAM,WAAW,GAAG;GACtB,IAAM,IAAY,GAAoB,EAChC,IAAiB,EAAa,UAAU,CAAC;AAC/C,OAAI,KAAa,GAAgB;IAC/B,IAAM,IAAiB,MAAM,EAAqB;KAChD;KACA;KACA;KACD,CAAC;AACF,IAAI,MACF,IAAQ,CAAC,EAAe,EACxB,EAAM,YAAY,EAAM;;;AAS9B,SAJI,EAAM,SAAS,KACjB,EAAM,oBAAoB,EAAM,GAAI,GAAG,EAGlC;GAAE,SAAS;GAAM,UAAU;GAAO;IAE3C;EAAC;EAAqB;EAAe;EAAiB,CACvD,EAEK,KAAgB,GAAa,MAA2B;EAC5D,IAAM,IAAQ,EAAa,UAAU;AAErC,EADA,EAAM,oBAAoB,EAAQ,GAAG,EAEnC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa,EAAM;GACnB,gBAAgB,EAAM;GACtB,WAAW,EAAQ;GACpB,CAAC,IAEF,EAAM,kBAAkB,KAAK;IAE9B,EAAE,CAAC;AA+FN,QAtFA,QAAgB;EACd,IAAI,IAAY,IAMV,KAAwB,MAAgC;GAC5D,IAAI,IAAU,IACV,IAAS,IACP,UAAgB;AAChB,YACJ;SAAI,GAAS;AACX,UAAS;AACT;;AAGG,KADL,IAAU,IACL,GAAK,CAAC,cAAc;AAEvB,MADA,IAAU,IACN,CAAC,KAAa,MAChB,IAAS,IACT,GAAS;OAEX;;;AAEJ,UAAO;KAGH,IAAkB,QAA2B,GAAe,CAAC,EAC7D,IAAoB,QAA2B;GACnD,IAAM,IAAQ,EAAa,UAAU,CAAC;AACtC,UAAO,IAAQ,EAAsB,EAAM,GAAG,QAAQ,SAAS;IAC/D,EAGI,IAAc,EAAS,OAAO,MAAU;GAE5C,IAAM,IAAoB,EAAM;AAEhC,OAAI,EAAuB,IAAI,EAAU,EAAE;IACzC,IAAM,IAAmB,EAAqB,EAAM,QAAQ,EACtD,EAAE,0BAAuB,EAAa,UAAU;AAGtD,QACE,KACA,KACA,MAAqB,EAErB;AAMF,OAAiB;AACjB;;AAGF,GAAI,EAAyB,IAAI,EAAU,IACzC,GAAmB;IAErB;AAEF,eAAa;AAEX,GADA,IAAY,IACZ,GAAa;;IAEd;EAAC;EAAU;EAAe;EAAsB,CAAC,EAkB7C;EACL;EACA;EACA;EAEA;EACA;EACA;EAEA,qBArB0B,EAAc,MACvC,MAAQ,EAAI,OAAO,EACrB;EAoBC,kBAnBuB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;EAkBC,gBAjBqB,EAAS,MAAM,MAAS,EAAK,OAAO,EAAiB;EAmB1E;EAEA;EACA;EACA;EACA,WACE,KAA0B,KAAuB;EAEnD;EAEA;EACA;EACA;EACA;EAEA;EACA;EACA;EACD;;AAmBH,SAAgB,EACd,GACA;CACA,IAAM,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAsB,GACzB,MAAU,EAAM,oBAClB,EACK,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IAAuB,GAAS,wBAAwB;AAE9D,SAAgB;AAGd,MAFI,KAEA,CAAC,KAAyB,CAAC,KAAe,EAAqB;EAGnE,IAAM,IAAwB,EAAW,MACtC,MAAO,EAAG,mBAAmB,EAC/B;AAID,MAAI,EAAW,SAAS,KAAK,CAAC,GAAuB;GACnD,IAAM,IAAQ,EAAa,UAAU;AAIrC,GAHA,EAAM,qBAAqB,GAAK,EAGhC,EAAsC;IACpC,SAAS;IACT,OAAO;IACP,WAAW;IACX,SAAS;IACV,CAAC,CACC,MAAM,MAAW;AAQhB,QALI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAEC,CAAC,EAAO,QAAQ,QAAQ;KAK1B,IAAM,KAJqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAI9C,QACd,MAAM,EAAE,mBAAmB,EAC7B;AACD,OAAM,cAAc,EAAG;;KAEzB,CACD,YAAY,GAEX,CACD,cAAc;AACb,MAAM,qBAAqB,GAAM;KACjC;;IAEL;EACD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;;AAqBJ,SAAgB,EAAqB,GAAyC;CAC5E,IAAM,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAmB,GAAwB,EAC3C,IACJ,GAAS,oBAAoB,EAAiB,kBAC1C,IAAqB,GAAS,sBAAsB,IACpD,IAAmB,GAAS,oBAAoB,IAOhD,IAAoB,EAAO,GAAM,EAIjC,IAAgB,kBACpB,IAAI,KAAK,CACV,EAYK,IAAyB,kBAE7B,IAAI,KAAK,CAAC,EAEN,IAAmC;AAqOzC,CApOA,QAAgB;AAMd,MALI,KAEA,CAAC,KAAsB,CAAC,KAGxB,EAAkB,QAAS;EAO/B,IAAM,IAAe,EAAuB,QAAQ,IAAI,EAAmB;AAC3E,MACE,KACA,EAAa,SAAS,KACtB,KAAK,KAAK,GAAG,EAAa,gBAAgB,EAE1C;AAEF,EACE,KACA,KAAK,KAAK,GAAG,EAAa,iBACxB,KAGF,EAAuB,QAAQ,OAAO,EAAmB;EAQ3D,IAAM,IAAmB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;AAGD,MACE,KACA,KACA,EAAiB,mBAAmB,EAEpC;EAGF,IAAM,IACJ,GAAkB,kBAAkB;AACtC,MAAI,CAAC,EAAgB;EAErB,IAAM,IAAQ,EAAa,UAAU,EAG/B,IACJ,CAAC,KACD,EAAe,EAAe,IAC9B,CAAC,EAAgC,GAAgB;GAC/C,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EAGE,IAA0B,EAAS,MACtC,MAAM,EAAE,gBAAgB,EAC1B;AACD,MAAI,KAA2B,CAAC,GAAY;AAC1C,OAAI,CAAC,EAAM,kBAAkB;IAC3B,IAAM,IAAe,EAAS,MAC3B,MAAY,EAAQ,gBAAgB,EACtC;AACD,IAAI,KACF,EAAM,oBAAoB,EAAa,GAAG;;AAG9C;;EAGF,IAAM,IAAe,YAAY;AAE/B,GADA,EAAkB,UAAU,IAC5B,EAAM,mBAAmB,GAAK;GAC9B,IAAI,IAAY;AAEhB,OAAI;IACF,IAAI,IAAU;AAGd,QAAI,GAAY;KACd,IAAM,IAAc,MAAM,EAEvB;MACD,SAAS;MACT,OAAO;MACP,WAAW,EACT,OAAO;OACL;OACA,aAAa;OACb,GAAI,IAAmB,EAAE,WAAW,GAAkB,GAAG,EAAE;OAC5D,EACF;MACD,WAAW;MACX,SAAS;MACV,CAAC;AAEF,SACE,EAAY,MAAM,qBAAqB,WACvC,EAAY,KAAK,oBAAoB,MAGrC,CADA,IAAU,EAAY,KAAK,oBAAoB,OAC/C,EAAM,kBAAkB,EAAQ;SAEhC;;AAKJ,QAAI,KAAW,CAAC,KAA2B,CAAC,GAAkB;KAC5D,IAAM,IAAiB,MAAM,EAA+B;MAC1D,SAAS;MACT,OAAO;MACP,WAAW;MACX,gBAAgB;MAChB,SAAS;MACV,CAAC;AAEF,SAAI,EAAe,QAAQ,OACzB;KAGF,IAAI,IAAmB,EAAe,MAAM,UAAU,SAAS,EAAE;AACjE,SAAI,EAAM,WAAW,GAAG;MACtB,IAAM,IAAiB,MAAM,EAAqB;OAChD,WAAW;OACX;OACA,gBAAgB;OACjB,CAAC;AACF,UAAI,EACF,KAAQ,CAAC,EAAe;UAMxB;;AAOJ,KAHA,EAAM,YAAY,EAAM,EAGpB,EAAM,SAAS,KAAK,CAAC,EAAM,oBAC7B,EAAM,oBAAoB,EAAM,GAAG,GAAG;;AAI1C,QAAY;WACN,WAEE;AAER,IADA,EAAM,mBAAmB,GAAM,EAC/B,EAAkB,UAAU;IAC5B,IAAM,IAAW,EAAuB;AACxC,QAAI,GAAW;AACb,OAAS,OAAO,EAAmB;KACnC,IAAM,IAAU,EAAc,QAAQ,IAAI,EAAmB;AAC7D,KAAI,MACF,aAAa,EAAQ,EACrB,EAAc,QAAQ,OAAO,EAAmB;WAE7C;KAEL,IAAM,KADW,EAAS,IAAI,EAAmB,EACpB,SAAS,KAAK;AAU3C,SATA,EAAS,IAAI,GAAoB;MAC/B,OAAO;MACP,eAAe,KAAK,KAAK;MAC1B,CAAC,EAME,IAAY,GAA2B;MACzC,IAAM,IAAgB,EAAc,QAAQ,IAAI,EAAmB;AACnE,MAAI,KAAe,aAAa,EAAc;MAC9C,IAAM,IAAY,KAAK,IAAI,MAAO,MAAM,IAAY,IAAI,IAAK,EACvD,IAAQ,iBAAiB;AAC7B,SAAc,QAAQ,OAAO,EAAmB;OAGhD,IAAM,IAAS,EAAa,UAAU;AACtC,OACE,EAAO,uBAAuB,KAC9B,CAAC,EAAO,SAAS,MACd,MAAM,EAAE,gBAAgB,EAC1B,IACD,CAAC,EAAkB,WAMd,GAAc;SAEpB,EAAU;AACb,QAAc,QAAQ,IAAI,GAAoB,EAAM;;;;;AAM5D,KAAc;IACb;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAIF,QAAgB;EACd,IAAM,IAAS,EAAc;AAC7B,eAAa;AAEX,GADA,EAAO,SAAS,MAAU,aAAa,EAAM,CAAC,EAC9C,EAAO,OAAO;;IAEf,EAAE,CAAC"}
+{"version":3,"file":"useContextSwitcherData.js","names":[],"sources":["../../../src/auth/hooks/useContextSwitcherData.ts"],"sourcesContent":["import { useCallback, useState, useEffect, useRef } from \"react\";\nimport {\n  graphqlFetch,\n  getStoredAuthToken,\n} from \"@burdenoff/fe-libs/shared/graphql\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { Organization, Workspace, Project } from \"../types\";\nimport { resolveGatewayBaseUrls } from \"../utils/gatewayBaseUrls\";\n\n// =============================================================================\n// Hook Options\n// =============================================================================\n\nexport interface UseContextSwitcherDataOptions {\n  /**\n   * Optional Global API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  globalBaseUrl?: string;\n  /**\n   * Optional Workspaces API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  workspaceBaseUrl?: string;\n  /** Disable initial organization/workspace bootstrap fetches */\n  disableBootstrap?: boolean;\n  /** Disable the workspace sync effect */\n  disableWorkspaceSync?: boolean;\n  /** Disable the project sync effect */\n  disableProjectSync?: boolean;\n  /** Only hydrate the workspace token; do not eagerly fetch projects */\n  skipProjectFetch?: boolean;\n}\n\n// =============================================================================\n// GraphQL Response Types\n// =============================================================================\n\ninterface MyOrganizationsResponse {\n  myOrganizations: {\n    total: number;\n    items: Organization[];\n  };\n}\n\ninterface WorkspacesByOrgResponse {\n  workspaces: {\n    total: number;\n    items: Workspace[];\n  };\n}\n\ntype GraphQLFetchResult<T> = Awaited<ReturnType<typeof graphqlFetch<T>>>;\n\ninterface IssueWorkspaceTokenResult {\n  success: boolean;\n  token: string | null;\n  expiresAt: string | null;\n  organizationId: string | null;\n  workspaceId: string | null;\n  projectId: string | null;\n  scopes: string[] | null;\n  error: {\n    code: string;\n    message: string;\n  } | null;\n}\n\ninterface ProjectsResponse {\n  projects: {\n    total: number;\n    items: Project[];\n  };\n}\n\ninterface CreateProjectResponse {\n  createProject: Project;\n}\n\n// =============================================================================\n// GraphQL Query/Mutation Strings\n// =============================================================================\n\nconst MY_ORGANIZATIONS_QUERY = `\n  query MyOrganizations {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\n// Both queries below historically used `workspaces(filter: $filter)` with\n// a `WorkspaceFilterInput` to fetch workspaces for a specific organization.\n// That Query field was removed/renamed in the global subgraph; calling it\n// now throws GRAPHQL_VALIDATION_FAILED (\"Cannot query field 'workspaces'\n// on type 'Query'\") which crashes the context switcher and cascades into a\n// \"Verifying workspace access...\" stuck-spinner on every Platform module\n// route (/billing, /support, /notifications, /devportal).\n//\n// The supported field is `myWorkspaces(limit, offset)` on the global\n// subgraph — self-scoped, returns the caller's workspaces across all\n// orgs. It does NOT accept a filter, so we fetch up to 100 of \"my\"\n// workspaces and let the existing downstream auto-pick logic filter by\n// organizationId client-side. The recovery path at line ~624 already\n// uses this exact aliased pattern; we're just promoting it to the\n// primary path.\nconst WORKSPACES_BY_ORG_QUERY = `\n  query WorkspacesByOrg {\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst ISSUE_WORKSPACE_TOKEN_MUTATION = `\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      expiresAt\n      organizationId\n      workspaceId\n      projectId\n      scopes\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\n// The workspace gateway exposes `myProjects` (public RBAC, caller-scoped to\n// the active workspace via x-workspace-id) and the privileged\n// `projects(filter)` (list:project). The header has no `list:project`\n// permission seeded for the typical operator, so the privileged form\n// returns FORBIDDEN even though the caller is a member of the workspace.\n// `myProjects` is the right field for \"give me the projects I can see in\n// this workspace\" — workspace scope is already established by the\n// workspace token + x-workspace-id header that we pass with the request.\nconst PROJECTS_QUERY = `\n  query MyProjectsForContext {\n    projects: myProjects {\n      total\n      items {\n        id\n        name\n        key\n        workspaceId\n        status\n        archived\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst CREATE_DEFAULT_PROJECT_MUTATION = `\n  mutation CreateDefaultProject($input: CreateProjectInput!) {\n    createProject(input: $input) {\n      id\n      name\n      key\n      workspaceId\n      status\n      archived\n      createdAt\n      updatedAt\n    }\n  }\n`;\n\nasync function createDefaultProject({\n  authToken,\n  workspaceBaseUrl,\n  workspaceToken,\n}: {\n  authToken: string;\n  workspaceBaseUrl: string;\n  workspaceToken: string;\n}): Promise<Project | null> {\n  const result = await graphqlFetch<CreateProjectResponse>({\n    gateway: \"workspace\",\n    query: CREATE_DEFAULT_PROJECT_MUTATION,\n    variables: {\n      input: {\n        name: \"Default Project\",\n      },\n    },\n    authToken,\n    workspaceToken,\n    baseUrl: workspaceBaseUrl,\n  });\n\n  if (result.errors?.length) {\n    console.warn(\"Failed to create default project:\", result.errors);\n    return null;\n  }\n\n  return result.data?.createProject ?? null;\n}\n\n// =============================================================================\n// Auth Helpers\n// =============================================================================\n\n/**\n * Check whether a JWT is expired (or within bufferMs of expiry).\n * Returns true if the token is expired, close to expiry, or malformed.\n */\nfunction isTokenExpired(token: string, bufferMs = 30_000): boolean {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    if (!payload.exp) return false;\n    return payload.exp * 1000 < Date.now() + bufferMs;\n  } catch {\n    return true;\n  }\n}\n\nfunction getWorkspaceTokenPayload(token: string): {\n  workspaceId?: string;\n  organizationId?: string;\n  projectId?: string;\n  exp?: number;\n} | null {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    return {\n      workspaceId:\n        typeof payload.workspaceId === \"string\"\n          ? payload.workspaceId\n          : undefined,\n      organizationId:\n        typeof payload.organizationId === \"string\"\n          ? payload.organizationId\n          : undefined,\n      projectId:\n        typeof payload.projectId === \"string\" ? payload.projectId : undefined,\n      exp: typeof payload.exp === \"number\" ? payload.exp : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nfunction isWorkspaceTokenValidForContext(\n  token: string | null | undefined,\n  expected: {\n    workspaceId?: string | null;\n    organizationId?: string | null;\n    projectId?: string | null;\n  },\n): token is string {\n  if (!token || isTokenExpired(token)) {\n    return false;\n  }\n\n  const payload = getWorkspaceTokenPayload(token);\n  if (!payload) {\n    return false;\n  }\n\n  if (expected.workspaceId && payload.workspaceId !== expected.workspaceId) {\n    return false;\n  }\n\n  if (\n    expected.organizationId &&\n    payload.organizationId !== expected.organizationId\n  ) {\n    return false;\n  }\n\n  if (expected.projectId && payload.projectId !== expected.projectId) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Custom error class for auth-related failures (expired token, unauthorized, etc.).\n * Used to distinguish auth errors in outer catch blocks so they can be\n * suppressed from console.error — they are expected during token refresh cycles\n * and do not indicate application bugs.\n */\nclass AuthError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * Detect whether a set of GraphQL errors are authentication-related.\n */\nfunction isAuthGraphQLError(\n  errors: Array<{ message?: string; extensions?: { code?: string } }>,\n): boolean {\n  return errors.some(\n    (e) =>\n      e.extensions?.code === \"UNAUTHENTICATED\" ||\n      e.message?.toLowerCase().includes(\"unauthorized\") ||\n      e.message?.toLowerCase().includes(\"not authenticated\"),\n  );\n}\n\n/**\n * Resolve the best available access token:\n * 1. Try the zustand store token\n * 2. If expired, fall back to profile storage (may have been refreshed)\n * 3. Return null if no valid token is available\n */\nfunction resolveAccessToken(): string | null {\n  const storeToken = useAuthStore.getState().accessToken;\n\n  // If store token is valid (or has no exp claim), use it\n  if (storeToken && !isTokenExpired(storeToken)) {\n    return storeToken;\n  }\n\n  // Store token is expired or missing — try profile storage (may be fresher)\n  const profileToken = getStoredAuthToken();\n  if (profileToken && !isTokenExpired(profileToken)) {\n    return profileToken;\n  }\n\n  // Both expired or missing — if store token exists at all, return it as a last\n  // resort (the gateway will reject it and the useEffect will re-trigger after\n  // token refresh). Returning null would silently swallow the first load.\n  return storeToken;\n}\n\nfunction buildFallbackOrganizations(workspaces: Workspace[]): Organization[] {\n  const uniqueOrgIds = Array.from(\n    new Set(\n      workspaces.flatMap((workspace) =>\n        workspace.organizationId ? [workspace.organizationId] : [],\n      ),\n    ),\n  );\n\n  return uniqueOrgIds.map((organizationId, index) => ({\n    id: organizationId,\n    name:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.name || `Organization ${index + 1}`,\n    slug: organizationId,\n    tenantId:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.tenantId || \"\",\n  }));\n}\n\n// =============================================================================\n// Hook Implementation\n// =============================================================================\n\n/**\n * Hook for managing the context switcher data (organizations, workspaces, projects)\n *\n * Data flow:\n * 1. fetchOrganizations() - Get all orgs user has access to (Global Gateway)\n * 2. selectOrganization(org) - Set current org & fetch workspaces for that org\n * 3. selectWorkspace(ws) - Issue workspace token & fetch projects\n * 4. selectProject(proj) - Set current project\n *\n * All GraphQL calls go through graphqlFetch from fe-libs which automatically\n * resolves gateway URLs and injects auth + locale headers.\n *\n * @param options - Optional configuration (gateway base URL overrides)\n */\n// Domain events emitted by microfe-workspaces that should refresh the switcher's\n// cached lists. Module-scoped so they aren't reallocated on every effect run.\nconst PROJECT_REFRESH_EVENTS = new Set<string>([\n  \"project.created\",\n  \"project.updated\",\n  \"project.deleted\",\n  \"project.archived\",\n  \"project.unarchived\",\n]);\nconst WORKSPACE_REFRESH_EVENTS = new Set<string>([\n  \"workspace.created\",\n  \"workspace.updated\",\n  \"workspace.deleted\",\n  \"workspace.archived\",\n  \"workspace.reactivated\",\n]);\n\n// Safely read a string `workspaceId` off a cross-MFE event payload of unknown\n// shape, rather than trusting a bare cast (the payload is produced by another\n// MFE and could drift). Returns undefined when absent or not a string.\nfunction readEventWorkspaceId(payload: unknown): string | undefined {\n  if (payload && typeof payload === \"object\" && \"workspaceId\" in payload) {\n    const value = (payload as { workspaceId?: unknown }).workspaceId;\n    return typeof value === \"string\" ? value : undefined;\n  }\n  return undefined;\n}\n\nexport function useContextSwitcherData(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const {\n    organizationId: activeOrganizationId,\n    workspaceId: activeWorkspaceId,\n    projectId: activeProjectId,\n    setContext: setActiveContext,\n  } = useActiveContext();\n\n  const eventBus = useEventBus();\n\n  // Use selectors for reactive state\n  const organizations = useAuthStore((state) => state.organizations);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const isLoadingOrganizations = useAuthStore(\n    (state) => state.isLoadingOrganizations,\n  );\n\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const isLoadingProjects = useAuthStore((state) => state.isLoadingProjects);\n\n  // Local error state\n  const [error, setError] = useState<string | null>(null);\n\n  // Deduplication refs to prevent duplicate GraphQL calls\n  const fetchOrganizationsPromiseRef = useRef<Promise<Organization[]> | null>(\n    null,\n  );\n  const fetchWorkspacesPromisesRef = useRef<Map<string, Promise<Workspace[]>>>(\n    new Map(),\n  );\n\n  // Stable refs for latest context values — avoids stale closures in callbacks\n  // without adding them to useCallback dep arrays (which would recreate callbacks\n  // on every context change and trigger spurious fetch re-runs).\n  const activeWorkspaceIdRef = useRef(activeWorkspaceId);\n  const activeOrganizationIdRef = useRef(activeOrganizationId);\n  useEffect(() => {\n    activeWorkspaceIdRef.current = activeWorkspaceId;\n    activeOrganizationIdRef.current = activeOrganizationId;\n  });\n\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n\n  // Refs to break feedback loops with the Header's \"store → URL\" sync effect.\n  // Without these the pair can ping-pong: this effect writes (URL → store),\n  // Header writes (store → URL), Zustand re-fires our subscribers, and React\n  // hits \"Maximum update depth exceeded\" — especially when a downstream call\n  // (workspace token issuance) returns 504 and leaves the two halves in\n  // disagreement. The refs record the last value we pushed for each axis;\n  // identical pushes are skipped so the loop has a hard floor.\n  const lastAppliedOrgIdRef = useRef<string | null>(null);\n  const lastAppliedWorkspaceIdRef = useRef<string | null>(null);\n  const lastAppliedProjectIdRef = useRef<string | null>(null);\n  const lastClearedTokenContextRef = useRef<string | null>(null);\n\n  useEffect(() => {\n    const store = useAuthStore.getState();\n\n    if (\n      activeOrganizationId &&\n      activeOrganizationId !== store.currentOrganizationId &&\n      activeOrganizationId !== lastAppliedOrgIdRef.current\n    ) {\n      lastAppliedOrgIdRef.current = activeOrganizationId;\n      store.setCurrentOrganizationId(activeOrganizationId);\n      if (\n        store.workspaces.length > 0 &&\n        !store.workspaces.some(\n          (workspace) => workspace.organizationId === activeOrganizationId,\n        )\n      ) {\n        store.setWorkspaces([]);\n      }\n    }\n\n    if (\n      activeWorkspaceId &&\n      activeWorkspaceId !== store.currentWorkspaceId &&\n      activeWorkspaceId !== lastAppliedWorkspaceIdRef.current\n    ) {\n      lastAppliedWorkspaceIdRef.current = activeWorkspaceId;\n      store.setCurrentWorkspaceId(activeWorkspaceId);\n      if (\n        store.projects.length > 0 &&\n        !store.projects.some(\n          (project) => project.workspaceId === activeWorkspaceId,\n        )\n      ) {\n        store.setProjects([]);\n        store.setCurrentProjectId(null);\n      }\n    }\n\n    if (\n      activeProjectId &&\n      activeProjectId !== store.currentProjectId &&\n      activeProjectId !== lastAppliedProjectIdRef.current\n    ) {\n      lastAppliedProjectIdRef.current = activeProjectId;\n      store.setCurrentProjectId(activeProjectId);\n    }\n\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: activeWorkspaceId,\n        organizationId: activeOrganizationId,\n        projectId: activeProjectId,\n      })\n    ) {\n      // Clear-token-once-per-context guard: when the upstream gateway is\n      // flaky (504s during workspace token issuance) the surrounding state\n      // machine can oscillate between \"got token but invalid\" and \"clearing\n      // token\". The downstream re-issue path then loops. Only clear once per\n      // (org, ws, proj) tuple — a successful re-issue resets the ref via\n      // setWorkspaceToken landing a new token for the same context.\n      const ctxKey = `${activeOrganizationId ?? \"\"}|${activeWorkspaceId ?? \"\"}|${activeProjectId ?? \"\"}`;\n      if (lastClearedTokenContextRef.current !== ctxKey) {\n        lastClearedTokenContextRef.current = ctxKey;\n        store.setWorkspaceToken(null);\n      }\n    }\n  }, [activeOrganizationId, activeWorkspaceId, activeProjectId]);\n\n  // ===========================================================================\n  // Fetch Organizations (Global Gateway)\n  // ===========================================================================\n\n  const fetchOrganizations = useCallback(async (): Promise<Organization[]> => {\n    // Deduplicate: if a fetch is already in progress, return the same promise\n    if (fetchOrganizationsPromiseRef.current) {\n      return fetchOrganizationsPromiseRef.current;\n    }\n\n    const store = useAuthStore.getState();\n    const token = resolveAccessToken();\n\n    if (!token) {\n      // Not an error — user may not be authenticated yet (e.g., page load before login).\n      // The useEffect in Header.tsx will re-trigger when accessToken becomes available.\n      return [];\n    }\n\n    // If the token is clearly expired and no fresh fallback was found, skip the\n    // doomed request. The useEffect in Header.tsx re-triggers when the auth\n    // provider refreshes the token and updates accessToken in the store.\n    if (isTokenExpired(token)) {\n      return [];\n    }\n\n    store.setLoadingOrganizations(true);\n    setError(null);\n\n    // Store the promise for deduplication before starting\n    fetchOrganizationsPromiseRef.current = (async () => {\n      try {\n        const initialTargetOrgId =\n          activeOrganizationIdRef.current ?? store.currentOrganizationId;\n        let result: GraphQLFetchResult<\n          MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n        > = initialTargetOrgId\n          ? await (async () => {\n              const [organizationsResult, workspacesResult] = await Promise.all(\n                [\n                  graphqlFetch<MyOrganizationsResponse>({\n                    gateway: \"global\",\n                    query: MY_ORGANIZATIONS_QUERY,\n                    authToken: token,\n                    baseUrl: globalBaseUrl,\n                  }),\n                  graphqlFetch<WorkspacesByOrgResponse>({\n                    gateway: \"global\",\n                    query: WORKSPACES_BY_ORG_QUERY,\n                    authToken: token,\n                    baseUrl: globalBaseUrl,\n                  }),\n                ],\n              );\n\n              const data = organizationsResult.data?.myOrganizations\n                ? {\n                    myOrganizations: organizationsResult.data.myOrganizations,\n                    ...(workspacesResult.data?.workspaces\n                      ? { workspaces: workspacesResult.data.workspaces }\n                      : {}),\n                  }\n                : null;\n\n              return {\n                data,\n                errors: [\n                  ...(organizationsResult.errors ?? []),\n                  ...(workspacesResult.errors ?? []),\n                ],\n              };\n            })()\n          : await graphqlFetch<MyOrganizationsResponse>({\n              gateway: \"global\",\n              query: MY_ORGANIZATIONS_QUERY,\n              authToken: token,\n              baseUrl: globalBaseUrl,\n            });\n\n        // Self-heal stale-URL case: if the workspace side of the bootstrap\n        // fails because the URL points at an inaccessible org/workspace, retry\n        // with the organization-only query so the operator sees their actual\n        // orgs and the URL params get corrected on next render.\n        if (\n          initialTargetOrgId &&\n          result.errors?.length &&\n          result.errors.some(\n            (e) =>\n              e?.extensions?.code === \"FORBIDDEN\" ||\n              /not a member of this organization/i.test(e?.message ?? \"\") ||\n              // Public gateway often drops the underlying FORBIDDEN error\n              // and replaces it with the schema-level non-null violation\n              // (\"Cannot return null for non-nullable field Query.myOrganizations\").\n              // That happens when ANY field in the query throws — workspaces\n              // here — and data:null cascades up. Treat that pattern as a\n              // signal to retry without the workspaces filter.\n              /Cannot return null for non-nullable field Query\\.myOrganizations/i.test(\n                e?.message ?? \"\",\n              ),\n          )\n        ) {\n          // Fetch myOrganizations + ALL workspaces (no filter) so the\n          // downstream auto-pick logic still has a workspace list to seed\n          // context from. If we only refetched myOrganizations, the page\n          // would render but every workspace-scoped query would fail with\n          // \"Select a workspace…\".\n          result = await graphqlFetch<\n            MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n          >({\n            gateway: \"global\",\n            query: `\n              query ContextSwitcherRecover {\n                myOrganizations {\n                  total\n                  items { id name slug tenantId description logo website status type createdAt updatedAt }\n                }\n                workspaces: myWorkspaces {\n                  total\n                  items { id name slug tenantId organizationId type status region createdAt updatedAt }\n                }\n              }\n            `,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n        }\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (isAuthGraphQLError(result.errors)) {\n            // Auth errors are expected during token refresh cycles — throw AuthError\n            // so the outer catch can suppress console.error.\n            throw new AuthError(errorMessage);\n          }\n          if (store.workspaces.length === 0) {\n            console.error(\"Failed to fetch organizations:\", result.errors);\n          }\n          throw new Error(errorMessage);\n        }\n\n        let orgs: Organization[] = result.data?.myOrganizations?.items ?? [];\n\n        // Stale-context recovery: bootstrap query was filtered by\n        // initialTargetOrgId, so when the URL/persisted org doesn't belong to\n        // this user the response is empty. Re-fetch the unfiltered list of\n        // *all* orgs the user can access so the guard below can pick a real\n        // default. Skip the recovery when no target was set (already\n        // unfiltered) or when workspaces are already in the store (the\n        // existing fallback path covers that case).\n        if (\n          initialTargetOrgId &&\n          orgs.length === 0 &&\n          store.workspaces.length === 0\n        ) {\n          const recovery = await graphqlFetch<MyOrganizationsResponse>({\n            gateway: \"global\",\n            query: MY_ORGANIZATIONS_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          if (!recovery.errors?.length) {\n            orgs = recovery.data?.myOrganizations?.items ?? [];\n            // discard the filtered workspaces payload — it was for the\n            // ghost org and would only mislead the workspace selector below.\n            result = {\n              ...recovery,\n              data: {\n                myOrganizations: recovery.data?.myOrganizations ?? {\n                  items: [],\n                  total: 0,\n                },\n              },\n            };\n          } else {\n            // Surface the failure so a user reporting \"blank org list\" has\n            // something to grep for in the console. We still fall through —\n            // the guard below either picks from a fallback (workspaces in\n            // store) or no-ops, leaving the existing error path in place.\n            console.warn(\n              \"[ContextSwitcher] Stale-context recovery failed:\",\n              recovery.errors,\n            );\n          }\n        }\n\n        const fallbackOrganizations =\n          orgs.length === 0 && store.workspaces.length > 0\n            ? buildFallbackOrganizations(store.workspaces)\n            : [];\n        const effectiveOrganizations =\n          fallbackOrganizations.length > 0 ? fallbackOrganizations : orgs;\n\n        store.setOrganizations(effectiveOrganizations);\n\n        // Determine which organization to use for workspace fetching\n        let targetOrgId = initialTargetOrgId;\n\n        // Stale-context guard: if the persisted/URL org isn't in the user's\n        // accessible orgs, fall back to the first available one and clear the\n        // stale workspace/project so they get re-derived. Without this, URL\n        // params like ?org=<ghost-id> from a prior session leak into the new\n        // user's request headers and cause \"Authentication required\" /\n        // \"not a member\" errors at every subgraph.\n        //\n        // Check against `orgs` (freshly returned from the API in this same\n        // closure) rather than `effectiveOrganizations`, which can fall back\n        // to ids derived from `store.workspaces` — that fallback path could\n        // contain stale ghost orgIds and mask the guard.\n        const targetOrgIsAccessible =\n          targetOrgId && orgs.some((org) => org.id === targetOrgId);\n        if (targetOrgId && !targetOrgIsAccessible && orgs.length > 0) {\n          targetOrgId = orgs[0].id;\n          setActiveContext({\n            organizationId: targetOrgId,\n            workspaceId: null,\n            tenantId: null,\n            projectId: null,\n          });\n          store.setWorkspaces([]);\n          store.setProjects([]);\n          store.setCurrentWorkspaceId(null);\n          store.setCurrentProjectId(null);\n          store.setWorkspaceToken(null);\n        }\n\n        if (targetOrgId && targetOrgId !== store.currentOrganizationId) {\n          store.setCurrentOrganizationId(targetOrgId);\n        }\n\n        // Auto-select first organization if none is selected\n        if (effectiveOrganizations.length > 0 && !targetOrgId) {\n          store.setCurrentOrganizationId(effectiveOrganizations[0].id);\n          targetOrgId = effectiveOrganizations[0].id;\n        }\n\n        // Fetch workspaces for the selected/auto-selected org if:\n        // 1. We have a target org (either auto-selected or persisted from localStorage)\n        // 2. AND workspaces array is empty (not persisted, or cleared)\n        // This handles both initial login AND page refresh scenarios.\n        // Read from useAuthStore.getState() rather than the captured `store`\n        // snapshot so we see the post-guard cleared value when the org guard\n        // above fired (the local `store.workspaces` ref is stale after\n        // setWorkspaces([])).\n        if (targetOrgId && useAuthStore.getState().workspaces.length === 0) {\n          store.setLoadingWorkspaces(true);\n          try {\n            // myWorkspaces returns ALL workspaces the user is a member of\n            // across every org. Filter to the target org client-side here.\n            const bootstrappedWorkspaces =\n              initialTargetOrgId === targetOrgId\n                ? result.data?.workspaces?.items?.filter(\n                    (w) => w.organizationId === targetOrgId,\n                  )\n                : undefined;\n            const ws = bootstrappedWorkspaces\n              ? (bootstrappedWorkspaces as Workspace[])\n              : await graphqlFetch<WorkspacesByOrgResponse>({\n                  gateway: \"global\",\n                  query: WORKSPACES_BY_ORG_QUERY,\n                  authToken: token,\n                  baseUrl: globalBaseUrl,\n                }).then((wsResult) =>\n                  wsResult.errors?.length\n                    ? null\n                    : (wsResult.data?.workspaces?.items ?? []).filter(\n                        (w) => w.organizationId === targetOrgId,\n                      ),\n                );\n\n            if (ws) {\n              store.setWorkspaces(ws);\n              const persistedWorkspace = activeWorkspaceIdRef.current\n                ? ws.find(\n                    (workspace) =>\n                      workspace.id === activeWorkspaceIdRef.current,\n                  )\n                : null;\n\n              if (persistedWorkspace) {\n                store.setCurrentWorkspaceId(persistedWorkspace.id);\n              } else if (ws.length > 0) {\n                const nextActiveContext = {\n                  organizationId: targetOrgId,\n                  workspaceId: ws[0].id,\n                  tenantId: ws[0].tenantId,\n                  projectId: null,\n                };\n\n                if (activeWorkspaceIdRef.current) {\n                  // Stale-context guard: URL/persisted workspace ID is not in\n                  // the user's accessible workspaces for the active org. Fall\n                  // back to the first workspace and clear the stale URL param\n                  // so subsequent requests don't carry the ghost ID.\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  store.setWorkspaceToken(null);\n                  setActiveContext(nextActiveContext);\n                } else if (!store.currentWorkspaceId) {\n                  // Auto-select first workspace only if none is currently selected\n                  // (preserves selection from completeAuthFlow or persistence if applicable)\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  setActiveContext(nextActiveContext);\n                }\n              }\n            }\n          } catch {\n            // Non-critical — user can still select workspace manually\n          } finally {\n            store.setLoadingWorkspaces(false);\n          }\n        }\n\n        return effectiveOrganizations;\n      } catch (err) {\n        // Auth errors are expected during token refresh / page load cycles.\n        // Suppress from console.error — the useEffect will re-trigger when the\n        // auth provider refreshes the token.\n        if (err instanceof AuthError) {\n          return [];\n        }\n        const message =\n          err instanceof Error ? err.message : \"Failed to fetch organizations\";\n        if (store.workspaces.length === 0) {\n          console.error(\"Failed to fetch organizations:\", err);\n        }\n        setError(message);\n\n        if (store.workspaces.length > 0) {\n          const fallbackOrganizations = buildFallbackOrganizations(\n            store.workspaces,\n          );\n          if (fallbackOrganizations.length > 0) {\n            store.setOrganizations(fallbackOrganizations);\n            if (!store.currentOrganizationId) {\n              store.setCurrentOrganizationId(fallbackOrganizations[0].id);\n            }\n            return fallbackOrganizations;\n          }\n        }\n\n        return [];\n      } finally {\n        store.setLoadingOrganizations(false);\n        fetchOrganizationsPromiseRef.current = null;\n      }\n    })();\n\n    return fetchOrganizationsPromiseRef.current;\n  }, [globalBaseUrl, setActiveContext]);\n\n  // ===========================================================================\n  // Fetch Workspaces for Organization (Global Gateway)\n  // ===========================================================================\n\n  const fetchWorkspacesForOrg = useCallback(\n    async (organizationId: string): Promise<Workspace[]> => {\n      // Deduplicate: if a fetch for this org is already in progress, return the same promise\n      const existingPromise =\n        fetchWorkspacesPromisesRef.current.get(organizationId);\n      if (existingPromise) {\n        return existingPromise;\n      }\n\n      const store = useAuthStore.getState();\n      const token = resolveAccessToken();\n\n      if (!token || isTokenExpired(token)) {\n        return [];\n      }\n\n      store.setLoadingWorkspaces(true);\n      setError(null);\n\n      // Store the promise for deduplication before starting\n      const fetchPromise = (async () => {\n        try {\n          const result = await graphqlFetch<WorkspacesByOrgResponse>({\n            gateway: \"global\",\n            query: WORKSPACES_BY_ORG_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          // myWorkspaces returns workspaces across all the user's orgs;\n          // filter to the requested org before handing to downstream.\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === organizationId,\n            );\n          }\n\n          if (result.errors?.length) {\n            const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n            if (isAuthGraphQLError(result.errors)) {\n              throw new AuthError(errorMessage);\n            }\n            console.error(\"Failed to fetch workspaces:\", result.errors);\n            throw new Error(errorMessage);\n          }\n\n          // `myWorkspaces` returns every workspace the caller can see across\n          // all of their orgs/tenants. The store key is per-org (selecting\n          // org X then opening the dropdown should only show X's workspaces),\n          // so we filter down to the requested org here. The dropdown filter\n          // in ContextSwitcher.tsx is a defence-in-depth — without this\n          // narrowing the store would briefly hold the caller's other-org\n          // workspaces and the auto-pick logic (lines below) might select\n          // one of them as the default.\n          const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n          const ws = allWs.filter((w) => w.organizationId === organizationId);\n          store.setWorkspaces(ws);\n          return ws;\n        } catch (err) {\n          if (err instanceof AuthError) {\n            return [];\n          }\n          const message =\n            err instanceof Error ? err.message : \"Failed to fetch workspaces\";\n          console.error(\"Failed to fetch workspaces:\", err);\n          setError(message);\n          return [];\n        } finally {\n          store.setLoadingWorkspaces(false);\n          fetchWorkspacesPromisesRef.current.delete(organizationId);\n        }\n      })();\n\n      fetchWorkspacesPromisesRef.current.set(organizationId, fetchPromise);\n      return fetchPromise;\n    },\n    [globalBaseUrl],\n  );\n\n  // ===========================================================================\n  // Issue Workspace Token (Workspace Gateway - wspace-auth-svc)\n  // ===========================================================================\n\n  const issueWorkspaceToken = useCallback(\n    async (\n      organizationId: string,\n      workspaceId?: string,\n      projectId?: string | null,\n    ): Promise<{\n      success: boolean;\n      token?: string;\n      resolvedWorkspaceId?: string;\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n      const authToken = resolveAccessToken();\n\n      if (!authToken || isTokenExpired(authToken)) {\n        return { success: false, error: \"No valid access token available\" };\n      }\n\n      setError(null);\n\n      try {\n        const result = await graphqlFetch<{\n          issueWorkspaceToken: IssueWorkspaceTokenResult;\n        }>({\n          gateway: \"workspace\",\n          query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n          variables: {\n            input: {\n              organizationId,\n              ...(workspaceId && { workspaceId }),\n              ...(projectId && { projectId }),\n            },\n          },\n          authToken,\n          baseUrl: workspaceBaseUrl,\n        });\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (!isAuthGraphQLError(result.errors)) {\n            console.error(\"Failed to issue workspace token:\", result.errors);\n          }\n          return { success: false, error: errorMessage };\n        }\n\n        const tokenResult = result.data?.issueWorkspaceToken;\n\n        if (tokenResult?.success && tokenResult.token) {\n          const resolvedWsId = tokenResult.workspaceId || workspaceId;\n          if (resolvedWsId) {\n            store.setCurrentWorkspaceId(resolvedWsId);\n          }\n          store.setWorkspaceToken(tokenResult.token);\n          return {\n            success: true,\n            token: tokenResult.token,\n            resolvedWorkspaceId: resolvedWsId || undefined,\n          };\n        }\n\n        return {\n          success: false,\n          error:\n            tokenResult?.error?.message ?? \"Failed to issue workspace token\",\n        };\n      } catch (err) {\n        const message =\n          err instanceof Error\n            ? err.message\n            : \"Failed to issue workspace token\";\n        console.error(\"Failed to issue workspace token:\", err);\n        setError(message);\n        return { success: false, error: message };\n      }\n    },\n    [workspaceBaseUrl],\n  );\n\n  // ===========================================================================\n  // Fetch Projects (Workspace Gateway - requires workspace token)\n  // ===========================================================================\n\n  const fetchProjects = useCallback(async (): Promise<Project[]> => {\n    const store = useAuthStore.getState();\n    const authToken = resolveAccessToken();\n    const wsToken = store.workspaceToken;\n    const workspaceId = store.currentWorkspaceId;\n\n    if (!authToken || isTokenExpired(authToken)) {\n      return [];\n    }\n\n    if (!wsToken) {\n      return [];\n    }\n\n    if (!workspaceId) {\n      return [];\n    }\n\n    store.setLoadingProjects(true);\n    setError(null);\n\n    try {\n      const result = await graphqlFetch<ProjectsResponse>({\n        gateway: \"workspace\",\n        query: PROJECTS_QUERY,\n        authToken,\n        workspaceToken: wsToken,\n        baseUrl: workspaceBaseUrl,\n      });\n\n      if (result.errors?.length) {\n        const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n        if (isAuthGraphQLError(result.errors)) {\n          throw new AuthError(errorMessage);\n        }\n        console.error(\"Failed to fetch projects:\", result.errors);\n        throw new Error(errorMessage);\n      }\n\n      const projs: Project[] = result.data?.projects?.items ?? [];\n      store.setProjects(projs);\n      return projs;\n    } catch (err) {\n      if (err instanceof AuthError) {\n        return [];\n      }\n      const message =\n        err instanceof Error ? err.message : \"Failed to fetch projects\";\n      console.error(\"Failed to fetch projects:\", err);\n      setError(message);\n      return [];\n    } finally {\n      store.setLoadingProjects(false);\n    }\n  }, [workspaceBaseUrl]);\n\n  // ===========================================================================\n  // High-Level Selection Actions\n  // ===========================================================================\n\n  const selectOrganization = useCallback(\n    async (org: Organization): Promise<Workspace[]> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentWorkspaceId(null);\n      store.setWorkspaceToken(null);\n      store.setProjects([]);\n      store.setCurrentProjectId(null);\n      store.setCurrentOrganizationId(org.id);\n\n      const ws = await fetchWorkspacesForOrg(org.id);\n      return ws;\n    },\n    [fetchWorkspacesForOrg],\n  );\n\n  const selectWorkspace = useCallback(\n    async (\n      workspace: Workspace,\n    ): Promise<{\n      success: boolean;\n      projects?: Project[];\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentProjectId(null);\n      store.setProjects([]);\n\n      if (!workspace.organizationId) {\n        console.error(\"Workspace missing organizationId:\", workspace);\n        return {\n          success: false,\n          error: \"Workspace is missing organizationId\",\n        };\n      }\n\n      const tokenResult = await issueWorkspaceToken(\n        workspace.organizationId,\n        workspace.id,\n      );\n\n      if (!tokenResult.success) {\n        return { success: false, error: tokenResult.error };\n      }\n\n      let projs = await fetchProjects();\n      if (projs.length === 0) {\n        const authToken = resolveAccessToken();\n        const workspaceToken = useAuthStore.getState().workspaceToken;\n        if (authToken && workspaceToken) {\n          const defaultProject = await createDefaultProject({\n            authToken,\n            workspaceBaseUrl,\n            workspaceToken,\n          });\n          if (defaultProject) {\n            projs = [defaultProject];\n            store.setProjects(projs);\n          }\n        }\n      }\n\n      if (projs.length > 0) {\n        store.setCurrentProjectId(projs[0]!.id);\n      }\n\n      return { success: true, projects: projs };\n    },\n    [issueWorkspaceToken, fetchProjects, workspaceBaseUrl],\n  );\n\n  const selectProject = useCallback((project: Project): void => {\n    const store = useAuthStore.getState();\n    store.setCurrentProjectId(project.id);\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: store.currentWorkspaceId,\n        organizationId: store.currentOrganizationId,\n        projectId: project.id,\n      })\n    ) {\n      store.setWorkspaceToken(null);\n    }\n  }, []);\n\n  // ===========================================================================\n  // Cross-MFE refresh: keep the switcher lists current when another MFE mutates\n  // org/workspace/project entities. microfe-workspaces emits these domain events\n  // on the shared event bus (e.g. on project rename); without this the switcher\n  // keeps showing the stale cached name until a full page reload.\n  // ===========================================================================\n\n  useEffect(() => {\n    let cancelled = false;\n\n    // Coalesce a refetch into a single in-flight run with one trailing re-run,\n    // so a burst of events collapses to one request (+ one trailing) instead of\n    // fanning out or being swallowed by a downstream per-key dedupe. The flag is\n    // cleared on cleanup so nothing fires after the subscription is torn down.\n    const makeCoalescedRefetch = (run: () => Promise<unknown>) => {\n      let running = false;\n      let queued = false;\n      const trigger = () => {\n        if (cancelled) return;\n        if (running) {\n          queued = true;\n          return;\n        }\n        running = true;\n        void run().finally(() => {\n          running = false;\n          if (!cancelled && queued) {\n            queued = false;\n            trigger();\n          }\n        });\n      };\n      return trigger;\n    };\n\n    const refreshProjects = makeCoalescedRefetch(() => fetchProjects());\n    const refreshWorkspaces = makeCoalescedRefetch(() => {\n      const orgId = useAuthStore.getState().currentOrganizationId;\n      return orgId ? fetchWorkspacesForOrg(orgId) : Promise.resolve();\n    });\n\n    // Custom domain events (not in BurdenoffEventName) flow through `onAny`.\n    const unsubscribe = eventBus.onAny((event) => {\n      // Custom event names aren't in the BurdenoffEventName union; compare as string.\n      const eventName: string = event.name;\n\n      if (PROJECT_REFRESH_EVENTS.has(eventName)) {\n        const eventWorkspaceId = readEventWorkspaceId(event.payload);\n        const { currentWorkspaceId } = useAuthStore.getState();\n        // Only refetch when the event targets the workspace currently in\n        // context (events without a workspace id are treated as relevant).\n        if (\n          eventWorkspaceId &&\n          currentWorkspaceId &&\n          eventWorkspaceId !== currentWorkspaceId\n        ) {\n          return;\n        }\n        // Refetch only — a deleted project simply drops out of the list, and\n        // `currentProject` resolves to undefined for it. Clearing the selection\n        // here would race ActiveContext / the project sync effect (the real\n        // source of truth), so we leave selection reconciliation to them.\n        refreshProjects();\n        return;\n      }\n\n      if (WORKSPACE_REFRESH_EVENTS.has(eventName)) {\n        refreshWorkspaces();\n      }\n    });\n\n    return () => {\n      cancelled = true;\n      unsubscribe();\n    };\n  }, [eventBus, fetchProjects, fetchWorkspacesForOrg]);\n\n  // ===========================================================================\n  // Get Current Items\n  // ===========================================================================\n\n  const currentOrganization = organizations.find(\n    (org) => org.id === currentOrganizationId,\n  );\n  const currentWorkspace = workspaces.find(\n    (ws) => ws.id === currentWorkspaceId,\n  );\n  const currentProject = projects.find((proj) => proj.id === currentProjectId);\n\n  // ===========================================================================\n  // Return Hook API\n  // ===========================================================================\n\n  return {\n    organizations,\n    workspaces,\n    projects,\n\n    currentOrganizationId,\n    currentWorkspaceId,\n    currentProjectId,\n\n    currentOrganization,\n    currentWorkspace,\n    currentProject,\n\n    workspaceToken,\n\n    isLoadingOrganizations,\n    isLoadingWorkspaces,\n    isLoadingProjects,\n    isLoading:\n      isLoadingOrganizations || isLoadingWorkspaces || isLoadingProjects,\n\n    error,\n\n    fetchOrganizations,\n    fetchWorkspacesForOrg,\n    issueWorkspaceToken,\n    fetchProjects,\n\n    selectOrganization,\n    selectWorkspace,\n    selectProject,\n  };\n}\n\n/**\n * Hook to reactively ensure workspaces are synced with the current organization.\n *\n * This handles edge cases where the organization changes but workspaces\n * from a different org are still in the store (e.g., stale data, race conditions).\n *\n * Usage:\n * ```tsx\n * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useWorkspaceSyncEffect(); // Ensures workspaces stay in sync\n *   // ...\n * }\n * ```\n */\nexport function useWorkspaceSyncEffect(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const disableWorkspaceSync = options?.disableWorkspaceSync ?? false;\n\n  useEffect(() => {\n    if (disableWorkspaceSync) return;\n    // Skip if no org selected, no token, or already loading\n    if (!currentOrganizationId || !accessToken || isLoadingWorkspaces) return;\n\n    // Check if any workspace matches the current org\n    const hasMatchingWorkspaces = workspaces.some(\n      (ws) => ws.organizationId === currentOrganizationId,\n    );\n\n    // If workspaces exist but none match current org, we need to refetch\n    // This can happen in edge cases with stale data or race conditions\n    if (workspaces.length > 0 && !hasMatchingWorkspaces) {\n      const store = useAuthStore.getState();\n      store.setLoadingWorkspaces(true);\n\n      // Inline fetch to avoid circular dependency with useContextSwitcherData\n      graphqlFetch<WorkspacesByOrgResponse>({\n        gateway: \"global\",\n        query: WORKSPACES_BY_ORG_QUERY,\n        authToken: accessToken,\n        baseUrl: globalBaseUrl,\n      })\n        .then((result) => {\n          // myWorkspaces returns ALL my workspaces; filter to current org\n          // client-side (the old server-side filter no longer exists).\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n          }\n          if (!result.errors?.length) {\n            const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n            // Same per-org narrowing as fetchWorkspacesForOrg — see the\n            // comment there for why we don't just dump the full caller-\n            // visible list into the store.\n            const ws = allWs.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n            store.setWorkspaces(ws);\n          }\n        })\n        .catch(() => {\n          // Silent fail - user can manually refresh or select org again\n        })\n        .finally(() => {\n          store.setLoadingWorkspaces(false);\n        });\n    }\n  }, [\n    currentOrganizationId,\n    workspaces,\n    accessToken,\n    isLoadingWorkspaces,\n    globalBaseUrl,\n    disableWorkspaceSync,\n  ]);\n}\n\n/**\n * Hook to reactively ensure projects are loaded when a workspace is selected.\n *\n * This handles the case where a workspace is auto-selected (from URL/localStorage)\n * but projects haven't been fetched yet. It will:\n * 1. Issue a workspace token if not present\n * 2. Fetch projects for the selected workspace\n *\n * Usage:\n * ```tsx\n * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useProjectSyncEffect(); // Ensures projects are loaded for selected workspace\n *   // ...\n * }\n * ```\n */\nexport function useProjectSyncEffect(options?: UseContextSwitcherDataOptions) {\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n  const disableProjectSync = options?.disableProjectSync ?? false;\n  const skipProjectFetch = options?.skipProjectFetch ?? false;\n\n  // Use refs to prevent the infinite loop caused by including loading/failure\n  // state in the dependency array. Without these, the cycle is:\n  //   setLoadingProjects(true) -> dep change -> effect re-runs (guarded) ->\n  //   async completes -> setLoadingProjects(false) -> dep change ->\n  //   effect re-runs -> starts again -> INFINITE LOOP\n  const syncInProgressRef = useRef(false);\n  // Pending retry timer per workspace, so transient failures (e.g. RBAC lag\n  // right after workspace creation) get an automatic second chance even if no\n  // dependency change re-triggers the effect.\n  const retryTimerRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(\n    new Map(),\n  );\n  // Per-workspace failure tracker — caps retry attempts when project bootstrap\n  // (token issue, list, or default-create) fails. Without this, a persistent\n  // backend failure (e.g. cross-layer workspace not yet synced) causes the\n  // effect to re-fire every render: list returns empty → create-default fails\n  // → setProjects([]) → new array reference → effect re-runs → loop.\n  //\n  // We track both count AND lastFailureAt so we can honour a \"cool-down\" window:\n  // after PROJECT_SYNC_FAILURE_COOLDOWN_MS has elapsed since the last failure,\n  // the counter is treated as cleared so transient backend hiccups (e.g. RBAC\n  // role propagation lag right after signup) don't permanently lock a workspace\n  // out of the context dropdown — the original cause of marqueue §729.\n  const projectSyncFailuresRef = useRef<\n    Map<string, { count: number; lastFailureAt: number }>\n  >(new Map());\n  const PROJECT_SYNC_MAX_FAILURES = 8;\n  const PROJECT_SYNC_FAILURE_COOLDOWN_MS = 30_000;\n  useEffect(() => {\n    if (disableProjectSync) return;\n    // Skip if no workspace selected or no access token\n    if (!currentWorkspaceId || !accessToken) return;\n\n    // Skip if a sync is already in progress (ref-based guard avoids dep loop)\n    if (syncInProgressRef.current) return;\n\n    // Stop retrying once this workspace has failed too many times in a row.\n    // Counter is reset on success, on workspace switch (different key), by\n    // an explicit user retry path (e.g. selectWorkspace), or after the\n    // cool-down window has elapsed since the last failure (so transient\n    // backend issues don't permanently wedge the dropdown).\n    const failureEntry = projectSyncFailuresRef.current.get(currentWorkspaceId);\n    if (\n      failureEntry &&\n      failureEntry.count >= PROJECT_SYNC_MAX_FAILURES &&\n      Date.now() - failureEntry.lastFailureAt < PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      return;\n    }\n    if (\n      failureEntry &&\n      Date.now() - failureEntry.lastFailureAt >=\n        PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      // Cool-down elapsed — clear the counter so we get a fresh budget.\n      projectSyncFailuresRef.current.delete(currentWorkspaceId);\n    }\n\n    // Resolve organizationId: prefer the workspace object (if loaded), fall\n    // back to the persisted currentOrganizationId.  The workspaces array is\n    // NOT persisted by zustand, so on page reload it is empty until\n    // fetchOrganizations() completes.  Using the persisted org ID lets us\n    // issue the workspace token immediately instead of waiting.\n    const currentWorkspace = workspaces.find(\n      (ws) => ws.id === currentWorkspaceId,\n    );\n\n    // Guard: transient (newOrg, oldWs) divergence during org switches — token issuance always fails.\n    if (\n      currentWorkspace &&\n      currentOrganizationId &&\n      currentWorkspace.organizationId !== currentOrganizationId\n    ) {\n      return;\n    }\n\n    const organizationId =\n      currentWorkspace?.organizationId ?? currentOrganizationId;\n    if (!organizationId) return;\n\n    const store = useAuthStore.getState();\n\n    // If we don't have a workspace token or it's expired, issue one first\n    const needsToken =\n      !workspaceToken ||\n      isTokenExpired(workspaceToken) ||\n      !isWorkspaceTokenValidForContext(workspaceToken, {\n        workspaceId: currentWorkspaceId,\n        organizationId: currentOrganizationId,\n        projectId: currentProjectId,\n      });\n\n    // Skip if projects are already loaded for this workspace AND token is valid\n    const hasProjectsForWorkspace = projects.some(\n      (p) => p.workspaceId === currentWorkspaceId,\n    );\n    if (hasProjectsForWorkspace && !needsToken) {\n      if (!store.currentProjectId) {\n        const firstProject = projects.find(\n          (project) => project.workspaceId === currentWorkspaceId,\n        );\n        if (firstProject) {\n          store.setCurrentProjectId(firstProject.id);\n        }\n      }\n      return;\n    }\n\n    const syncProjects = async () => {\n      syncInProgressRef.current = true;\n      store.setLoadingProjects(true);\n      let succeeded = false;\n\n      try {\n        let wsToken = workspaceToken;\n\n        // Issue workspace token if needed\n        if (needsToken) {\n          const tokenResult = await graphqlFetch<{\n            issueWorkspaceToken: IssueWorkspaceTokenResult;\n          }>({\n            gateway: \"workspace\",\n            query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n            variables: {\n              input: {\n                organizationId,\n                workspaceId: currentWorkspaceId,\n                ...(currentProjectId ? { projectId: currentProjectId } : {}),\n              },\n            },\n            authToken: accessToken,\n            baseUrl: workspaceBaseUrl,\n          });\n\n          if (\n            tokenResult.data?.issueWorkspaceToken?.success &&\n            tokenResult.data.issueWorkspaceToken.token\n          ) {\n            wsToken = tokenResult.data.issueWorkspaceToken.token;\n            store.setWorkspaceToken(wsToken);\n          } else {\n            return;\n          }\n        }\n\n        // Fetch projects (skip if already loaded or token-only sync requested)\n        if (wsToken && !hasProjectsForWorkspace && !skipProjectFetch) {\n          const projectsResult = await graphqlFetch<ProjectsResponse>({\n            gateway: \"workspace\",\n            query: PROJECTS_QUERY,\n            authToken: accessToken,\n            workspaceToken: wsToken,\n            baseUrl: workspaceBaseUrl,\n          });\n\n          if (projectsResult.errors?.length) {\n            return;\n          }\n\n          let projs: Project[] = projectsResult.data?.projects?.items ?? [];\n          if (projs.length === 0) {\n            const defaultProject = await createDefaultProject({\n              authToken: accessToken,\n              workspaceBaseUrl,\n              workspaceToken: wsToken,\n            });\n            if (defaultProject) {\n              projs = [defaultProject];\n            } else {\n              // Default-project creation failed (e.g. workspace not yet\n              // propagated to the workspace layer). Do NOT write [] back —\n              // that would change the projects reference and re-trigger\n              // this effect on the next render.\n              return;\n            }\n          }\n\n          store.setProjects(projs);\n\n          // Auto-select first project if none selected and projects exist\n          if (projs.length > 0 && !store.currentProjectId) {\n            store.setCurrentProjectId(projs[0].id);\n          }\n        }\n\n        succeeded = true;\n      } catch {\n        // A later auth/context update should be able to retry.\n      } finally {\n        store.setLoadingProjects(false);\n        syncInProgressRef.current = false;\n        const failures = projectSyncFailuresRef.current;\n        if (succeeded) {\n          failures.delete(currentWorkspaceId);\n          const pending = retryTimerRef.current.get(currentWorkspaceId);\n          if (pending) {\n            clearTimeout(pending);\n            retryTimerRef.current.delete(currentWorkspaceId);\n          }\n        } else {\n          const existing = failures.get(currentWorkspaceId);\n          const nextCount = (existing?.count ?? 0) + 1;\n          failures.set(currentWorkspaceId, {\n            count: nextCount,\n            lastFailureAt: Date.now(),\n          });\n          // Schedule a backoff retry for transient backend lag (e.g. RBAC\n          // role propagation right after signup → first projects() call hits\n          // permission-denied). Without this, the effect would only re-run on\n          // dep change and the user would be stuck staring at an empty\n          // project dropdown until something else triggered a re-render.\n          if (nextCount < PROJECT_SYNC_MAX_FAILURES) {\n            const existingTimer = retryTimerRef.current.get(currentWorkspaceId);\n            if (existingTimer) clearTimeout(existingTimer);\n            const backoffMs = Math.min(1000 * 2 ** (nextCount - 1), 8000);\n            const timer = setTimeout(() => {\n              retryTimerRef.current.delete(currentWorkspaceId);\n              // Only re-run if the workspace context is still the same and\n              // a project hasn't been loaded for it in the meantime.\n              const latest = useAuthStore.getState();\n              if (\n                latest.currentWorkspaceId === currentWorkspaceId &&\n                !latest.projects.some(\n                  (p) => p.workspaceId === currentWorkspaceId,\n                ) &&\n                !syncInProgressRef.current\n              ) {\n                // Bump a render by clearing then resetting workspaceToken\n                // when valid, OR by re-issuing projects fetch directly. The\n                // simplest robust trigger is to clear the in-progress guard\n                // and call syncProjects() again with current closure values.\n                void syncProjects();\n              }\n            }, backoffMs);\n            retryTimerRef.current.set(currentWorkspaceId, timer);\n          }\n        }\n      }\n    };\n\n    syncProjects();\n  }, [\n    currentWorkspaceId,\n    currentOrganizationId,\n    workspaces,\n    projects,\n    currentProjectId,\n    workspaceToken,\n    accessToken,\n    workspaceBaseUrl,\n    disableProjectSync,\n    skipProjectFetch,\n  ]);\n\n  // Cleanup any pending retry timers on unmount so we don't leak stray\n  // setTimeout callbacks running against stale closures.\n  useEffect(() => {\n    const timers = retryTimerRef.current;\n    return () => {\n      timers.forEach((timer) => clearTimeout(timer));\n      timers.clear();\n    };\n  }, []);\n}\n// hmr-bust-1778064429\n"],"mappings":";;;;;;;AAqFA,IAAM,IAAyB,2RAoCzB,IAA0B,oSAoB1B,IAAiC,6SA0BjC,IAAiB,uPAkBjB,IAAkC;AAexC,eAAe,EAAqB,EAClC,cACA,qBACA,qBAK0B;CAC1B,IAAM,IAAS,MAAM,EAAoC;EACvD,SAAS;EACT,OAAO;EACP,WAAW,EACT,OAAO,EACL,MAAM,mBACP,EACF;EACD;EACA;EACA,SAAS;EACV,CAAC;AAOF,QALI,EAAO,QAAQ,UACjB,QAAQ,KAAK,qCAAqC,EAAO,OAAO,EACzD,QAGF,EAAO,MAAM,iBAAiB;;AAWvC,SAAS,EAAe,GAAe,IAAW,KAAiB;AACjE,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AAErD,SADK,EAAQ,MACN,EAAQ,MAAM,MAAO,KAAK,KAAK,GAAG,IADhB;SAEnB;AACN,SAAO;;;AAIX,SAAS,EAAyB,GAKzB;AACP,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AACrD,SAAO;GACL,aACE,OAAO,EAAQ,eAAgB,WAC3B,EAAQ,cACR,KAAA;GACN,gBACE,OAAO,EAAQ,kBAAmB,WAC9B,EAAQ,iBACR,KAAA;GACN,WACE,OAAO,EAAQ,aAAc,WAAW,EAAQ,YAAY,KAAA;GAC9D,KAAK,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,KAAA;GACtD;SACK;AACN,SAAO;;;AAIX,SAAS,EACP,GACA,GAKiB;AACjB,KAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO;CAGT,IAAM,IAAU,EAAyB,EAAM;AAoB/C,QAJA,EAfI,CAAC,KAID,EAAS,eAAe,EAAQ,gBAAgB,EAAS,eAK3D,EAAS,kBACT,EAAQ,mBAAmB,EAAS,kBAKlC,EAAS,aAAa,EAAQ,cAAc,EAAS;;AAa3D,IAAM,IAAN,cAAwB,MAAM;CAC5B,YAAY,GAAiB;AAE3B,EADA,MAAM,EAAQ,EACd,KAAK,OAAO;;;AAOhB,SAAS,EACP,GACS;AACT,QAAO,EAAO,MACX,MACC,EAAE,YAAY,SAAS,qBACvB,EAAE,SAAS,aAAa,CAAC,SAAS,eAAe,IACjD,EAAE,SAAS,aAAa,CAAC,SAAS,oBAAoB,CACzD;;AASH,SAAS,IAAoC;CAC3C,IAAM,IAAa,EAAa,UAAU,CAAC;AAG3C,KAAI,KAAc,CAAC,EAAe,EAAW,CAC3C,QAAO;CAIT,IAAM,IAAe,GAAoB;AAQzC,QAPI,KAAgB,CAAC,EAAe,EAAa,GACxC,IAMF;;AAGT,SAAS,EAA2B,GAAyC;AAS3E,QARqB,MAAM,KACzB,IAAI,IACF,EAAW,SAAS,MAClB,EAAU,iBAAiB,CAAC,EAAU,eAAe,GAAG,EAAE,CAC3D,CACF,CACF,CAEmB,KAAK,GAAgB,OAAW;EAClD,IAAI;EACJ,MACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,QAAQ,gBAAgB,IAAQ;EACrC,MAAM;EACN,UACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,YAAY;EAClB,EAAE;;AAuBL,IAAM,IAAyB,IAAI,IAAY;CAC7C;CACA;CACA;CACA;CACA;CACD,CAAC,EACI,IAA2B,IAAI,IAAY;CAC/C;CACA;CACA;CACA;CACA;CACD,CAAC;AAKF,SAAS,EAAqB,GAAsC;AAClE,KAAI,KAAW,OAAO,KAAY,YAAY,iBAAiB,GAAS;EACtE,IAAM,IAAS,EAAsC;AACrD,SAAO,OAAO,KAAU,WAAW,IAAQ,KAAA;;;AAK/C,SAAgB,EACd,GACA;CACA,IAAM,EACJ,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,YAAY,MACV,GAAkB,EAEhB,IAAW,GAAa,EAGxB,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAyB,GAC5B,MAAU,EAAM,uBAClB,EAEK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,IAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAsB,GACzB,MAAU,EAAM,oBAClB,EAEK,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAoB,GAAc,MAAU,EAAM,kBAAkB,EAGpE,CAAC,IAAO,KAAY,EAAwB,KAAK,EAGjD,IAA+B,EACnC,KACD,EACK,IAA6B,kBACjC,IAAI,KAAK,CACV,EAKK,IAAuB,EAAO,EAAkB,EAChD,IAA0B,EAAO,EAAqB;AAC5D,SAAgB;AAEd,EADA,EAAqB,UAAU,GAC/B,EAAwB,UAAU;GAClC;CAEF,IAAM,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IACJ,GAAS,oBAAoB,EAAiB,kBAS1C,IAAsB,EAAsB,KAAK,EACjD,IAA4B,EAAsB,KAAK,EACvD,IAA0B,EAAsB,KAAK,EACrD,IAA6B,EAAsB,KAAK;AAE9D,SAAgB;EACd,IAAM,IAAQ,EAAa,UAAU;AA8CrC,MA3CE,KACA,MAAyB,EAAM,yBAC/B,MAAyB,EAAoB,YAE7C,EAAoB,UAAU,GAC9B,EAAM,yBAAyB,EAAqB,EAElD,EAAM,WAAW,SAAS,KAC1B,CAAC,EAAM,WAAW,MACf,MAAc,EAAU,mBAAmB,EAC7C,IAED,EAAM,cAAc,EAAE,CAAC,GAKzB,KACA,MAAsB,EAAM,sBAC5B,MAAsB,EAA0B,YAEhD,EAA0B,UAAU,GACpC,EAAM,sBAAsB,EAAkB,EAE5C,EAAM,SAAS,SAAS,KACxB,CAAC,EAAM,SAAS,MACb,MAAY,EAAQ,gBAAgB,EACtC,KAED,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,IAKjC,KACA,MAAoB,EAAM,oBAC1B,MAAoB,EAAwB,YAE5C,EAAwB,UAAU,GAClC,EAAM,oBAAoB,EAAgB,GAI1C,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EACF;GAOA,IAAM,IAAS,GAAG,KAAwB,GAAG,GAAG,KAAqB,GAAG,GAAG,KAAmB;AAC9F,GAAI,EAA2B,YAAY,MACzC,EAA2B,UAAU,GACrC,EAAM,kBAAkB,KAAK;;IAGhC;EAAC;EAAsB;EAAmB;EAAgB,CAAC;CAM9D,IAAM,KAAqB,EAAY,YAAqC;AAE1E,MAAI,EAA6B,QAC/B,QAAO,EAA6B;EAGtC,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AA+UlC,SA7UI,CAAC,KASD,EAAe,EAAM,GAChB,EAAE,IAGX,EAAM,wBAAwB,GAAK,EACnC,EAAS,KAAK,EAGd,EAA6B,WAAW,YAAY;AAClD,OAAI;IACF,IAAM,IACJ,EAAwB,WAAW,EAAM,uBACvC,IAEA,IACA,OAAO,YAAY;KACjB,IAAM,CAAC,GAAqB,KAAoB,MAAM,QAAQ,IAC5D,CACE,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC,EACF,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC,CACH,CACF;AAWD,YAAO;MACL,MAVW,EAAoB,MAAM,kBACnC;OACE,iBAAiB,EAAoB,KAAK;OAC1C,GAAI,EAAiB,MAAM,aACvB,EAAE,YAAY,EAAiB,KAAK,YAAY,GAChD,EAAE;OACP,GACD;MAIF,QAAQ,CACN,GAAI,EAAoB,UAAU,EAAE,EACpC,GAAI,EAAiB,UAAU,EAAE,CAClC;MACF;QACC,GACJ,MAAM,EAAsC;KAC1C,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;KACV,CAAC;AAkDN,QA3CE,KACA,EAAO,QAAQ,UACf,EAAO,OAAO,MACX,MACC,GAAG,YAAY,SAAS,eACxB,qCAAqC,KAAK,GAAG,WAAW,GAAG,IAO3D,oEAAoE,KAClE,GAAG,WAAW,GACf,CACJ,KAOD,IAAS,MAAM,EAEb;KACA,SAAS;KACT,OAAO;KAYP,WAAW;KACX,SAAS;KACV,CAAC,GAGA,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AASlD,WARI,EAAmB,EAAO,OAAO,GAG7B,IAAI,EAAU,EAAa,IAE/B,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAO,OAAO,EAEtD,MAAM,EAAa;;IAG/B,IAAI,IAAuB,EAAO,MAAM,iBAAiB,SAAS,EAAE;AASpE,QACE,KACA,EAAK,WAAW,KAChB,EAAM,WAAW,WAAW,GAC5B;KACA,IAAM,IAAW,MAAM,EAAsC;MAC3D,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC;AACF,KAAK,EAAS,QAAQ,SAkBpB,QAAQ,KACN,oDACA,EAAS,OACV,IApBD,IAAO,EAAS,MAAM,iBAAiB,SAAS,EAAE,EAGlD,IAAS;MACP,GAAG;MACH,MAAM,EACJ,iBAAiB,EAAS,MAAM,mBAAmB;OACjD,OAAO,EAAE;OACT,OAAO;OACR,EACF;MACF;;IAaL,IAAM,IACJ,EAAK,WAAW,KAAK,EAAM,WAAW,SAAS,IAC3C,EAA2B,EAAM,WAAW,GAC5C,EAAE,EACF,IACJ,EAAsB,SAAS,IAAI,IAAwB;AAE7D,MAAM,iBAAiB,EAAuB;IAG9C,IAAI,IAAc,GAaZ,IACJ,KAAe,EAAK,MAAM,MAAQ,EAAI,OAAO,EAAY;AAkC3D,QAjCI,KAAe,CAAC,KAAyB,EAAK,SAAS,MACzD,IAAc,EAAK,GAAG,IACtB,EAAiB;KACf,gBAAgB;KAChB,aAAa;KACb,UAAU;KACV,WAAW;KACZ,CAAC,EACF,EAAM,cAAc,EAAE,CAAC,EACvB,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,sBAAsB,KAAK,EACjC,EAAM,oBAAoB,KAAK,EAC/B,EAAM,kBAAkB,KAAK,GAG3B,KAAe,MAAgB,EAAM,yBACvC,EAAM,yBAAyB,EAAY,EAIzC,EAAuB,SAAS,KAAK,CAAC,MACxC,EAAM,yBAAyB,EAAuB,GAAG,GAAG,EAC5D,IAAc,EAAuB,GAAG,KAWtC,KAAe,EAAa,UAAU,CAAC,WAAW,WAAW,GAAG;AAClE,OAAM,qBAAqB,GAAK;AAChC,SAAI;MAGF,IAMM,KALJ,MAAuB,IACnB,EAAO,MAAM,YAAY,OAAO,QAC7B,MAAM,EAAE,mBAAmB,EAC7B,GACD,KAAA,MAGF,MAAM,EAAsC;OAC1C,SAAS;OACT,OAAO;OACP,WAAW;OACX,SAAS;OACV,CAAC,CAAC,MAAM,MACP,EAAS,QAAQ,SACb,QACC,EAAS,MAAM,YAAY,SAAS,EAAE,EAAE,QACtC,MAAM,EAAE,mBAAmB,EAC7B,CACN;AAEL,UAAI,GAAI;AACN,SAAM,cAAc,EAAG;OACvB,IAAM,IAAqB,EAAqB,UAC5C,EAAG,MACA,MACC,EAAU,OAAO,EAAqB,QACzC,GACD;AAEJ,WAAI,EACF,GAAM,sBAAsB,EAAmB,GAAG;gBACzC,EAAG,SAAS,GAAG;QACxB,IAAM,IAAoB;SACxB,gBAAgB;SAChB,aAAa,EAAG,GAAG;SACnB,UAAU,EAAG,GAAG;SAChB,WAAW;SACZ;AAED,QAAI,EAAqB,WAKvB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAM,kBAAkB,KAAK,EAC7B,EAAiB,EAAkB,IACzB,EAAM,uBAGhB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAiB,EAAkB;;;aAInC,WAEE;AACR,QAAM,qBAAqB,GAAM;;;AAIrC,WAAO;YACA,GAAK;AAIZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAMvC,QALI,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAI,EAEtD,EAAS,EAAQ,EAEb,EAAM,WAAW,SAAS,GAAG;KAC/B,IAAM,IAAwB,EAC5B,EAAM,WACP;AACD,SAAI,EAAsB,SAAS,EAKjC,QAJA,EAAM,iBAAiB,EAAsB,EACxC,EAAM,yBACT,EAAM,yBAAyB,EAAsB,GAAG,GAAG,EAEtD;;AAIX,WAAO,EAAE;aACD;AAER,IADA,EAAM,wBAAwB,GAAM,EACpC,EAA6B,UAAU;;MAEvC,EAEG,EAA6B;IACnC,CAAC,GAAe,EAAiB,CAAC,EAM/B,IAAwB,EAC5B,OAAO,MAAiD;EAEtD,IAAM,IACJ,EAA2B,QAAQ,IAAI,EAAe;AACxD,MAAI,EACF,QAAO;EAGT,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AAElC,MAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO,EAAE;AAIX,EADA,EAAM,qBAAqB,GAAK,EAChC,EAAS,KAAK;EAGd,IAAM,KAAgB,YAAY;AAChC,OAAI;IACF,IAAM,IAAS,MAAM,EAAsC;KACzD,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;KACV,CAAC;AASF,QANI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAGC,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,WAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,+BAA+B,EAAO,OAAO,EACjD,MAAM,EAAa;;IAY/B,IAAM,KADqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAC9C,QAAQ,MAAM,EAAE,mBAAmB,EAAe;AAEnE,WADA,EAAM,cAAc,EAAG,EAChB;YACA,GAAK;AACZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,WAFA,QAAQ,MAAM,+BAA+B,EAAI,EACjD,EAAS,EAAQ,EACV,EAAE;aACD;AAER,IADA,EAAM,qBAAqB,GAAM,EACjC,EAA2B,QAAQ,OAAO,EAAe;;MAEzD;AAGJ,SADA,EAA2B,QAAQ,IAAI,GAAgB,EAAa,EAC7D;IAET,CAAC,EAAc,CAChB,EAMK,IAAsB,EAC1B,OACE,GACA,GACA,MAMI;EACJ,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB;AAEtC,MAAI,CAAC,KAAa,EAAe,EAAU,CACzC,QAAO;GAAE,SAAS;GAAO,OAAO;GAAmC;AAGrE,IAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAElB;IACD,SAAS;IACT,OAAO;IACP,WAAW,EACT,OAAO;KACL;KACA,GAAI,KAAe,EAAE,gBAAa;KAClC,GAAI,KAAa,EAAE,cAAW;KAC/B,EACF;IACD;IACA,SAAS;IACV,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAIlD,WAHK,EAAmB,EAAO,OAAO,IACpC,QAAQ,MAAM,oCAAoC,EAAO,OAAO,EAE3D;KAAE,SAAS;KAAO,OAAO;KAAc;;GAGhD,IAAM,IAAc,EAAO,MAAM;AAEjC,OAAI,GAAa,WAAW,EAAY,OAAO;IAC7C,IAAM,IAAe,EAAY,eAAe;AAKhD,WAJI,KACF,EAAM,sBAAsB,EAAa,EAE3C,EAAM,kBAAkB,EAAY,MAAM,EACnC;KACL,SAAS;KACT,OAAO,EAAY;KACnB,qBAAqB,KAAgB,KAAA;KACtC;;AAGH,UAAO;IACL,SAAS;IACT,OACE,GAAa,OAAO,WAAW;IAClC;WACM,GAAK;GACZ,IAAM,IACJ,aAAe,QACX,EAAI,UACJ;AAGN,UAFA,QAAQ,MAAM,oCAAoC,EAAI,EACtD,EAAS,EAAQ,EACV;IAAE,SAAS;IAAO,OAAO;IAAS;;IAG7C,CAAC,EAAiB,CACnB,EAMK,IAAgB,EAAY,YAAgC;EAChE,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB,EAChC,IAAU,EAAM,gBAChB,IAAc,EAAM;AAU1B,MARI,CAAC,KAAa,EAAe,EAAU,IAIvC,CAAC,KAID,CAAC,EACH,QAAO,EAAE;AAIX,EADA,EAAM,mBAAmB,GAAK,EAC9B,EAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAA+B;IAClD,SAAS;IACT,OAAO;IACP;IACA,gBAAgB;IAChB,SAAS;IACV,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,UAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,6BAA6B,EAAO,OAAO,EAC/C,MAAM,EAAa;;GAG/B,IAAM,IAAmB,EAAO,MAAM,UAAU,SAAS,EAAE;AAE3D,UADA,EAAM,YAAY,EAAM,EACjB;WACA,GAAK;AACZ,OAAI,aAAe,EACjB,QAAO,EAAE;GAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,UAFA,QAAQ,MAAM,6BAA6B,EAAI,EAC/C,EAAS,EAAQ,EACV,EAAE;YACD;AACR,KAAM,mBAAmB,GAAM;;IAEhC,CAAC,EAAiB,CAAC,EAMhB,KAAqB,EACzB,OAAO,MAA4C;EACjD,IAAM,IAAQ,EAAa,UAAU;AASrC,SAPA,EAAM,sBAAsB,KAAK,EACjC,EAAM,kBAAkB,KAAK,EAC7B,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,EAC/B,EAAM,yBAAyB,EAAI,GAAG,EAE3B,MAAM,EAAsB,EAAI,GAAG;IAGhD,CAAC,EAAsB,CACxB,EAEK,KAAkB,EACtB,OACE,MAKI;EACJ,IAAM,IAAQ,EAAa,UAAU;AAKrC,MAHA,EAAM,oBAAoB,KAAK,EAC/B,EAAM,YAAY,EAAE,CAAC,EAEjB,CAAC,EAAU,eAEb,QADA,QAAQ,MAAM,qCAAqC,EAAU,EACtD;GACL,SAAS;GACT,OAAO;GACR;EAGH,IAAM,IAAc,MAAM,EACxB,EAAU,gBACV,EAAU,GACX;AAED,MAAI,CAAC,EAAY,QACf,QAAO;GAAE,SAAS;GAAO,OAAO,EAAY;GAAO;EAGrD,IAAI,IAAQ,MAAM,GAAe;AACjC,MAAI,EAAM,WAAW,GAAG;GACtB,IAAM,IAAY,GAAoB,EAChC,IAAiB,EAAa,UAAU,CAAC;AAC/C,OAAI,KAAa,GAAgB;IAC/B,IAAM,IAAiB,MAAM,EAAqB;KAChD;KACA;KACA;KACD,CAAC;AACF,IAAI,MACF,IAAQ,CAAC,EAAe,EACxB,EAAM,YAAY,EAAM;;;AAS9B,SAJI,EAAM,SAAS,KACjB,EAAM,oBAAoB,EAAM,GAAI,GAAG,EAGlC;GAAE,SAAS;GAAM,UAAU;GAAO;IAE3C;EAAC;EAAqB;EAAe;EAAiB,CACvD,EAEK,KAAgB,GAAa,MAA2B;EAC5D,IAAM,IAAQ,EAAa,UAAU;AAErC,EADA,EAAM,oBAAoB,EAAQ,GAAG,EAEnC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa,EAAM;GACnB,gBAAgB,EAAM;GACtB,WAAW,EAAQ;GACpB,CAAC,IAEF,EAAM,kBAAkB,KAAK;IAE9B,EAAE,CAAC;AA+FN,QAtFA,QAAgB;EACd,IAAI,IAAY,IAMV,KAAwB,MAAgC;GAC5D,IAAI,IAAU,IACV,IAAS,IACP,UAAgB;AAChB,YACJ;SAAI,GAAS;AACX,UAAS;AACT;;AAGG,KADL,IAAU,IACL,GAAK,CAAC,cAAc;AAEvB,MADA,IAAU,IACN,CAAC,KAAa,MAChB,IAAS,IACT,GAAS;OAEX;;;AAEJ,UAAO;KAGH,IAAkB,QAA2B,GAAe,CAAC,EAC7D,IAAoB,QAA2B;GACnD,IAAM,IAAQ,EAAa,UAAU,CAAC;AACtC,UAAO,IAAQ,EAAsB,EAAM,GAAG,QAAQ,SAAS;IAC/D,EAGI,IAAc,EAAS,OAAO,MAAU;GAE5C,IAAM,IAAoB,EAAM;AAEhC,OAAI,EAAuB,IAAI,EAAU,EAAE;IACzC,IAAM,IAAmB,EAAqB,EAAM,QAAQ,EACtD,EAAE,0BAAuB,EAAa,UAAU;AAGtD,QACE,KACA,KACA,MAAqB,EAErB;AAMF,OAAiB;AACjB;;AAGF,GAAI,EAAyB,IAAI,EAAU,IACzC,GAAmB;IAErB;AAEF,eAAa;AAEX,GADA,IAAY,IACZ,GAAa;;IAEd;EAAC;EAAU;EAAe;EAAsB,CAAC,EAkB7C;EACL;EACA;EACA;EAEA;EACA;EACA;EAEA,qBArB0B,EAAc,MACvC,MAAQ,EAAI,OAAO,EACrB;EAoBC,kBAnBuB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;EAkBC,gBAjBqB,EAAS,MAAM,MAAS,EAAK,OAAO,EAAiB;EAmB1E;EAEA;EACA;EACA;EACA,WACE,KAA0B,KAAuB;EAEnD;EAEA;EACA;EACA;EACA;EAEA;EACA;EACA;EACD;;AAmBH,SAAgB,EACd,GACA;CACA,IAAM,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAsB,GACzB,MAAU,EAAM,oBAClB,EACK,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IAAuB,GAAS,wBAAwB;AAE9D,SAAgB;AAGd,MAFI,KAEA,CAAC,KAAyB,CAAC,KAAe,EAAqB;EAGnE,IAAM,IAAwB,EAAW,MACtC,MAAO,EAAG,mBAAmB,EAC/B;AAID,MAAI,EAAW,SAAS,KAAK,CAAC,GAAuB;GACnD,IAAM,IAAQ,EAAa,UAAU;AAIrC,GAHA,EAAM,qBAAqB,GAAK,EAGhC,EAAsC;IACpC,SAAS;IACT,OAAO;IACP,WAAW;IACX,SAAS;IACV,CAAC,CACC,MAAM,MAAW;AAQhB,QALI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAEC,CAAC,EAAO,QAAQ,QAAQ;KAK1B,IAAM,KAJqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAI9C,QACd,MAAM,EAAE,mBAAmB,EAC7B;AACD,OAAM,cAAc,EAAG;;KAEzB,CACD,YAAY,GAEX,CACD,cAAc;AACb,MAAM,qBAAqB,GAAM;KACjC;;IAEL;EACD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;;AAqBJ,SAAgB,EAAqB,GAAyC;CAC5E,IAAM,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAmB,GAAwB,EAC3C,IACJ,GAAS,oBAAoB,EAAiB,kBAC1C,IAAqB,GAAS,sBAAsB,IACpD,IAAmB,GAAS,oBAAoB,IAOhD,IAAoB,EAAO,GAAM,EAIjC,IAAgB,kBACpB,IAAI,KAAK,CACV,EAYK,IAAyB,kBAE7B,IAAI,KAAK,CAAC,EAEN,IAAmC;AAqOzC,CApOA,QAAgB;AAMd,MALI,KAEA,CAAC,KAAsB,CAAC,KAGxB,EAAkB,QAAS;EAO/B,IAAM,IAAe,EAAuB,QAAQ,IAAI,EAAmB;AAC3E,MACE,KACA,EAAa,SAAS,KACtB,KAAK,KAAK,GAAG,EAAa,gBAAgB,EAE1C;AAEF,EACE,KACA,KAAK,KAAK,GAAG,EAAa,iBACxB,KAGF,EAAuB,QAAQ,OAAO,EAAmB;EAQ3D,IAAM,IAAmB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;AAGD,MACE,KACA,KACA,EAAiB,mBAAmB,EAEpC;EAGF,IAAM,IACJ,GAAkB,kBAAkB;AACtC,MAAI,CAAC,EAAgB;EAErB,IAAM,IAAQ,EAAa,UAAU,EAG/B,IACJ,CAAC,KACD,EAAe,EAAe,IAC9B,CAAC,EAAgC,GAAgB;GAC/C,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EAGE,IAA0B,EAAS,MACtC,MAAM,EAAE,gBAAgB,EAC1B;AACD,MAAI,KAA2B,CAAC,GAAY;AAC1C,OAAI,CAAC,EAAM,kBAAkB;IAC3B,IAAM,IAAe,EAAS,MAC3B,MAAY,EAAQ,gBAAgB,EACtC;AACD,IAAI,KACF,EAAM,oBAAoB,EAAa,GAAG;;AAG9C;;EAGF,IAAM,IAAe,YAAY;AAE/B,GADA,EAAkB,UAAU,IAC5B,EAAM,mBAAmB,GAAK;GAC9B,IAAI,IAAY;AAEhB,OAAI;IACF,IAAI,IAAU;AAGd,QAAI,GAAY;KACd,IAAM,IAAc,MAAM,EAEvB;MACD,SAAS;MACT,OAAO;MACP,WAAW,EACT,OAAO;OACL;OACA,aAAa;OACb,GAAI,IAAmB,EAAE,WAAW,GAAkB,GAAG,EAAE;OAC5D,EACF;MACD,WAAW;MACX,SAAS;MACV,CAAC;AAEF,SACE,EAAY,MAAM,qBAAqB,WACvC,EAAY,KAAK,oBAAoB,MAGrC,CADA,IAAU,EAAY,KAAK,oBAAoB,OAC/C,EAAM,kBAAkB,EAAQ;SAEhC;;AAKJ,QAAI,KAAW,CAAC,KAA2B,CAAC,GAAkB;KAC5D,IAAM,IAAiB,MAAM,EAA+B;MAC1D,SAAS;MACT,OAAO;MACP,WAAW;MACX,gBAAgB;MAChB,SAAS;MACV,CAAC;AAEF,SAAI,EAAe,QAAQ,OACzB;KAGF,IAAI,IAAmB,EAAe,MAAM,UAAU,SAAS,EAAE;AACjE,SAAI,EAAM,WAAW,GAAG;MACtB,IAAM,IAAiB,MAAM,EAAqB;OAChD,WAAW;OACX;OACA,gBAAgB;OACjB,CAAC;AACF,UAAI,EACF,KAAQ,CAAC,EAAe;UAMxB;;AAOJ,KAHA,EAAM,YAAY,EAAM,EAGpB,EAAM,SAAS,KAAK,CAAC,EAAM,oBAC7B,EAAM,oBAAoB,EAAM,GAAG,GAAG;;AAI1C,QAAY;WACN,WAEE;AAER,IADA,EAAM,mBAAmB,GAAM,EAC/B,EAAkB,UAAU;IAC5B,IAAM,IAAW,EAAuB;AACxC,QAAI,GAAW;AACb,OAAS,OAAO,EAAmB;KACnC,IAAM,IAAU,EAAc,QAAQ,IAAI,EAAmB;AAC7D,KAAI,MACF,aAAa,EAAQ,EACrB,EAAc,QAAQ,OAAO,EAAmB;WAE7C;KAEL,IAAM,KADW,EAAS,IAAI,EAAmB,EACpB,SAAS,KAAK;AAU3C,SATA,EAAS,IAAI,GAAoB;MAC/B,OAAO;MACP,eAAe,KAAK,KAAK;MAC1B,CAAC,EAME,IAAY,GAA2B;MACzC,IAAM,IAAgB,EAAc,QAAQ,IAAI,EAAmB;AACnE,MAAI,KAAe,aAAa,EAAc;MAC9C,IAAM,IAAY,KAAK,IAAI,MAAO,MAAM,IAAY,IAAI,IAAK,EACvD,IAAQ,iBAAiB;AAC7B,SAAc,QAAQ,OAAO,EAAmB;OAGhD,IAAM,IAAS,EAAa,UAAU;AACtC,OACE,EAAO,uBAAuB,KAC9B,CAAC,EAAO,SAAS,MACd,MAAM,EAAE,gBAAgB,EAC1B,IACD,CAAC,EAAkB,WAMd,GAAc;SAEpB,EAAU;AACb,QAAc,QAAQ,IAAI,GAAoB,EAAM;;;;;AAM5D,KAAc;IACb;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAIF,QAAgB;EACd,IAAM,IAAS,EAAc;AAC7B,eAAa;AAEX,GADA,EAAO,SAAS,MAAU,aAAa,EAAM,CAAC,EAC9C,EAAO,OAAO;;IAEf,EAAE,CAAC"}

package/dist/auth/pages/SSOClearPage.js

@@ -3,37 +3,35 @@ import { clearLocalAuthState as t } from "@burdenoff/fe-libs/shared/components";
 import { useSearchParams as n } from "react-router-dom";
 import { jsx as r } from "react/jsx-runtime";
 import { clearShellSsoCookies as i } from "@burdenoff/fe-libs/shared/utils";
-import { getAuthBridge as a } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
+import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
+import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
 //#region src/auth/pages/SSOClearPage.tsx
-var o = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
-function s(e) {
+var s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
+function c(e) {
 	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
 	if (e.protocol !== "https:") return !1;
-	for (let t of o) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `www.${t}`) return !0;
+	for (let t of s) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `www.${t}`) return !0;
 	return !1;
 }
-function c(e) {
+function l(e) {
 	if (!e) return "/auth/login?reason=logout";
 	try {
 		let t = new URL(e, window.location.origin);
-		if (t.origin === window.location.origin || s(t)) return t.href;
+		if (t.origin === window.location.origin || c(t)) return t.href;
 	} catch {}
 	return "/auth/login?reason=logout";
 }
-function l() {
-	let [o] = n();
+function u() {
+	let [s] = n();
 	return e(() => {
-		let e = c(o.get("returnTo"));
+		let e = l(s.get("returnTo"));
 		try {
-			t(), i(), a()?.notifyLogoutAll();
+			t(), i(), o()?.notifyLogoutAll();
 		} catch {}
 		window.location.replace(e);
-	}, [o]), /* @__PURE__ */ r("div", {
-		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
-	});
+	}, [s]), /* @__PURE__ */ r(a, { label: "Signing you out…" });
 }
 //#endregion
-export { l as SSOClearPage };
+export { u as SSOClearPage };
 
 //# sourceMappingURL=SSOClearPage.js.map

package/dist/auth/pages/SSOClearPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA2BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}
+{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return <BrandedSplash label=\"Signing you out…\" />;\n}\n"],"mappings":";;;;;;;;AA4BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,oBAAqB,CAAA"}

package/dist/auth/pages/SSODepositPage.js

@@ -3,52 +3,50 @@ import { useEffect as t } from "react";
 import { useSearchParams as n } from "react-router-dom";
 import { jsx as r } from "react/jsx-runtime";
 import { setSSoCookie as i } from "@burdenoff/fe-libs/shared/utils";
-import { getAuthBridge as a } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
+import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
+import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
 //#region src/auth/pages/SSODepositPage.tsx
-var o = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
-function s(e) {
+var s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
+function c(e) {
 	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
 	if (e.protocol !== "https:") return !1;
-	for (let t of o) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `admin.${t}` || e.hostname === `alphaadmin.${t}` || e.hostname === `www.${t}`) return !0;
+	for (let t of s) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `admin.${t}` || e.hostname === `alphaadmin.${t}` || e.hostname === `www.${t}`) return !0;
 	return !1;
 }
-function c(e) {
+function l(e) {
 	if (!e) return "/";
 	try {
 		let t = new URL(e, window.location.origin);
-		if (t.origin === window.location.origin || s(t)) return t.href;
+		if (t.origin === window.location.origin || c(t)) return t.href;
 	} catch {}
 	return "/";
 }
-function l() {
-	let [o] = n();
+function u() {
+	let [s] = n();
 	return t(() => {
-		let t = c(o.get("returnTo")), n = window.location.hash;
+		let t = l(s.get("returnTo")), n = window.location.hash;
 		if (!n.startsWith("#sso=")) {
 			window.location.replace(t);
 			return;
 		}
 		try {
-			let r = n.slice(5), { profileId: o, tokens: s, user: c, profiles: l } = JSON.parse(atob(r));
-			if (!o || !s) {
+			let r = n.slice(5), { profileId: a, tokens: s, user: c, profiles: l } = JSON.parse(atob(r));
+			if (!a || !s) {
 				window.location.replace(t);
 				return;
 			}
-			localStorage.setItem(`bf-p-${o}-tokens`, s), c && localStorage.setItem(`bf-p-${o}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", o), i(o), e.getState().loadFromProfile(o), window.dispatchEvent(new Event("bf-profile-storage-change")), a()?.notifyLogin({
+			localStorage.setItem(`bf-p-${a}-tokens`, s), c && localStorage.setItem(`bf-p-${a}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", a), i(a), e.getState().loadFromProfile(a), window.dispatchEvent(new Event("bf-profile-storage-change")), o()?.notifyLogin({
 				user: c ? JSON.parse(c) : null,
 				tokens: s ? JSON.parse(s) : null,
-				activeProfileId: o,
+				activeProfileId: a,
 				profiles: l ? JSON.parse(l) : []
 			}), window.location.replace(t);
 		} catch {
 			window.location.replace(t);
 		}
-	}, [o]), /* @__PURE__ */ r("div", {
-		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
-	});
+	}, [s]), /* @__PURE__ */ r(a, { label: "Signing you in…" });
 }
 //#endregion
-export { l as SSODepositPage };
+export { u as SSODepositPage };
 
 //# sourceMappingURL=SSODepositPage.js.map

package/dist/auth/pages/SSODepositPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // valid post-deposit return targets. Without these, a login that lands on\n      // the bridge host falls back to \"/\" instead of returning to the admin app.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA6BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAI7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}
+{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // valid post-deposit return targets. Without these, a login that lands on\n      // the bridge host falls back to \"/\" instead of returning to the admin app.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return <BrandedSplash label=\"Signing you in…\" />;\n}\n"],"mappings":";;;;;;;;AA8BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAI7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,mBAAoB,CAAA"}

package/dist/auth/pages/SSORelayCallbackPage.js

@@ -3,9 +3,10 @@ import { useEffect as t } from "react";
 import { useSearchParams as n } from "react-router-dom";
 import { jsx as r } from "react/jsx-runtime";
 import { setSSoCookie as i } from "@burdenoff/fe-libs/shared/utils";
-import { getAuthBridge as a } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
+import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
+import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
 //#region src/auth/pages/SSORelayCallbackPage.tsx
-function o(e) {
+function s(e) {
 	if (!e) return "/dashboard";
 	try {
 		let t = new URL(e, window.location.origin);
@@ -14,35 +15,32 @@ function o(e) {
 		return "/dashboard";
 	}
 }
-function s() {
-	let [s] = n();
+function c() {
+	let [c] = n();
 	return t(() => {
-		let t = o(s.get("returnTo")), n = window.location.hash;
+		let t = s(c.get("returnTo")), n = window.location.hash;
 		if (!n.startsWith("#sso=")) {
 			window.location.replace("/auth/login");
 			return;
 		}
 		try {
-			let r = n.slice(5), { profileId: o, tokens: s, user: c, profiles: l } = JSON.parse(atob(r));
-			if (!o || !s) {
+			let r = n.slice(5), { profileId: a, tokens: s, user: c, profiles: l } = JSON.parse(atob(r));
+			if (!a || !s) {
 				window.location.replace("/auth/login");
 				return;
 			}
-			localStorage.setItem(`bf-p-${o}-tokens`, s), c && localStorage.setItem(`bf-p-${o}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", o), i(o), e.getState().loadFromProfile(o), window.dispatchEvent(new Event("bf-profile-storage-change")), a()?.notifyLogin({
+			localStorage.setItem(`bf-p-${a}-tokens`, s), c && localStorage.setItem(`bf-p-${a}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", a), i(a), e.getState().loadFromProfile(a), window.dispatchEvent(new Event("bf-profile-storage-change")), o()?.notifyLogin({
 				user: c ? JSON.parse(c) : null,
 				tokens: s ? JSON.parse(s) : null,
-				activeProfileId: o,
+				activeProfileId: a,
 				profiles: l ? JSON.parse(l) : []
 			}), window.location.replace(t);
 		} catch {
 			window.location.replace("/auth/login");
 		}
-	}, [s]), /* @__PURE__ */ r("div", {
-		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
-	});
+	}, [c]), /* @__PURE__ */ r(a, { label: "Signing you in…" });
 }
 //#endregion
-export { s as SSORelayCallbackPage };
+export { c as SSORelayCallbackPage };
 
 //# sourceMappingURL=SSORelayCallbackPage.js.map

package/dist/auth/pages/SSORelayCallbackPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSORelayCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayCallbackPage.tsx"],"sourcesContent":["/**\n * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.\n *\n * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.\n * After storing in localStorage, redirects to the returnTo path.\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nfunction getSafeReturnTo(returnTo: string | null): string {\n  if (!returnTo) return \"/dashboard\";\n\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin !== window.location.origin) return \"/dashboard\";\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return \"/dashboard\";\n  }\n}\n\nexport function SSORelayCallbackPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = getSafeReturnTo(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      // No SSO data — redirect to login\n      window.location.replace(\"/auth/login\");\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5); // Remove \"#sso=\"\n      const payload = JSON.parse(atob(encoded));\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(\"/auth/login\");\n        return;\n      }\n\n      // Store tokens in localStorage\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n\n      // Dispatch event so AuthProvider picks up the new state\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the auth bridge so other open shells can pick up the new session\n      getAuthBridge()?.notifyLogin({\n        user: user ? JSON.parse(user) : null,\n        tokens: tokens ? JSON.parse(tokens) : null,\n        activeProfileId: profileId,\n        profiles: profiles ? JSON.parse(profiles) : [],\n      });\n\n      // Clear the hash and redirect\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(\"/auth/login\");\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AAaA,SAAS,EAAgB,GAAiC;AACxD,KAAI,CAAC,EAAU,QAAO;AAEtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAErD,SADI,EAAI,WAAW,OAAO,SAAS,SAC5B,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI,SADQ;SAE5C;AACN,SAAO;;;AAIX,SAAgB,IAAuB;CACrC,IAAM,CAAC,KAAgB,GAAiB;AAoDxC,QAlDA,QAAgB;EACd,IAAM,IAAW,EAAgB,EAAa,IAAI,WAAW,CAAC,EACxD,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAE7B,UAAO,SAAS,QAAQ,cAAc;AACtC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAEvB,EAAE,cAAW,WAAQ,SAAM,gBADjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAGzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,cAAc;AACtC;;AA2BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAGlD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAG5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;IAChC,QAAQ,IAAS,KAAK,MAAM,EAAO,GAAG;IACtC,iBAAiB;IACjB,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;IAC/C,CAAC,EAGF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,cAAc;;IAEvC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}
+{"version":3,"file":"SSORelayCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayCallbackPage.tsx"],"sourcesContent":["/**\n * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.\n *\n * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.\n * After storing in localStorage, redirects to the returnTo path.\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nfunction getSafeReturnTo(returnTo: string | null): string {\n  if (!returnTo) return \"/dashboard\";\n\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin !== window.location.origin) return \"/dashboard\";\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return \"/dashboard\";\n  }\n}\n\nexport function SSORelayCallbackPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = getSafeReturnTo(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      // No SSO data — redirect to login\n      window.location.replace(\"/auth/login\");\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5); // Remove \"#sso=\"\n      const payload = JSON.parse(atob(encoded));\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(\"/auth/login\");\n        return;\n      }\n\n      // Store tokens in localStorage\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n\n      // Dispatch event so AuthProvider picks up the new state\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the auth bridge so other open shells can pick up the new session\n      getAuthBridge()?.notifyLogin({\n        user: user ? JSON.parse(user) : null,\n        tokens: tokens ? JSON.parse(tokens) : null,\n        activeProfileId: profileId,\n        profiles: profiles ? JSON.parse(profiles) : [],\n      });\n\n      // Clear the hash and redirect\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(\"/auth/login\");\n    }\n  }, [searchParams]);\n\n  return <BrandedSplash label=\"Signing you in…\" />;\n}\n"],"mappings":";;;;;;;;AAcA,SAAS,EAAgB,GAAiC;AACxD,KAAI,CAAC,EAAU,QAAO;AAEtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAErD,SADI,EAAI,WAAW,OAAO,SAAS,SAC5B,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI,SADQ;SAE5C;AACN,SAAO;;;AAIX,SAAgB,IAAuB;CACrC,IAAM,CAAC,KAAgB,GAAiB;AAoDxC,QAlDA,QAAgB;EACd,IAAM,IAAW,EAAgB,EAAa,IAAI,WAAW,CAAC,EACxD,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAE7B,UAAO,SAAS,QAAQ,cAAc;AACtC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAEvB,EAAE,cAAW,WAAQ,SAAM,gBADjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAGzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,cAAc;AACtC;;AA2BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAGlD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAG5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;IAChC,QAAQ,IAAS,KAAK,MAAM,EAAO,GAAG;IACtC,iBAAiB;IACjB,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;IAC/C,CAAC,EAGF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,cAAc;;IAEvC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,mBAAoB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/microfe-auth",
-  "version": "2026.704.1",
+  "version": "2026.708.1",
   "description": "Auth microfrontend for Burdenoff products",
   "type": "module",
   "imports": {
@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "@apollo/client": "^4.0.9",
-    "@burdenoff/fe-libs": "2026.625.5",
+    "@burdenoff/fe-libs": "2026.704.2",
     "@types/qrcode.react": "^3.0.0",
     "clsx": "^2.1.1",
     "graphql": "^16.12.0",