@burdenoff/microfe-auth 2026.708.1 → 2026.710.2

package/dist/auth/hooks/useContextSwitcherData.js

@@ -237,9 +237,9 @@ function E(s) {
 			}
 		})();
 		return V.current.set(t, a), a;
-	}, [G]), Q = n(async (t, n, r) => {
-		let i = e.getState(), a = x();
-		if (!a || g(a)) return {
+	}, [G]), Q = n(async (t, n, r, i) => {
+		let a = e.getState(), o = x();
+		if (!o || g(o)) return {
 			success: !1,
 			error: "No valid access token available"
 		};
@@ -253,8 +253,9 @@ function E(s) {
 					...n && { workspaceId: n },
 					...r && { projectId: r }
 				} },
-				authToken: a,
-				baseUrl: K
+				authToken: o,
+				baseUrl: K,
+				tenantId: i
 			});
 			if (e.errors?.length) {
 				let t = e.errors[0]?.message ?? "GraphQL error";
@@ -263,18 +264,18 @@ function E(s) {
 					error: t
 				};
 			}
-			let o = e.data?.issueWorkspaceToken;
-			if (o?.success && o.token) {
-				let e = o.workspaceId || n;
-				return e && i.setCurrentWorkspaceId(e), i.setWorkspaceToken(o.token), {
+			let s = e.data?.issueWorkspaceToken;
+			if (s?.success && s.token) {
+				let e = s.workspaceId || n;
+				return e && a.setCurrentWorkspaceId(e), a.setWorkspaceToken(s.token), {
 					success: !0,
-					token: o.token,
+					token: s.token,
 					resolvedWorkspaceId: e || void 0
 				};
 			}
 			return {
 				success: !1,
-				error: o?.error?.message ?? "Failed to issue workspace token"
+				error: s?.error?.message ?? "Failed to issue workspace token"
 			};
 		} catch (e) {
 			let t = e instanceof Error ? e.message : "Failed to issue workspace token";
@@ -317,7 +318,7 @@ function E(s) {
 			success: !1,
 			error: "Workspace is missing organizationId"
 		};
-		let r = await Q(t.organizationId, t.id);
+		let r = await Q(t.organizationId, t.id, void 0, t.tenantId);
 		if (!r.success) return {
 			success: !1,
 			error: r.error
@@ -477,7 +478,8 @@ function O(n) {
 							...u ? { projectId: u } : {}
 						} },
 						authToken: m,
-						baseUrl: y
+						baseUrl: y,
+						tenantId: s.find((e) => e.id === a)?.tenantId
 					});
 					if (t.data?.issueWorkspaceToken?.success && t.data.issueWorkspaceToken.token) e = t.data.issueWorkspaceToken.token, i.setWorkspaceToken(e);
 					else return;

package/dist/auth/hooks/useContextSwitcherData.js.map

@@ -1 +1 @@
-{"version":3,"file":"useContextSwitcherData.js","names":[],"sources":["../../../src/auth/hooks/useContextSwitcherData.ts"],"sourcesContent":["import { useCallback, useState, useEffect, useRef } from \"react\";\nimport {\n  graphqlFetch,\n  getStoredAuthToken,\n} from \"@burdenoff/fe-libs/shared/graphql\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { Organization, Workspace, Project } from \"../types\";\nimport { resolveGatewayBaseUrls } from \"../utils/gatewayBaseUrls\";\n\n// =============================================================================\n// Hook Options\n// =============================================================================\n\nexport interface UseContextSwitcherDataOptions {\n  /**\n   * Optional Global API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  globalBaseUrl?: string;\n  /**\n   * Optional Workspaces API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  workspaceBaseUrl?: string;\n  /** Disable initial organization/workspace bootstrap fetches */\n  disableBootstrap?: boolean;\n  /** Disable the workspace sync effect */\n  disableWorkspaceSync?: boolean;\n  /** Disable the project sync effect */\n  disableProjectSync?: boolean;\n  /** Only hydrate the workspace token; do not eagerly fetch projects */\n  skipProjectFetch?: boolean;\n}\n\n// =============================================================================\n// GraphQL Response Types\n// =============================================================================\n\ninterface MyOrganizationsResponse {\n  myOrganizations: {\n    total: number;\n    items: Organization[];\n  };\n}\n\ninterface WorkspacesByOrgResponse {\n  workspaces: {\n    total: number;\n    items: Workspace[];\n  };\n}\n\ntype GraphQLFetchResult<T> = Awaited<ReturnType<typeof graphqlFetch<T>>>;\n\ninterface IssueWorkspaceTokenResult {\n  success: boolean;\n  token: string | null;\n  expiresAt: string | null;\n  organizationId: string | null;\n  workspaceId: string | null;\n  projectId: string | null;\n  scopes: string[] | null;\n  error: {\n    code: string;\n    message: string;\n  } | null;\n}\n\ninterface ProjectsResponse {\n  projects: {\n    total: number;\n    items: Project[];\n  };\n}\n\ninterface CreateProjectResponse {\n  createProject: Project;\n}\n\n// =============================================================================\n// GraphQL Query/Mutation Strings\n// =============================================================================\n\nconst MY_ORGANIZATIONS_QUERY = `\n  query MyOrganizations {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\n// Both queries below historically used `workspaces(filter: $filter)` with\n// a `WorkspaceFilterInput` to fetch workspaces for a specific organization.\n// That Query field was removed/renamed in the global subgraph; calling it\n// now throws GRAPHQL_VALIDATION_FAILED (\"Cannot query field 'workspaces'\n// on type 'Query'\") which crashes the context switcher and cascades into a\n// \"Verifying workspace access...\" stuck-spinner on every Platform module\n// route (/billing, /support, /notifications, /devportal).\n//\n// The supported field is `myWorkspaces(limit, offset)` on the global\n// subgraph — self-scoped, returns the caller's workspaces across all\n// orgs. It does NOT accept a filter, so we fetch up to 100 of \"my\"\n// workspaces and let the existing downstream auto-pick logic filter by\n// organizationId client-side. The recovery path at line ~624 already\n// uses this exact aliased pattern; we're just promoting it to the\n// primary path.\nconst WORKSPACES_BY_ORG_QUERY = `\n  query WorkspacesByOrg {\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst ISSUE_WORKSPACE_TOKEN_MUTATION = `\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      expiresAt\n      organizationId\n      workspaceId\n      projectId\n      scopes\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\n// The workspace gateway exposes `myProjects` (public RBAC, caller-scoped to\n// the active workspace via x-workspace-id) and the privileged\n// `projects(filter)` (list:project). The header has no `list:project`\n// permission seeded for the typical operator, so the privileged form\n// returns FORBIDDEN even though the caller is a member of the workspace.\n// `myProjects` is the right field for \"give me the projects I can see in\n// this workspace\" — workspace scope is already established by the\n// workspace token + x-workspace-id header that we pass with the request.\nconst PROJECTS_QUERY = `\n  query MyProjectsForContext {\n    projects: myProjects {\n      total\n      items {\n        id\n        name\n        key\n        workspaceId\n        status\n        archived\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst CREATE_DEFAULT_PROJECT_MUTATION = `\n  mutation CreateDefaultProject($input: CreateProjectInput!) {\n    createProject(input: $input) {\n      id\n      name\n      key\n      workspaceId\n      status\n      archived\n      createdAt\n      updatedAt\n    }\n  }\n`;\n\nasync function createDefaultProject({\n  authToken,\n  workspaceBaseUrl,\n  workspaceToken,\n}: {\n  authToken: string;\n  workspaceBaseUrl: string;\n  workspaceToken: string;\n}): Promise<Project | null> {\n  const result = await graphqlFetch<CreateProjectResponse>({\n    gateway: \"workspace\",\n    query: CREATE_DEFAULT_PROJECT_MUTATION,\n    variables: {\n      input: {\n        name: \"Default Project\",\n      },\n    },\n    authToken,\n    workspaceToken,\n    baseUrl: workspaceBaseUrl,\n  });\n\n  if (result.errors?.length) {\n    console.warn(\"Failed to create default project:\", result.errors);\n    return null;\n  }\n\n  return result.data?.createProject ?? null;\n}\n\n// =============================================================================\n// Auth Helpers\n// =============================================================================\n\n/**\n * Check whether a JWT is expired (or within bufferMs of expiry).\n * Returns true if the token is expired, close to expiry, or malformed.\n */\nfunction isTokenExpired(token: string, bufferMs = 30_000): boolean {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    if (!payload.exp) return false;\n    return payload.exp * 1000 < Date.now() + bufferMs;\n  } catch {\n    return true;\n  }\n}\n\nfunction getWorkspaceTokenPayload(token: string): {\n  workspaceId?: string;\n  organizationId?: string;\n  projectId?: string;\n  exp?: number;\n} | null {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    return {\n      workspaceId:\n        typeof payload.workspaceId === \"string\"\n          ? payload.workspaceId\n          : undefined,\n      organizationId:\n        typeof payload.organizationId === \"string\"\n          ? payload.organizationId\n          : undefined,\n      projectId:\n        typeof payload.projectId === \"string\" ? payload.projectId : undefined,\n      exp: typeof payload.exp === \"number\" ? payload.exp : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nfunction isWorkspaceTokenValidForContext(\n  token: string | null | undefined,\n  expected: {\n    workspaceId?: string | null;\n    organizationId?: string | null;\n    projectId?: string | null;\n  },\n): token is string {\n  if (!token || isTokenExpired(token)) {\n    return false;\n  }\n\n  const payload = getWorkspaceTokenPayload(token);\n  if (!payload) {\n    return false;\n  }\n\n  if (expected.workspaceId && payload.workspaceId !== expected.workspaceId) {\n    return false;\n  }\n\n  if (\n    expected.organizationId &&\n    payload.organizationId !== expected.organizationId\n  ) {\n    return false;\n  }\n\n  if (expected.projectId && payload.projectId !== expected.projectId) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Custom error class for auth-related failures (expired token, unauthorized, etc.).\n * Used to distinguish auth errors in outer catch blocks so they can be\n * suppressed from console.error — they are expected during token refresh cycles\n * and do not indicate application bugs.\n */\nclass AuthError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * Detect whether a set of GraphQL errors are authentication-related.\n */\nfunction isAuthGraphQLError(\n  errors: Array<{ message?: string; extensions?: { code?: string } }>,\n): boolean {\n  return errors.some(\n    (e) =>\n      e.extensions?.code === \"UNAUTHENTICATED\" ||\n      e.message?.toLowerCase().includes(\"unauthorized\") ||\n      e.message?.toLowerCase().includes(\"not authenticated\"),\n  );\n}\n\n/**\n * Resolve the best available access token:\n * 1. Try the zustand store token\n * 2. If expired, fall back to profile storage (may have been refreshed)\n * 3. Return null if no valid token is available\n */\nfunction resolveAccessToken(): string | null {\n  const storeToken = useAuthStore.getState().accessToken;\n\n  // If store token is valid (or has no exp claim), use it\n  if (storeToken && !isTokenExpired(storeToken)) {\n    return storeToken;\n  }\n\n  // Store token is expired or missing — try profile storage (may be fresher)\n  const profileToken = getStoredAuthToken();\n  if (profileToken && !isTokenExpired(profileToken)) {\n    return profileToken;\n  }\n\n  // Both expired or missing — if store token exists at all, return it as a last\n  // resort (the gateway will reject it and the useEffect will re-trigger after\n  // token refresh). Returning null would silently swallow the first load.\n  return storeToken;\n}\n\nfunction buildFallbackOrganizations(workspaces: Workspace[]): Organization[] {\n  const uniqueOrgIds = Array.from(\n    new Set(\n      workspaces.flatMap((workspace) =>\n        workspace.organizationId ? [workspace.organizationId] : [],\n      ),\n    ),\n  );\n\n  return uniqueOrgIds.map((organizationId, index) => ({\n    id: organizationId,\n    name:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.name || `Organization ${index + 1}`,\n    slug: organizationId,\n    tenantId:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.tenantId || \"\",\n  }));\n}\n\n// =============================================================================\n// Hook Implementation\n// =============================================================================\n\n/**\n * Hook for managing the context switcher data (organizations, workspaces, projects)\n *\n * Data flow:\n * 1. fetchOrganizations() - Get all orgs user has access to (Global Gateway)\n * 2. selectOrganization(org) - Set current org & fetch workspaces for that org\n * 3. selectWorkspace(ws) - Issue workspace token & fetch projects\n * 4. selectProject(proj) - Set current project\n *\n * All GraphQL calls go through graphqlFetch from fe-libs which automatically\n * resolves gateway URLs and injects auth + locale headers.\n *\n * @param options - Optional configuration (gateway base URL overrides)\n */\n// Domain events emitted by microfe-workspaces that should refresh the switcher's\n// cached lists. Module-scoped so they aren't reallocated on every effect run.\nconst PROJECT_REFRESH_EVENTS = new Set<string>([\n  \"project.created\",\n  \"project.updated\",\n  \"project.deleted\",\n  \"project.archived\",\n  \"project.unarchived\",\n]);\nconst WORKSPACE_REFRESH_EVENTS = new Set<string>([\n  \"workspace.created\",\n  \"workspace.updated\",\n  \"workspace.deleted\",\n  \"workspace.archived\",\n  \"workspace.reactivated\",\n]);\n\n// Safely read a string `workspaceId` off a cross-MFE event payload of unknown\n// shape, rather than trusting a bare cast (the payload is produced by another\n// MFE and could drift). Returns undefined when absent or not a string.\nfunction readEventWorkspaceId(payload: unknown): string | undefined {\n  if (payload && typeof payload === \"object\" && \"workspaceId\" in payload) {\n    const value = (payload as { workspaceId?: unknown }).workspaceId;\n    return typeof value === \"string\" ? value : undefined;\n  }\n  return undefined;\n}\n\nexport function useContextSwitcherData(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const {\n    organizationId: activeOrganizationId,\n    workspaceId: activeWorkspaceId,\n    projectId: activeProjectId,\n    setContext: setActiveContext,\n  } = useActiveContext();\n\n  const eventBus = useEventBus();\n\n  // Use selectors for reactive state\n  const organizations = useAuthStore((state) => state.organizations);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const isLoadingOrganizations = useAuthStore(\n    (state) => state.isLoadingOrganizations,\n  );\n\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const isLoadingProjects = useAuthStore((state) => state.isLoadingProjects);\n\n  // Local error state\n  const [error, setError] = useState<string | null>(null);\n\n  // Deduplication refs to prevent duplicate GraphQL calls\n  const fetchOrganizationsPromiseRef = useRef<Promise<Organization[]> | null>(\n    null,\n  );\n  const fetchWorkspacesPromisesRef = useRef<Map<string, Promise<Workspace[]>>>(\n    new Map(),\n  );\n\n  // Stable refs for latest context values — avoids stale closures in callbacks\n  // without adding them to useCallback dep arrays (which would recreate callbacks\n  // on every context change and trigger spurious fetch re-runs).\n  const activeWorkspaceIdRef = useRef(activeWorkspaceId);\n  const activeOrganizationIdRef = useRef(activeOrganizationId);\n  useEffect(() => {\n    activeWorkspaceIdRef.current = activeWorkspaceId;\n    activeOrganizationIdRef.current = activeOrganizationId;\n  });\n\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n\n  // Refs to break feedback loops with the Header's \"store → URL\" sync effect.\n  // Without these the pair can ping-pong: this effect writes (URL → store),\n  // Header writes (store → URL), Zustand re-fires our subscribers, and React\n  // hits \"Maximum update depth exceeded\" — especially when a downstream call\n  // (workspace token issuance) returns 504 and leaves the two halves in\n  // disagreement. The refs record the last value we pushed for each axis;\n  // identical pushes are skipped so the loop has a hard floor.\n  const lastAppliedOrgIdRef = useRef<string | null>(null);\n  const lastAppliedWorkspaceIdRef = useRef<string | null>(null);\n  const lastAppliedProjectIdRef = useRef<string | null>(null);\n  const lastClearedTokenContextRef = useRef<string | null>(null);\n\n  useEffect(() => {\n    const store = useAuthStore.getState();\n\n    if (\n      activeOrganizationId &&\n      activeOrganizationId !== store.currentOrganizationId &&\n      activeOrganizationId !== lastAppliedOrgIdRef.current\n    ) {\n      lastAppliedOrgIdRef.current = activeOrganizationId;\n      store.setCurrentOrganizationId(activeOrganizationId);\n      if (\n        store.workspaces.length > 0 &&\n        !store.workspaces.some(\n          (workspace) => workspace.organizationId === activeOrganizationId,\n        )\n      ) {\n        store.setWorkspaces([]);\n      }\n    }\n\n    if (\n      activeWorkspaceId &&\n      activeWorkspaceId !== store.currentWorkspaceId &&\n      activeWorkspaceId !== lastAppliedWorkspaceIdRef.current\n    ) {\n      lastAppliedWorkspaceIdRef.current = activeWorkspaceId;\n      store.setCurrentWorkspaceId(activeWorkspaceId);\n      if (\n        store.projects.length > 0 &&\n        !store.projects.some(\n          (project) => project.workspaceId === activeWorkspaceId,\n        )\n      ) {\n        store.setProjects([]);\n        store.setCurrentProjectId(null);\n      }\n    }\n\n    if (\n      activeProjectId &&\n      activeProjectId !== store.currentProjectId &&\n      activeProjectId !== lastAppliedProjectIdRef.current\n    ) {\n      lastAppliedProjectIdRef.current = activeProjectId;\n      store.setCurrentProjectId(activeProjectId);\n    }\n\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: activeWorkspaceId,\n        organizationId: activeOrganizationId,\n        projectId: activeProjectId,\n      })\n    ) {\n      // Clear-token-once-per-context guard: when the upstream gateway is\n      // flaky (504s during workspace token issuance) the surrounding state\n      // machine can oscillate between \"got token but invalid\" and \"clearing\n      // token\". The downstream re-issue path then loops. Only clear once per\n      // (org, ws, proj) tuple — a successful re-issue resets the ref via\n      // setWorkspaceToken landing a new token for the same context.\n      const ctxKey = `${activeOrganizationId ?? \"\"}|${activeWorkspaceId ?? \"\"}|${activeProjectId ?? \"\"}`;\n      if (lastClearedTokenContextRef.current !== ctxKey) {\n        lastClearedTokenContextRef.current = ctxKey;\n        store.setWorkspaceToken(null);\n      }\n    }\n  }, [activeOrganizationId, activeWorkspaceId, activeProjectId]);\n\n  // ===========================================================================\n  // Fetch Organizations (Global Gateway)\n  // ===========================================================================\n\n  const fetchOrganizations = useCallback(async (): Promise<Organization[]> => {\n    // Deduplicate: if a fetch is already in progress, return the same promise\n    if (fetchOrganizationsPromiseRef.current) {\n      return fetchOrganizationsPromiseRef.current;\n    }\n\n    const store = useAuthStore.getState();\n    const token = resolveAccessToken();\n\n    if (!token) {\n      // Not an error — user may not be authenticated yet (e.g., page load before login).\n      // The useEffect in Header.tsx will re-trigger when accessToken becomes available.\n      return [];\n    }\n\n    // If the token is clearly expired and no fresh fallback was found, skip the\n    // doomed request. The useEffect in Header.tsx re-triggers when the auth\n    // provider refreshes the token and updates accessToken in the store.\n    if (isTokenExpired(token)) {\n      return [];\n    }\n\n    store.setLoadingOrganizations(true);\n    setError(null);\n\n    // Store the promise for deduplication before starting\n    fetchOrganizationsPromiseRef.current = (async () => {\n      try {\n        const initialTargetOrgId =\n          activeOrganizationIdRef.current ?? store.currentOrganizationId;\n        let result: GraphQLFetchResult<\n          MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n        > = initialTargetOrgId\n          ? await (async () => {\n              const [organizationsResult, workspacesResult] = await Promise.all(\n                [\n                  graphqlFetch<MyOrganizationsResponse>({\n                    gateway: \"global\",\n                    query: MY_ORGANIZATIONS_QUERY,\n                    authToken: token,\n                    baseUrl: globalBaseUrl,\n                  }),\n                  graphqlFetch<WorkspacesByOrgResponse>({\n                    gateway: \"global\",\n                    query: WORKSPACES_BY_ORG_QUERY,\n                    authToken: token,\n                    baseUrl: globalBaseUrl,\n                  }),\n                ],\n              );\n\n              const data = organizationsResult.data?.myOrganizations\n                ? {\n                    myOrganizations: organizationsResult.data.myOrganizations,\n                    ...(workspacesResult.data?.workspaces\n                      ? { workspaces: workspacesResult.data.workspaces }\n                      : {}),\n                  }\n                : null;\n\n              return {\n                data,\n                errors: [\n                  ...(organizationsResult.errors ?? []),\n                  ...(workspacesResult.errors ?? []),\n                ],\n              };\n            })()\n          : await graphqlFetch<MyOrganizationsResponse>({\n              gateway: \"global\",\n              query: MY_ORGANIZATIONS_QUERY,\n              authToken: token,\n              baseUrl: globalBaseUrl,\n            });\n\n        // Self-heal stale-URL case: if the workspace side of the bootstrap\n        // fails because the URL points at an inaccessible org/workspace, retry\n        // with the organization-only query so the operator sees their actual\n        // orgs and the URL params get corrected on next render.\n        if (\n          initialTargetOrgId &&\n          result.errors?.length &&\n          result.errors.some(\n            (e) =>\n              e?.extensions?.code === \"FORBIDDEN\" ||\n              /not a member of this organization/i.test(e?.message ?? \"\") ||\n              // Public gateway often drops the underlying FORBIDDEN error\n              // and replaces it with the schema-level non-null violation\n              // (\"Cannot return null for non-nullable field Query.myOrganizations\").\n              // That happens when ANY field in the query throws — workspaces\n              // here — and data:null cascades up. Treat that pattern as a\n              // signal to retry without the workspaces filter.\n              /Cannot return null for non-nullable field Query\\.myOrganizations/i.test(\n                e?.message ?? \"\",\n              ),\n          )\n        ) {\n          // Fetch myOrganizations + ALL workspaces (no filter) so the\n          // downstream auto-pick logic still has a workspace list to seed\n          // context from. If we only refetched myOrganizations, the page\n          // would render but every workspace-scoped query would fail with\n          // \"Select a workspace…\".\n          result = await graphqlFetch<\n            MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n          >({\n            gateway: \"global\",\n            query: `\n              query ContextSwitcherRecover {\n                myOrganizations {\n                  total\n                  items { id name slug tenantId description logo website status type createdAt updatedAt }\n                }\n                workspaces: myWorkspaces {\n                  total\n                  items { id name slug tenantId organizationId type status region createdAt updatedAt }\n                }\n              }\n            `,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n        }\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (isAuthGraphQLError(result.errors)) {\n            // Auth errors are expected during token refresh cycles — throw AuthError\n            // so the outer catch can suppress console.error.\n            throw new AuthError(errorMessage);\n          }\n          if (store.workspaces.length === 0) {\n            console.error(\"Failed to fetch organizations:\", result.errors);\n          }\n          throw new Error(errorMessage);\n        }\n\n        let orgs: Organization[] = result.data?.myOrganizations?.items ?? [];\n\n        // Stale-context recovery: bootstrap query was filtered by\n        // initialTargetOrgId, so when the URL/persisted org doesn't belong to\n        // this user the response is empty. Re-fetch the unfiltered list of\n        // *all* orgs the user can access so the guard below can pick a real\n        // default. Skip the recovery when no target was set (already\n        // unfiltered) or when workspaces are already in the store (the\n        // existing fallback path covers that case).\n        if (\n          initialTargetOrgId &&\n          orgs.length === 0 &&\n          store.workspaces.length === 0\n        ) {\n          const recovery = await graphqlFetch<MyOrganizationsResponse>({\n            gateway: \"global\",\n            query: MY_ORGANIZATIONS_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          if (!recovery.errors?.length) {\n            orgs = recovery.data?.myOrganizations?.items ?? [];\n            // discard the filtered workspaces payload — it was for the\n            // ghost org and would only mislead the workspace selector below.\n            result = {\n              ...recovery,\n              data: {\n                myOrganizations: recovery.data?.myOrganizations ?? {\n                  items: [],\n                  total: 0,\n                },\n              },\n            };\n          } else {\n            // Surface the failure so a user reporting \"blank org list\" has\n            // something to grep for in the console. We still fall through —\n            // the guard below either picks from a fallback (workspaces in\n            // store) or no-ops, leaving the existing error path in place.\n            console.warn(\n              \"[ContextSwitcher] Stale-context recovery failed:\",\n              recovery.errors,\n            );\n          }\n        }\n\n        const fallbackOrganizations =\n          orgs.length === 0 && store.workspaces.length > 0\n            ? buildFallbackOrganizations(store.workspaces)\n            : [];\n        const effectiveOrganizations =\n          fallbackOrganizations.length > 0 ? fallbackOrganizations : orgs;\n\n        store.setOrganizations(effectiveOrganizations);\n\n        // Determine which organization to use for workspace fetching\n        let targetOrgId = initialTargetOrgId;\n\n        // Stale-context guard: if the persisted/URL org isn't in the user's\n        // accessible orgs, fall back to the first available one and clear the\n        // stale workspace/project so they get re-derived. Without this, URL\n        // params like ?org=<ghost-id> from a prior session leak into the new\n        // user's request headers and cause \"Authentication required\" /\n        // \"not a member\" errors at every subgraph.\n        //\n        // Check against `orgs` (freshly returned from the API in this same\n        // closure) rather than `effectiveOrganizations`, which can fall back\n        // to ids derived from `store.workspaces` — that fallback path could\n        // contain stale ghost orgIds and mask the guard.\n        const targetOrgIsAccessible =\n          targetOrgId && orgs.some((org) => org.id === targetOrgId);\n        if (targetOrgId && !targetOrgIsAccessible && orgs.length > 0) {\n          targetOrgId = orgs[0].id;\n          setActiveContext({\n            organizationId: targetOrgId,\n            workspaceId: null,\n            tenantId: null,\n            projectId: null,\n          });\n          store.setWorkspaces([]);\n          store.setProjects([]);\n          store.setCurrentWorkspaceId(null);\n          store.setCurrentProjectId(null);\n          store.setWorkspaceToken(null);\n        }\n\n        if (targetOrgId && targetOrgId !== store.currentOrganizationId) {\n          store.setCurrentOrganizationId(targetOrgId);\n        }\n\n        // Auto-select first organization if none is selected\n        if (effectiveOrganizations.length > 0 && !targetOrgId) {\n          store.setCurrentOrganizationId(effectiveOrganizations[0].id);\n          targetOrgId = effectiveOrganizations[0].id;\n        }\n\n        // Fetch workspaces for the selected/auto-selected org if:\n        // 1. We have a target org (either auto-selected or persisted from localStorage)\n        // 2. AND workspaces array is empty (not persisted, or cleared)\n        // This handles both initial login AND page refresh scenarios.\n        // Read from useAuthStore.getState() rather than the captured `store`\n        // snapshot so we see the post-guard cleared value when the org guard\n        // above fired (the local `store.workspaces` ref is stale after\n        // setWorkspaces([])).\n        if (targetOrgId && useAuthStore.getState().workspaces.length === 0) {\n          store.setLoadingWorkspaces(true);\n          try {\n            // myWorkspaces returns ALL workspaces the user is a member of\n            // across every org. Filter to the target org client-side here.\n            const bootstrappedWorkspaces =\n              initialTargetOrgId === targetOrgId\n                ? result.data?.workspaces?.items?.filter(\n                    (w) => w.organizationId === targetOrgId,\n                  )\n                : undefined;\n            const ws = bootstrappedWorkspaces\n              ? (bootstrappedWorkspaces as Workspace[])\n              : await graphqlFetch<WorkspacesByOrgResponse>({\n                  gateway: \"global\",\n                  query: WORKSPACES_BY_ORG_QUERY,\n                  authToken: token,\n                  baseUrl: globalBaseUrl,\n                }).then((wsResult) =>\n                  wsResult.errors?.length\n                    ? null\n                    : (wsResult.data?.workspaces?.items ?? []).filter(\n                        (w) => w.organizationId === targetOrgId,\n                      ),\n                );\n\n            if (ws) {\n              store.setWorkspaces(ws);\n              const persistedWorkspace = activeWorkspaceIdRef.current\n                ? ws.find(\n                    (workspace) =>\n                      workspace.id === activeWorkspaceIdRef.current,\n                  )\n                : null;\n\n              if (persistedWorkspace) {\n                store.setCurrentWorkspaceId(persistedWorkspace.id);\n              } else if (ws.length > 0) {\n                const nextActiveContext = {\n                  organizationId: targetOrgId,\n                  workspaceId: ws[0].id,\n                  tenantId: ws[0].tenantId,\n                  projectId: null,\n                };\n\n                if (activeWorkspaceIdRef.current) {\n                  // Stale-context guard: URL/persisted workspace ID is not in\n                  // the user's accessible workspaces for the active org. Fall\n                  // back to the first workspace and clear the stale URL param\n                  // so subsequent requests don't carry the ghost ID.\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  store.setWorkspaceToken(null);\n                  setActiveContext(nextActiveContext);\n                } else if (!store.currentWorkspaceId) {\n                  // Auto-select first workspace only if none is currently selected\n                  // (preserves selection from completeAuthFlow or persistence if applicable)\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  setActiveContext(nextActiveContext);\n                }\n              }\n            }\n          } catch {\n            // Non-critical — user can still select workspace manually\n          } finally {\n            store.setLoadingWorkspaces(false);\n          }\n        }\n\n        return effectiveOrganizations;\n      } catch (err) {\n        // Auth errors are expected during token refresh / page load cycles.\n        // Suppress from console.error — the useEffect will re-trigger when the\n        // auth provider refreshes the token.\n        if (err instanceof AuthError) {\n          return [];\n        }\n        const message =\n          err instanceof Error ? err.message : \"Failed to fetch organizations\";\n        if (store.workspaces.length === 0) {\n          console.error(\"Failed to fetch organizations:\", err);\n        }\n        setError(message);\n\n        if (store.workspaces.length > 0) {\n          const fallbackOrganizations = buildFallbackOrganizations(\n            store.workspaces,\n          );\n          if (fallbackOrganizations.length > 0) {\n            store.setOrganizations(fallbackOrganizations);\n            if (!store.currentOrganizationId) {\n              store.setCurrentOrganizationId(fallbackOrganizations[0].id);\n            }\n            return fallbackOrganizations;\n          }\n        }\n\n        return [];\n      } finally {\n        store.setLoadingOrganizations(false);\n        fetchOrganizationsPromiseRef.current = null;\n      }\n    })();\n\n    return fetchOrganizationsPromiseRef.current;\n  }, [globalBaseUrl, setActiveContext]);\n\n  // ===========================================================================\n  // Fetch Workspaces for Organization (Global Gateway)\n  // ===========================================================================\n\n  const fetchWorkspacesForOrg = useCallback(\n    async (organizationId: string): Promise<Workspace[]> => {\n      // Deduplicate: if a fetch for this org is already in progress, return the same promise\n      const existingPromise =\n        fetchWorkspacesPromisesRef.current.get(organizationId);\n      if (existingPromise) {\n        return existingPromise;\n      }\n\n      const store = useAuthStore.getState();\n      const token = resolveAccessToken();\n\n      if (!token || isTokenExpired(token)) {\n        return [];\n      }\n\n      store.setLoadingWorkspaces(true);\n      setError(null);\n\n      // Store the promise for deduplication before starting\n      const fetchPromise = (async () => {\n        try {\n          const result = await graphqlFetch<WorkspacesByOrgResponse>({\n            gateway: \"global\",\n            query: WORKSPACES_BY_ORG_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          // myWorkspaces returns workspaces across all the user's orgs;\n          // filter to the requested org before handing to downstream.\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === organizationId,\n            );\n          }\n\n          if (result.errors?.length) {\n            const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n            if (isAuthGraphQLError(result.errors)) {\n              throw new AuthError(errorMessage);\n            }\n            console.error(\"Failed to fetch workspaces:\", result.errors);\n            throw new Error(errorMessage);\n          }\n\n          // `myWorkspaces` returns every workspace the caller can see across\n          // all of their orgs/tenants. The store key is per-org (selecting\n          // org X then opening the dropdown should only show X's workspaces),\n          // so we filter down to the requested org here. The dropdown filter\n          // in ContextSwitcher.tsx is a defence-in-depth — without this\n          // narrowing the store would briefly hold the caller's other-org\n          // workspaces and the auto-pick logic (lines below) might select\n          // one of them as the default.\n          const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n          const ws = allWs.filter((w) => w.organizationId === organizationId);\n          store.setWorkspaces(ws);\n          return ws;\n        } catch (err) {\n          if (err instanceof AuthError) {\n            return [];\n          }\n          const message =\n            err instanceof Error ? err.message : \"Failed to fetch workspaces\";\n          console.error(\"Failed to fetch workspaces:\", err);\n          setError(message);\n          return [];\n        } finally {\n          store.setLoadingWorkspaces(false);\n          fetchWorkspacesPromisesRef.current.delete(organizationId);\n        }\n      })();\n\n      fetchWorkspacesPromisesRef.current.set(organizationId, fetchPromise);\n      return fetchPromise;\n    },\n    [globalBaseUrl],\n  );\n\n  // ===========================================================================\n  // Issue Workspace Token (Workspace Gateway - wspace-auth-svc)\n  // ===========================================================================\n\n  const issueWorkspaceToken = useCallback(\n    async (\n      organizationId: string,\n      workspaceId?: string,\n      projectId?: string | null,\n    ): Promise<{\n      success: boolean;\n      token?: string;\n      resolvedWorkspaceId?: string;\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n      const authToken = resolveAccessToken();\n\n      if (!authToken || isTokenExpired(authToken)) {\n        return { success: false, error: \"No valid access token available\" };\n      }\n\n      setError(null);\n\n      try {\n        const result = await graphqlFetch<{\n          issueWorkspaceToken: IssueWorkspaceTokenResult;\n        }>({\n          gateway: \"workspace\",\n          query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n          variables: {\n            input: {\n              organizationId,\n              ...(workspaceId && { workspaceId }),\n              ...(projectId && { projectId }),\n            },\n          },\n          authToken,\n          baseUrl: workspaceBaseUrl,\n        });\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (!isAuthGraphQLError(result.errors)) {\n            console.error(\"Failed to issue workspace token:\", result.errors);\n          }\n          return { success: false, error: errorMessage };\n        }\n\n        const tokenResult = result.data?.issueWorkspaceToken;\n\n        if (tokenResult?.success && tokenResult.token) {\n          const resolvedWsId = tokenResult.workspaceId || workspaceId;\n          if (resolvedWsId) {\n            store.setCurrentWorkspaceId(resolvedWsId);\n          }\n          store.setWorkspaceToken(tokenResult.token);\n          return {\n            success: true,\n            token: tokenResult.token,\n            resolvedWorkspaceId: resolvedWsId || undefined,\n          };\n        }\n\n        return {\n          success: false,\n          error:\n            tokenResult?.error?.message ?? \"Failed to issue workspace token\",\n        };\n      } catch (err) {\n        const message =\n          err instanceof Error\n            ? err.message\n            : \"Failed to issue workspace token\";\n        console.error(\"Failed to issue workspace token:\", err);\n        setError(message);\n        return { success: false, error: message };\n      }\n    },\n    [workspaceBaseUrl],\n  );\n\n  // ===========================================================================\n  // Fetch Projects (Workspace Gateway - requires workspace token)\n  // ===========================================================================\n\n  const fetchProjects = useCallback(async (): Promise<Project[]> => {\n    const store = useAuthStore.getState();\n    const authToken = resolveAccessToken();\n    const wsToken = store.workspaceToken;\n    const workspaceId = store.currentWorkspaceId;\n\n    if (!authToken || isTokenExpired(authToken)) {\n      return [];\n    }\n\n    if (!wsToken) {\n      return [];\n    }\n\n    if (!workspaceId) {\n      return [];\n    }\n\n    store.setLoadingProjects(true);\n    setError(null);\n\n    try {\n      const result = await graphqlFetch<ProjectsResponse>({\n        gateway: \"workspace\",\n        query: PROJECTS_QUERY,\n        authToken,\n        workspaceToken: wsToken,\n        baseUrl: workspaceBaseUrl,\n      });\n\n      if (result.errors?.length) {\n        const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n        if (isAuthGraphQLError(result.errors)) {\n          throw new AuthError(errorMessage);\n        }\n        console.error(\"Failed to fetch projects:\", result.errors);\n        throw new Error(errorMessage);\n      }\n\n      const projs: Project[] = result.data?.projects?.items ?? [];\n      store.setProjects(projs);\n      return projs;\n    } catch (err) {\n      if (err instanceof AuthError) {\n        return [];\n      }\n      const message =\n        err instanceof Error ? err.message : \"Failed to fetch projects\";\n      console.error(\"Failed to fetch projects:\", err);\n      setError(message);\n      return [];\n    } finally {\n      store.setLoadingProjects(false);\n    }\n  }, [workspaceBaseUrl]);\n\n  // ===========================================================================\n  // High-Level Selection Actions\n  // ===========================================================================\n\n  const selectOrganization = useCallback(\n    async (org: Organization): Promise<Workspace[]> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentWorkspaceId(null);\n      store.setWorkspaceToken(null);\n      store.setProjects([]);\n      store.setCurrentProjectId(null);\n      store.setCurrentOrganizationId(org.id);\n\n      const ws = await fetchWorkspacesForOrg(org.id);\n      return ws;\n    },\n    [fetchWorkspacesForOrg],\n  );\n\n  const selectWorkspace = useCallback(\n    async (\n      workspace: Workspace,\n    ): Promise<{\n      success: boolean;\n      projects?: Project[];\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentProjectId(null);\n      store.setProjects([]);\n\n      if (!workspace.organizationId) {\n        console.error(\"Workspace missing organizationId:\", workspace);\n        return {\n          success: false,\n          error: \"Workspace is missing organizationId\",\n        };\n      }\n\n      const tokenResult = await issueWorkspaceToken(\n        workspace.organizationId,\n        workspace.id,\n      );\n\n      if (!tokenResult.success) {\n        return { success: false, error: tokenResult.error };\n      }\n\n      let projs = await fetchProjects();\n      if (projs.length === 0) {\n        const authToken = resolveAccessToken();\n        const workspaceToken = useAuthStore.getState().workspaceToken;\n        if (authToken && workspaceToken) {\n          const defaultProject = await createDefaultProject({\n            authToken,\n            workspaceBaseUrl,\n            workspaceToken,\n          });\n          if (defaultProject) {\n            projs = [defaultProject];\n            store.setProjects(projs);\n          }\n        }\n      }\n\n      if (projs.length > 0) {\n        store.setCurrentProjectId(projs[0]!.id);\n      }\n\n      return { success: true, projects: projs };\n    },\n    [issueWorkspaceToken, fetchProjects, workspaceBaseUrl],\n  );\n\n  const selectProject = useCallback((project: Project): void => {\n    const store = useAuthStore.getState();\n    store.setCurrentProjectId(project.id);\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: store.currentWorkspaceId,\n        organizationId: store.currentOrganizationId,\n        projectId: project.id,\n      })\n    ) {\n      store.setWorkspaceToken(null);\n    }\n  }, []);\n\n  // ===========================================================================\n  // Cross-MFE refresh: keep the switcher lists current when another MFE mutates\n  // org/workspace/project entities. microfe-workspaces emits these domain events\n  // on the shared event bus (e.g. on project rename); without this the switcher\n  // keeps showing the stale cached name until a full page reload.\n  // ===========================================================================\n\n  useEffect(() => {\n    let cancelled = false;\n\n    // Coalesce a refetch into a single in-flight run with one trailing re-run,\n    // so a burst of events collapses to one request (+ one trailing) instead of\n    // fanning out or being swallowed by a downstream per-key dedupe. The flag is\n    // cleared on cleanup so nothing fires after the subscription is torn down.\n    const makeCoalescedRefetch = (run: () => Promise<unknown>) => {\n      let running = false;\n      let queued = false;\n      const trigger = () => {\n        if (cancelled) return;\n        if (running) {\n          queued = true;\n          return;\n        }\n        running = true;\n        void run().finally(() => {\n          running = false;\n          if (!cancelled && queued) {\n            queued = false;\n            trigger();\n          }\n        });\n      };\n      return trigger;\n    };\n\n    const refreshProjects = makeCoalescedRefetch(() => fetchProjects());\n    const refreshWorkspaces = makeCoalescedRefetch(() => {\n      const orgId = useAuthStore.getState().currentOrganizationId;\n      return orgId ? fetchWorkspacesForOrg(orgId) : Promise.resolve();\n    });\n\n    // Custom domain events (not in BurdenoffEventName) flow through `onAny`.\n    const unsubscribe = eventBus.onAny((event) => {\n      // Custom event names aren't in the BurdenoffEventName union; compare as string.\n      const eventName: string = event.name;\n\n      if (PROJECT_REFRESH_EVENTS.has(eventName)) {\n        const eventWorkspaceId = readEventWorkspaceId(event.payload);\n        const { currentWorkspaceId } = useAuthStore.getState();\n        // Only refetch when the event targets the workspace currently in\n        // context (events without a workspace id are treated as relevant).\n        if (\n          eventWorkspaceId &&\n          currentWorkspaceId &&\n          eventWorkspaceId !== currentWorkspaceId\n        ) {\n          return;\n        }\n        // Refetch only — a deleted project simply drops out of the list, and\n        // `currentProject` resolves to undefined for it. Clearing the selection\n        // here would race ActiveContext / the project sync effect (the real\n        // source of truth), so we leave selection reconciliation to them.\n        refreshProjects();\n        return;\n      }\n\n      if (WORKSPACE_REFRESH_EVENTS.has(eventName)) {\n        refreshWorkspaces();\n      }\n    });\n\n    return () => {\n      cancelled = true;\n      unsubscribe();\n    };\n  }, [eventBus, fetchProjects, fetchWorkspacesForOrg]);\n\n  // ===========================================================================\n  // Get Current Items\n  // ===========================================================================\n\n  const currentOrganization = organizations.find(\n    (org) => org.id === currentOrganizationId,\n  );\n  const currentWorkspace = workspaces.find(\n    (ws) => ws.id === currentWorkspaceId,\n  );\n  const currentProject = projects.find((proj) => proj.id === currentProjectId);\n\n  // ===========================================================================\n  // Return Hook API\n  // ===========================================================================\n\n  return {\n    organizations,\n    workspaces,\n    projects,\n\n    currentOrganizationId,\n    currentWorkspaceId,\n    currentProjectId,\n\n    currentOrganization,\n    currentWorkspace,\n    currentProject,\n\n    workspaceToken,\n\n    isLoadingOrganizations,\n    isLoadingWorkspaces,\n    isLoadingProjects,\n    isLoading:\n      isLoadingOrganizations || isLoadingWorkspaces || isLoadingProjects,\n\n    error,\n\n    fetchOrganizations,\n    fetchWorkspacesForOrg,\n    issueWorkspaceToken,\n    fetchProjects,\n\n    selectOrganization,\n    selectWorkspace,\n    selectProject,\n  };\n}\n\n/**\n * Hook to reactively ensure workspaces are synced with the current organization.\n *\n * This handles edge cases where the organization changes but workspaces\n * from a different org are still in the store (e.g., stale data, race conditions).\n *\n * Usage:\n * ```tsx\n * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useWorkspaceSyncEffect(); // Ensures workspaces stay in sync\n *   // ...\n * }\n * ```\n */\nexport function useWorkspaceSyncEffect(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const disableWorkspaceSync = options?.disableWorkspaceSync ?? false;\n\n  useEffect(() => {\n    if (disableWorkspaceSync) return;\n    // Skip if no org selected, no token, or already loading\n    if (!currentOrganizationId || !accessToken || isLoadingWorkspaces) return;\n\n    // Check if any workspace matches the current org\n    const hasMatchingWorkspaces = workspaces.some(\n      (ws) => ws.organizationId === currentOrganizationId,\n    );\n\n    // If workspaces exist but none match current org, we need to refetch\n    // This can happen in edge cases with stale data or race conditions\n    if (workspaces.length > 0 && !hasMatchingWorkspaces) {\n      const store = useAuthStore.getState();\n      store.setLoadingWorkspaces(true);\n\n      // Inline fetch to avoid circular dependency with useContextSwitcherData\n      graphqlFetch<WorkspacesByOrgResponse>({\n        gateway: \"global\",\n        query: WORKSPACES_BY_ORG_QUERY,\n        authToken: accessToken,\n        baseUrl: globalBaseUrl,\n      })\n        .then((result) => {\n          // myWorkspaces returns ALL my workspaces; filter to current org\n          // client-side (the old server-side filter no longer exists).\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n          }\n          if (!result.errors?.length) {\n            const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n            // Same per-org narrowing as fetchWorkspacesForOrg — see the\n            // comment there for why we don't just dump the full caller-\n            // visible list into the store.\n            const ws = allWs.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n            store.setWorkspaces(ws);\n          }\n        })\n        .catch(() => {\n          // Silent fail - user can manually refresh or select org again\n        })\n        .finally(() => {\n          store.setLoadingWorkspaces(false);\n        });\n    }\n  }, [\n    currentOrganizationId,\n    workspaces,\n    accessToken,\n    isLoadingWorkspaces,\n    globalBaseUrl,\n    disableWorkspaceSync,\n  ]);\n}\n\n/**\n * Hook to reactively ensure projects are loaded when a workspace is selected.\n *\n * This handles the case where a workspace is auto-selected (from URL/localStorage)\n * but projects haven't been fetched yet. It will:\n * 1. Issue a workspace token if not present\n * 2. Fetch projects for the selected workspace\n *\n * Usage:\n * ```tsx\n * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useProjectSyncEffect(); // Ensures projects are loaded for selected workspace\n *   // ...\n * }\n * ```\n */\nexport function useProjectSyncEffect(options?: UseContextSwitcherDataOptions) {\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n  const disableProjectSync = options?.disableProjectSync ?? false;\n  const skipProjectFetch = options?.skipProjectFetch ?? false;\n\n  // Use refs to prevent the infinite loop caused by including loading/failure\n  // state in the dependency array. Without these, the cycle is:\n  //   setLoadingProjects(true) -> dep change -> effect re-runs (guarded) ->\n  //   async completes -> setLoadingProjects(false) -> dep change ->\n  //   effect re-runs -> starts again -> INFINITE LOOP\n  const syncInProgressRef = useRef(false);\n  // Pending retry timer per workspace, so transient failures (e.g. RBAC lag\n  // right after workspace creation) get an automatic second chance even if no\n  // dependency change re-triggers the effect.\n  const retryTimerRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(\n    new Map(),\n  );\n  // Per-workspace failure tracker — caps retry attempts when project bootstrap\n  // (token issue, list, or default-create) fails. Without this, a persistent\n  // backend failure (e.g. cross-layer workspace not yet synced) causes the\n  // effect to re-fire every render: list returns empty → create-default fails\n  // → setProjects([]) → new array reference → effect re-runs → loop.\n  //\n  // We track both count AND lastFailureAt so we can honour a \"cool-down\" window:\n  // after PROJECT_SYNC_FAILURE_COOLDOWN_MS has elapsed since the last failure,\n  // the counter is treated as cleared so transient backend hiccups (e.g. RBAC\n  // role propagation lag right after signup) don't permanently lock a workspace\n  // out of the context dropdown — the original cause of marqueue §729.\n  const projectSyncFailuresRef = useRef<\n    Map<string, { count: number; lastFailureAt: number }>\n  >(new Map());\n  const PROJECT_SYNC_MAX_FAILURES = 8;\n  const PROJECT_SYNC_FAILURE_COOLDOWN_MS = 30_000;\n  useEffect(() => {\n    if (disableProjectSync) return;\n    // Skip if no workspace selected or no access token\n    if (!currentWorkspaceId || !accessToken) return;\n\n    // Skip if a sync is already in progress (ref-based guard avoids dep loop)\n    if (syncInProgressRef.current) return;\n\n    // Stop retrying once this workspace has failed too many times in a row.\n    // Counter is reset on success, on workspace switch (different key), by\n    // an explicit user retry path (e.g. selectWorkspace), or after the\n    // cool-down window has elapsed since the last failure (so transient\n    // backend issues don't permanently wedge the dropdown).\n    const failureEntry = projectSyncFailuresRef.current.get(currentWorkspaceId);\n    if (\n      failureEntry &&\n      failureEntry.count >= PROJECT_SYNC_MAX_FAILURES &&\n      Date.now() - failureEntry.lastFailureAt < PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      return;\n    }\n    if (\n      failureEntry &&\n      Date.now() - failureEntry.lastFailureAt >=\n        PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      // Cool-down elapsed — clear the counter so we get a fresh budget.\n      projectSyncFailuresRef.current.delete(currentWorkspaceId);\n    }\n\n    // Resolve organizationId: prefer the workspace object (if loaded), fall\n    // back to the persisted currentOrganizationId.  The workspaces array is\n    // NOT persisted by zustand, so on page reload it is empty until\n    // fetchOrganizations() completes.  Using the persisted org ID lets us\n    // issue the workspace token immediately instead of waiting.\n    const currentWorkspace = workspaces.find(\n      (ws) => ws.id === currentWorkspaceId,\n    );\n\n    // Guard: transient (newOrg, oldWs) divergence during org switches — token issuance always fails.\n    if (\n      currentWorkspace &&\n      currentOrganizationId &&\n      currentWorkspace.organizationId !== currentOrganizationId\n    ) {\n      return;\n    }\n\n    const organizationId =\n      currentWorkspace?.organizationId ?? currentOrganizationId;\n    if (!organizationId) return;\n\n    const store = useAuthStore.getState();\n\n    // If we don't have a workspace token or it's expired, issue one first\n    const needsToken =\n      !workspaceToken ||\n      isTokenExpired(workspaceToken) ||\n      !isWorkspaceTokenValidForContext(workspaceToken, {\n        workspaceId: currentWorkspaceId,\n        organizationId: currentOrganizationId,\n        projectId: currentProjectId,\n      });\n\n    // Skip if projects are already loaded for this workspace AND token is valid\n    const hasProjectsForWorkspace = projects.some(\n      (p) => p.workspaceId === currentWorkspaceId,\n    );\n    if (hasProjectsForWorkspace && !needsToken) {\n      if (!store.currentProjectId) {\n        const firstProject = projects.find(\n          (project) => project.workspaceId === currentWorkspaceId,\n        );\n        if (firstProject) {\n          store.setCurrentProjectId(firstProject.id);\n        }\n      }\n      return;\n    }\n\n    const syncProjects = async () => {\n      syncInProgressRef.current = true;\n      store.setLoadingProjects(true);\n      let succeeded = false;\n\n      try {\n        let wsToken = workspaceToken;\n\n        // Issue workspace token if needed\n        if (needsToken) {\n          const tokenResult = await graphqlFetch<{\n            issueWorkspaceToken: IssueWorkspaceTokenResult;\n          }>({\n            gateway: \"workspace\",\n            query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n            variables: {\n              input: {\n                organizationId,\n                workspaceId: currentWorkspaceId,\n                ...(currentProjectId ? { projectId: currentProjectId } : {}),\n              },\n            },\n            authToken: accessToken,\n            baseUrl: workspaceBaseUrl,\n          });\n\n          if (\n            tokenResult.data?.issueWorkspaceToken?.success &&\n            tokenResult.data.issueWorkspaceToken.token\n          ) {\n            wsToken = tokenResult.data.issueWorkspaceToken.token;\n            store.setWorkspaceToken(wsToken);\n          } else {\n            return;\n          }\n        }\n\n        // Fetch projects (skip if already loaded or token-only sync requested)\n        if (wsToken && !hasProjectsForWorkspace && !skipProjectFetch) {\n          const projectsResult = await graphqlFetch<ProjectsResponse>({\n            gateway: \"workspace\",\n            query: PROJECTS_QUERY,\n            authToken: accessToken,\n            workspaceToken: wsToken,\n            baseUrl: workspaceBaseUrl,\n          });\n\n          if (projectsResult.errors?.length) {\n            return;\n          }\n\n          let projs: Project[] = projectsResult.data?.projects?.items ?? [];\n          if (projs.length === 0) {\n            const defaultProject = await createDefaultProject({\n              authToken: accessToken,\n              workspaceBaseUrl,\n              workspaceToken: wsToken,\n            });\n            if (defaultProject) {\n              projs = [defaultProject];\n            } else {\n              // Default-project creation failed (e.g. workspace not yet\n              // propagated to the workspace layer). Do NOT write [] back —\n              // that would change the projects reference and re-trigger\n              // this effect on the next render.\n              return;\n            }\n          }\n\n          store.setProjects(projs);\n\n          // Auto-select first project if none selected and projects exist\n          if (projs.length > 0 && !store.currentProjectId) {\n            store.setCurrentProjectId(projs[0].id);\n          }\n        }\n\n        succeeded = true;\n      } catch {\n        // A later auth/context update should be able to retry.\n      } finally {\n        store.setLoadingProjects(false);\n        syncInProgressRef.current = false;\n        const failures = projectSyncFailuresRef.current;\n        if (succeeded) {\n          failures.delete(currentWorkspaceId);\n          const pending = retryTimerRef.current.get(currentWorkspaceId);\n          if (pending) {\n            clearTimeout(pending);\n            retryTimerRef.current.delete(currentWorkspaceId);\n          }\n        } else {\n          const existing = failures.get(currentWorkspaceId);\n          const nextCount = (existing?.count ?? 0) + 1;\n          failures.set(currentWorkspaceId, {\n            count: nextCount,\n            lastFailureAt: Date.now(),\n          });\n          // Schedule a backoff retry for transient backend lag (e.g. RBAC\n          // role propagation right after signup → first projects() call hits\n          // permission-denied). Without this, the effect would only re-run on\n          // dep change and the user would be stuck staring at an empty\n          // project dropdown until something else triggered a re-render.\n          if (nextCount < PROJECT_SYNC_MAX_FAILURES) {\n            const existingTimer = retryTimerRef.current.get(currentWorkspaceId);\n            if (existingTimer) clearTimeout(existingTimer);\n            const backoffMs = Math.min(1000 * 2 ** (nextCount - 1), 8000);\n            const timer = setTimeout(() => {\n              retryTimerRef.current.delete(currentWorkspaceId);\n              // Only re-run if the workspace context is still the same and\n              // a project hasn't been loaded for it in the meantime.\n              const latest = useAuthStore.getState();\n              if (\n                latest.currentWorkspaceId === currentWorkspaceId &&\n                !latest.projects.some(\n                  (p) => p.workspaceId === currentWorkspaceId,\n                ) &&\n                !syncInProgressRef.current\n              ) {\n                // Bump a render by clearing then resetting workspaceToken\n                // when valid, OR by re-issuing projects fetch directly. The\n                // simplest robust trigger is to clear the in-progress guard\n                // and call syncProjects() again with current closure values.\n                void syncProjects();\n              }\n            }, backoffMs);\n            retryTimerRef.current.set(currentWorkspaceId, timer);\n          }\n        }\n      }\n    };\n\n    syncProjects();\n  }, [\n    currentWorkspaceId,\n    currentOrganizationId,\n    workspaces,\n    projects,\n    currentProjectId,\n    workspaceToken,\n    accessToken,\n    workspaceBaseUrl,\n    disableProjectSync,\n    skipProjectFetch,\n  ]);\n\n  // Cleanup any pending retry timers on unmount so we don't leak stray\n  // setTimeout callbacks running against stale closures.\n  useEffect(() => {\n    const timers = retryTimerRef.current;\n    return () => {\n      timers.forEach((timer) => clearTimeout(timer));\n      timers.clear();\n    };\n  }, []);\n}\n// hmr-bust-1778064429\n"],"mappings":";;;;;;;AAqFA,IAAM,IAAyB,2RAoCzB,IAA0B,oSAoB1B,IAAiC,6SA0BjC,IAAiB,uPAkBjB,IAAkC;AAexC,eAAe,EAAqB,EAClC,cACA,qBACA,qBAK0B;CAC1B,IAAM,IAAS,MAAM,EAAoC;EACvD,SAAS;EACT,OAAO;EACP,WAAW,EACT,OAAO,EACL,MAAM,mBACP,EACF;EACD;EACA;EACA,SAAS;EACV,CAAC;AAOF,QALI,EAAO,QAAQ,UACjB,QAAQ,KAAK,qCAAqC,EAAO,OAAO,EACzD,QAGF,EAAO,MAAM,iBAAiB;;AAWvC,SAAS,EAAe,GAAe,IAAW,KAAiB;AACjE,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AAErD,SADK,EAAQ,MACN,EAAQ,MAAM,MAAO,KAAK,KAAK,GAAG,IADhB;SAEnB;AACN,SAAO;;;AAIX,SAAS,EAAyB,GAKzB;AACP,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AACrD,SAAO;GACL,aACE,OAAO,EAAQ,eAAgB,WAC3B,EAAQ,cACR,KAAA;GACN,gBACE,OAAO,EAAQ,kBAAmB,WAC9B,EAAQ,iBACR,KAAA;GACN,WACE,OAAO,EAAQ,aAAc,WAAW,EAAQ,YAAY,KAAA;GAC9D,KAAK,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,KAAA;GACtD;SACK;AACN,SAAO;;;AAIX,SAAS,EACP,GACA,GAKiB;AACjB,KAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO;CAGT,IAAM,IAAU,EAAyB,EAAM;AAoB/C,QAJA,EAfI,CAAC,KAID,EAAS,eAAe,EAAQ,gBAAgB,EAAS,eAK3D,EAAS,kBACT,EAAQ,mBAAmB,EAAS,kBAKlC,EAAS,aAAa,EAAQ,cAAc,EAAS;;AAa3D,IAAM,IAAN,cAAwB,MAAM;CAC5B,YAAY,GAAiB;AAE3B,EADA,MAAM,EAAQ,EACd,KAAK,OAAO;;;AAOhB,SAAS,EACP,GACS;AACT,QAAO,EAAO,MACX,MACC,EAAE,YAAY,SAAS,qBACvB,EAAE,SAAS,aAAa,CAAC,SAAS,eAAe,IACjD,EAAE,SAAS,aAAa,CAAC,SAAS,oBAAoB,CACzD;;AASH,SAAS,IAAoC;CAC3C,IAAM,IAAa,EAAa,UAAU,CAAC;AAG3C,KAAI,KAAc,CAAC,EAAe,EAAW,CAC3C,QAAO;CAIT,IAAM,IAAe,GAAoB;AAQzC,QAPI,KAAgB,CAAC,EAAe,EAAa,GACxC,IAMF;;AAGT,SAAS,EAA2B,GAAyC;AAS3E,QARqB,MAAM,KACzB,IAAI,IACF,EAAW,SAAS,MAClB,EAAU,iBAAiB,CAAC,EAAU,eAAe,GAAG,EAAE,CAC3D,CACF,CACF,CAEmB,KAAK,GAAgB,OAAW;EAClD,IAAI;EACJ,MACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,QAAQ,gBAAgB,IAAQ;EACrC,MAAM;EACN,UACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,YAAY;EAClB,EAAE;;AAuBL,IAAM,IAAyB,IAAI,IAAY;CAC7C;CACA;CACA;CACA;CACA;CACD,CAAC,EACI,IAA2B,IAAI,IAAY;CAC/C;CACA;CACA;CACA;CACA;CACD,CAAC;AAKF,SAAS,EAAqB,GAAsC;AAClE,KAAI,KAAW,OAAO,KAAY,YAAY,iBAAiB,GAAS;EACtE,IAAM,IAAS,EAAsC;AACrD,SAAO,OAAO,KAAU,WAAW,IAAQ,KAAA;;;AAK/C,SAAgB,EACd,GACA;CACA,IAAM,EACJ,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,YAAY,MACV,GAAkB,EAEhB,IAAW,GAAa,EAGxB,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAyB,GAC5B,MAAU,EAAM,uBAClB,EAEK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,IAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAsB,GACzB,MAAU,EAAM,oBAClB,EAEK,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAoB,GAAc,MAAU,EAAM,kBAAkB,EAGpE,CAAC,IAAO,KAAY,EAAwB,KAAK,EAGjD,IAA+B,EACnC,KACD,EACK,IAA6B,kBACjC,IAAI,KAAK,CACV,EAKK,IAAuB,EAAO,EAAkB,EAChD,IAA0B,EAAO,EAAqB;AAC5D,SAAgB;AAEd,EADA,EAAqB,UAAU,GAC/B,EAAwB,UAAU;GAClC;CAEF,IAAM,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IACJ,GAAS,oBAAoB,EAAiB,kBAS1C,IAAsB,EAAsB,KAAK,EACjD,IAA4B,EAAsB,KAAK,EACvD,IAA0B,EAAsB,KAAK,EACrD,IAA6B,EAAsB,KAAK;AAE9D,SAAgB;EACd,IAAM,IAAQ,EAAa,UAAU;AA8CrC,MA3CE,KACA,MAAyB,EAAM,yBAC/B,MAAyB,EAAoB,YAE7C,EAAoB,UAAU,GAC9B,EAAM,yBAAyB,EAAqB,EAElD,EAAM,WAAW,SAAS,KAC1B,CAAC,EAAM,WAAW,MACf,MAAc,EAAU,mBAAmB,EAC7C,IAED,EAAM,cAAc,EAAE,CAAC,GAKzB,KACA,MAAsB,EAAM,sBAC5B,MAAsB,EAA0B,YAEhD,EAA0B,UAAU,GACpC,EAAM,sBAAsB,EAAkB,EAE5C,EAAM,SAAS,SAAS,KACxB,CAAC,EAAM,SAAS,MACb,MAAY,EAAQ,gBAAgB,EACtC,KAED,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,IAKjC,KACA,MAAoB,EAAM,oBAC1B,MAAoB,EAAwB,YAE5C,EAAwB,UAAU,GAClC,EAAM,oBAAoB,EAAgB,GAI1C,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EACF;GAOA,IAAM,IAAS,GAAG,KAAwB,GAAG,GAAG,KAAqB,GAAG,GAAG,KAAmB;AAC9F,GAAI,EAA2B,YAAY,MACzC,EAA2B,UAAU,GACrC,EAAM,kBAAkB,KAAK;;IAGhC;EAAC;EAAsB;EAAmB;EAAgB,CAAC;CAM9D,IAAM,KAAqB,EAAY,YAAqC;AAE1E,MAAI,EAA6B,QAC/B,QAAO,EAA6B;EAGtC,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AA+UlC,SA7UI,CAAC,KASD,EAAe,EAAM,GAChB,EAAE,IAGX,EAAM,wBAAwB,GAAK,EACnC,EAAS,KAAK,EAGd,EAA6B,WAAW,YAAY;AAClD,OAAI;IACF,IAAM,IACJ,EAAwB,WAAW,EAAM,uBACvC,IAEA,IACA,OAAO,YAAY;KACjB,IAAM,CAAC,GAAqB,KAAoB,MAAM,QAAQ,IAC5D,CACE,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC,EACF,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC,CACH,CACF;AAWD,YAAO;MACL,MAVW,EAAoB,MAAM,kBACnC;OACE,iBAAiB,EAAoB,KAAK;OAC1C,GAAI,EAAiB,MAAM,aACvB,EAAE,YAAY,EAAiB,KAAK,YAAY,GAChD,EAAE;OACP,GACD;MAIF,QAAQ,CACN,GAAI,EAAoB,UAAU,EAAE,EACpC,GAAI,EAAiB,UAAU,EAAE,CAClC;MACF;QACC,GACJ,MAAM,EAAsC;KAC1C,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;KACV,CAAC;AAkDN,QA3CE,KACA,EAAO,QAAQ,UACf,EAAO,OAAO,MACX,MACC,GAAG,YAAY,SAAS,eACxB,qCAAqC,KAAK,GAAG,WAAW,GAAG,IAO3D,oEAAoE,KAClE,GAAG,WAAW,GACf,CACJ,KAOD,IAAS,MAAM,EAEb;KACA,SAAS;KACT,OAAO;KAYP,WAAW;KACX,SAAS;KACV,CAAC,GAGA,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AASlD,WARI,EAAmB,EAAO,OAAO,GAG7B,IAAI,EAAU,EAAa,IAE/B,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAO,OAAO,EAEtD,MAAM,EAAa;;IAG/B,IAAI,IAAuB,EAAO,MAAM,iBAAiB,SAAS,EAAE;AASpE,QACE,KACA,EAAK,WAAW,KAChB,EAAM,WAAW,WAAW,GAC5B;KACA,IAAM,IAAW,MAAM,EAAsC;MAC3D,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC;AACF,KAAK,EAAS,QAAQ,SAkBpB,QAAQ,KACN,oDACA,EAAS,OACV,IApBD,IAAO,EAAS,MAAM,iBAAiB,SAAS,EAAE,EAGlD,IAAS;MACP,GAAG;MACH,MAAM,EACJ,iBAAiB,EAAS,MAAM,mBAAmB;OACjD,OAAO,EAAE;OACT,OAAO;OACR,EACF;MACF;;IAaL,IAAM,IACJ,EAAK,WAAW,KAAK,EAAM,WAAW,SAAS,IAC3C,EAA2B,EAAM,WAAW,GAC5C,EAAE,EACF,IACJ,EAAsB,SAAS,IAAI,IAAwB;AAE7D,MAAM,iBAAiB,EAAuB;IAG9C,IAAI,IAAc,GAaZ,IACJ,KAAe,EAAK,MAAM,MAAQ,EAAI,OAAO,EAAY;AAkC3D,QAjCI,KAAe,CAAC,KAAyB,EAAK,SAAS,MACzD,IAAc,EAAK,GAAG,IACtB,EAAiB;KACf,gBAAgB;KAChB,aAAa;KACb,UAAU;KACV,WAAW;KACZ,CAAC,EACF,EAAM,cAAc,EAAE,CAAC,EACvB,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,sBAAsB,KAAK,EACjC,EAAM,oBAAoB,KAAK,EAC/B,EAAM,kBAAkB,KAAK,GAG3B,KAAe,MAAgB,EAAM,yBACvC,EAAM,yBAAyB,EAAY,EAIzC,EAAuB,SAAS,KAAK,CAAC,MACxC,EAAM,yBAAyB,EAAuB,GAAG,GAAG,EAC5D,IAAc,EAAuB,GAAG,KAWtC,KAAe,EAAa,UAAU,CAAC,WAAW,WAAW,GAAG;AAClE,OAAM,qBAAqB,GAAK;AAChC,SAAI;MAGF,IAMM,KALJ,MAAuB,IACnB,EAAO,MAAM,YAAY,OAAO,QAC7B,MAAM,EAAE,mBAAmB,EAC7B,GACD,KAAA,MAGF,MAAM,EAAsC;OAC1C,SAAS;OACT,OAAO;OACP,WAAW;OACX,SAAS;OACV,CAAC,CAAC,MAAM,MACP,EAAS,QAAQ,SACb,QACC,EAAS,MAAM,YAAY,SAAS,EAAE,EAAE,QACtC,MAAM,EAAE,mBAAmB,EAC7B,CACN;AAEL,UAAI,GAAI;AACN,SAAM,cAAc,EAAG;OACvB,IAAM,IAAqB,EAAqB,UAC5C,EAAG,MACA,MACC,EAAU,OAAO,EAAqB,QACzC,GACD;AAEJ,WAAI,EACF,GAAM,sBAAsB,EAAmB,GAAG;gBACzC,EAAG,SAAS,GAAG;QACxB,IAAM,IAAoB;SACxB,gBAAgB;SAChB,aAAa,EAAG,GAAG;SACnB,UAAU,EAAG,GAAG;SAChB,WAAW;SACZ;AAED,QAAI,EAAqB,WAKvB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAM,kBAAkB,KAAK,EAC7B,EAAiB,EAAkB,IACzB,EAAM,uBAGhB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAiB,EAAkB;;;aAInC,WAEE;AACR,QAAM,qBAAqB,GAAM;;;AAIrC,WAAO;YACA,GAAK;AAIZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAMvC,QALI,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAI,EAEtD,EAAS,EAAQ,EAEb,EAAM,WAAW,SAAS,GAAG;KAC/B,IAAM,IAAwB,EAC5B,EAAM,WACP;AACD,SAAI,EAAsB,SAAS,EAKjC,QAJA,EAAM,iBAAiB,EAAsB,EACxC,EAAM,yBACT,EAAM,yBAAyB,EAAsB,GAAG,GAAG,EAEtD;;AAIX,WAAO,EAAE;aACD;AAER,IADA,EAAM,wBAAwB,GAAM,EACpC,EAA6B,UAAU;;MAEvC,EAEG,EAA6B;IACnC,CAAC,GAAe,EAAiB,CAAC,EAM/B,IAAwB,EAC5B,OAAO,MAAiD;EAEtD,IAAM,IACJ,EAA2B,QAAQ,IAAI,EAAe;AACxD,MAAI,EACF,QAAO;EAGT,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AAElC,MAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO,EAAE;AAIX,EADA,EAAM,qBAAqB,GAAK,EAChC,EAAS,KAAK;EAGd,IAAM,KAAgB,YAAY;AAChC,OAAI;IACF,IAAM,IAAS,MAAM,EAAsC;KACzD,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;KACV,CAAC;AASF,QANI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAGC,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,WAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,+BAA+B,EAAO,OAAO,EACjD,MAAM,EAAa;;IAY/B,IAAM,KADqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAC9C,QAAQ,MAAM,EAAE,mBAAmB,EAAe;AAEnE,WADA,EAAM,cAAc,EAAG,EAChB;YACA,GAAK;AACZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,WAFA,QAAQ,MAAM,+BAA+B,EAAI,EACjD,EAAS,EAAQ,EACV,EAAE;aACD;AAER,IADA,EAAM,qBAAqB,GAAM,EACjC,EAA2B,QAAQ,OAAO,EAAe;;MAEzD;AAGJ,SADA,EAA2B,QAAQ,IAAI,GAAgB,EAAa,EAC7D;IAET,CAAC,EAAc,CAChB,EAMK,IAAsB,EAC1B,OACE,GACA,GACA,MAMI;EACJ,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB;AAEtC,MAAI,CAAC,KAAa,EAAe,EAAU,CACzC,QAAO;GAAE,SAAS;GAAO,OAAO;GAAmC;AAGrE,IAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAElB;IACD,SAAS;IACT,OAAO;IACP,WAAW,EACT,OAAO;KACL;KACA,GAAI,KAAe,EAAE,gBAAa;KAClC,GAAI,KAAa,EAAE,cAAW;KAC/B,EACF;IACD;IACA,SAAS;IACV,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAIlD,WAHK,EAAmB,EAAO,OAAO,IACpC,QAAQ,MAAM,oCAAoC,EAAO,OAAO,EAE3D;KAAE,SAAS;KAAO,OAAO;KAAc;;GAGhD,IAAM,IAAc,EAAO,MAAM;AAEjC,OAAI,GAAa,WAAW,EAAY,OAAO;IAC7C,IAAM,IAAe,EAAY,eAAe;AAKhD,WAJI,KACF,EAAM,sBAAsB,EAAa,EAE3C,EAAM,kBAAkB,EAAY,MAAM,EACnC;KACL,SAAS;KACT,OAAO,EAAY;KACnB,qBAAqB,KAAgB,KAAA;KACtC;;AAGH,UAAO;IACL,SAAS;IACT,OACE,GAAa,OAAO,WAAW;IAClC;WACM,GAAK;GACZ,IAAM,IACJ,aAAe,QACX,EAAI,UACJ;AAGN,UAFA,QAAQ,MAAM,oCAAoC,EAAI,EACtD,EAAS,EAAQ,EACV;IAAE,SAAS;IAAO,OAAO;IAAS;;IAG7C,CAAC,EAAiB,CACnB,EAMK,IAAgB,EAAY,YAAgC;EAChE,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB,EAChC,IAAU,EAAM,gBAChB,IAAc,EAAM;AAU1B,MARI,CAAC,KAAa,EAAe,EAAU,IAIvC,CAAC,KAID,CAAC,EACH,QAAO,EAAE;AAIX,EADA,EAAM,mBAAmB,GAAK,EAC9B,EAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAA+B;IAClD,SAAS;IACT,OAAO;IACP;IACA,gBAAgB;IAChB,SAAS;IACV,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,UAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,6BAA6B,EAAO,OAAO,EAC/C,MAAM,EAAa;;GAG/B,IAAM,IAAmB,EAAO,MAAM,UAAU,SAAS,EAAE;AAE3D,UADA,EAAM,YAAY,EAAM,EACjB;WACA,GAAK;AACZ,OAAI,aAAe,EACjB,QAAO,EAAE;GAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,UAFA,QAAQ,MAAM,6BAA6B,EAAI,EAC/C,EAAS,EAAQ,EACV,EAAE;YACD;AACR,KAAM,mBAAmB,GAAM;;IAEhC,CAAC,EAAiB,CAAC,EAMhB,KAAqB,EACzB,OAAO,MAA4C;EACjD,IAAM,IAAQ,EAAa,UAAU;AASrC,SAPA,EAAM,sBAAsB,KAAK,EACjC,EAAM,kBAAkB,KAAK,EAC7B,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,EAC/B,EAAM,yBAAyB,EAAI,GAAG,EAE3B,MAAM,EAAsB,EAAI,GAAG;IAGhD,CAAC,EAAsB,CACxB,EAEK,KAAkB,EACtB,OACE,MAKI;EACJ,IAAM,IAAQ,EAAa,UAAU;AAKrC,MAHA,EAAM,oBAAoB,KAAK,EAC/B,EAAM,YAAY,EAAE,CAAC,EAEjB,CAAC,EAAU,eAEb,QADA,QAAQ,MAAM,qCAAqC,EAAU,EACtD;GACL,SAAS;GACT,OAAO;GACR;EAGH,IAAM,IAAc,MAAM,EACxB,EAAU,gBACV,EAAU,GACX;AAED,MAAI,CAAC,EAAY,QACf,QAAO;GAAE,SAAS;GAAO,OAAO,EAAY;GAAO;EAGrD,IAAI,IAAQ,MAAM,GAAe;AACjC,MAAI,EAAM,WAAW,GAAG;GACtB,IAAM,IAAY,GAAoB,EAChC,IAAiB,EAAa,UAAU,CAAC;AAC/C,OAAI,KAAa,GAAgB;IAC/B,IAAM,IAAiB,MAAM,EAAqB;KAChD;KACA;KACA;KACD,CAAC;AACF,IAAI,MACF,IAAQ,CAAC,EAAe,EACxB,EAAM,YAAY,EAAM;;;AAS9B,SAJI,EAAM,SAAS,KACjB,EAAM,oBAAoB,EAAM,GAAI,GAAG,EAGlC;GAAE,SAAS;GAAM,UAAU;GAAO;IAE3C;EAAC;EAAqB;EAAe;EAAiB,CACvD,EAEK,KAAgB,GAAa,MAA2B;EAC5D,IAAM,IAAQ,EAAa,UAAU;AAErC,EADA,EAAM,oBAAoB,EAAQ,GAAG,EAEnC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa,EAAM;GACnB,gBAAgB,EAAM;GACtB,WAAW,EAAQ;GACpB,CAAC,IAEF,EAAM,kBAAkB,KAAK;IAE9B,EAAE,CAAC;AA+FN,QAtFA,QAAgB;EACd,IAAI,IAAY,IAMV,KAAwB,MAAgC;GAC5D,IAAI,IAAU,IACV,IAAS,IACP,UAAgB;AAChB,YACJ;SAAI,GAAS;AACX,UAAS;AACT;;AAGG,KADL,IAAU,IACL,GAAK,CAAC,cAAc;AAEvB,MADA,IAAU,IACN,CAAC,KAAa,MAChB,IAAS,IACT,GAAS;OAEX;;;AAEJ,UAAO;KAGH,IAAkB,QAA2B,GAAe,CAAC,EAC7D,IAAoB,QAA2B;GACnD,IAAM,IAAQ,EAAa,UAAU,CAAC;AACtC,UAAO,IAAQ,EAAsB,EAAM,GAAG,QAAQ,SAAS;IAC/D,EAGI,IAAc,EAAS,OAAO,MAAU;GAE5C,IAAM,IAAoB,EAAM;AAEhC,OAAI,EAAuB,IAAI,EAAU,EAAE;IACzC,IAAM,IAAmB,EAAqB,EAAM,QAAQ,EACtD,EAAE,0BAAuB,EAAa,UAAU;AAGtD,QACE,KACA,KACA,MAAqB,EAErB;AAMF,OAAiB;AACjB;;AAGF,GAAI,EAAyB,IAAI,EAAU,IACzC,GAAmB;IAErB;AAEF,eAAa;AAEX,GADA,IAAY,IACZ,GAAa;;IAEd;EAAC;EAAU;EAAe;EAAsB,CAAC,EAkB7C;EACL;EACA;EACA;EAEA;EACA;EACA;EAEA,qBArB0B,EAAc,MACvC,MAAQ,EAAI,OAAO,EACrB;EAoBC,kBAnBuB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;EAkBC,gBAjBqB,EAAS,MAAM,MAAS,EAAK,OAAO,EAAiB;EAmB1E;EAEA;EACA;EACA;EACA,WACE,KAA0B,KAAuB;EAEnD;EAEA;EACA;EACA;EACA;EAEA;EACA;EACA;EACD;;AAmBH,SAAgB,EACd,GACA;CACA,IAAM,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAsB,GACzB,MAAU,EAAM,oBAClB,EACK,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IAAuB,GAAS,wBAAwB;AAE9D,SAAgB;AAGd,MAFI,KAEA,CAAC,KAAyB,CAAC,KAAe,EAAqB;EAGnE,IAAM,IAAwB,EAAW,MACtC,MAAO,EAAG,mBAAmB,EAC/B;AAID,MAAI,EAAW,SAAS,KAAK,CAAC,GAAuB;GACnD,IAAM,IAAQ,EAAa,UAAU;AAIrC,GAHA,EAAM,qBAAqB,GAAK,EAGhC,EAAsC;IACpC,SAAS;IACT,OAAO;IACP,WAAW;IACX,SAAS;IACV,CAAC,CACC,MAAM,MAAW;AAQhB,QALI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAEC,CAAC,EAAO,QAAQ,QAAQ;KAK1B,IAAM,KAJqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAI9C,QACd,MAAM,EAAE,mBAAmB,EAC7B;AACD,OAAM,cAAc,EAAG;;KAEzB,CACD,YAAY,GAEX,CACD,cAAc;AACb,MAAM,qBAAqB,GAAM;KACjC;;IAEL;EACD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;;AAqBJ,SAAgB,EAAqB,GAAyC;CAC5E,IAAM,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAmB,GAAwB,EAC3C,IACJ,GAAS,oBAAoB,EAAiB,kBAC1C,IAAqB,GAAS,sBAAsB,IACpD,IAAmB,GAAS,oBAAoB,IAOhD,IAAoB,EAAO,GAAM,EAIjC,IAAgB,kBACpB,IAAI,KAAK,CACV,EAYK,IAAyB,kBAE7B,IAAI,KAAK,CAAC,EAEN,IAAmC;AAqOzC,CApOA,QAAgB;AAMd,MALI,KAEA,CAAC,KAAsB,CAAC,KAGxB,EAAkB,QAAS;EAO/B,IAAM,IAAe,EAAuB,QAAQ,IAAI,EAAmB;AAC3E,MACE,KACA,EAAa,SAAS,KACtB,KAAK,KAAK,GAAG,EAAa,gBAAgB,EAE1C;AAEF,EACE,KACA,KAAK,KAAK,GAAG,EAAa,iBACxB,KAGF,EAAuB,QAAQ,OAAO,EAAmB;EAQ3D,IAAM,IAAmB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;AAGD,MACE,KACA,KACA,EAAiB,mBAAmB,EAEpC;EAGF,IAAM,IACJ,GAAkB,kBAAkB;AACtC,MAAI,CAAC,EAAgB;EAErB,IAAM,IAAQ,EAAa,UAAU,EAG/B,IACJ,CAAC,KACD,EAAe,EAAe,IAC9B,CAAC,EAAgC,GAAgB;GAC/C,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EAGE,IAA0B,EAAS,MACtC,MAAM,EAAE,gBAAgB,EAC1B;AACD,MAAI,KAA2B,CAAC,GAAY;AAC1C,OAAI,CAAC,EAAM,kBAAkB;IAC3B,IAAM,IAAe,EAAS,MAC3B,MAAY,EAAQ,gBAAgB,EACtC;AACD,IAAI,KACF,EAAM,oBAAoB,EAAa,GAAG;;AAG9C;;EAGF,IAAM,IAAe,YAAY;AAE/B,GADA,EAAkB,UAAU,IAC5B,EAAM,mBAAmB,GAAK;GAC9B,IAAI,IAAY;AAEhB,OAAI;IACF,IAAI,IAAU;AAGd,QAAI,GAAY;KACd,IAAM,IAAc,MAAM,EAEvB;MACD,SAAS;MACT,OAAO;MACP,WAAW,EACT,OAAO;OACL;OACA,aAAa;OACb,GAAI,IAAmB,EAAE,WAAW,GAAkB,GAAG,EAAE;OAC5D,EACF;MACD,WAAW;MACX,SAAS;MACV,CAAC;AAEF,SACE,EAAY,MAAM,qBAAqB,WACvC,EAAY,KAAK,oBAAoB,MAGrC,CADA,IAAU,EAAY,KAAK,oBAAoB,OAC/C,EAAM,kBAAkB,EAAQ;SAEhC;;AAKJ,QAAI,KAAW,CAAC,KAA2B,CAAC,GAAkB;KAC5D,IAAM,IAAiB,MAAM,EAA+B;MAC1D,SAAS;MACT,OAAO;MACP,WAAW;MACX,gBAAgB;MAChB,SAAS;MACV,CAAC;AAEF,SAAI,EAAe,QAAQ,OACzB;KAGF,IAAI,IAAmB,EAAe,MAAM,UAAU,SAAS,EAAE;AACjE,SAAI,EAAM,WAAW,GAAG;MACtB,IAAM,IAAiB,MAAM,EAAqB;OAChD,WAAW;OACX;OACA,gBAAgB;OACjB,CAAC;AACF,UAAI,EACF,KAAQ,CAAC,EAAe;UAMxB;;AAOJ,KAHA,EAAM,YAAY,EAAM,EAGpB,EAAM,SAAS,KAAK,CAAC,EAAM,oBAC7B,EAAM,oBAAoB,EAAM,GAAG,GAAG;;AAI1C,QAAY;WACN,WAEE;AAER,IADA,EAAM,mBAAmB,GAAM,EAC/B,EAAkB,UAAU;IAC5B,IAAM,IAAW,EAAuB;AACxC,QAAI,GAAW;AACb,OAAS,OAAO,EAAmB;KACnC,IAAM,IAAU,EAAc,QAAQ,IAAI,EAAmB;AAC7D,KAAI,MACF,aAAa,EAAQ,EACrB,EAAc,QAAQ,OAAO,EAAmB;WAE7C;KAEL,IAAM,KADW,EAAS,IAAI,EAAmB,EACpB,SAAS,KAAK;AAU3C,SATA,EAAS,IAAI,GAAoB;MAC/B,OAAO;MACP,eAAe,KAAK,KAAK;MAC1B,CAAC,EAME,IAAY,GAA2B;MACzC,IAAM,IAAgB,EAAc,QAAQ,IAAI,EAAmB;AACnE,MAAI,KAAe,aAAa,EAAc;MAC9C,IAAM,IAAY,KAAK,IAAI,MAAO,MAAM,IAAY,IAAI,IAAK,EACvD,IAAQ,iBAAiB;AAC7B,SAAc,QAAQ,OAAO,EAAmB;OAGhD,IAAM,IAAS,EAAa,UAAU;AACtC,OACE,EAAO,uBAAuB,KAC9B,CAAC,EAAO,SAAS,MACd,MAAM,EAAE,gBAAgB,EAC1B,IACD,CAAC,EAAkB,WAMd,GAAc;SAEpB,EAAU;AACb,QAAc,QAAQ,IAAI,GAAoB,EAAM;;;;;AAM5D,KAAc;IACb;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAIF,QAAgB;EACd,IAAM,IAAS,EAAc;AAC7B,eAAa;AAEX,GADA,EAAO,SAAS,MAAU,aAAa,EAAM,CAAC,EAC9C,EAAO,OAAO;;IAEf,EAAE,CAAC"}
+{"version":3,"file":"useContextSwitcherData.js","names":[],"sources":["../../../src/auth/hooks/useContextSwitcherData.ts"],"sourcesContent":["import { useCallback, useState, useEffect, useRef } from \"react\";\nimport {\n  graphqlFetch,\n  getStoredAuthToken,\n} from \"@burdenoff/fe-libs/shared/graphql\";\nimport { useActiveContext } from \"@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { Organization, Workspace, Project } from \"../types\";\nimport { resolveGatewayBaseUrls } from \"../utils/gatewayBaseUrls\";\n\n// =============================================================================\n// Hook Options\n// =============================================================================\n\nexport interface UseContextSwitcherDataOptions {\n  /**\n   * Optional Global API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  globalBaseUrl?: string;\n  /**\n   * Optional Workspaces API Gateway base URL override.\n   * If not provided, uses GATEWAYS config from fe-libs.\n   */\n  workspaceBaseUrl?: string;\n  /** Disable initial organization/workspace bootstrap fetches */\n  disableBootstrap?: boolean;\n  /** Disable the workspace sync effect */\n  disableWorkspaceSync?: boolean;\n  /** Disable the project sync effect */\n  disableProjectSync?: boolean;\n  /** Only hydrate the workspace token; do not eagerly fetch projects */\n  skipProjectFetch?: boolean;\n}\n\n// =============================================================================\n// GraphQL Response Types\n// =============================================================================\n\ninterface MyOrganizationsResponse {\n  myOrganizations: {\n    total: number;\n    items: Organization[];\n  };\n}\n\ninterface WorkspacesByOrgResponse {\n  workspaces: {\n    total: number;\n    items: Workspace[];\n  };\n}\n\ntype GraphQLFetchResult<T> = Awaited<ReturnType<typeof graphqlFetch<T>>>;\n\ninterface IssueWorkspaceTokenResult {\n  success: boolean;\n  token: string | null;\n  expiresAt: string | null;\n  organizationId: string | null;\n  workspaceId: string | null;\n  projectId: string | null;\n  scopes: string[] | null;\n  error: {\n    code: string;\n    message: string;\n  } | null;\n}\n\ninterface ProjectsResponse {\n  projects: {\n    total: number;\n    items: Project[];\n  };\n}\n\ninterface CreateProjectResponse {\n  createProject: Project;\n}\n\n// =============================================================================\n// GraphQL Query/Mutation Strings\n// =============================================================================\n\nconst MY_ORGANIZATIONS_QUERY = `\n  query MyOrganizations {\n    myOrganizations {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        description\n        logo\n        website\n        status\n        type\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\n// Both queries below historically used `workspaces(filter: $filter)` with\n// a `WorkspaceFilterInput` to fetch workspaces for a specific organization.\n// That Query field was removed/renamed in the global subgraph; calling it\n// now throws GRAPHQL_VALIDATION_FAILED (\"Cannot query field 'workspaces'\n// on type 'Query'\") which crashes the context switcher and cascades into a\n// \"Verifying workspace access...\" stuck-spinner on every Platform module\n// route (/billing, /support, /notifications, /devportal).\n//\n// The supported field is `myWorkspaces(limit, offset)` on the global\n// subgraph — self-scoped, returns the caller's workspaces across all\n// orgs. It does NOT accept a filter, so we fetch up to 100 of \"my\"\n// workspaces and let the existing downstream auto-pick logic filter by\n// organizationId client-side. The recovery path at line ~624 already\n// uses this exact aliased pattern; we're just promoting it to the\n// primary path.\nconst WORKSPACES_BY_ORG_QUERY = `\n  query WorkspacesByOrg {\n    workspaces: myWorkspaces(limit: 100) {\n      total\n      items {\n        id\n        name\n        slug\n        tenantId\n        organizationId\n        type\n        status\n        region\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst ISSUE_WORKSPACE_TOKEN_MUTATION = `\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      expiresAt\n      organizationId\n      workspaceId\n      projectId\n      scopes\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\n// The workspace gateway exposes `myProjects` (public RBAC, caller-scoped to\n// the active workspace via x-workspace-id) and the privileged\n// `projects(filter)` (list:project). The header has no `list:project`\n// permission seeded for the typical operator, so the privileged form\n// returns FORBIDDEN even though the caller is a member of the workspace.\n// `myProjects` is the right field for \"give me the projects I can see in\n// this workspace\" — workspace scope is already established by the\n// workspace token + x-workspace-id header that we pass with the request.\nconst PROJECTS_QUERY = `\n  query MyProjectsForContext {\n    projects: myProjects {\n      total\n      items {\n        id\n        name\n        key\n        workspaceId\n        status\n        archived\n        createdAt\n        updatedAt\n      }\n    }\n  }\n`;\n\nconst CREATE_DEFAULT_PROJECT_MUTATION = `\n  mutation CreateDefaultProject($input: CreateProjectInput!) {\n    createProject(input: $input) {\n      id\n      name\n      key\n      workspaceId\n      status\n      archived\n      createdAt\n      updatedAt\n    }\n  }\n`;\n\nasync function createDefaultProject({\n  authToken,\n  workspaceBaseUrl,\n  workspaceToken,\n}: {\n  authToken: string;\n  workspaceBaseUrl: string;\n  workspaceToken: string;\n}): Promise<Project | null> {\n  const result = await graphqlFetch<CreateProjectResponse>({\n    gateway: \"workspace\",\n    query: CREATE_DEFAULT_PROJECT_MUTATION,\n    variables: {\n      input: {\n        name: \"Default Project\",\n      },\n    },\n    authToken,\n    workspaceToken,\n    baseUrl: workspaceBaseUrl,\n  });\n\n  if (result.errors?.length) {\n    console.warn(\"Failed to create default project:\", result.errors);\n    return null;\n  }\n\n  return result.data?.createProject ?? null;\n}\n\n// =============================================================================\n// Auth Helpers\n// =============================================================================\n\n/**\n * Check whether a JWT is expired (or within bufferMs of expiry).\n * Returns true if the token is expired, close to expiry, or malformed.\n */\nfunction isTokenExpired(token: string, bufferMs = 30_000): boolean {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    if (!payload.exp) return false;\n    return payload.exp * 1000 < Date.now() + bufferMs;\n  } catch {\n    return true;\n  }\n}\n\nfunction getWorkspaceTokenPayload(token: string): {\n  workspaceId?: string;\n  organizationId?: string;\n  projectId?: string;\n  exp?: number;\n} | null {\n  try {\n    const payload = JSON.parse(atob(token.split(\".\")[1]));\n    return {\n      workspaceId:\n        typeof payload.workspaceId === \"string\"\n          ? payload.workspaceId\n          : undefined,\n      organizationId:\n        typeof payload.organizationId === \"string\"\n          ? payload.organizationId\n          : undefined,\n      projectId:\n        typeof payload.projectId === \"string\" ? payload.projectId : undefined,\n      exp: typeof payload.exp === \"number\" ? payload.exp : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nfunction isWorkspaceTokenValidForContext(\n  token: string | null | undefined,\n  expected: {\n    workspaceId?: string | null;\n    organizationId?: string | null;\n    projectId?: string | null;\n  },\n): token is string {\n  if (!token || isTokenExpired(token)) {\n    return false;\n  }\n\n  const payload = getWorkspaceTokenPayload(token);\n  if (!payload) {\n    return false;\n  }\n\n  if (expected.workspaceId && payload.workspaceId !== expected.workspaceId) {\n    return false;\n  }\n\n  if (\n    expected.organizationId &&\n    payload.organizationId !== expected.organizationId\n  ) {\n    return false;\n  }\n\n  if (expected.projectId && payload.projectId !== expected.projectId) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Custom error class for auth-related failures (expired token, unauthorized, etc.).\n * Used to distinguish auth errors in outer catch blocks so they can be\n * suppressed from console.error — they are expected during token refresh cycles\n * and do not indicate application bugs.\n */\nclass AuthError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * Detect whether a set of GraphQL errors are authentication-related.\n */\nfunction isAuthGraphQLError(\n  errors: Array<{ message?: string; extensions?: { code?: string } }>,\n): boolean {\n  return errors.some(\n    (e) =>\n      e.extensions?.code === \"UNAUTHENTICATED\" ||\n      e.message?.toLowerCase().includes(\"unauthorized\") ||\n      e.message?.toLowerCase().includes(\"not authenticated\"),\n  );\n}\n\n/**\n * Resolve the best available access token:\n * 1. Try the zustand store token\n * 2. If expired, fall back to profile storage (may have been refreshed)\n * 3. Return null if no valid token is available\n */\nfunction resolveAccessToken(): string | null {\n  const storeToken = useAuthStore.getState().accessToken;\n\n  // If store token is valid (or has no exp claim), use it\n  if (storeToken && !isTokenExpired(storeToken)) {\n    return storeToken;\n  }\n\n  // Store token is expired or missing — try profile storage (may be fresher)\n  const profileToken = getStoredAuthToken();\n  if (profileToken && !isTokenExpired(profileToken)) {\n    return profileToken;\n  }\n\n  // Both expired or missing — if store token exists at all, return it as a last\n  // resort (the gateway will reject it and the useEffect will re-trigger after\n  // token refresh). Returning null would silently swallow the first load.\n  return storeToken;\n}\n\nfunction buildFallbackOrganizations(workspaces: Workspace[]): Organization[] {\n  const uniqueOrgIds = Array.from(\n    new Set(\n      workspaces.flatMap((workspace) =>\n        workspace.organizationId ? [workspace.organizationId] : [],\n      ),\n    ),\n  );\n\n  return uniqueOrgIds.map((organizationId, index) => ({\n    id: organizationId,\n    name:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.name || `Organization ${index + 1}`,\n    slug: organizationId,\n    tenantId:\n      workspaces.find(\n        (workspace) => workspace.organizationId === organizationId,\n      )?.tenantId || \"\",\n  }));\n}\n\n// =============================================================================\n// Hook Implementation\n// =============================================================================\n\n/**\n * Hook for managing the context switcher data (organizations, workspaces, projects)\n *\n * Data flow:\n * 1. fetchOrganizations() - Get all orgs user has access to (Global Gateway)\n * 2. selectOrganization(org) - Set current org & fetch workspaces for that org\n * 3. selectWorkspace(ws) - Issue workspace token & fetch projects\n * 4. selectProject(proj) - Set current project\n *\n * All GraphQL calls go through graphqlFetch from fe-libs which automatically\n * resolves gateway URLs and injects auth + locale headers.\n *\n * @param options - Optional configuration (gateway base URL overrides)\n */\n// Domain events emitted by microfe-workspaces that should refresh the switcher's\n// cached lists. Module-scoped so they aren't reallocated on every effect run.\nconst PROJECT_REFRESH_EVENTS = new Set<string>([\n  \"project.created\",\n  \"project.updated\",\n  \"project.deleted\",\n  \"project.archived\",\n  \"project.unarchived\",\n]);\nconst WORKSPACE_REFRESH_EVENTS = new Set<string>([\n  \"workspace.created\",\n  \"workspace.updated\",\n  \"workspace.deleted\",\n  \"workspace.archived\",\n  \"workspace.reactivated\",\n]);\n\n// Safely read a string `workspaceId` off a cross-MFE event payload of unknown\n// shape, rather than trusting a bare cast (the payload is produced by another\n// MFE and could drift). Returns undefined when absent or not a string.\nfunction readEventWorkspaceId(payload: unknown): string | undefined {\n  if (payload && typeof payload === \"object\" && \"workspaceId\" in payload) {\n    const value = (payload as { workspaceId?: unknown }).workspaceId;\n    return typeof value === \"string\" ? value : undefined;\n  }\n  return undefined;\n}\n\nexport function useContextSwitcherData(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const {\n    organizationId: activeOrganizationId,\n    workspaceId: activeWorkspaceId,\n    projectId: activeProjectId,\n    setContext: setActiveContext,\n  } = useActiveContext();\n\n  const eventBus = useEventBus();\n\n  // Use selectors for reactive state\n  const organizations = useAuthStore((state) => state.organizations);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const isLoadingOrganizations = useAuthStore(\n    (state) => state.isLoadingOrganizations,\n  );\n\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const isLoadingProjects = useAuthStore((state) => state.isLoadingProjects);\n\n  // Local error state\n  const [error, setError] = useState<string | null>(null);\n\n  // Deduplication refs to prevent duplicate GraphQL calls\n  const fetchOrganizationsPromiseRef = useRef<Promise<Organization[]> | null>(\n    null,\n  );\n  const fetchWorkspacesPromisesRef = useRef<Map<string, Promise<Workspace[]>>>(\n    new Map(),\n  );\n\n  // Stable refs for latest context values — avoids stale closures in callbacks\n  // without adding them to useCallback dep arrays (which would recreate callbacks\n  // on every context change and trigger spurious fetch re-runs).\n  const activeWorkspaceIdRef = useRef(activeWorkspaceId);\n  const activeOrganizationIdRef = useRef(activeOrganizationId);\n  useEffect(() => {\n    activeWorkspaceIdRef.current = activeWorkspaceId;\n    activeOrganizationIdRef.current = activeOrganizationId;\n  });\n\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n\n  // Refs to break feedback loops with the Header's \"store → URL\" sync effect.\n  // Without these the pair can ping-pong: this effect writes (URL → store),\n  // Header writes (store → URL), Zustand re-fires our subscribers, and React\n  // hits \"Maximum update depth exceeded\" — especially when a downstream call\n  // (workspace token issuance) returns 504 and leaves the two halves in\n  // disagreement. The refs record the last value we pushed for each axis;\n  // identical pushes are skipped so the loop has a hard floor.\n  const lastAppliedOrgIdRef = useRef<string | null>(null);\n  const lastAppliedWorkspaceIdRef = useRef<string | null>(null);\n  const lastAppliedProjectIdRef = useRef<string | null>(null);\n  const lastClearedTokenContextRef = useRef<string | null>(null);\n\n  useEffect(() => {\n    const store = useAuthStore.getState();\n\n    if (\n      activeOrganizationId &&\n      activeOrganizationId !== store.currentOrganizationId &&\n      activeOrganizationId !== lastAppliedOrgIdRef.current\n    ) {\n      lastAppliedOrgIdRef.current = activeOrganizationId;\n      store.setCurrentOrganizationId(activeOrganizationId);\n      if (\n        store.workspaces.length > 0 &&\n        !store.workspaces.some(\n          (workspace) => workspace.organizationId === activeOrganizationId,\n        )\n      ) {\n        store.setWorkspaces([]);\n      }\n    }\n\n    if (\n      activeWorkspaceId &&\n      activeWorkspaceId !== store.currentWorkspaceId &&\n      activeWorkspaceId !== lastAppliedWorkspaceIdRef.current\n    ) {\n      lastAppliedWorkspaceIdRef.current = activeWorkspaceId;\n      store.setCurrentWorkspaceId(activeWorkspaceId);\n      if (\n        store.projects.length > 0 &&\n        !store.projects.some(\n          (project) => project.workspaceId === activeWorkspaceId,\n        )\n      ) {\n        store.setProjects([]);\n        store.setCurrentProjectId(null);\n      }\n    }\n\n    if (\n      activeProjectId &&\n      activeProjectId !== store.currentProjectId &&\n      activeProjectId !== lastAppliedProjectIdRef.current\n    ) {\n      lastAppliedProjectIdRef.current = activeProjectId;\n      store.setCurrentProjectId(activeProjectId);\n    }\n\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: activeWorkspaceId,\n        organizationId: activeOrganizationId,\n        projectId: activeProjectId,\n      })\n    ) {\n      // Clear-token-once-per-context guard: when the upstream gateway is\n      // flaky (504s during workspace token issuance) the surrounding state\n      // machine can oscillate between \"got token but invalid\" and \"clearing\n      // token\". The downstream re-issue path then loops. Only clear once per\n      // (org, ws, proj) tuple — a successful re-issue resets the ref via\n      // setWorkspaceToken landing a new token for the same context.\n      const ctxKey = `${activeOrganizationId ?? \"\"}|${activeWorkspaceId ?? \"\"}|${activeProjectId ?? \"\"}`;\n      if (lastClearedTokenContextRef.current !== ctxKey) {\n        lastClearedTokenContextRef.current = ctxKey;\n        store.setWorkspaceToken(null);\n      }\n    }\n  }, [activeOrganizationId, activeWorkspaceId, activeProjectId]);\n\n  // ===========================================================================\n  // Fetch Organizations (Global Gateway)\n  // ===========================================================================\n\n  const fetchOrganizations = useCallback(async (): Promise<Organization[]> => {\n    // Deduplicate: if a fetch is already in progress, return the same promise\n    if (fetchOrganizationsPromiseRef.current) {\n      return fetchOrganizationsPromiseRef.current;\n    }\n\n    const store = useAuthStore.getState();\n    const token = resolveAccessToken();\n\n    if (!token) {\n      // Not an error — user may not be authenticated yet (e.g., page load before login).\n      // The useEffect in Header.tsx will re-trigger when accessToken becomes available.\n      return [];\n    }\n\n    // If the token is clearly expired and no fresh fallback was found, skip the\n    // doomed request. The useEffect in Header.tsx re-triggers when the auth\n    // provider refreshes the token and updates accessToken in the store.\n    if (isTokenExpired(token)) {\n      return [];\n    }\n\n    store.setLoadingOrganizations(true);\n    setError(null);\n\n    // Store the promise for deduplication before starting\n    fetchOrganizationsPromiseRef.current = (async () => {\n      try {\n        const initialTargetOrgId =\n          activeOrganizationIdRef.current ?? store.currentOrganizationId;\n        let result: GraphQLFetchResult<\n          MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n        > = initialTargetOrgId\n          ? await (async () => {\n              const [organizationsResult, workspacesResult] = await Promise.all(\n                [\n                  graphqlFetch<MyOrganizationsResponse>({\n                    gateway: \"global\",\n                    query: MY_ORGANIZATIONS_QUERY,\n                    authToken: token,\n                    baseUrl: globalBaseUrl,\n                  }),\n                  graphqlFetch<WorkspacesByOrgResponse>({\n                    gateway: \"global\",\n                    query: WORKSPACES_BY_ORG_QUERY,\n                    authToken: token,\n                    baseUrl: globalBaseUrl,\n                  }),\n                ],\n              );\n\n              const data = organizationsResult.data?.myOrganizations\n                ? {\n                    myOrganizations: organizationsResult.data.myOrganizations,\n                    ...(workspacesResult.data?.workspaces\n                      ? { workspaces: workspacesResult.data.workspaces }\n                      : {}),\n                  }\n                : null;\n\n              return {\n                data,\n                errors: [\n                  ...(organizationsResult.errors ?? []),\n                  ...(workspacesResult.errors ?? []),\n                ],\n              };\n            })()\n          : await graphqlFetch<MyOrganizationsResponse>({\n              gateway: \"global\",\n              query: MY_ORGANIZATIONS_QUERY,\n              authToken: token,\n              baseUrl: globalBaseUrl,\n            });\n\n        // Self-heal stale-URL case: if the workspace side of the bootstrap\n        // fails because the URL points at an inaccessible org/workspace, retry\n        // with the organization-only query so the operator sees their actual\n        // orgs and the URL params get corrected on next render.\n        if (\n          initialTargetOrgId &&\n          result.errors?.length &&\n          result.errors.some(\n            (e) =>\n              e?.extensions?.code === \"FORBIDDEN\" ||\n              /not a member of this organization/i.test(e?.message ?? \"\") ||\n              // Public gateway often drops the underlying FORBIDDEN error\n              // and replaces it with the schema-level non-null violation\n              // (\"Cannot return null for non-nullable field Query.myOrganizations\").\n              // That happens when ANY field in the query throws — workspaces\n              // here — and data:null cascades up. Treat that pattern as a\n              // signal to retry without the workspaces filter.\n              /Cannot return null for non-nullable field Query\\.myOrganizations/i.test(\n                e?.message ?? \"\",\n              ),\n          )\n        ) {\n          // Fetch myOrganizations + ALL workspaces (no filter) so the\n          // downstream auto-pick logic still has a workspace list to seed\n          // context from. If we only refetched myOrganizations, the page\n          // would render but every workspace-scoped query would fail with\n          // \"Select a workspace…\".\n          result = await graphqlFetch<\n            MyOrganizationsResponse & Partial<WorkspacesByOrgResponse>\n          >({\n            gateway: \"global\",\n            query: `\n              query ContextSwitcherRecover {\n                myOrganizations {\n                  total\n                  items { id name slug tenantId description logo website status type createdAt updatedAt }\n                }\n                workspaces: myWorkspaces {\n                  total\n                  items { id name slug tenantId organizationId type status region createdAt updatedAt }\n                }\n              }\n            `,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n        }\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (isAuthGraphQLError(result.errors)) {\n            // Auth errors are expected during token refresh cycles — throw AuthError\n            // so the outer catch can suppress console.error.\n            throw new AuthError(errorMessage);\n          }\n          if (store.workspaces.length === 0) {\n            console.error(\"Failed to fetch organizations:\", result.errors);\n          }\n          throw new Error(errorMessage);\n        }\n\n        let orgs: Organization[] = result.data?.myOrganizations?.items ?? [];\n\n        // Stale-context recovery: bootstrap query was filtered by\n        // initialTargetOrgId, so when the URL/persisted org doesn't belong to\n        // this user the response is empty. Re-fetch the unfiltered list of\n        // *all* orgs the user can access so the guard below can pick a real\n        // default. Skip the recovery when no target was set (already\n        // unfiltered) or when workspaces are already in the store (the\n        // existing fallback path covers that case).\n        if (\n          initialTargetOrgId &&\n          orgs.length === 0 &&\n          store.workspaces.length === 0\n        ) {\n          const recovery = await graphqlFetch<MyOrganizationsResponse>({\n            gateway: \"global\",\n            query: MY_ORGANIZATIONS_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          if (!recovery.errors?.length) {\n            orgs = recovery.data?.myOrganizations?.items ?? [];\n            // discard the filtered workspaces payload — it was for the\n            // ghost org and would only mislead the workspace selector below.\n            result = {\n              ...recovery,\n              data: {\n                myOrganizations: recovery.data?.myOrganizations ?? {\n                  items: [],\n                  total: 0,\n                },\n              },\n            };\n          } else {\n            // Surface the failure so a user reporting \"blank org list\" has\n            // something to grep for in the console. We still fall through —\n            // the guard below either picks from a fallback (workspaces in\n            // store) or no-ops, leaving the existing error path in place.\n            console.warn(\n              \"[ContextSwitcher] Stale-context recovery failed:\",\n              recovery.errors,\n            );\n          }\n        }\n\n        const fallbackOrganizations =\n          orgs.length === 0 && store.workspaces.length > 0\n            ? buildFallbackOrganizations(store.workspaces)\n            : [];\n        const effectiveOrganizations =\n          fallbackOrganizations.length > 0 ? fallbackOrganizations : orgs;\n\n        store.setOrganizations(effectiveOrganizations);\n\n        // Determine which organization to use for workspace fetching\n        let targetOrgId = initialTargetOrgId;\n\n        // Stale-context guard: if the persisted/URL org isn't in the user's\n        // accessible orgs, fall back to the first available one and clear the\n        // stale workspace/project so they get re-derived. Without this, URL\n        // params like ?org=<ghost-id> from a prior session leak into the new\n        // user's request headers and cause \"Authentication required\" /\n        // \"not a member\" errors at every subgraph.\n        //\n        // Check against `orgs` (freshly returned from the API in this same\n        // closure) rather than `effectiveOrganizations`, which can fall back\n        // to ids derived from `store.workspaces` — that fallback path could\n        // contain stale ghost orgIds and mask the guard.\n        const targetOrgIsAccessible =\n          targetOrgId && orgs.some((org) => org.id === targetOrgId);\n        if (targetOrgId && !targetOrgIsAccessible && orgs.length > 0) {\n          targetOrgId = orgs[0].id;\n          setActiveContext({\n            organizationId: targetOrgId,\n            workspaceId: null,\n            tenantId: null,\n            projectId: null,\n          });\n          store.setWorkspaces([]);\n          store.setProjects([]);\n          store.setCurrentWorkspaceId(null);\n          store.setCurrentProjectId(null);\n          store.setWorkspaceToken(null);\n        }\n\n        if (targetOrgId && targetOrgId !== store.currentOrganizationId) {\n          store.setCurrentOrganizationId(targetOrgId);\n        }\n\n        // Auto-select first organization if none is selected\n        if (effectiveOrganizations.length > 0 && !targetOrgId) {\n          store.setCurrentOrganizationId(effectiveOrganizations[0].id);\n          targetOrgId = effectiveOrganizations[0].id;\n        }\n\n        // Fetch workspaces for the selected/auto-selected org if:\n        // 1. We have a target org (either auto-selected or persisted from localStorage)\n        // 2. AND workspaces array is empty (not persisted, or cleared)\n        // This handles both initial login AND page refresh scenarios.\n        // Read from useAuthStore.getState() rather than the captured `store`\n        // snapshot so we see the post-guard cleared value when the org guard\n        // above fired (the local `store.workspaces` ref is stale after\n        // setWorkspaces([])).\n        if (targetOrgId && useAuthStore.getState().workspaces.length === 0) {\n          store.setLoadingWorkspaces(true);\n          try {\n            // myWorkspaces returns ALL workspaces the user is a member of\n            // across every org. Filter to the target org client-side here.\n            const bootstrappedWorkspaces =\n              initialTargetOrgId === targetOrgId\n                ? result.data?.workspaces?.items?.filter(\n                    (w) => w.organizationId === targetOrgId,\n                  )\n                : undefined;\n            const ws = bootstrappedWorkspaces\n              ? (bootstrappedWorkspaces as Workspace[])\n              : await graphqlFetch<WorkspacesByOrgResponse>({\n                  gateway: \"global\",\n                  query: WORKSPACES_BY_ORG_QUERY,\n                  authToken: token,\n                  baseUrl: globalBaseUrl,\n                }).then((wsResult) =>\n                  wsResult.errors?.length\n                    ? null\n                    : (wsResult.data?.workspaces?.items ?? []).filter(\n                        (w) => w.organizationId === targetOrgId,\n                      ),\n                );\n\n            if (ws) {\n              store.setWorkspaces(ws);\n              const persistedWorkspace = activeWorkspaceIdRef.current\n                ? ws.find(\n                    (workspace) =>\n                      workspace.id === activeWorkspaceIdRef.current,\n                  )\n                : null;\n\n              if (persistedWorkspace) {\n                store.setCurrentWorkspaceId(persistedWorkspace.id);\n              } else if (ws.length > 0) {\n                const nextActiveContext = {\n                  organizationId: targetOrgId,\n                  workspaceId: ws[0].id,\n                  tenantId: ws[0].tenantId,\n                  projectId: null,\n                };\n\n                if (activeWorkspaceIdRef.current) {\n                  // Stale-context guard: URL/persisted workspace ID is not in\n                  // the user's accessible workspaces for the active org. Fall\n                  // back to the first workspace and clear the stale URL param\n                  // so subsequent requests don't carry the ghost ID.\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  store.setWorkspaceToken(null);\n                  setActiveContext(nextActiveContext);\n                } else if (!store.currentWorkspaceId) {\n                  // Auto-select first workspace only if none is currently selected\n                  // (preserves selection from completeAuthFlow or persistence if applicable)\n                  store.setCurrentWorkspaceId(ws[0].id);\n                  setActiveContext(nextActiveContext);\n                }\n              }\n            }\n          } catch {\n            // Non-critical — user can still select workspace manually\n          } finally {\n            store.setLoadingWorkspaces(false);\n          }\n        }\n\n        return effectiveOrganizations;\n      } catch (err) {\n        // Auth errors are expected during token refresh / page load cycles.\n        // Suppress from console.error — the useEffect will re-trigger when the\n        // auth provider refreshes the token.\n        if (err instanceof AuthError) {\n          return [];\n        }\n        const message =\n          err instanceof Error ? err.message : \"Failed to fetch organizations\";\n        if (store.workspaces.length === 0) {\n          console.error(\"Failed to fetch organizations:\", err);\n        }\n        setError(message);\n\n        if (store.workspaces.length > 0) {\n          const fallbackOrganizations = buildFallbackOrganizations(\n            store.workspaces,\n          );\n          if (fallbackOrganizations.length > 0) {\n            store.setOrganizations(fallbackOrganizations);\n            if (!store.currentOrganizationId) {\n              store.setCurrentOrganizationId(fallbackOrganizations[0].id);\n            }\n            return fallbackOrganizations;\n          }\n        }\n\n        return [];\n      } finally {\n        store.setLoadingOrganizations(false);\n        fetchOrganizationsPromiseRef.current = null;\n      }\n    })();\n\n    return fetchOrganizationsPromiseRef.current;\n  }, [globalBaseUrl, setActiveContext]);\n\n  // ===========================================================================\n  // Fetch Workspaces for Organization (Global Gateway)\n  // ===========================================================================\n\n  const fetchWorkspacesForOrg = useCallback(\n    async (organizationId: string): Promise<Workspace[]> => {\n      // Deduplicate: if a fetch for this org is already in progress, return the same promise\n      const existingPromise =\n        fetchWorkspacesPromisesRef.current.get(organizationId);\n      if (existingPromise) {\n        return existingPromise;\n      }\n\n      const store = useAuthStore.getState();\n      const token = resolveAccessToken();\n\n      if (!token || isTokenExpired(token)) {\n        return [];\n      }\n\n      store.setLoadingWorkspaces(true);\n      setError(null);\n\n      // Store the promise for deduplication before starting\n      const fetchPromise = (async () => {\n        try {\n          const result = await graphqlFetch<WorkspacesByOrgResponse>({\n            gateway: \"global\",\n            query: WORKSPACES_BY_ORG_QUERY,\n            authToken: token,\n            baseUrl: globalBaseUrl,\n          });\n          // myWorkspaces returns workspaces across all the user's orgs;\n          // filter to the requested org before handing to downstream.\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === organizationId,\n            );\n          }\n\n          if (result.errors?.length) {\n            const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n            if (isAuthGraphQLError(result.errors)) {\n              throw new AuthError(errorMessage);\n            }\n            console.error(\"Failed to fetch workspaces:\", result.errors);\n            throw new Error(errorMessage);\n          }\n\n          // `myWorkspaces` returns every workspace the caller can see across\n          // all of their orgs/tenants. The store key is per-org (selecting\n          // org X then opening the dropdown should only show X's workspaces),\n          // so we filter down to the requested org here. The dropdown filter\n          // in ContextSwitcher.tsx is a defence-in-depth — without this\n          // narrowing the store would briefly hold the caller's other-org\n          // workspaces and the auto-pick logic (lines below) might select\n          // one of them as the default.\n          const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n          const ws = allWs.filter((w) => w.organizationId === organizationId);\n          store.setWorkspaces(ws);\n          return ws;\n        } catch (err) {\n          if (err instanceof AuthError) {\n            return [];\n          }\n          const message =\n            err instanceof Error ? err.message : \"Failed to fetch workspaces\";\n          console.error(\"Failed to fetch workspaces:\", err);\n          setError(message);\n          return [];\n        } finally {\n          store.setLoadingWorkspaces(false);\n          fetchWorkspacesPromisesRef.current.delete(organizationId);\n        }\n      })();\n\n      fetchWorkspacesPromisesRef.current.set(organizationId, fetchPromise);\n      return fetchPromise;\n    },\n    [globalBaseUrl],\n  );\n\n  // ===========================================================================\n  // Issue Workspace Token (Workspace Gateway - wspace-auth-svc)\n  // ===========================================================================\n\n  const issueWorkspaceToken = useCallback(\n    async (\n      organizationId: string,\n      workspaceId?: string,\n      projectId?: string | null,\n      // Target workspace's tenant. Sent as x-tenant-id so the token service can\n      // resolve the tenant for a super_admin switching into a workspace not\n      // mirrored into the wspace layer (whose access token carries no tenant\n      // claim). Regular members resolve their tenant via membership regardless.\n      tenantId?: string,\n    ): Promise<{\n      success: boolean;\n      token?: string;\n      resolvedWorkspaceId?: string;\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n      const authToken = resolveAccessToken();\n\n      if (!authToken || isTokenExpired(authToken)) {\n        return { success: false, error: \"No valid access token available\" };\n      }\n\n      setError(null);\n\n      try {\n        const result = await graphqlFetch<{\n          issueWorkspaceToken: IssueWorkspaceTokenResult;\n        }>({\n          gateway: \"workspace\",\n          query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n          variables: {\n            input: {\n              organizationId,\n              ...(workspaceId && { workspaceId }),\n              ...(projectId && { projectId }),\n            },\n          },\n          authToken,\n          baseUrl: workspaceBaseUrl,\n          tenantId,\n        });\n\n        if (result.errors?.length) {\n          const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n          if (!isAuthGraphQLError(result.errors)) {\n            console.error(\"Failed to issue workspace token:\", result.errors);\n          }\n          return { success: false, error: errorMessage };\n        }\n\n        const tokenResult = result.data?.issueWorkspaceToken;\n\n        if (tokenResult?.success && tokenResult.token) {\n          const resolvedWsId = tokenResult.workspaceId || workspaceId;\n          if (resolvedWsId) {\n            store.setCurrentWorkspaceId(resolvedWsId);\n          }\n          store.setWorkspaceToken(tokenResult.token);\n          return {\n            success: true,\n            token: tokenResult.token,\n            resolvedWorkspaceId: resolvedWsId || undefined,\n          };\n        }\n\n        return {\n          success: false,\n          error:\n            tokenResult?.error?.message ?? \"Failed to issue workspace token\",\n        };\n      } catch (err) {\n        const message =\n          err instanceof Error\n            ? err.message\n            : \"Failed to issue workspace token\";\n        console.error(\"Failed to issue workspace token:\", err);\n        setError(message);\n        return { success: false, error: message };\n      }\n    },\n    [workspaceBaseUrl],\n  );\n\n  // ===========================================================================\n  // Fetch Projects (Workspace Gateway - requires workspace token)\n  // ===========================================================================\n\n  const fetchProjects = useCallback(async (): Promise<Project[]> => {\n    const store = useAuthStore.getState();\n    const authToken = resolveAccessToken();\n    const wsToken = store.workspaceToken;\n    const workspaceId = store.currentWorkspaceId;\n\n    if (!authToken || isTokenExpired(authToken)) {\n      return [];\n    }\n\n    if (!wsToken) {\n      return [];\n    }\n\n    if (!workspaceId) {\n      return [];\n    }\n\n    store.setLoadingProjects(true);\n    setError(null);\n\n    try {\n      const result = await graphqlFetch<ProjectsResponse>({\n        gateway: \"workspace\",\n        query: PROJECTS_QUERY,\n        authToken,\n        workspaceToken: wsToken,\n        baseUrl: workspaceBaseUrl,\n      });\n\n      if (result.errors?.length) {\n        const errorMessage = result.errors[0]?.message ?? \"GraphQL error\";\n        if (isAuthGraphQLError(result.errors)) {\n          throw new AuthError(errorMessage);\n        }\n        console.error(\"Failed to fetch projects:\", result.errors);\n        throw new Error(errorMessage);\n      }\n\n      const projs: Project[] = result.data?.projects?.items ?? [];\n      store.setProjects(projs);\n      return projs;\n    } catch (err) {\n      if (err instanceof AuthError) {\n        return [];\n      }\n      const message =\n        err instanceof Error ? err.message : \"Failed to fetch projects\";\n      console.error(\"Failed to fetch projects:\", err);\n      setError(message);\n      return [];\n    } finally {\n      store.setLoadingProjects(false);\n    }\n  }, [workspaceBaseUrl]);\n\n  // ===========================================================================\n  // High-Level Selection Actions\n  // ===========================================================================\n\n  const selectOrganization = useCallback(\n    async (org: Organization): Promise<Workspace[]> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentWorkspaceId(null);\n      store.setWorkspaceToken(null);\n      store.setProjects([]);\n      store.setCurrentProjectId(null);\n      store.setCurrentOrganizationId(org.id);\n\n      const ws = await fetchWorkspacesForOrg(org.id);\n      return ws;\n    },\n    [fetchWorkspacesForOrg],\n  );\n\n  const selectWorkspace = useCallback(\n    async (\n      workspace: Workspace,\n    ): Promise<{\n      success: boolean;\n      projects?: Project[];\n      error?: string;\n    }> => {\n      const store = useAuthStore.getState();\n\n      store.setCurrentProjectId(null);\n      store.setProjects([]);\n\n      if (!workspace.organizationId) {\n        console.error(\"Workspace missing organizationId:\", workspace);\n        return {\n          success: false,\n          error: \"Workspace is missing organizationId\",\n        };\n      }\n\n      const tokenResult = await issueWorkspaceToken(\n        workspace.organizationId,\n        workspace.id,\n        undefined,\n        workspace.tenantId,\n      );\n\n      if (!tokenResult.success) {\n        return { success: false, error: tokenResult.error };\n      }\n\n      let projs = await fetchProjects();\n      if (projs.length === 0) {\n        const authToken = resolveAccessToken();\n        const workspaceToken = useAuthStore.getState().workspaceToken;\n        if (authToken && workspaceToken) {\n          const defaultProject = await createDefaultProject({\n            authToken,\n            workspaceBaseUrl,\n            workspaceToken,\n          });\n          if (defaultProject) {\n            projs = [defaultProject];\n            store.setProjects(projs);\n          }\n        }\n      }\n\n      if (projs.length > 0) {\n        store.setCurrentProjectId(projs[0]!.id);\n      }\n\n      return { success: true, projects: projs };\n    },\n    [issueWorkspaceToken, fetchProjects, workspaceBaseUrl],\n  );\n\n  const selectProject = useCallback((project: Project): void => {\n    const store = useAuthStore.getState();\n    store.setCurrentProjectId(project.id);\n    if (\n      store.workspaceToken &&\n      !isWorkspaceTokenValidForContext(store.workspaceToken, {\n        workspaceId: store.currentWorkspaceId,\n        organizationId: store.currentOrganizationId,\n        projectId: project.id,\n      })\n    ) {\n      store.setWorkspaceToken(null);\n    }\n  }, []);\n\n  // ===========================================================================\n  // Cross-MFE refresh: keep the switcher lists current when another MFE mutates\n  // org/workspace/project entities. microfe-workspaces emits these domain events\n  // on the shared event bus (e.g. on project rename); without this the switcher\n  // keeps showing the stale cached name until a full page reload.\n  // ===========================================================================\n\n  useEffect(() => {\n    let cancelled = false;\n\n    // Coalesce a refetch into a single in-flight run with one trailing re-run,\n    // so a burst of events collapses to one request (+ one trailing) instead of\n    // fanning out or being swallowed by a downstream per-key dedupe. The flag is\n    // cleared on cleanup so nothing fires after the subscription is torn down.\n    const makeCoalescedRefetch = (run: () => Promise<unknown>) => {\n      let running = false;\n      let queued = false;\n      const trigger = () => {\n        if (cancelled) return;\n        if (running) {\n          queued = true;\n          return;\n        }\n        running = true;\n        void run().finally(() => {\n          running = false;\n          if (!cancelled && queued) {\n            queued = false;\n            trigger();\n          }\n        });\n      };\n      return trigger;\n    };\n\n    const refreshProjects = makeCoalescedRefetch(() => fetchProjects());\n    const refreshWorkspaces = makeCoalescedRefetch(() => {\n      const orgId = useAuthStore.getState().currentOrganizationId;\n      return orgId ? fetchWorkspacesForOrg(orgId) : Promise.resolve();\n    });\n\n    // Custom domain events (not in BurdenoffEventName) flow through `onAny`.\n    const unsubscribe = eventBus.onAny((event) => {\n      // Custom event names aren't in the BurdenoffEventName union; compare as string.\n      const eventName: string = event.name;\n\n      if (PROJECT_REFRESH_EVENTS.has(eventName)) {\n        const eventWorkspaceId = readEventWorkspaceId(event.payload);\n        const { currentWorkspaceId } = useAuthStore.getState();\n        // Only refetch when the event targets the workspace currently in\n        // context (events without a workspace id are treated as relevant).\n        if (\n          eventWorkspaceId &&\n          currentWorkspaceId &&\n          eventWorkspaceId !== currentWorkspaceId\n        ) {\n          return;\n        }\n        // Refetch only — a deleted project simply drops out of the list, and\n        // `currentProject` resolves to undefined for it. Clearing the selection\n        // here would race ActiveContext / the project sync effect (the real\n        // source of truth), so we leave selection reconciliation to them.\n        refreshProjects();\n        return;\n      }\n\n      if (WORKSPACE_REFRESH_EVENTS.has(eventName)) {\n        refreshWorkspaces();\n      }\n    });\n\n    return () => {\n      cancelled = true;\n      unsubscribe();\n    };\n  }, [eventBus, fetchProjects, fetchWorkspacesForOrg]);\n\n  // ===========================================================================\n  // Get Current Items\n  // ===========================================================================\n\n  const currentOrganization = organizations.find(\n    (org) => org.id === currentOrganizationId,\n  );\n  const currentWorkspace = workspaces.find(\n    (ws) => ws.id === currentWorkspaceId,\n  );\n  const currentProject = projects.find((proj) => proj.id === currentProjectId);\n\n  // ===========================================================================\n  // Return Hook API\n  // ===========================================================================\n\n  return {\n    organizations,\n    workspaces,\n    projects,\n\n    currentOrganizationId,\n    currentWorkspaceId,\n    currentProjectId,\n\n    currentOrganization,\n    currentWorkspace,\n    currentProject,\n\n    workspaceToken,\n\n    isLoadingOrganizations,\n    isLoadingWorkspaces,\n    isLoadingProjects,\n    isLoading:\n      isLoadingOrganizations || isLoadingWorkspaces || isLoadingProjects,\n\n    error,\n\n    fetchOrganizations,\n    fetchWorkspacesForOrg,\n    issueWorkspaceToken,\n    fetchProjects,\n\n    selectOrganization,\n    selectWorkspace,\n    selectProject,\n  };\n}\n\n/**\n * Hook to reactively ensure workspaces are synced with the current organization.\n *\n * This handles edge cases where the organization changes but workspaces\n * from a different org are still in the store (e.g., stale data, race conditions).\n *\n * Usage:\n * ```tsx\n * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useWorkspaceSyncEffect(); // Ensures workspaces stay in sync\n *   // ...\n * }\n * ```\n */\nexport function useWorkspaceSyncEffect(\n  options?: UseContextSwitcherDataOptions,\n) {\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const isLoadingWorkspaces = useAuthStore(\n    (state) => state.isLoadingWorkspaces,\n  );\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const globalBaseUrl =\n    options?.globalBaseUrl ?? resolvedBaseUrls.globalBaseUrl;\n  const disableWorkspaceSync = options?.disableWorkspaceSync ?? false;\n\n  useEffect(() => {\n    if (disableWorkspaceSync) return;\n    // Skip if no org selected, no token, or already loading\n    if (!currentOrganizationId || !accessToken || isLoadingWorkspaces) return;\n\n    // Check if any workspace matches the current org\n    const hasMatchingWorkspaces = workspaces.some(\n      (ws) => ws.organizationId === currentOrganizationId,\n    );\n\n    // If workspaces exist but none match current org, we need to refetch\n    // This can happen in edge cases with stale data or race conditions\n    if (workspaces.length > 0 && !hasMatchingWorkspaces) {\n      const store = useAuthStore.getState();\n      store.setLoadingWorkspaces(true);\n\n      // Inline fetch to avoid circular dependency with useContextSwitcherData\n      graphqlFetch<WorkspacesByOrgResponse>({\n        gateway: \"global\",\n        query: WORKSPACES_BY_ORG_QUERY,\n        authToken: accessToken,\n        baseUrl: globalBaseUrl,\n      })\n        .then((result) => {\n          // myWorkspaces returns ALL my workspaces; filter to current org\n          // client-side (the old server-side filter no longer exists).\n          if (result.data?.workspaces?.items) {\n            result.data.workspaces.items = result.data.workspaces.items.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n          }\n          if (!result.errors?.length) {\n            const allWs: Workspace[] = result.data?.workspaces?.items ?? [];\n            // Same per-org narrowing as fetchWorkspacesForOrg — see the\n            // comment there for why we don't just dump the full caller-\n            // visible list into the store.\n            const ws = allWs.filter(\n              (w) => w.organizationId === currentOrganizationId,\n            );\n            store.setWorkspaces(ws);\n          }\n        })\n        .catch(() => {\n          // Silent fail - user can manually refresh or select org again\n        })\n        .finally(() => {\n          store.setLoadingWorkspaces(false);\n        });\n    }\n  }, [\n    currentOrganizationId,\n    workspaces,\n    accessToken,\n    isLoadingWorkspaces,\n    globalBaseUrl,\n    disableWorkspaceSync,\n  ]);\n}\n\n/**\n * Hook to reactively ensure projects are loaded when a workspace is selected.\n *\n * This handles the case where a workspace is auto-selected (from URL/localStorage)\n * but projects haven't been fetched yet. It will:\n * 1. Issue a workspace token if not present\n * 2. Fetch projects for the selected workspace\n *\n * Usage:\n * ```tsx\n * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';\n *\n * function MyComponent() {\n *   useProjectSyncEffect(); // Ensures projects are loaded for selected workspace\n *   // ...\n * }\n * ```\n */\nexport function useProjectSyncEffect(options?: UseContextSwitcherDataOptions) {\n  const currentWorkspaceId = useAuthStore((state) => state.currentWorkspaceId);\n  const currentOrganizationId = useAuthStore(\n    (state) => state.currentOrganizationId,\n  );\n  const workspaces = useAuthStore((state) => state.workspaces);\n  const projects = useAuthStore((state) => state.projects);\n  const currentProjectId = useAuthStore((state) => state.currentProjectId);\n  const workspaceToken = useAuthStore((state) => state.workspaceToken);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const resolvedBaseUrls = resolveGatewayBaseUrls();\n  const workspaceBaseUrl =\n    options?.workspaceBaseUrl ?? resolvedBaseUrls.workspaceBaseUrl;\n  const disableProjectSync = options?.disableProjectSync ?? false;\n  const skipProjectFetch = options?.skipProjectFetch ?? false;\n\n  // Use refs to prevent the infinite loop caused by including loading/failure\n  // state in the dependency array. Without these, the cycle is:\n  //   setLoadingProjects(true) -> dep change -> effect re-runs (guarded) ->\n  //   async completes -> setLoadingProjects(false) -> dep change ->\n  //   effect re-runs -> starts again -> INFINITE LOOP\n  const syncInProgressRef = useRef(false);\n  // Pending retry timer per workspace, so transient failures (e.g. RBAC lag\n  // right after workspace creation) get an automatic second chance even if no\n  // dependency change re-triggers the effect.\n  const retryTimerRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(\n    new Map(),\n  );\n  // Per-workspace failure tracker — caps retry attempts when project bootstrap\n  // (token issue, list, or default-create) fails. Without this, a persistent\n  // backend failure (e.g. cross-layer workspace not yet synced) causes the\n  // effect to re-fire every render: list returns empty → create-default fails\n  // → setProjects([]) → new array reference → effect re-runs → loop.\n  //\n  // We track both count AND lastFailureAt so we can honour a \"cool-down\" window:\n  // after PROJECT_SYNC_FAILURE_COOLDOWN_MS has elapsed since the last failure,\n  // the counter is treated as cleared so transient backend hiccups (e.g. RBAC\n  // role propagation lag right after signup) don't permanently lock a workspace\n  // out of the context dropdown — the original cause of marqueue §729.\n  const projectSyncFailuresRef = useRef<\n    Map<string, { count: number; lastFailureAt: number }>\n  >(new Map());\n  const PROJECT_SYNC_MAX_FAILURES = 8;\n  const PROJECT_SYNC_FAILURE_COOLDOWN_MS = 30_000;\n  useEffect(() => {\n    if (disableProjectSync) return;\n    // Skip if no workspace selected or no access token\n    if (!currentWorkspaceId || !accessToken) return;\n\n    // Skip if a sync is already in progress (ref-based guard avoids dep loop)\n    if (syncInProgressRef.current) return;\n\n    // Stop retrying once this workspace has failed too many times in a row.\n    // Counter is reset on success, on workspace switch (different key), by\n    // an explicit user retry path (e.g. selectWorkspace), or after the\n    // cool-down window has elapsed since the last failure (so transient\n    // backend issues don't permanently wedge the dropdown).\n    const failureEntry = projectSyncFailuresRef.current.get(currentWorkspaceId);\n    if (\n      failureEntry &&\n      failureEntry.count >= PROJECT_SYNC_MAX_FAILURES &&\n      Date.now() - failureEntry.lastFailureAt < PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      return;\n    }\n    if (\n      failureEntry &&\n      Date.now() - failureEntry.lastFailureAt >=\n        PROJECT_SYNC_FAILURE_COOLDOWN_MS\n    ) {\n      // Cool-down elapsed — clear the counter so we get a fresh budget.\n      projectSyncFailuresRef.current.delete(currentWorkspaceId);\n    }\n\n    // Resolve organizationId: prefer the workspace object (if loaded), fall\n    // back to the persisted currentOrganizationId.  The workspaces array is\n    // NOT persisted by zustand, so on page reload it is empty until\n    // fetchOrganizations() completes.  Using the persisted org ID lets us\n    // issue the workspace token immediately instead of waiting.\n    const currentWorkspace = workspaces.find(\n      (ws) => ws.id === currentWorkspaceId,\n    );\n\n    // Guard: transient (newOrg, oldWs) divergence during org switches — token issuance always fails.\n    if (\n      currentWorkspace &&\n      currentOrganizationId &&\n      currentWorkspace.organizationId !== currentOrganizationId\n    ) {\n      return;\n    }\n\n    const organizationId =\n      currentWorkspace?.organizationId ?? currentOrganizationId;\n    if (!organizationId) return;\n\n    const store = useAuthStore.getState();\n\n    // If we don't have a workspace token or it's expired, issue one first\n    const needsToken =\n      !workspaceToken ||\n      isTokenExpired(workspaceToken) ||\n      !isWorkspaceTokenValidForContext(workspaceToken, {\n        workspaceId: currentWorkspaceId,\n        organizationId: currentOrganizationId,\n        projectId: currentProjectId,\n      });\n\n    // Skip if projects are already loaded for this workspace AND token is valid\n    const hasProjectsForWorkspace = projects.some(\n      (p) => p.workspaceId === currentWorkspaceId,\n    );\n    if (hasProjectsForWorkspace && !needsToken) {\n      if (!store.currentProjectId) {\n        const firstProject = projects.find(\n          (project) => project.workspaceId === currentWorkspaceId,\n        );\n        if (firstProject) {\n          store.setCurrentProjectId(firstProject.id);\n        }\n      }\n      return;\n    }\n\n    const syncProjects = async () => {\n      syncInProgressRef.current = true;\n      store.setLoadingProjects(true);\n      let succeeded = false;\n\n      try {\n        let wsToken = workspaceToken;\n\n        // Issue workspace token if needed\n        if (needsToken) {\n          const tokenResult = await graphqlFetch<{\n            issueWorkspaceToken: IssueWorkspaceTokenResult;\n          }>({\n            gateway: \"workspace\",\n            query: ISSUE_WORKSPACE_TOKEN_MUTATION,\n            variables: {\n              input: {\n                organizationId,\n                workspaceId: currentWorkspaceId,\n                ...(currentProjectId ? { projectId: currentProjectId } : {}),\n              },\n            },\n            authToken: accessToken,\n            baseUrl: workspaceBaseUrl,\n            // See issueWorkspaceToken: send the current workspace's tenant so a\n            // super_admin (no tenant claim) can resolve it for an unmirrored ws.\n            tenantId: workspaces.find((ws) => ws.id === currentWorkspaceId)\n              ?.tenantId,\n          });\n\n          if (\n            tokenResult.data?.issueWorkspaceToken?.success &&\n            tokenResult.data.issueWorkspaceToken.token\n          ) {\n            wsToken = tokenResult.data.issueWorkspaceToken.token;\n            store.setWorkspaceToken(wsToken);\n          } else {\n            return;\n          }\n        }\n\n        // Fetch projects (skip if already loaded or token-only sync requested)\n        if (wsToken && !hasProjectsForWorkspace && !skipProjectFetch) {\n          const projectsResult = await graphqlFetch<ProjectsResponse>({\n            gateway: \"workspace\",\n            query: PROJECTS_QUERY,\n            authToken: accessToken,\n            workspaceToken: wsToken,\n            baseUrl: workspaceBaseUrl,\n          });\n\n          if (projectsResult.errors?.length) {\n            return;\n          }\n\n          let projs: Project[] = projectsResult.data?.projects?.items ?? [];\n          if (projs.length === 0) {\n            const defaultProject = await createDefaultProject({\n              authToken: accessToken,\n              workspaceBaseUrl,\n              workspaceToken: wsToken,\n            });\n            if (defaultProject) {\n              projs = [defaultProject];\n            } else {\n              // Default-project creation failed (e.g. workspace not yet\n              // propagated to the workspace layer). Do NOT write [] back —\n              // that would change the projects reference and re-trigger\n              // this effect on the next render.\n              return;\n            }\n          }\n\n          store.setProjects(projs);\n\n          // Auto-select first project if none selected and projects exist\n          if (projs.length > 0 && !store.currentProjectId) {\n            store.setCurrentProjectId(projs[0].id);\n          }\n        }\n\n        succeeded = true;\n      } catch {\n        // A later auth/context update should be able to retry.\n      } finally {\n        store.setLoadingProjects(false);\n        syncInProgressRef.current = false;\n        const failures = projectSyncFailuresRef.current;\n        if (succeeded) {\n          failures.delete(currentWorkspaceId);\n          const pending = retryTimerRef.current.get(currentWorkspaceId);\n          if (pending) {\n            clearTimeout(pending);\n            retryTimerRef.current.delete(currentWorkspaceId);\n          }\n        } else {\n          const existing = failures.get(currentWorkspaceId);\n          const nextCount = (existing?.count ?? 0) + 1;\n          failures.set(currentWorkspaceId, {\n            count: nextCount,\n            lastFailureAt: Date.now(),\n          });\n          // Schedule a backoff retry for transient backend lag (e.g. RBAC\n          // role propagation right after signup → first projects() call hits\n          // permission-denied). Without this, the effect would only re-run on\n          // dep change and the user would be stuck staring at an empty\n          // project dropdown until something else triggered a re-render.\n          if (nextCount < PROJECT_SYNC_MAX_FAILURES) {\n            const existingTimer = retryTimerRef.current.get(currentWorkspaceId);\n            if (existingTimer) clearTimeout(existingTimer);\n            const backoffMs = Math.min(1000 * 2 ** (nextCount - 1), 8000);\n            const timer = setTimeout(() => {\n              retryTimerRef.current.delete(currentWorkspaceId);\n              // Only re-run if the workspace context is still the same and\n              // a project hasn't been loaded for it in the meantime.\n              const latest = useAuthStore.getState();\n              if (\n                latest.currentWorkspaceId === currentWorkspaceId &&\n                !latest.projects.some(\n                  (p) => p.workspaceId === currentWorkspaceId,\n                ) &&\n                !syncInProgressRef.current\n              ) {\n                // Bump a render by clearing then resetting workspaceToken\n                // when valid, OR by re-issuing projects fetch directly. The\n                // simplest robust trigger is to clear the in-progress guard\n                // and call syncProjects() again with current closure values.\n                void syncProjects();\n              }\n            }, backoffMs);\n            retryTimerRef.current.set(currentWorkspaceId, timer);\n          }\n        }\n      }\n    };\n\n    syncProjects();\n  }, [\n    currentWorkspaceId,\n    currentOrganizationId,\n    workspaces,\n    projects,\n    currentProjectId,\n    workspaceToken,\n    accessToken,\n    workspaceBaseUrl,\n    disableProjectSync,\n    skipProjectFetch,\n  ]);\n\n  // Cleanup any pending retry timers on unmount so we don't leak stray\n  // setTimeout callbacks running against stale closures.\n  useEffect(() => {\n    const timers = retryTimerRef.current;\n    return () => {\n      timers.forEach((timer) => clearTimeout(timer));\n      timers.clear();\n    };\n  }, []);\n}\n// hmr-bust-1778064429\n"],"mappings":";;;;;;;AAqFA,IAAM,IAAyB,2RAoCzB,IAA0B,oSAoB1B,IAAiC,6SA0BjC,IAAiB,uPAkBjB,IAAkC;AAexC,eAAe,EAAqB,EAClC,cACA,qBACA,qBAK0B;CAC1B,IAAM,IAAS,MAAM,EAAoC;EACvD,SAAS;EACT,OAAO;EACP,WAAW,EACT,OAAO,EACL,MAAM,mBACP,EACF;EACD;EACA;EACA,SAAS;EACV,CAAC;AAOF,QALI,EAAO,QAAQ,UACjB,QAAQ,KAAK,qCAAqC,EAAO,OAAO,EACzD,QAGF,EAAO,MAAM,iBAAiB;;AAWvC,SAAS,EAAe,GAAe,IAAW,KAAiB;AACjE,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AAErD,SADK,EAAQ,MACN,EAAQ,MAAM,MAAO,KAAK,KAAK,GAAG,IADhB;SAEnB;AACN,SAAO;;;AAIX,SAAS,EAAyB,GAKzB;AACP,KAAI;EACF,IAAM,IAAU,KAAK,MAAM,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,CAAC;AACrD,SAAO;GACL,aACE,OAAO,EAAQ,eAAgB,WAC3B,EAAQ,cACR,KAAA;GACN,gBACE,OAAO,EAAQ,kBAAmB,WAC9B,EAAQ,iBACR,KAAA;GACN,WACE,OAAO,EAAQ,aAAc,WAAW,EAAQ,YAAY,KAAA;GAC9D,KAAK,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,KAAA;GACtD;SACK;AACN,SAAO;;;AAIX,SAAS,EACP,GACA,GAKiB;AACjB,KAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO;CAGT,IAAM,IAAU,EAAyB,EAAM;AAoB/C,QAJA,EAfI,CAAC,KAID,EAAS,eAAe,EAAQ,gBAAgB,EAAS,eAK3D,EAAS,kBACT,EAAQ,mBAAmB,EAAS,kBAKlC,EAAS,aAAa,EAAQ,cAAc,EAAS;;AAa3D,IAAM,IAAN,cAAwB,MAAM;CAC5B,YAAY,GAAiB;AAE3B,EADA,MAAM,EAAQ,EACd,KAAK,OAAO;;;AAOhB,SAAS,EACP,GACS;AACT,QAAO,EAAO,MACX,MACC,EAAE,YAAY,SAAS,qBACvB,EAAE,SAAS,aAAa,CAAC,SAAS,eAAe,IACjD,EAAE,SAAS,aAAa,CAAC,SAAS,oBAAoB,CACzD;;AASH,SAAS,IAAoC;CAC3C,IAAM,IAAa,EAAa,UAAU,CAAC;AAG3C,KAAI,KAAc,CAAC,EAAe,EAAW,CAC3C,QAAO;CAIT,IAAM,IAAe,GAAoB;AAQzC,QAPI,KAAgB,CAAC,EAAe,EAAa,GACxC,IAMF;;AAGT,SAAS,EAA2B,GAAyC;AAS3E,QARqB,MAAM,KACzB,IAAI,IACF,EAAW,SAAS,MAClB,EAAU,iBAAiB,CAAC,EAAU,eAAe,GAAG,EAAE,CAC3D,CACF,CACF,CAEmB,KAAK,GAAgB,OAAW;EAClD,IAAI;EACJ,MACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,QAAQ,gBAAgB,IAAQ;EACrC,MAAM;EACN,UACE,EAAW,MACR,MAAc,EAAU,mBAAmB,EAC7C,EAAE,YAAY;EAClB,EAAE;;AAuBL,IAAM,IAAyB,IAAI,IAAY;CAC7C;CACA;CACA;CACA;CACA;CACD,CAAC,EACI,IAA2B,IAAI,IAAY;CAC/C;CACA;CACA;CACA;CACA;CACD,CAAC;AAKF,SAAS,EAAqB,GAAsC;AAClE,KAAI,KAAW,OAAO,KAAY,YAAY,iBAAiB,GAAS;EACtE,IAAM,IAAS,EAAsC;AACrD,SAAO,OAAO,KAAU,WAAW,IAAQ,KAAA;;;AAK/C,SAAgB,EACd,GACA;CACA,IAAM,EACJ,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,YAAY,MACV,GAAkB,EAEhB,IAAW,GAAa,EAGxB,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAyB,GAC5B,MAAU,EAAM,uBAClB,EAEK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,IAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAsB,GACzB,MAAU,EAAM,oBAClB,EAEK,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAoB,GAAc,MAAU,EAAM,kBAAkB,EAGpE,CAAC,IAAO,KAAY,EAAwB,KAAK,EAGjD,IAA+B,EACnC,KACD,EACK,IAA6B,kBACjC,IAAI,KAAK,CACV,EAKK,IAAuB,EAAO,EAAkB,EAChD,IAA0B,EAAO,EAAqB;AAC5D,SAAgB;AAEd,EADA,EAAqB,UAAU,GAC/B,EAAwB,UAAU;GAClC;CAEF,IAAM,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IACJ,GAAS,oBAAoB,EAAiB,kBAS1C,IAAsB,EAAsB,KAAK,EACjD,IAA4B,EAAsB,KAAK,EACvD,IAA0B,EAAsB,KAAK,EACrD,IAA6B,EAAsB,KAAK;AAE9D,SAAgB;EACd,IAAM,IAAQ,EAAa,UAAU;AA8CrC,MA3CE,KACA,MAAyB,EAAM,yBAC/B,MAAyB,EAAoB,YAE7C,EAAoB,UAAU,GAC9B,EAAM,yBAAyB,EAAqB,EAElD,EAAM,WAAW,SAAS,KAC1B,CAAC,EAAM,WAAW,MACf,MAAc,EAAU,mBAAmB,EAC7C,IAED,EAAM,cAAc,EAAE,CAAC,GAKzB,KACA,MAAsB,EAAM,sBAC5B,MAAsB,EAA0B,YAEhD,EAA0B,UAAU,GACpC,EAAM,sBAAsB,EAAkB,EAE5C,EAAM,SAAS,SAAS,KACxB,CAAC,EAAM,SAAS,MACb,MAAY,EAAQ,gBAAgB,EACtC,KAED,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,IAKjC,KACA,MAAoB,EAAM,oBAC1B,MAAoB,EAAwB,YAE5C,EAAwB,UAAU,GAClC,EAAM,oBAAoB,EAAgB,GAI1C,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EACF;GAOA,IAAM,IAAS,GAAG,KAAwB,GAAG,GAAG,KAAqB,GAAG,GAAG,KAAmB;AAC9F,GAAI,EAA2B,YAAY,MACzC,EAA2B,UAAU,GACrC,EAAM,kBAAkB,KAAK;;IAGhC;EAAC;EAAsB;EAAmB;EAAgB,CAAC;CAM9D,IAAM,KAAqB,EAAY,YAAqC;AAE1E,MAAI,EAA6B,QAC/B,QAAO,EAA6B;EAGtC,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AA+UlC,SA7UI,CAAC,KASD,EAAe,EAAM,GAChB,EAAE,IAGX,EAAM,wBAAwB,GAAK,EACnC,EAAS,KAAK,EAGd,EAA6B,WAAW,YAAY;AAClD,OAAI;IACF,IAAM,IACJ,EAAwB,WAAW,EAAM,uBACvC,IAEA,IACA,OAAO,YAAY;KACjB,IAAM,CAAC,GAAqB,KAAoB,MAAM,QAAQ,IAC5D,CACE,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC,EACF,EAAsC;MACpC,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC,CACH,CACF;AAWD,YAAO;MACL,MAVW,EAAoB,MAAM,kBACnC;OACE,iBAAiB,EAAoB,KAAK;OAC1C,GAAI,EAAiB,MAAM,aACvB,EAAE,YAAY,EAAiB,KAAK,YAAY,GAChD,EAAE;OACP,GACD;MAIF,QAAQ,CACN,GAAI,EAAoB,UAAU,EAAE,EACpC,GAAI,EAAiB,UAAU,EAAE,CAClC;MACF;QACC,GACJ,MAAM,EAAsC;KAC1C,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;KACV,CAAC;AAkDN,QA3CE,KACA,EAAO,QAAQ,UACf,EAAO,OAAO,MACX,MACC,GAAG,YAAY,SAAS,eACxB,qCAAqC,KAAK,GAAG,WAAW,GAAG,IAO3D,oEAAoE,KAClE,GAAG,WAAW,GACf,CACJ,KAOD,IAAS,MAAM,EAEb;KACA,SAAS;KACT,OAAO;KAYP,WAAW;KACX,SAAS;KACV,CAAC,GAGA,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AASlD,WARI,EAAmB,EAAO,OAAO,GAG7B,IAAI,EAAU,EAAa,IAE/B,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAO,OAAO,EAEtD,MAAM,EAAa;;IAG/B,IAAI,IAAuB,EAAO,MAAM,iBAAiB,SAAS,EAAE;AASpE,QACE,KACA,EAAK,WAAW,KAChB,EAAM,WAAW,WAAW,GAC5B;KACA,IAAM,IAAW,MAAM,EAAsC;MAC3D,SAAS;MACT,OAAO;MACP,WAAW;MACX,SAAS;MACV,CAAC;AACF,KAAK,EAAS,QAAQ,SAkBpB,QAAQ,KACN,oDACA,EAAS,OACV,IApBD,IAAO,EAAS,MAAM,iBAAiB,SAAS,EAAE,EAGlD,IAAS;MACP,GAAG;MACH,MAAM,EACJ,iBAAiB,EAAS,MAAM,mBAAmB;OACjD,OAAO,EAAE;OACT,OAAO;OACR,EACF;MACF;;IAaL,IAAM,IACJ,EAAK,WAAW,KAAK,EAAM,WAAW,SAAS,IAC3C,EAA2B,EAAM,WAAW,GAC5C,EAAE,EACF,IACJ,EAAsB,SAAS,IAAI,IAAwB;AAE7D,MAAM,iBAAiB,EAAuB;IAG9C,IAAI,IAAc,GAaZ,IACJ,KAAe,EAAK,MAAM,MAAQ,EAAI,OAAO,EAAY;AAkC3D,QAjCI,KAAe,CAAC,KAAyB,EAAK,SAAS,MACzD,IAAc,EAAK,GAAG,IACtB,EAAiB;KACf,gBAAgB;KAChB,aAAa;KACb,UAAU;KACV,WAAW;KACZ,CAAC,EACF,EAAM,cAAc,EAAE,CAAC,EACvB,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,sBAAsB,KAAK,EACjC,EAAM,oBAAoB,KAAK,EAC/B,EAAM,kBAAkB,KAAK,GAG3B,KAAe,MAAgB,EAAM,yBACvC,EAAM,yBAAyB,EAAY,EAIzC,EAAuB,SAAS,KAAK,CAAC,MACxC,EAAM,yBAAyB,EAAuB,GAAG,GAAG,EAC5D,IAAc,EAAuB,GAAG,KAWtC,KAAe,EAAa,UAAU,CAAC,WAAW,WAAW,GAAG;AAClE,OAAM,qBAAqB,GAAK;AAChC,SAAI;MAGF,IAMM,KALJ,MAAuB,IACnB,EAAO,MAAM,YAAY,OAAO,QAC7B,MAAM,EAAE,mBAAmB,EAC7B,GACD,KAAA,MAGF,MAAM,EAAsC;OAC1C,SAAS;OACT,OAAO;OACP,WAAW;OACX,SAAS;OACV,CAAC,CAAC,MAAM,MACP,EAAS,QAAQ,SACb,QACC,EAAS,MAAM,YAAY,SAAS,EAAE,EAAE,QACtC,MAAM,EAAE,mBAAmB,EAC7B,CACN;AAEL,UAAI,GAAI;AACN,SAAM,cAAc,EAAG;OACvB,IAAM,IAAqB,EAAqB,UAC5C,EAAG,MACA,MACC,EAAU,OAAO,EAAqB,QACzC,GACD;AAEJ,WAAI,EACF,GAAM,sBAAsB,EAAmB,GAAG;gBACzC,EAAG,SAAS,GAAG;QACxB,IAAM,IAAoB;SACxB,gBAAgB;SAChB,aAAa,EAAG,GAAG;SACnB,UAAU,EAAG,GAAG;SAChB,WAAW;SACZ;AAED,QAAI,EAAqB,WAKvB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAM,kBAAkB,KAAK,EAC7B,EAAiB,EAAkB,IACzB,EAAM,uBAGhB,EAAM,sBAAsB,EAAG,GAAG,GAAG,EACrC,EAAiB,EAAkB;;;aAInC,WAEE;AACR,QAAM,qBAAqB,GAAM;;;AAIrC,WAAO;YACA,GAAK;AAIZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAMvC,QALI,EAAM,WAAW,WAAW,KAC9B,QAAQ,MAAM,kCAAkC,EAAI,EAEtD,EAAS,EAAQ,EAEb,EAAM,WAAW,SAAS,GAAG;KAC/B,IAAM,IAAwB,EAC5B,EAAM,WACP;AACD,SAAI,EAAsB,SAAS,EAKjC,QAJA,EAAM,iBAAiB,EAAsB,EACxC,EAAM,yBACT,EAAM,yBAAyB,EAAsB,GAAG,GAAG,EAEtD;;AAIX,WAAO,EAAE;aACD;AAER,IADA,EAAM,wBAAwB,GAAM,EACpC,EAA6B,UAAU;;MAEvC,EAEG,EAA6B;IACnC,CAAC,GAAe,EAAiB,CAAC,EAM/B,IAAwB,EAC5B,OAAO,MAAiD;EAEtD,IAAM,IACJ,EAA2B,QAAQ,IAAI,EAAe;AACxD,MAAI,EACF,QAAO;EAGT,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAQ,GAAoB;AAElC,MAAI,CAAC,KAAS,EAAe,EAAM,CACjC,QAAO,EAAE;AAIX,EADA,EAAM,qBAAqB,GAAK,EAChC,EAAS,KAAK;EAGd,IAAM,KAAgB,YAAY;AAChC,OAAI;IACF,IAAM,IAAS,MAAM,EAAsC;KACzD,SAAS;KACT,OAAO;KACP,WAAW;KACX,SAAS;KACV,CAAC;AASF,QANI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAGC,EAAO,QAAQ,QAAQ;KACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,WAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,+BAA+B,EAAO,OAAO,EACjD,MAAM,EAAa;;IAY/B,IAAM,KADqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAC9C,QAAQ,MAAM,EAAE,mBAAmB,EAAe;AAEnE,WADA,EAAM,cAAc,EAAG,EAChB;YACA,GAAK;AACZ,QAAI,aAAe,EACjB,QAAO,EAAE;IAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,WAFA,QAAQ,MAAM,+BAA+B,EAAI,EACjD,EAAS,EAAQ,EACV,EAAE;aACD;AAER,IADA,EAAM,qBAAqB,GAAM,EACjC,EAA2B,QAAQ,OAAO,EAAe;;MAEzD;AAGJ,SADA,EAA2B,QAAQ,IAAI,GAAgB,EAAa,EAC7D;IAET,CAAC,EAAc,CAChB,EAMK,IAAsB,EAC1B,OACE,GACA,GACA,GAKA,MAMI;EACJ,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB;AAEtC,MAAI,CAAC,KAAa,EAAe,EAAU,CACzC,QAAO;GAAE,SAAS;GAAO,OAAO;GAAmC;AAGrE,IAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAElB;IACD,SAAS;IACT,OAAO;IACP,WAAW,EACT,OAAO;KACL;KACA,GAAI,KAAe,EAAE,gBAAa;KAClC,GAAI,KAAa,EAAE,cAAW;KAC/B,EACF;IACD;IACA,SAAS;IACT;IACD,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAIlD,WAHK,EAAmB,EAAO,OAAO,IACpC,QAAQ,MAAM,oCAAoC,EAAO,OAAO,EAE3D;KAAE,SAAS;KAAO,OAAO;KAAc;;GAGhD,IAAM,IAAc,EAAO,MAAM;AAEjC,OAAI,GAAa,WAAW,EAAY,OAAO;IAC7C,IAAM,IAAe,EAAY,eAAe;AAKhD,WAJI,KACF,EAAM,sBAAsB,EAAa,EAE3C,EAAM,kBAAkB,EAAY,MAAM,EACnC;KACL,SAAS;KACT,OAAO,EAAY;KACnB,qBAAqB,KAAgB,KAAA;KACtC;;AAGH,UAAO;IACL,SAAS;IACT,OACE,GAAa,OAAO,WAAW;IAClC;WACM,GAAK;GACZ,IAAM,IACJ,aAAe,QACX,EAAI,UACJ;AAGN,UAFA,QAAQ,MAAM,oCAAoC,EAAI,EACtD,EAAS,EAAQ,EACV;IAAE,SAAS;IAAO,OAAO;IAAS;;IAG7C,CAAC,EAAiB,CACnB,EAMK,IAAgB,EAAY,YAAgC;EAChE,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAY,GAAoB,EAChC,IAAU,EAAM,gBAChB,IAAc,EAAM;AAU1B,MARI,CAAC,KAAa,EAAe,EAAU,IAIvC,CAAC,KAID,CAAC,EACH,QAAO,EAAE;AAIX,EADA,EAAM,mBAAmB,GAAK,EAC9B,EAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAS,MAAM,EAA+B;IAClD,SAAS;IACT,OAAO;IACP;IACA,gBAAgB;IAChB,SAAS;IACV,CAAC;AAEF,OAAI,EAAO,QAAQ,QAAQ;IACzB,IAAM,IAAe,EAAO,OAAO,IAAI,WAAW;AAKlD,UAJI,EAAmB,EAAO,OAAO,GAC7B,IAAI,EAAU,EAAa,IAEnC,QAAQ,MAAM,6BAA6B,EAAO,OAAO,EAC/C,MAAM,EAAa;;GAG/B,IAAM,IAAmB,EAAO,MAAM,UAAU,SAAS,EAAE;AAE3D,UADA,EAAM,YAAY,EAAM,EACjB;WACA,GAAK;AACZ,OAAI,aAAe,EACjB,QAAO,EAAE;GAEX,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAGvC,UAFA,QAAQ,MAAM,6BAA6B,EAAI,EAC/C,EAAS,EAAQ,EACV,EAAE;YACD;AACR,KAAM,mBAAmB,GAAM;;IAEhC,CAAC,EAAiB,CAAC,EAMhB,KAAqB,EACzB,OAAO,MAA4C;EACjD,IAAM,IAAQ,EAAa,UAAU;AASrC,SAPA,EAAM,sBAAsB,KAAK,EACjC,EAAM,kBAAkB,KAAK,EAC7B,EAAM,YAAY,EAAE,CAAC,EACrB,EAAM,oBAAoB,KAAK,EAC/B,EAAM,yBAAyB,EAAI,GAAG,EAE3B,MAAM,EAAsB,EAAI,GAAG;IAGhD,CAAC,EAAsB,CACxB,EAEK,KAAkB,EACtB,OACE,MAKI;EACJ,IAAM,IAAQ,EAAa,UAAU;AAKrC,MAHA,EAAM,oBAAoB,KAAK,EAC/B,EAAM,YAAY,EAAE,CAAC,EAEjB,CAAC,EAAU,eAEb,QADA,QAAQ,MAAM,qCAAqC,EAAU,EACtD;GACL,SAAS;GACT,OAAO;GACR;EAGH,IAAM,IAAc,MAAM,EACxB,EAAU,gBACV,EAAU,IACV,KAAA,GACA,EAAU,SACX;AAED,MAAI,CAAC,EAAY,QACf,QAAO;GAAE,SAAS;GAAO,OAAO,EAAY;GAAO;EAGrD,IAAI,IAAQ,MAAM,GAAe;AACjC,MAAI,EAAM,WAAW,GAAG;GACtB,IAAM,IAAY,GAAoB,EAChC,IAAiB,EAAa,UAAU,CAAC;AAC/C,OAAI,KAAa,GAAgB;IAC/B,IAAM,IAAiB,MAAM,EAAqB;KAChD;KACA;KACA;KACD,CAAC;AACF,IAAI,MACF,IAAQ,CAAC,EAAe,EACxB,EAAM,YAAY,EAAM;;;AAS9B,SAJI,EAAM,SAAS,KACjB,EAAM,oBAAoB,EAAM,GAAI,GAAG,EAGlC;GAAE,SAAS;GAAM,UAAU;GAAO;IAE3C;EAAC;EAAqB;EAAe;EAAiB,CACvD,EAEK,KAAgB,GAAa,MAA2B;EAC5D,IAAM,IAAQ,EAAa,UAAU;AAErC,EADA,EAAM,oBAAoB,EAAQ,GAAG,EAEnC,EAAM,kBACN,CAAC,EAAgC,EAAM,gBAAgB;GACrD,aAAa,EAAM;GACnB,gBAAgB,EAAM;GACtB,WAAW,EAAQ;GACpB,CAAC,IAEF,EAAM,kBAAkB,KAAK;IAE9B,EAAE,CAAC;AA+FN,QAtFA,QAAgB;EACd,IAAI,IAAY,IAMV,KAAwB,MAAgC;GAC5D,IAAI,IAAU,IACV,IAAS,IACP,UAAgB;AAChB,YACJ;SAAI,GAAS;AACX,UAAS;AACT;;AAGG,KADL,IAAU,IACL,GAAK,CAAC,cAAc;AAEvB,MADA,IAAU,IACN,CAAC,KAAa,MAChB,IAAS,IACT,GAAS;OAEX;;;AAEJ,UAAO;KAGH,IAAkB,QAA2B,GAAe,CAAC,EAC7D,IAAoB,QAA2B;GACnD,IAAM,IAAQ,EAAa,UAAU,CAAC;AACtC,UAAO,IAAQ,EAAsB,EAAM,GAAG,QAAQ,SAAS;IAC/D,EAGI,IAAc,EAAS,OAAO,MAAU;GAE5C,IAAM,IAAoB,EAAM;AAEhC,OAAI,EAAuB,IAAI,EAAU,EAAE;IACzC,IAAM,IAAmB,EAAqB,EAAM,QAAQ,EACtD,EAAE,0BAAuB,EAAa,UAAU;AAGtD,QACE,KACA,KACA,MAAqB,EAErB;AAMF,OAAiB;AACjB;;AAGF,GAAI,EAAyB,IAAI,EAAU,IACzC,GAAmB;IAErB;AAEF,eAAa;AAEX,GADA,IAAY,IACZ,GAAa;;IAEd;EAAC;EAAU;EAAe;EAAsB,CAAC,EAkB7C;EACL;EACA;EACA;EAEA;EACA;EACA;EAEA,qBArB0B,EAAc,MACvC,MAAQ,EAAI,OAAO,EACrB;EAoBC,kBAnBuB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;EAkBC,gBAjBqB,EAAS,MAAM,MAAS,EAAK,OAAO,EAAiB;EAmB1E;EAEA;EACA;EACA;EACA,WACE,KAA0B,KAAuB;EAEnD;EAEA;EACA;EACA;EACA;EAEA;EACA;EACA;EACD;;AAmBH,SAAgB,EACd,GACA;CACA,IAAM,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAsB,GACzB,MAAU,EAAM,oBAClB,EACK,IAAmB,GAAwB,EAC3C,IACJ,GAAS,iBAAiB,EAAiB,eACvC,IAAuB,GAAS,wBAAwB;AAE9D,SAAgB;AAGd,MAFI,KAEA,CAAC,KAAyB,CAAC,KAAe,EAAqB;EAGnE,IAAM,IAAwB,EAAW,MACtC,MAAO,EAAG,mBAAmB,EAC/B;AAID,MAAI,EAAW,SAAS,KAAK,CAAC,GAAuB;GACnD,IAAM,IAAQ,EAAa,UAAU;AAIrC,GAHA,EAAM,qBAAqB,GAAK,EAGhC,EAAsC;IACpC,SAAS;IACT,OAAO;IACP,WAAW;IACX,SAAS;IACV,CAAC,CACC,MAAM,MAAW;AAQhB,QALI,EAAO,MAAM,YAAY,UAC3B,EAAO,KAAK,WAAW,QAAQ,EAAO,KAAK,WAAW,MAAM,QACzD,MAAM,EAAE,mBAAmB,EAC7B,GAEC,CAAC,EAAO,QAAQ,QAAQ;KAK1B,IAAM,KAJqB,EAAO,MAAM,YAAY,SAAS,EAAE,EAI9C,QACd,MAAM,EAAE,mBAAmB,EAC7B;AACD,OAAM,cAAc,EAAG;;KAEzB,CACD,YAAY,GAEX,CACD,cAAc;AACb,MAAM,qBAAqB,GAAM;KACjC;;IAEL;EACD;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;;AAqBJ,SAAgB,EAAqB,GAAyC;CAC5E,IAAM,IAAqB,GAAc,MAAU,EAAM,mBAAmB,EACtE,IAAwB,GAC3B,MAAU,EAAM,sBAClB,EACK,IAAa,GAAc,MAAU,EAAM,WAAW,EACtD,IAAW,GAAc,MAAU,EAAM,SAAS,EAClD,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,IAAiB,GAAc,MAAU,EAAM,eAAe,EAC9D,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAAmB,GAAwB,EAC3C,IACJ,GAAS,oBAAoB,EAAiB,kBAC1C,IAAqB,GAAS,sBAAsB,IACpD,IAAmB,GAAS,oBAAoB,IAOhD,IAAoB,EAAO,GAAM,EAIjC,IAAgB,kBACpB,IAAI,KAAK,CACV,EAYK,IAAyB,kBAE7B,IAAI,KAAK,CAAC,EAEN,IAAmC;AAyOzC,CAxOA,QAAgB;AAMd,MALI,KAEA,CAAC,KAAsB,CAAC,KAGxB,EAAkB,QAAS;EAO/B,IAAM,IAAe,EAAuB,QAAQ,IAAI,EAAmB;AAC3E,MACE,KACA,EAAa,SAAS,KACtB,KAAK,KAAK,GAAG,EAAa,gBAAgB,EAE1C;AAEF,EACE,KACA,KAAK,KAAK,GAAG,EAAa,iBACxB,KAGF,EAAuB,QAAQ,OAAO,EAAmB;EAQ3D,IAAM,IAAmB,EAAW,MACjC,MAAO,EAAG,OAAO,EACnB;AAGD,MACE,KACA,KACA,EAAiB,mBAAmB,EAEpC;EAGF,IAAM,IACJ,GAAkB,kBAAkB;AACtC,MAAI,CAAC,EAAgB;EAErB,IAAM,IAAQ,EAAa,UAAU,EAG/B,IACJ,CAAC,KACD,EAAe,EAAe,IAC9B,CAAC,EAAgC,GAAgB;GAC/C,aAAa;GACb,gBAAgB;GAChB,WAAW;GACZ,CAAC,EAGE,IAA0B,EAAS,MACtC,MAAM,EAAE,gBAAgB,EAC1B;AACD,MAAI,KAA2B,CAAC,GAAY;AAC1C,OAAI,CAAC,EAAM,kBAAkB;IAC3B,IAAM,IAAe,EAAS,MAC3B,MAAY,EAAQ,gBAAgB,EACtC;AACD,IAAI,KACF,EAAM,oBAAoB,EAAa,GAAG;;AAG9C;;EAGF,IAAM,IAAe,YAAY;AAE/B,GADA,EAAkB,UAAU,IAC5B,EAAM,mBAAmB,GAAK;GAC9B,IAAI,IAAY;AAEhB,OAAI;IACF,IAAI,IAAU;AAGd,QAAI,GAAY;KACd,IAAM,IAAc,MAAM,EAEvB;MACD,SAAS;MACT,OAAO;MACP,WAAW,EACT,OAAO;OACL;OACA,aAAa;OACb,GAAI,IAAmB,EAAE,WAAW,GAAkB,GAAG,EAAE;OAC5D,EACF;MACD,WAAW;MACX,SAAS;MAGT,UAAU,EAAW,MAAM,MAAO,EAAG,OAAO,EAAmB,EAC3D;MACL,CAAC;AAEF,SACE,EAAY,MAAM,qBAAqB,WACvC,EAAY,KAAK,oBAAoB,MAGrC,CADA,IAAU,EAAY,KAAK,oBAAoB,OAC/C,EAAM,kBAAkB,EAAQ;SAEhC;;AAKJ,QAAI,KAAW,CAAC,KAA2B,CAAC,GAAkB;KAC5D,IAAM,IAAiB,MAAM,EAA+B;MAC1D,SAAS;MACT,OAAO;MACP,WAAW;MACX,gBAAgB;MAChB,SAAS;MACV,CAAC;AAEF,SAAI,EAAe,QAAQ,OACzB;KAGF,IAAI,IAAmB,EAAe,MAAM,UAAU,SAAS,EAAE;AACjE,SAAI,EAAM,WAAW,GAAG;MACtB,IAAM,IAAiB,MAAM,EAAqB;OAChD,WAAW;OACX;OACA,gBAAgB;OACjB,CAAC;AACF,UAAI,EACF,KAAQ,CAAC,EAAe;UAMxB;;AAOJ,KAHA,EAAM,YAAY,EAAM,EAGpB,EAAM,SAAS,KAAK,CAAC,EAAM,oBAC7B,EAAM,oBAAoB,EAAM,GAAG,GAAG;;AAI1C,QAAY;WACN,WAEE;AAER,IADA,EAAM,mBAAmB,GAAM,EAC/B,EAAkB,UAAU;IAC5B,IAAM,IAAW,EAAuB;AACxC,QAAI,GAAW;AACb,OAAS,OAAO,EAAmB;KACnC,IAAM,IAAU,EAAc,QAAQ,IAAI,EAAmB;AAC7D,KAAI,MACF,aAAa,EAAQ,EACrB,EAAc,QAAQ,OAAO,EAAmB;WAE7C;KAEL,IAAM,KADW,EAAS,IAAI,EAAmB,EACpB,SAAS,KAAK;AAU3C,SATA,EAAS,IAAI,GAAoB;MAC/B,OAAO;MACP,eAAe,KAAK,KAAK;MAC1B,CAAC,EAME,IAAY,GAA2B;MACzC,IAAM,IAAgB,EAAc,QAAQ,IAAI,EAAmB;AACnE,MAAI,KAAe,aAAa,EAAc;MAC9C,IAAM,IAAY,KAAK,IAAI,MAAO,MAAM,IAAY,IAAI,IAAK,EACvD,IAAQ,iBAAiB;AAC7B,SAAc,QAAQ,OAAO,EAAmB;OAGhD,IAAM,IAAS,EAAa,UAAU;AACtC,OACE,EAAO,uBAAuB,KAC9B,CAAC,EAAO,SAAS,MACd,MAAM,EAAE,gBAAgB,EAC1B,IACD,CAAC,EAAkB,WAMd,GAAc;SAEpB,EAAU;AACb,QAAc,QAAQ,IAAI,GAAoB,EAAM;;;;;AAM5D,KAAc;IACb;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAIF,QAAgB;EACd,IAAM,IAAS,EAAc;AAC7B,eAAa;AAEX,GADA,EAAO,SAAS,MAAU,aAAa,EAAM,CAAC,EAC9C,EAAO,OAAO;;IAEf,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/microfe-auth",
-  "version": "2026.708.1",
+  "version": "2026.710.2",
   "description": "Auth microfrontend for Burdenoff products",
   "type": "module",
   "imports": {