// ---------------------------------------------------------------------------// Last-visited-org cookie — the browser's "which org was I working in" memory.//// Org switching is stateless by design (the URL slug scopes every request; see// organization.ts), which leaves nothing that remembers the last org across// entries: the sealed session still carries the org pinned at LOGIN time, so a// bare URL (`executor.sh/`) would always canonicalize onto that first org. This// cookie fills the gap: the client records the slug of the org it's verifiably// viewing, and the two bare-entry deciders honor it —////   - the document auth gate redirects bare document paths onto it (doc-gate.ts)//   - the login callback prefers it when picking the org for a fresh session//     with a bare returnTo (handlers.ts)//// It is a PREFERENCE, never an authority: both readers re-check live membership// through the same authorize path as any org selector, so a stale or forged// value at worst falls back to today's behavior. Not HttpOnly — the client is// the writer. Deliberately NOT cleared on logout: surviving the session is what// lets the next login land on the last-used org.// --------------------------------------------------------------------------- export const LAST_ORG_COOKIE = "executor-last-org"; /** Outlives the 7d session on purpose — it spans logins. */const LAST_ORG_MAX_AGE_SECONDS = 60 * 60 * 24 * 365; /** Browser-side write. Slugs are `[a-z0-9-]` by grammar, so no encoding. */export const writeLastOrgCookie = (slug: string): void => {  document.cookie = `${LAST_ORG_COOKIE}=${slug}; Path=/; Max-Age=${LAST_ORG_MAX_AGE_SECONDS}; SameSite=Lax${    window.location.protocol === "https:" ? "; Secure" : ""  }`;};