Function resolveAuthHint

apps/cloud/src/auth/doc-gate.ts:117–147

(
  session: VerifiedSession,
  cookieHeader: string | null,
)

 * fields (which would ping-pong with the client's authoritative write).
 */
const resolveAuthHint = async (
  session: VerifiedSession,
  cookieHeader: string | null,
): Promise<{ hint: AuthHint; mint: boolean }> => {
  const existing = decodeAuthHint(parseCookie(cookieHeader, AUTH_HINT_COOKIE));
  if (
    existing &&
    existing.user.id === session.userId &&
    (existing.organization?.id ?? null) === session.organizationId
  ) {
    return { hint: existing, mint: false };
  }
  return {
    hint: {
      v: 1,
      user: {
        id: session.userId,
        email: session.email,
        name: session.name,
        avatarUrl: session.avatarUrl,
      },
      organization: session.organizationId
        ? {
            id: session.organizationId,
            ...(await organizationDisplay(session.organizationId)),
          }
        : null,
    },
    mint: true,
  };
};

// The sealed session carries the org ID but not its name/slug; the local
// mirror has both (every org row is born with a slug — see