| 272 | * (same-owner connects, or sessions written before this field), so `complete` |
| 273 | * falls back to the session owner. */ |
| 274 | const clientOwnerFromPayload = (payload: unknown): Owner | null => { |
| 275 | const decoded = |
| 276 | typeof payload === "string" |
| 277 | ? decodeJsonPayload(payload).pipe(Option.getOrElse(() => payload)) |
| 278 | : payload; |
| 279 | if (decoded === null || typeof decoded !== "object") return null; |
| 280 | const value = (decoded as Record<string, unknown>).clientOwner; |
| 281 | return value === "user" || value === "org" ? value : null; |
| 282 | }; |
| 283 | |
| 284 | /** Narrow a stored `grant` string to the `OAuthGrant` union, or `null` when the |
| 285 | * value is neither known grant. EXPLICIT — there is no silent fallback to |