| 106 | * client derives from the console URL (identities minted with an org carry |
| 107 | * it; org-scoped reads fail closed without one). */ |
| 108 | const orgSelectorOf = (identity: Identity): string => { |
| 109 | const selector = identity.headers?.[ORG_SELECTOR_HEADER]; |
| 110 | if (!selector) throw new Error(`identity ${identity.label} carries no org selector header`); |
| 111 | return selector; |
| 112 | }; |
| 113 | |
| 114 | /** Invite `member` into `admin`'s org and accept — the real invite flow. |
| 115 | * Returns the member identity with its requests scoped to that org. */ |