| 284 | * (same-owner connects, or sessions written before this field), so `complete` |
| 285 | * falls back to the session owner. */ |
| 286 | const clientOwnerFromPayload = (payload: unknown): Owner | null => { |
| 287 | const decoded = |
| 288 | typeof payload === "string" |
| 289 | ? decodeJsonPayload(payload).pipe(Option.getOrElse(() => payload)) |
| 290 | : payload; |
| 291 | if (decoded === null || typeof decoded !== "object") return null; |
| 292 | const value = (decoded as Record<string, unknown>).clientOwner; |
| 293 | return value === "user" || value === "org" ? value : null; |
| 294 | }; |
| 295 | |
| 296 | /** Narrow a stored `grant` string to the `OAuthGrant` union, or `null` when the |
| 297 | * value is neither known grant. EXPLICIT — there is no silent fallback to |