| 295 | * (same-owner connects, or sessions written before this field), so `complete` |
| 296 | * falls back to the session owner. */ |
| 297 | const clientOwnerFromPayload = (payload: unknown): Owner | null => { |
| 298 | const decoded = |
| 299 | typeof payload === "string" |
| 300 | ? decodeJsonPayload(payload).pipe(Option.getOrElse(() => payload)) |
| 301 | : payload; |
| 302 | if (decoded === null || typeof decoded !== "object") return null; |
| 303 | const value = (decoded as Record<string, unknown>).clientOwner; |
| 304 | return value === "user" || value === "org" ? value : null; |
| 305 | }; |
| 306 | |
| 307 | /** Narrow a stored `grant` string to the `OAuthGrant` union, or `null` when the |
| 308 | * value is neither known grant. EXPLICIT — there is no silent fallback to |