@pplethai/cli 0.6.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pplethai/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -26,7 +26,8 @@
     "@types/node": "^22.10.0",
     "esbuild": "^0.28.1",
     "typescript": "^5.8.0",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "yaml": "^2.9.1"
   },
   "engines": {
     "node": ">=22"

package/templates/golden-path/.dev.vars.example

@@ -3,11 +3,29 @@
 # settings below. `vite dev` and `wrangler dev` load `.dev.vars` automatically.
 
 # Which mock identity to sign in as locally. Defaults to "hq-staff".
-# Built-in personas: hq-staff, province-coordinator, platform-admin, delegate
+# Built-in personas: hq-staff, province-coordinator, platform-admin, delegate,
+# member (a party member with no role), unverified, kyc-pending,
+# kyc-verified-nonmember
 # (add your own in src/dev-personas.ts). Set to "none" to turn the bypass off
 # and exercise the real PPLE ID sign-in path locally.
+# On /.pple/registry/…, "none" or an unknown name sends no x-pple-identity
+# (the same as userToken: none). An unknown name does not fall back to
+# hq-staff on that path; /api still does.
 # DEV_PERSONA="province-coordinator"
 
+# Make offline callService return a platform refusal instead of a mock.
+# A code applies to every entry. provider/name=code applies to one entry
+# and wins over the global code. Separate several with commas.
+# invalid_app_key, not_listed, not_granted, needs_beta, user_token_invalid,
+# identity_unavailable, provider_unavailable, provider_timeout.
+# An unknown code is ignored.
+# DEV_REGISTRY_ERROR="needs_beta"
+# DEV_REGISTRY_ERROR="not_granted,shop/orders=provider_timeout"
+
+# Consumer slug reported on the emulated registry path. Defaults to
+# "dev-consumer". The entry id is dev-provider/<name>.
+# DEV_CONSUMER="brave-purple-lion"
+
 # Exercise the notification helper locally. These are normally injected by the
 # platform at deploy time.
 # NOTIFY_API_BASE="https://today.peoplesparty.or.th"

package/templates/golden-path/CLAUDE.md

@@ -31,12 +31,14 @@ which attach the PPLE ID bearer token. Same origin, so paths are relative
 Every `/api/*` request carries a PPLE ID bearer token; the Worker resolves it
 to an `Identity` (`src/auth.ts`, shape in `shared/api.ts`) with two faces:
 
-- **`actor`** — the real human clicking (`sub`, `name`, `mobile`). For audit
-  and display only.
-- **`effective`** — what they may do: `activeRole`, `eligibleRoles`,
-  `provinces` (scope), `extraRoles` (capabilities like `platform:admin`).
-  Under delegation `effective` holds the *supervisor's* values and
-  `effective.isDelegated` is true.
+- **`actor`** — the real human clicking (`sub`, `name`, `mobile`, `membership`).
+  For audit and display only. `membership` is `{ memberSince }` while the
+  party membership is active, and null otherwise.
+- **`effective`** — what they may do: `sub` (the person whose authority is
+  in effect), `activeRole`, `eligibleRoles`, `provinces` (scope), `extraRoles`
+  (capabilities like `platform:admin`). Under delegation these are the
+  *supervisor's* values, `effective.sub` is that person's PPLE ID sub (or null
+  when they have none), and `effective.isDelegated` is true.
 
 Where the token comes from:
 
@@ -47,9 +49,44 @@ Where the token comes from:
 - Locally (`npm run dev`) there is no login: the Worker signs you in as a mock
   **persona** (`DEV_PERSONA`, default `hq-staff` — see `src/dev-personas.ts`).
   To test a province-scoped feature use `DEV_PERSONA=province-coordinator`;
-  for delegation use `delegate`; for admin-only paths use `platform-admin`.
+  for delegation use `delegate`; for admin-only paths use `platform-admin`;
+  for a party member with no role use `member`.
   This bypass is gated on `import.meta.env.DEV`, so it is compiled out of the
   deployed Worker — there is nothing to set or unset for production.
+- A Service handler lives on `registry` in `src/index.ts`. Locally, curl
+  `/.pple/registry/<name>/…`. The dev wrapper sets `x-pple-consumer`
+  (`DEV_CONSUMER`, default `dev-consumer`), `x-pple-entry`
+  (`dev-provider/<name>`), and `x-pple-identity` from the active Persona.
+  `DEV_PERSONA=none` or an unknown persona name omits the Identity (as
+  `userToken: none` does) and does not fall back to `hq-staff` on this path.
+  Read the caller with `serviceCall(request)`. Tests call `callRegistry` from
+  `test/harness.ts`. An entry with no handler throws `registry handler missing`.
+  The wrapper is compiled out of the deployed Worker.
+- `callService` locally answers from `.pple/registry/<provider>/<name>/mocks/responses.json`
+  as the active persona (`x-pple-mock` names the entry). A `userToken: required`
+  entry called with no token is `user_token_invalid`. Nothing matched is
+  `no_mock` (404), dev-only, with a Thai message that names `pple registry`.
+  `DEV_REGISTRY_ERROR` (`<code>` or `<provider>/<name>=<code>`, commas) returns
+  that platform refusal instead. A persona added in `dev-personas.ts` only
+  hits cases that name no persona. `DEV_PERSONA=none` calls the real service.
+  Vitest uses the injected fetch and does not read the overlay. The overlay
+  glob keeps `.pple/registry` in its fixed base, and the whole path is
+  compiled out of the deployed Worker. `getLegalIdentity` still uses its own
+  offline answer.
+- `readDataset(env, entry, objectType, options)` reads a Dataset Object Type.
+  A collection page is `{ objects, next, sweptAt, snapshot }`; a singleton or
+  an id lookup is `{ object, sweptAt, snapshot }`. Pass `filter`, `sort` and
+  `limit`; pass `id` to look one object up; pass `follow: true` to walk
+  `next`. The user token is `options.userToken` and is sent only when set.
+  Platform refusals are `x-pple-error` (`not_found`, `invalid_query`,
+  `level_not_met`, and the same codes as `callService`). Locally it reads
+  `.pple/registry/<provider>/<name>/mocks/<objectType>.json` through the same
+  query rules and `passesLevel` against the active Persona. `sweptAt` is the
+  mock file's write time. A level whose `subs` list is missing, including
+  `subs: swept`, admits nobody offline. `DEV_REGISTRY_ERROR` and `no_mock`
+  work as they do for `callService`. `DEV_PERSONA=none` calls the real
+  service. Vitest uses the injected fetch. This path is compiled out of the
+  deployed Worker.
 
 ## Conventions
 
@@ -62,6 +99,36 @@ Where the token comes from:
 - **Add a DB table** by writing a new migration and running
   `npm run db:migrate:local`.
 
+## KYC Status and Legal Identity
+
+**KYC Status** is `actor.kyc`. Gate on `actor.kyc.verified`. It is never on
+`effective`. After someone returns from `/kyc`, re-read userinfo — `?kyc=` is
+a UI hint only. `kyc.verified` means PPLE ID knows a real person behind the
+account; it does not prove the account holder is the cardholder, and an app
+that needs that check adds its own.
+
+A **Legal Identity** (name and citizen ID) is not in userinfo. Call
+`getLegalIdentity(env, token)` only at the moment it is needed, such as
+checkout, and copy it onto that record, such as the receipt. Not on page
+views, and nowhere else — do not log, cache, or store it aside from that
+record. `idCardNumber` may be `null` for a member without a KYC record; send
+them through `/kyc` (`kycStartUrl`) if the app needs the number.
+
+Under delegation the Legal Identity is the actor's. If delegated use should
+be blocked, check `effective.isDelegated`.
+
+Legal Identity is the Private Platform Service `platform/legal-identity`, so
+the app needs a Use Grant: with the Builder's agreement, file
+`pple request use platform/legal-identity --reason "…"`. Calls flow at Beta
+or Live. `getLegalIdentity` reasons:
+`not_configured` (bindings missing), `invalid_app_key`, `not_granted`,
+`needs_beta` (the grant is held and the app is still Draft), `not_verified`,
+`user_token_invalid`, `upstream_unavailable`.
+
+Locally, try `DEV_PERSONA=unverified`, `kyc-pending`, or
+`kyc-verified-nonmember`. Member Personas are verified via membership and the
+offline helper returns `idCardNumber: null`.
+
 ## Before you finish
 
 Run these and make sure they pass:

package/templates/golden-path/README.md

@@ -34,8 +34,33 @@ npm run dev        # http://localhost:5173
 full-stack dev server. No config files, no PPLE Today, no OAuth: you're signed
 in automatically as a mock **persona** (`hq-staff` by default). To develop as
 someone else, set `DEV_PERSONA` in `.dev.vars` (see `.dev.vars.example`) to
-`hq-staff`, `province-coordinator`, `platform-admin`, or `delegate` — or add
-your own in `src/dev-personas.ts`.
+`hq-staff`, `province-coordinator`, `platform-admin`, `delegate`, or `member` —
+or add your own in `src/dev-personas.ts`.
+
+`callService` on `npm run dev` answers from
+`.pple/registry/<provider>/<name>/mocks/responses.json` as that persona. A
+missing entry or route is `no_mock` (404) and names `pple registry`. Set
+`DEV_REGISTRY_ERROR` to rehearse a platform refusal such as `not_granted` or
+`provider_timeout`. `DEV_PERSONA=none` calls the real service. This path is
+compiled out of the deployed Worker.
+
+`readDataset` on `npm run dev` reads
+`.pple/registry/<provider>/<name>/mocks/<objectType>.json` the same way:
+filters, sort and pages run locally, and the active persona has to pass the
+Object Type's level. `sweptAt` is the time that mock file was written. A
+level that only names people, or a swept list, admits nobody offline — those
+lists are not in the overlay. `DEV_REGISTRY_ERROR` and `no_mock` work as they
+do for `callService`. `DEV_PERSONA=none` reads the real Dataset. This path is
+compiled out of the deployed Worker.
+
+To exercise a Service this app provides, curl
+`/.pple/registry/<name>/…` on the dev server. That path is delivered to
+`registry[name]` with the active Persona's Identity and a fake Consumer
+(`dev-consumer`, or `DEV_CONSUMER`). The entry id is `dev-provider/<name>`.
+`DEV_PERSONA=none`, or a persona name that is not defined, sends no
+Identity — the same as an entry that declares `userToken: none`. An unknown
+name does not fall back to `hq-staff` on this path. The wrapper is compiled
+out of the deployed Worker. Tests use `callRegistry` from `test/harness.ts`.
 
 Opened inside PPLE Today, the mini-app SDK signs the real user in from the
 launch URL; opened in a plain browser after deploy, the same SDK runs the

package/templates/golden-path/gitignore

@@ -9,3 +9,6 @@ dist/
 .cursor/rules/pple-platform.mdc
 .pple/rules.md
 .pple/guidance.json
+.pple/registry/
+.pple/registry.json
+.pple/registry-check.json

package/templates/golden-path/overlay-mtime.mjs

@@ -0,0 +1,30 @@
+// Embeds an overlay file's mtime for offline readDataset (ADR-0030).
+//
+// The Worker cannot stat a file. Vite replaces `import.meta.glob` of `?mtime`
+// with this module, so `sweptAt` is the time the overlay was written. The
+// glob sits in an `import.meta.env.DEV` branch and is absent from the
+// production build.
+
+import fs from "node:fs";
+
+export function overlayMtimePlugin() {
+  return {
+    name: "pple-overlay-mtime",
+    enforce: "pre",
+    load(id) {
+      const split = id.indexOf("?");
+      if (split === -1) return null;
+      const query = id.slice(split + 1);
+      const wants = query.split("&").some((part) => part === "mtime" || part.startsWith("mtime="));
+      if (!wants) return null;
+      const file = id.slice(0, split);
+      let iso = "";
+      try {
+        iso = fs.statSync(file).mtime.toISOString();
+      } catch {
+        iso = "";
+      }
+      return `export default ${JSON.stringify(iso)};`;
+    },
+  };
+}

package/templates/golden-path/package-lock.json

@@ -10,6 +10,7 @@
         "@pplethai/components": "^1.4.3",
         "@pplethai/pple-today-miniapp-sdk": "^0.1.4",
         "hono": "^4.12.30",
+        "lucide-react": "^0.469.0",
         "react": "^19.2.0",
         "react-dom": "^19.2.0",
         "react-hook-form": "^7.81.0",
@@ -25,7 +26,8 @@
         "typescript": "^5.8.0",
         "vite": "^8.1.5",
         "vitest": "^4.1.10",
-        "wrangler": "^4.112.0"
+        "wrangler": "^4.112.0",
+        "yaml": "^2.9.1"
       }
     },
     "node_modules/@cloudflare/kv-asset-handler": {
@@ -4246,6 +4248,22 @@
         }
       }
     },
+    "node_modules/yaml": {
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
     "node_modules/youch": {
       "version": "4.1.0-beta.10",
       "resolved": "https://registry.npmjs.org/youch/-/youch-4.1.0-beta.10.tgz",

package/templates/golden-path/package.json

@@ -6,7 +6,7 @@
   "scripts": {
     "predev": "wrangler d1 migrations apply DB --local",
     "dev": "vite dev",
-    "build": "vite build",
+    "build": "vite build && node scripts/assert-dev-compiled-out.mjs",
     "preview": "vite preview",
     "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.worker.json",
     "test": "vitest run",
@@ -35,6 +35,7 @@
     "typescript": "^5.8.0",
     "vite": "^8.1.5",
     "vitest": "^4.1.10",
-    "wrangler": "^4.112.0"
+    "wrangler": "^4.112.0",
+    "yaml": "^2.9.1"
   }
 }

package/templates/golden-path/scripts/assert-dev-compiled-out.mjs

@@ -0,0 +1,42 @@
+// The deployed Worker is dist/pple_app/index.js. Vite inlines
+// `import.meta.env.DEV` to false and drops the Persona bypass and the
+// offline registry wrapper (ADR-0011). Strings that exist only in those
+// modules must not survive. The client bundle is a different compile.
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const bundle = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../dist/pple_app/index.js",
+);
+
+if (!fs.existsSync(bundle)) {
+  console.error(`production Worker bundle not found at ${bundle}`);
+  process.exit(1);
+}
+
+const source = fs.readFileSync(bundle, "utf8").replace(/\/\/# sourceMappingURL[\s\S]*$/, "");
+
+const forbidden = [
+  ["dev-hq-staff", "Persona bypass"],
+  ["Local Dev (HQ)", "Persona bypass"],
+  ["บุคคลทดสอบ ออฟไลน์", "offline Legal Identity"],
+  ["dev-consumer", "registry dev wrapper"],
+  ["DEV_CONSUMER", "registry dev wrapper"],
+  ["dev-provider", "registry dev wrapper"],
+  ["registry handler missing", "registry dev wrapper"],
+  ["x-pple-mock", "offline callService"],
+  ["../.pple/registry", "offline callService overlay glob"],
+  ["ไม่มีข้อมูลจำลอง", "offline callService no_mock"],
+];
+
+const found = forbidden.filter(([needle]) => source.includes(needle));
+if (found.length > 0) {
+  console.error(`production Worker still contains dev-only code (${bundle}):`);
+  for (const [needle, why] of found) console.error(`  ${JSON.stringify(needle)} (${why})`);
+  process.exit(1);
+}
+
+console.log("production Worker has no dev-only registry or Persona code");

package/templates/golden-path/shared/api.ts

@@ -8,22 +8,62 @@ import { z } from "zod";
  * The signed-in caller, as the Worker resolves it from the PPLE ID token
  * (src/auth.ts). Two faces:
  *
- * - `actor` — the real human clicking. Use for audit and display only.
- * - `effective` — what they may do. Gate every authorization decision on this,
+ * - `actor` — the real human clicking (`sub`, name, mobile, KYC Status,
+ *   party membership). Use for audit and display only.
+ * - `effective` — what they may do, including `sub` of the person whose
+ *   authority is in effect. Gate every authorization decision on this,
  *   never on `actor`. Under Delegation these are the supervisor's values and
  *   `isDelegated` is true. See docs/adr/0012 and CONTEXT.md.
  */
+/**
+ * KYC Status (CONTEXT.md). Whether PPLE ID knows a real person behind this
+ * account. It carries no name and no citizen ID, and it belongs to the human,
+ * so it sits on the actor — a delegate does not inherit a supervisor's status.
+ * `verified` does not prove the account holder is the cardholder.
+ */
+export const KycStatusSchema = z.object({
+  status: z.enum(["none", "pending_review", "verified", "rejected"]),
+  verified: z.boolean(),
+  verifiedAt: z.string().nullable(),
+  /** `membership` for an active member, `kyc` for a national-ID check, or null. */
+  source: z.enum(["membership", "kyc"]).nullable(),
+});
+export type KycStatus = z.infer<typeof KycStatusSchema>;
+
+/**
+ * Active party membership as the Identity carries it. `memberSince` is the
+ * ISO date (`YYYY-MM-DD`) PPLE ID reports. The actor field is null when the
+ * person is not an active member, or the lookup failed.
+ */
+export const MembershipSchema = z.object({
+  memberSince: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+});
+export type Membership = z.infer<typeof MembershipSchema>;
+
 export const ActorSchema = z.object({
   sub: z.string(),
   name: z.string().nullable(),
   /** Thai mobile number, the join key across PPLE systems. May be null. */
   mobile: z.string().nullable(),
+  /** Never copied onto `effective`. See KycStatusSchema. */
+  kyc: KycStatusSchema,
+  /**
+   * The human's party membership. Never copied onto `effective`: a delegate
+   * does not inherit a supervisor's membership. A lookup error is null.
+   */
+  membership: MembershipSchema.nullable(),
 });
 export type Actor = z.infer<typeof ActorSchema>;
 
 export const EffectiveSchema = z.object({
   /** True ⇒ the values below are borrowed from a supervisor (see Actor). */
   isDelegated: z.boolean(),
+  /**
+   * PPLE ID sub of the person whose authority is in effect. The actor's own
+   * sub when nobody is delegating. Under Delegation, the supervisor's Zitadel
+   * sub, or null when PPLE ID has none. Null matches no custom `subs`.
+   */
+  sub: z.string().min(1).nullable(),
   /** The Role in play now (one of `eligibleRoles`), e.g. "hq", "province". */
   activeRole: z.string(),
   eligibleRoles: z.array(z.string()),

package/templates/golden-path/src/auth.ts

@@ -10,7 +10,8 @@
 //   • actor     — the real human clicking (audit/display only)
 //   • effective — what they may do (gate authorization on this)
 // Under Delegation, effective.* are the supervisor's and effective.isDelegated
-// is true, while actor stays the delegate. See docs/adr/0012.
+// is true, while actor stays the delegate. effective.sub is the PPLE ID sub
+// of the person whose authority is in effect. See docs/adr/0012.
 import type { Identity } from "../shared/api";
 import { resolveDevPersona } from "./dev-personas";
 
@@ -74,6 +75,11 @@ interface RawPerson {
   id?: number;
   role?: string;
   mobile?: string;
+  /**
+   * The person's Zitadel user id, which is their PPLE ID sub. Read only for
+   * the supervisor under Delegation. Never `sso_user_id`.
+   */
+  zitadel_user_id?: unknown;
   metadata?: { ad?: { extra_roles?: unknown; is_province_coordinator?: unknown } };
 }
 
@@ -85,12 +91,74 @@ interface RawAd {
   eligibleProvinces?: unknown;
 }
 
+interface RawKyc {
+  status?: string;
+  verified?: boolean;
+  verifiedAt?: string | null;
+  source?: string | null;
+}
+
 interface RawUserInfo {
   sub?: string;
   name?: string;
+  /** KYC Status of the human who logged in. Absent until PPLE ID sends it. */
+  kyc?: RawKyc;
+  /**
+   * Party membership of the logged-in human, beside `ad` and `kyc`.
+   * PPLE ID sends an object or null. See membershipOf.
+   */
+  membership?: unknown;
   ad?: RawAd;
 }
 
+/** `YYYY-MM-DD`, the shape of userinfo `membership.memberSince`. */
+const MEMBER_SINCE = /^\d{4}-\d{2}-\d{2}$/;
+
+/**
+ * Reduce userinfo `membership` to `{ memberSince }` or null.
+ *
+ * PPLE ID sends `{ type, memberSince, registeredAddress }` only while the
+ * membership is legally active, looked up by the logged-in human's phone.
+ * A lookup error arrives as null. The Identity keeps the date and drops the
+ * address. A missing or odd value is null, so it cannot pass `member`.
+ */
+function membershipOf(value: unknown): Identity["actor"]["membership"] {
+  if (value === null || value === undefined || typeof value !== "object") return null;
+  const memberSince = (value as { memberSince?: unknown }).memberSince;
+  if (typeof memberSince !== "string" || !MEMBER_SINCE.test(memberSince)) return null;
+  return { memberSince };
+}
+
+/** Zitadel user ids are decimal strings. Anything else is not a PPLE ID sub. */
+const ZITADEL_SUB = /^\d+$/;
+
+/**
+ * `effective.sub` (ADR-0028, #266).
+ *
+ * Not delegated (`isDelegated` false): the Actor's `sub` from the token. It
+ * is never read from `ad`. PPLE ID falls back silently to the logged-in row
+ * when the supervisor row is missing, and that reads as not delegated.
+ *
+ * Delegated: `ad.user` is the supervisor only when the logged-in human's role
+ * is `delegate`. The supervisor's sub is `ad.user.zitadel_user_id`.
+ * `sso_user_id` is legacy (a Supabase UUID or null) and is never read. Any
+ * other delegated shape, or a missing, null, or non-Zitadel id, is null. It
+ * is never the Actor's sub, because `effective` is someone else's authority
+ * here. Null matches no custom `subs`.
+ */
+function effectiveSub(
+  actorSub: string,
+  isDelegated: boolean,
+  user: RawPerson | undefined,
+  actual: RawPerson | undefined,
+): string | null {
+  if (!isDelegated) return actorSub;
+  if (actual?.role !== "delegate") return null;
+  const zitadel = user?.zitadel_user_id;
+  if (typeof zitadel !== "string" || !ZITADEL_SUB.test(zitadel)) return null;
+  return zitadel;
+}
+
 function stringArray(value: unknown): string[] {
   return Array.isArray(value)
     ? value.filter((v): v is string => typeof v === "string")
@@ -108,26 +176,50 @@ function extraRolesOf(person: RawPerson | undefined): string[] {
   return roles;
 }
 
+const KYC_STATUSES = ["none", "pending_review", "verified", "rejected"] as const;
+const KYC_SOURCES = ["membership", "kyc"] as const;
+
+/** A missing or odd `kyc` is "PPLE ID has not verified this person", not an error. */
+function kycOf(raw: RawKyc | undefined): Identity["actor"]["kyc"] {
+  const status = KYC_STATUSES.find((s) => s === raw?.status) ?? "none";
+  const source = KYC_SOURCES.find((s) => s === raw?.source) ?? null;
+  return {
+    status,
+    verified: raw?.verified === true,
+    verifiedAt: typeof raw?.verifiedAt === "string" ? raw.verifiedAt : null,
+    source,
+  };
+}
+
 function toIdentity(body: RawUserInfo): Identity {
   const ad = body.ad;
   const effectivePerson = ad?.user;
   // When nobody is delegating, `actualPpleUser` mirrors `user`.
   const actualPerson = ad?.actualPpleUser ?? effectivePerson;
+  const isDelegated =
+    effectivePerson?.id !== undefined &&
+    actualPerson?.id !== undefined &&
+    effectivePerson.id !== actualPerson.id;
   const activeRole = ad?.activeRole ?? effectivePerson?.role ?? "";
   const eligibleRoles = stringArray(ad?.eligibleRoles);
+  // Top-level `sub` is the OIDC subject of the human who logged in.
+  const actorSub = body.sub as string;
 
   return {
     actor: {
-      // Top-level `sub` is the OIDC subject of the human who logged in.
-      sub: body.sub as string,
+      sub: actorSub,
       name: body.name ?? null,
       mobile: actualPerson?.mobile ?? null,
+      // The human's own KYC Status. A delegated session still reports the
+      // actor's, never the supervisor's, and effective never carries it.
+      kyc: kycOf(body.kyc),
+      // The human's own membership, likewise. Top-level userinfo, not `ad.user`
+      // (under Delegation `ad.user` is the supervisor).
+      membership: membershipOf(body.membership),
     },
     effective: {
-      isDelegated:
-        effectivePerson?.id !== undefined &&
-        actualPerson?.id !== undefined &&
-        effectivePerson.id !== actualPerson.id,
+      isDelegated,
+      sub: effectiveSub(actorSub, isDelegated, effectivePerson, ad?.actualPpleUser),
       activeRole,
       eligibleRoles:
         eligibleRoles.length > 0 ? eligibleRoles : activeRole ? [activeRole] : [],