jwt

var (
	ExpiryClaim = Claim[Expiry]{
				// contains filtered or unexported fields
	}
	// WorkspaceClaim is written by keycloak's MC_CUSTOMER script mapper, which strips the c: scope
	// prefix, so this carries the identifier rather than the scope. It is absent altogether where
	// the user holds no role on the workspace the token was asked for, which is NoWorkspace here.
	WorkspaceClaim = StringClaim[meshstack.Workspace]("MC_CUSTOMER")

	ScopeClaim = Claim[scope.Scopes]{
				// contains filtered or unexported fields
	}
	PreferredUsernameClaim = StringClaim[string]("preferred_username")
	EmailClaim             = StringClaim[string]("email")
	// ClientIdClaim is only on a token a client minted with its own credentials, such as an API key.
	ClientIdClaim = StringClaim[string]("client_id")
)