water/server/app/miniapi/auth/Principal.php

<?php

declare(strict_types=1);

namespace app\miniapi\auth;

/** Verified login identity. Mutable business permissions are always loaded through Access. */
final class Principal
{
    public function __construct(public readonly string $userId)
    {
        if ($userId === '' || strlen($userId) > 128) {
            throw new \InvalidArgumentException('Invalid mini-program user identity');
        }
    }
}