decodeJwtPayload (auth/agent-jwt.ts)

Utility functions to decode JWT payloads and check expiration with safety margins for session and capability tokens.

// Source: https://github.com/Atomic-Mail/atomic-mail-agentic | License: MIT | Copyright 2026 Atomic Mail
// Provided via justclaw.it.com; keep this notice with the code.
// JWT helpers for capability/session expiry checks.

export const SESSION_SAFETY_MARGIN_MS = 60_000;
export const CAPABILITY_SAFETY_MARGIN_MS = 20_000;

export interface JwtPayload {
  exp?: number;
  iat?: number;
  jti?: string;
  inboxId?: string;
  [key: string]: unknown;
}

export function decodeJwtPayload<T = JwtPayload>(jwt: string): T {
  const parts = jwt.split(".");
  if (parts.length < 2) {
    throw new Error(
      "Malformed JWT: expected at least 2 dot-separated segments.",
    );
  }
  const payloadB64Url = parts[1];
  const padLen = (4 - (payloadB64Url.length % 4)) % 4;
  const base64 = payloadB64Url
   

... (truncated -- full source via MCP)