Function buildJWTPayload

apps/api/src/lib/jwt/jwt-utils.ts:31–48

(
  id: string,
  email: string,
  accountId: string
)

 * inside the JWT clock-skew tolerance every verifier accepts.
 */
export const buildJWTPayload = async (
  id: string,
  email: string,
  accountId: string
): Promise<Record<string, string | number>> => {
  const nowSeconds = Math.floor(nowMs() / 1000);
  const cutoffSeconds = await jwtRevocationService.getUserRevokeCutoff(id);
  const iat = Math.max(nowSeconds, cutoffSeconds);

  return {
    id,
    email,
    aid: accountId,
    jti: crypto.randomUUID(),
    iat,
    exp: iat + JWT_TTL_SECONDS,
  };
};