import type { PortalSessionClaims } from '@zync/types'

/**
 * Customer portal session JWT payload — tenant-portals (wave 9b, Task 2).
 *
 * Distinct from staff SessionPayload; verified by portalAuthMiddleware together
 * with a matching portal_sessions row (stateful revocation).
 */
export interface PortalSessionPayload extends PortalSessionClaims {
  role: 'portal_customer'
  userId: string
  portalSessionId: string
  /** Unix seconds when the current auth chain started (preserved across refresh). */
  sessionStartedAt: number
}