/**
 * Session id from the access token, when it carries one.
 *
 * `/sessions/my-sessions` returns no "this is you" flag, so the only way to
 * stop the user revoking the session they are sitting in is to read the id off
 * the token. Undefined is a normal answer — an opaque token just means no
 * "This device" badge and a confirm dialog that warns instead.
 */
export function currentSessionId(token?: string): string | undefined {
  const payload = token?.split('.')[1];
  if (!payload) return undefined;
  try {
    const claims = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
    return claims.sessionId ?? claims.sid ?? claims.jti;
  } catch {
    return undefined;
  }
}
