interface JwtPayload {
    id?: string;
    _id?: string;
    email?: string;
    exp?: number;
    iat?: number;
}
/**
 * Decode JWT payload without signature verification.
 *
 * SECURITY NOTE: This is intentional. Signature verification happens
 * server-side on every API call. Client-side decoding is only used for:
 * - Checking token expiration before making requests
 * - Reading non-sensitive claims for UI display
 *
 * An attacker crafting fake JWTs gains nothing - the server rejects them.
 */
export declare function decodeJwt(token: string): JwtPayload | null;
/** Returns true if the JWT is expired (or unparseable). */
export declare function isTokenExpired(token: string): boolean;
/** Extract the user ID from a JWT. Returns null if token is invalid. */
export declare function getUserIdFromToken(token: string): string | null;
export {};