/**
 * JWT utilities — client-side only. No signature verification.
 * The server verifies the token on every request.
 */
interface JWTPayload {
    exp: number;
    [key: string]: unknown;
}
/**
 * Decodes the payload of a JWT without verifying the signature.
 * Returns null for any malformed token.
 */
export declare function decodeJWT(token: string): JWTPayload | null;
/**
 * Returns true if the token is expired or will expire within bufferSeconds.
 * Returns true for any malformed/missing token — triggers re-auth.
 */
export declare function isTokenExpired(token: string, bufferSeconds?: number): boolean;
export {};