/**
 * Read the `sub` (subject) claim out of a JWT access token WITHOUT verifying
 * its signature — verification is the gateway's job (it re-verifies every
 * connect-URL token). The client only needs to know *which principal* a token
 * belongs to, so it can tell "same identity, renewed token" apart from
 * "different identity" (#128).
 *
 * In this system `sub` IS the user id: user-auth mints it that way and both
 * the gateway (connection-handler → `userInfo.id`) and agentic-chat
 * (`/api/auth/callback` → `id: payload.sub`) read it as such. Note it names the
 * principal the TOKEN acts as, which is not always the human who logged in —
 * an admin impersonation token carries the impersonated user's `sub`.
 *
 * Returns null for anything that can't be positively read as a JWT carrying a
 * non-empty string `sub` — opaque tokens, malformed base64, missing claim.
 * Callers MUST treat null as "unknown", never as "different": a wrong
 * "different" verdict would tear down a healthy connection on every renewal.
 *
 * The return value is for EQUALITY COMPARISON only, not as an identifier to
 * pass on: `atob` decodes latin1, so a non-ASCII `sub` comes back mojibake.
 * Harmless here (the same `sub` always maps to the same mojibake, so equality
 * still holds) — same tradeoff as agentic-auth's own decoder.
 */
export declare function readTokenSubject(token: string): string | null;
//# sourceMappingURL=token-subject.d.ts.map