/**
 * Decodes a JWT payload without verifying the signature.
 * **IMPORTANT:** Signature verification must always be performed server-side.
 * This utility is intended for reading client-visible claims only.
 *
 * Without an `isValid` guard, the decoded payload is only checked to be a plain
 * object (not that it structurally matches `T`) — the same generic-erasure
 * limitation documented for array-builder functions in `@pawells/math-extended`:
 * there is no way to reconstruct an arbitrary caller-chosen generic shape from
 * an untyped payload without a schema. Pass `isValid` (e.g. a Zod schema's
 * `.safeParse` wrapped as a type guard) to get a real runtime-checked result
 * instead of a bare assertion.
 *
 * @param token - The raw JWT string to decode.
 * @param isValid - Optional runtime type guard used to verify the decoded payload
 * actually has the shape of `T`. When provided and the payload fails validation,
 * `parseJwt` returns `null` instead of asserting the type.
 * @returns The decoded payload as a typed object, or `null` if the token is
 * malformed, cannot be parsed, or fails `isValid` when provided.
 * @example
 * ```tsx
 * const payload = parseJwt<{ sub: string; exp: number }>(token);
 * if (!payload) throw new Error('Invalid token');
 * console.log(payload.sub); // typed as string
 * ```
 * @example With runtime validation
 * ```tsx
 * const isClaims = (value: Record<string, unknown>): value is { sub: string; exp: number } =>
 *   typeof value.sub === 'string' && typeof value.exp === 'number';
 * const payload = parseJwt(token, isClaims);
 * if (!payload) throw new Error('Invalid or malformed token claims');
 * ```
 */
export declare const parseJwt: <T extends Record<string, unknown>>(token: string, isValid?: (value: Record<string, unknown>) => value is T) => T | null;
/**
 * Returns `true` if a JWT is expired or malformed.
 *
 * @param token - The raw JWT string to inspect.
 * @param clockSkewSeconds - Buffer in seconds. A token with `exp = T` is
 *   considered expired only when `now > T + clockSkewSeconds`. Positive values
 *   extend the validity window (the token is treated as valid for up to this
 *   many seconds past its stated expiry). Negative values make the token expire
 *   earlier (stricter validation). Default is 0 (no buffer).
 * @returns `true` if the token is expired or malformed; `false` if it has a valid `exp` claim in the future.
 * @example
 * ```tsx
 * if (isTokenExpired(token)) {
 *   // Refresh or redirect to login
 * }
 * ```
 */
export declare const isTokenExpired: (token: string, clockSkewSeconds?: number) => boolean;
//# sourceMappingURL=token.d.ts.map