/** Default buffer (seconds) before token `exp` to consider the token expired. */
export declare const DEFAULT_EXPIRY_BUFFER_SEC = 60;
/**
 * Extract `scope` from a decoded JWT payload. Tolerates both the (legacy)
 * space-delimited string form and the array form.
 */
export declare function extractJwtScopes(payload: Record<string, unknown>): string[];
/**
 * Decode a JWT and return its `expires` Date and `scopes` array. Errors from
 * `decodeJWT` propagate to the caller — callers that want a soft-fail should
 * wrap this in try/catch.
 */
export declare function decodeJwtTokenInfo(token: string): {
    expires: Date;
    scopes: string[];
};
/**
 * Returns `true` if the token is non-empty, decodes successfully, has not
 * expired (with a small buffer), and includes all required scopes.
 *
 * @param token - The JWT access token
 * @param requiredScopes - Scopes that must all be present in the token (default: none)
 * @param expiryBufferSec - Treat token as expired this many seconds before its real `exp`
 */
export declare function isJwtTokenValid(token: string, requiredScopes?: string[], expiryBufferSec?: number): boolean;