/** The token's claims, or null if it isn't a readable JWT. */
export declare function decodeJwtPayload(token: string | null | undefined): Record<string, unknown> | null;
/**
 * Expiry as a millisecond epoch, or null when the token carries no readable
 * numeric `exp`. Callers decide what "unknown" means.
 */
export declare function readJwtExp(token: string | null | undefined): number | null;
/** The `sub` claim — the user id a token was minted for. */
export declare function readJwtSub(token: string | null | undefined): string | null;