/**
 * Lightweight JWT payload utilities.
 *
 * Decodes a JWT without verification (client-side display only).
 * Never use for security-critical checks.
 */
export interface DatalayerJwtUser {
    id: string;
    uid: string;
    handle: string;
    email: string;
    firstName: string;
    lastName: string;
    avatarUrl: string;
    roles: string[];
}
/** Full Datalayer JWT payload shape. */
export interface DatalayerJwtPayload {
    jti: string;
    iss: string;
    iat: number;
    exp: number;
    sub: string;
    user: DatalayerJwtUser;
    /** Legacy top-level roles array (some tokens). */
    roles?: string[];
}
/**
 * Decode the payload of a JWT without verifying the signature.
 * Returns `null` on any error (malformed token, invalid base64, etc.).
 */
export declare function parseJwtPayload<T = DatalayerJwtPayload>(token: string): T | null;
/**
 * Extract the Datalayer user object from a JWT, returning `null` if the
 * token is missing or cannot be decoded.
 */
export declare function getDatalayerJwtUser(token: string | null | undefined): DatalayerJwtUser | null;
/**
 * Format a human-readable display name from a JWT user.
 * Prefers "FirstName LastName", falls back to handle.
 */
export declare function getDatalayerDisplayName(user: DatalayerJwtUser | null | undefined, fallback?: string): string;
