export type AzureSessionsTokenClaims = {
    oid?: string;
    upn?: string;
    preferred_username?: string;
    aud?: string | string[];
    tid?: string;
    /** Present on user tokens obtained via an app (e.g. Azure CLI) — does NOT mean service principal. */
    appid?: string;
    /** "user" | "app" — reliable discriminator for Entra tokens */
    idtyp?: string;
};
export declare function decodeAzureSessionsTokenClaims(token: string): AzureSessionsTokenClaims | null;
/** App-only (service principal) tokens use idtyp=app. User tokens via az cli still include appid. */
export declare function isServicePrincipalToken(claims: AzureSessionsTokenClaims | null): boolean;
export declare function formatTokenIdentityForDiagnostics(claims: AzureSessionsTokenClaims | null): string;
//# sourceMappingURL=jwtClaims.d.ts.map