Here’s what the auth fixes were doing, concept by concept.

1. Implicit any vs explicit types

With strict on, untyped parameters become errors (implicitly has an 'any' type).

header, callback, req, res, next needed real types so TypeScript could check how you use them.

2. Library types (@types/...)

jsonwebtoken is JS; types come from @types/jsonwebtoken. That gives you:

• JwtHeader — token header shape (kid, alg, …)
• SigningKeyCallback — (err, key) => void for jwt.verify
• JwtPayload — decoded claims (sub, aud, …)

Same idea as @types/express for Request / Response / NextFunction.

3. import type

import type { NextFunction, Request, Response } from "express";

Imports types only — erased at runtime. Safer with verbatimModuleSyntax because it can’t accidentally pull in a runtime value.

4. Narrowing (type guards)

TypeScript won’t trust optional/union values until you check them:

• if (!header.kid) → after that, header.kid is string
• if (!key) → after that, key is defined
• if (!decodedClaims || typeof decodedClaims === "string") → remaining branch is JwtPayload

That’s control-flow narrowing: the type gets smaller after each check.

5. Nullable / optional values