/** True when the JWT's exp claim is in the past. Malformed tokens count as live. */
export declare function isJwtExpired(jwt: string): boolean;
/**
 * Make sure there's a usable session before a command that needs one, opening
 * the sign-in inline instead of bouncing the user to a separate `login` run.
 * (Expired WorkOS access tokens don't count as dead here — the API client
 * refreshes those transparently; only a missing session, or an expired legacy
 * JWT with no refresh path, needs a fresh sign-in.)
 */
export declare function ensureAuthed(version: string, opts?: {
    interactive?: boolean;
}): Promise<void>;
//# sourceMappingURL=ensure-auth.d.ts.map