/**
 * Returns a valid (non-expired) WorkOS access token for the given org,
 * refreshing if needed. Throws if no token for that org is on disk or if
 * refresh fails.
 *
 * If `QUONFIG_API_KEY` is set in the environment (non-empty), it is used
 * directly as a bearer token and no disk reads/writes or refresh calls
 * are made. This is the non-interactive (CI) path; `workosOrgId` is
 * ignored because API keys are workspace-scoped.
 */
type Logger = (msg: string, data?: unknown) => void;
/**
 * Slug-based wrapper around getValidAccessToken. Commands talk in
 * `<org-slug>` (the user-vocabulary form); the slug → workosOrgId
 * mapping is contained here so the rest of the CLI doesn't see WorkOS
 * identifiers.
 *
 * The `QUONFIG_API_KEY` short-circuit fires before any disk lookup, so
 * an empty/unknown slug is fine in CI mode.
 */
export declare function getValidAccessTokenForOrgSlug(orgSlug: string, log?: Logger): Promise<string>;
export declare function getValidAccessToken(workosOrgId: string, log?: Logger): Promise<string>;
export {};