export type OrgAuth = {
    username: string;
    orgId: string;
    accessToken: string;
    instanceUrl: string;
    apiVersion: string;
    alias?: string;
};
/**
 * Outcome of one `sf` invocation. `null` means the binary could not be
 * spawned at all (not on PATH, EACCES, …) — distinct from `sf` running and
 * exiting non-zero, which still yields stdout/stderr.
 */
export type SfRunResult = {
    code: number | null;
    stdout: string;
    stderr: string;
};
/** Runs `sf <args>` with `extraEnv` layered over `process.env`. */
export type SfRunner = (args: string[], extraEnv?: Record<string, string>) => Promise<SfRunResult | null>;
export type ResolveAuthOptions = {
    /** Injected for tests — replaces spawning the real `sf` binary. */
    runSf?: SfRunner;
    /** Injected for tests — root that `~/.sf` and `~/.sfdx` are resolved under. */
    homeDir?: string;
};
/**
 * Resolve authentication for a given org alias (or the default target org).
 *
 * Strategy:
 *   1. If `sf` is on PATH, shell out to `sf org display --target-org <alias> --json`.
 *      This is the most reliable path: `sf` handles encrypted tokens, refresh, etc.
 *      Salesforce CLI ≥ 2.149 (plugin-org ≥ 6) redacts `accessToken` from that
 *      output by default, so we (a) set `SF_TEMP_SHOW_SECRETS=true` for the call,
 *      which restores the token on CLIs that still honour it, and (b) when the
 *      token still comes back redacted, ask the dedicated
 *      `sf org auth show-access-token --json` command instead.
 *   2. Otherwise, fall back to reading `~/.sfdx/<username>.json` directly. This only
 *      works with plaintext tokens (older installs); encrypted tokens require `sf`.
 *
 * Whatever the path, the token is shape-checked (`looksPlaintext`) before it is
 * returned: a redaction placeholder or an encrypted blob must never end up in an
 * `Authorization: Bearer` header, where it would surface as an opaque HTTP 401.
 *
 * We deliberately do NOT depend on `@salesforce/core` — it's a heavy dependency and
 * shelling out gives us the same guarantees with no install-time cost.
 */
export declare function resolveAuth(alias: string | undefined, apiVersion: string, opts?: ResolveAuthOptions): Promise<OrgAuth>;
/**
 * Hint attached to a Salesforce HTTP 401 raised *after* `resolveAuth` has
 * already vetted the token's shape. At that point the token was well-formed
 * and came from `sf`, so the honest explanation is expiry or revocation —
 * not a redaction or keychain problem.
 */
export declare function tokenRejectedHint(auth: OrgAuth): string;
/**
 * Sanity-check that `token` looks like a Salesforce plaintext OAuth access
 * token: `<15-char OrgId starting 00D>!<rest>`. Both signals are required —
 * the `!` alone is too weak now that `sf` can hand back prose in this field.
 *
 * Returning `false` means "do not send this as a Bearer token". It catches:
 *   - the `[REDACTED] Use 'sf org auth show-access-token' to view` placeholder
 *     that Salesforce CLI ≥ 2.149 prints from `sf org display`;
 *   - encrypted blobs read straight from `~/.sf/` on systems where the OS
 *     keychain holds the key — opaque hex/base64, no `00D`, no `!`.
 *
 * Naming: a positive predicate on purpose. The prior `looksEncrypted` forced
 * call sites into a double-negative; `looksPlaintext === true` reads as "use
 * this token directly."
 */
export declare function looksPlaintext(token: string): boolean;