import { Target } from '@sasjs/utils';
/**
 * Authenticates against a SASVIYA target using a SAS username and password
 * (OAuth2 resource owner password grant against the built-in, secret-less
 * `sas.cli` client) and persists the resulting token pair. This enables all
 * authenticated commands (`sasjs run`, `sasjs deploy`, etc.) on estates where
 * no administrator-registered OAuth client/secret is available.
 *
 * Credentials are resolved in this order (highest precedence first):
 *
 *   Username:  SAS_USERNAME env var  >  interactive prompt (TTY only)
 *   Password:  --password-stdin      >  SAS_PASSWORD env var  >  interactive prompt (TTY only)
 *
 * When `--password-stdin` is set, stdin is consumed for the password, so the
 * username MUST come from the SAS_USERNAME env var (interactive prompting is
 * not possible because stdin is already redirected).
 *
 * If no TTY is available and no env var / stdin flag supplies the credential,
 * the function throws with a message pointing the caller at the env vars or
 * `--password-stdin` flag — this makes `sasjs auth login` safe to call from
 * CI pipelines and non-interactive agents.
 *
 * The password is used only to mint the tokens and is never stored. When the
 * access token expires, re-run `sasjs auth login -t <target>`.
 * @param {Target} target - the target to authenticate against.
 * @param {boolean} insecure - when true, bypasses TLS certificate validation
 *   (for self-signed cert Viya servers). Mirrors the `--insecure` flag on
 *   `sasjs add cred`.
 * @param {boolean} passwordStdin - when true, reads the password from stdin
 *   (like `docker login --password-stdin`) instead of prompting or reading
 *   the SAS_PASSWORD env var. The username must then come from SAS_USERNAME.
 */
export declare const authLogin: (target: Target, insecure?: boolean, passwordStdin?: boolean) => Promise<void>;