import { ServerType, Target } from '@sasjs/utils';
import SASjs from '@sasjs/adapter/node';
export declare const getAuthUrl: (serverType: ServerType, serverUrl: string, clientId: string) => string;
export declare function getAuthCode(authUrl: string): Promise<string>;
/**
 * Exchanges a refresh token for a new access/refresh token pair.
 * SAS Viya's refresh tokens are single-use and rotate on every call: the
 * `refresh_token` returned here supersedes the one passed in, which becomes
 * invalid immediately. Callers must persist the returned pair (see
 * `saveTokens` in config.ts) or a later refresh attempt with the old token
 * will be rejected by the server.
 */
export declare function refreshTokens(sasjsInstance: SASjs, clientId: string, clientSecret: string, refreshToken: string): Promise<{
    access_token: string;
    refresh_token: string;
}>;
/**
 * The pre-registered, secret-less OAuth client that ships with every SAS Viya
 * deployment (used by the official SAS Viya CLI). Allows authenticating with a
 * SAS username/password (OAuth2 resource owner password grant) when no
 * administrator-registered client/secret is available.
 */
export declare const SAS_CLI_CLIENT_ID = "sas.cli";
/**
 * Fetches an access/refresh token pair from SAS Viya using the resource owner
 * password grant against the built-in `sas.cli` public client. Unlike the
 * client/secret flows, no OAuth client registration is required - the
 * credentials are the user's regular SAS logon credentials.
 *
 * Note: this requires the password grant to be enabled for `sas.cli` (the
 * default) and a local/LDAP account - it cannot work on SSO/SAML/MFA-only
 * estates.
 * @param {Target} target - the SASVIYA target to authenticate against.
 * @param {string} user - the SAS username.
 * @param {string} pass - the SAS password.
 * @returns the access and refresh token pair.
 */
export declare function getTokensWithPasswordGrant(target: Target, user: string, pass: string): Promise<{
    access_token: string;
    refresh_token: string;
}>;
/**
 * Verifies an access token by fetching the identity it belongs to.
 * @param {Target} target - the SASVIYA target the token was minted for.
 * @param {string} accessToken - the access token to verify.
 * @returns the id and display name of the authenticated user.
 */
export declare function fetchLoggedInUser(target: Target, accessToken: string): Promise<{
    id: string;
    name?: string;
}>;
export declare function getNewAccessToken(sasjsInstance: SASjs, clientId: string, clientSecret: string, target: Target): Promise<{
    access_token: string;
    refresh_token: string;
}>;