@sasjs/cli 4.19.0 → 4.20.1

package/build/commands/auth/authCommand.d.ts

@@ -3,6 +3,7 @@ import { TargetCommand } from '../../types/command/targetCommand';
 export declare class AuthCommand extends TargetCommand {
     constructor(args: string[]);
     get insecure(): boolean;
+    get passwordStdin(): boolean;
     execute(): Promise<ReturnCode.Success | ReturnCode.InternalError>;
     executeLogin(): Promise<ReturnCode.Success | ReturnCode.InternalError>;
     executeCred(): Promise<ReturnCode.Success | ReturnCode.InternalError>;

package/build/commands/auth/authCommand.js

@@ -69,7 +69,10 @@ var usage = 'sasjs auth login --target <target-name> | sasjs auth [options]';
 var description = "Authenticates against the specified target.\n" +
     "With the 'login' subCommand, authentication is performed with a SAS username and password " +
     "(no OAuth client/secret required, SASVIYA targets only) and the resulting tokens are saved.\n" +
-    "Without a subCommand, behaves like 'sasjs add cred' (client/secret based authentication).";
+    "Without a subCommand, behaves like 'sasjs add cred' (client/secret based authentication).\n" +
+    "\n" +
+    "Non-interactive use (CI/agents): set SAS_USERNAME and SAS_PASSWORD environment variables, " +
+    "or pipe the password and use --password-stdin.";
 var examples = [
     {
         command: 'sasjs auth login --target <target-name>',
@@ -79,6 +82,14 @@ var examples = [
         command: 'sasjs auth login -t <target-name>',
         description: ''
     },
+    {
+        command: 'SAS_USERNAME=usr SAS_PASSWORD=pass sasjs auth login -t <target-name>',
+        description: 'Non-interactive: read credentials from SAS_USERNAME/SAS_PASSWORD env vars (CI/agents).'
+    },
+    {
+        command: 'echo "$SAS_PASSWORD" | sasjs auth login --password-stdin -t <target-name>',
+        description: 'Non-interactive: read the password from stdin (avoids shell history).'
+    },
     {
         command: 'sasjs auth --target <target-name>',
         description: 'Legacy behaviour, equivalent to `sasjs add cred`.'
@@ -93,6 +104,14 @@ var AuthCommand = /** @class */ (function (_super) {
                 alias: 'i',
                 default: false,
                 description: 'Allows the command to bypass the HTTPs requirement. Not recommended.'
+            },
+            passwordStdin: {
+                type: 'boolean',
+                default: false,
+                description: 'Read the password from stdin instead of prompting or reading the ' +
+                    'SAS_PASSWORD env var. Use this in CI/scripts to avoid leaking the ' +
+                    'password in shell history (e.g. ' +
+                    '`echo "$SAS_PASSWORD" | sasjs auth login --password-stdin -t <target>`).'
             }
         };
         return _super.call(this, args, { parseOptions: parseOptions, usage: usage, description: description, examples: examples, syntax: syntax }) || this;
@@ -104,6 +123,13 @@ var AuthCommand = /** @class */ (function (_super) {
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(AuthCommand.prototype, "passwordStdin", {
+        get: function () {
+            return !!this.parsed.passwordStdin;
+        },
+        enumerable: false,
+        configurable: true
+    });
     AuthCommand.prototype.execute = function () {
         return __awaiter(this, void 0, void 0, function () {
             var _a;
@@ -136,7 +162,7 @@ var AuthCommand = /** @class */ (function (_super) {
                         _b.label = 2;
                     case 2:
                         _b.trys.push([2, 4, , 5]);
-                        return [4 /*yield*/, (0, login_1.authLogin)(target, this.insecure)];
+                        return [4 /*yield*/, (0, login_1.authLogin)(target, this.insecure, this.passwordStdin)];
                     case 3:
                         _b.sent();
                         return [2 /*return*/, command_1.ReturnCode.Success];

package/build/commands/auth/login.d.ts

@@ -6,11 +6,28 @@ import { Target } from '@sasjs/utils';
  * authenticated commands (`sasjs run`, `sasjs deploy`, etc.) on estates where
  * no administrator-registered OAuth client/secret is available.
  *
+ * Credentials are resolved in this order (highest precedence first):
+ *
+ *   Username:  SAS_USERNAME env var  >  interactive prompt (TTY only)
+ *   Password:  --password-stdin      >  SAS_PASSWORD env var  >  interactive prompt (TTY only)
+ *
+ * When `--password-stdin` is set, stdin is consumed for the password, so the
+ * username MUST come from the SAS_USERNAME env var (interactive prompting is
+ * not possible because stdin is already redirected).
+ *
+ * If no TTY is available and no env var / stdin flag supplies the credential,
+ * the function throws with a message pointing the caller at the env vars or
+ * `--password-stdin` flag — this makes `sasjs auth login` safe to call from
+ * CI pipelines and non-interactive agents.
+ *
  * The password is used only to mint the tokens and is never stored. When the
  * access token expires, re-run `sasjs auth login -t <target>`.
  * @param {Target} target - the target to authenticate against.
  * @param {boolean} insecure - when true, bypasses TLS certificate validation
  *   (for self-signed cert Viya servers). Mirrors the `--insecure` flag on
  *   `sasjs add cred`.
+ * @param {boolean} passwordStdin - when true, reads the password from stdin
+ *   (like `docker login --password-stdin`) instead of prompting or reading
+ *   the SAS_PASSWORD env var. The username must then come from SAS_USERNAME.
  */
-export declare const authLogin: (target: Target, insecure?: boolean) => Promise<void>;
+export declare const authLogin: (target: Target, insecure?: boolean, passwordStdin?: boolean) => Promise<void>;

package/build/commands/auth/login.js

@@ -46,6 +46,13 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -54,6 +61,61 @@ exports.authLogin = void 0;
 var prompts_1 = __importDefault(require("prompts"));
 var utils_1 = require("@sasjs/utils");
 var utils_2 = require("../../utils");
+/**
+ * Reads a single line/value from stdin until EOF or newline, then trims
+ * trailing whitespace. Used by the `--password-stdin` flow so passwords can
+ * be piped without appearing in shell history or process argument lists.
+ */
+var readPasswordFromStdin = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var data, _a, _b, _c, chunk, e_1_1;
+    var _d, e_1, _e, _f;
+    return __generator(this, function (_g) {
+        switch (_g.label) {
+            case 0:
+                data = '';
+                _g.label = 1;
+            case 1:
+                _g.trys.push([1, 6, 7, 12]);
+                _a = true, _b = __asyncValues(process.stdin);
+                _g.label = 2;
+            case 2: return [4 /*yield*/, _b.next()];
+            case 3:
+                if (!(_c = _g.sent(), _d = _c.done, !_d)) return [3 /*break*/, 5];
+                _f = _c.value;
+                _a = false;
+                try {
+                    chunk = _f;
+                    data += chunk.toString();
+                }
+                finally {
+                    _a = true;
+                }
+                _g.label = 4;
+            case 4: return [3 /*break*/, 2];
+            case 5: return [3 /*break*/, 12];
+            case 6:
+                e_1_1 = _g.sent();
+                e_1 = { error: e_1_1 };
+                return [3 /*break*/, 12];
+            case 7:
+                _g.trys.push([7, , 10, 11]);
+                if (!(!_a && !_d && (_e = _b.return))) return [3 /*break*/, 9];
+                return [4 /*yield*/, _e.call(_b)];
+            case 8:
+                _g.sent();
+                _g.label = 9;
+            case 9: return [3 /*break*/, 11];
+            case 10:
+                if (e_1) throw e_1.error;
+                return [7 /*endfinally*/];
+            case 11: return [7 /*endfinally*/];
+            case 12: 
+            // Trim trailing newline/carriage-return only; leading/trailing spaces are
+            // intentionally preserved in case a password genuinely contains them.
+            return [2 /*return*/, data.replace(/[\r\n]+$/g, '')];
+        }
+    });
+}); };
 /**
  * Authenticates against a SASVIYA target using a SAS username and password
  * (OAuth2 resource owner password grant against the built-in, secret-less
@@ -61,17 +123,35 @@ var utils_2 = require("../../utils");
  * authenticated commands (`sasjs run`, `sasjs deploy`, etc.) on estates where
  * no administrator-registered OAuth client/secret is available.
  *
+ * Credentials are resolved in this order (highest precedence first):
+ *
+ *   Username:  SAS_USERNAME env var  >  interactive prompt (TTY only)
+ *   Password:  --password-stdin      >  SAS_PASSWORD env var  >  interactive prompt (TTY only)
+ *
+ * When `--password-stdin` is set, stdin is consumed for the password, so the
+ * username MUST come from the SAS_USERNAME env var (interactive prompting is
+ * not possible because stdin is already redirected).
+ *
+ * If no TTY is available and no env var / stdin flag supplies the credential,
+ * the function throws with a message pointing the caller at the env vars or
+ * `--password-stdin` flag — this makes `sasjs auth login` safe to call from
+ * CI pipelines and non-interactive agents.
+ *
  * The password is used only to mint the tokens and is never stored. When the
  * access token expires, re-run `sasjs auth login -t <target>`.
  * @param {Target} target - the target to authenticate against.
  * @param {boolean} insecure - when true, bypasses TLS certificate validation
  *   (for self-signed cert Viya servers). Mirrors the `--insecure` flag on
  *   `sasjs add cred`.
+ * @param {boolean} passwordStdin - when true, reads the password from stdin
+ *   (like `docker login --password-stdin`) instead of prompting or reading
+ *   the SAS_PASSWORD env var. The username must then come from SAS_USERNAME.
  */
-var authLogin = function (target, insecure) {
+var authLogin = function (target, insecure, passwordStdin) {
     if (insecure === void 0) { insecure = false; }
+    if (passwordStdin === void 0) { passwordStdin = false; }
     return __awaiter(void 0, void 0, void 0, function () {
-        var user, pass, _a, access_token, refresh_token, _b, id, name;
+        var isTty, envUser, envPass, user, hint, pass, promptedPass, _a, access_token, refresh_token, _b, id, name;
         var _c, _d, _e;
         return __generator(this, function (_f) {
             switch (_f.label) {
@@ -88,17 +168,39 @@ var authLogin = function (target, insecure) {
                         target = new utils_1.Target(__assign(__assign({}, target.toJson(false)), { httpsAgentOptions: __assign(__assign({}, target.httpsAgentOptions), { allowInsecureRequests: true, rejectUnauthorized: false }) }));
                         (_c = process.logger) === null || _c === void 0 ? void 0 : _c.warn('Executing with insecure connection.');
                     }
-                    return [4 /*yield*/, (0, utils_1.getString)('Please enter your SAS username', function (v) { return !!v || 'Username is required.'; })
-                        // Password is prompted with a masked input (prompts 'password' type) rather
-                        // than getString from @sasjs/utils, because getString has no mask/hide mode
-                        // and would echo the password to the terminal.
-                        // The password stays in memory for the remainder of the process. This is an
-                        // accepted trade-off for a short-lived CLI: the process exits within seconds
-                        // and Node's V8 heap is not accessible to other users. Clearing the variable
-                        // would not reliably zero the underlying V8 string storage anyway.
-                    ];
+                    isTty = !!process.stdin.isTTY;
+                    envUser = process.env.SAS_USERNAME;
+                    envPass = process.env.SAS_PASSWORD;
+                    if (!envUser) return [3 /*break*/, 1];
+                    user = envUser;
+                    return [3 /*break*/, 4];
                 case 1:
+                    if (!(isTty && !passwordStdin)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, (0, utils_1.getString)('Please enter your SAS username', function (v) { return !!v || 'Username is required.'; })];
+                case 2:
                     user = _f.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    hint = passwordStdin
+                        ? "When using --password-stdin, the username must be provided via the SAS_USERNAME environment variable (stdin is used for the password)."
+                        : "No TTY is available for an interactive prompt. Set the SAS_USERNAME environment variable (and SAS_PASSWORD, or use --password-stdin).";
+                    throw new Error("A SAS username is required but was not provided. ".concat(hint));
+                case 4:
+                    if (!passwordStdin) return [3 /*break*/, 6];
+                    return [4 /*yield*/, readPasswordFromStdin()];
+                case 5:
+                    pass = _f.sent();
+                    if (!pass) {
+                        throw new Error("--password-stdin was specified but no password was read from stdin. " +
+                            "Pipe the password, e.g. echo \"$SAS_PASSWORD\" | sasjs auth login --password-stdin -t ".concat(target.name, "."));
+                    }
+                    return [3 /*break*/, 10];
+                case 6:
+                    if (!envPass) return [3 /*break*/, 7];
+                    pass = envPass;
+                    return [3 /*break*/, 10];
+                case 7:
+                    if (!isTty) return [3 /*break*/, 9];
                     return [4 /*yield*/, (0, prompts_1.default)({
                             type: 'password',
                             name: 'pass',
@@ -108,16 +210,21 @@ var authLogin = function (target, insecure) {
                                 throw new Error('Input cancelled.');
                             }
                         })];
-                case 2:
-                    pass = (_f.sent()).pass;
-                    return [4 /*yield*/, (0, utils_2.getTokensWithPasswordGrant)(target, user, pass)];
-                case 3:
+                case 8:
+                    promptedPass = (_f.sent()).pass;
+                    pass = promptedPass;
+                    return [3 /*break*/, 10];
+                case 9: throw new Error("A SAS password is required but was not provided. " +
+                    "Set the SAS_PASSWORD environment variable, or pipe the password and use --password-stdin " +
+                    "(e.g. echo \"$SAS_PASSWORD\" | sasjs auth login --password-stdin -t ".concat(target.name, ")."));
+                case 10: return [4 /*yield*/, (0, utils_2.getTokensWithPasswordGrant)(target, user, pass)];
+                case 11:
                     _a = _f.sent(), access_token = _a.access_token, refresh_token = _a.refresh_token;
                     return [4 /*yield*/, (0, utils_2.fetchLoggedInUser)(target, access_token)];
-                case 4:
+                case 12:
                     _b = _f.sent(), id = _b.id, name = _b.name;
                     return [4 /*yield*/, (0, utils_2.saveTokens)(target.name, access_token, refresh_token || '')];
-                case 5:
+                case 13:
                     _f.sent();
                     (_d = process.logger) === null || _d === void 0 ? void 0 : _d.success("Logged in as ".concat(id || 'unknown user').concat(name ? " (".concat(name, ")") : '', " on ").concat(target.serverUrl, "."));
                     (_e = process.logger) === null || _e === void 0 ? void 0 : _e.info("The access token is valid for the duration configured on the server (12 hours by default). " +

package/build/commands/auth/spec/authCommand.spec.js

@@ -139,7 +139,7 @@ describe('AuthCommand', function () {
                     return [4 /*yield*/, command.execute()];
                 case 1:
                     returnCode = _a.sent();
-                    expect(authLoginModule.authLogin).toHaveBeenCalledWith(target, false);
+                    expect(authLoginModule.authLogin).toHaveBeenCalledWith(target, false, false);
                     expect(returnCode).toEqual(command_1.ReturnCode.Success);
                     return [2 /*return*/];
             }
@@ -158,7 +158,58 @@ describe('AuthCommand', function () {
                     return [4 /*yield*/, command.execute()];
                 case 1:
                     returnCode = _a.sent();
-                    expect(authLoginModule.authLogin).toHaveBeenCalledWith(target, true);
+                    expect(authLoginModule.authLogin).toHaveBeenCalledWith(target, true, false);
+                    expect(returnCode).toEqual(command_1.ReturnCode.Success);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should pass passwordStdin=true to authLogin when --password-stdin is provided', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var args, command, returnCode;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    jest
+                        .spyOn(authLoginModule, 'authLogin')
+                        .mockImplementation(function () { return Promise.resolve(); });
+                    args = __spreadArray(__spreadArray([], __read(defaultArgs), false), [
+                        'auth',
+                        'login',
+                        '-t',
+                        'test',
+                        '--password-stdin'
+                    ], false);
+                    command = new authCommand_1.AuthCommand(args);
+                    return [4 /*yield*/, command.execute()];
+                case 1:
+                    returnCode = _a.sent();
+                    expect(authLoginModule.authLogin).toHaveBeenCalledWith(target, false, true);
+                    expect(returnCode).toEqual(command_1.ReturnCode.Success);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should pass both insecure and passwordStdin flags to authLogin', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var args, command, returnCode;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    jest
+                        .spyOn(authLoginModule, 'authLogin')
+                        .mockImplementation(function () { return Promise.resolve(); });
+                    args = __spreadArray(__spreadArray([], __read(defaultArgs), false), [
+                        'auth',
+                        'login',
+                        '-t',
+                        'test',
+                        '--insecure',
+                        '--password-stdin'
+                    ], false);
+                    command = new authCommand_1.AuthCommand(args);
+                    return [4 /*yield*/, command.execute()];
+                case 1:
+                    returnCode = _a.sent();
+                    expect(authLoginModule.authLogin).toHaveBeenCalledWith(target, true, true);
                     expect(returnCode).toEqual(command_1.ReturnCode.Success);
                     return [2 /*return*/];
             }

package/build/commands/auth/spec/login.spec.js

@@ -125,9 +125,24 @@ describe('authLogin', function () {
             name: 'SAS Test User'
         });
         utilsModule.saveTokens.mockResolvedValue(undefined);
+        // Reset env vars and TTY between tests.
+        delete process.env.SAS_USERNAME;
+        delete process.env.SAS_PASSWORD;
+        // Default to TTY=true so interactive prompts are allowed unless a test
+        // explicitly overrides.
+        Object.defineProperty(process.stdin, 'isTTY', {
+            value: true,
+            configurable: true
+        });
     });
     afterAll(function () {
         jest.restoreAllMocks();
+        delete process.env.SAS_USERNAME;
+        delete process.env.SAS_PASSWORD;
+        Object.defineProperty(process.stdin, 'isTTY', {
+            value: true,
+            configurable: true
+        });
     });
     // ---------------------------------------------------------------------------
     // Guard 1: Non-Viya rejection
@@ -361,4 +376,290 @@ describe('authLogin', function () {
             }
         });
     }); });
+    // ===========================================================================
+    // Non-interactive credential input paths (env vars, stdin, no-TTY fallback)
+    // ===========================================================================
+    // ---------------------------------------------------------------------------
+    // Env vars: SAS_USERNAME + SAS_PASSWORD skip both prompts
+    // ---------------------------------------------------------------------------
+    it('should use SAS_USERNAME and SAS_PASSWORD env vars without prompting', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'env-user';
+                    process.env.SAS_PASSWORD = 'env-pass';
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utils_2.getString).not.toHaveBeenCalled();
+                    expect(prompts_1.default).not.toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'env-user', 'env-pass');
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Env var username only — password still prompted interactively
+    // ---------------------------------------------------------------------------
+    it('should use SAS_USERNAME but prompt for password when only username env var is set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'env-user';
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utils_2.getString).not.toHaveBeenCalled();
+                    expect(prompts_1.default).toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'env-user', 'test-pass');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Env var password only — username still prompted interactively
+    // ---------------------------------------------------------------------------
+    it('should use SAS_PASSWORD but prompt for username when only password env var is set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.SAS_PASSWORD = 'env-pass';
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utils_2.getString).toHaveBeenCalled();
+                    expect(prompts_1.default).not.toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'test-user', 'env-pass');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // --password-stdin reads password from stdin, username from env
+    // ---------------------------------------------------------------------------
+    it('should read password from stdin and username from SAS_USERNAME when --password-stdin is set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var stdinData, originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'stdin-user';
+                    stdinData = 'stdin-pa55\n';
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            var done = false;
+                            return {
+                                next: function () {
+                                    if (done)
+                                        return Promise.resolve({ done: true, value: undefined });
+                                    done = true;
+                                    return Promise.resolve({
+                                        done: false,
+                                        value: Buffer.from(stdinData)
+                                    });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false, true)];
+                case 2:
+                    _b.sent();
+                    expect(utils_2.getString).not.toHaveBeenCalled();
+                    expect(prompts_1.default).not.toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'stdin-user', 'stdin-pa55');
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // --password-stdin with empty stdin throws a clear error
+    // ---------------------------------------------------------------------------
+    it('should throw when --password-stdin is set but stdin is empty', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'stdin-user';
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            return {
+                                next: function () {
+                                    return Promise.resolve({ done: true, value: undefined });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false, true)).rejects.toThrow(/no password was read from stdin/)];
+                case 2:
+                    _b.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // --password-stdin without SAS_USERNAME throws (can't prompt interactively)
+    // ---------------------------------------------------------------------------
+    it('should throw when --password-stdin is set but SAS_USERNAME is not set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            return {
+                                next: function () {
+                                    return Promise.resolve({ done: true, value: undefined });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false, true)).rejects.toThrow(/SAS_USERNAME/)];
+                case 2:
+                    _b.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // No TTY, no env vars, no --password-stdin → clear error for username
+    // ---------------------------------------------------------------------------
+    it('should throw a clear error when no TTY and no env vars are available (username)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    Object.defineProperty(process.stdin, 'isTTY', {
+                        value: false,
+                        configurable: true
+                    });
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow(/A SAS username is required/)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // No TTY + SAS_USERNAME set but no password → clear error for password
+    // ---------------------------------------------------------------------------
+    it('should throw a clear error when SAS_USERNAME is set but no password source is available', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    Object.defineProperty(process.stdin, 'isTTY', {
+                        value: false,
+                        configurable: true
+                    });
+                    process.env.SAS_USERNAME = 'env-user';
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow(/A SAS password is required/)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Precedence: --password-stdin takes precedence over SAS_PASSWORD
+    // ---------------------------------------------------------------------------
+    it('should prefer --password-stdin over SAS_PASSWORD env var', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var stdinData, originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'env-user';
+                    process.env.SAS_PASSWORD = 'env-pass';
+                    stdinData = 'stdin-pa55\n';
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            var done = false;
+                            return {
+                                next: function () {
+                                    if (done)
+                                        return Promise.resolve({ done: true, value: undefined });
+                                    done = true;
+                                    return Promise.resolve({
+                                        done: false,
+                                        value: Buffer.from(stdinData)
+                                    });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false, true)];
+                case 2:
+                    _b.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'env-user', 'stdin-pa55');
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
 });

package/build/commands/flow/internal/executeFlow.js

@@ -69,7 +69,7 @@ var executeFlow = function (flow, sasjs, pollOptions, target, authConfig, csvFil
                                     return [4 /*yield*/, sasjs
                                             .startComputeJob(jobLocation, null, {
                                             contextName: target.contextName
-                                        }, authConfig, true, pollOptions, true, job.macroVars)
+                                        }, authConfig, true, pollOptions, true, job.macroVars, undefined, (0, utils_1.persistTokensRefreshedByAdapter)(target))
                                             .catch(function (err) { return __awaiter(void 0, void 0, void 0, function () {
                                             var logName, predecessors, data;
                                             var _a, _b, _c, _d;

package/build/commands/job/internal/execute/viya.js

@@ -105,7 +105,7 @@ function executeJobViya(sasjs, authConfig, jobPath, target, waitForJob, output,
                     }
                     _c.label = 5;
                 case 5: return [4 /*yield*/, sasjs
-                        .startComputeJob(jobPath, null, { contextName: contextName }, authConfig, waitForJob || !!logFile, pollOptions, true, macroVars === null || macroVars === void 0 ? void 0 : macroVars.macroVars)
+                        .startComputeJob(jobPath, null, { contextName: contextName }, authConfig, waitForJob || !!logFile, pollOptions, true, macroVars === null || macroVars === void 0 ? void 0 : macroVars.macroVars, undefined, (0, utils_2.persistTokensRefreshedByAdapter)(target))
                         .catch(function (err) { return __awaiter(_this, void 0, void 0, function () {
                         var logData;
                         var _a, _b;

package/build/commands/job/spec/execute.spec.js

@@ -68,6 +68,7 @@ var types_1 = require("@sasjs/utils/types");
 var path_1 = __importDefault(require("path"));
 var utils_2 = require("../../../utils");
 var utilsModule = __importStar(require("../../../utils/utils"));
+var configUtils = __importStar(require("../../../utils/config"));
 var execute_1 = require("../internal/execute");
 var mocks_1 = require("./mocks");
 var sasjs = new node_1.default();
@@ -104,7 +105,7 @@ describe('executeJobViya', function () {
                         pollInterval: 0,
                         streamLog: true,
                         logFolderPath: testLogsPath
-                    }, true, undefined);
+                    }, true, undefined, undefined, expect.any(Function));
                     return [4 /*yield*/, (0, utils_1.deleteFile)(testFilePath)];
                 case 2:
                     _a.sent();
@@ -125,7 +126,7 @@ describe('executeJobViya', function () {
                         pollInterval: 0,
                         streamLog: false,
                         logFolderPath: testLogsPath
-                    }, true, undefined);
+                    }, true, undefined, undefined, expect.any(Function));
                     return [4 /*yield*/, (0, utils_1.deleteFile)(testFilePath)];
                 case 2:
                     _a.sent();
@@ -133,6 +134,27 @@ describe('executeJobViya', function () {
             }
         });
     }); });
+    it('should pass persistTokensRefreshedByAdapter(target) as onTokensRefreshed', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var spy, callArgs, onTokensRefreshed;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    spy = jest
+                        .spyOn(configUtils, 'persistTokensRefreshedByAdapter')
+                        .mockImplementation(function () { return jest.fn(); });
+                    return [4 /*yield*/, (0, execute_1.executeJobViya)(sasjs, mocks_1.mockAuthConfig, 'test/job', target, false, false, undefined, undefined, false, undefined, false)];
+                case 1:
+                    _a.sent();
+                    expect(spy).toHaveBeenCalledWith(target);
+                    callArgs = sasjs.startComputeJob.mock.calls[0];
+                    onTokensRefreshed = callArgs[callArgs.length - 1];
+                    expect(onTokensRefreshed).toBeDefined();
+                    expect(typeof onTokensRefreshed).toEqual('function');
+                    spy.mockRestore();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
 });
 describe('executeJobSasjs', function () {
     beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {

package/package.json

@@ -69,7 +69,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@sasjs/adapter": "^4.18.0",
+    "@sasjs/adapter": "^4.19.0",
     "@sasjs/core": "4.68.1",
     "@sasjs/lint": "2.4.3",
     "@sasjs/utils": "^3.6.0",
@@ -124,5 +124,5 @@
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "4.19.0"
+  "version": "4.20.1"
 }