import * as _auth0_auth0_spa_js from '@auth0/auth0-spa-js';
import { GetTokenSilentlyOptions, ConnectAccountRedirectResult, ResponseType, Auth0ClientOptions, Auth0Client, RedirectLoginOptions as RedirectLoginOptions$1, LogoutOptions as LogoutOptions$1, Authenticator, EnrollParams, EnrollmentResponse, ChallengeAuthenticatorParams, ChallengeResponse, EnrollmentFactor, VerifyParams, TokenEndpointResponse, PasskeySignupOptions, PasskeyLoginOptions, Factor, AuthenticationMethodType, AuthenticationMethod, UpdateAuthenticationMethodRequest, EnrollmentChallengeOptions, EnrollmentChallengeResponse, EnrollmentVerifyOptions, RedirectConnectAccountOptions, PopupLoginOptions, PopupConfigOptions, GetTokenSilentlyVerboseResponse, GetTokenWithPopupOptions, CustomTokenExchangeOptions, RedirectLoginResult, CustomFetchMinimalOutput, FetcherConfig, Fetcher } from '@auth0/auth0-spa-js';
export { AuthenticationError, AuthenticationMethod, AuthenticationMethodType, Authenticator, AuthenticatorType, AuthorizationParams, Cacheable, ChallengeAuthenticatorParams, ChallengeResponse, ConnectAccountRedirectResult, ConnectError, CustomFetchMinimalOutput, CustomTokenExchangeOptions, EmailAuthenticationMethod, EmailEnrollmentChallengeOptions, EmailEnrollmentChallengeResponse, EmailEnrollmentVerifyOptions, EnrollEmailParams, EnrollOtpParams, EnrollParams, EnrollPushParams, EnrollSmsParams, EnrollVoiceParams, EnrollmentChallengeOptions, EnrollmentChallengeResponse, EnrollmentFactor, EnrollmentResponse, EnrollmentVerifyOptions, Factor, Fetcher, FetcherConfig, GenericError, GetTokenSilentlyOptions, GetTokenWithPopupOptions, ICache, IdToken, InMemoryCache, InteractiveErrorHandler, InvalidConfigurationError, IsFederatedDomainOptions, LocalStorageCache, MfaChallengeError, MfaEnrollmentError, MfaEnrollmentFactorsError, MfaError, MfaFactorType, MfaGrantType, MfaListAuthenticatorsError, MfaRequiredError, MfaVerifyError, MissingRefreshTokenError, MissingScopesError, MyAccountApiClient, MyAccountApiError, OobChannel, OobEnrollmentResponse, OtpEnrollmentResponse, PasskeyApiClient, PasskeyAuthenticationMethod, PasskeyChallengeError, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyEnrollmentChallengeOptions, PasskeyEnrollmentChallengeResponse, PasskeyEnrollmentVerifyOptions, PasskeyError, PasskeyErrorResponse, PasskeyGetTokenError, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, PasskeyLoginOptions, PasskeyRegisterError, PasskeyRequestOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeySignupOptions, PasswordAuthenticationMethod, PasswordEnrollmentChallengeOptions, PasswordEnrollmentChallengeResponse, PasswordEnrollmentVerifyOptions, PhoneAuthenticationMethod, PhoneEnrollmentChallengeOptions, PhoneEnrollmentChallengeResponse, PhoneEnrollmentVerifyOptions, PopupCancelledError, PopupConfigOptions, PopupLoginOptions, PopupOpenError, PopupTimeoutError, PushNotificationAuthenticationMethod, PushNotificationEnrollmentChallengeOptions, PushNotificationEnrollmentChallengeResponse, PushNotificationEnrollmentVerifyOptions, RecoveryCodeAuthenticationMethod, RecoveryCodeEnrollmentChallengeOptions, RecoveryCodeEnrollmentChallengeResponse, RecoveryCodeEnrollmentVerifyOptions, RedirectConnectAccountOptions, RefreshTokenMode, ResponseType, TimeoutError, TokenEndpointResponse, TotpAuthenticationMethod, TotpEnrollmentChallengeOptions, TotpEnrollmentChallengeResponse, TotpEnrollmentVerifyOptions, UpdateAuthenticationMethodRequest, UseDpopNonceError, User, VerifyParams, WebAuthnPlatformAuthenticationMethod, WebAuthnRoamingAuthenticationMethod, isFederatedDomain } from '@auth0/auth0-spa-js';
import * as i0 from '@angular/core';
import { Injector, InjectionToken, OnDestroy, ModuleWithProviders, EnvironmentProviders } from '@angular/core';
import * as rxjs from 'rxjs';
import { Observable } from 'rxjs';
import { Location } from '@angular/common';
import { Route, UrlSegment, ActivatedRouteSnapshot, RouterStateSnapshot } from '@angular/router';
import { HttpInterceptor, HttpRequest, HttpHandler, HttpEvent } from '@angular/common/http';

declare class AbstractNavigator {
    private location;
    private readonly router?;
    constructor(location: Location, injector: Injector);
    /**
     * Navigates to the specified url. The router will be used if one is available, otherwise it falls back
     * to `window.history.replaceState`.
     *
     * @param url The url to navigate to
     */
    navigateByUrl(url: string): void;
    static ɵfac: i0.ɵɵFactoryDeclaration<AbstractNavigator, never>;
    static ɵprov: i0.ɵɵInjectableDeclaration<AbstractNavigator>;
}

/**
 * Defines a common set of HTTP methods.
 */
declare const enum HttpMethod {
    Get = "GET",
    Post = "POST",
    Put = "PUT",
    Patch = "PATCH",
    Delete = "DELETE",
    Head = "HEAD"
}
/**
 * Defines the type for a route config entry. Can either be:
 *
 * - an object of type HttpInterceptorRouteConfig
 * - a string
 */
type ApiRouteDefinition = HttpInterceptorRouteConfig | string;
/**
 * A custom type guard to help identify route definitions that are actually HttpInterceptorRouteConfig types.
 *
 * @param def The route definition type
 */
declare function isHttpInterceptorRouteConfig(def: ApiRouteDefinition): def is HttpInterceptorRouteConfig;
/**
 * Configuration for the HttpInterceptor
 */
interface HttpInterceptorConfig {
    allowedList: ApiRouteDefinition[];
}
/**
 * Configuration for a single interceptor route
 */
interface HttpInterceptorRouteConfig {
    /**
     * The URL to test, by supplying the URL to match.
     * If `test` is a match for the current request path from the HTTP client, then
     * an access token is attached to the request in the
     *  ["Authorization" header](https://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-20#section-2.1).
     *
     * If the test does not pass, the request proceeds without the access token attached.
     *
     * A wildcard character can be used to match only the start of the URL.
     *
     * @usagenotes
     *
     * '/api' - exactly match the route /api
     * '/api/*' - match any route that starts with /api/
     */
    uri?: string;
    /**
     * A function that will be called with the HttpRequest.url value, allowing you to do
     * any kind of flexible matching.
     *
     * If this function returns true, then
     * an access token is attached to the request in the
     *  ["Authorization" header](https://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-20#section-2.1).
     *
     * If it returns false, the request proceeds without the access token attached.
     */
    uriMatcher?: (uri: string) => boolean;
    /**
     * The options that are passed to the SDK when retrieving the
     * access token to attach to the outgoing request.
     */
    tokenOptions?: GetTokenSilentlyOptions;
    /**
     * The HTTP method to match on. If specified, the HTTP method of
     * the outgoing request will be checked against this. If there is no match, the
     * Authorization header is not attached.
     *
     * The HTTP method name is case-sensitive.
     */
    httpMethod?: HttpMethod | string;
    /**
     * Allow the HTTP call to be executed anonymously, when no token is available.
     *
     * When omitted (or set to false), calls that match the configuration will fail when no token is available.
     */
    allowAnonymous?: boolean;
}
/**
 * Configuration for the authentication service
 */
interface AuthConfig extends Auth0ClientOptions {
    /**
     * By default, if the page URL has code and state parameters, the SDK will assume they are for
     * an Auth0 application and attempt to exchange the code for a token.
     * In some cases the code might be for something else (e.g. another OAuth SDK). In these
     * instances you can instruct the client to ignore them by setting `skipRedirectCallback`.
     *
     * ```js
     * AuthModule.forRoot({
     *   skipRedirectCallback: window.location.pathname === '/other-callback'
     * })
     * ```
     *
     * **Note**: In the above example, `/other-callback` is an existing route that will be called
     * by any other OAuth provider with a `code` (or `error` in case when something went wrong) and `state`.
     *
     */
    skipRedirectCallback?: boolean;
    /**
     * Configuration for the built-in Http Interceptor, used for
     * automatically attaching access tokens.
     */
    httpInterceptor?: HttpInterceptorConfig;
    /**
     * Path in your application to redirect to when the Authorization server
     * returns an error. Defaults to `/`
     */
    errorPath?: string;
}
/**
 * The account that has been connected during the connect flow.
 */
type ConnectedAccount = Omit<ConnectAccountRedirectResult, 'appState' | 'response_type'>;
/**
 * Angular specific state to be stored before redirect
 * and any account that the user may have connected to.
 */
interface AppState {
    /**
     * Target path the app gets routed to after
     * handling the callback from Auth0 (defaults to '/')
     */
    target?: string;
    /**
     * The connected account information when the user has completed
     * a connect account flow.
     */
    connectedAccount?: ConnectedAccount;
    /**
     * The response type returned from the authentication server.
     */
    response_type?: ResponseType;
    /**
     * Any custom parameter to be stored in appState
     */
    [key: string]: any;
}
/**
 * Injection token for accessing configuration.
 *
 * @usageNotes
 *
 * Use the `Inject` decorator to access the configuration from a service or component:
 *
 * ```
 * class MyService(@Inject(AuthConfigService) config: AuthConfig) {}
 * ```
 */
declare const AuthConfigService: InjectionToken<AuthConfig>;
/**
 * Gets and sets configuration for the internal Auth0 client. This can be
 * used to provide configuration outside of using AuthModule.forRoot, i.e. from
 * a factory provided by APP_INITIALIZER.
 *
 * @usage
 *
 * ```js
 * // app.module.ts
 * // ---------------------------
 * import { AuthModule, AuthClientConfig } from '@auth0/auth0-angular';
 *
 * // Provide an initializer function that returns a Promise
 * function configInitializer(
 *   http: HttpClient,
 *   config: AuthClientConfig
 * ) {
 *   return () =>
 *     http
 *       .get('/config')
 *       .toPromise()
 *       .then((loadedConfig: any) => config.set(loadedConfig));   // Set the config that was loaded asynchronously here
 * }
 *
 * // Provide APP_INITIALIZER with this function. Note that there is no config passed to AuthModule.forRoot
 * imports: [
 *   // other imports..
 *
 *   HttpClientModule,
 *   AuthModule.forRoot(),   //<- don't pass any config here
 * ],
 * providers: [
 *   {
 *     provide: APP_INITIALIZER,
 *     useFactory: configInitializer,    // <- pass your initializer function here
 *     deps: [HttpClient, AuthClientConfig],
 *     multi: true,
 *   },
 * ],
 * ```
 *
 */
declare class AuthClientConfig {
    private config?;
    constructor(config?: AuthConfig);
    /**
     * Sets configuration to be read by other consumers of the service (see usage notes)
     *
     * @param config The configuration to set
     */
    set(config: AuthConfig): void;
    /**
     * Gets the config that has been set by other consumers of the service
     */
    get(): AuthConfig;
    static ɵfac: i0.ɵɵFactoryDeclaration<AuthClientConfig, [{ optional: true; }]>;
    static ɵprov: i0.ɵɵInjectableDeclaration<AuthClientConfig>;
}

/**
 * Tracks the Authentication State for the SDK
 */
declare class AuthState {
    private auth0Client;
    private isLoadingSubject$;
    private refresh$;
    private accessToken$;
    private errorSubject$;
    /**
     * Emits boolean values indicating the loading state of the SDK.
     */
    readonly isLoading$: rxjs.Observable<boolean>;
    /**
     * Trigger used to pull User information from the Auth0Client.
     * Triggers when the access token has changed.
     */
    private accessTokenTrigger$;
    /**
     * Trigger used to pull User information from the Auth0Client.
     * Triggers when an event occurs that needs to retrigger the User Profile information.
     * Events: Login, Access Token change and Logout
     */
    private readonly isAuthenticatedTrigger$;
    /**
     * Emits boolean values indicating the authentication state of the user. If `true`, it means a user has authenticated.
     * This depends on the value of `isLoading$`, so there is no need to manually check the loading state of the SDK.
     */
    readonly isAuthenticated$: rxjs.Observable<boolean>;
    /**
     * Emits details about the authenticated user, or null if not authenticated.
     */
    readonly user$: rxjs.Observable<_auth0_auth0_spa_js.User | null | undefined>;
    /**
     * Emits ID token claims when authenticated, or null if not authenticated.
     */
    readonly idTokenClaims$: rxjs.Observable<_auth0_auth0_spa_js.IdToken | null | undefined>;
    /**
     * Emits errors that occur during login, or when checking for an active session on startup.
     */
    readonly error$: rxjs.Observable<Error>;
    constructor(auth0Client: Auth0Client);
    /**
     * Update the isLoading state using the provided value
     *
     * @param isLoading The new value for isLoading
     */
    setIsLoading(isLoading: boolean): void;
    /**
     * Refresh the state to ensure the `isAuthenticated`, `user$` and `idTokenClaims$`
     * reflect the most up-to-date values from  Auth0Client.
     */
    refresh(): void;
    /**
     * Update the access token, doing so will also refresh the state.
     *
     * @param accessToken The new Access Token
     */
    setAccessToken(accessToken: string): void;
    /**
     * Emits the error in the `error$` observable.
     *
     * @param error The new error
     */
    setError(error: any): void;
    static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
    static ɵprov: i0.ɵɵInjectableDeclaration<AuthState>;
}

interface RedirectLoginOptions<TAppState> extends Omit<RedirectLoginOptions$1<TAppState>, 'onRedirect'> {
}
interface LogoutOptions extends Omit<LogoutOptions$1, 'onRedirect'> {
}
/**
 * Observable-based MFA API client exposed by `AuthService.mfa`.
 *
 * This is the Angular counterpart of `MfaApiClient` from `@auth0/auth0-spa-js`.
 * All methods return `Observable` instead of `Promise`.
 */
interface ObservableMfaApiClient {
    /**
     * Returns the list of enrolled MFA authenticators for the current user,
     * filtered by the challenge types stored in the MFA context.
     * @throws {MfaListAuthenticatorsError}
     */
    getAuthenticators(mfaToken: string): Observable<Authenticator[]>;
    /**
     * Enrolls a new MFA authenticator (OTP, SMS, Voice, Email, or Push).
     * @throws {MfaEnrollmentError}
     */
    enroll(params: EnrollParams): Observable<EnrollmentResponse>;
    /**
     * Initiates an MFA challenge, sending an OOB code via SMS, email, or push,
     * or preparing for OTP entry. Required for all factor types except OTP,
     * where it is optional.
     * @throws {MfaChallengeError}
     */
    challenge(params: ChallengeAuthenticatorParams): Observable<ChallengeResponse>;
    /**
     * Returns the available enrollment factors from the stored MFA context.
     * A non-empty result means the user must enroll before they can authenticate.
     * @throws {MfaEnrollmentFactorsError}
     */
    getEnrollmentFactors(mfaToken: string): Observable<EnrollmentFactor[]>;
    /**
     * Verifies an MFA challenge and returns raw tokens. The grant type is inferred
     * automatically from the provided field: `otp`, `oobCode`, or `recoveryCode`.
     * Angular auth state (`isAuthenticated$`, `user$`) is not updated automatically —
     * call `getAccessTokenSilently()` afterwards to reflect the new session.
     * @throws {MfaVerifyError}
     */
    verify(params: VerifyParams): Observable<TokenEndpointResponse>;
}
/**
 * Observable-based Passkey API client exposed by `AuthService.passkey`.
 *
 * Wraps `PasskeyApiClient` from `@auth0/auth0-spa-js`. Both methods handle the
 * full WebAuthn flow internally and update Angular auth state on success.
 * All methods return `Observable` instead of `Promise`.
 */
interface ObservablePasskeyApiClient {
    /**
     * Registers a new user with a passkey credential.
     * Updates `isAuthenticated$` and `user$` on success.
     * @throws {PasskeyRegisterError}
     * @throws {PasskeyGetTokenError}
     * @throws {PasskeyError}
     */
    signup(options: PasskeySignupOptions): Observable<TokenEndpointResponse>;
    /**
     * Authenticates an existing user via passkey assertion.
     * Updates `isAuthenticated$` and `user$` on success.
     * @throws {PasskeyChallengeError}
     * @throws {PasskeyGetTokenError}
     * @throws {PasskeyError}
     */
    login(options?: PasskeyLoginOptions): Observable<TokenEndpointResponse>;
}
/**
 * Observable-based MyAccount API client exposed by `AuthService.myAccount`.
 *
 * This is the Angular counterpart of `MyAccountApiClient` from `@auth0/auth0-spa-js`.
 * All methods return `Observable` instead of `Promise`.
 */
interface ObservableMyAccountApiClient {
    /**
     * Returns the list of factors with their enabled and enrollment status.
     * @throws {MyAccountApiError}
     */
    getFactors(): Observable<Factor[]>;
    /**
     * Returns the authenticated user's enrolled authentication methods,
     * optionally filtered by type.
     * @throws {MyAccountApiError}
     */
    getAuthenticationMethods(type?: AuthenticationMethodType): Observable<AuthenticationMethod[]>;
    /**
     * Returns a single authentication method by its ID.
     * @throws {MyAccountApiError}
     */
    getAuthenticationMethod(id: string): Observable<AuthenticationMethod>;
    /**
     * Deletes the specified authentication method.
     * @throws {MyAccountApiError}
     */
    deleteAuthenticationMethod(id: string): Observable<void>;
    /**
     * Updates the specified authentication method (e.g. name, preferred phone method).
     * @throws {MyAccountApiError}
     */
    updateAuthenticationMethod(id: string, data: UpdateAuthenticationMethodRequest): Observable<AuthenticationMethod>;
    /**
     * Starts enrollment of an authentication method.
     * Returns a challenge response containing `auth_session` and type-specific data.
     * @throws {MyAccountApiError}
     */
    enrollmentChallenge(options: EnrollmentChallengeOptions): Observable<EnrollmentChallengeResponse>;
    /**
     * Completes enrollment by verifying the challenge response.
     * Returns the created `AuthenticationMethod`.
     * @throws {MyAccountApiError}
     */
    enrollmentVerify(options: EnrollmentVerifyOptions): Observable<AuthenticationMethod>;
}

declare class AuthService<TAppState extends AppState = AppState> implements OnDestroy {
    private auth0Client;
    private configFactory;
    private navigator;
    private authState;
    private appStateSubject$;
    private ngUnsubscribe$;
    /**
     * Emits boolean values indicating the loading state of the SDK.
     */
    readonly isLoading$: Observable<boolean>;
    /**
     * Emits boolean values indicating the authentication state of the user. If `true`, it means a user has authenticated.
     * This depends on the value of `isLoading$`, so there is no need to manually check the loading state of the SDK.
     */
    readonly isAuthenticated$: Observable<boolean>;
    /**
     * Emits details about the authenticated user, or null if not authenticated.
     */
    readonly user$: Observable<_auth0_auth0_spa_js.User | null | undefined>;
    /**
     * Emits ID token claims when authenticated, or null if not authenticated.
     */
    readonly idTokenClaims$: Observable<_auth0_auth0_spa_js.IdToken | null | undefined>;
    /**
     * Emits errors that occur during login, or when checking for an active session on startup.
     */
    readonly error$: Observable<Error>;
    /**
     * Emits the value (if any) that was passed to the `loginWithRedirect` method call
     * but only **after** `handleRedirectCallback` is first called
     */
    readonly appState$: Observable<TAppState>;
    constructor(auth0Client: Auth0Client, configFactory: AuthClientConfig, navigator: AbstractNavigator, authState: AuthState);
    /**
     * Called when the service is destroyed
     */
    ngOnDestroy(): void;
    /**
     * ```js
     * loginWithRedirect(options);
     * ```
     *
     * Performs a redirect to `/authorize` using the parameters
     * provided as arguments. Random and secure `state` and `nonce`
     * parameters will be auto-generated.
     *
     * @param options The login options
     */
    loginWithRedirect(options?: RedirectLoginOptions<TAppState>): Observable<void>;
    /**
     * ```js
     * connectAccountWithRedirect({
     *   connection: 'google-oauth2',
     *   scopes: ['openid', 'profile', 'email', 'https://www.googleapis.com/auth/drive.readonly'],
     *   authorization_params: {
     *     // additional authorization params to forward to the authorization server
     *   }
     * });
     * ```
     *
     * Redirects to the `/connect` URL using the parameters
     * provided as arguments. This then redirects to the connection's login page
     * where the user can authenticate and authorize the account to be connected.
     *
     * If connecting the account is successful, `handleRedirectCallback` will be called
     * with the details of the connected account.
     *
     * @param options The connect account options
     */
    connectAccountWithRedirect(options: RedirectConnectAccountOptions<TAppState>): Observable<void>;
    /**
     * ```js
     * await loginWithPopup(options);
     * ```
     *
     * Opens a popup with the `/authorize` URL using the parameters
     * provided as arguments. Random and secure `state` and `nonce`
     * parameters will be auto-generated. If the response is successful,
     * results will be valid according to their expiration times.
     *
     * IMPORTANT: This method has to be called from an event handler
     * that was started by the user like a button click, for example,
     * otherwise the popup will be blocked in most browsers.
     *
     * @param options The login options
     * @param config Configuration for the popup window
     */
    loginWithPopup(options?: PopupLoginOptions, config?: PopupConfigOptions): Observable<void>;
    /**
     * ```js
     * logout();
     * ```
     *
     * Clears the application session and performs a redirect to `/v2/logout`, using
     * the parameters provided as arguments, to clear the Auth0 session.
     * If the `federated` option is specified it also clears the Identity Provider session.
     * If the `openUrl` option is set to false, it only clears the application session.
     * It is invalid to set both the `federated` to true and `openUrl` to `false`,
     * and an error will be thrown if you do.
     * [Read more about how Logout works at Auth0](https://auth0.com/docs/logout).
     *
     * @param options The logout options
     */
    logout(options?: LogoutOptions): Observable<void>;
    /**
     * Fetches a new access token and returns the response from the /oauth/token endpoint, omitting the refresh token.
     *
     * @param options The options for configuring the token fetch.
     */
    getAccessTokenSilently(options: GetTokenSilentlyOptions & {
        detailedResponse: true;
    }): Observable<GetTokenSilentlyVerboseResponse | undefined>;
    /**
     * Fetches a new access token and returns it.
     *
     * @param options The options for configuring the token fetch.
     */
    getAccessTokenSilently(options?: GetTokenSilentlyOptions): Observable<string | undefined>;
    /**
     * ```js
     * getTokenWithPopup(options).subscribe(token => ...)
     * ```
     *
     * Get an access token interactively.
     *
     * Opens a popup with the `/authorize` URL using the parameters
     * provided as arguments. Random and secure `state` and `nonce`
     * parameters will be auto-generated. If the response is successful,
     * results will be valid according to their expiration times.
     */
    getAccessTokenWithPopup(options?: GetTokenWithPopupOptions): Observable<string | undefined>;
    /**
     * ```js
     * loginWithCustomTokenExchange(options).subscribe(tokenResponse => ...)
     * ```
     *
     * Exchanges an external subject token for Auth0 tokens and establishes an authenticated session.
     *
     * This method implements the token exchange grant as specified in RFC 8693.
     * It performs a token exchange by sending a request to the `/oauth/token` endpoint
     * with the external token and returns Auth0 tokens (access token, ID token, etc.).
     *
     * The request includes the following parameters:
     * - `grant_type`: Hard-coded to "urn:ietf:params:oauth:grant-type:token-exchange"
     * - `subject_token`: The external token to be exchanged
     * - `subject_token_type`: A namespaced URI identifying the token type (must be under your organization's control)
     * - `audience`: The target audience (falls back to the SDK's default audience if not provided)
     * - `scope`: Space-separated list of scopes (merged with the SDK's default scopes)
     *
     * After a successful token exchange, this method updates the authentication state
     * to ensure consistency with the standard authentication flows.
     *
     * @param options The options required to perform the token exchange
     * @returns An Observable that emits the token endpoint response containing Auth0 tokens
     */
    loginWithCustomTokenExchange(options: CustomTokenExchangeOptions): Observable<TokenEndpointResponse>;
    /**
     * ```js
     * handleRedirectCallback(url).subscribe(result => ...)
     * ```
     *
     * After the browser redirects back to the callback page,
     * call `handleRedirectCallback` to handle success and error
     * responses from Auth0. If the response is successful, results
     * will be valid according to their expiration times.
     *
     * Calling this method also refreshes the authentication and user states.
     *
     * @param url The URL to that should be used to retrieve the `state` and `code` values. Defaults to `window.location.href` if not given.
     */
    handleRedirectCallback(url?: string): Observable<RedirectLoginResult<TAppState> | ConnectAccountRedirectResult<TAppState>>;
    /**
     * ```js
     * getDpopNonce(id).subscribe(nonce => ...)
     * ```
     *
     * Gets the DPoP nonce for the specified domain or the default domain.
     * The nonce is used in DPoP proof generation for token binding.
     *
     * @param id Optional identifier for the domain. If not provided, uses the default domain.
     * @returns An Observable that emits the DPoP nonce string or undefined if not available.
     */
    getDpopNonce(id?: string): Observable<string | undefined>;
    /**
     * ```js
     * setDpopNonce(nonce, id).subscribe(() => ...)
     * ```
     *
     * Sets the DPoP nonce for the specified domain or the default domain.
     * This is typically used after receiving a new nonce from the authorization server.
     *
     * @param nonce The DPoP nonce value to set.
     * @param id Optional identifier for the domain. If not provided, uses the default domain.
     * @returns An Observable that completes when the nonce is set.
     */
    setDpopNonce(nonce: string, id?: string): Observable<void>;
    /**
     * ```js
     * generateDpopProof(params).subscribe(proof => ...)
     * ```
     *
     * Generates a DPoP (Demonstrating Proof-of-Possession) proof JWT.
     * This proof is used to bind access tokens to a specific client, providing
     * an additional layer of security for token usage.
     *
     * @param params Configuration for generating the DPoP proof
     * @param params.url The URL of the resource server endpoint
     * @param params.method The HTTP method (e.g., 'GET', 'POST')
     * @param params.nonce Optional DPoP nonce from the authorization server
     * @param params.accessToken The access token to bind to the proof
     * @returns An Observable that emits the generated DPoP proof as a JWT string.
     */
    generateDpopProof(params: {
        url: string;
        method: string;
        nonce?: string;
        accessToken: string;
    }): Observable<string>;
    /**
     * ```js
     * const fetcher = createFetcher(config);
     * ```
     *
     * Creates a custom fetcher instance that can be used to make authenticated
     * HTTP requests. The fetcher automatically handles token refresh and can
     * be configured with custom request/response handling.
     *
     * @param config Optional configuration for the fetcher
     * @returns A Fetcher instance configured with the Auth0 client.
     */
    createFetcher<TOutput extends CustomFetchMinimalOutput = Response>(config?: FetcherConfig<TOutput>): Fetcher<TOutput>;
    /**
     * Provides MFA (Multi-Factor Authentication) operations as Observables.
     *
     * These methods are available after `getAccessTokenSilently` throws an `MfaRequiredError`.
     * Use the `mfa_token` from the error to call these methods.
     */
    readonly mfa: ObservableMfaApiClient;
    /**
     * Provides Passkey (WebAuthn) authentication as Observables.
     *
     * Both methods handle the full WebAuthn challenge-response flow internally.
     * After a successful call, this updates the authentication state to ensure
     * consistency with the standard authentication flows.
     */
    readonly passkey: ObservablePasskeyApiClient;
    /**
     * Provides MyAccount API operations as Observables.
     *
     * Allows the authenticated user to list, enroll, update, and delete their
     * authentication methods. Requires an access token with the appropriate
     * `read/create/update/delete:me:authentication-methods` scopes.
     */
    readonly myAccount: ObservableMyAccountApiClient;
    private shouldHandleCallback;
    static ɵfac: i0.ɵɵFactoryDeclaration<AuthService<any>, never>;
    static ɵprov: i0.ɵɵInjectableDeclaration<AuthService<any>>;
}

declare class AuthModule {
    /**
     * Initialize the authentication module system. Configuration can either be specified here,
     * or by calling AuthClientConfig.set (perhaps from an APP_INITIALIZER factory function).
     *
     * @param config The optional configuration for the SDK.
     */
    static forRoot(config?: AuthConfig): ModuleWithProviders<AuthModule>;
    static ɵfac: i0.ɵɵFactoryDeclaration<AuthModule, never>;
    static ɵmod: i0.ɵɵNgModuleDeclaration<AuthModule, never, never, never>;
    static ɵinj: i0.ɵɵInjectorDeclaration<AuthModule>;
}

declare class AuthGuard {
    private auth;
    constructor(auth: AuthService);
    canLoad(route: Route, segments: UrlSegment[]): Observable<boolean>;
    canActivate(next: ActivatedRouteSnapshot, state: RouterStateSnapshot): Observable<boolean>;
    canActivateChild(childRoute: ActivatedRouteSnapshot, state: RouterStateSnapshot): Observable<boolean>;
    private redirectIfUnauthenticated;
    static ɵfac: i0.ɵɵFactoryDeclaration<AuthGuard, never>;
    static ɵprov: i0.ɵɵInjectableDeclaration<AuthGuard>;
}

declare class AuthHttpInterceptor implements HttpInterceptor {
    private configFactory;
    private auth0Client;
    private authState;
    private authService;
    constructor(configFactory: AuthClientConfig, auth0Client: Auth0Client, authState: AuthState, authService: AuthService);
    intercept(req: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>>;
    /**
     * Duplicate of AuthService.getAccessTokenSilently, but with a slightly different error handling.
     * Only used internally in the interceptor.
     *
     * @param options The options for configuring the token fetch.
     */
    private getAccessTokenSilently;
    /**
     * Strips the query and fragment from the given uri
     *
     * @param uri The uri to remove the query and fragment from
     */
    private stripQueryFrom;
    /**
     * Determines whether the specified route can have an access token attached to it, based on matching the HTTP request against
     * the interceptor route configuration.
     *
     * @param route The route to test
     * @param request The HTTP request
     */
    private canAttachToken;
    /**
     * Tries to match a route from the SDK configuration to the HTTP request.
     * If a match is found, the route configuration is returned.
     *
     * @param request The Http request
     * @param config HttpInterceptorConfig
     */
    private findMatchingRoute;
    private allowAnonymous;
    static ɵfac: i0.ɵɵFactoryDeclaration<AuthHttpInterceptor, never>;
    static ɵprov: i0.ɵɵInjectableDeclaration<AuthHttpInterceptor>;
}

declare class Auth0ClientFactory {
    static createClient(configFactory: AuthClientConfig): Auth0Client;
}
declare const Auth0ClientService: InjectionToken<Auth0Client>;

/**
 * Initialize the authentication system. Configuration can either be specified here,
 * or by calling AuthClientConfig.set (perhaps from an APP_INITIALIZER factory function).
 *
 * Note: Should only be used as of Angular 15. This function returns `EnvironmentProviders`
 * which ensures it can only be used at the application/environment level and cannot be
 * added to a component's providers array (this will result in a compile-time error).
 *
 * @param config The optional configuration for the SDK.
 *
 * @example
 * bootstrapApplication(AppComponent, {
 *   providers: [
 *     provideAuth0(),
 *   ],
 * });
 */
declare function provideAuth0(config?: AuthConfig): EnvironmentProviders;

/**
 * Functional AuthGuard to ensure routes can only be accessed when authenticated.
 *
 * Note: Should only be used as of Angular 15
 *
 * @param route Contains the information about a route associated with a component loaded in an outlet at a particular moment in time.
 * @param state Represents the state of the router at a moment in time.
 * @returns An Observable, indicating if the route can be accessed or not
 */
declare const authGuardFn: (route: ActivatedRouteSnapshot, state: RouterStateSnapshot) => Observable<boolean>;
/**
 * Functional AuthHttpInterceptor to include the access token in matching requests.
 *
 * Note: Should only be used as of Angular 15
 *
 * @param req An outgoing HTTP request with an optional typed body.
 * @param handle Represents the next interceptor in an interceptor chain, or the real backend if there are no
 * further interceptors.
 * @returns An Observable representing the intercepted HttpRequest
 */
declare const authHttpInterceptorFn: (req: HttpRequest<any>, handle: (req: HttpRequest<unknown>) => Observable<HttpEvent<unknown>>) => Observable<HttpEvent<any>>;

export { AbstractNavigator, Auth0ClientFactory, Auth0ClientService, AuthClientConfig, AuthConfigService, AuthGuard, AuthHttpInterceptor, AuthModule, AuthService, AuthState, HttpMethod, authGuardFn, authHttpInterceptorFn, isHttpInterceptorRouteConfig, provideAuth0 };
export type { ApiRouteDefinition, AppState, AuthConfig, ConnectedAccount, HttpInterceptorConfig, HttpInterceptorRouteConfig, LogoutOptions, ObservableMfaApiClient, ObservableMyAccountApiClient, ObservablePasskeyApiClient, RedirectLoginOptions };