import type { User, IdToken, PopupLoginOptions, PopupConfigOptions, RedirectLoginResult, GetTokenSilentlyOptions, GetTokenSilentlyVerboseResponse, GetTokenWithPopupOptions, ConnectAccountRedirectResult, CustomFetchMinimalOutput, Fetcher, FetcherConfig, MfaApiClient, CustomTokenExchangeOptions, TokenEndpointResponse, PasskeyApiClient, MyAccountApiClient } from '@auth0/auth0-spa-js';
import type { Ref } from 'vue';
import type { AppState } from './app-state';
import type { LogoutOptions, RedirectLoginOptions } from './auth0-vue-client-options';
export interface Auth0VueClient {
    /**
     * The loading state of the SDK, `true` if the SDK is still processing the PKCE flow, `false` if the SDK has finished processing the PKCE flow.
     */
    isLoading: Ref<boolean>;
    /**
     * The authentication state, `true` if the user is authenticated, `false` if not.
     */
    isAuthenticated: Ref<boolean>;
    /**
     * Contains the information of the user if available.
     */
    user: Ref<User | undefined>;
    /**
     * Contains all claims from the id_token if available.
     */
    idTokenClaims: Ref<IdToken | undefined>;
    /**
     * Contains an error that occured in the SDK
     */
    error: Ref<any>;
    /**
     * ```js
     * try {
     *  await loginWithPopup(options);
     * } catch(e) {
     *  if (e instanceof PopupCancelledError) {
     *    // Popup was closed before login completed
     *  }
     * }
     * ```
     *
     * Opens a popup with the `/authorize` URL using the parameters
     * provided as arguments. Random and secure `state` and `nonce`
     * parameters will be auto-generated. If the response is successful,
     * results will be valid according to their expiration times.
     *
     * IMPORTANT: This method has to be called from an event handler
     * that was started by the user like a button click, for example,
     * otherwise the popup will be blocked in most browsers.
     *
     * @param options
     * @param config
     */
    loginWithPopup(options?: PopupLoginOptions, config?: PopupConfigOptions): Promise<void>;
    /**
     * ```js
     * await loginWithRedirect(options);
     * ```
     *
     * Performs a redirect to `/authorize` using the parameters
     * provided as arguments. Random and secure `state` and `nonce`
     * parameters will be auto-generated.
     *
     * @param options
     */
    loginWithRedirect(options?: RedirectLoginOptions<AppState>): Promise<void>;
    /**
     * ```js
     * const tokenResponse = await loginWithCustomTokenExchange({
     *   subject_token: 'external_token_value',
     *   subject_token_type: 'urn:acme:legacy-system-token',
     *   scope: 'openid profile email'
     * });
     * ```
     *
     * Exchanges an external subject token for Auth0 tokens and logs the user in.
     * This method implements the Custom Token Exchange grant as specified in RFC 8693.
     *
     * The exchanged tokens are automatically cached, establishing an authenticated session.
     * After calling this method, `isAuthenticated` will be `true` and `user` will contain
     * the user's information.
     *
     * @param options - The options required to perform the token exchange
     * @returns A promise that resolves to the token endpoint response containing Auth0 tokens
     */
    loginWithCustomTokenExchange(options: CustomTokenExchangeOptions): Promise<TokenEndpointResponse>;
    /**
     * After the browser redirects back to the callback page,
     * call `handleRedirectCallback` to handle success and error
     * responses from Auth0. If the response is successful, results
     * will be valid according to their expiration times.
     *
     * **Note:** The Auth0-Vue SDK handles this for you, unless you set `skipRedirectCallback` to true.
     * In that case, be sure to explicitly call `handleRedirectCallback` yourself.
     */
    handleRedirectCallback(url?: string): Promise<RedirectLoginResult<AppState> | ConnectAccountRedirectResult<AppState>>;
    /**
     * ```js
     * await checkSession();
     * ```
     *
     * Check if the user is logged in using `getTokenSilently`. The difference
     * with `getTokenSilently` is that this doesn't return a token, but it will
     * pre-fill the token cache.
     *
     * This method also heeds the `auth0.{clientId}.is.authenticated` cookie, as an optimization
     *  to prevent calling Auth0 unnecessarily. If the cookie is not present because
     * there was no previous login (or it has expired) then tokens will not be refreshed.
     *
     * @param options
     */
    checkSession(options?: GetTokenSilentlyOptions): Promise<void>;
    /**
     * Fetches a new access token and returns the response from the /oauth/token endpoint, omitting the refresh token.
     *
     * @param options
     */
    getAccessTokenSilently(options: GetTokenSilentlyOptions & {
        detailedResponse: true;
    }): Promise<GetTokenSilentlyVerboseResponse>;
    /**
     * Fetches a new access token and returns it.
     *
     * @param options
     */
    getAccessTokenSilently(options?: GetTokenSilentlyOptions): Promise<string>;
    /**
     * ```js
     * const token = await getTokenWithPopup(options);
     * ```
     * Opens a popup with the `/authorize` URL using the parameters
     * provided as arguments. Random and secure `state` and `nonce`
     * parameters will be auto-generated. If the response is successful,
     * results will be valid according to their expiration times.
     *
     * @param options
     * @param config
     */
    getAccessTokenWithPopup(options?: GetTokenWithPopupOptions, config?: PopupConfigOptions): Promise<string | undefined>;
    /**
     * ```js
     * logout();
     * ```
     *
     * Clears the application session and performs a redirect to `/v2/logout`, using
     * the parameters provided as arguments, to clear the Auth0 session.
     *
     * **Note:** If you are using a custom cache, and specifying `localOnly: true`, and you want to perform actions or read state from the SDK immediately after logout, you should `await` the result of calling `logout`.
     *
     * If the `federated` option is specified it also clears the Identity Provider session.
     * If the `localOnly` option is specified, it only clears the application session.
     * It is invalid to set both the `federated` and `localOnly` options to `true`,
     * and an error will be thrown if you do.
     * [Read more about how Logout works at Auth0](https://auth0.com/docs/logout).
     *
     * @param options
     */
    logout(options?: LogoutOptions): Promise<void>;
    /**
     * ```js
     * const nonce = await getDpopNonce();
     * ```
     *
     * Retrieves the current DPoP nonce value for a specific identifier.
     *
     * The nonce is used to prevent replay attacks when using DPoP (Demonstrating Proof-of-Possession).
     * It may return `undefined` initially before the first server response.
     *
     * **Note:** Requires `useDpop: true` in the Auth0 client configuration.
     *
     * @param id - Optional identifier for the nonce. If omitted, returns the nonce for Auth0 requests.
     *             Use a custom identifier for tracking nonces for different API endpoints.
     */
    getDpopNonce(id?: string): Promise<string | undefined>;
    /**
     * ```js
     * await setDpopNonce('new-nonce-value', 'my-api');
     * ```
     *
     * Stores a DPoP nonce value for future use with a specific identifier.
     *
     * This is typically called automatically when the server provides a new nonce
     * in the `DPoP-Nonce` response header. Manual usage is only needed for advanced scenarios.
     *
     * **Note:** Requires `useDpop: true` in the Auth0 client configuration.
     *
     * @param nonce - The nonce value to store
     * @param id - Optional identifier for the nonce. If omitted, sets the nonce for Auth0 requests.
     *             Use a custom identifier for managing nonces for different API endpoints.
     */
    setDpopNonce(nonce: string, id?: string): Promise<void>;
    /**
     * ```js
     * const proof = await generateDpopProof({
     *   url: 'https://api.example.com/data',
     *   method: 'GET',
     *   accessToken: token
     * });
     * ```
     *
     * Generates a DPoP proof JWT that cryptographically binds an access token to the current client.
     *
     * The proof is a signed JWT that demonstrates possession of the private key associated with
     * the public key in the access token. This prevents token theft and replay attacks.
     *
     * **Note:** Requires `useDpop: true` in the Auth0 client configuration.
     * Most developers should use `createFetcher()` instead, which handles proof generation automatically.
     *
     * @param params - Configuration for generating the proof
     * @param params.url - The target URL for the API request
     * @param params.method - The HTTP method (GET, POST, etc.)
     * @param params.accessToken - The access token to bind to the proof
     * @param params.nonce - Optional nonce value from a previous server response
     */
    generateDpopProof(params: {
        url: string;
        method: string;
        accessToken: string;
        nonce?: string;
    }): Promise<string>;
    /**
     * ```js
     * const fetcher = createFetcher({
     *   dpopNonceId: 'my-api',
     *   baseUrl: 'https://api.example.com'
     * });
     *
     * const response = await fetcher.fetchWithAuth('/data', {
     *   method: 'GET'
     * });
     * const data = await response.json();
     * ```
     *
     * Creates a fetcher instance that automatically handles authentication for API requests.
     *
     * The fetcher automatically:
     * - Retrieves access tokens using `getAccessTokenSilently()`
     * - Adds proper `Authorization` headers
     * - Generates and includes DPoP proofs when using DPoP tokens
     * - Manages DPoP nonces and retries on nonce errors
     * - Handles token refreshing
     *
     * This is the recommended way to make authenticated API calls, especially when using DPoP.
     *
     * @param config - Configuration options for the fetcher
     */
    createFetcher<TOutput extends CustomFetchMinimalOutput = Response>(config?: FetcherConfig<TOutput>): Fetcher<TOutput>;
    /**
     * MFA API client for multi-factor authentication operations.
     *
     * Use this property to handle MFA challenge and enrollment flows
     * after receiving a `MfaRequiredError` from `getAccessTokenSilently`.
     *
     * **Note:** `mfa.verify()` returns raw tokens but does not automatically
     * update Vue's reactive state (`isAuthenticated`, `user`, `idTokenClaims`).
     * Call `checkSession()` after a successful `verify()` to reflect the new
     * session in your components.
     *
     * **Note:** Errors thrown by `mfa` methods are **not** captured in the
     * `error` ref returned by `useAuth0()`. Unlike other SDK methods, MFA
     * operations bypass the plugin's error handling proxy. Always wrap `mfa`
     * calls in a `try/catch` and handle typed MFA errors (e.g.
     * `MfaVerifyError`, `MfaChallengeError`) directly in your component.
     *
     * ```js
     * import { MfaRequiredError } from '@auth0/auth0-vue';
     *
     * const { getAccessTokenSilently, mfa, checkSession } = useAuth0();
     *
     * try {
     *   await getAccessTokenSilently();
     * } catch (e) {
     *   if (e instanceof MfaRequiredError) {
     *     if (e.mfa_requirements?.enroll?.length) {
     *       const factors = await mfa.getEnrollmentFactors(e.mfa_token);
     *       // ... show enrollment UI
     *     } else {
     *       const authenticators = await mfa.getAuthenticators(e.mfa_token);
     *       // ... show challenge UI, then:
     *       await mfa.verify({ mfaToken: e.mfa_token, otp: userCode });
     *       await checkSession(); // refresh isAuthenticated, user, etc.
     *     }
     *   }
     * }
     * ```
     */
    mfa: MfaApiClient;
    /**
     * ```js
     * const { passkey } = useAuth0();
     * const tokens = await passkey.signup({ email: 'user@example.com' });
     * ```
     *
     * Passkey API client for WebAuthn-based passwordless authentication.
     *
     * - `signup(options)` — register a new user and create a passkey credential
     * - `login(options?)` — authenticate an existing user via passkey assertion
     *
     * Both methods handle the full WebAuthn flow internally (challenge → browser
     * credential ceremony → token exchange) and automatically update
     * `isAuthenticated`, `user`, and `idTokenClaims` on completion.
     *
     * **Note:** Errors thrown by `passkey` methods are captured in the `error`
     * ref. You can also wrap calls in a `try/catch` to handle typed passkey
     * errors (e.g. `PasskeyError`, `PasskeyRegisterError`) directly in your component.
     *
     * ```js
     * import { PasskeyError } from '@auth0/auth0-vue';
     *
     * const { passkey } = useAuth0();
     *
     * try {
     *   await passkey.signup({ email: 'user@example.com' });
     *   // isAuthenticated, user, and idTokenClaims are updated automatically
     * } catch (e) {
     *   if (e instanceof PasskeyError) {
     *     // handle passkey-specific errors
     *   }
     * }
     * ```
     */
    passkey: PasskeyApiClient;
    /**
     * ```js
     * const { myAccount } = useAuth0();
     * const factors = await myAccount.getFactors();
     * ```
     *
     * MyAccount API client for self-service account management operations.
     *
     * Provides methods for managing the authenticated user's authentication
     * methods and factors:
     * - `getFactors()` — list all enabled factors and those available for enrollment
     * - `getAuthenticationMethods(type?)` — list enrolled authentication methods, optionally filtered by type
     * - `getAuthenticationMethod(id)` — get a single authentication method by ID
     * - `updateAuthenticationMethod(id, data)` — update an authentication method (e.g. rename)
     * - `deleteAuthenticationMethod(id)` — remove an enrolled authentication method
     * - `enrollmentChallenge(options)` — initiate a two-step enrollment challenge
     * - `enrollmentVerify(options)` — complete enrollment by verifying the challenge
     *
     * **Note:** MyAccount API calls require an access token with the appropriate
     * scope (e.g. `read:me:authentication_methods`). Use MRRT to exchange a
     * refresh token for a scoped access token if needed.
     *
     * ```js
     * const { myAccount } = useAuth0();
     *
     * // List passkey authentication methods
     * const methods = await myAccount.getAuthenticationMethods('passkey');
     *
     * // Enroll a new passkey
     * const challenge = await myAccount.enrollmentChallenge({ type: 'passkey' });
     * const credential = await navigator.credentials.create({ publicKey: challenge.authn_params_public_key });
     * await myAccount.enrollmentVerify({ type: 'passkey', auth_session: challenge.auth_session, location: challenge.location, authn_response: credential });
     * ```
     */
    myAccount: MyAccountApiClient;
}