@newheap/platform-common 1.3.1 → 1.4.0

package/fesm2022/newheap-platform-common.mjs

@@ -33,6 +33,32 @@ class EndpointsAuthenticationNhCommonModuleConfig {
         this.impersonate = '/authentication/impersonate';
         this.revertImpersonate = '/authentication/ImpersonateRevert';
         this.accountInformation = '/account';
+        this.twoFactorVerify = '/authentication/two-factor/verify';
+        this.twoFactorStatus = '/account/two-factor';
+        this.twoFactorAuthenticator = '/account/two-factor/authenticator';
+        this.twoFactorAuthenticatorConfirm = '/account/two-factor/authenticator/confirm';
+        this.twoFactorRecoveryCodes = '/account/two-factor/recovery-codes';
+        this.twoFactorDisable = '/account/two-factor/disable';
+        this.twoFactorForgetDevices = '/account/two-factor/forget-devices';
+        this.twoFactorEmailSetup = '/account/two-factor/email';
+        this.twoFactorEmailConfirm = '/account/two-factor/email/confirm';
+        this.twoFactorEmail = '/authentication/two-factor/email';
+        this.twoFactorPasskeyOptions = '/authentication/two-factor/passkey/options';
+        this.twoFactorPasskey = '/authentication/two-factor/passkey';
+        this.twoFactorEnrollmentAuthenticator = '/authentication/two-factor/enrollment/authenticator';
+        this.twoFactorEnrollmentAuthenticatorConfirm = '/authentication/two-factor/enrollment/authenticator/confirm';
+        this.twoFactorEnrollmentEmail = '/authentication/two-factor/enrollment/email';
+        this.twoFactorEnrollmentEmailConfirm = '/authentication/two-factor/enrollment/email/confirm';
+        this.twoFactorEnrollmentPasskeyOptions = '/authentication/two-factor/enrollment/passkey/options';
+        this.twoFactorEnrollmentPasskey = '/authentication/two-factor/enrollment/passkey';
+        /** Administration route; `{userId}` is replaced with the user ID. */
+        this.twoFactorUserReset = '/authentication/two-factor/users/{userId}/reset';
+        this.twoFactorEnrollmentReminders = '/authentication/two-factor/operations/enrollment-reminders';
+        this.twoFactorSessionRevocation = '/authentication/two-factor/operations/session-revocation';
+        this.passkeySignInOptions = '/authentication/passkey/options';
+        this.passkeySignIn = '/authentication/passkey/login';
+        this.passkeys = '/account/passkeys';
+        this.passkeyRegistrationOptions = '/account/passkeys/options';
         Object.assign(this, init);
     }
 }
@@ -617,6 +643,174 @@ class RevertImpersonateAuthenticateModel {
         Object.assign(this, init);
     }
 }
+/**
+ * Second-factor methods a user can present after the first factor succeeded.
+ */
+const NhTwoFactorMethods = {
+    authenticator: 'authenticator',
+    recoveryCode: 'recovery-code',
+    email: 'email',
+    passkey: 'passkey'
+};
+/**
+ * Safe failure codes returned by the two-factor endpoints. Each error item uses the code as
+ * its name and `nh-two-factor.<suffix>` as its translation key.
+ */
+var NhTwoFactorFailureCodes;
+(function (NhTwoFactorFailureCodes) {
+    NhTwoFactorFailureCodes["Required"] = "two-factor-required";
+    NhTwoFactorFailureCodes["EnrollmentRequired"] = "two-factor-enrollment-required";
+    NhTwoFactorFailureCodes["InvalidCode"] = "two-factor-invalid-code";
+    NhTwoFactorFailureCodes["ChallengeExpired"] = "two-factor-challenge-expired";
+    NhTwoFactorFailureCodes["LockedOut"] = "two-factor-locked-out";
+    NhTwoFactorFailureCodes["MethodNotAllowed"] = "two-factor-method-not-allowed";
+    NhTwoFactorFailureCodes["NotEnabled"] = "two-factor-not-enabled";
+    NhTwoFactorFailureCodes["AlreadyEnabled"] = "two-factor-already-enabled";
+    NhTwoFactorFailureCodes["SetupNotStarted"] = "two-factor-setup-not-started";
+    NhTwoFactorFailureCodes["ReauthenticationRequired"] = "two-factor-reauthentication-required";
+    NhTwoFactorFailureCodes["ReauthenticationFailed"] = "two-factor-reauthentication-failed";
+    NhTwoFactorFailureCodes["RequiredByPolicy"] = "two-factor-required-by-policy";
+    NhTwoFactorFailureCodes["NotAllowedWhileImpersonating"] = "two-factor-not-allowed-while-impersonating";
+    NhTwoFactorFailureCodes["ConfigurationInvalid"] = "two-factor-configuration-invalid";
+    NhTwoFactorFailureCodes["EmailCooldown"] = "two-factor-email-cooldown";
+    NhTwoFactorFailureCodes["EmailUnavailable"] = "two-factor-email-unavailable";
+    NhTwoFactorFailureCodes["UserNotFound"] = "two-factor-user-not-found";
+    NhTwoFactorFailureCodes["PasskeyInvalid"] = "two-factor-passkey-invalid";
+    NhTwoFactorFailureCodes["PasskeyNotFound"] = "two-factor-passkey-not-found";
+    /** The browser does not support passkeys or the user cancelled the passkey prompt. */
+    NhTwoFactorFailureCodes["PasskeyUnavailable"] = "two-factor-passkey-unavailable";
+})(NhTwoFactorFailureCodes || (NhTwoFactorFailureCodes = {}));
+/**
+ * Status values of a pending authentication step.
+ */
+const NhAuthenticationStepStatuses = {
+    twoFactorRequired: 'two-factor-required',
+    enrollmentRequired: 'enrollment-required'
+};
+/**
+ * A pending sign-in step. With status `two-factor-required` the user presents a second
+ * factor; with `enrollment-required` the policy requires the user to enroll one first, and
+ * `challengeToken` is the enrollment token.
+ */
+class NhTwoFactorChallenge {
+    constructor(init) {
+        this.status = NhAuthenticationStepStatuses.twoFactorRequired;
+        this.challengeToken = '';
+        this.expiresAt = '';
+        this.methods = [];
+        /** Whether completing the challenge can remember this device for later sign-ins. */
+        this.rememberDeviceAvailable = false;
+        Object.assign(this, init);
+    }
+}
+/**
+ * Outcome of an interactive sign-in step: the stored authorization, a second-factor
+ * challenge or a required enrollment.
+ */
+class NhAuthenticationStep {
+    constructor(init) {
+        this.status = 'authenticated';
+        Object.assign(this, init);
+    }
+}
+class NhTwoFactorVerifyModel {
+    constructor(init) {
+        this.challengeToken = '';
+        this.method = NhTwoFactorMethods.authenticator;
+        this.code = '';
+        Object.assign(this, init);
+    }
+}
+/**
+ * Proof that the signed-in user is present before a sensitive change: the current password
+ * or a valid second-factor code.
+ */
+class NhTwoFactorReauthentication {
+    constructor(init) {
+        Object.assign(this, init);
+    }
+}
+class NhTwoFactorStatus {
+    constructor(init) {
+        this.enabled = false;
+        this.required = false;
+        this.methods = [];
+        this.availableMethods = [];
+        this.recoveryCodesLeft = 0;
+        this.authenticatorSetupPending = false;
+        this.emailSetupPending = false;
+        this.rememberDeviceAvailable = false;
+        this.passkeyCount = 0;
+        Object.assign(this, init);
+    }
+}
+/**
+ * Pending authenticator enrollment. `qrCodeDataUri` is a PNG data URI rendered by the server.
+ */
+class NhAuthenticatorSetup {
+    constructor(init) {
+        this.sharedKey = '';
+        this.authenticatorUri = '';
+        Object.assign(this, init);
+    }
+}
+/**
+ * Result of a two-factor change. Recovery codes are returned once. When the change ended
+ * every session, the service has already stored the renewed session for this device.
+ */
+class NhTwoFactorChange {
+    constructor(init) {
+        this.sessionRenewed = false;
+        Object.assign(this, init);
+    }
+}
+/**
+ * Confirmation that the server e-mailed a code.
+ */
+class NhTwoFactorEmailCodeSent {
+    constructor(init) {
+        this.expiresAt = '';
+        /** When another code can be requested. */
+        this.resendAvailableAt = '';
+        Object.assign(this, init);
+    }
+}
+/**
+ * Result of an enrollment that the policy required during sign-in. The session is already
+ * stored; the recovery codes are returned once.
+ */
+class NhTwoFactorEnrollmentResult {
+    constructor(init) {
+        Object.assign(this, init);
+    }
+}
+/**
+ * WebAuthn options from the server for one passkey ceremony. `options` is the JSON form of
+ * the creation or request options; `ceremonyToken` goes back with the credential.
+ */
+class NhPasskeyOptions {
+    constructor(init) {
+        this.options = {};
+        this.ceremonyToken = '';
+        this.expiresAt = '';
+        Object.assign(this, init);
+    }
+}
+/**
+ * A registered passkey. The public key is never returned.
+ */
+class NhPasskey {
+    constructor(init) {
+        /** Credential ID, base64url encoded. */
+        this.id = '';
+        this.name = '';
+        this.createdAt = '';
+        /** Whether a passkey provider, such as a password manager, syncs the passkey. */
+        this.isBackedUp = false;
+        this.transports = [];
+        Object.assign(this, init);
+    }
+}
 
 class NhUserNotificationCollectionHttpRequestOptions extends CollectionHttpRequestOptions {
     constructor(init) {
@@ -2340,9 +2534,131 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.28", ngImpo
                     args: [REQUEST_CONTEXT]
                 }] }, { type: i1.CookieService }] });
 
+/**
+ * Runs WebAuthn ceremonies in the browser. The server returns the options in their JSON form
+ * and expects the credential in its JSON form; this client converts both, with a fallback for
+ * browsers without `PublicKeyCredential.parseCreationOptionsFromJSON` and `toJSON()`.
+ */
+class NhPasskeyClient {
+    constructor() {
+        this.platformId = inject(PLATFORM_ID);
+    }
+    /**
+     * Whether the browser supports passkeys. Always false during server-side rendering.
+     */
+    isSupported() {
+        return isPlatformBrowser(this.platformId)
+            && typeof window !== 'undefined'
+            && typeof window.PublicKeyCredential !== 'undefined'
+            && !!navigator.credentials;
+    }
+    /**
+     * Creates a passkey for WebAuthn creation options and returns the credential JSON.
+     * Rejects when the user cancels the prompt or the browser refuses the request.
+     */
+    async create(options) {
+        this.ensureSupported();
+        const parse = PublicKeyCredential.parseCreationOptionsFromJSON;
+        const publicKey = typeof parse === 'function'
+            ? parse.call(PublicKeyCredential, options)
+            : this.creationOptionsFromJSON(options);
+        const credential = await navigator.credentials.create({ publicKey: publicKey });
+        return this.credentialToJSON(this.requireCredential(credential));
+    }
+    /**
+     * Signs WebAuthn request options with a passkey and returns the credential JSON.
+     * Rejects when the user cancels the prompt or the browser refuses the request.
+     */
+    async get(options) {
+        this.ensureSupported();
+        const parse = PublicKeyCredential.parseRequestOptionsFromJSON;
+        const publicKey = typeof parse === 'function'
+            ? parse.call(PublicKeyCredential, options)
+            : this.requestOptionsFromJSON(options);
+        const credential = await navigator.credentials.get({ publicKey: publicKey });
+        return this.credentialToJSON(this.requireCredential(credential));
+    }
+    ensureSupported() {
+        if (!this.isSupported()) {
+            throw new Error('Passkeys are not supported in this browser.');
+        }
+    }
+    requireCredential(credential) {
+        if (!credential || credential.type !== 'public-key') {
+            throw new Error('No passkey was selected.');
+        }
+        return credential;
+    }
+    creationOptionsFromJSON(json) {
+        return {
+            ...json,
+            challenge: NhPasskeyClient.fromBase64Url(json.challenge),
+            user: { ...json.user, id: NhPasskeyClient.fromBase64Url(json.user.id) },
+            excludeCredentials: (json.excludeCredentials ?? []).map((descriptor) => ({
+                ...descriptor,
+                id: NhPasskeyClient.fromBase64Url(descriptor.id)
+            }))
+        };
+    }
+    requestOptionsFromJSON(json) {
+        return {
+            ...json,
+            challenge: NhPasskeyClient.fromBase64Url(json.challenge),
+            allowCredentials: (json.allowCredentials ?? []).map((descriptor) => ({
+                ...descriptor,
+                id: NhPasskeyClient.fromBase64Url(descriptor.id)
+            }))
+        };
+    }
+    credentialToJSON(credential) {
+        const toJSON = credential.toJSON;
+        if (typeof toJSON === 'function') {
+            return toJSON.call(credential);
+        }
+        const response = credential.response;
+        const json = {
+            id: credential.id,
+            rawId: NhPasskeyClient.toBase64Url(credential.rawId),
+            type: credential.type,
+            authenticatorAttachment: credential.authenticatorAttachment ?? undefined,
+            clientExtensionResults: credential.getClientExtensionResults?.() ?? {},
+            response: {
+                clientDataJSON: NhPasskeyClient.toBase64Url(response.clientDataJSON)
+            }
+        };
+        if (response.attestationObject) {
+            json.response.attestationObject = NhPasskeyClient.toBase64Url(response.attestationObject);
+            json.response.transports = typeof response.getTransports === 'function' ? response.getTransports() : [];
+        }
+        if (response.authenticatorData) {
+            json.response.authenticatorData = NhPasskeyClient.toBase64Url(response.authenticatorData);
+            json.response.signature = NhPasskeyClient.toBase64Url(response.signature);
+            json.response.userHandle = response.userHandle ? NhPasskeyClient.toBase64Url(response.userHandle) : null;
+        }
+        return json;
+    }
+    static fromBase64Url(value) {
+        const bytes = Base64.toUint8Array(value);
+        return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    }
+    static toBase64Url(buffer) {
+        return Base64.fromUint8Array(new Uint8Array(buffer), true);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.28", ngImport: i0, type: NhPasskeyClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.28", ngImport: i0, type: NhPasskeyClient, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.28", ngImport: i0, type: NhPasskeyClient, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
 class BaseNhAuthService {
+    static { this.pendingTwoFactorChallengeStorageKey = 'nh-two-factor-challenge'; }
+    static { this.externalTwoFactorChallengePrefix = 'nh-two-factor='; }
+    static { this.rememberDeviceStorageKey = 'nh-two-factor-device'; }
     constructor() {
         this.authorization = undefined;
+        this.pendingTwoFactorChallenge = undefined;
         this.authSession = undefined;
         this.authSubject = new BehaviorSubject(this.getAuthorization());
         this._sessionExpirationInformation = new BehaviorSubject(this.getSessionExpirationInformation());
@@ -2352,6 +2668,7 @@ class BaseNhAuthService {
         this.httpClient = inject(HttpClient);
         this.platformId = inject(PLATFORM_ID);
         this.requestContext = inject(REQUEST_CONTEXT, { optional: true });
+        this.passkeyClient = inject(NhPasskeyClient);
         this.authReady = new Promise(resolve => {
             this.onReady = resolve;
         });
@@ -2590,23 +2907,44 @@ class BaseNhAuthService {
             withCredentials: true
         }).taskResultLastValueFrom();
     }
+    /**
+     * Signs in with username and password and stores the complete session.
+     *
+     * When the server requires a second factor this method fails with
+     * `NhTwoFactorFailureCodes.Required` and stores nothing. Use `authenticateInteractive`
+     * to receive the challenge, or read it with `getPendingTwoFactorChallenge()`.
+     */
     async authenticate(model, loginAsUser = false) {
         const result = new TaskResult();
-        let httpParams = new HttpParams();
-        if (httpParams.get('language') === null) {
-            httpParams = httpParams.set('language', this.moduleConfig.language);
+        const stepResult = await this.authenticateInteractive(model);
+        if (!stepResult.isSuccess) {
+            stepResult.copyTo(result);
+            return result;
         }
+        if (stepResult.data?.status === 'two-factor-required') {
+            return result.withError(NhTwoFactorFailureCodes.Required, 'nh-two-factor.required');
+        }
+        if (stepResult.data?.status === 'enrollment-required') {
+            return result.withError(NhTwoFactorFailureCodes.EnrollmentRequired, 'nh-two-factor.enrollment-required');
+        }
+        result.data = stepResult.data?.authorization;
+        return result;
+    }
+    /**
+     * Signs in with username and password. Returns the stored authorization, the
+     * second-factor challenge or the required enrollment. A pending step is never stored as
+     * an authorization.
+     */
+    async authenticateInteractive(model) {
+        const result = new TaskResult();
         model.realm = this.moduleConfig.authenticationRealm;
+        model.rememberDeviceToken = model.rememberDeviceToken ?? this.getRememberDeviceToken();
         const request$ = this.httpClient.post(this.moduleConfig.authApiBaseUrl + this.moduleConfig.authentication.endpoints.login, model, {
-            params: httpParams,
+            params: this.languageParams(),
             withCredentials: true
         });
         try {
-            result.data = await lastValueFrom(request$);
-            if (result.isSuccess) {
-                result.data.realm = this.moduleConfig.authenticationRealm;
-            }
-            this.setAuthorization(result.data);
+            result.data = this.completeAuthenticationStep(await lastValueFrom(request$));
         }
         catch (ex) {
             if (this.isAuthenticated()) {
@@ -2617,6 +2955,523 @@ class BaseNhAuthService {
         }
         return result;
     }
+    /**
+     * Completes a second-factor challenge and stores the session.
+     */
+    async verifyTwoFactor(model) {
+        const result = new TaskResult();
+        const request$ = this.httpClient.post(this.moduleConfig.authApiBaseUrl + this.twoFactorEndpoints().twoFactorVerify, model, {
+            params: this.languageParams(),
+            withCredentials: true
+        });
+        try {
+            result.data = this.completeAuthenticationStep(await lastValueFrom(request$)).authorization;
+        }
+        catch (ex) {
+            this.pendingStepFailed(ex).copyTo(result);
+        }
+        return result;
+    }
+    /**
+     * E-mails a sign-in code for the pending challenge when the user enrolled the e-mail factor.
+     */
+    sendTwoFactorEmailCode(challengeToken) {
+        return this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(this.twoFactorEndpoints().twoFactorEmail), { challengeToken: challengeToken }, this.twoFactorStepRequestOptions()), response => new NhTwoFactorEmailCodeSent(response));
+    }
+    /**
+     * Whether this browser can use passkeys.
+     */
+    isPasskeySupported() {
+        return this.passkeyClient.isSupported();
+    }
+    /**
+     * Completes the pending challenge with a passkey and stores the session.
+     */
+    async verifyTwoFactorWithPasskey(challengeToken, rememberDevice = false) {
+        const result = new TaskResult();
+        const endpoints = this.twoFactorEndpoints();
+        const options = await this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(endpoints.twoFactorPasskeyOptions), { challengeToken: challengeToken }, this.twoFactorStepRequestOptions()), response => new NhPasskeyOptions(response));
+        if (!options.isSuccess) {
+            options.copyTo(result);
+            return result;
+        }
+        const credential = await this.runPasskeyCeremony(() => this.passkeyClient.get(options.data.options));
+        if (!credential.isSuccess) {
+            credential.copyTo(result);
+            return result;
+        }
+        const request$ = this.httpClient.post(this.twoFactorUrl(endpoints.twoFactorPasskey), {
+            challengeToken: challengeToken,
+            ceremonyToken: options.data.ceremonyToken,
+            credential: credential.data,
+            rememberDevice: rememberDevice
+        }, this.twoFactorStepRequestOptions());
+        try {
+            result.data = this.completeAuthenticationStep(await lastValueFrom(request$)).authorization;
+        }
+        catch (ex) {
+            this.pendingStepFailed(ex).copyTo(result);
+        }
+        return result;
+    }
+    /**
+     * Signs in with a discoverable passkey, without a username or password. Returns the
+     * stored authorization, or a pending step when the server's policy asks for more.
+     */
+    async signInWithPasskey() {
+        const result = new TaskResult();
+        const endpoints = this.twoFactorEndpoints();
+        const options = await this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(endpoints.passkeySignInOptions), {}, this.twoFactorStepRequestOptions()), response => new NhPasskeyOptions(response));
+        if (!options.isSuccess) {
+            options.copyTo(result);
+            return result;
+        }
+        const credential = await this.runPasskeyCeremony(() => this.passkeyClient.get(options.data.options));
+        if (!credential.isSuccess) {
+            credential.copyTo(result);
+            return result;
+        }
+        const request$ = this.httpClient.post(this.twoFactorUrl(endpoints.passkeySignIn), {
+            ceremonyToken: options.data.ceremonyToken,
+            credential: credential.data,
+            rememberDeviceToken: this.getRememberDeviceToken()
+        }, this.twoFactorStepRequestOptions());
+        try {
+            result.data = this.completeAuthenticationStep(await lastValueFrom(request$));
+        }
+        catch (ex) {
+            NhApiUtil.taskResultFromResponse(ex).copyTo(result);
+        }
+        return result;
+    }
+    /**
+     * Starts authenticator enrollment for a user whom the policy requires to enroll during
+     * sign-in. `enrollmentToken` is the `challengeToken` of the enrollment step.
+     */
+    beginEnrollmentAuthenticatorSetup(enrollmentToken) {
+        return this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(this.twoFactorEndpoints().twoFactorEnrollmentAuthenticator), { enrollmentToken: enrollmentToken }, this.twoFactorStepRequestOptions()), response => new NhAuthenticatorSetup(response));
+    }
+    /**
+     * Confirms the authenticator during a required enrollment and stores the session.
+     */
+    confirmEnrollmentAuthenticator(enrollmentToken, code) {
+        return this.sendEnrollmentCompletion(this.twoFactorEndpoints().twoFactorEnrollmentAuthenticatorConfirm, { enrollmentToken: enrollmentToken, code: code });
+    }
+    /**
+     * E-mails a confirmation code during a required enrollment.
+     */
+    sendEnrollmentEmailCode(enrollmentToken) {
+        return this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(this.twoFactorEndpoints().twoFactorEnrollmentEmail), { enrollmentToken: enrollmentToken }, this.twoFactorStepRequestOptions()), response => new NhTwoFactorEmailCodeSent(response));
+    }
+    /**
+     * Confirms the e-mail factor during a required enrollment and stores the session.
+     */
+    confirmEnrollmentEmail(enrollmentToken, code) {
+        return this.sendEnrollmentCompletion(this.twoFactorEndpoints().twoFactorEnrollmentEmailConfirm, { enrollmentToken: enrollmentToken, code: code });
+    }
+    /**
+     * Registers a passkey during a required enrollment and stores the session.
+     */
+    async enrollPasskey(enrollmentToken, name) {
+        const result = new TaskResult();
+        const endpoints = this.twoFactorEndpoints();
+        const options = await this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(endpoints.twoFactorEnrollmentPasskeyOptions), { enrollmentToken: enrollmentToken }, this.twoFactorStepRequestOptions()), response => new NhPasskeyOptions(response));
+        if (!options.isSuccess) {
+            options.copyTo(result);
+            return result;
+        }
+        const credential = await this.runPasskeyCeremony(() => this.passkeyClient.create(options.data.options));
+        if (!credential.isSuccess) {
+            credential.copyTo(result);
+            return result;
+        }
+        return this.sendEnrollmentCompletion(endpoints.twoFactorEnrollmentPasskey, {
+            enrollmentToken: enrollmentToken,
+            ceremonyToken: options.data.ceremonyToken,
+            credential: credential.data,
+            name: name
+        });
+    }
+    /**
+     * Returns the pending second-factor challenge of this browser tab, if it has not expired.
+     */
+    getPendingTwoFactorChallenge() {
+        const challenge = this.pendingTwoFactorChallenge ?? this.readStoredTwoFactorChallenge();
+        if (!challenge) {
+            return undefined;
+        }
+        if (challenge.expiresAt && DateTime.fromISO(challenge.expiresAt) <= DateTime.now()) {
+            this.clearPendingTwoFactorChallenge();
+            return undefined;
+        }
+        this.pendingTwoFactorChallenge = challenge;
+        return challenge;
+    }
+    clearPendingTwoFactorChallenge() {
+        this.pendingTwoFactorChallenge = undefined;
+        if (isPlatformServer(this.platformId)) {
+            return;
+        }
+        try {
+            sessionStorage.removeItem(BaseNhAuthService.pendingTwoFactorChallengeStorageKey);
+        }
+        catch {
+            // Storage can be unavailable in private browsing; the in-memory challenge is cleared.
+        }
+    }
+    /**
+     * Reads a challenge that an external sign-in (Microsoft OAuth) passed back in the URL
+     * fragment, stores it as the pending challenge and removes it from the address bar.
+     */
+    consumeExternalTwoFactorChallenge(fragment) {
+        const browser = !isPlatformServer(this.platformId);
+        const source = fragment ?? (browser ? window.location.hash : '');
+        const value = source.startsWith('#') ? source.substring(1) : source;
+        if (!value.startsWith(BaseNhAuthService.externalTwoFactorChallengePrefix)) {
+            return undefined;
+        }
+        let challenge;
+        try {
+            const payload = value.substring(BaseNhAuthService.externalTwoFactorChallengePrefix.length);
+            challenge = new NhTwoFactorChallenge(JSON.parse(Base64.decode(payload)));
+        }
+        catch {
+            return undefined;
+        }
+        if (!challenge.challengeToken) {
+            return undefined;
+        }
+        this.setPendingTwoFactorChallenge(challenge);
+        if (browser && fragment === undefined) {
+            window.history.replaceState(window.history.state, '', window.location.pathname + window.location.search);
+        }
+        return challenge;
+    }
+    async getTwoFactorStatus() {
+        const result = new TaskResult();
+        const request$ = this.httpClient.get(this.moduleConfig.authApiBaseUrl + this.twoFactorEndpoints().twoFactorStatus, this.twoFactorAccountRequestOptions());
+        try {
+            result.data = new NhTwoFactorStatus(await lastValueFrom(request$));
+        }
+        catch (ex) {
+            const errResult = NhApiUtil.taskResultFromResponse(ex);
+            errResult.copyTo(result);
+        }
+        return result;
+    }
+    /**
+     * Starts authenticator enrollment. Restarting enrollment while two-factor authentication
+     * is enabled requires reauthentication.
+     */
+    async beginAuthenticatorSetup(reauthentication) {
+        const result = new TaskResult();
+        const request$ = this.httpClient.post(this.moduleConfig.authApiBaseUrl + this.twoFactorEndpoints().twoFactorAuthenticator, { reauthentication: reauthentication }, this.twoFactorAccountRequestOptions());
+        try {
+            result.data = new NhAuthenticatorSetup(await lastValueFrom(request$));
+        }
+        catch (ex) {
+            const errResult = NhApiUtil.taskResultFromResponse(ex);
+            errResult.copyTo(result);
+        }
+        return result;
+    }
+    /**
+     * Confirms authenticator enrollment. The server ends every other session; the renewed
+     * session for this device is stored before the promise resolves.
+     */
+    confirmAuthenticator(code) {
+        return this.sendTwoFactorChange(this.twoFactorEndpoints().twoFactorAuthenticatorConfirm, { code: code });
+    }
+    regenerateRecoveryCodes(reauthentication) {
+        return this.sendTwoFactorChange(this.twoFactorEndpoints().twoFactorRecoveryCodes, { reauthentication: reauthentication });
+    }
+    disableTwoFactor(reauthentication) {
+        return this.sendTwoFactorChange(this.twoFactorEndpoints().twoFactorDisable, { reauthentication: reauthentication });
+    }
+    /**
+     * E-mails a code that confirms the user's e-mail address as a second factor. Requires
+     * reauthentication while two-factor authentication is enabled.
+     */
+    beginEmailSetup(reauthentication) {
+        return this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(this.twoFactorEndpoints().twoFactorEmailSetup), { reauthentication: reauthentication }, this.twoFactorAccountRequestOptions()), response => new NhTwoFactorEmailCodeSent(response));
+    }
+    confirmEmailSetup(code) {
+        return this.sendTwoFactorChange(this.twoFactorEndpoints().twoFactorEmailConfirm, { code: code });
+    }
+    /**
+     * Forgets every remembered device, including this one, and ends every other session.
+     */
+    async forgetTwoFactorDevices(reauthentication) {
+        const result = await this.sendTwoFactorChange(this.twoFactorEndpoints().twoFactorForgetDevices, { reauthentication: reauthentication });
+        if (result.isSuccess) {
+            this.storeRememberDeviceToken(undefined);
+        }
+        return result;
+    }
+    getPasskeys() {
+        return this.sendTwoFactorRequest(this.httpClient.get(this.twoFactorUrl(this.twoFactorEndpoints().passkeys), this.twoFactorAccountRequestOptions()), response => (response ?? []).map(passkey => new NhPasskey(passkey)));
+    }
+    /**
+     * Registers a passkey on this device. Adding a passkey while two-factor authentication is
+     * enabled requires reauthentication. The server ends every other session; the renewed
+     * session for this device is stored before the promise resolves.
+     */
+    async registerPasskey(name, reauthentication) {
+        const result = new TaskResult();
+        const endpoints = this.twoFactorEndpoints();
+        const options = await this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(endpoints.passkeyRegistrationOptions), { reauthentication: reauthentication }, this.twoFactorAccountRequestOptions()), response => new NhPasskeyOptions(response));
+        if (!options.isSuccess) {
+            options.copyTo(result);
+            return result;
+        }
+        const credential = await this.runPasskeyCeremony(() => this.passkeyClient.create(options.data.options));
+        if (!credential.isSuccess) {
+            credential.copyTo(result);
+            return result;
+        }
+        return this.sendTwoFactorChange(endpoints.passkeys, {
+            ceremonyToken: options.data.ceremonyToken,
+            credential: credential.data,
+            name: name
+        });
+    }
+    renamePasskey(passkeyId, name) {
+        return this.sendTwoFactorRequest(this.httpClient.put(this.twoFactorUrl(this.twoFactorEndpoints().passkeys) + '/' + encodeURIComponent(passkeyId), { name: name }, this.twoFactorAccountRequestOptions()), () => undefined);
+    }
+    /**
+     * Removes a passkey. Removing the last second factor disables two-factor authentication,
+     * which fails when the policy requires it.
+     */
+    removePasskey(passkeyId, reauthentication) {
+        return this.sendTwoFactorChange(this.twoFactorEndpoints().passkeys + '/' + encodeURIComponent(passkeyId) + '/remove', { reauthentication: reauthentication });
+    }
+    /**
+     * Removes every second factor of another user who lost access to them. Requires the
+     * server's two-factor administration policy.
+     */
+    resetUserTwoFactor(userId) {
+        const endpoint = this.twoFactorEndpoints().twoFactorUserReset.replace('{userId}', encodeURIComponent(userId));
+        return this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(endpoint), {}, this.twoFactorAccountRequestOptions()), () => undefined);
+    }
+    /**
+     * Starts a background operation that reminds every user whom the policy requires to
+     * enroll. A repeated idempotency key returns the operation that was already started.
+     */
+    startTwoFactorEnrollmentReminders(idempotencyKey) {
+        return this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(this.twoFactorEndpoints().twoFactorEnrollmentReminders), { idempotencyKey: idempotencyKey }, this.twoFactorAccountRequestOptions()), response => response);
+    }
+    /**
+     * Starts a background operation that ends the sessions of every user whom the policy
+     * requires to enroll, so their next sign-in enrolls them.
+     */
+    startTwoFactorSessionRevocation(idempotencyKey) {
+        return this.sendTwoFactorRequest(this.httpClient.post(this.twoFactorUrl(this.twoFactorEndpoints().twoFactorSessionRevocation), { idempotencyKey: idempotencyKey }, this.twoFactorAccountRequestOptions()), response => response);
+    }
+    async sendTwoFactorChange(endpoint, body) {
+        const result = new TaskResult();
+        const request$ = this.httpClient.post(this.moduleConfig.authApiBaseUrl + endpoint, body, this.twoFactorAccountRequestOptions());
+        try {
+            const response = await lastValueFrom(request$);
+            const sessionRenewed = this.applyRenewedSession(response?.session);
+            result.data = new NhTwoFactorChange({
+                recoveryCodes: response?.recoveryCodes ?? undefined,
+                sessionRenewed: sessionRenewed
+            });
+        }
+        catch (ex) {
+            const errResult = NhApiUtil.taskResultFromResponse(ex);
+            errResult.copyTo(result);
+        }
+        return result;
+    }
+    /**
+     * Stores the session that the server issued for this device after a change that ended
+     * every session. The user, claims and divisions of the current authorization are kept.
+     */
+    applyRenewedSession(session) {
+        const authorization = this.getAuthorization();
+        if (!session?.token || !authorization) {
+            return false;
+        }
+        authorization.token = session.token;
+        authorization.validTo = session.validTo ?? authorization.validTo;
+        authorization.refreshToken = session.refreshToken ?? undefined;
+        authorization.refreshTokenExpires = session.refreshValidTo ?? undefined;
+        this.setAuthorization(authorization);
+        return true;
+    }
+    toAuthorization(response) {
+        const authorization = response;
+        delete authorization.twoFactor;
+        delete authorization.rememberDeviceToken;
+        authorization.realm = this.moduleConfig.authenticationRealm;
+        return authorization;
+    }
+    /**
+     * Stores a complete session, or keeps a second-factor challenge or enrollment as the
+     * pending step of this browser tab.
+     */
+    completeAuthenticationStep(response) {
+        if (response?.twoFactor) {
+            const challenge = new NhTwoFactorChallenge(response.twoFactor);
+            this.setPendingTwoFactorChallenge(challenge);
+            return new NhAuthenticationStep({
+                status: challenge.status === NhAuthenticationStepStatuses.enrollmentRequired ? 'enrollment-required' : 'two-factor-required',
+                challenge: challenge
+            });
+        }
+        if (response?.rememberDeviceToken) {
+            this.storeRememberDeviceToken(response.rememberDeviceToken);
+        }
+        const authorization = this.toAuthorization(response);
+        this.setAuthorization(authorization);
+        this.clearPendingTwoFactorChallenge();
+        return new NhAuthenticationStep({ status: 'authenticated', authorization: authorization });
+    }
+    /**
+     * Converts a failed challenge or enrollment request and forgets the pending step when the
+     * server ended it.
+     */
+    pendingStepFailed(ex) {
+        const errResult = NhApiUtil.taskResultFromResponse(ex);
+        const stepEnded = errResult.items.some(item => item.name === NhTwoFactorFailureCodes.ChallengeExpired || item.name === NhTwoFactorFailureCodes.LockedOut);
+        if (stepEnded) {
+            this.clearPendingTwoFactorChallenge();
+        }
+        return errResult;
+    }
+    async sendEnrollmentCompletion(endpoint, body) {
+        const result = new TaskResult();
+        const request$ = this.httpClient.post(this.twoFactorUrl(endpoint), body, this.twoFactorStepRequestOptions());
+        try {
+            const response = await lastValueFrom(request$);
+            const authorization = response?.session ? this.completeAuthenticationStep(response.session).authorization : undefined;
+            result.data = new NhTwoFactorEnrollmentResult({
+                authorization: authorization,
+                recoveryCodes: response?.recoveryCodes ?? undefined
+            });
+        }
+        catch (ex) {
+            this.pendingStepFailed(ex).copyTo(result);
+        }
+        return result;
+    }
+    async sendTwoFactorRequest(request$, map) {
+        const result = new TaskResult();
+        try {
+            result.data = map(await lastValueFrom(request$, { defaultValue: undefined }));
+        }
+        catch (ex) {
+            NhApiUtil.taskResultFromResponse(ex).copyTo(result);
+        }
+        return result;
+    }
+    /**
+     * Runs a WebAuthn prompt. A cancelled prompt or an unsupported browser becomes a failed
+     * result with `NhTwoFactorFailureCodes.PasskeyUnavailable`.
+     */
+    async runPasskeyCeremony(ceremony) {
+        const result = new TaskResult();
+        try {
+            result.data = await ceremony();
+        }
+        catch {
+            return result.withError(NhTwoFactorFailureCodes.PasskeyUnavailable, 'nh-two-factor.passkey-unavailable');
+        }
+        return result;
+    }
+    /**
+     * Returns the remember-device token of header clients. Cookie clients receive it as an
+     * HttpOnly cookie, so nothing is stored in the browser.
+     */
+    getRememberDeviceToken() {
+        if (this.moduleConfig.authType !== 'header' || isPlatformServer(this.platformId)) {
+            return undefined;
+        }
+        try {
+            return localStorage.getItem(this.rememberDeviceStorageKey()) ?? undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    storeRememberDeviceToken(token) {
+        if (this.moduleConfig.authType !== 'header' || isPlatformServer(this.platformId)) {
+            return;
+        }
+        try {
+            if (token) {
+                localStorage.setItem(this.rememberDeviceStorageKey(), token);
+            }
+            else {
+                localStorage.removeItem(this.rememberDeviceStorageKey());
+            }
+        }
+        catch {
+            // Storage can be unavailable in private browsing; the device is then not remembered.
+        }
+    }
+    rememberDeviceStorageKey() {
+        return BaseNhAuthService.rememberDeviceStorageKey + ':' + this.moduleConfig.authenticationRealm;
+    }
+    setPendingTwoFactorChallenge(challenge) {
+        this.pendingTwoFactorChallenge = challenge;
+        if (isPlatformServer(this.platformId)) {
+            return;
+        }
+        try {
+            sessionStorage.setItem(BaseNhAuthService.pendingTwoFactorChallengeStorageKey, JSON.stringify(challenge));
+        }
+        catch {
+            // Storage can be unavailable in private browsing; the in-memory challenge still works.
+        }
+    }
+    readStoredTwoFactorChallenge() {
+        if (isPlatformServer(this.platformId)) {
+            return undefined;
+        }
+        try {
+            const stored = sessionStorage.getItem(BaseNhAuthService.pendingTwoFactorChallengeStorageKey);
+            if (!stored) {
+                return undefined;
+            }
+            return new NhTwoFactorChallenge(JSON.parse(stored));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    twoFactorEndpoints() {
+        // Consumers that passed a plain endpoints object keep working with the default routes.
+        return new EndpointsAuthenticationNhCommonModuleConfig({
+            ...new EndpointsAuthenticationNhCommonModuleConfig(),
+            ...this.moduleConfig.authentication.endpoints
+        });
+    }
+    twoFactorUrl(endpoint) {
+        return this.moduleConfig.authApiBaseUrl + endpoint;
+    }
+    twoFactorStepRequestOptions() {
+        return {
+            params: this.languageParams(),
+            withCredentials: true
+        };
+    }
+    twoFactorAccountRequestOptions() {
+        let headers = new HttpHeaders();
+        const authorization = this.getAuthorization();
+        if (this.moduleConfig.authType === 'header' && authorization?.token) {
+            headers = headers.set('Authorization', `Bearer ${authorization.token}`);
+        }
+        return {
+            params: this.languageParams(),
+            headers: headers,
+            withCredentials: true
+        };
+    }
+    languageParams() {
+        return new HttpParams().set('language', this.moduleConfig.language);
+    }
     async reloadAuthorizationProfile() {
         const result = new TaskResult();
         const auth = this.getAuthorization();
@@ -8769,5 +9624,5 @@ function nhTranslateBrowserLoaderFactory(httpClient, transferState) {
  * Generated bundle index. Do not edit.
  */
 
-export { AbstractValueAccessor, AspMvcFormServerSideFormValidator, AuthSessionExpirationInformation, AuthenticateModel, AuthenticationNhCommonModuleConfig, AuthenticationSessionCreateResponse, BackgroundOperationsNhCommonModuleConfig, BaseNhAuthService, CheckAuthenticateSessionModel, Claim, ClaimAuthenticateSessionAccountMutateModel, ClaimAuthenticateSessionAccountViewModel, ClaimTypes, CollectionHttpRequestOptions, CollectionHttpResponse, DefaultMultiSelectSettings, DefaultMultiSelectTexts, EndpointsAuthenticationNhCommonModuleConfig, FilterRequestOptions, FormError, FormValidationResult, HttpDownloadRequestOptions, HttpRequestOptions, HttpRequestOptionsArrayBuffer, HttpRequestOptionsText, ImpersonateAuthenticateModel, IsAllPermissionsGrantedPipe, IsAuthenticatedPipe, IsClaimGrantedPipe, IsDefined, IsGrantedRolePipe, IsOneActiveDivisionPermissionGrantedGuard, IsOneActiveDivisionPermissionGrantedPipe, IsOneActiveDivisionRoleGrantedGuard, IsOneActiveDivisionRoleGrantedPipe, IsOneClaimGrantedPipe, IsOneDivisionPermissionGrantedPipe, IsOneDivisionRoleGrantedPipe, IsOnePermissionGrantedPipe, IsOneRoleGrantedPipe, JsonLdDataChanged, ListSortDirection, MakeProvider, MutationType, NH_ERROR_HANDLERS, NH_ROUTER_LANGUAGE_CHANGE_METHOD, NH_ROUTER_ROOT_ROUTES, NhAccountInformationResponse, NhAngularUtil, NhApiService, NhApiUtil, NhAppService, NhAsyncLock, NhAuthService, NhAuthorization, NhBackgroundOperationAdministrationCollectionHttpRequestOptions, NhBackgroundOperationAdministrationService, NhBackgroundOperationCollectionHttpRequestOptions, NhBackgroundOperationLiveUpdateService, NhBackgroundOperationProgressComponent, NhBackgroundOperationService, NhBackgroundOperationStore, NhBaseApiService, NhBooleanToStringPipe, NhBreadCrumb, NhBreadCrumbItem, NhButtonDebounceDirective, NhCanCancelNavigationGuard, NhCollectionBaseComponent, NhCollectionTypeBaseComponent, NhCommonConfig, NhCommonConfigChanged, NhCommonModule, NhCommonModuleConfig, NhConfigCommonService, NhContextMenu, NhContextMenuItem, NhContextMenuService, NhContextMenuServiceConfig, NhCookieService, NhDatePipe, NhDateTimePipe, NhDateUtcPipe, NhDebounceDirective, NhDeduplicateGetRequestsInterceptor, NhDivision, NhDivisionRole, NhDivisionUser, NhEncodeHttpParamsInterceptor, NhEncodingUtil, NhErrorComponent, NhErrorHandlerService, NhFormDropDownComponent, NhFormDropDownNhCommonModuleConfig, NhFormDropDownSettings, NhFormErrorMessageComponent, NhFormHelper, NhHeadService, NhHttpNhCommonModuleConfig, NhHttpUtil, NhInternetConnectionService, NhIsAllPermissionsGrantedGuard, NhIsAuthenticatedGuard, NhIsOneClaimGrantedGuard, NhIsOnePermissionGrantedGuard, NhIsOneRoleGrantedGuard, NhJsonLdComponent, NhJsonLdData, NhJsonLdDataItem, NhJsonLdService, NhLoaderComponent, NhMetaService, NhModalComponent, NhModalComponentClosed, NhModalComponentImpl, NhModalComponentRef, NhModalConfirmComponent, NhModalContentDirective, NhModalLoadingComponent, NhModalMutateBaseComponent, NhModalMutateBaseTypeComponent, NhModalOptions, NhModalService, NhMutateBaseComponent, NhMutateBaseTypeComponent, NhMutex, NhPageBaseComponent, NhPageService, NhPageSettings, NhPageSizeComponent, NhPageTypeBaseComponent, NhRegisterRoute, NhRequestScopedServerHttpInterceptorService, NhRoute, NhRouteInfo, NhRouteNavigationItem, NhRouterLinkDirective, NhRouterService, NhRouterSetupService, NhSearchInputComponent, NhServerHttpInterceptor, NhServerService, NhServerSideFormValidationService, NhSitemap, NhSitemapEntry, NhSitemapEntryItem, NhStringUtil, NhTaskResultFormValidationService, NhTitleService, NhToHeadDirective, NhTranslateBrowserLoader, NhTranslationNhCommonModuleConfig, NhTypedPageBaseComponent, NhTypedPageTypeBaseComponent, NhUrlEncodePipe, NhUser, NhUserNotification, NhUserNotificationCollectionHttpRequestOptions, NhUserNotificationData, NhUserNotificationMessage, NhUserNotificationOverview, NhUserNotificationService, NhUserNotificationState, NhUserNotificationsAbstractComponent, OrderByRequestOptions, PreConnectUrlItem, PreLoadUrlItem, REVIEW_AGGREGATE_RATING_KEY, REVIEW_KEY, RefreshTokenLoginAccountMutateModel, RevertImpersonateAuthenticateModel, SafeHtmlPipe, SafeResourceUrlPipe, SafeUrlPipe, SearchableCollectionHttpRequestOptions, SimpleCollectionHttpRequestOptions, SimpleCollectionHttpResponse, TaskResult, TaskResultItem, TypedNhPageSettings, UserNotificationNhCommonModuleConfig, enumIntValuesToArray, enumKeysToArray, enumStringValuesToArray, enumValuesToArray, getEmptyGuid, getRandomIdentifier, groupBy, languageToCultureMap, nameof, nhBackgroundOperationStatusName, nhBackgroundOperationStepStatusName, nhBackgroundOperationTranslationSegment, nhTranslateBrowserLoaderFactory, nhUserNotificationSeverityName, uppercaseFirst };
+export { AbstractValueAccessor, AspMvcFormServerSideFormValidator, AuthSessionExpirationInformation, AuthenticateModel, AuthenticationNhCommonModuleConfig, AuthenticationSessionCreateResponse, BackgroundOperationsNhCommonModuleConfig, BaseNhAuthService, CheckAuthenticateSessionModel, Claim, ClaimAuthenticateSessionAccountMutateModel, ClaimAuthenticateSessionAccountViewModel, ClaimTypes, CollectionHttpRequestOptions, CollectionHttpResponse, DefaultMultiSelectSettings, DefaultMultiSelectTexts, EndpointsAuthenticationNhCommonModuleConfig, FilterRequestOptions, FormError, FormValidationResult, HttpDownloadRequestOptions, HttpRequestOptions, HttpRequestOptionsArrayBuffer, HttpRequestOptionsText, ImpersonateAuthenticateModel, IsAllPermissionsGrantedPipe, IsAuthenticatedPipe, IsClaimGrantedPipe, IsDefined, IsGrantedRolePipe, IsOneActiveDivisionPermissionGrantedGuard, IsOneActiveDivisionPermissionGrantedPipe, IsOneActiveDivisionRoleGrantedGuard, IsOneActiveDivisionRoleGrantedPipe, IsOneClaimGrantedPipe, IsOneDivisionPermissionGrantedPipe, IsOneDivisionRoleGrantedPipe, IsOnePermissionGrantedPipe, IsOneRoleGrantedPipe, JsonLdDataChanged, ListSortDirection, MakeProvider, MutationType, NH_ERROR_HANDLERS, NH_ROUTER_LANGUAGE_CHANGE_METHOD, NH_ROUTER_ROOT_ROUTES, NhAccountInformationResponse, NhAngularUtil, NhApiService, NhApiUtil, NhAppService, NhAsyncLock, NhAuthService, NhAuthenticationStep, NhAuthenticationStepStatuses, NhAuthenticatorSetup, NhAuthorization, NhBackgroundOperationAdministrationCollectionHttpRequestOptions, NhBackgroundOperationAdministrationService, NhBackgroundOperationCollectionHttpRequestOptions, NhBackgroundOperationLiveUpdateService, NhBackgroundOperationProgressComponent, NhBackgroundOperationService, NhBackgroundOperationStore, NhBaseApiService, NhBooleanToStringPipe, NhBreadCrumb, NhBreadCrumbItem, NhButtonDebounceDirective, NhCanCancelNavigationGuard, NhCollectionBaseComponent, NhCollectionTypeBaseComponent, NhCommonConfig, NhCommonConfigChanged, NhCommonModule, NhCommonModuleConfig, NhConfigCommonService, NhContextMenu, NhContextMenuItem, NhContextMenuService, NhContextMenuServiceConfig, NhCookieService, NhDatePipe, NhDateTimePipe, NhDateUtcPipe, NhDebounceDirective, NhDeduplicateGetRequestsInterceptor, NhDivision, NhDivisionRole, NhDivisionUser, NhEncodeHttpParamsInterceptor, NhEncodingUtil, NhErrorComponent, NhErrorHandlerService, NhFormDropDownComponent, NhFormDropDownNhCommonModuleConfig, NhFormDropDownSettings, NhFormErrorMessageComponent, NhFormHelper, NhHeadService, NhHttpNhCommonModuleConfig, NhHttpUtil, NhInternetConnectionService, NhIsAllPermissionsGrantedGuard, NhIsAuthenticatedGuard, NhIsOneClaimGrantedGuard, NhIsOnePermissionGrantedGuard, NhIsOneRoleGrantedGuard, NhJsonLdComponent, NhJsonLdData, NhJsonLdDataItem, NhJsonLdService, NhLoaderComponent, NhMetaService, NhModalComponent, NhModalComponentClosed, NhModalComponentImpl, NhModalComponentRef, NhModalConfirmComponent, NhModalContentDirective, NhModalLoadingComponent, NhModalMutateBaseComponent, NhModalMutateBaseTypeComponent, NhModalOptions, NhModalService, NhMutateBaseComponent, NhMutateBaseTypeComponent, NhMutex, NhPageBaseComponent, NhPageService, NhPageSettings, NhPageSizeComponent, NhPageTypeBaseComponent, NhPasskey, NhPasskeyClient, NhPasskeyOptions, NhRegisterRoute, NhRequestScopedServerHttpInterceptorService, NhRoute, NhRouteInfo, NhRouteNavigationItem, NhRouterLinkDirective, NhRouterService, NhRouterSetupService, NhSearchInputComponent, NhServerHttpInterceptor, NhServerService, NhServerSideFormValidationService, NhSitemap, NhSitemapEntry, NhSitemapEntryItem, NhStringUtil, NhTaskResultFormValidationService, NhTitleService, NhToHeadDirective, NhTranslateBrowserLoader, NhTranslationNhCommonModuleConfig, NhTwoFactorChallenge, NhTwoFactorChange, NhTwoFactorEmailCodeSent, NhTwoFactorEnrollmentResult, NhTwoFactorFailureCodes, NhTwoFactorMethods, NhTwoFactorReauthentication, NhTwoFactorStatus, NhTwoFactorVerifyModel, NhTypedPageBaseComponent, NhTypedPageTypeBaseComponent, NhUrlEncodePipe, NhUser, NhUserNotification, NhUserNotificationCollectionHttpRequestOptions, NhUserNotificationData, NhUserNotificationMessage, NhUserNotificationOverview, NhUserNotificationService, NhUserNotificationState, NhUserNotificationsAbstractComponent, OrderByRequestOptions, PreConnectUrlItem, PreLoadUrlItem, REVIEW_AGGREGATE_RATING_KEY, REVIEW_KEY, RefreshTokenLoginAccountMutateModel, RevertImpersonateAuthenticateModel, SafeHtmlPipe, SafeResourceUrlPipe, SafeUrlPipe, SearchableCollectionHttpRequestOptions, SimpleCollectionHttpRequestOptions, SimpleCollectionHttpResponse, TaskResult, TaskResultItem, TypedNhPageSettings, UserNotificationNhCommonModuleConfig, enumIntValuesToArray, enumKeysToArray, enumStringValuesToArray, enumValuesToArray, getEmptyGuid, getRandomIdentifier, groupBy, languageToCultureMap, nameof, nhBackgroundOperationStatusName, nhBackgroundOperationStepStatusName, nhBackgroundOperationTranslationSegment, nhTranslateBrowserLoaderFactory, nhUserNotificationSeverityName, uppercaseFirst };
 //# sourceMappingURL=newheap-platform-common.mjs.map