@mintplayer/ng-spark 22.29.0 → 22.31.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mintplayer/ng-spark",
   "private": false,
-  "version": "22.29.0",
+  "version": "22.31.0",
   "description": "Angular component library for MintPlayer.Spark CRUD applications",
   "repository": {
     "type": "git",
@@ -14,11 +14,17 @@
     "@angular/common": "^22.0.0",
     "@angular/router": "^22.0.0",
     "@angular/forms": "^22.0.0",
-    "@mintplayer/ng-bootstrap": "^22.21.0",
-    "@mintplayer/web-components": "^2.18.0",
+    "@angular/service-worker": "^22.0.0",
+    "@mintplayer/ng-bootstrap": "^22.22.0",
+    "@mintplayer/web-components": "^2.19.0",
     "@mintplayer/pagination": "*",
     "rxjs": "~7.8.0"
   },
+  "peerDependenciesMeta": {
+    "@angular/service-worker": {
+      "optional": true
+    }
+  },
   "sideEffects": false,
   "module": "fesm2022/mintplayer-ng-spark.mjs",
   "typings": "types/mintplayer-ng-spark.d.ts",
@@ -34,6 +40,74 @@
       "types": "./types/mintplayer-ng-spark-attribute-description.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-attribute-description.mjs"
     },
+    "./auth": {
+      "types": "./types/mintplayer-ng-spark-auth.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth.mjs"
+    },
+    "./auth/account": {
+      "types": "./types/mintplayer-ng-spark-auth-account.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-account.mjs"
+    },
+    "./auth/auth-bar": {
+      "types": "./types/mintplayer-ng-spark-auth-auth-bar.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-auth-bar.mjs"
+    },
+    "./auth/confirm-email": {
+      "types": "./types/mintplayer-ng-spark-auth-confirm-email.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-confirm-email.mjs"
+    },
+    "./auth/core": {
+      "types": "./types/mintplayer-ng-spark-auth-core.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-core.mjs"
+    },
+    "./auth/external-login": {
+      "types": "./types/mintplayer-ng-spark-auth-external-login.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-external-login.mjs"
+    },
+    "./auth/forgot-password": {
+      "types": "./types/mintplayer-ng-spark-auth-forgot-password.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-forgot-password.mjs"
+    },
+    "./auth/guards": {
+      "types": "./types/mintplayer-ng-spark-auth-guards.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-guards.mjs"
+    },
+    "./auth/interceptors": {
+      "types": "./types/mintplayer-ng-spark-auth-interceptors.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-interceptors.mjs"
+    },
+    "./auth/login": {
+      "types": "./types/mintplayer-ng-spark-auth-login.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-login.mjs"
+    },
+    "./auth/models": {
+      "types": "./types/mintplayer-ng-spark-auth-models.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-models.mjs"
+    },
+    "./auth/pipes": {
+      "types": "./types/mintplayer-ng-spark-auth-pipes.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-pipes.mjs"
+    },
+    "./auth/register": {
+      "types": "./types/mintplayer-ng-spark-auth-register.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-register.mjs"
+    },
+    "./auth/reset-password": {
+      "types": "./types/mintplayer-ng-spark-auth-reset-password.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-reset-password.mjs"
+    },
+    "./auth/routes": {
+      "types": "./types/mintplayer-ng-spark-auth-routes.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-routes.mjs"
+    },
+    "./auth/sign-in": {
+      "types": "./types/mintplayer-ng-spark-auth-sign-in.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-sign-in.mjs"
+    },
+    "./auth/two-factor": {
+      "types": "./types/mintplayer-ng-spark-auth-two-factor.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-two-factor.mjs"
+    },
     "./client-operations": {
       "types": "./types/mintplayer-ng-spark-client-operations.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-client-operations.mjs"
@@ -58,6 +132,26 @@
       "types": "./types/mintplayer-ng-spark-icon.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-icon.mjs"
     },
+    "./identity-provider": {
+      "types": "./types/mintplayer-ng-spark-identity-provider.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-identity-provider.mjs"
+    },
+    "./identity-provider/connected-applications": {
+      "types": "./types/mintplayer-ng-spark-identity-provider-connected-applications.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-identity-provider-connected-applications.mjs"
+    },
+    "./identity-provider/core": {
+      "types": "./types/mintplayer-ng-spark-identity-provider-core.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-identity-provider-core.mjs"
+    },
+    "./identity-provider/developers": {
+      "types": "./types/mintplayer-ng-spark-identity-provider-developers.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-identity-provider-developers.mjs"
+    },
+    "./identity-provider/management": {
+      "types": "./types/mintplayer-ng-spark-identity-provider-management.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-identity-provider-management.mjs"
+    },
     "./models": {
       "types": "./types/mintplayer-ng-spark-models.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-models.mjs"
@@ -90,6 +184,10 @@
       "types": "./types/mintplayer-ng-spark-po-form.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-po-form.mjs"
     },
+    "./pwa": {
+      "types": "./types/mintplayer-ng-spark-pwa.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-pwa.mjs"
+    },
     "./query-list": {
       "types": "./types/mintplayer-ng-spark-query-list.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-query-list.mjs"

package/types/mintplayer-ng-spark-auth-account.d.ts

@@ -0,0 +1,255 @@
+import { SparkAccountProfileField, SparkAccountResult, SparkAuthCapabilities, SparkAuthRoutePaths, SparkAuthenticatorUri, SparkExternalLogins, SparkTwoFactorState } from "@mintplayer/ng-spark/auth/models";
+import { SparkAuthService } from "@mintplayer/ng-spark/auth/core";
+import * as i0 from "@angular/core";
+import { OnInit } from "@angular/core";
+import { FormControl, FormGroup } from "@angular/forms";
+import { Color } from "@mintplayer/ng-bootstrap";
+/**
+ * The messages to show for a failed account call: the server's validation messages (already written
+ * for the user by Identity or a profile contributor), else a translation key for its error code or
+ * status. Keys start with `auth.`; the page runs everything through the `t` pipe, which returns
+ * anything that is not a key unchanged.
+ */
+export declare function accountMessages(result: SparkAccountResult<unknown>): string[];
+/** The messages for one field of a validation problem, matched case-insensitively. */
+export declare function fieldMessages(result: SparkAccountResult<unknown> | null, field: string): string[];
+/**
+ * Whether the server serves a page's feature. Mounting a page on the client is necessary but not
+ * sufficient: the route table and the server's switches are configured independently, which is why
+ * `/spark/auth/capabilities` exists. Pages without an entry need no switch beyond being mounted.
+ */
+type ServerCheck = (capabilities: SparkAuthCapabilities) => boolean;
+/**
+ * The account area's landing page (#460, D16): who is signed in, and a link per account page that is
+ * both mounted (`withAccount()`) and served (`/spark/auth/capabilities`), then the links other route
+ * features contribute through `SPARK_ACCOUNT_OVERVIEW_LINKS` (e.g. connected applications, from
+ * `@mintplayer/ng-spark/identity-provider`).
+ */
+export declare class SparkAccountOverviewComponent {
+  protected readonly auth: SparkAuthService;
+  private readonly paths;
+  private readonly capabilities;
+  /**
+   * Pages behind a server switch stay hidden until the capabilities arrive, and stay hidden if the
+   * call fails: offering a page whose endpoints the server does not map is worse than omitting it.
+   */
+  protected readonly pages: import("@angular/core").Signal<{
+    path: string;
+    key: keyof SparkAuthRoutePaths;
+    label: string;
+    server?: ServerCheck;
+  }[]>;
+  private readonly accountLinks;
+  /**
+   * Links contributed by route features of other entry points (connected applications), after the
+   * auth pages. Each carries its own translations; resolved in the app's current language.
+   */
+  protected readonly extraLinks: import("@angular/core").Signal<{
+    key: string;
+    path: string;
+    label: string;
+  }[]>;
+  constructor();
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkAccountOverviewComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkAccountOverviewComponent, "spark-account-overview", never, {}, {}, never, never, true, never>;
+}
+interface CultureOption {
+  value: string;
+  label: string;
+}
+/**
+ * The profile page (#460, D16): user name, email (changeable only under the server's opt-in
+ * `SparkEmailChange.Enabled`; a change is confirmed from the NEW address first),
+ * the preferred mail language (`SparkUser.PreferredCulture`, M8) and the application's own fields
+ * (`SPARK_ACCOUNT_PROFILE_FIELDS`, validated server-side by `ISparkProfileContributor<TUser>`).
+ *
+ * The language list is the application's UI languages (`GET /spark/culture`); a stored culture not in
+ * that list (e.g. `nl-BE`) is kept as an option so opening the page never changes it.
+ */
+export declare class SparkAccountProfileComponent {
+  private readonly auth;
+  private readonly http;
+  protected readonly colors: typeof Color;
+  /** The app's fields, ordered; each becomes a control under `fields`. */
+  protected readonly profileFields: SparkAccountProfileField[];
+  readonly form: FormGroup<{
+    userName: FormControl<string>;
+    preferredCulture: FormControl<string>;
+    fields: FormGroup<Record<string, FormControl<unknown>>>;
+  }>;
+  readonly emailForm: FormGroup<{
+    newEmail: FormControl<string>;
+  }>;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly saved: import("@angular/core").WritableSignal<boolean>;
+  readonly messages: import("@angular/core").WritableSignal<string[]>;
+  private readonly lastResult;
+  readonly email: import("@angular/core").WritableSignal<string | null>;
+  readonly emailConfirmed: import("@angular/core").WritableSignal<boolean | null>;
+  readonly emailSent: import("@angular/core").WritableSignal<boolean>;
+  readonly emailMessages: import("@angular/core").WritableSignal<string[]>;
+  /** Off until the server reports `emailChange`, and off if the capabilities call fails. */
+  readonly emailChangeAllowed: import("@angular/core").WritableSignal<boolean>;
+  private readonly languages;
+  private readonly storedCulture;
+  readonly cultureOptions: import("@angular/core").Signal<CultureOption[]>;
+  readonly userNameErrors: import("@angular/core").Signal<string[]>;
+  constructor();
+  private isInlineError;
+  protected fieldErrors(name: string): string[];
+  private load;
+  private loadLanguages;
+  private apply;
+  save(): Promise<void>;
+  changeEmail(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkAccountProfileComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkAccountProfileComponent, "spark-account-profile", never, {}, {}, never, never, true, never>;
+}
+/**
+ * Change the password — or set a first one on an account created through an external provider
+ * (`POST /spark/auth/manage/password`, #460 D16). The current password is required only when the
+ * account has one; the server says so (`CurrentPasswordRequired`) rather than the page guessing.
+ */
+export declare class SparkChangePasswordComponent {
+  private readonly auth;
+  protected readonly colors: typeof Color;
+  readonly form: FormGroup<{
+    currentPassword: FormControl<string>;
+    newPassword: FormControl<string>;
+    confirmPassword: FormControl<string>;
+  }>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly saved: import("@angular/core").WritableSignal<boolean>;
+  readonly messages: import("@angular/core").WritableSignal<string[]>;
+  submit(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkChangePasswordComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkChangePasswordComponent, "spark-change-password", never, {}, {}, never, never, true, never>;
+}
+/**
+ * Two-factor authentication (#460, D16): enroll an authenticator app (server-rendered QR SVG, SP-D),
+ * see and regenerate recovery codes, forget this browser, reset the key, disable 2FA; and, when the
+ * server offers it and 2FA is on, let an external sign-in skip the code (switching that on needs a code).
+ *
+ * Built on Identity's `POST /manage/2fa` (which creates the key on the first read) and Spark's read-only
+ * `GET /manage/2fa/authenticator-uri`. The QR SVG is shown through an `<img>` data URL, never inserted
+ * as markup: an image cannot run script, whatever the SVG contains.
+ */
+export declare class SparkTwoFactorSetupComponent {
+  private readonly auth;
+  private readonly translation;
+  protected readonly colors: typeof Color;
+  readonly form: FormGroup<{
+    code: FormControl<string>;
+  }>;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly messages: import("@angular/core").WritableSignal<string[]>;
+  readonly state: import("@angular/core").WritableSignal<SparkTwoFactorState | null>;
+  readonly authenticator: import("@angular/core").WritableSignal<SparkAuthenticatorUri | null>;
+  readonly recoveryCodes: import("@angular/core").WritableSignal<string[]>;
+  /** The server's SVG as an image URL — displayed, never parsed into the DOM. */
+  readonly qrDataUrl: import("@angular/core").Signal<string | null>;
+  readonly bypassForm: FormGroup<{
+    code: FormControl<string>;
+  }>;
+  /** The server offers the external-login bypass (`capabilities.externalLoginTwoFactorBypass`). */
+  private readonly bypassCapability;
+  /** The account's bypass setting, or null until read (or when the read failed). */
+  readonly bypass: import("@angular/core").WritableSignal<boolean | null>;
+  /** Switched on but not yet confirmed with an authenticator code. */
+  readonly bypassPending: import("@angular/core").WritableSignal<boolean>;
+  /** Shown only when the server offers it AND the account has two-factor on: there is nothing to skip otherwise. */
+  readonly bypassOffered: import("@angular/core").Signal<boolean>;
+  readonly bypassChecked: import("@angular/core").Signal<boolean>;
+  constructor();
+  private loadBypass;
+  /** Off: saved at once. On: asks for an authenticator code first ({@link confirmBypass}). */
+  toggleBypass(on: boolean): Promise<void>;
+  confirmBypass(): Promise<void>;
+  private saveBypass;
+  /** Groups the base32 key in fours, the way authenticator apps show it. */
+  protected formatKey(key: string): string;
+  refresh(): Promise<void>;
+  enable(): Promise<void>;
+  disable(): Promise<void>;
+  regenerateRecoveryCodes(): Promise<void>;
+  forgetMachine(): Promise<void>;
+  resetKey(): Promise<void>;
+  private run;
+  private applyState;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkTwoFactorSetupComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkTwoFactorSetupComponent, "spark-two-factor-setup", never, {}, {}, never, never, true, never>;
+}
+/**
+ * Connected logins (#460, D16): the providers attached to the account (remove, unless it is the last
+ * way in — the server's `canUnlink`, and its refusal), and the configured providers that could be
+ * attached (a popup handshake keyed on the signed-in user).
+ *
+ * Presentation (icon, display name) comes from the same `externalProvider()` declarations as the
+ * sign-in page when they are in scope; the server stays authoritative over which providers exist.
+ */
+export declare class SparkExternalLoginsComponent {
+  private readonly auth;
+  private readonly router;
+  private readonly presentations;
+  protected readonly colors: typeof Color;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly errorKey: import("@angular/core").WritableSignal<string>;
+  readonly logins: import("@angular/core").WritableSignal<SparkExternalLogins | null>;
+  /**
+   * While a link popup is open. Taken from the service, not from the link() promise: under COOP the
+   * popup reads closed long before the result arrives, and the attempt keeps listening (D2).
+   */
+  readonly linkPending: import("@angular/core").Signal<boolean>;
+  /** `link_confirmation_sent` travels as a failure but is news, not an error. */
+  readonly errorIsNotice: import("@angular/core").Signal<boolean>;
+  constructor();
+  private showLinkError;
+  private presentation;
+  protected iconFor(scheme: string): string | undefined;
+  protected nameFor(scheme: string, serverName: string): string;
+  refresh(): Promise<void>;
+  /**
+   * Links another provider. The buttons follow {@link linkPending} rather than this promise, which
+   * settles only on the result, a newer attempt or the 10-minute timeout.
+   */
+  link(provider: string): Promise<void>;
+  unlink(provider: string, providerKey: string): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkExternalLoginsComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkExternalLoginsComponent, "spark-external-logins", never, {}, {}, never, never, true, never>;
+}
+/**
+ * Personal data (#460, D8/D16): download everything the account and the application's
+ * `ISparkPersonalDataContributor`s hold as JSON, and delete the account.
+ *
+ * Deletion needs re-authentication: the current password (the field shows only when the account has
+ * one, from `account.hasPassword`), or — for an account without one — a sign-in
+ * younger than the server's `ReauthenticationMaxAge` (5 minutes). A 403 `reauthentication_required`
+ * says which is missing; the page then asks to sign in again. Handlers run first and the account is
+ * removed last, so a failure (500 `deletion_failed`) leaves the account intact and retryable.
+ */
+export declare class SparkPersonalDataComponent implements OnInit {
+  private readonly auth;
+  private readonly router;
+  private readonly config;
+  protected readonly colors: typeof Color;
+  readonly form: FormGroup<{
+    password: FormControl<string>;
+    confirm: FormControl<boolean>;
+  }>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly downloadMessages: import("@angular/core").WritableSignal<string[]>;
+  readonly deleteMessages: import("@angular/core").WritableSignal<string[]>;
+  /**
+   * Whether the account has a password (`account.hasPassword` of the personal data). Null while
+   * unknown — an older server, or the read failed — which keeps the password field, as before.
+   */
+  readonly hasPassword: import("@angular/core").WritableSignal<boolean | null>;
+  ngOnInit(): Promise<void>;
+  download(): Promise<void>;
+  deleteAccount(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkPersonalDataComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkPersonalDataComponent, "spark-personal-data", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-auth-auth-bar.d.ts

@@ -0,0 +1,22 @@
+import { SparkAuthService } from "@mintplayer/ng-spark/auth/core";
+import * as i0 from "@angular/core";
+export declare class SparkAuthBarComponent {
+  readonly authService: SparkAuthService;
+  readonly config: import("@mintplayer/ng-spark/auth/models").SparkAuthConfig;
+  private readonly router;
+  /** Same target the guard and interceptor use, so the bar cannot link somewhere they would not send you. */
+  readonly signInUrl: string;
+  /**
+   * Where the account overview lives, or `undefined` when `withAccount()` did not mount it — then the
+   * bar offers logout alone rather than a link that would fall through to some other route.
+   *
+   * `SPARK_AUTH_ROUTE_PATHS` is provided by `sparkAuthRoutes()` on its own route subtree, and this bar
+   * usually lives in the application shell, outside it, so the token is injected optionally and the
+   * router configuration is the fallback. Reading the configuration makes a custom `account` path
+   * exact here too, instead of assuming the default.
+   */
+  readonly accountUrl: string | undefined;
+  onLogout(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkAuthBarComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkAuthBarComponent, "spark-auth-bar", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-auth-confirm-email.d.ts

@@ -0,0 +1,21 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkAuthService } from "@mintplayer/ng-spark/auth/core";
+import * as i0 from "@angular/core";
+type ConfirmState = 'working' | 'confirmed' | 'changed' | 'invalid';
+/**
+ * The target of every confirmation mail (#460, D16): `?userId=&code=` confirms an address,
+ * `&changedEmail=` completes an email change (M5: one route for both). Posts once, on load, to
+ * `POST /spark/auth/confirm-email`. Public — the link is opened from a mailbox, often signed out.
+ */
+export declare class SparkConfirmEmailComponent {
+  protected readonly auth: SparkAuthService;
+  private readonly route;
+  protected readonly routePaths: Partial<Record<keyof import("@mintplayer/ng-spark/auth/models").SparkAuthRouteEntries, string>>;
+  protected readonly homeUrl: string;
+  protected readonly colors: typeof Color;
+  readonly state: import("@angular/core").WritableSignal<ConfirmState>;
+  constructor();
+  private confirm;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkConfirmEmailComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkConfirmEmailComponent, "spark-confirm-email", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-auth-core.d.ts

@@ -0,0 +1,197 @@
+import { AuthUser, SparkAccountInfo, SparkAccountProfile, SparkAccountProfileUpdate, SparkAccountResult, SparkAuthCapabilities, SparkAuthenticatorUri, SparkExternalLoginError, SparkExternalLoginOptions, SparkExternalLoginResult, SparkExternalLoginTwoFactor, SparkExternalLogins, SparkPasskeyResult, SparkTwoFactorRequest, SparkTwoFactorState, SparkUnlinkResult } from "@mintplayer/ng-spark/auth/models";
+import * as i0 from "@angular/core";
+export declare class SparkAuthService {
+  private readonly http;
+  private readonly config;
+  private readonly zone;
+  private readonly currentUser;
+  readonly user: import("@angular/core").Signal<AuthUser | null>;
+  readonly isAuthenticated: import("@angular/core").Signal<boolean>;
+  /** Resolved lazily: only {@link takeExternalLoginResult} needs the router. */
+  private readonly injector;
+  private readonly pendingExternalLogin;
+  /**
+   * `true` while a popup sign-in or link attempt is open and its popup has not been seen closed.
+   *
+   * ⚠️ Drive button and spinner state from this, **not** from the promise settling. When the
+   * provider's login page sends COOP the popup reads closed long before its result arrives, so this
+   * turns `false` early (the buttons re-enable) while the attempt keeps listening, and a late result
+   * still settles it.
+   */
+  readonly externalLoginPending: import("@angular/core").Signal<boolean>;
+  /** Settles the open popup attempt; `null` when none is open. */
+  private activeExternalAttempt;
+  constructor();
+  /**
+   * The credentials of a sign-in that answered `RequiresTwoFactor`, held in memory only until the
+   * second step. MapIdentityApi's `/login` is stateless per request: the 2FA step must repeat the
+   * email and password next to the code (its `LoginRequest` requires both), or it answers 400.
+   */
+  private pendingTwoFactorLogin;
+  /** Whether the pending sign-in (and its two-factor step) asked for a persistent cookie. */
+  private pendingRememberMe;
+  /**
+   * The login URL. MapIdentityApi's `/login` issues a persistent cookie for `useCookies=true`
+   * and a session cookie (no `Expires`) when `useSessionCookies=true` is added.
+   */
+  private loginUrl;
+  /**
+   * Signs in with a cookie. `rememberMe` (default `true`) makes the cookie persistent; `false`
+   * makes it a session cookie that ends with the browser session.
+   */
+  login(email: string, password: string, rememberMe?: boolean): Promise<void>;
+  loginTwoFactor(twoFactorCode: string, twoFactorRecoveryCode?: string): Promise<void>;
+  /** `userName` is the public handle other users see; it is required and may not contain `@`. */
+  register(email: string, password: string, userName: string): Promise<void>;
+  logout(): Promise<void>;
+  /**
+   * What sign-in methods this deployment actually offers.
+   *
+   * Read from the server rather than assumed from the client's own route configuration: the two are
+   * configured independently, and a mismatch is otherwise invisible until a user hits it.
+   *
+   * Callers that ask while a request is already in flight share it: the login page and the
+   * `<spark-external-login-buttons>` it hosts both ask on construction, and that is one request, not
+   * two. Nothing is cached once it settles, so a later call still reads the server's current answer.
+   */
+  capabilities(): Promise<SparkAuthCapabilities>;
+  private capabilitiesInFlight;
+  csrfRefresh(): Promise<void>;
+  checkAuth(): Promise<AuthUser | null>;
+  /**
+   * Signs in through an external provider (GitHub, Google, …) and leaves this service's
+   * `user()` signal up to date, exactly as `login()` does.
+   *
+   * The whole handshake lives here: a per-attempt nonce, four ways for the result to come back
+   * (`postMessage` from the opener-held popup, a BroadcastChannel, a `localStorage` entry and its
+   * `storage` event, and a re-read of that entry when this tab is shown again), the acknowledgement
+   * that lets the callback page close itself, teardown on every exit path, and re-reading the
+   * session afterwards. Callers get an outcome, not a protocol.
+   *
+   * A popup attempt settles only when its result arrives, when another attempt starts (the old one
+   * settles `popup_closed`), or after 10 minutes (`popup_closed`). A popup that *looks* closed does
+   * not settle it: the provider's COOP header severs the handle while the user is still signing in.
+   * ⚠️ Take button and spinner state from {@link externalLoginPending}, not from this promise.
+   *
+   * The mode is the call's `mode`, else the configured `externalLoginMode` (`'auto'`: redirect in an
+   * installed web app, popup otherwise). In `'redirect'` mode the returned promise never settles:
+   * this document is being replaced, and the outcome arrives as the next page load
+   * ({@link takeExternalLoginResult}) rather than as a value.
+   */
+  loginWithProvider(provider: string, options?: SparkExternalLoginOptions): Promise<SparkExternalLoginResult>;
+  /**
+   * What external logins are attached to the signed-in account, and what else could be.
+   *
+   * Only served when the deployment allows linking at all; under `Disabled` the endpoint is not
+   * mapped, so this rejects with a 404. That is deliberate on the server side — an account page
+   * offering an action the deployment forbids is worse than one that is absent.
+   */
+  externalLogins(): Promise<SparkExternalLogins>;
+  /**
+   * Attaches another provider to the account that is already signed in.
+   *
+   * The same handshake as {@link loginWithProvider}, against the endpoint that links rather than
+   * the one that signs in — the difference that matters is on the server, where the challenge is
+   * keyed on the current user so the identity coming back cannot land in somebody else's session.
+   */
+  linkProvider(provider: string, options?: SparkExternalLoginOptions): Promise<SparkExternalLoginResult>;
+  /**
+   * Detaches a provider from the signed-in account.
+   *
+   * ⚠️ Resolves with `error: 'last_credential'` rather than throwing when the server refuses to
+   * remove the account's last way in. It is an expected answer to a reasonable request, not a
+   * fault — and it is the server's refusal that protects the user, not the `canUnlink` flag the
+   * list hands out.
+   */
+  unlinkProvider(provider: string, providerKey: string): Promise<SparkUnlinkResult>;
+  /**
+   * Reads the `?sparkExternalLogin=<code>` a redirect-mode round trip came back with, and strips it
+   * from the address bar (a `replaceUrl` navigation, so Back does not bring it back and a reload
+   * does not show it twice).
+   *
+   * Answers `null` when the URL carries none. A value that is not a known
+   * {@link SparkExternalLoginError} is answered as `no_login_info` rather than echoed, so a crafted
+   * link cannot put text of its choosing on the page.
+   *
+   * Only failures carry the parameter, and they land on the `errorUrl` the attempt was started with
+   * (by default the page that started it); a successful redirect lands on the `returnUrl` signed in.
+   * The shipped `<spark-external-login-buttons>` (on the sign-in and login pages) and the account
+   * pages call this on load. Each failure is answered once: a second call before the strip lands
+   * answers `null`. An app that starts a redirect-mode
+   * attempt from some other page calls it there (or in its shell) to show the failure.
+   */
+  takeExternalLoginResult(): SparkExternalLoginError | null;
+  /** The URL whose `sparkExternalLogin` {@link takeExternalLoginResult} already took, until the strip lands. */
+  private externalLoginResultTakenFrom;
+  /**
+   * The in-app URL of this page (path and query, as the router sees it) with any earlier
+   * `sparkExternalLogin` removed, so a second failure does not stack onto the first one's code.
+   * Falls back to `location` when no router is provided.
+   */
+  private currentUrlForExternalLoginError;
+  /**
+   * The full-page navigation of a redirect-mode attempt. Its own method only so a unit test can
+   * observe the URL: jsdom locks `window.location.assign` against redefinition.
+   */
+  private leaveForProvider;
+  private externalFlow;
+  forgotPassword(email: string): Promise<void>;
+  resetPassword(email: string, resetCode: string, newPassword: string): Promise<void>;
+  /** `POST /confirm-email` — the query of a mailed confirmation link (a changed email too). */
+  confirmEmail(userId: string, code: string, changedEmail?: string | null): Promise<SparkAccountResult>;
+  /** `POST /manage/password` — change it (`currentPassword` required when the account has one) or set a first one. */
+  setPassword(newPassword: string, currentPassword?: string | null): Promise<SparkAccountResult>;
+  /** `GET /manage/info` — the email and whether it is confirmed. */
+  accountInfo(): Promise<SparkAccountResult<SparkAccountInfo>>;
+  /**
+   * `POST /manage/info { newEmail }` — mails a confirmation link to the NEW address; nothing changes
+   * until it is followed (the confirm-email page completes it).
+   */
+  changeEmail(newEmail: string): Promise<SparkAccountResult<SparkAccountInfo>>;
+  /** `GET /manage/profile`. */
+  profile(): Promise<SparkAccountResult<SparkAccountProfile>>;
+  /** `POST /manage/profile` — answers the saved profile, or field errors. */
+  updateProfile(update: SparkAccountProfileUpdate): Promise<SparkAccountResult<SparkAccountProfile>>;
+  /** `POST /manage/2fa` (Identity's) — an empty request reads the state and creates a key when none exists. */
+  twoFactor(request?: SparkTwoFactorRequest): Promise<SparkAccountResult<SparkTwoFactorState>>;
+  /** `GET /manage/2fa/authenticator-uri` — 409 `no_authenticator_key` until {@link twoFactor} created one. */
+  authenticatorUri(): Promise<SparkAccountResult<SparkAuthenticatorUri>>;
+  /** `GET /manage/external-login-two-factor` — whether an external sign-in skips the second factor. */
+  externalLoginTwoFactor(): Promise<SparkAccountResult<SparkExternalLoginTwoFactor>>;
+  /**
+   * `POST /manage/external-login-two-factor` — turning the bypass on needs a current authenticator
+   * `code` (400 when it is not valid); turning it off needs none.
+   */
+  setExternalLoginTwoFactor(bypass: boolean, code?: string): Promise<SparkAccountResult<SparkExternalLoginTwoFactor>>;
+  /** `GET /manage/personal-data` — the account and every contributor's data, as JSON. */
+  personalData(): Promise<SparkAccountResult<unknown>>;
+  /**
+   * `DELETE /manage/account` — re-authenticated by `password`, or by a sign-in younger than the server's
+   * `ReauthenticationMaxAge` (5 minutes) when omitted. 403 `reauthentication_required` otherwise. On
+   * success the session is gone.
+   */
+  deleteAccount(password?: string | null): Promise<SparkAccountResult>;
+  private accountCall;
+  /**
+   * Signs in with a passkey.
+   *
+   * ⚠️ Takes no username, and must not grow one. The server's request-options endpoint refuses to
+   * accept an identity precisely so that its response cannot reveal whether an account exists; the
+   * browser offers whatever discoverable credential it holds, and the account is resolved from the
+   * credential afterwards.
+   */
+  signInWithPasskey(): Promise<SparkPasskeyResult>;
+  /** {@link sparkPasskeyError}; shared with the `webauthn.create` client method. */
+  private passkeyError;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkAuthService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export declare class SparkAuthTranslationService {
+  private readonly http;
+  private readonly translationsMap;
+  constructor();
+  private loadTranslations;
+  t(key: string): string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkAuthTranslationService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}