@mintplayer/ng-spark 22.29.0 → 22.31.0

package/types/mintplayer-ng-spark-auth-routes.d.ts

@@ -0,0 +1,154 @@
+import { SparkAccountOverviewLink, SparkAuthRouteEntries, SparkAuthRouteEntry, SparkAuthRoutePaths, SparkExternalProviderPresentation } from "@mintplayer/ng-spark/auth/models";
+import { CanActivateFn } from "@angular/router";
+type Loader = () => Promise<any>;
+interface Child {
+  path: string;
+  loadComponent?: Loader;
+  canActivate?: CanActivateFn[];
+  children?: [];
+}
+/**
+ * The passkeys page: the generic persistent-object page of the Authorization library's virtual
+ * `Passkeys` type, one per signed-in user, so the id is the fixed `me` (generic passkeys page PRD D1).
+ */
+export declare const SPARK_PASSKEYS_PAGE_URL = "/po/passkeys/me";
+/**
+ * One opt-in group of authentication pages, passed to {@link sparkAuthRoutes}. Constructed only by
+ * ng-spark's entry points: `withLocalLogin()`, `withRegistration()`, `withExternalLogin()`,
+ * `withPasskeys()` and `withAccount()` here, and `withIdentityProvider()` from
+ * `@mintplayer/ng-spark/identity-provider`. That keeps the set of mountable pages a decision this
+ * library makes rather than a shape an application invents.
+ */
+export interface SparkAuthRoutesFeature {
+  readonly children: Child[];
+  readonly paths: SparkAuthRoutePaths;
+  readonly providers?: SparkExternalProviderPresentation[];
+  /** Extra links for the account overview (`SPARK_ACCOUNT_OVERVIEW_LINKS`). */
+  readonly accountLinks?: SparkAccountOverviewLink[];
+}
+/** Path override for the sign-in landing page. Named to stay clear of the core package's
+ * `SparkExternalLoginOptions`, which is about the sign-in *call* rather than the route. */
+export type SparkExternalLoginRouteOptions = Pick<SparkAuthRouteEntries, 'signIn'>;
+/**
+ * The routes for Spark's authentication pages.
+ *
+ * **Nothing is mounted unless a feature asks for it.** Passing no features emits no pages at all —
+ * opt-in enforced by construction rather than by a flag, matching `provideHttpClient(withFetch())`
+ * and `provideRouter(withComponentInputBinding())`. Before this the pages mounted by default and an
+ * application had to opt *out*, so every app shipped a registration form whether or not it wanted
+ * one.
+ *
+ * ```ts
+ * sparkAuthRoutes(
+ *   withLocalLogin(),
+ *   withRegistration(),
+ *   withExternalLogin(githubProvider(), facebookProvider()),
+ * )
+ * ```
+ *
+ * The `import()` expressions live *inside* each feature. That placement is the point: a bundler
+ * decides whether to emit a lazy chunk from whether the `import()` call site is reachable, not from
+ * whether the route object referencing it survives — so filtering a children array after the fact
+ * would still ship every page. A page nobody opted into has no reachable `import()` at all.
+ */
+export declare function sparkAuthRoutes(...features: SparkAuthRoutesFeature[]): any[];
+/**
+ * Mounts the email/password family: login, two-factor, forgot-password, reset-password.
+ *
+ * These four are one feature rather than four because they form a star centred on the login page and
+ * every template dereferences its siblings unconditionally — removing any proper subset leaves a
+ * dangling link. Registration is genuinely separable, and is its own feature.
+ *
+ * Two-factor belongs here because it is reachable only from the login page's `RequiresTwoFactor`
+ * branch and posts to the same `/login` endpoint: it is part of password sign-in, not of
+ * authentication in general.
+ */
+export declare function withLocalLogin(entries?: Pick<SparkAuthRouteEntries, 'login' | 'twoFactor' | 'forgotPassword' | 'resetPassword'>): SparkAuthRoutesFeature;
+/**
+ * Mounts the self-service registration page.
+ *
+ * Separate from {@link withLocalLogin} because the two decisions genuinely are separate: an
+ * application whose accounts are provisioned by an administrator still needs password sign-in and
+ * password reset. Mount it only alongside a server whose `SparkLocalCredentials` is `Full` — with
+ * `SignInOnly` the endpoint it posts to is not mapped.
+ */
+export declare function withRegistration(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature;
+/**
+ * Mounts the sign-in landing page — a button per external provider the *server* reports.
+ *
+ * Accepts provider declarations and, in any position, one options object for the page's own path;
+ * the two shapes are disjoint, so `withExternalLogin(githubProvider(), facebookProvider())` and
+ * `withExternalLogin({ signIn: 'landing' }, githubProvider())` both read naturally.
+ *
+ * Declaring no providers is valid and useful: the page still renders whatever
+ * `GET /spark/auth/capabilities` reports, using default buttons.
+ */
+export declare function withExternalLogin(...providersOrOptions: (SparkExternalProviderPresentation | SparkExternalLoginRouteOptions)[]): SparkAuthRoutesFeature;
+/**
+ * Presentation for one provider's button, keyed by the scheme the server reports.
+ *
+ * The generic form. `githubProvider()` and friends are this with a scheme and an icon filled in —
+ * they exist so the common case does not require knowing the scheme string, not because the library
+ * has an opinion about which providers exist.
+ */
+/**
+ * Mounts the passkey management path, which forwards to the generic passkeys page (`/po/passkeys/me`).
+ *
+ * Independent of every other feature here, and of the server's `SparkLocalCredentials`: a passkey is
+ * a passwordless credential, so the applications most likely to want this page are exactly the ones
+ * that mount no password pages at all. It pairs with `SparkPasskeys.Enabled` on the server.
+ *
+ * ⚠️ The page assumes a signed-in user — enrollment adds a credential to an existing account, it
+ * cannot create one. Mount it inside the application's authenticated area, or behind
+ * `sparkAuthGuard`; the server answers the page with 404 to a visitor who is not signed in.
+ */
+export declare function withPasskeys(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature;
+/** Options for {@link withAccount}: a path/component per page, and the guard of the signed-in pages. */
+export type SparkAccountRouteOptions = Pick<SparkAuthRouteEntries, 'confirmEmail' | 'account' | 'profile' | 'changePassword' | 'twoFactorSetup' | 'externalLogins' | 'passkeys' | 'personalData'> & {
+  /**
+   * Guards the signed-in pages (everything but confirm-email). Defaults to `[sparkAuthGuard]`,
+   * which waits for the session check so a hard reload does not bounce a signed-in user to the
+   * sign-in page. Pass `[]` when the pages sit under a guarded parent route already.
+   */
+  canActivate?: CanActivateFn[];
+  /**
+   * Pages to leave out, e.g. `['externalLogins']` for an app without external providers or
+   * `['changePassword']` under `SparkLocalCredentials.Disabled` (the endpoint is not mapped there).
+   */
+  exclude?: (keyof Omit<SparkAccountRouteOptions, 'canActivate' | 'exclude'>)[];
+};
+/**
+ * Mounts the account pages (#460, D16), each also usable as a standalone component:
+ *
+ * | page | default path | component |
+ * |---|---|---|
+ * | confirm email (public; the mail link target) | `confirm-email` | `SparkConfirmEmailComponent` |
+ * | overview | `account` | `SparkAccountOverviewComponent` |
+ * | profile (user name, email change, mail language, app fields) | `account/profile` | `SparkAccountProfileComponent` |
+ * | change / set password | `account/password` | `SparkChangePasswordComponent` |
+ * | two-factor (authenticator, recovery codes) | `account/two-factor` | `SparkTwoFactorSetupComponent` |
+ * | connected logins | `account/logins` | `SparkExternalLoginsComponent` |
+ * | passkeys (forwards to the generic page, `/po/passkeys/me`) | `account/passkeys` | — |
+ * | personal data + account deletion | `account/personal-data` | `SparkPersonalDataComponent` |
+ *
+ * `confirm-email` must stay at the server's `Spark:Auth:Links:ConfirmEmailPath` (default
+ * `/confirm-email`), which confirmation mails link to. No path has a parameterised first segment, so the
+ * group neither shadows `sparkRoutes()` nor is shadowed by it.
+ */
+export declare function withAccount(options?: SparkAccountRouteOptions): SparkAuthRoutesFeature;
+export declare function externalProvider(scheme: string, presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function githubProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function googleProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function facebookProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function microsoftProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+/** X (formerly Twitter) — the server's `spark.AddTwitter()` preset (OAuth 2.0), scheme `Twitter`. */
+export declare function twitterProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+/** LinkedIn — the server's `spark.AddLinkedIn()` preset (OpenID Connect userinfo), scheme `LinkedIn`. */
+export declare function linkedInProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+/**
+ * Any OpenID Connect provider — the client half of the server's OIDC preset
+ * (`spark.AddOpenIdConnect(...)`, or a `Spark:Auth:Providers:OpenIdConnect:<scheme>` section). Unlike the named presets the scheme is the
+ * application's own choice, so it and the button text are required; `scheme` must equal the server's
+ * scheme name exactly.
+ */
+export declare function oidcProvider(scheme: string, displayName: string, iconClass?: string): SparkExternalProviderPresentation;

package/types/mintplayer-ng-spark-auth-sign-in.d.ts

@@ -0,0 +1,84 @@
+import * as i0 from "@angular/core";
+import { TemplateRef } from "@angular/core";
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkExternalProviderView, SparkProviderButtonContext, SparkProviderButtonContext as SparkProviderButtonContext$1 } from "@mintplayer/ng-spark/auth/external-login";
+/**
+ * The sign-in landing page: a button per external provider, and a link to the password form when the
+ * application mounted one.
+ *
+ * The provider buttons are `<spark-external-login-buttons>`, which the login page hosts as well; this
+ * page adds the passkey button, the link to the password form, and says so when there is no way to
+ * sign in at all.
+ */
+export declare class SparkSignInComponent {
+  private readonly authService;
+  private readonly route;
+  private readonly router;
+  private readonly config;
+  readonly routePaths: Partial<Record<keyof import("@mintplayer/ng-spark/auth/models").SparkAuthRouteEntries, string>>;
+  readonly colors: typeof Color;
+  /**
+   * Where to land after a successful external sign-in.
+   *
+   * Falls back to a `?returnUrl=` query parameter, matching what the login page already does — so a
+   * plain `<a routerLink="/sign-in" [queryParams]="{ returnUrl: '/somewhere' }">` works with no
+   * wiring, which is what a routed page needs since the router passes it no inputs. The query value
+   * is validated as a local path before use; an off-site one is dropped rather than followed.
+   */
+  readonly returnUrl: import("@angular/core").InputSignal<string | undefined>;
+  private effectiveReturnUrl;
+  /**
+   * Replaces the default provider button. Rendered once per provider with a
+   * {@link SparkProviderButtonContext}.
+   *
+   * Reachable only when the consumer *hosts* this component — the router instantiates it with no
+   * projected content, so on a default `withExternalLogin()` route there is nothing to project into.
+   * Host it via `withExternalLogin({ signIn: { path: 'sign-in', component: MySignIn } })` and pass
+   * the template from there.
+   */
+  readonly providerTemplate: import("@angular/core").InputSignal<TemplateRef<SparkProviderButtonContext$1> | null>;
+  /** Whether the server reported any external provider; with none and no passkeys there is no way in. */
+  readonly hasProviders: import("@angular/core").WritableSignal<boolean>;
+  readonly localCredentialsAvailable: import("@angular/core").WritableSignal<boolean>;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly failed: import("@angular/core").WritableSignal<boolean>;
+  /**
+   * Two conditions, and both are necessary. The server must have mounted the sign-in endpoint, and
+   * this browser must be able to run the ceremony — offering the button on either half alone
+   * produces a control that fails the moment it is clicked.
+   */
+  readonly passkeysAvailable: import("@angular/core").WritableSignal<boolean>;
+  readonly passkeyBusy: import("@angular/core").WritableSignal<boolean>;
+  readonly passkeyError: import("@angular/core").WritableSignal<string>;
+  constructor();
+  private load;
+  /**
+   * The routes are a build-time decision and the server's mode a deployment-time one, so they can
+   * disagree without anything failing loudly. Reaching this page at all means the app routed it,
+   * which it only does when local credentials are meant to be limited.
+   */
+  private warnOnMismatch;
+  /**
+   * Signs in with a passkey, then navigates. The navigation matters for the same reason it does
+   * after an external sign-in: nothing else moves the user off this page.
+   *
+   * No username is collected, and none should be: the server's request-options endpoint refuses to
+   * accept an identity so that its answer cannot reveal whether an account exists. The browser
+   * offers whatever discoverable credential it holds.
+   */
+  signInWithPasskey(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkSignInComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkSignInComponent, "spark-sign-in", never, {
+    "returnUrl": {
+      "alias": "returnUrl";
+      "required": false;
+      "isSignal": true;
+    };
+    "providerTemplate": {
+      "alias": "providerTemplate";
+      "required": false;
+      "isSignal": true;
+    };
+  }, {}, never, never, true, never>;
+}
+export type { SparkExternalProviderView, SparkProviderButtonContext };

package/types/mintplayer-ng-spark-auth-two-factor.d.ts

@@ -0,0 +1,23 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import * as i0 from "@angular/core";
+export declare class SparkTwoFactorComponent {
+  private readonly fb;
+  private readonly authService;
+  private readonly router;
+  private readonly route;
+  private readonly config;
+  private readonly translation;
+  readonly routePaths: Partial<Record<keyof import("@mintplayer/ng-spark/auth/models").SparkAuthRouteEntries, string>>;
+  colors: typeof Color;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly errorMessage: import("@angular/core").WritableSignal<string>;
+  readonly useRecoveryCode: import("@angular/core").WritableSignal<boolean>;
+  readonly form: import("@angular/forms").FormGroup<{
+    code: import("@angular/forms").FormControl<string | null>;
+    recoveryCode: import("@angular/forms").FormControl<string | null>;
+  }>;
+  toggleRecoveryCode(): void;
+  onSubmit(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkTwoFactorComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkTwoFactorComponent, "spark-two-factor", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-auth.d.ts

@@ -0,0 +1,24 @@
+import { SPARK_AUTH_CONFIG, SparkAuthConfig, SparkAuthConfig as SparkAuthConfig$1, defaultSparkAuthConfig } from "@mintplayer/ng-spark/auth/models";
+import { EnvironmentProviders } from "@angular/core";
+import { HttpFeature, HttpFeatureKind } from "@angular/common/http";
+import { SparkClientMethodMap } from "@mintplayer/ng-spark/client-operations";
+export declare function provideSparkAuth(config?: Partial<SparkAuthConfig$1>): EnvironmentProviders;
+export declare function withSparkAuth(): HttpFeature<HttpFeatureKind>[];
+/**
+ * The browser steps the Authorization library's server actions invoke (`IRetryAccessor.Invoke`),
+ * registered by {@link provideSparkAuth}.
+ *
+ * `webauthn.create` is the enrollment ceremony of the passkeys page's `AddPasskey` action: the
+ * server hands it the creation options and receives the credential back in the same action, which
+ * attests it against the ceremony cookie its first pass set. The server keeps the challenge; nothing
+ * here chooses or carries one.
+ *
+ * - The user dismissing the prompt (`cancelled`, `no_credential`) rejects, which answers the server
+ *   with `Cancel`: not an error, so no banner.
+ * - Any other failure (an authenticator already holding a credential for this account, a security
+ *   error) resolves as `{ error }`, so the server can say it did not work.
+ * - An unsupported browser never runs it (`supported`), and the action shows disabled with
+ *   `auth.passkeyUnsupported` as the reason.
+ */
+export declare const sparkAuthClientMethods: SparkClientMethodMap;
+export { SPARK_AUTH_CONFIG, type SparkAuthConfig, defaultSparkAuthConfig };

package/types/mintplayer-ng-spark-client-operations.d.ts

@@ -1,6 +1,7 @@
 import { PersistentObject, TranslatedString } from "@mintplayer/ng-spark/models";
 import * as i0 from "@angular/core";
 import { EnvironmentProviders, InjectionToken } from "@angular/core";
+import { Color } from "@mintplayer/ng-bootstrap";
 export declare enum NotificationKind {
   Info = 0,
   Success = 1,
@@ -53,13 +54,34 @@ export interface RetryOperation {
   defaultOption?: string | null;
   persistentObject?: PersistentObject | null;
   message?: string | null;
+  /** Whether the client offers its own translated Cancel, answered as `'Cancel'` (`IRetryAccessor.Action(..., cancellable)`). */
+  cancellable?: boolean;
+  /** A client method to run instead of a modal (`IRetryAccessor.Invoke`); see `provideSparkClientMethods`. */
+  clientMethod?: string | null;
+  /** Its argument, as the server serialized it. */
+  arguments?: unknown;
+}
+/**
+ * A value the server shows exactly once (a generated client secret, an API token), in a dialog with
+ * a copy button (`IClientAccessor.ShowSecret`, `docs/identity_provider_platform_PRD.md` D5). The server
+ * keeps only a hash. The value is never written to the page's state, the URL or browser storage, and
+ * closing the dialog discards it.
+ */
+export interface ShowSecretOperation {
+  type: 'showSecret';
+  /** The dialog's title, in the request's language. */
+  title: string;
+  /** The explanation shown above the value, in the request's language. */
+  message: string;
+  /** The value itself. */
+  value: string;
 }
 /**
  * Discriminated union of known operation types, plus an open shape for unknown
  * future operations. Handlers should narrow via the `type` discriminator before
  * accessing fields specific to their operation type.
  */
-export type ClientOperation = NavigateOperation | NotifyOperation | RefreshAttributeOperation | RefreshQueryOperation | RetryOperation | {
+export type ClientOperation = NavigateOperation | NotifyOperation | RefreshAttributeOperation | RefreshQueryOperation | RetryOperation | ShowSecretOperation | {
   type: string;
   [key: string]: unknown;
 };
@@ -85,7 +107,7 @@ export interface ClientOperationEnvelope<T = unknown> {
  *   The dispatcher treats handler resolution as allow-list-by-type (unknown
  *   types drop). It does NOT validate the *content* of each operation. Handlers
  *   that act on URL-shaped fields (navigate, redirect, openWindow) MUST run
- *   the value through `sanitizeReturnUrl` from `@mintplayer/ng-spark-auth/models`
+ *   the value through `sanitizeReturnUrl` from `@mintplayer/ng-spark/auth/models`
  *   (or an equivalent same-origin check) before acting on it. Otherwise a
  *   single attribute-echo XSS or a single mid-channel byte flip on a non-TLS
  *   path lets the server drive client navigation to an attacker host. The
@@ -120,6 +142,70 @@ export interface ClientOperationHandlerRegistration {
  * providers using this token.
  */
 export declare const SPARK_CLIENT_OPERATION_HANDLERS: InjectionToken<readonly ClientOperationHandlerRegistration[]>;
+/**
+ * One step a server action needs from the browser (`IRetryAccessor.Invoke` on the server): WebAuthn,
+ * a file picker, the clipboard. The answer travels back into the same server action as the retry's
+ * `value`, so authorization, state and the follow-up all stay inside that one action.
+ */
+export interface SparkClientMethod {
+  /**
+   * Runs the step. Called in an injection context, so `inject()` works synchronously at the top.
+   * A rejection or a thrown error answers the server with `Cancel`, exactly like an unknown name.
+   */
+  invoke(args: unknown): Promise<unknown>;
+  /**
+   * Whether this browser can run the method at all. An action whose `requiresClient` names a method
+   * that is unsupported is shown disabled; an `Invoke` of it answers `Cancel` without running it.
+   * Absent means always supported.
+   */
+  supported?(): boolean;
+  /** The translation key explaining why the method is unsupported; defaults to `common.clientUnsupported`. */
+  unsupportedReason?: string;
+}
+/** Client methods by the name the server invokes them with, e.g. `{ 'webauthn.create': { invoke: … } }`. */
+export type SparkClientMethodMap = Readonly<Record<string, SparkClientMethod>>;
+/** Multi-provider token; use {@link provideSparkClientMethods}. A later registration of a name wins. */
+export declare const SPARK_CLIENT_METHODS: InjectionToken<readonly Readonly<Record<string, SparkClientMethod>>[]>;
+/** The reason shown on an action whose client method is missing or unsupported, when the method names none. */
+export declare const SPARK_CLIENT_UNSUPPORTED_REASON = "common.clientUnsupported";
+/**
+ * Registers client methods a server action may invoke through a retry (`IRetryAccessor.Invoke`).
+ *
+ * The set is closed on purpose: the server can only name a method the app registered here, and an
+ * unknown name answers `Cancel`. Nothing the server sends is evaluated.
+ *
+ * @example
+ * provideSparkClientMethods({
+ *   'clipboard.read': { invoke: () => navigator.clipboard.readText(), supported: () => !!navigator.clipboard },
+ * })
+ */
+export declare function provideSparkClientMethods(methods: SparkClientMethodMap): EnvironmentProviders;
+/** How a client method ended: its value, or a failure the server sees as `Cancel`. */
+export type SparkClientMethodOutcome = {
+  ok: true;
+  value: unknown;
+} | {
+  ok: false;
+};
+/** The registered client methods: whether one can run here, and running it. */
+export declare class SparkClientMethodRegistry {
+  private readonly injector;
+  private readonly methods;
+  constructor();
+  /**
+   * Null when the method is registered and supported here; otherwise the translation key saying why
+   * it is not. Null for no name at all, so an action without `requiresClient` is never affected.
+   */
+  unavailableReason(name: string | null | undefined): string | null;
+  /**
+   * Runs the method registered under `name`. Fails closed: an unknown name, an unsupported method, a
+   * rejection or a thrown error all end as `{ ok: false }`, which the retry loop answers as `Cancel`.
+   */
+  invoke(name: string, args: unknown): Promise<SparkClientMethodOutcome>;
+  private isSupported;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkClientMethodRegistry, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 export interface SparkToast {
   id: string;
   message: string;
@@ -150,7 +236,10 @@ export declare class SparkToastContainerComponent {
 }
 /**
  * Registers the built-in client-operation handlers: `notify`, `refreshQuery`,
- * `refreshAttribute` and `navigate`. Apps add this once in their bootstrap providers.
+ * `refreshAttribute`, `navigate` and `showSecret`. Apps add this once in their bootstrap providers.
+ *
+ * `showSecret` opens {@link SparkSecretDialogService}'s dialog, which mounts itself: without it the
+ * value the server shows once (a client secret, a token) would be lost, since the server keeps a hash.
  *
  * Unregistered operation types are dropped SILENTLY by the dispatcher, which is why
  * `refreshQuery` did nothing at all for as long as it went unhandled — the server emitted
@@ -170,6 +259,62 @@ export declare class SparkToastContainerComponent {
  * `multi: true` providers using <see cref="SPARK_CLIENT_OPERATION_HANDLERS" />.
  */
 export declare function provideSparkClientOperations(): EnvironmentProviders;
+/** A value shown once: the `showSecret` operation's payload, or a value a page received itself. */
+export interface SparkSecret {
+  title: string;
+  message: string;
+  value: string;
+}
+/**
+ * Shows a value the server will never show again, in a modal with a copy button (`showSecret`,
+ * `docs/identity_provider_platform_PRD.md` D5).
+ *
+ * The dialog mounts itself on `document.body` the first time it is needed, so an application does not
+ * have to place a component in its root template for `IClientAccessor.ShowSecret` to work: a handler
+ * whose dialog nobody placed would lose the value as surely as a missing handler.
+ *
+ * The value lives only in this service's signal while the dialog is open. Closing the dialog clears
+ * it; it is never written to the URL, the router state or browser storage.
+ */
+export declare class SparkSecretDialogService {
+  private readonly appRef;
+  private readonly injector;
+  private readonly document;
+  private readonly browser;
+  private readonly current;
+  private dialog;
+  /** The secret on display, or null when the dialog is closed. */
+  readonly secret: import("@angular/core").Signal<SparkSecret | null>;
+  constructor();
+  show(secret: SparkSecret): void;
+  /** Closes the dialog and discards the value. */
+  close(): void;
+  private mount;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkSecretDialogService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/** The dialog behind {@link SparkSecretDialogService}; mounted by the service, not by applications. */
+export declare class SparkShowSecretModalComponent {
+  private readonly dialog;
+  private readonly document;
+  private copiedTimer;
+  protected readonly colors: typeof Color;
+  protected readonly secret: import("@angular/core").Signal<SparkSecret | null>;
+  protected readonly isOpen: import("@angular/core").Signal<boolean>;
+  protected readonly copyState: import("@angular/core").WritableSignal<"copied" | "idle" | "failed">;
+  protected readonly text: import("@angular/core").Signal<{
+    copy: string;
+    copied: string;
+    copyFailed: string;
+    close: string;
+    value: string;
+  }>;
+  protected selectAll(event: Event): void;
+  protected copy(): Promise<void>;
+  protected close(): void;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkShowSecretModalComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkShowSecretModalComponent, "spark-show-secret-modal", never, {}, {}, never, never, true, never>;
+}
 /**
  * Carries a server-issued `refreshQuery` to whichever grids are showing that query.
  *

package/types/mintplayer-ng-spark-grid.d.ts

@@ -252,6 +252,7 @@ export declare class SparkQueryGridComponent {
   /** Add-on row-menu entries (`SPARK_QUERY_ROW_ACTIONS`), e.g. Contributions' revert. */
   private readonly addonRowActions;
   readonly lang: SparkLanguageService;
+  private readonly clientMethods;
   /** Query alias or id. */
   queryId: import("@angular/core").InputSignal<string>;
   /**
@@ -549,6 +550,13 @@ export declare class SparkQueryGridComponent {
    * Every column that ships is drawn (#264): there is no shipped-but-hidden column.
    */
   allColumns: import("@angular/core").Signal<QueryColumn[]>;
+  /** The internal name of the per-row ⋮ menu's column; never shown or announced (its `label` is "Actions"). */
+  readonly rowActionsColumn = "__sparkRowActions";
+  /**
+   * The datatable's `[labels]`: the resize handle and its options dialog, translated. The column
+   * each string names comes from `bsDatatableColumnLabel` in the template. See `sparkDatatableLabels`.
+   */
+  datatableLabels: import("@angular/core").Signal<import("@mintplayer/ng-spark/services").SparkDatatableLabels>;
   /**
    * True when rows do not come from this component's own fetch.
    *
@@ -559,8 +567,16 @@ export declare class SparkQueryGridComponent {
    * before the host had anything to bind.
    */
   hasExternalData: import("@angular/core").Signal<boolean>;
-  /** Whether an action's selection rule is satisfied right now. The server checks it again. */
+  /**
+   * Whether an action can run right now: its selection rule is satisfied, and the client method it
+   * requires (`requiresClient`) is registered and supported here. The server checks the rule again.
+   */
   isActionEnabled(action: CustomActionDefinition): boolean;
+  /**
+   * Why an action is disabled regardless of the selection, translated, for its tooltip: its required
+   * client method is missing or unsupported in this browser (Q9). Null when nothing stands in the way.
+   */
+  actionUnavailableReason(action: CustomActionDefinition): string | null;
   constructor();
   /**
    * Re-run the query, keeping the current page, sort and scroll position.
@@ -872,6 +888,8 @@ export declare class SparkQueryCardComponent {
   protected readonly toolbarActions: import("@angular/core").Signal<SparkQueryToolbarAction[]>;
   protected actionClass(action: SparkQueryToolbarAction): string;
   protected isEnabled(action: SparkQueryToolbarAction): boolean;
+  /** The tooltip of an action disabled for want of its client method (`requiresClient`); null otherwise. */
+  protected unavailableReason(action: SparkQueryToolbarAction): string | null;
   protected run(action: SparkQueryToolbarAction): void;
   protected readonly selection: import("@angular/core").Signal<QueryResultItem[]>;
   static ɵfac: i0.ɵɵFactoryDeclaration<SparkQueryCardComponent, never>;

package/types/mintplayer-ng-spark-identity-provider-connected-applications.d.ts

@@ -0,0 +1,35 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkConnectedApplication, SparkConnectedScope } from "@mintplayer/ng-spark/identity-provider/core";
+import * as i0 from "@angular/core";
+/**
+ * The signed-in user's connected applications (`account/applications`, PRD D6/D7): each application
+ * the user granted access to, with its logo, publisher, the granted scopes and the dates. The user
+ * withdraws the whole grant, or unticks individual scopes and withdraws only those. Required scopes
+ * (`openid`, and those the application or resource marks required) go only with the whole grant.
+ *
+ * The server resolves the scope texts in the request's language; the `spark-lang` cookie
+ * `SparkLanguageService` writes is what makes that the language the user picked here.
+ */
+export declare class SparkConnectedApplicationsComponent {
+  private readonly text;
+  private readonly portal;
+  protected readonly colors: typeof Color;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly apps: import("@angular/core").WritableSignal<SparkConnectedApplication[]>;
+  readonly error: import("@angular/core").WritableSignal<string>;
+  readonly notice: import("@angular/core").WritableSignal<string>;
+  /** Per application, the scopes the user unticked (to withdraw). */
+  private readonly unticked;
+  constructor();
+  load(): Promise<void>;
+  protected hasOptionalScopes(app: SparkConnectedApplication): boolean;
+  protected isUnticked(app: SparkConnectedApplication, scope: SparkConnectedScope): boolean;
+  protected untickedOf(app: SparkConnectedApplication): readonly string[];
+  protected setTicked(app: SparkConnectedApplication, scope: SparkConnectedScope, ticked: boolean): void;
+  withdrawUnticked(app: SparkConnectedApplication): Promise<void>;
+  withdrawAll(app: SparkConnectedApplication): Promise<void>;
+  private withdraw;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkConnectedApplicationsComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkConnectedApplicationsComponent, "spark-connected-applications", never, {}, {}, never, never, true, never>;
+}