@mintplayer/ng-spark 22.29.0 → 22.31.0

package/types/mintplayer-ng-spark-identity-provider-core.d.ts

@@ -0,0 +1,144 @@
+import * as i0 from "@angular/core";
+import { PipeTransform } from "@angular/core";
+/** One granted scope, with its text in the request's language (`spark-lang` cookie). */
+export interface SparkConnectedScope {
+  name: string;
+  displayName: string;
+  description?: string | null;
+  /** `openid`, or a scope the resource or the application marks required: only withdrawable with the whole grant. */
+  required: boolean;
+}
+/** One application the signed-in user granted access to (`GET /applications`, PRD D6). */
+export interface SparkConnectedApplication {
+  applicationId: string;
+  displayName: string;
+  logoUrl?: string | null;
+  publisher?: string | null;
+  homepageUrl?: string | null;
+  scopes: SparkConnectedScope[];
+  firstGrantedAt: string;
+  lastUsedAt?: string | null;
+  remembered: boolean;
+  rememberedUntil?: string | null;
+}
+/** The body of `POST /applications/withdraw`. No `scopes` withdraws the whole grant. */
+export interface SparkWithdrawAccessRequest {
+  applicationId: string;
+  scopes?: string[];
+}
+/** The developer statuses the server stores (`OidcDeveloperStatuses`). */
+export type SparkDeveloperStatusName = 'Requested' | 'Approved' | 'Rejected' | 'Revoked';
+/** `GET /developer` and `POST /developer` (`OidcDeveloperStatusResponse`). */
+export interface SparkDeveloperStatus {
+  /** Null when the user never asked. */
+  status: SparkDeveloperStatusName | string | null;
+  acceptedTermsVersion: number | null;
+  currentTermsVersion: number;
+  termsUrl: string | null;
+  requireApproval: boolean;
+  isActive: boolean;
+  requestedAt: string | null;
+  decidedAt: string | null;
+  note: string | null;
+}
+/** `POST /developer/registration-token`: an RFC 7591 initial access token, shown once. */
+export interface SparkRegistrationToken {
+  initialAccessToken: string;
+  /** Seconds. */
+  expiresIn: number;
+}
+/** `POST /invitations/accept` (`OidcAcceptInvitationResponse`). */
+export interface SparkInvitationOutcome {
+  accepted: boolean;
+  application: string | null;
+  problem: string | null;
+}
+/** One signing key on the management page (`OidcKeySummary`); never its private material. */
+export interface SparkSigningKey {
+  kid: string;
+  algorithm: string;
+  state: string;
+  createdAt: string;
+  activatedAt: string | null;
+  retiredAt: string | null;
+}
+/** `POST /admin/keys/rotate`. */
+export interface SparkKeyRotation {
+  changes: string[];
+}
+/** The outcome of a portal call: the value, or the status and the server's problem text. */
+export type SparkPortalResult<T> = {
+  ok: true;
+  value: T;
+} | {
+  ok: false;
+  status: number;
+  problem: string | null;
+};
+/** The portal API's prefix (`IdentityProviderPortalGroup.Prefix` on the server). */
+export declare const SPARK_IDENTITY_PROVIDER_API = "/spark/identity-provider";
+/**
+ * The identity provider's portal API for the SPA pages (PRD D7). Every call is for a signed-in user;
+ * the POSTs require the antiforgery token, which Angular's XSRF support adds from the `XSRF-TOKEN`
+ * cookie (`withSparkAuth()` configures it), so the calls are plain `HttpClient` requests.
+ *
+ * Calls never throw: each resolves to a {@link SparkPortalResult}, so a page branches on `ok` and on
+ * the status (403 for a page the user may not see) instead of catching.
+ */
+export declare class SparkIdentityProviderPortalService {
+  private readonly http;
+  connectedApplications(): Promise<SparkPortalResult<SparkConnectedApplication[]>>;
+  /** Withdraws the whole grant, or only `scopes` when given. Answers 204, or 409 when it could not. */
+  withdraw(request: SparkWithdrawAccessRequest): Promise<SparkPortalResult<null>>;
+  developerStatus(): Promise<SparkPortalResult<SparkDeveloperStatus>>;
+  /** Accepts the terms version the page showed; the server refuses (409) a version that is no longer current. */
+  requestDeveloperStatus(termsVersion: number): Promise<SparkPortalResult<SparkDeveloperStatus>>;
+  issueRegistrationToken(): Promise<SparkPortalResult<SparkRegistrationToken>>;
+  acceptInvitation(applicationId: string, token: string): Promise<SparkPortalResult<SparkInvitationOutcome>>;
+  signingKeys(): Promise<SparkPortalResult<SparkSigningKey[]>>;
+  rotateSigningKeys(): Promise<SparkPortalResult<SparkKeyRotation>>;
+  private call;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderPortalService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * A text function for component code: `private readonly text = injectIdentityProviderText();` then
+ * `this.text('apps.withdrawn')`. The texts come from the server's translations in the app's current
+ * language, like every other ng-spark page; `{0}`, `{1}` are replaced by the arguments.
+ */
+export declare function injectIdentityProviderText(): (key: string, ...args: unknown[]) => string;
+/** `{{ 'apps.title' | idp }}`, `{{ 'apps.by' | idp: publisher }}`. Impure: follows the language and the loaded translations. */
+export declare class SparkIdentityProviderTextPipe implements PipeTransform {
+  private readonly translations;
+  transform(key: string, ...args: unknown[]): string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderTextPipe, never>;
+  static ɵpipe: i0.ɵɵPipeDeclaration<SparkIdentityProviderTextPipe, "idp", true>;
+}
+/**
+ * A server date (ISO string) as a date and time in the app's current language; empty for null.
+ * `Intl` rather than Angular's `DatePipe`, which needs locale data registered for every language.
+ */
+export declare function identityProviderDate(value: string | null | undefined): string;
+/** `{{ app.firstGrantedAt | idpDate }}`. Impure: follows the language signal. */
+export declare class SparkIdentityProviderDatePipe implements PipeTransform {
+  transform(value: string | null | undefined): string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderDatePipe, never>;
+  static ɵpipe: i0.ɵɵPipeDeclaration<SparkIdentityProviderDatePipe, "idpDate", true>;
+}
+/**
+ * The identity-provider library's queries, by the aliases in its `App_Data/Model/*.json`
+ * (`queries[].alias`). They open in the generic query page of `sparkRoutes()`, `/query/:queryId`,
+ * which resolves an alias as well as an id. Each lists only what the caller may see.
+ */
+export declare const SPARK_IDENTITY_PROVIDER_QUERIES: {
+  /** `OidcApplication`: the caller's applications (members-only filter), or all of them for an administrator. */
+  readonly applications: "oidc-applications";
+  readonly resources: "oidc-resources";
+  readonly developerRequests: "oidc-developer-requests";
+  readonly scopeApprovals: "oidc-scope-approvals";
+  readonly goLiveReviews: "oidc-golive-reviews";
+  readonly grants: "oidc-grants";
+  readonly auditEvents: "oidc-audit-events";
+};
+/** The router commands that open one of {@link SPARK_IDENTITY_PROVIDER_QUERIES}. */
+export declare function identityProviderQueryLink(alias: string): string[];

package/types/mintplayer-ng-spark-identity-provider-developers.d.ts

@@ -0,0 +1,55 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkDeveloperStatus } from "@mintplayer/ng-spark/identity-provider/core";
+import * as i0 from "@angular/core";
+/**
+ * The developer portal's landing page (`/developers`, PRD D2/D7): the user's developer status, the
+ * terms to accept to request it (again, when they were raised), and for an active developer a link to
+ * their applications (the generic query page, members-only filtered) and a one-time registration
+ * token for dynamic client registration (RFC 7591), shown in the same dialog as `showSecret`.
+ */
+export declare class SparkDevelopersComponent {
+  private readonly text;
+  private readonly portal;
+  private readonly secrets;
+  protected readonly colors: typeof Color;
+  protected readonly applicationsLink: string[];
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly status: import("@angular/core").WritableSignal<SparkDeveloperStatus | null>;
+  readonly accepted: import("@angular/core").WritableSignal<boolean>;
+  readonly error: import("@angular/core").WritableSignal<string>;
+  readonly notice: import("@angular/core").WritableSignal<string>;
+  protected readonly statusKey: import("@angular/core").Signal<string>;
+  /** A developer (or a pending request) whose accepted terms are older than the current ones. */
+  protected readonly termsChanged: import("@angular/core").Signal<boolean>;
+  /** Asking (again) is possible unless an administrator revoked the status; the server refuses that too. */
+  protected readonly canRequest: import("@angular/core").Signal<boolean>;
+  constructor();
+  load(): Promise<void>;
+  request(): Promise<void>;
+  issueToken(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkDevelopersComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkDevelopersComponent, "spark-developers", never, {}, {}, never, never, true, never>;
+}
+/**
+ * The target of a mailed team invitation (`/developers/invitations/:token?app=<applicationId>`, PRD
+ * D3). Accepting is an explicit click, not a side effect of opening the link, and needs the signed-in
+ * account the invitation was sent to; every failure reads the same, as the server answers it.
+ */
+export declare class SparkAcceptInvitationComponent {
+  private readonly portal;
+  private readonly route;
+  protected readonly colors: typeof Color;
+  protected readonly applicationsLink: string[];
+  private readonly token;
+  private readonly applicationId;
+  /** A link without both values cannot be an invitation. */
+  protected readonly valid: boolean;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly failed: import("@angular/core").WritableSignal<boolean>;
+  /** The application joined, once accepted. */
+  readonly joined: import("@angular/core").WritableSignal<string | null>;
+  accept(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkAcceptInvitationComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkAcceptInvitationComponent, "spark-accept-invitation", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-identity-provider-management.d.ts

@@ -0,0 +1,33 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkSigningKey, identityProviderQueryLink } from "@mintplayer/ng-spark/identity-provider/core";
+import * as i0 from "@angular/core";
+/**
+ * The identity provider's management page (`identity-provider/admin`, PRD D9), for its
+ * administrators (`ManageAll/IdentityProvider`): the signing keys with a rotate-now action, and links
+ * to the library's queues (developer requests, scope approvals, go-live reviews) and records (grants,
+ * the audit trail) in the generic query page. The server answers 403 to anyone else, and the page
+ * then says so instead of rendering an empty administration screen.
+ */
+export declare class SparkIdentityProviderManagementComponent {
+  private readonly text;
+  private readonly portal;
+  protected readonly colors: typeof Color;
+  protected readonly queues: {
+    label: string;
+    alias: string;
+  }[];
+  protected readonly queryLink: typeof identityProviderQueryLink;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly forbidden: import("@angular/core").WritableSignal<boolean>;
+  readonly keys: import("@angular/core").WritableSignal<SparkSigningKey[]>;
+  readonly changes: import("@angular/core").WritableSignal<string[]>;
+  readonly error: import("@angular/core").WritableSignal<string>;
+  readonly notice: import("@angular/core").WritableSignal<string>;
+  constructor();
+  load(): Promise<void>;
+  rotate(): Promise<void>;
+  protected stateColor(state: string): Color;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderManagementComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkIdentityProviderManagementComponent, "spark-identity-provider-management", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-identity-provider.d.ts

@@ -0,0 +1,64 @@
+import { CanActivateFn } from "@angular/router";
+import { SparkAccountOverviewLink, SparkAuthRouteEntry, SparkAuthRoutePaths } from "@mintplayer/ng-spark/auth/models";
+import { SparkAuthRoutesFeature } from "@mintplayer/ng-spark/auth/routes";
+export * from "@mintplayer/ng-spark/identity-provider/core";
+type Child = SparkAuthRoutesFeature['children'][number];
+/**
+ * One group of identity-provider pages, passed to {@link withIdentityProvider}. Produced only by
+ * `withConnectedApplications()`, `withDeveloperRoutes()` and `withManagementRoutes()`.
+ */
+export interface SparkIdentityProviderRoutesFeature {
+  readonly children: Child[];
+  readonly paths: SparkAuthRoutePaths;
+  readonly accountLinks?: SparkAccountOverviewLink[];
+}
+/** Every feature's guard option: defaults to `[sparkAuthGuard]`; `[]` under an already guarded parent. */
+export interface SparkIdentityProviderGuardOptions {
+  canActivate?: CanActivateFn[];
+}
+/**
+ * The identity provider's SPA pages (`docs/identity_provider_platform_PRD.md` D7), as one
+ * `sparkAuthRoutes()` feature:
+ *
+ * ```ts
+ * sparkAuthRoutes(
+ *   withLocalLogin(), withAccount(),
+ *   withIdentityProvider(withConnectedApplications(), withDeveloperRoutes(), withManagementRoutes()),
+ * )
+ * ```
+ *
+ * The sub-features merge into one feature, and each page keeps its own `import()` (its own secondary
+ * entry point), so a page nobody opts into is never bundled. The pages popups show (`/connect/*`:
+ * sign-in, consent, device, logout, error) are server-rendered and not part of this.
+ *
+ * Every path has a literal first segment, so the group neither shadows `sparkRoutes()` nor is shadowed
+ * by it. Apps and resources are edited in the generic `po/:type` screens (PRD Q1 = A).
+ */
+export declare function withIdentityProvider(...features: SparkIdentityProviderRoutesFeature[]): SparkAuthRoutesFeature;
+/**
+ * Mounts the connected-applications page (default `account/applications`, PRD D6): the applications
+ * the user granted access to, with whole-grant and per-scope withdrawal. Sets
+ * `SPARK_AUTH_ROUTE_PATHS.connectedApplications` and adds a link to the account overview.
+ */
+export declare function withConnectedApplications(options?: SparkIdentityProviderGuardOptions & {
+  connectedApplications?: SparkAuthRouteEntry;
+}): SparkIdentityProviderRoutesFeature;
+/**
+ * Mounts the developer portal (PRD D2/D3): `developers` (status, terms, request, registration token)
+ * and `developers/invitations/:token?app=<applicationId>` (accept a team invitation; the mailed link's
+ * target, which the server builds from this default path). Both need a signed-in user; the guard sends
+ * anyone else to sign in and back.
+ */
+export declare function withDeveloperRoutes(options?: SparkIdentityProviderGuardOptions & {
+  developers?: SparkAuthRouteEntry;
+  invitation?: SparkAuthRouteEntry;
+}): SparkIdentityProviderRoutesFeature;
+/**
+ * Mounts the management page (default `identity-provider/admin`, PRD D9): signing keys with
+ * rotate-now, and links to the queues (developer requests, scope approvals, go-live reviews) and
+ * records (applications, resources, grants, audit trail). Mount it for everyone signed in: the server
+ * decides who is an administrator, and the page tells anyone else they may not see it.
+ */
+export declare function withManagementRoutes(options?: SparkIdentityProviderGuardOptions & {
+  identityProviderManagement?: SparkAuthRouteEntry;
+}): SparkIdentityProviderRoutesFeature;

package/types/mintplayer-ng-spark-models.d.ts

@@ -169,6 +169,12 @@ export interface CustomActionDefinition {
    * `/po/new`, the edit page and `/po/delete-many`, never `/actions/execute`. Absent for a custom action.
    */
   isDefault?: boolean;
+  /**
+   * The client method the action needs in the browser (`provideSparkClientMethods`), e.g.
+   * `'webauthn.create'`. When it is not registered, or its `supported()` says no, the action is shown
+   * disabled with the reason as its tooltip. Advisory: the server still handles a cancelled step.
+   */
+  requiresClient?: string;
 }
 /**
  * Whether a grid lets the user tick rows — what `<bs-datatable>` renders. There is no single
@@ -665,19 +671,41 @@ export interface LookupReferenceValue {
   isActive: boolean;
   extra?: Record<string, unknown>;
 }
+/**
+ * The option a cancelled retry step answers with (`RetryResult.CancelOption` on the server): the
+ * modal's own Cancel button or its dismissal on a `cancellable` prompt, and a client method that did
+ * not answer. An identifier, never a label: the button shows `common.cancel` in the user's language.
+ */
+export declare const SPARK_RETRY_CANCEL = "Cancel";
 export interface RetryActionPayload {
   type: 'retry-action';
   step: number;
   title: string;
   message?: string;
+  /** The action's own options, shown as given. Never `'Cancel'`: see {@link cancellable}. */
   options: string[];
   defaultOption?: string;
   persistentObject?: PersistentObject;
+  /**
+   * Whether the modal adds its own Cancel button, labelled `common.cancel`, which, like closing the
+   * modal, answers {@link SPARK_RETRY_CANCEL}. Without it a closed modal abandons the request.
+   */
+  cancellable?: boolean;
+  /**
+   * Set when the server asks for a client method (`IRetryAccessor.Invoke`) instead of a choice: the
+   * name a method was registered under with `provideSparkClientMethods`. No modal is shown then.
+   */
+  clientMethod?: string;
+  /** The client method's argument, as the server serialized it. */
+  arguments?: unknown;
 }
 export interface RetryActionResult {
   step: number;
+  /** The option chosen. For a client-method step `'OK'` when it answered, `'Cancel'` otherwise. */
   option: string;
   persistentObject?: PersistentObject;
+  /** What the client method resolved with; absent for an ordinary prompt and for a cancelled step. */
+  value?: unknown;
 }
 export interface EntityPermissions {
   /**

package/types/mintplayer-ng-spark-po-detail.d.ts

@@ -13,6 +13,7 @@ export declare class SparkPoDetailComponent {
   private readonly queryRefresh;
   private readonly attributeRefresh;
   protected readonly lang: SparkLanguageService;
+  private readonly clientMethods;
   protected readonly rendererRegistry: import("@mintplayer/ng-spark/renderers").SparkAttributeRendererRegistration[];
   /**
    * Add-on panels and action-bar buttons (#460, `SPARK_DETAIL_PANELS` / `SPARK_DETAIL_ACTIONS`).
@@ -118,6 +119,8 @@ export declare class SparkPoDetailComponent {
   resolvedTabs: import("@angular/core").Signal<AttributeTab[]>;
   groupsForTab(tab: AttributeTab): AttributeGroup[];
   attrsForGroup(group: AttributeGroup): EntityAttributeDefinition[];
+  /** Whether the attribute's renderer asks for the whole row, without a label (`fullWidth`). */
+  isFullWidthRenderer(attr: EntityAttributeDefinition): boolean;
   getDetailRendererComponent(attr: EntityAttributeDefinition): Type<any> | null;
   /** Inputs of an AsDetail row renderer (`rowComponent`): the row and the object that owns it. */
   getRowRendererInputs(renderer: SparkResolvedRowRenderer, row: Record<string, any>, item: PersistentObject): Record<string, any>;
@@ -146,6 +149,11 @@ export declare class SparkPoDetailComponent {
    * a slow action and a broken one became indistinguishable.
    */
   runningAction: import("@angular/core").WritableSignal<string | null>;
+  /**
+   * Why an action cannot run in this browser, translated, for its tooltip: the client method it
+   * requires (`requiresClient`) is not registered or not supported here (Q9). Null otherwise.
+   */
+  protected customActionUnavailableReason(action: CustomActionDefinition): string | null;
   onCustomAction(action: CustomActionDefinition): Promise<void>;
   onEdit(): void;
   onDelete(): Promise<void>;

package/types/mintplayer-ng-spark-po-form.d.ts

@@ -516,6 +516,8 @@ export declare class SparkReferencePickerComponent {
   searchTerm: string;
   /** The picker lists query rows, so its columns are the query's: `showedOn` includes Query (#264; not None). */
   visibleAttributes: import("@angular/core").Signal<import("@mintplayer/ng-spark/models").EntityAttributeDefinition[]>;
+  /** The resize handle and its options dialog, translated; columns are named by `bsDatatableColumnLabel`. */
+  datatableLabels: import("@angular/core").Signal<import("@mintplayer/ng-spark/services").SparkDatatableLabels>;
   rows: import("@angular/core").Signal<QueryResultItem[]>;
   displayValue: import("@angular/core").Signal<string>;
   open(): Promise<void>;

package/types/mintplayer-ng-spark-pwa.d.ts

@@ -0,0 +1,89 @@
+import * as i0 from "@angular/core";
+import { EnvironmentProviders, InjectionToken } from "@angular/core";
+import { SwRegistrationOptions } from "@angular/service-worker";
+export interface SparkServiceWorkerOptions {
+  /** Whether the worker registers. Default: `!isDevMode()`, so only production builds register it. */
+  enabled?: boolean;
+  /** The worker script, relative to the base href. Default: `ngsw-worker.js`. */
+  script?: string;
+  /** When the worker registers. Default: `registerWhenStable:30000`. */
+  registrationStrategy?: SwRegistrationOptions['registrationStrategy'];
+}
+/**
+ * Registers Angular's service worker with Spark's update policy (#464, Q1b); see
+ * {@link SparkServiceWorkerUpdates} for what happens when a new version is deployed.
+ *
+ * The application also needs an `ngsw-config.json` with Spark's navigation exclusions and
+ * `serviceWorker` in its production build configuration; see `docs/guide-pwa.md`.
+ */
+export declare function provideSparkServiceWorker(options?: SparkServiceWorkerOptions): EnvironmentProviders;
+/** A service-worker version as `ngsw.json` describes it. `appData` is the config's `appData`. */
+export interface SparkAppVersion {
+  hash: string;
+  appData?: Record<string, unknown>;
+}
+/** The two page loads the update policy performs. Replaceable for tests. */
+export interface SparkPageLoader {
+  assign(url: string): void;
+  reload(): void;
+}
+/** How the update policy loads a page: `window.location` by default. */
+export declare const SPARK_SW_PAGE_LOADER: InjectionToken<SparkPageLoader>;
+/** Update-check timing. Defaults: every 6 h, and on becoming visible at most once a minute. */
+export interface SparkServiceWorkerSchedule {
+  checkIntervalMs: number;
+  visibleCheckThrottleMs: number;
+}
+export declare const SPARK_SW_SCHEDULE: InjectionToken<SparkServiceWorkerSchedule>;
+/**
+ * The update policy of `provideSparkServiceWorker()` (#464, Q1b).
+ *
+ * - `VERSION_READY`: the **next** router navigation becomes a full page load of its target, so the
+ *   user lands on the page they asked for, in the new version, without losing anything on the page
+ *   they are leaving (the navigation was leaving it anyway).
+ * - `unrecoverable`: the running version can no longer be served, so the page reloads at once.
+ * - Checks: once the application is stable, every 6 h, and when the tab becomes visible again
+ *   (at most once a minute).
+ * - **A hidden tab never reloads.** Spark has no unsaved-changes tracking to consult, so a reload
+ *   nobody is looking at could throw away an open edit. An `unrecoverable` in a hidden tab waits
+ *   until the tab is visible; a navigation in a hidden tab stays a normal in-app navigation.
+ *
+ * Nothing happens when the service worker is disabled (development builds, unsupported browsers)
+ * or on the server.
+ */
+export declare class SparkServiceWorkerUpdates {
+  private readonly swUpdate;
+  private readonly router;
+  private readonly location;
+  private readonly appRef;
+  private readonly document;
+  private readonly platformId;
+  private readonly destroyRef;
+  private readonly pageLoader;
+  private readonly schedule;
+  private readonly _updateReady;
+  private readonly _currentVersion;
+  private readonly _latestVersion;
+  /** True once a new version is downloaded and the next navigation will load it. */
+  readonly updateReady: import("@angular/core").Signal<boolean>;
+  /** The running version, known once an update was reported. */
+  readonly currentVersion: import("@angular/core").Signal<SparkAppVersion | null>;
+  /** The version the next navigation loads (`appData.build` is the ng-spark version). */
+  readonly latestVersion: import("@angular/core").Signal<SparkAppVersion | null>;
+  private started;
+  private leaving;
+  private reloadWhenVisible;
+  private lastCheck;
+  /** Starts the policy. Idempotent; called by the app initializer `provideSparkServiceWorker()` adds. */
+  start(): void;
+  private onVersionReady;
+  private onUnrecoverable;
+  private onNavigationStart;
+  private check;
+  private reload;
+  private isHidden;
+  private readReloadedFor;
+  private writeReloadedFor;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkServiceWorkerUpdates, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}

package/types/mintplayer-ng-spark-query-list.d.ts

@@ -85,6 +85,8 @@ export declare class SparkQueryListComponent {
   protected readonly toolbarActions: import("@angular/core").Signal<SparkQueryToolbarAction[]>;
   protected toolbarActionClass(action: SparkQueryToolbarAction): string;
   protected isToolbarActionEnabled(action: SparkQueryToolbarAction): boolean;
+  /** The tooltip of an action disabled for want of its client method (`requiresClient`); null otherwise. */
+  protected toolbarActionUnavailableReason(action: SparkQueryToolbarAction): string | null;
   protected runToolbarAction(action: SparkQueryToolbarAction): void;
   protected isActionEnabled(action: CustomActionDefinition): boolean;
   isStreaming: import("@angular/core").WritableSignal<boolean>;

package/types/mintplayer-ng-spark-renderers.d.ts

@@ -1,3 +1,4 @@
+import * as i0 from "@angular/core";
 import { InjectionToken, InputSignal, Provider, Type } from "@angular/core";
 import { EntityAttributeDefinition, EntityType, PersistentObject, PersistentObjectAttribute, QueryResultItem, QueryResultItemValue, SparkCellColumn } from "@mintplayer/ng-spark/models";
 /**
@@ -136,7 +137,17 @@ export interface SparkAttributeRendererRegistration {
    * give it, which is the whole reason the renderer itself cannot be used here.
    */
   filterLabel?: (value: unknown) => string;
+  /**
+   * The detail page draws the renderer across the whole row, with no label: for text blocks such
+   * as the core `paragraph` renderer, which are body text rather than a labelled value.
+   */
+  fullWidth?: boolean;
 }
+/**
+ * The renderers ng-spark ships itself, available in every app without registration. An app's own
+ * registration of the same name wins (it comes first in the list).
+ */
+export declare const sparkCoreRenderers: readonly SparkAttributeRendererRegistration[];
 export declare const SPARK_ATTRIBUTE_RENDERERS: InjectionToken<SparkAttributeRendererRegistration[]>;
 /**
  * Register custom attribute renderers globally.
@@ -148,6 +159,42 @@ export declare const SPARK_ATTRIBUTE_RENDERERS: InjectionToken<SparkAttributeRen
  * ])
  */
 export declare function provideSparkAttributeRenderers(renderers: SparkAttributeRendererRegistration[]): Provider;
+/**
+ * The core `paragraph` renderer (generic passkeys page, D5): a read-only string shown as body text,
+ * full width and without a label — an explanatory text block on a persistent object, filled from
+ * translations by the actions class. Pair it with `showedOn: PersistentObject` so it never becomes a
+ * grid column.
+ *
+ * **Escaped by default.** The value is interpolated, so markup in it is shown as text. A blank line
+ * starts a new paragraph and a single newline is a line break.
+ *
+ * `"rendererOptions": { "sanitize": false }` renders the value as HTML instead, through Angular's
+ * `[innerHTML]`, whose sanitizer still strips scripts, event handlers and `javascript:` URLs. There is
+ * deliberately no `bypassSecurityTrustHtml` anywhere on this path: the opt-out is "allow markup",
+ * never "allow script".
+ */
+export declare class SparkParagraphRendererComponent implements SparkAttributeDetailRenderer {
+  readonly value: import("@angular/core").InputSignal<any>;
+  readonly options: import("@angular/core").InputSignal<Record<string, any> | undefined>;
+  protected readonly text: import("@angular/core").Signal<string>;
+  /** Only an explicit `false` opts out of escaping; anything else, absent included, escapes. */
+  protected readonly asHtml: import("@angular/core").Signal<boolean>;
+  /** Paragraphs split on blank lines, each a list of its lines. */
+  protected readonly paragraphs: import("@angular/core").Signal<string[][]>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkParagraphRendererComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkParagraphRendererComponent, "spark-paragraph-renderer", never, {
+    "value": {
+      "alias": "value";
+      "required": false;
+      "isSignal": true;
+    };
+    "options": {
+      "alias": "options";
+      "required": false;
+      "isSignal": true;
+    };
+  }, {}, never, never, true, never>;
+}
 /** The row renderer of an AsDetail row type, resolved once per type (see `rowComponent`). */
 export interface SparkResolvedRowRenderer {
   component: Type<any>;

package/types/mintplayer-ng-spark-retry-action-modal.d.ts

@@ -15,6 +15,7 @@ export declare class SparkRetryActionModalComponent {
   protected readonly retryActionService: RetryActionService;
   private readonly sparkService;
   colors: typeof Color;
+  protected readonly cancel = "Cancel";
   isOpen: import("@angular/core").Signal<boolean>;
   /**
    * EntityType definition for the incoming PO — fetched lazily via SparkService so the

package/types/mintplayer-ng-spark-services.d.ts

@@ -15,6 +15,8 @@ export declare class RetryActionService {
 export declare class SparkLanguageService {
   private readonly http;
   private readonly config;
+  /** Null outside a browser (server-side rendering), where there is no cookie to write. */
+  private readonly document;
   private readonly baseUrl;
   private readonly currentLang;
   private readonly translationsMap;
@@ -22,6 +24,14 @@ export declare class SparkLanguageService {
   readonly languages: import("@angular/core").WritableSignal<Record<string, TranslatedString>>;
   constructor();
   private loadCulture;
+  /**
+   * Mirrors the language into the `spark-lang` cookie, which the server-rendered pages read
+   * (`/connect/*` of the identity provider, `ConnectText.CultureCookie`): they cannot see
+   * localStorage, and without the cookie a sign-in popup would open in the browser's language
+   * rather than the one the user picked in the app. Not `HttpOnly` by nature (script writes it);
+   * it carries only a language code, which the server matches against its supported cultures.
+   */
+  private writeCookie;
   private loadTranslations;
   setLanguage(lang: string): void;
   resolve(ts: TranslatedString | undefined): string;
@@ -102,6 +112,7 @@ export declare class SparkService {
    */
   private static readonly MAX_RETRY_DEPTH;
   private readonly dispatcher;
+  private readonly clientMethods;
   getEntityTypes(): Promise<EntityType[]>;
   /**
    * One entity type, shaped by the caller's attribute rights. `purpose` narrows it for one form (#264, G1/G2):
@@ -492,4 +503,29 @@ export declare class SparkReturnNavigationService {
   listRouteFor(entityTypeName: string): Promise<unknown[] | null>;
   static ɵfac: i0.ɵɵFactoryDeclaration<SparkReturnNavigationService, never>;
   static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+}
+/** The `<bs-datatable>` strings Spark translates: the column-resize handle and its options dialog. */
+export interface SparkDatatableLabels {
+  resizeColumn: (column: string) => string;
+  resizeColumnHint: string;
+  resizeColumnOptions: (column: string) => string;
+  narrowerColumn: (column: string) => string;
+  widerColumn: (column: string) => string;
+  columnWidth: (px: number) => string;
+  fitColumn: string;
+  resetColumn: string;
+}
+/**
+ * The `[labels]` a Spark `<bs-datatable>` passes so the column-resize handle, its keymap
+ * announcement and its resize options dialog (ng-bootstrap 22.22.0 / web-components 2.19.0) speak
+ * the viewer's language.
+ *
+ * The `column` these formatters receive is the column's label: every Spark grid binds
+ * `bsDatatableColumnLabel` to the header's translated text (and the row-actions column to
+ * "Actions"), so the datatable no longer falls back to the internal name. The keys omitted here
+ * keep the web component's English defaults.
+ *
+ * Every translation is read EAGERLY, so a `computed` that calls this tracks the language and the
+ * translation map, and hands the datatable a new object — which re-renders it — when either changes.
+ */
+export declare function sparkDatatableLabels(lang: SparkLanguageService): SparkDatatableLabels;

package/types/mintplayer-ng-spark-shell.d.ts

@@ -43,7 +43,7 @@ export declare class SparkShellTopbarStartDirective {
 /**
  * Topbar, trailing edge. Default: the language selector (which hides itself when the app has
  * one language). This is where an auth bar goes — the shell cannot ship one itself, since
- * `@mintplayer/ng-spark` does not (and must not) depend on `@mintplayer/ng-spark-auth`.
+ * the non-auth entry points of `@mintplayer/ng-spark` do not (and must not) import `@mintplayer/ng-spark/auth/*`.
  */
 export declare class SparkShellTopbarEndDirective {
   readonly templateRef: TemplateRef<unknown>;
@@ -320,7 +320,7 @@ export declare class SparkShellComponent {
  * instead.
  *
  * Because the response is caller-scoped it must be re-fetched when the caller changes: the
- * component tracks the optional `SPARK_AUTH_STATE` signal (supplied by ng-spark-auth's
+ * component tracks the optional `SPARK_AUTH_STATE` signal (supplied by ng-spark/auth's
  * `provideSparkAuth()`, or by the app's own auth stack) and reloads on every change. Without a
  * provider it fetches once. `reloadToken` is the manual escape hatch (any changed value triggers
  * a reload), and `reload()` the imperative one.