@mintplayer/ng-spark 22.30.0 → 22.31.0

package/types/mintplayer-ng-spark-auth-routes.d.ts

@@ -0,0 +1,154 @@
+import { SparkAccountOverviewLink, SparkAuthRouteEntries, SparkAuthRouteEntry, SparkAuthRoutePaths, SparkExternalProviderPresentation } from "@mintplayer/ng-spark/auth/models";
+import { CanActivateFn } from "@angular/router";
+type Loader = () => Promise<any>;
+interface Child {
+  path: string;
+  loadComponent?: Loader;
+  canActivate?: CanActivateFn[];
+  children?: [];
+}
+/**
+ * The passkeys page: the generic persistent-object page of the Authorization library's virtual
+ * `Passkeys` type, one per signed-in user, so the id is the fixed `me` (generic passkeys page PRD D1).
+ */
+export declare const SPARK_PASSKEYS_PAGE_URL = "/po/passkeys/me";
+/**
+ * One opt-in group of authentication pages, passed to {@link sparkAuthRoutes}. Constructed only by
+ * ng-spark's entry points: `withLocalLogin()`, `withRegistration()`, `withExternalLogin()`,
+ * `withPasskeys()` and `withAccount()` here, and `withIdentityProvider()` from
+ * `@mintplayer/ng-spark/identity-provider`. That keeps the set of mountable pages a decision this
+ * library makes rather than a shape an application invents.
+ */
+export interface SparkAuthRoutesFeature {
+  readonly children: Child[];
+  readonly paths: SparkAuthRoutePaths;
+  readonly providers?: SparkExternalProviderPresentation[];
+  /** Extra links for the account overview (`SPARK_ACCOUNT_OVERVIEW_LINKS`). */
+  readonly accountLinks?: SparkAccountOverviewLink[];
+}
+/** Path override for the sign-in landing page. Named to stay clear of the core package's
+ * `SparkExternalLoginOptions`, which is about the sign-in *call* rather than the route. */
+export type SparkExternalLoginRouteOptions = Pick<SparkAuthRouteEntries, 'signIn'>;
+/**
+ * The routes for Spark's authentication pages.
+ *
+ * **Nothing is mounted unless a feature asks for it.** Passing no features emits no pages at all —
+ * opt-in enforced by construction rather than by a flag, matching `provideHttpClient(withFetch())`
+ * and `provideRouter(withComponentInputBinding())`. Before this the pages mounted by default and an
+ * application had to opt *out*, so every app shipped a registration form whether or not it wanted
+ * one.
+ *
+ * ```ts
+ * sparkAuthRoutes(
+ *   withLocalLogin(),
+ *   withRegistration(),
+ *   withExternalLogin(githubProvider(), facebookProvider()),
+ * )
+ * ```
+ *
+ * The `import()` expressions live *inside* each feature. That placement is the point: a bundler
+ * decides whether to emit a lazy chunk from whether the `import()` call site is reachable, not from
+ * whether the route object referencing it survives — so filtering a children array after the fact
+ * would still ship every page. A page nobody opted into has no reachable `import()` at all.
+ */
+export declare function sparkAuthRoutes(...features: SparkAuthRoutesFeature[]): any[];
+/**
+ * Mounts the email/password family: login, two-factor, forgot-password, reset-password.
+ *
+ * These four are one feature rather than four because they form a star centred on the login page and
+ * every template dereferences its siblings unconditionally — removing any proper subset leaves a
+ * dangling link. Registration is genuinely separable, and is its own feature.
+ *
+ * Two-factor belongs here because it is reachable only from the login page's `RequiresTwoFactor`
+ * branch and posts to the same `/login` endpoint: it is part of password sign-in, not of
+ * authentication in general.
+ */
+export declare function withLocalLogin(entries?: Pick<SparkAuthRouteEntries, 'login' | 'twoFactor' | 'forgotPassword' | 'resetPassword'>): SparkAuthRoutesFeature;
+/**
+ * Mounts the self-service registration page.
+ *
+ * Separate from {@link withLocalLogin} because the two decisions genuinely are separate: an
+ * application whose accounts are provisioned by an administrator still needs password sign-in and
+ * password reset. Mount it only alongside a server whose `SparkLocalCredentials` is `Full` — with
+ * `SignInOnly` the endpoint it posts to is not mapped.
+ */
+export declare function withRegistration(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature;
+/**
+ * Mounts the sign-in landing page — a button per external provider the *server* reports.
+ *
+ * Accepts provider declarations and, in any position, one options object for the page's own path;
+ * the two shapes are disjoint, so `withExternalLogin(githubProvider(), facebookProvider())` and
+ * `withExternalLogin({ signIn: 'landing' }, githubProvider())` both read naturally.
+ *
+ * Declaring no providers is valid and useful: the page still renders whatever
+ * `GET /spark/auth/capabilities` reports, using default buttons.
+ */
+export declare function withExternalLogin(...providersOrOptions: (SparkExternalProviderPresentation | SparkExternalLoginRouteOptions)[]): SparkAuthRoutesFeature;
+/**
+ * Presentation for one provider's button, keyed by the scheme the server reports.
+ *
+ * The generic form. `githubProvider()` and friends are this with a scheme and an icon filled in —
+ * they exist so the common case does not require knowing the scheme string, not because the library
+ * has an opinion about which providers exist.
+ */
+/**
+ * Mounts the passkey management path, which forwards to the generic passkeys page (`/po/passkeys/me`).
+ *
+ * Independent of every other feature here, and of the server's `SparkLocalCredentials`: a passkey is
+ * a passwordless credential, so the applications most likely to want this page are exactly the ones
+ * that mount no password pages at all. It pairs with `SparkPasskeys.Enabled` on the server.
+ *
+ * ⚠️ The page assumes a signed-in user — enrollment adds a credential to an existing account, it
+ * cannot create one. Mount it inside the application's authenticated area, or behind
+ * `sparkAuthGuard`; the server answers the page with 404 to a visitor who is not signed in.
+ */
+export declare function withPasskeys(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature;
+/** Options for {@link withAccount}: a path/component per page, and the guard of the signed-in pages. */
+export type SparkAccountRouteOptions = Pick<SparkAuthRouteEntries, 'confirmEmail' | 'account' | 'profile' | 'changePassword' | 'twoFactorSetup' | 'externalLogins' | 'passkeys' | 'personalData'> & {
+  /**
+   * Guards the signed-in pages (everything but confirm-email). Defaults to `[sparkAuthGuard]`,
+   * which waits for the session check so a hard reload does not bounce a signed-in user to the
+   * sign-in page. Pass `[]` when the pages sit under a guarded parent route already.
+   */
+  canActivate?: CanActivateFn[];
+  /**
+   * Pages to leave out, e.g. `['externalLogins']` for an app without external providers or
+   * `['changePassword']` under `SparkLocalCredentials.Disabled` (the endpoint is not mapped there).
+   */
+  exclude?: (keyof Omit<SparkAccountRouteOptions, 'canActivate' | 'exclude'>)[];
+};
+/**
+ * Mounts the account pages (#460, D16), each also usable as a standalone component:
+ *
+ * | page | default path | component |
+ * |---|---|---|
+ * | confirm email (public; the mail link target) | `confirm-email` | `SparkConfirmEmailComponent` |
+ * | overview | `account` | `SparkAccountOverviewComponent` |
+ * | profile (user name, email change, mail language, app fields) | `account/profile` | `SparkAccountProfileComponent` |
+ * | change / set password | `account/password` | `SparkChangePasswordComponent` |
+ * | two-factor (authenticator, recovery codes) | `account/two-factor` | `SparkTwoFactorSetupComponent` |
+ * | connected logins | `account/logins` | `SparkExternalLoginsComponent` |
+ * | passkeys (forwards to the generic page, `/po/passkeys/me`) | `account/passkeys` | — |
+ * | personal data + account deletion | `account/personal-data` | `SparkPersonalDataComponent` |
+ *
+ * `confirm-email` must stay at the server's `Spark:Auth:Links:ConfirmEmailPath` (default
+ * `/confirm-email`), which confirmation mails link to. No path has a parameterised first segment, so the
+ * group neither shadows `sparkRoutes()` nor is shadowed by it.
+ */
+export declare function withAccount(options?: SparkAccountRouteOptions): SparkAuthRoutesFeature;
+export declare function externalProvider(scheme: string, presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function githubProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function googleProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function facebookProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+export declare function microsoftProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+/** X (formerly Twitter) — the server's `spark.AddTwitter()` preset (OAuth 2.0), scheme `Twitter`. */
+export declare function twitterProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+/** LinkedIn — the server's `spark.AddLinkedIn()` preset (OpenID Connect userinfo), scheme `LinkedIn`. */
+export declare function linkedInProvider(presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>): SparkExternalProviderPresentation;
+/**
+ * Any OpenID Connect provider — the client half of the server's OIDC preset
+ * (`spark.AddOpenIdConnect(...)`, or a `Spark:Auth:Providers:OpenIdConnect:<scheme>` section). Unlike the named presets the scheme is the
+ * application's own choice, so it and the button text are required; `scheme` must equal the server's
+ * scheme name exactly.
+ */
+export declare function oidcProvider(scheme: string, displayName: string, iconClass?: string): SparkExternalProviderPresentation;

package/types/mintplayer-ng-spark-auth-sign-in.d.ts

@@ -0,0 +1,84 @@
+import * as i0 from "@angular/core";
+import { TemplateRef } from "@angular/core";
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkExternalProviderView, SparkProviderButtonContext, SparkProviderButtonContext as SparkProviderButtonContext$1 } from "@mintplayer/ng-spark/auth/external-login";
+/**
+ * The sign-in landing page: a button per external provider, and a link to the password form when the
+ * application mounted one.
+ *
+ * The provider buttons are `<spark-external-login-buttons>`, which the login page hosts as well; this
+ * page adds the passkey button, the link to the password form, and says so when there is no way to
+ * sign in at all.
+ */
+export declare class SparkSignInComponent {
+  private readonly authService;
+  private readonly route;
+  private readonly router;
+  private readonly config;
+  readonly routePaths: Partial<Record<keyof import("@mintplayer/ng-spark/auth/models").SparkAuthRouteEntries, string>>;
+  readonly colors: typeof Color;
+  /**
+   * Where to land after a successful external sign-in.
+   *
+   * Falls back to a `?returnUrl=` query parameter, matching what the login page already does — so a
+   * plain `<a routerLink="/sign-in" [queryParams]="{ returnUrl: '/somewhere' }">` works with no
+   * wiring, which is what a routed page needs since the router passes it no inputs. The query value
+   * is validated as a local path before use; an off-site one is dropped rather than followed.
+   */
+  readonly returnUrl: import("@angular/core").InputSignal<string | undefined>;
+  private effectiveReturnUrl;
+  /**
+   * Replaces the default provider button. Rendered once per provider with a
+   * {@link SparkProviderButtonContext}.
+   *
+   * Reachable only when the consumer *hosts* this component — the router instantiates it with no
+   * projected content, so on a default `withExternalLogin()` route there is nothing to project into.
+   * Host it via `withExternalLogin({ signIn: { path: 'sign-in', component: MySignIn } })` and pass
+   * the template from there.
+   */
+  readonly providerTemplate: import("@angular/core").InputSignal<TemplateRef<SparkProviderButtonContext$1> | null>;
+  /** Whether the server reported any external provider; with none and no passkeys there is no way in. */
+  readonly hasProviders: import("@angular/core").WritableSignal<boolean>;
+  readonly localCredentialsAvailable: import("@angular/core").WritableSignal<boolean>;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly failed: import("@angular/core").WritableSignal<boolean>;
+  /**
+   * Two conditions, and both are necessary. The server must have mounted the sign-in endpoint, and
+   * this browser must be able to run the ceremony — offering the button on either half alone
+   * produces a control that fails the moment it is clicked.
+   */
+  readonly passkeysAvailable: import("@angular/core").WritableSignal<boolean>;
+  readonly passkeyBusy: import("@angular/core").WritableSignal<boolean>;
+  readonly passkeyError: import("@angular/core").WritableSignal<string>;
+  constructor();
+  private load;
+  /**
+   * The routes are a build-time decision and the server's mode a deployment-time one, so they can
+   * disagree without anything failing loudly. Reaching this page at all means the app routed it,
+   * which it only does when local credentials are meant to be limited.
+   */
+  private warnOnMismatch;
+  /**
+   * Signs in with a passkey, then navigates. The navigation matters for the same reason it does
+   * after an external sign-in: nothing else moves the user off this page.
+   *
+   * No username is collected, and none should be: the server's request-options endpoint refuses to
+   * accept an identity so that its answer cannot reveal whether an account exists. The browser
+   * offers whatever discoverable credential it holds.
+   */
+  signInWithPasskey(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkSignInComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkSignInComponent, "spark-sign-in", never, {
+    "returnUrl": {
+      "alias": "returnUrl";
+      "required": false;
+      "isSignal": true;
+    };
+    "providerTemplate": {
+      "alias": "providerTemplate";
+      "required": false;
+      "isSignal": true;
+    };
+  }, {}, never, never, true, never>;
+}
+export type { SparkExternalProviderView, SparkProviderButtonContext };

package/types/mintplayer-ng-spark-auth-two-factor.d.ts

@@ -0,0 +1,23 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import * as i0 from "@angular/core";
+export declare class SparkTwoFactorComponent {
+  private readonly fb;
+  private readonly authService;
+  private readonly router;
+  private readonly route;
+  private readonly config;
+  private readonly translation;
+  readonly routePaths: Partial<Record<keyof import("@mintplayer/ng-spark/auth/models").SparkAuthRouteEntries, string>>;
+  colors: typeof Color;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly errorMessage: import("@angular/core").WritableSignal<string>;
+  readonly useRecoveryCode: import("@angular/core").WritableSignal<boolean>;
+  readonly form: import("@angular/forms").FormGroup<{
+    code: import("@angular/forms").FormControl<string | null>;
+    recoveryCode: import("@angular/forms").FormControl<string | null>;
+  }>;
+  toggleRecoveryCode(): void;
+  onSubmit(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkTwoFactorComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkTwoFactorComponent, "spark-two-factor", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-auth.d.ts

@@ -0,0 +1,24 @@
+import { SPARK_AUTH_CONFIG, SparkAuthConfig, SparkAuthConfig as SparkAuthConfig$1, defaultSparkAuthConfig } from "@mintplayer/ng-spark/auth/models";
+import { EnvironmentProviders } from "@angular/core";
+import { HttpFeature, HttpFeatureKind } from "@angular/common/http";
+import { SparkClientMethodMap } from "@mintplayer/ng-spark/client-operations";
+export declare function provideSparkAuth(config?: Partial<SparkAuthConfig$1>): EnvironmentProviders;
+export declare function withSparkAuth(): HttpFeature<HttpFeatureKind>[];
+/**
+ * The browser steps the Authorization library's server actions invoke (`IRetryAccessor.Invoke`),
+ * registered by {@link provideSparkAuth}.
+ *
+ * `webauthn.create` is the enrollment ceremony of the passkeys page's `AddPasskey` action: the
+ * server hands it the creation options and receives the credential back in the same action, which
+ * attests it against the ceremony cookie its first pass set. The server keeps the challenge; nothing
+ * here chooses or carries one.
+ *
+ * - The user dismissing the prompt (`cancelled`, `no_credential`) rejects, which answers the server
+ *   with `Cancel`: not an error, so no banner.
+ * - Any other failure (an authenticator already holding a credential for this account, a security
+ *   error) resolves as `{ error }`, so the server can say it did not work.
+ * - An unsupported browser never runs it (`supported`), and the action shows disabled with
+ *   `auth.passkeyUnsupported` as the reason.
+ */
+export declare const sparkAuthClientMethods: SparkClientMethodMap;
+export { SPARK_AUTH_CONFIG, type SparkAuthConfig, defaultSparkAuthConfig };

package/types/mintplayer-ng-spark-client-operations.d.ts

@@ -1,6 +1,7 @@
 import { PersistentObject, TranslatedString } from "@mintplayer/ng-spark/models";
 import * as i0 from "@angular/core";
 import { EnvironmentProviders, InjectionToken } from "@angular/core";
+import { Color } from "@mintplayer/ng-bootstrap";
 export declare enum NotificationKind {
   Info = 0,
   Success = 1,
@@ -60,12 +61,27 @@ export interface RetryOperation {
   /** Its argument, as the server serialized it. */
   arguments?: unknown;
 }
+/**
+ * A value the server shows exactly once (a generated client secret, an API token), in a dialog with
+ * a copy button (`IClientAccessor.ShowSecret`, `docs/identity_provider_platform_PRD.md` D5). The server
+ * keeps only a hash. The value is never written to the page's state, the URL or browser storage, and
+ * closing the dialog discards it.
+ */
+export interface ShowSecretOperation {
+  type: 'showSecret';
+  /** The dialog's title, in the request's language. */
+  title: string;
+  /** The explanation shown above the value, in the request's language. */
+  message: string;
+  /** The value itself. */
+  value: string;
+}
 /**
  * Discriminated union of known operation types, plus an open shape for unknown
  * future operations. Handlers should narrow via the `type` discriminator before
  * accessing fields specific to their operation type.
  */
-export type ClientOperation = NavigateOperation | NotifyOperation | RefreshAttributeOperation | RefreshQueryOperation | RetryOperation | {
+export type ClientOperation = NavigateOperation | NotifyOperation | RefreshAttributeOperation | RefreshQueryOperation | RetryOperation | ShowSecretOperation | {
   type: string;
   [key: string]: unknown;
 };
@@ -91,7 +107,7 @@ export interface ClientOperationEnvelope<T = unknown> {
  *   The dispatcher treats handler resolution as allow-list-by-type (unknown
  *   types drop). It does NOT validate the *content* of each operation. Handlers
  *   that act on URL-shaped fields (navigate, redirect, openWindow) MUST run
- *   the value through `sanitizeReturnUrl` from `@mintplayer/ng-spark-auth/models`
+ *   the value through `sanitizeReturnUrl` from `@mintplayer/ng-spark/auth/models`
  *   (or an equivalent same-origin check) before acting on it. Otherwise a
  *   single attribute-echo XSS or a single mid-channel byte flip on a non-TLS
  *   path lets the server drive client navigation to an attacker host. The
@@ -220,7 +236,10 @@ export declare class SparkToastContainerComponent {
 }
 /**
  * Registers the built-in client-operation handlers: `notify`, `refreshQuery`,
- * `refreshAttribute` and `navigate`. Apps add this once in their bootstrap providers.
+ * `refreshAttribute`, `navigate` and `showSecret`. Apps add this once in their bootstrap providers.
+ *
+ * `showSecret` opens {@link SparkSecretDialogService}'s dialog, which mounts itself: without it the
+ * value the server shows once (a client secret, a token) would be lost, since the server keeps a hash.
  *
  * Unregistered operation types are dropped SILENTLY by the dispatcher, which is why
  * `refreshQuery` did nothing at all for as long as it went unhandled — the server emitted
@@ -240,6 +259,62 @@ export declare class SparkToastContainerComponent {
  * `multi: true` providers using <see cref="SPARK_CLIENT_OPERATION_HANDLERS" />.
  */
 export declare function provideSparkClientOperations(): EnvironmentProviders;
+/** A value shown once: the `showSecret` operation's payload, or a value a page received itself. */
+export interface SparkSecret {
+  title: string;
+  message: string;
+  value: string;
+}
+/**
+ * Shows a value the server will never show again, in a modal with a copy button (`showSecret`,
+ * `docs/identity_provider_platform_PRD.md` D5).
+ *
+ * The dialog mounts itself on `document.body` the first time it is needed, so an application does not
+ * have to place a component in its root template for `IClientAccessor.ShowSecret` to work: a handler
+ * whose dialog nobody placed would lose the value as surely as a missing handler.
+ *
+ * The value lives only in this service's signal while the dialog is open. Closing the dialog clears
+ * it; it is never written to the URL, the router state or browser storage.
+ */
+export declare class SparkSecretDialogService {
+  private readonly appRef;
+  private readonly injector;
+  private readonly document;
+  private readonly browser;
+  private readonly current;
+  private dialog;
+  /** The secret on display, or null when the dialog is closed. */
+  readonly secret: import("@angular/core").Signal<SparkSecret | null>;
+  constructor();
+  show(secret: SparkSecret): void;
+  /** Closes the dialog and discards the value. */
+  close(): void;
+  private mount;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkSecretDialogService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/** The dialog behind {@link SparkSecretDialogService}; mounted by the service, not by applications. */
+export declare class SparkShowSecretModalComponent {
+  private readonly dialog;
+  private readonly document;
+  private copiedTimer;
+  protected readonly colors: typeof Color;
+  protected readonly secret: import("@angular/core").Signal<SparkSecret | null>;
+  protected readonly isOpen: import("@angular/core").Signal<boolean>;
+  protected readonly copyState: import("@angular/core").WritableSignal<"copied" | "idle" | "failed">;
+  protected readonly text: import("@angular/core").Signal<{
+    copy: string;
+    copied: string;
+    copyFailed: string;
+    close: string;
+    value: string;
+  }>;
+  protected selectAll(event: Event): void;
+  protected copy(): Promise<void>;
+  protected close(): void;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkShowSecretModalComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkShowSecretModalComponent, "spark-show-secret-modal", never, {}, {}, never, never, true, never>;
+}
 /**
  * Carries a server-issued `refreshQuery` to whichever grids are showing that query.
  *

package/types/mintplayer-ng-spark-identity-provider-connected-applications.d.ts

@@ -0,0 +1,35 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkConnectedApplication, SparkConnectedScope } from "@mintplayer/ng-spark/identity-provider/core";
+import * as i0 from "@angular/core";
+/**
+ * The signed-in user's connected applications (`account/applications`, PRD D6/D7): each application
+ * the user granted access to, with its logo, publisher, the granted scopes and the dates. The user
+ * withdraws the whole grant, or unticks individual scopes and withdraws only those. Required scopes
+ * (`openid`, and those the application or resource marks required) go only with the whole grant.
+ *
+ * The server resolves the scope texts in the request's language; the `spark-lang` cookie
+ * `SparkLanguageService` writes is what makes that the language the user picked here.
+ */
+export declare class SparkConnectedApplicationsComponent {
+  private readonly text;
+  private readonly portal;
+  protected readonly colors: typeof Color;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly apps: import("@angular/core").WritableSignal<SparkConnectedApplication[]>;
+  readonly error: import("@angular/core").WritableSignal<string>;
+  readonly notice: import("@angular/core").WritableSignal<string>;
+  /** Per application, the scopes the user unticked (to withdraw). */
+  private readonly unticked;
+  constructor();
+  load(): Promise<void>;
+  protected hasOptionalScopes(app: SparkConnectedApplication): boolean;
+  protected isUnticked(app: SparkConnectedApplication, scope: SparkConnectedScope): boolean;
+  protected untickedOf(app: SparkConnectedApplication): readonly string[];
+  protected setTicked(app: SparkConnectedApplication, scope: SparkConnectedScope, ticked: boolean): void;
+  withdrawUnticked(app: SparkConnectedApplication): Promise<void>;
+  withdrawAll(app: SparkConnectedApplication): Promise<void>;
+  private withdraw;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkConnectedApplicationsComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkConnectedApplicationsComponent, "spark-connected-applications", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-identity-provider-core.d.ts

@@ -0,0 +1,144 @@
+import * as i0 from "@angular/core";
+import { PipeTransform } from "@angular/core";
+/** One granted scope, with its text in the request's language (`spark-lang` cookie). */
+export interface SparkConnectedScope {
+  name: string;
+  displayName: string;
+  description?: string | null;
+  /** `openid`, or a scope the resource or the application marks required: only withdrawable with the whole grant. */
+  required: boolean;
+}
+/** One application the signed-in user granted access to (`GET /applications`, PRD D6). */
+export interface SparkConnectedApplication {
+  applicationId: string;
+  displayName: string;
+  logoUrl?: string | null;
+  publisher?: string | null;
+  homepageUrl?: string | null;
+  scopes: SparkConnectedScope[];
+  firstGrantedAt: string;
+  lastUsedAt?: string | null;
+  remembered: boolean;
+  rememberedUntil?: string | null;
+}
+/** The body of `POST /applications/withdraw`. No `scopes` withdraws the whole grant. */
+export interface SparkWithdrawAccessRequest {
+  applicationId: string;
+  scopes?: string[];
+}
+/** The developer statuses the server stores (`OidcDeveloperStatuses`). */
+export type SparkDeveloperStatusName = 'Requested' | 'Approved' | 'Rejected' | 'Revoked';
+/** `GET /developer` and `POST /developer` (`OidcDeveloperStatusResponse`). */
+export interface SparkDeveloperStatus {
+  /** Null when the user never asked. */
+  status: SparkDeveloperStatusName | string | null;
+  acceptedTermsVersion: number | null;
+  currentTermsVersion: number;
+  termsUrl: string | null;
+  requireApproval: boolean;
+  isActive: boolean;
+  requestedAt: string | null;
+  decidedAt: string | null;
+  note: string | null;
+}
+/** `POST /developer/registration-token`: an RFC 7591 initial access token, shown once. */
+export interface SparkRegistrationToken {
+  initialAccessToken: string;
+  /** Seconds. */
+  expiresIn: number;
+}
+/** `POST /invitations/accept` (`OidcAcceptInvitationResponse`). */
+export interface SparkInvitationOutcome {
+  accepted: boolean;
+  application: string | null;
+  problem: string | null;
+}
+/** One signing key on the management page (`OidcKeySummary`); never its private material. */
+export interface SparkSigningKey {
+  kid: string;
+  algorithm: string;
+  state: string;
+  createdAt: string;
+  activatedAt: string | null;
+  retiredAt: string | null;
+}
+/** `POST /admin/keys/rotate`. */
+export interface SparkKeyRotation {
+  changes: string[];
+}
+/** The outcome of a portal call: the value, or the status and the server's problem text. */
+export type SparkPortalResult<T> = {
+  ok: true;
+  value: T;
+} | {
+  ok: false;
+  status: number;
+  problem: string | null;
+};
+/** The portal API's prefix (`IdentityProviderPortalGroup.Prefix` on the server). */
+export declare const SPARK_IDENTITY_PROVIDER_API = "/spark/identity-provider";
+/**
+ * The identity provider's portal API for the SPA pages (PRD D7). Every call is for a signed-in user;
+ * the POSTs require the antiforgery token, which Angular's XSRF support adds from the `XSRF-TOKEN`
+ * cookie (`withSparkAuth()` configures it), so the calls are plain `HttpClient` requests.
+ *
+ * Calls never throw: each resolves to a {@link SparkPortalResult}, so a page branches on `ok` and on
+ * the status (403 for a page the user may not see) instead of catching.
+ */
+export declare class SparkIdentityProviderPortalService {
+  private readonly http;
+  connectedApplications(): Promise<SparkPortalResult<SparkConnectedApplication[]>>;
+  /** Withdraws the whole grant, or only `scopes` when given. Answers 204, or 409 when it could not. */
+  withdraw(request: SparkWithdrawAccessRequest): Promise<SparkPortalResult<null>>;
+  developerStatus(): Promise<SparkPortalResult<SparkDeveloperStatus>>;
+  /** Accepts the terms version the page showed; the server refuses (409) a version that is no longer current. */
+  requestDeveloperStatus(termsVersion: number): Promise<SparkPortalResult<SparkDeveloperStatus>>;
+  issueRegistrationToken(): Promise<SparkPortalResult<SparkRegistrationToken>>;
+  acceptInvitation(applicationId: string, token: string): Promise<SparkPortalResult<SparkInvitationOutcome>>;
+  signingKeys(): Promise<SparkPortalResult<SparkSigningKey[]>>;
+  rotateSigningKeys(): Promise<SparkPortalResult<SparkKeyRotation>>;
+  private call;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderPortalService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * A text function for component code: `private readonly text = injectIdentityProviderText();` then
+ * `this.text('apps.withdrawn')`. The texts come from the server's translations in the app's current
+ * language, like every other ng-spark page; `{0}`, `{1}` are replaced by the arguments.
+ */
+export declare function injectIdentityProviderText(): (key: string, ...args: unknown[]) => string;
+/** `{{ 'apps.title' | idp }}`, `{{ 'apps.by' | idp: publisher }}`. Impure: follows the language and the loaded translations. */
+export declare class SparkIdentityProviderTextPipe implements PipeTransform {
+  private readonly translations;
+  transform(key: string, ...args: unknown[]): string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderTextPipe, never>;
+  static ɵpipe: i0.ɵɵPipeDeclaration<SparkIdentityProviderTextPipe, "idp", true>;
+}
+/**
+ * A server date (ISO string) as a date and time in the app's current language; empty for null.
+ * `Intl` rather than Angular's `DatePipe`, which needs locale data registered for every language.
+ */
+export declare function identityProviderDate(value: string | null | undefined): string;
+/** `{{ app.firstGrantedAt | idpDate }}`. Impure: follows the language signal. */
+export declare class SparkIdentityProviderDatePipe implements PipeTransform {
+  transform(value: string | null | undefined): string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderDatePipe, never>;
+  static ɵpipe: i0.ɵɵPipeDeclaration<SparkIdentityProviderDatePipe, "idpDate", true>;
+}
+/**
+ * The identity-provider library's queries, by the aliases in its `App_Data/Model/*.json`
+ * (`queries[].alias`). They open in the generic query page of `sparkRoutes()`, `/query/:queryId`,
+ * which resolves an alias as well as an id. Each lists only what the caller may see.
+ */
+export declare const SPARK_IDENTITY_PROVIDER_QUERIES: {
+  /** `OidcApplication`: the caller's applications (members-only filter), or all of them for an administrator. */
+  readonly applications: "oidc-applications";
+  readonly resources: "oidc-resources";
+  readonly developerRequests: "oidc-developer-requests";
+  readonly scopeApprovals: "oidc-scope-approvals";
+  readonly goLiveReviews: "oidc-golive-reviews";
+  readonly grants: "oidc-grants";
+  readonly auditEvents: "oidc-audit-events";
+};
+/** The router commands that open one of {@link SPARK_IDENTITY_PROVIDER_QUERIES}. */
+export declare function identityProviderQueryLink(alias: string): string[];

package/types/mintplayer-ng-spark-identity-provider-developers.d.ts

@@ -0,0 +1,55 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkDeveloperStatus } from "@mintplayer/ng-spark/identity-provider/core";
+import * as i0 from "@angular/core";
+/**
+ * The developer portal's landing page (`/developers`, PRD D2/D7): the user's developer status, the
+ * terms to accept to request it (again, when they were raised), and for an active developer a link to
+ * their applications (the generic query page, members-only filtered) and a one-time registration
+ * token for dynamic client registration (RFC 7591), shown in the same dialog as `showSecret`.
+ */
+export declare class SparkDevelopersComponent {
+  private readonly text;
+  private readonly portal;
+  private readonly secrets;
+  protected readonly colors: typeof Color;
+  protected readonly applicationsLink: string[];
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly status: import("@angular/core").WritableSignal<SparkDeveloperStatus | null>;
+  readonly accepted: import("@angular/core").WritableSignal<boolean>;
+  readonly error: import("@angular/core").WritableSignal<string>;
+  readonly notice: import("@angular/core").WritableSignal<string>;
+  protected readonly statusKey: import("@angular/core").Signal<string>;
+  /** A developer (or a pending request) whose accepted terms are older than the current ones. */
+  protected readonly termsChanged: import("@angular/core").Signal<boolean>;
+  /** Asking (again) is possible unless an administrator revoked the status; the server refuses that too. */
+  protected readonly canRequest: import("@angular/core").Signal<boolean>;
+  constructor();
+  load(): Promise<void>;
+  request(): Promise<void>;
+  issueToken(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkDevelopersComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkDevelopersComponent, "spark-developers", never, {}, {}, never, never, true, never>;
+}
+/**
+ * The target of a mailed team invitation (`/developers/invitations/:token?app=<applicationId>`, PRD
+ * D3). Accepting is an explicit click, not a side effect of opening the link, and needs the signed-in
+ * account the invitation was sent to; every failure reads the same, as the server answers it.
+ */
+export declare class SparkAcceptInvitationComponent {
+  private readonly portal;
+  private readonly route;
+  protected readonly colors: typeof Color;
+  protected readonly applicationsLink: string[];
+  private readonly token;
+  private readonly applicationId;
+  /** A link without both values cannot be an invitation. */
+  protected readonly valid: boolean;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly failed: import("@angular/core").WritableSignal<boolean>;
+  /** The application joined, once accepted. */
+  readonly joined: import("@angular/core").WritableSignal<string | null>;
+  accept(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkAcceptInvitationComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkAcceptInvitationComponent, "spark-accept-invitation", never, {}, {}, never, never, true, never>;
+}