@coolms/core-angular 2.0.0-alpha.2

package/fesm2022/coolms-core-angular.mjs

@@ -0,0 +1,2085 @@
+import * as i0 from '@angular/core';
+import { Injectable, inject, DestroyRef, Component, signal, computed, effect, input, ChangeDetectionStrategy, InjectionToken } from '@angular/core';
+import { HttpClient, HttpErrorResponse, HttpContextToken, HttpContext, HttpParams } from '@angular/common/http';
+import { Action, Selector, State, Store } from '@ngxs/store';
+import { __decorate } from 'tslib';
+import { Subject, debounceTime, catchError, of, defer, throwError, shareReplay, finalize, from, firstValueFrom, take, switchMap as switchMap$1, ReplaySubject, tap as tap$1, map } from 'rxjs';
+import { tap, switchMap, map as map$1, catchError as catchError$1, shareReplay as shareReplay$1 } from 'rxjs/operators';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+import { Router } from '@angular/router';
+import { Location, NgIf } from '@angular/common';
+import * as i1 from '@angular/forms';
+import { FormsModule } from '@angular/forms';
+
+// Typed contract — must mirror ApiManifest PHP VOs exactly.
+// No `any` anywhere.
+/**
+ * Replaces {param} tokens in a URL pattern with encoded values.
+ *
+ * @example
+ *   resolvePattern(manifest.sections!.item, { id: '123' })
+ *   // -> '/api/v1/sections/123'
+ */
+function resolvePattern(pattern, params) {
+    return Object.entries(params).reduce((url, [key, value]) => url.replace(`{${key}}`, encodeURIComponent(value)), pattern);
+}
+
+// Typed contract — mirrors FormRenderDefinition PHP VOs exactly.
+// No `any` anywhere.
+
+// --- Action ------------------------------------------------------------------
+class SetAppConfig {
+    config;
+    static type = '[AppConfig] Set';
+    constructor(config) {
+        this.config = config;
+    }
+}
+let AppConfigState = class AppConfigState {
+    set(ctx, { config }) {
+        ctx.setState({ config, loaded: true });
+    }
+    static manifest(state) {
+        return state.config?.manifest ?? null;
+    }
+    /**
+     * F.7 viewer manifest. Null when the backend didn't ship a viewers
+     * section (no tagged providers); consumers should fall back to a
+     * "no preview" surface.
+     */
+    static viewers(state) {
+        return state.config?.manifest.viewers ?? null;
+    }
+    static loaded(state) {
+        return state.loaded;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState });
+};
+__decorate([
+    Action(SetAppConfig)
+], AppConfigState.prototype, "set", null);
+__decorate([
+    Selector()
+], AppConfigState, "manifest", null);
+__decorate([
+    Selector()
+], AppConfigState, "viewers", null);
+__decorate([
+    Selector()
+], AppConfigState, "loaded", null);
+AppConfigState = __decorate([
+    State({
+        name: 'appConfig',
+        defaults: { config: null, loaded: false },
+    })
+], AppConfigState);
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState, decorators: [{
+            type: Injectable
+        }], propDecorators: { set: [] } });
+
+/**
+ * The identity endpoints core owns: the session lifecycle, plus the settings
+ * read at boot.
+ *
+ * Carved out of the admin's `ApiService` -- 2410 lines, 118 methods and 89 DTOs
+ * spanning calendars, documents, calls, VFS and the rest. Core cannot depend on
+ * that and still ship beneath the UI kit: it would drag every module's wire
+ * types down with it. Core called exactly FOUR of those methods.
+ *
+ * `logout` is the one addition, and not for symmetry: the auth lifecycle lives
+ * here (state, refresh coordinator, cross-tab sync), so a core package that
+ * could sign in but not out would be incomplete.
+ *
+ * `ApiService` keeps its own identical signatures and delegates here, so none
+ * of the 94 feature files calling it changed.
+ */
+class IdentityApiClient {
+    http = inject(HttpClient);
+    store = inject(Store);
+    /** URLs come from the boot manifest, which core already owns. */
+    get manifest() {
+        const m = this.store.selectSnapshot(AppConfigState.manifest);
+        if (!m)
+            throw new Error('ApiManifest not loaded — call AppInitService.load() first');
+        return m;
+    }
+    login(identifier, password) {
+        return this.http.post(this.manifest.auth.login, { identifier, password });
+    }
+    refresh(refreshToken) {
+        return this.http.post(this.manifest.auth.refresh, { refreshToken });
+    }
+    logout() {
+        return this.http.post(this.manifest.auth.logout, {});
+    }
+    me() {
+        return this.http.get(this.manifest.auth.me);
+    }
+    getSettings() {
+        // Force plain JSON. Angular's default Accept carries a wildcard, which
+        // makes the backend prefer application/ld+json -- and the section keys
+        // are then lost inside the Hydra member array.
+        return this.http.get(this.manifest.identity.settingsUrl, { headers: { Accept: 'application/json' } });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * The two realtime endpoints, carved out for the same reason the identity ones
+ * were: the UI kit's realtime client needed exactly these two of `ApiService`'s
+ * 117 methods, and depending on the whole thing would have pulled the entire
+ * application's wire vocabulary underneath the kit.
+ *
+ * They belong in core rather than in the kit because both answers are derived
+ * from things core already owns -- the boot manifest for the URL, and the auth
+ * interceptor for the bearer token that authorises the request. A token is
+ * session state, not a widget.
+ *
+ * `ApiService` keeps its identical signatures and delegates here, so nothing
+ * calling it had to change.
+ */
+class RealtimeTokenClient {
+    http = inject(HttpClient);
+    store = inject(Store);
+    get manifest() {
+        const m = this.store.selectSnapshot(AppConfigState.manifest);
+        if (!m)
+            throw new Error('ApiManifest not loaded — call AppInitService.load() first');
+        return m;
+    }
+    connectionToken() {
+        return this.http.post(this.manifest.apiBase + '/centrifugo/connection-token', {});
+    }
+    subscriptionToken(channel) {
+        return this.http.post(this.manifest.apiBase + '/centrifugo/subscription-token', { channel });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+class Login {
+    identifier;
+    password;
+    static type = '[Auth] Login';
+    constructor(identifier, password) {
+        this.identifier = identifier;
+        this.password = password;
+    }
+}
+class Logout {
+    static type = '[Auth] Logout';
+}
+class RestoreSession {
+    static type = '[Auth] Restore Session';
+}
+class SetTokens {
+    response;
+    static type = '[Auth] Set Tokens';
+    constructor(response) {
+        this.response = response;
+    }
+}
+/** Merge a partial update into the currently-stored user (e.g. after avatar change). */
+class PatchCurrentUser {
+    patch;
+    static type = '[Auth] Patch Current User';
+    constructor(patch) {
+        this.patch = patch;
+    }
+}
+
+/**
+ * Unified user preferences service — all preference types share one
+ * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
+ *
+ * Key naming convention (stored as nested objects, referenced via dot-notation):
+ *
+ *   // Grids
+ *   grids.{gridId}.columns
+ *   grids.{gridId}.columnWidths
+ *
+ *   // Panels (ExplorerLayout persistKey values from YAML)
+ *   panel.{persistKey}.width
+ *   panel.{persistKey}.collapsed
+ *
+ *   // Page navigation state
+ *   page.vfs.lastPath
+ *   page.vfs.viewMode
+ *   page.media.lastDir
+ *   page.media.viewMode
+ *
+ *   // Global
+ *   nav.lastRoute
+ *   terminal.height
+ *   terminal.open
+ */
+class UserPreferencesService {
+    http = inject(HttpClient);
+    store = inject(Store);
+    destroyRef = inject(DestroyRef);
+    STORAGE_KEY = 'coolms_ui_prefs';
+    SYNC_DELAY = 2000; // ms
+    syncSubject = new Subject();
+    constructor() {
+        // Debounced sync to server — batches rapid changes (e.g. live resize)
+        this.syncSubject.pipe(debounceTime(this.SYNC_DELAY), takeUntilDestroyed(this.destroyRef)).subscribe(prefs => this.syncToServer(prefs));
+    }
+    // -- Core helpers ---------------------------------------------------------
+    /**
+     * Write all prefs to localStorage and schedule a debounced server sync.
+     */
+    save(all) {
+        localStorage.setItem(this.STORAGE_KEY, JSON.stringify(all));
+        this.syncSubject.next(all);
+    }
+    /**
+     * Read the entire prefs object from localStorage, applying legacy key
+     * migration on the first read after an upgrade.
+     */
+    load() {
+        try {
+            const raw = localStorage.getItem(this.STORAGE_KEY);
+            const all = raw ? JSON.parse(raw) : {};
+            return this.migrate(all);
+        }
+        catch {
+            return {};
+        }
+    }
+    /**
+     * One-time migration of legacy flat keys to the new nested naming convention.
+     * Mutates `all` in place and re-persists only when something changed.
+     */
+    migrate(all) {
+        let dirty = false;
+        // terminal_height -> terminal.height
+        if (typeof all['terminal_height'] === 'number') {
+            const terminal = (all['terminal'] ?? {});
+            terminal['height'] = all['terminal_height'];
+            all['terminal'] = terminal;
+            delete all['terminal_height'];
+            dirty = true;
+        }
+        // media_view_mode -> page.media.viewMode
+        if (typeof all['media_view_mode'] === 'string') {
+            const page = (all['page'] ?? {});
+            const media = (page['media'] ?? {});
+            media['viewMode'] = all['media_view_mode'];
+            page['media'] = media;
+            all['page'] = page;
+            delete all['media_view_mode'];
+            dirty = true;
+        }
+        // media_collections_panel -> panel.media_panel_left  (matches persistKey in media-library.yaml)
+        if (all['media_collections_panel'] && typeof all['media_collections_panel'] === 'object') {
+            const panel = (all['panel'] ?? {});
+            panel['media_panel_left'] = all['media_collections_panel'];
+            all['panel'] = panel;
+            delete all['media_collections_panel'];
+            dirty = true;
+        }
+        // Normalize namespace arrays to empty objects.
+        // The server serialises empty namespaces as [] (JSON array) rather than {}
+        // because PHP converts empty associative arrays to JSON arrays. Arrays silently
+        // swallow named-property writes and produce "[]" on serialisation, so column/
+        // panel preferences would be lost. Convert once and re-persist.
+        const NAMESPACES = new Set(['grids', 'panel', 'page', 'terminal', 'nav']);
+        for (const ns of NAMESPACES) {
+            if (Array.isArray(all[ns])) {
+                all[ns] = {};
+                dirty = true;
+            }
+        }
+        // Grid keys: any top-level object with `columns` or `columnWidths` -> grids.{key}
+        for (const key of Object.keys(all)) {
+            if (NAMESPACES.has(key))
+                continue;
+            const val = all[key];
+            if (val && typeof val === 'object' && !Array.isArray(val)) {
+                const obj = val;
+                if ('columns' in obj || 'columnWidths' in obj) {
+                    const grids = (all['grids'] ?? {});
+                    grids[key] = obj;
+                    all['grids'] = grids;
+                    delete all[key];
+                    dirty = true;
+                }
+            }
+        }
+        if (dirty) {
+            localStorage.setItem(this.STORAGE_KEY, JSON.stringify(all));
+        }
+        return all;
+    }
+    // -- Server sync ----------------------------------------------------------
+    /**
+     * Seed localStorage from server preferences.
+     * Called after login and on every session restore (page reload).
+     *
+     * Strategy:
+     *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
+     *  - Local prefs already exist -> merge with local taking priority at each
+     *    top-level namespace.  This ensures that locally-persisted state
+     *    (panel widths, last path, etc.) is never overwritten by the stale copy
+     *    that was saved in the auth token at login time.
+     */
+    loadFromServer(uiPrefs) {
+        if (Object.keys(uiPrefs).length === 0)
+            return;
+        try {
+            const raw = localStorage.getItem(this.STORAGE_KEY);
+            if (!raw) {
+                // Fresh device — trust the server entirely
+                localStorage.setItem(this.STORAGE_KEY, JSON.stringify(uiPrefs));
+            }
+            else {
+                // Local prefs exist — server is the base, local namespaces win
+                const local = JSON.parse(raw);
+                const merged = { ...uiPrefs, ...local };
+                localStorage.setItem(this.STORAGE_KEY, JSON.stringify(merged));
+            }
+        }
+        catch {
+            localStorage.setItem(this.STORAGE_KEY, JSON.stringify(uiPrefs));
+        }
+    }
+    syncToServer(prefs) {
+        const manifest = this.store.selectSnapshot(AppConfigState.manifest);
+        const url = manifest?.auth?.preferencesUrl;
+        if (!url)
+            return;
+        this.http.patch(url, { uiPrefs: prefs }, {
+            headers: { 'Content-Type': 'application/merge-patch+json' },
+        }).subscribe({
+            error: err => console.warn('Preferences sync failed:', err),
+        });
+    }
+    // -- Grids ----------------------------------------------------------------
+    /**
+     * Get stored preferences for a specific grid.
+     */
+    getGridPref(gridId) {
+        try {
+            const all = this.load();
+            const grids = all['grids'];
+            if (!grids)
+                return null;
+            return grids[gridId] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Set visible column order for a grid.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setColumns(gridId, columns) {
+        this.updateGrid(gridId, existing => ({ ...existing, columns }));
+    }
+    /**
+     * Record a column width for a grid column.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setColumnWidth(gridId, field, width) {
+        this.updateGrid(gridId, existing => ({
+            ...existing,
+            columnWidths: {
+                ...(existing.columnWidths ?? {}),
+                [field]: Math.max(60, width),
+            },
+        }));
+    }
+    /**
+     * Remove all preferences for a specific grid and immediately sync to server.
+     */
+    resetGrid(gridId) {
+        const all = this.load();
+        const grids = (all['grids'] ?? {});
+        delete grids[gridId];
+        all['grids'] = grids;
+        this.save(all);
+        this.syncToServer(all); // immediate sync
+    }
+    updateGrid(gridId, updater) {
+        const all = this.load();
+        const grids = (all['grids'] ?? {});
+        grids[gridId] = updater(grids[gridId] ?? {});
+        all['grids'] = grids;
+        this.save(all);
+    }
+    // -- Terminal -------------------------------------------------------------
+    /**
+     * Get persisted terminal panel height.
+     */
+    getTerminalHeight() {
+        const all = this.load();
+        const terminal = all['terminal'];
+        return typeof terminal?.['height'] === 'number' ? terminal['height'] : null;
+    }
+    /**
+     * Persist terminal panel height.
+     */
+    setTerminalHeight(height) {
+        const all = this.load();
+        const terminal = (all['terminal'] ?? {});
+        terminal['height'] = Math.round(height);
+        all['terminal'] = terminal;
+        this.save(all);
+    }
+    // -- Panel ----------------------------------------------------------------
+    /**
+     * Get persisted state for a resizable panel identified by key.
+     * Used by ExplorerLayoutComponent to persist panel widths across sessions.
+     */
+    getPanelState(key) {
+        try {
+            const all = this.load();
+            const panel = all['panel'];
+            if (!panel)
+                return null;
+            const p = panel[key];
+            if (!p || typeof p !== 'object')
+                return null;
+            const { width, collapsed } = p;
+            return typeof width === 'number' && typeof collapsed === 'boolean'
+                ? { width, collapsed }
+                : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Persist generic panel state by key.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setPanelState(key, width, collapsed) {
+        const all = this.load();
+        const panel = (all['panel'] ?? {});
+        panel[key] = { width: Math.round(width), collapsed };
+        all['panel'] = panel;
+        this.save(all);
+    }
+    // -- Page state -----------------------------------------------------------
+    /**
+     * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
+     */
+    getPageState(pageKey) {
+        try {
+            const all = this.load();
+            const page = all['page'];
+            if (!page)
+                return null;
+            return page[pageKey] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Merge partial state into a page namespace.
+     * Existing keys in the namespace are preserved; only provided keys are updated.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setPageState(pageKey, state) {
+        const all = this.load();
+        const page = (all['page'] ?? {});
+        page[pageKey] = { ...(page[pageKey] ?? {}), ...state };
+        all['page'] = page;
+        this.save(all);
+    }
+    // -- Media (legacy pass-through — kept for compatibility) -----------------
+    /** @deprecated Use getPageState('media') instead */
+    getMediaViewMode() {
+        return this.getPageState('media')?.viewMode ?? null;
+    }
+    /** @deprecated Use setPageState('media', ...) instead */
+    setMediaViewMode(mode) {
+        this.setPageState('media', { viewMode: mode });
+    }
+    /** @deprecated Use getPanelState('media_panel_left') instead */
+    getMediaCollectionsPanel() {
+        return this.getPanelState('media_panel_left');
+    }
+    /** @deprecated Use setPanelState('media_panel_left', ...) instead */
+    setMediaCollectionsPanel(width, collapsed) {
+        this.setPanelState('media_panel_left', width, collapsed);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [] });
+
+const STORAGE_KEY$1 = 'coolms_token';
+let AuthState = class AuthState {
+    // `inject()` rather than constructor parameters, and the imports above are
+    // VALUE imports on purpose: an injected type must survive to runtime. As a
+    // constructor parameter that is invisible to `tsc`, which type-checks a
+    // type-only import happily and leaves the Angular compiler to fail with
+    // NG2003. Read as a value here, so the same mistake is a type error.
+    api = inject(IdentityApiClient);
+    prefs = inject(UserPreferencesService);
+    login(ctx, { identifier, password }) {
+        return this.api.login(identifier, password).pipe(tap((res) => {
+            const state = {
+                accessToken: res.accessToken,
+                refreshToken: res.refreshToken,
+                expiresAt: res.expiresAt,
+                user: res.user ?? null,
+            };
+            ctx.setState(state);
+            localStorage.setItem(STORAGE_KEY$1, JSON.stringify(state));
+        }), 
+        // Fetch full user data (includes uiPrefs) to seed preferences
+        switchMap(() => this.api.me().pipe(catchError(() => of(null)))), tap(me => {
+            if (!me)
+                return;
+            // Update stored user with full data including uiPrefs
+            const updated = { ...ctx.getState(), user: me };
+            ctx.setState(updated);
+            localStorage.setItem(STORAGE_KEY$1, JSON.stringify(updated));
+            if (me.uiPrefs) {
+                this.prefs.loadFromServer(me.uiPrefs);
+            }
+        }));
+    }
+    logout(ctx) {
+        ctx.setState({ accessToken: null, refreshToken: null, expiresAt: null, user: null });
+        localStorage.removeItem(STORAGE_KEY$1);
+    }
+    restore(ctx) {
+        const raw = localStorage.getItem(STORAGE_KEY$1);
+        if (!raw)
+            return;
+        try {
+            const state = JSON.parse(raw);
+            // Restore whenever any token is present.
+            // If only the access token has expired but the refresh token is still
+            // valid, the HTTP interceptor will transparently refresh on the next
+            // request.  Discarding state here would throw away the refresh token
+            // and force a full re-login unnecessarily.
+            if (state.accessToken || state.refreshToken) {
+                ctx.setState(state);
+                // Seed preferences from previously stored user (covers page-reload case)
+                if (state.user?.uiPrefs) {
+                    this.prefs.loadFromServer(state.user.uiPrefs);
+                }
+            }
+            else {
+                localStorage.removeItem(STORAGE_KEY$1);
+            }
+        }
+        catch {
+            localStorage.removeItem(STORAGE_KEY$1);
+        }
+    }
+    setTokens(ctx, { response }) {
+        const state = {
+            accessToken: response.accessToken,
+            refreshToken: response.refreshToken,
+            expiresAt: response.expiresAt,
+            user: response.user ?? ctx.getState().user,
+        };
+        ctx.setState(state);
+        localStorage.setItem(STORAGE_KEY$1, JSON.stringify(state));
+    }
+    patchCurrentUser(ctx, { patch }) {
+        const current = ctx.getState();
+        if (!current.user)
+            return;
+        const updated = { ...current, user: { ...current.user, ...patch } };
+        ctx.setState(updated);
+        localStorage.setItem(STORAGE_KEY$1, JSON.stringify(updated));
+    }
+    static isAuthenticated(state) {
+        return null !== state.accessToken;
+    }
+    static accessToken(state) {
+        return state.accessToken;
+    }
+    static refreshToken(state) {
+        return state.refreshToken;
+    }
+    /**
+     * Sub-phase Y -- expose the access-token expiry timestamp so
+     * preemptive-refresh callers (e.g., Centrifuge getToken
+     * callbacks) can decide whether to rotate before issuing the
+     * next protected request, instead of relying on the
+     * interceptor's reactive 401-retry path.
+     */
+    static expiresAt(state) {
+        return state.expiresAt;
+    }
+    static currentUser(state) {
+        return state.user;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState });
+};
+__decorate([
+    Action(Login)
+], AuthState.prototype, "login", null);
+__decorate([
+    Action(Logout)
+], AuthState.prototype, "logout", null);
+__decorate([
+    Action(RestoreSession)
+], AuthState.prototype, "restore", null);
+__decorate([
+    Action(SetTokens)
+], AuthState.prototype, "setTokens", null);
+__decorate([
+    Action(PatchCurrentUser)
+], AuthState.prototype, "patchCurrentUser", null);
+__decorate([
+    Selector()
+], AuthState, "isAuthenticated", null);
+__decorate([
+    Selector()
+], AuthState, "accessToken", null);
+__decorate([
+    Selector()
+], AuthState, "refreshToken", null);
+__decorate([
+    Selector()
+], AuthState, "expiresAt", null);
+__decorate([
+    Selector()
+], AuthState, "currentUser", null);
+AuthState = __decorate([
+    State({
+        name: 'auth',
+        defaults: { accessToken: null, refreshToken: null, expiresAt: null, user: null },
+    })
+], AuthState);
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState, decorators: [{
+            type: Injectable
+        }], propDecorators: { login: [], logout: [], restore: [], setTokens: [], patchCurrentUser: [] } });
+
+const LOCK_NAME = 'coolms_auth_refresh';
+const FRESH_TOKEN_GRACE_MS = 30_000;
+/**
+ * Two-layer refresh coordinator: an intra-tab `shareReplay(1)`
+ * mutex dedupes concurrent callers within one tab, and a
+ * cross-tab `navigator.locks` wrapper ensures only one tab in
+ * the browser issues the actual `POST /auth/refresh` at a time.
+ *
+ * Without the cross-tab layer, two tabs racing the same expired
+ * refresh-token both POST `/auth/refresh`; the backend's
+ * `isUsed` replay branch revokes every token for the user on
+ * the second arrival and the operator is kicked to /login.
+ *
+ * The Web Lock body re-reads the current access-token expiry from
+ * `AuthState` before issuing the HTTP call. When this tab waited
+ * behind another tab's refresh, that tab's `SetTokens` dispatch
+ * has already published fresh values into shared `localStorage`,
+ * `CrossTabAuthSyncService` has mirrored them into this tab's
+ * NGXS state, and the lock body simply returns the cached access
+ * token without another network round-trip.
+ *
+ * `Logout` fires only when the refresh endpoint returns 401
+ * (real auth failure). Transient errors (network blips, 5xx,
+ * CORS, timeouts) propagate without clearing the session so a
+ * momentary refresh failure does not kill a valid login.
+ */
+class AuthRefreshCoordinator {
+    api = inject(IdentityApiClient);
+    store = inject(Store);
+    router = inject(Router);
+    inFlight = null;
+    /**
+     * Return the in-flight refresh Observable, or spawn a new one
+     * with the supplied refresh-token value.
+     *
+     * Callers subscribe via `switchMap` / `firstValueFrom` to retry
+     * their original request with the resolved access token.
+     */
+    refresh(refreshToken) {
+        if (this.inFlight) {
+            return this.inFlight;
+        }
+        this.inFlight = defer(() => this.refreshWithCrossTabLock(refreshToken)).pipe(catchError(refreshErr => {
+            const isAuthFailure = refreshErr instanceof HttpErrorResponse && refreshErr.status === 401;
+            if (isAuthFailure) {
+                this.store.dispatch(new Logout());
+                if (this.router.navigated) {
+                    void this.router.navigate(['/login']);
+                }
+            }
+            return throwError(() => refreshErr);
+        }), shareReplay(1), finalize(() => {
+            this.inFlight = null;
+        }));
+        return this.inFlight;
+    }
+    /**
+     * Run the refresh body inside `navigator.locks` when the API is
+     * available; degrade to direct invocation otherwise. The lock
+     * body checks for state already updated by a sibling tab before
+     * issuing its own HTTP call.
+     */
+    refreshWithCrossTabLock(refreshToken) {
+        const lockBody = () => this.executeRefresh(refreshToken);
+        if (typeof navigator === 'undefined' || !('locks' in navigator)) {
+            return from(lockBody());
+        }
+        return from(navigator.locks.request(LOCK_NAME, lockBody).then(value => {
+            if (value === undefined) {
+                throw new Error('Refresh lock aborted before completing.');
+            }
+            return value;
+        }));
+    }
+    /**
+     * Lock body. Re-reads `AuthState.expiresAt` first: if another
+     * tab published fresh tokens while we were queued, return the
+     * cached access token directly. Otherwise read the latest
+     * refresh-token value from state (it may have rotated while we
+     * waited) and issue the HTTP refresh.
+     */
+    async executeRefresh(originalRefreshToken) {
+        const cachedAccess = this.tryConsumeFreshState();
+        if (cachedAccess !== null) {
+            return cachedAccess;
+        }
+        const currentRefreshToken = this.store.selectSnapshot(AuthState.refreshToken) ?? originalRefreshToken;
+        const response = await firstValueFrom(this.api.refresh(currentRefreshToken));
+        this.store.dispatch(new SetTokens(response));
+        return response.accessToken;
+    }
+    /**
+     * Return the cached access token when `AuthState.expiresAt` has
+     * more than `FRESH_TOKEN_GRACE_MS` milliseconds remaining --
+     * signalling that some other tab refreshed for us. Null
+     * otherwise.
+     */
+    tryConsumeFreshState() {
+        const accessToken = this.store.selectSnapshot(AuthState.accessToken);
+        const expiresAtStr = this.store.selectSnapshot(AuthState.expiresAt);
+        if (accessToken === null || expiresAtStr === null) {
+            return null;
+        }
+        const expiresAtMs = new Date(expiresAtStr).getTime();
+        if (Number.isNaN(expiresAtMs)) {
+            return null;
+        }
+        if (Date.now() < expiresAtMs - FRESH_TOKEN_GRACE_MS) {
+            return accessToken;
+        }
+        return null;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+// -- Opt-out context token -----------------------------------------------------
+//
+// Set BYPASS_AUTH to true on any HttpRequest to skip adding the Authorization
+// header entirely.  Used by AppInitService for the bootstrap config request so
+// that a stale localStorage token does not cause a 401 on a public endpoint.
+const BYPASS_AUTH = new HttpContextToken(() => false);
+// -----------------------------------------------------------------------------
+const authInterceptor = (req, next) => {
+    const store = inject(Store);
+    const router = inject(Router);
+    const coordinator = inject(AuthRefreshCoordinator);
+    const initService = inject(AppInitService);
+    // Caller explicitly requested no auth header (e.g. the bootstrap config
+    // fetch — the endpoint is public and a stale token would cause 401).
+    if (req.context.get(BYPASS_AUTH)) {
+        return next(req);
+    }
+    // Auth endpoints are public by design.  The backend's JWT firewall rejects any
+    // request that carries an invalid/expired Bearer token — even on endpoints
+    // that would otherwise allow anonymous access — so never forward a stored
+    // token to login or refresh.
+    if (req.url.includes('/auth/login') || req.url.includes('/auth/refresh')) {
+        return next(req);
+    }
+    // Queue behind AppInitService.ready$ so that token restoration from
+    // localStorage (RestoreSession) is guaranteed to be in NGXS state before
+    // we read it.  On F5 the interceptor fires synchronously for every pending
+    // request before APP_INITIALIZER has completed; without this guard the
+    // token snapshot is null and every request gets a 401 -> refresh cycle even
+    // for a perfectly valid session.
+    //
+    // ready$ is a ReplaySubject(1) that completes after load() finishes, so:
+    //   - requests fired during init queue here and flush the moment ready$ emits;
+    //   - requests fired after init pass through take(1) immediately (replayed value).
+    return initService.ready$.pipe(take(1), switchMap$1(() => {
+        const token = store.selectSnapshot(AuthState.accessToken);
+        const authed = token
+            ? req.clone({ setHeaders: { Authorization: `Bearer ${token}` } })
+            : req;
+        return next(authed).pipe(catchError((err) => {
+            if (!(err instanceof HttpErrorResponse) || err.status !== 401) {
+                return throwError(() => err);
+            }
+            // Avoid infinite loop — skip refresh for auth endpoints themselves.
+            if (req.url.includes('/auth/refresh') || req.url.includes('/auth/login')) {
+                return throwError(() => err);
+            }
+            const refreshToken = store.selectSnapshot(AuthState.refreshToken);
+            if (!refreshToken) {
+                store.dispatch(new Logout());
+                // Only navigate programmatically once the router has already
+                // completed its initial navigation.  During APP_INITIALIZER the
+                // router is still blocked; authGuard handles the redirect there.
+                if (router.navigated)
+                    void router.navigate(['/login']);
+                return throwError(() => err);
+            }
+            // Delegate refresh to the shared coordinator so the
+            // Centrifuge getToken path and the interceptor share ONE
+            // in-flight refresh. Without this, two parallel
+            // `api.refresh(refreshToken)` calls (one from each mutex)
+            // would send the same refresh-token twice and trigger the
+            // backend's `isUsed` replay branch on the second arrival,
+            // wiping the whole session.
+            return coordinator.refresh(refreshToken).pipe(switchMap$1(newToken => next(req.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } }))));
+        }));
+    }));
+};
+
+const STORAGE_KEY = 'coolms_token';
+/**
+ * Bridges shared `localStorage` mutations into the NGXS auth
+ * state so a refresh executed in one tab silently propagates to
+ * every other open tab.
+ *
+ * The browser fires `storage` events in tabs OTHER than the one
+ * that mutated `localStorage`. So when Tab A's
+ * `AuthRefreshCoordinator` rotates the token pair and `SetTokens`
+ * persists the new values, every sibling tab receives an event
+ * here and dispatches `SetTokens` against its own NGXS state --
+ * no extra HTTP roundtrip, no extra refresh contention.
+ *
+ * Pairs with the `navigator.locks` cross-tab mutex in
+ * `AuthRefreshCoordinator`: locks ensure only one tab issues the
+ * refresh, this listener propagates the result to the rest.
+ *
+ * `Logout` from any tab clears `coolms_token` (newValue === null)
+ * and this listener mirrors that into the sibling tabs so the
+ * shell redirects to `/login` without waiting for the next
+ * protected request to 401.
+ *
+ * Started from `AppInitService.load()` so the listener is in
+ * place before any protected HTTP fires.
+ */
+class CrossTabAuthSyncService {
+    store = inject(Store);
+    listenerAttached = false;
+    start() {
+        if (this.listenerAttached) {
+            return;
+        }
+        this.listenerAttached = true;
+        window.addEventListener('storage', this.handleStorageEvent);
+    }
+    handleStorageEvent = (event) => {
+        if (event.key !== STORAGE_KEY) {
+            return;
+        }
+        // Sibling tab cleared the key (logout dispatch or
+        // RestoreSession parse-error cleanup). Mirror the clear so
+        // this tab does not keep operating against a revoked
+        // server-side session.
+        if (event.newValue === null) {
+            this.store.dispatch(new Logout());
+            return;
+        }
+        // Parse the new value and dispatch SetTokens so this tab's
+        // in-memory NGXS state reflects what the originating tab
+        // just wrote. Malformed payloads are ignored.
+        let parsed;
+        try {
+            parsed = JSON.parse(event.newValue);
+        }
+        catch {
+            return;
+        }
+        if (typeof parsed.accessToken !== 'string' || typeof parsed.refreshToken !== 'string' || typeof parsed.expiresAt !== 'string') {
+            return;
+        }
+        const tokenResponse = {
+            accessToken: parsed.accessToken,
+            refreshToken: parsed.refreshToken,
+            expiresAt: parsed.expiresAt,
+            user: parsed.user ?? undefined,
+        };
+        this.store.dispatch(new SetTokens(tokenResponse));
+    };
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+class AppInitService {
+    // Injected as values, not constructor parameters: an injection token has to
+    // exist at runtime, and a type-only import of one type-checks clean while
+    // the Angular compiler rejects it with NG2003.
+    http = inject(HttpClient);
+    store = inject(Store);
+    router = inject(Router);
+    location = inject(Location);
+    prefs = inject(UserPreferencesService);
+    crossTabSync = inject(CrossTabAuthSyncService);
+    refreshCoordinator = inject(AuthRefreshCoordinator);
+    /** The only hardcoded URL — everything else comes from the manifest. */
+    configUrl = '/api/v1/theme/config';
+    /**
+     * Emits (once) when load() has fully completed — tokens settled, manifest
+     * set (or swallowed on error).  authGuard subscribes to this so it never
+     * evaluates isAuthenticated against a partially-restored stale token.
+     */
+    initComplete = new ReplaySubject(1);
+    ready$ = this.initComplete.asObservable();
+    async load() {
+        // -- Step 0: cross-tab sync --------------------------------------------
+        //
+        // Install the storage-event listener before RestoreSession so that
+        // any localStorage mutation from a sibling tab during bootstrap
+        // (e.g., a parallel tab refreshing tokens just as we load) is mirrored
+        // into this tab's NGXS state.
+        this.crossTabSync.start();
+        // -- Step 1: restore tokens from localStorage --------------------------
+        //
+        // RestoreSession is synchronous (ctx.setState from localStorage), so
+        // this await resolves in the same microtask.  Tokens are in NGXS state
+        // before ANY subsequent HTTP request fires — the auth interceptor reads
+        // the token from state when attaching Authorization headers, so this
+        // ordering prevents unauthenticated requests on page reload (F5).
+        await firstValueFrom(this.store.dispatch(new RestoreSession()));
+        // -- Step 2: fetch the manifest ----------------------------------------
+        //
+        // BYPASS_AUTH is required here — not optional.  The manifest endpoint
+        // is public, but two specific failure modes make bypassing necessary:
+        //
+        //   a) The stored access token may be expired.  Without BYPASS_AUTH the
+        //      interceptor attaches the expired token, gets a 401, and tries to
+        //      refresh.  But the refresh endpoint URL comes from the manifest
+        //      (api.refresh() reads manifest.auth.refresh), which hasn't been
+        //      loaded yet — triggering a null-dereference crash before the app
+        //      can recover.
+        //
+        //   b) Even if the token is valid, attaching it to a public endpoint
+        //      that ignores auth adds unnecessary coupling.
+        //
+        // Consequence: every page load issues one unauthenticated config
+        // request, which is intentional.  All subsequent API calls carry the
+        // restored (or refreshed) token normally.
+        const config = await firstValueFrom(this.http.get(this.configUrl, {
+            context: new HttpContext().set(BYPASS_AUTH, true),
+        }).pipe(tap$1(cfg => this.store.dispatch(new SetAppConfig(cfg))), catchError(() => {
+            console.warn('CoolMS: theme/config unreachable, using safe defaults');
+            return of(null);
+        })));
+        // -- Step 3: validate the restored session -----------------------------
+        //
+        // RestoreSession trusts whatever tokens are in localStorage, but they may
+        // have been revoked out-of-band — most notably, signing out on the public
+        // SSR site revokes the user's WHOLE token set. We MUST settle the real
+        // auth state here, BEFORE step 4 signals ready$: both the auth interceptor
+        // AND authGuard gate on ready$, so if we signalled first, the guard would
+        // race ahead and mount the shell against the stale isAuthenticated=true
+        // before this probe finished (-> half-loaded shell + "Session expired"
+        // toasts, the exact bug this fixes). Because the probe itself cannot wait
+        // on ready$ (that would deadlock), validateSession() bypasses the
+        // interceptor and attaches the token / drives the refresh by hand.
+        const meUrl = config?.manifest.identity?.meUrl;
+        if (meUrl && this.store.selectSnapshot(AuthState.isAuthenticated)) {
+            await this.validateSession(meUrl);
+        }
+        // -- Step 4: signal authGuard + unblock the interceptor ----------------
+        //
+        // Auth state is now settled (session confirmed, refreshed, or Logout
+        // dispatched). ReplaySubject(1) replays to guards/requests that subscribe
+        // afterwards, so they evaluate against the final isAuthenticated value.
+        this.initComplete.next();
+        this.initComplete.complete();
+        // -- Step 5: navigate to last-visited route ----------------------------
+        //
+        // Only when the session survived validation. If it did not, isAuthenticated
+        // is now false, we skip the saved-route navigation, and authGuard sends the
+        // initial navigation to /login.
+        //
+        // Only restore when the user opened the bare /admin root. An explicit
+        // deep link (pasted /admin/sync-fleet, a bookmark, a shared URL) must
+        // win over the saved route. The router cannot tell us which one this is:
+        // withEnabledBlockingInitialNavigation holds the initial navigation until
+        // this initializer resolves, so router.url is still '/'. The browser
+        // location is the only record of what was requested — Location.path()
+        // reads it with the /admin base href stripped, so the bare root (with or
+        // without trailing slash) yields ''. Anything else, including a root URL
+        // carrying query params, is treated as an explicit destination.
+        if (this.store.selectSnapshot(AuthState.isAuthenticated)) {
+            const requested = this.location.path();
+            if (requested === '' || requested === '/') {
+                const saved = this.prefs.getPageState('nav');
+                if (saved?.lastRoute && !saved.lastRoute.startsWith('/login')) {
+                    void this.router.navigateByUrl(saved.lastRoute);
+                }
+            }
+        }
+    }
+    /**
+     * Confirm the restored session is still alive, settling AuthState before the
+     * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
+     * interceptor queues behind ready$, which has not fired yet at this point.
+     *
+     *   - access token accepted  -> done, session alive;
+     *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
+     *                              so an expired one with a valid refresh token must
+     *                              stay logged in). The coordinator dispatches Logout
+     *                              on a refresh 401 and SetTokens on success; a
+     *                              transient failure (5xx/network) is swallowed so a
+     *                              momentary blip never kills a valid session.
+     */
+    async validateSession(meUrl) {
+        const token = this.store.selectSnapshot(AuthState.accessToken);
+        if (await this.probe(meUrl, token)) {
+            return;
+        }
+        const refreshToken = this.store.selectSnapshot(AuthState.refreshToken);
+        if (!refreshToken) {
+            this.store.dispatch(new Logout());
+            return;
+        }
+        let refreshedToken = null;
+        try {
+            refreshedToken = await firstValueFrom(this.refreshCoordinator.refresh(refreshToken));
+        }
+        catch {
+            // 401 -> coordinator already dispatched Logout; transient -> session kept.
+            return;
+        }
+        // Refresh resolved — but the coordinator's fresh-state optimisation can hand
+        // back the SAME access token (without a network round-trip) when its stored
+        // expiry still looks fresh. For a token that was revoked but not yet expired
+        // (signing out on the SSR site while the access token is still in its TTL),
+        // that token is dead despite looking fresh. Re-probe with whatever we now
+        // hold; a second rejection means the session is genuinely gone.
+        if (!(await this.probe(meUrl, refreshedToken))) {
+            this.store.dispatch(new Logout());
+        }
+    }
+    /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
+    probe(url, token) {
+        return firstValueFrom(this.http.get(url, {
+            context: new HttpContext().set(BYPASS_AUTH, true),
+            headers: token ? { Authorization: `Bearer ${token}` } : {},
+        }).pipe(map(() => true), catchError(() => of(false))));
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * Protects routes that require authentication.
+ *
+ * The guard is intentionally ASYNC: it waits for AppInitService.ready$ before
+ * evaluating auth state.  Without this, Angular's router can evaluate
+ * isAuthenticated while APP_INITIALIZER is still in-flight — RestoreSession
+ * will have placed a non-null (but expired) token in state, causing the guard
+ * to pass even though the subsequent config/refresh requests will fail and
+ * dispatch Logout.  Waiting for ready$ guarantees the auth state is settled.
+ */
+const authGuard = () => {
+    const init = inject(AppInitService);
+    const store = inject(Store);
+    const router = inject(Router);
+    return init.ready$.pipe(take(1), map(() => {
+        if (store.selectSnapshot(AuthState.isAuthenticated)) {
+            return true;
+        }
+        return router.createUrlTree(['/login']);
+    }));
+};
+
+/**
+ * Guards the `/login` route -- redirects already-authenticated
+ * callers to admin home so a stale tab parked on `/login` cannot
+ * remain mounted while another tab is logged in. When Tab A logs
+ * in fresh, Tab B's `RestoreSession` (driven by APP_INITIALIZER)
+ * reads the new token from shared `localStorage` and populates
+ * `AuthState`; this guard then sees `isAuthenticated === true`
+ * and routes Tab B to `/`.
+ *
+ * Same `ready$` wait as `authGuard` -- ensures `RestoreSession`
+ * has run before the snapshot is read; otherwise a fresh F5 on
+ * `/login` with a valid stored session would briefly evaluate
+ * as anonymous, allow `/login`, and only then have the token
+ * populated.
+ */
+const loginPageGuard = () => {
+    const init = inject(AppInitService);
+    const store = inject(Store);
+    const router = inject(Router);
+    return init.ready$.pipe(take(1), map(() => {
+        if (store.selectSnapshot(AuthState.isAuthenticated)) {
+            return router.createUrlTree(['/']);
+        }
+        return true;
+    }));
+};
+
+class LoginComponent {
+    identifier = '';
+    password = '';
+    loading = false;
+    error = null;
+    store = inject(Store);
+    router = inject(Router);
+    submit() {
+        if (!this.identifier || !this.password)
+            return;
+        this.loading = true;
+        this.error = null;
+        this.store.dispatch(new Login(this.identifier, this.password)).subscribe({
+            next: () => {
+                // A rejected navigation used to vanish: nothing resets `loading`
+                // on the success path, because the page is expected to go
+                // away. If it does not, the form spins for ever with no reason
+                // given, so say so instead.
+                void this.router.navigate(['/']).catch(() => {
+                    this.loading = false;
+                    this.error = 'Signed in, but the admin could not be opened. Please reload.';
+                });
+            },
+            error: (err) => {
+                this.loading = false;
+                this.error = err?.error?.detail ?? err?.error?.message ?? err?.message ?? 'Invalid credentials. Please try again.';
+            },
+        });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: LoginComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "22.1.3", type: LoginComponent, isStandalone: true, selector: "coolms-admin-login", ngImport: i0, template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n", dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox]):not([ngNoCva])[formControlName],textarea:not([ngNoCva])[formControlName],input:not([type=checkbox]):not([ngNoCva])[formControl],textarea:not([ngNoCva])[formControl],input:not([type=checkbox]):not([ngNoCva])[ngModel],textarea:not([ngNoCva])[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }] });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: LoginComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'coolms-admin-login', standalone: true, imports: [FormsModule, NgIf], template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n" }]
+        }] });
+
+/**
+ * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
+ *
+ * Responses are cached for the lifetime of the service (Map + shareReplay(1))
+ * so repeated calls never re-fetch the same resource.
+ *
+ * configBase is read from the API manifest (manifest.configBase) and falls
+ * back to '/api/v1/config' when the manifest is not yet loaded.
+ */
+class ConfigService {
+    http = inject(HttpClient);
+    store = inject(Store);
+    cache = new Map();
+    layout(id) { return this.fetch('layout', id); }
+    dialog(id) { return this.fetch('dialog', id); }
+    navigraph(slug) { return this.fetch('navigraph', slug); }
+    form(id) { return this.fetch('form', id); }
+    datagrid(id) { return this.fetch('datagrid', id); }
+    fetch(type, id) {
+        const key = `${type}/${id}`;
+        if (!this.cache.has(key)) {
+            const base = this.store.selectSnapshot(AppConfigState.manifest)?.configBase
+                ?? '/api/v1/config';
+            // The config endpoint wraps the YAML payload in a `data` field:
+            // { type, id, data: { ...yaml content... } }
+            // Unwrap so callers always receive the config payload directly.
+            const obs = this.http.get(`${base}/${type}/${id}`).pipe(map(r => (r.data ?? r)), shareReplay(1));
+            this.cache.set(key, obs);
+        }
+        return this.cache.get(key);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * Converts any caught error into a human-readable message.
+ *
+ * Priority order for backend errors:
+ *   1. error.detail              (RFC 7807 problem detail)
+ *   2. error['hydra:description'] (Hydra validation errors)
+ *   3. error.message             (generic)
+ *   4. error.violations[]        (constraint violations)
+ *   5. Status-based fallback
+ */
+class ErrorHandlerService {
+    humanize(err) {
+        if (!(err instanceof HttpErrorResponse)) {
+            return err instanceof Error ? err.message : 'An unexpected error occurred.';
+        }
+        const body = err.error;
+        if (body && typeof body === 'object') {
+            const detail = body['detail'] ?? body['hydra:description'] ?? body['message'];
+            if (typeof detail === 'string' && detail.trim()) {
+                return detail.trim();
+            }
+            if (Array.isArray(body['violations'])) {
+                const msgs = body['violations']
+                    .map(v => v.message)
+                    .filter(Boolean);
+                if (msgs.length)
+                    return msgs.join(' ');
+            }
+        }
+        return this.statusMessage(err.status);
+    }
+    statusMessage(status) {
+        switch (status) {
+            case 0: return 'Network error. Check your connection.';
+            case 400: return 'Invalid request.';
+            case 401: return 'Session expired. Please sign in again.';
+            case 403: return 'Access denied.';
+            case 404: return 'Resource not found.';
+            case 409: return 'Conflict — resource already exists.';
+            case 422: return 'Validation failed.';
+            case 429: return 'Too many requests. Please wait a moment.';
+            case 500: return 'Server error. Please try again later.';
+            case 503: return 'Service unavailable. Please try again later.';
+            default: return `Unexpected error (${status}).`;
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+const CHOICES = ['light', 'dark', 'system'];
+/**
+ * A CACHE, never a source of truth.
+ *
+ * The authoritative value is `preferences.theme` in `/auth/me/settings`, which
+ * the Profile -> Preferences tab already writes. This copy exists only so the
+ * first paint of a reload is the right colour: the settings request is async,
+ * so without it every load would start light and flip. It is deliberately NOT
+ * stored via UserPreferencesService, which syncs its own bag to the server —
+ * that would give one setting two server-side homes.
+ */
+const CACHE_KEY = 'coolms_theme';
+const ACCENT_CACHE_KEY = 'coolms_accent';
+/**
+ * Six-digit hex only, checked again HERE even though the server already vets it
+ * on write. This value is substituted into a `--cms-*` custom property,
+ * and a stored setting is data from the network like any other — the write-side
+ * guard protects what the admin stores, this one protects what it renders.
+ */
+const HEX = /^#[0-9a-fA-F]{6}$/;
+function isChoice(v) {
+    return typeof v === 'string' && CHOICES.includes(v);
+}
+function isAccent(v) {
+    return typeof v === 'string' && HEX.test(v);
+}
+/**
+ * Applies the user's theme by setting `data-theme` on the document element.
+ *
+ * The stylesheet does the rest: `:root[data-theme='dark']` re-points the
+ * `--cms-*` palette and every colour in the admin arrives through those names.
+ * Nothing here knows a single colour, which is the point — a second
+ * theme is a block of tokens, not a code change.
+ *
+ * Follows the shape of UserCalendarPreferencesService and
+ * CallOverlayPreferencesService: lazy one-shot load of `/auth/me/settings`,
+ * cached for the SPA lifetime, with `update()` called by the Profile page after
+ * a save so the change lands without a refetch.
+ */
+class ThemeService {
+    api = inject(IdentityApiClient);
+    store = inject(Store);
+    _choice = signal(ThemeService.readCache(), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "_choice" }] : /* istanbul ignore next */ []));
+    _systemDark = signal(false, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "_systemDark" }] : /* istanbul ignore next */ []));
+    _userAccent = signal(ThemeService.readAccentCache(), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "_userAccent" }] : /* istanbul ignore next */ []));
+    _platformAccent = signal(null, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "_platformAccent" }] : /* istanbul ignore next */ []));
+    loadOnce$;
+    /** The user's stored choice, including `system`. */
+    choice = this._choice.asReadonly();
+    /** This user's personal override, independent of the deployment's. */
+    userAccent = this._userAccent.asReadonly();
+    /** The deployment's brand accent from the API manifest, if it set one. */
+    platformAccent = this._platformAccent.asReadonly();
+    /**
+     * The colour actually painted: personal override, else the deployment's,
+     * else null — which leaves the stylesheet's own accent in place.
+     *
+     * Three rungs and each is a real state. A user who has chosen nothing is
+     * NOT the same as one who chose the deployment's colour: clear the
+     * deployment's brand and the first user follows it, the second does not.
+     */
+    accent = computed(() => this._userAccent() ?? this._platformAccent(), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "accent" }] : /* istanbul ignore next */ []));
+    /** The choice with `system` resolved against the OS setting. */
+    resolved = computed(() => {
+        const c = this._choice();
+        return c === 'system' ? (this._systemDark() ? 'dark' : 'light') : c;
+    }, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "resolved" }] : /* istanbul ignore next */ []));
+    constructor() {
+        // `matchMedia` is guarded because the unit suite and any SSR-ish
+        // rendering path may not provide it; absent it, `system` means light.
+        const mq = typeof window !== 'undefined' && window.matchMedia
+            ? window.matchMedia('(prefers-color-scheme: dark)')
+            : null;
+        if (mq) {
+            this._systemDark.set(mq.matches);
+            // The OS can flip while the SPA is open, and `system` must follow it
+            // live rather than only at load.
+            mq.addEventListener('change', e => this._systemDark.set(e.matches));
+        }
+        effect(() => this.applyToDocument(this.resolved()));
+        effect(() => this.applyAccent(this.accent()));
+    }
+    /**
+     * One-shot load of the stored preference. Safe to call more than once and
+     * safe for anonymous users — a failure leaves the cached/system value in
+     * place rather than forcing light, so the login screen still matches the OS.
+     */
+    ensureLoaded() {
+        if (this.loadOnce$)
+            return this.loadOnce$;
+        // Read the deployment's colour FIRST and synchronously, so it is in
+        // place whether or not the settings request succeeds — an anonymous
+        // visitor on the login screen still sees the deployment's brand.
+        this.readPlatformAccent();
+        this.loadOnce$ = this.api.getSettings().pipe(map$1(all => {
+            const prefs = all['preferences'];
+            // The accent rides along on the same response — it is a field of
+            // the same section, so it costs no extra request.
+            this.setAccent(isAccent(prefs?.['accentColor']) ? prefs['accentColor'] : null);
+            return isChoice(prefs?.['theme']) ? prefs['theme'] : this._choice();
+        }), tap(choice => this.set(choice)), catchError$1(() => of(this._choice())), shareReplay$1({ bufferSize: 1, refCount: false }));
+        return this.loadOnce$;
+    }
+    /**
+     * Called by the Profile page after the Preferences tab saves, so the admin
+     * re-themes on the spot. Ignores anything that is not a known choice —
+     * the section PATCH returns the whole merged bag, not just this field.
+     */
+    update(value) {
+        if (isChoice(value))
+            this.set(value);
+    }
+    /**
+     * Companion to {@link update} for the accent field of the same save.
+     * An explicit null clears the override; anything malformed is ignored
+     * rather than applied, so a bad value can never blank the admin's accent.
+     */
+    updateAccent(value) {
+        if (null === value || '' === value)
+            this.setAccent(null);
+        else if (isAccent(value))
+            this.setAccent(value);
+    }
+    set(choice) {
+        this._choice.set(choice);
+        try {
+            localStorage.setItem(CACHE_KEY, choice);
+        }
+        catch {
+            // A blocked or full localStorage costs the pre-paint hint, nothing
+            // more — the server value still arrives and applies.
+        }
+    }
+    /**
+     * The manifest is loaded at bootstrap, well before the authenticated shell
+     * calls this, so a snapshot read is enough and no subscription is needed.
+     * A malformed value is ignored rather than applied — the container refuses
+     * to build with one, but the manifest crosses the network all the same.
+     */
+    readPlatformAccent() {
+        const value = this.store.selectSnapshot(AppConfigState.manifest)?.platformDefaults?.accentColor;
+        this._platformAccent.set(isAccent(value) ? value : null);
+    }
+    setAccent(accent) {
+        this._userAccent.set(accent);
+        try {
+            if (accent)
+                localStorage.setItem(ACCENT_CACHE_KEY, accent);
+            else
+                localStorage.removeItem(ACCENT_CACHE_KEY);
+        }
+        catch {
+            // Same as the theme cache: losing it costs the pre-paint hint only.
+        }
+    }
+    /**
+     * Writes the override onto the document element, where an inline style
+     * outranks every stylesheet rule — including the dark block — so one
+     * declaration re-points the accent in both themes.
+     *
+     * Only --cms-accent is set, not the -hover/-light/-text members of the
+     * family. Deriving those from an arbitrary user colour needs a colour model
+     * the palette does not have yet, and guessing them would produce hover
+     * states that clash with the very colour the user chose. Until then the
+     * override moves the brand fill and leaves its supporting tones alone.
+     */
+    applyAccent(accent) {
+        const root = document.documentElement;
+        if (accent && HEX.test(accent))
+            root.style.setProperty('--cms-accent', accent);
+        else
+            root.style.removeProperty('--cms-accent');
+    }
+    applyToDocument(theme) {
+        // Written for BOTH values rather than only removing the attribute for
+        // light, so the attribute is a reliable signal for anything that wants
+        // to read the active theme, and so a future `[data-theme='light']`
+        // block has something to hang on.
+        document.documentElement.setAttribute('data-theme', theme);
+    }
+    static readCache() {
+        try {
+            const raw = localStorage.getItem(CACHE_KEY);
+            return isChoice(raw) ? raw : 'system';
+        }
+        catch {
+            return 'system';
+        }
+    }
+    static readAccentCache() {
+        try {
+            const raw = localStorage.getItem(ACCENT_CACHE_KEY);
+            return isAccent(raw) ? raw : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [] });
+
+/**
+ * The platform's loading indicator: the exclamation mark from Cool!MS,
+ * drawing itself.
+ *
+ * ## Why a mark and not a spinner
+ *
+ * A spinner says "something is happening" and nothing else; every product has
+ * one and none of them are yours. The bang is already the one glyph in the
+ * wordmark that carries the brand, so a loader built from it says whose
+ * software is thinking — for free, in the place a user is already looking.
+ *
+ * ## Why one component rather than a snippet per surface
+ *
+ * It is meant for every wait long enough to notice: a dashboard assembling its
+ * cards, an editor paginating a document, an explorer listing a folder. Those
+ * are different teams' files, and a copied SVG in each is how three loaders
+ * that no longer match each other happen.
+ *
+ * ## The animation
+ *
+ * The stem wipes upward and the dot lands after it, on a loop — the shape being
+ * WRITTEN rather than spun. It is deliberately calm: a loader is background
+ * furniture, and anything with a hard beat gets irritating on the third viewing.
+ * Under `prefers-reduced-motion` it holds still and only breathes, because
+ * motion sickness is not a stylistic preference.
+ */
+class CmsLoaderComponent {
+    /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
+    label = input('', /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "label" }] : /* istanbul ignore next */ []));
+    /** Cover the positioned ancestor rather than sitting in the flow. */
+    overlay = input(false, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "overlay" }] : /* istanbul ignore next */ []));
+    /**
+     * Row layout at text scale, for a wait inside a row, a status bar or a
+     * button. Override `--cms-loader-size` to tune the mark.
+     */
+    inline = input(false, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "inline" }] : /* istanbul ignore next */ []));
+    /**
+     * A clip-path needs a document-unique id, and this component is used more
+     * than once per page — two loaders sharing an id makes the second one clip
+     * against the first one's rectangle and stop animating.
+     */
+    clipId = 'cms-loader-' + Math.random().toString(36).slice(2, 9);
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CmsLoaderComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.1.3", type: CmsLoaderComponent, isStandalone: true, selector: "cms-loader", inputs: { label: { classPropertyName: "label", publicName: "label", isSignal: true, isRequired: false, transformFunction: null }, overlay: { classPropertyName: "overlay", publicName: "overlay", isSignal: true, isRequired: false, transformFunction: null }, inline: { classPropertyName: "inline", publicName: "inline", isSignal: true, isRequired: false, transformFunction: null } }, ngImport: i0, template: `
+        <div class="cms-loader"
+             [class.cms-loader--overlay]="overlay()"
+             [class.cms-loader--inline]="inline()"
+             role="status"
+             [attr.aria-label]="label() || 'Loading'">
+            <svg class="cms-loader__mark" viewBox="0 0 24 48" aria-hidden="true">
+                <defs>
+                    <clipPath [attr.id]="clipId">
+                        <rect class="cms-loader__wipe" x="0" y="0" width="24" height="34" />
+                    </clipPath>
+                </defs>
+                <!-- Ghost beneath: the mark stays legible as a SHAPE while the
+                     wipe crosses it, so the loader never looks broken mid-cycle. -->
+                <rect class="cms-loader__ghost" x="8" y="2" width="8" height="30" rx="4" />
+                <circle class="cms-loader__ghost" cx="12" cy="42" r="4" />
+
+                <rect class="cms-loader__stem" x="8" y="2" width="8" height="30" rx="4"
+                      [attr.clip-path]="'url(#' + clipId + ')'" />
+                <circle class="cms-loader__dot" cx="12" cy="42" r="4" />
+            </svg>
+            @if (label()) {
+                <span class="cms-loader__label">{{ label() }}</span>
+            }
+        </div>
+    `, isInline: true, styles: [".cms-loader{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;padding:24px;color:var(--cms-text-muted)}.cms-loader--overlay{position:absolute;inset:0;z-index:5;background:var(--cms-surface)}.cms-loader--inline{flex-direction:row;gap:8px;padding:0}.cms-loader--inline .cms-loader__mark{width:var(--cms-loader-size, 14px)}.cms-loader__mark{width:var(--cms-loader-size, 40px);height:auto;overflow:visible}.cms-loader__ghost{fill:var(--cms-border)}.cms-loader__stem,.cms-loader__dot{fill:var(--cms-accent)}.cms-loader__wipe{animation:cms-loader-wipe 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 32px}.cms-loader__dot{animation:cms-loader-dot 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 42px}@keyframes cms-loader-wipe{0%{transform:scaleY(0)}45%,70%{transform:scaleY(1)}to{transform:scaleY(0)}}@keyframes cms-loader-dot{0%,40%{opacity:0;transform:scale(.4)}55%,70%{opacity:1;transform:scale(1)}to{opacity:0;transform:scale(.4)}}.cms-loader__label{font-size:.8125rem}@media(prefers-reduced-motion:reduce){.cms-loader__wipe{animation:none;transform:scaleY(1)}.cms-loader__dot{animation:cms-loader-breathe 2s ease-in-out infinite;opacity:1}}@keyframes cms-loader-breathe{0%,to{opacity:.35}50%{opacity:1}}\n"], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CmsLoaderComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'cms-loader', standalone: true, changeDetection: ChangeDetectionStrategy.OnPush, template: `
+        <div class="cms-loader"
+             [class.cms-loader--overlay]="overlay()"
+             [class.cms-loader--inline]="inline()"
+             role="status"
+             [attr.aria-label]="label() || 'Loading'">
+            <svg class="cms-loader__mark" viewBox="0 0 24 48" aria-hidden="true">
+                <defs>
+                    <clipPath [attr.id]="clipId">
+                        <rect class="cms-loader__wipe" x="0" y="0" width="24" height="34" />
+                    </clipPath>
+                </defs>
+                <!-- Ghost beneath: the mark stays legible as a SHAPE while the
+                     wipe crosses it, so the loader never looks broken mid-cycle. -->
+                <rect class="cms-loader__ghost" x="8" y="2" width="8" height="30" rx="4" />
+                <circle class="cms-loader__ghost" cx="12" cy="42" r="4" />
+
+                <rect class="cms-loader__stem" x="8" y="2" width="8" height="30" rx="4"
+                      [attr.clip-path]="'url(#' + clipId + ')'" />
+                <circle class="cms-loader__dot" cx="12" cy="42" r="4" />
+            </svg>
+            @if (label()) {
+                <span class="cms-loader__label">{{ label() }}</span>
+            }
+        </div>
+    `, styles: [".cms-loader{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;padding:24px;color:var(--cms-text-muted)}.cms-loader--overlay{position:absolute;inset:0;z-index:5;background:var(--cms-surface)}.cms-loader--inline{flex-direction:row;gap:8px;padding:0}.cms-loader--inline .cms-loader__mark{width:var(--cms-loader-size, 14px)}.cms-loader__mark{width:var(--cms-loader-size, 40px);height:auto;overflow:visible}.cms-loader__ghost{fill:var(--cms-border)}.cms-loader__stem,.cms-loader__dot{fill:var(--cms-accent)}.cms-loader__wipe{animation:cms-loader-wipe 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 32px}.cms-loader__dot{animation:cms-loader-dot 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 42px}@keyframes cms-loader-wipe{0%{transform:scaleY(0)}45%,70%{transform:scaleY(1)}to{transform:scaleY(0)}}@keyframes cms-loader-dot{0%,40%{opacity:0;transform:scale(.4)}55%,70%{opacity:1;transform:scale(1)}to{opacity:0;transform:scale(.4)}}.cms-loader__label{font-size:.8125rem}@media(prefers-reduced-motion:reduce){.cms-loader__wipe{animation:none;transform:scaleY(1)}.cms-loader__dot{animation:cms-loader-breathe 2s ease-in-out infinite;opacity:1}}@keyframes cms-loader-breathe{0%,to{opacity:.35}50%{opacity:1}}\n"] }]
+        }], propDecorators: { label: [{ type: i0.Input, args: [{ isSignal: true, alias: "label", required: false }] }], overlay: [{ type: i0.Input, args: [{ isSignal: true, alias: "overlay", required: false }] }], inline: [{ type: i0.Input, args: [{ isSignal: true, alias: "inline", required: false }] }] } });
+
+/**
+ * Sidebar collapse state -- two independent dimensions:
+ *
+ *  - `collapsed`: whole-sidebar icon-only rail toggle (the chevron at
+ *    the bottom of the sidebar). Per-device localStorage.
+ *  - `collapsedSections`: per-section collapse, keyed by the section
+ *    separator's node id. Used to fold a section's items under their
+ *    header so the nav doesn't endless-scroll once a tenant has lots
+ *    of modules. Per-device localStorage.
+ *  - `collapsedItems`: per-item inline-expand collapse, keyed by the
+ *    nav node's id. Mirrors `collapsedSections` but for sub-tree items
+ *    (a top-level item with children, e.g. Reports -> Process Report).
+ *    Absent id = expanded (children visible); present = collapsed.
+ *    Per-device localStorage.
+ *
+ * Storage failures (private mode, quota, disabled cookies) fall back
+ * to defaulting un-collapsed -- the toggles still work for the session,
+ * just don't persist.
+ */
+class SidebarStateService {
+    static STORAGE_KEY = 'coolms.admin.sidebar.collapsed';
+    static STORAGE_KEY_SECTIONS = 'coolms.admin.sidebar.collapsedSections';
+    static STORAGE_KEY_ITEMS = 'coolms.admin.sidebar.collapsedItems';
+    collapsed = signal(this.readPersisted(), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "collapsed" }] : /* istanbul ignore next */ []));
+    collapsedSections = signal(this.readSectionsPersisted(), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "collapsedSections" }] : /* istanbul ignore next */ []));
+    collapsedItems = signal(this.readItemsPersisted(), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "collapsedItems" }] : /* istanbul ignore next */ []));
+    toggle() {
+        const next = !this.collapsed();
+        this.collapsed.set(next);
+        this.persist(next);
+    }
+    isSectionCollapsed(id) {
+        return this.collapsedSections().has(id);
+    }
+    toggleSection(id) {
+        const next = new Set(this.collapsedSections());
+        if (next.has(id)) {
+            next.delete(id);
+        }
+        else {
+            next.add(id);
+        }
+        this.collapsedSections.set(next);
+        this.persistSections(next);
+    }
+    /**
+     * Force a section to be expanded. Used when navigation lands on
+     * a route inside a manually-collapsed section -- it would be
+     * confusing to leave the active item hidden. The user can
+     * collapse the section again afterwards.
+     */
+    ensureExpanded(id) {
+        if (!this.collapsedSections().has(id))
+            return;
+        const next = new Set(this.collapsedSections());
+        next.delete(id);
+        this.collapsedSections.set(next);
+        this.persistSections(next);
+    }
+    // --- Per-item inline-expand (sub-tree items, e.g. a section's children) --
+    isItemCollapsed(id) {
+        return this.collapsedItems().has(id);
+    }
+    toggleItem(id) {
+        const next = new Set(this.collapsedItems());
+        if (next.has(id)) {
+            next.delete(id);
+        }
+        else {
+            next.add(id);
+        }
+        this.collapsedItems.set(next);
+        this.persistItems(next);
+    }
+    readPersisted() {
+        try {
+            return localStorage.getItem(SidebarStateService.STORAGE_KEY) === 'true';
+        }
+        catch {
+            return false;
+        }
+    }
+    persist(value) {
+        try {
+            localStorage.setItem(SidebarStateService.STORAGE_KEY, String(value));
+        }
+        catch {
+            // Non-persistence acceptable; toggle still works in-session.
+        }
+    }
+    readSectionsPersisted() {
+        try {
+            const raw = localStorage.getItem(SidebarStateService.STORAGE_KEY_SECTIONS);
+            if (raw === null)
+                return new Set();
+            const parsed = JSON.parse(raw);
+            if (!Array.isArray(parsed))
+                return new Set();
+            return new Set(parsed.filter((v) => typeof v === 'string'));
+        }
+        catch {
+            return new Set();
+        }
+    }
+    persistSections(value) {
+        try {
+            localStorage.setItem(SidebarStateService.STORAGE_KEY_SECTIONS, JSON.stringify(Array.from(value)));
+        }
+        catch {
+            // Non-persistence acceptable; toggle still works in-session.
+        }
+    }
+    readItemsPersisted() {
+        try {
+            const raw = localStorage.getItem(SidebarStateService.STORAGE_KEY_ITEMS);
+            if (raw === null)
+                return new Set();
+            const parsed = JSON.parse(raw);
+            if (!Array.isArray(parsed))
+                return new Set();
+            return new Set(parsed.filter((v) => typeof v === 'string'));
+        }
+        catch {
+            return new Set();
+        }
+    }
+    persistItems(value) {
+        try {
+            localStorage.setItem(SidebarStateService.STORAGE_KEY_ITEMS, JSON.stringify(Array.from(value)));
+        }
+        catch {
+            // Non-persistence acceptable; toggle still works in-session.
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * HTTP client for the Phase 2a `/api/entity-search` endpoint.
+ * Returns a stream of search results for the given entity FQCN.
+ * Permission filtering happens at the backend resolver layer —
+ * this service is a thin RPC.
+ */
+class EntitySearchService {
+    http = inject(HttpClient);
+    /**
+     * @param entityType  Fully-qualified PHP class name of the entity
+     *                    being searched (e.g. the backend's User entity).
+     * @param query       Free-text search input. Empty string is
+     *                    valid — the backend returns the default
+     *                    listing for that entity type.
+     * @param limit       Max rows to return; clamped server-side to
+     *                    [1, 100].
+     */
+    search(entityType, query, limit = 20) {
+        const params = new HttpParams()
+            .set('type', entityType)
+            .set('q', query)
+            .set('limit', String(limit));
+        return this.http.get('/api/entity-search', { params });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * Loads, caches, and drives admin NaviGraph trees.
+ *
+ * Usage:
+ *   naviGraphService.loadAdminNav(url).subscribe();
+ *   const items = naviGraphService.adminNav();         // signal<NaviGraphNode[]>
+ *   naviGraphService.handleClick(node);
+ */
+class NaviGraphService {
+    http = inject(HttpClient);
+    router = inject(Router);
+    store = inject(Store);
+    errors = inject(ErrorHandlerService);
+    /** Resolved root nodes for navi.admin (sidebar). */
+    adminNav = signal([], /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "adminNav" }] : /* istanbul ignore next */ []));
+    /** Resolved root nodes for navi.admin.topbar. */
+    topbarNav = signal([], /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "topbarNav" }] : /* istanbul ignore next */ []));
+    cache = new Map();
+    // -------------------------------------------------------------------------
+    loadAdminNav(url) {
+        return this.loadTree(url).pipe(map(tree => { this.adminNav.set(tree); return tree; }));
+    }
+    loadTopbarNav(url) {
+        return this.loadTree(url).pipe(map(tree => { this.topbarNav.set(tree); return tree; }));
+    }
+    // -------------------------------------------------------------------------
+    /**
+     * Handle a nav-node click.
+     *
+     * Routing logic based on meta.target:
+     *   'action.logout'  — dispatch Logout
+     *   '_blank'         — window.open (uses node.path as href)
+     *   default          — router.navigate with meta.routerLink or node.path
+     */
+    handleClick(node) {
+        const target = node.meta.target;
+        if (target === 'action.logout') {
+            this.store.dispatch(new Logout()).subscribe(() => {
+                void this.router.navigate(['/login']);
+            });
+            return;
+        }
+        if (target === '_blank') {
+            window.open(node.meta.routerLink ?? node.path, '_blank', 'noopener');
+            return;
+        }
+        const link = node.meta.routerLink ?? node.path;
+        void this.router.navigate([link]);
+    }
+    // -------------------------------------------------------------------------
+    /**
+     * Evaluate `showWhen` meta condition against a record.
+     * Nodes with no `showWhen` are always visible.
+     * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
+     */
+    isVisible(node, record) {
+        const showWhen = node.meta['showWhen'];
+        if (!showWhen)
+            return true;
+        return this.evalCondition(showWhen, record);
+    }
+    /**
+     * Standalone `showWhen` evaluator for callers that don't have a
+     * full `NaviGraphNode` (e.g. a grid's row context menu — a
+     * `rowAction.showWhen` predicate is evaluated against the row's
+     * own projection). `null`/`undefined` predicates default to
+     * visible, mirroring `isVisible`'s "no rule = always shown"
+     * semantics.
+     */
+    matchesShowWhen(showWhen, record) {
+        if (!showWhen)
+            return true;
+        return this.evalCondition(showWhen, record);
+    }
+    evalCondition(cond, record) {
+        if ('and' in cond) {
+            return cond['and']
+                .every(c => this.evalCondition(c, record));
+        }
+        if ('or' in cond) {
+            return cond['or']
+                .some(c => this.evalCondition(c, record));
+        }
+        // Strict missing-field semantics. A leaf predicate
+        // referencing a field absent from the record evaluates to
+        // false (fail-loud) instead of the prior op-dependent lax
+        // behavior that returned true for ne/nin/unknown ops. Aligns
+        // with CSS attribute selectors / JSONPath / React conditional
+        // rendering conventions.
+        const field = cond['field'];
+        if (!(field in record))
+            return false;
+        const val = record[field];
+        switch (cond['op']) {
+            case 'eq': return val === cond['value'];
+            case 'ne': return val !== cond['value'];
+            case 'in': return Array.isArray(cond['value']) && cond['value'].includes(val);
+            case 'nin': return Array.isArray(cond['value']) && !cond['value'].includes(val);
+            // Prefix match for strings — primary use case is filtering
+            // actions by MIME-type major (e.g., "image/" matches all
+            // image MIMEs without enumerating each subtype).
+            case 'startsWith':
+                return typeof val === 'string'
+                    && typeof cond['value'] === 'string'
+                    && val.startsWith(cond['value']);
+            // Strict: unknown / typo op (e.g. 'equals' instead of 'eq')
+            // never matches.
+            default: return false;
+        }
+    }
+    /**
+     * Fetch a graph endpoint and return a nested tree.
+     * Handles both compact JSON-LD IRIs (`member`) and
+     * the legacy Hydra key (`hydra:member`).
+     * Results are cached by URL for the lifetime of the service instance.
+     */
+    loadTree(url) {
+        if (this.cache.has(url)) {
+            return of(this.cache.get(url));
+        }
+        return this.http.get(url, {
+            headers: { Accept: 'application/ld+json' },
+        }).pipe(map(r => {
+            const raw = r['member'] ?? r['hydra:member'] ?? [];
+            const flat = Array.isArray(raw) ? raw : [];
+            const tree = this.buildTree(flat);
+            this.cache.set(url, tree);
+            return tree;
+        }), catchError(err => {
+            console.error('[NaviGraph] loadTree failed for', url, this.errors.humanize(err));
+            return of([]);
+        }));
+    }
+    /**
+     * Build a nested tree from a flat array of nodes.
+     * Nodes are sorted by sortOrder at each level.
+     */
+    buildTree(flat) {
+        if (!flat.length) {
+            return [];
+        }
+        const map = new Map(flat.map(n => [n.id, { ...n, children: [] }]));
+        const roots = [];
+        for (const node of map.values()) {
+            if (node.parentId && map.has(node.parentId)) {
+                map.get(node.parentId).children.push(node);
+            }
+            else {
+                roots.push(node);
+            }
+        }
+        const sort = (nodes) => {
+            nodes.sort((a, b) => a.sortOrder - b.sortOrder);
+            nodes.forEach(n => n.children?.length && sort(n.children));
+        };
+        sort(roots);
+        return roots;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+// --- NaviGraph API types ------------------------------------------------------
+// Mirror the PHP NaviGraphNodeResource DTO exactly. No `any` allowed.
+
+/**
+ * Registry mapping string keys to Angular component classes.
+ *
+ * Backed by a static Map so components registered at module load time
+ * (e.g. in app.config.ts) are visible to all injected instances.
+ *
+ * Usage — static (app.config.ts / bootstrap time):
+ *   ComponentRegistry.register('MediaLibraryPage', MediaLibraryPage);
+ *
+ * Usage — injected (SlotComponent / runtime):
+ *   private readonly registry = inject(ComponentRegistry);
+ *   const cls = this.registry.get('MediaLibraryPage');
+ */
+class ComponentRegistry {
+    static map = new Map();
+    // -- Static API (bootstrap / app.config.ts) -------------------------------
+    static register(key, component) {
+        ComponentRegistry.map.set(key, component);
+    }
+    static get(key) {
+        return ComponentRegistry.map.get(key);
+    }
+    static has(key) {
+        return ComponentRegistry.map.has(key);
+    }
+    static keys() {
+        return Array.from(ComponentRegistry.map.keys());
+    }
+    // -- Instance API (injectable) ---------------------------------------------
+    register(key, component) {
+        ComponentRegistry.register(key, component);
+    }
+    get(key) {
+        return ComponentRegistry.get(key) ?? null;
+    }
+    has(key) {
+        return ComponentRegistry.has(key);
+    }
+    keys() {
+        return ComponentRegistry.keys();
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * Optional by design: an application assembled without a Sections module binds
+ * nothing and simply sends no `X-CoolMS-Section` header, which is exactly what
+ * a single-site install wants.
+ */
+const CURRENT_SECTION = new InjectionToken('coolms.current-section');
+
+/**
+ * Phase H7 -- admin Site Selector.
+ *
+ * Stamps `X-CoolMS-Section: <slug>` on outgoing `/api/v1/*` requests when
+ * the admin has picked a section from the Site Selector dropdown. The backend
+ * honours it for AUTHENTICATED requests only -- anonymous traffic cannot pivot
+ * the active section.
+ *
+ * What the header actually reaches, counted rather than intended: exactly two
+ * readers act on it, `CreatePageProcessor` and `CreateCollectionProcessor`,
+ * each choosing WHICH SITE a newly created page or collection lands in -- and,
+ * for a page, that section's default locale and slug-naming policy. Nothing
+ * else is scoped by it. Media spaces list every active section regardless, and
+ * every other reader of `_coolms_section` sits on the public SSR surface,
+ * which resolves from host+path and never sees this header.
+ *
+ * This block used to say the backend "scopes site-specific API providers
+ * (pages, media spaces, etc.)". That described where was heading --
+ * H4/H5, multisite Document and Media, never landed -- not what it does. Left
+ * recorded because a docstring naming an intended destination reads exactly
+ * like one naming a shipped feature, and this one misdescribed the control for
+ * three months.
+ *
+ * Skipped:
+ *  - non-API URLs (no section context needed for SSR/static)
+ *  - `/auth/*` endpoints (login/refresh are pre-session; the header would
+ *    be ignored by the backend anyway, but skipping keeps wire traffic clean)
+ *  - requests that already carry the header (programmatic overrides win)
+ */
+const sectionInterceptor = (req, next) => {
+    if (!shouldStamp(req.url)) {
+        return next(req);
+    }
+    if (req.headers.has('X-CoolMS-Section')) {
+        return next(req);
+    }
+    // Optional: no Sections module installed means no section to stamp.
+    const slug = inject(CURRENT_SECTION, { optional: true })?.currentSlug() ?? null;
+    if (!slug)
+        return next(req);
+    return next(req.clone({ setHeaders: { 'X-CoolMS-Section': slug } }));
+};
+function shouldStamp(url) {
+    // Strip protocol/host so absolute and relative URLs are treated alike.
+    const path = url.replace(/^https?:\/\/[^/]+/, '');
+    if (!path.startsWith('/api/v1/'))
+        return false;
+    if (path.startsWith('/api/v1/auth/'))
+        return false;
+    return true;
+}
+
+/**
+ * `@coolms/core-angular` -- the CoolMS client runtime for Angular.
+ *
+ * Everything a CoolMS front-end needs before it has any UI: the session and its
+ * refresh/cross-tab machinery, the boot manifest and app config, theme and user
+ * preferences, error handling, the HTTP interceptors, and the wire types the
+ * backend's form-render and navi-graph endpoints emit.
+ *
+ * It is deliberately NOT "the admin's core": nothing here is admin chrome. It is
+ * also not a general Angular library -- every endpoint it speaks is a CoolMS
+ * one, so it is worthless without a CoolMS backend. The layering is
+ *
+ *     @coolms/core-angular  ->  @coolms/admin-ui-angular  ->  @coolms/x-ui-angular
+ *
+ * and the reason it must be a package rather than app code is federation: the
+ * kit and every remote need this at runtime as ONE `singleton`, and a remote
+ * cannot import from its host.
+ *
+ * This barrel is the whole public surface. Nothing outside `core/` may deep-link
+ * past it -- eslint enforces that, so this file is what "core exports" MEANS. A
+ * symbol not listed here is internal, and adding one is a deliberate act.
+ *
+ * The single component (`LoginComponent`) is here on purpose: core owns the auth
+ * lifecycle, so it ships a working sign-in rather than leaving every consumer to
+ * rebuild one against endpoints only core knows.
+ */
+// -- Wire types + the API client core owns ------------------------------------
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, CrossTabAuthSyncService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, authGuard, authInterceptor, loginPageGuard, resolvePattern, sectionInterceptor };
+//# sourceMappingURL=coolms-core-angular.mjs.map