@coolms/core-angular 2.0.0-alpha.2

package/types/coolms-core-angular.d.ts

@@ -0,0 +1,1415 @@
+import * as rxjs from 'rxjs';
+import { Observable } from 'rxjs';
+import * as i0 from '@angular/core';
+import { Type, InjectionToken } from '@angular/core';
+import { StateContext } from '@ngxs/store';
+import { CanActivateFn } from '@angular/router';
+import { HttpContextToken, HttpInterceptorFn } from '@angular/common/http';
+
+interface AuthApiManifest {
+    readonly login: string;
+    readonly logout: string;
+    readonly refresh: string;
+    readonly register: string;
+    readonly me: string;
+    readonly usersApi?: string;
+    readonly groupsApi?: string;
+    readonly preferencesUrl?: string;
+    readonly groupFormId?: string | null;
+    readonly userFormId?: string | null;
+}
+interface SectionApiManifest {
+    readonly list: string;
+    readonly create: string;
+    readonly item: string;
+    readonly update: string;
+    readonly delete: string;
+    readonly formId?: string;
+    readonly apply?: string;
+}
+interface NaviApiManifest {
+    readonly treesList: string;
+    readonly treesCreate: string;
+    readonly treesItem: string;
+    readonly nodesList: string;
+    readonly nodesCreate: string;
+    readonly nodesItem: string;
+    readonly nodesReorder: string;
+    readonly nodesMove: string;
+    readonly nodesByTree: string;
+    readonly treesFormId?: string;
+    readonly nodesFormId?: string;
+    readonly adminNavGraph?: string;
+    readonly topbarNavGraph?: string;
+    readonly toolbarVfsGraph?: string;
+    readonly graphBySlug?: string;
+}
+interface ContentApiManifest {
+    readonly variantPublishUrl: string;
+    readonly pageSpacesUrl?: string;
+    readonly pageTypesUrl?: string;
+}
+interface DataGridApiManifest {
+    readonly configBase: string;
+}
+interface TerminalApiManifest {
+    readonly executeUrl: string;
+    readonly completeUrl: string;
+}
+interface MediaApiManifest {
+    readonly listUrl: string;
+    readonly itemUrl: string;
+    readonly permissionsUrl: string;
+    readonly regenerateUrl: string;
+    readonly resizeUrl: string;
+    readonly collectionsUrl: string;
+    readonly collectionsCreateUrl: string;
+    readonly collectionPermissionsUrl: string;
+    readonly moveUrl?: string;
+    readonly spacesUrl?: string;
+}
+interface VfsApiManifest {
+    readonly fileContentUrl: string;
+    readonly binaryWriteUrl: string;
+}
+/**
+ * Document module URL section. Today the only entry is `spacesUrl`;
+ * the struct is reserved so future Document-module URLs can land
+ * here without a new manifest section.
+ */
+interface DocumentApiManifest {
+    readonly spacesUrl?: string;
+}
+interface DynamicEntityApiManifest {
+    readonly typesUrl: string;
+    readonly fieldDefinitionsUrl: string;
+    readonly fieldDefinitionUrl: string;
+    readonly fieldDefinitionsReorderUrl: string;
+    readonly toolbarNaviGraphUrl: string;
+    readonly constraintsUrl: string;
+    readonly recordsUrl: string;
+    readonly recordUrl: string;
+    readonly recordsByTypeUrl: string;
+    readonly typeUrl: string;
+    readonly typesCreateUrl: string;
+    readonly formTypesUrl?: string;
+    readonly typeByAliasUrl?: string;
+}
+interface DomainExplorerApiManifest {
+    readonly entitiesUrl: string;
+    readonly entityUrl: string;
+    readonly toolbarNaviGraphUrl: string;
+    readonly domainExplorerToolbarUrl: string;
+    readonly entityFieldsDataGridUrl?: string;
+    readonly typeFieldsDataGridUrl?: string;
+}
+interface IdentityApiManifest {
+    readonly usersUrl: string;
+    readonly userUrl: string;
+    readonly groupsUrl: string;
+    readonly groupUrl: string;
+    readonly meUrl: string;
+    readonly assignGroupsUrl: string;
+    readonly avatarUploadUrl: string;
+    readonly settingsUrl: string;
+    readonly settingsSectionsUrl: string;
+    readonly settingsSectionUrl: string;
+    readonly colorUrl: string;
+    readonly rolesUrl?: string;
+}
+/**
+ * Editor sub-manifest emitted by the backend's Editor module. The
+ * frontend bridge (`@coolms/editor-angular`) consumes this through the
+ * `EDITOR_MANIFEST_PROVIDER` token.
+ *
+ * schemaVersion 2 (sub-prompt D) replaced the editorId axis with a profile
+ * axis: `manifest.editor.profiles[name]` returns a slice with the
+ * pre-resolved contributor list AND the storage allow-list a sanitizer
+ * enforces on save.
+ */
+interface EditorApiManifestEntry {
+    readonly id: string;
+    readonly group: string;
+    readonly priority: number;
+    readonly icon: string;
+    readonly label: string;
+    readonly actionType: string;
+    readonly actionParams: Readonly<Record<string, unknown>>;
+    readonly extensions: ReadonlyArray<string>;
+    readonly stateKeys: ReadonlyArray<string>;
+    readonly shortcut?: string | null;
+    readonly slashable?: boolean;
+    readonly keywords?: ReadonlyArray<string>;
+}
+interface EditorApiManifestProfile {
+    readonly contributors: ReadonlyArray<EditorApiManifestEntry>;
+    readonly allowedWidgets: ReadonlyArray<string>;
+}
+interface EditorApiManifest {
+    readonly schemaVersion: number;
+    readonly profiles: Readonly<Record<string, EditorApiManifestProfile>>;
+}
+/**
+ * Viewer manifest emitted by the backend's Document module.
+ * Each viewer declares the MIME types / extensions it handles, the
+ * Angular component selector to dispatch into, and one config blob per
+ * profile. Profile config is open-ended — every viewer interprets the
+ * keys it understands and ignores the rest.
+ */
+interface ViewerProfileApiManifest {
+    readonly key: string;
+    readonly config: Readonly<Record<string, unknown>>;
+}
+interface ViewerDefinitionApiManifest {
+    readonly key: string;
+    readonly mimeTypes: ReadonlyArray<string>;
+    readonly extensions: ReadonlyArray<string>;
+    readonly component: string;
+    readonly profiles: Readonly<Record<string, ViewerProfileApiManifest>>;
+}
+interface ViewerApiManifest {
+    readonly schemaVersion: number;
+    readonly viewers: Readonly<Record<string, ViewerDefinitionApiManifest>>;
+}
+/**
+ * Platform-wide default user-facing settings. The
+ * fallback floor for anonymous / pre-login rendering: timezone, date /
+ * time format (CLDR tokens) and week start come from the deployment's
+ * config, not an FE-hardcoded Western default. `locale` is the default
+ * locale, previously absent from the manifest.
+ */
+interface PlatformDefaults {
+    readonly locale: string;
+    readonly timezone: string;
+    readonly dateFormat: string;
+    readonly timeFormat: '12h' | '24h';
+    readonly weekStart: 'monday' | 'sunday';
+    /**
+     * Deployment brand accent as `#rrggbb`, or null/absent to keep the
+     * stylesheet's own. Sits BELOW a user's personal accentColor.
+     */
+    readonly accentColor?: string | null;
+}
+interface ApiManifest {
+    readonly apiBase: string;
+    readonly configBase?: string;
+    readonly auth?: AuthApiManifest;
+    readonly identity?: IdentityApiManifest;
+    readonly sections?: SectionApiManifest;
+    readonly navi?: NaviApiManifest;
+    readonly content?: ContentApiManifest;
+    readonly dataGrid?: DataGridApiManifest;
+    readonly terminal?: TerminalApiManifest;
+    readonly media?: MediaApiManifest;
+    readonly document?: DocumentApiManifest;
+    readonly vfs?: VfsApiManifest;
+    readonly dynamicEntity?: DynamicEntityApiManifest;
+    readonly domainExplorer?: DomainExplorerApiManifest;
+    readonly editor?: EditorApiManifest;
+    readonly viewers?: ViewerApiManifest;
+    readonly supportedLocales?: Array<{
+        code: string;
+        label: string;
+    }>;
+    readonly platformDefaults?: PlatformDefaults;
+}
+interface ThemeConfigResponse {
+    readonly slug?: string | null;
+    readonly feStack?: string | null;
+    readonly spaFramework?: string | null;
+    readonly assetsUrl?: string | null;
+    readonly manifest: ApiManifest;
+}
+/**
+ * Replaces {param} tokens in a URL pattern with encoded values.
+ *
+ * @example
+ *   resolvePattern(manifest.sections!.item, { id: '123' })
+ *   // -> '/api/v1/sections/123'
+ */
+declare function resolvePattern(pattern: string, params: Record<string, string>): string;
+
+/**
+ * Shapes the user-preference store persists.
+ *
+ * {@link UserPreferencesService} owns ONE store (`coolms_ui_prefs`) with
+ * several namespaces -- grids, panels, page state, nav, terminal -- so these
+ * shapes are core's and the surfaces that read them are consumers. The datagrid
+ * is simply the namespace with the richest shape.
+ *
+ * `shared/datagrid/datagrid-preferences.types` re-exports them, so the kit
+ * keeps its own local path and nothing that reads a grid preference had to
+ * change.
+ */
+interface DataGridPreference {
+    columns?: string[];
+    columnWidths?: Record<string, number>;
+}
+type DataGridPreferences = Record<string, DataGridPreference>;
+
+/**
+ * Session and current-user DTOs.
+ *
+ * They live in core because core runs the session: the NGXS auth state, the
+ * refresh coordinator and the cross-tab sync are all here, and all three name
+ * these shapes. They used to be declared inside the admin's `ApiService`, which
+ * meant core imported a 2410-line client to read two interfaces.
+ *
+ * `ApiService` re-exports them from its own module, so the feature files that
+ * import `UserDto` from there are untouched.
+ */
+interface TokenResponse {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: string;
+    user?: UserDto;
+}
+interface UserDto {
+    id: string;
+    email: string;
+    identifier?: string;
+    roles: string[];
+    uiPrefs?: DataGridPreferences;
+    avatarUrl?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    fullName?: string;
+}
+
+type FieldType = 'text' | 'email' | 'password' | 'number' | 'textarea' | 'select' | 'toggle' | 'date' | 'time' | 'hidden' | 'relation' | 'subform' | 'token-pattern' | 'richtext' | 'localizedText' | 'localizedTextarea' | 'optionsEditor' | 'intlPhone' | 'color';
+type DataSourceType = 'static' | 'enum' | 'api' | 'repo';
+type VisibilityOperator = 'eq' | 'ne' | 'in' | 'notIn' | 'empty' | 'notEmpty';
+interface VisibilityCondition {
+    readonly field: string;
+    readonly operator: VisibilityOperator;
+    readonly value?: unknown;
+}
+type DataSourceWidget = 'select' | 'select-search' | 'select-tree' | 'token-input' | 'media-picker';
+type DataSourceLoading = 'eager' | 'lazy';
+interface DataSourceOption {
+    readonly value: unknown;
+    readonly label: string;
+    readonly parentId?: string | null;
+}
+interface DataSourceDefinition {
+    readonly type: DataSourceType;
+    readonly bindValue: string;
+    readonly bindLabel: string;
+    readonly multiple: boolean;
+    readonly maxItems?: number;
+    readonly options?: ReadonlyArray<DataSourceOption>;
+    readonly url?: string;
+    readonly widget: DataSourceWidget;
+    readonly loading: DataSourceLoading;
+    /** Free-form widget-specific configuration block populated from YAML
+     *  `dataSource.widgetOptions`. Used by media-picker for bindTarget /
+     *  display / accept / recentlyUsed / hoverPreview, and reserved for
+     *  future custom widgets. Kept separate from `options` (which is the
+     *  static-option list) to avoid key collisions. */
+    readonly widgetOptions?: Readonly<Record<string, unknown>>;
+}
+interface ValidatorDefinition {
+    readonly type: string;
+    readonly value?: unknown;
+    readonly message?: string;
+}
+interface RelationDefinition {
+    readonly cardinality: 'one' | 'many';
+    readonly maxItems?: number;
+    readonly targetFormId?: string;
+    readonly dataSource?: DataSourceDefinition;
+}
+interface SubFormDefinition {
+    readonly formId: string;
+    readonly relation: 'one' | 'many';
+    readonly maxItems?: number;
+}
+interface FieldSecurityPolicy {
+    readonly read: ReadonlyArray<string>;
+    readonly write: ReadonlyArray<string>;
+}
+interface FieldItem {
+    readonly alias: string;
+    readonly type: FieldType;
+    readonly label: string;
+    readonly placeholder?: string;
+    readonly hint?: string;
+    readonly required: boolean;
+    readonly readonly: boolean;
+    readonly locked: boolean;
+    readonly private: boolean;
+    readonly validators: ReadonlyArray<ValidatorDefinition>;
+    readonly dataSource?: DataSourceDefinition;
+    readonly relation?: RelationDefinition;
+    readonly subForm?: SubFormDefinition;
+    readonly separators?: ReadonlyArray<string>;
+    readonly security?: FieldSecurityPolicy | null;
+    readonly autocomplete?: string;
+}
+interface LayoutNode {
+    readonly type: 'group' | 'grid' | 'column' | 'tabs' | 'tab' | (string & {});
+    readonly name?: string;
+    readonly description?: string;
+    readonly compact?: boolean;
+    readonly width?: number;
+    readonly children?: ReadonlyArray<LayoutNode>;
+    readonly showWhen?: VisibilityCondition;
+}
+type FormActionType = 'submit' | 'button' | 'reset';
+type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
+/** Terminal form button (Submit / Cancel / …) — mirrors PHP FormAction.
+ *  Resolved by the backend (declared `formOptions.actions`, else lifted from
+ *  legacy submit fields, else a default Submit). `label` is already translated. */
+interface FormAction {
+    readonly type: FormActionType;
+    readonly label: string;
+    readonly name: string;
+    readonly variant: FormActionVariant;
+}
+interface FormRenderDefinition {
+    readonly id: string;
+    readonly context: 'create' | 'edit';
+    readonly layout: ReadonlyArray<LayoutNode>;
+    readonly items: ReadonlyArray<FieldItem>;
+    readonly actions: ReadonlyArray<FormAction>;
+    readonly action?: string;
+}
+
+/**
+ * The collection envelope API Platform wraps every list response in.
+ *
+ * It belongs to the client runtime rather than to any one screen: it is the
+ * shape of EVERY paginated response the CoolMS API emits, so a feature that
+ * lists anything needs it, and a UI kit that lists anything must not have to
+ * reach into the application to describe it.
+ *
+ * **The keys arrive WITHOUT the `hydra:` prefix.** The vocabulary is mapped in
+ * `@context`, so the wire carries `member` and `totalItems` rather than
+ * `hydra:member` and `hydra:totalItems`.
+ *
+ *  Three document services in the admin declare their own version of this
+ * interface accepting BOTH spellings, every field optional. That is a
+ * different claim about the same wire, not a duplicate of this one, and
+ * whichever is wrong is wrong silently -- an optional `member` makes every
+ * call site handle an absence that may never happen, and a required one
+ * crashes if it does. Settle it by calling the endpoint, not by merging the
+ * types.
+ */
+interface HydraView {
+    '@id': string;
+    'next'?: string;
+    'previous'?: string;
+    'last'?: string;
+}
+interface HydraCollection<T> {
+    'member': T[];
+    'totalItems': number;
+    'view'?: HydraView;
+}
+
+/**
+ * The identity endpoints core owns: the session lifecycle, plus the settings
+ * read at boot.
+ *
+ * Carved out of the admin's `ApiService` -- 2410 lines, 118 methods and 89 DTOs
+ * spanning calendars, documents, calls, VFS and the rest. Core cannot depend on
+ * that and still ship beneath the UI kit: it would drag every module's wire
+ * types down with it. Core called exactly FOUR of those methods.
+ *
+ * `logout` is the one addition, and not for symmetry: the auth lifecycle lives
+ * here (state, refresh coordinator, cross-tab sync), so a core package that
+ * could sign in but not out would be incomplete.
+ *
+ * `ApiService` keeps its own identical signatures and delegates here, so none
+ * of the 94 feature files calling it changed.
+ */
+declare class IdentityApiClient {
+    private readonly http;
+    private readonly store;
+    /** URLs come from the boot manifest, which core already owns. */
+    private get manifest();
+    login(identifier: string, password: string): Observable<TokenResponse>;
+    refresh(refreshToken: string): Observable<TokenResponse>;
+    logout(): Observable<void>;
+    me(): Observable<UserDto>;
+    getSettings(): Observable<Record<string, Record<string, unknown>>>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<IdentityApiClient>;
+}
+
+/**
+ * Response of `POST /centrifugo/connection-token`: the JWT the realtime SDK
+ * opens its socket with, and what it needs to refresh before expiry.
+ */
+interface CentrifugoConnectionTokenDto {
+    token: string;
+    expiresAt: number;
+    ttl: number;
+    wsUrl: string;
+}
+/**
+ * Response of `POST /centrifugo/subscription-token`: a per-channel JWT. The
+ * SDK asks for one before subscribing to a private namespace, so this is
+ * fetched per subscription rather than once per connection.
+ */
+interface CentrifugoSubscriptionTokenDto {
+    channel: string;
+    token: string;
+    expiresAt: number;
+    ttl: number;
+}
+/**
+ * The two realtime endpoints, carved out for the same reason the identity ones
+ * were: the UI kit's realtime client needed exactly these two of `ApiService`'s
+ * 117 methods, and depending on the whole thing would have pulled the entire
+ * application's wire vocabulary underneath the kit.
+ *
+ * They belong in core rather than in the kit because both answers are derived
+ * from things core already owns -- the boot manifest for the URL, and the auth
+ * interceptor for the bearer token that authorises the request. A token is
+ * session state, not a widget.
+ *
+ * `ApiService` keeps its identical signatures and delegates here, so nothing
+ * calling it had to change.
+ */
+declare class RealtimeTokenClient {
+    private readonly http;
+    private readonly store;
+    private get manifest();
+    connectionToken(): Observable<CentrifugoConnectionTokenDto>;
+    subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<RealtimeTokenClient>;
+}
+
+declare class Login {
+    identifier: string;
+    password: string;
+    static readonly type = "[Auth] Login";
+    constructor(identifier: string, password: string);
+}
+declare class Logout {
+    static readonly type = "[Auth] Logout";
+}
+declare class RestoreSession {
+    static readonly type = "[Auth] Restore Session";
+}
+declare class SetTokens {
+    readonly response: TokenResponse;
+    static readonly type = "[Auth] Set Tokens";
+    constructor(response: TokenResponse);
+}
+/** Merge a partial update into the currently-stored user (e.g. after avatar change). */
+declare class PatchCurrentUser {
+    readonly patch: Partial<UserDto>;
+    static readonly type = "[Auth] Patch Current User";
+    constructor(patch: Partial<UserDto>);
+}
+
+interface AuthStateModel {
+    accessToken: string | null;
+    refreshToken: string | null;
+    expiresAt: string | null;
+    user: UserDto | null;
+}
+declare class AuthState {
+    private readonly api;
+    private readonly prefs;
+    login(ctx: StateContext<AuthStateModel>, { identifier, password }: Login): rxjs.Observable<UserDto | null>;
+    logout(ctx: StateContext<AuthStateModel>): void;
+    restore(ctx: StateContext<AuthStateModel>): void;
+    setTokens(ctx: StateContext<AuthStateModel>, { response }: SetTokens): void;
+    patchCurrentUser(ctx: StateContext<AuthStateModel>, { patch }: PatchCurrentUser): void;
+    static isAuthenticated(state: AuthStateModel): boolean;
+    static accessToken(state: AuthStateModel): string | null;
+    static refreshToken(state: AuthStateModel): string | null;
+    /**
+     * Sub-phase Y -- expose the access-token expiry timestamp so
+     * preemptive-refresh callers (e.g., Centrifuge getToken
+     * callbacks) can decide whether to rotate before issuing the
+     * next protected request, instead of relying on the
+     * interceptor's reactive 401-retry path.
+     */
+    static expiresAt(state: AuthStateModel): string | null;
+    static currentUser(state: AuthStateModel): UserDto | null;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AuthState>;
+}
+
+/**
+ * Protects routes that require authentication.
+ *
+ * The guard is intentionally ASYNC: it waits for AppInitService.ready$ before
+ * evaluating auth state.  Without this, Angular's router can evaluate
+ * isAuthenticated while APP_INITIALIZER is still in-flight — RestoreSession
+ * will have placed a non-null (but expired) token in state, causing the guard
+ * to pass even though the subsequent config/refresh requests will fail and
+ * dispatch Logout.  Waiting for ready$ guarantees the auth state is settled.
+ */
+declare const authGuard: CanActivateFn;
+
+/**
+ * Guards the `/login` route -- redirects already-authenticated
+ * callers to admin home so a stale tab parked on `/login` cannot
+ * remain mounted while another tab is logged in. When Tab A logs
+ * in fresh, Tab B's `RestoreSession` (driven by APP_INITIALIZER)
+ * reads the new token from shared `localStorage` and populates
+ * `AuthState`; this guard then sees `isAuthenticated === true`
+ * and routes Tab B to `/`.
+ *
+ * Same `ready$` wait as `authGuard` -- ensures `RestoreSession`
+ * has run before the snapshot is read; otherwise a fresh F5 on
+ * `/login` with a valid stored session would briefly evaluate
+ * as anonymous, allow `/login`, and only then have the token
+ * populated.
+ */
+declare const loginPageGuard: CanActivateFn;
+
+declare const BYPASS_AUTH: HttpContextToken<boolean>;
+declare const authInterceptor: HttpInterceptorFn;
+
+/**
+ * Two-layer refresh coordinator: an intra-tab `shareReplay(1)`
+ * mutex dedupes concurrent callers within one tab, and a
+ * cross-tab `navigator.locks` wrapper ensures only one tab in
+ * the browser issues the actual `POST /auth/refresh` at a time.
+ *
+ * Without the cross-tab layer, two tabs racing the same expired
+ * refresh-token both POST `/auth/refresh`; the backend's
+ * `isUsed` replay branch revokes every token for the user on
+ * the second arrival and the operator is kicked to /login.
+ *
+ * The Web Lock body re-reads the current access-token expiry from
+ * `AuthState` before issuing the HTTP call. When this tab waited
+ * behind another tab's refresh, that tab's `SetTokens` dispatch
+ * has already published fresh values into shared `localStorage`,
+ * `CrossTabAuthSyncService` has mirrored them into this tab's
+ * NGXS state, and the lock body simply returns the cached access
+ * token without another network round-trip.
+ *
+ * `Logout` fires only when the refresh endpoint returns 401
+ * (real auth failure). Transient errors (network blips, 5xx,
+ * CORS, timeouts) propagate without clearing the session so a
+ * momentary refresh failure does not kill a valid login.
+ */
+declare class AuthRefreshCoordinator {
+    private readonly api;
+    private readonly store;
+    private readonly router;
+    private inFlight;
+    /**
+     * Return the in-flight refresh Observable, or spawn a new one
+     * with the supplied refresh-token value.
+     *
+     * Callers subscribe via `switchMap` / `firstValueFrom` to retry
+     * their original request with the resolved access token.
+     */
+    refresh(refreshToken: string): Observable<string>;
+    /**
+     * Run the refresh body inside `navigator.locks` when the API is
+     * available; degrade to direct invocation otherwise. The lock
+     * body checks for state already updated by a sibling tab before
+     * issuing its own HTTP call.
+     */
+    private refreshWithCrossTabLock;
+    /**
+     * Lock body. Re-reads `AuthState.expiresAt` first: if another
+     * tab published fresh tokens while we were queued, return the
+     * cached access token directly. Otherwise read the latest
+     * refresh-token value from state (it may have rotated while we
+     * waited) and issue the HTTP refresh.
+     */
+    private executeRefresh;
+    /**
+     * Return the cached access token when `AuthState.expiresAt` has
+     * more than `FRESH_TOKEN_GRACE_MS` milliseconds remaining --
+     * signalling that some other tab refreshed for us. Null
+     * otherwise.
+     */
+    private tryConsumeFreshState;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AuthRefreshCoordinator>;
+}
+
+/**
+ * Bridges shared `localStorage` mutations into the NGXS auth
+ * state so a refresh executed in one tab silently propagates to
+ * every other open tab.
+ *
+ * The browser fires `storage` events in tabs OTHER than the one
+ * that mutated `localStorage`. So when Tab A's
+ * `AuthRefreshCoordinator` rotates the token pair and `SetTokens`
+ * persists the new values, every sibling tab receives an event
+ * here and dispatches `SetTokens` against its own NGXS state --
+ * no extra HTTP roundtrip, no extra refresh contention.
+ *
+ * Pairs with the `navigator.locks` cross-tab mutex in
+ * `AuthRefreshCoordinator`: locks ensure only one tab issues the
+ * refresh, this listener propagates the result to the rest.
+ *
+ * `Logout` from any tab clears `coolms_token` (newValue === null)
+ * and this listener mirrors that into the sibling tabs so the
+ * shell redirects to `/login` without waiting for the next
+ * protected request to 401.
+ *
+ * Started from `AppInitService.load()` so the listener is in
+ * place before any protected HTTP fires.
+ */
+declare class CrossTabAuthSyncService {
+    private readonly store;
+    private listenerAttached;
+    start(): void;
+    private readonly handleStorageEvent;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<CrossTabAuthSyncService>;
+}
+
+declare class LoginComponent {
+    identifier: string;
+    password: string;
+    loading: boolean;
+    error: string | null;
+    private readonly store;
+    private readonly router;
+    submit(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
+}
+
+declare class AppInitService {
+    private readonly http;
+    private readonly store;
+    private readonly router;
+    private readonly location;
+    private readonly prefs;
+    private readonly crossTabSync;
+    private readonly refreshCoordinator;
+    /** The only hardcoded URL — everything else comes from the manifest. */
+    private readonly configUrl;
+    /**
+     * Emits (once) when load() has fully completed — tokens settled, manifest
+     * set (or swallowed on error).  authGuard subscribes to this so it never
+     * evaluates isAuthenticated against a partially-restored stale token.
+     */
+    private readonly initComplete;
+    readonly ready$: rxjs.Observable<void>;
+    load(): Promise<void>;
+    /**
+     * Confirm the restored session is still alive, settling AuthState before the
+     * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
+     * interceptor queues behind ready$, which has not fired yet at this point.
+     *
+     *   - access token accepted  -> done, session alive;
+     *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
+     *                              so an expired one with a valid refresh token must
+     *                              stay logged in). The coordinator dispatches Logout
+     *                              on a refresh 401 and SetTokens on success; a
+     *                              transient failure (5xx/network) is swallowed so a
+     *                              momentary blip never kills a valid session.
+     */
+    private validateSession;
+    /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
+    private probe;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AppInitService>;
+}
+
+/**
+ * Layout config DTO -- the shape served from
+ * `GET /api/v1/config/layout/{id}`. Mirrors the YAML at
+ * `config/modules/{module}/layout/*.yaml`.
+ *
+ * The optional fields below are the page-level contract
+ * every admin SPA page resolves through. The base contract (id /
+ * template / title / icon / slots) is the legacy list shape and stays
+ * untouched. Existing 17 list YAMLs render identically when the new
+ * fields are absent.
+ *
+ * New optional fields:
+ *  - `subtitle`         one-line page description rendered under the title
+ *  - `sections`         ordered map of body sections, each with its own slot graph
+ *                       (replaces single-slot `slots:` for multi-section pages)
+ *  - `headerActions`    buttons displayed in the cms-page-header action bar
+ *  - `permissions`      hint for clients about who this page targets; real gating
+ *                       lives on the data APIs the slot components consume
+ *                       (the layout endpoint itself is public by design --
+ *                       layouts carry only structure, never data)
+ *
+ * `[key: string]: unknown` index signature stays so existing per-page
+ * keys (e.g. `media:library`'s `naviGraph:` slot shorthand) keep working
+ * without further interface changes.
+ */
+interface LayoutHeaderAction {
+    id: string;
+    label?: string;
+    icon?: string;
+    title?: string;
+    primary?: boolean;
+    danger?: boolean;
+    disabled?: boolean;
+    /**
+     * Optional capability gate evaluated FE-side against runtime state
+     * (e.g. `administer` / `delete`) — the config declares WHICH actions
+     * exist + their gate; the FE decides if THIS user/row qualifies. Absent
+     * = always shown. Used by detail pages whose actions are config-driven
+     * (see `web:section-detail`).
+     *
+     * For a gate that depends on the RECORD rather than the user, prefer
+     * `showWhen` below: `requires` needs a page to interpret the token, so
+     * every new value costs a branch in TypeScript.
+     */
+    requires?: string;
+    /**
+     * Conditions on the page's published context, same grammar and same
+     * evaluator as a NaviGraph toolbar node, applied
+     * by {@link LayoutActionsService}:
+     *
+     *   showWhen     — the action does not APPLY, so it is absent.
+     *   disabledWhen — temporarily UNAVAILABLE: stays put and greys out.
+     *   busyWhen     — the action is RUNNING: greys out too, and may relabel.
+     *   busyLabel    — label shown while `busyWhen` holds ("Saving…").
+     *   activeWhen   — pressed/active styling.
+     *
+     * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
+     * a page that moves between them should not have to relearn how to say
+     * "not now".
+     */
+    showWhen?: Record<string, unknown>;
+    disabledWhen?: Record<string, unknown>;
+    busyWhen?: Record<string, unknown>;
+    busyLabel?: string;
+    activeWhen?: Record<string, unknown>;
+}
+interface LayoutSection {
+    title?: string;
+    /**
+     * When true, the layout shell pins the section to the top of the
+     * scroll container (CSS `position: sticky`). Used by inspector /
+     * filter pages where an input form should stay visible while the
+     * operator scrolls through results below. Currently honoured by
+     * cms-inspector-layout; cms-detail-layout will follow when it
+     * lands. Default false.
+     */
+    sticky?: boolean;
+    slots?: Record<string, {
+        component?: string;
+        [key: string]: unknown;
+    }>;
+    [key: string]: unknown;
+}
+interface LayoutConfig {
+    id?: string;
+    template?: string;
+    title?: string;
+    subtitle?: string;
+    icon?: string;
+    slots?: Record<string, unknown>;
+    sections?: Record<string, LayoutSection>;
+    headerActions?: LayoutHeaderAction[];
+    /**
+     * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
+     * — primary / destructive actions kept out of the cramped header.
+     * Same shape as `headerActions`; gated per-item via `requires`.
+     */
+    footerActions?: LayoutHeaderAction[];
+    permissions?: string[];
+    [key: string]: unknown;
+}
+interface DialogConfig {
+    [key: string]: unknown;
+}
+interface NavigraphConfig {
+    [key: string]: unknown;
+}
+interface FormConfig {
+    [key: string]: unknown;
+}
+interface DatagridConfig {
+    [key: string]: unknown;
+}
+/**
+ * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
+ *
+ * Responses are cached for the lifetime of the service (Map + shareReplay(1))
+ * so repeated calls never re-fetch the same resource.
+ *
+ * configBase is read from the API manifest (manifest.configBase) and falls
+ * back to '/api/v1/config' when the manifest is not yet loaded.
+ */
+declare class ConfigService {
+    private readonly http;
+    private readonly store;
+    private readonly cache;
+    layout(id: string): Observable<LayoutConfig>;
+    dialog(id: string): Observable<DialogConfig>;
+    navigraph(slug: string): Observable<NavigraphConfig>;
+    form(id: string): Observable<FormConfig>;
+    datagrid(id: string): Observable<DatagridConfig>;
+    private fetch;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ConfigService>;
+}
+
+declare class SetAppConfig {
+    readonly config: ThemeConfigResponse;
+    static readonly type = "[AppConfig] Set";
+    constructor(config: ThemeConfigResponse);
+}
+interface AppConfigStateModel {
+    config: ThemeConfigResponse | null;
+    loaded: boolean;
+}
+declare class AppConfigState {
+    set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
+    static manifest(state: AppConfigStateModel): ApiManifest | null;
+    /**
+     * F.7 viewer manifest. Null when the backend didn't ship a viewers
+     * section (no tagged providers); consumers should fall back to a
+     * "no preview" surface.
+     */
+    static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
+    static loaded(state: AppConfigStateModel): boolean;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AppConfigState>;
+}
+
+/**
+ * Converts any caught error into a human-readable message.
+ *
+ * Priority order for backend errors:
+ *   1. error.detail              (RFC 7807 problem detail)
+ *   2. error['hydra:description'] (Hydra validation errors)
+ *   3. error.message             (generic)
+ *   4. error.violations[]        (constraint violations)
+ *   5. Status-based fallback
+ */
+declare class ErrorHandlerService {
+    humanize(err: unknown): string;
+    private statusMessage;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ErrorHandlerService>;
+}
+
+/** What the user PICKED. `system` defers to the OS. */
+type ThemeChoice = 'light' | 'dark' | 'system';
+/** What that resolves to right now — the only two the stylesheet knows. */
+type ResolvedTheme = 'light' | 'dark';
+/**
+ * Applies the user's theme by setting `data-theme` on the document element.
+ *
+ * The stylesheet does the rest: `:root[data-theme='dark']` re-points the
+ * `--cms-*` palette and every colour in the admin arrives through those names.
+ * Nothing here knows a single colour, which is the point — a second
+ * theme is a block of tokens, not a code change.
+ *
+ * Follows the shape of UserCalendarPreferencesService and
+ * CallOverlayPreferencesService: lazy one-shot load of `/auth/me/settings`,
+ * cached for the SPA lifetime, with `update()` called by the Profile page after
+ * a save so the change lands without a refetch.
+ */
+declare class ThemeService {
+    private readonly api;
+    private readonly store;
+    private readonly _choice;
+    private readonly _systemDark;
+    private readonly _userAccent;
+    private readonly _platformAccent;
+    private loadOnce$?;
+    /** The user's stored choice, including `system`. */
+    readonly choice: i0.Signal<ThemeChoice>;
+    /** This user's personal override, independent of the deployment's. */
+    readonly userAccent: i0.Signal<string | null>;
+    /** The deployment's brand accent from the API manifest, if it set one. */
+    readonly platformAccent: i0.Signal<string | null>;
+    /**
+     * The colour actually painted: personal override, else the deployment's,
+     * else null — which leaves the stylesheet's own accent in place.
+     *
+     * Three rungs and each is a real state. A user who has chosen nothing is
+     * NOT the same as one who chose the deployment's colour: clear the
+     * deployment's brand and the first user follows it, the second does not.
+     */
+    readonly accent: i0.Signal<string | null>;
+    /** The choice with `system` resolved against the OS setting. */
+    readonly resolved: i0.Signal<ResolvedTheme>;
+    constructor();
+    /**
+     * One-shot load of the stored preference. Safe to call more than once and
+     * safe for anonymous users — a failure leaves the cached/system value in
+     * place rather than forcing light, so the login screen still matches the OS.
+     */
+    ensureLoaded(): Observable<ThemeChoice>;
+    /**
+     * Called by the Profile page after the Preferences tab saves, so the admin
+     * re-themes on the spot. Ignores anything that is not a known choice —
+     * the section PATCH returns the whole merged bag, not just this field.
+     */
+    update(value: unknown): void;
+    /**
+     * Companion to {@link update} for the accent field of the same save.
+     * An explicit null clears the override; anything malformed is ignored
+     * rather than applied, so a bad value can never blank the admin's accent.
+     */
+    updateAccent(value: unknown): void;
+    private set;
+    /**
+     * The manifest is loaded at bootstrap, well before the authenticated shell
+     * calls this, so a snapshot read is enough and no subscription is needed.
+     * A malformed value is ignored rather than applied — the container refuses
+     * to build with one, but the manifest crosses the network all the same.
+     */
+    private readPlatformAccent;
+    private setAccent;
+    /**
+     * Writes the override onto the document element, where an inline style
+     * outranks every stylesheet rule — including the dark block — so one
+     * declaration re-points the accent in both themes.
+     *
+     * Only --cms-accent is set, not the -hover/-light/-text members of the
+     * family. Deriving those from an arbitrary user colour needs a colour model
+     * the palette does not have yet, and guessing them would produce hover
+     * states that clash with the very colour the user chose. Until then the
+     * override moves the brand fill and leaves its supporting tones alone.
+     */
+    private applyAccent;
+    private applyToDocument;
+    private static readCache;
+    private static readAccentCache;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ThemeService>;
+}
+
+/**
+ * The platform's loading indicator: the exclamation mark from Cool!MS,
+ * drawing itself.
+ *
+ * ## Why a mark and not a spinner
+ *
+ * A spinner says "something is happening" and nothing else; every product has
+ * one and none of them are yours. The bang is already the one glyph in the
+ * wordmark that carries the brand, so a loader built from it says whose
+ * software is thinking — for free, in the place a user is already looking.
+ *
+ * ## Why one component rather than a snippet per surface
+ *
+ * It is meant for every wait long enough to notice: a dashboard assembling its
+ * cards, an editor paginating a document, an explorer listing a folder. Those
+ * are different teams' files, and a copied SVG in each is how three loaders
+ * that no longer match each other happen.
+ *
+ * ## The animation
+ *
+ * The stem wipes upward and the dot lands after it, on a loop — the shape being
+ * WRITTEN rather than spun. It is deliberately calm: a loader is background
+ * furniture, and anything with a hard beat gets irritating on the third viewing.
+ * Under `prefers-reduced-motion` it holds still and only breathes, because
+ * motion sickness is not a stylistic preference.
+ */
+declare class CmsLoaderComponent {
+    /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
+    readonly label: i0.InputSignal<string>;
+    /** Cover the positioned ancestor rather than sitting in the flow. */
+    readonly overlay: i0.InputSignal<boolean>;
+    /**
+     * Row layout at text scale, for a wait inside a row, a status bar or a
+     * button. Override `--cms-loader-size` to tune the mark.
+     */
+    readonly inline: i0.InputSignal<boolean>;
+    /**
+     * A clip-path needs a document-unique id, and this component is used more
+     * than once per page — two loaders sharing an id makes the second one clip
+     * against the first one's rectangle and stop animating.
+     */
+    protected readonly clipId: string;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CmsLoaderComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<CmsLoaderComponent, "cms-loader", never, { "label": { "alias": "label"; "required": false; "isSignal": true; }; "overlay": { "alias": "overlay"; "required": false; "isSignal": true; }; "inline": { "alias": "inline"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
+}
+
+/**
+ * Unified user preferences service — all preference types share one
+ * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
+ *
+ * Key naming convention (stored as nested objects, referenced via dot-notation):
+ *
+ *   // Grids
+ *   grids.{gridId}.columns
+ *   grids.{gridId}.columnWidths
+ *
+ *   // Panels (ExplorerLayout persistKey values from YAML)
+ *   panel.{persistKey}.width
+ *   panel.{persistKey}.collapsed
+ *
+ *   // Page navigation state
+ *   page.vfs.lastPath
+ *   page.vfs.viewMode
+ *   page.media.lastDir
+ *   page.media.viewMode
+ *
+ *   // Global
+ *   nav.lastRoute
+ *   terminal.height
+ *   terminal.open
+ */
+declare class UserPreferencesService {
+    private readonly http;
+    private readonly store;
+    private readonly destroyRef;
+    private readonly STORAGE_KEY;
+    private readonly SYNC_DELAY;
+    private syncSubject;
+    constructor();
+    /**
+     * Write all prefs to localStorage and schedule a debounced server sync.
+     */
+    private save;
+    /**
+     * Read the entire prefs object from localStorage, applying legacy key
+     * migration on the first read after an upgrade.
+     */
+    private load;
+    /**
+     * One-time migration of legacy flat keys to the new nested naming convention.
+     * Mutates `all` in place and re-persists only when something changed.
+     */
+    private migrate;
+    /**
+     * Seed localStorage from server preferences.
+     * Called after login and on every session restore (page reload).
+     *
+     * Strategy:
+     *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
+     *  - Local prefs already exist -> merge with local taking priority at each
+     *    top-level namespace.  This ensures that locally-persisted state
+     *    (panel widths, last path, etc.) is never overwritten by the stale copy
+     *    that was saved in the auth token at login time.
+     */
+    loadFromServer(uiPrefs: Record<string, unknown>): void;
+    private syncToServer;
+    /**
+     * Get stored preferences for a specific grid.
+     */
+    getGridPref(gridId: string): DataGridPreference | null;
+    /**
+     * Set visible column order for a grid.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setColumns(gridId: string, columns: string[]): void;
+    /**
+     * Record a column width for a grid column.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setColumnWidth(gridId: string, field: string, width: number): void;
+    /**
+     * Remove all preferences for a specific grid and immediately sync to server.
+     */
+    resetGrid(gridId: string): void;
+    private updateGrid;
+    /**
+     * Get persisted terminal panel height.
+     */
+    getTerminalHeight(): number | null;
+    /**
+     * Persist terminal panel height.
+     */
+    setTerminalHeight(height: number): void;
+    /**
+     * Get persisted state for a resizable panel identified by key.
+     * Used by ExplorerLayoutComponent to persist panel widths across sessions.
+     */
+    getPanelState(key: string): {
+        width: number;
+        collapsed: boolean;
+    } | null;
+    /**
+     * Persist generic panel state by key.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setPanelState(key: string, width: number, collapsed: boolean): void;
+    /**
+     * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
+     */
+    getPageState<T>(pageKey: string): T | null;
+    /**
+     * Merge partial state into a page namespace.
+     * Existing keys in the namespace are preserved; only provided keys are updated.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setPageState(pageKey: string, state: Record<string, unknown>): void;
+    /** @deprecated Use getPageState('media') instead */
+    getMediaViewMode(): string | null;
+    /** @deprecated Use setPageState('media', ...) instead */
+    setMediaViewMode(mode: string): void;
+    /** @deprecated Use getPanelState('media_panel_left') instead */
+    getMediaCollectionsPanel(): {
+        width: number;
+        collapsed: boolean;
+    } | null;
+    /** @deprecated Use setPanelState('media_panel_left', ...) instead */
+    setMediaCollectionsPanel(width: number, collapsed: boolean): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<UserPreferencesService>;
+}
+
+/**
+ * Sidebar collapse state -- two independent dimensions:
+ *
+ *  - `collapsed`: whole-sidebar icon-only rail toggle (the chevron at
+ *    the bottom of the sidebar). Per-device localStorage.
+ *  - `collapsedSections`: per-section collapse, keyed by the section
+ *    separator's node id. Used to fold a section's items under their
+ *    header so the nav doesn't endless-scroll once a tenant has lots
+ *    of modules. Per-device localStorage.
+ *  - `collapsedItems`: per-item inline-expand collapse, keyed by the
+ *    nav node's id. Mirrors `collapsedSections` but for sub-tree items
+ *    (a top-level item with children, e.g. Reports -> Process Report).
+ *    Absent id = expanded (children visible); present = collapsed.
+ *    Per-device localStorage.
+ *
+ * Storage failures (private mode, quota, disabled cookies) fall back
+ * to defaulting un-collapsed -- the toggles still work for the session,
+ * just don't persist.
+ */
+declare class SidebarStateService {
+    private static readonly STORAGE_KEY;
+    private static readonly STORAGE_KEY_SECTIONS;
+    private static readonly STORAGE_KEY_ITEMS;
+    readonly collapsed: i0.WritableSignal<boolean>;
+    readonly collapsedSections: i0.WritableSignal<Set<string>>;
+    readonly collapsedItems: i0.WritableSignal<Set<string>>;
+    toggle(): void;
+    isSectionCollapsed(id: string): boolean;
+    toggleSection(id: string): void;
+    /**
+     * Force a section to be expanded. Used when navigation lands on
+     * a route inside a manually-collapsed section -- it would be
+     * confusing to leave the active item hidden. The user can
+     * collapse the section again afterwards.
+     */
+    ensureExpanded(id: string): void;
+    isItemCollapsed(id: string): boolean;
+    toggleItem(id: string): void;
+    private readPersisted;
+    private persist;
+    private readSectionsPersisted;
+    private persistSections;
+    private readItemsPersisted;
+    private persistItems;
+    static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<SidebarStateService>;
+}
+
+/**
+ * One row returned by the `/api/entity-search` endpoint. `id` is
+ * what the picker emits via its `valueChange` output (and what the
+ * template's persisted context carries). `label` is the primary
+ * display line. `secondary` is an optional second line for
+ * disambiguation (email, slug, etc.) — the backend omits the key
+ * when there is nothing to show; receiving `null` from a custom
+ * resolver is normalized to `undefined` here.
+ */
+interface EntitySearchResult {
+    readonly id: string | number;
+    readonly label: string;
+    readonly secondary?: string;
+}
+/**
+ * HTTP client for the Phase 2a `/api/entity-search` endpoint.
+ * Returns a stream of search results for the given entity FQCN.
+ * Permission filtering happens at the backend resolver layer —
+ * this service is a thin RPC.
+ */
+declare class EntitySearchService {
+    private readonly http;
+    /**
+     * @param entityType  Fully-qualified PHP class name of the entity
+     *                    being searched (e.g. the backend's User entity).
+     * @param query       Free-text search input. Empty string is
+     *                    valid — the backend returns the default
+     *                    listing for that entity type.
+     * @param limit       Max rows to return; clamped server-side to
+     *                    [1, 100].
+     */
+    search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<EntitySearchService>;
+}
+
+/**
+ * Well-known click target values embedded in meta.target.
+ *   'action.logout' — dispatch Logout action
+ *   'route'         — navigate via routerLink (default when target absent)
+ *   '_blank'        — open in a new tab (hrefOverride must be set)
+ */
+type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
+interface NaviGraphMeta {
+    readonly component?: string;
+    readonly icon?: string;
+    readonly routerLink?: string;
+    readonly target?: NaviGraphTarget;
+    readonly requiredRole?: string;
+    readonly voterAttribute?: string;
+    readonly contributor?: string;
+    readonly [key: string]: unknown;
+}
+/** Flat node as returned from GET /navi/trees/{slug}/graph */
+interface NaviGraphNodeFlat {
+    readonly id: string;
+    readonly path: string;
+    readonly title: string;
+    readonly parentId: string | null;
+    readonly sortOrder: number;
+    readonly isActive: boolean;
+    readonly isVisible: boolean;
+    readonly meta: NaviGraphMeta;
+}
+/** Same node enriched with resolved children after client-side tree build */
+interface NaviGraphNode extends NaviGraphNodeFlat {
+    readonly children: NaviGraphNode[];
+}
+
+/**
+ * Loads, caches, and drives admin NaviGraph trees.
+ *
+ * Usage:
+ *   naviGraphService.loadAdminNav(url).subscribe();
+ *   const items = naviGraphService.adminNav();         // signal<NaviGraphNode[]>
+ *   naviGraphService.handleClick(node);
+ */
+declare class NaviGraphService {
+    private readonly http;
+    private readonly router;
+    private readonly store;
+    private readonly errors;
+    /** Resolved root nodes for navi.admin (sidebar). */
+    readonly adminNav: i0.WritableSignal<NaviGraphNode[]>;
+    /** Resolved root nodes for navi.admin.topbar. */
+    readonly topbarNav: i0.WritableSignal<NaviGraphNode[]>;
+    private readonly cache;
+    loadAdminNav(url: string): Observable<NaviGraphNode[]>;
+    loadTopbarNav(url: string): Observable<NaviGraphNode[]>;
+    /**
+     * Handle a nav-node click.
+     *
+     * Routing logic based on meta.target:
+     *   'action.logout'  — dispatch Logout
+     *   '_blank'         — window.open (uses node.path as href)
+     *   default          — router.navigate with meta.routerLink or node.path
+     */
+    handleClick(node: NaviGraphNode): void;
+    /**
+     * Evaluate `showWhen` meta condition against a record.
+     * Nodes with no `showWhen` are always visible.
+     * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
+     */
+    isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
+    /**
+     * Standalone `showWhen` evaluator for callers that don't have a
+     * full `NaviGraphNode` (e.g. a grid's row context menu — a
+     * `rowAction.showWhen` predicate is evaluated against the row's
+     * own projection). `null`/`undefined` predicates default to
+     * visible, mirroring `isVisible`'s "no rule = always shown"
+     * semantics.
+     */
+    matchesShowWhen(showWhen: Record<string, unknown> | undefined | null, record: Record<string, unknown>): boolean;
+    private evalCondition;
+    /**
+     * Fetch a graph endpoint and return a nested tree.
+     * Handles both compact JSON-LD IRIs (`member`) and
+     * the legacy Hydra key (`hydra:member`).
+     * Results are cached by URL for the lifetime of the service instance.
+     */
+    loadTree(url: string): Observable<NaviGraphNode[]>;
+    /**
+     * Build a nested tree from a flat array of nodes.
+     * Nodes are sorted by sortOrder at each level.
+     */
+    private buildTree;
+    static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<NaviGraphService>;
+}
+
+/**
+ * Registry mapping string keys to Angular component classes.
+ *
+ * Backed by a static Map so components registered at module load time
+ * (e.g. in app.config.ts) are visible to all injected instances.
+ *
+ * Usage — static (app.config.ts / bootstrap time):
+ *   ComponentRegistry.register('MediaLibraryPage', MediaLibraryPage);
+ *
+ * Usage — injected (SlotComponent / runtime):
+ *   private readonly registry = inject(ComponentRegistry);
+ *   const cls = this.registry.get('MediaLibraryPage');
+ */
+declare class ComponentRegistry {
+    private static readonly map;
+    static register(key: string, component: Type<unknown>): void;
+    static get(key: string): Type<unknown> | undefined;
+    static has(key: string): boolean;
+    static keys(): string[];
+    register(key: string, component: Type<unknown>): void;
+    get(key: string): Type<unknown> | null;
+    has(key: string): boolean;
+    keys(): string[];
+    static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ComponentRegistry>;
+}
+
+/**
+ * Phase H7 -- admin Site Selector.
+ *
+ * Stamps `X-CoolMS-Section: <slug>` on outgoing `/api/v1/*` requests when
+ * the admin has picked a section from the Site Selector dropdown. The backend
+ * honours it for AUTHENTICATED requests only -- anonymous traffic cannot pivot
+ * the active section.
+ *
+ * What the header actually reaches, counted rather than intended: exactly two
+ * readers act on it, `CreatePageProcessor` and `CreateCollectionProcessor`,
+ * each choosing WHICH SITE a newly created page or collection lands in -- and,
+ * for a page, that section's default locale and slug-naming policy. Nothing
+ * else is scoped by it. Media spaces list every active section regardless, and
+ * every other reader of `_coolms_section` sits on the public SSR surface,
+ * which resolves from host+path and never sees this header.
+ *
+ * This block used to say the backend "scopes site-specific API providers
+ * (pages, media spaces, etc.)". That described where was heading --
+ * H4/H5, multisite Document and Media, never landed -- not what it does. Left
+ * recorded because a docstring naming an intended destination reads exactly
+ * like one naming a shipped feature, and this one misdescribed the control for
+ * three months.
+ *
+ * Skipped:
+ *  - non-API URLs (no section context needed for SSR/static)
+ *  - `/auth/*` endpoints (login/refresh are pre-session; the header would
+ *    be ignored by the backend anyway, but skipping keeps wire traffic clean)
+ *  - requests that already carry the header (programmatic overrides win)
+ */
+declare const sectionInterceptor: HttpInterceptorFn;
+
+/**
+ * The one fact the section interceptor needs: which site the operator is
+ * currently working in.
+ *
+ * `core` is auth, config, errors and interceptors -- the layer everything else
+ * is built on -- so it must not import a feature. The obvious-looking fix,
+ * moving `SectionState` into core, is the wrong one: sections are a CMS domain
+ * concept, and hoisting domain state into the base layer trades one bad
+ * direction for another. So core declares the little it needs and the module
+ * that owns the state provides it, bound in the composition root.
+ *
+ * Read SYNCHRONOUSLY on purpose. An interceptor decides whether to stamp a
+ * header while building the request; it cannot wait on a stream.
+ */
+interface CurrentSectionPort {
+    /** Slug of the active section, or null when the operator picked none. */
+    currentSlug(): string | null;
+}
+/**
+ * Optional by design: an application assembled without a Sections module binds
+ * nothing and simply sends no `X-CoolMS-Section` header, which is exactly what
+ * a single-site install wants.
+ */
+declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;
+
+export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, CrossTabAuthSyncService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, authGuard, authInterceptor, loginPageGuard, resolvePattern, sectionInterceptor };
+export type { ApiManifest, AppConfigStateModel, AuthApiManifest, AuthStateModel, CentrifugoConnectionTokenDto, CentrifugoSubscriptionTokenDto, ContentApiManifest, CurrentSectionPort, DataGridApiManifest, DataGridPreference, DataGridPreferences, DataSourceDefinition, DataSourceLoading, DataSourceOption, DataSourceType, DataSourceWidget, DatagridConfig, DialogConfig, DocumentApiManifest, DomainExplorerApiManifest, DynamicEntityApiManifest, EditorApiManifest, EditorApiManifestEntry, EditorApiManifestProfile, EntitySearchResult, FieldItem, FieldSecurityPolicy, FieldType, FormAction, FormActionType, FormActionVariant, FormConfig, FormRenderDefinition, HydraCollection, HydraView, IdentityApiManifest, LayoutConfig, LayoutHeaderAction, LayoutNode, LayoutSection, MediaApiManifest, NaviApiManifest, NaviGraphMeta, NaviGraphNode, NaviGraphNodeFlat, NaviGraphTarget, NavigraphConfig, PlatformDefaults, RelationDefinition, ResolvedTheme, SectionApiManifest, SubFormDefinition, TerminalApiManifest, ThemeChoice, ThemeConfigResponse, TokenResponse, UserDto, ValidatorDefinition, VfsApiManifest, ViewerApiManifest, ViewerDefinitionApiManifest, ViewerProfileApiManifest, VisibilityCondition, VisibilityOperator };