@coolms/core-angular 2.0.0-alpha.3 → 2.0.0-alpha.4

package/fesm2022/coolms-core-angular.mjs

@@ -1,1542 +1,1483 @@
-import * as i0 from '@angular/core';
-import { Injectable, inject, DestroyRef, Component, signal, computed, effect, input, ChangeDetectionStrategy, InjectionToken } from '@angular/core';
-import { HttpClient, HttpErrorResponse, HttpContextToken, HttpContext, HttpParams } from '@angular/common/http';
-import { Action, Selector, State, Store } from '@ngxs/store';
-import { __decorate } from 'tslib';
-import { Subject, debounceTime, catchError, of, defer, throwError, shareReplay, finalize, from, firstValueFrom, take, switchMap as switchMap$1, ReplaySubject, tap as tap$1, map } from 'rxjs';
-import { tap, switchMap, map as map$1, catchError as catchError$1, shareReplay as shareReplay$1 } from 'rxjs/operators';
-import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
-import { Router } from '@angular/router';
-import { Location, NgIf } from '@angular/common';
-import * as i1 from '@angular/forms';
-import { FormsModule } from '@angular/forms';
-
-// Typed contract — must mirror ApiManifest PHP VOs exactly.
-// No `any` anywhere.
-/**
- * Replaces {param} tokens in a URL pattern with encoded values.
- *
- * @example
- *   resolvePattern(manifest.sections!.item, { id: '123' })
- *   // -> '/api/v1/sections/123'
- */
+import * as i0 from "@angular/core";
+import { ChangeDetectionStrategy, Component, DestroyRef, Injectable, InjectionToken, computed, effect, inject, input, makeEnvironmentProviders, provideAppInitializer, signal, untracked } from "@angular/core";
+import { HttpClient, HttpContext, HttpContextToken, HttpErrorResponse, HttpParams } from "@angular/common/http";
+import { Action, Selector, State, Store, provideStore } from "@ngxs/store";
+import { __decorate } from "tslib";
+import { ReplaySubject, Subject, catchError, debounceTime, defer, finalize, firstValueFrom, from, map, of, shareReplay, switchMap, take, tap, throwError } from "rxjs";
+import { catchError as catchError$1, map as map$1, shareReplay as shareReplay$1, switchMap as switchMap$1, tap as tap$1 } from "rxjs/operators";
+import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
+import { Router } from "@angular/router";
+import { Location, NgIf } from "@angular/common";
+import * as i1 from "@angular/forms";
+import { FormsModule } from "@angular/forms";
 function resolvePattern(pattern, params) {
-    return Object.entries(params).reduce((url, [key, value]) => url.replace(`{${key}}`, encodeURIComponent(value)), pattern);
-}
-
-// Typed contract — mirrors FormRenderDefinition PHP VOs exactly.
-// No `any` anywhere.
-
-// --- Action ------------------------------------------------------------------
-class SetAppConfig {
-    config;
-    static type = '[AppConfig] Set';
-    constructor(config) {
-        this.config = config;
-    }
+	return Object.entries(params).reduce((url, [key, value]) => url.replace(`{${key}}`, encodeURIComponent(value)), pattern);
 }
+var SetAppConfig = class {
+	config;
+	static type = "[AppConfig] Set";
+	constructor(config) {
+		this.config = config;
+	}
+};
 let AppConfigState = class AppConfigState {
-    set(ctx, { config }) {
-        ctx.setState({ config, loaded: true });
-    }
-    static manifest(state) {
-        return state.config?.manifest ?? null;
-    }
-    /**
-     * F.7 viewer manifest. Null when the backend didn't ship a viewers
-     * section (no tagged providers); consumers should fall back to a
-     * "no preview" surface.
-     */
-    static viewers(state) {
-        return state.config?.manifest.viewers ?? null;
-    }
-    static loaded(state) {
-        return state.loaded;
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState });
+	set(ctx, { config }) {
+		ctx.setState({
+			config,
+			loaded: true
+		});
+	}
+	static manifest(state) {
+		return state.config?.manifest ?? null;
+	}
+	static viewers(state) {
+		return state.config?.manifest.viewers ?? null;
+	}
+	static loaded(state) {
+		return state.loaded;
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AppConfigState,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AppConfigState
+	});
 };
-__decorate([
-    Action(SetAppConfig)
-], AppConfigState.prototype, "set", null);
-__decorate([
-    Selector()
-], AppConfigState, "manifest", null);
-__decorate([
-    Selector()
-], AppConfigState, "viewers", null);
-__decorate([
-    Selector()
-], AppConfigState, "loaded", null);
-AppConfigState = __decorate([
-    State({
-        name: 'appConfig',
-        defaults: { config: null, loaded: false },
-    })
-], AppConfigState);
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState, decorators: [{
-            type: Injectable
-        }], propDecorators: { set: [] } });
-
-/**
- * The identity endpoints core owns: the session lifecycle, plus the settings
- * read at boot.
- *
- * Carved out of the admin's `ApiService` -- 2410 lines, 118 methods and 89 DTOs
- * spanning calendars, documents, calls, VFS and the rest. Core cannot depend on
- * that and still ship beneath the UI kit: it would drag every module's wire
- * types down with it. Core called exactly FOUR of those methods.
- *
- * `logout` is the one addition, and not for symmetry: the auth lifecycle lives
- * here (state, refresh coordinator, cross-tab sync), so a core package that
- * could sign in but not out would be incomplete.
- *
- * `ApiService` keeps its own identical signatures and delegates here, so none
- * of the 94 feature files calling it changed.
- */
-class IdentityApiClient {
-    http = inject(HttpClient);
-    store = inject(Store);
-    /** URLs come from the boot manifest, which core already owns. */
-    get manifest() {
-        const m = this.store.selectSnapshot(AppConfigState.manifest);
-        if (!m)
-            throw new Error('ApiManifest not loaded — call AppInitService.load() first');
-        return m;
-    }
-    login(identifier, password) {
-        return this.http.post(this.manifest.auth.login, { identifier, password });
-    }
-    refresh(refreshToken) {
-        return this.http.post(this.manifest.auth.refresh, { refreshToken });
-    }
-    logout() {
-        return this.http.post(this.manifest.auth.logout, {});
-    }
-    me() {
-        return this.http.get(this.manifest.auth.me);
-    }
-    getSettings() {
-        // Force plain JSON. Angular's default Accept carries a wildcard, which
-        // makes the backend prefer application/ld+json -- and the section keys
-        // are then lost inside the Hydra member array.
-        return this.http.get(this.manifest.identity.settingsUrl, { headers: { Accept: 'application/json' } });
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * The two realtime endpoints, carved out for the same reason the identity ones
- * were: the UI kit's realtime client needed exactly these two of `ApiService`'s
- * 117 methods, and depending on the whole thing would have pulled the entire
- * application's wire vocabulary underneath the kit.
- *
- * They belong in core rather than in the kit because both answers are derived
- * from things core already owns -- the boot manifest for the URL, and the auth
- * interceptor for the bearer token that authorises the request. A token is
- * session state, not a widget.
- *
- * `ApiService` keeps its identical signatures and delegates here, so nothing
- * calling it had to change.
- */
-class RealtimeTokenClient {
-    http = inject(HttpClient);
-    store = inject(Store);
-    get manifest() {
-        const m = this.store.selectSnapshot(AppConfigState.manifest);
-        if (!m)
-            throw new Error('ApiManifest not loaded — call AppInitService.load() first');
-        return m;
-    }
-    connectionToken() {
-        return this.http.post(this.manifest.apiBase + '/centrifugo/connection-token', {});
-    }
-    subscriptionToken(channel) {
-        return this.http.post(this.manifest.apiBase + '/centrifugo/subscription-token', { channel });
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-class Login {
-    identifier;
-    password;
-    static type = '[Auth] Login';
-    constructor(identifier, password) {
-        this.identifier = identifier;
-        this.password = password;
-    }
-}
-class Logout {
-    static type = '[Auth] Logout';
-}
-class RestoreSession {
-    static type = '[Auth] Restore Session';
-}
-class SetTokens {
-    response;
-    static type = '[Auth] Set Tokens';
-    constructor(response) {
-        this.response = response;
-    }
-}
-/** Merge a partial update into the currently-stored user (e.g. after avatar change). */
-class PatchCurrentUser {
-    patch;
-    static type = '[Auth] Patch Current User';
-    constructor(patch) {
-        this.patch = patch;
-    }
-}
-
-/**
- * Unified user preferences service — all preference types share one
- * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
- *
- * Key naming convention (stored as nested objects, referenced via dot-notation):
- *
- *   // Grids
- *   grids.{gridId}.columns
- *   grids.{gridId}.columnWidths
- *
- *   // Panels (ExplorerLayout persistKey values from YAML)
- *   panel.{persistKey}.width
- *   panel.{persistKey}.collapsed
- *
- *   // Page navigation state
- *   page.vfs.lastPath
- *   page.vfs.viewMode
- *   page.media.lastDir
- *   page.media.viewMode
- *
- *   // Global
- *   nav.lastRoute
- *   terminal.height
- *   terminal.open
- */
-class UserPreferencesService {
-    http = inject(HttpClient);
-    store = inject(Store);
-    destroyRef = inject(DestroyRef);
-    STORAGE_KEY = 'coolms_ui_prefs';
-    SYNC_DELAY = 2000; // ms
-    syncSubject = new Subject();
-    constructor() {
-        // Debounced sync to server — batches rapid changes (e.g. live resize)
-        this.syncSubject.pipe(debounceTime(this.SYNC_DELAY), takeUntilDestroyed(this.destroyRef)).subscribe(prefs => this.syncToServer(prefs));
-    }
-    // -- Core helpers ---------------------------------------------------------
-    /**
-     * Write all prefs to localStorage and schedule a debounced server sync.
-     */
-    save(all) {
-        localStorage.setItem(this.STORAGE_KEY, JSON.stringify(all));
-        this.syncSubject.next(all);
-    }
-    /**
-     * Read the entire prefs object from localStorage, applying legacy key
-     * migration on the first read after an upgrade.
-     */
-    load() {
-        try {
-            const raw = localStorage.getItem(this.STORAGE_KEY);
-            const all = raw ? JSON.parse(raw) : {};
-            return this.migrate(all);
-        }
-        catch {
-            return {};
-        }
-    }
-    /**
-     * One-time migration of legacy flat keys to the new nested naming convention.
-     * Mutates `all` in place and re-persists only when something changed.
-     */
-    migrate(all) {
-        let dirty = false;
-        // terminal_height -> terminal.height
-        if (typeof all['terminal_height'] === 'number') {
-            const terminal = (all['terminal'] ?? {});
-            terminal['height'] = all['terminal_height'];
-            all['terminal'] = terminal;
-            delete all['terminal_height'];
-            dirty = true;
-        }
-        // media_view_mode -> page.media.viewMode
-        if (typeof all['media_view_mode'] === 'string') {
-            const page = (all['page'] ?? {});
-            const media = (page['media'] ?? {});
-            media['viewMode'] = all['media_view_mode'];
-            page['media'] = media;
-            all['page'] = page;
-            delete all['media_view_mode'];
-            dirty = true;
-        }
-        // media_collections_panel -> panel.media_panel_left  (matches persistKey in media-library.yaml)
-        if (all['media_collections_panel'] && typeof all['media_collections_panel'] === 'object') {
-            const panel = (all['panel'] ?? {});
-            panel['media_panel_left'] = all['media_collections_panel'];
-            all['panel'] = panel;
-            delete all['media_collections_panel'];
-            dirty = true;
-        }
-        // Normalize namespace arrays to empty objects.
-        // The server serialises empty namespaces as [] (JSON array) rather than {}
-        // because PHP converts empty associative arrays to JSON arrays. Arrays silently
-        // swallow named-property writes and produce "[]" on serialisation, so column/
-        // panel preferences would be lost. Convert once and re-persist.
-        const NAMESPACES = new Set(['grids', 'panel', 'page', 'terminal', 'nav']);
-        for (const ns of NAMESPACES) {
-            if (Array.isArray(all[ns])) {
-                all[ns] = {};
-                dirty = true;
-            }
-        }
-        // Grid keys: any top-level object with `columns` or `columnWidths` -> grids.{key}
-        for (const key of Object.keys(all)) {
-            if (NAMESPACES.has(key))
-                continue;
-            const val = all[key];
-            if (val && typeof val === 'object' && !Array.isArray(val)) {
-                const obj = val;
-                if ('columns' in obj || 'columnWidths' in obj) {
-                    const grids = (all['grids'] ?? {});
-                    grids[key] = obj;
-                    all['grids'] = grids;
-                    delete all[key];
-                    dirty = true;
-                }
-            }
-        }
-        if (dirty) {
-            localStorage.setItem(this.STORAGE_KEY, JSON.stringify(all));
-        }
-        return all;
-    }
-    // -- Server sync ----------------------------------------------------------
-    /**
-     * Seed localStorage from server preferences.
-     * Called after login and on every session restore (page reload).
-     *
-     * Strategy:
-     *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
-     *  - Local prefs already exist -> merge with local taking priority at each
-     *    top-level namespace.  This ensures that locally-persisted state
-     *    (panel widths, last path, etc.) is never overwritten by the stale copy
-     *    that was saved in the auth token at login time.
-     */
-    loadFromServer(uiPrefs) {
-        if (Object.keys(uiPrefs).length === 0)
-            return;
-        try {
-            const raw = localStorage.getItem(this.STORAGE_KEY);
-            if (!raw) {
-                // Fresh device — trust the server entirely
-                localStorage.setItem(this.STORAGE_KEY, JSON.stringify(uiPrefs));
-            }
-            else {
-                // Local prefs exist — server is the base, local namespaces win
-                const local = JSON.parse(raw);
-                const merged = { ...uiPrefs, ...local };
-                localStorage.setItem(this.STORAGE_KEY, JSON.stringify(merged));
-            }
-        }
-        catch {
-            localStorage.setItem(this.STORAGE_KEY, JSON.stringify(uiPrefs));
-        }
-    }
-    syncToServer(prefs) {
-        const manifest = this.store.selectSnapshot(AppConfigState.manifest);
-        const url = manifest?.auth?.preferencesUrl;
-        if (!url)
-            return;
-        this.http.patch(url, { uiPrefs: prefs }, {
-            headers: { 'Content-Type': 'application/merge-patch+json' },
-        }).subscribe({
-            error: err => console.warn('Preferences sync failed:', err),
-        });
-    }
-    // -- Grids ----------------------------------------------------------------
-    /**
-     * Get stored preferences for a specific grid.
-     */
-    getGridPref(gridId) {
-        try {
-            const all = this.load();
-            const grids = all['grids'];
-            if (!grids)
-                return null;
-            return grids[gridId] ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Set visible column order for a grid.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setColumns(gridId, columns) {
-        this.updateGrid(gridId, existing => ({ ...existing, columns }));
-    }
-    /**
-     * Record a column width for a grid column.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setColumnWidth(gridId, field, width) {
-        this.updateGrid(gridId, existing => ({
-            ...existing,
-            columnWidths: {
-                ...(existing.columnWidths ?? {}),
-                [field]: Math.max(60, width),
-            },
-        }));
-    }
-    /**
-     * Remove all preferences for a specific grid and immediately sync to server.
-     */
-    resetGrid(gridId) {
-        const all = this.load();
-        const grids = (all['grids'] ?? {});
-        delete grids[gridId];
-        all['grids'] = grids;
-        this.save(all);
-        this.syncToServer(all); // immediate sync
-    }
-    updateGrid(gridId, updater) {
-        const all = this.load();
-        const grids = (all['grids'] ?? {});
-        grids[gridId] = updater(grids[gridId] ?? {});
-        all['grids'] = grids;
-        this.save(all);
-    }
-    // -- Terminal -------------------------------------------------------------
-    /**
-     * Get persisted terminal panel height.
-     */
-    getTerminalHeight() {
-        const all = this.load();
-        const terminal = all['terminal'];
-        return typeof terminal?.['height'] === 'number' ? terminal['height'] : null;
-    }
-    /**
-     * Persist terminal panel height.
-     */
-    setTerminalHeight(height) {
-        const all = this.load();
-        const terminal = (all['terminal'] ?? {});
-        terminal['height'] = Math.round(height);
-        all['terminal'] = terminal;
-        this.save(all);
-    }
-    // -- Panel ----------------------------------------------------------------
-    /**
-     * Get persisted state for a resizable panel identified by key.
-     * Used by ExplorerLayoutComponent to persist panel widths across sessions.
-     */
-    getPanelState(key) {
-        try {
-            const all = this.load();
-            const panel = all['panel'];
-            if (!panel)
-                return null;
-            const p = panel[key];
-            if (!p || typeof p !== 'object')
-                return null;
-            const { width, collapsed } = p;
-            return typeof width === 'number' && typeof collapsed === 'boolean'
-                ? { width, collapsed }
-                : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Persist generic panel state by key.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setPanelState(key, width, collapsed) {
-        const all = this.load();
-        const panel = (all['panel'] ?? {});
-        panel[key] = { width: Math.round(width), collapsed };
-        all['panel'] = panel;
-        this.save(all);
-    }
-    // -- Page state -----------------------------------------------------------
-    /**
-     * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
-     */
-    getPageState(pageKey) {
-        try {
-            const all = this.load();
-            const page = all['page'];
-            if (!page)
-                return null;
-            return page[pageKey] ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Merge partial state into a page namespace.
-     * Existing keys in the namespace are preserved; only provided keys are updated.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setPageState(pageKey, state) {
-        const all = this.load();
-        const page = (all['page'] ?? {});
-        page[pageKey] = { ...(page[pageKey] ?? {}), ...state };
-        all['page'] = page;
-        this.save(all);
-    }
-    // -- Media (legacy pass-through — kept for compatibility) -----------------
-    /** @deprecated Use getPageState('media') instead */
-    getMediaViewMode() {
-        return this.getPageState('media')?.viewMode ?? null;
-    }
-    /** @deprecated Use setPageState('media', ...) instead */
-    setMediaViewMode(mode) {
-        this.setPageState('media', { viewMode: mode });
-    }
-    /** @deprecated Use getPanelState('media_panel_left') instead */
-    getMediaCollectionsPanel() {
-        return this.getPanelState('media_panel_left');
-    }
-    /** @deprecated Use setPanelState('media_panel_left', ...) instead */
-    setMediaCollectionsPanel(width, collapsed) {
-        this.setPanelState('media_panel_left', width, collapsed);
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }], ctorParameters: () => [] });
-
-const STORAGE_KEY$1 = 'coolms_token';
+__decorate([Action(SetAppConfig)], AppConfigState.prototype, "set", null);
+__decorate([Selector()], AppConfigState, "manifest", null);
+__decorate([Selector()], AppConfigState, "viewers", null);
+__decorate([Selector()], AppConfigState, "loaded", null);
+AppConfigState = __decorate([State({
+	name: "appConfig",
+	defaults: {
+		config: null,
+		loaded: false
+	}
+})], AppConfigState);
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: AppConfigState,
+	decorators: [{ type: Injectable }],
+	propDecorators: { set: [] }
+});
+var IdentityApiClient = class IdentityApiClient {
+	http = inject(HttpClient);
+	store = inject(Store);
+	get manifest() {
+		const m = this.store.selectSnapshot(AppConfigState.manifest);
+		if (!m) throw new Error("ApiManifest not loaded — call AppInitService.load() first");
+		return m;
+	}
+	login(identifier, password) {
+		return this.http.post(this.manifest.auth.login, {
+			identifier,
+			password
+		});
+	}
+	refresh(refreshToken) {
+		return this.http.post(this.manifest.auth.refresh, { refreshToken });
+	}
+	logout() {
+		return this.http.post(this.manifest.auth.logout, {});
+	}
+	me() {
+		return this.http.get(this.manifest.auth.me);
+	}
+	getSettings() {
+		return this.http.get(this.manifest.identity.settingsUrl, { headers: { Accept: "application/json" } });
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: IdentityApiClient,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: IdentityApiClient,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: IdentityApiClient,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+var RealtimeTokenClient = class RealtimeTokenClient {
+	http = inject(HttpClient);
+	store = inject(Store);
+	get manifest() {
+		const m = this.store.selectSnapshot(AppConfigState.manifest);
+		if (!m) throw new Error("ApiManifest not loaded — call AppInitService.load() first");
+		return m;
+	}
+	connectionToken() {
+		return this.http.post(this.manifest.apiBase + "/centrifugo/connection-token", {});
+	}
+	subscriptionToken(channel) {
+		return this.http.post(this.manifest.apiBase + "/centrifugo/subscription-token", { channel });
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RealtimeTokenClient,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RealtimeTokenClient,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: RealtimeTokenClient,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+var Login = class {
+	identifier;
+	password;
+	static type = "[Auth] Login";
+	constructor(identifier, password) {
+		this.identifier = identifier;
+		this.password = password;
+	}
+};
+var Logout = class {
+	static type = "[Auth] Logout";
+};
+var RestoreSession = class {
+	static type = "[Auth] Restore Session";
+};
+var SetTokens = class {
+	response;
+	static type = "[Auth] Set Tokens";
+	constructor(response) {
+		this.response = response;
+	}
+};
+var PatchCurrentUser = class {
+	patch;
+	static type = "[Auth] Patch Current User";
+	constructor(patch) {
+		this.patch = patch;
+	}
+};
+var UserPreferencesService = class UserPreferencesService {
+	http = inject(HttpClient);
+	store = inject(Store);
+	destroyRef = inject(DestroyRef);
+	STORAGE_KEY = "coolms_ui_prefs";
+	SYNC_DELAY = 2e3;
+	syncSubject = new Subject();
+	constructor() {
+		this.syncSubject.pipe(debounceTime(this.SYNC_DELAY), takeUntilDestroyed(this.destroyRef)).subscribe((prefs) => this.syncToServer(prefs));
+	}
+	save(all) {
+		localStorage.setItem(this.STORAGE_KEY, JSON.stringify(all));
+		this.syncSubject.next(all);
+	}
+	load() {
+		try {
+			const raw = localStorage.getItem(this.STORAGE_KEY);
+			const all = raw ? JSON.parse(raw) : {};
+			return this.migrate(all);
+		} catch {
+			return {};
+		}
+	}
+	migrate(all) {
+		let dirty = false;
+		if (typeof all["terminal_height"] === "number") {
+			const terminal = all["terminal"] ?? {};
+			terminal["height"] = all["terminal_height"];
+			all["terminal"] = terminal;
+			delete all["terminal_height"];
+			dirty = true;
+		}
+		if (typeof all["media_view_mode"] === "string") {
+			const page = all["page"] ?? {};
+			const media = page["media"] ?? {};
+			media["viewMode"] = all["media_view_mode"];
+			page["media"] = media;
+			all["page"] = page;
+			delete all["media_view_mode"];
+			dirty = true;
+		}
+		if (all["media_collections_panel"] && typeof all["media_collections_panel"] === "object") {
+			const panel = all["panel"] ?? {};
+			panel["media_panel_left"] = all["media_collections_panel"];
+			all["panel"] = panel;
+			delete all["media_collections_panel"];
+			dirty = true;
+		}
+		const NAMESPACES = /* @__PURE__ */ new Set([
+			"grids",
+			"panel",
+			"page",
+			"terminal",
+			"nav"
+		]);
+		for (const ns of NAMESPACES) if (Array.isArray(all[ns])) {
+			all[ns] = {};
+			dirty = true;
+		}
+		for (const key of Object.keys(all)) {
+			if (NAMESPACES.has(key)) continue;
+			const val = all[key];
+			if (val && typeof val === "object" && !Array.isArray(val)) {
+				const obj = val;
+				if ("columns" in obj || "columnWidths" in obj) {
+					const grids = all["grids"] ?? {};
+					grids[key] = obj;
+					all["grids"] = grids;
+					delete all[key];
+					dirty = true;
+				}
+			}
+		}
+		if (dirty) localStorage.setItem(this.STORAGE_KEY, JSON.stringify(all));
+		return all;
+	}
+	loadFromServer(uiPrefs) {
+		if (Object.keys(uiPrefs).length === 0) return;
+		try {
+			const raw = localStorage.getItem(this.STORAGE_KEY);
+			if (!raw) localStorage.setItem(this.STORAGE_KEY, JSON.stringify(uiPrefs));
+			else {
+				const local = JSON.parse(raw);
+				const merged = {
+					...uiPrefs,
+					...local
+				};
+				localStorage.setItem(this.STORAGE_KEY, JSON.stringify(merged));
+			}
+		} catch {
+			localStorage.setItem(this.STORAGE_KEY, JSON.stringify(uiPrefs));
+		}
+	}
+	syncToServer(prefs) {
+		const url = this.store.selectSnapshot(AppConfigState.manifest)?.auth?.preferencesUrl;
+		if (!url) return;
+		this.http.patch(url, { uiPrefs: prefs }, { headers: { "Content-Type": "application/merge-patch+json" } }).subscribe({ error: (err) => console.warn("Preferences sync failed:", err) });
+	}
+	getGridPref(gridId) {
+		try {
+			const grids = this.load()["grids"];
+			if (!grids) return null;
+			return grids[gridId] ?? null;
+		} catch {
+			return null;
+		}
+	}
+	setColumns(gridId, columns) {
+		this.updateGrid(gridId, (existing) => ({
+			...existing,
+			columns
+		}));
+	}
+	setColumnWidth(gridId, field, width) {
+		this.updateGrid(gridId, (existing) => ({
+			...existing,
+			columnWidths: {
+				...existing.columnWidths ?? {},
+				[field]: Math.max(60, width)
+			}
+		}));
+	}
+	resetGrid(gridId) {
+		const all = this.load();
+		const grids = all["grids"] ?? {};
+		delete grids[gridId];
+		all["grids"] = grids;
+		this.save(all);
+		this.syncToServer(all);
+	}
+	updateGrid(gridId, updater) {
+		const all = this.load();
+		const grids = all["grids"] ?? {};
+		grids[gridId] = updater(grids[gridId] ?? {});
+		all["grids"] = grids;
+		this.save(all);
+	}
+	getTerminalHeight() {
+		const terminal = this.load()["terminal"];
+		return typeof terminal?.["height"] === "number" ? terminal["height"] : null;
+	}
+	setTerminalHeight(height) {
+		const all = this.load();
+		const terminal = all["terminal"] ?? {};
+		terminal["height"] = Math.round(height);
+		all["terminal"] = terminal;
+		this.save(all);
+	}
+	getPanelState(key) {
+		try {
+			const panel = this.load()["panel"];
+			if (!panel) return null;
+			const p = panel[key];
+			if (!p || typeof p !== "object") return null;
+			const { width, collapsed } = p;
+			return typeof width === "number" && typeof collapsed === "boolean" ? {
+				width,
+				collapsed
+			} : null;
+		} catch {
+			return null;
+		}
+	}
+	setPanelState(key, width, collapsed) {
+		const all = this.load();
+		const panel = all["panel"] ?? {};
+		panel[key] = {
+			width: Math.round(width),
+			collapsed
+		};
+		all["panel"] = panel;
+		this.save(all);
+	}
+	getPageState(pageKey) {
+		try {
+			const page = this.load()["page"];
+			if (!page) return null;
+			return page[pageKey] ?? null;
+		} catch {
+			return null;
+		}
+	}
+	setPageState(pageKey, state) {
+		const all = this.load();
+		const page = all["page"] ?? {};
+		page[pageKey] = {
+			...page[pageKey] ?? {},
+			...state
+		};
+		all["page"] = page;
+		this.save(all);
+	}
+	getMediaViewMode() {
+		return this.getPageState("media")?.viewMode ?? null;
+	}
+	setMediaViewMode(mode) {
+		this.setPageState("media", { viewMode: mode });
+	}
+	getMediaCollectionsPanel() {
+		return this.getPanelState("media_panel_left");
+	}
+	setMediaCollectionsPanel(width, collapsed) {
+		this.setPanelState("media_panel_left", width, collapsed);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: UserPreferencesService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: UserPreferencesService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: UserPreferencesService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}],
+	ctorParameters: () => []
+});
+const STORAGE_KEY$2 = "coolms_token";
 let AuthState = class AuthState {
-    // `inject()` rather than constructor parameters, and the imports above are
-    // VALUE imports on purpose: an injected type must survive to runtime. As a
-    // constructor parameter that is invisible to `tsc`, which type-checks a
-    // type-only import happily and leaves the Angular compiler to fail with
-    // NG2003. Read as a value here, so the same mistake is a type error.
-    api = inject(IdentityApiClient);
-    prefs = inject(UserPreferencesService);
-    login(ctx, { identifier, password }) {
-        return this.api.login(identifier, password).pipe(tap((res) => {
-            const state = {
-                accessToken: res.accessToken,
-                refreshToken: res.refreshToken,
-                expiresAt: res.expiresAt,
-                user: res.user ?? null,
-            };
-            ctx.setState(state);
-            localStorage.setItem(STORAGE_KEY$1, JSON.stringify(state));
-        }), 
-        // Fetch full user data (includes uiPrefs) to seed preferences
-        switchMap(() => this.api.me().pipe(catchError(() => of(null)))), tap(me => {
-            if (!me)
-                return;
-            // Update stored user with full data including uiPrefs
-            const updated = { ...ctx.getState(), user: me };
-            ctx.setState(updated);
-            localStorage.setItem(STORAGE_KEY$1, JSON.stringify(updated));
-            if (me.uiPrefs) {
-                this.prefs.loadFromServer(me.uiPrefs);
-            }
-        }));
-    }
-    logout(ctx) {
-        ctx.setState({ accessToken: null, refreshToken: null, expiresAt: null, user: null });
-        localStorage.removeItem(STORAGE_KEY$1);
-    }
-    restore(ctx) {
-        const raw = localStorage.getItem(STORAGE_KEY$1);
-        if (!raw)
-            return;
-        try {
-            const state = JSON.parse(raw);
-            // Restore whenever any token is present.
-            // If only the access token has expired but the refresh token is still
-            // valid, the HTTP interceptor will transparently refresh on the next
-            // request.  Discarding state here would throw away the refresh token
-            // and force a full re-login unnecessarily.
-            if (state.accessToken || state.refreshToken) {
-                ctx.setState(state);
-                // Seed preferences from previously stored user (covers page-reload case)
-                if (state.user?.uiPrefs) {
-                    this.prefs.loadFromServer(state.user.uiPrefs);
-                }
-            }
-            else {
-                localStorage.removeItem(STORAGE_KEY$1);
-            }
-        }
-        catch {
-            localStorage.removeItem(STORAGE_KEY$1);
-        }
-    }
-    setTokens(ctx, { response }) {
-        const state = {
-            accessToken: response.accessToken,
-            refreshToken: response.refreshToken,
-            expiresAt: response.expiresAt,
-            user: response.user ?? ctx.getState().user,
-        };
-        ctx.setState(state);
-        localStorage.setItem(STORAGE_KEY$1, JSON.stringify(state));
-    }
-    patchCurrentUser(ctx, { patch }) {
-        const current = ctx.getState();
-        if (!current.user)
-            return;
-        const updated = { ...current, user: { ...current.user, ...patch } };
-        ctx.setState(updated);
-        localStorage.setItem(STORAGE_KEY$1, JSON.stringify(updated));
-    }
-    static isAuthenticated(state) {
-        return null !== state.accessToken;
-    }
-    static accessToken(state) {
-        return state.accessToken;
-    }
-    static refreshToken(state) {
-        return state.refreshToken;
-    }
-    /**
-     * Sub-phase Y -- expose the access-token expiry timestamp so
-     * preemptive-refresh callers (e.g., Centrifuge getToken
-     * callbacks) can decide whether to rotate before issuing the
-     * next protected request, instead of relying on the
-     * interceptor's reactive 401-retry path.
-     */
-    static expiresAt(state) {
-        return state.expiresAt;
-    }
-    static currentUser(state) {
-        return state.user;
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState });
+	api = inject(IdentityApiClient);
+	prefs = inject(UserPreferencesService);
+	login(ctx, { identifier, password }) {
+		return this.api.login(identifier, password).pipe(tap$1((res) => {
+			const state = {
+				accessToken: res.accessToken,
+				refreshToken: res.refreshToken,
+				expiresAt: res.expiresAt,
+				user: res.user ?? null
+			};
+			ctx.setState(state);
+			localStorage.setItem(STORAGE_KEY$2, JSON.stringify(state));
+		}), switchMap$1(() => this.api.me().pipe(catchError(() => of(null)))), tap$1((me) => {
+			if (!me) return;
+			const updated = {
+				...ctx.getState(),
+				user: me
+			};
+			ctx.setState(updated);
+			localStorage.setItem(STORAGE_KEY$2, JSON.stringify(updated));
+			if (me.uiPrefs) this.prefs.loadFromServer(me.uiPrefs);
+		}));
+	}
+	logout(ctx) {
+		ctx.setState({
+			accessToken: null,
+			refreshToken: null,
+			expiresAt: null,
+			user: null
+		});
+		localStorage.removeItem(STORAGE_KEY$2);
+	}
+	restore(ctx) {
+		const raw = localStorage.getItem(STORAGE_KEY$2);
+		if (!raw) return;
+		try {
+			const state = JSON.parse(raw);
+			if (state.accessToken || state.refreshToken) {
+				ctx.setState(state);
+				if (state.user?.uiPrefs) this.prefs.loadFromServer(state.user.uiPrefs);
+			} else localStorage.removeItem(STORAGE_KEY$2);
+		} catch {
+			localStorage.removeItem(STORAGE_KEY$2);
+		}
+	}
+	setTokens(ctx, { response }) {
+		const state = {
+			accessToken: response.accessToken,
+			refreshToken: response.refreshToken,
+			expiresAt: response.expiresAt,
+			user: response.user ?? ctx.getState().user
+		};
+		ctx.setState(state);
+		localStorage.setItem(STORAGE_KEY$2, JSON.stringify(state));
+	}
+	patchCurrentUser(ctx, { patch }) {
+		const current = ctx.getState();
+		if (!current.user) return;
+		const updated = {
+			...current,
+			user: {
+				...current.user,
+				...patch
+			}
+		};
+		ctx.setState(updated);
+		localStorage.setItem(STORAGE_KEY$2, JSON.stringify(updated));
+	}
+	static isAuthenticated(state) {
+		return null !== state.accessToken;
+	}
+	static accessToken(state) {
+		return state.accessToken;
+	}
+	static refreshToken(state) {
+		return state.refreshToken;
+	}
+	static expiresAt(state) {
+		return state.expiresAt;
+	}
+	static currentUser(state) {
+		return state.user;
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AuthState,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AuthState
+	});
 };
-__decorate([
-    Action(Login)
-], AuthState.prototype, "login", null);
-__decorate([
-    Action(Logout)
-], AuthState.prototype, "logout", null);
-__decorate([
-    Action(RestoreSession)
-], AuthState.prototype, "restore", null);
-__decorate([
-    Action(SetTokens)
-], AuthState.prototype, "setTokens", null);
-__decorate([
-    Action(PatchCurrentUser)
-], AuthState.prototype, "patchCurrentUser", null);
-__decorate([
-    Selector()
-], AuthState, "isAuthenticated", null);
-__decorate([
-    Selector()
-], AuthState, "accessToken", null);
-__decorate([
-    Selector()
-], AuthState, "refreshToken", null);
-__decorate([
-    Selector()
-], AuthState, "expiresAt", null);
-__decorate([
-    Selector()
-], AuthState, "currentUser", null);
-AuthState = __decorate([
-    State({
-        name: 'auth',
-        defaults: { accessToken: null, refreshToken: null, expiresAt: null, user: null },
-    })
-], AuthState);
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState, decorators: [{
-            type: Injectable
-        }], propDecorators: { login: [], logout: [], restore: [], setTokens: [], patchCurrentUser: [] } });
-
-const LOCK_NAME = 'coolms_auth_refresh';
-const FRESH_TOKEN_GRACE_MS = 30_000;
-/**
- * Two-layer refresh coordinator: an intra-tab `shareReplay(1)`
- * mutex dedupes concurrent callers within one tab, and a
- * cross-tab `navigator.locks` wrapper ensures only one tab in
- * the browser issues the actual `POST /auth/refresh` at a time.
- *
- * Without the cross-tab layer, two tabs racing the same expired
- * refresh-token both POST `/auth/refresh`; the backend's
- * `isUsed` replay branch revokes every token for the user on
- * the second arrival and the operator is kicked to /login.
- *
- * The Web Lock body re-reads the current access-token expiry from
- * `AuthState` before issuing the HTTP call. When this tab waited
- * behind another tab's refresh, that tab's `SetTokens` dispatch
- * has already published fresh values into shared `localStorage`,
- * `CrossTabAuthSyncService` has mirrored them into this tab's
- * NGXS state, and the lock body simply returns the cached access
- * token without another network round-trip.
- *
- * `Logout` fires only when the refresh endpoint returns 401
- * (real auth failure). Transient errors (network blips, 5xx,
- * CORS, timeouts) propagate without clearing the session so a
- * momentary refresh failure does not kill a valid login.
- */
-class AuthRefreshCoordinator {
-    api = inject(IdentityApiClient);
-    store = inject(Store);
-    router = inject(Router);
-    inFlight = null;
-    /**
-     * Return the in-flight refresh Observable, or spawn a new one
-     * with the supplied refresh-token value.
-     *
-     * Callers subscribe via `switchMap` / `firstValueFrom` to retry
-     * their original request with the resolved access token.
-     */
-    refresh(refreshToken) {
-        if (this.inFlight) {
-            return this.inFlight;
-        }
-        this.inFlight = defer(() => this.refreshWithCrossTabLock(refreshToken)).pipe(catchError(refreshErr => {
-            const isAuthFailure = refreshErr instanceof HttpErrorResponse && refreshErr.status === 401;
-            if (isAuthFailure) {
-                this.store.dispatch(new Logout());
-                if (this.router.navigated) {
-                    void this.router.navigate(['/login']);
-                }
-            }
-            return throwError(() => refreshErr);
-        }), shareReplay(1), finalize(() => {
-            this.inFlight = null;
-        }));
-        return this.inFlight;
-    }
-    /**
-     * Run the refresh body inside `navigator.locks` when the API is
-     * available; degrade to direct invocation otherwise. The lock
-     * body checks for state already updated by a sibling tab before
-     * issuing its own HTTP call.
-     */
-    refreshWithCrossTabLock(refreshToken) {
-        const lockBody = () => this.executeRefresh(refreshToken);
-        if (typeof navigator === 'undefined' || !('locks' in navigator)) {
-            return from(lockBody());
-        }
-        return from(navigator.locks.request(LOCK_NAME, lockBody).then(value => {
-            if (value === undefined) {
-                throw new Error('Refresh lock aborted before completing.');
-            }
-            return value;
-        }));
-    }
-    /**
-     * Lock body. Re-reads `AuthState.expiresAt` first: if another
-     * tab published fresh tokens while we were queued, return the
-     * cached access token directly. Otherwise read the latest
-     * refresh-token value from state (it may have rotated while we
-     * waited) and issue the HTTP refresh.
-     */
-    async executeRefresh(originalRefreshToken) {
-        const cachedAccess = this.tryConsumeFreshState();
-        if (cachedAccess !== null) {
-            return cachedAccess;
-        }
-        const currentRefreshToken = this.store.selectSnapshot(AuthState.refreshToken) ?? originalRefreshToken;
-        const response = await firstValueFrom(this.api.refresh(currentRefreshToken));
-        this.store.dispatch(new SetTokens(response));
-        return response.accessToken;
-    }
-    /**
-     * Return the cached access token when `AuthState.expiresAt` has
-     * more than `FRESH_TOKEN_GRACE_MS` milliseconds remaining --
-     * signalling that some other tab refreshed for us. Null
-     * otherwise.
-     */
-    tryConsumeFreshState() {
-        const accessToken = this.store.selectSnapshot(AuthState.accessToken);
-        const expiresAtStr = this.store.selectSnapshot(AuthState.expiresAt);
-        if (accessToken === null || expiresAtStr === null) {
-            return null;
-        }
-        const expiresAtMs = new Date(expiresAtStr).getTime();
-        if (Number.isNaN(expiresAtMs)) {
-            return null;
-        }
-        if (Date.now() < expiresAtMs - FRESH_TOKEN_GRACE_MS) {
-            return accessToken;
-        }
-        return null;
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-// -- Opt-out context token -----------------------------------------------------
-//
-// Set BYPASS_AUTH to true on any HttpRequest to skip adding the Authorization
-// header entirely.  Used by AppInitService for the bootstrap config request so
-// that a stale localStorage token does not cause a 401 on a public endpoint.
+__decorate([Action(Login)], AuthState.prototype, "login", null);
+__decorate([Action(Logout)], AuthState.prototype, "logout", null);
+__decorate([Action(RestoreSession)], AuthState.prototype, "restore", null);
+__decorate([Action(SetTokens)], AuthState.prototype, "setTokens", null);
+__decorate([Action(PatchCurrentUser)], AuthState.prototype, "patchCurrentUser", null);
+__decorate([Selector()], AuthState, "isAuthenticated", null);
+__decorate([Selector()], AuthState, "accessToken", null);
+__decorate([Selector()], AuthState, "refreshToken", null);
+__decorate([Selector()], AuthState, "expiresAt", null);
+__decorate([Selector()], AuthState, "currentUser", null);
+AuthState = __decorate([State({
+	name: "auth",
+	defaults: {
+		accessToken: null,
+		refreshToken: null,
+		expiresAt: null,
+		user: null
+	}
+})], AuthState);
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: AuthState,
+	decorators: [{ type: Injectable }],
+	propDecorators: {
+		login: [],
+		logout: [],
+		restore: [],
+		setTokens: [],
+		patchCurrentUser: []
+	}
+});
+const LOCK_NAME = "coolms_auth_refresh";
+const FRESH_TOKEN_GRACE_MS = 3e4;
+const STORAGE_KEY$1 = "coolms_token";
+var AuthRefreshCoordinator = class AuthRefreshCoordinator {
+	api = inject(IdentityApiClient);
+	store = inject(Store);
+	router = inject(Router);
+	inFlight = null;
+	refresh(refreshToken, refusedAccessToken = null) {
+		if (this.inFlight) return this.inFlight;
+		this.inFlight = defer(() => this.refreshWithCrossTabLock(refreshToken, refusedAccessToken)).pipe(catchError((refreshErr) => {
+			if (refreshErr instanceof HttpErrorResponse && refreshErr.status === 401) {
+				this.store.dispatch(new Logout());
+				if (this.router.navigated) this.router.navigate(["/login"]);
+			}
+			return throwError(() => refreshErr);
+		}), shareReplay(1), finalize(() => {
+			this.inFlight = null;
+		}));
+		return this.inFlight;
+	}
+	refreshWithCrossTabLock(refreshToken, refusedAccessToken) {
+		const lockBody = () => this.executeRefresh(refreshToken, refusedAccessToken);
+		if (typeof navigator === "undefined" || !("locks" in navigator)) return from(lockBody());
+		return from(navigator.locks.request(LOCK_NAME, lockBody).then((value) => {
+			if (value === void 0) throw new Error("Refresh lock aborted before completing.");
+			return value;
+		}));
+	}
+	async executeRefresh(originalRefreshToken, refusedAccessToken) {
+		const shared = this.readShared();
+		if (refusedAccessToken !== null) {
+			if (shared !== null && shared.accessToken !== refusedAccessToken) {
+				if (this.store.selectSnapshot(AuthState.accessToken) !== shared.accessToken) this.store.dispatch(new SetTokens(shared));
+				return shared.accessToken;
+			}
+		} else {
+			const cachedAccess = this.tryConsumeFreshState(shared);
+			if (cachedAccess !== null) return cachedAccess;
+		}
+		const currentRefreshToken = shared?.refreshToken ?? this.store.selectSnapshot(AuthState.refreshToken) ?? originalRefreshToken;
+		const response = await firstValueFrom(this.api.refresh(currentRefreshToken));
+		this.store.dispatch(new SetTokens(response));
+		return response.accessToken;
+	}
+	readShared() {
+		let raw;
+		try {
+			raw = localStorage.getItem(STORAGE_KEY$1);
+		} catch {
+			return null;
+		}
+		if (raw === null) return null;
+		try {
+			const parsed = JSON.parse(raw);
+			if (typeof parsed?.accessToken !== "string" || typeof parsed.refreshToken !== "string" || typeof parsed.expiresAt !== "string") return null;
+			return {
+				accessToken: parsed.accessToken,
+				refreshToken: parsed.refreshToken,
+				expiresAt: parsed.expiresAt
+			};
+		} catch {
+			return null;
+		}
+	}
+	tryConsumeFreshState(shared) {
+		const accessToken = shared?.accessToken ?? this.store.selectSnapshot(AuthState.accessToken);
+		const expiresAtStr = shared?.expiresAt ?? this.store.selectSnapshot(AuthState.expiresAt);
+		if (accessToken === null || expiresAtStr === null) return null;
+		const expiresAtMs = new Date(expiresAtStr).getTime();
+		if (Number.isNaN(expiresAtMs)) return null;
+		if (Date.now() >= expiresAtMs - FRESH_TOKEN_GRACE_MS) return null;
+		if (shared !== null && this.store.selectSnapshot(AuthState.accessToken) !== shared.accessToken) this.store.dispatch(new SetTokens(shared));
+		return accessToken;
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AuthRefreshCoordinator,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AuthRefreshCoordinator,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: AuthRefreshCoordinator,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
 const BYPASS_AUTH = new HttpContextToken(() => false);
-// -----------------------------------------------------------------------------
 const authInterceptor = (req, next) => {
-    const store = inject(Store);
-    const router = inject(Router);
-    const coordinator = inject(AuthRefreshCoordinator);
-    const initService = inject(AppInitService);
-    // Caller explicitly requested no auth header (e.g. the bootstrap config
-    // fetch — the endpoint is public and a stale token would cause 401).
-    if (req.context.get(BYPASS_AUTH)) {
-        return next(req);
-    }
-    // Auth endpoints are public by design.  The backend's JWT firewall rejects any
-    // request that carries an invalid/expired Bearer token — even on endpoints
-    // that would otherwise allow anonymous access — so never forward a stored
-    // token to login or refresh.
-    if (req.url.includes('/auth/login') || req.url.includes('/auth/refresh')) {
-        return next(req);
-    }
-    // Queue behind AppInitService.ready$ so that token restoration from
-    // localStorage (RestoreSession) is guaranteed to be in NGXS state before
-    // we read it.  On F5 the interceptor fires synchronously for every pending
-    // request before APP_INITIALIZER has completed; without this guard the
-    // token snapshot is null and every request gets a 401 -> refresh cycle even
-    // for a perfectly valid session.
-    //
-    // ready$ is a ReplaySubject(1) that completes after load() finishes, so:
-    //   - requests fired during init queue here and flush the moment ready$ emits;
-    //   - requests fired after init pass through take(1) immediately (replayed value).
-    return initService.ready$.pipe(take(1), switchMap$1(() => {
-        const token = store.selectSnapshot(AuthState.accessToken);
-        const authed = token
-            ? req.clone({ setHeaders: { Authorization: `Bearer ${token}` } })
-            : req;
-        return next(authed).pipe(catchError((err) => {
-            if (!(err instanceof HttpErrorResponse) || err.status !== 401) {
-                return throwError(() => err);
-            }
-            // Avoid infinite loop — skip refresh for auth endpoints themselves.
-            if (req.url.includes('/auth/refresh') || req.url.includes('/auth/login')) {
-                return throwError(() => err);
-            }
-            const refreshToken = store.selectSnapshot(AuthState.refreshToken);
-            if (!refreshToken) {
-                store.dispatch(new Logout());
-                // Only navigate programmatically once the router has already
-                // completed its initial navigation.  During APP_INITIALIZER the
-                // router is still blocked; authGuard handles the redirect there.
-                if (router.navigated)
-                    void router.navigate(['/login']);
-                return throwError(() => err);
-            }
-            // Delegate refresh to the shared coordinator so the
-            // Centrifuge getToken path and the interceptor share ONE
-            // in-flight refresh. Without this, two parallel
-            // `api.refresh(refreshToken)` calls (one from each mutex)
-            // would send the same refresh-token twice and trigger the
-            // backend's `isUsed` replay branch on the second arrival,
-            // wiping the whole session.
-            return coordinator.refresh(refreshToken).pipe(switchMap$1(newToken => next(req.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } }))));
-        }));
-    }));
+	const store = inject(Store);
+	const router = inject(Router);
+	const coordinator = inject(AuthRefreshCoordinator);
+	const initService = inject(AppInitService);
+	if (req.context.get(BYPASS_AUTH)) return next(req);
+	if (req.url.includes("/auth/login") || req.url.includes("/auth/refresh")) return next(req);
+	return initService.ready$.pipe(take(1), switchMap(() => {
+		const token = store.selectSnapshot(AuthState.accessToken);
+		return next(token ? req.clone({ setHeaders: { Authorization: `Bearer ${token}` } }) : req).pipe(catchError((err) => {
+			if (!(err instanceof HttpErrorResponse) || err.status !== 401) return throwError(() => err);
+			if (req.url.includes("/auth/refresh") || req.url.includes("/auth/login")) return throwError(() => err);
+			const refreshToken = store.selectSnapshot(AuthState.refreshToken);
+			if (!refreshToken) {
+				store.dispatch(new Logout());
+				if (router.navigated) router.navigate(["/login"]);
+				return throwError(() => err);
+			}
+			return coordinator.refresh(refreshToken, token).pipe(switchMap((newToken) => next(req.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } }))));
+		}));
+	}));
 };
-
-const STORAGE_KEY = 'coolms_token';
-/**
- * Bridges shared `localStorage` mutations into the NGXS auth
- * state so a refresh executed in one tab silently propagates to
- * every other open tab.
- *
- * The browser fires `storage` events in tabs OTHER than the one
- * that mutated `localStorage`. So when Tab A's
- * `AuthRefreshCoordinator` rotates the token pair and `SetTokens`
- * persists the new values, every sibling tab receives an event
- * here and dispatches `SetTokens` against its own NGXS state --
- * no extra HTTP roundtrip, no extra refresh contention.
- *
- * Pairs with the `navigator.locks` cross-tab mutex in
- * `AuthRefreshCoordinator`: locks ensure only one tab issues the
- * refresh, this listener propagates the result to the rest.
- *
- * `Logout` from any tab clears `coolms_token` (newValue === null)
- * and this listener mirrors that into the sibling tabs so the
- * shell redirects to `/login` without waiting for the next
- * protected request to 401.
- *
- * Started from `AppInitService.load()` so the listener is in
- * place before any protected HTTP fires.
- */
-class CrossTabAuthSyncService {
-    store = inject(Store);
-    listenerAttached = false;
-    start() {
-        if (this.listenerAttached) {
-            return;
-        }
-        this.listenerAttached = true;
-        window.addEventListener('storage', this.handleStorageEvent);
-    }
-    handleStorageEvent = (event) => {
-        if (event.key !== STORAGE_KEY) {
-            return;
-        }
-        // Sibling tab cleared the key (logout dispatch or
-        // RestoreSession parse-error cleanup). Mirror the clear so
-        // this tab does not keep operating against a revoked
-        // server-side session.
-        if (event.newValue === null) {
-            this.store.dispatch(new Logout());
-            return;
-        }
-        // Parse the new value and dispatch SetTokens so this tab's
-        // in-memory NGXS state reflects what the originating tab
-        // just wrote. Malformed payloads are ignored.
-        let parsed;
-        try {
-            parsed = JSON.parse(event.newValue);
-        }
-        catch {
-            return;
-        }
-        if (typeof parsed.accessToken !== 'string' || typeof parsed.refreshToken !== 'string' || typeof parsed.expiresAt !== 'string') {
-            return;
-        }
-        const tokenResponse = {
-            accessToken: parsed.accessToken,
-            refreshToken: parsed.refreshToken,
-            expiresAt: parsed.expiresAt,
-            user: parsed.user ?? undefined,
-        };
-        this.store.dispatch(new SetTokens(tokenResponse));
-    };
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-class AppInitService {
-    // Injected as values, not constructor parameters: an injection token has to
-    // exist at runtime, and a type-only import of one type-checks clean while
-    // the Angular compiler rejects it with NG2003.
-    http = inject(HttpClient);
-    store = inject(Store);
-    router = inject(Router);
-    location = inject(Location);
-    prefs = inject(UserPreferencesService);
-    crossTabSync = inject(CrossTabAuthSyncService);
-    refreshCoordinator = inject(AuthRefreshCoordinator);
-    /** The only hardcoded URL — everything else comes from the manifest. */
-    configUrl = '/api/v1/theme/config';
-    /**
-     * Emits (once) when load() has fully completed — tokens settled, manifest
-     * set (or swallowed on error).  authGuard subscribes to this so it never
-     * evaluates isAuthenticated against a partially-restored stale token.
-     */
-    initComplete = new ReplaySubject(1);
-    ready$ = this.initComplete.asObservable();
-    async load() {
-        // -- Step 0: cross-tab sync --------------------------------------------
-        //
-        // Install the storage-event listener before RestoreSession so that
-        // any localStorage mutation from a sibling tab during bootstrap
-        // (e.g., a parallel tab refreshing tokens just as we load) is mirrored
-        // into this tab's NGXS state.
-        this.crossTabSync.start();
-        // -- Step 1: restore tokens from localStorage --------------------------
-        //
-        // RestoreSession is synchronous (ctx.setState from localStorage), so
-        // this await resolves in the same microtask.  Tokens are in NGXS state
-        // before ANY subsequent HTTP request fires — the auth interceptor reads
-        // the token from state when attaching Authorization headers, so this
-        // ordering prevents unauthenticated requests on page reload (F5).
-        await firstValueFrom(this.store.dispatch(new RestoreSession()));
-        // -- Step 2: fetch the manifest ----------------------------------------
-        //
-        // BYPASS_AUTH is required here — not optional.  The manifest endpoint
-        // is public, but two specific failure modes make bypassing necessary:
-        //
-        //   a) The stored access token may be expired.  Without BYPASS_AUTH the
-        //      interceptor attaches the expired token, gets a 401, and tries to
-        //      refresh.  But the refresh endpoint URL comes from the manifest
-        //      (api.refresh() reads manifest.auth.refresh), which hasn't been
-        //      loaded yet — triggering a null-dereference crash before the app
-        //      can recover.
-        //
-        //   b) Even if the token is valid, attaching it to a public endpoint
-        //      that ignores auth adds unnecessary coupling.
-        //
-        // Consequence: every page load issues one unauthenticated config
-        // request, which is intentional.  All subsequent API calls carry the
-        // restored (or refreshed) token normally.
-        const config = await firstValueFrom(this.http.get(this.configUrl, {
-            context: new HttpContext().set(BYPASS_AUTH, true),
-        }).pipe(tap$1(cfg => this.store.dispatch(new SetAppConfig(cfg))), catchError(() => {
-            console.warn('CoolMS: theme/config unreachable, using safe defaults');
-            return of(null);
-        })));
-        // -- Step 3: validate the restored session -----------------------------
-        //
-        // RestoreSession trusts whatever tokens are in localStorage, but they may
-        // have been revoked out-of-band — most notably, signing out on the public
-        // SSR site revokes the user's WHOLE token set. We MUST settle the real
-        // auth state here, BEFORE step 4 signals ready$: both the auth interceptor
-        // AND authGuard gate on ready$, so if we signalled first, the guard would
-        // race ahead and mount the shell against the stale isAuthenticated=true
-        // before this probe finished (-> half-loaded shell + "Session expired"
-        // toasts, the exact bug this fixes). Because the probe itself cannot wait
-        // on ready$ (that would deadlock), validateSession() bypasses the
-        // interceptor and attaches the token / drives the refresh by hand.
-        const meUrl = config?.manifest.identity?.meUrl;
-        if (meUrl && this.store.selectSnapshot(AuthState.isAuthenticated)) {
-            await this.validateSession(meUrl);
-        }
-        // -- Step 4: signal authGuard + unblock the interceptor ----------------
-        //
-        // Auth state is now settled (session confirmed, refreshed, or Logout
-        // dispatched). ReplaySubject(1) replays to guards/requests that subscribe
-        // afterwards, so they evaluate against the final isAuthenticated value.
-        this.initComplete.next();
-        this.initComplete.complete();
-        // -- Step 5: navigate to last-visited route ----------------------------
-        //
-        // Only when the session survived validation. If it did not, isAuthenticated
-        // is now false, we skip the saved-route navigation, and authGuard sends the
-        // initial navigation to /login.
-        //
-        // Only restore when the user opened the bare /admin root. An explicit
-        // deep link (pasted /admin/sync-fleet, a bookmark, a shared URL) must
-        // win over the saved route. The router cannot tell us which one this is:
-        // withEnabledBlockingInitialNavigation holds the initial navigation until
-        // this initializer resolves, so router.url is still '/'. The browser
-        // location is the only record of what was requested — Location.path()
-        // reads it with the /admin base href stripped, so the bare root (with or
-        // without trailing slash) yields ''. Anything else, including a root URL
-        // carrying query params, is treated as an explicit destination.
-        if (this.store.selectSnapshot(AuthState.isAuthenticated)) {
-            const requested = this.location.path();
-            if (requested === '' || requested === '/') {
-                const saved = this.prefs.getPageState('nav');
-                if (saved?.lastRoute && !saved.lastRoute.startsWith('/login')) {
-                    void this.router.navigateByUrl(saved.lastRoute);
-                }
-            }
-        }
-    }
-    /**
-     * Confirm the restored session is still alive, settling AuthState before the
-     * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
-     * interceptor queues behind ready$, which has not fired yet at this point.
-     *
-     *   - access token accepted  -> done, session alive;
-     *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
-     *                              so an expired one with a valid refresh token must
-     *                              stay logged in). The coordinator dispatches Logout
-     *                              on a refresh 401 and SetTokens on success; a
-     *                              transient failure (5xx/network) is swallowed so a
-     *                              momentary blip never kills a valid session.
-     */
-    async validateSession(meUrl) {
-        const token = this.store.selectSnapshot(AuthState.accessToken);
-        if (await this.probe(meUrl, token)) {
-            return;
-        }
-        const refreshToken = this.store.selectSnapshot(AuthState.refreshToken);
-        if (!refreshToken) {
-            this.store.dispatch(new Logout());
-            return;
-        }
-        let refreshedToken = null;
-        try {
-            refreshedToken = await firstValueFrom(this.refreshCoordinator.refresh(refreshToken));
-        }
-        catch {
-            // 401 -> coordinator already dispatched Logout; transient -> session kept.
-            return;
-        }
-        // Refresh resolved — but the coordinator's fresh-state optimisation can hand
-        // back the SAME access token (without a network round-trip) when its stored
-        // expiry still looks fresh. For a token that was revoked but not yet expired
-        // (signing out on the SSR site while the access token is still in its TTL),
-        // that token is dead despite looking fresh. Re-probe with whatever we now
-        // hold; a second rejection means the session is genuinely gone.
-        if (!(await this.probe(meUrl, refreshedToken))) {
-            this.store.dispatch(new Logout());
-        }
-    }
-    /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
-    probe(url, token) {
-        return firstValueFrom(this.http.get(url, {
-            context: new HttpContext().set(BYPASS_AUTH, true),
-            headers: token ? { Authorization: `Bearer ${token}` } : {},
-        }).pipe(map(() => true), catchError(() => of(false))));
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * Protects routes that require authentication.
- *
- * The guard is intentionally ASYNC: it waits for AppInitService.ready$ before
- * evaluating auth state.  Without this, Angular's router can evaluate
- * isAuthenticated while APP_INITIALIZER is still in-flight — RestoreSession
- * will have placed a non-null (but expired) token in state, causing the guard
- * to pass even though the subsequent config/refresh requests will fail and
- * dispatch Logout.  Waiting for ready$ guarantees the auth state is settled.
- */
+const STORAGE_KEY = "coolms_token";
+var CrossTabAuthSyncService = class CrossTabAuthSyncService {
+	store = inject(Store);
+	listenerAttached = false;
+	start() {
+		if (this.listenerAttached) return;
+		this.listenerAttached = true;
+		window.addEventListener("storage", this.handleStorageEvent);
+	}
+	handleStorageEvent = (event) => {
+		if (event.key !== STORAGE_KEY) return;
+		if (event.newValue === null) {
+			this.store.dispatch(new Logout());
+			return;
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(event.newValue);
+		} catch {
+			return;
+		}
+		if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string" || typeof parsed.expiresAt !== "string") return;
+		const tokenResponse = {
+			accessToken: parsed.accessToken,
+			refreshToken: parsed.refreshToken,
+			expiresAt: parsed.expiresAt,
+			user: parsed.user ?? void 0
+		};
+		this.store.dispatch(new SetTokens(tokenResponse));
+	};
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: CrossTabAuthSyncService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: CrossTabAuthSyncService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: CrossTabAuthSyncService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+var AppInitService = class AppInitService {
+	http = inject(HttpClient);
+	store = inject(Store);
+	router = inject(Router);
+	location = inject(Location);
+	prefs = inject(UserPreferencesService);
+	crossTabSync = inject(CrossTabAuthSyncService);
+	refreshCoordinator = inject(AuthRefreshCoordinator);
+	configUrl = "/api/v1/theme/config";
+	initComplete = new ReplaySubject(1);
+	ready$ = this.initComplete.asObservable();
+	async load() {
+		this.crossTabSync.start();
+		await firstValueFrom(this.store.dispatch(new RestoreSession()));
+		const meUrl = (await firstValueFrom(this.http.get(this.configUrl, { context: new HttpContext().set(BYPASS_AUTH, true) }).pipe(tap((cfg) => this.store.dispatch(new SetAppConfig(cfg))), catchError(() => {
+			console.warn("CoolMS: theme/config unreachable, using safe defaults");
+			return of(null);
+		}))))?.manifest.identity?.meUrl;
+		if (meUrl && this.store.selectSnapshot(AuthState.isAuthenticated)) await this.validateSession(meUrl);
+		this.initComplete.next();
+		this.initComplete.complete();
+		if (this.store.selectSnapshot(AuthState.isAuthenticated)) {
+			const requested = this.location.path();
+			if (requested === "" || requested === "/") {
+				const saved = this.prefs.getPageState("nav");
+				if (saved?.lastRoute && !saved.lastRoute.startsWith("/login")) this.router.navigateByUrl(saved.lastRoute);
+			}
+		}
+	}
+	async validateSession(meUrl) {
+		const token = this.store.selectSnapshot(AuthState.accessToken);
+		if (await this.probe(meUrl, token)) return;
+		const refreshToken = this.store.selectSnapshot(AuthState.refreshToken);
+		if (!refreshToken) {
+			this.store.dispatch(new Logout());
+			return;
+		}
+		let refreshedToken = null;
+		try {
+			refreshedToken = await firstValueFrom(this.refreshCoordinator.refresh(refreshToken, token));
+		} catch {
+			return;
+		}
+		if (!await this.probe(meUrl, refreshedToken)) this.store.dispatch(new Logout());
+	}
+	probe(url, token) {
+		return firstValueFrom(this.http.get(url, {
+			context: new HttpContext().set(BYPASS_AUTH, true),
+			headers: token ? { Authorization: `Bearer ${token}` } : {}
+		}).pipe(map(() => true), catchError(() => of(false))));
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AppInitService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: AppInitService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: AppInitService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
 const authGuard = () => {
-    const init = inject(AppInitService);
-    const store = inject(Store);
-    const router = inject(Router);
-    return init.ready$.pipe(take(1), map(() => {
-        if (store.selectSnapshot(AuthState.isAuthenticated)) {
-            return true;
-        }
-        return router.createUrlTree(['/login']);
-    }));
+	const init = inject(AppInitService);
+	const store = inject(Store);
+	const router = inject(Router);
+	return init.ready$.pipe(take(1), map(() => {
+		if (store.selectSnapshot(AuthState.isAuthenticated)) return true;
+		return router.createUrlTree(["/login"]);
+	}));
 };
-
-/**
- * Guards the `/login` route -- redirects already-authenticated
- * callers to admin home so a stale tab parked on `/login` cannot
- * remain mounted while another tab is logged in. When Tab A logs
- * in fresh, Tab B's `RestoreSession` (driven by APP_INITIALIZER)
- * reads the new token from shared `localStorage` and populates
- * `AuthState`; this guard then sees `isAuthenticated === true`
- * and routes Tab B to `/`.
- *
- * Same `ready$` wait as `authGuard` -- ensures `RestoreSession`
- * has run before the snapshot is read; otherwise a fresh F5 on
- * `/login` with a valid stored session would briefly evaluate
- * as anonymous, allow `/login`, and only then have the token
- * populated.
- */
 const loginPageGuard = () => {
-    const init = inject(AppInitService);
-    const store = inject(Store);
-    const router = inject(Router);
-    return init.ready$.pipe(take(1), map(() => {
-        if (store.selectSnapshot(AuthState.isAuthenticated)) {
-            return router.createUrlTree(['/']);
-        }
-        return true;
-    }));
+	const init = inject(AppInitService);
+	const store = inject(Store);
+	const router = inject(Router);
+	return init.ready$.pipe(take(1), map(() => {
+		if (store.selectSnapshot(AuthState.isAuthenticated)) return router.createUrlTree(["/"]);
+		return true;
+	}));
 };
-
-class LoginComponent {
-    identifier = '';
-    password = '';
-    loading = false;
-    error = null;
-    store = inject(Store);
-    router = inject(Router);
-    submit() {
-        if (!this.identifier || !this.password)
-            return;
-        this.loading = true;
-        this.error = null;
-        this.store.dispatch(new Login(this.identifier, this.password)).subscribe({
-            next: () => {
-                // A rejected navigation used to vanish: nothing resets `loading`
-                // on the success path, because the page is expected to go
-                // away. If it does not, the form spins for ever with no reason
-                // given, so say so instead.
-                void this.router.navigate(['/']).catch(() => {
-                    this.loading = false;
-                    this.error = 'Signed in, but the admin could not be opened. Please reload.';
-                });
-            },
-            error: (err) => {
-                this.loading = false;
-                this.error = err?.error?.detail ?? err?.error?.message ?? err?.message ?? 'Invalid credentials. Please try again.';
-            },
-        });
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: LoginComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "22.1.3", type: LoginComponent, isStandalone: true, selector: "coolms-admin-login", ngImport: i0, template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n", dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox]):not([ngNoCva])[formControlName],textarea:not([ngNoCva])[formControlName],input:not([type=checkbox]):not([ngNoCva])[formControl],textarea:not([ngNoCva])[formControl],input:not([type=checkbox]):not([ngNoCva])[ngModel],textarea:not([ngNoCva])[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }] });
+const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
+const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
+const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
+const ELEVATION_PROMPT = new InjectionToken("coolms.elevation-prompt");
+const BYPASS_ELEVATION = new HttpContextToken(() => false);
+const CROSS_TAB_KEY = "coolms.elevation.changed";
+const RECONCILE_MIN_INTERVAL_MS = 2e3;
+const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
+var ElevationService = class ElevationService {
+	http = inject(HttpClient);
+	store = inject(Store);
+	prompt = inject(ELEVATION_PROMPT, { optional: true });
+	destroyRef = inject(DestroyRef);
+	served = signal(null, ...ngDevMode ? [{ debugName: "served" }] : /* istanbul ignore next */ []);
+	state = () => {
+		const served = this.served();
+		if (served === null || !isPast(served)) return served;
+		const expired = expiredView(served);
+		untracked(() => this.served.set(expired));
+		this.announceExpiryLater();
+		return expired;
+	};
+	elevated = () => this.state()?.elevated ?? false;
+	expiresAt = () => {
+		const iso = this.state()?.expiresAt;
+		return iso ? new Date(iso) : null;
+	};
+	changes$ = new Subject();
+	expiryTimer = null;
+	pendingPrompt = null;
+	expiryAnnouncePending = false;
+	lastReconcileAt = 0;
+	constructor() {
+		if (typeof window !== "undefined") {
+			window.addEventListener("storage", this.onStorage);
+			window.addEventListener("focus", this.onFocus);
+			if (typeof document !== "undefined") document.addEventListener("visibilitychange", this.onVisibilityChange);
+			this.destroyRef.onDestroy(() => {
+				window.removeEventListener("storage", this.onStorage);
+				window.removeEventListener("focus", this.onFocus);
+				if (typeof document !== "undefined") document.removeEventListener("visibilitychange", this.onVisibilityChange);
+				this.clearTimer();
+			});
+		}
+	}
+	get available() {
+		return this.url !== null;
+	}
+	get url() {
+		return this.store.selectSnapshot(AppConfigState.manifest)?.identity?.elevationUrl ?? null;
+	}
+	isThisApi(url) {
+		const apiBase = this.store.selectSnapshot(AppConfigState.manifest)?.apiBase ?? "/api/v1";
+		let path = url.split("?")[0];
+		if (/^https?:\/\//.test(path)) try {
+			const parsed = new URL(path);
+			if (typeof window !== "undefined" && parsed.host !== window.location.host) return false;
+			path = parsed.pathname;
+		} catch {
+			return false;
+		}
+		return path === apiBase || path.startsWith(`${apiBase}/`);
+	}
+	refresh() {
+		const url = this.url;
+		if (!url) return of(this.inert());
+		return this.http.get(url, this.options()).pipe(tap((s) => this.apply(s)));
+	}
+	elevate(password, code) {
+		const url = this.url;
+		if (!url) return of(this.inert());
+		const body = { password };
+		if (code) body.code = code;
+		return this.http.post(url, body, this.options()).pipe(tap((s) => this.apply(s, "granted")));
+	}
+	drop(reason = "dropped_by_user") {
+		const url = this.url;
+		if (!url) return of(this.inert());
+		return this.http.delete(`${url}?reason=${reason}`, this.options()).pipe(switchMap(() => this.refresh()));
+	}
+	offerFor(refusal) {
+		if (!this.available || !this.prompt) return of(false);
+		return this.refresh().pipe(switchMap((state) => state.elevated ? of(false) : this.requestElevation({
+			state,
+			refusal
+		})));
+	}
+	requestElevation(request) {
+		if (!this.prompt) return of(false);
+		if (this.pendingPrompt) return this.pendingPrompt;
+		const prompt = this.prompt;
+		this.pendingPrompt = defer(() => prompt.open(request)).pipe(finalize(() => {
+			this.pendingPrompt = null;
+		}), shareReplay(1));
+		return this.pendingPrompt;
+	}
+	options() {
+		return { context: new HttpContext().set(BYPASS_ELEVATION, true) };
+	}
+	inert() {
+		return {
+			elevated: false,
+			ended: {
+				reason: "never",
+				at: null
+			},
+			lifetimeSeconds: 0,
+			lifetimeCeilingSeconds: 0,
+			mfaRequired: false,
+			warnings: []
+		};
+	}
+	apply(next, explicit) {
+		const prev = untracked(() => this.served());
+		this.served.set(next);
+		this.schedule(next);
+		const kind = explicit ?? this.kindOf(prev, next);
+		if (kind === null) return;
+		this.expiryAnnouncePending = false;
+		this.changes$.next({
+			kind,
+			state: next
+		});
+		this.announceToOtherTabs();
+	}
+	kindOf(prev, next) {
+		const was = prev?.elevated ?? false;
+		if (was && !next.elevated) return next.ended.reason === "expired" ? "expired" : "dropped";
+		if (!was && next.elevated) return "granted";
+		if (was && next.elevated && (prev?.expiresAt ?? null) !== (next.expiresAt ?? null)) return "observed";
+		return null;
+	}
+	announceExpiryLater() {
+		if (this.expiryAnnouncePending) return;
+		this.expiryAnnouncePending = true;
+		queueMicrotask(() => {
+			if (!this.expiryAnnouncePending) return;
+			this.expiryAnnouncePending = false;
+			const state = untracked(() => this.served());
+			if (state !== null && !state.elevated) this.changes$.next({
+				kind: "expired",
+				state
+			});
+		});
+	}
+	schedule(state) {
+		this.clearTimer();
+		if (!state.elevated || !state.expiresAt) return;
+		const wanted = Date.parse(state.expiresAt) - Date.now() + 250;
+		const ms = Math.min(Math.max(1e3, wanted), 2147483647);
+		this.expiryTimer = setTimeout(() => {
+			this.expiryTimer = null;
+			this.refresh().subscribe({
+				next: (s) => {
+					if (s.elevated && s.expiresAt && Date.parse(s.expiresAt) <= Date.now()) this.scheduleRetry();
+				},
+				error: () => this.scheduleRetry()
+			});
+		}, ms);
+	}
+	scheduleRetry() {
+		this.clearTimer();
+		this.expiryTimer = setTimeout(() => {
+			this.expiryTimer = null;
+			this.refresh().subscribe({ error: () => void 0 });
+		}, 5e3);
+	}
+	clearTimer() {
+		if (this.expiryTimer !== null) {
+			clearTimeout(this.expiryTimer);
+			this.expiryTimer = null;
+		}
+	}
+	announceToOtherTabs() {
+		try {
+			localStorage.setItem(CROSS_TAB_KEY, String(Date.now()));
+		} catch {}
+	}
+	onStorage = (event) => {
+		if (event.key !== CROSS_TAB_KEY || !this.available) return;
+		this.refresh().subscribe({ error: () => void 0 });
+	};
+	onFocus = () => this.reconcile();
+	onVisibilityChange = () => {
+		if (document.visibilityState === "visible") this.reconcile();
+	};
+	reconcile() {
+		this.state();
+		if (!this.available) return;
+		const now = Date.now();
+		if (now - this.lastReconcileAt < RECONCILE_MIN_INTERVAL_MS) return;
+		this.lastReconcileAt = now;
+		this.refresh().subscribe({ error: () => void 0 });
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ElevationService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ElevationService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: ElevationService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}],
+	ctorParameters: () => []
+});
+function isPast(state) {
+	if (!state.elevated || !state.expiresAt) return false;
+	const at = Date.parse(state.expiresAt);
+	return Number.isFinite(at) && at <= Date.now();
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: LoginComponent, decorators: [{
-            type: Component,
-            args: [{ selector: 'coolms-admin-login', standalone: true, imports: [FormsModule, NgIf], template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n" }]
-        }] });
-
-/**
- * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
- *
- * Responses are cached for the lifetime of the service (Map + shareReplay(1))
- * so repeated calls never re-fetch the same resource.
- *
- * configBase is read from the API manifest (manifest.configBase) and falls
- * back to '/api/v1/config' when the manifest is not yet loaded.
- */
-class ConfigService {
-    http = inject(HttpClient);
-    store = inject(Store);
-    cache = new Map();
-    layout(id) { return this.fetch('layout', id); }
-    dialog(id) { return this.fetch('dialog', id); }
-    navigraph(slug) { return this.fetch('navigraph', slug); }
-    form(id) { return this.fetch('form', id); }
-    datagrid(id) { return this.fetch('datagrid', id); }
-    fetch(type, id) {
-        const key = `${type}/${id}`;
-        if (!this.cache.has(key)) {
-            const base = this.store.selectSnapshot(AppConfigState.manifest)?.configBase
-                ?? '/api/v1/config';
-            // The config endpoint wraps the YAML payload in a `data` field:
-            // { type, id, data: { ...yaml content... } }
-            // Unwrap so callers always receive the config payload directly.
-            const obs = this.http.get(`${base}/${type}/${id}`).pipe(map(r => (r.data ?? r)), shareReplay(1));
-            this.cache.set(key, obs);
-        }
-        return this.cache.get(key);
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, providedIn: 'root' });
+function expiredView(state) {
+	return {
+		...state,
+		elevated: false,
+		expiresAt: null,
+		grantedAt: null,
+		factorConfirmed: null,
+		ended: {
+			reason: "expired",
+			at: state.expiresAt ?? null
+		}
+	};
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * Converts any caught error into a human-readable message.
- *
- * Priority order for backend errors:
- *   1. error.detail              (RFC 7807 problem detail)
- *   2. error['hydra:description'] (Hydra validation errors)
- *   3. error.message             (generic)
- *   4. error.violations[]        (constraint violations)
- *   5. Status-based fallback
- */
-class ErrorHandlerService {
-    humanize(err) {
-        if (!(err instanceof HttpErrorResponse)) {
-            return err instanceof Error ? err.message : 'An unexpected error occurred.';
-        }
-        const body = err.error;
-        if (body && typeof body === 'object') {
-            const detail = body['detail'] ?? body['hydra:description'] ?? body['message'];
-            if (typeof detail === 'string' && detail.trim()) {
-                return detail.trim();
-            }
-            if (Array.isArray(body['violations'])) {
-                const msgs = body['violations']
-                    .map(v => v.message)
-                    .filter(Boolean);
-                if (msgs.length)
-                    return msgs.join(' ');
-            }
-        }
-        return this.statusMessage(err.status);
-    }
-    statusMessage(status) {
-        switch (status) {
-            case 0: return 'Network error. Check your connection.';
-            case 400: return 'Invalid request.';
-            case 401: return 'Session expired. Please sign in again.';
-            case 403: return 'Access denied.';
-            case 404: return 'Resource not found.';
-            case 409: return 'Conflict — resource already exists.';
-            case 422: return 'Validation failed.';
-            case 429: return 'Too many requests. Please wait a moment.';
-            case 500: return 'Server error. Please try again later.';
-            case 503: return 'Service unavailable. Please try again later.';
-            default: return `Unexpected error (${status}).`;
-        }
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-const CHOICES = ['light', 'dark', 'system'];
-/**
- * A CACHE, never a source of truth.
- *
- * The authoritative value is `preferences.theme` in `/auth/me/settings`, which
- * the Profile -> Preferences tab already writes. This copy exists only so the
- * first paint of a reload is the right colour: the settings request is async,
- * so without it every load would start light and flip. It is deliberately NOT
- * stored via UserPreferencesService, which syncs its own bag to the server —
- * that would give one setting two server-side homes.
- */
-const CACHE_KEY = 'coolms_theme';
-const ACCENT_CACHE_KEY = 'coolms_accent';
-/**
- * Six-digit hex only, checked again HERE even though the server already vets it
- * on write. This value is substituted into a `--cms-*` custom property,
- * and a stored setting is data from the network like any other — the write-side
- * guard protects what the admin stores, this one protects what it renders.
- */
+var ErrorHandlerService = class ErrorHandlerService {
+	humanize(err) {
+		if (!(err instanceof HttpErrorResponse)) return err instanceof Error ? err.message : "An unexpected error occurred.";
+		const body = err.error;
+		if (body && typeof body === "object") {
+			const detail = body["detail"] ?? body["hydra:description"] ?? body["message"];
+			if (typeof detail === "string" && detail.trim()) return detail.trim();
+			if (Array.isArray(body["violations"])) {
+				const msgs = body["violations"].map((v) => v.message).filter(Boolean);
+				if (msgs.length) return msgs.join(" ");
+			}
+		}
+		return this.statusMessage(err.status);
+	}
+	statusMessage(status) {
+		switch (status) {
+			case 0: return "Network error. Check your connection.";
+			case 400: return "Invalid request.";
+			case 401: return "Session expired. Please sign in again.";
+			case 403: return "Access denied.";
+			case 404: return "Resource not found.";
+			case 409: return "Conflict — resource already exists.";
+			case 422: return "Validation failed.";
+			case 429: return "Too many requests. Please wait a moment.";
+			case 500: return "Server error. Please try again later.";
+			case 503: return "Service unavailable. Please try again later.";
+			default: return `Unexpected error (${status}).`;
+		}
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ErrorHandlerService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ErrorHandlerService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: ErrorHandlerService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+const elevationInterceptor = (req, next) => {
+	const elevation = inject(ElevationService);
+	const errors = inject(ErrorHandlerService);
+	if (req.context.get(BYPASS_ELEVATION) || !elevation.isThisApi(req.url)) return next(req);
+	return next(req).pipe(catchError((err) => {
+		if (!(err instanceof HttpErrorResponse) || err.status !== 403 || !err.headers.get("X-Elevation-Required")) return throwError(() => err);
+		return elevation.offerFor(errors.humanize(err)).pipe(switchMap((granted) => granted ? next(req) : throwError(() => err)));
+	}));
+};
+var LoginComponent = class LoginComponent {
+	identifier = "";
+	password = "";
+	loading = false;
+	error = null;
+	store = inject(Store);
+	router = inject(Router);
+	submit() {
+		if (!this.identifier || !this.password) return;
+		this.loading = true;
+		this.error = null;
+		this.store.dispatch(new Login(this.identifier, this.password)).subscribe({
+			next: () => {
+				this.router.navigate(["/"]).catch(() => {
+					this.loading = false;
+					this.error = "Signed in, but the admin could not be opened. Please reload.";
+				});
+			},
+			error: (err) => {
+				this.loading = false;
+				this.error = err?.error?.detail ?? err?.error?.message ?? err?.message ?? "Invalid credentials. Please try again.";
+			}
+		});
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: LoginComponent,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Component
+	});
+	static ɵcmp = i0.ɵɵngDeclareComponent({
+		minVersion: "14.0.0",
+		version: "22.2.0",
+		type: LoginComponent,
+		isStandalone: true,
+		selector: "coolms-admin-login",
+		ngImport: i0,
+		template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in…' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n",
+		dependencies: [
+			{
+				kind: "ngmodule",
+				type: FormsModule
+			},
+			{
+				kind: "directive",
+				type: i1.ɵNgNoValidate,
+				selector: "form:not([ngNoForm]):not([ngNativeValidate])"
+			},
+			{
+				kind: "directive",
+				type: i1.DefaultValueAccessor,
+				selector: "input:not([type=checkbox]):not([ngNoCva])[formControlName],textarea:not([ngNoCva])[formControlName],input:not([type=checkbox]):not([ngNoCva])[formControl],textarea:not([ngNoCva])[formControl],input:not([type=checkbox]):not([ngNoCva])[ngModel],textarea:not([ngNoCva])[ngModel],[ngDefaultControl]"
+			},
+			{
+				kind: "directive",
+				type: i1.NgControlStatus,
+				selector: "[formControlName],[ngModel],[formControl]"
+			},
+			{
+				kind: "directive",
+				type: i1.NgControlStatusGroup,
+				selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]"
+			},
+			{
+				kind: "directive",
+				type: i1.RequiredValidator,
+				selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]",
+				inputs: ["required"]
+			},
+			{
+				kind: "directive",
+				type: i1.NgModel,
+				selector: "[ngModel]:not([formControlName]):not([formControl])",
+				inputs: [
+					"name",
+					"disabled",
+					"ngModel",
+					"ngModelOptions"
+				],
+				outputs: ["ngModelChange"],
+				exportAs: ["ngModel"]
+			},
+			{
+				kind: "directive",
+				type: i1.NgForm,
+				selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]",
+				inputs: ["ngFormOptions"],
+				outputs: ["ngSubmit"],
+				exportAs: ["ngForm"]
+			},
+			{
+				kind: "directive",
+				type: NgIf,
+				selector: "[ngIf]",
+				inputs: [
+					"ngIf",
+					"ngIfThen",
+					"ngIfElse"
+				]
+			}
+		]
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: LoginComponent,
+	decorators: [{
+		type: Component,
+		args: [{
+			selector: "coolms-admin-login",
+			standalone: true,
+			imports: [FormsModule, NgIf],
+			template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in…' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n"
+		}]
+	}]
+});
+var ConfigService = class ConfigService {
+	http = inject(HttpClient);
+	store = inject(Store);
+	cache = /* @__PURE__ */ new Map();
+	layout(id) {
+		return this.fetch("layout", id);
+	}
+	dialog(id) {
+		return this.fetch("dialog", id);
+	}
+	navigraph(slug) {
+		return this.fetch("navigraph", slug);
+	}
+	form(id) {
+		return this.fetch("form", id);
+	}
+	datagrid(id) {
+		return this.fetch("datagrid", id);
+	}
+	fetch(type, id) {
+		const key = `${type}/${id}`;
+		if (!this.cache.has(key)) {
+			const base = this.store.selectSnapshot(AppConfigState.manifest)?.configBase ?? "/api/v1/config";
+			const obs = this.http.get(`${base}/${type}/${id}`).pipe(map((r) => r.data ?? r), shareReplay(1));
+			this.cache.set(key, obs);
+		}
+		return this.cache.get(key);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ConfigService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ConfigService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: ConfigService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+const CHOICES = [
+	"light",
+	"dark",
+	"system"
+];
+const CACHE_KEY = "coolms_theme";
+const ACCENT_CACHE_KEY = "coolms_accent";
 const HEX = /^#[0-9a-fA-F]{6}$/;
 function isChoice(v) {
-    return typeof v === 'string' && CHOICES.includes(v);
+	return typeof v === "string" && CHOICES.includes(v);
 }
 function isAccent(v) {
-    return typeof v === 'string' && HEX.test(v);
+	return typeof v === "string" && HEX.test(v);
 }
-/**
- * Applies the user's theme by setting `data-theme` on the document element.
- *
- * The stylesheet does the rest: `:root[data-theme='dark']` re-points the
- * `--cms-*` palette and every colour in the admin arrives through those names.
- * Nothing here knows a single colour, which is the point — a second
- * theme is a block of tokens, not a code change.
- *
- * Follows the shape of UserCalendarPreferencesService and
- * CallOverlayPreferencesService: lazy one-shot load of `/auth/me/settings`,
- * cached for the SPA lifetime, with `update()` called by the Profile page after
- * a save so the change lands without a refetch.
- */
-class ThemeService {
-    api = inject(IdentityApiClient);
-    store = inject(Store);
-    _choice = signal(ThemeService.readCache(), /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "_choice" }] : /* istanbul ignore next */ []));
-    _systemDark = signal(false, /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "_systemDark" }] : /* istanbul ignore next */ []));
-    _userAccent = signal(ThemeService.readAccentCache(), /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "_userAccent" }] : /* istanbul ignore next */ []));
-    _platformAccent = signal(null, /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "_platformAccent" }] : /* istanbul ignore next */ []));
-    loadOnce$;
-    /** The user's stored choice, including `system`. */
-    choice = this._choice.asReadonly();
-    /** This user's personal override, independent of the deployment's. */
-    userAccent = this._userAccent.asReadonly();
-    /** The deployment's brand accent from the API manifest, if it set one. */
-    platformAccent = this._platformAccent.asReadonly();
-    /**
-     * The colour actually painted: personal override, else the deployment's,
-     * else null — which leaves the stylesheet's own accent in place.
-     *
-     * Three rungs and each is a real state. A user who has chosen nothing is
-     * NOT the same as one who chose the deployment's colour: clear the
-     * deployment's brand and the first user follows it, the second does not.
-     */
-    accent = computed(() => this._userAccent() ?? this._platformAccent(), /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "accent" }] : /* istanbul ignore next */ []));
-    /** The choice with `system` resolved against the OS setting. */
-    resolved = computed(() => {
-        const c = this._choice();
-        return c === 'system' ? (this._systemDark() ? 'dark' : 'light') : c;
-    }, /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "resolved" }] : /* istanbul ignore next */ []));
-    constructor() {
-        // `matchMedia` is guarded because the unit suite and any SSR-ish
-        // rendering path may not provide it; absent it, `system` means light.
-        const mq = typeof window !== 'undefined' && window.matchMedia
-            ? window.matchMedia('(prefers-color-scheme: dark)')
-            : null;
-        if (mq) {
-            this._systemDark.set(mq.matches);
-            // The OS can flip while the SPA is open, and `system` must follow it
-            // live rather than only at load.
-            mq.addEventListener('change', e => this._systemDark.set(e.matches));
-        }
-        effect(() => this.applyToDocument(this.resolved()));
-        effect(() => this.applyAccent(this.accent()));
-    }
-    /**
-     * One-shot load of the stored preference. Safe to call more than once and
-     * safe for anonymous users — a failure leaves the cached/system value in
-     * place rather than forcing light, so the login screen still matches the OS.
-     */
-    ensureLoaded() {
-        if (this.loadOnce$)
-            return this.loadOnce$;
-        // Read the deployment's colour FIRST and synchronously, so it is in
-        // place whether or not the settings request succeeds — an anonymous
-        // visitor on the login screen still sees the deployment's brand.
-        this.readPlatformAccent();
-        this.loadOnce$ = this.api.getSettings().pipe(map$1(all => {
-            const prefs = all['preferences'];
-            // The accent rides along on the same response — it is a field of
-            // the same section, so it costs no extra request.
-            this.setAccent(isAccent(prefs?.['accentColor']) ? prefs['accentColor'] : null);
-            return isChoice(prefs?.['theme']) ? prefs['theme'] : this._choice();
-        }), tap(choice => this.set(choice)), catchError$1(() => of(this._choice())), shareReplay$1({ bufferSize: 1, refCount: false }));
-        return this.loadOnce$;
-    }
-    /**
-     * Called by the Profile page after the Preferences tab saves, so the admin
-     * re-themes on the spot. Ignores anything that is not a known choice —
-     * the section PATCH returns the whole merged bag, not just this field.
-     */
-    update(value) {
-        if (isChoice(value))
-            this.set(value);
-    }
-    /**
-     * Companion to {@link update} for the accent field of the same save.
-     * An explicit null clears the override; anything malformed is ignored
-     * rather than applied, so a bad value can never blank the admin's accent.
-     */
-    updateAccent(value) {
-        if (null === value || '' === value)
-            this.setAccent(null);
-        else if (isAccent(value))
-            this.setAccent(value);
-    }
-    set(choice) {
-        this._choice.set(choice);
-        try {
-            localStorage.setItem(CACHE_KEY, choice);
-        }
-        catch {
-            // A blocked or full localStorage costs the pre-paint hint, nothing
-            // more — the server value still arrives and applies.
-        }
-    }
-    /**
-     * The manifest is loaded at bootstrap, well before the authenticated shell
-     * calls this, so a snapshot read is enough and no subscription is needed.
-     * A malformed value is ignored rather than applied — the container refuses
-     * to build with one, but the manifest crosses the network all the same.
-     */
-    readPlatformAccent() {
-        const value = this.store.selectSnapshot(AppConfigState.manifest)?.platformDefaults?.accentColor;
-        this._platformAccent.set(isAccent(value) ? value : null);
-    }
-    setAccent(accent) {
-        this._userAccent.set(accent);
-        try {
-            if (accent)
-                localStorage.setItem(ACCENT_CACHE_KEY, accent);
-            else
-                localStorage.removeItem(ACCENT_CACHE_KEY);
-        }
-        catch {
-            // Same as the theme cache: losing it costs the pre-paint hint only.
-        }
-    }
-    /**
-     * Writes the override onto the document element, where an inline style
-     * outranks every stylesheet rule — including the dark block — so one
-     * declaration re-points the accent in both themes.
-     *
-     * Only --cms-accent is set, not the -hover/-light/-text members of the
-     * family. Deriving those from an arbitrary user colour needs a colour model
-     * the palette does not have yet, and guessing them would produce hover
-     * states that clash with the very colour the user chose. Until then the
-     * override moves the brand fill and leaves its supporting tones alone.
-     */
-    applyAccent(accent) {
-        const root = document.documentElement;
-        if (accent && HEX.test(accent))
-            root.style.setProperty('--cms-accent', accent);
-        else
-            root.style.removeProperty('--cms-accent');
-    }
-    applyToDocument(theme) {
-        // Written for BOTH values rather than only removing the attribute for
-        // light, so the attribute is a reliable signal for anything that wants
-        // to read the active theme, and so a future `[data-theme='light']`
-        // block has something to hang on.
-        document.documentElement.setAttribute('data-theme', theme);
-    }
-    static readCache() {
-        try {
-            const raw = localStorage.getItem(CACHE_KEY);
-            return isChoice(raw) ? raw : 'system';
-        }
-        catch {
-            return 'system';
-        }
-    }
-    static readAccentCache() {
-        try {
-            const raw = localStorage.getItem(ACCENT_CACHE_KEY);
-            return isAccent(raw) ? raw : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }], ctorParameters: () => [] });
-
-/**
- * The platform's loading indicator: the exclamation mark from Cool!MS,
- * drawing itself.
- *
- * ## Why a mark and not a spinner
- *
- * A spinner says "something is happening" and nothing else; every product has
- * one and none of them are yours. The bang is already the one glyph in the
- * wordmark that carries the brand, so a loader built from it says whose
- * software is thinking — for free, in the place a user is already looking.
- *
- * ## Why one component rather than a snippet per surface
- *
- * It is meant for every wait long enough to notice: a dashboard assembling its
- * cards, an editor paginating a document, an explorer listing a folder. Those
- * are different teams' files, and a copied SVG in each is how three loaders
- * that no longer match each other happen.
- *
- * ## The animation
- *
- * The stem wipes upward and the dot lands after it, on a loop — the shape being
- * WRITTEN rather than spun. It is deliberately calm: a loader is background
- * furniture, and anything with a hard beat gets irritating on the third viewing.
- * Under `prefers-reduced-motion` it holds still and only breathes, because
- * motion sickness is not a stylistic preference.
- */
-class CmsLoaderComponent {
-    /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
-    label = input('', /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "label" }] : /* istanbul ignore next */ []));
-    /** Cover the positioned ancestor rather than sitting in the flow. */
-    overlay = input(false, /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "overlay" }] : /* istanbul ignore next */ []));
-    /**
-     * Row layout at text scale, for a wait inside a row, a status bar or a
-     * button. Override `--cms-loader-size` to tune the mark.
-     */
-    inline = input(false, /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "inline" }] : /* istanbul ignore next */ []));
-    /**
-     * A clip-path needs a document-unique id, and this component is used more
-     * than once per page — two loaders sharing an id makes the second one clip
-     * against the first one's rectangle and stop animating.
-     */
-    clipId = 'cms-loader-' + Math.random().toString(36).slice(2, 9);
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CmsLoaderComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.1.3", type: CmsLoaderComponent, isStandalone: true, selector: "cms-loader", inputs: { label: { classPropertyName: "label", publicName: "label", isSignal: true, isRequired: false, transformFunction: null }, overlay: { classPropertyName: "overlay", publicName: "overlay", isSignal: true, isRequired: false, transformFunction: null }, inline: { classPropertyName: "inline", publicName: "inline", isSignal: true, isRequired: false, transformFunction: null } }, ngImport: i0, template: `
+var ThemeService = class ThemeService {
+	api = inject(IdentityApiClient);
+	store = inject(Store);
+	_choice = signal(ThemeService.readCache(), ...ngDevMode ? [{ debugName: "_choice" }] : /* istanbul ignore next */ []);
+	_systemDark = signal(false, ...ngDevMode ? [{ debugName: "_systemDark" }] : /* istanbul ignore next */ []);
+	_userAccent = signal(ThemeService.readAccentCache(), ...ngDevMode ? [{ debugName: "_userAccent" }] : /* istanbul ignore next */ []);
+	_platformAccent = signal(null, ...ngDevMode ? [{ debugName: "_platformAccent" }] : /* istanbul ignore next */ []);
+	loadOnce$;
+	choice = this._choice.asReadonly();
+	userAccent = this._userAccent.asReadonly();
+	platformAccent = this._platformAccent.asReadonly();
+	accent = computed(() => this._userAccent() ?? this._platformAccent(), ...ngDevMode ? [{ debugName: "accent" }] : /* istanbul ignore next */ []);
+	resolved = computed(() => {
+		const c = this._choice();
+		return c === "system" ? this._systemDark() ? "dark" : "light" : c;
+	}, ...ngDevMode ? [{ debugName: "resolved" }] : /* istanbul ignore next */ []);
+	constructor() {
+		const mq = typeof window !== "undefined" && window.matchMedia ? window.matchMedia("(prefers-color-scheme: dark)") : null;
+		if (mq) {
+			this._systemDark.set(mq.matches);
+			mq.addEventListener("change", (e) => this._systemDark.set(e.matches));
+		}
+		effect(() => this.applyToDocument(this.resolved()));
+		effect(() => this.applyAccent(this.accent()));
+	}
+	ensureLoaded() {
+		if (this.loadOnce$) return this.loadOnce$;
+		this.readPlatformAccent();
+		this.loadOnce$ = this.api.getSettings().pipe(map$1((all) => {
+			const prefs = all["preferences"];
+			this.setAccent(isAccent(prefs?.["accentColor"]) ? prefs["accentColor"] : null);
+			return isChoice(prefs?.["theme"]) ? prefs["theme"] : this._choice();
+		}), tap$1((choice) => this.set(choice)), catchError$1(() => of(this._choice())), shareReplay$1({
+			bufferSize: 1,
+			refCount: false
+		}));
+		return this.loadOnce$;
+	}
+	update(value) {
+		if (isChoice(value)) this.set(value);
+	}
+	updateAccent(value) {
+		if (null === value || "" === value) this.setAccent(null);
+		else if (isAccent(value)) this.setAccent(value);
+	}
+	set(choice) {
+		this._choice.set(choice);
+		try {
+			localStorage.setItem(CACHE_KEY, choice);
+		} catch {}
+	}
+	readPlatformAccent() {
+		const value = this.store.selectSnapshot(AppConfigState.manifest)?.platformDefaults?.accentColor;
+		this._platformAccent.set(isAccent(value) ? value : null);
+	}
+	setAccent(accent) {
+		this._userAccent.set(accent);
+		try {
+			if (accent) localStorage.setItem(ACCENT_CACHE_KEY, accent);
+			else localStorage.removeItem(ACCENT_CACHE_KEY);
+		} catch {}
+	}
+	applyAccent(accent) {
+		const root = document.documentElement;
+		if (accent && HEX.test(accent)) root.style.setProperty("--cms-accent", accent);
+		else root.style.removeProperty("--cms-accent");
+	}
+	applyToDocument(theme) {
+		document.documentElement.setAttribute("data-theme", theme);
+	}
+	static readCache() {
+		try {
+			const raw = localStorage.getItem(CACHE_KEY);
+			return isChoice(raw) ? raw : "system";
+		} catch {
+			return "system";
+		}
+	}
+	static readAccentCache() {
+		try {
+			const raw = localStorage.getItem(ACCENT_CACHE_KEY);
+			return isAccent(raw) ? raw : null;
+		} catch {
+			return null;
+		}
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ThemeService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ThemeService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: ThemeService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}],
+	ctorParameters: () => []
+});
+var CmsLoaderComponent = class CmsLoaderComponent {
+	label = input("", ...ngDevMode ? [{ debugName: "label" }] : /* istanbul ignore next */ []);
+	overlay = input(false, ...ngDevMode ? [{ debugName: "overlay" }] : /* istanbul ignore next */ []);
+	inline = input(false, ...ngDevMode ? [{ debugName: "inline" }] : /* istanbul ignore next */ []);
+	clipId = "cms-loader-" + Math.random().toString(36).slice(2, 9);
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: CmsLoaderComponent,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Component
+	});
+	static ɵcmp = i0.ɵɵngDeclareComponent({
+		minVersion: "17.0.0",
+		version: "22.2.0",
+		type: CmsLoaderComponent,
+		isStandalone: true,
+		selector: "cms-loader",
+		inputs: {
+			label: {
+				classPropertyName: "label",
+				publicName: "label",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			},
+			overlay: {
+				classPropertyName: "overlay",
+				publicName: "overlay",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			},
+			inline: {
+				classPropertyName: "inline",
+				publicName: "inline",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			}
+		},
+		ngImport: i0,
+		template: `
         <div class="cms-loader"
              [class.cms-loader--overlay]="overlay()"
              [class.cms-loader--inline]="inline()"
@@ -1561,11 +1502,24 @@ class CmsLoaderComponent {
                 <span class="cms-loader__label">{{ label() }}</span>
             }
         </div>
-    `, isInline: true, styles: [".cms-loader{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;padding:24px;color:var(--cms-text-muted)}.cms-loader--overlay{position:absolute;inset:0;z-index:5;background:var(--cms-surface)}.cms-loader--inline{flex-direction:row;gap:8px;padding:0}.cms-loader--inline .cms-loader__mark{width:var(--cms-loader-size, 14px)}.cms-loader__mark{width:var(--cms-loader-size, 40px);height:auto;overflow:visible}.cms-loader__ghost{fill:var(--cms-border)}.cms-loader__stem,.cms-loader__dot{fill:var(--cms-accent)}.cms-loader__wipe{animation:cms-loader-wipe 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 32px}.cms-loader__dot{animation:cms-loader-dot 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 42px}@keyframes cms-loader-wipe{0%{transform:scaleY(0)}45%,70%{transform:scaleY(1)}to{transform:scaleY(0)}}@keyframes cms-loader-dot{0%,40%{opacity:0;transform:scale(.4)}55%,70%{opacity:1;transform:scale(1)}to{opacity:0;transform:scale(.4)}}.cms-loader__label{font-size:.8125rem}@media(prefers-reduced-motion:reduce){.cms-loader__wipe{animation:none;transform:scaleY(1)}.cms-loader__dot{animation:cms-loader-breathe 2s ease-in-out infinite;opacity:1}}@keyframes cms-loader-breathe{0%,to{opacity:.35}50%{opacity:1}}\n"], changeDetection: i0.ChangeDetectionStrategy.OnPush });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CmsLoaderComponent, decorators: [{
-            type: Component,
-            args: [{ selector: 'cms-loader', standalone: true, changeDetection: ChangeDetectionStrategy.OnPush, template: `
+    `,
+		isInline: true,
+		styles: [".cms-loader{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;padding:24px;color:var(--cms-text-muted)}.cms-loader--overlay{position:absolute;inset:0;z-index:5;background:var(--cms-surface)}.cms-loader--inline{flex-direction:row;gap:8px;padding:0}.cms-loader--inline .cms-loader__mark{width:var(--cms-loader-size, 14px)}.cms-loader__mark{width:var(--cms-loader-size, 40px);height:auto;overflow:visible}.cms-loader__ghost{fill:var(--cms-border)}.cms-loader__stem,.cms-loader__dot{fill:var(--cms-accent)}.cms-loader__wipe{animation:cms-loader-wipe 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 32px}.cms-loader__dot{animation:cms-loader-dot 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 42px}@keyframes cms-loader-wipe{0%{transform:scaleY(0)}45%,70%{transform:scaleY(1)}to{transform:scaleY(0)}}@keyframes cms-loader-dot{0%,40%{opacity:0;transform:scale(.4)}55%,70%{opacity:1;transform:scale(1)}to{opacity:0;transform:scale(.4)}}.cms-loader__label{font-size:.8125rem}@media(prefers-reduced-motion:reduce){.cms-loader__wipe{animation:none;transform:scaleY(1)}.cms-loader__dot{animation:cms-loader-breathe 2s ease-in-out infinite;opacity:1}}@keyframes cms-loader-breathe{0%,to{opacity:.35}50%{opacity:1}}\n"],
+		changeDetection: i0.ChangeDetectionStrategy.OnPush
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: CmsLoaderComponent,
+	decorators: [{
+		type: Component,
+		args: [{
+			selector: "cms-loader",
+			standalone: true,
+			changeDetection: ChangeDetectionStrategy.OnPush,
+			template: `
         <div class="cms-loader"
              [class.cms-loader--overlay]="overlay()"
              [class.cms-loader--inline]="inline()"
@@ -1590,496 +1544,505 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImpor
                 <span class="cms-loader__label">{{ label() }}</span>
             }
         </div>
-    `, styles: [".cms-loader{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;padding:24px;color:var(--cms-text-muted)}.cms-loader--overlay{position:absolute;inset:0;z-index:5;background:var(--cms-surface)}.cms-loader--inline{flex-direction:row;gap:8px;padding:0}.cms-loader--inline .cms-loader__mark{width:var(--cms-loader-size, 14px)}.cms-loader__mark{width:var(--cms-loader-size, 40px);height:auto;overflow:visible}.cms-loader__ghost{fill:var(--cms-border)}.cms-loader__stem,.cms-loader__dot{fill:var(--cms-accent)}.cms-loader__wipe{animation:cms-loader-wipe 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 32px}.cms-loader__dot{animation:cms-loader-dot 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 42px}@keyframes cms-loader-wipe{0%{transform:scaleY(0)}45%,70%{transform:scaleY(1)}to{transform:scaleY(0)}}@keyframes cms-loader-dot{0%,40%{opacity:0;transform:scale(.4)}55%,70%{opacity:1;transform:scale(1)}to{opacity:0;transform:scale(.4)}}.cms-loader__label{font-size:.8125rem}@media(prefers-reduced-motion:reduce){.cms-loader__wipe{animation:none;transform:scaleY(1)}.cms-loader__dot{animation:cms-loader-breathe 2s ease-in-out infinite;opacity:1}}@keyframes cms-loader-breathe{0%,to{opacity:.35}50%{opacity:1}}\n"] }]
-        }], propDecorators: { label: [{ type: i0.Input, args: [{ isSignal: true, alias: "label", required: false }] }], overlay: [{ type: i0.Input, args: [{ isSignal: true, alias: "overlay", required: false }] }], inline: [{ type: i0.Input, args: [{ isSignal: true, alias: "inline", required: false }] }] } });
-
-/**
- * Sidebar collapse state -- two independent dimensions:
- *
- *  - `collapsed`: whole-sidebar icon-only rail toggle (the chevron at
- *    the bottom of the sidebar). Per-device localStorage.
- *  - `collapsedSections`: per-section collapse, keyed by the section
- *    separator's node id. Used to fold a section's items under their
- *    header so the nav doesn't endless-scroll once a tenant has lots
- *    of modules. Per-device localStorage.
- *  - `collapsedItems`: per-item inline-expand collapse, keyed by the
- *    nav node's id. Mirrors `collapsedSections` but for sub-tree items
- *    (a top-level item with children, e.g. Reports -> Process Report).
- *    Absent id = expanded (children visible); present = collapsed.
- *    Per-device localStorage.
- *
- * Storage failures (private mode, quota, disabled cookies) fall back
- * to defaulting un-collapsed -- the toggles still work for the session,
- * just don't persist.
- */
-class SidebarStateService {
-    static STORAGE_KEY = 'coolms.admin.sidebar.collapsed';
-    static STORAGE_KEY_SECTIONS = 'coolms.admin.sidebar.collapsedSections';
-    static STORAGE_KEY_ITEMS = 'coolms.admin.sidebar.collapsedItems';
-    collapsed = signal(this.readPersisted(), /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "collapsed" }] : /* istanbul ignore next */ []));
-    collapsedSections = signal(this.readSectionsPersisted(), /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "collapsedSections" }] : /* istanbul ignore next */ []));
-    collapsedItems = signal(this.readItemsPersisted(), /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "collapsedItems" }] : /* istanbul ignore next */ []));
-    toggle() {
-        const next = !this.collapsed();
-        this.collapsed.set(next);
-        this.persist(next);
-    }
-    isSectionCollapsed(id) {
-        return this.collapsedSections().has(id);
-    }
-    toggleSection(id) {
-        const next = new Set(this.collapsedSections());
-        if (next.has(id)) {
-            next.delete(id);
-        }
-        else {
-            next.add(id);
-        }
-        this.collapsedSections.set(next);
-        this.persistSections(next);
-    }
-    /**
-     * Force a section to be expanded. Used when navigation lands on
-     * a route inside a manually-collapsed section -- it would be
-     * confusing to leave the active item hidden. The user can
-     * collapse the section again afterwards.
-     */
-    ensureExpanded(id) {
-        if (!this.collapsedSections().has(id))
-            return;
-        const next = new Set(this.collapsedSections());
-        next.delete(id);
-        this.collapsedSections.set(next);
-        this.persistSections(next);
-    }
-    // --- Per-item inline-expand (sub-tree items, e.g. a section's children) --
-    isItemCollapsed(id) {
-        return this.collapsedItems().has(id);
-    }
-    toggleItem(id) {
-        const next = new Set(this.collapsedItems());
-        if (next.has(id)) {
-            next.delete(id);
-        }
-        else {
-            next.add(id);
-        }
-        this.collapsedItems.set(next);
-        this.persistItems(next);
-    }
-    readPersisted() {
-        try {
-            return localStorage.getItem(SidebarStateService.STORAGE_KEY) === 'true';
-        }
-        catch {
-            return false;
-        }
-    }
-    persist(value) {
-        try {
-            localStorage.setItem(SidebarStateService.STORAGE_KEY, String(value));
-        }
-        catch {
-            // Non-persistence acceptable; toggle still works in-session.
-        }
-    }
-    readSectionsPersisted() {
-        try {
-            const raw = localStorage.getItem(SidebarStateService.STORAGE_KEY_SECTIONS);
-            if (raw === null)
-                return new Set();
-            const parsed = JSON.parse(raw);
-            if (!Array.isArray(parsed))
-                return new Set();
-            return new Set(parsed.filter((v) => typeof v === 'string'));
-        }
-        catch {
-            return new Set();
-        }
-    }
-    persistSections(value) {
-        try {
-            localStorage.setItem(SidebarStateService.STORAGE_KEY_SECTIONS, JSON.stringify(Array.from(value)));
-        }
-        catch {
-            // Non-persistence acceptable; toggle still works in-session.
-        }
-    }
-    readItemsPersisted() {
-        try {
-            const raw = localStorage.getItem(SidebarStateService.STORAGE_KEY_ITEMS);
-            if (raw === null)
-                return new Set();
-            const parsed = JSON.parse(raw);
-            if (!Array.isArray(parsed))
-                return new Set();
-            return new Set(parsed.filter((v) => typeof v === 'string'));
-        }
-        catch {
-            return new Set();
-        }
-    }
-    persistItems(value) {
-        try {
-            localStorage.setItem(SidebarStateService.STORAGE_KEY_ITEMS, JSON.stringify(Array.from(value)));
-        }
-        catch {
-            // Non-persistence acceptable; toggle still works in-session.
-        }
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, providedIn: 'root' });
+    `,
+			styles: [".cms-loader{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;padding:24px;color:var(--cms-text-muted)}.cms-loader--overlay{position:absolute;inset:0;z-index:5;background:var(--cms-surface)}.cms-loader--inline{flex-direction:row;gap:8px;padding:0}.cms-loader--inline .cms-loader__mark{width:var(--cms-loader-size, 14px)}.cms-loader__mark{width:var(--cms-loader-size, 40px);height:auto;overflow:visible}.cms-loader__ghost{fill:var(--cms-border)}.cms-loader__stem,.cms-loader__dot{fill:var(--cms-accent)}.cms-loader__wipe{animation:cms-loader-wipe 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 32px}.cms-loader__dot{animation:cms-loader-dot 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 42px}@keyframes cms-loader-wipe{0%{transform:scaleY(0)}45%,70%{transform:scaleY(1)}to{transform:scaleY(0)}}@keyframes cms-loader-dot{0%,40%{opacity:0;transform:scale(.4)}55%,70%{opacity:1;transform:scale(1)}to{opacity:0;transform:scale(.4)}}.cms-loader__label{font-size:.8125rem}@media(prefers-reduced-motion:reduce){.cms-loader__wipe{animation:none;transform:scaleY(1)}.cms-loader__dot{animation:cms-loader-breathe 2s ease-in-out infinite;opacity:1}}@keyframes cms-loader-breathe{0%,to{opacity:.35}50%{opacity:1}}\n"]
+		}]
+	}],
+	propDecorators: {
+		label: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "label",
+				required: false
+			}]
+		}],
+		overlay: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "overlay",
+				required: false
+			}]
+		}],
+		inline: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "inline",
+				required: false
+			}]
+		}]
+	}
+});
+var SidebarStateService = class SidebarStateService {
+	static STORAGE_KEY = "coolms.admin.sidebar.collapsed";
+	static STORAGE_KEY_SECTIONS = "coolms.admin.sidebar.collapsedSections";
+	static STORAGE_KEY_ITEMS = "coolms.admin.sidebar.collapsedItems";
+	collapsed = signal(this.readPersisted(), ...ngDevMode ? [{ debugName: "collapsed" }] : /* istanbul ignore next */ []);
+	collapsedSections = signal(this.readSectionsPersisted(), ...ngDevMode ? [{ debugName: "collapsedSections" }] : /* istanbul ignore next */ []);
+	collapsedItems = signal(this.readItemsPersisted(), ...ngDevMode ? [{ debugName: "collapsedItems" }] : /* istanbul ignore next */ []);
+	toggle() {
+		const next = !this.collapsed();
+		this.collapsed.set(next);
+		this.persist(next);
+	}
+	isSectionCollapsed(id) {
+		return this.collapsedSections().has(id);
+	}
+	toggleSection(id) {
+		const next = new Set(this.collapsedSections());
+		if (next.has(id)) next.delete(id);
+		else next.add(id);
+		this.collapsedSections.set(next);
+		this.persistSections(next);
+	}
+	ensureExpanded(id) {
+		if (!this.collapsedSections().has(id)) return;
+		const next = new Set(this.collapsedSections());
+		next.delete(id);
+		this.collapsedSections.set(next);
+		this.persistSections(next);
+	}
+	isItemCollapsed(id) {
+		return this.collapsedItems().has(id);
+	}
+	toggleItem(id) {
+		const next = new Set(this.collapsedItems());
+		if (next.has(id)) next.delete(id);
+		else next.add(id);
+		this.collapsedItems.set(next);
+		this.persistItems(next);
+	}
+	readPersisted() {
+		try {
+			return localStorage.getItem(SidebarStateService.STORAGE_KEY) === "true";
+		} catch {
+			return false;
+		}
+	}
+	persist(value) {
+		try {
+			localStorage.setItem(SidebarStateService.STORAGE_KEY, String(value));
+		} catch {}
+	}
+	readSectionsPersisted() {
+		try {
+			const raw = localStorage.getItem(SidebarStateService.STORAGE_KEY_SECTIONS);
+			if (raw === null) return /* @__PURE__ */ new Set();
+			const parsed = JSON.parse(raw);
+			if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
+			return new Set(parsed.filter((v) => typeof v === "string"));
+		} catch {
+			return /* @__PURE__ */ new Set();
+		}
+	}
+	persistSections(value) {
+		try {
+			localStorage.setItem(SidebarStateService.STORAGE_KEY_SECTIONS, JSON.stringify(Array.from(value)));
+		} catch {}
+	}
+	readItemsPersisted() {
+		try {
+			const raw = localStorage.getItem(SidebarStateService.STORAGE_KEY_ITEMS);
+			if (raw === null) return /* @__PURE__ */ new Set();
+			const parsed = JSON.parse(raw);
+			if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
+			return new Set(parsed.filter((v) => typeof v === "string"));
+		} catch {
+			return /* @__PURE__ */ new Set();
+		}
+	}
+	persistItems(value) {
+		try {
+			localStorage.setItem(SidebarStateService.STORAGE_KEY_ITEMS, JSON.stringify(Array.from(value)));
+		} catch {}
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: SidebarStateService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: SidebarStateService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: SidebarStateService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+var EntitySearchService = class EntitySearchService {
+	http = inject(HttpClient);
+	search(entityType, query, limit = 20) {
+		const params = new HttpParams().set("type", entityType).set("q", query).set("limit", String(limit));
+		return this.http.get("/api/entity-search", { params });
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: EntitySearchService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: EntitySearchService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: EntitySearchService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+var NaviGraphService = class NaviGraphService {
+	http = inject(HttpClient);
+	router = inject(Router);
+	store = inject(Store);
+	errors = inject(ErrorHandlerService);
+	adminNav = signal([], ...ngDevMode ? [{ debugName: "adminNav" }] : /* istanbul ignore next */ []);
+	topbarNav = signal([], ...ngDevMode ? [{ debugName: "topbarNav" }] : /* istanbul ignore next */ []);
+	cache = /* @__PURE__ */ new Map();
+	loadAdminNav(url) {
+		return this.loadTree(url).pipe(map((tree) => {
+			this.adminNav.set(tree);
+			return tree;
+		}));
+	}
+	loadTopbarNav(url) {
+		return this.loadTree(url).pipe(map((tree) => {
+			this.topbarNav.set(tree);
+			return tree;
+		}));
+	}
+	handleClick(node) {
+		const target = node.meta.target;
+		if (target === "action.logout") {
+			this.store.dispatch(new Logout()).subscribe(() => {
+				this.router.navigate(["/login"]);
+			});
+			return;
+		}
+		if (target === "_blank") {
+			window.open(node.meta.routerLink ?? node.path, "_blank", "noopener");
+			return;
+		}
+		const link = node.meta.routerLink ?? node.path;
+		this.router.navigate([link]);
+	}
+	isVisible(node, record) {
+		const showWhen = node.meta["showWhen"];
+		if (!showWhen) return true;
+		return this.evalCondition(showWhen, record);
+	}
+	matchesShowWhen(showWhen, record) {
+		if (!showWhen) return true;
+		return this.evalCondition(showWhen, record);
+	}
+	evalCondition(cond, record) {
+		if ("and" in cond) return cond["and"].every((c) => this.evalCondition(c, record));
+		if ("or" in cond) return cond["or"].some((c) => this.evalCondition(c, record));
+		const field = cond["field"];
+		if (!(field in record)) return false;
+		const val = record[field];
+		switch (cond["op"]) {
+			case "eq": return val === cond["value"];
+			case "ne": return val !== cond["value"];
+			case "in": return Array.isArray(cond["value"]) && cond["value"].includes(val);
+			case "nin": return Array.isArray(cond["value"]) && !cond["value"].includes(val);
+			case "startsWith": return typeof val === "string" && typeof cond["value"] === "string" && val.startsWith(cond["value"]);
+			default: return false;
+		}
+	}
+	loadTree(url) {
+		if (this.cache.has(url)) return of(this.cache.get(url));
+		return this.http.get(url, { headers: { Accept: "application/ld+json" } }).pipe(map((r) => {
+			const raw = r["member"] ?? r["hydra:member"] ?? [];
+			const flat = Array.isArray(raw) ? raw : [];
+			const tree = this.buildTree(flat);
+			this.cache.set(url, tree);
+			return tree;
+		}), catchError((err) => {
+			console.error("[NaviGraph] loadTree failed for", url, this.errors.humanize(err));
+			return of([]);
+		}));
+	}
+	buildTree(flat) {
+		if (!flat.length) return [];
+		const map = new Map(flat.map((n) => [n.id, {
+			...n,
+			children: []
+		}]));
+		const roots = [];
+		for (const node of map.values()) if (node.parentId && map.has(node.parentId)) map.get(node.parentId).children.push(node);
+		else roots.push(node);
+		const sort = (nodes) => {
+			nodes.sort((a, b) => a.sortOrder - b.sortOrder);
+			nodes.forEach((n) => n.children?.length && sort(n.children));
+		};
+		sort(roots);
+		return roots;
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: NaviGraphService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: NaviGraphService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: NaviGraphService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+var ComponentRegistry = class ComponentRegistry {
+	static map = /* @__PURE__ */ new Map();
+	static register(key, component) {
+		ComponentRegistry.map.set(key, component);
+	}
+	static get(key) {
+		return ComponentRegistry.map.get(key);
+	}
+	static has(key) {
+		return ComponentRegistry.map.has(key);
+	}
+	static keys() {
+		return Array.from(ComponentRegistry.map.keys());
+	}
+	register(key, component) {
+		ComponentRegistry.register(key, component);
+	}
+	get(key) {
+		return ComponentRegistry.get(key) ?? null;
+	}
+	has(key) {
+		return ComponentRegistry.has(key);
+	}
+	keys() {
+		return ComponentRegistry.keys();
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ComponentRegistry,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ComponentRegistry,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: ComponentRegistry,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+const CONSOLE_CONTRACT = {
+	name: "console",
+	version: "1.0"
+};
+function isPortProvision(p) {
+	return typeof p === "object" && "port" in p && "useExisting" in p;
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * HTTP client for the Phase 2a `/api/entity-search` endpoint.
- * Returns a stream of search results for the given entity FQCN.
- * Permission filtering happens at the backend resolver layer —
- * this service is a thin RPC.
- */
-class EntitySearchService {
-    http = inject(HttpClient);
-    /**
-     * @param entityType  Fully-qualified PHP class name of the entity
-     *                    being searched (e.g. the backend's User entity).
-     * @param query       Free-text search input. Empty string is
-     *                    valid — the backend returns the default
-     *                    listing for that entity type.
-     * @param limit       Max rows to return; clamped server-side to
-     *                    [1, 100].
-     */
-    search(entityType, query, limit = 20) {
-        const params = new HttpParams()
-            .set('type', entityType)
-            .set('q', query)
-            .set('limit', String(limit));
-        return this.http.get('/api/entity-search', { params });
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, providedIn: 'root' });
+function consoleEntry(entry) {
+	return entry;
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * Loads, caches, and drives admin NaviGraph trees.
- *
- * Usage:
- *   naviGraphService.loadAdminNav(url).subscribe();
- *   const items = naviGraphService.adminNav();         // signal<NaviGraphNode[]>
- *   naviGraphService.handleClick(node);
- */
-class NaviGraphService {
-    http = inject(HttpClient);
-    router = inject(Router);
-    store = inject(Store);
-    errors = inject(ErrorHandlerService);
-    /** Resolved root nodes for navi.admin (sidebar). */
-    adminNav = signal([], /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "adminNav" }] : /* istanbul ignore next */ []));
-    /** Resolved root nodes for navi.admin.topbar. */
-    topbarNav = signal([], /* @ts-ignore */
-    ...(ngDevMode ? [{ debugName: "topbarNav" }] : /* istanbul ignore next */ []));
-    cache = new Map();
-    // -------------------------------------------------------------------------
-    loadAdminNav(url) {
-        return this.loadTree(url).pipe(map(tree => { this.adminNav.set(tree); return tree; }));
-    }
-    loadTopbarNav(url) {
-        return this.loadTree(url).pipe(map(tree => { this.topbarNav.set(tree); return tree; }));
-    }
-    // -------------------------------------------------------------------------
-    /**
-     * Handle a nav-node click.
-     *
-     * Routing logic based on meta.target:
-     *   'action.logout'  — dispatch Logout
-     *   '_blank'         — window.open (uses node.path as href)
-     *   default          — router.navigate with meta.routerLink or node.path
-     */
-    handleClick(node) {
-        const target = node.meta.target;
-        if (target === 'action.logout') {
-            this.store.dispatch(new Logout()).subscribe(() => {
-                void this.router.navigate(['/login']);
-            });
-            return;
-        }
-        if (target === '_blank') {
-            window.open(node.meta.routerLink ?? node.path, '_blank', 'noopener');
-            return;
-        }
-        const link = node.meta.routerLink ?? node.path;
-        void this.router.navigate([link]);
-    }
-    // -------------------------------------------------------------------------
-    /**
-     * Evaluate `showWhen` meta condition against a record.
-     * Nodes with no `showWhen` are always visible.
-     * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
-     */
-    isVisible(node, record) {
-        const showWhen = node.meta['showWhen'];
-        if (!showWhen)
-            return true;
-        return this.evalCondition(showWhen, record);
-    }
-    /**
-     * Standalone `showWhen` evaluator for callers that don't have a
-     * full `NaviGraphNode` (e.g. a grid's row context menu — a
-     * `rowAction.showWhen` predicate is evaluated against the row's
-     * own projection). `null`/`undefined` predicates default to
-     * visible, mirroring `isVisible`'s "no rule = always shown"
-     * semantics.
-     */
-    matchesShowWhen(showWhen, record) {
-        if (!showWhen)
-            return true;
-        return this.evalCondition(showWhen, record);
-    }
-    evalCondition(cond, record) {
-        if ('and' in cond) {
-            return cond['and']
-                .every(c => this.evalCondition(c, record));
-        }
-        if ('or' in cond) {
-            return cond['or']
-                .some(c => this.evalCondition(c, record));
-        }
-        // Strict missing-field semantics. A leaf predicate
-        // referencing a field absent from the record evaluates to
-        // false (fail-loud) instead of the prior op-dependent lax
-        // behavior that returned true for ne/nin/unknown ops. Aligns
-        // with CSS attribute selectors / JSONPath / React conditional
-        // rendering conventions.
-        const field = cond['field'];
-        if (!(field in record))
-            return false;
-        const val = record[field];
-        switch (cond['op']) {
-            case 'eq': return val === cond['value'];
-            case 'ne': return val !== cond['value'];
-            case 'in': return Array.isArray(cond['value']) && cond['value'].includes(val);
-            case 'nin': return Array.isArray(cond['value']) && !cond['value'].includes(val);
-            // Prefix match for strings — primary use case is filtering
-            // actions by MIME-type major (e.g., "image/" matches all
-            // image MIMEs without enumerating each subtype).
-            case 'startsWith':
-                return typeof val === 'string'
-                    && typeof cond['value'] === 'string'
-                    && val.startsWith(cond['value']);
-            // Strict: unknown / typo op (e.g. 'equals' instead of 'eq')
-            // never matches.
-            default: return false;
-        }
-    }
-    /**
-     * Fetch a graph endpoint and return a nested tree.
-     * Handles both compact JSON-LD IRIs (`member`) and
-     * the legacy Hydra key (`hydra:member`).
-     * Results are cached by URL for the lifetime of the service instance.
-     */
-    loadTree(url) {
-        if (this.cache.has(url)) {
-            return of(this.cache.get(url));
-        }
-        return this.http.get(url, {
-            headers: { Accept: 'application/ld+json' },
-        }).pipe(map(r => {
-            const raw = r['member'] ?? r['hydra:member'] ?? [];
-            const flat = Array.isArray(raw) ? raw : [];
-            const tree = this.buildTree(flat);
-            this.cache.set(url, tree);
-            return tree;
-        }), catchError(err => {
-            console.error('[NaviGraph] loadTree failed for', url, this.errors.humanize(err));
-            return of([]);
-        }));
-    }
-    /**
-     * Build a nested tree from a flat array of nodes.
-     * Nodes are sorted by sortOrder at each level.
-     */
-    buildTree(flat) {
-        if (!flat.length) {
-            return [];
-        }
-        const map = new Map(flat.map(n => [n.id, { ...n, children: [] }]));
-        const roots = [];
-        for (const node of map.values()) {
-            if (node.parentId && map.has(node.parentId)) {
-                map.get(node.parentId).children.push(node);
-            }
-            else {
-                roots.push(node);
-            }
-        }
-        const sort = (nodes) => {
-            nodes.sort((a, b) => a.sortOrder - b.sortOrder);
-            nodes.forEach(n => n.children?.length && sort(n.children));
-        };
-        sort(roots);
-        return roots;
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, providedIn: 'root' });
+const VERSION = /^(\d+)\.(\d+)$/;
+const RANGE = /^\^(\d+)\.(\d+)$/;
+function satisfiesRange(range, version) {
+	const r = RANGE.exec(range);
+	const v = VERSION.exec(version);
+	if (!r || !v) return false;
+	return Number(r[1]) === Number(v[1]) && Number(v[2]) >= Number(r[2]);
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-// --- NaviGraph API types ------------------------------------------------------
-// Mirror the PHP NaviGraphNodeResource DTO exactly. No `any` allowed.
-
-/**
- * Registry mapping string keys to Angular component classes.
- *
- * Backed by a static Map so components registered at module load time
- * (e.g. in app.config.ts) are visible to all injected instances.
- *
- * Usage — static (app.config.ts / bootstrap time):
- *   ComponentRegistry.register('MediaLibraryPage', MediaLibraryPage);
- *
- * Usage — injected (SlotComponent / runtime):
- *   private readonly registry = inject(ComponentRegistry);
- *   const cls = this.registry.get('MediaLibraryPage');
- */
-class ComponentRegistry {
-    static map = new Map();
-    // -- Static API (bootstrap / app.config.ts) -------------------------------
-    static register(key, component) {
-        ComponentRegistry.map.set(key, component);
-    }
-    static get(key) {
-        return ComponentRegistry.map.get(key);
-    }
-    static has(key) {
-        return ComponentRegistry.map.has(key);
-    }
-    static keys() {
-        return Array.from(ComponentRegistry.map.keys());
-    }
-    // -- Instance API (injectable) ---------------------------------------------
-    register(key, component) {
-        ComponentRegistry.register(key, component);
-    }
-    get(key) {
-        return ComponentRegistry.get(key) ?? null;
-    }
-    has(key) {
-        return ComponentRegistry.has(key);
-    }
-    keys() {
-        return ComponentRegistry.keys();
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, providedIn: 'root' });
+var ConsoleAssemblyError = class extends Error {
+	problems;
+	constructor(problems) {
+		super(`console assembly refused:\n  ${problems.join("\n  ")}`);
+		this.problems = problems;
+		this.name = "ConsoleAssemblyError";
+	}
+};
+function assembleConsole(entries) {
+	const problems = [];
+	const seenModules = /* @__PURE__ */ new Map();
+	const paths = /* @__PURE__ */ new Map();
+	const bindings = /* @__PURE__ */ new Map();
+	const topbar = /* @__PURE__ */ new Map();
+	const overlays = /* @__PURE__ */ new Map();
+	const panels = /* @__PURE__ */ new Map();
+	const states = /* @__PURE__ */ new Map();
+	const ports = /* @__PURE__ */ new Map();
+	const claim = (map, key, owner, what) => {
+		const prev = map.get(key);
+		if (prev !== void 0 && prev !== owner) problems.push(`${what} '${String(key)}' is claimed by modules '${prev}' and '${owner}'`);
+		else map.set(key, owner);
+	};
+	for (const e of entries) {
+		if (!satisfiesRange(e.range, CONSOLE_CONTRACT.version)) problems.push(`module '${e.module}' offers console ${e.range}; this host implements console ${CONSOLE_CONTRACT.version} -- refused`);
+		seenModules.set(e.module, (seenModules.get(e.module) ?? 0) + 1);
+		for (const r of e.routes ?? []) claim(paths, r.path, e.module, "route path");
+		for (const b of e.bindings ?? []) claim(bindings, b.name, e.module, "binding");
+		for (const t of e.topbar ?? []) claim(topbar, t.id, e.module, "top-bar item");
+		for (const o of e.overlays ?? []) claim(overlays, o.id, e.module, "overlay");
+		for (const p of e.panels ?? []) claim(panels, p.id, e.module, "panel");
+		for (const s of e.states ?? []) claim(states, s, e.module, "state");
+		for (const p of e.providers ?? []) if (isPortProvision(p)) claim(ports, p.port, e.module, "port");
+	}
+	for (const [module, n] of seenModules) if (n > 1) problems.push(`module '${module}' has ${n} entries; one entry per module`);
+	if (problems.length) throw new ConsoleAssemblyError(problems);
+	return entries;
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * Optional by design: an application assembled without a Sections module binds
- * nothing and simply sends no `X-CoolMS-Section` header, which is exactly what
- * a single-site install wants.
- */
-const CURRENT_SECTION = new InjectionToken('coolms.current-section');
-
-/**
- * Phase H7 -- admin Site Selector.
- *
- * Stamps `X-CoolMS-Section: <slug>` on outgoing `/api/v1/*` requests when
- * the admin has picked a section from the Site Selector dropdown. The backend
- * honours it for AUTHENTICATED requests only -- anonymous traffic cannot pivot
- * the active section.
- *
- * What the header actually reaches, counted rather than intended: exactly two
- * readers act on it, `CreatePageProcessor` and `CreateCollectionProcessor`,
- * each choosing WHICH SITE a newly created page or collection lands in -- and,
- * for a page, that section's default locale and slug-naming policy. Nothing
- * else is scoped by it. Media spaces list every active section regardless, and
- * every other reader of `_coolms_section` sits on the public SSR surface,
- * which resolves from host+path and never sees this header.
- *
- * This block used to say the backend "scopes site-specific API providers
- * (pages, media spaces, etc.)". That described where was heading --
- * H4/H5, multisite Document and Media, never landed -- not what it does. Left
- * recorded because a docstring naming an intended destination reads exactly
- * like one naming a shipped feature, and this one misdescribed the control for
- * three months.
- *
- * Skipped:
- *  - non-API URLs (no section context needed for SSR/static)
- *  - `/auth/*` endpoints (login/refresh are pre-session; the header would
- *    be ignored by the backend anyway, but skipping keeps wire traffic clean)
- *  - requests that already carry the header (programmatic overrides win)
- */
+const CONSOLE_ENTRIES = new InjectionToken("coolms.console.entries");
+var ConsolePanelHost = class {};
+function installedConsoleModules(manifest) {
+	return new Set((manifest?.ui?.modules ?? []).filter((m) => m.contract === CONSOLE_CONTRACT.name).map((m) => m.module));
+}
+var ConsoleActivation = class ConsoleActivation {
+	entries = inject(CONSOLE_ENTRIES, { optional: true }) ?? [];
+	manifest = inject(Store).selectSignal(AppConfigState.manifest);
+	installed = computed(() => installedConsoleModules(this.manifest()), ...ngDevMode ? [{ debugName: "installed" }] : /* istanbul ignore next */ []);
+	active = computed(() => this.entries.filter((e) => this.installed().has(e.module)), ...ngDevMode ? [{ debugName: "active" }] : /* istanbul ignore next */ []);
+	topbar = computed(() => this.active().flatMap((e) => e.topbar ?? []).slice().sort((a, b) => a.order - b.order || a.id.localeCompare(b.id)), ...ngDevMode ? [{ debugName: "topbar" }] : /* istanbul ignore next */ []);
+	overlays = computed(() => this.active().flatMap((e) => e.overlays ?? []), ...ngDevMode ? [{ debugName: "overlays" }] : /* istanbul ignore next */ []);
+	panels = computed(() => this.active().flatMap((e) => e.panels ?? []), ...ngDevMode ? [{ debugName: "panels" }] : /* istanbul ignore next */ []);
+	missing = computed(() => [...this.installed()].filter((m) => !this.entries.some((e) => e.module === m)).sort(), ...ngDevMode ? [{ debugName: "missing" }] : /* istanbul ignore next */ []);
+	isInstalled(module) {
+		return this.installed().has(module);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ConsoleActivation,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: ConsoleActivation,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: ConsoleActivation,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+function consoleModuleInstalled(module) {
+	return () => {
+		const activation = inject(ConsoleActivation);
+		return inject(AppInitService).ready$.pipe(take(1), map(() => activation.isInstalled(module)));
+	};
+}
+function consoleChildren(entries) {
+	const routes = [];
+	for (const e of assembleConsole(entries)) for (const m of e.routes ?? []) {
+		if ("redirectTo" in m) {
+			routes.push({
+				path: m.path,
+				redirectTo: m.redirectTo,
+				pathMatch: "full"
+			});
+			continue;
+		}
+		const route = {
+			path: m.path,
+			canMatch: [consoleModuleInstalled(e.module)],
+			...m.nav ? { data: { ...m.nav } } : {},
+			...m.providers ? { providers: [...m.providers] } : {}
+		};
+		if ("children" in m) route.loadChildren = m.children;
+		else route.loadComponent = m.component;
+		routes.push(route);
+	}
+	return routes;
+}
+function provideConsole(entries, options) {
+	const checked = assembleConsole(entries);
+	const providers = [
+		{
+			provide: CONSOLE_ENTRIES,
+			useValue: checked
+		},
+		provideStore([...options.hostStates, ...checked.flatMap((e) => e.states ?? [])]),
+		provideAppInitializer(() => {
+			const registry = inject(ComponentRegistry);
+			for (const e of checked) for (const b of e.bindings ?? []) registry.register(b.name, b.component);
+		})
+	];
+	for (const e of checked) for (const p of e.providers ?? []) providers.push(isPortProvision(p) ? {
+		provide: p.port,
+		useExisting: p.useExisting
+	} : p);
+	return makeEnvironmentProviders(providers);
+}
+const CURRENT_SECTION = new InjectionToken("coolms.current-section");
 const sectionInterceptor = (req, next) => {
-    if (!shouldStamp(req.url)) {
-        return next(req);
-    }
-    if (req.headers.has('X-CoolMS-Section')) {
-        return next(req);
-    }
-    // Optional: no Sections module installed means no section to stamp.
-    const slug = inject(CURRENT_SECTION, { optional: true })?.currentSlug() ?? null;
-    if (!slug)
-        return next(req);
-    return next(req.clone({ setHeaders: { 'X-CoolMS-Section': slug } }));
+	if (!shouldStamp(req.url)) return next(req);
+	if (req.headers.has("X-CoolMS-Section")) return next(req);
+	const slug = inject(CURRENT_SECTION, { optional: true })?.currentSlug() ?? null;
+	if (!slug) return next(req);
+	return next(req.clone({ setHeaders: { "X-CoolMS-Section": slug } }));
 };
 function shouldStamp(url) {
-    // Strip protocol/host so absolute and relative URLs are treated alike.
-    const path = url.replace(/^https?:\/\/[^/]+/, '');
-    if (!path.startsWith('/api/v1/'))
-        return false;
-    if (path.startsWith('/api/v1/auth/'))
-        return false;
-    return true;
+	const path = url.replace(/^https?:\/\/[^/]+/, "");
+	if (!path.startsWith("/api/v1/")) return false;
+	if (path.startsWith("/api/v1/auth/")) return false;
+	return true;
 }
+export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, BYPASS_ELEVATION, CONSOLE_CONTRACT, CONSOLE_ENTRIES, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, ConsoleActivation, ConsoleAssemblyError, ConsolePanelHost, CrossTabAuthSyncService, ELEVATION_PROMPT, ELEVATION_REQUIRED_HEADER, ELEVATION_WARNING_FACTOR_MISSING, ELEVATION_WARNING_MFA_OFF, ELEVATION_WARNING_PASSWORD_NOT_SET, ElevationService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, assembleConsole, authGuard, authInterceptor, consoleChildren, consoleEntry, consoleModuleInstalled, elevationInterceptor, installedConsoleModules, isPortProvision, loginPageGuard, provideConsole, resolvePattern, satisfiesRange, sectionInterceptor };
 
-/**
- * `@coolms/core-angular` -- the CoolMS client runtime for Angular.
- *
- * Everything a CoolMS front-end needs before it has any UI: the session and its
- * refresh/cross-tab machinery, the boot manifest and app config, theme and user
- * preferences, error handling, the HTTP interceptors, and the wire types the
- * backend's form-render and navi-graph endpoints emit.
- *
- * It is deliberately NOT "the admin's core": nothing here is admin chrome. It is
- * also not a general Angular library -- every endpoint it speaks is a CoolMS
- * one, so it is worthless without a CoolMS backend. The layering is
- *
- *     @coolms/core-angular  ->  @coolms/admin-ui-angular  ->  @coolms/x-ui-angular
- *
- * and the reason it must be a package rather than app code is federation: the
- * kit and every remote need this at runtime as ONE `singleton`, and a remote
- * cannot import from its host.
- *
- * This barrel is the whole public surface. Nothing outside `core/` may deep-link
- * past it -- eslint enforces that, so this file is what "core exports" MEANS. A
- * symbol not listed here is internal, and adding one is a deliberate act.
- *
- * The single component (`LoginComponent`) is here on purpose: core owns the auth
- * lifecycle, so it ships a working sign-in rather than leaving every consumer to
- * rebuild one against endpoints only core knows.
- */
-// -- Wire types + the API client core owns ------------------------------------
-
-/**
- * Generated bundle index. Do not edit.
- */
-
-export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, CrossTabAuthSyncService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, authGuard, authInterceptor, loginPageGuard, resolvePattern, sectionInterceptor };
-//# sourceMappingURL=coolms-core-angular.mjs.map
+//# sourceMappingURL=coolms-core-angular.mjs.map