@coolms/core-angular 2.0.0-alpha.3 → 2.0.0-alpha.4

package/types/coolms-core-angular.d.ts

@@ -1,121 +1,164 @@
-import * as rxjs from 'rxjs';
-import { Observable } from 'rxjs';
-import * as i0 from '@angular/core';
-import { Type, InjectionToken } from '@angular/core';
-import { StateContext } from '@ngxs/store';
-import { CanActivateFn } from '@angular/router';
-import { HttpContextToken, HttpInterceptorFn } from '@angular/common/http';
-
-interface AuthApiManifest {
-    readonly login: string;
-    readonly logout: string;
-    readonly refresh: string;
-    readonly register: string;
-    readonly me: string;
-    readonly usersApi?: string;
-    readonly groupsApi?: string;
-    readonly preferencesUrl?: string;
-    readonly groupFormId?: string | null;
-    readonly userFormId?: string | null;
-}
-interface SectionApiManifest {
-    readonly list: string;
-    readonly create: string;
-    readonly item: string;
-    readonly update: string;
-    readonly delete: string;
-    readonly formId?: string;
-    readonly apply?: string;
-}
-interface NaviApiManifest {
-    readonly treesList: string;
-    readonly treesCreate: string;
-    readonly treesItem: string;
-    readonly nodesList: string;
-    readonly nodesCreate: string;
-    readonly nodesItem: string;
-    readonly nodesReorder: string;
-    readonly nodesMove: string;
-    readonly nodesByTree: string;
-    readonly treesFormId?: string;
-    readonly nodesFormId?: string;
-    readonly adminNavGraph?: string;
-    readonly topbarNavGraph?: string;
-    readonly toolbarVfsGraph?: string;
-    readonly graphBySlug?: string;
-}
-interface ContentApiManifest {
-    readonly variantPublishUrl: string;
-    readonly pageSpacesUrl?: string;
-    readonly pageTypesUrl?: string;
-}
-interface DataGridApiManifest {
-    readonly configBase: string;
-}
-interface TerminalApiManifest {
-    readonly executeUrl: string;
-    readonly completeUrl: string;
-}
-interface MediaApiManifest {
-    readonly listUrl: string;
-    readonly itemUrl: string;
-    readonly permissionsUrl: string;
-    readonly regenerateUrl: string;
-    readonly resizeUrl: string;
-    readonly collectionsUrl: string;
-    readonly collectionsCreateUrl: string;
-    readonly collectionPermissionsUrl: string;
-    readonly moveUrl?: string;
-    readonly spacesUrl?: string;
-}
-interface VfsApiManifest {
-    readonly fileContentUrl: string;
-    readonly binaryWriteUrl: string;
+import { Observable, Subject } from "rxjs";
+import * as i0 from "@angular/core";
+import { EnvironmentProviders, InjectionToken, Provider, Type } from "@angular/core";
+import { StateContext } from "@ngxs/store";
+import { CanActivateFn, CanMatchFn, Routes } from "@angular/router";
+import { HttpContextToken, HttpInterceptorFn } from "@angular/common/http";
+export interface AuthApiManifest {
+  readonly login: string;
+  readonly logout: string;
+  readonly refresh: string;
+  readonly register: string;
+  readonly me: string;
+  readonly usersApi?: string;
+  readonly groupsApi?: string;
+  readonly preferencesUrl?: string;
+  readonly groupFormId?: string | null;
+  readonly userFormId?: string | null;
+}
+export interface SectionApiManifest {
+  readonly list: string;
+  readonly create: string;
+  readonly item: string;
+  readonly update: string;
+  readonly delete: string;
+  readonly formId?: string;
+  readonly apply?: string;
+}
+export interface NaviApiManifest {
+  readonly treesList: string;
+  readonly treesCreate: string;
+  readonly treesItem: string;
+  readonly nodesList: string;
+  readonly nodesCreate: string;
+  readonly nodesItem: string;
+  readonly nodesReorder: string;
+  readonly nodesMove: string;
+  readonly nodesByTree: string;
+  readonly treesFormId?: string;
+  readonly nodesFormId?: string;
+  readonly adminNavGraph?: string;
+  readonly topbarNavGraph?: string;
+  readonly toolbarVfsGraph?: string;
+  readonly graphBySlug?: string;
+}
+export interface ContentApiManifest {
+  readonly variantPublishUrl: string;
+  readonly pageSpacesUrl?: string;
+  readonly pageTypesUrl?: string;
+}
+export interface DataGridApiManifest {
+  readonly configBase: string;
+}
+export interface TerminalApiManifest {
+  readonly executeUrl: string;
+  readonly completeUrl: string;
+}
+export interface MediaApiManifest {
+  readonly listUrl: string;
+  readonly itemUrl: string;
+  readonly permissionsUrl: string;
+  readonly regenerateUrl: string;
+  readonly resizeUrl: string;
+  readonly collectionsUrl: string;
+  readonly collectionsCreateUrl: string;
+  readonly collectionPermissionsUrl: string;
+  readonly moveUrl?: string;
+  readonly spacesUrl?: string;
+}
+export interface VfsApiManifest {
+  readonly fileContentUrl: string;
+  readonly binaryWriteUrl: string;
 }
 /**
  * Document module URL section. Today the only entry is `spacesUrl`;
  * the struct is reserved so future Document-module URLs can land
  * here without a new manifest section.
  */
-interface DocumentApiManifest {
-    readonly spacesUrl?: string;
-}
-interface DynamicEntityApiManifest {
-    readonly typesUrl: string;
-    readonly fieldDefinitionsUrl: string;
-    readonly fieldDefinitionUrl: string;
-    readonly fieldDefinitionsReorderUrl: string;
-    readonly toolbarNaviGraphUrl: string;
-    readonly constraintsUrl: string;
-    readonly recordsUrl: string;
-    readonly recordUrl: string;
-    readonly recordsByTypeUrl: string;
-    readonly typeUrl: string;
-    readonly typesCreateUrl: string;
-    readonly formTypesUrl?: string;
-    readonly typeByAliasUrl?: string;
-}
-interface DomainExplorerApiManifest {
-    readonly entitiesUrl: string;
-    readonly entityUrl: string;
-    readonly toolbarNaviGraphUrl: string;
-    readonly domainExplorerToolbarUrl: string;
-    readonly entityFieldsDataGridUrl?: string;
-    readonly typeFieldsDataGridUrl?: string;
-}
-interface IdentityApiManifest {
-    readonly usersUrl: string;
-    readonly userUrl: string;
-    readonly groupsUrl: string;
-    readonly groupUrl: string;
-    readonly meUrl: string;
-    readonly assignGroupsUrl: string;
-    readonly avatarUploadUrl: string;
-    readonly settingsUrl: string;
-    readonly settingsSectionsUrl: string;
-    readonly settingsSectionUrl: string;
-    readonly colorUrl: string;
-    readonly rolesUrl?: string;
+export interface DocumentApiManifest {
+  readonly spacesUrl?: string;
+  /**
+   * !! Carried here rather than derived from `spacesUrl`. Concatenating
+   * `/available` onto that would couple the client to a URL shape the router
+   * owns, and it would keep working until the route moved -- then fail as a
+   * 404 the UI reports as "no sites available", which is indistinguishable
+   * from the true empty answer.
+   *
+   * !! ABSENT ARRIVES AS `''`, NOT `undefined`. The producer declares these
+   * as non-nullable strings defaulting to empty, so an installation that has
+   * not set them sends an empty string and the `?` here never fires.
+   *
+   * Guard on FALSINESS -- `!url`, `Boolean(url)`. The dangerous rewrite is
+   * `url === undefined` (or `!== undefined`), which reads as more precise and
+   * treats `''` as present, handing a caller a request to the empty string.
+   *
+   * !! A `?? fallback` is NOT the hazard, though it looks like the obvious
+   * one: `'' ?? x` is `''`, so a fallback never fires on the value this
+   * producer actually sends. Measured by mutation -- adding one changed
+   * nothing, changing the guard broke three assertions.
+   */
+  readonly spacesAvailableUrl?: string;
+  readonly spaceEnablementUrl?: string;
+  /**
+   * FQCN of the entity a filter-mode audience can be built from.
+   *
+   * !! The SERVER owns this and the client must not know it. The generation
+   * wizard offers Filter mode only when a template's context schema
+   * references this type, and it used to compare against a constant compiled
+   * into this bundle -- which shipped the consuming application's class name
+   * inside a published package, and tied that package to an installation
+   * having that exact class.
+   *
+   * !! Absent arrives as `''`, like the urls above. Treat empty as **filter
+   * mode unavailable**, never as a reason to fall back to a remembered
+   * value: the server is the thing that rejects every other type, so a guess
+   * here offers a mode the server will refuse.
+   */
+  readonly filterAudienceEntity?: string;
+}
+export interface DynamicEntityApiManifest {
+  readonly typesUrl: string;
+  readonly fieldDefinitionsUrl: string;
+  readonly fieldDefinitionUrl: string;
+  readonly fieldDefinitionsReorderUrl: string;
+  readonly toolbarNaviGraphUrl: string;
+  readonly constraintsUrl: string;
+  readonly recordsUrl: string;
+  readonly recordUrl: string;
+  readonly recordsByTypeUrl: string;
+  readonly typeUrl: string;
+  readonly typesCreateUrl: string;
+  readonly formTypesUrl?: string;
+  readonly typeByAliasUrl?: string;
+}
+export interface DomainExplorerApiManifest {
+  readonly entitiesUrl: string;
+  readonly entityUrl: string;
+  readonly toolbarNaviGraphUrl: string;
+  readonly domainExplorerToolbarUrl: string;
+  readonly entityFieldsDataGridUrl?: string;
+  readonly typeFieldsDataGridUrl?: string;
+}
+export interface IdentityApiManifest {
+  readonly usersUrl: string;
+  readonly userUrl: string;
+  readonly groupsUrl: string;
+  readonly groupUrl: string;
+  readonly meUrl: string;
+  readonly assignGroupsUrl: string;
+  readonly avatarUploadUrl: string;
+  readonly settingsUrl: string;
+  readonly settingsSectionsUrl: string;
+  readonly settingsSectionUrl: string;
+  readonly colorUrl: string;
+  readonly rolesUrl?: string;
+  readonly elevationUrl?: string;
+  readonly deletionsUrl?: string;
+  readonly footprintsUrl?: string;
+  readonly userDeletionUrl?: string;
+  readonly userLegalHoldsUrl?: string;
+  readonly holdsSettingsBlock?: string;
+  readonly legalHoldFormId?: string | null;
 }
 /**
  * Editor sub-manifest emitted by the backend's Editor module. The
@@ -127,49 +170,49 @@ interface IdentityApiManifest {
  * pre-resolved contributor list AND the storage allow-list a sanitizer
  * enforces on save.
  */
-interface EditorApiManifestEntry {
-    readonly id: string;
-    readonly group: string;
-    readonly priority: number;
-    readonly icon: string;
-    readonly label: string;
-    readonly actionType: string;
-    readonly actionParams: Readonly<Record<string, unknown>>;
-    readonly extensions: ReadonlyArray<string>;
-    readonly stateKeys: ReadonlyArray<string>;
-    readonly shortcut?: string | null;
-    readonly slashable?: boolean;
-    readonly keywords?: ReadonlyArray<string>;
-}
-interface EditorApiManifestProfile {
-    readonly contributors: ReadonlyArray<EditorApiManifestEntry>;
-    readonly allowedWidgets: ReadonlyArray<string>;
-}
-interface EditorApiManifest {
-    readonly schemaVersion: number;
-    readonly profiles: Readonly<Record<string, EditorApiManifestProfile>>;
+export interface EditorApiManifestEntry {
+  readonly id: string;
+  readonly group: string;
+  readonly priority: number;
+  readonly icon: string;
+  readonly label: string;
+  readonly actionType: string;
+  readonly actionParams: Readonly<Record<string, unknown>>;
+  readonly extensions: ReadonlyArray<string>;
+  readonly stateKeys: ReadonlyArray<string>;
+  readonly shortcut?: string | null;
+  readonly slashable?: boolean;
+  readonly keywords?: ReadonlyArray<string>;
+}
+export interface EditorApiManifestProfile {
+  readonly contributors: ReadonlyArray<EditorApiManifestEntry>;
+  readonly allowedWidgets: ReadonlyArray<string>;
+}
+export interface EditorApiManifest {
+  readonly schemaVersion: number;
+  readonly profiles: Readonly<Record<string, EditorApiManifestProfile>>;
 }
 /**
  * Viewer manifest emitted by the backend's Document module.
  * Each viewer declares the MIME types / extensions it handles, the
  * Angular component selector to dispatch into, and one config blob per
- * profile. Profile config is open-ended — every viewer interprets the
+ * profile. Profile config is open-ended -- every viewer interprets the
  * keys it understands and ignores the rest.
  */
-interface ViewerProfileApiManifest {
-    readonly key: string;
-    readonly config: Readonly<Record<string, unknown>>;
+export interface ViewerProfileApiManifest {
+  readonly key: string;
+  readonly config: Readonly<Record<string, unknown>>;
 }
-interface ViewerDefinitionApiManifest {
-    readonly key: string;
-    readonly mimeTypes: ReadonlyArray<string>;
-    readonly extensions: ReadonlyArray<string>;
-    readonly component: string;
-    readonly profiles: Readonly<Record<string, ViewerProfileApiManifest>>;
+export interface ViewerDefinitionApiManifest {
+  readonly key: string;
+  readonly mimeTypes: ReadonlyArray<string>;
+  readonly extensions: ReadonlyArray<string>;
+  readonly component: string;
+  readonly profiles: Readonly<Record<string, ViewerProfileApiManifest>>;
 }
-interface ViewerApiManifest {
-    readonly schemaVersion: number;
-    readonly viewers: Readonly<Record<string, ViewerDefinitionApiManifest>>;
+export interface ViewerApiManifest {
+  readonly schemaVersion: number;
+  readonly viewers: Readonly<Record<string, ViewerDefinitionApiManifest>>;
 }
 /**
  * Platform-wide default user-facing settings. The
@@ -178,47 +221,68 @@ interface ViewerApiManifest {
  * config, not an FE-hardcoded Western default. `locale` is the default
  * locale, previously absent from the manifest.
  */
-interface PlatformDefaults {
-    readonly locale: string;
-    readonly timezone: string;
-    readonly dateFormat: string;
-    readonly timeFormat: '12h' | '24h';
-    readonly weekStart: 'monday' | 'sunday';
-    /**
-     * Deployment brand accent as `#rrggbb`, or null/absent to keep the
-     * stylesheet's own. Sits BELOW a user's personal accentColor.
-     */
-    readonly accentColor?: string | null;
-}
-interface ApiManifest {
-    readonly apiBase: string;
-    readonly configBase?: string;
-    readonly auth?: AuthApiManifest;
-    readonly identity?: IdentityApiManifest;
-    readonly sections?: SectionApiManifest;
-    readonly navi?: NaviApiManifest;
-    readonly content?: ContentApiManifest;
-    readonly dataGrid?: DataGridApiManifest;
-    readonly terminal?: TerminalApiManifest;
-    readonly media?: MediaApiManifest;
-    readonly document?: DocumentApiManifest;
-    readonly vfs?: VfsApiManifest;
-    readonly dynamicEntity?: DynamicEntityApiManifest;
-    readonly domainExplorer?: DomainExplorerApiManifest;
-    readonly editor?: EditorApiManifest;
-    readonly viewers?: ViewerApiManifest;
-    readonly supportedLocales?: Array<{
-        code: string;
-        label: string;
-    }>;
-    readonly platformDefaults?: PlatformDefaults;
-}
-interface ThemeConfigResponse {
-    readonly slug?: string | null;
-    readonly feStack?: string | null;
-    readonly spaFramework?: string | null;
-    readonly assetsUrl?: string | null;
-    readonly manifest: ApiManifest;
+export interface PlatformDefaults {
+  readonly locale: string;
+  readonly timezone: string;
+  readonly dateFormat: string;
+  readonly timeFormat: '12h' | '24h';
+  readonly weekStart: 'monday' | 'sunday';
+  /**
+   * Deployment brand accent as `#rrggbb`, or null/absent to keep the
+   * stylesheet's own. Sits BELOW a user's personal accentColor.
+   */
+  readonly accentColor?: string | null;
+}
+/**
+ * The host contracts in force here (the platform rule: hosts implement
+ * contracts, modules offer entries): for each contract, what the one
+ * installed theme implementing it declares, and the installed modules whose
+ * entries the installer matched against it. A host mounts a module only when
+ * it is listed.
+ */
+export interface UiApiManifest {
+  /** The contracts in force, name -> MAJOR.MINOR (`{ console: '1.0' }`): one installed theme implements each. */
+  readonly contracts: Readonly<Record<string, string>>;
+  /** Which installed theme implements each contract, name -> theme slug. */
+  readonly hosts?: Readonly<Record<string, string>>;
+  readonly modules: ReadonlyArray<UiModuleEntryManifest>;
+}
+export interface UiModuleEntryManifest {
+  readonly module: string;
+  readonly contract: string;
+  readonly range: string;
+  readonly framework: string;
+}
+export interface ApiManifest {
+  readonly apiBase: string;
+  readonly ui?: UiApiManifest;
+  readonly configBase?: string;
+  readonly auth?: AuthApiManifest;
+  readonly identity?: IdentityApiManifest;
+  readonly sections?: SectionApiManifest;
+  readonly navi?: NaviApiManifest;
+  readonly content?: ContentApiManifest;
+  readonly dataGrid?: DataGridApiManifest;
+  readonly terminal?: TerminalApiManifest;
+  readonly media?: MediaApiManifest;
+  readonly document?: DocumentApiManifest;
+  readonly vfs?: VfsApiManifest;
+  readonly dynamicEntity?: DynamicEntityApiManifest;
+  readonly domainExplorer?: DomainExplorerApiManifest;
+  readonly editor?: EditorApiManifest;
+  readonly viewers?: ViewerApiManifest;
+  readonly supportedLocales?: Array<{
+    code: string;
+    label: string;
+  }>;
+  readonly platformDefaults?: PlatformDefaults;
+}
+export interface ThemeConfigResponse {
+  readonly slug?: string | null;
+  readonly feStack?: string | null;
+  readonly spaFramework?: string | null;
+  readonly assetsUrl?: string | null;
+  readonly manifest: ApiManifest;
 }
 /**
  * Replaces {param} tokens in a URL pattern with encoded values.
@@ -227,8 +291,7 @@ interface ThemeConfigResponse {
  *   resolvePattern(manifest.sections!.item, { id: '123' })
  *   // -> '/api/v1/sections/123'
  */
-declare function resolvePattern(pattern: string, params: Record<string, string>): string;
-
+export declare function resolvePattern(pattern: string, params: Record<string, string>): string;
 /**
  * Shapes the user-preference store persists.
  *
@@ -241,12 +304,11 @@ declare function resolvePattern(pattern: string, params: Record<string, string>)
  * keeps its own local path and nothing that reads a grid preference had to
  * change.
  */
-interface DataGridPreference {
-    columns?: string[];
-    columnWidths?: Record<string, number>;
+export interface DataGridPreference {
+  columns?: string[];
+  columnWidths?: Record<string, number>;
 }
-type DataGridPreferences = Record<string, DataGridPreference>;
-
+export type DataGridPreferences = Record<string, DataGridPreference>;
 /**
  * Session and current-user DTOs.
  *
@@ -258,123 +320,121 @@ type DataGridPreferences = Record<string, DataGridPreference>;
  * `ApiService` re-exports them from its own module, so the feature files that
  * import `UserDto` from there are untouched.
  */
-interface TokenResponse {
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: string;
-    user?: UserDto;
-}
-interface UserDto {
-    id: string;
-    email: string;
-    identifier?: string;
-    roles: string[];
-    uiPrefs?: DataGridPreferences;
-    avatarUrl?: string | null;
-    firstName?: string | null;
-    lastName?: string | null;
-    fullName?: string;
-}
-
-type FieldType = 'text' | 'email' | 'password' | 'number' | 'textarea' | 'select' | 'toggle' | 'date' | 'time' | 'hidden' | 'relation' | 'subform' | 'token-pattern' | 'richtext' | 'localizedText' | 'localizedTextarea' | 'optionsEditor' | 'intlPhone' | 'color';
-type DataSourceType = 'static' | 'enum' | 'api' | 'repo';
-type VisibilityOperator = 'eq' | 'ne' | 'in' | 'notIn' | 'empty' | 'notEmpty';
-interface VisibilityCondition {
-    readonly field: string;
-    readonly operator: VisibilityOperator;
-    readonly value?: unknown;
-}
-type DataSourceWidget = 'select' | 'select-search' | 'select-tree' | 'token-input' | 'media-picker';
-type DataSourceLoading = 'eager' | 'lazy';
-interface DataSourceOption {
-    readonly value: unknown;
-    readonly label: string;
-    readonly parentId?: string | null;
-}
-interface DataSourceDefinition {
-    readonly type: DataSourceType;
-    readonly bindValue: string;
-    readonly bindLabel: string;
-    readonly multiple: boolean;
-    readonly maxItems?: number;
-    readonly options?: ReadonlyArray<DataSourceOption>;
-    readonly url?: string;
-    readonly widget: DataSourceWidget;
-    readonly loading: DataSourceLoading;
-    /** Free-form widget-specific configuration block populated from YAML
-     *  `dataSource.widgetOptions`. Used by media-picker for bindTarget /
-     *  display / accept / recentlyUsed / hoverPreview, and reserved for
-     *  future custom widgets. Kept separate from `options` (which is the
-     *  static-option list) to avoid key collisions. */
-    readonly widgetOptions?: Readonly<Record<string, unknown>>;
-}
-interface ValidatorDefinition {
-    readonly type: string;
-    readonly value?: unknown;
-    readonly message?: string;
-}
-interface RelationDefinition {
-    readonly cardinality: 'one' | 'many';
-    readonly maxItems?: number;
-    readonly targetFormId?: string;
-    readonly dataSource?: DataSourceDefinition;
-}
-interface SubFormDefinition {
-    readonly formId: string;
-    readonly relation: 'one' | 'many';
-    readonly maxItems?: number;
-}
-interface FieldSecurityPolicy {
-    readonly read: ReadonlyArray<string>;
-    readonly write: ReadonlyArray<string>;
-}
-interface FieldItem {
-    readonly alias: string;
-    readonly type: FieldType;
-    readonly label: string;
-    readonly placeholder?: string;
-    readonly hint?: string;
-    readonly required: boolean;
-    readonly readonly: boolean;
-    readonly locked: boolean;
-    readonly private: boolean;
-    readonly validators: ReadonlyArray<ValidatorDefinition>;
-    readonly dataSource?: DataSourceDefinition;
-    readonly relation?: RelationDefinition;
-    readonly subForm?: SubFormDefinition;
-    readonly separators?: ReadonlyArray<string>;
-    readonly security?: FieldSecurityPolicy | null;
-    readonly autocomplete?: string;
-}
-interface LayoutNode {
-    readonly type: 'group' | 'grid' | 'column' | 'tabs' | 'tab' | (string & {});
-    readonly name?: string;
-    readonly description?: string;
-    readonly compact?: boolean;
-    readonly width?: number;
-    readonly children?: ReadonlyArray<LayoutNode>;
-    readonly showWhen?: VisibilityCondition;
-}
-type FormActionType = 'submit' | 'button' | 'reset';
-type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
-/** Terminal form button (Submit / Cancel / …) — mirrors PHP FormAction.
+export interface TokenResponse {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: string;
+  user?: UserDto;
+}
+export interface UserDto {
+  id: string;
+  email: string;
+  identifier?: string;
+  roles: string[];
+  uiPrefs?: DataGridPreferences;
+  avatarUrl?: string | null;
+  firstName?: string | null;
+  lastName?: string | null;
+  fullName?: string;
+}
+export type FieldType = 'text' | 'email' | 'password' | 'number' | 'textarea' | 'select' | 'toggle' | 'date' | 'time' | 'hidden' | 'relation' | 'subform' | 'token-pattern' | 'richtext' | 'localizedText' | 'localizedTextarea' | 'optionsEditor' | 'intlPhone' | 'color';
+export type DataSourceType = 'static' | 'enum' | 'api' | 'repo';
+export type VisibilityOperator = 'eq' | 'ne' | 'in' | 'notIn' | 'empty' | 'notEmpty';
+export interface VisibilityCondition {
+  readonly field: string;
+  readonly operator: VisibilityOperator;
+  readonly value?: unknown;
+}
+export type DataSourceWidget = 'select' | 'select-search' | 'select-tree' | 'token-input' | 'media-picker';
+export type DataSourceLoading = 'eager' | 'lazy';
+export interface DataSourceOption {
+  readonly value: unknown;
+  readonly label: string;
+  readonly parentId?: string | null;
+}
+export interface DataSourceDefinition {
+  readonly type: DataSourceType;
+  readonly bindValue: string;
+  readonly bindLabel: string;
+  readonly multiple: boolean;
+  readonly maxItems?: number;
+  readonly options?: ReadonlyArray<DataSourceOption>;
+  readonly url?: string;
+  readonly widget: DataSourceWidget;
+  readonly loading: DataSourceLoading;
+  /** Free-form widget-specific configuration block populated from YAML
+   *  `dataSource.widgetOptions`. Used by media-picker for bindTarget /
+   *  display / accept / recentlyUsed / hoverPreview, and reserved for
+   *  future custom widgets. Kept separate from `options` (which is the
+   *  static-option list) to avoid key collisions. */
+  readonly widgetOptions?: Readonly<Record<string, unknown>>;
+}
+export interface ValidatorDefinition {
+  readonly type: string;
+  readonly value?: unknown;
+  readonly message?: string;
+}
+export interface RelationDefinition {
+  readonly cardinality: 'one' | 'many';
+  readonly maxItems?: number;
+  readonly targetFormId?: string;
+  readonly dataSource?: DataSourceDefinition;
+}
+export interface SubFormDefinition {
+  readonly formId: string;
+  readonly relation: 'one' | 'many';
+  readonly maxItems?: number;
+}
+export interface FieldSecurityPolicy {
+  readonly read: ReadonlyArray<string>;
+  readonly write: ReadonlyArray<string>;
+}
+export interface FieldItem {
+  readonly alias: string;
+  readonly type: FieldType;
+  readonly label: string;
+  readonly placeholder?: string;
+  readonly hint?: string;
+  readonly required: boolean;
+  readonly readonly: boolean;
+  readonly locked: boolean;
+  readonly private: boolean;
+  readonly validators: ReadonlyArray<ValidatorDefinition>;
+  readonly dataSource?: DataSourceDefinition;
+  readonly relation?: RelationDefinition;
+  readonly subForm?: SubFormDefinition;
+  readonly separators?: ReadonlyArray<string>;
+  readonly security?: FieldSecurityPolicy | null;
+  readonly autocomplete?: string;
+}
+export interface LayoutNode {
+  readonly type: 'group' | 'grid' | 'column' | 'tabs' | 'tab' | (string & {});
+  readonly name?: string;
+  readonly description?: string;
+  readonly compact?: boolean;
+  readonly width?: number;
+  readonly children?: ReadonlyArray<LayoutNode>;
+  readonly showWhen?: VisibilityCondition;
+}
+export type FormActionType = 'submit' | 'button' | 'reset';
+export type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
+/** Terminal form button (Submit / Cancel / ...) -- mirrors PHP FormAction.
  *  Resolved by the backend (declared `formOptions.actions`, else lifted from
  *  legacy submit fields, else a default Submit). `label` is already translated. */
-interface FormAction {
-    readonly type: FormActionType;
-    readonly label: string;
-    readonly name: string;
-    readonly variant: FormActionVariant;
-}
-interface FormRenderDefinition {
-    readonly id: string;
-    readonly context: 'create' | 'edit';
-    readonly layout: ReadonlyArray<LayoutNode>;
-    readonly items: ReadonlyArray<FieldItem>;
-    readonly actions: ReadonlyArray<FormAction>;
-    readonly action?: string;
-}
-
+export interface FormAction {
+  readonly type: FormActionType;
+  readonly label: string;
+  readonly name: string;
+  readonly variant: FormActionVariant;
+}
+export interface FormRenderDefinition {
+  readonly id: string;
+  readonly context: 'create' | 'edit';
+  readonly layout: ReadonlyArray<LayoutNode>;
+  readonly items: ReadonlyArray<FieldItem>;
+  readonly actions: ReadonlyArray<FormAction>;
+  readonly action?: string;
+}
 /**
  * The collection envelope API Platform wraps every list response in.
  *
@@ -395,18 +455,17 @@ interface FormRenderDefinition {
  * crashes if it does. Settle it by calling the endpoint, not by merging the
  * types.
  */
-interface HydraView {
-    '@id': string;
-    'next'?: string;
-    'previous'?: string;
-    'last'?: string;
-}
-interface HydraCollection<T> {
-    'member': T[];
-    'totalItems': number;
-    'view'?: HydraView;
-}
-
+export interface HydraView {
+  '@id': string;
+  'next'?: string;
+  'previous'?: string;
+  'last'?: string;
+}
+export interface HydraCollection<T> {
+  'member': T[];
+  'totalItems': number;
+  'view'?: HydraView;
+}
 /**
  * The identity endpoints core owns: the session lifecycle, plus the settings
  * read at boot.
@@ -423,40 +482,46 @@ interface HydraCollection<T> {
  * `ApiService` keeps its own identical signatures and delegates here, so none
  * of the 94 feature files calling it changed.
  */
-declare class IdentityApiClient {
-    private readonly http;
-    private readonly store;
-    /** URLs come from the boot manifest, which core already owns. */
-    private get manifest();
-    login(identifier: string, password: string): Observable<TokenResponse>;
-    refresh(refreshToken: string): Observable<TokenResponse>;
-    logout(): Observable<void>;
-    me(): Observable<UserDto>;
-    getSettings(): Observable<Record<string, Record<string, unknown>>>;
-    static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<IdentityApiClient>;
-}
-
+export declare class IdentityApiClient {
+  private readonly http;
+  private readonly store;
+  /** URLs come from the boot manifest, which core already owns. */
+  private get manifest();
+  login(identifier: string, password: string): Observable<TokenResponse>;
+  refresh(refreshToken: string): Observable<TokenResponse>;
+  logout(): Observable<void>;
+  me(): Observable<UserDto>;
+  getSettings(): Observable<Record<string, Record<string, unknown>>>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Response of `POST /centrifugo/connection-token`: the JWT the realtime SDK
  * opens its socket with, and what it needs to refresh before expiry.
  */
-interface CentrifugoConnectionTokenDto {
-    token: string;
-    expiresAt: number;
-    ttl: number;
-    wsUrl: string;
+export interface CentrifugoConnectionTokenDto {
+  token: string;
+  expiresAt: number;
+  ttl: number;
+  wsUrl: string;
+  /**
+   * The code the server closes this connection with when the caller's session
+   * ended (a sign-out everywhere, a password change, a deactivation). On it the
+   * client signs out and ends its calls at once, without reconnecting or waiting
+   * for a 401 (2026-09-26). Absent from a server older than that.
+   */
+  sessionEndedCode?: number;
 }
 /**
  * Response of `POST /centrifugo/subscription-token`: a per-channel JWT. The
  * SDK asks for one before subscribing to a private namespace, so this is
  * fetched per subscription rather than once per connection.
  */
-interface CentrifugoSubscriptionTokenDto {
-    channel: string;
-    token: string;
-    expiresAt: number;
-    ttl: number;
+export interface CentrifugoSubscriptionTokenDto {
+  channel: string;
+  token: string;
+  expiresAt: number;
+  ttl: number;
 }
 /**
  * The two realtime endpoints, carved out for the same reason the identity ones
@@ -472,82 +537,78 @@ interface CentrifugoSubscriptionTokenDto {
  * `ApiService` keeps its identical signatures and delegates here, so nothing
  * calling it had to change.
  */
-declare class RealtimeTokenClient {
-    private readonly http;
-    private readonly store;
-    private get manifest();
-    connectionToken(): Observable<CentrifugoConnectionTokenDto>;
-    subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
-    static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<RealtimeTokenClient>;
-}
-
-declare class Login {
-    identifier: string;
-    password: string;
-    static readonly type = "[Auth] Login";
-    constructor(identifier: string, password: string);
-}
-declare class Logout {
-    static readonly type = "[Auth] Logout";
-}
-declare class RestoreSession {
-    static readonly type = "[Auth] Restore Session";
-}
-declare class SetTokens {
-    readonly response: TokenResponse;
-    static readonly type = "[Auth] Set Tokens";
-    constructor(response: TokenResponse);
+export declare class RealtimeTokenClient {
+  private readonly http;
+  private readonly store;
+  private get manifest();
+  connectionToken(): Observable<CentrifugoConnectionTokenDto>;
+  subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export declare class Login {
+  identifier: string;
+  password: string;
+  static readonly type = "[Auth] Login";
+  constructor(identifier: string, password: string);
+}
+export declare class Logout {
+  static readonly type = "[Auth] Logout";
+}
+export declare class RestoreSession {
+  static readonly type = "[Auth] Restore Session";
+}
+export declare class SetTokens {
+  readonly response: TokenResponse;
+  static readonly type = "[Auth] Set Tokens";
+  constructor(response: TokenResponse);
 }
 /** Merge a partial update into the currently-stored user (e.g. after avatar change). */
-declare class PatchCurrentUser {
-    readonly patch: Partial<UserDto>;
-    static readonly type = "[Auth] Patch Current User";
-    constructor(patch: Partial<UserDto>);
-}
-
-interface AuthStateModel {
-    accessToken: string | null;
-    refreshToken: string | null;
-    expiresAt: string | null;
-    user: UserDto | null;
-}
-declare class AuthState {
-    private readonly api;
-    private readonly prefs;
-    login(ctx: StateContext<AuthStateModel>, { identifier, password }: Login): rxjs.Observable<UserDto | null>;
-    logout(ctx: StateContext<AuthStateModel>): void;
-    restore(ctx: StateContext<AuthStateModel>): void;
-    setTokens(ctx: StateContext<AuthStateModel>, { response }: SetTokens): void;
-    patchCurrentUser(ctx: StateContext<AuthStateModel>, { patch }: PatchCurrentUser): void;
-    static isAuthenticated(state: AuthStateModel): boolean;
-    static accessToken(state: AuthStateModel): string | null;
-    static refreshToken(state: AuthStateModel): string | null;
-    /**
-     * Sub-phase Y -- expose the access-token expiry timestamp so
-     * preemptive-refresh callers (e.g., Centrifuge getToken
-     * callbacks) can decide whether to rotate before issuing the
-     * next protected request, instead of relying on the
-     * interceptor's reactive 401-retry path.
-     */
-    static expiresAt(state: AuthStateModel): string | null;
-    static currentUser(state: AuthStateModel): UserDto | null;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AuthState>;
-}
-
+export declare class PatchCurrentUser {
+  readonly patch: Partial<UserDto>;
+  static readonly type = "[Auth] Patch Current User";
+  constructor(patch: Partial<UserDto>);
+}
+export interface AuthStateModel {
+  accessToken: string | null;
+  refreshToken: string | null;
+  expiresAt: string | null;
+  user: UserDto | null;
+}
+export declare class AuthState {
+  private readonly api;
+  private readonly prefs;
+  login(ctx: StateContext<AuthStateModel>, { identifier, password }: Login): import("rxjs").Observable<UserDto | null>;
+  logout(ctx: StateContext<AuthStateModel>): void;
+  restore(ctx: StateContext<AuthStateModel>): void;
+  setTokens(ctx: StateContext<AuthStateModel>, { response }: SetTokens): void;
+  patchCurrentUser(ctx: StateContext<AuthStateModel>, { patch }: PatchCurrentUser): void;
+  static isAuthenticated(state: AuthStateModel): boolean;
+  static accessToken(state: AuthStateModel): string | null;
+  static refreshToken(state: AuthStateModel): string | null;
+  /**
+   * Sub-phase Y -- expose the access-token expiry timestamp so
+   * preemptive-refresh callers (e.g., Centrifuge getToken
+   * callbacks) can decide whether to rotate before issuing the
+   * next protected request, instead of relying on the
+   * interceptor's reactive 401-retry path.
+   */
+  static expiresAt(state: AuthStateModel): string | null;
+  static currentUser(state: AuthStateModel): UserDto | null;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Protects routes that require authentication.
  *
  * The guard is intentionally ASYNC: it waits for AppInitService.ready$ before
  * evaluating auth state.  Without this, Angular's router can evaluate
- * isAuthenticated while APP_INITIALIZER is still in-flight — RestoreSession
+ * isAuthenticated while APP_INITIALIZER is still in-flight -- RestoreSession
  * will have placed a non-null (but expired) token in state, causing the guard
  * to pass even though the subsequent config/refresh requests will fail and
  * dispatch Logout.  Waiting for ready$ guarantees the auth state is settled.
  */
-declare const authGuard: CanActivateFn;
-
+export declare const authGuard: CanActivateFn;
 /**
  * Guards the `/login` route -- redirects already-authenticated
  * callers to admin home so a stale tab parked on `/login` cannot
@@ -563,11 +624,9 @@ declare const authGuard: CanActivateFn;
  * as anonymous, allow `/login`, and only then have the token
  * populated.
  */
-declare const loginPageGuard: CanActivateFn;
-
-declare const BYPASS_AUTH: HttpContextToken<boolean>;
-declare const authInterceptor: HttpInterceptorFn;
-
+export declare const loginPageGuard: CanActivateFn;
+export declare const BYPASS_AUTH: HttpContextToken<boolean>;
+export declare const authInterceptor: HttpInterceptorFn;
 /**
  * Two-layer refresh coordinator: an intra-tab `shareReplay(1)`
  * mutex dedupes concurrent callers within one tab, and a
@@ -591,46 +650,83 @@ declare const authInterceptor: HttpInterceptorFn;
  * (real auth failure). Transient errors (network blips, 5xx,
  * CORS, timeouts) propagate without clearing the session so a
  * momentary refresh failure does not kill a valid login.
+ *
+ * A token the server REFUSED (2026-09-26). A caller answering a 401
+ * passes the access token that was refused. Until then the lock body
+ * handed back the cached token whenever its expiry looked fresh --
+ * which a revoked token's does: a session ended on the server (a
+ * sign-out everywhere from another device, a password change) was
+ * retried with the same dead token and never refreshed, so the client
+ * stayed signed in, and in its calls, until the token neared expiry
+ * (measured: a 1:1 call kept for the whole 30 s window, every request
+ * answered 401). Now the lock body re-reads the SHARED copy
+ * (`localStorage`, which every tab's `SetTokens` writes synchronously;
+ * this tab's state only follows a sibling's write when its `storage`
+ * event arrives):
+ *   - a different access token there -> another tab (or an earlier
+ *     refresh here) already rotated past the refused one: use it, no
+ *     request;
+ *   - the same one -> the server refused this token: refresh, with the
+ *     newest refresh token -- the shared one, so a rotation a sibling
+ *     made is never replayed with the token it consumed. A 401 there
+ *     is the session's end: `Logout`.
  */
-declare class AuthRefreshCoordinator {
-    private readonly api;
-    private readonly store;
-    private readonly router;
-    private inFlight;
-    /**
-     * Return the in-flight refresh Observable, or spawn a new one
-     * with the supplied refresh-token value.
-     *
-     * Callers subscribe via `switchMap` / `firstValueFrom` to retry
-     * their original request with the resolved access token.
-     */
-    refresh(refreshToken: string): Observable<string>;
-    /**
-     * Run the refresh body inside `navigator.locks` when the API is
-     * available; degrade to direct invocation otherwise. The lock
-     * body checks for state already updated by a sibling tab before
-     * issuing its own HTTP call.
-     */
-    private refreshWithCrossTabLock;
-    /**
-     * Lock body. Re-reads `AuthState.expiresAt` first: if another
-     * tab published fresh tokens while we were queued, return the
-     * cached access token directly. Otherwise read the latest
-     * refresh-token value from state (it may have rotated while we
-     * waited) and issue the HTTP refresh.
-     */
-    private executeRefresh;
-    /**
-     * Return the cached access token when `AuthState.expiresAt` has
-     * more than `FRESH_TOKEN_GRACE_MS` milliseconds remaining --
-     * signalling that some other tab refreshed for us. Null
-     * otherwise.
-     */
-    private tryConsumeFreshState;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AuthRefreshCoordinator>;
-}
-
+export declare class AuthRefreshCoordinator {
+  private readonly api;
+  private readonly store;
+  private readonly router;
+  private inFlight;
+  /**
+   * Return the in-flight refresh Observable, or spawn a new one
+   * with the supplied refresh-token value.
+   *
+   * `refusedAccessToken`: the access token the server just answered
+   * 401 to, when the caller is answering one. With it, the lock body
+   * refreshes unless the shared copy already holds another token;
+   * without it (a preemptive refresh), a fresh-looking cached token
+   * is handed back as before.
+   *
+   * Callers subscribe via `switchMap` / `firstValueFrom` to retry
+   * their original request with the resolved access token.
+   */
+  refresh(refreshToken: string, refusedAccessToken?: string | null): Observable<string>;
+  /**
+   * Run the refresh body inside `navigator.locks` when the API is
+   * available; degrade to direct invocation otherwise. The lock
+   * body checks for state already updated by a sibling tab before
+   * issuing its own HTTP call.
+   */
+  private refreshWithCrossTabLock;
+  /**
+   * Lock body. Re-reads the shared copy first (see the class note).
+   *
+   * Answering a refusal: a shared access token other than the refused
+   * one is a rotation already made -- taken, and mirrored into this
+   * tab's state if its `storage` event has not arrived yet. Otherwise,
+   * or for a preemptive caller whose cached token no longer looks
+   * fresh, the HTTP refresh, with the newest refresh token: shared,
+   * then state, then the caller's.
+   */
+  private executeRefresh;
+  /**
+   * The session as the tabs share it, or null when there is none to
+   * read: no storage, nothing stored (signed out), or a value that is
+   * not a complete token set.
+   */
+  private readShared;
+  /**
+   * For a preemptive caller only: return the current access token when
+   * its expiry is more than `FRESH_TOKEN_GRACE_MS` milliseconds away --
+   * signalling that some other tab refreshed for us. The shared copy
+   * first, which a sibling's rotation reaches before this tab's state
+   * does (mirrored here when it is newer); this tab's state when there
+   * is none. Null otherwise. Never asked for a token the server
+   * refused: a refused token's expiry looks just as fresh.
+   */
+  private tryConsumeFreshState;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Bridges shared `localStorage` mutations into the NGXS auth
  * state so a refresh executed in one tab silently propagates to
@@ -655,65 +751,368 @@ declare class AuthRefreshCoordinator {
  * Started from `AppInitService.load()` so the listener is in
  * place before any protected HTTP fires.
  */
-declare class CrossTabAuthSyncService {
-    private readonly store;
-    private listenerAttached;
-    start(): void;
-    private readonly handleStorageEvent;
-    static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<CrossTabAuthSyncService>;
-}
-
-declare class LoginComponent {
-    identifier: string;
-    password: string;
-    loading: boolean;
-    error: string | null;
-    private readonly store;
-    private readonly router;
-    submit(): void;
-    static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
-}
-
-declare class AppInitService {
-    private readonly http;
-    private readonly store;
-    private readonly router;
-    private readonly location;
-    private readonly prefs;
-    private readonly crossTabSync;
-    private readonly refreshCoordinator;
-    /** The only hardcoded URL — everything else comes from the manifest. */
-    private readonly configUrl;
-    /**
-     * Emits (once) when load() has fully completed — tokens settled, manifest
-     * set (or swallowed on error).  authGuard subscribes to this so it never
-     * evaluates isAuthenticated against a partially-restored stale token.
-     */
-    private readonly initComplete;
-    readonly ready$: rxjs.Observable<void>;
-    load(): Promise<void>;
-    /**
-     * Confirm the restored session is still alive, settling AuthState before the
-     * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
-     * interceptor queues behind ready$, which has not fired yet at this point.
-     *
-     *   - access token accepted  -> done, session alive;
-     *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
-     *                              so an expired one with a valid refresh token must
-     *                              stay logged in). The coordinator dispatches Logout
-     *                              on a refresh 401 and SetTokens on success; a
-     *                              transient failure (5xx/network) is swallowed so a
-     *                              momentary blip never kills a valid session.
-     */
-    private validateSession;
-    /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
-    private probe;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AppInitService>;
-}
-
+export declare class CrossTabAuthSyncService {
+  private readonly store;
+  private listenerAttached;
+  start(): void;
+  private readonly handleStorageEvent;
+  static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * The elevation state of the signed-in session: the wire shape of
+ * `GET /auth/elevation`, returned again by `POST` on a grant.
+ *
+ * Elevation is state, not a role. It lasts a fixed time from the grant, ends
+ * when the admin panel is closed or reloaded, and the client derives nothing
+ * about it from mode bits or membership: this record and the node resource's
+ * capability flags are the two readings of ONE server-side decision, and the
+ * client keeps no third.
+ */
+export interface ElevationState {
+  /** Whether this session is elevated right now. */
+  elevated: boolean;
+  /** When the current elevation ends (ISO 8601); absent or null when not elevated. */
+  expiresAt?: string | null;
+  /** When the current elevation was granted (ISO 8601); absent or null when not elevated. */
+  grantedAt?: string | null;
+  /** How the LAST elevation of this session ended. Rendered by the prompt before it asks. */
+  ended: ElevationEnded;
+  /** The lifetime a grant made now would get, in seconds (the setting, clamped to the ceiling). */
+  lifetimeSeconds: number;
+  /** The most any elevation can last, fixed in code. */
+  lifetimeCeilingSeconds: number;
+  /** Whether the CURRENT elevation was confirmed by a second factor; absent or null when not elevated. */
+  factorConfirmed?: boolean | null;
+  /** Whether a grant made now must carry a code from the admin authenticator. */
+  mfaRequired: boolean;
+  /** What the prompt shows before asking; two of the codes mean the installation cannot elevate yet. */
+  warnings: ElevationWarning[];
+}
+/**
+ * `closed` is the beacon (the panel was closed or reloaded), `dropped_by_user`
+ * the explicit drop, `refresh_from_other_pair` the server's refresh tripwire,
+ * `never` a session that has not elevated yet.
+ */
+export type ElevationEndedReason = 'expired' | 'closed' | 'dropped_by_user' | 'refresh_from_other_pair' | 'never';
+export interface ElevationEnded {
+  reason: ElevationEndedReason;
+  /** ISO 8601, null for `never`. */
+  at: string | null;
+}
+/**
+ * `elevation.password_not_set` and `elevation.factor_missing` mean the
+ * installation cannot elevate and the message names the server command;
+ * `elevation.mfa_off` is the recommendation carried while the switch is off.
+ */
+export interface ElevationWarning {
+  /** The three the server documents today; the client renders any it does not know as text. */
+  code: string;
+  message: string;
+}
+export declare const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
+export declare const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
+export declare const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
+/** Why the elevation of a session changed, for whoever refetches on it. */
+export type ElevationChangeKind = 'granted' | 'dropped' | 'expired' | 'observed';
+export interface ElevationChange {
+  kind: ElevationChangeKind;
+  state: ElevationState;
+}
+/** The two reasons the client sends when it drops an elevation itself. */
+export type ElevationDropReason = 'dropped_by_user' | 'closed';
+/**
+ * What the elevation prompt is told when it opens.
+ *
+ * `state` is the server's answer at the moment of asking -- `ended.reason` is
+ * rendered first (a person asked for a password again after F5
+ * with no explanation reads it as a fault), `warnings` may say the
+ * installation cannot elevate yet, `mfaRequired` decides whether a code field
+ * shows from the start.
+ *
+ * `refusal` is the server's own sentence for the action that was refused
+ * ("Permission denied: cannot write '/docs/...'"), when a 403 opened the
+ * prompt; absent when a disabled control offered elevation instead.
+ */
+export interface ElevationPromptRequest {
+  state: ElevationState;
+  refusal?: string;
+}
+/**
+ * The prompt itself is a dialog, and dialogs are the kit's -- a layer above
+ * this one. Core owns the state, the interceptor and the decision to ask; the
+ * application binds this port to whatever renders the question. Same shape as
+ * `CURRENT_SECTION`: core declares the little it needs, the composition root
+ * provides it.
+ *
+ * Resolves to true when the session is elevated by the time the dialog closes,
+ * false when the person declined or could not. The port does not retry the
+ * refused action; the interceptor does, on true.
+ */
+export interface ElevationPromptPort {
+  open(request: ElevationPromptRequest): Observable<boolean>;
+}
+/**
+ * Optional by design: with nothing bound, a 403 stays a 403 and the state
+ * service still answers -- an application without an admin panel has no
+ * prompt to show and loses nothing.
+ */
+export declare const ELEVATION_PROMPT: InjectionToken<ElevationPromptPort>;
+/**
+ * Set on a request that must never open the elevation prompt: the elevation
+ * endpoint's own calls (a wrong password is a 403 and is not a refused action),
+ * and any caller that would rather receive its 403 and decide for itself.
+ */
+export declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
+/**
+ * The elevation state of this session, read from ONE place: the server.
+ *
+ * The elevation client requirement, in one service. The state endpoint is the only
+ * source -- `elevated`, `expiresAt`, how the last elevation ended -- and every
+ * change of it is announced on `changes$` so the Explorer listing can refetch
+ * (its capability flags are the server's reading of the same state, computed
+ * when the listing was fetched, and a `write: true` fetched while elevated
+ * must not outlive the elevation).
+ *
+ * **Expiry is driven by the READ, not by a timer.** An elevation ends because
+ * time passed, and time is not an event; a client that waits to be told has
+ * nothing to wait for when the machine was asleep at the moment. So `state()`
+ * does the arithmetic every time it is asked, and an answer whose `expiresAt`
+ * has gone by reports expired without a request. The timer below still fires
+ * at `expiresAt` and the tab still re-asks when it comes back into view -- both
+ * are how the SERVER's answer is refreshed, which is a different thing from
+ * knowing this one has run out.
+ *
+ * This is not a second decider. The server said "elevated until T"; after T,
+ * continuing to report `elevated: true` asserts something it never said.
+ *
+ * The prompt is not here: dialogs are the kit's, a layer above core. The
+ * service asks the `ELEVATION_PROMPT` port and shares ONE in-flight prompt, so
+ * a burst of refused requests (a multi-select delete is one 403 per node)
+ * opens one dialog and every caller waits on the same answer.
+ */
+/**
+ * The header a 403 refused for want of elevation carries, with the gate's name
+ * as its value. The server stamps it where the gate refused; the interceptor
+ * prompts on it and on nothing else. There is no list of gated URLs on this
+ * side any more: the one that stood here lagged the server by every route
+ * whose refusal came from the VFS permission service under another module's
+ * path (media, document and word templates, content distribution).
+ */
+export declare const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
+export declare class ElevationService {
+  private readonly http;
+  private readonly store;
+  private readonly prompt;
+  private readonly destroyRef;
+  /** The last answer the server gave, exactly as it gave it. */
+  private readonly served;
+  /**
+   * The state as it stands NOW; null until the first read from the server.
+   *
+   * Deliberately NOT a `computed`. A cached derivation is only recomputed
+   * when one of its dependencies changes, and nothing changes when an
+   * elevation simply runs out -- so it would keep answering `elevated: true`
+   * past the moment the server itself named, for as long as the machine
+   * happened to be asleep.
+   *
+   * Reading past `expiresAt` also demotes the STORED answer. The value
+   * returned here is already correct without that write; the write is only
+   * how cached readers (a `computed`, an OnPush template) find out.
+   */
+  readonly state: () => ElevationState | null;
+  /** Convenience over `state`: false until the server has said otherwise. */
+  readonly elevated: () => boolean;
+  /** `expiresAt` as a Date, null when not elevated. */
+  readonly expiresAt: () => Date | null;
+  /**
+   * Every change of elevation state: a grant, a drop (by this person, by the
+   * beacon, by the tripwire), an expiry, or an observed change of a live
+   * grant's `expiresAt`. A refresh that reports the same state emits nothing,
+   * so subscribers that refetch a listing on it never refetch for no reason.
+   */
+  readonly changes$: Subject<ElevationChange>;
+  private expiryTimer;
+  private pendingPrompt;
+  private expiryAnnouncePending;
+  private lastReconcileAt;
+  constructor();
+  /** The manifest carries the URL; without it the service is inert, not broken. */
+  get available(): boolean;
+  private get url();
+  /**
+   * Whether a URL belongs to THIS API: a relative one under the manifest's
+   * `apiBase`, or an absolute one on this origin under it. The interceptor
+   * acts on a stamped refusal from here and from nowhere else -- a third
+   * party answering 403 with a header of the same name is not an invitation
+   * to elevate this session.
+   */
+  isThisApi(url: string): boolean;
+  /** Ask the server. Applies the answer and announces it when it differs. */
+  refresh(): Observable<ElevationState>;
+  /**
+   * Elevate with the admin password and, when the switch is on, a code from
+   * the admin authenticator. Errors are the dialog's to branch on: 403 wrong
+   * password or wrong / replayed code, 428 a code is required, 409 the
+   * installation cannot elevate yet, 429 throttled. They pass through
+   * untouched, and never open the prompt (BYPASS_ELEVATION).
+   */
+  elevate(password: string, code?: string): Observable<ElevationState>;
+  /** Drop the elevation now. Idempotent on the server: nothing live is still a 204. */
+  drop(reason?: ElevationDropReason): Observable<ElevationState>;
+  /**
+   * What the interceptor calls on a 403: ask the server whether this session
+   * is elevated, and only when it is not, offer the prompt. A 403 while
+   * elevated is a real refusal -- elevation would not change it -- and is
+   * handed back as such (false, no prompt).
+   */
+  offerFor(refusal?: string): Observable<boolean>;
+  /**
+   * Open the prompt, or join the one already open. Resolves to whether the
+   * session is elevated once the dialog closes.
+   */
+  requestElevation(request: ElevationPromptRequest): Observable<boolean>;
+  private options;
+  private inert;
+  /**
+   * Store the answer, schedule the expiry read, announce a change.
+   *
+   * `explicit` names the change when the caller knows it (a grant). For a
+   * plain refresh the kind is derived from the two states: elevated -> not
+   * is `expired` when the server says so and `dropped` otherwise (the person,
+   * another tab, the beacon, the tripwire); not -> elevated is a grant seen
+   * from another tab; a live grant whose `expiresAt` moved is `observed`.
+   *
+   * `prev` is read RAW rather than through `state()`: the demotion is not
+   * wanted here (this answer supersedes the stored one either way), and a
+   * read that demoted would queue an expiry announcement the server's own
+   * answer is about to make.
+   */
+  private apply;
+  private kindOf;
+  /**
+   * Tell the listings that this session's elevation ran out, once, and NOT
+   * from inside the read that noticed: a subscriber refetches on this, and a
+   * refetch started in the middle of a change detection pass is a write
+   * during a read. The microtask runs at the end of the current task, before
+   * anything can paint.
+   *
+   * A server answer arriving first clears the flag, so the announcement is
+   * made by whichever of the two got there first, never by both. Other tabs
+   * are NOT told: each one reaches the same conclusion from the same
+   * `expiresAt` on its own read, so the storage write would only buy a
+   * thundering herd of GETs.
+   */
+  private announceExpiryLater;
+  /**
+   * Ask the server again at `expiresAt` -- an OPTIMISATION, not the
+   * mechanism. `state()` already reports an elapsed grant as expired without
+   * being told, so a timer that a sleeping machine swallows, or that a
+   * background tab throttles to once a minute, now costs freshness rather
+   * than correctness. What it buys is the listing refetch happening at the
+   * moment of expiry instead of at the next read.
+   *
+   * Do not flip a local flag here: the lifetime counts from the grant on the
+   * server's clock, and if the server still says elevated at that moment
+   * (skew), the honest thing is to ask again shortly.
+   */
+  private schedule;
+  /**
+   * One more attempt, then stop. Giving up is affordable now and was not
+   * before: the state a failed read leaves behind is still read through the
+   * arithmetic above, so an unreachable server cannot leave this tab
+   * believing it is elevated. What is lost is only news from elsewhere -- a
+   * grant or a drop in another session -- and that is what the tab picks up
+   * when it next comes into view.
+   */
+  private scheduleRetry;
+  private clearTimer;
+  private announceToOtherTabs;
+  private readonly onStorage;
+  private readonly onFocus;
+  private readonly onVisibilityChange;
+  /**
+   * The tab is back. Read first -- that alone ends an elevation that ran out
+   * while it was away, with no request and no network to depend on -- then
+   * ask the server for what the read cannot know: a grant or a drop made
+   * elsewhere, or a lifetime the server moved.
+   */
+  private reconcile;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ElevationService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * The elevation prompt hangs off the 403, not off the listing's flags
+ * (the elevation client requirement, point 1) -- and off the 403 that SAYS it
+ * was refused for want of elevation: the server stamps `X-Elevation-Required`
+ * with the gate's name where its gate refused a member who has not elevated.
+ * Any route of this API can carry it -- the VFS, a media asset's
+ * permissions, a document template, an account's deletion -- so nothing here
+ * lists URLs; the list that stood here lagged the server by every route whose
+ * refusal came from the VFS permission service under another module's path.
+ *
+ * On the stamp: ask the server whether this session is elevated, and only when
+ * it is NOT open the prompt; on a grant send the refused request again, once.
+ * A 403 without the stamp is a refusal for another reason and is handed back
+ * as it came; so are a 403 while elevated, a declined prompt, and an
+ * installation that cannot elevate -- nothing here swallows a refusal. A
+ * stamped 403 from anywhere but this API is ignored: the header is the
+ * server's word, and only this server's counts.
+ *
+ * Order in the chain: BEFORE the auth interceptor, so the retry re-enters it
+ * and carries the token current at that moment (the prompt may have outlived
+ * a refresh). The elevation endpoint's own calls carry BYPASS_ELEVATION: a
+ * wrong password is a 403 and is not a refused action.
+ */
+export declare const elevationInterceptor: HttpInterceptorFn;
+export declare class LoginComponent {
+  identifier: string;
+  password: string;
+  loading: boolean;
+  error: string | null;
+  private readonly store;
+  private readonly router;
+  submit(): void;
+  static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
+}
+export declare class AppInitService {
+  private readonly http;
+  private readonly store;
+  private readonly router;
+  private readonly location;
+  private readonly prefs;
+  private readonly crossTabSync;
+  private readonly refreshCoordinator;
+  /** The only hardcoded URL -- everything else comes from the manifest. */
+  private readonly configUrl;
+  /**
+   * Emits (once) when load() has fully completed -- tokens settled, manifest
+   * set (or swallowed on error).  authGuard subscribes to this so it never
+   * evaluates isAuthenticated against a partially-restored stale token.
+   */
+  private readonly initComplete;
+  readonly ready$: import("rxjs").Observable<void>;
+  load(): Promise<void>;
+  /**
+   * Confirm the restored session is still alive, settling AuthState before the
+   * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
+   * interceptor queues behind ready$, which has not fired yet at this point.
+   *
+   *   - access token accepted  -> done, session alive;
+   *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
+   *                              so an expired one with a valid refresh token must
+   *                              stay logged in). The coordinator dispatches Logout
+   *                              on a refresh 401 and SetTokens on success; a
+   *                              transient failure (5xx/network) is swallowed so a
+   *                              momentary blip never kills a valid session.
+   */
+  private validateSession;
+  /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
+  private probe;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Layout config DTO -- the shape served from
  * `GET /api/v1/config/layout/{id}`. Mirrors the YAML at
@@ -739,93 +1138,93 @@ declare class AppInitService {
  * keys (e.g. `media:library`'s `naviGraph:` slot shorthand) keep working
  * without further interface changes.
  */
-interface LayoutHeaderAction {
-    id: string;
-    label?: string;
-    icon?: string;
-    title?: string;
-    primary?: boolean;
-    danger?: boolean;
-    disabled?: boolean;
-    /**
-     * Optional capability gate evaluated FE-side against runtime state
-     * (e.g. `administer` / `delete`) — the config declares WHICH actions
-     * exist + their gate; the FE decides if THIS user/row qualifies. Absent
-     * = always shown. Used by detail pages whose actions are config-driven
-     * (see `web:section-detail`).
-     *
-     * For a gate that depends on the RECORD rather than the user, prefer
-     * `showWhen` below: `requires` needs a page to interpret the token, so
-     * every new value costs a branch in TypeScript.
-     */
-    requires?: string;
-    /**
-     * Conditions on the page's published context, same grammar and same
-     * evaluator as a NaviGraph toolbar node, applied
-     * by {@link LayoutActionsService}:
-     *
-     *   showWhen     — the action does not APPLY, so it is absent.
-     *   disabledWhen — temporarily UNAVAILABLE: stays put and greys out.
-     *   busyWhen     — the action is RUNNING: greys out too, and may relabel.
-     *   busyLabel    — label shown while `busyWhen` holds ("Saving…").
-     *   activeWhen   — pressed/active styling.
-     *
-     * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
-     * a page that moves between them should not have to relearn how to say
-     * "not now".
-     */
-    showWhen?: Record<string, unknown>;
-    disabledWhen?: Record<string, unknown>;
-    busyWhen?: Record<string, unknown>;
-    busyLabel?: string;
-    activeWhen?: Record<string, unknown>;
-}
-interface LayoutSection {
-    title?: string;
-    /**
-     * When true, the layout shell pins the section to the top of the
-     * scroll container (CSS `position: sticky`). Used by inspector /
-     * filter pages where an input form should stay visible while the
-     * operator scrolls through results below. Currently honoured by
-     * cms-inspector-layout; cms-detail-layout will follow when it
-     * lands. Default false.
-     */
-    sticky?: boolean;
-    slots?: Record<string, {
-        component?: string;
-        [key: string]: unknown;
-    }>;
-    [key: string]: unknown;
-}
-interface LayoutConfig {
-    id?: string;
-    template?: string;
-    title?: string;
-    subtitle?: string;
-    icon?: string;
-    slots?: Record<string, unknown>;
-    sections?: Record<string, LayoutSection>;
-    headerActions?: LayoutHeaderAction[];
-    /**
-     * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
-     * — primary / destructive actions kept out of the cramped header.
-     * Same shape as `headerActions`; gated per-item via `requires`.
-     */
-    footerActions?: LayoutHeaderAction[];
-    permissions?: string[];
-    [key: string]: unknown;
-}
-interface DialogConfig {
-    [key: string]: unknown;
-}
-interface NavigraphConfig {
-    [key: string]: unknown;
-}
-interface FormConfig {
-    [key: string]: unknown;
-}
-interface DatagridConfig {
+export interface LayoutHeaderAction {
+  id: string;
+  label?: string;
+  icon?: string;
+  title?: string;
+  primary?: boolean;
+  danger?: boolean;
+  disabled?: boolean;
+  /**
+   * Optional capability gate evaluated FE-side against runtime state
+   * (e.g. `administer` / `delete`) -- the config declares WHICH actions
+   * exist + their gate; the FE decides if THIS user/row qualifies. Absent
+   * = always shown. Used by detail pages whose actions are config-driven
+   * (see `web:section-detail`).
+   *
+   * For a gate that depends on the RECORD rather than the user, prefer
+   * `showWhen` below: `requires` needs a page to interpret the token, so
+   * every new value costs a branch in TypeScript.
+   */
+  requires?: string;
+  /**
+   * Conditions on the page's published context, same grammar and same
+   * evaluator as a NaviGraph toolbar node, applied
+   * by {@link LayoutActionsService}:
+   *
+   *   showWhen     -- the action does not APPLY, so it is absent.
+   *   disabledWhen -- temporarily UNAVAILABLE: stays put and greys out.
+   *   busyWhen     -- the action is RUNNING: greys out too, and may relabel.
+   *   busyLabel    -- label shown while `busyWhen` holds ("Saving...").
+   *   activeWhen   -- pressed/active styling.
+   *
+   * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
+   * a page that moves between them should not have to relearn how to say
+   * "not now".
+   */
+  showWhen?: Record<string, unknown>;
+  disabledWhen?: Record<string, unknown>;
+  busyWhen?: Record<string, unknown>;
+  busyLabel?: string;
+  activeWhen?: Record<string, unknown>;
+}
+export interface LayoutSection {
+  title?: string;
+  /**
+   * When true, the layout shell pins the section to the top of the
+   * scroll container (CSS `position: sticky`). Used by inspector /
+   * filter pages where an input form should stay visible while the
+   * operator scrolls through results below. Currently honoured by
+   * cms-inspector-layout; cms-detail-layout will follow when it
+   * lands. Default false.
+   */
+  sticky?: boolean;
+  slots?: Record<string, {
+    component?: string;
     [key: string]: unknown;
+  }>;
+  [key: string]: unknown;
+}
+export interface LayoutConfig {
+  id?: string;
+  template?: string;
+  title?: string;
+  subtitle?: string;
+  icon?: string;
+  slots?: Record<string, unknown>;
+  sections?: Record<string, LayoutSection>;
+  headerActions?: LayoutHeaderAction[];
+  /**
+   * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
+   * -- primary / destructive actions kept out of the cramped header.
+   * Same shape as `headerActions`; gated per-item via `requires`.
+   */
+  footerActions?: LayoutHeaderAction[];
+  permissions?: string[];
+  [key: string]: unknown;
+}
+export interface DialogConfig {
+  [key: string]: unknown;
+}
+export interface NavigraphConfig {
+  [key: string]: unknown;
+}
+export interface FormConfig {
+  [key: string]: unknown;
+}
+export interface DatagridConfig {
+  [key: string]: unknown;
 }
 /**
  * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
@@ -836,43 +1235,41 @@ interface DatagridConfig {
  * configBase is read from the API manifest (manifest.configBase) and falls
  * back to '/api/v1/config' when the manifest is not yet loaded.
  */
-declare class ConfigService {
-    private readonly http;
-    private readonly store;
-    private readonly cache;
-    layout(id: string): Observable<LayoutConfig>;
-    dialog(id: string): Observable<DialogConfig>;
-    navigraph(slug: string): Observable<NavigraphConfig>;
-    form(id: string): Observable<FormConfig>;
-    datagrid(id: string): Observable<DatagridConfig>;
-    private fetch;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ConfigService>;
-}
-
-declare class SetAppConfig {
-    readonly config: ThemeConfigResponse;
-    static readonly type = "[AppConfig] Set";
-    constructor(config: ThemeConfigResponse);
-}
-interface AppConfigStateModel {
-    config: ThemeConfigResponse | null;
-    loaded: boolean;
-}
-declare class AppConfigState {
-    set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
-    static manifest(state: AppConfigStateModel): ApiManifest | null;
-    /**
-     * F.7 viewer manifest. Null when the backend didn't ship a viewers
-     * section (no tagged providers); consumers should fall back to a
-     * "no preview" surface.
-     */
-    static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
-    static loaded(state: AppConfigStateModel): boolean;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AppConfigState>;
-}
-
+export declare class ConfigService {
+  private readonly http;
+  private readonly store;
+  private readonly cache;
+  layout(id: string): Observable<LayoutConfig>;
+  dialog(id: string): Observable<DialogConfig>;
+  navigraph(slug: string): Observable<NavigraphConfig>;
+  form(id: string): Observable<FormConfig>;
+  datagrid(id: string): Observable<DatagridConfig>;
+  private fetch;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export declare class SetAppConfig {
+  readonly config: ThemeConfigResponse;
+  static readonly type = "[AppConfig] Set";
+  constructor(config: ThemeConfigResponse);
+}
+export interface AppConfigStateModel {
+  config: ThemeConfigResponse | null;
+  loaded: boolean;
+}
+export declare class AppConfigState {
+  set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
+  static manifest(state: AppConfigStateModel): ApiManifest | null;
+  /**
+   * The viewer manifest. Null when the backend didn't ship a viewers
+   * section (no tagged providers); consumers should fall back to a
+   * "no preview" surface.
+   */
+  static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
+  static loaded(state: AppConfigStateModel): boolean;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Converts any caught error into a human-readable message.
  *
@@ -883,23 +1280,22 @@ declare class AppConfigState {
  *   4. error.violations[]        (constraint violations)
  *   5. Status-based fallback
  */
-declare class ErrorHandlerService {
-    humanize(err: unknown): string;
-    private statusMessage;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ErrorHandlerService>;
+export declare class ErrorHandlerService {
+  humanize(err: unknown): string;
+  private statusMessage;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
-
 /** What the user PICKED. `system` defers to the OS. */
-type ThemeChoice = 'light' | 'dark' | 'system';
-/** What that resolves to right now — the only two the stylesheet knows. */
-type ResolvedTheme = 'light' | 'dark';
+export type ThemeChoice = 'light' | 'dark' | 'system';
+/** What that resolves to right now -- the only two the stylesheet knows. */
+export type ResolvedTheme = 'light' | 'dark';
 /**
  * Applies the user's theme by setting `data-theme` on the document element.
  *
  * The stylesheet does the rest: `:root[data-theme='dark']` re-points the
  * `--cms-*` palette and every colour in the admin arrives through those names.
- * Nothing here knows a single colour, which is the point — a second
+ * Nothing here knows a single colour, which is the point -- a second
  * theme is a block of tokens, not a code change.
  *
  * Follows the shape of UserCalendarPreferencesService and
@@ -907,78 +1303,77 @@ type ResolvedTheme = 'light' | 'dark';
  * cached for the SPA lifetime, with `update()` called by the Profile page after
  * a save so the change lands without a refetch.
  */
-declare class ThemeService {
-    private readonly api;
-    private readonly store;
-    private readonly _choice;
-    private readonly _systemDark;
-    private readonly _userAccent;
-    private readonly _platformAccent;
-    private loadOnce$?;
-    /** The user's stored choice, including `system`. */
-    readonly choice: i0.Signal<ThemeChoice>;
-    /** This user's personal override, independent of the deployment's. */
-    readonly userAccent: i0.Signal<string | null>;
-    /** The deployment's brand accent from the API manifest, if it set one. */
-    readonly platformAccent: i0.Signal<string | null>;
-    /**
-     * The colour actually painted: personal override, else the deployment's,
-     * else null — which leaves the stylesheet's own accent in place.
-     *
-     * Three rungs and each is a real state. A user who has chosen nothing is
-     * NOT the same as one who chose the deployment's colour: clear the
-     * deployment's brand and the first user follows it, the second does not.
-     */
-    readonly accent: i0.Signal<string | null>;
-    /** The choice with `system` resolved against the OS setting. */
-    readonly resolved: i0.Signal<ResolvedTheme>;
-    constructor();
-    /**
-     * One-shot load of the stored preference. Safe to call more than once and
-     * safe for anonymous users — a failure leaves the cached/system value in
-     * place rather than forcing light, so the login screen still matches the OS.
-     */
-    ensureLoaded(): Observable<ThemeChoice>;
-    /**
-     * Called by the Profile page after the Preferences tab saves, so the admin
-     * re-themes on the spot. Ignores anything that is not a known choice —
-     * the section PATCH returns the whole merged bag, not just this field.
-     */
-    update(value: unknown): void;
-    /**
-     * Companion to {@link update} for the accent field of the same save.
-     * An explicit null clears the override; anything malformed is ignored
-     * rather than applied, so a bad value can never blank the admin's accent.
-     */
-    updateAccent(value: unknown): void;
-    private set;
-    /**
-     * The manifest is loaded at bootstrap, well before the authenticated shell
-     * calls this, so a snapshot read is enough and no subscription is needed.
-     * A malformed value is ignored rather than applied — the container refuses
-     * to build with one, but the manifest crosses the network all the same.
-     */
-    private readPlatformAccent;
-    private setAccent;
-    /**
-     * Writes the override onto the document element, where an inline style
-     * outranks every stylesheet rule — including the dark block — so one
-     * declaration re-points the accent in both themes.
-     *
-     * Only --cms-accent is set, not the -hover/-light/-text members of the
-     * family. Deriving those from an arbitrary user colour needs a colour model
-     * the palette does not have yet, and guessing them would produce hover
-     * states that clash with the very colour the user chose. Until then the
-     * override moves the brand fill and leaves its supporting tones alone.
-     */
-    private applyAccent;
-    private applyToDocument;
-    private static readCache;
-    private static readAccentCache;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ThemeService>;
-}
-
+export declare class ThemeService {
+  private readonly api;
+  private readonly store;
+  private readonly _choice;
+  private readonly _systemDark;
+  private readonly _userAccent;
+  private readonly _platformAccent;
+  private loadOnce$?;
+  /** The user's stored choice, including `system`. */
+  readonly choice: import("@angular/core").Signal<ThemeChoice>;
+  /** This user's personal override, independent of the deployment's. */
+  readonly userAccent: import("@angular/core").Signal<string | null>;
+  /** The deployment's brand accent from the API manifest, if it set one. */
+  readonly platformAccent: import("@angular/core").Signal<string | null>;
+  /**
+   * The colour actually painted: personal override, else the deployment's,
+   * else null -- which leaves the stylesheet's own accent in place.
+   *
+   * Three rungs and each is a real state. A user who has chosen nothing is
+   * NOT the same as one who chose the deployment's colour: clear the
+   * deployment's brand and the first user follows it, the second does not.
+   */
+  readonly accent: import("@angular/core").Signal<string | null>;
+  /** The choice with `system` resolved against the OS setting. */
+  readonly resolved: import("@angular/core").Signal<ResolvedTheme>;
+  constructor();
+  /**
+   * One-shot load of the stored preference. Safe to call more than once and
+   * safe for anonymous users -- a failure leaves the cached/system value in
+   * place rather than forcing light, so the login screen still matches the OS.
+   */
+  ensureLoaded(): Observable<ThemeChoice>;
+  /**
+   * Called by the Profile page after the Preferences tab saves, so the admin
+   * re-themes on the spot. Ignores anything that is not a known choice --
+   * the section PATCH returns the whole merged bag, not just this field.
+   */
+  update(value: unknown): void;
+  /**
+   * Companion to {@link update} for the accent field of the same save.
+   * An explicit null clears the override; anything malformed is ignored
+   * rather than applied, so a bad value can never blank the admin's accent.
+   */
+  updateAccent(value: unknown): void;
+  private set;
+  /**
+   * The manifest is loaded at bootstrap, well before the authenticated shell
+   * calls this, so a snapshot read is enough and no subscription is needed.
+   * A malformed value is ignored rather than applied -- the container refuses
+   * to build with one, but the manifest crosses the network all the same.
+   */
+  private readPlatformAccent;
+  private setAccent;
+  /**
+   * Writes the override onto the document element, where an inline style
+   * outranks every stylesheet rule -- including the dark block -- so one
+   * declaration re-points the accent in both themes.
+   *
+   * Only --cms-accent is set, not the -hover/-light/-text members of the
+   * family. Deriving those from an arbitrary user colour needs a colour model
+   * the palette does not have yet, and guessing them would produce hover
+   * states that clash with the very colour the user chose. Until then the
+   * override moves the brand fill and leaves its supporting tones alone.
+   */
+  private applyAccent;
+  private applyToDocument;
+  private static readCache;
+  private static readAccentCache;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * The platform's loading indicator: the exclamation mark from Cool!MS,
  * drawing itself.
@@ -988,7 +1383,7 @@ declare class ThemeService {
  * A spinner says "something is happening" and nothing else; every product has
  * one and none of them are yours. The bang is already the one glyph in the
  * wordmark that carries the brand, so a loader built from it says whose
- * software is thinking — for free, in the place a user is already looking.
+ * software is thinking -- for free, in the place a user is already looking.
  *
  * ## Why one component rather than a snippet per surface
  *
@@ -999,34 +1394,49 @@ declare class ThemeService {
  *
  * ## The animation
  *
- * The stem wipes upward and the dot lands after it, on a loop — the shape being
+ * The stem wipes upward and the dot lands after it, on a loop -- the shape being
  * WRITTEN rather than spun. It is deliberately calm: a loader is background
  * furniture, and anything with a hard beat gets irritating on the third viewing.
  * Under `prefers-reduced-motion` it holds still and only breathes, because
  * motion sickness is not a stylistic preference.
  */
-declare class CmsLoaderComponent {
-    /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
-    readonly label: i0.InputSignal<string>;
-    /** Cover the positioned ancestor rather than sitting in the flow. */
-    readonly overlay: i0.InputSignal<boolean>;
-    /**
-     * Row layout at text scale, for a wait inside a row, a status bar or a
-     * button. Override `--cms-loader-size` to tune the mark.
-     */
-    readonly inline: i0.InputSignal<boolean>;
-    /**
-     * A clip-path needs a document-unique id, and this component is used more
-     * than once per page — two loaders sharing an id makes the second one clip
-     * against the first one's rectangle and stop animating.
-     */
-    protected readonly clipId: string;
-    static ɵfac: i0.ɵɵFactoryDeclaration<CmsLoaderComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<CmsLoaderComponent, "cms-loader", never, { "label": { "alias": "label"; "required": false; "isSignal": true; }; "overlay": { "alias": "overlay"; "required": false; "isSignal": true; }; "inline": { "alias": "inline"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
-}
-
+export declare class CmsLoaderComponent {
+  /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
+  readonly label: import("@angular/core").InputSignal<string>;
+  /** Cover the positioned ancestor rather than sitting in the flow. */
+  readonly overlay: import("@angular/core").InputSignal<boolean>;
+  /**
+   * Row layout at text scale, for a wait inside a row, a status bar or a
+   * button. Override `--cms-loader-size` to tune the mark.
+   */
+  readonly inline: import("@angular/core").InputSignal<boolean>;
+  /**
+   * A clip-path needs a document-unique id, and this component is used more
+   * than once per page -- two loaders sharing an id makes the second one clip
+   * against the first one's rectangle and stop animating.
+   */
+  protected readonly clipId: string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<CmsLoaderComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<CmsLoaderComponent, "cms-loader", never, {
+    "label": {
+      "alias": "label";
+      "required": false;
+      "isSignal": true;
+    };
+    "overlay": {
+      "alias": "overlay";
+      "required": false;
+      "isSignal": true;
+    };
+    "inline": {
+      "alias": "inline";
+      "required": false;
+      "isSignal": true;
+    };
+  }, {}, never, never, true, never>;
+}
 /**
- * Unified user preferences service — all preference types share one
+ * Unified user preferences service -- all preference types share one
  * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
  *
  * Key naming convention (stored as nested objects, referenced via dot-notation):
@@ -1050,106 +1460,105 @@ declare class CmsLoaderComponent {
  *   terminal.height
  *   terminal.open
  */
-declare class UserPreferencesService {
-    private readonly http;
-    private readonly store;
-    private readonly destroyRef;
-    private readonly STORAGE_KEY;
-    private readonly SYNC_DELAY;
-    private syncSubject;
-    constructor();
-    /**
-     * Write all prefs to localStorage and schedule a debounced server sync.
-     */
-    private save;
-    /**
-     * Read the entire prefs object from localStorage, applying legacy key
-     * migration on the first read after an upgrade.
-     */
-    private load;
-    /**
-     * One-time migration of legacy flat keys to the new nested naming convention.
-     * Mutates `all` in place and re-persists only when something changed.
-     */
-    private migrate;
-    /**
-     * Seed localStorage from server preferences.
-     * Called after login and on every session restore (page reload).
-     *
-     * Strategy:
-     *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
-     *  - Local prefs already exist -> merge with local taking priority at each
-     *    top-level namespace.  This ensures that locally-persisted state
-     *    (panel widths, last path, etc.) is never overwritten by the stale copy
-     *    that was saved in the auth token at login time.
-     */
-    loadFromServer(uiPrefs: Record<string, unknown>): void;
-    private syncToServer;
-    /**
-     * Get stored preferences for a specific grid.
-     */
-    getGridPref(gridId: string): DataGridPreference | null;
-    /**
-     * Set visible column order for a grid.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setColumns(gridId: string, columns: string[]): void;
-    /**
-     * Record a column width for a grid column.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setColumnWidth(gridId: string, field: string, width: number): void;
-    /**
-     * Remove all preferences for a specific grid and immediately sync to server.
-     */
-    resetGrid(gridId: string): void;
-    private updateGrid;
-    /**
-     * Get persisted terminal panel height.
-     */
-    getTerminalHeight(): number | null;
-    /**
-     * Persist terminal panel height.
-     */
-    setTerminalHeight(height: number): void;
-    /**
-     * Get persisted state for a resizable panel identified by key.
-     * Used by ExplorerLayoutComponent to persist panel widths across sessions.
-     */
-    getPanelState(key: string): {
-        width: number;
-        collapsed: boolean;
-    } | null;
-    /**
-     * Persist generic panel state by key.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setPanelState(key: string, width: number, collapsed: boolean): void;
-    /**
-     * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
-     */
-    getPageState<T>(pageKey: string): T | null;
-    /**
-     * Merge partial state into a page namespace.
-     * Existing keys in the namespace are preserved; only provided keys are updated.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setPageState(pageKey: string, state: Record<string, unknown>): void;
-    /** @deprecated Use getPageState('media') instead */
-    getMediaViewMode(): string | null;
-    /** @deprecated Use setPageState('media', ...) instead */
-    setMediaViewMode(mode: string): void;
-    /** @deprecated Use getPanelState('media_panel_left') instead */
-    getMediaCollectionsPanel(): {
-        width: number;
-        collapsed: boolean;
-    } | null;
-    /** @deprecated Use setPanelState('media_panel_left', ...) instead */
-    setMediaCollectionsPanel(width: number, collapsed: boolean): void;
-    static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<UserPreferencesService>;
-}
-
+export declare class UserPreferencesService {
+  private readonly http;
+  private readonly store;
+  private readonly destroyRef;
+  private readonly STORAGE_KEY;
+  private readonly SYNC_DELAY;
+  private syncSubject;
+  constructor();
+  /**
+   * Write all prefs to localStorage and schedule a debounced server sync.
+   */
+  private save;
+  /**
+   * Read the entire prefs object from localStorage, applying legacy key
+   * migration on the first read after an upgrade.
+   */
+  private load;
+  /**
+   * One-time migration of legacy flat keys to the new nested naming convention.
+   * Mutates `all` in place and re-persists only when something changed.
+   */
+  private migrate;
+  /**
+   * Seed localStorage from server preferences.
+   * Called after login and on every session restore (page reload).
+   *
+   * Strategy:
+   *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
+   *  - Local prefs already exist -> merge with local taking priority at each
+   *    top-level namespace.  This ensures that locally-persisted state
+   *    (panel widths, last path, etc.) is never overwritten by the stale copy
+   *    that was saved in the auth token at login time.
+   */
+  loadFromServer(uiPrefs: Record<string, unknown>): void;
+  private syncToServer;
+  /**
+   * Get stored preferences for a specific grid.
+   */
+  getGridPref(gridId: string): DataGridPreference | null;
+  /**
+   * Set visible column order for a grid.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setColumns(gridId: string, columns: string[]): void;
+  /**
+   * Record a column width for a grid column.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setColumnWidth(gridId: string, field: string, width: number): void;
+  /**
+   * Remove all preferences for a specific grid and immediately sync to server.
+   */
+  resetGrid(gridId: string): void;
+  private updateGrid;
+  /**
+   * Get persisted terminal panel height.
+   */
+  getTerminalHeight(): number | null;
+  /**
+   * Persist terminal panel height.
+   */
+  setTerminalHeight(height: number): void;
+  /**
+   * Get persisted state for a resizable panel identified by key.
+   * Used by ExplorerLayoutComponent to persist panel widths across sessions.
+   */
+  getPanelState(key: string): {
+    width: number;
+    collapsed: boolean;
+  } | null;
+  /**
+   * Persist generic panel state by key.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setPanelState(key: string, width: number, collapsed: boolean): void;
+  /**
+   * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
+   */
+  getPageState<T>(pageKey: string): T | null;
+  /**
+   * Merge partial state into a page namespace.
+   * Existing keys in the namespace are preserved; only provided keys are updated.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setPageState(pageKey: string, state: Record<string, unknown>): void;
+  /** @deprecated Use getPageState('media') instead */
+  getMediaViewMode(): string | null;
+  /** @deprecated Use setPageState('media', ...) instead */
+  setMediaViewMode(mode: string): void;
+  /** @deprecated Use getPanelState('media_panel_left') instead */
+  getMediaCollectionsPanel(): {
+    width: number;
+    collapsed: boolean;
+  } | null;
+  /** @deprecated Use setPanelState('media_panel_left', ...) instead */
+  setMediaCollectionsPanel(width: number, collapsed: boolean): void;
+  static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Sidebar collapse state -- two independent dimensions:
  *
@@ -1169,104 +1578,101 @@ declare class UserPreferencesService {
  * to defaulting un-collapsed -- the toggles still work for the session,
  * just don't persist.
  */
-declare class SidebarStateService {
-    private static readonly STORAGE_KEY;
-    private static readonly STORAGE_KEY_SECTIONS;
-    private static readonly STORAGE_KEY_ITEMS;
-    readonly collapsed: i0.WritableSignal<boolean>;
-    readonly collapsedSections: i0.WritableSignal<Set<string>>;
-    readonly collapsedItems: i0.WritableSignal<Set<string>>;
-    toggle(): void;
-    isSectionCollapsed(id: string): boolean;
-    toggleSection(id: string): void;
-    /**
-     * Force a section to be expanded. Used when navigation lands on
-     * a route inside a manually-collapsed section -- it would be
-     * confusing to leave the active item hidden. The user can
-     * collapse the section again afterwards.
-     */
-    ensureExpanded(id: string): void;
-    isItemCollapsed(id: string): boolean;
-    toggleItem(id: string): void;
-    private readPersisted;
-    private persist;
-    private readSectionsPersisted;
-    private persistSections;
-    private readItemsPersisted;
-    private persistItems;
-    static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<SidebarStateService>;
-}
-
+export declare class SidebarStateService {
+  private static readonly STORAGE_KEY;
+  private static readonly STORAGE_KEY_SECTIONS;
+  private static readonly STORAGE_KEY_ITEMS;
+  readonly collapsed: import("@angular/core").WritableSignal<boolean>;
+  readonly collapsedSections: import("@angular/core").WritableSignal<Set<string>>;
+  readonly collapsedItems: import("@angular/core").WritableSignal<Set<string>>;
+  toggle(): void;
+  isSectionCollapsed(id: string): boolean;
+  toggleSection(id: string): void;
+  /**
+   * Force a section to be expanded. Used when navigation lands on
+   * a route inside a manually-collapsed section -- it would be
+   * confusing to leave the active item hidden. The user can
+   * collapse the section again afterwards.
+   */
+  ensureExpanded(id: string): void;
+  isItemCollapsed(id: string): boolean;
+  toggleItem(id: string): void;
+  private readPersisted;
+  private persist;
+  private readSectionsPersisted;
+  private persistSections;
+  private readItemsPersisted;
+  private persistItems;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * One row returned by the `/api/entity-search` endpoint. `id` is
  * what the picker emits via its `valueChange` output (and what the
  * template's persisted context carries). `label` is the primary
  * display line. `secondary` is an optional second line for
- * disambiguation (email, slug, etc.) — the backend omits the key
+ * disambiguation (email, slug, etc.) -- the backend omits the key
  * when there is nothing to show; receiving `null` from a custom
  * resolver is normalized to `undefined` here.
  */
-interface EntitySearchResult {
-    readonly id: string | number;
-    readonly label: string;
-    readonly secondary?: string;
+export interface EntitySearchResult {
+  readonly id: string | number;
+  readonly label: string;
+  readonly secondary?: string;
 }
 /**
  * HTTP client for the Phase 2a `/api/entity-search` endpoint.
  * Returns a stream of search results for the given entity FQCN.
- * Permission filtering happens at the backend resolver layer —
+ * Permission filtering happens at the backend resolver layer --
  * this service is a thin RPC.
  */
-declare class EntitySearchService {
-    private readonly http;
-    /**
-     * @param entityType  Fully-qualified PHP class name of the entity
-     *                    being searched (e.g. the backend's User entity).
-     * @param query       Free-text search input. Empty string is
-     *                    valid — the backend returns the default
-     *                    listing for that entity type.
-     * @param limit       Max rows to return; clamped server-side to
-     *                    [1, 100].
-     */
-    search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
-    static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<EntitySearchService>;
-}
-
+export declare class EntitySearchService {
+  private readonly http;
+  /**
+   * @param entityType  Fully-qualified PHP class name of the entity
+   *                    being searched (e.g. the backend's User entity).
+   * @param query       Free-text search input. Empty string is
+   *                    valid -- the backend returns the default
+   *                    listing for that entity type.
+   * @param limit       Max rows to return; clamped server-side to
+   *                    [1, 100].
+   */
+  search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Well-known click target values embedded in meta.target.
- *   'action.logout' — dispatch Logout action
- *   'route'         — navigate via routerLink (default when target absent)
- *   '_blank'        — open in a new tab (hrefOverride must be set)
+ *   'action.logout' -- dispatch Logout action
+ *   'route'         -- navigate via routerLink (default when target absent)
+ *   '_blank'        -- open in a new tab (hrefOverride must be set)
  */
-type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
-interface NaviGraphMeta {
-    readonly component?: string;
-    readonly icon?: string;
-    readonly routerLink?: string;
-    readonly target?: NaviGraphTarget;
-    readonly requiredRole?: string;
-    readonly voterAttribute?: string;
-    readonly contributor?: string;
-    readonly [key: string]: unknown;
+export type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
+export interface NaviGraphMeta {
+  readonly component?: string;
+  readonly icon?: string;
+  readonly routerLink?: string;
+  readonly target?: NaviGraphTarget;
+  readonly requiredRole?: string;
+  readonly voterAttribute?: string;
+  readonly contributor?: string;
+  readonly [key: string]: unknown;
 }
 /** Flat node as returned from GET /navi/trees/{slug}/graph */
-interface NaviGraphNodeFlat {
-    readonly id: string;
-    readonly path: string;
-    readonly title: string;
-    readonly parentId: string | null;
-    readonly sortOrder: number;
-    readonly isActive: boolean;
-    readonly isVisible: boolean;
-    readonly meta: NaviGraphMeta;
+export interface NaviGraphNodeFlat {
+  readonly id: string;
+  readonly path: string;
+  readonly title: string;
+  readonly parentId: string | null;
+  readonly sortOrder: number;
+  readonly isActive: boolean;
+  readonly isVisible: boolean;
+  readonly meta: NaviGraphMeta;
 }
 /** Same node enriched with resolved children after client-side tree build */
-interface NaviGraphNode extends NaviGraphNodeFlat {
-    readonly children: NaviGraphNode[];
+export interface NaviGraphNode extends NaviGraphNodeFlat {
+  readonly children: NaviGraphNode[];
 }
-
 /**
  * Loads, caches, and drives admin NaviGraph trees.
  *
@@ -1275,86 +1681,282 @@ interface NaviGraphNode extends NaviGraphNodeFlat {
  *   const items = naviGraphService.adminNav();         // signal<NaviGraphNode[]>
  *   naviGraphService.handleClick(node);
  */
-declare class NaviGraphService {
-    private readonly http;
-    private readonly router;
-    private readonly store;
-    private readonly errors;
-    /** Resolved root nodes for navi.admin (sidebar). */
-    readonly adminNav: i0.WritableSignal<NaviGraphNode[]>;
-    /** Resolved root nodes for navi.admin.topbar. */
-    readonly topbarNav: i0.WritableSignal<NaviGraphNode[]>;
-    private readonly cache;
-    loadAdminNav(url: string): Observable<NaviGraphNode[]>;
-    loadTopbarNav(url: string): Observable<NaviGraphNode[]>;
-    /**
-     * Handle a nav-node click.
-     *
-     * Routing logic based on meta.target:
-     *   'action.logout'  — dispatch Logout
-     *   '_blank'         — window.open (uses node.path as href)
-     *   default          — router.navigate with meta.routerLink or node.path
-     */
-    handleClick(node: NaviGraphNode): void;
-    /**
-     * Evaluate `showWhen` meta condition against a record.
-     * Nodes with no `showWhen` are always visible.
-     * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
-     */
-    isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
-    /**
-     * Standalone `showWhen` evaluator for callers that don't have a
-     * full `NaviGraphNode` (e.g. a grid's row context menu — a
-     * `rowAction.showWhen` predicate is evaluated against the row's
-     * own projection). `null`/`undefined` predicates default to
-     * visible, mirroring `isVisible`'s "no rule = always shown"
-     * semantics.
-     */
-    matchesShowWhen(showWhen: Record<string, unknown> | undefined | null, record: Record<string, unknown>): boolean;
-    private evalCondition;
-    /**
-     * Fetch a graph endpoint and return a nested tree.
-     * Handles both compact JSON-LD IRIs (`member`) and
-     * the legacy Hydra key (`hydra:member`).
-     * Results are cached by URL for the lifetime of the service instance.
-     */
-    loadTree(url: string): Observable<NaviGraphNode[]>;
-    /**
-     * Build a nested tree from a flat array of nodes.
-     * Nodes are sorted by sortOrder at each level.
-     */
-    private buildTree;
-    static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<NaviGraphService>;
-}
-
+export declare class NaviGraphService {
+  private readonly http;
+  private readonly router;
+  private readonly store;
+  private readonly errors;
+  /** Resolved root nodes for navi.admin (sidebar). */
+  readonly adminNav: import("@angular/core").WritableSignal<NaviGraphNode[]>;
+  /** Resolved root nodes for navi.admin.topbar. */
+  readonly topbarNav: import("@angular/core").WritableSignal<NaviGraphNode[]>;
+  private readonly cache;
+  loadAdminNav(url: string): Observable<NaviGraphNode[]>;
+  loadTopbarNav(url: string): Observable<NaviGraphNode[]>;
+  /**
+   * Handle a nav-node click.
+   *
+   * Routing logic based on meta.target:
+   *   'action.logout'  -- dispatch Logout
+   *   '_blank'         -- window.open (uses node.path as href)
+   *   default          -- router.navigate with meta.routerLink or node.path
+   */
+  handleClick(node: NaviGraphNode): void;
+  /**
+   * Evaluate `showWhen` meta condition against a record.
+   * Nodes with no `showWhen` are always visible.
+   * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
+   */
+  isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
+  /**
+   * Standalone `showWhen` evaluator for callers that don't have a
+   * full `NaviGraphNode` (e.g. a grid's row context menu -- a
+   * `rowAction.showWhen` predicate is evaluated against the row's
+   * own projection). `null`/`undefined` predicates default to
+   * visible, mirroring `isVisible`'s "no rule = always shown"
+   * semantics.
+   */
+  matchesShowWhen(showWhen: Record<string, unknown> | undefined | null, record: Record<string, unknown>): boolean;
+  private evalCondition;
+  /**
+   * Fetch a graph endpoint and return a nested tree.
+   * Handles both compact JSON-LD IRIs (`member`) and
+   * the legacy Hydra key (`hydra:member`).
+   * Results are cached by URL for the lifetime of the service instance.
+   */
+  loadTree(url: string): Observable<NaviGraphNode[]>;
+  /**
+   * Build a nested tree from a flat array of nodes.
+   * Nodes are sorted by sortOrder at each level.
+   */
+  private buildTree;
+  static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Registry mapping string keys to Angular component classes.
  *
  * Backed by a static Map so components registered at module load time
  * (e.g. in app.config.ts) are visible to all injected instances.
  *
- * Usage — static (app.config.ts / bootstrap time):
+ * Usage -- static (app.config.ts / bootstrap time):
  *   ComponentRegistry.register('MediaLibraryPage', MediaLibraryPage);
  *
- * Usage — injected (SlotComponent / runtime):
+ * Usage -- injected (SlotComponent / runtime):
  *   private readonly registry = inject(ComponentRegistry);
  *   const cls = this.registry.get('MediaLibraryPage');
  */
-declare class ComponentRegistry {
-    private static readonly map;
-    static register(key: string, component: Type<unknown>): void;
-    static get(key: string): Type<unknown> | undefined;
-    static has(key: string): boolean;
-    static keys(): string[];
-    register(key: string, component: Type<unknown>): void;
-    get(key: string): Type<unknown> | null;
-    has(key: string): boolean;
-    keys(): string[];
-    static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ComponentRegistry>;
-}
-
+export declare class ComponentRegistry {
+  private static readonly map;
+  static register(key: string, component: Type<unknown>): void;
+  static get(key: string): Type<unknown> | undefined;
+  static has(key: string): boolean;
+  static keys(): string[];
+  register(key: string, component: Type<unknown>): void;
+  get(key: string): Type<unknown> | null;
+  has(key: string): boolean;
+  keys(): string[];
+  static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * `console` -- the administration host contract (the platform rule: hosts implement contracts, modules offer entries).
+ *
+ * A module contributes to the console with ONE object, its entry: data the
+ * host reads, never a call the module makes into the host. Six lists, each
+ * optional; an absent list means "nothing here", never an error. The host
+ * assembles the entries (build time today, install time under federation),
+ * refuses collisions by name, and activates only the modules the backend's
+ * manifest says are installed.
+ *
+ * The version is MAJOR.MINOR: a minor adds an optional list or field, a major
+ * changes or removes one. An entry declares the range it was written for
+ * (`^1.2` -- major 1, minor at least 2), checked at build against this
+ * constant and at install against the theme's declaration.
+ */
+export declare const CONSOLE_CONTRACT: {
+  readonly name: "console";
+  readonly version: "1.0";
+};
+export interface ConsoleEntry {
+  /** The backend module id, as `config/modules/<id>`. Activation is by this id. */
+  readonly module: string;
+  readonly contract: 'console';
+  /** The console versions this entry was written for: a caret range over MAJOR.MINOR, e.g. '^1.0'. */
+  readonly range: string;
+  readonly routes?: readonly ConsoleRouteMount[];
+  readonly bindings?: readonly ConsoleBinding[];
+  readonly topbar?: readonly ConsoleTopbarItem[];
+  readonly overlays?: readonly ConsoleOverlay[];
+  readonly panels?: readonly ConsolePanel[];
+  readonly states?: readonly Type<unknown>[];
+  readonly providers?: readonly ConsoleProvision[];
+}
+/** What a route's `data` carries for the shell: the sidebar item to light, and whether the page owns its height. */
+export interface ConsoleNavHint {
+  readonly activeNav?: string;
+  readonly fullHeight?: boolean;
+  /** An intermediate crumb the top bar renders between Home and the page. */
+  readonly breadcrumb?: {
+    readonly label: string;
+    readonly routerLink: string;
+  };
+  /** Which server layout the page renders, for the generic layout pages. */
+  readonly layoutId?: string;
+}
+/**
+ * A route mounted under the console's authenticated layout. The host adds
+ * what a module may not decide: the layout component, `canActivate: [authGuard]`,
+ * and a `canMatch` that answers whether the module is installed here. Routes
+ * are lazy: a static component here would put every module's pages in `main`.
+ */
+export type ConsoleRouteMount = {
+  readonly path: string;
+  readonly children: () => Promise<Routes>;
+  readonly nav?: ConsoleNavHint;
+  readonly providers?: readonly Provider[];
+} | {
+  readonly path: string;
+  readonly component: () => Promise<Type<unknown>>;
+  readonly nav?: ConsoleNavHint;
+  readonly providers?: readonly Provider[];
+} | {
+  readonly path: string;
+  readonly redirectTo: string;
+};
+/** A `ComponentRegistry` name -> class: names a module OWNS (its server layouts name them) and names it fills in another module's slot (`profile.tab:call`). */
+export interface ConsoleBinding {
+  readonly name: string;
+  readonly component: Type<unknown>;
+}
+/** A tile in the top bar's quick-access strip, rendered in ascending `order`. */
+export interface ConsoleTopbarItem {
+  readonly id: string;
+  readonly order: number;
+  readonly component: Type<unknown>;
+}
+/** Mounted once, inside the authenticated layout, outside the router outlet. */
+export interface ConsoleOverlay {
+  readonly id: string;
+  readonly component: Type<unknown>;
+}
+/**
+ * A dock panel the layout opens and closes: the host renders its toggle in
+ * the top bar and the panel in the dock, and the panel talks back through
+ * {@link ConsolePanelHost} -- not through outputs, which a slot cannot carry.
+ */
+export interface ConsolePanel {
+  readonly id: string;
+  readonly dock: 'bottom';
+  /** The top-bar toggle: a label (the title), an icon name or a short text, and a key the host binds with Ctrl. */
+  readonly toggle: {
+    readonly label: string;
+    readonly icon?: string;
+    readonly text?: string;
+    readonly key?: string;
+  };
+  readonly component: Type<unknown>;
+}
+/**
+ * What a `provide*` line is: environment providers from a library's registry
+ * (editor extensions, viewers, field widgets, file editors), or the
+ * implementation of a single-implementation port, listed as such so the
+ * assembly can refuse two modules implementing one port by name.
+ */
+export type ConsoleProvision = EnvironmentProviders | Provider | ConsolePortProvision;
+export interface ConsolePortProvision {
+  readonly port: InjectionToken<unknown>;
+  readonly useExisting: Type<unknown>;
+}
+export declare function isPortProvision(p: ConsoleProvision): p is ConsolePortProvision;
+/** The identity function with the type: an entry file exports data, nothing runs. */
+export declare function consoleEntry(entry: ConsoleEntry): ConsoleEntry;
+/**
+ * Whether a caret range over MAJOR.MINOR admits a version: same major, minor
+ * at least the range's. Malformed input admits nothing -- a range that cannot
+ * be read must refuse, never pass.
+ */
+export declare function satisfiesRange(range: string, version: string): boolean;
+/** The refusal an assembly raises: one message per collision, all of them, by name. */
+export declare class ConsoleAssemblyError extends Error {
+  readonly problems: readonly string[];
+  constructor(problems: readonly string[]);
+}
+/**
+ * The checks every assembly runs, in one place so the build-time spec, the
+ * bootstrap and a future install-time loader agree: entry ranges against
+ * this contract, and the collision rules of the six lists. Returns the
+ * entries unchanged when nothing is wrong.
+ */
+export declare function assembleConsole(entries: readonly ConsoleEntry[]): readonly ConsoleEntry[];
+/**
+ * The host side of `console@1`: what a theme calls to turn the assembled
+ * entries into routes, providers and the lists its shell renders.
+ *
+ * Activation is the backend's: `GET /app-config` carries `ui.modules`, the
+ * modules whose console entry the installer matched against the theme's
+ * declaration. A module in the bundle but not in that list is dormant -- no
+ * route matches, no tile, no overlay; a module in the list but not in the
+ * bundle is reported by name ({@link ConsoleActivation.missing}), never
+ * silently absent.
+ */
+/** Every entry this build assembled, after {@link assembleConsole}'s checks. */
+export declare const CONSOLE_ENTRIES: InjectionToken<readonly ConsoleEntry[]>;
+/**
+ * The port a dock panel talks back through: the layout provides one per
+ * panel it mounts, so the panel never needs an output the slot cannot carry.
+ */
+export declare abstract class ConsolePanelHost {
+  abstract close(): void;
+  abstract maximize(on: boolean): void;
+}
+/** The console modules the manifest says are installed here. */
+export declare function installedConsoleModules(manifest: ApiManifest | null): ReadonlySet<string>;
+export declare class ConsoleActivation {
+  private readonly entries;
+  private readonly manifest;
+  readonly installed: import("@angular/core").Signal<ReadonlySet<string>>;
+  /** The entries of installed modules, in assembly order. */
+  readonly active: import("@angular/core").Signal<ConsoleEntry[]>;
+  readonly topbar: import("@angular/core").Signal<readonly ConsoleTopbarItem[]>;
+  readonly overlays: import("@angular/core").Signal<readonly ConsoleOverlay[]>;
+  readonly panels: import("@angular/core").Signal<readonly ConsolePanel[]>;
+  /** Modules the manifest names that this build has no entry for: what a diagnostics page shows by name. */
+  readonly missing: import("@angular/core").Signal<string[]>;
+  isInstalled(module: string): boolean;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleActivation, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * `canMatch` for a module's mount: the route exists only where the module is
+ * installed. Answered once the manifest is in: on a cold deep link the router
+ * recognises the URL while the initializer is still fetching `/theme/config`
+ * (the two run as parallel initializers), and a synchronous read then found
+ * no module installed, so every pasted module URL fell to the wildcard and
+ * landed on the dashboard (measured 2026-09-22: no chunk requested for the
+ * mount, the dashboard's instead). `ready$` is what the auth guard waits on
+ * too, and it fires whether or not the config fetch succeeded.
+ */
+export declare function consoleModuleInstalled(module: string): CanMatchFn;
+/**
+ * The children a theme mounts under its authenticated layout for the
+ * assembled entries: one `Route` per mount, lazy as written, `data` from the
+ * entry's nav hint, `canMatch` from the manifest. The theme keeps its own
+ * shape around them (login, the layout, `canActivate: [authGuard]`, the
+ * wildcard).
+ */
+export declare function consoleChildren(entries: readonly ConsoleEntry[]): Routes;
+/**
+ * The providers a theme adds for the assembled entries: the store with the
+ * host's states and every module state, the registry bindings (an
+ * initializer, so they exist before the first render), every module
+ * provision, and {@link CONSOLE_ENTRIES} for the shell. Place it AFTER the
+ * library providers a module's provisions extend (the editor bridge, the
+ * PDF viewer), as the hand-written lines were.
+ */
+export declare function provideConsole(entries: readonly ConsoleEntry[], options: {
+  readonly hostStates: readonly Type<unknown>[];
+}): EnvironmentProviders;
 /**
  * Phase H7 -- admin Site Selector.
  *
@@ -1384,8 +1986,7 @@ declare class ComponentRegistry {
  *    be ignored by the backend anyway, but skipping keeps wire traffic clean)
  *  - requests that already carry the header (programmatic overrides win)
  */
-declare const sectionInterceptor: HttpInterceptorFn;
-
+export declare const sectionInterceptor: HttpInterceptorFn;
 /**
  * The one fact the section interceptor needs: which site the operator is
  * currently working in.
@@ -1400,16 +2001,13 @@ declare const sectionInterceptor: HttpInterceptorFn;
  * Read SYNCHRONOUSLY on purpose. An interceptor decides whether to stamp a
  * header while building the request; it cannot wait on a stream.
  */
-interface CurrentSectionPort {
-    /** Slug of the active section, or null when the operator picked none. */
-    currentSlug(): string | null;
+export interface CurrentSectionPort {
+  /** Slug of the active section, or null when the operator picked none. */
+  currentSlug(): string | null;
 }
 /**
  * Optional by design: an application assembled without a Sections module binds
  * nothing and simply sends no `X-CoolMS-Section` header, which is exactly what
  * a single-site install wants.
  */
-declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;
-
-export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, CrossTabAuthSyncService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, authGuard, authInterceptor, loginPageGuard, resolvePattern, sectionInterceptor };
-export type { ApiManifest, AppConfigStateModel, AuthApiManifest, AuthStateModel, CentrifugoConnectionTokenDto, CentrifugoSubscriptionTokenDto, ContentApiManifest, CurrentSectionPort, DataGridApiManifest, DataGridPreference, DataGridPreferences, DataSourceDefinition, DataSourceLoading, DataSourceOption, DataSourceType, DataSourceWidget, DatagridConfig, DialogConfig, DocumentApiManifest, DomainExplorerApiManifest, DynamicEntityApiManifest, EditorApiManifest, EditorApiManifestEntry, EditorApiManifestProfile, EntitySearchResult, FieldItem, FieldSecurityPolicy, FieldType, FormAction, FormActionType, FormActionVariant, FormConfig, FormRenderDefinition, HydraCollection, HydraView, IdentityApiManifest, LayoutConfig, LayoutHeaderAction, LayoutNode, LayoutSection, MediaApiManifest, NaviApiManifest, NaviGraphMeta, NaviGraphNode, NaviGraphNodeFlat, NaviGraphTarget, NavigraphConfig, PlatformDefaults, RelationDefinition, ResolvedTheme, SectionApiManifest, SubFormDefinition, TerminalApiManifest, ThemeChoice, ThemeConfigResponse, TokenResponse, UserDto, ValidatorDefinition, VfsApiManifest, ViewerApiManifest, ViewerDefinitionApiManifest, ViewerProfileApiManifest, VisibilityCondition, VisibilityOperator };
+export declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;