@coolms/core-angular 2.0.0-alpha.3 → 2.0.0-alpha.5

package/fesm2022/coolms-core-angular.mjs

@@ -1,17 +1,17 @@
 import * as i0 from '@angular/core';
-import { Injectable, inject, DestroyRef, Component, signal, computed, effect, input, ChangeDetectionStrategy, InjectionToken } from '@angular/core';
-import { HttpClient, HttpErrorResponse, HttpContextToken, HttpContext, HttpParams } from '@angular/common/http';
-import { Action, Selector, State, Store } from '@ngxs/store';
+import { Injectable, inject, InjectionToken, DestroyRef, signal, untracked, Injector, Component, computed, effect, input, ChangeDetectionStrategy, provideAppInitializer, makeEnvironmentProviders } from '@angular/core';
+import { HttpClient, HttpContextToken, HttpErrorResponse, HttpContext, HttpParams } from '@angular/common/http';
+import { Action, Selector, State, Store, Actions, ofActionDispatched, provideStore } from '@ngxs/store';
 import { __decorate } from 'tslib';
-import { Subject, debounceTime, catchError, of, defer, throwError, shareReplay, finalize, from, firstValueFrom, take, switchMap as switchMap$1, ReplaySubject, tap as tap$1, map } from 'rxjs';
-import { tap, switchMap, map as map$1, catchError as catchError$1, shareReplay as shareReplay$1 } from 'rxjs/operators';
+import { Subject, of, tap, switchMap, defer, finalize, shareReplay, debounceTime, catchError, firstValueFrom, throwError, map, from, take, ReplaySubject } from 'rxjs';
+import { tap as tap$1, switchMap as switchMap$1, map as map$1, catchError as catchError$1, shareReplay as shareReplay$1 } from 'rxjs/operators';
 import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
-import { Router } from '@angular/router';
+import { Router, ActivatedRoute } from '@angular/router';
 import { Location, NgIf } from '@angular/common';
 import * as i1 from '@angular/forms';
 import { FormsModule } from '@angular/forms';
 
-// Typed contract — must mirror ApiManifest PHP VOs exactly.
+// Typed contract -- must mirror ApiManifest PHP VOs exactly.
 // No `any` anywhere.
 /**
  * Replaces {param} tokens in a URL pattern with encoded values.
@@ -24,7 +24,7 @@ function resolvePattern(pattern, params) {
     return Object.entries(params).reduce((url, [key, value]) => url.replace(`{${key}}`, encodeURIComponent(value)), pattern);
 }
 
-// Typed contract — mirrors FormRenderDefinition PHP VOs exactly.
+// Typed contract -- mirrors FormRenderDefinition PHP VOs exactly.
 // No `any` anywhere.
 
 // --- Action ------------------------------------------------------------------
@@ -39,11 +39,15 @@ let AppConfigState = class AppConfigState {
     set(ctx, { config }) {
         ctx.setState({ config, loaded: true });
     }
+    /** The whole config as last set: the public theme config, with the console's manifest once granted. */
+    static config(state) {
+        return state.config;
+    }
     static manifest(state) {
         return state.config?.manifest ?? null;
     }
     /**
-     * F.7 viewer manifest. Null when the backend didn't ship a viewers
+     * The viewer manifest. Null when the backend didn't ship a viewers
      * section (no tagged providers); consumers should fall back to a
      * "no preview" surface.
      */
@@ -53,12 +57,15 @@ let AppConfigState = class AppConfigState {
     static loaded(state) {
         return state.loaded;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AppConfigState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AppConfigState });
 };
 __decorate([
     Action(SetAppConfig)
 ], AppConfigState.prototype, "set", null);
+__decorate([
+    Selector()
+], AppConfigState, "config", null);
 __decorate([
     Selector()
 ], AppConfigState, "manifest", null);
@@ -74,7 +81,7 @@ AppConfigState = __decorate([
         defaults: { config: null, loaded: false },
     })
 ], AppConfigState);
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppConfigState, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AppConfigState, decorators: [{
             type: Injectable
         }], propDecorators: { set: [] } });
 
@@ -122,47 +129,10 @@ class IdentityApiClient {
         // are then lost inside the Hydra member array.
         return this.http.get(this.manifest.identity.settingsUrl, { headers: { Accept: 'application/json' } });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: IdentityApiClient, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * The two realtime endpoints, carved out for the same reason the identity ones
- * were: the UI kit's realtime client needed exactly these two of `ApiService`'s
- * 117 methods, and depending on the whole thing would have pulled the entire
- * application's wire vocabulary underneath the kit.
- *
- * They belong in core rather than in the kit because both answers are derived
- * from things core already owns -- the boot manifest for the URL, and the auth
- * interceptor for the bearer token that authorises the request. A token is
- * session state, not a widget.
- *
- * `ApiService` keeps its identical signatures and delegates here, so nothing
- * calling it had to change.
- */
-class RealtimeTokenClient {
-    http = inject(HttpClient);
-    store = inject(Store);
-    get manifest() {
-        const m = this.store.selectSnapshot(AppConfigState.manifest);
-        if (!m)
-            throw new Error('ApiManifest not loaded — call AppInitService.load() first');
-        return m;
-    }
-    connectionToken() {
-        return this.http.post(this.manifest.apiBase + '/centrifugo/connection-token', {});
-    }
-    subscriptionToken(channel) {
-        return this.http.post(this.manifest.apiBase + '/centrifugo/subscription-token', { channel });
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: IdentityApiClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: IdentityApiClient, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: RealtimeTokenClient, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: IdentityApiClient, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -199,7 +169,447 @@ class PatchCurrentUser {
 }
 
 /**
- * Unified user preferences service — all preference types share one
+ * Optional by design: with nothing bound, a 403 stays a 403 and the state
+ * service still answers -- an application without an admin panel has no
+ * prompt to show and loses nothing.
+ */
+const ELEVATION_PROMPT = new InjectionToken('coolms.elevation-prompt');
+/** Optional, like {@link ELEVATION_PROMPT}: with nothing bound, a refusal is only a 403. */
+const ELEVATION_NOTICE = new InjectionToken('coolms.elevation-notice');
+
+/**
+ * Set on a request that must never open the elevation prompt: the elevation
+ * endpoint's own calls (a wrong password is a 403 and is not a refused action),
+ * and any caller that would rather receive its 403 and decide for itself.
+ */
+const BYPASS_ELEVATION = new HttpContextToken(() => false);
+/**
+ * The `storage` key whose write announces "this session's elevation changed"
+ * to the other tabs of the same browser. One token chain is shared across
+ * tabs, so a grant or a drop in one tab is true in all of
+ * them; the others learn of it here rather than at their next 403.
+ */
+const CROSS_TAB_KEY = 'coolms.elevation.changed';
+/**
+ * The shortest gap between two reconciling reads. `visibilitychange` and
+ * `focus` both fire when a window is re-activated, so without this a single
+ * alt-tab costs two identical GETs.
+ */
+const RECONCILE_MIN_INTERVAL_MS = 2_000;
+/**
+ * The elevation state of this session, read from ONE place: the server.
+ *
+ * The elevation client requirement, in one service. The state endpoint is the only
+ * source -- `elevated`, `expiresAt`, how the last elevation ended -- and every
+ * change of it is announced on `changes$` so the Explorer listing can refetch
+ * (its capability flags are the server's reading of the same state, computed
+ * when the listing was fetched, and a `write: true` fetched while elevated
+ * must not outlive the elevation).
+ *
+ * **Expiry is driven by the READ, not by a timer.** An elevation ends because
+ * time passed, and time is not an event; a client that waits to be told has
+ * nothing to wait for when the machine was asleep at the moment. So `state()`
+ * does the arithmetic every time it is asked, and an answer whose `expiresAt`
+ * has gone by reports expired without a request. The timer below still fires
+ * at `expiresAt` and the tab still re-asks when it comes back into view -- both
+ * are how the SERVER's answer is refreshed, which is a different thing from
+ * knowing this one has run out.
+ *
+ * This is not a second decider. The server said "elevated until T"; after T,
+ * continuing to report `elevated: true` asserts something it never said.
+ *
+ * The prompt is not here: dialogs are the kit's, a layer above core. The
+ * service asks the `ELEVATION_PROMPT` port and shares ONE in-flight prompt, so
+ * a burst of refused requests (a multi-select delete is one 403 per node)
+ * opens one dialog and every caller waits on the same answer.
+ */
+/**
+ * The header a 403 refused for want of elevation carries, with the gate's name
+ * as its value. The server stamps it where the gate refused; the interceptor
+ * prompts on it and on nothing else. There is no list of gated URLs on this
+ * side any more: the one that stood here lagged the server by every route
+ * whose refusal came from the VFS permission service under another module's
+ * path (media, document and word templates, content distribution).
+ */
+const ELEVATION_REQUIRED_HEADER = 'X-Elevation-Required';
+/**
+ * Set on a request no person asked for: a realtime token, a preferences sync, a
+ * poll. Its refusal is never announced -- not by a dialog and not by a notice --
+ * because nobody is waiting on it and nobody can act on it. The caller still
+ * receives the 403 and decides what its own state shows.
+ */
+const BACKGROUND_REQUEST = new HttpContextToken(() => false);
+/**
+ * Whether a failed request was refused for want of elevation: a 403 carrying
+ * the server's stamp. The one test every reader of a refusal uses -- the
+ * interceptor, a page's inline state, the error text -- so they cannot disagree.
+ */
+function isElevationRefusal(err) {
+    return err instanceof HttpErrorResponse && err.status === 403 && !!err.headers.get(ELEVATION_REQUIRED_HEADER);
+}
+class ElevationService {
+    http = inject(HttpClient);
+    store = inject(Store);
+    prompt = inject(ELEVATION_PROMPT, { optional: true });
+    destroyRef = inject(DestroyRef);
+    /** The last answer the server gave, exactly as it gave it. */
+    served = signal(null, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "served" }] : /* istanbul ignore next */ []));
+    /**
+     * The state as it stands NOW; null until the first read from the server.
+     *
+     * Deliberately NOT a `computed`. A cached derivation is only recomputed
+     * when one of its dependencies changes, and nothing changes when an
+     * elevation simply runs out -- so it would keep answering `elevated: true`
+     * past the moment the server itself named, for as long as the machine
+     * happened to be asleep.
+     *
+     * Reading past `expiresAt` also demotes the STORED answer. The value
+     * returned here is already correct without that write; the write is only
+     * how cached readers (a `computed`, an OnPush template) find out.
+     */
+    state = () => {
+        const served = this.served();
+        if (served === null || !isPast(served))
+            return served;
+        const expired = expiredView(served);
+        // untracked: this read can happen inside a computed or a template, and
+        // a signal write is refused there. The demotion is not a state change
+        // of its own -- it is the answer we already hold, read correctly.
+        untracked(() => this.served.set(expired));
+        this.announceExpiryLater();
+        return expired;
+    };
+    /** Convenience over `state`: false until the server has said otherwise. */
+    elevated = () => this.state()?.elevated ?? false;
+    /** `expiresAt` as a Date, null when not elevated. */
+    expiresAt = () => {
+        const iso = this.state()?.expiresAt;
+        return iso ? new Date(iso) : null;
+    };
+    /**
+     * Every change of elevation state: a grant, a drop (by this person, by the
+     * beacon, by the tripwire), an expiry, or an observed change of a live
+     * grant's `expiresAt`. A refresh that reports the same state emits nothing,
+     * so subscribers that refetch a listing on it never refetch for no reason.
+     */
+    changes$ = new Subject();
+    expiryTimer = null;
+    pendingPrompt = null;
+    expiryAnnouncePending = false;
+    lastReconcileAt = 0;
+    constructor() {
+        if (typeof window !== 'undefined') {
+            window.addEventListener('storage', this.onStorage);
+            window.addEventListener('focus', this.onFocus);
+            if (typeof document !== 'undefined') {
+                document.addEventListener('visibilitychange', this.onVisibilityChange);
+            }
+            this.destroyRef.onDestroy(() => {
+                window.removeEventListener('storage', this.onStorage);
+                window.removeEventListener('focus', this.onFocus);
+                if (typeof document !== 'undefined') {
+                    document.removeEventListener('visibilitychange', this.onVisibilityChange);
+                }
+                this.clearTimer();
+            });
+        }
+    }
+    /** The manifest carries the URL; without it the service is inert, not broken. */
+    get available() {
+        return this.url !== null;
+    }
+    get url() {
+        return this.store.selectSnapshot(AppConfigState.manifest)?.identity?.elevationUrl ?? null;
+    }
+    /**
+     * Whether a URL belongs to THIS API: a relative one under the manifest's
+     * `apiBase`, or an absolute one on this origin under it. The interceptor
+     * acts on a stamped refusal from here and from nowhere else -- a third
+     * party answering 403 with a header of the same name is not an invitation
+     * to elevate this session.
+     */
+    isThisApi(url) {
+        const apiBase = this.store.selectSnapshot(AppConfigState.manifest)?.apiBase ?? '/api/v1';
+        let path = url.split('?')[0];
+        if (/^https?:\/\//.test(path)) {
+            try {
+                const parsed = new URL(path);
+                if (typeof window !== 'undefined' && parsed.host !== window.location.host)
+                    return false;
+                path = parsed.pathname;
+            }
+            catch {
+                return false;
+            }
+        }
+        return path === apiBase || path.startsWith(`${apiBase}/`);
+    }
+    /** Ask the server. Applies the answer and announces it when it differs. */
+    refresh() {
+        const url = this.url;
+        if (!url)
+            return of(this.inert());
+        return this.http.get(url, this.options()).pipe(tap(s => this.apply(s)));
+    }
+    /**
+     * Elevate with the person's own password and, when the switch is on, a
+     * code from their own authenticator. Errors are the dialog's to branch on:
+     * 403 not a member of the admin group, wrong password, or wrong / replayed
+     * code, 428 a code is required, 409 this account cannot elevate yet, 429
+     * throttled. They pass through
+     * untouched, and never open the prompt (BYPASS_ELEVATION).
+     */
+    elevate(password, code) {
+        const url = this.url;
+        if (!url)
+            return of(this.inert());
+        const body = { password };
+        if (code)
+            body.code = code;
+        return this.http.post(url, body, this.options()).pipe(tap(s => this.apply(s, 'granted')));
+    }
+    /** Drop the elevation now. Idempotent on the server: nothing live is still a 204. */
+    drop(reason = 'dropped_by_user') {
+        const url = this.url;
+        if (!url)
+            return of(this.inert());
+        return this.http.delete(`${url}?reason=${reason}`, this.options()).pipe(switchMap(() => this.refresh()));
+    }
+    /**
+     * What a person's explicit request for elevation calls -- an Elevate button,
+     * or a control that already knows its action needs elevation: ask the
+     * server whether this session is elevated, and only when it is not, open
+     * the prompt. Nothing calls it on a response by itself (the interceptor
+     * only tells {@link ELEVATION_NOTICE}). Elevated already is false, no
+     * prompt: elevation would change nothing.
+     */
+    offerFor(refusal) {
+        if (!this.available || !this.prompt)
+            return of(false);
+        return this.refresh().pipe(switchMap(state => state.elevated ? of(false) : this.requestElevation({ state, refusal })));
+    }
+    /**
+     * Open the prompt, or join the one already open. Resolves to whether the
+     * session is elevated once the dialog closes.
+     */
+    requestElevation(request) {
+        if (!this.prompt)
+            return of(false);
+        if (this.pendingPrompt)
+            return this.pendingPrompt;
+        const prompt = this.prompt;
+        this.pendingPrompt = defer(() => prompt.open(request)).pipe(finalize(() => { this.pendingPrompt = null; }), shareReplay(1));
+        return this.pendingPrompt;
+    }
+    // -- internals ------------------------------------------------------------
+    options() {
+        return { context: new HttpContext().set(BYPASS_ELEVATION, true) };
+    }
+    inert() {
+        return {
+            elevated: false,
+            ended: { reason: 'never', at: null },
+            lifetimeSeconds: 0,
+            lifetimeCeilingSeconds: 0,
+            mfaRequired: false,
+            warnings: [],
+        };
+    }
+    /**
+     * Store the answer, schedule the expiry read, announce a change.
+     *
+     * `explicit` names the change when the caller knows it (a grant). For a
+     * plain refresh the kind is derived from the two states: elevated -> not
+     * is `expired` when the server says so and `dropped` otherwise (the person,
+     * another tab, the beacon, the tripwire); not -> elevated is a grant seen
+     * from another tab; a live grant whose `expiresAt` moved is `observed`.
+     *
+     * `prev` is read RAW rather than through `state()`: the demotion is not
+     * wanted here (this answer supersedes the stored one either way), and a
+     * read that demoted would queue an expiry announcement the server's own
+     * answer is about to make.
+     */
+    apply(next, explicit) {
+        const prev = untracked(() => this.served());
+        this.served.set(next);
+        this.schedule(next);
+        const kind = explicit ?? this.kindOf(prev, next);
+        if (kind === null)
+            return;
+        // Something is being announced here, so a queued expiry would be a
+        // second telling of the same news -- or, after a grant, stale news.
+        // A NULL kind must not cancel it: that is the case where a read
+        // already demoted the stored answer, leaving this one nothing to
+        // compare against, and the queued announcement is the only one there
+        // will be.
+        this.expiryAnnouncePending = false;
+        this.changes$.next({ kind, state: next });
+        this.announceToOtherTabs();
+    }
+    kindOf(prev, next) {
+        // Raw: a grant nothing had read yet is still a grant that ENDED, and
+        // this answer is the first notice of it. When a read demoted it first,
+        // `prev` already says so and this correctly finds no change.
+        const was = prev?.elevated ?? false;
+        if (was && !next.elevated)
+            return next.ended.reason === 'expired' ? 'expired' : 'dropped';
+        if (!was && next.elevated)
+            return 'granted';
+        if (was && next.elevated && (prev?.expiresAt ?? null) !== (next.expiresAt ?? null))
+            return 'observed';
+        return null;
+    }
+    /**
+     * Tell the listings that this session's elevation ran out, once, and NOT
+     * from inside the read that noticed: a subscriber refetches on this, and a
+     * refetch started in the middle of a change detection pass is a write
+     * during a read. The microtask runs at the end of the current task, before
+     * anything can paint.
+     *
+     * A server answer arriving first clears the flag, so the announcement is
+     * made by whichever of the two got there first, never by both. Other tabs
+     * are NOT told: each one reaches the same conclusion from the same
+     * `expiresAt` on its own read, so the storage write would only buy a
+     * thundering herd of GETs.
+     */
+    announceExpiryLater() {
+        if (this.expiryAnnouncePending)
+            return;
+        this.expiryAnnouncePending = true;
+        queueMicrotask(() => {
+            if (!this.expiryAnnouncePending)
+                return;
+            this.expiryAnnouncePending = false;
+            const state = untracked(() => this.served());
+            if (state !== null && !state.elevated)
+                this.changes$.next({ kind: 'expired', state });
+        });
+    }
+    /**
+     * Ask the server again at `expiresAt` -- an OPTIMISATION, not the
+     * mechanism. `state()` already reports an elapsed grant as expired without
+     * being told, so a timer that a sleeping machine swallows, or that a
+     * background tab throttles to once a minute, now costs freshness rather
+     * than correctness. What it buys is the listing refetch happening at the
+     * moment of expiry instead of at the next read.
+     *
+     * Do not flip a local flag here: the lifetime counts from the grant on the
+     * server's clock, and if the server still says elevated at that moment
+     * (skew), the honest thing is to ask again shortly.
+     */
+    schedule(state) {
+        this.clearTimer();
+        if (!state.elevated || !state.expiresAt)
+            return;
+        // Floor: never a tight loop on a stale answer. Ceiling: a browser
+        // treats a delay past 2^31-1 ms as ZERO and fires at once; the code
+        // ceiling is an hour, so only bad data gets there, and it re-schedules.
+        const wanted = Date.parse(state.expiresAt) - Date.now() + 250;
+        const ms = Math.min(Math.max(1_000, wanted), 2_147_483_647);
+        this.expiryTimer = setTimeout(() => {
+            this.expiryTimer = null;
+            this.refresh().subscribe({
+                // apply() has re-scheduled from the fresh answer. Only when the
+                // server still says elevated PAST its own expiresAt (clock skew
+                // between the two) is a short retry needed instead.
+                next: s => {
+                    if (s.elevated && s.expiresAt && Date.parse(s.expiresAt) <= Date.now())
+                        this.scheduleRetry();
+                },
+                error: () => this.scheduleRetry(),
+            });
+        }, ms);
+    }
+    /**
+     * One more attempt, then stop. Giving up is affordable now and was not
+     * before: the state a failed read leaves behind is still read through the
+     * arithmetic above, so an unreachable server cannot leave this tab
+     * believing it is elevated. What is lost is only news from elsewhere -- a
+     * grant or a drop in another session -- and that is what the tab picks up
+     * when it next comes into view.
+     */
+    scheduleRetry() {
+        this.clearTimer();
+        this.expiryTimer = setTimeout(() => {
+            this.expiryTimer = null;
+            this.refresh().subscribe({ error: () => undefined });
+        }, 5_000);
+    }
+    clearTimer() {
+        if (this.expiryTimer !== null) {
+            clearTimeout(this.expiryTimer);
+            this.expiryTimer = null;
+        }
+    }
+    announceToOtherTabs() {
+        try {
+            localStorage.setItem(CROSS_TAB_KEY, String(Date.now()));
+        }
+        catch {
+            // Private mode or storage denied: the other tabs learn at their next 403.
+        }
+    }
+    onStorage = (event) => {
+        if (event.key !== CROSS_TAB_KEY || !this.available)
+            return;
+        this.refresh().subscribe({ error: () => undefined });
+    };
+    onFocus = () => this.reconcile();
+    onVisibilityChange = () => {
+        if (document.visibilityState === 'visible')
+            this.reconcile();
+    };
+    /**
+     * The tab is back. Read first -- that alone ends an elevation that ran out
+     * while it was away, with no request and no network to depend on -- then
+     * ask the server for what the read cannot know: a grant or a drop made
+     * elsewhere, or a lifetime the server moved.
+     */
+    reconcile() {
+        this.state();
+        if (!this.available)
+            return;
+        const now = Date.now();
+        if (now - this.lastReconcileAt < RECONCILE_MIN_INTERVAL_MS)
+            return;
+        this.lastReconcileAt = now;
+        this.refresh().subscribe({ error: () => undefined });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ElevationService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ElevationService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ElevationService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [] });
+/** Whether a stored answer has gone past the moment the server named. */
+function isPast(state) {
+    if (!state.elevated || !state.expiresAt)
+        return false;
+    const at = Date.parse(state.expiresAt);
+    // Unparseable is not expired: a date this client cannot read is a reason to
+    // keep asking the server, not to end an elevation it may still be granting.
+    return Number.isFinite(at) && at <= Date.now();
+}
+/**
+ * The same answer, read after its own `expiresAt`: what the server would say
+ * if asked now, down to `ended`, so a prompt opened from it explains itself
+ * the same way whether the news came from the read or from the endpoint.
+ */
+function expiredView(state) {
+    return {
+        ...state,
+        elevated: false,
+        expiresAt: null,
+        grantedAt: null,
+        factorConfirmed: null,
+        ended: { reason: 'expired', at: state.expiresAt ?? null },
+    };
+}
+
+/**
+ * Unified user preferences service -- all preference types share one
  * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
  *
  * Key naming convention (stored as nested objects, referenced via dot-notation):
@@ -231,7 +641,7 @@ class UserPreferencesService {
     SYNC_DELAY = 2000; // ms
     syncSubject = new Subject();
     constructor() {
-        // Debounced sync to server — batches rapid changes (e.g. live resize)
+        // Debounced sync to server -- batches rapid changes (e.g. live resize)
         this.syncSubject.pipe(debounceTime(this.SYNC_DELAY), takeUntilDestroyed(this.destroyRef)).subscribe(prefs => this.syncToServer(prefs));
     }
     // -- Core helpers ---------------------------------------------------------
@@ -339,11 +749,11 @@ class UserPreferencesService {
         try {
             const raw = localStorage.getItem(this.STORAGE_KEY);
             if (!raw) {
-                // Fresh device — trust the server entirely
+                // Fresh device -- trust the server entirely
                 localStorage.setItem(this.STORAGE_KEY, JSON.stringify(uiPrefs));
             }
             else {
-                // Local prefs exist — server is the base, local namespaces win
+                // Local prefs exist -- server is the base, local namespaces win
                 const local = JSON.parse(raw);
                 const merged = { ...uiPrefs, ...local };
                 localStorage.setItem(this.STORAGE_KEY, JSON.stringify(merged));
@@ -360,6 +770,8 @@ class UserPreferencesService {
             return;
         this.http.patch(url, { uiPrefs: prefs }, {
             headers: { 'Content-Type': 'application/merge-patch+json' },
+            // Sent on every navigation, by no one's action.
+            context: new HttpContext().set(BACKGROUND_REQUEST, true),
         }).subscribe({
             error: err => console.warn('Preferences sync failed:', err),
         });
@@ -499,7 +911,7 @@ class UserPreferencesService {
         all['page'] = page;
         this.save(all);
     }
-    // -- Media (legacy pass-through — kept for compatibility) -----------------
+    // -- Media (legacy pass-through -- kept for compatibility) -----------------
     /** @deprecated Use getPageState('media') instead */
     getMediaViewMode() {
         return this.getPageState('media')?.viewMode ?? null;
@@ -516,15 +928,15 @@ class UserPreferencesService {
     setMediaCollectionsPanel(width, collapsed) {
         this.setPanelState('media_panel_left', width, collapsed);
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: UserPreferencesService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: UserPreferencesService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: UserPreferencesService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: UserPreferencesService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }], ctorParameters: () => [] });
 
-const STORAGE_KEY$1 = 'coolms_token';
+const STORAGE_KEY$2 = 'coolms_token';
 let AuthState = class AuthState {
     // `inject()` rather than constructor parameters, and the imports above are
     // VALUE imports on purpose: an injected type must survive to runtime. As a
@@ -534,7 +946,7 @@ let AuthState = class AuthState {
     api = inject(IdentityApiClient);
     prefs = inject(UserPreferencesService);
     login(ctx, { identifier, password }) {
-        return this.api.login(identifier, password).pipe(tap((res) => {
+        return this.api.login(identifier, password).pipe(tap$1((res) => {
             const state = {
                 accessToken: res.accessToken,
                 refreshToken: res.refreshToken,
@@ -542,16 +954,16 @@ let AuthState = class AuthState {
                 user: res.user ?? null,
             };
             ctx.setState(state);
-            localStorage.setItem(STORAGE_KEY$1, JSON.stringify(state));
+            localStorage.setItem(STORAGE_KEY$2, JSON.stringify(state));
         }), 
         // Fetch full user data (includes uiPrefs) to seed preferences
-        switchMap(() => this.api.me().pipe(catchError(() => of(null)))), tap(me => {
+        switchMap$1(() => this.api.me().pipe(catchError(() => of(null)))), tap$1(me => {
             if (!me)
                 return;
             // Update stored user with full data including uiPrefs
             const updated = { ...ctx.getState(), user: me };
             ctx.setState(updated);
-            localStorage.setItem(STORAGE_KEY$1, JSON.stringify(updated));
+            localStorage.setItem(STORAGE_KEY$2, JSON.stringify(updated));
             if (me.uiPrefs) {
                 this.prefs.loadFromServer(me.uiPrefs);
             }
@@ -559,10 +971,10 @@ let AuthState = class AuthState {
     }
     logout(ctx) {
         ctx.setState({ accessToken: null, refreshToken: null, expiresAt: null, user: null });
-        localStorage.removeItem(STORAGE_KEY$1);
+        localStorage.removeItem(STORAGE_KEY$2);
     }
     restore(ctx) {
-        const raw = localStorage.getItem(STORAGE_KEY$1);
+        const raw = localStorage.getItem(STORAGE_KEY$2);
         if (!raw)
             return;
         try {
@@ -580,11 +992,11 @@ let AuthState = class AuthState {
                 }
             }
             else {
-                localStorage.removeItem(STORAGE_KEY$1);
+                localStorage.removeItem(STORAGE_KEY$2);
             }
         }
         catch {
-            localStorage.removeItem(STORAGE_KEY$1);
+            localStorage.removeItem(STORAGE_KEY$2);
         }
     }
     setTokens(ctx, { response }) {
@@ -595,7 +1007,7 @@ let AuthState = class AuthState {
             user: response.user ?? ctx.getState().user,
         };
         ctx.setState(state);
-        localStorage.setItem(STORAGE_KEY$1, JSON.stringify(state));
+        localStorage.setItem(STORAGE_KEY$2, JSON.stringify(state));
     }
     patchCurrentUser(ctx, { patch }) {
         const current = ctx.getState();
@@ -603,7 +1015,7 @@ let AuthState = class AuthState {
             return;
         const updated = { ...current, user: { ...current.user, ...patch } };
         ctx.setState(updated);
-        localStorage.setItem(STORAGE_KEY$1, JSON.stringify(updated));
+        localStorage.setItem(STORAGE_KEY$2, JSON.stringify(updated));
     }
     static isAuthenticated(state) {
         return null !== state.accessToken;
@@ -627,8 +1039,8 @@ let AuthState = class AuthState {
     static currentUser(state) {
         return state.user;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AuthState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AuthState });
 };
 __decorate([
     Action(Login)
@@ -666,12 +1078,179 @@ AuthState = __decorate([
         defaults: { accessToken: null, refreshToken: null, expiresAt: null, user: null },
     })
 ], AuthState);
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthState, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AuthState, decorators: [{
             type: Injectable
         }], propDecorators: { login: [], logout: [], restore: [], setTokens: [], patchCurrentUser: [] } });
 
+/**
+ * Whether the signed-in account may use the console, and the console's endpoint
+ * map when it may.
+ *
+ * The server decides: `GET /api/v1/admin/manifest` answers the map. Since 2026-10-06
+ * (Dmitry: "no host groups"; access is decided by module groups alone) it answers every
+ * signed-in account: the map grants nothing, each call it names is decided by its own
+ * route, and an account in no group sees the admin with an empty menu. A server from
+ * before that answers only at `/api/v1/console/manifest`, to the `console` group, and
+ * 403 to anyone else -- there a refused sign-in is still signed out; this asks the new
+ * address first and the old one only on its 404. The public theme config
+ * read before sign-in carries only what the sign-in page needs; the rest arrives
+ * here, once per sign-in, and is merged into the app config key by key: a key the
+ * console's map carries replaces the public one whole, so the console's copy of a
+ * section is always the complete one.
+ *
+ * `unknown` is a failure to ask (the network, a 5xx), not an answer: it is not kept,
+ * so while the endpoint fails every navigation asks again.
+ *
+ * !! An answer belongs to the sign-in it was asked for. A sign-in, a sign-out or a
+ * restored session starts a new generation; an answer that arrives for a generation
+ * that is gone is kept for nobody -- A's late 403 must not sign B out -- and whoever
+ * is waiting on it is answered for the sign-in there is now.
+ *
+ * !! With nobody signed in there is nothing to ask, and nothing is asked. Without
+ * that, the re-ask after a sign-out went out with no token, its 401 made the
+ * interceptor dispatch Logout, which started another generation, which re-asked:
+ * a loop for as long as the tab lived (found in review).
+ */
+class ConsoleAccessService {
+    /** The admin manifest's URL: fixed, like the theme config's, because nothing is known before it. */
+    static URL = '/api/v1/admin/manifest';
+    /** The address before 2026-10-06, asked only when a server older than that answers 404 at {@link URL}. */
+    static LEGACY_URL = '/api/v1/console/manifest';
+    /** The login page's query parameter value for "signed out: no console access". */
+    static REFUSED_REASON = 'no-console-access';
+    http = inject(HttpClient);
+    store = inject(Store);
+    answer = 'unknown';
+    pending = null;
+    generation = 0;
+    constructor() {
+        // Another sign-in -- or none -- is another question.
+        inject(Actions).pipe(ofActionDispatched(Login, Logout, RestoreSession)).subscribe(() => {
+            this.generation++;
+            this.answer = 'unknown';
+            this.pending = null;
+        });
+    }
+    /** Ask once per sign-in; the manifest is merged into the app config when granted. */
+    ensure() {
+        if (!this.store.selectSnapshot(AuthState.isAuthenticated)) {
+            return Promise.resolve('unknown');
+        }
+        if ('unknown' !== this.answer) {
+            return Promise.resolve(this.answer);
+        }
+        if (null !== this.pending) {
+            return this.pending;
+        }
+        const askedFor = this.generation;
+        const pending = firstValueFrom(this.http.get(ConsoleAccessService.URL).pipe(catchError((error) => error instanceof HttpErrorResponse && 404 === error.status
+            ? this.http.get(ConsoleAccessService.LEGACY_URL)
+            : throwError(() => error)), map((response) => ({ access: 'granted', response })), catchError((error) => of({
+            access: error instanceof HttpErrorResponse && 403 === error.status ? 'refused' : 'unknown',
+            response: null,
+        })))).then(({ access, response }) => {
+            if (askedFor !== this.generation) {
+                return this.ensure();
+            }
+            if (null !== response) {
+                this.merge(response);
+            }
+            this.pending = null;
+            this.answer = access;
+            return access;
+        });
+        this.pending = pending;
+        return pending;
+    }
+    /**
+     * Sign a refused account out: this sign-in ends on the server (its refresh token
+     * with it), as the account menu's sign-out does, and then in this browser --
+     * whatever the server answered, so a refused request cannot leave it signed in.
+     */
+    signOut() {
+        const logout = this.store.selectSnapshot(AppConfigState.manifest)?.auth?.logout ?? '/api/v1/auth/logout';
+        return this.http.post(logout, null).pipe(catchError(() => of(null)), switchMap(() => this.store.dispatch(new Logout())), map(() => undefined));
+    }
+    merge(response) {
+        const config = this.store.selectSnapshot(AppConfigState.config);
+        this.store.dispatch(new SetAppConfig({
+            ...(config ?? {}),
+            manifest: { ...(config?.manifest ?? {}), ...response.manifest },
+        }));
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConsoleAccessService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConsoleAccessService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConsoleAccessService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [] });
+
+/** No person asks for a realtime token: a refusal is the channel's answer, never a prompt or a notice. */
+const BACKGROUND = { context: new HttpContext().set(BACKGROUND_REQUEST, true) };
+/**
+ * The two realtime endpoints, carved out for the same reason the identity ones
+ * were: the UI kit's realtime client needed exactly these two of `ApiService`'s
+ * 117 methods, and depending on the whole thing would have pulled the entire
+ * application's wire vocabulary underneath the kit.
+ *
+ * They belong in core rather than in the kit because both answers are derived
+ * from things core already owns -- the boot manifest for the URL, and the auth
+ * interceptor for the bearer token that authorises the request. A token is
+ * session state, not a widget.
+ *
+ * `ApiService` keeps its identical signatures and delegates here, so nothing
+ * calling it had to change.
+ *
+ * !! Access first, then realtime (Dmitry, 2026-09-28): "The console opens a realtime
+ * connection before the access check. Reverse the order ... A refused account opens no
+ * socket." The socket cannot open without the connection token, and anything may ask for
+ * one early -- the ring subscription is built at app init and asks as soon as a user is
+ * set, before the guard's answer is in. So the token waits for the console's answer (the
+ * guard's own request, not a second one) and a refused sign-in gets none: no request, no
+ * socket. A failure to ask is not a refusal, as at the guard.
+ *
+ * Since 2026-10-06 the connection token is every signed-in account's (Dmitry: "The connection
+ * token only opens a socket; each channel is authorized when it is subscribed to"), and a
+ * current server answers the admin manifest to every signed-in account, so no
+ * sign-in is refused and every one gets its token; each subscription is then decided by its
+ * channel. The wait stays for a server from before that, where a refused sign-in still opens
+ * no socket.
+ */
+class RealtimeTokenClient {
+    /** The error a refused sign-in's connection-token request ends with. */
+    static REFUSED = 'no console access: no realtime connection';
+    http = inject(HttpClient);
+    store = inject(Store);
+    // Resolved when a connection token is asked for, not with this client: ApiService
+    // delegates here and is built in many places that never open a socket.
+    injector = inject(Injector);
+    get manifest() {
+        const m = this.store.selectSnapshot(AppConfigState.manifest);
+        if (!m)
+            throw new Error('ApiManifest not loaded — call AppInitService.load() first');
+        return m;
+    }
+    connectionToken() {
+        return defer(() => this.injector.get(ConsoleAccessService).ensure()).pipe(switchMap(access => 'refused' === access
+            ? throwError(() => new Error(RealtimeTokenClient.REFUSED))
+            : this.http.post(this.manifest.apiBase + '/centrifugo/connection-token', {}, BACKGROUND)));
+    }
+    subscriptionToken(channel) {
+        return this.http.post(this.manifest.apiBase + '/centrifugo/subscription-token', { channel }, BACKGROUND);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: RealtimeTokenClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: RealtimeTokenClient, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: RealtimeTokenClient, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
 const LOCK_NAME = 'coolms_auth_refresh';
 const FRESH_TOKEN_GRACE_MS = 30_000;
+/** Where AuthState persists the session, shared by every tab of the origin. */
+const STORAGE_KEY$1 = 'coolms_token';
 /**
  * Two-layer refresh coordinator: an intra-tab `shareReplay(1)`
  * mutex dedupes concurrent callers within one tab, and a
@@ -695,6 +1274,26 @@ const FRESH_TOKEN_GRACE_MS = 30_000;
  * (real auth failure). Transient errors (network blips, 5xx,
  * CORS, timeouts) propagate without clearing the session so a
  * momentary refresh failure does not kill a valid login.
+ *
+ * A token the server REFUSED (2026-09-26). A caller answering a 401
+ * passes the access token that was refused. Until then the lock body
+ * handed back the cached token whenever its expiry looked fresh --
+ * which a revoked token's does: a session ended on the server (a
+ * sign-out everywhere from another device, a password change) was
+ * retried with the same dead token and never refreshed, so the client
+ * stayed signed in, and in its calls, until the token neared expiry
+ * (measured: a 1:1 call kept for the whole 30 s window, every request
+ * answered 401). Now the lock body re-reads the SHARED copy
+ * (`localStorage`, which every tab's `SetTokens` writes synchronously;
+ * this tab's state only follows a sibling's write when its `storage`
+ * event arrives):
+ *   - a different access token there -> another tab (or an earlier
+ *     refresh here) already rotated past the refused one: use it, no
+ *     request;
+ *   - the same one -> the server refused this token: refresh, with the
+ *     newest refresh token -- the shared one, so a rotation a sibling
+ *     made is never replayed with the token it consumed. A 401 there
+ *     is the session's end: `Logout`.
  */
 class AuthRefreshCoordinator {
     api = inject(IdentityApiClient);
@@ -705,14 +1304,20 @@ class AuthRefreshCoordinator {
      * Return the in-flight refresh Observable, or spawn a new one
      * with the supplied refresh-token value.
      *
+     * `refusedAccessToken`: the access token the server just answered
+     * 401 to, when the caller is answering one. With it, the lock body
+     * refreshes unless the shared copy already holds another token;
+     * without it (a preemptive refresh), a fresh-looking cached token
+     * is handed back as before.
+     *
      * Callers subscribe via `switchMap` / `firstValueFrom` to retry
      * their original request with the resolved access token.
      */
-    refresh(refreshToken) {
+    refresh(refreshToken, refusedAccessToken = null) {
         if (this.inFlight) {
             return this.inFlight;
         }
-        this.inFlight = defer(() => this.refreshWithCrossTabLock(refreshToken)).pipe(catchError(refreshErr => {
+        this.inFlight = defer(() => this.refreshWithCrossTabLock(refreshToken, refusedAccessToken)).pipe(catchError(refreshErr => {
             const isAuthFailure = refreshErr instanceof HttpErrorResponse && refreshErr.status === 401;
             if (isAuthFailure) {
                 this.store.dispatch(new Logout());
@@ -732,8 +1337,8 @@ class AuthRefreshCoordinator {
      * body checks for state already updated by a sibling tab before
      * issuing its own HTTP call.
      */
-    refreshWithCrossTabLock(refreshToken) {
-        const lockBody = () => this.executeRefresh(refreshToken);
+    refreshWithCrossTabLock(refreshToken, refusedAccessToken) {
+        const lockBody = () => this.executeRefresh(refreshToken, refusedAccessToken);
         if (typeof navigator === 'undefined' || !('locks' in navigator)) {
             return from(lockBody());
         }
@@ -745,31 +1350,77 @@ class AuthRefreshCoordinator {
         }));
     }
     /**
-     * Lock body. Re-reads `AuthState.expiresAt` first: if another
-     * tab published fresh tokens while we were queued, return the
-     * cached access token directly. Otherwise read the latest
-     * refresh-token value from state (it may have rotated while we
-     * waited) and issue the HTTP refresh.
+     * Lock body. Re-reads the shared copy first (see the class note).
+     *
+     * Answering a refusal: a shared access token other than the refused
+     * one is a rotation already made -- taken, and mirrored into this
+     * tab's state if its `storage` event has not arrived yet. Otherwise,
+     * or for a preemptive caller whose cached token no longer looks
+     * fresh, the HTTP refresh, with the newest refresh token: shared,
+     * then state, then the caller's.
      */
-    async executeRefresh(originalRefreshToken) {
-        const cachedAccess = this.tryConsumeFreshState();
-        if (cachedAccess !== null) {
-            return cachedAccess;
+    async executeRefresh(originalRefreshToken, refusedAccessToken) {
+        const shared = this.readShared();
+        if (refusedAccessToken !== null) {
+            if (shared !== null && shared.accessToken !== refusedAccessToken) {
+                if (this.store.selectSnapshot(AuthState.accessToken) !== shared.accessToken) {
+                    this.store.dispatch(new SetTokens(shared));
+                }
+                return shared.accessToken;
+            }
+        }
+        else {
+            const cachedAccess = this.tryConsumeFreshState(shared);
+            if (cachedAccess !== null) {
+                return cachedAccess;
+            }
         }
-        const currentRefreshToken = this.store.selectSnapshot(AuthState.refreshToken) ?? originalRefreshToken;
+        const currentRefreshToken = shared?.refreshToken
+            ?? this.store.selectSnapshot(AuthState.refreshToken)
+            ?? originalRefreshToken;
         const response = await firstValueFrom(this.api.refresh(currentRefreshToken));
         this.store.dispatch(new SetTokens(response));
         return response.accessToken;
     }
     /**
-     * Return the cached access token when `AuthState.expiresAt` has
-     * more than `FRESH_TOKEN_GRACE_MS` milliseconds remaining --
-     * signalling that some other tab refreshed for us. Null
-     * otherwise.
+     * The session as the tabs share it, or null when there is none to
+     * read: no storage, nothing stored (signed out), or a value that is
+     * not a complete token set.
+     */
+    readShared() {
+        let raw;
+        try {
+            raw = localStorage.getItem(STORAGE_KEY$1);
+        }
+        catch {
+            return null;
+        }
+        if (raw === null) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (typeof parsed?.accessToken !== 'string' || typeof parsed.refreshToken !== 'string' || typeof parsed.expiresAt !== 'string') {
+                return null;
+            }
+            return { accessToken: parsed.accessToken, refreshToken: parsed.refreshToken, expiresAt: parsed.expiresAt };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * For a preemptive caller only: return the current access token when
+     * its expiry is more than `FRESH_TOKEN_GRACE_MS` milliseconds away --
+     * signalling that some other tab refreshed for us. The shared copy
+     * first, which a sibling's rotation reaches before this tab's state
+     * does (mirrored here when it is newer); this tab's state when there
+     * is none. Null otherwise. Never asked for a token the server
+     * refused: a refused token's expiry looks just as fresh.
      */
-    tryConsumeFreshState() {
-        const accessToken = this.store.selectSnapshot(AuthState.accessToken);
-        const expiresAtStr = this.store.selectSnapshot(AuthState.expiresAt);
+    tryConsumeFreshState(shared) {
+        const accessToken = shared?.accessToken ?? this.store.selectSnapshot(AuthState.accessToken);
+        const expiresAtStr = shared?.expiresAt ?? this.store.selectSnapshot(AuthState.expiresAt);
         if (accessToken === null || expiresAtStr === null) {
             return null;
         }
@@ -777,15 +1428,18 @@ class AuthRefreshCoordinator {
         if (Number.isNaN(expiresAtMs)) {
             return null;
         }
-        if (Date.now() < expiresAtMs - FRESH_TOKEN_GRACE_MS) {
-            return accessToken;
+        if (Date.now() >= expiresAtMs - FRESH_TOKEN_GRACE_MS) {
+            return null;
+        }
+        if (shared !== null && this.store.selectSnapshot(AuthState.accessToken) !== shared.accessToken) {
+            this.store.dispatch(new SetTokens(shared));
         }
-        return null;
+        return accessToken;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AuthRefreshCoordinator, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AuthRefreshCoordinator, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AuthRefreshCoordinator, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AuthRefreshCoordinator, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -803,13 +1457,13 @@ const authInterceptor = (req, next) => {
     const coordinator = inject(AuthRefreshCoordinator);
     const initService = inject(AppInitService);
     // Caller explicitly requested no auth header (e.g. the bootstrap config
-    // fetch — the endpoint is public and a stale token would cause 401).
+    // fetch -- the endpoint is public and a stale token would cause 401).
     if (req.context.get(BYPASS_AUTH)) {
         return next(req);
     }
     // Auth endpoints are public by design.  The backend's JWT firewall rejects any
-    // request that carries an invalid/expired Bearer token — even on endpoints
-    // that would otherwise allow anonymous access — so never forward a stored
+    // request that carries an invalid/expired Bearer token -- even on endpoints
+    // that would otherwise allow anonymous access -- so never forward a stored
     // token to login or refresh.
     if (req.url.includes('/auth/login') || req.url.includes('/auth/refresh')) {
         return next(req);
@@ -824,7 +1478,7 @@ const authInterceptor = (req, next) => {
     // ready$ is a ReplaySubject(1) that completes after load() finishes, so:
     //   - requests fired during init queue here and flush the moment ready$ emits;
     //   - requests fired after init pass through take(1) immediately (replayed value).
-    return initService.ready$.pipe(take(1), switchMap$1(() => {
+    return initService.ready$.pipe(take(1), switchMap(() => {
         const token = store.selectSnapshot(AuthState.accessToken);
         const authed = token
             ? req.clone({ setHeaders: { Authorization: `Bearer ${token}` } })
@@ -833,7 +1487,7 @@ const authInterceptor = (req, next) => {
             if (!(err instanceof HttpErrorResponse) || err.status !== 401) {
                 return throwError(() => err);
             }
-            // Avoid infinite loop — skip refresh for auth endpoints themselves.
+            // Avoid infinite loop -- skip refresh for auth endpoints themselves.
             if (req.url.includes('/auth/refresh') || req.url.includes('/auth/login')) {
                 return throwError(() => err);
             }
@@ -854,7 +1508,12 @@ const authInterceptor = (req, next) => {
             // would send the same refresh-token twice and trigger the
             // backend's `isUsed` replay branch on the second arrival,
             // wiping the whole session.
-            return coordinator.refresh(refreshToken).pipe(switchMap$1(newToken => next(req.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } }))));
+            //
+            // With the token that was refused, so the coordinator
+            // refreshes rather than hand the same dead token back
+            // because its expiry still looks fresh (a session ended
+            // on the server went unnoticed until then, 2026-09-26).
+            return coordinator.refresh(refreshToken, token).pipe(switchMap(newToken => next(req.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } }))));
         }));
     }));
 };
@@ -927,10 +1586,10 @@ class CrossTabAuthSyncService {
         };
         this.store.dispatch(new SetTokens(tokenResponse));
     };
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: CrossTabAuthSyncService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: CrossTabAuthSyncService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CrossTabAuthSyncService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: CrossTabAuthSyncService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -946,10 +1605,10 @@ class AppInitService {
     prefs = inject(UserPreferencesService);
     crossTabSync = inject(CrossTabAuthSyncService);
     refreshCoordinator = inject(AuthRefreshCoordinator);
-    /** The only hardcoded URL — everything else comes from the manifest. */
+    /** The only hardcoded URL -- everything else comes from the manifest. */
     configUrl = '/api/v1/theme/config';
     /**
-     * Emits (once) when load() has fully completed — tokens settled, manifest
+     * Emits (once) when load() has fully completed -- tokens settled, manifest
      * set (or swallowed on error).  authGuard subscribes to this so it never
      * evaluates isAuthenticated against a partially-restored stale token.
      */
@@ -967,20 +1626,20 @@ class AppInitService {
         //
         // RestoreSession is synchronous (ctx.setState from localStorage), so
         // this await resolves in the same microtask.  Tokens are in NGXS state
-        // before ANY subsequent HTTP request fires — the auth interceptor reads
+        // before ANY subsequent HTTP request fires -- the auth interceptor reads
         // the token from state when attaching Authorization headers, so this
         // ordering prevents unauthenticated requests on page reload (F5).
         await firstValueFrom(this.store.dispatch(new RestoreSession()));
         // -- Step 2: fetch the manifest ----------------------------------------
         //
-        // BYPASS_AUTH is required here — not optional.  The manifest endpoint
+        // BYPASS_AUTH is required here -- not optional.  The manifest endpoint
         // is public, but two specific failure modes make bypassing necessary:
         //
         //   a) The stored access token may be expired.  Without BYPASS_AUTH the
         //      interceptor attaches the expired token, gets a 401, and tries to
         //      refresh.  But the refresh endpoint URL comes from the manifest
         //      (api.refresh() reads manifest.auth.refresh), which hasn't been
-        //      loaded yet — triggering a null-dereference crash before the app
+        //      loaded yet -- triggering a null-dereference crash before the app
         //      can recover.
         //
         //   b) Even if the token is valid, attaching it to a public endpoint
@@ -991,14 +1650,14 @@ class AppInitService {
         // restored (or refreshed) token normally.
         const config = await firstValueFrom(this.http.get(this.configUrl, {
             context: new HttpContext().set(BYPASS_AUTH, true),
-        }).pipe(tap$1(cfg => this.store.dispatch(new SetAppConfig(cfg))), catchError(() => {
+        }).pipe(tap(cfg => this.store.dispatch(new SetAppConfig(cfg))), catchError(() => {
             console.warn('CoolMS: theme/config unreachable, using safe defaults');
             return of(null);
         })));
         // -- Step 3: validate the restored session -----------------------------
         //
         // RestoreSession trusts whatever tokens are in localStorage, but they may
-        // have been revoked out-of-band — most notably, signing out on the public
+        // have been revoked out-of-band -- most notably, signing out on the public
         // SSR site revokes the user's WHOLE token set. We MUST settle the real
         // auth state here, BEFORE step 4 signals ready$: both the auth interceptor
         // AND authGuard gate on ready$, so if we signalled first, the guard would
@@ -1029,7 +1688,7 @@ class AppInitService {
         // win over the saved route. The router cannot tell us which one this is:
         // withEnabledBlockingInitialNavigation holds the initial navigation until
         // this initializer resolves, so router.url is still '/'. The browser
-        // location is the only record of what was requested — Location.path()
+        // location is the only record of what was requested -- Location.path()
         // reads it with the /admin base href stripped, so the bare root (with or
         // without trailing slash) yields ''. Anything else, including a root URL
         // carrying query params, is treated as an explicit destination.
@@ -1068,18 +1727,17 @@ class AppInitService {
         }
         let refreshedToken = null;
         try {
-            refreshedToken = await firstValueFrom(this.refreshCoordinator.refresh(refreshToken));
+            refreshedToken = await firstValueFrom(this.refreshCoordinator.refresh(refreshToken, token));
         }
         catch {
             // 401 -> coordinator already dispatched Logout; transient -> session kept.
             return;
         }
-        // Refresh resolved — but the coordinator's fresh-state optimisation can hand
-        // back the SAME access token (without a network round-trip) when its stored
-        // expiry still looks fresh. For a token that was revoked but not yet expired
-        // (signing out on the SSR site while the access token is still in its TTL),
-        // that token is dead despite looking fresh. Re-probe with whatever we now
-        // hold; a second rejection means the session is genuinely gone.
+        // Refresh resolved. Handed the refused token, the coordinator no longer
+        // returns that same token (2026-09-26) -- it did when its stored expiry
+        // looked fresh, which a revoked token's does. The re-probe stays: a
+        // second rejection means the session is genuinely gone, whatever path
+        // the coordinator took.
         if (!(await this.probe(meUrl, refreshedToken))) {
             this.store.dispatch(new Logout());
         }
@@ -1091,10 +1749,10 @@ class AppInitService {
             headers: token ? { Authorization: `Bearer ${token}` } : {},
         }).pipe(map(() => true), catchError(() => of(false))));
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AppInitService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AppInitService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: AppInitService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: AppInitService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -1104,20 +1762,35 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImpor
  *
  * The guard is intentionally ASYNC: it waits for AppInitService.ready$ before
  * evaluating auth state.  Without this, Angular's router can evaluate
- * isAuthenticated while APP_INITIALIZER is still in-flight — RestoreSession
+ * isAuthenticated while APP_INITIALIZER is still in-flight -- RestoreSession
  * will have placed a non-null (but expired) token in state, causing the guard
  * to pass even though the subsequent config/refresh requests will fail and
  * dispatch Logout.  Waiting for ready$ guarantees the auth state is settled.
+ *
+ * Signed in is not enough: the console is granted, and the server says to whom
+ * (ConsoleAccessService). An account it refuses -- a customer who registered on the
+ * public site -- is signed out of this sign-in, on the server as well as here, and
+ * sent to the login page, which says why. A failure to ask is not a refusal: the console opens, and every request it
+ * makes is still decided by the server.
  */
 const authGuard = () => {
     const init = inject(AppInitService);
     const store = inject(Store);
     const router = inject(Router);
-    return init.ready$.pipe(take(1), map(() => {
-        if (store.selectSnapshot(AuthState.isAuthenticated)) {
-            return true;
-        }
-        return router.createUrlTree(['/login']);
+    const consoleAccess = inject(ConsoleAccessService);
+    return init.ready$.pipe(take(1), switchMap(() => {
+        if (!store.selectSnapshot(AuthState.isAuthenticated)) {
+            return of(router.createUrlTree(['/login']));
+        }
+        return from(consoleAccess.ensure()).pipe(switchMap(access => {
+            // Signed out while asking: nobody to open the console for.
+            if (!store.selectSnapshot(AuthState.isAuthenticated)) {
+                return of(router.createUrlTree(['/login']));
+            }
+            return 'refused' !== access
+                ? of(true)
+                : consoleAccess.signOut().pipe(map(() => router.createUrlTree(['/login'], { queryParams: { reason: ConsoleAccessService.REFUSED_REASON } })));
+        }));
     }));
 };
 
@@ -1148,18 +1821,153 @@ const loginPageGuard = () => {
     }));
 };
 
+const ELEVATION_WARNING_PASSWORD_NOT_SET = 'elevation.password_not_set';
+const ELEVATION_WARNING_FACTOR_MISSING = 'elevation.factor_missing';
+const ELEVATION_WARNING_MFA_OFF = 'elevation.mfa_off';
+
+/** The refusal text the server's framework writes when no one wrote a better one. */
+const FRAMEWORK_REFUSAL = /^\s*access denied\.?\s*$/i;
+/**
+ * Converts any caught error into a human-readable message.
+ *
+ * Priority order for backend errors:
+ *   1. error.detail              (RFC 7807 problem detail)
+ *   2. error['hydra:description'] (Hydra validation errors)
+ *   3. error.message             (generic)
+ *   4. error.violations[]        (constraint violations)
+ *   5. Status-based fallback
+ */
+class ErrorHandlerService {
+    humanize(err) {
+        if (!(err instanceof HttpErrorResponse)) {
+            return err instanceof Error ? err.message : 'An unexpected error occurred.';
+        }
+        const elevationRefusal = isElevationRefusal(err);
+        const body = err.error;
+        if (body && typeof body === 'object') {
+            const detail = body['detail'] ?? body['hydra:description'] ?? body['message'];
+            // The framework's own refusal text ("Access Denied.") says nothing a person can act
+            // on, so it is replaced by the status sentence; a sentence the server wrote for the
+            // refused action ("Permission denied: cannot write '/docs/a'") is kept.
+            if (typeof detail === 'string' && detail.trim() && !FRAMEWORK_REFUSAL.test(detail)) {
+                return detail.trim();
+            }
+            if (Array.isArray(body['violations'])) {
+                const msgs = body['violations']
+                    .map(v => v.message)
+                    .filter(Boolean);
+                if (msgs.length)
+                    return msgs.join(' ');
+            }
+        }
+        return elevationRefusal ? 'This needs an elevated session.' : this.statusMessage(err.status);
+    }
+    statusMessage(status) {
+        switch (status) {
+            case 0: return 'Network error. Check your connection.';
+            case 400: return 'Invalid request.';
+            case 401: return 'Session expired. Please sign in again.';
+            case 403: return 'You don\'t have access to this.';
+            case 404: return 'Resource not found.';
+            case 409: return 'Conflict — resource already exists.';
+            case 422: return 'Validation failed.';
+            case 429: return 'Too many requests. Please wait a moment.';
+            case 500: return 'Server error. Please try again later.';
+            case 503: return 'Service unavailable. Please try again later.';
+            default: return `Unexpected error (${status}).`;
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ErrorHandlerService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ErrorHandlerService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ErrorHandlerService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/** Methods that read. A read is made by a page as it loads or by a poll, never as an action. */
+const READS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/**
+ * A refusal for want of elevation is a 403 the server stamps `X-Elevation-Required`
+ * where its gate refused a member who has not elevated ({@link isElevationRefusal}).
+ * This interceptor never opens the elevation prompt. The prompt opens only when a
+ * person asks for it: an Elevate button, or an action whose control already knows it
+ * needs elevation and offers it ({@link ElevationService.offerFor}).
+ *
+ * What it does with a stamped 403:
+ * - On a write a person made (POST, PUT, PATCH, DELETE without
+ *   {@link BACKGROUND_REQUEST}): tells {@link ELEVATION_NOTICE}, which shows the
+ *   refusal with an Elevate button. The request is not held and not repeated; the
+ *   caller receives the 403 at once, and after elevating the person repeats the action.
+ * - On a read: nothing. Reads are what a page makes as it loads and what polls make in
+ *   the background, and the page shows its own state for a refused one -- an inline
+ *   "needs an elevated session" with an Elevate button, or the feature hidden.
+ * - On a background request: nothing. Nobody is waiting on it.
+ *
+ * Until 2026-10-08 any stamped 403 opened the prompt, so the setup reads of almost every
+ * console page, and a realtime token at every load, opened it for an administrator who
+ * had not elevated: 13 of 15 pages on a menu click, 15 of 15 on a reload (measured).
+ *
+ * The elevation endpoint's own calls carry {@link BYPASS_ELEVATION}: a wrong password is a
+ * 403 and is not a refused action. A stamped 403 from anywhere but this API is ignored:
+ * the header is the server's word, and only this server's counts.
+ */
+const elevationInterceptor = (req, next) => {
+    const elevation = inject(ElevationService);
+    if (req.context.get(BYPASS_ELEVATION)
+        || req.context.get(BACKGROUND_REQUEST)
+        || READS.has(req.method.toUpperCase())
+        || !elevation.isThisApi(req.url)) {
+        return next(req);
+    }
+    const notice = inject(ELEVATION_NOTICE, { optional: true });
+    if (!notice) {
+        return next(req);
+    }
+    const errors = inject(ErrorHandlerService);
+    return next(req).pipe(tap({
+        error: (err) => {
+            if (isElevationRefusal(err)) {
+                notice.refused(errors.humanize(err));
+            }
+        },
+    }));
+};
+
 class LoginComponent {
     identifier = '';
     password = '';
-    loading = false;
-    error = null;
+    // !! SIGNALS, not fields. Angular 22 renders a component that names no change-detection
+    // strategy as OnPush (`onPush: changeDetection !== ChangeDetectionStrategy.Eager`), and
+    // this one names none. So a plain field set from an asynchronous answer -- a wrong
+    // password, or the console's refusal the guard sends back -- was set and never drawn: the
+    // page said "Signing in..." until the person typed a character, which marked the view dirty
+    // (measured in a browser on the served admin, 2026-09-28). A signal marks it dirty itself.
+    // The zone was blamed first (core-angular#21) and running the answers inside it changed
+    // nothing on the served admin: it re-ran change detection, which skipped this clean view.
+    loading = signal(false, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "loading" }] : /* istanbul ignore next */ []));
+    error = signal(null, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "error" }] : /* istanbul ignore next */ []));
     store = inject(Store);
     router = inject(Router);
+    /** Shown when the guard signed an account out because the console is not granted to it. */
+    static NO_CONSOLE_ACCESS = 'This account has no access to the console.';
+    constructor() {
+        // Observed, not read once: after a sign-in the guard's redirect lands on this same
+        // page, and the component is reused rather than made again.
+        inject(ActivatedRoute).queryParamMap.pipe(takeUntilDestroyed()).subscribe(params => {
+            if (ConsoleAccessService.REFUSED_REASON === params.get('reason')) {
+                this.loading.set(false);
+                this.error.set(LoginComponent.NO_CONSOLE_ACCESS);
+            }
+        });
+    }
     submit() {
         if (!this.identifier || !this.password)
             return;
-        this.loading = true;
-        this.error = null;
+        this.loading.set(true);
+        this.error.set(null);
         this.store.dispatch(new Login(this.identifier, this.password)).subscribe({
             next: () => {
                 // A rejected navigation used to vanish: nothing resets `loading`
@@ -1167,29 +1975,30 @@ class LoginComponent {
                 // away. If it does not, the form spins for ever with no reason
                 // given, so say so instead.
                 void this.router.navigate(['/']).catch(() => {
-                    this.loading = false;
-                    this.error = 'Signed in, but the admin could not be opened. Please reload.';
+                    this.loading.set(false);
+                    this.error.set('Signed in, but the admin could not be opened. Please reload.');
                 });
             },
             error: (err) => {
-                this.loading = false;
-                this.error = err?.error?.detail ?? err?.error?.message ?? err?.message ?? 'Invalid credentials. Please try again.';
+                this.loading.set(false);
+                this.error.set(err?.error?.detail ?? err?.error?.message ?? err?.message ?? 'Invalid credentials. Please try again.');
             },
         });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: LoginComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "22.1.3", type: LoginComponent, isStandalone: true, selector: "coolms-admin-login", ngImport: i0, template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n", dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox]):not([ngNoCva])[formControlName],textarea:not([ngNoCva])[formControlName],input:not([type=checkbox]):not([ngNoCva])[formControl],textarea:not([ngNoCva])[formControl],input:not([type=checkbox]):not([ngNoCva])[ngModel],textarea:not([ngNoCva])[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }] });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: LoginComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "22.2.1", type: LoginComponent, isStandalone: true, selector: "coolms-admin-login", ngImport: i0, template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error()\" class=\"alert alert-danger py-2 small\">{{ error() }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading() || loginForm.invalid\"\n        >\n          {{ loading() ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n", dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox]):not([ngNoCva])[formControlName],textarea:not([ngNoCva])[formControlName],input:not([type=checkbox]):not([ngNoCva])[formControl],textarea:not([ngNoCva])[formControl],input:not([type=checkbox]):not([ngNoCva])[ngModel],textarea:not([ngNoCva])[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: LoginComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: LoginComponent, decorators: [{
             type: Component,
-            args: [{ selector: 'coolms-admin-login', standalone: true, imports: [FormsModule, NgIf], template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n" }]
-        }] });
+            args: [{ selector: 'coolms-admin-login', standalone: true, imports: [FormsModule, NgIf], template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error()\" class=\"alert alert-danger py-2 small\">{{ error() }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading() || loginForm.invalid\"\n        >\n          {{ loading() ? 'Signing in\u2026' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n" }]
+        }], ctorParameters: () => [] });
 
 /**
  * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
  *
  * Responses are cached for the lifetime of the service (Map + shareReplay(1))
- * so repeated calls never re-fetch the same resource.
+ * so repeated calls never re-fetch the same resource. A failed read is dropped
+ * from the cache, so the next call asks the server again.
  *
  * configBase is read from the API manifest (manifest.configBase) and falls
  * back to '/api/v1/config' when the manifest is not yet loaded.
@@ -1211,69 +2020,21 @@ class ConfigService {
             // The config endpoint wraps the YAML payload in a `data` field:
             // { type, id, data: { ...yaml content... } }
             // Unwrap so callers always receive the config payload directly.
-            const obs = this.http.get(`${base}/${type}/${id}`).pipe(map(r => (r.data ?? r)), shareReplay(1));
+            const obs = this.http.get(`${base}/${type}/${id}`).pipe(map(r => (r.data ?? r)), 
+            // A failed read is not kept: a page that was refused for want of elevation reads
+            // again once the person elevates, and must reach the server, not this cache.
+            catchError((err) => {
+                this.cache.delete(key);
+                return throwError(() => err);
+            }), shareReplay(1));
             this.cache.set(key, obs);
         }
         return this.cache.get(key);
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ConfigService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
-/**
- * Converts any caught error into a human-readable message.
- *
- * Priority order for backend errors:
- *   1. error.detail              (RFC 7807 problem detail)
- *   2. error['hydra:description'] (Hydra validation errors)
- *   3. error.message             (generic)
- *   4. error.violations[]        (constraint violations)
- *   5. Status-based fallback
- */
-class ErrorHandlerService {
-    humanize(err) {
-        if (!(err instanceof HttpErrorResponse)) {
-            return err instanceof Error ? err.message : 'An unexpected error occurred.';
-        }
-        const body = err.error;
-        if (body && typeof body === 'object') {
-            const detail = body['detail'] ?? body['hydra:description'] ?? body['message'];
-            if (typeof detail === 'string' && detail.trim()) {
-                return detail.trim();
-            }
-            if (Array.isArray(body['violations'])) {
-                const msgs = body['violations']
-                    .map(v => v.message)
-                    .filter(Boolean);
-                if (msgs.length)
-                    return msgs.join(' ');
-            }
-        }
-        return this.statusMessage(err.status);
-    }
-    statusMessage(status) {
-        switch (status) {
-            case 0: return 'Network error. Check your connection.';
-            case 400: return 'Invalid request.';
-            case 401: return 'Session expired. Please sign in again.';
-            case 403: return 'Access denied.';
-            case 404: return 'Resource not found.';
-            case 409: return 'Conflict — resource already exists.';
-            case 422: return 'Validation failed.';
-            case 429: return 'Too many requests. Please wait a moment.';
-            case 500: return 'Server error. Please try again later.';
-            case 503: return 'Service unavailable. Please try again later.';
-            default: return `Unexpected error (${status}).`;
-        }
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConfigService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConfigService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ErrorHandlerService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConfigService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -1286,7 +2047,7 @@ const CHOICES = ['light', 'dark', 'system'];
  * the Profile -> Preferences tab already writes. This copy exists only so the
  * first paint of a reload is the right colour: the settings request is async,
  * so without it every load would start light and flip. It is deliberately NOT
- * stored via UserPreferencesService, which syncs its own bag to the server —
+ * stored via UserPreferencesService, which syncs its own bag to the server --
  * that would give one setting two server-side homes.
  */
 const CACHE_KEY = 'coolms_theme';
@@ -1294,7 +2055,7 @@ const ACCENT_CACHE_KEY = 'coolms_accent';
 /**
  * Six-digit hex only, checked again HERE even though the server already vets it
  * on write. This value is substituted into a `--cms-*` custom property,
- * and a stored setting is data from the network like any other — the write-side
+ * and a stored setting is data from the network like any other -- the write-side
  * guard protects what the admin stores, this one protects what it renders.
  */
 const HEX = /^#[0-9a-fA-F]{6}$/;
@@ -1309,7 +2070,7 @@ function isAccent(v) {
  *
  * The stylesheet does the rest: `:root[data-theme='dark']` re-points the
  * `--cms-*` palette and every colour in the admin arrives through those names.
- * Nothing here knows a single colour, which is the point — a second
+ * Nothing here knows a single colour, which is the point -- a second
  * theme is a block of tokens, not a code change.
  *
  * Follows the shape of UserCalendarPreferencesService and
@@ -1337,7 +2098,7 @@ class ThemeService {
     platformAccent = this._platformAccent.asReadonly();
     /**
      * The colour actually painted: personal override, else the deployment's,
-     * else null — which leaves the stylesheet's own accent in place.
+     * else null -- which leaves the stylesheet's own accent in place.
      *
      * Three rungs and each is a real state. A user who has chosen nothing is
      * NOT the same as one who chose the deployment's colour: clear the
@@ -1368,28 +2129,28 @@ class ThemeService {
     }
     /**
      * One-shot load of the stored preference. Safe to call more than once and
-     * safe for anonymous users — a failure leaves the cached/system value in
+     * safe for anonymous users -- a failure leaves the cached/system value in
      * place rather than forcing light, so the login screen still matches the OS.
      */
     ensureLoaded() {
         if (this.loadOnce$)
             return this.loadOnce$;
         // Read the deployment's colour FIRST and synchronously, so it is in
-        // place whether or not the settings request succeeds — an anonymous
+        // place whether or not the settings request succeeds -- an anonymous
         // visitor on the login screen still sees the deployment's brand.
         this.readPlatformAccent();
         this.loadOnce$ = this.api.getSettings().pipe(map$1(all => {
             const prefs = all['preferences'];
-            // The accent rides along on the same response — it is a field of
+            // The accent rides along on the same response -- it is a field of
             // the same section, so it costs no extra request.
             this.setAccent(isAccent(prefs?.['accentColor']) ? prefs['accentColor'] : null);
             return isChoice(prefs?.['theme']) ? prefs['theme'] : this._choice();
-        }), tap(choice => this.set(choice)), catchError$1(() => of(this._choice())), shareReplay$1({ bufferSize: 1, refCount: false }));
+        }), tap$1(choice => this.set(choice)), catchError$1(() => of(this._choice())), shareReplay$1({ bufferSize: 1, refCount: false }));
         return this.loadOnce$;
     }
     /**
      * Called by the Profile page after the Preferences tab saves, so the admin
-     * re-themes on the spot. Ignores anything that is not a known choice —
+     * re-themes on the spot. Ignores anything that is not a known choice --
      * the section PATCH returns the whole merged bag, not just this field.
      */
     update(value) {
@@ -1414,13 +2175,13 @@ class ThemeService {
         }
         catch {
             // A blocked or full localStorage costs the pre-paint hint, nothing
-            // more — the server value still arrives and applies.
+            // more -- the server value still arrives and applies.
         }
     }
     /**
      * The manifest is loaded at bootstrap, well before the authenticated shell
      * calls this, so a snapshot read is enough and no subscription is needed.
-     * A malformed value is ignored rather than applied — the container refuses
+     * A malformed value is ignored rather than applied -- the container refuses
      * to build with one, but the manifest crosses the network all the same.
      */
     readPlatformAccent() {
@@ -1441,7 +2202,7 @@ class ThemeService {
     }
     /**
      * Writes the override onto the document element, where an inline style
-     * outranks every stylesheet rule — including the dark block — so one
+     * outranks every stylesheet rule -- including the dark block -- so one
      * declaration re-points the accent in both themes.
      *
      * Only --cms-accent is set, not the -hover/-light/-text members of the
@@ -1482,10 +2243,10 @@ class ThemeService {
             return null;
         }
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ThemeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ThemeService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ThemeService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ThemeService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }], ctorParameters: () => [] });
@@ -1499,7 +2260,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImpor
  * A spinner says "something is happening" and nothing else; every product has
  * one and none of them are yours. The bang is already the one glyph in the
  * wordmark that carries the brand, so a loader built from it says whose
- * software is thinking — for free, in the place a user is already looking.
+ * software is thinking -- for free, in the place a user is already looking.
  *
  * ## Why one component rather than a snippet per surface
  *
@@ -1510,7 +2271,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImpor
  *
  * ## The animation
  *
- * The stem wipes upward and the dot lands after it, on a loop — the shape being
+ * The stem wipes upward and the dot lands after it, on a loop -- the shape being
  * WRITTEN rather than spun. It is deliberately calm: a loader is background
  * furniture, and anything with a hard beat gets irritating on the third viewing.
  * Under `prefers-reduced-motion` it holds still and only breathes, because
@@ -1531,12 +2292,12 @@ class CmsLoaderComponent {
     ...(ngDevMode ? [{ debugName: "inline" }] : /* istanbul ignore next */ []));
     /**
      * A clip-path needs a document-unique id, and this component is used more
-     * than once per page — two loaders sharing an id makes the second one clip
+     * than once per page -- two loaders sharing an id makes the second one clip
      * against the first one's rectangle and stop animating.
      */
     clipId = 'cms-loader-' + Math.random().toString(36).slice(2, 9);
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CmsLoaderComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.1.3", type: CmsLoaderComponent, isStandalone: true, selector: "cms-loader", inputs: { label: { classPropertyName: "label", publicName: "label", isSignal: true, isRequired: false, transformFunction: null }, overlay: { classPropertyName: "overlay", publicName: "overlay", isSignal: true, isRequired: false, transformFunction: null }, inline: { classPropertyName: "inline", publicName: "inline", isSignal: true, isRequired: false, transformFunction: null } }, ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: CmsLoaderComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.2.1", type: CmsLoaderComponent, isStandalone: true, selector: "cms-loader", inputs: { label: { classPropertyName: "label", publicName: "label", isSignal: true, isRequired: false, transformFunction: null }, overlay: { classPropertyName: "overlay", publicName: "overlay", isSignal: true, isRequired: false, transformFunction: null }, inline: { classPropertyName: "inline", publicName: "inline", isSignal: true, isRequired: false, transformFunction: null } }, ngImport: i0, template: `
         <div class="cms-loader"
              [class.cms-loader--overlay]="overlay()"
              [class.cms-loader--inline]="inline()"
@@ -1563,7 +2324,7 @@ class CmsLoaderComponent {
         </div>
     `, isInline: true, styles: [".cms-loader{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;padding:24px;color:var(--cms-text-muted)}.cms-loader--overlay{position:absolute;inset:0;z-index:5;background:var(--cms-surface)}.cms-loader--inline{flex-direction:row;gap:8px;padding:0}.cms-loader--inline .cms-loader__mark{width:var(--cms-loader-size, 14px)}.cms-loader__mark{width:var(--cms-loader-size, 40px);height:auto;overflow:visible}.cms-loader__ghost{fill:var(--cms-border)}.cms-loader__stem,.cms-loader__dot{fill:var(--cms-accent)}.cms-loader__wipe{animation:cms-loader-wipe 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 32px}.cms-loader__dot{animation:cms-loader-dot 1.6s cubic-bezier(.65,0,.35,1) infinite;transform-origin:12px 42px}@keyframes cms-loader-wipe{0%{transform:scaleY(0)}45%,70%{transform:scaleY(1)}to{transform:scaleY(0)}}@keyframes cms-loader-dot{0%,40%{opacity:0;transform:scale(.4)}55%,70%{opacity:1;transform:scale(1)}to{opacity:0;transform:scale(.4)}}.cms-loader__label{font-size:.8125rem}@media(prefers-reduced-motion:reduce){.cms-loader__wipe{animation:none;transform:scaleY(1)}.cms-loader__dot{animation:cms-loader-breathe 2s ease-in-out infinite;opacity:1}}@keyframes cms-loader-breathe{0%,to{opacity:.35}50%{opacity:1}}\n"], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: CmsLoaderComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: CmsLoaderComponent, decorators: [{
             type: Component,
             args: [{ selector: 'cms-loader', standalone: true, changeDetection: ChangeDetectionStrategy.OnPush, template: `
         <div class="cms-loader"
@@ -1730,10 +2491,10 @@ class SidebarStateService {
             // Non-persistence acceptable; toggle still works in-session.
         }
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: SidebarStateService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: SidebarStateService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: SidebarStateService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: SidebarStateService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -1741,7 +2502,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImpor
 /**
  * HTTP client for the Phase 2a `/api/entity-search` endpoint.
  * Returns a stream of search results for the given entity FQCN.
- * Permission filtering happens at the backend resolver layer —
+ * Permission filtering happens at the backend resolver layer --
  * this service is a thin RPC.
  */
 class EntitySearchService {
@@ -1750,7 +2511,7 @@ class EntitySearchService {
      * @param entityType  Fully-qualified PHP class name of the entity
      *                    being searched (e.g. the backend's User entity).
      * @param query       Free-text search input. Empty string is
-     *                    valid — the backend returns the default
+     *                    valid -- the backend returns the default
      *                    listing for that entity type.
      * @param limit       Max rows to return; clamped server-side to
      *                    [1, 100].
@@ -1762,10 +2523,10 @@ class EntitySearchService {
             .set('limit', String(limit));
         return this.http.get('/api/entity-search', { params });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: EntitySearchService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: EntitySearchService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: EntitySearchService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: EntitySearchService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -1802,9 +2563,9 @@ class NaviGraphService {
      * Handle a nav-node click.
      *
      * Routing logic based on meta.target:
-     *   'action.logout'  — dispatch Logout
-     *   '_blank'         — window.open (uses node.path as href)
-     *   default          — router.navigate with meta.routerLink or node.path
+     *   'action.logout'  -- dispatch Logout
+     *   '_blank'         -- window.open (uses node.path as href)
+     *   default          -- router.navigate with meta.routerLink or node.path
      */
     handleClick(node) {
         const target = node.meta.target;
@@ -1835,7 +2596,7 @@ class NaviGraphService {
     }
     /**
      * Standalone `showWhen` evaluator for callers that don't have a
-     * full `NaviGraphNode` (e.g. a grid's row context menu — a
+     * full `NaviGraphNode` (e.g. a grid's row context menu -- a
      * `rowAction.showWhen` predicate is evaluated against the row's
      * own projection). `null`/`undefined` predicates default to
      * visible, mirroring `isVisible`'s "no rule = always shown"
@@ -1870,7 +2631,7 @@ class NaviGraphService {
             case 'ne': return val !== cond['value'];
             case 'in': return Array.isArray(cond['value']) && cond['value'].includes(val);
             case 'nin': return Array.isArray(cond['value']) && !cond['value'].includes(val);
-            // Prefix match for strings — primary use case is filtering
+            // Prefix match for strings -- primary use case is filtering
             // actions by MIME-type major (e.g., "image/" matches all
             // image MIMEs without enumerating each subtype).
             case 'startsWith':
@@ -1930,10 +2691,10 @@ class NaviGraphService {
         sort(roots);
         return roots;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: NaviGraphService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: NaviGraphService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: NaviGraphService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: NaviGraphService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -1947,10 +2708,10 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImpor
  * Backed by a static Map so components registered at module load time
  * (e.g. in app.config.ts) are visible to all injected instances.
  *
- * Usage — static (app.config.ts / bootstrap time):
+ * Usage -- static (app.config.ts / bootstrap time):
  *   ComponentRegistry.register('MediaLibraryPage', MediaLibraryPage);
  *
- * Usage — injected (SlotComponent / runtime):
+ * Usage -- injected (SlotComponent / runtime):
  *   private readonly registry = inject(ComponentRegistry);
  *   const cls = this.registry.get('MediaLibraryPage');
  */
@@ -1982,14 +2743,258 @@ class ComponentRegistry {
     keys() {
         return ComponentRegistry.keys();
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ComponentRegistry, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ComponentRegistry, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.3", ngImport: i0, type: ComponentRegistry, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ComponentRegistry, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
 
+/**
+ * `console` -- the administration host contract (the platform rule: hosts implement contracts, modules offer entries).
+ *
+ * A module contributes to the console with ONE object, its entry: data the
+ * host reads, never a call the module makes into the host. Six lists, each
+ * optional; an absent list means "nothing here", never an error. The host
+ * assembles the entries (build time today, install time under federation),
+ * refuses collisions by name, and activates only the modules the backend's
+ * manifest says are installed.
+ *
+ * The version is MAJOR.MINOR: a minor adds an optional list or field, a major
+ * changes or removes one. An entry declares the range it was written for
+ * (`^1.2` -- major 1, minor at least 2), checked at build against this
+ * constant and at install against the theme's declaration.
+ */
+const CONSOLE_CONTRACT = { name: 'console', version: '1.0' };
+function isPortProvision(p) {
+    return typeof p === 'object' && 'port' in p && 'useExisting' in p;
+}
+/** The identity function with the type: an entry file exports data, nothing runs. */
+function consoleEntry(entry) {
+    return entry;
+}
+/** MAJOR.MINOR, both non-negative integers. */
+const VERSION = /^(\d+)\.(\d+)$/;
+/** `^MAJOR.MINOR` -- the caret is required: an entry names what it needs, never a bare number. */
+const RANGE = /^\^(\d+)\.(\d+)$/;
+/**
+ * Whether a caret range over MAJOR.MINOR admits a version: same major, minor
+ * at least the range's. Malformed input admits nothing -- a range that cannot
+ * be read must refuse, never pass.
+ */
+function satisfiesRange(range, version) {
+    const r = RANGE.exec(range);
+    const v = VERSION.exec(version);
+    if (!r || !v)
+        return false;
+    return Number(r[1]) === Number(v[1]) && Number(v[2]) >= Number(r[2]);
+}
+/** The refusal an assembly raises: one message per collision, all of them, by name. */
+class ConsoleAssemblyError extends Error {
+    problems;
+    constructor(problems) {
+        super(`console assembly refused:\n  ${problems.join('\n  ')}`);
+        this.problems = problems;
+        this.name = 'ConsoleAssemblyError';
+    }
+}
+/**
+ * The checks every assembly runs, in one place so the build-time spec, the
+ * bootstrap and a future install-time loader agree: entry ranges against
+ * this contract, and the collision rules of the six lists. Returns the
+ * entries unchanged when nothing is wrong.
+ */
+function assembleConsole(entries) {
+    const problems = [];
+    const seenModules = new Map();
+    const paths = new Map();
+    const bindings = new Map();
+    const topbar = new Map();
+    const overlays = new Map();
+    const panels = new Map();
+    const states = new Map();
+    const ports = new Map();
+    const claim = (map, key, owner, what) => {
+        const prev = map.get(key);
+        if (prev !== undefined && prev !== owner) {
+            problems.push(`${what} '${String(key)}' is claimed by modules '${prev}' and '${owner}'`);
+        }
+        else {
+            map.set(key, owner);
+        }
+    };
+    for (const e of entries) {
+        if (!satisfiesRange(e.range, CONSOLE_CONTRACT.version)) {
+            problems.push(`module '${e.module}' offers console ${e.range}; this host implements console ${CONSOLE_CONTRACT.version} -- refused`);
+        }
+        seenModules.set(e.module, (seenModules.get(e.module) ?? 0) + 1);
+        for (const r of e.routes ?? [])
+            claim(paths, r.path, e.module, 'route path');
+        for (const b of e.bindings ?? [])
+            claim(bindings, b.name, e.module, 'binding');
+        for (const t of e.topbar ?? [])
+            claim(topbar, t.id, e.module, 'top-bar item');
+        for (const o of e.overlays ?? [])
+            claim(overlays, o.id, e.module, 'overlay');
+        for (const p of e.panels ?? [])
+            claim(panels, p.id, e.module, 'panel');
+        for (const s of e.states ?? [])
+            claim(states, s, e.module, 'state');
+        for (const p of e.providers ?? []) {
+            if (isPortProvision(p))
+                claim(ports, p.port, e.module, 'port');
+        }
+    }
+    for (const [module, n] of seenModules) {
+        if (n > 1)
+            problems.push(`module '${module}' has ${n} entries; one entry per module`);
+    }
+    if (problems.length)
+        throw new ConsoleAssemblyError(problems);
+    return entries;
+}
+
+/**
+ * The host side of `console@1`: what a theme calls to turn the assembled
+ * entries into routes, providers and the lists its shell renders.
+ *
+ * Activation is the backend's: `GET /app-config` carries `ui.modules`, the
+ * modules whose console entry the installer matched against the theme's
+ * declaration. A module in the bundle but not in that list is dormant -- no
+ * route matches, no tile, no overlay; a module in the list but not in the
+ * bundle is reported by name ({@link ConsoleActivation.missing}), never
+ * silently absent.
+ */
+/** Every entry this build assembled, after {@link assembleConsole}'s checks. */
+const CONSOLE_ENTRIES = new InjectionToken('coolms.console.entries');
+/**
+ * The port a dock panel talks back through: the layout provides one per
+ * panel it mounts, so the panel never needs an output the slot cannot carry.
+ */
+class ConsolePanelHost {
+}
+/** The console modules the manifest says are installed here. */
+function installedConsoleModules(manifest) {
+    return new Set((manifest?.ui?.modules ?? [])
+        .filter(m => m.contract === CONSOLE_CONTRACT.name)
+        .map(m => m.module));
+}
+class ConsoleActivation {
+    entries = inject(CONSOLE_ENTRIES, { optional: true }) ?? [];
+    manifest = inject(Store).selectSignal(AppConfigState.manifest);
+    installed = computed(() => installedConsoleModules(this.manifest()), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "installed" }] : /* istanbul ignore next */ []));
+    /** The entries of installed modules, in assembly order. */
+    active = computed(() => this.entries.filter(e => this.installed().has(e.module)), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "active" }] : /* istanbul ignore next */ []));
+    topbar = computed(() => this.active().flatMap(e => e.topbar ?? [])
+        .slice()
+        .sort((a, b) => a.order - b.order || a.id.localeCompare(b.id)), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "topbar" }] : /* istanbul ignore next */ []));
+    overlays = computed(() => this.active().flatMap(e => e.overlays ?? []), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "overlays" }] : /* istanbul ignore next */ []));
+    panels = computed(() => this.active().flatMap(e => e.panels ?? []), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "panels" }] : /* istanbul ignore next */ []));
+    /** Modules the manifest names that this build has no entry for: what a diagnostics page shows by name. */
+    missing = computed(() => [...this.installed()].filter(m => !this.entries.some(e => e.module === m)).sort(), /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "missing" }] : /* istanbul ignore next */ []));
+    isInstalled(module) {
+        return this.installed().has(module);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConsoleActivation, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConsoleActivation, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.2.1", ngImport: i0, type: ConsoleActivation, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+/**
+ * `canMatch` for a module's mount: the route exists only where the module is
+ * installed. Answered once the manifest is in: on a cold deep link the router
+ * recognises the URL while the initializer is still fetching `/theme/config`
+ * (the two run as parallel initializers), and a synchronous read then found
+ * no module installed, so every pasted module URL fell to the wildcard and
+ * landed on the dashboard (measured 2026-09-22: no chunk requested for the
+ * mount, the dashboard's instead). `ready$` is what the auth guard waits on
+ * too, and it fires whether or not the config fetch succeeded.
+ *
+ * !! Then the console's own manifest, when someone is signed in: `ui.modules` is
+ * the console's, not the public config's, and arrives with it
+ * ({@link ConsoleAccessService}). canMatch runs before the layout's auth guard,
+ * which asks the same question, so answering from the public config alone said
+ * "no" to every module once that config stopped carrying them. Nobody signed in:
+ * nothing is asked, the answer is the public config's, and the layout's guard
+ * sends the person to sign in. A refusal merges nothing, so the answer is no.
+ */
+function consoleModuleInstalled(module) {
+    return () => {
+        const activation = inject(ConsoleActivation);
+        const consoleAccess = inject(ConsoleAccessService);
+        return inject(AppInitService).ready$.pipe(take(1), switchMap(() => from(consoleAccess.ensure())), map(() => activation.isInstalled(module)));
+    };
+}
+/**
+ * The children a theme mounts under its authenticated layout for the
+ * assembled entries: one `Route` per mount, lazy as written, `data` from the
+ * entry's nav hint, `canMatch` from the manifest. The theme keeps its own
+ * shape around them (login, the layout, `canActivate: [authGuard]`, the
+ * wildcard).
+ */
+function consoleChildren(entries) {
+    const routes = [];
+    for (const e of assembleConsole(entries)) {
+        for (const m of e.routes ?? []) {
+            if ('redirectTo' in m) {
+                routes.push({ path: m.path, redirectTo: m.redirectTo, pathMatch: 'full' });
+                continue;
+            }
+            const route = {
+                path: m.path,
+                canMatch: [consoleModuleInstalled(e.module)],
+                ...(m.nav ? { data: { ...m.nav } } : {}),
+                ...(m.providers ? { providers: [...m.providers] } : {}),
+            };
+            if ('children' in m) {
+                route.loadChildren = m.children;
+            }
+            else {
+                route.loadComponent = m.component;
+            }
+            routes.push(route);
+        }
+    }
+    return routes;
+}
+/**
+ * The providers a theme adds for the assembled entries: the store with the
+ * host's states and every module state, the registry bindings (an
+ * initializer, so they exist before the first render), every module
+ * provision, and {@link CONSOLE_ENTRIES} for the shell. Place it AFTER the
+ * library providers a module's provisions extend (the editor bridge, the
+ * PDF viewer), as the hand-written lines were.
+ */
+function provideConsole(entries, options) {
+    const checked = assembleConsole(entries);
+    const providers = [
+        { provide: CONSOLE_ENTRIES, useValue: checked },
+        provideStore([...options.hostStates, ...checked.flatMap(e => e.states ?? [])]),
+        provideAppInitializer(() => {
+            const registry = inject(ComponentRegistry);
+            for (const e of checked) {
+                for (const b of e.bindings ?? [])
+                    registry.register(b.name, b.component);
+            }
+        }),
+    ];
+    for (const e of checked) {
+        for (const p of e.providers ?? []) {
+            providers.push(isPortProvision(p) ? { provide: p.port, useExisting: p.useExisting } : p);
+        }
+    }
+    return makeEnvironmentProviders(providers);
+}
+
 /**
  * Optional by design: an application assembled without a Sections module binds
  * nothing and simply sends no `X-CoolMS-Section` header, which is exactly what
@@ -2081,5 +3086,5 @@ function shouldStamp(url) {
  * Generated bundle index. Do not edit.
  */
 
-export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, CrossTabAuthSyncService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, authGuard, authInterceptor, loginPageGuard, resolvePattern, sectionInterceptor };
+export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BACKGROUND_REQUEST, BYPASS_AUTH, BYPASS_ELEVATION, CONSOLE_CONTRACT, CONSOLE_ENTRIES, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, ConsoleAccessService, ConsoleActivation, ConsoleAssemblyError, ConsolePanelHost, CrossTabAuthSyncService, ELEVATION_NOTICE, ELEVATION_PROMPT, ELEVATION_REQUIRED_HEADER, ELEVATION_WARNING_FACTOR_MISSING, ELEVATION_WARNING_MFA_OFF, ELEVATION_WARNING_PASSWORD_NOT_SET, ElevationService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, assembleConsole, authGuard, authInterceptor, consoleChildren, consoleEntry, consoleModuleInstalled, elevationInterceptor, installedConsoleModules, isElevationRefusal, isPortProvision, loginPageGuard, provideConsole, resolvePattern, satisfiesRange, sectionInterceptor };
 //# sourceMappingURL=coolms-core-angular.mjs.map