@coolms/core-angular 2.0.0-alpha.3 → 2.0.0-alpha.5

package/types/coolms-core-angular.d.ts

@@ -1,9 +1,9 @@
 import * as rxjs from 'rxjs';
-import { Observable } from 'rxjs';
+import { Observable, Subject } from 'rxjs';
 import * as i0 from '@angular/core';
-import { Type, InjectionToken } from '@angular/core';
+import { InjectionToken, Type, Provider, EnvironmentProviders } from '@angular/core';
 import { StateContext } from '@ngxs/store';
-import { CanActivateFn } from '@angular/router';
+import { CanActivateFn, Routes, CanMatchFn } from '@angular/router';
 import { HttpContextToken, HttpInterceptorFn } from '@angular/common/http';
 
 interface AuthApiManifest {
@@ -79,6 +79,44 @@ interface VfsApiManifest {
  */
 interface DocumentApiManifest {
     readonly spacesUrl?: string;
+    /**
+     * !! Carried here rather than derived from `spacesUrl`. Concatenating
+     * `/available` onto that would couple the client to a URL shape the router
+     * owns, and it would keep working until the route moved -- then fail as a
+     * 404 the UI reports as "no sites available", which is indistinguishable
+     * from the true empty answer.
+     *
+     * !! ABSENT ARRIVES AS `''`, NOT `undefined`. The producer declares these
+     * as non-nullable strings defaulting to empty, so an installation that has
+     * not set them sends an empty string and the `?` here never fires.
+     *
+     * Guard on FALSINESS -- `!url`, `Boolean(url)`. The dangerous rewrite is
+     * `url === undefined` (or `!== undefined`), which reads as more precise and
+     * treats `''` as present, handing a caller a request to the empty string.
+     *
+     * !! A `?? fallback` is NOT the hazard, though it looks like the obvious
+     * one: `'' ?? x` is `''`, so a fallback never fires on the value this
+     * producer actually sends. Measured by mutation -- adding one changed
+     * nothing, changing the guard broke three assertions.
+     */
+    readonly spacesAvailableUrl?: string;
+    readonly spaceEnablementUrl?: string;
+    /**
+     * FQCN of the entity a filter-mode audience can be built from.
+     *
+     * !! The SERVER owns this and the client must not know it. The generation
+     * wizard offers Filter mode only when a template's context schema
+     * references this type, and it used to compare against a constant compiled
+     * into this bundle -- which shipped the consuming application's class name
+     * inside a published package, and tied that package to an installation
+     * having that exact class.
+     *
+     * !! Absent arrives as `''`, like the urls above. Treat empty as **filter
+     * mode unavailable**, never as a reason to fall back to a remembered
+     * value: the server is the thing that rejects every other type, so a guess
+     * here offers a mode the server will refuse.
+     */
+    readonly filterAudienceEntity?: string;
 }
 interface DynamicEntityApiManifest {
     readonly typesUrl: string;
@@ -116,6 +154,13 @@ interface IdentityApiManifest {
     readonly settingsSectionUrl: string;
     readonly colorUrl: string;
     readonly rolesUrl?: string;
+    readonly elevationUrl?: string;
+    readonly deletionsUrl?: string;
+    readonly footprintsUrl?: string;
+    readonly userDeletionUrl?: string;
+    readonly userLegalHoldsUrl?: string;
+    readonly holdsSettingsBlock?: string;
+    readonly legalHoldFormId?: string | null;
 }
 /**
  * Editor sub-manifest emitted by the backend's Editor module. The
@@ -153,7 +198,7 @@ interface EditorApiManifest {
  * Viewer manifest emitted by the backend's Document module.
  * Each viewer declares the MIME types / extensions it handles, the
  * Angular component selector to dispatch into, and one config blob per
- * profile. Profile config is open-ended — every viewer interprets the
+ * profile. Profile config is open-ended -- every viewer interprets the
  * keys it understands and ignores the rest.
  */
 interface ViewerProfileApiManifest {
@@ -190,8 +235,29 @@ interface PlatformDefaults {
      */
     readonly accentColor?: string | null;
 }
+/**
+ * The host contracts in force here (the platform rule: hosts implement
+ * contracts, modules offer entries): for each contract, what the one
+ * installed theme implementing it declares, and the installed modules whose
+ * entries the installer matched against it. A host mounts a module only when
+ * it is listed.
+ */
+interface UiApiManifest {
+    /** The contracts in force, name -> MAJOR.MINOR (`{ console: '1.0' }`): one installed theme implements each. */
+    readonly contracts: Readonly<Record<string, string>>;
+    /** Which installed theme implements each contract, name -> theme slug. */
+    readonly hosts?: Readonly<Record<string, string>>;
+    readonly modules: ReadonlyArray<UiModuleEntryManifest>;
+}
+interface UiModuleEntryManifest {
+    readonly module: string;
+    readonly contract: string;
+    readonly range: string;
+    readonly framework: string;
+}
 interface ApiManifest {
     readonly apiBase: string;
+    readonly ui?: UiApiManifest;
     readonly configBase?: string;
     readonly auth?: AuthApiManifest;
     readonly identity?: IdentityApiManifest;
@@ -213,6 +279,15 @@ interface ApiManifest {
     }>;
     readonly platformDefaults?: PlatformDefaults;
 }
+/**
+ * GET /api/v1/admin/manifest -- the admin's endpoint map, answered to every signed-in account
+ * since 2026-10-06 (no host groups: each call it names is decided by its own route). A server
+ * from before that answers at /api/v1/console/manifest, to the console group only. Read once
+ * signed in.
+ */
+interface ConsoleManifestResponse {
+    readonly manifest: ApiManifest;
+}
 interface ThemeConfigResponse {
     readonly slug?: string | null;
     readonly feStack?: string | null;
@@ -357,7 +432,7 @@ interface LayoutNode {
 }
 type FormActionType = 'submit' | 'button' | 'reset';
 type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
-/** Terminal form button (Submit / Cancel / …) — mirrors PHP FormAction.
+/** Terminal form button (Submit / Cancel / ...) -- mirrors PHP FormAction.
  *  Resolved by the backend (declared `formOptions.actions`, else lifted from
  *  legacy submit fields, else a default Submit). `label` is already translated. */
 interface FormAction {
@@ -434,7 +509,7 @@ declare class IdentityApiClient {
     me(): Observable<UserDto>;
     getSettings(): Observable<Record<string, Record<string, unknown>>>;
     static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<IdentityApiClient>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -446,6 +521,13 @@ interface CentrifugoConnectionTokenDto {
     expiresAt: number;
     ttl: number;
     wsUrl: string;
+    /**
+     * The code the server closes this connection with when the caller's session
+     * ended (a sign-out everywhere, a password change, a deactivation). On it the
+     * client signs out and ends its calls at once, without reconnecting or waiting
+     * for a 401 (2026-09-26). Absent from a server older than that.
+     */
+    sessionEndedCode?: number;
 }
 /**
  * Response of `POST /centrifugo/subscription-token`: a per-channel JWT. The
@@ -471,15 +553,33 @@ interface CentrifugoSubscriptionTokenDto {
  *
  * `ApiService` keeps its identical signatures and delegates here, so nothing
  * calling it had to change.
+ *
+ * !! Access first, then realtime (Dmitry, 2026-09-28): "The console opens a realtime
+ * connection before the access check. Reverse the order ... A refused account opens no
+ * socket." The socket cannot open without the connection token, and anything may ask for
+ * one early -- the ring subscription is built at app init and asks as soon as a user is
+ * set, before the guard's answer is in. So the token waits for the console's answer (the
+ * guard's own request, not a second one) and a refused sign-in gets none: no request, no
+ * socket. A failure to ask is not a refusal, as at the guard.
+ *
+ * Since 2026-10-06 the connection token is every signed-in account's (Dmitry: "The connection
+ * token only opens a socket; each channel is authorized when it is subscribed to"), and a
+ * current server answers the admin manifest to every signed-in account, so no
+ * sign-in is refused and every one gets its token; each subscription is then decided by its
+ * channel. The wait stays for a server from before that, where a refused sign-in still opens
+ * no socket.
  */
 declare class RealtimeTokenClient {
+    /** The error a refused sign-in's connection-token request ends with. */
+    static readonly REFUSED = "no console access: no realtime connection";
     private readonly http;
     private readonly store;
+    private readonly injector;
     private get manifest();
     connectionToken(): Observable<CentrifugoConnectionTokenDto>;
     subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
     static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<RealtimeTokenClient>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 declare class Login {
@@ -533,7 +633,7 @@ declare class AuthState {
     static expiresAt(state: AuthStateModel): string | null;
     static currentUser(state: AuthStateModel): UserDto | null;
     static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AuthState>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -541,10 +641,16 @@ declare class AuthState {
  *
  * The guard is intentionally ASYNC: it waits for AppInitService.ready$ before
  * evaluating auth state.  Without this, Angular's router can evaluate
- * isAuthenticated while APP_INITIALIZER is still in-flight — RestoreSession
+ * isAuthenticated while APP_INITIALIZER is still in-flight -- RestoreSession
  * will have placed a non-null (but expired) token in state, causing the guard
  * to pass even though the subsequent config/refresh requests will fail and
  * dispatch Logout.  Waiting for ready$ guarantees the auth state is settled.
+ *
+ * Signed in is not enough: the console is granted, and the server says to whom
+ * (ConsoleAccessService). An account it refuses -- a customer who registered on the
+ * public site -- is signed out of this sign-in, on the server as well as here, and
+ * sent to the login page, which says why. A failure to ask is not a refusal: the console opens, and every request it
+ * makes is still decided by the server.
  */
 declare const authGuard: CanActivateFn;
 
@@ -591,6 +697,26 @@ declare const authInterceptor: HttpInterceptorFn;
  * (real auth failure). Transient errors (network blips, 5xx,
  * CORS, timeouts) propagate without clearing the session so a
  * momentary refresh failure does not kill a valid login.
+ *
+ * A token the server REFUSED (2026-09-26). A caller answering a 401
+ * passes the access token that was refused. Until then the lock body
+ * handed back the cached token whenever its expiry looked fresh --
+ * which a revoked token's does: a session ended on the server (a
+ * sign-out everywhere from another device, a password change) was
+ * retried with the same dead token and never refreshed, so the client
+ * stayed signed in, and in its calls, until the token neared expiry
+ * (measured: a 1:1 call kept for the whole 30 s window, every request
+ * answered 401). Now the lock body re-reads the SHARED copy
+ * (`localStorage`, which every tab's `SetTokens` writes synchronously;
+ * this tab's state only follows a sibling's write when its `storage`
+ * event arrives):
+ *   - a different access token there -> another tab (or an earlier
+ *     refresh here) already rotated past the refused one: use it, no
+ *     request;
+ *   - the same one -> the server refused this token: refresh, with the
+ *     newest refresh token -- the shared one, so a rotation a sibling
+ *     made is never replayed with the token it consumed. A 401 there
+ *     is the session's end: `Logout`.
  */
 declare class AuthRefreshCoordinator {
     private readonly api;
@@ -601,10 +727,16 @@ declare class AuthRefreshCoordinator {
      * Return the in-flight refresh Observable, or spawn a new one
      * with the supplied refresh-token value.
      *
+     * `refusedAccessToken`: the access token the server just answered
+     * 401 to, when the caller is answering one. With it, the lock body
+     * refreshes unless the shared copy already holds another token;
+     * without it (a preemptive refresh), a fresh-looking cached token
+     * is handed back as before.
+     *
      * Callers subscribe via `switchMap` / `firstValueFrom` to retry
      * their original request with the resolved access token.
      */
-    refresh(refreshToken: string): Observable<string>;
+    refresh(refreshToken: string, refusedAccessToken?: string | null): Observable<string>;
     /**
      * Run the refresh body inside `navigator.locks` when the API is
      * available; degrade to direct invocation otherwise. The lock
@@ -613,22 +745,34 @@ declare class AuthRefreshCoordinator {
      */
     private refreshWithCrossTabLock;
     /**
-     * Lock body. Re-reads `AuthState.expiresAt` first: if another
-     * tab published fresh tokens while we were queued, return the
-     * cached access token directly. Otherwise read the latest
-     * refresh-token value from state (it may have rotated while we
-     * waited) and issue the HTTP refresh.
+     * Lock body. Re-reads the shared copy first (see the class note).
+     *
+     * Answering a refusal: a shared access token other than the refused
+     * one is a rotation already made -- taken, and mirrored into this
+     * tab's state if its `storage` event has not arrived yet. Otherwise,
+     * or for a preemptive caller whose cached token no longer looks
+     * fresh, the HTTP refresh, with the newest refresh token: shared,
+     * then state, then the caller's.
      */
     private executeRefresh;
     /**
-     * Return the cached access token when `AuthState.expiresAt` has
-     * more than `FRESH_TOKEN_GRACE_MS` milliseconds remaining --
-     * signalling that some other tab refreshed for us. Null
-     * otherwise.
+     * The session as the tabs share it, or null when there is none to
+     * read: no storage, nothing stored (signed out), or a value that is
+     * not a complete token set.
+     */
+    private readShared;
+    /**
+     * For a preemptive caller only: return the current access token when
+     * its expiry is more than `FRESH_TOKEN_GRACE_MS` milliseconds away --
+     * signalling that some other tab refreshed for us. The shared copy
+     * first, which a sibling's rotation reaches before this tab's state
+     * does (mirrored here when it is newer); this tab's state when there
+     * is none. Null otherwise. Never asked for a token the server
+     * refused: a refused token's expiry looks just as fresh.
      */
     private tryConsumeFreshState;
     static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AuthRefreshCoordinator>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -661,16 +805,366 @@ declare class CrossTabAuthSyncService {
     start(): void;
     private readonly handleStorageEvent;
     static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<CrossTabAuthSyncService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
+/**
+ * The elevation state of the signed-in session: the wire shape of
+ * `GET /auth/elevation`, returned again by `POST` on a grant.
+ *
+ * Elevation is state, not a role. It lasts a fixed time from the grant, ends
+ * when the admin panel is closed or reloaded, and the client derives nothing
+ * about it from mode bits or membership: this record and the node resource's
+ * capability flags are the two readings of ONE server-side decision, and the
+ * client keeps no third.
+ */
+interface ElevationState {
+    /** Whether this session is elevated right now. */
+    elevated: boolean;
+    /** When the current elevation ends (ISO 8601); absent or null when not elevated. */
+    expiresAt?: string | null;
+    /** When the current elevation was granted (ISO 8601); absent or null when not elevated. */
+    grantedAt?: string | null;
+    /** How the LAST elevation of this session ended. Rendered by the prompt before it asks. */
+    ended: ElevationEnded;
+    /** The lifetime a grant made now would get, in seconds (the setting, clamped to the ceiling). */
+    lifetimeSeconds: number;
+    /** The most any elevation can last, fixed in code. */
+    lifetimeCeilingSeconds: number;
+    /** Whether the CURRENT elevation was confirmed by a second factor; absent or null when not elevated. */
+    factorConfirmed?: boolean | null;
+    /** Whether a grant made now must carry a code from the person's own authenticator. */
+    mfaRequired: boolean;
+    /** What the prompt shows before asking; two of the codes mean this account cannot elevate yet. */
+    warnings: ElevationWarning[];
+}
+/**
+ * `closed` is the beacon (the panel was closed or reloaded), `dropped_by_user`
+ * the explicit drop, `refresh_from_other_pair` the server's refresh tripwire,
+ * `never` a session that has not elevated yet.
+ */
+type ElevationEndedReason = 'expired' | 'closed' | 'dropped_by_user' | 'refresh_from_other_pair' | 'never';
+interface ElevationEnded {
+    reason: ElevationEndedReason;
+    /** ISO 8601, null for `never`. */
+    at: string | null;
+}
+/**
+ * `elevation.password_not_set` and `elevation.factor_missing` mean this
+ * account cannot elevate (it has no password, or no confirmed factor, of its
+ * own) and the message says which;
+ * `elevation.mfa_off` is the recommendation carried while the switch is off.
+ */
+interface ElevationWarning {
+    /** The three the server documents today; the client renders any it does not know as text. */
+    code: string;
+    message: string;
+}
+declare const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
+declare const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
+declare const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
+/** Why the elevation of a session changed, for whoever refetches on it. */
+type ElevationChangeKind = 'granted' | 'dropped' | 'expired' | 'observed';
+interface ElevationChange {
+    kind: ElevationChangeKind;
+    state: ElevationState;
+}
+/** The two reasons the client sends when it drops an elevation itself. */
+type ElevationDropReason = 'dropped_by_user' | 'closed';
+
+/**
+ * What the elevation prompt is told when it opens.
+ *
+ * `state` is the server's answer at the moment of asking -- `ended.reason` is
+ * rendered first (a person asked for a password again after F5
+ * with no explanation reads it as a fault), `warnings` may say this
+ * account cannot elevate yet, `mfaRequired` decides whether a code field
+ * shows from the start.
+ *
+ * `refusal` is the server's own sentence for the action that was refused
+ * ("Permission denied: cannot write '/docs/...'"), when a 403 opened the
+ * prompt; absent when a disabled control offered elevation instead.
+ */
+interface ElevationPromptRequest {
+    state: ElevationState;
+    refusal?: string;
+}
+/**
+ * The prompt itself is a dialog, and dialogs are the kit's -- a layer above
+ * this one. Core owns the state, the interceptor and the decision to ask; the
+ * application binds this port to whatever renders the question. Same shape as
+ * `CURRENT_SECTION`: core declares the little it needs, the composition root
+ * provides it.
+ *
+ * Resolves to true when the session is elevated by the time the dialog closes,
+ * false when the person declined or could not. The port does not retry the
+ * refused action; the interceptor does, on true.
+ */
+interface ElevationPromptPort {
+    open(request: ElevationPromptRequest): Observable<boolean>;
 }
+/**
+ * Optional by design: with nothing bound, a 403 stays a 403 and the state
+ * service still answers -- an application without an admin panel has no
+ * prompt to show and loses nothing.
+ */
+declare const ELEVATION_PROMPT: InjectionToken<ElevationPromptPort>;
+/**
+ * Told when an action a person took was refused for want of elevation: a
+ * write (not a read, not a background request) answered by a stamped 403.
+ *
+ * It must not open the prompt. The prompt opens only when the person asks for
+ * it -- the application shows the refusal and offers elevation as something to
+ * click (a notice with an Elevate button), and the click is what calls
+ * {@link ElevationService.offerFor}. A refused action is not repeated by
+ * itself after a grant: the person repeats it.
+ *
+ * `refusal` is the server's sentence for the refused action, already made
+ * readable by the error service.
+ */
+interface ElevationNoticePort {
+    refused(refusal: string): void;
+}
+/** Optional, like {@link ELEVATION_PROMPT}: with nothing bound, a refusal is only a 403. */
+declare const ELEVATION_NOTICE: InjectionToken<ElevationNoticePort>;
+
+/**
+ * Set on a request that must never open the elevation prompt: the elevation
+ * endpoint's own calls (a wrong password is a 403 and is not a refused action),
+ * and any caller that would rather receive its 403 and decide for itself.
+ */
+declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
+/**
+ * The elevation state of this session, read from ONE place: the server.
+ *
+ * The elevation client requirement, in one service. The state endpoint is the only
+ * source -- `elevated`, `expiresAt`, how the last elevation ended -- and every
+ * change of it is announced on `changes$` so the Explorer listing can refetch
+ * (its capability flags are the server's reading of the same state, computed
+ * when the listing was fetched, and a `write: true` fetched while elevated
+ * must not outlive the elevation).
+ *
+ * **Expiry is driven by the READ, not by a timer.** An elevation ends because
+ * time passed, and time is not an event; a client that waits to be told has
+ * nothing to wait for when the machine was asleep at the moment. So `state()`
+ * does the arithmetic every time it is asked, and an answer whose `expiresAt`
+ * has gone by reports expired without a request. The timer below still fires
+ * at `expiresAt` and the tab still re-asks when it comes back into view -- both
+ * are how the SERVER's answer is refreshed, which is a different thing from
+ * knowing this one has run out.
+ *
+ * This is not a second decider. The server said "elevated until T"; after T,
+ * continuing to report `elevated: true` asserts something it never said.
+ *
+ * The prompt is not here: dialogs are the kit's, a layer above core. The
+ * service asks the `ELEVATION_PROMPT` port and shares ONE in-flight prompt, so
+ * a burst of refused requests (a multi-select delete is one 403 per node)
+ * opens one dialog and every caller waits on the same answer.
+ */
+/**
+ * The header a 403 refused for want of elevation carries, with the gate's name
+ * as its value. The server stamps it where the gate refused; the interceptor
+ * prompts on it and on nothing else. There is no list of gated URLs on this
+ * side any more: the one that stood here lagged the server by every route
+ * whose refusal came from the VFS permission service under another module's
+ * path (media, document and word templates, content distribution).
+ */
+declare const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
+/**
+ * Set on a request no person asked for: a realtime token, a preferences sync, a
+ * poll. Its refusal is never announced -- not by a dialog and not by a notice --
+ * because nobody is waiting on it and nobody can act on it. The caller still
+ * receives the 403 and decides what its own state shows.
+ */
+declare const BACKGROUND_REQUEST: HttpContextToken<boolean>;
+/**
+ * Whether a failed request was refused for want of elevation: a 403 carrying
+ * the server's stamp. The one test every reader of a refusal uses -- the
+ * interceptor, a page's inline state, the error text -- so they cannot disagree.
+ */
+declare function isElevationRefusal(err: unknown): boolean;
+declare class ElevationService {
+    private readonly http;
+    private readonly store;
+    private readonly prompt;
+    private readonly destroyRef;
+    /** The last answer the server gave, exactly as it gave it. */
+    private readonly served;
+    /**
+     * The state as it stands NOW; null until the first read from the server.
+     *
+     * Deliberately NOT a `computed`. A cached derivation is only recomputed
+     * when one of its dependencies changes, and nothing changes when an
+     * elevation simply runs out -- so it would keep answering `elevated: true`
+     * past the moment the server itself named, for as long as the machine
+     * happened to be asleep.
+     *
+     * Reading past `expiresAt` also demotes the STORED answer. The value
+     * returned here is already correct without that write; the write is only
+     * how cached readers (a `computed`, an OnPush template) find out.
+     */
+    readonly state: () => ElevationState | null;
+    /** Convenience over `state`: false until the server has said otherwise. */
+    readonly elevated: () => boolean;
+    /** `expiresAt` as a Date, null when not elevated. */
+    readonly expiresAt: () => Date | null;
+    /**
+     * Every change of elevation state: a grant, a drop (by this person, by the
+     * beacon, by the tripwire), an expiry, or an observed change of a live
+     * grant's `expiresAt`. A refresh that reports the same state emits nothing,
+     * so subscribers that refetch a listing on it never refetch for no reason.
+     */
+    readonly changes$: Subject<ElevationChange>;
+    private expiryTimer;
+    private pendingPrompt;
+    private expiryAnnouncePending;
+    private lastReconcileAt;
+    constructor();
+    /** The manifest carries the URL; without it the service is inert, not broken. */
+    get available(): boolean;
+    private get url();
+    /**
+     * Whether a URL belongs to THIS API: a relative one under the manifest's
+     * `apiBase`, or an absolute one on this origin under it. The interceptor
+     * acts on a stamped refusal from here and from nowhere else -- a third
+     * party answering 403 with a header of the same name is not an invitation
+     * to elevate this session.
+     */
+    isThisApi(url: string): boolean;
+    /** Ask the server. Applies the answer and announces it when it differs. */
+    refresh(): Observable<ElevationState>;
+    /**
+     * Elevate with the person's own password and, when the switch is on, a
+     * code from their own authenticator. Errors are the dialog's to branch on:
+     * 403 not a member of the admin group, wrong password, or wrong / replayed
+     * code, 428 a code is required, 409 this account cannot elevate yet, 429
+     * throttled. They pass through
+     * untouched, and never open the prompt (BYPASS_ELEVATION).
+     */
+    elevate(password: string, code?: string): Observable<ElevationState>;
+    /** Drop the elevation now. Idempotent on the server: nothing live is still a 204. */
+    drop(reason?: ElevationDropReason): Observable<ElevationState>;
+    /**
+     * What a person's explicit request for elevation calls -- an Elevate button,
+     * or a control that already knows its action needs elevation: ask the
+     * server whether this session is elevated, and only when it is not, open
+     * the prompt. Nothing calls it on a response by itself (the interceptor
+     * only tells {@link ELEVATION_NOTICE}). Elevated already is false, no
+     * prompt: elevation would change nothing.
+     */
+    offerFor(refusal?: string): Observable<boolean>;
+    /**
+     * Open the prompt, or join the one already open. Resolves to whether the
+     * session is elevated once the dialog closes.
+     */
+    requestElevation(request: ElevationPromptRequest): Observable<boolean>;
+    private options;
+    private inert;
+    /**
+     * Store the answer, schedule the expiry read, announce a change.
+     *
+     * `explicit` names the change when the caller knows it (a grant). For a
+     * plain refresh the kind is derived from the two states: elevated -> not
+     * is `expired` when the server says so and `dropped` otherwise (the person,
+     * another tab, the beacon, the tripwire); not -> elevated is a grant seen
+     * from another tab; a live grant whose `expiresAt` moved is `observed`.
+     *
+     * `prev` is read RAW rather than through `state()`: the demotion is not
+     * wanted here (this answer supersedes the stored one either way), and a
+     * read that demoted would queue an expiry announcement the server's own
+     * answer is about to make.
+     */
+    private apply;
+    private kindOf;
+    /**
+     * Tell the listings that this session's elevation ran out, once, and NOT
+     * from inside the read that noticed: a subscriber refetches on this, and a
+     * refetch started in the middle of a change detection pass is a write
+     * during a read. The microtask runs at the end of the current task, before
+     * anything can paint.
+     *
+     * A server answer arriving first clears the flag, so the announcement is
+     * made by whichever of the two got there first, never by both. Other tabs
+     * are NOT told: each one reaches the same conclusion from the same
+     * `expiresAt` on its own read, so the storage write would only buy a
+     * thundering herd of GETs.
+     */
+    private announceExpiryLater;
+    /**
+     * Ask the server again at `expiresAt` -- an OPTIMISATION, not the
+     * mechanism. `state()` already reports an elapsed grant as expired without
+     * being told, so a timer that a sleeping machine swallows, or that a
+     * background tab throttles to once a minute, now costs freshness rather
+     * than correctness. What it buys is the listing refetch happening at the
+     * moment of expiry instead of at the next read.
+     *
+     * Do not flip a local flag here: the lifetime counts from the grant on the
+     * server's clock, and if the server still says elevated at that moment
+     * (skew), the honest thing is to ask again shortly.
+     */
+    private schedule;
+    /**
+     * One more attempt, then stop. Giving up is affordable now and was not
+     * before: the state a failed read leaves behind is still read through the
+     * arithmetic above, so an unreachable server cannot leave this tab
+     * believing it is elevated. What is lost is only news from elsewhere -- a
+     * grant or a drop in another session -- and that is what the tab picks up
+     * when it next comes into view.
+     */
+    private scheduleRetry;
+    private clearTimer;
+    private announceToOtherTabs;
+    private readonly onStorage;
+    private readonly onFocus;
+    private readonly onVisibilityChange;
+    /**
+     * The tab is back. Read first -- that alone ends an elevation that ran out
+     * while it was away, with no request and no network to depend on -- then
+     * ask the server for what the read cannot know: a grant or a drop made
+     * elsewhere, or a lifetime the server moved.
+     */
+    private reconcile;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ElevationService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
+/**
+ * A refusal for want of elevation is a 403 the server stamps `X-Elevation-Required`
+ * where its gate refused a member who has not elevated ({@link isElevationRefusal}).
+ * This interceptor never opens the elevation prompt. The prompt opens only when a
+ * person asks for it: an Elevate button, or an action whose control already knows it
+ * needs elevation and offers it ({@link ElevationService.offerFor}).
+ *
+ * What it does with a stamped 403:
+ * - On a write a person made (POST, PUT, PATCH, DELETE without
+ *   {@link BACKGROUND_REQUEST}): tells {@link ELEVATION_NOTICE}, which shows the
+ *   refusal with an Elevate button. The request is not held and not repeated; the
+ *   caller receives the 403 at once, and after elevating the person repeats the action.
+ * - On a read: nothing. Reads are what a page makes as it loads and what polls make in
+ *   the background, and the page shows its own state for a refused one -- an inline
+ *   "needs an elevated session" with an Elevate button, or the feature hidden.
+ * - On a background request: nothing. Nobody is waiting on it.
+ *
+ * Until 2026-10-08 any stamped 403 opened the prompt, so the setup reads of almost every
+ * console page, and a realtime token at every load, opened it for an administrator who
+ * had not elevated: 13 of 15 pages on a menu click, 15 of 15 on a reload (measured).
+ *
+ * The elevation endpoint's own calls carry {@link BYPASS_ELEVATION}: a wrong password is a
+ * 403 and is not a refused action. A stamped 403 from anywhere but this API is ignored:
+ * the header is the server's word, and only this server's counts.
+ */
+declare const elevationInterceptor: HttpInterceptorFn;
 
 declare class LoginComponent {
     identifier: string;
     password: string;
-    loading: boolean;
-    error: string | null;
+    readonly loading: i0.WritableSignal<boolean>;
+    readonly error: i0.WritableSignal<string | null>;
     private readonly store;
     private readonly router;
+    /** Shown when the guard signed an account out because the console is not granted to it. */
+    static readonly NO_CONSOLE_ACCESS = "This account has no access to the console.";
+    constructor();
     submit(): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
     static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
@@ -684,10 +1178,10 @@ declare class AppInitService {
     private readonly prefs;
     private readonly crossTabSync;
     private readonly refreshCoordinator;
-    /** The only hardcoded URL — everything else comes from the manifest. */
+    /** The only hardcoded URL -- everything else comes from the manifest. */
     private readonly configUrl;
     /**
-     * Emits (once) when load() has fully completed — tokens settled, manifest
+     * Emits (once) when load() has fully completed -- tokens settled, manifest
      * set (or swallowed on error).  authGuard subscribes to this so it never
      * evaluates isAuthenticated against a partially-restored stale token.
      */
@@ -711,7 +1205,64 @@ declare class AppInitService {
     /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
     private probe;
     static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AppInitService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
+/** What the server said about this sign-in and the console. */
+type ConsoleAccess = 'granted' | 'refused' | 'unknown';
+/**
+ * Whether the signed-in account may use the console, and the console's endpoint
+ * map when it may.
+ *
+ * The server decides: `GET /api/v1/admin/manifest` answers the map. Since 2026-10-06
+ * (Dmitry: "no host groups"; access is decided by module groups alone) it answers every
+ * signed-in account: the map grants nothing, each call it names is decided by its own
+ * route, and an account in no group sees the admin with an empty menu. A server from
+ * before that answers only at `/api/v1/console/manifest`, to the `console` group, and
+ * 403 to anyone else -- there a refused sign-in is still signed out; this asks the new
+ * address first and the old one only on its 404. The public theme config
+ * read before sign-in carries only what the sign-in page needs; the rest arrives
+ * here, once per sign-in, and is merged into the app config key by key: a key the
+ * console's map carries replaces the public one whole, so the console's copy of a
+ * section is always the complete one.
+ *
+ * `unknown` is a failure to ask (the network, a 5xx), not an answer: it is not kept,
+ * so while the endpoint fails every navigation asks again.
+ *
+ * !! An answer belongs to the sign-in it was asked for. A sign-in, a sign-out or a
+ * restored session starts a new generation; an answer that arrives for a generation
+ * that is gone is kept for nobody -- A's late 403 must not sign B out -- and whoever
+ * is waiting on it is answered for the sign-in there is now.
+ *
+ * !! With nobody signed in there is nothing to ask, and nothing is asked. Without
+ * that, the re-ask after a sign-out went out with no token, its 401 made the
+ * interceptor dispatch Logout, which started another generation, which re-asked:
+ * a loop for as long as the tab lived (found in review).
+ */
+declare class ConsoleAccessService {
+    /** The admin manifest's URL: fixed, like the theme config's, because nothing is known before it. */
+    static readonly URL = "/api/v1/admin/manifest";
+    /** The address before 2026-10-06, asked only when a server older than that answers 404 at {@link URL}. */
+    static readonly LEGACY_URL = "/api/v1/console/manifest";
+    /** The login page's query parameter value for "signed out: no console access". */
+    static readonly REFUSED_REASON = "no-console-access";
+    private readonly http;
+    private readonly store;
+    private answer;
+    private pending;
+    private generation;
+    constructor();
+    /** Ask once per sign-in; the manifest is merged into the app config when granted. */
+    ensure(): Promise<ConsoleAccess>;
+    /**
+     * Sign a refused account out: this sign-in ends on the server (its refresh token
+     * with it), as the account menu's sign-out does, and then in this browser --
+     * whatever the server answered, so a refused request cannot leave it signed in.
+     */
+    signOut(): Observable<void>;
+    private merge;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleAccessService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -749,7 +1300,7 @@ interface LayoutHeaderAction {
     disabled?: boolean;
     /**
      * Optional capability gate evaluated FE-side against runtime state
-     * (e.g. `administer` / `delete`) — the config declares WHICH actions
+     * (e.g. `administer` / `delete`) -- the config declares WHICH actions
      * exist + their gate; the FE decides if THIS user/row qualifies. Absent
      * = always shown. Used by detail pages whose actions are config-driven
      * (see `web:section-detail`).
@@ -764,11 +1315,11 @@ interface LayoutHeaderAction {
      * evaluator as a NaviGraph toolbar node, applied
      * by {@link LayoutActionsService}:
      *
-     *   showWhen     — the action does not APPLY, so it is absent.
-     *   disabledWhen — temporarily UNAVAILABLE: stays put and greys out.
-     *   busyWhen     — the action is RUNNING: greys out too, and may relabel.
-     *   busyLabel    — label shown while `busyWhen` holds ("Saving…").
-     *   activeWhen   — pressed/active styling.
+     *   showWhen     -- the action does not APPLY, so it is absent.
+     *   disabledWhen -- temporarily UNAVAILABLE: stays put and greys out.
+     *   busyWhen     -- the action is RUNNING: greys out too, and may relabel.
+     *   busyLabel    -- label shown while `busyWhen` holds ("Saving...").
+     *   activeWhen   -- pressed/active styling.
      *
      * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
      * a page that moves between them should not have to relearn how to say
@@ -808,7 +1359,7 @@ interface LayoutConfig {
     headerActions?: LayoutHeaderAction[];
     /**
      * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
-     * — primary / destructive actions kept out of the cramped header.
+     * -- primary / destructive actions kept out of the cramped header.
      * Same shape as `headerActions`; gated per-item via `requires`.
      */
     footerActions?: LayoutHeaderAction[];
@@ -831,7 +1382,8 @@ interface DatagridConfig {
  * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
  *
  * Responses are cached for the lifetime of the service (Map + shareReplay(1))
- * so repeated calls never re-fetch the same resource.
+ * so repeated calls never re-fetch the same resource. A failed read is dropped
+ * from the cache, so the next call asks the server again.
  *
  * configBase is read from the API manifest (manifest.configBase) and falls
  * back to '/api/v1/config' when the manifest is not yet loaded.
@@ -847,7 +1399,7 @@ declare class ConfigService {
     datagrid(id: string): Observable<DatagridConfig>;
     private fetch;
     static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ConfigService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 declare class SetAppConfig {
@@ -861,16 +1413,18 @@ interface AppConfigStateModel {
 }
 declare class AppConfigState {
     set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
+    /** The whole config as last set: the public theme config, with the console's manifest once granted. */
+    static config(state: AppConfigStateModel): ThemeConfigResponse | null;
     static manifest(state: AppConfigStateModel): ApiManifest | null;
     /**
-     * F.7 viewer manifest. Null when the backend didn't ship a viewers
+     * The viewer manifest. Null when the backend didn't ship a viewers
      * section (no tagged providers); consumers should fall back to a
      * "no preview" surface.
      */
     static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
     static loaded(state: AppConfigStateModel): boolean;
     static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<AppConfigState>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -887,19 +1441,19 @@ declare class ErrorHandlerService {
     humanize(err: unknown): string;
     private statusMessage;
     static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ErrorHandlerService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /** What the user PICKED. `system` defers to the OS. */
 type ThemeChoice = 'light' | 'dark' | 'system';
-/** What that resolves to right now — the only two the stylesheet knows. */
+/** What that resolves to right now -- the only two the stylesheet knows. */
 type ResolvedTheme = 'light' | 'dark';
 /**
  * Applies the user's theme by setting `data-theme` on the document element.
  *
  * The stylesheet does the rest: `:root[data-theme='dark']` re-points the
  * `--cms-*` palette and every colour in the admin arrives through those names.
- * Nothing here knows a single colour, which is the point — a second
+ * Nothing here knows a single colour, which is the point -- a second
  * theme is a block of tokens, not a code change.
  *
  * Follows the shape of UserCalendarPreferencesService and
@@ -923,7 +1477,7 @@ declare class ThemeService {
     readonly platformAccent: i0.Signal<string | null>;
     /**
      * The colour actually painted: personal override, else the deployment's,
-     * else null — which leaves the stylesheet's own accent in place.
+     * else null -- which leaves the stylesheet's own accent in place.
      *
      * Three rungs and each is a real state. A user who has chosen nothing is
      * NOT the same as one who chose the deployment's colour: clear the
@@ -935,13 +1489,13 @@ declare class ThemeService {
     constructor();
     /**
      * One-shot load of the stored preference. Safe to call more than once and
-     * safe for anonymous users — a failure leaves the cached/system value in
+     * safe for anonymous users -- a failure leaves the cached/system value in
      * place rather than forcing light, so the login screen still matches the OS.
      */
     ensureLoaded(): Observable<ThemeChoice>;
     /**
      * Called by the Profile page after the Preferences tab saves, so the admin
-     * re-themes on the spot. Ignores anything that is not a known choice —
+     * re-themes on the spot. Ignores anything that is not a known choice --
      * the section PATCH returns the whole merged bag, not just this field.
      */
     update(value: unknown): void;
@@ -955,14 +1509,14 @@ declare class ThemeService {
     /**
      * The manifest is loaded at bootstrap, well before the authenticated shell
      * calls this, so a snapshot read is enough and no subscription is needed.
-     * A malformed value is ignored rather than applied — the container refuses
+     * A malformed value is ignored rather than applied -- the container refuses
      * to build with one, but the manifest crosses the network all the same.
      */
     private readPlatformAccent;
     private setAccent;
     /**
      * Writes the override onto the document element, where an inline style
-     * outranks every stylesheet rule — including the dark block — so one
+     * outranks every stylesheet rule -- including the dark block -- so one
      * declaration re-points the accent in both themes.
      *
      * Only --cms-accent is set, not the -hover/-light/-text members of the
@@ -976,7 +1530,7 @@ declare class ThemeService {
     private static readCache;
     private static readAccentCache;
     static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ThemeService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -988,7 +1542,7 @@ declare class ThemeService {
  * A spinner says "something is happening" and nothing else; every product has
  * one and none of them are yours. The bang is already the one glyph in the
  * wordmark that carries the brand, so a loader built from it says whose
- * software is thinking — for free, in the place a user is already looking.
+ * software is thinking -- for free, in the place a user is already looking.
  *
  * ## Why one component rather than a snippet per surface
  *
@@ -999,7 +1553,7 @@ declare class ThemeService {
  *
  * ## The animation
  *
- * The stem wipes upward and the dot lands after it, on a loop — the shape being
+ * The stem wipes upward and the dot lands after it, on a loop -- the shape being
  * WRITTEN rather than spun. It is deliberately calm: a loader is background
  * furniture, and anything with a hard beat gets irritating on the third viewing.
  * Under `prefers-reduced-motion` it holds still and only breathes, because
@@ -1017,7 +1571,7 @@ declare class CmsLoaderComponent {
     readonly inline: i0.InputSignal<boolean>;
     /**
      * A clip-path needs a document-unique id, and this component is used more
-     * than once per page — two loaders sharing an id makes the second one clip
+     * than once per page -- two loaders sharing an id makes the second one clip
      * against the first one's rectangle and stop animating.
      */
     protected readonly clipId: string;
@@ -1026,7 +1580,7 @@ declare class CmsLoaderComponent {
 }
 
 /**
- * Unified user preferences service — all preference types share one
+ * Unified user preferences service -- all preference types share one
  * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
  *
  * Key naming convention (stored as nested objects, referenced via dot-notation):
@@ -1147,7 +1701,7 @@ declare class UserPreferencesService {
     /** @deprecated Use setPanelState('media_panel_left', ...) instead */
     setMediaCollectionsPanel(width: number, collapsed: boolean): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<UserPreferencesService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -1195,7 +1749,7 @@ declare class SidebarStateService {
     private readItemsPersisted;
     private persistItems;
     static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<SidebarStateService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -1203,7 +1757,7 @@ declare class SidebarStateService {
  * what the picker emits via its `valueChange` output (and what the
  * template's persisted context carries). `label` is the primary
  * display line. `secondary` is an optional second line for
- * disambiguation (email, slug, etc.) — the backend omits the key
+ * disambiguation (email, slug, etc.) -- the backend omits the key
  * when there is nothing to show; receiving `null` from a custom
  * resolver is normalized to `undefined` here.
  */
@@ -1215,7 +1769,7 @@ interface EntitySearchResult {
 /**
  * HTTP client for the Phase 2a `/api/entity-search` endpoint.
  * Returns a stream of search results for the given entity FQCN.
- * Permission filtering happens at the backend resolver layer —
+ * Permission filtering happens at the backend resolver layer --
  * this service is a thin RPC.
  */
 declare class EntitySearchService {
@@ -1224,21 +1778,21 @@ declare class EntitySearchService {
      * @param entityType  Fully-qualified PHP class name of the entity
      *                    being searched (e.g. the backend's User entity).
      * @param query       Free-text search input. Empty string is
-     *                    valid — the backend returns the default
+     *                    valid -- the backend returns the default
      *                    listing for that entity type.
      * @param limit       Max rows to return; clamped server-side to
      *                    [1, 100].
      */
     search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
     static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<EntitySearchService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
  * Well-known click target values embedded in meta.target.
- *   'action.logout' — dispatch Logout action
- *   'route'         — navigate via routerLink (default when target absent)
- *   '_blank'        — open in a new tab (hrefOverride must be set)
+ *   'action.logout' -- dispatch Logout action
+ *   'route'         -- navigate via routerLink (default when target absent)
+ *   '_blank'        -- open in a new tab (hrefOverride must be set)
  */
 type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
 interface NaviGraphMeta {
@@ -1291,9 +1845,9 @@ declare class NaviGraphService {
      * Handle a nav-node click.
      *
      * Routing logic based on meta.target:
-     *   'action.logout'  — dispatch Logout
-     *   '_blank'         — window.open (uses node.path as href)
-     *   default          — router.navigate with meta.routerLink or node.path
+     *   'action.logout'  -- dispatch Logout
+     *   '_blank'         -- window.open (uses node.path as href)
+     *   default          -- router.navigate with meta.routerLink or node.path
      */
     handleClick(node: NaviGraphNode): void;
     /**
@@ -1304,7 +1858,7 @@ declare class NaviGraphService {
     isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
     /**
      * Standalone `showWhen` evaluator for callers that don't have a
-     * full `NaviGraphNode` (e.g. a grid's row context menu — a
+     * full `NaviGraphNode` (e.g. a grid's row context menu -- a
      * `rowAction.showWhen` predicate is evaluated against the row's
      * own projection). `null`/`undefined` predicates default to
      * visible, mirroring `isVisible`'s "no rule = always shown"
@@ -1325,7 +1879,7 @@ declare class NaviGraphService {
      */
     private buildTree;
     static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<NaviGraphService>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
 /**
@@ -1334,10 +1888,10 @@ declare class NaviGraphService {
  * Backed by a static Map so components registered at module load time
  * (e.g. in app.config.ts) are visible to all injected instances.
  *
- * Usage — static (app.config.ts / bootstrap time):
+ * Usage -- static (app.config.ts / bootstrap time):
  *   ComponentRegistry.register('MediaLibraryPage', MediaLibraryPage);
  *
- * Usage — injected (SlotComponent / runtime):
+ * Usage -- injected (SlotComponent / runtime):
  *   private readonly registry = inject(ComponentRegistry);
  *   const cls = this.registry.get('MediaLibraryPage');
  */
@@ -1352,9 +1906,217 @@ declare class ComponentRegistry {
     has(key: string): boolean;
     keys(): string[];
     static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<ComponentRegistry>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 
+/**
+ * `console` -- the administration host contract (the platform rule: hosts implement contracts, modules offer entries).
+ *
+ * A module contributes to the console with ONE object, its entry: data the
+ * host reads, never a call the module makes into the host. Six lists, each
+ * optional; an absent list means "nothing here", never an error. The host
+ * assembles the entries (build time today, install time under federation),
+ * refuses collisions by name, and activates only the modules the backend's
+ * manifest says are installed.
+ *
+ * The version is MAJOR.MINOR: a minor adds an optional list or field, a major
+ * changes or removes one. An entry declares the range it was written for
+ * (`^1.2` -- major 1, minor at least 2), checked at build against this
+ * constant and at install against the theme's declaration.
+ */
+declare const CONSOLE_CONTRACT: {
+    readonly name: "console";
+    readonly version: "1.0";
+};
+interface ConsoleEntry {
+    /** The backend module id, as `config/modules/<id>`. Activation is by this id. */
+    readonly module: string;
+    readonly contract: 'console';
+    /** The console versions this entry was written for: a caret range over MAJOR.MINOR, e.g. '^1.0'. */
+    readonly range: string;
+    readonly routes?: readonly ConsoleRouteMount[];
+    readonly bindings?: readonly ConsoleBinding[];
+    readonly topbar?: readonly ConsoleTopbarItem[];
+    readonly overlays?: readonly ConsoleOverlay[];
+    readonly panels?: readonly ConsolePanel[];
+    readonly states?: readonly Type<unknown>[];
+    readonly providers?: readonly ConsoleProvision[];
+}
+/** What a route's `data` carries for the shell: the sidebar item to light, and whether the page owns its height. */
+interface ConsoleNavHint {
+    readonly activeNav?: string;
+    readonly fullHeight?: boolean;
+    /** An intermediate crumb the top bar renders between Home and the page. */
+    readonly breadcrumb?: {
+        readonly label: string;
+        readonly routerLink: string;
+    };
+    /** Which server layout the page renders, for the generic layout pages. */
+    readonly layoutId?: string;
+}
+/**
+ * A route mounted under the console's authenticated layout. The host adds
+ * what a module may not decide: the layout component, `canActivate: [authGuard]`,
+ * and a `canMatch` that answers whether the module is installed here. Routes
+ * are lazy: a static component here would put every module's pages in `main`.
+ */
+type ConsoleRouteMount = {
+    readonly path: string;
+    readonly children: () => Promise<Routes>;
+    readonly nav?: ConsoleNavHint;
+    readonly providers?: readonly Provider[];
+} | {
+    readonly path: string;
+    readonly component: () => Promise<Type<unknown>>;
+    readonly nav?: ConsoleNavHint;
+    readonly providers?: readonly Provider[];
+} | {
+    readonly path: string;
+    readonly redirectTo: string;
+};
+/** A `ComponentRegistry` name -> class: names a module OWNS (its server layouts name them) and names it fills in another module's slot (`profile.tab:call`). */
+interface ConsoleBinding {
+    readonly name: string;
+    readonly component: Type<unknown>;
+}
+/** A tile in the top bar's quick-access strip, rendered in ascending `order`. */
+interface ConsoleTopbarItem {
+    readonly id: string;
+    readonly order: number;
+    readonly component: Type<unknown>;
+}
+/** Mounted once, inside the authenticated layout, outside the router outlet. */
+interface ConsoleOverlay {
+    readonly id: string;
+    readonly component: Type<unknown>;
+}
+/**
+ * A dock panel the layout opens and closes: the host renders its toggle in
+ * the top bar and the panel in the dock, and the panel talks back through
+ * {@link ConsolePanelHost} -- not through outputs, which a slot cannot carry.
+ */
+interface ConsolePanel {
+    readonly id: string;
+    readonly dock: 'bottom';
+    /** The top-bar toggle: a label (the title), an icon name or a short text, and a key the host binds with Ctrl. */
+    readonly toggle: {
+        readonly label: string;
+        readonly icon?: string;
+        readonly text?: string;
+        readonly key?: string;
+    };
+    readonly component: Type<unknown>;
+}
+/**
+ * What a `provide*` line is: environment providers from a library's registry
+ * (editor extensions, viewers, field widgets, file editors), or the
+ * implementation of a single-implementation port, listed as such so the
+ * assembly can refuse two modules implementing one port by name.
+ */
+type ConsoleProvision = EnvironmentProviders | Provider | ConsolePortProvision;
+interface ConsolePortProvision {
+    readonly port: InjectionToken<unknown>;
+    readonly useExisting: Type<unknown>;
+}
+declare function isPortProvision(p: ConsoleProvision): p is ConsolePortProvision;
+/** The identity function with the type: an entry file exports data, nothing runs. */
+declare function consoleEntry(entry: ConsoleEntry): ConsoleEntry;
+/**
+ * Whether a caret range over MAJOR.MINOR admits a version: same major, minor
+ * at least the range's. Malformed input admits nothing -- a range that cannot
+ * be read must refuse, never pass.
+ */
+declare function satisfiesRange(range: string, version: string): boolean;
+/** The refusal an assembly raises: one message per collision, all of them, by name. */
+declare class ConsoleAssemblyError extends Error {
+    readonly problems: readonly string[];
+    constructor(problems: readonly string[]);
+}
+/**
+ * The checks every assembly runs, in one place so the build-time spec, the
+ * bootstrap and a future install-time loader agree: entry ranges against
+ * this contract, and the collision rules of the six lists. Returns the
+ * entries unchanged when nothing is wrong.
+ */
+declare function assembleConsole(entries: readonly ConsoleEntry[]): readonly ConsoleEntry[];
+
+/**
+ * The host side of `console@1`: what a theme calls to turn the assembled
+ * entries into routes, providers and the lists its shell renders.
+ *
+ * Activation is the backend's: `GET /app-config` carries `ui.modules`, the
+ * modules whose console entry the installer matched against the theme's
+ * declaration. A module in the bundle but not in that list is dormant -- no
+ * route matches, no tile, no overlay; a module in the list but not in the
+ * bundle is reported by name ({@link ConsoleActivation.missing}), never
+ * silently absent.
+ */
+/** Every entry this build assembled, after {@link assembleConsole}'s checks. */
+declare const CONSOLE_ENTRIES: InjectionToken<readonly ConsoleEntry[]>;
+/**
+ * The port a dock panel talks back through: the layout provides one per
+ * panel it mounts, so the panel never needs an output the slot cannot carry.
+ */
+declare abstract class ConsolePanelHost {
+    abstract close(): void;
+    abstract maximize(on: boolean): void;
+}
+/** The console modules the manifest says are installed here. */
+declare function installedConsoleModules(manifest: ApiManifest | null): ReadonlySet<string>;
+declare class ConsoleActivation {
+    private readonly entries;
+    private readonly manifest;
+    readonly installed: i0.Signal<ReadonlySet<string>>;
+    /** The entries of installed modules, in assembly order. */
+    readonly active: i0.Signal<ConsoleEntry[]>;
+    readonly topbar: i0.Signal<readonly ConsoleTopbarItem[]>;
+    readonly overlays: i0.Signal<readonly ConsoleOverlay[]>;
+    readonly panels: i0.Signal<readonly ConsolePanel[]>;
+    /** Modules the manifest names that this build has no entry for: what a diagnostics page shows by name. */
+    readonly missing: i0.Signal<string[]>;
+    isInstalled(module: string): boolean;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleActivation, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * `canMatch` for a module's mount: the route exists only where the module is
+ * installed. Answered once the manifest is in: on a cold deep link the router
+ * recognises the URL while the initializer is still fetching `/theme/config`
+ * (the two run as parallel initializers), and a synchronous read then found
+ * no module installed, so every pasted module URL fell to the wildcard and
+ * landed on the dashboard (measured 2026-09-22: no chunk requested for the
+ * mount, the dashboard's instead). `ready$` is what the auth guard waits on
+ * too, and it fires whether or not the config fetch succeeded.
+ *
+ * !! Then the console's own manifest, when someone is signed in: `ui.modules` is
+ * the console's, not the public config's, and arrives with it
+ * ({@link ConsoleAccessService}). canMatch runs before the layout's auth guard,
+ * which asks the same question, so answering from the public config alone said
+ * "no" to every module once that config stopped carrying them. Nobody signed in:
+ * nothing is asked, the answer is the public config's, and the layout's guard
+ * sends the person to sign in. A refusal merges nothing, so the answer is no.
+ */
+declare function consoleModuleInstalled(module: string): CanMatchFn;
+/**
+ * The children a theme mounts under its authenticated layout for the
+ * assembled entries: one `Route` per mount, lazy as written, `data` from the
+ * entry's nav hint, `canMatch` from the manifest. The theme keeps its own
+ * shape around them (login, the layout, `canActivate: [authGuard]`, the
+ * wildcard).
+ */
+declare function consoleChildren(entries: readonly ConsoleEntry[]): Routes;
+/**
+ * The providers a theme adds for the assembled entries: the store with the
+ * host's states and every module state, the registry bindings (an
+ * initializer, so they exist before the first render), every module
+ * provision, and {@link CONSOLE_ENTRIES} for the shell. Place it AFTER the
+ * library providers a module's provisions extend (the editor bridge, the
+ * PDF viewer), as the hand-written lines were.
+ */
+declare function provideConsole(entries: readonly ConsoleEntry[], options: {
+    readonly hostStates: readonly Type<unknown>[];
+}): EnvironmentProviders;
+
 /**
  * Phase H7 -- admin Site Selector.
  *
@@ -1411,5 +2173,5 @@ interface CurrentSectionPort {
  */
 declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;
 
-export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, CrossTabAuthSyncService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, authGuard, authInterceptor, loginPageGuard, resolvePattern, sectionInterceptor };
-export type { ApiManifest, AppConfigStateModel, AuthApiManifest, AuthStateModel, CentrifugoConnectionTokenDto, CentrifugoSubscriptionTokenDto, ContentApiManifest, CurrentSectionPort, DataGridApiManifest, DataGridPreference, DataGridPreferences, DataSourceDefinition, DataSourceLoading, DataSourceOption, DataSourceType, DataSourceWidget, DatagridConfig, DialogConfig, DocumentApiManifest, DomainExplorerApiManifest, DynamicEntityApiManifest, EditorApiManifest, EditorApiManifestEntry, EditorApiManifestProfile, EntitySearchResult, FieldItem, FieldSecurityPolicy, FieldType, FormAction, FormActionType, FormActionVariant, FormConfig, FormRenderDefinition, HydraCollection, HydraView, IdentityApiManifest, LayoutConfig, LayoutHeaderAction, LayoutNode, LayoutSection, MediaApiManifest, NaviApiManifest, NaviGraphMeta, NaviGraphNode, NaviGraphNodeFlat, NaviGraphTarget, NavigraphConfig, PlatformDefaults, RelationDefinition, ResolvedTheme, SectionApiManifest, SubFormDefinition, TerminalApiManifest, ThemeChoice, ThemeConfigResponse, TokenResponse, UserDto, ValidatorDefinition, VfsApiManifest, ViewerApiManifest, ViewerDefinitionApiManifest, ViewerProfileApiManifest, VisibilityCondition, VisibilityOperator };
+export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BACKGROUND_REQUEST, BYPASS_AUTH, BYPASS_ELEVATION, CONSOLE_CONTRACT, CONSOLE_ENTRIES, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, ConsoleAccessService, ConsoleActivation, ConsoleAssemblyError, ConsolePanelHost, CrossTabAuthSyncService, ELEVATION_NOTICE, ELEVATION_PROMPT, ELEVATION_REQUIRED_HEADER, ELEVATION_WARNING_FACTOR_MISSING, ELEVATION_WARNING_MFA_OFF, ELEVATION_WARNING_PASSWORD_NOT_SET, ElevationService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, assembleConsole, authGuard, authInterceptor, consoleChildren, consoleEntry, consoleModuleInstalled, elevationInterceptor, installedConsoleModules, isElevationRefusal, isPortProvision, loginPageGuard, provideConsole, resolvePattern, satisfiesRange, sectionInterceptor };
+export type { ApiManifest, AppConfigStateModel, AuthApiManifest, AuthStateModel, CentrifugoConnectionTokenDto, CentrifugoSubscriptionTokenDto, ConsoleAccess, ConsoleBinding, ConsoleEntry, ConsoleManifestResponse, ConsoleNavHint, ConsoleOverlay, ConsolePanel, ConsolePortProvision, ConsoleProvision, ConsoleRouteMount, ConsoleTopbarItem, ContentApiManifest, CurrentSectionPort, DataGridApiManifest, DataGridPreference, DataGridPreferences, DataSourceDefinition, DataSourceLoading, DataSourceOption, DataSourceType, DataSourceWidget, DatagridConfig, DialogConfig, DocumentApiManifest, DomainExplorerApiManifest, DynamicEntityApiManifest, EditorApiManifest, EditorApiManifestEntry, EditorApiManifestProfile, ElevationChange, ElevationChangeKind, ElevationDropReason, ElevationEnded, ElevationEndedReason, ElevationNoticePort, ElevationPromptPort, ElevationPromptRequest, ElevationState, ElevationWarning, EntitySearchResult, FieldItem, FieldSecurityPolicy, FieldType, FormAction, FormActionType, FormActionVariant, FormConfig, FormRenderDefinition, HydraCollection, HydraView, IdentityApiManifest, LayoutConfig, LayoutHeaderAction, LayoutNode, LayoutSection, MediaApiManifest, NaviApiManifest, NaviGraphMeta, NaviGraphNode, NaviGraphNodeFlat, NaviGraphTarget, NavigraphConfig, PlatformDefaults, RelationDefinition, ResolvedTheme, SectionApiManifest, SubFormDefinition, TerminalApiManifest, ThemeChoice, ThemeConfigResponse, TokenResponse, UiApiManifest, UiModuleEntryManifest, UserDto, ValidatorDefinition, VfsApiManifest, ViewerApiManifest, ViewerDefinitionApiManifest, ViewerProfileApiManifest, VisibilityCondition, VisibilityOperator };