@coolms/core-angular 2.0.0-alpha.4 → 2.0.0-alpha.5

package/types/coolms-core-angular.d.ts

@@ -1,164 +1,166 @@
-import { Observable, Subject } from "rxjs";
-import * as i0 from "@angular/core";
-import { EnvironmentProviders, InjectionToken, Provider, Type } from "@angular/core";
-import { StateContext } from "@ngxs/store";
-import { CanActivateFn, CanMatchFn, Routes } from "@angular/router";
-import { HttpContextToken, HttpInterceptorFn } from "@angular/common/http";
-export interface AuthApiManifest {
-  readonly login: string;
-  readonly logout: string;
-  readonly refresh: string;
-  readonly register: string;
-  readonly me: string;
-  readonly usersApi?: string;
-  readonly groupsApi?: string;
-  readonly preferencesUrl?: string;
-  readonly groupFormId?: string | null;
-  readonly userFormId?: string | null;
-}
-export interface SectionApiManifest {
-  readonly list: string;
-  readonly create: string;
-  readonly item: string;
-  readonly update: string;
-  readonly delete: string;
-  readonly formId?: string;
-  readonly apply?: string;
-}
-export interface NaviApiManifest {
-  readonly treesList: string;
-  readonly treesCreate: string;
-  readonly treesItem: string;
-  readonly nodesList: string;
-  readonly nodesCreate: string;
-  readonly nodesItem: string;
-  readonly nodesReorder: string;
-  readonly nodesMove: string;
-  readonly nodesByTree: string;
-  readonly treesFormId?: string;
-  readonly nodesFormId?: string;
-  readonly adminNavGraph?: string;
-  readonly topbarNavGraph?: string;
-  readonly toolbarVfsGraph?: string;
-  readonly graphBySlug?: string;
-}
-export interface ContentApiManifest {
-  readonly variantPublishUrl: string;
-  readonly pageSpacesUrl?: string;
-  readonly pageTypesUrl?: string;
-}
-export interface DataGridApiManifest {
-  readonly configBase: string;
-}
-export interface TerminalApiManifest {
-  readonly executeUrl: string;
-  readonly completeUrl: string;
-}
-export interface MediaApiManifest {
-  readonly listUrl: string;
-  readonly itemUrl: string;
-  readonly permissionsUrl: string;
-  readonly regenerateUrl: string;
-  readonly resizeUrl: string;
-  readonly collectionsUrl: string;
-  readonly collectionsCreateUrl: string;
-  readonly collectionPermissionsUrl: string;
-  readonly moveUrl?: string;
-  readonly spacesUrl?: string;
-}
-export interface VfsApiManifest {
-  readonly fileContentUrl: string;
-  readonly binaryWriteUrl: string;
+import * as rxjs from 'rxjs';
+import { Observable, Subject } from 'rxjs';
+import * as i0 from '@angular/core';
+import { InjectionToken, Type, Provider, EnvironmentProviders } from '@angular/core';
+import { StateContext } from '@ngxs/store';
+import { CanActivateFn, Routes, CanMatchFn } from '@angular/router';
+import { HttpContextToken, HttpInterceptorFn } from '@angular/common/http';
+
+interface AuthApiManifest {
+    readonly login: string;
+    readonly logout: string;
+    readonly refresh: string;
+    readonly register: string;
+    readonly me: string;
+    readonly usersApi?: string;
+    readonly groupsApi?: string;
+    readonly preferencesUrl?: string;
+    readonly groupFormId?: string | null;
+    readonly userFormId?: string | null;
+}
+interface SectionApiManifest {
+    readonly list: string;
+    readonly create: string;
+    readonly item: string;
+    readonly update: string;
+    readonly delete: string;
+    readonly formId?: string;
+    readonly apply?: string;
+}
+interface NaviApiManifest {
+    readonly treesList: string;
+    readonly treesCreate: string;
+    readonly treesItem: string;
+    readonly nodesList: string;
+    readonly nodesCreate: string;
+    readonly nodesItem: string;
+    readonly nodesReorder: string;
+    readonly nodesMove: string;
+    readonly nodesByTree: string;
+    readonly treesFormId?: string;
+    readonly nodesFormId?: string;
+    readonly adminNavGraph?: string;
+    readonly topbarNavGraph?: string;
+    readonly toolbarVfsGraph?: string;
+    readonly graphBySlug?: string;
+}
+interface ContentApiManifest {
+    readonly variantPublishUrl: string;
+    readonly pageSpacesUrl?: string;
+    readonly pageTypesUrl?: string;
+}
+interface DataGridApiManifest {
+    readonly configBase: string;
+}
+interface TerminalApiManifest {
+    readonly executeUrl: string;
+    readonly completeUrl: string;
+}
+interface MediaApiManifest {
+    readonly listUrl: string;
+    readonly itemUrl: string;
+    readonly permissionsUrl: string;
+    readonly regenerateUrl: string;
+    readonly resizeUrl: string;
+    readonly collectionsUrl: string;
+    readonly collectionsCreateUrl: string;
+    readonly collectionPermissionsUrl: string;
+    readonly moveUrl?: string;
+    readonly spacesUrl?: string;
+}
+interface VfsApiManifest {
+    readonly fileContentUrl: string;
+    readonly binaryWriteUrl: string;
 }
 /**
  * Document module URL section. Today the only entry is `spacesUrl`;
  * the struct is reserved so future Document-module URLs can land
  * here without a new manifest section.
  */
-export interface DocumentApiManifest {
-  readonly spacesUrl?: string;
-  /**
-   * !! Carried here rather than derived from `spacesUrl`. Concatenating
-   * `/available` onto that would couple the client to a URL shape the router
-   * owns, and it would keep working until the route moved -- then fail as a
-   * 404 the UI reports as "no sites available", which is indistinguishable
-   * from the true empty answer.
-   *
-   * !! ABSENT ARRIVES AS `''`, NOT `undefined`. The producer declares these
-   * as non-nullable strings defaulting to empty, so an installation that has
-   * not set them sends an empty string and the `?` here never fires.
-   *
-   * Guard on FALSINESS -- `!url`, `Boolean(url)`. The dangerous rewrite is
-   * `url === undefined` (or `!== undefined`), which reads as more precise and
-   * treats `''` as present, handing a caller a request to the empty string.
-   *
-   * !! A `?? fallback` is NOT the hazard, though it looks like the obvious
-   * one: `'' ?? x` is `''`, so a fallback never fires on the value this
-   * producer actually sends. Measured by mutation -- adding one changed
-   * nothing, changing the guard broke three assertions.
-   */
-  readonly spacesAvailableUrl?: string;
-  readonly spaceEnablementUrl?: string;
-  /**
-   * FQCN of the entity a filter-mode audience can be built from.
-   *
-   * !! The SERVER owns this and the client must not know it. The generation
-   * wizard offers Filter mode only when a template's context schema
-   * references this type, and it used to compare against a constant compiled
-   * into this bundle -- which shipped the consuming application's class name
-   * inside a published package, and tied that package to an installation
-   * having that exact class.
-   *
-   * !! Absent arrives as `''`, like the urls above. Treat empty as **filter
-   * mode unavailable**, never as a reason to fall back to a remembered
-   * value: the server is the thing that rejects every other type, so a guess
-   * here offers a mode the server will refuse.
-   */
-  readonly filterAudienceEntity?: string;
-}
-export interface DynamicEntityApiManifest {
-  readonly typesUrl: string;
-  readonly fieldDefinitionsUrl: string;
-  readonly fieldDefinitionUrl: string;
-  readonly fieldDefinitionsReorderUrl: string;
-  readonly toolbarNaviGraphUrl: string;
-  readonly constraintsUrl: string;
-  readonly recordsUrl: string;
-  readonly recordUrl: string;
-  readonly recordsByTypeUrl: string;
-  readonly typeUrl: string;
-  readonly typesCreateUrl: string;
-  readonly formTypesUrl?: string;
-  readonly typeByAliasUrl?: string;
-}
-export interface DomainExplorerApiManifest {
-  readonly entitiesUrl: string;
-  readonly entityUrl: string;
-  readonly toolbarNaviGraphUrl: string;
-  readonly domainExplorerToolbarUrl: string;
-  readonly entityFieldsDataGridUrl?: string;
-  readonly typeFieldsDataGridUrl?: string;
-}
-export interface IdentityApiManifest {
-  readonly usersUrl: string;
-  readonly userUrl: string;
-  readonly groupsUrl: string;
-  readonly groupUrl: string;
-  readonly meUrl: string;
-  readonly assignGroupsUrl: string;
-  readonly avatarUploadUrl: string;
-  readonly settingsUrl: string;
-  readonly settingsSectionsUrl: string;
-  readonly settingsSectionUrl: string;
-  readonly colorUrl: string;
-  readonly rolesUrl?: string;
-  readonly elevationUrl?: string;
-  readonly deletionsUrl?: string;
-  readonly footprintsUrl?: string;
-  readonly userDeletionUrl?: string;
-  readonly userLegalHoldsUrl?: string;
-  readonly holdsSettingsBlock?: string;
-  readonly legalHoldFormId?: string | null;
+interface DocumentApiManifest {
+    readonly spacesUrl?: string;
+    /**
+     * !! Carried here rather than derived from `spacesUrl`. Concatenating
+     * `/available` onto that would couple the client to a URL shape the router
+     * owns, and it would keep working until the route moved -- then fail as a
+     * 404 the UI reports as "no sites available", which is indistinguishable
+     * from the true empty answer.
+     *
+     * !! ABSENT ARRIVES AS `''`, NOT `undefined`. The producer declares these
+     * as non-nullable strings defaulting to empty, so an installation that has
+     * not set them sends an empty string and the `?` here never fires.
+     *
+     * Guard on FALSINESS -- `!url`, `Boolean(url)`. The dangerous rewrite is
+     * `url === undefined` (or `!== undefined`), which reads as more precise and
+     * treats `''` as present, handing a caller a request to the empty string.
+     *
+     * !! A `?? fallback` is NOT the hazard, though it looks like the obvious
+     * one: `'' ?? x` is `''`, so a fallback never fires on the value this
+     * producer actually sends. Measured by mutation -- adding one changed
+     * nothing, changing the guard broke three assertions.
+     */
+    readonly spacesAvailableUrl?: string;
+    readonly spaceEnablementUrl?: string;
+    /**
+     * FQCN of the entity a filter-mode audience can be built from.
+     *
+     * !! The SERVER owns this and the client must not know it. The generation
+     * wizard offers Filter mode only when a template's context schema
+     * references this type, and it used to compare against a constant compiled
+     * into this bundle -- which shipped the consuming application's class name
+     * inside a published package, and tied that package to an installation
+     * having that exact class.
+     *
+     * !! Absent arrives as `''`, like the urls above. Treat empty as **filter
+     * mode unavailable**, never as a reason to fall back to a remembered
+     * value: the server is the thing that rejects every other type, so a guess
+     * here offers a mode the server will refuse.
+     */
+    readonly filterAudienceEntity?: string;
+}
+interface DynamicEntityApiManifest {
+    readonly typesUrl: string;
+    readonly fieldDefinitionsUrl: string;
+    readonly fieldDefinitionUrl: string;
+    readonly fieldDefinitionsReorderUrl: string;
+    readonly toolbarNaviGraphUrl: string;
+    readonly constraintsUrl: string;
+    readonly recordsUrl: string;
+    readonly recordUrl: string;
+    readonly recordsByTypeUrl: string;
+    readonly typeUrl: string;
+    readonly typesCreateUrl: string;
+    readonly formTypesUrl?: string;
+    readonly typeByAliasUrl?: string;
+}
+interface DomainExplorerApiManifest {
+    readonly entitiesUrl: string;
+    readonly entityUrl: string;
+    readonly toolbarNaviGraphUrl: string;
+    readonly domainExplorerToolbarUrl: string;
+    readonly entityFieldsDataGridUrl?: string;
+    readonly typeFieldsDataGridUrl?: string;
+}
+interface IdentityApiManifest {
+    readonly usersUrl: string;
+    readonly userUrl: string;
+    readonly groupsUrl: string;
+    readonly groupUrl: string;
+    readonly meUrl: string;
+    readonly assignGroupsUrl: string;
+    readonly avatarUploadUrl: string;
+    readonly settingsUrl: string;
+    readonly settingsSectionsUrl: string;
+    readonly settingsSectionUrl: string;
+    readonly colorUrl: string;
+    readonly rolesUrl?: string;
+    readonly elevationUrl?: string;
+    readonly deletionsUrl?: string;
+    readonly footprintsUrl?: string;
+    readonly userDeletionUrl?: string;
+    readonly userLegalHoldsUrl?: string;
+    readonly holdsSettingsBlock?: string;
+    readonly legalHoldFormId?: string | null;
 }
 /**
  * Editor sub-manifest emitted by the backend's Editor module. The
@@ -170,27 +172,27 @@ export interface IdentityApiManifest {
  * pre-resolved contributor list AND the storage allow-list a sanitizer
  * enforces on save.
  */
-export interface EditorApiManifestEntry {
-  readonly id: string;
-  readonly group: string;
-  readonly priority: number;
-  readonly icon: string;
-  readonly label: string;
-  readonly actionType: string;
-  readonly actionParams: Readonly<Record<string, unknown>>;
-  readonly extensions: ReadonlyArray<string>;
-  readonly stateKeys: ReadonlyArray<string>;
-  readonly shortcut?: string | null;
-  readonly slashable?: boolean;
-  readonly keywords?: ReadonlyArray<string>;
-}
-export interface EditorApiManifestProfile {
-  readonly contributors: ReadonlyArray<EditorApiManifestEntry>;
-  readonly allowedWidgets: ReadonlyArray<string>;
-}
-export interface EditorApiManifest {
-  readonly schemaVersion: number;
-  readonly profiles: Readonly<Record<string, EditorApiManifestProfile>>;
+interface EditorApiManifestEntry {
+    readonly id: string;
+    readonly group: string;
+    readonly priority: number;
+    readonly icon: string;
+    readonly label: string;
+    readonly actionType: string;
+    readonly actionParams: Readonly<Record<string, unknown>>;
+    readonly extensions: ReadonlyArray<string>;
+    readonly stateKeys: ReadonlyArray<string>;
+    readonly shortcut?: string | null;
+    readonly slashable?: boolean;
+    readonly keywords?: ReadonlyArray<string>;
+}
+interface EditorApiManifestProfile {
+    readonly contributors: ReadonlyArray<EditorApiManifestEntry>;
+    readonly allowedWidgets: ReadonlyArray<string>;
+}
+interface EditorApiManifest {
+    readonly schemaVersion: number;
+    readonly profiles: Readonly<Record<string, EditorApiManifestProfile>>;
 }
 /**
  * Viewer manifest emitted by the backend's Document module.
@@ -199,20 +201,20 @@ export interface EditorApiManifest {
  * profile. Profile config is open-ended -- every viewer interprets the
  * keys it understands and ignores the rest.
  */
-export interface ViewerProfileApiManifest {
-  readonly key: string;
-  readonly config: Readonly<Record<string, unknown>>;
+interface ViewerProfileApiManifest {
+    readonly key: string;
+    readonly config: Readonly<Record<string, unknown>>;
 }
-export interface ViewerDefinitionApiManifest {
-  readonly key: string;
-  readonly mimeTypes: ReadonlyArray<string>;
-  readonly extensions: ReadonlyArray<string>;
-  readonly component: string;
-  readonly profiles: Readonly<Record<string, ViewerProfileApiManifest>>;
+interface ViewerDefinitionApiManifest {
+    readonly key: string;
+    readonly mimeTypes: ReadonlyArray<string>;
+    readonly extensions: ReadonlyArray<string>;
+    readonly component: string;
+    readonly profiles: Readonly<Record<string, ViewerProfileApiManifest>>;
 }
-export interface ViewerApiManifest {
-  readonly schemaVersion: number;
-  readonly viewers: Readonly<Record<string, ViewerDefinitionApiManifest>>;
+interface ViewerApiManifest {
+    readonly schemaVersion: number;
+    readonly viewers: Readonly<Record<string, ViewerDefinitionApiManifest>>;
 }
 /**
  * Platform-wide default user-facing settings. The
@@ -221,17 +223,17 @@ export interface ViewerApiManifest {
  * config, not an FE-hardcoded Western default. `locale` is the default
  * locale, previously absent from the manifest.
  */
-export interface PlatformDefaults {
-  readonly locale: string;
-  readonly timezone: string;
-  readonly dateFormat: string;
-  readonly timeFormat: '12h' | '24h';
-  readonly weekStart: 'monday' | 'sunday';
-  /**
-   * Deployment brand accent as `#rrggbb`, or null/absent to keep the
-   * stylesheet's own. Sits BELOW a user's personal accentColor.
-   */
-  readonly accentColor?: string | null;
+interface PlatformDefaults {
+    readonly locale: string;
+    readonly timezone: string;
+    readonly dateFormat: string;
+    readonly timeFormat: '12h' | '24h';
+    readonly weekStart: 'monday' | 'sunday';
+    /**
+     * Deployment brand accent as `#rrggbb`, or null/absent to keep the
+     * stylesheet's own. Sits BELOW a user's personal accentColor.
+     */
+    readonly accentColor?: string | null;
 }
 /**
  * The host contracts in force here (the platform rule: hosts implement
@@ -240,49 +242,58 @@ export interface PlatformDefaults {
  * entries the installer matched against it. A host mounts a module only when
  * it is listed.
  */
-export interface UiApiManifest {
-  /** The contracts in force, name -> MAJOR.MINOR (`{ console: '1.0' }`): one installed theme implements each. */
-  readonly contracts: Readonly<Record<string, string>>;
-  /** Which installed theme implements each contract, name -> theme slug. */
-  readonly hosts?: Readonly<Record<string, string>>;
-  readonly modules: ReadonlyArray<UiModuleEntryManifest>;
-}
-export interface UiModuleEntryManifest {
-  readonly module: string;
-  readonly contract: string;
-  readonly range: string;
-  readonly framework: string;
-}
-export interface ApiManifest {
-  readonly apiBase: string;
-  readonly ui?: UiApiManifest;
-  readonly configBase?: string;
-  readonly auth?: AuthApiManifest;
-  readonly identity?: IdentityApiManifest;
-  readonly sections?: SectionApiManifest;
-  readonly navi?: NaviApiManifest;
-  readonly content?: ContentApiManifest;
-  readonly dataGrid?: DataGridApiManifest;
-  readonly terminal?: TerminalApiManifest;
-  readonly media?: MediaApiManifest;
-  readonly document?: DocumentApiManifest;
-  readonly vfs?: VfsApiManifest;
-  readonly dynamicEntity?: DynamicEntityApiManifest;
-  readonly domainExplorer?: DomainExplorerApiManifest;
-  readonly editor?: EditorApiManifest;
-  readonly viewers?: ViewerApiManifest;
-  readonly supportedLocales?: Array<{
-    code: string;
-    label: string;
-  }>;
-  readonly platformDefaults?: PlatformDefaults;
+interface UiApiManifest {
+    /** The contracts in force, name -> MAJOR.MINOR (`{ console: '1.0' }`): one installed theme implements each. */
+    readonly contracts: Readonly<Record<string, string>>;
+    /** Which installed theme implements each contract, name -> theme slug. */
+    readonly hosts?: Readonly<Record<string, string>>;
+    readonly modules: ReadonlyArray<UiModuleEntryManifest>;
+}
+interface UiModuleEntryManifest {
+    readonly module: string;
+    readonly contract: string;
+    readonly range: string;
+    readonly framework: string;
+}
+interface ApiManifest {
+    readonly apiBase: string;
+    readonly ui?: UiApiManifest;
+    readonly configBase?: string;
+    readonly auth?: AuthApiManifest;
+    readonly identity?: IdentityApiManifest;
+    readonly sections?: SectionApiManifest;
+    readonly navi?: NaviApiManifest;
+    readonly content?: ContentApiManifest;
+    readonly dataGrid?: DataGridApiManifest;
+    readonly terminal?: TerminalApiManifest;
+    readonly media?: MediaApiManifest;
+    readonly document?: DocumentApiManifest;
+    readonly vfs?: VfsApiManifest;
+    readonly dynamicEntity?: DynamicEntityApiManifest;
+    readonly domainExplorer?: DomainExplorerApiManifest;
+    readonly editor?: EditorApiManifest;
+    readonly viewers?: ViewerApiManifest;
+    readonly supportedLocales?: Array<{
+        code: string;
+        label: string;
+    }>;
+    readonly platformDefaults?: PlatformDefaults;
+}
+/**
+ * GET /api/v1/admin/manifest -- the admin's endpoint map, answered to every signed-in account
+ * since 2026-10-06 (no host groups: each call it names is decided by its own route). A server
+ * from before that answers at /api/v1/console/manifest, to the console group only. Read once
+ * signed in.
+ */
+interface ConsoleManifestResponse {
+    readonly manifest: ApiManifest;
 }
-export interface ThemeConfigResponse {
-  readonly slug?: string | null;
-  readonly feStack?: string | null;
-  readonly spaFramework?: string | null;
-  readonly assetsUrl?: string | null;
-  readonly manifest: ApiManifest;
+interface ThemeConfigResponse {
+    readonly slug?: string | null;
+    readonly feStack?: string | null;
+    readonly spaFramework?: string | null;
+    readonly assetsUrl?: string | null;
+    readonly manifest: ApiManifest;
 }
 /**
  * Replaces {param} tokens in a URL pattern with encoded values.
@@ -291,7 +302,8 @@ export interface ThemeConfigResponse {
  *   resolvePattern(manifest.sections!.item, { id: '123' })
  *   // -> '/api/v1/sections/123'
  */
-export declare function resolvePattern(pattern: string, params: Record<string, string>): string;
+declare function resolvePattern(pattern: string, params: Record<string, string>): string;
+
 /**
  * Shapes the user-preference store persists.
  *
@@ -304,11 +316,12 @@ export declare function resolvePattern(pattern: string, params: Record<string, s
  * keeps its own local path and nothing that reads a grid preference had to
  * change.
  */
-export interface DataGridPreference {
-  columns?: string[];
-  columnWidths?: Record<string, number>;
+interface DataGridPreference {
+    columns?: string[];
+    columnWidths?: Record<string, number>;
 }
-export type DataGridPreferences = Record<string, DataGridPreference>;
+type DataGridPreferences = Record<string, DataGridPreference>;
+
 /**
  * Session and current-user DTOs.
  *
@@ -320,121 +333,123 @@ export type DataGridPreferences = Record<string, DataGridPreference>;
  * `ApiService` re-exports them from its own module, so the feature files that
  * import `UserDto` from there are untouched.
  */
-export interface TokenResponse {
-  accessToken: string;
-  refreshToken: string;
-  expiresAt: string;
-  user?: UserDto;
-}
-export interface UserDto {
-  id: string;
-  email: string;
-  identifier?: string;
-  roles: string[];
-  uiPrefs?: DataGridPreferences;
-  avatarUrl?: string | null;
-  firstName?: string | null;
-  lastName?: string | null;
-  fullName?: string;
-}
-export type FieldType = 'text' | 'email' | 'password' | 'number' | 'textarea' | 'select' | 'toggle' | 'date' | 'time' | 'hidden' | 'relation' | 'subform' | 'token-pattern' | 'richtext' | 'localizedText' | 'localizedTextarea' | 'optionsEditor' | 'intlPhone' | 'color';
-export type DataSourceType = 'static' | 'enum' | 'api' | 'repo';
-export type VisibilityOperator = 'eq' | 'ne' | 'in' | 'notIn' | 'empty' | 'notEmpty';
-export interface VisibilityCondition {
-  readonly field: string;
-  readonly operator: VisibilityOperator;
-  readonly value?: unknown;
-}
-export type DataSourceWidget = 'select' | 'select-search' | 'select-tree' | 'token-input' | 'media-picker';
-export type DataSourceLoading = 'eager' | 'lazy';
-export interface DataSourceOption {
-  readonly value: unknown;
-  readonly label: string;
-  readonly parentId?: string | null;
-}
-export interface DataSourceDefinition {
-  readonly type: DataSourceType;
-  readonly bindValue: string;
-  readonly bindLabel: string;
-  readonly multiple: boolean;
-  readonly maxItems?: number;
-  readonly options?: ReadonlyArray<DataSourceOption>;
-  readonly url?: string;
-  readonly widget: DataSourceWidget;
-  readonly loading: DataSourceLoading;
-  /** Free-form widget-specific configuration block populated from YAML
-   *  `dataSource.widgetOptions`. Used by media-picker for bindTarget /
-   *  display / accept / recentlyUsed / hoverPreview, and reserved for
-   *  future custom widgets. Kept separate from `options` (which is the
-   *  static-option list) to avoid key collisions. */
-  readonly widgetOptions?: Readonly<Record<string, unknown>>;
-}
-export interface ValidatorDefinition {
-  readonly type: string;
-  readonly value?: unknown;
-  readonly message?: string;
-}
-export interface RelationDefinition {
-  readonly cardinality: 'one' | 'many';
-  readonly maxItems?: number;
-  readonly targetFormId?: string;
-  readonly dataSource?: DataSourceDefinition;
-}
-export interface SubFormDefinition {
-  readonly formId: string;
-  readonly relation: 'one' | 'many';
-  readonly maxItems?: number;
-}
-export interface FieldSecurityPolicy {
-  readonly read: ReadonlyArray<string>;
-  readonly write: ReadonlyArray<string>;
-}
-export interface FieldItem {
-  readonly alias: string;
-  readonly type: FieldType;
-  readonly label: string;
-  readonly placeholder?: string;
-  readonly hint?: string;
-  readonly required: boolean;
-  readonly readonly: boolean;
-  readonly locked: boolean;
-  readonly private: boolean;
-  readonly validators: ReadonlyArray<ValidatorDefinition>;
-  readonly dataSource?: DataSourceDefinition;
-  readonly relation?: RelationDefinition;
-  readonly subForm?: SubFormDefinition;
-  readonly separators?: ReadonlyArray<string>;
-  readonly security?: FieldSecurityPolicy | null;
-  readonly autocomplete?: string;
-}
-export interface LayoutNode {
-  readonly type: 'group' | 'grid' | 'column' | 'tabs' | 'tab' | (string & {});
-  readonly name?: string;
-  readonly description?: string;
-  readonly compact?: boolean;
-  readonly width?: number;
-  readonly children?: ReadonlyArray<LayoutNode>;
-  readonly showWhen?: VisibilityCondition;
-}
-export type FormActionType = 'submit' | 'button' | 'reset';
-export type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
+interface TokenResponse {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: string;
+    user?: UserDto;
+}
+interface UserDto {
+    id: string;
+    email: string;
+    identifier?: string;
+    roles: string[];
+    uiPrefs?: DataGridPreferences;
+    avatarUrl?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    fullName?: string;
+}
+
+type FieldType = 'text' | 'email' | 'password' | 'number' | 'textarea' | 'select' | 'toggle' | 'date' | 'time' | 'hidden' | 'relation' | 'subform' | 'token-pattern' | 'richtext' | 'localizedText' | 'localizedTextarea' | 'optionsEditor' | 'intlPhone' | 'color';
+type DataSourceType = 'static' | 'enum' | 'api' | 'repo';
+type VisibilityOperator = 'eq' | 'ne' | 'in' | 'notIn' | 'empty' | 'notEmpty';
+interface VisibilityCondition {
+    readonly field: string;
+    readonly operator: VisibilityOperator;
+    readonly value?: unknown;
+}
+type DataSourceWidget = 'select' | 'select-search' | 'select-tree' | 'token-input' | 'media-picker';
+type DataSourceLoading = 'eager' | 'lazy';
+interface DataSourceOption {
+    readonly value: unknown;
+    readonly label: string;
+    readonly parentId?: string | null;
+}
+interface DataSourceDefinition {
+    readonly type: DataSourceType;
+    readonly bindValue: string;
+    readonly bindLabel: string;
+    readonly multiple: boolean;
+    readonly maxItems?: number;
+    readonly options?: ReadonlyArray<DataSourceOption>;
+    readonly url?: string;
+    readonly widget: DataSourceWidget;
+    readonly loading: DataSourceLoading;
+    /** Free-form widget-specific configuration block populated from YAML
+     *  `dataSource.widgetOptions`. Used by media-picker for bindTarget /
+     *  display / accept / recentlyUsed / hoverPreview, and reserved for
+     *  future custom widgets. Kept separate from `options` (which is the
+     *  static-option list) to avoid key collisions. */
+    readonly widgetOptions?: Readonly<Record<string, unknown>>;
+}
+interface ValidatorDefinition {
+    readonly type: string;
+    readonly value?: unknown;
+    readonly message?: string;
+}
+interface RelationDefinition {
+    readonly cardinality: 'one' | 'many';
+    readonly maxItems?: number;
+    readonly targetFormId?: string;
+    readonly dataSource?: DataSourceDefinition;
+}
+interface SubFormDefinition {
+    readonly formId: string;
+    readonly relation: 'one' | 'many';
+    readonly maxItems?: number;
+}
+interface FieldSecurityPolicy {
+    readonly read: ReadonlyArray<string>;
+    readonly write: ReadonlyArray<string>;
+}
+interface FieldItem {
+    readonly alias: string;
+    readonly type: FieldType;
+    readonly label: string;
+    readonly placeholder?: string;
+    readonly hint?: string;
+    readonly required: boolean;
+    readonly readonly: boolean;
+    readonly locked: boolean;
+    readonly private: boolean;
+    readonly validators: ReadonlyArray<ValidatorDefinition>;
+    readonly dataSource?: DataSourceDefinition;
+    readonly relation?: RelationDefinition;
+    readonly subForm?: SubFormDefinition;
+    readonly separators?: ReadonlyArray<string>;
+    readonly security?: FieldSecurityPolicy | null;
+    readonly autocomplete?: string;
+}
+interface LayoutNode {
+    readonly type: 'group' | 'grid' | 'column' | 'tabs' | 'tab' | (string & {});
+    readonly name?: string;
+    readonly description?: string;
+    readonly compact?: boolean;
+    readonly width?: number;
+    readonly children?: ReadonlyArray<LayoutNode>;
+    readonly showWhen?: VisibilityCondition;
+}
+type FormActionType = 'submit' | 'button' | 'reset';
+type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
 /** Terminal form button (Submit / Cancel / ...) -- mirrors PHP FormAction.
  *  Resolved by the backend (declared `formOptions.actions`, else lifted from
  *  legacy submit fields, else a default Submit). `label` is already translated. */
-export interface FormAction {
-  readonly type: FormActionType;
-  readonly label: string;
-  readonly name: string;
-  readonly variant: FormActionVariant;
-}
-export interface FormRenderDefinition {
-  readonly id: string;
-  readonly context: 'create' | 'edit';
-  readonly layout: ReadonlyArray<LayoutNode>;
-  readonly items: ReadonlyArray<FieldItem>;
-  readonly actions: ReadonlyArray<FormAction>;
-  readonly action?: string;
-}
+interface FormAction {
+    readonly type: FormActionType;
+    readonly label: string;
+    readonly name: string;
+    readonly variant: FormActionVariant;
+}
+interface FormRenderDefinition {
+    readonly id: string;
+    readonly context: 'create' | 'edit';
+    readonly layout: ReadonlyArray<LayoutNode>;
+    readonly items: ReadonlyArray<FieldItem>;
+    readonly actions: ReadonlyArray<FormAction>;
+    readonly action?: string;
+}
+
 /**
  * The collection envelope API Platform wraps every list response in.
  *
@@ -455,17 +470,18 @@ export interface FormRenderDefinition {
  * crashes if it does. Settle it by calling the endpoint, not by merging the
  * types.
  */
-export interface HydraView {
-  '@id': string;
-  'next'?: string;
-  'previous'?: string;
-  'last'?: string;
-}
-export interface HydraCollection<T> {
-  'member': T[];
-  'totalItems': number;
-  'view'?: HydraView;
-}
+interface HydraView {
+    '@id': string;
+    'next'?: string;
+    'previous'?: string;
+    'last'?: string;
+}
+interface HydraCollection<T> {
+    'member': T[];
+    'totalItems': number;
+    'view'?: HydraView;
+}
+
 /**
  * The identity endpoints core owns: the session lifecycle, plus the settings
  * read at boot.
@@ -482,46 +498,47 @@ export interface HydraCollection<T> {
  * `ApiService` keeps its own identical signatures and delegates here, so none
  * of the 94 feature files calling it changed.
  */
-export declare class IdentityApiClient {
-  private readonly http;
-  private readonly store;
-  /** URLs come from the boot manifest, which core already owns. */
-  private get manifest();
-  login(identifier: string, password: string): Observable<TokenResponse>;
-  refresh(refreshToken: string): Observable<TokenResponse>;
-  logout(): Observable<void>;
-  me(): Observable<UserDto>;
-  getSettings(): Observable<Record<string, Record<string, unknown>>>;
-  static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class IdentityApiClient {
+    private readonly http;
+    private readonly store;
+    /** URLs come from the boot manifest, which core already owns. */
+    private get manifest();
+    login(identifier: string, password: string): Observable<TokenResponse>;
+    refresh(refreshToken: string): Observable<TokenResponse>;
+    logout(): Observable<void>;
+    me(): Observable<UserDto>;
+    getSettings(): Observable<Record<string, Record<string, unknown>>>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Response of `POST /centrifugo/connection-token`: the JWT the realtime SDK
  * opens its socket with, and what it needs to refresh before expiry.
  */
-export interface CentrifugoConnectionTokenDto {
-  token: string;
-  expiresAt: number;
-  ttl: number;
-  wsUrl: string;
-  /**
-   * The code the server closes this connection with when the caller's session
-   * ended (a sign-out everywhere, a password change, a deactivation). On it the
-   * client signs out and ends its calls at once, without reconnecting or waiting
-   * for a 401 (2026-09-26). Absent from a server older than that.
-   */
-  sessionEndedCode?: number;
+interface CentrifugoConnectionTokenDto {
+    token: string;
+    expiresAt: number;
+    ttl: number;
+    wsUrl: string;
+    /**
+     * The code the server closes this connection with when the caller's session
+     * ended (a sign-out everywhere, a password change, a deactivation). On it the
+     * client signs out and ends its calls at once, without reconnecting or waiting
+     * for a 401 (2026-09-26). Absent from a server older than that.
+     */
+    sessionEndedCode?: number;
 }
 /**
  * Response of `POST /centrifugo/subscription-token`: a per-channel JWT. The
  * SDK asks for one before subscribing to a private namespace, so this is
  * fetched per subscription rather than once per connection.
  */
-export interface CentrifugoSubscriptionTokenDto {
-  channel: string;
-  token: string;
-  expiresAt: number;
-  ttl: number;
+interface CentrifugoSubscriptionTokenDto {
+    channel: string;
+    token: string;
+    expiresAt: number;
+    ttl: number;
 }
 /**
  * The two realtime endpoints, carved out for the same reason the identity ones
@@ -536,68 +553,89 @@ export interface CentrifugoSubscriptionTokenDto {
  *
  * `ApiService` keeps its identical signatures and delegates here, so nothing
  * calling it had to change.
+ *
+ * !! Access first, then realtime (Dmitry, 2026-09-28): "The console opens a realtime
+ * connection before the access check. Reverse the order ... A refused account opens no
+ * socket." The socket cannot open without the connection token, and anything may ask for
+ * one early -- the ring subscription is built at app init and asks as soon as a user is
+ * set, before the guard's answer is in. So the token waits for the console's answer (the
+ * guard's own request, not a second one) and a refused sign-in gets none: no request, no
+ * socket. A failure to ask is not a refusal, as at the guard.
+ *
+ * Since 2026-10-06 the connection token is every signed-in account's (Dmitry: "The connection
+ * token only opens a socket; each channel is authorized when it is subscribed to"), and a
+ * current server answers the admin manifest to every signed-in account, so no
+ * sign-in is refused and every one gets its token; each subscription is then decided by its
+ * channel. The wait stays for a server from before that, where a refused sign-in still opens
+ * no socket.
  */
-export declare class RealtimeTokenClient {
-  private readonly http;
-  private readonly store;
-  private get manifest();
-  connectionToken(): Observable<CentrifugoConnectionTokenDto>;
-  subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
-  static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-export declare class Login {
-  identifier: string;
-  password: string;
-  static readonly type = "[Auth] Login";
-  constructor(identifier: string, password: string);
-}
-export declare class Logout {
-  static readonly type = "[Auth] Logout";
-}
-export declare class RestoreSession {
-  static readonly type = "[Auth] Restore Session";
-}
-export declare class SetTokens {
-  readonly response: TokenResponse;
-  static readonly type = "[Auth] Set Tokens";
-  constructor(response: TokenResponse);
+declare class RealtimeTokenClient {
+    /** The error a refused sign-in's connection-token request ends with. */
+    static readonly REFUSED = "no console access: no realtime connection";
+    private readonly http;
+    private readonly store;
+    private readonly injector;
+    private get manifest();
+    connectionToken(): Observable<CentrifugoConnectionTokenDto>;
+    subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
+declare class Login {
+    identifier: string;
+    password: string;
+    static readonly type = "[Auth] Login";
+    constructor(identifier: string, password: string);
+}
+declare class Logout {
+    static readonly type = "[Auth] Logout";
+}
+declare class RestoreSession {
+    static readonly type = "[Auth] Restore Session";
+}
+declare class SetTokens {
+    readonly response: TokenResponse;
+    static readonly type = "[Auth] Set Tokens";
+    constructor(response: TokenResponse);
 }
 /** Merge a partial update into the currently-stored user (e.g. after avatar change). */
-export declare class PatchCurrentUser {
-  readonly patch: Partial<UserDto>;
-  static readonly type = "[Auth] Patch Current User";
-  constructor(patch: Partial<UserDto>);
-}
-export interface AuthStateModel {
-  accessToken: string | null;
-  refreshToken: string | null;
-  expiresAt: string | null;
-  user: UserDto | null;
-}
-export declare class AuthState {
-  private readonly api;
-  private readonly prefs;
-  login(ctx: StateContext<AuthStateModel>, { identifier, password }: Login): import("rxjs").Observable<UserDto | null>;
-  logout(ctx: StateContext<AuthStateModel>): void;
-  restore(ctx: StateContext<AuthStateModel>): void;
-  setTokens(ctx: StateContext<AuthStateModel>, { response }: SetTokens): void;
-  patchCurrentUser(ctx: StateContext<AuthStateModel>, { patch }: PatchCurrentUser): void;
-  static isAuthenticated(state: AuthStateModel): boolean;
-  static accessToken(state: AuthStateModel): string | null;
-  static refreshToken(state: AuthStateModel): string | null;
-  /**
-   * Sub-phase Y -- expose the access-token expiry timestamp so
-   * preemptive-refresh callers (e.g., Centrifuge getToken
-   * callbacks) can decide whether to rotate before issuing the
-   * next protected request, instead of relying on the
-   * interceptor's reactive 401-retry path.
-   */
-  static expiresAt(state: AuthStateModel): string | null;
-  static currentUser(state: AuthStateModel): UserDto | null;
-  static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class PatchCurrentUser {
+    readonly patch: Partial<UserDto>;
+    static readonly type = "[Auth] Patch Current User";
+    constructor(patch: Partial<UserDto>);
+}
+
+interface AuthStateModel {
+    accessToken: string | null;
+    refreshToken: string | null;
+    expiresAt: string | null;
+    user: UserDto | null;
+}
+declare class AuthState {
+    private readonly api;
+    private readonly prefs;
+    login(ctx: StateContext<AuthStateModel>, { identifier, password }: Login): rxjs.Observable<UserDto | null>;
+    logout(ctx: StateContext<AuthStateModel>): void;
+    restore(ctx: StateContext<AuthStateModel>): void;
+    setTokens(ctx: StateContext<AuthStateModel>, { response }: SetTokens): void;
+    patchCurrentUser(ctx: StateContext<AuthStateModel>, { patch }: PatchCurrentUser): void;
+    static isAuthenticated(state: AuthStateModel): boolean;
+    static accessToken(state: AuthStateModel): string | null;
+    static refreshToken(state: AuthStateModel): string | null;
+    /**
+     * Sub-phase Y -- expose the access-token expiry timestamp so
+     * preemptive-refresh callers (e.g., Centrifuge getToken
+     * callbacks) can decide whether to rotate before issuing the
+     * next protected request, instead of relying on the
+     * interceptor's reactive 401-retry path.
+     */
+    static expiresAt(state: AuthStateModel): string | null;
+    static currentUser(state: AuthStateModel): UserDto | null;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Protects routes that require authentication.
  *
@@ -607,8 +645,15 @@ export declare class AuthState {
  * will have placed a non-null (but expired) token in state, causing the guard
  * to pass even though the subsequent config/refresh requests will fail and
  * dispatch Logout.  Waiting for ready$ guarantees the auth state is settled.
+ *
+ * Signed in is not enough: the console is granted, and the server says to whom
+ * (ConsoleAccessService). An account it refuses -- a customer who registered on the
+ * public site -- is signed out of this sign-in, on the server as well as here, and
+ * sent to the login page, which says why. A failure to ask is not a refusal: the console opens, and every request it
+ * makes is still decided by the server.
  */
-export declare const authGuard: CanActivateFn;
+declare const authGuard: CanActivateFn;
+
 /**
  * Guards the `/login` route -- redirects already-authenticated
  * callers to admin home so a stale tab parked on `/login` cannot
@@ -624,9 +669,11 @@ export declare const authGuard: CanActivateFn;
  * as anonymous, allow `/login`, and only then have the token
  * populated.
  */
-export declare const loginPageGuard: CanActivateFn;
-export declare const BYPASS_AUTH: HttpContextToken<boolean>;
-export declare const authInterceptor: HttpInterceptorFn;
+declare const loginPageGuard: CanActivateFn;
+
+declare const BYPASS_AUTH: HttpContextToken<boolean>;
+declare const authInterceptor: HttpInterceptorFn;
+
 /**
  * Two-layer refresh coordinator: an intra-tab `shareReplay(1)`
  * mutex dedupes concurrent callers within one tab, and a
@@ -671,62 +718,63 @@ export declare const authInterceptor: HttpInterceptorFn;
  *     made is never replayed with the token it consumed. A 401 there
  *     is the session's end: `Logout`.
  */
-export declare class AuthRefreshCoordinator {
-  private readonly api;
-  private readonly store;
-  private readonly router;
-  private inFlight;
-  /**
-   * Return the in-flight refresh Observable, or spawn a new one
-   * with the supplied refresh-token value.
-   *
-   * `refusedAccessToken`: the access token the server just answered
-   * 401 to, when the caller is answering one. With it, the lock body
-   * refreshes unless the shared copy already holds another token;
-   * without it (a preemptive refresh), a fresh-looking cached token
-   * is handed back as before.
-   *
-   * Callers subscribe via `switchMap` / `firstValueFrom` to retry
-   * their original request with the resolved access token.
-   */
-  refresh(refreshToken: string, refusedAccessToken?: string | null): Observable<string>;
-  /**
-   * Run the refresh body inside `navigator.locks` when the API is
-   * available; degrade to direct invocation otherwise. The lock
-   * body checks for state already updated by a sibling tab before
-   * issuing its own HTTP call.
-   */
-  private refreshWithCrossTabLock;
-  /**
-   * Lock body. Re-reads the shared copy first (see the class note).
-   *
-   * Answering a refusal: a shared access token other than the refused
-   * one is a rotation already made -- taken, and mirrored into this
-   * tab's state if its `storage` event has not arrived yet. Otherwise,
-   * or for a preemptive caller whose cached token no longer looks
-   * fresh, the HTTP refresh, with the newest refresh token: shared,
-   * then state, then the caller's.
-   */
-  private executeRefresh;
-  /**
-   * The session as the tabs share it, or null when there is none to
-   * read: no storage, nothing stored (signed out), or a value that is
-   * not a complete token set.
-   */
-  private readShared;
-  /**
-   * For a preemptive caller only: return the current access token when
-   * its expiry is more than `FRESH_TOKEN_GRACE_MS` milliseconds away --
-   * signalling that some other tab refreshed for us. The shared copy
-   * first, which a sibling's rotation reaches before this tab's state
-   * does (mirrored here when it is newer); this tab's state when there
-   * is none. Null otherwise. Never asked for a token the server
-   * refused: a refused token's expiry looks just as fresh.
-   */
-  private tryConsumeFreshState;
-  static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class AuthRefreshCoordinator {
+    private readonly api;
+    private readonly store;
+    private readonly router;
+    private inFlight;
+    /**
+     * Return the in-flight refresh Observable, or spawn a new one
+     * with the supplied refresh-token value.
+     *
+     * `refusedAccessToken`: the access token the server just answered
+     * 401 to, when the caller is answering one. With it, the lock body
+     * refreshes unless the shared copy already holds another token;
+     * without it (a preemptive refresh), a fresh-looking cached token
+     * is handed back as before.
+     *
+     * Callers subscribe via `switchMap` / `firstValueFrom` to retry
+     * their original request with the resolved access token.
+     */
+    refresh(refreshToken: string, refusedAccessToken?: string | null): Observable<string>;
+    /**
+     * Run the refresh body inside `navigator.locks` when the API is
+     * available; degrade to direct invocation otherwise. The lock
+     * body checks for state already updated by a sibling tab before
+     * issuing its own HTTP call.
+     */
+    private refreshWithCrossTabLock;
+    /**
+     * Lock body. Re-reads the shared copy first (see the class note).
+     *
+     * Answering a refusal: a shared access token other than the refused
+     * one is a rotation already made -- taken, and mirrored into this
+     * tab's state if its `storage` event has not arrived yet. Otherwise,
+     * or for a preemptive caller whose cached token no longer looks
+     * fresh, the HTTP refresh, with the newest refresh token: shared,
+     * then state, then the caller's.
+     */
+    private executeRefresh;
+    /**
+     * The session as the tabs share it, or null when there is none to
+     * read: no storage, nothing stored (signed out), or a value that is
+     * not a complete token set.
+     */
+    private readShared;
+    /**
+     * For a preemptive caller only: return the current access token when
+     * its expiry is more than `FRESH_TOKEN_GRACE_MS` milliseconds away --
+     * signalling that some other tab refreshed for us. The shared copy
+     * first, which a sibling's rotation reaches before this tab's state
+     * does (mirrored here when it is newer); this tab's state when there
+     * is none. Null otherwise. Never asked for a token the server
+     * refused: a refused token's expiry looks just as fresh.
+     */
+    private tryConsumeFreshState;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Bridges shared `localStorage` mutations into the NGXS auth
  * state so a refresh executed in one tab silently propagates to
@@ -751,14 +799,15 @@ export declare class AuthRefreshCoordinator {
  * Started from `AppInitService.load()` so the listener is in
  * place before any protected HTTP fires.
  */
-export declare class CrossTabAuthSyncService {
-  private readonly store;
-  private listenerAttached;
-  start(): void;
-  private readonly handleStorageEvent;
-  static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class CrossTabAuthSyncService {
+    private readonly store;
+    private listenerAttached;
+    start(): void;
+    private readonly handleStorageEvent;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * The elevation state of the signed-in session: the wire shape of
  * `GET /auth/elevation`, returned again by `POST` on a grant.
@@ -769,74 +818,76 @@ export declare class CrossTabAuthSyncService {
  * capability flags are the two readings of ONE server-side decision, and the
  * client keeps no third.
  */
-export interface ElevationState {
-  /** Whether this session is elevated right now. */
-  elevated: boolean;
-  /** When the current elevation ends (ISO 8601); absent or null when not elevated. */
-  expiresAt?: string | null;
-  /** When the current elevation was granted (ISO 8601); absent or null when not elevated. */
-  grantedAt?: string | null;
-  /** How the LAST elevation of this session ended. Rendered by the prompt before it asks. */
-  ended: ElevationEnded;
-  /** The lifetime a grant made now would get, in seconds (the setting, clamped to the ceiling). */
-  lifetimeSeconds: number;
-  /** The most any elevation can last, fixed in code. */
-  lifetimeCeilingSeconds: number;
-  /** Whether the CURRENT elevation was confirmed by a second factor; absent or null when not elevated. */
-  factorConfirmed?: boolean | null;
-  /** Whether a grant made now must carry a code from the admin authenticator. */
-  mfaRequired: boolean;
-  /** What the prompt shows before asking; two of the codes mean the installation cannot elevate yet. */
-  warnings: ElevationWarning[];
+interface ElevationState {
+    /** Whether this session is elevated right now. */
+    elevated: boolean;
+    /** When the current elevation ends (ISO 8601); absent or null when not elevated. */
+    expiresAt?: string | null;
+    /** When the current elevation was granted (ISO 8601); absent or null when not elevated. */
+    grantedAt?: string | null;
+    /** How the LAST elevation of this session ended. Rendered by the prompt before it asks. */
+    ended: ElevationEnded;
+    /** The lifetime a grant made now would get, in seconds (the setting, clamped to the ceiling). */
+    lifetimeSeconds: number;
+    /** The most any elevation can last, fixed in code. */
+    lifetimeCeilingSeconds: number;
+    /** Whether the CURRENT elevation was confirmed by a second factor; absent or null when not elevated. */
+    factorConfirmed?: boolean | null;
+    /** Whether a grant made now must carry a code from the person's own authenticator. */
+    mfaRequired: boolean;
+    /** What the prompt shows before asking; two of the codes mean this account cannot elevate yet. */
+    warnings: ElevationWarning[];
 }
 /**
  * `closed` is the beacon (the panel was closed or reloaded), `dropped_by_user`
  * the explicit drop, `refresh_from_other_pair` the server's refresh tripwire,
  * `never` a session that has not elevated yet.
  */
-export type ElevationEndedReason = 'expired' | 'closed' | 'dropped_by_user' | 'refresh_from_other_pair' | 'never';
-export interface ElevationEnded {
-  reason: ElevationEndedReason;
-  /** ISO 8601, null for `never`. */
-  at: string | null;
+type ElevationEndedReason = 'expired' | 'closed' | 'dropped_by_user' | 'refresh_from_other_pair' | 'never';
+interface ElevationEnded {
+    reason: ElevationEndedReason;
+    /** ISO 8601, null for `never`. */
+    at: string | null;
 }
 /**
- * `elevation.password_not_set` and `elevation.factor_missing` mean the
- * installation cannot elevate and the message names the server command;
+ * `elevation.password_not_set` and `elevation.factor_missing` mean this
+ * account cannot elevate (it has no password, or no confirmed factor, of its
+ * own) and the message says which;
  * `elevation.mfa_off` is the recommendation carried while the switch is off.
  */
-export interface ElevationWarning {
-  /** The three the server documents today; the client renders any it does not know as text. */
-  code: string;
-  message: string;
-}
-export declare const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
-export declare const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
-export declare const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
+interface ElevationWarning {
+    /** The three the server documents today; the client renders any it does not know as text. */
+    code: string;
+    message: string;
+}
+declare const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
+declare const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
+declare const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
 /** Why the elevation of a session changed, for whoever refetches on it. */
-export type ElevationChangeKind = 'granted' | 'dropped' | 'expired' | 'observed';
-export interface ElevationChange {
-  kind: ElevationChangeKind;
-  state: ElevationState;
+type ElevationChangeKind = 'granted' | 'dropped' | 'expired' | 'observed';
+interface ElevationChange {
+    kind: ElevationChangeKind;
+    state: ElevationState;
 }
 /** The two reasons the client sends when it drops an elevation itself. */
-export type ElevationDropReason = 'dropped_by_user' | 'closed';
+type ElevationDropReason = 'dropped_by_user' | 'closed';
+
 /**
  * What the elevation prompt is told when it opens.
  *
  * `state` is the server's answer at the moment of asking -- `ended.reason` is
  * rendered first (a person asked for a password again after F5
- * with no explanation reads it as a fault), `warnings` may say the
- * installation cannot elevate yet, `mfaRequired` decides whether a code field
+ * with no explanation reads it as a fault), `warnings` may say this
+ * account cannot elevate yet, `mfaRequired` decides whether a code field
  * shows from the start.
  *
  * `refusal` is the server's own sentence for the action that was refused
  * ("Permission denied: cannot write '/docs/...'"), when a 403 opened the
  * prompt; absent when a disabled control offered elevation instead.
  */
-export interface ElevationPromptRequest {
-  state: ElevationState;
-  refusal?: string;
+interface ElevationPromptRequest {
+    state: ElevationState;
+    refusal?: string;
 }
 /**
  * The prompt itself is a dialog, and dialogs are the kit's -- a layer above
@@ -849,21 +900,40 @@ export interface ElevationPromptRequest {
  * false when the person declined or could not. The port does not retry the
  * refused action; the interceptor does, on true.
  */
-export interface ElevationPromptPort {
-  open(request: ElevationPromptRequest): Observable<boolean>;
+interface ElevationPromptPort {
+    open(request: ElevationPromptRequest): Observable<boolean>;
 }
 /**
  * Optional by design: with nothing bound, a 403 stays a 403 and the state
  * service still answers -- an application without an admin panel has no
  * prompt to show and loses nothing.
  */
-export declare const ELEVATION_PROMPT: InjectionToken<ElevationPromptPort>;
+declare const ELEVATION_PROMPT: InjectionToken<ElevationPromptPort>;
+/**
+ * Told when an action a person took was refused for want of elevation: a
+ * write (not a read, not a background request) answered by a stamped 403.
+ *
+ * It must not open the prompt. The prompt opens only when the person asks for
+ * it -- the application shows the refusal and offers elevation as something to
+ * click (a notice with an Elevate button), and the click is what calls
+ * {@link ElevationService.offerFor}. A refused action is not repeated by
+ * itself after a grant: the person repeats it.
+ *
+ * `refusal` is the server's sentence for the refused action, already made
+ * readable by the error service.
+ */
+interface ElevationNoticePort {
+    refused(refusal: string): void;
+}
+/** Optional, like {@link ELEVATION_PROMPT}: with nothing bound, a refusal is only a 403. */
+declare const ELEVATION_NOTICE: InjectionToken<ElevationNoticePort>;
+
 /**
  * Set on a request that must never open the elevation prompt: the elevation
  * endpoint's own calls (a wrong password is a 403 and is not a refused action),
  * and any caller that would rather receive its 403 and decide for itself.
  */
-export declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
+declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
 /**
  * The elevation state of this session, read from ONE place: the server.
  *
@@ -899,220 +969,302 @@ export declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
  * whose refusal came from the VFS permission service under another module's
  * path (media, document and word templates, content distribution).
  */
-export declare const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
-export declare class ElevationService {
-  private readonly http;
-  private readonly store;
-  private readonly prompt;
-  private readonly destroyRef;
-  /** The last answer the server gave, exactly as it gave it. */
-  private readonly served;
-  /**
-   * The state as it stands NOW; null until the first read from the server.
-   *
-   * Deliberately NOT a `computed`. A cached derivation is only recomputed
-   * when one of its dependencies changes, and nothing changes when an
-   * elevation simply runs out -- so it would keep answering `elevated: true`
-   * past the moment the server itself named, for as long as the machine
-   * happened to be asleep.
-   *
-   * Reading past `expiresAt` also demotes the STORED answer. The value
-   * returned here is already correct without that write; the write is only
-   * how cached readers (a `computed`, an OnPush template) find out.
-   */
-  readonly state: () => ElevationState | null;
-  /** Convenience over `state`: false until the server has said otherwise. */
-  readonly elevated: () => boolean;
-  /** `expiresAt` as a Date, null when not elevated. */
-  readonly expiresAt: () => Date | null;
-  /**
-   * Every change of elevation state: a grant, a drop (by this person, by the
-   * beacon, by the tripwire), an expiry, or an observed change of a live
-   * grant's `expiresAt`. A refresh that reports the same state emits nothing,
-   * so subscribers that refetch a listing on it never refetch for no reason.
-   */
-  readonly changes$: Subject<ElevationChange>;
-  private expiryTimer;
-  private pendingPrompt;
-  private expiryAnnouncePending;
-  private lastReconcileAt;
-  constructor();
-  /** The manifest carries the URL; without it the service is inert, not broken. */
-  get available(): boolean;
-  private get url();
-  /**
-   * Whether a URL belongs to THIS API: a relative one under the manifest's
-   * `apiBase`, or an absolute one on this origin under it. The interceptor
-   * acts on a stamped refusal from here and from nowhere else -- a third
-   * party answering 403 with a header of the same name is not an invitation
-   * to elevate this session.
-   */
-  isThisApi(url: string): boolean;
-  /** Ask the server. Applies the answer and announces it when it differs. */
-  refresh(): Observable<ElevationState>;
-  /**
-   * Elevate with the admin password and, when the switch is on, a code from
-   * the admin authenticator. Errors are the dialog's to branch on: 403 wrong
-   * password or wrong / replayed code, 428 a code is required, 409 the
-   * installation cannot elevate yet, 429 throttled. They pass through
-   * untouched, and never open the prompt (BYPASS_ELEVATION).
-   */
-  elevate(password: string, code?: string): Observable<ElevationState>;
-  /** Drop the elevation now. Idempotent on the server: nothing live is still a 204. */
-  drop(reason?: ElevationDropReason): Observable<ElevationState>;
-  /**
-   * What the interceptor calls on a 403: ask the server whether this session
-   * is elevated, and only when it is not, offer the prompt. A 403 while
-   * elevated is a real refusal -- elevation would not change it -- and is
-   * handed back as such (false, no prompt).
-   */
-  offerFor(refusal?: string): Observable<boolean>;
-  /**
-   * Open the prompt, or join the one already open. Resolves to whether the
-   * session is elevated once the dialog closes.
-   */
-  requestElevation(request: ElevationPromptRequest): Observable<boolean>;
-  private options;
-  private inert;
-  /**
-   * Store the answer, schedule the expiry read, announce a change.
-   *
-   * `explicit` names the change when the caller knows it (a grant). For a
-   * plain refresh the kind is derived from the two states: elevated -> not
-   * is `expired` when the server says so and `dropped` otherwise (the person,
-   * another tab, the beacon, the tripwire); not -> elevated is a grant seen
-   * from another tab; a live grant whose `expiresAt` moved is `observed`.
-   *
-   * `prev` is read RAW rather than through `state()`: the demotion is not
-   * wanted here (this answer supersedes the stored one either way), and a
-   * read that demoted would queue an expiry announcement the server's own
-   * answer is about to make.
-   */
-  private apply;
-  private kindOf;
-  /**
-   * Tell the listings that this session's elevation ran out, once, and NOT
-   * from inside the read that noticed: a subscriber refetches on this, and a
-   * refetch started in the middle of a change detection pass is a write
-   * during a read. The microtask runs at the end of the current task, before
-   * anything can paint.
-   *
-   * A server answer arriving first clears the flag, so the announcement is
-   * made by whichever of the two got there first, never by both. Other tabs
-   * are NOT told: each one reaches the same conclusion from the same
-   * `expiresAt` on its own read, so the storage write would only buy a
-   * thundering herd of GETs.
-   */
-  private announceExpiryLater;
-  /**
-   * Ask the server again at `expiresAt` -- an OPTIMISATION, not the
-   * mechanism. `state()` already reports an elapsed grant as expired without
-   * being told, so a timer that a sleeping machine swallows, or that a
-   * background tab throttles to once a minute, now costs freshness rather
-   * than correctness. What it buys is the listing refetch happening at the
-   * moment of expiry instead of at the next read.
-   *
-   * Do not flip a local flag here: the lifetime counts from the grant on the
-   * server's clock, and if the server still says elevated at that moment
-   * (skew), the honest thing is to ask again shortly.
-   */
-  private schedule;
-  /**
-   * One more attempt, then stop. Giving up is affordable now and was not
-   * before: the state a failed read leaves behind is still read through the
-   * arithmetic above, so an unreachable server cannot leave this tab
-   * believing it is elevated. What is lost is only news from elsewhere -- a
-   * grant or a drop in another session -- and that is what the tab picks up
-   * when it next comes into view.
-   */
-  private scheduleRetry;
-  private clearTimer;
-  private announceToOtherTabs;
-  private readonly onStorage;
-  private readonly onFocus;
-  private readonly onVisibilityChange;
-  /**
-   * The tab is back. Read first -- that alone ends an elevation that ran out
-   * while it was away, with no request and no network to depend on -- then
-   * ask the server for what the read cannot know: a grant or a drop made
-   * elsewhere, or a lifetime the server moved.
-   */
-  private reconcile;
-  static ɵfac: i0.ɵɵFactoryDeclaration<ElevationService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
 /**
- * The elevation prompt hangs off the 403, not off the listing's flags
- * (the elevation client requirement, point 1) -- and off the 403 that SAYS it
- * was refused for want of elevation: the server stamps `X-Elevation-Required`
- * with the gate's name where its gate refused a member who has not elevated.
- * Any route of this API can carry it -- the VFS, a media asset's
- * permissions, a document template, an account's deletion -- so nothing here
- * lists URLs; the list that stood here lagged the server by every route whose
- * refusal came from the VFS permission service under another module's path.
- *
- * On the stamp: ask the server whether this session is elevated, and only when
- * it is NOT open the prompt; on a grant send the refused request again, once.
- * A 403 without the stamp is a refusal for another reason and is handed back
- * as it came; so are a 403 while elevated, a declined prompt, and an
- * installation that cannot elevate -- nothing here swallows a refusal. A
- * stamped 403 from anywhere but this API is ignored: the header is the
- * server's word, and only this server's counts.
- *
- * Order in the chain: BEFORE the auth interceptor, so the retry re-enters it
- * and carries the token current at that moment (the prompt may have outlived
- * a refresh). The elevation endpoint's own calls carry BYPASS_ELEVATION: a
- * wrong password is a 403 and is not a refused action.
+ * Set on a request no person asked for: a realtime token, a preferences sync, a
+ * poll. Its refusal is never announced -- not by a dialog and not by a notice --
+ * because nobody is waiting on it and nobody can act on it. The caller still
+ * receives the 403 and decides what its own state shows.
  */
-export declare const elevationInterceptor: HttpInterceptorFn;
-export declare class LoginComponent {
-  identifier: string;
-  password: string;
-  loading: boolean;
-  error: string | null;
-  private readonly store;
-  private readonly router;
-  submit(): void;
-  static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
-  static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
-}
-export declare class AppInitService {
-  private readonly http;
-  private readonly store;
-  private readonly router;
-  private readonly location;
-  private readonly prefs;
-  private readonly crossTabSync;
-  private readonly refreshCoordinator;
-  /** The only hardcoded URL -- everything else comes from the manifest. */
-  private readonly configUrl;
-  /**
-   * Emits (once) when load() has fully completed -- tokens settled, manifest
-   * set (or swallowed on error).  authGuard subscribes to this so it never
-   * evaluates isAuthenticated against a partially-restored stale token.
-   */
-  private readonly initComplete;
-  readonly ready$: import("rxjs").Observable<void>;
-  load(): Promise<void>;
-  /**
-   * Confirm the restored session is still alive, settling AuthState before the
-   * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
-   * interceptor queues behind ready$, which has not fired yet at this point.
-   *
-   *   - access token accepted  -> done, session alive;
-   *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
-   *                              so an expired one with a valid refresh token must
-   *                              stay logged in). The coordinator dispatches Logout
-   *                              on a refresh 401 and SetTokens on success; a
-   *                              transient failure (5xx/network) is swallowed so a
-   *                              momentary blip never kills a valid session.
-   */
-  private validateSession;
-  /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
-  private probe;
-  static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare const BACKGROUND_REQUEST: HttpContextToken<boolean>;
+/**
+ * Whether a failed request was refused for want of elevation: a 403 carrying
+ * the server's stamp. The one test every reader of a refusal uses -- the
+ * interceptor, a page's inline state, the error text -- so they cannot disagree.
+ */
+declare function isElevationRefusal(err: unknown): boolean;
+declare class ElevationService {
+    private readonly http;
+    private readonly store;
+    private readonly prompt;
+    private readonly destroyRef;
+    /** The last answer the server gave, exactly as it gave it. */
+    private readonly served;
+    /**
+     * The state as it stands NOW; null until the first read from the server.
+     *
+     * Deliberately NOT a `computed`. A cached derivation is only recomputed
+     * when one of its dependencies changes, and nothing changes when an
+     * elevation simply runs out -- so it would keep answering `elevated: true`
+     * past the moment the server itself named, for as long as the machine
+     * happened to be asleep.
+     *
+     * Reading past `expiresAt` also demotes the STORED answer. The value
+     * returned here is already correct without that write; the write is only
+     * how cached readers (a `computed`, an OnPush template) find out.
+     */
+    readonly state: () => ElevationState | null;
+    /** Convenience over `state`: false until the server has said otherwise. */
+    readonly elevated: () => boolean;
+    /** `expiresAt` as a Date, null when not elevated. */
+    readonly expiresAt: () => Date | null;
+    /**
+     * Every change of elevation state: a grant, a drop (by this person, by the
+     * beacon, by the tripwire), an expiry, or an observed change of a live
+     * grant's `expiresAt`. A refresh that reports the same state emits nothing,
+     * so subscribers that refetch a listing on it never refetch for no reason.
+     */
+    readonly changes$: Subject<ElevationChange>;
+    private expiryTimer;
+    private pendingPrompt;
+    private expiryAnnouncePending;
+    private lastReconcileAt;
+    constructor();
+    /** The manifest carries the URL; without it the service is inert, not broken. */
+    get available(): boolean;
+    private get url();
+    /**
+     * Whether a URL belongs to THIS API: a relative one under the manifest's
+     * `apiBase`, or an absolute one on this origin under it. The interceptor
+     * acts on a stamped refusal from here and from nowhere else -- a third
+     * party answering 403 with a header of the same name is not an invitation
+     * to elevate this session.
+     */
+    isThisApi(url: string): boolean;
+    /** Ask the server. Applies the answer and announces it when it differs. */
+    refresh(): Observable<ElevationState>;
+    /**
+     * Elevate with the person's own password and, when the switch is on, a
+     * code from their own authenticator. Errors are the dialog's to branch on:
+     * 403 not a member of the admin group, wrong password, or wrong / replayed
+     * code, 428 a code is required, 409 this account cannot elevate yet, 429
+     * throttled. They pass through
+     * untouched, and never open the prompt (BYPASS_ELEVATION).
+     */
+    elevate(password: string, code?: string): Observable<ElevationState>;
+    /** Drop the elevation now. Idempotent on the server: nothing live is still a 204. */
+    drop(reason?: ElevationDropReason): Observable<ElevationState>;
+    /**
+     * What a person's explicit request for elevation calls -- an Elevate button,
+     * or a control that already knows its action needs elevation: ask the
+     * server whether this session is elevated, and only when it is not, open
+     * the prompt. Nothing calls it on a response by itself (the interceptor
+     * only tells {@link ELEVATION_NOTICE}). Elevated already is false, no
+     * prompt: elevation would change nothing.
+     */
+    offerFor(refusal?: string): Observable<boolean>;
+    /**
+     * Open the prompt, or join the one already open. Resolves to whether the
+     * session is elevated once the dialog closes.
+     */
+    requestElevation(request: ElevationPromptRequest): Observable<boolean>;
+    private options;
+    private inert;
+    /**
+     * Store the answer, schedule the expiry read, announce a change.
+     *
+     * `explicit` names the change when the caller knows it (a grant). For a
+     * plain refresh the kind is derived from the two states: elevated -> not
+     * is `expired` when the server says so and `dropped` otherwise (the person,
+     * another tab, the beacon, the tripwire); not -> elevated is a grant seen
+     * from another tab; a live grant whose `expiresAt` moved is `observed`.
+     *
+     * `prev` is read RAW rather than through `state()`: the demotion is not
+     * wanted here (this answer supersedes the stored one either way), and a
+     * read that demoted would queue an expiry announcement the server's own
+     * answer is about to make.
+     */
+    private apply;
+    private kindOf;
+    /**
+     * Tell the listings that this session's elevation ran out, once, and NOT
+     * from inside the read that noticed: a subscriber refetches on this, and a
+     * refetch started in the middle of a change detection pass is a write
+     * during a read. The microtask runs at the end of the current task, before
+     * anything can paint.
+     *
+     * A server answer arriving first clears the flag, so the announcement is
+     * made by whichever of the two got there first, never by both. Other tabs
+     * are NOT told: each one reaches the same conclusion from the same
+     * `expiresAt` on its own read, so the storage write would only buy a
+     * thundering herd of GETs.
+     */
+    private announceExpiryLater;
+    /**
+     * Ask the server again at `expiresAt` -- an OPTIMISATION, not the
+     * mechanism. `state()` already reports an elapsed grant as expired without
+     * being told, so a timer that a sleeping machine swallows, or that a
+     * background tab throttles to once a minute, now costs freshness rather
+     * than correctness. What it buys is the listing refetch happening at the
+     * moment of expiry instead of at the next read.
+     *
+     * Do not flip a local flag here: the lifetime counts from the grant on the
+     * server's clock, and if the server still says elevated at that moment
+     * (skew), the honest thing is to ask again shortly.
+     */
+    private schedule;
+    /**
+     * One more attempt, then stop. Giving up is affordable now and was not
+     * before: the state a failed read leaves behind is still read through the
+     * arithmetic above, so an unreachable server cannot leave this tab
+     * believing it is elevated. What is lost is only news from elsewhere -- a
+     * grant or a drop in another session -- and that is what the tab picks up
+     * when it next comes into view.
+     */
+    private scheduleRetry;
+    private clearTimer;
+    private announceToOtherTabs;
+    private readonly onStorage;
+    private readonly onFocus;
+    private readonly onVisibilityChange;
+    /**
+     * The tab is back. Read first -- that alone ends an elevation that ran out
+     * while it was away, with no request and no network to depend on -- then
+     * ask the server for what the read cannot know: a grant or a drop made
+     * elsewhere, or a lifetime the server moved.
+     */
+    private reconcile;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ElevationService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
+/**
+ * A refusal for want of elevation is a 403 the server stamps `X-Elevation-Required`
+ * where its gate refused a member who has not elevated ({@link isElevationRefusal}).
+ * This interceptor never opens the elevation prompt. The prompt opens only when a
+ * person asks for it: an Elevate button, or an action whose control already knows it
+ * needs elevation and offers it ({@link ElevationService.offerFor}).
+ *
+ * What it does with a stamped 403:
+ * - On a write a person made (POST, PUT, PATCH, DELETE without
+ *   {@link BACKGROUND_REQUEST}): tells {@link ELEVATION_NOTICE}, which shows the
+ *   refusal with an Elevate button. The request is not held and not repeated; the
+ *   caller receives the 403 at once, and after elevating the person repeats the action.
+ * - On a read: nothing. Reads are what a page makes as it loads and what polls make in
+ *   the background, and the page shows its own state for a refused one -- an inline
+ *   "needs an elevated session" with an Elevate button, or the feature hidden.
+ * - On a background request: nothing. Nobody is waiting on it.
+ *
+ * Until 2026-10-08 any stamped 403 opened the prompt, so the setup reads of almost every
+ * console page, and a realtime token at every load, opened it for an administrator who
+ * had not elevated: 13 of 15 pages on a menu click, 15 of 15 on a reload (measured).
+ *
+ * The elevation endpoint's own calls carry {@link BYPASS_ELEVATION}: a wrong password is a
+ * 403 and is not a refused action. A stamped 403 from anywhere but this API is ignored:
+ * the header is the server's word, and only this server's counts.
+ */
+declare const elevationInterceptor: HttpInterceptorFn;
+
+declare class LoginComponent {
+    identifier: string;
+    password: string;
+    readonly loading: i0.WritableSignal<boolean>;
+    readonly error: i0.WritableSignal<string | null>;
+    private readonly store;
+    private readonly router;
+    /** Shown when the guard signed an account out because the console is not granted to it. */
+    static readonly NO_CONSOLE_ACCESS = "This account has no access to the console.";
+    constructor();
+    submit(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
+}
+
+declare class AppInitService {
+    private readonly http;
+    private readonly store;
+    private readonly router;
+    private readonly location;
+    private readonly prefs;
+    private readonly crossTabSync;
+    private readonly refreshCoordinator;
+    /** The only hardcoded URL -- everything else comes from the manifest. */
+    private readonly configUrl;
+    /**
+     * Emits (once) when load() has fully completed -- tokens settled, manifest
+     * set (or swallowed on error).  authGuard subscribes to this so it never
+     * evaluates isAuthenticated against a partially-restored stale token.
+     */
+    private readonly initComplete;
+    readonly ready$: rxjs.Observable<void>;
+    load(): Promise<void>;
+    /**
+     * Confirm the restored session is still alive, settling AuthState before the
+     * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
+     * interceptor queues behind ready$, which has not fired yet at this point.
+     *
+     *   - access token accepted  -> done, session alive;
+     *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
+     *                              so an expired one with a valid refresh token must
+     *                              stay logged in). The coordinator dispatches Logout
+     *                              on a refresh 401 and SetTokens on success; a
+     *                              transient failure (5xx/network) is swallowed so a
+     *                              momentary blip never kills a valid session.
+     */
+    private validateSession;
+    /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
+    private probe;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
+/** What the server said about this sign-in and the console. */
+type ConsoleAccess = 'granted' | 'refused' | 'unknown';
+/**
+ * Whether the signed-in account may use the console, and the console's endpoint
+ * map when it may.
+ *
+ * The server decides: `GET /api/v1/admin/manifest` answers the map. Since 2026-10-06
+ * (Dmitry: "no host groups"; access is decided by module groups alone) it answers every
+ * signed-in account: the map grants nothing, each call it names is decided by its own
+ * route, and an account in no group sees the admin with an empty menu. A server from
+ * before that answers only at `/api/v1/console/manifest`, to the `console` group, and
+ * 403 to anyone else -- there a refused sign-in is still signed out; this asks the new
+ * address first and the old one only on its 404. The public theme config
+ * read before sign-in carries only what the sign-in page needs; the rest arrives
+ * here, once per sign-in, and is merged into the app config key by key: a key the
+ * console's map carries replaces the public one whole, so the console's copy of a
+ * section is always the complete one.
+ *
+ * `unknown` is a failure to ask (the network, a 5xx), not an answer: it is not kept,
+ * so while the endpoint fails every navigation asks again.
+ *
+ * !! An answer belongs to the sign-in it was asked for. A sign-in, a sign-out or a
+ * restored session starts a new generation; an answer that arrives for a generation
+ * that is gone is kept for nobody -- A's late 403 must not sign B out -- and whoever
+ * is waiting on it is answered for the sign-in there is now.
+ *
+ * !! With nobody signed in there is nothing to ask, and nothing is asked. Without
+ * that, the re-ask after a sign-out went out with no token, its 401 made the
+ * interceptor dispatch Logout, which started another generation, which re-asked:
+ * a loop for as long as the tab lived (found in review).
+ */
+declare class ConsoleAccessService {
+    /** The admin manifest's URL: fixed, like the theme config's, because nothing is known before it. */
+    static readonly URL = "/api/v1/admin/manifest";
+    /** The address before 2026-10-06, asked only when a server older than that answers 404 at {@link URL}. */
+    static readonly LEGACY_URL = "/api/v1/console/manifest";
+    /** The login page's query parameter value for "signed out: no console access". */
+    static readonly REFUSED_REASON = "no-console-access";
+    private readonly http;
+    private readonly store;
+    private answer;
+    private pending;
+    private generation;
+    constructor();
+    /** Ask once per sign-in; the manifest is merged into the app config when granted. */
+    ensure(): Promise<ConsoleAccess>;
+    /**
+     * Sign a refused account out: this sign-in ends on the server (its refresh token
+     * with it), as the account menu's sign-out does, and then in this browser --
+     * whatever the server answered, so a refused request cannot leave it signed in.
+     */
+    signOut(): Observable<void>;
+    private merge;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleAccessService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Layout config DTO -- the shape served from
  * `GET /api/v1/config/layout/{id}`. Mirrors the YAML at
@@ -1138,138 +1290,143 @@ export declare class AppInitService {
  * keys (e.g. `media:library`'s `naviGraph:` slot shorthand) keep working
  * without further interface changes.
  */
-export interface LayoutHeaderAction {
-  id: string;
-  label?: string;
-  icon?: string;
-  title?: string;
-  primary?: boolean;
-  danger?: boolean;
-  disabled?: boolean;
-  /**
-   * Optional capability gate evaluated FE-side against runtime state
-   * (e.g. `administer` / `delete`) -- the config declares WHICH actions
-   * exist + their gate; the FE decides if THIS user/row qualifies. Absent
-   * = always shown. Used by detail pages whose actions are config-driven
-   * (see `web:section-detail`).
-   *
-   * For a gate that depends on the RECORD rather than the user, prefer
-   * `showWhen` below: `requires` needs a page to interpret the token, so
-   * every new value costs a branch in TypeScript.
-   */
-  requires?: string;
-  /**
-   * Conditions on the page's published context, same grammar and same
-   * evaluator as a NaviGraph toolbar node, applied
-   * by {@link LayoutActionsService}:
-   *
-   *   showWhen     -- the action does not APPLY, so it is absent.
-   *   disabledWhen -- temporarily UNAVAILABLE: stays put and greys out.
-   *   busyWhen     -- the action is RUNNING: greys out too, and may relabel.
-   *   busyLabel    -- label shown while `busyWhen` holds ("Saving...").
-   *   activeWhen   -- pressed/active styling.
-   *
-   * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
-   * a page that moves between them should not have to relearn how to say
-   * "not now".
-   */
-  showWhen?: Record<string, unknown>;
-  disabledWhen?: Record<string, unknown>;
-  busyWhen?: Record<string, unknown>;
-  busyLabel?: string;
-  activeWhen?: Record<string, unknown>;
-}
-export interface LayoutSection {
-  title?: string;
-  /**
-   * When true, the layout shell pins the section to the top of the
-   * scroll container (CSS `position: sticky`). Used by inspector /
-   * filter pages where an input form should stay visible while the
-   * operator scrolls through results below. Currently honoured by
-   * cms-inspector-layout; cms-detail-layout will follow when it
-   * lands. Default false.
-   */
-  sticky?: boolean;
-  slots?: Record<string, {
-    component?: string;
+interface LayoutHeaderAction {
+    id: string;
+    label?: string;
+    icon?: string;
+    title?: string;
+    primary?: boolean;
+    danger?: boolean;
+    disabled?: boolean;
+    /**
+     * Optional capability gate evaluated FE-side against runtime state
+     * (e.g. `administer` / `delete`) -- the config declares WHICH actions
+     * exist + their gate; the FE decides if THIS user/row qualifies. Absent
+     * = always shown. Used by detail pages whose actions are config-driven
+     * (see `web:section-detail`).
+     *
+     * For a gate that depends on the RECORD rather than the user, prefer
+     * `showWhen` below: `requires` needs a page to interpret the token, so
+     * every new value costs a branch in TypeScript.
+     */
+    requires?: string;
+    /**
+     * Conditions on the page's published context, same grammar and same
+     * evaluator as a NaviGraph toolbar node, applied
+     * by {@link LayoutActionsService}:
+     *
+     *   showWhen     -- the action does not APPLY, so it is absent.
+     *   disabledWhen -- temporarily UNAVAILABLE: stays put and greys out.
+     *   busyWhen     -- the action is RUNNING: greys out too, and may relabel.
+     *   busyLabel    -- label shown while `busyWhen` holds ("Saving...").
+     *   activeWhen   -- pressed/active styling.
+     *
+     * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
+     * a page that moves between them should not have to relearn how to say
+     * "not now".
+     */
+    showWhen?: Record<string, unknown>;
+    disabledWhen?: Record<string, unknown>;
+    busyWhen?: Record<string, unknown>;
+    busyLabel?: string;
+    activeWhen?: Record<string, unknown>;
+}
+interface LayoutSection {
+    title?: string;
+    /**
+     * When true, the layout shell pins the section to the top of the
+     * scroll container (CSS `position: sticky`). Used by inspector /
+     * filter pages where an input form should stay visible while the
+     * operator scrolls through results below. Currently honoured by
+     * cms-inspector-layout; cms-detail-layout will follow when it
+     * lands. Default false.
+     */
+    sticky?: boolean;
+    slots?: Record<string, {
+        component?: string;
+        [key: string]: unknown;
+    }>;
+    [key: string]: unknown;
+}
+interface LayoutConfig {
+    id?: string;
+    template?: string;
+    title?: string;
+    subtitle?: string;
+    icon?: string;
+    slots?: Record<string, unknown>;
+    sections?: Record<string, LayoutSection>;
+    headerActions?: LayoutHeaderAction[];
+    /**
+     * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
+     * -- primary / destructive actions kept out of the cramped header.
+     * Same shape as `headerActions`; gated per-item via `requires`.
+     */
+    footerActions?: LayoutHeaderAction[];
+    permissions?: string[];
+    [key: string]: unknown;
+}
+interface DialogConfig {
+    [key: string]: unknown;
+}
+interface NavigraphConfig {
+    [key: string]: unknown;
+}
+interface FormConfig {
+    [key: string]: unknown;
+}
+interface DatagridConfig {
     [key: string]: unknown;
-  }>;
-  [key: string]: unknown;
-}
-export interface LayoutConfig {
-  id?: string;
-  template?: string;
-  title?: string;
-  subtitle?: string;
-  icon?: string;
-  slots?: Record<string, unknown>;
-  sections?: Record<string, LayoutSection>;
-  headerActions?: LayoutHeaderAction[];
-  /**
-   * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
-   * -- primary / destructive actions kept out of the cramped header.
-   * Same shape as `headerActions`; gated per-item via `requires`.
-   */
-  footerActions?: LayoutHeaderAction[];
-  permissions?: string[];
-  [key: string]: unknown;
-}
-export interface DialogConfig {
-  [key: string]: unknown;
-}
-export interface NavigraphConfig {
-  [key: string]: unknown;
-}
-export interface FormConfig {
-  [key: string]: unknown;
-}
-export interface DatagridConfig {
-  [key: string]: unknown;
 }
 /**
  * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
  *
  * Responses are cached for the lifetime of the service (Map + shareReplay(1))
- * so repeated calls never re-fetch the same resource.
+ * so repeated calls never re-fetch the same resource. A failed read is dropped
+ * from the cache, so the next call asks the server again.
  *
  * configBase is read from the API manifest (manifest.configBase) and falls
  * back to '/api/v1/config' when the manifest is not yet loaded.
  */
-export declare class ConfigService {
-  private readonly http;
-  private readonly store;
-  private readonly cache;
-  layout(id: string): Observable<LayoutConfig>;
-  dialog(id: string): Observable<DialogConfig>;
-  navigraph(slug: string): Observable<NavigraphConfig>;
-  form(id: string): Observable<FormConfig>;
-  datagrid(id: string): Observable<DatagridConfig>;
-  private fetch;
-  static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-export declare class SetAppConfig {
-  readonly config: ThemeConfigResponse;
-  static readonly type = "[AppConfig] Set";
-  constructor(config: ThemeConfigResponse);
-}
-export interface AppConfigStateModel {
-  config: ThemeConfigResponse | null;
-  loaded: boolean;
-}
-export declare class AppConfigState {
-  set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
-  static manifest(state: AppConfigStateModel): ApiManifest | null;
-  /**
-   * The viewer manifest. Null when the backend didn't ship a viewers
-   * section (no tagged providers); consumers should fall back to a
-   * "no preview" surface.
-   */
-  static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
-  static loaded(state: AppConfigStateModel): boolean;
-  static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class ConfigService {
+    private readonly http;
+    private readonly store;
+    private readonly cache;
+    layout(id: string): Observable<LayoutConfig>;
+    dialog(id: string): Observable<DialogConfig>;
+    navigraph(slug: string): Observable<NavigraphConfig>;
+    form(id: string): Observable<FormConfig>;
+    datagrid(id: string): Observable<DatagridConfig>;
+    private fetch;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
+declare class SetAppConfig {
+    readonly config: ThemeConfigResponse;
+    static readonly type = "[AppConfig] Set";
+    constructor(config: ThemeConfigResponse);
+}
+interface AppConfigStateModel {
+    config: ThemeConfigResponse | null;
+    loaded: boolean;
+}
+declare class AppConfigState {
+    set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
+    /** The whole config as last set: the public theme config, with the console's manifest once granted. */
+    static config(state: AppConfigStateModel): ThemeConfigResponse | null;
+    static manifest(state: AppConfigStateModel): ApiManifest | null;
+    /**
+     * The viewer manifest. Null when the backend didn't ship a viewers
+     * section (no tagged providers); consumers should fall back to a
+     * "no preview" surface.
+     */
+    static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
+    static loaded(state: AppConfigStateModel): boolean;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Converts any caught error into a human-readable message.
  *
@@ -1280,16 +1437,17 @@ export declare class AppConfigState {
  *   4. error.violations[]        (constraint violations)
  *   5. Status-based fallback
  */
-export declare class ErrorHandlerService {
-  humanize(err: unknown): string;
-  private statusMessage;
-  static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+declare class ErrorHandlerService {
+    humanize(err: unknown): string;
+    private statusMessage;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
+
 /** What the user PICKED. `system` defers to the OS. */
-export type ThemeChoice = 'light' | 'dark' | 'system';
+type ThemeChoice = 'light' | 'dark' | 'system';
 /** What that resolves to right now -- the only two the stylesheet knows. */
-export type ResolvedTheme = 'light' | 'dark';
+type ResolvedTheme = 'light' | 'dark';
 /**
  * Applies the user's theme by setting `data-theme` on the document element.
  *
@@ -1303,77 +1461,78 @@ export type ResolvedTheme = 'light' | 'dark';
  * cached for the SPA lifetime, with `update()` called by the Profile page after
  * a save so the change lands without a refetch.
  */
-export declare class ThemeService {
-  private readonly api;
-  private readonly store;
-  private readonly _choice;
-  private readonly _systemDark;
-  private readonly _userAccent;
-  private readonly _platformAccent;
-  private loadOnce$?;
-  /** The user's stored choice, including `system`. */
-  readonly choice: import("@angular/core").Signal<ThemeChoice>;
-  /** This user's personal override, independent of the deployment's. */
-  readonly userAccent: import("@angular/core").Signal<string | null>;
-  /** The deployment's brand accent from the API manifest, if it set one. */
-  readonly platformAccent: import("@angular/core").Signal<string | null>;
-  /**
-   * The colour actually painted: personal override, else the deployment's,
-   * else null -- which leaves the stylesheet's own accent in place.
-   *
-   * Three rungs and each is a real state. A user who has chosen nothing is
-   * NOT the same as one who chose the deployment's colour: clear the
-   * deployment's brand and the first user follows it, the second does not.
-   */
-  readonly accent: import("@angular/core").Signal<string | null>;
-  /** The choice with `system` resolved against the OS setting. */
-  readonly resolved: import("@angular/core").Signal<ResolvedTheme>;
-  constructor();
-  /**
-   * One-shot load of the stored preference. Safe to call more than once and
-   * safe for anonymous users -- a failure leaves the cached/system value in
-   * place rather than forcing light, so the login screen still matches the OS.
-   */
-  ensureLoaded(): Observable<ThemeChoice>;
-  /**
-   * Called by the Profile page after the Preferences tab saves, so the admin
-   * re-themes on the spot. Ignores anything that is not a known choice --
-   * the section PATCH returns the whole merged bag, not just this field.
-   */
-  update(value: unknown): void;
-  /**
-   * Companion to {@link update} for the accent field of the same save.
-   * An explicit null clears the override; anything malformed is ignored
-   * rather than applied, so a bad value can never blank the admin's accent.
-   */
-  updateAccent(value: unknown): void;
-  private set;
-  /**
-   * The manifest is loaded at bootstrap, well before the authenticated shell
-   * calls this, so a snapshot read is enough and no subscription is needed.
-   * A malformed value is ignored rather than applied -- the container refuses
-   * to build with one, but the manifest crosses the network all the same.
-   */
-  private readPlatformAccent;
-  private setAccent;
-  /**
-   * Writes the override onto the document element, where an inline style
-   * outranks every stylesheet rule -- including the dark block -- so one
-   * declaration re-points the accent in both themes.
-   *
-   * Only --cms-accent is set, not the -hover/-light/-text members of the
-   * family. Deriving those from an arbitrary user colour needs a colour model
-   * the palette does not have yet, and guessing them would produce hover
-   * states that clash with the very colour the user chose. Until then the
-   * override moves the brand fill and leaves its supporting tones alone.
-   */
-  private applyAccent;
-  private applyToDocument;
-  private static readCache;
-  private static readAccentCache;
-  static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class ThemeService {
+    private readonly api;
+    private readonly store;
+    private readonly _choice;
+    private readonly _systemDark;
+    private readonly _userAccent;
+    private readonly _platformAccent;
+    private loadOnce$?;
+    /** The user's stored choice, including `system`. */
+    readonly choice: i0.Signal<ThemeChoice>;
+    /** This user's personal override, independent of the deployment's. */
+    readonly userAccent: i0.Signal<string | null>;
+    /** The deployment's brand accent from the API manifest, if it set one. */
+    readonly platformAccent: i0.Signal<string | null>;
+    /**
+     * The colour actually painted: personal override, else the deployment's,
+     * else null -- which leaves the stylesheet's own accent in place.
+     *
+     * Three rungs and each is a real state. A user who has chosen nothing is
+     * NOT the same as one who chose the deployment's colour: clear the
+     * deployment's brand and the first user follows it, the second does not.
+     */
+    readonly accent: i0.Signal<string | null>;
+    /** The choice with `system` resolved against the OS setting. */
+    readonly resolved: i0.Signal<ResolvedTheme>;
+    constructor();
+    /**
+     * One-shot load of the stored preference. Safe to call more than once and
+     * safe for anonymous users -- a failure leaves the cached/system value in
+     * place rather than forcing light, so the login screen still matches the OS.
+     */
+    ensureLoaded(): Observable<ThemeChoice>;
+    /**
+     * Called by the Profile page after the Preferences tab saves, so the admin
+     * re-themes on the spot. Ignores anything that is not a known choice --
+     * the section PATCH returns the whole merged bag, not just this field.
+     */
+    update(value: unknown): void;
+    /**
+     * Companion to {@link update} for the accent field of the same save.
+     * An explicit null clears the override; anything malformed is ignored
+     * rather than applied, so a bad value can never blank the admin's accent.
+     */
+    updateAccent(value: unknown): void;
+    private set;
+    /**
+     * The manifest is loaded at bootstrap, well before the authenticated shell
+     * calls this, so a snapshot read is enough and no subscription is needed.
+     * A malformed value is ignored rather than applied -- the container refuses
+     * to build with one, but the manifest crosses the network all the same.
+     */
+    private readPlatformAccent;
+    private setAccent;
+    /**
+     * Writes the override onto the document element, where an inline style
+     * outranks every stylesheet rule -- including the dark block -- so one
+     * declaration re-points the accent in both themes.
+     *
+     * Only --cms-accent is set, not the -hover/-light/-text members of the
+     * family. Deriving those from an arbitrary user colour needs a colour model
+     * the palette does not have yet, and guessing them would produce hover
+     * states that clash with the very colour the user chose. Until then the
+     * override moves the brand fill and leaves its supporting tones alone.
+     */
+    private applyAccent;
+    private applyToDocument;
+    private static readCache;
+    private static readAccentCache;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * The platform's loading indicator: the exclamation mark from Cool!MS,
  * drawing itself.
@@ -1400,41 +1559,26 @@ export declare class ThemeService {
  * Under `prefers-reduced-motion` it holds still and only breathes, because
  * motion sickness is not a stylistic preference.
  */
-export declare class CmsLoaderComponent {
-  /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
-  readonly label: import("@angular/core").InputSignal<string>;
-  /** Cover the positioned ancestor rather than sitting in the flow. */
-  readonly overlay: import("@angular/core").InputSignal<boolean>;
-  /**
-   * Row layout at text scale, for a wait inside a row, a status bar or a
-   * button. Override `--cms-loader-size` to tune the mark.
-   */
-  readonly inline: import("@angular/core").InputSignal<boolean>;
-  /**
-   * A clip-path needs a document-unique id, and this component is used more
-   * than once per page -- two loaders sharing an id makes the second one clip
-   * against the first one's rectangle and stop animating.
-   */
-  protected readonly clipId: string;
-  static ɵfac: i0.ɵɵFactoryDeclaration<CmsLoaderComponent, never>;
-  static ɵcmp: i0.ɵɵComponentDeclaration<CmsLoaderComponent, "cms-loader", never, {
-    "label": {
-      "alias": "label";
-      "required": false;
-      "isSignal": true;
-    };
-    "overlay": {
-      "alias": "overlay";
-      "required": false;
-      "isSignal": true;
-    };
-    "inline": {
-      "alias": "inline";
-      "required": false;
-      "isSignal": true;
-    };
-  }, {}, never, never, true, never>;
-}
+declare class CmsLoaderComponent {
+    /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
+    readonly label: i0.InputSignal<string>;
+    /** Cover the positioned ancestor rather than sitting in the flow. */
+    readonly overlay: i0.InputSignal<boolean>;
+    /**
+     * Row layout at text scale, for a wait inside a row, a status bar or a
+     * button. Override `--cms-loader-size` to tune the mark.
+     */
+    readonly inline: i0.InputSignal<boolean>;
+    /**
+     * A clip-path needs a document-unique id, and this component is used more
+     * than once per page -- two loaders sharing an id makes the second one clip
+     * against the first one's rectangle and stop animating.
+     */
+    protected readonly clipId: string;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CmsLoaderComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<CmsLoaderComponent, "cms-loader", never, { "label": { "alias": "label"; "required": false; "isSignal": true; }; "overlay": { "alias": "overlay"; "required": false; "isSignal": true; }; "inline": { "alias": "inline"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
+}
+
 /**
  * Unified user preferences service -- all preference types share one
  * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
@@ -1460,105 +1604,106 @@ export declare class CmsLoaderComponent {
  *   terminal.height
  *   terminal.open
  */
-export declare class UserPreferencesService {
-  private readonly http;
-  private readonly store;
-  private readonly destroyRef;
-  private readonly STORAGE_KEY;
-  private readonly SYNC_DELAY;
-  private syncSubject;
-  constructor();
-  /**
-   * Write all prefs to localStorage and schedule a debounced server sync.
-   */
-  private save;
-  /**
-   * Read the entire prefs object from localStorage, applying legacy key
-   * migration on the first read after an upgrade.
-   */
-  private load;
-  /**
-   * One-time migration of legacy flat keys to the new nested naming convention.
-   * Mutates `all` in place and re-persists only when something changed.
-   */
-  private migrate;
-  /**
-   * Seed localStorage from server preferences.
-   * Called after login and on every session restore (page reload).
-   *
-   * Strategy:
-   *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
-   *  - Local prefs already exist -> merge with local taking priority at each
-   *    top-level namespace.  This ensures that locally-persisted state
-   *    (panel widths, last path, etc.) is never overwritten by the stale copy
-   *    that was saved in the auth token at login time.
-   */
-  loadFromServer(uiPrefs: Record<string, unknown>): void;
-  private syncToServer;
-  /**
-   * Get stored preferences for a specific grid.
-   */
-  getGridPref(gridId: string): DataGridPreference | null;
-  /**
-   * Set visible column order for a grid.
-   * Applies to localStorage instantly; server sync is debounced.
-   */
-  setColumns(gridId: string, columns: string[]): void;
-  /**
-   * Record a column width for a grid column.
-   * Applies to localStorage instantly; server sync is debounced.
-   */
-  setColumnWidth(gridId: string, field: string, width: number): void;
-  /**
-   * Remove all preferences for a specific grid and immediately sync to server.
-   */
-  resetGrid(gridId: string): void;
-  private updateGrid;
-  /**
-   * Get persisted terminal panel height.
-   */
-  getTerminalHeight(): number | null;
-  /**
-   * Persist terminal panel height.
-   */
-  setTerminalHeight(height: number): void;
-  /**
-   * Get persisted state for a resizable panel identified by key.
-   * Used by ExplorerLayoutComponent to persist panel widths across sessions.
-   */
-  getPanelState(key: string): {
-    width: number;
-    collapsed: boolean;
-  } | null;
-  /**
-   * Persist generic panel state by key.
-   * Applies to localStorage instantly; server sync is debounced.
-   */
-  setPanelState(key: string, width: number, collapsed: boolean): void;
-  /**
-   * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
-   */
-  getPageState<T>(pageKey: string): T | null;
-  /**
-   * Merge partial state into a page namespace.
-   * Existing keys in the namespace are preserved; only provided keys are updated.
-   * Applies to localStorage instantly; server sync is debounced.
-   */
-  setPageState(pageKey: string, state: Record<string, unknown>): void;
-  /** @deprecated Use getPageState('media') instead */
-  getMediaViewMode(): string | null;
-  /** @deprecated Use setPageState('media', ...) instead */
-  setMediaViewMode(mode: string): void;
-  /** @deprecated Use getPanelState('media_panel_left') instead */
-  getMediaCollectionsPanel(): {
-    width: number;
-    collapsed: boolean;
-  } | null;
-  /** @deprecated Use setPanelState('media_panel_left', ...) instead */
-  setMediaCollectionsPanel(width: number, collapsed: boolean): void;
-  static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class UserPreferencesService {
+    private readonly http;
+    private readonly store;
+    private readonly destroyRef;
+    private readonly STORAGE_KEY;
+    private readonly SYNC_DELAY;
+    private syncSubject;
+    constructor();
+    /**
+     * Write all prefs to localStorage and schedule a debounced server sync.
+     */
+    private save;
+    /**
+     * Read the entire prefs object from localStorage, applying legacy key
+     * migration on the first read after an upgrade.
+     */
+    private load;
+    /**
+     * One-time migration of legacy flat keys to the new nested naming convention.
+     * Mutates `all` in place and re-persists only when something changed.
+     */
+    private migrate;
+    /**
+     * Seed localStorage from server preferences.
+     * Called after login and on every session restore (page reload).
+     *
+     * Strategy:
+     *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
+     *  - Local prefs already exist -> merge with local taking priority at each
+     *    top-level namespace.  This ensures that locally-persisted state
+     *    (panel widths, last path, etc.) is never overwritten by the stale copy
+     *    that was saved in the auth token at login time.
+     */
+    loadFromServer(uiPrefs: Record<string, unknown>): void;
+    private syncToServer;
+    /**
+     * Get stored preferences for a specific grid.
+     */
+    getGridPref(gridId: string): DataGridPreference | null;
+    /**
+     * Set visible column order for a grid.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setColumns(gridId: string, columns: string[]): void;
+    /**
+     * Record a column width for a grid column.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setColumnWidth(gridId: string, field: string, width: number): void;
+    /**
+     * Remove all preferences for a specific grid and immediately sync to server.
+     */
+    resetGrid(gridId: string): void;
+    private updateGrid;
+    /**
+     * Get persisted terminal panel height.
+     */
+    getTerminalHeight(): number | null;
+    /**
+     * Persist terminal panel height.
+     */
+    setTerminalHeight(height: number): void;
+    /**
+     * Get persisted state for a resizable panel identified by key.
+     * Used by ExplorerLayoutComponent to persist panel widths across sessions.
+     */
+    getPanelState(key: string): {
+        width: number;
+        collapsed: boolean;
+    } | null;
+    /**
+     * Persist generic panel state by key.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setPanelState(key: string, width: number, collapsed: boolean): void;
+    /**
+     * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
+     */
+    getPageState<T>(pageKey: string): T | null;
+    /**
+     * Merge partial state into a page namespace.
+     * Existing keys in the namespace are preserved; only provided keys are updated.
+     * Applies to localStorage instantly; server sync is debounced.
+     */
+    setPageState(pageKey: string, state: Record<string, unknown>): void;
+    /** @deprecated Use getPageState('media') instead */
+    getMediaViewMode(): string | null;
+    /** @deprecated Use setPageState('media', ...) instead */
+    setMediaViewMode(mode: string): void;
+    /** @deprecated Use getPanelState('media_panel_left') instead */
+    getMediaCollectionsPanel(): {
+        width: number;
+        collapsed: boolean;
+    } | null;
+    /** @deprecated Use setPanelState('media_panel_left', ...) instead */
+    setMediaCollectionsPanel(width: number, collapsed: boolean): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Sidebar collapse state -- two independent dimensions:
  *
@@ -1578,34 +1723,35 @@ export declare class UserPreferencesService {
  * to defaulting un-collapsed -- the toggles still work for the session,
  * just don't persist.
  */
-export declare class SidebarStateService {
-  private static readonly STORAGE_KEY;
-  private static readonly STORAGE_KEY_SECTIONS;
-  private static readonly STORAGE_KEY_ITEMS;
-  readonly collapsed: import("@angular/core").WritableSignal<boolean>;
-  readonly collapsedSections: import("@angular/core").WritableSignal<Set<string>>;
-  readonly collapsedItems: import("@angular/core").WritableSignal<Set<string>>;
-  toggle(): void;
-  isSectionCollapsed(id: string): boolean;
-  toggleSection(id: string): void;
-  /**
-   * Force a section to be expanded. Used when navigation lands on
-   * a route inside a manually-collapsed section -- it would be
-   * confusing to leave the active item hidden. The user can
-   * collapse the section again afterwards.
-   */
-  ensureExpanded(id: string): void;
-  isItemCollapsed(id: string): boolean;
-  toggleItem(id: string): void;
-  private readPersisted;
-  private persist;
-  private readSectionsPersisted;
-  private persistSections;
-  private readItemsPersisted;
-  private persistItems;
-  static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class SidebarStateService {
+    private static readonly STORAGE_KEY;
+    private static readonly STORAGE_KEY_SECTIONS;
+    private static readonly STORAGE_KEY_ITEMS;
+    readonly collapsed: i0.WritableSignal<boolean>;
+    readonly collapsedSections: i0.WritableSignal<Set<string>>;
+    readonly collapsedItems: i0.WritableSignal<Set<string>>;
+    toggle(): void;
+    isSectionCollapsed(id: string): boolean;
+    toggleSection(id: string): void;
+    /**
+     * Force a section to be expanded. Used when navigation lands on
+     * a route inside a manually-collapsed section -- it would be
+     * confusing to leave the active item hidden. The user can
+     * collapse the section again afterwards.
+     */
+    ensureExpanded(id: string): void;
+    isItemCollapsed(id: string): boolean;
+    toggleItem(id: string): void;
+    private readPersisted;
+    private persist;
+    private readSectionsPersisted;
+    private persistSections;
+    private readItemsPersisted;
+    private persistItems;
+    static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * One row returned by the `/api/entity-search` endpoint. `id` is
  * what the picker emits via its `valueChange` output (and what the
@@ -1615,10 +1761,10 @@ export declare class SidebarStateService {
  * when there is nothing to show; receiving `null` from a custom
  * resolver is normalized to `undefined` here.
  */
-export interface EntitySearchResult {
-  readonly id: string | number;
-  readonly label: string;
-  readonly secondary?: string;
+interface EntitySearchResult {
+    readonly id: string | number;
+    readonly label: string;
+    readonly secondary?: string;
 }
 /**
  * HTTP client for the Phase 2a `/api/entity-search` endpoint.
@@ -1626,53 +1772,55 @@ export interface EntitySearchResult {
  * Permission filtering happens at the backend resolver layer --
  * this service is a thin RPC.
  */
-export declare class EntitySearchService {
-  private readonly http;
-  /**
-   * @param entityType  Fully-qualified PHP class name of the entity
-   *                    being searched (e.g. the backend's User entity).
-   * @param query       Free-text search input. Empty string is
-   *                    valid -- the backend returns the default
-   *                    listing for that entity type.
-   * @param limit       Max rows to return; clamped server-side to
-   *                    [1, 100].
-   */
-  search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
-  static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class EntitySearchService {
+    private readonly http;
+    /**
+     * @param entityType  Fully-qualified PHP class name of the entity
+     *                    being searched (e.g. the backend's User entity).
+     * @param query       Free-text search input. Empty string is
+     *                    valid -- the backend returns the default
+     *                    listing for that entity type.
+     * @param limit       Max rows to return; clamped server-side to
+     *                    [1, 100].
+     */
+    search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Well-known click target values embedded in meta.target.
  *   'action.logout' -- dispatch Logout action
  *   'route'         -- navigate via routerLink (default when target absent)
  *   '_blank'        -- open in a new tab (hrefOverride must be set)
  */
-export type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
-export interface NaviGraphMeta {
-  readonly component?: string;
-  readonly icon?: string;
-  readonly routerLink?: string;
-  readonly target?: NaviGraphTarget;
-  readonly requiredRole?: string;
-  readonly voterAttribute?: string;
-  readonly contributor?: string;
-  readonly [key: string]: unknown;
+type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
+interface NaviGraphMeta {
+    readonly component?: string;
+    readonly icon?: string;
+    readonly routerLink?: string;
+    readonly target?: NaviGraphTarget;
+    readonly requiredRole?: string;
+    readonly voterAttribute?: string;
+    readonly contributor?: string;
+    readonly [key: string]: unknown;
 }
 /** Flat node as returned from GET /navi/trees/{slug}/graph */
-export interface NaviGraphNodeFlat {
-  readonly id: string;
-  readonly path: string;
-  readonly title: string;
-  readonly parentId: string | null;
-  readonly sortOrder: number;
-  readonly isActive: boolean;
-  readonly isVisible: boolean;
-  readonly meta: NaviGraphMeta;
+interface NaviGraphNodeFlat {
+    readonly id: string;
+    readonly path: string;
+    readonly title: string;
+    readonly parentId: string | null;
+    readonly sortOrder: number;
+    readonly isActive: boolean;
+    readonly isVisible: boolean;
+    readonly meta: NaviGraphMeta;
 }
 /** Same node enriched with resolved children after client-side tree build */
-export interface NaviGraphNode extends NaviGraphNodeFlat {
-  readonly children: NaviGraphNode[];
+interface NaviGraphNode extends NaviGraphNodeFlat {
+    readonly children: NaviGraphNode[];
 }
+
 /**
  * Loads, caches, and drives admin NaviGraph trees.
  *
@@ -1681,58 +1829,59 @@ export interface NaviGraphNode extends NaviGraphNodeFlat {
  *   const items = naviGraphService.adminNav();         // signal<NaviGraphNode[]>
  *   naviGraphService.handleClick(node);
  */
-export declare class NaviGraphService {
-  private readonly http;
-  private readonly router;
-  private readonly store;
-  private readonly errors;
-  /** Resolved root nodes for navi.admin (sidebar). */
-  readonly adminNav: import("@angular/core").WritableSignal<NaviGraphNode[]>;
-  /** Resolved root nodes for navi.admin.topbar. */
-  readonly topbarNav: import("@angular/core").WritableSignal<NaviGraphNode[]>;
-  private readonly cache;
-  loadAdminNav(url: string): Observable<NaviGraphNode[]>;
-  loadTopbarNav(url: string): Observable<NaviGraphNode[]>;
-  /**
-   * Handle a nav-node click.
-   *
-   * Routing logic based on meta.target:
-   *   'action.logout'  -- dispatch Logout
-   *   '_blank'         -- window.open (uses node.path as href)
-   *   default          -- router.navigate with meta.routerLink or node.path
-   */
-  handleClick(node: NaviGraphNode): void;
-  /**
-   * Evaluate `showWhen` meta condition against a record.
-   * Nodes with no `showWhen` are always visible.
-   * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
-   */
-  isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
-  /**
-   * Standalone `showWhen` evaluator for callers that don't have a
-   * full `NaviGraphNode` (e.g. a grid's row context menu -- a
-   * `rowAction.showWhen` predicate is evaluated against the row's
-   * own projection). `null`/`undefined` predicates default to
-   * visible, mirroring `isVisible`'s "no rule = always shown"
-   * semantics.
-   */
-  matchesShowWhen(showWhen: Record<string, unknown> | undefined | null, record: Record<string, unknown>): boolean;
-  private evalCondition;
-  /**
-   * Fetch a graph endpoint and return a nested tree.
-   * Handles both compact JSON-LD IRIs (`member`) and
-   * the legacy Hydra key (`hydra:member`).
-   * Results are cached by URL for the lifetime of the service instance.
-   */
-  loadTree(url: string): Observable<NaviGraphNode[]>;
-  /**
-   * Build a nested tree from a flat array of nodes.
-   * Nodes are sorted by sortOrder at each level.
-   */
-  private buildTree;
-  static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class NaviGraphService {
+    private readonly http;
+    private readonly router;
+    private readonly store;
+    private readonly errors;
+    /** Resolved root nodes for navi.admin (sidebar). */
+    readonly adminNav: i0.WritableSignal<NaviGraphNode[]>;
+    /** Resolved root nodes for navi.admin.topbar. */
+    readonly topbarNav: i0.WritableSignal<NaviGraphNode[]>;
+    private readonly cache;
+    loadAdminNav(url: string): Observable<NaviGraphNode[]>;
+    loadTopbarNav(url: string): Observable<NaviGraphNode[]>;
+    /**
+     * Handle a nav-node click.
+     *
+     * Routing logic based on meta.target:
+     *   'action.logout'  -- dispatch Logout
+     *   '_blank'         -- window.open (uses node.path as href)
+     *   default          -- router.navigate with meta.routerLink or node.path
+     */
+    handleClick(node: NaviGraphNode): void;
+    /**
+     * Evaluate `showWhen` meta condition against a record.
+     * Nodes with no `showWhen` are always visible.
+     * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
+     */
+    isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
+    /**
+     * Standalone `showWhen` evaluator for callers that don't have a
+     * full `NaviGraphNode` (e.g. a grid's row context menu -- a
+     * `rowAction.showWhen` predicate is evaluated against the row's
+     * own projection). `null`/`undefined` predicates default to
+     * visible, mirroring `isVisible`'s "no rule = always shown"
+     * semantics.
+     */
+    matchesShowWhen(showWhen: Record<string, unknown> | undefined | null, record: Record<string, unknown>): boolean;
+    private evalCondition;
+    /**
+     * Fetch a graph endpoint and return a nested tree.
+     * Handles both compact JSON-LD IRIs (`member`) and
+     * the legacy Hydra key (`hydra:member`).
+     * Results are cached by URL for the lifetime of the service instance.
+     */
+    loadTree(url: string): Observable<NaviGraphNode[]>;
+    /**
+     * Build a nested tree from a flat array of nodes.
+     * Nodes are sorted by sortOrder at each level.
+     */
+    private buildTree;
+    static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * Registry mapping string keys to Angular component classes.
  *
@@ -1746,19 +1895,20 @@ export declare class NaviGraphService {
  *   private readonly registry = inject(ComponentRegistry);
  *   const cls = this.registry.get('MediaLibraryPage');
  */
-export declare class ComponentRegistry {
-  private static readonly map;
-  static register(key: string, component: Type<unknown>): void;
-  static get(key: string): Type<unknown> | undefined;
-  static has(key: string): boolean;
-  static keys(): string[];
-  register(key: string, component: Type<unknown>): void;
-  get(key: string): Type<unknown> | null;
-  has(key: string): boolean;
-  keys(): string[];
-  static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
+declare class ComponentRegistry {
+    private static readonly map;
+    static register(key: string, component: Type<unknown>): void;
+    static get(key: string): Type<unknown> | undefined;
+    static has(key: string): boolean;
+    static keys(): string[];
+    register(key: string, component: Type<unknown>): void;
+    get(key: string): Type<unknown> | null;
+    has(key: string): boolean;
+    keys(): string[];
+    static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+
 /**
  * `console` -- the administration host contract (the platform rule: hosts implement contracts, modules offer entries).
  *
@@ -1774,35 +1924,35 @@ export declare class ComponentRegistry {
  * (`^1.2` -- major 1, minor at least 2), checked at build against this
  * constant and at install against the theme's declaration.
  */
-export declare const CONSOLE_CONTRACT: {
-  readonly name: "console";
-  readonly version: "1.0";
+declare const CONSOLE_CONTRACT: {
+    readonly name: "console";
+    readonly version: "1.0";
 };
-export interface ConsoleEntry {
-  /** The backend module id, as `config/modules/<id>`. Activation is by this id. */
-  readonly module: string;
-  readonly contract: 'console';
-  /** The console versions this entry was written for: a caret range over MAJOR.MINOR, e.g. '^1.0'. */
-  readonly range: string;
-  readonly routes?: readonly ConsoleRouteMount[];
-  readonly bindings?: readonly ConsoleBinding[];
-  readonly topbar?: readonly ConsoleTopbarItem[];
-  readonly overlays?: readonly ConsoleOverlay[];
-  readonly panels?: readonly ConsolePanel[];
-  readonly states?: readonly Type<unknown>[];
-  readonly providers?: readonly ConsoleProvision[];
+interface ConsoleEntry {
+    /** The backend module id, as `config/modules/<id>`. Activation is by this id. */
+    readonly module: string;
+    readonly contract: 'console';
+    /** The console versions this entry was written for: a caret range over MAJOR.MINOR, e.g. '^1.0'. */
+    readonly range: string;
+    readonly routes?: readonly ConsoleRouteMount[];
+    readonly bindings?: readonly ConsoleBinding[];
+    readonly topbar?: readonly ConsoleTopbarItem[];
+    readonly overlays?: readonly ConsoleOverlay[];
+    readonly panels?: readonly ConsolePanel[];
+    readonly states?: readonly Type<unknown>[];
+    readonly providers?: readonly ConsoleProvision[];
 }
 /** What a route's `data` carries for the shell: the sidebar item to light, and whether the page owns its height. */
-export interface ConsoleNavHint {
-  readonly activeNav?: string;
-  readonly fullHeight?: boolean;
-  /** An intermediate crumb the top bar renders between Home and the page. */
-  readonly breadcrumb?: {
-    readonly label: string;
-    readonly routerLink: string;
-  };
-  /** Which server layout the page renders, for the generic layout pages. */
-  readonly layoutId?: string;
+interface ConsoleNavHint {
+    readonly activeNav?: string;
+    readonly fullHeight?: boolean;
+    /** An intermediate crumb the top bar renders between Home and the page. */
+    readonly breadcrumb?: {
+        readonly label: string;
+        readonly routerLink: string;
+    };
+    /** Which server layout the page renders, for the generic layout pages. */
+    readonly layoutId?: string;
 }
 /**
  * A route mounted under the console's authenticated layout. The host adds
@@ -1810,52 +1960,52 @@ export interface ConsoleNavHint {
  * and a `canMatch` that answers whether the module is installed here. Routes
  * are lazy: a static component here would put every module's pages in `main`.
  */
-export type ConsoleRouteMount = {
-  readonly path: string;
-  readonly children: () => Promise<Routes>;
-  readonly nav?: ConsoleNavHint;
-  readonly providers?: readonly Provider[];
+type ConsoleRouteMount = {
+    readonly path: string;
+    readonly children: () => Promise<Routes>;
+    readonly nav?: ConsoleNavHint;
+    readonly providers?: readonly Provider[];
 } | {
-  readonly path: string;
-  readonly component: () => Promise<Type<unknown>>;
-  readonly nav?: ConsoleNavHint;
-  readonly providers?: readonly Provider[];
+    readonly path: string;
+    readonly component: () => Promise<Type<unknown>>;
+    readonly nav?: ConsoleNavHint;
+    readonly providers?: readonly Provider[];
 } | {
-  readonly path: string;
-  readonly redirectTo: string;
+    readonly path: string;
+    readonly redirectTo: string;
 };
 /** A `ComponentRegistry` name -> class: names a module OWNS (its server layouts name them) and names it fills in another module's slot (`profile.tab:call`). */
-export interface ConsoleBinding {
-  readonly name: string;
-  readonly component: Type<unknown>;
+interface ConsoleBinding {
+    readonly name: string;
+    readonly component: Type<unknown>;
 }
 /** A tile in the top bar's quick-access strip, rendered in ascending `order`. */
-export interface ConsoleTopbarItem {
-  readonly id: string;
-  readonly order: number;
-  readonly component: Type<unknown>;
+interface ConsoleTopbarItem {
+    readonly id: string;
+    readonly order: number;
+    readonly component: Type<unknown>;
 }
 /** Mounted once, inside the authenticated layout, outside the router outlet. */
-export interface ConsoleOverlay {
-  readonly id: string;
-  readonly component: Type<unknown>;
+interface ConsoleOverlay {
+    readonly id: string;
+    readonly component: Type<unknown>;
 }
 /**
  * A dock panel the layout opens and closes: the host renders its toggle in
  * the top bar and the panel in the dock, and the panel talks back through
  * {@link ConsolePanelHost} -- not through outputs, which a slot cannot carry.
  */
-export interface ConsolePanel {
-  readonly id: string;
-  readonly dock: 'bottom';
-  /** The top-bar toggle: a label (the title), an icon name or a short text, and a key the host binds with Ctrl. */
-  readonly toggle: {
-    readonly label: string;
-    readonly icon?: string;
-    readonly text?: string;
-    readonly key?: string;
-  };
-  readonly component: Type<unknown>;
+interface ConsolePanel {
+    readonly id: string;
+    readonly dock: 'bottom';
+    /** The top-bar toggle: a label (the title), an icon name or a short text, and a key the host binds with Ctrl. */
+    readonly toggle: {
+        readonly label: string;
+        readonly icon?: string;
+        readonly text?: string;
+        readonly key?: string;
+    };
+    readonly component: Type<unknown>;
 }
 /**
  * What a `provide*` line is: environment providers from a library's registry
@@ -1863,24 +2013,24 @@ export interface ConsolePanel {
  * implementation of a single-implementation port, listed as such so the
  * assembly can refuse two modules implementing one port by name.
  */
-export type ConsoleProvision = EnvironmentProviders | Provider | ConsolePortProvision;
-export interface ConsolePortProvision {
-  readonly port: InjectionToken<unknown>;
-  readonly useExisting: Type<unknown>;
+type ConsoleProvision = EnvironmentProviders | Provider | ConsolePortProvision;
+interface ConsolePortProvision {
+    readonly port: InjectionToken<unknown>;
+    readonly useExisting: Type<unknown>;
 }
-export declare function isPortProvision(p: ConsoleProvision): p is ConsolePortProvision;
+declare function isPortProvision(p: ConsoleProvision): p is ConsolePortProvision;
 /** The identity function with the type: an entry file exports data, nothing runs. */
-export declare function consoleEntry(entry: ConsoleEntry): ConsoleEntry;
+declare function consoleEntry(entry: ConsoleEntry): ConsoleEntry;
 /**
  * Whether a caret range over MAJOR.MINOR admits a version: same major, minor
  * at least the range's. Malformed input admits nothing -- a range that cannot
  * be read must refuse, never pass.
  */
-export declare function satisfiesRange(range: string, version: string): boolean;
+declare function satisfiesRange(range: string, version: string): boolean;
 /** The refusal an assembly raises: one message per collision, all of them, by name. */
-export declare class ConsoleAssemblyError extends Error {
-  readonly problems: readonly string[];
-  constructor(problems: readonly string[]);
+declare class ConsoleAssemblyError extends Error {
+    readonly problems: readonly string[];
+    constructor(problems: readonly string[]);
 }
 /**
  * The checks every assembly runs, in one place so the build-time spec, the
@@ -1888,7 +2038,8 @@ export declare class ConsoleAssemblyError extends Error {
  * this contract, and the collision rules of the six lists. Returns the
  * entries unchanged when nothing is wrong.
  */
-export declare function assembleConsole(entries: readonly ConsoleEntry[]): readonly ConsoleEntry[];
+declare function assembleConsole(entries: readonly ConsoleEntry[]): readonly ConsoleEntry[];
+
 /**
  * The host side of `console@1`: what a theme calls to turn the assembled
  * entries into routes, providers and the lists its shell renders.
@@ -1901,31 +2052,31 @@ export declare function assembleConsole(entries: readonly ConsoleEntry[]): reado
  * silently absent.
  */
 /** Every entry this build assembled, after {@link assembleConsole}'s checks. */
-export declare const CONSOLE_ENTRIES: InjectionToken<readonly ConsoleEntry[]>;
+declare const CONSOLE_ENTRIES: InjectionToken<readonly ConsoleEntry[]>;
 /**
  * The port a dock panel talks back through: the layout provides one per
  * panel it mounts, so the panel never needs an output the slot cannot carry.
  */
-export declare abstract class ConsolePanelHost {
-  abstract close(): void;
-  abstract maximize(on: boolean): void;
+declare abstract class ConsolePanelHost {
+    abstract close(): void;
+    abstract maximize(on: boolean): void;
 }
 /** The console modules the manifest says are installed here. */
-export declare function installedConsoleModules(manifest: ApiManifest | null): ReadonlySet<string>;
-export declare class ConsoleActivation {
-  private readonly entries;
-  private readonly manifest;
-  readonly installed: import("@angular/core").Signal<ReadonlySet<string>>;
-  /** The entries of installed modules, in assembly order. */
-  readonly active: import("@angular/core").Signal<ConsoleEntry[]>;
-  readonly topbar: import("@angular/core").Signal<readonly ConsoleTopbarItem[]>;
-  readonly overlays: import("@angular/core").Signal<readonly ConsoleOverlay[]>;
-  readonly panels: import("@angular/core").Signal<readonly ConsolePanel[]>;
-  /** Modules the manifest names that this build has no entry for: what a diagnostics page shows by name. */
-  readonly missing: import("@angular/core").Signal<string[]>;
-  isInstalled(module: string): boolean;
-  static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleActivation, never>;
-  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+declare function installedConsoleModules(manifest: ApiManifest | null): ReadonlySet<string>;
+declare class ConsoleActivation {
+    private readonly entries;
+    private readonly manifest;
+    readonly installed: i0.Signal<ReadonlySet<string>>;
+    /** The entries of installed modules, in assembly order. */
+    readonly active: i0.Signal<ConsoleEntry[]>;
+    readonly topbar: i0.Signal<readonly ConsoleTopbarItem[]>;
+    readonly overlays: i0.Signal<readonly ConsoleOverlay[]>;
+    readonly panels: i0.Signal<readonly ConsolePanel[]>;
+    /** Modules the manifest names that this build has no entry for: what a diagnostics page shows by name. */
+    readonly missing: i0.Signal<string[]>;
+    isInstalled(module: string): boolean;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleActivation, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 /**
  * `canMatch` for a module's mount: the route exists only where the module is
@@ -1936,8 +2087,16 @@ export declare class ConsoleActivation {
  * landed on the dashboard (measured 2026-09-22: no chunk requested for the
  * mount, the dashboard's instead). `ready$` is what the auth guard waits on
  * too, and it fires whether or not the config fetch succeeded.
+ *
+ * !! Then the console's own manifest, when someone is signed in: `ui.modules` is
+ * the console's, not the public config's, and arrives with it
+ * ({@link ConsoleAccessService}). canMatch runs before the layout's auth guard,
+ * which asks the same question, so answering from the public config alone said
+ * "no" to every module once that config stopped carrying them. Nobody signed in:
+ * nothing is asked, the answer is the public config's, and the layout's guard
+ * sends the person to sign in. A refusal merges nothing, so the answer is no.
  */
-export declare function consoleModuleInstalled(module: string): CanMatchFn;
+declare function consoleModuleInstalled(module: string): CanMatchFn;
 /**
  * The children a theme mounts under its authenticated layout for the
  * assembled entries: one `Route` per mount, lazy as written, `data` from the
@@ -1945,7 +2104,7 @@ export declare function consoleModuleInstalled(module: string): CanMatchFn;
  * shape around them (login, the layout, `canActivate: [authGuard]`, the
  * wildcard).
  */
-export declare function consoleChildren(entries: readonly ConsoleEntry[]): Routes;
+declare function consoleChildren(entries: readonly ConsoleEntry[]): Routes;
 /**
  * The providers a theme adds for the assembled entries: the store with the
  * host's states and every module state, the registry bindings (an
@@ -1954,9 +2113,10 @@ export declare function consoleChildren(entries: readonly ConsoleEntry[]): Route
  * library providers a module's provisions extend (the editor bridge, the
  * PDF viewer), as the hand-written lines were.
  */
-export declare function provideConsole(entries: readonly ConsoleEntry[], options: {
-  readonly hostStates: readonly Type<unknown>[];
+declare function provideConsole(entries: readonly ConsoleEntry[], options: {
+    readonly hostStates: readonly Type<unknown>[];
 }): EnvironmentProviders;
+
 /**
  * Phase H7 -- admin Site Selector.
  *
@@ -1986,7 +2146,8 @@ export declare function provideConsole(entries: readonly ConsoleEntry[], options
  *    be ignored by the backend anyway, but skipping keeps wire traffic clean)
  *  - requests that already carry the header (programmatic overrides win)
  */
-export declare const sectionInterceptor: HttpInterceptorFn;
+declare const sectionInterceptor: HttpInterceptorFn;
+
 /**
  * The one fact the section interceptor needs: which site the operator is
  * currently working in.
@@ -2001,13 +2162,16 @@ export declare const sectionInterceptor: HttpInterceptorFn;
  * Read SYNCHRONOUSLY on purpose. An interceptor decides whether to stamp a
  * header while building the request; it cannot wait on a stream.
  */
-export interface CurrentSectionPort {
-  /** Slug of the active section, or null when the operator picked none. */
-  currentSlug(): string | null;
+interface CurrentSectionPort {
+    /** Slug of the active section, or null when the operator picked none. */
+    currentSlug(): string | null;
 }
 /**
  * Optional by design: an application assembled without a Sections module binds
  * nothing and simply sends no `X-CoolMS-Section` header, which is exactly what
  * a single-site install wants.
  */
-export declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;
+declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;
+
+export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BACKGROUND_REQUEST, BYPASS_AUTH, BYPASS_ELEVATION, CONSOLE_CONTRACT, CONSOLE_ENTRIES, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, ConsoleAccessService, ConsoleActivation, ConsoleAssemblyError, ConsolePanelHost, CrossTabAuthSyncService, ELEVATION_NOTICE, ELEVATION_PROMPT, ELEVATION_REQUIRED_HEADER, ELEVATION_WARNING_FACTOR_MISSING, ELEVATION_WARNING_MFA_OFF, ELEVATION_WARNING_PASSWORD_NOT_SET, ElevationService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, assembleConsole, authGuard, authInterceptor, consoleChildren, consoleEntry, consoleModuleInstalled, elevationInterceptor, installedConsoleModules, isElevationRefusal, isPortProvision, loginPageGuard, provideConsole, resolvePattern, satisfiesRange, sectionInterceptor };
+export type { ApiManifest, AppConfigStateModel, AuthApiManifest, AuthStateModel, CentrifugoConnectionTokenDto, CentrifugoSubscriptionTokenDto, ConsoleAccess, ConsoleBinding, ConsoleEntry, ConsoleManifestResponse, ConsoleNavHint, ConsoleOverlay, ConsolePanel, ConsolePortProvision, ConsoleProvision, ConsoleRouteMount, ConsoleTopbarItem, ContentApiManifest, CurrentSectionPort, DataGridApiManifest, DataGridPreference, DataGridPreferences, DataSourceDefinition, DataSourceLoading, DataSourceOption, DataSourceType, DataSourceWidget, DatagridConfig, DialogConfig, DocumentApiManifest, DomainExplorerApiManifest, DynamicEntityApiManifest, EditorApiManifest, EditorApiManifestEntry, EditorApiManifestProfile, ElevationChange, ElevationChangeKind, ElevationDropReason, ElevationEnded, ElevationEndedReason, ElevationNoticePort, ElevationPromptPort, ElevationPromptRequest, ElevationState, ElevationWarning, EntitySearchResult, FieldItem, FieldSecurityPolicy, FieldType, FormAction, FormActionType, FormActionVariant, FormConfig, FormRenderDefinition, HydraCollection, HydraView, IdentityApiManifest, LayoutConfig, LayoutHeaderAction, LayoutNode, LayoutSection, MediaApiManifest, NaviApiManifest, NaviGraphMeta, NaviGraphNode, NaviGraphNodeFlat, NaviGraphTarget, NavigraphConfig, PlatformDefaults, RelationDefinition, ResolvedTheme, SectionApiManifest, SubFormDefinition, TerminalApiManifest, ThemeChoice, ThemeConfigResponse, TokenResponse, UiApiManifest, UiModuleEntryManifest, UserDto, ValidatorDefinition, VfsApiManifest, ViewerApiManifest, ViewerDefinitionApiManifest, ViewerProfileApiManifest, VisibilityCondition, VisibilityOperator };