@coolms/core-angular 2.0.0-alpha.4 → 2.0.0-alpha.6

package/fesm2022/coolms-core-angular.mjs

@@ -1,12 +1,12 @@
 import * as i0 from "@angular/core";
-import { ChangeDetectionStrategy, Component, DestroyRef, Injectable, InjectionToken, computed, effect, inject, input, makeEnvironmentProviders, provideAppInitializer, signal, untracked } from "@angular/core";
+import { ChangeDetectionStrategy, Component, DestroyRef, Injectable, InjectionToken, Injector, computed, effect, inject, input, makeEnvironmentProviders, provideAppInitializer, signal, untracked } from "@angular/core";
 import { HttpClient, HttpContext, HttpContextToken, HttpErrorResponse, HttpParams } from "@angular/common/http";
-import { Action, Selector, State, Store, provideStore } from "@ngxs/store";
+import { Action, Actions, Selector, State, Store, ofActionDispatched, provideStore } from "@ngxs/store";
 import { __decorate } from "tslib";
 import { ReplaySubject, Subject, catchError, debounceTime, defer, finalize, firstValueFrom, from, map, of, shareReplay, switchMap, take, tap, throwError } from "rxjs";
 import { catchError as catchError$1, map as map$1, shareReplay as shareReplay$1, switchMap as switchMap$1, tap as tap$1 } from "rxjs/operators";
 import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
-import { Router } from "@angular/router";
+import { ActivatedRoute, Router } from "@angular/router";
 import { Location, NgIf } from "@angular/common";
 import * as i1 from "@angular/forms";
 import { FormsModule } from "@angular/forms";
@@ -27,6 +27,9 @@ let AppConfigState = class AppConfigState {
 			loaded: true
 		});
 	}
+	static config(state) {
+		return state.config;
+	}
 	static manifest(state) {
 		return state.config?.manifest ?? null;
 	}
@@ -38,7 +41,7 @@ let AppConfigState = class AppConfigState {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AppConfigState,
 		deps: [],
@@ -46,12 +49,13 @@ let AppConfigState = class AppConfigState {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AppConfigState
 	});
 };
 __decorate([Action(SetAppConfig)], AppConfigState.prototype, "set", null);
+__decorate([Selector()], AppConfigState, "config", null);
 __decorate([Selector()], AppConfigState, "manifest", null);
 __decorate([Selector()], AppConfigState, "viewers", null);
 __decorate([Selector()], AppConfigState, "loaded", null);
@@ -64,7 +68,7 @@ AppConfigState = __decorate([State({
 })], AppConfigState);
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: AppConfigState,
 	decorators: [{ type: Injectable }],
@@ -98,7 +102,7 @@ var IdentityApiClient = class IdentityApiClient {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: IdentityApiClient,
 		deps: [],
@@ -106,7 +110,7 @@ var IdentityApiClient = class IdentityApiClient {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: IdentityApiClient,
 		providedIn: "root"
@@ -114,7 +118,7 @@ var IdentityApiClient = class IdentityApiClient {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: IdentityApiClient,
 	decorators: [{
@@ -122,46 +126,6 @@ i0.ɵɵngDeclareClassMetadata({
 		args: [{ providedIn: "root" }]
 	}]
 });
-var RealtimeTokenClient = class RealtimeTokenClient {
-	http = inject(HttpClient);
-	store = inject(Store);
-	get manifest() {
-		const m = this.store.selectSnapshot(AppConfigState.manifest);
-		if (!m) throw new Error("ApiManifest not loaded — call AppInitService.load() first");
-		return m;
-	}
-	connectionToken() {
-		return this.http.post(this.manifest.apiBase + "/centrifugo/connection-token", {});
-	}
-	subscriptionToken(channel) {
-		return this.http.post(this.manifest.apiBase + "/centrifugo/subscription-token", { channel });
-	}
-	static ɵfac = i0.ɵɵngDeclareFactory({
-		minVersion: "12.0.0",
-		version: "22.2.0",
-		ngImport: i0,
-		type: RealtimeTokenClient,
-		deps: [],
-		target: i0.ɵɵFactoryTarget.Injectable
-	});
-	static ɵprov = i0.ɵɵngDeclareInjectable({
-		minVersion: "12.0.0",
-		version: "22.2.0",
-		ngImport: i0,
-		type: RealtimeTokenClient,
-		providedIn: "root"
-	});
-};
-i0.ɵɵngDeclareClassMetadata({
-	minVersion: "12.0.0",
-	version: "22.2.0",
-	ngImport: i0,
-	type: RealtimeTokenClient,
-	decorators: [{
-		type: Injectable,
-		args: [{ providedIn: "root" }]
-	}]
-});
 var Login = class {
 	identifier;
 	password;
@@ -191,6 +155,255 @@ var PatchCurrentUser = class {
 		this.patch = patch;
 	}
 };
+const ELEVATION_PROMPT = new InjectionToken("coolms.elevation-prompt");
+const ELEVATION_ACTION = new HttpContextToken(() => null);
+const ELEVATION_NOTICE = new InjectionToken("coolms.elevation-notice");
+const BYPASS_ELEVATION = new HttpContextToken(() => false);
+const CROSS_TAB_KEY = "coolms.elevation.changed";
+const RECONCILE_MIN_INTERVAL_MS = 2e3;
+const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
+const BACKGROUND_REQUEST = new HttpContextToken(() => false);
+function isElevationRefusal(err) {
+	return err instanceof HttpErrorResponse && err.status === 403 && !!err.headers.get("X-Elevation-Required");
+}
+var ElevationService = class ElevationService {
+	http = inject(HttpClient);
+	store = inject(Store);
+	prompt = inject(ELEVATION_PROMPT, { optional: true });
+	destroyRef = inject(DestroyRef);
+	served = signal(null, ...ngDevMode ? [{ debugName: "served" }] : /* istanbul ignore next */ []);
+	state = () => {
+		const served = this.served();
+		if (served === null || !isPast(served)) return served;
+		const expired = expiredView(served);
+		untracked(() => this.served.set(expired));
+		this.announceExpiryLater();
+		return expired;
+	};
+	elevated = () => this.state()?.elevated ?? false;
+	mayElevate = () => this.state()?.mayElevate ?? false;
+	expiresAt = () => {
+		const iso = this.state()?.expiresAt;
+		return iso ? new Date(iso) : null;
+	};
+	changes$ = new Subject();
+	expiryTimer = null;
+	pendingPrompt = null;
+	expiryAnnouncePending = false;
+	lastReconcileAt = 0;
+	constructor() {
+		if (typeof window !== "undefined") {
+			window.addEventListener("storage", this.onStorage);
+			window.addEventListener("focus", this.onFocus);
+			if (typeof document !== "undefined") document.addEventListener("visibilitychange", this.onVisibilityChange);
+			this.destroyRef.onDestroy(() => {
+				window.removeEventListener("storage", this.onStorage);
+				window.removeEventListener("focus", this.onFocus);
+				if (typeof document !== "undefined") document.removeEventListener("visibilitychange", this.onVisibilityChange);
+				this.clearTimer();
+			});
+		}
+	}
+	get canPrompt() {
+		return this.available && this.prompt !== null;
+	}
+	get apiBase() {
+		return this.store.selectSnapshot(AppConfigState.manifest)?.apiBase ?? "/api/v1";
+	}
+	get available() {
+		return this.url !== null;
+	}
+	get url() {
+		return this.store.selectSnapshot(AppConfigState.manifest)?.identity?.elevationUrl ?? null;
+	}
+	isThisApi(url) {
+		const apiBase = this.store.selectSnapshot(AppConfigState.manifest)?.apiBase ?? "/api/v1";
+		let path = url.split("?")[0];
+		if (/^https?:\/\//.test(path)) try {
+			const parsed = new URL(path);
+			if (typeof window !== "undefined" && parsed.host !== window.location.host) return false;
+			path = parsed.pathname;
+		} catch {
+			return false;
+		}
+		return path === apiBase || path.startsWith(`${apiBase}/`);
+	}
+	refresh() {
+		const url = this.url;
+		if (!url) return of(this.inert());
+		return this.http.get(url, this.options()).pipe(tap((s) => this.apply(s)));
+	}
+	elevate(password, code) {
+		const url = this.url;
+		if (!url) return of(this.inert());
+		const body = { password };
+		if (code) body.code = code;
+		return this.http.post(url, body, this.options()).pipe(tap((s) => this.apply(s, "granted")));
+	}
+	drop(reason = "dropped_by_user") {
+		const url = this.url;
+		if (!url) return of(this.inert());
+		return this.http.delete(`${url}?reason=${reason}`, this.options()).pipe(switchMap(() => this.refresh()));
+	}
+	offerFor(refusal) {
+		if (!this.available || !this.prompt) return of(false);
+		return this.refresh().pipe(switchMap((state) => state.elevated ? of(false) : this.requestElevation({
+			state,
+			refusal
+		})));
+	}
+	requestElevation(request) {
+		if (!this.prompt) return of(false);
+		if (this.pendingPrompt) return this.pendingPrompt;
+		const prompt = this.prompt;
+		this.pendingPrompt = defer(() => prompt.open(request)).pipe(finalize(() => {
+			this.pendingPrompt = null;
+		}), shareReplay(1));
+		return this.pendingPrompt;
+	}
+	options() {
+		return { context: new HttpContext().set(BYPASS_ELEVATION, true) };
+	}
+	inert() {
+		return {
+			elevated: false,
+			ended: {
+				reason: "never",
+				at: null
+			},
+			lifetimeSeconds: 0,
+			lifetimeCeilingSeconds: 0,
+			mfaRequired: false,
+			warnings: []
+		};
+	}
+	apply(next, explicit) {
+		const prev = untracked(() => this.served());
+		this.served.set(next);
+		this.schedule(next);
+		const kind = explicit ?? this.kindOf(prev, next);
+		if (kind === null) return;
+		this.expiryAnnouncePending = false;
+		this.changes$.next({
+			kind,
+			state: next
+		});
+		this.announceToOtherTabs();
+	}
+	kindOf(prev, next) {
+		const was = prev?.elevated ?? false;
+		if (was && !next.elevated) return next.ended.reason === "expired" ? "expired" : "dropped";
+		if (!was && next.elevated) return "granted";
+		if (was && next.elevated && (prev?.expiresAt ?? null) !== (next.expiresAt ?? null)) return "observed";
+		return null;
+	}
+	announceExpiryLater() {
+		if (this.expiryAnnouncePending) return;
+		this.expiryAnnouncePending = true;
+		queueMicrotask(() => {
+			if (!this.expiryAnnouncePending) return;
+			this.expiryAnnouncePending = false;
+			const state = untracked(() => this.served());
+			if (state !== null && !state.elevated) this.changes$.next({
+				kind: "expired",
+				state
+			});
+		});
+	}
+	schedule(state) {
+		this.clearTimer();
+		if (!state.elevated || !state.expiresAt) return;
+		const wanted = Date.parse(state.expiresAt) - Date.now() + 250;
+		const ms = Math.min(Math.max(1e3, wanted), 2147483647);
+		this.expiryTimer = setTimeout(() => {
+			this.expiryTimer = null;
+			this.refresh().subscribe({
+				next: (s) => {
+					if (s.elevated && s.expiresAt && Date.parse(s.expiresAt) <= Date.now()) this.scheduleRetry();
+				},
+				error: () => this.scheduleRetry()
+			});
+		}, ms);
+	}
+	scheduleRetry() {
+		this.clearTimer();
+		this.expiryTimer = setTimeout(() => {
+			this.expiryTimer = null;
+			this.refresh().subscribe({ error: () => void 0 });
+		}, 5e3);
+	}
+	clearTimer() {
+		if (this.expiryTimer !== null) {
+			clearTimeout(this.expiryTimer);
+			this.expiryTimer = null;
+		}
+	}
+	announceToOtherTabs() {
+		try {
+			localStorage.setItem(CROSS_TAB_KEY, String(Date.now()));
+		} catch {}
+	}
+	onStorage = (event) => {
+		if (event.key !== CROSS_TAB_KEY || !this.available) return;
+		this.refresh().subscribe({ error: () => void 0 });
+	};
+	onFocus = () => this.reconcile();
+	onVisibilityChange = () => {
+		if (document.visibilityState === "visible") this.reconcile();
+	};
+	reconcile() {
+		this.state();
+		if (!this.available) return;
+		const now = Date.now();
+		if (now - this.lastReconcileAt < RECONCILE_MIN_INTERVAL_MS) return;
+		this.lastReconcileAt = now;
+		this.refresh().subscribe({ error: () => void 0 });
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: ElevationService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: ElevationService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.3",
+	ngImport: i0,
+	type: ElevationService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}],
+	ctorParameters: () => []
+});
+function isPast(state) {
+	if (!state.elevated || !state.expiresAt) return false;
+	const at = Date.parse(state.expiresAt);
+	return Number.isFinite(at) && at <= Date.now();
+}
+function expiredView(state) {
+	return {
+		...state,
+		elevated: false,
+		expiresAt: null,
+		grantedAt: null,
+		factorConfirmed: null,
+		ended: {
+			reason: "expired",
+			at: state.expiresAt ?? null
+		}
+	};
+}
 var UserPreferencesService = class UserPreferencesService {
 	http = inject(HttpClient);
 	store = inject(Store);
@@ -287,7 +500,10 @@ var UserPreferencesService = class UserPreferencesService {
 	syncToServer(prefs) {
 		const url = this.store.selectSnapshot(AppConfigState.manifest)?.auth?.preferencesUrl;
 		if (!url) return;
-		this.http.patch(url, { uiPrefs: prefs }, { headers: { "Content-Type": "application/merge-patch+json" } }).subscribe({ error: (err) => console.warn("Preferences sync failed:", err) });
+		this.http.patch(url, { uiPrefs: prefs }, {
+			headers: { "Content-Type": "application/merge-patch+json" },
+			context: new HttpContext().set(BACKGROUND_REQUEST, true)
+		}).subscribe({ error: (err) => console.warn("Preferences sync failed:", err) });
 	}
 	getGridPref(gridId) {
 		try {
@@ -397,7 +613,7 @@ var UserPreferencesService = class UserPreferencesService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: UserPreferencesService,
 		deps: [],
@@ -405,7 +621,7 @@ var UserPreferencesService = class UserPreferencesService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: UserPreferencesService,
 		providedIn: "root"
@@ -413,7 +629,7 @@ var UserPreferencesService = class UserPreferencesService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: UserPreferencesService,
 	decorators: [{
@@ -509,7 +725,7 @@ let AuthState = class AuthState {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AuthState,
 		deps: [],
@@ -517,7 +733,7 @@ let AuthState = class AuthState {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AuthState
 	});
@@ -543,7 +759,7 @@ AuthState = __decorate([State({
 })], AuthState);
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: AuthState,
 	decorators: [{ type: Injectable }],
@@ -555,6 +771,127 @@ i0.ɵɵngDeclareClassMetadata({
 		patchCurrentUser: []
 	}
 });
+var ConsoleAccessService = class ConsoleAccessService {
+	static URL = "/api/v1/admin/manifest";
+	static LEGACY_URL = "/api/v1/console/manifest";
+	static REFUSED_REASON = "no-console-access";
+	http = inject(HttpClient);
+	store = inject(Store);
+	answer = "unknown";
+	pending = null;
+	generation = 0;
+	constructor() {
+		inject(Actions).pipe(ofActionDispatched(Login, Logout, RestoreSession)).subscribe(() => {
+			this.generation++;
+			this.answer = "unknown";
+			this.pending = null;
+		});
+	}
+	ensure() {
+		if (!this.store.selectSnapshot(AuthState.isAuthenticated)) return Promise.resolve("unknown");
+		if ("unknown" !== this.answer) return Promise.resolve(this.answer);
+		if (null !== this.pending) return this.pending;
+		const askedFor = this.generation;
+		const pending = firstValueFrom(this.http.get(ConsoleAccessService.URL).pipe(catchError((error) => error instanceof HttpErrorResponse && 404 === error.status ? this.http.get(ConsoleAccessService.LEGACY_URL) : throwError(() => error)), map((response) => ({
+			access: "granted",
+			response
+		})), catchError((error) => of({
+			access: error instanceof HttpErrorResponse && 403 === error.status ? "refused" : "unknown",
+			response: null
+		})))).then(({ access, response }) => {
+			if (askedFor !== this.generation) return this.ensure();
+			if (null !== response) this.merge(response);
+			this.pending = null;
+			this.answer = access;
+			return access;
+		});
+		this.pending = pending;
+		return pending;
+	}
+	signOut() {
+		const logout = this.store.selectSnapshot(AppConfigState.manifest)?.auth?.logout ?? "/api/v1/auth/logout";
+		return this.http.post(logout, null).pipe(catchError(() => of(null)), switchMap(() => this.store.dispatch(new Logout())), map(() => void 0));
+	}
+	merge(response) {
+		const config = this.store.selectSnapshot(AppConfigState.config);
+		this.store.dispatch(new SetAppConfig({
+			...config ?? {},
+			manifest: {
+				...config?.manifest ?? {},
+				...response.manifest
+			}
+		}));
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: ConsoleAccessService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: ConsoleAccessService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.3",
+	ngImport: i0,
+	type: ConsoleAccessService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}],
+	ctorParameters: () => []
+});
+const BACKGROUND = { context: new HttpContext().set(BACKGROUND_REQUEST, true) };
+var RealtimeTokenClient = class RealtimeTokenClient {
+	static REFUSED = "no console access: no realtime connection";
+	http = inject(HttpClient);
+	store = inject(Store);
+	injector = inject(Injector);
+	get manifest() {
+		const m = this.store.selectSnapshot(AppConfigState.manifest);
+		if (!m) throw new Error("ApiManifest not loaded — call AppInitService.load() first");
+		return m;
+	}
+	connectionToken() {
+		return defer(() => this.injector.get(ConsoleAccessService).ensure()).pipe(switchMap((access) => "refused" === access ? throwError(() => new Error(RealtimeTokenClient.REFUSED)) : this.http.post(this.manifest.apiBase + "/centrifugo/connection-token", {}, BACKGROUND)));
+	}
+	subscriptionToken(channel) {
+		return this.http.post(this.manifest.apiBase + "/centrifugo/subscription-token", { channel }, BACKGROUND);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: RealtimeTokenClient,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: RealtimeTokenClient,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.3",
+	ngImport: i0,
+	type: RealtimeTokenClient,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
 const LOCK_NAME = "coolms_auth_refresh";
 const FRESH_TOKEN_GRACE_MS = 3e4;
 const STORAGE_KEY$1 = "coolms_token";
@@ -632,7 +969,7 @@ var AuthRefreshCoordinator = class AuthRefreshCoordinator {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AuthRefreshCoordinator,
 		deps: [],
@@ -640,7 +977,7 @@ var AuthRefreshCoordinator = class AuthRefreshCoordinator {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AuthRefreshCoordinator,
 		providedIn: "root"
@@ -648,7 +985,7 @@ var AuthRefreshCoordinator = class AuthRefreshCoordinator {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: AuthRefreshCoordinator,
 	decorators: [{
@@ -711,7 +1048,7 @@ var CrossTabAuthSyncService = class CrossTabAuthSyncService {
 	};
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: CrossTabAuthSyncService,
 		deps: [],
@@ -719,7 +1056,7 @@ var CrossTabAuthSyncService = class CrossTabAuthSyncService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: CrossTabAuthSyncService,
 		providedIn: "root"
@@ -727,7 +1064,7 @@ var CrossTabAuthSyncService = class CrossTabAuthSyncService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: CrossTabAuthSyncService,
 	decorators: [{
@@ -788,7 +1125,7 @@ var AppInitService = class AppInitService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AppInitService,
 		deps: [],
@@ -796,7 +1133,7 @@ var AppInitService = class AppInitService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: AppInitService,
 		providedIn: "root"
@@ -804,7 +1141,7 @@ var AppInitService = class AppInitService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: AppInitService,
 	decorators: [{
@@ -816,9 +1153,13 @@ const authGuard = () => {
 	const init = inject(AppInitService);
 	const store = inject(Store);
 	const router = inject(Router);
-	return init.ready$.pipe(take(1), map(() => {
-		if (store.selectSnapshot(AuthState.isAuthenticated)) return true;
-		return router.createUrlTree(["/login"]);
+	const consoleAccess = inject(ConsoleAccessService);
+	return init.ready$.pipe(take(1), switchMap(() => {
+		if (!store.selectSnapshot(AuthState.isAuthenticated)) return of(router.createUrlTree(["/login"]));
+		return from(consoleAccess.ensure()).pipe(switchMap((access) => {
+			if (!store.selectSnapshot(AuthState.isAuthenticated)) return of(router.createUrlTree(["/login"]));
+			return "refused" !== access ? of(true) : consoleAccess.signOut().pipe(map(() => router.createUrlTree(["/login"], { queryParams: { reason: ConsoleAccessService.REFUSED_REASON } })));
+		}));
 	}));
 };
 const loginPageGuard = () => {
@@ -833,262 +1174,28 @@ const loginPageGuard = () => {
 const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
 const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
 const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
-const ELEVATION_PROMPT = new InjectionToken("coolms.elevation-prompt");
-const BYPASS_ELEVATION = new HttpContextToken(() => false);
-const CROSS_TAB_KEY = "coolms.elevation.changed";
-const RECONCILE_MIN_INTERVAL_MS = 2e3;
-const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
-var ElevationService = class ElevationService {
-	http = inject(HttpClient);
-	store = inject(Store);
-	prompt = inject(ELEVATION_PROMPT, { optional: true });
-	destroyRef = inject(DestroyRef);
-	served = signal(null, ...ngDevMode ? [{ debugName: "served" }] : /* istanbul ignore next */ []);
-	state = () => {
-		const served = this.served();
-		if (served === null || !isPast(served)) return served;
-		const expired = expiredView(served);
-		untracked(() => this.served.set(expired));
-		this.announceExpiryLater();
-		return expired;
-	};
-	elevated = () => this.state()?.elevated ?? false;
-	expiresAt = () => {
-		const iso = this.state()?.expiresAt;
-		return iso ? new Date(iso) : null;
-	};
-	changes$ = new Subject();
-	expiryTimer = null;
-	pendingPrompt = null;
-	expiryAnnouncePending = false;
-	lastReconcileAt = 0;
-	constructor() {
-		if (typeof window !== "undefined") {
-			window.addEventListener("storage", this.onStorage);
-			window.addEventListener("focus", this.onFocus);
-			if (typeof document !== "undefined") document.addEventListener("visibilitychange", this.onVisibilityChange);
-			this.destroyRef.onDestroy(() => {
-				window.removeEventListener("storage", this.onStorage);
-				window.removeEventListener("focus", this.onFocus);
-				if (typeof document !== "undefined") document.removeEventListener("visibilitychange", this.onVisibilityChange);
-				this.clearTimer();
-			});
-		}
-	}
-	get available() {
-		return this.url !== null;
-	}
-	get url() {
-		return this.store.selectSnapshot(AppConfigState.manifest)?.identity?.elevationUrl ?? null;
-	}
-	isThisApi(url) {
-		const apiBase = this.store.selectSnapshot(AppConfigState.manifest)?.apiBase ?? "/api/v1";
-		let path = url.split("?")[0];
-		if (/^https?:\/\//.test(path)) try {
-			const parsed = new URL(path);
-			if (typeof window !== "undefined" && parsed.host !== window.location.host) return false;
-			path = parsed.pathname;
-		} catch {
-			return false;
-		}
-		return path === apiBase || path.startsWith(`${apiBase}/`);
-	}
-	refresh() {
-		const url = this.url;
-		if (!url) return of(this.inert());
-		return this.http.get(url, this.options()).pipe(tap((s) => this.apply(s)));
-	}
-	elevate(password, code) {
-		const url = this.url;
-		if (!url) return of(this.inert());
-		const body = { password };
-		if (code) body.code = code;
-		return this.http.post(url, body, this.options()).pipe(tap((s) => this.apply(s, "granted")));
-	}
-	drop(reason = "dropped_by_user") {
-		const url = this.url;
-		if (!url) return of(this.inert());
-		return this.http.delete(`${url}?reason=${reason}`, this.options()).pipe(switchMap(() => this.refresh()));
-	}
-	offerFor(refusal) {
-		if (!this.available || !this.prompt) return of(false);
-		return this.refresh().pipe(switchMap((state) => state.elevated ? of(false) : this.requestElevation({
-			state,
-			refusal
-		})));
-	}
-	requestElevation(request) {
-		if (!this.prompt) return of(false);
-		if (this.pendingPrompt) return this.pendingPrompt;
-		const prompt = this.prompt;
-		this.pendingPrompt = defer(() => prompt.open(request)).pipe(finalize(() => {
-			this.pendingPrompt = null;
-		}), shareReplay(1));
-		return this.pendingPrompt;
-	}
-	options() {
-		return { context: new HttpContext().set(BYPASS_ELEVATION, true) };
-	}
-	inert() {
-		return {
-			elevated: false,
-			ended: {
-				reason: "never",
-				at: null
-			},
-			lifetimeSeconds: 0,
-			lifetimeCeilingSeconds: 0,
-			mfaRequired: false,
-			warnings: []
-		};
-	}
-	apply(next, explicit) {
-		const prev = untracked(() => this.served());
-		this.served.set(next);
-		this.schedule(next);
-		const kind = explicit ?? this.kindOf(prev, next);
-		if (kind === null) return;
-		this.expiryAnnouncePending = false;
-		this.changes$.next({
-			kind,
-			state: next
-		});
-		this.announceToOtherTabs();
-	}
-	kindOf(prev, next) {
-		const was = prev?.elevated ?? false;
-		if (was && !next.elevated) return next.ended.reason === "expired" ? "expired" : "dropped";
-		if (!was && next.elevated) return "granted";
-		if (was && next.elevated && (prev?.expiresAt ?? null) !== (next.expiresAt ?? null)) return "observed";
-		return null;
-	}
-	announceExpiryLater() {
-		if (this.expiryAnnouncePending) return;
-		this.expiryAnnouncePending = true;
-		queueMicrotask(() => {
-			if (!this.expiryAnnouncePending) return;
-			this.expiryAnnouncePending = false;
-			const state = untracked(() => this.served());
-			if (state !== null && !state.elevated) this.changes$.next({
-				kind: "expired",
-				state
-			});
-		});
-	}
-	schedule(state) {
-		this.clearTimer();
-		if (!state.elevated || !state.expiresAt) return;
-		const wanted = Date.parse(state.expiresAt) - Date.now() + 250;
-		const ms = Math.min(Math.max(1e3, wanted), 2147483647);
-		this.expiryTimer = setTimeout(() => {
-			this.expiryTimer = null;
-			this.refresh().subscribe({
-				next: (s) => {
-					if (s.elevated && s.expiresAt && Date.parse(s.expiresAt) <= Date.now()) this.scheduleRetry();
-				},
-				error: () => this.scheduleRetry()
-			});
-		}, ms);
-	}
-	scheduleRetry() {
-		this.clearTimer();
-		this.expiryTimer = setTimeout(() => {
-			this.expiryTimer = null;
-			this.refresh().subscribe({ error: () => void 0 });
-		}, 5e3);
-	}
-	clearTimer() {
-		if (this.expiryTimer !== null) {
-			clearTimeout(this.expiryTimer);
-			this.expiryTimer = null;
-		}
-	}
-	announceToOtherTabs() {
-		try {
-			localStorage.setItem(CROSS_TAB_KEY, String(Date.now()));
-		} catch {}
-	}
-	onStorage = (event) => {
-		if (event.key !== CROSS_TAB_KEY || !this.available) return;
-		this.refresh().subscribe({ error: () => void 0 });
-	};
-	onFocus = () => this.reconcile();
-	onVisibilityChange = () => {
-		if (document.visibilityState === "visible") this.reconcile();
-	};
-	reconcile() {
-		this.state();
-		if (!this.available) return;
-		const now = Date.now();
-		if (now - this.lastReconcileAt < RECONCILE_MIN_INTERVAL_MS) return;
-		this.lastReconcileAt = now;
-		this.refresh().subscribe({ error: () => void 0 });
-	}
-	static ɵfac = i0.ɵɵngDeclareFactory({
-		minVersion: "12.0.0",
-		version: "22.2.0",
-		ngImport: i0,
-		type: ElevationService,
-		deps: [],
-		target: i0.ɵɵFactoryTarget.Injectable
-	});
-	static ɵprov = i0.ɵɵngDeclareInjectable({
-		minVersion: "12.0.0",
-		version: "22.2.0",
-		ngImport: i0,
-		type: ElevationService,
-		providedIn: "root"
-	});
-};
-i0.ɵɵngDeclareClassMetadata({
-	minVersion: "12.0.0",
-	version: "22.2.0",
-	ngImport: i0,
-	type: ElevationService,
-	decorators: [{
-		type: Injectable,
-		args: [{ providedIn: "root" }]
-	}],
-	ctorParameters: () => []
-});
-function isPast(state) {
-	if (!state.elevated || !state.expiresAt) return false;
-	const at = Date.parse(state.expiresAt);
-	return Number.isFinite(at) && at <= Date.now();
-}
-function expiredView(state) {
-	return {
-		...state,
-		elevated: false,
-		expiresAt: null,
-		grantedAt: null,
-		factorConfirmed: null,
-		ended: {
-			reason: "expired",
-			at: state.expiresAt ?? null
-		}
-	};
-}
+const FRAMEWORK_REFUSAL = /^\s*access denied\.?\s*$/i;
 var ErrorHandlerService = class ErrorHandlerService {
 	humanize(err) {
 		if (!(err instanceof HttpErrorResponse)) return err instanceof Error ? err.message : "An unexpected error occurred.";
+		const elevationRefusal = isElevationRefusal(err);
 		const body = err.error;
 		if (body && typeof body === "object") {
 			const detail = body["detail"] ?? body["hydra:description"] ?? body["message"];
-			if (typeof detail === "string" && detail.trim()) return detail.trim();
+			if (typeof detail === "string" && detail.trim() && !FRAMEWORK_REFUSAL.test(detail)) return detail.trim();
 			if (Array.isArray(body["violations"])) {
 				const msgs = body["violations"].map((v) => v.message).filter(Boolean);
 				if (msgs.length) return msgs.join(" ");
 			}
 		}
-		return this.statusMessage(err.status);
+		return elevationRefusal ? "This needs an elevated session." : this.statusMessage(err.status);
 	}
 	statusMessage(status) {
 		switch (status) {
 			case 0: return "Network error. Check your connection.";
 			case 400: return "Invalid request.";
 			case 401: return "Session expired. Please sign in again.";
-			case 403: return "Access denied.";
+			case 403: return "You don't have access to this.";
 			case 404: return "Resource not found.";
 			case 409: return "Conflict — resource already exists.";
 			case 422: return "Validation failed.";
@@ -1100,7 +1207,7 @@ var ErrorHandlerService = class ErrorHandlerService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ErrorHandlerService,
 		deps: [],
@@ -1108,7 +1215,7 @@ var ErrorHandlerService = class ErrorHandlerService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ErrorHandlerService,
 		providedIn: "root"
@@ -1116,7 +1223,7 @@ var ErrorHandlerService = class ErrorHandlerService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: ErrorHandlerService,
 	decorators: [{
@@ -1124,42 +1231,85 @@ i0.ɵɵngDeclareClassMetadata({
 		args: [{ providedIn: "root" }]
 	}]
 });
+const READS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
 const elevationInterceptor = (req, next) => {
 	const elevation = inject(ElevationService);
+	if (req.context.get(BYPASS_ELEVATION) || req.context.get(BACKGROUND_REQUEST) || READS.has(req.method.toUpperCase()) || !elevation.isThisApi(req.url)) return next(req);
+	const notice = inject(ELEVATION_NOTICE, { optional: true });
 	const errors = inject(ErrorHandlerService);
-	if (req.context.get(BYPASS_ELEVATION) || !elevation.isThisApi(req.url)) return next(req);
 	return next(req).pipe(catchError((err) => {
-		if (!(err instanceof HttpErrorResponse) || err.status !== 403 || !err.headers.get("X-Elevation-Required")) return throwError(() => err);
-		return elevation.offerFor(errors.humanize(err)).pipe(switchMap((granted) => granted ? next(req) : throwError(() => err)));
+		if (!isElevationRefusal(err)) return throwError(() => err);
+		const refusal = errors.humanize(err);
+		const action = actionOf(req, elevation.apiBase);
+		const decline = () => {
+			notice?.refused(refusal, action);
+			return throwError(() => err);
+		};
+		if (!elevation.canPrompt) return decline();
+		return elevation.refresh().pipe(switchMap((state) => state.elevated ? of(true) : elevation.requestElevation({
+			state,
+			refusal,
+			action
+		})), catchError(() => of(false)), switchMap((granted) => granted ? next(req) : decline()));
 	}));
 };
+function actionOf(req, apiBase = "/api/v1") {
+	const named = req.context.get(ELEVATION_ACTION);
+	if (named) return named;
+	const verb = {
+		POST: "Creating",
+		PUT: "Saving",
+		PATCH: "Saving",
+		DELETE: "Deleting"
+	}[req.method.toUpperCase()] ?? "This change";
+	let path = req.url.split("?")[0];
+	try {
+		path = new URL(path, "http://x").pathname;
+	} catch {}
+	if (path.startsWith(apiBase)) path = path.slice(apiBase.length);
+	const words = path.split("/").filter((s) => s !== "" && !/^[0-9a-f-]{8,}$/i.test(s) && !/^\d+$/.test(s)).map((s) => s.replace(/[-_]/g, " "));
+	return words.length === 0 ? verb : `${verb} ${words.join(" ")}`;
+}
 var LoginComponent = class LoginComponent {
 	identifier = "";
 	password = "";
-	loading = false;
-	error = null;
+	loading = signal(false, ...ngDevMode ? [{ debugName: "loading" }] : /* istanbul ignore next */ []);
+	error = signal(null, ...ngDevMode ? [{ debugName: "error" }] : /* istanbul ignore next */ []);
 	store = inject(Store);
 	router = inject(Router);
+	static NO_CONSOLE_ACCESS = "This account has no access to the console.";
+	constructor() {
+		inject(ActivatedRoute).queryParamMap.pipe(takeUntilDestroyed()).subscribe((params) => {
+			if (ConsoleAccessService.REFUSED_REASON === params.get("reason")) {
+				this.loading.set(false);
+				this.error.set(LoginComponent.NO_CONSOLE_ACCESS);
+			}
+		});
+	}
 	submit() {
 		if (!this.identifier || !this.password) return;
-		this.loading = true;
-		this.error = null;
+		this.loading.set(true);
+		this.error.set(null);
 		this.store.dispatch(new Login(this.identifier, this.password)).subscribe({
 			next: () => {
 				this.router.navigate(["/"]).catch(() => {
-					this.loading = false;
-					this.error = "Signed in, but the admin could not be opened. Please reload.";
+					this.loading.set(false);
+					this.error.set("Signed in, but the admin could not be opened. Please reload.");
 				});
 			},
 			error: (err) => {
-				this.loading = false;
-				this.error = err?.error?.detail ?? err?.error?.message ?? err?.message ?? "Invalid credentials. Please try again.";
+				this.loading.set(false);
+				this.error.set(err?.error?.detail ?? err?.error?.message ?? err?.message ?? "Invalid credentials. Please try again.");
 			}
 		});
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: LoginComponent,
 		deps: [],
@@ -1167,12 +1317,12 @@ var LoginComponent = class LoginComponent {
 	});
 	static ɵcmp = i0.ɵɵngDeclareComponent({
 		minVersion: "14.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		type: LoginComponent,
 		isStandalone: true,
 		selector: "coolms-admin-login",
 		ngImport: i0,
-		template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in…' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n",
+		template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error()\" class=\"alert alert-danger py-2 small\">{{ error() }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading() || loginForm.invalid\"\n        >\n          {{ loading() ? 'Signing in…' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n",
 		dependencies: [
 			{
 				kind: "ngmodule",
@@ -1240,7 +1390,7 @@ var LoginComponent = class LoginComponent {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: LoginComponent,
 	decorators: [{
@@ -1249,9 +1399,10 @@ i0.ɵɵngDeclareClassMetadata({
 			selector: "coolms-admin-login",
 			standalone: true,
 			imports: [FormsModule, NgIf],
-			template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error\" class=\"alert alert-danger py-2 small\">{{ error }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading || loginForm.invalid\"\n        >\n          {{ loading ? 'Signing in…' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n"
+			template: "<div class=\"d-flex align-items-center justify-content-center min-vh-100 bg-light\">\n  <div class=\"card shadow-sm\" style=\"width: 360px\">\n    <div class=\"card-body p-4\">\n      <h1 class=\"h5 mb-1\">CoolMS Admin</h1>\n      <p class=\"text-muted small mb-4\">Sign in to continue</p>\n\n      <div *ngIf=\"error()\" class=\"alert alert-danger py-2 small\">{{ error() }}</div>\n\n      <form (ngSubmit)=\"submit()\" #loginForm=\"ngForm\">\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Email or username</label>\n          <input\n            type=\"text\"\n            class=\"form-control\"\n            [(ngModel)]=\"identifier\"\n            name=\"identifier\"\n            required\n            autocomplete=\"username\"\n          />\n        </div>\n        <div class=\"mb-3\">\n          <label class=\"form-label\">Password</label>\n          <input\n            type=\"password\"\n            class=\"form-control\"\n            [(ngModel)]=\"password\"\n            name=\"password\"\n            required\n            autocomplete=\"current-password\"\n          />\n        </div>\n        <button\n          type=\"submit\"\n          class=\"cms-btn cms-btn-primary w-100 justify-content-center\"\n          [disabled]=\"loading() || loginForm.invalid\"\n        >\n          {{ loading() ? 'Signing in…' : 'Sign in' }}\n        </button>\n      </form>\n    </div>\n  </div>\n</div>\n"
 		}]
-	}]
+	}],
+	ctorParameters: () => []
 });
 var ConfigService = class ConfigService {
 	http = inject(HttpClient);
@@ -1276,14 +1427,17 @@ var ConfigService = class ConfigService {
 		const key = `${type}/${id}`;
 		if (!this.cache.has(key)) {
 			const base = this.store.selectSnapshot(AppConfigState.manifest)?.configBase ?? "/api/v1/config";
-			const obs = this.http.get(`${base}/${type}/${id}`).pipe(map((r) => r.data ?? r), shareReplay(1));
+			const obs = this.http.get(`${base}/${type}/${id}`).pipe(map((r) => r.data ?? r), catchError((err) => {
+				this.cache.delete(key);
+				return throwError(() => err);
+			}), shareReplay(1));
 			this.cache.set(key, obs);
 		}
 		return this.cache.get(key);
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ConfigService,
 		deps: [],
@@ -1291,7 +1445,7 @@ var ConfigService = class ConfigService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ConfigService,
 		providedIn: "root"
@@ -1299,7 +1453,7 @@ var ConfigService = class ConfigService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: ConfigService,
 	decorators: [{
@@ -1409,7 +1563,7 @@ var ThemeService = class ThemeService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ThemeService,
 		deps: [],
@@ -1417,7 +1571,7 @@ var ThemeService = class ThemeService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ThemeService,
 		providedIn: "root"
@@ -1425,7 +1579,7 @@ var ThemeService = class ThemeService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: ThemeService,
 	decorators: [{
@@ -1441,7 +1595,7 @@ var CmsLoaderComponent = class CmsLoaderComponent {
 	clipId = "cms-loader-" + Math.random().toString(36).slice(2, 9);
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: CmsLoaderComponent,
 		deps: [],
@@ -1449,7 +1603,7 @@ var CmsLoaderComponent = class CmsLoaderComponent {
 	});
 	static ɵcmp = i0.ɵɵngDeclareComponent({
 		minVersion: "17.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		type: CmsLoaderComponent,
 		isStandalone: true,
 		selector: "cms-loader",
@@ -1510,7 +1664,7 @@ var CmsLoaderComponent = class CmsLoaderComponent {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: CmsLoaderComponent,
 	decorators: [{
@@ -1660,7 +1814,7 @@ var SidebarStateService = class SidebarStateService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: SidebarStateService,
 		deps: [],
@@ -1668,7 +1822,7 @@ var SidebarStateService = class SidebarStateService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: SidebarStateService,
 		providedIn: "root"
@@ -1676,7 +1830,7 @@ var SidebarStateService = class SidebarStateService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: SidebarStateService,
 	decorators: [{
@@ -1692,7 +1846,7 @@ var EntitySearchService = class EntitySearchService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: EntitySearchService,
 		deps: [],
@@ -1700,7 +1854,7 @@ var EntitySearchService = class EntitySearchService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: EntitySearchService,
 		providedIn: "root"
@@ -1708,7 +1862,7 @@ var EntitySearchService = class EntitySearchService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: EntitySearchService,
 	decorators: [{
@@ -1724,8 +1878,8 @@ var NaviGraphService = class NaviGraphService {
 	adminNav = signal([], ...ngDevMode ? [{ debugName: "adminNav" }] : /* istanbul ignore next */ []);
 	topbarNav = signal([], ...ngDevMode ? [{ debugName: "topbarNav" }] : /* istanbul ignore next */ []);
 	cache = /* @__PURE__ */ new Map();
-	loadAdminNav(url) {
-		return this.loadTree(url).pipe(map((tree) => {
+	loadAdminNav(url, options = {}) {
+		return this.loadTree(url, options.fresh ?? false).pipe(map((tree) => {
 			this.adminNav.set(tree);
 			return tree;
 		}));
@@ -1775,8 +1929,8 @@ var NaviGraphService = class NaviGraphService {
 			default: return false;
 		}
 	}
-	loadTree(url) {
-		if (this.cache.has(url)) return of(this.cache.get(url));
+	loadTree(url, fresh = false) {
+		if (!fresh && this.cache.has(url)) return of(this.cache.get(url));
 		return this.http.get(url, { headers: { Accept: "application/ld+json" } }).pipe(map((r) => {
 			const raw = r["member"] ?? r["hydra:member"] ?? [];
 			const flat = Array.isArray(raw) ? raw : [];
@@ -1785,7 +1939,7 @@ var NaviGraphService = class NaviGraphService {
 			return tree;
 		}), catchError((err) => {
 			console.error("[NaviGraph] loadTree failed for", url, this.errors.humanize(err));
-			return of([]);
+			return of(this.cache.get(url) ?? []);
 		}));
 	}
 	buildTree(flat) {
@@ -1806,7 +1960,7 @@ var NaviGraphService = class NaviGraphService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: NaviGraphService,
 		deps: [],
@@ -1814,7 +1968,7 @@ var NaviGraphService = class NaviGraphService {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: NaviGraphService,
 		providedIn: "root"
@@ -1822,7 +1976,7 @@ var NaviGraphService = class NaviGraphService {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: NaviGraphService,
 	decorators: [{
@@ -1830,6 +1984,9 @@ i0.ɵɵngDeclareClassMetadata({
 		args: [{ providedIn: "root" }]
 	}]
 });
+function naviAccessOf(node) {
+	return node.access === "elevate" ? "elevate" : "allowed";
+}
 var ComponentRegistry = class ComponentRegistry {
 	static map = /* @__PURE__ */ new Map();
 	static register(key, component) {
@@ -1858,7 +2015,7 @@ var ComponentRegistry = class ComponentRegistry {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ComponentRegistry,
 		deps: [],
@@ -1866,7 +2023,7 @@ var ComponentRegistry = class ComponentRegistry {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ComponentRegistry,
 		providedIn: "root"
@@ -1874,7 +2031,7 @@ var ComponentRegistry = class ComponentRegistry {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: ComponentRegistry,
 	decorators: [{
@@ -1957,7 +2114,7 @@ var ConsoleActivation = class ConsoleActivation {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ConsoleActivation,
 		deps: [],
@@ -1965,7 +2122,7 @@ var ConsoleActivation = class ConsoleActivation {
 	});
 	static ɵprov = i0.ɵɵngDeclareInjectable({
 		minVersion: "12.0.0",
-		version: "22.2.0",
+		version: "22.2.3",
 		ngImport: i0,
 		type: ConsoleActivation,
 		providedIn: "root"
@@ -1973,7 +2130,7 @@ var ConsoleActivation = class ConsoleActivation {
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.0",
+	version: "22.2.3",
 	ngImport: i0,
 	type: ConsoleActivation,
 	decorators: [{
@@ -1984,7 +2141,8 @@ i0.ɵɵngDeclareClassMetadata({
 function consoleModuleInstalled(module) {
 	return () => {
 		const activation = inject(ConsoleActivation);
-		return inject(AppInitService).ready$.pipe(take(1), map(() => activation.isInstalled(module)));
+		const consoleAccess = inject(ConsoleAccessService);
+		return inject(AppInitService).ready$.pipe(take(1), switchMap(() => from(consoleAccess.ensure())), map(() => activation.isInstalled(module)));
 	};
 }
 function consoleChildren(entries) {
@@ -2043,6 +2201,6 @@ function shouldStamp(url) {
 	if (path.startsWith("/api/v1/auth/")) return false;
 	return true;
 }
-export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BYPASS_AUTH, BYPASS_ELEVATION, CONSOLE_CONTRACT, CONSOLE_ENTRIES, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, ConsoleActivation, ConsoleAssemblyError, ConsolePanelHost, CrossTabAuthSyncService, ELEVATION_PROMPT, ELEVATION_REQUIRED_HEADER, ELEVATION_WARNING_FACTOR_MISSING, ELEVATION_WARNING_MFA_OFF, ELEVATION_WARNING_PASSWORD_NOT_SET, ElevationService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, assembleConsole, authGuard, authInterceptor, consoleChildren, consoleEntry, consoleModuleInstalled, elevationInterceptor, installedConsoleModules, isPortProvision, loginPageGuard, provideConsole, resolvePattern, satisfiesRange, sectionInterceptor };
+export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BACKGROUND_REQUEST, BYPASS_AUTH, BYPASS_ELEVATION, CONSOLE_CONTRACT, CONSOLE_ENTRIES, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, ConsoleAccessService, ConsoleActivation, ConsoleAssemblyError, ConsolePanelHost, CrossTabAuthSyncService, ELEVATION_ACTION, ELEVATION_NOTICE, ELEVATION_PROMPT, ELEVATION_REQUIRED_HEADER, ELEVATION_WARNING_FACTOR_MISSING, ELEVATION_WARNING_MFA_OFF, ELEVATION_WARNING_PASSWORD_NOT_SET, ElevationService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, actionOf, assembleConsole, authGuard, authInterceptor, consoleChildren, consoleEntry, consoleModuleInstalled, elevationInterceptor, installedConsoleModules, isElevationRefusal, isPortProvision, loginPageGuard, naviAccessOf, provideConsole, resolvePattern, satisfiesRange, sectionInterceptor };
 
 //# sourceMappingURL=coolms-core-angular.mjs.map