@coolms/core-angular 2.0.0-alpha.5 → 2.0.0-alpha.6

package/types/coolms-core-angular.d.ts

@@ -1,166 +1,164 @@
-import * as rxjs from 'rxjs';
-import { Observable, Subject } from 'rxjs';
-import * as i0 from '@angular/core';
-import { InjectionToken, Type, Provider, EnvironmentProviders } from '@angular/core';
-import { StateContext } from '@ngxs/store';
-import { CanActivateFn, Routes, CanMatchFn } from '@angular/router';
-import { HttpContextToken, HttpInterceptorFn } from '@angular/common/http';
-
-interface AuthApiManifest {
-    readonly login: string;
-    readonly logout: string;
-    readonly refresh: string;
-    readonly register: string;
-    readonly me: string;
-    readonly usersApi?: string;
-    readonly groupsApi?: string;
-    readonly preferencesUrl?: string;
-    readonly groupFormId?: string | null;
-    readonly userFormId?: string | null;
-}
-interface SectionApiManifest {
-    readonly list: string;
-    readonly create: string;
-    readonly item: string;
-    readonly update: string;
-    readonly delete: string;
-    readonly formId?: string;
-    readonly apply?: string;
-}
-interface NaviApiManifest {
-    readonly treesList: string;
-    readonly treesCreate: string;
-    readonly treesItem: string;
-    readonly nodesList: string;
-    readonly nodesCreate: string;
-    readonly nodesItem: string;
-    readonly nodesReorder: string;
-    readonly nodesMove: string;
-    readonly nodesByTree: string;
-    readonly treesFormId?: string;
-    readonly nodesFormId?: string;
-    readonly adminNavGraph?: string;
-    readonly topbarNavGraph?: string;
-    readonly toolbarVfsGraph?: string;
-    readonly graphBySlug?: string;
-}
-interface ContentApiManifest {
-    readonly variantPublishUrl: string;
-    readonly pageSpacesUrl?: string;
-    readonly pageTypesUrl?: string;
-}
-interface DataGridApiManifest {
-    readonly configBase: string;
-}
-interface TerminalApiManifest {
-    readonly executeUrl: string;
-    readonly completeUrl: string;
-}
-interface MediaApiManifest {
-    readonly listUrl: string;
-    readonly itemUrl: string;
-    readonly permissionsUrl: string;
-    readonly regenerateUrl: string;
-    readonly resizeUrl: string;
-    readonly collectionsUrl: string;
-    readonly collectionsCreateUrl: string;
-    readonly collectionPermissionsUrl: string;
-    readonly moveUrl?: string;
-    readonly spacesUrl?: string;
-}
-interface VfsApiManifest {
-    readonly fileContentUrl: string;
-    readonly binaryWriteUrl: string;
+import { Observable, Subject } from "rxjs";
+import * as i0 from "@angular/core";
+import { EnvironmentProviders, InjectionToken, Provider, Type } from "@angular/core";
+import { StateContext } from "@ngxs/store";
+import { CanActivateFn, CanMatchFn, Routes } from "@angular/router";
+import { HttpContextToken, HttpInterceptorFn, HttpRequest } from "@angular/common/http";
+export interface AuthApiManifest {
+  readonly login: string;
+  readonly logout: string;
+  readonly refresh: string;
+  readonly register: string;
+  readonly me: string;
+  readonly usersApi?: string;
+  readonly groupsApi?: string;
+  readonly preferencesUrl?: string;
+  readonly groupFormId?: string | null;
+  readonly userFormId?: string | null;
+}
+export interface SectionApiManifest {
+  readonly list: string;
+  readonly create: string;
+  readonly item: string;
+  readonly update: string;
+  readonly delete: string;
+  readonly formId?: string;
+  readonly apply?: string;
+}
+export interface NaviApiManifest {
+  readonly treesList: string;
+  readonly treesCreate: string;
+  readonly treesItem: string;
+  readonly nodesList: string;
+  readonly nodesCreate: string;
+  readonly nodesItem: string;
+  readonly nodesReorder: string;
+  readonly nodesMove: string;
+  readonly nodesByTree: string;
+  readonly treesFormId?: string;
+  readonly nodesFormId?: string;
+  readonly adminNavGraph?: string;
+  readonly topbarNavGraph?: string;
+  readonly toolbarVfsGraph?: string;
+  readonly graphBySlug?: string;
+}
+export interface ContentApiManifest {
+  readonly variantPublishUrl: string;
+  readonly pageSpacesUrl?: string;
+  readonly pageTypesUrl?: string;
+}
+export interface DataGridApiManifest {
+  readonly configBase: string;
+}
+export interface TerminalApiManifest {
+  readonly executeUrl: string;
+  readonly completeUrl: string;
+}
+export interface MediaApiManifest {
+  readonly listUrl: string;
+  readonly itemUrl: string;
+  readonly permissionsUrl: string;
+  readonly regenerateUrl: string;
+  readonly resizeUrl: string;
+  readonly collectionsUrl: string;
+  readonly collectionsCreateUrl: string;
+  readonly collectionPermissionsUrl: string;
+  readonly moveUrl?: string;
+  readonly spacesUrl?: string;
+}
+export interface VfsApiManifest {
+  readonly fileContentUrl: string;
+  readonly binaryWriteUrl: string;
 }
 /**
  * Document module URL section. Today the only entry is `spacesUrl`;
  * the struct is reserved so future Document-module URLs can land
  * here without a new manifest section.
  */
-interface DocumentApiManifest {
-    readonly spacesUrl?: string;
-    /**
-     * !! Carried here rather than derived from `spacesUrl`. Concatenating
-     * `/available` onto that would couple the client to a URL shape the router
-     * owns, and it would keep working until the route moved -- then fail as a
-     * 404 the UI reports as "no sites available", which is indistinguishable
-     * from the true empty answer.
-     *
-     * !! ABSENT ARRIVES AS `''`, NOT `undefined`. The producer declares these
-     * as non-nullable strings defaulting to empty, so an installation that has
-     * not set them sends an empty string and the `?` here never fires.
-     *
-     * Guard on FALSINESS -- `!url`, `Boolean(url)`. The dangerous rewrite is
-     * `url === undefined` (or `!== undefined`), which reads as more precise and
-     * treats `''` as present, handing a caller a request to the empty string.
-     *
-     * !! A `?? fallback` is NOT the hazard, though it looks like the obvious
-     * one: `'' ?? x` is `''`, so a fallback never fires on the value this
-     * producer actually sends. Measured by mutation -- adding one changed
-     * nothing, changing the guard broke three assertions.
-     */
-    readonly spacesAvailableUrl?: string;
-    readonly spaceEnablementUrl?: string;
-    /**
-     * FQCN of the entity a filter-mode audience can be built from.
-     *
-     * !! The SERVER owns this and the client must not know it. The generation
-     * wizard offers Filter mode only when a template's context schema
-     * references this type, and it used to compare against a constant compiled
-     * into this bundle -- which shipped the consuming application's class name
-     * inside a published package, and tied that package to an installation
-     * having that exact class.
-     *
-     * !! Absent arrives as `''`, like the urls above. Treat empty as **filter
-     * mode unavailable**, never as a reason to fall back to a remembered
-     * value: the server is the thing that rejects every other type, so a guess
-     * here offers a mode the server will refuse.
-     */
-    readonly filterAudienceEntity?: string;
-}
-interface DynamicEntityApiManifest {
-    readonly typesUrl: string;
-    readonly fieldDefinitionsUrl: string;
-    readonly fieldDefinitionUrl: string;
-    readonly fieldDefinitionsReorderUrl: string;
-    readonly toolbarNaviGraphUrl: string;
-    readonly constraintsUrl: string;
-    readonly recordsUrl: string;
-    readonly recordUrl: string;
-    readonly recordsByTypeUrl: string;
-    readonly typeUrl: string;
-    readonly typesCreateUrl: string;
-    readonly formTypesUrl?: string;
-    readonly typeByAliasUrl?: string;
-}
-interface DomainExplorerApiManifest {
-    readonly entitiesUrl: string;
-    readonly entityUrl: string;
-    readonly toolbarNaviGraphUrl: string;
-    readonly domainExplorerToolbarUrl: string;
-    readonly entityFieldsDataGridUrl?: string;
-    readonly typeFieldsDataGridUrl?: string;
-}
-interface IdentityApiManifest {
-    readonly usersUrl: string;
-    readonly userUrl: string;
-    readonly groupsUrl: string;
-    readonly groupUrl: string;
-    readonly meUrl: string;
-    readonly assignGroupsUrl: string;
-    readonly avatarUploadUrl: string;
-    readonly settingsUrl: string;
-    readonly settingsSectionsUrl: string;
-    readonly settingsSectionUrl: string;
-    readonly colorUrl: string;
-    readonly rolesUrl?: string;
-    readonly elevationUrl?: string;
-    readonly deletionsUrl?: string;
-    readonly footprintsUrl?: string;
-    readonly userDeletionUrl?: string;
-    readonly userLegalHoldsUrl?: string;
-    readonly holdsSettingsBlock?: string;
-    readonly legalHoldFormId?: string | null;
+export interface DocumentApiManifest {
+  readonly spacesUrl?: string;
+  /**
+   * !! Carried here rather than derived from `spacesUrl`. Concatenating
+   * `/available` onto that would couple the client to a URL shape the router
+   * owns, and it would keep working until the route moved -- then fail as a
+   * 404 the UI reports as "no sites available", which is indistinguishable
+   * from the true empty answer.
+   *
+   * !! ABSENT ARRIVES AS `''`, NOT `undefined`. The producer declares these
+   * as non-nullable strings defaulting to empty, so an installation that has
+   * not set them sends an empty string and the `?` here never fires.
+   *
+   * Guard on FALSINESS -- `!url`, `Boolean(url)`. The dangerous rewrite is
+   * `url === undefined` (or `!== undefined`), which reads as more precise and
+   * treats `''` as present, handing a caller a request to the empty string.
+   *
+   * !! A `?? fallback` is NOT the hazard, though it looks like the obvious
+   * one: `'' ?? x` is `''`, so a fallback never fires on the value this
+   * producer actually sends. Measured by mutation -- adding one changed
+   * nothing, changing the guard broke three assertions.
+   */
+  readonly spacesAvailableUrl?: string;
+  readonly spaceEnablementUrl?: string;
+  /**
+   * FQCN of the entity a filter-mode audience can be built from.
+   *
+   * !! The SERVER owns this and the client must not know it. The generation
+   * wizard offers Filter mode only when a template's context schema
+   * references this type, and it used to compare against a constant compiled
+   * into this bundle -- which shipped the consuming application's class name
+   * inside a published package, and tied that package to an installation
+   * having that exact class.
+   *
+   * !! Absent arrives as `''`, like the urls above. Treat empty as **filter
+   * mode unavailable**, never as a reason to fall back to a remembered
+   * value: the server is the thing that rejects every other type, so a guess
+   * here offers a mode the server will refuse.
+   */
+  readonly filterAudienceEntity?: string;
+}
+export interface DynamicEntityApiManifest {
+  readonly typesUrl: string;
+  readonly fieldDefinitionsUrl: string;
+  readonly fieldDefinitionUrl: string;
+  readonly fieldDefinitionsReorderUrl: string;
+  readonly toolbarNaviGraphUrl: string;
+  readonly constraintsUrl: string;
+  readonly recordsUrl: string;
+  readonly recordUrl: string;
+  readonly recordsByTypeUrl: string;
+  readonly typeUrl: string;
+  readonly typesCreateUrl: string;
+  readonly formTypesUrl?: string;
+  readonly typeByAliasUrl?: string;
+}
+export interface DomainExplorerApiManifest {
+  readonly entitiesUrl: string;
+  readonly entityUrl: string;
+  readonly toolbarNaviGraphUrl: string;
+  readonly domainExplorerToolbarUrl: string;
+  readonly entityFieldsDataGridUrl?: string;
+  readonly typeFieldsDataGridUrl?: string;
+}
+export interface IdentityApiManifest {
+  readonly usersUrl: string;
+  readonly userUrl: string;
+  readonly groupsUrl: string;
+  readonly groupUrl: string;
+  readonly meUrl: string;
+  readonly assignGroupsUrl: string;
+  readonly avatarUploadUrl: string;
+  readonly settingsUrl: string;
+  readonly settingsSectionsUrl: string;
+  readonly settingsSectionUrl: string;
+  readonly colorUrl: string;
+  readonly rolesUrl?: string;
+  readonly elevationUrl?: string;
+  readonly deletionsUrl?: string;
+  readonly footprintsUrl?: string;
+  readonly userDeletionUrl?: string;
+  readonly userLegalHoldsUrl?: string;
+  readonly holdsSettingsBlock?: string;
+  readonly legalHoldFormId?: string | null;
 }
 /**
  * Editor sub-manifest emitted by the backend's Editor module. The
@@ -172,27 +170,27 @@ interface IdentityApiManifest {
  * pre-resolved contributor list AND the storage allow-list a sanitizer
  * enforces on save.
  */
-interface EditorApiManifestEntry {
-    readonly id: string;
-    readonly group: string;
-    readonly priority: number;
-    readonly icon: string;
-    readonly label: string;
-    readonly actionType: string;
-    readonly actionParams: Readonly<Record<string, unknown>>;
-    readonly extensions: ReadonlyArray<string>;
-    readonly stateKeys: ReadonlyArray<string>;
-    readonly shortcut?: string | null;
-    readonly slashable?: boolean;
-    readonly keywords?: ReadonlyArray<string>;
-}
-interface EditorApiManifestProfile {
-    readonly contributors: ReadonlyArray<EditorApiManifestEntry>;
-    readonly allowedWidgets: ReadonlyArray<string>;
-}
-interface EditorApiManifest {
-    readonly schemaVersion: number;
-    readonly profiles: Readonly<Record<string, EditorApiManifestProfile>>;
+export interface EditorApiManifestEntry {
+  readonly id: string;
+  readonly group: string;
+  readonly priority: number;
+  readonly icon: string;
+  readonly label: string;
+  readonly actionType: string;
+  readonly actionParams: Readonly<Record<string, unknown>>;
+  readonly extensions: ReadonlyArray<string>;
+  readonly stateKeys: ReadonlyArray<string>;
+  readonly shortcut?: string | null;
+  readonly slashable?: boolean;
+  readonly keywords?: ReadonlyArray<string>;
+}
+export interface EditorApiManifestProfile {
+  readonly contributors: ReadonlyArray<EditorApiManifestEntry>;
+  readonly allowedWidgets: ReadonlyArray<string>;
+}
+export interface EditorApiManifest {
+  readonly schemaVersion: number;
+  readonly profiles: Readonly<Record<string, EditorApiManifestProfile>>;
 }
 /**
  * Viewer manifest emitted by the backend's Document module.
@@ -201,20 +199,20 @@ interface EditorApiManifest {
  * profile. Profile config is open-ended -- every viewer interprets the
  * keys it understands and ignores the rest.
  */
-interface ViewerProfileApiManifest {
-    readonly key: string;
-    readonly config: Readonly<Record<string, unknown>>;
+export interface ViewerProfileApiManifest {
+  readonly key: string;
+  readonly config: Readonly<Record<string, unknown>>;
 }
-interface ViewerDefinitionApiManifest {
-    readonly key: string;
-    readonly mimeTypes: ReadonlyArray<string>;
-    readonly extensions: ReadonlyArray<string>;
-    readonly component: string;
-    readonly profiles: Readonly<Record<string, ViewerProfileApiManifest>>;
+export interface ViewerDefinitionApiManifest {
+  readonly key: string;
+  readonly mimeTypes: ReadonlyArray<string>;
+  readonly extensions: ReadonlyArray<string>;
+  readonly component: string;
+  readonly profiles: Readonly<Record<string, ViewerProfileApiManifest>>;
 }
-interface ViewerApiManifest {
-    readonly schemaVersion: number;
-    readonly viewers: Readonly<Record<string, ViewerDefinitionApiManifest>>;
+export interface ViewerApiManifest {
+  readonly schemaVersion: number;
+  readonly viewers: Readonly<Record<string, ViewerDefinitionApiManifest>>;
 }
 /**
  * Platform-wide default user-facing settings. The
@@ -223,17 +221,17 @@ interface ViewerApiManifest {
  * config, not an FE-hardcoded Western default. `locale` is the default
  * locale, previously absent from the manifest.
  */
-interface PlatformDefaults {
-    readonly locale: string;
-    readonly timezone: string;
-    readonly dateFormat: string;
-    readonly timeFormat: '12h' | '24h';
-    readonly weekStart: 'monday' | 'sunday';
-    /**
-     * Deployment brand accent as `#rrggbb`, or null/absent to keep the
-     * stylesheet's own. Sits BELOW a user's personal accentColor.
-     */
-    readonly accentColor?: string | null;
+export interface PlatformDefaults {
+  readonly locale: string;
+  readonly timezone: string;
+  readonly dateFormat: string;
+  readonly timeFormat: '12h' | '24h';
+  readonly weekStart: 'monday' | 'sunday';
+  /**
+   * Deployment brand accent as `#rrggbb`, or null/absent to keep the
+   * stylesheet's own. Sits BELOW a user's personal accentColor.
+   */
+  readonly accentColor?: string | null;
 }
 /**
  * The host contracts in force here (the platform rule: hosts implement
@@ -242,42 +240,42 @@ interface PlatformDefaults {
  * entries the installer matched against it. A host mounts a module only when
  * it is listed.
  */
-interface UiApiManifest {
-    /** The contracts in force, name -> MAJOR.MINOR (`{ console: '1.0' }`): one installed theme implements each. */
-    readonly contracts: Readonly<Record<string, string>>;
-    /** Which installed theme implements each contract, name -> theme slug. */
-    readonly hosts?: Readonly<Record<string, string>>;
-    readonly modules: ReadonlyArray<UiModuleEntryManifest>;
-}
-interface UiModuleEntryManifest {
-    readonly module: string;
-    readonly contract: string;
-    readonly range: string;
-    readonly framework: string;
-}
-interface ApiManifest {
-    readonly apiBase: string;
-    readonly ui?: UiApiManifest;
-    readonly configBase?: string;
-    readonly auth?: AuthApiManifest;
-    readonly identity?: IdentityApiManifest;
-    readonly sections?: SectionApiManifest;
-    readonly navi?: NaviApiManifest;
-    readonly content?: ContentApiManifest;
-    readonly dataGrid?: DataGridApiManifest;
-    readonly terminal?: TerminalApiManifest;
-    readonly media?: MediaApiManifest;
-    readonly document?: DocumentApiManifest;
-    readonly vfs?: VfsApiManifest;
-    readonly dynamicEntity?: DynamicEntityApiManifest;
-    readonly domainExplorer?: DomainExplorerApiManifest;
-    readonly editor?: EditorApiManifest;
-    readonly viewers?: ViewerApiManifest;
-    readonly supportedLocales?: Array<{
-        code: string;
-        label: string;
-    }>;
-    readonly platformDefaults?: PlatformDefaults;
+export interface UiApiManifest {
+  /** The contracts in force, name -> MAJOR.MINOR (`{ console: '1.0' }`): one installed theme implements each. */
+  readonly contracts: Readonly<Record<string, string>>;
+  /** Which installed theme implements each contract, name -> theme slug. */
+  readonly hosts?: Readonly<Record<string, string>>;
+  readonly modules: ReadonlyArray<UiModuleEntryManifest>;
+}
+export interface UiModuleEntryManifest {
+  readonly module: string;
+  readonly contract: string;
+  readonly range: string;
+  readonly framework: string;
+}
+export interface ApiManifest {
+  readonly apiBase: string;
+  readonly ui?: UiApiManifest;
+  readonly configBase?: string;
+  readonly auth?: AuthApiManifest;
+  readonly identity?: IdentityApiManifest;
+  readonly sections?: SectionApiManifest;
+  readonly navi?: NaviApiManifest;
+  readonly content?: ContentApiManifest;
+  readonly dataGrid?: DataGridApiManifest;
+  readonly terminal?: TerminalApiManifest;
+  readonly media?: MediaApiManifest;
+  readonly document?: DocumentApiManifest;
+  readonly vfs?: VfsApiManifest;
+  readonly dynamicEntity?: DynamicEntityApiManifest;
+  readonly domainExplorer?: DomainExplorerApiManifest;
+  readonly editor?: EditorApiManifest;
+  readonly viewers?: ViewerApiManifest;
+  readonly supportedLocales?: Array<{
+    code: string;
+    label: string;
+  }>;
+  readonly platformDefaults?: PlatformDefaults;
 }
 /**
  * GET /api/v1/admin/manifest -- the admin's endpoint map, answered to every signed-in account
@@ -285,15 +283,15 @@ interface ApiManifest {
  * from before that answers at /api/v1/console/manifest, to the console group only. Read once
  * signed in.
  */
-interface ConsoleManifestResponse {
-    readonly manifest: ApiManifest;
+export interface ConsoleManifestResponse {
+  readonly manifest: ApiManifest;
 }
-interface ThemeConfigResponse {
-    readonly slug?: string | null;
-    readonly feStack?: string | null;
-    readonly spaFramework?: string | null;
-    readonly assetsUrl?: string | null;
-    readonly manifest: ApiManifest;
+export interface ThemeConfigResponse {
+  readonly slug?: string | null;
+  readonly feStack?: string | null;
+  readonly spaFramework?: string | null;
+  readonly assetsUrl?: string | null;
+  readonly manifest: ApiManifest;
 }
 /**
  * Replaces {param} tokens in a URL pattern with encoded values.
@@ -302,8 +300,7 @@ interface ThemeConfigResponse {
  *   resolvePattern(manifest.sections!.item, { id: '123' })
  *   // -> '/api/v1/sections/123'
  */
-declare function resolvePattern(pattern: string, params: Record<string, string>): string;
-
+export declare function resolvePattern(pattern: string, params: Record<string, string>): string;
 /**
  * Shapes the user-preference store persists.
  *
@@ -316,12 +313,11 @@ declare function resolvePattern(pattern: string, params: Record<string, string>)
  * keeps its own local path and nothing that reads a grid preference had to
  * change.
  */
-interface DataGridPreference {
-    columns?: string[];
-    columnWidths?: Record<string, number>;
+export interface DataGridPreference {
+  columns?: string[];
+  columnWidths?: Record<string, number>;
 }
-type DataGridPreferences = Record<string, DataGridPreference>;
-
+export type DataGridPreferences = Record<string, DataGridPreference>;
 /**
  * Session and current-user DTOs.
  *
@@ -333,123 +329,121 @@ type DataGridPreferences = Record<string, DataGridPreference>;
  * `ApiService` re-exports them from its own module, so the feature files that
  * import `UserDto` from there are untouched.
  */
-interface TokenResponse {
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: string;
-    user?: UserDto;
-}
-interface UserDto {
-    id: string;
-    email: string;
-    identifier?: string;
-    roles: string[];
-    uiPrefs?: DataGridPreferences;
-    avatarUrl?: string | null;
-    firstName?: string | null;
-    lastName?: string | null;
-    fullName?: string;
-}
-
-type FieldType = 'text' | 'email' | 'password' | 'number' | 'textarea' | 'select' | 'toggle' | 'date' | 'time' | 'hidden' | 'relation' | 'subform' | 'token-pattern' | 'richtext' | 'localizedText' | 'localizedTextarea' | 'optionsEditor' | 'intlPhone' | 'color';
-type DataSourceType = 'static' | 'enum' | 'api' | 'repo';
-type VisibilityOperator = 'eq' | 'ne' | 'in' | 'notIn' | 'empty' | 'notEmpty';
-interface VisibilityCondition {
-    readonly field: string;
-    readonly operator: VisibilityOperator;
-    readonly value?: unknown;
-}
-type DataSourceWidget = 'select' | 'select-search' | 'select-tree' | 'token-input' | 'media-picker';
-type DataSourceLoading = 'eager' | 'lazy';
-interface DataSourceOption {
-    readonly value: unknown;
-    readonly label: string;
-    readonly parentId?: string | null;
-}
-interface DataSourceDefinition {
-    readonly type: DataSourceType;
-    readonly bindValue: string;
-    readonly bindLabel: string;
-    readonly multiple: boolean;
-    readonly maxItems?: number;
-    readonly options?: ReadonlyArray<DataSourceOption>;
-    readonly url?: string;
-    readonly widget: DataSourceWidget;
-    readonly loading: DataSourceLoading;
-    /** Free-form widget-specific configuration block populated from YAML
-     *  `dataSource.widgetOptions`. Used by media-picker for bindTarget /
-     *  display / accept / recentlyUsed / hoverPreview, and reserved for
-     *  future custom widgets. Kept separate from `options` (which is the
-     *  static-option list) to avoid key collisions. */
-    readonly widgetOptions?: Readonly<Record<string, unknown>>;
-}
-interface ValidatorDefinition {
-    readonly type: string;
-    readonly value?: unknown;
-    readonly message?: string;
-}
-interface RelationDefinition {
-    readonly cardinality: 'one' | 'many';
-    readonly maxItems?: number;
-    readonly targetFormId?: string;
-    readonly dataSource?: DataSourceDefinition;
-}
-interface SubFormDefinition {
-    readonly formId: string;
-    readonly relation: 'one' | 'many';
-    readonly maxItems?: number;
-}
-interface FieldSecurityPolicy {
-    readonly read: ReadonlyArray<string>;
-    readonly write: ReadonlyArray<string>;
-}
-interface FieldItem {
-    readonly alias: string;
-    readonly type: FieldType;
-    readonly label: string;
-    readonly placeholder?: string;
-    readonly hint?: string;
-    readonly required: boolean;
-    readonly readonly: boolean;
-    readonly locked: boolean;
-    readonly private: boolean;
-    readonly validators: ReadonlyArray<ValidatorDefinition>;
-    readonly dataSource?: DataSourceDefinition;
-    readonly relation?: RelationDefinition;
-    readonly subForm?: SubFormDefinition;
-    readonly separators?: ReadonlyArray<string>;
-    readonly security?: FieldSecurityPolicy | null;
-    readonly autocomplete?: string;
-}
-interface LayoutNode {
-    readonly type: 'group' | 'grid' | 'column' | 'tabs' | 'tab' | (string & {});
-    readonly name?: string;
-    readonly description?: string;
-    readonly compact?: boolean;
-    readonly width?: number;
-    readonly children?: ReadonlyArray<LayoutNode>;
-    readonly showWhen?: VisibilityCondition;
-}
-type FormActionType = 'submit' | 'button' | 'reset';
-type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
+export interface TokenResponse {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: string;
+  user?: UserDto;
+}
+export interface UserDto {
+  id: string;
+  email: string;
+  identifier?: string;
+  roles: string[];
+  uiPrefs?: DataGridPreferences;
+  avatarUrl?: string | null;
+  firstName?: string | null;
+  lastName?: string | null;
+  fullName?: string;
+}
+export type FieldType = 'text' | 'email' | 'password' | 'number' | 'textarea' | 'select' | 'toggle' | 'date' | 'time' | 'hidden' | 'relation' | 'subform' | 'token-pattern' | 'richtext' | 'localizedText' | 'localizedTextarea' | 'optionsEditor' | 'intlPhone' | 'color';
+export type DataSourceType = 'static' | 'enum' | 'api' | 'repo';
+export type VisibilityOperator = 'eq' | 'ne' | 'in' | 'notIn' | 'empty' | 'notEmpty';
+export interface VisibilityCondition {
+  readonly field: string;
+  readonly operator: VisibilityOperator;
+  readonly value?: unknown;
+}
+export type DataSourceWidget = 'select' | 'select-search' | 'select-tree' | 'token-input' | 'media-picker';
+export type DataSourceLoading = 'eager' | 'lazy';
+export interface DataSourceOption {
+  readonly value: unknown;
+  readonly label: string;
+  readonly parentId?: string | null;
+}
+export interface DataSourceDefinition {
+  readonly type: DataSourceType;
+  readonly bindValue: string;
+  readonly bindLabel: string;
+  readonly multiple: boolean;
+  readonly maxItems?: number;
+  readonly options?: ReadonlyArray<DataSourceOption>;
+  readonly url?: string;
+  readonly widget: DataSourceWidget;
+  readonly loading: DataSourceLoading;
+  /** Free-form widget-specific configuration block populated from YAML
+   *  `dataSource.widgetOptions`. Used by media-picker for bindTarget /
+   *  display / accept / recentlyUsed / hoverPreview, and reserved for
+   *  future custom widgets. Kept separate from `options` (which is the
+   *  static-option list) to avoid key collisions. */
+  readonly widgetOptions?: Readonly<Record<string, unknown>>;
+}
+export interface ValidatorDefinition {
+  readonly type: string;
+  readonly value?: unknown;
+  readonly message?: string;
+}
+export interface RelationDefinition {
+  readonly cardinality: 'one' | 'many';
+  readonly maxItems?: number;
+  readonly targetFormId?: string;
+  readonly dataSource?: DataSourceDefinition;
+}
+export interface SubFormDefinition {
+  readonly formId: string;
+  readonly relation: 'one' | 'many';
+  readonly maxItems?: number;
+}
+export interface FieldSecurityPolicy {
+  readonly read: ReadonlyArray<string>;
+  readonly write: ReadonlyArray<string>;
+}
+export interface FieldItem {
+  readonly alias: string;
+  readonly type: FieldType;
+  readonly label: string;
+  readonly placeholder?: string;
+  readonly hint?: string;
+  readonly required: boolean;
+  readonly readonly: boolean;
+  readonly locked: boolean;
+  readonly private: boolean;
+  readonly validators: ReadonlyArray<ValidatorDefinition>;
+  readonly dataSource?: DataSourceDefinition;
+  readonly relation?: RelationDefinition;
+  readonly subForm?: SubFormDefinition;
+  readonly separators?: ReadonlyArray<string>;
+  readonly security?: FieldSecurityPolicy | null;
+  readonly autocomplete?: string;
+}
+export interface LayoutNode {
+  readonly type: 'group' | 'grid' | 'column' | 'tabs' | 'tab' | (string & {});
+  readonly name?: string;
+  readonly description?: string;
+  readonly compact?: boolean;
+  readonly width?: number;
+  readonly children?: ReadonlyArray<LayoutNode>;
+  readonly showWhen?: VisibilityCondition;
+}
+export type FormActionType = 'submit' | 'button' | 'reset';
+export type FormActionVariant = 'primary' | 'secondary' | 'danger' | 'link';
 /** Terminal form button (Submit / Cancel / ...) -- mirrors PHP FormAction.
  *  Resolved by the backend (declared `formOptions.actions`, else lifted from
  *  legacy submit fields, else a default Submit). `label` is already translated. */
-interface FormAction {
-    readonly type: FormActionType;
-    readonly label: string;
-    readonly name: string;
-    readonly variant: FormActionVariant;
-}
-interface FormRenderDefinition {
-    readonly id: string;
-    readonly context: 'create' | 'edit';
-    readonly layout: ReadonlyArray<LayoutNode>;
-    readonly items: ReadonlyArray<FieldItem>;
-    readonly actions: ReadonlyArray<FormAction>;
-    readonly action?: string;
-}
-
+export interface FormAction {
+  readonly type: FormActionType;
+  readonly label: string;
+  readonly name: string;
+  readonly variant: FormActionVariant;
+}
+export interface FormRenderDefinition {
+  readonly id: string;
+  readonly context: 'create' | 'edit';
+  readonly layout: ReadonlyArray<LayoutNode>;
+  readonly items: ReadonlyArray<FieldItem>;
+  readonly actions: ReadonlyArray<FormAction>;
+  readonly action?: string;
+}
 /**
  * The collection envelope API Platform wraps every list response in.
  *
@@ -470,18 +464,17 @@ interface FormRenderDefinition {
  * crashes if it does. Settle it by calling the endpoint, not by merging the
  * types.
  */
-interface HydraView {
-    '@id': string;
-    'next'?: string;
-    'previous'?: string;
-    'last'?: string;
-}
-interface HydraCollection<T> {
-    'member': T[];
-    'totalItems': number;
-    'view'?: HydraView;
-}
-
+export interface HydraView {
+  '@id': string;
+  'next'?: string;
+  'previous'?: string;
+  'last'?: string;
+}
+export interface HydraCollection<T> {
+  'member': T[];
+  'totalItems': number;
+  'view'?: HydraView;
+}
 /**
  * The identity endpoints core owns: the session lifecycle, plus the settings
  * read at boot.
@@ -498,47 +491,46 @@ interface HydraCollection<T> {
  * `ApiService` keeps its own identical signatures and delegates here, so none
  * of the 94 feature files calling it changed.
  */
-declare class IdentityApiClient {
-    private readonly http;
-    private readonly store;
-    /** URLs come from the boot manifest, which core already owns. */
-    private get manifest();
-    login(identifier: string, password: string): Observable<TokenResponse>;
-    refresh(refreshToken: string): Observable<TokenResponse>;
-    logout(): Observable<void>;
-    me(): Observable<UserDto>;
-    getSettings(): Observable<Record<string, Record<string, unknown>>>;
-    static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class IdentityApiClient {
+  private readonly http;
+  private readonly store;
+  /** URLs come from the boot manifest, which core already owns. */
+  private get manifest();
+  login(identifier: string, password: string): Observable<TokenResponse>;
+  refresh(refreshToken: string): Observable<TokenResponse>;
+  logout(): Observable<void>;
+  me(): Observable<UserDto>;
+  getSettings(): Observable<Record<string, Record<string, unknown>>>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<IdentityApiClient, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Response of `POST /centrifugo/connection-token`: the JWT the realtime SDK
  * opens its socket with, and what it needs to refresh before expiry.
  */
-interface CentrifugoConnectionTokenDto {
-    token: string;
-    expiresAt: number;
-    ttl: number;
-    wsUrl: string;
-    /**
-     * The code the server closes this connection with when the caller's session
-     * ended (a sign-out everywhere, a password change, a deactivation). On it the
-     * client signs out and ends its calls at once, without reconnecting or waiting
-     * for a 401 (2026-09-26). Absent from a server older than that.
-     */
-    sessionEndedCode?: number;
+export interface CentrifugoConnectionTokenDto {
+  token: string;
+  expiresAt: number;
+  ttl: number;
+  wsUrl: string;
+  /**
+   * The code the server closes this connection with when the caller's session
+   * ended (a sign-out everywhere, a password change, a deactivation). On it the
+   * client signs out and ends its calls at once, without reconnecting or waiting
+   * for a 401 (2026-09-26). Absent from a server older than that.
+   */
+  sessionEndedCode?: number;
 }
 /**
  * Response of `POST /centrifugo/subscription-token`: a per-channel JWT. The
  * SDK asks for one before subscribing to a private namespace, so this is
  * fetched per subscription rather than once per connection.
  */
-interface CentrifugoSubscriptionTokenDto {
-    channel: string;
-    token: string;
-    expiresAt: number;
-    ttl: number;
+export interface CentrifugoSubscriptionTokenDto {
+  channel: string;
+  token: string;
+  expiresAt: number;
+  ttl: number;
 }
 /**
  * The two realtime endpoints, carved out for the same reason the identity ones
@@ -569,73 +561,70 @@ interface CentrifugoSubscriptionTokenDto {
  * channel. The wait stays for a server from before that, where a refused sign-in still opens
  * no socket.
  */
-declare class RealtimeTokenClient {
-    /** The error a refused sign-in's connection-token request ends with. */
-    static readonly REFUSED = "no console access: no realtime connection";
-    private readonly http;
-    private readonly store;
-    private readonly injector;
-    private get manifest();
-    connectionToken(): Observable<CentrifugoConnectionTokenDto>;
-    subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
-    static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
-declare class Login {
-    identifier: string;
-    password: string;
-    static readonly type = "[Auth] Login";
-    constructor(identifier: string, password: string);
-}
-declare class Logout {
-    static readonly type = "[Auth] Logout";
-}
-declare class RestoreSession {
-    static readonly type = "[Auth] Restore Session";
-}
-declare class SetTokens {
-    readonly response: TokenResponse;
-    static readonly type = "[Auth] Set Tokens";
-    constructor(response: TokenResponse);
+export declare class RealtimeTokenClient {
+  /** The error a refused sign-in's connection-token request ends with. */
+  static readonly REFUSED = "no console access: no realtime connection";
+  private readonly http;
+  private readonly store;
+  private readonly injector;
+  private get manifest();
+  connectionToken(): Observable<CentrifugoConnectionTokenDto>;
+  subscriptionToken(channel: string): Observable<CentrifugoSubscriptionTokenDto>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<RealtimeTokenClient, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export declare class Login {
+  identifier: string;
+  password: string;
+  static readonly type = "[Auth] Login";
+  constructor(identifier: string, password: string);
+}
+export declare class Logout {
+  static readonly type = "[Auth] Logout";
+}
+export declare class RestoreSession {
+  static readonly type = "[Auth] Restore Session";
+}
+export declare class SetTokens {
+  readonly response: TokenResponse;
+  static readonly type = "[Auth] Set Tokens";
+  constructor(response: TokenResponse);
 }
 /** Merge a partial update into the currently-stored user (e.g. after avatar change). */
-declare class PatchCurrentUser {
-    readonly patch: Partial<UserDto>;
-    static readonly type = "[Auth] Patch Current User";
-    constructor(patch: Partial<UserDto>);
-}
-
-interface AuthStateModel {
-    accessToken: string | null;
-    refreshToken: string | null;
-    expiresAt: string | null;
-    user: UserDto | null;
-}
-declare class AuthState {
-    private readonly api;
-    private readonly prefs;
-    login(ctx: StateContext<AuthStateModel>, { identifier, password }: Login): rxjs.Observable<UserDto | null>;
-    logout(ctx: StateContext<AuthStateModel>): void;
-    restore(ctx: StateContext<AuthStateModel>): void;
-    setTokens(ctx: StateContext<AuthStateModel>, { response }: SetTokens): void;
-    patchCurrentUser(ctx: StateContext<AuthStateModel>, { patch }: PatchCurrentUser): void;
-    static isAuthenticated(state: AuthStateModel): boolean;
-    static accessToken(state: AuthStateModel): string | null;
-    static refreshToken(state: AuthStateModel): string | null;
-    /**
-     * Sub-phase Y -- expose the access-token expiry timestamp so
-     * preemptive-refresh callers (e.g., Centrifuge getToken
-     * callbacks) can decide whether to rotate before issuing the
-     * next protected request, instead of relying on the
-     * interceptor's reactive 401-retry path.
-     */
-    static expiresAt(state: AuthStateModel): string | null;
-    static currentUser(state: AuthStateModel): UserDto | null;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class PatchCurrentUser {
+  readonly patch: Partial<UserDto>;
+  static readonly type = "[Auth] Patch Current User";
+  constructor(patch: Partial<UserDto>);
+}
+export interface AuthStateModel {
+  accessToken: string | null;
+  refreshToken: string | null;
+  expiresAt: string | null;
+  user: UserDto | null;
+}
+export declare class AuthState {
+  private readonly api;
+  private readonly prefs;
+  login(ctx: StateContext<AuthStateModel>, { identifier, password }: Login): import("rxjs").Observable<UserDto | null>;
+  logout(ctx: StateContext<AuthStateModel>): void;
+  restore(ctx: StateContext<AuthStateModel>): void;
+  setTokens(ctx: StateContext<AuthStateModel>, { response }: SetTokens): void;
+  patchCurrentUser(ctx: StateContext<AuthStateModel>, { patch }: PatchCurrentUser): void;
+  static isAuthenticated(state: AuthStateModel): boolean;
+  static accessToken(state: AuthStateModel): string | null;
+  static refreshToken(state: AuthStateModel): string | null;
+  /**
+   * Sub-phase Y -- expose the access-token expiry timestamp so
+   * preemptive-refresh callers (e.g., Centrifuge getToken
+   * callbacks) can decide whether to rotate before issuing the
+   * next protected request, instead of relying on the
+   * interceptor's reactive 401-retry path.
+   */
+  static expiresAt(state: AuthStateModel): string | null;
+  static currentUser(state: AuthStateModel): UserDto | null;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AuthState, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Protects routes that require authentication.
  *
@@ -652,8 +641,7 @@ declare class AuthState {
  * sent to the login page, which says why. A failure to ask is not a refusal: the console opens, and every request it
  * makes is still decided by the server.
  */
-declare const authGuard: CanActivateFn;
-
+export declare const authGuard: CanActivateFn;
 /**
  * Guards the `/login` route -- redirects already-authenticated
  * callers to admin home so a stale tab parked on `/login` cannot
@@ -669,11 +657,9 @@ declare const authGuard: CanActivateFn;
  * as anonymous, allow `/login`, and only then have the token
  * populated.
  */
-declare const loginPageGuard: CanActivateFn;
-
-declare const BYPASS_AUTH: HttpContextToken<boolean>;
-declare const authInterceptor: HttpInterceptorFn;
-
+export declare const loginPageGuard: CanActivateFn;
+export declare const BYPASS_AUTH: HttpContextToken<boolean>;
+export declare const authInterceptor: HttpInterceptorFn;
 /**
  * Two-layer refresh coordinator: an intra-tab `shareReplay(1)`
  * mutex dedupes concurrent callers within one tab, and a
@@ -718,63 +704,62 @@ declare const authInterceptor: HttpInterceptorFn;
  *     made is never replayed with the token it consumed. A 401 there
  *     is the session's end: `Logout`.
  */
-declare class AuthRefreshCoordinator {
-    private readonly api;
-    private readonly store;
-    private readonly router;
-    private inFlight;
-    /**
-     * Return the in-flight refresh Observable, or spawn a new one
-     * with the supplied refresh-token value.
-     *
-     * `refusedAccessToken`: the access token the server just answered
-     * 401 to, when the caller is answering one. With it, the lock body
-     * refreshes unless the shared copy already holds another token;
-     * without it (a preemptive refresh), a fresh-looking cached token
-     * is handed back as before.
-     *
-     * Callers subscribe via `switchMap` / `firstValueFrom` to retry
-     * their original request with the resolved access token.
-     */
-    refresh(refreshToken: string, refusedAccessToken?: string | null): Observable<string>;
-    /**
-     * Run the refresh body inside `navigator.locks` when the API is
-     * available; degrade to direct invocation otherwise. The lock
-     * body checks for state already updated by a sibling tab before
-     * issuing its own HTTP call.
-     */
-    private refreshWithCrossTabLock;
-    /**
-     * Lock body. Re-reads the shared copy first (see the class note).
-     *
-     * Answering a refusal: a shared access token other than the refused
-     * one is a rotation already made -- taken, and mirrored into this
-     * tab's state if its `storage` event has not arrived yet. Otherwise,
-     * or for a preemptive caller whose cached token no longer looks
-     * fresh, the HTTP refresh, with the newest refresh token: shared,
-     * then state, then the caller's.
-     */
-    private executeRefresh;
-    /**
-     * The session as the tabs share it, or null when there is none to
-     * read: no storage, nothing stored (signed out), or a value that is
-     * not a complete token set.
-     */
-    private readShared;
-    /**
-     * For a preemptive caller only: return the current access token when
-     * its expiry is more than `FRESH_TOKEN_GRACE_MS` milliseconds away --
-     * signalling that some other tab refreshed for us. The shared copy
-     * first, which a sibling's rotation reaches before this tab's state
-     * does (mirrored here when it is newer); this tab's state when there
-     * is none. Null otherwise. Never asked for a token the server
-     * refused: a refused token's expiry looks just as fresh.
-     */
-    private tryConsumeFreshState;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class AuthRefreshCoordinator {
+  private readonly api;
+  private readonly store;
+  private readonly router;
+  private inFlight;
+  /**
+   * Return the in-flight refresh Observable, or spawn a new one
+   * with the supplied refresh-token value.
+   *
+   * `refusedAccessToken`: the access token the server just answered
+   * 401 to, when the caller is answering one. With it, the lock body
+   * refreshes unless the shared copy already holds another token;
+   * without it (a preemptive refresh), a fresh-looking cached token
+   * is handed back as before.
+   *
+   * Callers subscribe via `switchMap` / `firstValueFrom` to retry
+   * their original request with the resolved access token.
+   */
+  refresh(refreshToken: string, refusedAccessToken?: string | null): Observable<string>;
+  /**
+   * Run the refresh body inside `navigator.locks` when the API is
+   * available; degrade to direct invocation otherwise. The lock
+   * body checks for state already updated by a sibling tab before
+   * issuing its own HTTP call.
+   */
+  private refreshWithCrossTabLock;
+  /**
+   * Lock body. Re-reads the shared copy first (see the class note).
+   *
+   * Answering a refusal: a shared access token other than the refused
+   * one is a rotation already made -- taken, and mirrored into this
+   * tab's state if its `storage` event has not arrived yet. Otherwise,
+   * or for a preemptive caller whose cached token no longer looks
+   * fresh, the HTTP refresh, with the newest refresh token: shared,
+   * then state, then the caller's.
+   */
+  private executeRefresh;
+  /**
+   * The session as the tabs share it, or null when there is none to
+   * read: no storage, nothing stored (signed out), or a value that is
+   * not a complete token set.
+   */
+  private readShared;
+  /**
+   * For a preemptive caller only: return the current access token when
+   * its expiry is more than `FRESH_TOKEN_GRACE_MS` milliseconds away --
+   * signalling that some other tab refreshed for us. The shared copy
+   * first, which a sibling's rotation reaches before this tab's state
+   * does (mirrored here when it is newer); this tab's state when there
+   * is none. Null otherwise. Never asked for a token the server
+   * refused: a refused token's expiry looks just as fresh.
+   */
+  private tryConsumeFreshState;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AuthRefreshCoordinator, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Bridges shared `localStorage` mutations into the NGXS auth
  * state so a refresh executed in one tab silently propagates to
@@ -799,15 +784,14 @@ declare class AuthRefreshCoordinator {
  * Started from `AppInitService.load()` so the listener is in
  * place before any protected HTTP fires.
  */
-declare class CrossTabAuthSyncService {
-    private readonly store;
-    private listenerAttached;
-    start(): void;
-    private readonly handleStorageEvent;
-    static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class CrossTabAuthSyncService {
+  private readonly store;
+  private listenerAttached;
+  start(): void;
+  private readonly handleStorageEvent;
+  static ɵfac: i0.ɵɵFactoryDeclaration<CrossTabAuthSyncService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * The elevation state of the signed-in session: the wire shape of
  * `GET /auth/elevation`, returned again by `POST` on a grant.
@@ -818,36 +802,41 @@ declare class CrossTabAuthSyncService {
  * capability flags are the two readings of ONE server-side decision, and the
  * client keeps no third.
  */
-interface ElevationState {
-    /** Whether this session is elevated right now. */
-    elevated: boolean;
-    /** When the current elevation ends (ISO 8601); absent or null when not elevated. */
-    expiresAt?: string | null;
-    /** When the current elevation was granted (ISO 8601); absent or null when not elevated. */
-    grantedAt?: string | null;
-    /** How the LAST elevation of this session ended. Rendered by the prompt before it asks. */
-    ended: ElevationEnded;
-    /** The lifetime a grant made now would get, in seconds (the setting, clamped to the ceiling). */
-    lifetimeSeconds: number;
-    /** The most any elevation can last, fixed in code. */
-    lifetimeCeilingSeconds: number;
-    /** Whether the CURRENT elevation was confirmed by a second factor; absent or null when not elevated. */
-    factorConfirmed?: boolean | null;
-    /** Whether a grant made now must carry a code from the person's own authenticator. */
-    mfaRequired: boolean;
-    /** What the prompt shows before asking; two of the codes mean this account cannot elevate yet. */
-    warnings: ElevationWarning[];
+export interface ElevationState {
+  /** Whether this session is elevated right now. */
+  elevated: boolean;
+  /** When the current elevation ends (ISO 8601); absent or null when not elevated. */
+  expiresAt?: string | null;
+  /** When the current elevation was granted (ISO 8601); absent or null when not elevated. */
+  grantedAt?: string | null;
+  /** How the LAST elevation of this session ended. Rendered by the prompt before it asks. */
+  ended: ElevationEnded;
+  /** The lifetime a grant made now would get, in seconds (the setting, clamped to the ceiling). */
+  lifetimeSeconds: number;
+  /** The most any elevation can last, fixed in code. */
+  lifetimeCeilingSeconds: number;
+  /** Whether the CURRENT elevation was confirmed by a second factor; absent or null when not elevated. */
+  factorConfirmed?: boolean | null;
+  /** Whether a grant made now must carry a code from the person's own authenticator. */
+  mfaRequired: boolean;
+  /** What the prompt shows before asking; two of the codes mean this account cannot elevate yet. */
+  warnings: ElevationWarning[];
+  /**
+   * Whether this account may elevate at all -- a member of the admin group, elevated or not. The one source a
+   * client offers "Elevate session" from; absent (an older server) reads as false.
+   */
+  mayElevate?: boolean;
 }
 /**
  * `closed` is the beacon (the panel was closed or reloaded), `dropped_by_user`
  * the explicit drop, `refresh_from_other_pair` the server's refresh tripwire,
  * `never` a session that has not elevated yet.
  */
-type ElevationEndedReason = 'expired' | 'closed' | 'dropped_by_user' | 'refresh_from_other_pair' | 'never';
-interface ElevationEnded {
-    reason: ElevationEndedReason;
-    /** ISO 8601, null for `never`. */
-    at: string | null;
+export type ElevationEndedReason = 'expired' | 'closed' | 'dropped_by_user' | 'refresh_from_other_pair' | 'never';
+export interface ElevationEnded {
+  reason: ElevationEndedReason;
+  /** ISO 8601, null for `never`. */
+  at: string | null;
 }
 /**
  * `elevation.password_not_set` and `elevation.factor_missing` mean this
@@ -855,23 +844,22 @@ interface ElevationEnded {
  * own) and the message says which;
  * `elevation.mfa_off` is the recommendation carried while the switch is off.
  */
-interface ElevationWarning {
-    /** The three the server documents today; the client renders any it does not know as text. */
-    code: string;
-    message: string;
-}
-declare const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
-declare const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
-declare const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
+export interface ElevationWarning {
+  /** The three the server documents today; the client renders any it does not know as text. */
+  code: string;
+  message: string;
+}
+export declare const ELEVATION_WARNING_PASSWORD_NOT_SET = "elevation.password_not_set";
+export declare const ELEVATION_WARNING_FACTOR_MISSING = "elevation.factor_missing";
+export declare const ELEVATION_WARNING_MFA_OFF = "elevation.mfa_off";
 /** Why the elevation of a session changed, for whoever refetches on it. */
-type ElevationChangeKind = 'granted' | 'dropped' | 'expired' | 'observed';
-interface ElevationChange {
-    kind: ElevationChangeKind;
-    state: ElevationState;
+export type ElevationChangeKind = 'granted' | 'dropped' | 'expired' | 'observed';
+export interface ElevationChange {
+  kind: ElevationChangeKind;
+  state: ElevationState;
 }
 /** The two reasons the client sends when it drops an elevation itself. */
-type ElevationDropReason = 'dropped_by_user' | 'closed';
-
+export type ElevationDropReason = 'dropped_by_user' | 'closed';
 /**
  * What the elevation prompt is told when it opens.
  *
@@ -885,9 +873,11 @@ type ElevationDropReason = 'dropped_by_user' | 'closed';
  * ("Permission denied: cannot write '/docs/...'"), when a 403 opened the
  * prompt; absent when a disabled control offered elevation instead.
  */
-interface ElevationPromptRequest {
-    state: ElevationState;
-    refusal?: string;
+export interface ElevationPromptRequest {
+  state: ElevationState;
+  refusal?: string;
+  /** The refused action in words ("Saving navi nodes"), when a refused request opened the prompt. */
+  action?: string;
 }
 /**
  * The prompt itself is a dialog, and dialogs are the kit's -- a layer above
@@ -900,15 +890,15 @@ interface ElevationPromptRequest {
  * false when the person declined or could not. The port does not retry the
  * refused action; the interceptor does, on true.
  */
-interface ElevationPromptPort {
-    open(request: ElevationPromptRequest): Observable<boolean>;
+export interface ElevationPromptPort {
+  open(request: ElevationPromptRequest): Observable<boolean>;
 }
 /**
  * Optional by design: with nothing bound, a 403 stays a 403 and the state
  * service still answers -- an application without an admin panel has no
  * prompt to show and loses nothing.
  */
-declare const ELEVATION_PROMPT: InjectionToken<ElevationPromptPort>;
+export declare const ELEVATION_PROMPT: InjectionToken<ElevationPromptPort>;
 /**
  * Told when an action a person took was refused for want of elevation: a
  * write (not a read, not a background request) answered by a stamped 403.
@@ -922,18 +912,24 @@ declare const ELEVATION_PROMPT: InjectionToken<ElevationPromptPort>;
  * `refusal` is the server's sentence for the refused action, already made
  * readable by the error service.
  */
-interface ElevationNoticePort {
-    refused(refusal: string): void;
+export interface ElevationNoticePort {
+  /** `action` names what the person did ("Saving navi nodes"); absent from older callers. */
+  refused(refusal: string, action?: string): void;
 }
+/**
+ * What a write IS, in the person's words, for the elevation prompt and notice when the server refuses it -- set by a
+ * caller that knows better than the URL ("Saving the menu entry"). Without it the interceptor names the method's verb
+ * and the resource the URL names.
+ */
+export declare const ELEVATION_ACTION: HttpContextToken<string | null>;
 /** Optional, like {@link ELEVATION_PROMPT}: with nothing bound, a refusal is only a 403. */
-declare const ELEVATION_NOTICE: InjectionToken<ElevationNoticePort>;
-
+export declare const ELEVATION_NOTICE: InjectionToken<ElevationNoticePort>;
 /**
  * Set on a request that must never open the elevation prompt: the elevation
  * endpoint's own calls (a wrong password is a 403 and is not a refused action),
  * and any caller that would rather receive its 403 and decide for itself.
  */
-declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
+export declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
 /**
  * The elevation state of this session, read from ONE place: the server.
  *
@@ -969,247 +965,262 @@ declare const BYPASS_ELEVATION: HttpContextToken<boolean>;
  * whose refusal came from the VFS permission service under another module's
  * path (media, document and word templates, content distribution).
  */
-declare const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
+export declare const ELEVATION_REQUIRED_HEADER = "X-Elevation-Required";
 /**
  * Set on a request no person asked for: a realtime token, a preferences sync, a
  * poll. Its refusal is never announced -- not by a dialog and not by a notice --
  * because nobody is waiting on it and nobody can act on it. The caller still
  * receives the 403 and decides what its own state shows.
  */
-declare const BACKGROUND_REQUEST: HttpContextToken<boolean>;
+export declare const BACKGROUND_REQUEST: HttpContextToken<boolean>;
 /**
  * Whether a failed request was refused for want of elevation: a 403 carrying
  * the server's stamp. The one test every reader of a refusal uses -- the
  * interceptor, a page's inline state, the error text -- so they cannot disagree.
  */
-declare function isElevationRefusal(err: unknown): boolean;
-declare class ElevationService {
-    private readonly http;
-    private readonly store;
-    private readonly prompt;
-    private readonly destroyRef;
-    /** The last answer the server gave, exactly as it gave it. */
-    private readonly served;
-    /**
-     * The state as it stands NOW; null until the first read from the server.
-     *
-     * Deliberately NOT a `computed`. A cached derivation is only recomputed
-     * when one of its dependencies changes, and nothing changes when an
-     * elevation simply runs out -- so it would keep answering `elevated: true`
-     * past the moment the server itself named, for as long as the machine
-     * happened to be asleep.
-     *
-     * Reading past `expiresAt` also demotes the STORED answer. The value
-     * returned here is already correct without that write; the write is only
-     * how cached readers (a `computed`, an OnPush template) find out.
-     */
-    readonly state: () => ElevationState | null;
-    /** Convenience over `state`: false until the server has said otherwise. */
-    readonly elevated: () => boolean;
-    /** `expiresAt` as a Date, null when not elevated. */
-    readonly expiresAt: () => Date | null;
-    /**
-     * Every change of elevation state: a grant, a drop (by this person, by the
-     * beacon, by the tripwire), an expiry, or an observed change of a live
-     * grant's `expiresAt`. A refresh that reports the same state emits nothing,
-     * so subscribers that refetch a listing on it never refetch for no reason.
-     */
-    readonly changes$: Subject<ElevationChange>;
-    private expiryTimer;
-    private pendingPrompt;
-    private expiryAnnouncePending;
-    private lastReconcileAt;
-    constructor();
-    /** The manifest carries the URL; without it the service is inert, not broken. */
-    get available(): boolean;
-    private get url();
-    /**
-     * Whether a URL belongs to THIS API: a relative one under the manifest's
-     * `apiBase`, or an absolute one on this origin under it. The interceptor
-     * acts on a stamped refusal from here and from nowhere else -- a third
-     * party answering 403 with a header of the same name is not an invitation
-     * to elevate this session.
-     */
-    isThisApi(url: string): boolean;
-    /** Ask the server. Applies the answer and announces it when it differs. */
-    refresh(): Observable<ElevationState>;
-    /**
-     * Elevate with the person's own password and, when the switch is on, a
-     * code from their own authenticator. Errors are the dialog's to branch on:
-     * 403 not a member of the admin group, wrong password, or wrong / replayed
-     * code, 428 a code is required, 409 this account cannot elevate yet, 429
-     * throttled. They pass through
-     * untouched, and never open the prompt (BYPASS_ELEVATION).
-     */
-    elevate(password: string, code?: string): Observable<ElevationState>;
-    /** Drop the elevation now. Idempotent on the server: nothing live is still a 204. */
-    drop(reason?: ElevationDropReason): Observable<ElevationState>;
-    /**
-     * What a person's explicit request for elevation calls -- an Elevate button,
-     * or a control that already knows its action needs elevation: ask the
-     * server whether this session is elevated, and only when it is not, open
-     * the prompt. Nothing calls it on a response by itself (the interceptor
-     * only tells {@link ELEVATION_NOTICE}). Elevated already is false, no
-     * prompt: elevation would change nothing.
-     */
-    offerFor(refusal?: string): Observable<boolean>;
-    /**
-     * Open the prompt, or join the one already open. Resolves to whether the
-     * session is elevated once the dialog closes.
-     */
-    requestElevation(request: ElevationPromptRequest): Observable<boolean>;
-    private options;
-    private inert;
-    /**
-     * Store the answer, schedule the expiry read, announce a change.
-     *
-     * `explicit` names the change when the caller knows it (a grant). For a
-     * plain refresh the kind is derived from the two states: elevated -> not
-     * is `expired` when the server says so and `dropped` otherwise (the person,
-     * another tab, the beacon, the tripwire); not -> elevated is a grant seen
-     * from another tab; a live grant whose `expiresAt` moved is `observed`.
-     *
-     * `prev` is read RAW rather than through `state()`: the demotion is not
-     * wanted here (this answer supersedes the stored one either way), and a
-     * read that demoted would queue an expiry announcement the server's own
-     * answer is about to make.
-     */
-    private apply;
-    private kindOf;
-    /**
-     * Tell the listings that this session's elevation ran out, once, and NOT
-     * from inside the read that noticed: a subscriber refetches on this, and a
-     * refetch started in the middle of a change detection pass is a write
-     * during a read. The microtask runs at the end of the current task, before
-     * anything can paint.
-     *
-     * A server answer arriving first clears the flag, so the announcement is
-     * made by whichever of the two got there first, never by both. Other tabs
-     * are NOT told: each one reaches the same conclusion from the same
-     * `expiresAt` on its own read, so the storage write would only buy a
-     * thundering herd of GETs.
-     */
-    private announceExpiryLater;
-    /**
-     * Ask the server again at `expiresAt` -- an OPTIMISATION, not the
-     * mechanism. `state()` already reports an elapsed grant as expired without
-     * being told, so a timer that a sleeping machine swallows, or that a
-     * background tab throttles to once a minute, now costs freshness rather
-     * than correctness. What it buys is the listing refetch happening at the
-     * moment of expiry instead of at the next read.
-     *
-     * Do not flip a local flag here: the lifetime counts from the grant on the
-     * server's clock, and if the server still says elevated at that moment
-     * (skew), the honest thing is to ask again shortly.
-     */
-    private schedule;
-    /**
-     * One more attempt, then stop. Giving up is affordable now and was not
-     * before: the state a failed read leaves behind is still read through the
-     * arithmetic above, so an unreachable server cannot leave this tab
-     * believing it is elevated. What is lost is only news from elsewhere -- a
-     * grant or a drop in another session -- and that is what the tab picks up
-     * when it next comes into view.
-     */
-    private scheduleRetry;
-    private clearTimer;
-    private announceToOtherTabs;
-    private readonly onStorage;
-    private readonly onFocus;
-    private readonly onVisibilityChange;
-    /**
-     * The tab is back. Read first -- that alone ends an elevation that ran out
-     * while it was away, with no request and no network to depend on -- then
-     * ask the server for what the read cannot know: a grant or a drop made
-     * elsewhere, or a lifetime the server moved.
-     */
-    private reconcile;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ElevationService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare function isElevationRefusal(err: unknown): boolean;
+export declare class ElevationService {
+  private readonly http;
+  private readonly store;
+  private readonly prompt;
+  private readonly destroyRef;
+  /** The last answer the server gave, exactly as it gave it. */
+  private readonly served;
+  /**
+   * The state as it stands NOW; null until the first read from the server.
+   *
+   * Deliberately NOT a `computed`. A cached derivation is only recomputed
+   * when one of its dependencies changes, and nothing changes when an
+   * elevation simply runs out -- so it would keep answering `elevated: true`
+   * past the moment the server itself named, for as long as the machine
+   * happened to be asleep.
+   *
+   * Reading past `expiresAt` also demotes the STORED answer. The value
+   * returned here is already correct without that write; the write is only
+   * how cached readers (a `computed`, an OnPush template) find out.
+   */
+  readonly state: () => ElevationState | null;
+  /** Convenience over `state`: false until the server has said otherwise. */
+  readonly elevated: () => boolean;
+  /** Whether this account may elevate at all, as the server answered it: what "Elevate session" is offered from. */
+  readonly mayElevate: () => boolean;
+  /** `expiresAt` as a Date, null when not elevated. */
+  readonly expiresAt: () => Date | null;
+  /**
+   * Every change of elevation state: a grant, a drop (by this person, by the
+   * beacon, by the tripwire), an expiry, or an observed change of a live
+   * grant's `expiresAt`. A refresh that reports the same state emits nothing,
+   * so subscribers that refetch a listing on it never refetch for no reason.
+   */
+  readonly changes$: Subject<ElevationChange>;
+  private expiryTimer;
+  private pendingPrompt;
+  private expiryAnnouncePending;
+  private lastReconcileAt;
+  constructor();
+  /** Whether a prompt can be opened at all: this install offers elevation and a prompt is bound. */
+  get canPrompt(): boolean;
+  /** The manifest's API base, as {@link isThisApi} reads it. */
+  get apiBase(): string;
+  /** The manifest carries the URL; without it the service is inert, not broken. */
+  get available(): boolean;
+  private get url();
+  /**
+   * Whether a URL belongs to THIS API: a relative one under the manifest's
+   * `apiBase`, or an absolute one on this origin under it. The interceptor
+   * acts on a stamped refusal from here and from nowhere else -- a third
+   * party answering 403 with a header of the same name is not an invitation
+   * to elevate this session.
+   */
+  isThisApi(url: string): boolean;
+  /** Ask the server. Applies the answer and announces it when it differs. */
+  refresh(): Observable<ElevationState>;
+  /**
+   * Elevate with the person's own password and, when the switch is on, a
+   * code from their own authenticator. Errors are the dialog's to branch on:
+   * 403 not a member of the admin group, wrong password, or wrong / replayed
+   * code, 428 a code is required, 409 this account cannot elevate yet, 429
+   * throttled. They pass through
+   * untouched, and never open the prompt (BYPASS_ELEVATION).
+   */
+  elevate(password: string, code?: string): Observable<ElevationState>;
+  /** Drop the elevation now. Idempotent on the server: nothing live is still a 204. */
+  drop(reason?: ElevationDropReason): Observable<ElevationState>;
+  /**
+   * What a person's explicit request for elevation calls -- an Elevate button,
+   * or a control that already knows its action needs elevation: ask the
+   * server whether this session is elevated, and only when it is not, open
+   * the prompt. Nothing calls it on a response by itself (the interceptor
+   * only tells {@link ELEVATION_NOTICE}). Elevated already is false, no
+   * prompt: elevation would change nothing.
+   */
+  offerFor(refusal?: string): Observable<boolean>;
+  /**
+   * Open the prompt, or join the one already open. Resolves to whether the
+   * session is elevated once the dialog closes.
+   */
+  requestElevation(request: ElevationPromptRequest): Observable<boolean>;
+  private options;
+  private inert;
+  /**
+   * Store the answer, schedule the expiry read, announce a change.
+   *
+   * `explicit` names the change when the caller knows it (a grant). For a
+   * plain refresh the kind is derived from the two states: elevated -> not
+   * is `expired` when the server says so and `dropped` otherwise (the person,
+   * another tab, the beacon, the tripwire); not -> elevated is a grant seen
+   * from another tab; a live grant whose `expiresAt` moved is `observed`.
+   *
+   * `prev` is read RAW rather than through `state()`: the demotion is not
+   * wanted here (this answer supersedes the stored one either way), and a
+   * read that demoted would queue an expiry announcement the server's own
+   * answer is about to make.
+   */
+  private apply;
+  private kindOf;
+  /**
+   * Tell the listings that this session's elevation ran out, once, and NOT
+   * from inside the read that noticed: a subscriber refetches on this, and a
+   * refetch started in the middle of a change detection pass is a write
+   * during a read. The microtask runs at the end of the current task, before
+   * anything can paint.
+   *
+   * A server answer arriving first clears the flag, so the announcement is
+   * made by whichever of the two got there first, never by both. Other tabs
+   * are NOT told: each one reaches the same conclusion from the same
+   * `expiresAt` on its own read, so the storage write would only buy a
+   * thundering herd of GETs.
+   */
+  private announceExpiryLater;
+  /**
+   * Ask the server again at `expiresAt` -- an OPTIMISATION, not the
+   * mechanism. `state()` already reports an elapsed grant as expired without
+   * being told, so a timer that a sleeping machine swallows, or that a
+   * background tab throttles to once a minute, now costs freshness rather
+   * than correctness. What it buys is the listing refetch happening at the
+   * moment of expiry instead of at the next read.
+   *
+   * Do not flip a local flag here: the lifetime counts from the grant on the
+   * server's clock, and if the server still says elevated at that moment
+   * (skew), the honest thing is to ask again shortly.
+   */
+  private schedule;
+  /**
+   * One more attempt, then stop. Giving up is affordable now and was not
+   * before: the state a failed read leaves behind is still read through the
+   * arithmetic above, so an unreachable server cannot leave this tab
+   * believing it is elevated. What is lost is only news from elsewhere -- a
+   * grant or a drop in another session -- and that is what the tab picks up
+   * when it next comes into view.
+   */
+  private scheduleRetry;
+  private clearTimer;
+  private announceToOtherTabs;
+  private readonly onStorage;
+  private readonly onFocus;
+  private readonly onVisibilityChange;
+  /**
+   * The tab is back. Read first -- that alone ends an elevation that ran out
+   * while it was away, with no request and no network to depend on -- then
+   * ask the server for what the read cannot know: a grant or a drop made
+   * elsewhere, or a lifetime the server moved.
+   */
+  private reconcile;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ElevationService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * A refusal for want of elevation is a 403 the server stamps `X-Elevation-Required`
  * where its gate refused a member who has not elevated ({@link isElevationRefusal}).
- * This interceptor never opens the elevation prompt. The prompt opens only when a
- * person asks for it: an Elevate button, or an action whose control already knows it
- * needs elevation and offers it ({@link ElevationService.offerFor}).
- *
- * What it does with a stamped 403:
- * - On a write a person made (POST, PUT, PATCH, DELETE without
- *   {@link BACKGROUND_REQUEST}): tells {@link ELEVATION_NOTICE}, which shows the
- *   refusal with an Elevate button. The request is not held and not repeated; the
- *   caller receives the 403 at once, and after elevating the person repeats the action.
+ *
+ * What it does with a stamped 403 (decided 2026-10-20 for a person's write):
+ * - On a write a person made (POST, PUT, PATCH, DELETE without {@link BACKGROUND_REQUEST}):
+ *   the prompt opens THERE, above whatever the person is in -- an edit dialog stays open
+ *   beneath it with its input -- and the request is HELD. If the person elevates, it is
+ *   sent once more and the caller receives that answer, as if the first had been accepted;
+ *   if the session turns out to be elevated already (another tab), it is sent once more
+ *   without asking. If the person declines, {@link ELEVATION_NOTICE} is told -- "Elevation
+ *   required", naming the action, with an Elevate button -- and the caller receives the 403.
+ *   The repeat is sent past this interceptor, so a second refusal is a 403, never a second
+ *   prompt.
  * - On a read: nothing. Reads are what a page makes as it loads and what polls make in
  *   the background, and the page shows its own state for a refused one -- an inline
  *   "needs an elevated session" with an Elevate button, or the feature hidden.
  * - On a background request: nothing. Nobody is waiting on it.
  *
- * Until 2026-10-08 any stamped 403 opened the prompt, so the setup reads of almost every
- * console page, and a realtime token at every load, opened it for an administrator who
- * had not elevated: 13 of 15 pages on a menu click, 15 of 15 on a reload (measured).
+ * !! Why reads and background requests still open nothing. Until 2026-10-08 any stamped 403
+ * opened the prompt, so the setup reads of almost every console page, and a realtime token at
+ * every load, opened it for an administrator who had not elevated: 13 of 15 pages on a menu
+ * click, 15 of 15 on a reload (measured). From then until 2026-10-20 a person's write opened
+ * nothing either, only a toast -- which, with a dialog open, rendered under it, so the edit had
+ * to be thrown away to elevate (measured on the served admin, Edit Node). A person's write is
+ * the one refusal somebody is waiting on, which is why it is the one that asks.
  *
  * The elevation endpoint's own calls carry {@link BYPASS_ELEVATION}: a wrong password is a
  * 403 and is not a refused action. A stamped 403 from anywhere but this API is ignored:
  * the header is the server's word, and only this server's counts.
  */
-declare const elevationInterceptor: HttpInterceptorFn;
-
-declare class LoginComponent {
-    identifier: string;
-    password: string;
-    readonly loading: i0.WritableSignal<boolean>;
-    readonly error: i0.WritableSignal<string | null>;
-    private readonly store;
-    private readonly router;
-    /** Shown when the guard signed an account out because the console is not granted to it. */
-    static readonly NO_CONSOLE_ACCESS = "This account has no access to the console.";
-    constructor();
-    submit(): void;
-    static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
-}
-
-declare class AppInitService {
-    private readonly http;
-    private readonly store;
-    private readonly router;
-    private readonly location;
-    private readonly prefs;
-    private readonly crossTabSync;
-    private readonly refreshCoordinator;
-    /** The only hardcoded URL -- everything else comes from the manifest. */
-    private readonly configUrl;
-    /**
-     * Emits (once) when load() has fully completed -- tokens settled, manifest
-     * set (or swallowed on error).  authGuard subscribes to this so it never
-     * evaluates isAuthenticated against a partially-restored stale token.
-     */
-    private readonly initComplete;
-    readonly ready$: rxjs.Observable<void>;
-    load(): Promise<void>;
-    /**
-     * Confirm the restored session is still alive, settling AuthState before the
-     * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
-     * interceptor queues behind ready$, which has not fired yet at this point.
-     *
-     *   - access token accepted  -> done, session alive;
-     *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
-     *                              so an expired one with a valid refresh token must
-     *                              stay logged in). The coordinator dispatches Logout
-     *                              on a refresh 401 and SetTokens on success; a
-     *                              transient failure (5xx/network) is swallowed so a
-     *                              momentary blip never kills a valid session.
-     */
-    private validateSession;
-    /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
-    private probe;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare const elevationInterceptor: HttpInterceptorFn;
+/**
+ * The action a refused write was, in words for the person: what its caller said it is
+ * ({@link ELEVATION_ACTION}), or else the method's verb and the resource the URL names --
+ * "Saving navi nodes" for `PATCH /api/v1/navi/nodes/{id}`. Identifiers and the API base
+ * are left out; they say nothing to the person who pressed the button.
+ */
+export declare function actionOf(req: HttpRequest<unknown>, apiBase?: string): string;
+export declare class LoginComponent {
+  identifier: string;
+  password: string;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly error: import("@angular/core").WritableSignal<string | null>;
+  private readonly store;
+  private readonly router;
+  /** Shown when the guard signed an account out because the console is not granted to it. */
+  static readonly NO_CONSOLE_ACCESS = "This account has no access to the console.";
+  constructor();
+  submit(): void;
+  static ɵfac: i0.ɵɵFactoryDeclaration<LoginComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<LoginComponent, "coolms-admin-login", never, {}, {}, never, never, true, never>;
+}
+export declare class AppInitService {
+  private readonly http;
+  private readonly store;
+  private readonly router;
+  private readonly location;
+  private readonly prefs;
+  private readonly crossTabSync;
+  private readonly refreshCoordinator;
+  /** The only hardcoded URL -- everything else comes from the manifest. */
+  private readonly configUrl;
+  /**
+   * Emits (once) when load() has fully completed -- tokens settled, manifest
+   * set (or swallowed on error).  authGuard subscribes to this so it never
+   * evaluates isAuthenticated against a partially-restored stale token.
+   */
+  private readonly initComplete;
+  readonly ready$: import("rxjs").Observable<void>;
+  load(): Promise<void>;
+  /**
+   * Confirm the restored session is still alive, settling AuthState before the
+   * app unblocks. Runs OUTSIDE the auth interceptor (BYPASS_AUTH) because the
+   * interceptor queues behind ready$, which has not fired yet at this point.
+   *
+   *   - access token accepted  -> done, session alive;
+   *   - access token rejected  -> attempt ONE refresh (access tokens are short-lived,
+   *                              so an expired one with a valid refresh token must
+   *                              stay logged in). The coordinator dispatches Logout
+   *                              on a refresh 401 and SetTokens on success; a
+   *                              transient failure (5xx/network) is swallowed so a
+   *                              momentary blip never kills a valid session.
+   */
+  private validateSession;
+  /** GET an authed endpoint with an explicit Bearer header, bypassing the interceptor. */
+  private probe;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AppInitService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /** What the server said about this sign-in and the console. */
-type ConsoleAccess = 'granted' | 'refused' | 'unknown';
+export type ConsoleAccess = 'granted' | 'refused' | 'unknown';
 /**
  * Whether the signed-in account may use the console, and the console's endpoint
  * map when it may.
@@ -1239,32 +1250,31 @@ type ConsoleAccess = 'granted' | 'refused' | 'unknown';
  * interceptor dispatch Logout, which started another generation, which re-asked:
  * a loop for as long as the tab lived (found in review).
  */
-declare class ConsoleAccessService {
-    /** The admin manifest's URL: fixed, like the theme config's, because nothing is known before it. */
-    static readonly URL = "/api/v1/admin/manifest";
-    /** The address before 2026-10-06, asked only when a server older than that answers 404 at {@link URL}. */
-    static readonly LEGACY_URL = "/api/v1/console/manifest";
-    /** The login page's query parameter value for "signed out: no console access". */
-    static readonly REFUSED_REASON = "no-console-access";
-    private readonly http;
-    private readonly store;
-    private answer;
-    private pending;
-    private generation;
-    constructor();
-    /** Ask once per sign-in; the manifest is merged into the app config when granted. */
-    ensure(): Promise<ConsoleAccess>;
-    /**
-     * Sign a refused account out: this sign-in ends on the server (its refresh token
-     * with it), as the account menu's sign-out does, and then in this browser --
-     * whatever the server answered, so a refused request cannot leave it signed in.
-     */
-    signOut(): Observable<void>;
-    private merge;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleAccessService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class ConsoleAccessService {
+  /** The admin manifest's URL: fixed, like the theme config's, because nothing is known before it. */
+  static readonly URL = "/api/v1/admin/manifest";
+  /** The address before 2026-10-06, asked only when a server older than that answers 404 at {@link URL}. */
+  static readonly LEGACY_URL = "/api/v1/console/manifest";
+  /** The login page's query parameter value for "signed out: no console access". */
+  static readonly REFUSED_REASON = "no-console-access";
+  private readonly http;
+  private readonly store;
+  private answer;
+  private pending;
+  private generation;
+  constructor();
+  /** Ask once per sign-in; the manifest is merged into the app config when granted. */
+  ensure(): Promise<ConsoleAccess>;
+  /**
+   * Sign a refused account out: this sign-in ends on the server (its refresh token
+   * with it), as the account menu's sign-out does, and then in this browser --
+   * whatever the server answered, so a refused request cannot leave it signed in.
+   */
+  signOut(): Observable<void>;
+  private merge;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleAccessService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Layout config DTO -- the shape served from
  * `GET /api/v1/config/layout/{id}`. Mirrors the YAML at
@@ -1290,93 +1300,93 @@ declare class ConsoleAccessService {
  * keys (e.g. `media:library`'s `naviGraph:` slot shorthand) keep working
  * without further interface changes.
  */
-interface LayoutHeaderAction {
-    id: string;
-    label?: string;
-    icon?: string;
-    title?: string;
-    primary?: boolean;
-    danger?: boolean;
-    disabled?: boolean;
-    /**
-     * Optional capability gate evaluated FE-side against runtime state
-     * (e.g. `administer` / `delete`) -- the config declares WHICH actions
-     * exist + their gate; the FE decides if THIS user/row qualifies. Absent
-     * = always shown. Used by detail pages whose actions are config-driven
-     * (see `web:section-detail`).
-     *
-     * For a gate that depends on the RECORD rather than the user, prefer
-     * `showWhen` below: `requires` needs a page to interpret the token, so
-     * every new value costs a branch in TypeScript.
-     */
-    requires?: string;
-    /**
-     * Conditions on the page's published context, same grammar and same
-     * evaluator as a NaviGraph toolbar node, applied
-     * by {@link LayoutActionsService}:
-     *
-     *   showWhen     -- the action does not APPLY, so it is absent.
-     *   disabledWhen -- temporarily UNAVAILABLE: stays put and greys out.
-     *   busyWhen     -- the action is RUNNING: greys out too, and may relabel.
-     *   busyLabel    -- label shown while `busyWhen` holds ("Saving...").
-     *   activeWhen   -- pressed/active styling.
-     *
-     * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
-     * a page that moves between them should not have to relearn how to say
-     * "not now".
-     */
-    showWhen?: Record<string, unknown>;
-    disabledWhen?: Record<string, unknown>;
-    busyWhen?: Record<string, unknown>;
-    busyLabel?: string;
-    activeWhen?: Record<string, unknown>;
-}
-interface LayoutSection {
-    title?: string;
-    /**
-     * When true, the layout shell pins the section to the top of the
-     * scroll container (CSS `position: sticky`). Used by inspector /
-     * filter pages where an input form should stay visible while the
-     * operator scrolls through results below. Currently honoured by
-     * cms-inspector-layout; cms-detail-layout will follow when it
-     * lands. Default false.
-     */
-    sticky?: boolean;
-    slots?: Record<string, {
-        component?: string;
-        [key: string]: unknown;
-    }>;
-    [key: string]: unknown;
-}
-interface LayoutConfig {
-    id?: string;
-    template?: string;
-    title?: string;
-    subtitle?: string;
-    icon?: string;
-    slots?: Record<string, unknown>;
-    sections?: Record<string, LayoutSection>;
-    headerActions?: LayoutHeaderAction[];
-    /**
-     * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
-     * -- primary / destructive actions kept out of the cramped header.
-     * Same shape as `headerActions`; gated per-item via `requires`.
-     */
-    footerActions?: LayoutHeaderAction[];
-    permissions?: string[];
-    [key: string]: unknown;
-}
-interface DialogConfig {
-    [key: string]: unknown;
-}
-interface NavigraphConfig {
-    [key: string]: unknown;
-}
-interface FormConfig {
-    [key: string]: unknown;
-}
-interface DatagridConfig {
+export interface LayoutHeaderAction {
+  id: string;
+  label?: string;
+  icon?: string;
+  title?: string;
+  primary?: boolean;
+  danger?: boolean;
+  disabled?: boolean;
+  /**
+   * Optional capability gate evaluated FE-side against runtime state
+   * (e.g. `administer` / `delete`) -- the config declares WHICH actions
+   * exist + their gate; the FE decides if THIS user/row qualifies. Absent
+   * = always shown. Used by detail pages whose actions are config-driven
+   * (see `web:section-detail`).
+   *
+   * For a gate that depends on the RECORD rather than the user, prefer
+   * `showWhen` below: `requires` needs a page to interpret the token, so
+   * every new value costs a branch in TypeScript.
+   */
+  requires?: string;
+  /**
+   * Conditions on the page's published context, same grammar and same
+   * evaluator as a NaviGraph toolbar node, applied
+   * by {@link LayoutActionsService}:
+   *
+   *   showWhen     -- the action does not APPLY, so it is absent.
+   *   disabledWhen -- temporarily UNAVAILABLE: stays put and greys out.
+   *   busyWhen     -- the action is RUNNING: greys out too, and may relabel.
+   *   busyLabel    -- label shown while `busyWhen` holds ("Saving...").
+   *   activeWhen   -- pressed/active styling.
+   *
+   * Two carriers (a layout config and a NaviGraph tree) but ONE vocabulary:
+   * a page that moves between them should not have to relearn how to say
+   * "not now".
+   */
+  showWhen?: Record<string, unknown>;
+  disabledWhen?: Record<string, unknown>;
+  busyWhen?: Record<string, unknown>;
+  busyLabel?: string;
+  activeWhen?: Record<string, unknown>;
+}
+export interface LayoutSection {
+  title?: string;
+  /**
+   * When true, the layout shell pins the section to the top of the
+   * scroll container (CSS `position: sticky`). Used by inspector /
+   * filter pages where an input form should stay visible while the
+   * operator scrolls through results below. Currently honoured by
+   * cms-inspector-layout; cms-detail-layout will follow when it
+   * lands. Default false.
+   */
+  sticky?: boolean;
+  slots?: Record<string, {
+    component?: string;
     [key: string]: unknown;
+  }>;
+  [key: string]: unknown;
+}
+export interface LayoutConfig {
+  id?: string;
+  template?: string;
+  title?: string;
+  subtitle?: string;
+  icon?: string;
+  slots?: Record<string, unknown>;
+  sections?: Record<string, LayoutSection>;
+  headerActions?: LayoutHeaderAction[];
+  /**
+   * Actions rendered in the page's fixed bottom bar (`<cms-detail-footer>`)
+   * -- primary / destructive actions kept out of the cramped header.
+   * Same shape as `headerActions`; gated per-item via `requires`.
+   */
+  footerActions?: LayoutHeaderAction[];
+  permissions?: string[];
+  [key: string]: unknown;
+}
+export interface DialogConfig {
+  [key: string]: unknown;
+}
+export interface NavigraphConfig {
+  [key: string]: unknown;
+}
+export interface FormConfig {
+  [key: string]: unknown;
+}
+export interface DatagridConfig {
+  [key: string]: unknown;
 }
 /**
  * Fetches config YAMLs (served as JSON) from GET /api/v1/config/{type}/{id}.
@@ -1388,45 +1398,43 @@ interface DatagridConfig {
  * configBase is read from the API manifest (manifest.configBase) and falls
  * back to '/api/v1/config' when the manifest is not yet loaded.
  */
-declare class ConfigService {
-    private readonly http;
-    private readonly store;
-    private readonly cache;
-    layout(id: string): Observable<LayoutConfig>;
-    dialog(id: string): Observable<DialogConfig>;
-    navigraph(slug: string): Observable<NavigraphConfig>;
-    form(id: string): Observable<FormConfig>;
-    datagrid(id: string): Observable<DatagridConfig>;
-    private fetch;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
-declare class SetAppConfig {
-    readonly config: ThemeConfigResponse;
-    static readonly type = "[AppConfig] Set";
-    constructor(config: ThemeConfigResponse);
-}
-interface AppConfigStateModel {
-    config: ThemeConfigResponse | null;
-    loaded: boolean;
-}
-declare class AppConfigState {
-    set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
-    /** The whole config as last set: the public theme config, with the console's manifest once granted. */
-    static config(state: AppConfigStateModel): ThemeConfigResponse | null;
-    static manifest(state: AppConfigStateModel): ApiManifest | null;
-    /**
-     * The viewer manifest. Null when the backend didn't ship a viewers
-     * section (no tagged providers); consumers should fall back to a
-     * "no preview" surface.
-     */
-    static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
-    static loaded(state: AppConfigStateModel): boolean;
-    static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class ConfigService {
+  private readonly http;
+  private readonly store;
+  private readonly cache;
+  layout(id: string): Observable<LayoutConfig>;
+  dialog(id: string): Observable<DialogConfig>;
+  navigraph(slug: string): Observable<NavigraphConfig>;
+  form(id: string): Observable<FormConfig>;
+  datagrid(id: string): Observable<DatagridConfig>;
+  private fetch;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ConfigService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export declare class SetAppConfig {
+  readonly config: ThemeConfigResponse;
+  static readonly type = "[AppConfig] Set";
+  constructor(config: ThemeConfigResponse);
+}
+export interface AppConfigStateModel {
+  config: ThemeConfigResponse | null;
+  loaded: boolean;
+}
+export declare class AppConfigState {
+  set(ctx: StateContext<AppConfigStateModel>, { config }: SetAppConfig): void;
+  /** The whole config as last set: the public theme config, with the console's manifest once granted. */
+  static config(state: AppConfigStateModel): ThemeConfigResponse | null;
+  static manifest(state: AppConfigStateModel): ApiManifest | null;
+  /**
+   * The viewer manifest. Null when the backend didn't ship a viewers
+   * section (no tagged providers); consumers should fall back to a
+   * "no preview" surface.
+   */
+  static viewers(state: AppConfigStateModel): ViewerApiManifest | null;
+  static loaded(state: AppConfigStateModel): boolean;
+  static ɵfac: i0.ɵɵFactoryDeclaration<AppConfigState, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Converts any caught error into a human-readable message.
  *
@@ -1437,17 +1445,16 @@ declare class AppConfigState {
  *   4. error.violations[]        (constraint violations)
  *   5. Status-based fallback
  */
-declare class ErrorHandlerService {
-    humanize(err: unknown): string;
-    private statusMessage;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+export declare class ErrorHandlerService {
+  humanize(err: unknown): string;
+  private statusMessage;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ErrorHandlerService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
-
 /** What the user PICKED. `system` defers to the OS. */
-type ThemeChoice = 'light' | 'dark' | 'system';
+export type ThemeChoice = 'light' | 'dark' | 'system';
 /** What that resolves to right now -- the only two the stylesheet knows. */
-type ResolvedTheme = 'light' | 'dark';
+export type ResolvedTheme = 'light' | 'dark';
 /**
  * Applies the user's theme by setting `data-theme` on the document element.
  *
@@ -1461,78 +1468,77 @@ type ResolvedTheme = 'light' | 'dark';
  * cached for the SPA lifetime, with `update()` called by the Profile page after
  * a save so the change lands without a refetch.
  */
-declare class ThemeService {
-    private readonly api;
-    private readonly store;
-    private readonly _choice;
-    private readonly _systemDark;
-    private readonly _userAccent;
-    private readonly _platformAccent;
-    private loadOnce$?;
-    /** The user's stored choice, including `system`. */
-    readonly choice: i0.Signal<ThemeChoice>;
-    /** This user's personal override, independent of the deployment's. */
-    readonly userAccent: i0.Signal<string | null>;
-    /** The deployment's brand accent from the API manifest, if it set one. */
-    readonly platformAccent: i0.Signal<string | null>;
-    /**
-     * The colour actually painted: personal override, else the deployment's,
-     * else null -- which leaves the stylesheet's own accent in place.
-     *
-     * Three rungs and each is a real state. A user who has chosen nothing is
-     * NOT the same as one who chose the deployment's colour: clear the
-     * deployment's brand and the first user follows it, the second does not.
-     */
-    readonly accent: i0.Signal<string | null>;
-    /** The choice with `system` resolved against the OS setting. */
-    readonly resolved: i0.Signal<ResolvedTheme>;
-    constructor();
-    /**
-     * One-shot load of the stored preference. Safe to call more than once and
-     * safe for anonymous users -- a failure leaves the cached/system value in
-     * place rather than forcing light, so the login screen still matches the OS.
-     */
-    ensureLoaded(): Observable<ThemeChoice>;
-    /**
-     * Called by the Profile page after the Preferences tab saves, so the admin
-     * re-themes on the spot. Ignores anything that is not a known choice --
-     * the section PATCH returns the whole merged bag, not just this field.
-     */
-    update(value: unknown): void;
-    /**
-     * Companion to {@link update} for the accent field of the same save.
-     * An explicit null clears the override; anything malformed is ignored
-     * rather than applied, so a bad value can never blank the admin's accent.
-     */
-    updateAccent(value: unknown): void;
-    private set;
-    /**
-     * The manifest is loaded at bootstrap, well before the authenticated shell
-     * calls this, so a snapshot read is enough and no subscription is needed.
-     * A malformed value is ignored rather than applied -- the container refuses
-     * to build with one, but the manifest crosses the network all the same.
-     */
-    private readPlatformAccent;
-    private setAccent;
-    /**
-     * Writes the override onto the document element, where an inline style
-     * outranks every stylesheet rule -- including the dark block -- so one
-     * declaration re-points the accent in both themes.
-     *
-     * Only --cms-accent is set, not the -hover/-light/-text members of the
-     * family. Deriving those from an arbitrary user colour needs a colour model
-     * the palette does not have yet, and guessing them would produce hover
-     * states that clash with the very colour the user chose. Until then the
-     * override moves the brand fill and leaves its supporting tones alone.
-     */
-    private applyAccent;
-    private applyToDocument;
-    private static readCache;
-    private static readAccentCache;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class ThemeService {
+  private readonly api;
+  private readonly store;
+  private readonly _choice;
+  private readonly _systemDark;
+  private readonly _userAccent;
+  private readonly _platformAccent;
+  private loadOnce$?;
+  /** The user's stored choice, including `system`. */
+  readonly choice: import("@angular/core").Signal<ThemeChoice>;
+  /** This user's personal override, independent of the deployment's. */
+  readonly userAccent: import("@angular/core").Signal<string | null>;
+  /** The deployment's brand accent from the API manifest, if it set one. */
+  readonly platformAccent: import("@angular/core").Signal<string | null>;
+  /**
+   * The colour actually painted: personal override, else the deployment's,
+   * else null -- which leaves the stylesheet's own accent in place.
+   *
+   * Three rungs and each is a real state. A user who has chosen nothing is
+   * NOT the same as one who chose the deployment's colour: clear the
+   * deployment's brand and the first user follows it, the second does not.
+   */
+  readonly accent: import("@angular/core").Signal<string | null>;
+  /** The choice with `system` resolved against the OS setting. */
+  readonly resolved: import("@angular/core").Signal<ResolvedTheme>;
+  constructor();
+  /**
+   * One-shot load of the stored preference. Safe to call more than once and
+   * safe for anonymous users -- a failure leaves the cached/system value in
+   * place rather than forcing light, so the login screen still matches the OS.
+   */
+  ensureLoaded(): Observable<ThemeChoice>;
+  /**
+   * Called by the Profile page after the Preferences tab saves, so the admin
+   * re-themes on the spot. Ignores anything that is not a known choice --
+   * the section PATCH returns the whole merged bag, not just this field.
+   */
+  update(value: unknown): void;
+  /**
+   * Companion to {@link update} for the accent field of the same save.
+   * An explicit null clears the override; anything malformed is ignored
+   * rather than applied, so a bad value can never blank the admin's accent.
+   */
+  updateAccent(value: unknown): void;
+  private set;
+  /**
+   * The manifest is loaded at bootstrap, well before the authenticated shell
+   * calls this, so a snapshot read is enough and no subscription is needed.
+   * A malformed value is ignored rather than applied -- the container refuses
+   * to build with one, but the manifest crosses the network all the same.
+   */
+  private readPlatformAccent;
+  private setAccent;
+  /**
+   * Writes the override onto the document element, where an inline style
+   * outranks every stylesheet rule -- including the dark block -- so one
+   * declaration re-points the accent in both themes.
+   *
+   * Only --cms-accent is set, not the -hover/-light/-text members of the
+   * family. Deriving those from an arbitrary user colour needs a colour model
+   * the palette does not have yet, and guessing them would produce hover
+   * states that clash with the very colour the user chose. Until then the
+   * override moves the brand fill and leaves its supporting tones alone.
+   */
+  private applyAccent;
+  private applyToDocument;
+  private static readCache;
+  private static readAccentCache;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * The platform's loading indicator: the exclamation mark from Cool!MS,
  * drawing itself.
@@ -1559,26 +1565,41 @@ declare class ThemeService {
  * Under `prefers-reduced-motion` it holds still and only breathes, because
  * motion sickness is not a stylistic preference.
  */
-declare class CmsLoaderComponent {
-    /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
-    readonly label: i0.InputSignal<string>;
-    /** Cover the positioned ancestor rather than sitting in the flow. */
-    readonly overlay: i0.InputSignal<boolean>;
-    /**
-     * Row layout at text scale, for a wait inside a row, a status bar or a
-     * button. Override `--cms-loader-size` to tune the mark.
-     */
-    readonly inline: i0.InputSignal<boolean>;
-    /**
-     * A clip-path needs a document-unique id, and this component is used more
-     * than once per page -- two loaders sharing an id makes the second one clip
-     * against the first one's rectangle and stop animating.
-     */
-    protected readonly clipId: string;
-    static ɵfac: i0.ɵɵFactoryDeclaration<CmsLoaderComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<CmsLoaderComponent, "cms-loader", never, { "label": { "alias": "label"; "required": false; "isSignal": true; }; "overlay": { "alias": "overlay"; "required": false; "isSignal": true; }; "inline": { "alias": "inline"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
-}
-
+export declare class CmsLoaderComponent {
+  /** Optional caption. Absent renders the mark alone, which suits a small inline wait. */
+  readonly label: import("@angular/core").InputSignal<string>;
+  /** Cover the positioned ancestor rather than sitting in the flow. */
+  readonly overlay: import("@angular/core").InputSignal<boolean>;
+  /**
+   * Row layout at text scale, for a wait inside a row, a status bar or a
+   * button. Override `--cms-loader-size` to tune the mark.
+   */
+  readonly inline: import("@angular/core").InputSignal<boolean>;
+  /**
+   * A clip-path needs a document-unique id, and this component is used more
+   * than once per page -- two loaders sharing an id makes the second one clip
+   * against the first one's rectangle and stop animating.
+   */
+  protected readonly clipId: string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<CmsLoaderComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<CmsLoaderComponent, "cms-loader", never, {
+    "label": {
+      "alias": "label";
+      "required": false;
+      "isSignal": true;
+    };
+    "overlay": {
+      "alias": "overlay";
+      "required": false;
+      "isSignal": true;
+    };
+    "inline": {
+      "alias": "inline";
+      "required": false;
+      "isSignal": true;
+    };
+  }, {}, never, never, true, never>;
+}
 /**
  * Unified user preferences service -- all preference types share one
  * localStorage key (`coolms_ui_prefs`) and one debounced server-sync pipeline.
@@ -1604,106 +1625,105 @@ declare class CmsLoaderComponent {
  *   terminal.height
  *   terminal.open
  */
-declare class UserPreferencesService {
-    private readonly http;
-    private readonly store;
-    private readonly destroyRef;
-    private readonly STORAGE_KEY;
-    private readonly SYNC_DELAY;
-    private syncSubject;
-    constructor();
-    /**
-     * Write all prefs to localStorage and schedule a debounced server sync.
-     */
-    private save;
-    /**
-     * Read the entire prefs object from localStorage, applying legacy key
-     * migration on the first read after an upgrade.
-     */
-    private load;
-    /**
-     * One-time migration of legacy flat keys to the new nested naming convention.
-     * Mutates `all` in place and re-persists only when something changed.
-     */
-    private migrate;
-    /**
-     * Seed localStorage from server preferences.
-     * Called after login and on every session restore (page reload).
-     *
-     * Strategy:
-     *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
-     *  - Local prefs already exist -> merge with local taking priority at each
-     *    top-level namespace.  This ensures that locally-persisted state
-     *    (panel widths, last path, etc.) is never overwritten by the stale copy
-     *    that was saved in the auth token at login time.
-     */
-    loadFromServer(uiPrefs: Record<string, unknown>): void;
-    private syncToServer;
-    /**
-     * Get stored preferences for a specific grid.
-     */
-    getGridPref(gridId: string): DataGridPreference | null;
-    /**
-     * Set visible column order for a grid.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setColumns(gridId: string, columns: string[]): void;
-    /**
-     * Record a column width for a grid column.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setColumnWidth(gridId: string, field: string, width: number): void;
-    /**
-     * Remove all preferences for a specific grid and immediately sync to server.
-     */
-    resetGrid(gridId: string): void;
-    private updateGrid;
-    /**
-     * Get persisted terminal panel height.
-     */
-    getTerminalHeight(): number | null;
-    /**
-     * Persist terminal panel height.
-     */
-    setTerminalHeight(height: number): void;
-    /**
-     * Get persisted state for a resizable panel identified by key.
-     * Used by ExplorerLayoutComponent to persist panel widths across sessions.
-     */
-    getPanelState(key: string): {
-        width: number;
-        collapsed: boolean;
-    } | null;
-    /**
-     * Persist generic panel state by key.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setPanelState(key: string, width: number, collapsed: boolean): void;
-    /**
-     * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
-     */
-    getPageState<T>(pageKey: string): T | null;
-    /**
-     * Merge partial state into a page namespace.
-     * Existing keys in the namespace are preserved; only provided keys are updated.
-     * Applies to localStorage instantly; server sync is debounced.
-     */
-    setPageState(pageKey: string, state: Record<string, unknown>): void;
-    /** @deprecated Use getPageState('media') instead */
-    getMediaViewMode(): string | null;
-    /** @deprecated Use setPageState('media', ...) instead */
-    setMediaViewMode(mode: string): void;
-    /** @deprecated Use getPanelState('media_panel_left') instead */
-    getMediaCollectionsPanel(): {
-        width: number;
-        collapsed: boolean;
-    } | null;
-    /** @deprecated Use setPanelState('media_panel_left', ...) instead */
-    setMediaCollectionsPanel(width: number, collapsed: boolean): void;
-    static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class UserPreferencesService {
+  private readonly http;
+  private readonly store;
+  private readonly destroyRef;
+  private readonly STORAGE_KEY;
+  private readonly SYNC_DELAY;
+  private syncSubject;
+  constructor();
+  /**
+   * Write all prefs to localStorage and schedule a debounced server sync.
+   */
+  private save;
+  /**
+   * Read the entire prefs object from localStorage, applying legacy key
+   * migration on the first read after an upgrade.
+   */
+  private load;
+  /**
+   * One-time migration of legacy flat keys to the new nested naming convention.
+   * Mutates `all` in place and re-persists only when something changed.
+   */
+  private migrate;
+  /**
+   * Seed localStorage from server preferences.
+   * Called after login and on every session restore (page reload).
+   *
+   * Strategy:
+   *  - No local prefs yet (new device / clean install) -> use server prefs as-is.
+   *  - Local prefs already exist -> merge with local taking priority at each
+   *    top-level namespace.  This ensures that locally-persisted state
+   *    (panel widths, last path, etc.) is never overwritten by the stale copy
+   *    that was saved in the auth token at login time.
+   */
+  loadFromServer(uiPrefs: Record<string, unknown>): void;
+  private syncToServer;
+  /**
+   * Get stored preferences for a specific grid.
+   */
+  getGridPref(gridId: string): DataGridPreference | null;
+  /**
+   * Set visible column order for a grid.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setColumns(gridId: string, columns: string[]): void;
+  /**
+   * Record a column width for a grid column.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setColumnWidth(gridId: string, field: string, width: number): void;
+  /**
+   * Remove all preferences for a specific grid and immediately sync to server.
+   */
+  resetGrid(gridId: string): void;
+  private updateGrid;
+  /**
+   * Get persisted terminal panel height.
+   */
+  getTerminalHeight(): number | null;
+  /**
+   * Persist terminal panel height.
+   */
+  setTerminalHeight(height: number): void;
+  /**
+   * Get persisted state for a resizable panel identified by key.
+   * Used by ExplorerLayoutComponent to persist panel widths across sessions.
+   */
+  getPanelState(key: string): {
+    width: number;
+    collapsed: boolean;
+  } | null;
+  /**
+   * Persist generic panel state by key.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setPanelState(key: string, width: number, collapsed: boolean): void;
+  /**
+   * Get all persisted state for a page namespace (e.g. 'vfs', 'media', 'nav').
+   */
+  getPageState<T>(pageKey: string): T | null;
+  /**
+   * Merge partial state into a page namespace.
+   * Existing keys in the namespace are preserved; only provided keys are updated.
+   * Applies to localStorage instantly; server sync is debounced.
+   */
+  setPageState(pageKey: string, state: Record<string, unknown>): void;
+  /** @deprecated Use getPageState('media') instead */
+  getMediaViewMode(): string | null;
+  /** @deprecated Use setPageState('media', ...) instead */
+  setMediaViewMode(mode: string): void;
+  /** @deprecated Use getPanelState('media_panel_left') instead */
+  getMediaCollectionsPanel(): {
+    width: number;
+    collapsed: boolean;
+  } | null;
+  /** @deprecated Use setPanelState('media_panel_left', ...) instead */
+  setMediaCollectionsPanel(width: number, collapsed: boolean): void;
+  static ɵfac: i0.ɵɵFactoryDeclaration<UserPreferencesService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Sidebar collapse state -- two independent dimensions:
  *
@@ -1723,35 +1743,34 @@ declare class UserPreferencesService {
  * to defaulting un-collapsed -- the toggles still work for the session,
  * just don't persist.
  */
-declare class SidebarStateService {
-    private static readonly STORAGE_KEY;
-    private static readonly STORAGE_KEY_SECTIONS;
-    private static readonly STORAGE_KEY_ITEMS;
-    readonly collapsed: i0.WritableSignal<boolean>;
-    readonly collapsedSections: i0.WritableSignal<Set<string>>;
-    readonly collapsedItems: i0.WritableSignal<Set<string>>;
-    toggle(): void;
-    isSectionCollapsed(id: string): boolean;
-    toggleSection(id: string): void;
-    /**
-     * Force a section to be expanded. Used when navigation lands on
-     * a route inside a manually-collapsed section -- it would be
-     * confusing to leave the active item hidden. The user can
-     * collapse the section again afterwards.
-     */
-    ensureExpanded(id: string): void;
-    isItemCollapsed(id: string): boolean;
-    toggleItem(id: string): void;
-    private readPersisted;
-    private persist;
-    private readSectionsPersisted;
-    private persistSections;
-    private readItemsPersisted;
-    private persistItems;
-    static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class SidebarStateService {
+  private static readonly STORAGE_KEY;
+  private static readonly STORAGE_KEY_SECTIONS;
+  private static readonly STORAGE_KEY_ITEMS;
+  readonly collapsed: import("@angular/core").WritableSignal<boolean>;
+  readonly collapsedSections: import("@angular/core").WritableSignal<Set<string>>;
+  readonly collapsedItems: import("@angular/core").WritableSignal<Set<string>>;
+  toggle(): void;
+  isSectionCollapsed(id: string): boolean;
+  toggleSection(id: string): void;
+  /**
+   * Force a section to be expanded. Used when navigation lands on
+   * a route inside a manually-collapsed section -- it would be
+   * confusing to leave the active item hidden. The user can
+   * collapse the section again afterwards.
+   */
+  ensureExpanded(id: string): void;
+  isItemCollapsed(id: string): boolean;
+  toggleItem(id: string): void;
+  private readPersisted;
+  private persist;
+  private readSectionsPersisted;
+  private persistSections;
+  private readItemsPersisted;
+  private persistItems;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SidebarStateService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * One row returned by the `/api/entity-search` endpoint. `id` is
  * what the picker emits via its `valueChange` output (and what the
@@ -1761,10 +1780,10 @@ declare class SidebarStateService {
  * when there is nothing to show; receiving `null` from a custom
  * resolver is normalized to `undefined` here.
  */
-interface EntitySearchResult {
-    readonly id: string | number;
-    readonly label: string;
-    readonly secondary?: string;
+export interface EntitySearchResult {
+  readonly id: string | number;
+  readonly label: string;
+  readonly secondary?: string;
 }
 /**
  * HTTP client for the Phase 2a `/api/entity-search` endpoint.
@@ -1772,55 +1791,64 @@ interface EntitySearchResult {
  * Permission filtering happens at the backend resolver layer --
  * this service is a thin RPC.
  */
-declare class EntitySearchService {
-    private readonly http;
-    /**
-     * @param entityType  Fully-qualified PHP class name of the entity
-     *                    being searched (e.g. the backend's User entity).
-     * @param query       Free-text search input. Empty string is
-     *                    valid -- the backend returns the default
-     *                    listing for that entity type.
-     * @param limit       Max rows to return; clamped server-side to
-     *                    [1, 100].
-     */
-    search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
-    static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class EntitySearchService {
+  private readonly http;
+  /**
+   * @param entityType  Fully-qualified PHP class name of the entity
+   *                    being searched (e.g. the backend's User entity).
+   * @param query       Free-text search input. Empty string is
+   *                    valid -- the backend returns the default
+   *                    listing for that entity type.
+   * @param limit       Max rows to return; clamped server-side to
+   *                    [1, 100].
+   */
+  search(entityType: string, query: string, limit?: number): Observable<EntitySearchResult[]>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<EntitySearchService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Well-known click target values embedded in meta.target.
  *   'action.logout' -- dispatch Logout action
  *   'route'         -- navigate via routerLink (default when target absent)
  *   '_blank'        -- open in a new tab (hrefOverride must be set)
  */
-type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
-interface NaviGraphMeta {
-    readonly component?: string;
-    readonly icon?: string;
-    readonly routerLink?: string;
-    readonly target?: NaviGraphTarget;
-    readonly requiredRole?: string;
-    readonly voterAttribute?: string;
-    readonly contributor?: string;
-    readonly [key: string]: unknown;
+export type NaviGraphTarget = 'action.logout' | 'route' | '_blank' | (string & {});
+export interface NaviGraphMeta {
+  readonly component?: string;
+  readonly icon?: string;
+  readonly routerLink?: string;
+  readonly target?: NaviGraphTarget;
+  readonly requiredRole?: string;
+  readonly voterAttribute?: string;
+  readonly contributor?: string;
+  readonly [key: string]: unknown;
 }
+/**
+ * What the server says this account may do with a node, as it answered the graph:
+ *   'allowed' -- its own rights open it; shown as usual;
+ *   'elevate' -- a member of admin, not elevated, whose own rights refuse it and whom elevation would let in;
+ *                shown with a lock, and opening it asks for elevation first.
+ * A node anyone else may not open is not in the answer at all. Absent (an older server) reads as 'allowed'.
+ */
+export type NaviAccess = 'allowed' | 'elevate';
 /** Flat node as returned from GET /navi/trees/{slug}/graph */
-interface NaviGraphNodeFlat {
-    readonly id: string;
-    readonly path: string;
-    readonly title: string;
-    readonly parentId: string | null;
-    readonly sortOrder: number;
-    readonly isActive: boolean;
-    readonly isVisible: boolean;
-    readonly meta: NaviGraphMeta;
-}
+export interface NaviGraphNodeFlat {
+  readonly id: string;
+  readonly path: string;
+  readonly title: string;
+  readonly parentId: string | null;
+  readonly sortOrder: number;
+  readonly isActive: boolean;
+  readonly isVisible: boolean;
+  readonly meta: NaviGraphMeta;
+  readonly access?: NaviAccess;
+}
+/** The node's access as the server answered it; 'allowed' when the server said nothing (an older server). */
+export declare function naviAccessOf(node: Pick<NaviGraphNodeFlat, 'access'>): NaviAccess;
 /** Same node enriched with resolved children after client-side tree build */
-interface NaviGraphNode extends NaviGraphNodeFlat {
-    readonly children: NaviGraphNode[];
+export interface NaviGraphNode extends NaviGraphNodeFlat {
+  readonly children: NaviGraphNode[];
 }
-
 /**
  * Loads, caches, and drives admin NaviGraph trees.
  *
@@ -1829,59 +1857,65 @@ interface NaviGraphNode extends NaviGraphNodeFlat {
  *   const items = naviGraphService.adminNav();         // signal<NaviGraphNode[]>
  *   naviGraphService.handleClick(node);
  */
-declare class NaviGraphService {
-    private readonly http;
-    private readonly router;
-    private readonly store;
-    private readonly errors;
-    /** Resolved root nodes for navi.admin (sidebar). */
-    readonly adminNav: i0.WritableSignal<NaviGraphNode[]>;
-    /** Resolved root nodes for navi.admin.topbar. */
-    readonly topbarNav: i0.WritableSignal<NaviGraphNode[]>;
-    private readonly cache;
-    loadAdminNav(url: string): Observable<NaviGraphNode[]>;
-    loadTopbarNav(url: string): Observable<NaviGraphNode[]>;
-    /**
-     * Handle a nav-node click.
-     *
-     * Routing logic based on meta.target:
-     *   'action.logout'  -- dispatch Logout
-     *   '_blank'         -- window.open (uses node.path as href)
-     *   default          -- router.navigate with meta.routerLink or node.path
-     */
-    handleClick(node: NaviGraphNode): void;
-    /**
-     * Evaluate `showWhen` meta condition against a record.
-     * Nodes with no `showWhen` are always visible.
-     * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
-     */
-    isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
-    /**
-     * Standalone `showWhen` evaluator for callers that don't have a
-     * full `NaviGraphNode` (e.g. a grid's row context menu -- a
-     * `rowAction.showWhen` predicate is evaluated against the row's
-     * own projection). `null`/`undefined` predicates default to
-     * visible, mirroring `isVisible`'s "no rule = always shown"
-     * semantics.
-     */
-    matchesShowWhen(showWhen: Record<string, unknown> | undefined | null, record: Record<string, unknown>): boolean;
-    private evalCondition;
-    /**
-     * Fetch a graph endpoint and return a nested tree.
-     * Handles both compact JSON-LD IRIs (`member`) and
-     * the legacy Hydra key (`hydra:member`).
-     * Results are cached by URL for the lifetime of the service instance.
-     */
-    loadTree(url: string): Observable<NaviGraphNode[]>;
-    /**
-     * Build a nested tree from a flat array of nodes.
-     * Nodes are sorted by sortOrder at each level.
-     */
-    private buildTree;
-    static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class NaviGraphService {
+  private readonly http;
+  private readonly router;
+  private readonly store;
+  private readonly errors;
+  /** Resolved root nodes for navi.admin (sidebar). */
+  readonly adminNav: import("@angular/core").WritableSignal<NaviGraphNode[]>;
+  /** Resolved root nodes for navi.admin.topbar. */
+  readonly topbarNav: import("@angular/core").WritableSignal<NaviGraphNode[]>;
+  private readonly cache;
+  /**
+   * `fresh` asks the server again instead of answering from this service's cache: the answer is per account AND
+   * per elevation state (a node is 'elevate' before a grant and 'allowed' after it), so a change of elevation must
+   * re-ask, or a lock would outlive the grant -- or come back only after a reload.
+   */
+  loadAdminNav(url: string, options?: {
+    fresh?: boolean;
+  }): Observable<NaviGraphNode[]>;
+  loadTopbarNav(url: string): Observable<NaviGraphNode[]>;
+  /**
+   * Handle a nav-node click.
+   *
+   * Routing logic based on meta.target:
+   *   'action.logout'  -- dispatch Logout
+   *   '_blank'         -- window.open (uses node.path as href)
+   *   default          -- router.navigate with meta.routerLink or node.path
+   */
+  handleClick(node: NaviGraphNode): void;
+  /**
+   * Evaluate `showWhen` meta condition against a record.
+   * Nodes with no `showWhen` are always visible.
+   * Supports nested AND/OR logic: { and: [...] } / { or: [...] }
+   */
+  isVisible(node: NaviGraphNode, record: Record<string, unknown>): boolean;
+  /**
+   * Standalone `showWhen` evaluator for callers that don't have a
+   * full `NaviGraphNode` (e.g. a grid's row context menu -- a
+   * `rowAction.showWhen` predicate is evaluated against the row's
+   * own projection). `null`/`undefined` predicates default to
+   * visible, mirroring `isVisible`'s "no rule = always shown"
+   * semantics.
+   */
+  matchesShowWhen(showWhen: Record<string, unknown> | undefined | null, record: Record<string, unknown>): boolean;
+  private evalCondition;
+  /**
+   * Fetch a graph endpoint and return a nested tree.
+   * Handles both compact JSON-LD IRIs (`member`) and
+   * the legacy Hydra key (`hydra:member`).
+   * Results are cached by URL for the lifetime of the service instance.
+   */
+  loadTree(url: string, fresh?: boolean): Observable<NaviGraphNode[]>;
+  /**
+   * Build a nested tree from a flat array of nodes.
+   * Nodes are sorted by sortOrder at each level.
+   */
+  private buildTree;
+  static ɵfac: i0.ɵɵFactoryDeclaration<NaviGraphService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * Registry mapping string keys to Angular component classes.
  *
@@ -1895,20 +1929,19 @@ declare class NaviGraphService {
  *   private readonly registry = inject(ComponentRegistry);
  *   const cls = this.registry.get('MediaLibraryPage');
  */
-declare class ComponentRegistry {
-    private static readonly map;
-    static register(key: string, component: Type<unknown>): void;
-    static get(key: string): Type<unknown> | undefined;
-    static has(key: string): boolean;
-    static keys(): string[];
-    register(key: string, component: Type<unknown>): void;
-    get(key: string): Type<unknown> | null;
-    has(key: string): boolean;
-    keys(): string[];
-    static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
-}
-
+export declare class ComponentRegistry {
+  private static readonly map;
+  static register(key: string, component: Type<unknown>): void;
+  static get(key: string): Type<unknown> | undefined;
+  static has(key: string): boolean;
+  static keys(): string[];
+  register(key: string, component: Type<unknown>): void;
+  get(key: string): Type<unknown> | null;
+  has(key: string): boolean;
+  keys(): string[];
+  static ɵfac: i0.ɵɵFactoryDeclaration<ComponentRegistry, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
 /**
  * `console` -- the administration host contract (the platform rule: hosts implement contracts, modules offer entries).
  *
@@ -1924,35 +1957,35 @@ declare class ComponentRegistry {
  * (`^1.2` -- major 1, minor at least 2), checked at build against this
  * constant and at install against the theme's declaration.
  */
-declare const CONSOLE_CONTRACT: {
-    readonly name: "console";
-    readonly version: "1.0";
+export declare const CONSOLE_CONTRACT: {
+  readonly name: "console";
+  readonly version: "1.0";
 };
-interface ConsoleEntry {
-    /** The backend module id, as `config/modules/<id>`. Activation is by this id. */
-    readonly module: string;
-    readonly contract: 'console';
-    /** The console versions this entry was written for: a caret range over MAJOR.MINOR, e.g. '^1.0'. */
-    readonly range: string;
-    readonly routes?: readonly ConsoleRouteMount[];
-    readonly bindings?: readonly ConsoleBinding[];
-    readonly topbar?: readonly ConsoleTopbarItem[];
-    readonly overlays?: readonly ConsoleOverlay[];
-    readonly panels?: readonly ConsolePanel[];
-    readonly states?: readonly Type<unknown>[];
-    readonly providers?: readonly ConsoleProvision[];
+export interface ConsoleEntry {
+  /** The backend module id, as `config/modules/<id>`. Activation is by this id. */
+  readonly module: string;
+  readonly contract: 'console';
+  /** The console versions this entry was written for: a caret range over MAJOR.MINOR, e.g. '^1.0'. */
+  readonly range: string;
+  readonly routes?: readonly ConsoleRouteMount[];
+  readonly bindings?: readonly ConsoleBinding[];
+  readonly topbar?: readonly ConsoleTopbarItem[];
+  readonly overlays?: readonly ConsoleOverlay[];
+  readonly panels?: readonly ConsolePanel[];
+  readonly states?: readonly Type<unknown>[];
+  readonly providers?: readonly ConsoleProvision[];
 }
 /** What a route's `data` carries for the shell: the sidebar item to light, and whether the page owns its height. */
-interface ConsoleNavHint {
-    readonly activeNav?: string;
-    readonly fullHeight?: boolean;
-    /** An intermediate crumb the top bar renders between Home and the page. */
-    readonly breadcrumb?: {
-        readonly label: string;
-        readonly routerLink: string;
-    };
-    /** Which server layout the page renders, for the generic layout pages. */
-    readonly layoutId?: string;
+export interface ConsoleNavHint {
+  readonly activeNav?: string;
+  readonly fullHeight?: boolean;
+  /** An intermediate crumb the top bar renders between Home and the page. */
+  readonly breadcrumb?: {
+    readonly label: string;
+    readonly routerLink: string;
+  };
+  /** Which server layout the page renders, for the generic layout pages. */
+  readonly layoutId?: string;
 }
 /**
  * A route mounted under the console's authenticated layout. The host adds
@@ -1960,52 +1993,52 @@ interface ConsoleNavHint {
  * and a `canMatch` that answers whether the module is installed here. Routes
  * are lazy: a static component here would put every module's pages in `main`.
  */
-type ConsoleRouteMount = {
-    readonly path: string;
-    readonly children: () => Promise<Routes>;
-    readonly nav?: ConsoleNavHint;
-    readonly providers?: readonly Provider[];
+export type ConsoleRouteMount = {
+  readonly path: string;
+  readonly children: () => Promise<Routes>;
+  readonly nav?: ConsoleNavHint;
+  readonly providers?: readonly Provider[];
 } | {
-    readonly path: string;
-    readonly component: () => Promise<Type<unknown>>;
-    readonly nav?: ConsoleNavHint;
-    readonly providers?: readonly Provider[];
+  readonly path: string;
+  readonly component: () => Promise<Type<unknown>>;
+  readonly nav?: ConsoleNavHint;
+  readonly providers?: readonly Provider[];
 } | {
-    readonly path: string;
-    readonly redirectTo: string;
+  readonly path: string;
+  readonly redirectTo: string;
 };
 /** A `ComponentRegistry` name -> class: names a module OWNS (its server layouts name them) and names it fills in another module's slot (`profile.tab:call`). */
-interface ConsoleBinding {
-    readonly name: string;
-    readonly component: Type<unknown>;
+export interface ConsoleBinding {
+  readonly name: string;
+  readonly component: Type<unknown>;
 }
 /** A tile in the top bar's quick-access strip, rendered in ascending `order`. */
-interface ConsoleTopbarItem {
-    readonly id: string;
-    readonly order: number;
-    readonly component: Type<unknown>;
+export interface ConsoleTopbarItem {
+  readonly id: string;
+  readonly order: number;
+  readonly component: Type<unknown>;
 }
 /** Mounted once, inside the authenticated layout, outside the router outlet. */
-interface ConsoleOverlay {
-    readonly id: string;
-    readonly component: Type<unknown>;
+export interface ConsoleOverlay {
+  readonly id: string;
+  readonly component: Type<unknown>;
 }
 /**
  * A dock panel the layout opens and closes: the host renders its toggle in
  * the top bar and the panel in the dock, and the panel talks back through
  * {@link ConsolePanelHost} -- not through outputs, which a slot cannot carry.
  */
-interface ConsolePanel {
-    readonly id: string;
-    readonly dock: 'bottom';
-    /** The top-bar toggle: a label (the title), an icon name or a short text, and a key the host binds with Ctrl. */
-    readonly toggle: {
-        readonly label: string;
-        readonly icon?: string;
-        readonly text?: string;
-        readonly key?: string;
-    };
-    readonly component: Type<unknown>;
+export interface ConsolePanel {
+  readonly id: string;
+  readonly dock: 'bottom';
+  /** The top-bar toggle: a label (the title), an icon name or a short text, and a key the host binds with Ctrl. */
+  readonly toggle: {
+    readonly label: string;
+    readonly icon?: string;
+    readonly text?: string;
+    readonly key?: string;
+  };
+  readonly component: Type<unknown>;
 }
 /**
  * What a `provide*` line is: environment providers from a library's registry
@@ -2013,24 +2046,24 @@ interface ConsolePanel {
  * implementation of a single-implementation port, listed as such so the
  * assembly can refuse two modules implementing one port by name.
  */
-type ConsoleProvision = EnvironmentProviders | Provider | ConsolePortProvision;
-interface ConsolePortProvision {
-    readonly port: InjectionToken<unknown>;
-    readonly useExisting: Type<unknown>;
+export type ConsoleProvision = EnvironmentProviders | Provider | ConsolePortProvision;
+export interface ConsolePortProvision {
+  readonly port: InjectionToken<unknown>;
+  readonly useExisting: Type<unknown>;
 }
-declare function isPortProvision(p: ConsoleProvision): p is ConsolePortProvision;
+export declare function isPortProvision(p: ConsoleProvision): p is ConsolePortProvision;
 /** The identity function with the type: an entry file exports data, nothing runs. */
-declare function consoleEntry(entry: ConsoleEntry): ConsoleEntry;
+export declare function consoleEntry(entry: ConsoleEntry): ConsoleEntry;
 /**
  * Whether a caret range over MAJOR.MINOR admits a version: same major, minor
  * at least the range's. Malformed input admits nothing -- a range that cannot
  * be read must refuse, never pass.
  */
-declare function satisfiesRange(range: string, version: string): boolean;
+export declare function satisfiesRange(range: string, version: string): boolean;
 /** The refusal an assembly raises: one message per collision, all of them, by name. */
-declare class ConsoleAssemblyError extends Error {
-    readonly problems: readonly string[];
-    constructor(problems: readonly string[]);
+export declare class ConsoleAssemblyError extends Error {
+  readonly problems: readonly string[];
+  constructor(problems: readonly string[]);
 }
 /**
  * The checks every assembly runs, in one place so the build-time spec, the
@@ -2038,8 +2071,7 @@ declare class ConsoleAssemblyError extends Error {
  * this contract, and the collision rules of the six lists. Returns the
  * entries unchanged when nothing is wrong.
  */
-declare function assembleConsole(entries: readonly ConsoleEntry[]): readonly ConsoleEntry[];
-
+export declare function assembleConsole(entries: readonly ConsoleEntry[]): readonly ConsoleEntry[];
 /**
  * The host side of `console@1`: what a theme calls to turn the assembled
  * entries into routes, providers and the lists its shell renders.
@@ -2052,31 +2084,31 @@ declare function assembleConsole(entries: readonly ConsoleEntry[]): readonly Con
  * silently absent.
  */
 /** Every entry this build assembled, after {@link assembleConsole}'s checks. */
-declare const CONSOLE_ENTRIES: InjectionToken<readonly ConsoleEntry[]>;
+export declare const CONSOLE_ENTRIES: InjectionToken<readonly ConsoleEntry[]>;
 /**
  * The port a dock panel talks back through: the layout provides one per
  * panel it mounts, so the panel never needs an output the slot cannot carry.
  */
-declare abstract class ConsolePanelHost {
-    abstract close(): void;
-    abstract maximize(on: boolean): void;
+export declare abstract class ConsolePanelHost {
+  abstract close(): void;
+  abstract maximize(on: boolean): void;
 }
 /** The console modules the manifest says are installed here. */
-declare function installedConsoleModules(manifest: ApiManifest | null): ReadonlySet<string>;
-declare class ConsoleActivation {
-    private readonly entries;
-    private readonly manifest;
-    readonly installed: i0.Signal<ReadonlySet<string>>;
-    /** The entries of installed modules, in assembly order. */
-    readonly active: i0.Signal<ConsoleEntry[]>;
-    readonly topbar: i0.Signal<readonly ConsoleTopbarItem[]>;
-    readonly overlays: i0.Signal<readonly ConsoleOverlay[]>;
-    readonly panels: i0.Signal<readonly ConsolePanel[]>;
-    /** Modules the manifest names that this build has no entry for: what a diagnostics page shows by name. */
-    readonly missing: i0.Signal<string[]>;
-    isInstalled(module: string): boolean;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleActivation, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+export declare function installedConsoleModules(manifest: ApiManifest | null): ReadonlySet<string>;
+export declare class ConsoleActivation {
+  private readonly entries;
+  private readonly manifest;
+  readonly installed: import("@angular/core").Signal<ReadonlySet<string>>;
+  /** The entries of installed modules, in assembly order. */
+  readonly active: import("@angular/core").Signal<ConsoleEntry[]>;
+  readonly topbar: import("@angular/core").Signal<readonly ConsoleTopbarItem[]>;
+  readonly overlays: import("@angular/core").Signal<readonly ConsoleOverlay[]>;
+  readonly panels: import("@angular/core").Signal<readonly ConsolePanel[]>;
+  /** Modules the manifest names that this build has no entry for: what a diagnostics page shows by name. */
+  readonly missing: import("@angular/core").Signal<string[]>;
+  isInstalled(module: string): boolean;
+  static ɵfac: i0.ɵɵFactoryDeclaration<ConsoleActivation, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
 }
 /**
  * `canMatch` for a module's mount: the route exists only where the module is
@@ -2096,7 +2128,7 @@ declare class ConsoleActivation {
  * nothing is asked, the answer is the public config's, and the layout's guard
  * sends the person to sign in. A refusal merges nothing, so the answer is no.
  */
-declare function consoleModuleInstalled(module: string): CanMatchFn;
+export declare function consoleModuleInstalled(module: string): CanMatchFn;
 /**
  * The children a theme mounts under its authenticated layout for the
  * assembled entries: one `Route` per mount, lazy as written, `data` from the
@@ -2104,7 +2136,7 @@ declare function consoleModuleInstalled(module: string): CanMatchFn;
  * shape around them (login, the layout, `canActivate: [authGuard]`, the
  * wildcard).
  */
-declare function consoleChildren(entries: readonly ConsoleEntry[]): Routes;
+export declare function consoleChildren(entries: readonly ConsoleEntry[]): Routes;
 /**
  * The providers a theme adds for the assembled entries: the store with the
  * host's states and every module state, the registry bindings (an
@@ -2113,10 +2145,9 @@ declare function consoleChildren(entries: readonly ConsoleEntry[]): Routes;
  * library providers a module's provisions extend (the editor bridge, the
  * PDF viewer), as the hand-written lines were.
  */
-declare function provideConsole(entries: readonly ConsoleEntry[], options: {
-    readonly hostStates: readonly Type<unknown>[];
+export declare function provideConsole(entries: readonly ConsoleEntry[], options: {
+  readonly hostStates: readonly Type<unknown>[];
 }): EnvironmentProviders;
-
 /**
  * Phase H7 -- admin Site Selector.
  *
@@ -2146,8 +2177,7 @@ declare function provideConsole(entries: readonly ConsoleEntry[], options: {
  *    be ignored by the backend anyway, but skipping keeps wire traffic clean)
  *  - requests that already carry the header (programmatic overrides win)
  */
-declare const sectionInterceptor: HttpInterceptorFn;
-
+export declare const sectionInterceptor: HttpInterceptorFn;
 /**
  * The one fact the section interceptor needs: which site the operator is
  * currently working in.
@@ -2162,16 +2192,13 @@ declare const sectionInterceptor: HttpInterceptorFn;
  * Read SYNCHRONOUSLY on purpose. An interceptor decides whether to stamp a
  * header while building the request; it cannot wait on a stream.
  */
-interface CurrentSectionPort {
-    /** Slug of the active section, or null when the operator picked none. */
-    currentSlug(): string | null;
+export interface CurrentSectionPort {
+  /** Slug of the active section, or null when the operator picked none. */
+  currentSlug(): string | null;
 }
 /**
  * Optional by design: an application assembled without a Sections module binds
  * nothing and simply sends no `X-CoolMS-Section` header, which is exactly what
  * a single-site install wants.
  */
-declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;
-
-export { AppConfigState, AppInitService, AuthRefreshCoordinator, AuthState, BACKGROUND_REQUEST, BYPASS_AUTH, BYPASS_ELEVATION, CONSOLE_CONTRACT, CONSOLE_ENTRIES, CURRENT_SECTION, CmsLoaderComponent, ComponentRegistry, ConfigService, ConsoleAccessService, ConsoleActivation, ConsoleAssemblyError, ConsolePanelHost, CrossTabAuthSyncService, ELEVATION_NOTICE, ELEVATION_PROMPT, ELEVATION_REQUIRED_HEADER, ELEVATION_WARNING_FACTOR_MISSING, ELEVATION_WARNING_MFA_OFF, ELEVATION_WARNING_PASSWORD_NOT_SET, ElevationService, EntitySearchService, ErrorHandlerService, IdentityApiClient, Login, LoginComponent, Logout, NaviGraphService, PatchCurrentUser, RealtimeTokenClient, RestoreSession, SetAppConfig, SetTokens, SidebarStateService, ThemeService, UserPreferencesService, assembleConsole, authGuard, authInterceptor, consoleChildren, consoleEntry, consoleModuleInstalled, elevationInterceptor, installedConsoleModules, isElevationRefusal, isPortProvision, loginPageGuard, provideConsole, resolvePattern, satisfiesRange, sectionInterceptor };
-export type { ApiManifest, AppConfigStateModel, AuthApiManifest, AuthStateModel, CentrifugoConnectionTokenDto, CentrifugoSubscriptionTokenDto, ConsoleAccess, ConsoleBinding, ConsoleEntry, ConsoleManifestResponse, ConsoleNavHint, ConsoleOverlay, ConsolePanel, ConsolePortProvision, ConsoleProvision, ConsoleRouteMount, ConsoleTopbarItem, ContentApiManifest, CurrentSectionPort, DataGridApiManifest, DataGridPreference, DataGridPreferences, DataSourceDefinition, DataSourceLoading, DataSourceOption, DataSourceType, DataSourceWidget, DatagridConfig, DialogConfig, DocumentApiManifest, DomainExplorerApiManifest, DynamicEntityApiManifest, EditorApiManifest, EditorApiManifestEntry, EditorApiManifestProfile, ElevationChange, ElevationChangeKind, ElevationDropReason, ElevationEnded, ElevationEndedReason, ElevationNoticePort, ElevationPromptPort, ElevationPromptRequest, ElevationState, ElevationWarning, EntitySearchResult, FieldItem, FieldSecurityPolicy, FieldType, FormAction, FormActionType, FormActionVariant, FormConfig, FormRenderDefinition, HydraCollection, HydraView, IdentityApiManifest, LayoutConfig, LayoutHeaderAction, LayoutNode, LayoutSection, MediaApiManifest, NaviApiManifest, NaviGraphMeta, NaviGraphNode, NaviGraphNodeFlat, NaviGraphTarget, NavigraphConfig, PlatformDefaults, RelationDefinition, ResolvedTheme, SectionApiManifest, SubFormDefinition, TerminalApiManifest, ThemeChoice, ThemeConfigResponse, TokenResponse, UiApiManifest, UiModuleEntryManifest, UserDto, ValidatorDefinition, VfsApiManifest, ViewerApiManifest, ViewerDefinitionApiManifest, ViewerProfileApiManifest, VisibilityCondition, VisibilityOperator };
+export declare const CURRENT_SECTION: InjectionToken<CurrentSectionPort>;