@flyos/design-system 3.13.0 → 3.16.0

package/types/flyos-design-system.d.ts

@@ -1,5 +1,5 @@
 import * as _angular_core from '@angular/core';
-import { Type, InjectionToken, Signal, WritableSignal, OnInit, EventEmitter, OnChanges, OnDestroy, SimpleChanges, EnvironmentProviders, PipeTransform, signal, AfterViewInit, ElementRef, AfterViewChecked, ErrorHandler, Provider, TemplateRef } from '@angular/core';
+import { Type, InjectionToken, Signal, WritableSignal, OnInit, EventEmitter, OnChanges, OnDestroy, SimpleChanges, EnvironmentProviders, PipeTransform, signal, AfterViewInit, ElementRef, AfterViewChecked, Provider, ErrorHandler, TemplateRef } from '@angular/core';
 import * as rxjs from 'rxjs';
 import { Observable, MonoTypeOperatorFunction } from 'rxjs';
 import { ControlValueAccessor, Validator, AbstractControl, ValidationErrors } from '@angular/forms';
@@ -122,7 +122,7 @@ interface LaunchContext {
  * provisioning. Remotes subscribe to deep links via the federation-safe surfaces
  * instead: `FLYOS_LAUNCH_EVENT` (window CustomEvent) plus the
  * `__FLYOS_PENDING_LAUNCHES__` registry on `globalThis`. See
- * <c>skills/cross-app-deep-linking.md</c>.
+ * <c>skills/platform-deep-linking.md</c>.
  */
 declare const LAUNCH_CONTEXT: InjectionToken<Signal<LaunchContext | null>>;
 /**
@@ -168,7 +168,7 @@ type FlyosPendingLaunches = Record<string, LaunchContext>;
  *
  * Only the shell may act on this: it owns the app registry and the window manager,
  * neither of which is reachable from a federated remote. See
- * `skills/cross-app-deep-linking.md` § "Initiator side (federated remote)".
+ * `skills/platform-deep-linking.md` § "Initiator side (federated remote)".
  */
 interface FlyLaunchRequestDetail {
     /** Shell-registry app id of the app to open, e.g. `'chats'`. */
@@ -2377,7 +2377,7 @@ declare class FlyRemoteRouter {
      * `/trends/abc`) instead would leave a host-unroutable path in the bar — on
      * reload the shell router falls through to its `**` wildcard, redirects to
      * `/desktop`, and the deep link is silently lost. See
-     * skills/cross-app-deep-linking.md.
+     * skills/platform-deep-linking.md.
      *
      * `flyRemoteUrl` is still stashed in the history state so the popstate
      * listener restores the exact remote URL for back/forward without re-parsing
@@ -2467,6 +2467,21 @@ interface ConnectRemoteLaunchOptions {
      * `route => void flyRouter.navigateByUrl(route)`.
      */
     readonly navigate: (route: string) => void;
+    /**
+     * Optional side-channel for the rest of the launch — most importantly `ctx.params`,
+     * which {@link navigate} cannot carry (it is handed a route string).
+     *
+     * Called once per accepted (version-deduped) launch, BEFORE {@link navigate}, and
+     * called even when `ctx.route` is `null` — a params-only launch ("re-filter what is
+     * already open") is a real case and must not be swallowed by the null-route
+     * navigation no-op.
+     *
+     * Prefer {@link FlyLaunchContextService} over this callback for anything that isn't
+     * the root component: the helper publishes every accepted launch there too, so a
+     * lazily-mounted leaf can `inject(FlyLaunchContextService).contextFor(appId)` without
+     * the root having to thread a value down. This hook is for root-local reactions.
+     */
+    readonly onLaunch?: (ctx: LaunchContext) => void;
     /**
      * Gate. Pass your `isEmbedded` flag — when `false` the helper is a no-op (a
      * standalone remote has no shell dispatcher). Defaults to `true`. The helper is
@@ -2479,7 +2494,7 @@ interface ConnectRemoteLaunchOptions {
  * Federation-safe deep-link RECEIVER for an Angular Native-Federation remote — the
  * remote-side counterpart of the shell's `connectWindowRoute`. Collapses the
  * drain + dedupe + listen + cleanup boilerplate every remote root used to
- * hand-roll (see `skills/cross-app-deep-linking.md` § "Receiver side") into one
+ * hand-roll (see `skills/platform-deep-linking.md` § "Receiver side") into one
  * call, so the correct contract can't be hand-rolled wrong.
  *
  * **Must be called from an injection context** (component constructor or a field
@@ -2502,12 +2517,32 @@ interface ConnectRemoteLaunchOptions {
  * `appId`: the {@link FLYOS_LAUNCH_EVENT} window `CustomEvent` and the
  * `globalThis[FlyosPendingLaunchesGlobalKey]` registry. This helper consumes both.
  *
+ * ## The launch PARAMS
+ * `navigate` receives a route string, so it structurally cannot carry `ctx.params` —
+ * the payload dashboard drill-down rides on (`skills/dashboard-reports.md` §
+ * "Drill-down" sends `{ [filterParam]: clickedValue }`). Before DS 3.15.0 this helper
+ * read `ctx.route` and dropped the rest, so every drill-down into a federated remote
+ * opened an UNFILTERED register, and consumers hand-rolled a second, non-destructive
+ * peek at the same pending-launch registry — with a load-bearing construction-ordering
+ * dependency on running before this helper's drain deleted the entry.
+ *
+ * Every accepted launch is now published to {@link FlyLaunchContextService}, keyed by
+ * `appId`, so any component in the remote reads the full context — params included —
+ * with no ordering constraint:
+ *
+ * ```ts
+ * private readonly ctx = inject(FlyLaunchContextService).contextFor('ppm');
+ * ```
+ *
+ * {@link ConnectRemoteLaunchOptions.onLaunch} is the callback form, for a root-local
+ * reaction that needs no injectable.
+ *
  * ## Two inbound paths, one dedupe
  *  1. **First-mount drain.** The launch event fires BEFORE this listener attaches
  *     for the very first launch, so the shell stashes the latest context per
  *     `appId` on the `globalThis` registry. The helper reads it then **deletes**
  *     it — never leaving a stale entry behind (a leftover entry would re-apply on
- *     every re-mount; this is the failure mode `skills/cross-app-deep-linking.md`
+ *     every re-mount; this is the failure mode `skills/platform-deep-linking.md`
  *     § "What NOT to do" warns about).
  *  2. **Live event.** Re-launches into an already-mounted remote arrive on
  *     {@link FLYOS_LAUNCH_EVENT}; the `appId` filter is mandatory.
@@ -2528,6 +2563,111 @@ interface ConnectRemoteLaunchOptions {
  */
 declare function connectRemoteLaunch(opts: ConnectRemoteLaunchOptions): void;
 
+/**
+ * Shared cross-bundle store key + sync event for the inbound launch channel.
+ *
+ * **Public contract**, for the same reason {@link FLY_REMOTE_CONTEXT_STORE_KEY} is: a
+ * consumer pinned to a DS older than 3.15.0 can read this slot directly (same shape,
+ * keyed by appId) rather than re-deriving the peek-the-pending-registry workaround.
+ * Keep these literals stable; they are an integration boundary.
+ */
+declare const FLY_LAUNCH_CONTEXT_STORE_KEY = "__flyLaunchContext__";
+declare const FLY_LAUNCH_CONTEXT_EVENT = "fly:launch-context";
+/**
+ * Shell → remote launch channel: the **whole** {@link LaunchContext} of the most
+ * recent launch into each app, `params` included.
+ *
+ * Why this exists
+ * ---------------
+ * {@link connectRemoteLaunch} consumes the two DI-free launch surfaces
+ * (`FLYOS_LAUNCH_EVENT` + the `__FLYOS_PENDING_LAUNCHES__` registry) and applies the
+ * `route` half by navigating. Until DS 3.15.0 it read `ctx.route` and **nothing else**,
+ * so `ctx.params` — the payload dashboard drill-down carries (`skills/dashboard-reports.md`
+ * § "Drill-down": `{ [filterParam]: clickedValue }`) — was silently dropped, and every
+ * drill-down into a federated remote landed on an UNFILTERED register.
+ *
+ * The shell-side answer to "read the launch params" is `inject(LAUNCH_CONTEXT)`, which a
+ * federated remote must not use: Native Federation can split that `InjectionToken`
+ * instance across host and remote bundles, so `inject()` returns `null` (see
+ * `LAUNCH_CONTEXT`'s own doc). This service is the federation-safe counterpart —
+ * `connectRemoteLaunch` publishes here, and any component in the remote (however deep, in
+ * whatever lazy chunk) injects this and reads the same context.
+ *
+ * Why `globalThis`, not just the DI singleton
+ * -------------------------------------------
+ * Identical rationale to {@link FlyRemoteContextService}: the shell builds the design
+ * system from workspace SOURCE while remotes consume the published npm package, and NF's
+ * version negotiation has silently split `providedIn: 'root'` before. State therefore
+ * lives on `globalThis` (see {@link FLY_LAUNCH_CONTEXT_STORE_KEY}); {@link context} /
+ * {@link params} read it directly (split-proof, synchronous) and a per-instance signal
+ * mirrors it for reactive consumers, re-synced from a `globalThis` event whenever another
+ * copy of the service mutates the store.
+ *
+ * Reading it
+ * ----------
+ * ```ts
+ * private readonly launch = inject(FlyLaunchContextService);
+ * private readonly drillDown = this.launch.contextFor('ppm');
+ * private lastVersion = -1;                       // -1 never collides: the shell counts from 1
+ *
+ * constructor() {
+ *   effect(() => {
+ *     const ctx = this.drillDown();
+ *     if (!ctx || ctx.version === this.lastVersion) return;   // version-dedupe is the consumer's job
+ *     this.lastVersion = ctx.version;
+ *     const status = ctx.params?.['status'];
+ *     if (typeof status === 'string') this.applyStatusFilter(status);
+ *   });
+ * }
+ * ```
+ *
+ * Staleness
+ * ---------
+ * An entry is **not** dropped once read — a lazily-mounted consumer must still find the
+ * launch that opened the window, which may have arrived long before its chunk loaded (the
+ * exact ordering hazard the hand-rolled "peek the pending registry before
+ * `connectRemoteLaunch` drains it" workaround existed to dodge). It cannot go stale across
+ * a remount for the same reason `connectRemoteLaunch`'s `lastVersion` reset is safe: the
+ * shell is the single writer and `reloadWindowContent` ALWAYS re-publishes the window's
+ * CURRENT context (`params: null`, bumped version) before dropping the injector, so the
+ * remount's drain overwrites this slot before any consumer mounts. Consumers dedupe on
+ * `version` regardless, exactly as they must for the live-event path.
+ *
+ * Keyed by `appId` (last launch wins) — a single live window per app, matching
+ * `__FLYOS_PENDING_LAUNCHES__`'s own keying.
+ */
+declare class FlyLaunchContextService {
+    private readonly _byApp;
+    /** Every app's latest inbound launch context, keyed by app id. Reactive. */
+    readonly contexts: Signal<ReadonlyMap<string, LaunchContext>>;
+    /**
+     * `contextFor` memo — one computed per app id, so repeated calls (a component field
+     * initializer re-running per instance) hand back the SAME signal instead of leaking a
+     * new computed each time.
+     */
+    private readonly perApp;
+    constructor();
+    /**
+     * Record an inbound launch for an app. Called by {@link connectRemoteLaunch} once per
+     * accepted (version-deduped) launch — a remote should not normally call this itself.
+     */
+    publish(appId: string, ctx: LaunchContext): void;
+    /** Latest launch context for an app as a signal — the reactive read path. */
+    contextFor(appId: string): Signal<LaunchContext | null>;
+    /** Latest launch context for an app, read straight off the store. `null` when none. */
+    context(appId: string): LaunchContext | null;
+    /**
+     * The `params` half of an app's latest launch — the drill-down payload. `null` when the
+     * app has no launch context, or when the launch carried no params. The **consumer**
+     * interprets the keys against its own filter contract; the platform never does.
+     */
+    params(appId: string): Readonly<Record<string, unknown>> | null;
+    /** Drop an app's launch context. No-op if absent. Mainly for teardown and tests. */
+    clear(appId: string): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyLaunchContextService, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<FlyLaunchContextService>;
+}
+
 /**
  * A federated remote's current navigation context, as published to the shell.
  *
@@ -3903,7 +4043,7 @@ interface AgentDragPayload<T = unknown> {
      * DS package is shell-agnostic and shouldn't grow a second copy of the
      * URL grammar. Apps building envelopes are expected to stamp routes that
      * match their own internal route schema (e.g. dashboard publishes
-     * `/reports/{id}` and `/custom/{id}`); see `skills/cross-app-deep-linking.md`.
+     * `/reports/{id}` and `/custom/{id}`); see `skills/platform-deep-linking.md`.
      *
      * Backwards-compat: absent on v1 payloads and on v2 payloads built
      * before this field was added. Persisted JSONB chips without the field
@@ -5983,7 +6123,7 @@ interface FlySelectPanelPosition {
  * input still wins. It used to default to a hardcoded English literal that every consumer had to
  * remember to override — none did, so a searchable select read "Search…" under ar/fr/ur.
  * Styling composes the Nova token language (`--w*` ramp, `--accent`, `nova-glass.popover`) — see
- * `skills/desktop-design-language.md` §3.2 and `.workflow/plans/ux-refresh/notes/S1.7-form-family.md`.
+ * `skills/shell-design-language.md` §3.2 and `.workflow/plans/ux-refresh/notes/S1.7-form-family.md`.
  *
  * **Positioning (S1.7 — Nova):** the panel is `position: fixed`, measured from the trigger, and
  * **portaled to `<body>`** the same way {@link ContextMenuComponent} escapes a clipping/glass
@@ -6514,6 +6654,21 @@ interface GanttRow {
      * expanding it emits {@link FlyGanttComponent.rowExpand} instead of revealing nothing.
      */
     hasChildren?: boolean;
+    /**
+     * Whether a row that currently has NO children is still a valid drag-to-reorder PARENT —
+     * dropping another row directly beneath it files that row as its first child instead of as its
+     * sibling. Independent of {@link hasChildren}: that field also paints a chevron, which is wrong
+     * for a container with nothing in it yet (a milestone that has no tasks is a point-in-time
+     * marker, not an expandable list with zero items). This field changes ONLY what
+     * `resolveGanttReorderDrop` does with a drop on this row; it paints nothing.
+     *
+     * Existing rows with real children need no help — `hasChildren && !collapsed` already nests
+     * into them. This exists for the row that CAN adopt a child but has not yet: the indent action
+     * already reaches this case (`canIndentGanttRow` only checks depth, never child count), so
+     * without this flag a drag and an indent onto the same empty container disagreed — one nested
+     * the row, the other filed it as a root/backlog sibling with no explanation.
+     */
+    canAdoptChildren?: boolean;
     /**
      * Optional baseline (plan-of-record) date, ISO `YYYY-MM-DD`. When both `baselineStart` and
      * `baselineEnd` are set and {@link FlyGanttComponent.showBaselines} is on, the chart renders a
@@ -6569,6 +6724,43 @@ interface GanttDependencyCreate {
     toId: string;
     type: GanttDependencyType;
 }
+/**
+ * Payload of {@link FlyGanttComponent.rowReorder} — a label row dragged to a new place in the tree.
+ *
+ * Carries the FULL new sibling order rather than a `before`/`after` hint, because that is the shape
+ * every ordering endpoint actually takes (an ordered, complete id set) and because re-deriving it
+ * consumer-side is where the chart's order and the consumer's start to disagree. `parentId` is the
+ * parent AFTER the move — `null` for a root row — so a drop that also re-homes the row (dragging a
+ * task from one summary group into another) is one event, not two.
+ *
+ * The chart does NOT judge whether a level change is legal: only the consumer knows whether its
+ * two outline levels are the same kind of thing. Reject the move by simply not persisting it; the
+ * rows are re-rendered from the consumer's own input either way, so nothing is left inconsistent.
+ */
+interface GanttRowReorder {
+    /** The row that moved. */
+    readonly id: string;
+    /** Its parent after the move; `null` = a root row. */
+    readonly parentId: string | null;
+    /** Zero-based slot among `parentId`'s children after the move. */
+    readonly index: number;
+    /** Every child of `parentId` after the move, in their new order (includes {@link id}). */
+    readonly siblingIds: readonly string[];
+}
+/**
+ * Payload of {@link FlyGanttComponent.rowIndentChange} — the outline-level nudge behind an
+ * indent / outdent action.
+ *
+ * `delta` is `+1` (indent — become a child of the row above) or `-1` (outdent — become a sibling of
+ * the current parent). `parentId` is the resulting parent, resolved by the chart from the row's
+ * neighbours so every consumer does not re-implement "which row would adopt it": `null` means the
+ * row lands at the root.
+ */
+interface GanttRowIndentChange {
+    readonly id: string;
+    readonly delta: 1 | -1;
+    readonly parentId: string | null;
+}
 /** Payload of {@link FlyGanttComponent.dependencyDelete} — the edge the user removed. */
 interface GanttDependencyDelete {
     fromId: string;
@@ -6605,6 +6797,10 @@ interface GanttFlatRow {
     hasChildren: boolean;
     collapsed: boolean;
 }
+interface ResolvedDates {
+    start: Date | null;
+    end: Date | null;
+}
 /** Render shape a row resolves to — decides which geometry fields on its VM are meaningful. */
 type RowShape = 'bar' | 'milestone' | 'group' | 'empty';
 /** Which end of a bar a link gesture grabbed / was dropped on. */
@@ -6650,7 +6846,7 @@ interface GanttLinkGesture {
  * `gantt-label-pane.ts`: a few pure functions plus one signal-based class composed by the host).
  * The functions below remain dependency-free — no Angular, no DOM — for the same reason
  * `gantt-scale.ts`'s are: jsdom lays nothing out, so pure functions are the only directly
- * testable form of this math (skill: design-system-gantt.md §8).
+ * testable form of this math (skill: ds-gantt.md §8).
  *
  * ## The `viewBox`-pan trick this math drives
  * The body `<svg>` stays `position: absolute`, sized to only the rendered window
@@ -6718,17 +6914,120 @@ interface GanttRowVm {
     /** Baseline overlay geometry, or `null` when the row has none (or baselines are hidden). */
     baseline: GanttBaselineVm | null;
 }
-interface LinkVm {
+/**
+ * What the geometry needs from its host, as signals rather than a component reference — the same
+ * one-way shape {@link GanttLabelPane} and {@link GanttLinkGestures} take.
+ */
+interface GanttRowGeometryDeps {
+    readonly rowHeight: Signal<number>;
+    readonly rtl: Signal<boolean>;
+    readonly domain: Signal<GanttDomain>;
+    readonly pxPerDay: Signal<number>;
+    readonly innerWidth: Signal<number>;
+    readonly showBaselines: Signal<boolean>;
+    readonly readonly: Signal<boolean>;
+    /** Every row's effective `{start,end}` (`resolveRowDates`), including derived group spans. */
+    readonly resolvedDates: Signal<ReadonlyMap<string, ResolvedDates>>;
+    /** The in-flight bar drag, folded into the geometry so the bar follows the pointer. */
+    readonly dragPreview: Signal<{
+        id: string;
+        start: Date;
+        end: Date;
+    } | null>;
+    /** The row-band tint, already faded to its low alpha (or `null`). */
+    readonly tintFor: (row: GanttRow) => string | null;
+    /** The localized accessible label for a row. */
+    readonly ariaFor: (row: GanttRow, start: Date | null, end: Date | null, shape: RowShape) => string;
+}
+/**
+ * Render-space geometry for a Gantt row: the view-model one flattened row resolves to, and every
+ * shape derived from it.
+ *
+ * ## Why this is not in the component
+ * `fly-gantt` composes its gestures out of one-concern classes already ({@link GanttLabelPane},
+ * {@link GanttLinkGestures}, {@link GanttViewport}, {@link GanttPan}) and this is the matching
+ * carve on the RENDER side: everything here is "given a row and the current scale, where is it and
+ * what shape is it", with no knowledge of selection, collapse, windowing, events or i18n beyond the
+ * one label callback. Keeping it here means the component's remaining bulk is state and wiring, and
+ * the geometry — the part that is actually hard to read — sits beside the scale math it calls.
+ *
+ * ## RTL
+ * Nothing here branches on direction except through `mapX`/`projectBar` and the two `sign` terms
+ * below, because the whole coordinate space is pre-mirrored (see `gantt-scale.ts`). The
+ * consequence worth remembering: under RTL a row's `startX` is GREATER than its `endX`.
+ */
+declare class GanttRowGeometry {
+    private readonly deps;
+    constructor(deps: GanttRowGeometryDeps);
+    /** Bar height for the current row height — the band minus its vertical padding. */
+    readonly barHeight: Signal<number>;
+    /** Full geometry for one row — used for rendered rows AND for link endpoints outside the window. */
+    forFlat(flat: GanttFlatRow, index: number): GanttRowVm;
+    barTop(vm: GanttRowVm): number;
+    /** Baseline underbar's top edge — a thin strip directly beneath the main bar. */
+    baselineBarTop(vm: GanttRowVm): number;
+    private milestoneR;
+    /** Diamond polygon points for a milestone marker. */
+    diamondPoints(vm: GanttRowVm): string;
+    /** Hollow outline diamond for a milestone row's baseline date (its own x, same row's y). */
+    baselineDiamondPoints(vm: GanttRowVm): string;
+    /**
+     * Link connector x for a milestone. A diamond has no width, so the connector is nudged clear
+     * of the marker in the forward-in-time direction (which flips under RTL).
+     */
+    milestoneConnectorX(vm: GanttRowVm): number;
+    /**
+     * Connector x for one END of a bar, pushed into the gutter BESIDE the bar rather than sitting on
+     * its edge (see {@link CONNECTOR_GAP}). Forward-in-time is `+x` LTR and `-x` RTL, so the start
+     * connector always lands before the bar and the finish connector after it, in reading order.
+     */
+    connectorX(vm: GanttRowVm, anchor: 'start' | 'finish'): number;
+    /** Summary-bracket path (thin bar + down-turned end caps) for a group row. */
+    groupPath(vm: GanttRowVm): string;
+    /** Inline-start label indent for a tree depth. */
+    indentFor(depth: number): number;
+}
+
+/** Which part of a bar the press grabbed. */
+type GanttBarDragMode = 'move' | 'resize-start' | 'resize-end';
+/** The follow-the-cursor date readout shown while a drag runs. */
+interface GanttDragTooltip {
+    readonly x: number;
+    readonly y: number;
+    readonly text: string;
+}
+
+/**
+ * Which end of each row a relationship touches.
+ *
+ * The two letters ARE the anchors — `FS` is "from my **F**inish to your **S**tart" — so this is
+ * the exact inverse of `linkTypeFor`, and stating it as a function rather than re-reading the
+ * letters at each call site is what keeps the arrowhead, the re-target handle and the type
+ * derivation from ever disagreeing about which end an arrow lands on.
+ */
+declare function linkAnchorsFor(type: GanttDependencyType): {
+    from: GanttLinkAnchor;
+    to: GanttLinkAnchor;
+};
+/** A dependency arrow, ready to draw. Render space throughout. */
+interface GanttLinkVm {
     key: string;
     fromId: string;
     toId: string;
     type: GanttDependencyType;
     path: string;
-    /** Anchor for the delete affordance shown while the link is selected (render space). */
+    /** Anchor for the delete affordance shown while the link is selected. */
     badgeX: number;
     badgeY: number;
+    /** The arrowhead end — where the re-target handle sits while the link is selected. */
+    headX: number;
+    headY: number;
+    /** The end of the SOURCE row this arrow leaves from, which a re-target drag has to start on. */
+    fromAnchor: GanttLinkAnchor;
     ariaLabel: string;
 }
+
+/** One dependency arrow, routed and ready for the template. */
 /**
  * **`fly-gantt`** — the design-system SVG Gantt chart.
  *
@@ -6762,9 +7061,21 @@ interface LinkVm {
 declare class FlyGanttComponent {
     readonly i18n: I18nService;
     private readonly destroyRef;
+    /**
+     * App-level presentation defaults, when the consuming app provided any. Optional by
+     * construction: a chart with no provider behaves exactly as it did before the token existed.
+     */
+    private readonly appDefaults;
     readonly rows: _angular_core.InputSignal<readonly GanttRow[]>;
     readonly dependencies: _angular_core.InputSignal<readonly GanttDependency[]>;
-    readonly zoom: _angular_core.InputSignal<GanttZoom>;
+    /**
+     * Time-grid resolution. `null` defers to {@link FlyGanttDefaults.zoom}, then to `'week'`.
+     *
+     * Widened from `GanttZoom` to `GanttZoom | null` so the same three-step precedence
+     * (input → app default → built-in) applies to every presentation input. Passing a concrete zoom
+     * is unchanged.
+     */
+    readonly zoom: _angular_core.InputSignal<GanttZoom | null>;
     /** Draw the vertical "today" marker when today falls inside the domain. */
     readonly showToday: _angular_core.InputSignal<boolean>;
     /** Globally disable drag/resize/link (individual rows can also be `readonly`). */
@@ -6774,11 +7085,11 @@ declare class FlyGanttComponent {
      * divider from there; once they have, this input only re-seeds the pane if
      * {@link resetLabelWidth} is called (double-clicking the divider does exactly that).
      */
-    readonly labelWidth: _angular_core.InputSignal<number>;
+    readonly labelWidth: _angular_core.InputSignal<number | null>;
     /** Let the user drag the divider between the label pane and the time grid. */
     readonly resizableLabels: _angular_core.InputSignal<boolean>;
-    /** Row band height in px. */
-    readonly rowHeight: _angular_core.InputSignal<number>;
+    /** Row band height in px. `null` defers to {@link FlyGanttDefaults.rowHeight}, then to `34`. */
+    readonly rowHeight: _angular_core.InputSignal<number | null>;
     /** Hard cap on the flattened row list; beyond it the list is truncated (see class doc).
      *  `0` (the default) is uncapped — windowing (below) is what keeps an uncapped chart cheap. */
     readonly maxRows: _angular_core.InputSignal<number>;
@@ -6793,6 +7104,31 @@ declare class FlyGanttComponent {
     readonly virtualized: _angular_core.InputSignal<boolean>;
     /** Render the baseline underbar/diamond for rows carrying `baselineStart`/`baselineEnd`. */
     readonly showBaselines: _angular_core.InputSignal<boolean>;
+    /**
+     * Render a search field in the pinned corner that filters the label tree.
+     *
+     * Filtering preserves tree CONTEXT rather than flattening to a hit list — see
+     * `gantt-search.ts` for why a plain `rows.filter()` silently re-parents matching children and
+     * de-groups matching parents. A live query also expands every group (a match hidden inside a
+     * collapsed summary is indistinguishable from no match at all) and suspends drag-reorder, since
+     * a filtered sibling list is not a complete one to reorder against.
+     *
+     * `null` defers to {@link FlyGanttDefaults.searchable}, then to `false`.
+     */
+    readonly searchable: _angular_core.InputSignal<boolean | null>;
+    /**
+     * Let the user drag label rows to reorder / re-home them, emitting {@link rowReorder}.
+     *
+     * `null` defers to {@link FlyGanttDefaults.reorderable}, then to `false` — the chart never
+     * offers a gesture whose result nobody is persisting.
+     */
+    readonly reorderable: _angular_core.InputSignal<boolean | null>;
+    /**
+     * The label-tree filter text. Two-way bindable, so a consumer can seed it from a deep link or
+     * clear it on navigation; the built-in field writes it as the user types (debounced by
+     * `fly-search-input`). Ignored unless {@link searchable}.
+     */
+    readonly searchQuery: _angular_core.ModelSignal<string>;
     /** Fires on a committed bar move / resize with the new ISO `start`/`end`. */
     readonly rowDatesChange: _angular_core.OutputEmitterRef<GanttRowDatesChange>;
     /**
@@ -6812,32 +7148,72 @@ declare class FlyGanttComponent {
     readonly rowExpand: _angular_core.OutputEmitterRef<string>;
     /** The component coarsened the requested zoom to stay under `maxCanvasPx`. */
     readonly effectiveZoomChange: _angular_core.OutputEmitterRef<GanttZoom>;
+    /**
+     * A label row was dragged to a new place. Carries the complete new sibling order, so a consumer
+     * persists it with one ordered-set write. See {@link GanttRowReorder}.
+     */
+    readonly rowReorder: _angular_core.OutputEmitterRef<GanttRowReorder>;
+    /**
+     * A row's outline level was nudged by {@link indentRow} / {@link outdentRow}, with the resulting
+     * parent already resolved from the row's neighbours. The chart does not re-render on its own —
+     * like every other gesture here, the consumer persists and feeds new `rows` back in.
+     */
+    readonly rowIndentChange: _angular_core.OutputEmitterRef<GanttRowIndentChange>;
     private readonly _uid;
     readonly markerId: string;
     readonly HEADER_H: number;
     readonly HEADER_UPPER_H = 22;
     readonly HEADER_LOWER_H = 22;
     readonly HANDLE_W = 8;
+    /** Connector radius — small, and parked outside the bar, so it never steals the resize
+     *  handle's press (`gantt-row-vm.ts`'s CONNECTOR_R note). */
+    readonly CONNECTOR_R = 3;
     readonly MIN_LABEL_W = 140;
     readonly MAX_LABEL_W = 720;
     readonly BASELINE_BAR_H: number;
     readonly selectedId: _angular_core.WritableSignal<string | null>;
     /** Uncontrolled collapse state — the source of truth whenever the `collapsedIds` input is `null`. */
     private readonly _uncontrolledCollapsed;
-    /** Live drag preview `{id,start,end}` folded into geometry while a gesture runs. */
+    /** Live drag preview `{id,start,end}` folded into geometry while a bar gesture runs, and the
+     *  cursor-following date readout beside it — both owned by {@link GanttBarDrag}, re-exposed here
+     *  because the row geometry reads the first and the template renders the second. */
     private readonly _dragPreview;
-    readonly dragTooltip: _angular_core.WritableSignal<{
-        x: number;
-        y: number;
-        text: string;
-    } | null>;
+    readonly dragTooltip: _angular_core.Signal<GanttDragTooltip | null>;
     private readonly bodyRef;
     private readonly scrollElRef;
     private readonly canvasElRef;
     private readonly labelsElRef;
     readonly rtl: _angular_core.Signal<boolean>;
+    /** The zoom the consumer asked for, before `maxCanvasPx` coarsening ({@link effectiveZoom}). */
+    readonly requestedZoom: _angular_core.Signal<GanttZoom>;
+    /** Row band height actually rendered. */
+    readonly effectiveRowHeight: _angular_core.Signal<number>;
+    /** The width the label pane falls back to until the user drags the divider. */
+    private readonly _labelWidthInput;
+    /** Whether the corner search field is rendered at all. */
+    readonly searchEnabled: _angular_core.Signal<boolean>;
+    /** The live filter text, or `''` when searching is off — the one signal every filter path reads. */
+    readonly activeQuery: _angular_core.Signal<string>;
+    /**
+     * Whether a label row can be dragged right now.
+     *
+     * Suspended while a search is live, deliberately: {@link rowReorder} emits the COMPLETE sibling
+     * order, and a filtered tree only holds the siblings that matched. Persisting that list would
+     * quietly drop every row the filter is hiding — the sort of data loss whose cause is invisible
+     * afterwards. A read-only chart never reorders either.
+     */
+    readonly reorderEnabled: _angular_core.Signal<boolean>;
     /** Effective collapse set: the controlled input when the consumer supplied one, else internal state. */
     private readonly _collapsed;
+    /**
+     * The consumer's rows narrowed by the live search filter (identity-stable when not searching).
+     *
+     * NOTE the domain and the resolved dates below deliberately stay on the UNFILTERED `rows()`: a
+     * timeline whose axis and whose summary spans jumped on every keystroke would make the filter
+     * feel like it was editing the plan. Filtering decides which rows are LISTED, not what the dates
+     * are.
+     */
+    readonly filteredRows: _angular_core.Signal<readonly GanttRow[]>;
     /** Full visible list after tree flatten/collapse (no `maxRows` cap applied yet). */
     private readonly _flat;
     /** `_flat`, capped at `maxRows` when it is positive — unchanged from the pre-A9 contract. */
@@ -6877,31 +7253,28 @@ declare class FlyGanttComponent {
     readonly rowVms: _angular_core.Signal<GanttRowVm[]>;
     /** Only the rows carrying a tint, so the band pass does not emit an empty rect per row. */
     readonly tintedRows: _angular_core.Signal<GanttRowVm[]>;
-    /** Dependency arrows whose y-span intersects the row window — O(E), not O(N). Endpoints are
-     *  resolved via {@link _vmForFlat} directly (not off `rowVms()`) since an edge can cross the
-     *  window with one endpoint outside it — the memo §4.3 rule-2 fix for the pre-A9 "both
-     *  endpoints rendered" predicate, which would erase exactly those crossing arrows. */
-    readonly linkVms: _angular_core.Signal<LinkVm[]>;
-    /** Full geometry for one row — shared by `rowVms` and `linkVms` (endpoints outside the window). */
-    private _vmForFlat;
+    /**
+     * Render-space geometry, in {@link GanttRowGeometry} — the row view-model plus every shape
+     * derived from it. Composed for the same reason as the gestures below it: given a row and the
+     * current scale it answers "where is this and what shape is it", and knows nothing about
+     * selection, collapse, windowing or events. `geo` is public because the TEMPLATE calls it.
+     */
+    readonly geo: GanttRowGeometry;
+    /** Bar height for the current row height — bound directly by the template. */
     readonly barHeight: _angular_core.Signal<number>;
-    barTop(vm: GanttRowVm): number;
-    /** Baseline underbar's top edge — a thin strip directly beneath the main bar. */
-    baselineBarTop(vm: GanttRowVm): number;
-    private milestoneR;
-    /** Diamond polygon points for a milestone marker. */
-    diamondPoints(vm: GanttRowVm): string;
-    /** Hollow outline diamond for a milestone row's baseline date (its own x, same row's y). */
-    baselineDiamondPoints(vm: GanttRowVm): string;
     /**
-     * Link connector x for a milestone. A diamond has no width, so the connector is nudged clear
-     * of the marker in the forward-in-time direction (which flips under RTL).
+     * Dependency arrows, in {@link GanttLinkVms} — the drawing half of the link surface, paired with
+     * the dragging half in `gantt-link-gestures.ts`. Declared after {@link geo} because it is handed
+     * that instance: both halves of a link resolve through the SAME row geometry the rows draw from,
+     * so an arrow can never land somewhere its own endpoint is not.
+     *
+     * Only arrows whose y-span intersects the row window are built — O(E), not O(N) — and the
+     * predicate is CROSSES, not "both endpoints rendered": an edge with one end scrolled out of the
+     * window still has to be drawn through it (memo §4.3 rule 2).
      */
-    milestoneConnectorX(vm: GanttRowVm): number;
-    /** Summary-bracket path (thin bar + down-turned end caps) for a group row. */
-    groupPath(vm: GanttRowVm): string;
-    /** Inline-start label indent for a tree depth. */
-    indentFor(depth: number): number;
+    private readonly _linkVms;
+    /** The arrows the template draws. */
+    readonly linkVms: _angular_core.Signal<GanttLinkVm[]>;
     /**
      * The divider's own state machine, in {@link GanttLabelPane}. It is composed rather than
      * inlined because it is the one region of this component with no coupling to the chart: give it
@@ -6936,12 +7309,42 @@ declare class FlyGanttComponent {
     onLabelRowKeydown(ev: Event, id: string): void;
     onRowClick(id: string): void;
     onRowDblClick(id: string): void;
-    onLinkClick(ev: Event, vm: LinkVm): void;
-    deleteLink(ev: Event, vm: LinkVm): void;
-    onGridKeydown(ev: KeyboardEvent): void;
-    /** Shift both dates of the selected bar by `deltaDays` and emit (respecting read-only). */
-    private _nudgeSelected;
-    onBarPointerDown(ev: PointerEvent, vm: GanttRowVm, mode: 'move' | 'resize-start' | 'resize-end'): void;
+    /**
+     * Press on a row's own SHAPE — the group bracket today; bars and milestones reach the same place
+     * through {@link onBarPointerDown}, which additionally starts a drag.
+     *
+     * `stopPropagation` is what keeps this apart from the background pan: the full-width lane rect
+     * behind every row is deliberately NOT a selection target any more (clicking the empty part of a
+     * row is a pan, not a pick), so only a press that lands on a painted shape may select.
+     */
+    onShapePointerDown(ev: PointerEvent, id: string): void;
+    /** Settled (debounced) text from the corner search field. */
+    onSearchQueryChange(query: string): void;
+    onLinkClick(ev: Event, vm: GanttLinkVm): void;
+    /**
+     * Claim the press on a dependency arrow before the canvas can read it as the start of a pan.
+     *
+     * An arrow is a CONTROL sitting on the pan surface, and it selects on `click` — but the pan
+     * gesture swallows the trailing click of any press that travelled more than
+     * `PAN_THRESHOLD_PX`, so on a 1.5px line a perfectly ordinary click (a few pixels of hand
+     * movement between press and release) selected nothing and nudged the chart sideways instead.
+     * The bar drag and the connector drag were never affected because both already stop the press
+     * here; the arrow was the one interactive thing on the canvas that did not.
+     */
+    onLinkPathPointerDown(ev: PointerEvent): void;
+    /**
+     * Grab the head of the selected arrow and re-point it. Resolves the arrow's SOURCE row, because
+     * that is where the gesture has to originate for the drop to derive a relationship type.
+     */
+    onLinkHeadPointerDown(ev: PointerEvent, vm: GanttLinkVm): void;
+    deleteLink(ev: Event, vm: GanttLinkVm): void;
+    /**
+     * Moving and resizing a bar, in {@link GanttBarDrag} — the last of the three pointer gestures
+     * to be composed rather than inlined, for the same reason as the other two: it needs a scale, a
+     * direction and somewhere to report a committed pair of dates, and nothing else about the chart.
+     */
+    private readonly _barDrag;
+    onBarPointerDown(ev: PointerEvent, vm: GanttRowVm, mode: GanttBarDragMode): void;
     /**
      * The dependency-drawing gesture, in {@link GanttLinkGestures}. Composed rather than inlined
      * because it is a self-contained second gesture whose interesting part is a RULE — the end you
@@ -6955,1584 +7358,1839 @@ declare class FlyGanttComponent {
     readonly linkGesture: _angular_core.WritableSignal<GanttLinkGesture | null>;
     /** Rubber-band path for an in-flight link gesture (render space). */
     readonly linkGesturePath: _angular_core.Signal<string | null>;
-    onLinkPointerDown(ev: PointerEvent, vm: GanttRowVm, anchor: GanttLinkAnchor): void;
     /**
-     * Resolve a row's `backgroundColor` into the low-alpha band colour actually painted.
-     * `color-mix` does the fade in the consumer's own colour space, so a token, a hex, an
-     * `rgb()` or an `oklch()` all work and none of them need pre-computing per theme.
+     * The chart's keyboard map, in {@link GanttKeyboard} — composed for the same reason as the three
+     * pointer gestures below it. Declared after the link surface because it is handed both halves:
+     * Delete belongs to a selected ARROW before it belongs to a selected row.
      */
-    private _tintFor;
+    private readonly _keyboard;
+    onGridKeydown(ev: KeyboardEvent): void;
+    onLinkPointerDown(ev: PointerEvent, vm: GanttRowVm, anchor: GanttLinkAnchor): void;
+    /**
+     * Ctrl+wheel scrolls horizontally and a press-drag on empty chart space pans, both in
+     * {@link GanttPan}. Composed for the same reason as the other two gestures: it needs a scrolling
+     * element and nothing else about the chart, and its two subtleties (a non-passive wheel listener
+     * is the only kind that can out-vote browser zoom; a pan must swallow its own trailing click)
+     * read better beside each other than scattered through this class.
+     */
+    private readonly _pan;
+    /** True mid drag-pan — drives the host's grabbing cursor. */
+    readonly panning: _angular_core.WritableSignal<boolean>;
+    /**
+     * Press on the chart background. Every interactive shape stops propagation on its own
+     * `pointerdown`, so only genuinely empty space (the lane rects, the weekend bands, the
+     * gridlines, the canvas itself) ever reaches this.
+     */
+    onPanPointerDown(ev: PointerEvent): void;
+    /**
+     * The flattened rows in the narrow shape the reorder resolver needs.
+     *
+     * `parentId` is recomputed from the rendered DEPTHS rather than copied off `GanttRow.parentId`,
+     * and the difference is load-bearing: `flattenRows` treats an unknown, self- or cyclic parent as
+     * a root, so a row can render at depth 0 while still carrying a `parentId` string. Trusting the
+     * field would have the resolver build a sibling list for a parent that is not on screen.
+     */
+    private readonly _reorderRows;
+    private readonly _reorder;
+    /** Id of the row being dragged, or `null`. */
+    readonly reorderDraggingId: _angular_core.WritableSignal<string | null>;
+    /** Absolute row-space `y` of the drop indicator, or `null` when no drag is live. */
+    readonly reorderIndicatorTop: _angular_core.Signal<number | null>;
+    onLabelRowPointerDown(ev: PointerEvent, id: string): void;
+    /** Whether `id` can become a child of the row above it (see `canIndentGanttRow`). */
+    canIndentRow(id: string): boolean;
+    /** Whether `id` can be lifted out of its parent — i.e. whether it has one. */
+    canOutdentRow(id: string): boolean;
+    /** Reactive twins for the currently selected row — what a magic-bar publisher binds to. */
+    readonly canIndentSelected: _angular_core.Signal<boolean>;
+    readonly canOutdentSelected: _angular_core.Signal<boolean>;
+    /** Make `id` a child of the row directly above it, if it has an eligible sibling there. */
+    indentRow(id: string): void;
+    /** Lift `id` out to its grandparent's level (`null` = the root). */
+    outdentRow(id: string): void;
     private _mapTicks;
+    /** Bridges the pure a11y label builder to this component's localizer + Date-typed geometry. */
     private _ariaFor;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyGanttComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyGanttComponent, "fly-gantt", never, { "rows": { "alias": "rows"; "required": false; "isSignal": true; }; "dependencies": { "alias": "dependencies"; "required": false; "isSignal": true; }; "zoom": { "alias": "zoom"; "required": false; "isSignal": true; }; "showToday": { "alias": "showToday"; "required": false; "isSignal": true; }; "readonly": { "alias": "readonly"; "required": false; "isSignal": true; }; "labelWidth": { "alias": "labelWidth"; "required": false; "isSignal": true; }; "resizableLabels": { "alias": "resizableLabels"; "required": false; "isSignal": true; }; "rowHeight": { "alias": "rowHeight"; "required": false; "isSignal": true; }; "maxRows": { "alias": "maxRows"; "required": false; "isSignal": true; }; "collapsedIds": { "alias": "collapsedIds"; "required": false; "isSignal": true; }; "overscanRows": { "alias": "overscanRows"; "required": false; "isSignal": true; }; "maxCanvasPx": { "alias": "maxCanvasPx"; "required": false; "isSignal": true; }; "virtualized": { "alias": "virtualized"; "required": false; "isSignal": true; }; "showBaselines": { "alias": "showBaselines"; "required": false; "isSignal": true; }; }, { "rowDatesChange": "rowDatesChange"; "dependencyCreate": "dependencyCreate"; "dependencyDelete": "dependencyDelete"; "rowClick": "rowClick"; "rowDblClick": "rowDblClick"; "labelWidthChange": "labelWidthChange"; "collapsedIdsChange": "collapsedIdsChange"; "rowExpand": "rowExpand"; "effectiveZoomChange": "effectiveZoomChange"; }, never, never, true, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyGanttComponent, "fly-gantt", never, { "rows": { "alias": "rows"; "required": false; "isSignal": true; }; "dependencies": { "alias": "dependencies"; "required": false; "isSignal": true; }; "zoom": { "alias": "zoom"; "required": false; "isSignal": true; }; "showToday": { "alias": "showToday"; "required": false; "isSignal": true; }; "readonly": { "alias": "readonly"; "required": false; "isSignal": true; }; "labelWidth": { "alias": "labelWidth"; "required": false; "isSignal": true; }; "resizableLabels": { "alias": "resizableLabels"; "required": false; "isSignal": true; }; "rowHeight": { "alias": "rowHeight"; "required": false; "isSignal": true; }; "maxRows": { "alias": "maxRows"; "required": false; "isSignal": true; }; "collapsedIds": { "alias": "collapsedIds"; "required": false; "isSignal": true; }; "overscanRows": { "alias": "overscanRows"; "required": false; "isSignal": true; }; "maxCanvasPx": { "alias": "maxCanvasPx"; "required": false; "isSignal": true; }; "virtualized": { "alias": "virtualized"; "required": false; "isSignal": true; }; "showBaselines": { "alias": "showBaselines"; "required": false; "isSignal": true; }; "searchable": { "alias": "searchable"; "required": false; "isSignal": true; }; "reorderable": { "alias": "reorderable"; "required": false; "isSignal": true; }; "searchQuery": { "alias": "searchQuery"; "required": false; "isSignal": true; }; }, { "searchQuery": "searchQueryChange"; "rowDatesChange": "rowDatesChange"; "dependencyCreate": "dependencyCreate"; "dependencyDelete": "dependencyDelete"; "rowClick": "rowClick"; "rowDblClick": "rowDblClick"; "labelWidthChange": "labelWidthChange"; "collapsedIdsChange": "collapsedIdsChange"; "rowExpand": "rowExpand"; "effectiveZoomChange": "effectiveZoomChange"; "rowReorder": "rowReorder"; "rowIndentChange": "rowIndentChange"; }, never, never, true, never>;
 }
 
-/** The 14 rendered field kinds. Drives the control the renderer picks. */
-type FlyFormQuestionType = 'Text' | 'MultilineText' | 'Number' | 'Email' | 'Date' | 'DateTime' | 'Boolean' | 'SingleSelect' | 'MultipleSelect' | 'RadioButton' | 'Country' | 'File' | 'MultiFile' | 'Image';
-/**
- * A selectable option on a choice field (SingleSelect / MultipleSelect /
- * RadioButton). `linkedQuestionIds` drive conditional branching: selecting this
- * option reveals those (branch-target) fields. `score` is author-only and is only
- * surfaced to the viewer when the host opts in via `[showScore]` (a scorecard);
- * a respondent-facing form leaves `showScore` false and never renders it.
- */
-interface FlyFormOption {
-    id: string;
-    label: string;
-    score?: number;
-    linkedQuestionIds?: string[];
-}
-/** Per-type constraints/affordances an author can attach to a field. */
-interface FlyFormFieldOptions {
-    minLength?: number;
-    maxLength?: number;
-    numericMin?: number;
-    numericMax?: number;
-    rows?: number;
-    maxFileSizeMb?: number;
-    maxFileCount?: number;
-    allowedExtensions?: string[];
-    hasSearch?: boolean;
-}
 /**
- * A single form field. `isBranchTarget` fields start hidden. `sectionId` /
- * `criteriaGroup` are additive grouping hints a scorecard uses; they are ignored
- * by the respondent-facing survey path, so binding them changes nothing there.
+ * App-level defaults for every {@link FlyGanttComponent} under a given injector.
+ *
+ * ## Why a token and not "just use the input"
+ * Every field here is already a per-instance `input()`, and for a one-off chart that is the right
+ * knob. But a planning app draws the SAME chart on four or five screens (a project plan, a
+ * schedule, a portfolio roadmap, a programme rollup), and the presentation decisions — how wide the
+ * label pane starts, how tall a row band is, whether the label pane is searchable — are properties
+ * of the APP, not of any one screen. Repeating them at every call site is how the fifth screen ends
+ * up with a 240px pane while the other four use 360, with no single place that says which is right.
+ *
+ * So: provide once at the app (or a feature-area) injector, override per instance where a screen
+ * genuinely differs. An explicit input ALWAYS wins over the token, and the token over the built-in
+ * default — the plain three-step precedence, stated once in `FlyGanttComponent`'s resolvers.
+ *
+ * ```ts
+ * // app.config.ts
+ * providers: [provideFlyGanttDefaults({ labelWidth: 360, searchable: true })]
+ * ```
+ *
+ * Every field is optional: a partial object overrides only what it names, so an app can move the
+ * label width without also inheriting an opinion about row height.
  */
-interface FlyFormQuestion {
-    id: string;
-    text: string;
-    description?: string;
-    type: FlyFormQuestionType;
-    required: boolean;
-    isBranchTarget: boolean;
-    /** Additive: an author-hidden field. `false` excludes it from the visible set (and thus from
-     *  required-enforcement); omitted / `true` renders as normal. Mirrors the backend `IsVisible`. */
-    isVisible?: boolean;
-    fieldOptions?: FlyFormFieldOptions;
-    options: FlyFormOption[];
-    /** Additive: groups fields into a visual section (scorecard). Ignored by surveys. */
-    sectionId?: string;
-    /** Additive: labels the weighted-criteria group a scored field belongs to. Ignored by surveys. */
-    criteriaGroup?: string;
-}
-/** A full form definition — the top-level `[definition]` binding. */
-interface FlyFormDefinition {
-    title: string;
-    description?: string;
-    declaration?: string;
-    questions: FlyFormQuestion[];
+interface FlyGanttDefaults {
+    /**
+     * Initial inline-start label-pane width in px, before the user drags the divider. Clamped into
+     * `[GANTT_LABEL_W_MIN, GANTT_LABEL_W_MAX]` like every other width source.
+     */
+    readonly labelWidth?: number;
+    /** Row band height in px. */
+    readonly rowHeight?: number;
+    /** Time-grid resolution a chart opens at. */
+    readonly zoom?: GanttZoom;
+    /** Render the label-pane search field (see `FlyGanttComponent.searchable`). */
+    readonly searchable?: boolean;
+    /** Allow dragging label rows to reorder them (see `FlyGanttComponent.reorderable`). */
+    readonly reorderable?: boolean;
 }
-/** How an opted-in `[showScore]` host renders a choice option's points. */
-type FlyFormScoreDisplay = 'inline' | 'badge';
 /**
- * The polymorphic answer payload for one field. Only the field(s) relevant to the
- * type are populated:
- * - text: Text / MultilineText / Email
- * - number: Number
- * - dateValue: Date / DateTime (raw `<input>` value string)
- * - boolValue: Boolean
- * - selectedOptionIds: SingleSelect / MultipleSelect / RadioButton / Country
- * - fileIds: File / MultiFile / Image (filled by the host after upload; this
- *   component emits it empty and surfaces the raw selection via `fileSelected`)
+ * DI token carrying {@link FlyGanttDefaults}. Optional everywhere — a chart with no provider falls
+ * back to the component's own built-in defaults, which is what every pre-existing consumer gets.
  */
-interface FlyFormAnswerValue {
-    text?: string;
-    number?: number;
-    dateValue?: string;
-    boolValue?: boolean;
-    selectedOptionIds?: string[];
-    fileIds?: string[];
-}
-/** One field's answer — the unit emitted by `answersChange` / `submit`. */
-interface FlyFormAnswer {
-    questionId: string;
-    value: FlyFormAnswerValue;
-}
+declare const FLY_GANTT_DEFAULTS: InjectionToken<FlyGanttDefaults>;
+/** Provider helper — `providers: [provideFlyGanttDefaults({ labelWidth: 360 })]`. */
+declare function provideFlyGanttDefaults(defaults: FlyGanttDefaults): Provider;
+
+/** Label-pane width bounds (px) the splitter clamps to. */
+declare const GANTT_LABEL_W_MIN = 140;
+declare const GANTT_LABEL_W_MAX = 720;
 /**
- * Raw file selection surfaced by File / MultiFile / Image fields. The host wires
- * this to its own upload API and, once ids are known, feeds them back via the
- * `[answers]` prefill (`fileIds`). The DS component never touches an upload endpoint.
+ * Width (px) a label pane opens at when neither the consumer's `labelWidth` input nor an app-level
+ * `FlyGanttDefaults` says otherwise.
+ *
+ * Raised from the original 240. A Gantt label is a full work-breakdown title, routinely carrying a
+ * prefix the consumer composed in (PPM puts the assignee's initials on every task row and a weight
+ * suffix on every milestone), and at 240px the ellipsis landed inside the NAME for a majority of
+ * real rows — which turns the pane into a list of indistinguishable truncations rather than a
+ * readable outline. It remains an INITIAL value only: the divider drag, the keyboard resize and
+ * `resetLabelWidth()` all behave exactly as before.
  */
-interface FlyFileSelection {
-    questionId: string;
-    files: File[];
-}
+declare const GANTT_LABEL_W_DEFAULT = 320;
 
-/** A render segment: either an ungrouped field (`group === null`) or a titled `criteriaGroup` section.
- *  `index` is the field's running position across the whole form (drives unique element ids). */
-interface FlyFormFieldGroup {
-    group: string | null;
-    items: {
-        q: FlyFormQuestion;
-        index: number;
-    }[];
-}
 /**
- * **`fly-dynamic-form`** — the design-system data-contract-driven form renderer.
- *
- * Renders a {@link FlyFormDefinition} (14 field types) into an accessible,
- * theme-aware form, owning all the fiddly behaviour a form needs: conditional
- * **branching** (options reveal branch-target fields), per-visible-field
- * **required validation**, a **declaration** acceptance gate, and a **readonly**
- * replay mode. It is a platform surface — zero coupling to any specific app, and
- * (deliberately) no coupling to an upload API: File / Image / MultiFile fields
- * surface the raw selection via {@link fileSelected} and emit `fileIds` empty; the
- * host wires the upload and feeds ids back through the `[answers]` prefill.
+ * Magic-bar contribution contract (UX v2 "Nova", D5 §4).
  *
- * The historical **`fly-survey-form`** selector is retained on this same component
- * (multi-selector), so every existing `<fly-survey-form>` binding keeps working
- * unchanged. Surveys never sets {@link showScore}, so its behaviour (never rendering
- * `option.score`) is identical. A scorecard host opts into score display with
- * `[showScore]="true"`.
+ * The magic bar is the shell's top-bar toolbar pill. Unlike the fixed right
+ * cluster (Help / Tasks / Notifications / assistant orb — shell-owned, an app can
+ * never remove it), the pill's contents belong to **whatever view the user is
+ * looking at**, and the design's reference implementation re-publishes the whole
+ * set on every selection, tab and save (`pubTabActions`). Two consequences shape
+ * every type below:
  *
- * i18n is self-sufficient through the `form.*` keys in `DS_BASELINE_LOCALES`
- * (en/ar/fr/ur), overridable by any consumer key of the same name. RTL works via
- * logical CSS. Styling uses DS theme tokens (`--surface-*`, `--label-*`,
- * `--separator`, `--fill-*`, `--accent`, `--system-*`) with light-neutral
- * fallbacks so it stays readable even in a consumer that hasn't mapped them.
+ *  1. **A contribution is a full replace, never a patch.** There is no "add one
+ *     action" call, because the publisher never knows what the previous view left
+ *     behind. That also collapses D5's `search: null` ("suppress") vs `search`
+ *     absent distinction — under full replace both simply mean "this view offers
+ *     no search".
+ *  2. **Render data and behaviour are separated in the type system.** Each family
+ *     has a `*Spec` base carrying ONLY the fields that affect what is painted;
+ *     the publisher-facing type extends it with callbacks, and the shell-facing
+ *     `*View` type extends it with bound invokers. The base IS the equality
+ *     surface {@link MagicBarRegistry} dedupes on — a re-publish whose specs are
+ *     unchanged must not disturb the shell, even though its closures are brand
+ *     new objects every time (an arrow function in a component method never
+ *     compares equal to its predecessor). See `magic-bar-projection.ts`.
  *
- * @example
- * ```html
- * <fly-dynamic-form
- *   [definition]="def"
- *   [answers]="prefill"
- *   [showScore]="true"
- *   (answersChange)="draft = $event"
- *   (validityChange)="valid = $event"
- *   (fileSelected)="upload($event)"
- *   (submit)="persist($event)" />
- * ```
+ * **Strings are i18n keys, never resolved text** — same rule as
+ * {@link AgentCommandRegistration} (`labelKey` / `descriptionKey` / `hintKey`),
+ * for the same two reasons: a contribution outlives a locale switch (a resolved
+ * label would silently go stale until the publisher happened to re-publish), and
+ * keys are locale-invariant so the dedupe fingerprint doesn't churn when the user
+ * changes language. Keys resolve in the OWNING app's bundle.
+ *
+ * **Every `*Key` has an optional `*Params` sibling** ({@link MagicBarTextParams}),
+ * fed straight to `I18nService.t(key, params)`. Without it a count-carrying string
+ * ("Search 1,204 tasks…") forces the publisher to pass pre-formatted TEXT as the
+ * key: it renders correctly in `en`, renders identically untranslated in ar/fr/ur,
+ * and no locale tool can see it. Params participate in the dedupe fingerprint, so
+ * a changing count re-paints.
+ *
+ * Which of D5 §4's "dynamics the shell must honor" live where:
+ *
+ * | # | Dynamic | Owner |
+ * |---|---|---|
+ * | 1 | Live re-publication, idempotent replace | {@link MagicBarRegistry} (here) |
+ * | 2 | Disabled ≠ hidden, auto disabled-tooltip | contract keeps `disabled` rows; `fly-magic-actions` renders + suffixes |
+ * | 3 | `toolbarPopIn` 40 ms stagger | renderer — it tracks on {@link MagicBarActionSpec.id}, which is why ids are unique across the WHOLE contribution |
+ * | 4 | i18n on every label/tip | contract (keys + params, above) |
+ * | 5 | Fixed right cluster is not contributable | contract — no slot exists for it |
+ * | 6 | Mobile renders the same contribution | contract carries no form-factor branch; `openWidth` is a desktop hint mobile ignores |
+ * | 7 | `shortcut` reserved (design has no shortcut affordance yet) | contract — carried, unrendered |
+ *
+ * On dynamic 3 specifically: the registry's dedupe does NOT stop the stagger
+ * replaying, and believing it does would produce a renderer that re-animates on
+ * every click. Dedupe fires only when *nothing painted* changed, and the dominant
+ * case — `disabled: !hasSelection` — changes the fingerprint on every selection.
+ * What holds the DOM still is the renderer's `@for (…; track item.id)`.
  */
-declare class FlyDynamicFormComponent implements OnInit {
-    private readonly _i18n;
-    /** The form to render. */
-    readonly definition: _angular_core.InputSignal<FlyFormDefinition>;
-    /** Replay mode — every control is disabled and no validation errors / submit show.
-     *  Aliased to `[readonly]` (the public binding); the class member avoids shadowing
-     *  the TypeScript `readonly` keyword. */
-    readonly isReadonly: _angular_core.InputSignal<boolean>;
-    /** Hides the submit button while leaving every control interactive — the author's
-     *  pre-publish PREVIEW, which must let you open dropdowns and try the form out but has
-     *  nothing to submit to. Distinct from `readonly`, which disables the controls outright
-     *  (a submission replay). A host that hides submit should not bind `(submit)`. */
-    readonly hideSubmit: _angular_core.InputSignal<boolean>;
-    /** Prefill answers (e.g. a saved draft or a completed response). Answers for
-     *  currently-hidden branch targets are ignored. */
-    readonly answers: _angular_core.InputSignal<readonly FlyFormAnswer[]>;
-    /** Additive, opt-in: render each choice option's `score` (a weighted scorecard).
-     *  Defaults false so the respondent-facing survey path never leaks the answer key. */
-    readonly showScore: _angular_core.InputSignal<boolean>;
-    /** How an opted-in score is rendered next to an option (`badge` chip or `inline` text). */
-    readonly scoreDisplay: _angular_core.InputSignal<FlyFormScoreDisplay>;
-    /** The full visible answer set on every change. */
-    readonly answersChange: _angular_core.OutputEmitterRef<FlyFormAnswer[]>;
-    /** Required-field validity on every change (does NOT include the declaration gate). */
-    readonly validityChange: _angular_core.OutputEmitterRef<boolean>;
-    /** Fires only when the form is valid AND (if a declaration is set) accepted. */
-    readonly submit: _angular_core.OutputEmitterRef<FlyFormAnswer[]>;
-    /** Raw file selection for a File / MultiFile / Image field — the host uploads
-     *  and feeds the resulting ids back via `[answers]`. */
-    readonly fileSelected: _angular_core.OutputEmitterRef<FlyFileSelection>;
-    private readonly _base;
-    /** questionId → answer value. Only ever contains VISIBLE, non-empty answers. */
-    private readonly _values;
-    /** questionId → locally-picked File[] (transient, pre-upload). Never emitted as ids. */
-    private readonly _fileSelections;
-    private readonly _declarationAccepted;
-    private readonly _submitAttempted;
-    /** questionIds the user has interacted with — gates when a required error shows. */
-    private readonly _interacted;
-    /** Per-field local file-validation error message (already localized). */
-    private readonly _fileErrors;
-    private readonly _countryOptions;
-    constructor();
-    ngOnInit(): void;
-    /** The set of field ids currently shown (base fields + revealed branch targets). */
-    readonly visibleQuestionIds: _angular_core.Signal<Set<string>>;
-    /** Definition fields filtered to the visible set, in definition order. */
-    readonly visibleQuestions: _angular_core.Signal<FlyFormQuestion[]>;
+/**
+ * How an action paints. `'text'` is the labelled-pill form (calendar's "Today").
+ *
+ * `kind` and {@link MagicBarActionSpec.iconPath} are INDEPENDENT, and the three useful
+ * combinations are all reachable:
+ *
+ * | `kind` | `iconPath` | Paints |
+ * |---|---|---|
+ * | absent / `'icon'` | set | icon only — the default, for a verb with a universally-read glyph |
+ * | `'text'` | absent | label only — for a value with no honest glyph ("Shortlisted", "Deferred") |
+ * | `'text'` | set | **icon + label** — for a verb whose glyph needs naming ("Promote to schedule") |
+ *
+ * Prefer icon-only for the small set of verbs a user reads without help — add, edit, delete, close,
+ * save. Anything else earns its label: an unlabelled glyph the reader has to hover to identify is a
+ * quiz, and the tooltip is not an answer on touch.
+ */
+type MagicBarActionKind = 'icon' | 'text' | 'toggle';
+/**
+ * Semantic colour of an action. `'danger'` is the red Delete treatment (red glyph
+ * + red 18 % hover tint, D7); `'success'` is the green "Mark as complete" pressed
+ * state (D5 §1.4 + §4 prop table: "pressed bg tint-sel / green for complete").
+ *
+ * A union rather than the boolean `danger` this started as: the design already
+ * demands a second colour, and widening a shipped `danger?: boolean` into a union
+ * later would mean REMOVING an interface member — MAJOR under `tools/ds-compat`
+ * (rule 7), which forks the federation singleton for every remote.
+ */
+type MagicBarTone = 'default' | 'danger' | 'success';
+/**
+ * Interpolation params for one i18n key — the `params` argument of
+ * `I18nService.t(key, params)`, substituting `{{name}}` placeholders.
+ *
+ * Values are `string | number` only: the fingerprint has to encode them, and the
+ * renderer resolves them through `t()`, which stringifies. A `Date` or a nested
+ * object would fingerprint as `{}` and paint as `[object Object]`.
+ */
+type MagicBarTextParams = Readonly<Record<string, string | number>>;
+/**
+ * Identity of a contribution's publisher, and the arbitration key the shell uses
+ * to pick which contribution the bar renders.
+ *
+ * `windowId` is optional but strongly preferred: two windows of the same app can
+ * be open on different selections, and keying on `appId` alone would let the
+ * background one paint the focused one's toolbar. It is optional only because a
+ * federated remote that predates per-window plumbing can still contribute —
+ * {@link MagicBarRegistry} resolves an `appId`-keyed slot as a fallback.
+ *
+ * It only has to be unique **within the publishing app** (the shell passes its own
+ * `win-<appId>-<timestamp>` window id; a tab index or a route-derived id is equally
+ * valid) — {@link magicBarOwnerKey} scopes it by `appId`, so a value another app
+ * also uses can never cross over.
+ */
+interface MagicBarOwnerRef {
+    readonly appId: string;
+    readonly windowId?: string;
+}
+/**
+ * Storage/arbitration key for an owner. Exported because the shell computes it
+ * on the janitor path (`clear` after a window closes) without holding the
+ * publisher.
+ *
+ * **Both fields key the slot**, even though the shell's own ids
+ * (`win-<appId>-<timestamp>`) are already unique. `windowId` is publisher-supplied
+ * DATA that crosses the federation boundary, and the field is documented only as
+ * "two windows of the same app" — nothing stops a remote passing a tab index or a
+ * route-derived id. Keyed on `windowId` alone, two apps that both call their first
+ * window `"1"` would share a slot: one silently paints the other's chrome, and the
+ * shell's janitor `clear()` wipes the wrong one.
+ */
+declare function magicBarOwnerKey(owner: MagicBarOwnerRef): string;
+/** One `menuitemradio` row. `value` is the publisher's own vocabulary. */
+interface MagicBarRadioOption {
+    readonly value: string;
     /**
-     * The visible fields laid out in render order, segmented by `criteriaGroup`: fields that share a
-     * (non-empty) group render together inside one titled section (a scorecard's weighted-criteria
-     * grouping); a field with no `criteriaGroup` is its own ungrouped segment and renders flat, exactly
-     * as before. Each item keeps its running index across the whole form so element ids stay unique.
+     * i18n key for this row. Required, and it stays required — the overwhelming case is a fixed
+     * vocabulary (statuses, sort orders) that MUST translate. When {@link label} is supplied this
+     * is the accessible fallback used if the row's data-derived text is ever empty, so give it a
+     * generic key ("Untitled") rather than inventing a per-value one.
      */
-    readonly groupedQuestions: _angular_core.Signal<FlyFormFieldGroup[]>;
-    readonly declarationRequired: _angular_core.Signal<boolean>;
-    /** Required-field validity (declaration NOT included — see {@link canSubmit}). */
-    readonly isValid: _angular_core.Signal<boolean>;
-    /** Whether `(submit)` may fire: valid required set AND declaration accepted (if any). */
-    readonly canSubmit: _angular_core.Signal<boolean>;
-    readonly declarationAccepted: _angular_core.Signal<boolean>;
-    fieldId(index: number): string;
-    descId(index: number): string;
-    errId(index: number): string;
-    describedBy(q: FlyFormQuestion, index: number): string | null;
-    isChoice(type: FlyFormQuestionType): boolean;
-    isFile(type: FlyFormQuestionType): boolean;
-    /** Types rendered as a native input group inside `<fieldset><legend>`. */
-    isFieldset(type: FlyFormQuestionType): boolean;
-    isCountry(type: FlyFormQuestionType): boolean;
+    readonly labelKey: string;
+    /** Params for {@link labelKey} — the count-badged option ("All statuses ({{count}})"). */
+    readonly labelParams?: MagicBarTextParams;
     /**
-     * Types rendered with the DS `<fly-select>` (labelled via `ariaLabel`).
+     * ALREADY-RESOLVED display text, for a row whose label is TENANT DATA rather than a caption —
+     * a campaign name, an area of focus, an owner. When present it wins over {@link labelKey}.
      *
-     * Every select-like type now qualifies. `hasSearch` used to gate the CONTROL, which left a plain
-     * SingleSelect on a native `<select>` — an OS-chrome popup that cannot be themed (it paints its
-     * rows with the control's translucent background over a white backing, so the list rendered
-     * white-on-white on the dark shell). `hasSearch` now only decides whether the DS panel carries a
-     * search box; see {@link selectSearchable}.
+     * ## Why this had to exist
+     * Everything else in this contract is an i18n key, deliberately (see the module header). But a
+     * key can only name a string the APP ships in its locale bundles, and a tenant's campaign names
+     * are rows in their database. Without this field a publisher had exactly two bad options: put
+     * the name in `labelKey`, which renders correctly in `en`, renders identically untranslated in
+     * ar/fr/ur, and is invisible to every locale tool; or leave the filter out of the bar entirely.
+     * Thoughts' `top-trending` chose the second and kept its campaign/area filters in-page — that
+     * is the gap this closes.
+     *
+     * ## What it does NOT license
+     * Do not use it for captions. If the string is something your app authored — "All statuses",
+     * "Newest first", an action name — it belongs in a locale bundle and `labelKey` is the field.
+     * The test is where the string comes from: shipped with the app ⇒ `labelKey`; read from the
+     * tenant's data ⇒ `label`. A resolved caption here is untranslatable text smuggled past the
+     * locale tooling, which is precisely what the key-only rule exists to prevent.
+     *
+     * It participates in the dedupe fingerprint, so a renamed campaign repaints.
      */
-    usesDsSelect(q: FlyFormQuestion): boolean;
-    /** Search box: always for Country (the list is ~200 long), else only when the author asked. */
-    selectSearchable(q: FlyFormQuestion): boolean;
+    readonly label?: string;
+}
+/** Render surface of a radio menu — the dedupe key for {@link MagicBarRadioMenu}. */
+interface MagicBarRadioMenuSpec {
+    /** Eyebrow above the options ("Filter by status" / "Sort by"). */
+    readonly titleKey: string;
+    /** Params for {@link titleKey}. */
+    readonly titleParams?: MagicBarTextParams;
+    readonly options: readonly MagicBarRadioOption[];
+    /** Current selection — check glyph + 600 weight on the matching row. */
+    readonly value: string;
+    /** The unfiltered/unsorted baseline; the trigger shows its accent dot iff `value !== defaultValue`. */
+    readonly defaultValue: string;
+}
+/** What a publisher supplies for a radio menu. */
+interface MagicBarRadioMenu extends MagicBarRadioMenuSpec {
+    readonly onSelect?: (value: string) => void;
+}
+/** What the shell renders. `select` always exists; it no-ops when the publisher supplied no handler. */
+interface MagicBarRadioMenuView extends MagicBarRadioMenuSpec {
+    select(value: string): void;
+}
+/**
+ * Render surface of an action — the dedupe key for {@link MagicBarAction}.
+ *
+ * `id` must be unique across the WHOLE contribution (every group, plus `primary`
+ * and `overflow`), not merely within its group: it is the address the shell's
+ * invoker resolves against the publisher's latest handlers.
+ */
+interface MagicBarActionSpec {
+    readonly id: string;
+    /** i18n key — the `aria-label` and the default tooltip. */
+    readonly labelKey: string;
+    /** Params for {@link labelKey}, e.g. `{ count: 3 }` for "Delete {{count}} items". */
+    readonly labelParams?: MagicBarTextParams;
     /**
-     * The points to show for a choice option, or null to render nothing. Non-null only when the host
-     * opted in via `[showScore]` and the option actually carries a score — this is the sole gate that
-     * keeps a respondent-facing survey (which never binds `showScore`) from leaking the answer key.
+     * Inner-SVG geometry for a 24×24 glyph (`stroke-width: 1.8`, round caps) —
+     * the design's icon transport. Reference {@link FLY_MAGIC_BAR_ICONS} by name
+     * rather than hand-authoring; a publisher MAY author its own, subject to the
+     * contract below.
+     *
+     * **This value is not trusted.** The renderer parses it against a closed
+     * allowlist — self-closing `path`/`circle`/`rect`/`ellipse`/`line`/`polyline`/
+     * `polygon` elements carrying geometry attributes only (`d`, `cx`, `points`,
+     * …) — and binds the result as real attributes. It is never assigned as HTML.
+     * Anything else (a container element, an `on*` handler, `style`, `href`,
+     * `fill="url(…)"`, a stray text node) rejects the WHOLE fragment: the button
+     * renders with no glyph and logs. See `magic-actions-icon.ts`.
+     *
+     * The type stays `string` deliberately. Narrowing it to a branded/opaque type
+     * would be a ds-compat MAJOR, and it would not buy anything the renderer's own
+     * validation does not already guarantee — a nominal type describes where a
+     * value came from, not what it contains.
      */
-    optionScore(opt: FlyFormOption): number | null;
-    /** Whether a required error should be visible for a field right now. */
-    showError(q: FlyFormQuestion): boolean;
-    fileError(q: FlyFormQuestion): string | null;
-    textValue(q: FlyFormQuestion): string;
-    numberValue(q: FlyFormQuestion): number | null;
-    dateValue(q: FlyFormQuestion): string;
-    boolValue(q: FlyFormQuestion): boolean | null;
-    singleValue(q: FlyFormQuestion): string | null;
-    isSelected(q: FlyFormQuestion, optionId: string): boolean;
-    countryOptions(q: FlyFormQuestion): readonly FlySelectOption[];
-    selectOptions(q: FlyFormQuestion): readonly FlySelectOption[];
-    fileNames(q: FlyFormQuestion): string[];
-    acceptFor(q: FlyFormQuestion): string;
-    onText(q: FlyFormQuestion, value: string): void;
-    onNumber(q: FlyFormQuestion, value: string): void;
-    onDate(q: FlyFormQuestion, value: string): void;
-    onBoolean(q: FlyFormQuestion, value: boolean): void;
-    onSingleSelect(q: FlyFormQuestion, value: string | readonly string[] | null): void;
-    onRadio(q: FlyFormQuestion, optionId: string): void;
-    onMultiToggle(q: FlyFormQuestion, optionId: string, checked: boolean): void;
-    onFiles(q: FlyFormQuestion, input: HTMLInputElement): void;
-    onDeclarationToggle(checked: boolean): void;
-    onSubmit(): void;
-    private _touch;
-    private _setFileError;
-    private _mutate;
-    private _emit;
-    private _collectAnswers;
-    private _isAnswered;
-    private _isEmptyValue;
-    private _selectedIds;
+    readonly iconPath?: string;
+    /** Default `'icon'`. */
+    readonly kind?: MagicBarActionKind;
+    /** Dimmed (`opacity .38`), NEVER hidden — a vanishing action teaches the user nothing. */
+    readonly disabled?: boolean;
     /**
-     * The set of visible field ids for a given answer map. Base (non-branch-target)
-     * fields are always visible; a branch target becomes visible when a
-     * currently-visible field has a selected option that links to it. Computed to a
-     * fixpoint so chained reveals work, and cycle-safe: the visible set only grows and
-     * iteration is capped at `questions.length` passes, so an A↔B link cycle terminates.
+     * Tooltip override while disabled. Absent is the normal case: the renderer
+     * auto-suffixes the resolved label ("… — select an item first"). Resolution
+     * and the connector phrasing are the renderer's job precisely because they are
+     * locale work, and this store holds keys rather than text.
+     */
+    readonly disabledTipKey?: string;
+    /** Params for {@link disabledTipKey}. */
+    readonly disabledTipParams?: MagicBarTextParams;
+    /**
+     * Mirror the glyph horizontally under `dir="rtl"`.
      *
-     * This is the TypeScript twin of the backend Fly.Sdk.Forms `BranchResolver`
-     * fixpoint — the two must stay in lockstep so server + client agree on which fields
-     * are active.
+     * Most marks in {@link FLY_MAGIC_BAR_ICONS} are direction-neutral — a trash can, a gear, a
+     * calendar grid read the same in every locale, and mirroring them would be wrong. A minority
+     * encode a DIRECTION as their meaning: indent/outdent, promote (an up-and-right arrow), a
+     * next/previous chevron, an export tray. Those are mirrored by every RTL desktop application
+     * there is, and left unmirrored they point at the wrong edge of the screen in `ar` and `ur` —
+     * three of this platform's four locales.
+     *
+     * Opt-in rather than automatic because no property of the geometry distinguishes the two
+     * groups: only the publisher knows whether its arrow means "forward" (mirror) or "north-east"
+     * (do not). Defaults to `false`, so every glyph shipped before this field existed paints exactly
+     * as it did.
+     *
+     * It flips only the ICON. The button, its label and the bar's own item order already mirror
+     * through logical CSS properties — see `magic-actions.component.scss`'s header.
      */
-    private _computeVisibleIds;
-    /** Imperative localization for file-validation messages (the pipe covers view strings). */
-    private _t;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyDynamicFormComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyDynamicFormComponent, "fly-dynamic-form, fly-survey-form", never, { "definition": { "alias": "definition"; "required": true; "isSignal": true; }; "isReadonly": { "alias": "readonly"; "required": false; "isSignal": true; }; "hideSubmit": { "alias": "hideSubmit"; "required": false; "isSignal": true; }; "answers": { "alias": "answers"; "required": false; "isSignal": true; }; "showScore": { "alias": "showScore"; "required": false; "isSignal": true; }; "scoreDisplay": { "alias": "scoreDisplay"; "required": false; "isSignal": true; }; }, { "answersChange": "answersChange"; "validityChange": "validityChange"; "submit": "submit"; "fileSelected": "fileSelected"; }, never, never, true, never>;
-}
-
-interface FlyCountry {
-    /** ISO 3166-1 alpha-2 code (uppercase), e.g. `AE`. */
-    code: string;
-    /** English display name. */
-    name: string;
+    readonly mirrorInRtl?: boolean;
+    /** Tooltip override while enabled. Absent → the renderer uses `labelKey`. */
+    readonly tipKey?: string;
+    /** Params for {@link tipKey}. */
+    readonly tipParams?: MagicBarTextParams;
+    /**
+     * Semantic colour. Default `'default'`; `'danger'` is the ONLY thing that makes
+     * an icon red (D7), `'success'` the green completed-toggle treatment.
+     */
+    readonly tone?: MagicBarTone;
+    /** `aria-pressed` for `kind: 'toggle'`. */
+    readonly pressed?: boolean;
+    /** Small accent dot — a non-default filter/sort is active. */
+    readonly badgeDot?: boolean;
+    /**
+     * Reserved (D5 §4 item 7). The designs carry no keyboard-shortcut affordance
+     * anywhere; the field exists so adding one later is a renderer change rather
+     * than a contract break. Nothing renders it today.
+     */
+    readonly shortcut?: string;
 }
-/** Frozen alpha-2 list, alphabetical by English name. */
-declare const FLY_COUNTRIES: readonly FlyCountry[];
-
-/** Backend `CommentReportReason` enum — string-persisted, member names frozen. */
-type FlyCommentReportReason = 'Spam' | 'Harassment' | 'OffTopic' | 'Misinformation' | 'Inappropriate' | 'Other';
-/** Backend `CommentReportStatus` enum — string-persisted, member names frozen. */
-type FlyCommentReportStatus = 'Open' | 'UnderReview' | 'ActionTaken' | 'Dismissed';
-/**
- * One comment, at any depth. `isDeleted` comments render as a tombstone (the
- * host still supplies `body`-less structural fields so the reply subtree stays
- * navigable; the component never assumes `body` is present when `isDeleted`).
- * `canEdit` / `canDelete` / `canModerate` are pre-resolved by the host (Cerbos
- * decision or equivalent) — the component never evaluates authorization itself.
- */
-interface FlyComment {
-    id: string;
-    authorUserId: string;
-    authorDisplayName?: string;
-    authorAvatarUrl?: string;
-    parentCommentId?: string;
-    depth: number;
-    body: string;
-    replyCount: number;
-    isEdited: boolean;
-    isDeleted: boolean;
-    createdAt: string;
-    updatedAt?: string;
-    canEdit: boolean;
-    canDelete: boolean;
-    canModerate: boolean;
+/** What a publisher supplies for one action. */
+interface MagicBarAction extends MagicBarActionSpec {
+    readonly menu?: MagicBarRadioMenu;
+    /**
+     * Invoked on activation. The argument is the DOM element the renderer painted
+     * for this action — see {@link MagicBarActionView.run} for why it is passed and
+     * what a publisher may do with it. Ignore it and this is the zero-argument
+     * handler it has always been.
+     */
+    readonly onSelect?: (trigger?: HTMLElement) => void;
 }
 /**
- * A paged slice of comments at one nesting level — mirrors the service's
- * `GET .../comments?parentCommentId=&page=&pageSize=` shape. Every depth is
- * paged independently: the root page and each expanded parent's reply page are
- * separate {@link FlyCommentPage} instances tracked by the host.
+ * What the shell renders. `run()` always exists and always dispatches to the
+ * publisher's LATEST handler for this id — including after a re-publish the
+ * registry deliberately did not propagate (see `magic-bar-projection.ts`).
  */
-interface FlyCommentPage {
-    items: FlyComment[];
-    page: number;
-    pageSize: number;
-    total: number;
-    hasMore: boolean;
-}
-/** `loadReplies` request — expand a collapsed reply subtree, one page at a time. */
-interface FlyCommentLoadRepliesRequest {
-    parentCommentId: string;
-    page: number;
-}
-/** `loadMore` request — next page at the root level (`parentCommentId` omitted) or under a parent. */
-interface FlyCommentLoadMoreRequest {
-    parentCommentId?: string;
-    page: number;
-}
-/** `submit` request — a new root comment (`parentCommentId` omitted) or a reply. */
-interface FlyCommentSubmitRequest {
-    body: string;
-    parentCommentId?: string;
-}
-/** `edit` request — author-only body edit of an existing comment. */
-interface FlyCommentEditRequest {
-    commentId: string;
-    body: string;
+interface MagicBarActionView extends MagicBarActionSpec {
+    readonly menu: MagicBarRadioMenuView | null;
+    /**
+     * Fire the publisher's newest handler for this id.
+     *
+     * ## Why it carries the trigger element
+     * An action that opens a POPOVER the publisher owns — the canonical case is a
+     * listing screen's advanced-filter panel — has to position that popover under
+     * the button the user just pressed. The publisher cannot find that button:
+     * embedded, it is painted by `fly-magic-actions` inside the shell's top-bar
+     * pill, in the shell's DOM, several stacking contexts and one federation
+     * boundary away from the remote that published the action. Before this argument
+     * existed, PPM's projects register had to anchor its panel to its own page
+     * header instead, which put the panel in the middle of the window while the
+     * button that opened it sat in the chrome above — an affordance with no visible
+     * relationship to its own trigger.
+     *
+     * Passing the element rather than modelling the popover is deliberate. The
+     * panel's CONTENT is app schema (see {@link MagicBarSearch.onOpenFilters} for
+     * the same ruling), so it must stay in the publisher's own DOM and injection
+     * context; only its POSITION is chrome-relative. An element reference crosses
+     * the federation boundary without any of the coupling a descriptor would need —
+     * a DOM node is a DOM node in every bundle. `fly-filter-panel`'s `[anchorEl]`
+     * is the intended consumer.
+     *
+     * ## What a publisher must not assume
+     * The element is the trigger AS PAINTED RIGHT NOW. It is valid for the duration
+     * of the popover, not beyond: a re-publish that drops this action id destroys it
+     * (`@for (…; track action.id)`), and a mode switch repaints it in a different
+     * chrome entirely. Hold it in a signal the popover's open-state clears, never in
+     * long-lived state, and never mutate it.
+     *
+     * It is OPTIONAL because not every renderer has one to give — a keyboard-driven
+     * invocation, a synthetic call in a test, an inline composer that paints no
+     * button. A publisher that receives `undefined` must still work: for a popover
+     * that means falling back to its own in-page anchoring, which is exactly what
+     * `fly-filter-panel` does when `[anchorEl]` is null.
+     */
+    run(trigger?: HTMLElement): void;
 }
-/** `delete` request — soft delete (tombstone), author or moderator. */
-interface FlyCommentDeleteRequest {
-    commentId: string;
+/** Render surface of a group — the dedupe key for {@link MagicBarGroup}. */
+interface MagicBarGroupSpec {
+    readonly id: string;
+    /** i18n key for the `role="group"` aria-label ("Signal actions"). */
+    readonly labelKey: string;
+    /** Framed variant: 2 px gaps + a trailing separator. Plain (default) uses 8 px gaps. */
+    readonly framed?: boolean;
 }
-/** `report` request — typed reason + optional free-text detail. */
-interface FlyCommentReportRequest {
-    commentId: string;
-    reason: FlyCommentReportReason;
-    detail?: string;
+interface MagicBarGroup extends MagicBarGroupSpec {
+    readonly items: readonly MagicBarAction[];
 }
-/** `lockToggle` request — moderator lock/unlock of the whole thread. */
-interface FlyCommentLockToggleRequest {
-    locked: boolean;
+interface MagicBarGroupView extends MagicBarGroupSpec {
+    readonly items: readonly MagicBarActionView[];
 }
-
 /**
- * **`fly-comment-thread`** — the design-system generic threaded-comments renderer.
- *
- * Renders a {@link FlyCommentPage} (root comments) plus lazily-fetched nested
- * reply pages into an accessible, theme-aware thread: reply composer, inline
- * edit, soft-delete (tombstone render), typed report-with-reason dialog, and
- * moderator affordances (lock/unlock, delete-any). It is a platform surface —
- * transport-agnostic like `fly-survey-form` / `fly-dynamic-form`: this component
- * never calls an API. It only renders the pages the host hands it via
- * `[rootPage]` / `[repliesByParent]` and emits typed requests
- * (`loadReplies`/`loadMore`/`submit`/`edit`/`delete`/`report`/`lockToggle`) —
- * the host owns HTTP, optimistic-insert reconciliation, and any live-update
- * channel (SignalR, polling, …).
- *
- * Nested replies are fetched **lazily on expand** (`loadReplies`, never an
- * eager load-all) — the explicit fix for the legacy unpaged-children scale bug
- * — and each level pages independently via `loadMore`.
- *
- * The `comments` core app owns no user profile data, so `FlyComment` carries
- * `authorUserId` and an OPTIONAL `authorDisplayName`. Rather than make every host
- * map names in itself (and render GUIDs when it forgets), bind
- * `[resolveDisplayName]` to `FlyUserDirectoryService.label` — see
- * {@link FlyCommentThreadComponent.resolveDisplayName}. Still transport-agnostic:
- * the resolver is a function the host hands over, not a call this component makes.
- *
- * i18n is self-sufficient through the `comment.*` keys in `DS_BASELINE_LOCALES`
- * (en/ar/fr/ur), overridable by any consumer key of the same name. RTL works via
- * logical CSS. Styling uses DS theme tokens (`--surface-*`, `--label-*`,
- * `--separator`, `--fill-*`, `--accent`, `--system-*`) with light-neutral
- * fallbacks so it stays readable even in a consumer that hasn't mapped them.
+ * Render surface of the expanding search field — the dedupe key for
+ * {@link MagicBarSearch}.
  *
- * @example
- * ```html
- * <fly-comment-thread
- *   [rootPage]="rootPage()"
- *   [repliesByParent]="repliesByParent()"
- *   [currentUserId]="me.id"
- *   [resolveDisplayName]="directory.label"
- *   [canModerateThread]="canModerate()"
- *   [isLocked]="thread().isLocked"
- *   (loadReplies)="onLoadReplies($event)"
- *   (loadMore)="onLoadMore($event)"
- *   (submit)="onSubmit($event)"
- *   (edit)="onEdit($event)"
- *   (delete)="onDelete($event)"
- *   (report)="onReport($event)"
- *   (lockToggle)="onLockToggle($event)" />
- * ```
+ * This is a per-page typeahead, NOT a command palette: neither design package
+ * has a global ⌘K surface, and the only "command" affordance is the Ask-AI menu.
  */
-declare class FlyCommentThreadComponent {
-    /** The root-level comment page (accumulated across `loadMore` calls by the host). */
-    readonly rootPage: _angular_core.InputSignal<FlyCommentPage>;
-    /**
-     * Accumulated reply page per expanded parent (keyed by `parentCommentId`), also
-     * accumulated across `loadMore` calls by the host. Additive to the frozen
-     * contract's `rootPage` input — required because a lazily-nested tree has no
-     * other channel to carry fetched reply data back into the component.
-     */
-    readonly repliesByParent: _angular_core.InputSignal<Readonly<Record<string, FlyCommentPage>>>;
-    /** Current sort order label (host owns re-fetch on {@link sortChange}; purely descriptive here otherwise). */
-    readonly sort: _angular_core.InputSignal<"newest" | "oldest">;
-    /** Locked threads disable the composer (root + reply) entirely, for every user. */
-    readonly isLocked: _angular_core.InputSignal<boolean>;
-    /** The signed-in user's id — gates the "report" affordance (can't report your own comment). */
-    readonly currentUserId: _angular_core.InputSignal<string | null>;
-    /** Replay / read-only mode — hides composer, reply, edit, delete, report, and lock affordances.
-     *  Aliased to `[readonly]` (the public binding); the class member avoids shadowing the
-     *  TypeScript `readonly` keyword. */
-    readonly isReadonly: _angular_core.InputSignal<boolean>;
-    /** Thread-scoped moderator permission (lock/unlock). Additive — distinct from the
-     *  per-comment `canModerate` flag, which gates delete-any on that specific comment. */
-    readonly canModerateThread: _angular_core.InputSignal<boolean>;
+interface MagicBarSearchSpec {
+    /** Context-aware placeholder key ("Search tasks…", "Search events…"). */
+    readonly placeholderKey: string;
+    /** Params for {@link placeholderKey}, e.g. `{ count: 1204 }` for "Search {{count}} tasks…". */
+    readonly placeholderParams?: MagicBarTextParams;
     /**
-     * Optional id→name lookup, for the common case where the backend DTO carries only
-     * `authorUserId`. The `comments` core app owns no user profile data, so without
-     * this every host had to map display names into `authorDisplayName` itself — and
-     * a host that forgot rendered raw GUIDs at the reader.
+     * The text the search field should SHOW — literal text, not an i18n key, because
+     * it is the user's own query rather than a caption.
      *
-     * Bind `FlyUserDirectoryService.label` (a signal-backed read-through cache that
-     * resolves on demand and batches). Because the component reads it during render,
-     * the name appears by itself once the lookup lands — the host keeps a plain
-     * page signal, with no `computed` derivation and no priming.
+     * Exists because a view can arrive **already filtered**: a deep link carrying
+     * `?q=…`, a restored session, a filter applied from a detail pane. Without it the
+     * box renders empty over a visibly filtered list, and the user is looking at a
+     * contradiction the chrome cannot explain.
      *
-     * The component still never calls an API: this is a function the HOST supplies,
-     * exactly like `fly-entity-lookup`'s `LOOKUP_APP_NAME_RESOLVER`. Absent (or
-     * returning `null`), rendering falls back as before. See {@link authorLabel} for
-     * the resolution order.
-     */
-    readonly resolveDisplayName: _angular_core.InputSignal<((userId: string) => string | null) | null>;
-    /** Expand a collapsed reply subtree — always page 1 of that parent. */
-    readonly loadReplies: _angular_core.OutputEmitterRef<{
-        parentCommentId: string;
-        page: number;
-    }>;
-    /** Fetch the next page at a level: root when `parentCommentId` is omitted, else that parent's replies. */
-    readonly loadMore: _angular_core.OutputEmitterRef<{
-        parentCommentId?: string;
-        page: number;
-    }>;
-    /** A new root comment (`parentCommentId` omitted) or reply. */
-    readonly submit: _angular_core.OutputEmitterRef<{
-        body: string;
-        parentCommentId?: string;
-    }>;
-    /** Author-only body edit of an existing comment. */
-    readonly edit: _angular_core.OutputEmitterRef<{
-        commentId: string;
-        body: string;
-    }>;
-    /** Soft delete (tombstone) — author's own comment, or any comment for a moderator. */
-    readonly delete: _angular_core.OutputEmitterRef<{
-        commentId: string;
-    }>;
-    /** Typed report submission. */
-    readonly report: _angular_core.OutputEmitterRef<{
-        commentId: string;
-        reason: FlyCommentReportReason;
-        detail?: string;
-    }>;
-    /** Moderator lock/unlock of the whole thread. */
-    readonly lockToggle: _angular_core.OutputEmitterRef<{
-        locked: boolean;
-    }>;
-    /** Additive: a sort-order pick from the header control — the host re-fetches page 1 in that order. */
-    readonly sortChange: _angular_core.OutputEmitterRef<"newest" | "oldest">;
-    private readonly _base;
-    readonly reportReasons: readonly FlyCommentReportReason[];
-    /** commentIds whose reply subtree is currently expanded/visible. */
-    private readonly _expanded;
-    /** Composer draft text, keyed by parentCommentId (root uses {@link ROOT_DRAFT_KEY}). */
-    private readonly _drafts;
-    /** commentIds whose reply composer box is currently open (distinct from `_expanded`, which toggles the read view). */
-    private readonly _replyBoxOpen;
-    private readonly _editingId;
-    private readonly _editDraft;
-    private readonly _confirmingDeleteId;
-    private readonly _reportingId;
-    private readonly _reportReason;
-    private readonly _reportDetail;
-    readonly rootDraft: _angular_core.Signal<string>;
-    readonly editingId: _angular_core.Signal<string | null>;
-    readonly confirmingDeleteId: _angular_core.Signal<string | null>;
-    readonly reportingId: _angular_core.Signal<string | null>;
-    readonly reportReason: _angular_core.Signal<FlyCommentReportReason | null>;
-    readonly reportDetail: _angular_core.Signal<string>;
-    fieldId(suffix: string): string;
-    isExpanded(commentId: string): boolean;
-    isReplyBoxOpen(commentId: string): boolean;
-    repliesFor(commentId: string): FlyCommentPage | undefined;
-    replyDraft(commentId: string): string;
-    isOwn(comment: FlyComment): boolean;
+     * ## Why it is not called `query`
+     * {@link MagicBarSearchView} — which extends this interface — already declares
+     * `query(text: string): void`, the late-bound invoker. A `query?: string` here
+     * would make that view an illegal extension (TS2430: `(text: string) => void` is
+     * not assignable to `string | undefined`), and the only other way out — renaming
+     * the invoker — removes a member of a shipped exported interface, which is a
+     * ds-compat MAJOR (rule 7) and forks the federation singleton for every remote.
+     * So the field takes the name that pairs with the invoker instead of colliding
+     * with it: `queryText` is the text, `query()` submits it.
+     *
+     * ## Precedence — this is a SEED, not a controlled value
+     * The field's live text is owned by the **shell**, because the user types into
+     * it. This field is the publisher's chance to move it, and the shell adopts the
+     * published value exactly three times:
+     *
+     *  1. the first time it binds this view,
+     *  2. when {@link MagicBarContribution.viewKey} changes (reset-on-navigate — the
+     *     previous view's query must not survive into the next one), and
+     *  3. when the published value **itself changes** from the one previously
+     *     published.
+     *
+     * A re-publish carrying an UNCHANGED `queryText` never touches what the user has
+     * typed. That third clause is the whole rule: the dominant re-publish is
+     * `disabled: !hasSelection` flipping on a selection change, and a shell that
+     * re-read `queryText` on every emitted view would revert a keystroke every time
+     * the user selected a row mid-search — the classic controlled-input bug. The rule
+     * is authored once, as {@link magicBarSearchText}, so no renderer re-derives it.
+     *
+     * `undefined` and `''` are **different** and the difference is load-bearing:
+     * absent means "this view does not manage the field" (nothing is ever forced),
+     * `''` means "clear it". Both the fingerprint and the seed comparison distinguish
+     * them.
+     *
+     * ## Do not echo the user's keystrokes back through this field
+     * A publisher that mirrors its `onQuery` argument straight back into `queryText`
+     * is harmless (the seed changes to text the field already shows). A publisher
+     * that mirrors it back **debounced** is not: typing "abc" then publishing
+     * `queryText: 'a'` 300 ms later is, by rule 3, a genuine publisher-initiated
+     * change, and the field snaps back to "a". Publish here only for state the view
+     * owns independently of the field.
+     */
+    readonly queryText?: string;
     /**
-     * The name to render for a comment's author. Resolution order:
-     * explicit `authorDisplayName` (a host that already knows the name, or a
-     * backend that returns one, always wins) → {@link resolveDisplayName} →
-     * the raw `authorUserId`.
+     * Expanded width in px — a **desktop layout hint**, carried verbatim.
      *
-     * The raw id remains the last resort rather than a placeholder: it is stable,
-     * unique, and lets a reader correlate two comments by the same author even
-     * when the directory is unreachable.
+     * The design's range is 140–420 (default 230), but this store deliberately does
+     * NOT validate or clamp it: enforcing a paint range here would reject a whole
+     * contribution over a cosmetic hint (leaving the previous view's actions in the
+     * chrome), and mobile ignores the field entirely, so there is no single range to
+     * enforce. `fly-magic-actions` clamps to the design range at paint time and is
+     * the only place that decides what an out-of-range or non-finite value means.
      */
-    authorLabel(comment: FlyComment): string;
-    /** First character of {@link authorLabel}, for the avatar-initials fallback. */
-    authorInitial(comment: FlyComment): string;
-    canReport(comment: FlyComment): boolean;
-    canReply(): boolean;
-    canDeleteComment(comment: FlyComment): boolean;
-    canEditComment(comment: FlyComment): boolean;
-    formatDate(iso: string): string;
-    onRootDraftChange(value: string): void;
-    submitRoot(): void;
-    toggleReplies(comment: FlyComment): void;
-    private _expand;
-    loadMoreRoot(): void;
-    loadMoreReplies(parentId: string): void;
-    openReplyBox(commentId: string): void;
-    closeReplyBox(commentId: string): void;
-    onReplyDraftChange(commentId: string, value: string): void;
-    submitReply(commentId: string): void;
-    startEdit(comment: FlyComment): void;
-    onEditDraftChange(value: string): void;
-    saveEdit(comment: FlyComment): void;
-    cancelEdit(): void;
-    requestDelete(comment: FlyComment): void;
-    confirmDelete(comment: FlyComment): void;
-    cancelDelete(): void;
-    openReport(comment: FlyComment): void;
-    onReportReasonChange(reason: FlyCommentReportReason): void;
-    onReportDetailChange(value: string): void;
-    submitReport(): void;
-    closeReport(): void;
-    /** Space would otherwise scroll the page while the backdrop (role="button") is focused. */
-    onOverlayBackdropSpace(event: Event): void;
-    toggleLock(): void;
-    onSortPick(next: 'newest' | 'oldest'): void;
-    private _setDraft;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyCommentThreadComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyCommentThreadComponent, "fly-comment-thread", never, { "rootPage": { "alias": "rootPage"; "required": true; "isSignal": true; }; "repliesByParent": { "alias": "repliesByParent"; "required": false; "isSignal": true; }; "sort": { "alias": "sort"; "required": false; "isSignal": true; }; "isLocked": { "alias": "isLocked"; "required": false; "isSignal": true; }; "currentUserId": { "alias": "currentUserId"; "required": false; "isSignal": true; }; "isReadonly": { "alias": "readonly"; "required": false; "isSignal": true; }; "canModerateThread": { "alias": "canModerateThread"; "required": false; "isSignal": true; }; "resolveDisplayName": { "alias": "resolveDisplayName"; "required": false; "isSignal": true; }; }, { "loadReplies": "loadReplies"; "loadMore": "loadMore"; "submit": "submit"; "edit": "edit"; "delete": "delete"; "report": "report"; "lockToggle": "lockToggle"; "sortChange": "sortChange"; }, never, never, true, never>;
+    readonly openWidth?: number;
+    /** Accent dot on the Filters button — a non-default filter is applied. */
+    readonly filtersActive?: boolean;
 }
-
-/**
- * A proof-of-work challenge issued by `Fly.Sdk.Captcha` (`CaptchaChallenge`).
- * The solver must find `n` in `[0, maxNumber)` such that
- * `sha256HexLower(salt + n) === challenge`.
- */
-interface FlyCaptchaChallenge {
-    /** Always `"SHA-256"` today. */
-    algorithm: string;
-    /** Lowercase-hex SHA-256 of `salt + number` for the secret solution number. */
-    challenge: string;
-    /** Base64 random salt, unique per challenge. */
-    salt: string;
-    /** HMAC signature binding challenge + maxNumber + expiresAt (server-verified). */
-    signature: string;
-    /** Exclusive upper bound of the search space (difficulty). */
-    maxNumber: number;
-    /** ISO-8601 instant after which the solution is rejected. Echoed back verbatim. */
-    expiresAt: string;
+interface MagicBarSearch extends MagicBarSearchSpec {
+    readonly onQuery?: (query: string) => void;
+    /**
+     * Opens the view's own Advanced-search overlay. Presence of this handler is
+     * what makes the Filters button exist — the DS deliberately does not model the
+     * dialog itself. Its fields are app schema (Circles' PESTLE/horizon grid), and
+     * a descriptor for them would be business logic the design system cannot
+     * validate or render honestly.
+     */
+    readonly onOpenFilters?: (trigger?: HTMLElement) => void;
 }
-/**
- * The solved payload, matching `Fly.Sdk.Captcha.CaptchaSolution` field-for-field
- * (camelCase Web JSON). Serialized to the opaque base64 token the backend decodes:
- * `base64(utf8(JSON.stringify(solution)))` — i.e. `Convert.ToBase64String` +
- * `JsonSerializerDefaults.Web`. Every field except `number` is echoed from the
- * challenge unchanged so the server's stateless signature check passes.
- */
-interface FlyCaptchaSolution {
-    algorithm: string;
-    challenge: string;
-    salt: string;
-    number: number;
-    signature: string;
-    maxNumber: number;
-    expiresAt: string;
+interface MagicBarSearchView extends MagicBarSearchSpec {
+    /** True iff the publisher can open an advanced-search overlay. */
+    readonly hasFilters: boolean;
+    /**
+     * Submit the field's current text to the publisher's newest `onQuery`. The
+     * inbound half — what the field should SHOW — is
+     * {@link MagicBarSearchSpec.queryText}, and that asymmetry in naming is forced:
+     * this member shipped first, and renaming it would be a ds-compat MAJOR.
+     */
+    query(text: string): void;
+    /**
+     * Open the publisher's advanced-search overlay. Carries the Filters button the
+     * shell painted, for the same reason and under the same caveats as
+     * {@link MagicBarActionView.run} — a publisher whose overlay is a popover
+     * anchors it there instead of guessing at a position inside its own page.
+     */
+    openFilters(trigger?: HTMLElement): void;
 }
-/** The solver lifecycle surfaced by the component's `state()` signal. */
-type FlyCaptchaState = 'idle' | 'verifying' | 'verified' | 'expired' | 'error';
-
-/** Lowercase-hex SHA-256 of `input` via Web Crypto — matches `Convert.ToHexStringLower(SHA256…)`. */
-declare function flyCaptchaSha256Hex(input: string): Promise<string>;
-/** Standard base64 of the UTF-8 bytes of `s` — matches .NET `Convert.ToBase64String`. */
-declare function flyCaptchaBase64Utf8(s: string): string;
 /**
- * Builds the opaque base64 token the backend's `CaptchaSolution.FromToken` expects.
- * Exported so a host (or a test) can construct/verify the token shape without the
- * component.
+ * One view's complete claim on the magic bar.
+ *
+ * Identity (`appId` / `windowId`) is deliberately absent: it belongs to the
+ * {@link MagicBarPublisher} that was minted for this owner, so a later publish
+ * cannot re-target another app's slot.
  */
-declare function flyCaptchaBuildToken(solution: FlyCaptchaSolution): string;
+interface MagicBarContribution {
+    /**
+     * What the publisher is showing, e.g. `'tasks:detail'`. A change here is
+     * reset-on-navigate: the registry replaces the slot wholesale rather than
+     * reconciling, so nothing from the previous view can survive.
+     */
+    readonly viewKey: string;
+    readonly search?: MagicBarSearch | null;
+    /** Ordered clusters, separator-joined. */
+    readonly groups?: readonly MagicBarGroup[];
+    /** The accent-filled CTA ("New task", "Add signal"). */
+    readonly primary?: MagicBarAction | null;
+    /**
+     * Ids of {@link AgentCommand}s this view considers most relevant, most-relevant
+     * first — the Ask-AI menu's per-view sets.
+     *
+     * Ids, not command objects: the platform already models commands (manifest
+     * `commands[]` → `AgentCommandRegistry`), and D5 §6 item 9 is explicit that
+     * production must source these from manifests instead of the mock's hardcoded
+     * `{ title, note, prompt }` triples. Duplicating that model here would fork the
+     * palette and reintroduce hardcoded prompt text. Unknown ids are dropped by the
+     * resolver; an empty list leaves the shell's affinity ranking in charge.
+     */
+    readonly quickCommandIds?: readonly string[];
+    /** The "…" overflow set. Reserved design intent (D5 §6 item 8) — Print / Export / Settings. */
+    readonly overflow?: readonly MagicBarAction[];
+}
+/** The shell-facing projection of a contribution. See `magic-bar-projection.ts`. */
+interface MagicBarView {
+    readonly appId: string;
+    readonly windowId?: string;
+    /** {@link magicBarOwnerKey} of the publisher. */
+    readonly ownerKey: string;
+    readonly viewKey: string;
+    readonly search: MagicBarSearchView | null;
+    readonly groups: readonly MagicBarGroupView[];
+    readonly primary: MagicBarActionView | null;
+    readonly quickCommandIds: readonly string[];
+    readonly overflow: readonly MagicBarActionView[];
+}
 /**
- * **`fly-captcha`** — the design-system client for the self-hosted proof-of-work
- * captcha (`Fly.Sdk.Captcha`).
- *
- * Given a {@link FlyCaptchaChallenge}, it brute-forces `n` in `[0, maxNumber)`
- * until `sha256HexLower(salt + n) === challenge`, then emits the solution as the
- * base64 token the backend decodes ({@link flyCaptchaBuildToken}). The search
- * hashes candidates with a vendored **synchronous** SHA-256 ({@link sha256HexSync}
- * from `./sha256` — no `crypto.subtle`/promise overhead per candidate, which used
- * to dominate solve time), in chunks scheduled on `requestAnimationFrame` so a
- * chunk boundary still yields back to the browser between slices. It auto-starts
- * whenever the `[challenge]` input changes. Implements
- * {@link ControlValueAccessor} so it drops into a reactive form / `[(ngModel)]` —
- * the control value IS the token string.
- *
- * Expiry is the host's concern to refresh: the component checks `expiresAt` up
- * front and while solving, emits {@link expired}, and stops. i18n is
- * self-sufficient via the `captcha.*` baseline keys; RTL works via logical CSS.
- *
- * @example
- * ```html
- * <fly-captcha [challenge]="challenge()" (solved)="post($event)" (expired)="refresh()" />
- * ```
+ * A view's handle on its magic-bar slot. Minted once per publisher (not per
+ * publish) because the publish rate is the whole point of this surface: the
+ * sibling registries hand back a handle per `register()` and expect a handful of
+ * calls per app lifetime, whereas a magic-bar publisher re-emits on every
+ * selection change. Handing out a fresh handle each time would leave the caller
+ * holding a dead one and force it to reassign on every keystroke.
  */
-declare class FlyCaptchaComponent implements ControlValueAccessor, OnDestroy {
-    /** The challenge to solve. Setting (or replacing) it auto-starts a fresh solve. */
-    readonly challenge: _angular_core.InputSignal<FlyCaptchaChallenge | null>;
-    /** Candidates hashed synchronously in one slice before yielding back to the browser
-     *  on the next animation frame. Higher = fewer `requestAnimationFrame` hops (each
-     *  carries ~16ms of frame-boundary overhead), more synchronous work per slice.
-     *  20,000 keeps a slice's own hashing time well under a long-task budget on modern
-     *  hardware (the vendored sync SHA-256 does several hundred thousand hashes/sec)
-     *  while needing only a handful of hops to clear the library's default difficulty. */
-    readonly chunkSize: _angular_core.InputSignal<number>;
-    /** The solution token once solved — the exact string to POST back to the backend. */
-    readonly solved: _angular_core.OutputEmitterRef<string>;
-    /** The challenge expired (up-front or mid-solve). The host should request a new one. */
-    readonly expired: _angular_core.OutputEmitterRef<void>;
-    readonly state: _angular_core.WritableSignal<FlyCaptchaState>;
-    readonly token: _angular_core.WritableSignal<string | null>;
-    /** Monotonic generation — bumped on every restart/destroy so a stale async chunk
-     *  or timer that captured an older generation no-ops instead of racing. */
-    private _gen;
-    private _raf;
-    private _expiryTimer;
-    private _onChange;
-    private _onTouched;
-    constructor();
-    ngOnDestroy(): void;
-    private _restart;
+interface MagicBarPublisher {
+    readonly owner: MagicBarOwnerRef;
     /**
-     * Hashes `[start, end)` synchronously with {@link sha256HexSync} — no per-candidate
-     * `await`, so there is no promise/microtask overhead between candidates — then
-     * yields to the next animation frame for the remainder. Bails to `error` state if
-     * hashing itself throws (defensive; a pure function over a short string should not)
-     * or if the whole `[0, maxNumber)` space is exhausted with no match, which means the
-     * challenge is corrupt or was tampered with.
+     * Replace this owner's contribution. No-op after {@link dispose}, and no-op
+     * after the shell has {@link MagicBarRegistry.clear}ed this owner key.
+     *
+     * **Publish is last-writer-wins and eviction is not** — a deliberate asymmetry.
+     * A stale publisher (one that has been replaced on this key by a newer one)
+     * cannot `dispose()` the newer one out of the slot, but it *can* still take the
+     * slot back by publishing. Symmetry would need a "newest publisher wins" rule
+     * enforced on write, which would make the first publish of a replacement
+     * publisher silently drop whenever two live views briefly share a key. The
+     * exposure is bounded: two live publishers on one owner key only happen while a
+     * view is being replaced in place, and the loser re-publishes on its next
+     * selection change. The unbounded case — a publisher that outlives its window —
+     * is closed by `clear()`'s tombstone, not by write ordering.
+     */
+    publish(contribution: MagicBarContribution): void;
+    /**
+     * Release the slot. Idempotent, and a no-op if another publisher has since
+     * taken this owner key — the same stale-handle rule the sibling registries use.
      */
-    private _solveChunk;
-    private _onSolved;
-    private _cancel;
-    private _schedule;
-    private _cancelSchedule;
-    writeValue(value: string | null): void;
-    registerOnChange(fn: (v: string | null) => void): void;
-    registerOnTouched(fn: () => void): void;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyCaptchaComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyCaptchaComponent, "fly-captcha", never, { "challenge": { "alias": "challenge"; "required": false; "isSignal": true; }; "chunkSize": { "alias": "chunkSize"; "required": false; "isSignal": true; }; }, { "solved": "solved"; "expired": "expired"; }, never, never, true, never>;
+    dispose(): void;
 }
 
 /**
- * Singleton registry of slash commands offered by the agent input palette.
+ * The Gantt **Period** control as a magic-bar radio-menu item.
  *
- * Lives in the DS so it crosses the federation boundary as a single instance via
- * `sharedMappings: ['@flyos/design-system']`. Federated remotes register
- * their commands at boot (and dispose on window close) without forking the shell.
+ * ## Why it is called Period and not Zoom
+ * The control does not scale the chart — it changes the unit the time axis is measured in
+ * (day / week / month / quarter), which is what a planner calls the *period*. "Zoom" invites the
+ * browser's own Ctrl+wheel meaning, which this chart deliberately remaps to horizontal scrolling
+ * (`gantt-pan.ts`), so two different verbs would have shared one word on the same surface. The
+ * underlying type stays {@link GanttZoom} — renaming a shipped exported type is MAJOR under
+ * `tools/ds-compat` and would fork the federation singleton for every remote over a caption.
  *
- * Storage is a signal store. `register` is O(1) for the unique-id case and O(n) when
- * replacing an existing id (filter then push). The append-then-replace strategy is
- * deliberate: registrations are rare (each one corresponds to a remote's app-init
- * effect), and the tradeoff buys us a stable id-collision contract — the *latest*
- * registration wins, and the previous handle's `dispose()` becomes a no-op rather
- * than removing the new entry.
+ * ## Why it lives in the design system
+ * A period picker is not app vocabulary: every screen that draws a `fly-gantt` needs exactly these
+ * four levels under exactly these labels, and the first app to grow a second Gantt screen
+ * immediately has two copies to keep in step (PPM had a project plan, a project schedule and a
+ * portfolio roadmap). Shipping the item beside the chart means the labels ride the DS baseline
+ * locales in all four languages and a consumer supplies only state and a callback.
+ *
+ * `defaultValue` is the CALLER's load-time default — `'week'` on a single project's plan, `'month'`
+ * on a portfolio spanning years — because the trigger's accent "non-default" dot should light only
+ * once the user has left that screen's own entry point.
+ *
+ * `labelKeyPrefix` exists for a consumer that already ships its own translated period labels and
+ * does not want the DS baseline (PPM's `ppm.projects.plan.zoom.*` predate this helper). It appends
+ * `.label` for the trigger and `.<zoom>` per option, matching the baseline layout exactly.
  */
-declare class AgentCommandRegistry {
-    private readonly _commands;
-    /** All currently-registered commands, in insertion order. */
-    readonly all: Signal<readonly AgentCommandRegistration[]>;
-    /**
-     * Returns a signal of commands whose scope is `'global'` OR whose `scope.appId` is in
-     * the live app set. The signal recomputes when either the registry or `liveAppIds`
-     * changes — pass a `Signal<ReadonlySet<string>>` from the host's app-registry service
-     * for reactive filtering.
-     */
-    visible(liveAppIds: ReadonlySet<string> | Signal<ReadonlySet<string>>): Signal<readonly AgentCommandRegistration[]>;
-    /**
-     * Register a single command. Returns a handle whose `dispose()` removes the row by
-     * id. If the same id is later re-registered, the original handle's `dispose()`
-     * becomes a no-op (the newer registration owns the row). Idempotent disposal.
-     */
-    register(cmd: AgentCommandRegistration): AgentCommandHandle;
-    /**
-     * Bulk register. Rolls back on duplicate id within the input batch (throws before any
-     * row lands). Cross-batch duplicates against existing rows follow the standard
-     * "latest wins" rule and do NOT trigger rollback.
-     *
-     * Returns a handle whose `dispose()` tears down every row registered by this call.
-     */
-    registerAll(cmds: readonly AgentCommandRegistration[]): AgentCommandHandle;
-    /** Tear down by id. Idempotent. */
-    unregister(id: string): void;
-    /** Monotonic counter; identifies which registration call currently owns each id. */
-    private _generation;
-    /** id → generation. Used so a stale handle's `dispose()` is a no-op after replacement. */
-    private readonly _owners;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentCommandRegistry, never>;
-    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentCommandRegistry>;
-}
+declare function ganttPeriodBarItem(spec: {
+    value: GanttZoom;
+    defaultValue: GanttZoom;
+    disabled?: boolean;
+    /** Key namespace for the trigger + option captions. Defaults to the DS baseline `gantt.period`. */
+    labelKeyPrefix?: string;
+    onSelect: (zoom: GanttZoom) => void;
+}): MagicBarAction;
+/**
+ * The **Indent** / **Outdent** pair as magic-bar actions, for a chart whose consumer maps outline
+ * level onto something it can persist.
+ *
+ * Two actions rather than one toggle: they are opposite verbs with independent availability (a row
+ * can be indentable and not outdentable, and at the top of a list neither applies), and a toggle
+ * would have to pick a label for a state the user cannot see.
+ *
+ * ## Icon-only, and why they are still discoverable
+ * Both are icon-only despite `skills/shell-magic-bar-views.md` §5's default, because the
+ * indent/outdent glyph pair is one of the few marks a user genuinely reads without help — it is the
+ * same pair every word processor, IDE and desktop planner has shipped for thirty years, and the two
+ * are identified by being MIRRORS of each other, which a label cannot improve on. They also sort
+ * inside Add/Delete/Edit under {@link orderMagicBarItems}, so they never take the outer edge from a
+ * verb that needs it.
+ *
+ * ## Omitted, never dimmed
+ * An unavailable verb is left OUT of the returned array — the magic bar renders no disabled
+ * buttons at all (`skills/shell-magic-bar-views.md` §6). The bar is one small shared strip
+ * and its cost is measured in how many things it shows at once, so a dimmed button spends that
+ * budget on an action the user cannot take. This pair is the clearest case: at most ONE of the two
+ * is ever available for a given row, so dimming doubled the group's width to say nothing. What
+ * availability depends on is also on screen while the bar is being read — a row already nested
+ * cannot nest further — so the dimmed state was not teaching anything the chart did not show.
+ *
+ * Returns 0, 1 or 2 actions. Spread it; never index it.
+ */
+declare function ganttOutlineBarItems(spec: {
+    canIndent: boolean;
+    canOutdent: boolean;
+    onIndent: () => void;
+    onOutdent: () => void;
+}): MagicBarAction[];
 
 /**
- * Singleton registry of entity lookups offered by the `/lookup` typeahead.
+ * Normalise a label / query for comparison: case-folded and stripped of combining marks, so a
+ * search for `resume` finds `Résumé` and an Arabic query matches regardless of harakat.
  *
- * Mirrors {@link AgentCommandRegistry}'s federation-singleton story
- * (`sharedMappings: ['@flyos/design-system']`), id-collision
- * "latest wins" contract, and disposable-handle ergonomics. OS-core entities
- * (note / calendar event / file) register once at shell bootstrap via
- * `CORE_APP_LOOKUPS`; federated remotes (Circles: scenario / trend / signal)
- * register at remote-component boot and dispose on window close.
+ * `NFD` + strip `\p{M}` rather than a hand-rolled accent table: the table approach covers Latin-1
+ * and silently fails on every other script this platform ships (`ar`, `ur`), which is precisely the
+ * locale pair where a user is most likely to type an unmarked form.
+ */
+declare function normalizeGanttSearchText(value: string): string;
+/**
+ * Filter a Gantt row set to the rows a query is "about", **preserving tree context**.
  *
- * **Scope semantics diverge from commands.** Commands HIDE when their `appId`
- * isn't in `liveAppIds`. Lookups DO NOT — they're always offered, and
- * `{appId}` is just a *priority hint* that bumps that lookup to the top of
- * the entity picker when the app is live. See {@link LookupRegistration.scope}
- * for the rationale.
+ * A flat `rows.filter(matches)` is the obvious implementation and it is wrong here for two
+ * independent reasons, both of which change what the user sees rather than merely how it looks:
  *
- * Storage is a signal store keyed on {@link LookupRegistration.entity}. Because
- * `entity` is the collision key, an app re-registering the same entity replaces
- * the prior descriptor; a stale handle's `dispose()` then no-ops.
+ * 1. **A matching child whose parent is filtered out becomes a root.** `flattenRows` treats an
+ *    unknown `parentId` as a root, so a task matching "deploy" would jump to depth 0 and lose the
+ *    milestone that gives it meaning. The user asked to find a row, not to re-parent it.
+ * 2. **A matching parent whose children are filtered out stops being a group.** Its chevron
+ *    disappears and its derived span collapses to its own dates — so searching for a milestone
+ *    silently changes the bar the chart draws for it.
+ *
+ * So the kept set is the **closure** of the matches over both directions of the tree: every match,
+ * every ancestor of a match (context above), and every descendant of a match (context below).
+ * Searching a milestone's name shows that milestone with its whole task list intact; searching a
+ * task's name shows the task under its own milestone.
+ *
+ * Order is preserved — this is a filter, never a re-sort. An empty / whitespace query returns the
+ * input array by reference, so a non-searching chart pays nothing and its `computed` never
+ * invalidates on identity alone.
  */
-declare class AgentLookupRegistry {
-    private readonly _lookups;
-    /** All currently-registered lookups, in insertion order. */
-    readonly all: Signal<readonly LookupRegistration[]>;
-    /**
-     * All registered lookups, sorted by affinity to `liveAppIds`:
-     *
-     *   1. Lookups whose `scope.appId` is in the live app set (in registration
-     *      order within that bucket).
-     *   2. Then everything else — `'global'` lookups AND scoped lookups whose
-     *      app isn't currently live — in registration order.
-     *
-     * Recomputes when either the registry or `liveAppIds` changes. Pass a
-     * `Signal<ReadonlySet<string>>` from the host's app-registry for reactive
-     * re-sorting. **Always returns the full registry** — see the type doc on
-     * {@link LookupRegistration.scope} for why this differs from
-     * {@link AgentCommandRegistry.visible}.
-     */
-    visible(liveAppIds: ReadonlySet<string> | Signal<ReadonlySet<string>>): Signal<readonly LookupRegistration[]>;
-    /**
-     * Register one lookup. Returns a handle whose `dispose()` removes the row by
-     * `entity`. A later re-registration of the same entity makes the original
-     * handle's `dispose()` a no-op (the newer registration owns the row).
-     */
-    register(lookup: LookupRegistration): LookupHandle;
-    /**
-     * Bulk register. Rolls back on a duplicate entity WITHIN the input batch
-     * (throws before any row lands). Cross-batch duplicates against existing rows
-     * follow the standard "latest wins" rule and do NOT trigger rollback.
-     */
-    registerAll(lookups: readonly LookupRegistration[]): LookupHandle;
-    /**
-     * Resolve a deep-link anchor to a concrete launch target.
-     *
-     * `kind` is the dotted `<appId>.<entity>` token the agents backend emits
-     * inside `flyos:<kind>/<id>` chat-answer anchors — the same entity-kind
-     * vocabulary as drag-payload kinds and `ref` parts. Returns
-     * `{ appId, route }` when a registered lookup for that `(appId, entity)`
-     * pair carries a {@link LookupDescriptor.deepLinkRoute} template; `null`
-     * otherwise (unknown entity, app mismatch, or no template — e.g. the
-     * owning app isn't installed) so the caller renders plain text rather than
-     * a dead link.
-     *
-     * `appId` and `entity` are both dot-free by their own grammars, so the
-     * FIRST dot is the unambiguous split point; a dotless `kind` can't carry an
-     * app and never resolves. The template's single `{id}` placeholder is
-     * substituted URL-encoded.
-     */
-    resolveDeepLink(kind: string, id: string): {
-        readonly appId: string;
-        readonly route: string;
-    } | null;
-    /**
-     * Resolve a deep-link target from a bare `(entity, id)` pair — the shape a
-     * `/lookup` ref carries (it has no `<appId>.<entity>` kind token; the owning
-     * app is implicit in the registered descriptor). `entity` is the registry's
-     * unique storage key, so it identifies the descriptor unambiguously without
-     * an app prefix.
-     *
-     * Returns `{ appId, route }` (the descriptor's {@link LookupDescriptor.appId}
-     * / affinity `scope.appId` as the owner, `{id}` substituted URL-encoded) when
-     * a matching descriptor carries a {@link LookupDescriptor.deepLinkRoute};
-     * `null` otherwise (unknown entity, no template, or the owning app has since
-     * unregistered) so callers render plain text rather than a dead link — the
-     * same graceful-degrade contract as {@link resolveDeepLink}.
-     */
-    resolveDeepLinkForEntity(entity: string, id: string): {
-        readonly appId: string;
-        readonly route: string;
-    } | null;
-    /** Tear down by entity. Idempotent. */
-    unregister(entity: string): void;
-    /** Monotonic counter; identifies which registration call currently owns each entity. */
-    private _generation;
-    /** entity → generation. Lets a stale handle's `dispose()` no-op after replacement. */
-    private readonly _owners;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentLookupRegistry, never>;
-    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentLookupRegistry>;
+declare function filterGanttRows(rows: readonly GanttRow[], query: string): readonly GanttRow[];
+
+/**
+ * Apply a {@link GanttRowReorder} to a plain `GanttRow[]`, returning a new array.
+ *
+ * Optional: a consumer that persists to a server and re-reads does not need it. It exists for the
+ * two cases that do — an optimistic update while the write is in flight, and an app whose row
+ * order is client-side only — because the fiddly part is not the parent change, it is keeping the
+ * moved row's DESCENDANTS with it and landing the block after the previous sibling's whole
+ * subtree rather than immediately after that sibling's own row.
+ *
+ * The moved row's `parentId` is rewritten to the move's parent; every other row is untouched, so a
+ * consumer's extra fields survive.
+ */
+declare function applyGanttRowReorder(rows: readonly GanttRow[], move: GanttRowReorder): GanttRow[];
+
+/** The 14 rendered field kinds. Drives the control the renderer picks. */
+type FlyFormQuestionType = 'Text' | 'MultilineText' | 'Number' | 'Email' | 'Date' | 'DateTime' | 'Boolean' | 'SingleSelect' | 'MultipleSelect' | 'RadioButton' | 'Country' | 'File' | 'MultiFile' | 'Image';
+/**
+ * A selectable option on a choice field (SingleSelect / MultipleSelect /
+ * RadioButton). `linkedQuestionIds` drive conditional branching: selecting this
+ * option reveals those (branch-target) fields. `score` is author-only and is only
+ * surfaced to the viewer when the host opts in via `[showScore]` (a scorecard);
+ * a respondent-facing form leaves `showScore` false and never renders it.
+ */
+interface FlyFormOption {
+    id: string;
+    label: string;
+    score?: number;
+    linkedQuestionIds?: string[];
+}
+/** Per-type constraints/affordances an author can attach to a field. */
+interface FlyFormFieldOptions {
+    minLength?: number;
+    maxLength?: number;
+    numericMin?: number;
+    numericMax?: number;
+    rows?: number;
+    maxFileSizeMb?: number;
+    maxFileCount?: number;
+    allowedExtensions?: string[];
+    hasSearch?: boolean;
+}
+/**
+ * A single form field. `isBranchTarget` fields start hidden. `sectionId` /
+ * `criteriaGroup` are additive grouping hints a scorecard uses; they are ignored
+ * by the respondent-facing survey path, so binding them changes nothing there.
+ */
+interface FlyFormQuestion {
+    id: string;
+    text: string;
+    description?: string;
+    type: FlyFormQuestionType;
+    required: boolean;
+    isBranchTarget: boolean;
+    /** Additive: an author-hidden field. `false` excludes it from the visible set (and thus from
+     *  required-enforcement); omitted / `true` renders as normal. Mirrors the backend `IsVisible`. */
+    isVisible?: boolean;
+    fieldOptions?: FlyFormFieldOptions;
+    options: FlyFormOption[];
+    /** Additive: groups fields into a visual section (scorecard). Ignored by surveys. */
+    sectionId?: string;
+    /** Additive: labels the weighted-criteria group a scored field belongs to. Ignored by surveys. */
+    criteriaGroup?: string;
+}
+/** A full form definition — the top-level `[definition]` binding. */
+interface FlyFormDefinition {
+    title: string;
+    description?: string;
+    declaration?: string;
+    questions: FlyFormQuestion[];
+}
+/** How an opted-in `[showScore]` host renders a choice option's points. */
+type FlyFormScoreDisplay = 'inline' | 'badge';
+/**
+ * The polymorphic answer payload for one field. Only the field(s) relevant to the
+ * type are populated:
+ * - text: Text / MultilineText / Email
+ * - number: Number
+ * - dateValue: Date / DateTime (raw `<input>` value string)
+ * - boolValue: Boolean
+ * - selectedOptionIds: SingleSelect / MultipleSelect / RadioButton / Country
+ * - fileIds: File / MultiFile / Image (filled by the host after upload; this
+ *   component emits it empty and surfaces the raw selection via `fileSelected`)
+ */
+interface FlyFormAnswerValue {
+    text?: string;
+    number?: number;
+    dateValue?: string;
+    boolValue?: boolean;
+    selectedOptionIds?: string[];
+    fileIds?: string[];
+}
+/** One field's answer — the unit emitted by `answersChange` / `submit`. */
+interface FlyFormAnswer {
+    questionId: string;
+    value: FlyFormAnswerValue;
+}
+/**
+ * Raw file selection surfaced by File / MultiFile / Image fields. The host wires
+ * this to its own upload API and, once ids are known, feeds them back via the
+ * `[answers]` prefill (`fileIds`). The DS component never touches an upload endpoint.
+ */
+interface FlyFileSelection {
+    questionId: string;
+    files: File[];
 }
 
+/** A render segment: either an ungrouped field (`group === null`) or a titled `criteriaGroup` section.
+ *  `index` is the field's running position across the whole form (drives unique element ids). */
+interface FlyFormFieldGroup {
+    group: string | null;
+    items: {
+        q: FlyFormQuestion;
+        index: number;
+    }[];
+}
 /**
- * Singleton registry of chip-renderer components and keyboard-alternative draggable
- * items, keyed by `kind` and `appId`.
+ * **`fly-dynamic-form`** — the design-system data-contract-driven form renderer.
  *
- * Like {@link AgentCommandRegistry}, this lives in the DS so it crosses the federation
- * boundary as a single instance. Hosts (the shell `<fly-agent-input>`) lookup
- * renderers; remotes register them.
+ * Renders a {@link FlyFormDefinition} (14 field types) into an accessible,
+ * theme-aware form, owning all the fiddly behaviour a form needs: conditional
+ * **branching** (options reveal branch-target fields), per-visible-field
+ * **required validation**, a **declaration** acceptance gate, and a **readonly**
+ * replay mode. It is a platform surface — zero coupling to any specific app, and
+ * (deliberately) no coupling to an upload API: File / Image / MultiFile fields
+ * surface the raw selection via {@link fileSelected} and emit `fileIds` empty; the
+ * host wires the upload and feeds ids back through the `[answers]` prefill.
  *
- * Renderer lookup is `O(n)` over the registered list — the registry is small (one or
- * two entries per app) and lookups happen on drop, not per frame.
+ * The historical **`fly-survey-form`** selector is retained on this same component
+ * (multi-selector), so every existing `<fly-survey-form>` binding keeps working
+ * unchanged. Surveys never sets {@link showScore}, so its behaviour (never rendering
+ * `option.score`) is identical. A scorecard host opts into score display with
+ * `[showScore]="true"`.
  *
- * Draggable storage is per-`appId` writable signal cached in a Map, so each `appId`
- * gets a stable {@link Signal} reference across reads (callers can `===`-compare).
+ * i18n is self-sufficient through the `form.*` keys in `DS_BASELINE_LOCALES`
+ * (en/ar/fr/ur), overridable by any consumer key of the same name. RTL works via
+ * logical CSS. Styling uses DS theme tokens (`--surface-*`, `--label-*`,
+ * `--separator`, `--fill-*`, `--accent`, `--system-*`) with light-neutral
+ * fallbacks so it stays readable even in a consumer that hasn't mapped them.
+ *
+ * @example
+ * ```html
+ * <fly-dynamic-form
+ *   [definition]="def"
+ *   [answers]="prefill"
+ *   [showScore]="true"
+ *   (answersChange)="draft = $event"
+ *   (validityChange)="valid = $event"
+ *   (fileSelected)="upload($event)"
+ *   (submit)="persist($event)" />
+ * ```
  */
-declare class AgentDropRegistry {
-    private readonly _renderers;
-    /** Per-appId writable store for draggables. Read-only mirror returned to callers. */
-    private readonly _draggablesByApp;
+declare class FlyDynamicFormComponent implements OnInit {
+    private readonly _i18n;
+    /** The form to render. */
+    readonly definition: _angular_core.InputSignal<FlyFormDefinition>;
+    /** Replay mode — every control is disabled and no validation errors / submit show.
+     *  Aliased to `[readonly]` (the public binding); the class member avoids shadowing
+     *  the TypeScript `readonly` keyword. */
+    readonly isReadonly: _angular_core.InputSignal<boolean>;
+    /** Hides the submit button while leaving every control interactive — the author's
+     *  pre-publish PREVIEW, which must let you open dropdowns and try the form out but has
+     *  nothing to submit to. Distinct from `readonly`, which disables the controls outright
+     *  (a submission replay). A host that hides submit should not bind `(submit)`. */
+    readonly hideSubmit: _angular_core.InputSignal<boolean>;
+    /** Prefill answers (e.g. a saved draft or a completed response). Answers for
+     *  currently-hidden branch targets are ignored. */
+    readonly answers: _angular_core.InputSignal<readonly FlyFormAnswer[]>;
+    /** Additive, opt-in: render each choice option's `score` (a weighted scorecard).
+     *  Defaults false so the respondent-facing survey path never leaks the answer key. */
+    readonly showScore: _angular_core.InputSignal<boolean>;
+    /** How an opted-in score is rendered next to an option (`badge` chip or `inline` text). */
+    readonly scoreDisplay: _angular_core.InputSignal<FlyFormScoreDisplay>;
+    /** The full visible answer set on every change. */
+    readonly answersChange: _angular_core.OutputEmitterRef<FlyFormAnswer[]>;
+    /** Required-field validity on every change (does NOT include the declaration gate). */
+    readonly validityChange: _angular_core.OutputEmitterRef<boolean>;
+    /** Fires only when the form is valid AND (if a declaration is set) accepted. */
+    readonly submit: _angular_core.OutputEmitterRef<FlyFormAnswer[]>;
+    /** Raw file selection for a File / MultiFile / Image field — the host uploads
+     *  and feeds the resulting ids back via `[answers]`. */
+    readonly fileSelected: _angular_core.OutputEmitterRef<FlyFileSelection>;
+    private readonly _base;
+    /** questionId → answer value. Only ever contains VISIBLE, non-empty answers. */
+    private readonly _values;
+    /** questionId → locally-picked File[] (transient, pre-upload). Never emitted as ids. */
+    private readonly _fileSelections;
+    private readonly _declarationAccepted;
+    private readonly _submitAttempted;
+    /** questionIds the user has interacted with — gates when a required error shows. */
+    private readonly _interacted;
+    /** Per-field local file-validation error message (already localized). */
+    private readonly _fileErrors;
+    private readonly _countryOptions;
+    constructor();
+    ngOnInit(): void;
+    /** The set of field ids currently shown (base fields + revealed branch targets). */
+    readonly visibleQuestionIds: _angular_core.Signal<Set<string>>;
+    /** Definition fields filtered to the visible set, in definition order. */
+    readonly visibleQuestions: _angular_core.Signal<FlyFormQuestion[]>;
     /**
-     * Look up the chip-renderer component class for a `kind`. The newest registration for
-     * a given `kind` wins, regardless of `appId` — we scan the list in reverse so a later
-     * `register` call shadows an earlier one for the same `kind`.
-     *
-     * Returns `null` when no renderer is registered; the host falls back to a generic
-     * `plainTextFallback` chip.
+     * The visible fields laid out in render order, segmented by `criteriaGroup`: fields that share a
+     * (non-empty) group render together inside one titled section (a scorecard's weighted-criteria
+     * grouping); a field with no `criteriaGroup` is its own ungrouped segment and renders flat, exactly
+     * as before. Each item keeps its running index across the whole form so element ids stay unique.
      */
-    rendererFor(kind: string): Type<AgentChipHostInputs> | null;
+    readonly groupedQuestions: _angular_core.Signal<FlyFormFieldGroup[]>;
+    readonly declarationRequired: _angular_core.Signal<boolean>;
+    /** Required-field validity (declaration NOT included — see {@link canSubmit}). */
+    readonly isValid: _angular_core.Signal<boolean>;
+    /** Whether `(submit)` may fire: valid required set AND declaration accepted (if any). */
+    readonly canSubmit: _angular_core.Signal<boolean>;
+    readonly declarationAccepted: _angular_core.Signal<boolean>;
+    fieldId(index: number): string;
+    descId(index: number): string;
+    errId(index: number): string;
+    describedBy(q: FlyFormQuestion, index: number): string | null;
+    isChoice(type: FlyFormQuestionType): boolean;
+    isFile(type: FlyFormQuestionType): boolean;
+    /** Types rendered as a native input group inside `<fieldset><legend>`. */
+    isFieldset(type: FlyFormQuestionType): boolean;
+    isCountry(type: FlyFormQuestionType): boolean;
     /**
-     * Register a renderer for a `(kind, appId)` pair. Re-registering the same pair
-     * replaces the prior entry; the disposal handle for the prior registration becomes
-     * a no-op.
+     * Types rendered with the DS `<fly-select>` (labelled via `ariaLabel`).
      *
-     * Returns a {@link AgentCommandHandle} (re-used to keep the disposable shape uniform
-     * across registries) whose `dispose()` removes this exact registration.
+     * Every select-like type now qualifies. `hasSearch` used to gate the CONTROL, which left a plain
+     * SingleSelect on a native `<select>` — an OS-chrome popup that cannot be themed (it paints its
+     * rows with the control's translucent background over a white backing, so the list rendered
+     * white-on-white on the dark shell). `hasSearch` now only decides whether the DS panel carries a
+     * search box; see {@link selectSearchable}.
      */
-    register<T = unknown>(reg: AgentDropRendererRegistration<T>): AgentCommandHandle;
+    usesDsSelect(q: FlyFormQuestion): boolean;
+    /** Search box: always for Country (the list is ~200 long), else only when the author asked. */
+    selectSearchable(q: FlyFormQuestion): boolean;
     /**
-     * Apps publish their live "draggable from focused window" set so the keyboard
-     * "Attach from app…" menu can offer them. Hosts call this each time the user-visible
-     * draggable list changes; passing an empty array clears the entry for this `appId`.
+     * The points to show for a choice option, or null to render nothing. Non-null only when the host
+     * opted in via `[showScore]` and the option actually carries a score — this is the sole gate that
+     * keeps a respondent-facing survey (which never binds `showScore`) from leaking the answer key.
      */
-    publishDraggables(appId: string, items: readonly AgentDraggableItem[]): void;
+    optionScore(opt: FlyFormOption): number | null;
+    /** Whether a required error should be visible for a field right now. */
+    showError(q: FlyFormQuestion): boolean;
+    fileError(q: FlyFormQuestion): string | null;
+    textValue(q: FlyFormQuestion): string;
+    numberValue(q: FlyFormQuestion): number | null;
+    dateValue(q: FlyFormQuestion): string;
+    boolValue(q: FlyFormQuestion): boolean | null;
+    singleValue(q: FlyFormQuestion): string | null;
+    isSelected(q: FlyFormQuestion, optionId: string): boolean;
+    countryOptions(q: FlyFormQuestion): readonly FlySelectOption[];
+    selectOptions(q: FlyFormQuestion): readonly FlySelectOption[];
+    fileNames(q: FlyFormQuestion): string[];
+    acceptFor(q: FlyFormQuestion): string;
+    onText(q: FlyFormQuestion, value: string): void;
+    onNumber(q: FlyFormQuestion, value: string): void;
+    onDate(q: FlyFormQuestion, value: string): void;
+    onBoolean(q: FlyFormQuestion, value: boolean): void;
+    onSingleSelect(q: FlyFormQuestion, value: string | readonly string[] | null): void;
+    onRadio(q: FlyFormQuestion, optionId: string): void;
+    onMultiToggle(q: FlyFormQuestion, optionId: string, checked: boolean): void;
+    onFiles(q: FlyFormQuestion, input: HTMLInputElement): void;
+    onDeclarationToggle(checked: boolean): void;
+    onSubmit(): void;
+    private _touch;
+    private _setFileError;
+    private _mutate;
+    private _emit;
+    private _collectAnswers;
+    private _isAnswered;
+    private _isEmptyValue;
+    private _selectedIds;
     /**
-     * Reactive read of the draggable set published for `appId`. Empty when none. The
-     * returned signal is stable across calls (cached by `appId`), so consumers can use
-     * it as a stable input to `computed()`.
+     * The set of visible field ids for a given answer map. Base (non-branch-target)
+     * fields are always visible; a branch target becomes visible when a
+     * currently-visible field has a selected option that links to it. Computed to a
+     * fixpoint so chained reveals work, and cycle-safe: the visible set only grows and
+     * iteration is capped at `questions.length` passes, so an A↔B link cycle terminates.
+     *
+     * This is the TypeScript twin of the backend Fly.Sdk.Forms `BranchResolver`
+     * fixpoint — the two must stay in lockstep so server + client agree on which fields
+     * are active.
      */
-    draggablesFor(appId: string): Signal<readonly AgentDraggableItem[]>;
-    /** Lazy-init the per-appId writable bucket. Returns the writable handle for internal use. */
-    private bucketFor;
-    private _generation;
-    private readonly _owners;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentDropRegistry, never>;
-    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentDropRegistry>;
+    private _computeVisibleIds;
+    /** Imperative localization for file-validation messages (the pipe covers view strings). */
+    private _t;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyDynamicFormComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyDynamicFormComponent, "fly-dynamic-form, fly-survey-form", never, { "definition": { "alias": "definition"; "required": true; "isSignal": true; }; "isReadonly": { "alias": "readonly"; "required": false; "isSignal": true; }; "hideSubmit": { "alias": "hideSubmit"; "required": false; "isSignal": true; }; "answers": { "alias": "answers"; "required": false; "isSignal": true; }; "showScore": { "alias": "showScore"; "required": false; "isSignal": true; }; "scoreDisplay": { "alias": "scoreDisplay"; "required": false; "isSignal": true; }; }, { "answersChange": "answersChange"; "validityChange": "validityChange"; "submit": "submit"; "fileSelected": "fileSelected"; }, never, never, true, never>;
 }
 
-/**
- * Imperative action published by an app, consumed by the agent panel.
- *
- * Re-uses {@link AgentDragPayload} as the wire envelope so a dragged item
- * and a programmatic "Explain" click are byte-for-byte the same shape —
- * renderers, validators, and serialisation paths never fork on transport.
- *
- * Adding a verb is a minor DS bump (consumers ignore unknown verbs in
- * their `switch`). Removing one is a major DS bump.
- */
-type AgentActionVerb = 'explain' | 'why-empty' | 'compose-query' | 'compare' | 'summarize';
-/**
- * Whether the agent panel sends the staged payload immediately or stages
- * the chip for the user to edit and send manually.
- *
- * Phase 1 (DS v2.6.0) supports `'stage'` only. Dispatching with `'auto'`
- * throws {@link AgentActionUnsupportedDispatchError} so callers don't
- * silently fail. `'auto'` lands once `AgentInputComponent.programmaticSubmit`
- * is exposed and reviewed against the input's state machine.
- */
-type AgentActionDispatch = 'auto' | 'stage';
-interface AgentAction<T = unknown> {
-    /** Intent the agent should apply to {@link payload}. */
-    readonly verb: AgentActionVerb;
-    /** The wire envelope. Validated against {@link validateAgentPayload}'s
-     *  size caps before the bus fans it out. */
-    readonly payload: AgentDragPayload<T>;
-    /** Optional slash command id to bind before send (e.g. `'explain-report'`).
-     *  Phase 1 captures this for telemetry only — actual binding lands when
-     *  the input's programmatic-send API ships. An unknown id is dropped
-     *  silently with a console warning, the chip still arrives. */
-    readonly autoCommandId?: string;
-    /** Phase 1 supports `'stage'` only. See {@link AgentActionDispatch}. */
-    readonly dispatch: AgentActionDispatch;
-    /** Source DOM rect for the FLIP entry animation. Omit to skip the
-     *  animation (e.g. dispatching from a keyboard shortcut with no anchor). */
-    readonly originRect?: DOMRect;
-    /** Optional HTML snippet rendered inside the flight ghost. Callers are
-     *  responsible for escaping untrusted text — the bus does not sanitise.
-     *  Defaults (when omitted) to a strong-wrapped escape of the payload's
-     *  `plainTextFallback` rendered by the panel host. */
-    readonly originPreviewHtml?: string;
+interface FlyCountry {
+    /** ISO 3166-1 alpha-2 code (uppercase), e.g. `AE`. */
+    code: string;
+    /** English display name. */
+    name: string;
+}
+/** Frozen alpha-2 list, alphabetical by English name. */
+declare const FLY_COUNTRIES: readonly FlyCountry[];
+
+/** Backend `CommentReportReason` enum — string-persisted, member names frozen. */
+type FlyCommentReportReason = 'Spam' | 'Harassment' | 'OffTopic' | 'Misinformation' | 'Inappropriate' | 'Other';
+/** Backend `CommentReportStatus` enum — string-persisted, member names frozen. */
+type FlyCommentReportStatus = 'Open' | 'UnderReview' | 'ActionTaken' | 'Dismissed';
+/**
+ * One comment, at any depth. `isDeleted` comments render as a tombstone (the
+ * host still supplies `body`-less structural fields so the reply subtree stays
+ * navigable; the component never assumes `body` is present when `isDeleted`).
+ * `canEdit` / `canDelete` / `canModerate` are pre-resolved by the host (Cerbos
+ * decision or equivalent) — the component never evaluates authorization itself.
+ */
+interface FlyComment {
+    id: string;
+    authorUserId: string;
+    authorDisplayName?: string;
+    authorAvatarUrl?: string;
+    parentCommentId?: string;
+    depth: number;
+    body: string;
+    replyCount: number;
+    isEdited: boolean;
+    isDeleted: boolean;
+    createdAt: string;
+    updatedAt?: string;
+    canEdit: boolean;
+    canDelete: boolean;
+    canModerate: boolean;
 }
 /**
- * Thrown synchronously by {@link AgentActionBus.dispatch} when a caller
- * supplies a dispatch mode this DS version doesn't implement yet. Catching
- * by class name lets a forward-compatible caller fall back to `'stage'`
- * without depending on instanceof across federation boundaries.
+ * A paged slice of comments at one nesting level — mirrors the service's
+ * `GET .../comments?parentCommentId=&page=&pageSize=` shape. Every depth is
+ * paged independently: the root page and each expanded parent's reply page are
+ * separate {@link FlyCommentPage} instances tracked by the host.
  */
-declare class AgentActionUnsupportedDispatchError extends Error {
-    readonly dispatch: AgentActionDispatch;
-    constructor(dispatch: AgentActionDispatch);
+interface FlyCommentPage {
+    items: FlyComment[];
+    page: number;
+    pageSize: number;
+    total: number;
+    hasMore: boolean;
+}
+/** `loadReplies` request — expand a collapsed reply subtree, one page at a time. */
+interface FlyCommentLoadRepliesRequest {
+    parentCommentId: string;
+    page: number;
+}
+/** `loadMore` request — next page at the root level (`parentCommentId` omitted) or under a parent. */
+interface FlyCommentLoadMoreRequest {
+    parentCommentId?: string;
+    page: number;
+}
+/** `submit` request — a new root comment (`parentCommentId` omitted) or a reply. */
+interface FlyCommentSubmitRequest {
+    body: string;
+    parentCommentId?: string;
+}
+/** `edit` request — author-only body edit of an existing comment. */
+interface FlyCommentEditRequest {
+    commentId: string;
+    body: string;
+}
+/** `delete` request — soft delete (tombstone), author or moderator. */
+interface FlyCommentDeleteRequest {
+    commentId: string;
+}
+/** `report` request — typed reason + optional free-text detail. */
+interface FlyCommentReportRequest {
+    commentId: string;
+    reason: FlyCommentReportReason;
+    detail?: string;
+}
+/** `lockToggle` request — moderator lock/unlock of the whole thread. */
+interface FlyCommentLockToggleRequest {
+    locked: boolean;
 }
 
 /**
- * Imperative sibling to {@link AgentCommandRegistry} / {@link AgentDropRegistry}.
+ * **`fly-comment-thread`** — the design-system generic threaded-comments renderer.
  *
- * Apps call {@link dispatch} to push a typed {@link AgentAction} onto the bus;
- * the agent panel subscribes once at construct and routes by verb. The bus
- * itself is a thin pass-through — it does NOT decide UI behaviour. The
- * subscriber (agent-panel) owns: showing the panel, staging the chip,
- * triggering the flight animation, and binding the command. This keeps the
- * DS free of host policy.
+ * Renders a {@link FlyCommentPage} (root comments) plus lazily-fetched nested
+ * reply pages into an accessible, theme-aware thread: reply composer, inline
+ * edit, soft-delete (tombstone render), typed report-with-reason dialog, and
+ * moderator affordances (lock/unlock, delete-any). It is a platform surface —
+ * transport-agnostic like `fly-survey-form` / `fly-dynamic-form`: this component
+ * never calls an API. It only renders the pages the host hands it via
+ * `[rootPage]` / `[repliesByParent]` and emits typed requests
+ * (`loadReplies`/`loadMore`/`submit`/`edit`/`delete`/`report`/`lockToggle`) —
+ * the host owns HTTP, optimistic-insert reconciliation, and any live-update
+ * channel (SignalR, polling, …).
  *
- * Federation-safe: `providedIn: 'root'` + `sharedMappings: ['@flyos/design-system']`
- * give every federated remote the same singleton, so a remote's "Explain"
- * button reaches the host's panel without any cross-bundle wiring.
+ * Nested replies are fetched **lazily on expand** (`loadReplies`, never an
+ * eager load-all) — the explicit fix for the legacy unpaged-children scale bug
+ * — and each level pages independently via `loadMore`.
  *
- * Validation runs synchronously inside `dispatch` so a caller that sends an
- * oversize payload sees the throw at their site, not on the subscriber. The
- * subscriber therefore never has to defend against malformed envelopes.
+ * The `comments` core app owns no user profile data, so `FlyComment` carries
+ * `authorUserId` and an OPTIONAL `authorDisplayName`. Rather than make every host
+ * map names in itself (and render GUIDs when it forgets), bind
+ * `[resolveDisplayName]` to `FlyUserDirectoryService.label` — see
+ * {@link FlyCommentThreadComponent.resolveDisplayName}. Still transport-agnostic:
+ * the resolver is a function the host hands over, not a call this component makes.
+ *
+ * i18n is self-sufficient through the `comment.*` keys in `DS_BASELINE_LOCALES`
+ * (en/ar/fr/ur), overridable by any consumer key of the same name. RTL works via
+ * logical CSS. Styling uses DS theme tokens (`--surface-*`, `--label-*`,
+ * `--separator`, `--fill-*`, `--accent`, `--system-*`) with light-neutral
+ * fallbacks so it stays readable even in a consumer that hasn't mapped them.
+ *
+ * @example
+ * ```html
+ * <fly-comment-thread
+ *   [rootPage]="rootPage()"
+ *   [repliesByParent]="repliesByParent()"
+ *   [currentUserId]="me.id"
+ *   [resolveDisplayName]="directory.label"
+ *   [canModerateThread]="canModerate()"
+ *   [isLocked]="thread().isLocked"
+ *   (loadReplies)="onLoadReplies($event)"
+ *   (loadMore)="onLoadMore($event)"
+ *   (submit)="onSubmit($event)"
+ *   (edit)="onEdit($event)"
+ *   (delete)="onDelete($event)"
+ *   (report)="onReport($event)"
+ *   (lockToggle)="onLockToggle($event)" />
+ * ```
  */
-declare class AgentActionBus {
-    private readonly _actions$;
-    /** Hot stream of actions in dispatch order. Subscribers receive only
-     *  actions dispatched AFTER they subscribe — late subscribers see nothing
-     *  retroactively. Use {@link lastAction} for the latest snapshot. */
-    readonly actions$: Observable<AgentAction>;
-    /** Most recent action — for DevTools, smoke tests, and late-subscriber
-     *  catch-up. Null until the first successful dispatch. */
-    readonly lastAction: _angular_core.WritableSignal<AgentAction<unknown> | null>;
+declare class FlyCommentThreadComponent {
+    /** The root-level comment page (accumulated across `loadMore` calls by the host). */
+    readonly rootPage: _angular_core.InputSignal<FlyCommentPage>;
     /**
-     * The action currently being processed by the subscriber, or null when
-     * none. Set by {@link dispatch} immediately before emitting on
-     * {@link actions$}; cleared by the subscriber via {@link settle} once
-     * it finishes its handler (success or fail). Lets the dispatcher render
-     * a busy state on the originating control — e.g. a card swapping its
-     * sparkle icon for a spinner while the agent panel mints the optimistic
-     * thread and starts the request. Identity check (`bus.inFlight() === act`)
-     * is the panel-side contract; dispatchers usually project to a stable id
-     * inside the payload (e.g. <c>reportId</c>) to scope busy-state visually.
-     *
-     * If multiple dispatches race, the latest wins — the prior in-flight
-     * action is dropped on the floor here (the panel may still handle it,
-     * but the dispatcher's busy indicator follows the newer action). Apps
-     * that need stricter single-flight semantics should guard at the call
-     * site (the agent-panel's <c>_pendingTempThreadId</c> already does so
-     * for the explain verb).
+     * Accumulated reply page per expanded parent (keyed by `parentCommentId`), also
+     * accumulated across `loadMore` calls by the host. Additive to the frozen
+     * contract's `rootPage` input — required because a lazily-nested tree has no
+     * other channel to carry fetched reply data back into the component.
      */
-    readonly inFlight: _angular_core.WritableSignal<AgentAction<unknown> | null>;
+    readonly repliesByParent: _angular_core.InputSignal<Readonly<Record<string, FlyCommentPage>>>;
+    /** Current sort order label (host owns re-fetch on {@link sortChange}; purely descriptive here otherwise). */
+    readonly sort: _angular_core.InputSignal<"newest" | "oldest">;
+    /** Locked threads disable the composer (root + reply) entirely, for every user. */
+    readonly isLocked: _angular_core.InputSignal<boolean>;
+    /** The signed-in user's id — gates the "report" affordance (can't report your own comment). */
+    readonly currentUserId: _angular_core.InputSignal<string | null>;
+    /** Replay / read-only mode — hides composer, reply, edit, delete, report, and lock affordances.
+     *  Aliased to `[readonly]` (the public binding); the class member avoids shadowing the
+     *  TypeScript `readonly` keyword. */
+    readonly isReadonly: _angular_core.InputSignal<boolean>;
+    /** Thread-scoped moderator permission (lock/unlock). Additive — distinct from the
+     *  per-comment `canModerate` flag, which gates delete-any on that specific comment. */
+    readonly canModerateThread: _angular_core.InputSignal<boolean>;
     /**
-     * Push an action onto the bus.
+     * Optional id→name lookup, for the common case where the backend DTO carries only
+     * `authorUserId`. The `comments` core app owns no user profile data, so without
+     * this every host had to map display names into `authorDisplayName` itself — and
+     * a host that forgot rendered raw GUIDs at the reader.
      *
-     * Throws synchronously when:
-     *   - `dispatch === 'auto'` (not implemented in this DS version) — see
-     *     {@link AgentActionUnsupportedDispatchError}.
-     *   - the payload fails {@link validateAgentPayload} (oversize, invalid
-     *     version, invalid kind). The error message carries the field path
-     *     so the caller can fix the offending field.
+     * Bind `FlyUserDirectoryService.label` (a signal-backed read-through cache that
+     * resolves on demand and batches). Because the component reads it during render,
+     * the name appears by itself once the lookup lands — the host keeps a plain
+     * page signal, with no `computed` derivation and no priming.
      *
-     * Subscribers see the action via {@link actions$} on the next tick of
-     * the Subject; the {@link lastAction} signal updates synchronously
-     * before the Subject emits so an effect reading both stays consistent.
-     */
-    dispatch<T>(action: AgentAction<T>): void;
-    /**
-     * Subscriber contract: call after the handler for {@link inFlight}
-     * completes (success or fail). Only clears {@link inFlight} if it still
-     * points at the passed action — a no-op when a later dispatch already
-     * superseded it. Pass the same action reference the subscriber received
-     * from {@link actions$}; identity is the gate.
+     * The component still never calls an API: this is a function the HOST supplies,
+     * exactly like `fly-entity-lookup`'s `LOOKUP_APP_NAME_RESOLVER`. Absent (or
+     * returning `null`), rendering falls back as before. See {@link authorLabel} for
+     * the resolution order.
      */
-    settle(action: AgentAction): void;
+    readonly resolveDisplayName: _angular_core.InputSignal<((userId: string) => string | null) | null>;
+    /** Expand a collapsed reply subtree — always page 1 of that parent. */
+    readonly loadReplies: _angular_core.OutputEmitterRef<{
+        parentCommentId: string;
+        page: number;
+    }>;
+    /** Fetch the next page at a level: root when `parentCommentId` is omitted, else that parent's replies. */
+    readonly loadMore: _angular_core.OutputEmitterRef<{
+        parentCommentId?: string;
+        page: number;
+    }>;
+    /** A new root comment (`parentCommentId` omitted) or reply. */
+    readonly submit: _angular_core.OutputEmitterRef<{
+        body: string;
+        parentCommentId?: string;
+    }>;
+    /** Author-only body edit of an existing comment. */
+    readonly edit: _angular_core.OutputEmitterRef<{
+        commentId: string;
+        body: string;
+    }>;
+    /** Soft delete (tombstone) — author's own comment, or any comment for a moderator. */
+    readonly delete: _angular_core.OutputEmitterRef<{
+        commentId: string;
+    }>;
+    /** Typed report submission. */
+    readonly report: _angular_core.OutputEmitterRef<{
+        commentId: string;
+        reason: FlyCommentReportReason;
+        detail?: string;
+    }>;
+    /** Moderator lock/unlock of the whole thread. */
+    readonly lockToggle: _angular_core.OutputEmitterRef<{
+        locked: boolean;
+    }>;
+    /** Additive: a sort-order pick from the header control — the host re-fetches page 1 in that order. */
+    readonly sortChange: _angular_core.OutputEmitterRef<"newest" | "oldest">;
+    private readonly _base;
+    readonly reportReasons: readonly FlyCommentReportReason[];
+    /** commentIds whose reply subtree is currently expanded/visible. */
+    private readonly _expanded;
+    /** Composer draft text, keyed by parentCommentId (root uses {@link ROOT_DRAFT_KEY}). */
+    private readonly _drafts;
+    /** commentIds whose reply composer box is currently open (distinct from `_expanded`, which toggles the read view). */
+    private readonly _replyBoxOpen;
+    private readonly _editingId;
+    private readonly _editDraft;
+    private readonly _confirmingDeleteId;
+    private readonly _reportingId;
+    private readonly _reportReason;
+    private readonly _reportDetail;
+    readonly rootDraft: _angular_core.Signal<string>;
+    readonly editingId: _angular_core.Signal<string | null>;
+    readonly confirmingDeleteId: _angular_core.Signal<string | null>;
+    readonly reportingId: _angular_core.Signal<string | null>;
+    readonly reportReason: _angular_core.Signal<FlyCommentReportReason | null>;
+    readonly reportDetail: _angular_core.Signal<string>;
+    fieldId(suffix: string): string;
+    isExpanded(commentId: string): boolean;
+    isReplyBoxOpen(commentId: string): boolean;
+    repliesFor(commentId: string): FlyCommentPage | undefined;
+    replyDraft(commentId: string): string;
+    isOwn(comment: FlyComment): boolean;
     /**
-     * Semantic alias of {@link settle} for explicit user-driven cancellation —
-     * e.g. a future "Stop" button in the agent input tray, or a dispatcher
-     * teardown that wants to abandon its own in-flight action. Identical
-     * runtime behaviour (identity check + clear), but the two-method surface
-     * lets the UI distinguish "handler finished" from "user said no" in
-     * telemetry / logs without sniffing a "reason" parameter.
+     * The name to render for a comment's author. Resolution order:
+     * explicit `authorDisplayName` (a host that already knows the name, or a
+     * backend that returns one, always wins) → {@link resolveDisplayName} →
+     * the raw `authorUserId`.
      *
-     * Pass the same action reference returned from {@link inFlight} or held
-     * by the dispatcher; identity is the gate.
+     * The raw id remains the last resort rather than a placeholder: it is stable,
+     * unique, and lets a reader correlate two comments by the same author even
+     * when the directory is unreachable.
      */
-    cancel(action: AgentAction): void;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentActionBus, never>;
-    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentActionBus>;
+    authorLabel(comment: FlyComment): string;
+    /** First character of {@link authorLabel}, for the avatar-initials fallback. */
+    authorInitial(comment: FlyComment): string;
+    canReport(comment: FlyComment): boolean;
+    canReply(): boolean;
+    canDeleteComment(comment: FlyComment): boolean;
+    canEditComment(comment: FlyComment): boolean;
+    formatDate(iso: string): string;
+    onRootDraftChange(value: string): void;
+    submitRoot(): void;
+    toggleReplies(comment: FlyComment): void;
+    private _expand;
+    loadMoreRoot(): void;
+    loadMoreReplies(parentId: string): void;
+    openReplyBox(commentId: string): void;
+    closeReplyBox(commentId: string): void;
+    onReplyDraftChange(commentId: string, value: string): void;
+    submitReply(commentId: string): void;
+    startEdit(comment: FlyComment): void;
+    onEditDraftChange(value: string): void;
+    saveEdit(comment: FlyComment): void;
+    cancelEdit(): void;
+    requestDelete(comment: FlyComment): void;
+    confirmDelete(comment: FlyComment): void;
+    cancelDelete(): void;
+    openReport(comment: FlyComment): void;
+    onReportReasonChange(reason: FlyCommentReportReason): void;
+    onReportDetailChange(value: string): void;
+    submitReport(): void;
+    closeReport(): void;
+    /** Space would otherwise scroll the page while the backdrop (role="button") is focused. */
+    onOverlayBackdropSpace(event: Event): void;
+    toggleLock(): void;
+    onSortPick(next: 'newest' | 'oldest'): void;
+    private _setDraft;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyCommentThreadComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyCommentThreadComponent, "fly-comment-thread", never, { "rootPage": { "alias": "rootPage"; "required": true; "isSignal": true; }; "repliesByParent": { "alias": "repliesByParent"; "required": false; "isSignal": true; }; "sort": { "alias": "sort"; "required": false; "isSignal": true; }; "isLocked": { "alias": "isLocked"; "required": false; "isSignal": true; }; "currentUserId": { "alias": "currentUserId"; "required": false; "isSignal": true; }; "isReadonly": { "alias": "readonly"; "required": false; "isSignal": true; }; "canModerateThread": { "alias": "canModerateThread"; "required": false; "isSignal": true; }; "resolveDisplayName": { "alias": "resolveDisplayName"; "required": false; "isSignal": true; }; }, { "loadReplies": "loadReplies"; "loadMore": "loadMore"; "submit": "submit"; "edit": "edit"; "delete": "delete"; "report": "report"; "lockToggle": "lockToggle"; "sortChange": "sortChange"; }, never, never, true, never>;
 }
 
 /**
- * FLIP-style entry animation for payloads landing in the agent panel.
- *
- * Pure DOM + Web Animations API — no Chart.js, no Angular animations module,
- * no CSS transitions racing layout. Honours `prefers-reduced-motion`: the
- * ghost is appended then removed without animating when the user asked for
- * less motion (so DOM side-effects stay consistent).
- *
- * Lifecycle:
- *   1. The agent panel calls {@link registerTarget} in `ngAfterViewInit`
- *      with its header element.
- *   2. A source app dispatches an `AgentAction` carrying an `originRect`
- *      from `getBoundingClientRect()` on the click target.
- *   3. The bus subscriber calls {@link flyInto} with that rect.
- *   4. The animator creates a fixed-position ghost at the origin, animates
- *      transform + opacity toward the registered target's rect, then
- *      removes itself on `onfinish` / `oncancel`.
- *
- * Uses `getBoundingClientRect()` (physical viewport coords) so the animation
- * is RTL-correct without inset-inline math — the rect already encodes the
- * physical position regardless of `dir`.
- *
- * The 900 ms duration and easing curve are deliberately hardcoded — making
- * them configurable surfaces an API the host can't usefully tune without
- * understanding motion design as a whole.
+ * A proof-of-work challenge issued by `Fly.Sdk.Captcha` (`CaptchaChallenge`).
+ * The solver must find `n` in `[0, maxNumber)` such that
+ * `sha256HexLower(salt + n) === challenge`.
  */
-declare class AgentFlightAnimator {
-    /** Hardcoded — see class doc. */
-    private static readonly DURATION_MS;
-    private static readonly EASING;
-    /** Floor the target/source scale ratio so a tiny target rect doesn't
-     *  collapse the ghost to invisibility before the animation finishes. */
-    private static readonly MIN_SCALE;
-    private targetEl;
-    /** Called by the panel host to publish where flights should land. Pass
-     *  `null` on destroy so a re-mounted panel doesn't leave the animator
-     *  pointing at a detached node. */
-    registerTarget(el: HTMLElement | null): void;
-    /**
-     * Animate a ghost element from {@link from} to the registered target's
-     * rect. No-ops when:
-     *   - no target is registered (silent — panel may not be mounted yet)
-     *   - running outside a browser (SSR safety)
-     *   - the user has `prefers-reduced-motion: reduce` set (DOM is still
-     *     touched so callers see consistent side-effects, but no animation
-     *     runs)
-     *
-     * The ghost is appended to `document.body` (not the panel) so a parent
-     * `overflow: hidden` on the panel can't clip the flight path.
-     */
-    flyInto(from: DOMRect, opts?: {
-        previewHtml?: string;
-    }): void;
-    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentFlightAnimator, never>;
-    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentFlightAnimator>;
+interface FlyCaptchaChallenge {
+    /** Always `"SHA-256"` today. */
+    algorithm: string;
+    /** Lowercase-hex SHA-256 of `salt + number` for the secret solution number. */
+    challenge: string;
+    /** Base64 random salt, unique per challenge. */
+    salt: string;
+    /** HMAC signature binding challenge + maxNumber + expiresAt (server-verified). */
+    signature: string;
+    /** Exclusive upper bound of the search space (difficulty). */
+    maxNumber: number;
+    /** ISO-8601 instant after which the solution is rejected. Echoed back verbatim. */
+    expiresAt: string;
 }
-
 /**
- * Magic-bar contribution contract (UX v2 "Nova", D5 §4).
- *
- * The magic bar is the shell's top-bar toolbar pill. Unlike the fixed right
- * cluster (Help / Tasks / Notifications / assistant orb — shell-owned, an app can
- * never remove it), the pill's contents belong to **whatever view the user is
- * looking at**, and the design's reference implementation re-publishes the whole
- * set on every selection, tab and save (`pubTabActions`). Two consequences shape
- * every type below:
- *
- *  1. **A contribution is a full replace, never a patch.** There is no "add one
- *     action" call, because the publisher never knows what the previous view left
- *     behind. That also collapses D5's `search: null` ("suppress") vs `search`
- *     absent distinction — under full replace both simply mean "this view offers
- *     no search".
- *  2. **Render data and behaviour are separated in the type system.** Each family
- *     has a `*Spec` base carrying ONLY the fields that affect what is painted;
- *     the publisher-facing type extends it with callbacks, and the shell-facing
- *     `*View` type extends it with bound invokers. The base IS the equality
- *     surface {@link MagicBarRegistry} dedupes on — a re-publish whose specs are
- *     unchanged must not disturb the shell, even though its closures are brand
- *     new objects every time (an arrow function in a component method never
- *     compares equal to its predecessor). See `magic-bar-projection.ts`.
- *
- * **Strings are i18n keys, never resolved text** — same rule as
- * {@link AgentCommandRegistration} (`labelKey` / `descriptionKey` / `hintKey`),
- * for the same two reasons: a contribution outlives a locale switch (a resolved
- * label would silently go stale until the publisher happened to re-publish), and
- * keys are locale-invariant so the dedupe fingerprint doesn't churn when the user
- * changes language. Keys resolve in the OWNING app's bundle.
- *
- * **Every `*Key` has an optional `*Params` sibling** ({@link MagicBarTextParams}),
- * fed straight to `I18nService.t(key, params)`. Without it a count-carrying string
- * ("Search 1,204 tasks…") forces the publisher to pass pre-formatted TEXT as the
- * key: it renders correctly in `en`, renders identically untranslated in ar/fr/ur,
- * and no locale tool can see it. Params participate in the dedupe fingerprint, so
- * a changing count re-paints.
- *
- * Which of D5 §4's "dynamics the shell must honor" live where:
- *
- * | # | Dynamic | Owner |
- * |---|---|---|
- * | 1 | Live re-publication, idempotent replace | {@link MagicBarRegistry} (here) |
- * | 2 | Disabled ≠ hidden, auto disabled-tooltip | contract keeps `disabled` rows; `fly-magic-actions` renders + suffixes |
- * | 3 | `toolbarPopIn` 40 ms stagger | renderer — it tracks on {@link MagicBarActionSpec.id}, which is why ids are unique across the WHOLE contribution |
- * | 4 | i18n on every label/tip | contract (keys + params, above) |
- * | 5 | Fixed right cluster is not contributable | contract — no slot exists for it |
- * | 6 | Mobile renders the same contribution | contract carries no form-factor branch; `openWidth` is a desktop hint mobile ignores |
- * | 7 | `shortcut` reserved (design has no shortcut affordance yet) | contract — carried, unrendered |
- *
- * On dynamic 3 specifically: the registry's dedupe does NOT stop the stagger
- * replaying, and believing it does would produce a renderer that re-animates on
- * every click. Dedupe fires only when *nothing painted* changed, and the dominant
- * case — `disabled: !hasSelection` — changes the fingerprint on every selection.
- * What holds the DOM still is the renderer's `@for (…; track item.id)`.
+ * The solved payload, matching `Fly.Sdk.Captcha.CaptchaSolution` field-for-field
+ * (camelCase Web JSON). Serialized to the opaque base64 token the backend decodes:
+ * `base64(utf8(JSON.stringify(solution)))` — i.e. `Convert.ToBase64String` +
+ * `JsonSerializerDefaults.Web`. Every field except `number` is echoed from the
+ * challenge unchanged so the server's stateless signature check passes.
  */
-/** How an action paints. `'text'` is the labelled-pill form (calendar's "Today"). */
-type MagicBarActionKind = 'icon' | 'text' | 'toggle';
+interface FlyCaptchaSolution {
+    algorithm: string;
+    challenge: string;
+    salt: string;
+    number: number;
+    signature: string;
+    maxNumber: number;
+    expiresAt: string;
+}
+/** The solver lifecycle surfaced by the component's `state()` signal. */
+type FlyCaptchaState = 'idle' | 'verifying' | 'verified' | 'expired' | 'error';
+
+/** Lowercase-hex SHA-256 of `input` via Web Crypto — matches `Convert.ToHexStringLower(SHA256…)`. */
+declare function flyCaptchaSha256Hex(input: string): Promise<string>;
+/** Standard base64 of the UTF-8 bytes of `s` — matches .NET `Convert.ToBase64String`. */
+declare function flyCaptchaBase64Utf8(s: string): string;
 /**
- * Semantic colour of an action. `'danger'` is the red Delete treatment (red glyph
- * + red 18 % hover tint, D7); `'success'` is the green "Mark as complete" pressed
- * state (D5 §1.4 + §4 prop table: "pressed bg tint-sel / green for complete").
- *
- * A union rather than the boolean `danger` this started as: the design already
- * demands a second colour, and widening a shipped `danger?: boolean` into a union
- * later would mean REMOVING an interface member — MAJOR under `tools/ds-compat`
- * (rule 7), which forks the federation singleton for every remote.
+ * Builds the opaque base64 token the backend's `CaptchaSolution.FromToken` expects.
+ * Exported so a host (or a test) can construct/verify the token shape without the
+ * component.
  */
-type MagicBarTone = 'default' | 'danger' | 'success';
+declare function flyCaptchaBuildToken(solution: FlyCaptchaSolution): string;
 /**
- * Interpolation params for one i18n key — the `params` argument of
- * `I18nService.t(key, params)`, substituting `{{name}}` placeholders.
+ * **`fly-captcha`** — the design-system client for the self-hosted proof-of-work
+ * captcha (`Fly.Sdk.Captcha`).
  *
- * Values are `string | number` only: the fingerprint has to encode them, and the
- * renderer resolves them through `t()`, which stringifies. A `Date` or a nested
- * object would fingerprint as `{}` and paint as `[object Object]`.
- */
-type MagicBarTextParams = Readonly<Record<string, string | number>>;
-/**
- * Identity of a contribution's publisher, and the arbitration key the shell uses
- * to pick which contribution the bar renders.
+ * Given a {@link FlyCaptchaChallenge}, it brute-forces `n` in `[0, maxNumber)`
+ * until `sha256HexLower(salt + n) === challenge`, then emits the solution as the
+ * base64 token the backend decodes ({@link flyCaptchaBuildToken}). The search
+ * hashes candidates with a vendored **synchronous** SHA-256 ({@link sha256HexSync}
+ * from `./sha256` — no `crypto.subtle`/promise overhead per candidate, which used
+ * to dominate solve time), in chunks scheduled on `requestAnimationFrame` so a
+ * chunk boundary still yields back to the browser between slices. It auto-starts
+ * whenever the `[challenge]` input changes. Implements
+ * {@link ControlValueAccessor} so it drops into a reactive form / `[(ngModel)]` —
+ * the control value IS the token string.
  *
- * `windowId` is optional but strongly preferred: two windows of the same app can
- * be open on different selections, and keying on `appId` alone would let the
- * background one paint the focused one's toolbar. It is optional only because a
- * federated remote that predates per-window plumbing can still contribute —
- * {@link MagicBarRegistry} resolves an `appId`-keyed slot as a fallback.
+ * Expiry is the host's concern to refresh: the component checks `expiresAt` up
+ * front and while solving, emits {@link expired}, and stops. i18n is
+ * self-sufficient via the `captcha.*` baseline keys; RTL works via logical CSS.
  *
- * It only has to be unique **within the publishing app** (the shell passes its own
- * `win-<appId>-<timestamp>` window id; a tab index or a route-derived id is equally
- * valid) — {@link magicBarOwnerKey} scopes it by `appId`, so a value another app
- * also uses can never cross over.
+ * @example
+ * ```html
+ * <fly-captcha [challenge]="challenge()" (solved)="post($event)" (expired)="refresh()" />
+ * ```
  */
-interface MagicBarOwnerRef {
-    readonly appId: string;
-    readonly windowId?: string;
+declare class FlyCaptchaComponent implements ControlValueAccessor, OnDestroy {
+    /** The challenge to solve. Setting (or replacing) it auto-starts a fresh solve. */
+    readonly challenge: _angular_core.InputSignal<FlyCaptchaChallenge | null>;
+    /** Candidates hashed synchronously in one slice before yielding back to the browser
+     *  on the next animation frame. Higher = fewer `requestAnimationFrame` hops (each
+     *  carries ~16ms of frame-boundary overhead), more synchronous work per slice.
+     *  20,000 keeps a slice's own hashing time well under a long-task budget on modern
+     *  hardware (the vendored sync SHA-256 does several hundred thousand hashes/sec)
+     *  while needing only a handful of hops to clear the library's default difficulty. */
+    readonly chunkSize: _angular_core.InputSignal<number>;
+    /** The solution token once solved — the exact string to POST back to the backend. */
+    readonly solved: _angular_core.OutputEmitterRef<string>;
+    /** The challenge expired (up-front or mid-solve). The host should request a new one. */
+    readonly expired: _angular_core.OutputEmitterRef<void>;
+    readonly state: _angular_core.WritableSignal<FlyCaptchaState>;
+    readonly token: _angular_core.WritableSignal<string | null>;
+    /** Monotonic generation — bumped on every restart/destroy so a stale async chunk
+     *  or timer that captured an older generation no-ops instead of racing. */
+    private _gen;
+    private _raf;
+    private _expiryTimer;
+    private _onChange;
+    private _onTouched;
+    constructor();
+    ngOnDestroy(): void;
+    private _restart;
+    /**
+     * Hashes `[start, end)` synchronously with {@link sha256HexSync} — no per-candidate
+     * `await`, so there is no promise/microtask overhead between candidates — then
+     * yields to the next animation frame for the remainder. Bails to `error` state if
+     * hashing itself throws (defensive; a pure function over a short string should not)
+     * or if the whole `[0, maxNumber)` space is exhausted with no match, which means the
+     * challenge is corrupt or was tampered with.
+     */
+    private _solveChunk;
+    private _onSolved;
+    private _cancel;
+    private _schedule;
+    private _cancelSchedule;
+    writeValue(value: string | null): void;
+    registerOnChange(fn: (v: string | null) => void): void;
+    registerOnTouched(fn: () => void): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyCaptchaComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyCaptchaComponent, "fly-captcha", never, { "challenge": { "alias": "challenge"; "required": false; "isSignal": true; }; "chunkSize": { "alias": "chunkSize"; "required": false; "isSignal": true; }; }, { "solved": "solved"; "expired": "expired"; }, never, never, true, never>;
 }
+
 /**
- * Storage/arbitration key for an owner. Exported because the shell computes it
- * on the janitor path (`clear` after a window closes) without holding the
- * publisher.
+ * Singleton registry of slash commands offered by the agent input palette.
  *
- * **Both fields key the slot**, even though the shell's own ids
- * (`win-<appId>-<timestamp>`) are already unique. `windowId` is publisher-supplied
- * DATA that crosses the federation boundary, and the field is documented only as
- * "two windows of the same app" — nothing stops a remote passing a tab index or a
- * route-derived id. Keyed on `windowId` alone, two apps that both call their first
- * window `"1"` would share a slot: one silently paints the other's chrome, and the
- * shell's janitor `clear()` wipes the wrong one.
+ * Lives in the DS so it crosses the federation boundary as a single instance via
+ * `sharedMappings: ['@flyos/design-system']`. Federated remotes register
+ * their commands at boot (and dispose on window close) without forking the shell.
+ *
+ * Storage is a signal store. `register` is O(1) for the unique-id case and O(n) when
+ * replacing an existing id (filter then push). The append-then-replace strategy is
+ * deliberate: registrations are rare (each one corresponds to a remote's app-init
+ * effect), and the tradeoff buys us a stable id-collision contract — the *latest*
+ * registration wins, and the previous handle's `dispose()` becomes a no-op rather
+ * than removing the new entry.
  */
-declare function magicBarOwnerKey(owner: MagicBarOwnerRef): string;
-/** One `menuitemradio` row. `value` is the publisher's own vocabulary. */
-interface MagicBarRadioOption {
-    readonly value: string;
+declare class AgentCommandRegistry {
+    private readonly _commands;
+    /** All currently-registered commands, in insertion order. */
+    readonly all: Signal<readonly AgentCommandRegistration[]>;
     /**
-     * i18n key for this row. Required, and it stays required — the overwhelming case is a fixed
-     * vocabulary (statuses, sort orders) that MUST translate. When {@link label} is supplied this
-     * is the accessible fallback used if the row's data-derived text is ever empty, so give it a
-     * generic key ("Untitled") rather than inventing a per-value one.
+     * Returns a signal of commands whose scope is `'global'` OR whose `scope.appId` is in
+     * the live app set. The signal recomputes when either the registry or `liveAppIds`
+     * changes — pass a `Signal<ReadonlySet<string>>` from the host's app-registry service
+     * for reactive filtering.
      */
-    readonly labelKey: string;
-    /** Params for {@link labelKey} — the count-badged option ("All statuses ({{count}})"). */
-    readonly labelParams?: MagicBarTextParams;
+    visible(liveAppIds: ReadonlySet<string> | Signal<ReadonlySet<string>>): Signal<readonly AgentCommandRegistration[]>;
     /**
-     * ALREADY-RESOLVED display text, for a row whose label is TENANT DATA rather than a caption —
-     * a campaign name, an area of focus, an owner. When present it wins over {@link labelKey}.
-     *
-     * ## Why this had to exist
-     * Everything else in this contract is an i18n key, deliberately (see the module header). But a
-     * key can only name a string the APP ships in its locale bundles, and a tenant's campaign names
-     * are rows in their database. Without this field a publisher had exactly two bad options: put
-     * the name in `labelKey`, which renders correctly in `en`, renders identically untranslated in
-     * ar/fr/ur, and is invisible to every locale tool; or leave the filter out of the bar entirely.
-     * Thoughts' `top-trending` chose the second and kept its campaign/area filters in-page — that
-     * is the gap this closes.
-     *
-     * ## What it does NOT license
-     * Do not use it for captions. If the string is something your app authored — "All statuses",
-     * "Newest first", an action name — it belongs in a locale bundle and `labelKey` is the field.
-     * The test is where the string comes from: shipped with the app ⇒ `labelKey`; read from the
-     * tenant's data ⇒ `label`. A resolved caption here is untranslatable text smuggled past the
-     * locale tooling, which is precisely what the key-only rule exists to prevent.
+     * Register a single command. Returns a handle whose `dispose()` removes the row by
+     * id. If the same id is later re-registered, the original handle's `dispose()`
+     * becomes a no-op (the newer registration owns the row). Idempotent disposal.
+     */
+    register(cmd: AgentCommandRegistration): AgentCommandHandle;
+    /**
+     * Bulk register. Rolls back on duplicate id within the input batch (throws before any
+     * row lands). Cross-batch duplicates against existing rows follow the standard
+     * "latest wins" rule and do NOT trigger rollback.
      *
-     * It participates in the dedupe fingerprint, so a renamed campaign repaints.
+     * Returns a handle whose `dispose()` tears down every row registered by this call.
      */
-    readonly label?: string;
-}
-/** Render surface of a radio menu — the dedupe key for {@link MagicBarRadioMenu}. */
-interface MagicBarRadioMenuSpec {
-    /** Eyebrow above the options ("Filter by status" / "Sort by"). */
-    readonly titleKey: string;
-    /** Params for {@link titleKey}. */
-    readonly titleParams?: MagicBarTextParams;
-    readonly options: readonly MagicBarRadioOption[];
-    /** Current selection — check glyph + 600 weight on the matching row. */
-    readonly value: string;
-    /** The unfiltered/unsorted baseline; the trigger shows its accent dot iff `value !== defaultValue`. */
-    readonly defaultValue: string;
-}
-/** What a publisher supplies for a radio menu. */
-interface MagicBarRadioMenu extends MagicBarRadioMenuSpec {
-    readonly onSelect?: (value: string) => void;
-}
-/** What the shell renders. `select` always exists; it no-ops when the publisher supplied no handler. */
-interface MagicBarRadioMenuView extends MagicBarRadioMenuSpec {
-    select(value: string): void;
+    registerAll(cmds: readonly AgentCommandRegistration[]): AgentCommandHandle;
+    /** Tear down by id. Idempotent. */
+    unregister(id: string): void;
+    /** Monotonic counter; identifies which registration call currently owns each id. */
+    private _generation;
+    /** id → generation. Used so a stale handle's `dispose()` is a no-op after replacement. */
+    private readonly _owners;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentCommandRegistry, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentCommandRegistry>;
 }
+
 /**
- * Render surface of an action — the dedupe key for {@link MagicBarAction}.
+ * Singleton registry of entity lookups offered by the `/lookup` typeahead.
  *
- * `id` must be unique across the WHOLE contribution (every group, plus `primary`
- * and `overflow`), not merely within its group: it is the address the shell's
- * invoker resolves against the publisher's latest handlers.
+ * Mirrors {@link AgentCommandRegistry}'s federation-singleton story
+ * (`sharedMappings: ['@flyos/design-system']`), id-collision
+ * "latest wins" contract, and disposable-handle ergonomics. OS-core entities
+ * (note / calendar event / file) register once at shell bootstrap via
+ * `CORE_APP_LOOKUPS`; federated remotes (Circles: scenario / trend / signal)
+ * register at remote-component boot and dispose on window close.
+ *
+ * **Scope semantics diverge from commands.** Commands HIDE when their `appId`
+ * isn't in `liveAppIds`. Lookups DO NOT — they're always offered, and
+ * `{appId}` is just a *priority hint* that bumps that lookup to the top of
+ * the entity picker when the app is live. See {@link LookupRegistration.scope}
+ * for the rationale.
+ *
+ * Storage is a signal store keyed on {@link LookupRegistration.entity}. Because
+ * `entity` is the collision key, an app re-registering the same entity replaces
+ * the prior descriptor; a stale handle's `dispose()` then no-ops.
  */
-interface MagicBarActionSpec {
-    readonly id: string;
-    /** i18n key — the `aria-label` and the default tooltip. */
-    readonly labelKey: string;
-    /** Params for {@link labelKey}, e.g. `{ count: 3 }` for "Delete {{count}} items". */
-    readonly labelParams?: MagicBarTextParams;
+declare class AgentLookupRegistry {
+    private readonly _lookups;
+    /** All currently-registered lookups, in insertion order. */
+    readonly all: Signal<readonly LookupRegistration[]>;
     /**
-     * Inner-SVG geometry for a 24×24 glyph (`stroke-width: 1.8`, round caps) —
-     * the design's icon transport. Reference {@link FLY_MAGIC_BAR_ICONS} by name
-     * rather than hand-authoring; a publisher MAY author its own, subject to the
-     * contract below.
+     * All registered lookups, sorted by affinity to `liveAppIds`:
      *
-     * **This value is not trusted.** The renderer parses it against a closed
-     * allowlist — self-closing `path`/`circle`/`rect`/`ellipse`/`line`/`polyline`/
-     * `polygon` elements carrying geometry attributes only (`d`, `cx`, `points`,
-     * …) — and binds the result as real attributes. It is never assigned as HTML.
-     * Anything else (a container element, an `on*` handler, `style`, `href`,
-     * `fill="url(…)"`, a stray text node) rejects the WHOLE fragment: the button
-     * renders with no glyph and logs. See `magic-actions-icon.ts`.
+     *   1. Lookups whose `scope.appId` is in the live app set (in registration
+     *      order within that bucket).
+     *   2. Then everything else — `'global'` lookups AND scoped lookups whose
+     *      app isn't currently live — in registration order.
      *
-     * The type stays `string` deliberately. Narrowing it to a branded/opaque type
-     * would be a ds-compat MAJOR, and it would not buy anything the renderer's own
-     * validation does not already guarantee — a nominal type describes where a
-     * value came from, not what it contains.
-     */
-    readonly iconPath?: string;
-    /** Default `'icon'`. */
-    readonly kind?: MagicBarActionKind;
-    /** Dimmed (`opacity .38`), NEVER hidden — a vanishing action teaches the user nothing. */
-    readonly disabled?: boolean;
-    /**
-     * Tooltip override while disabled. Absent is the normal case: the renderer
-     * auto-suffixes the resolved label ("… — select an item first"). Resolution
-     * and the connector phrasing are the renderer's job precisely because they are
-     * locale work, and this store holds keys rather than text.
-     */
-    readonly disabledTipKey?: string;
-    /** Params for {@link disabledTipKey}. */
-    readonly disabledTipParams?: MagicBarTextParams;
-    /** Tooltip override while enabled. Absent → the renderer uses `labelKey`. */
-    readonly tipKey?: string;
-    /** Params for {@link tipKey}. */
-    readonly tipParams?: MagicBarTextParams;
-    /**
-     * Semantic colour. Default `'default'`; `'danger'` is the ONLY thing that makes
-     * an icon red (D7), `'success'` the green completed-toggle treatment.
+     * Recomputes when either the registry or `liveAppIds` changes. Pass a
+     * `Signal<ReadonlySet<string>>` from the host's app-registry for reactive
+     * re-sorting. **Always returns the full registry** — see the type doc on
+     * {@link LookupRegistration.scope} for why this differs from
+     * {@link AgentCommandRegistry.visible}.
      */
-    readonly tone?: MagicBarTone;
-    /** `aria-pressed` for `kind: 'toggle'`. */
-    readonly pressed?: boolean;
-    /** Small accent dot — a non-default filter/sort is active. */
-    readonly badgeDot?: boolean;
+    visible(liveAppIds: ReadonlySet<string> | Signal<ReadonlySet<string>>): Signal<readonly LookupRegistration[]>;
     /**
-     * Reserved (D5 §4 item 7). The designs carry no keyboard-shortcut affordance
-     * anywhere; the field exists so adding one later is a renderer change rather
-     * than a contract break. Nothing renders it today.
+     * Register one lookup. Returns a handle whose `dispose()` removes the row by
+     * `entity`. A later re-registration of the same entity makes the original
+     * handle's `dispose()` a no-op (the newer registration owns the row).
      */
-    readonly shortcut?: string;
-}
-/** What a publisher supplies for one action. */
-interface MagicBarAction extends MagicBarActionSpec {
-    readonly menu?: MagicBarRadioMenu;
+    register(lookup: LookupRegistration): LookupHandle;
     /**
-     * Invoked on activation. The argument is the DOM element the renderer painted
-     * for this action — see {@link MagicBarActionView.run} for why it is passed and
-     * what a publisher may do with it. Ignore it and this is the zero-argument
-     * handler it has always been.
+     * Bulk register. Rolls back on a duplicate entity WITHIN the input batch
+     * (throws before any row lands). Cross-batch duplicates against existing rows
+     * follow the standard "latest wins" rule and do NOT trigger rollback.
      */
-    readonly onSelect?: (trigger?: HTMLElement) => void;
-}
-/**
- * What the shell renders. `run()` always exists and always dispatches to the
- * publisher's LATEST handler for this id — including after a re-publish the
- * registry deliberately did not propagate (see `magic-bar-projection.ts`).
- */
-interface MagicBarActionView extends MagicBarActionSpec {
-    readonly menu: MagicBarRadioMenuView | null;
+    registerAll(lookups: readonly LookupRegistration[]): LookupHandle;
     /**
-     * Fire the publisher's newest handler for this id.
-     *
-     * ## Why it carries the trigger element
-     * An action that opens a POPOVER the publisher owns — the canonical case is a
-     * listing screen's advanced-filter panel — has to position that popover under
-     * the button the user just pressed. The publisher cannot find that button:
-     * embedded, it is painted by `fly-magic-actions` inside the shell's top-bar
-     * pill, in the shell's DOM, several stacking contexts and one federation
-     * boundary away from the remote that published the action. Before this argument
-     * existed, PPM's projects register had to anchor its panel to its own page
-     * header instead, which put the panel in the middle of the window while the
-     * button that opened it sat in the chrome above — an affordance with no visible
-     * relationship to its own trigger.
+     * Resolve a deep-link anchor to a concrete launch target.
      *
-     * Passing the element rather than modelling the popover is deliberate. The
-     * panel's CONTENT is app schema (see {@link MagicBarSearch.onOpenFilters} for
-     * the same ruling), so it must stay in the publisher's own DOM and injection
-     * context; only its POSITION is chrome-relative. An element reference crosses
-     * the federation boundary without any of the coupling a descriptor would need —
-     * a DOM node is a DOM node in every bundle. `fly-filter-panel`'s `[anchorEl]`
-     * is the intended consumer.
+     * `kind` is the dotted `<appId>.<entity>` token the agents backend emits
+     * inside `flyos:<kind>/<id>` chat-answer anchors — the same entity-kind
+     * vocabulary as drag-payload kinds and `ref` parts. Returns
+     * `{ appId, route }` when a registered lookup for that `(appId, entity)`
+     * pair carries a {@link LookupDescriptor.deepLinkRoute} template; `null`
+     * otherwise (unknown entity, app mismatch, or no template — e.g. the
+     * owning app isn't installed) so the caller renders plain text rather than
+     * a dead link.
      *
-     * ## What a publisher must not assume
-     * The element is the trigger AS PAINTED RIGHT NOW. It is valid for the duration
-     * of the popover, not beyond: a re-publish that drops this action id destroys it
-     * (`@for (…; track action.id)`), and a mode switch repaints it in a different
-     * chrome entirely. Hold it in a signal the popover's open-state clears, never in
-     * long-lived state, and never mutate it.
+     * `appId` and `entity` are both dot-free by their own grammars, so the
+     * FIRST dot is the unambiguous split point; a dotless `kind` can't carry an
+     * app and never resolves. The template's single `{id}` placeholder is
+     * substituted URL-encoded.
+     */
+    resolveDeepLink(kind: string, id: string): {
+        readonly appId: string;
+        readonly route: string;
+    } | null;
+    /**
+     * Resolve a deep-link target from a bare `(entity, id)` pair — the shape a
+     * `/lookup` ref carries (it has no `<appId>.<entity>` kind token; the owning
+     * app is implicit in the registered descriptor). `entity` is the registry's
+     * unique storage key, so it identifies the descriptor unambiguously without
+     * an app prefix.
      *
-     * It is OPTIONAL because not every renderer has one to give — a keyboard-driven
-     * invocation, a synthetic call in a test, an inline composer that paints no
-     * button. A publisher that receives `undefined` must still work: for a popover
-     * that means falling back to its own in-page anchoring, which is exactly what
-     * `fly-filter-panel` does when `[anchorEl]` is null.
+     * Returns `{ appId, route }` (the descriptor's {@link LookupDescriptor.appId}
+     * / affinity `scope.appId` as the owner, `{id}` substituted URL-encoded) when
+     * a matching descriptor carries a {@link LookupDescriptor.deepLinkRoute};
+     * `null` otherwise (unknown entity, no template, or the owning app has since
+     * unregistered) so callers render plain text rather than a dead link — the
+     * same graceful-degrade contract as {@link resolveDeepLink}.
      */
-    run(trigger?: HTMLElement): void;
-}
-/** Render surface of a group — the dedupe key for {@link MagicBarGroup}. */
-interface MagicBarGroupSpec {
-    readonly id: string;
-    /** i18n key for the `role="group"` aria-label ("Signal actions"). */
-    readonly labelKey: string;
-    /** Framed variant: 2 px gaps + a trailing separator. Plain (default) uses 8 px gaps. */
-    readonly framed?: boolean;
-}
-interface MagicBarGroup extends MagicBarGroupSpec {
-    readonly items: readonly MagicBarAction[];
-}
-interface MagicBarGroupView extends MagicBarGroupSpec {
-    readonly items: readonly MagicBarActionView[];
+    resolveDeepLinkForEntity(entity: string, id: string): {
+        readonly appId: string;
+        readonly route: string;
+    } | null;
+    /** Tear down by entity. Idempotent. */
+    unregister(entity: string): void;
+    /** Monotonic counter; identifies which registration call currently owns each entity. */
+    private _generation;
+    /** entity → generation. Lets a stale handle's `dispose()` no-op after replacement. */
+    private readonly _owners;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentLookupRegistry, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentLookupRegistry>;
 }
+
 /**
- * Render surface of the expanding search field — the dedupe key for
- * {@link MagicBarSearch}.
+ * Singleton registry of chip-renderer components and keyboard-alternative draggable
+ * items, keyed by `kind` and `appId`.
  *
- * This is a per-page typeahead, NOT a command palette: neither design package
- * has a global ⌘K surface, and the only "command" affordance is the Ask-AI menu.
+ * Like {@link AgentCommandRegistry}, this lives in the DS so it crosses the federation
+ * boundary as a single instance. Hosts (the shell `<fly-agent-input>`) lookup
+ * renderers; remotes register them.
+ *
+ * Renderer lookup is `O(n)` over the registered list — the registry is small (one or
+ * two entries per app) and lookups happen on drop, not per frame.
+ *
+ * Draggable storage is per-`appId` writable signal cached in a Map, so each `appId`
+ * gets a stable {@link Signal} reference across reads (callers can `===`-compare).
  */
-interface MagicBarSearchSpec {
-    /** Context-aware placeholder key ("Search tasks…", "Search events…"). */
-    readonly placeholderKey: string;
-    /** Params for {@link placeholderKey}, e.g. `{ count: 1204 }` for "Search {{count}} tasks…". */
-    readonly placeholderParams?: MagicBarTextParams;
+declare class AgentDropRegistry {
+    private readonly _renderers;
+    /** Per-appId writable store for draggables. Read-only mirror returned to callers. */
+    private readonly _draggablesByApp;
     /**
-     * The text the search field should SHOW — literal text, not an i18n key, because
-     * it is the user's own query rather than a caption.
-     *
-     * Exists because a view can arrive **already filtered**: a deep link carrying
-     * `?q=…`, a restored session, a filter applied from a detail pane. Without it the
-     * box renders empty over a visibly filtered list, and the user is looking at a
-     * contradiction the chrome cannot explain.
-     *
-     * ## Why it is not called `query`
-     * {@link MagicBarSearchView} — which extends this interface — already declares
-     * `query(text: string): void`, the late-bound invoker. A `query?: string` here
-     * would make that view an illegal extension (TS2430: `(text: string) => void` is
-     * not assignable to `string | undefined`), and the only other way out — renaming
-     * the invoker — removes a member of a shipped exported interface, which is a
-     * ds-compat MAJOR (rule 7) and forks the federation singleton for every remote.
-     * So the field takes the name that pairs with the invoker instead of colliding
-     * with it: `queryText` is the text, `query()` submits it.
-     *
-     * ## Precedence — this is a SEED, not a controlled value
-     * The field's live text is owned by the **shell**, because the user types into
-     * it. This field is the publisher's chance to move it, and the shell adopts the
-     * published value exactly three times:
-     *
-     *  1. the first time it binds this view,
-     *  2. when {@link MagicBarContribution.viewKey} changes (reset-on-navigate — the
-     *     previous view's query must not survive into the next one), and
-     *  3. when the published value **itself changes** from the one previously
-     *     published.
-     *
-     * A re-publish carrying an UNCHANGED `queryText` never touches what the user has
-     * typed. That third clause is the whole rule: the dominant re-publish is
-     * `disabled: !hasSelection` flipping on a selection change, and a shell that
-     * re-read `queryText` on every emitted view would revert a keystroke every time
-     * the user selected a row mid-search — the classic controlled-input bug. The rule
-     * is authored once, as {@link magicBarSearchText}, so no renderer re-derives it.
-     *
-     * `undefined` and `''` are **different** and the difference is load-bearing:
-     * absent means "this view does not manage the field" (nothing is ever forced),
-     * `''` means "clear it". Both the fingerprint and the seed comparison distinguish
-     * them.
+     * Look up the chip-renderer component class for a `kind`. The newest registration for
+     * a given `kind` wins, regardless of `appId` — we scan the list in reverse so a later
+     * `register` call shadows an earlier one for the same `kind`.
      *
-     * ## Do not echo the user's keystrokes back through this field
-     * A publisher that mirrors its `onQuery` argument straight back into `queryText`
-     * is harmless (the seed changes to text the field already shows). A publisher
-     * that mirrors it back **debounced** is not: typing "abc" then publishing
-     * `queryText: 'a'` 300 ms later is, by rule 3, a genuine publisher-initiated
-     * change, and the field snaps back to "a". Publish here only for state the view
-     * owns independently of the field.
+     * Returns `null` when no renderer is registered; the host falls back to a generic
+     * `plainTextFallback` chip.
      */
-    readonly queryText?: string;
+    rendererFor(kind: string): Type<AgentChipHostInputs> | null;
     /**
-     * Expanded width in px — a **desktop layout hint**, carried verbatim.
+     * Register a renderer for a `(kind, appId)` pair. Re-registering the same pair
+     * replaces the prior entry; the disposal handle for the prior registration becomes
+     * a no-op.
      *
-     * The design's range is 140–420 (default 230), but this store deliberately does
-     * NOT validate or clamp it: enforcing a paint range here would reject a whole
-     * contribution over a cosmetic hint (leaving the previous view's actions in the
-     * chrome), and mobile ignores the field entirely, so there is no single range to
-     * enforce. `fly-magic-actions` clamps to the design range at paint time and is
-     * the only place that decides what an out-of-range or non-finite value means.
+     * Returns a {@link AgentCommandHandle} (re-used to keep the disposable shape uniform
+     * across registries) whose `dispose()` removes this exact registration.
      */
-    readonly openWidth?: number;
-    /** Accent dot on the Filters button — a non-default filter is applied. */
-    readonly filtersActive?: boolean;
+    register<T = unknown>(reg: AgentDropRendererRegistration<T>): AgentCommandHandle;
+    /**
+     * Apps publish their live "draggable from focused window" set so the keyboard
+     * "Attach from app…" menu can offer them. Hosts call this each time the user-visible
+     * draggable list changes; passing an empty array clears the entry for this `appId`.
+     */
+    publishDraggables(appId: string, items: readonly AgentDraggableItem[]): void;
+    /**
+     * Reactive read of the draggable set published for `appId`. Empty when none. The
+     * returned signal is stable across calls (cached by `appId`), so consumers can use
+     * it as a stable input to `computed()`.
+     */
+    draggablesFor(appId: string): Signal<readonly AgentDraggableItem[]>;
+    /** Lazy-init the per-appId writable bucket. Returns the writable handle for internal use. */
+    private bucketFor;
+    private _generation;
+    private readonly _owners;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentDropRegistry, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentDropRegistry>;
+}
+
+/**
+ * Imperative action published by an app, consumed by the agent panel.
+ *
+ * Re-uses {@link AgentDragPayload} as the wire envelope so a dragged item
+ * and a programmatic "Explain" click are byte-for-byte the same shape —
+ * renderers, validators, and serialisation paths never fork on transport.
+ *
+ * Adding a verb is a minor DS bump (consumers ignore unknown verbs in
+ * their `switch`). Removing one is a major DS bump.
+ */
+type AgentActionVerb = 'explain' | 'why-empty' | 'compose-query' | 'compare' | 'summarize';
+/**
+ * Whether the agent panel sends the staged payload immediately or stages
+ * the chip for the user to edit and send manually.
+ *
+ * Phase 1 (DS v2.6.0) supports `'stage'` only. Dispatching with `'auto'`
+ * throws {@link AgentActionUnsupportedDispatchError} so callers don't
+ * silently fail. `'auto'` lands once `AgentInputComponent.programmaticSubmit`
+ * is exposed and reviewed against the input's state machine.
+ */
+type AgentActionDispatch = 'auto' | 'stage';
+interface AgentAction<T = unknown> {
+    /** Intent the agent should apply to {@link payload}. */
+    readonly verb: AgentActionVerb;
+    /** The wire envelope. Validated against {@link validateAgentPayload}'s
+     *  size caps before the bus fans it out. */
+    readonly payload: AgentDragPayload<T>;
+    /** Optional slash command id to bind before send (e.g. `'explain-report'`).
+     *  Phase 1 captures this for telemetry only — actual binding lands when
+     *  the input's programmatic-send API ships. An unknown id is dropped
+     *  silently with a console warning, the chip still arrives. */
+    readonly autoCommandId?: string;
+    /** Phase 1 supports `'stage'` only. See {@link AgentActionDispatch}. */
+    readonly dispatch: AgentActionDispatch;
+    /** Source DOM rect for the FLIP entry animation. Omit to skip the
+     *  animation (e.g. dispatching from a keyboard shortcut with no anchor). */
+    readonly originRect?: DOMRect;
+    /** Optional HTML snippet rendered inside the flight ghost. Callers are
+     *  responsible for escaping untrusted text — the bus does not sanitise.
+     *  Defaults (when omitted) to a strong-wrapped escape of the payload's
+     *  `plainTextFallback` rendered by the panel host. */
+    readonly originPreviewHtml?: string;
 }
-interface MagicBarSearch extends MagicBarSearchSpec {
-    readonly onQuery?: (query: string) => void;
-    /**
-     * Opens the view's own Advanced-search overlay. Presence of this handler is
-     * what makes the Filters button exist — the DS deliberately does not model the
-     * dialog itself. Its fields are app schema (Circles' PESTLE/horizon grid), and
-     * a descriptor for them would be business logic the design system cannot
-     * validate or render honestly.
-     */
-    readonly onOpenFilters?: (trigger?: HTMLElement) => void;
+/**
+ * Thrown synchronously by {@link AgentActionBus.dispatch} when a caller
+ * supplies a dispatch mode this DS version doesn't implement yet. Catching
+ * by class name lets a forward-compatible caller fall back to `'stage'`
+ * without depending on instanceof across federation boundaries.
+ */
+declare class AgentActionUnsupportedDispatchError extends Error {
+    readonly dispatch: AgentActionDispatch;
+    constructor(dispatch: AgentActionDispatch);
 }
-interface MagicBarSearchView extends MagicBarSearchSpec {
-    /** True iff the publisher can open an advanced-search overlay. */
-    readonly hasFilters: boolean;
+
+/**
+ * Imperative sibling to {@link AgentCommandRegistry} / {@link AgentDropRegistry}.
+ *
+ * Apps call {@link dispatch} to push a typed {@link AgentAction} onto the bus;
+ * the agent panel subscribes once at construct and routes by verb. The bus
+ * itself is a thin pass-through — it does NOT decide UI behaviour. The
+ * subscriber (agent-panel) owns: showing the panel, staging the chip,
+ * triggering the flight animation, and binding the command. This keeps the
+ * DS free of host policy.
+ *
+ * Federation-safe: `providedIn: 'root'` + `sharedMappings: ['@flyos/design-system']`
+ * give every federated remote the same singleton, so a remote's "Explain"
+ * button reaches the host's panel without any cross-bundle wiring.
+ *
+ * Validation runs synchronously inside `dispatch` so a caller that sends an
+ * oversize payload sees the throw at their site, not on the subscriber. The
+ * subscriber therefore never has to defend against malformed envelopes.
+ */
+declare class AgentActionBus {
+    private readonly _actions$;
+    /** Hot stream of actions in dispatch order. Subscribers receive only
+     *  actions dispatched AFTER they subscribe — late subscribers see nothing
+     *  retroactively. Use {@link lastAction} for the latest snapshot. */
+    readonly actions$: Observable<AgentAction>;
+    /** Most recent action — for DevTools, smoke tests, and late-subscriber
+     *  catch-up. Null until the first successful dispatch. */
+    readonly lastAction: _angular_core.WritableSignal<AgentAction<unknown> | null>;
     /**
-     * Submit the field's current text to the publisher's newest `onQuery`. The
-     * inbound half — what the field should SHOW — is
-     * {@link MagicBarSearchSpec.queryText}, and that asymmetry in naming is forced:
-     * this member shipped first, and renaming it would be a ds-compat MAJOR.
+     * The action currently being processed by the subscriber, or null when
+     * none. Set by {@link dispatch} immediately before emitting on
+     * {@link actions$}; cleared by the subscriber via {@link settle} once
+     * it finishes its handler (success or fail). Lets the dispatcher render
+     * a busy state on the originating control — e.g. a card swapping its
+     * sparkle icon for a spinner while the agent panel mints the optimistic
+     * thread and starts the request. Identity check (`bus.inFlight() === act`)
+     * is the panel-side contract; dispatchers usually project to a stable id
+     * inside the payload (e.g. <c>reportId</c>) to scope busy-state visually.
+     *
+     * If multiple dispatches race, the latest wins — the prior in-flight
+     * action is dropped on the floor here (the panel may still handle it,
+     * but the dispatcher's busy indicator follows the newer action). Apps
+     * that need stricter single-flight semantics should guard at the call
+     * site (the agent-panel's <c>_pendingTempThreadId</c> already does so
+     * for the explain verb).
      */
-    query(text: string): void;
+    readonly inFlight: _angular_core.WritableSignal<AgentAction<unknown> | null>;
     /**
-     * Open the publisher's advanced-search overlay. Carries the Filters button the
-     * shell painted, for the same reason and under the same caveats as
-     * {@link MagicBarActionView.run} — a publisher whose overlay is a popover
-     * anchors it there instead of guessing at a position inside its own page.
+     * Push an action onto the bus.
+     *
+     * Throws synchronously when:
+     *   - `dispatch === 'auto'` (not implemented in this DS version) — see
+     *     {@link AgentActionUnsupportedDispatchError}.
+     *   - the payload fails {@link validateAgentPayload} (oversize, invalid
+     *     version, invalid kind). The error message carries the field path
+     *     so the caller can fix the offending field.
+     *
+     * Subscribers see the action via {@link actions$} on the next tick of
+     * the Subject; the {@link lastAction} signal updates synchronously
+     * before the Subject emits so an effect reading both stays consistent.
      */
-    openFilters(trigger?: HTMLElement): void;
-}
-/**
- * One view's complete claim on the magic bar.
- *
- * Identity (`appId` / `windowId`) is deliberately absent: it belongs to the
- * {@link MagicBarPublisher} that was minted for this owner, so a later publish
- * cannot re-target another app's slot.
- */
-interface MagicBarContribution {
+    dispatch<T>(action: AgentAction<T>): void;
     /**
-     * What the publisher is showing, e.g. `'tasks:detail'`. A change here is
-     * reset-on-navigate: the registry replaces the slot wholesale rather than
-     * reconciling, so nothing from the previous view can survive.
+     * Subscriber contract: call after the handler for {@link inFlight}
+     * completes (success or fail). Only clears {@link inFlight} if it still
+     * points at the passed action — a no-op when a later dispatch already
+     * superseded it. Pass the same action reference the subscriber received
+     * from {@link actions$}; identity is the gate.
      */
-    readonly viewKey: string;
-    readonly search?: MagicBarSearch | null;
-    /** Ordered clusters, separator-joined. */
-    readonly groups?: readonly MagicBarGroup[];
-    /** The accent-filled CTA ("New task", "Add signal"). */
-    readonly primary?: MagicBarAction | null;
+    settle(action: AgentAction): void;
     /**
-     * Ids of {@link AgentCommand}s this view considers most relevant, most-relevant
-     * first — the Ask-AI menu's per-view sets.
+     * Semantic alias of {@link settle} for explicit user-driven cancellation —
+     * e.g. a future "Stop" button in the agent input tray, or a dispatcher
+     * teardown that wants to abandon its own in-flight action. Identical
+     * runtime behaviour (identity check + clear), but the two-method surface
+     * lets the UI distinguish "handler finished" from "user said no" in
+     * telemetry / logs without sniffing a "reason" parameter.
      *
-     * Ids, not command objects: the platform already models commands (manifest
-     * `commands[]` → `AgentCommandRegistry`), and D5 §6 item 9 is explicit that
-     * production must source these from manifests instead of the mock's hardcoded
-     * `{ title, note, prompt }` triples. Duplicating that model here would fork the
-     * palette and reintroduce hardcoded prompt text. Unknown ids are dropped by the
-     * resolver; an empty list leaves the shell's affinity ranking in charge.
+     * Pass the same action reference returned from {@link inFlight} or held
+     * by the dispatcher; identity is the gate.
      */
-    readonly quickCommandIds?: readonly string[];
-    /** The "…" overflow set. Reserved design intent (D5 §6 item 8) — Print / Export / Settings. */
-    readonly overflow?: readonly MagicBarAction[];
-}
-/** The shell-facing projection of a contribution. See `magic-bar-projection.ts`. */
-interface MagicBarView {
-    readonly appId: string;
-    readonly windowId?: string;
-    /** {@link magicBarOwnerKey} of the publisher. */
-    readonly ownerKey: string;
-    readonly viewKey: string;
-    readonly search: MagicBarSearchView | null;
-    readonly groups: readonly MagicBarGroupView[];
-    readonly primary: MagicBarActionView | null;
-    readonly quickCommandIds: readonly string[];
-    readonly overflow: readonly MagicBarActionView[];
+    cancel(action: AgentAction): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentActionBus, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentActionBus>;
 }
+
 /**
- * A view's handle on its magic-bar slot. Minted once per publisher (not per
- * publish) because the publish rate is the whole point of this surface: the
- * sibling registries hand back a handle per `register()` and expect a handful of
- * calls per app lifetime, whereas a magic-bar publisher re-emits on every
- * selection change. Handing out a fresh handle each time would leave the caller
- * holding a dead one and force it to reassign on every keystroke.
+ * FLIP-style entry animation for payloads landing in the agent panel.
+ *
+ * Pure DOM + Web Animations API — no Chart.js, no Angular animations module,
+ * no CSS transitions racing layout. Honours `prefers-reduced-motion`: the
+ * ghost is appended then removed without animating when the user asked for
+ * less motion (so DOM side-effects stay consistent).
+ *
+ * Lifecycle:
+ *   1. The agent panel calls {@link registerTarget} in `ngAfterViewInit`
+ *      with its header element.
+ *   2. A source app dispatches an `AgentAction` carrying an `originRect`
+ *      from `getBoundingClientRect()` on the click target.
+ *   3. The bus subscriber calls {@link flyInto} with that rect.
+ *   4. The animator creates a fixed-position ghost at the origin, animates
+ *      transform + opacity toward the registered target's rect, then
+ *      removes itself on `onfinish` / `oncancel`.
+ *
+ * Uses `getBoundingClientRect()` (physical viewport coords) so the animation
+ * is RTL-correct without inset-inline math — the rect already encodes the
+ * physical position regardless of `dir`.
+ *
+ * The 900 ms duration and easing curve are deliberately hardcoded — making
+ * them configurable surfaces an API the host can't usefully tune without
+ * understanding motion design as a whole.
  */
-interface MagicBarPublisher {
-    readonly owner: MagicBarOwnerRef;
+declare class AgentFlightAnimator {
+    /** Hardcoded — see class doc. */
+    private static readonly DURATION_MS;
+    private static readonly EASING;
+    /** Floor the target/source scale ratio so a tiny target rect doesn't
+     *  collapse the ghost to invisibility before the animation finishes. */
+    private static readonly MIN_SCALE;
+    private targetEl;
+    /** Called by the panel host to publish where flights should land. Pass
+     *  `null` on destroy so a re-mounted panel doesn't leave the animator
+     *  pointing at a detached node. */
+    registerTarget(el: HTMLElement | null): void;
     /**
-     * Replace this owner's contribution. No-op after {@link dispose}, and no-op
-     * after the shell has {@link MagicBarRegistry.clear}ed this owner key.
+     * Animate a ghost element from {@link from} to the registered target's
+     * rect. No-ops when:
+     *   - no target is registered (silent — panel may not be mounted yet)
+     *   - running outside a browser (SSR safety)
+     *   - the user has `prefers-reduced-motion: reduce` set (DOM is still
+     *     touched so callers see consistent side-effects, but no animation
+     *     runs)
      *
-     * **Publish is last-writer-wins and eviction is not** — a deliberate asymmetry.
-     * A stale publisher (one that has been replaced on this key by a newer one)
-     * cannot `dispose()` the newer one out of the slot, but it *can* still take the
-     * slot back by publishing. Symmetry would need a "newest publisher wins" rule
-     * enforced on write, which would make the first publish of a replacement
-     * publisher silently drop whenever two live views briefly share a key. The
-     * exposure is bounded: two live publishers on one owner key only happen while a
-     * view is being replaced in place, and the loser re-publishes on its next
-     * selection change. The unbounded case — a publisher that outlives its window —
-     * is closed by `clear()`'s tombstone, not by write ordering.
-     */
-    publish(contribution: MagicBarContribution): void;
-    /**
-     * Release the slot. Idempotent, and a no-op if another publisher has since
-     * taken this owner key — the same stale-handle rule the sibling registries use.
+     * The ghost is appended to `document.body` (not the panel) so a parent
+     * `overflow: hidden` on the panel can't clip the flight path.
      */
-    dispose(): void;
+    flyInto(from: DOMRect, opts?: {
+        previewHtml?: string;
+    }): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AgentFlightAnimator, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AgentFlightAnimator>;
 }
 
 /**
@@ -8813,6 +9471,36 @@ interface MagicBarSearchSeed {
  */
 declare function magicBarSearchText(previous: MagicBarSearchSeed | null, next: MagicBarSearchSeed): string | null;
 
+/**
+ * Order one group's items the way every FlyOS bar orders them.
+ *
+ * **Icon-only actions occupy the outer edge of the flow — the right in LTR — in the precedence
+ * Add, Delete, Edit reading inward; labelled (icon+label) actions sit inside them.**
+ *
+ * The outer edge is where the hand and the eye finish, so it belongs to the actions that need no
+ * reading: a bare glyph is fastest to hit and slowest to identify, and putting the glyphs where
+ * they are found by position rather than by reading is what makes that trade pay. A labelled
+ * action is identified by its text wherever it sits, so it gives the edge up.
+ *
+ * Order is expressed as FLOW order, never as physical left/right: the bar mirrors under RTL, so
+ * "outermost" becomes the left edge in `ar`/`ur` automatically. Encoding it as a physical side
+ * would be a bug in three of this platform's four locales.
+ *
+ * Stable within each band — callers keep authoring items in whatever order reads best in source,
+ * and two labelled actions stay in the order they were written (PPM's "Promote to schedule" stays
+ * after "Add backlog task").
+ *
+ * ## Why this lives in the design system
+ * It shipped first inside PPM (`ppm/shared/magic-bar-order.util.ts`) and
+ * `skills/shell-magic-bar-views.md` §7 named that file as the reference implementation —
+ * which is exactly the shape of a rule that is about to be copy-pasted into the next External App.
+ * The ordering is a property of the BAR, not of any one app: the same renderer paints every
+ * contribution, so two apps disagreeing about it is a platform-visible inconsistency, not a local
+ * style choice. Same reasoning as {@link magicBarSearchText} — a documented-but-unimplemented rule
+ * gets re-derived per consumer, and the copies disagree on precisely the case that is hard to see.
+ */
+declare function orderMagicBarItems(items: readonly MagicBarAction[]): MagicBarAction[];
+
 /**
  * Allowlist parser for {@link MagicBarActionSpec.iconPath} — the geometry-only
  * gate between a publisher-supplied glyph fragment and the DOM.
@@ -9034,6 +9722,15 @@ declare class FlyMagicActionsComponent {
      * what stops `@for (…; track $index)` rebuilding the glyph each time.
      */
     protected iconNodes(action: MagicBarActionView): readonly FlyMagicBarIconNode[];
+    /**
+     * Whether this action has a glyph to paint at all.
+     *
+     * Derived from the PARSED nodes, never from `iconPath` being a non-empty string: a fragment the
+     * allowlist rejected parses to zero nodes, and treating that as "has an icon" would paint an
+     * empty `<svg>` box — on a labelled action, a permanent gap in front of the text. The parse
+     * memoizes, so asking twice costs nothing.
+     */
+    protected hasGlyph(action: MagicBarActionView): boolean;
     /** `null` (not `'default'`) so `[attr.data-tone]` omits the attribute entirely for the common case. */
     protected toneAttr(action: MagicBarActionView): string | null;
     /**
@@ -9164,6 +9861,17 @@ declare const FLY_MAGIC_BAR_ICONS: {
      * the settings gear, not the mode switcher).
      */
     readonly calendarView: "<rect x=\"3.5\" y=\"3.5\" width=\"17\" height=\"17\" rx=\"2.5\"/><path d=\"M3.5 12h17M12 3.5v17\"/>";
+    /**
+     * Gantt / outline "Indent" — the block pushed in, with the arrow pointing INTO the indent.
+     * Pairs with {@link outdent}: the two differ only in the arrow, which is the convention every
+     * word processor and desktop planner has shipped for decades and the reason both stay icon-only.
+     *
+     * Directional, so publishers pass `mirrorInRtl: true` alongside it — the block sits on the
+     * reading-start side, which is the right edge in `ar`/`ur`.
+     */
+    readonly indent: "<path d=\"M4 5h16M4 19h16\"/><path d=\"M11 9.7h9M11 14.3h9\"/><path d=\"M4.5 9.7 7.5 12l-3 2.3\"/>";
+    /** Gantt / outline "Outdent" — {@link indent}'s block with the arrow pulling back out. */
+    readonly outdent: "<path d=\"M4 5h16M4 19h16\"/><path d=\"M11 9.7h9M11 14.3h9\"/><path d=\"M7.5 9.7 4.5 12l3 2.3\"/>";
     /** `UX/FlyOS Desktop-app/MainContent.dc.html:927` (`pubTabActions`'s local `P` table). */
     readonly addEvidence: "<path d=\"M10.5 13.5a4 4 0 0 0 5.7 0l2-2a4 4 0 0 0-5.7-5.7l-.6.6\"/><path d=\"M13.5 10.5a4 4 0 0 0-5.7 0l-2 2a4 4 0 0 0 4.2 6.5\"/><path d=\"M17.5 15.5v5M15 18h5\"/>";
     /** `MainContent.dc.html:928`. Reused for every "Edit …" action (evidence, link, task). */
@@ -9212,7 +9920,7 @@ type FlyMagicBarIconName = keyof typeof FLY_MAGIC_BAR_ICONS;
  * App running standalone.
  *
  * ## The gap this closes
- * A view publishes one `MagicBarContribution` (skill: `magic-bar-actions.md`)
+ * A view publishes one `MagicBarContribution` (skill: `shell-magic-bar.md`)
  * and, embedded in the desktop shell, the top-bar pill renders it. Standalone,
  * nothing did — so every screen also kept a bespoke header-actions row
  * (`[page-header-actions]` buttons) that duplicated the published actions in
@@ -10490,7 +11198,7 @@ type FlyCurrencySelectorValue = string | readonly string[] | null;
  * `locked` is a different claim entirely: **the value is fixed on purpose**, because
  * something downstream now depends on it (PPM freezes a project's currency the moment any
  * financial row exists — changing it would silently re-denominate every stored amount).
- * A dimmed control with no explanation is exactly the failure `skills/magic-bar-actions.md`
+ * A dimmed control with no explanation is exactly the failure `skills/shell-magic-bar.md`
  * §3.6 names for actions ("a vanishing action teaches the user nothing"); the same argument
  * applies to a frozen field. So `locked` renders differently on purpose: full-opacity (never
  * dimmed — the value is not "unavailable", it is authoritative), no dropdown affordance at
@@ -10573,7 +11281,7 @@ declare class FlyCurrencySelectorComponent implements ControlValueAccessor {
      */
     readonly locked: _angular_core.InputSignal<boolean>;
     /**
-     * i18n KEY (never resolved text — see `skills/magic-bar-actions.md` §3.4) explaining
+     * i18n KEY (never resolved text — see `skills/shell-magic-bar.md` §3.4) explaining
      * WHY the control is locked. Omit to use the localized `currency_selector.locked_default_reason`
      * baseline key; supply your own only when that default reason is wrong for your case
      * (mirrors `MagicBarActionSpec.disabledTipKey`'s "supply only when the default is wrong"
@@ -12902,6 +13610,13 @@ declare class FlyDataTableComponent {
     /** `fly-state-message` key when `rows` is empty (omit to render nothing). */
     readonly emptyKey: _angular_core.InputSignal<string | undefined>;
     readonly emptyIconClass: _angular_core.InputSignal<string | undefined>;
+    /**
+     * The selected row's `id`, or `null`/omitted for no selection — the select-then-act model
+     * (`skills/shell-ux-rulebook.md` §1) paints the matching `<tr>` with `--tint-sel` and
+     * `aria-selected`. A page that still opens rows on activation (rather than selecting them) simply
+     * never sets this; the table renders exactly as before.
+     */
+    readonly selectedId: _angular_core.InputSignal<string | null>;
     protected readonly skeletonRows: number[];
     private readonly cellTemplates;
     private readonly templateMap;
@@ -12913,13 +13628,14 @@ declare class FlyDataTableComponent {
      */
     protected onRowActivate(event: Event, row: unknown): void;
     protected cellValue(row: unknown, col: FlyColumn): unknown;
+    protected isSelected(row: unknown): boolean;
     /** Default text rendering — em-dash for absent values, verbatim otherwise. */
     protected displayValue(row: unknown, col: FlyColumn): string;
     protected headerAriaSort(col: FlyColumn): string | null;
     protected sortDirFor(col: FlyColumn): string | null;
     protected onHeaderClick(col: FlyColumn): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<FlyDataTableComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyDataTableComponent, "fly-data-table", never, { "columns": { "alias": "columns"; "required": true; "isSignal": true; }; "rows": { "alias": "rows"; "required": true; "isSignal": true; }; "loading": { "alias": "loading"; "required": false; "isSignal": true; }; "ariaLabelKey": { "alias": "ariaLabelKey"; "required": false; "isSignal": true; }; "sort": { "alias": "sort"; "required": false; "isSignal": true; }; "emptyKey": { "alias": "emptyKey"; "required": false; "isSignal": true; }; "emptyIconClass": { "alias": "emptyIconClass"; "required": false; "isSignal": true; }; }, { "sortChange": "sortChange"; "rowActivated": "rowActivated"; }, ["cellTemplates"], never, true, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<FlyDataTableComponent, "fly-data-table", never, { "columns": { "alias": "columns"; "required": true; "isSignal": true; }; "rows": { "alias": "rows"; "required": true; "isSignal": true; }; "loading": { "alias": "loading"; "required": false; "isSignal": true; }; "ariaLabelKey": { "alias": "ariaLabelKey"; "required": false; "isSignal": true; }; "sort": { "alias": "sort"; "required": false; "isSignal": true; }; "emptyKey": { "alias": "emptyKey"; "required": false; "isSignal": true; }; "emptyIconClass": { "alias": "emptyIconClass"; "required": false; "isSignal": true; }; "selectedId": { "alias": "selectedId"; "required": false; "isSignal": true; }; }, { "sortChange": "sortChange"; "rowActivated": "rowActivated"; }, ["cellTemplates"], never, true, never>;
 }
 
 /**
@@ -14314,6 +15030,6 @@ declare const AUDIENCE_ERROR_CODES: {
 };
 type AudienceErrorCode = (typeof AUDIENCE_ERROR_CODES)[keyof typeof AUDIENCE_ERROR_CODES];
 
-export { AGENT_DRAG_MIME, AGENT_PAYLOAD_VERSION, APP_LOOKUP, AUDIENCE_ERROR_CODES, AUDIENCE_LIMITS, AUDIENCE_PRESETS, AUDIENCE_TERM_KINDS, AgentActionBus, AgentActionUnsupportedDispatchError, AgentCommandRegistry, AgentDropRegistry, AgentFlightAnimator, AgentLookupRegistry, AgentPayloadOversizeError, AudienceBuilderComponent, AuthService, BilingualFieldComponent, CRON_MODES, CRON_WEEKDAYS, ContextMenuComponent, DEFAULT_AGENT_PAYLOAD_LIMITS, DEFAULT_FLY_THEME_MODE, DS_BASELINE_LOCALES, DashboardKpiComponent, DialogResult, ENTITY_LINK_LAUNCHER, EntityLookupComponent, FLYOS_LAUNCH_EVENT, FLYOS_LAUNCH_REQUEST_EVENT, FLYOS_REMOTE_ROUTE_EVENT, FLY_ACCENT_PROPERTY, FLY_ADMIN_ROLES, FLY_CHUNK_RELOAD_FLAG, FLY_COMPACT_THRESHOLD, FLY_COUNTRIES, FLY_CURRENCIES_BRIEF_ENDPOINT, FLY_CURRENCY_DEFAULT_ENDPOINT, FLY_EMOJI_BY_ID, FLY_EMOJI_CATEGORIES, FLY_EMOJI_CATEGORY_BY_ID, FLY_EMOJI_DEFAULT_CATEGORIES, FLY_EMOJI_PACK, FLY_EMOJI_PACK_MISSING_MESSAGE, FLY_EMOJI_PREVIEW_COUNT, FLY_EMPTY_VALUE, FLY_LOCALE_CATALOG, FLY_MAGIC_BAR_EVENT, FLY_MAGIC_BAR_ICONS, FLY_MAGIC_BAR_STORE_KEY, FLY_NF_CACHE_HEAL_FLAG, FLY_RELOAD_DEBOUNCE_MS, FLY_RELOAD_REARM_MS, FLY_REMOTE_BASE_PATH, FLY_REMOTE_CONTEXT_EVENT, FLY_REMOTE_CONTEXT_STORE_KEY, FLY_REMOTE_OUTLET_DEPTH, FLY_REMOTE_ROUTES, FLY_SCAN_PENDING_DEFAULT_DELAY_MS, FLY_SCAN_PENDING_MAX_RETRIES, FLY_SCAN_PENDING_STATUS, FLY_SEARCH_DEBOUNCE_MS, FLY_SKIN_TONES, FLY_STANDALONE_AUTH_CONFIG, FLY_STRATEGY_OBJECTIVES_LOOKUP_ENDPOINT, FLY_THEME_MODE_IDS, FLY_VIEWPORT_IS_MOBILE, FLY_WINDOW_BREADCRUMBS_EVENT, FLY_WINDOW_BREADCRUMBS_STORE_KEY, FLY_WINDOW_HELP_HINT_EVENT, FLY_WINDOW_PAGE_TITLE_EVENT, FlyAchievementProgressComponent, FlyActionMenuComponent, FlyActionStackComponent, FlyAgentDraggableDirective, FlyAnimatedEmojiComponent, FlyAppHomeComponent, FlyAppTopbarComponent, FlyAppUnavailableComponent, FlyAuthLiveRefresh, FlyBadgeWallComponent, FlyBlockUiComponent, FlyBreadcrumbComponent, FlyButtonComponent, FlyBytesPipe, FlyCaptchaComponent, FlyCardActionsComponent, FlyCardBodyComponent, FlyCardComponent, FlyCardFooterComponent, FlyCardGridComponent, FlyCardMediaComponent, FlyCardMetaComponent, FlyCardStatusComponent, FlyCardTitleComponent, FlyCellDirective, FlyCheckboxComponent, FlyChipComponent, FlyChunkReloadErrorHandler, FlyClickOutsideDirective, FlyCollapsibleComponent, FlyCommentThreadComponent, FlyCompactNumberPipe, FlyConfirmDialogComponent, FlyControlDirective, FlyCronBuilderComponent, FlyCurrencyCatalogService, FlyCurrencySelectorComponent, FlyDataTableComponent, FlyDatePipe, FlyDateTimePipe, FlyDebouncer, FlyDecimalNumberPipe, FlyDeepLinkPrefetchService, FlyDetailCardComponent, FlyDetailShellComponent, FlyDrawerComponent, FlyDurationPipe, FlyDynamicFormComponent, FlyEmojiPickerComponent, FlyFieldComponent, FlyFileDownloadService, FlyFileUploadComponent, FlyFilterPanelComponent, FlyFormBannerComponent, FlyFormFooterComponent, FlyFormGridComponent, FlyFormSectionComponent, FlyFullNumberPipe, FlyGanttComponent, FlyHubClient, FlyIconButtonComponent, FlyIfAdminDirective, FlyIfRoleDirective, FlyImageUploadComponent, FlyLeaderboardComponent, FlyLifecyclePipelineComponent, FlyMagicActionsComponent, FlyMetaListComponent, FlyModalComponent, FlyModerationQueueComponent, FlyModuleIconDirective, FlyMoneyPipe, FlyOverviewKpiRowComponent, FlyOverviewRowsComponent, FlyOverviewSectionComponent, FlyOverviewSurfaceComponent, FlyPagerComponent, FlyPaginationComponent, FlyPeoplePickerComponent, FlyPointsTierComponent, FlyProgressComponent, FlyRelativeTimePipe, FlyRemoteContextService, FlyRemoteRouter, FlyRemoteRouterOutletComponent, FlySearchInputComponent, FlySectionHeaderComponent, FlySecureSrcDirective, FlySegmentedComponent, FlySelectComponent, FlySkeletonComponent, FlySliderComponent, FlySparklineComponent, FlySpinnerComponent, FlyStandaloneAuthCallbackComponent, FlyStandaloneAuthService, FlyStandaloneMagicActionsComponent, FlyStateMessageComponent, FlyStrategySelectorComponent, FlyDynamicFormComponent as FlySurveyFormComponent, FlyTabComponent, FlyTabsComponent, FlyTagsInputComponent, FlyThemeService, FlyTimePipe, FlyToastService, FlyToggleComponent, FlyTooltipDirective, FlyTreeNavComponent, FlyTypeaheadComponent, FlyUserDirectoryService, FlyWindowHelpService, FlyWindowTitleService, FlyosPendingLaunchesGlobalKey, FlyosShellHandlesLaunchRequestsGlobalKey, FlyosShellOwnsHistoryGlobalKey, GANTT_DEPENDENCY_TYPES, GANTT_ROW_TINT_ALPHA, GANTT_ZOOMS, I18nService, LAUNCH_CONTEXT, MAGIC_BAR_SEARCH_WIDTH_DEFAULT, MAGIC_BAR_SEARCH_WIDTH_MAX, MAGIC_BAR_SEARCH_WIDTH_MIN, MagicBarRegistry, MessageBoxButtons, MessageBoxComponent, MessageBoxIcon, MessageBoxService, MockAuthService, NOVA_PRIORITY_TONE, NOVA_STATUS_TONE, NOVA_TONE_FALLBACK, OverlayStack, PRESENCE_COLORS, PageHeaderComponent, RTL_LOCALE_SET, SHARE_ORG_CHART_SYSTEM_KEY_APPS, SHARE_ORG_CHART_SYSTEM_KEY_DEFAULT, SHARE_PANEL_DEFAULT_FILE_LEVELS, STATE_DEFAULT_ICONS, STATE_DEFAULT_MESSAGE_KEYS, STEP_UP_CODE, STEP_UP_REAUTH_HANDLER, STEP_UP_RETURN_KEY, SUPPORTED_AGENT_PAYLOAD_VERSIONS, SharePanelComponent, SourceAppResolver, StandaloneWindowManagerService, StatusBadgeComponent, StepUpService, ToastHostComponent, TranslatePipe, WINDOW_DATA, WINDOW_HELP_HINT, WindowBreadcrumbsRegistry, WindowManagerService, applySkinTone, applySuggestion, ariaSort, buildCron, canConfirm, canGoNext$1 as canGoNext, canGoPrev$1 as canGoPrev, captureFocus, clampMagicBarSearchWidth, clampPage$1 as clampPage, clampSliderValue, connectRemoteLaunch, deepestFlyMatch, enterActivatesNatively, filterGroup, filterSuggestions, findLocaleByDialect, findLocaleByPrefix, firstEnabledIndex, firstModuleIndex, flattenModules, flyAdminGuard, flyApiErrorMessage, flyCaptchaBase64Utf8, flyCaptchaBuildToken, flyCaptchaSha256Hex, flyCompactNumber, flyDebounced, flyDecimalNumber, flyDownloadBlob, flyDuration, flyEmojiFor, flyEmojiIsTonable, flyEmojiPackUrl, flyExportFileName, flyFirstEnabledIndex, flyFormatBytes, flyFormatDate, flyFormatDateTime, flyFormatMoney, flyFormatTime, flyFullNumber, flyNextEnabledIndex, flyNextSegmentIndex, flyRelativeTime, flyResolveActiveTab, flyRoleGuard, flyScanPendingDelayMs, flyScanRetry, flySignedCompact, flySkinToneLabelKey, flyStandaloneAuthGuard, flyStandaloneAuthInterceptor, flyToDateOnly, flyToPage, flyUnwrap, flyUnwrapCurrencies, flyUnwrapCurrency, flyUnwrapLenient, flyUnwrapObjectiveLookup, hasAnyRoleIn, healNativeFederationCacheOnce, initialExpanded, isAccentColor, isChunkLoadError, isFlyAuthStorePopulated, isNativeFederationCacheError, isRtlLocale, isRtlLocaleEntry, isValidCron, isValidSingleField, loadRemoteStyles, magicBarOwnerKey, magicBarSearchText, matchFlyRoutePattern, matchFlyRoutePrefix, matchFlyRouteTable, nextEnabledIndex, nextModuleIndex, nextSegmentIndex, nextSort, normalizeFlyTheme, normalizeRoles, novaPriorityToneVar, novaStatusToneVar, overlayStack, canGoNext as pagerCanGoNext, canGoPrev as pagerCanGoPrev, clampPage as pagerClampPage, parseCron, parseStepUpChallenge, parseTags, prefetchRemoteStyles, presenceColorFor, printConsoleSecurityWarning, provideFlyChunkReloadRecovery, provideFlyEmojiPack, provideFlyOfflineAuth, provideFlyStandaloneAuth, reloadOnceForChunkError, requestAppLaunch, resolveActiveModule, resolveActiveSection, resolveActiveTab, resolveCellValue, resolveStateIcon, resolveStateMessageKey, restoreFocus, sameTags, sectionHintKey, sectionLayout, sliderTrackGradient, sparklinePath, sparklinePoints, stepUpInterceptor, stepUpReturnKey, trimAgentPayload, trimAgentString, unloadRemoteStyles, utf8ByteLength, validateAgentPayload, warnIfEmbeddedSessionMissing };
-export type { ActionMenuItem, AgentAction, AgentActionDispatch, AgentActionVerb, AgentChipHostInputs, AgentCommand, AgentCommandContextBinding, AgentCommandHandle, AgentCommandRegistration, AgentCommandScope, AgentCommandSlashSpec, AgentDragPayload, AgentDraggableItem, AgentDropChipMode, AgentDropRendererRegistration, AgentEnvelopeAttachment, AgentMcpScope, AgentMessageEnvelope, AgentPayloadLimits, AgentPayloadValidationResult, AppEveryonePrincipal, AppEveryoneTerm, AppLookup, AppLookupEntry, AudienceEditTarget, AudienceErrorCode, AudienceFilter, AudienceOptions, AudiencePresetKind, AudienceTerm, AudienceTermKind, BreadcrumbItem, ButtonSize, ButtonVariant, CardDensity, CardLayout, ChartTerm, ChildWindowData, ChipTone, ConfirmKind, ConnectRemoteLaunchOptions, ContextMenuAlign, ContextMenuItem, ContextMenuSection, CronAdvancedFieldDef, CronMode, CronParts, CronWeekday, DesktopApp, DesktopAppCategory, DesktopAppKind, DetailSection, DialogResultWithAcknowledgement, EmbeddedSessionProbe, EntityLinkLauncher, EntityLinkSelection, FilterGroup, FlyAchievementRow, FlyApiError, FlyApiResponse, FlyAppHomeLayout, FlyAppModule, FlyAppModuleSection, FlyAppUnavailableState, FlyAuthRefreshPayload, FlyAuthStoreReadable, FlyBadgeTile, FlyBreadcrumbItem, FlyCaptchaChallenge, FlyCaptchaSolution, FlyCaptchaState, FlyCellContext, FlyColumn, FlyColumnKind, FlyComment, FlyCommentDeleteRequest, FlyCommentEditRequest, FlyCommentLoadMoreRequest, FlyCommentLoadRepliesRequest, FlyCommentLockToggleRequest, FlyCommentPage, FlyCommentReportReason, FlyCommentReportRequest, FlyCommentReportStatus, FlyCommentSubmitRequest, FlyCountry, FlyCurrency, FlyCurrencyFetchFn, FlyCurrencySelectorMode, FlyCurrencySelectorValue, FlyDeepLinkPrefetchRoute, FlyDrawerBodyPadding, FlyDrawerPosition, FlyDrawerSide, FlyDrawerSize, FlyDrawerVariant, FlyEmojiCategory, FlyEmojiCell, FlyEmojiEntry, FlyEmojiPack, FlyEmojiPackEntry, FlyEmojiPackManifest, FlyEmojiPickerSize, FlyEmojiPickerTab, FlyEmojiSection, FlyFileInfo, FlyFileSelection, FlyFormAnswer, FlyFormAnswerValue, FlyFormDefinition, FlyFormFieldOptions, FlyFormOption, FlyFormQuestion, FlyFormQuestionType, FlyFormScoreDisplay, FlyFormatMoneyOptions, FlyLaunchEventDetail, FlyLaunchRequestDetail, FlyLeaderboardRow, FlyLiveRefreshOptions, FlyLocaleEntry, FlyMagicBarIconName, FlyMetaItem, FlyModerationLoadPageRequest, FlyModerationLockThreadRequest, FlyModerationOpenSubjectRequest, FlyModerationReport, FlyModerationReportPage, FlyModerationResolutionStatus, FlyModerationResolveRequest, FlyMoneyDisplay, FlyNavigableItem, FlyOfflineAuthConfig, FlyPageMeta, FlyPageResult, FlyPaged, FlyPeoplePickerMode, FlyPeoplePickerOption, FlyPeopleSearchFn, FlyPointsSummary, FlyRemoteContext, FlyRemoteEagerRoute, FlyRemoteLazyRoute, FlyRemoteLoadedComponent, FlyRemoteMatch, FlyRemoteRoute, FlyRemoteRouteEventDetail, FlySearchExpandTrigger, FlySearchInputSize, FlySecureSrcState, FlySelectOption, FlySelectValue, FlySkeletonAnimation, FlySkeletonLayout, FlySkeletonShape, FlySkinTone, FlySort, FlyStandaloneAuthConfig, FlyStrategyObjectiveRef, FlyStrategyObjectiveSearchFn, FlyFileSelection as FlySurveyFileSelection, FlyFormAnswer as FlySurveyFormAnswer, FlyFormAnswerValue as FlySurveyFormAnswerValue, FlyFormDefinition as FlySurveyFormDefinition, FlyFormFieldOptions as FlySurveyFormFieldOptions, FlyFormOption as FlySurveyFormOption, FlyFormQuestion as FlySurveyFormQuestion, FlyFormQuestionType as FlySurveyQuestionType, FlyTenantDefaultCurrencyFetchFn, FlyThemeMode, FlyTooltipPlacement, FlyTreeNavNode, FlyTypeaheadOption, FlyWindowHelpHintEventDetail, FlyWindowHelpPublisher, FlyWindowPageTitleEventDetail, FlyWindowTitlePublisher, FlyosPendingLaunches, FocusRestore, FormBannerKind, GanttDependency, GanttDependencyCreate, GanttDependencyDelete, GanttDependencyType, GanttRow, GanttRowDatesChange, GanttRowKind, GanttZoom, IconButtonVariant, LaunchContext, LifecycleRollupItem, LifecycleStep, LoadBundleOptions, LoadRemoteStylesOptions, LookupDescriptor, LookupHandle, LookupRegistration, LookupResult, LookupSearch, MagicBarAction, MagicBarActionKind, MagicBarActionSpec, MagicBarActionView, MagicBarContribution, MagicBarGroup, MagicBarGroupSpec, MagicBarGroupView, MagicBarOwnerRef, MagicBarPublisher, MagicBarRadioMenu, MagicBarRadioMenuSpec, MagicBarRadioMenuView, MagicBarRadioOption, MagicBarSearch, MagicBarSearchSeed, MagicBarSearchSpec, MagicBarSearchView, MagicBarTextParams, MagicBarTone, MagicBarView, MessageBoxButton, MessageBoxDontAskAgainConfig, MessageBoxOptions, MessageBoxOptionsWithAcknowledgement, MockAuthConfig, OpenWindowOptions, OuPrincipal, OuTerm, OverlayHandle, OverviewKpiItem, OverviewKpiTone, OverviewRow, PageHeaderVariant, PresetTerm, ProgressTone, RemoteAppDef, RequestAppLaunchOptions, RoleOuLookupRow, RolePrincipal, RolesTerm, SegmentedOption, SegmentedVariant, ShareOrgChartOption, ShareOuNode, SharePanelLevelOption, SharePermissionEntry, SharePrincipal, SharePrincipalKind, ShareUserResult, StateMessageKind, StepUpChallenge, StepUpReauthHandler, StepUpReauthRequest, TabsVariant, ToastAction, ToastEntry, ToastOptions, ToastVariant, User, UserPrincipal, UsersTerm, WindowBreadcrumb, WindowHelpHint, WindowInstance, WindowState };
+export { AGENT_DRAG_MIME, AGENT_PAYLOAD_VERSION, APP_LOOKUP, AUDIENCE_ERROR_CODES, AUDIENCE_LIMITS, AUDIENCE_PRESETS, AUDIENCE_TERM_KINDS, AgentActionBus, AgentActionUnsupportedDispatchError, AgentCommandRegistry, AgentDropRegistry, AgentFlightAnimator, AgentLookupRegistry, AgentPayloadOversizeError, AudienceBuilderComponent, AuthService, BilingualFieldComponent, CRON_MODES, CRON_WEEKDAYS, ContextMenuComponent, DEFAULT_AGENT_PAYLOAD_LIMITS, DEFAULT_FLY_THEME_MODE, DS_BASELINE_LOCALES, DashboardKpiComponent, DialogResult, ENTITY_LINK_LAUNCHER, EntityLookupComponent, FLYOS_LAUNCH_EVENT, FLYOS_LAUNCH_REQUEST_EVENT, FLYOS_REMOTE_ROUTE_EVENT, FLY_ACCENT_PROPERTY, FLY_ADMIN_ROLES, FLY_CHUNK_RELOAD_FLAG, FLY_COMPACT_THRESHOLD, FLY_COUNTRIES, FLY_CURRENCIES_BRIEF_ENDPOINT, FLY_CURRENCY_DEFAULT_ENDPOINT, FLY_EMOJI_BY_ID, FLY_EMOJI_CATEGORIES, FLY_EMOJI_CATEGORY_BY_ID, FLY_EMOJI_DEFAULT_CATEGORIES, FLY_EMOJI_PACK, FLY_EMOJI_PACK_MISSING_MESSAGE, FLY_EMOJI_PREVIEW_COUNT, FLY_EMPTY_VALUE, FLY_GANTT_DEFAULTS, FLY_LAUNCH_CONTEXT_EVENT, FLY_LAUNCH_CONTEXT_STORE_KEY, FLY_LOCALE_CATALOG, FLY_MAGIC_BAR_EVENT, FLY_MAGIC_BAR_ICONS, FLY_MAGIC_BAR_STORE_KEY, FLY_NF_CACHE_HEAL_FLAG, FLY_RELOAD_DEBOUNCE_MS, FLY_RELOAD_REARM_MS, FLY_REMOTE_BASE_PATH, FLY_REMOTE_CONTEXT_EVENT, FLY_REMOTE_CONTEXT_STORE_KEY, FLY_REMOTE_OUTLET_DEPTH, FLY_REMOTE_ROUTES, FLY_SCAN_PENDING_DEFAULT_DELAY_MS, FLY_SCAN_PENDING_MAX_RETRIES, FLY_SCAN_PENDING_STATUS, FLY_SEARCH_DEBOUNCE_MS, FLY_SKIN_TONES, FLY_STANDALONE_AUTH_CONFIG, FLY_STRATEGY_OBJECTIVES_LOOKUP_ENDPOINT, FLY_THEME_MODE_IDS, FLY_VIEWPORT_IS_MOBILE, FLY_WINDOW_BREADCRUMBS_EVENT, FLY_WINDOW_BREADCRUMBS_STORE_KEY, FLY_WINDOW_HELP_HINT_EVENT, FLY_WINDOW_PAGE_TITLE_EVENT, FlyAchievementProgressComponent, FlyActionMenuComponent, FlyActionStackComponent, FlyAgentDraggableDirective, FlyAnimatedEmojiComponent, FlyAppHomeComponent, FlyAppTopbarComponent, FlyAppUnavailableComponent, FlyAuthLiveRefresh, FlyBadgeWallComponent, FlyBlockUiComponent, FlyBreadcrumbComponent, FlyButtonComponent, FlyBytesPipe, FlyCaptchaComponent, FlyCardActionsComponent, FlyCardBodyComponent, FlyCardComponent, FlyCardFooterComponent, FlyCardGridComponent, FlyCardMediaComponent, FlyCardMetaComponent, FlyCardStatusComponent, FlyCardTitleComponent, FlyCellDirective, FlyCheckboxComponent, FlyChipComponent, FlyChunkReloadErrorHandler, FlyClickOutsideDirective, FlyCollapsibleComponent, FlyCommentThreadComponent, FlyCompactNumberPipe, FlyConfirmDialogComponent, FlyControlDirective, FlyCronBuilderComponent, FlyCurrencyCatalogService, FlyCurrencySelectorComponent, FlyDataTableComponent, FlyDatePipe, FlyDateTimePipe, FlyDebouncer, FlyDecimalNumberPipe, FlyDeepLinkPrefetchService, FlyDetailCardComponent, FlyDetailShellComponent, FlyDrawerComponent, FlyDurationPipe, FlyDynamicFormComponent, FlyEmojiPickerComponent, FlyFieldComponent, FlyFileDownloadService, FlyFileUploadComponent, FlyFilterPanelComponent, FlyFormBannerComponent, FlyFormFooterComponent, FlyFormGridComponent, FlyFormSectionComponent, FlyFullNumberPipe, FlyGanttComponent, FlyHubClient, FlyIconButtonComponent, FlyIfAdminDirective, FlyIfRoleDirective, FlyImageUploadComponent, FlyLaunchContextService, FlyLeaderboardComponent, FlyLifecyclePipelineComponent, FlyMagicActionsComponent, FlyMetaListComponent, FlyModalComponent, FlyModerationQueueComponent, FlyModuleIconDirective, FlyMoneyPipe, FlyOverviewKpiRowComponent, FlyOverviewRowsComponent, FlyOverviewSectionComponent, FlyOverviewSurfaceComponent, FlyPagerComponent, FlyPaginationComponent, FlyPeoplePickerComponent, FlyPointsTierComponent, FlyProgressComponent, FlyRelativeTimePipe, FlyRemoteContextService, FlyRemoteRouter, FlyRemoteRouterOutletComponent, FlySearchInputComponent, FlySectionHeaderComponent, FlySecureSrcDirective, FlySegmentedComponent, FlySelectComponent, FlySkeletonComponent, FlySliderComponent, FlySparklineComponent, FlySpinnerComponent, FlyStandaloneAuthCallbackComponent, FlyStandaloneAuthService, FlyStandaloneMagicActionsComponent, FlyStateMessageComponent, FlyStrategySelectorComponent, FlyDynamicFormComponent as FlySurveyFormComponent, FlyTabComponent, FlyTabsComponent, FlyTagsInputComponent, FlyThemeService, FlyTimePipe, FlyToastService, FlyToggleComponent, FlyTooltipDirective, FlyTreeNavComponent, FlyTypeaheadComponent, FlyUserDirectoryService, FlyWindowHelpService, FlyWindowTitleService, FlyosPendingLaunchesGlobalKey, FlyosShellHandlesLaunchRequestsGlobalKey, FlyosShellOwnsHistoryGlobalKey, GANTT_DEPENDENCY_TYPES, GANTT_LABEL_W_DEFAULT, GANTT_LABEL_W_MAX, GANTT_LABEL_W_MIN, GANTT_ROW_TINT_ALPHA, GANTT_ZOOMS, I18nService, LAUNCH_CONTEXT, MAGIC_BAR_SEARCH_WIDTH_DEFAULT, MAGIC_BAR_SEARCH_WIDTH_MAX, MAGIC_BAR_SEARCH_WIDTH_MIN, MagicBarRegistry, MessageBoxButtons, MessageBoxComponent, MessageBoxIcon, MessageBoxService, MockAuthService, NOVA_PRIORITY_TONE, NOVA_STATUS_TONE, NOVA_TONE_FALLBACK, OverlayStack, PRESENCE_COLORS, PageHeaderComponent, RTL_LOCALE_SET, SHARE_ORG_CHART_SYSTEM_KEY_APPS, SHARE_ORG_CHART_SYSTEM_KEY_DEFAULT, SHARE_PANEL_DEFAULT_FILE_LEVELS, STATE_DEFAULT_ICONS, STATE_DEFAULT_MESSAGE_KEYS, STEP_UP_CODE, STEP_UP_REAUTH_HANDLER, STEP_UP_RETURN_KEY, SUPPORTED_AGENT_PAYLOAD_VERSIONS, SharePanelComponent, SourceAppResolver, StandaloneWindowManagerService, StatusBadgeComponent, StepUpService, ToastHostComponent, TranslatePipe, WINDOW_DATA, WINDOW_HELP_HINT, WindowBreadcrumbsRegistry, WindowManagerService, applyGanttRowReorder, applySkinTone, applySuggestion, ariaSort, buildCron, canConfirm, canGoNext$1 as canGoNext, canGoPrev$1 as canGoPrev, captureFocus, clampMagicBarSearchWidth, clampPage$1 as clampPage, clampSliderValue, connectRemoteLaunch, deepestFlyMatch, enterActivatesNatively, filterGanttRows, filterGroup, filterSuggestions, findLocaleByDialect, findLocaleByPrefix, firstEnabledIndex, firstModuleIndex, flattenModules, flyAdminGuard, flyApiErrorMessage, flyCaptchaBase64Utf8, flyCaptchaBuildToken, flyCaptchaSha256Hex, flyCompactNumber, flyDebounced, flyDecimalNumber, flyDownloadBlob, flyDuration, flyEmojiFor, flyEmojiIsTonable, flyEmojiPackUrl, flyExportFileName, flyFirstEnabledIndex, flyFormatBytes, flyFormatDate, flyFormatDateTime, flyFormatMoney, flyFormatTime, flyFullNumber, flyNextEnabledIndex, flyNextSegmentIndex, flyRelativeTime, flyResolveActiveTab, flyRoleGuard, flyScanPendingDelayMs, flyScanRetry, flySignedCompact, flySkinToneLabelKey, flyStandaloneAuthGuard, flyStandaloneAuthInterceptor, flyToDateOnly, flyToPage, flyUnwrap, flyUnwrapCurrencies, flyUnwrapCurrency, flyUnwrapLenient, flyUnwrapObjectiveLookup, ganttOutlineBarItems, ganttPeriodBarItem, hasAnyRoleIn, healNativeFederationCacheOnce, initialExpanded, isAccentColor, isChunkLoadError, isFlyAuthStorePopulated, isNativeFederationCacheError, isRtlLocale, isRtlLocaleEntry, isValidCron, isValidSingleField, linkAnchorsFor, loadRemoteStyles, magicBarOwnerKey, magicBarSearchText, matchFlyRoutePattern, matchFlyRoutePrefix, matchFlyRouteTable, nextEnabledIndex, nextModuleIndex, nextSegmentIndex, nextSort, normalizeFlyTheme, normalizeGanttSearchText, normalizeRoles, novaPriorityToneVar, novaStatusToneVar, orderMagicBarItems, overlayStack, canGoNext as pagerCanGoNext, canGoPrev as pagerCanGoPrev, clampPage as pagerClampPage, parseCron, parseStepUpChallenge, parseTags, prefetchRemoteStyles, presenceColorFor, printConsoleSecurityWarning, provideFlyChunkReloadRecovery, provideFlyEmojiPack, provideFlyGanttDefaults, provideFlyOfflineAuth, provideFlyStandaloneAuth, reloadOnceForChunkError, requestAppLaunch, resolveActiveModule, resolveActiveSection, resolveActiveTab, resolveCellValue, resolveStateIcon, resolveStateMessageKey, restoreFocus, sameTags, sectionHintKey, sectionLayout, sliderTrackGradient, sparklinePath, sparklinePoints, stepUpInterceptor, stepUpReturnKey, trimAgentPayload, trimAgentString, unloadRemoteStyles, utf8ByteLength, validateAgentPayload, warnIfEmbeddedSessionMissing };
+export type { ActionMenuItem, AgentAction, AgentActionDispatch, AgentActionVerb, AgentChipHostInputs, AgentCommand, AgentCommandContextBinding, AgentCommandHandle, AgentCommandRegistration, AgentCommandScope, AgentCommandSlashSpec, AgentDragPayload, AgentDraggableItem, AgentDropChipMode, AgentDropRendererRegistration, AgentEnvelopeAttachment, AgentMcpScope, AgentMessageEnvelope, AgentPayloadLimits, AgentPayloadValidationResult, AppEveryonePrincipal, AppEveryoneTerm, AppLookup, AppLookupEntry, AudienceEditTarget, AudienceErrorCode, AudienceFilter, AudienceOptions, AudiencePresetKind, AudienceTerm, AudienceTermKind, BreadcrumbItem, ButtonSize, ButtonVariant, CardDensity, CardLayout, ChartTerm, ChildWindowData, ChipTone, ConfirmKind, ConnectRemoteLaunchOptions, ContextMenuAlign, ContextMenuItem, ContextMenuSection, CronAdvancedFieldDef, CronMode, CronParts, CronWeekday, DesktopApp, DesktopAppCategory, DesktopAppKind, DetailSection, DialogResultWithAcknowledgement, EmbeddedSessionProbe, EntityLinkLauncher, EntityLinkSelection, FilterGroup, FlyAchievementRow, FlyApiError, FlyApiResponse, FlyAppHomeLayout, FlyAppModule, FlyAppModuleSection, FlyAppUnavailableState, FlyAuthRefreshPayload, FlyAuthStoreReadable, FlyBadgeTile, FlyBreadcrumbItem, FlyCaptchaChallenge, FlyCaptchaSolution, FlyCaptchaState, FlyCellContext, FlyColumn, FlyColumnKind, FlyComment, FlyCommentDeleteRequest, FlyCommentEditRequest, FlyCommentLoadMoreRequest, FlyCommentLoadRepliesRequest, FlyCommentLockToggleRequest, FlyCommentPage, FlyCommentReportReason, FlyCommentReportRequest, FlyCommentReportStatus, FlyCommentSubmitRequest, FlyCountry, FlyCurrency, FlyCurrencyFetchFn, FlyCurrencySelectorMode, FlyCurrencySelectorValue, FlyDeepLinkPrefetchRoute, FlyDrawerBodyPadding, FlyDrawerPosition, FlyDrawerSide, FlyDrawerSize, FlyDrawerVariant, FlyEmojiCategory, FlyEmojiCell, FlyEmojiEntry, FlyEmojiPack, FlyEmojiPackEntry, FlyEmojiPackManifest, FlyEmojiPickerSize, FlyEmojiPickerTab, FlyEmojiSection, FlyFileInfo, FlyFileSelection, FlyFormAnswer, FlyFormAnswerValue, FlyFormDefinition, FlyFormFieldOptions, FlyFormOption, FlyFormQuestion, FlyFormQuestionType, FlyFormScoreDisplay, FlyFormatMoneyOptions, FlyGanttDefaults, FlyLaunchEventDetail, FlyLaunchRequestDetail, FlyLeaderboardRow, FlyLiveRefreshOptions, FlyLocaleEntry, FlyMagicBarIconName, FlyMetaItem, FlyModerationLoadPageRequest, FlyModerationLockThreadRequest, FlyModerationOpenSubjectRequest, FlyModerationReport, FlyModerationReportPage, FlyModerationResolutionStatus, FlyModerationResolveRequest, FlyMoneyDisplay, FlyNavigableItem, FlyOfflineAuthConfig, FlyPageMeta, FlyPageResult, FlyPaged, FlyPeoplePickerMode, FlyPeoplePickerOption, FlyPeopleSearchFn, FlyPointsSummary, FlyRemoteContext, FlyRemoteEagerRoute, FlyRemoteLazyRoute, FlyRemoteLoadedComponent, FlyRemoteMatch, FlyRemoteRoute, FlyRemoteRouteEventDetail, FlySearchExpandTrigger, FlySearchInputSize, FlySecureSrcState, FlySelectOption, FlySelectValue, FlySkeletonAnimation, FlySkeletonLayout, FlySkeletonShape, FlySkinTone, FlySort, FlyStandaloneAuthConfig, FlyStrategyObjectiveRef, FlyStrategyObjectiveSearchFn, FlyFileSelection as FlySurveyFileSelection, FlyFormAnswer as FlySurveyFormAnswer, FlyFormAnswerValue as FlySurveyFormAnswerValue, FlyFormDefinition as FlySurveyFormDefinition, FlyFormFieldOptions as FlySurveyFormFieldOptions, FlyFormOption as FlySurveyFormOption, FlyFormQuestion as FlySurveyFormQuestion, FlyFormQuestionType as FlySurveyQuestionType, FlyTenantDefaultCurrencyFetchFn, FlyThemeMode, FlyTooltipPlacement, FlyTreeNavNode, FlyTypeaheadOption, FlyWindowHelpHintEventDetail, FlyWindowHelpPublisher, FlyWindowPageTitleEventDetail, FlyWindowTitlePublisher, FlyosPendingLaunches, FocusRestore, FormBannerKind, GanttDependency, GanttDependencyCreate, GanttDependencyDelete, GanttDependencyType, GanttLinkVm, GanttRow, GanttRowDatesChange, GanttRowIndentChange, GanttRowKind, GanttRowReorder, GanttZoom, IconButtonVariant, LaunchContext, LifecycleRollupItem, LifecycleStep, LoadBundleOptions, LoadRemoteStylesOptions, LookupDescriptor, LookupHandle, LookupRegistration, LookupResult, LookupSearch, MagicBarAction, MagicBarActionKind, MagicBarActionSpec, MagicBarActionView, MagicBarContribution, MagicBarGroup, MagicBarGroupSpec, MagicBarGroupView, MagicBarOwnerRef, MagicBarPublisher, MagicBarRadioMenu, MagicBarRadioMenuSpec, MagicBarRadioMenuView, MagicBarRadioOption, MagicBarSearch, MagicBarSearchSeed, MagicBarSearchSpec, MagicBarSearchView, MagicBarTextParams, MagicBarTone, MagicBarView, MessageBoxButton, MessageBoxDontAskAgainConfig, MessageBoxOptions, MessageBoxOptionsWithAcknowledgement, MockAuthConfig, OpenWindowOptions, OuPrincipal, OuTerm, OverlayHandle, OverviewKpiItem, OverviewKpiTone, OverviewRow, PageHeaderVariant, PresetTerm, ProgressTone, RemoteAppDef, RequestAppLaunchOptions, RoleOuLookupRow, RolePrincipal, RolesTerm, SegmentedOption, SegmentedVariant, ShareOrgChartOption, ShareOuNode, SharePanelLevelOption, SharePermissionEntry, SharePrincipal, SharePrincipalKind, ShareUserResult, StateMessageKind, StepUpChallenge, StepUpReauthHandler, StepUpReauthRequest, TabsVariant, ToastAction, ToastEntry, ToastOptions, ToastVariant, User, UserPrincipal, UsersTerm, WindowBreadcrumb, WindowHelpHint, WindowInstance, WindowState };
 //# sourceMappingURL=flyos-design-system.d.ts.map