@loomweaver/shell 0.7.2

package/types/loomweaver-shell.d.ts

@@ -0,0 +1,2280 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, Provider, Signal, EnvironmentProviders, Type, Injector, WritableSignal } from '@angular/core';
+import { LwButtonVariant, LwButtonSize, NotificationKind, NotificationAction, NotificationInput, DialogRef, DialogTone, DialogSize, ConfirmOptions, AlertOptions, PromptOptions, OpenOptions, ProgressOptions, ProgressHandle, BarItem, RailItem, View, ContentRoute, Command, MenuItem, Disposable, SettingsSection, PaneArea, PaneAreaBase, PaneColumnArea, PaneRowArea, PaneTabArea, AuthSnapshot, AccessRequirement, ViewAction, ActiveContent, OpenTabInput, MenuContext, CommandArguments, BarSlot, Plugin, Capability, InvocableCommand, CommandOutcome } from '@loomweaver/plugin-sdk';
+export { AlertOptions, BarButtonItem, BarComponentItem, BarItem, BarSlot, ConfirmOptions, DialogButton, DialogRef, DialogSize, DialogTone, Disposable, LwButtonSize, LwButtonVariant, NotificationAction, NotificationInput, NotificationKind, OpenOptions, Plugin, PluginContext, PluginHost, PluginManifest, PluginSession, PluginUi, ProgressHandle, ProgressOptions, PromptOptions, RailItem, RequireConfirmation, SelectOption, SettingButton, SettingComponent, SettingControl, SettingRow, SettingSelect, SettingSlider, SettingText, SettingToggle, SettingsSection, UiMenuItem, View, ViewAction } from '@loomweaver/plugin-sdk';
+import { Routes } from '@angular/router';
+
+/** Where a region docks in the border topology. */
+type DockPosition = 'top' | 'bottom' | 'left' | 'right' | 'center';
+/** Region anatomy types. */
+type RegionType = 'bar' | 'rail' | 'panel' | 'content';
+/** One region the distribution places into the border frame. */
+interface LayoutRegion {
+    /** Stable id (slot targeting, collapse state, ordering). */
+    readonly id: string;
+    readonly type: RegionType;
+    readonly dock: DockPosition;
+}
+/** A distribution's declared base layout — the Core renders it (declarative, Stufe A). */
+interface ShellLayout {
+    readonly regions: readonly LayoutRegion[];
+}
+/**
+ * Bare default: a top Bar (header) over the Content-Area, with a status Bar under it.
+ *
+ * The status bar is not decoration — the shell's own default contributions include one that docks
+ * there, and a default aimed at a region the default layout omits renders nothing and reports
+ * nothing. Every region a shell default targets belongs here; `tools/check-region-ids.mjs` fails
+ * the build when one does not.
+ */
+declare const DEFAULT_LAYOUT: ShellLayout;
+/** Active layout. Defaults to {@link DEFAULT_LAYOUT}; a distribution overrides it. */
+declare const SHELL_LAYOUT: InjectionToken<ShellLayout>;
+/** A distribution declares its base layout with this provider. */
+declare function provideLayout(layout: ShellLayout): Provider;
+
+declare class ViewportService {
+    private readonly document;
+    readonly compact: Signal<boolean>;
+    private watchCompact;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ViewportService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ViewportService>;
+}
+
+/**
+ * Opening a surface in its own browser window, and knowing whether this window **is** one.
+ *
+ * A pop-out boots the same app from a `/popout/…` URL and renders exactly one surface — no rail, no
+ * sidebars, no pane tree — so the main window stays the only writer of the layout keys. The mode is
+ * read from the location once at startup: a pop-out never becomes a main window, and the shell needs
+ * the answer before it renders anything.
+ */
+declare class PopoutService {
+    /** Whether this browser window is a pop-out. Fixed for the window's lifetime. */
+    readonly active: boolean;
+    private readonly document;
+    private readonly dialogs;
+    private readonly transloco;
+    constructor();
+    /**
+     * Opens `paneTarget` — a `view:<viewId>` descriptor or a content-route path — in a new browser
+     * window. The tab it came from **stays** where it is: this duplicates, it does not move. If the
+     * pop-up blocker swallows the window, the user gets a dialog whose button is a fresh gesture that
+     * practically always gets through.
+     */
+    open(paneTarget: string): void;
+    private tryOpen;
+    static ɵfac: i0.ɵɵFactoryDeclaration<PopoutService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<PopoutService>;
+}
+
+/** Layout host: renders the declared regions into the border topology. */
+declare class Shell {
+    private readonly layout;
+    private readonly panels;
+    protected readonly viewport: ViewportService;
+    protected readonly popout: PopoutService;
+    protected readonly topBars: LayoutRegion[];
+    protected readonly bottomBars: LayoutRegion[];
+    protected readonly leftRails: LayoutRegion[];
+    protected readonly leftPanels: LayoutRegion[];
+    protected readonly rightPanels: LayoutRegion[];
+    protected readonly rightRails: LayoutRegion[];
+    protected readonly hasContent: boolean;
+    protected readonly leftFloating: i0.Signal<LayoutRegion[]>;
+    protected readonly rightFloating: i0.Signal<LayoutRegion[]>;
+    protected readonly leftEdgeBorder: i0.Signal<boolean>;
+    protected readonly rightEdgeBorder: i0.Signal<boolean>;
+    protected readonly leftRailDivider: i0.Signal<boolean>;
+    protected readonly rightRailDivider: i0.Signal<boolean>;
+    private readonly theme;
+    private readonly fontScale;
+    protected panelCollapsed(panel: LayoutRegion): boolean;
+    protected isOverlayOpen(regionId: string): boolean;
+    protected anyOverlayOpen(): boolean;
+    protected closeOverlay(): void;
+    private floating;
+    private railDivider;
+    private edgeHasBody;
+    private regionsAt;
+    static ɵfac: i0.ɵɵFactoryDeclaration<Shell, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<Shell, "lw-shell", never, {}, {}, never, never, true, never>;
+}
+
+type RetentionDefault = 'destroy' | 'retain';
+
+/** Options a distribution can pass to {@link provideShell}. */
+interface ShellOptions {
+    /**
+     * Contribution ids to hide — a distribution drops a default it does not want (e.g.
+     * `['shell.language']`). A **lasting** filter, not a one-time delete: an id a plugin
+     * registers later stays hidden too. To *replace* a default instead of hiding it, register
+     * your own contribution with the same id (last-in wins) and do **not** omit it.
+     *
+     * Covers **every** contribution kind. Chrome — commands, views, bar items, rail items — is
+     * addressed by bare id. The other kinds carry a **prefix**, because ids from different kinds may
+     * coincide and there is exactly one shared omit set: an unprefixed omit stays chrome-only and never
+     * silently takes a same-named contribution of another kind with it (`shell.language`, for one, is
+     * both a top-bar item and a settings row).
+     *
+     * - `menu:<commandId>` — one menu entry, leaving the command itself (palette/shortcut) alive.
+     * - `setting:<id>` — a whole section (`'setting:shell.permissions'`) or a single row
+     *   (`'setting:shell.textSize'`); a section left without rows disappears.
+     * - `route:<surfaceId>` — a routable surface's content route. It leaves the tab strip,
+     *   the auto-open on deep-link and the pane target picker; its URL renders a neutral "not available
+     *   here" placeholder rather than falling back to home, so a shared deep-link explains itself.
+     *   Addressed by the surface **id**, while a route is *overridden* by its `path` (registering your
+     *   own surface on the same path wins) — two handles, deliberately, for two different operations.
+     */
+    readonly omit?: readonly string[];
+    /**
+     * Whether to register the application's service worker — `true` by default, and inert in dev
+     * either way. The shell owns the registration so that the update badge, the update
+     * toast and `ctx.host.checkForUpdate()` work in a distribution that only ships the build
+     * artefacts; you do **not** add `provideServiceWorker` yourself.
+     *
+     * Pass `false` when your build emits no `ngsw-worker.js` (no `serviceWorker` option in the build
+     * target). Registration would otherwise 404 in production and log a failure. Nothing else
+     * changes: `UpdateService` injects `SwUpdate` optionally, so it simply reports
+     * {@link UpdateService.enabled} as `false` and never offers an update.
+     *
+     * `@angular/service-worker` stays a peer dependency regardless — the opt-out removes the
+     * registration, not the import.
+     */
+    readonly serviceWorker?: boolean;
+    /**
+     * The app-wide retention default for **hidden** surfaces: `'destroy'` (the default) destroys a
+     * hidden, clean surface, so state that must survive belongs in `VIEW_STATE`; `'retain'` keeps
+     * every hidden instance alive at the price of memory growing with every surface ever shown. A
+     * surface's own `retain: 'always' | 'never'` declaration wins over this default. `iframe` and
+     * `container` surfaces are always rebuilt regardless.
+     *
+     * This is a storage policy for the developer, not a capability the user can see, which is why it
+     * lives here rather than in `provideShellFeatures`.
+     */
+    readonly retention?: RetentionDefault;
+}
+/**
+ * Wires the neutral shell host (theme, i18n, icons, error handling) for a
+ * distribution. A distribution adds its own router and product identity; the
+ * bare platform falls back to the LoomWeaver identity.
+ */
+declare function provideShell(options?: ShellOptions): (Provider | EnvironmentProviders)[];
+
+/**
+ * Gestures the content area offers on tabs and panes. Each field takes the **affordance and the
+ * gesture**: switching one off removes the button, the drag target and the keyboard shortcut alike,
+ * so a capability can never come back through a second door.
+ */
+interface ContentFeatures {
+    /** Closing a tab: the × affordance, the `Delete` key and the close entries of the tab menu. */
+    readonly close: boolean;
+    /** Pinning a tab: the menu entry, the pin affordance and the pin step of the double-click cycle. */
+    readonly pin: boolean;
+    /**
+     * The double-click cycle on a tab (preview → keep → pin → unpin). The first step is the one users
+     * arrive expecting, and a preview tab says so itself — its tooltip reads "double-click to keep
+     * open", which is why the hint is drawn only while this is on. Switch it off and the tooltip drops
+     * the promise; every step of the cycle stays reachable from the tab's context menu either way.
+     */
+    readonly escalate: boolean;
+    /** Dragging a tab into another pane, and onto an empty pane. */
+    readonly moveTabs: boolean;
+    /** The single reused italic **preview** slot (VS-Code "Preview Editors"). With it off, `openContentTab({ preview: true })` opens a permanent tab. */
+    readonly preview: boolean;
+    /** The "+" button that opens the new-tab picker. */
+    readonly newTab: boolean;
+    /** Splitting a pane horizontally: the toolbar button, the left/right drop edges and `mod+\`. */
+    readonly splitRight: boolean;
+    /** Splitting a pane vertically: the toolbar button and the top/bottom drop edges. */
+    readonly splitDown: boolean;
+    /** Blowing a pane up to the whole content area. */
+    readonly maximize: boolean;
+    /** Collapsing a pane into the minimised strip. */
+    readonly minimize: boolean;
+    /** Reordering tabs within their band, by drag or `Alt+Arrow`. */
+    readonly reorderTabs: boolean;
+}
+/** Gestures the side panels offer on their docked views. */
+interface SidebarFeatures {
+    /** Collapsing and expanding a panel. The close button of the compact drawer is not affected. */
+    readonly collapse: boolean;
+    /** Dragging a panel wider or narrower. */
+    readonly resize: boolean;
+    /** Reordering view tabs **within** one panel, by drag or `Alt+Arrow`. */
+    readonly reorderViews: boolean;
+    /** Moving a view to the other sidebar: the menu entry, the drag and `Alt+Shift+Arrow`. */
+    readonly moveViews: boolean;
+    /** Hiding a view from this workspace (menu entry). */
+    readonly hideViews: boolean;
+    /** The checklist on the icon strip that says which views live here. */
+    readonly curate: boolean;
+    /** Stacking a second view below the first: the menu entry and the drop edges of a panel. */
+    readonly stackViews: boolean;
+    /** Parking a foreign tab in a sidebar, by dragging it onto the strip or a drop edge. */
+    readonly acceptTabs: boolean;
+    /** Opening a docked view in the content area (menu entry). */
+    readonly openViewInContent: boolean;
+    /** Resetting the stored state of a view (menu entry). */
+    readonly resetViewState: boolean;
+    /** The named-instance switcher in the panel header, where a surface declares `instanceable`. */
+    readonly instances: boolean;
+}
+/** Gestures the rail offers on its items. */
+interface RailFeatures {
+    /** Reordering rail items **within** their band, by drag or `Alt+Arrow`. */
+    readonly reorder: boolean;
+    /** Moving an item to the other rail: the menu entry, the drag and `Alt+Shift+Arrow`. */
+    readonly moveItems: boolean;
+    /** Hiding a rail item (menu entry). */
+    readonly hideItems: boolean;
+    /** The checklist on empty rail space that says which items live here. */
+    readonly curate: boolean;
+}
+/** Whether named workspaces exist for this product at all. */
+interface WorkspaceFeatures {
+    /**
+     * The workspace machinery the shell offers on its own: the manage and reset commands and the
+     * workspace entries in the rail. Switching it off leaves the storage scoping untouched — the
+     * active workspace still names the layout keys, the user just never meets the concept.
+     */
+    readonly enabled: boolean;
+    /**
+     * Whether the user may put a workspace **they saved** in the rail. A saved workspace is never
+     * there by itself — the user places it from *Customize activity bar* — and switching this off
+     * withdraws that offer, so the rail holds what your product put there and nothing else. Their
+     * placements are kept rather than erased, so switching it back on restores what each user had.
+     *
+     * Everything else about a saved workspace is untouched: saving, renaming, resetting and switching
+     * all work, with the workspace dialog as the way to them. This says nothing about **whether** a
+     * user may save workspaces, which is a different question and has no switch.
+     */
+    readonly savedInRail: boolean;
+}
+/** Whether a tab or a view may be torn off into a browser window of its own. */
+interface WindowFeatures {
+    /** "Open in new window" on a tab and on a docked view. */
+    readonly popout: boolean;
+}
+/** How commands reach the user beyond the buttons that name them. */
+interface CommandFeatures {
+    /**
+     * Keyboard shortcuts at all: the global listener that turns a chord into a command, and the
+     * chord hints the shell prints beside menu entries, palette rows and bar buttons. With it off a
+     * command is still reachable by its button and by the palette, and no hint promises a key that
+     * does nothing.
+     */
+    readonly shortcuts: boolean;
+    /** The "recently used" section at the top of the command palette (and the list behind it). */
+    readonly recentlyUsed: boolean;
+}
+/**
+ * Which shell capabilities a distribution offers its users. The platform ships the full workbench —
+ * every capability here is on by default — and a product that would overwhelm its users switches
+ * parts off.
+ *
+ * This is the home for **gestures**. A *contribution* (a command, a bar or rail item, a settings row,
+ * a menu entry) is not a gesture and is removed with `provideShell({ omit })` instead. Where a
+ * capability has both — a menu entry *and* a drag — the feature switch wins and takes the entry with
+ * it, while `omit` stays the finer tool for "entry gone, gesture stays".
+ */
+interface ShellFeatures {
+    readonly content: ContentFeatures;
+    readonly sidebar: SidebarFeatures;
+    readonly rail: RailFeatures;
+    readonly workspaces: WorkspaceFeatures;
+    readonly windows: WindowFeatures;
+    readonly commands: CommandFeatures;
+}
+/** The default workbench: every capability on. */
+declare const DEFAULT_SHELL_FEATURES: ShellFeatures;
+declare const SHELL_FEATURES: InjectionToken<ShellFeatures>;
+/** A partial override: name only what you switch off, group by group. */
+type ShellFeaturesInput = {
+    readonly [Group in keyof ShellFeatures]?: Partial<ShellFeatures[Group]>;
+};
+/**
+ * Switches shell capabilities off for this distribution, e.g.
+ * `provideShellFeatures({ content: { splitDown: false, maximize: false } })`. Omit for the full
+ * workbench; fields merge group by group, so a partial override leaves the rest of that group alone.
+ */
+declare function provideShellFeatures(features: ShellFeaturesInput): EnvironmentProviders;
+
+/**
+ * Extra translation namespaces a distribution composes on top of the host base. Each is served at `/i18n/<name>/<lang>.json` and nested under its key, so its strings
+ * live at `name.*` and can never collide with a host key. Used for a weaver's own strings
+ * (`demo`) and for distribution branding (`product`).
+ */
+declare const TRANSLATION_NAMESPACES: InjectionToken<readonly string[]>;
+/**
+ * A distribution declares which namespaced translation bundles to load — the weavers it bundles
+ * (e.g. `'testbed'`) and its own branding (`'product'`). The bare platform registers none;
+ * its host keys are the whole story.
+ */
+declare function provideTranslationNamespaces(...namespaces: string[]): Provider;
+/** Directory the distribution serves its overlay bundles from, without a trailing slash. */
+declare const TRANSLATION_OVERRIDES: InjectionToken<string>;
+/**
+ * Load `<basePath>/<lang>.json` and merge it over everything else **key by key**, so a product
+ * can reword the shell in its own house language ("Save as" rather than "Save as new") without
+ * forking our bundle: name only the keys you change and inherit the rest, including every key a
+ * later release adds. It is applied last, so it also reaches a bundled weaver's strings.
+ *
+ * Namespaces (`provideTranslationNamespaces`) remain the way to *add* your own strings, and they can
+ * still never collide with a host key. This is the opposite job — replacing one — which is why it is
+ * a separate, deliberate opt-in rather than a namespace with a magic name.
+ *
+ * `basePath` lets one build carry several wordings and pick one while composing — a white-label
+ * distribution that serves three brands from the same bundle, or a demo that switches product.
+ * A product with a backend does not need it: the default path is same-origin, so its server can
+ * already vary the bytes per tenant. Omit it and nothing changes.
+ *
+ * A language with no overlay file keeps the shipped strings (dev-warned). A key the overlay names but
+ * nothing ships is dev-warned too, since a typo there would otherwise be a string that never appears.
+ */
+declare function provideTranslationOverrides(basePath?: string): Provider;
+
+/**
+ * The neutral host button primitive. A directive on a real `<button>`/`<a>`, so it
+ * keeps native semantics (type, disabled, focus, aria) and its own content — consumers just add
+ * `lwButton` and pick a variant.
+ *
+ * The button LOOK is a CSS-class contract (`.lw-btn` in theme.css): this directive is
+ * only a thin wrapper that emits those class names from typed inputs. So the very same look is
+ * reachable by SDK-only plugins that cannot import this directive across the Nx boundary — they
+ * write `<button class="lw-btn lw-btn--primary">`. One source of truth, all on semantic tokens,
+ * so a theme / tenant override reaches host and plugin buttons alike.
+ *
+ *   <button lwButton variant="primary" (click)="save()">Speichern</button>
+ *   <button lwButton variant="ghost" size="sm" iconOnly aria-label="…"><lw-icon … /></button>
+ */
+declare class LwButton {
+    /** Visual weight; defaults to `default`. */
+    readonly variant: i0.InputSignal<LwButtonVariant>;
+    /** Size; defaults to `md`. */
+    readonly size: i0.InputSignal<LwButtonSize>;
+    /** Square, equal-padding button for a single icon (needs its own `aria-label`). */
+    readonly iconOnly: i0.InputSignalWithTransform<boolean, unknown>;
+    protected readonly classes: i0.Signal<string>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<LwButton, never>;
+    static ɵdir: i0.ɵɵDirectiveDeclaration<LwButton, "button[lwButton], a[lwButton]", never, { "variant": { "alias": "variant"; "required": false; "isSignal": true; }; "size": { "alias": "size"; "required": false; "isSignal": true; }; "iconOnly": { "alias": "iconOnly"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
+}
+
+/** The custom-element tag. */
+declare const LW_BUTTON_TAG = "lw-button";
+/**
+ * `<lw-button variant="primary">Save</lw-button>` — the host button primitive as a framework-agnostic
+ * custom element (like `<lw-tooltip>`/`<lw-select>`/`<lw-menu>`): light DOM (its content stays
+ * in place), a `role="button"` element that emits the same **`.lw-btn` CSS-class contract**
+ * (`theme.css`) the {@link LwButton} directive does — one source of truth for the look, on semantic tokens.
+ *
+ * The Angular {@link LwButton} directive stays the idiomatic choice for host chrome (it sits on a **native**
+ * `<button>`/`<a>`, keeping native semantics). This element is the framework-agnostic path for a weaver body
+ * or a sandboxed iframe that cannot import the directive across the Nx boundary. It adds keyboard activation
+ * (Enter/Space) and `disabled` so a `role="button"` behaves like a button.
+ *
+ *   <lw-button variant="primary" (click)="save()">Speichern</lw-button>
+ *   <lw-button variant="ghost" size="sm" icon-only aria-label="…"><!-- icon --></lw-button>
+ */
+declare class LwButtonElement extends HTMLElement {
+    static readonly observedAttributes: string[];
+    get variant(): LwButtonVariant;
+    set variant(value: LwButtonVariant | null);
+    get size(): LwButtonSize;
+    set size(value: LwButtonSize | null);
+    get iconOnly(): boolean;
+    set iconOnly(value: boolean);
+    get disabled(): boolean;
+    set disabled(value: boolean);
+    connectedCallback(): void;
+    disconnectedCallback(): void;
+    attributeChangedCallback(): void;
+    private readonly onKeydown;
+    private render;
+}
+/** Registers `<lw-button>` once (idempotent) — called from {@link provideShell} at bootstrap. */
+declare function defineLwButton(): void;
+
+/** The custom-element tag. */
+declare const LW_MARKDOWN_TAG = "lw-markdown";
+/**
+ * `<lw-markdown source="…">` — the host rich-text primitive as a framework-agnostic custom element
+ * (like `<lw-tooltip>`/`<lw-select>`/`<lw-menu>`): a plain `HTMLElement`, **light DOM**, so the
+ * `prose-lw` Tailwind-Typography classes + `--lw-*` tokens cascade in (auto dark-mode). It does
+ * no formatting logic of its own — `marked` parses, **DOMPurify** sanitizes (scripts / `on*` / `javascript:`
+ * stripped; the element renders raw `innerHTML`, so this is the security seam, like the icon registry).
+ * Reusable anywhere rich text is needed (dialog bodies, About, weaver content), and — unlike the old
+ * Angular component — usable in a weaver body by tag, no `@loomweaver/shell` import.
+ *
+ *   <lw-markdown [source]="'Delete **' + name + '**? This cannot be undone.'"></lw-markdown>
+ */
+declare class LwMarkdownElement extends HTMLElement {
+    static readonly observedAttributes: string[];
+    private prose?;
+    get source(): string;
+    set source(value: string | null);
+    connectedCallback(): void;
+    attributeChangedCallback(): void;
+    private render;
+}
+/** Registers `<lw-markdown>` once (idempotent) — called from {@link provideShell} at bootstrap. */
+declare function defineLwMarkdown(): void;
+
+/**
+ * A small indeterminate spinner. Pure CSS ring on `currentColor`
+ * (brand by default), sized via the `size` input. Used by the progress dialog and anywhere a
+ * busy indicator is needed.
+ *
+ *   <lw-spinner />
+ *   <lw-spinner size="1rem" [label]="'…' | transloco" />
+ */
+declare class LwSpinner {
+    /** CSS size of the spinner (width = height). */
+    readonly size: i0.InputSignal<string>;
+    /** Accessible label announced to screen readers — pass a translated string; empty = none. */
+    readonly label: i0.InputSignal<string>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<LwSpinner, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<LwSpinner, "lw-spinner", never, { "size": { "alias": "size"; "required": false; "isSignal": true; }; "label": { "alias": "label"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
+}
+
+/** Tooltip placement relative to the trigger — the element positions the bubble in JS accordingly. */
+type TooltipPosition = 'top' | 'bottom' | 'left' | 'right';
+/** The custom-element tag. Authored as the last child of a `position: relative` trigger. */
+declare const LW_TOOLTIP_TAG = "lw-tooltip";
+/**
+ * `<lw-tooltip>` — the host tooltip primitive as a **framework-agnostic custom element**.
+ * It is a plain `HTMLElement` (no framework runtime), so it crosses the Nx boundary as a *tag* (an
+ * SDK-only weaver uses `<lw-tooltip text="…" position="bottom">` without importing `@loomweaver/shell`) and,
+ * later, an iframe/sandbox boundary once the element script is served alongside `theme.css`.
+ *
+ * The element renders the bubble and drives it entirely in JS — reveal, hide, and **positioning**. The
+ * bubble is a **Popover** in the browser top layer, so it is never clipped by a `transform`/`overflow`
+ * ancestor (a virtual-scroll row) nor lost under a region's z-order (#13). Its `left`/`top` are computed
+ * in JS (no CSS anchor positioning — shipping Safari does not support it): a **pointer** reveal anchors to
+ * the **cursor** (native-`title`-like, so a wide trigger's tooltip appears where the mouse is, not at the
+ * element's far edge); a **focus** reveal anchors to the trigger element per `position`. Reveal is off the
+ * trigger's hover/focus (mouse only — touch never reveals). Its **look** lives in `theme.css`
+ * (`.lw-tooltip-bubble`, tokened) like `.lw-btn`. Place it as the last child of a positioned trigger:
+ *
+ *   <button class="relative …" [attr.aria-label]="'key' | transloco">
+ *     <lw-icon name="…" />
+ *     <lw-tooltip text="…" position="bottom"></lw-tooltip>
+ *   </button>
+ */
+declare class LwTooltipElement extends HTMLElement {
+    static readonly observedAttributes: string[];
+    private bubble?;
+    private trigger?;
+    private showTimer?;
+    private pointer?;
+    get text(): string | null;
+    set text(value: string | null);
+    get position(): TooltipPosition;
+    set position(value: TooltipPosition | null);
+    connectedCallback(): void;
+    disconnectedCallback(): void;
+    attributeChangedCallback(): void;
+    private readonly onEnter;
+    private readonly onMove;
+    private readonly onLeave;
+    private readonly onFocusIn;
+    private readonly onFocusOut;
+    private render;
+    private createBubble;
+    private scheduleShow;
+    private delayMs;
+    private show;
+    private placeBubble;
+    private hide;
+    private clearTimer;
+}
+/** Registers `<lw-tooltip>` once (idempotent) — called from {@link provideShell} at bootstrap. */
+declare function defineLwTooltip(): void;
+
+/**
+ * Displays the running build's version, e.g. `v0.1.0`. A neutral host-offered widget
+ * any distribution or plugin can embed (status bar, about dialog, …); the number comes
+ * from {@link VersionService}, never hardcoded.
+ *
+ *   <lw-version />          → v0.1.0
+ *   <lw-version prefix="" /> → 0.1.0
+ */
+declare class LwVersion {
+    private readonly versions;
+    /** Text shown before the number; set to `''` to hide. */
+    readonly prefix: i0.InputSignal<string>;
+    protected readonly label: i0.Signal<string>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<LwVersion, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<LwVersion, "lw-version", never, { "prefix": { "alias": "prefix"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
+}
+
+declare const LOOM_ICONS: {
+    readonly themeLight: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M12 3v2.25m6.364.386-1.591 1.591M21 12h-2.25m-.386 6.364-1.591-1.591M12 18.75V21m-4.773-4.227-1.591 1.591M5.25 12H3m4.227-4.773L5.636 5.636M15.75 12a3.75 3.75 0 1 1-7.5 0 3.75 3.75 0 0 1 7.5 0Z\"></path></svg>";
+    readonly themeDark: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M21.752 15.002A9.72 9.72 0 0 1 18 15.75c-5.385 0-9.75-4.365-9.75-9.75 0-1.33.266-2.597.748-3.752A9.753 9.753 0 0 0 3 11.25C3 16.635 7.365 21 12.75 21a9.753 9.753 0 0 0 9.002-5.998Z\"></path></svg>";
+    readonly themeSystem: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 17.25v1.007a3 3 0 0 1-.879 2.122L7.5 21h9l-.621-.621A3 3 0 0 1 15 18.257V17.25m6-12V15a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 15V5.25m18 0A2.25 2.25 0 0 0 18.75 3H5.25A2.25 2.25 0 0 0 3 5.25m18 0V12a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 12V5.25\"></path></svg>";
+    readonly chevronsLeft: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m18.75 4.5-7.5 7.5 7.5 7.5m-6-15L5.25 12l7.5 7.5\"></path></svg>";
+    readonly chevronsRight: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m5.25 4.5 7.5 7.5-7.5 7.5m6-15 7.5 7.5-7.5 7.5\"></path></svg>";
+    readonly chevronDown: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m19.5 8.25-7.5 7.5-7.5-7.5\"></path></svg>";
+    readonly check: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m4.5 12.75 6 6 9-13.5\"></path></svg>";
+    readonly close: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M6 18 18 6M6 6l12 12\"></path></svg>";
+    readonly pin: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke-width=\"1.5\" stroke=\"currentColor\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M8 4h8M10.5 4v7M13.5 4v7M7 11h10M12 11v9\"/></svg>";
+    readonly save: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke-width=\"1.5\" stroke=\"currentColor\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M17 3.75H5.25a1.5 1.5 0 0 0-1.5 1.5v13.5a1.5 1.5 0 0 0 1.5 1.5h13.5a1.5 1.5 0 0 0 1.5-1.5V7l-3.25-3.25Z\"/><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M8.25 3.75v4.5h6.5v-4.5M7.75 20.25v-7h8.5v7\"/></svg>";
+    readonly splitPanes: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke-width=\"1.5\" stroke=\"currentColor\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4 5.25h16a.75.75 0 0 1 .75.75v12a.75.75 0 0 1-.75.75H4a.75.75 0 0 1-.75-.75V6a.75.75 0 0 1 .75-.75ZM12 5.25v13.5\"/></svg>";
+    readonly splitPanesDown: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke-width=\"1.5\" stroke=\"currentColor\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4 5.25h16a.75.75 0 0 1 .75.75v12a.75.75 0 0 1-.75.75H4a.75.75 0 0 1-.75-.75V6a.75.75 0 0 1 .75-.75ZM3.25 12h17.5\"/></svg>";
+    readonly workspaces: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M2.25 7.125C2.25 6.504 2.754 6 3.375 6h6c.621 0 1.125.504 1.125 1.125v3.75c0 .621-.504 1.125-1.125 1.125h-6a1.125 1.125 0 0 1-1.125-1.125v-3.75ZM14.25 8.625c0-.621.504-1.125 1.125-1.125h5.25c.621 0 1.125.504 1.125 1.125v8.25c0 .621-.504 1.125-1.125 1.125h-5.25a1.125 1.125 0 0 1-1.125-1.125v-8.25ZM3.75 16.125c0-.621.504-1.125 1.125-1.125h5.25c.621 0 1.125.504 1.125 1.125v2.25c0 .621-.504 1.125-1.125 1.125h-5.25a1.125 1.125 0 0 1-1.125-1.125v-2.25Z\"></path></svg>";
+    readonly menu: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5\"></path></svg>";
+    readonly document: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M19.5 14.25v-2.625a3.375 3.375 0 0 0-3.375-3.375h-1.5A1.125 1.125 0 0 1 13.5 7.125v-1.5a3.375 3.375 0 0 0-3.375-3.375H8.25m2.25 0H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 0 0-9-9Z\"></path></svg>";
+    readonly navigator: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5\"></path></svg>";
+    readonly outline: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M8.25 6.75h12M8.25 12h12m-12 5.25h12M3.75 6.75h.007v.008H3.75V6.75Zm.375 0a.375.375 0 1 1-.75 0 .375.375 0 0 1 .75 0ZM3.75 12h.007v.008H3.75V12Zm.375 0a.375.375 0 1 1-.75 0 .375.375 0 0 1 .75 0Zm-.375 5.25h.007v.008H3.75v-.008Zm.375 0a.375.375 0 1 1-.75 0 .375.375 0 0 1 .75 0Z\"></path></svg>";
+    readonly add: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M12 4.5v15m7.5-7.5h-15\"></path></svg>";
+    readonly edit: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m16.862 4.487 1.687-1.688a1.875 1.875 0 1 1 2.652 2.652L10.582 16.07a4.5 4.5 0 0 1-1.897 1.13L6 18l.8-2.685a4.5 4.5 0 0 1 1.13-1.897l8.932-8.931Zm0 0L19.5 7.125M18 14v4.75A2.25 2.25 0 0 1 15.75 21H5.25A2.25 2.25 0 0 1 3 18.75V8.25A2.25 2.25 0 0 1 5.25 6H10\"></path></svg>";
+    readonly trash: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m14.74 9-.346 9m-4.788 0L9.26 9m9.968-3.21c.342.052.682.107 1.022.166m-1.022-.165L18.16 19.673a2.25 2.25 0 0 1-2.244 2.077H8.084a2.25 2.25 0 0 1-2.244-2.077L4.772 5.79m14.456 0a48.108 48.108 0 0 0-3.478-.397m-12 .562c.34-.059.68-.114 1.022-.165m0 0a48.11 48.11 0 0 1 3.478-.397m7.5 0v-.916c0-1.18-.91-2.164-2.09-2.201a51.964 51.964 0 0 0-3.32 0c-1.18.037-2.09 1.022-2.09 2.201v.916m7.5 0a48.667 48.667 0 0 0-7.5 0\"></path></svg>";
+    readonly preview: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M2.036 12.322a1.012 1.012 0 0 1 0-.639C3.423 7.51 7.36 4.5 12 4.5c4.638 0 8.573 3.007 9.963 7.178.07.207.07.431 0 .639C20.577 16.49 16.64 19.5 12 19.5c-4.638 0-8.573-3.007-9.963-7.178Z\"></path><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M15 12a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z\"></path></svg>";
+    readonly sort: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M3 7.5 7.5 3m0 0L12 7.5M7.5 3v13.5m13.5 0L16.5 21m0 0L12 16.5m4.5 4.5V7.5\"></path></svg>";
+    readonly reset: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.023 9.348h4.992v-.001M2.985 19.644v-4.992m0 0h4.992m-4.993 0 3.181 3.183a8.25 8.25 0 0 0 13.803-3.7M4.031 9.865a8.25 8.25 0 0 1 13.803-3.7l3.181 3.182m0-4.991v4.99\"></path></svg>";
+    readonly undo: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 15 3 9m0 0 6-6M3 9h12a6 6 0 0 1 0 12h-3\"></path></svg>";
+    readonly info: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m11.25 11.25.041-.02a.75.75 0 0 1 1.063.852l-.708 2.836a.75.75 0 0 0 1.063.853l.041-.021M21 12a9 9 0 1 1-18 0 9 9 0 0 1 18 0Zm-9-3.75h.008v.008H12V8.25Z\"></path></svg>";
+    readonly lock: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 10.5V6.75a4.5 4.5 0 1 0-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 0 0 2.25-2.25v-6.75a2.25 2.25 0 0 0-2.25-2.25H6.75a2.25 2.25 0 0 0-2.25 2.25v6.75a2.25 2.25 0 0 0 2.25 2.25Z\"></path></svg>";
+    readonly success: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m4.5 12.75 6 6 9-13.5\"></path></svg>";
+    readonly warning: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126ZM12 15.75h.007v.008H12v-.008Z\"></path></svg>";
+    readonly error: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m9.75 9.75 4.5 4.5m0-4.5-4.5 4.5M21 12a9 9 0 1 1-18 0 9 9 0 0 1 18 0Z\"></path></svg>";
+    readonly settings: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9.594 3.94c.09-.542.56-.94 1.11-.94h2.593c.55 0 1.02.398 1.11.94l.213 1.281c.063.374.313.686.645.87.074.04.147.083.22.127.325.196.72.257 1.075.124l1.217-.456a1.125 1.125 0 0 1 1.37.49l1.296 2.247a1.125 1.125 0 0 1-.26 1.431l-1.003.827c-.293.241-.438.613-.43.992a7.723 7.723 0 0 1 0 .255c-.008.378.137.75.43.991l1.004.827c.424.35.534.955.26 1.43l-1.298 2.247a1.125 1.125 0 0 1-1.369.491l-1.217-.456c-.355-.133-.75-.072-1.076.124a6.47 6.47 0 0 1-.22.128c-.331.183-.581.495-.644.869l-.213 1.281c-.09.543-.56.94-1.11.94h-2.594c-.55 0-1.019-.398-1.11-.94l-.213-1.281c-.062-.374-.312-.686-.644-.87a6.52 6.52 0 0 1-.22-.127c-.325-.196-.72-.257-1.076-.124l-1.217.456a1.125 1.125 0 0 1-1.369-.49l-1.297-2.247a1.125 1.125 0 0 1 .26-1.431l1.004-.827c.292-.24.437-.613.43-.991a6.932 6.932 0 0 1 0-.255c.007-.38-.138-.751-.43-.992l-1.004-.827a1.125 1.125 0 0 1-.26-1.43l1.297-2.247a1.125 1.125 0 0 1 1.37-.491l1.216.456c.356.133.751.072 1.076-.124.072-.044.146-.086.22-.128.332-.183.582-.495.644-.869l.214-1.28Z\"></path><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M15 12a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z\"></path></svg>";
+    readonly help: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9.879 7.519c1.171-1.025 3.071-1.025 4.242 0 1.172 1.025 1.172 2.687 0 3.712-.203.179-.43.326-.67.442-.745.361-1.45.999-1.45 1.827v.75M21 12a9 9 0 1 1-18 0 9 9 0 0 1 18 0Zm-9 5.25h.008v.008H12v-.008Z\"></path></svg>";
+    readonly search: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"m21 21-5.197-5.197m0 0A7.5 7.5 0 1 0 5.196 5.196a7.5 7.5 0 0 0 10.607 10.607Z\"></path></svg>";
+    readonly plugin: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M14.25 6.087c0-.355.186-.676.401-.959.221-.29.349-.634.349-1.003 0-1.036-1.007-1.875-2.25-1.875s-2.25.84-2.25 1.875c0 .369.128.713.349 1.003.215.283.401.604.401.959v0a.64.64 0 0 1-.657.643 48.39 48.39 0 0 1-4.163-.3c.186 1.613.293 3.25.315 4.907a.656.656 0 0 1-.658.663v0c-.355 0-.676-.186-.959-.401a1.647 1.647 0 0 0-1.003-.349c-1.036 0-1.875 1.007-1.875 2.25s.84 2.25 1.875 2.25c.369 0 .713-.128 1.003-.349.283-.215.604-.401.959-.401v0c.31 0 .555.26.532.57a48.039 48.039 0 0 1-.642 5.056c1.518.19 3.058.309 4.616.354a.64.64 0 0 0 .657-.643v0c0-.355-.186-.676-.401-.959a1.647 1.647 0 0 1-.349-1.003c0-1.035 1.008-1.875 2.25-1.875 1.243 0 2.25.84 2.25 1.875 0 .369-.128.713-.349 1.003-.215.283-.4.604-.4.959v0c0 .333.277.599.61.58a48.1 48.1 0 0 0 5.427-.63 48.05 48.05 0 0 0 .582-4.717.532.532 0 0 0-.533-.57v0c-.355 0-.676.186-.959.401-.29.221-.634.349-1.003.349-1.035 0-1.875-1.007-1.875-2.25s.84-2.25 1.875-2.25c.37 0 .713.128 1.003.349.283.215.604.401.96.401v0a.656.656 0 0 0 .658-.663 48.422 48.422 0 0 0-.37-5.36c-1.886.342-3.81.574-5.766.689a.578.578 0 0 1-.61-.58v0Z\"></path></svg>";
+    readonly download: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M3 16.5v2.25A2.25 2.25 0 0 0 5.25 21h13.5A2.25 2.25 0 0 0 21 18.75V16.5M16.5 12 12 16.5m0 0L7.5 12m4.5 4.5V3\"></path></svg>";
+    readonly maximize: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M3.75 3.75v4.5m0-4.5h4.5m-4.5 0L9 9M3.75 20.25v-4.5m0 4.5h4.5m-4.5 0L9 15M20.25 3.75h-4.5m4.5 0v4.5m0-4.5L15 9m5.25 11.25h-4.5m4.5 0v-4.5m0 4.5L15 15\"></path></svg>";
+    readonly popout: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M13.5 6H5.25A2.25 2.25 0 0 0 3 8.25v10.5A2.25 2.25 0 0 0 5.25 21h10.5A2.25 2.25 0 0 0 18 18.75V10.5m-10.5 6L21 3m0 0h-5.25M21 3v5.25\"></path></svg>";
+    readonly restore: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 9V4.5M9 9H4.5M9 9 3.75 3.75M9 15v4.5M9 15H4.5M9 15l-5.25 5.25M15 9h4.5M15 9V4.5M15 9l5.25-5.25M15 15h4.5M15 15v4.5m0-4.5 5.25 5.25\"></path></svg>";
+    readonly minimize: "<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" aria-hidden=\"true\" data-slot=\"icon\" style=\"stroke-width:var(--ng-icon__stroke-width, 1.5)\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M5 12h14\"></path></svg>";
+};
+/** The names the shell ships. Naming one in `provideIcons` replaces that glyph app-wide. */
+type LoomIconName = keyof typeof LOOM_ICONS;
+
+/** A live notification held by the service and rendered by the toast outlet. */
+interface Notification {
+    readonly id: string;
+    readonly kind: NotificationKind;
+    readonly message: string;
+    readonly action?: NotificationAction;
+}
+/**
+ * Neutral host service for transient notifications ("toasts"). The shell
+ * renders them once via the toast outlet; distributions and plugins raise them through
+ * `ctx`. Sticky toasts (no `timeoutMs`) stay until dismissed — the update notice uses
+ * this so dismissing it never loses the "update available" state.
+ */
+declare class NotificationService {
+    private readonly items;
+    private readonly timers;
+    private nextId;
+    /** The currently visible notifications, oldest first. */
+    readonly notifications: i0.Signal<readonly Notification[]>;
+    /** Shows a notification (replacing any with the same id) and returns its id. */
+    show(input: NotificationInput): string;
+    /** Removes the notification with the given id (no-op if already gone). */
+    dismiss(id: string): void;
+    private clearTimer;
+    static ɵfac: i0.ɵɵFactoryDeclaration<NotificationService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<NotificationService>;
+}
+
+/**
+ * Renders the active notifications as toasts in a fixed corner. Mounted once
+ * by the shell root, so every distribution gets it for free. Each toast shows its kind
+ * icon, message, an optional action button and a dismiss control. The kind selects the
+ * icon; a feedback-colour token ladder can be added later if toasts grow richer.
+ */
+declare class ToastOutlet {
+    private readonly service;
+    protected readonly notifications: i0.Signal<readonly Notification[]>;
+    private readonly icons;
+    private readonly iconColors;
+    protected iconFor(kind: NotificationKind): LoomIconName;
+    protected iconColorFor(kind: NotificationKind): string;
+    protected roleFor(kind: NotificationKind): 'alert' | 'status';
+    protected runAction(toast: Notification): void;
+    protected dismiss(id: string): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ToastOutlet, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<ToastOutlet, "lw-toasts", never, {}, {}, never, never, true, never>;
+}
+
+/**
+ * Persistent update affordance for a bar. While no update is pending it is a
+ * quiet "check for updates" button; once the service worker has a new version ready it
+ * gains a badge dot and becomes "reload to update". When installing an update failed it gains a
+ * caution dot and offers a reload instead of pretending to be current; when the worker's cache is
+ * broken outright it says so and offers the repair. Reads {@link UpdateService}, so the badge
+ * survives dismissing the toast. Renders nothing when updates are unavailable
+ * (no service worker — dev/unsupported).
+ */
+declare class UpdateBadge {
+    private readonly updates;
+    protected readonly enabled: boolean;
+    protected readonly available: i0.Signal<boolean>;
+    protected readonly failed: i0.Signal<boolean>;
+    protected readonly label: i0.Signal<"update.available" | "update.broken" | "update.failed" | "update.check">;
+    protected onClick(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<UpdateBadge, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<UpdateBadge, "lw-update-badge", never, {}, {}, never, never, true, never>;
+}
+
+type DialogKind = 'confirm' | 'alert' | 'prompt' | 'custom' | 'progress';
+type ButtonRole = 'confirm' | 'cancel' | 'custom';
+/** A footer button as the dialog outlet renders it. */
+interface DialogButtonView {
+    readonly label: string;
+    readonly variant: LwButtonVariant;
+    readonly role: ButtonRole;
+    readonly value?: unknown;
+    readonly autofocus: boolean;
+}
+/** One open dialog, held by the service and rendered by the dialog outlet. */
+interface DialogInstance {
+    readonly id: string;
+    readonly ref: DialogRef;
+    readonly kind: DialogKind;
+    readonly tone: DialogTone;
+    /** Host icon name (from options or the tone default); rendered by `<lw-icon>`. */
+    readonly icon?: string;
+    readonly title?: string;
+    readonly message?: string;
+    readonly component?: Type<unknown>;
+    readonly injector?: Injector;
+    readonly placeholder?: string;
+    readonly promptValue?: WritableSignal<string>;
+    /** Live status text for a `progress` dialog. */
+    readonly progressMessage?: WritableSignal<string>;
+    /** Type-to-confirm label (Markdown) shown above the input, if any. */
+    readonly requireLabel?: string;
+    /** Validates the guard input; `null` = valid (enables confirm), else an inline error. */
+    readonly requireValidate?: (value: string) => string | null;
+    readonly buttons: readonly DialogButtonView[];
+    readonly dismissable: boolean;
+    readonly size?: DialogSize;
+    /** Render only the component (no host chrome) — the component owns the frame contents. */
+    readonly bare?: boolean;
+    /** The frame shows a maximize/restore control (framed dialogs; bare ones draw their own). */
+    readonly maximizable?: boolean;
+    /** Vertical anchor: `'top'` pins the panel's top edge on every width. Defaults to `'center'`. */
+    readonly align?: 'center' | 'top';
+}
+/**
+ * Neutral host service for modal dialogs:
+ * convenience dialogs (`confirm`/`alert`/`prompt`, the host paints everything) and rich
+ * `open(Component)` dialogs where a plugin owns the body and the host paints the frame +
+ * declarative footer buttons. The shell renders them once via `<lw-dialog-outlet>`. Uses
+ * only `<lw-*>` chrome + semantic tokens, so plugin-authored bodies stay harmonious.
+ */
+declare class DialogService {
+    private readonly injector;
+    private readonly document;
+    private readonly items;
+    private counter;
+    /** The currently open dialogs, oldest first (the last one is topmost). */
+    readonly dialogs: i0.Signal<readonly DialogInstance[]>;
+    /** Asks a yes/no question; resolves `true` only if confirmed. */
+    confirm(options: ConfirmOptions): Promise<boolean>;
+    /** Shows a message with a single acknowledge button. */
+    alert(options: AlertOptions): Promise<void>;
+    /** Asks for a line of text; resolves the value, or `null` if cancelled/dismissed. */
+    prompt(options: PromptOptions): Promise<string | null>;
+    /**
+     * Opens a custom body component. The host paints the frame + any declarative footer
+     * buttons; the component owns the body and injects {@link DialogRef} to close itself.
+     */
+    open<R = unknown>(component: Type<unknown>, options?: OpenOptions): DialogRef<R>;
+    /**
+     * Shows a non-dismissable busy indicator (spinner + status) so a running operation is not
+     * interrupted. The caller closes it when done — or use {@link withProgress} to auto-close.
+     */
+    progress(options: ProgressOptions): ProgressHandle;
+    /** Runs `work` behind a progress dialog that closes automatically when it settles. */
+    withProgress<T>(options: ProgressOptions, work: Promise<T>): Promise<T>;
+    private push;
+    private mount;
+    static ɵfac: i0.ɵɵFactoryDeclaration<DialogService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<DialogService>;
+}
+
+/**
+ * Renders the open dialogs once, mounted by the shell root. Draws the frame
+ * (backdrop, panel, title, close-X, footer buttons) and either the convenience body
+ * (message + optional prompt input) or a plugin's custom body via NgComponentOutlet.
+ * Owns the modal mechanics: scroll-lock, Escape + backdrop dismiss, focus into the newest
+ * dialog + restore on close, and a lightweight focus trap.
+ */
+declare class DialogOutlet {
+    private readonly service;
+    private readonly document;
+    protected readonly dialogs: i0.Signal<readonly DialogInstance[]>;
+    private readonly panels;
+    constructor();
+    protected onEscape(): void;
+    protected onFocusIn(event: FocusEvent): void;
+    protected onTab(event: Event, backward: boolean): void;
+    protected dismiss(dialog: DialogInstance): void;
+    protected onButton(dialog: DialogInstance, button: DialogButtonView): void;
+    protected onPromptInput(dialog: DialogInstance, event: Event): void;
+    protected onEnter(dialog: DialogInstance): void;
+    protected confirmBlocked(dialog: DialogInstance, button: DialogButtonView): boolean;
+    protected guardError(dialog: DialogInstance): string | null;
+    protected wrapperClasses(dialog: DialogInstance): string;
+    protected toneCircle(tone: DialogTone): string;
+    protected panelWidth(dialog: DialogInstance): string;
+    private topPanel;
+    private focusable;
+    private top;
+    static ɵfac: i0.ɵɵFactoryDeclaration<DialogOutlet, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<DialogOutlet, "lw-dialog-outlet", never, {}, {}, never, never, true, never>;
+}
+
+/**
+ * One settings row: label (+ optional description) on the left, the control projected on
+ * the right. A pure layout primitive — the host slots the matching control
+ * (`<lw-select>`, later toggle/button) via content projection.
+ */
+declare class LwSettingRow {
+    readonly label: i0.InputSignal<string>;
+    readonly description: i0.InputSignal<string>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<LwSettingRow, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<LwSettingRow, "lw-setting-row", never, { "label": { "alias": "label"; "required": false; "isSignal": true; }; "description": { "alias": "description"; "required": false; "isSignal": true; }; }, {}, never, ["*"], true, never>;
+}
+
+/** Multi-provider token: each contribution adds one {@link BarItem}. */
+declare const BAR_ITEM: InjectionToken<readonly BarItem[]>;
+/** Hooks bar items into the shell — used by the host and by distributions. */
+declare function provideBarItems(...items: BarItem[]): Provider[];
+
+/** Multi-provider token: each contribution adds one {@link RailItem}. */
+declare const RAIL_ITEM: InjectionToken<readonly RailItem[]>;
+/** Hooks rail commands into the shell — used by the host and by distributions. */
+declare function provideRailItems(...items: RailItem[]): Provider[];
+
+/** Multi-provider token: each contribution adds one {@link View}. */
+declare const VIEW: InjectionToken<readonly View[]>;
+/** Hooks views into regions — used by the host and by distributions. */
+declare function provideViews(...views: View[]): Provider[];
+
+/**
+ * A {@link ContentRoute} as the registry holds it: the plugin's own declaration plus the **host-stamped**
+ * id of the plugin that registered it. The id is not part of the authoring contract — a plugin must not be
+ * able to claim someone else's identity — so it lives here rather than in `@loomweaver/plugin-sdk`.
+ */
+type RegisteredContentRoute = ContentRoute & {
+    readonly pluginId?: string;
+};
+/**
+ * A {@link View} as the registry holds it: the plugin's own declaration plus the **host-stamped** id
+ * of the plugin that registered it, mirroring {@link RegisteredContentRoute}. The stamp is what lets
+ * the retention guards find a plugin's dirty instances before the plugin is disabled or uninstalled.
+ */
+type RegisteredView = View & {
+    readonly pluginId?: string;
+};
+
+/**
+ * A command as the registry holds it: the declaration a plugin handed in, plus the owner the host
+ * stamped on it. The owner is what lets a command be attributed — to let its own plugin reach it
+ * without a grant, and to tell a plugin's commands from the shell's own.
+ */
+interface RegisteredCommand {
+    readonly command: Command;
+    readonly ownerId?: string;
+}
+/**
+ * Holds the live UI contributions the regions render. Seeded at startup from the
+ * static `provide*` API and (P1.2 loader) added to at runtime by plugins. Signal-
+ * based so the regions react to runtime registration/removal.
+ *
+ * Contributions are keyed by `id`: registering an existing id **overrides** the
+ * previous entry in place (last contribution wins — a distribution/plugin can
+ * replace a host default by reusing its id), and `remove*ById` drops one (a
+ * distribution hides a default it does not want, e.g. via `provideShell({ omit })`).
+ *
+ * Override is **destructive**, not stacked: the superseded entry is replaced, so disposing
+ * the *winning* handle removes the id entirely (it does not restore the entry it replaced),
+ * and disposing a *superseded* handle is a no-op. That is fine for today's usage (defaults are
+ * overridden at composition time and never disposed); a per-id stack that reveals the previous
+ * entry on dispose is the follow-up if a plugin ever overrides a default and is then unloaded.
+ */
+declare class ContributionRegistry {
+    private readonly commandsSignal;
+    private readonly surfacesSignal;
+    private readonly barItemsSignal;
+    private readonly railItemsSignal;
+    private readonly menuItemsSignal;
+    private readonly dockedSurfaces;
+    private readonly routableSurfaces;
+    private readonly omittedSignal;
+    /** Registered commands with their owner — the source for anything that has to attribute one. */
+    readonly registeredCommands: Signal<readonly RegisteredCommand[]>;
+    /** Registered commands — the invocable actions triggers (items/keybindings/palette) point at. */
+    readonly commands: Signal<readonly Command[]>;
+    readonly views: Signal<readonly RegisteredView[]>;
+    readonly barItems: Signal<readonly BarItem[]>;
+    readonly railItems: Signal<readonly RailItem[]>;
+    /**
+     * URL-addressed content-area routes; the ContentRouter mirrors these into the Router.
+     * Omitted routes are filtered out, so every consumer — tab strip, auto-open, pane target
+     * picker, `matchRoute` — drops them without knowing about omission.
+     */
+    readonly contentRoutes: Signal<readonly RegisteredContentRoute[]>;
+    /**
+     * The routes {@link omit} dropped. The ContentRouter still maps these to a neutral
+     * "not available here" placeholder at their path, so a shared deep-link explains itself instead of
+     * silently falling back to home.
+     */
+    readonly omittedContentRoutes: Signal<readonly RegisteredContentRoute[]>;
+    /** Menu-slot contributions; the MenuService filters these by slot + `when` when a menu opens. */
+    readonly menuItems: Signal<readonly MenuItem[]>;
+    /** The ids {@link omit} hides, exactly as the distribution wrote them, prefixes and all. */
+    readonly omitted: Signal<ReadonlySet<string>>;
+    /**
+     * Every id registered so far, of whatever kind, **including** those {@link omit} hides. An
+     * omitted contribution is by construction absent from every other signal here, so this is the
+     * only way to tell an `omit` that hid something from one that hit nothing at all.
+     */
+    readonly registeredIds: Signal<ReadonlySet<string>>;
+    /**
+     * Hides contributions by id for good — a distribution drops a default it does not want
+     * (`provideShell({ omit })`). Unlike {@link removeCommandById} and friends, which delete what is
+     * registered *now*, this is a lasting filter: an id a plugin registers later stays hidden too.
+     */
+    omit(ids: readonly string[]): void;
+    /**
+     * Adds a command. Like {@link addContentRoute}, `pluginId` is stamped by the host and never
+     * claimed by the plugin: it is what decides whether a caller is reaching its own command or
+     * another's. The shell's own seeded commands carry none.
+     */
+    addCommand(command: Command, pluginId?: string): Disposable;
+    /**
+     * Adds a panel view. Like {@link addContentRoute}, `pluginId` is stamped by the host, never by
+     * the plugin, and overwrites anything the view carried.
+     */
+    addView(view: View, pluginId?: string): Disposable;
+    addBarItem(item: BarItem): Disposable;
+    addRailItem(item: RailItem): Disposable;
+    removeCommandById(id: string): void;
+    removeViewById(id: string): void;
+    removeBarItemById(id: string): void;
+    removeRailItemById(id: string): void;
+    /**
+     * Adds a content route (keyed by `path`; a re-registered path overrides in place). `pluginId` is
+     * stamped by the host, never by the plugin: it is what lets a route's surface be checked against its
+     * owner's capability grants, so it is applied last and overwrites anything the route carried.
+     */
+    addContentRoute(route: ContentRoute, pluginId?: string): Disposable;
+    /** Adds a menu-slot item. With an `id` a re-registration replaces in place (last-in wins); without one the item is additive and dispose removes this exact contribution. */
+    addMenuItem(item: MenuItem): Disposable;
+    removeMenuItemById(id: string): void;
+    private addSurface;
+    private visible;
+    private add;
+    private removeById;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ContributionRegistry, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ContributionRegistry>;
+}
+
+/**
+ * Host registry for settings sections (schema-driven). The shell and
+ * plugins contribute sections; the host renders them all in one {@link SettingsDialog}.
+ * Storage is deliberately NOT centralised — each section carries its own value accessors,
+ * so the owner keeps responsibility for persistence (shell settings in the shell, plugin
+ * settings in the plugin, optionally against its owner's backend). This keeps the host domain-pure and
+ * fits the per-tenant tenancy model without the host needing to persist foreign data.
+ */
+declare class SettingsService {
+    private current;
+    private readonly dialogs;
+    private readonly registry;
+    /** The section a caller asked to show; the settings dialog consumes it. */
+    readonly requestedSection: i0.Signal<string | undefined>;
+    /**
+     * Registered sections, ordered by `order` (default 0), then registration order — with any
+     * omitted section or row dropped, and a section left with no rows hidden entirely.
+     */
+    readonly all: i0.Signal<SettingsSection[]>;
+    /**
+     * Every registered section, **including** those {@link omit} hides and with their omitted rows
+     * still in place. {@link all} is what the dialog draws; this is what was contributed, which is
+     * what a dev-mode report needs to tell an `omit` that hid a row from one that hit nothing.
+     */
+    readonly registered: i0.Signal<readonly SettingsSection[]>;
+    /**
+     * Contributes a section; dispose to remove it (plugin deactivation). Registering an existing
+     * id **overrides** the previous section in place (last contribution wins), like every other
+     * contribution.
+     */
+    register(section: SettingsSection): Disposable;
+    /**
+     * Hides settings by id — a section id drops the whole section, a row id drops that row. A
+     * lasting filter (like {@link ContributionRegistry.omit}), so a section a plugin registers
+     * later is covered too.
+     */
+    omit(ids: readonly string[]): void;
+    /**
+     * Opens the settings dialog — a bare, wide two-column surface owning its own chrome. Pass a
+     * `sectionId` to land on (or switch an already-open dialog to) that section — e.g. the plugin
+     * store's gear action jumping to an installed plugin's own settings.
+     */
+    open(sectionId?: string): DialogRef;
+    consumeRequestedSection(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<SettingsService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<SettingsService>;
+}
+
+/**
+ * The shared shape of the shell's two persistence ports: `SETTINGS_STORE` for genuine
+ * settings and `WORKING_STATE_STORE` for working state. A store implemented once fits either port —
+ * only what the shell routes through it differs.
+ *
+ * It is a plain **string** key-value store: callers serialise/validate their own payloads (they already
+ * do so defensively), which keeps the wire format identical to what the shell wrote before — no data
+ * migration. `get`/`set`/`delete` are async so a network-backed store fits; the optional {@link peek} is
+ * a synchronous fast-path for bootstrap-critical reads (theme, panel sizes) that must apply before the
+ * first paint. A store that cannot answer synchronously (network-backed) omits `peek`; callers then start
+ * from a default and reconcile via `get`.
+ */
+interface KeyValueStore {
+    /**
+     * Reads the stored string for `key`, or `undefined` if absent. Untrusted — callers validate its shape.
+     * Best-effort like {@link set}: prefer resolving with `undefined` over rejecting when the read fails
+     * (a network store that is offline or unauthorized). The shell treats a rejection as "no value" rather
+     * than failing startup, but a store that rejects makes the user's data silently unavailable.
+     */
+    get(key: string): Promise<string | undefined>;
+    /** Writes `value` for `key`. Best-effort: implementations resolve even when persistence fails. */
+    set(key: string, value: string): Promise<void>;
+    /** Removes the value for `key`. */
+    delete(key: string): Promise<void>;
+    /**
+     * Optional synchronous snapshot of `key` for bootstrap-critical reads that must apply before first
+     * paint. Omitted by stores that can only answer asynchronously — callers fall back to {@link get}.
+     */
+    peek?(key: string): string | undefined;
+}
+/**
+ * Default {@link KeyValueStore}: user-local `localStorage`. Reads and writes are synchronous
+ * under the hood — `peek` exposes that for zero-flash bootstrap — and wrapped in the same best-effort
+ * try/catch the shell used before (private browsing, quota, corrupt payloads). Both persistence ports
+ * default to an instance of this store.
+ */
+declare class LocalStorageStore implements KeyValueStore {
+    peek(key: string): string | undefined;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+
+/**
+ * The **settings** persistence port: deliberate user decisions only — theme,
+ * language, text size, plugin settings, installed/disabled plugins, capability revocations and the
+ * saved-workspaces list. Working state (view state, layout, usage traces) never flows through this
+ * port; it lives behind `WORKING_STATE_STORE`. That guarantee is structural, which is what makes
+ * this port the right seam for a product backend: writes are rare, small and roaming-worthy, so a
+ * REST-backed implementation (the `ISettingsRepository` pattern) receives exactly
+ * what it expects. Swap the backing store with {@link provideSettingsStore}; the built-in default
+ * is {@link LocalStorageStore}.
+ */
+declare const SETTINGS_STORE: InjectionToken<KeyValueStore>;
+/**
+ * Provides a custom settings {@link KeyValueStore}, replacing the default `localStorage` one —
+ * place after `provideShell()` (last provider wins). Pass a class (DI-constructed) or a ready
+ * instance. The cross-tab sync wrapper is applied on top either way.
+ */
+declare function provideSettingsStore(store: KeyValueStore | Type<KeyValueStore>): Provider;
+
+/**
+ * The **working-state** persistence port: state that accrues from using the app rather
+ * than from deciding something — view state and view instances, the palette's recently-used list,
+ * and the window-local layout keys (pane trees, panel sizes, collapse state, item order, view
+ * placement). Writes are frequent and debounced, which is why this port defaults to the device
+ * ({@link LocalStorageStore}) instead of a product backend.
+ *
+ * A distribution that wants working state to travel across devices provides a backend-backed store
+ * with {@link provideWorkingStateStore}: a fresh tab then hydrates the last persisted state at boot
+ * with no further wiring. For *live* cross-device updates, pair the store with a push transport
+ * (SSE, WebSocket) that calls `StateSyncService.notifyRemoteChange` when the backend reports a
+ * changed key.
+ */
+declare const WORKING_STATE_STORE: InjectionToken<KeyValueStore>;
+/**
+ * Provides a custom working-state {@link KeyValueStore}, replacing the default `localStorage` one —
+ * place after `provideShell()` (last provider wins). Pass a class (DI-constructed) or a ready
+ * instance. The cross-tab sync wrapper is applied on top either way.
+ */
+declare function provideWorkingStateStore(store: KeyValueStore | Type<KeyValueStore>): Provider;
+
+/**
+ * The storage keys that stay **device-level** by default when the stores are identity-scoped
+ *: preferences that reasonably belong to the browser, not the signed-in user. Extend the
+ * default via `provideIdentityScopedStores({ deviceKeys: [...DEVICE_LEVEL_KEYS, 'my.key'] })`.
+ */
+declare const DEVICE_LEVEL_KEYS: readonly string[];
+/** Configuration for {@link provideIdentityScopedStores}. */
+interface IdentityScopedStoreOptions {
+    /**
+     * The identity discriminator, read synchronously. Return the current principal's stable id
+     * (typically `AuthSnapshot.subject`; encode the tenant into it if tenant switches should
+     * separate state). `null`/`undefined`/`''` means anonymous — keys pass through **unscoped**, so
+     * a signed-out app behaves exactly like the unwrapped stores. Both stores **latch the first
+     * non-empty value per boot** through one shared latch and never follow a live switch afterwards
+     *: a change to a *different* subject only takes effect across the reload boundary
+     * (`provideAuthSource(..., { onIdentityChange: 'reload' })`), so in-flight writes of the
+     * departing user — a pending debounce, a commit during the login transition — can never land in
+     * the next user's namespace. The shell peeks bootstrap-critical keys before first paint, so the
+     * discriminator must be answerable synchronously at boot (persist the last-known subject
+     * yourself).
+     */
+    identity: () => string | null | undefined;
+    /**
+     * Exact keys that stay unscoped regardless of identity. **Replaces** the default
+     * ({@link DEVICE_LEVEL_KEYS}) — spread it to extend. Applied to both stores; the built-in
+     * defaults are all settings keys, but a distribution may declare device-level keys of its own.
+     */
+    deviceKeys?: readonly string[];
+    /** The wrapped settings store. Defaults to the built-in `localStorage` store. */
+    settingsStore?: KeyValueStore;
+    /** The wrapped working-state store. Defaults to the built-in `localStorage` store. */
+    workingStateStore?: KeyValueStore;
+}
+/**
+ * Scopes **both** persistence ports (`SETTINGS_STORE` and `WORKING_STATE_STORE`) per
+ * signed-in user: every key outside `deviceKeys` is prefixed `lw.id.<identity>:` while
+ * someone is signed in, so on a shared browser one user's pane trees, tab titles, workspaces,
+ * view state and plugin settings are never re-hydrated for the next. Device-level keys and the
+ * anonymous session write the original, unprefixed keys — a distribution without auth is
+ * byte-identical to the unwrapped stores.
+ *
+ * Place after `provideShell()` (last provider wins). The standard answer to per-user state on a
+ * shared browser; pair with `provideAuthSource(..., { onIdentityChange: 'reload' })` so a user
+ * switch re-hydrates cleanly from the new namespace. The cross-tab sync wrapper is applied on top
+ * of both stores; `peek` is offered only when the wrapped store offers it, because the
+ * shell branches on the *presence* of `peek` (sync bootstrap vs. async hydration).
+ */
+declare function provideIdentityScopedStores(options: IdentityScopedStoreOptions): Provider;
+
+/**
+ * Where a synced key's fresh value is read back from after another window announced a change
+ *: the `SETTINGS_STORE`, the `WORKING_STATE_STORE`, or — for state persisted outside
+ * both ports, such as a product session store — `'external'`, in which case no read-back happens
+ * and the applier receives `undefined` (it re-reads its own storage).
+ */
+type SyncSource = 'settings' | 'working-state' | 'external';
+/**
+ * Re-applies a key that another browser window just wrote. `raw` is the value read back from the
+ * registered {@link SyncSource}'s store (`undefined` for `'external'` registrations) — the store
+ * stays the single source of truth, the message only names the key. An applier must **set its
+ * state without persisting again**, or two windows would write back and forth forever.
+ */
+type ApplySyncedState = (raw: string | undefined, key: string) => void;
+/**
+ * Cross-tab live sync at the persistence seams. Every write through either port
+ * broadcasts its **key** to the other windows of the same origin over a `BroadcastChannel`; a
+ * window that has registered a reaction for that key reads the fresh value back through the
+ * registered source's store and applies it — so it works with any store behind the ports,
+ * including a product's HTTP-backed one.
+ *
+ * The shell registers its own keys (settings such as theme, language and text size on the
+ * `'settings'` source; view state, view instances and the palette's recently-used list on
+ * `'working-state'`), so plugins inherit the sync for free: their state lives in host-managed
+ * stores. **Layout keys are deliberately not registered** — two windows are meant to be able to
+ * show different layouts.
+ *
+ * A distribution registers its own keys the same way, most usefully its product session key
+ * (source `'external'`): when it changes, the other window's `AuthSnapshot` flips and the existing
+ * `onIdentityChange` policy takes over. Use {@link announce} when that state is
+ * persisted outside the ports, and {@link notifyRemoteChange} when a backend push transport
+ * reports a change made on another device.
+ */
+declare class StateSyncService {
+    private readonly settings;
+    private readonly workingState;
+    private readonly channel;
+    private readonly exact;
+    private readonly prefixes;
+    constructor();
+    /**
+     * Reacts to remote writes of exactly `key`; `source` names the store the fresh value is read
+     * back from. One applier per key — registering again replaces it. Returns a disposer that
+     * unregisters this applier (a later re-registration always wins over a stale disposer).
+     */
+    register(source: SyncSource, key: string, apply: ApplySyncedState): () => void;
+    /**
+     * Reacts to remote writes of every key starting with `prefix` — for key families such as
+     * `lw.shell.view-state:`. Exact registrations win over prefixes. Returns a disposer that
+     * unregisters this applier (a later re-registration always wins over a stale disposer).
+     */
+    registerPrefix(source: SyncSource, prefix: string, apply: ApplySyncedState): () => void;
+    /**
+     * Announces a change this window made to state that is persisted **outside** the persistence
+     * ports — a product session store, for example. Writes through the ports broadcast on their own;
+     * this is the escape hatch for state the ports never see. Notifies only the **other** windows.
+     */
+    announce(key: string): void;
+    /**
+     * Runs the registered applier for `key` in **this** window, reading the fresh value back from
+     * the registered source's store. The entry point for cross-device live sync: a
+     * backend-backed store paired with a push transport (SSE, WebSocket) calls this when the backend
+     * reports a key changed on another device. No-op for keys without a registration.
+     */
+    notifyRemoteChange(key: string): void;
+    private applyRemote;
+    private readBack;
+    private registrationFor;
+    static ɵfac: i0.ɵɵFactoryDeclaration<StateSyncService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<StateSyncService>;
+}
+
+/**
+ * A developer-defined workspace a distribution ships with {@link provideWorkspaces}: the same thing a
+ * user can build and save, only its baseline lives in code — it is never written to storage, the user
+ * cannot overwrite, rename or delete it, and it moves with product updates. Switching, the automatic
+ * per-workspace working state and **Reset** (back to this declaration) work exactly as for a
+ * user-saved workspace.
+ */
+interface WorkspaceDefinition {
+    /**
+     * Stable identity — keys the workspace's working state. `default` is reserved for the built-in
+     * empty workspace; a duplicate id keeps the first declaration.
+     */
+    readonly id: string;
+    /** Display name — a translation key; a literal string falls back to itself. */
+    readonly title: string;
+    /** Optional icon (registry name) shown next to the name in the workspace management UI. */
+    readonly icon?: string;
+    /**
+     * Makes this the workspace a fresh install opens in, instead of the empty `default` one. It applies
+     * **once**, on a first boot with nothing stored yet: from then on the user's own last choice wins,
+     * so switching away is not undone by the next reload. A deep link still wins over the declaration —
+     * the baseline is laid out, but an incoming address is navigated to, so a shared link opens what it
+     * names. If two declarations set this, the first one wins, as with a duplicate id.
+     */
+    readonly initial?: boolean;
+    /**
+     * Which views each sidebar shows, keyed by the **panel region id** of your layout. A listed region
+     * shows exactly the named views; everything else declared for it is hidden and can be brought back
+     * through the strip's context menu. List a region with an **empty array** to show none of its views
+     * — the sidebar itself stays, empty. A region you leave out, or omitting the whole field, keeps
+     * whatever the user has there. **Whether a sidebar exists, is open and how wide it is belongs to the
+     * window, not to the workspace**: your layout decides which sidebars the app has, the user decides
+     * whether they are open, and switching workspaces never collapses, resizes or removes one.
+     */
+    readonly sidebars?: Readonly<Record<string, readonly string[]>>;
+    /**
+     * The content addresses that belong to this workspace, as route paths in the same vocabulary as
+     * {@link content} — `quotes/:id` claims every quote document and everything below one. Reaching a
+     * claimed address activates this workspace and shows the content inside it, **however the address
+     * was reached**: a link followed into the application, a restart, a command, a programmatic
+     * navigation or a tab a plugin opened. Without a claim an address is shown wherever the user
+     * already is, which is the behaviour of every workspace that declares none.
+     *
+     * Where two workspaces claim addresses of the same shape, neither is narrower and the claim is
+     * dropped from both with a message naming them; a narrower claim (more segments, or fewer
+     * parameters at the same length) simply wins. A workspace the **user** saved is never a
+     * destination, however it came by its claim — it exists on one machine only, and an address that
+     * led somewhere different for every user would not be an address.
+     */
+    readonly claims?: readonly string[];
+    /**
+     * The content area as a recursive arrangement: an area either holds `tabs`, splits into `rows`
+     * (top to bottom) or splits into `columns` (left to right). The **first** tabs area in reading
+     * order becomes the URL pane; switching to the workspace navigates to its active tab. Omit to
+     * start on the empty layout.
+     */
+    readonly content?: WorkspaceArea;
+}
+/**
+ * One node of a {@link WorkspaceDefinition} content declaration — the shared {@link PaneArea} grammar
+ * over route paths. A container declares its own arrangement in the same grammar over
+ * child surface ids.
+ */
+type WorkspaceArea = PaneArea<WorkspaceTabEntry>;
+type WorkspaceAreaBase = PaneAreaBase;
+/** An area that holds tabs. */
+type WorkspaceTabArea = PaneTabArea<WorkspaceTabEntry>;
+/** An area that splits into rows, top to bottom. */
+type WorkspaceRowArea = PaneRowArea<WorkspaceTabEntry>;
+/** An area that splits into columns, left to right. */
+type WorkspaceColumnArea = PaneColumnArea<WorkspaceTabEntry>;
+/** A tab in a workspace declaration — a route path, or the object form for the extra flags. */
+type WorkspaceTabEntry = string | WorkspaceTab;
+interface WorkspaceTab {
+    /** The surface route path the tab opens (sidebar views belong under `sidebars`, not here). */
+    readonly path: string;
+    /**
+     * `false` fixes the tab in this workspace: it shows no close affordance, "close others" and
+     * "close all" spare it, and it cannot be dragged away. Reset restores it either way.
+     */
+    readonly closable?: boolean;
+    /** Marks the area's initially active tab; without it the first tab is active. */
+    readonly active?: boolean;
+}
+
+/**
+ * The developer-defined workspaces of the composition — each {@link provideWorkspaces} call
+ * contributes one batch. Read by the workspace service; a distribution never injects this itself.
+ */
+declare const WORKSPACE_DEFINITIONS: InjectionToken<readonly (readonly WorkspaceDefinition[])[]>;
+/**
+ * Ships developer-defined workspaces with the distribution (composition root). They are switchable,
+ * self-remembering (each keeps its live working state per workspace) and resettable to the
+ * declaration — but their baseline lives in code, so the user cannot overwrite, rename or delete
+ * them. The workspace dialog therefore lists them separately from the user's own, opening on
+ * whichever list holds the active workspace. Invalid declarations are reported to
+ * the console in dev mode, naming what is ignored; nothing fails silently at runtime.
+ */
+declare function provideWorkspaces(...definitions: WorkspaceDefinition[]): EnvironmentProviders;
+
+/**
+ * The running build's version, sourced from `<Version>` in Directory.Build.props
+ * at build time (see tools/stamp-version.mjs). Exposed as a signal so a
+ * later source (e.g. a product backend) can update it live without touching consumers.
+ *
+ * Neutral core chrome: the version is host-offered data; distributions and plugins
+ * render it via `<lw-version>` or `ctx`, never hardcoded.
+ */
+declare class VersionService {
+    /** SemVer of the running build, e.g. `0.1.0`. */
+    readonly version: i0.WritableSignal<string>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<VersionService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<VersionService>;
+}
+
+/**
+ * Detects when a new app version has been fetched by the service worker and offers
+ * to activate it. Neutral core chrome: it raises a sticky toast and drives
+ * the persistent update badge off {@link updateAvailable}. Dismissing the toast never
+ * clears that signal, so the badge stays until the user actually reloads.
+ *
+ * `SwUpdate` is injected optionally: with no registered service worker (dev, tests,
+ * unsupported browsers) the service is simply inert — {@link enabled} is `false` and
+ * no update is ever offered.
+ */
+declare class UpdateService {
+    private readonly swUpdate;
+    private readonly notifications;
+    private readonly document;
+    private readonly destroyRef;
+    private readonly available;
+    private readonly failed;
+    private readonly broken;
+    private lastSilentCheck;
+    /** True once a new version is downloaded and ready to activate. */
+    readonly updateAvailable: i0.Signal<boolean>;
+    /**
+     * True once an update could not be installed, whichever of the two ways it went wrong.
+     * The client keeps running its current version until a reload; the badge and the failure
+     * toast both offer that reload. Read {@link updateBroken} to tell the two apart.
+     */
+    readonly updateFailed: i0.Signal<boolean>;
+    /**
+     * True once the service worker reports an unrecoverable state, which is the harsher half of
+     * {@link updateFailed}: its cached asset table no longer matches what the server serves, so it
+     * cannot repair itself and a plain reload lands in the same state again. {@link activateUpdate}
+     * handles it by dropping the worker rather than reloading into the same wall; read this only if
+     * you want to say something different about it in your own UI.
+     */
+    readonly updateBroken: i0.Signal<boolean>;
+    /** Whether update checks are possible (a service worker is registered and enabled). */
+    readonly enabled: boolean;
+    constructor();
+    /** Manually checks for a new version, noting when already up to date. */
+    checkForUpdate(): Promise<void>;
+    /**
+     * Gets the client onto a working version and reloads into it — it reloads even if that fails,
+     * so the affordance is never a silent no-op.
+     *
+     * When the worker is {@link updateBroken} activating is pointless: the broken registration would
+     * still control the next load and report the same failure, which is a loop the user cannot leave
+     * from inside the app. There the shell unregisters its own worker and drops its caches first, so
+     * the reload lands uncontrolled and registers afresh. Only the shell's own `ngsw-worker.js` and
+     * the `ngsw:` caches are touched; anything else the product registered is left alone.
+     */
+    activateUpdate(): Promise<void>;
+    private ensureControlled;
+    private showReloadNeeded;
+    private tryActivate;
+    private dropWorker;
+    private onVersionEvent;
+    private onUpdateReady;
+    private showUpdateAvailable;
+    private onUpdateFailed;
+    private onWorkerBroken;
+    private showUpdateFailed;
+    private startBackgroundChecks;
+    private silentCheck;
+    static ɵfac: i0.ɵɵFactoryDeclaration<UpdateService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<UpdateService>;
+}
+
+/**
+ * The distribution-supplied session snapshot signal. Defaults to **anonymous** so the
+ * bare platform runs with nobody signed in; a distribution maps its product's auth (OIDC/custom/…)
+ * into an {@link AuthSnapshot} signal via {@link provideAuthSource}. LoomWeaver never owns auth — it
+ * only reads this signal.
+ */
+declare const AUTH_SOURCE: InjectionToken<Signal<AuthSnapshot>>;
+/**
+ * What the shell does when one established identity is replaced by another.
+ * The comparison anchor is {@link AuthSnapshot.subject}.
+ */
+interface AuthSourceOptions {
+    /**
+     * `'reload'`: when a snapshot carries a **different** non-empty `subject` than the one already
+     * established this app lifetime, the shell performs a full `location.reload()` — the
+     * guaranteed-clean user switch (no pane trees, tab titles or plugin in-memory state of the
+     * previous user survive; paired with an identity-scoped settings store, the new session
+     * re-hydrates entirely from its own namespace). First sign-in (anonymous → subject) and
+     * sign-out (subject → anonymous) never fire, so an async session restore at boot causes no
+     * reload flicker. Snapshots without a `subject` never fire either. Default: `'ignore'`.
+     */
+    onIdentityChange?: 'reload' | 'ignore';
+}
+/**
+ * A distribution declares its auth source. The factory runs in the injection context, so it can
+ * `inject()` the product's own session/BFF service and return a signal derived from it. Pass
+ * `options` to opt into the identity-change policy: with
+ * `{ onIdentityChange: 'reload' }` a user switch on a shared browser reloads the app instead of
+ * leaving the previous user's in-memory state alive.
+ */
+declare function provideAuthSource(factory: () => Signal<AuthSnapshot>, options?: AuthSourceOptions): EnvironmentProviders;
+/**
+ * Reactive read-only view of the current session, plus the gating predicates the host chrome uses to
+ * hide/disable contributions. Roles/claims are opaque — this service matches, never
+ * interprets. Client-side gating is presentation, not a security boundary.
+ */
+declare class AuthContext {
+    private readonly source;
+    /** The current session snapshot (reactive). */
+    readonly state: Signal<AuthSnapshot>;
+    /** Whether someone is signed in. */
+    readonly authenticated: Signal<boolean>;
+    /** The current principal's roles. */
+    readonly roles: Signal<readonly string[]>;
+    /** True if the current principal holds `role`. */
+    hasRole(role: string): boolean;
+    /** True if the current session satisfies `access` (undefined = always). */
+    meets(access: AccessRequirement | undefined): boolean;
+    /** Whether a chrome item with this requirement should render (unmet + hide → false). */
+    visible(access: AccessRequirement | undefined): boolean;
+    /** Whether a rendered chrome item with this requirement should be disabled (unmet + disable). */
+    disabled(access: AccessRequirement | undefined): boolean;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthContext, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AuthContext>;
+}
+
+/** What the user picked. `system` follows the OS `prefers-color-scheme`. */
+type ThemeMode = 'light' | 'dark' | 'system';
+/** What is actually being rendered, once `system` has been resolved against the OS. */
+type ResolvedTheme = 'light' | 'dark';
+/**
+ * Owns light/dark for the whole application: it persists the user's choice through the
+ * the settings store, mirrors it across tabs, and toggles the `dark` class on `<html>` — which is what
+ * flips the `--lw-*` token ladder every surface reads.
+ *
+ * Inject it when your own UI has to follow the same mode, most commonly to mirror it onto another
+ * framework's switch (Bootstrap's `data-bs-theme`, for example) so the two never disagree:
+ *
+ * ```ts
+ * const theme = inject(ThemeService);
+ * effect(() => {
+ *   document.documentElement.setAttribute('data-bs-theme', theme.resolvedTheme());
+ * });
+ * ```
+ */
+declare class ThemeService {
+    private readonly document;
+    private readonly store;
+    private readonly sync;
+    private readonly systemDark;
+    private readonly modeState;
+    /** The user's choice, including `system`. Use {@link resolvedTheme} to know what is rendered. */
+    readonly mode: Signal<ThemeMode>;
+    /** The mode in effect, with `system` already resolved against the OS preference. */
+    readonly resolvedTheme: Signal<ResolvedTheme>;
+    constructor();
+    /** Switch the mode and persist it. Other tabs follow through the settings sync. */
+    setMode(mode: ThemeMode): void;
+    private watchSystemPreference;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ThemeService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ThemeService>;
+}
+
+/**
+ * The distribution's router, set up for the content area — call this **instead of**
+ * `provideRouter([])`. It bundles the three pieces that make plugin-contributed content routes work
+ * as one foolproof unit, so a distribution author cannot forget the initial-navigation flag:
+ *
+ * - `withDisabledInitialNavigation()` — the router does not navigate until the plugin routes exist.
+ * - `ContentReuseStrategy` — keeps a surface's instance across tab/perspective switches when its
+ *   retention policy says so (`retain: 'always'` or a `retention: 'retain'` default).
+ * - an app-initializer that runs {@link ContentRouter.start} after plugins activate: it mirrors the
+ *   registered content routes into the router and then performs the deferred initial navigation.
+ *
+ * Pass `extraRoutes` for any non-content routes the distribution owns.
+ */
+declare function provideShellRouter(extraRoutes?: Routes): (Provider | EnvironmentProviders)[];
+
+/**
+ * A distribution's redirect for a gated content route the session cannot reach. Given the
+ * attempted path, it returns an in-app URL to redirect to (e.g. the product's login route), or `null`
+ * to fall back to the host's neutral "sign-in required" placeholder. LoomWeaver owns no login UI, so
+ * this is how a product plugs in its own auth flow. Defaults to `null` (placeholder).
+ */
+type UnauthorizedHandler = (attemptedPath: string) => string | null;
+/** A distribution registers a login redirect for gated content routes. */
+declare function provideUnauthorizedRedirect(handler: UnauthorizedHandler): Provider;
+
+/** One rendered tab in the content strip (static or dynamic), as the content-area template consumes it. */
+interface ContentTabView {
+    /** The tab **root** — stable identity (tracking, active compare, close). */
+    readonly path: string;
+    /** The full path to navigate to when the tab is selected (root + remembered sub-route). */
+    readonly navPath: string;
+    readonly title: string;
+    /** When true the host shows `title` verbatim; otherwise it is a Transloco key (finding #8). */
+    readonly literalTitle: boolean;
+    readonly icon?: string;
+    readonly order: number;
+    /** Dynamic tabs show a close affordance; static (registered) tabs do not. */
+    readonly closable: boolean;
+    /** A preview tab renders its title in italics until promoted. */
+    readonly preview: boolean;
+    /** A pinned tab is sorted to the group's front and shows an unpin control instead of close. */
+    readonly pinned: boolean;
+    readonly actions?: readonly ViewAction[];
+}
+
+/**
+ * A navigable content target the command palette's Quick-Open mode lists:
+ * a registered surface reachable by plain navigation (a parameterless, non-chromeless route), or a
+ * currently **open** tab — across every workspace pane. `lastActive` is a session-only epoch stamp of
+ * when the target was last the active tab — it is not persisted (a fresh window starts with no
+ * times), and it floats recently visited targets up.
+ */
+interface QuickOpenTarget {
+    /** The tab root — stable identity and the `tabId` for the tab context menu. */
+    readonly path: string;
+    /** The full path to navigate to (open: root + remembered sub-route; else the route path). */
+    readonly navPath: string;
+    readonly title: string;
+    readonly literalTitle: boolean;
+    readonly icon?: string;
+    readonly pinned: boolean;
+    /** A target that is not an open tab is not closable — the context menu hides Close/Split/Pin. */
+    readonly closable: boolean;
+    readonly lastActive?: number;
+}
+
+/**
+ * The **URL pane's** tab state: the tabs to show (facet tabs of `follows`
+ * surfaces + opened ones), and the active tab — all derived from the URL plus the open set. The open
+ * set lives in the **pane tree's primary leaf**: the URL pane's tab group works like any
+ * pane's, so its tabs persist and reload with the tree (R10); only the non-serialisable `onClose`
+ * hooks stay session-local. A tab is identified by its **tab root**; sub-routes (`subRoutes`) live
+ * under it, so switching sub-routes stays in one tab and is reflected in the URL. A **chromeless**
+ * surface shows no strip.
+ */
+declare class ContentTabsService {
+    private readonly state;
+    private readonly closing;
+    private readonly registry;
+    private readonly reuse;
+    private readonly features;
+    private readonly paneTree;
+    private readonly closeHooks;
+    /**
+     * The Quick-Open source for the command palette: every currently **open** tab across
+     * **all content panes** (a split's secondary panes contribute theirs too), plus every registered
+     * route the user could open — one that takes no route parameter and is not `chromeless`. A route
+     * the user has visited carries its session `lastActive`; an open tab wins any path collision (it
+     * keeps its pinned identity). View tabs are excluded — those are reached through their rail item.
+     *
+     * **Access:** an unopened route is offered only when the session meets its `access` requirement. An
+     * already-open tab is listed as it is — matching the tab strip, which does not re-gate content tabs
+     * either, which is a deliberate open point. Client-side gating is
+     * presentation, not enforcement: opening the target still passes the router's `canMatch` twin, and an
+     * off-router mount re-checks the session, so a target the session no longer qualifies for renders the
+     * neutral placeholder rather than its content.
+     */
+    readonly quickOpenTargets: Signal<readonly QuickOpenTarget[]>;
+    /** The active `view:` tab of the URL group, or `null` when the router drives the area (R9). */
+    readonly activeViewPath: Signal<string | null>;
+    readonly activeViewInstance: Signal<string | undefined>;
+    /** Active content path (no leading slash, no query), including the sub-route, e.g. `doc/abc/preview`. */
+    readonly activePath: Signal<string>;
+    /** The active tab root — the leading segments the active route matched (e.g. `doc/abc`). */
+    readonly activeTabRoot: Signal<string>;
+    /** The active content read a plugin reaches through `ctx.activeContent` (finding #19). */
+    readonly activeContent: Signal<ActiveContent | null>;
+    /**
+     * Whether the tab strip renders: whenever the pane holds tabs — and never while a **chromeless**
+     * surface (login, onboarding) is active. That is the whole rule since groups retired:
+     * a pane shows a strip when it holds tabs; a chromeless surface shows none.
+     */
+    readonly showStrip: Signal<boolean>;
+    /**
+     * Everything the strip holds: the permanent facet tabs (`follows` surfaces with a computed
+     * address), then the open tabs, then the view tabs. Groups retired — every open tab
+     * renders, in every workspace.
+     */
+    readonly tabs: Signal<readonly ContentTabView[]>;
+    /**
+     * Activates a `view:` tab of the URL group (O5/E7 — a view living as a tab beside the content tabs):
+     * the content area host-mounts the view; the URL stays at its last route. No-op unless the group
+     * actually holds that tab.
+     */
+    activateViewTab(path: string): void;
+    /**
+     * Applies a user drag/keyboard reorder of the strip's dynamic tabs. `ids` is the new full
+     * order of dynamic tab roots (pinned then unpinned — the directive keeps moves within their band).
+     *
+     * The order is written to the pane that holds the tabs, exactly as a reorder in any other pane is.
+     * It used to be kept beside the tree under one key for the whole content dock, which meant the URL
+     * pane sorted its strip by that key while every other pane rendered the tabs in the order the tree
+     * held them — so the same tabs changed order as the URL role moved between panes (TreeWeaver #41).
+     */
+    reorder(ids: string[]): void;
+    /**
+     * Moves the tab rooted at `path` to the front of the strip's unpinned band (MRU). The strip does not
+     * scroll: tabs that no longer fit are clipped away, reachable via the overflow
+     * dropdown or the Library. Reopening such a tab front-inserts it here so it becomes visible while the
+     * least-recent tabs drop off the end. No-op for a pinned (anchored) or unknown tab. It moves the tab
+     * in the pane's own tab list, exactly as a drag-reorder does, so every pane shows the one
+     * order; the host calls it only when the active tab is actually clipped, so tabs that already fit
+     * keep their order.
+     */
+    bringToFront(path: string): void;
+    /**
+     * Navigates the content area to a path (a full-area screen, another tab, a specific sub-route).
+     *
+     * If another pane already holds that tab, **that pane becomes the URL pane** and the tab is activated
+     * there instead of a second copy opening beside the current one: exactly one pane carries the
+     * address, and the address follows the focused pane. Without this, a workspace that parks a surface
+     * in its own pane would gain a duplicate of it the moment a rail item or command navigated there, because
+     * every visit opens a tab.
+     *
+     * Ends any view-tab selection here and marks the navigation as ours, so the URL effect — which exists
+     * to end the selection on **external** moves like back/forward or a deep link — leaves alone whatever
+     * the caller selects once this settles.
+     *
+     * **A no-op in a pop-out window**, with a dev-mode warning. A pop-out shows exactly one surface and
+     * has no tab strip; navigating it would take its address out of `/popout/…`, and the window would
+     * quietly stop being a pop-out — chrome-less until the next reload, and the full app after it. Same
+     * reasoning as a docked surface, whose `navigate` is a no-op for want of a content area.
+     */
+    navigate(path: string): Promise<boolean>;
+    /**
+     * Fire-and-forget navigation: like {@link navigate}, but owns the "navigation may fail"
+     * semantics — a rejected router navigation is logged instead of surfacing as an unhandled
+     * rejection. Call sites that do not await the outcome use this.
+     */
+    navigateTo(path: string): void;
+    /**
+     * Reveals a content tab **where it already lives** (Quick-Open): a tab held by another pane is
+     * activated there and that pane takes the address; anything else simply navigates. Either way the tab is
+     * never duplicated into the URL pane. Since {@link navigate} carries that rule, this is the name the
+     * Quick-Open call site reads by — the behaviour is the same for every way of reaching a tab.
+     */
+    revealContentTab(navPath: string): void;
+    /**
+     * Opens a titled dynamic tab (idempotent per tab root; re-opening restores its sub-route) and activates
+     * it. With `preview` (and preview enabled) a **new** tab uses the strip's **single reused preview slot**
+     *: a preview open for a *different* path replaces that slot in place (the old instance is
+     * evicted + its `onClose` runs). Re-opening an **existing** tab preserves its current preview state (a
+     * mere title/sub-route refinement never promotes); promotion is explicit via {@link keep}.
+     */
+    open(input: OpenTabInput): void;
+    /**
+     * Promotes the preview tab rooted at `path` to a permanent tab — the programmatic
+     * "Keep Open" (`ctx.keepContentTab`, a double-click, or an edit). No-op if it is already permanent.
+     */
+    keep(path: string): void;
+    /**
+     * Pins the tab rooted at `path`: it moves to the front of the strip — after the tabs
+     * already pinned — and its close control becomes an unpin control (guarding against accidental
+     * close). Pinning also promotes a preview tab (a pinned tab is never transient). No-op if the tab is
+     * not open.
+     */
+    pin(path: string): void;
+    /**
+     * Unpins the tab rooted at `path` — it returns to a normal, closable tab and takes the
+     * first seat after the tabs still pinned. No-op otherwise.
+     */
+    unpin(path: string): void;
+    /** Closes every dynamic tab in the strip except the target — pinned and unclosable tabs are kept. */
+    closeOthers(path: string): void;
+    /** Closes every dynamic tab in the strip — pinned and unclosable tabs are kept. */
+    closeAll(): void;
+    /** Closes the dynamic tabs that render after the target in the strip — pinned tabs are kept. */
+    closeToRight(path: string): void;
+    /**
+     * Closes the **primary (URL) pane** of a split — the pane-toolbar "Close pane" on the URL pane: the
+     * primary leaf collapses, a neighbour is promoted to URL pane and navigated to. Guarded like every
+     * other user-initiated close: unsaved changes in any of the primary group's tabs run
+     * the host's Save · Discard · Cancel dialog first.
+     */
+    closePrimaryPane(): void;
+    /**
+     * Closes a dynamic tab (by any path under its root). If it was active, we navigate to a neighbour
+     * **first**, then evict the stored instance (keyed by the tab root — see {@link ContentReuseStrategy});
+     * a background tab is evicted immediately.
+     */
+    close(path: string): void;
+    /**
+     * Runs (and clears) the close hook of the tab rooted at `path` — for a close that happens **outside**
+     * the URL group (a moved tab closed in another pane). No-op while the tab is still open
+     * in the URL group (its own {@link close} will run the hook).
+     */
+    runCloseHook(path: string): void;
+    /**
+     * The URL pane's neighbour of the tab rooted at `path` — where the URL goes when that tab **leaves**
+     * the pane (moved away) or closes: the last remaining sibling, else home (`''` — the
+     * "no file is open" default).
+     */
+    neighbourOf(path: string): string;
+    private repin;
+    private replacePreviewSlot;
+    private refineElsewhere;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ContentTabsService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ContentTabsService>;
+}
+
+/** What the host knows when it works out where a following tab should point. */
+interface TabAddressInput {
+    /** The following surface's id, when it declared one. */
+    readonly surfaceId?: string;
+    /** That surface's route pattern, e.g. `cedents/:cedentId/programs/:programId/treaties`. */
+    readonly pattern: string;
+    /** Parameter values of the address the user is on, by name. */
+    readonly params: Readonly<Record<string, string>>;
+    /** The full active content path, for a resolver that needs more than the names. */
+    readonly activePath: string;
+}
+/**
+ * A distribution's own answer to "where should this following tab point?" — part of the mapping is
+ * domain knowledge the platform cannot have (a query parameter on one tab deciding a path segment on
+ * another). Return `null` to fall back to the host's substitution.
+ */
+type TabAddressResolver = (input: TabAddressInput) => string | null;
+/**
+ * Overrides or extends how the host computes the address of a **following** tab
+ * (`routable: { follows: true }`). The platform supplies the default — the parameter values of the
+ * current address substituted by name into the tab's own pattern — and the distribution supplies the
+ * domain knowledge on top; returning `null` keeps the default for that tab.
+ */
+declare function provideTabAddressResolver(resolve: TabAddressResolver): EnvironmentProviders;
+
+interface Triggerable {
+    readonly command?: string;
+    run?(): void | Promise<void>;
+}
+/**
+ * Executes commands by id — the single seam every trigger flows through:
+ * rail/bar/view-action items, and (next) keybindings and the command palette. Keeping execution
+ * here (not on the registry, which only stores) means one place resolves an id, one place fires the
+ * behaviour, and one place reports a failure.
+ */
+declare class CommandService {
+    private readonly registry;
+    private readonly auth;
+    private readonly errors;
+    private readonly shortcuts;
+    private readonly inPopout;
+    /** The registered commands — the source list for a command palette. */
+    readonly commands: Signal<readonly Command[]>;
+    /**
+     * Whether this command can run **here and now**: the session meets its `access`, and
+     * this window is one it belongs in — a pop-out offers only commands that declare `popout`, since it
+     * has no content area, rail or sidebar for the rest to reach. A palette uses this to filter.
+     */
+    available(command: Command): boolean;
+    /**
+     * The command's keyboard chord, formatted for display and OS-correct (`'⌘K'` / `'Ctrl+K'`), or
+     * `undefined` where it has none — **or where this distribution has switched shortcuts off**, so a
+     * hint never promises a key that does nothing. Every place the shell prints a chord (menu entry,
+     * palette row, bar button) asks here.
+     */
+    shortcutOf(command: Command | undefined): string | undefined;
+    /**
+     * Runs the command with this id; a no-op (with a warning) if none is registered. Blocks — the one
+     * choke point every trigger flows through (keybinding, palette, item) — when the session does not
+     * meet the command's `access`. An optional {@link MenuContext} is forwarded to
+     * `command.run(context)` — how a menu tells `shell.tab.closeOthers` which tab.
+     */
+    execute(id: string, context?: MenuContext): void;
+    /**
+     * Fires a resolved command's behaviour — the one place that happens, whatever triggered it — and
+     * reports a failure the way every trigger already does. Answers what the command returned, and
+     * rejects with what it threw, so a caller that has to tell a failure from an answer can.
+     */
+    run(command: Command, context?: MenuContext, args?: CommandArguments): Promise<unknown>;
+    /**
+     * Whether this item's trigger leads anywhere: an inline callback, or a command that is actually
+     * registered. A rail or bar item naming a command nobody registered would render as a dead button
+     * — the same orphan a menu entry can be, and the host drops both rather than draw them.
+     */
+    triggerable(item: Triggerable): boolean;
+    /** Fires a UI item's trigger: its bound command if it names one, else its inline callback. */
+    trigger(item: Triggerable): void;
+    private invoke;
+    private onError;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CommandService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<CommandService>;
+}
+
+/**
+ * Binds command shortcuts to the keyboard. Bindings are *derived* from the registered
+ * commands' `shortcut` (no separate registration path) and rebuild reactively as commands come and
+ * go. One global `keydown` listener resolves the pressed chord to a command id and fires it through
+ * the {@link CommandService} — the same seam a click uses. User rebinding is deferred.
+ */
+declare class KeybindingService {
+    private readonly registry;
+    private readonly commands;
+    private readonly document;
+    private readonly destroyRef;
+    private readonly injector;
+    private readonly enabled;
+    private readonly isMac;
+    private started;
+    private readonly build;
+    private readonly bindings;
+    /** Attaches the global listener once; auto-detached on destroy. No-op where shortcuts are off. */
+    start(): void;
+    private onKeydown;
+    static ɵfac: i0.ɵɵFactoryDeclaration<KeybindingService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<KeybindingService>;
+}
+
+/**
+ * Formats a keyboard chord for display, OS-correct: `formatChord('mod+k')` → `'⌘K'` on macOS,
+ * `'Ctrl+K'` elsewhere. `mod` maps to ⌘/Ctrl, `alt` to ⌥/Alt, `shift` to ⇧/Shift, and so on — the
+ * same token vocabulary a {@link Command.shortcut} uses. Lets a distribution or weaver show a
+ * shortcut anywhere without duplicating the platform detection the shell already does internally.
+ */
+declare function formatChord(chord: string): string;
+
+/** Where the built command-palette entry goes (LWF-05). Defaults: top bar, end slot, order 5. */
+interface CommandPaletteEntryOptions {
+    /**
+     * Target Bar region id. Default `'top-bar'`. The badge adapts to the bar it lands in: a top bar is
+     * a fixed band, so there it pins the shared bar-control height and lines up with the theme and
+     * language controls; a bottom bar takes the height of its tallest item, so there it renders like a
+     * plain bar item rather than growing the bar and costing the content area.
+     */
+    readonly bar?: string;
+    /** Which Bar slot the entry renders in. Default `'end'`. */
+    readonly slot?: BarSlot;
+    /** Lower renders first within the slot. Default `5` (left of the built update/language/theme items). */
+    readonly order?: number;
+}
+/**
+ * Places a built command-palette entry in a Bar (LWF-05) — a badge-styled affordance (search icon +
+ * the palette's OS-correct shortcut) that opens `shell.commandPalette`, correct-by-construction and
+ * without a distribution component. Opt-in: omit it for a palette that opens only by shortcut. Uses the
+ * `shell.commandPaletteEntry` bar-item id, so `provideShell({ omit: ['shell.commandPaletteEntry'] })`
+ * removes it.
+ */
+declare function provideCommandPaletteEntry(options?: CommandPaletteEntryOptions): EnvironmentProviders;
+
+/** Multi-provider token: each contribution adds one plugin to load. */
+declare const PLUGIN: InjectionToken<readonly Plugin[]>;
+/**
+ * Activates the registered plugins. Trusted in-process runtime (the lowest isolation
+ * rung); this abstraction lets a sandboxed runtime slot in later
+ * without touching plugins or the host.
+ */
+declare class PluginRuntime {
+    private readonly grants;
+    private readonly enablement;
+    private readonly factory;
+    private readonly injector;
+    private readonly plugins;
+    private readonly active;
+    private started;
+    activateAll(): void;
+    /**
+     * Unloads a plugin: undoes every contribution it made (via its context's tracked
+     * disposables) and runs its optional `deactivate` hook. Idempotent — unknown/inactive
+     * ids are a no-op. This is the counterpart to {@link activateAll} that keeps the `active`
+     * map from being write-only (a real unload path, needed before an untrusted loader lands).
+     */
+    deactivate(id: string): void;
+    /** Unloads every active plugin (e.g. on teardown). */
+    deactivateAll(): void;
+    private reconcile;
+    private activate;
+    private onActivationError;
+    static ɵfac: i0.ɵɵFactoryDeclaration<PluginRuntime, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<PluginRuntime>;
+}
+/** A distribution registers its plugins; they are activated eagerly at startup. */
+declare function providePlugins(...plugins: Plugin[]): (Provider | EnvironmentProviders)[];
+
+/**
+ * How much the browser holds a frame plugin back. **Isolated** strips the frame of an origin, which
+ * is what denies it the hosting document, any storage and any session the browser would carry for
+ * it. **Embedded** lets it keep an origin, and with it whatever the browser grants that origin — a
+ * separation of deployments rather than of privileges.
+ *
+ * Isolated is the default: a plugin whose level was never stated runs isolated.
+ */
+type PluginIsolationLevel = 'isolated' | 'embedded';
+
+/**
+ * A **sandboxed** plugin a distribution registers: its code is not an in-process
+ * {@link Plugin} object but a URL to an isolated document, loaded into an `<iframe sandbox>` and given
+ * `ctx` over RPC. Contrast {@link providePlugins} (trusted, in-process).
+ */
+interface FramePlugin {
+    /** Stable plugin id — the same id the distribution grants capabilities to (default-deny). */
+    readonly id: string;
+    /**
+     * What the workbench calls this plugin where it names it to the user — the permissions surface,
+     * the plugin list. Omit it and the id is shown, which is a poor name but a correct one: nothing is
+     * derived from it. Grants, collisions and the user's stored decisions all follow {@link id}, never
+     * this, so naming a plugin changes what is read and nothing else.
+     */
+    readonly name?: string;
+    /** URL of the plugin's entry document (served by the distribution, e.g. `/my-plugin/plugin.html`). */
+    readonly entryUrl: string;
+    /** Capabilities the plugin declares it needs; the distribution still has to grant them. */
+    readonly capabilities?: readonly Capability[];
+    /**
+     * Origins this plugin's own surfaces may be served from, beyond the application's own — the seam
+     * refuses anything else, and refuses an address that would execute or carry its content inline at
+     * any level. Omit it and the application's own origin is the only one, which is the right answer
+     * for a plugin whose files the distribution serves itself.
+     *
+     * A sibling subdomain belongs here: it is what gives an embedded application its own storage and
+     * keeps it out of the hosting document, while a session cookie scoped to the shared domain still
+     * reaches it.
+     */
+    readonly origins?: readonly string[];
+    /**
+     * How much the browser holds this plugin back. Omitted means
+     * {@link PluginIsolationLevel `'isolated'`} — the frame is stripped of an origin and reaches
+     * neither the hosting document nor any storage. `'embedded'` lets it keep an origin, which is what
+     * a first-party application composed for its own deployment needs and what a plugin you did not
+     * write must never be given.
+     */
+    readonly level?: PluginIsolationLevel;
+}
+/** Multi-provider token: each contribution adds one sandboxed plugin to load. */
+declare const FRAME_PLUGIN: InjectionToken<readonly FramePlugin[]>;
+/**
+ * Second {@link PluginRuntime} implementation:
+ * runs each plugin in an isolated `<iframe sandbox="allow-scripts">` and hands it `ctx` over **Penpal**
+ * RPC. The RPC endpoints are backed by the **same** {@link HostPluginContext} the trusted runtime uses,
+ * so the default-deny capability broker enforces grants identically — the isolation and
+ * transport change, the broker does not. Data-oriented `ctx` calls (`registerRoute({iframe})`, `toast`)
+ * serialise across the boundary; the reserved Angular-only surface (`component`) never crosses it.
+ *
+ * Activation reconciles against the union of three sets: the composed {@link FramePlugin} list,
+ * what the operator deployed through the catalog, and what the user installed. Installing spawns a
+ * plugin live, uninstalling unloads it, and a catalog that stops carrying a deployed entry unloads
+ * that one — all without a reload. Authority decides an id collision: composed wins over deployed,
+ * and deployed wins over installed, because a deployed entry holds exactly what it names and a
+ * user's consent cannot narrow what the operator issued.
+ */
+declare class FramePluginRuntime {
+    private readonly grants;
+    private readonly enablement;
+    private readonly install;
+    private readonly deployment;
+    private readonly isolation;
+    private readonly catalogCap;
+    private readonly refusals;
+    private readonly store;
+    private readonly sync;
+    private readonly factory;
+    private readonly injector;
+    private readonly plugins;
+    private readonly instances;
+    private started;
+    activateAll(): void;
+    /**
+     * Unloads one sandboxed plugin: closes the RPC connection, removes the frame, disposes `ctx`
+     * (undoing its contributions). Idempotent — unknown/inactive ids are a no-op; the counterpart
+     * to the trusted runtime's `deactivate(id)`.
+     */
+    deactivate(id: string): void;
+    /** Tears down every sandboxed plugin (e.g. on teardown). */
+    deactivateAll(): void;
+    private reconcile;
+    private runnablePlugins;
+    private dropUninstalled;
+    private spawn;
+    private createFrame;
+    private reportingRefusals;
+    private rpcMethods;
+    private watchState;
+    private notifyState;
+    private notifyTabClosed;
+    private notifySettings;
+    static ɵfac: i0.ɵɵFactoryDeclaration<FramePluginRuntime, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<FramePluginRuntime>;
+}
+/** A distribution registers its sandboxed plugins; they are activated eagerly at startup. */
+declare function provideFramePlugins(...plugins: FramePlugin[]): (Provider | EnvironmentProviders)[];
+
+interface CommandInvoker {
+    invocable(callerId: string, granted: boolean): readonly InvocableCommand[];
+    invoke(callerId: string, granted: boolean, id: string, args?: CommandArguments): Promise<CommandOutcome>;
+}
+declare const COMMAND_INVOKER: InjectionToken<CommandInvoker>;
+
+declare class CommandInvocationService implements CommandInvoker {
+    private readonly commands;
+    private readonly registry;
+    private readonly errors;
+    private readonly transloco;
+    private depth;
+    invocable(callerId: string, granted: boolean): readonly InvocableCommand[];
+    invoke(callerId: string, granted: boolean, id: string, args?: CommandArguments): Promise<CommandOutcome>;
+    private run;
+    private answerOf;
+    private reachable;
+    private reportRefusal;
+    private describe;
+    private text;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CommandInvocationService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<CommandInvocationService>;
+}
+
+/** Capabilities granted per plugin id. A missing id means "no grant" → default-deny. */
+type CapabilityGrants = Readonly<Record<string, readonly Capability[]>>;
+/**
+ * The active capability grants. Defaults to **empty** (default-deny — no plugin can do anything
+ * until granted). A distribution overrides it via {@link provideCapabilityGrants}; a product can
+ * later feed per-tenant grants from its own backend behind the same seam.
+ */
+declare const CAPABILITY_GRANTS: InjectionToken<Readonly<Record<string, readonly ("contributions" | "ui" | "host" | "navigation" | "session" | "theme" | "automation")[]>>>;
+/**
+ * A distribution declares which plugin gets which capabilities. The composition root is the
+ * authoritative grant source — the honest default-deny model, dogfooded by the first-party plugin
+ * like a third-party one would be. A product backend can replace it behind the same seam.
+ */
+declare function provideCapabilityGrants(grants: CapabilityGrants): Provider;
+/**
+ * The effective capability set for one plugin: what the distribution granted, **intersected** with
+ * what the plugin declares ("plugin declares, distribution grants"). A grant for an
+ * undeclared capability is inert, so least privilege holds in both directions; dev mode flags the
+ * mismatch so the composition stays honest. A plugin without a declaration keeps its grants as-is
+ * (declaring is optional today; the manifest schema hardens this later).
+ */
+declare function effectiveCapabilities(pluginId: string, granted: readonly Capability[] | undefined, declared: readonly Capability[] | undefined): ReadonlySet<Capability>;
+
+/** One capability as shown in the permissions surface: whether the user currently keeps it on. */
+interface PluginCapabilityState {
+    readonly capability: Capability;
+    readonly effective: boolean;
+}
+/** A plugin and the base-granted capabilities the user can manage for it. */
+interface PluginPermissions {
+    readonly pluginId: string;
+    readonly capabilities: readonly PluginCapabilityState[];
+}
+/**
+ * The live capability broker. The distribution's static grants (the platform ships no server, so
+ * the composition root — later a per-tenant backend behind the same seam —
+ * is the grant source) form each plugin's **base** set (grant ∩ declaration). On top of that the user can
+ * **revoke** a granted capability at runtime; the decision is user-local and persisted through the
+ * {@link SETTINGS_STORE}, exactly like the rest of the chrome state. Enforcement in
+ * {@link HostPluginContext} consults {@link isGranted} on every `ctx` call, so a revocation takes effect
+ * on the plugin's next call without a reload — the honest default-deny model made transparent and
+ * user-controllable (a "Permissions" settings surface), never wider than the distribution allowed.
+ */
+declare class CapabilityGrantService {
+    private readonly store;
+    private readonly sync;
+    private readonly grants;
+    private readonly revoked;
+    private readonly bases;
+    /** The plugins and their base-granted capabilities, for the permissions settings surface. */
+    readonly permissions: i0.Signal<readonly PluginPermissions[]>;
+    constructor();
+    /**
+     * Records a plugin's base grant (grant ∩ declaration) so enforcement and the permissions surface know
+     * about it. A runtime calls this once when it activates a plugin. `granted` overrides the
+     * distribution's static grant source — used for user-installed plugins, whose grant is the user's
+     * install consent instead of the composition root.
+     */
+    register(pluginId: string, declared: readonly Capability[] | undefined, granted?: readonly Capability[]): void;
+    /** Drops a plugin from the permissions surface (its runtime deactivated it). Idempotent. */
+    unregister(pluginId: string): void;
+    /** Whether `pluginId` may use `capability` right now: base-granted and not user-revoked. */
+    isGranted(pluginId: string, capability: Capability): boolean;
+    /**
+     * Whether the distribution granted `capability` to `pluginId` (grant ∩ declaration), **ignoring** any
+     * user revocation. Used only while a plugin activates — a revocation must not stop it from loading and
+     * registering its contributions; it applies to the plugin's runtime `ctx` calls afterwards.
+     */
+    isBaseGranted(pluginId: string, capability: Capability): boolean;
+    /** Turns a base-granted capability on or off for a plugin (user revoke / restore). Persisted. */
+    setGranted(pluginId: string, capability: Capability, granted: boolean): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CapabilityGrantService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<CapabilityGrantService>;
+}
+
+/** A plugin as shown in the permissions surface: its id, display name and whether it is enabled. */
+interface PluginInfo {
+    readonly id: string;
+    readonly name: string;
+    readonly enabled: boolean;
+}
+
+/**
+ * Whether each plugin is turned on — plugin enable/disable, distinct from capability revocation. Disabling a plugin is coarse: it does not restrict a power, it unloads the
+ * whole plugin so **none** of its contributions appear; enabling loads it again. The decision is
+ * user-local and persisted through the {@link SETTINGS_STORE}, exactly like the rest of the chrome state.
+ *
+ * This service holds only the state; the runtimes ({@link PluginRuntime}, {@link FramePluginRuntime})
+ * inject it and reconcile activation against {@link disabled} reactively, so a toggle takes effect at
+ * once without a reload. It never depends on the runtimes, which keeps the dependency one-way.
+ */
+declare class PluginEnablementService {
+    private readonly store;
+    private readonly sync;
+    private readonly disabledSet;
+    private readonly names;
+    /** The disabled plugin ids (reactive) — a runtime reconciles activation against this. */
+    readonly disabled: i0.Signal<ReadonlySet<string>>;
+    /** Every known plugin with its enabled state, for the permissions settings surface. */
+    readonly plugins: i0.Signal<readonly PluginInfo[]>;
+    constructor();
+    /** Records a plugin so the permissions surface can list it (enabled or not). Idempotent. A runtime calls it for every plugin it knows. */
+    register(id: string, name: string): void;
+    /** Drops a plugin from the list — it was uninstalled, not merely disabled. Idempotent. */
+    unregister(id: string): void;
+    /** Whether `id` is currently enabled (default: yes — a plugin is on until the user turns it off). */
+    isEnabled(id: string): boolean;
+    /** Turns a whole plugin on or off (persisted). The runtimes react by loading/unloading it. */
+    setEnabled(id: string, enabled: boolean): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<PluginEnablementService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<PluginEnablementService>;
+}
+
+/**
+ * A community plugin the user installed from the distribution's catalog. Plain data — the
+ * same shape the sandbox runtime needs to spawn it, plus display metadata for the store and
+ * permissions surfaces.
+ */
+interface InstalledPlugin {
+    /** Stable plugin id — also the id capabilities are granted to (default-deny). */
+    readonly id: string;
+    /** Display name shown in the store and permissions surfaces. */
+    readonly name: string;
+    /** Same-origin URL of the plugin's entry document. */
+    readonly entryUrl: string;
+    /**
+     * Capabilities the plugin declares. Accepting the install dialog grants exactly these — the user's
+     * consent replaces the composition root's grant for installed plugins.
+     */
+    readonly capabilities?: readonly Capability[];
+    /**
+     * Catalog version at install/update time. Drives update detection (a strictly newer catalog
+     * version offers an update) and is part of the runtime's respawn signature — a version-only
+     * change respawns the running plugin.
+     */
+    readonly version?: string;
+    /** Same-origin URL of the plugin's list icon (an image the operator ships with the plugin). */
+    readonly iconUrl?: string;
+    /**
+     * The level this entry asks to run at. It is a request, not a decision: the composition sets the
+     * highest level a catalog may confer, an entry at or below it runs at what it asked for, and one
+     * above it is refused rather than quietly run lower. Omitted means isolated.
+     */
+    readonly level?: PluginIsolationLevel;
+}
+/**
+ * One entry of the distribution's plugin catalog: an {@link InstalledPlugin} plus the
+ * display metadata the store dialog shows (the Obsidian community-plugins model — list of name,
+ * author, downloads, last update and description; a detail pane rendering the plugin's README
+ * **in-app**, never an embedded external page).
+ */
+interface PluginCatalogEntry extends InstalledPlugin {
+    /** Short description shown in the store list. */
+    readonly description?: string;
+    /** Icon name for the install-consent dialog — resolved by the host icon registry. */
+    readonly icon?: string;
+    /** Operator-curated category, shown as a badge and matched by the store search. */
+    readonly category?: string;
+    /** Plugin author, shown in the list and the detail pane. */
+    readonly author?: string;
+    /** Install/download count, display-only (the operator's stats). */
+    readonly downloads?: number;
+    /** ISO date of the last update, display-only. */
+    readonly updated?: string;
+    /** External link to the plugin's repository/homepage — rendered as a plain link, never framed. */
+    readonly repository?: string;
+    /**
+     * Same-origin URL of the plugin's README (Markdown) — the operator copies it into the store next
+     * to the plugin files; the detail pane fetches and renders it sanitized in-app.
+     */
+    readonly readmeUrl?: string;
+    /**
+     * `true` for a plugin the operator **deploys**: active for every user without a consent dialog,
+     * holding exactly the capabilities this entry names, and gone again once the catalog stops
+     * carrying it. Omitted or `false` means the entry is merely **offered** — the user browses it,
+     * consents and installs it, which is the only path that grants anything on their say-so.
+     *
+     * The authority behind a deployed entry is the operator's, so the user is shown it but is not
+     * asked about it and cannot remove it.
+     */
+    readonly deployed?: boolean;
+}
+
+/**
+ * The user's installed community plugins. Holds only the state: which catalog entries the
+ * user installed, persisted user-locally through the {@link SETTINGS_STORE} — a product that wants
+ * tenant-wide or server-held installs implements that in its store backend, the seam does not change.
+ * The {@link FramePluginRuntime} reconciles activation against {@link installed} reactively, so an
+ * install spawns the plugin at once and an uninstall unloads it, both without a reload. It never
+ * depends on the runtime, which keeps the dependency one-way (the {@link PluginEnablementService}
+ * precedent).
+ */
+declare class PluginInstallService {
+    private readonly store;
+    private readonly sync;
+    private readonly pluginState;
+    private readonly entries;
+    private composedIds;
+    /** The installed plugins (reactive) — the sandbox runtime reconciles against this. */
+    readonly installed: i0.Signal<readonly InstalledPlugin[]>;
+    constructor();
+    /** Records the composition-time plugin ids so an install can never shadow a composed plugin. */
+    markComposed(ids: readonly string[]): void;
+    isInstalled(id: string): boolean;
+    /** The installed entry for an id, or `undefined` — the baseline an update is compared against. */
+    find(id: string): InstalledPlugin | undefined;
+    /**
+     * Installs a catalog entry after the user consented to its declared capabilities. Fail-fast: the
+     * `entryUrl` must be same-origin (the store is the distribution's own origin) and the id
+     * must be neither composed nor already installed. Persisted; the runtime spawns the plugin live.
+     */
+    install(plugin: InstalledPlugin): void;
+    /**
+     * Replaces an installed entry with a newer catalog entry (the update flow).
+     * Same fail-fast validation as {@link install}, except the id must already be installed. The
+     * persisted entry carries the plugin's capabilities, so a declaration that grew must be consented
+     * to before this is called — see `confirmUpdate`. The runtime respawns the plugin live.
+     */
+    update(plugin: InstalledPlugin): void;
+    /** Removes an installed plugin (idempotent); the runtime unloads it live. */
+    /**
+     * Removes an installed plugin and **deletes its own store** — deliberately the
+     * opposite of its settings section, which survives so a reinstall finds its configuration. An
+     * abandoned draft of a plugin the user just removed is litter; a preference is not.
+     */
+    uninstall(id: string): void;
+    private validEntry;
+    private persist;
+    static ɵfac: i0.ɵɵFactoryDeclaration<PluginInstallService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<PluginInstallService>;
+}
+
+/**
+ * The distribution's plugin catalog port: the operator-curated list of community plugins a
+ * user may install. The platform only defines the seam — what is not in the catalog does not exist
+ * for the shell; per-tenant curation is the product backend answering the catalog request
+ * tenant-dependently.
+ */
+interface PluginCatalog {
+    load(): Promise<readonly PluginCatalogEntry[]>;
+}
+/**
+ * Injection token for the {@link PluginCatalog}. No default — a distribution without a catalog has no
+ * plugin store (and no store settings section). Provide one with {@link providePluginCatalog}.
+ */
+declare const PLUGIN_CATALOG: InjectionToken<PluginCatalog>;
+/**
+ * A {@link PluginCatalog} that fetches a same-origin JSON document (an array of
+ * {@link PluginCatalogEntry}). Entries are parsed defensively: junk shapes, foreign-origin
+ * `entryUrl`s and unknown capability names are dropped. The catalog URL itself must be same-origin —
+ * the store is the distribution's own origin; a product that wants another source
+ * implements the {@link PluginCatalog} port directly.
+ */
+declare function urlPluginCatalog(url: string): PluginCatalog;
+
+/** Options for {@link providePluginCatalog}. */
+interface PluginCatalogOptions {
+    /**
+     * Transloco key (or literal) for the store's settings-section title — brand the store per product
+     * (e.g. `'product.marketplace'`). Defaults to the built-in `settings.pluginStore` ("Plugin store").
+     */
+    readonly title?: string;
+    /**
+     * The highest level this catalog may confer on what it carries. Defaults to the strict one, so a
+     * catalog can never hand out an embedded application unless the composition said it may. An entry
+     * asking for more is refused rather than started lower — a plugin running below what it needs
+     * fails in ways nobody can trace back to a line of configuration.
+     */
+    readonly maxLevel?: PluginIsolationLevel;
+}
+/**
+ * Wires the plugin store into a distribution: provides the catalog (a same-origin JSON URL
+ * or a custom {@link PluginCatalog} implementation), makes sure the sandbox runtime is active even
+ * when no plugin is composed statically, and registers the store's entry points — a settings section
+ * (`setting:shell.pluginStore`, omit-able) whose Browse button opens the **store dialog** (the
+ * Obsidian browse model: searchable list + in-app detail pane with README), plus the palette command
+ * `shell.openPluginStore`. The title is brandable via {@link PluginCatalogOptions.title}. Installing
+ * and uninstalling happens in the store; an installed plugin that declares its own settings gets its
+ * own entry under the **Community plugins** nav group. Place after `provideShell()`.
+ */
+declare function providePluginCatalog(source: PluginCatalog | string, options?: PluginCatalogOptions): (Provider | EnvironmentProviders)[];
+
+/**
+ * Distribution-level icons: seed `name → SVG` into the module-global registry at bootstrap,
+ * resolved by `<lw-icon>`. **The distribution wins:** naming one of the first-party icons replaces it
+ * everywhere the chrome draws it, which is how a product re-skins the workbench; naming a new one adds it.
+ * A *weaver* instead contributes at runtime via `ctx.contributeIcons` and can never shadow a name that is
+ * already taken, so an installed plugin cannot repaint the chrome. Distribution icons are build-time and
+ * trusted like the first-party set, so they are not re-sanitized.
+ *
+ * The key type suggests the shipped names while still accepting your own, so a typo in an intended
+ * replacement shows up while writing it instead of silently adding a glyph nothing draws.
+ *
+ * These icons also travel into sandboxed surfaces, so a plugin drawing `<lw-icon name="trash">` shows
+ * your glyph rather than ours.
+ */
+declare function provideIcons(icons: Readonly<Partial<Record<LoomIconName | (string & {}), string>>>): EnvironmentProviders;
+
+/** The custom-element tag. */
+declare const LW_ICON_TAG = "lw-icon";
+/**
+ * `<lw-icon name="add" size="1rem">` — the host icon primitive as a framework-agnostic custom element
+ *: a plain `HTMLElement` that resolves a **name** to its SVG via the module-global icon
+ * registry — no Angular DI, no `@ng-icons` runtime — so it works in a weaver body by tag, not
+ * only in shell chrome. Light DOM: the SVG uses `currentColor`, so `text-*` tokens tint it for free.
+ *
+ * The SVG is already safe (first-party markup, or sanitized at registration), so it is set as raw
+ * `innerHTML`. Decorative by default (`aria-hidden`); pass `aria-label` to expose it as an image.
+ *
+ *   <lw-icon name="close" size="0.85rem"></lw-icon>
+ *   <lw-icon [name]="dynamicName()" aria-label="…"></lw-icon>
+ */
+declare class LwIconElement extends HTMLElement {
+    static readonly observedAttributes: string[];
+    get name(): string;
+    set name(value: string | null);
+    get size(): string;
+    set size(value: string | null);
+    connectedCallback(): void;
+    attributeChangedCallback(): void;
+    /**
+     * Re-draws from the registry without changing the name. A sandboxed surface receives the product's
+     * replacement icons over its channel, which can arrive after it has already painted.
+     */
+    refresh(): void;
+    private render;
+}
+/** Registers `<lw-icon>` once (idempotent) — called from {@link provideShell} at bootstrap. */
+declare function defineLwIcon(): void;
+
+export { AUTH_SOURCE, AuthContext, BAR_ITEM, CAPABILITY_GRANTS, COMMAND_INVOKER, CapabilityGrantService, CommandInvocationService, CommandService, ContentTabsService, ContributionRegistry, DEFAULT_LAYOUT, DEFAULT_SHELL_FEATURES, DEVICE_LEVEL_KEYS, DialogOutlet, DialogService, FRAME_PLUGIN, FramePluginRuntime, KeybindingService, LW_BUTTON_TAG, LW_ICON_TAG, LW_MARKDOWN_TAG, LW_TOOLTIP_TAG, LocalStorageStore, LwButton, LwButtonElement, LwIconElement, LwMarkdownElement, LwSettingRow, LwSpinner, LwTooltipElement, LwVersion, NotificationService, PLUGIN, PLUGIN_CATALOG, PluginEnablementService, PluginInstallService, PluginRuntime, PopoutService, RAIL_ITEM, SETTINGS_STORE, SHELL_FEATURES, SHELL_LAYOUT, SettingsService, Shell, StateSyncService, TRANSLATION_NAMESPACES, TRANSLATION_OVERRIDES, ThemeService, ToastOutlet, UpdateBadge, UpdateService, VIEW, VersionService, WORKING_STATE_STORE, WORKSPACE_DEFINITIONS, defineLwButton, defineLwIcon, defineLwMarkdown, defineLwTooltip, effectiveCapabilities, formatChord, provideAuthSource, provideBarItems, provideCapabilityGrants, provideCommandPaletteEntry, provideFramePlugins, provideIcons, provideIdentityScopedStores, provideLayout, providePluginCatalog, providePlugins, provideRailItems, provideSettingsStore, provideShell, provideShellFeatures, provideShellRouter, provideTabAddressResolver, provideTranslationNamespaces, provideTranslationOverrides, provideUnauthorizedRedirect, provideViews, provideWorkingStateStore, provideWorkspaces, urlPluginCatalog };
+export type { ApplySyncedState, AuthSourceOptions, CapabilityGrants, CommandFeatures, CommandInvoker, CommandPaletteEntryOptions, ContentFeatures, ContentTabView, DialogButtonView, DialogInstance, DockPosition, FramePlugin, IdentityScopedStoreOptions, InstalledPlugin, KeyValueStore, LayoutRegion, LoomIconName, Notification, PluginCapabilityState, PluginCatalog, PluginCatalogEntry, PluginCatalogOptions, PluginInfo, PluginPermissions, QuickOpenTarget, RailFeatures, RegionType, RegisteredCommand, RegisteredContentRoute, RegisteredView, ResolvedTheme, RetentionDefault, ShellFeatures, ShellFeaturesInput, ShellLayout, ShellOptions, SidebarFeatures, SyncSource, TabAddressInput, TabAddressResolver, ThemeMode, TooltipPosition, UnauthorizedHandler, WindowFeatures, WorkspaceArea, WorkspaceAreaBase, WorkspaceColumnArea, WorkspaceDefinition, WorkspaceFeatures, WorkspaceRowArea, WorkspaceTab, WorkspaceTabArea, WorkspaceTabEntry };
+//# sourceMappingURL=loomweaver-shell.d.ts.map