@sdcorejs/angular 20.1.6 → 20.2.1

package/modules/permission/index.d.ts

@@ -49,6 +49,17 @@ interface ISdPermissionConfiguration {
      * Hỗ trợ trả về đồng bộ, Promise hoặc Observable.
      */
     getToken?: () => MaybeAsync<string | undefined | null>;
+    /**
+     * Cho phép mirror danh sách mã quyền của key này xuống `sessionStorage` để sống qua reload.
+     *
+     * ⚠️ Mặc định `false` — danh sách quyền CHỈ nằm trong bộ nhớ.
+     *
+     * Bật cờ này nghĩa là chấp nhận: mọi script chạy trên cùng origin đều ĐỌC và GHI được danh sách đó.
+     * Cache KHÔNG phải một ranh giới phân quyền — nó chỉ tiết kiệm một lần gọi API khi reload; backend
+     * vẫn phải kiểm tra quyền cho từng request. Khi bật, nhớ gọi `SdPermissionService.reset()` lúc
+     * signout để xoá cả bản mirror.
+     */
+    persistCache?: boolean;
 }
 /**
  * InjectionToken cho cấu hình permission.
@@ -65,13 +76,64 @@ interface ISdPermissionConfiguration {
  */
 declare const SD_PERMISSION_CONFIGURATION: InjectionToken<ISdPermissionConfiguration | ISdPermissionConfiguration[]>;
 
+/**
+ * Opt-out TƯỜNG MINH: "chỗ này cố ý không yêu cầu quyền nào".
+ *
+ * Dùng cho `route.data.permission`, `[sdPermission]` hoặc `hasPermission(...)` khi một route/phần tử
+ * thật sự công khai. Mọi giá trị rỗng khác (`undefined`, `null`, `''`, `[]`) đều bị coi là CẤU HÌNH
+ * THIẾU và bị từ chối — xem `SdPermissionService.hasPermission`.
+ */
+declare const SD_PERMISSION_PUBLIC = "__SD_PERMISSION_PUBLIC__";
+/** Kiểu đầu vào cho `hasPermission` / `[sdPermission]`. */
+type SdPermissionInput = string | string[] | null | undefined;
 declare class SdPermissionService {
     #private;
     constructor();
     loadPermissions: (key?: string) => Promise<string[]>;
     loadAllPermissions: () => Promise<void>;
-    hasPermission: (permission: string | string[], key?: string) => boolean;
+    /**
+     * Xoá TOÀN BỘ quyền đã nạp (mọi key) — cả map trong bộ nhớ, cờ "đã nạp" lẫn bản mirror
+     * `sessionStorage` của các key bật `persistCache`.
+     *
+     * ⚠️ BẮT BUỘC gọi khi signout. Service là singleton `providedIn: 'root'`, nên trong một SPA
+     * signout → signin (không reload trang) mà không reset thì `loadPermissions()` sẽ short-circuit
+     * theo key đã cache và user MỚI thừa hưởng nguyên bộ quyền của user CŨ.
+     *
+     * ```ts
+     * auth.signout$?.subscribe(() => permissionService.reset());
+     * ```
+     */
+    reset: () => void;
+    /**
+     * Xoá quyền đã nạp của MỘT key (mặc định là key portal `undefined`), buộc lần
+     * `loadPermissions(key)` kế tiếp gọi lại loader. Dùng khi chỉ một profile/tenant đổi quyền;
+     * signout thì dùng {@link reset}.
+     */
+    invalidate: (key?: string) => void;
+    /**
+     * Kiểm tra quyền (OR cho mảng).
+     *
+     * ⚠️ BREAKING: đầu vào rỗng (`undefined` / `null` / `''` / `[]`) giờ trả `false`.
+     * Muốn "không yêu cầu quyền" thì phải nói ra bằng {@link SD_PERMISSION_PUBLIC}.
+     */
+    hasPermission: (permission: SdPermissionInput, key?: string) => boolean;
     getToken: (key?: string) => Promise<string | null | undefined>;
+    /**
+     * Giải mã phần payload của JWT hiện tại và trả về claim **CHƯA ĐƯỢC XÁC THỰC**.
+     *
+     * ⚠️ KHÔNG kiểm chữ ký, KHÔNG kiểm `exp`/`nbf`/`aud`/`iss`. Đây thuần tuý là base64url-decode: bất
+     * kỳ ai cũng tự tạo được một token có claim tuỳ ý và hàm này sẽ vui vẻ trả về. Vì vậy kết quả CHỈ
+     * dùng cho mục đích hiển thị (tên, avatar, tenant đang chọn…) và TUYỆT ĐỐI không được dùng để ra
+     * quyết định phân quyền — quyền phải do backend xác thực chữ ký rồi trả về.
+     *
+     * Trả `null` khi không có token hoặc payload hỏng.
+     */
+    readUnverifiedTokenClaims: <T>(key?: string) => Promise<T | null>;
+    /**
+     * @deprecated Tên `decodeToken` gợi ý một thao tác đã được kiểm chứng, trong khi thực tế payload
+     * hoàn toàn KHÔNG được xác thực. Dùng {@link readUnverifiedTokenClaims} — alias này chỉ còn để
+     * consumer cũ không vỡ và sẽ bị gỡ ở release sau.
+     */
     decodeToken: <T>(key?: string) => Promise<T | null>;
     static ɵfac: i0.ɵɵFactoryDeclaration<SdPermissionService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<SdPermissionService>;
@@ -79,7 +141,7 @@ declare class SdPermissionService {
 
 declare class SdPermissionDirective {
     #private;
-    readonly sdPermission: i0.InputSignal<string | string[] | null | undefined>;
+    readonly sdPermission: i0.InputSignal<SdPermissionInput>;
     readonly sdPermissionKey: i0.InputSignal<string | undefined>;
     constructor();
     static ɵfac: i0.ɵɵFactoryDeclaration<SdPermissionDirective, never>;
@@ -96,5 +158,5 @@ declare class SdPermissionGuard implements CanActivate, CanActivateChild {
     static ɵprov: i0.ɵɵInjectableDeclaration<SdPermissionGuard>;
 }
 
-export { SD_PERMISSION_CONFIGURATION, SdPermissionDirective, SdPermissionGuard, SdPermissionService };
-export type { ISdPermissionConfiguration };
+export { SD_PERMISSION_CONFIGURATION, SD_PERMISSION_PUBLIC, SdPermissionDirective, SdPermissionGuard, SdPermissionService };
+export type { ISdPermissionConfiguration, SdPermissionInput };

package/package.json

@@ -1,7 +1,24 @@
 {
   "name": "@sdcorejs/angular",
-  "version": "20.1.6",
+  "version": "20.2.1",
+  "description": "Angular component library: data table, query bar/builder, 20+ signal-based form controls, layout, auth and workflow services. Standalone, OnPush, signals-first. Published in parallel lines for Angular 19, 20 and 21.",
+  "keywords": [
+    "angular",
+    "angular-components",
+    "component-library",
+    "ui-components",
+    "angular-material",
+    "signals",
+    "standalone-components",
+    "data-table",
+    "forms",
+    "query-builder"
+  ],
+  "author": "SDCoreJS",
   "license": "MIT",
+  "engines": {
+    "node": ">=20.11.0"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/sdcorejs/sdcorejs-angular.git"
@@ -11,18 +28,22 @@
     "url": "https://github.com/sdcorejs/sdcorejs-angular/issues"
   },
   "peerDependencies": {
+    "@angular/animations": "^19.0.0 || ^20.0.0 || ^21.0.0",
+    "@angular/cdk": "^19.0.0 || ^20.0.0 || ^21.0.0",
     "@angular/common": "^19.0.0 || ^20.0.0 || ^21.0.0",
     "@angular/core": "^19.0.0 || ^20.0.0 || ^21.0.0",
+    "@angular/forms": "^19.0.0 || ^20.0.0 || ^21.0.0",
     "@angular/material": "^19.0.0 || ^20.0.0 || ^21.0.0",
-    "@angular/material-date-fns-adapter": "^19.0.0 || ^20.0.0 || ^21.0.0"
+    "@angular/material-date-fns-adapter": "^19.0.0 || ^20.0.0 || ^21.0.0",
+    "@angular/platform-browser": "^19.0.0 || ^20.0.0 || ^21.0.0",
+    "@angular/router": "^19.0.0 || ^20.0.0 || ^21.0.0",
+    "rxjs": "^7.8.0"
   },
   "dependencies": {
     "@sdcorejs/angular-material-datetime": "1.0.3",
     "@sdcorejs/utils": "1.1.4",
     "@lucide/angular": "^1.22.0",
     "@ckeditor/ckeditor5-angular": "11.1.2",
-    "@omer-go/docx-parser-converter-ts": "^1.0.0",
-    "@bjorn3/browser_wasi_shim": "^0.4.2",
     "ckeditor5": "48.0.0",
     "chart.js": "^4.5.1",
     "date-fns": "^3.6.0",
@@ -32,7 +53,13 @@
     "prismjs": "^1.30.0",
     "tslib": "^2.8.0"
   },
-  "sideEffects": false,
+  "sideEffects": [
+    "**/*.css",
+    "**/*.scss",
+    "./fesm2022/sdcorejs-angular-components-chart.mjs",
+    "./fesm2022/sdcorejs-angular-components-code-editor.mjs",
+    "./fesm2022/sdcorejs-angular-components-ckeditor-styles.mjs"
+  ],
   "module": "fesm2022/sdcorejs-angular.mjs",
   "typings": "index.d.ts",
   "exports": {
@@ -51,6 +78,10 @@
       "types": "./components/anchor/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-components-anchor.mjs"
     },
+    "./components/api-contract-builder": {
+      "types": "./components/api-contract-builder/index.d.ts",
+      "default": "./fesm2022/sdcorejs-angular-components-api-contract-builder.mjs"
+    },
     "./components/audit-diff": {
       "types": "./components/audit-diff/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-components-audit-diff.mjs"
@@ -67,10 +98,6 @@
       "types": "./components/badge/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-components-badge.mjs"
     },
-    "./components/base": {
-      "types": "./components/base/index.d.ts",
-      "default": "./fesm2022/sdcorejs-angular-components-base.mjs"
-    },
     "./components/breadcrumb": {
       "types": "./components/breadcrumb/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-components-breadcrumb.mjs"
@@ -95,10 +122,6 @@
       "types": "./components/data-state/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-components-data-state.mjs"
     },
-    "./components/document-builder": {
-      "types": "./components/document-builder/index.d.ts",
-      "default": "./fesm2022/sdcorejs-angular-components-document-builder.mjs"
-    },
     "./components/editor": {
       "types": "./components/editor/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-components-editor.mjs"
@@ -311,10 +334,6 @@
       "types": "./interceptors/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-interceptors.mjs"
     },
-    "./models": {
-      "types": "./models/index.d.ts",
-      "default": "./fesm2022/sdcorejs-angular-models.mjs"
-    },
     "./modules": {
       "types": "./modules/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-modules.mjs"
@@ -359,18 +378,10 @@
       "types": "./services/confirm/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-services-confirm.mjs"
     },
-    "./services/docx": {
-      "types": "./services/docx/index.d.ts",
-      "default": "./fesm2022/sdcorejs-angular-services-docx.mjs"
-    },
     "./services/excel": {
       "types": "./services/excel/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-services-excel.mjs"
     },
-    "./services/license": {
-      "types": "./services/license/index.d.ts",
-      "default": "./fesm2022/sdcorejs-angular-services-license.mjs"
-    },
     "./services/loading": {
       "types": "./services/loading/index.d.ts",
       "default": "./fesm2022/sdcorejs-angular-services-loading.mjs"

package/pipes/index.d.ts

@@ -1,6 +1,6 @@
 import * as i0 from '@angular/core';
 import { PipeTransform } from '@angular/core';
-import * as _angular_platform_browser from '@angular/platform-browser';
+import { SafeHtml } from '@angular/platform-browser';
 import { Observable } from 'rxjs';
 
 declare class SdFormatDatePipe implements PipeTransform {
@@ -25,17 +25,39 @@ declare class SdFormatNumberPipe implements PipeTransform {
     static ɵprov: i0.ɵɵInjectableDeclaration<SdFormatNumberPipe>;
 }
 
+/**
+ * Render an HTML string through `[innerHTML]`.
+ *
+ * why: this pipe used to call `bypassSecurityTrustHtml()` unconditionally, on every value, with no
+ * sanitize step. That turned every call site into a stored-XSS sink — and the library itself pipes
+ * server-supplied table cell data through it
+ * (`components/table/src/components/desktop-cell/view/view.component.html`), while
+ * `components/table/sd-table.md` already described the value as "sanitized via sdSafeHtml".
+ *
+ * Now it **sanitizes by default** and the bypass is an explicit, per-call-site opt-in:
+ *
+ * ```html
+ * <!-- untrusted / server-supplied: script, on* handlers and javascript: urls are stripped -->
+ * <div [innerHTML]="row.note | sdSafeHtml"></div>
+ *
+ * <!-- app-authored markup you control, e.g. an inline SVG sprite -->
+ * <span [innerHTML]="iconSvg | sdSafeHtml: true"></span>
+ * ```
+ *
+ * This mirrors the decision already taken for the toast in `services/notify`: text-safe by default,
+ * opt-in HTML. Auto-detecting "this looks like HTML" is deliberately NOT done — it would escalate
+ * untrusted text that merely contains `<` straight back into the unsanitized sink.
+ */
 declare class SdSafeHtmlPipe implements PipeTransform {
-    private sanitizer;
-    /** Inserted by Angular inject() migration for backwards compatibility */
-    constructor(...args: unknown[]);
-    transform(html: string | number | undefined | null): _angular_platform_browser.SafeHtml | undefined;
+    #private;
+    transform(html: string | number | undefined | null, trusted?: boolean): SafeHtml | string | number | undefined;
     static ɵfac: i0.ɵɵFactoryDeclaration<SdSafeHtmlPipe, never>;
     static ɵpipe: i0.ɵɵPipeDeclaration<SdSafeHtmlPipe, "sdSafeHtml", true>;
     static ɵprov: i0.ɵɵInjectableDeclaration<SdSafeHtmlPipe>;
 }
 
 declare class SdTimeDifferentPipe implements PipeTransform {
+    #private;
     private maxSecond;
     private maxMinute;
     private maxHour;

package/services/api/index.d.ts

@@ -75,6 +75,20 @@ interface ISdApiConfiguration {
 declare const SD_API_CONFIG: InjectionToken<ISdApiConfiguration>;
 /** @deprecated Use `SD_API_CONFIG`. This is the same injection token. */
 declare const SD_API_CONFIGURATION: InjectionToken<ISdApiConfiguration>;
+/**
+ * Lỗi nghiệp vụ: HTTP 200 nhưng body envelope báo thất bại (`{ ok: false, ... }`).
+ *
+ * why: trước đây `SdApiService` `throw body` — một plain object. Hệ quả: `error instanceof Error`
+ * là `false`, `error.message` là `undefined`, nên mọi `catch` của consumer và predicate
+ * `retry.retryWhen` đều bỏ sót nhánh này. Bọc vào một Error thật để envelope lỗi đi chung
+ * đường với lỗi HTTP; body gốc vẫn giữ nguyên ở `.body`.
+ */
+declare class SdApiError<TBody = unknown> extends Error {
+    readonly name = "SdApiError";
+    /** Body nguyên bản của response (đúng object server trả về). */
+    readonly body: TBody;
+    constructor(body: TBody, message?: string);
+}
 
 /**
  * Response generics intentionally default to `unknown` for type safety.
@@ -105,11 +119,17 @@ declare class SdHttpInterceptor implements HttpInterceptor {
     static ɵprov: i0.ɵɵInjectableDeclaration<SdHttpInterceptor>;
 }
 
+/**
+ * Thông điệp của assertion dev-mode ở constructor. Export ra để spec khẳng định đúng nội dung,
+ * và để consumer grep được khi thấy nó trong console.
+ */
+declare const SD_API_MISSING_HTTP_CLIENT_MESSAGE: string;
 declare class SdApiModule {
+    constructor();
     static ɵfac: i0.ɵɵFactoryDeclaration<SdApiModule, never>;
     static ɵmod: i0.ɵɵNgModuleDeclaration<SdApiModule, never, never, never>;
     static ɵinj: i0.ɵɵInjectorDeclaration<SdApiModule>;
 }
 
-export { SD_API_CONFIG, SD_API_CONFIGURATION, SdApiModule, SdApiService, SdHttpInterceptor };
+export { SD_API_CONFIG, SD_API_CONFIGURATION, SD_API_MISSING_HTTP_CLIENT_MESSAGE, SdApiError, SdApiModule, SdApiService, SdHttpInterceptor };
 export type { ISdApiConfiguration, SdApiHandler, SdApiHttpOption, SdApiOption, SdApiRequestUpdate, SdApiResponseType, SdApiRetryOption, SdDeleteOption, SdGetOption, SdPatchOption, SdPostOption, SdPutOption };

package/services/cache/index.d.ts

@@ -43,12 +43,22 @@ interface SdCacheStoredValue<T = unknown> {
 type SdCacheSetCallback = (key: string, value: SdCacheStoredValue<unknown>, option?: SdCacheOption<unknown>) => Promise<void> | void;
 type SdCacheGetCallback = (key: string, option?: SdCacheOption<unknown>) => Promise<SdCacheStoredValue<unknown> | undefined>;
 type SdCacheRemoveCallback = (key: string, option?: SdCacheOption<unknown>) => Promise<void> | void;
+/**
+ * Số entry `type: 'memory'` tối đa được giữ trước khi LRU đẩy entry cũ nhất ra.
+ * Ghi đè bằng `maxMemoryEntries` trên `SD_CACHE_CONFIG`.
+ */
+declare const SD_CACHE_DEFAULT_MAX_MEMORY_ENTRIES = 500;
 interface ISdCacheConfiguration {
     convertKey?: (key: string) => string;
     namespace?: string;
     version?: string | number;
     serializer?: SdPersistenceSerializer;
     identityCanonicalizer?: SdPersistenceIdentityCanonicalizer;
+    /**
+     * Trần LRU cho cache `type: 'memory'`. Mặc định `SD_CACHE_DEFAULT_MAX_MEMORY_ENTRIES` (500).
+     * Giá trị không hợp lệ (không hữu hạn, < 1) sẽ rơi về mặc định.
+     */
+    maxMemoryEntries?: number;
     set?: SdCacheSetCallback;
     get?: SdCacheGetCallback;
     remove?: SdCacheRemoveCallback;
@@ -75,5 +85,5 @@ declare class SdCacheService {
     static ɵprov: i0.ɵɵInjectableDeclaration<SdCacheService>;
 }
 
-export { SD_CACHE_CONFIG, SdCacheService, adaptLegacySdCacheCallbacks };
+export { SD_CACHE_CONFIG, SD_CACHE_DEFAULT_MAX_MEMORY_ENTRIES, SdCacheService, adaptLegacySdCacheCallbacks };
 export type { ISdCacheConfiguration, SdCache, SdCacheGetCallback, SdCacheOption, SdCacheRemoveCallback, SdCacheSetCallback, SdCacheSnapshot, SdCacheStoredValue, SdCacheWithDefault, SdLegacyCacheCallbacks };

package/services/index.d.ts

@@ -6,7 +6,6 @@ export * from '@sdcorejs/angular/services/confirm';
 export * from '@sdcorejs/angular/services/api';
 export * from '@sdcorejs/angular/services/loading';
 export * from '@sdcorejs/angular/services/excel';
-export * from '@sdcorejs/angular/services/docx';
 export * from '@sdcorejs/angular/services/viewport';
 export * from '@sdcorejs/angular/services/unsaved-changes';
 export * from '@sdcorejs/angular/services/task';

package/services/notify/index.d.ts

@@ -53,4 +53,4 @@ declare class SdNotifyService {
 }
 
 export { SdNotifyService };
-export type { NotifyOption as SdNotifyOption };
+export type { NotifyOption as SdNotifyOption, ToastData as SdToastData, ToastType as SdToastType };

package/utilities/extensions/index.d.ts

@@ -1,58 +1,12 @@
-export { ArrayUtilities, BrowserUtilities, ColorUtilities, DateUtilities, NumberUtilities, Utilities, ValidationUtilities } from '@sdcorejs/utils/fns';
-
-declare const StringUtilities: {
-    /** @deprecated Use REGEX_VN_PHONE instead */
-    REGEX_PHONE_VN: string;
-    /** @deprecated Use REGEX_VN_ID instead */
-    REGEX_IDVN: string;
-    /** @deprecated Use REGEX_VN_ID_OR_PASSPORT instead */
-    REGEX_IDVN_OR_PASSPORT: string;
-    /** @deprecated Use {@link ValidationUtilities.isEmail} instead */
-    isValidEmail: (value: any) => boolean;
-    /** @deprecated Use {@link ValidationUtilities.isPhone} instead */
-    isValidPhone: (value: any) => boolean;
-    /** @deprecated Use {@link ValidationUtilities.isCode} instead */
-    isValidCode: (value: any) => boolean;
-    REGEX_EMAIL: string;
-    REGEX_PHONE: string;
-    REGEX_VN_PHONE: string;
-    REGEX_VN_ID: string;
-    REGEX_PASSPORT: string;
-    REGEX_VN_ID_OR_PASSPORT: string;
-    REGEX_TIME: string;
-    REGEX_URL: string;
-    REGEX_DOMAIN: string;
-    REGEX_IPV4: string;
-    REGEX_IPV6: string;
-    REGEX_IMAGE_URL: string;
-    REGEX_SLUG: string;
-    REGEX_NUMBER: string;
-    REGEX_INTEGER: string;
-    REGEX_DECIMAL: string;
-    REGEX_POSITIVE_NUMBER: string;
-    REGEX_UUID: string;
-    REGEX_CODE_16: string;
-    REGEX_CODE_32: string;
-    REGEX_HEX_COLOR: string;
-    REGEX_BASE64: string;
-    changeAliasLowerCase: (alias: any) => string;
-    aliasIncludes: (alias: any, searchText: any) => boolean;
-    format: (template: string, ...arr: any[]) => string;
-    templateToDisplay: (template: string, entity: Record<string, any>) => string;
-    parseExpression: (template: string, entity: Record<string, any>) => any;
-    encrypt: (obj: any) => string;
-    decrypt: (encripted: string) => any;
-    isNullOrEmpty: (value: any) => boolean;
-    isNullOrWhiteSpace: (value: any) => boolean;
-    convertToSnakeCaseCode: (name: string) => string;
-    generateUniqueCode: (name: string, existingCodes: string[]) => string;
-    sha256: (input: string) => Promise<string>;
-};
-
 /**
- * @deprecated Use {@link Utilities} and {@link BrowserUtilities} from `@sdcorejs/utils/fns` instead.
- * - upload/download/clipboard/isMobile → BrowserUtilities
- * - allWithPaging (→ fetchAllByPaging) / randomId / hash / parseQueryParams / generateUuid / getNestedValue → Utilities
+ * Facade tiện ích chung của `@sdcorejs/angular` (upload/download, clipboard, paging, hash, uuid…).
+ *
+ * why: khối này TỪNG bị đánh dấu `@deprecated` như thể chỉ là alias mỏng của `Utilities` /
+ * `BrowserUtilities` bên `@sdcorejs/utils/fns` — điều đó SAI. Cả 14 member dưới đây là cài đặt
+ * cục bộ trong chính file này (xem phần trên), có hành vi riêng cho môi trường Angular (interceptor,
+ * i18n, DOM). Xoá nó theo diện "dead alias" sẽ mất code thật, nên marker `@deprecated` đã được gỡ
+ * trong đợt breaking rename thay vì gỡ implementation. Các alias thật sự chết ở `utilities/**`
+ * (`SdColor`, `SD_EMPTY_STR`, `SdFilter*`, `SdPatternCommons`, `hslToHex`/`rgbToHex`…) đã bị xoá hẳn.
  */
 declare const SdUtilities: {
     upload: (option?: {
@@ -74,16 +28,11 @@ declare const SdUtilities: {
     randomId: (prefix?: string | null) => string;
     hash: (obj: any) => string;
     parseQueryParams: (queryString?: string) => Record<string, string>;
-    getClientPublicIp: () => Promise<string | null>;
+    getClientPublicIp: (endpoint: string) => Promise<string | null>;
     generateUuid: () => string;
     getNestedValue: (obj: any, path: string) => any;
 };
 
-/** @deprecated Use {@link ColorUtilities.hslToHex} from `@sdcorejs/utils/fns` instead */
-declare const hslToHex: (h: number, s: number, l: number) => string;
-/** @deprecated Use {@link ColorUtilities.rgbToHex} from `@sdcorejs/utils/fns` instead */
-declare const rgbToHex: (r: number, g: number, b: number) => string;
-
 type PlainObject = Record<PropertyKey, unknown>;
 declare const ObjectUtilities: {
     isPlainObject: (value: unknown) => value is PlainObject;
@@ -92,4 +41,77 @@ declare const ObjectUtilities: {
     deepMerge: <T extends PlainObject>(...sources: T[]) => T;
 };
 
-export { ObjectUtilities, SdUtilities, StringUtilities, hslToHex, rgbToHex };
+/**
+ * URL safety helpers.
+ *
+ * why: this library used to decide "is this an external link?" and "should this request carry the
+ * bearer token?" with plain substring tests — `path.includes('http')` and `url.includes(route)`.
+ * Both are unsound:
+ *
+ *   - `'javascript:fetch(...)//http'.includes('http')` is `true`, so a menu entry could be opened
+ *     with `window.open()` and execute script in the app origin.
+ *   - With `secureRoutes: ['/api/v1']`, `'https://evil.example.com/api/v1/collect'.includes('/api/v1')`
+ *     is `true`, so a third-party host received the `Authorization: Bearer <token>` header.
+ *
+ * Everything here parses the URL instead of pattern-matching the string, and fails closed.
+ */
+/**
+ * Stand-in origin used when there is no `window.location` (SSR, prerender, unit tests).
+ *
+ * why: without a base, a relative route entry like `'/api/v1'` cannot be parsed, so every
+ * origin-aware check would silently answer `false` on the server — e.g. the keycloak interceptor
+ * would stop attaching the bearer token to every server-rendered request. Resolving BOTH the route
+ * entry and the request URL against one fixed synthetic origin keeps relative-vs-relative matching
+ * consistent across environments, while an ABSOLUTE route entry still has to match a real origin,
+ * so nothing is loosened.
+ */
+declare const SD_NON_BROWSER_ORIGIN = "http://sdcorejs.invalid";
+/** Resolve the origin that relative URLs should be interpreted against. */
+declare function sdResolveBaseOrigin(explicit?: string): string;
+/**
+ * Parse `value` into a URL. Relative values are resolved against `base` when one is supplied.
+ * Returns `undefined` instead of throwing so callers can fail closed with a simple null check.
+ */
+declare function sdParseUrl(value: string | null | undefined, base?: string): URL | undefined;
+/**
+ * True only when `value` is an ABSOLUTE `http:`/`https:` URL.
+ *
+ * Replaces `url.startsWith('http')` / `path.includes('http')`. Note that `startsWith('http')` also
+ * accepts nonsense like `'httpfoo'`, and `includes('http')` accepts any string that merely mentions
+ * it — including `javascript:` payloads.
+ */
+declare function sdIsExternalHttpUrl(value: string | null | undefined): boolean;
+/**
+ * Open an external link in a new browsing context.
+ *
+ * Refuses anything that is not absolute `http:`/`https:` (returns `null` without opening), and
+ * always passes `noopener,noreferrer` so the opened page cannot reach back through `window.opener`
+ * (reverse tabnabbing).
+ */
+declare function sdOpenExternal(value: string | null | undefined, target?: string): Window | null;
+/**
+ * True when `url` is same-origin, or its origin is in `allowedOrigins`.
+ *
+ * Relative URLs (`/api/v1/users`) always count as same-origin. Outside a browser they resolve
+ * against {@link SD_NON_BROWSER_ORIGIN} unless `baseOrigin` is supplied.
+ */
+declare function sdIsAllowedOrigin(url: string | null | undefined, allowedOrigins: readonly string[], baseOrigin?: string): boolean;
+/**
+ * Decide whether an outgoing request matches one of the configured secure routes, i.e. whether it
+ * is allowed to carry credentials.
+ *
+ * A route entry is either:
+ *   - a path prefix (`'/api/v1'`) — matches ONLY same-origin requests under that path, or
+ *   - an absolute URL (`'https://api.example.com/v1'`) — matches that exact origin, under that path.
+ *
+ * Path matching is segment-aware: `'/api/v1'` matches `/api/v1` and `/api/v1/users`, but NOT
+ * `/api/v1beta`. Anything that fails to parse returns `false`.
+ */
+declare function sdMatchesSecureRoute(url: string | null | undefined, routes: readonly string[] | undefined, baseOrigin?: string): boolean;
+/**
+ * Segment-aware path prefix test: `/api/v1` covers `/api/v1` and `/api/v1/users`, but not
+ * `/api/v1beta`. A bare `/` prefix covers everything on that origin.
+ */
+declare function sdIsPathPrefix(prefix: string, pathname: string): boolean;
+
+export { ObjectUtilities, SD_NON_BROWSER_ORIGIN, SdUtilities, sdIsAllowedOrigin, sdIsExternalHttpUrl, sdIsPathPrefix, sdMatchesSecureRoute, sdOpenExternal, sdParseUrl, sdResolveBaseOrigin };

package/utilities/models/index.d.ts

@@ -1,89 +1,15 @@
-import { Color, Size, MaybeAsync, NestedKeyOf, Operator, OperatorHasData, OperatorNoData, Filter, FilterAndOr, FilterBetween, FilterHasData, FilterNoData, Order, PagingReq, PagingRes, QueryReq } from '@sdcorejs/utils/models';
-export { Color, Filter, FilterAndOr, FilterBetween, FilterHasData, FilterNoData, MaybeAsync, NestedKeyOf, Operator, OperatorHasData, OperatorNoData, Order, PagingReq, PagingRes, QueryReq, Size, ValidationPattern, ValidationPatternType, normalizeAsync, resolveMaybeAsync } from '@sdcorejs/utils/models';
-import * as rxjs from 'rxjs';
 import { InputSignalWithTransform, InputSignal, ModelSignal } from '@angular/core';
-export { EMPTY_STR, VALIDATION_PATTERNS } from '@sdcorejs/utils/constants';
-
-/** @deprecated Use {@link Color} from `@sdcorejs/utils/models` instead */
-type SdColor = Color;
-
-/** @deprecated Use {@link Size} from `@sdcorejs/utils/models` instead */
-type SdSize = Size;
 
 type SdIconSet = 'material-icons' | 'material-icons-outlined' | 'material-icons-round' | 'material-icons-sharp' | 'lucide';
 type SdMaterialIconSet = Exclude<SdIconSet, 'lucide'>;
 declare const DefaultSdIconSet: SdIconSet;
 declare const DefaultSdMaterialIconSet: SdMaterialIconSet;
 
-/**
- * @deprecated Use {@link ValidationPatternType} from `@sdcorejs/utils/models` instead.
- * Note: member names changed — PHONE_VN → VN_PHONE, IDVN → VN_ID, IDVN_OR_PASSPORT → VN_ID_OR_PASSPORT.
- */
-type SdPatternType = 'EMAIL' | 'PHONE' | 'PHONE_VN' | 'IDVN' | 'PASSPORT' | 'IDVN_OR_PASSPORT' | 'TIME';
-/**
- * @deprecated Use {@link ValidationPattern} from `@sdcorejs/utils/models` instead.
- * Note: `regex` field renamed to `pattern` to align with Angular `Validators.pattern()`.
- */
-interface SdPatternCommon {
-    type: SdPatternType;
-    name: string;
-    regex: string;
-    errorMessage: string;
-}
-/** @deprecated Use `VALIDATION_PATTERNS` from `@sdcorejs/utils/constants` instead. */
-declare const SdPatternCommons: SdPatternCommon[];
-
-/** @deprecated Use {@link EMPTY_STR} from `@sdcorejs/utils/constants` instead */
-declare const SD_EMPTY_STR = "--";
-
-/** @deprecated Use {@link MaybeAsync} from `@sdcorejs/utils/models` instead */
-type SdMaybeAsync<T> = MaybeAsync<T>;
-/** @deprecated Use {@link resolveMaybeAsync} from `@sdcorejs/utils/models` instead */
-declare const SdResolveMaybeAsync: <T>(value: MaybeAsync<T>) => Promise<T>;
-/** @deprecated Use {@link normalizeAsync} from `@sdcorejs/utils/models` instead */
-declare const SdNormalizeAsync: <T>(value: MaybeAsync<T>) => rxjs.Observable<T>;
-
-/** @deprecated Use {@link NestedKeyOf} from `@sdcorejs/utils/models` instead */
-type SdNestedKeyOf<T> = NestedKeyOf<T>;
-
 /**
  * Utility Type: Bóc tách kiểu dữ liệu gốc từ Angular Signal Inputs & Models
  */
 type SdUnwrapSignal<T> = T extends InputSignalWithTransform<any, infer WriteT> ? WriteT : T extends InputSignal<infer ReadT> ? ReadT : T extends ModelSignal<infer ModelT> ? ModelT : T;
 type SdUnwrapSafe<T> = SdUnwrapSignal<NonNullable<T>>;
 
-/** @deprecated Use {@link Operator} from `@sdcorejs/utils/models` instead */
-type SdOperator = Operator;
-/** @deprecated Use {@link OperatorHasData} from `@sdcorejs/utils/models` instead */
-type SdOperatorHasData = OperatorHasData;
-/** @deprecated Use {@link OperatorNoData} from `@sdcorejs/utils/models` instead */
-type SdOperatorNoData = OperatorNoData;
-declare const SdOperators: {
-    value: Operator;
-    symbol?: string;
-    display: string;
-}[];
-
-/** @deprecated Use {@link Filter} from `@sdcorejs/utils/models` instead */
-type SdFilter<T = any> = Filter<T>;
-/** @deprecated Use {@link FilterHasData} from `@sdcorejs/utils/models` instead */
-type SdFilterHasData<T = any> = FilterHasData<T>;
-/** @deprecated Use {@link FilterBetween} from `@sdcorejs/utils/models` instead */
-type SdFilterBetween<T = any> = FilterBetween<T>;
-/** @deprecated Use {@link FilterNoData} from `@sdcorejs/utils/models` instead */
-type SdFilterNoData<T = any> = FilterNoData<T>;
-/** @deprecated Use {@link FilterAndOr} from `@sdcorejs/utils/models` instead */
-type SdFilterAndOr<T = any> = FilterAndOr<T>;
-
-/** @deprecated Use {@link Order} from `@sdcorejs/utils/models` instead */
-type SdOrder<T = any> = Order<T>;
-
-/** @deprecated Use {@link QueryReq} from `@sdcorejs/utils/models` instead */
-type SdQueryReq<T = any> = QueryReq<T>;
-/** @deprecated Use {@link PagingReq} from `@sdcorejs/utils/models` instead */
-type SdPagingReq<T = any> = PagingReq<T>;
-/** @deprecated Use {@link PagingRes} from `@sdcorejs/utils/models` instead */
-type SdPagingRes<T = any> = PagingRes<T>;
-
-export { DefaultSdIconSet, DefaultSdMaterialIconSet, SD_EMPTY_STR, SdNormalizeAsync, SdOperators, SdPatternCommons, SdResolveMaybeAsync };
-export type { SdColor, SdFilter, SdFilterAndOr, SdFilterBetween, SdFilterHasData, SdFilterNoData, SdIconSet, SdMaterialIconSet, SdMaybeAsync, SdNestedKeyOf, SdOperator, SdOperatorHasData, SdOperatorNoData, SdOrder, SdPagingReq, SdPagingRes, SdPatternCommon, SdPatternType, SdQueryReq, SdSize, SdUnwrapSafe, SdUnwrapSignal };
+export { DefaultSdIconSet, DefaultSdMaterialIconSet };
+export type { SdIconSet, SdMaterialIconSet, SdUnwrapSafe, SdUnwrapSignal };

package/components/base/index.d.ts

@@ -1,11 +0,0 @@
-import { SdLicenseService } from '@sdcorejs/angular/services/license';
-import * as i0 from '@angular/core';
-
-declare abstract class SdBaseSecureComponent {
-    protected licenseService: SdLicenseService;
-    constructor();
-    static ɵfac: i0.ɵɵFactoryDeclaration<SdBaseSecureComponent, never>;
-    static ɵdir: i0.ɵɵDirectiveDeclaration<SdBaseSecureComponent, never, never, {}, {}, never, never, true, never>;
-}
-
-export { SdBaseSecureComponent };