tin-spa 20.8.1 → 20.8.2

package/fesm2022/tin-spa.mjs

@@ -1,5 +1,5 @@
 import * as i0 from '@angular/core';
-import { Injectable, Inject, Component, InjectionToken, makeEnvironmentProviders, Optional, EventEmitter, Output, Input, inject, ViewChild, Pipe, ViewEncapsulation, Directive, NgModule, forwardRef, HostListener, ContentChild } from '@angular/core';
+import { Injectable, Inject, Component, InjectionToken, makeEnvironmentProviders, Optional, EventEmitter, Output, Input, inject, ViewChild, Pipe, ViewEncapsulation, Directive, NgModule, forwardRef, HostListener, SecurityContext, ContentChild } from '@angular/core';
 import * as i1 from '@angular/material/dialog';
 import { MAT_DIALOG_DATA, MatDialogModule, MAT_DIALOG_DEFAULT_OPTIONS, MatDialog } from '@angular/material/dialog';
 import * as i2 from '@angular/common';
@@ -14,17 +14,17 @@ import { of, BehaviorSubject, Subject, from, throwError, timeout, firstValueFrom
 import { mergeMap, map, tap, catchError, filter, startWith as startWith$1, finalize as finalize$1, take, switchMap as switchMap$1 } from 'rxjs/operators';
 import * as i2$1 from '@angular/material/snack-bar';
 import { MatSnackBarModule } from '@angular/material/snack-bar';
+import Dexie, { liveQuery } from 'dexie';
+import * as i10 from '@azure/msal-angular';
+import { MSAL_INSTANCE, MsalService } from '@azure/msal-angular';
+import { PublicClientApplication, BrowserCacheLocation } from '@azure/msal-browser';
+import * as i1$1 from '@angular/common/http';
+import { HttpHeaders, HttpClientModule, HTTP_INTERCEPTORS, HttpClient } from '@angular/common/http';
 import * as i1$2 from '@angular/router';
 import { NavigationEnd, Router, RouterModule } from '@angular/router';
+import * as signalR from '@microsoft/signalr';
 import * as i2$2 from '@abacritt/angularx-social-login';
 import { SocialLoginModule } from '@abacritt/angularx-social-login';
-import * as i1$1 from '@angular/common/http';
-import { HttpHeaders, HttpClientModule, HTTP_INTERCEPTORS, HttpClient } from '@angular/common/http';
-import * as signalR from '@microsoft/signalr';
-import * as i10 from '@azure/msal-angular';
-import { MSAL_INSTANCE, MsalService } from '@azure/msal-angular';
-import { PublicClientApplication, BrowserCacheLocation } from '@azure/msal-browser';
-import Dexie, { liveQuery } from 'dexie';
 import * as i6$1 from 'ngx-doc-viewer';
 import { NgxDocViewerModule } from 'ngx-doc-viewer';
 import * as i6 from '@angular/material/chips';
@@ -1346,153 +1346,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImpo
                 }]
         }], ctorParameters: () => [] });
 
-class HttpService {
-    constructor(httpClient, router) {
-        this.httpClient = httpClient;
-        this.router = router;
-        //----Set apiUrl from the data service of the project---//
-        this.apiUrl = "https://api.solinc.co.zw/"; //default
-        this.httpOptions_Legacy = {
-            headers: new HttpHeaders({
-                Accept: "application/json",
-                "Content-Type": "application/json",
-                Authorization: "Basic " + btoa("emptyUser:emptyToken"),
-            }),
-            resposeType: "json",
-        };
-        this.httpOptions_Files = {
-            headers: new HttpHeaders({
-                Authorization: "Basic " + btoa("tnyagato:j5Toszfr@ys"),
-            }),
-            resposeType: "json",
-        };
-    }
-    //POST
-    Post(service, data) {
-        return this.httpClient.post(this.apiUrl + service, data, this.httpOptions_Legacy);
-    }
-    //PUT
-    Put(service, data) {
-        return this.httpClient.put(this.apiUrl + service, data, this.httpOptions_Legacy);
-    }
-    //POST RAW
-    Post_Raw(url, data) {
-        return this.httpClient.post(url, data, this.httpOptions_Legacy);
-    }
-    //POST with file
-    Post_WithFile(service, data, file) {
-        let formData = new FormData();
-        if (file) {
-            formData.append("uploadFile", file, file.name);
-        }
-        formData.append("data", JSON.stringify(data));
-        return this.httpClient.post(this.apiUrl + service, formData, this.httpOptions_Files);
-    }
-    //  //POST with files
-    Post_FormData(service, formData) {
-        return this.httpClient.post(this.apiUrl + service, formData, this.httpOptions_Files);
-    }
-    //GET
-    Get(service) {
-        return this.httpClient.get(this.apiUrl + service, this.httpOptions_Legacy);
-    }
-    //Get RAW
-    Get_Raw(url) {
-        return this.httpClient.get(url, this.httpOptions_Legacy);
-    }
-    //ERROR
-    Error(error) {
-        if (error.statusText == "Unauthorized") {
-            this.router.navigate(["login"]);
-            return "Unauthorized";
-        }
-        else {
-            return "Connection failed";
-        }
-    }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: HttpService, deps: [{ token: i1$1.HttpClient }, { token: i1$2.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: HttpService, providedIn: "root" }); }
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: HttpService, decorators: [{
-            type: Injectable,
-            args: [{
-                    providedIn: "root",
-                }]
-        }], ctorParameters: () => [{ type: i1$1.HttpClient }, { type: i1$2.Router }] });
-
-// import { Core } from 'tin-core';
-class LogService {
-    constructor() {
-        this.level = LogLevel.All;
-        this.logToConsole = true;
-        this.logToApi = false;
-    }
-    debug(msg, ...optionalParams) {
-        this.writeToLog(msg, LogLevel.Debug, optionalParams);
-    }
-    info(msg, ...optionalParams) {
-        this.writeToLog(msg, LogLevel.Info, optionalParams);
-    }
-    warn(msg, ...optionalParams) {
-        this.writeToLog(msg, LogLevel.Warn, optionalParams);
-    }
-    error(msg, ...optionalParams) {
-        this.writeToLog(msg, LogLevel.Error, optionalParams);
-    }
-    fatal(msg, ...optionalParams) {
-        this.writeToLog(msg, LogLevel.Fatal, optionalParams);
-    }
-    log(msg, ...optionalParams) {
-        this.writeToLog(msg, LogLevel.All, optionalParams);
-    }
-    writeToLog(msg, level, params) {
-        if (this.shouldLog(level)) {
-            // Build log string
-            let value = Core.getFormatedDate(Date(), false).replace("T", " ");
-            // value += " - Type: " + LogLevel[this.level];
-            value += " - Message: " + msg;
-            if (params.length) {
-                value += " - Extra Info: " + this.formatParams(params);
-            }
-            // Log the value
-            if (this.logToConsole) {
-                console.log(value);
-            }
-            if (this.logToApi) {
-                //Call API post
-            }
-        }
-    }
-    formatParams(params) {
-        let ret = params.join(",");
-        // Is there at least one object in the array?
-        if (params.some((p) => typeof p == "object")) {
-            ret = "";
-            // Build comma-delimited string
-            for (let item of params) {
-                ret += JSON.stringify(item) + ",";
-            }
-        }
-        return ret;
-    }
-    shouldLog(level) {
-        let ret = false;
-        if ((level >= this.level && level !== LogLevel.Off) ||
-            this.level === LogLevel.All) {
-            ret = true;
-        }
-        return ret;
-    }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: LogService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: LogService, providedIn: "root" }); }
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: LogService, decorators: [{
-            type: Injectable,
-            args: [{
-                    providedIn: "root",
-                }]
-        }], ctorParameters: () => [] });
-
 // ───────────────────────────────────────────────────────────────────────────
 // tin-spa runtime configuration
 //
@@ -1578,6 +1431,80 @@ function provideTinSpaRuntime(config) {
     ]);
 }
 
+class HttpService {
+    constructor(httpClient, router) {
+        this.httpClient = httpClient;
+        this.router = router;
+        //----Set apiUrl from the data service of the project---//
+        this.apiUrl = "https://api.solinc.co.zw/"; //default
+        // Changed: removed hardcoded Basic-auth credentials. Authentication is handled centrally by
+        // LoaderInterceptor, which attaches the Bearer token to every request. Embedding a credential here
+        // shipped it in the JS bundle where anyone could recover it.
+        this.httpOptions_Legacy = {
+            headers: new HttpHeaders({
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            }),
+            responseType: "json",
+        };
+        // No Content-Type here — the browser sets the multipart boundary for FormData uploads.
+        this.httpOptions_Files = {
+            responseType: "json",
+        };
+    }
+    //POST
+    Post(service, data) {
+        return this.httpClient.post(this.apiUrl + service, data, this.httpOptions_Legacy);
+    }
+    //PUT
+    Put(service, data) {
+        return this.httpClient.put(this.apiUrl + service, data, this.httpOptions_Legacy);
+    }
+    //POST RAW
+    Post_Raw(url, data) {
+        return this.httpClient.post(url, data, this.httpOptions_Legacy);
+    }
+    //POST with file
+    Post_WithFile(service, data, file) {
+        let formData = new FormData();
+        if (file) {
+            formData.append("uploadFile", file, file.name);
+        }
+        formData.append("data", JSON.stringify(data));
+        return this.httpClient.post(this.apiUrl + service, formData, this.httpOptions_Files);
+    }
+    //  //POST with files
+    Post_FormData(service, formData) {
+        return this.httpClient.post(this.apiUrl + service, formData, this.httpOptions_Files);
+    }
+    //GET
+    Get(service) {
+        return this.httpClient.get(this.apiUrl + service, this.httpOptions_Legacy);
+    }
+    //Get RAW
+    Get_Raw(url) {
+        return this.httpClient.get(url, this.httpOptions_Legacy);
+    }
+    //ERROR
+    Error(error) {
+        if (error.statusText == "Unauthorized") {
+            this.router.navigate(["login"]);
+            return "Unauthorized";
+        }
+        else {
+            return "Connection failed";
+        }
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: HttpService, deps: [{ token: i1$1.HttpClient }, { token: i1$2.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: HttpService, providedIn: "root" }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: HttpService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: "root",
+                }]
+        }], ctorParameters: () => [{ type: i1$1.HttpClient }, { type: i1$2.Router }] });
+
 // Changed: Consolidated SignalR service — single hub connection for both notifications and entity broadcasts
 class SignalRService {
     // Changed: real-time is now driven centrally by tin-spa runtime config (provideTinSpaRuntime).
@@ -1744,946 +1671,1048 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImpo
                     args: [TIN_SPA_RUNTIME_CONFIG]
                 }] }] });
 
-class AuthService {
-    constructor(_route, socialService, storage, router, httpService, messageService, logService, signalRService) {
-        this._route = _route;
-        this.socialService = socialService;
-        this.storage = storage;
-        this.router = router;
+class OfflineService {
+    constructor(httpService, authService, storage, messageService, signalR, zone, runtimeConfig) {
         this.httpService = httpService;
+        this.authService = authService;
+        this.storage = storage;
         this.messageService = messageService;
-        this.logService = logService;
-        this.signalRService = signalRService;
-        this.googleAuthInitialized = false;
-        this.isRefreshing = false; // Changed: Guard to prevent concurrent refresh calls
-        this.refreshTimer = null; // Changed: Proactive token refresh timer
-        this.socialUserSource = new BehaviorSubject(null);
-        this.socialUserObserv = this.socialUserSource.asObservable();
-        //Logged in
-        this.loggedin = false;
-        this.loggedinSource = new BehaviorSubject(this.loggedin);
-        this.loggedinObserv = this.loggedinSource.asObservable();
-        //autoLogin
-        this.autoLogin = false;
-        this.autoLoginSource = new BehaviorSubject(this.autoLogin);
-        this.autoLoginObserv = this.autoLoginSource.asObservable();
-        //Token
-        this.token = "";
-        this.tokenSource = new BehaviorSubject(this.token);
-        this.tokenObserv = this.tokenSource.asObservable();
-        //TokenExpire
-        this.tokenExpire = "";
-        this.tokenExpireSource = new BehaviorSubject(this.tokenExpire);
-        this.tokenExpireObserv = this.tokenExpireSource.asObservable();
-        //Current User
-        this.currentUser = "tnyagato";
-        this.currentUserSource = new BehaviorSubject(this.currentUser);
-        this.currentUserObserv = this.currentUserSource.asObservable();
-        //Line Manager
-        this.islineManager = false;
-        this.isLineManagerSource = new BehaviorSubject(this.islineManager);
-        this.isLineManagerObserv = this.isLineManagerSource.asObservable();
-        //Roles
-        this.currentRole = new Role;
-        this.currentRoleSource = new BehaviorSubject(this.currentRole);
-        this.myRoleObserv = this.currentRoleSource.asObservable();
-        //Logged in FirstName
-        this.loggedUserSource = new BehaviorSubject("tnyagato");
-        this.loggedUserFullName = this.loggedUserSource.asObservable();
-        //TenantName
-        this.tenantNameSource = new BehaviorSubject("Tenant Name");
-        this.tenantNameObserv = this.tenantNameSource.asObservable();
-        this.initializeGoogleAuth();
-        this.initVisibilityRefresh(); // Changed: Refresh token when tab becomes visible after being hidden
+        this.signalR = signalR;
+        this.zone = zone;
+        this.runtimeConfig = runtimeConfig;
+        //================ Connectivity (public) ================
+        this.online$ = new BehaviorSubject(typeof navigator === 'undefined' ? true : navigator.onLine);
+        // Entities whose ops synced in the last drain — tables listen to refetch (push-then-pull)
+        this.drained$ = new Subject();
+        //---------------- Dexie ----------------
+        this.db = null;
+        //---------------- Registry ----------------
+        this.entries = new Map();
+        this.readUrls = new Map();
+        this.readPrefixes = [];
+        this.registered$ = new BehaviorSubject(false);
+        //---------------- Runtime flags ----------------
+        this.connectivityStarted = false;
+        this.syncStarted = false;
+        this.draining = false;
+        this.backoffTimer = null;
+        this.periodicTimer = null;
+        this.recoveryTimer = null;
     }
-    initializeGoogleAuth() {
-        if (this.googleAuthInitialized) {
-            return;
-        }
-        this.googleAuthInitialized = true;
-        this.socialService.authState.subscribe({
-            next: (socialUser) => {
-                this.socialUserSource.next(socialUser);
-            },
-            error: (error) => {
-                console.debug('Google Sign-In initialization error (expected if not using Google auth):', error?.message);
-            }
-        });
+    /** App-level gate: offline capability only runs when the app opts in via provideTinSpaRuntime({ offline: true }).
+     *  When off, register()/ensureConnectivity() no-op, so a consumer that never uses offline runs none of this. */
+    get enabled() { return !!this.runtimeConfig?.offline; }
+    get hasAny() { return this.entries.size > 0; }
+    get online() { return this.online$.value; }
+    //================ Sync page view ================
+    // Live, display-ready outbox rows (summary + status label projected on) for the sync page's spa-table.
+    outboxView$() {
+        return this.activeOps$().pipe(map(ops => ops.map(op => ({ ...op, summary: this.summarize(op), statusLabel: this.statusLabel(op) }))));
     }
-    // Changed: Enhanced clearSession with optional server-side revocation
-    clearSession(revokeOnServer = false) {
-        if (revokeOnServer) {
-            // Changed: Revoke only this device's refresh token — other devices keep their sessions
-            const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
-            if (refreshToken) {
-                this.httpService.Post('User/revoke', { refreshToken }).subscribe({
-                    error: () => { } // Silently ignore errors during logout
-                });
-            }
-        }
-        if (this.refreshTimer) {
-            clearTimeout(this.refreshTimer);
-            this.refreshTimer = null;
-        } // Changed: Cancel proactive refresh timer
-        this.signalRService.stopConnection(); // Changed: Stop consolidated SignalR connection before clearing session
-        this.Updateloggedin(false);
-        this.UpdateAutoLogin(false);
-        this.UpdateRole(new Role());
-        this.UpdateToken(''); // Changed: Clear in-memory token
-        this.UpdateTokenExpire(''); // Changed: Clear in-memory token expiry
-        if (revokeOnServer) {
-            this.storage.clearAll(); // Changed: Full logout clears everything including refresh token
+    summarize(op) {
+        const p = op.payload ?? {};
+        if (typeof p.name === 'string' && p.name)
+            return p.name;
+        const firstString = Object.keys(p).map(k => p[k]).find(v => typeof v === 'string' && v.length > 0 && v.length < 60);
+        return firstString ?? (op.targetId != null ? `#${op.targetId}` : 'new record');
+    }
+    statusLabel(op) {
+        switch (op.status) {
+            case 'failed': return 'Failed';
+            case 'conflict': return 'Conflict';
+            case 'stale': return 'Held';
+            case 'syncing': return 'Sending';
+            default: return 'Pending';
         }
-        else {
-            this.storage.clearSessionData(); // Changed: Session expired — preserve refresh token for "remember me"
+    }
+    //================ Registry ================
+    // Called from TableComponent when a config with `offline` initializes; idempotent per entity
+    register(config) {
+        if (!this.enabled)
+            return null; // app-level gate: ignore per-table offline flags when the app didn't opt in
+        const resolved = this.resolveConfig(config.offline);
+        if (!resolved || !config.loadAction?.url)
+            return null;
+        const entity = config.loadAction.url.split('/')[0].split('?')[0];
+        const existing = this.entries.get(entity);
+        if (existing) {
+            this.startSync();
+            return existing;
         }
-        this.socialService.signOut();
+        const entry = {
+            entity,
+            entityName: config.entityName ?? entity,
+            idField: (config.formConfig?.heroField ?? config.heroField ?? entity.replace(/s$/, '') + 'ID'),
+            config: resolved,
+        };
+        this.entries.set(entity, entry);
+        if (!this.registered$.value)
+            this.registered$.next(true);
+        this.readUrls.set(config.loadAction.url, entry);
+        if (config.countAction?.url)
+            this.readUrls.set(config.countAction.url, entry);
+        if (config.formConfig?.loadAction?.url)
+            this.readPrefixes.push({ prefix: config.formConfig.loadAction.url + '/', entry });
+        this.registerLookups(config.formConfig, entry);
+        this.startSync();
+        return entry;
     }
-    sessionExpired() {
-        this.clearSession(false); // Changed: Don't revoke on server, token just expired
-        let url = new URL(window.location.href);
-        let path = url.hash.replace("#/", "");
-        this.router.navigate(["login"], {
-            relativeTo: this._route,
-            queryParams: { redirectTo: path },
-            queryParamsHandling: 'merge',
-            skipLocationChange: false
+    registerLookups(formConfig, entry, depth = 0) {
+        if (!formConfig?.fields || depth > 1)
+            return;
+        const allow = entry.config.cacheLookups;
+        if (allow === false)
+            return;
+        formConfig.fields.forEach((field) => {
+            const url = field.loadAction?.url;
+            if (url && (allow === true || (Array.isArray(allow) && allow.includes(url)))) {
+                if (!this.readUrls.has(url))
+                    this.readUrls.set(url, entry);
+            }
+            if (field.detailsConfig?.formConfig)
+                this.registerLookups(field.detailsConfig.formConfig, entry, depth + 1);
         });
     }
-    logoff() {
-        this.clearSession(true); // Changed: Revoke refresh tokens on explicit logout
-        this.router.navigate(["login"]);
-    }
-    Updateloggedin(loggedin) {
-        this.loggedinSource.next(loggedin);
-        this.loggedin = loggedin;
-    }
-    UpdateAutoLogin(autoLogin) {
-        this.autoLoginSource.next(autoLogin);
-        this.autoLogin = autoLogin;
-    }
-    UpdateToken(newToken) {
-        this.tokenSource.next(newToken);
-    }
-    UpdateTokenExpire(newTokenExpire) {
-        this.tokenExpireSource.next(newTokenExpire);
-    }
-    UpdateCurrentUser(newUser) {
-        this.currentUserSource.next(newUser.toLocaleLowerCase());
-        this.currentUser = newUser.toLocaleLowerCase();
-    }
-    UpdateIsLineManager(manager) {
-        this.isLineManagerSource.next(manager);
+    matchRead(url) {
+        if (!this.hasAny)
+            return null;
+        const exact = this.readUrls.get(url);
+        if (exact)
+            return exact;
+        const prefixed = this.readPrefixes.find(p => url.startsWith(p.prefix));
+        return prefixed ? prefixed.entry : null;
     }
-    UpdateRole(role) {
-        this.currentRoleSource.next(role);
+    matchMutation(url) {
+        if (!this.hasAny)
+            return null;
+        const match = url.match(/^([^?/]+)\?action=(create|edit|delete)$/);
+        if (!match)
+            return null;
+        const entry = this.entries.get(match[1]);
+        if (!entry)
+            return null;
+        return entry.config.queue[match[2]] ? entry : null;
     }
-    updateLoggedUserFullName(userName) {
-        this.loggedUserSource.next(userName);
+    // Interceptor seam: suppress the 'Connection Error' toast for URLs the offline layer handles (plus the heartbeat)
+    suppressesUrl(absoluteUrl) {
+        const relative = absoluteUrl.startsWith(this.httpService.apiUrl) ? absoluteUrl.substring(this.httpService.apiUrl.length) : absoluteUrl;
+        if (relative === 'ping')
+            return true;
+        if (!this.hasAny)
+            return false;
+        return !!(this.matchRead(relative) || this.matchMutation(relative));
     }
-    updateTenantName(tenantName) {
-        this.tenantNameSource.next(tenantName);
+    resolveConfig(offline) {
+        if (!offline)
+            return null;
+        const cfg = offline === true ? { enabled: true } : offline;
+        if (!cfg.enabled)
+            return null;
+        return {
+            enabled: true,
+            cacheRows: cfg.cacheRows ?? 500,
+            cacheLookups: cfg.cacheLookups ?? true,
+            lookupMaxAgeHours: cfg.lookupMaxAgeHours ?? 72,
+            queue: cfg.readOnly
+                ? { create: false, edit: false, delete: false }
+                : { create: cfg.queue?.create ?? true, edit: cfg.queue?.edit ?? true, delete: cfg.queue?.delete ?? false },
+            maxQueueAgeHours: cfg.maxQueueAgeHours ?? 72,
+            readOnly: cfg.readOnly ?? false,
+        };
     }
-    //Authorisation
-    isAuthorised(capName) {
-        if (!this.currentRoleSource.value[capName]) {
-            // this.logService.info(`authorise: ${this.currentRoleSource.value.roleName} not authorised for ${capName}`);
-            this.router.navigate(["home"]);
-            this.messageService.toast(`Unauthorised: ${capName}`);
-            return false;
+    //================ Store (Dexie) ================
+    // Added: wipe all locally cached records + pending outbox for the current user. Called on explicit logout
+    // so a shared device does not retain the previous user's business data in IndexedDB after they sign out.
+    async deleteLocalData() {
+        try {
+            if (this.db) {
+                const db = this.db;
+                this.db = null;
+                db.close();
+                await db.delete();
+                return;
+            }
+            // Not currently open — best-effort delete by recomputing this user's db name.
+            const tenant = this.storage.getPersistent(Constants.AUTH_TENANT_NAME) || 'default';
+            const user = this.authService.currentUser || 'anon';
+            const name = `tinspa_offline_${this.hash(this.httpService.apiUrl)}_${this.sanitize(tenant)}_${this.sanitize(user)}`;
+            await Dexie.delete(name);
         }
-        else {
-            return true;
+        catch (e) {
+            console.warn('Offline data wipe failed', e);
         }
     }
-    // Changed: Pure validation — no side effects. Callers handle refresh/redirect.
-    isValidToken() {
-        let tokenExpire = new Date(this.tokenExpireSource.value);
-        let nowDate = new Date();
-        return tokenExpire > nowDate;
-    }
-    // Changed: Centralized handler for storing all auth data from login/refresh response
-    applyLoginResponse(data, rememberMe) {
-        // Set storage mode: sessionStorage when not remembered, localStorage when remembered
-        this.storage.setSessionMode(!rememberMe);
-        // Store remember-me flag persistently (survives browser close)
-        this.storage.storePersistent(Constants.AUTH_REMEMBER_ME, rememberMe);
-        // Update in-memory state
-        this.Updateloggedin(true);
-        this.UpdateToken(data.token);
-        this.UpdateTokenExpire(data.expiration);
-        this.signalRService.updateToken(data.token); // Changed: Keep SignalR reconnection token in sync
-        this.UpdateRole(data.role);
-        this.updateLoggedUserFullName(data.firstName);
-        this.updateTenantName(data.tenantName);
-        if (data.userName)
-            this.UpdateCurrentUser(data.userName); // Changed: Restore username after silent refresh
-        // Store session data in active storage
-        this.storage.store(Constants.AUTH_TOKEN, data.token);
-        this.storage.store(Constants.AUTH_TOKEN_EXPIRE, data.expiration);
-        this.storage.store(Constants.AUTH_ROLES, JSON.stringify(data.role));
-        this.storage.store(Constants.AUTH_NAME, data.firstName);
-        this.storage.store(Constants.AUTH_TENANT_NAME, data.tenantName);
-        if (data.userName)
-            this.storage.store(Constants.AUTH_USER, data.userName); // Changed: Persist username so checkAuthentication finds AUTH_USER after app restart
-        // Store refresh token persistently if provided (always in localStorage)
-        if (data.refreshToken) {
-            this.storage.storePersistent(Constants.AUTH_REFRESH_TOKEN, data.refreshToken);
-            this.storage.storePersistent(Constants.AUTH_REFRESH_TOKEN_EXPIRE, data.refreshTokenExpiry);
+    ensureOpen() {
+        if (this.db)
+            return this.db;
+        const tenant = this.storage.getPersistent(Constants.AUTH_TENANT_NAME) || 'default';
+        const user = this.authService.currentUser || 'anon';
+        const name = `tinspa_offline_${this.hash(this.httpService.apiUrl)}_${this.sanitize(tenant)}_${this.sanitize(user)}`;
+        const db = new Dexie(name);
+        db.version(1).stores({ reads: '&url, entity', outbox: '++seq, opId, entity, status, clientRef', meta: '&key' });
+        this.db = db;
+        this.reads = db.table('reads');
+        this.outbox = db.table('outbox');
+        this.meta = db.table('meta');
+        try {
+            navigator.storage?.persist?.();
         }
-        this.scheduleTokenRefresh(data.expiration); // Changed: Schedule proactive refresh before token expires
+        catch { }
+        this.meta.put({ key: 'sentinel', value: Date.now() }).catch(() => { });
+        return db;
     }
-    // Changed: Schedule a silent refresh 5 minutes before the access token expires
-    scheduleTokenRefresh(expiration) {
-        if (this.refreshTimer)
-            clearTimeout(this.refreshTimer); // Clear any existing timer
-        const expiresAt = new Date(expiration).getTime();
-        const now = Date.now();
-        const refreshIn = expiresAt - now - (5 * 60 * 1000); // 5 minutes before expiry
-        if (refreshIn <= 0)
-            return; // Token already expired or about to — reactive refresh will handle it
-        this.refreshTimer = setTimeout(() => {
-            this.silentRefresh().then(success => {
-                if (!success)
-                    this.sessionExpired();
-            });
-        }, refreshIn);
+    putRead(url, entity, data, maxRows) {
+        this.ensureOpen();
+        let stored = data;
+        if (Array.isArray(data))
+            stored = data.slice(0, url.includes('/list/') ? 1000 : maxRows);
+        return this.reads.put({ url, entity, data: stored, savedAt: Date.now() }).catch(err => console.warn('Offline cache write failed', err));
     }
-    // Changed: When tab becomes visible, check if token needs immediate refresh
-    initVisibilityRefresh() {
-        document.addEventListener('visibilitychange', () => {
-            if (document.visibilityState !== 'visible')
-                return;
-            if (!this.loggedin)
-                return;
-            const expire = this.tokenExpireSource.value;
-            if (!expire)
-                return;
-            const expiresAt = new Date(expire).getTime();
-            const now = Date.now();
-            const minutesLeft = (expiresAt - now) / 60000;
-            // If token expires in less than 10 minutes or is already expired, refresh immediately
-            if (minutesLeft < 10 && this.hasRefreshToken()) {
-                this.silentRefresh().then(success => {
-                    if (!success)
-                        this.sessionExpired();
-                });
+    getRead(url) {
+        this.ensureOpen();
+        try {
+            return this.reads.get(url).catch(() => undefined);
+        }
+        catch {
+            return Promise.resolve(undefined);
+        }
+    }
+    //================ CallApi seam helpers (called by DataServiceLib) ================
+    // Reads: network-first with write-through; on verified-offline or network failure serve the cached copy.
+    handleOfflineRead(action, entry, networkCall) {
+        const serveCache = () => from(this.serveCachedRead(action.url)).pipe(map(result => result
+            ? { success: true, message: 'success', data: result }
+            : { success: false, message: 'No offline data available yet for this view', data: null }));
+        if (!this.online)
+            return serveCache();
+        return networkCall().pipe(tap((response) => {
+            if (response.success && response?.data)
+                this.putRead(action.url, entry.entity, response.data, entry.config.cacheRows);
+        }), catchError((err) => {
+            if (err?.status === 0) {
+                this.reportNetworkFailure();
+                return serveCache();
             }
-        });
+            return throwError(() => err);
+        }));
     }
-    // Changed: Non-destructive check — only returns true if token is genuinely valid (not expired)
-    hasValidSession() {
-        // Check in-memory state first
-        if (this.loggedin && this.tokenExpireSource.value) {
-            const tokenExpire = new Date(this.tokenExpireSource.value);
-            if (tokenExpire > new Date())
-                return true;
+    // For '/list/' lookups, append pending offline creates as selectable 'cref:' options so offline forms can reference not-yet-synced parents
+    async serveCachedRead(url) {
+        const saved = await this.getRead(url);
+        let data = saved?.data ?? null;
+        const listMatch = url.match(/^([^?/]+)\/list\//);
+        if (listMatch) {
+            const creates = await this.pendingCreates(listMatch[1]);
+            if (creates.length) {
+                const opts = creates.map(op => ({ name: `${op.payload?.name ?? 'New'} (pending)`, value: 'cref:' + op.clientRef }));
+                data = Array.isArray(data) ? [...opts, ...data] : opts;
+            }
         }
-        // Changed: Check localStorage for non-expired token (not just existence)
-        const localExpiry = localStorage.getItem(Constants.AUTH_TOKEN_EXPIRE);
-        if (localExpiry) {
-            try {
-                const expiry = new Date(JSON.parse(unescape(atob(localExpiry))));
-                if (expiry > new Date())
-                    return true;
+        return data;
+    }
+    // Persists a mutation and synthesizes a success ApiResponse so the existing dialog/refresh machinery works unchanged
+    enqueueOffline(action, data, entry) {
+        return from(this.enqueueMutation(action, data, entry)).pipe(map(op => ({
+            success: true,
+            message: 'Saved offline — will be sent when connection is restored',
+            data: op ? { ...op.payload, _offline: { status: op.status, opId: op.opId, clientRef: op.clientRef ?? op.targetClientRef } } : data,
+        })), catchError((err) => of({ success: false, message: 'Could not save offline: ' + (err?.message ?? 'storage error'), data: null })));
+    }
+    //================ Outbox writes ================
+    async enqueueMutation(action, data, entry) {
+        this.ensureOpen();
+        const opAction = this.parseAction(action.url);
+        if (!opAction)
+            throw new Error('Unsupported offline mutation: ' + action.url);
+        const payload = { ...data };
+        const marker = payload._offline;
+        delete payload._offline;
+        const refMap = {};
+        Object.keys(payload).forEach(k => {
+            if (typeof payload[k] === 'string' && payload[k].startsWith('cref:')) {
+                refMap[k] = payload[k].substring(5);
+                payload[k] = 0;
+            }
+        });
+        const userId = this.authService.currentUser || 'anon';
+        if (opAction === 'edit' && marker?.clientRef) {
+            const createOp = await this.outbox.where('clientRef').equals(marker.clientRef).first();
+            if (createOp && createOp.status !== 'synced') {
+                createOp.payload = { ...createOp.payload, ...payload, clientRef: createOp.clientRef };
+                createOp.refMap = { ...createOp.refMap, ...refMap };
+                await this.outbox.put(createOp);
+                return createOp;
             }
-            catch { /* ignore parse errors */ }
         }
-        // Changed: Check sessionStorage for non-expired token
-        const sessionExpiry = sessionStorage.getItem(Constants.AUTH_TOKEN_EXPIRE);
-        if (sessionExpiry) {
-            try {
-                const expiry = new Date(JSON.parse(unescape(atob(sessionExpiry))));
-                if (expiry > new Date())
-                    return true;
+        if (opAction === 'delete' && marker?.clientRef) {
+            const createOp = await this.outbox.where('clientRef').equals(marker.clientRef).first();
+            if (createOp && createOp.status !== 'synced') {
+                await this.outbox.delete(createOp.seq);
+                return null;
             }
-            catch { /* ignore parse errors */ }
         }
-        // Changed: Refresh token alone does NOT count as valid session — caller must handle refresh separately
-        return false;
+        const targetId = opAction === 'create' ? undefined : payload[entry.idField];
+        if (opAction === 'edit' && targetId !== undefined) {
+            const existing = await this.outbox.where('entity').equals(entry.entity)
+                .and(op => op.opAction === 'edit' && op.targetId === targetId && (op.status === 'pending' || op.status === 'failed')).first();
+            if (existing) {
+                existing.payload = payload;
+                existing.refMap = { ...existing.refMap, ...refMap };
+                existing.status = 'pending';
+                await this.outbox.put(existing);
+                return existing;
+            }
+        }
+        const op = {
+            opId: crypto.randomUUID(), entity: entry.entity, entityName: entry.entityName, url: action.url, opAction, payload, targetId,
+            targetClientRef: marker?.clientRef, refMap: Object.keys(refMap).length ? refMap : undefined,
+            status: 'pending', attempts: 0, maxAgeHours: entry.config.maxQueueAgeHours, userId, enqueuedAt: Date.now(),
+        };
+        if (opAction === 'create') {
+            op.clientRef = crypto.randomUUID();
+            op.payload = { ...payload, clientRef: op.clientRef };
+        }
+        await this.outbox.add(op);
+        return op;
     }
-    // Changed: Check if a refresh token exists (for login page to attempt silent refresh)
-    hasRefreshToken() {
-        const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
-        return refreshToken !== null;
+    //================ Live streams (cross-tab reactive) ================
+    pendingOpsFor$(entity) {
+        this.ensureOpen();
+        return from(liveQuery(() => this.outbox.where('entity').equals(entity).and(op => op.status !== 'synced').sortBy('seq')));
     }
-    // Shared entry point for any page that needs to auto-redirect authenticated users
-    // Returns true if session is active or was successfully restored via silent refresh
-    async tryRestoreSession() {
-        if (this.hasValidSession())
-            return true;
-        if (this.hasRefreshToken())
-            return await this.silentRefresh();
-        return false;
+    activeOps$() {
+        this.ensureOpen();
+        return from(liveQuery(() => this.outbox.filter(op => op.status !== 'synced').sortBy('seq')));
     }
-    // Changed: Silently refresh the JWT using the stored refresh token
-    silentRefresh() {
-        if (this.isRefreshing)
-            return Promise.resolve(false); // Prevent concurrent refreshes
-        this.isRefreshing = true;
-        const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
-        if (!refreshToken) {
-            this.isRefreshing = false;
-            return Promise.resolve(false);
+    pendingCreates(entity) {
+        this.ensureOpen();
+        return this.outbox.where('entity').equals(entity).and(op => op.opAction === 'create' && op.status !== 'synced').sortBy('seq');
+    }
+    hasPending() {
+        this.ensureOpen();
+        return this.outbox.where('status').equals('pending').count().then(c => c > 0);
+    }
+    //================ Connectivity ================
+    // Started by the sync engine (offline table registered) OR by the toolbar indicator (to show a status light).
+    // Uses SignalR's hub connection as the instant online signal when real-time is enabled; ping is the fallback/source of truth.
+    ensureConnectivity() {
+        if (!this.enabled)
+            return; // app-level gate: no pinging/SignalR-watching when offline capability is off
+        if (this.connectivityStarted)
+            return;
+        this.connectivityStarted = true;
+        if (typeof window !== 'undefined') {
+            window.addEventListener('offline', () => this.zone.run(() => this.setOffline()));
+            window.addEventListener('online', () => this.zone.run(() => this.verify()));
         }
-        return new Promise((resolve) => {
-            this.httpService.Post('User/refresh', { refreshToken }).subscribe({
-                next: (response) => {
-                    this.isRefreshing = false;
-                    if (response.success) {
-                        const rememberMe = this.storage.getPersistent(Constants.AUTH_REMEMBER_ME) ?? true;
-                        this.applyLoginResponse(response.data, rememberMe);
-                        resolve(true);
-                    }
-                    else {
-                        // Changed: Server explicitly rejected the token (revoked/expired) — safe to clear
-                        const currentToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
-                        if (currentToken === refreshToken) {
-                            this.storage.removePersistent(Constants.AUTH_REFRESH_TOKEN);
-                            this.storage.removePersistent(Constants.AUTH_REFRESH_TOKEN_EXPIRE);
-                            this.storage.removePersistent(Constants.AUTH_REMEMBER_ME);
-                        }
-                        resolve(false);
-                    }
-                },
-                error: () => {
-                    this.isRefreshing = false;
-                    // Changed: Network error (device waking up, no connectivity) — do NOT clear the refresh token.
-                    // The token may still be valid; next visibility change or 401 interceptor will retry.
-                    resolve(false);
-                }
-            });
+        // SignalR hub state: connected => instantly online (+drain); disconnected => confirm via ping before declaring offline.
+        // When real-time is disabled the hub never connects, so this stays false and ping fully drives connectivity.
+        this.signalR.dataHubConnected$.subscribe(connected => this.zone.run(() => connected ? this.setOnline() : this.verify()));
+        this.verify();
+    }
+    reportNetworkFailure() { if (this.connectivityStarted)
+        this.setOffline(); }
+    verify() {
+        this.httpService.Get('ping').pipe(timeout(5000)).subscribe({
+            next: () => this.setOnline(),
+            error: (err) => { if (err?.status > 0)
+                this.setOnline();
+            else
+                this.setOffline(); },
         });
     }
-    // Changed: Returns Promise<boolean> to properly await refresh instead of optimistically returning true
-    checkAuthentication() {
-        if (this.loggedin && this.isValidToken()) {
-            return Promise.resolve(true);
+    setOnline() {
+        this.stopRecoveryPolling();
+        if (!this.online$.value) {
+            this.online$.next(true);
+            if (this.syncStarted)
+                setTimeout(() => this.drain(), Math.floor(Math.random() * 5000)); // jittered so a reconnecting fleet doesn't stampede
         }
-        // Changed: Restore storage mode from persistent remember-me flag
-        const rememberMe = this.storage.getPersistent(Constants.AUTH_REMEMBER_ME);
-        if (rememberMe !== null) {
-            this.storage.setSessionMode(!rememberMe);
+        // Marry the two: whenever ping confirms we're reachable, revive SignalR if its own auto-reconnect gave up.
+        // No-op when the hub is already connected, so this is safe to call on every online confirmation.
+        this.signalR.reconnectIfNeeded();
+    }
+    setOffline() {
+        if (this.online$.value)
+            this.online$.next(false);
+        this.startRecoveryPolling();
+    }
+    startRecoveryPolling() {
+        if (this.recoveryTimer || !this.connectivityStarted)
+            return;
+        this.recoveryTimer = setInterval(() => this.verify(), 30000); // safety net; SignalR reconnect usually beats this when real-time is on
+    }
+    stopRecoveryPolling() {
+        if (this.recoveryTimer) {
+            clearInterval(this.recoveryTimer);
+            this.recoveryTimer = null;
         }
-        if (this.storage.hasKey(Constants.AUTH_USER)) {
-            this.Updateloggedin(true);
-            this.storage.get(Constants.AUTH_USER).then((resp) => {
-                this.UpdateCurrentUser(resp);
-            });
-            this.storage.get(Constants.AUTH_NAME).then((resp) => {
-                this.updateLoggedUserFullName(resp);
-            });
-            this.storage.get(Constants.AUTH_ROLES).then((resp) => {
-                let ret = JSON.parse(resp);
-                this.UpdateRole(ret);
-            });
-            this.storage.get(Constants.AUTH_TENANT_NAME).then((resp) => {
-                this.updateTenantName(resp);
-            });
-            // Changed: Load token and check validity — if expired, await silentRefresh before allowing navigation
-            return this.storage.get(Constants.AUTH_TOKEN).then((token) => {
-                this.UpdateToken(token);
-                return this.storage.get(Constants.AUTH_TOKEN_EXPIRE);
-            }).then((expire) => {
-                this.UpdateTokenExpire(expire);
-                const tokenExpire = new Date(expire);
-                if (tokenExpire > new Date()) {
-                    return true; // Token still valid
-                }
-                // Token expired — attempt silent refresh and wait for result
-                const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
-                if (refreshToken) {
-                    return this.silentRefresh().then((success) => {
-                        if (!success) {
-                            this.sessionExpired();
-                        }
-                        return success;
-                    });
-                }
-                this.sessionExpired();
-                return false;
-            });
+    }
+    //================ Sync engine ================
+    startSync() {
+        if (this.syncStarted)
+            return;
+        this.syncStarted = true;
+        this.ensureConnectivity();
+        this.resetOrphans().catch(() => { });
+        this.periodicTimer = setInterval(() => { if (this.online)
+            this.hasPending().then(has => { if (has)
+                this.drain(); }); }, 60000);
+        if (this.online)
+            this.drain();
+    }
+    async drain() {
+        if (this.draining || !this.online)
+            return;
+        this.draining = true;
+        const runner = () => this.drainLoop().finally(() => { this.draining = false; });
+        const locks = navigator.locks;
+        if (locks?.request) {
+            try {
+                await locks.request('tinspa-outbox-drain', { ifAvailable: true }, async (lock) => { if (lock)
+                    await runner();
+                else
+                    this.draining = false; });
+            }
+            catch {
+                await runner();
+            }
         }
-        // Changed: Check for persistent refresh token when no session data exists
-        const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
-        if (refreshToken) {
-            // Changed: Wait for refresh to complete before deciding
-            return this.silentRefresh().then((success) => {
-                if (!success) {
-                    this.sessionExpired();
-                }
-                return success;
-            });
+        else {
+            await runner();
         }
-        this.sessionExpired();
-        return Promise.resolve(false);
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: AuthService, deps: [{ token: i1$2.ActivatedRoute }, { token: i2$2.SocialAuthService }, { token: StorageService }, { token: i1$2.Router }, { token: HttpService }, { token: MessageService }, { token: LogService }, { token: SignalRService }], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: AuthService, providedIn: 'root' }); }
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: AuthService, decorators: [{
-            type: Injectable,
-            args: [{
-                    providedIn: 'root'
-                }]
-        }], ctorParameters: () => [{ type: i1$2.ActivatedRoute }, { type: i2$2.SocialAuthService }, { type: StorageService }, { type: i1$2.Router }, { type: HttpService }, { type: MessageService }, { type: LogService }, { type: SignalRService }] });
-
-class OfflineService {
-    constructor(httpService, authService, storage, messageService, signalR, zone, runtimeConfig) {
-        this.httpService = httpService;
-        this.authService = authService;
-        this.storage = storage;
-        this.messageService = messageService;
-        this.signalR = signalR;
-        this.zone = zone;
-        this.runtimeConfig = runtimeConfig;
-        //================ Connectivity (public) ================
-        this.online$ = new BehaviorSubject(typeof navigator === 'undefined' ? true : navigator.onLine);
-        // Entities whose ops synced in the last drain — tables listen to refetch (push-then-pull)
-        this.drained$ = new Subject();
-        //---------------- Dexie ----------------
-        this.db = null;
-        //---------------- Registry ----------------
-        this.entries = new Map();
-        this.readUrls = new Map();
-        this.readPrefixes = [];
-        this.registered$ = new BehaviorSubject(false);
-        //---------------- Runtime flags ----------------
-        this.connectivityStarted = false;
-        this.syncStarted = false;
-        this.draining = false;
-        this.backoffTimer = null;
-        this.periodicTimer = null;
-        this.recoveryTimer = null;
+    async drainLoop() {
+        const syncedEntities = new Set();
+        while (true) {
+            const op = await this.nextAutoOp();
+            if (!op)
+                break;
+            op.status = 'syncing';
+            await this.outbox.put(op); // persisted BEFORE network I/O — crash recovery reverts to pending
+            const outcome = await this.sendOp(op);
+            if (outcome === 'transient') {
+                op.status = 'pending';
+                op.attempts++;
+                await this.outbox.put(op);
+                this.scheduleBackoff(op.attempts);
+                break; // strict FIFO: a transient failure halts the drain until backoff/reconnect
+            }
+            if (outcome === 'synced')
+                syncedEntities.add(op.entity);
+            if (outcome === 'failed') {
+                this.messageService.toast(`Sync failed: ${op.entityName} ${op.opAction} — open the sync tray to review`);
+                if (op.clientRef)
+                    await this.cascadeFailure(op.clientRef, `${op.entityName} ${op.opAction} failed`);
+            }
+            if (outcome === 'conflict')
+                this.messageService.toast(`Sync conflict: ${op.entityName} changed on the server — review in the sync tray`);
+        }
+        if (syncedEntities.size > 0) {
+            this.drained$.next(Array.from(syncedEntities));
+            this.messageService.toast('Offline changes synced');
+        }
     }
-    /** App-level gate: offline capability only runs when the app opts in via provideTinSpaRuntime({ offline: true }).
-     *  When off, register()/ensureConnectivity() no-op, so a consumer that never uses offline runs none of this. */
-    get enabled() { return !!this.runtimeConfig?.offline; }
-    get hasAny() { return this.entries.size > 0; }
-    get online() { return this.online$.value; }
-    //================ Sync page view ================
-    // Live, display-ready outbox rows (summary + status label projected on) for the sync page's spa-table.
-    outboxView$() {
-        return this.activeOps$().pipe(map(ops => ops.map(op => ({ ...op, summary: this.summarize(op), statusLabel: this.statusLabel(op) }))));
+    async sendOp(op) {
+        const payload = { ...op.payload };
+        if (op.refMap && Object.keys(op.refMap).length)
+            payload.clientRefs = JSON.stringify(op.refMap); // server resolves parent ClientRef -> real int FK
+        let response;
+        try {
+            response = await firstValueFrom(this.httpService.Post(op.url, payload));
+        }
+        catch (err) {
+            const status = err?.status ?? 0;
+            if (status === 0 || status === 408 || status === 429 || status >= 500) {
+                if (status === 0)
+                    this.reportNetworkFailure();
+                return 'transient';
+            }
+            return this.finishOp(op, 'failed', err?.message ?? `HTTP ${status}`);
+        }
+        if (response.success)
+            return this.finishOp(op, 'synced');
+        const reason = response.reason ?? '';
+        const notFound = reason === 'not_found' || response.message?.includes('not found');
+        if (reason === 'conflict') {
+            op.serverRecord = response.data ?? null;
+            return this.finishOp(op, 'conflict', response.message);
+        }
+        if (notFound && op.opAction === 'delete')
+            return this.finishOp(op, 'synced'); // delete of already-deleted row — outcome achieved
+        if (notFound && op.opAction === 'edit')
+            return this.finishOp(op, 'conflict', 'This record was deleted on the server');
+        return this.finishOp(op, 'failed', response.message); // validation/business failure — permanent
     }
-    summarize(op) {
-        const p = op.payload ?? {};
-        if (typeof p.name === 'string' && p.name)
-            return p.name;
-        const firstString = Object.keys(p).map(k => p[k]).find(v => typeof v === 'string' && v.length > 0 && v.length < 60);
-        return firstString ?? (op.targetId != null ? `#${op.targetId}` : 'new record');
+    async finishOp(op, status, error) {
+        op.status = status;
+        op.lastError = error;
+        if (status === 'synced')
+            op.syncedAt = Date.now();
+        await this.outbox.put(op);
+        return status;
     }
-    statusLabel(op) {
-        switch (op.status) {
-            case 'failed': return 'Failed';
-            case 'conflict': return 'Conflict';
-            case 'stale': return 'Held';
-            case 'syncing': return 'Sending';
-            default: return 'Pending';
+    async nextAutoOp() {
+        this.ensureOpen();
+        const ops = await this.outbox.orderBy('seq').filter(op => op.status === 'pending').toArray();
+        for (const op of ops) {
+            if (Date.now() - op.enqueuedAt > op.maxAgeHours * 3600 * 1000) {
+                op.status = 'stale';
+                op.lastError = 'Held — too old to send automatically';
+                await this.outbox.put(op);
+                continue;
+            }
+            return op;
         }
+        return undefined;
     }
-    //================ Registry ================
-    // Called from TableComponent when a config with `offline` initializes; idempotent per entity
-    register(config) {
-        if (!this.enabled)
-            return null; // app-level gate: ignore per-table offline flags when the app didn't opt in
-        const resolved = this.resolveConfig(config.offline);
-        if (!resolved || !config.loadAction?.url)
-            return null;
-        const entity = config.loadAction.url.split('/')[0].split('?')[0];
-        const existing = this.entries.get(entity);
-        if (existing) {
-            this.startSync();
-            return existing;
+    async resetOrphans() {
+        this.ensureOpen();
+        const orphans = await this.outbox.where('status').equals('syncing').toArray();
+        for (const op of orphans) {
+            op.status = 'pending';
+            await this.outbox.put(op);
+        } // safe: opId/ClientRef idempotency makes resend collide, not duplicate
+        const cutoff = Date.now() - 24 * 3600 * 1000;
+        await this.outbox.where('status').equals('synced').and(op => (op.syncedAt ?? 0) < cutoff).delete();
+    }
+    async cascadeFailure(clientRef, reason) {
+        this.ensureOpen();
+        const dependents = await this.outbox.filter(op => op.status === 'pending' && !!op.refMap && Object.values(op.refMap).includes(clientRef)).toArray();
+        for (const op of dependents) {
+            op.status = 'failed';
+            op.lastError = 'Blocked: ' + reason;
+            await this.outbox.put(op);
         }
-        const entry = {
-            entity,
-            entityName: config.entityName ?? entity,
-            idField: (config.formConfig?.heroField ?? config.heroField ?? entity.replace(/s$/, '') + 'ID'),
-            config: resolved,
-        };
-        this.entries.set(entity, entry);
-        if (!this.registered$.value)
-            this.registered$.next(true);
-        this.readUrls.set(config.loadAction.url, entry);
-        if (config.countAction?.url)
-            this.readUrls.set(config.countAction.url, entry);
-        if (config.formConfig?.loadAction?.url)
-            this.readPrefixes.push({ prefix: config.formConfig.loadAction.url + '/', entry });
-        this.registerLookups(config.formConfig, entry);
-        this.startSync();
-        return entry;
     }
-    registerLookups(formConfig, entry, depth = 0) {
-        if (!formConfig?.fields || depth > 1)
+    scheduleBackoff(attempts) {
+        if (this.backoffTimer)
+            clearTimeout(this.backoffTimer);
+        const cap = Math.min(5000 * Math.pow(2, attempts), 300000); // exponential 5s·2^n capped 5min, full jitter
+        this.backoffTimer = setTimeout(() => this.drain(), Math.floor(Math.random() * cap));
+    }
+    //================ Sync-tray actions ================
+    async retryOp(opId) {
+        const op = await this.getOp(opId);
+        if (!op)
             return;
-        const allow = entry.config.cacheLookups;
-        if (allow === false)
+        op.status = 'pending';
+        op.attempts = 0;
+        op.enqueuedAt = Date.now();
+        await this.outbox.put(op);
+        this.drain();
+    }
+    discardOp(opId) { this.ensureOpen(); return this.outbox.where('opId').equals(opId).delete(); }
+    // keepMine re-arms the op with the fresh server RowVersion (explicit, informed overwrite); keepServer discards
+    async resolveConflict(opId, choice) {
+        const op = await this.getOp(opId);
+        if (!op)
             return;
-        formConfig.fields.forEach((field) => {
-            const url = field.loadAction?.url;
-            if (url && (allow === true || (Array.isArray(allow) && allow.includes(url)))) {
-                if (!this.readUrls.has(url))
-                    this.readUrls.set(url, entry);
-            }
-            if (field.detailsConfig?.formConfig)
-                this.registerLookups(field.detailsConfig.formConfig, entry, depth + 1);
-        });
+        if (choice === 'keepServer') {
+            await this.discardOp(opId);
+            return;
+        }
+        if (op.serverRecord?.rowVersion)
+            op.payload = { ...op.payload, rowVersion: op.serverRecord.rowVersion };
+        else
+            delete op.payload.rowVersion;
+        op.status = 'pending';
+        op.attempts = 0;
+        op.enqueuedAt = Date.now();
+        await this.outbox.put(op);
+        this.drain();
     }
-    matchRead(url) {
-        if (!this.hasAny)
-            return null;
-        const exact = this.readUrls.get(url);
-        if (exact)
-            return exact;
-        const prefixed = this.readPrefixes.find(p => url.startsWith(p.prefix));
-        return prefixed ? prefixed.entry : null;
+    getOp(opId) { this.ensureOpen(); return this.outbox.where('opId').equals(opId).first(); }
+    //================ helpers ================
+    parseAction(url) {
+        if (url.includes('?action=create'))
+            return 'create';
+        if (url.includes('?action=edit'))
+            return 'edit';
+        if (url.includes('?action=delete'))
+            return 'delete';
+        return null;
     }
-    matchMutation(url) {
-        if (!this.hasAny)
-            return null;
-        const match = url.match(/^([^?/]+)\?action=(create|edit|delete)$/);
-        if (!match)
-            return null;
-        const entry = this.entries.get(match[1]);
-        if (!entry)
-            return null;
-        return entry.config.queue[match[2]] ? entry : null;
+    hash(v) { let h = 0; for (let i = 0; i < v.length; i++)
+        h = ((h << 5) - h + v.charCodeAt(i)) | 0; return Math.abs(h).toString(36); }
+    sanitize(v) { return v.replace(/[^a-zA-Z0-9_-]/g, '_').toLowerCase(); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: OfflineService, deps: [{ token: HttpService }, { token: AuthService }, { token: StorageService }, { token: MessageService }, { token: SignalRService }, { token: i0.NgZone }, { token: TIN_SPA_RUNTIME_CONFIG, optional: true }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: OfflineService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: OfflineService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [{ type: HttpService }, { type: AuthService }, { type: StorageService }, { type: MessageService }, { type: SignalRService }, { type: i0.NgZone }, { type: undefined, decorators: [{
+                    type: Optional
+                }, {
+                    type: Inject,
+                    args: [TIN_SPA_RUNTIME_CONFIG]
+                }] }] });
+
+// import { Core } from 'tin-core';
+class LogService {
+    constructor() {
+        this.level = LogLevel.All;
+        this.logToConsole = true;
+        this.logToApi = false;
     }
-    // Interceptor seam: suppress the 'Connection Error' toast for URLs the offline layer handles (plus the heartbeat)
-    suppressesUrl(absoluteUrl) {
-        const relative = absoluteUrl.startsWith(this.httpService.apiUrl) ? absoluteUrl.substring(this.httpService.apiUrl.length) : absoluteUrl;
-        if (relative === 'ping')
-            return true;
-        if (!this.hasAny)
-            return false;
-        return !!(this.matchRead(relative) || this.matchMutation(relative));
+    debug(msg, ...optionalParams) {
+        this.writeToLog(msg, LogLevel.Debug, optionalParams);
+    }
+    info(msg, ...optionalParams) {
+        this.writeToLog(msg, LogLevel.Info, optionalParams);
+    }
+    warn(msg, ...optionalParams) {
+        this.writeToLog(msg, LogLevel.Warn, optionalParams);
     }
-    resolveConfig(offline) {
-        if (!offline)
-            return null;
-        const cfg = offline === true ? { enabled: true } : offline;
-        if (!cfg.enabled)
-            return null;
-        return {
-            enabled: true,
-            cacheRows: cfg.cacheRows ?? 500,
-            cacheLookups: cfg.cacheLookups ?? true,
-            lookupMaxAgeHours: cfg.lookupMaxAgeHours ?? 72,
-            queue: cfg.readOnly
-                ? { create: false, edit: false, delete: false }
-                : { create: cfg.queue?.create ?? true, edit: cfg.queue?.edit ?? true, delete: cfg.queue?.delete ?? false },
-            maxQueueAgeHours: cfg.maxQueueAgeHours ?? 72,
-            readOnly: cfg.readOnly ?? false,
-        };
+    error(msg, ...optionalParams) {
+        this.writeToLog(msg, LogLevel.Error, optionalParams);
     }
-    //================ Store (Dexie) ================
-    ensureOpen() {
-        if (this.db)
-            return this.db;
-        const tenant = this.storage.getPersistent(Constants.AUTH_TENANT_NAME) || 'default';
-        const user = this.authService.currentUser || 'anon';
-        const name = `tinspa_offline_${this.hash(this.httpService.apiUrl)}_${this.sanitize(tenant)}_${this.sanitize(user)}`;
-        const db = new Dexie(name);
-        db.version(1).stores({ reads: '&url, entity', outbox: '++seq, opId, entity, status, clientRef', meta: '&key' });
-        this.db = db;
-        this.reads = db.table('reads');
-        this.outbox = db.table('outbox');
-        this.meta = db.table('meta');
-        try {
-            navigator.storage?.persist?.();
-        }
-        catch { }
-        this.meta.put({ key: 'sentinel', value: Date.now() }).catch(() => { });
-        return db;
+    fatal(msg, ...optionalParams) {
+        this.writeToLog(msg, LogLevel.Fatal, optionalParams);
     }
-    putRead(url, entity, data, maxRows) {
-        this.ensureOpen();
-        let stored = data;
-        if (Array.isArray(data))
-            stored = data.slice(0, url.includes('/list/') ? 1000 : maxRows);
-        return this.reads.put({ url, entity, data: stored, savedAt: Date.now() }).catch(err => console.warn('Offline cache write failed', err));
+    log(msg, ...optionalParams) {
+        this.writeToLog(msg, LogLevel.All, optionalParams);
     }
-    getRead(url) {
-        this.ensureOpen();
-        try {
-            return this.reads.get(url).catch(() => undefined);
-        }
-        catch {
-            return Promise.resolve(undefined);
+    writeToLog(msg, level, params) {
+        if (this.shouldLog(level)) {
+            // Build log string
+            let value = Core.getFormatedDate(Date(), false).replace("T", " ");
+            // value += " - Type: " + LogLevel[this.level];
+            value += " - Message: " + msg;
+            if (params.length) {
+                value += " - Extra Info: " + this.formatParams(params);
+            }
+            // Log the value
+            if (this.logToConsole) {
+                console.log(value);
+            }
+            if (this.logToApi) {
+                //Call API post
+            }
         }
     }
-    //================ CallApi seam helpers (called by DataServiceLib) ================
-    // Reads: network-first with write-through; on verified-offline or network failure serve the cached copy.
-    handleOfflineRead(action, entry, networkCall) {
-        const serveCache = () => from(this.serveCachedRead(action.url)).pipe(map(result => result
-            ? { success: true, message: 'success', data: result }
-            : { success: false, message: 'No offline data available yet for this view', data: null }));
-        if (!this.online)
-            return serveCache();
-        return networkCall().pipe(tap((response) => {
-            if (response.success && response?.data)
-                this.putRead(action.url, entry.entity, response.data, entry.config.cacheRows);
-        }), catchError((err) => {
-            if (err?.status === 0) {
-                this.reportNetworkFailure();
-                return serveCache();
+    formatParams(params) {
+        let ret = params.join(",");
+        // Is there at least one object in the array?
+        if (params.some((p) => typeof p == "object")) {
+            ret = "";
+            // Build comma-delimited string
+            for (let item of params) {
+                ret += JSON.stringify(item) + ",";
             }
-            return throwError(() => err);
-        }));
+        }
+        return ret;
     }
-    // For '/list/' lookups, append pending offline creates as selectable 'cref:' options so offline forms can reference not-yet-synced parents
-    async serveCachedRead(url) {
-        const saved = await this.getRead(url);
-        let data = saved?.data ?? null;
-        const listMatch = url.match(/^([^?/]+)\/list\//);
-        if (listMatch) {
-            const creates = await this.pendingCreates(listMatch[1]);
-            if (creates.length) {
-                const opts = creates.map(op => ({ name: `${op.payload?.name ?? 'New'} (pending)`, value: 'cref:' + op.clientRef }));
-                data = Array.isArray(data) ? [...opts, ...data] : opts;
-            }
+    shouldLog(level) {
+        let ret = false;
+        if ((level >= this.level && level !== LogLevel.Off) ||
+            this.level === LogLevel.All) {
+            ret = true;
         }
-        return data;
+        return ret;
     }
-    // Persists a mutation and synthesizes a success ApiResponse so the existing dialog/refresh machinery works unchanged
-    enqueueOffline(action, data, entry) {
-        return from(this.enqueueMutation(action, data, entry)).pipe(map(op => ({
-            success: true,
-            message: 'Saved offline — will be sent when connection is restored',
-            data: op ? { ...op.payload, _offline: { status: op.status, opId: op.opId, clientRef: op.clientRef ?? op.targetClientRef } } : data,
-        })), catchError((err) => of({ success: false, message: 'Could not save offline: ' + (err?.message ?? 'storage error'), data: null })));
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: LogService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: LogService, providedIn: "root" }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: LogService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: "root",
+                }]
+        }], ctorParameters: () => [] });
+
+class AuthService {
+    constructor(_route, socialService, storage, router, httpService, messageService, logService, signalRService, injector) {
+        this._route = _route;
+        this.socialService = socialService;
+        this.storage = storage;
+        this.router = router;
+        this.httpService = httpService;
+        this.messageService = messageService;
+        this.logService = logService;
+        this.signalRService = signalRService;
+        this.injector = injector;
+        this.googleAuthInitialized = false;
+        this.isRefreshing = false; // Changed: Guard to prevent concurrent refresh calls
+        this.refreshTimer = null; // Changed: Proactive token refresh timer
+        this.socialUserSource = new BehaviorSubject(null);
+        this.socialUserObserv = this.socialUserSource.asObservable();
+        //Logged in
+        this.loggedin = false;
+        this.loggedinSource = new BehaviorSubject(this.loggedin);
+        this.loggedinObserv = this.loggedinSource.asObservable();
+        //autoLogin
+        this.autoLogin = false;
+        this.autoLoginSource = new BehaviorSubject(this.autoLogin);
+        this.autoLoginObserv = this.autoLoginSource.asObservable();
+        //Token
+        this.token = "";
+        this.tokenSource = new BehaviorSubject(this.token);
+        this.tokenObserv = this.tokenSource.asObservable();
+        //TokenExpire
+        this.tokenExpire = "";
+        this.tokenExpireSource = new BehaviorSubject(this.tokenExpire);
+        this.tokenExpireObserv = this.tokenExpireSource.asObservable();
+        //Current User
+        this.currentUser = "tnyagato";
+        this.currentUserSource = new BehaviorSubject(this.currentUser);
+        this.currentUserObserv = this.currentUserSource.asObservable();
+        //Line Manager
+        this.islineManager = false;
+        this.isLineManagerSource = new BehaviorSubject(this.islineManager);
+        this.isLineManagerObserv = this.isLineManagerSource.asObservable();
+        //Roles
+        this.currentRole = new Role;
+        this.currentRoleSource = new BehaviorSubject(this.currentRole);
+        this.myRoleObserv = this.currentRoleSource.asObservable();
+        //Logged in FirstName
+        this.loggedUserSource = new BehaviorSubject("tnyagato");
+        this.loggedUserFullName = this.loggedUserSource.asObservable();
+        //TenantName
+        this.tenantNameSource = new BehaviorSubject("Tenant Name");
+        this.tenantNameObserv = this.tenantNameSource.asObservable();
+        this.initializeGoogleAuth();
+        this.initVisibilityRefresh(); // Changed: Refresh token when tab becomes visible after being hidden
     }
-    //================ Outbox writes ================
-    async enqueueMutation(action, data, entry) {
-        this.ensureOpen();
-        const opAction = this.parseAction(action.url);
-        if (!opAction)
-            throw new Error('Unsupported offline mutation: ' + action.url);
-        const payload = { ...data };
-        const marker = payload._offline;
-        delete payload._offline;
-        const refMap = {};
-        Object.keys(payload).forEach(k => {
-            if (typeof payload[k] === 'string' && payload[k].startsWith('cref:')) {
-                refMap[k] = payload[k].substring(5);
-                payload[k] = 0;
+    initializeGoogleAuth() {
+        if (this.googleAuthInitialized) {
+            return;
+        }
+        this.googleAuthInitialized = true;
+        this.socialService.authState.subscribe({
+            next: (socialUser) => {
+                this.socialUserSource.next(socialUser);
+            },
+            error: (error) => {
+                console.debug('Google Sign-In initialization error (expected if not using Google auth):', error?.message);
             }
         });
-        const userId = this.authService.currentUser || 'anon';
-        if (opAction === 'edit' && marker?.clientRef) {
-            const createOp = await this.outbox.where('clientRef').equals(marker.clientRef).first();
-            if (createOp && createOp.status !== 'synced') {
-                createOp.payload = { ...createOp.payload, ...payload, clientRef: createOp.clientRef };
-                createOp.refMap = { ...createOp.refMap, ...refMap };
-                await this.outbox.put(createOp);
-                return createOp;
+    }
+    // Changed: Enhanced clearSession with optional server-side revocation
+    clearSession(revokeOnServer = false) {
+        if (revokeOnServer) {
+            // Changed: Revoke only this device's refresh token — other devices keep their sessions
+            const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
+            if (refreshToken) {
+                this.httpService.Post('User/revoke', { refreshToken }).subscribe({
+                    error: () => { } // Silently ignore errors during logout
+                });
             }
-        }
-        if (opAction === 'delete' && marker?.clientRef) {
-            const createOp = await this.outbox.where('clientRef').equals(marker.clientRef).first();
-            if (createOp && createOp.status !== 'synced') {
-                await this.outbox.delete(createOp.seq);
-                return null;
+            // Added: on explicit logout, wipe the offline IndexedDB cache so a shared device retains no
+            // prior-user records. Resolved lazily to avoid a circular dependency with OfflineService.
+            // Done before storage is cleared so the cache DB name can still be resolved if needed.
+            try {
+                this.injector.get(OfflineService).deleteLocalData();
             }
+            catch { /* offline layer not in use */ }
         }
-        const targetId = opAction === 'create' ? undefined : payload[entry.idField];
-        if (opAction === 'edit' && targetId !== undefined) {
-            const existing = await this.outbox.where('entity').equals(entry.entity)
-                .and(op => op.opAction === 'edit' && op.targetId === targetId && (op.status === 'pending' || op.status === 'failed')).first();
-            if (existing) {
-                existing.payload = payload;
-                existing.refMap = { ...existing.refMap, ...refMap };
-                existing.status = 'pending';
-                await this.outbox.put(existing);
-                return existing;
-            }
+        if (this.refreshTimer) {
+            clearTimeout(this.refreshTimer);
+            this.refreshTimer = null;
+        } // Changed: Cancel proactive refresh timer
+        this.signalRService.stopConnection(); // Changed: Stop consolidated SignalR connection before clearing session
+        this.Updateloggedin(false);
+        this.UpdateAutoLogin(false);
+        this.UpdateRole(new Role());
+        this.UpdateToken(''); // Changed: Clear in-memory token
+        this.UpdateTokenExpire(''); // Changed: Clear in-memory token expiry
+        if (revokeOnServer) {
+            this.storage.clearAll(); // Changed: Full logout clears everything including refresh token
         }
-        const op = {
-            opId: crypto.randomUUID(), entity: entry.entity, entityName: entry.entityName, url: action.url, opAction, payload, targetId,
-            targetClientRef: marker?.clientRef, refMap: Object.keys(refMap).length ? refMap : undefined,
-            status: 'pending', attempts: 0, maxAgeHours: entry.config.maxQueueAgeHours, userId, enqueuedAt: Date.now(),
-        };
-        if (opAction === 'create') {
-            op.clientRef = crypto.randomUUID();
-            op.payload = { ...payload, clientRef: op.clientRef };
+        else {
+            this.storage.clearSessionData(); // Changed: Session expired — preserve refresh token for "remember me"
         }
-        await this.outbox.add(op);
-        return op;
+        this.socialService.signOut();
     }
-    //================ Live streams (cross-tab reactive) ================
-    pendingOpsFor$(entity) {
-        this.ensureOpen();
-        return from(liveQuery(() => this.outbox.where('entity').equals(entity).and(op => op.status !== 'synced').sortBy('seq')));
+    sessionExpired() {
+        this.clearSession(false); // Changed: Don't revoke on server, token just expired
+        let url = new URL(window.location.href);
+        let path = url.hash.replace("#/", "");
+        this.router.navigate(["login"], {
+            relativeTo: this._route,
+            queryParams: { redirectTo: path },
+            queryParamsHandling: 'merge',
+            skipLocationChange: false
+        });
     }
-    activeOps$() {
-        this.ensureOpen();
-        return from(liveQuery(() => this.outbox.filter(op => op.status !== 'synced').sortBy('seq')));
+    logoff() {
+        this.clearSession(true); // Changed: Revoke refresh tokens on explicit logout
+        this.router.navigate(["login"]);
     }
-    pendingCreates(entity) {
-        this.ensureOpen();
-        return this.outbox.where('entity').equals(entity).and(op => op.opAction === 'create' && op.status !== 'synced').sortBy('seq');
+    Updateloggedin(loggedin) {
+        this.loggedinSource.next(loggedin);
+        this.loggedin = loggedin;
     }
-    hasPending() {
-        this.ensureOpen();
-        return this.outbox.where('status').equals('pending').count().then(c => c > 0);
+    UpdateAutoLogin(autoLogin) {
+        this.autoLoginSource.next(autoLogin);
+        this.autoLogin = autoLogin;
     }
-    //================ Connectivity ================
-    // Started by the sync engine (offline table registered) OR by the toolbar indicator (to show a status light).
-    // Uses SignalR's hub connection as the instant online signal when real-time is enabled; ping is the fallback/source of truth.
-    ensureConnectivity() {
-        if (!this.enabled)
-            return; // app-level gate: no pinging/SignalR-watching when offline capability is off
-        if (this.connectivityStarted)
-            return;
-        this.connectivityStarted = true;
-        if (typeof window !== 'undefined') {
-            window.addEventListener('offline', () => this.zone.run(() => this.setOffline()));
-            window.addEventListener('online', () => this.zone.run(() => this.verify()));
-        }
-        // SignalR hub state: connected => instantly online (+drain); disconnected => confirm via ping before declaring offline.
-        // When real-time is disabled the hub never connects, so this stays false and ping fully drives connectivity.
-        this.signalR.dataHubConnected$.subscribe(connected => this.zone.run(() => connected ? this.setOnline() : this.verify()));
-        this.verify();
+    UpdateToken(newToken) {
+        this.tokenSource.next(newToken);
     }
-    reportNetworkFailure() { if (this.connectivityStarted)
-        this.setOffline(); }
-    verify() {
-        this.httpService.Get('ping').pipe(timeout(5000)).subscribe({
-            next: () => this.setOnline(),
-            error: (err) => { if (err?.status > 0)
-                this.setOnline();
-            else
-                this.setOffline(); },
-        });
+    UpdateTokenExpire(newTokenExpire) {
+        this.tokenExpireSource.next(newTokenExpire);
     }
-    setOnline() {
-        this.stopRecoveryPolling();
-        if (!this.online$.value) {
-            this.online$.next(true);
-            if (this.syncStarted)
-                setTimeout(() => this.drain(), Math.floor(Math.random() * 5000)); // jittered so a reconnecting fleet doesn't stampede
-        }
-        // Marry the two: whenever ping confirms we're reachable, revive SignalR if its own auto-reconnect gave up.
-        // No-op when the hub is already connected, so this is safe to call on every online confirmation.
-        this.signalR.reconnectIfNeeded();
+    UpdateCurrentUser(newUser) {
+        this.currentUserSource.next(newUser.toLocaleLowerCase());
+        this.currentUser = newUser.toLocaleLowerCase();
     }
-    setOffline() {
-        if (this.online$.value)
-            this.online$.next(false);
-        this.startRecoveryPolling();
+    UpdateIsLineManager(manager) {
+        this.isLineManagerSource.next(manager);
     }
-    startRecoveryPolling() {
-        if (this.recoveryTimer || !this.connectivityStarted)
-            return;
-        this.recoveryTimer = setInterval(() => this.verify(), 30000); // safety net; SignalR reconnect usually beats this when real-time is on
+    UpdateRole(role) {
+        this.currentRoleSource.next(role);
     }
-    stopRecoveryPolling() {
-        if (this.recoveryTimer) {
-            clearInterval(this.recoveryTimer);
-            this.recoveryTimer = null;
-        }
+    updateLoggedUserFullName(userName) {
+        this.loggedUserSource.next(userName);
     }
-    //================ Sync engine ================
-    startSync() {
-        if (this.syncStarted)
-            return;
-        this.syncStarted = true;
-        this.ensureConnectivity();
-        this.resetOrphans().catch(() => { });
-        this.periodicTimer = setInterval(() => { if (this.online)
-            this.hasPending().then(has => { if (has)
-                this.drain(); }); }, 60000);
-        if (this.online)
-            this.drain();
+    updateTenantName(tenantName) {
+        this.tenantNameSource.next(tenantName);
     }
-    async drain() {
-        if (this.draining || !this.online)
-            return;
-        this.draining = true;
-        const runner = () => this.drainLoop().finally(() => { this.draining = false; });
-        const locks = navigator.locks;
-        if (locks?.request) {
-            try {
-                await locks.request('tinspa-outbox-drain', { ifAvailable: true }, async (lock) => { if (lock)
-                    await runner();
-                else
-                    this.draining = false; });
-            }
-            catch {
-                await runner();
-            }
+    //Authorisation
+    isAuthorised(capName) {
+        if (!this.currentRoleSource.value[capName]) {
+            // this.logService.info(`authorise: ${this.currentRoleSource.value.roleName} not authorised for ${capName}`);
+            this.router.navigate(["home"]);
+            this.messageService.toast(`Unauthorised: ${capName}`);
+            return false;
         }
         else {
-            await runner();
+            return true;
         }
     }
-    async drainLoop() {
-        const syncedEntities = new Set();
-        while (true) {
-            const op = await this.nextAutoOp();
-            if (!op)
-                break;
-            op.status = 'syncing';
-            await this.outbox.put(op); // persisted BEFORE network I/O — crash recovery reverts to pending
-            const outcome = await this.sendOp(op);
-            if (outcome === 'transient') {
-                op.status = 'pending';
-                op.attempts++;
-                await this.outbox.put(op);
-                this.scheduleBackoff(op.attempts);
-                break; // strict FIFO: a transient failure halts the drain until backoff/reconnect
-            }
-            if (outcome === 'synced')
-                syncedEntities.add(op.entity);
-            if (outcome === 'failed') {
-                this.messageService.toast(`Sync failed: ${op.entityName} ${op.opAction} — open the sync tray to review`);
-                if (op.clientRef)
-                    await this.cascadeFailure(op.clientRef, `${op.entityName} ${op.opAction} failed`);
-            }
-            if (outcome === 'conflict')
-                this.messageService.toast(`Sync conflict: ${op.entityName} changed on the server — review in the sync tray`);
-        }
-        if (syncedEntities.size > 0) {
-            this.drained$.next(Array.from(syncedEntities));
-            this.messageService.toast('Offline changes synced');
-        }
+    // Changed: Pure validation — no side effects. Callers handle refresh/redirect.
+    isValidToken() {
+        let tokenExpire = new Date(this.tokenExpireSource.value);
+        let nowDate = new Date();
+        return tokenExpire > nowDate;
     }
-    async sendOp(op) {
-        const payload = { ...op.payload };
-        if (op.refMap && Object.keys(op.refMap).length)
-            payload.clientRefs = JSON.stringify(op.refMap); // server resolves parent ClientRef -> real int FK
-        let response;
-        try {
-            response = await firstValueFrom(this.httpService.Post(op.url, payload));
-        }
-        catch (err) {
-            const status = err?.status ?? 0;
-            if (status === 0 || status === 408 || status === 429 || status >= 500) {
-                if (status === 0)
-                    this.reportNetworkFailure();
-                return 'transient';
-            }
-            return this.finishOp(op, 'failed', err?.message ?? `HTTP ${status}`);
-        }
-        if (response.success)
-            return this.finishOp(op, 'synced');
-        const reason = response.reason ?? '';
-        const notFound = reason === 'not_found' || response.message?.includes('not found');
-        if (reason === 'conflict') {
-            op.serverRecord = response.data ?? null;
-            return this.finishOp(op, 'conflict', response.message);
+    // Changed: Centralized handler for storing all auth data from login/refresh response
+    applyLoginResponse(data, rememberMe) {
+        // Set storage mode: sessionStorage when not remembered, localStorage when remembered
+        this.storage.setSessionMode(!rememberMe);
+        // Store remember-me flag persistently (survives browser close)
+        this.storage.storePersistent(Constants.AUTH_REMEMBER_ME, rememberMe);
+        // Update in-memory state
+        this.Updateloggedin(true);
+        this.UpdateToken(data.token);
+        this.UpdateTokenExpire(data.expiration);
+        this.signalRService.updateToken(data.token); // Changed: Keep SignalR reconnection token in sync
+        this.UpdateRole(data.role);
+        this.updateLoggedUserFullName(data.firstName);
+        this.updateTenantName(data.tenantName);
+        if (data.userName)
+            this.UpdateCurrentUser(data.userName); // Changed: Restore username after silent refresh
+        // Store session data in active storage
+        this.storage.store(Constants.AUTH_TOKEN, data.token);
+        this.storage.store(Constants.AUTH_TOKEN_EXPIRE, data.expiration);
+        this.storage.store(Constants.AUTH_ROLES, JSON.stringify(data.role));
+        this.storage.store(Constants.AUTH_NAME, data.firstName);
+        this.storage.store(Constants.AUTH_TENANT_NAME, data.tenantName);
+        if (data.userName)
+            this.storage.store(Constants.AUTH_USER, data.userName); // Changed: Persist username so checkAuthentication finds AUTH_USER after app restart
+        // Store refresh token persistently if provided (always in localStorage)
+        if (data.refreshToken) {
+            this.storage.storePersistent(Constants.AUTH_REFRESH_TOKEN, data.refreshToken);
+            this.storage.storePersistent(Constants.AUTH_REFRESH_TOKEN_EXPIRE, data.refreshTokenExpiry);
         }
-        if (notFound && op.opAction === 'delete')
-            return this.finishOp(op, 'synced'); // delete of already-deleted row — outcome achieved
-        if (notFound && op.opAction === 'edit')
-            return this.finishOp(op, 'conflict', 'This record was deleted on the server');
-        return this.finishOp(op, 'failed', response.message); // validation/business failure — permanent
+        this.scheduleTokenRefresh(data.expiration); // Changed: Schedule proactive refresh before token expires
+    }
+    // Changed: Schedule a silent refresh 5 minutes before the access token expires
+    scheduleTokenRefresh(expiration) {
+        if (this.refreshTimer)
+            clearTimeout(this.refreshTimer); // Clear any existing timer
+        const expiresAt = new Date(expiration).getTime();
+        const now = Date.now();
+        const refreshIn = expiresAt - now - (5 * 60 * 1000); // 5 minutes before expiry
+        if (refreshIn <= 0)
+            return; // Token already expired or about to — reactive refresh will handle it
+        this.refreshTimer = setTimeout(() => {
+            this.silentRefresh().then(success => {
+                if (!success)
+                    this.sessionExpired();
+            });
+        }, refreshIn);
     }
-    async finishOp(op, status, error) {
-        op.status = status;
-        op.lastError = error;
-        if (status === 'synced')
-            op.syncedAt = Date.now();
-        await this.outbox.put(op);
-        return status;
+    // Changed: When tab becomes visible, check if token needs immediate refresh
+    initVisibilityRefresh() {
+        document.addEventListener('visibilitychange', () => {
+            if (document.visibilityState !== 'visible')
+                return;
+            if (!this.loggedin)
+                return;
+            const expire = this.tokenExpireSource.value;
+            if (!expire)
+                return;
+            const expiresAt = new Date(expire).getTime();
+            const now = Date.now();
+            const minutesLeft = (expiresAt - now) / 60000;
+            // If token expires in less than 10 minutes or is already expired, refresh immediately
+            if (minutesLeft < 10 && this.hasRefreshToken()) {
+                this.silentRefresh().then(success => {
+                    if (!success)
+                        this.sessionExpired();
+                });
+            }
+        });
     }
-    async nextAutoOp() {
-        this.ensureOpen();
-        const ops = await this.outbox.orderBy('seq').filter(op => op.status === 'pending').toArray();
-        for (const op of ops) {
-            if (Date.now() - op.enqueuedAt > op.maxAgeHours * 3600 * 1000) {
-                op.status = 'stale';
-                op.lastError = 'Held — too old to send automatically';
-                await this.outbox.put(op);
-                continue;
+    // Changed: Non-destructive check — only returns true if token is genuinely valid (not expired)
+    hasValidSession() {
+        // Check in-memory state first
+        if (this.loggedin && this.tokenExpireSource.value) {
+            const tokenExpire = new Date(this.tokenExpireSource.value);
+            if (tokenExpire > new Date())
+                return true;
+        }
+        // Changed: Check localStorage for non-expired token (not just existence)
+        const localExpiry = localStorage.getItem(Constants.AUTH_TOKEN_EXPIRE);
+        if (localExpiry) {
+            try {
+                const expiry = new Date(JSON.parse(unescape(atob(localExpiry))));
+                if (expiry > new Date())
+                    return true;
             }
-            return op;
+            catch { /* ignore parse errors */ }
         }
-        return undefined;
-    }
-    async resetOrphans() {
-        this.ensureOpen();
-        const orphans = await this.outbox.where('status').equals('syncing').toArray();
-        for (const op of orphans) {
-            op.status = 'pending';
-            await this.outbox.put(op);
-        } // safe: opId/ClientRef idempotency makes resend collide, not duplicate
-        const cutoff = Date.now() - 24 * 3600 * 1000;
-        await this.outbox.where('status').equals('synced').and(op => (op.syncedAt ?? 0) < cutoff).delete();
-    }
-    async cascadeFailure(clientRef, reason) {
-        this.ensureOpen();
-        const dependents = await this.outbox.filter(op => op.status === 'pending' && !!op.refMap && Object.values(op.refMap).includes(clientRef)).toArray();
-        for (const op of dependents) {
-            op.status = 'failed';
-            op.lastError = 'Blocked: ' + reason;
-            await this.outbox.put(op);
+        // Changed: Check sessionStorage for non-expired token
+        const sessionExpiry = sessionStorage.getItem(Constants.AUTH_TOKEN_EXPIRE);
+        if (sessionExpiry) {
+            try {
+                const expiry = new Date(JSON.parse(unescape(atob(sessionExpiry))));
+                if (expiry > new Date())
+                    return true;
+            }
+            catch { /* ignore parse errors */ }
         }
+        // Changed: Refresh token alone does NOT count as valid session — caller must handle refresh separately
+        return false;
     }
-    scheduleBackoff(attempts) {
-        if (this.backoffTimer)
-            clearTimeout(this.backoffTimer);
-        const cap = Math.min(5000 * Math.pow(2, attempts), 300000); // exponential 5s·2^n capped 5min, full jitter
-        this.backoffTimer = setTimeout(() => this.drain(), Math.floor(Math.random() * cap));
+    // Changed: Check if a refresh token exists (for login page to attempt silent refresh)
+    hasRefreshToken() {
+        const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
+        return refreshToken !== null;
     }
-    //================ Sync-tray actions ================
-    async retryOp(opId) {
-        const op = await this.getOp(opId);
-        if (!op)
-            return;
-        op.status = 'pending';
-        op.attempts = 0;
-        op.enqueuedAt = Date.now();
-        await this.outbox.put(op);
-        this.drain();
+    // Shared entry point for any page that needs to auto-redirect authenticated users
+    // Returns true if session is active or was successfully restored via silent refresh
+    async tryRestoreSession() {
+        if (this.hasValidSession())
+            return true;
+        if (this.hasRefreshToken())
+            return await this.silentRefresh();
+        return false;
     }
-    discardOp(opId) { this.ensureOpen(); return this.outbox.where('opId').equals(opId).delete(); }
-    // keepMine re-arms the op with the fresh server RowVersion (explicit, informed overwrite); keepServer discards
-    async resolveConflict(opId, choice) {
-        const op = await this.getOp(opId);
-        if (!op)
-            return;
-        if (choice === 'keepServer') {
-            await this.discardOp(opId);
-            return;
+    // Changed: Silently refresh the JWT using the stored refresh token
+    silentRefresh() {
+        if (this.isRefreshing)
+            return Promise.resolve(false); // Prevent concurrent refreshes
+        this.isRefreshing = true;
+        const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
+        if (!refreshToken) {
+            this.isRefreshing = false;
+            return Promise.resolve(false);
         }
-        if (op.serverRecord?.rowVersion)
-            op.payload = { ...op.payload, rowVersion: op.serverRecord.rowVersion };
-        else
-            delete op.payload.rowVersion;
-        op.status = 'pending';
-        op.attempts = 0;
-        op.enqueuedAt = Date.now();
-        await this.outbox.put(op);
-        this.drain();
+        return new Promise((resolve) => {
+            this.httpService.Post('User/refresh', { refreshToken }).subscribe({
+                next: (response) => {
+                    this.isRefreshing = false;
+                    if (response.success) {
+                        const rememberMe = this.storage.getPersistent(Constants.AUTH_REMEMBER_ME) ?? true;
+                        this.applyLoginResponse(response.data, rememberMe);
+                        resolve(true);
+                    }
+                    else {
+                        // Changed: Server explicitly rejected the token (revoked/expired) — safe to clear
+                        const currentToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
+                        if (currentToken === refreshToken) {
+                            this.storage.removePersistent(Constants.AUTH_REFRESH_TOKEN);
+                            this.storage.removePersistent(Constants.AUTH_REFRESH_TOKEN_EXPIRE);
+                            this.storage.removePersistent(Constants.AUTH_REMEMBER_ME);
+                        }
+                        resolve(false);
+                    }
+                },
+                error: () => {
+                    this.isRefreshing = false;
+                    // Changed: Network error (device waking up, no connectivity) — do NOT clear the refresh token.
+                    // The token may still be valid; next visibility change or 401 interceptor will retry.
+                    resolve(false);
+                }
+            });
+        });
     }
-    getOp(opId) { this.ensureOpen(); return this.outbox.where('opId').equals(opId).first(); }
-    //================ helpers ================
-    parseAction(url) {
-        if (url.includes('?action=create'))
-            return 'create';
-        if (url.includes('?action=edit'))
-            return 'edit';
-        if (url.includes('?action=delete'))
-            return 'delete';
-        return null;
+    // Changed: Returns Promise<boolean> to properly await refresh instead of optimistically returning true
+    checkAuthentication() {
+        if (this.loggedin && this.isValidToken()) {
+            return Promise.resolve(true);
+        }
+        // Changed: Restore storage mode from persistent remember-me flag
+        const rememberMe = this.storage.getPersistent(Constants.AUTH_REMEMBER_ME);
+        if (rememberMe !== null) {
+            this.storage.setSessionMode(!rememberMe);
+        }
+        if (this.storage.hasKey(Constants.AUTH_USER)) {
+            this.Updateloggedin(true);
+            this.storage.get(Constants.AUTH_USER).then((resp) => {
+                this.UpdateCurrentUser(resp);
+            });
+            this.storage.get(Constants.AUTH_NAME).then((resp) => {
+                this.updateLoggedUserFullName(resp);
+            });
+            this.storage.get(Constants.AUTH_ROLES).then((resp) => {
+                let ret = JSON.parse(resp);
+                this.UpdateRole(ret);
+            });
+            this.storage.get(Constants.AUTH_TENANT_NAME).then((resp) => {
+                this.updateTenantName(resp);
+            });
+            // Changed: Load token and check validity — if expired, await silentRefresh before allowing navigation
+            return this.storage.get(Constants.AUTH_TOKEN).then((token) => {
+                this.UpdateToken(token);
+                return this.storage.get(Constants.AUTH_TOKEN_EXPIRE);
+            }).then((expire) => {
+                this.UpdateTokenExpire(expire);
+                const tokenExpire = new Date(expire);
+                if (tokenExpire > new Date()) {
+                    return true; // Token still valid
+                }
+                // Token expired — attempt silent refresh and wait for result
+                const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
+                if (refreshToken) {
+                    return this.silentRefresh().then((success) => {
+                        if (!success) {
+                            this.sessionExpired();
+                        }
+                        return success;
+                    });
+                }
+                this.sessionExpired();
+                return false;
+            });
+        }
+        // Changed: Check for persistent refresh token when no session data exists
+        const refreshToken = this.storage.getPersistent(Constants.AUTH_REFRESH_TOKEN);
+        if (refreshToken) {
+            // Changed: Wait for refresh to complete before deciding
+            return this.silentRefresh().then((success) => {
+                if (!success) {
+                    this.sessionExpired();
+                }
+                return success;
+            });
+        }
+        this.sessionExpired();
+        return Promise.resolve(false);
     }
-    hash(v) { let h = 0; for (let i = 0; i < v.length; i++)
-        h = ((h << 5) - h + v.charCodeAt(i)) | 0; return Math.abs(h).toString(36); }
-    sanitize(v) { return v.replace(/[^a-zA-Z0-9_-]/g, '_').toLowerCase(); }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: OfflineService, deps: [{ token: HttpService }, { token: AuthService }, { token: StorageService }, { token: MessageService }, { token: SignalRService }, { token: i0.NgZone }, { token: TIN_SPA_RUNTIME_CONFIG, optional: true }], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: OfflineService, providedIn: 'root' }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: AuthService, deps: [{ token: i1$2.ActivatedRoute }, { token: i2$2.SocialAuthService }, { token: StorageService }, { token: i1$2.Router }, { token: HttpService }, { token: MessageService }, { token: LogService }, { token: SignalRService }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: AuthService, providedIn: 'root' }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: OfflineService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: AuthService, decorators: [{
             type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }], ctorParameters: () => [{ type: HttpService }, { type: AuthService }, { type: StorageService }, { type: MessageService }, { type: SignalRService }, { type: i0.NgZone }, { type: undefined, decorators: [{
-                    type: Optional
-                }, {
-                    type: Inject,
-                    args: [TIN_SPA_RUNTIME_CONFIG]
-                }] }] });
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: i1$2.ActivatedRoute }, { type: i2$2.SocialAuthService }, { type: StorageService }, { type: i1$2.Router }, { type: HttpService }, { type: MessageService }, { type: LogService }, { type: SignalRService }, { type: i0.Injector }] });
 
 class DataServiceLib {
     constructor(httpService, router, route, authService, offline) {
@@ -4430,6 +4459,10 @@ class DialogService {
         iframe.style.height = '0';
         iframe.style.border = 'none';
         iframe.style.visibility = 'hidden';
+        // Changed: sandbox the print frame WITHOUT allow-scripts so any injected <script> / event handlers
+        // in the print content cannot execute. allow-same-origin lets us write content and call print();
+        // allow-modals permits the browser print dialog.
+        iframe.setAttribute('sandbox', 'allow-same-origin allow-modals');
         document.body.appendChild(iframe);
         if (iframe.contentWindow) {
             iframe.contentWindow.document.open();
@@ -13361,6 +13394,7 @@ class HtmlComponent {
         this.value = '';
         this.maxHeight = '500px'; // Default maximum height
         this.display = ''; // For consistency with other components
+        this.sanitizedHtml = '';
     }
     ngOnInit() {
         this.sanitizeHtml();
@@ -13369,7 +13403,10 @@ class HtmlComponent {
         this.sanitizeHtml();
     }
     sanitizeHtml() {
-        this.sanitizedHtml = this.sanitizer.bypassSecurityTrustHtml(this.value);
+        // Changed: sanitize instead of bypassing Angular's protection. This strips <script>, event handlers
+        // (onerror/onclick, etc.) and other XSS vectors while keeping safe formatting markup, preventing
+        // stored XSS from any user-influenced html-type field.
+        this.sanitizedHtml = this.sanitizer.sanitize(SecurityContext.HTML, this.value ?? '') ?? '';
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: HtmlComponent, deps: [{ token: i1$5.DomSanitizer }], target: i0.ɵɵFactoryTarget.Component }); }
     static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.14", type: HtmlComponent, isStandalone: false, selector: "spa-html", inputs: { value: "value", maxHeight: "maxHeight", display: "display" }, usesOnChanges: true, ngImport: i0, template: "<div *ngIf=\"display\" class=\"html-label\">{{display}}</div>\r\n<div class=\"html-container\" [ngStyle]=\"{'max-height': maxHeight}\">\r\n  <div class=\"html-content\" [innerHTML]=\"sanitizedHtml\"></div>\r\n</div>", styles: [".html-container{width:100%;overflow-y:auto;border:1px solid #e0e0e0;border-radius:4px;padding:8px;background-color:#fafafa}.html-content{width:100%}.html-label{font-weight:500;margin-bottom:5px}\n"], dependencies: [{ kind: "directive", type: i2.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "directive", type: i2.NgStyle, selector: "[ngStyle]", inputs: ["ngStyle"] }] }); }