@lenne.tech/ng-base 18.1.3 → 22.0.0

package/fesm2022/lenne.tech-ng-base-server.mjs

@@ -0,0 +1,408 @@
+import { writeResponseToNodeResponse } from "@angular/ssr/node";
+import { LT_SERVER_RUNTIME_CONFIG, injectLtRuntimeConfigScript } from "@lenne.tech/ng-base";
+import { makeEnvironmentProviders } from "@angular/core";
+import { Readable, pipeline } from "node:stream";
+const SECURITY_TXT_PATH = "/.well-known/security.txt";
+const SECURITY_TXT_DEFAULT_CONTACT = "mailto:security@lenne.tech";
+const SECURITY_TXT_DEFAULT_LANGUAGES = ["de", "en"];
+const SECURITY_TXT_DEFAULT_VALID_DAYS = 180;
+const SECURITY_TXT_MAX_VALID_DAYS = 365;
+const DAY_MS = 864e5;
+const CONTACT_URI = /^(?:mailto:|tel:|https:\/\/)\S/i;
+function isSingleToken(value) {
+	return typeof value === "string" && value.length > 0 && !/\s/.test(value);
+}
+function normalizeSecurityTxtContacts(contact) {
+	return (Array.isArray(contact) ? contact : [contact]).map((value) => typeof value === "string" ? value.trim() : value).filter(isSingleToken).filter((value) => CONTACT_URI.test(value));
+}
+function normalizeSecurityTxtList(value) {
+	return (typeof value === "string" ? value.split(",") : Array.isArray(value) ? value : []).map((entry) => typeof entry === "string" ? entry.trim() : entry).filter(isSingleToken);
+}
+function normalizeSecurityTxtValidDays(validDays) {
+	const days = Number(validDays);
+	if (!Number.isFinite(days) || days < 1) return 180;
+	return Math.min(Math.floor(days), SECURITY_TXT_MAX_VALID_DAYS);
+}
+function toSecurityTxtOrigin(url) {
+	if (!url) return;
+	try {
+		const parsed = new URL(url);
+		return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.origin : void 0;
+	} catch {
+		return;
+	}
+}
+function allowedRequestOrigin(host, allowedHosts) {
+	const name = host?.trim().toLowerCase();
+	const allowed = allowedHosts.map((entry) => entry.trim().toLowerCase());
+	return name && allowed.includes(name) ? `https://${name}` : void 0;
+}
+function resolveAgainstOrigin(value, origin) {
+	if (!isSingleToken(value)) return;
+	if (!value.startsWith("/")) return value;
+	return origin ? `${origin}${value}` : void 0;
+}
+function buildSecurityTxt(options) {
+	const { contacts, now, origins, policy, preferredLanguages = [] } = options;
+	const validDays = normalizeSecurityTxtValidDays(options.validDays ?? 180);
+	const expires = /* @__PURE__ */ new Date(Math.floor((now.getTime() + validDays * DAY_MS) / DAY_MS) * DAY_MS);
+	const canonicals = [...new Set(origins.map((origin) => origin.replace(/\/+$/, "")).filter(Boolean))];
+	const languages = preferredLanguages.map((language) => language.trim()).filter(isSingleToken);
+	const lines = [...contacts.filter(isSingleToken).map((contact) => `Contact: ${contact}`), `Expires: ${expires.toISOString()}`];
+	const policyUri = resolveAgainstOrigin(policy, canonicals[0]);
+	if (policyUri) lines.push(`Policy: ${policyUri}`);
+	if (languages.length) lines.push(`Preferred-Languages: ${languages.join(", ")}`);
+	for (const origin of canonicals) lines.push(`Canonical: ${origin}${SECURITY_TXT_PATH}`);
+	return `${lines.join("\n")}\n`;
+}
+function resolveSecurityTxt(input) {
+	const config = input.config ?? {};
+	const contacts = normalizeSecurityTxtContacts(config.contact);
+	if (!contacts.length) return;
+	const siteOrigin = toSecurityTxtOrigin(input.siteUrl);
+	const requestOrigin = allowedRequestOrigin(input.requestHost, normalizeSecurityTxtList(config.hosts));
+	return buildSecurityTxt({
+		contacts,
+		now: input.now,
+		origins: [siteOrigin, requestOrigin].filter((origin) => !!origin),
+		policy: config.policy,
+		preferredLanguages: normalizeSecurityTxtList(config.preferredLanguages),
+		validDays: normalizeSecurityTxtValidDays(config.validDays)
+	});
+}
+const LT_RUNTIME_FEATURE_KEYS = {
+	ai: { basePath: "string" },
+	auth: {
+		basePath: "string",
+		loginPath: "string",
+		twoFactorRedirectPath: "string",
+		enablePasskey: "boolean",
+		enableTwoFactor: "boolean"
+	},
+	bug: {
+		autoOpenOnError: "boolean",
+		autoShow: "boolean",
+		buttonColor: "string",
+		buttonText: "string",
+		enabled: "boolean",
+		enableScreenshot: "boolean",
+		position: "string"
+	},
+	errorTranslation: {
+		defaultLocale: "string",
+		enabled: "boolean",
+		preload: "boolean"
+	},
+	sync: { basePath: "string" },
+	tus: {
+		defaultChunkSize: "number",
+		defaultEndpoint: "string",
+		resolveAgainstApi: "boolean"
+	}
+};
+const LT_RUNTIME_NESTED_KEYS = { auth: {
+	interceptor: {
+		enabled: "boolean",
+		publicPaths: "array"
+	},
+	systemSetup: {
+		enabled: "boolean",
+		setupPath: "string"
+	}
+} };
+function toLtEnvKey(camel) {
+	return camel.replace(/([a-z\d])([A-Z])/g, "$1_$2").toUpperCase();
+}
+function readLtRuntimeConfigFromEnv(env = processEnv$1(), options = {}) {
+	const value = (name) => {
+		const raw = env[name]?.trim();
+		return raw ? raw : void 0;
+	};
+	const lt = {};
+	for (const [feature, keys] of Object.entries(LT_RUNTIME_FEATURE_KEYS)) {
+		const options = {};
+		for (const [key, type] of Object.entries(keys)) {
+			const parsed = parseLtEnvValue(value(`NG_PUBLIC_LT_${toLtEnvKey(feature)}_${toLtEnvKey(key)}`), type);
+			if (parsed !== void 0) options[key] = parsed;
+		}
+		for (const [group, groupKeys] of Object.entries(LT_RUNTIME_NESTED_KEYS[feature] ?? {})) {
+			const nested = {};
+			for (const [key, type] of Object.entries(groupKeys)) {
+				const parsed = parseLtEnvValue(value(`NG_PUBLIC_LT_${toLtEnvKey(feature)}_${toLtEnvKey(group)}_${toLtEnvKey(key)}`), type);
+				if (parsed !== void 0) nested[key] = parsed;
+			}
+			if (Object.keys(nested).length) options[group] = nested;
+		}
+		if (Object.keys(options).length) lt[feature] = options;
+	}
+	const apiProxy = parseLtEnvValue(value("NG_PUBLIC_API_PROXY"), "boolean");
+	const commit = [value("NG_PUBLIC_APP_COMMIT"), value("APP_VERSION_COMMIT")].find((candidate) => candidate && candidate !== "unknown");
+	return {
+		public: {
+			apiProxy,
+			apiUrl: value("NG_PUBLIC_API_URL"),
+			appCommit: commit ?? "unknown",
+			appEnv: value("NG_PUBLIC_APP_ENV"),
+			appVersion: options.appVersion ?? value("NG_PUBLIC_APP_VERSION"),
+			cookiePrefix: value("NG_PUBLIC_COOKIE_PREFIX"),
+			lt,
+			siteUrl: value("NG_PUBLIC_SITE_URL"),
+			storagePrefix: value("NG_PUBLIC_STORAGE_PREFIX"),
+			...options.extend?.(env)
+		},
+		serverApiUrl: value("NG_API_URL") ?? ""
+	};
+}
+function readLtRequestContext(env = processEnv$1(), options = {}) {
+	const config = readLtRuntimeConfigFromEnv(env, options);
+	return {
+		runtimeConfig: config.public,
+		serverApiUrl: config.serverApiUrl
+	};
+}
+function parseLtEnvValue(raw, type) {
+	if (raw === void 0) return;
+	switch (type) {
+		case "boolean": return /^(true|1|yes|on)$/i.test(raw) ? true : /^(false|0|no|off)$/i.test(raw) ? false : void 0;
+		case "number": {
+			const number = raw.trim() ? Number(raw) : NaN;
+			return Number.isFinite(number) ? number : void 0;
+		}
+		case "array": return raw.split(",").map((part) => part.trim()).filter(Boolean);
+		default: return raw;
+	}
+}
+function provideLtServerRuntimeConfig(env) {
+	return makeEnvironmentProviders([{
+		provide: LT_SERVER_RUNTIME_CONFIG,
+		useFactory: () => readLtRuntimeConfigFromEnv(typeof env === "function" ? env() : env ?? processEnv$1())
+	}]);
+}
+function processEnv$1() {
+	return globalThis.process?.env ?? {};
+}
+const SECURITY_HEADERS = Object.freeze({
+	"Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=()",
+	"Referrer-Policy": "strict-origin",
+	"X-Content-Type-Options": "nosniff",
+	"X-DNS-Prefetch-Control": "off",
+	"X-Frame-Options": "DENY",
+	"X-Permitted-Cross-Domain-Policies": "none"
+});
+const LT_HSTS_VALUE = "max-age=31536000; includeSubDomains";
+function isLtSecureRequest(req) {
+	const forwarded = headerValue(req.headers["x-forwarded-proto"])?.split(",")[0]?.trim().toLowerCase();
+	if (forwarded) return forwarded === "https";
+	return !!req.socket?.encrypted;
+}
+function buildLtSecurityHeaders(options) {
+	return options.secure ? {
+		...SECURITY_HEADERS,
+		"Strict-Transport-Security": LT_HSTS_VALUE
+	} : { ...SECURITY_HEADERS };
+}
+function ltSecurityHeaders() {
+	return (req, res, next) => {
+		res.removeHeader("X-Powered-By");
+		for (const [name, value] of Object.entries(buildLtSecurityHeaders({ secure: isLtSecureRequest(req) }))) if (!res.hasHeader(name)) res.setHeader(name, value);
+		next();
+	};
+}
+function applyLtHtmlCacheHeaders(response) {
+	if (!(response.headers.get("content-type") ?? "").includes("text/html") || response.headers.has("cache-control")) return false;
+	response.headers.set("cache-control", "private, no-cache");
+	const vary = response.headers.get("vary");
+	response.headers.set("vary", vary ? `${vary}, Cookie` : "Cookie");
+	return true;
+}
+function ltSecurityTxt(options = {}) {
+	return (req, res, next) => {
+		if ((req.url ?? "").split("?")[0] !== "/.well-known/security.txt" || req.method !== "GET" && req.method !== "HEAD") {
+			next();
+			return;
+		}
+		const env = options.env ?? processEnv();
+		const fromEnv = (name) => env[name] === void 0 || env[name] === "" ? void 0 : env[name];
+		const body = resolveSecurityTxt({
+			config: {
+				contact: fromEnv("NG_LT_SECURITY_TXT_CONTACT")?.split(",") ?? options.contact ?? "mailto:security@lenne.tech",
+				hosts: fromEnv("NG_LT_SECURITY_TXT_HOSTS") ?? options.hosts ?? [],
+				policy: fromEnv("NG_LT_SECURITY_TXT_POLICY") ?? options.policy,
+				preferredLanguages: fromEnv("NG_LT_SECURITY_TXT_PREFERRED_LANGUAGES") ?? options.preferredLanguages ?? SECURITY_TXT_DEFAULT_LANGUAGES,
+				validDays: fromEnv("NG_LT_SECURITY_TXT_VALID_DAYS") ?? options.validDays ?? 180
+			},
+			now: /* @__PURE__ */ new Date(),
+			requestHost: headerValue(req.headers["x-forwarded-host"])?.split(",")[0]?.trim() || headerValue(req.headers.host),
+			siteUrl: options.siteUrl ?? readLtRuntimeConfigFromEnv(env).public.siteUrl
+		});
+		if (!body) {
+			res.statusCode = 404;
+			res.setHeader("content-type", "text/plain; charset=utf-8");
+			res.end("Not Found");
+			return;
+		}
+		res.statusCode = 200;
+		res.setHeader("content-type", "text/plain; charset=utf-8");
+		res.setHeader("cache-control", "no-store");
+		res.end(req.method === "HEAD" ? void 0 : body);
+	};
+}
+function resolveLtBuildCommit(env = processEnv()) {
+	for (const candidate of [env["NG_PUBLIC_APP_COMMIT"], env["APP_VERSION_COMMIT"]]) if (typeof candidate === "string" && candidate.trim() && candidate !== "unknown") return candidate;
+	return "unknown";
+}
+function ltBuildIdentity(options = {}) {
+	const path = options.path ?? "/api/build-identity";
+	return (req, res, next) => {
+		if ((req.url ?? "").split("?")[0] !== path || req.method !== "GET") {
+			next();
+			return;
+		}
+		const env = options.env ?? processEnv();
+		res.statusCode = 200;
+		res.setHeader("content-type", "application/json; charset=utf-8");
+		res.setHeader("cache-control", "no-store");
+		res.end(JSON.stringify({
+			commit: resolveLtBuildCommit(env),
+			version: options.version ?? env["NG_PUBLIC_APP_VERSION"] ?? "0.0.0"
+		}));
+	};
+}
+function headerValue(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+function processEnv() {
+	return globalThis.process?.env ?? {};
+}
+async function withLtRuntimeConfigScript(response, config, options = {}) {
+	if (!(response.headers.get("content-type") ?? "").includes("text/html")) return response;
+	const html = injectLtRuntimeConfigScript(await response.text(), config, options);
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	return new Response(html, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+function ltAngularRequestHandler(engine, options = {}) {
+	return (req, res, next) => {
+		const context = readLtRequestContext(options.env, options);
+		engine.handle(req, context).then(async (response) => {
+			if (!response) {
+				next();
+				return;
+			}
+			if (options.htmlNoCache !== false) applyLtHtmlCacheHeaders(response);
+			await writeResponseToNodeResponse(await withLtRuntimeConfigScript(response, context.runtimeConfig, { submitGuard: options.submitGuard }), res);
+		}).catch(next);
+	};
+}
+const FORWARDED_REQUEST_HEADERS = [
+	"accept",
+	"accept-language",
+	"authorization",
+	"content-type",
+	"cookie",
+	"origin",
+	"referer",
+	"user-agent",
+	"x-file-id",
+	"x-system-setup-token",
+	"x-tenant-id",
+	"tus-resumable",
+	"upload-length",
+	"upload-metadata",
+	"upload-offset",
+	"upload-concat",
+	"upload-defer-length"
+];
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"content-encoding",
+	"content-length",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+function rewriteLtProxyCookie(cookie, secure) {
+	const [pair = "", ...attributes] = cookie.split(";").map((part) => part.trim());
+	return [
+		pair,
+		"Path=/",
+		...attributes.filter((part) => part && !/^domain=/i.test(part) && !/^path=/i.test(part) && (secure || !/^secure$/i.test(part)))
+	].join("; ");
+}
+function rewriteLtProxyLocation(location, target, prefix) {
+	if (location.startsWith("/") && !location.startsWith("//")) return `${prefix}${location}`;
+	try {
+		const url = new URL(location);
+		const base = new URL(target);
+		if (url.origin !== base.origin) return location;
+		const basePath = base.pathname.replace(/\/+$/, "");
+		return `${prefix}${basePath && url.pathname.startsWith(`${basePath}/`) ? url.pathname.slice(basePath.length) : url.pathname}${url.search}${url.hash}`;
+	} catch {
+		return location;
+	}
+}
+function ltApiProxy(options = {}) {
+	const prefix = (options.prefix ?? "/api").replace(/\/+$/, "");
+	return (req, res, next) => {
+		const url = req.url ?? "";
+		if (url !== prefix && !url.startsWith(`${prefix}/`) && !url.startsWith(`${prefix}?`)) {
+			next();
+			return;
+		}
+		const runtime = readLtRuntimeConfigFromEnv(options.env ?? globalThis.process?.env ?? {});
+		const enabled = options.enabled ?? runtime.public.apiProxy === true;
+		const target = (options.target ?? (runtime.serverApiUrl || runtime.public.apiUrl || "")).replace(/\/+$/, "");
+		if (!enabled || !target) {
+			next();
+			return;
+		}
+		const headers = new Headers();
+		for (const name of FORWARDED_REQUEST_HEADERS) {
+			const value = req.headers[name];
+			if (value !== void 0) headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+		}
+		const method = (req.method ?? "GET").toUpperCase();
+		const hasBody = method !== "GET" && method !== "HEAD";
+		const controller = new AbortController();
+		res.on("close", () => controller.abort());
+		fetch(`${target}${url.slice(prefix.length) || "/"}`, {
+			body: hasBody ? Readable.toWeb(req) : void 0,
+			headers,
+			method,
+			redirect: "manual",
+			signal: controller.signal,
+			...hasBody ? { duplex: "half" } : {}
+		}).then(async (response) => {
+			res.statusCode = response.status;
+			const secure = isLtSecureRequest(req);
+			response.headers.forEach((value, name) => {
+				if (name === "location" || name === "content-location") res.setHeader(name, rewriteLtProxyLocation(value, target, prefix));
+				else if (!HOP_BY_HOP.has(name) && name !== "set-cookie") res.setHeader(name, value);
+			});
+			const cookies = response.headers.getSetCookie?.() ?? [];
+			if (cookies.length) res.setHeader("set-cookie", cookies.map((cookie) => rewriteLtProxyCookie(cookie, secure)));
+			if (!response.body) {
+				res.end();
+				return;
+			}
+			pipeline(Readable.fromWeb(response.body), res, () => void 0);
+		}).catch((error) => {
+			if (controller.signal.aborted) return;
+			console.error("[@lenne.tech/ng-base/server] API proxy error:", error);
+			res.statusCode = 502;
+			res.setHeader("content-type", "application/json");
+			res.end(JSON.stringify({ message: "API proxy error" }));
+		});
+	};
+}
+export { LT_HSTS_VALUE, LT_RUNTIME_FEATURE_KEYS, SECURITY_TXT_DEFAULT_CONTACT, SECURITY_TXT_DEFAULT_LANGUAGES, SECURITY_TXT_DEFAULT_VALID_DAYS, SECURITY_TXT_PATH, allowedRequestOrigin, applyLtHtmlCacheHeaders, buildLtSecurityHeaders, buildSecurityTxt as buildLtSecurityTxt, isLtSecureRequest, ltAngularRequestHandler, ltApiProxy, ltBuildIdentity, ltSecurityHeaders, ltSecurityTxt, normalizeSecurityTxtContacts, normalizeSecurityTxtList, normalizeSecurityTxtValidDays, parseLtEnvValue, provideLtServerRuntimeConfig, readLtRequestContext, readLtRuntimeConfigFromEnv, resolveLtBuildCommit, resolveSecurityTxt as resolveLtSecurityTxt, rewriteLtProxyCookie, rewriteLtProxyLocation, toLtEnvKey, toSecurityTxtOrigin, withLtRuntimeConfigScript };
+
+//# sourceMappingURL=lenne.tech-ng-base-server.mjs.map

package/fesm2022/lenne.tech-ng-base-server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lenne.tech-ng-base-server.mjs","names":["processEnv"],"sources":["../../../projects/ng-base/server/src/lib/security-txt.ts","../../../projects/ng-base/server/src/lib/runtime-env.ts","../../../projects/ng-base/server/src/lib/middlewares.ts","../../../projects/ng-base/server/src/lib/angular-handler.ts","../../../projects/ng-base/server/src/lib/api-proxy.ts"],"sourcesContent":["/**\n * security.txt according to RFC 9116, built per request.\n *\n * Ported from the lenne.Tech website (DEV-3602), where it has been live since 2026-10-13.\n * Pure functions only, so the route stays a thin adapter and everything that decides the\n * file's content is unit-testable without a Nitro context.\n */\n\nexport const SECURITY_TXT_PATH = '/.well-known/security.txt';\nexport const SECURITY_TXT_DEFAULT_CONTACT = 'mailto:security@lenne.tech';\nexport const SECURITY_TXT_DEFAULT_LANGUAGES = ['de', 'en'];\nexport const SECURITY_TXT_DEFAULT_VALID_DAYS = 180;\n/** RFC 9116 recommends an `Expires` less than a year away. */\nconst SECURITY_TXT_MAX_VALID_DAYS = 365;\n\nconst DAY_MS = 24 * 60 * 60 * 1000;\n\n/** RFC 9116 §2.5.3: a contact is a URI, and a web URI must be https. */\nconst CONTACT_URI = /^(?:mailto:|tel:|https:\\/\\/)\\S/i;\n\nexport interface SecurityTxtOptions {\n  /** Contact URIs (`mailto:`, `https:` or `tel:`), in order of preference. */\n  contacts: string[];\n  /** Point in time the file is built for; `Expires` is derived from it. */\n  now: Date;\n  /** Origins the file is served from; each becomes one `Canonical` line. */\n  origins: string[];\n  /** URI of the vulnerability disclosure policy, or a path resolved against the first origin. */\n  policy?: string;\n  /** Language tags in order of preference. */\n  preferredLanguages?: string[];\n  /** Days between `now` and `Expires`. */\n  validDays?: number;\n}\n\n/**\n * Keeps a configured value only if it is a single token. Every value ends up on a line of its\n * own, so a line break or blank inside one would forge an additional field.\n */\nfunction isSingleToken(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0 && !/\\s/.test(value);\n}\n\n/**\n * Normalises the configured contact(s). Accepts a string or an array (`ltSecurityTxt()` splits the comma-separated\n * runtime override `NG_LT_SECURITY_TXT_CONTACT`).\n *\n * Whatever is not a usable URI is dropped. `security@example.com` is the obvious typo, and scanners\n * treat the file it would produce as invalid; with no contact left, the route answers 404 instead.\n */\nexport function normalizeSecurityTxtContacts(contact: unknown): string[] {\n  const values = Array.isArray(contact) ? contact : [contact];\n  return values\n    .map((value) => (typeof value === 'string' ? value.trim() : value))\n    .filter(isSingleToken)\n    .filter((value) => CONTACT_URI.test(value));\n}\n\n/**\n * Normalises a list option (languages, hosts). A runtime override via an environment variable\n * arrives as a string, so `\"de, en\"` is accepted as well as `['de', 'en']`.\n */\nexport function normalizeSecurityTxtList(value: unknown): string[] {\n  const values = typeof value === 'string' ? value.split(',') : Array.isArray(value) ? value : [];\n  return values.map((entry) => (typeof entry === 'string' ? entry.trim() : entry)).filter(isSingleToken);\n}\n\n/**\n * Clamps `validDays` into the window RFC 9116 recommends. A non-finite or non-positive value\n * falls back to the default instead of producing an `Expires` in the past.\n */\nexport function normalizeSecurityTxtValidDays(validDays: unknown): number {\n  const days = Number(validDays);\n  if (!Number.isFinite(days) || days < 1) {\n    return SECURITY_TXT_DEFAULT_VALID_DAYS;\n  }\n  return Math.min(Math.floor(days), SECURITY_TXT_MAX_VALID_DAYS);\n}\n\n/**\n * Turns a configured site URL into an origin (`https://example.com`), dropping path, query and\n * trailing slash. Anything that is not an absolute http(s) URL yields `undefined`.\n */\nexport function toSecurityTxtOrigin(url: string | undefined): string | undefined {\n  if (!url) {\n    return undefined;\n  }\n  try {\n    const parsed = new URL(url);\n    return parsed.protocol === 'https:' || parsed.protocol === 'http:' ? parsed.origin : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Turns the requested host into an origin, but only if it is one the site is known to be served\n * from. The host comes from a request header, so anything else must not end up in the file.\n */\nexport function allowedRequestOrigin(host: string | undefined, allowedHosts: string[]): string | undefined {\n  const name = host?.trim().toLowerCase();\n  const allowed = allowedHosts.map((entry) => entry.trim().toLowerCase());\n  return name && allowed.includes(name) ? `https://${name}` : undefined;\n}\n\n/** Resolves a path against the first origin; absolute URIs pass through unchanged. */\nfunction resolveAgainstOrigin(value: string | undefined, origin: string | undefined): string | undefined {\n  if (!isSingleToken(value)) {\n    return undefined;\n  }\n  if (!value.startsWith('/')) {\n    return value;\n  }\n  return origin ? `${origin}${value}` : undefined;\n}\n\n/**\n * Builds a security.txt according to RFC 9116.\n *\n * `Expires` is relative to `now`, so a file built per request never goes stale, no matter how\n * long ago the last deployment was. It is cut to midnight UTC, which makes the file valid for up\n * to a day less than `validDays` and keeps it byte-identical for a whole day.\n */\nexport function buildSecurityTxt(options: SecurityTxtOptions): string {\n  const { contacts, now, origins, policy, preferredLanguages = [] } = options;\n  const validDays = normalizeSecurityTxtValidDays(options.validDays ?? SECURITY_TXT_DEFAULT_VALID_DAYS);\n  const expires = new Date(Math.floor((now.getTime() + validDays * DAY_MS) / DAY_MS) * DAY_MS);\n  const canonicals = [...new Set(origins.map((origin) => origin.replace(/\\/+$/, '')).filter(Boolean))];\n  const languages = preferredLanguages.map((language) => language.trim()).filter(isSingleToken);\n\n  const lines = [...contacts.filter(isSingleToken).map((contact) => `Contact: ${contact}`), `Expires: ${expires.toISOString()}`];\n  const policyUri = resolveAgainstOrigin(policy, canonicals[0]);\n  if (policyUri) {\n    lines.push(`Policy: ${policyUri}`);\n  }\n  if (languages.length) {\n    lines.push(`Preferred-Languages: ${languages.join(', ')}`);\n  }\n  for (const origin of canonicals) {\n    lines.push(`Canonical: ${origin}${SECURITY_TXT_PATH}`);\n  }\n\n  return `${lines.join('\\n')}\\n`;\n}\n\n/** The server-only runtime config the module writes to `runtimeConfig.ltExtensions.securityTxt`. */\nexport interface SecurityTxtRuntimeConfig {\n  contact?: string | string[];\n  hosts?: string | string[];\n  policy?: string;\n  preferredLanguages?: string | string[];\n  validDays?: number | string;\n}\n\n/**\n * Turns the runtime config and the request into the file's content, or `undefined` when no\n * usable contact is left (the route then answers 404).\n *\n * `Canonical` names the configured site URL and, in addition, the requested host if it is one of\n * the configured `hosts`. A site served under several hostnames without a redirect needs the\n * second line: RFC 9116 expects the URI a file was fetched from among its Canonical lines.\n */\nexport function resolveSecurityTxt(input: {\n  config: SecurityTxtRuntimeConfig | undefined;\n  now: Date;\n  requestHost: string | undefined;\n  siteUrl: string | undefined;\n}): string | undefined {\n  const config = input.config ?? {};\n  const contacts = normalizeSecurityTxtContacts(config.contact);\n  if (!contacts.length) {\n    return undefined;\n  }\n\n  const siteOrigin = toSecurityTxtOrigin(input.siteUrl);\n  const requestOrigin = allowedRequestOrigin(input.requestHost, normalizeSecurityTxtList(config.hosts));\n\n  return buildSecurityTxt({\n    contacts,\n    now: input.now,\n    origins: [siteOrigin, requestOrigin].filter((origin): origin is string => !!origin),\n    policy: config.policy,\n    preferredLanguages: normalizeSecurityTxtList(config.preferredLanguages),\n    validDays: normalizeSecurityTxtValidDays(config.validDays),\n  });\n}\n","import { makeEnvironmentProviders, type EnvironmentProviders } from '@angular/core';\nimport { LT_SERVER_RUNTIME_CONFIG, type LtPublicFeatureConfig, type LtRequestContext, type LtRuntimeConfig, type LtServerRuntimeConfig } from '@lenne.tech/ng-base';\n\n/** Environment map (`process.env` shape). */\nexport type LtEnv = Record<string, string | undefined>;\n\n/**\n * Feature options that may be overridden at runtime via `NG_PUBLIC_LT_<FEATURE>_<OPTION>` (camelCase ↔ SCREAMING_SNAKE).\n * Only listed keys are read, so an env name maps to exactly one option. Values are parsed by the type of the default:\n * booleans (`true`/`false`), numbers, string arrays (comma-separated), strings.\n */\nexport const LT_RUNTIME_FEATURE_KEYS: Readonly<Record<string, Readonly<Record<string, 'array' | 'boolean' | 'number' | 'string'>>>> = {\n  ai: { basePath: 'string' },\n  auth: { basePath: 'string', loginPath: 'string', twoFactorRedirectPath: 'string', enablePasskey: 'boolean', enableTwoFactor: 'boolean' },\n  bug: {\n    autoOpenOnError: 'boolean',\n    autoShow: 'boolean',\n    buttonColor: 'string',\n    buttonText: 'string',\n    enabled: 'boolean',\n    enableScreenshot: 'boolean',\n    position: 'string',\n  },\n  errorTranslation: { defaultLocale: 'string', enabled: 'boolean', preload: 'boolean' },\n  sync: { basePath: 'string' },\n  tus: { defaultChunkSize: 'number', defaultEndpoint: 'string', resolveAgainstApi: 'boolean' },\n};\n\n/** Nested auth keys (`NG_PUBLIC_LT_AUTH_SYSTEM_SETUP_ENABLED`, `…_INTERCEPTOR_PUBLIC_PATHS`, …). */\nconst LT_RUNTIME_NESTED_KEYS: Readonly<Record<string, Readonly<Record<string, Readonly<Record<string, 'array' | 'boolean' | 'number' | 'string'>>>>>> = {\n  auth: {\n    interceptor: { enabled: 'boolean', publicPaths: 'array' },\n    systemSetup: { enabled: 'boolean', setupPath: 'string' },\n  },\n};\n\n/** `loginPath` → `LOGIN_PATH`. */\nexport function toLtEnvKey(camel: string): string {\n  return camel.replace(/([a-z\\d])([A-Z])/g, '$1_$2').toUpperCase();\n}\n\n/**\n * Read the runtime configuration from the server environment (default `process.env`), the counterpart of Nuxt's\n * `NUXT_*` → `runtimeConfig` mapping:\n *\n * | Variable | Target |\n * |---|---|\n * | `NG_PUBLIC_API_URL` | `apiUrl` |\n * | `NG_API_URL` | `serverApiUrl` (SSR only, never transferred) |\n * | `NG_PUBLIC_SITE_URL` | `siteUrl` |\n * | `NG_PUBLIC_STORAGE_PREFIX` | `storagePrefix` |\n * | `NG_PUBLIC_COOKIE_PREFIX` | `cookiePrefix` |\n * | `NG_PUBLIC_API_PROXY` | `apiProxy` (`true`/`false`; unset = `null`) |\n * | `NG_PUBLIC_APP_ENV` | `appEnv` |\n * | `NG_PUBLIC_APP_COMMIT`, fallback `APP_VERSION_COMMIT` | `appCommit` |\n * | `NG_PUBLIC_APP_VERSION` | `appVersion` (or `options.appVersion`) |\n * | `NG_PUBLIC_LT_<FEATURE>_<OPTION>` | `lt.<feature>.<option>` (see {@link LT_RUNTIME_FEATURE_KEYS}) |\n *\n * Unset variables stay `undefined`, so code defaults keep applying.\n */\nexport function readLtRuntimeConfigFromEnv(env: LtEnv = processEnv(), options: LtRuntimeEnvOptions = {}): LtServerRuntimeConfig {\n  const value = (name: string) => {\n    const raw = env[name]?.trim();\n    return raw ? raw : undefined;\n  };\n  const lt: LtPublicFeatureConfig = {};\n  for (const [feature, keys] of Object.entries(LT_RUNTIME_FEATURE_KEYS)) {\n    const options: Record<string, unknown> = {};\n    for (const [key, type] of Object.entries(keys)) {\n      const parsed = parseLtEnvValue(value(`NG_PUBLIC_LT_${toLtEnvKey(feature)}_${toLtEnvKey(key)}`), type);\n      if (parsed !== undefined) {\n        options[key] = parsed;\n      }\n    }\n    for (const [group, groupKeys] of Object.entries(LT_RUNTIME_NESTED_KEYS[feature] ?? {})) {\n      const nested: Record<string, unknown> = {};\n      for (const [key, type] of Object.entries(groupKeys)) {\n        const parsed = parseLtEnvValue(value(`NG_PUBLIC_LT_${toLtEnvKey(feature)}_${toLtEnvKey(group)}_${toLtEnvKey(key)}`), type);\n        if (parsed !== undefined) {\n          nested[key] = parsed;\n        }\n      }\n      if (Object.keys(nested).length) {\n        options[group] = nested;\n      }\n    }\n    if (Object.keys(options).length) {\n      lt[feature] = options;\n    }\n  }\n  const apiProxy = parseLtEnvValue(value('NG_PUBLIC_API_PROXY'), 'boolean') as boolean | undefined;\n  const commit = [value('NG_PUBLIC_APP_COMMIT'), value('APP_VERSION_COMMIT')].find((candidate) => candidate && candidate !== 'unknown');\n  const publicConfig: Partial<LtRuntimeConfig> = {\n    apiProxy,\n    apiUrl: value('NG_PUBLIC_API_URL'),\n    appCommit: commit ?? 'unknown',\n    appEnv: value('NG_PUBLIC_APP_ENV'),\n    appVersion: options.appVersion ?? value('NG_PUBLIC_APP_VERSION'),\n    cookiePrefix: value('NG_PUBLIC_COOKIE_PREFIX'),\n    lt,\n    siteUrl: value('NG_PUBLIC_SITE_URL'),\n    storagePrefix: value('NG_PUBLIC_STORAGE_PREFIX'),\n  };\n  return { public: { ...publicConfig, ...options.extend?.(env) }, serverApiUrl: value('NG_API_URL') ?? '' };\n}\n\n/** Options of {@link readLtRuntimeConfigFromEnv} / {@link readLtRequestContext}. */\nexport interface LtRuntimeEnvOptions {\n  /** Version of the running build (e.g. from package.json); overrides `NG_PUBLIC_APP_VERSION`. */\n  appVersion?: string;\n  /** Additional public values of the project (e.g. `{ plausibleApiHost: env.NG_PUBLIC_PLAUSIBLE_API_HOST }`). */\n  extend?: (env: LtEnv) => Record<string, unknown>;\n}\n\n/**\n * Build the request context for `AngularNodeAppEngine.handle(req, context)` from the environment, per request (a\n * changed env needs no rebuild). Angular code reads it through `REQUEST_CONTEXT` (`LT_SERVER_RUNTIME_CONFIG`), and the\n * public part must be written into the HTML with `injectLtRuntimeConfigScript()` / `ltAngularRequestHandler()`.\n */\nexport function readLtRequestContext(env: LtEnv = processEnv(), options: LtRuntimeEnvOptions = {}): LtRequestContext {\n  const config = readLtRuntimeConfigFromEnv(env, options);\n  return { runtimeConfig: config.public, serverApiUrl: config.serverApiUrl };\n}\n\n/** Parse one env value by its option type (`undefined` for unset or unparsable values). */\nexport function parseLtEnvValue(raw: string | undefined, type: 'array' | 'boolean' | 'number' | 'string'): unknown {\n  if (raw === undefined) {\n    return undefined;\n  }\n  switch (type) {\n    case 'boolean':\n      return /^(true|1|yes|on)$/i.test(raw) ? true : /^(false|0|no|off)$/i.test(raw) ? false : undefined;\n    case 'number': {\n      // `Number('')` is 0: a blank value is unparsable, not zero.\n      const number = raw.trim() ? Number(raw) : Number.NaN;\n      return Number.isFinite(number) ? number : undefined;\n    }\n    case 'array':\n      return raw\n        .split(',')\n        .map((part) => part.trim())\n        .filter(Boolean);\n    default:\n      return raw;\n  }\n}\n\n/**\n * Alternative to the request context for servers that call `handle(req)` without one: reads the `NG_*` environment\n * at request time in the app (every SSR render bootstraps it) and provides `LT_SERVER_RUNTIME_CONFIG`. The browser\n * still needs `<script id=\"ng-runtime-config\">` in the HTML, so prefer `ltAngularRequestHandler()`, which does both.\n */\nexport function provideLtServerRuntimeConfig(env?: LtEnv | (() => LtEnv)): EnvironmentProviders {\n  return makeEnvironmentProviders([\n    {\n      provide: LT_SERVER_RUNTIME_CONFIG,\n      useFactory: () => readLtRuntimeConfigFromEnv(typeof env === 'function' ? env() : (env ?? processEnv())),\n    },\n  ]);\n}\n\nfunction processEnv(): LtEnv {\n  return (globalThis as { process?: { env?: LtEnv } }).process?.env ?? {};\n}\n","/// <reference types=\"node\" />\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\nimport { resolveSecurityTxt, SECURITY_TXT_DEFAULT_CONTACT, SECURITY_TXT_DEFAULT_LANGUAGES, SECURITY_TXT_DEFAULT_VALID_DAYS, SECURITY_TXT_PATH } from './security-txt';\nimport { readLtRuntimeConfigFromEnv, type LtEnv } from './runtime-env';\n\n/** Express-compatible middleware (`(req, res, next)`), also usable with plain `node:http`. */\nexport type LtNodeMiddleware = (req: IncomingMessage, res: ServerResponse, next: (error?: unknown) => void) => void;\n\nconst SECURITY_HEADERS: Readonly<Record<string, string>> = Object.freeze({\n  'Permissions-Policy': 'camera=(), microphone=(), geolocation=(), payment=()',\n  'Referrer-Policy': 'strict-origin',\n  'X-Content-Type-Options': 'nosniff',\n  'X-DNS-Prefetch-Control': 'off',\n  'X-Frame-Options': 'DENY',\n  'X-Permitted-Cross-Domain-Policies': 'none',\n});\n\n/** HSTS header value set on HTTPS requests. */\nexport const LT_HSTS_VALUE = 'max-age=31536000; includeSubDomains';\n\n/** Whether the request came in over HTTPS (`X-Forwarded-Proto` first, then the socket). */\nexport function isLtSecureRequest(req: Pick<IncomingMessage, 'headers'> & { socket?: unknown }): boolean {\n  const forwarded = headerValue(req.headers['x-forwarded-proto'])?.split(',')[0]?.trim().toLowerCase();\n  if (forwarded) {\n    return forwarded === 'https';\n  }\n  return !!(req.socket as { encrypted?: boolean } | undefined)?.encrypted;\n}\n\n/** The security headers for a request (same set as nuxt-base-starter; no CSP by design). */\nexport function buildLtSecurityHeaders(options: { secure: boolean }): Record<string, string> {\n  return options.secure ? { ...SECURITY_HEADERS, 'Strict-Transport-Security': LT_HSTS_VALUE } : { ...SECURITY_HEADERS };\n}\n\n/**\n * Security headers on every response: `nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin`,\n * `Permissions-Policy`, `X-DNS-Prefetch-Control: off`, `X-Permitted-Cross-Domain-Policies: none`, HSTS on HTTPS;\n * removes `X-Powered-By`; never overwrites a header a route already set.\n */\nexport function ltSecurityHeaders(): LtNodeMiddleware {\n  return (req, res, next) => {\n    res.removeHeader('X-Powered-By');\n    for (const [name, value] of Object.entries(buildLtSecurityHeaders({ secure: isLtSecureRequest(req) }))) {\n      if (!res.hasHeader(name)) {\n        res.setHeader(name, value);\n      }\n    }\n    next();\n  };\n}\n\n/**\n * Cache headers for SSR HTML: `Cache-Control: private, no-cache` and `Vary: Cookie` (the page depends on the auth\n * cookie), unless the response already has a `Cache-Control`. Apply it to the `Response` of `AngularNodeAppEngine.handle()`\n * before `writeResponseToNodeResponse()`. Returns whether the headers were set.\n */\nexport function applyLtHtmlCacheHeaders(response: Response): boolean {\n  if (!(response.headers.get('content-type') ?? '').includes('text/html') || response.headers.has('cache-control')) {\n    return false;\n  }\n  response.headers.set('cache-control', 'private, no-cache');\n  const vary = response.headers.get('vary');\n  response.headers.set('vary', vary ? `${vary}, Cookie` : 'Cookie');\n  return true;\n}\n\n/** Options of {@link ltSecurityTxt}. Values can be overridden per stage via `NG_LT_SECURITY_TXT_*`. */\nexport interface LtSecurityTxtHandlerOptions {\n  /** Contact URI(s) (`mailto:`, `https://`, `tel:`), default `mailto:security@lenne.tech`. Env `NG_LT_SECURITY_TXT_CONTACT` (comma-separated). */\n  contact?: string | string[];\n  /** Hostnames served without redirect; a request for one adds a second `Canonical` line. Env `NG_LT_SECURITY_TXT_HOSTS`. */\n  hosts?: string[];\n  /** Policy URI or path (resolved against the site URL). Env `NG_LT_SECURITY_TXT_POLICY`. */\n  policy?: string;\n  /** Language tags (default `de, en`). Env `NG_LT_SECURITY_TXT_PREFERRED_LANGUAGES`. */\n  preferredLanguages?: string[];\n  /** Site URL for `Canonical` (default `NG_PUBLIC_SITE_URL`). */\n  siteUrl?: string;\n  /** Days until `Expires` (default 180, max 365). Env `NG_LT_SECURITY_TXT_VALID_DAYS`. */\n  validDays?: number;\n  /** Environment to read the overrides from (default `process.env`). */\n  env?: LtEnv;\n}\n\n/**\n * Serve `/.well-known/security.txt` (RFC 9116), built per request: GET/HEAD, `text/plain`, `no-store`; 404 when no\n * valid contact is configured. Register it only where somebody reads the contact address.\n *\n * @example server.ts: app.use(ltSecurityTxt({ contact: 'mailto:security@customer.example' }))\n */\nexport function ltSecurityTxt(options: LtSecurityTxtHandlerOptions = {}): LtNodeMiddleware {\n  return (req, res, next) => {\n    const path = (req.url ?? '').split('?')[0];\n    if (path !== SECURITY_TXT_PATH || (req.method !== 'GET' && req.method !== 'HEAD')) {\n      next();\n      return;\n    }\n    const env = options.env ?? processEnv();\n    const fromEnv = (name: string) => (env[name] === undefined || env[name] === '' ? undefined : env[name]);\n    const body = resolveSecurityTxt({\n      config: {\n        contact: fromEnv('NG_LT_SECURITY_TXT_CONTACT')?.split(',') ?? options.contact ?? SECURITY_TXT_DEFAULT_CONTACT,\n        hosts: fromEnv('NG_LT_SECURITY_TXT_HOSTS') ?? options.hosts ?? [],\n        policy: fromEnv('NG_LT_SECURITY_TXT_POLICY') ?? options.policy,\n        preferredLanguages: fromEnv('NG_LT_SECURITY_TXT_PREFERRED_LANGUAGES') ?? options.preferredLanguages ?? SECURITY_TXT_DEFAULT_LANGUAGES,\n        validDays: fromEnv('NG_LT_SECURITY_TXT_VALID_DAYS') ?? options.validDays ?? SECURITY_TXT_DEFAULT_VALID_DAYS,\n      },\n      now: new Date(),\n      requestHost: headerValue(req.headers['x-forwarded-host'])?.split(',')[0]?.trim() || headerValue(req.headers.host),\n      siteUrl: options.siteUrl ?? readLtRuntimeConfigFromEnv(env).public.siteUrl,\n    });\n    if (!body) {\n      res.statusCode = 404;\n      res.setHeader('content-type', 'text/plain; charset=utf-8');\n      res.end('Not Found');\n      return;\n    }\n    res.statusCode = 200;\n    res.setHeader('content-type', 'text/plain; charset=utf-8');\n    res.setHeader('cache-control', 'no-store');\n    res.end(req.method === 'HEAD' ? undefined : body);\n  };\n}\n\n/** Options of {@link ltBuildIdentity}. */\nexport interface LtBuildIdentityOptions {\n  /** Route (default `/api/build-identity`). */\n  path?: string;\n  /** App version (default `NG_PUBLIC_APP_VERSION`, else `0.0.0`). */\n  version?: string;\n  /** Environment (default `process.env`). */\n  env?: LtEnv;\n}\n\n/** Commit of the running build: `NG_PUBLIC_APP_COMMIT`, else `APP_VERSION_COMMIT` (TurboOps), else `unknown`. */\nexport function resolveLtBuildCommit(env: LtEnv = processEnv()): string {\n  for (const candidate of [env['NG_PUBLIC_APP_COMMIT'], env['APP_VERSION_COMMIT']]) {\n    if (typeof candidate === 'string' && candidate.trim() && candidate !== 'unknown') {\n      return candidate;\n    }\n  }\n  return 'unknown';\n}\n\n/** `GET /api/build-identity` → `{ commit, version }` (no-store), used by the admin system page to detect drift. */\nexport function ltBuildIdentity(options: LtBuildIdentityOptions = {}): LtNodeMiddleware {\n  const path = options.path ?? '/api/build-identity';\n  return (req, res, next) => {\n    if ((req.url ?? '').split('?')[0] !== path || req.method !== 'GET') {\n      next();\n      return;\n    }\n    const env = options.env ?? processEnv();\n    res.statusCode = 200;\n    res.setHeader('content-type', 'application/json; charset=utf-8');\n    res.setHeader('cache-control', 'no-store');\n    res.end(JSON.stringify({ commit: resolveLtBuildCommit(env), version: options.version ?? env['NG_PUBLIC_APP_VERSION'] ?? '0.0.0' }));\n  };\n}\n\nfunction headerValue(value: string | string[] | undefined): string | undefined {\n  return Array.isArray(value) ? value[0] : value;\n}\n\nfunction processEnv(): LtEnv {\n  return (globalThis as { process?: { env?: LtEnv } }).process?.env ?? {};\n}\n","/// <reference types=\"node\" />\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\nimport { writeResponseToNodeResponse } from '@angular/ssr/node';\nimport { injectLtRuntimeConfigScript, type LtRequestContext, type LtRuntimeConfig } from '@lenne.tech/ng-base';\n\nimport type { LtNodeMiddleware } from './middlewares';\nimport { applyLtHtmlCacheHeaders } from './middlewares';\nimport { readLtRequestContext, type LtEnv, type LtRuntimeEnvOptions } from './runtime-env';\n\n/** The part of `AngularNodeAppEngine` the handler needs. */\nexport interface LtAngularEngine {\n  handle(request: IncomingMessage, requestContext?: unknown): Promise<Response | null>;\n}\n\n/** Options of {@link ltAngularRequestHandler}. */\nexport interface LtAngularRequestHandlerOptions extends LtRuntimeEnvOptions {\n  /** Set `Cache-Control: private, no-cache` + `Vary: Cookie` on HTML without own cache header (default `true`). */\n  htmlNoCache?: boolean;\n  /** Write the pre-hydration submit guard into the HTML (default `true`, see `LT_PRE_HYDRATION_SUBMIT_GUARD_SCRIPT`). */\n  submitGuard?: boolean;\n  /** Environment (default `process.env`, read per request). */\n  env?: LtEnv;\n}\n\n/**\n * Write the public runtime configuration as `<script id=\"ng-runtime-config\">` into an HTML response (SSR and\n * client-rendered routes alike). Non-HTML responses are returned unchanged.\n */\nexport async function withLtRuntimeConfigScript(response: Response, config: Partial<LtRuntimeConfig>, options: { submitGuard?: boolean } = {}): Promise<Response> {\n  if (!(response.headers.get('content-type') ?? '').includes('text/html')) {\n    return response;\n  }\n  const html = injectLtRuntimeConfigScript(await response.text(), config, options);\n  const headers = new Headers(response.headers);\n  headers.delete('content-length');\n  return new Response(html, { headers, status: response.status, statusText: response.statusText });\n}\n\n/**\n * The Angular render handler for `server.ts`: per request it reads the `NG_*` environment into an\n * {@link LtRequestContext}, renders with `engine.handle(req, context)`, adds the HTML cache headers and the runtime\n * config script, and writes the response. Unhandled requests go to `next()`.\n *\n * @example server.ts\n * app.use(ltAngularRequestHandler(new AngularNodeAppEngine(), { appVersion: packageJson.version }));\n */\nexport function ltAngularRequestHandler(engine: LtAngularEngine, options: LtAngularRequestHandlerOptions = {}): LtNodeMiddleware {\n  return (req: IncomingMessage, res: ServerResponse, next) => {\n    const context: LtRequestContext = readLtRequestContext(options.env, options);\n    engine\n      .handle(req, context)\n      .then(async (response) => {\n        if (!response) {\n          next();\n          return;\n        }\n        if (options.htmlNoCache !== false) {\n          applyLtHtmlCacheHeaders(response);\n        }\n        await writeResponseToNodeResponse(await withLtRuntimeConfigScript(response, context.runtimeConfig, { submitGuard: options.submitGuard }), res);\n      })\n      .catch(next);\n  };\n}\n","/// <reference types=\"node\" />\nimport { pipeline, Readable } from 'node:stream';\n\nimport { isLtSecureRequest, type LtNodeMiddleware } from './middlewares';\nimport { readLtRuntimeConfigFromEnv, type LtEnv } from './runtime-env';\n\n/** Options of {@link ltApiProxy}. */\nexport interface LtApiProxyOptions {\n  /**\n   * Serve the proxy (default: only when `NG_PUBLIC_API_PROXY=true`). On deployed stages the browser talks to the API\n   * directly; the proxy is for same-origin cookies and WebAuthn on `localhost` (SSR dev server, `lt dev`, E2E).\n   */\n  enabled?: boolean;\n  /** Environment (default `process.env`). */\n  env?: LtEnv;\n  /** Path prefix that is stripped (default `/api`). */\n  prefix?: string;\n  /** Target API (default `NG_API_URL`, then `NG_PUBLIC_API_URL`). */\n  target?: string;\n}\n\nconst FORWARDED_REQUEST_HEADERS = [\n  'accept',\n  'accept-language',\n  'authorization',\n  'content-type',\n  'cookie',\n  'origin',\n  'referer',\n  'user-agent',\n  'x-file-id',\n  'x-system-setup-token',\n  'x-tenant-id',\n  'tus-resumable',\n  'upload-length',\n  'upload-metadata',\n  'upload-offset',\n  'upload-concat',\n  'upload-defer-length',\n];\nconst HOP_BY_HOP = new Set([\n  'connection',\n  'content-encoding',\n  'content-length',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/**\n * Rewrite a backend `Set-Cookie` for the app origin: drop `Domain`, drop `Secure` on plain HTTP, force `Path=/`.\n * Without it the session cookie of `localhost:3000` never reaches the app on `localhost:3001`.\n */\nexport function rewriteLtProxyCookie(cookie: string, secure: boolean): string {\n  const [pair = '', ...attributes] = cookie.split(';').map((part) => part.trim());\n  const kept = attributes.filter((part) => part && !/^domain=/i.test(part) && !/^path=/i.test(part) && (secure || !/^secure$/i.test(part)));\n  // Always `Path=/`: without one the browser scopes the cookie to the directory of the proxied URL (e.g. `/api/iam`).\n  return [pair, 'Path=/', ...kept].join('; ');\n}\n\n/**\n * Rewrite a backend `Location` / `Content-Location` for the browser: a URL on the proxy target (`http://api:3000/tus/1`)\n * or an API path (`/tus/1`) becomes the proxied path (`/api/tus/1`); other origins (OAuth redirects) stay unchanged.\n * Without it a TUS upload continues against the internal `NG_API_URL`, which the browser can neither reach nor should\n * ever learn.\n */\nexport function rewriteLtProxyLocation(location: string, target: string, prefix: string): string {\n  if (location.startsWith('/') && !location.startsWith('//')) {\n    return `${prefix}${location}`;\n  }\n  try {\n    const url = new URL(location);\n    const base = new URL(target);\n    if (url.origin !== base.origin) {\n      return location;\n    }\n    const basePath = base.pathname.replace(/\\/+$/, '');\n    const path = basePath && url.pathname.startsWith(`${basePath}/`) ? url.pathname.slice(basePath.length) : url.pathname;\n    return `${prefix}${path}${url.search}${url.hash}`;\n  } catch {\n    return location;\n  }\n}\n\n/**\n * Same-origin API proxy for the Angular SSR server: `/api/<path>` → `<target>/<path>` (method, body and the auth\n * headers forwarded, streaming both ways, `Set-Cookie` rewritten). The counterpart of nuxt-base-starter's\n * `server/api/iam/[...path].ts`, covering every API path (auth, TUS, AI SSE, sync).\n *\n * `ng serve` uses `proxy.conf.mjs` instead; this is for the built server (`.output/server/index.mjs`).\n */\nexport function ltApiProxy(options: LtApiProxyOptions = {}): LtNodeMiddleware {\n  const prefix = (options.prefix ?? '/api').replace(/\\/+$/, '');\n  return (req, res, next) => {\n    const url = req.url ?? '';\n    if (url !== prefix && !url.startsWith(`${prefix}/`) && !url.startsWith(`${prefix}?`)) {\n      next();\n      return;\n    }\n    const env = options.env ?? (globalThis as { process?: { env?: LtEnv } }).process?.env ?? {};\n    const runtime = readLtRuntimeConfigFromEnv(env);\n    const enabled = options.enabled ?? runtime.public.apiProxy === true;\n    const target = (options.target ?? (runtime.serverApiUrl || runtime.public.apiUrl || '')).replace(/\\/+$/, '');\n    if (!enabled || !target) {\n      next();\n      return;\n    }\n    const headers = new Headers();\n    for (const name of FORWARDED_REQUEST_HEADERS) {\n      const value = req.headers[name];\n      if (value !== undefined) {\n        headers.set(name, Array.isArray(value) ? value.join(', ') : value);\n      }\n    }\n    const method = (req.method ?? 'GET').toUpperCase();\n    const hasBody = method !== 'GET' && method !== 'HEAD';\n    const controller = new AbortController();\n    res.on('close', () => controller.abort());\n    fetch(`${target}${url.slice(prefix.length) || '/'}`, {\n      body: hasBody ? (Readable.toWeb(req) as unknown as BodyInit) : undefined,\n      headers,\n      method,\n      redirect: 'manual',\n      signal: controller.signal,\n      ...(hasBody ? { duplex: 'half' } : {}),\n    } as RequestInit)\n      .then(async (response) => {\n        res.statusCode = response.status;\n        const secure = isLtSecureRequest(req);\n        response.headers.forEach((value, name) => {\n          if (name === 'location' || name === 'content-location') {\n            res.setHeader(name, rewriteLtProxyLocation(value, target, prefix));\n          } else if (!HOP_BY_HOP.has(name) && name !== 'set-cookie') {\n            res.setHeader(name, value);\n          }\n        });\n        const cookies = response.headers.getSetCookie?.() ?? [];\n        if (cookies.length) {\n          res.setHeader(\n            'set-cookie',\n            cookies.map((cookie) => rewriteLtProxyCookie(cookie, secure)),\n          );\n        }\n        if (!response.body) {\n          res.end();\n          return;\n        }\n        // pipeline(), not pipe(): a client that leaves mid-stream (SSE, AI stop, navigation) aborts the upstream body,\n        // and that error must end this response instead of crashing the process as an unhandled 'error' event.\n        pipeline(Readable.fromWeb(response.body as never), res, () => undefined);\n      })\n      .catch((error: unknown) => {\n        if (controller.signal.aborted) {\n          return;\n        }\n        // The cause may carry the internal NG_API_URL (e.g. \"Failed to parse URL from …\"): server log only.\n        console.error('[@lenne.tech/ng-base/server] API proxy error:', error);\n        res.statusCode = 502;\n        res.setHeader('content-type', 'application/json');\n        res.end(JSON.stringify({ message: 'API proxy error' }));\n      });\n  };\n}\n"],"mappings":";;;;AAQA,MAAa,oBAAoB;AACjC,MAAa,+BAA+B;AAC5C,MAAa,iCAAiC,CAAC,MAAM,IAAI;AACzD,MAAa,kCAAkC;AAE/C,MAAM,8BAA8B;AAEpC,MAAM,SAAS;AAGf,MAAM,cAAc;AAqBpB,SAAS,cAAc,OAAc;CACnC,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,CAAC,KAAK,KAAK,KAAK;AAC1E;AASA,SAAgB,6BAA6B,SAAgB;CAE3D,QADe,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO,EACnD,CACJ,KAAK,UAAW,OAAO,UAAU,WAAW,MAAM,KAAI,IAAK,KAAM,CAAC,CAClE,OAAO,aAAa,CAAC,CACrB,QAAQ,UAAU,YAAY,KAAK,KAAK,CAAC;AAC9C;AAMA,SAAgB,yBAAyB,OAAc;CAErD,QADe,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAI,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA,EACtF,CAAO,KAAK,UAAW,OAAO,UAAU,WAAW,MAAM,KAAI,IAAK,KAAM,CAAC,CAAC,OAAO,aAAa;AACvG;AAMA,SAAgB,8BAA8B,WAAkB;CAC9D,MAAM,OAAO,OAAO,SAAS;CAC7B,IAAI,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,GACnC,OAAA;CAEF,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,GAAG,2BAA2B;AAC/D;AAMA,SAAgB,oBAAoB,KAAuB;CACzD,IAAI,CAAC,KACH;CAEF,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,OAAO,OAAO,aAAa,YAAY,OAAO,aAAa,UAAU,OAAO,SAAS;CACvF,QAAQ;EACN;CACF;AACF;AAMA,SAAgB,qBAAqB,MAA0B,cAAsB;CACnF,MAAM,OAAO,MAAM,KAAI,CAAE,CAAC,YAAW;CACrC,MAAM,UAAU,aAAa,KAAK,UAAU,MAAM,KAAI,CAAE,CAAC,YAAW,CAAE;CACtE,OAAO,QAAQ,QAAQ,SAAS,IAAI,IAAI,WAAW,SAAS;AAC9D;AAGA,SAAS,qBAAqB,OAA2B,QAA0B;CACjF,IAAI,CAAC,cAAc,KAAK,GACtB;CAEF,IAAI,CAAC,MAAM,WAAW,GAAG,GACvB,OAAO;CAET,OAAO,SAAS,GAAG,SAAS,UAAU;AACxC;AASA,SAAgB,iBAAiB,SAA2B;CAC1D,MAAM,EAAE,UAAU,KAAK,SAAS,QAAQ,qBAAqB,CAAA,MAAO;CACpE,MAAM,YAAY,8BAA8B,QAAQ,aAAA,GAA4C;CACpG,MAAM,0BAAU,IAAI,KAAK,KAAK,OAAO,IAAI,QAAO,IAAK,YAAY,UAAU,MAAM,IAAI,MAAM;CAC3F,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,QAAQ,KAAK,WAAW,OAAO,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC;CACnG,MAAM,YAAY,mBAAmB,KAAK,aAAa,SAAS,KAAI,CAAE,CAAC,CAAC,OAAO,aAAa;CAE5F,MAAM,QAAQ,CAAC,GAAG,SAAS,OAAO,aAAa,CAAC,CAAC,KAAK,YAAY,YAAY,SAAS,GAAG,YAAY,QAAQ,YAAW,GAAI;CAC7H,MAAM,YAAY,qBAAqB,QAAQ,WAAW,EAAE;CAC5D,IAAI,WACF,MAAM,KAAK,WAAW,WAAW;CAEnC,IAAI,UAAU,QACZ,MAAM,KAAK,wBAAwB,UAAU,KAAK,IAAI,GAAG;CAE3D,KAAK,MAAM,UAAU,YACnB,MAAM,KAAK,cAAc,SAAS,mBAAmB;CAGvD,OAAO,GAAG,MAAM,KAAK,IAAI,EAAC;AAC5B;AAmBA,SAAgB,mBAAmB,OAKlC;CACC,MAAM,SAAS,MAAM,UAAU,CAAA;CAC/B,MAAM,WAAW,6BAA6B,OAAO,OAAO;CAC5D,IAAI,CAAC,SAAS,QACZ;CAGF,MAAM,aAAa,oBAAoB,MAAM,OAAO;CACpD,MAAM,gBAAgB,qBAAqB,MAAM,aAAa,yBAAyB,OAAO,KAAK,CAAC;CAEpG,OAAO,iBAAiB;EACtB;EACA,KAAK,MAAM;EACX,SAAS,CAAC,YAAY,aAAa,CAAC,CAAC,QAAQ,WAA6B,CAAC,CAAC,MAAM;EAClF,QAAQ,OAAO;EACf,oBAAoB,yBAAyB,OAAO,kBAAkB;EACtE,WAAW,8BAA8B,OAAO,SAAS;CAC1D,CAAA;AACH;AC9KA,MAAa,0BAAyH;CACpI,IAAI,EAAE,UAAU,SAAQ;CACxB,MAAM;EAAE,UAAU;EAAU,WAAW;EAAU,uBAAuB;EAAU,eAAe;EAAW,iBAAiB;CAAS;CACtI,KAAK;EACH,iBAAiB;EACjB,UAAU;EACV,aAAa;EACb,YAAY;EACZ,SAAS;EACT,kBAAkB;EAClB,UAAU;CACX;CACD,kBAAkB;EAAE,eAAe;EAAU,SAAS;EAAW,SAAS;CAAS;CACnF,MAAM,EAAE,UAAU,SAAQ;CAC1B,KAAK;EAAE,kBAAkB;EAAU,iBAAiB;EAAU,mBAAmB;CAAS;AAC3F;AAGD,MAAM,yBAAkJ,EACtJ,MAAM;CACJ,aAAa;EAAE,SAAS;EAAW,aAAa;CAAO;CACvD,aAAa;EAAE,SAAS;EAAW,WAAW;CAAQ;AACvD,EACF;AAGD,SAAgB,WAAW,OAAa;CACtC,OAAO,MAAM,QAAQ,qBAAqB,OAAO,CAAC,CAAC,YAAW;AAChE;AAqBA,SAAgB,2BAA2B,MAAaA,aAAU,GAAI,UAA+B,CAAA,GAAE;CACrG,MAAM,SAAS,SAAgB;EAC7B,MAAM,MAAM,IAAI,KAAK,EAAE,KAAI;EAC3B,OAAO,MAAM,MAAM;CACrB;CACA,MAAM,KAA4B,CAAA;CAClC,KAAK,MAAM,CAAC,SAAS,SAAS,OAAO,QAAQ,uBAAuB,GAAG;EACrE,MAAM,UAAmC,CAAA;EACzC,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,IAAI,GAAG;GAC9C,MAAM,SAAS,gBAAgB,MAAM,gBAAgB,WAAW,OAAO,EAAC,GAAI,WAAW,GAAG,GAAG,GAAG,IAAI;GACpG,IAAI,WAAW,QACb,QAAQ,OAAO;EAEnB;EACA,KAAK,MAAM,CAAC,OAAO,cAAc,OAAO,QAAQ,uBAAuB,YAAY,CAAA,CAAE,GAAG;GACtF,MAAM,SAAkC,CAAA;GACxC,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,SAAS,GAAG;IACnD,MAAM,SAAS,gBAAgB,MAAM,gBAAgB,WAAW,OAAO,EAAC,GAAI,WAAW,KAAK,EAAC,GAAI,WAAW,GAAG,GAAG,GAAG,IAAI;IACzH,IAAI,WAAW,QACb,OAAO,OAAO;GAElB;GACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,QACtB,QAAQ,SAAS;EAErB;EACA,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,QACvB,GAAG,WAAW;CAElB;CACA,MAAM,WAAW,gBAAgB,MAAM,qBAAqB,GAAG,SAAS;CACxE,MAAM,SAAS,CAAC,MAAM,sBAAsB,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,MAAM,cAAc,aAAa,cAAc,SAAS;CAYpI,OAAO;EAAE,QAAQ;GAVf;GACA,QAAQ,MAAM,mBAAmB;GACjC,WAAW,UAAU;GACrB,QAAQ,MAAM,mBAAmB;GACjC,YAAY,QAAQ,cAAc,MAAM,uBAAuB;GAC/D,cAAc,MAAM,yBAAyB;GAC7C;GACA,SAAS,MAAM,oBAAoB;GACnC,eAAe,MAAM,0BAA0B;GAEb,GAAG,QAAQ,SAAS,GAAG;EAAC;EAAI,cAAc,MAAM,YAAY,KAAK;CAAE;AACzG;AAeA,SAAgB,qBAAqB,MAAaA,aAAU,GAAI,UAA+B,CAAA,GAAE;CAC/F,MAAM,SAAS,2BAA2B,KAAK,OAAO;CACtD,OAAO;EAAE,eAAe,OAAO;EAAQ,cAAc,OAAO;CAAY;AAC1E;AAGA,SAAgB,gBAAgB,KAAyB,MAA+C;CACtG,IAAI,QAAQ,QACV;CAEF,QAAQ,MAAR;EACE,KAAK,WACH,OAAO,qBAAqB,KAAK,GAAG,IAAI,OAAO,sBAAsB,KAAK,GAAG,IAAI,QAAQ;EAC3F,KAAK,UAAU;GAEb,MAAM,SAAS,IAAI,KAAI,IAAK,OAAO,GAAG,IAAI;GAC1C,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;EAC5C;EACA,KAAK,SACH,OAAO,IACJ,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAI,CAAE,CAAC,CAC1B,OAAO,OAAO;EACnB,SACE,OAAO;CACX;AACF;AAOA,SAAgB,6BAA6B,KAA2B;CACtE,OAAO,yBAAyB,CAC9B;EACE,SAAS;EACT,kBAAkB,2BAA2B,OAAO,QAAQ,aAAa,IAAG,IAAM,OAAOA,aAAU,CAAG;CACvG,CACF,CAAA;AACH;AAEA,SAASA,eAAU;CACjB,OAAQ,WAA6C,SAAS,OAAO,CAAA;AACvE;AC1JA,MAAM,mBAAqD,OAAO,OAAO;CACvE,sBAAsB;CACtB,mBAAmB;CACnB,0BAA0B;CAC1B,0BAA0B;CAC1B,mBAAmB;CACnB,qCAAqC;AACtC,CAAA;AAGD,MAAa,gBAAgB;AAG7B,SAAgB,kBAAkB,KAA4D;CAC5F,MAAM,YAAY,YAAY,IAAI,QAAQ,oBAAoB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAI,CAAE,CAAC,YAAW;CAClG,IAAI,WACF,OAAO,cAAc;CAEvB,OAAO,CAAC,CAAE,IAAI,QAAgD;AAChE;AAGA,SAAgB,uBAAuB,SAA4B;CACjE,OAAO,QAAQ,SAAS;EAAE,GAAG;EAAkB,6BAA6B;CAAa,IAAK,EAAE,GAAG,iBAAgB;AACrH;AAOA,SAAgB,oBAAiB;CAC/B,QAAQ,KAAK,KAAK,SAAQ;EACxB,IAAI,aAAa,cAAc;EAC/B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,uBAAuB,EAAE,QAAQ,kBAAkB,GAAG,EAAC,CAAE,CAAC,GACnG,IAAI,CAAC,IAAI,UAAU,IAAI,GACrB,IAAI,UAAU,MAAM,KAAK;EAG7B,KAAI;CACN;AACF;AAOA,SAAgB,wBAAwB,UAAkB;CACxD,IAAI,EAAE,SAAS,QAAQ,IAAI,cAAc,KAAK,GAAA,CAAI,SAAS,WAAW,KAAK,SAAS,QAAQ,IAAI,eAAe,GAC7G,OAAO;CAET,SAAS,QAAQ,IAAI,iBAAiB,mBAAmB;CACzD,MAAM,OAAO,SAAS,QAAQ,IAAI,MAAM;CACxC,SAAS,QAAQ,IAAI,QAAQ,OAAO,GAAG,KAAI,YAAa,QAAQ;CAChE,OAAO;AACT;AA0BA,SAAgB,cAAc,UAAuC,CAAA,GAAE;CACrE,QAAQ,KAAK,KAAK,SAAQ;EAExB,KADc,IAAI,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OACpC,+BAA+B,IAAI,WAAW,SAAS,IAAI,WAAW,QAAS;GACjF,KAAI;GACJ;EACF;EACA,MAAM,MAAM,QAAQ,OAAO,WAAU;EACrC,MAAM,WAAW,SAAkB,IAAI,UAAU,UAAa,IAAI,UAAU,KAAK,SAAY,IAAI;EACjG,MAAM,OAAO,mBAAmB;GAC9B,QAAQ;IACN,SAAS,QAAQ,4BAA4B,CAAC,EAAE,MAAM,GAAG,KAAK,QAAQ,WAAA;IACtE,OAAO,QAAQ,0BAA0B,KAAK,QAAQ,SAAS,CAAA;IAC/D,QAAQ,QAAQ,2BAA2B,KAAK,QAAQ;IACxD,oBAAoB,QAAQ,wCAAwC,KAAK,QAAQ,sBAAsB;IACvG,WAAW,QAAQ,+BAA+B,KAAK,QAAQ,aAAA;GAChE;GACD,qBAAK,IAAI,KAAI;GACb,aAAa,YAAY,IAAI,QAAQ,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAI,KAAM,YAAY,IAAI,QAAQ,IAAI;GAChH,SAAS,QAAQ,WAAW,2BAA2B,GAAG,CAAC,CAAC,OAAO;EACpE,CAAA;EACD,IAAI,CAAC,MAAM;GACT,IAAI,aAAa;GACjB,IAAI,UAAU,gBAAgB,2BAA2B;GACzD,IAAI,IAAI,WAAW;GACnB;EACF;EACA,IAAI,aAAa;EACjB,IAAI,UAAU,gBAAgB,2BAA2B;EACzD,IAAI,UAAU,iBAAiB,UAAU;EACzC,IAAI,IAAI,IAAI,WAAW,SAAS,SAAY,IAAI;CAClD;AACF;AAaA,SAAgB,qBAAqB,MAAa,WAAU,GAAE;CAC5D,KAAK,MAAM,aAAa,CAAC,IAAI,yBAAyB,IAAI,qBAAqB,GAC7E,IAAI,OAAO,cAAc,YAAY,UAAU,KAAI,KAAM,cAAc,WACrE,OAAO;CAGX,OAAO;AACT;AAGA,SAAgB,gBAAgB,UAAkC,CAAA,GAAE;CAClE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,QAAQ,KAAK,KAAK,SAAQ;EACxB,KAAK,IAAI,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,QAAQ,IAAI,WAAW,OAAO;GAClE,KAAI;GACJ;EACF;EACA,MAAM,MAAM,QAAQ,OAAO,WAAU;EACrC,IAAI,aAAa;EACjB,IAAI,UAAU,gBAAgB,iCAAiC;EAC/D,IAAI,UAAU,iBAAiB,UAAU;EACzC,IAAI,IAAI,KAAK,UAAU;GAAE,QAAQ,qBAAqB,GAAG;GAAG,SAAS,QAAQ,WAAW,IAAI,4BAA4B;EAAO,CAAE,CAAC;CACpI;AACF;AAEA,SAAS,YAAY,OAAoC;CACvD,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;AAC3C;AAEA,SAAS,aAAU;CACjB,OAAQ,WAA6C,SAAS,OAAO,CAAA;AACvE;AC1IA,eAAsB,0BAA0B,UAAoB,QAAkC,UAAqC,CAAA,GAAE;CAC3I,IAAI,EAAE,SAAS,QAAQ,IAAI,cAAc,KAAK,GAAA,CAAI,SAAS,WAAW,GACpE,OAAO;CAET,MAAM,OAAO,4BAA4B,MAAM,SAAS,KAAI,GAAI,QAAQ,OAAO;CAC/E,MAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;CAC5C,QAAQ,OAAO,gBAAgB;CAC/B,OAAO,IAAI,SAAS,MAAM;EAAE;EAAS,QAAQ,SAAS;EAAQ,YAAY,SAAS;CAAU,CAAE;AACjG;AAUA,SAAgB,wBAAwB,QAAyB,UAA0C,CAAA,GAAE;CAC3G,QAAQ,KAAsB,KAAqB,SAAQ;EACzD,MAAM,UAA4B,qBAAqB,QAAQ,KAAK,OAAO;EAC3E,OACG,OAAO,KAAK,OAAO,CAAC,CACpB,KAAK,OAAO,aAAY;GACvB,IAAI,CAAC,UAAU;IACb,KAAI;IACJ;GACF;GACA,IAAI,QAAQ,gBAAgB,OAC1B,wBAAwB,QAAQ;GAElC,MAAM,4BAA4B,MAAM,0BAA0B,UAAU,QAAQ,eAAe,EAAE,aAAa,QAAQ,YAAW,CAAE,GAAG,GAAG;EAC/I,CAAC,CAAC,CACD,MAAM,IAAI;CACf;AACF;AC3CA,MAAM,4BAA4B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;AACD,MAAM,6BAAa,IAAI,IAAI;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAA;AAMD,SAAgB,qBAAqB,QAAgB,QAAe;CAClE,MAAM,CAAC,OAAO,IAAI,GAAG,cAAc,OAAO,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,KAAI,CAAE;CAG9E,OAAO;EAAC;EAAM;EAAU,GAFX,WAAW,QAAQ,SAAS,QAAQ,CAAC,YAAY,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,MAAM,UAAU,CAAC,YAAY,KAAK,IAAI,EAE3G;CAAI,CAAC,CAAC,KAAK,IAAI;AAC5C;AAQA,SAAgB,uBAAuB,UAAkB,QAAgB,QAAc;CACrF,IAAI,SAAS,WAAW,GAAG,KAAK,CAAC,SAAS,WAAW,IAAI,GACvD,OAAO,GAAG,SAAS;CAErB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,MAAM,OAAO,IAAI,IAAI,MAAM;EAC3B,IAAI,IAAI,WAAW,KAAK,QACtB,OAAO;EAET,MAAM,WAAW,KAAK,SAAS,QAAQ,QAAQ,EAAE;EAEjD,OAAO,GAAG,SADG,YAAY,IAAI,SAAS,WAAW,GAAG,SAAQ,EAAG,IAAI,IAAI,SAAS,MAAM,SAAS,MAAM,IAAI,IAAI,WACnF,IAAI,SAAS,IAAI;CAC7C,QAAQ;EACN,OAAO;CACT;AACF;AASA,SAAgB,WAAW,UAA6B,CAAA,GAAE;CACxD,MAAM,UAAU,QAAQ,UAAU,OAAA,CAAQ,QAAQ,QAAQ,EAAE;CAC5D,QAAQ,KAAK,KAAK,SAAQ;EACxB,MAAM,MAAM,IAAI,OAAO;EACvB,IAAI,QAAQ,UAAU,CAAC,IAAI,WAAW,GAAG,OAAM,EAAG,KAAK,CAAC,IAAI,WAAW,GAAG,OAAM,EAAG,GAAG;GACpF,KAAI;GACJ;EACF;EAEA,MAAM,UAAU,2BADJ,QAAQ,OAAQ,WAA6C,SAAS,OAAO,CAAA,CAC3C;EAC9C,MAAM,UAAU,QAAQ,WAAW,QAAQ,OAAO,aAAa;EAC/D,MAAM,UAAU,QAAQ,WAAW,QAAQ,gBAAgB,QAAQ,OAAO,UAAU,IAAA,CAAK,QAAQ,QAAQ,EAAE;EAC3G,IAAI,CAAC,WAAW,CAAC,QAAQ;GACvB,KAAI;GACJ;EACF;EACA,MAAM,UAAU,IAAI,QAAO;EAC3B,KAAK,MAAM,QAAQ,2BAA2B;GAC5C,MAAM,QAAQ,IAAI,QAAQ;GAC1B,IAAI,UAAU,QACZ,QAAQ,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;EAErE;EACA,MAAM,UAAU,IAAI,UAAU,MAAA,CAAO,YAAW;EAChD,MAAM,UAAU,WAAW,SAAS,WAAW;EAC/C,MAAM,aAAa,IAAI,gBAAe;EACtC,IAAI,GAAG,eAAe,WAAW,MAAK,CAAE;EACxC,MAAM,GAAG,SAAS,IAAI,MAAM,OAAO,MAAM,KAAK,OAAO;GACnD,MAAM,UAAW,SAAS,MAAM,GAAG,IAA4B;GAC/D;GACA;GACA,UAAU;GACV,QAAQ,WAAW;GACnB,GAAI,UAAU,EAAE,QAAQ,OAAM,IAAK,CAAA;EACrB,CAAA,CAAC,CACd,KAAK,OAAO,aAAY;GACvB,IAAI,aAAa,SAAS;GAC1B,MAAM,SAAS,kBAAkB,GAAG;GACpC,SAAS,QAAQ,SAAS,OAAO,SAAQ;IACvC,IAAI,SAAS,cAAc,SAAS,oBAClC,IAAI,UAAU,MAAM,uBAAuB,OAAO,QAAQ,MAAM,CAAC;SAC5D,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,SAAS,cAC3C,IAAI,UAAU,MAAM,KAAK;GAE7B,CAAC;GACD,MAAM,UAAU,SAAS,QAAQ,eAAc,KAAM,CAAA;GACrD,IAAI,QAAQ,QACV,IAAI,UACF,cACA,QAAQ,KAAK,WAAW,qBAAqB,QAAQ,MAAM,CAAC,CAAC;GAGjE,IAAI,CAAC,SAAS,MAAM;IAClB,IAAI,IAAG;IACP;GACF;GAGA,SAAS,SAAS,QAAQ,SAAS,IAAa,GAAG,WAAW,MAAS;EACzE,CAAC,CAAC,CACD,OAAO,UAAkB;GACxB,IAAI,WAAW,OAAO,SACpB;GAGF,QAAQ,MAAM,iDAAiD,KAAK;GACpE,IAAI,aAAa;GACjB,IAAI,UAAU,gBAAgB,kBAAkB;GAChD,IAAI,IAAI,KAAK,UAAU,EAAE,SAAS,kBAAiB,CAAE,CAAC;EACxD,CAAC;CACL;AACF"}

package/fesm2022/lenne.tech-ng-base-share.mjs

@@ -0,0 +1,76 @@
+import { isPlatformBrowser } from "@angular/common";
+import * as i0 from "@angular/core";
+import { PLATFORM_ID, Service, inject } from "@angular/core";
+import { LtI18nService, LtToastService } from "@lenne.tech/ng-base";
+const LT_SHARE_MESSAGES = {
+	de: { lt: { "share": {
+		"copied": "Link kopiert",
+		"copiedDescription": "Der Link wurde in die Zwischenablage kopiert."
+	} } },
+	en: { lt: { "share": {
+		"copied": "Link copied",
+		"copiedDescription": "The link has been copied to clipboard."
+	} } }
+};
+function injectLtShareI18n() {
+	const i18n = inject(LtI18nService);
+	i18n.registerLibraryMessages("share", LT_SHARE_MESSAGES);
+	return i18n;
+}
+var LtShareService = class LtShareService {
+	i18n = injectLtShareI18n();
+	toast = inject(LtToastService);
+	isBrowser = isPlatformBrowser(inject(PLATFORM_ID));
+	canShare() {
+		return this.isBrowser && typeof navigator !== "undefined" && typeof navigator.share === "function";
+	}
+	async share(title, text, url) {
+		if (!this.isBrowser) return "unavailable";
+		const target = url ?? globalThis.location?.href ?? "";
+		if (this.canShare()) try {
+			await navigator.share({
+				text: text ?? globalThis.location?.origin,
+				title,
+				url: target
+			});
+			return "shared";
+		} catch (error) {
+			if (error instanceof DOMException && error.name === "AbortError") return "aborted";
+		}
+		try {
+			await navigator.clipboard.writeText(target);
+			if (!this.toast.show({
+				color: "success",
+				description: this.i18n.t("lt.share.copiedDescription"),
+				title: this.i18n.t("lt.share.copied")
+			})) console.info(`[@lenne.tech/ng-base] ${this.i18n.t("lt.share.copied")}: ${target}`);
+			return "copied";
+		} catch {
+			return "failed";
+		}
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtShareService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtShareService
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.4",
+	ngImport: i0,
+	type: LtShareService,
+	decorators: [{ type: Service }]
+});
+export { LtShareService };
+
+//# sourceMappingURL=lenne.tech-ng-base-share.mjs.map

package/fesm2022/lenne.tech-ng-base-share.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lenne.tech-ng-base-share.mjs","names":[],"sources":["../tmp-esm2022/share/lib/i18n/de.json","../tmp-esm2022/share/lib/i18n/en.json","../../../projects/ng-base/share/src/lib/i18n.ts","../../../projects/ng-base/share/src/lib/share-service.ts"],"sourcesContent":["","","import { inject } from '@angular/core';\nimport { LtI18nService } from '@lenne.tech/ng-base';\n\nimport de from './i18n/de.json';\nimport en from './i18n/en.json';\n\n/** The `lt.share.*` texts (also shipped as `i18n/share/{de,en}.json`). */\nexport const LT_SHARE_MESSAGES = { de, en } as const;\n\n/** `LtI18nService` with the `lt.share.*` texts registered (injection context). */\nexport function injectLtShareI18n(): LtI18nService {\n  const i18n = inject(LtI18nService);\n  i18n.registerLibraryMessages('share', LT_SHARE_MESSAGES);\n  return i18n;\n}\n","import { isPlatformBrowser } from '@angular/common';\nimport { inject, PLATFORM_ID, Service } from '@angular/core';\nimport { LtToastService } from '@lenne.tech/ng-base';\nimport { injectLtShareI18n } from './i18n';\n\n/** Result of {@link LtShareService.share}. */\nexport type LtShareResult = 'aborted' | 'copied' | 'failed' | 'shared' | 'unavailable';\n\n/**\n * Web Share API with clipboard fallback (counterpart of `useLtShare()`). Browser only.\n *\n * `share()` uses `navigator.share({ title, text, url })` where available; otherwise the URL is copied to the clipboard\n * and a success toast (`lt.share.copied`) is shown. The URL defaults to the current page.\n */\n@Service()\nexport class LtShareService {\n  private readonly i18n = injectLtShareI18n();\n  private readonly toast = inject(LtToastService);\n  private readonly isBrowser = isPlatformBrowser(inject(PLATFORM_ID));\n\n  /** Whether the native share sheet is available. */\n  canShare(): boolean {\n    return this.isBrowser && typeof navigator !== 'undefined' && typeof navigator.share === 'function';\n  }\n\n  /** Share a link (native share sheet, else clipboard + toast). */\n  async share(title?: string, text?: string, url?: string): Promise<LtShareResult> {\n    if (!this.isBrowser) {\n      return 'unavailable';\n    }\n    const target = url ?? globalThis.location?.href ?? '';\n    if (this.canShare()) {\n      try {\n        await navigator.share({ text: text ?? globalThis.location?.origin, title, url: target });\n        return 'shared';\n      } catch (error) {\n        if (error instanceof DOMException && error.name === 'AbortError') {\n          return 'aborted';\n        }\n      }\n    }\n    try {\n      await navigator.clipboard.writeText(target);\n      if (!this.toast.show({ color: 'success', description: this.i18n.t('lt.share.copiedDescription'), title: this.i18n.t('lt.share.copied') })) {\n        console.info(`[@lenne.tech/ng-base] ${this.i18n.t('lt.share.copied')}: ${target}`);\n      }\n      return 'copied';\n    } catch {\n      return 'failed';\n    }\n  }\n}\n"],"mappings":";;;;AEOA,MAAa,oBAAoB;CAAE,IAAA,E;;;C,IAAA;CAAI,IAAA,E;;;C,IAAA;AAAE;AAGzC,SAAgB,oBAAiB;CAC/B,MAAM,OAAO,OAAO,aAAa;CACjC,KAAK,wBAAwB,SAAS,iBAAiB;CACvD,OAAO;AACT;ACCA,IAAa,iBAAb,MAAa,eAAc;CACR,OAAO,kBAAiB;CACxB,QAAQ,OAAO,cAAc;CAC7B,YAAY,kBAAkB,OAAO,WAAW,CAAC;CAGlE,WAAQ;EACN,OAAO,KAAK,aAAa,OAAO,cAAc,eAAe,OAAO,UAAU,UAAU;CAC1F;CAGA,MAAM,MAAM,OAAgB,MAAe,KAAY;EACrD,IAAI,CAAC,KAAK,WACR,OAAO;EAET,MAAM,SAAS,OAAO,WAAW,UAAU,QAAQ;EACnD,IAAI,KAAK,SAAQ,GACf,IAAI;GACF,MAAM,UAAU,MAAM;IAAE,MAAM,QAAQ,WAAW,UAAU;IAAQ;IAAO,KAAK;GAAM,CAAE;GACvF,OAAO;EACT,SAAS,OAAO;GACd,IAAI,iBAAiB,gBAAgB,MAAM,SAAS,cAClD,OAAO;EAEX;EAEF,IAAI;GACF,MAAM,UAAU,UAAU,UAAU,MAAM;GAC1C,IAAI,CAAC,KAAK,MAAM,KAAK;IAAE,OAAO;IAAW,aAAa,KAAK,KAAK,EAAE,4BAA4B;IAAG,OAAO,KAAK,KAAK,EAAE,iBAAiB;GAAC,CAAE,GACtI,QAAQ,KAAK,yBAAyB,KAAK,KAAK,EAAE,iBAAiB,EAAC,IAAK,QAAQ;GAEnF,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;CAnCW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAc,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAd,OAAA,QAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;CAAc,CAAA;;AAAd,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAc,YAAA,CAAA,EAD1B,MAAA,Q"}