@lenne.tech/ng-base 18.1.3 → 22.0.0

package/types/lenne.tech-ng-base-auth.d.ts

@@ -0,0 +1,320 @@
+import { LtAuthCallOptions, LtAuthFeatures, LtAuthMode, LtAuthResponse, LtNoStrayCredential, LtPasskey, LtPasskeyAuthResult, LtPasskeyRegisterResult, LtTwoFactorEnableResult, LtUser, LtUserInput } from "@lenne.tech/ng-base/auth/provide";
+import { createAuthClient } from "better-auth/client";
+import { LtApiUrlResolution, LtFetch } from "@lenne.tech/ng-base";
+import * as i0 from "@angular/core";
+import { Signal } from "@angular/core";
+export * from "@lenne.tech/ng-base/auth/provide";
+/** Configuration of {@link createLtAuthClient}. */
+interface LtAuthClientConfig {
+  /** API origin (`''` for same-origin / proxy). */
+  baseURL: string;
+  /** Better Auth base path, e.g. `/iam` or `/api/iam` behind the dev proxy. */
+  basePath: string;
+  /** Register `adminClient()` (default `false`, see `LtAuthOptions.enableAdmin`). */
+  enableAdmin?: boolean;
+  /** Register `twoFactorClient()` (default `true`). */
+  enableTwoFactor?: boolean;
+  /** Fetch implementation (the auth-aware `LT_FETCH`). */
+  fetch?: LtFetch;
+  /** Called when a sign-in answers `twoFactorRedirect` (navigate to the 2FA page). */
+  onTwoFactorRedirect?: () => void | Promise<void>;
+  /** Additional Better Auth client plugins (e.g. `passkeyClient()` from `@better-auth/passkey/client`). */
+  plugins?: unknown[];
+}
+/**
+ * The Better Auth client surface ng-base exposes. Every method that sends a credential hashes it with SHA-256 first
+ * (`{ ...params, field: sha256(field) }`, never a whitelist), so a plaintext password never leaves the browser.
+ */
+interface LtAuthClient {
+  /** The underlying Better Auth client (escape hatch; its methods do NOT hash). */
+  readonly raw: ReturnType<typeof createAuthClient>;
+  changePassword<T extends {
+    currentPassword: string;
+    newPassword: string;
+    revokeOtherSessions?: boolean;
+  }>(params: LtNoStrayCredential<T, 'currentPassword' | 'newPassword'>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  getSession(options?: LtAuthCallOptions): Promise<LtAuthResponse<{
+    session: Record<string, unknown>;
+    user: LtUser;
+  } | null>>;
+  passkey: {
+    deletePasskey(params: {
+      id: string;
+    }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+    listUserPasskeys(options?: LtAuthCallOptions): Promise<LtAuthResponse<LtPasskey[]>>;
+    updatePasskey(params: {
+      id: string;
+      name: string;
+    }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  };
+  requestPasswordReset<T extends {
+    email: string;
+    redirectTo?: string;
+  }>(params: LtNoStrayCredential<T, never>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  resetPassword<T extends {
+    newPassword: string;
+    token: string;
+  }>(params: LtNoStrayCredential<T, 'newPassword'>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  sendVerificationEmail<T extends {
+    callbackURL?: string;
+    email: string;
+  }>(params: LtNoStrayCredential<T, never>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  signIn: {
+    email<T extends {
+      callbackURL?: string;
+      email: string;
+      password: string;
+      rememberMe?: boolean;
+    }>(params: LtNoStrayCredential<T, 'password'>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  };
+  signOut(options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  signUp: {
+    email<T extends {
+      callbackURL?: string;
+      email: string;
+      name: string;
+      password: string;
+    }>(params: LtNoStrayCredential<T, 'password'>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  };
+  twoFactor: {
+    disable<T extends {
+      password: string;
+    }>(params: LtNoStrayCredential<T, 'password'>, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+    enable<T extends {
+      issuer?: string;
+      password: string;
+    }>(params: LtNoStrayCredential<T, 'password'>, options?: LtAuthCallOptions): Promise<LtAuthResponse<LtTwoFactorEnableResult>>;
+    generateBackupCodes<T extends {
+      password: string;
+    }>(params: LtNoStrayCredential<T, 'password'>, options?: LtAuthCallOptions): Promise<LtAuthResponse<{
+      backupCodes: string[];
+    }>>;
+    verifyBackupCode(params: {
+      code: string;
+      disableSession?: boolean;
+      trustDevice?: boolean;
+    }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+    verifyTotp(params: {
+      code: string;
+      trustDevice?: boolean;
+    }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+  };
+  verifyEmail(params: {
+    callbackURL?: string;
+    token: string;
+  }, options?: LtAuthCallOptions): Promise<LtAuthResponse>;
+}
+/** Register extra Better Auth client plugins for every client created afterwards (prefer `provideLtAuth({ plugins })`). */
+export declare function registerLtAuthPlugins(plugins: unknown[]): void;
+/** Plugins registered via {@link registerLtAuthPlugins}. */
+export declare function getLtAuthPluginRegistry(): readonly unknown[];
+/** Clear the plugin registry (tests). */
+export declare function clearLtAuthPluginRegistry(): void;
+/**
+ * `baseURL` / `basePath` of the Better Auth client for an API URL resolution: behind the dev proxy the origin is the
+ * app itself (`''`) and the path gets the `/api` prefix (`/iam` → `/api/iam`), otherwise the API base URL with the
+ * configured path.
+ */
+export declare function resolveLtAuthClientBase(resolution: Pick<LtApiUrlResolution, 'baseUrl' | 'proxy'>, basePath: string): {
+  basePath: string;
+  baseURL: string;
+};
+/**
+ * Absolute Better Auth URL for `baseURL` + `basePath`.
+ *
+ * Better Auth rejects a relative `baseURL` ("Invalid base URL"), so an empty origin (same-origin deployment, dev proxy
+ * `/api/iam`) is resolved against the browser origin. Without a usable origin (server without API URL) the path is
+ * returned unchanged; such a client cannot reach the backend anyway.
+ */
+export declare function resolveLtAuthClientUrl(baseURL: string, basePath: string): string;
+/**
+ * Create the hashing Better Auth client wrapper.
+ *
+ * Uses the framework-agnostic `better-auth/client` (`createAuthClient`) with `twoFactorClient()` (and `adminClient()` when
+ * enabled), the plugins of `config.plugins` and the registry, and the given fetch. Async because Better Auth is loaded
+ * on first use (see `LtAuthService.getClient()`, which shares one client per app).
+ */
+export declare function createLtAuthClient(config: LtAuthClientConfig): Promise<LtAuthClient>;
+/**
+ * Authentication against nest-server's Better Auth integration (`/iam`), the Angular counterpart of `useLtAuth()`.
+ *
+ * A facade over {@link LtAuthStore} (`@lenne.tech/ng-base/auth/provide`): state, transport, session validation and
+ * sign-out are the store's (same signals, same methods), this service adds the flows that need Better Auth or WebAuthn
+ * — sign-in/up, 2FA, passkeys, password and email. Guards, the interceptor and `provideLtAuth()` use the store only, so
+ * this service (and Better Auth, loaded on first use) stays out of the initial bundle until a page injects it.
+ *
+ * State is signal-based and backed by the client-readable `lt-auth-state` cookie, so SSR renders the signed-in shell
+ * from the request cookie (UI gating only; the session itself is the httpOnly `iam.session_token`).
+ *
+ * Transport: session cookie first; when cookies do not work (401 while the state says signed in) the service switches
+ * to JWT mode (`GET /iam/token`, Bearer header) and refreshes a stale JWT once per burst. All credentials are SHA-256
+ * hashed before they leave the browser.
+ */
+export declare class LtAuthService {
+  private readonly store;
+  private readonly api;
+  private readonly options;
+  private readonly i18n;
+  private clientRequest;
+  /** Signed-in user (from the auth-state cookie, refreshed by `validateSession()` and every sign-in). */
+  readonly user: Signal<LtUser | null>;
+  /** Whether a user is signed in (UI gating; the backend decides). */
+  readonly isAuthenticated: Signal<boolean>;
+  /** Current transport. */
+  readonly authMode: Signal<LtAuthMode>;
+  /** Whether the JWT fallback is active. */
+  readonly isJwtMode: Signal<boolean>;
+  /** Whether a sign-in/up/out or passkey flow is running. */
+  readonly isLoading: Signal<boolean>;
+  /** Whether the user has the `admin` role (UX gate only). */
+  readonly isAdmin: Signal<boolean>;
+  /** Whether two-factor authentication is enabled for the user. */
+  readonly is2FAEnabled: Signal<boolean>;
+  /** nest-server feature flags (`GET /iam/features`); fetched on the server and transferred to the browser. */
+  readonly features: Signal<LtAuthFeatures>;
+  /** Whether passkeys can be used: enabled in the options, backend feature on and WebAuthn available in this browser. */
+  readonly passkeySupported: Signal<boolean>;
+  /**
+   * The hashing Better Auth client (see {@link LtAuthClient}), created once per app on first use. Better Auth is loaded
+   * lazily (dynamic import), so it is not part of the initial bundle; session state, guards, the interceptor and
+   * {@link fetchWithAuth} never need it. The client sends every request through {@link fetchWithAuth} (the same
+   * auth-aware fetch as `LT_FETCH`). During SSR it never carries the request's cookies, so do not use it on the
+   * server for anything that needs the user's session. A failed load is retried on the next call.
+   */
+  getClient(): Promise<LtAuthClient>;
+  /** The current JWT (JWT mode only), or `null`. */
+  jwtToken(): string | null;
+  /** `user.role === role` or `user.roles` contains it (case-sensitive). */
+  hasRole(role: string): boolean;
+  /** Whether the user has any of the roles. */
+  hasAnyRole(...roles: string[]): boolean;
+  /** Fetch the feature flags (`GET /iam/features`, see {@link LtAuthStore.fetchFeatures}). */
+  fetchFeatures(): Promise<LtAuthFeatures>;
+  /** The feature flags, fetched at most once (transferred from SSR, or fetched on first call). */
+  ensureFeatures(): Promise<LtAuthFeatures>;
+  /**
+   * Email sign-in (password hashed). A second factor (`requiresTwoFactor` from nest-server or `twoFactorRedirect` from
+   * Better Auth) navigates to `twoFactorRedirectPath` (keeping the current `redirect` query parameter) and sets no user. A JWT-shaped body token (nest-server
+   * `cookies: false`) switches to JWT mode; otherwise the session cookie is used and a JWT is fetched in the background.
+   */
+  readonly signIn: {
+    email: <T extends {
+      callbackURL?: string;
+      email: string;
+      password: string;
+      rememberMe?: boolean;
+    }>(params: LtNoStrayCredential<T, "password">, options?: LtAuthCallOptions) => Promise<LtAuthResponse>;
+    /** Passkey sign-in (same as {@link authenticateWithPasskey}). */
+    passkey: () => Promise<LtPasskeyAuthResult>;
+  };
+  /**
+   * Email sign-up (password hashed), same token handling as sign-in. With email verification nest-server answers
+   * `emailVerificationRequired: true` and revokes the session: no user is set, the caller leads to the verify page.
+   */
+  readonly signUp: {
+    email: <T extends {
+      callbackURL?: string;
+      email: string;
+      name: string;
+      password: string;
+    }>(params: LtNoStrayCredential<T, "password">, options?: LtAuthCallOptions) => Promise<LtAuthResponse>;
+  };
+  /**
+   * Sign out: sign-out hooks (offline sync flush), `POST /iam/sign-out`, local state cleared, after-hooks (sync wipe).
+   * The local state is cleared even when the request fails (offline device). See {@link LtAuthStore.signOut}.
+   */
+  signOut(options?: LtAuthCallOptions): Promise<void>;
+  /** Store the user in state and cookie (browser always; SSR never writes). `image: null` becomes `undefined`. */
+  setUser(user: LtUserInput | null, mode?: LtAuthMode): void;
+  /** Clear local auth state and cookies (browser). Does not delete offline data (use `signOut()` for that). */
+  clearUser(): void;
+  /**
+   * Validate the session (app start / hard reload). Server: answers from the cookie, no backend call. Browser:
+   * `GET /iam/get-session` (≤ 10 s); a user is merged with the cached one (nest-server-only fields kept, authz keys
+   * fail-closed); no user but a cached one → `true` (e.g. right after 2FA); else `false`.
+   */
+  validateSession(): Promise<boolean>;
+  /** The auth-aware fetch, also provided as `LT_FETCH` (see {@link LtAuthStore.fetchWithAuth}). */
+  fetchWithAuth(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+  /** Token to retry a request with after a 401 (see {@link LtAuthStore.recoverFrom401}). */
+  recoverFrom401(url: string, sentToken: string | null): Promise<string | null>;
+  /** Session-loss handling for a 401 from `url` (see `LtUnauthorizedHandler`). */
+  handleUnauthorized(url?: string): Promise<boolean>;
+  /** `GET /iam/token` → store the JWT and switch to JWT mode. One request per burst. Browser only. */
+  switchToJwtMode(): Promise<boolean>;
+  /** Re-mint the JWT (JWT mode only). */
+  refreshJwtToken(): Promise<boolean>;
+  /** Passkey sign-in: options → `navigator.credentials.get` → `verify-authentication` (`challengeId`) → user set. */
+  authenticateWithPasskey(): Promise<LtPasskeyAuthResult>;
+  /** Register a passkey for the signed-in user (`challengeId` body as nest-server expects). */
+  registerPasskey(name?: string): Promise<LtPasskeyRegisterResult>;
+  /** Passkey management of the signed-in user. */
+  readonly passkey: {
+    delete: (id: string) => Promise<LtAuthResponse>;
+    list: () => Promise<LtAuthResponse<LtPasskey[]>>;
+    update: (id: string, name: string) => Promise<LtAuthResponse>;
+  };
+  /** Two-factor methods (passwords hashed). `verifyTotp` / `verifyBackupCode` set the user on success (fix vs. Nuxt). */
+  readonly twoFactor: {
+    disable: <T extends {
+      password: string;
+    }>(params: LtNoStrayCredential<T, "password">) => Promise<LtAuthResponse>;
+    enable: <T extends {
+      issuer?: string;
+      password: string;
+    }>(params: LtNoStrayCredential<T, "password">) => Promise<LtAuthResponse<LtTwoFactorEnableResult>>;
+    generateBackupCodes: <T extends {
+      password: string;
+    }>(params: LtNoStrayCredential<T, "password">) => Promise<LtAuthResponse<{
+      backupCodes: string[];
+    }>>;
+    verifyBackupCode: (params: {
+      code: string;
+      trustDevice?: boolean;
+    }) => Promise<LtAuthResponse>;
+    verifyTotp: (params: {
+      code: string;
+      trustDevice?: boolean;
+    }) => Promise<LtAuthResponse>;
+  };
+  /** `POST /iam/change-password` (both passwords hashed; `revokeOtherSessions` forwarded). */
+  changePassword<T extends {
+    currentPassword: string;
+    newPassword: string;
+    revokeOtherSessions?: boolean;
+  }>(params: LtNoStrayCredential<T, 'currentPassword' | 'newPassword'>): Promise<LtAuthResponse>;
+  /** `POST /iam/request-password-reset`; `redirectTo` defaults to `<siteUrl>/auth/reset-password` (absolute, never user-derived). */
+  requestPasswordReset<T extends {
+    email: string;
+    redirectTo?: string;
+  }>(params: LtNoStrayCredential<T, never>): Promise<LtAuthResponse>;
+  /** `POST /iam/reset-password` with `{ newPassword (hashed), token }`. */
+  resetPassword<T extends {
+    newPassword: string;
+    token: string;
+  }>(params: LtNoStrayCredential<T, 'newPassword'>): Promise<LtAuthResponse>;
+  /** `POST /iam/send-verification-email`; `callbackURL` defaults to `<siteUrl>/auth/login` (absolute). */
+  sendVerificationEmail<T extends {
+    callbackURL?: string;
+    email: string;
+  }>(params: LtNoStrayCredential<T, never>): Promise<LtAuthResponse>;
+  /** `GET /iam/verify-email?token=` (JSON answer without `callbackURL`). */
+  verifyEmail(params: {
+    callbackURL?: string;
+    token: string;
+  }): Promise<LtAuthResponse>;
+  /**
+   * Build an absolute app URL from `NG_PUBLIC_SITE_URL` (or the browser origin), for `redirectTo` / `callbackURL`.
+   * Never derived from the request: on the server without a site URL it throws. Absolute input is returned unchanged.
+   */
+  absoluteAppUrl(path: string): string;
+  /**
+   * After a successful 2FA verification: see {@link LtAuthStore.adoptVerifiedSession} (a JWT in the answer → JWT mode,
+   * else cookie mode; Better Auth's opaque session token is never stored as JWT, that would put the session into a
+   * script-readable cookie).
+   */
+  private adoptVerifiedSession;
+  static ɵfac: i0.ɵɵFactoryDeclaration<LtAuthService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export type { LtAuthClient, LtAuthClientConfig };

package/types/lenne.tech-ng-base-bug-provide.d.ts

@@ -0,0 +1,272 @@
+import { EnvironmentProviders, InjectionToken } from "@angular/core";
+/** Kind of report; mapped onto a Linear label (`bug`, `feature`, `enhancement`, `other`). */
+type LtBugReportType = 'bug' | 'enhancement' | 'feature' | 'other';
+/** Corner of the floating report button. */
+type LtBugPosition = 'bottom-left' | 'bottom-right' | 'top-left' | 'top-right';
+/** Background of the screenshot: `auto` follows the app color mode (`html.dark`, `color-scheme`, system preference). */
+type LtBugTheme = 'auto' | 'dark' | 'light';
+/** Browser, system and performance details attached to a report. URLs are redacted. */
+interface LtBrowserInfo {
+  browser: {
+    name: string;
+    version?: string;
+  };
+  cookieEnabled: boolean;
+  language: string;
+  languages: string[];
+  onLine: boolean;
+  os: {
+    name: string;
+    version: string;
+  };
+  performance?: {
+    domComplete: number;
+    domContentLoaded: number;
+    firstContentfulPaint: number | null;
+    firstPaint: number | null;
+    loadTime: number;
+    navigationStart: number;
+    responseEnd: number;
+  };
+  platform: string;
+  referrer: string;
+  screen: {
+    colorDepth: number;
+    height: number;
+    pixelDepth: number;
+    width: number;
+  };
+  timestamp: string;
+  timezone: string;
+  title: string;
+  url: string;
+  userAgent: string;
+  vendor: string;
+  viewport: {
+    height: number;
+    width: number;
+  };
+}
+/** One captured console call (CSS `%c` styling removed, secrets redacted). */
+interface LtConsoleLogEntry {
+  level: 'debug' | 'error' | 'info' | 'log' | 'warn';
+  message: string[];
+  stack?: string;
+  timestamp: string;
+}
+/** One captured `fetch` / `XMLHttpRequest` call (sensitive headers and auth bodies are never recorded). */
+interface LtNetworkRequestEntry {
+  duration?: number;
+  error?: string;
+  method: string;
+  requestBody?: string;
+  requestHeaders?: Record<string, string>;
+  responseBody?: string;
+  responseHeaders?: Record<string, string>;
+  status: number;
+  statusText: string;
+  timestamp: string;
+  type: 'fetch' | 'xhr';
+  url: string;
+}
+/** Kind of a user journey event. */
+type LtUserInteractionType = 'click' | 'error' | 'form_change' | 'form_submit' | 'hover' | 'input_change' | 'keyboard' | 'modal_close' | 'modal_open' | 'navigation' | 'scroll';
+/** Details of a user journey event. */
+interface LtUserInteractionMetadata {
+  [key: string]: unknown;
+  classes?: string[];
+  element?: string;
+  errorMessage?: string;
+  fromUrl?: string;
+  id?: string;
+  key?: string;
+  scrollPosition?: number;
+  tag?: string;
+  text?: string;
+  toUrl?: string;
+  url?: string;
+  value?: string;
+}
+/** One user journey event (click, navigation, form interaction, keyboard shortcut, error, dialog). */
+interface LtUserInteractionEvent {
+  metadata?: LtUserInteractionMetadata;
+  target: string;
+  timestamp: string;
+  type: LtUserInteractionType;
+}
+/** A captured error (Angular `ErrorHandler`, uncaught error, unhandled rejection or `reportError()`). */
+interface LtBugErrorInfo {
+  /** Where the error came from (`ErrorHandler`, `window`, or the source passed to `reportError()`). */
+  componentName?: string;
+  message: string;
+  stack?: string;
+  timestamp: string;
+  url?: string;
+  userAgent?: string;
+}
+/** A file attached to a report (`data` is a base64 data URL). */
+interface LtBugAttachment {
+  data: string;
+  id: string;
+  isScreenshot?: boolean;
+  name: string;
+  /** Data URL for the thumbnail (images only); never sent to the server. */
+  preview?: string;
+  size: number;
+  type: string;
+}
+/** The report sent to the server endpoint (`POST /_bug-lt/report`). */
+interface LtBugReportData {
+  attachments?: Omit<LtBugAttachment, 'preview'>[];
+  browserInfo?: LtBrowserInfo;
+  consoleLogs?: LtConsoleLogEntry[];
+  description: string;
+  expectedBehavior?: string;
+  networkRequests?: LtNetworkRequestEntry[];
+  /** Legacy single screenshot (data URL); the browser sends the screenshot as an attachment instead. */
+  screenshot?: string;
+  stepsToReproduce?: string;
+  title: string;
+  type: LtBugReportType;
+  userInteractions?: LtUserInteractionEvent[];
+}
+/** Answer of the server endpoint. */
+interface LtBugReportResponse {
+  error?: string;
+  identifier?: string;
+  issueId?: string;
+  issueUrl?: string;
+  message?: string;
+  success: boolean;
+}
+/** User journey options (`provideLtBug({ userJourney })`). */
+interface LtBugUserJourneyOptions {
+  /** Record clicks (default `true`). */
+  captureClicks?: boolean;
+  /** Record errors (default `true`). */
+  captureErrors?: boolean;
+  /** Record submit and change events of form fields (default `true`). */
+  captureFormInteractions?: boolean;
+  /** Record hovered elements, throttled (default `false`, noisy). */
+  captureHover?: boolean;
+  /** Record typing in text fields, throttled (default `false`; values only with `captureInputValues`). */
+  captureInputChanges?: boolean;
+  /**
+   * Record the values of form fields (default `false`). Values of password fields, of fields with `autocomplete`
+   * `current-password` / `new-password` / `one-time-code` / `cc-*` and of fields named like tokens, secrets, PINs or card
+   * numbers are never recorded, not even with this option.
+   */
+  captureInputValues?: boolean;
+  /** Record keyboard shortcuts (with Ctrl/Meta/Alt); typed text is never recorded (default `true`). */
+  captureKeyboard?: boolean;
+  /** Record dialogs that open and close (`role="dialog"`, `role="alertdialog"`, `<dialog open>`) (default `true`). */
+  captureModalEvents?: boolean;
+  /** Record navigation (`Router` events, `popstate` without a router) (default `true`). */
+  captureNavigation?: boolean;
+  /** Record the scroll position, throttled (default `false`, noisy). */
+  captureScroll?: boolean;
+  /** Record the user journey at all (default `true`). */
+  enabled?: boolean;
+  /** Ring buffer size (default `50`). */
+  maxEvents?: number;
+  /** Throttle interval of hover, scroll and input events in ms (default `100`). */
+  throttleRate?: number;
+}
+/**
+ * Options of `provideLtBug()`, the counterpart of the `bug` block of `@lenne.tech/bug.lt` in `nuxt.config.ts`.
+ * Linear credentials are not part of it: they live on the server only (`ltBugReport()` from
+ * `@lenne.tech/ng-base/bug/server`).
+ */
+interface LtBugOptions {
+  /** Open the dialog automatically when an error is captured (default `false`). */
+  autoOpenOnError?: boolean;
+  /** Render the floating button of `<lt-bug-report>` (default `true`); `false` keeps only programmatic opening. */
+  autoShow?: boolean;
+  /** Button background color (default `#dc2626`, white text on it meets WCAG AA). */
+  buttonColor?: string;
+  /** ng-icons name of the button icon (default the Lucide bug icon); register custom icons with `provideIcons()`. */
+  buttonIcon?: string;
+  /** Text next to the icon (default none: round icon button). */
+  buttonText?: string;
+  /** Capture browser, OS, viewport and performance details (default `true`). */
+  enableBrowserInfo?: boolean;
+  /** Capture console output (default `true`). */
+  enableConsoleLogs?: boolean;
+  /** Capture errors through the app's `ErrorHandler` and window error events (default `true`). */
+  enableErrorBoundary?: boolean;
+  /** Capture `fetch` and `XMLHttpRequest` calls (default `true`). */
+  enableNetworkRequests?: boolean;
+  /** Take a viewport screenshot before the dialog opens (default `true`; needs the optional peer `modern-screenshot`). */
+  enableScreenshot?: boolean;
+  /** Capture the user journey (default `true`; see {@link userJourney}). */
+  enableUserJourney?: boolean;
+  /**
+   * Force the reporter on or off. Default: decided at runtime, on unless the app env (`NG_PUBLIC_APP_ENV`) is
+   * `production`; without an app env only in dev mode (`isDevMode()`), so a production build fails closed.
+   */
+  enabled?: boolean;
+  /** Server endpoint (default `/_bug-lt/report`, outside `/api` so an API proxy does not swallow it). */
+  endpoint?: string;
+  /** Console ring buffer size (default `50`). */
+  maxConsoleLogs?: number;
+  /** Network ring buffer size (default `50`). */
+  maxNetworkRequests?: number;
+  /** Button corner (default `bottom-right`). */
+  position?: LtBugPosition;
+  /** Screenshot background (default `auto`). */
+  theme?: LtBugTheme;
+  /** User journey options. */
+  userJourney?: LtBugUserJourneyOptions;
+}
+/** {@link LtBugOptions} with every default applied. */
+interface LtResolvedBugOptions extends Required<Omit<LtBugOptions, 'buttonIcon' | 'buttonText' | 'enabled' | 'userJourney'>> {
+  buttonIcon?: string;
+  buttonText?: string;
+  enabled?: boolean;
+  userJourney: Required<LtBugUserJourneyOptions>;
+}
+/** Options passed to `provideLtBug()`; `null` when the provider is missing (the reporter stays off). */
+export declare const LT_BUG_INPUT_OPTIONS: InjectionToken<LtBugOptions | null>;
+/** Dev mode flag used for the fail-closed decision (a token so tests can simulate a production build). */
+export declare const LT_BUG_DEV_MODE: InjectionToken<boolean>;
+/**
+ * Whether the bug reporter is on in this app and stage: `provideLtBug()` is present and the runtime decision
+ * ({@link isLtBugActive}) says on. The same on the server and in the browser (no hydration mismatch), so the app
+ * shell can keep the reporter's chunk out of production entirely:
+ *
+ * @example app.html
+ * @if (bugActive) { @defer (on immediate) { <lt-bug-report /> } }
+ */
+export declare const LT_BUG_ACTIVE: InjectionToken<boolean>;
+/**
+ * Whether the reporter is active (decided at runtime, so one build serves every stage):
+ *
+ * 1. `enabled` set explicitly wins.
+ * 2. App env (`NG_PUBLIC_APP_ENV`) `production` / `prod` → off, any other value → on.
+ * 3. No app env → only in dev mode (`isDevMode()`): a production build without the variable fails closed.
+ */
+export declare function isLtBugActive(options: Pick<LtBugOptions, 'enabled'>, appEnv: unknown, devMode: boolean): boolean;
+/**
+ * Opt-in bug reporter (the Angular counterpart of the `@lenne.tech/bug.lt` Nuxt module): captures console output,
+ * `fetch`/`XMLHttpRequest` calls, the user journey and errors, and lets the user send a report with screenshot to
+ * Linear through `ltBugReport()` from `@lenne.tech/ng-base/bug/server`.
+ *
+ * Active only when the app env (`LT_RUNTIME_CONFIG.appEnv`, `NG_PUBLIC_APP_ENV`) is not `production`, decided at
+ * runtime so one image serves every stage; without an app env only in dev mode (a production build fails closed).
+ * `enabled` (or `NG_PUBLIC_LT_BUG_ENABLED`) overrides the decision.
+ *
+ * This provider carries only the options: nothing of the reporter is in the initial bundle. `<lt-bug-report>` (from
+ * `@lenne.tech/ng-base/bug`) starts the capture when it is created, so render it deferred and only while
+ * {@link LT_BUG_ACTIVE} is `true`: production then never loads the reporter, the other stages start capturing right
+ * after the first render (`on immediate`).
+ *
+ * @example app.config.ts
+ * import { provideLtBug } from '@lenne.tech/ng-base/bug/provide';
+ * providers: [provideLtNgBase(), provideLtUi(), provideLtBug({ autoOpenOnError: true })]
+ *
+ * @example app.ts / app.html
+ * protected readonly bugActive = inject(LT_BUG_ACTIVE);
+ * @if (bugActive) { @defer (on immediate) { <lt-bug-report /> } }
+ */
+export declare function provideLtBug(options?: LtBugOptions): EnvironmentProviders;
+export type { LtBrowserInfo, LtBugAttachment, LtBugErrorInfo, LtBugOptions, LtBugPosition, LtBugReportData, LtBugReportResponse, LtBugReportType, LtBugTheme, LtBugUserJourneyOptions, LtConsoleLogEntry, LtNetworkRequestEntry, LtResolvedBugOptions, LtUserInteractionEvent, LtUserInteractionMetadata, LtUserInteractionType };

package/types/lenne.tech-ng-base-bug-rolldown-runtime-C25Le4-w.d.ts

@@ -0,0 +1 @@
+export { __reExport as n, __exportAll as t };