@lenne.tech/ng-base 18.1.3 → 22.0.0

package/types/lenne.tech-ng-base-files.d.ts

@@ -0,0 +1,288 @@
+import * as i0 from "@angular/core";
+import { EnvironmentProviders, InjectionToken, Signal } from "@angular/core";
+/**
+ * Status of an upload item
+ */
+type LtUploadStatus = 'completed' | 'error' | 'idle' | 'paused' | 'uploading';
+/**
+ * Progress information for an upload
+ */
+interface LtUploadProgress {
+  /** Total bytes to upload */
+  bytesTotal: number;
+  /** Bytes already uploaded */
+  bytesUploaded: number;
+  /** Percentage complete (0-100) */
+  percentage: number;
+  /** Estimated remaining time in seconds */
+  remainingTime: number;
+  /** Current upload speed in bytes/second */
+  speed: number;
+}
+/**
+ * Individual upload item with progress tracking
+ */
+interface LtUploadItem {
+  /** Timestamp when upload completed */
+  completedAt?: Date;
+  /** Error message if upload failed */
+  error?: string;
+  /** The file being uploaded */
+  file: File;
+  /**
+   * Id of the stored file, from the `X-File-Id` header of the response that completed the upload
+   * (nest-server 11.42.13+). Use it for file links and references — not the last segment of `url`,
+   * which is the TUS upload id. Undefined when the backend sends no such header: an older
+   * nest-server, or an `onUploadComplete()` override that never calls `super.onUploadComplete()`.
+   */
+  fileId?: string;
+  /** Unique identifier for this upload */
+  id: string;
+  /** Custom metadata to include with the upload */
+  metadata?: Record<string, string>;
+  /** Current progress information */
+  progress: LtUploadProgress;
+  /** Timestamp when upload started */
+  startedAt?: Date;
+  /** Current status of the upload */
+  status: LtUploadStatus;
+  /** URL of the TUS upload resource (available after completion) — not a file URL; see `fileId` */
+  url?: string;
+}
+/**
+ * Configuration options for TUS uploads
+ */
+interface LtUploadOptions {
+  /** Automatically start uploads when files are added (default: true) */
+  autoStart?: boolean;
+  /** Chunk size in bytes (default: 5MB) */
+  chunkSize?: number;
+  /** TUS upload endpoint URL; a relative path is resolved against the API (see `tus.resolveAgainstApi`) */
+  endpoint?: string;
+  /** Additional headers to include with requests */
+  headers?: Record<string, string>;
+  /** Default metadata to include with all uploads */
+  metadata?: Record<string, string>;
+  /** Callback when an upload fails */
+  onError?: (item: LtUploadItem, error: Error) => void;
+  /** Callback when upload progress updates */
+  onProgress?: (item: LtUploadItem) => void;
+  /** Callback when an upload completes successfully */
+  onSuccess?: (item: LtUploadItem) => void;
+  /** Maximum number of concurrent uploads (default: 3) */
+  parallelUploads?: number;
+  /** Retry delays in milliseconds (default: [0, 1000, 3000, 5000, 10000]) */
+  retryDelays?: number[];
+}
+/**
+ * Return type for injectLtTusUpload()
+ */
+interface LtTusUploadState {
+  /** Add files to the upload queue, returns array of upload IDs */
+  addFiles: (files: File | File[]) => Promise<string[]>;
+  /** Cancel all uploads */
+  cancelAll: () => void;
+  /** Cancel a specific upload by ID */
+  cancelUpload: (id: string) => void;
+  /** Remove all completed uploads from the list */
+  clearCompleted: () => void;
+  /** Get an upload item by ID */
+  getUpload: (id: string) => LtUploadItem | undefined;
+  /** Pause all active uploads */
+  pauseAll: () => void;
+  /** Pause a specific upload by ID */
+  pauseUpload: (id: string) => void;
+  /** Remove an upload from the list (also cancels if active) */
+  removeUpload: (id: string) => void;
+  /** Resume all paused uploads */
+  resumeAll: () => void;
+  /** Resume a specific upload by ID */
+  resumeUpload: (id: string) => void;
+  /** Retry a failed upload by ID */
+  retryUpload: (id: string) => void;
+  /** Start all idle uploads */
+  startAll: () => void;
+  /** Start a specific upload by ID */
+  startUpload: (id: string) => void;
+  /** Whether any uploads are currently in progress */
+  isUploading: Signal<boolean>;
+  /** Aggregated progress of all uploads */
+  totalProgress: Signal<LtUploadProgress>;
+  /** List of all upload items */
+  uploads: Signal<LtUploadItem[]>;
+}
+/**
+ * File info returned from the server
+ */
+interface LtFileInfo {
+  [key: string]: unknown;
+  filename: string;
+  id: string;
+  mimetype: string;
+  size: number;
+  url?: string;
+}
+/**
+ * Return type for LtFileService
+ */
+interface LtFileState {
+  /** Format duration in seconds to human readable string */
+  formatDuration: (seconds: number) => string;
+  /** Format bytes to human readable string (e.g., "1.5 MB") */
+  formatFileSize: (bytes: number) => string;
+  /** Get download URL for a file by ID */
+  getDownloadUrl: (id: string, filename?: string) => string;
+  /** Get file info from the server by ID */
+  getFileInfo: (id: string | undefined) => Promise<LtFileInfo | null | string>;
+  /** Get direct file URL by ID */
+  getFileUrl: (id: string) => string;
+  /** Check if a string is a valid MongoDB ObjectId */
+  isValidMongoID: (id: string) => boolean;
+}
+/**
+ * nest-server file helpers (counterpart of `useLtFile()`). URLs are resolved against the API base URL (fix: the Nuxt
+ * version built them relative to the app origin), under `filesBasePath` of `provideLtFiles()` (default `/files`).
+ */
+export declare class LtFileService implements LtFileState {
+  private readonly api;
+  private readonly fetch;
+  private readonly options;
+  /** `GET <api>/files/info/:id` with credentials; `null` for empty ids or on error, a non-ObjectId string is returned as is. */
+  getFileInfo(id: string | undefined): Promise<LtFileInfo | null | string>;
+  /**
+   * `<api>/files/id/:id` — nest-server's `GET files/id/:id` (CoreFileController), which streams the file (or redirects
+   * to a presigned S3 URL) after the rights check (`file.downloadRoles`, default admin).
+   */
+  getFileUrl(id: string): string;
+  /**
+   * Download URL. nest-server sets `Content-Disposition` from the stored filename on `GET files/id/:id`, so this is the
+   * same URL as {@link getFileUrl}; `filename` is accepted for API compatibility with nuxt-extensions and ignored (the
+   * server has no rename parameter — nuxt-extensions' `/files/download/:id` does not exist in nest-server 12.5).
+   */
+  getDownloadUrl(id: string, _filename?: string): string;
+  /** 1024-based `B`/`KB`/`MB`/`GB`/`TB` with two decimals. */
+  formatFileSize(bytes: number): string;
+  /** `Ns`, `Nm Ns`, `Nh Nm`. */
+  formatDuration(seconds: number): string;
+  /** `/^[a-f\d]{24}$/i`. */
+  isValidMongoID(id: string): boolean;
+  /** `<api><filesBasePath>` without a trailing slash; an absolute `filesBasePath` is used as is. */
+  private baseUrl;
+  static ɵfac: i0.ɵɵFactoryDeclaration<LtFileService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/** 1024-based file size with two decimals (`0 B` for non-positive input). */
+export declare function formatLtFileSize(bytes: number): string;
+/** Human readable duration (`45s`, `2m 5s`, `1h 3m`). */
+export declare function formatLtDuration(seconds: number): string;
+/** Whether `id` is a MongoDB ObjectId (24 hex characters). */
+export declare function isLtMongoId(id: string): boolean;
+/** TUS options of `provideLtFiles({ tus })`; runtime overrides `NG_PUBLIC_LT_TUS_*`. */
+interface LtTusOptions {
+  /** Chunk size in bytes (default 5 MB). */
+  defaultChunkSize?: number;
+  /**
+   * TUS endpoint (default **`/tus`**, nest-server's default; nuxt-extensions defaulted to `/files/upload`). Relative values
+   * are paths on the API while `resolveAgainstApi` is on; absolute URLs are used as they are.
+   */
+  defaultEndpoint?: string;
+  /** Resolve a relative endpoint against the API base URL (default `true`). Turn off only behind an own same-origin proxy. */
+  resolveAgainstApi?: boolean;
+}
+/** Options of `provideLtFiles()`. */
+interface LtFilesOptions {
+  /** Base path of nest-server's file controller for info/download URLs (default `/files`). */
+  filesBasePath?: string;
+  /** TUS upload options. */
+  tus?: LtTusOptions;
+}
+/** Resolved files options. */
+interface LtResolvedFilesOptions {
+  filesBasePath: string;
+  tus: Required<LtTusOptions>;
+}
+/** Defaults of {@link LtFilesOptions}. */
+export declare const LT_FILES_DEFAULTS: LtResolvedFilesOptions;
+/** Resolved files options (defaults ← `provideLtFiles(options)` ← runtime `NG_PUBLIC_LT_TUS_*`). */
+export declare const LT_FILES_OPTIONS: InjectionToken<LtResolvedFilesOptions>;
+/** Files providers (TUS upload defaults, file info/download base path). Optional when the defaults fit. */
+export declare function provideLtFiles(options?: LtFilesOptions): EnvironmentProviders;
+/** The request object tus-js-client hands to `onBeforeRequest` / `onAfterResponse`. */
+interface LtTusHttpRequest {
+  getUnderlyingObject(): unknown;
+  setHeader(header: string, value: string): void;
+}
+/** The response object tus-js-client hands to `onAfterResponse` (and inside `DetailedError.originalResponse`). */
+interface LtTusHttpResponse {
+  getHeader(header: string): null | string | undefined;
+  getStatus(): number;
+}
+/** A previous upload of the same file found in tus-js-client's URL storage. */
+interface LtTusPreviousUpload {
+  creationTime?: string;
+}
+/** The tus-js-client upload options `injectLtTusUpload()` sets. */
+interface LtTusClientUploadOptions {
+  chunkSize?: number;
+  endpoint?: string;
+  headers?: Record<string, string>;
+  metadata?: Record<string, string>;
+  onAfterResponse?: (req: LtTusHttpRequest, res: LtTusHttpResponse) => void;
+  onBeforeRequest?: (req: LtTusHttpRequest) => void;
+  onError?: (error: Error) => void;
+  onProgress?: (bytesUploaded: number, bytesTotal: number) => void;
+  onShouldRetry?: (error: Error & {
+    originalResponse?: LtTusHttpResponse | null;
+  }, retryAttempt: number, options: unknown) => boolean;
+  onSuccess?: () => void;
+  removeFingerprintOnSuccess?: boolean;
+  retryDelays?: number[];
+}
+/** The part of a tus-js-client `Upload` instance `injectLtTusUpload()` uses. */
+interface LtTusClientUpload {
+  url: null | string;
+  abort(shouldTerminate?: boolean): Promise<void>;
+  findPreviousUploads(): Promise<LtTusPreviousUpload[]>;
+  resumeFromPreviousUpload(previousUpload: LtTusPreviousUpload): void;
+  start(): void;
+}
+/** The part of the `tus-js-client` module `injectLtTusUpload()` uses (structural, so the peer stays optional). */
+interface LtTusClient {
+  Upload: new (file: File, options: LtTusClientUploadOptions) => LtTusClientUpload;
+}
+/** Error text when the optional peer `tus-js-client` is missing. */
+export declare const LT_TUS_CLIENT_MISSING_MESSAGE = "[@lenne.tech/ng-base] tus-js-client is not installed. Install it to use uploads: pnpm add tus-js-client (or npm install tus-js-client).";
+/** Load `tus-js-client` lazily (once); rejects with an install hint when the optional peer is missing. */
+export declare function loadLtTusClient(): Promise<LtTusClient>;
+/**
+ * Loader of the `tus-js-client` module used by `injectLtTusUpload()` (default: lazy `import('tus-js-client')`).
+ * Replace it in tests with a fake client, or to supply a preconfigured build.
+ */
+export declare const LT_TUS_CLIENT_LOADER: InjectionToken<() => Promise<LtTusClient>>;
+/** A TUS upload queue with signal state, created by {@link injectLtTusUpload}. */
+type LtTusUpload = LtTusUploadState;
+/**
+ * Response header in which nest-server (11.42.13+, `TUS_FILE_ID_HEADER`) names the stored file. Sent on the response that
+ * completes the upload and listed in `Access-Control-Expose-Headers`.
+ */
+export declare const LT_TUS_FILE_ID_HEADER = "X-File-Id";
+/** Default retry delays of a TUS upload in milliseconds. */
+export declare const LT_TUS_RETRY_DELAYS: readonly number[];
+/**
+ * Create a TUS upload queue (counterpart of `useLtTusUpload()`), bound to the current injection context: running
+ * uploads are aborted when the component/service is destroyed.
+ *
+ * `tus-js-client` (optional peer) is loaded lazily; without it `addFiles` rejects with an install hint.
+ * Defaults: `autoStart` true, chunk size and endpoint from `provideLtFiles()`, 3 parallel uploads, retries
+ * `[0, 1000, 3000, 5000, 10000]` (none on 4xx except 429), `withCredentials` for the session cookie, Bearer token
+ * in JWT mode, the nest-server file id from the `X-File-Id` response header, resume via fingerprints.
+ *
+ * Options are read whenever an upload is created or started, so an object with getters (e.g. over component inputs)
+ * stays current. `undefined` values keep the default. Uploads beyond `parallelUploads` wait in a queue and start as
+ * soon as a slot is free; `startUpload`/`resumeUpload`/`retryUpload` of a single item start it right away.
+ *
+ * @example
+ * protected readonly upload = injectLtTusUpload({ onSuccess: (item) => this.attach(item.fileId) });
+ */
+export declare function injectLtTusUpload(options?: LtUploadOptions): LtTusUpload;
+export type { LtFileInfo, LtFileState, LtFilesOptions, LtResolvedFilesOptions, LtTusClient, LtTusClientUpload, LtTusClientUploadOptions, LtTusHttpRequest, LtTusHttpResponse, LtTusOptions, LtTusPreviousUpload, LtTusUpload, LtTusUploadState, LtUploadItem, LtUploadOptions, LtUploadProgress, LtUploadStatus };

package/types/lenne.tech-ng-base-server.d.ts

@@ -0,0 +1,262 @@
+import { IncomingMessage, ServerResponse } from "node:http";
+import { LtRequestContext, LtRuntimeConfig, LtServerRuntimeConfig } from "@lenne.tech/ng-base";
+import { EnvironmentProviders } from "@angular/core";
+/** Environment map (`process.env` shape). */
+type LtEnv = Record<string, string | undefined>;
+/**
+ * Feature options that may be overridden at runtime via `NG_PUBLIC_LT_<FEATURE>_<OPTION>` (camelCase ↔ SCREAMING_SNAKE).
+ * Only listed keys are read, so an env name maps to exactly one option. Values are parsed by the type of the default:
+ * booleans (`true`/`false`), numbers, string arrays (comma-separated), strings.
+ */
+export declare const LT_RUNTIME_FEATURE_KEYS: Readonly<Record<string, Readonly<Record<string, 'array' | 'boolean' | 'number' | 'string'>>>>;
+/** `loginPath` → `LOGIN_PATH`. */
+export declare function toLtEnvKey(camel: string): string;
+/**
+ * Read the runtime configuration from the server environment (default `process.env`), the counterpart of Nuxt's
+ * `NUXT_*` → `runtimeConfig` mapping:
+ *
+ * | Variable | Target |
+ * |---|---|
+ * | `NG_PUBLIC_API_URL` | `apiUrl` |
+ * | `NG_API_URL` | `serverApiUrl` (SSR only, never transferred) |
+ * | `NG_PUBLIC_SITE_URL` | `siteUrl` |
+ * | `NG_PUBLIC_STORAGE_PREFIX` | `storagePrefix` |
+ * | `NG_PUBLIC_COOKIE_PREFIX` | `cookiePrefix` |
+ * | `NG_PUBLIC_API_PROXY` | `apiProxy` (`true`/`false`; unset = `null`) |
+ * | `NG_PUBLIC_APP_ENV` | `appEnv` |
+ * | `NG_PUBLIC_APP_COMMIT`, fallback `APP_VERSION_COMMIT` | `appCommit` |
+ * | `NG_PUBLIC_APP_VERSION` | `appVersion` (or `options.appVersion`) |
+ * | `NG_PUBLIC_LT_<FEATURE>_<OPTION>` | `lt.<feature>.<option>` (see {@link LT_RUNTIME_FEATURE_KEYS}) |
+ *
+ * Unset variables stay `undefined`, so code defaults keep applying.
+ */
+export declare function readLtRuntimeConfigFromEnv(env?: LtEnv, options?: LtRuntimeEnvOptions): LtServerRuntimeConfig;
+/** Options of {@link readLtRuntimeConfigFromEnv} / {@link readLtRequestContext}. */
+interface LtRuntimeEnvOptions {
+  /** Version of the running build (e.g. from package.json); overrides `NG_PUBLIC_APP_VERSION`. */
+  appVersion?: string;
+  /** Additional public values of the project (e.g. `{ plausibleApiHost: env.NG_PUBLIC_PLAUSIBLE_API_HOST }`). */
+  extend?: (env: LtEnv) => Record<string, unknown>;
+}
+/**
+ * Build the request context for `AngularNodeAppEngine.handle(req, context)` from the environment, per request (a
+ * changed env needs no rebuild). Angular code reads it through `REQUEST_CONTEXT` (`LT_SERVER_RUNTIME_CONFIG`), and the
+ * public part must be written into the HTML with `injectLtRuntimeConfigScript()` / `ltAngularRequestHandler()`.
+ */
+export declare function readLtRequestContext(env?: LtEnv, options?: LtRuntimeEnvOptions): LtRequestContext;
+/** Parse one env value by its option type (`undefined` for unset or unparsable values). */
+export declare function parseLtEnvValue(raw: string | undefined, type: 'array' | 'boolean' | 'number' | 'string'): unknown;
+/**
+ * Alternative to the request context for servers that call `handle(req)` without one: reads the `NG_*` environment
+ * at request time in the app (every SSR render bootstraps it) and provides `LT_SERVER_RUNTIME_CONFIG`. The browser
+ * still needs `<script id="ng-runtime-config">` in the HTML, so prefer `ltAngularRequestHandler()`, which does both.
+ */
+export declare function provideLtServerRuntimeConfig(env?: LtEnv | (() => LtEnv)): EnvironmentProviders;
+/** Express-compatible middleware (`(req, res, next)`), also usable with plain `node:http`. */
+type LtNodeMiddleware = (req: IncomingMessage, res: ServerResponse, next: (error?: unknown) => void) => void;
+/** HSTS header value set on HTTPS requests. */
+export declare const LT_HSTS_VALUE = "max-age=31536000; includeSubDomains";
+/** Whether the request came in over HTTPS (`X-Forwarded-Proto` first, then the socket). */
+export declare function isLtSecureRequest(req: Pick<IncomingMessage, 'headers'> & {
+  socket?: unknown;
+}): boolean;
+/** The security headers for a request (same set as nuxt-base-starter; no CSP by design). */
+export declare function buildLtSecurityHeaders(options: {
+  secure: boolean;
+}): Record<string, string>;
+/**
+ * Security headers on every response: `nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin`,
+ * `Permissions-Policy`, `X-DNS-Prefetch-Control: off`, `X-Permitted-Cross-Domain-Policies: none`, HSTS on HTTPS;
+ * removes `X-Powered-By`; never overwrites a header a route already set.
+ */
+export declare function ltSecurityHeaders(): LtNodeMiddleware;
+/**
+ * Cache headers for SSR HTML: `Cache-Control: private, no-cache` and `Vary: Cookie` (the page depends on the auth
+ * cookie), unless the response already has a `Cache-Control`. Apply it to the `Response` of `AngularNodeAppEngine.handle()`
+ * before `writeResponseToNodeResponse()`. Returns whether the headers were set.
+ */
+export declare function applyLtHtmlCacheHeaders(response: Response): boolean;
+/** Options of {@link ltSecurityTxt}. Values can be overridden per stage via `NG_LT_SECURITY_TXT_*`. */
+interface LtSecurityTxtHandlerOptions {
+  /** Contact URI(s) (`mailto:`, `https://`, `tel:`), default `mailto:security@lenne.tech`. Env `NG_LT_SECURITY_TXT_CONTACT` (comma-separated). */
+  contact?: string | string[];
+  /** Hostnames served without redirect; a request for one adds a second `Canonical` line. Env `NG_LT_SECURITY_TXT_HOSTS`. */
+  hosts?: string[];
+  /** Policy URI or path (resolved against the site URL). Env `NG_LT_SECURITY_TXT_POLICY`. */
+  policy?: string;
+  /** Language tags (default `de, en`). Env `NG_LT_SECURITY_TXT_PREFERRED_LANGUAGES`. */
+  preferredLanguages?: string[];
+  /** Site URL for `Canonical` (default `NG_PUBLIC_SITE_URL`). */
+  siteUrl?: string;
+  /** Days until `Expires` (default 180, max 365). Env `NG_LT_SECURITY_TXT_VALID_DAYS`. */
+  validDays?: number;
+  /** Environment to read the overrides from (default `process.env`). */
+  env?: LtEnv;
+}
+/**
+ * Serve `/.well-known/security.txt` (RFC 9116), built per request: GET/HEAD, `text/plain`, `no-store`; 404 when no
+ * valid contact is configured. Register it only where somebody reads the contact address.
+ *
+ * @example server.ts: app.use(ltSecurityTxt({ contact: 'mailto:security@customer.example' }))
+ */
+export declare function ltSecurityTxt(options?: LtSecurityTxtHandlerOptions): LtNodeMiddleware;
+/** Options of {@link ltBuildIdentity}. */
+interface LtBuildIdentityOptions {
+  /** Route (default `/api/build-identity`). */
+  path?: string;
+  /** App version (default `NG_PUBLIC_APP_VERSION`, else `0.0.0`). */
+  version?: string;
+  /** Environment (default `process.env`). */
+  env?: LtEnv;
+}
+/** Commit of the running build: `NG_PUBLIC_APP_COMMIT`, else `APP_VERSION_COMMIT` (TurboOps), else `unknown`. */
+export declare function resolveLtBuildCommit(env?: LtEnv): string;
+/** `GET /api/build-identity` → `{ commit, version }` (no-store), used by the admin system page to detect drift. */
+export declare function ltBuildIdentity(options?: LtBuildIdentityOptions): LtNodeMiddleware;
+/** The part of `AngularNodeAppEngine` the handler needs. */
+interface LtAngularEngine {
+  handle(request: IncomingMessage, requestContext?: unknown): Promise<Response | null>;
+}
+/** Options of {@link ltAngularRequestHandler}. */
+interface LtAngularRequestHandlerOptions extends LtRuntimeEnvOptions {
+  /** Set `Cache-Control: private, no-cache` + `Vary: Cookie` on HTML without own cache header (default `true`). */
+  htmlNoCache?: boolean;
+  /** Write the pre-hydration submit guard into the HTML (default `true`, see `LT_PRE_HYDRATION_SUBMIT_GUARD_SCRIPT`). */
+  submitGuard?: boolean;
+  /** Environment (default `process.env`, read per request). */
+  env?: LtEnv;
+}
+/**
+ * Write the public runtime configuration as `<script id="ng-runtime-config">` into an HTML response (SSR and
+ * client-rendered routes alike). Non-HTML responses are returned unchanged.
+ */
+export declare function withLtRuntimeConfigScript(response: Response, config: Partial<LtRuntimeConfig>, options?: {
+  submitGuard?: boolean;
+}): Promise<Response>;
+/**
+ * The Angular render handler for `server.ts`: per request it reads the `NG_*` environment into an
+ * {@link LtRequestContext}, renders with `engine.handle(req, context)`, adds the HTML cache headers and the runtime
+ * config script, and writes the response. Unhandled requests go to `next()`.
+ *
+ * @example server.ts
+ * app.use(ltAngularRequestHandler(new AngularNodeAppEngine(), { appVersion: packageJson.version }));
+ */
+export declare function ltAngularRequestHandler(engine: LtAngularEngine, options?: LtAngularRequestHandlerOptions): LtNodeMiddleware;
+/** Options of {@link ltApiProxy}. */
+interface LtApiProxyOptions {
+  /**
+   * Serve the proxy (default: only when `NG_PUBLIC_API_PROXY=true`). On deployed stages the browser talks to the API
+   * directly; the proxy is for same-origin cookies and WebAuthn on `localhost` (SSR dev server, `lt dev`, E2E).
+   */
+  enabled?: boolean;
+  /** Environment (default `process.env`). */
+  env?: LtEnv;
+  /** Path prefix that is stripped (default `/api`). */
+  prefix?: string;
+  /** Target API (default `NG_API_URL`, then `NG_PUBLIC_API_URL`). */
+  target?: string;
+}
+/**
+ * Rewrite a backend `Set-Cookie` for the app origin: drop `Domain`, drop `Secure` on plain HTTP, force `Path=/`.
+ * Without it the session cookie of `localhost:3000` never reaches the app on `localhost:3001`.
+ */
+export declare function rewriteLtProxyCookie(cookie: string, secure: boolean): string;
+/**
+ * Rewrite a backend `Location` / `Content-Location` for the browser: a URL on the proxy target (`http://api:3000/tus/1`)
+ * or an API path (`/tus/1`) becomes the proxied path (`/api/tus/1`); other origins (OAuth redirects) stay unchanged.
+ * Without it a TUS upload continues against the internal `NG_API_URL`, which the browser can neither reach nor should
+ * ever learn.
+ */
+export declare function rewriteLtProxyLocation(location: string, target: string, prefix: string): string;
+/**
+ * Same-origin API proxy for the Angular SSR server: `/api/<path>` → `<target>/<path>` (method, body and the auth
+ * headers forwarded, streaming both ways, `Set-Cookie` rewritten). The counterpart of nuxt-base-starter's
+ * `server/api/iam/[...path].ts`, covering every API path (auth, TUS, AI SSE, sync).
+ *
+ * `ng serve` uses `proxy.conf.mjs` instead; this is for the built server (`.output/server/index.mjs`).
+ */
+export declare function ltApiProxy(options?: LtApiProxyOptions): LtNodeMiddleware;
+/**
+ * security.txt according to RFC 9116, built per request.
+ *
+ * Ported from the lenne.Tech website (DEV-3602), where it has been live since 2026-10-13.
+ * Pure functions only, so the route stays a thin adapter and everything that decides the
+ * file's content is unit-testable without a Nitro context.
+ */
+export declare const SECURITY_TXT_PATH = "/.well-known/security.txt";
+export declare const SECURITY_TXT_DEFAULT_CONTACT = "mailto:security@lenne.tech";
+export declare const SECURITY_TXT_DEFAULT_LANGUAGES: string[];
+export declare const SECURITY_TXT_DEFAULT_VALID_DAYS = 180;
+interface SecurityTxtOptions {
+  /** Contact URIs (`mailto:`, `https:` or `tel:`), in order of preference. */
+  contacts: string[];
+  /** Point in time the file is built for; `Expires` is derived from it. */
+  now: Date;
+  /** Origins the file is served from; each becomes one `Canonical` line. */
+  origins: string[];
+  /** URI of the vulnerability disclosure policy, or a path resolved against the first origin. */
+  policy?: string;
+  /** Language tags in order of preference. */
+  preferredLanguages?: string[];
+  /** Days between `now` and `Expires`. */
+  validDays?: number;
+}
+/**
+ * Normalises the configured contact(s). Accepts a string or an array (`ltSecurityTxt()` splits the comma-separated
+ * runtime override `NG_LT_SECURITY_TXT_CONTACT`).
+ *
+ * Whatever is not a usable URI is dropped. `security@example.com` is the obvious typo, and scanners
+ * treat the file it would produce as invalid; with no contact left, the route answers 404 instead.
+ */
+export declare function normalizeSecurityTxtContacts(contact: unknown): string[];
+/**
+ * Normalises a list option (languages, hosts). A runtime override via an environment variable
+ * arrives as a string, so `"de, en"` is accepted as well as `['de', 'en']`.
+ */
+export declare function normalizeSecurityTxtList(value: unknown): string[];
+/**
+ * Clamps `validDays` into the window RFC 9116 recommends. A non-finite or non-positive value
+ * falls back to the default instead of producing an `Expires` in the past.
+ */
+export declare function normalizeSecurityTxtValidDays(validDays: unknown): number;
+/**
+ * Turns a configured site URL into an origin (`https://example.com`), dropping path, query and
+ * trailing slash. Anything that is not an absolute http(s) URL yields `undefined`.
+ */
+export declare function toSecurityTxtOrigin(url: string | undefined): string | undefined;
+/**
+ * Turns the requested host into an origin, but only if it is one the site is known to be served
+ * from. The host comes from a request header, so anything else must not end up in the file.
+ */
+export declare function allowedRequestOrigin(host: string | undefined, allowedHosts: string[]): string | undefined;
+/**
+ * Builds a security.txt according to RFC 9116.
+ *
+ * `Expires` is relative to `now`, so a file built per request never goes stale, no matter how
+ * long ago the last deployment was. It is cut to midnight UTC, which makes the file valid for up
+ * to a day less than `validDays` and keeps it byte-identical for a whole day.
+ */
+declare function buildSecurityTxt(options: SecurityTxtOptions): string;
+/** The server-only runtime config the module writes to `runtimeConfig.ltExtensions.securityTxt`. */
+interface SecurityTxtRuntimeConfig {
+  contact?: string | string[];
+  hosts?: string | string[];
+  policy?: string;
+  preferredLanguages?: string | string[];
+  validDays?: number | string;
+}
+/**
+ * Turns the runtime config and the request into the file's content, or `undefined` when no
+ * usable contact is left (the route then answers 404).
+ *
+ * `Canonical` names the configured site URL and, in addition, the requested host if it is one of
+ * the configured `hosts`. A site served under several hostnames without a redirect needs the
+ * second line: RFC 9116 expects the URI a file was fetched from among its Canonical lines.
+ */
+declare function resolveSecurityTxt(input: {
+  config: SecurityTxtRuntimeConfig | undefined;
+  now: Date;
+  requestHost: string | undefined;
+  siteUrl: string | undefined;
+}): string | undefined;
+export { type LtAngularEngine, type LtAngularRequestHandlerOptions, type LtApiProxyOptions, type LtBuildIdentityOptions, type LtEnv, type LtNodeMiddleware, type LtRuntimeEnvOptions, type LtSecurityTxtHandlerOptions, type SecurityTxtOptions as LtSecurityTxtOptions, type SecurityTxtRuntimeConfig as LtSecurityTxtRuntimeConfig, buildSecurityTxt as buildLtSecurityTxt, resolveSecurityTxt as resolveLtSecurityTxt };

package/types/lenne.tech-ng-base-share.d.ts

@@ -0,0 +1,21 @@
+import * as i0 from "@angular/core";
+/** Result of {@link LtShareService.share}. */
+type LtShareResult = 'aborted' | 'copied' | 'failed' | 'shared' | 'unavailable';
+/**
+ * Web Share API with clipboard fallback (counterpart of `useLtShare()`). Browser only.
+ *
+ * `share()` uses `navigator.share({ title, text, url })` where available; otherwise the URL is copied to the clipboard
+ * and a success toast (`lt.share.copied`) is shown. The URL defaults to the current page.
+ */
+export declare class LtShareService {
+  private readonly i18n;
+  private readonly toast;
+  private readonly isBrowser;
+  /** Whether the native share sheet is available. */
+  canShare(): boolean;
+  /** Share a link (native share sheet, else clipboard + toast). */
+  share(title?: string, text?: string, url?: string): Promise<LtShareResult>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<LtShareService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export type { LtShareResult };