@seifer-webapp-factory/authentication 0.1.0

package/dist/backend/src/ports.d.ts

@@ -0,0 +1,60 @@
+/**
+ * De poorten & de dependency-bundle van de authentication-mechanism-laag.
+ *
+ * De flow-services zijn framework-vrij en krijgen ALLE afhankelijkheden via één {@link AuthModuleDeps}-
+ * bundel. We hergebruiken de poorten van de `auth`-kit (UserStore, Mailer, PasswordHasher, Clock,
+ * TokenStore) i.p.v. eigen varianten te definiëren. Voor de token- en single-use-service typen we tegen
+ * smalle *structurele* poorten (`TokenServicePort`/`SingleUseServicePort`): de kit exporteert deze als
+ * klassen met `#private`-velden — die zijn nominaal en dus niet fakebaar — terwijl een structurele
+ * interface zowel de echte kit-service als een in-memory fake accepteert.
+ */
+import type { Clock, IssuedTokens, Mailer, PasswordHasher, UserStore, VerifiedAccess } from '@seifer-webapp-factory/kits/backend/auth';
+import type { AuthEventSink } from '../../contract/index.js';
+/**
+ * Structurele poort die de publieke API van de kit-`TokenService` weerspiegelt (JWT + roterend
+ * refresh). `revokeRefresh` retourneert het subject uitsluitend wanneer het token nú werd ingetrokken
+ * (emit-once); `revokeAllForSubject` trekt alle sessies van een gebruiker in (bv. na wachtwoord-reset).
+ */
+export interface TokenServicePort {
+    issue(subject: string, claims?: Record<string, unknown>): Promise<IssuedTokens>;
+    verify(accessToken: string): Promise<VerifiedAccess>;
+    refresh(refreshToken: string): Promise<IssuedTokens>;
+    revokeAccess(accessToken: string): Promise<void>;
+    revokeRefresh(refreshToken: string): Promise<string | null>;
+    revokeAllForSubject(subject: string): Promise<void>;
+}
+/** Structurele poort die de publieke API van de kit-`SingleUseTokenService` weerspiegelt. */
+export interface SingleUseServicePort {
+    issue(purpose: string, payload: unknown): Promise<string>;
+    consume(token: string, purpose: string): Promise<unknown>;
+}
+/** Wachtwoord-beleid (US-A0603) — details komen uit config, niet uit het schema. */
+export interface PasswordPolicy {
+    minLength: number;
+    maxLength: number;
+}
+/** Purposes voor de single-use-tokens; sluiten aan op de kit-defaults maar zijn configureerbaar. */
+export interface AuthPurposes {
+    emailVerify: string;
+    passwordReset: string;
+}
+/** Configuratie van de mechanism-laag (geen secrets hier — die zitten in de geïnjecteerde services). */
+export interface AuthModuleConfig {
+    purposes: AuthPurposes;
+    password: PasswordPolicy;
+}
+/**
+ * De volledige afhankelijkheids-bundel die in elke flow-service wordt geïnjecteerd. Geen module-globale
+ * state; determinisme loopt via de geïnjecteerde {@link Clock}.
+ */
+export interface AuthModuleDeps {
+    userStore: UserStore;
+    mailer: Mailer;
+    hasher: PasswordHasher;
+    tokenService: TokenServicePort;
+    singleUseTokenService: SingleUseServicePort;
+    events: AuthEventSink;
+    clock: Clock;
+    config: AuthModuleConfig;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/backend/src/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../backend/src/ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,MAAM,EACN,cAAc,EACd,SAAS,EACT,cAAc,EACf,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChF,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;CAC1B"}

package/dist/backend/src/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/backend/src/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../backend/src/ports.ts"],"names":[],"mappings":""}

package/dist/backend/src/services.d.ts

@@ -0,0 +1,49 @@
+import type { Acknowledgement, ForgotPasswordRequest, LoginRequest, RegisterRequest, ResetPasswordRequest, SessionResponse } from '../../contract/index.js';
+import type { AuthModuleDeps } from './ports.js';
+/**
+ * Resultaat van login/refresh. `session` is de contract-body; `refreshToken` is het opaque, roterende
+ * refresh-token dat de surface-laag via een httpOnly-cookie zet (US-A0703) — het hoort NIET in de body.
+ */
+export interface SessionResult {
+    session: SessionResponse;
+    refreshToken: string;
+}
+/**
+ * Registreer een gebruiker: hash + opslaan, single-use verificatietoken uitgeven, verificatiemail sturen,
+ * `user.registered` emitten. Fouten: `weak_password`, `email_taken`.
+ */
+export declare function registerUser(deps: AuthModuleDeps, req: RegisterRequest): Promise<Acknowledgement>;
+/**
+ * Verifieer een e-mailadres: verbruik het single-use verificatietoken (exact één keer), markeer de
+ * gebruiker als geverifieerd en emit `user.verified`. Fouten: `token_invalid`, `token_expired`.
+ */
+export declare function verifyEmail(deps: AuthModuleDeps, token: string): Promise<Acknowledgement>;
+/**
+ * Log in: gebruiker zoeken, wachtwoord verifiëren, geverifieerd e-mailadres eisen, tokens uitgeven en
+ * `user.logged_in` emitten. No-enumeration: onbekend e-mailadres én verkeerd wachtwoord geven BEIDE
+ * `invalid_credentials`. `email_not_verified` wordt pas ná geslaagde wachtwoordcontrole onthuld.
+ */
+export declare function login(deps: AuthModuleDeps, req: LoginRequest): Promise<SessionResult>;
+/**
+ * Ververs de sessie: roteer het refresh-token via de kit (met hergebruik-detectie), emit
+ * `session.refreshed`. Fouten: `unauthenticated`, `token_invalid`, `token_expired`.
+ */
+export declare function refresh(deps: AuthModuleDeps, refreshToken: string | undefined): Promise<SessionResult>;
+/**
+ * Log uit: trek het refresh-token in en emit `user.logged_out`. Idempotent — een onbekend of reeds
+ * ingetrokken token geeft geen fout en emit geen dubbel event.
+ */
+export declare function logout(deps: AuthModuleDeps, refreshToken: string | undefined): Promise<Acknowledgement>;
+/**
+ * Start een wachtwoord-reset. No-enumeration: retourneert ALTIJD dezelfde generieke bevestiging. Alleen
+ * als de gebruiker bestaat wordt een reset-token uitgegeven, een mail gestuurd en `password.reset_requested`
+ * geëmit.
+ */
+export declare function forgotPassword(deps: AuthModuleDeps, req: ForgotPasswordRequest): Promise<Acknowledgement>;
+/**
+ * Reset het wachtwoord: verbruik het single-use reset-token (exact één keer), zet de nieuwe hash, trek
+ * ALLE sessies van de gebruiker in en emit `password.reset`. Fouten: `weak_password`, `token_invalid`,
+ * `token_expired`.
+ */
+export declare function resetPassword(deps: AuthModuleDeps, req: ResetPasswordRequest): Promise<Acknowledgement>;
+//# sourceMappingURL=services.d.ts.map

package/dist/backend/src/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../backend/src/services.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,YAAY,EAEZ,eAAe,EACf,oBAAoB,EACpB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAuBvG;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAS/F;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAiB3F;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAgB5G;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,CAU7G;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAY/G;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CAe7G"}

package/dist/backend/src/services.js

@@ -0,0 +1,178 @@
+/**
+ * De backend-mechanism-laag: framework-vrije flow-services voor authentication. Elke functie krijgt de
+ * {@link AuthModuleDeps}-bundel + het gevalideerde request, componeert de `auth`-kit-services, mapt
+ * fouten naar de contract-taxonomie, emit het juiste domein-event en handhaaft de security-invarianten
+ * (no-enumeration, single-use + revoke, idempotente logout). NestJS-controllers zijn *surface* en horen
+ * hier niet thuis.
+ */
+import { newId } from '@seifer-webapp-factory/kits/backend/auth';
+import { AuthModuleError, asModuleError } from './errors.js';
+const OK = { ok: true };
+// --- Services ---
+/**
+ * Registreer een gebruiker: hash + opslaan, single-use verificatietoken uitgeven, verificatiemail sturen,
+ * `user.registered` emitten. Fouten: `weak_password`, `email_taken`.
+ */
+export async function registerUser(deps, req) {
+    assertStrongPassword(deps, req.password);
+    const existing = await deps.userStore.findByIdentifier(req.email);
+    if (existing)
+        throw new AuthModuleError('email_taken');
+    const passwordHash = await deps.hasher.hash(req.password);
+    const user = await deps.userStore.save({
+        id: newId(),
+        identifier: req.email,
+        passwordHash,
+        verified: false,
+    });
+    const token = await deps.singleUseTokenService.issue(deps.config.purposes.emailVerify, { userId: user.id });
+    await deps.mailer.send({
+        to: req.email,
+        subject: 'Bevestig je account',
+        data: { token, purpose: deps.config.purposes.emailVerify },
+    });
+    deps.events.emit({ name: 'user.registered', occurredAt: nowIso(deps), userId: user.id, email: req.email });
+    return OK;
+}
+/**
+ * Verifieer een e-mailadres: verbruik het single-use verificatietoken (exact één keer), markeer de
+ * gebruiker als geverifieerd en emit `user.verified`. Fouten: `token_invalid`, `token_expired`.
+ */
+export async function verifyEmail(deps, token) {
+    const payload = await consume(deps, token, deps.config.purposes.emailVerify);
+    const user = await deps.userStore.findById(payload.userId);
+    if (!user)
+        throw new AuthModuleError('token_invalid');
+    const saved = await deps.userStore.save({ ...user, verified: true });
+    deps.events.emit({ name: 'user.verified', occurredAt: nowIso(deps), userId: saved.id });
+    return OK;
+}
+/**
+ * Log in: gebruiker zoeken, wachtwoord verifiëren, geverifieerd e-mailadres eisen, tokens uitgeven en
+ * `user.logged_in` emitten. No-enumeration: onbekend e-mailadres én verkeerd wachtwoord geven BEIDE
+ * `invalid_credentials`. `email_not_verified` wordt pas ná geslaagde wachtwoordcontrole onthuld.
+ */
+export async function login(deps, req) {
+    const user = await deps.userStore.findByIdentifier(req.email);
+    if (!user || !user.passwordHash)
+        throw new AuthModuleError('invalid_credentials');
+    const { valid, needsRehash } = await deps.hasher.verify(req.password, user.passwordHash);
+    if (!valid)
+        throw new AuthModuleError('invalid_credentials');
+    if (!user.verified)
+        throw new AuthModuleError('email_not_verified');
+    if (needsRehash) {
+        const passwordHash = await deps.hasher.hash(req.password);
+        await deps.userStore.save({ ...user, passwordHash });
+    }
+    const tokens = await deps.tokenService.issue(user.id, { identifier: user.identifier });
+    deps.events.emit({ name: 'user.logged_in', occurredAt: nowIso(deps), userId: user.id });
+    return { session: toSession(user, tokens.accessToken, tokens.expiresInSeconds), refreshToken: tokens.refreshToken };
+}
+/**
+ * Ververs de sessie: roteer het refresh-token via de kit (met hergebruik-detectie), emit
+ * `session.refreshed`. Fouten: `unauthenticated`, `token_invalid`, `token_expired`.
+ */
+export async function refresh(deps, refreshToken) {
+    if (!refreshToken)
+        throw new AuthModuleError('unauthenticated');
+    let tokens;
+    try {
+        tokens = await deps.tokenService.refresh(refreshToken);
+    }
+    catch (err) {
+        throw asModuleError(err) ?? err;
+    }
+    const verified = await deps.tokenService.verify(tokens.accessToken);
+    const user = await deps.userStore.findById(verified.subject);
+    if (!user)
+        throw new AuthModuleError('unauthenticated');
+    deps.events.emit({ name: 'session.refreshed', occurredAt: nowIso(deps), userId: user.id });
+    return { session: toSession(user, tokens.accessToken, tokens.expiresInSeconds), refreshToken: tokens.refreshToken };
+}
+/**
+ * Log uit: trek het refresh-token in en emit `user.logged_out`. Idempotent — een onbekend of reeds
+ * ingetrokken token geeft geen fout en emit geen dubbel event.
+ */
+export async function logout(deps, refreshToken) {
+    if (!refreshToken)
+        return OK;
+    // De kit trekt idempotent in en geeft het subject alleen terug wanneer dit token nú werd
+    // ingetrokken — dus emitten we `user.logged_out` precies één keer, zonder eigen lookup.
+    const subject = await deps.tokenService.revokeRefresh(refreshToken);
+    if (subject !== null) {
+        deps.events.emit({ name: 'user.logged_out', occurredAt: nowIso(deps), userId: subject });
+    }
+    return OK;
+}
+/**
+ * Start een wachtwoord-reset. No-enumeration: retourneert ALTIJD dezelfde generieke bevestiging. Alleen
+ * als de gebruiker bestaat wordt een reset-token uitgegeven, een mail gestuurd en `password.reset_requested`
+ * geëmit.
+ */
+export async function forgotPassword(deps, req) {
+    const user = await deps.userStore.findByIdentifier(req.email);
+    if (user) {
+        const token = await deps.singleUseTokenService.issue(deps.config.purposes.passwordReset, { userId: user.id });
+        await deps.mailer.send({
+            to: req.email,
+            subject: 'Reset je wachtwoord',
+            data: { token, purpose: deps.config.purposes.passwordReset },
+        });
+        deps.events.emit({ name: 'password.reset_requested', occurredAt: nowIso(deps), userId: user.id });
+    }
+    return OK;
+}
+/**
+ * Reset het wachtwoord: verbruik het single-use reset-token (exact één keer), zet de nieuwe hash, trek
+ * ALLE sessies van de gebruiker in en emit `password.reset`. Fouten: `weak_password`, `token_invalid`,
+ * `token_expired`.
+ */
+export async function resetPassword(deps, req) {
+    // Beleid vóór verbruik controleren: een zwak wachtwoord mag geen geldig token opbranden.
+    assertStrongPassword(deps, req.password);
+    const payload = await consume(deps, req.token, deps.config.purposes.passwordReset);
+    const user = await deps.userStore.findById(payload.userId);
+    if (!user)
+        throw new AuthModuleError('token_invalid');
+    const passwordHash = await deps.hasher.hash(req.password);
+    await deps.userStore.save({ ...user, passwordHash });
+    await deps.tokenService.revokeAllForSubject(user.id);
+    deps.events.emit({ name: 'password.reset', occurredAt: nowIso(deps), userId: user.id });
+    return OK;
+}
+// --- Interne helpers ---
+/** Verbruik een single-use-token en normaliseer de payload; kit-fouten → contract-taxonomie. */
+async function consume(deps, token, purpose) {
+    let payload;
+    try {
+        payload = await deps.singleUseTokenService.consume(token, purpose);
+    }
+    catch (err) {
+        throw asModuleError(err) ?? err;
+    }
+    if (!payload || typeof payload !== 'object' || typeof payload.userId !== 'string') {
+        throw new AuthModuleError('token_invalid');
+    }
+    return payload;
+}
+/** Handhaaf het wachtwoord-beleid uit config; gooit `weak_password`. */
+function assertStrongPassword(deps, password) {
+    const { minLength, maxLength } = deps.config.password;
+    if (password.length < minLength || password.length > maxLength) {
+        throw new AuthModuleError('weak_password');
+    }
+}
+/** ISO-8601 tijdstip uit de geïnjecteerde klok (deterministisch, geen `Date.now`). */
+function nowIso(deps) {
+    return new Date(deps.clock()).toISOString();
+}
+/** Map een kit-`UserRecord` naar de veilige contract-`PublicUser` (geen credential-materiaal). */
+function toPublicUser(user) {
+    return { id: user.id, email: user.identifier, emailVerified: user.verified === true };
+}
+/** Bouw de contract-`SessionResponse` (access-token in de body; refresh gaat via cookie). */
+function toSession(user, accessToken, expiresIn) {
+    return { user: toPublicUser(user), accessToken, expiresIn };
+}
+//# sourceMappingURL=services.js.map

package/dist/backend/src/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../backend/src/services.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,0CAA0C,CAAC;AAWjE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAY7D,MAAM,EAAE,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAEzC,mBAAmB;AAEnB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAoB,EAAE,GAAoB;IAC3E,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,EAAE,EAAE,KAAK,EAAE;QACX,UAAU,EAAE,GAAG,CAAC,KAAK;QACrB,YAAY;QACZ,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;KAC3D,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3G,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAoB,EAAE,KAAa;IACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAoB,EAAE,GAAiB;IACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAElF,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAE7D,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAEpE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACtH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB,EAAE,YAAgC;IAClF,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAEhE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAExD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACtH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAoB,EAAE,YAAgC;IACjF,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,yFAAyF;IACzF,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAoB,EAAE,GAA0B;IACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,EAAE,EAAE,GAAG,CAAC,KAAK;YACb,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAoB,EAAE,GAAyB;IACjF,yFAAyF;IACzF,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAEtD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0BAA0B;AAE1B,gGAAgG;AAChG,KAAK,UAAU,OAAO,CAAC,IAAoB,EAAE,KAAa,EAAE,OAAe;IACzE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAQ,OAAgC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5G,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAA6B,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,SAAS,oBAAoB,CAAC,IAAoB,EAAE,QAAgB;IAClE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,IAAoB;IAClC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,kGAAkG;AAClG,SAAS,YAAY,CAAC,IAAgB;IACpC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;AACxF,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,IAAgB,EAAE,WAAmB,EAAE,SAAiB;IACzE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC"}

package/dist/contract/endpoints.d.ts

@@ -0,0 +1,259 @@
+import type { z } from 'zod';
+import type { AuthErrorCode } from './errors.js';
+/**
+ * US-A0104/US-A0105 — de machine-leesbare endpoint-catalogus. Backend leidt hier route + validatie
+ * uit af; frontend leidt hier zijn getypte client uit af. Eén bron, geen drift.
+ */
+export interface EndpointDescriptor<Req extends z.ZodTypeAny | null, Res extends z.ZodTypeAny> {
+    readonly method: 'POST' | 'GET';
+    readonly path: string;
+    readonly request: Req;
+    readonly response: Res;
+    /** Foutcodes die dit endpoint kan retourneren (uit de gedeelde taxonomie). */
+    readonly errors: readonly AuthErrorCode[];
+    /** Vereist een geldig CSRF-token (cookie-transport, US-A0703). */
+    readonly csrf: boolean;
+    /** Vereist een geauthenticeerde sessie. */
+    readonly auth: boolean;
+}
+export declare const AUTH_ENDPOINTS: {
+    readonly register: {
+        readonly method: "POST";
+        readonly path: "/auth/register";
+        readonly request: z.ZodObject<{
+            email: z.ZodString;
+            password: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            email: string;
+            password: string;
+        }, {
+            email: string;
+            password: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["email_taken", "weak_password", "validation_failed", "rate_limited"];
+        readonly csrf: true;
+        readonly auth: false;
+    };
+    readonly verifyEmail: {
+        readonly method: "POST";
+        readonly path: "/auth/verify-email";
+        readonly request: z.ZodObject<{
+            token: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            token: string;
+        }, {
+            token: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["token_invalid", "token_expired"];
+        readonly csrf: true;
+        readonly auth: false;
+    };
+    readonly login: {
+        readonly method: "POST";
+        readonly path: "/auth/login";
+        readonly request: z.ZodObject<{
+            email: z.ZodString;
+            password: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            email: string;
+            password: string;
+        }, {
+            email: string;
+            password: string;
+        }>;
+        readonly response: z.ZodObject<{
+            user: z.ZodObject<{
+                id: z.ZodString;
+                email: z.ZodString;
+                emailVerified: z.ZodBoolean;
+            }, "strip", z.ZodTypeAny, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            }, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            }>;
+            accessToken: z.ZodString;
+            expiresIn: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            };
+            accessToken: string;
+            expiresIn: number;
+        }, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            };
+            accessToken: string;
+            expiresIn: number;
+        }>;
+        readonly errors: readonly ["invalid_credentials", "email_not_verified", "rate_limited", "csrf_failed"];
+        readonly csrf: true;
+        readonly auth: false;
+    };
+    readonly refresh: {
+        readonly method: "POST";
+        readonly path: "/auth/refresh";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            user: z.ZodObject<{
+                id: z.ZodString;
+                email: z.ZodString;
+                emailVerified: z.ZodBoolean;
+            }, "strip", z.ZodTypeAny, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            }, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            }>;
+            accessToken: z.ZodString;
+            expiresIn: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            };
+            accessToken: string;
+            expiresIn: number;
+        }, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            };
+            accessToken: string;
+            expiresIn: number;
+        }>;
+        readonly errors: readonly ["unauthenticated", "token_invalid", "token_expired"];
+        readonly csrf: true;
+        readonly auth: false;
+    };
+    readonly logout: {
+        readonly method: "POST";
+        readonly path: "/auth/logout";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly [];
+        readonly csrf: true;
+        readonly auth: false;
+    };
+    readonly forgotPassword: {
+        readonly method: "POST";
+        readonly path: "/auth/forgot-password";
+        readonly request: z.ZodObject<{
+            email: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            email: string;
+        }, {
+            email: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["rate_limited", "validation_failed"];
+        readonly csrf: true;
+        readonly auth: false;
+    };
+    readonly resetPassword: {
+        readonly method: "POST";
+        readonly path: "/auth/reset-password";
+        readonly request: z.ZodObject<{
+            token: z.ZodString;
+            password: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            password: string;
+            token: string;
+        }, {
+            password: string;
+            token: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["token_invalid", "token_expired", "weak_password"];
+        readonly csrf: true;
+        readonly auth: false;
+    };
+    readonly me: {
+        readonly method: "GET";
+        readonly path: "/auth/me";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            user: z.ZodObject<{
+                id: z.ZodString;
+                email: z.ZodString;
+                emailVerified: z.ZodBoolean;
+            }, "strip", z.ZodTypeAny, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            }, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            }>;
+            roles: z.ZodArray<z.ZodString, "many">;
+            permissions: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            };
+            roles: string[];
+            permissions: string[];
+        }, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+            };
+            roles: string[];
+            permissions: string[];
+        }>;
+        readonly errors: readonly ["unauthenticated"];
+        readonly csrf: false;
+        readonly auth: true;
+    };
+};
+export type AuthEndpointName = keyof typeof AUTH_ENDPOINTS;
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/contract/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../contract/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAW7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,GAAG,SAAS,CAAC,CAAC,UAAU,GAAG,IAAI,EAC/B,GAAG,SAAS,CAAC,CAAC,UAAU;IAExB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuC+D,CAAC;AAE3F,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,cAAc,CAAC"}

package/dist/contract/endpoints.js

@@ -0,0 +1,42 @@
+import { registerRequestSchema, verifyEmailRequestSchema, loginRequestSchema, forgotPasswordRequestSchema, resetPasswordRequestSchema, sessionResponseSchema, meResponseSchema, acknowledgementSchema, } from './schemas.js';
+export const AUTH_ENDPOINTS = {
+    register: {
+        method: 'POST', path: '/auth/register', request: registerRequestSchema,
+        response: acknowledgementSchema, errors: ['email_taken', 'weak_password', 'validation_failed', 'rate_limited'],
+        csrf: true, auth: false,
+    },
+    verifyEmail: {
+        method: 'POST', path: '/auth/verify-email', request: verifyEmailRequestSchema,
+        response: acknowledgementSchema, errors: ['token_invalid', 'token_expired'],
+        csrf: true, auth: false,
+    },
+    login: {
+        method: 'POST', path: '/auth/login', request: loginRequestSchema,
+        response: sessionResponseSchema, errors: ['invalid_credentials', 'email_not_verified', 'rate_limited', 'csrf_failed'],
+        csrf: true, auth: false,
+    },
+    refresh: {
+        method: 'POST', path: '/auth/refresh', request: null,
+        response: sessionResponseSchema, errors: ['unauthenticated', 'token_invalid', 'token_expired'],
+        csrf: true, auth: false,
+    },
+    logout: {
+        method: 'POST', path: '/auth/logout', request: null,
+        response: acknowledgementSchema, errors: [], csrf: true, auth: false,
+    },
+    forgotPassword: {
+        method: 'POST', path: '/auth/forgot-password', request: forgotPasswordRequestSchema,
+        response: acknowledgementSchema, errors: ['rate_limited', 'validation_failed'],
+        csrf: true, auth: false,
+    },
+    resetPassword: {
+        method: 'POST', path: '/auth/reset-password', request: resetPasswordRequestSchema,
+        response: acknowledgementSchema, errors: ['token_invalid', 'token_expired', 'weak_password'],
+        csrf: true, auth: false,
+    },
+    me: {
+        method: 'GET', path: '/auth/me', request: null,
+        response: meResponseSchema, errors: ['unauthenticated'], csrf: false, auth: true,
+    },
+};
+//# sourceMappingURL=endpoints.js.map

package/dist/contract/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../contract/endpoints.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAuBtB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB;QACtE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,cAAc,CAAC;QAC9G,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;KACxB;IACD,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,wBAAwB;QAC7E,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;QAC3E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;KACxB;IACD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB;QAChE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,CAAC;QACrH,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;KACxB;IACD,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI;QACpD,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,eAAe,CAAC;QAC9F,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;KACxB;IACD,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI;QACnD,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;KACrE;IACD,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,2BAA2B;QACnF,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;QAC9E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;KACxB;IACD,aAAa,EAAE;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,0BAA0B;QACjF,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC;QAC5F,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;KACxB;IACD,EAAE,EAAE;QACF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI;QAC9C,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI;KACjF;CACuF,CAAC"}

package/dist/contract/errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * US-A0102 — Error-taxonomie + i18n-sleutels. Eén gedeelde foutcodelijst die beide helften (backend
+ * mapping → HTTP, frontend weergave → i18n) uit het contract afleiden. Codes lekken nooit of een
+ * e-mail bestaat of waarom een token precies faalde (no-enumeration, security).
+ */
+export declare const AUTH_ERROR_CODES: readonly ["invalid_credentials", "email_taken", "weak_password", "token_invalid", "token_expired", "email_not_verified", "rate_limited", "csrf_failed", "unauthenticated", "validation_failed"];
+export type AuthErrorCode = (typeof AUTH_ERROR_CODES)[number];
+export interface AuthErrorDescriptor {
+    /** HTTP-status waarnaar de backend deze fout mapt. */
+    readonly httpStatus: number;
+    /** i18n-sleutel die de frontend toont (nooit rauwe details). */
+    readonly i18nKey: string;
+}
+/** Enige bron van de code→HTTP + code→i18n-mapping. Bewust generiek gehouden (no-enumeration). */
+export declare const AUTH_ERROR_TAXONOMY: Readonly<Record<AuthErrorCode, AuthErrorDescriptor>>;
+/** Contract-vorm van een foutrespons (body). Bevat nooit stacktraces of secret-materiaal. */
+export interface AuthErrorBody {
+    readonly code: AuthErrorCode;
+    readonly message: string;
+    /** Optioneel: veld-gebonden validatiefouten (paden), zonder ingevoerde waarden. */
+    readonly fields?: Readonly<Record<string, string[]>>;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/contract/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../contract/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,gBAAgB,iMAWnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAWnF,CAAC;AAEH,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CACtD"}