@seifer-webapp-factory/authentication 0.1.0

package/dist/contract/errors.js

@@ -0,0 +1,31 @@
+/**
+ * US-A0102 — Error-taxonomie + i18n-sleutels. Eén gedeelde foutcodelijst die beide helften (backend
+ * mapping → HTTP, frontend weergave → i18n) uit het contract afleiden. Codes lekken nooit of een
+ * e-mail bestaat of waarom een token precies faalde (no-enumeration, security).
+ */
+export const AUTH_ERROR_CODES = [
+    'invalid_credentials',
+    'email_taken',
+    'weak_password',
+    'token_invalid',
+    'token_expired',
+    'email_not_verified',
+    'rate_limited',
+    'csrf_failed',
+    'unauthenticated',
+    'validation_failed',
+];
+/** Enige bron van de code→HTTP + code→i18n-mapping. Bewust generiek gehouden (no-enumeration). */
+export const AUTH_ERROR_TAXONOMY = Object.freeze({
+    invalid_credentials: { httpStatus: 401, i18nKey: 'auth.error.invalid_credentials' },
+    email_taken: { httpStatus: 409, i18nKey: 'auth.error.email_taken' },
+    weak_password: { httpStatus: 422, i18nKey: 'auth.error.weak_password' },
+    token_invalid: { httpStatus: 400, i18nKey: 'auth.error.token_invalid' },
+    token_expired: { httpStatus: 410, i18nKey: 'auth.error.token_expired' },
+    email_not_verified: { httpStatus: 403, i18nKey: 'auth.error.email_not_verified' },
+    rate_limited: { httpStatus: 429, i18nKey: 'auth.error.rate_limited' },
+    csrf_failed: { httpStatus: 403, i18nKey: 'auth.error.csrf_failed' },
+    unauthenticated: { httpStatus: 401, i18nKey: 'auth.error.unauthenticated' },
+    validation_failed: { httpStatus: 422, i18nKey: 'auth.error.validation_failed' },
+});
+//# sourceMappingURL=errors.js.map

package/dist/contract/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../contract/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,qBAAqB;IACrB,aAAa;IACb,eAAe;IACf,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,mBAAmB;CACX,CAAC;AAWX,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAyD,MAAM,CAAC,MAAM,CAAC;IACrG,mBAAmB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACnF,WAAW,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACnE,aAAa,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACvE,aAAa,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACvE,aAAa,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACvE,kBAAkB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,+BAA+B,EAAE;IACjF,YAAY,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,yBAAyB,EAAE;IACrE,WAAW,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACnE,eAAe,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC3E,iBAAiB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE;CAChF,CAAC,CAAC"}

package/dist/contract/events.d.ts

@@ -0,0 +1,40 @@
+/**
+ * US-A0103 — Domein-events. De module publiceert deze events (bv. voor audit-log US-A0705 of
+ * host-hooks). Payloads bevatten identificatie, nooit credentials/tokens.
+ */
+export declare const AUTH_EVENTS: readonly ["user.registered", "user.verified", "user.logged_in", "user.logged_out", "session.refreshed", "password.reset_requested", "password.reset"];
+export type AuthEventName = (typeof AUTH_EVENTS)[number];
+export interface AuthEventBase {
+    readonly name: AuthEventName;
+    /** ISO-8601 timestamp — door de host/klok geïnjecteerd, niet hier gegenereerd. */
+    readonly occurredAt: string;
+    readonly userId: string;
+}
+export interface UserRegisteredEvent extends AuthEventBase {
+    readonly name: 'user.registered';
+    readonly email: string;
+}
+export interface UserVerifiedEvent extends AuthEventBase {
+    readonly name: 'user.verified';
+}
+export interface UserLoggedInEvent extends AuthEventBase {
+    readonly name: 'user.logged_in';
+}
+export interface UserLoggedOutEvent extends AuthEventBase {
+    readonly name: 'user.logged_out';
+}
+export interface SessionRefreshedEvent extends AuthEventBase {
+    readonly name: 'session.refreshed';
+}
+export interface PasswordResetRequestedEvent extends AuthEventBase {
+    readonly name: 'password.reset_requested';
+}
+export interface PasswordResetEvent extends AuthEventBase {
+    readonly name: 'password.reset';
+}
+export type AuthEvent = UserRegisteredEvent | UserVerifiedEvent | UserLoggedInEvent | UserLoggedOutEvent | SessionRefreshedEvent | PasswordResetRequestedEvent | PasswordResetEvent;
+/** Poort die de host levert om events te consumeren (audit-log/analytics/…). */
+export interface AuthEventSink {
+    emit(event: AuthEvent): void;
+}
+//# sourceMappingURL=events.d.ts.map

package/dist/contract/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../contract/events.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,WAAW,uJAQd,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AACD,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AACD,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC;AACD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AACD,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AACD,MAAM,WAAW,2BAA4B,SAAQ,aAAa;IAChE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;CAC3C;AACD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC;AAED,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,qBAAqB,GACrB,2BAA2B,GAC3B,kBAAkB,CAAC;AAEvB,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CAC9B"}

package/dist/contract/events.js

@@ -0,0 +1,14 @@
+/**
+ * US-A0103 — Domein-events. De module publiceert deze events (bv. voor audit-log US-A0705 of
+ * host-hooks). Payloads bevatten identificatie, nooit credentials/tokens.
+ */
+export const AUTH_EVENTS = [
+    'user.registered',
+    'user.verified',
+    'user.logged_in',
+    'user.logged_out',
+    'session.refreshed',
+    'password.reset_requested',
+    'password.reset',
+];
+//# sourceMappingURL=events.js.map

package/dist/contract/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../contract/events.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,0BAA0B;IAC1B,gBAAgB;CACR,CAAC"}

package/dist/contract/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * authentication — het contract (de seam). Eén bron waaruit backend-validatie én frontend-client
+ * hun types afleiden. Bevat geen mechanisme, alleen schema's/typen/taxonomie/events.
+ */
+export * from './schemas.js';
+export * from './errors.js';
+export * from './events.js';
+export * from './endpoints.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/contract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../contract/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/contract/index.js

@@ -0,0 +1,9 @@
+/**
+ * authentication — het contract (de seam). Eén bron waaruit backend-validatie én frontend-client
+ * hun types afleiden. Bevat geen mechanisme, alleen schema's/typen/taxonomie/events.
+ */
+export * from './schemas.js';
+export * from './errors.js';
+export * from './events.js';
+export * from './endpoints.js';
+//# sourceMappingURL=index.js.map

package/dist/contract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../contract/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/contract/schemas.d.ts

@@ -0,0 +1,150 @@
+import { z } from 'zod';
+/**
+ * US-A0101 — DTO-schema's (de seam). Eén set Zod-schema's waaruit de backend valideert én de
+ * frontend zijn getypte client afleidt (`z.infer`). Wachtwoord-policy-details komen uit config
+ * (US-A0603); hier alleen de vorm + minimale invarianten.
+ */
+export declare const emailSchema: z.ZodString;
+export declare const passwordSchema: z.ZodString;
+export declare const registerRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+}, {
+    email: string;
+    password: string;
+}>;
+export declare const verifyEmailRequestSchema: z.ZodObject<{
+    token: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    token: string;
+}, {
+    token: string;
+}>;
+export declare const loginRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+}, {
+    email: string;
+    password: string;
+}>;
+export declare const forgotPasswordRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+}, {
+    email: string;
+}>;
+export declare const resetPasswordRequestSchema: z.ZodObject<{
+    token: z.ZodString;
+    password: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    password: string;
+    token: string;
+}, {
+    password: string;
+    token: string;
+}>;
+export declare const publicUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    emailVerified: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    id: string;
+    emailVerified: boolean;
+}, {
+    email: string;
+    id: string;
+    emailVerified: boolean;
+}>;
+/** Access-token in de body; het roterende refresh-token gaat via httpOnly cookie (US-A0703). */
+export declare const sessionResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    }, {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    }>;
+    accessToken: z.ZodString;
+    expiresIn: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    user: {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    };
+    accessToken: string;
+    expiresIn: number;
+}, {
+    user: {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    };
+    accessToken: string;
+    expiresIn: number;
+}>;
+export declare const meResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    }, {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    }>;
+    roles: z.ZodArray<z.ZodString, "many">;
+    permissions: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    user: {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    };
+    roles: string[];
+    permissions: string[];
+}, {
+    user: {
+        email: string;
+        id: string;
+        emailVerified: boolean;
+    };
+    roles: string[];
+    permissions: string[];
+}>;
+/** Generieke bevestiging voor register/forgot (no-enumeration): altijd hetzelfde. */
+export declare const acknowledgementSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, "strip", z.ZodTypeAny, {
+    ok: true;
+}, {
+    ok: true;
+}>;
+export type RegisterRequest = z.infer<typeof registerRequestSchema>;
+export type VerifyEmailRequest = z.infer<typeof verifyEmailRequestSchema>;
+export type LoginRequest = z.infer<typeof loginRequestSchema>;
+export type ForgotPasswordRequest = z.infer<typeof forgotPasswordRequestSchema>;
+export type ResetPasswordRequest = z.infer<typeof resetPasswordRequestSchema>;
+export type PublicUser = z.infer<typeof publicUserSchema>;
+export type SessionResponse = z.infer<typeof sessionResponseSchema>;
+export type MeResponse = z.infer<typeof meResponseSchema>;
+export type Acknowledgement = z.infer<typeof acknowledgementSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/contract/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../contract/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,eAAO,MAAM,WAAW,aAAqB,CAAC;AAC9C,eAAO,MAAM,cAAc,aAA6B,CAAC;AAGzD,eAAO,MAAM,qBAAqB;;;;;;;;;EAGhC,CAAC;AACH,eAAO,MAAM,wBAAwB;;;;;;EAAyC,CAAC;AAC/E,eAAO,MAAM,kBAAkB;;;;;;;;;EAG7B,CAAC;AACH,eAAO,MAAM,2BAA2B;;;;;;EAAmC,CAAC;AAC5E,eAAO,MAAM,0BAA0B;;;;;;;;;EAGrC,CAAC;AAGH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAI3B,CAAC;AACH,gGAAgG;AAChG,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIhC,CAAC;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI3B,CAAC;AACH,qFAAqF;AACrF,eAAO,MAAM,qBAAqB;;;;;;EAAoC,CAAC;AAGvE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/contract/schemas.js

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+/**
+ * US-A0101 — DTO-schema's (de seam). Eén set Zod-schema's waaruit de backend valideert én de
+ * frontend zijn getypte client afleidt (`z.infer`). Wachtwoord-policy-details komen uit config
+ * (US-A0603); hier alleen de vorm + minimale invarianten.
+ */
+export const emailSchema = z.string().email();
+export const passwordSchema = z.string().min(8).max(200);
+// --- Requests ---
+export const registerRequestSchema = z.object({
+    email: emailSchema,
+    password: passwordSchema,
+});
+export const verifyEmailRequestSchema = z.object({ token: z.string().min(1) });
+export const loginRequestSchema = z.object({
+    email: emailSchema,
+    password: z.string().min(1),
+});
+export const forgotPasswordRequestSchema = z.object({ email: emailSchema });
+export const resetPasswordRequestSchema = z.object({
+    token: z.string().min(1),
+    password: passwordSchema,
+});
+// --- Responses ---
+export const publicUserSchema = z.object({
+    id: z.string(),
+    email: emailSchema,
+    emailVerified: z.boolean(),
+});
+/** Access-token in de body; het roterende refresh-token gaat via httpOnly cookie (US-A0703). */
+export const sessionResponseSchema = z.object({
+    user: publicUserSchema,
+    accessToken: z.string(),
+    expiresIn: z.number().int().positive(),
+});
+export const meResponseSchema = z.object({
+    user: publicUserSchema,
+    roles: z.array(z.string()),
+    permissions: z.array(z.string()),
+});
+/** Generieke bevestiging voor register/forgot (no-enumeration): altijd hetzelfde. */
+export const acknowledgementSchema = z.object({ ok: z.literal(true) });
+//# sourceMappingURL=schemas.js.map

package/dist/contract/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../contract/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEzD,mBAAmB;AACnB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC;AAEH,oBAAoB;AACpB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,WAAW;IAClB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAC;AACH,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AACH,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}

package/dist/frontend/src/client.d.ts

@@ -0,0 +1,38 @@
+import type { HttpClient } from '@seifer-webapp-factory/kits/frontend/http-client';
+import type { AuthErrorCode, Acknowledgement, ForgotPasswordRequest, LoginRequest, MeResponse, RegisterRequest, ResetPasswordRequest, SessionResponse, VerifyEmailRequest } from '../../contract/index.js';
+/**
+ * Getypte fout die de client bij een niet-2xx-respons gooit. Draagt de contract-`code` + de
+ * bijbehorende `i18nKey` (uit de taxonomie) zodat de UI een sleutel toont, nooit rauwe details.
+ * Bevat nooit credential-/token-materiaal.
+ */
+export declare class AuthClientError extends Error {
+    readonly code: AuthErrorCode;
+    readonly i18nKey: string;
+    readonly httpStatus: number;
+    /** Optionele veld-gebonden validatiefouten (paden), zonder ingevoerde waarden. */
+    readonly fields?: Readonly<Record<string, string[]>>;
+    constructor(code: AuthErrorCode, i18nKey: string, httpStatus: number, fields?: Readonly<Record<string, string[]>>);
+}
+/** De publieke, getypte client-API. Elke methode neemt het contract-request en levert de -respons. */
+export interface AuthClient {
+    register(input: RegisterRequest): Promise<Acknowledgement>;
+    verifyEmail(input: VerifyEmailRequest): Promise<Acknowledgement>;
+    login(input: LoginRequest): Promise<SessionResponse>;
+    refresh(): Promise<SessionResponse>;
+    logout(): Promise<Acknowledgement>;
+    forgotPassword(input: ForgotPasswordRequest): Promise<Acknowledgement>;
+    resetPassword(input: ResetPasswordRequest): Promise<Acknowledgement>;
+    me(): Promise<MeResponse>;
+}
+export interface CreateAuthClientOptions {
+    /** De geïnjecteerde kit-`HttpClient` (met base-URL + cookie-transport). */
+    readonly http: HttpClient;
+}
+/**
+ * Maakt een getypte auth-client rond de geïnjecteerde kit-`HttpClient`. Elke methode is een dunne
+ * wrapper om `call`, die het endpoint-descriptor uit het contract gebruikt voor methode + pad, de
+ * kit-`HttpError` naar een getypte `AuthClientError` mapt (via de response-body), en de happy-respons
+ * tegen het contract-schema valideert.
+ */
+export declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/frontend/src/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../frontend/src/client.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAMnF,OAAO,KAAK,EAEV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAGnD,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAS9C;AAED,sGAAsG;AACtG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE,KAAK,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACpC,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACnC,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACvE,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrE,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AA0BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,UAAU,CA+C7E"}

package/dist/frontend/src/client.js

@@ -0,0 +1,88 @@
+/**
+ * De getypte auth-client (het mechanisme). Leidt zijn methoden, paden en foutcodes af uit het
+ * contract (`AUTH_ENDPOINTS` + `AUTH_ERROR_TAXONOMY`) — één bron, geen drift. De client kent geen
+ * netwerk: hij krijgt de kit-`HttpClient` (`@seifer-webapp-factory/kits/frontend/http-client`) geïnjecteerd,
+ * geconfigureerd met base-URL + een transport dat cookies (roterend refresh-token + CSRF) meestuurt.
+ * Bij een niet-2xx-respons gooit de kit-client een `HttpError` mét de geparste response-body, zodat
+ * we de contract-`code` kunnen lezen en naar een getypte `AuthClientError` mappen. Geen module-globale
+ * mutable state — elke `createAuthClient` is een verse closure over de geïnjecteerde client.
+ */
+import { HttpError } from '@seifer-webapp-factory/kits/frontend/http-client';
+import { AUTH_ENDPOINTS, AUTH_ERROR_CODES, AUTH_ERROR_TAXONOMY, } from '../../contract/index.js';
+/**
+ * Getypte fout die de client bij een niet-2xx-respons gooit. Draagt de contract-`code` + de
+ * bijbehorende `i18nKey` (uit de taxonomie) zodat de UI een sleutel toont, nooit rauwe details.
+ * Bevat nooit credential-/token-materiaal.
+ */
+export class AuthClientError extends Error {
+    code;
+    i18nKey;
+    httpStatus;
+    /** Optionele veld-gebonden validatiefouten (paden), zonder ingevoerde waarden. */
+    fields;
+    constructor(code, i18nKey, httpStatus, fields) {
+        super(`[auth] ${code} (HTTP ${httpStatus})`);
+        this.name = 'AuthClientError';
+        this.code = code;
+        this.i18nKey = i18nKey;
+        this.httpStatus = httpStatus;
+        this.fields = fields;
+    }
+}
+const ERROR_CODES = AUTH_ERROR_CODES;
+/**
+ * Leidt de foutcode af uit de respons: bij voorkeur uit de body (`code`), anders een reverse-lookup
+ * op de HTTP-status (no-enumeration: bewust generiek), met een veilige validation-fallback.
+ */
+function resolveErrorCode(status, body) {
+    const bodyCode = body?.code;
+    if (typeof bodyCode === 'string' && ERROR_CODES.includes(bodyCode)) {
+        return bodyCode;
+    }
+    const byStatus = AUTH_ERROR_CODES.find((code) => AUTH_ERROR_TAXONOMY[code].httpStatus === status);
+    return byStatus ?? 'validation_failed';
+}
+/**
+ * Maakt een getypte auth-client rond de geïnjecteerde kit-`HttpClient`. Elke methode is een dunne
+ * wrapper om `call`, die het endpoint-descriptor uit het contract gebruikt voor methode + pad, de
+ * kit-`HttpError` naar een getypte `AuthClientError` mapt (via de response-body), en de happy-respons
+ * tegen het contract-schema valideert.
+ */
+export function createAuthClient(options) {
+    const { http } = options;
+    async function call(endpoint, body) {
+        let data;
+        let status;
+        try {
+            const res = await http.request({ method: endpoint.method, path: endpoint.path, body });
+            data = res.data;
+            status = res.status;
+        }
+        catch (err) {
+            if (err instanceof HttpError && err.status !== undefined) {
+                const code = resolveErrorCode(err.status, err.body);
+                const errorBody = err.body;
+                throw new AuthClientError(code, AUTH_ERROR_TAXONOMY[code].i18nKey, err.status, errorBody?.fields);
+            }
+            // Netwerk/timeout/abort: laat de getypte kit-fout ongewijzigd door.
+            throw err;
+        }
+        // Valideer de happy-respons tegen het contract-schema: gegarandeerde vorm, of een getypte fout.
+        const parsed = endpoint.response.safeParse(data);
+        if (!parsed.success) {
+            throw new AuthClientError('validation_failed', AUTH_ERROR_TAXONOMY.validation_failed.i18nKey, status);
+        }
+        return parsed.data;
+    }
+    return {
+        register: (input) => call(AUTH_ENDPOINTS.register, input),
+        verifyEmail: (input) => call(AUTH_ENDPOINTS.verifyEmail, input),
+        login: (input) => call(AUTH_ENDPOINTS.login, input),
+        refresh: () => call(AUTH_ENDPOINTS.refresh),
+        logout: () => call(AUTH_ENDPOINTS.logout),
+        forgotPassword: (input) => call(AUTH_ENDPOINTS.forgotPassword, input),
+        resetPassword: (input) => call(AUTH_ENDPOINTS.resetPassword, input),
+        me: () => call(AUTH_ENDPOINTS.me),
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/frontend/src/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../frontend/src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,kDAAkD,CAAC;AAE7E,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAcjC;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAgB;IACpB,OAAO,CAAS;IAChB,UAAU,CAAS;IAC5B,kFAAkF;IACzE,MAAM,CAAsC;IAErD,YACE,IAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,MAA2C;QAE3C,KAAK,CAAC,UAAU,IAAI,UAAU,UAAU,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAmBD,MAAM,WAAW,GAAsB,gBAAgB,CAAC;AAExD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAa;IACrD,MAAM,QAAQ,GAAI,IAA8C,EAAE,IAAI,CAAC;IACvE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,QAAyB,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAC1D,CAAC;IACF,OAAO,QAAQ,IAAI,mBAAmB,CAAC;AACzC,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAEzB,KAAK,UAAU,IAAI,CAAM,QAA0B,EAAE,IAAc;QACjE,IAAI,IAAa,CAAC;QAClB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAiD,CAAC;gBACxE,MAAM,IAAI,eAAe,CACvB,IAAI,EACJ,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EACjC,GAAG,CAAC,MAAM,EACV,SAAS,EAAE,MAAM,CAClB,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,gGAAgG;QAChG,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAC7C,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAW,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC1E,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC;QAChF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAkB,cAAc,CAAC,OAAO,CAAC;QAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAkB,cAAc,CAAC,MAAM,CAAC;QAC1D,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC;QACtF,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC;QACpF,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAa,cAAc,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/frontend/src/composables.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Vue-composables (het mechanisme, provide/inject). Een dunne, reactieve laag bovenop de getypte
+ * auth-client en de frontend auth-kit sessie-store. De client wordt per app-instance geprovide
+ * (`provideAuthClient`), zodat SSR-render en client-hydratie per request geïsoleerd blijven — geen
+ * module-globale mutable state. Elke actie-composable stelt reactieve `pending`/`error`(i18nKey)/
+ * `result` bloot plus een `submit`-functie.
+ */
+import { type App, type InjectionKey, type Ref } from 'vue';
+import { type AuthClient } from './client.js';
+import type { Acknowledgement, ForgotPasswordRequest, LoginRequest, RegisterRequest, ResetPasswordRequest, SessionResponse, VerifyEmailRequest } from '../../contract/index.js';
+/** De per-request client die op de app wordt geprovide. Symbool = module-constante (geen state). */
+export declare const AUTH_CLIENT_KEY: InjectionKey<AuthClient>;
+/** Registreer de auth-client op een app-instance (bij bootstrap). */
+export declare function provideAuthClient(app: App, client: AuthClient): void;
+/** Haal de getypte auth-client op binnen setup(). Werpt als er niets geprovide is. */
+export declare function useAuthClient(): AuthClient;
+/** De reactieve vorm die elke actie-composable teruggeeft. `error` is een i18n-sleutel, geen detail. */
+export interface UseAuthAction<Input, Result> {
+    /** True tijdens de call. */
+    readonly pending: Ref<boolean>;
+    /** i18n-sleutel bij falen (uit de foutentaxonomie), anders `null`. */
+    readonly error: Ref<string | null>;
+    /** De laatste geslaagde respons, of `null`. */
+    readonly result: Ref<Result | null>;
+    /** Voer de actie uit; levert de respons bij succes, of `undefined` bij een gemapte fout. */
+    submit(input: Input): Promise<Result | undefined>;
+}
+/**
+ * Login-composable: roept `client.login` aan en hydrateert bij succes de auth-kit sessie-store
+ * (status → `authenticated`). Werpt als er geen auth-instantie geprovide is (via `provideAuth`).
+ */
+export declare function useLogin(): UseAuthAction<LoginRequest, SessionResponse>;
+/** Registratie-composable. */
+export declare function useRegister(): UseAuthAction<RegisterRequest, Acknowledgement>;
+/** E-mailverificatie-composable. */
+export declare function useVerifyEmail(): UseAuthAction<VerifyEmailRequest, Acknowledgement>;
+/** Wachtwoord-vergeten-composable (no-enumeration: altijd dezelfde bevestiging). */
+export declare function useForgotPassword(): UseAuthAction<ForgotPasswordRequest, Acknowledgement>;
+/** Wachtwoord-reset-composable. */
+export declare function useResetPassword(): UseAuthAction<ResetPasswordRequest, Acknowledgement>;
+/**
+ * Logout-composable: beëindigt de server-sessie en wist de lokale auth-kit-sessie. De lokale sessie
+ * wordt hoe dan ook gewist, ook als de server-call faalt (netwerk/afgemeld).
+ */
+export declare function useLogout(): UseAuthAction<void, Acknowledgement>;
+//# sourceMappingURL=composables.d.ts.map

package/dist/frontend/src/composables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composables.d.ts","sourceRoot":"","sources":["../../../frontend/src/composables.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAe,KAAK,GAAG,EAAE,KAAK,YAAY,EAAE,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAGzE,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAEjC,oGAAoG;AACpG,eAAO,MAAM,eAAe,EAAE,YAAY,CAAC,UAAU,CAAyB,CAAC;AAE/E,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAEpE;AAED,sFAAsF;AACtF,wBAAgB,aAAa,IAAI,UAAU,CAQ1C;AAED,wGAAwG;AACxG,MAAM,WAAW,aAAa,CAAC,KAAK,EAAE,MAAM;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpC,4FAA4F;IAC5F,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAiCD;;;GAGG;AACH,wBAAgB,QAAQ,IAAI,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAoBvE;AAED,8BAA8B;AAC9B,wBAAgB,WAAW,IAAI,aAAa,CAAC,eAAe,EAAE,eAAe,CAAC,CAG7E;AAED,oCAAoC;AACpC,wBAAgB,cAAc,IAAI,aAAa,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAGnF;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,IAAI,aAAa,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAKzF;AAED,mCAAmC;AACnC,wBAAgB,gBAAgB,IAAI,aAAa,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAGvF;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,CAUhE"}

package/dist/frontend/src/composables.js

@@ -0,0 +1,111 @@
+/**
+ * Vue-composables (het mechanisme, provide/inject). Een dunne, reactieve laag bovenop de getypte
+ * auth-client en de frontend auth-kit sessie-store. De client wordt per app-instance geprovide
+ * (`provideAuthClient`), zodat SSR-render en client-hydratie per request geïsoleerd blijven — geen
+ * module-globale mutable state. Elke actie-composable stelt reactieve `pending`/`error`(i18nKey)/
+ * `result` bloot plus een `submit`-functie.
+ */
+import { inject, ref } from 'vue';
+import { AUTH_KEY } from '@seifer-webapp-factory/kits/frontend/auth/vue';
+import { AuthClientError } from './client.js';
+/** De per-request client die op de app wordt geprovide. Symbool = module-constante (geen state). */
+export const AUTH_CLIENT_KEY = Symbol('auth.client');
+/** Registreer de auth-client op een app-instance (bij bootstrap). */
+export function provideAuthClient(app, client) {
+    app.provide(AUTH_CLIENT_KEY, client);
+}
+/** Haal de getypte auth-client op binnen setup(). Werpt als er niets geprovide is. */
+export function useAuthClient() {
+    const client = inject(AUTH_CLIENT_KEY);
+    if (client === undefined) {
+        throw new Error('[auth] useAuthClient(): geen auth-client geprovide. Roep provideAuthClient(app, client) aan bij bootstrap.');
+    }
+    return client;
+}
+/** Vertaalt een gevangen fout naar een i18n-sleutel zonder details te lekken. */
+function toI18nKey(cause) {
+    return cause instanceof AuthClientError ? cause.i18nKey : 'auth.error.unknown';
+}
+/** Interne fabriek: bouwt een reactieve actie rond een async runner met uniforme foutafhandeling. */
+function useAuthAction(run) {
+    const pending = ref(false);
+    const error = ref(null);
+    const result = ref(null);
+    async function submit(input) {
+        pending.value = true;
+        error.value = null;
+        try {
+            const value = await run(input);
+            result.value = value;
+            return value;
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+            return undefined;
+        }
+        finally {
+            pending.value = false;
+        }
+    }
+    return { pending, error, result, submit };
+}
+/**
+ * Login-composable: roept `client.login` aan en hydrateert bij succes de auth-kit sessie-store
+ * (status → `authenticated`). Werpt als er geen auth-instantie geprovide is (via `provideAuth`).
+ */
+export function useLogin() {
+    const client = useAuthClient();
+    const auth = inject(AUTH_KEY);
+    if (auth === undefined) {
+        throw new Error('[auth] useLogin(): geen auth-instantie geprovide. Roep provideAuth(app, instance) aan bij bootstrap.');
+    }
+    return useAuthAction(async (input) => {
+        const session = await client.login(input);
+        auth.store.establish({
+            tokens: {
+                accessToken: session.accessToken,
+                expiresAt: Date.now() + session.expiresIn * 1000,
+            },
+            subject: session.user.id,
+            claims: session.user,
+        });
+        return session;
+    });
+}
+/** Registratie-composable. */
+export function useRegister() {
+    const client = useAuthClient();
+    return useAuthAction((input) => client.register(input));
+}
+/** E-mailverificatie-composable. */
+export function useVerifyEmail() {
+    const client = useAuthClient();
+    return useAuthAction((input) => client.verifyEmail(input));
+}
+/** Wachtwoord-vergeten-composable (no-enumeration: altijd dezelfde bevestiging). */
+export function useForgotPassword() {
+    const client = useAuthClient();
+    return useAuthAction((input) => client.forgotPassword(input));
+}
+/** Wachtwoord-reset-composable. */
+export function useResetPassword() {
+    const client = useAuthClient();
+    return useAuthAction((input) => client.resetPassword(input));
+}
+/**
+ * Logout-composable: beëindigt de server-sessie en wist de lokale auth-kit-sessie. De lokale sessie
+ * wordt hoe dan ook gewist, ook als de server-call faalt (netwerk/afgemeld).
+ */
+export function useLogout() {
+    const client = useAuthClient();
+    const auth = inject(AUTH_KEY);
+    return useAuthAction(async () => {
+        try {
+            return await client.logout();
+        }
+        finally {
+            auth?.store.clear();
+        }
+    });
+}
+//# sourceMappingURL=composables.js.map

package/dist/frontend/src/composables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composables.js","sourceRoot":"","sources":["../../../frontend/src/composables.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAyC,MAAM,KAAK,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,+CAA+C,CAAC;AAEzE,OAAO,EAAE,eAAe,EAAmB,MAAM,aAAa,CAAC;AAW/D,oGAAoG;AACpG,MAAM,CAAC,MAAM,eAAe,GAA6B,MAAM,CAAC,aAAa,CAAC,CAAC;AAE/E,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,GAAQ,EAAE,MAAkB;IAC5D,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACjF,CAAC;AAED,qGAAqG;AACrG,SAAS,aAAa,CACpB,GAAsC;IAEtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAgB,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAgB,IAAI,CAAuB,CAAC;IAE9D,KAAK,UAAU,MAAM,CAAC,KAAY;QAChC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAe,QAAQ,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAgC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE;gBACN,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI;aACjD;YACD,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACxB,MAAM,EAAE,OAAO,CAAC,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,aAAa,CAAmC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,aAAa,CAAsC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,aAAa,CAAyC,CAAC,KAAK,EAAE,EAAE,CACrE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,aAAa,CAAwC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAe,QAAQ,CAAC,CAAC;IAC5C,OAAO,aAAa,CAAwB,KAAK,IAAI,EAAE;QACrD,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}