@seifer-webapp-factory/kits 0.1.0

package/dist/backend/rate-limit/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../../backend/src/rate-limit/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;AAEjC,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjF,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACtF;AAED,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/D"}

package/dist/backend/rate-limit/core/ports.js

@@ -0,0 +1,6 @@
+/**
+ * Poorten & types voor de rate-limit-kit. Limieten per route, de store-adapter en de sleutel-afleiding
+ * worden geïnjecteerd; de kit bevat geen domeinkennis.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/backend/rate-limit/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../../backend/src/rate-limit/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/backend/rate-limit/core/sliding-window.d.ts

@@ -0,0 +1,9 @@
+import type { Clock, RateLimitStore, RateLimiter } from './ports.js';
+export interface SlidingWindowConfig {
+    /** Maximaal aantal requests binnen het venster. */
+    limit: number;
+    /** Venstergrootte in seconden. */
+    windowSeconds: number;
+}
+export declare function slidingWindowLimiter(config: SlidingWindowConfig, store: RateLimitStore, clock?: Clock): RateLimiter;
+//# sourceMappingURL=sliding-window.d.ts.map

package/dist/backend/rate-limit/core/sliding-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sliding-window.d.ts","sourceRoot":"","sources":["../../../../backend/src/rate-limit/core/sliding-window.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,cAAc,EACrB,KAAK,GAAE,KAAgB,GACtB,WAAW,CAiBb"}

package/dist/backend/rate-limit/core/sliding-window.js

@@ -0,0 +1,24 @@
+/**
+ * US-0602 — Sliding-window-limiter (voortschrijdend venster via gewogen teller). Vermijdt de
+ * grens-burst van een vast venster. Config-validatie fail-fast; atomaire telling via de
+ * {@link RateLimitStore}-poort — dezelfde store-abstractie als token-bucket.
+ */
+import { assertPositive } from './errors.js';
+export function slidingWindowLimiter(config, store, clock = Date.now) {
+    assertPositive('limit', config.limit);
+    assertPositive('windowSeconds', config.windowSeconds);
+    const windowMs = config.windowSeconds * 1000;
+    return {
+        limit: config.limit,
+        async consume(key, cost = 1) {
+            const result = await store.consumeSlidingWindow(key, {
+                limit: config.limit,
+                windowMs,
+                cost,
+                nowMs: clock(),
+            });
+            return { ...result, limit: config.limit };
+        },
+    };
+}
+//# sourceMappingURL=sliding-window.js.map

package/dist/backend/rate-limit/core/sliding-window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sliding-window.js","sourceRoot":"","sources":["../../../../backend/src/rate-limit/core/sliding-window.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAU7C,MAAM,UAAU,oBAAoB,CAClC,MAA2B,EAC3B,KAAqB,EACrB,QAAe,IAAI,CAAC,GAAG;IAEvB,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE;gBACnD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/rate-limit/core/token-bucket.d.ts

@@ -0,0 +1,9 @@
+import type { Clock, RateLimitStore, RateLimiter } from './ports.js';
+export interface TokenBucketConfig {
+    /** Maximale burst-capaciteit (tokens). */
+    capacity: number;
+    /** Bijvul-rate in tokens per seconde. */
+    refillPerSecond: number;
+}
+export declare function tokenBucketLimiter(config: TokenBucketConfig, store: RateLimitStore, clock?: Clock): RateLimiter;
+//# sourceMappingURL=token-bucket.d.ts.map

package/dist/backend/rate-limit/core/token-bucket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-bucket.d.ts","sourceRoot":"","sources":["../../../../backend/src/rate-limit/core/token-bucket.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,cAAc,EACrB,KAAK,GAAE,KAAgB,GACtB,WAAW,CAiBb"}

package/dist/backend/rate-limit/core/token-bucket.js

@@ -0,0 +1,24 @@
+/**
+ * US-0601 — Token-bucket-limiter. Per sleutel een bucket met burst-capaciteit die met een
+ * configureerbare rate wordt bijgevuld. Config-validatie fail-fast (nooit stil terugvallen op
+ * "onbeperkt toestaan"); de atomaire state loopt via de {@link RateLimitStore}-poort.
+ */
+import { assertPositive } from './errors.js';
+export function tokenBucketLimiter(config, store, clock = Date.now) {
+    assertPositive('capacity', config.capacity);
+    assertPositive('refillPerSecond', config.refillPerSecond);
+    const refillPerMs = config.refillPerSecond / 1000;
+    return {
+        limit: config.capacity,
+        async consume(key, cost = 1) {
+            const result = await store.consumeTokenBucket(key, {
+                capacity: config.capacity,
+                refillPerMs,
+                cost,
+                nowMs: clock(),
+            });
+            return { ...result, limit: config.capacity };
+        },
+    };
+}
+//# sourceMappingURL=token-bucket.js.map

package/dist/backend/rate-limit/core/token-bucket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-bucket.js","sourceRoot":"","sources":["../../../../backend/src/rate-limit/core/token-bucket.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAU7C,MAAM,UAAU,kBAAkB,CAChC,MAAyB,EACzB,KAAqB,EACrB,QAAe,IAAI,CAAC,GAAG;IAEvB,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,cAAc,CAAC,iBAAiB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;IAElD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,QAAQ;QACtB,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE;gBACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW;gBACX,IAAI;gBACJ,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/rate-limit/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `rate-limit` kit — domein-loze throttling: token-bucket + sliding-window over een pluggable atomaire
+ * store (in-memory + Redis), met enforcement-middleware en standaard-headers. Pure core + adapters.
+ *
+ * De NestJS-guard zit onder `@seifer-webapp-factory/kits/backend/rate-limit/nestjs`.
+ */
+export { tokenBucketLimiter, type TokenBucketConfig } from './core/token-bucket.js';
+export { slidingWindowLimiter, type SlidingWindowConfig } from './core/sliding-window.js';
+export { enforceRateLimit, rateLimitHeaders, type RateLimitDecision, type EnforceOptions, } from './core/enforcer.js';
+export type { Clock, RateLimiter, RateLimitResult, RateLimitStore, StoreResult, TokenBucketParams, SlidingWindowParams, } from './core/ports.js';
+export { RateLimitError, RateLimitConfigError, StoreUnavailableError, } from './core/errors.js';
+export { inMemoryRateLimitStore } from './adapters/in-memory-store.js';
+export { redisRateLimitStore, type RedisLike, type RedisRateLimitStoreOptions, } from './adapters/redis-store.js';
+export { rateLimitMiddleware, type RateLimitMiddlewareOptions } from './nodejs/middleware.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/rate-limit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../backend/src/rate-limit/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG1F,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EACV,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/backend/rate-limit/index.js

@@ -0,0 +1,19 @@
+/**
+ * `rate-limit` kit — domein-loze throttling: token-bucket + sliding-window over een pluggable atomaire
+ * store (in-memory + Redis), met enforcement-middleware en standaard-headers. Pure core + adapters.
+ *
+ * De NestJS-guard zit onder `@seifer-webapp-factory/kits/backend/rate-limit/nestjs`.
+ */
+// Algoritmen (US-0601/US-0602)
+export { tokenBucketLimiter } from './core/token-bucket.js';
+export { slidingWindowLimiter } from './core/sliding-window.js';
+// Enforcement + headers (US-0604)
+export { enforceRateLimit, rateLimitHeaders, } from './core/enforcer.js';
+// Fouten
+export { RateLimitError, RateLimitConfigError, StoreUnavailableError, } from './core/errors.js';
+// Adapters (dep-vrij; de Redis-store gebruikt een structurele `RedisLike`-client)
+export { inMemoryRateLimitStore } from './adapters/in-memory-store.js';
+export { redisRateLimitStore, } from './adapters/redis-store.js';
+// Node/express-middleware (US-0604)
+export { rateLimitMiddleware } from './nodejs/middleware.js';
+//# sourceMappingURL=index.js.map

package/dist/backend/rate-limit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../backend/src/rate-limit/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+BAA+B;AAC/B,OAAO,EAAE,kBAAkB,EAA0B,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE1F,kCAAkC;AAClC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAa5B,SAAS;AACT,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,kFAAkF;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,mBAAmB,GAGpB,MAAM,2BAA2B,CAAC;AAEnC,oCAAoC;AACpC,OAAO,EAAE,mBAAmB,EAAmC,MAAM,wBAAwB,CAAC"}

package/dist/backend/rate-limit/nestjs/rate-limit.module.d.ts

@@ -0,0 +1,25 @@
+/**
+ * NestJS-adapter voor US-0604: een `RateLimitGuard` die per request de limiter evalueert, de
+ * `X-RateLimit-*`-headers zet en bij weigering een `429` (met `Retry-After`) gooit. De pure
+ * enforcement-logica zit in de core. `@nestjs/common` is een optionele peer-dependency.
+ */
+import { type CanActivate, type DynamicModule, type ExecutionContext } from '@nestjs/common';
+import type { RateLimiter } from '../core/ports.js';
+export declare const RATE_LIMIT_OPTIONS: unique symbol;
+export interface RateLimitGuardOptions {
+    limiter: RateLimiter;
+    /** Leidt de sleutel af uit het request (bv. IP of user-id). */
+    getKey: (request: unknown) => string;
+    failPolicy?: 'open' | 'closed';
+    cost?: number;
+    global?: boolean;
+}
+export declare class RateLimitGuard implements CanActivate {
+    private readonly options;
+    constructor(options: RateLimitGuardOptions);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+export declare class RateLimitModule {
+    static forRoot(options: RateLimitGuardOptions): DynamicModule;
+}
+//# sourceMappingURL=rate-limit.module.d.ts.map

package/dist/backend/rate-limit/nestjs/rate-limit.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.module.d.ts","sourceRoot":"","sources":["../../../../backend/src/rate-limit/nestjs/rate-limit.module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAEtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,eAAO,MAAM,kBAAkB,eAAmC,CAAC;AAMnE,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,WAAW,CAAC;IACrB,+DAA+D;IAC/D,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBACa,cAAe,YAAW,WAAW;IACR,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,qBAAqB;IAEjF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAsB/D;AAED,qBAAa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa;CAY9D"}

package/dist/backend/rate-limit/nestjs/rate-limit.module.js

@@ -0,0 +1,63 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+/**
+ * NestJS-adapter voor US-0604: een `RateLimitGuard` die per request de limiter evalueert, de
+ * `X-RateLimit-*`-headers zet en bij weigering een `429` (met `Retry-After`) gooit. De pure
+ * enforcement-logica zit in de core. `@nestjs/common` is een optionele peer-dependency.
+ */
+import { HttpException, Inject, Injectable, } from '@nestjs/common';
+import { enforceRateLimit } from '../core/enforcer.js';
+export const RATE_LIMIT_OPTIONS = Symbol.for('rate-limit.options');
+let RateLimitGuard = class RateLimitGuard {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const response = context.switchToHttp().getResponse();
+        const decision = await enforceRateLimit(this.options.getKey(request), {
+            limiter: this.options.limiter,
+            ...(this.options.failPolicy ? { failPolicy: this.options.failPolicy } : {}),
+            ...(this.options.cost !== undefined ? { cost: this.options.cost } : {}),
+        });
+        for (const [header, value] of Object.entries(decision.headers)) {
+            response.header(header, value);
+        }
+        if (!decision.allowed) {
+            throw new HttpException({ error: { code: 'RATE_LIMITED', message: 'Too Many Requests' } }, decision.status);
+        }
+        return true;
+    }
+};
+RateLimitGuard = __decorate([
+    Injectable(),
+    __param(0, Inject(RATE_LIMIT_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], RateLimitGuard);
+export { RateLimitGuard };
+export class RateLimitModule {
+    static forRoot(options) {
+        const providers = [
+            { provide: RATE_LIMIT_OPTIONS, useValue: options },
+            RateLimitGuard,
+        ];
+        return {
+            module: RateLimitModule,
+            global: options.global ?? true,
+            providers,
+            exports: [RateLimitGuard, RATE_LIMIT_OPTIONS],
+        };
+    }
+}
+//# sourceMappingURL=rate-limit.module.js.map

package/dist/backend/rate-limit/nestjs/rate-limit.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.module.js","sourceRoot":"","sources":["../../../../backend/src/rate-limit/nestjs/rate-limit.module.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;GAIG;AACH,OAAO,EACL,aAAa,EACb,MAAM,EACN,UAAU,GAKX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAgB5D,IAAM,cAAc,GAApB,MAAM,cAAc;IACgC;IAAzD,YAAyD,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAE3F,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAgB,CAAC;QAEpE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YACpE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CACrB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EACjE,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAzBY,cAAc;IAD1B,UAAU,EAAE;IAEE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAD5B,cAAc,CAyB1B;;AAED,MAAM,OAAO,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA8B;QAC3C,MAAM,SAAS,GAAe;YAC5B,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;YAClD,cAAc;SACf,CAAC;QACF,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,SAAS;YACT,OAAO,EAAE,CAAC,cAAc,EAAE,kBAAkB,CAAC;SAC9C,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/rate-limit/nodejs/middleware.d.ts

@@ -0,0 +1,16 @@
+/**
+ * US-0604 — Node/connect/express-compatibele rate-limit-middleware. Bepaalt de sleutel via een
+ * callback, evalueert de limiter en zet de standaard-headers; bij weigering `429` + `Retry-After`.
+ * Werkt ook in een Nest-express-app via `app.use(...)`.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RateLimiter } from '../core/ports.js';
+export interface RateLimitMiddlewareOptions {
+    limiter: RateLimiter;
+    /** Leidt de rate-limit-sleutel af uit het request (bv. IP of user-id). */
+    keyOf: (req: IncomingMessage) => string;
+    failPolicy?: 'open' | 'closed';
+    cost?: number;
+}
+export declare function rateLimitMiddleware(options: RateLimitMiddlewareOptions): (req: IncomingMessage, res: ServerResponse, next: () => void) => Promise<void>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/backend/rate-limit/nodejs/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../backend/src/rate-limit/nodejs/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,WAAW,CAAC;IACrB,0EAA0E;IAC1E,KAAK,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,IACvD,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,MAAM,IAAI,KAAG,OAAO,CAAC,IAAI,CAAC,CA2B1F"}

package/dist/backend/rate-limit/nodejs/middleware.js

@@ -0,0 +1,26 @@
+import { enforceRateLimit } from '../core/enforcer.js';
+export function rateLimitMiddleware(options) {
+    return async (req, res, next) => {
+        const decision = await enforceRateLimit(options.keyOf(req), {
+            limiter: options.limiter,
+            ...(options.failPolicy ? { failPolicy: options.failPolicy } : {}),
+            ...(options.cost !== undefined ? { cost: options.cost } : {}),
+        });
+        for (const [header, value] of Object.entries(decision.headers)) {
+            res.setHeader(header, value);
+        }
+        if (decision.allowed) {
+            next();
+            return;
+        }
+        res.statusCode = decision.status;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({
+            error: {
+                code: decision.status === 429 ? 'RATE_LIMITED' : 'STORE_UNAVAILABLE',
+                message: decision.status === 429 ? 'Too Many Requests' : 'Service Unavailable',
+            },
+        }));
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/backend/rate-limit/nodejs/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../../backend/src/rate-limit/nodejs/middleware.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAWvD,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,IAAgB,EAAiB,EAAE;QAC1F,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB;gBACpE,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB;aAC/E;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/test-kit/adapters/infra-bootstrap.d.ts

@@ -0,0 +1,40 @@
+/**
+ * US-1401 — Testcontainers-bootstrap (Postgres/Redis). Bouwt voort op de persistence-kit-harness voor
+ * Postgres en start een wegwerp-Redis via testcontainers. Levert connectie-handles + `reset()` (schone
+ * staat tussen tests, zonder herstart) en `stop()` (gegarandeerde opruiming, ook bij een fout tijdens de
+ * bootstrap). Container-selectie/images komen uit geïnjecteerde config; geen domeinaannames.
+ *
+ * `testcontainers` wordt lui geladen; import van deze module vereist Docker pas bij `bootstrapTestInfra`.
+ */
+import { type TestDatabase } from '../../persistence/pg.js';
+import type { Migration } from '../../persistence/index.js';
+export interface PostgresInfraOptions {
+    migrations?: Migration[];
+    /** Tabellen die `reset()` leegmaakt tussen tests. */
+    managedTables?: string[];
+    image?: string;
+}
+export interface RedisInfraOptions {
+    image?: string;
+}
+export interface TestInfraOptions {
+    postgres?: PostgresInfraOptions;
+    redis?: RedisInfraOptions;
+}
+export interface RedisHandle {
+    uri: string;
+    host: string;
+    port: number;
+    /** FLUSHALL — schone staat tussen tests. */
+    reset(): Promise<void>;
+}
+export interface TestInfra {
+    postgres?: TestDatabase;
+    redis?: RedisHandle;
+    /** Zet alle ingeschakelde stores terug naar de basisstaat (US-1401 AC2). */
+    reset(): Promise<void>;
+    /** Stopt en ruimt alle containers op (US-1401 AC3). */
+    stop(): Promise<void>;
+}
+export declare function bootstrapTestInfra(options?: TestInfraOptions): Promise<TestInfra>;
+//# sourceMappingURL=infra-bootstrap.d.ts.map

package/dist/backend/test-kit/adapters/infra-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-bootstrap.d.ts","sourceRoot":"","sources":["../../../../backend/src/test-kit/adapters/infra-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,4EAA4E;IAC5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,uDAAuD;IACvD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CAuD3F"}

package/dist/backend/test-kit/adapters/infra-bootstrap.js

@@ -0,0 +1,64 @@
+/**
+ * US-1401 — Testcontainers-bootstrap (Postgres/Redis). Bouwt voort op de persistence-kit-harness voor
+ * Postgres en start een wegwerp-Redis via testcontainers. Levert connectie-handles + `reset()` (schone
+ * staat tussen tests, zonder herstart) en `stop()` (gegarandeerde opruiming, ook bij een fout tijdens de
+ * bootstrap). Container-selectie/images komen uit geïnjecteerde config; geen domeinaannames.
+ *
+ * `testcontainers` wordt lui geladen; import van deze module vereist Docker pas bij `bootstrapTestInfra`.
+ */
+import { startTestDatabase, postgresContainerFactory } from '../../persistence/pg.js';
+export async function bootstrapTestInfra(options = {}) {
+    const stops = [];
+    let postgres;
+    let redis;
+    try {
+        if (options.postgres) {
+            postgres = await startTestDatabase({
+                migrations: options.postgres.migrations ?? [],
+                ...(options.postgres.managedTables ? { managedTables: options.postgres.managedTables } : {}),
+                ...(options.postgres.image ? { containerFactory: postgresContainerFactory({ image: options.postgres.image }) } : {}),
+            });
+            const db = postgres;
+            stops.push(() => db.stop());
+        }
+        if (options.redis) {
+            const { GenericContainer, Wait } = await import('testcontainers');
+            const container = await new GenericContainer(options.redis.image ?? 'redis:7-alpine')
+                .withExposedPorts(6379)
+                .withWaitStrategy(Wait.forLogMessage(/Ready to accept connections/))
+                .start();
+            stops.push(async () => {
+                await container.stop();
+            });
+            const host = container.getHost();
+            const port = container.getMappedPort(6379);
+            redis = {
+                uri: `redis://${host}:${port}`,
+                host,
+                port,
+                reset: async () => {
+                    await container.exec(['redis-cli', 'FLUSHALL']);
+                },
+            };
+        }
+    }
+    catch (error) {
+        // Geen halve/lekkende containers achterlaten (AC3).
+        for (const stop of stops.reverse())
+            await stop().catch(() => undefined);
+        throw new Error(`test-kit infra-bootstrap mislukt (is de Docker-daemon bereikbaar?): ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        ...(postgres ? { postgres } : {}),
+        ...(redis ? { redis } : {}),
+        reset: async () => {
+            await postgres?.reset();
+            await redis?.reset();
+        },
+        stop: async () => {
+            for (const stop of stops.reverse())
+                await stop().catch(() => undefined);
+        },
+    };
+}
+//# sourceMappingURL=infra-bootstrap.js.map

package/dist/backend/test-kit/adapters/infra-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-bootstrap.js","sourceRoot":"","sources":["../../../../backend/src/test-kit/adapters/infra-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAqB,MAAM,yBAAyB,CAAC;AAoCzG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAA4B,EAAE;IACrE,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,IAAI,QAAkC,CAAC;IACvC,IAAI,KAA8B,CAAC;IAEnC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACjC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE;gBAC7C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrH,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC;iBAClF,gBAAgB,CAAC,IAAI,CAAC;iBACtB,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC;iBACnE,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACpB,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC3C,KAAK,GAAG;gBACN,GAAG,EAAE,WAAW,IAAI,IAAI,IAAI,EAAE;gBAC9B,IAAI;gBACJ,IAAI;gBACJ,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;gBAClD,CAAC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oDAAoD;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,uEAAuE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChI,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxB,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/test-kit/core/contract.d.ts

@@ -0,0 +1,49 @@
+/**
+ * US-1404 — Contract-test-harness. Verifieert dat een provider een geïnjecteerd contract nakomt: per
+ * interactie status + body (subset-match: extra velden toegestaan, ontbrekende/afwijkende velden falen).
+ * Afwijkingen worden precies gerapporteerd (pad + verwacht vs. werkelijk). Contracten zijn geïnjecteerde
+ * data; de provider-koppeling is een adapter (bv. de HTTP-test-client).
+ */
+export type ContractMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+export interface Contract {
+    name?: string;
+    request: {
+        method: ContractMethod;
+        path: string;
+        body?: unknown;
+        headers?: Record<string, string>;
+        token?: string;
+    };
+    expect: {
+        status: number;
+        /** Verwachte (deel)body; extra velden in de response zijn toegestaan. */
+        body?: unknown;
+    };
+}
+export interface Deviation {
+    path: string;
+    expected: unknown;
+    actual: unknown;
+}
+export interface ContractResult {
+    name: string;
+    verified: boolean;
+    deviations: Deviation[];
+}
+export interface ContractReport {
+    verified: boolean;
+    results: ContractResult[];
+}
+/** Structureel provider-contract (de HTTP-test-client voldoet hieraan via `request`). */
+export interface ContractProvider {
+    request(method: string, path: string, options?: {
+        body?: unknown;
+        headers?: Record<string, string>;
+        token?: string;
+    }): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+}
+export declare function verifyContracts(provider: ContractProvider, contracts: Contract[]): Promise<ContractReport>;
+//# sourceMappingURL=contract.d.ts.map

package/dist/backend/test-kit/core/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../../backend/src/test-kit/core/contract.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzE,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QACP,MAAM,EAAE,cAAc,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CACL,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7E,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/C;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,QAAQ,EAAE,GACpB,OAAO,CAAC,cAAc,CAAC,CAoBzB"}

package/dist/backend/test-kit/core/contract.js

@@ -0,0 +1,52 @@
+/**
+ * US-1404 — Contract-test-harness. Verifieert dat een provider een geïnjecteerd contract nakomt: per
+ * interactie status + body (subset-match: extra velden toegestaan, ontbrekende/afwijkende velden falen).
+ * Afwijkingen worden precies gerapporteerd (pad + verwacht vs. werkelijk). Contracten zijn geïnjecteerde
+ * data; de provider-koppeling is een adapter (bv. de HTTP-test-client).
+ */
+export async function verifyContracts(provider, contracts) {
+    const results = [];
+    for (const contract of contracts) {
+        const name = contract.name ?? `${contract.request.method} ${contract.request.path}`;
+        const response = await provider.request(contract.request.method, contract.request.path, {
+            ...(contract.request.body !== undefined ? { body: contract.request.body } : {}),
+            ...(contract.request.headers ? { headers: contract.request.headers } : {}),
+            ...(contract.request.token ? { token: contract.request.token } : {}),
+        });
+        const deviations = [];
+        if (response.status !== contract.expect.status) {
+            deviations.push({ path: 'status', expected: contract.expect.status, actual: response.status });
+        }
+        if (contract.expect.body !== undefined) {
+            deviations.push(...matchSubset(contract.expect.body, response.body, 'body'));
+        }
+        results.push({ name, verified: deviations.length === 0, deviations });
+    }
+    return { verified: results.every((r) => r.verified), results };
+}
+/** Subset-match: elke sleutel/waarde in `expected` moet in `actual` voorkomen; extra velden zijn oké. */
+function matchSubset(expected, actual, path) {
+    if (expected !== null && typeof expected === 'object' && !Array.isArray(expected)) {
+        if (actual === null || typeof actual !== 'object' || Array.isArray(actual)) {
+            return [{ path, expected, actual }];
+        }
+        const record = actual;
+        const deviations = [];
+        for (const key of Object.keys(expected)) {
+            deviations.push(...matchSubset(expected[key], record[key], `${path}.${key}`));
+        }
+        return deviations;
+    }
+    if (Array.isArray(expected)) {
+        if (!Array.isArray(actual))
+            return [{ path, expected, actual }];
+        const deviations = [];
+        if (actual.length < expected.length) {
+            deviations.push({ path: `${path}.length`, expected: expected.length, actual: actual.length });
+        }
+        expected.forEach((item, i) => deviations.push(...matchSubset(item, actual[i], `${path}[${i}]`)));
+        return deviations;
+    }
+    return expected === actual ? [] : [{ path, expected, actual }];
+}
+//# sourceMappingURL=contract.js.map

package/dist/backend/test-kit/core/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../../backend/src/test-kit/core/contract.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA8CH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA0B,EAC1B,SAAqB;IAErB,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;YACtF,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC;QAEH,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,yGAAyG;AACzG,SAAS,WAAW,CAAC,QAAiB,EAAE,MAAe,EAAE,IAAY;IACnE,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAE,QAAoC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/backend/test-kit/core/errors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Foutentaxonomie voor test-kit.
+ */
+export declare class TestKitError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** Opgevraagde factory bestaat niet in de registry (US-1402 AC3). */
+export declare class UnknownFactoryError extends TestKitError {
+    constructor(name: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/backend/test-kit/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../backend/src/test-kit/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM1C;AAED,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,YAAY;gBACvC,IAAI,EAAE,MAAM;CAGzB"}

package/dist/backend/test-kit/core/errors.js

@@ -0,0 +1,19 @@
+/**
+ * Foutentaxonomie voor test-kit.
+ */
+export class TestKitError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Opgevraagde factory bestaat niet in de registry (US-1402 AC3). */
+export class UnknownFactoryError extends TestKitError {
+    constructor(name) {
+        super(`Onbekende factory: "${name}"`, 'UNKNOWN_FACTORY');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/backend/test-kit/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../backend/src/test-kit/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD,YAAY,IAAY;QACtB,KAAK,CAAC,uBAAuB,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/backend/test-kit/core/factories.d.ts

@@ -0,0 +1,24 @@
+export interface FactoryContext {
+    /** 1-gebaseerde, per build oplopende sequence — handig voor unieke velden. */
+    seq: number;
+}
+export interface Factory<T> {
+    build(overrides?: Partial<T>): T;
+    buildList(n: number, overrides?: Partial<T>): T[];
+}
+export declare function defineFactory<T extends object>(builder: (ctx: FactoryContext) => T): Factory<T>;
+export interface FactoryRegistry {
+    register<T extends object>(name: string, factory: Factory<T>): void;
+    define<T extends object>(name: string, builder: (ctx: FactoryContext) => T): Factory<T>;
+    build<T = unknown>(name: string, overrides?: Partial<T>): T;
+    buildList<T = unknown>(name: string, n: number, overrides?: Partial<T>): T[];
+    has(name: string): boolean;
+}
+export declare function createFactoryRegistry(): FactoryRegistry;
+export interface PersistentFactory<T> {
+    create(overrides?: Partial<T>): Promise<T>;
+    createList(n: number, overrides?: Partial<T>): Promise<T[]>;
+}
+/** Wikkelt een factory zodat elk gebouwd object via de geïnjecteerde `persist`-functie wordt opgeslagen. */
+export declare function withPersistence<T extends object>(factory: Factory<T>, persist: (item: T) => Promise<T | void>): PersistentFactory<T>;
+//# sourceMappingURL=factories.d.ts.map

package/dist/backend/test-kit/core/factories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../../../../backend/src/test-kit/core/factories.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACnD;AAED,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAU/F;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACpE,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxF,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5D,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,wBAAgB,qBAAqB,IAAI,eAAe,CAoBvD;AAID,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3C,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7D;AAED,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAC9C,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GACtC,iBAAiB,CAAC,CAAC,CAAC,CActB"}