@seifer-webapp-factory/kits 0.1.0

package/dist/backend/http/core/ports.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Poorten & types voor de http-kernel. Het consumerende project injecteert route-modules, schema's
+ * en (optioneel) configuratie; de kernel bevat zelf geen route of domeinkennis.
+ */
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS' | 'HEAD';
+/** Framework-agnostisch request-object dat de kernel verwerkt. */
+export interface KernelRequest {
+    method: string;
+    /** Pad zonder query-string, bv. `/users/42`. */
+    path: string;
+    headers: Record<string, string | string[] | undefined>;
+    /** Reeds geparste query-parameters. */
+    query?: Record<string, unknown>;
+    body?: unknown;
+    /** Door de router ingevulde path-parameters. */
+    params?: Record<string, string>;
+}
+/** Framework-agnostisch response-object dat de kernel oplevert. */
+export interface KernelResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: unknown;
+}
+export interface ValidationIssue {
+    path: string;
+    message: string;
+}
+export type ValidationOutcome<T> = {
+    success: true;
+    value: T;
+} | {
+    success: false;
+    issues: ValidationIssue[];
+};
+/** Vervangbare validatie-engine. Zie de Zod-adapter voor een implementatie. */
+export interface Schema<T = unknown> {
+    validate(input: unknown): ValidationOutcome<T>;
+    /** Optioneel: JSON-schema voor OpenAPI-generatie (US-0206). */
+    jsonSchema?(): JsonSchema;
+}
+/** Minimale JSON-schema-vorm (OpenAPI 3.1 componenten). */
+export type JsonSchema = {
+    type?: string;
+    properties?: Record<string, JsonSchema>;
+    required?: string[];
+    items?: JsonSchema;
+    enum?: unknown[];
+    format?: string;
+    [key: string]: unknown;
+};
+export interface RequestContext {
+    requestId: string;
+    correlationId: string;
+}
+export interface RouteHandlerInput<B = unknown, Q = unknown, P = unknown> {
+    body: B;
+    query: Q;
+    params: P;
+    /** Genormaliseerde list-parameters, alleen voor list-routes (US-0205). */
+    list?: ListParams;
+    raw: KernelRequest;
+    context: RequestContext;
+}
+export type RouteHandler<B = unknown, Q = unknown, P = unknown> = (input: RouteHandlerInput<B, Q, P>) => unknown | Promise<unknown>;
+export interface RouteSchemas {
+    body?: Schema;
+    query?: Schema;
+    params?: Schema;
+    /** Response-schema voor OpenAPI (validatie van output is optioneel). */
+    response?: Schema;
+}
+export interface RouteDefinition {
+    method: HttpMethod;
+    /** Pad relatief aan de module-basePath; mag `:param`-segmenten bevatten. */
+    path: string;
+    handler: RouteHandler;
+    schemas?: RouteSchemas;
+    summary?: string;
+    /** Markeer als list-endpoint met paginatie/sortering/filtering (US-0205). */
+    list?: ListConfig | boolean;
+    /** Success-statuscode (default 200, of 204 bij lege body). */
+    status?: number;
+}
+export interface RouteModule {
+    basePath?: string;
+    routes: RouteDefinition[];
+}
+export interface ListConfig {
+    defaultPageSize?: number;
+    maxPageSize?: number;
+    allowedSortFields?: string[];
+    allowedFilterFields?: string[];
+    defaultSort?: SortField[];
+}
+export interface SortField {
+    field: string;
+    direction: 'asc' | 'desc';
+}
+export interface ListParams {
+    page: number;
+    pageSize: number;
+    offset: number;
+    sort: SortField[];
+    filters: Record<string, string>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/backend/http/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../../backend/src/http/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1F,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;CACf;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC3B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC;AAElD,+EAA+E;AAC/E,MAAM,WAAW,MAAM,CAAC,CAAC,GAAG,OAAO;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,UAAU,CAAC,IAAI,UAAU,CAAC;CAC3B;AAED,2DAA2D;AAC3D,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAIF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,CAAC,CAAC;IACV,0EAA0E;IAC1E,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI,CAChE,KAAK,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC9B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAID,MAAM,WAAW,UAAU;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC"}

package/dist/backend/http/core/ports.js

@@ -0,0 +1,6 @@
+/**
+ * Poorten & types voor de http-kernel. Het consumerende project injecteert route-modules, schema's
+ * en (optioneel) configuratie; de kernel bevat zelf geen route of domeinkennis.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/backend/http/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../../backend/src/http/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/backend/http/core/redaction.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Redactie van gevoelige velden in fout-payloads en logs (US-0204 AC3). Domein-loos: de set
+ * gevoelige key-namen is configureerbaar.
+ */
+export declare const DEFAULT_SENSITIVE_KEYS: string[];
+/** Diep redigeren: waarden van keys die (case-insensitief) matchen worden vervangen door `***`. */
+export declare function redactSensitive(value: unknown, sensitiveKeys?: string[]): unknown;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/backend/http/core/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../../backend/src/http/core/redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,sBAAsB,UAkBlC,CAAC;AAIF,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,GAAE,MAAM,EAA2B,GAAG,OAAO,CAGzG"}

package/dist/backend/http/core/redaction.js

@@ -0,0 +1,45 @@
+/**
+ * Redactie van gevoelige velden in fout-payloads en logs (US-0204 AC3). Domein-loos: de set
+ * gevoelige key-namen is configureerbaar.
+ */
+export const DEFAULT_SENSITIVE_KEYS = [
+    'password',
+    'pass',
+    'secret',
+    'token',
+    'authorization',
+    'apikey',
+    'api_key',
+    'accesstoken',
+    'access_token',
+    'refreshtoken',
+    'refresh_token',
+    'cookie',
+    'setcookie',
+    'ssn',
+    'creditcard',
+    'card',
+    'pin',
+];
+const REDACTED = '***';
+/** Diep redigeren: waarden van keys die (case-insensitief) matchen worden vervangen door `***`. */
+export function redactSensitive(value, sensitiveKeys = DEFAULT_SENSITIVE_KEYS) {
+    const set = new Set(sensitiveKeys.map((k) => k.toLowerCase()));
+    return redact(value, set, new WeakSet());
+}
+function redact(value, keys, seen) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value)) {
+        return value.map((item) => redact(item, keys, seen));
+    }
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+        out[key] = keys.has(key.toLowerCase()) ? REDACTED : redact(val, keys, seen);
+    }
+    return out;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/backend/http/core/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../../backend/src/http/core/redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,MAAM;IACN,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,SAAS;IACT,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,QAAQ;IACR,WAAW;IACX,KAAK;IACL,YAAY;IACZ,MAAM;IACN,KAAK;CACN,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,gBAA0B,sBAAsB;IAC9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAiB,EAAE,IAAqB;IACtE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/backend/http/core/router.d.ts

@@ -0,0 +1,37 @@
+/**
+ * US-0201 — Route-modules valideren, mounten en matchen.
+ *
+ * Valideert geïnjecteerde route-modules tegen het port-contract (fail-fast bij een ongeldige module),
+ * compileert ze tot een route-tabel onder het geconfigureerde base-path en detecteert conflicterende
+ * registraties (zelfde methode + pad). Bevat geen domeinkennis.
+ */
+import type { HttpMethod, RouteDefinition, RouteModule } from './ports.js';
+/** Fout bij het bootstrappen van de kernel (US-0201 AC3 / US-0206 AC3). Bevat geen interne payload. */
+export declare class KernelBootstrapError extends Error {
+    constructor(message: string);
+}
+interface Segment {
+    value: string;
+    param: boolean;
+}
+export interface CompiledRoute {
+    method: HttpMethod;
+    /** Volledig pad inclusief base-path, bv. `/api/users/:id`. */
+    fullPath: string;
+    segments: Segment[];
+    definition: RouteDefinition;
+}
+/** Valideert één route-module tegen het port-contract. Gooit {@link KernelBootstrapError}. */
+export declare function validateRouteModule(mod: unknown, index: number): asserts mod is RouteModule;
+/** Compileert alle route-modules tot één route-tabel; detecteert conflicten (fail-fast). */
+export declare function compileRoutes(modules: unknown[], basePath?: string): CompiledRoute[];
+export interface RouteMatch {
+    route: CompiledRoute;
+    params: Record<string, string>;
+}
+/** Zoekt de eerste route die matcht op methode + pad en extraheert path-params. */
+export declare function matchRoute(routes: CompiledRoute[], method: string, path: string): RouteMatch | null;
+/** True als er wel een pad matcht maar geen enkele methode (405-hint). */
+export declare function pathExistsWithOtherMethod(routes: CompiledRoute[], path: string): boolean;
+export {};
+//# sourceMappingURL=router.d.ts.map

package/dist/backend/http/core/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../../backend/src/http/core/router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3E,uGAAuG;AACvG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAK5B;AAYD,UAAU,OAAO;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAyB3F;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,SAAK,GAAG,aAAa,EAAE,CAuBhF;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CACxB,MAAM,EAAE,aAAa,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,IAAI,CASnB;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGxF"}

package/dist/backend/http/core/router.js

@@ -0,0 +1,120 @@
+/** Fout bij het bootstrappen van de kernel (US-0201 AC3 / US-0206 AC3). Bevat geen interne payload. */
+export class KernelBootstrapError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'KernelBootstrapError';
+        Object.setPrototypeOf(this, KernelBootstrapError.prototype);
+    }
+}
+const VALID_METHODS = new Set([
+    'GET',
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+    'OPTIONS',
+    'HEAD',
+]);
+/** Valideert één route-module tegen het port-contract. Gooit {@link KernelBootstrapError}. */
+export function validateRouteModule(mod, index) {
+    const label = `route-module[${index}]`;
+    if (typeof mod !== 'object' || mod === null || Array.isArray(mod)) {
+        throw new KernelBootstrapError(`${label} is geen geldig object`);
+    }
+    const routes = mod.routes;
+    if (!Array.isArray(routes)) {
+        throw new KernelBootstrapError(`${label}.routes ontbreekt of is geen array`);
+    }
+    routes.forEach((route, i) => {
+        const rl = `${label}.routes[${i}]`;
+        if (typeof route !== 'object' || route === null) {
+            throw new KernelBootstrapError(`${rl} is geen geldig route-object`);
+        }
+        const r = route;
+        if (typeof r.method !== 'string' || !VALID_METHODS.has(r.method.toUpperCase())) {
+            throw new KernelBootstrapError(`${rl}.method "${String(r.method)}" is ongeldig`);
+        }
+        if (typeof r.path !== 'string' || !r.path.startsWith('/')) {
+            throw new KernelBootstrapError(`${rl}.path moet een string zijn die met "/" begint`);
+        }
+        if (typeof r.handler !== 'function') {
+            throw new KernelBootstrapError(`${rl}.handler ontbreekt of is geen functie`);
+        }
+    });
+}
+/** Compileert alle route-modules tot één route-tabel; detecteert conflicten (fail-fast). */
+export function compileRoutes(modules, basePath = '') {
+    const routes = [];
+    const seen = new Map();
+    const normalizedBase = normalize(basePath);
+    modules.forEach((mod, index) => {
+        validateRouteModule(mod, index);
+        const moduleBase = normalize(mod.basePath ?? '');
+        for (const definition of mod.routes) {
+            const method = definition.method.toUpperCase();
+            const fullPath = joinPaths(normalizedBase, moduleBase, definition.path);
+            const key = `${method} ${fullPath}`;
+            if (seen.has(key)) {
+                throw new KernelBootstrapError(`conflicterende route-registratie: ${key} is meer dan één keer geregistreerd`);
+            }
+            seen.set(key, key);
+            routes.push({ method, fullPath, segments: toSegments(fullPath), definition });
+        }
+    });
+    return routes;
+}
+/** Zoekt de eerste route die matcht op methode + pad en extraheert path-params. */
+export function matchRoute(routes, method, path) {
+    const upper = method.toUpperCase();
+    const target = toSegments(normalize(path));
+    for (const route of routes) {
+        if (route.method !== upper)
+            continue;
+        const params = matchSegments(route.segments, target);
+        if (params)
+            return { route, params };
+    }
+    return null;
+}
+/** True als er wel een pad matcht maar geen enkele methode (405-hint). */
+export function pathExistsWithOtherMethod(routes, path) {
+    const target = toSegments(normalize(path));
+    return routes.some((route) => matchSegments(route.segments, target) !== null);
+}
+function matchSegments(routeSegs, target) {
+    if (routeSegs.length !== target.length)
+        return null;
+    const params = {};
+    for (let i = 0; i < routeSegs.length; i++) {
+        const seg = routeSegs[i];
+        const value = target[i].value;
+        if (seg.param) {
+            params[seg.value] = decodeURIComponent(value);
+        }
+        else if (seg.value !== value) {
+            return null;
+        }
+    }
+    return params;
+}
+function toSegments(path) {
+    return path
+        .split('/')
+        .filter((s) => s.length > 0)
+        .map((s) => (s.startsWith(':') ? { value: s.slice(1), param: true } : { value: s, param: false }));
+}
+function normalize(path) {
+    if (!path)
+        return '';
+    let p = path.trim();
+    if (!p.startsWith('/'))
+        p = `/${p}`;
+    if (p.length > 1 && p.endsWith('/'))
+        p = p.slice(0, -1);
+    return p === '/' ? '' : p;
+}
+function joinPaths(...parts) {
+    const joined = parts.map((p) => normalize(p)).join('');
+    return joined === '' ? '/' : joined;
+}
+//# sourceMappingURL=router.js.map

package/dist/backend/http/core/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../../backend/src/http/core/router.ts"],"names":[],"mappings":"AASA,uGAAuG;AACvG,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAa;IACxC,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAeH,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,KAAa;IAC7D,MAAM,KAAK,GAAG,gBAAgB,KAAK,GAAG,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAI,GAAmB,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,EAAE,GAAG,GAAG,KAAK,WAAW,CAAC,GAAG,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,GAAG,KAAwB,CAAC;QACnC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAgB,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,OAAkB,EAAE,QAAQ,GAAG,EAAE;IAC7D,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE3C,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAgB,CAAC;YAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,oBAAoB,CAC5B,qCAAqC,GAAG,qCAAqC,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,mFAAmF;AACnF,MAAM,UAAU,UAAU,CACxB,MAAuB,EACvB,MAAc,EACd,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,MAAuB,EAAE,IAAY;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,SAAoB,EAAE,MAAiB;IAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAY,CAAC;QACpC,MAAM,KAAK,GAAI,MAAM,CAAC,CAAC,CAAa,CAAC,KAAK,CAAC;QAC3C,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,KAAe;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC"}

package/dist/backend/http/core/security.d.ts

@@ -0,0 +1,43 @@
+/**
+ * US-0207 — CORS + security-headers.
+ *
+ * Past veilige security-header-defaults toe en handelt CORS af op basis van een geconfigureerde
+ * allowlist van origins/methodes/headers. Onbekende origins krijgen geen CORS-toegangs-headers. De
+ * laag is domein-loos; allowlist en overrides komen via config-injectie binnen.
+ */
+export interface SecurityHeadersConfig {
+    /** `Strict-Transport-Security`. Default veilige waarde; `false` schakelt uit. */
+    hsts?: string | false;
+    /** `Content-Security-Policy`. Default `default-src 'self'`; `false` schakelt uit. */
+    csp?: string | false;
+    /** `X-Frame-Options`. Default `DENY`. */
+    frameOptions?: string | false;
+    /** `Referrer-Policy`. Default `no-referrer`. */
+    referrerPolicy?: string | false;
+    /** Extra/overschrijvende headers. */
+    extra?: Record<string, string>;
+}
+/** Bouwt de security-headers met veilige defaults. */
+export declare function securityHeaders(config?: SecurityHeadersConfig): Record<string, string>;
+export interface CorsConfig {
+    /** Toegestane origins, of `'*'` voor alle. Leeg/afwezig = geen cross-origin-toegang. */
+    allowedOrigins?: string[] | '*';
+    allowedMethods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    allowCredentials?: boolean;
+    maxAge?: number;
+}
+export interface CorsResult {
+    headers: Record<string, string>;
+    /** True als de origin op de allowlist staat (of `*`). */
+    allowed: boolean;
+    isPreflight: boolean;
+}
+/**
+ * Berekent de CORS-headers voor een request. Onbekende origins krijgen geen
+ * `Access-Control-Allow-Origin` (US-0207 AC3). Voor een preflight (OPTIONS met
+ * `Access-Control-Request-Method`) worden de toegestane methodes/headers teruggegeven.
+ */
+export declare function resolveCors(origin: string | undefined, method: string, config?: CorsConfig, hasPreflightHeader?: boolean): CorsResult;
+//# sourceMappingURL=security.d.ts.map

package/dist/backend/http/core/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../backend/src/http/core/security.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAKD,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,GAAE,qBAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1F;AAED,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,UAAe,EACvB,kBAAkB,UAAQ,GACzB,UAAU,CAwBZ"}

package/dist/backend/http/core/security.js

@@ -0,0 +1,66 @@
+/**
+ * US-0207 — CORS + security-headers.
+ *
+ * Past veilige security-header-defaults toe en handelt CORS af op basis van een geconfigureerde
+ * allowlist van origins/methodes/headers. Onbekende origins krijgen geen CORS-toegangs-headers. De
+ * laag is domein-loos; allowlist en overrides komen via config-injectie binnen.
+ */
+const DEFAULT_HSTS = 'max-age=63072000; includeSubDomains';
+const DEFAULT_CSP = "default-src 'self'";
+/** Bouwt de security-headers met veilige defaults. */
+export function securityHeaders(config = {}) {
+    const headers = {
+        'X-Content-Type-Options': 'nosniff',
+    };
+    if (config.frameOptions !== false)
+        headers['X-Frame-Options'] = config.frameOptions ?? 'DENY';
+    if (config.hsts !== false)
+        headers['Strict-Transport-Security'] = config.hsts ?? DEFAULT_HSTS;
+    if (config.csp !== false)
+        headers['Content-Security-Policy'] = config.csp ?? DEFAULT_CSP;
+    if (config.referrerPolicy !== false) {
+        headers['Referrer-Policy'] = config.referrerPolicy ?? 'no-referrer';
+    }
+    return { ...headers, ...(config.extra ?? {}) };
+}
+const DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'];
+const DEFAULT_HEADERS = ['Content-Type', 'Authorization'];
+/**
+ * Berekent de CORS-headers voor een request. Onbekende origins krijgen geen
+ * `Access-Control-Allow-Origin` (US-0207 AC3). Voor een preflight (OPTIONS met
+ * `Access-Control-Request-Method`) worden de toegestane methodes/headers teruggegeven.
+ */
+export function resolveCors(origin, method, config = {}, hasPreflightHeader = false) {
+    const isPreflight = method.toUpperCase() === 'OPTIONS' && hasPreflightHeader;
+    const allowed = isOriginAllowed(origin, config.allowedOrigins);
+    if (!allowed || origin === undefined) {
+        return { headers: {}, allowed: false, isPreflight };
+    }
+    const headers = {};
+    const originValue = config.allowedOrigins === '*' && !config.allowCredentials ? '*' : origin;
+    headers['Access-Control-Allow-Origin'] = originValue;
+    if (originValue !== '*')
+        headers['Vary'] = 'Origin';
+    if (config.allowCredentials)
+        headers['Access-Control-Allow-Credentials'] = 'true';
+    if (config.exposedHeaders?.length) {
+        headers['Access-Control-Expose-Headers'] = config.exposedHeaders.join(', ');
+    }
+    if (isPreflight) {
+        headers['Access-Control-Allow-Methods'] = (config.allowedMethods ?? DEFAULT_METHODS).join(', ');
+        headers['Access-Control-Allow-Headers'] = (config.allowedHeaders ?? DEFAULT_HEADERS).join(', ');
+        if (config.maxAge !== undefined)
+            headers['Access-Control-Max-Age'] = String(config.maxAge);
+    }
+    return { headers, allowed: true, isPreflight };
+}
+function isOriginAllowed(origin, allowlist) {
+    if (origin === undefined)
+        return false;
+    if (allowlist === '*')
+        return true;
+    if (!allowlist || allowlist.length === 0)
+        return false;
+    return allowlist.includes(origin);
+}
+//# sourceMappingURL=security.js.map

package/dist/backend/http/core/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../../backend/src/http/core/security.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,SAAgC,EAAE;IAChE,MAAM,OAAO,GAA2B;QACtC,wBAAwB,EAAE,SAAS;KACpC,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC;IAC9F,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;IAC9F,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,CAAC,yBAAyB,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC;IACzF,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACpC,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAmBD,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC7E,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAA0B,EAC1B,MAAc,EACd,SAAqB,EAAE,EACvB,kBAAkB,GAAG,KAAK;IAE1B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC;IAC7E,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,OAAO,CAAC,6BAA6B,CAAC,GAAG,WAAW,CAAC;IACrD,IAAI,WAAW,KAAK,GAAG;QAAE,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;IACpD,IAAI,MAAM,CAAC,gBAAgB;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IAClF,IAAI,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAClC,OAAO,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B,EAAE,SAAqC;IACxF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,SAAS,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/backend/http/core/validation.d.ts

@@ -0,0 +1,9 @@
+import type { KernelRequest, RouteSchemas } from './ports.js';
+export interface ValidatedRequest {
+    body: unknown;
+    query: unknown;
+    params: unknown;
+}
+/** Valideert de request-onderdelen; verzamelt álle overtredingen over body/query/params heen. */
+export declare function validateRequest(req: KernelRequest, schemas?: RouteSchemas): ValidatedRequest;
+//# sourceMappingURL=validation.d.ts.map

package/dist/backend/http/core/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../backend/src/http/core/validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,CAc5F"}

package/dist/backend/http/core/validation.js

@@ -0,0 +1,36 @@
+/**
+ * US-0203 — Input-validatie (DTO/schema).
+ *
+ * Valideert body, query en path-params tegen per-route geregistreerde schema's. Bij succes krijgt de
+ * handler getypte data; bij falen wordt een {@link ValidationError} met een geaggregeerde,
+ * geredigeerde lijst overtredingen geworpen (die de kernel als 400 mapt). De validatie-engine is
+ * vervangbaar via de {@link Schema}-poort; de laag is domein-loos.
+ */
+import { ValidationError } from './errors.js';
+/** Valideert de request-onderdelen; verzamelt álle overtredingen over body/query/params heen. */
+export function validateRequest(req, schemas) {
+    if (!schemas) {
+        return { body: req.body, query: req.query ?? {}, params: req.params ?? {} };
+    }
+    const issues = [];
+    const body = check('body', req.body, schemas.body, issues);
+    const query = check('query', req.query ?? {}, schemas.query, issues);
+    const params = check('params', req.params ?? {}, schemas.params, issues);
+    if (issues.length > 0) {
+        throw new ValidationError(issues);
+    }
+    return { body, query, params };
+}
+function check(scope, value, schema, issues) {
+    if (!schema)
+        return value;
+    const result = schema.validate(value);
+    if (result.success)
+        return result.value;
+    for (const issue of result.issues) {
+        const path = issue.path && issue.path !== '(root)' ? `${scope}.${issue.path}` : scope;
+        issues.push({ path, message: issue.message });
+    }
+    return undefined;
+}
+//# sourceMappingURL=validation.js.map

package/dist/backend/http/core/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../../backend/src/http/core/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAS9C,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,GAAkB,EAAE,OAAsB;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CACZ,KAAkC,EAClC,KAAc,EACd,MAA4B,EAC5B,MAAyB;IAEzB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/backend/http/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `http` kit — domein-loze HTTP-plumbing: bootstrap + route-mounting, request-context, validatie,
+ * error-taxonomie, paginatie, OpenAPI en CORS/security-headers. Framework-agnostische core + adapters.
+ *
+ * De NestJS-adapter zit bewust achter de subpath `@seifer-webapp-factory/kits/backend/http/nestjs` (harde
+ * `@nestjs/*`-import), zodat de core-kit zonder Nest bruikbaar blijft.
+ */
+export { createKernel, type Kernel, type KernelConfig, type CreateKernelOptions, type KernelLogEvent, } from './core/kernel.js';
+export type { HttpMethod, KernelRequest, KernelResponse, Schema, ValidationOutcome, ValidationIssue, JsonSchema, RequestContext, RouteModule, RouteDefinition, RouteHandler, RouteHandlerInput, RouteSchemas, ListConfig, ListParams, SortField, } from './core/ports.js';
+export { HttpError, ValidationError, toErrorResponse, isHttpError, badRequest, unauthorized, forbidden, notFound, conflict, unprocessable, internal, type ErrorCategory, type ErrorResponseOptions, } from './core/errors.js';
+export { buildRequestContext, contextHeaders, runWithContext, getRequestContext, type ContextConfig, } from './core/context.js';
+export { validateRequest } from './core/validation.js';
+export { parseListQuery, paginate } from './core/pagination.js';
+export { securityHeaders, resolveCors, type SecurityHeadersConfig, type CorsConfig, type CorsResult, } from './core/security.js';
+export { compileRoutes, matchRoute, validateRouteModule, KernelBootstrapError, type CompiledRoute, type RouteMatch, } from './core/router.js';
+export { generateOpenApi, type OpenApiDocument, type OpenApiInfo, type OpenApiOptions, } from './core/openapi.js';
+export { redactSensitive, DEFAULT_SENSITIVE_KEYS } from './core/redaction.js';
+export { zodSchema, zodToJsonSchema } from './adapters/zod-schema.js';
+export { createRequestListener, type NodeRequestListener } from './nodejs/http-adapter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../backend/src/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/backend/http/index.js

@@ -0,0 +1,29 @@
+/**
+ * `http` kit — domein-loze HTTP-plumbing: bootstrap + route-mounting, request-context, validatie,
+ * error-taxonomie, paginatie, OpenAPI en CORS/security-headers. Framework-agnostische core + adapters.
+ *
+ * De NestJS-adapter zit bewust achter de subpath `@seifer-webapp-factory/kits/backend/http/nestjs` (harde
+ * `@nestjs/*`-import), zodat de core-kit zonder Nest bruikbaar blijft.
+ */
+// Kernel (US-0201..0207)
+export { createKernel, } from './core/kernel.js';
+// Error-taxonomie (US-0204)
+export { HttpError, ValidationError, toErrorResponse, isHttpError, badRequest, unauthorized, forbidden, notFound, conflict, unprocessable, internal, } from './core/errors.js';
+// Request-context (US-0202)
+export { buildRequestContext, contextHeaders, runWithContext, getRequestContext, } from './core/context.js';
+// Validatie (US-0203)
+export { validateRequest } from './core/validation.js';
+// Paginatie/filtering/sortering (US-0205)
+export { parseListQuery, paginate } from './core/pagination.js';
+// CORS + security-headers (US-0207)
+export { securityHeaders, resolveCors, } from './core/security.js';
+// Router (US-0201)
+export { compileRoutes, matchRoute, validateRouteModule, KernelBootstrapError, } from './core/router.js';
+// OpenAPI (US-0206)
+export { generateOpenApi, } from './core/openapi.js';
+// Redactie
+export { redactSensitive, DEFAULT_SENSITIVE_KEYS } from './core/redaction.js';
+// Adapters (dep-vrij / peer via zod)
+export { zodSchema, zodToJsonSchema } from './adapters/zod-schema.js';
+export { createRequestListener } from './nodejs/http-adapter.js';
+//# sourceMappingURL=index.js.map

package/dist/backend/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../backend/src/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,yBAAyB;AACzB,OAAO,EACL,YAAY,GAKb,MAAM,kBAAkB,CAAC;AAsB1B,4BAA4B;AAC5B,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,QAAQ,GAGT,MAAM,kBAAkB,CAAC;AAE1B,4BAA4B;AAC5B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAE3B,sBAAsB;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,0CAA0C;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhE,oCAAoC;AACpC,OAAO,EACL,eAAe,EACf,WAAW,GAIZ,MAAM,oBAAoB,CAAC;AAE5B,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAE1B,oBAAoB;AACpB,OAAO,EACL,eAAe,GAIhB,MAAM,mBAAmB,CAAC;AAE3B,WAAW;AACX,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,qCAAqC;AACrC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAA4B,MAAM,0BAA0B,CAAC"}