@seifer-webapp-factory/user-settings 0.1.0

package/dist/backend/src/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../backend/src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAarE,sFAAsF;AACtF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;gBACzB,IAAI,EAAE,qBAAqB,EAAE,OAAO,GAAE,MAAuB;CAM1E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,SAAS,CAE/E"}

package/dist/backend/src/errors.js

@@ -0,0 +1,29 @@
+/** Generieke, veilige boodschappen per code (nooit rauwe details). */
+const MESSAGES = {
+    unknown_key: 'Onbekende instellingssleutel',
+    validation_failed: 'Validatie mislukt',
+    consent_namespace_rejected: "Namespace 'consent' hoort bij de account-module, niet bij user-settings",
+    stale_write: 'De meegestuurde baseVersion is verouderd',
+    unauthenticated: 'Niet geauthenticeerd',
+    csrf_failed: 'CSRF-controle mislukt',
+    store_unavailable: 'De instellingen-store is niet beschikbaar',
+};
+/** Fout van de mechanism-laag, gedragen door een contract-`UserSettingsErrorCode`. */
+export class UserSettingsModuleError extends Error {
+    code;
+    constructor(code, message = MESSAGES[code]) {
+        super(message);
+        this.name = 'UserSettingsModuleError';
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * Vertaal een reeds-getypte module-fout door; geef `undefined` terug voor een onbekende fout (die laat de
+ * aanroeper bubbelen). Bestaat voor pariteit met de siblings; user-settings heeft geen kit-fouten om te
+ * mappen.
+ */
+export function asModuleError(err) {
+    return err instanceof UserSettingsModuleError ? err : undefined;
+}
+//# sourceMappingURL=errors.js.map

package/dist/backend/src/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../backend/src/errors.ts"],"names":[],"mappings":"AAOA,sEAAsE;AACtE,MAAM,QAAQ,GAA0C;IACtD,WAAW,EAAE,8BAA8B;IAC3C,iBAAiB,EAAE,mBAAmB;IACtC,0BAA0B,EAAE,yEAAyE;IACrG,WAAW,EAAE,0CAA0C;IACvD,eAAe,EAAE,sBAAsB;IACvC,WAAW,EAAE,uBAAuB;IACpC,iBAAiB,EAAE,2CAA2C;CAC/D,CAAC;AAEF,sFAAsF;AACtF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAwB;IACrC,YAAY,IAA2B,EAAE,UAAkB,QAAQ,CAAC,IAAI,CAAC;QACvE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,OAAO,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}

package/dist/backend/src/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * user-settings — backend-mechanism (flow-services). De verticale, framework-vrije servicelaag voor de
+ * server-adapter achter het gedeelde contract. Surface (NestJS-controller/module/migratie/pg-store) leeft
+ * in `backend/templates` en consumeert deze barrel.
+ */
+export { getSettings, putSetting, mergeSettings } from './services.js';
+export { UserSettingsModuleError, asModuleError } from './errors.js';
+export { assertValidDescriptors, resolveDescriptor, validateValue } from './descriptors.js';
+export type { Clock, StoredSetting, UpsertSetting, SettingsServerStore, SubjectProvider, UserSettingsModuleConfig, UserSettingsModuleDeps, } from './ports.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../backend/src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE5F,YAAY,EACV,KAAK,EACL,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,YAAY,CAAC"}

package/dist/backend/src/index.js

@@ -0,0 +1,9 @@
+/**
+ * user-settings — backend-mechanism (flow-services). De verticale, framework-vrije servicelaag voor de
+ * server-adapter achter het gedeelde contract. Surface (NestJS-controller/module/migratie/pg-store) leeft
+ * in `backend/templates` en consumeert deze barrel.
+ */
+export { getSettings, putSetting, mergeSettings } from './services.js';
+export { UserSettingsModuleError, asModuleError } from './errors.js';
+export { assertValidDescriptors, resolveDescriptor, validateValue } from './descriptors.js';
+//# sourceMappingURL=index.js.map

package/dist/backend/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../backend/src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/backend/src/ports.d.ts

@@ -0,0 +1,58 @@
+/**
+ * De poorten & de dependency-bundle van de user-settings-mechanism-laag.
+ *
+ * De flow-services zijn framework-vrij en krijgen ALLE afhankelijkheden via één {@link UserSettingsModuleDeps}-
+ * bundel. Anders dan account leunt deze module NIET op de auth- of privacy-kit: de server-adapter heeft
+ * alleen een keyed store, een subject-provider, events en een klok nodig. Determinisme loopt via de
+ * geïnjecteerde {@link Clock} (nooit `Date.now`).
+ */
+import type { SettingsSchema, UserSettingsConfig, UserSettingsEventSink } from '../../contract/index.js';
+/** Deterministische klok-poort (ms-epoch). Lokaal getypt zodat de module geen auth-kit-dep nodig heeft. */
+export type Clock = () => number;
+/** Eén server-persistente instelling: gekeyd op (subject, key), server-beheerde monotone `version`. */
+export interface StoredSetting {
+    readonly key: string;
+    readonly namespace: string;
+    readonly value: unknown;
+    readonly version: number;
+    readonly updatedAt: number;
+    /** Versioned tombstone: een delete is een write met `deleted: true`, nooit een fysieke row-delete. */
+    readonly deleted: boolean;
+}
+/** Wat de service aan de store aanbiedt om te upserten; de store stempelt zelf de nieuwe `version`. */
+export interface UpsertSetting {
+    readonly key: string;
+    readonly namespace: string;
+    readonly value: unknown;
+    readonly updatedAt: number;
+    readonly deleted?: boolean;
+}
+/**
+ * `SettingsServerStore`-poort (requires-port `SettingsStore`, server-kant): de host levert een adapter over
+ * `persistence` + de `user_settings`-migratie. `upsert` MOET de `version` server-side monotoon ophogen per
+ * (subject, key) — dat is de ordenings-autoriteit die client-klok-skew omzeilt.
+ */
+export interface SettingsServerStore {
+    all(subjectId: string): Promise<readonly StoredSetting[]>;
+    get(subjectId: string, key: string): Promise<StoredSetting | null>;
+    upsert(subjectId: string, entry: UpsertSetting): Promise<StoredSetting>;
+}
+/** `SubjectProvider`-poort: resolve het geauthenticeerde subject-id (alleen server-adapter). */
+export interface SubjectProvider {
+    resolve(request: unknown): Promise<string | null>;
+}
+/** Configuratie van de mechanism-laag: het host-descriptor-schema + het gevalideerde config-fragment. */
+export interface UserSettingsModuleConfig {
+    /** De host-gedeclareerde keys; drijft unknown-key- en waarde-validatie in de services. */
+    descriptors: SettingsSchema;
+    /** Uit het contract-config-fragment: renderKeys, cookiePrefix, serverSync, onboardingScope. */
+    policy: UserSettingsConfig;
+}
+/** De volledige afhankelijkheids-bundel die in elke flow-service wordt geïnjecteerd. */
+export interface UserSettingsModuleDeps {
+    store: SettingsServerStore;
+    events: UserSettingsEventSink;
+    clock: Clock;
+    config: UserSettingsModuleConfig;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/backend/src/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../backend/src/ports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEzG,2GAA2G;AAC3G,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;AAEjC,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzE;AAED,gGAAgG;AAChG,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,yGAAyG;AACzG,MAAM,WAAW,wBAAwB;IACvC,0FAA0F;IAC1F,WAAW,EAAE,cAAc,CAAC;IAC5B,+FAA+F;IAC/F,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,wBAAwB,CAAC;CAClC"}

package/dist/backend/src/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/backend/src/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../backend/src/ports.ts"],"names":[],"mappings":""}

package/dist/backend/src/services.d.ts

@@ -0,0 +1,26 @@
+/**
+ * De backend-mechanism-laag: framework-vrije flow-services voor de server-adapter. Elke functie krijgt de
+ * {@link UserSettingsModuleDeps}-bundel + het gevalideerde request (en het subject-id), stempelt de
+ * server-beheerde monotone `version`, handhaaft de per-key LWW-merge en emit het juiste domein-event
+ * (nooit met een waarde erin). NestJS-controllers zijn *surface* en horen hier niet thuis.
+ */
+import type { MergeRequest, MergeResponse, PutSettingRequest, SettingsMapResponse, SettingsRecord } from '../../contract/index.js';
+import type { UserSettingsModuleDeps } from './ports.js';
+/** Lees de volledige keyed map van het subject. Tombstones komen mee als `deleted: true`. */
+export declare function getSettings(deps: UserSettingsModuleDeps, subjectId: string): Promise<SettingsMapResponse>;
+/**
+ * Upsert één key. Onbekende key → `unknown_key`; ongeldige waarde → `validation_failed`. Als de client een
+ * `baseVersion` meestuurt die achterloopt op de server → `stale_write` (409): de client heeft tegen
+ * verouderde state geschreven en moet opnieuw ophalen. Zonder `baseVersion` wint de write onvoorwaardelijk
+ * (receive-order LWW). De store hoogt de `version` monotoon op. Emit `setting.updated` (zonder waarde).
+ */
+export declare function putSetting(deps: UserSettingsModuleDeps, subjectId: string, key: string, req: PutSettingRequest): Promise<SettingsRecord>;
+/**
+ * Voeg de anonieme client-map samen in de server-store. Conflict-policy (onderzoek-default): een key die de
+ * account nog NIET heeft wordt overgenomen (`client_filled`); een key die de account wél heeft blijft staan
+ * (`server_won`); een onbekende/ongeldige key wordt overgeslagen (`rejected`) — nooit stil weggegooid.
+ * Deterministisch en klok-onafhankelijk. `opId` maakt de aanroep idempotent op de surface-laag (dedupe).
+ * Emit één `settings.merged` met de aangeraakte keys + conflicten (nooit waarden).
+ */
+export declare function mergeSettings(deps: UserSettingsModuleDeps, subjectId: string, req: MergeRequest): Promise<MergeResponse>;
+//# sourceMappingURL=services.d.ts.map

package/dist/backend/src/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../backend/src/services.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,iBAAiB,EAEjB,mBAAmB,EACnB,cAAc,EACf,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAiB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIxE,6FAA6F;AAC7F,wBAAsB,WAAW,CAAC,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAK/G;AAID;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,sBAAsB,EAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,cAAc,CAAC,CA0BzB;AAID;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,sBAAsB,EAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,aAAa,CAAC,CA4CxB"}

package/dist/backend/src/services.js

@@ -0,0 +1,104 @@
+import { resolveDescriptor, validateValue } from './descriptors.js';
+import { UserSettingsModuleError } from './errors.js';
+// --- Lezen ---
+/** Lees de volledige keyed map van het subject. Tombstones komen mee als `deleted: true`. */
+export async function getSettings(deps, subjectId) {
+    const stored = await deps.store.all(subjectId);
+    const settings = {};
+    for (const record of stored)
+        settings[record.key] = toRecord(record);
+    return { settings };
+}
+// --- Eén key schrijven (optimistic concurrency via baseVersion) ---
+/**
+ * Upsert één key. Onbekende key → `unknown_key`; ongeldige waarde → `validation_failed`. Als de client een
+ * `baseVersion` meestuurt die achterloopt op de server → `stale_write` (409): de client heeft tegen
+ * verouderde state geschreven en moet opnieuw ophalen. Zonder `baseVersion` wint de write onvoorwaardelijk
+ * (receive-order LWW). De store hoogt de `version` monotoon op. Emit `setting.updated` (zonder waarde).
+ */
+export async function putSetting(deps, subjectId, key, req) {
+    const descriptor = resolveDescriptor(deps.config.descriptors, key);
+    const value = validateValue(descriptor, req.value);
+    const current = await deps.store.get(subjectId, key);
+    if (current !== null && req.baseVersion !== undefined && req.baseVersion < current.version) {
+        throw new UserSettingsModuleError('stale_write');
+    }
+    const saved = await deps.store.upsert(subjectId, {
+        key,
+        namespace: descriptor.namespace,
+        value,
+        updatedAt: deps.clock(),
+        deleted: false,
+    });
+    deps.events.emit({
+        name: 'setting.updated',
+        occurredAt: nowIso(deps),
+        subjectId,
+        key,
+        namespace: descriptor.namespace,
+        version: saved.version,
+    });
+    return toRecord(saved);
+}
+// --- Guest→login merge (per-key, idempotent) ---
+/**
+ * Voeg de anonieme client-map samen in de server-store. Conflict-policy (onderzoek-default): een key die de
+ * account nog NIET heeft wordt overgenomen (`client_filled`); een key die de account wél heeft blijft staan
+ * (`server_won`); een onbekende/ongeldige key wordt overgeslagen (`rejected`) — nooit stil weggegooid.
+ * Deterministisch en klok-onafhankelijk. `opId` maakt de aanroep idempotent op de surface-laag (dedupe).
+ * Emit één `settings.merged` met de aangeraakte keys + conflicten (nooit waarden).
+ */
+export async function mergeSettings(deps, subjectId, req) {
+    const conflicts = [];
+    const mergedKeys = [];
+    for (const [key, entry] of Object.entries(req.entries)) {
+        const descriptor = deps.config.descriptors.find((d) => d.key === key);
+        if (descriptor === undefined) {
+            conflicts.push({ key, resolution: 'rejected' });
+            continue;
+        }
+        const parsed = descriptor.schema.safeParse(entry.value);
+        if (!parsed.success) {
+            conflicts.push({ key, resolution: 'rejected' });
+            continue;
+        }
+        const current = await deps.store.get(subjectId, key);
+        if (current !== null) {
+            // De account heeft deze key al → server wint (default policy).
+            conflicts.push({ key, resolution: 'server_won' });
+            continue;
+        }
+        await deps.store.upsert(subjectId, {
+            key,
+            namespace: descriptor.namespace,
+            value: parsed.data,
+            updatedAt: deps.clock(),
+            deleted: entry.deleted ?? false,
+        });
+        mergedKeys.push(key);
+        conflicts.push({ key, resolution: 'client_filled' });
+    }
+    deps.events.emit({
+        name: 'settings.merged',
+        occurredAt: nowIso(deps),
+        subjectId,
+        mergedKeys,
+        conflicts: conflicts.filter((c) => c.resolution === 'server_won').map((c) => c.key),
+    });
+    const settings = (await getSettings(deps, subjectId)).settings;
+    return { settings, conflicts };
+}
+// --- Interne helpers ---
+function toRecord(record) {
+    return {
+        value: record.value,
+        version: record.version,
+        updatedAt: record.updatedAt,
+        ...(record.deleted ? { deleted: true } : {}),
+    };
+}
+/** ISO-8601 tijdstip uit de geïnjecteerde klok (deterministisch, geen `Date.now`). */
+function nowIso(deps) {
+    return new Date(deps.clock()).toISOString();
+}
+//# sourceMappingURL=services.js.map

package/dist/backend/src/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../backend/src/services.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,gBAAgB;AAEhB,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,SAAiB;IAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,MAAM;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAA4B,EAC5B,SAAiB,EACjB,GAAW,EACX,GAAsB;IAEtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3F,MAAM,IAAI,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QAC/C,GAAG;QACH,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE;QACvB,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;QACxB,SAAS;QACT,GAAG;QACH,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,kDAAkD;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA4B,EAC5B,SAAiB,EACjB,GAAiB;IAEjB,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,+DAA+D;YAC/D,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;YACjC,GAAG;YACH,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;SAChC,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;QACxB,SAAS;QACT,UAAU;QACV,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;KACpF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,0BAA0B;AAE1B,SAAS,QAAQ,CAAC,MAAqB;IACrC,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,IAA4B;IAC1C,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC"}

package/dist/contract/config.d.ts

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+/**
+ * user-settings — config-fragment (host levert dit via de config-kit). Elke knop is divergentie-niveau 1.
+ * Defaults resolven tot een werkende, veilige module. `serverSync` staat AAN wanneer auth aanwezig is
+ * (locked decision): cross-device follow-me incl. onboarding; een no-auth product selecteert de
+ * server-adapter nooit (client-only, geen backend) ongeacht deze vlag.
+ */
+export declare const userSettingsConfigSchema: z.ZodObject<{
+    /** Server-persistentie aan wanneer auth aanwezig is (default), of expliciet uit voor client-only. */
+    serverSync: z.ZodDefault<z.ZodBoolean>;
+    /** Prefix voor de render-key cookies. */
+    cookiePrefix: z.ZodDefault<z.ZodString>;
+    /** De render-kritieke keys die altijd op een server-leesbare cookie gaan (SSR-veilig, first-paint). */
+    renderKeys: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Levensduur (dagen) van de render-key cookies. */
+    cookieMaxAgeDays: z.ZodDefault<z.ZodNumber>;
+    /** Onboarding-scope: 'server' (follow-me over devices, default) of 'device' (localStorage). */
+    onboardingScope: z.ZodDefault<z.ZodEnum<["server", "device"]>>;
+}, "strip", z.ZodTypeAny, {
+    serverSync: boolean;
+    cookiePrefix: string;
+    renderKeys: string[];
+    cookieMaxAgeDays: number;
+    onboardingScope: "server" | "device";
+}, {
+    serverSync?: boolean | undefined;
+    cookiePrefix?: string | undefined;
+    renderKeys?: string[] | undefined;
+    cookieMaxAgeDays?: number | undefined;
+    onboardingScope?: "server" | "device" | undefined;
+}>;
+export type UserSettingsConfig = z.infer<typeof userSettingsConfigSchema>;
+/** Ongevalideerde host-invoer (alle velden optioneel; defaults vullen de rest). */
+export type UserSettingsConfigInput = z.input<typeof userSettingsConfigSchema>;
+//# sourceMappingURL=config.d.ts.map

package/dist/contract/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../contract/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;IACnC,qGAAqG;;IAErG,yCAAyC;;IAEzC,uGAAuG;;IAEvG,oDAAoD;;IAEpD,+FAA+F;;;;;;;;;;;;;;EAE/F,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,mFAAmF;AACnF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/contract/config.js

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+/**
+ * user-settings — config-fragment (host levert dit via de config-kit). Elke knop is divergentie-niveau 1.
+ * Defaults resolven tot een werkende, veilige module. `serverSync` staat AAN wanneer auth aanwezig is
+ * (locked decision): cross-device follow-me incl. onboarding; een no-auth product selecteert de
+ * server-adapter nooit (client-only, geen backend) ongeacht deze vlag.
+ */
+export const userSettingsConfigSchema = z.object({
+    /** Server-persistentie aan wanneer auth aanwezig is (default), of expliciet uit voor client-only. */
+    serverSync: z.boolean().default(true),
+    /** Prefix voor de render-key cookies. */
+    cookiePrefix: z.string().min(1).default('us_'),
+    /** De render-kritieke keys die altijd op een server-leesbare cookie gaan (SSR-veilig, first-paint). */
+    renderKeys: z.array(z.string().min(1)).default(['theme', 'locale', 'dir']),
+    /** Levensduur (dagen) van de render-key cookies. */
+    cookieMaxAgeDays: z.number().int().positive().default(365),
+    /** Onboarding-scope: 'server' (follow-me over devices, default) of 'device' (localStorage). */
+    onboardingScope: z.enum(['server', 'device']).default('server'),
+});
+//# sourceMappingURL=config.js.map

package/dist/contract/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../contract/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,qGAAqG;IACrG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,yCAAyC;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,uGAAuG;IACvG,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1E,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1D,+FAA+F;IAC/F,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;CAChE,CAAC,CAAC"}

package/dist/contract/endpoints.d.ts

@@ -0,0 +1,188 @@
+import type { z } from 'zod';
+import type { UserSettingsErrorCode } from './errors.js';
+/**
+ * De machine-leesbare endpoint-catalogus (alleen relevant wanneer de server-adapter draait). Backend
+ * leidt hier route + validatie uit af; frontend leidt hier zijn getypte client uit af. Eén bron, geen
+ * drift — de manifest `backendRoutes` wordt hieruit afgeleid (nooit met de hand overgetypt).
+ */
+export interface EndpointDescriptor<Req extends z.ZodTypeAny | null, Res extends z.ZodTypeAny> {
+    readonly method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    readonly path: string;
+    readonly request: Req;
+    readonly response: Res;
+    /** Foutcodes die dit endpoint kan retourneren (uit de gedeelde taxonomie). */
+    readonly errors: readonly UserSettingsErrorCode[];
+    /** Vereist een geldig CSRF-token (cookie-transport). */
+    readonly csrf: boolean;
+    /** Vereist een geauthenticeerde sessie (via de host SubjectProvider). */
+    readonly auth: boolean;
+}
+export declare const USER_SETTINGS_ENDPOINTS: {
+    readonly getSettings: {
+        readonly method: "GET";
+        readonly path: "/settings";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            settings: z.ZodRecord<z.ZodString, z.ZodObject<{
+                value: z.ZodUnknown;
+                version: z.ZodNumber;
+                updatedAt: z.ZodNumber;
+                deleted: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            settings: Record<string, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>;
+        }, {
+            settings: Record<string, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>;
+        }>;
+        readonly errors: readonly ["unauthenticated", "store_unavailable"];
+        readonly csrf: false;
+        readonly auth: true;
+    };
+    readonly putSetting: {
+        readonly method: "PUT";
+        readonly path: "/settings/:key";
+        readonly request: z.ZodObject<{
+            value: z.ZodUnknown;
+            baseVersion: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            value?: unknown;
+            baseVersion?: number | undefined;
+        }, {
+            value?: unknown;
+            baseVersion?: number | undefined;
+        }>;
+        readonly response: z.ZodObject<{
+            value: z.ZodUnknown;
+            version: z.ZodNumber;
+            updatedAt: z.ZodNumber;
+            deleted: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            version: number;
+            updatedAt: number;
+            value?: unknown;
+            deleted?: boolean | undefined;
+        }, {
+            version: number;
+            updatedAt: number;
+            value?: unknown;
+            deleted?: boolean | undefined;
+        }>;
+        readonly errors: readonly ["unknown_key", "validation_failed", "stale_write", "unauthenticated", "csrf_failed", "store_unavailable"];
+        readonly csrf: true;
+        readonly auth: true;
+    };
+    readonly mergeSettings: {
+        readonly method: "POST";
+        readonly path: "/settings/merge";
+        readonly request: z.ZodObject<{
+            opId: z.ZodString;
+            entries: z.ZodRecord<z.ZodString, z.ZodObject<{
+                value: z.ZodUnknown;
+                version: z.ZodNumber;
+                updatedAt: z.ZodNumber;
+                deleted: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            entries: Record<string, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>;
+            opId: string;
+        }, {
+            entries: Record<string, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>;
+            opId: string;
+        }>;
+        readonly response: z.ZodObject<{
+            settings: z.ZodRecord<z.ZodString, z.ZodObject<{
+                value: z.ZodUnknown;
+                version: z.ZodNumber;
+                updatedAt: z.ZodNumber;
+                deleted: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>>;
+            conflicts: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                resolution: z.ZodEnum<["server_won", "client_filled", "rejected"]>;
+            }, "strip", z.ZodTypeAny, {
+                key: string;
+                resolution: "server_won" | "client_filled" | "rejected";
+            }, {
+                key: string;
+                resolution: "server_won" | "client_filled" | "rejected";
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            settings: Record<string, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>;
+            conflicts: {
+                key: string;
+                resolution: "server_won" | "client_filled" | "rejected";
+            }[];
+        }, {
+            settings: Record<string, {
+                version: number;
+                updatedAt: number;
+                value?: unknown;
+                deleted?: boolean | undefined;
+            }>;
+            conflicts: {
+                key: string;
+                resolution: "server_won" | "client_filled" | "rejected";
+            }[];
+        }>;
+        readonly errors: readonly ["validation_failed", "unauthenticated", "csrf_failed", "store_unavailable"];
+        readonly csrf: true;
+        readonly auth: true;
+    };
+};
+export type UserSettingsEndpointName = keyof typeof USER_SETTINGS_ENDPOINTS;
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/contract/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../contract/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQ7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,GAAG,SAAS,CAAC,CAAC,UAAU,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,UAAU;IAC3F,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBsD,CAAC;AAE3F,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,uBAAuB,CAAC"}

package/dist/contract/endpoints.js

@@ -0,0 +1,21 @@
+import { settingsMapResponseSchema, putSettingRequestSchema, putSettingResponseSchema, mergeRequestSchema, mergeResponseSchema, } from './schemas.js';
+export const USER_SETTINGS_ENDPOINTS = {
+    getSettings: {
+        method: 'GET', path: '/settings', request: null,
+        response: settingsMapResponseSchema,
+        errors: ['unauthenticated', 'store_unavailable'], csrf: false, auth: true,
+    },
+    putSetting: {
+        method: 'PUT', path: '/settings/:key', request: putSettingRequestSchema,
+        response: putSettingResponseSchema,
+        errors: ['unknown_key', 'validation_failed', 'stale_write', 'unauthenticated', 'csrf_failed', 'store_unavailable'],
+        csrf: true, auth: true,
+    },
+    mergeSettings: {
+        method: 'POST', path: '/settings/merge', request: mergeRequestSchema,
+        response: mergeResponseSchema,
+        errors: ['validation_failed', 'unauthenticated', 'csrf_failed', 'store_unavailable'],
+        csrf: true, auth: true,
+    },
+};
+//# sourceMappingURL=endpoints.js.map

package/dist/contract/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../contract/endpoints.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAqBtB,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI;QAC/C,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI;KAC1E;IACD,UAAU,EAAE;QACV,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uBAAuB;QACvE,QAAQ,EAAE,wBAAwB;QAClC,MAAM,EAAE,CAAC,aAAa,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,CAAC;QAClH,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KACvB;IACD,aAAa,EAAE;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB;QACpE,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,CAAC;QACpF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KACvB;CACuF,CAAC"}

package/dist/contract/errors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Error-taxonomie + i18n-sleutels. Eén gedeelde foutcodelijst die beide helften (backend mapping → HTTP,
+ * frontend weergave → i18n) uit het contract afleiden. Foutteksten lekken nooit waarden of PII.
+ */
+export declare const USER_SETTINGS_ERROR_CODES: readonly ["unknown_key", "validation_failed", "consent_namespace_rejected", "stale_write", "unauthenticated", "csrf_failed", "store_unavailable"];
+export type UserSettingsErrorCode = (typeof USER_SETTINGS_ERROR_CODES)[number];
+export interface UserSettingsErrorDescriptor {
+    /** HTTP-status waarnaar de backend deze fout mapt. */
+    readonly httpStatus: number;
+    /** i18n-sleutel die de frontend toont (nooit rauwe details). */
+    readonly i18nKey: string;
+}
+/** Enige bron van de code→HTTP + code→i18n-mapping. */
+export declare const USER_SETTINGS_ERROR_TAXONOMY: Readonly<Record<UserSettingsErrorCode, UserSettingsErrorDescriptor>>;
+/** Contract-vorm van een foutrespons (body). Bevat nooit stacktraces, waarden of PII. */
+export interface UserSettingsErrorBody {
+    readonly code: UserSettingsErrorCode;
+    readonly message: string;
+    /** Optioneel: veld-gebonden validatiefouten (paden), zonder ingevoerde waarden. */
+    readonly fields?: Readonly<Record<string, string[]>>;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/contract/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../contract/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,yBAAyB,mJAQ5B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,WAAW,2BAA2B;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAW1G,CAAC;AAEL,yFAAyF;AACzF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CACtD"}

package/dist/contract/errors.js

@@ -0,0 +1,26 @@
+/**
+ * Error-taxonomie + i18n-sleutels. Eén gedeelde foutcodelijst die beide helften (backend mapping → HTTP,
+ * frontend weergave → i18n) uit het contract afleiden. Foutteksten lekken nooit waarden of PII.
+ */
+export const USER_SETTINGS_ERROR_CODES = [
+    'unknown_key',
+    'validation_failed',
+    'consent_namespace_rejected',
+    'stale_write',
+    'unauthenticated',
+    'csrf_failed',
+    'store_unavailable',
+];
+/** Enige bron van de code→HTTP + code→i18n-mapping. */
+export const USER_SETTINGS_ERROR_TAXONOMY = Object.freeze({
+    unknown_key: { httpStatus: 422, i18nKey: 'userSettings.error.unknown_key' },
+    validation_failed: { httpStatus: 422, i18nKey: 'userSettings.error.validation_failed' },
+    consent_namespace_rejected: { httpStatus: 422, i18nKey: 'userSettings.error.consent_namespace_rejected' },
+    // stale_write: de baseVersion is ouder dan de server. Voor scalar-prefs mag de write alsnog winnen
+    // (receive-order LWW), maar de code wordt blootgesteld voor optimistic-concurrency-detectie.
+    stale_write: { httpStatus: 409, i18nKey: 'userSettings.error.stale_write' },
+    unauthenticated: { httpStatus: 401, i18nKey: 'userSettings.error.unauthenticated' },
+    csrf_failed: { httpStatus: 403, i18nKey: 'userSettings.error.csrf_failed' },
+    store_unavailable: { httpStatus: 503, i18nKey: 'userSettings.error.store_unavailable' },
+});
+//# sourceMappingURL=errors.js.map

package/dist/contract/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../contract/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,aAAa;IACb,mBAAmB;IACnB,4BAA4B;IAC5B,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,mBAAmB;CACX,CAAC;AAWX,uDAAuD;AACvD,MAAM,CAAC,MAAM,4BAA4B,GACvC,MAAM,CAAC,MAAM,CAAC;IACZ,WAAW,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAC3E,iBAAiB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,sCAAsC,EAAE;IACvF,0BAA0B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACzG,mGAAmG;IACnG,6FAA6F;IAC7F,WAAW,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAC3E,eAAe,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACnF,WAAW,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAC3E,iBAAiB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,sCAAsC,EAAE;CACxF,CAAC,CAAC"}