webapp-factory 0.1.0

package/dist/privacy/core/consent.js

@@ -0,0 +1,49 @@
+export function createConsentRegistry(store, options = {}) {
+    const clock = options.clock ?? Date.now;
+    const write = async (subjectId, purpose, status, policyVersion) => {
+        const record = {
+            subjectId,
+            purpose,
+            status,
+            timestamp: clock(),
+            ...(policyVersion !== undefined ? { policyVersion } : {}),
+        };
+        await store.append(record);
+        await options.audit?.record({
+            action: `privacy.consent.${status}`,
+            subjectId,
+            complete: true,
+            meta: { purpose, ...(policyVersion !== undefined ? { policyVersion } : {}) },
+        });
+        return record;
+    };
+    return {
+        grant: (subjectId, purpose, opts = {}) => write(subjectId, purpose, 'granted', opts.policyVersion),
+        withdraw: (subjectId, purpose) => write(subjectId, purpose, 'withdrawn'),
+        async status(subjectId, purpose) {
+            const latest = await store.latest(subjectId, purpose);
+            if (!latest)
+                return { status: 'none' };
+            return {
+                status: latest.status,
+                ...(latest.policyVersion !== undefined ? { policyVersion: latest.policyVersion } : {}),
+                timestamp: latest.timestamp,
+            };
+        },
+        history: (subjectId, purpose) => store.history(subjectId, purpose),
+    };
+}
+/**
+ * Leidt een boolean opt-out-flag af uit de consent-status voor het doel "analytics". Leest live uit de
+ * consent-registry (geen cache), zodat een intrekking direct doorwerkt; default is opt-out.
+ */
+export function analyticsOptOut(consent, options = {}) {
+    const purpose = options.purpose ?? 'analytics';
+    return {
+        async isAnalyticsAllowed(subjectId) {
+            const result = await consent.status(subjectId, purpose);
+            return result.status === 'granted';
+        },
+    };
+}
+//# sourceMappingURL=consent.js.map

package/dist/privacy/core/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../../src/privacy/core/consent.ts"],"names":[],"mappings":"AAyBA,MAAM,UAAU,qBAAqB,CAAC,KAAmB,EAAE,UAA0B,EAAE;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,EACjB,SAAiB,EACjB,OAAe,EACf,MAAqB,EACrB,aAAsB,EACE,EAAE;QAC1B,MAAM,MAAM,GAAkB;YAC5B,SAAS;YACT,OAAO;YACP,MAAM;YACN,SAAS,EAAE,KAAK,EAAE;YAClB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;QACF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YAC1B,MAAM,EAAE,mBAAmB,MAAM,EAAE;YACnC,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC7E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC;QAClG,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC;QACxE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;KACnE,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,UAAgC,EAAE;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC;IAC/C,OAAO;QACL,KAAK,CAAC,kBAAkB,CAAC,SAAS;YAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/privacy/core/erasure.d.ts

@@ -0,0 +1,22 @@
+import type { AuditSink, Clock, EraseStrategy } from './ports.js';
+import type { ProviderRegistry } from './registry.js';
+export interface ErasureReportEntry {
+    providerId: string;
+    status: 'erased' | 'failed';
+    strategy?: EraseStrategy;
+    affected?: number;
+    reason?: string;
+}
+export interface ErasureReport {
+    subjectId: string;
+    generatedAt: number;
+    complete: boolean;
+    retryable: boolean;
+    entries: ErasureReportEntry[];
+}
+export interface ErasureOptions {
+    audit?: AuditSink;
+    clock?: Clock;
+}
+export declare function eraseSubject(registry: ProviderRegistry, subjectId: string, options?: ErasureOptions): Promise<ErasureReport>;
+//# sourceMappingURL=erasure.d.ts.map

package/dist/privacy/core/erasure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.d.ts","sourceRoot":"","sources":["../../../src/privacy/core/erasure.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CA4BxB"}

package/dist/privacy/core/erasure.js

@@ -0,0 +1,35 @@
+/**
+ * US-1203 — Erasure-orkestratie (recht op vergetelheid, AVG art. 17). Roept `erase(subjectId)` aan op
+ * elke provider en verzamelt per provider de strategie (deleted/anonymized) + aantal getroffen records.
+ * Een gedeeltelijke mislukking maakt het rapport `incomplete` + `retryable`, zodat het subject
+ * aangemerkt blijft voor herhaling.
+ */
+import { redactReason } from './errors.js';
+export async function eraseSubject(registry, subjectId, options = {}) {
+    const clock = options.clock ?? Date.now;
+    const entries = [];
+    let complete = true;
+    for (const provider of registry.list()) {
+        try {
+            const result = await provider.erase(subjectId);
+            entries.push({
+                providerId: provider.id,
+                status: 'erased',
+                strategy: result.strategy,
+                affected: result.affected,
+            });
+        }
+        catch (error) {
+            complete = false;
+            entries.push({ providerId: provider.id, status: 'failed', reason: redactReason(error) });
+        }
+    }
+    await options.audit?.record({
+        action: 'privacy.erasure',
+        subjectId,
+        complete,
+        meta: { entries: entries.map((e) => ({ id: e.providerId, status: e.status })) },
+    });
+    return { subjectId, generatedAt: clock(), complete, retryable: !complete, entries };
+}
+//# sourceMappingURL=erasure.js.map

package/dist/privacy/core/erasure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.js","sourceRoot":"","sources":["../../../src/privacy/core/erasure.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyB3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA0B,EAC1B,SAAiB,EACjB,UAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACxC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,GAAG,KAAK,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1B,MAAM,EAAE,iBAAiB;QACzB,SAAS;QACT,QAAQ;QACR,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;KAChF,CAAC,CAAC;IAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC"}

package/dist/privacy/core/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Foutentaxonomie voor privacy-kit. Foutredenen in export-/erasure-rapporten worden geredigeerd.
+ */
+export declare class PrivacyError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** Twee providers met hetzelfde id (US-1201 AC2). */
+export declare class DuplicateProviderError extends PrivacyError {
+    constructor(id: string);
+}
+/** Registratie na het afsluiten (sealen) van de registry (US-1201 AC3). */
+export declare class SealedRegistryError extends PrivacyError {
+    constructor();
+}
+/** Redigeert een foutreden zodat er geen payload/secret in een rapport belandt. */
+export declare function redactReason(input: unknown): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/privacy/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/privacy/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM1C;AAED,qDAAqD;AACrD,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,EAAE,EAAE,MAAM;CAGvB;AAED,2EAA2E;AAC3E,qBAAa,mBAAoB,SAAQ,YAAY;;CAIpD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGnD"}

package/dist/privacy/core/errors.js

@@ -0,0 +1,30 @@
+/**
+ * Foutentaxonomie voor privacy-kit. Foutredenen in export-/erasure-rapporten worden geredigeerd.
+ */
+export class PrivacyError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Twee providers met hetzelfde id (US-1201 AC2). */
+export class DuplicateProviderError extends PrivacyError {
+    constructor(id) {
+        super(`Data-provider met id "${id}" is al geregistreerd`, 'DUPLICATE_PROVIDER');
+    }
+}
+/** Registratie na het afsluiten (sealen) van de registry (US-1201 AC3). */
+export class SealedRegistryError extends PrivacyError {
+    constructor() {
+        super('Provider-registry is afgesloten (sealed); registratie is niet meer toegestaan', 'REGISTRY_SEALED');
+    }
+}
+/** Redigeert een foutreden zodat er geen payload/secret in een rapport belandt. */
+export function redactReason(input) {
+    const text = input instanceof Error ? input.message : String(input);
+    return text.replace(/(password|pwd|token|secret|api[-_]?key)\s*[=:]\s*[^\s;,&]+/gi, '$1=***');
+}
+//# sourceMappingURL=errors.js.map

package/dist/privacy/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/privacy/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACtD,YAAY,EAAU;QACpB,KAAK,CAAC,yBAAyB,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD;QACE,KAAK,CAAC,+EAA+E,EAAE,iBAAiB,CAAC,CAAC;IAC5G,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,OAAO,CAAC,8DAA8D,EAAE,QAAQ,CAAC,CAAC;AAChG,CAAC"}

package/dist/privacy/core/export.d.ts

@@ -0,0 +1,20 @@
+import type { AuditSink, Clock } from './ports.js';
+import type { ProviderRegistry } from './registry.js';
+export interface ExportManifestEntry {
+    providerId: string;
+    status: 'covered' | 'failed';
+    reason?: string;
+}
+export interface ExportBundle {
+    subjectId: string;
+    generatedAt: number;
+    complete: boolean;
+    sections: Record<string, unknown>;
+    manifest: ExportManifestEntry[];
+}
+export interface ExportOptions {
+    audit?: AuditSink;
+    clock?: Clock;
+}
+export declare function exportSubject(registry: ProviderRegistry, subjectId: string, options?: ExportOptions): Promise<ExportBundle>;
+//# sourceMappingURL=export.d.ts.map

package/dist/privacy/core/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/privacy/core/export.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAwBvB"}

package/dist/privacy/core/export.js

@@ -0,0 +1,30 @@
+/**
+ * US-1202 — Export-orkestratie (dataportabiliteit, AVG art. 15/20). Itereert over alle geregistreerde
+ * providers, bundelt hun output per sectie en levert een manifest dat volledigheid aantoonbaar maakt.
+ * Een falende provider wordt expliciet als `failed` gerapporteerd; de export wordt dan `incomplete`.
+ */
+import { redactReason } from './errors.js';
+export async function exportSubject(registry, subjectId, options = {}) {
+    const clock = options.clock ?? Date.now;
+    const sections = {};
+    const manifest = [];
+    let complete = true;
+    for (const provider of registry.list()) {
+        try {
+            sections[provider.id] = await provider.export(subjectId);
+            manifest.push({ providerId: provider.id, status: 'covered' });
+        }
+        catch (error) {
+            complete = false;
+            manifest.push({ providerId: provider.id, status: 'failed', reason: redactReason(error) });
+        }
+    }
+    await options.audit?.record({
+        action: 'privacy.export',
+        subjectId,
+        complete,
+        meta: { providers: manifest.map((m) => m.providerId) },
+    });
+    return { subjectId, generatedAt: clock(), complete, sections, manifest };
+}
+//# sourceMappingURL=export.js.map

package/dist/privacy/core/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/privacy/core/export.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuB3C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA0B,EAC1B,SAAiB,EACjB,UAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,GAAG,KAAK,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1B,MAAM,EAAE,gBAAgB;QACxB,SAAS;QACT,QAAQ;QACR,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;KACvD,CAAC,CAAC;IAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC3E,CAAC"}

package/dist/privacy/core/ports.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Poorten & types voor de privacy-kit. Data-providers, de consent-store en de audit-sink worden
+ * geïnjecteerd; de kit kent geen domeintabellen, PII-velden of bewaartermijnen.
+ */
+/** Strategie waarmee een provider persoonsgegevens heeft gewist. */
+export type EraseStrategy = 'deleted' | 'anonymized';
+export interface EraseResult {
+    strategy: EraseStrategy;
+    /** Aantal getroffen records. */
+    affected: number;
+}
+/**
+ * Data-provider-poort (US-1201): een domeinmodule weet hoe het per subject persoonsgegevens
+ * exporteert en wist. Wordt door de consumer geïnjecteerd/geregistreerd.
+ */
+export interface DataProvider {
+    readonly id: string;
+    describe(): string;
+    export(subjectId: string): Promise<unknown>;
+    erase(subjectId: string): Promise<EraseResult>;
+}
+export interface PrivacyAuditEvent {
+    action: string;
+    subjectId: string;
+    complete: boolean;
+    meta?: Record<string, unknown>;
+}
+/** Audit-sink-poort: privacy-kit publiceert hierheen (bv. naar audit-log). */
+export interface AuditSink {
+    record(event: PrivacyAuditEvent): Promise<void>;
+}
+export type ConsentStatus = 'granted' | 'withdrawn';
+export interface ConsentRecord {
+    subjectId: string;
+    purpose: string;
+    status: ConsentStatus;
+    policyVersion?: string;
+    /** ms epoch. */
+    timestamp: number;
+}
+/** Append-only consent-store-poort. */
+export interface ConsentStore {
+    append(record: ConsentRecord): Promise<void>;
+    history(subjectId: string, purpose: string): Promise<ConsentRecord[]>;
+    latest(subjectId: string, purpose: string): Promise<ConsentRecord | null>;
+}
+export type Clock = () => number;
+//# sourceMappingURL=ports.d.ts.map

package/dist/privacy/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/privacy/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,aAAa,CAAC;IACxB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,IAAI,MAAM,CAAC;IACnB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAChD;AAID,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAID,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC"}

package/dist/privacy/core/ports.js

@@ -0,0 +1,6 @@
+/**
+ * Poorten & types voor de privacy-kit. Data-providers, de consent-store en de audit-sink worden
+ * geïnjecteerd; de kit kent geen domeintabellen, PII-velden of bewaartermijnen.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/privacy/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/privacy/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/privacy/core/registry.d.ts

@@ -0,0 +1,17 @@
+import type { DataProvider } from './ports.js';
+export interface ProviderInfo {
+    id: string;
+    description: string;
+}
+export interface ProviderRegistry {
+    register(provider: DataProvider): void;
+    /** Sluit de registry af; verdere registraties falen. */
+    seal(): void;
+    list(): DataProvider[];
+    /** Introspectie: id + beschrijving per provider. */
+    describe(): ProviderInfo[];
+    get(id: string): DataProvider | undefined;
+    readonly size: number;
+}
+export declare function createProviderRegistry(initial?: DataProvider[]): ProviderRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/privacy/core/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/privacy/core/registry.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,wDAAwD;IACxD,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,IAAI,YAAY,EAAE,CAAC;IACvB,oDAAoD;IACpD,QAAQ,IAAI,YAAY,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,YAAY,EAAO,GAAG,gBAAgB,CAwBrF"}

package/dist/privacy/core/registry.js

@@ -0,0 +1,31 @@
+/**
+ * US-1201 — Data-provider-registry. Valideert unieke provider-id's, kan na bootstrap worden afgesloten
+ * (sealed) en biedt introspectie zodat aantoonbaar is welke datastores gedekt zijn. Geen domeinkennis.
+ */
+import { DuplicateProviderError, SealedRegistryError } from './errors.js';
+export function createProviderRegistry(initial = []) {
+    const providers = new Map();
+    let sealed = false;
+    const register = (provider) => {
+        if (sealed)
+            throw new SealedRegistryError();
+        if (providers.has(provider.id))
+            throw new DuplicateProviderError(provider.id);
+        providers.set(provider.id, provider);
+    };
+    for (const provider of initial)
+        register(provider);
+    return {
+        register,
+        seal: () => {
+            sealed = true;
+        },
+        list: () => [...providers.values()],
+        describe: () => [...providers.values()].map((p) => ({ id: p.id, description: p.describe() })),
+        get: (id) => providers.get(id),
+        get size() {
+            return providers.size;
+        },
+    };
+}
+//# sourceMappingURL=registry.js.map

package/dist/privacy/core/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/privacy/core/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAmB1E,MAAM,UAAU,sBAAsB,CAAC,UAA0B,EAAE;IACjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,QAAQ,GAAG,CAAC,QAAsB,EAAQ,EAAE;QAChD,IAAI,MAAM;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9E,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,OAAO;QAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,GAAG,EAAE;YACT,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QACnC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7F,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAI;YACN,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/privacy/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `privacy` kit — domein-loze AVG/GDPR data-subject-rechten: een data-provider-registry (US-1201),
+ * export- (US-1202) en erasure-orkestratie (US-1203) over geregistreerde providers, een append-only
+ * consent-registry (US-1204) en een analytics-opt-out-flag met privacy-by-default (US-1205). Providers,
+ * consent-store en audit-sink worden geïnjecteerd.
+ */
+export { createProviderRegistry, type ProviderRegistry, type ProviderInfo } from './core/registry.js';
+export { exportSubject, type ExportBundle, type ExportManifestEntry, type ExportOptions, } from './core/export.js';
+export { eraseSubject, type ErasureReport, type ErasureReportEntry, type ErasureOptions, } from './core/erasure.js';
+export { createConsentRegistry, analyticsOptOut, type ConsentRegistry, type ConsentOptions, type ConsentStatusResult, type AnalyticsOptOut, } from './core/consent.js';
+export { inMemoryConsentStore } from './adapters/in-memory-consent-store.js';
+export { pgConsentStore, consentMigration, type PgConsentStoreOptions, type SqlExec, } from './adapters/pg-consent-store.js';
+export { auditLogSink, type AuditLogLike } from './adapters/audit-sink.js';
+export type { DataProvider, EraseResult, EraseStrategy, AuditSink, PrivacyAuditEvent, ConsentRecord, ConsentStatus, ConsentStore, } from './core/ports.js';
+export { PrivacyError, DuplicateProviderError, SealedRegistryError } from './core/errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/privacy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/privacy/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGtG,OAAO,EACL,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,OAAO,GACb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG3E,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/privacy/index.js

@@ -0,0 +1,21 @@
+/**
+ * `privacy` kit — domein-loze AVG/GDPR data-subject-rechten: een data-provider-registry (US-1201),
+ * export- (US-1202) en erasure-orkestratie (US-1203) over geregistreerde providers, een append-only
+ * consent-registry (US-1204) en een analytics-opt-out-flag met privacy-by-default (US-1205). Providers,
+ * consent-store en audit-sink worden geïnjecteerd.
+ */
+// Registry (US-1201)
+export { createProviderRegistry } from './core/registry.js';
+// Export-orkestratie (US-1202)
+export { exportSubject, } from './core/export.js';
+// Erasure-orkestratie (US-1203)
+export { eraseSubject, } from './core/erasure.js';
+// Consent + analytics-opt-out (US-1204/US-1205)
+export { createConsentRegistry, analyticsOptOut, } from './core/consent.js';
+// Adapters
+export { inMemoryConsentStore } from './adapters/in-memory-consent-store.js';
+export { pgConsentStore, consentMigration, } from './adapters/pg-consent-store.js';
+export { auditLogSink } from './adapters/audit-sink.js';
+// Fouten
+export { PrivacyError, DuplicateProviderError, SealedRegistryError } from './core/errors.js';
+//# sourceMappingURL=index.js.map

package/dist/privacy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/privacy/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAqB;AACrB,OAAO,EAAE,sBAAsB,EAA4C,MAAM,oBAAoB,CAAC;AAEtG,+BAA+B;AAC/B,OAAO,EACL,aAAa,GAId,MAAM,kBAAkB,CAAC;AAE1B,gCAAgC;AAChC,OAAO,EACL,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAE3B,gDAAgD;AAChD,OAAO,EACL,qBAAqB,EACrB,eAAe,GAKhB,MAAM,mBAAmB,CAAC;AAE3B,WAAW;AACX,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAqB,MAAM,0BAA0B,CAAC;AAc3E,SAAS;AACT,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/rate-limit/adapters/in-memory-store.d.ts

@@ -0,0 +1,7 @@
+/**
+ * US-0603 — In-memory {@link RateLimitStore} (single-instance/dev). Atomair door Node's single-threaded
+ * uitvoering. Geen externe afhankelijkheid. De algoritme-logica is identiek aan de Redis-Lua-varianten.
+ */
+import type { RateLimitStore } from '../core/ports.js';
+export declare function inMemoryRateLimitStore(): RateLimitStore;
+//# sourceMappingURL=in-memory-store.d.ts.map

package/dist/rate-limit/adapters/in-memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.d.ts","sourceRoot":"","sources":["../../../src/rate-limit/adapters/in-memory-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,cAAc,EAAuD,MAAM,kBAAkB,CAAC;AAY5G,wBAAgB,sBAAsB,IAAI,cAAc,CAuDvD"}

package/dist/rate-limit/adapters/in-memory-store.js

@@ -0,0 +1,50 @@
+export function inMemoryRateLimitStore() {
+    const buckets = new Map();
+    const windows = new Map();
+    return {
+        async consumeTokenBucket(key, params) {
+            const { capacity, refillPerMs, cost, nowMs } = params;
+            const state = buckets.get(key) ?? { tokens: capacity, ts: nowMs };
+            const elapsed = Math.max(0, nowMs - state.ts);
+            let tokens = Math.min(capacity, state.tokens + elapsed * refillPerMs);
+            let allowed = false;
+            if (tokens >= cost) {
+                tokens -= cost;
+                allowed = true;
+            }
+            buckets.set(key, { tokens, ts: nowMs });
+            return {
+                allowed,
+                remaining: Math.floor(tokens),
+                resetMs: Math.ceil((capacity - tokens) / refillPerMs),
+                retryAfterMs: allowed ? 0 : Math.ceil((cost - tokens) / refillPerMs),
+            };
+        },
+        async consumeSlidingWindow(key, params) {
+            const { limit, windowMs, cost, nowMs } = params;
+            const nominal = Math.floor(nowMs / windowMs) * windowMs;
+            let state = windows.get(key) ?? { start: nominal, cur: 0, prev: 0 };
+            if (state.start !== nominal) {
+                state = { start: nominal, cur: 0, prev: nominal - state.start === windowMs ? state.cur : 0 };
+            }
+            const elapsed = nowMs - nominal;
+            const weight = (windowMs - elapsed) / windowMs;
+            let weighted = state.prev * weight + state.cur;
+            let allowed = false;
+            if (weighted + cost <= limit) {
+                state.cur += cost;
+                weighted += cost;
+                allowed = true;
+            }
+            windows.set(key, state);
+            const resetMs = Math.ceil(windowMs - elapsed);
+            return {
+                allowed,
+                remaining: Math.max(0, Math.floor(limit - weighted)),
+                resetMs,
+                retryAfterMs: allowed ? 0 : resetMs,
+            };
+        },
+    };
+}
+//# sourceMappingURL=in-memory-store.js.map

package/dist/rate-limit/adapters/in-memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.js","sourceRoot":"","sources":["../../../src/rate-limit/adapters/in-memory-store.ts"],"names":[],"mappings":"AAgBA,MAAM,UAAU,sBAAsB;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,OAAO;QACL,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,MAAyB;YAC7D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC;YAEtE,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,IAAI,CAAC;gBACf,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAExC,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,WAAW,CAAC;gBACrD,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,WAAW,CAAC;aACrE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,MAA2B;YACjE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC;YACxD,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACpE,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAC;YAC/C,IAAI,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC;YAE/C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,QAAQ,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC7B,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC;gBAClB,QAAQ,IAAI,IAAI,CAAC;gBACjB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAExB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;YAC9C,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC;gBACpD,OAAO;gBACP,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;aACpC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/rate-limit/adapters/redis-store.d.ts

@@ -0,0 +1,11 @@
+import type { RateLimitStore } from '../core/ports.js';
+/** Minimale Redis-client-vorm (compatibel met ioredis' `eval`). */
+export interface RedisLike {
+    eval(script: string, numKeys: number, ...args: (string | number)[]): Promise<unknown>;
+}
+export interface RedisRateLimitStoreOptions {
+    /** Prefix voor alle sleutels. Default `rl:`. */
+    keyPrefix?: string;
+}
+export declare function redisRateLimitStore(client: RedisLike, options?: RedisRateLimitStoreOptions): RateLimitStore;
+//# sourceMappingURL=redis-store.d.ts.map

package/dist/rate-limit/adapters/redis-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.d.ts","sourceRoot":"","sources":["../../../src/rate-limit/adapters/redis-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,kBAAkB,CAAC;AAE1B,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AA4DD,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,0BAA+B,GACvC,cAAc,CA+BhB"}

package/dist/rate-limit/adapters/redis-store.js

@@ -0,0 +1,93 @@
+/**
+ * US-0603 — Redis {@link RateLimitStore} (gedistribueerd). Gebruikt Lua-scripts zodat lezen +
+ * bijwerken van de teller atomair over instances gebeurt (geen race/dubbeltelling). Accepteert een
+ * minimale `RedisLike`-client (bv. ioredis) zodat de kit niet hard aan één redis-lib hangt. Bij een
+ * store-fout wordt een geredigeerde {@link StoreUnavailableError} geworpen (geen connectiestring).
+ */
+import { StoreUnavailableError } from '../core/errors.js';
+// Retourneert {allowed, remaining, resetMs, retryAfterMs} — atomair.
+const TOKEN_BUCKET_LUA = `
+local key = KEYS[1]
+local capacity = tonumber(ARGV[1])
+local refill = tonumber(ARGV[2])
+local cost = tonumber(ARGV[3])
+local now = tonumber(ARGV[4])
+local ttl = tonumber(ARGV[5])
+local data = redis.call('HMGET', key, 'tokens', 'ts')
+local tokens = tonumber(data[1])
+local ts = tonumber(data[2])
+if tokens == nil then tokens = capacity; ts = now end
+local elapsed = now - ts
+if elapsed < 0 then elapsed = 0 end
+tokens = math.min(capacity, tokens + elapsed * refill)
+local allowed = 0
+if tokens >= cost then tokens = tokens - cost; allowed = 1 end
+redis.call('HSET', key, 'tokens', tokens, 'ts', now)
+redis.call('PEXPIRE', key, ttl)
+local retry = 0
+if allowed == 0 then retry = math.ceil((cost - tokens) / refill) end
+local reset = math.ceil((capacity - tokens) / refill)
+return { allowed, math.floor(tokens), reset, retry }
+`;
+const SLIDING_WINDOW_LUA = `
+local key = KEYS[1]
+local limit = tonumber(ARGV[1])
+local window = tonumber(ARGV[2])
+local cost = tonumber(ARGV[3])
+local now = tonumber(ARGV[4])
+local ttl = tonumber(ARGV[5])
+local nominal = math.floor(now / window) * window
+local d = redis.call('HMGET', key, 'start', 'cur', 'prev')
+local start = tonumber(d[1])
+local cur = tonumber(d[2])
+local prev = tonumber(d[3])
+if start == nil then start = nominal; cur = 0; prev = 0 end
+if start ~= nominal then
+  if nominal - start == window then prev = cur else prev = 0 end
+  cur = 0
+  start = nominal
+end
+local elapsed = now - nominal
+local weight = (window - elapsed) / window
+local weighted = prev * weight + cur
+local allowed = 0
+if weighted + cost <= limit then cur = cur + cost; weighted = weighted + cost; allowed = 1 end
+redis.call('HSET', key, 'start', start, 'cur', cur, 'prev', prev)
+redis.call('PEXPIRE', key, ttl)
+local remaining = math.floor(limit - weighted)
+if remaining < 0 then remaining = 0 end
+local reset = math.ceil(window - elapsed)
+local retry = 0
+if allowed == 0 then retry = reset end
+return { allowed, remaining, reset, retry }
+`;
+export function redisRateLimitStore(client, options = {}) {
+    const prefix = options.keyPrefix ?? 'rl:';
+    const run = async (script, key, args) => {
+        let raw;
+        try {
+            raw = await client.eval(script, 1, prefix + key, ...args);
+        }
+        catch {
+            throw new StoreUnavailableError();
+        }
+        const arr = raw;
+        return {
+            allowed: Number(arr[0]) === 1,
+            remaining: Number(arr[1]),
+            resetMs: Number(arr[2]),
+            retryAfterMs: Number(arr[3]),
+        };
+    };
+    return {
+        consumeTokenBucket: (key, p) => run(TOKEN_BUCKET_LUA, key, [
+            p.capacity,
+            p.refillPerMs,
+            p.cost,
+            p.nowMs,
+            Math.ceil(p.capacity / p.refillPerMs),
+        ]),
+        consumeSlidingWindow: (key, p) => run(SLIDING_WINDOW_LUA, key, [p.limit, p.windowMs, p.cost, p.nowMs, p.windowMs * 2]),
+    };
+}
+//# sourceMappingURL=redis-store.js.map

package/dist/rate-limit/adapters/redis-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.js","sourceRoot":"","sources":["../../../src/rate-limit/adapters/redis-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAa1D,qEAAqE;AACrE,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBxB,CAAC;AAEF,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+B1B,CAAC;AAOF,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,UAAsC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,MAAM,GAAG,GAAG,KAAK,EAAE,MAAc,EAAE,GAAW,EAAE,IAAc,EAAwB,EAAE;QACtF,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,GAAuC,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACvB,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,CAAC,GAAW,EAAE,CAAoB,EAAE,EAAE,CACxD,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE;YACzB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,KAAK;YACP,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC;SACtC,CAAC;QACJ,oBAAoB,EAAE,CAAC,GAAW,EAAE,CAAsB,EAAE,EAAE,CAC5D,GAAG,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;KACvF,CAAC;AACJ,CAAC"}

package/dist/rate-limit/core/enforcer.d.ts

@@ -0,0 +1,23 @@
+/**
+ * US-0604 — Framework-agnostische enforcement-kern. Evalueert een limiter voor een sleutel en levert
+ * een beslissing + gestandaardiseerde headers (`X-RateLimit-*`, en bij weigering `Retry-After`).
+ * Bij een store-fout volgt het geconfigureerde fail-beleid (fail-open of fail-closed) — nooit
+ * onbepaald gedrag, en zonder secret-/connectie-details te lekken.
+ */
+import type { RateLimitResult, RateLimiter } from './ports.js';
+export interface RateLimitDecision {
+    allowed: boolean;
+    status: number;
+    headers: Record<string, string>;
+    result?: RateLimitResult;
+}
+export interface EnforceOptions {
+    limiter: RateLimiter;
+    /** `open` laat door bij store-fout, `closed` weigert (503). Default `closed`. */
+    failPolicy?: 'open' | 'closed';
+    cost?: number;
+}
+export declare function enforceRateLimit(key: string, options: EnforceOptions): Promise<RateLimitDecision>;
+/** Bouwt de informatieve `X-RateLimit-*`-headers uit een resultaat. */
+export declare function rateLimitHeaders(result: RateLimitResult): Record<string, string>;
+//# sourceMappingURL=enforcer.d.ts.map

package/dist/rate-limit/core/enforcer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer.d.ts","sourceRoot":"","sources":["../../../src/rate-limit/core/enforcer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgBvG;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhF"}