webapp-factory 0.1.0

package/dist/audit/core/errors.js

@@ -0,0 +1,35 @@
+/**
+ * Foutentaxonomie voor audit-log.
+ */
+export class AuditError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Ontbrekend/ongeldig verplicht veld bij append of query (US-1001 AC3, US-1003 AC3). */
+export class AuditValidationError extends AuditError {
+    field;
+    constructor(field, reason) {
+        super(`Ongeldig audit-veld "${field}": ${reason}`, 'AUDIT_VALIDATION');
+        this.field = field;
+    }
+}
+/** Onbekend event-type (niet in de geïnjecteerde registry) (US-1001 AC2). */
+export class UnknownEventTypeError extends AuditError {
+    action;
+    constructor(action) {
+        super(`Onbekend event-type (action): "${action}"`, 'UNKNOWN_EVENT_TYPE');
+        this.action = action;
+    }
+}
+/** Poging tot mutatie van een append-only record (US-1002 AC3). */
+export class ImmutabilityError extends AuditError {
+    constructor() {
+        super('Audit-records zijn append-only; wijzigen/verwijderen is niet toegestaan', 'AUDIT_IMMUTABLE');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/audit/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/audit/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IACzC,KAAK,CAAS;IACvB,YAAY,KAAa,EAAE,MAAc;QACvC,KAAK,CAAC,wBAAwB,KAAK,MAAM,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CAAC,kCAAkC,MAAM,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C;QACE,KAAK,CAAC,yEAAyE,EAAE,iBAAiB,CAAC,CAAC;IACtG,CAAC;CACF"}

package/dist/audit/core/hash.d.ts

@@ -0,0 +1,9 @@
+import type { ComputeHash, Hasher } from './ports.js';
+/** prevHash van het eerste record (genesis). */
+export declare const GENESIS = "";
+export declare function sha256Hasher(): Hasher;
+/** Canonieke JSON met recursief gesorteerde object-keys (stabiele serialisatie). */
+export declare function canonicalJson(value: unknown): string;
+/** Bouwt een {@link ComputeHash} uit een {@link Hasher}. */
+export declare function makeComputeHash(hasher: Hasher): ComputeHash;
+//# sourceMappingURL=hash.d.ts.map

package/dist/audit/core/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../src/audit/core/hash.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEvE,gDAAgD;AAChD,eAAO,MAAM,OAAO,KAAK,CAAC;AAE1B,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAcD,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAa3D"}

package/dist/audit/core/hash.js

@@ -0,0 +1,45 @@
+/**
+ * US-1002 — Hash-keten: elk record hasht zijn eigen inhoud plus de hash van het vorige record.
+ * Serialisatie is canoniek (gesorteerde keys) zodat de hash stabiel en reproduceerbaar is.
+ */
+import { createHash } from 'node:crypto';
+/** prevHash van het eerste record (genesis). */
+export const GENESIS = '';
+export function sha256Hasher() {
+    return {
+        algorithm: 'sha256',
+        hash: (data) => createHash('sha256').update(data).digest('hex'),
+    };
+}
+/** Canonieke JSON met recursief gesorteerde object-keys (stabiele serialisatie). */
+export function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            out[key] = sortKeys(value[key]);
+        }
+        return out;
+    }
+    return value;
+}
+/** Bouwt een {@link ComputeHash} uit een {@link Hasher}. */
+export function makeComputeHash(hasher) {
+    return (sequence, prevHash, input) => {
+        const payload = [
+            String(sequence),
+            input.actor,
+            input.action,
+            input.target,
+            String(input.timestamp),
+            canonicalJson(input.meta),
+            prevHash,
+        ].join('\n');
+        return hasher.hash(payload);
+    };
+}
+//# sourceMappingURL=hash.js.map

package/dist/audit/core/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../../src/audit/core/hash.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,gDAAgD;AAChD,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,CAAC,QAAgB,EAAE,QAAgB,EAAE,KAAsB,EAAU,EAAE;QAC5E,MAAM,OAAO,GAAG;YACd,MAAM,CAAC,QAAQ,CAAC;YAChB,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,MAAM;YACZ,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YACvB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YACzB,QAAQ;SACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC"}

package/dist/audit/core/ports.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Poorten & types voor de audit-log-kit. Event-types, de store (repository), de klok en het
+ * hash-algoritme worden geïnjecteerd; de kit bevat geen domeinkennis.
+ */
+export type Clock = () => number;
+/** Eén onveranderlijk audit-record in de hash-keten. */
+export interface AuditRecord {
+    /** Monotone, unieke volgnummer. */
+    sequence: number;
+    actor: string;
+    action: string;
+    target: string;
+    /** Server-timestamp (ms epoch) via de Clock-port. */
+    timestamp: number;
+    meta: Record<string, unknown>;
+    /** Hash van het vorige record (leeg voor het eerste). */
+    prevHash: string;
+    /** Hash over de eigen inhoud + prevHash. */
+    hash: string;
+}
+/** Invoer voor één append (server vult sequence/timestamp/hash in). */
+export interface AuditEventInput {
+    actor: string;
+    action: string;
+    target: string;
+    timestamp: number;
+    meta: Record<string, unknown>;
+}
+/** Berekent de record-hash uit (sequence, prevHash, input). Puur; door de kit aangeleverd. */
+export type ComputeHash = (sequence: number, prevHash: string, input: AuditEventInput) => string;
+export interface QueryFilter {
+    actor?: string;
+    action?: string;
+    target?: string;
+    /** Tijdsbereik (ms epoch), inclusief. */
+    fromMs?: number;
+    toMs?: number;
+}
+export interface QueryPagination {
+    /** Sequence waarna wordt doorgepagineerd (exclusief). */
+    cursor?: number;
+    pageSize: number;
+}
+export interface QueryResult {
+    items: AuditRecord[];
+    /** Sequence voor de volgende pagina, of `null` als er geen is. */
+    nextCursor: number | null;
+}
+/**
+ * Append-only store-poort. Bevat bewust géén update/delete van losse records (immutability); alleen
+ * `purgeOlderThan` voor gecontroleerde retentie. `append` assembleert de keten atomair.
+ */
+export interface AuditStore {
+    /** Atomair: bepaal sequence + prevHash, bereken de hash en voeg het record toe. */
+    append(input: AuditEventInput, computeHash: ComputeHash): Promise<AuditRecord>;
+    query(filter: QueryFilter, pagination: QueryPagination): Promise<QueryResult>;
+    /** Alle records oplopend op sequence (voor verificatie/export). */
+    all(): Promise<AuditRecord[]>;
+    /** Retentie: verwijder records met timestamp < cutoff. Retourneert de afgevoerde records. */
+    purgeOlderThan(cutoffMs: number): Promise<AuditRecord[]>;
+    count(): Promise<number>;
+}
+/** Injecteerbaar hash-algoritme (default sha256). */
+export interface Hasher {
+    algorithm: string;
+    hash(data: string): string;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/audit/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/audit/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;AAEjC,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC;AAEjG,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9E,mEAAmE;IACnE,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9B,6FAA6F;IAC7F,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED,qDAAqD;AACrD,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B"}

package/dist/audit/core/ports.js

@@ -0,0 +1,6 @@
+/**
+ * Poorten & types voor de audit-log-kit. Event-types, de store (repository), de klok en het
+ * hash-algoritme worden geïnjecteerd; de kit bevat geen domeinkennis.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/audit/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/audit/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/audit/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `audit-log` kit — domein-loos, onveranderlijk logboek: append-only events (actor/action/target/meta)
+ * met een hash-keten (tamper-evidence), read-only gefilterde/gepagineerde query, en retentie +
+ * geverifieerde NDJSON-export. Pluggable store (in-memory + Postgres append-only); event-types worden
+ * geïnjecteerd.
+ */
+export { createAuditLog, type AuditLog, type AuditLogOptions, type AppendInput, type VerifyResult, type ExportResult, type ExportSummary, } from './core/audit-log.js';
+export { sha256Hasher, canonicalJson, makeComputeHash, GENESIS } from './core/hash.js';
+export type { Clock, AuditRecord, AuditEventInput, AuditStore, QueryFilter, QueryPagination, QueryResult, Hasher, ComputeHash, } from './core/ports.js';
+export { AuditError, AuditValidationError, UnknownEventTypeError, ImmutabilityError, } from './core/errors.js';
+export { inMemoryAuditStore } from './adapters/in-memory-store.js';
+export { pgAuditStore, auditMigration, type SqlExecutor, type SqlExec, type PgAuditStoreOptions, } from './adapters/pg-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGvF,YAAY,EACV,KAAK,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,WAAW,EACX,eAAe,EACf,WAAW,EACX,MAAM,EACN,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,16 @@
+/**
+ * `audit-log` kit — domein-loos, onveranderlijk logboek: append-only events (actor/action/target/meta)
+ * met een hash-keten (tamper-evidence), read-only gefilterde/gepagineerde query, en retentie +
+ * geverifieerde NDJSON-export. Pluggable store (in-memory + Postgres append-only); event-types worden
+ * geïnjecteerd.
+ */
+// Service (US-1001..1004)
+export { createAuditLog, } from './core/audit-log.js';
+// Hash-keten
+export { sha256Hasher, canonicalJson, makeComputeHash, GENESIS } from './core/hash.js';
+// Fouten
+export { AuditError, AuditValidationError, UnknownEventTypeError, ImmutabilityError, } from './core/errors.js';
+// Adapters
+export { inMemoryAuditStore } from './adapters/in-memory-store.js';
+export { pgAuditStore, auditMigration, } from './adapters/pg-store.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,0BAA0B;AAC1B,OAAO,EACL,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAevF,SAAS;AACT,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,WAAW;AACX,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,cAAc,GAIf,MAAM,wBAAwB,CAAC"}

package/dist/auth/adapters/argon2id-hasher.d.ts

@@ -0,0 +1,15 @@
+import type { PasswordHasher } from '../core/ports.js';
+export interface Argon2idParams {
+    /** Geheugengrootte in KiB. Default 19456 (19 MiB, OWASP-richtlijn). */
+    memoryKiB?: number;
+    /** Iteraties (time cost). Default 2. */
+    iterations?: number;
+    /** Parallelisme (lanes). Default 1. */
+    parallelism?: number;
+    /** Lengte van de afgeleide hash in bytes. Default 32. */
+    hashLength?: number;
+    /** Saltlengte in bytes. Default 16. */
+    saltLength?: number;
+}
+export declare function argon2idHasher(params?: Argon2idParams): PasswordHasher;
+//# sourceMappingURL=argon2id-hasher.d.ts.map

package/dist/auth/adapters/argon2id-hasher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2id-hasher.d.ts","sourceRoot":"","sources":["../../../src/auth/adapters/argon2id-hasher.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAiBD,wBAAgB,cAAc,CAAC,MAAM,GAAE,cAAmB,GAAG,cAAc,CA6B1E"}

package/dist/auth/adapters/argon2id-hasher.js

@@ -0,0 +1,61 @@
+/**
+ * US-0401 — argon2id-{@link PasswordHasher} bovenop `hash-wasm` (pure WASM, geen native build).
+ * Produceert een zelfbeschrijvende PHC-hashstring en berekent de rehash-policy door de parameters in
+ * de opgeslagen hash te vergelijken met de huidige config. `hash-wasm` wordt lazy geladen, zodat de
+ * kit importeerbaar blijft zonder die dep tot je daadwerkelijk hasht.
+ */
+import { randomBytes } from 'node:crypto';
+import { UnsupportedHashError } from '../core/errors.js';
+const DEFAULTS = {
+    memoryKiB: 19456,
+    iterations: 2,
+    parallelism: 1,
+    hashLength: 32,
+    saltLength: 16,
+};
+export function argon2idHasher(params = {}) {
+    const cfg = { ...DEFAULTS, ...params };
+    return {
+        async hash(password) {
+            const { argon2id } = await import('hash-wasm');
+            return argon2id({
+                password,
+                salt: randomBytes(cfg.saltLength),
+                parallelism: cfg.parallelism,
+                iterations: cfg.iterations,
+                memorySize: cfg.memoryKiB,
+                hashLength: cfg.hashLength,
+                outputType: 'encoded',
+            });
+        },
+        async verify(password, hash) {
+            const parsed = parsePhc(hash);
+            if (!parsed || parsed.algo !== 'argon2id') {
+                // Onbekend/niet-ondersteund formaat: expliciete, niet-lekkende fout (US-0401 AC3).
+                throw new UnsupportedHashError();
+            }
+            const { argon2Verify } = await import('hash-wasm');
+            const valid = await argon2Verify({ password, hash });
+            const needsRehash = valid && isWeaker(parsed, cfg);
+            return { valid, needsRehash };
+        },
+    };
+}
+function parsePhc(hash) {
+    // $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>
+    const m = /^\$(argon2(?:id|i|d))\$v=\d+\$m=(\d+),t=(\d+),p=(\d+)\$/.exec(hash);
+    if (!m)
+        return null;
+    return {
+        algo: m[1],
+        memoryKiB: Number(m[2]),
+        iterations: Number(m[3]),
+        parallelism: Number(m[4]),
+    };
+}
+function isWeaker(parsed, cfg) {
+    return (parsed.memoryKiB < cfg.memoryKiB ||
+        parsed.iterations < cfg.iterations ||
+        parsed.parallelism < cfg.parallelism);
+}
+//# sourceMappingURL=argon2id-hasher.js.map

package/dist/auth/adapters/argon2id-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2id-hasher.js","sourceRoot":"","sources":["../../../src/auth/adapters/argon2id-hasher.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAgBzD,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;CACf,CAAC;AASF,MAAM,UAAU,cAAc,CAAC,SAAyB,EAAE;IACxD,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;IAEvC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,QAAgB;YACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/C,OAAO,QAAQ,CAAC;gBACd,QAAQ;gBACR,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;gBACjC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,GAAG,CAAC,SAAS;gBACzB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;YACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC1C,mFAAmF;gBACnF,MAAM,IAAI,oBAAoB,EAAE,CAAC;YACnC,CAAC;YACD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,+CAA+C;IAC/C,MAAM,CAAC,GAAG,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,CAAC,CAAW;QACpB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAiB,EAAE,GAAoB;IACvD,OAAO,CACL,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS;QAChC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU;QAClC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CACrC,CAAC;AACJ,CAAC"}

package/dist/auth/adapters/in-memory-stores.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Dep-vrije referentie-adapters (US-0404): in-memory implementaties van de token-, single-use-,
+ * `UserStore`- en `Mailer`-ports. Bedoeld voor tests en lokale ontwikkeling; productie-adapters
+ * (bv. bovenop persistence-kit / mailer-kit) levert het consumerende project.
+ */
+import type { MailMessage, Mailer, SingleUseStore, TokenStore, UserRecord, UserStore } from '../core/ports.js';
+export declare function inMemoryTokenStore(): TokenStore;
+export declare function inMemorySingleUseStore(): SingleUseStore;
+export declare function inMemoryUserStore(seed?: UserRecord[]): UserStore;
+/** In-memory mailer die verzonden berichten vasthoudt voor asserties. */
+export declare function inMemoryMailer(): Mailer & {
+    readonly sent: MailMessage[];
+};
+//# sourceMappingURL=in-memory-stores.d.ts.map

package/dist/auth/adapters/in-memory-stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-stores.d.ts","sourceRoot":"","sources":["../../../src/auth/adapters/in-memory-stores.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,WAAW,EACX,MAAM,EAGN,cAAc,EACd,UAAU,EACV,UAAU,EACV,SAAS,EACV,MAAM,kBAAkB,CAAC;AAE1B,wBAAgB,kBAAkB,IAAI,UAAU,CAwB/C;AAED,wBAAgB,sBAAsB,IAAI,cAAc,CAiBvD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,UAAU,EAAO,GAAG,SAAS,CAmBpE;AAED,yEAAyE;AACzE,wBAAgB,cAAc,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,CAAA;CAAE,CAQ1E"}

package/dist/auth/adapters/in-memory-stores.js

@@ -0,0 +1,78 @@
+export function inMemoryTokenStore() {
+    const refresh = new Map();
+    const denied = new Set();
+    return {
+        async saveRefresh(record) {
+            refresh.set(record.id, { ...record });
+        },
+        async findRefresh(id) {
+            const record = refresh.get(id);
+            return record ? { ...record } : null;
+        },
+        async markRefreshUsed(id) {
+            const record = refresh.get(id);
+            if (!record || record.usedAt !== undefined)
+                return false;
+            record.usedAt = Date.now();
+            return true;
+        },
+        async denyAccess(jti) {
+            denied.add(jti);
+        },
+        async isAccessDenied(jti) {
+            return denied.has(jti);
+        },
+    };
+}
+export function inMemorySingleUseStore() {
+    const store = new Map();
+    return {
+        async save(record) {
+            store.set(record.id, { ...record });
+        },
+        async find(id) {
+            const record = store.get(id);
+            return record ? { ...record } : null;
+        },
+        async markConsumed(id) {
+            const record = store.get(id);
+            if (!record || record.consumedAt !== undefined)
+                return false;
+            record.consumedAt = Date.now();
+            return true;
+        },
+    };
+}
+export function inMemoryUserStore(seed = []) {
+    const byId = new Map();
+    for (const user of seed)
+        byId.set(user.id, { ...user });
+    return {
+        async findByIdentifier(identifier) {
+            for (const user of byId.values()) {
+                if (user.identifier === identifier)
+                    return { ...user };
+            }
+            return null;
+        },
+        async findById(id) {
+            const user = byId.get(id);
+            return user ? { ...user } : null;
+        },
+        async save(user) {
+            byId.set(user.id, { ...user });
+            return { ...user };
+        },
+    };
+}
+/** In-memory mailer die verzonden berichten vasthoudt voor asserties. */
+export function inMemoryMailer() {
+    const sent = [];
+    return {
+        sent,
+        async send(message) {
+            sent.push(message);
+        },
+    };
+}
+//# sourceMappingURL=in-memory-stores.js.map

package/dist/auth/adapters/in-memory-stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-stores.js","sourceRoot":"","sources":["../../../src/auth/adapters/in-memory-stores.ts"],"names":[],"mappings":"AAgBA,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,EAAE;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAG;YAClB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,GAAG;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE;YACX,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,EAAE;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC7D,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAE;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,UAAU;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;oBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC/B,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/core/auth-service.d.ts

@@ -0,0 +1,40 @@
+import type { CredentialService } from './credentials.js';
+import type { SingleUseTokenService } from './single-use.js';
+import type { TokenService } from './tokens.js';
+import type { IssuedTokens, Mailer, UserStore } from './ports.js';
+export interface AuthPurposes {
+    emailVerify: string;
+    passwordReset: string;
+    invite: string;
+}
+export interface AuthServiceDeps {
+    credentials: CredentialService;
+    tokens: TokenService;
+    singleUse: SingleUseTokenService;
+    userStore: UserStore;
+    mailer: Mailer;
+    purposes?: Partial<AuthPurposes>;
+}
+/** Gebruiker zonder credential-materiaal (veilig om terug te geven/loggen). */
+export interface PublicUser {
+    id: string;
+    identifier: string;
+    verified?: boolean;
+    [key: string]: unknown;
+}
+export declare class AuthService {
+    #private;
+    constructor(deps: AuthServiceDeps);
+    register(identifier: string, password: string): Promise<{
+        user: PublicUser;
+        verifyToken: string;
+    }>;
+    verifyEmail(token: string): Promise<PublicUser>;
+    login(identifier: string, password: string): Promise<IssuedTokens>;
+    /** Start een wachtwoord-reset. Retourneert het token als de gebruiker bestaat, anders `null` (geen enumeration). */
+    requestPasswordReset(identifier: string): Promise<string | null>;
+    resetPassword(token: string, newPassword: string): Promise<void>;
+}
+/** Valideert de ports fail-fast en levert een {@link AuthService} (US-0404 AC3). */
+export declare function createAuthService(deps: AuthServiceDeps): AuthService;
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/auth/core/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../../src/auth/core/auth-service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAc,SAAS,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,qBAAqB,CAAC;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAClC;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAQD,qBAAa,WAAW;;gBAIV,IAAI,EAAE,eAAe;IAK3B,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBlG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAU/C,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcxE,oHAAoH;IAC9G,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAYhE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASvE;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAOpE"}

package/dist/auth/core/auth-service.js

@@ -0,0 +1,106 @@
+/**
+ * US-0404 — Integratie: een domein-loze `AuthService` die de credential-, token- en single-use-
+ * services samenbindt met de geïnjecteerde `UserStore`- en `Mailer`-ports. Bij initialisatie worden
+ * de ports fail-fast gevalideerd (geredigeerd, geen PII/secrets). De kit kent geen concrete database
+ * of mailprovider — alleen de port-contracten.
+ */
+import { AuthConfigurationError, AuthError, InvalidCredentialsError, SingleUseTokenError } from './errors.js';
+import { newId } from './crypto-util.js';
+const DEFAULT_PURPOSES = {
+    emailVerify: 'email-verify',
+    passwordReset: 'password-reset',
+    invite: 'invite',
+};
+export class AuthService {
+    #d;
+    #purposes;
+    constructor(deps) {
+        this.#d = deps;
+        this.#purposes = { ...DEFAULT_PURPOSES, ...deps.purposes };
+    }
+    async register(identifier, password) {
+        const existing = await this.#d.userStore.findByIdentifier(identifier);
+        if (existing)
+            throw new AuthError('Identifier is al in gebruik', 'IDENTIFIER_TAKEN');
+        const passwordHash = await this.#d.credentials.hash(password);
+        const user = await this.#d.userStore.save({
+            id: newId(),
+            identifier,
+            passwordHash,
+            verified: false,
+        });
+        const verifyToken = await this.#d.singleUse.issue(this.#purposes.emailVerify, { userId: user.id });
+        await this.#d.mailer.send({
+            to: identifier,
+            subject: 'Bevestig je account',
+            data: { token: verifyToken, purpose: this.#purposes.emailVerify },
+        });
+        return { user: toPublic(user), verifyToken };
+    }
+    async verifyEmail(token) {
+        const payload = (await this.#d.singleUse.consume(token, this.#purposes.emailVerify));
+        const user = await this.#d.userStore.findById(payload.userId);
+        if (!user)
+            throw new SingleUseTokenError('invalid');
+        const saved = await this.#d.userStore.save({ ...user, verified: true });
+        return toPublic(saved);
+    }
+    async login(identifier, password) {
+        const user = await this.#d.userStore.findByIdentifier(identifier);
+        if (!user || !user.passwordHash)
+            throw new InvalidCredentialsError();
+        const { valid, needsRehash } = await this.#d.credentials.verify(password, user.passwordHash);
+        if (!valid)
+            throw new InvalidCredentialsError();
+        if (needsRehash) {
+            const passwordHash = await this.#d.credentials.hash(password);
+            await this.#d.userStore.save({ ...user, passwordHash });
+        }
+        return this.#d.tokens.issue(user.id, { identifier: user.identifier });
+    }
+    /** Start een wachtwoord-reset. Retourneert het token als de gebruiker bestaat, anders `null` (geen enumeration). */
+    async requestPasswordReset(identifier) {
+        const user = await this.#d.userStore.findByIdentifier(identifier);
+        if (!user)
+            return null;
+        const token = await this.#d.singleUse.issue(this.#purposes.passwordReset, { userId: user.id });
+        await this.#d.mailer.send({
+            to: identifier,
+            subject: 'Reset je wachtwoord',
+            data: { token, purpose: this.#purposes.passwordReset },
+        });
+        return token;
+    }
+    async resetPassword(token, newPassword) {
+        const payload = (await this.#d.singleUse.consume(token, this.#purposes.passwordReset));
+        const user = await this.#d.userStore.findById(payload.userId);
+        if (!user)
+            throw new SingleUseTokenError('invalid');
+        const passwordHash = await this.#d.credentials.hash(newPassword);
+        await this.#d.userStore.save({ ...user, passwordHash });
+    }
+}
+/** Valideert de ports fail-fast en levert een {@link AuthService} (US-0404 AC3). */
+export function createAuthService(deps) {
+    requirePort('UserStore', deps.userStore, ['findByIdentifier', 'findById', 'save']);
+    requirePort('Mailer', deps.mailer, ['send']);
+    requirePort('TokenService', deps.tokens, ['issue', 'verify', 'refresh']);
+    requirePort('CredentialService', deps.credentials, ['hash', 'verify']);
+    requirePort('SingleUseTokenService', deps.singleUse, ['issue', 'consume']);
+    return new AuthService(deps);
+}
+function requirePort(name, port, methods) {
+    if (port === null || typeof port !== 'object') {
+        throw new AuthConfigurationError(name, 'ontbreekt of is geen object');
+    }
+    for (const method of methods) {
+        if (typeof port[method] !== 'function') {
+            throw new AuthConfigurationError(name, `implementeert methode "${method}" niet`);
+        }
+    }
+}
+function toPublic(user) {
+    const { passwordHash: _omit, ...rest } = user;
+    return rest;
+}
+//# sourceMappingURL=auth-service.js.map

package/dist/auth/core/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../../src/auth/core/auth-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9G,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AA6BzC,MAAM,gBAAgB,GAAiB;IACrC,WAAW,EAAE,cAAc;IAC3B,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,MAAM,OAAO,WAAW;IACb,EAAE,CAAkB;IACpB,SAAS,CAAe;IAEjC,YAAY,IAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAgB;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,kBAAkB,CAAC,CAAC;QAErF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;YACxC,EAAE,EAAE,KAAK,EAAE;YACX,UAAU;YACV,YAAY;YACZ,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,UAAU;YACd,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;SAClE,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAElF,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,QAAgB;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAErE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAEhD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,oHAAoH;IACpH,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,UAAU;YACd,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE;SACvD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,WAAmB;QACpD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAEpF,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,WAAW,CAAC,mBAAmB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAa,EAAE,OAAiB;IACjE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,sBAAsB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAQ,IAAgC,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YACpE,MAAM,IAAI,sBAAsB,CAAC,IAAI,EAAE,0BAA0B,MAAM,QAAQ,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB;IAChC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/core/credentials.d.ts

@@ -0,0 +1,15 @@
+/**
+ * US-0401 — Credential-service. Dunne, domein-loze wrapper rond een {@link PasswordHasher}-poort:
+ * hasht en verifieert wachtwoorden en signaleert of een hash verouderd is (rehash-policy). De
+ * concrete kostenparameters zitten in de geïnjecteerde hasher (bv. de argon2id-adapter).
+ */
+import type { PasswordHasher, VerifyResult } from './ports.js';
+export declare class CredentialService {
+    #private;
+    constructor(hasher: PasswordHasher);
+    /** Hash een wachtwoord tot een zelfbeschrijvende hash-string. */
+    hash(password: string): Promise<string>;
+    /** Verifieer een wachtwoord; retourneert `{ valid, needsRehash }`. */
+    verify(password: string, hash: string): Promise<VerifyResult>;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/auth/core/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/auth/core/credentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/D,qBAAa,iBAAiB;;gBAGhB,MAAM,EAAE,cAAc;IAIlC,iEAAiE;IACjE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIvC,sEAAsE;IACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAG9D"}

package/dist/auth/core/credentials.js

@@ -0,0 +1,15 @@
+export class CredentialService {
+    #hasher;
+    constructor(hasher) {
+        this.#hasher = hasher;
+    }
+    /** Hash een wachtwoord tot een zelfbeschrijvende hash-string. */
+    hash(password) {
+        return this.#hasher.hash(password);
+    }
+    /** Verifieer een wachtwoord; retourneert `{ valid, needsRehash }`. */
+    verify(password, hash) {
+        return this.#hasher.verify(password, hash);
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/auth/core/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/auth/core/credentials.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,iBAAiB;IACnB,OAAO,CAAiB;IAEjC,YAAY,MAAsB;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,iEAAiE;IACjE,IAAI,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,QAAgB,EAAE,IAAY;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/auth/core/crypto-util.d.ts

@@ -0,0 +1,7 @@
+/** Cryptografisch random, url-safe token (32 bytes). */
+export declare function randomToken(): string;
+/** SHA-256-hash (hex) van een token, zodat het klare token nooit persistent is. */
+export declare function hashToken(token: string): string;
+/** Random id (UUID v4). */
+export declare function newId(): string;
+//# sourceMappingURL=crypto-util.d.ts.map