webapp-factory 0.1.0

package/dist/auth/core/crypto-util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-util.d.ts","sourceRoot":"","sources":["../../../src/auth/core/crypto-util.ts"],"names":[],"mappings":"AAGA,wDAAwD;AACxD,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,2BAA2B;AAC3B,wBAAgB,KAAK,IAAI,MAAM,CAE9B"}

package/dist/auth/core/crypto-util.js

@@ -0,0 +1,15 @@
+/** Gedeelde crypto-helpers: onraadbare tokens en hashing van tokens voor opslag. */
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+/** Cryptografisch random, url-safe token (32 bytes). */
+export function randomToken() {
+    return randomBytes(32).toString('base64url');
+}
+/** SHA-256-hash (hex) van een token, zodat het klare token nooit persistent is. */
+export function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+/** Random id (UUID v4). */
+export function newId() {
+    return randomUUID();
+}
+//# sourceMappingURL=crypto-util.js.map

package/dist/auth/core/crypto-util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-util.js","sourceRoot":"","sources":["../../../src/auth/core/crypto-util.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,wDAAwD;AACxD,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,KAAK;IACnB,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/auth/core/errors.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Foutentaxonomie voor de auth-kit. Fouten lekken nooit wachtwoord-, hash-, key- of PII-materiaal
+ * en vermijden user-enumeration (dezelfde generieke fout voor "onbekend" en "ongeldig").
+ */
+export declare class AuthError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** Generieke, niet-lekkende credential-fout (geen onderscheid onbekend/verkeerd wachtwoord). */
+export declare class InvalidCredentialsError extends AuthError {
+    constructor();
+}
+/** Hash-string met een onbekend/niet-ondersteund algoritme (US-0401 AC3). */
+export declare class UnsupportedHashError extends AuthError {
+    constructor();
+}
+export type TokenErrorReason = 'invalid' | 'expired' | 'revoked' | 'reuse';
+/** Token-verificatie/‑refresh mislukt; benoemt de reden zonder key/claim-materiaal. */
+export declare class TokenError extends AuthError {
+    readonly reason: TokenErrorReason;
+    constructor(reason: TokenErrorReason);
+}
+export type SingleUseReason = 'invalid' | 'expired' | 'consumed';
+/** Single-use-token inwisseling mislukt; `invalid` onthult niets (geen enumeration). */
+export declare class SingleUseTokenError extends AuthError {
+    readonly reason: SingleUseReason;
+    constructor(reason: SingleUseReason);
+}
+/** Fail-fast bij een ontbrekende/contract-schendende geïnjecteerde port (US-0404 AC3). */
+export declare class AuthConfigurationError extends AuthError {
+    constructor(portName: string, reason: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/auth/core/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM1C;AAED,gGAAgG;AAChG,qBAAa,uBAAwB,SAAQ,SAAS;;CAIrD;AAED,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,SAAS;;CAIlD;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,uFAAuF;AACvF,qBAAa,UAAW,SAAQ,SAAS;IACvC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;gBACtB,MAAM,EAAE,gBAAgB;CAIrC;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAEjE,wFAAwF;AACxF,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBACrB,MAAM,EAAE,eAAe;CAIpC;AAED,0FAA0F;AAC1F,qBAAa,sBAAuB,SAAQ,SAAS;gBACvC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAG7C"}

package/dist/auth/core/errors.js

@@ -0,0 +1,48 @@
+/**
+ * Foutentaxonomie voor de auth-kit. Fouten lekken nooit wachtwoord-, hash-, key- of PII-materiaal
+ * en vermijden user-enumeration (dezelfde generieke fout voor "onbekend" en "ongeldig").
+ */
+export class AuthError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Generieke, niet-lekkende credential-fout (geen onderscheid onbekend/verkeerd wachtwoord). */
+export class InvalidCredentialsError extends AuthError {
+    constructor() {
+        super('Ongeldige inloggegevens', 'INVALID_CREDENTIALS');
+    }
+}
+/** Hash-string met een onbekend/niet-ondersteund algoritme (US-0401 AC3). */
+export class UnsupportedHashError extends AuthError {
+    constructor() {
+        super('Niet-ondersteund hash-formaat', 'UNSUPPORTED_HASH');
+    }
+}
+/** Token-verificatie/‑refresh mislukt; benoemt de reden zonder key/claim-materiaal. */
+export class TokenError extends AuthError {
+    reason;
+    constructor(reason) {
+        super(`Token ${reason}`, `TOKEN_${reason.toUpperCase()}`);
+        this.reason = reason;
+    }
+}
+/** Single-use-token inwisseling mislukt; `invalid` onthult niets (geen enumeration). */
+export class SingleUseTokenError extends AuthError {
+    reason;
+    constructor(reason) {
+        super(`Single-use token ${reason}`, `SINGLE_USE_${reason.toUpperCase()}`);
+        this.reason = reason;
+    }
+}
+/** Fail-fast bij een ontbrekende/contract-schendende geïnjecteerde port (US-0404 AC3). */
+export class AuthConfigurationError extends AuthError {
+    constructor(portName, reason) {
+        super(`Auth-configuratie ongeldig: port "${portName}" ${reason}`, 'AUTH_CONFIGURATION');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/auth/core/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD;QACE,KAAK,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjD;QACE,KAAK,CAAC,+BAA+B,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;CACF;AAID,uFAAuF;AACvF,MAAM,OAAO,UAAW,SAAQ,SAAS;IAC9B,MAAM,CAAmB;IAClC,YAAY,MAAwB;QAClC,KAAK,CAAC,SAAS,MAAM,EAAE,EAAE,SAAS,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAID,wFAAwF;AACxF,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACvC,MAAM,CAAkB;IACjC,YAAY,MAAuB;QACjC,KAAK,CAAC,oBAAoB,MAAM,EAAE,EAAE,cAAc,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,0FAA0F;AAC1F,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IACnD,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CAAC,qCAAqC,QAAQ,KAAK,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC1F,CAAC;CACF"}

package/dist/auth/core/jwt.d.ts

@@ -0,0 +1,5 @@
+/** Onderteken een payload als HS256-JWT. */
+export declare function signJwt(payload: Record<string, unknown>, secret: string): string;
+/** Verifieer de handtekening en retourneer de payload. Gooit `TokenError('invalid')` bij een fout. */
+export declare function verifyJwt(token: string, secret: string): Record<string, unknown>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/auth/core/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/core/jwt.ts"],"names":[],"mappings":"AAWA,4CAA4C;AAC5C,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMhF;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBhF"}

package/dist/auth/core/jwt.js

@@ -0,0 +1,40 @@
+/**
+ * Minimale HS256-JWT (self-contained, ondertekend) op basis van Node-crypto — geen externe dep. Doet
+ * uitsluitend signing + signature-verificatie; TTL/revocatie zit in de token-service.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { TokenError } from './errors.js';
+function b64url(input) {
+    return Buffer.from(input, 'utf8').toString('base64url');
+}
+/** Onderteken een payload als HS256-JWT. */
+export function signJwt(payload, secret) {
+    const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+    const body = b64url(JSON.stringify(payload));
+    const data = `${header}.${body}`;
+    const signature = createHmac('sha256', secret).update(data).digest('base64url');
+    return `${data}.${signature}`;
+}
+/** Verifieer de handtekening en retourneer de payload. Gooit `TokenError('invalid')` bij een fout. */
+export function verifyJwt(token, secret) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        throw new TokenError('invalid');
+    const [header, body, signature] = parts;
+    const data = `${header}.${body}`;
+    const expected = createHmac('sha256', secret).update(data).digest();
+    const actual = Buffer.from(signature, 'base64url');
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+        throw new TokenError('invalid');
+    }
+    try {
+        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+        if (typeof parsed !== 'object' || parsed === null)
+            throw new Error('geen object');
+        return parsed;
+    }
+    catch {
+        throw new TokenError('invalid');
+    }
+}
+//# sourceMappingURL=jwt.js.map

package/dist/auth/core/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/core/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,OAAO,CAAC,OAAgC,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,KAAiC,CAAC;IACpE,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAClF,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/auth/core/ports.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Poorten & types voor de auth-kit. Het consumerende project injecteert de hashing-engine, token-
+ * en single-use-stores, en de `UserStore`/`Mailer`-ports. De kit bevat geen gebruikers- of
+ * domeinkennis.
+ */
+/** Injecteerbare klok (ms sinds epoch); default `Date.now`. Maakt TTL-gedrag deterministisch testbaar. */
+export type Clock = () => number;
+export interface VerifyResult {
+    valid: boolean;
+    /** True als de hash met zwakkere parameters is gemaakt dan de huidige config. */
+    needsRehash: boolean;
+}
+export interface PasswordHasher {
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<VerifyResult>;
+}
+export interface TokenConfig {
+    /** Signing-key (bij voorkeur als secret via config-kit geladen). */
+    secret: string;
+    accessTtlSeconds: number;
+    refreshTtlSeconds: number;
+    issuer?: string;
+}
+export interface RefreshRecord {
+    /** Hash van het klare refresh-token. */
+    id: string;
+    subject: string;
+    /** ms sinds epoch. */
+    expiresAt: number;
+    /** ms sinds epoch waarop dit token is ingewisseld (rotatie/hergebruik-detectie). */
+    usedAt?: number;
+}
+/** Opslag voor refresh-token-rotatie en access-token-revocatie. */
+export interface TokenStore {
+    saveRefresh(record: RefreshRecord): Promise<void>;
+    findRefresh(id: string): Promise<RefreshRecord | null>;
+    /** Markeer een refresh-token als ingewisseld; retourneer `false` als het al gebruikt is. */
+    markRefreshUsed(id: string): Promise<boolean>;
+    denyAccess(jti: string, expiresAt: number): Promise<void>;
+    isAccessDenied(jti: string): Promise<boolean>;
+}
+export interface IssuedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresInSeconds: number;
+}
+export interface VerifiedAccess {
+    subject: string;
+    claims: Record<string, unknown>;
+    jti: string;
+}
+export interface SingleUseRecord {
+    /** Hash van het klare token. */
+    id: string;
+    purpose: string;
+    payload: unknown;
+    expiresAt: number;
+    consumedAt?: number;
+}
+export interface SingleUseStore {
+    save(record: SingleUseRecord): Promise<void>;
+    find(id: string): Promise<SingleUseRecord | null>;
+    /** Atomair verbruiken; `true` als het nu net verbruikt is, `false` als het al verbruikt was. */
+    markConsumed(id: string): Promise<boolean>;
+}
+export interface SingleUseConfig {
+    /** TTL (seconden) per purpose, bv. `{ 'password-reset': 3600 }`. */
+    ttlByPurpose?: Record<string, number>;
+    defaultTtlSeconds?: number;
+}
+export interface UserRecord {
+    id: string;
+    /** Login-identifier (bv. e-mail); de kit interpreteert dit niet. */
+    identifier: string;
+    passwordHash?: string;
+    verified?: boolean;
+    [key: string]: unknown;
+}
+export interface UserStore {
+    findByIdentifier(identifier: string): Promise<UserRecord | null>;
+    findById(id: string): Promise<UserRecord | null>;
+    save(user: UserRecord): Promise<UserRecord>;
+}
+export interface MailMessage {
+    to: string;
+    subject: string;
+    text?: string;
+    html?: string;
+    /** Vrije data die een concrete mailer-adapter (mailer-kit) kan gebruiken voor templating. */
+    data?: Record<string, unknown>;
+}
+export interface Mailer {
+    send(message: MailMessage): Promise<void>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/auth/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/auth/core/ports.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0GAA0G;AAC1G,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;AAIjC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/D;AAID,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvD,4FAA4F;IAC5F,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb;AAID,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAClD,gGAAgG;IAChG,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C"}

package/dist/auth/core/ports.js

@@ -0,0 +1,7 @@
+/**
+ * Poorten & types voor de auth-kit. Het consumerende project injecteert de hashing-engine, token-
+ * en single-use-stores, en de `UserStore`/`Mailer`-ports. De kit bevat geen gebruikers- of
+ * domeinkennis.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/auth/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/auth/core/ports.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/auth/core/single-use.d.ts

@@ -0,0 +1,10 @@
+import type { Clock, SingleUseConfig, SingleUseStore } from './ports.js';
+export declare class SingleUseTokenService {
+    #private;
+    constructor(config: SingleUseConfig, store: SingleUseStore, clock?: Clock);
+    /** Geef een token uit voor een purpose met bijbehorende payload; retourneert het klare token. */
+    issue(purpose: string, payload: unknown): Promise<string>;
+    /** Wissel een token exact één keer in; retourneert de payload of gooit een {@link SingleUseTokenError}. */
+    consume(token: string, purpose: string): Promise<unknown>;
+}
+//# sourceMappingURL=single-use.d.ts.map

package/dist/auth/core/single-use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-use.d.ts","sourceRoot":"","sources":["../../../src/auth/core/single-use.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIzE,qBAAa,qBAAqB;;gBAKpB,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,GAAE,KAAgB;IAMnF,iGAAiG;IAC3F,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAa/D,2GAA2G;IACrG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUhE"}

package/dist/auth/core/single-use.js

@@ -0,0 +1,47 @@
+/**
+ * US-0403 — Single-use tokens met TTL (verify/reset/invite).
+ *
+ * Genereert onraadbare tokens per purpose, slaat alleen de gehashte variant op via de
+ * {@link SingleUseStore}-poort en wisselt exact één keer in (atomair). Ongeldige tokens leveren een
+ * generieke `invalid`-fout op (geen enumeration van purpose/payload).
+ */
+import { hashToken, randomToken } from './crypto-util.js';
+import { SingleUseTokenError } from './errors.js';
+const DEFAULT_TTL_SECONDS = 3600;
+export class SingleUseTokenService {
+    #config;
+    #store;
+    #clock;
+    constructor(config, store, clock = Date.now) {
+        this.#config = config;
+        this.#store = store;
+        this.#clock = clock;
+    }
+    /** Geef een token uit voor een purpose met bijbehorende payload; retourneert het klare token. */
+    async issue(purpose, payload) {
+        const token = randomToken();
+        const ttl = this.#config.ttlByPurpose?.[purpose] ?? this.#config.defaultTtlSeconds ?? DEFAULT_TTL_SECONDS;
+        await this.#store.save({
+            id: hashToken(token),
+            purpose,
+            payload,
+            expiresAt: this.#clock() + ttl * 1000,
+        });
+        return token;
+    }
+    /** Wissel een token exact één keer in; retourneert de payload of gooit een {@link SingleUseTokenError}. */
+    async consume(token, purpose) {
+        const id = hashToken(token);
+        const record = await this.#store.find(id);
+        // `invalid` voor niet-bestaand én verkeerde purpose: geen enumeration.
+        if (!record || record.purpose !== purpose)
+            throw new SingleUseTokenError('invalid');
+        if (this.#clock() > record.expiresAt)
+            throw new SingleUseTokenError('expired');
+        const consumed = await this.#store.markConsumed(id);
+        if (!consumed)
+            throw new SingleUseTokenError('consumed');
+        return record.payload;
+    }
+}
+//# sourceMappingURL=single-use.js.map

package/dist/auth/core/single-use.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-use.js","sourceRoot":"","sources":["../../../src/auth/core/single-use.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,OAAO,qBAAqB;IACvB,OAAO,CAAkB;IACzB,MAAM,CAAiB;IACvB,MAAM,CAAQ;IAEvB,YAAY,MAAuB,EAAE,KAAqB,EAAE,QAAe,IAAI,CAAC,GAAG;QACjF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAgB;QAC3C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,GAAG,GACP,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,mBAAmB,CAAC;QAChG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC;YACpB,OAAO;YACP,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI;SACtC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2GAA2G;IAC3G,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAAe;QAC1C,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,uEAAuE;QACvE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF"}

package/dist/auth/core/tokens.d.ts

@@ -0,0 +1,14 @@
+import type { Clock, IssuedTokens, TokenConfig, TokenStore, VerifiedAccess } from './ports.js';
+export declare class TokenService {
+    #private;
+    constructor(config: TokenConfig, store: TokenStore, clock?: Clock);
+    issue(subject: string, claims?: Record<string, unknown>): Promise<IssuedTokens>;
+    verify(accessToken: string): Promise<VerifiedAccess>;
+    /** Wissel een refresh-token in voor een nieuw paar (rotatie). Hergebruik → `TokenError('reuse')`. */
+    refresh(refreshToken: string): Promise<IssuedTokens>;
+    /** Trek een access-token in (denylist op `jti` tot aan zijn expiry). */
+    revokeAccess(accessToken: string): Promise<void>;
+    /** Trek een refresh-token in (markeer als gebruikt). */
+    revokeRefresh(refreshToken: string): Promise<void>;
+}
+//# sourceMappingURL=tokens.d.ts.map

package/dist/auth/core/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/auth/core/tokens.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,YAAY,CAAC;AAIpB,qBAAa,YAAY;;gBAKX,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,GAAE,KAAgB;IAMrE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBnF,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB1D,qGAAqG;IAC/F,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAU1D,wEAAwE;IAClE,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD,wDAAwD;IAClD,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzD"}

package/dist/auth/core/tokens.js

@@ -0,0 +1,85 @@
+/**
+ * US-0402 — Token-service: issue/verify/refresh/revoke.
+ *
+ * Access-tokens zijn ondertekende JWT's; refresh-tokens zijn opaque en worden (gehasht) via de
+ * {@link TokenStore}-poort bijgehouden voor rotatie en hergebruik-detectie. Access-revocatie loopt via
+ * een denylist op `jti`. Signing-key/TTL's komen uit config; de core kent geen opslag of domein.
+ */
+import { hashToken, randomToken } from './crypto-util.js';
+import { TokenError } from './errors.js';
+import { signJwt, verifyJwt } from './jwt.js';
+const RESERVED_CLAIMS = new Set(['sub', 'jti', 'iat', 'exp', 'iss']);
+export class TokenService {
+    #config;
+    #store;
+    #clock;
+    constructor(config, store, clock = Date.now) {
+        this.#config = config;
+        this.#store = store;
+        this.#clock = clock;
+    }
+    async issue(subject, claims = {}) {
+        const now = this.#clock();
+        const jti = randomToken();
+        const nowSec = Math.floor(now / 1000);
+        const payload = {
+            ...claims,
+            sub: subject,
+            jti,
+            iat: nowSec,
+            exp: nowSec + this.#config.accessTtlSeconds,
+        };
+        if (this.#config.issuer)
+            payload['iss'] = this.#config.issuer;
+        const accessToken = signJwt(payload, this.#config.secret);
+        const refreshToken = randomToken();
+        await this.#store.saveRefresh({
+            id: hashToken(refreshToken),
+            subject,
+            expiresAt: now + this.#config.refreshTtlSeconds * 1000,
+        });
+        return { accessToken, refreshToken, expiresInSeconds: this.#config.accessTtlSeconds };
+    }
+    async verify(accessToken) {
+        const payload = verifyJwt(accessToken, this.#config.secret);
+        const nowSec = Math.floor(this.#clock() / 1000);
+        if (typeof payload['exp'] === 'number' && nowSec > payload['exp']) {
+            throw new TokenError('expired');
+        }
+        const jti = String(payload['jti'] ?? '');
+        if (await this.#store.isAccessDenied(jti))
+            throw new TokenError('revoked');
+        const claims = {};
+        for (const [key, value] of Object.entries(payload)) {
+            if (!RESERVED_CLAIMS.has(key))
+                claims[key] = value;
+        }
+        return { subject: String(payload['sub'] ?? ''), claims, jti };
+    }
+    /** Wissel een refresh-token in voor een nieuw paar (rotatie). Hergebruik → `TokenError('reuse')`. */
+    async refresh(refreshToken) {
+        const id = hashToken(refreshToken);
+        const record = await this.#store.findRefresh(id);
+        if (!record)
+            throw new TokenError('invalid');
+        if (this.#clock() > record.expiresAt)
+            throw new TokenError('expired');
+        const rotated = await this.#store.markRefreshUsed(id);
+        if (!rotated)
+            throw new TokenError('reuse');
+        return this.issue(record.subject);
+    }
+    /** Trek een access-token in (denylist op `jti` tot aan zijn expiry). */
+    async revokeAccess(accessToken) {
+        const payload = verifyJwt(accessToken, this.#config.secret);
+        const expiresAt = typeof payload['exp'] === 'number'
+            ? payload['exp'] * 1000
+            : this.#clock() + this.#config.accessTtlSeconds * 1000;
+        await this.#store.denyAccess(String(payload['jti'] ?? ''), expiresAt);
+    }
+    /** Trek een refresh-token in (markeer als gebruikt). */
+    async revokeRefresh(refreshToken) {
+        await this.#store.markRefreshUsed(hashToken(refreshToken));
+    }
+}
+//# sourceMappingURL=tokens.js.map

package/dist/auth/core/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/auth/core/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAS9C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAErE,MAAM,OAAO,YAAY;IACd,OAAO,CAAc;IACrB,MAAM,CAAa;IACnB,MAAM,CAAQ;IAEvB,YAAY,MAAmB,EAAE,KAAiB,EAAE,QAAe,IAAI,CAAC,GAAG;QACzE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,SAAkC,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACtC,MAAM,OAAO,GAA4B;YACvC,GAAG,MAAM;YACT,GAAG,EAAE,OAAO;YACZ,GAAG;YACH,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SAC5C,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAE9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5B,EAAE,EAAE,SAAS,CAAC,YAAY,CAAC;YAC3B,OAAO;YACP,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,GAAG,IAAI;SACvD,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QAE3E,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAChE,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;YAChC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI;YACvB,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC3D,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `auth` kit — domein-loze identiteit & credentials: argon2id-hashing met rehash-policy, een token-
+ * service (JWT + opaque refresh met rotatie/revocatie), single-use TTL-tokens en de `UserStore`/
+ * `Mailer`-integratieports. Pure core + adapters; geen gebruikers- of domeinkennis.
+ *
+ * De NestJS-adapter zit onder `webapp-factory/backend-foundation/auth/nestjs`.
+ */
+export { CredentialService } from './core/credentials.js';
+export { TokenService } from './core/tokens.js';
+export { SingleUseTokenService } from './core/single-use.js';
+export { AuthService, createAuthService, type AuthServiceDeps, type AuthPurposes, type PublicUser, } from './core/auth-service.js';
+export { signJwt, verifyJwt } from './core/jwt.js';
+export { randomToken, hashToken, newId } from './core/crypto-util.js';
+export type { Clock, PasswordHasher, VerifyResult, TokenConfig, TokenStore, RefreshRecord, IssuedTokens, VerifiedAccess, SingleUseStore, SingleUseRecord, SingleUseConfig, UserStore, UserRecord, Mailer, MailMessage, } from './core/ports.js';
+export { AuthError, InvalidCredentialsError, UnsupportedHashError, TokenError, SingleUseTokenError, AuthConfigurationError, type TokenErrorReason, type SingleUseReason, } from './core/errors.js';
+export { argon2idHasher, type Argon2idParams } from './adapters/argon2id-hasher.js';
+export { inMemoryTokenStore, inMemorySingleUseStore, inMemoryUserStore, inMemoryMailer, } from './adapters/in-memory-stores.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGtE,YAAY,EACV,KAAK,EACL,cAAc,EACd,YAAY,EACZ,WAAW,EACX,UAAU,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,SAAS,EACT,UAAU,EACV,MAAM,EACN,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,GACf,MAAM,gCAAgC,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,22 @@
+/**
+ * `auth` kit — domein-loze identiteit & credentials: argon2id-hashing met rehash-policy, een token-
+ * service (JWT + opaque refresh met rotatie/revocatie), single-use TTL-tokens en de `UserStore`/
+ * `Mailer`-integratieports. Pure core + adapters; geen gebruikers- of domeinkennis.
+ *
+ * De NestJS-adapter zit onder `webapp-factory/backend-foundation/auth/nestjs`.
+ */
+// Services (US-0401..0404)
+export { CredentialService } from './core/credentials.js';
+export { TokenService } from './core/tokens.js';
+export { SingleUseTokenService } from './core/single-use.js';
+export { AuthService, createAuthService, } from './core/auth-service.js';
+// JWT-helpers
+export { signJwt, verifyJwt } from './core/jwt.js';
+// Crypto-helpers
+export { randomToken, hashToken, newId } from './core/crypto-util.js';
+// Fouten
+export { AuthError, InvalidCredentialsError, UnsupportedHashError, TokenError, SingleUseTokenError, AuthConfigurationError, } from './core/errors.js';
+// Adapters
+export { argon2idHasher } from './adapters/argon2id-hasher.js';
+export { inMemoryTokenStore, inMemorySingleUseStore, inMemoryUserStore, inMemoryMailer, } from './adapters/in-memory-stores.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2BAA2B;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,iBAAiB,GAIlB,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAEnD,iBAAiB;AACjB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAqBtE,SAAS;AACT,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,kBAAkB,CAAC;AAE1B,WAAW;AACX,OAAO,EAAE,cAAc,EAAuB,MAAM,+BAA+B,CAAC;AACpF,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,GACf,MAAM,gCAAgC,CAAC"}

package/dist/auth/nestjs/auth.module.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Dunne NestJS-adapter: stelt een fail-fast-gevalideerde {@link AuthService} beschikbaar via DI. De
+ * Nest-types zijn `import type` (geen runtime-dep op `@nestjs/common`; optionele peer).
+ */
+import type { DynamicModule, InjectionToken } from '@nestjs/common';
+import { type AuthServiceDeps } from '../core/auth-service.js';
+/** DI-token waaronder de auth-service beschikbaar is. */
+export declare const AUTH_SERVICE: unique symbol;
+export interface AuthKitModuleOptions extends AuthServiceDeps {
+    global?: boolean;
+    token?: InjectionToken;
+}
+export declare class AuthKitModule {
+    /** Bouwt (fail-fast) de auth-service en registreert deze onder het token. */
+    static forRoot(options: AuthKitModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/auth/nestjs/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../../src/auth/nestjs/auth.module.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAY,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAuC,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEpG,yDAAyD;AACzD,eAAO,MAAM,YAAY,eAAiC,CAAC;AAE3D,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,qBAAa,aAAa;IACxB,6EAA6E;IAC7E,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;CAW7D"}

package/dist/auth/nestjs/auth.module.js

@@ -0,0 +1,18 @@
+import { createAuthService } from '../core/auth-service.js';
+/** DI-token waaronder de auth-service beschikbaar is. */
+export const AUTH_SERVICE = Symbol.for('auth-kit.service');
+export class AuthKitModule {
+    /** Bouwt (fail-fast) de auth-service en registreert deze onder het token. */
+    static forRoot(options) {
+        const service = createAuthService(options);
+        const token = options.token ?? AUTH_SERVICE;
+        const provider = { provide: token, useValue: service };
+        return {
+            module: AuthKitModule,
+            global: options.global ?? true,
+            providers: [provider],
+            exports: [token],
+        };
+    }
+}
+//# sourceMappingURL=auth.module.js.map

package/dist/auth/nestjs/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../../src/auth/nestjs/auth.module.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAA0C,MAAM,yBAAyB,CAAC;AAEpG,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAO3D,MAAM,OAAO,aAAa;IACxB,6EAA6E;IAC7E,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,MAAM,OAAO,GAAgB,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;QAC5C,MAAM,QAAQ,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,OAAO,EAAE,CAAC,KAAK,CAAC;SACjB,CAAC;IACJ,CAAC;CACF"}

package/dist/cache/adapters/in-memory-store.d.ts

@@ -0,0 +1,6 @@
+import type { CacheStore, Clock, PubSubStore } from '../core/ports.js';
+export declare function inMemoryCacheStore(options?: {
+    clock?: Clock;
+}): CacheStore;
+export declare function inMemoryPubSub(): PubSubStore;
+//# sourceMappingURL=in-memory-store.d.ts.map

package/dist/cache/adapters/in-memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.d.ts","sourceRoot":"","sources":["../../../src/cache/adapters/in-memory-store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAOvE,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAAG,UAAU,CAyC9E;AAED,wBAAgB,cAAc,IAAI,WAAW,CAgB5C"}