webapp-factory 0.1.0

package/dist/http/core/pagination.js

@@ -0,0 +1,108 @@
+/**
+ * US-0205 — Paginatie/filtering/sortering-conventies.
+ *
+ * Parset en valideert list-query-parameters tot genormaliseerde, getypte parameters en levert een
+ * consistente response-envelope met metadata. Toegestane sorteer-/filtervelden worden per route
+ * geïnjecteerd (whitelist); defaults en limieten zijn configureerbaar. De kern bevat geen
+ * domeinvelden.
+ */
+import { ValidationError } from './errors.js';
+const DEFAULT_PAGE_SIZE = 20;
+const DEFAULT_MAX_PAGE_SIZE = 100;
+/**
+ * Parset `page`, `pageSize`, `sort` en filters uit de query. `sort` heeft de vorm
+ * `veld:asc,ander:desc` of `veld,-ander`. Ongeldige/niet-toegestane velden -> {@link ValidationError}.
+ */
+export function parseListQuery(query = {}, config = {}) {
+    const issues = [];
+    const defaultPageSize = config.defaultPageSize ?? DEFAULT_PAGE_SIZE;
+    const maxPageSize = config.maxPageSize ?? DEFAULT_MAX_PAGE_SIZE;
+    const page = parsePositiveInt(query['page'], 1, 'page', issues);
+    let pageSize = parsePositiveInt(query['pageSize'], defaultPageSize, 'pageSize', issues);
+    // AC2: begrens boven het maximum tot het maximum.
+    if (pageSize > maxPageSize)
+        pageSize = maxPageSize;
+    const sort = parseSort(query['sort'], config, issues);
+    const filters = parseFilters(query, config, issues);
+    if (issues.length > 0) {
+        throw new ValidationError(issues, 'Ongeldige list-parameters');
+    }
+    return {
+        page,
+        pageSize,
+        offset: (page - 1) * pageSize,
+        sort: sort.length > 0 ? sort : (config.defaultSort ?? []),
+        filters,
+    };
+}
+/** Bouwt een consistente response-envelope met paginatie-metadata. */
+export function paginate(items, total, params) {
+    return {
+        data: items,
+        meta: {
+            page: params.page,
+            pageSize: params.pageSize,
+            total,
+            totalPages: params.pageSize > 0 ? Math.ceil(total / params.pageSize) : 0,
+        },
+    };
+}
+function parsePositiveInt(raw, fallback, field, issues) {
+    if (raw === undefined || raw === '')
+        return fallback;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1) {
+        issues.push({ path: field, message: `moet een positief geheel getal zijn` });
+        return fallback;
+    }
+    return n;
+}
+function parseSort(raw, config, issues) {
+    if (raw === undefined || raw === '')
+        return [];
+    const allowed = config.allowedSortFields;
+    const tokens = String(raw)
+        .split(',')
+        .map((t) => t.trim())
+        .filter((t) => t.length > 0);
+    const result = [];
+    for (const token of tokens) {
+        let field = token;
+        let direction = 'asc';
+        if (token.includes(':')) {
+            const [f, d] = token.split(':');
+            field = (f ?? '').trim();
+            direction = (d ?? '').trim().toLowerCase() === 'desc' ? 'desc' : 'asc';
+        }
+        else if (token.startsWith('-')) {
+            field = token.slice(1);
+            direction = 'desc';
+        }
+        if (allowed && !allowed.includes(field)) {
+            issues.push({ path: 'sort', message: `sorteren op "${field}" is niet toegestaan` });
+            continue;
+        }
+        result.push({ field, direction });
+    }
+    return result;
+}
+const RESERVED = new Set(['page', 'pageSize', 'sort']);
+function parseFilters(query, config, issues) {
+    const allowed = config.allowedFilterFields;
+    const filters = {};
+    for (const [key, value] of Object.entries(query)) {
+        if (RESERVED.has(key))
+            continue;
+        if (value === undefined)
+            continue;
+        if (allowed === undefined)
+            continue; // geen filtering geconfigureerd -> negeer overige params
+        if (!allowed.includes(key)) {
+            issues.push({ path: key, message: `filteren op "${key}" is niet toegestaan` });
+            continue;
+        }
+        filters[key] = String(value);
+    }
+    return filters;
+}
+//# sourceMappingURL=pagination.js.map

package/dist/http/core/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../../src/http/core/pagination.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAiC,EAAE,EAAE,SAAqB,EAAE;IACzF,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAEhE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACxF,kDAAkD;IAClD,IAAI,QAAQ,GAAG,WAAW;QAAE,QAAQ,GAAG,WAAW,CAAC;IAEnD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ;QAC7B,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACzD,OAAO;KACR,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,QAAQ,CACtB,KAAU,EACV,KAAa,EACb,MAA6C;IAE7C,OAAO;QACL,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;SACzE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAY,EACZ,QAAgB,EAChB,KAAa,EACb,MAAyB;IAEzB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,MAAkB,EAAE,MAAyB;IAC5E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,SAAS,GAAmB,KAAK,CAAC;QACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACzE,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,KAAK,sBAAsB,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,SAAS,YAAY,CACnB,KAA8B,EAC9B,MAAkB,EAClB,MAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,yDAAyD;QAC9F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,GAAG,sBAAsB,EAAE,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/http/core/ports.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Poorten & types voor de http-kernel. Het consumerende project injecteert route-modules, schema's
+ * en (optioneel) configuratie; de kernel bevat zelf geen route of domeinkennis.
+ */
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS' | 'HEAD';
+/** Framework-agnostisch request-object dat de kernel verwerkt. */
+export interface KernelRequest {
+    method: string;
+    /** Pad zonder query-string, bv. `/users/42`. */
+    path: string;
+    headers: Record<string, string | string[] | undefined>;
+    /** Reeds geparste query-parameters. */
+    query?: Record<string, unknown>;
+    body?: unknown;
+    /** Door de router ingevulde path-parameters. */
+    params?: Record<string, string>;
+}
+/** Framework-agnostisch response-object dat de kernel oplevert. */
+export interface KernelResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: unknown;
+}
+export interface ValidationIssue {
+    path: string;
+    message: string;
+}
+export type ValidationOutcome<T> = {
+    success: true;
+    value: T;
+} | {
+    success: false;
+    issues: ValidationIssue[];
+};
+/** Vervangbare validatie-engine. Zie de Zod-adapter voor een implementatie. */
+export interface Schema<T = unknown> {
+    validate(input: unknown): ValidationOutcome<T>;
+    /** Optioneel: JSON-schema voor OpenAPI-generatie (US-0206). */
+    jsonSchema?(): JsonSchema;
+}
+/** Minimale JSON-schema-vorm (OpenAPI 3.1 componenten). */
+export type JsonSchema = {
+    type?: string;
+    properties?: Record<string, JsonSchema>;
+    required?: string[];
+    items?: JsonSchema;
+    enum?: unknown[];
+    format?: string;
+    [key: string]: unknown;
+};
+export interface RequestContext {
+    requestId: string;
+    correlationId: string;
+}
+export interface RouteHandlerInput<B = unknown, Q = unknown, P = unknown> {
+    body: B;
+    query: Q;
+    params: P;
+    /** Genormaliseerde list-parameters, alleen voor list-routes (US-0205). */
+    list?: ListParams;
+    raw: KernelRequest;
+    context: RequestContext;
+}
+export type RouteHandler<B = unknown, Q = unknown, P = unknown> = (input: RouteHandlerInput<B, Q, P>) => unknown | Promise<unknown>;
+export interface RouteSchemas {
+    body?: Schema;
+    query?: Schema;
+    params?: Schema;
+    /** Response-schema voor OpenAPI (validatie van output is optioneel). */
+    response?: Schema;
+}
+export interface RouteDefinition {
+    method: HttpMethod;
+    /** Pad relatief aan de module-basePath; mag `:param`-segmenten bevatten. */
+    path: string;
+    handler: RouteHandler;
+    schemas?: RouteSchemas;
+    summary?: string;
+    /** Markeer als list-endpoint met paginatie/sortering/filtering (US-0205). */
+    list?: ListConfig | boolean;
+    /** Success-statuscode (default 200, of 204 bij lege body). */
+    status?: number;
+}
+export interface RouteModule {
+    basePath?: string;
+    routes: RouteDefinition[];
+}
+export interface ListConfig {
+    defaultPageSize?: number;
+    maxPageSize?: number;
+    allowedSortFields?: string[];
+    allowedFilterFields?: string[];
+    defaultSort?: SortField[];
+}
+export interface SortField {
+    field: string;
+    direction: 'asc' | 'desc';
+}
+export interface ListParams {
+    page: number;
+    pageSize: number;
+    offset: number;
+    sort: SortField[];
+    filters: Record<string, string>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/http/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/http/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1F,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;CACf;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC3B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC;AAElD,+EAA+E;AAC/E,MAAM,WAAW,MAAM,CAAC,CAAC,GAAG,OAAO;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,UAAU,CAAC,IAAI,UAAU,CAAC;CAC3B;AAED,2DAA2D;AAC3D,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAIF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,CAAC,CAAC;IACV,0EAA0E;IAC1E,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI,CAChE,KAAK,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC9B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAID,MAAM,WAAW,UAAU;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC"}

package/dist/http/core/ports.js

@@ -0,0 +1,6 @@
+/**
+ * Poorten & types voor de http-kernel. Het consumerende project injecteert route-modules, schema's
+ * en (optioneel) configuratie; de kernel bevat zelf geen route of domeinkennis.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/http/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/http/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/http/core/redaction.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Redactie van gevoelige velden in fout-payloads en logs (US-0204 AC3). Domein-loos: de set
+ * gevoelige key-namen is configureerbaar.
+ */
+export declare const DEFAULT_SENSITIVE_KEYS: string[];
+/** Diep redigeren: waarden van keys die (case-insensitief) matchen worden vervangen door `***`. */
+export declare function redactSensitive(value: unknown, sensitiveKeys?: string[]): unknown;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/http/core/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/http/core/redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,sBAAsB,UAkBlC,CAAC;AAIF,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,GAAE,MAAM,EAA2B,GAAG,OAAO,CAGzG"}

package/dist/http/core/redaction.js

@@ -0,0 +1,45 @@
+/**
+ * Redactie van gevoelige velden in fout-payloads en logs (US-0204 AC3). Domein-loos: de set
+ * gevoelige key-namen is configureerbaar.
+ */
+export const DEFAULT_SENSITIVE_KEYS = [
+    'password',
+    'pass',
+    'secret',
+    'token',
+    'authorization',
+    'apikey',
+    'api_key',
+    'accesstoken',
+    'access_token',
+    'refreshtoken',
+    'refresh_token',
+    'cookie',
+    'setcookie',
+    'ssn',
+    'creditcard',
+    'card',
+    'pin',
+];
+const REDACTED = '***';
+/** Diep redigeren: waarden van keys die (case-insensitief) matchen worden vervangen door `***`. */
+export function redactSensitive(value, sensitiveKeys = DEFAULT_SENSITIVE_KEYS) {
+    const set = new Set(sensitiveKeys.map((k) => k.toLowerCase()));
+    return redact(value, set, new WeakSet());
+}
+function redact(value, keys, seen) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value)) {
+        return value.map((item) => redact(item, keys, seen));
+    }
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+        out[key] = keys.has(key.toLowerCase()) ? REDACTED : redact(val, keys, seen);
+    }
+    return out;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/http/core/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/http/core/redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,MAAM;IACN,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,SAAS;IACT,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,QAAQ;IACR,WAAW;IACX,KAAK;IACL,YAAY;IACZ,MAAM;IACN,KAAK;CACN,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,gBAA0B,sBAAsB;IAC9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAiB,EAAE,IAAqB;IACtE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/core/router.d.ts

@@ -0,0 +1,37 @@
+/**
+ * US-0201 — Route-modules valideren, mounten en matchen.
+ *
+ * Valideert geïnjecteerde route-modules tegen het port-contract (fail-fast bij een ongeldige module),
+ * compileert ze tot een route-tabel onder het geconfigureerde base-path en detecteert conflicterende
+ * registraties (zelfde methode + pad). Bevat geen domeinkennis.
+ */
+import type { HttpMethod, RouteDefinition, RouteModule } from './ports.js';
+/** Fout bij het bootstrappen van de kernel (US-0201 AC3 / US-0206 AC3). Bevat geen interne payload. */
+export declare class KernelBootstrapError extends Error {
+    constructor(message: string);
+}
+interface Segment {
+    value: string;
+    param: boolean;
+}
+export interface CompiledRoute {
+    method: HttpMethod;
+    /** Volledig pad inclusief base-path, bv. `/api/users/:id`. */
+    fullPath: string;
+    segments: Segment[];
+    definition: RouteDefinition;
+}
+/** Valideert één route-module tegen het port-contract. Gooit {@link KernelBootstrapError}. */
+export declare function validateRouteModule(mod: unknown, index: number): asserts mod is RouteModule;
+/** Compileert alle route-modules tot één route-tabel; detecteert conflicten (fail-fast). */
+export declare function compileRoutes(modules: unknown[], basePath?: string): CompiledRoute[];
+export interface RouteMatch {
+    route: CompiledRoute;
+    params: Record<string, string>;
+}
+/** Zoekt de eerste route die matcht op methode + pad en extraheert path-params. */
+export declare function matchRoute(routes: CompiledRoute[], method: string, path: string): RouteMatch | null;
+/** True als er wel een pad matcht maar geen enkele methode (405-hint). */
+export declare function pathExistsWithOtherMethod(routes: CompiledRoute[], path: string): boolean;
+export {};
+//# sourceMappingURL=router.d.ts.map

package/dist/http/core/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/core/router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3E,uGAAuG;AACvG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAK5B;AAYD,UAAU,OAAO;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAyB3F;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,SAAK,GAAG,aAAa,EAAE,CAuBhF;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CACxB,MAAM,EAAE,aAAa,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,IAAI,CASnB;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGxF"}

package/dist/http/core/router.js

@@ -0,0 +1,120 @@
+/** Fout bij het bootstrappen van de kernel (US-0201 AC3 / US-0206 AC3). Bevat geen interne payload. */
+export class KernelBootstrapError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'KernelBootstrapError';
+        Object.setPrototypeOf(this, KernelBootstrapError.prototype);
+    }
+}
+const VALID_METHODS = new Set([
+    'GET',
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+    'OPTIONS',
+    'HEAD',
+]);
+/** Valideert één route-module tegen het port-contract. Gooit {@link KernelBootstrapError}. */
+export function validateRouteModule(mod, index) {
+    const label = `route-module[${index}]`;
+    if (typeof mod !== 'object' || mod === null || Array.isArray(mod)) {
+        throw new KernelBootstrapError(`${label} is geen geldig object`);
+    }
+    const routes = mod.routes;
+    if (!Array.isArray(routes)) {
+        throw new KernelBootstrapError(`${label}.routes ontbreekt of is geen array`);
+    }
+    routes.forEach((route, i) => {
+        const rl = `${label}.routes[${i}]`;
+        if (typeof route !== 'object' || route === null) {
+            throw new KernelBootstrapError(`${rl} is geen geldig route-object`);
+        }
+        const r = route;
+        if (typeof r.method !== 'string' || !VALID_METHODS.has(r.method.toUpperCase())) {
+            throw new KernelBootstrapError(`${rl}.method "${String(r.method)}" is ongeldig`);
+        }
+        if (typeof r.path !== 'string' || !r.path.startsWith('/')) {
+            throw new KernelBootstrapError(`${rl}.path moet een string zijn die met "/" begint`);
+        }
+        if (typeof r.handler !== 'function') {
+            throw new KernelBootstrapError(`${rl}.handler ontbreekt of is geen functie`);
+        }
+    });
+}
+/** Compileert alle route-modules tot één route-tabel; detecteert conflicten (fail-fast). */
+export function compileRoutes(modules, basePath = '') {
+    const routes = [];
+    const seen = new Map();
+    const normalizedBase = normalize(basePath);
+    modules.forEach((mod, index) => {
+        validateRouteModule(mod, index);
+        const moduleBase = normalize(mod.basePath ?? '');
+        for (const definition of mod.routes) {
+            const method = definition.method.toUpperCase();
+            const fullPath = joinPaths(normalizedBase, moduleBase, definition.path);
+            const key = `${method} ${fullPath}`;
+            if (seen.has(key)) {
+                throw new KernelBootstrapError(`conflicterende route-registratie: ${key} is meer dan één keer geregistreerd`);
+            }
+            seen.set(key, key);
+            routes.push({ method, fullPath, segments: toSegments(fullPath), definition });
+        }
+    });
+    return routes;
+}
+/** Zoekt de eerste route die matcht op methode + pad en extraheert path-params. */
+export function matchRoute(routes, method, path) {
+    const upper = method.toUpperCase();
+    const target = toSegments(normalize(path));
+    for (const route of routes) {
+        if (route.method !== upper)
+            continue;
+        const params = matchSegments(route.segments, target);
+        if (params)
+            return { route, params };
+    }
+    return null;
+}
+/** True als er wel een pad matcht maar geen enkele methode (405-hint). */
+export function pathExistsWithOtherMethod(routes, path) {
+    const target = toSegments(normalize(path));
+    return routes.some((route) => matchSegments(route.segments, target) !== null);
+}
+function matchSegments(routeSegs, target) {
+    if (routeSegs.length !== target.length)
+        return null;
+    const params = {};
+    for (let i = 0; i < routeSegs.length; i++) {
+        const seg = routeSegs[i];
+        const value = target[i].value;
+        if (seg.param) {
+            params[seg.value] = decodeURIComponent(value);
+        }
+        else if (seg.value !== value) {
+            return null;
+        }
+    }
+    return params;
+}
+function toSegments(path) {
+    return path
+        .split('/')
+        .filter((s) => s.length > 0)
+        .map((s) => (s.startsWith(':') ? { value: s.slice(1), param: true } : { value: s, param: false }));
+}
+function normalize(path) {
+    if (!path)
+        return '';
+    let p = path.trim();
+    if (!p.startsWith('/'))
+        p = `/${p}`;
+    if (p.length > 1 && p.endsWith('/'))
+        p = p.slice(0, -1);
+    return p === '/' ? '' : p;
+}
+function joinPaths(...parts) {
+    const joined = parts.map((p) => normalize(p)).join('');
+    return joined === '' ? '/' : joined;
+}
+//# sourceMappingURL=router.js.map

package/dist/http/core/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/http/core/router.ts"],"names":[],"mappings":"AASA,uGAAuG;AACvG,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAa;IACxC,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAeH,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,KAAa;IAC7D,MAAM,KAAK,GAAG,gBAAgB,KAAK,GAAG,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAI,GAAmB,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,EAAE,GAAG,GAAG,KAAK,WAAW,CAAC,GAAG,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,GAAG,KAAwB,CAAC;QACnC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAgB,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,OAAkB,EAAE,QAAQ,GAAG,EAAE;IAC7D,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE3C,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAgB,CAAC;YAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,oBAAoB,CAC5B,qCAAqC,GAAG,qCAAqC,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,mFAAmF;AACnF,MAAM,UAAU,UAAU,CACxB,MAAuB,EACvB,MAAc,EACd,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,MAAuB,EAAE,IAAY;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,SAAoB,EAAE,MAAiB;IAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAY,CAAC;QACpC,MAAM,KAAK,GAAI,MAAM,CAAC,CAAC,CAAa,CAAC,KAAK,CAAC;QAC3C,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,KAAe;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC"}

package/dist/http/core/security.d.ts

@@ -0,0 +1,43 @@
+/**
+ * US-0207 — CORS + security-headers.
+ *
+ * Past veilige security-header-defaults toe en handelt CORS af op basis van een geconfigureerde
+ * allowlist van origins/methodes/headers. Onbekende origins krijgen geen CORS-toegangs-headers. De
+ * laag is domein-loos; allowlist en overrides komen via config-injectie binnen.
+ */
+export interface SecurityHeadersConfig {
+    /** `Strict-Transport-Security`. Default veilige waarde; `false` schakelt uit. */
+    hsts?: string | false;
+    /** `Content-Security-Policy`. Default `default-src 'self'`; `false` schakelt uit. */
+    csp?: string | false;
+    /** `X-Frame-Options`. Default `DENY`. */
+    frameOptions?: string | false;
+    /** `Referrer-Policy`. Default `no-referrer`. */
+    referrerPolicy?: string | false;
+    /** Extra/overschrijvende headers. */
+    extra?: Record<string, string>;
+}
+/** Bouwt de security-headers met veilige defaults. */
+export declare function securityHeaders(config?: SecurityHeadersConfig): Record<string, string>;
+export interface CorsConfig {
+    /** Toegestane origins, of `'*'` voor alle. Leeg/afwezig = geen cross-origin-toegang. */
+    allowedOrigins?: string[] | '*';
+    allowedMethods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    allowCredentials?: boolean;
+    maxAge?: number;
+}
+export interface CorsResult {
+    headers: Record<string, string>;
+    /** True als de origin op de allowlist staat (of `*`). */
+    allowed: boolean;
+    isPreflight: boolean;
+}
+/**
+ * Berekent de CORS-headers voor een request. Onbekende origins krijgen geen
+ * `Access-Control-Allow-Origin` (US-0207 AC3). Voor een preflight (OPTIONS met
+ * `Access-Control-Request-Method`) worden de toegestane methodes/headers teruggegeven.
+ */
+export declare function resolveCors(origin: string | undefined, method: string, config?: CorsConfig, hasPreflightHeader?: boolean): CorsResult;
+//# sourceMappingURL=security.d.ts.map

package/dist/http/core/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/http/core/security.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAKD,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,GAAE,qBAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1F;AAED,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,UAAe,EACvB,kBAAkB,UAAQ,GACzB,UAAU,CAwBZ"}

package/dist/http/core/security.js

@@ -0,0 +1,66 @@
+/**
+ * US-0207 — CORS + security-headers.
+ *
+ * Past veilige security-header-defaults toe en handelt CORS af op basis van een geconfigureerde
+ * allowlist van origins/methodes/headers. Onbekende origins krijgen geen CORS-toegangs-headers. De
+ * laag is domein-loos; allowlist en overrides komen via config-injectie binnen.
+ */
+const DEFAULT_HSTS = 'max-age=63072000; includeSubDomains';
+const DEFAULT_CSP = "default-src 'self'";
+/** Bouwt de security-headers met veilige defaults. */
+export function securityHeaders(config = {}) {
+    const headers = {
+        'X-Content-Type-Options': 'nosniff',
+    };
+    if (config.frameOptions !== false)
+        headers['X-Frame-Options'] = config.frameOptions ?? 'DENY';
+    if (config.hsts !== false)
+        headers['Strict-Transport-Security'] = config.hsts ?? DEFAULT_HSTS;
+    if (config.csp !== false)
+        headers['Content-Security-Policy'] = config.csp ?? DEFAULT_CSP;
+    if (config.referrerPolicy !== false) {
+        headers['Referrer-Policy'] = config.referrerPolicy ?? 'no-referrer';
+    }
+    return { ...headers, ...(config.extra ?? {}) };
+}
+const DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'];
+const DEFAULT_HEADERS = ['Content-Type', 'Authorization'];
+/**
+ * Berekent de CORS-headers voor een request. Onbekende origins krijgen geen
+ * `Access-Control-Allow-Origin` (US-0207 AC3). Voor een preflight (OPTIONS met
+ * `Access-Control-Request-Method`) worden de toegestane methodes/headers teruggegeven.
+ */
+export function resolveCors(origin, method, config = {}, hasPreflightHeader = false) {
+    const isPreflight = method.toUpperCase() === 'OPTIONS' && hasPreflightHeader;
+    const allowed = isOriginAllowed(origin, config.allowedOrigins);
+    if (!allowed || origin === undefined) {
+        return { headers: {}, allowed: false, isPreflight };
+    }
+    const headers = {};
+    const originValue = config.allowedOrigins === '*' && !config.allowCredentials ? '*' : origin;
+    headers['Access-Control-Allow-Origin'] = originValue;
+    if (originValue !== '*')
+        headers['Vary'] = 'Origin';
+    if (config.allowCredentials)
+        headers['Access-Control-Allow-Credentials'] = 'true';
+    if (config.exposedHeaders?.length) {
+        headers['Access-Control-Expose-Headers'] = config.exposedHeaders.join(', ');
+    }
+    if (isPreflight) {
+        headers['Access-Control-Allow-Methods'] = (config.allowedMethods ?? DEFAULT_METHODS).join(', ');
+        headers['Access-Control-Allow-Headers'] = (config.allowedHeaders ?? DEFAULT_HEADERS).join(', ');
+        if (config.maxAge !== undefined)
+            headers['Access-Control-Max-Age'] = String(config.maxAge);
+    }
+    return { headers, allowed: true, isPreflight };
+}
+function isOriginAllowed(origin, allowlist) {
+    if (origin === undefined)
+        return false;
+    if (allowlist === '*')
+        return true;
+    if (!allowlist || allowlist.length === 0)
+        return false;
+    return allowlist.includes(origin);
+}
+//# sourceMappingURL=security.js.map

package/dist/http/core/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/http/core/security.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,SAAgC,EAAE;IAChE,MAAM,OAAO,GAA2B;QACtC,wBAAwB,EAAE,SAAS;KACpC,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC;IAC9F,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;IAC9F,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,CAAC,yBAAyB,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC;IACzF,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACpC,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAmBD,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC7E,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAA0B,EAC1B,MAAc,EACd,SAAqB,EAAE,EACvB,kBAAkB,GAAG,KAAK;IAE1B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC;IAC7E,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,OAAO,CAAC,6BAA6B,CAAC,GAAG,WAAW,CAAC;IACrD,IAAI,WAAW,KAAK,GAAG;QAAE,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;IACpD,IAAI,MAAM,CAAC,gBAAgB;QAAE,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IAClF,IAAI,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAClC,OAAO,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B,EAAE,SAAqC;IACxF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,SAAS,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/http/core/validation.d.ts

@@ -0,0 +1,9 @@
+import type { KernelRequest, RouteSchemas } from './ports.js';
+export interface ValidatedRequest {
+    body: unknown;
+    query: unknown;
+    params: unknown;
+}
+/** Valideert de request-onderdelen; verzamelt álle overtredingen over body/query/params heen. */
+export declare function validateRequest(req: KernelRequest, schemas?: RouteSchemas): ValidatedRequest;
+//# sourceMappingURL=validation.d.ts.map

package/dist/http/core/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/http/core/validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,CAc5F"}