@seifer-webapp-factory/kits 0.1.0

package/dist/backend/persistence/core/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../backend/src/persistence/core/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAGxE,qBAAa,cAAc,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,GAAG,OAAO;;gBAKzC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAM3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAetC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAMnC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAK5D,IAAI,CAAC,OAAO,GAAE,WAAW,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAgBhD,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAO/D,kFAAkF;IAC5E,IAAI,CAAC,OAAO,GAAE,WAAW,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAMzE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAepD,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAuBvC"}

package/dist/backend/persistence/core/repository.js

@@ -0,0 +1,113 @@
+/**
+ * US-0304 — Generieke, getypte base-repository met CRUD- en query-primitives.
+ *
+ * Generiek over een geïnjecteerd entity-type + mapping (tabelnaam/kolommen); geen hardgecodeerde
+ * tabellen of domeinkennis. Operaties lopen via {@link Pool.execute}, dus ze sluiten automatisch aan
+ * op een actieve transactie-context (US-0302). Fouten lekken geen ruwe SQL of secrets (US-0304 AC3).
+ */
+import { QueryError, UniqueConstraintError } from './errors.js';
+import { buildOrderBy, buildWhere, quoteIdent } from './sql.js';
+export class BaseRepository {
+    #pool;
+    #mapping;
+    #idColumn;
+    constructor(pool, mapping) {
+        this.#pool = pool;
+        this.#mapping = mapping;
+        this.#idColumn = mapping.idColumn ?? 'id';
+    }
+    async insert(entity) {
+        const row = { ...entity };
+        if (row[this.#idColumn] === undefined && this.#mapping.generateId) {
+            row[this.#idColumn] = this.#mapping.generateId();
+        }
+        const columns = this.#persistableColumns().filter((c) => row[c] !== undefined);
+        const values = columns.map((c) => row[c]);
+        const placeholders = columns.map((_, i) => `$${i + 1}`);
+        const sql = `INSERT INTO ${this.#table()} (${columns.map(quoteIdent).join(', ')}) ` +
+            `VALUES (${placeholders.join(', ')}) RETURNING *`;
+        const result = await this.#run(sql, values);
+        return result.rows[0];
+    }
+    async findById(id) {
+        const sql = `SELECT * FROM ${this.#table()} WHERE ${quoteIdent(this.#idColumn)} = $1 LIMIT 1`;
+        const result = await this.#run(sql, [id]);
+        return result.rows[0] ?? null;
+    }
+    async findOne(filter) {
+        const rows = await this.find({ ...(filter ? { filter } : {}), limit: 1 });
+        return rows[0] ?? null;
+    }
+    async find(options = {}) {
+        const where = buildWhere(options.filter);
+        const params = [...where.params];
+        let sql = `SELECT * FROM ${this.#table()}${where.text}${buildOrderBy(options.sort)}`;
+        if (options.limit !== undefined) {
+            params.push(options.limit);
+            sql += ` LIMIT $${params.length}`;
+        }
+        if (options.offset !== undefined) {
+            params.push(options.offset);
+            sql += ` OFFSET $${params.length}`;
+        }
+        const result = await this.#run(sql, params);
+        return result.rows;
+    }
+    async count(filter) {
+        const where = buildWhere(filter);
+        const sql = `SELECT COUNT(*)::int AS "count" FROM ${this.#table()}${where.text}`;
+        const result = await this.#run(sql, where.params);
+        return Number(result.rows[0]?.count ?? 0);
+    }
+    /** Combineert `find` + `count` voor een pagina met totaalaantal (US-0304 AC2). */
+    async page(options = {}) {
+        const data = await this.find(options);
+        const total = await this.count(options.filter);
+        return { data, total };
+    }
+    async update(id, patch) {
+        const columns = this.#persistableColumns().filter((c) => c !== this.#idColumn && patch[c] !== undefined);
+        if (columns.length === 0)
+            return this.findById(id);
+        const assignments = columns.map((c, i) => `${quoteIdent(c)} = $${i + 1}`);
+        const params = columns.map((c) => patch[c]);
+        params.push(id);
+        const sql = `UPDATE ${this.#table()} SET ${assignments.join(', ')} ` +
+            `WHERE ${quoteIdent(this.#idColumn)} = $${params.length} RETURNING *`;
+        const result = await this.#run(sql, params);
+        return result.rows[0] ?? null;
+    }
+    async delete(id) {
+        const sql = `DELETE FROM ${this.#table()} WHERE ${quoteIdent(this.#idColumn)} = $1`;
+        const result = await this.#run(sql, [id]);
+        return result.rowCount > 0;
+    }
+    #table() {
+        return quoteIdent(this.#mapping.table);
+    }
+    #persistableColumns() {
+        const set = new Set(this.#mapping.columns);
+        set.add(this.#idColumn);
+        return [...set];
+    }
+    async #run(sql, params) {
+        try {
+            return await this.#pool.execute(sql, params);
+        }
+        catch (error) {
+            throw mapDbError(error);
+        }
+    }
+}
+function mapDbError(error) {
+    if (error instanceof UniqueConstraintError)
+        return error;
+    const code = error?.code;
+    if (code === '23505') {
+        const constraint = error.constraint;
+        return new UniqueConstraintError(constraint);
+    }
+    // Geen ruwe SQL of driver-details doorgeven.
+    return new QueryError();
+}
+//# sourceMappingURL=repository.js.map

package/dist/backend/persistence/core/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../../backend/src/persistence/core/repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEhE,MAAM,OAAO,cAAc;IAChB,KAAK,CAAO;IACZ,QAAQ,CAAmB;IAC3B,SAAS,CAAS;IAE3B,YAAY,IAAU,EAAE,OAAyB;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAkB;QAC7B,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GACP,eAAe,IAAI,CAAC,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACvE,WAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAM,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAM;QACnB,MAAM,GAAG,GAAG,iBAAiB,IAAI,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAI,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAgC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAA0B,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,MAA6C,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,iBAAiB,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,GAAG,IAAI,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,GAAG,IAAI,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAiC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,MAA6C,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,wCAAwC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAoB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,IAAI,CAAC,UAA0B,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAM,EAAE,KAAiB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,IAAK,KAAiC,CAAC,CAAC,CAAC,KAAK,SAAS,CACnF,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,GAAG,GACP,UAAU,IAAI,CAAC,MAAM,EAAE,QAAQ,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACxD,SAAS,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,MAAM,CAAC,MAAM,cAAc,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAM;QACjB,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM;QACJ,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,mBAAmB;QACjB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CAAgB,GAAW,EAAE,MAA0B;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,YAAY,qBAAqB;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,IAAI,GAAI,KAA2B,EAAE,IAAI,CAAC;IAChD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,GAAI,KAAiC,CAAC,UAAU,CAAC;QACjE,OAAO,IAAI,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,6CAA6C;IAC7C,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC"}

package/dist/backend/persistence/core/sql.d.ts

@@ -0,0 +1,13 @@
+/** Valideert en quote't een identifier; gooit bij een ongeldige naam (injectiebescherming). */
+export declare function quoteIdent(name: string): string;
+export interface WhereClause {
+    text: string;
+    params: unknown[];
+}
+/** Bouwt een `WHERE a = $1 AND b = $2`-clausule uit een gelijkheids-filter. */
+export declare function buildWhere(filter: Record<string, unknown> | undefined, startIndex?: number): WhereClause;
+export declare function buildOrderBy(sort: {
+    field: string;
+    direction: 'asc' | 'desc';
+}[] | undefined): string;
+//# sourceMappingURL=sql.d.ts.map

package/dist/backend/persistence/core/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../../../backend/src/persistence/core/sql.ts"],"names":[],"mappings":"AAQA,+FAA+F;AAC/F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,UAAU,SAAI,GACb,WAAW,CAWb;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;CAAE,EAAE,GAAG,SAAS,GAC/D,MAAM,CAIR"}

package/dist/backend/persistence/core/sql.js

@@ -0,0 +1,35 @@
+/**
+ * Kleine, veilige SQL-builder voor de base-repository. Identifiers worden gevalideerd en gequote
+ * (geen interpolatie van waarden — alles gaat via parameters `$n`).
+ */
+import { PersistenceError } from './errors.js';
+const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Valideert en quote't een identifier; gooit bij een ongeldige naam (injectiebescherming). */
+export function quoteIdent(name) {
+    if (!IDENT.test(name)) {
+        throw new PersistenceError(`Ongeldige identifier: ${JSON.stringify(name)}`);
+    }
+    return `"${name}"`;
+}
+/** Bouwt een `WHERE a = $1 AND b = $2`-clausule uit een gelijkheids-filter. */
+export function buildWhere(filter, startIndex = 1) {
+    if (!filter)
+        return { text: '', params: [] };
+    const entries = Object.entries(filter).filter(([, v]) => v !== undefined);
+    if (entries.length === 0)
+        return { text: '', params: [] };
+    const parts = [];
+    const params = [];
+    entries.forEach(([col, value], i) => {
+        parts.push(`${quoteIdent(col)} = $${startIndex + i}`);
+        params.push(value);
+    });
+    return { text: ` WHERE ${parts.join(' AND ')}`, params };
+}
+export function buildOrderBy(sort) {
+    if (!sort || sort.length === 0)
+        return '';
+    const parts = sort.map((s) => `${quoteIdent(s.field)} ${s.direction === 'desc' ? 'DESC' : 'ASC'}`);
+    return ` ORDER BY ${parts.join(', ')}`;
+}
+//# sourceMappingURL=sql.js.map

package/dist/backend/persistence/core/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../../../../backend/src/persistence/core/sql.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,KAAK,GAAG,0BAA0B,CAAC;AAEzC,+FAA+F;AAC/F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC;AAOD,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CACxB,MAA2C,EAC3C,UAAU,GAAG,CAAC;IAEd,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,UAAU,GAAG,CAAC,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAgE;IAEhE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACnG,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzC,CAAC"}

package/dist/backend/persistence/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `persistence` kit — domein-loos DB-fundament: connectie-pool + health, transactie-scope
+ * (unit-of-work met savepoints), migratie-runner, generieke base-repository en een testcontainer-
+ * harness. Framework-/ORM-neutraal via de {@link Driver}-poort; entities en migraties worden
+ * geïnjecteerd.
+ */
+export type { Driver, DriverConnection, Executor, Pool, PoolConfig, PoolStats, QueryResult, Row, HealthResult, HealthState, Migration, MigrationContext, MigrationStatus, EntityMapping, FindOptions, } from './core/ports.js';
+export { createPool } from './core/pool.js';
+export { MigrationRunner, type MigrationRunnerOptions } from './core/migrations.js';
+export { BaseRepository } from './core/repository.js';
+export { PersistenceError, ConnectionError, PoolTimeoutError, QueryError, UniqueConstraintError, MigrationError, redactReason, } from './core/errors.js';
+export { quoteIdent } from './core/sql.js';
+export { inMemoryDriver } from './adapters/in-memory-driver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/persistence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../backend/src/persistence/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,YAAY,EACV,MAAM,EACN,gBAAgB,EAChB,QAAQ,EACR,IAAI,EACJ,UAAU,EACV,SAAS,EACT,WAAW,EACX,GAAG,EACH,YAAY,EACZ,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/backend/persistence/index.js

@@ -0,0 +1,22 @@
+/**
+ * `persistence` kit — domein-loos DB-fundament: connectie-pool + health, transactie-scope
+ * (unit-of-work met savepoints), migratie-runner, generieke base-repository en een testcontainer-
+ * harness. Framework-/ORM-neutraal via de {@link Driver}-poort; entities en migraties worden
+ * geïnjecteerd.
+ */
+// Pool + transacties (US-0301/US-0302)
+export { createPool } from './core/pool.js';
+// Migraties (US-0303)
+export { MigrationRunner } from './core/migrations.js';
+// Base-repository (US-0304)
+export { BaseRepository } from './core/repository.js';
+// Fouten
+export { PersistenceError, ConnectionError, PoolTimeoutError, QueryError, UniqueConstraintError, MigrationError, redactReason, } from './core/errors.js';
+// SQL-helpers
+export { quoteIdent } from './core/sql.js';
+// Dep-vrije adapter (voor tests en consumer-tests zonder Docker)
+export { inMemoryDriver } from './adapters/in-memory-driver.js';
+// De echte Postgres-driver + testcontainer-harness zitten achter de subpath
+// `@seifer-webapp-factory/kits/backend/persistence/pg` (harde `pg`/`testcontainers`-import), zodat de
+// core-kit zonder die deps bruikbaar blijft.
+//# sourceMappingURL=index.js.map

package/dist/backend/persistence/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../backend/src/persistence/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqBH,uCAAuC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,sBAAsB;AACtB,OAAO,EAAE,eAAe,EAA+B,MAAM,sBAAsB,CAAC;AAEpF,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,SAAS;AACT,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,cAAc;AACd,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,4EAA4E;AAC5E,sGAAsG;AACtG,6CAA6C"}

package/dist/backend/persistence/pg.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Subpath `@seifer-webapp-factory/kits/backend/persistence/pg` — de echte Postgres-driver en de testcontainer-
+ * harness. Vereist de optionele peer-dependencies `pg` en (voor de harness) `testcontainers`.
+ */
+export { pgDriver, type PgConnectionConfig } from './adapters/pg-driver.js';
+export { startTestDatabase, postgresContainerFactory, type TestDatabase, type TestDatabaseOptions, type ContainerFactory, type StartedDatabase, type PostgresContainerOptions, } from './adapters/testcontainer-harness.js';
+//# sourceMappingURL=pg.d.ts.map

package/dist/backend/persistence/pg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg.d.ts","sourceRoot":"","sources":["../../../backend/src/persistence/pg.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,qCAAqC,CAAC"}

package/dist/backend/persistence/pg.js

@@ -0,0 +1,7 @@
+/**
+ * Subpath `@seifer-webapp-factory/kits/backend/persistence/pg` — de echte Postgres-driver en de testcontainer-
+ * harness. Vereist de optionele peer-dependencies `pg` en (voor de harness) `testcontainers`.
+ */
+export { pgDriver } from './adapters/pg-driver.js';
+export { startTestDatabase, postgresContainerFactory, } from './adapters/testcontainer-harness.js';
+//# sourceMappingURL=pg.js.map

package/dist/backend/persistence/pg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg.js","sourceRoot":"","sources":["../../../backend/src/persistence/pg.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAA2B,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GAMzB,MAAM,qCAAqC,CAAC"}

package/dist/backend/privacy/adapters/audit-sink.d.ts

@@ -0,0 +1,19 @@
+/**
+ * US-1202/US-1203/US-1204 — {@link AuditSink}-adapter op de audit-log-kit. Mapt privacy-events naar een
+ * append op de geïnjecteerde audit-log. De consumer registreert de gebruikte `action`-namen als
+ * event-types in de audit-log (bv. `privacy.export`, `privacy.erasure`, `privacy.consent.granted`).
+ */
+import type { AuditSink } from '../core/ports.js';
+/** Minimaal contract dat we van de audit-log nodig hebben (structureel, geen harde import). */
+export interface AuditLogLike {
+    append(input: {
+        actor: string;
+        action: string;
+        target: string;
+        meta?: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+export declare function auditLogSink(auditLog: AuditLogLike, options: {
+    actor: string;
+}): AuditSink;
+//# sourceMappingURL=audit-sink.d.ts.map

package/dist/backend/privacy/adapters/audit-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sink.d.ts","sourceRoot":"","sources":["../../../../backend/src/privacy/adapters/audit-sink.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAErE,+FAA+F;AAC/F,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpH;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAW1F"}

package/dist/backend/privacy/adapters/audit-sink.js

@@ -0,0 +1,13 @@
+export function auditLogSink(auditLog, options) {
+    return {
+        async record(event) {
+            await auditLog.append({
+                actor: options.actor,
+                action: event.action,
+                target: event.subjectId,
+                meta: { complete: event.complete, ...(event.meta ?? {}) },
+            });
+        },
+    };
+}
+//# sourceMappingURL=audit-sink.js.map

package/dist/backend/privacy/adapters/audit-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sink.js","sourceRoot":"","sources":["../../../../backend/src/privacy/adapters/audit-sink.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,YAAY,CAAC,QAAsB,EAAE,OAA0B;IAC7E,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAwB;YACnC,MAAM,QAAQ,CAAC,MAAM,CAAC;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,SAAS;gBACvB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/privacy/adapters/in-memory-consent-store.d.ts

@@ -0,0 +1,7 @@
+/**
+ * US-1204 — In-memory {@link ConsentStore} (tests/dev). Append-only: geen update/delete, alleen toevoegen
+ * en lezen; `latest` geeft het laatst toegevoegde record voor (subject, purpose).
+ */
+import type { ConsentStore } from '../core/ports.js';
+export declare function inMemoryConsentStore(): ConsentStore;
+//# sourceMappingURL=in-memory-consent-store.d.ts.map

package/dist/backend/privacy/adapters/in-memory-consent-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-consent-store.d.ts","sourceRoot":"","sources":["../../../../backend/src/privacy/adapters/in-memory-consent-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE,wBAAgB,oBAAoB,IAAI,YAAY,CAkBnD"}

package/dist/backend/privacy/adapters/in-memory-consent-store.js

@@ -0,0 +1,18 @@
+export function inMemoryConsentStore() {
+    const records = [];
+    const matching = (subjectId, purpose) => records.filter((r) => r.subjectId === subjectId && r.purpose === purpose);
+    return {
+        async append(record) {
+            records.push({ ...record });
+        },
+        async history(subjectId, purpose) {
+            return matching(subjectId, purpose).map((r) => ({ ...r }));
+        },
+        async latest(subjectId, purpose) {
+            const found = matching(subjectId, purpose);
+            const last = found[found.length - 1];
+            return last ? { ...last } : null;
+        },
+    };
+}
+//# sourceMappingURL=in-memory-consent-store.js.map

package/dist/backend/privacy/adapters/in-memory-consent-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-consent-store.js","sourceRoot":"","sources":["../../../../backend/src/privacy/adapters/in-memory-consent-store.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAE,EAAE,CACtD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAE5E,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO;YAC9B,OAAO,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/privacy/adapters/pg-consent-store.d.ts

@@ -0,0 +1,26 @@
+/**
+ * US-1204 — Postgres {@link ConsentStore} (productie). Append-only tabel; records worden alleen
+ * toegevoegd en gelezen (`latest` = hoogste id per subject/purpose). Werkt tegen een structurele
+ * `SqlExec` (compatibel met de persistence-kit `Pool`) — geen harde `pg`-dep.
+ */
+import type { ConsentStore } from '../core/ports.js';
+export interface SqlResult<R = Record<string, unknown>> {
+    rows: R[];
+    rowCount: number;
+}
+export interface SqlExec {
+    execute<R = Record<string, unknown>>(sql: string, params?: readonly unknown[]): Promise<SqlResult<R>>;
+}
+export interface PgConsentStoreOptions {
+    table?: string;
+}
+/**
+ * Migratie voor de consent-tabel (append-only door conventie: de adapter kent geen update/delete-pad).
+ * Vorm compatibel met de persistence-kit `Migration` (id + up).
+ */
+export declare function consentMigration(table?: string): {
+    id: string;
+    up(ctx: SqlExec): Promise<void>;
+};
+export declare function pgConsentStore(executor: SqlExec, options?: PgConsentStoreOptions): ConsentStore;
+//# sourceMappingURL=pg-consent-store.d.ts.map

package/dist/backend/privacy/adapters/pg-consent-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-consent-store.d.ts","sourceRoot":"","sources":["../../../../backend/src/privacy/adapters/pg-consent-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,OAAO;IACtB,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACvG;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,SAAoB;;YAIxC,OAAO;EAYxB;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAmCnG"}

package/dist/backend/privacy/adapters/pg-consent-store.js

@@ -0,0 +1,43 @@
+/**
+ * Migratie voor de consent-tabel (append-only door conventie: de adapter kent geen update/delete-pad).
+ * Vorm compatibel met de persistence-kit `Migration` (id + up).
+ */
+export function consentMigration(table = 'consent_records') {
+    const q = `"${table}"`;
+    return {
+        id: '0001_consent_records',
+        async up(ctx) {
+            await ctx.execute(`CREATE TABLE IF NOT EXISTS ${q} (` +
+                `id bigserial PRIMARY KEY, subject_id text NOT NULL, purpose text NOT NULL, ` +
+                `status text NOT NULL CHECK (status IN ('granted', 'withdrawn')), ` +
+                `policy_version text, "timestamp" bigint NOT NULL)`);
+            await ctx.execute(`CREATE INDEX IF NOT EXISTS "${table}_subject_purpose_idx" ON ${q} (subject_id, purpose, id)`);
+        },
+    };
+}
+export function pgConsentStore(executor, options = {}) {
+    const table = options.table ?? 'consent_records';
+    const q = `"${table}"`;
+    const mapRow = (row) => ({
+        subjectId: String(row['subject_id']),
+        purpose: String(row['purpose']),
+        status: row['status'],
+        ...(row['policy_version'] != null ? { policyVersion: String(row['policy_version']) } : {}),
+        timestamp: Number(row['timestamp']),
+    });
+    return {
+        async append(record) {
+            await executor.execute(`INSERT INTO ${q} (subject_id, purpose, status, policy_version, "timestamp") VALUES ($1, $2, $3, $4, $5)`, [record.subjectId, record.purpose, record.status, record.policyVersion ?? null, record.timestamp]);
+        },
+        async history(subjectId, purpose) {
+            const result = await executor.execute(`SELECT * FROM ${q} WHERE subject_id = $1 AND purpose = $2 ORDER BY id ASC`, [subjectId, purpose]);
+            return result.rows.map(mapRow);
+        },
+        async latest(subjectId, purpose) {
+            const result = await executor.execute(`SELECT * FROM ${q} WHERE subject_id = $1 AND purpose = $2 ORDER BY id DESC LIMIT 1`, [subjectId, purpose]);
+            const row = result.rows[0];
+            return row ? mapRow(row) : null;
+        },
+    };
+}
+//# sourceMappingURL=pg-consent-store.js.map

package/dist/backend/privacy/adapters/pg-consent-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-consent-store.js","sourceRoot":"","sources":["../../../../backend/src/privacy/adapters/pg-consent-store.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAAG,iBAAiB;IACxD,MAAM,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC;IACvB,OAAO;QACL,EAAE,EAAE,sBAAsB;QAC1B,KAAK,CAAC,EAAE,CAAC,GAAY;YACnB,MAAM,GAAG,CAAC,OAAO,CACf,8BAA8B,CAAC,IAAI;gBACjC,6EAA6E;gBAC7E,mEAAmE;gBACnE,mDAAmD,CACtD,CAAC;YACF,MAAM,GAAG,CAAC,OAAO,CACf,+BAA+B,KAAK,4BAA4B,CAAC,4BAA4B,CAC9F,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAiB,EAAE,UAAiC,EAAE;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,MAAM,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC;IAEvB,MAAM,MAAM,GAAG,CAAC,GAA4B,EAAiB,EAAE,CAAC,CAAC;QAC/D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAA4B;QAChD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;KACpC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,QAAQ,CAAC,OAAO,CACpB,eAAe,CAAC,yFAAyF,EACzG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAClG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO;YAC9B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,iBAAiB,CAAC,yDAAyD,EAC3E,CAAC,SAAS,EAAE,OAAO,CAAC,CACrB,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,iBAAiB,CAAC,kEAAkE,EACpF,CAAC,SAAS,EAAE,OAAO,CAAC,CACrB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/privacy/core/consent.d.ts

@@ -0,0 +1,35 @@
+/**
+ * US-1204 — Consent-registry (AVG art. 7). Legt per (subject, purpose) append-only records vast met
+ * status/policyversie/tijdstempel; een intrekking overschrijft niet maar voegt toe. US-1205 — een
+ * afgeleide analytics-opt-out-flag met veilige default (opt-out bij ontbrekende toestemming).
+ */
+import type { AuditSink, Clock, ConsentRecord, ConsentStatus, ConsentStore } from './ports.js';
+export interface ConsentStatusResult {
+    status: ConsentStatus | 'none';
+    policyVersion?: string;
+    timestamp?: number;
+}
+export interface ConsentRegistry {
+    grant(subjectId: string, purpose: string, options?: {
+        policyVersion?: string;
+    }): Promise<ConsentRecord>;
+    withdraw(subjectId: string, purpose: string): Promise<ConsentRecord>;
+    status(subjectId: string, purpose: string): Promise<ConsentStatusResult>;
+    history(subjectId: string, purpose: string): Promise<ConsentRecord[]>;
+}
+export interface ConsentOptions {
+    clock?: Clock;
+    audit?: AuditSink;
+}
+export declare function createConsentRegistry(store: ConsentStore, options?: ConsentOptions): ConsentRegistry;
+export interface AnalyticsOptOut {
+    isAnalyticsAllowed(subjectId: string): Promise<boolean>;
+}
+/**
+ * Leidt een boolean opt-out-flag af uit de consent-status voor het doel "analytics". Leest live uit de
+ * consent-registry (geen cache), zodat een intrekking direct doorwerkt; default is opt-out.
+ */
+export declare function analyticsOptOut(consent: ConsentRegistry, options?: {
+    purpose?: string;
+}): AnalyticsOptOut;
+//# sourceMappingURL=consent.d.ts.map

package/dist/backend/privacy/core/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../../../backend/src/privacy/core/consent.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACrE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,cAAmB,GAAG,eAAe,CAwCxG;AAID,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,eAAe,CAQ7G"}

package/dist/backend/privacy/core/consent.js

@@ -0,0 +1,49 @@
+export function createConsentRegistry(store, options = {}) {
+    const clock = options.clock ?? Date.now;
+    const write = async (subjectId, purpose, status, policyVersion) => {
+        const record = {
+            subjectId,
+            purpose,
+            status,
+            timestamp: clock(),
+            ...(policyVersion !== undefined ? { policyVersion } : {}),
+        };
+        await store.append(record);
+        await options.audit?.record({
+            action: `privacy.consent.${status}`,
+            subjectId,
+            complete: true,
+            meta: { purpose, ...(policyVersion !== undefined ? { policyVersion } : {}) },
+        });
+        return record;
+    };
+    return {
+        grant: (subjectId, purpose, opts = {}) => write(subjectId, purpose, 'granted', opts.policyVersion),
+        withdraw: (subjectId, purpose) => write(subjectId, purpose, 'withdrawn'),
+        async status(subjectId, purpose) {
+            const latest = await store.latest(subjectId, purpose);
+            if (!latest)
+                return { status: 'none' };
+            return {
+                status: latest.status,
+                ...(latest.policyVersion !== undefined ? { policyVersion: latest.policyVersion } : {}),
+                timestamp: latest.timestamp,
+            };
+        },
+        history: (subjectId, purpose) => store.history(subjectId, purpose),
+    };
+}
+/**
+ * Leidt een boolean opt-out-flag af uit de consent-status voor het doel "analytics". Leest live uit de
+ * consent-registry (geen cache), zodat een intrekking direct doorwerkt; default is opt-out.
+ */
+export function analyticsOptOut(consent, options = {}) {
+    const purpose = options.purpose ?? 'analytics';
+    return {
+        async isAnalyticsAllowed(subjectId) {
+            const result = await consent.status(subjectId, purpose);
+            return result.status === 'granted';
+        },
+    };
+}
+//# sourceMappingURL=consent.js.map

package/dist/backend/privacy/core/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../../../backend/src/privacy/core/consent.ts"],"names":[],"mappings":"AAyBA,MAAM,UAAU,qBAAqB,CAAC,KAAmB,EAAE,UAA0B,EAAE;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,EACjB,SAAiB,EACjB,OAAe,EACf,MAAqB,EACrB,aAAsB,EACE,EAAE;QAC1B,MAAM,MAAM,GAAkB;YAC5B,SAAS;YACT,OAAO;YACP,MAAM;YACN,SAAS,EAAE,KAAK,EAAE;YAClB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;QACF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YAC1B,MAAM,EAAE,mBAAmB,MAAM,EAAE;YACnC,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC7E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC;QAClG,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC;QACxE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;KACnE,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,UAAgC,EAAE;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC;IAC/C,OAAO;QACL,KAAK,CAAC,kBAAkB,CAAC,SAAS;YAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/privacy/core/erasure.d.ts

@@ -0,0 +1,22 @@
+import type { AuditSink, Clock, EraseStrategy } from './ports.js';
+import type { ProviderRegistry } from './registry.js';
+export interface ErasureReportEntry {
+    providerId: string;
+    status: 'erased' | 'failed';
+    strategy?: EraseStrategy;
+    affected?: number;
+    reason?: string;
+}
+export interface ErasureReport {
+    subjectId: string;
+    generatedAt: number;
+    complete: boolean;
+    retryable: boolean;
+    entries: ErasureReportEntry[];
+}
+export interface ErasureOptions {
+    audit?: AuditSink;
+    clock?: Clock;
+}
+export declare function eraseSubject(registry: ProviderRegistry, subjectId: string, options?: ErasureOptions): Promise<ErasureReport>;
+//# sourceMappingURL=erasure.d.ts.map

package/dist/backend/privacy/core/erasure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.d.ts","sourceRoot":"","sources":["../../../../backend/src/privacy/core/erasure.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CA4BxB"}

package/dist/backend/privacy/core/erasure.js

@@ -0,0 +1,35 @@
+/**
+ * US-1203 — Erasure-orkestratie (recht op vergetelheid, AVG art. 17). Roept `erase(subjectId)` aan op
+ * elke provider en verzamelt per provider de strategie (deleted/anonymized) + aantal getroffen records.
+ * Een gedeeltelijke mislukking maakt het rapport `incomplete` + `retryable`, zodat het subject
+ * aangemerkt blijft voor herhaling.
+ */
+import { redactReason } from './errors.js';
+export async function eraseSubject(registry, subjectId, options = {}) {
+    const clock = options.clock ?? Date.now;
+    const entries = [];
+    let complete = true;
+    for (const provider of registry.list()) {
+        try {
+            const result = await provider.erase(subjectId);
+            entries.push({
+                providerId: provider.id,
+                status: 'erased',
+                strategy: result.strategy,
+                affected: result.affected,
+            });
+        }
+        catch (error) {
+            complete = false;
+            entries.push({ providerId: provider.id, status: 'failed', reason: redactReason(error) });
+        }
+    }
+    await options.audit?.record({
+        action: 'privacy.erasure',
+        subjectId,
+        complete,
+        meta: { entries: entries.map((e) => ({ id: e.providerId, status: e.status })) },
+    });
+    return { subjectId, generatedAt: clock(), complete, retryable: !complete, entries };
+}
+//# sourceMappingURL=erasure.js.map

package/dist/backend/privacy/core/erasure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.js","sourceRoot":"","sources":["../../../../backend/src/privacy/core/erasure.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyB3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA0B,EAC1B,SAAiB,EACjB,UAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACxC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,GAAG,KAAK,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1B,MAAM,EAAE,iBAAiB;QACzB,SAAS;QACT,QAAQ;QACR,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;KAChF,CAAC,CAAC;IAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC"}

package/dist/backend/privacy/core/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Foutentaxonomie voor privacy-kit. Foutredenen in export-/erasure-rapporten worden geredigeerd.
+ */
+export declare class PrivacyError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** Twee providers met hetzelfde id (US-1201 AC2). */
+export declare class DuplicateProviderError extends PrivacyError {
+    constructor(id: string);
+}
+/** Registratie na het afsluiten (sealen) van de registry (US-1201 AC3). */
+export declare class SealedRegistryError extends PrivacyError {
+    constructor();
+}
+/** Redigeert een foutreden zodat er geen payload/secret in een rapport belandt. */
+export declare function redactReason(input: unknown): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/backend/privacy/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../backend/src/privacy/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM1C;AAED,qDAAqD;AACrD,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,EAAE,EAAE,MAAM;CAGvB;AAED,2EAA2E;AAC3E,qBAAa,mBAAoB,SAAQ,YAAY;;CAIpD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGnD"}