@seifer-webapp-factory/kits 0.1.0

package/dist/backend/access-control/nestjs/access-control.module.d.ts

@@ -0,0 +1,34 @@
+/**
+ * NestJS-adapter voor US-0502: een `@RequirePermissions(...)`-decorator en een `PermissionsGuard` die
+ * de effectieve permissies van het subject resolvet en de toegang toestaat/weigert (default-deny). De
+ * pure enforcement-logica zit in de core; dit is slechts de framework-binding. `@nestjs/common` en
+ * `@nestjs/core` zijn optionele peer-dependencies.
+ */
+import { type CanActivate, type DynamicModule, type ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { Rbac } from '../core/rbac.js';
+import type { Subject } from '../core/ports.js';
+export declare const PERMISSIONS_KEY = "access-control:permissions";
+export declare const RBAC_TOKEN: unique symbol;
+export declare const ACCESS_OPTIONS: unique symbol;
+/** Declareert de vereiste permissie(s) op een route-handler of controller. */
+export declare const RequirePermissions: (...permissions: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export interface AccessControlOptions {
+    rbac: Rbac;
+    /** Haalt het subject uit het request. Default `request.user`. */
+    getSubject?: (request: unknown) => Subject | null | undefined;
+    /** Default-beleid voor handlers zonder permissie-declaratie. Default `deny`. */
+    defaultDecision?: 'allow' | 'deny';
+    global?: boolean;
+}
+export declare class PermissionsGuard implements CanActivate {
+    private readonly reflector;
+    private readonly rbac;
+    private readonly options;
+    constructor(reflector: Reflector, rbac: Rbac, options: AccessControlOptions);
+    canActivate(context: ExecutionContext): boolean;
+}
+export declare class AccessControlModule {
+    static forRoot(options: AccessControlOptions): DynamicModule;
+}
+//# sourceMappingURL=access-control.module.d.ts.map

package/dist/backend/access-control/nestjs/access-control.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.module.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/nestjs/access-control.module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAC5D,eAAO,MAAM,UAAU,eAAoC,CAAC;AAC5D,eAAO,MAAM,cAAc,eAAuC,CAAC;AAEnE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,GAAI,GAAG,aAAa,MAAM,EAAE,qDAChB,CAAC;AAE5C,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,iEAAiE;IACjE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9D,gFAAgF;IAChF,eAAe,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBACa,gBAAiB,YAAW,WAAW;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFZ,SAAS,EAAE,SAAS,EACnB,IAAI,EAAE,IAAI,EACN,OAAO,EAAE,oBAAoB;IAGxE,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAwBhD;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;CAa7D"}

package/dist/backend/access-control/nestjs/access-control.module.js

@@ -0,0 +1,80 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+/**
+ * NestJS-adapter voor US-0502: een `@RequirePermissions(...)`-decorator en een `PermissionsGuard` die
+ * de effectieve permissies van het subject resolvet en de toegang toestaat/weigert (default-deny). De
+ * pure enforcement-logica zit in de core; dit is slechts de framework-binding. `@nestjs/common` en
+ * `@nestjs/core` zijn optionele peer-dependencies.
+ */
+import { ForbiddenException, Inject, Injectable, SetMetadata, } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { authorizePermissions } from '../core/enforcement.js';
+export const PERMISSIONS_KEY = 'access-control:permissions';
+export const RBAC_TOKEN = Symbol.for('access-control.rbac');
+export const ACCESS_OPTIONS = Symbol.for('access-control.options');
+/** Declareert de vereiste permissie(s) op een route-handler of controller. */
+export const RequirePermissions = (...permissions) => SetMetadata(PERMISSIONS_KEY, permissions);
+let PermissionsGuard = class PermissionsGuard {
+    reflector;
+    rbac;
+    options;
+    constructor(reflector, rbac, options) {
+        this.reflector = reflector;
+        this.rbac = rbac;
+        this.options = options;
+    }
+    canActivate(context) {
+        const required = this.reflector.getAllAndOverride(PERMISSIONS_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]) ?? [];
+        const request = context.switchToHttp().getRequest();
+        const getSubject = this.options.getSubject ?? ((r) => r.user);
+        const subject = getSubject(request);
+        const params = {
+            subject,
+            required,
+            rbac: this.rbac,
+            ...(this.options.defaultDecision ? { defaultDecision: this.options.defaultDecision } : {}),
+        };
+        if (!authorizePermissions(params).allowed) {
+            // Generieke 403 — geen info over welke permissies/rollen bestaan.
+            throw new ForbiddenException();
+        }
+        return true;
+    }
+};
+PermissionsGuard = __decorate([
+    Injectable(),
+    __param(0, Inject(Reflector)),
+    __param(1, Inject(RBAC_TOKEN)),
+    __param(2, Inject(ACCESS_OPTIONS)),
+    __metadata("design:paramtypes", [Reflector, Object, Object])
+], PermissionsGuard);
+export { PermissionsGuard };
+export class AccessControlModule {
+    static forRoot(options) {
+        const providers = [
+            { provide: RBAC_TOKEN, useValue: options.rbac },
+            { provide: ACCESS_OPTIONS, useValue: options },
+            PermissionsGuard,
+        ];
+        return {
+            module: AccessControlModule,
+            global: options.global ?? true,
+            providers,
+            exports: [PermissionsGuard, RBAC_TOKEN, ACCESS_OPTIONS],
+        };
+    }
+}
+//# sourceMappingURL=access-control.module.js.map

package/dist/backend/access-control/nestjs/access-control.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.module.js","sourceRoot":"","sources":["../../../../backend/src/access-control/nestjs/access-control.module.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;GAKG;AACH,OAAO,EACL,kBAAkB,EAClB,MAAM,EACN,UAAU,EACV,WAAW,GAKZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAI9D,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAC5D,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAEnE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,WAAqB,EAAE,EAAE,CAC7D,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;AAYrC,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAEW;IACC;IACI;IAH3C,YACsC,SAAoB,EACnB,IAAU,EACN,OAA6B;QAFlC,cAAS,GAAT,SAAS,CAAW;QACnB,SAAI,GAAJ,IAAI,CAAM;QACN,YAAO,GAAP,OAAO,CAAsB;IACrE,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,MAAM,QAAQ,GACZ,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,eAAe,EAAE;YAC1D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,IAAI,EAAE,CAAC;QAEX,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,UAAU,GACd,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAE,CAA+B,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG;YACb,OAAO;YACP,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,kEAAkE;YAClE,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA/BY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,SAAS,CAAC,CAAA;IACjB,WAAA,MAAM,CAAC,UAAU,CAAC,CAAA;IAClB,WAAA,MAAM,CAAC,cAAc,CAAC,CAAA;qCAFwB,SAAS;GAF/C,gBAAgB,CA+B5B;;AAED,MAAM,OAAO,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,MAAM,SAAS,GAAe;YAC5B,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE;YAC/C,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC9C,gBAAgB;SACjB,CAAC;QACF,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,SAAS;YACT,OAAO,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,CAAC;SACxD,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/audit/adapters/in-memory-store.d.ts

@@ -0,0 +1,3 @@
+import type { AuditStore } from '../core/ports.js';
+export declare function inMemoryAuditStore(): AuditStore;
+//# sourceMappingURL=in-memory-store.d.ts.map

package/dist/backend/audit/adapters/in-memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.d.ts","sourceRoot":"","sources":["../../../../backend/src/audit/adapters/in-memory-store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAe,UAAU,EAAgC,MAAM,kBAAkB,CAAC;AAE9F,wBAAgB,kBAAkB,IAAI,UAAU,CAqD/C"}

package/dist/backend/audit/adapters/in-memory-store.js

@@ -0,0 +1,66 @@
+/**
+ * Dep-vrije in-memory {@link AuditStore} (dev/tests). Append-only: er is geen update/delete van losse
+ * records; alleen retentie voert oude records af. Records blijven oplopend op sequence.
+ */
+import { GENESIS } from '../core/hash.js';
+export function inMemoryAuditStore() {
+    const records = [];
+    const clone = (record) => ({ ...record, meta: { ...record.meta } });
+    return {
+        async append(input, computeHash) {
+            const last = records[records.length - 1];
+            const sequence = (last?.sequence ?? 0) + 1;
+            const prevHash = last?.hash ?? GENESIS;
+            const hash = computeHash(sequence, prevHash, input);
+            const record = {
+                sequence,
+                actor: input.actor,
+                action: input.action,
+                target: input.target,
+                timestamp: input.timestamp,
+                meta: input.meta,
+                prevHash,
+                hash,
+            };
+            records.push(clone(record));
+            return clone(record);
+        },
+        async query(filter, pagination) {
+            const matches = records
+                .filter((r) => matchFilter(r, filter))
+                .filter((r) => pagination.cursor === undefined || r.sequence > pagination.cursor);
+            const page = matches.slice(0, pagination.pageSize).map(clone);
+            const nextCursor = matches.length > pagination.pageSize && page.length > 0
+                ? page[page.length - 1].sequence
+                : null;
+            return { items: page, nextCursor };
+        },
+        async all() {
+            return records.map(clone);
+        },
+        async purgeOlderThan(cutoffMs) {
+            const removed = records.filter((r) => r.timestamp < cutoffMs);
+            const kept = records.filter((r) => r.timestamp >= cutoffMs);
+            records.length = 0;
+            records.push(...kept);
+            return removed.map(clone);
+        },
+        async count() {
+            return records.length;
+        },
+    };
+}
+function matchFilter(record, filter) {
+    if (filter.actor !== undefined && record.actor !== filter.actor)
+        return false;
+    if (filter.action !== undefined && record.action !== filter.action)
+        return false;
+    if (filter.target !== undefined && record.target !== filter.target)
+        return false;
+    if (filter.fromMs !== undefined && record.timestamp < filter.fromMs)
+        return false;
+    if (filter.toMs !== undefined && record.timestamp > filter.toMs)
+        return false;
+    return true;
+}
+//# sourceMappingURL=in-memory-store.js.map

package/dist/backend/audit/adapters/in-memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.js","sourceRoot":"","sources":["../../../../backend/src/audit/adapters/in-memory-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,KAAK,GAAG,CAAC,MAAmB,EAAe,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAE9F,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC;YACvC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,MAAM,GAAgB;gBAC1B,QAAQ;gBACR,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ;gBACR,IAAI;aACL,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU;YAC5B,MAAM,OAAO,GAAG,OAAO;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;iBACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9D,MAAM,UAAU,GACd,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBACrD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ;gBACjC,CAAC,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,GAAG;YACP,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;YAC5D,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,KAAK;YACT,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB,EAAE,MAAmB;IAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/backend/audit/adapters/pg-store.d.ts

@@ -0,0 +1,22 @@
+import type { AuditStore } from '../core/ports.js';
+export interface SqlResult<R = Record<string, unknown>> {
+    rows: R[];
+    rowCount: number;
+}
+export interface SqlExec {
+    execute<R = Record<string, unknown>>(sql: string, params?: readonly unknown[]): Promise<SqlResult<R>>;
+}
+export interface SqlExecutor extends SqlExec {
+    withTransaction<T>(fn: (executor: SqlExec) => Promise<T>): Promise<T>;
+}
+export interface PgAuditStoreOptions {
+    table?: string;
+}
+export declare function pgAuditStore(executor: SqlExecutor, options?: PgAuditStoreOptions): AuditStore;
+/** Migratie (persistence-kit-vorm) die de append-only tabel + immutability-trigger aanlegt. */
+export declare function auditMigration(table?: string): {
+    id: string;
+    up(ctx: SqlExec): Promise<void>;
+    down(ctx: SqlExec): Promise<void>;
+};
+//# sourceMappingURL=pg-store.d.ts.map

package/dist/backend/audit/adapters/pg-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-store.d.ts","sourceRoot":"","sources":["../../../../backend/src/audit/adapters/pg-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,UAAU,EAAgC,MAAM,kBAAkB,CAAC;AAE9F,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,OAAO;IACtB,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACvG;AACD,MAAM,WAAW,WAAY,SAAQ,OAAO;IAC1C,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvE;AAKD,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,GAAE,mBAAwB,GAAG,UAAU,CAyFjG;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,KAAK,SAAc;;YAMhC,OAAO;cAsBL,OAAO;EAI1B"}

package/dist/backend/audit/adapters/pg-store.js

@@ -0,0 +1,119 @@
+/**
+ * Postgres {@link AuditStore} (productie). Append-only tabel met een hash-keten; UPDATE/DELETE worden
+ * op DB-niveau geweigerd via een trigger (US-1002 AC3), behalve gecontroleerde retentie. De keten
+ * wordt atomair opgebouwd via een advisory lock (serialiseert appends over instances). Werkt tegen een
+ * structurele `SqlExecutor` (compatibel met de persistence-kit `Pool`) — geen harde `pg`-dep.
+ */
+import { GENESIS } from '../core/hash.js';
+/** Advisory-lock-sleutel om appends te serialiseren (per tabel volstaat één vaste sleutel). */
+const APPEND_LOCK_KEY = 918_273_645;
+export function pgAuditStore(executor, options = {}) {
+    const table = options.table ?? 'audit_log';
+    const q = `"${table}"`;
+    const mapRow = (row) => ({
+        sequence: Number(row['sequence']),
+        actor: String(row['actor']),
+        action: String(row['action']),
+        target: String(row['target']),
+        timestamp: Number(row['timestamp']),
+        meta: (row['meta'] ?? {}),
+        prevHash: String(row['prev_hash']),
+        hash: String(row['hash']),
+    });
+    return {
+        async append(input, computeHash) {
+            return executor.withTransaction(async (tx) => {
+                await tx.execute('SELECT pg_advisory_xact_lock($1)', [APPEND_LOCK_KEY]);
+                const last = await tx.execute(`SELECT sequence, hash FROM ${q} ORDER BY sequence DESC LIMIT 1`);
+                const lastRow = last.rows[0];
+                const sequence = (lastRow ? Number(lastRow.sequence) : 0) + 1;
+                const prevHash = lastRow ? String(lastRow.hash) : GENESIS;
+                const hash = computeHash(sequence, prevHash, input);
+                await tx.execute(`INSERT INTO ${q} (sequence, actor, action, target, "timestamp", meta, prev_hash, hash) ` +
+                    `VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8)`, [sequence, input.actor, input.action, input.target, input.timestamp, JSON.stringify(input.meta), prevHash, hash]);
+                return {
+                    sequence,
+                    actor: input.actor,
+                    action: input.action,
+                    target: input.target,
+                    timestamp: input.timestamp,
+                    meta: input.meta,
+                    prevHash,
+                    hash,
+                };
+            });
+        },
+        async query(filter, pagination) {
+            const conditions = [];
+            const params = [];
+            const add = (clause, value) => {
+                params.push(value);
+                conditions.push(clause(params.length));
+            };
+            if (filter.actor !== undefined)
+                add((i) => `actor = $${i}`, filter.actor);
+            if (filter.action !== undefined)
+                add((i) => `action = $${i}`, filter.action);
+            if (filter.target !== undefined)
+                add((i) => `target = $${i}`, filter.target);
+            if (filter.fromMs !== undefined)
+                add((i) => `"timestamp" >= $${i}`, filter.fromMs);
+            if (filter.toMs !== undefined)
+                add((i) => `"timestamp" <= $${i}`, filter.toMs);
+            if (pagination.cursor !== undefined)
+                add((i) => `sequence > $${i}`, pagination.cursor);
+            const where = conditions.length > 0 ? ` WHERE ${conditions.join(' AND ')}` : '';
+            params.push(pagination.pageSize + 1);
+            const result = await executor.execute(`SELECT * FROM ${q}${where} ORDER BY sequence ASC LIMIT $${params.length}`, params);
+            const rows = result.rows.map(mapRow);
+            const hasMore = rows.length > pagination.pageSize;
+            const items = hasMore ? rows.slice(0, pagination.pageSize) : rows;
+            return { items, nextCursor: hasMore ? items[items.length - 1].sequence : null };
+        },
+        async all() {
+            const result = await executor.execute(`SELECT * FROM ${q} ORDER BY sequence ASC`);
+            return result.rows.map(mapRow);
+        },
+        async purgeOlderThan(cutoffMs) {
+            return executor.withTransaction(async (tx) => {
+                // Gecontroleerde retentie: sta DELETE tijdelijk toe via de session-GUC die de trigger leest.
+                await tx.execute(`SET LOCAL "audit.allow_purge" = 'on'`);
+                const result = await tx.execute(`DELETE FROM ${q} WHERE "timestamp" < $1 RETURNING *`, [cutoffMs]);
+                return result.rows.map(mapRow);
+            });
+        },
+        async count() {
+            const result = await executor.execute(`SELECT COUNT(*)::int AS count FROM ${q}`);
+            return Number(result.rows[0]?.count ?? 0);
+        },
+    };
+}
+/** Migratie (persistence-kit-vorm) die de append-only tabel + immutability-trigger aanlegt. */
+export function auditMigration(table = 'audit_log') {
+    const q = `"${table}"`;
+    const guard = `"${table}_guard"`;
+    const trigger = `"${table}_immutable"`;
+    return {
+        id: '0001_audit_log',
+        async up(ctx) {
+            await ctx.execute(`CREATE TABLE IF NOT EXISTS ${q} (` +
+                `sequence bigint PRIMARY KEY, actor text NOT NULL, action text NOT NULL, target text NOT NULL, ` +
+                `"timestamp" bigint NOT NULL, meta jsonb NOT NULL, prev_hash text NOT NULL, hash text NOT NULL)`);
+            await ctx.execute(`CREATE INDEX IF NOT EXISTS "${table}_actor_idx" ON ${q} (actor)`);
+            await ctx.execute(`CREATE OR REPLACE FUNCTION ${guard}() RETURNS trigger AS $guard$ ` +
+                `BEGIN ` +
+                `IF TG_OP = 'UPDATE' THEN RAISE EXCEPTION 'audit-log is append-only (geen UPDATE)'; END IF; ` +
+                `IF TG_OP = 'DELETE' THEN ` +
+                `IF current_setting('audit.allow_purge', true) IS DISTINCT FROM 'on' ` +
+                `THEN RAISE EXCEPTION 'audit-log is append-only (DELETE alleen via retentie)'; END IF; ` +
+                `END IF; ` +
+                `RETURN OLD; END; $guard$ LANGUAGE plpgsql`);
+            await ctx.execute(`DROP TRIGGER IF EXISTS ${trigger} ON ${q}`);
+            await ctx.execute(`CREATE TRIGGER ${trigger} BEFORE UPDATE OR DELETE ON ${q} FOR EACH ROW EXECUTE FUNCTION ${guard}()`);
+        },
+        async down(ctx) {
+            await ctx.execute(`DROP TABLE IF EXISTS ${q}`);
+        },
+    };
+}
+//# sourceMappingURL=pg-store.js.map

package/dist/backend/audit/adapters/pg-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-store.js","sourceRoot":"","sources":["../../../../backend/src/audit/adapters/pg-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAc1C,+FAA+F;AAC/F,MAAM,eAAe,GAAG,WAAW,CAAC;AAMpC,MAAM,UAAU,YAAY,CAAC,QAAqB,EAAE,UAA+B,EAAE;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;IAC3C,MAAM,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC;IAEvB,MAAM,MAAM,GAAG,CAAC,GAA4B,EAAe,EAAE,CAAC,CAAC;QAC7D,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAA4B;QACpD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;KAC1B,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW;YAC7B,OAAO,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC3C,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;gBACxE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,8BAA8B,CAAC,iCAAiC,CACjE,CAAC;gBACF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC1D,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpD,MAAM,EAAE,CAAC,OAAO,CACd,eAAe,CAAC,yEAAyE;oBACvF,gDAAgD,EAClD,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CACjH,CAAC;gBACF,OAAO;oBACL,QAAQ;oBACR,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ;oBACR,IAAI;iBACL,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU;YAC5B,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,MAA6B,EAAE,KAAc,EAAQ,EAAE;gBAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACnF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/E,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAEvF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,iBAAiB,CAAC,GAAG,KAAK,iCAAiC,MAAM,CAAC,MAAM,EAAE,EAC1E,MAAM,CACP,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,CAAC;QAED,KAAK,CAAC,GAAG;YACP,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YAClF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,OAAO,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC3C,6FAA6F;gBAC7F,MAAM,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,qCAAqC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnG,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAoB,sCAAsC,CAAC,EAAE,CAAC,CAAC;YACpG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,KAAK,GAAG,WAAW;IAChD,MAAM,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,KAAK,aAAa,CAAC;IACvC,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,KAAK,CAAC,EAAE,CAAC,GAAY;YACnB,MAAM,GAAG,CAAC,OAAO,CACf,8BAA8B,CAAC,IAAI;gBACjC,gGAAgG;gBAChG,gGAAgG,CACnG,CAAC;YACF,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,KAAK,kBAAkB,CAAC,UAAU,CAAC,CAAC;YACrF,MAAM,GAAG,CAAC,OAAO,CACf,8BAA8B,KAAK,gCAAgC;gBACjE,QAAQ;gBACR,6FAA6F;gBAC7F,2BAA2B;gBAC3B,sEAAsE;gBACtE,wFAAwF;gBACxF,UAAU;gBACV,2CAA2C,CAC9C,CAAC;YACF,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/D,MAAM,GAAG,CAAC,OAAO,CACf,kBAAkB,OAAO,+BAA+B,CAAC,kCAAkC,KAAK,IAAI,CACrG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAY;YACrB,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/audit/core/audit-log.d.ts

@@ -0,0 +1,41 @@
+import type { AuditRecord, AuditStore, Clock, Hasher, QueryFilter, QueryPagination, QueryResult } from './ports.js';
+export interface AuditLogOptions {
+    /** Toegestane `action`-waarden (geïnjecteerd; niet ingebakken). */
+    eventTypes: string[];
+    clock?: Clock;
+    hasher?: Hasher;
+    /** Bewaartermijn (ms) voor `runRetention`. */
+    retentionMs?: number;
+}
+export interface AppendInput {
+    actor: string;
+    action: string;
+    target: string;
+    meta?: Record<string, unknown>;
+}
+export interface VerifyResult {
+    intact: boolean;
+    brokenAt?: number;
+    verified: number;
+}
+export interface ExportSummary {
+    intact: boolean;
+    brokenAt?: number;
+    count: number;
+    algorithm: string;
+}
+export interface ExportResult {
+    ndjson: string;
+    summary: ExportSummary;
+}
+export interface AuditLog {
+    append(input: AppendInput): Promise<AuditRecord>;
+    verifyChain(): Promise<VerifyResult>;
+    query(filter: QueryFilter, pagination: QueryPagination): Promise<QueryResult>;
+    export(): Promise<ExportResult>;
+    runRetention(nowMs?: number): Promise<{
+        removed: number;
+    }>;
+}
+export declare function createAuditLog(store: AuditStore, options: AuditLogOptions): AuditLog;
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/backend/audit/core/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../backend/src/audit/core/audit-log.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,KAAK,EAEL,MAAM,EACN,WAAW,EACX,eAAe,EACf,WAAW,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACrC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAChC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,GAAG,QAAQ,CA2DpF"}

package/dist/backend/audit/core/audit-log.js

@@ -0,0 +1,78 @@
+/**
+ * De audit-log-service. US-1001 append (validatie + geïnjecteerde event-types + server-timestamp),
+ * US-1002 verifyChain (tamper-evidence), US-1003 query (read-only, gefilterd, gepagineerd), US-1004
+ * retentie + geverifieerde NDJSON-export. Domein-loos; store/klok/hash/event-types geïnjecteerd.
+ */
+import { AuditValidationError, UnknownEventTypeError } from './errors.js';
+import { makeComputeHash, sha256Hasher } from './hash.js';
+export function createAuditLog(store, options) {
+    const eventTypes = new Set(options.eventTypes);
+    const clock = options.clock ?? Date.now;
+    const hasher = options.hasher ?? sha256Hasher();
+    const computeHash = makeComputeHash(hasher);
+    return {
+        async append(input) {
+            requireNonEmpty('actor', input.actor);
+            requireNonEmpty('action', input.action);
+            requireNonEmpty('target', input.target);
+            const meta = input.meta ?? {};
+            if (typeof meta !== 'object' || Array.isArray(meta)) {
+                throw new AuditValidationError('meta', 'moet een object zijn');
+            }
+            if (!eventTypes.has(input.action)) {
+                throw new UnknownEventTypeError(input.action);
+            }
+            return store.append({ actor: input.actor, action: input.action, target: input.target, timestamp: clock(), meta }, computeHash);
+        },
+        async verifyChain() {
+            return verifyRecords(await store.all(), computeHash);
+        },
+        async query(filter, pagination) {
+            if (!Number.isInteger(pagination.pageSize) || pagination.pageSize <= 0) {
+                throw new AuditValidationError('pageSize', 'moet een positief geheel getal zijn');
+            }
+            if (filter.fromMs !== undefined && filter.toMs !== undefined && filter.fromMs > filter.toMs) {
+                throw new AuditValidationError('range', 'fromMs mag niet groter zijn dan toMs');
+            }
+            return store.query(filter, pagination);
+        },
+        async export() {
+            const records = await store.all();
+            const verify = verifyRecords(records, computeHash);
+            const summary = {
+                intact: verify.intact,
+                count: records.length,
+                algorithm: hasher.algorithm,
+                ...(verify.brokenAt !== undefined ? { brokenAt: verify.brokenAt } : {}),
+            };
+            return { ndjson: records.map((r) => JSON.stringify(r)).join('\n'), summary };
+        },
+        async runRetention(nowMs) {
+            if (options.retentionMs === undefined) {
+                throw new AuditValidationError('retentionMs', 'geen retentie-bewaartermijn geconfigureerd');
+            }
+            const cutoff = (nowMs ?? clock()) - options.retentionMs;
+            const removed = await store.purgeOlderThan(cutoff);
+            return { removed: removed.length };
+        },
+    };
+}
+function requireNonEmpty(field, value) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new AuditValidationError(field, 'is verplicht');
+    }
+}
+function verifyRecords(records, computeHash) {
+    for (let i = 0; i < records.length; i++) {
+        const record = records[i];
+        const expected = computeHash(record.sequence, record.prevHash, record);
+        if (expected !== record.hash) {
+            return { intact: false, brokenAt: record.sequence, verified: i };
+        }
+        if (i > 0 && record.prevHash !== records[i - 1].hash) {
+            return { intact: false, brokenAt: record.sequence, verified: i };
+        }
+    }
+    return { intact: true, verified: records.length };
+}
+//# sourceMappingURL=audit-log.js.map

package/dist/backend/audit/core/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../../../backend/src/audit/core/audit-log.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAsD1D,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,OAAwB;IACxE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5C,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACxC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CACjB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAC5F,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW;YACf,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU;YAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,oBAAoB,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5F,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,OAAO,GAAkB;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/E,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,oBAAoB,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,WAAwB;IACrE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACpD,CAAC"}

package/dist/backend/audit/core/errors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Foutentaxonomie voor audit-log.
+ */
+export declare class AuditError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** Ontbrekend/ongeldig verplicht veld bij append of query (US-1001 AC3, US-1003 AC3). */
+export declare class AuditValidationError extends AuditError {
+    readonly field: string;
+    constructor(field: string, reason: string);
+}
+/** Onbekend event-type (niet in de geïnjecteerde registry) (US-1001 AC2). */
+export declare class UnknownEventTypeError extends AuditError {
+    readonly action: string;
+    constructor(action: string);
+}
+/** Poging tot mutatie van een append-only record (US-1002 AC3). */
+export declare class ImmutabilityError extends AuditError {
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/backend/audit/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../backend/src/audit/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM1C;AAED,yFAAyF;AACzF,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI1C;AAED,6EAA6E;AAC7E,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAI3B;AAED,mEAAmE;AACnE,qBAAa,iBAAkB,SAAQ,UAAU;;CAIhD"}

package/dist/backend/audit/core/errors.js

@@ -0,0 +1,35 @@
+/**
+ * Foutentaxonomie voor audit-log.
+ */
+export class AuditError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Ontbrekend/ongeldig verplicht veld bij append of query (US-1001 AC3, US-1003 AC3). */
+export class AuditValidationError extends AuditError {
+    field;
+    constructor(field, reason) {
+        super(`Ongeldig audit-veld "${field}": ${reason}`, 'AUDIT_VALIDATION');
+        this.field = field;
+    }
+}
+/** Onbekend event-type (niet in de geïnjecteerde registry) (US-1001 AC2). */
+export class UnknownEventTypeError extends AuditError {
+    action;
+    constructor(action) {
+        super(`Onbekend event-type (action): "${action}"`, 'UNKNOWN_EVENT_TYPE');
+        this.action = action;
+    }
+}
+/** Poging tot mutatie van een append-only record (US-1002 AC3). */
+export class ImmutabilityError extends AuditError {
+    constructor() {
+        super('Audit-records zijn append-only; wijzigen/verwijderen is niet toegestaan', 'AUDIT_IMMUTABLE');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/backend/audit/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../backend/src/audit/core/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IACzC,KAAK,CAAS;IACvB,YAAY,KAAa,EAAE,MAAc;QACvC,KAAK,CAAC,wBAAwB,KAAK,MAAM,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CAAC,kCAAkC,MAAM,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C;QACE,KAAK,CAAC,yEAAyE,EAAE,iBAAiB,CAAC,CAAC;IACtG,CAAC;CACF"}

package/dist/backend/audit/core/hash.d.ts

@@ -0,0 +1,9 @@
+import type { ComputeHash, Hasher } from './ports.js';
+/** prevHash van het eerste record (genesis). */
+export declare const GENESIS = "";
+export declare function sha256Hasher(): Hasher;
+/** Canonieke JSON met recursief gesorteerde object-keys (stabiele serialisatie). */
+export declare function canonicalJson(value: unknown): string;
+/** Bouwt een {@link ComputeHash} uit een {@link Hasher}. */
+export declare function makeComputeHash(hasher: Hasher): ComputeHash;
+//# sourceMappingURL=hash.d.ts.map

package/dist/backend/audit/core/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../../backend/src/audit/core/hash.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEvE,gDAAgD;AAChD,eAAO,MAAM,OAAO,KAAK,CAAC;AAE1B,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAcD,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAa3D"}

package/dist/backend/audit/core/hash.js

@@ -0,0 +1,45 @@
+/**
+ * US-1002 — Hash-keten: elk record hasht zijn eigen inhoud plus de hash van het vorige record.
+ * Serialisatie is canoniek (gesorteerde keys) zodat de hash stabiel en reproduceerbaar is.
+ */
+import { createHash } from 'node:crypto';
+/** prevHash van het eerste record (genesis). */
+export const GENESIS = '';
+export function sha256Hasher() {
+    return {
+        algorithm: 'sha256',
+        hash: (data) => createHash('sha256').update(data).digest('hex'),
+    };
+}
+/** Canonieke JSON met recursief gesorteerde object-keys (stabiele serialisatie). */
+export function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            out[key] = sortKeys(value[key]);
+        }
+        return out;
+    }
+    return value;
+}
+/** Bouwt een {@link ComputeHash} uit een {@link Hasher}. */
+export function makeComputeHash(hasher) {
+    return (sequence, prevHash, input) => {
+        const payload = [
+            String(sequence),
+            input.actor,
+            input.action,
+            input.target,
+            String(input.timestamp),
+            canonicalJson(input.meta),
+            prevHash,
+        ].join('\n');
+        return hasher.hash(payload);
+    };
+}
+//# sourceMappingURL=hash.js.map

package/dist/backend/audit/core/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../../../backend/src/audit/core/hash.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,gDAAgD;AAChD,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,CAAC,QAAgB,EAAE,QAAgB,EAAE,KAAsB,EAAU,EAAE;QAC5E,MAAM,OAAO,GAAG;YACd,MAAM,CAAC,QAAQ,CAAC;YAChB,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,MAAM;YACZ,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YACvB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YACzB,QAAQ;SACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC"}