feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/beheer/src/domain/audit-entry.ts

@@ -0,0 +1,10 @@
+/** One authz/PII-reveal audit row as the FE sees it (WP-41 backend → WP-42 view). Pure
+    type; data-minimised (no PII) by construction on the server. */
+export interface AuditEntry {
+  at: string; // ISO timestamp
+  action: string;
+  resource: string;
+  decision: 'allow' | 'deny';
+  role: string;
+  correlationId: string;
+}

libs/beheer/src/domain/stamdata-editor.machine.spec.ts

@@ -0,0 +1,63 @@
+import { describe, it, expect } from 'vitest';
+import { StamTable } from './stamdata';
+import { StamdataEditorState, initial, reduce } from './stamdata-editor.machine';
+
+const table: StamTable = {
+  id: 'professions',
+  label: 'Opleiding → beroep',
+  temporal: true,
+  columns: [
+    { name: 'program', type: 'text', isKey: true, options: [] },
+    { name: 'beroep', type: 'text', isKey: false, options: [] },
+    { name: 'geldigVan', type: 'date', isKey: false, options: [] },
+    { name: 'geldigTot', type: 'date', isKey: false, options: [] },
+  ],
+};
+
+const seedLoaded = (): StamdataEditorState =>
+  reduce(initial, {
+    tag: 'Loaded',
+    table,
+    rows: [{ program: 'geneeskunde', beroep: 'Arts', geldigVan: '2000-01-01', geldigTot: '' }],
+  });
+
+describe('stamdata-editor reduce', () => {
+  it('Loaded snapshots original independently of rows', () => {
+    const s = seedLoaded();
+    expect(s.tag).toBe('loaded');
+    if (s.tag !== 'loaded') return;
+    const edited = reduce(s, { tag: 'CellEdited', row: 0, column: 'beroep', value: 'Chirurg' });
+    if (edited.tag !== 'loaded') return;
+    expect(edited.rows[0]['beroep']).toBe('Chirurg');
+    expect(edited.original[0]['beroep']).toBe('Arts'); // snapshot untouched → diff works
+  });
+
+  it('RowAdded appends an empty row shaped by the schema', () => {
+    const s = reduce(seedLoaded(), { tag: 'RowAdded' });
+    if (s.tag !== 'loaded') return;
+    expect(s.rows).toHaveLength(2);
+    expect(s.rows[1]).toEqual({ program: '', beroep: '', geldigVan: '', geldigTot: '' });
+  });
+
+  it('RowRemoved drops the row at the index', () => {
+    const s = reduce(reduce(seedLoaded(), { tag: 'RowAdded' }), { tag: 'RowRemoved', row: 0 });
+    if (s.tag !== 'loaded') return;
+    expect(s.rows).toHaveLength(1);
+  });
+
+  it('edit messages are ignored unless loaded', () => {
+    expect(reduce(initial, { tag: 'RowAdded' })).toBe(initial);
+    expect(
+      reduce({ tag: 'failed', reason: 'x' }, { tag: 'CellEdited', row: 0, column: 'a', value: 'b' })
+        .tag,
+    ).toBe('failed');
+  });
+
+  it('LoadFailed and Loading transition regardless of prior state', () => {
+    expect(reduce(seedLoaded(), { tag: 'LoadFailed', reason: 'boom' })).toEqual({
+      tag: 'failed',
+      reason: 'boom',
+    });
+    expect(reduce(seedLoaded(), { tag: 'Loading' })).toEqual({ tag: 'loading' });
+  });
+});

libs/beheer/src/domain/stamdata-editor.machine.ts

@@ -0,0 +1,55 @@
+import { assertNever } from '@shared/kernel/fp';
+import { StamRow, StamTable, emptyRow } from '@beheer/domain/stamdata';
+
+/**
+ * The stamdata table editor as one Elm-style tagged union (the house form idiom). While
+ * `loaded`, the draft `rows` are the edit state and `original` is the loaded snapshot the
+ * diff compares against — no separate `dirty` flag (derive it, don't store it). Loading and
+ * failure are states here too, so the page can render them via `<app-async>`.
+ *
+ * There is no submit/save Msg: an edit stays local until the admin downloads the file (the
+ * apply path is a reviewed PR, not a runtime write — ADR-0004).
+ */
+export type StamdataEditorState =
+  | { tag: 'loading' }
+  | { tag: 'failed'; reason: string }
+  | { tag: 'loaded'; table: StamTable; rows: StamRow[]; original: readonly StamRow[] };
+
+export type StamdataEditorMsg =
+  | { tag: 'Loading' }
+  | { tag: 'Loaded'; table: StamTable; rows: StamRow[] }
+  | { tag: 'LoadFailed'; reason: string }
+  | { tag: 'CellEdited'; row: number; column: string; value: string }
+  | { tag: 'RowAdded' }
+  | { tag: 'RowRemoved'; row: number }
+  | { tag: 'Seed'; state: StamdataEditorState }; // mount a specific state (stories/tests)
+
+export const initial: StamdataEditorState = { tag: 'loading' };
+
+const copy = (rows: readonly StamRow[]): StamRow[] => rows.map((r) => ({ ...r }));
+
+export function reduce(s: StamdataEditorState, m: StamdataEditorMsg): StamdataEditorState {
+  switch (m.tag) {
+    case 'Loading':
+      return { tag: 'loading' };
+    case 'Loaded':
+      // original is an independent snapshot so later edits never mutate it (drives the diff).
+      return { tag: 'loaded', table: m.table, rows: copy(m.rows), original: copy(m.rows) };
+    case 'LoadFailed':
+      return { tag: 'failed', reason: m.reason };
+    case 'CellEdited':
+      if (s.tag !== 'loaded') return s;
+      return {
+        ...s,
+        rows: s.rows.map((r, i) => (i === m.row ? { ...r, [m.column]: m.value } : r)),
+      };
+    case 'RowAdded':
+      return s.tag === 'loaded' ? { ...s, rows: [...s.rows, emptyRow(s.table)] } : s;
+    case 'RowRemoved':
+      return s.tag === 'loaded' ? { ...s, rows: s.rows.filter((_, i) => i !== m.row) } : s;
+    case 'Seed':
+      return m.state;
+    default:
+      return assertNever(m);
+  }
+}

libs/beheer/src/domain/stamdata.spec.ts

@@ -0,0 +1,96 @@
+import { describe, it, expect } from 'vitest';
+import { StamTable, activeOn, changeCounts, isValid, rowErrors, toJson } from './stamdata';
+
+const professions: StamTable = {
+  id: 'professions',
+  label: 'Opleiding → beroep',
+  temporal: true,
+  columns: [
+    { name: 'program', type: 'text', isKey: true, options: [] },
+    { name: 'beroep', type: 'text', isKey: false, options: [] },
+    { name: 'geldigVan', type: 'date', isKey: false, options: [] },
+    { name: 'geldigTot', type: 'date', isKey: false, options: [] },
+  ],
+};
+
+const row = (program: string, beroep: string, van: string, tot = ''): Record<string, string> => ({
+  program,
+  beroep,
+  geldigVan: van,
+  geldigTot: tot,
+});
+
+describe('activeOn (valid-time, half-open [van, tot))', () => {
+  it('includes a row whose window covers the date', () => {
+    expect(activeOn(professions, row('a', 'A', '2000-01-01'), '2020-01-01')).toBe(true);
+  });
+  it('excludes a row before its geldigVan', () => {
+    expect(activeOn(professions, row('a', 'A', '2000-01-01'), '1999-01-01')).toBe(false);
+  });
+  it('excludes on the geldigTot boundary (half-open)', () => {
+    expect(activeOn(professions, row('a', 'A', '2000-01-01', '2020-01-01'), '2020-01-01')).toBe(
+      false,
+    );
+    expect(activeOn(professions, row('a', 'A', '2000-01-01', '2020-01-01'), '2019-12-31')).toBe(
+      true,
+    );
+  });
+});
+
+describe('rowErrors / isValid (format only)', () => {
+  it('flags a blank key', () => {
+    expect(rowErrors(professions, [row('', 'A', '2000-01-01')])[0]).not.toBe('');
+  });
+  it('flags a missing geldigVan on a temporal table', () => {
+    expect(rowErrors(professions, [row('a', 'A', '')])[0]).not.toBe('');
+  });
+  it('flags geldigTot on or before geldigVan', () => {
+    expect(rowErrors(professions, [row('a', 'A', '2020-01-01', '2020-01-01')])[0]).not.toBe('');
+  });
+  it('passes a well-formed row', () => {
+    expect(isValid(professions, [row('a', 'A', '2000-01-01')])).toBe(true);
+  });
+});
+
+describe('changeCounts (diff against the loaded snapshot, by key)', () => {
+  const original = [row('a', 'A', '2000-01-01'), row('b', 'B', '2000-01-01')];
+  it('counts an added key', () => {
+    const draft = [...original, row('c', 'C', '2000-01-01')];
+    expect(changeCounts(professions, original, draft)).toEqual({ added: 1, removed: 0, edited: 0 });
+  });
+  it('counts a removed key', () => {
+    expect(changeCounts(professions, original, [original[0]])).toEqual({
+      added: 0,
+      removed: 1,
+      edited: 0,
+    });
+  });
+  it('counts an edited cell', () => {
+    const draft = [row('a', 'CHANGED', '2000-01-01'), original[1]];
+    expect(changeCounts(professions, original, draft)).toEqual({ added: 0, removed: 0, edited: 1 });
+  });
+});
+
+describe('toJson (draft → file shape)', () => {
+  it('reconstructs an open-ended geldigTot as null and pretty-prints', () => {
+    const json = toJson(professions, [row('a', 'Arts', '2000-01-01')]);
+    expect(JSON.parse(json)).toEqual([
+      { program: 'a', beroep: 'Arts', geldigVan: '2000-01-01', geldigTot: null },
+    ]);
+    expect(json.endsWith('\n')).toBe(true);
+  });
+  it('coerces a number column', () => {
+    const table: StamTable = {
+      id: 't',
+      label: 't',
+      temporal: false,
+      columns: [
+        { name: 'code', type: 'text', isKey: true, options: [] },
+        { name: 'jaar', type: 'number', isKey: false, options: [] },
+      ],
+    };
+    expect(JSON.parse(toJson(table, [{ code: 'x', jaar: '2020' }]))).toEqual([
+      { code: 'x', jaar: 2020 },
+    ]);
+  });
+});

libs/beheer/src/domain/stamdata.ts

@@ -0,0 +1,130 @@
+// Domain model for stamdata maintenance (ADR-0004). Pure TS, no Angular. A table is a
+// reflected column schema + editable rows; the pure functions below cover validation
+// (FORMAT only — the CI build + StamdataValidationTests stay the authority), the
+// valid-time preview filter, the change diff, and serialization back to the file shape.
+
+export type ColumnType = 'text' | 'date' | 'number' | 'enum';
+
+export interface StamColumn {
+  name: string;
+  type: ColumnType;
+  isKey: boolean;
+  options: readonly string[];
+}
+
+export interface StamTable {
+  id: string;
+  label: string;
+  columns: readonly StamColumn[];
+  temporal: boolean;
+}
+
+/**
+ * An editable row: every cell is the text the user edits ('' = empty). Typed values
+ * (number, null geldigTot) are reconstructed at export time — see {@link toJson}.
+ */
+export type StamRow = Record<string, string>;
+
+export interface ChangeCounts {
+  added: number;
+  removed: number;
+  edited: number;
+}
+
+const GELDIG_VAN = 'geldigVan';
+const GELDIG_TOT = 'geldigTot';
+
+export function keyColumn(table: StamTable): StamColumn {
+  return table.columns.find((c) => c.isKey) ?? table.columns[0];
+}
+
+export function keyOf(table: StamTable, row: StamRow): string {
+  return row[keyColumn(table).name] ?? '';
+}
+
+export function emptyRow(table: StamTable): StamRow {
+  const row: StamRow = {};
+  for (const c of table.columns) row[c.name] = '';
+  return row;
+}
+
+/**
+ * Valid-time membership, half-open [van, tot) — the same rule the backend applies, done
+ * client-side so the editor's "geldig op" preview is instant and never drops unsaved edits.
+ * ISO yyyy-MM-dd strings compare correctly lexicographically. Non-temporal tables: all rows.
+ */
+export function activeOn(table: StamTable, row: StamRow, on: string): boolean {
+  if (!table.temporal) return true;
+  const van = row[GELDIG_VAN] ?? '';
+  const tot = row[GELDIG_TOT] ?? '';
+  return van !== '' && van <= on && (tot === '' || on < tot);
+}
+
+/** Per-row FORMAT error (index-aligned; '' = valid). Cross-row overlap is the CI gate's job. */
+export function rowErrors(table: StamTable, rows: readonly StamRow[]): string[] {
+  const key = keyColumn(table).name;
+  return rows.map((row) => {
+    if ((row[key] ?? '').trim() === '')
+      return $localize`:@@beheer.validation.key:Vul de sleutelkolom in.`;
+    if (table.temporal) {
+      const van = row[GELDIG_VAN] ?? '';
+      const tot = row[GELDIG_TOT] ?? '';
+      if (van === '') return $localize`:@@beheer.validation.van:Vul een 'geldig van'-datum in.`;
+      if (tot !== '' && tot <= van)
+        return $localize`:@@beheer.validation.range:'Geldig tot' moet ná 'geldig van' liggen.`;
+    }
+    return '';
+  });
+}
+
+export function isValid(table: StamTable, rows: readonly StamRow[]): boolean {
+  return rowErrors(table, rows).every((e) => e === '');
+}
+
+/** Diff draft against the loaded snapshot, matched by key value. */
+export function changeCounts(
+  table: StamTable,
+  original: readonly StamRow[],
+  draft: readonly StamRow[],
+): ChangeCounts {
+  const origByKey = new Map(original.map((r) => [keyOf(table, r), r]));
+  const draftKeys = new Set(draft.map((r) => keyOf(table, r)));
+  let added = 0;
+  let edited = 0;
+  for (const row of draft) {
+    const prev = origByKey.get(keyOf(table, row));
+    if (!prev) added++;
+    else if (!sameRow(table, prev, row)) edited++;
+  }
+  const removed = original.filter((r) => !draftKeys.has(keyOf(table, r))).length;
+  return { added, removed, edited };
+}
+
+function sameRow(table: StamTable, a: StamRow, b: StamRow): boolean {
+  return table.columns.every((c) => (a[c.name] ?? '') === (b[c.name] ?? ''));
+}
+
+/**
+ * Serialize the draft back to the data-file's JSON shape, reconstructing typed values per
+ * column: an empty date/number cell becomes null (an open-ended geldigTot), a number cell
+ * becomes a number, everything else a string. This is the file the admin drops into the
+ * repo — the existing CI build re-validates it (a bad edit fails the build, never prod).
+ */
+export function toJson(table: StamTable, rows: readonly StamRow[]): string {
+  const objects = rows.map((row) => {
+    const out: Record<string, string | number | null> = {};
+    for (const c of table.columns) {
+      const cell = (row[c.name] ?? '').trim();
+      out[c.name] =
+        cell === ''
+          ? c.type === 'text' || c.type === 'enum'
+            ? ''
+            : null
+          : c.type === 'number'
+            ? Number(cell)
+            : cell;
+    }
+    return out;
+  });
+  return JSON.stringify(objects, null, 2) + '\n';
+}