@flowselections/core 1.0.15 → 1.0.18

package/README.md

@@ -0,0 +1,113 @@
+# @flowselections/core
+
+Fundament-module: authenticatie, shell-layout (sidebar/header), instellingen en de
+gedeelde UI-componenten. Elke module heeft core als `peerDependency`; de shell
+bepaalt welke core-versie draait.
+
+## Modulecontract
+
+```ts
+interface FlowModule {
+  id: string;            // pakket-id (npm), NIET de externe sleutel
+  name: string;
+  version: string;
+  nav: NavItem;
+  settingsCards: SettingsCard[];
+  registryKey?: string;  // optionele expliciete externe sleutel
+}
+```
+
+### De modulesleutel
+
+Core matcht extern (module_registry, rechten) **altijd** op `moduleKey(mod)` en
+nooit op `mod.id` — `id` is een pakket-id, terwijl de registry route-slugs bevat.
+
+`moduleKey()`:
+
+1. `registryKey` als die is opgegeven;
+2. anders het eerste padsegment van `nav.href`;
+3. **afsluitende underscores worden gestript.**
+
+Regel 3 is een expliciete beslissing: een afsluitende underscore in een routepad
+(`/voorraad_/detail`) is een TanStack un-nesting-conventie en geen betekenisvol
+segment. Zonder strippen krijgt dezelfde module twee sleutels (`voorraad` en
+`voorraad_`) en verdwijnt hij half uit de zijbalk. Er is gekozen voor strippen in
+plaats van `registryKey` verplicht maken, omdat dat laatste bestaande modules
+stil zou breken. Wil je afwijken, zet dan `registryKey` expliciet.
+
+Core kent geen enkele module- of domeinnaam; de regel is volledig generiek.
+
+## Shell-extensiepunten
+
+Alles optioneel. Zonder provider gedraagt een shell zich exact zoals voorheen:
+default-allow, code-volgorde.
+
+```tsx
+// src/routes/_authenticated.tsx
+import { ShellExtensionsProvider, ModuleGuardSlot, Sidebar, useModulePermissionTransform } from "@flowselections/core";
+import { useModuleOrderTransform } from "@flowselections/sidebar-ordening-installatie-techniek";
+
+<ShellExtensionsProvider
+  useModuleList={[useModulePermissionTransform, useModuleOrderTransform]}
+>
+  <Sidebar auth={auth} modules={modules} />
+  <ModuleGuardSlot>
+    <Outlet />
+  </ModuleGuardSlot>
+</ShellExtensionsProvider>
+```
+
+Pipeline-volgorde is de array-volgorde: **eerst rechten filteren, dan sorteren.**
+Meegegeven hooks moeten stabiele referenties zijn (module-scope functies, geen
+inline lambdas), zodat de hook-volgorde tussen renders nooit verandert.
+
+Bij laden, een ontbrekende tabel/RPC of een fout in een transform komt de lijst
+**ongewijzigd** terug. Een lege zijbalk is nooit een geldige uitkomst.
+
+### Parent/child-gedrag in de zijbalk
+
+- Groep waarvan **alle** kinderen wegvallen → groep wordt niet gerenderd.
+- Parent-sleutel geweigerd maar een kind toegestaan → groep blijft staan met
+  alleen de toegestane kinderen. `NavItem.href` is op een groep een uitklapknop,
+  geen echte bestemming, dus de parent-sleutel wordt voor groepen niet gebruikt
+  om zichtbaarheid te bepalen.
+- Platte items worden op hun eigen sleutel beoordeeld.
+
+## Rechten (leeskant)
+
+- `useMyModulePermissions()` / `useModulePermission(moduleId, featureId?)` — React
+  Query op RPC `my_module_permissions()`, `queryKey: ["my-module-permissions"]`.
+- `useModulePermissionTransform()` — laat zijbalkitems met `none` weg.
+- `ModuleAccessGuard` — pad-gebaseerde guard (module-id uit het eerste
+  URL-segment).
+- `requireModulePermission()` — **server-only**, alleen via
+  `@flowselections/core/server`.
+
+Core leest of schrijft **geen enkele tabel** uit het rechtenschema. Alleen de twee
+RPC's `my_module_permissions()` en `effective_module_permission()`. Het schema
+blijft eigendom van de admin-add-on.
+
+### ModuleAccessGuard is fail-open — met opzet
+
+`ModuleAccessGuard` en `useModulePermission` laten door bij:
+
+- laden (eerste render, eerste login);
+- een ontbrekende RPC (add-on niet geïnstalleerd op die database — PostgREST
+  404 / Postgres 42883);
+- elke andere fout in de query;
+- een module zonder rij in `module_registry` (default-allow).
+
+Dit is een bewuste keuze: zichtbaarheid is geen beveiliging, en een dichte guard
+zou bij elke laadfout of ontbrekende add-on de hele app onbruikbaar maken.
+
+**De echte afscherming is `requireModulePermission()` server-side plus RLS/policies
+op de database.** Lees deze guard niet als beveiligingslaag.
+
+De permissie-query heeft `retry: false`: een ontbrekende RPC mag nooit een
+retry-storm veroorzaken.
+
+## Supabase
+
+De browser-client is env-gedreven en lazy (`VITE_SUPABASE_URL` /
+`VITE_SUPABASE_PUBLISHABLE_KEY`, met `SUPABASE_*` fallback voor SSR). Er staat
+geen projectref of key in de code, ook niet als fallback.

package/dist/components/layout/LoginPage.d.ts

@@ -1,5 +1,6 @@
 interface LoginPageProps {
-    redirectTo: string;
+    /** Pad waarnaar wordt genavigeerd na succesvol inloggen. */
+    redirectTo?: string;
 }
 export declare function LoginPage({ redirectTo }: LoginPageProps): import("react/jsx-runtime").JSX.Element;
 export {};

package/dist/components/layout/LoginPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/LoginPage.tsx"],"names":[],"mappings":"AASA,UAAU,cAAc;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,cAAc,2CA4GvD"}
+{"version":3,"file":"LoginPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/LoginPage.tsx"],"names":[],"mappings":"AAUA,UAAU,cAAc;IACtB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,SAAS,CAAC,EAAE,UAA4B,EAAE,EAAE,cAAc,2CAgIzE"}

package/dist/components/layout/LoginPage.js

@@ -1,5 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from "react";
+import { useRouter } from "@tanstack/react-router";
 import { Button } from "../ui/button";
 import { Input } from "../ui/input";
 import { Label } from "../ui/label";
@@ -7,13 +8,24 @@ import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle }
 import { toast } from "sonner";
 import { loginSchema } from "../../lib/validationSchemas";
 import { supabase } from "../../supabase/client";
-export function LoginPage({ redirectTo }) {
+export function LoginPage({ redirectTo = "/instellingen" }) {
+    const router = useRouter();
     const [email, setEmail] = useState("");
     const [password, setPassword] = useState("");
     const [isLoading, setIsLoading] = useState(false);
     const [showForgot, setShowForgot] = useState(false);
     const [forgotEmail, setForgotEmail] = useState("");
     const [forgotLoading, setForgotLoading] = useState(false);
+    /** Wacht tot de auth-context de nieuwe sessie kent, zodat de route-gate niet terugstuurt. */
+    const waitForAuthContext = async () => {
+        for (let i = 0; i < 60; i++) {
+            const auth = router.options.context?.auth;
+            if (auth?.isAuthenticated)
+                return true;
+            await new Promise((r) => setTimeout(r, 25));
+        }
+        return false;
+    };
     const handleSubmit = async (e) => {
         e.preventDefault();
         const validation = loginSchema.safeParse({ email, password });
@@ -23,13 +35,20 @@ export function LoginPage({ redirectTo }) {
         }
         setIsLoading(true);
         const { error } = await supabase.auth.signInWithPassword({ email, password });
-        setIsLoading(false);
         if (error) {
+            setIsLoading(false);
             toast.error("Controleer je e-mailadres en wachtwoord.");
+            return;
         }
-        else {
+        // Client-side navigatie zonder volledige herlaad: dat voorkomt de flits
+        // waarbij de server (zonder sessie) eerst naar /login terugstuurt.
+        const ready = await waitForAuthContext();
+        if (!ready) {
             window.location.href = redirectTo;
+            return;
         }
+        await router.navigate({ to: redirectTo, replace: true });
+        setIsLoading(false);
     };
     const handleForgotPassword = async (e) => {
         e.preventDefault();
@@ -53,5 +72,5 @@ export function LoginPage({ redirectTo }) {
     if (showForgot) {
         return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: "Wachtwoord vergeten" }), _jsx(CardDescription, { children: "Vul je e-mailadres in om een reset-link te ontvangen" })] }), _jsxs("form", { onSubmit: handleForgotPassword, children: [_jsx(CardContent, { className: "space-y-4", children: _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "forgot-email", children: "E-mailadres" }), _jsx(Input, { id: "forgot-email", type: "email", placeholder: "naam@bedrijf.nl", value: forgotEmail, onChange: (e) => setForgotEmail(e.target.value), required: true, maxLength: 255 })] }) }), _jsxs(CardFooter, { className: "flex flex-col gap-4", children: [_jsx(Button, { type: "submit", className: "w-full", disabled: forgotLoading, children: forgotLoading ? "Versturen..." : "Reset-link versturen" }), _jsx("button", { type: "button", onClick: () => setShowForgot(false), className: "text-sm text-primary hover:underline", children: "Terug naar inloggen" })] })] })] }) }));
     }
-    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: "Inloggen" }), _jsx(CardDescription, { children: "Voer je gegevens in om toegang te krijgen tot het systeem" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "email", children: "E-mailadres" }), _jsx(Input, { id: "email", type: "email", placeholder: "naam@bedrijf.nl", value: email, onChange: (e) => setEmail(e.target.value), required: true, maxLength: 255 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Wachtwoord" }), _jsx(Input, { id: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, maxLength: 128 })] })] }), _jsxs(CardFooter, { className: "flex flex-col gap-4", children: [_jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Bezig met inloggen..." : "Inloggen" }), _jsx("button", { type: "button", onClick: () => setShowForgot(true), className: "text-sm text-muted-foreground hover:text-primary hover:underline", children: "Wachtwoord vergeten?" })] })] })] }) }));
+    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: "Inloggen" }), _jsx(CardDescription, { children: "Voer je gegevens in om toegang te krijgen tot het systeem" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "email", children: "E-mailadres" }), _jsx(Input, { id: "email", type: "email", placeholder: "naam@bedrijf.nl", value: email, onChange: (e) => setEmail(e.target.value), required: true, maxLength: 255 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Wachtwoord" }), _jsx(Input, { id: "password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", value: password, onChange: (e) => setPassword(e.target.value), required: true, maxLength: 128 })] })] }), _jsxs(CardFooter, { className: "flex flex-col gap-4", children: [_jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Bezig met inloggen..." : "Inloggen" }), _jsx("button", { type: "button", onClick: () => setShowForgot(true), className: "text-sm text-muted-foreground hover:text-primary hover:underline", children: "Wachtwoord vergeten?" })] })] })] }) }));
 }

package/dist/components/layout/Sidebar.d.ts

@@ -1,5 +1,5 @@
 import type { AuthContext } from "../../auth/useAuth";
-import type { FlowModule } from "../../types/module";
+import type { FlowModule } from "../../types/module.js";
 interface SidebarProps {
     auth: AuthContext;
     modules: FlowModule[];

package/dist/components/layout/Sidebar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Sidebar.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/Sidebar.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAW,MAAM,oBAAoB,CAAC;AAI9D,UAAU,YAAY;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAkFD,wBAAgB,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,YAAY,2CAkDtD"}
+{"version":3,"file":"Sidebar.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/Sidebar.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAW,MAAM,uBAAuB,CAAC;AAMjE,UAAU,YAAY;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAkFD,wBAAgB,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,YAAY,2CAqDtD"}

package/dist/components/layout/Sidebar.js

@@ -3,6 +3,7 @@ import { useState } from "react";
 import { Link, useLocation } from "@tanstack/react-router";
 import { Settings, LogOut, ChevronDown } from "lucide-react";
 import { cn } from "../../lib/utils";
+import { useModuleListTransform } from "../../extensions/ShellExtensions.js";
 // ─── Single flat nav link ─────────────────────────────────────────────────────
 function SidebarLink({ item, pathname, indent = false, }) {
     const isActive = pathname === item.href;
@@ -22,8 +23,10 @@ function SidebarGroup({ item, pathname, }) {
 export function Sidebar({ auth, modules }) {
     const location = useLocation();
     const pathname = location.pathname;
+    // Zonder ShellExtensionsProvider komt de lijst ongewijzigd terug (code-volgorde).
+    const visibleModules = useModuleListTransform(modules);
     const handleSignOut = async () => {
         await auth.signOut();
     };
-    return (_jsx("aside", { className: "fixed left-0 top-0 z-40 h-screen w-64 bg-sidebar", children: _jsxs("div", { className: "flex h-full flex-col", children: [_jsx("div", { className: "px-12 py-0 border-b border-sidebar-border", children: _jsx("img", { src: "/logo.png", alt: "Logo", className: "w-full h-auto object-contain" }) }), _jsx("nav", { className: "flex-1 space-y-1 px-3 py-4 overflow-y-auto sidebar-scroll", children: modules.map((mod) => mod.nav.children?.length ? (_jsx(SidebarGroup, { item: mod.nav, pathname: pathname }, mod.id)) : (_jsx(SidebarLink, { item: mod.nav, pathname: pathname }, mod.id))) }), _jsxs("div", { className: "border-t border-sidebar-border px-3 py-4", children: [_jsx(SidebarLink, { item: { label: "Instellingen", href: "/instellingen", icon: Settings }, pathname: pathname }), _jsxs("button", { onClick: handleSignOut, className: "flex w-full items-center gap-3 rounded-lg px-3 py-2.5 text-sm font-medium transition-colors text-sidebar-muted hover:bg-sidebar-accent hover:text-sidebar-accent-foreground mt-1 cursor-pointer", children: [_jsx(LogOut, { className: "h-5 w-5" }), "Uitloggen"] })] })] }) }));
+    return (_jsx("aside", { className: "fixed left-0 top-0 z-40 h-screen w-64 bg-sidebar", children: _jsxs("div", { className: "flex h-full flex-col", children: [_jsx("div", { className: "px-12 py-0 border-b border-sidebar-border", children: _jsx("img", { src: "/logo.png", alt: "Logo", className: "w-full h-auto object-contain" }) }), _jsx("nav", { className: "flex-1 space-y-1 px-3 py-4 overflow-y-auto sidebar-scroll", children: visibleModules.map((mod) => mod.nav.children?.length ? (_jsx(SidebarGroup, { item: mod.nav, pathname: pathname }, mod.id)) : (_jsx(SidebarLink, { item: mod.nav, pathname: pathname }, mod.id))) }), _jsxs("div", { className: "border-t border-sidebar-border px-3 py-4", children: [_jsx(SidebarLink, { item: { label: "Instellingen", href: "/instellingen", icon: Settings }, pathname: pathname }), _jsxs("button", { onClick: handleSignOut, className: "flex w-full items-center gap-3 rounded-lg px-3 py-2.5 text-sm font-medium transition-colors text-sidebar-muted hover:bg-sidebar-accent hover:text-sidebar-accent-foreground mt-1 cursor-pointer", children: [_jsx(LogOut, { className: "h-5 w-5" }), "Uitloggen"] })] })] }) }));
 }

package/dist/extensions/ModuleGuardSlot.d.ts

@@ -0,0 +1,10 @@
+import type { ReactNode } from "react";
+/**
+ * Rendert standaard alleen zijn children. Is er via `ShellExtensionsProvider`
+ * een `guard` meegegeven, dan wordt die eromheen gebruikt. Zo kan een shell een
+ * eigen guard inprikken zonder dat core een module hoeft te kennen.
+ */
+export declare function ModuleGuardSlot({ children }: {
+    children: ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=ModuleGuardSlot.d.ts.map

package/dist/extensions/ModuleGuardSlot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ModuleGuardSlot.d.ts","sourceRoot":"","sources":["../../src/core/extensions/ModuleGuardSlot.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAGvC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,2CAIpE"}

package/dist/extensions/ModuleGuardSlot.js

@@ -0,0 +1,13 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useShellGuard } from "./ShellExtensions.js";
+/**
+ * Rendert standaard alleen zijn children. Is er via `ShellExtensionsProvider`
+ * een `guard` meegegeven, dan wordt die eromheen gebruikt. Zo kan een shell een
+ * eigen guard inprikken zonder dat core een module hoeft te kennen.
+ */
+export function ModuleGuardSlot({ children }) {
+    const Guard = useShellGuard();
+    if (!Guard)
+        return _jsx(_Fragment, { children: children });
+    return _jsx(Guard, { children: children });
+}

package/dist/extensions/ShellExtensions.d.ts

@@ -0,0 +1,31 @@
+import type { ComponentType, ReactNode } from "react";
+import type { FlowModule } from "../types/module.js";
+/** Transformeert de modulelijst (filteren en/of sorteren). Puur, geen side effects. */
+export type ModuleListTransform = (modules: FlowModule[]) => FlowModule[];
+export type UseModuleListTransform = () => ModuleListTransform;
+export interface ShellExtensionsProviderProps {
+    /**
+     * Eén of meer hooks die elk een ModuleListTransform teruggeven.
+     *
+     * Contract: geef stabiele referenties mee (module-scope functies, geen inline
+     * lambdas). De array-volgorde is de pipeline-volgorde: eerst rechten filteren,
+     * daarna sorteren.
+     */
+    useModuleList?: UseModuleListTransform | UseModuleListTransform[];
+    /** Optionele guard-component die `ModuleGuardSlot` rendert rond zijn children. */
+    guard?: ComponentType<{
+        children: ReactNode;
+    }>;
+    children: ReactNode;
+}
+export declare function ShellExtensionsProvider({ useModuleList, guard, children, }: ShellExtensionsProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function useShellGuard(): ComponentType<{
+    children: ReactNode;
+}> | undefined;
+/**
+ * Past de geregistreerde transforms toe. Zonder provider, tijdens laden of bij
+ * een fout in een transform komt de lijst ONGEWIJZIGD terug — nooit een lege
+ * zijbalk.
+ */
+export declare function useModuleListTransform(modules: FlowModule[]): FlowModule[];
+//# sourceMappingURL=ShellExtensions.d.ts.map

package/dist/extensions/ShellExtensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ShellExtensions.d.ts","sourceRoot":"","sources":["../../src/core/extensions/ShellExtensions.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,uFAAuF;AACvF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAAG,MAAM,mBAAmB,CAAC;AAS/D,MAAM,WAAW,4BAA4B;IAC3C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAAC;IAClE,kFAAkF;IAClF,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAC/C,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CAAC,EACtC,aAAa,EACb,KAAK,EACL,QAAQ,GACT,EAAE,4BAA4B,2CAY9B;AAED,wBAAgB,aAAa,IAAI,aAAa,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAAC,GAAG,SAAS,CAElF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAuB1E"}

package/dist/extensions/ShellExtensions.js

@@ -0,0 +1,45 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useContext, useMemo } from "react";
+const ShellExtensionsContext = createContext({ transforms: [] });
+export function ShellExtensionsProvider({ useModuleList, guard, children, }) {
+    const transforms = useMemo(() => (Array.isArray(useModuleList) ? useModuleList : useModuleList ? [useModuleList] : []), 
+    // Bewust op de referentie(s): de hooks moeten stabiel zijn, zodat de
+    // hook-volgorde tussen renders nooit verandert.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [useModuleList]);
+    const value = useMemo(() => ({ transforms, guard }), [transforms, guard]);
+    return _jsx(ShellExtensionsContext.Provider, { value: value, children: children });
+}
+export function useShellGuard() {
+    return useContext(ShellExtensionsContext).guard;
+}
+/**
+ * Past de geregistreerde transforms toe. Zonder provider, tijdens laden of bij
+ * een fout in een transform komt de lijst ONGEWIJZIGD terug — nooit een lege
+ * zijbalk.
+ */
+export function useModuleListTransform(modules) {
+    const { transforms } = useContext(ShellExtensionsContext);
+    // Onvoorwaardelijk en in vaste volgorde: geen hook-order-problemen.
+    const applied = [];
+    for (const useTransform of transforms) {
+        try {
+            applied.push(useTransform());
+        }
+        catch {
+            applied.push((list) => list);
+        }
+    }
+    let result = modules;
+    for (const transform of applied) {
+        try {
+            const next = transform(result);
+            if (Array.isArray(next))
+                result = next;
+        }
+        catch {
+            // fail-open: lijst ongewijzigd laten
+        }
+    }
+    return result;
+}

package/dist/index.d.ts

@@ -31,4 +31,12 @@ export { validateFileUpload, ALLOWED_FILE_TYPES, loginSchema } from "./lib/valid
 export { useIsMobile } from "./hooks/use-mobile";
 export { useHuisstijl } from "./hooks/useHuisstijl";
 export type { FlowModule, NavItem, SettingsCard } from "./types/module";
+export { moduleKey, navKey } from "./types/module.js";
+export { ShellExtensionsProvider, useModuleListTransform } from "./extensions/ShellExtensions.js";
+export type { ModuleListTransform, UseModuleListTransform, ShellExtensionsProviderProps, } from "./extensions/ShellExtensions.js";
+export { ModuleGuardSlot } from "./extensions/ModuleGuardSlot.js";
+export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, } from "./permissions/useModulePermission.js";
+export type { PermissionLevel, ModulePermissionRow } from "./permissions/useModulePermission.js";
+export { ModuleAccessGuard } from "./permissions/ModuleAccessGuard.js";
+export type { ModuleAccessGuardProps } from "./permissions/ModuleAccessGuard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGnF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGnF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAClG,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -33,3 +33,10 @@ export { cn } from "./lib/utils";
 export { validateFileUpload, ALLOWED_FILE_TYPES, loginSchema } from "./lib/validationSchemas";
 export { useIsMobile } from "./hooks/use-mobile";
 export { useHuisstijl } from "./hooks/useHuisstijl";
+export { moduleKey, navKey } from "./types/module.js";
+// Shell-extensiepunten (allemaal optioneel; zonder provider ongewijzigd gedrag)
+export { ShellExtensionsProvider, useModuleListTransform } from "./extensions/ShellExtensions.js";
+export { ModuleGuardSlot } from "./extensions/ModuleGuardSlot.js";
+// Rechten (leeskant; fail-open, zie README)
+export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, } from "./permissions/useModulePermission.js";
+export { ModuleAccessGuard } from "./permissions/ModuleAccessGuard.js";

package/dist/permissions/ModuleAccessGuard.d.ts

@@ -0,0 +1,19 @@
+import type { ReactNode } from "react";
+export interface ModuleAccessGuardProps {
+    children: ReactNode;
+    /** Wat te tonen bij `none`. Default: een neutrale melding. */
+    fallback?: ReactNode;
+    /** Overschrijf de module-id; standaard afgeleid uit het eerste URL-segment. */
+    moduleId?: string;
+    featureId?: string | null;
+}
+/**
+ * Pad-gebaseerde guard.
+ *
+ * FAIL-OPEN, met opzet: tijdens laden, bij een ontbrekende RPC of bij elke
+ * fout laat deze guard door. Modules zonder rij in het rechtenschema zijn
+ * default-allow. Dit is UX (menu's en pagina's verbergen), GEEN beveiliging —
+ * de echte afscherming is `requireModulePermission` server-side plus RLS.
+ */
+export declare function ModuleAccessGuard({ children, fallback, moduleId, featureId, }: ModuleAccessGuardProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=ModuleAccessGuard.d.ts.map

package/dist/permissions/ModuleAccessGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ModuleAccessGuard.d.ts","sourceRoot":"","sources":["../../src/core/permissions/ModuleAccessGuard.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAKvC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,SAAS,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,GACV,EAAE,sBAAsB,2CAqBxB"}

package/dist/permissions/ModuleAccessGuard.js

@@ -0,0 +1,20 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useLocation } from "@tanstack/react-router";
+import { navKey } from "../types/module.js";
+import { useModulePermission } from "./useModulePermission.js";
+/**
+ * Pad-gebaseerde guard.
+ *
+ * FAIL-OPEN, met opzet: tijdens laden, bij een ontbrekende RPC of bij elke
+ * fout laat deze guard door. Modules zonder rij in het rechtenschema zijn
+ * default-allow. Dit is UX (menu's en pagina's verbergen), GEEN beveiliging —
+ * de echte afscherming is `requireModulePermission` server-side plus RLS.
+ */
+export function ModuleAccessGuard({ children, fallback, moduleId, featureId, }) {
+    const location = useLocation();
+    const key = moduleId ?? navKey(location.pathname);
+    const { canView } = useModulePermission(key, featureId ?? null);
+    if (canView)
+        return _jsx(_Fragment, { children: children });
+    return (_jsx(_Fragment, { children: fallback ?? (_jsx("div", { className: "flex min-h-[60vh] items-center justify-center p-8", children: _jsxs("div", { className: "max-w-md text-center", children: [_jsx("h1", { className: "text-lg font-semibold text-foreground", children: "Geen toegang" }), _jsx("p", { className: "mt-2 text-sm text-muted-foreground", children: "Je hebt geen rechten voor deze module. Vraag een beheerder om toegang." })] }) })) }));
+}

package/dist/permissions/useModulePermission.d.ts

@@ -0,0 +1,217 @@
+import type { ModuleListTransform } from "../extensions/ShellExtensions.js";
+export type PermissionLevel = "none" | "view" | "edit";
+export interface ModulePermissionRow {
+    moduleId: string;
+    featureId: string | null;
+    permission: PermissionLevel;
+}
+/**
+ * Leest de rechten van de ingelogde gebruiker via RPC `my_module_permissions()`.
+ *
+ * Ontbreekt de RPC (add-on niet geïnstalleerd) of faalt de call, dan is het
+ * resultaat een LEGE lijst zonder zichtbare fout en zonder retry — en dat
+ * betekent bij alle consumers default-allow.
+ */
+export declare function useMyModulePermissions(): {
+    permissions: ModulePermissionRow[];
+    /** True zolang we niets weten; callers behandelen dit als allow. */
+    isUnknown: boolean;
+    data: ModulePermissionRow[];
+    error: Error;
+    isError: true;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: false;
+    isRefetchError: true;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "error";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<ModulePermissionRow[], Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<ModulePermissionRow[]>;
+} | {
+    permissions: ModulePermissionRow[];
+    /** True zolang we niets weten; callers behandelen dit als allow. */
+    isUnknown: boolean;
+    data: ModulePermissionRow[];
+    error: null;
+    isError: false;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: true;
+    isPlaceholderData: false;
+    status: "success";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<ModulePermissionRow[], Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<ModulePermissionRow[]>;
+} | {
+    permissions: ModulePermissionRow[];
+    /** True zolang we niets weten; callers behandelen dit als allow. */
+    isUnknown: boolean;
+    data: undefined;
+    error: Error;
+    isError: true;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: true;
+    isRefetchError: false;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "error";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<ModulePermissionRow[], Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<ModulePermissionRow[]>;
+} | {
+    permissions: ModulePermissionRow[];
+    /** True zolang we niets weten; callers behandelen dit als allow. */
+    isUnknown: boolean;
+    data: undefined;
+    error: null;
+    isError: false;
+    isPending: true;
+    isLoading: true;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "pending";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<ModulePermissionRow[], Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<ModulePermissionRow[]>;
+} | {
+    permissions: ModulePermissionRow[];
+    /** True zolang we niets weten; callers behandelen dit als allow. */
+    isUnknown: boolean;
+    data: undefined;
+    error: null;
+    isError: false;
+    isPending: true;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "pending";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isLoading: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<ModulePermissionRow[], Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<ModulePermissionRow[]>;
+} | {
+    permissions: ModulePermissionRow[];
+    /** True zolang we niets weten; callers behandelen dit als allow. */
+    isUnknown: boolean;
+    data: ModulePermissionRow[];
+    isError: false;
+    error: null;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: true;
+    isPlaceholderData: true;
+    status: "success";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<ModulePermissionRow[], Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<ModulePermissionRow[]>;
+};
+/**
+ * Rechtenniveau voor één module (optioneel één feature). Tijdens laden en bij
+ * elke fout is het antwoord `edit` (fail-open).
+ */
+export declare function useModulePermission(moduleId: string, featureId?: string | null): {
+    level: PermissionLevel;
+    canView: boolean;
+    canEdit: boolean;
+    isLoading: boolean;
+};
+/**
+ * ModuleListTransform die zijbalkitems met `none` weglaat.
+ *
+ * - Tijdens laden / bij fouten: lijst ongewijzigd.
+ * - Modules zonder rij in het rechtenschema: default-allow.
+ * - Groepen: de kinderen bepalen zichtbaarheid. Blijft er geen kind over, dan
+ *   valt de groep weg. Is de parent-sleutel geweigerd maar een kind toegestaan,
+ *   dan blijft de groep staan met alleen de toegestane kinderen — de parent-href
+ *   van een groep is een uitklapknop, geen bestemming.
+ */
+export declare function useModulePermissionTransform(): ModuleListTransform;
+//# sourceMappingURL=useModulePermission.d.ts.map

package/dist/permissions/useModulePermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useModulePermission.d.ts","sourceRoot":"","sources":["../../src/core/permissions/useModulePermission.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAuCD;;;;;;GAMG;AACH,wBAAgB,sBAAsB;;IA0BlC,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGvE;AAyBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;EAW9E;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CAyBlE"}

package/dist/permissions/useModulePermission.js

@@ -0,0 +1,137 @@
+import { useCallback } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { supabase } from "../supabase/client.js";
+import { moduleKey, navKey } from "../types/module.js";
+function normalizeLevel(value) {
+    const v = typeof value === "string" ? value.toLowerCase() : "";
+    if (v === "none" || v === "view" || v === "edit")
+        return v;
+    // Onbekende waarde → fail-open (zichtbaarheid is geen beveiliging).
+    return "edit";
+}
+function normalizeRows(data) {
+    if (!Array.isArray(data))
+        return [];
+    return data.map((raw) => {
+        const row = (raw ?? {});
+        const rawModule = (row["module_id"] ?? row["moduleId"] ?? "");
+        const rawFeature = (row["feature_id"] ?? row["featureId"] ?? null);
+        return {
+            moduleId: navKey(String(rawModule ?? "")),
+            featureId: rawFeature ? String(rawFeature) : null,
+            permission: normalizeLevel(row["permission"] ?? row["level"] ?? row["permission_level"]),
+        };
+    });
+}
+/** Waar of de fout betekent "de rechten-add-on staat niet op deze database". */
+function isMissingRpc(error) {
+    const e = (error ?? {});
+    const code = e.code ?? "";
+    const message = (e.message ?? "").toLowerCase();
+    return (code === "42883" ||
+        code === "PGRST202" ||
+        code === "PGRST302" ||
+        e.status === 404 ||
+        message.includes("does not exist") ||
+        message.includes("could not find the function") ||
+        message.includes("schema cache"));
+}
+/**
+ * Leest de rechten van de ingelogde gebruiker via RPC `my_module_permissions()`.
+ *
+ * Ontbreekt de RPC (add-on niet geïnstalleerd) of faalt de call, dan is het
+ * resultaat een LEGE lijst zonder zichtbare fout en zonder retry — en dat
+ * betekent bij alle consumers default-allow.
+ */
+export function useMyModulePermissions() {
+    const query = useQuery({
+        queryKey: ["my-module-permissions"],
+        queryFn: async () => {
+            const { data, error } = await supabase.rpc("my_module_permissions");
+            if (error) {
+                if (isMissingRpc(error))
+                    return [];
+                // Ook andere fouten mogen niet blokkeren: fail-open, geen retry.
+                return [];
+            }
+            return normalizeRows(data);
+        },
+        // GEEN retry: een ontbrekende RPC mag nooit een retry-storm veroorzaken.
+        retry: false,
+        refetchOnWindowFocus: false,
+        staleTime: 5 * 60 * 1000,
+    });
+    return {
+        ...query,
+        permissions: query.data ?? [],
+        /** True zolang we niets weten; callers behandelen dit als allow. */
+        isUnknown: query.isLoading || query.data === undefined,
+    };
+}
+function resolveLevel(rows, moduleId, featureId) {
+    const key = navKey(moduleId);
+    const forModule = rows.filter((r) => r.moduleId === key);
+    // Geen rij voor deze module → default-allow.
+    if (forModule.length === 0)
+        return "edit";
+    if (featureId) {
+        const feature = forModule.find((r) => r.featureId === featureId);
+        if (feature)
+            return feature.permission;
+    }
+    const moduleLevel = forModule.find((r) => !r.featureId);
+    if (moduleLevel)
+        return moduleLevel.permission;
+    // Alleen feature-rijen bekend: hoogste feature-recht bepaalt moduletoegang.
+    if (forModule.some((r) => r.permission === "edit"))
+        return "edit";
+    if (forModule.some((r) => r.permission === "view"))
+        return "view";
+    return "none";
+}
+/**
+ * Rechtenniveau voor één module (optioneel één feature). Tijdens laden en bij
+ * elke fout is het antwoord `edit` (fail-open).
+ */
+export function useModulePermission(moduleId, featureId) {
+    const { permissions, isUnknown } = useMyModulePermissions();
+    const level = isUnknown ? "edit" : resolveLevel(permissions, moduleId, featureId);
+    return {
+        level,
+        canView: level === "view" || level === "edit",
+        canEdit: level === "edit",
+        isLoading: isUnknown,
+    };
+}
+/**
+ * ModuleListTransform die zijbalkitems met `none` weglaat.
+ *
+ * - Tijdens laden / bij fouten: lijst ongewijzigd.
+ * - Modules zonder rij in het rechtenschema: default-allow.
+ * - Groepen: de kinderen bepalen zichtbaarheid. Blijft er geen kind over, dan
+ *   valt de groep weg. Is de parent-sleutel geweigerd maar een kind toegestaan,
+ *   dan blijft de groep staan met alleen de toegestane kinderen — de parent-href
+ *   van een groep is een uitklapknop, geen bestemming.
+ */
+export function useModulePermissionTransform() {
+    const { permissions, isUnknown } = useMyModulePermissions();
+    return useCallback((modules) => {
+        if (isUnknown || permissions.length === 0)
+            return modules;
+        const result = [];
+        for (const mod of modules) {
+            const children = mod.nav.children;
+            if (children?.length) {
+                const allowed = children.filter((child) => resolveLevel(permissions, navKey(child.href)) !== "none");
+                if (allowed.length === 0)
+                    continue;
+                result.push({ ...mod, nav: { ...mod.nav, children: allowed } });
+                continue;
+            }
+            if (resolveLevel(permissions, moduleKey(mod)) === "none")
+                continue;
+            result.push(mod);
+        }
+        return result;
+    }, [permissions, isUnknown]);
+}

package/dist/server/index.d.ts

@@ -1,3 +1,6 @@
-export { getProviderToken } from "./provider-token.js";
+export { getProviderToken, listProviderAccounts, revokeProviderAccount } from "./provider-token.js";
+export type { ProviderAccount } from "./provider-token.js";
 export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";
+export { requireModulePermission } from "./permissions.server.js";
+export type { PermissionLevel } from "./permissions.server.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/server/index.js

@@ -1,2 +1,5 @@
-export { getProviderToken } from "./provider-token.js";
+export { getProviderToken, listProviderAccounts, revokeProviderAccount } from "./provider-token.js";
 export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";
+// Server-only rechtencheck. Uitsluitend via het "./server" subpath, nooit via
+// de hoofdbarrel.
+export { requireModulePermission } from "./permissions.server.js";

package/dist/server/permissions.server.d.ts

@@ -0,0 +1,16 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+export type PermissionLevel = "none" | "view" | "edit";
+/**
+ * Server-side rechtencheck via RPC `effective_module_permission()`.
+ *
+ * Bedoeld om te combineren met `requireSupabaseAuth`: geef de authenticated
+ * client uit `context.supabase` mee.
+ *
+ * - Ontbreekt de RPC (rechten-add-on niet geïnstalleerd) → toegestaan
+ *   (default-allow), zodat bestaande shells blijven werken.
+ * - Onvoldoende rechten → gooit een `Response` met status 403.
+ *
+ * Core raakt géén enkele tabel uit het rechtenschema; alleen deze RPC.
+ */
+export declare function requireModulePermission(supabase: SupabaseClient<any, any, any>, moduleId: string, featureId?: string | null, level?: PermissionLevel): Promise<PermissionLevel>;
+//# sourceMappingURL=permissions.server.d.ts.map

package/dist/server/permissions.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.server.d.ts","sourceRoot":"","sources":["../../src/core/server/permissions.server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAkBvD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAM,GAAG,IAAW,EAC/B,KAAK,GAAE,eAAwB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAuB1B"}

package/dist/server/permissions.server.js

@@ -0,0 +1,41 @@
+const RANK = { none: 0, view: 1, edit: 2 };
+function isMissingRpc(error) {
+    const e = (error ?? {});
+    const code = e.code ?? "";
+    const message = (e.message ?? "").toLowerCase();
+    return (code === "42883" ||
+        code === "PGRST202" ||
+        code === "PGRST302" ||
+        e.status === 404 ||
+        message.includes("does not exist") ||
+        message.includes("could not find the function"));
+}
+/**
+ * Server-side rechtencheck via RPC `effective_module_permission()`.
+ *
+ * Bedoeld om te combineren met `requireSupabaseAuth`: geef de authenticated
+ * client uit `context.supabase` mee.
+ *
+ * - Ontbreekt de RPC (rechten-add-on niet geïnstalleerd) → toegestaan
+ *   (default-allow), zodat bestaande shells blijven werken.
+ * - Onvoldoende rechten → gooit een `Response` met status 403.
+ *
+ * Core raakt géén enkele tabel uit het rechtenschema; alleen deze RPC.
+ */
+export async function requireModulePermission(supabase, moduleId, featureId = null, level = "view") {
+    const { data, error } = await supabase.rpc("effective_module_permission", {
+        _module_id: moduleId,
+        _feature_id: featureId,
+    });
+    if (error) {
+        if (isMissingRpc(error))
+            return "edit";
+        throw new Response("Rechtencheck mislukt", { status: 500 });
+    }
+    const raw = typeof data === "string" ? data.toLowerCase() : "";
+    const effective = raw === "none" || raw === "view" || raw === "edit" ? raw : "edit";
+    if (RANK[effective] < RANK[level]) {
+        throw new Response("Forbidden: geen rechten voor deze module", { status: 403 });
+    }
+    return effective;
+}

package/dist/server/provider-token.d.ts

@@ -13,6 +13,13 @@ export declare class CentralAuthUnavailableError extends Error {
 export declare class AmbiguousAccountError extends Error {
     constructor(message: string);
 }
+export interface ProviderAccount {
+    accountKey: string;
+    environment: "staging" | "live";
+    status: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
 export declare function getProviderToken(provider: string, opts?: {
     environment?: "staging" | "live";
     accountKey?: string;
@@ -20,4 +27,10 @@ export declare function getProviderToken(provider: string, opts?: {
     accessToken: string;
     expiresAt: Date;
 }>;
+export declare function listProviderAccounts(provider: string, opts?: {
+    environment?: "staging" | "live";
+}): Promise<ProviderAccount[]>;
+export declare function revokeProviderAccount(provider: string, accountKey: string, opts?: {
+    environment?: "staging" | "live";
+}): Promise<void>;
 //# sourceMappingURL=provider-token.d.ts.map

package/dist/server/provider-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAkID,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA6BnD"}
+{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAOD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AA4LD,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA6BnD;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,EAAE,CAAC,CA4C5B;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/server/provider-token.js

@@ -30,6 +30,10 @@ export class AmbiguousAccountError extends Error {
 }
 const TIMEOUT_MS = 10000;
 const EXPIRY_BUFFER_MS = 60000;
+// Module-private by design: getProviderToken and revokeProviderAccount share
+// this Map (revoke invalidates entries it never wrote itself), so it must
+// never be exposed or passed around — the two functions' coupling through it
+// is intentional, but only within this file.
 const cache = new Map();
 function isFresh(token) {
     return token.expiresAt.getTime() - EXPIRY_BUFFER_MS > Date.now();
@@ -37,55 +41,24 @@ function isFresh(token) {
 function logAuthFailure(provider, environment, status) {
     console.error("[central-auth] provider token request failed", { provider, environment, status });
 }
-async function fetchProviderToken(provider, environment, accountKey) {
+function getCentralAuthConfig() {
     const baseUrl = process.env.CENTRAL_AUTH_URL;
     const secret = process.env.CENTRAL_AUTH_SECRET;
     if (!baseUrl || !secret) {
         throw new CentralAuthConfigError("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
     }
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/token/${encodeURIComponent(provider)}`;
-    const requestBody = { environment };
-    if (accountKey !== undefined)
-        requestBody.account_key = accountKey;
-    const controller = new AbortController();
-    let timedOut = false;
-    const timeout = setTimeout(() => {
-        timedOut = true;
-        controller.abort();
-    }, TIMEOUT_MS);
-    let response;
-    try {
-        response = await fetch(url, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${secret}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify(requestBody),
-            signal: controller.signal,
-        });
-    }
-    catch {
-        logAuthFailure(provider, environment, timedOut ? "timeout" : "network");
-        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${provider}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-    if (response.ok) {
-        let body;
-        try {
-            body = (await response.json());
-        }
-        catch {
-            logAuthFailure(provider, environment, response.status);
-            throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${environment}, status=${response.status}).`);
-        }
-        return {
-            accessToken: body.access_token,
-            expiresAt: new Date(body.expires_at),
-        };
-    }
+    return { baseUrl, secret };
+}
+// segment is always one of the three literals above, never caller input —
+// the URL path must never be built from anything a caller supplies.
+function buildCentralUrl(baseUrl, segment, provider, query) {
+    const base = `${baseUrl.replace(/\/+$/, "")}/api/${segment}/${encodeURIComponent(provider)}`;
+    if (!query)
+        return base;
+    const qs = new URLSearchParams(query).toString();
+    return qs ? `${base}?${qs}` : base;
+}
+async function mapCentralError(response, provider, environment, allowAmbiguousAccount) {
     let errorCode;
     try {
         const text = await response.text();
@@ -98,6 +71,14 @@ async function fetchProviderToken(provider, environment, accountKey) {
     }
     logAuthFailure(provider, environment, response.status);
     if (response.status === 400 && errorCode === "ambiguous_account") {
+        if (!allowAmbiguousAccount) {
+            // Only /api/token/ can legitimately return ambiguous_account. Any other
+            // endpoint returning it is an unexpected/malformed response from
+            // central, not a real ambiguity the caller can resolve — surfacing it
+            // as AmbiguousAccountError here would hand the caller a message about
+            // "multiple accounts" for an endpoint that never asked to disambiguate.
+            throw new CentralAuthUnavailableError(`Central auth returned an unexpected ambiguous_account error (provider=${provider}, environment=${environment}, status=400).`);
+        }
         throw new AmbiguousAccountError(`Central auth reports multiple connected accounts for provider "${provider}"; accountKey is required to disambiguate (provider=${provider}, environment=${environment}).`);
     }
     if (response.status === 401 || errorCode === "unauthorized") {
@@ -116,6 +97,58 @@ async function fetchProviderToken(provider, environment, accountKey) {
     }
     throw new CentralAuthUnavailableError(`Central auth unavailable (provider=${provider}, environment=${environment}, status=${response.status}).`);
 }
+async function requestCentral(segment, provider, environment, init, allowAmbiguousAccount) {
+    const { baseUrl, secret } = getCentralAuthConfig();
+    const url = buildCentralUrl(baseUrl, segment, provider, init.query);
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            method: init.method,
+            headers: {
+                Authorization: `Bearer ${secret}`,
+                ...(init.body !== undefined ? { "Content-Type": "application/json" } : {}),
+            },
+            ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        logAuthFailure(provider, environment, timedOut ? "timeout" : "network");
+        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${provider}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (!response.ok) {
+        await mapCentralError(response, provider, environment, allowAmbiguousAccount);
+    }
+    return response;
+}
+async function fetchProviderToken(provider, environment, accountKey) {
+    const requestBody = { environment };
+    if (accountKey !== undefined)
+        requestBody.account_key = accountKey;
+    const response = await requestCentral("token", provider, environment, { method: "POST", body: requestBody }, 
+    /* allowAmbiguousAccount */ true);
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        logAuthFailure(provider, environment, response.status);
+        throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+    return {
+        accessToken: body.access_token,
+        expiresAt: new Date(body.expires_at),
+    };
+}
 export async function getProviderToken(provider, opts) {
     const environment = opts?.environment ?? "live";
     // Moet central's normalisatie in oauth-authcode.server.ts spiegelen (trim + toLowerCase).
@@ -146,3 +179,55 @@ export async function getProviderToken(provider, opts) {
     });
     return promise;
 }
+export async function listProviderAccounts(provider, opts) {
+    // Filter: only sent to central when the caller explicitly asked for one
+    // environment. Omitting it must return accounts across all environments —
+    // defaulting it here would silently narrow every unfiltered call to "live".
+    const environmentFilter = opts?.environment;
+    // Context for error messages/logging only, never the query filter above.
+    // Defaults to "live" purely so log lines read "environment=live" instead of
+    // "environment=" when no filter was requested.
+    const logEnvironment = environmentFilter ?? "live";
+    const response = await requestCentral("accounts", provider, logEnvironment, { method: "GET", query: environmentFilter ? { environment: environmentFilter } : undefined }, 
+    /* allowAmbiguousAccount */ false);
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        logAuthFailure(provider, logEnvironment, response.status);
+        throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${logEnvironment}, status=${response.status}).`);
+    }
+    // "revoked" rows are intentionally kept — the caller decides what to do with them.
+    return body.accounts.map((account) => ({
+        accountKey: account.account_key,
+        environment: account.environment,
+        status: account.status,
+        createdAt: new Date(account.created_at),
+        updatedAt: new Date(account.updated_at),
+    }));
+}
+export async function revokeProviderAccount(provider, accountKey, opts) {
+    const environment = opts?.environment ?? "live";
+    // Same normalisation as getProviderToken — a caller revoking "INFO@X.nl"
+    // must invalidate the exact cache entries getProviderToken would have used.
+    const normalizedAccountKey = accountKey.trim().toLowerCase();
+    if (!normalizedAccountKey) {
+        throw new CentralAuthConfigError("revokeProviderAccount requires a non-empty accountKey.");
+    }
+    await requestCentral("revoke", provider, environment, { method: "POST", body: { account_key: normalizedAccountKey, environment } }, 
+    /* allowAmbiguousAccount */ false);
+    // Cache-invalidatie na een geslaagde revoke: verwijder ALLE entries met
+    // prefix `${provider}:${environment}:`, niet alleen die van dit accountKey.
+    // Reden: de entry zonder accountKey (`${provider}:${environment}:`)
+    // resolveert naar "de enige actieve mailbox" — revoke je die mailbox, dan
+    // blijft een geldig token voor een ingetrokken account tot een uur in de
+    // cache staan. Revoke verandert bovendien de ambiguity-resolutie voor
+    // toekomstige aanroepen zonder accountKey. Alleen uitvoeren als de
+    // revoke-call zelf slaagde (requestCentral gooit hierboven bij een fout).
+    const prefix = `${provider}:${environment}:`;
+    for (const key of cache.keys()) {
+        if (key.startsWith(prefix))
+            cache.delete(key);
+    }
+}

package/dist/types/module.d.ts

@@ -16,5 +16,28 @@ export interface FlowModule {
     version: string;
     nav: NavItem;
     settingsCards: SettingsCard[];
+    /**
+     * Optionele expliciete sleutel waarmee deze module extern (module_registry,
+     * rechten) wordt geïdentificeerd. Zet deze wanneer de afgeleide sleutel niet
+     * gelijk is aan de registry-slug.
+     */
+    registryKey?: string;
 }
+/**
+ * De externe modulesleutel.
+ *
+ * Regel (generiek, core kent geen enkele module- of domeinnaam):
+ *   1. `registryKey` als die is opgegeven;
+ *   2. anders het eerste padsegment van `nav.href`;
+ *   3. afsluitende underscores worden gestript.
+ *
+ * Waarom (3): een afsluitende underscore in een routepad is een TanStack
+ * un-nesting-conventie (`/voorraad_/detail`), geen betekenisvol segment. Zonder
+ * strippen levert dezelfde module twee sleutels op (`voorraad` en `voorraad_`)
+ * en verdwijnt hij half uit de zijbalk. Strippen is gekozen boven "registryKey
+ * verplicht maken", omdat dat laatste bestaande modules stil zou breken.
+ */
+export declare function moduleKey(mod: FlowModule): string;
+/** Zelfde afleidingsregel, maar voor een los pad (nav-children, URL-pathname). */
+export declare function navKey(href: string): string;
 //# sourceMappingURL=module.d.ts.map

package/dist/types/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/core/types/module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,aAAa,EAAE,YAAY,EAAE,CAAC;CAC/B"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/core/types/module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAGjD;AAED,kFAAkF;AAClF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3C"}

package/dist/types/module.js

@@ -1 +1,24 @@
-export {};
+/**
+ * De externe modulesleutel.
+ *
+ * Regel (generiek, core kent geen enkele module- of domeinnaam):
+ *   1. `registryKey` als die is opgegeven;
+ *   2. anders het eerste padsegment van `nav.href`;
+ *   3. afsluitende underscores worden gestript.
+ *
+ * Waarom (3): een afsluitende underscore in een routepad is een TanStack
+ * un-nesting-conventie (`/voorraad_/detail`), geen betekenisvol segment. Zonder
+ * strippen levert dezelfde module twee sleutels op (`voorraad` en `voorraad_`)
+ * en verdwijnt hij half uit de zijbalk. Strippen is gekozen boven "registryKey
+ * verplicht maken", omdat dat laatste bestaande modules stil zou breken.
+ */
+export function moduleKey(mod) {
+    if (mod.registryKey)
+        return mod.registryKey;
+    return navKey(mod.nav.href);
+}
+/** Zelfde afleidingsregel, maar voor een los pad (nav-children, URL-pathname). */
+export function navKey(href) {
+    const segment = href.split("?")[0].split("#")[0].split("/").filter(Boolean)[0] ?? "";
+    return segment.replace(/_+$/, "");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.15",
+  "version": "1.0.18",
   "private": false,
   "sideEffects": false,
   "type": "module",
@@ -16,7 +16,9 @@
       "default": "./dist/server/index.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "dev": "vite dev",
     "build": "vite build",
@@ -70,6 +72,7 @@
     "embla-carousel-react": "^8.6.0",
     "input-otp": "^1.4.2",
     "lucide-react": "^0.575.0",
+    "nitro": "3.0.260603-beta",
     "react": "^19.2.0",
     "react-barcode": "^1.6.1",
     "react-day-picker": "^9.14.0",
@@ -88,7 +91,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.32.0",
-    "@lovable.dev/vite-tanstack-config": "^1.2.0",
+    "@lovable.dev/vite-tanstack-config": "2.13.1",
     "@types/node": "^22.16.5",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",