@flowselections/core 1.0.18 → 1.0.20

package/dist/auth/handover.functions.d.ts

@@ -0,0 +1,16 @@
+export interface HandoverExchangeResult {
+    accessToken: string;
+    refreshToken: string;
+}
+/**
+ * Wisselt een eenmalige handover-code in voor een Supabase-sessie.
+ *
+ * Fail-closed: bij elke fout gooit deze functie en krijgt de client alleen een
+ * generieke foutmelding. De code wordt nooit gelogd.
+ */
+export declare const exchangeHandover: import("@tanstack/start-client-core").RequiredFetcher<undefined, (data: {
+    code: string;
+}) => {
+    code: string;
+}, Promise<HandoverExchangeResult>>;
+//# sourceMappingURL=handover.functions.d.ts.map

package/dist/auth/handover.functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handover.functions.d.ts","sourceRoot":"","sources":["../../src/core/auth/handover.functions.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,0EACJ;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;;mCASrC,CAAC"}

package/dist/auth/handover.functions.js

@@ -0,0 +1,23 @@
+import { createServerFn } from "@tanstack/react-start";
+// Top-level import van het server-only bestand: de Start-compiler haalt de
+// handler-body (en dus deze aanroep) uit de clientbundel. Met een testbuild
+// gecontroleerd: het central-auth-secret en het exchange-pad komen niet in de
+// clientchunks voor.
+import { exchangeHandoverCode } from "../server/provider-token.js";
+/**
+ * Wisselt een eenmalige handover-code in voor een Supabase-sessie.
+ *
+ * Fail-closed: bij elke fout gooit deze functie en krijgt de client alleen een
+ * generieke foutmelding. De code wordt nooit gelogd.
+ */
+export const exchangeHandover = createServerFn({ method: "POST" })
+    .inputValidator((data) => {
+    if (!data || typeof data.code !== "string" || data.code.trim() === "") {
+        throw new Error("invalid_request");
+    }
+    return { code: data.code };
+})
+    .handler(async ({ data }) => {
+    const session = await exchangeHandoverCode(data.code);
+    return { accessToken: session.accessToken, refreshToken: session.refreshToken };
+});

package/dist/components/layout/HandoverPage.d.ts

@@ -0,0 +1,8 @@
+export interface HandoverPageProps {
+    /** Waar de gebruiker na een geslaagde handover naartoe gaat. */
+    redirectTo?: string;
+    /** Pad van de (centrale) inlogpagina voor de foutknop. */
+    loginPath?: string;
+}
+export declare function HandoverPage({ redirectTo, loginPath }: HandoverPageProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=HandoverPage.d.ts.map

package/dist/components/layout/HandoverPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandoverPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/HandoverPage.tsx"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,YAAY,CAAC,EAAE,UAAgB,EAAE,SAAoB,EAAE,EAAE,iBAAiB,2CAgGzF"}

package/dist/components/layout/HandoverPage.js

@@ -0,0 +1,73 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from "react";
+import { useRouter } from "@tanstack/react-router";
+import { Button } from "../ui/button";
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "../ui/card";
+import { supabase } from "../../supabase/client";
+import { exchangeHandover } from "../../auth/handover.functions.js";
+const FOUTMELDING = "Inloggen is niet gelukt. Probeer het opnieuw vanaf de inlogpagina.";
+export function HandoverPage({ redirectTo = "/", loginPath = "/login" }) {
+    const router = useRouter();
+    const [failed, setFailed] = useState(false);
+    const started = useRef(false);
+    /** Wacht tot de auth-context de nieuwe sessie kent, zodat de route-gate niet terugstuurt. */
+    const waitForAuthContext = async () => {
+        for (let i = 0; i < 60; i++) {
+            const auth = router.options.context?.auth;
+            if (auth?.isAuthenticated)
+                return true;
+            await new Promise((r) => setTimeout(r, 25));
+        }
+        return false;
+    };
+    useEffect(() => {
+        // React 19 mount kan in dev dubbel vuren; een code is eenmalig bruikbaar.
+        if (started.current)
+            return;
+        started.current = true;
+        (async () => {
+            const code = new URLSearchParams(window.location.search).get("code");
+            if (!code) {
+                setFailed(true);
+                return;
+            }
+            // Code direct uit de adresbalk halen: hij mag niet in de geschiedenis
+            // of in een referer blijven staan.
+            const cleanUrl = window.location.pathname + window.location.hash;
+            window.history.replaceState(null, "", cleanUrl);
+            try {
+                // Eerst een eventuele bestaande sessie beëindigen, anders belandt
+                // iemand in de omgeving van de vorige gebruiker. Scope 'local':
+                // alleen de lokale opslag wissen, geen server-side sessies intrekken.
+                // De standaardscope ('global') zou óók de net aangemaakte
+                // handover-sessie server-side ongeldig maken (session_not_found).
+                const { data } = await supabase.auth.getSession();
+                if (data.session)
+                    await supabase.auth.signOut({ scope: "local" });
+                const result = await exchangeHandover({ data: { code } });
+                const { error } = await supabase.auth.setSession({
+                    access_token: result.accessToken,
+                    refresh_token: result.refreshToken,
+                });
+                if (error) {
+                    setFailed(true);
+                    return;
+                }
+                await waitForAuthContext();
+                // Nooit window.location.href: een volledige pagina-load laat de
+                // server (zonder sessie) eerst naar /login redirecten.
+                await router.navigate({ to: redirectTo, replace: true });
+            }
+            catch {
+                setFailed(true);
+            }
+        })();
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    if (failed) {
+        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: "Inloggen mislukt" }), _jsx(CardDescription, { children: FOUTMELDING })] }), _jsx(CardFooter, { children: _jsx(Button, { className: "w-full", onClick: () => {
+                                window.location.href = loginPath;
+                            }, children: "Naar de inlogpagina" }) })] }) }));
+    }
+    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsx(Card, { className: "w-full max-w-md", children: _jsxs(CardContent, { className: "flex flex-col items-center gap-4 py-10", children: [_jsx("div", { className: "animate-spin rounded-full h-8 w-8 border-b-2 border-primary" }), _jsx("p", { className: "text-sm text-muted-foreground", children: "Je wordt aangemeld\u2026" })] }) }) }));
+}

package/dist/index.d.ts

@@ -3,6 +3,8 @@ export type { AuthContext, AuthState, AuthActions, AppRole } from "./auth/useAut
 export { supabase } from "./supabase/client";
 export type { Database } from "./supabase/types";
 export { LoginPage } from "./components/layout/LoginPage";
+export { HandoverPage } from "./components/layout/HandoverPage";
+export type { HandoverPageProps } from "./components/layout/HandoverPage";
 export { ResetWachtwoordPage } from "./components/layout/ResetWachtwoordPage";
 export { Header } from "./components/layout/Header";
 export { InstellingenPage } from "./components/layout/InstellingenPage";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGnF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAClG,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGnF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAClG,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@ export { useAuth, useAuthState } from "./auth/useAuth";
 export { supabase } from "./supabase/client";
 // Layout
 export { LoginPage } from "./components/layout/LoginPage";
+export { HandoverPage } from "./components/layout/HandoverPage";
 export { ResetWachtwoordPage } from "./components/layout/ResetWachtwoordPage";
 export { Header } from "./components/layout/Header";
 export { InstellingenPage } from "./components/layout/InstellingenPage";

package/dist/server/index.d.ts

@@ -1,5 +1,7 @@
 export { getProviderToken, listProviderAccounts, revokeProviderAccount } from "./provider-token.js";
 export type { ProviderAccount } from "./provider-token.js";
+export { exchangeHandoverCode, HandoverExchangeError } from "./provider-token.js";
+export type { HandoverSession } from "./provider-token.js";
 export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";
 export { requireModulePermission } from "./permissions.server.js";
 export type { PermissionLevel } from "./permissions.server.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/server/index.js

@@ -1,4 +1,5 @@
 export { getProviderToken, listProviderAccounts, revokeProviderAccount } from "./provider-token.js";
+export { exchangeHandoverCode, HandoverExchangeError } from "./provider-token.js";
 export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";
 // Server-only rechtencheck. Uitsluitend via het "./server" subpath, nooit via
 // de hoofdbarrel.

package/dist/server/provider-token.d.ts

@@ -33,4 +33,21 @@ export declare function listProviderAccounts(provider: string, opts?: {
 export declare function revokeProviderAccount(provider: string, accountKey: string, opts?: {
     environment?: "staging" | "live";
 }): Promise<void>;
+export declare class HandoverExchangeError extends Error {
+    constructor(message: string);
+}
+export interface HandoverSession {
+    accessToken: string;
+    refreshToken: string;
+    /** Kan ongeldig zijn als central geen expires_at meestuurt; alleen informatief. */
+    expiresAt: Date;
+}
+/**
+ * POST {CENTRAL_AUTH_URL}/api/session/exchange met body { code }.
+ *
+ * Fail-closed: elke fout gooit. De code komt NOOIT in een logregel of
+ * foutmelding terecht, en het secret verlaat deze module niet.
+ * Uitsluitend beschikbaar via het "./server"-subpath.
+ */
+export declare function exchangeHandoverCode(code: string): Promise<HandoverSession>;
 //# sourceMappingURL=provider-token.d.ts.map

package/dist/server/provider-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAOD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AA4LD,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA6BnD;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,EAAE,CAAC,CA4C5B;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,IAAI,CAAC,CA8Bf"}
+{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAOD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAqMD,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA6BnD;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,EAAE,CAAC,CA4C5B;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAMD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAmCjF"}

package/dist/server/provider-token.js

@@ -49,10 +49,12 @@ function getCentralAuthConfig() {
     }
     return { baseUrl, secret };
 }
-// segment is always one of the three literals above, never caller input —
+// segment is always one of the literals above, never caller input —
 // the URL path must never be built from anything a caller supplies.
+// provider === undefined betekent: provider-less endpoint, geen extra segment.
 function buildCentralUrl(baseUrl, segment, provider, query) {
-    const base = `${baseUrl.replace(/\/+$/, "")}/api/${segment}/${encodeURIComponent(provider)}`;
+    const path = provider === undefined ? segment : `${segment}/${encodeURIComponent(provider)}`;
+    const base = `${baseUrl.replace(/\/+$/, "")}/api/${path}`;
     if (!query)
         return base;
     const qs = new URLSearchParams(query).toString();
@@ -97,9 +99,13 @@ async function mapCentralError(response, provider, environment, allowAmbiguousAc
     }
     throw new CentralAuthUnavailableError(`Central auth unavailable (provider=${provider}, environment=${environment}, status=${response.status}).`);
 }
-async function requestCentral(segment, provider, environment, init, allowAmbiguousAccount) {
+async function requestCentral(segment, 
+// undefined bij provider-less endpoints; alleen voor de URL relevant.
+provider, environment, init, allowAmbiguousAccount) {
     const { baseUrl, secret } = getCentralAuthConfig();
     const url = buildCentralUrl(baseUrl, segment, provider, init.query);
+    // Label uitsluitend voor logging en foutmeldingen — nooit voor de URL.
+    const providerLabel = provider ?? segment;
     const controller = new AbortController();
     let timedOut = false;
     const timeout = setTimeout(() => {
@@ -119,14 +125,14 @@ async function requestCentral(segment, provider, environment, init, allowAmbiguo
         });
     }
     catch {
-        logAuthFailure(provider, environment, timedOut ? "timeout" : "network");
-        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${provider}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
+        logAuthFailure(providerLabel, environment, timedOut ? "timeout" : "network");
+        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${providerLabel}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
     }
     finally {
         clearTimeout(timeout);
     }
     if (!response.ok) {
-        await mapCentralError(response, provider, environment, allowAmbiguousAccount);
+        await mapCentralError(response, providerLabel, environment, allowAmbiguousAccount);
     }
     return response;
 }
@@ -231,3 +237,44 @@ export async function revokeProviderAccount(provider, accountKey, opts) {
             cache.delete(key);
     }
 }
+// ---------------------------------------------------------------------------
+// Handover: eenmalige code van central-auth inwisselen voor een Supabase-sessie.
+// ---------------------------------------------------------------------------
+export class HandoverExchangeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HandoverExchangeError";
+    }
+}
+/**
+ * POST {CENTRAL_AUTH_URL}/api/session/exchange met body { code }.
+ *
+ * Fail-closed: elke fout gooit. De code komt NOOIT in een logregel of
+ * foutmelding terecht, en het secret verlaat deze module niet.
+ * Uitsluitend beschikbaar via het "./server"-subpath.
+ */
+export async function exchangeHandoverCode(code) {
+    if (typeof code !== "string" || code.trim() === "") {
+        throw new HandoverExchangeError("Handover code is missing.");
+    }
+    const response = await requestCentral("session/exchange", 
+    /* provider */ undefined, "live", { method: "POST", body: { code } }, 
+    /* allowAmbiguousAccount */ false);
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        logAuthFailure("session/exchange", "live", response.status);
+        throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (endpoint=session/exchange, status=${response.status}).`);
+    }
+    if (typeof body.access_token !== "string" || typeof body.refresh_token !== "string") {
+        logAuthFailure("session/exchange", "live", response.status);
+        throw new HandoverExchangeError(`Central auth returned an incomplete session (endpoint=session/exchange, status=${response.status}).`);
+    }
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        expiresAt: new Date(typeof body.expires_at === "string" ? body.expires_at : Date.now()),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "private": false,
   "sideEffects": false,
   "type": "module",