@flowselections/core 1.0.28 → 1.0.30

package/README.md

@@ -206,3 +206,14 @@ Ook: `resetPasswordRoute({ landing })` (`/reset-wachtwoord`), `landingRoute({ la
 `prepublishOnly` draait `build:pkg`, dat `dist/` eerst leegmaakt, opnieuw bouwt en met
 `scripts/check-pkg.mjs` controleert dat `dist/` precies het pakket bevat. `npm publish` publiceert dus nooit
 een preview-build.
+
+## Shell-adres en Central-koppeling (`./server`)
+
+De door het dashboard gegenereerde globale request-middleware roept per verzoek aan:
+
+```ts
+import { runShellRuntime } from "@flowselections/core/server";
+await runShellRuntime(); // zet PUBLIC_BASE_URL uit de database, controleert de Central-koppeling hooguit eens per uur
+```
+
+Vereist `SUPABASE_URL`, `SB_SERVICE_ROLE_KEY`, `CENTRAL_AUTH_URL`, `CENTRAL_AUTH_SECRET`. Gooit nooit; de leessleutel wordt nooit gelogd of teruggegeven.

package/dist/auth/redirect.d.ts

@@ -23,7 +23,7 @@ export interface ModuleAccessContext {
 /**
  * Sinds 1.0.23. Moduletoegang voor een pad. Wacht max. 3 s; fout, time-out,
  * vrijgesteld pad of geen modulerij → `edit` (fail-open).
- * Zichtbaarheid, geen beveiliging.
+ * Superadmin → altijd `edit`; admin volgt de rechten. Zichtbaarheid, geen beveiliging.
  */
 export declare function resolveModuleAccess(path: string, opts?: {
     userId?: string | null;

package/dist/auth/redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/core/auth/redirect.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAazE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,eAAe,CAAC;CAC/B;AAUD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACnF,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,yFAAyF;AACzF,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/E,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,EACtC,SAAS,SAAW,GACnB,IAAI,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuB3D"}
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/core/auth/redirect.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAazE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,eAAe,CAAC;CAC/B;AAWD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACnF,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,yFAAyF;AACzF,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/E,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,EACtC,SAAS,SAAW,GACnB,IAAI,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuB3D"}

package/dist/auth/redirect.js

@@ -38,13 +38,14 @@ export function readRedirectParam(fallback) {
 function pathOf(location) {
     return location.pathname ?? location.href.split("?")[0].split("#")[0];
 }
+/** Alleen superadmin heeft een vrijbrief voor modulerechten; admin volgt de rechten. */
 function isAdminRoles(roles) {
-    return Array.isArray(roles) && (roles.includes("admin") || roles.includes("superadmin"));
+    return Array.isArray(roles) && roles.includes("superadmin");
 }
 /**
  * Sinds 1.0.23. Moduletoegang voor een pad. Wacht max. 3 s; fout, time-out,
  * vrijgesteld pad of geen modulerij → `edit` (fail-open).
- * Zichtbaarheid, geen beveiliging.
+ * Superadmin → altijd `edit`; admin volgt de rechten. Zichtbaarheid, geen beveiliging.
  */
 export async function resolveModuleAccess(path, opts = {}) {
     const key = navKey(path);

package/dist/components/layout/AuthenticatedLayout.js

@@ -45,5 +45,5 @@ export function AuthenticatedLayout({ children, header = true, permissions = tru
         visibleModules,
         permissionsLoading: loading,
     }), [sidebarProps.shellId, sidebarProps.modules, visibleModules, loading]);
-    return (_jsx(ShellContext.Provider, { value: shell, children: _jsxs("div", { className: "min-h-screen bg-background [--core-topbar-h:3.5rem] md:[--core-topbar-h:0px]", children: [_jsx(Sidebar, { ...sidebarProps, permissions: permissions, visibleModules: visibleModules, loading: loading }), _jsxs("div", { className: "flex min-h-dvh flex-col pt-14 md:ml-64 md:pt-0", children: [header && _jsx(Header, { title: title }), _jsx("main", { className: "flex-1", children: permissions && access === "none" ? _jsx(NoAccess, {}) : (children ?? _jsx(Outlet, {})) })] })] }) }));
+    return (_jsx(ShellContext.Provider, { value: shell, children: _jsxs("div", { className: "min-h-screen bg-background [--core-topbar-h:3.5rem] md:[--core-topbar-h:0px]", children: [_jsx(Sidebar, { ...sidebarProps, permissions: permissions, visibleModules: visibleModules, loading: loading }), _jsxs("div", { className: "flex min-h-dvh flex-col pt-[var(--core-topbar-h)] md:ml-64 md:pt-0", children: [header && _jsx(Header, { title: title }), _jsx("main", { className: "flex-1", children: permissions && access === "none" ? _jsx(NoAccess, {}) : (children ?? _jsx(Outlet, {})) })] })] }) }));
 }

package/dist/components/layout/Header.js

@@ -7,5 +7,5 @@ import { BugsDialog } from "./BugsDialog.js";
 import { NotificationBell } from "./NotificationBell.js";
 export function Header({ title }) {
     const [bugsDialogOpen, setBugsDialogOpen] = useState(false);
-    return (_jsxs(_Fragment, { children: [_jsxs("header", { className: "sticky top-[var(--core-topbar-h,0px)] md:top-0 z-30 flex h-16 items-center justify-between border-b border-border bg-card px-6", children: [_jsx("h1", { className: "text-xl font-semibold text-foreground", children: title }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsxs("div", { className: "relative hidden md:block", children: [_jsx(Search, { className: "absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" }), _jsx(Input, { placeholder: "Zoeken...", className: "w-64 pl-9" })] }), _jsxs(Button, { variant: "outline", size: "sm", onClick: () => setBugsDialogOpen(true), children: [_jsx(Bug, { className: "mr-2 h-4 w-4" }), "Bugs melden"] }), _jsx(NotificationBell, {})] })] }), _jsx(BugsDialog, { open: bugsDialogOpen, onOpenChange: setBugsDialogOpen })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("header", { className: "sticky top-[var(--core-topbar-h,0px)] md:top-0 z-30 flex h-[var(--app-header-height)] shrink-0 items-center justify-between border-b border-border bg-card px-6", children: [_jsx("h1", { className: "text-xl font-semibold text-foreground", children: title }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsxs("div", { className: "relative hidden md:block", children: [_jsx(Search, { className: "absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" }), _jsx(Input, { placeholder: "Zoeken...", className: "w-64 pl-9" })] }), _jsxs(Button, { variant: "outline", size: "sm", onClick: () => setBugsDialogOpen(true), children: [_jsx(Bug, { className: "mr-2 h-4 w-4" }), "Bugs melden"] }), _jsx(NotificationBell, {})] })] }), _jsx(BugsDialog, { open: bugsDialogOpen, onOpenChange: setBugsDialogOpen })] }));
 }

package/dist/components/layout/InstellingenPage.js

@@ -76,9 +76,9 @@ const coreCards = [
 // ─── Main export ──────────────────────────────────────────────────────────────
 export function InstellingenPage({ modules }) {
     // Sinds 1.0.23: modulekaarten erven het recht van hun module (of featureId).
-    // Core-kaarten altijd. Laden/fout/admin → tonen. Zichtbaarheid, geen beveiliging.
+    // Core-kaarten altijd. Laden/fout/superadmin → tonen. Zichtbaarheid, geen beveiliging.
     const snap = usePermissionSnapshot();
-    const filterOn = snap.status === "ready" && !snap.roles.includes("admin") && !snap.roles.includes("superadmin");
+    const filterOn = snap.status === "ready" && !snap.roles.includes("superadmin");
     const moduleCards = modules.flatMap((m) => m.settingsCards.filter((card) => !filterOn ||
         resolveLevel(snap.rows, card.moduleId ?? moduleKey(m), card.featureId ?? null) !== "none"));
     const allCards = [...coreCards, ...moduleCards].sort((a, b) => a.order - b.order);

package/dist/components/layout/LoginPage.js

@@ -78,5 +78,5 @@ export function LoginPage({ redirectTo = "/instellingen", routeHandlesRedirect =
     if (showForgot) {
         return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(BrandLogo, { src: "/brand/logo.svg", className: "mx-auto mb-4 max-h-16 max-w-52 object-contain", fallbackClassName: "mb-4 font-display text-primary" }), _jsx(CardTitle, { className: "font-display text-2xl", children: "Wachtwoord vergeten" }), _jsx(CardDescription, { children: "Vul je e-mailadres in om een reset-link te ontvangen" })] }), _jsxs("form", { onSubmit: handleForgotPassword, children: [_jsx(CardContent, { className: "space-y-4", children: _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "forgot-email", children: "E-mailadres" }), _jsx(Input, { id: "forgot-email", type: "email", placeholder: "naam@bedrijf.nl", value: forgotEmail, onChange: (e) => setForgotEmail(e.target.value), required: true, maxLength: 255 })] }) }), _jsxs(CardFooter, { className: "flex flex-col gap-4", children: [_jsx(Button, { type: "submit", className: "w-full", disabled: forgotLoading, children: forgotLoading ? "Versturen..." : "Reset-link versturen" }), _jsx("button", { type: "button", onClick: () => setShowForgot(false), className: "text-sm text-primary hover:underline", children: "Terug naar inloggen" })] })] })] }) }));
     }
-    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(BrandLogo, { src: "/brand/logo.svg", className: "mx-auto mb-4 max-h-16 max-w-52 object-contain", fallbackClassName: "mb-4 font-display text-primary" }), _jsx(CardTitle, { className: "font-display text-2xl", children: "Inloggen" }), _jsx(CardDescription, { children: "Voer je gegevens in om toegang te krijgen tot het systeem" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "email", children: "E-mailadres" }), _jsx(Input, { id: "email", type: "email", placeholder: "naam@bedrijf.nl", value: email, onChange: (e) => setEmail(e.target.value), required: true, maxLength: 255 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Wachtwoord" }), _jsx(Input, { id: "password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", value: password, onChange: (e) => setPassword(e.target.value), required: true, maxLength: 128 })] })] }), _jsxs(CardFooter, { className: "flex flex-col gap-4", children: [_jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Bezig met inloggen..." : "Inloggen" }), _jsx("button", { type: "button", onClick: () => setShowForgot(true), className: "text-sm text-muted-foreground hover:text-primary hover:underline", children: "Wachtwoord vergeten?" })] })] })] }) }));
+    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(BrandLogo, { src: "/brand/logo.svg", className: "mx-auto mb-4 max-h-16 max-w-52 object-contain", fallbackClassName: "mb-4 font-display text-primary" }), _jsx(CardTitle, { className: "font-sans text-2xl font-semibold", children: "Inloggen" }), _jsx(CardDescription, { children: "Voer je gegevens in om toegang te krijgen tot het systeem" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "email", children: "E-mailadres" }), _jsx(Input, { id: "email", type: "email", placeholder: "naam@bedrijf.nl", value: email, onChange: (e) => setEmail(e.target.value), required: true, maxLength: 255 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Wachtwoord" }), _jsx(Input, { id: "password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", value: password, onChange: (e) => setPassword(e.target.value), required: true, maxLength: 128 })] })] }), _jsxs(CardFooter, { className: "flex flex-col gap-4", children: [_jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Bezig met inloggen..." : "Inloggen" }), _jsx("button", { type: "button", onClick: () => setShowForgot(true), className: "text-sm text-muted-foreground hover:text-primary hover:underline", children: "Wachtwoord vergeten?" })] })] })] }) }));
 }

package/dist/components/layout/Sidebar.js

@@ -37,7 +37,7 @@ function SidebarContent({ auth, visibleModules, loading, logoSrc, showSettings,
         onNavigate?.();
         await auth.signOut();
     };
-    return (_jsxs("div", { className: "flex h-full min-h-0 flex-col font-sans", children: [_jsx("div", { className: "flex shrink-0 items-center justify-center border-b border-sidebar-border px-6 py-6", children: _jsx(BrandLogo, { src: logoSrc, className: "max-h-12 w-auto max-w-full object-contain", fallbackClassName: "flex h-12 max-w-full items-center text-sidebar-foreground" }) }), _jsx("nav", { className: "min-h-0 flex-1 space-y-1 px-3 py-4 overflow-y-auto sidebar-scroll", "aria-busy": loading || undefined, children: loading ? (_jsx("div", { "data-testid": "sidebar-skeleton", className: "space-y-2", children: [0, 1, 2, 3].map((i) => (_jsx(Skeleton, { className: "h-9 w-full bg-sidebar-accent" }, i))) })) : (visibleModules.map((mod) => mod.nav.children?.length ? (_jsx(SidebarGroup, { item: mod.nav, pathname: pathname, onNavigate: onNavigate }, mod.id)) : (_jsx(SidebarLink, { item: mod.nav, pathname: pathname, onNavigate: onNavigate }, mod.id)))) }), _jsxs("div", { className: "shrink-0 border-t border-sidebar-border px-3 py-4", children: [showSettings && (_jsx(SidebarLink, { item: { label: "Instellingen", href: "/instellingen", icon: Settings }, pathname: pathname, onNavigate: onNavigate })), _jsxs("button", { onClick: handleSignOut, className: "mt-1 flex w-full items-center gap-3 rounded-lg px-3 py-2.5 font-sans text-sm font-medium text-sidebar-foreground transition-colors hover:bg-sidebar-accent/50 cursor-pointer", children: [_jsx(LogOut, { className: "h-5 w-5" }), "Uitloggen"] })] })] }));
+    return (_jsxs("div", { className: "flex h-full min-h-0 flex-col font-sans", children: [_jsx("div", { className: "flex h-24 shrink-0 items-center justify-center px-6 py-2", children: _jsx(BrandLogo, { src: logoSrc, className: "max-h-20 w-auto max-w-full object-contain", fallbackClassName: "flex h-full max-w-full items-center text-sidebar-foreground" }) }), _jsx("nav", { className: "min-h-0 flex-1 space-y-1 px-3 py-4 overflow-y-auto sidebar-scroll", "aria-busy": loading || undefined, children: loading ? (_jsx("div", { "data-testid": "sidebar-skeleton", className: "space-y-2", children: [0, 1, 2, 3].map((i) => (_jsx(Skeleton, { className: "h-9 w-full bg-sidebar-accent" }, i))) })) : (visibleModules.map((mod) => mod.nav.children?.length ? (_jsx(SidebarGroup, { item: mod.nav, pathname: pathname, onNavigate: onNavigate }, mod.id)) : (_jsx(SidebarLink, { item: mod.nav, pathname: pathname, onNavigate: onNavigate }, mod.id)))) }), _jsxs("div", { className: "shrink-0 border-t border-sidebar-border px-3 py-4", children: [showSettings && (_jsx(SidebarLink, { item: { label: "Instellingen", href: "/instellingen", icon: Settings }, pathname: pathname, onNavigate: onNavigate })), _jsxs("button", { onClick: handleSignOut, className: "mt-1 flex w-full items-center gap-3 rounded-lg px-3 py-2.5 font-sans text-sm font-medium text-sidebar-foreground transition-colors hover:bg-sidebar-accent/50 cursor-pointer", children: [_jsx(LogOut, { className: "h-5 w-5" }), "Uitloggen"] })] })] }));
 }
 // ─── Main Sidebar ─────────────────────────────────────────────────────────────
 /**

package/dist/permissions/useModulePermission.d.ts

@@ -194,7 +194,7 @@ export declare function useMyModulePermissions(): {
 };
 /**
  * Rechtenniveau voor één module (optioneel één feature). Tijdens laden, bij
- * een fout en voor admin/superadmin: `edit`. Zichtbaarheid, geen beveiliging.
+ * een fout en voor superadmin: `edit`. Zichtbaarheid, geen beveiliging.
  */
 export declare function useModulePermission(moduleId: string, featureId?: string | null): {
     level: PermissionLevel;
@@ -221,7 +221,7 @@ export interface CanProps {
 /** Sinds 1.0.23. Rendert children als `useCan` toestaat. Zichtbaarheid, geen beveiliging. */
 export declare function Can({ module, feature, level, fallback, children }: CanProps): import("react").FunctionComponentElement<import("react").FragmentProps>;
 /**
- * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/admin →
+ * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/superadmin →
  * ongewijzigd. Zichtbaarheid, geen beveiliging.
  */
 export declare function useModulePermissionTransform(): ModuleListTransform;

package/dist/permissions/useModulePermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useModulePermission.d.ts","sourceRoot":"","sources":["../../src/core/permissions/useModulePermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAiBzE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB;;;IAuBlC,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;EAW9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,eAAwB;;;;EAGlG;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,6FAA6F;AAC7F,wBAAgB,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAc,EAAE,QAAe,EAAE,QAAQ,EAAE,EAAE,QAAQ,2EAG3F;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CASlE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,UAAO;;;EAQjF"}
+{"version":3,"file":"useModulePermission.d.ts","sourceRoot":"","sources":["../../src/core/permissions/useModulePermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAkBzE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB;;;IAuBlC,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;EAW9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,eAAwB;;;;EAGlG;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,6FAA6F;AAC7F,wBAAgB,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAc,EAAE,QAAe,EAAE,QAAQ,EAAE,EAAE,QAAQ,2EAG3F;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CASlE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,UAAO;;;EAQjF"}

package/dist/permissions/useModulePermission.js

@@ -9,7 +9,8 @@ function getFallbackClient() {
     return fallbackClient;
 }
 function rolesAreAdmin(roles) {
-    return roles.includes("admin") || roles.includes("superadmin");
+    // Alleen superadmin heeft een vrijbrief; admin volgt de rechten.
+    return roles.includes("superadmin");
 }
 /** Snapshot → bekend? Laden = onbekend; fout/time-out = bekend (leeg → allow). */
 function isKnown(s) {
@@ -49,7 +50,7 @@ export function useMyModulePermissions() {
 }
 /**
  * Rechtenniveau voor één module (optioneel één feature). Tijdens laden, bij
- * een fout en voor admin/superadmin: `edit`. Zichtbaarheid, geen beveiliging.
+ * een fout en voor superadmin: `edit`. Zichtbaarheid, geen beveiliging.
  */
 export function useModulePermission(moduleId, featureId) {
     const snap = usePermissionSnapshot();
@@ -76,7 +77,7 @@ export function Can({ module, feature, level = "view", fallback = null, children
     return createElement(Fragment, null, allowed ? children : fallback);
 }
 /**
- * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/admin →
+ * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/superadmin →
  * ongewijzigd. Zichtbaarheid, geen beveiliging.
  */
 export function useModulePermissionTransform() {

package/dist/server/index.d.ts

@@ -8,4 +8,5 @@ export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
 export type { HandoverExchangeHandlerOptions } from "./handover-handler.js";
 export type { PermissionLevel } from "./permissions.server.js";
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -6,3 +6,6 @@ export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamErro
 export { requireModulePermission, isSuperadminServer } from "./permissions.server.js";
 export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
+// Shell-adres en Central-koppeling (alleen server; aangeroepen door de
+// door het dashboard gegenereerde globale request-middleware).
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";

package/dist/server/shell-runtime.d.ts

@@ -0,0 +1,24 @@
+/** Absolute https-origin zonder pad, of null. */
+export declare function normalizeShellBaseUrl(raw: unknown): string | null;
+/**
+ * Het shell-adres uit de klantdatabase (60 s cache per isolate). Bij een fout:
+ * de laatst bekende waarde plus waarschuwing. Valt nooit terug op het adres
+ * van het binnenkomende verzoek.
+ */
+export declare function getShellBaseUrl(): Promise<string | null>;
+/**
+ * Zet process.env.PUBLIC_BASE_URL uit de database. De database wint; een
+ * afwijkende env-waarde geeft een waarschuwing. Zonder databasewaarde blijft
+ * de env ongemoeid (host-afhankelijke code faalt zoals nu).
+ */
+export declare function applyShellBaseUrl(): Promise<string | null>;
+/**
+ * Hooguit eens per uur per isolate. Netwerkfout of ontbrekende RPC: niets
+ * doen, waarschuwen, niet opnieuw tot het volgende uur.
+ */
+export declare function ensureCentralLink(): Promise<void>;
+/** Voor de globale request-middleware van de shell. Gooit nooit. */
+export declare function runShellRuntime(): Promise<void>;
+/** Alleen voor tests. */
+export declare function __resetShellRuntimeForTests(): void;
+//# sourceMappingURL=shell-runtime.d.ts.map

package/dist/server/shell-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAwDA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AAyDD;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAevD;AAED,oEAAoE;AACpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAM1C"}

package/dist/server/shell-runtime.js

@@ -0,0 +1,219 @@
+// Server-only: shell-adres en Central-koppeling via de klantdatabase.
+// Uitsluitend bereikbaar via het "./server"-subpad. Geen serverpakket-imports:
+// alleen fetch en process.env, gelezen binnen de functies.
+//
+// - getShellBaseUrl(): module_runtime_config.shell_base_url, 60 s cache per isolate.
+// - applyShellBaseUrl(): zet process.env.PUBLIC_BASE_URL per verzoek (database wint).
+// - ensureCentralLink(): hooguit eens per uur per isolate; haalt zo nodig de
+//   (idempotente) leessleutel bij Central en geeft hem aan de database.
+// - runShellRuntime(): beide, bedoeld voor de door het dashboard gegenereerde
+//   globale request-middleware.
+//
+// De leessleutel wordt nooit gelogd, nooit teruggegeven en nooit bewaard.
+const BASE_URL_TTL_MS = 60000;
+const LINK_INTERVAL_MS = 60 * 60000;
+const TIMEOUT_MS = 5000;
+const WARN_INTERVAL_MS = 5 * 60000;
+let baseUrlCache = null;
+let baseUrlInflight = null;
+let lastLinkCheck = 0;
+let linkInflight = null;
+const lastWarn = new Map();
+function warn(key, message, detail) {
+    const now = Date.now();
+    if (now - (lastWarn.get(key) ?? 0) < WARN_INTERVAL_MS)
+        return;
+    lastWarn.set(key, now);
+    console.warn(`[shell-runtime] ${message}`, detail ?? {});
+}
+function dbConfig() {
+    const url = process.env.SUPABASE_URL;
+    const key = process.env.SB_SERVICE_ROLE_KEY;
+    if (!url || !key)
+        return null;
+    return { url: url.replace(/\/+$/, ""), key };
+}
+function dbHeaders(key) {
+    const h = { apikey: key, "Content-Type": "application/json", Accept: "application/json" };
+    // Oude JWT-sleutels als Bearer; nieuwe sb_secret_-sleutels zijn geen JWT.
+    if (key.split(".").length === 3)
+        h.Authorization = `Bearer ${key}`;
+    return h;
+}
+async function timedFetch(url, init) {
+    const ctrl = new AbortController();
+    const t = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+    try {
+        return await fetch(url, { ...init, signal: ctrl.signal, redirect: "error" });
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+/** Absolute https-origin zonder pad, of null. */
+export function normalizeShellBaseUrl(raw) {
+    if (typeof raw !== "string" || !raw.trim())
+        return null;
+    try {
+        const u = new URL(raw.trim());
+        if (u.protocol !== "https:" || u.username || u.password)
+            return null;
+        return u.origin;
+    }
+    catch {
+        return null;
+    }
+}
+async function readShellBaseUrl() {
+    const cfg = dbConfig();
+    if (!cfg) {
+        warn("config", "SUPABASE_URL of SB_SERVICE_ROLE_KEY ontbreekt; shell-adres onbekend");
+        return null;
+    }
+    const res = await timedFetch(`${cfg.url}/rest/v1/module_runtime_config?select=shell_base_url&limit=1`, { method: "GET", headers: dbHeaders(cfg.key) });
+    if (!res.ok)
+        throw new Error(`database ${res.status}`);
+    const rows = (await res.json());
+    const value = normalizeShellBaseUrl(Array.isArray(rows) ? rows[0]?.shell_base_url : null);
+    if (!value)
+        warn("empty", "module_runtime_config.shell_base_url ontbreekt of is geen https-adres");
+    return value;
+}
+/**
+ * Het shell-adres uit de klantdatabase (60 s cache per isolate). Bij een fout:
+ * de laatst bekende waarde plus waarschuwing. Valt nooit terug op het adres
+ * van het binnenkomende verzoek.
+ */
+export async function getShellBaseUrl() {
+    const now = Date.now();
+    if (baseUrlCache && now - baseUrlCache.at < BASE_URL_TTL_MS)
+        return baseUrlCache.value;
+    if (baseUrlInflight)
+        return baseUrlInflight;
+    baseUrlInflight = (async () => {
+        try {
+            const value = await readShellBaseUrl();
+            baseUrlCache = { value, at: Date.now() };
+            return value;
+        }
+        catch (e) {
+            warn("read", "shell-adres lezen mislukt; laatst bekende waarde gebruikt", {
+                error: e instanceof Error ? e.message : "onbekend",
+            });
+            const last = baseUrlCache?.value ?? null;
+            baseUrlCache = { value: last, at: Date.now() };
+            return last;
+        }
+        finally {
+            baseUrlInflight = null;
+        }
+    })();
+    return baseUrlInflight;
+}
+/**
+ * Zet process.env.PUBLIC_BASE_URL uit de database. De database wint; een
+ * afwijkende env-waarde geeft een waarschuwing. Zonder databasewaarde blijft
+ * de env ongemoeid (host-afhankelijke code faalt zoals nu).
+ */
+export async function applyShellBaseUrl() {
+    const value = await getShellBaseUrl();
+    if (!value)
+        return null;
+    const current = process.env.PUBLIC_BASE_URL;
+    if (current && normalizeShellBaseUrl(current) !== value) {
+        warn("mismatch", "PUBLIC_BASE_URL wijkt af van de database; databasewaarde gebruikt", {
+            env: current,
+            database: value,
+        });
+    }
+    process.env.PUBLIC_BASE_URL = value;
+    return value;
+}
+async function rpc(cfg, name, body) {
+    return timedFetch(`${cfg.url}/rest/v1/rpc/${name}`, {
+        method: "POST",
+        headers: dbHeaders(cfg.key),
+        body: JSON.stringify(body),
+    });
+}
+async function linkOnce() {
+    const cfg = dbConfig();
+    const centralUrl = process.env.CENTRAL_AUTH_URL?.replace(/\/+$/, "");
+    const secret = process.env.CENTRAL_AUTH_SECRET;
+    if (!cfg || !centralUrl || !secret) {
+        warn("link-config", "configuratie voor de Central-koppeling ontbreekt");
+        return;
+    }
+    const statusRes = await rpc(cfg, "flowselections_central_status", {});
+    if (!statusRes.ok) {
+        warn("link-status", "flowselections_central_status niet beschikbaar", { status: statusRes.status });
+        return;
+    }
+    const raw = await statusRes.json();
+    const status = (Array.isArray(raw) ? raw[0] : raw);
+    if (!status) {
+        warn("link-status", "flowselections_central_status gaf geen resultaat");
+        return;
+    }
+    if (status.token_aanwezig !== false && status.laatste_status !== "http_401")
+        return;
+    const tokenRes = await timedFetch(`${centralUrl}/api/shell-host/read-token`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${secret}`, Accept: "application/json" },
+    });
+    if (!tokenRes.ok) {
+        warn("link-token", "leessleutel ophalen bij Central mislukt", { status: tokenRes.status });
+        return;
+    }
+    const { token } = (await tokenRes.json());
+    if (typeof token !== "string" || !token) {
+        warn("link-token", "Central gaf geen bruikbare leessleutel");
+        return;
+    }
+    const setRes = await rpc(cfg, "flowselections_set_central_link", {
+        p_central_url: centralUrl,
+        p_read_token: token,
+    });
+    if (!setRes.ok) {
+        warn("link-set", "flowselections_set_central_link mislukt", { status: setRes.status });
+    }
+}
+/**
+ * Hooguit eens per uur per isolate. Netwerkfout of ontbrekende RPC: niets
+ * doen, waarschuwen, niet opnieuw tot het volgende uur.
+ */
+export async function ensureCentralLink() {
+    const now = Date.now();
+    if (linkInflight)
+        return linkInflight;
+    if (lastLinkCheck && now - lastLinkCheck < LINK_INTERVAL_MS)
+        return;
+    lastLinkCheck = now;
+    linkInflight = linkOnce()
+        .catch((e) => {
+        warn("link-error", "Central-koppeling controleren mislukt", {
+            error: e instanceof Error ? e.name : "onbekend",
+        });
+    })
+        .finally(() => {
+        linkInflight = null;
+    });
+    return linkInflight;
+}
+/** Voor de globale request-middleware van de shell. Gooit nooit. */
+export async function runShellRuntime() {
+    try {
+        await Promise.all([applyShellBaseUrl(), ensureCentralLink()]);
+    }
+    catch {
+        // helpers vangen zelf; nooit een verzoek laten falen
+    }
+}
+/** Alleen voor tests. */
+export function __resetShellRuntimeForTests() {
+    baseUrlCache = null;
+    baseUrlInflight = null;
+    lastLinkCheck = 0;
+    linkInflight = null;
+    lastWarn.clear();
+}

package/dist/styles.css

@@ -5,6 +5,10 @@
 @custom-variant dark (&:is(.dark *));
 
 @layer base {
+  :root {
+    --app-header-height: 4rem;
+  }
+
   button, [role="button"], a, [type="button"], [type="submit"], [type="reset"] {
     cursor: pointer;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "private": false,
   "sideEffects": false,
   "type": "module",
@@ -99,7 +99,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.32.0",
-    "@lovable.dev/vite-tanstack-config": "2.23.1",
+    "@lovable.dev/vite-tanstack-config": "2.26.5",
     "@types/node": "^22.16.5",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",