@flowselections/core 1.0.29 → 1.0.31

package/README.md

@@ -206,3 +206,53 @@ Ook: `resetPasswordRoute({ landing })` (`/reset-wachtwoord`), `landingRoute({ la
 `prepublishOnly` draait `build:pkg`, dat `dist/` eerst leegmaakt, opnieuw bouwt en met
 `scripts/check-pkg.mjs` controleert dat `dist/` precies het pakket bevat. `npm publish` publiceert dus nooit
 een preview-build.
+
+## Shell-adres en Central-koppeling (`./server`)
+
+De door het dashboard gegenereerde globale request-middleware roept per verzoek aan:
+
+```ts
+import { runShellRuntime } from "@flowselections/core/server";
+await runShellRuntime(); // bestaand gedrag, geeft null terug; geen croncontrole zonder context
+```
+
+Vereist `SUPABASE_URL`, `SB_SERVICE_ROLE_KEY`, `CENTRAL_AUTH_URL`, `CENTRAL_AUTH_SECRET`. Gooit nooit; de leessleutel wordt nooit gelogd of teruggegeven.
+
+### Centrale croncontrole (dashboardaansluiting)
+
+Het dashboard past `system-files.js`, `buildBody`, voor het systeembestand
+`src/lib/shell-runtime-middleware.ts` aan. Houd deze middleware als eerste:
+
+```ts
+createMiddleware({ type: "request" }).server(async ({ request, pathname, next }) => {
+  const { runShellRuntime } = await import("@flowselections/core/server");
+  const denied = await runShellRuntime({ request, pathname }); return denied ?? next();
+});
+```
+
+`ensureCronKeys()` synchroniseert `SUPABASE_PUBLISHABLE_KEY ?? SUPABASE_ANON_KEY`
+(zonder omringende aanhalingstekens) via `flowselections_set_anon_key`.
+Central-koppeling en sleutelsynchronisatie wachten één uur na succes en vijf
+minuten na een mislukking, per isolate. Geen sleutels in logs of responses.
+
+`checkCronRequest(request)` controleert uitsluitend exacte paden uit
+`flowselections_cron_paths()`, met `x-flowselections-cron-key` tegen
+`flowselections_cron_secret()`. Native Web Crypto verifieert de vergelijking.
+Paden, sleutel en configuratie worden vijf minuten gecachet; een afwijkende
+sleutel veroorzaakt één herlezing vóór de beslissing. Gelijktijdige herlezingen
+delen een Promise; daarna blijven herhaalde mismatches tot de volgende cacheverversing
+zonder extra RPC's, om een verzoekenstorm te voorkomen. Ontbrekende RPC's, netwerkfouten of ongeldige antwoorden laten
+verzoeken door en worden begrensd gemeld; deze laag vervangt geen modulebeveiliging.
+
+`module_runtime_config` heeft `key`/`value`-rijen: `shell_base_url`,
+`cron_auth_mode` (`compat` standaard, of `afdwingen`) en
+`cron_auth_exempt_paths` (komma-gescheiden extra padprefixen). In `compat` komt
+alleen een waarschuwing; in `afdwingen` een 401 vóór de handler. De drie vaste
+uitzonderingsprefixen blijven altijd gelden, ook bij een lege configuratie:
+
+- `/api/public/print/queue-tick`
+- `/api/public/hooks/logistics-shipping-note-now`
+- `/api/public/cron/ping`
+
+De eigen engine-tick en `verkoop_cron_post` staan buiten deze centrale padenlijst.
+Er worden geen requestheaders herschreven en geen modules gewijzigd.

package/dist/auth/password-callback.d.ts

@@ -0,0 +1,17 @@
+/** URL metadata is only a correlation signal; Supabase validates the session. */
+export type PasswordCallback = {
+    type: "invite" | "recovery";
+    sub: string;
+};
+export declare const PASSWORD_CALLBACK_WAIT_MS = 5000;
+export declare function readPasswordCallback(hash: string): PasswordCallback | null;
+/** Called immediately before createClient can consume/clear the URL hash. */
+export declare function capturePasswordCallback(): void;
+export declare function getPasswordCallback(): PasswordCallback | null;
+export declare function clearPasswordCallback(): void;
+export declare function matchingPasswordCallback(signal: PasswordCallback | null, session: {
+    user: {
+        id: string;
+    };
+} | null): PasswordCallback["type"] | null;
+//# sourceMappingURL=password-callback.d.ts.map

package/dist/auth/password-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-callback.d.ts","sourceRoot":"","sources":["../../src/core/auth/password-callback.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAG9C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAiB1E;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,OAAO,EAAE;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GACvC,gBAAgB,CAAC,MAAM,CAAC,GAAG,IAAI,CAEjC"}

package/dist/auth/password-callback.js

@@ -0,0 +1,39 @@
+export const PASSWORD_CALLBACK_WAIT_MS = 5000;
+let callback = null;
+export function readPasswordCallback(hash) {
+    const params = new URLSearchParams(hash.replace(/^#/, ""));
+    const type = params.get("type");
+    if (type !== "invite" && type !== "recovery")
+        return null;
+    try {
+        // Decode only the payload inline. Never retain the access token.
+        const payload = params.get("access_token")?.split(".")[1];
+        params.delete("access_token");
+        if (!payload)
+            return null;
+        const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const bytes = Uint8Array.from(atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "=")), (c) => c.charCodeAt(0));
+        const decoded = JSON.parse(new TextDecoder().decode(bytes));
+        if (typeof decoded !== "object" || decoded === null || !("sub" in decoded))
+            return null;
+        return typeof decoded.sub === "string" && decoded.sub.length > 0 ? { type, sub: decoded.sub } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Called immediately before createClient can consume/clear the URL hash. */
+export function capturePasswordCallback() {
+    if (typeof window === "undefined")
+        return;
+    callback = readPasswordCallback(window.location.hash);
+}
+export function getPasswordCallback() {
+    return callback;
+}
+export function clearPasswordCallback() {
+    callback = null;
+}
+export function matchingPasswordCallback(signal, session) {
+    return signal && session?.user.id === signal.sub ? signal.type : null;
+}

package/dist/auth/redirect.d.ts

@@ -23,7 +23,7 @@ export interface ModuleAccessContext {
 /**
  * Sinds 1.0.23. Moduletoegang voor een pad. Wacht max. 3 s; fout, time-out,
  * vrijgesteld pad of geen modulerij → `edit` (fail-open).
- * Zichtbaarheid, geen beveiliging.
+ * Superadmin → altijd `edit`; admin volgt de rechten. Zichtbaarheid, geen beveiliging.
  */
 export declare function resolveModuleAccess(path: string, opts?: {
     userId?: string | null;

package/dist/auth/redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/core/auth/redirect.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAazE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,eAAe,CAAC;CAC/B;AAUD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACnF,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,yFAAyF;AACzF,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/E,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,EACtC,SAAS,SAAW,GACnB,IAAI,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuB3D"}
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/core/auth/redirect.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAazE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,eAAe,CAAC;CAC/B;AAWD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACnF,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,yFAAyF;AACzF,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/E,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,EACtC,SAAS,SAAW,GACnB,IAAI,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuB3D"}

package/dist/auth/redirect.js

@@ -38,13 +38,14 @@ export function readRedirectParam(fallback) {
 function pathOf(location) {
     return location.pathname ?? location.href.split("?")[0].split("#")[0];
 }
+/** Alleen superadmin heeft een vrijbrief voor modulerechten; admin volgt de rechten. */
 function isAdminRoles(roles) {
-    return Array.isArray(roles) && (roles.includes("admin") || roles.includes("superadmin"));
+    return Array.isArray(roles) && roles.includes("superadmin");
 }
 /**
  * Sinds 1.0.23. Moduletoegang voor een pad. Wacht max. 3 s; fout, time-out,
  * vrijgesteld pad of geen modulerij → `edit` (fail-open).
- * Zichtbaarheid, geen beveiliging.
+ * Superadmin → altijd `edit`; admin volgt de rechten. Zichtbaarheid, geen beveiliging.
  */
 export async function resolveModuleAccess(path, opts = {}) {
     const key = navKey(path);

package/dist/components/layout/InstellingenPage.js

@@ -76,9 +76,9 @@ const coreCards = [
 // ─── Main export ──────────────────────────────────────────────────────────────
 export function InstellingenPage({ modules }) {
     // Sinds 1.0.23: modulekaarten erven het recht van hun module (of featureId).
-    // Core-kaarten altijd. Laden/fout/admin → tonen. Zichtbaarheid, geen beveiliging.
+    // Core-kaarten altijd. Laden/fout/superadmin → tonen. Zichtbaarheid, geen beveiliging.
     const snap = usePermissionSnapshot();
-    const filterOn = snap.status === "ready" && !snap.roles.includes("admin") && !snap.roles.includes("superadmin");
+    const filterOn = snap.status === "ready" && !snap.roles.includes("superadmin");
     const moduleCards = modules.flatMap((m) => m.settingsCards.filter((card) => !filterOn ||
         resolveLevel(snap.rows, card.moduleId ?? moduleKey(m), card.featureId ?? null) !== "none"));
     const allCards = [...coreCards, ...moduleCards].sort((a, b) => a.order - b.order);

package/dist/components/layout/ResetWachtwoordPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResetWachtwoordPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/ResetWachtwoordPage.tsx"],"names":[],"mappings":"AASA,UAAU,wBAAwB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAoB,EAAE,EAAE,wBAAwB,2CAwFjG"}
+{"version":3,"file":"ResetWachtwoordPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/ResetWachtwoordPage.tsx"],"names":[],"mappings":"AAUA,UAAU,wBAAwB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAoB,EAAE,EAAE,wBAAwB,2CA0IjG"}

package/dist/components/layout/ResetWachtwoordPage.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useState, useEffect } from "react";
+import { useState, useEffect, useRef } from "react";
 import { useRouter } from "@tanstack/react-router";
 import { Button } from "../ui/button.js";
 import { Input } from "../ui/input.js";
@@ -7,23 +7,58 @@ import { Label } from "../ui/label.js";
 import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "../ui/card.js";
 import { toast } from "sonner";
 import { supabase } from "../../supabase/client.js";
+import { clearPasswordCallback, getPasswordCallback, matchingPasswordCallback, PASSWORD_CALLBACK_WAIT_MS } from "../../auth/password-callback.js";
 export function ResetWachtwoordPage({ redirectTo, loginPath = "/login" }) {
     const router = useRouter();
     const [password, setPassword] = useState("");
     const [confirmPassword, setConfirmPassword] = useState("");
     const [isLoading, setIsLoading] = useState(false);
-    const [isReady, setIsReady] = useState(false);
+    const [callbackType, setCallbackType] = useState(null);
+    const [isWaiting, setIsWaiting] = useState(true);
+    const callback = useRef(null);
     useEffect(() => {
-        const hash = window.location.hash;
-        if (hash && hash.includes("type=recovery")) {
-            setIsReady(true);
-        }
-        const { data: { subscription } } = supabase.auth.onAuthStateChange((event) => {
-            if (event === "PASSWORD_RECOVERY") {
-                setIsReady(true);
+        let active = true;
+        let accepted = false;
+        let timer;
+        // Accessing auth initializes the lazy client and captures the URL first.
+        const auth = supabase.auth;
+        callback.current = callback.current ?? getPasswordCallback();
+        const signal = callback.current;
+        const acceptSession = (session) => {
+            if (!active)
+                return;
+            const type = matchingPasswordCallback(signal, session);
+            setCallbackType(type);
+            if (type) {
+                accepted = true;
+                clearTimeout(timer);
+                clearPasswordCallback();
+                setIsWaiting(false);
+            }
+            else if (accepted) {
+                // A later sign-out or account switch invalidates this callback.
+                active = false;
+                callback.current = null;
+                setIsWaiting(false);
             }
+        };
+        const { data: { subscription } } = auth.onAuthStateChange((_event, session) => {
+            acceptSession(session);
         });
-        return () => subscription.unsubscribe();
+        timer = setTimeout(() => {
+            active = false;
+            clearPasswordCallback();
+            callback.current = null;
+            setCallbackType(null);
+            setIsWaiting(false);
+        }, PASSWORD_CALLBACK_WAIT_MS);
+        void auth.getSession().then(({ data: { session }, error }) => {
+            if (!error)
+                acceptSession(session);
+        }).catch(() => {
+            // The bounded wait also covers session initialization/network failures.
+        });
+        return () => { active = false; clearTimeout(timer); clearPasswordCallback(); subscription.unsubscribe(); };
     }, []);
     const handleSubmit = async (e) => {
         e.preventDefault();
@@ -35,19 +70,34 @@ export function ResetWachtwoordPage({ redirectTo, loginPath = "/login" }) {
             toast.error("Wachtwoorden komen niet overeen");
             return;
         }
+        if (!callbackType)
+            return;
         setIsLoading(true);
+        const { data: { session }, error: sessionError } = await supabase.auth.getSession();
+        if (sessionError || !matchingPasswordCallback(callback.current, session)) {
+            clearPasswordCallback();
+            callback.current = null;
+            setCallbackType(null);
+            setIsLoading(false);
+            return;
+        }
         const { error } = await supabase.auth.updateUser({ password });
         setIsLoading(false);
         if (error) {
             toast.error("Fout bij het instellen van het nieuwe wachtwoord");
         }
         else {
+            clearPasswordCallback();
+            callback.current = null;
             toast.success("Wachtwoord succesvol gewijzigd!");
             await router.navigate({ href: redirectTo });
         }
     };
-    if (!isReady) {
-        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { "data-empty-state": true, className: "text-2xl", children: "Ongeldige link" }), _jsx(CardDescription, { children: "Deze reset-link is ongeldig of verlopen. Vraag een nieuwe aan via de inlogpagina." })] }), _jsx(CardFooter, { className: "justify-center", children: _jsx(Button, { onClick: () => router.navigate({ href: loginPath }), children: "Naar inlogpagina" }) })] }) }));
+    if (isWaiting) {
+        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", role: "status", "aria-label": "Link controleren", children: _jsx("div", { className: "h-8 w-8 animate-spin rounded-full border-b-2 border-primary motion-reduce:animate-none" }) }));
+    }
+    if (!callbackType) {
+        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { "data-empty-state": true, className: "text-2xl", children: "Ongeldige link" }), _jsx(CardDescription, { children: "Deze link is verlopen of al gebruikt. Vraag een nieuwe uitnodiging aan, of gebruik Wachtwoord vergeten op de inlogpagina." })] }), _jsx(CardFooter, { className: "justify-center", children: _jsx(Button, { onClick: () => router.navigate({ href: loginPath }), children: "Naar inlogpagina" }) })] }) }));
     }
-    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: "Nieuw wachtwoord instellen" }), _jsx(CardDescription, { children: "Kies een nieuw wachtwoord voor je account" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Nieuw wachtwoord" }), _jsx(Input, { id: "password", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "confirmPassword", children: "Bevestig wachtwoord" }), _jsx(Input, { id: "confirmPassword", type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] })] }), _jsx(CardFooter, { children: _jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Opslaan..." : "Wachtwoord opslaan" }) })] })] }) }));
+    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: callbackType === "invite" ? "Welkom!" : "Nieuw wachtwoord instellen" }), _jsx(CardDescription, { children: callbackType === "invite" ? "Kies een wachtwoord om je account te activeren." : "Kies een nieuw wachtwoord voor je account" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Nieuw wachtwoord" }), _jsx(Input, { id: "password", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "confirmPassword", children: "Bevestig wachtwoord" }), _jsx(Input, { id: "confirmPassword", type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] })] }), _jsx(CardFooter, { children: _jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Opslaan..." : "Wachtwoord opslaan" }) })] })] }) }));
 }

package/dist/permissions/useModulePermission.d.ts

@@ -194,7 +194,7 @@ export declare function useMyModulePermissions(): {
 };
 /**
  * Rechtenniveau voor één module (optioneel één feature). Tijdens laden, bij
- * een fout en voor admin/superadmin: `edit`. Zichtbaarheid, geen beveiliging.
+ * een fout en voor superadmin: `edit`. Zichtbaarheid, geen beveiliging.
  */
 export declare function useModulePermission(moduleId: string, featureId?: string | null): {
     level: PermissionLevel;
@@ -221,7 +221,7 @@ export interface CanProps {
 /** Sinds 1.0.23. Rendert children als `useCan` toestaat. Zichtbaarheid, geen beveiliging. */
 export declare function Can({ module, feature, level, fallback, children }: CanProps): import("react").FunctionComponentElement<import("react").FragmentProps>;
 /**
- * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/admin →
+ * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/superadmin →
  * ongewijzigd. Zichtbaarheid, geen beveiliging.
  */
 export declare function useModulePermissionTransform(): ModuleListTransform;

package/dist/permissions/useModulePermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useModulePermission.d.ts","sourceRoot":"","sources":["../../src/core/permissions/useModulePermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAiBzE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB;;;IAuBlC,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;EAW9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,eAAwB;;;;EAGlG;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,6FAA6F;AAC7F,wBAAgB,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAc,EAAE,QAAe,EAAE,QAAQ,EAAE,EAAE,QAAQ,2EAG3F;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CASlE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,UAAO;;;EAQjF"}
+{"version":3,"file":"useModulePermission.d.ts","sourceRoot":"","sources":["../../src/core/permissions/useModulePermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAkBzE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB;;;IAuBlC,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;EAW9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,eAAwB;;;;EAGlG;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,6FAA6F;AAC7F,wBAAgB,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAc,EAAE,QAAe,EAAE,QAAQ,EAAE,EAAE,QAAQ,2EAG3F;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CASlE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,UAAO;;;EAQjF"}

package/dist/permissions/useModulePermission.js

@@ -9,7 +9,8 @@ function getFallbackClient() {
     return fallbackClient;
 }
 function rolesAreAdmin(roles) {
-    return roles.includes("admin") || roles.includes("superadmin");
+    // Alleen superadmin heeft een vrijbrief; admin volgt de rechten.
+    return roles.includes("superadmin");
 }
 /** Snapshot → bekend? Laden = onbekend; fout/time-out = bekend (leeg → allow). */
 function isKnown(s) {
@@ -49,7 +50,7 @@ export function useMyModulePermissions() {
 }
 /**
  * Rechtenniveau voor één module (optioneel één feature). Tijdens laden, bij
- * een fout en voor admin/superadmin: `edit`. Zichtbaarheid, geen beveiliging.
+ * een fout en voor superadmin: `edit`. Zichtbaarheid, geen beveiliging.
  */
 export function useModulePermission(moduleId, featureId) {
     const snap = usePermissionSnapshot();
@@ -76,7 +77,7 @@ export function Can({ module, feature, level = "view", fallback = null, children
     return createElement(Fragment, null, allowed ? children : fallback);
 }
 /**
- * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/admin →
+ * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/superadmin →
  * ongewijzigd. Zichtbaarheid, geen beveiliging.
  */
 export function useModulePermissionTransform() {

package/dist/server/index.d.ts

@@ -8,4 +8,5 @@ export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
 export type { HandoverExchangeHandlerOptions } from "./handover-handler.js";
 export type { PermissionLevel } from "./permissions.server.js";
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, ensureCronKeys, checkCronRequest, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -6,3 +6,6 @@ export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamErro
 export { requireModulePermission, isSuperadminServer } from "./permissions.server.js";
 export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
+// Shell-adres en Central-koppeling (alleen server; aangeroepen door de
+// door het dashboard gegenereerde globale request-middleware).
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, ensureCronKeys, checkCronRequest, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";

package/dist/server/shell-runtime.d.ts

@@ -0,0 +1,30 @@
+/** Absolute https-origin zonder pad, of null. */
+export declare function normalizeShellBaseUrl(raw: unknown): string | null;
+/**
+ * Het shell-adres uit de klantdatabase (60 s cache per isolate). Bij een fout:
+ * de laatst bekende waarde plus waarschuwing. Valt nooit terug op het adres
+ * van het binnenkomende verzoek.
+ */
+export declare function getShellBaseUrl(): Promise<string | null>;
+/**
+ * Zet process.env.PUBLIC_BASE_URL uit de database. De database wint; een
+ * afwijkende env-waarde geeft een waarschuwing. Zonder databasewaarde blijft
+ * de env ongemoeid (host-afhankelijke code faalt zoals nu).
+ */
+export declare function applyShellBaseUrl(): Promise<string | null>;
+/**
+ * Na succes één uur wachten per isolate; na een fout vijf minuten.
+ */
+export declare function ensureCentralLink(): Promise<void>;
+/** Synchroniseert de shell-publishable key; uur na succes, vijf minuten na fout. */
+export declare function ensureCronKeys(): Promise<void>;
+/** Alleen geregistreerde cronpaden; alle lees-/runtimefouten laten door. */
+export declare function checkCronRequest(request: Request): Promise<Response | null>;
+/** Zonder context hetzelfde gedrag als voorheen. Alleen bewuste cronweigering geeft 401. */
+export declare function runShellRuntime(ctx?: {
+    request: Request;
+    pathname: string;
+}): Promise<Response | null>;
+/** Alleen voor tests. */
+export declare function __resetShellRuntimeForTests(): void;
+//# sourceMappingURL=shell-runtime.d.ts.map

package/dist/server/shell-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAqEA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AA+DD;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvD;AA4BD,oFAAoF;AACpF,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAWpD;AAyFD,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuBjF;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,GAAG,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAU5G;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAW1C"}

package/dist/server/shell-runtime.js

@@ -0,0 +1,410 @@
+// Server-only: shell-adres en Central-koppeling via de klantdatabase.
+// Uitsluitend bereikbaar via het "./server"-subpad. Geen serverpakket-imports:
+// alleen fetch en process.env, gelezen binnen de functies.
+//
+// - getShellBaseUrl(): module_runtime_config.shell_base_url, 60 s cache per isolate.
+// - applyShellBaseUrl(): zet process.env.PUBLIC_BASE_URL per verzoek (database wint).
+// - ensureCentralLink(): hooguit eens per uur per isolate; haalt zo nodig de
+//   (idempotente) leessleutel bij Central en geeft hem aan de database.
+// - runShellRuntime(): beide, bedoeld voor de door het dashboard gegenereerde
+//   globale request-middleware.
+//
+// De leessleutel wordt nooit gelogd, nooit teruggegeven en nooit bewaard.
+const BASE_URL_TTL_MS = 60000;
+const LINK_INTERVAL_MS = 60 * 60000;
+const TIMEOUT_MS = 5000;
+const WARN_INTERVAL_MS = 5 * 60000;
+const CRON_TTL_MS = 5 * 60000;
+let baseUrlCache = null;
+let baseUrlInflight = null;
+let nextLinkCheck = 0;
+let linkInflight = null;
+let nextCronKeyCheck = 0;
+let cronKeyInflight = null;
+let cronCache = null;
+let cronInflight = null;
+let comparisonKey = null;
+const DEFAULT_EXEMPT = [
+    "/api/public/print/queue-tick",
+    "/api/public/hooks/logistics-shipping-note-now",
+    "/api/public/cron/ping",
+];
+const lastWarn = new Map();
+function warn(key, message, detail) {
+    const now = Date.now();
+    const last = lastWarn.get(key);
+    if (last !== undefined && now - last < WARN_INTERVAL_MS)
+        return;
+    lastWarn.set(key, now);
+    console.warn(`[shell-runtime] ${message}`, detail ?? {});
+}
+function dbConfig() {
+    const url = process.env.SUPABASE_URL;
+    const key = process.env.SB_SERVICE_ROLE_KEY;
+    if (!url || !key)
+        return null;
+    return { url: url.replace(/\/+$/, ""), key };
+}
+function dbHeaders(key) {
+    const h = { apikey: key, "Content-Type": "application/json", Accept: "application/json" };
+    // Oude JWT-sleutels als Bearer; nieuwe sb_secret_-sleutels zijn geen JWT.
+    if (key.split(".").length === 3)
+        h.Authorization = `Bearer ${key}`;
+    return h;
+}
+async function timedFetch(url, init) {
+    const ctrl = new AbortController();
+    const t = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+    try {
+        return await fetch(url, { ...init, signal: ctrl.signal, redirect: "error" });
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+/** Absolute https-origin zonder pad, of null. */
+export function normalizeShellBaseUrl(raw) {
+    if (typeof raw !== "string" || !raw.trim())
+        return null;
+    try {
+        const u = new URL(raw.trim());
+        if (u.protocol !== "https:" || u.username || u.password)
+            return null;
+        return u.origin;
+    }
+    catch {
+        return null;
+    }
+}
+async function readShellBaseUrl() {
+    const cfg = dbConfig();
+    if (!cfg) {
+        warn("config", "SUPABASE_URL of SB_SERVICE_ROLE_KEY ontbreekt; shell-adres onbekend");
+        return null;
+    }
+    const res = await timedFetch(`${cfg.url}/rest/v1/module_runtime_config?select=value&key=eq.shell_base_url&limit=1`, { method: "GET", headers: dbHeaders(cfg.key) });
+    if (!res.ok)
+        throw new Error(`database ${res.status}`);
+    const rows = (await res.json());
+    const value = normalizeShellBaseUrl(Array.isArray(rows) ? rows[0]?.value : null);
+    if (!value)
+        warn("empty", "module_runtime_config.shell_base_url ontbreekt of is geen https-adres");
+    return value;
+}
+/**
+ * Het shell-adres uit de klantdatabase (60 s cache per isolate). Bij een fout:
+ * de laatst bekende waarde plus waarschuwing. Valt nooit terug op het adres
+ * van het binnenkomende verzoek.
+ */
+export async function getShellBaseUrl() {
+    const now = Date.now();
+    if (baseUrlCache && now - baseUrlCache.at < BASE_URL_TTL_MS)
+        return baseUrlCache.value;
+    if (baseUrlInflight)
+        return baseUrlInflight;
+    baseUrlInflight = (async () => {
+        try {
+            const value = await readShellBaseUrl();
+            baseUrlCache = { value, at: Date.now() };
+            return value;
+        }
+        catch (e) {
+            warn("read", "shell-adres lezen mislukt; laatst bekende waarde gebruikt", {
+                error: e instanceof Error ? e.message : "onbekend",
+            });
+            const last = baseUrlCache?.value ?? null;
+            baseUrlCache = { value: last, at: Date.now() };
+            return last;
+        }
+        finally {
+            baseUrlInflight = null;
+        }
+    })();
+    return baseUrlInflight;
+}
+/**
+ * Zet process.env.PUBLIC_BASE_URL uit de database. De database wint; een
+ * afwijkende env-waarde geeft een waarschuwing. Zonder databasewaarde blijft
+ * de env ongemoeid (host-afhankelijke code faalt zoals nu).
+ */
+export async function applyShellBaseUrl() {
+    const value = await getShellBaseUrl();
+    if (!value)
+        return null;
+    const current = process.env.PUBLIC_BASE_URL;
+    if (current && normalizeShellBaseUrl(current) !== value) {
+        warn("mismatch", "PUBLIC_BASE_URL wijkt af van de database; databasewaarde gebruikt", {
+            env: hostOnly(current),
+            database: hostOnly(value),
+        });
+    }
+    process.env.PUBLIC_BASE_URL = value;
+    return value;
+}
+async function rpc(cfg, name, body) {
+    return timedFetch(`${cfg.url}/rest/v1/rpc/${name}`, {
+        method: "POST",
+        headers: dbHeaders(cfg.key),
+        body: JSON.stringify(body),
+    });
+}
+function hostOnly(value) {
+    try {
+        return new URL(value).host;
+    }
+    catch {
+        return null;
+    }
+}
+async function linkOnce() {
+    const cfg = dbConfig();
+    const centralUrl = process.env.CENTRAL_AUTH_URL?.replace(/\/+$/, "");
+    const secret = process.env.CENTRAL_AUTH_SECRET;
+    if (!cfg || !centralUrl || !secret) {
+        warn("link-config", "configuratie voor de Central-koppeling ontbreekt");
+        return false;
+    }
+    const statusRes = await rpc(cfg, "flowselections_central_status", {});
+    if (!statusRes.ok) {
+        warn("link-status", "flowselections_central_status niet beschikbaar", { status: statusRes.status });
+        return false;
+    }
+    const raw = await statusRes.json();
+    const status = (Array.isArray(raw) ? raw[0] : raw);
+    if (!status || typeof status.token_aanwezig !== "boolean") {
+        warn("link-status", "flowselections_central_status gaf geen resultaat");
+        return false;
+    }
+    if (status.token_aanwezig !== false && status.laatste_status !== "http_401")
+        return true;
+    const tokenRes = await timedFetch(`${centralUrl}/api/shell-host/read-token`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${secret}`, Accept: "application/json" },
+    });
+    if (!tokenRes.ok) {
+        warn("link-token", "leessleutel ophalen bij Central mislukt", { status: tokenRes.status });
+        return false;
+    }
+    const { token } = (await tokenRes.json());
+    if (typeof token !== "string" || !token) {
+        warn("link-token", "Central gaf geen bruikbare leessleutel");
+        return false;
+    }
+    const setRes = await rpc(cfg, "flowselections_set_central_link", {
+        p_central_url: centralUrl,
+        p_read_token: token,
+    });
+    if (!setRes.ok) {
+        warn("link-set", "flowselections_set_central_link mislukt", { status: setRes.status });
+        return false;
+    }
+    return true;
+}
+/**
+ * Na succes één uur wachten per isolate; na een fout vijf minuten.
+ */
+export async function ensureCentralLink() {
+    const now = Date.now();
+    if (linkInflight)
+        return linkInflight;
+    if (now < nextLinkCheck)
+        return;
+    linkInflight = linkOnce()
+        .then((ok) => { nextLinkCheck = Date.now() + (ok ? LINK_INTERVAL_MS : CRON_TTL_MS); })
+        .catch((e) => {
+        nextLinkCheck = Date.now() + CRON_TTL_MS;
+        warn("link-error", "Central-koppeling controleren mislukt", {
+            error: e instanceof Error ? e.name : "onbekend",
+        });
+    })
+        .finally(() => {
+        linkInflight = null;
+    });
+    return linkInflight;
+}
+async function cronKeysOnce() {
+    const cfg = dbConfig();
+    const raw = process.env.SUPABASE_PUBLISHABLE_KEY ?? process.env.SUPABASE_ANON_KEY;
+    if (!cfg || !raw) {
+        warn("cron-key-config", "configuratie voor cronsleutels ontbreekt");
+        return false;
+    }
+    const key = raw.trim().replace(/^(["'])(.*)\1$/, "$2").trim();
+    if (!key) {
+        warn("cron-key-config", "publishable key ontbreekt");
+        return false;
+    }
+    const res = await rpc(cfg, "flowselections_set_anon_key", { p_key: key });
+    if (!res.ok) {
+        warn("cron-key-rpc", "flowselections_set_anon_key niet beschikbaar of mislukt", { status: res.status });
+        return false;
+    }
+    const result = await res.json();
+    if (result !== "ongewijzigd" && result !== "bijgewerkt") {
+        warn("cron-key-result", "flowselections_set_anon_key gaf geen geldig resultaat");
+        return false;
+    }
+    if (result === "bijgewerkt")
+        console.info("[shell-runtime] cronsleutel bijgewerkt");
+    return true;
+}
+/** Synchroniseert de shell-publishable key; uur na succes, vijf minuten na fout. */
+export async function ensureCronKeys() {
+    if (cronKeyInflight)
+        return cronKeyInflight;
+    if (Date.now() < nextCronKeyCheck)
+        return;
+    cronKeyInflight = cronKeysOnce()
+        .then((ok) => { nextCronKeyCheck = Date.now() + (ok ? LINK_INTERVAL_MS : CRON_TTL_MS); })
+        .catch(() => {
+        nextCronKeyCheck = Date.now() + CRON_TTL_MS;
+        warn("cron-key-error", "cronsleutel synchroniseren mislukt");
+    })
+        .finally(() => { cronKeyInflight = null; });
+    return cronKeyInflight;
+}
+async function readCronConfig() {
+    const cfg = dbConfig();
+    if (!cfg) {
+        warn("cron-config", "databaseconfiguratie voor croncontrole ontbreekt");
+        return null;
+    }
+    const pathsRes = await rpc(cfg, "flowselections_cron_paths", {});
+    if (!pathsRes.ok) {
+        warn("cron-paths", "flowselections_cron_paths niet beschikbaar", { status: pathsRes.status });
+        return null;
+    }
+    const paths = await pathsRes.json();
+    if (!Array.isArray(paths) || !paths.every((p) => typeof p === "string" && p.startsWith("/"))) {
+        warn("cron-paths-result", "cronpaden hebben een ongeldig formaat");
+        return null;
+    }
+    if (!paths.length)
+        return { paths: [], secret: "", mode: "compat", exempt: DEFAULT_EXEMPT };
+    const [secretRes, configRes] = await Promise.all([
+        rpc(cfg, "flowselections_cron_secret", {}),
+        timedFetch(`${cfg.url}/rest/v1/module_runtime_config?select=key,value&key=in.(cron_auth_mode,cron_auth_exempt_paths)`, { method: "GET", headers: dbHeaders(cfg.key) }),
+    ]);
+    if (!secretRes.ok || !configRes.ok) {
+        warn("cron-read", "cronsleutel of cronconfiguratie niet beschikbaar", {
+            secretStatus: secretRes.status, configStatus: configRes.status,
+        });
+        return null;
+    }
+    const secret = await secretRes.json();
+    const rows = await configRes.json();
+    if (typeof secret !== "string" || !secret || !Array.isArray(rows)) {
+        warn("cron-result", "cronconfiguratie heeft een ongeldig formaat");
+        return null;
+    }
+    const config = new Map();
+    for (const row of rows) {
+        if (!row || typeof row !== "object" || typeof row.key !== "string" || typeof row.value !== "string") {
+            warn("cron-result", "cronconfiguratie heeft een ongeldig formaat");
+            return null;
+        }
+        config.set(row.key, row.value);
+    }
+    const mode = config.get("cron_auth_mode") ?? "compat";
+    if (mode !== "compat" && mode !== "afdwingen") {
+        warn("cron-mode", "onbekende cronmodus; controle overgeslagen");
+        return null;
+    }
+    const extra = (config.get("cron_auth_exempt_paths") ?? "").split(",").map((p) => p.trim()).filter(Boolean);
+    if (extra.some((p) => !p.startsWith("/"))) {
+        warn("cron-exempt", "ongeldig uitzonderingsprefix; controle overgeslagen");
+        return null;
+    }
+    return { paths, secret, mode, exempt: [...DEFAULT_EXEMPT, ...extra] };
+}
+async function getCronConfig(force = false, previous) {
+    if (cronInflight)
+        return cronInflight;
+    if (force && cronCache && Date.now() - cronCache.at < CRON_TTL_MS &&
+        (cronCache.value !== previous || cronCache.mismatchRefreshed))
+        return cronCache.value;
+    if (!force && cronCache && Date.now() - cronCache.at < CRON_TTL_MS)
+        return cronCache.value;
+    cronCache = null;
+    cronInflight = readCronConfig()
+        .catch(() => {
+        warn("cron-error", "croncontrole lezen mislukt");
+        return null;
+    })
+        .then((value) => {
+        cronCache = { value, at: Date.now(), mismatchRefreshed: force };
+        return value;
+    })
+        .finally(() => { cronInflight = null; });
+    return cronInflight;
+}
+// Native Web Crypto verifies a fixed-size HMAC tag in constant time. No Node imports.
+async function sameSecret(expected, supplied) {
+    comparisonKey ?? (comparisonKey = crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]));
+    const key = await comparisonKey;
+    const encoder = new TextEncoder();
+    const tag = await crypto.subtle.sign("HMAC", key, encoder.encode(expected));
+    return crypto.subtle.verify("HMAC", key, tag, encoder.encode(supplied));
+}
+function needsCronCheck(config, pathname) {
+    return config.paths.includes(pathname) && !config.exempt.some((prefix) => pathname.startsWith(prefix));
+}
+/** Alleen geregistreerde cronpaden; alle lees-/runtimefouten laten door. */
+export async function checkCronRequest(request) {
+    try {
+        const pathname = new URL(request.url).pathname;
+        // Permanently mixed-use routes never require a cron secret, even on DB errors.
+        if (DEFAULT_EXEMPT.some((prefix) => pathname.startsWith(prefix)))
+            return null;
+        let config = await getCronConfig();
+        if (!config || !needsCronCheck(config, pathname))
+            return null;
+        const supplied = request.headers.get("x-flowselections-cron-key");
+        if (supplied !== null && await sameSecret(config.secret, supplied))
+            return null;
+        if (supplied !== null) {
+            config = await getCronConfig(true, config);
+            if (!config || !needsCronCheck(config, pathname))
+                return null;
+            if (await sameSecret(config.secret, supplied))
+                return null;
+        }
+        if (config.mode === "afdwingen")
+            return new Response("Unauthorized", { status: 401 });
+        warn("cron-auth", "cronaanroep zonder geldige platformsleutel", {
+            path: pathname, reason: supplied === null ? "ontbreekt" : "wijkt af",
+        });
+        return null;
+    }
+    catch {
+        warn("cron-check", "croncontrole mislukt; verzoek doorgelaten");
+        return null;
+    }
+}
+/** Zonder context hetzelfde gedrag als voorheen. Alleen bewuste cronweigering geeft 401. */
+export async function runShellRuntime(ctx) {
+    try {
+        await Promise.allSettled([
+            applyShellBaseUrl(), ensureCentralLink(), ...(ctx ? [ensureCronKeys()] : []),
+        ]);
+        if (ctx)
+            return await checkCronRequest(ctx.request);
+    }
+    catch {
+        // Geen onbedoelde weigering bij configuratie- of runtimefouten.
+    }
+    return null;
+}
+/** Alleen voor tests. */
+export function __resetShellRuntimeForTests() {
+    baseUrlCache = null;
+    baseUrlInflight = null;
+    nextLinkCheck = 0;
+    linkInflight = null;
+    nextCronKeyCheck = 0;
+    cronKeyInflight = null;
+    cronCache = null;
+    cronInflight = null;
+    comparisonKey = null;
+    lastWarn.clear();
+}

package/dist/supabase/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/supabase/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAyB3C,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;8BAb8C,CAAC;0BAEnD,CAAC;;kBAAqD,CAAC;wBACrD,CAAC;sBAA0B,CAAC;;0BAM/C,CADC;;;;8BAGkB,CAAC;0BACL,CAAC;2BAA+B,CAAC;kBACzC,CAAC;wBAA6B,CAAA;sBAA0B,CAAC;qBAC3D,CAAC;0BACE,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;0BAGwL,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;0BAAkqB,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;uBAA+iB,CAAC;oBAA+B,CAAC;;8BAAyE,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;oBAA+B,CAAC;4BAAuC,CAAC;8BAAkC,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;;;;;;;;;;;0BAAqT,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;0BAA8D,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;;;;;;;;;;;0BAAyR,CAAC;kBAAsB,CAAC;;0BAAsD,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;;0BAAwD,CAAC;;;;0BAAuF,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;qBAA0B,CAAC;0BAA8B,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;;;;qBAA2W,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;;;0BAA8E,CAAC;0BAA8B,CAAC;;;qBAAuD,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;oBAAwB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;0BAA0S,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;mCAA6sB,CAAC;0BAA4B,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;mCAAqE,CAAC;0BAA4B,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;uBAA0pB,CAAC;;0BAA8D,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;;4BAA4D,CAAC;;4BAA2D,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;uBAAgE,CAAC;qBAAgC,CAAC;0BAA8B,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;wBAA4B,CAAC;4BAAgC,CAAC;uBAA2B,CAAC;4BAAgC,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;;;;;;;;;;;;0BAAwV,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;;wCAAyE,CAAC;0BAA4B,CAAC;;;0BAA4D,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;kBAA6B,CAAC;wCAA4C,CAAC;0BAA4B,CAAC;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;;wBAAiE,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;iCAAqC,CAAC;wBAA4B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAAm+B,CAAC;;kBAAgE,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;;sBAAiE,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;sCAA0C,CAAC;kBAAsB,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;4BAAuC,CAAC;sBAA0B,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA69B,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;;qBAAiD,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;;oBAA8D,CAAC;0BAA8B,CAAC;;;8BAAgE,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;qBAAyB,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;2BAAsC,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;uBAA8xB,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;;qBAAwD,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;oBAA+B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;;;;;;sBAAiK,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;sBAAyB,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;oBAAwB,CAAC,EAAC,kBAAmB,SAAS;uBAA+B,CAAC;;;;;;;;;;;;;;;;;;;EAA1igB,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/supabase/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA2B3C,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;8BAhBnB,CAAA;0BAGA,CAAC;;kBAAqD,CAAC;wBAC/C,CAAC;sBACa,CAAC;;0BACnB,CAAN;;;;8BAGE,CAAF;0BAGyB,CAAC;2BAA+B,CAAC;kBAEhD,CAAA;wBAA4B,CAAC;sBAChB,CAAC;qBAAyB,CAAC;0BACjC,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;0BAKwE,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;0BAAkqB,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;uBAA+iB,CAAC;oBAA+B,CAAC;;8BAAyE,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;oBAA+B,CAAC;4BAAuC,CAAC;8BAAkC,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;;;;;;;;;;;0BAAqT,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;0BAA8D,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;;;;;;;;;;;0BAAyR,CAAC;kBAAsB,CAAC;;0BAAsD,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;;0BAAwD,CAAC;;;;0BAAuF,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;qBAA0B,CAAC;0BAA8B,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;;;;qBAA2W,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;;;0BAA8E,CAAC;0BAA8B,CAAC;;;qBAAuD,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;oBAAwB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;0BAA0S,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;mCAA6sB,CAAC;0BAA4B,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;mCAAqE,CAAC;0BAA4B,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;uBAA0pB,CAAC;;0BAA8D,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;;4BAA4D,CAAC;;4BAA2D,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;uBAAgE,CAAC;qBAAgC,CAAC;0BAA8B,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;wBAA4B,CAAC;4BAAgC,CAAC;uBAA2B,CAAC;4BAAgC,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;;;;;;;;;;;;0BAAwV,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;;wCAAyE,CAAC;0BAA4B,CAAC;;;0BAA4D,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;kBAA6B,CAAC;wCAA4C,CAAC;0BAA4B,CAAC;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;;wBAAiE,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;iCAAqC,CAAC;wBAA4B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAAm+B,CAAC;;kBAAgE,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;;sBAAiE,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;sCAA0C,CAAC;kBAAsB,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;4BAAuC,CAAC;sBAA0B,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA69B,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;;qBAAiD,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;;oBAA8D,CAAC;0BAA8B,CAAC;;;8BAAgE,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;qBAAyB,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;2BAAsC,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;uBAA8xB,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;;qBAAwD,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;oBAA+B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;;;;;;sBAAiK,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;sBAAyB,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;oBAAwB,CAAC,EAAC,kBAAmB,SAAS;uBAA+B,CAAC;;;;;;;;;;;;;;;;;;;EAAn8f,CAAC"}

package/dist/supabase/client.js

@@ -1,11 +1,13 @@
 // This file is automatically generated. Do not edit it directly.
 import { createClient } from '@supabase/supabase-js';
+import { capturePasswordCallback } from '../auth/password-callback.js';
 function createSupabaseClient() {
     const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || process.env.SUPABASE_URL;
     const SUPABASE_PUBLISHABLE_KEY = import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY || process.env.SUPABASE_PUBLISHABLE_KEY;
     if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
         throw new Error('Missing Supabase environment variables. Ensure VITE_SUPABASE_URL and VITE_SUPABASE_PUBLISHABLE_KEY (or SUPABASE_URL/SUPABASE_PUBLISHABLE_KEY) are set.');
     }
+    capturePasswordCallback();
     return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
         auth: {
             storage: typeof window !== 'undefined' ? window.localStorage : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.29",
+  "version": "1.0.31",
   "private": false,
   "sideEffects": false,
   "type": "module",
@@ -99,7 +99,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.32.0",
-    "@lovable.dev/vite-tanstack-config": "2.25.3",
+    "@lovable.dev/vite-tanstack-config": "2.26.5",
     "@types/node": "^22.16.5",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",