@flowselections/core 1.0.30 → 1.0.31

package/README.md

@@ -213,7 +213,46 @@ De door het dashboard gegenereerde globale request-middleware roept per verzoek
 
 ```ts
 import { runShellRuntime } from "@flowselections/core/server";
-await runShellRuntime(); // zet PUBLIC_BASE_URL uit de database, controleert de Central-koppeling hooguit eens per uur
+await runShellRuntime(); // bestaand gedrag, geeft null terug; geen croncontrole zonder context
 ```
 
 Vereist `SUPABASE_URL`, `SB_SERVICE_ROLE_KEY`, `CENTRAL_AUTH_URL`, `CENTRAL_AUTH_SECRET`. Gooit nooit; de leessleutel wordt nooit gelogd of teruggegeven.
+
+### Centrale croncontrole (dashboardaansluiting)
+
+Het dashboard past `system-files.js`, `buildBody`, voor het systeembestand
+`src/lib/shell-runtime-middleware.ts` aan. Houd deze middleware als eerste:
+
+```ts
+createMiddleware({ type: "request" }).server(async ({ request, pathname, next }) => {
+  const { runShellRuntime } = await import("@flowselections/core/server");
+  const denied = await runShellRuntime({ request, pathname }); return denied ?? next();
+});
+```
+
+`ensureCronKeys()` synchroniseert `SUPABASE_PUBLISHABLE_KEY ?? SUPABASE_ANON_KEY`
+(zonder omringende aanhalingstekens) via `flowselections_set_anon_key`.
+Central-koppeling en sleutelsynchronisatie wachten één uur na succes en vijf
+minuten na een mislukking, per isolate. Geen sleutels in logs of responses.
+
+`checkCronRequest(request)` controleert uitsluitend exacte paden uit
+`flowselections_cron_paths()`, met `x-flowselections-cron-key` tegen
+`flowselections_cron_secret()`. Native Web Crypto verifieert de vergelijking.
+Paden, sleutel en configuratie worden vijf minuten gecachet; een afwijkende
+sleutel veroorzaakt één herlezing vóór de beslissing. Gelijktijdige herlezingen
+delen een Promise; daarna blijven herhaalde mismatches tot de volgende cacheverversing
+zonder extra RPC's, om een verzoekenstorm te voorkomen. Ontbrekende RPC's, netwerkfouten of ongeldige antwoorden laten
+verzoeken door en worden begrensd gemeld; deze laag vervangt geen modulebeveiliging.
+
+`module_runtime_config` heeft `key`/`value`-rijen: `shell_base_url`,
+`cron_auth_mode` (`compat` standaard, of `afdwingen`) en
+`cron_auth_exempt_paths` (komma-gescheiden extra padprefixen). In `compat` komt
+alleen een waarschuwing; in `afdwingen` een 401 vóór de handler. De drie vaste
+uitzonderingsprefixen blijven altijd gelden, ook bij een lege configuratie:
+
+- `/api/public/print/queue-tick`
+- `/api/public/hooks/logistics-shipping-note-now`
+- `/api/public/cron/ping`
+
+De eigen engine-tick en `verkoop_cron_post` staan buiten deze centrale padenlijst.
+Er worden geen requestheaders herschreven en geen modules gewijzigd.

package/dist/auth/password-callback.d.ts

@@ -0,0 +1,17 @@
+/** URL metadata is only a correlation signal; Supabase validates the session. */
+export type PasswordCallback = {
+    type: "invite" | "recovery";
+    sub: string;
+};
+export declare const PASSWORD_CALLBACK_WAIT_MS = 5000;
+export declare function readPasswordCallback(hash: string): PasswordCallback | null;
+/** Called immediately before createClient can consume/clear the URL hash. */
+export declare function capturePasswordCallback(): void;
+export declare function getPasswordCallback(): PasswordCallback | null;
+export declare function clearPasswordCallback(): void;
+export declare function matchingPasswordCallback(signal: PasswordCallback | null, session: {
+    user: {
+        id: string;
+    };
+} | null): PasswordCallback["type"] | null;
+//# sourceMappingURL=password-callback.d.ts.map

package/dist/auth/password-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-callback.d.ts","sourceRoot":"","sources":["../../src/core/auth/password-callback.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAG9C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAiB1E;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,OAAO,EAAE;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GACvC,gBAAgB,CAAC,MAAM,CAAC,GAAG,IAAI,CAEjC"}

package/dist/auth/password-callback.js

@@ -0,0 +1,39 @@
+export const PASSWORD_CALLBACK_WAIT_MS = 5000;
+let callback = null;
+export function readPasswordCallback(hash) {
+    const params = new URLSearchParams(hash.replace(/^#/, ""));
+    const type = params.get("type");
+    if (type !== "invite" && type !== "recovery")
+        return null;
+    try {
+        // Decode only the payload inline. Never retain the access token.
+        const payload = params.get("access_token")?.split(".")[1];
+        params.delete("access_token");
+        if (!payload)
+            return null;
+        const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const bytes = Uint8Array.from(atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "=")), (c) => c.charCodeAt(0));
+        const decoded = JSON.parse(new TextDecoder().decode(bytes));
+        if (typeof decoded !== "object" || decoded === null || !("sub" in decoded))
+            return null;
+        return typeof decoded.sub === "string" && decoded.sub.length > 0 ? { type, sub: decoded.sub } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Called immediately before createClient can consume/clear the URL hash. */
+export function capturePasswordCallback() {
+    if (typeof window === "undefined")
+        return;
+    callback = readPasswordCallback(window.location.hash);
+}
+export function getPasswordCallback() {
+    return callback;
+}
+export function clearPasswordCallback() {
+    callback = null;
+}
+export function matchingPasswordCallback(signal, session) {
+    return signal && session?.user.id === signal.sub ? signal.type : null;
+}

package/dist/components/layout/ResetWachtwoordPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResetWachtwoordPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/ResetWachtwoordPage.tsx"],"names":[],"mappings":"AASA,UAAU,wBAAwB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAoB,EAAE,EAAE,wBAAwB,2CAwFjG"}
+{"version":3,"file":"ResetWachtwoordPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/ResetWachtwoordPage.tsx"],"names":[],"mappings":"AAUA,UAAU,wBAAwB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAoB,EAAE,EAAE,wBAAwB,2CA0IjG"}

package/dist/components/layout/ResetWachtwoordPage.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useState, useEffect } from "react";
+import { useState, useEffect, useRef } from "react";
 import { useRouter } from "@tanstack/react-router";
 import { Button } from "../ui/button.js";
 import { Input } from "../ui/input.js";
@@ -7,23 +7,58 @@ import { Label } from "../ui/label.js";
 import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "../ui/card.js";
 import { toast } from "sonner";
 import { supabase } from "../../supabase/client.js";
+import { clearPasswordCallback, getPasswordCallback, matchingPasswordCallback, PASSWORD_CALLBACK_WAIT_MS } from "../../auth/password-callback.js";
 export function ResetWachtwoordPage({ redirectTo, loginPath = "/login" }) {
     const router = useRouter();
     const [password, setPassword] = useState("");
     const [confirmPassword, setConfirmPassword] = useState("");
     const [isLoading, setIsLoading] = useState(false);
-    const [isReady, setIsReady] = useState(false);
+    const [callbackType, setCallbackType] = useState(null);
+    const [isWaiting, setIsWaiting] = useState(true);
+    const callback = useRef(null);
     useEffect(() => {
-        const hash = window.location.hash;
-        if (hash && hash.includes("type=recovery")) {
-            setIsReady(true);
-        }
-        const { data: { subscription } } = supabase.auth.onAuthStateChange((event) => {
-            if (event === "PASSWORD_RECOVERY") {
-                setIsReady(true);
+        let active = true;
+        let accepted = false;
+        let timer;
+        // Accessing auth initializes the lazy client and captures the URL first.
+        const auth = supabase.auth;
+        callback.current = callback.current ?? getPasswordCallback();
+        const signal = callback.current;
+        const acceptSession = (session) => {
+            if (!active)
+                return;
+            const type = matchingPasswordCallback(signal, session);
+            setCallbackType(type);
+            if (type) {
+                accepted = true;
+                clearTimeout(timer);
+                clearPasswordCallback();
+                setIsWaiting(false);
+            }
+            else if (accepted) {
+                // A later sign-out or account switch invalidates this callback.
+                active = false;
+                callback.current = null;
+                setIsWaiting(false);
             }
+        };
+        const { data: { subscription } } = auth.onAuthStateChange((_event, session) => {
+            acceptSession(session);
         });
-        return () => subscription.unsubscribe();
+        timer = setTimeout(() => {
+            active = false;
+            clearPasswordCallback();
+            callback.current = null;
+            setCallbackType(null);
+            setIsWaiting(false);
+        }, PASSWORD_CALLBACK_WAIT_MS);
+        void auth.getSession().then(({ data: { session }, error }) => {
+            if (!error)
+                acceptSession(session);
+        }).catch(() => {
+            // The bounded wait also covers session initialization/network failures.
+        });
+        return () => { active = false; clearTimeout(timer); clearPasswordCallback(); subscription.unsubscribe(); };
     }, []);
     const handleSubmit = async (e) => {
         e.preventDefault();
@@ -35,19 +70,34 @@ export function ResetWachtwoordPage({ redirectTo, loginPath = "/login" }) {
             toast.error("Wachtwoorden komen niet overeen");
             return;
         }
+        if (!callbackType)
+            return;
         setIsLoading(true);
+        const { data: { session }, error: sessionError } = await supabase.auth.getSession();
+        if (sessionError || !matchingPasswordCallback(callback.current, session)) {
+            clearPasswordCallback();
+            callback.current = null;
+            setCallbackType(null);
+            setIsLoading(false);
+            return;
+        }
         const { error } = await supabase.auth.updateUser({ password });
         setIsLoading(false);
         if (error) {
             toast.error("Fout bij het instellen van het nieuwe wachtwoord");
         }
         else {
+            clearPasswordCallback();
+            callback.current = null;
             toast.success("Wachtwoord succesvol gewijzigd!");
             await router.navigate({ href: redirectTo });
         }
     };
-    if (!isReady) {
-        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { "data-empty-state": true, className: "text-2xl", children: "Ongeldige link" }), _jsx(CardDescription, { children: "Deze reset-link is ongeldig of verlopen. Vraag een nieuwe aan via de inlogpagina." })] }), _jsx(CardFooter, { className: "justify-center", children: _jsx(Button, { onClick: () => router.navigate({ href: loginPath }), children: "Naar inlogpagina" }) })] }) }));
+    if (isWaiting) {
+        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", role: "status", "aria-label": "Link controleren", children: _jsx("div", { className: "h-8 w-8 animate-spin rounded-full border-b-2 border-primary motion-reduce:animate-none" }) }));
+    }
+    if (!callbackType) {
+        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { "data-empty-state": true, className: "text-2xl", children: "Ongeldige link" }), _jsx(CardDescription, { children: "Deze link is verlopen of al gebruikt. Vraag een nieuwe uitnodiging aan, of gebruik Wachtwoord vergeten op de inlogpagina." })] }), _jsx(CardFooter, { className: "justify-center", children: _jsx(Button, { onClick: () => router.navigate({ href: loginPath }), children: "Naar inlogpagina" }) })] }) }));
     }
-    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: "Nieuw wachtwoord instellen" }), _jsx(CardDescription, { children: "Kies een nieuw wachtwoord voor je account" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Nieuw wachtwoord" }), _jsx(Input, { id: "password", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "confirmPassword", children: "Bevestig wachtwoord" }), _jsx(Input, { id: "confirmPassword", type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] })] }), _jsx(CardFooter, { children: _jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Opslaan..." : "Wachtwoord opslaan" }) })] })] }) }));
+    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: callbackType === "invite" ? "Welkom!" : "Nieuw wachtwoord instellen" }), _jsx(CardDescription, { children: callbackType === "invite" ? "Kies een wachtwoord om je account te activeren." : "Kies een nieuw wachtwoord voor je account" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Nieuw wachtwoord" }), _jsx(Input, { id: "password", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "confirmPassword", children: "Bevestig wachtwoord" }), _jsx(Input, { id: "confirmPassword", type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] })] }), _jsx(CardFooter, { children: _jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Opslaan..." : "Wachtwoord opslaan" }) })] })] }) }));
 }

package/dist/server/index.d.ts

@@ -8,5 +8,5 @@ export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
 export type { HandoverExchangeHandlerOptions } from "./handover-handler.js";
 export type { PermissionLevel } from "./permissions.server.js";
-export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, ensureCronKeys, checkCronRequest, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -8,4 +8,4 @@ export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
 // Shell-adres en Central-koppeling (alleen server; aangeroepen door de
 // door het dashboard gegenereerde globale request-middleware).
-export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, ensureCronKeys, checkCronRequest, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";

package/dist/server/shell-runtime.d.ts

@@ -13,12 +13,18 @@ export declare function getShellBaseUrl(): Promise<string | null>;
  */
 export declare function applyShellBaseUrl(): Promise<string | null>;
 /**
- * Hooguit eens per uur per isolate. Netwerkfout of ontbrekende RPC: niets
- * doen, waarschuwen, niet opnieuw tot het volgende uur.
+ * Na succes één uur wachten per isolate; na een fout vijf minuten.
  */
 export declare function ensureCentralLink(): Promise<void>;
-/** Voor de globale request-middleware van de shell. Gooit nooit. */
-export declare function runShellRuntime(): Promise<void>;
+/** Synchroniseert de shell-publishable key; uur na succes, vijf minuten na fout. */
+export declare function ensureCronKeys(): Promise<void>;
+/** Alleen geregistreerde cronpaden; alle lees-/runtimefouten laten door. */
+export declare function checkCronRequest(request: Request): Promise<Response | null>;
+/** Zonder context hetzelfde gedrag als voorheen. Alleen bewuste cronweigering geeft 401. */
+export declare function runShellRuntime(ctx?: {
+    request: Request;
+    pathname: string;
+}): Promise<Response | null>;
 /** Alleen voor tests. */
 export declare function __resetShellRuntimeForTests(): void;
 //# sourceMappingURL=shell-runtime.d.ts.map

package/dist/server/shell-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAwDA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AAyDD;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAevD;AAED,oEAAoE;AACpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAM1C"}
+{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAqEA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AA+DD;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvD;AA4BD,oFAAoF;AACpF,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAWpD;AAyFD,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuBjF;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,GAAG,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAU5G;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAW1C"}

package/dist/server/shell-runtime.js

@@ -14,14 +14,26 @@ const BASE_URL_TTL_MS = 60000;
 const LINK_INTERVAL_MS = 60 * 60000;
 const TIMEOUT_MS = 5000;
 const WARN_INTERVAL_MS = 5 * 60000;
+const CRON_TTL_MS = 5 * 60000;
 let baseUrlCache = null;
 let baseUrlInflight = null;
-let lastLinkCheck = 0;
+let nextLinkCheck = 0;
 let linkInflight = null;
+let nextCronKeyCheck = 0;
+let cronKeyInflight = null;
+let cronCache = null;
+let cronInflight = null;
+let comparisonKey = null;
+const DEFAULT_EXEMPT = [
+    "/api/public/print/queue-tick",
+    "/api/public/hooks/logistics-shipping-note-now",
+    "/api/public/cron/ping",
+];
 const lastWarn = new Map();
 function warn(key, message, detail) {
     const now = Date.now();
-    if (now - (lastWarn.get(key) ?? 0) < WARN_INTERVAL_MS)
+    const last = lastWarn.get(key);
+    if (last !== undefined && now - last < WARN_INTERVAL_MS)
         return;
     lastWarn.set(key, now);
     console.warn(`[shell-runtime] ${message}`, detail ?? {});
@@ -70,11 +82,11 @@ async function readShellBaseUrl() {
         warn("config", "SUPABASE_URL of SB_SERVICE_ROLE_KEY ontbreekt; shell-adres onbekend");
         return null;
     }
-    const res = await timedFetch(`${cfg.url}/rest/v1/module_runtime_config?select=shell_base_url&limit=1`, { method: "GET", headers: dbHeaders(cfg.key) });
+    const res = await timedFetch(`${cfg.url}/rest/v1/module_runtime_config?select=value&key=eq.shell_base_url&limit=1`, { method: "GET", headers: dbHeaders(cfg.key) });
     if (!res.ok)
         throw new Error(`database ${res.status}`);
     const rows = (await res.json());
-    const value = normalizeShellBaseUrl(Array.isArray(rows) ? rows[0]?.shell_base_url : null);
+    const value = normalizeShellBaseUrl(Array.isArray(rows) ? rows[0]?.value : null);
     if (!value)
         warn("empty", "module_runtime_config.shell_base_url ontbreekt of is geen https-adres");
     return value;
@@ -122,8 +134,8 @@ export async function applyShellBaseUrl() {
     const current = process.env.PUBLIC_BASE_URL;
     if (current && normalizeShellBaseUrl(current) !== value) {
         warn("mismatch", "PUBLIC_BASE_URL wijkt af van de database; databasewaarde gebruikt", {
-            env: current,
-            database: value,
+            env: hostOnly(current),
+            database: hostOnly(value),
         });
     }
     process.env.PUBLIC_BASE_URL = value;
@@ -136,39 +148,47 @@ async function rpc(cfg, name, body) {
         body: JSON.stringify(body),
     });
 }
+function hostOnly(value) {
+    try {
+        return new URL(value).host;
+    }
+    catch {
+        return null;
+    }
+}
 async function linkOnce() {
     const cfg = dbConfig();
     const centralUrl = process.env.CENTRAL_AUTH_URL?.replace(/\/+$/, "");
     const secret = process.env.CENTRAL_AUTH_SECRET;
     if (!cfg || !centralUrl || !secret) {
         warn("link-config", "configuratie voor de Central-koppeling ontbreekt");
-        return;
+        return false;
     }
     const statusRes = await rpc(cfg, "flowselections_central_status", {});
     if (!statusRes.ok) {
         warn("link-status", "flowselections_central_status niet beschikbaar", { status: statusRes.status });
-        return;
+        return false;
     }
     const raw = await statusRes.json();
     const status = (Array.isArray(raw) ? raw[0] : raw);
-    if (!status) {
+    if (!status || typeof status.token_aanwezig !== "boolean") {
         warn("link-status", "flowselections_central_status gaf geen resultaat");
-        return;
+        return false;
     }
     if (status.token_aanwezig !== false && status.laatste_status !== "http_401")
-        return;
+        return true;
     const tokenRes = await timedFetch(`${centralUrl}/api/shell-host/read-token`, {
         method: "POST",
         headers: { Authorization: `Bearer ${secret}`, Accept: "application/json" },
     });
     if (!tokenRes.ok) {
         warn("link-token", "leessleutel ophalen bij Central mislukt", { status: tokenRes.status });
-        return;
+        return false;
     }
     const { token } = (await tokenRes.json());
     if (typeof token !== "string" || !token) {
         warn("link-token", "Central gaf geen bruikbare leessleutel");
-        return;
+        return false;
     }
     const setRes = await rpc(cfg, "flowselections_set_central_link", {
         p_central_url: centralUrl,
@@ -176,21 +196,23 @@ async function linkOnce() {
     });
     if (!setRes.ok) {
         warn("link-set", "flowselections_set_central_link mislukt", { status: setRes.status });
+        return false;
     }
+    return true;
 }
 /**
- * Hooguit eens per uur per isolate. Netwerkfout of ontbrekende RPC: niets
- * doen, waarschuwen, niet opnieuw tot het volgende uur.
+ * Na succes één uur wachten per isolate; na een fout vijf minuten.
  */
 export async function ensureCentralLink() {
     const now = Date.now();
     if (linkInflight)
         return linkInflight;
-    if (lastLinkCheck && now - lastLinkCheck < LINK_INTERVAL_MS)
+    if (now < nextLinkCheck)
         return;
-    lastLinkCheck = now;
     linkInflight = linkOnce()
+        .then((ok) => { nextLinkCheck = Date.now() + (ok ? LINK_INTERVAL_MS : CRON_TTL_MS); })
         .catch((e) => {
+        nextLinkCheck = Date.now() + CRON_TTL_MS;
         warn("link-error", "Central-koppeling controleren mislukt", {
             error: e instanceof Error ? e.name : "onbekend",
         });
@@ -200,20 +222,189 @@ export async function ensureCentralLink() {
     });
     return linkInflight;
 }
-/** Voor de globale request-middleware van de shell. Gooit nooit. */
-export async function runShellRuntime() {
+async function cronKeysOnce() {
+    const cfg = dbConfig();
+    const raw = process.env.SUPABASE_PUBLISHABLE_KEY ?? process.env.SUPABASE_ANON_KEY;
+    if (!cfg || !raw) {
+        warn("cron-key-config", "configuratie voor cronsleutels ontbreekt");
+        return false;
+    }
+    const key = raw.trim().replace(/^(["'])(.*)\1$/, "$2").trim();
+    if (!key) {
+        warn("cron-key-config", "publishable key ontbreekt");
+        return false;
+    }
+    const res = await rpc(cfg, "flowselections_set_anon_key", { p_key: key });
+    if (!res.ok) {
+        warn("cron-key-rpc", "flowselections_set_anon_key niet beschikbaar of mislukt", { status: res.status });
+        return false;
+    }
+    const result = await res.json();
+    if (result !== "ongewijzigd" && result !== "bijgewerkt") {
+        warn("cron-key-result", "flowselections_set_anon_key gaf geen geldig resultaat");
+        return false;
+    }
+    if (result === "bijgewerkt")
+        console.info("[shell-runtime] cronsleutel bijgewerkt");
+    return true;
+}
+/** Synchroniseert de shell-publishable key; uur na succes, vijf minuten na fout. */
+export async function ensureCronKeys() {
+    if (cronKeyInflight)
+        return cronKeyInflight;
+    if (Date.now() < nextCronKeyCheck)
+        return;
+    cronKeyInflight = cronKeysOnce()
+        .then((ok) => { nextCronKeyCheck = Date.now() + (ok ? LINK_INTERVAL_MS : CRON_TTL_MS); })
+        .catch(() => {
+        nextCronKeyCheck = Date.now() + CRON_TTL_MS;
+        warn("cron-key-error", "cronsleutel synchroniseren mislukt");
+    })
+        .finally(() => { cronKeyInflight = null; });
+    return cronKeyInflight;
+}
+async function readCronConfig() {
+    const cfg = dbConfig();
+    if (!cfg) {
+        warn("cron-config", "databaseconfiguratie voor croncontrole ontbreekt");
+        return null;
+    }
+    const pathsRes = await rpc(cfg, "flowselections_cron_paths", {});
+    if (!pathsRes.ok) {
+        warn("cron-paths", "flowselections_cron_paths niet beschikbaar", { status: pathsRes.status });
+        return null;
+    }
+    const paths = await pathsRes.json();
+    if (!Array.isArray(paths) || !paths.every((p) => typeof p === "string" && p.startsWith("/"))) {
+        warn("cron-paths-result", "cronpaden hebben een ongeldig formaat");
+        return null;
+    }
+    if (!paths.length)
+        return { paths: [], secret: "", mode: "compat", exempt: DEFAULT_EXEMPT };
+    const [secretRes, configRes] = await Promise.all([
+        rpc(cfg, "flowselections_cron_secret", {}),
+        timedFetch(`${cfg.url}/rest/v1/module_runtime_config?select=key,value&key=in.(cron_auth_mode,cron_auth_exempt_paths)`, { method: "GET", headers: dbHeaders(cfg.key) }),
+    ]);
+    if (!secretRes.ok || !configRes.ok) {
+        warn("cron-read", "cronsleutel of cronconfiguratie niet beschikbaar", {
+            secretStatus: secretRes.status, configStatus: configRes.status,
+        });
+        return null;
+    }
+    const secret = await secretRes.json();
+    const rows = await configRes.json();
+    if (typeof secret !== "string" || !secret || !Array.isArray(rows)) {
+        warn("cron-result", "cronconfiguratie heeft een ongeldig formaat");
+        return null;
+    }
+    const config = new Map();
+    for (const row of rows) {
+        if (!row || typeof row !== "object" || typeof row.key !== "string" || typeof row.value !== "string") {
+            warn("cron-result", "cronconfiguratie heeft een ongeldig formaat");
+            return null;
+        }
+        config.set(row.key, row.value);
+    }
+    const mode = config.get("cron_auth_mode") ?? "compat";
+    if (mode !== "compat" && mode !== "afdwingen") {
+        warn("cron-mode", "onbekende cronmodus; controle overgeslagen");
+        return null;
+    }
+    const extra = (config.get("cron_auth_exempt_paths") ?? "").split(",").map((p) => p.trim()).filter(Boolean);
+    if (extra.some((p) => !p.startsWith("/"))) {
+        warn("cron-exempt", "ongeldig uitzonderingsprefix; controle overgeslagen");
+        return null;
+    }
+    return { paths, secret, mode, exempt: [...DEFAULT_EXEMPT, ...extra] };
+}
+async function getCronConfig(force = false, previous) {
+    if (cronInflight)
+        return cronInflight;
+    if (force && cronCache && Date.now() - cronCache.at < CRON_TTL_MS &&
+        (cronCache.value !== previous || cronCache.mismatchRefreshed))
+        return cronCache.value;
+    if (!force && cronCache && Date.now() - cronCache.at < CRON_TTL_MS)
+        return cronCache.value;
+    cronCache = null;
+    cronInflight = readCronConfig()
+        .catch(() => {
+        warn("cron-error", "croncontrole lezen mislukt");
+        return null;
+    })
+        .then((value) => {
+        cronCache = { value, at: Date.now(), mismatchRefreshed: force };
+        return value;
+    })
+        .finally(() => { cronInflight = null; });
+    return cronInflight;
+}
+// Native Web Crypto verifies a fixed-size HMAC tag in constant time. No Node imports.
+async function sameSecret(expected, supplied) {
+    comparisonKey ?? (comparisonKey = crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]));
+    const key = await comparisonKey;
+    const encoder = new TextEncoder();
+    const tag = await crypto.subtle.sign("HMAC", key, encoder.encode(expected));
+    return crypto.subtle.verify("HMAC", key, tag, encoder.encode(supplied));
+}
+function needsCronCheck(config, pathname) {
+    return config.paths.includes(pathname) && !config.exempt.some((prefix) => pathname.startsWith(prefix));
+}
+/** Alleen geregistreerde cronpaden; alle lees-/runtimefouten laten door. */
+export async function checkCronRequest(request) {
+    try {
+        const pathname = new URL(request.url).pathname;
+        // Permanently mixed-use routes never require a cron secret, even on DB errors.
+        if (DEFAULT_EXEMPT.some((prefix) => pathname.startsWith(prefix)))
+            return null;
+        let config = await getCronConfig();
+        if (!config || !needsCronCheck(config, pathname))
+            return null;
+        const supplied = request.headers.get("x-flowselections-cron-key");
+        if (supplied !== null && await sameSecret(config.secret, supplied))
+            return null;
+        if (supplied !== null) {
+            config = await getCronConfig(true, config);
+            if (!config || !needsCronCheck(config, pathname))
+                return null;
+            if (await sameSecret(config.secret, supplied))
+                return null;
+        }
+        if (config.mode === "afdwingen")
+            return new Response("Unauthorized", { status: 401 });
+        warn("cron-auth", "cronaanroep zonder geldige platformsleutel", {
+            path: pathname, reason: supplied === null ? "ontbreekt" : "wijkt af",
+        });
+        return null;
+    }
+    catch {
+        warn("cron-check", "croncontrole mislukt; verzoek doorgelaten");
+        return null;
+    }
+}
+/** Zonder context hetzelfde gedrag als voorheen. Alleen bewuste cronweigering geeft 401. */
+export async function runShellRuntime(ctx) {
     try {
-        await Promise.all([applyShellBaseUrl(), ensureCentralLink()]);
+        await Promise.allSettled([
+            applyShellBaseUrl(), ensureCentralLink(), ...(ctx ? [ensureCronKeys()] : []),
+        ]);
+        if (ctx)
+            return await checkCronRequest(ctx.request);
     }
     catch {
-        // helpers vangen zelf; nooit een verzoek laten falen
+        // Geen onbedoelde weigering bij configuratie- of runtimefouten.
     }
+    return null;
 }
 /** Alleen voor tests. */
 export function __resetShellRuntimeForTests() {
     baseUrlCache = null;
     baseUrlInflight = null;
-    lastLinkCheck = 0;
+    nextLinkCheck = 0;
     linkInflight = null;
+    nextCronKeyCheck = 0;
+    cronKeyInflight = null;
+    cronCache = null;
+    cronInflight = null;
+    comparisonKey = null;
     lastWarn.clear();
 }

package/dist/supabase/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/supabase/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAyB3C,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;8BAb8C,CAAC;0BAEnD,CAAC;;kBAAqD,CAAC;wBACrD,CAAC;sBAA0B,CAAC;;0BAM/C,CADC;;;;8BAGkB,CAAC;0BACL,CAAC;2BAA+B,CAAC;kBACzC,CAAC;wBAA6B,CAAA;sBAA0B,CAAC;qBAC3D,CAAC;0BACE,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;0BAGwL,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;0BAAkqB,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;uBAA+iB,CAAC;oBAA+B,CAAC;;8BAAyE,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;oBAA+B,CAAC;4BAAuC,CAAC;8BAAkC,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;;;;;;;;;;;0BAAqT,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;0BAA8D,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;;;;;;;;;;;0BAAyR,CAAC;kBAAsB,CAAC;;0BAAsD,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;;0BAAwD,CAAC;;;;0BAAuF,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;qBAA0B,CAAC;0BAA8B,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;;;;qBAA2W,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;;;0BAA8E,CAAC;0BAA8B,CAAC;;;qBAAuD,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;oBAAwB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;0BAA0S,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;mCAA6sB,CAAC;0BAA4B,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;mCAAqE,CAAC;0BAA4B,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;uBAA0pB,CAAC;;0BAA8D,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;;4BAA4D,CAAC;;4BAA2D,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;uBAAgE,CAAC;qBAAgC,CAAC;0BAA8B,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;wBAA4B,CAAC;4BAAgC,CAAC;uBAA2B,CAAC;4BAAgC,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;;;;;;;;;;;;0BAAwV,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;;wCAAyE,CAAC;0BAA4B,CAAC;;;0BAA4D,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;kBAA6B,CAAC;wCAA4C,CAAC;0BAA4B,CAAC;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;;wBAAiE,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;iCAAqC,CAAC;wBAA4B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAAm+B,CAAC;;kBAAgE,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;;sBAAiE,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;sCAA0C,CAAC;kBAAsB,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;4BAAuC,CAAC;sBAA0B,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA69B,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;;qBAAiD,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;;oBAA8D,CAAC;0BAA8B,CAAC;;;8BAAgE,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;qBAAyB,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;2BAAsC,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;uBAA8xB,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;;qBAAwD,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;oBAA+B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;;;;;;sBAAiK,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;sBAAyB,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;oBAAwB,CAAC,EAAC,kBAAmB,SAAS;uBAA+B,CAAC;;;;;;;;;;;;;;;;;;;EAA1igB,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/supabase/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA2B3C,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;8BAhBnB,CAAA;0BAGA,CAAC;;kBAAqD,CAAC;wBAC/C,CAAC;sBACa,CAAC;;0BACnB,CAAN;;;;8BAGE,CAAF;0BAGyB,CAAC;2BAA+B,CAAC;kBAEhD,CAAA;wBAA4B,CAAC;sBAChB,CAAC;qBAAyB,CAAC;0BACjC,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;0BAKwE,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;0BAAkqB,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;uBAA+iB,CAAC;oBAA+B,CAAC;;8BAAyE,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;oBAA+B,CAAC;4BAAuC,CAAC;8BAAkC,CAAC;uBAAkC,CAAC;0BAAqC,CAAC;6BAAiC,CAAC;qBAAuB,CAAC;kBAA6B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;2BAAsC,CAAC;0BAAqC,CAAC;;;;;;;;;;;;;0BAAqT,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;0BAA8D,CAAC;gCAAoC,CAAC;kBAAwB,CAAC;0BAA8B,CAAC;+BAAmC,CAAC;;;;;;;;;;;;;0BAAyR,CAAC;kBAAsB,CAAC;;0BAAsD,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;;0BAAwD,CAAC;;;;0BAAuF,CAAC;kBAAsB,CAAC;uBAA2B,CAAC;oBAA+B,CAAC;qBAA0B,CAAC;0BAA8B,CAAC;uBAA2B,CAAC;;;;;;;;;;;;;;;;qBAA2W,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;;;0BAA8E,CAAC;0BAA8B,CAAC;;;qBAAuD,CAAC;0BAA8B,CAAC;oBAAwB,CAAC;kBAA6B,CAAC;oBAAwB,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;0BAA0S,CAAC;;kBAA0D,CAAC;;0BAAuD,CAAC;;;0BAA4D,CAAC;gCAAoC,CAAC;kBAAsB,CAAC;qBAAyB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;mCAA6sB,CAAC;0BAA4B,CAAC;;;0BAA0F,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;mCAAqE,CAAC;0BAA4B,CAAC;yBAA6B,CAAC;2BAA+B,CAAC;0BAA8B,CAAC;kBAAsB,CAAC;yBAA6B,CAAC;0BAA+B,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;uBAA0pB,CAAC;;0BAA8D,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;;4BAA4D,CAAC;;4BAA2D,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;uBAAgE,CAAC;qBAAgC,CAAC;0BAA8B,CAAC;6BAAiC,CAAC;kBAAoB,CAAC;yBAA6B,CAAC;iCAA4C,CAAC;wBAA4B,CAAC;4BAAgC,CAAC;uBAA2B,CAAC;4BAAgC,CAAC;8BAAkC,CAAC;wBAAmC,CAAC;0BAA8B,CAAC;oBAA+B,CAAC;0BAA8B,CAAC;sBAA0B,CAAC;;;;;;;;;;;;;;0BAAwV,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;;wCAAyE,CAAC;0BAA4B,CAAC;;;0BAA4D,CAAC;4BAAgC,CAAC;qBAAgC,CAAC;kBAA6B,CAAC;wCAA4C,CAAC;0BAA4B,CAAC;;;;;;;;;;;;;;0BAAoV,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;;wBAAiE,CAAC;;;0BAA4D,CAAC;kBAAsB,CAAC;0BAA8B,CAAC;4BAAuC,CAAC;iCAAqC,CAAC;wBAA4B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAAm+B,CAAC;;kBAAgE,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;;sBAAiE,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;0BAA4D,CAAC;sCAA0C,CAAC;kBAAsB,CAAC;2BAA+B,CAAC;qBAAgC,CAAC;4BAAuC,CAAC;sBAA0B,CAAC;2BAA+B,CAAC;6BAAwC,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAA69B,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;;qBAAiD,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;;oBAA8D,CAAC;0BAA8B,CAAC;;;8BAAgE,CAAC;0BAAqC,CAAC;kBAAsB,CAAC;oBAAwB,CAAC;qBAAyB,CAAC;wBAAmC,CAAC;qBAAgC,CAAC;wBAAmC,CAAC;2BAAsC,CAAC;oBAAwB,CAAC;0BAA8B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;uBAA8xB,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;;qBAAwD,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;uBAAyD,CAAC;+BAA0C,CAAC;8BAAuC,CAAC;0BAAqC,CAAC;oCAAwC,CAAC;qBAAyB,CAAC;kBAA6B,CAAC;kCAAsC,CAAC;oBAA+B,CAAC;qBAAyB,CAAC;qBAAgC,CAAC;0BAAqC,CAAC;;;;;;;;sBAAiK,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;sBAAyB,kBAAmB,SAAS;;;;0BAA2F,CAAC;kBAAsB,CAAC;oBAAwB,CAAC,EAAC,kBAAmB,SAAS;uBAA+B,CAAC;;;;;;;;;;;;;;;;;;;EAAn8f,CAAC"}

package/dist/supabase/client.js

@@ -1,11 +1,13 @@
 // This file is automatically generated. Do not edit it directly.
 import { createClient } from '@supabase/supabase-js';
+import { capturePasswordCallback } from '../auth/password-callback.js';
 function createSupabaseClient() {
     const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || process.env.SUPABASE_URL;
     const SUPABASE_PUBLISHABLE_KEY = import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY || process.env.SUPABASE_PUBLISHABLE_KEY;
     if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
         throw new Error('Missing Supabase environment variables. Ensure VITE_SUPABASE_URL and VITE_SUPABASE_PUBLISHABLE_KEY (or SUPABASE_URL/SUPABASE_PUBLISHABLE_KEY) are set.');
     }
+    capturePasswordCallback();
     return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
         auth: {
             storage: typeof window !== 'undefined' ? window.localStorage : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.30",
+  "version": "1.0.31",
   "private": false,
   "sideEffects": false,
   "type": "module",