@flowselections/core 1.0.30 → 1.0.32

package/README.md

@@ -213,7 +213,46 @@ De door het dashboard gegenereerde globale request-middleware roept per verzoek
 
 ```ts
 import { runShellRuntime } from "@flowselections/core/server";
-await runShellRuntime(); // zet PUBLIC_BASE_URL uit de database, controleert de Central-koppeling hooguit eens per uur
+await runShellRuntime(); // bestaand gedrag, geeft null terug; geen croncontrole zonder context
 ```
 
 Vereist `SUPABASE_URL`, `SB_SERVICE_ROLE_KEY`, `CENTRAL_AUTH_URL`, `CENTRAL_AUTH_SECRET`. Gooit nooit; de leessleutel wordt nooit gelogd of teruggegeven.
+
+### Centrale croncontrole (dashboardaansluiting)
+
+Het dashboard past `system-files.js`, `buildBody`, voor het systeembestand
+`src/lib/shell-runtime-middleware.ts` aan. Houd deze middleware als eerste:
+
+```ts
+createMiddleware({ type: "request" }).server(async ({ request, pathname, next }) => {
+  const { runShellRuntime } = await import("@flowselections/core/server");
+  const denied = await runShellRuntime({ request, pathname }); return denied ?? next();
+});
+```
+
+`ensureCronKeys()` synchroniseert `SUPABASE_PUBLISHABLE_KEY ?? SUPABASE_ANON_KEY`
+(zonder omringende aanhalingstekens) via `flowselections_set_anon_key`.
+Central-koppeling en sleutelsynchronisatie wachten één uur na succes en vijf
+minuten na een mislukking, per isolate. Geen sleutels in logs of responses.
+
+`checkCronRequest(request)` controleert uitsluitend exacte paden uit
+`flowselections_cron_paths()`, met `x-flowselections-cron-key` tegen
+`flowselections_cron_secret()`. Native Web Crypto verifieert de vergelijking.
+Paden, sleutel en configuratie worden vijf minuten gecachet; een afwijkende
+sleutel veroorzaakt één herlezing vóór de beslissing. Gelijktijdige herlezingen
+delen een Promise; daarna blijven herhaalde mismatches tot de volgende cacheverversing
+zonder extra RPC's, om een verzoekenstorm te voorkomen. Ontbrekende RPC's, netwerkfouten of ongeldige antwoorden laten
+verzoeken door en worden begrensd gemeld; deze laag vervangt geen modulebeveiliging.
+
+`module_runtime_config` heeft `key`/`value`-rijen: `shell_base_url`,
+`cron_auth_mode` (`compat` standaard, of `afdwingen`) en
+`cron_auth_exempt_paths` (komma-gescheiden extra padprefixen). In `compat` komt
+alleen een waarschuwing; in `afdwingen` een 401 vóór de handler. De drie vaste
+uitzonderingsprefixen blijven altijd gelden, ook bij een lege configuratie:
+
+- `/api/public/print/queue-tick`
+- `/api/public/hooks/logistics-shipping-note-now`
+- `/api/public/cron/ping`
+
+De eigen engine-tick en `verkoop_cron_post` staan buiten deze centrale padenlijst.
+Er worden geen requestheaders herschreven en geen modules gewijzigd.

package/dist/auth/header-identity.d.ts

@@ -0,0 +1,23 @@
+type IdentitySource = {
+    profile?: {
+        display_name?: unknown;
+    } | null;
+    user?: {
+        email?: string | null;
+        user_metadata?: Record<string, unknown>;
+    } | null;
+};
+export declare function displayName(auth: IdentitySource): string;
+export declare function primaryRole(roles: readonly string[]): string | undefined;
+export declare function roleLabel(key: string | undefined, name?: string | null): string;
+export declare function initials(name: string): string;
+export declare function greetingAtHour(hour: number): string;
+export declare function amsterdamGreeting(now: Date, name: string): {
+    date: string;
+    text: string;
+};
+export type GreetingStorage = Pick<Storage, "getItem" | "setItem">;
+/** Storage is obtained inside the callback so even localStorage access can fail safely. */
+export declare function claimGreeting(userId: string, date: string, storage: () => GreetingStorage, seen: Map<string, string>): boolean;
+export {};
+//# sourceMappingURL=header-identity.d.ts.map

package/dist/auth/header-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-identity.d.ts","sourceRoot":"","sources":["../../src/core/auth/header-identity.ts"],"names":[],"mappings":"AAAA,KAAK,cAAc,GAAG;IACpB,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CAClF,CAAC;AAEF,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAIxD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAG/E;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUzF;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;AAEnE,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,eAAe,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAgB9H"}

package/dist/auth/header-identity.js

@@ -0,0 +1,53 @@
+export function displayName(auth) {
+    const metadata = auth.user?.user_metadata;
+    const candidates = [auth.profile?.display_name, metadata?.display_name, metadata?.full_name, auth.user?.email?.split("@")[0]];
+    return candidates.find((value) => typeof value === "string" && !!value.trim())?.trim() ?? "Gebruiker";
+}
+export function primaryRole(roles) {
+    return ["superadmin", "admin", "planner", "monteur"].find((role) => roles.includes(role)) ?? roles.find((role) => !!role.trim());
+}
+export function roleLabel(key, name) {
+    const value = name?.trim() || key || "";
+    return value ? value.charAt(0).toLocaleUpperCase("nl-NL") + value.slice(1) : "";
+}
+export function initials(name) {
+    const words = name.trim().split(/\s+/);
+    const first = words[0]?.charAt(0) ?? "";
+    const last = words.length > 1 ? words[words.length - 1]?.charAt(0) ?? "" : "";
+    return (first + last).toLocaleUpperCase("nl-NL");
+}
+export function greetingAtHour(hour) {
+    return hour >= 5 && hour < 12 ? "Goedemorgen" : hour >= 12 && hour < 18 ? "Goedemiddag" : "Goedenavond";
+}
+export function amsterdamGreeting(now, name) {
+    const parts = new Intl.DateTimeFormat("nl-NL", {
+        timeZone: "Europe/Amsterdam", year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", hourCycle: "h23",
+    }).formatToParts(now);
+    const part = (type) => parts.find((value) => value.type === type)?.value ?? "";
+    const date = `${part("year")}-${part("month")}-${part("day")}`;
+    const label = new Intl.DateTimeFormat("nl-NL", {
+        timeZone: "Europe/Amsterdam", weekday: "long", day: "numeric", month: "long",
+    }).format(now);
+    return { date, text: `${greetingAtHour(Number(part("hour")))}, ${name.split(/\s+/)[0]} · ${label}` };
+}
+/** Storage is obtained inside the callback so even localStorage access can fail safely. */
+export function claimGreeting(userId, date, storage, seen) {
+    if (seen.get(userId) === date)
+        return false;
+    try {
+        const target = storage();
+        const key = `core:greeted:${userId}`;
+        if (target.getItem(key) === date) {
+            seen.set(userId, date);
+            return false;
+        }
+        target.setItem(key, date);
+    }
+    catch {
+        // Without storage, only one greeting per user for this page session.
+        if (seen.has(userId))
+            return false;
+    }
+    seen.set(userId, date);
+    return true;
+}

package/dist/auth/password-callback.d.ts

@@ -0,0 +1,17 @@
+/** URL metadata is only a correlation signal; Supabase validates the session. */
+export type PasswordCallback = {
+    type: "invite" | "recovery";
+    sub: string;
+};
+export declare const PASSWORD_CALLBACK_WAIT_MS = 5000;
+export declare function readPasswordCallback(hash: string): PasswordCallback | null;
+/** Called immediately before createClient can consume/clear the URL hash. */
+export declare function capturePasswordCallback(): void;
+export declare function getPasswordCallback(): PasswordCallback | null;
+export declare function clearPasswordCallback(): void;
+export declare function matchingPasswordCallback(signal: PasswordCallback | null, session: {
+    user: {
+        id: string;
+    };
+} | null): PasswordCallback["type"] | null;
+//# sourceMappingURL=password-callback.d.ts.map

package/dist/auth/password-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-callback.d.ts","sourceRoot":"","sources":["../../src/core/auth/password-callback.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAG9C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAiB1E;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,OAAO,EAAE;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GACvC,gBAAgB,CAAC,MAAM,CAAC,GAAG,IAAI,CAEjC"}

package/dist/auth/password-callback.js

@@ -0,0 +1,39 @@
+export const PASSWORD_CALLBACK_WAIT_MS = 5000;
+let callback = null;
+export function readPasswordCallback(hash) {
+    const params = new URLSearchParams(hash.replace(/^#/, ""));
+    const type = params.get("type");
+    if (type !== "invite" && type !== "recovery")
+        return null;
+    try {
+        // Decode only the payload inline. Never retain the access token.
+        const payload = params.get("access_token")?.split(".")[1];
+        params.delete("access_token");
+        if (!payload)
+            return null;
+        const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const bytes = Uint8Array.from(atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "=")), (c) => c.charCodeAt(0));
+        const decoded = JSON.parse(new TextDecoder().decode(bytes));
+        if (typeof decoded !== "object" || decoded === null || !("sub" in decoded))
+            return null;
+        return typeof decoded.sub === "string" && decoded.sub.length > 0 ? { type, sub: decoded.sub } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Called immediately before createClient can consume/clear the URL hash. */
+export function capturePasswordCallback() {
+    if (typeof window === "undefined")
+        return;
+    callback = readPasswordCallback(window.location.hash);
+}
+export function getPasswordCallback() {
+    return callback;
+}
+export function clearPasswordCallback() {
+    callback = null;
+}
+export function matchingPasswordCallback(signal, session) {
+    return signal && session?.user.id === signal.sub ? signal.type : null;
+}

package/dist/components/layout/AuthenticatedLayout.js

@@ -45,5 +45,5 @@ export function AuthenticatedLayout({ children, header = true, permissions = tru
         visibleModules,
         permissionsLoading: loading,
     }), [sidebarProps.shellId, sidebarProps.modules, visibleModules, loading]);
-    return (_jsx(ShellContext.Provider, { value: shell, children: _jsxs("div", { className: "min-h-screen bg-background [--core-topbar-h:3.5rem] md:[--core-topbar-h:0px]", children: [_jsx(Sidebar, { ...sidebarProps, permissions: permissions, visibleModules: visibleModules, loading: loading }), _jsxs("div", { className: "flex min-h-dvh flex-col pt-[var(--core-topbar-h)] md:ml-64 md:pt-0", children: [header && _jsx(Header, { title: title }), _jsx("main", { className: "flex-1", children: permissions && access === "none" ? _jsx(NoAccess, {}) : (children ?? _jsx(Outlet, {})) })] })] }) }));
+    return (_jsx(ShellContext.Provider, { value: shell, children: _jsxs("div", { className: "min-h-screen bg-background [--core-topbar-h:3.5rem] md:[--core-topbar-h:0px]", children: [_jsx(Sidebar, { ...sidebarProps, permissions: permissions, visibleModules: visibleModules, loading: loading }), _jsxs("div", { className: "flex min-h-dvh flex-col pt-[var(--core-topbar-h)] md:ml-64 md:pt-0", children: [header && _jsx(Header, { title: title, auth: sidebarProps.auth }), _jsx("main", { className: "flex-1", children: permissions && access === "none" ? _jsx(NoAccess, {}) : (children ?? _jsx(Outlet, {})) })] })] }) }));
 }

package/dist/components/layout/Header.d.ts

@@ -1,6 +1,8 @@
+import type { AuthContext } from "../../auth/useAuth.js";
 interface HeaderProps {
     title: string;
+    auth?: AuthContext;
 }
-export declare function Header({ title }: HeaderProps): import("react/jsx-runtime").JSX.Element;
+export declare function Header({ title, auth }: HeaderProps): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=Header.d.ts.map

package/dist/components/layout/Header.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Header.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/Header.tsx"],"names":[],"mappings":"AAOA,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,2CAsB5C"}
+{"version":3,"file":"Header.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/Header.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,wBAAgB,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,2CA4BlD"}

package/dist/components/layout/Header.js

@@ -5,7 +5,10 @@ import { Input } from "../ui/input.js";
 import { Button } from "../ui/button.js";
 import { BugsDialog } from "./BugsDialog.js";
 import { NotificationBell } from "./NotificationBell.js";
-export function Header({ title }) {
+import { HeaderIdentity } from "./HeaderIdentity.js";
+import { useHeaderGreeting } from "./useHeaderGreeting.js";
+export function Header({ title, auth }) {
     const [bugsDialogOpen, setBugsDialogOpen] = useState(false);
-    return (_jsxs(_Fragment, { children: [_jsxs("header", { className: "sticky top-[var(--core-topbar-h,0px)] md:top-0 z-30 flex h-[var(--app-header-height)] shrink-0 items-center justify-between border-b border-border bg-card px-6", children: [_jsx("h1", { className: "text-xl font-semibold text-foreground", children: title }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsxs("div", { className: "relative hidden md:block", children: [_jsx(Search, { className: "absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" }), _jsx(Input, { placeholder: "Zoeken...", className: "w-64 pl-9" })] }), _jsxs(Button, { variant: "outline", size: "sm", onClick: () => setBugsDialogOpen(true), children: [_jsx(Bug, { className: "mr-2 h-4 w-4" }), "Bugs melden"] }), _jsx(NotificationBell, {})] })] }), _jsx(BugsDialog, { open: bugsDialogOpen, onOpenChange: setBugsDialogOpen })] }));
+    const greeting = useHeaderGreeting(auth);
+    return (_jsxs(_Fragment, { children: [_jsx("header", { className: "@container sticky top-[var(--core-topbar-h,0px)] md:top-0 z-30 min-h-[var(--app-header-height)] shrink-0 border-b border-border bg-card px-3 py-2 md:px-6", children: _jsxs("div", { className: "flex min-h-11 flex-wrap items-center justify-between gap-x-3 gap-y-1", children: [_jsx("h1", { className: "min-w-0 flex-1 truncate text-xl font-semibold text-foreground", children: title }), _jsxs("div", { className: "flex shrink-0 items-center gap-2 @[900px]:gap-4", children: [_jsxs("div", { className: "relative hidden @[1300px]:block", children: [_jsx(Search, { className: "absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" }), _jsx(Input, { placeholder: "Zoeken...", className: "w-64 pl-9" })] }), _jsxs(Button, { variant: "outline", size: "sm", "aria-label": "Bugs melden", title: "Bugs melden", onClick: () => setBugsDialogOpen(true), children: [_jsx(Bug, { className: "h-4 w-4" }), _jsx("span", { className: "hidden @[650px]:inline", children: "Bugs melden" })] }), _jsx(NotificationBell, {}), greeting && _jsx("p", { className: "hidden max-w-96 font-sans text-sm text-muted-foreground @[1100px]:block", children: greeting }), auth && _jsx(HeaderIdentity, { auth: auth })] }), greeting && _jsx("p", { className: "w-full break-words font-sans text-xs text-muted-foreground @[1100px]:hidden", children: greeting })] }) }), _jsx(BugsDialog, { open: bugsDialogOpen, onOpenChange: setBugsDialogOpen })] }));
 }

package/dist/components/layout/HeaderIdentity.d.ts

@@ -0,0 +1,5 @@
+import type { AuthContext } from "../../auth/useAuth.js";
+export declare function HeaderIdentity({ auth }: {
+    auth: AuthContext;
+}): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=HeaderIdentity.d.ts.map

package/dist/components/layout/HeaderIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HeaderIdentity.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/HeaderIdentity.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOzD,wBAAgB,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,kDAkC7D"}

package/dist/components/layout/HeaderIdentity.js

@@ -0,0 +1,32 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { displayName, primaryRole, roleLabel, initials } from "../../auth/header-identity.js";
+import { supabase } from "../../supabase/client.js";
+import { Button } from "../ui/button.js";
+import { Popover, PopoverContent, PopoverTrigger } from "../ui/popover.js";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "../ui/tooltip.js";
+export function HeaderIdentity({ auth }) {
+    const name = displayName(auth);
+    const key = primaryRole(auth.roles);
+    const [resolved, setResolved] = useState(null);
+    useEffect(() => {
+        let active = true;
+        if (!key || !auth.user)
+            return;
+        const userId = auth.user.id;
+        void (async () => {
+            try {
+                const { data } = await supabase.from("roles").select("name").eq("key", key).maybeSingle();
+                if (active && data?.name)
+                    setResolved({ key, name: data.name, userId });
+            }
+            catch { /* Existing permissions only; the key remains the fallback. */ }
+        })();
+        return () => { active = false; };
+    }, [key, auth.user?.id]);
+    if (!auth.user)
+        return null;
+    const role = roleLabel(key, resolved && resolved.key === key && resolved.userId === auth.user.id ? resolved.name : undefined);
+    const label = role ? `${name} · ${role}` : name;
+    return _jsxs(_Fragment, { children: [_jsxs("div", { className: "hidden max-w-64 min-w-0 items-center gap-1 font-sans text-sm @[1100px]:flex", title: label, children: [_jsx("span", { className: "truncate text-foreground", children: name }), role && _jsxs("span", { className: "shrink-0 text-muted-foreground", children: ["\u00B7 ", role] })] }), _jsx(TooltipProvider, { children: _jsx(Tooltip, { children: _jsxs(Popover, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsx(PopoverTrigger, { asChild: true, children: _jsx(Button, { variant: "secondary", size: "icon", className: "shrink-0 rounded-full font-sans @[1100px]:hidden", "aria-label": label, children: initials(name) }) }) }), _jsxs(PopoverContent, { align: "end", className: "w-64 break-words font-sans", children: [_jsx("p", { children: name }), role && _jsx("p", { className: "text-sm text-muted-foreground", children: role })] }), _jsx(TooltipContent, { children: label })] }) }) })] });
+}

package/dist/components/layout/ResetWachtwoordPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResetWachtwoordPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/ResetWachtwoordPage.tsx"],"names":[],"mappings":"AASA,UAAU,wBAAwB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAoB,EAAE,EAAE,wBAAwB,2CAwFjG"}
+{"version":3,"file":"ResetWachtwoordPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/ResetWachtwoordPage.tsx"],"names":[],"mappings":"AAUA,UAAU,wBAAwB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAoB,EAAE,EAAE,wBAAwB,2CA0IjG"}

package/dist/components/layout/ResetWachtwoordPage.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useState, useEffect } from "react";
+import { useState, useEffect, useRef } from "react";
 import { useRouter } from "@tanstack/react-router";
 import { Button } from "../ui/button.js";
 import { Input } from "../ui/input.js";
@@ -7,23 +7,58 @@ import { Label } from "../ui/label.js";
 import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "../ui/card.js";
 import { toast } from "sonner";
 import { supabase } from "../../supabase/client.js";
+import { clearPasswordCallback, getPasswordCallback, matchingPasswordCallback, PASSWORD_CALLBACK_WAIT_MS } from "../../auth/password-callback.js";
 export function ResetWachtwoordPage({ redirectTo, loginPath = "/login" }) {
     const router = useRouter();
     const [password, setPassword] = useState("");
     const [confirmPassword, setConfirmPassword] = useState("");
     const [isLoading, setIsLoading] = useState(false);
-    const [isReady, setIsReady] = useState(false);
+    const [callbackType, setCallbackType] = useState(null);
+    const [isWaiting, setIsWaiting] = useState(true);
+    const callback = useRef(null);
     useEffect(() => {
-        const hash = window.location.hash;
-        if (hash && hash.includes("type=recovery")) {
-            setIsReady(true);
-        }
-        const { data: { subscription } } = supabase.auth.onAuthStateChange((event) => {
-            if (event === "PASSWORD_RECOVERY") {
-                setIsReady(true);
+        let active = true;
+        let accepted = false;
+        let timer;
+        // Accessing auth initializes the lazy client and captures the URL first.
+        const auth = supabase.auth;
+        callback.current = callback.current ?? getPasswordCallback();
+        const signal = callback.current;
+        const acceptSession = (session) => {
+            if (!active)
+                return;
+            const type = matchingPasswordCallback(signal, session);
+            setCallbackType(type);
+            if (type) {
+                accepted = true;
+                clearTimeout(timer);
+                clearPasswordCallback();
+                setIsWaiting(false);
+            }
+            else if (accepted) {
+                // A later sign-out or account switch invalidates this callback.
+                active = false;
+                callback.current = null;
+                setIsWaiting(false);
             }
+        };
+        const { data: { subscription } } = auth.onAuthStateChange((_event, session) => {
+            acceptSession(session);
         });
-        return () => subscription.unsubscribe();
+        timer = setTimeout(() => {
+            active = false;
+            clearPasswordCallback();
+            callback.current = null;
+            setCallbackType(null);
+            setIsWaiting(false);
+        }, PASSWORD_CALLBACK_WAIT_MS);
+        void auth.getSession().then(({ data: { session }, error }) => {
+            if (!error)
+                acceptSession(session);
+        }).catch(() => {
+            // The bounded wait also covers session initialization/network failures.
+        });
+        return () => { active = false; clearTimeout(timer); clearPasswordCallback(); subscription.unsubscribe(); };
     }, []);
     const handleSubmit = async (e) => {
         e.preventDefault();
@@ -35,19 +70,34 @@ export function ResetWachtwoordPage({ redirectTo, loginPath = "/login" }) {
             toast.error("Wachtwoorden komen niet overeen");
             return;
         }
+        if (!callbackType)
+            return;
         setIsLoading(true);
+        const { data: { session }, error: sessionError } = await supabase.auth.getSession();
+        if (sessionError || !matchingPasswordCallback(callback.current, session)) {
+            clearPasswordCallback();
+            callback.current = null;
+            setCallbackType(null);
+            setIsLoading(false);
+            return;
+        }
         const { error } = await supabase.auth.updateUser({ password });
         setIsLoading(false);
         if (error) {
             toast.error("Fout bij het instellen van het nieuwe wachtwoord");
         }
         else {
+            clearPasswordCallback();
+            callback.current = null;
             toast.success("Wachtwoord succesvol gewijzigd!");
             await router.navigate({ href: redirectTo });
         }
     };
-    if (!isReady) {
-        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { "data-empty-state": true, className: "text-2xl", children: "Ongeldige link" }), _jsx(CardDescription, { children: "Deze reset-link is ongeldig of verlopen. Vraag een nieuwe aan via de inlogpagina." })] }), _jsx(CardFooter, { className: "justify-center", children: _jsx(Button, { onClick: () => router.navigate({ href: loginPath }), children: "Naar inlogpagina" }) })] }) }));
+    if (isWaiting) {
+        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", role: "status", "aria-label": "Link controleren", children: _jsx("div", { className: "h-8 w-8 animate-spin rounded-full border-b-2 border-primary motion-reduce:animate-none" }) }));
+    }
+    if (!callbackType) {
+        return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { "data-empty-state": true, className: "text-2xl", children: "Ongeldige link" }), _jsx(CardDescription, { children: "Deze link is verlopen of al gebruikt. Vraag een nieuwe uitnodiging aan, of gebruik Wachtwoord vergeten op de inlogpagina." })] }), _jsx(CardFooter, { className: "justify-center", children: _jsx(Button, { onClick: () => router.navigate({ href: loginPath }), children: "Naar inlogpagina" }) })] }) }));
     }
-    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: "Nieuw wachtwoord instellen" }), _jsx(CardDescription, { children: "Kies een nieuw wachtwoord voor je account" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Nieuw wachtwoord" }), _jsx(Input, { id: "password", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "confirmPassword", children: "Bevestig wachtwoord" }), _jsx(Input, { id: "confirmPassword", type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] })] }), _jsx(CardFooter, { children: _jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Opslaan..." : "Wachtwoord opslaan" }) })] })] }) }));
+    return (_jsx("div", { className: "min-h-screen flex items-center justify-center bg-background p-4", children: _jsxs(Card, { className: "w-full max-w-md", children: [_jsxs(CardHeader, { className: "text-center", children: [_jsx(CardTitle, { className: "text-2xl", children: callbackType === "invite" ? "Welkom!" : "Nieuw wachtwoord instellen" }), _jsx(CardDescription, { children: callbackType === "invite" ? "Kies een wachtwoord om je account te activeren." : "Kies een nieuw wachtwoord voor je account" })] }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "password", children: "Nieuw wachtwoord" }), _jsx(Input, { id: "password", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "confirmPassword", children: "Bevestig wachtwoord" }), _jsx(Input, { id: "confirmPassword", type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 6, maxLength: 128 })] })] }), _jsx(CardFooter, { children: _jsx(Button, { type: "submit", className: "w-full", disabled: isLoading, children: isLoading ? "Opslaan..." : "Wachtwoord opslaan" }) })] })] }) }));
 }

package/dist/components/layout/useHeaderGreeting.d.ts

@@ -0,0 +1,3 @@
+import type { AuthContext } from "../../auth/useAuth.js";
+export declare function useHeaderGreeting(auth?: AuthContext): string | null;
+//# sourceMappingURL=useHeaderGreeting.d.ts.map

package/dist/components/layout/useHeaderGreeting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useHeaderGreeting.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/useHeaderGreeting.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKzD,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CA+BnE"}

package/dist/components/layout/useHeaderGreeting.js

@@ -0,0 +1,40 @@
+import { useEffect, useRef, useState } from "react";
+import { useLocation } from "@tanstack/react-router";
+import { amsterdamGreeting, claimGreeting, displayName } from "../../auth/header-identity.js";
+const seen = new Map();
+export function useHeaderGreeting(auth) {
+    const href = useLocation({ select: (location) => location.href });
+    const [greeting, setGreeting] = useState(null);
+    const previousHref = useRef(href);
+    const name = auth ? displayName(auth) : "";
+    const userId = auth?.user?.id;
+    useEffect(() => {
+        if (previousHref.current !== href) {
+            previousHref.current = href;
+            setGreeting(null);
+        }
+    }, [href]);
+    useEffect(() => {
+        if (!userId || auth?.loading) {
+            setGreeting(null);
+            return;
+        }
+        const greet = () => {
+            const result = amsterdamGreeting(new Date(), name);
+            if (claimGreeting(userId, result.date, () => window.localStorage, seen)) {
+                setGreeting({ userId, text: result.text });
+            }
+            else {
+                // Profile data may arrive after session metadata; refresh only an
+                // already visible greeting, never resurrect one hidden by navigation.
+                setGreeting((current) => current?.userId === userId ? { userId, text: result.text } : current);
+            }
+        };
+        greet();
+        // Also cover an open tab crossing Amsterdam midnight.
+        const timer = window.setInterval(greet, 60000);
+        window.addEventListener("focus", greet);
+        return () => { window.clearInterval(timer); window.removeEventListener("focus", greet); };
+    }, [userId, auth?.loading, name]);
+    return greeting?.userId === userId ? greeting?.text ?? null : null;
+}

package/dist/components/ui/command.d.ts

@@ -6,7 +6,7 @@ declare const Command: React.ForwardRefExoticComponent<Omit<{
     ref?: React.Ref<HTMLDivElement>;
 } & {
     asChild?: boolean;
-}, "asChild" | "key" | keyof React.HTMLAttributes<HTMLDivElement>> & {
+}, "key" | "asChild" | keyof React.HTMLAttributes<HTMLDivElement>> & {
     label?: string;
     shouldFilter?: boolean;
     filter?: (value: string, search: string, keywords?: string[]) => number;
@@ -22,7 +22,7 @@ declare const CommandInput: React.ForwardRefExoticComponent<Omit<Omit<Pick<Pick<
     ref?: React.Ref<HTMLInputElement>;
 } & {
     asChild?: boolean;
-}, "asChild" | "key" | keyof React.InputHTMLAttributes<HTMLInputElement>>, "type" | "value" | "onChange"> & {
+}, "key" | "asChild" | keyof React.InputHTMLAttributes<HTMLInputElement>>, "type" | "value" | "onChange"> & {
     value?: string;
     onValueChange?: (search: string) => void;
 } & React.RefAttributes<HTMLInputElement>, "ref"> & React.RefAttributes<HTMLInputElement>>;
@@ -32,7 +32,7 @@ declare const CommandList: React.ForwardRefExoticComponent<Omit<{
     ref?: React.Ref<HTMLDivElement>;
 } & {
     asChild?: boolean;
-}, "asChild" | "key" | keyof React.HTMLAttributes<HTMLDivElement>> & {
+}, "key" | "asChild" | keyof React.HTMLAttributes<HTMLDivElement>> & {
     label?: string;
 } & React.RefAttributes<HTMLDivElement>, "ref"> & React.RefAttributes<HTMLDivElement>>;
 declare const CommandEmpty: React.ForwardRefExoticComponent<Omit<{
@@ -41,14 +41,14 @@ declare const CommandEmpty: React.ForwardRefExoticComponent<Omit<{
     ref?: React.Ref<HTMLDivElement>;
 } & {
     asChild?: boolean;
-}, "asChild" | "key" | keyof React.HTMLAttributes<HTMLDivElement>> & React.RefAttributes<HTMLDivElement>, "ref"> & React.RefAttributes<HTMLDivElement>>;
+}, "key" | "asChild" | keyof React.HTMLAttributes<HTMLDivElement>> & React.RefAttributes<HTMLDivElement>, "ref"> & React.RefAttributes<HTMLDivElement>>;
 declare const CommandGroup: React.ForwardRefExoticComponent<Omit<{
     children?: React.ReactNode;
 } & Omit<Pick<Pick<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, "key" | keyof React.HTMLAttributes<HTMLDivElement>> & {
     ref?: React.Ref<HTMLDivElement>;
 } & {
     asChild?: boolean;
-}, "asChild" | "key" | keyof React.HTMLAttributes<HTMLDivElement>>, "value" | "heading"> & {
+}, "key" | "asChild" | keyof React.HTMLAttributes<HTMLDivElement>>, "value" | "heading"> & {
     heading?: React.ReactNode;
     value?: string;
     forceMount?: boolean;
@@ -57,7 +57,7 @@ declare const CommandSeparator: React.ForwardRefExoticComponent<Omit<Pick<Pick<R
     ref?: React.Ref<HTMLDivElement>;
 } & {
     asChild?: boolean;
-}, "asChild" | "key" | keyof React.HTMLAttributes<HTMLDivElement>> & {
+}, "key" | "asChild" | keyof React.HTMLAttributes<HTMLDivElement>> & {
     alwaysRender?: boolean;
 } & React.RefAttributes<HTMLDivElement>, "ref"> & React.RefAttributes<HTMLDivElement>>;
 declare const CommandItem: React.ForwardRefExoticComponent<Omit<{
@@ -66,7 +66,7 @@ declare const CommandItem: React.ForwardRefExoticComponent<Omit<{
     ref?: React.Ref<HTMLDivElement>;
 } & {
     asChild?: boolean;
-}, "asChild" | "key" | keyof React.HTMLAttributes<HTMLDivElement>>, "disabled" | "value" | "onSelect"> & {
+}, "key" | "asChild" | keyof React.HTMLAttributes<HTMLDivElement>>, "disabled" | "value" | "onSelect"> & {
     disabled?: boolean;
     onSelect?: (value: string) => void;
     value?: string;

package/dist/server/index.d.ts

@@ -8,5 +8,5 @@ export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
 export type { HandoverExchangeHandlerOptions } from "./handover-handler.js";
 export type { PermissionLevel } from "./permissions.server.js";
-export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, ensureCronKeys, checkCronRequest, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -8,4 +8,4 @@ export { getRoleFlags } from "../auth/roles.js";
 export { handoverExchangeHandler, HANDOVER_MAX_BODY_BYTES, HANDOVER_MAX_CODE_LENGTH, } from "./handover-handler.js";
 // Shell-adres en Central-koppeling (alleen server; aangeroepen door de
 // door het dashboard gegenereerde globale request-middleware).
-export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";
+export { getShellBaseUrl, applyShellBaseUrl, ensureCentralLink, ensureCronKeys, checkCronRequest, runShellRuntime, normalizeShellBaseUrl, } from "./shell-runtime.js";

package/dist/server/shell-runtime.d.ts

@@ -13,12 +13,18 @@ export declare function getShellBaseUrl(): Promise<string | null>;
  */
 export declare function applyShellBaseUrl(): Promise<string | null>;
 /**
- * Hooguit eens per uur per isolate. Netwerkfout of ontbrekende RPC: niets
- * doen, waarschuwen, niet opnieuw tot het volgende uur.
+ * Na succes één uur wachten per isolate; na een fout vijf minuten.
  */
 export declare function ensureCentralLink(): Promise<void>;
-/** Voor de globale request-middleware van de shell. Gooit nooit. */
-export declare function runShellRuntime(): Promise<void>;
+/** Synchroniseert de shell-publishable key; uur na succes, vijf minuten na fout. */
+export declare function ensureCronKeys(): Promise<void>;
+/** Alleen geregistreerde cronpaden; alle lees-/runtimefouten laten door. */
+export declare function checkCronRequest(request: Request): Promise<Response | null>;
+/** Zonder context hetzelfde gedrag als voorheen. Alleen bewuste cronweigering geeft 401. */
+export declare function runShellRuntime(ctx?: {
+    request: Request;
+    pathname: string;
+}): Promise<Response | null>;
 /** Alleen voor tests. */
 export declare function __resetShellRuntimeForTests(): void;
 //# sourceMappingURL=shell-runtime.d.ts.map

package/dist/server/shell-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAwDA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AAyDD;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAevD;AAED,oEAAoE;AACpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAM1C"}
+{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAmHA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AA+DD;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAcvD;AA4BD,oFAAoF;AACpF,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAWpD;AAyFD,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuBjF;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,GAAG,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAU5G;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAW1C"}