@flowselections/core 1.0.31 → 1.0.33

package/dist/extensions/ShellExtensions.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useContext, useMemo } from "react";
-const ShellExtensionsContext = createContext({ transforms: [] });
+const ShellExtensionsContext = createContext({ transforms: [], startPaths: [] });
 const identityFooter = () => (items) => items;
 /** Sinds 1.0.23. Past de footer-transform toe; fout → ongewijzigd. Zichtbaarheid, geen beveiliging. */
 export function useFooterItems(base) {
@@ -20,13 +20,16 @@ export function useFooterItems(base) {
         return base;
     }
 }
-export function ShellExtensionsProvider({ useModuleList, guard, useFooter, children, }) {
+export function ShellExtensionsProvider({ useModuleList, guard, useFooter, useStartPath, children, }) {
     const transforms = useMemo(() => (Array.isArray(useModuleList) ? useModuleList : useModuleList ? [useModuleList] : []), 
     // Bewust op de referentie(s): de hooks moeten stabiel zijn, zodat de
     // hook-volgorde tussen renders nooit verandert.
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [useModuleList]);
-    const value = useMemo(() => ({ transforms, guard, useFooter }), [transforms, guard, useFooter]);
+    const startPaths = useMemo(() => (Array.isArray(useStartPath) ? useStartPath : useStartPath ? [useStartPath] : []), 
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [useStartPath]);
+    const value = useMemo(() => ({ transforms, startPaths, guard, useFooter }), [transforms, startPaths, guard, useFooter]);
     return _jsx(ShellExtensionsContext.Provider, { value: value, children: children });
 }
 export function useShellGuard() {
@@ -65,3 +68,24 @@ export function useModuleListTransform(modules, allModules = modules) {
     }
     return result;
 }
+/**
+ * Sinds 1.0.32. Roept de startpagina-hooks aan (vaste volgorde) en geeft hun
+ * resultaten terug, rol vóór shell. Een fout of ongeldige vorm telt als
+ * "geen voorkeur" (fail-open).
+ */
+export function useStartPathPreferences() {
+    const { startPaths } = useContext(ShellExtensionsContext);
+    const out = [];
+    for (const useStart of startPaths) {
+        try {
+            const r = useStart();
+            if (r && (r.bron === "rol" || r.bron === "shell")) {
+                out.push({ bron: r.bron, pad: typeof r.pad === "string" ? r.pad : null, laden: r.laden === true });
+            }
+        }
+        catch {
+            /* fail-open */
+        }
+    }
+    return [...out.filter((r) => r.bron === "rol"), ...out.filter((r) => r.bron === "shell")];
+}

package/dist/index.d.ts

@@ -45,8 +45,11 @@ export { useIsMobile } from "./hooks/use-mobile.js";
 export { useHuisstijl } from "./hooks/useHuisstijl.js";
 export type { FlowModule, NavItem, SettingsCard, FeatureDefinition } from "./types/module.js";
 export { moduleKey, navKey, featureKey, moduleFeatures } from "./types/module.js";
-export { ShellExtensionsProvider, useModuleListTransform, useFooterItems } from "./extensions/ShellExtensions.js";
-export type { ModuleListTransform, ModuleListTransformContext, UseModuleListTransform, ShellExtensionsProviderProps, FooterItems, FooterTransform, UseFooterTransform, } from "./extensions/ShellExtensions.js";
+export { ShellExtensionsProvider, useModuleListTransform, useFooterItems, useStartPathPreferences, } from "./extensions/ShellExtensions.js";
+export { StartPage } from "./components/layout/StartPage.js";
+export { modulePagePath, isPathActive, routeExists, pickStartPath, orderStartPreferences, getFailedStartPaths, START_PATH, } from "./navigation/start.js";
+export type { StartPathResult, StartPathSource, StartDecision, PickStartArgs } from "./navigation/start.js";
+export type { ModuleListTransform, ModuleListTransformContext, UseModuleListTransform, ShellExtensionsProviderProps, FooterItems, FooterTransform, UseFooterTransform, UseStartPath, } from "./extensions/ShellExtensions.js";
 export { ModuleGuardSlot } from "./extensions/ModuleGuardSlot.js";
 export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, useCan, Can, usePermissionFilteredModules, } from "./permissions/useModulePermission.js";
 export type { PermissionLevel, ModulePermissionRow, CanProps } from "./permissions/useModulePermission.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGtF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAChH,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGlF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAClH,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,4BAA4B,EAC5B,WAAW,EACX,eAAe,EACf,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,MAAM,EACN,GAAG,EACH,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGtF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAChH,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGlF,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC5G,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,4BAA4B,EAC5B,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,MAAM,EACN,GAAG,EACH,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -43,7 +43,9 @@ export { useIsMobile } from "./hooks/use-mobile.js";
 export { useHuisstijl } from "./hooks/useHuisstijl.js";
 export { moduleKey, navKey, featureKey, moduleFeatures } from "./types/module.js";
 // Shell-extensiepunten (allemaal optioneel; zonder provider ongewijzigd gedrag)
-export { ShellExtensionsProvider, useModuleListTransform, useFooterItems } from "./extensions/ShellExtensions.js";
+export { ShellExtensionsProvider, useModuleListTransform, useFooterItems, useStartPathPreferences, } from "./extensions/ShellExtensions.js";
+export { StartPage } from "./components/layout/StartPage.js";
+export { modulePagePath, isPathActive, routeExists, pickStartPath, orderStartPreferences, getFailedStartPaths, START_PATH, } from "./navigation/start.js";
 export { ModuleGuardSlot } from "./extensions/ModuleGuardSlot.js";
 // Rechten (leeskant; fail-open, zie README)
 export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, useCan, Can, usePermissionFilteredModules, } from "./permissions/useModulePermission.js";

package/dist/navigation/start.d.ts

@@ -0,0 +1,60 @@
+import type { FlowModule } from "../types/module.js";
+/** Standaardpad van de startpagina en de laatste terugval. */
+export declare const START_PATH = "/start";
+export declare const START_FALLBACK = "/instellingen";
+/**
+ * Sinds 1.0.32. Bestemming van een module: bij een groep de href van het
+ * eerste (na het rechtenfilter zichtbare) kind, anders `nav.href`.
+ * Core gebruikt `nav.href` van een groep nooit als bestemming.
+ */
+export declare function modulePagePath(mod: FlowModule): string;
+/** Actief als het pad gelijk is aan `href` of eronder valt. */
+export declare function isPathActive(pathname: string, href: string): boolean;
+type RouterLike = {
+    getMatchedRoutes?: (pathname: string, routePathname?: string) => unknown;
+};
+/**
+ * Sinds 1.0.32. Bestaat het pad als route (zonder te navigeren)? Een
+ * vangroute (root-splat) of alleen de root telt niet. Zonder router-API: `true`
+ * (fail-open).
+ */
+export declare function routeExists(router: RouterLike | null | undefined, path: string): boolean;
+export type StartPathSource = "rol" | "shell";
+export interface StartPathResult {
+    bron: StartPathSource;
+    pad: string | null;
+    laden: boolean;
+}
+/** Rol vóór shell; binnen dezelfde bron de registratievolgorde. */
+export declare function orderStartPreferences(results: StartPathResult[]): StartPathResult[];
+export interface PickStartArgs {
+    preferences: StartPathResult[];
+    /** Zichtbare modules in zijbalkvolgorde (na rechten en ordening). */
+    modules: FlowModule[];
+    failed?: string[];
+    canAccess: (path: string) => Promise<boolean> | boolean;
+    exists: (path: string) => boolean;
+}
+export interface StartDecision {
+    pad: string;
+    stap: "rol" | "shell" | "module" | "instellingen";
+}
+/**
+ * Sinds 1.0.32. Volgorde: rol → shell → eerste module → /instellingen.
+ * Een voorkeur telt alleen als hij bestaat, toegankelijk is en niet eerder in
+ * deze sessie mislukte.
+ */
+export declare function pickStartPath({ preferences, modules, failed, canAccess, exists }: PickStartArgs): Promise<StartDecision>;
+/** Paden die vanuit /start eerder een 404 of "Geen toegang" gaven. */
+export declare function getFailedStartPaths(): string[];
+/** /start zet dit vlak vóór het navigeren. */
+export declare function markStartNavigation(path: string): void;
+/**
+ * Afronding van een navigatie: alleen als hij vanuit /start kwam en op dit
+ * pad landde, wordt een mislukking onthouden. Andere 404's tellen niet.
+ */
+export declare function settleStartNavigation(path: string, failed: boolean): void;
+/** Alleen voor tests. */
+export declare function __resetStartGuard(): void;
+export {};
+//# sourceMappingURL=start.d.ts.map

package/dist/navigation/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/core/navigation/start.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,8DAA8D;AAC9D,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAGtD;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED,KAAK,UAAU,GAAG;IAChB,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;CAC1E,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAexF;AAID,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,OAAO,CAAC;AAC9C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,qEAAqE;IACrE,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAW,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBnI;AA8BD,sEAAsE;AACtE,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAED,8CAA8C;AAC9C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,QAE/C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,QAOlE;AAED,yBAAyB;AACzB,wBAAgB,iBAAiB,SAQhC"}

package/dist/navigation/start.js

@@ -0,0 +1,141 @@
+import { safeRedirectPath } from "../auth/redirect.js";
+/** Standaardpad van de startpagina en de laatste terugval. */
+export const START_PATH = "/start";
+export const START_FALLBACK = "/instellingen";
+/**
+ * Sinds 1.0.32. Bestemming van een module: bij een groep de href van het
+ * eerste (na het rechtenfilter zichtbare) kind, anders `nav.href`.
+ * Core gebruikt `nav.href` van een groep nooit als bestemming.
+ */
+export function modulePagePath(mod) {
+    const first = mod.nav.children?.[0];
+    return first ? first.href : mod.nav.href;
+}
+/** Actief als het pad gelijk is aan `href` of eronder valt. */
+export function isPathActive(pathname, href) {
+    if (!href)
+        return false;
+    if (pathname === href)
+        return true;
+    const base = href.endsWith("/") ? href.slice(0, -1) : href;
+    return base !== "" && pathname.startsWith(base + "/");
+}
+/**
+ * Sinds 1.0.32. Bestaat het pad als route (zonder te navigeren)? Een
+ * vangroute (root-splat) of alleen de root telt niet. Zonder router-API: `true`
+ * (fail-open).
+ */
+export function routeExists(router, path) {
+    if (!router || typeof router.getMatchedRoutes !== "function")
+        return true;
+    const pathname = path.split("?")[0].split("#")[0] || "/";
+    try {
+        // Oudere routerversies geven een object, nieuwere een tuple [routes, params, foundRoute].
+        const res = router.getMatchedRoutes(pathname, undefined);
+        const found = Array.isArray(res) ? res[2] : res?.foundRoute;
+        if (!found)
+            return false;
+        if (found.id === "__root__")
+            return false;
+        const full = found.fullPath ?? "";
+        if (full === "/$" || full === "$")
+            return false;
+        return true;
+    }
+    catch {
+        return true;
+    }
+}
+/** Rol vóór shell; binnen dezelfde bron de registratievolgorde. */
+export function orderStartPreferences(results) {
+    return [...results.filter((r) => r.bron === "rol"), ...results.filter((r) => r.bron === "shell")];
+}
+/**
+ * Sinds 1.0.32. Volgorde: rol → shell → eerste module → /instellingen.
+ * Een voorkeur telt alleen als hij bestaat, toegankelijk is en niet eerder in
+ * deze sessie mislukte.
+ */
+export async function pickStartPath({ preferences, modules, failed = [], canAccess, exists }) {
+    const skip = new Set(failed);
+    for (const pref of orderStartPreferences(preferences)) {
+        const pad = pref.pad ? safeRedirectPath(pref.pad, "") : "";
+        if (!pad || pad === START_PATH || skip.has(pad) || !exists(pad))
+            continue;
+        let ok = false;
+        try {
+            ok = await canAccess(pad);
+        }
+        catch {
+            ok = true;
+        }
+        if (ok)
+            return { pad, stap: pref.bron };
+    }
+    for (const mod of modules) {
+        const pad = modulePagePath(mod);
+        if (!pad || pad === START_PATH || skip.has(pad) || !exists(pad))
+            continue;
+        return { pad, stap: "module" };
+    }
+    return { pad: START_FALLBACK, stap: "instellingen" };
+}
+// ─── Bescherming tegen rondjes ───────────────────────────────────────────────
+const FAILED_KEY = "core:start:failed";
+let memoryFailed = [];
+let pending = null;
+function readFailed() {
+    try {
+        const raw = globalThis.sessionStorage?.getItem(FAILED_KEY);
+        if (raw) {
+            const list = JSON.parse(raw);
+            if (Array.isArray(list))
+                return list.filter((p) => typeof p === "string");
+        }
+    }
+    catch {
+        /* geen opslag */
+    }
+    return memoryFailed;
+}
+function writeFailed(list) {
+    memoryFailed = list;
+    try {
+        globalThis.sessionStorage?.setItem(FAILED_KEY, JSON.stringify(list));
+    }
+    catch {
+        /* geen opslag: alleen geheugen */
+    }
+}
+/** Paden die vanuit /start eerder een 404 of "Geen toegang" gaven. */
+export function getFailedStartPaths() {
+    return [...new Set([...readFailed(), ...memoryFailed])];
+}
+/** /start zet dit vlak vóór het navigeren. */
+export function markStartNavigation(path) {
+    pending = path;
+}
+/**
+ * Afronding van een navigatie: alleen als hij vanuit /start kwam en op dit
+ * pad landde, wordt een mislukking onthouden. Andere 404's tellen niet.
+ */
+export function settleStartNavigation(path, failed) {
+    if (pending === null || pending !== path)
+        return;
+    pending = null;
+    if (failed) {
+        const list = getFailedStartPaths();
+        if (!list.includes(path))
+            writeFailed([...list, path]);
+    }
+}
+/** Alleen voor tests. */
+export function __resetStartGuard() {
+    pending = null;
+    memoryFailed = [];
+    try {
+        globalThis.sessionStorage?.removeItem(FAILED_KEY);
+    }
+    catch {
+        /* */
+    }
+}

package/dist/routes/index.d.ts

@@ -1,19 +1,26 @@
 export interface SystemRouteOptions {
-    /** Pad als er geen geldig `?redirect` is (na inloggen, handover, reset). */
-    landing: string;
+    /**
+     * Pad als er geen geldig `?redirect` is (na inloggen, handover, reset).
+     * Sinds 1.0.32 optioneel: zonder → "/start" (startpagina per rol/shell).
+     */
+    landing?: string;
     /** Pad van de inlogpagina. Standaard "/login". */
     loginPath?: string;
 }
 export interface LoginSearch {
     redirect?: string;
 }
-/** `/login`: ingelogd → `?redirect` (alleen same-site) wint van `landing`. */
-export declare function loginRoute({ landing }: SystemRouteOptions): {
+/**
+ * `/login`: ingelogd → `?redirect` (alleen same-site) wint van `landing`.
+ * Zonder `landing` (sinds 1.0.32): `?redirect` alleen als die toegankelijk is
+ * (`canAccessModule`), anders "/start".
+ */
+export declare function loginRoute({ landing }?: SystemRouteOptions): {
     validateSearch: (search: Record<string, unknown>) => LoginSearch;
     beforeLoad: ({ context, search }: {
         context: unknown;
         search: LoginSearch;
-    }) => void;
+    }) => void | Promise<void>;
     head: () => {
         meta: ({
             title: string;
@@ -35,7 +42,7 @@ export declare function loginRoute({ landing }: SystemRouteOptions): {
     component: () => import("react/jsx-runtime").JSX.Element;
 };
 /** `/reset-wachtwoord`: de core-pagina, daarna naar `landing`. */
-export declare function resetPasswordRoute({ landing, loginPath }: SystemRouteOptions): {
+export declare function resetPasswordRoute({ landing, loginPath }?: SystemRouteOptions): {
     head: () => {
         meta: ({
             title: string;
@@ -57,7 +64,7 @@ export declare function resetPasswordRoute({ landing, loginPath }: SystemRouteOp
     component: () => import("react/jsx-runtime").JSX.Element;
 };
 /** `/`: redirect in beforeLoad, dus er wordt niets gerenderd (geen flits). */
-export declare function landingRoute({ landing }: Pick<SystemRouteOptions, "landing">): {
+export declare function landingRoute({ landing }?: Pick<SystemRouteOptions, "landing">): {
     head: () => {
         meta: ({
             title: string;
@@ -104,4 +111,30 @@ export declare function handoverRoute({ landing, loginPath, exchangePath, }: Sys
     };
     component: () => import("react/jsx-runtime").JSX.Element;
 };
+/**
+ * Sinds 1.0.32. `/start` onder `_authenticated` (door het dashboard
+ * gegenereerd): kiest rol → shell → eerste module → /instellingen.
+ */
+export declare function startRoute(): {
+    ssr: false;
+    head: () => {
+        meta: ({
+            title: string;
+            name?: undefined;
+            content?: undefined;
+            property?: undefined;
+        } | {
+            name: string;
+            content: string;
+            title?: undefined;
+            property?: undefined;
+        } | {
+            property: string;
+            content: string;
+            title?: undefined;
+            name?: undefined;
+        })[];
+    };
+    component: () => import("react/jsx-runtime").JSX.Element;
+};
 //# sourceMappingURL=index.d.ts.map

package/dist/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/routes/index.tsx"],"names":[],"mappings":"AA4BA,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,kBAAkB;6BAE7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,WAAW;sCAE5B;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;EAU9E;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,EAAE,OAAO,EAAE,SAAoB,EAAE,EAAE,kBAAkB;;;;;;;;;;;;;;;;;;;;EAOvF;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC;;;;;;;;;;;;;;;;;;;sBAGzD,KAAK;;EAOxB;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,EAC5B,OAAO,EACP,SAAoB,EACpB,YAAY,GACb,EAAE,kBAAkB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;EAQhD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/routes/index.tsx"],"names":[],"mappings":"AA8BA,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,EAAE,OAAO,EAAE,GAAE,kBAAuB;6BAElC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,WAAW;sCAE5B;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,KAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;EA0BrG;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,EAAE,OAAoB,EAAE,SAAoB,EAAE,GAAE,kBAAuB;;;;;;;;;;;;;;;;;;;;EAOzG;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,EAAE,OAAoB,EAAE,GAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAM;;;;;;;;;;;;;;;;;;;sBAG3E,KAAK;;EAOxB;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,EAC5B,OAAoB,EACpB,SAAoB,EACpB,YAAY,GACb,EAAE,kBAAkB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;EAQhD;AAED;;;GAGG;AACH,wBAAgB,UAAU;;;;;;;;;;;;;;;;;;;;;EAQzB"}

package/dist/routes/index.js

@@ -12,7 +12,9 @@ import { redirect } from "@tanstack/react-router";
 import { LoginPage } from "../components/layout/LoginPage.js";
 import { ResetWachtwoordPage } from "../components/layout/ResetWachtwoordPage.js";
 import { HandoverPage } from "../components/layout/HandoverPage.js";
-import { safeRedirectPath } from "../auth/redirect.js";
+import { StartPage } from "../components/layout/StartPage.js";
+import { canAccessModule, safeRedirectPath } from "../auth/redirect.js";
+import { START_PATH } from "../navigation/start.js";
 function pageHead(title, description) {
     return {
         meta: [
@@ -28,23 +30,42 @@ function pageHead(title, description) {
 function isAuthenticated(context) {
     return Boolean(context?.auth?.isAuthenticated);
 }
-/** `/login`: ingelogd → `?redirect` (alleen same-site) wint van `landing`. */
-export function loginRoute({ landing }) {
+/**
+ * `/login`: ingelogd → `?redirect` (alleen same-site) wint van `landing`.
+ * Zonder `landing` (sinds 1.0.32): `?redirect` alleen als die toegankelijk is
+ * (`canAccessModule`), anders "/start".
+ */
+export function loginRoute({ landing } = {}) {
     return {
         validateSearch: (search) => typeof search.redirect === "string" ? { redirect: search.redirect } : {},
         beforeLoad: ({ context, search }) => {
-            if (isAuthenticated(context)) {
+            if (!isAuthenticated(context))
+                return;
+            if (landing) {
                 throw redirect({ href: safeRedirectPath(search?.redirect, landing) });
             }
+            const target = safeRedirectPath(search?.redirect, START_PATH);
+            if (target === START_PATH)
+                throw redirect({ href: START_PATH });
+            const auth = context.auth;
+            return canAccessModule(target, {
+                userId: auth?.user?.id ?? null,
+                accessToken: auth?.session?.access_token ?? null,
+                roles: Array.isArray(auth?.roles) ? auth.roles : [],
+            }).then((ok) => {
+                throw redirect({ href: ok ? target : START_PATH });
+            }, () => {
+                throw redirect({ href: target });
+            });
         },
         head: () => pageHead("Inloggen | Flora Select", "Log veilig in bij Flora Select."),
         component: function LoginRouteComponent() {
-            return _jsx(LoginPage, { redirectTo: landing, routeHandlesRedirect: true });
+            return _jsx(LoginPage, { redirectTo: landing ?? START_PATH, routeHandlesRedirect: true });
         },
     };
 }
 /** `/reset-wachtwoord`: de core-pagina, daarna naar `landing`. */
-export function resetPasswordRoute({ landing, loginPath = "/login" }) {
+export function resetPasswordRoute({ landing = START_PATH, loginPath = "/login" } = {}) {
     return {
         head: () => pageHead("Nieuw wachtwoord | Flora Select", "Stel een nieuw wachtwoord in voor Flora Select."),
         component: function ResetPasswordRouteComponent() {
@@ -53,7 +74,7 @@ export function resetPasswordRoute({ landing, loginPath = "/login" }) {
     };
 }
 /** `/`: redirect in beforeLoad, dus er wordt niets gerenderd (geen flits). */
-export function landingRoute({ landing }) {
+export function landingRoute({ landing = START_PATH } = {}) {
     return {
         head: () => pageHead("Flora Select", "Open de Flora Select-omgeving."),
         beforeLoad: () => {
@@ -65,7 +86,7 @@ export function landingRoute({ landing }) {
     };
 }
 /** `/auth/handover`: client-only, want de sessie staat alleen in localStorage. */
-export function handoverRoute({ landing, loginPath = "/login", exchangePath, }) {
+export function handoverRoute({ landing = START_PATH, loginPath = "/login", exchangePath, }) {
     return {
         ssr: false,
         head: () => pageHead("Aanmelden | Flora Select", "Rond de veilige aanmelding bij Flora Select af."),
@@ -74,3 +95,16 @@ export function handoverRoute({ landing, loginPath = "/login", exchangePath, })
         },
     };
 }
+/**
+ * Sinds 1.0.32. `/start` onder `_authenticated` (door het dashboard
+ * gegenereerd): kiest rol → shell → eerste module → /instellingen.
+ */
+export function startRoute() {
+    return {
+        ssr: false,
+        head: () => pageHead("Start | Flora Select", "Je startpagina in Flora Select wordt geopend."),
+        component: function StartRouteComponent() {
+            return _jsx(StartPage, {});
+        },
+    };
+}

package/dist/server/shell-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAqEA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AA+DD;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvD;AA4BD,oFAAoF;AACpF,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAWpD;AAyFD,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuBjF;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,GAAG,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAU5G;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAW1C"}
+{"version":3,"file":"shell-runtime.d.ts","sourceRoot":"","sources":["../../src/core/server/shell-runtime.ts"],"names":[],"mappings":"AAmHA,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAmBD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhE;AA+DD;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAcvD;AA4BD,oFAAoF;AACpF,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAWpD;AAyFD,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuBjF;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,GAAG,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAU5G;AAED,yBAAyB;AACzB,wBAAgB,2BAA2B,SAW1C"}

package/dist/server/shell-runtime.js

@@ -56,12 +56,62 @@ async function timedFetch(url, init) {
     const ctrl = new AbortController();
     const t = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
     try {
-        return await fetch(url, { ...init, signal: ctrl.signal, redirect: "error" });
+        const response = await fetch(url, { ...init, signal: ctrl.signal, redirect: "manual" });
+        if ((response.status >= 300 && response.status <= 399) || response.type === "opaqueredirect") {
+            throw new Error(`onverwachte doorverwijzing (status ${response.status})`);
+        }
+        return response;
+    }
+    catch (error) {
+        // Transport errors can echo a URL or credential. Scrub outgoing values
+        // before propagating the error; never attach the request or response body.
+        const sensitive = [];
+        new Headers(init.headers).forEach((value) => sensitive.push(value));
+        if (typeof init.body === "string") {
+            sensitive.push(init.body);
+            try {
+                const collect = (value) => {
+                    if (typeof value === "string")
+                        sensitive.push(value);
+                    else if (Array.isArray(value))
+                        value.forEach(collect);
+                    else if (value && typeof value === "object")
+                        Object.values(value).forEach(collect);
+                };
+                collect(JSON.parse(init.body));
+            }
+            catch { /* No body content is logged. */ }
+        }
+        const detail = errorDetail(error, sensitive);
+        const sanitized = new Error(detail.message);
+        sanitized.name = detail.error;
+        throw sanitized;
     }
     finally {
         clearTimeout(t);
     }
 }
+/** Only bounded error name/message; never serialize an error's extra fields. */
+function errorDetail(error, sensitive = []) {
+    const redact = (text) => {
+        const values = [...sensitive,
+            process.env.SB_SERVICE_ROLE_KEY, process.env.CENTRAL_AUTH_SECRET,
+            process.env.SUPABASE_PUBLISHABLE_KEY, process.env.SUPABASE_ANON_KEY,
+            cronCache?.value?.secret,
+        ].filter((value) => typeof value === "string" && value.length > 0);
+        let result = text;
+        for (const value of values.sort((a, b) => b.length - a.length)) {
+            result = result.split(value).join("[redacted]");
+        }
+        return result.replace(/https?:\/\/[^\s"'<>]+/gi, "[url]")
+            .replace(/\b(?:sb_secret_|sb_publishable_)[\w-]+|\beyJ[\w-]*\.[\w-]+\.[\w-]+/g, "[redacted]")
+            .replace(/[\r\n\t]/g, " ").slice(0, 200);
+    };
+    return {
+        error: redact(error instanceof Error ? error.name : "UnknownError"),
+        message: redact(error instanceof Error ? error.message : "onbekende fout"),
+    };
+}
 /** Absolute https-origin zonder pad, of null. */
 export function normalizeShellBaseUrl(raw) {
     if (typeof raw !== "string" || !raw.trim())
@@ -109,9 +159,7 @@ export async function getShellBaseUrl() {
             return value;
         }
         catch (e) {
-            warn("read", "shell-adres lezen mislukt; laatst bekende waarde gebruikt", {
-                error: e instanceof Error ? e.message : "onbekend",
-            });
+            warn("read", "shell-adres lezen mislukt; laatst bekende waarde gebruikt", errorDetail(e));
             const last = baseUrlCache?.value ?? null;
             baseUrlCache = { value: last, at: Date.now() };
             return last;
@@ -213,9 +261,7 @@ export async function ensureCentralLink() {
         .then((ok) => { nextLinkCheck = Date.now() + (ok ? LINK_INTERVAL_MS : CRON_TTL_MS); })
         .catch((e) => {
         nextLinkCheck = Date.now() + CRON_TTL_MS;
-        warn("link-error", "Central-koppeling controleren mislukt", {
-            error: e instanceof Error ? e.name : "onbekend",
-        });
+        warn("link-error", "Central-koppeling controleren mislukt", errorDetail(e));
     })
         .finally(() => {
         linkInflight = null;
@@ -256,9 +302,9 @@ export async function ensureCronKeys() {
         return;
     cronKeyInflight = cronKeysOnce()
         .then((ok) => { nextCronKeyCheck = Date.now() + (ok ? LINK_INTERVAL_MS : CRON_TTL_MS); })
-        .catch(() => {
+        .catch((e) => {
         nextCronKeyCheck = Date.now() + CRON_TTL_MS;
-        warn("cron-key-error", "cronsleutel synchroniseren mislukt");
+        warn("cron-key-error", "cronsleutel synchroniseren mislukt", errorDetail(e));
     })
         .finally(() => { cronKeyInflight = null; });
     return cronKeyInflight;
@@ -327,8 +373,8 @@ async function getCronConfig(force = false, previous) {
         return cronCache.value;
     cronCache = null;
     cronInflight = readCronConfig()
-        .catch(() => {
-        warn("cron-error", "croncontrole lezen mislukt");
+        .catch((e) => {
+        warn("cron-error", "croncontrole lezen mislukt", errorDetail(e));
         return null;
     })
         .then((value) => {
@@ -376,8 +422,8 @@ export async function checkCronRequest(request) {
         });
         return null;
     }
-    catch {
-        warn("cron-check", "croncontrole mislukt; verzoek doorgelaten");
+    catch (e) {
+        warn("cron-check", "croncontrole mislukt; verzoek doorgelaten", errorDetail(e));
         return null;
     }
 }

package/dist/supabase/auth-middleware.d.ts

@@ -2,6 +2,36 @@ import type { Database } from './types.js';
 export declare const requireSupabaseAuth: import("@tanstack/start-client-core").FunctionMiddlewareAfterServer<{}, unknown, undefined, {
     supabase: import("@supabase/supabase-js").SupabaseClient<Database, "public", "public", {
         Tables: {
+            roles: {
+                Row: {
+                    id: string;
+                    key: string;
+                    name: string;
+                    is_protected: boolean;
+                    created_at: string;
+                    updated_at: string;
+                    permissions_initialized: boolean;
+                };
+                Insert: {
+                    id?: string;
+                    key: string;
+                    name: string;
+                    is_protected?: boolean;
+                    created_at?: string;
+                    updated_at?: string;
+                    permissions_initialized?: boolean;
+                };
+                Update: {
+                    id?: string;
+                    key?: string;
+                    name?: string;
+                    is_protected?: boolean;
+                    created_at?: string;
+                    updated_at?: string;
+                    permissions_initialized?: boolean;
+                };
+                Relationships: [];
+            };
             bugs: {
                 Row: {
                     attachment_url: string | null;