@flowselections/floriday-authenticatie-module 1.0.41 → 1.0.43

package/dist-lib/lib/floriday.functions.js

@@ -79,8 +79,7 @@ function toPublic(row) {
         environment: row.environment,
         label: row.label ?? "",
         is_active: row.is_active,
-        has_credentials: Boolean(row.client_id && row.client_secret && row.api_key),
-        client_id_masked: mask(row.client_id, 4),
+        has_credentials: Boolean(row.api_key),
         api_key_masked: mask(row.api_key, 4),
         token_expires_at: row.token_expires_at,
         organization_name: row.organization_name ?? null,
@@ -390,14 +389,19 @@ export const forceRefreshFlorydayToken = createServerFn({ method: "POST" })
         .maybeSingle();
     return { ok: true, expires_at: log?.expires_at ?? null };
 });
+/**
+ * Slaat uitsluitend de Floriday API-sleutel (X-Api-Key) op. Client ID en
+ * Client Secret worden door Central Auth beheerd en mogen hier niet meer
+ * worden ingevoerd of opgeslagen.
+ */
 export const upsertFlorydayConnection = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
     .inputValidator((input) => {
     if (!["staging", "live"].includes(input.environment)) {
         throw new Error("Ongeldige environment");
     }
-    if (!input.client_id?.trim() || !input.client_secret?.trim() || !input.api_key?.trim()) {
-        throw new Error("Client ID, Client Secret en API Key zijn verplicht");
+    if (!input.api_key?.trim()) {
+        throw new Error("API-sleutel is verplicht");
     }
     return input;
 })
@@ -419,13 +423,8 @@ export const upsertFlorydayConnection = createServerFn({ method: "POST" })
         throw new Error(selectError.message);
     const payload = {
         label: data.label ?? "",
-        client_id: deepSanitizeCredential(data.client_id),
-        client_secret: deepSanitizeCredential(data.client_secret),
         api_key: deepSanitizeCredential(data.api_key),
         is_active: true,
-        // Oud access_token is ongeldig zodra credentials wijzigen.
-        access_token: null,
-        token_expires_at: null,
     };
     let inserted;
     if (existing?.id) {
@@ -537,6 +536,14 @@ export const deleteFlorydayConnection = createServerFn({ method: "POST" })
         throw new Error(error.message);
     return { ok: true };
 });
+/**
+ * Verbindingstest in drie zichtbare stappen:
+ *  1. token opgehaald bij Central Auth
+ *  2. API-sleutel aanwezig in deze module
+ *  3. echte Floriday-aanroep gelukt
+ * Fouten worden in gewone taal onderscheiden: Central Auth (geen koppeling
+ * voor deze omgeving) versus Floriday (API-sleutel ontbreekt of is ongeldig).
+ */
 export const testFlorydayConnection = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
     .inputValidator((input) => {
@@ -546,28 +553,76 @@ export const testFlorydayConnection = createServerFn({ method: "POST" })
     return input;
 })
     .handler(async ({ data, context }) => {
+    const steps = [];
+    const fail = (error) => ({ ok: false, error, steps });
+    // Stap 1 — token bij Central Auth.
     try {
-        // 1. Token-roundtrip (verifieert client_id + client_secret + Okta).
         await getFlorydayAccessToken(context.supabase, data.environment, { forceRefresh: true });
-        // 2. API-call met X-Api-Key (verifieert de api_key tegen Floriday-gateway).
+        steps.push({
+            key: "token",
+            label: "Token opgehaald bij Central Auth",
+            ok: true,
+            detail: "Central Auth gaf een geldig toegangstoken voor deze omgeving.",
+        });
+    }
+    catch (e) {
+        const msg = String(e?.message ?? e);
+        steps.push({
+            key: "token",
+            label: "Token opgehaald bij Central Auth",
+            ok: false,
+            detail: msg,
+        });
+        return fail(msg);
+    }
+    // Stap 2 — API-sleutel in deze module.
+    const row = await getActiveFlorydayCredentials(context.supabase, data.environment);
+    const apiKey = deepSanitizeCredential(row?.api_key);
+    if (!apiKey) {
+        const msg = "De Floriday API-sleutel ontbreekt voor deze omgeving. Vul de API-sleutel in en sla die op.";
+        steps.push({ key: "api_key", label: "API-sleutel aanwezig", ok: false, detail: msg });
+        return fail(msg);
+    }
+    steps.push({
+        key: "api_key",
+        label: "API-sleutel aanwezig",
+        ok: true,
+        detail: `Opgeslagen sleutel: ${mask(apiKey, 4)}`,
+    });
+    // Stap 3 — echte Floriday-aanroep.
+    try {
         const pingRes = await florydayFetch(context.supabase, data.environment, `/${SUPPLIERS_API_VERSION}/warehouses`, { cache: "no-store" });
         if (!pingRes.ok) {
             const body = await pingRes.text().catch(() => "");
-            return {
+            const msg = pingRes.status === 401 || pingRes.status === 403
+                ? `Floriday weigerde de aanvraag (${pingRes.status}). De API-sleutel ontbreekt of is ongeldig voor deze omgeving.`
+                : `Floriday API gaf ${pingRes.status}: ${body.slice(0, 200) || pingRes.statusText}`;
+            steps.push({
+                key: "api_call",
+                label: "Floriday-aanroep gelukt",
                 ok: false,
-                error: `Floriday API gaf ${pingRes.status}: ${body.slice(0, 200) || pingRes.statusText}`,
-            };
-        }
-        // 3. Organisatie-info ophalen (niet-fataal).
-        const row = await getActiveFlorydayCredentials(context.supabase, data.environment);
-        if (row) {
-            await fetchAndStoreFlorydayOrganizationName(context.supabase, data.environment, row.id);
+                detail: msg,
+            });
+            return fail(msg);
         }
-        return { ok: true };
+        steps.push({
+            key: "api_call",
+            label: "Floriday-aanroep gelukt",
+            ok: true,
+            detail: "Testaanroep op /warehouses is geslaagd.",
+        });
     }
     catch (e) {
-        return { ok: false, error: e?.message ?? "Onbekende fout" };
+        const msg = String(e?.message ?? e);
+        steps.push({ key: "api_call", label: "Floriday-aanroep gelukt", ok: false, detail: msg });
+        return fail(msg);
+    }
+    // Organisatie-info bijwerken (niet-fataal).
+    if (row) {
+        await fetchAndStoreFlorydayOrganizationName(context.supabase, data.environment, row.id)
+            .catch(() => null);
     }
+    return { ok: true, steps };
 });
 /**
  * Bepaalt de base-URL waar pg_cron de Lovable-app moet aanroepen.

package/dist-lib/lib/gateway/fulfillment-order-body.d.ts

@@ -1,5 +1,5 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
-export declare function deriveFulfillmentOrderId(deliveryOrderId: string): string;
+export declare function deriveFulfillmentOrderId(deliveryOrderId: string): Promise<string>;
 export declare function resolvePackageCount(req: any): number | null;
 export interface SkippedFulfillmentRequest {
     fulfillmentRequestId: string;
@@ -24,6 +24,32 @@ export type BuildFulfillmentOrderBodyResult = {
     /** false = tijdelijk (opnieuw proberen kan slagen na sync). */
     permanent: boolean;
 };
+/**
+ * Eén kar zoals ons systeem die intern heeft ingedeeld. Wordt 1-op-1 vertaald
+ * naar een `AddLoadCarrierConfiguration` uit het 2026v1-schema.
+ */
+export interface CartLoadCarrierInput {
+    /** Floriday `LoadCarrierType`; ontbreekt hij, dan die van de request. */
+    loadCarrierType?: string;
+    /** Ons interne karnummer/referentie. */
+    loadCarrierReference?: string;
+    loadCarrierBarcode?: string;
+    /** Aantal extra lagen op deze kar (default 0). */
+    numberOfAdditionalLayers?: number;
+    sortIndex?: number;
+    items: Array<{
+        fulfillmentRequestId: string;
+        /** Ontbreekt hij, dan uit de delivery-order-cache. */
+        numberOfPackages?: number;
+        sortIndex?: number;
+        serviceCode?: number;
+        deliveryRemarks?: string;
+        loadCarrierItemId?: string;
+        packingAgentOrganizationId?: string;
+        commercialInvoiceReference?: string;
+        alternativeDisplayName?: string;
+    }>;
+}
 export interface BuildFulfillmentOrderBodyInput {
     connectionId: string;
     deliveryOrderId: string;
@@ -31,6 +57,16 @@ export interface BuildFulfillmentOrderBodyInput {
     deliveryOrderData: any;
     /** Optionele filter op fulfillmentRequestId (gateway-pad). */
     fulfillmentRequestIds?: string[] | null;
+    /**
+     * Onze definitieve karrenindeling. Ontbreekt die, dan groeperen we (zoals
+     * voorheen) per `loadCarrier`-waarde van de fulfillmentRequests.
+     */
+    loadCarriers?: CartLoadCarrierInput[] | null;
+    /** Optionele schema-velden van `FulfillmentOrderCreate`. */
+    carrierOrganizationId?: string | null;
+    logisticHub?: string | null;
+    deliveryLocationGln?: string | null;
+    oneLabelOnly?: boolean;
 }
 export type FulfillmentDetectionSource = "delivery_order_claims" | "fulfillment_orders_cache";
 export type FulfillmentDetection = {

package/dist-lib/lib/gateway/fulfillment-order-body.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fulfillment-order-body.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/fulfillment-order-body.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAsC5D,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAExE;AAUD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAO3D;AAMD,MAAM,WAAW,yBAAyB;IACxC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,mBAAmB,GAAG,iBAAiB,CAAC;CACjD;AAED,MAAM,MAAM,+BAA+B,GACvC;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,yBAAyB,EAAE,CAAC;CACtC,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,yBAAyB,EAAE,CAAC;CACtC,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEN,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,iBAAiB,EAAE,GAAG,CAAC;IACvB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACzC;AAqBD,MAAM,MAAM,0BAA0B,GAClC,uBAAuB,GACvB,0BAA0B,CAAC;AAE/B,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,yBAAyB,EAAE,CAAC;CACtC,GACD;IACE,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAyC9B,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,GAAG,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACzC;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CA0D/B;AAOD,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,+BAA+B,CAAC,CA2N1C"}
+{"version":3,"file":"fulfillment-order-body.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/fulfillment-order-body.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAqD5D,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAWD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAO3D;AAMD,MAAM,WAAW,yBAAyB;IACxC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,mBAAmB,GAAG,iBAAiB,CAAC;CACjD;AAED,MAAM,MAAM,+BAA+B,GACvC;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,yBAAyB,EAAE,CAAC;CACtC,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,yBAAyB,EAAE,CAAC;CACtC,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;QACX,oBAAoB,EAAE,MAAM,CAAC;QAC7B,sDAAsD;QACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,0BAA0B,CAAC,EAAE,MAAM,CAAC;QACpC,0BAA0B,CAAC,EAAE,MAAM,CAAC;QACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,iBAAiB,EAAE,GAAG,CAAC;IACvB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,YAAY,CAAC,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC7C,4DAA4D;IAC5D,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAsBD,MAAM,MAAM,0BAA0B,GAClC,uBAAuB,GACvB,0BAA0B,CAAC;AAE/B,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,yBAAyB,EAAE,CAAC;CACtC,GACD;IACE,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAyC9B,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,GAAG,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACzC;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CA0D/B;AAOD,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,+BAA+B,CAAC,CAgR1C"}

package/dist-lib/lib/gateway/fulfillment-order-body.js

@@ -7,7 +7,6 @@
 // De body wordt volledig opgebouwd uit de delivery-order-cache plus een join
 // op de sales-order-cache; er wordt niets verzonnen. Ontbrekende gegevens
 // leiden tot een expliciete fout, nooit tot een stille aanname.
-import { createHash } from "node:crypto";
 // ---------------------------------------------------------------------------
 // fulfillmentOrderId — deterministische UUIDv5
 // ---------------------------------------------------------------------------
@@ -28,18 +27,30 @@ import { createHash } from "node:crypto";
 // worden uitgebreid met een discriminator én moet de gekozen waarde worden
 // vastgelegd, anders overschrijven de pushes elkaars identiteit.
 const FULFILLMENT_ORDER_NAMESPACE = "6f9a1e2c-7d34-4c1b-9a5e-3b8f0d2c4a71";
-function uuidV5(name, namespace) {
+// Web Crypto in plaats van node:crypto — dit bestand wordt ook client-side
+// gebundeld; Node-builtins bestaan daar niet.
+function toHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function uuidV5(name, namespace) {
     const hex = namespace.replace(/-/g, "");
     if (hex.length !== 32)
         throw new Error("Ongeldige namespace-GUID");
-    const nsBytes = Buffer.from(hex, "hex");
-    const hash = createHash("sha1")
-        .update(Buffer.concat([nsBytes, Buffer.from(name, "utf8")]))
-        .digest();
-    const bytes = Buffer.from(hash.subarray(0, 16));
+    const nsBytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i++) {
+        nsBytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    const nameBytes = new TextEncoder().encode(name);
+    const input = new Uint8Array(nsBytes.length + nameBytes.length);
+    input.set(nsBytes, 0);
+    input.set(nameBytes, nsBytes.length);
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-1", input));
+    const bytes = digest.slice(0, 16);
     bytes[6] = (bytes[6] & 0x0f) | 0x50; // versie 5
     bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant
-    const h = bytes.toString("hex");
+    const h = toHex(bytes);
     return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
 }
 export function deriveFulfillmentOrderId(deliveryOrderId) {
@@ -165,9 +176,22 @@ export async function buildFulfillmentOrderBody(supabase, input) {
             permanent: true,
         };
     }
-    const filterIds = Array.isArray(input.fulfillmentRequestIds)
+    // Onze eigen karrenindeling (optioneel). Is die er, dan bepalen de karren
+    // welke fulfillmentRequests meegaan.
+    const cartCarriers = Array.isArray(input.loadCarriers) && input.loadCarriers.length > 0
+        ? input.loadCarriers
+        : null;
+    const explicitIds = Array.isArray(input.fulfillmentRequestIds)
         ? input.fulfillmentRequestIds.map((s) => String(s))
         : null;
+    const cartIds = cartCarriers
+        ? Array.from(new Set(cartCarriers.flatMap((c) => (c.items ?? []).map((i) => String(i?.fulfillmentRequestId ?? ""))))).filter(Boolean)
+        : null;
+    const filterIds = cartIds
+        ? explicitIds
+            ? cartIds.filter((id) => explicitIds.includes(id))
+            : cartIds
+        : explicitIds;
     const skipped = [];
     const candidates = [];
     for (const r of allRequests) {
@@ -216,135 +240,171 @@ export async function buildFulfillmentOrderBody(supabase, input) {
             permanent: true,
         };
     }
-    // ─ Join: tradeItemId + organisatie-id's uit de sales-order-cache ─────────
-    const salesOrderIds = Array.from(new Set(candidates
-        .map((r) => (r?.salesOrderId ? String(r.salesOrderId) : ""))
-        .filter(Boolean)));
-    if (salesOrderIds.length === 0) {
-        return {
-            kind: "error",
-            error: "fulfillmentRequests zonder salesOrderId — tradeItemId niet te bepalen",
-            permanent: true,
-        };
-    }
-    const { data: soRows, error: soError } = await supabase
-        .from("floriday_salesorders_cache")
-        .select("floriday_id, data")
-        .eq("connection_id", connectionId)
-        .in("floriday_id", salesOrderIds);
-    if (soError) {
-        return {
-            kind: "error",
-            error: `Sales-orders lezen mislukt: ${soError.message}`,
-            permanent: false,
-        };
-    }
-    const soById = new Map();
-    for (const row of (soRows ?? [])) {
-        soById.set(String(row.floriday_id), row.data ?? {});
-    }
-    const missing = salesOrderIds.filter((id) => !soById.has(id));
-    if (missing.length > 0) {
-        return {
-            kind: "error",
-            error: `Sales-order(s) niet in cache — sync eerst: ${missing.join(", ")}`,
-            permanent: false,
-        };
-    }
-    const firstSo = soById.get(String(candidates[0].salesOrderId));
-    const supplierOrganizationId = firstSo?.supplierOrganizationId ?? null;
-    if (!supplierOrganizationId) {
-        return {
-            kind: "error",
-            error: "supplierOrganizationId ontbreekt op de gekoppelde sales-order",
-            permanent: false,
-        };
-    }
-    // ─ Groeperen per loadCarrier-waarde ──────────────────────────────────────
-    const groups = new Map();
+    // ─ Body opbouwen — uitsluitend velden uit `FulfillmentOrderCreate` ───────
+    //
+    // Toegestaan volgens Suppliers API 2026v1:
+    //   fulfillmentOrderId (verplicht), oneLabelOnly (verplicht),
+    //   loadCarriers (verplicht), carrierOrganizationId, logisticHub,
+    //   deliveryLocationGln.
+    // Per kar: loadCarrierType, numberOfAdditionalLayers, sortIndex (verplicht),
+    //   loadCarrierReference, loadCarrierBarcode, loadCarrierItems.
+    // Per item: fulfillmentRequestId, numberOfPackages (verplicht),
+    //   loadCarrierItemId, serviceCode, packingAgentOrganizationId, sortIndex,
+    //   deliveryRemarks, commercialInvoiceReference, alternativeDisplayName.
+    // Alles daarbuiten (type, organisatie-id's, despatchWarehouseId,
+    // destination, tradeItemId, salesOrderId) wordt door Floriday met een 400
+    // afgewezen en hoort hier dus NIET thuis.
+    const byRequestId = new Map();
     for (const r of candidates) {
-        const key = String(r.loadCarrier).trim();
-        const list = groups.get(key);
-        if (list)
-            list.push(r);
-        else
-            groups.set(key, [r]);
+        byRequestId.set(String(r?.fulfillmentRequestId ?? r?.id), r);
     }
     const usedRequestIds = [];
     const loadCarriers = [];
-    let carrierIndex = 0;
-    for (const [loadCarrierType, reqs] of groups) {
-        carrierIndex += 1;
-        const items = [];
-        let itemIndex = 0;
-        for (const r of reqs) {
-            const id = String(r?.fulfillmentRequestId ?? r?.id);
-            const count = resolvePackageCount(r);
-            if (count === null) {
+    const buildItem = (req, override, sortIndex) => {
+        const id = String(req?.fulfillmentRequestId ?? req?.id);
+        const count = override?.numberOfPackages && Number(override.numberOfPackages) > 0
+            ? Number(override.numberOfPackages)
+            : resolvePackageCount(req);
+        if (count === null) {
+            return {
+                error: `Aantal pakketten ontbreekt op fulfillmentRequest ${id}`,
+                permanent: true,
+            };
+        }
+        const item = {
+            fulfillmentRequestId: id,
+            numberOfPackages: count,
+            sortIndex: override?.sortIndex ?? sortIndex,
+        };
+        if (override?.loadCarrierItemId)
+            item.loadCarrierItemId = override.loadCarrierItemId;
+        if (override?.serviceCode !== undefined)
+            item.serviceCode = override.serviceCode;
+        if (override?.packingAgentOrganizationId) {
+            item.packingAgentOrganizationId = override.packingAgentOrganizationId;
+        }
+        const remarks = override?.deliveryRemarks ?? req?.deliveryRemarks;
+        if (remarks)
+            item.deliveryRemarks = remarks;
+        if (override?.commercialInvoiceReference) {
+            item.commercialInvoiceReference = override.commercialInvoiceReference;
+        }
+        if (override?.alternativeDisplayName) {
+            item.alternativeDisplayName = override.alternativeDisplayName;
+        }
+        usedRequestIds.push(id);
+        return { item };
+    };
+    if (cartCarriers) {
+        // ── Pad 1: onze eigen karrenindeling is leidend ────────────────────────
+        let carrierIndex = 0;
+        for (const cart of cartCarriers) {
+            carrierIndex += 1;
+            const items = [];
+            let itemIndex = 0;
+            let typeFromRequests = "";
+            for (const line of cart.items ?? []) {
+                const id = String(line?.fulfillmentRequestId ?? "").trim();
+                if (!id) {
+                    return {
+                        kind: "error",
+                        error: "Karregel zonder fulfillmentRequestId",
+                        permanent: true,
+                    };
+                }
+                const req = byRequestId.get(id);
+                if (!req) {
+                    const claimedHere = skipped.find((s) => s.fulfillmentRequestId === id);
+                    return {
+                        kind: "error",
+                        error: claimedHere
+                            ? `fulfillmentRequest ${id} is al geclaimd bij Floriday`
+                            : `fulfillmentRequest ${id} staat niet op delivery-order ${deliveryOrderId}`,
+                        permanent: true,
+                    };
+                }
+                itemIndex += 1;
+                const built = buildItem(req, line, itemIndex);
+                if ("error" in built) {
+                    return { kind: "error", error: built.error, permanent: built.permanent };
+                }
+                items.push(built.item);
+                if (!typeFromRequests)
+                    typeFromRequests = String(req?.loadCarrier ?? "").trim();
+            }
+            if (items.length === 0) {
                 return {
                     kind: "error",
-                    error: `Aantal pakketten ontbreekt op fulfillmentRequest ${id}`,
+                    error: `Kar ${cart.loadCarrierReference ?? carrierIndex} bevat geen regels`,
                     permanent: true,
                 };
             }
-            const so = soById.get(String(r.salesOrderId));
-            const tradeItemId = so?.tradeItemId ?? null;
-            if (!tradeItemId) {
+            const loadCarrierType = String(cart.loadCarrierType ?? typeFromRequests).trim();
+            if (!loadCarrierType || loadCarrierType === "NONE") {
                 return {
                     kind: "error",
-                    error: `tradeItemId ontbreekt op sales-order ${r.salesOrderId}`,
-                    permanent: false,
+                    error: `Kar ${cart.loadCarrierReference ?? carrierIndex} heeft geen bruikbaar loadCarrierType`,
+                    permanent: true,
                 };
             }
-            itemIndex += 1;
-            items.push({
-                sortIndex: itemIndex,
-                fulfillmentRequestId: id,
-                salesOrderId: String(r.salesOrderId),
-                tradeItemId,
-                numberOfPackages: count,
+            const carrier = {
+                sortIndex: cart.sortIndex ?? carrierIndex,
+                loadCarrierType,
+                numberOfAdditionalLayers: Number(cart.numberOfAdditionalLayers ?? 0),
+                loadCarrierItems: items,
+            };
+            if (cart.loadCarrierReference)
+                carrier.loadCarrierReference = cart.loadCarrierReference;
+            if (cart.loadCarrierBarcode)
+                carrier.loadCarrierBarcode = cart.loadCarrierBarcode;
+            loadCarriers.push(carrier);
+        }
+    }
+    else {
+        // ── Pad 2 (fallback): groeperen per loadCarrier-waarde van de requests ──
+        const groups = new Map();
+        for (const r of candidates) {
+            const key = String(r.loadCarrier).trim();
+            const list = groups.get(key);
+            if (list)
+                list.push(r);
+            else
+                groups.set(key, [r]);
+        }
+        let carrierIndex = 0;
+        for (const [loadCarrierType, reqs] of groups) {
+            carrierIndex += 1;
+            const items = [];
+            let itemIndex = 0;
+            for (const r of reqs) {
+                itemIndex += 1;
+                const built = buildItem(r, null, itemIndex);
+                if ("error" in built) {
+                    return { kind: "error", error: built.error, permanent: built.permanent };
+                }
+                items.push(built.item);
+            }
+            loadCarriers.push({
+                sortIndex: carrierIndex,
+                loadCarrierType,
+                numberOfAdditionalLayers: 0,
+                loadCarrierItems: items,
             });
-            usedRequestIds.push(id);
         }
-        loadCarriers.push({
-            sortIndex: carrierIndex,
-            loadCarrierType,
-            numberOfAdditionalLayers: 0,
-            loadCarrierItems: items,
-        });
     }
-    const fulfillmentOrderId = deriveFulfillmentOrderId(deliveryOrderId);
+    const fulfillmentOrderId = await deriveFulfillmentOrderId(deliveryOrderId);
     const body = {
-        type: "DIRECT_SALES",
         fulfillmentOrderId,
-        supplierOrganizationId,
-        fulfillingOrganizationId: supplierOrganizationId,
-        despatchWarehouseId: doData.despatchWarehouseId ?? null,
-        latestDeliveryDateTime: doData.deliveryDateTime ?? null,
-        oneLabelOnly: false,
-        destination: doData.destination ?? null,
+        oneLabelOnly: input.oneLabelOnly ?? false,
         loadCarriers,
     };
-    if (!body.despatchWarehouseId) {
-        return {
-            kind: "error",
-            error: "despatchWarehouseId ontbreekt in de delivery-order-cache",
-            permanent: false,
-        };
-    }
-    if (!body.latestDeliveryDateTime) {
-        return {
-            kind: "error",
-            error: "deliveryDateTime ontbreekt in de delivery-order-cache",
-            permanent: false,
-        };
-    }
-    if (!body.destination) {
-        return {
-            kind: "error",
-            error: "destination ontbreekt in de delivery-order-cache",
-            permanent: false,
-        };
-    }
+    const carrierOrganizationId = input.carrierOrganizationId ?? doData.carrierOrganizationId ?? null;
+    if (carrierOrganizationId)
+        body.carrierOrganizationId = carrierOrganizationId;
+    if (input.logisticHub)
+        body.logisticHub = input.logisticHub;
+    const gln = input.deliveryLocationGln ?? doData?.destination?.location?.gln ?? null;
+    if (gln)
+        body.deliveryLocationGln = gln;
     return { kind: "body", body, fulfillmentOrderId, usedRequestIds, skipped };
 }

package/dist-lib/lib/gateway/fulfillment-order-send.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fulfillment-order-send.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/fulfillment-order-send.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQ5D,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,0BAA0B,CAAC,CA0JrC;AAeD,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAmCnB"}
+{"version":3,"file":"fulfillment-order-send.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/fulfillment-order-send.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQ5D,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,0BAA0B,CAAC,CAiKrC;AAeD,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAmCnB"}

package/dist-lib/lib/gateway/fulfillment-order-send.js

@@ -84,6 +84,12 @@ export async function runFulfillmentOrderSend(supabase, body, caller) {
             deliveryOrderId,
             deliveryOrderData: doRow.data,
             fulfillmentRequestIds,
+            // Definitieve karrenindeling uit ons systeem (optioneel).
+            loadCarriers: Array.isArray(body?.loadCarriers) ? body.loadCarriers : null,
+            carrierOrganizationId: body?.carrierOrganizationId ?? null,
+            logisticHub: body?.logisticHub ?? null,
+            deliveryLocationGln: body?.deliveryLocationGln ?? null,
+            oneLabelOnly: Boolean(body?.oneLabelOnly),
         });
         if (built.kind === "already_fulfilled") {
             return {

package/dist-lib/lib/gateway/fulfillment-order-status.d.ts

@@ -0,0 +1,11 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+export interface FulfillmentOrderStatusResult {
+    status: number;
+    payload: unknown;
+}
+export declare function runFulfillmentOrderStatus(supabase: SupabaseClient, input: {
+    fulfillmentOrderId: string;
+    environment?: "staging" | "live";
+}): Promise<FulfillmentOrderStatusResult>;
+export declare function handleFulfillmentOrderStatus(request: Request, supabase: SupabaseClient): Promise<Response>;
+//# sourceMappingURL=fulfillment-order-status.d.ts.map

package/dist-lib/lib/gateway/fulfillment-order-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fulfillment-order-status.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/fulfillment-order-status.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAI5D,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,4BAA4B,CAAC,CA6CvC;AAcD,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAgCnB"}