@flowselections/floriday-authenticatie-module 1.0.58 → 1.0.62

package/dist-lib/lib/floriday.functions.js

@@ -999,25 +999,48 @@ export async function resolveVerifiedFlorydayCronUrl(path) {
  * Deze functie schrijft die waarde bij elke cron-ronde opnieuw, zodat hij
  * meebeweegt met de omgeving en nooit handmatig gezet hoeft te worden.
  */
+const shellSkipLogged = new Map();
+async function reportShellHostSkip(reason) {
+    console.warn(`[floriday] shell-host niet geschreven: ${reason}`);
+    const now = Date.now();
+    if ((shellSkipLogged.get(reason) ?? 0) > now - 60 * 60 * 1000)
+        return;
+    shellSkipLogged.set(reason, now);
+    try {
+        const { supabaseAdmin } = await import("../integrations/supabase/client.server.js");
+        const db = supabaseAdmin;
+        const since = new Date(now - 60 * 60 * 1000).toISOString();
+        const { data: recent } = await db.from("floriday_write_log").select("id")
+            .eq("action", "shell-host-skipped").eq("error", reason).gte("created_at", since).limit(1);
+        if (recent && recent.length)
+            return;
+        await db.from("floriday_write_log").insert({
+            connection_id: null, module: "floriday-authenticatie", action: "shell-host-skipped",
+            resource: "module_runtime_config", floriday_id: null, request: null, response: null,
+            http_status: 0, ok: false, error: reason, idempotency_key: null, caller: "shell-host-sync",
+        });
+    }
+    catch { /* melden is best-effort */ }
+}
 export async function syncShellHostRuntimeConfig() {
-    let base = null;
+    // Geen project/env-fallback: alleen de actieve tenant-host uit Central Auth.
+    let raw = null;
     try {
-        // Geen project/env-fallback: alleen de actieve tenant-host uit Central
-        // Auth mag deze waarden bepalen.
         const { getShellHostFromCentral } = await import("./central-auth.server.js");
-        const { normalizeShellBase } = await import("./shell-base.js");
-        const raw = await getShellHostFromCentral();
-        if (!raw)
-            return { base: null, changed: false, skipped: "Central Auth gaf geen shell-host" };
-        base = normalizeShellBase(raw);
-        if (!base) {
-            console.warn(`[floriday] shell-host uit Central Auth afgewezen (ongeldig): ${String(raw).slice(0, 120)}`);
-            return { base: null, changed: false, skipped: "ongeldige shell-host" };
-        }
+        raw = await getShellHostFromCentral();
     }
     catch {
+        await reportShellHostSkip("Central Auth niet bereikbaar");
         return { base: null, changed: false, skipped: "Central Auth niet bereikbaar" };
     }
+    const { decideShellBaseWrites, normalizeShellBase } = await import("./shell-base.js");
+    const pre = decideShellBaseWrites(raw, {}, false);
+    if (!pre.ok) {
+        await reportShellHostSkip(pre.reason === "ongeldige shell-host"
+            ? `ongeldige shell-host uit Central Auth: ${String(raw).slice(0, 120)}` : pre.reason);
+        return { base: null, changed: false, skipped: pre.reason };
+    }
+    const base = normalizeShellBase(raw);
     try {
         const { supabaseAdmin } = await import("../integrations/supabase/client.server.js");
         const db = supabaseAdmin;
@@ -1026,48 +1049,41 @@ export async function syncShellHostRuntimeConfig() {
             .select("key, value")
             .in("key", ["stock_queue_processor_base_url", "shell_base_url"]);
         const cur = new Map((rows ?? []).map((r) => [r.key, r.value]));
-        const stockSame = cur.get("stock_queue_processor_base_url") === base;
-        const shellSame = cur.get("shell_base_url") === base;
-        if (stockSame && shellSame)
-            return { base, changed: false, shellBaseChanged: false };
-        // Alleen schrijven als dit adres deze module aantoonbaar bedient.
-        const pingErr = await checkShellServesCronRoute(base, "/api/public/cron/ping");
-        if (pingErr) {
-            console.warn(`[floriday] shell-host ${base} niet geschreven: ${pingErr}`);
-            return { base, changed: false, skipped: pingErr };
-        }
+        const current = { shell: cur.get("shell_base_url") ?? null, stock: cur.get("stock_queue_processor_base_url") ?? null };
+        // Ping alleen nodig voor de verwerker-sleutel.
+        let pingErr = null;
+        if (current.stock !== base)
+            pingErr = await checkShellServesCronRoute(base, "/api/public/cron/ping");
+        const d = decideShellBaseWrites(raw, current, !pingErr);
+        if (!d.ok)
+            return { base: null, changed: false, skipped: d.reason };
         const now = new Date().toISOString();
-        let shellBaseChanged = false;
-        if (!shellSame) {
-            const previous = cur.get("shell_base_url") ?? null;
-            if (previous) {
-                await db.from("module_runtime_config").upsert({ key: "shell_base_url_previous", value: previous, updated_at: now }, { onConflict: "key" });
+        if (d.writeShell) {
+            if (d.previous) {
+                await db.from("module_runtime_config").upsert({ key: "shell_base_url_previous", value: d.previous, updated_at: now }, { onConflict: "key" });
             }
-            await db.from("module_runtime_config").upsert({ key: "shell_base_url", value: base, updated_at: now }, { onConflict: "key" });
-            shellBaseChanged = true;
+            const { error } = await db.from("module_runtime_config").upsert({ key: "shell_base_url", value: base, updated_at: now }, { onConflict: "key" });
+            if (error)
+                throw new Error(error.message);
             await db.from("floriday_write_log").insert({
-                connection_id: null,
-                module: "floriday-authenticatie",
-                action: "shell-host-changed",
-                resource: "module_runtime_config",
-                floriday_id: null,
-                request: { key: "shell_base_url", from: previous, to: base },
-                response: null,
-                http_status: 0,
-                ok: true,
-                error: `shell-host gewijzigd van ${previous ?? "(leeg)"} naar ${base}`,
-                idempotency_key: null,
-                caller: "shell-host-sync",
+                connection_id: null, module: "floriday-authenticatie", action: "shell-host-changed",
+                resource: "module_runtime_config", floriday_id: null,
+                request: { key: "shell_base_url", from: d.previous, to: base }, response: null,
+                http_status: 0, ok: true,
+                error: `shell-host gewijzigd van ${d.previous ?? "(leeg)"} naar ${base}`,
+                idempotency_key: null, caller: "shell-host-sync",
             }).then(() => undefined, () => undefined);
         }
-        if (!stockSame) {
+        if (d.writeStock) {
             await db.from("module_runtime_config").upsert({ key: "stock_queue_processor_base_url", value: base, updated_at: now }, { onConflict: "key" });
         }
-        console.log(`[floriday] shell-host bijgewerkt naar ${base}`);
-        return { base, changed: !stockSame, shellBaseChanged };
+        else if (pingErr) {
+            await reportShellHostSkip(`stock_queue_processor_base_url niet bijgewerkt: ${pingErr}`);
+        }
+        return { base, changed: d.writeStock, shellBaseChanged: d.writeShell, skipped: pingErr ?? undefined };
     }
     catch (e) {
-        console.warn(`[floriday] shell-host synchroniseren mislukt: ${e?.message ?? e}`);
+        await reportShellHostSkip(`shell-host synchroniseren mislukt: ${e?.message ?? e}`);
         return { base, changed: false };
     }
 }

package/dist-lib/lib/gateway/supply-line.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supply-line.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/supply-line.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAiH5D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD,OAAO,CAAC,gBAAgB,CAAC,CAmK3B;AAcD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}
+{"version":3,"file":"supply-line.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/supply-line.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA6G5D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD,OAAO,CAAC,gBAAgB,CAAC,CAqP3B;AAcD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}

package/dist-lib/lib/gateway/supply-line.js

@@ -2,6 +2,7 @@
 // Spiegel van src/routes/api/public/gateway/supply-line.ts.
 import { resolveGatewayEnvironment } from "./shared.js";
 import { florydayWrite, getActiveFlorydayCredentials } from "../floriday.functions.js";
+import { classifyWeek, interpretPutFailure, isoWeekAmsterdam, isRetryableStatus, planBaseSupply, toProblem, PRICE_LOCKED_MESSAGE, WEEK_IN_PAST_MESSAGE, } from "../base-supply-decision.js";
 function pickNumber(...vals) {
     for (const v of vals) {
         if (typeof v === "number" && isFinite(v))
@@ -20,13 +21,6 @@ function pickString(...vals) {
             return v.trim();
     return undefined;
 }
-function weekOfYear(date = new Date()) {
-    const d = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
-    d.setUTCDate(d.getUTCDate() + 4 - (d.getUTCDay() || 7));
-    const yearStart = new Date(Date.UTC(d.getUTCFullYear(), 0, 1));
-    const week = Math.ceil(((d.getTime() - yearStart.getTime()) / 86400000 + 1) / 7);
-    return { year: d.getUTCFullYear(), week };
-}
 function defaultPeriod() {
     const start = new Date();
     start.setUTCHours(0, 0, 0, 0);
@@ -136,23 +130,131 @@ export async function runSupplyLine(supabase, input) {
         if (supplyType === "CATALOG_PRICE") {
             const explicitYear = pickNumber(raw.year, raw?.tradePeriod?.year);
             const explicitWeek = pickNumber(raw.week, raw?.tradePeriod?.week);
-            const computed = weekOfYear(pickString(raw.periodStart, raw?.supplyPeriod?.periodStart) ? new Date(pickString(raw.periodStart, raw?.supplyPeriod?.periodStart)) : new Date());
+            const ps = pickString(raw.periodStart, raw?.supplyPeriod?.periodStart);
+            const computed = isoWeekAmsterdam(ps ? new Date(ps) : new Date());
             const year = Math.trunc(explicitYear ?? computed.year);
             const week = Math.trunc(explicitWeek ?? computed.week);
-            const baseSupplyBody = {
-                basePricePerPiece: { value: pricePerPiece, currency },
-                numberOfPieces: Math.max(0, Math.trunc(availableQuantity)),
+            const pieces = Math.max(0, Math.trunc(availableQuantity));
+            const baseSupplyBody = { basePricePerPiece: { value: pricePerPiece, currency }, numberOfPieces: pieces };
+            const now = isoWeekAmsterdam();
+            const weekClass = classifyWeek({ year, week }, now);
+            const tiPath = `/trade-items/${encodeURIComponent(tradeItemId)}/base-supply/${year}/${week}`;
+            const respond = (status, body) => ({
+                status,
+                payload: {
+                    environment, endpointFamily: "weekly-base-supply", tradeItemId, supplyLineId: null, year, week,
+                    currentWeek: now, ...body,
+                },
+            });
+            if (weekClass === "invalid") {
+                return respond(400, { ok: false, outcome: "error", quantitySent: false, priceStatus: "not_sent",
+                    reason: "invalid_week", retryable: false, floriday: null, error: `Ongeldige ISO-week ${year}-${week}` });
+            }
+            if (weekClass === "past") {
+                return respond(409, { ok: false, outcome: "week_in_past", quantitySent: false, priceStatus: "not_sent",
+                    reason: "week_in_past", retryable: false, floriday: null, error: WEEK_IN_PAST_MESSAGE });
+            }
+            const readExisting = async () => {
+                const { florydayFetch, SUPPLIERS_API_VERSION } = await import("../floriday.functions.js");
+                try {
+                    const r = await florydayFetch(supabase, environment, `/${SUPPLIERS_API_VERSION}/trade-items/base-supply?year=${year}&week=${week}`, { method: "GET" });
+                    if (!r.ok)
+                        return { ok: false, status: r.status, item: null };
+                    const list = await r.json().catch(() => []);
+                    const item = Array.isArray(list) ? list.find((x) => x?.tradeItemId === tradeItemId) ?? null : null;
+                    return { ok: true, status: r.status, item };
+                }
+                catch {
+                    return { ok: false, status: 0, item: null };
+                }
             };
-            const baseResult = await florydayWrite(supabase, environment, {
+            const patchQuantity = () => florydayWrite(supabase, environment, {
                 module: "catalog",
-                action: "upsert-weekly-base-supply",
-                method: "PUT",
-                path: `/trade-items/${encodeURIComponent(tradeItemId)}/base-supply/${year}/${week}`,
+                action: "patch-weekly-base-supply",
+                method: "PATCH",
+                path: `${tiPath}?numberOfPieces=${pieces}`,
                 referenceId: tradeItemId,
-                body: baseSupplyBody,
                 caller,
-                idempotencyKey: `weekly-base-supply:${environment}:${tradeItemId}:${year}:${week}:${pricePerPiece}:${availableQuantity}`,
+                idempotencyKey: `weekly-base-supply-patch:${environment}:${tradeItemId}:${year}:${week}:${pieces}`,
             });
+            const existing = await readExisting();
+            if (!existing.ok) {
+                return respond(isRetryableStatus(existing.status) ? 503 : existing.status || 502, {
+                    ok: false, outcome: "error", quantitySent: false, priceStatus: "not_sent",
+                    reason: "base_supply_read_failed", retryable: isRetryableStatus(existing.status),
+                    floriday: { status: existing.status, domainErrorCode: null, title: null, detail: null },
+                    error: `Weekaanbod lezen mislukt (HTTP ${existing.status})`,
+                });
+            }
+            let step = planBaseSupply(weekClass, existing.item, pricePerPiece);
+            let outcome = "quantity_updated";
+            let priceStatus = "not_sent";
+            let reason = null;
+            let problem = null;
+            let baseResult = null;
+            if (step.kind === "put") {
+                baseResult = await florydayWrite(supabase, environment, {
+                    module: "catalog",
+                    action: "upsert-weekly-base-supply",
+                    method: "PUT",
+                    path: tiPath,
+                    referenceId: tradeItemId,
+                    body: baseSupplyBody,
+                    caller,
+                    idempotencyKey: `weekly-base-supply:${environment}:${tradeItemId}:${year}:${week}:${pricePerPiece}:${pieces}`,
+                });
+                if (baseResult.ok) {
+                    outcome = existing.item ? "price_updated" : "created";
+                    priceStatus = "sent";
+                }
+                else {
+                    problem = toProblem(baseResult.status, baseResult.data);
+                    const f = interpretPutFailure(weekClass, problem);
+                    if (f.kind === "week_in_past") {
+                        return respond(409, { ok: false, outcome: "week_in_past", quantitySent: false, priceStatus: "not_sent",
+                            reason: "week_in_past", retryable: false, floriday: problem, error: WEEK_IN_PAST_MESSAGE, attemptId: baseResult.attemptId });
+                    }
+                    if (f.kind === "price_locked_current_week") {
+                        step = { kind: "patch", priceStatus: "price_locked_current_week" };
+                        reason = "price_locked_current_week";
+                    }
+                    else if (f.kind === "recheck") {
+                        const again = await readExisting();
+                        if (again.ok && again.item) {
+                            outcome = "already_exists";
+                            reason = "already_exists";
+                            step = planBaseSupply(weekClass, again.item, pricePerPiece).kind === "patch"
+                                ? planBaseSupply(weekClass, again.item, pricePerPiece)
+                                : { kind: "patch", priceStatus: weekClass === "current" ? "price_locked_current_week" : "unchanged" };
+                        }
+                        else {
+                            return respond(problem.status || 500, { ok: false, outcome: "error", quantitySent: false, priceStatus: "not_sent",
+                                reason: problem.domainErrorCode ?? `http_${problem.status}`, retryable: false, floriday: problem,
+                                error: problem.title ?? baseResult.error, attemptId: baseResult.attemptId });
+                        }
+                    }
+                    else {
+                        return respond(f.retryable ? 503 : problem.status || 500, { ok: false, outcome: "error", quantitySent: false, priceStatus: "not_sent",
+                            reason: problem.domainErrorCode ?? `http_${problem.status}`, retryable: f.retryable, floriday: problem,
+                            error: problem.title ?? baseResult.error, attemptId: baseResult.attemptId });
+                    }
+                }
+            }
+            if (step.kind === "patch") {
+                priceStatus = step.priceStatus;
+                if (step.priceStatus === "price_locked_current_week")
+                    reason = reason === "already_exists" ? "already_exists" : "price_locked_current_week";
+                const patchResult = await patchQuantity();
+                if (!patchResult.ok) {
+                    const pp = toProblem(patchResult.status, patchResult.data);
+                    return respond(isRetryableStatus(pp.status) ? 503 : pp.status || 500, { ok: false, outcome: "error", quantitySent: false, priceStatus,
+                        reason: pp.status === 404 ? "base_supply_not_found" : pp.domainErrorCode ?? `http_${pp.status}`,
+                        retryable: isRetryableStatus(pp.status), floriday: pp, error: pp.title ?? patchResult.error, attemptId: patchResult.attemptId });
+                }
+                if (outcome !== "already_exists")
+                    outcome = "quantity_updated";
+                baseResult = patchResult;
+            }
             let availabilityResult = null;
             if (raw.usesCatalogAvailability !== false) {
                 availabilityResult = await florydayWrite(supabase, environment, {
@@ -166,56 +268,31 @@ export async function runSupplyLine(supabase, input) {
                 });
             }
             await persistSupplyMapping(supabase, {
-                connection_id: conn.id,
-                user_id: userId,
-                environment,
-                trade_item_id: tradeItemId,
-                supply_type: supplyType,
-                endpoint_family: "weekly-base-supply",
-                supply_line_id: null,
-                year,
-                week,
-                price_per_piece: pricePerPiece,
-                available_quantity: availableQuantity,
-                currency,
-                sales_unit: salesUnit,
-                last_status: baseResult.status,
-                last_error: baseResult.error ?? null,
-                updated_at: new Date().toISOString(),
+                connection_id: conn.id, user_id: userId, environment, trade_item_id: tradeItemId, supply_type: supplyType,
+                endpoint_family: "weekly-base-supply", supply_line_id: null, year, week, price_per_piece: pricePerPiece,
+                available_quantity: availableQuantity, currency, sales_unit: salesUnit, last_status: baseResult.status,
+                last_error: reason, updated_at: new Date().toISOString(),
             });
             await logGatewayStep(supabase, {
-                action: "supply-line-resolved",
-                ok: baseResult.ok,
+                action: "supply-line-resolved", ok: true, status: baseResult.status, caller, connection_id: conn.id,
+                environment, tradeItemId, endpoint: tiPath, mapping: { endpoint_family: "weekly-base-supply", year, week, outcome, priceStatus, reason },
+                payload: baseSupplyBody, error: reason,
+            });
+            return respond(200, {
+                ok: !availabilityResult || availabilityResult.ok,
                 status: baseResult.status,
-                caller,
-                connection_id: conn.id,
-                environment,
-                tradeItemId,
-                oldEndpoint: "/supply-lines/{id}",
-                endpoint: `/trade-items/${tradeItemId}/base-supply/${year}/${week}`,
-                oldSupplyLineId: pickString(raw.supplyLineId, raw.id) ?? null,
-                newSupplyLineId: null,
-                mapping: { endpoint_family: "weekly-base-supply", year, week },
-                payload: baseSupplyBody,
-                error: baseResult.error ?? null,
+                outcome,
+                quantitySent: true,
+                priceStatus,
+                reason,
+                message: priceStatus === "price_locked_current_week" ? PRICE_LOCKED_MESSAGE : null,
+                retryable: false,
+                floriday: problem,
+                attemptId: baseResult.attemptId,
+                availabilityAttemptId: availabilityResult?.attemptId ?? null,
+                availabilitySent: availabilityResult ? availabilityResult.ok : null,
+                error: availabilityResult && !availabilityResult.ok ? availabilityResult.error : null,
             });
-            return {
-                status: baseResult.ok ? 200 : baseResult.status || 500,
-                payload: {
-                    ok: baseResult.ok && (!availabilityResult || availabilityResult.ok),
-                    status: baseResult.status,
-                    environment,
-                    endpointFamily: "weekly-base-supply",
-                    tradeItemId,
-                    supplyLineId: null,
-                    year,
-                    week,
-                    attemptId: baseResult.attemptId,
-                    availabilityAttemptId: availabilityResult?.attemptId ?? null,
-                    error: baseResult.error ?? availabilityResult?.error,
-                    data: { baseSupply: baseResult.data, customerOfferAvailability: availabilityResult?.data ?? null },
-                },
-            };
         }
         // Batch-prijs blijft volgens 2026v1 via POST /supply-lines lopen.
         const period = defaultPeriod();

package/dist-lib/lib/gateway/webhook-subscribe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-subscribe.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/webhook-subscribe.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,KAAK,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;AAM9B,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;CACtE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUvH;AAQD,iFAAiF;AACjF,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBnF;AAuBD,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrG,OAAO,CAAC,YAAY,CAAC,CA2GvB;AA6BD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,cAAc;iBAKlC,MAAM;qBAc3C;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBhH"}
+{"version":3,"file":"webhook-subscribe.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/webhook-subscribe.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,KAAK,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;AAM9B,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;CACtE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUvH;AAiBD,iFAAiF;AACjF,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBnF;AAuBD,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrG,OAAO,CAAC,YAAY,CAAC,CAmHvB;AA6BD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,cAAc;iBAKlC,MAAM;qBAc3C;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBhH"}

package/dist-lib/lib/gateway/webhook-subscribe.js

@@ -34,10 +34,21 @@ function confirmedBase(existing) {
         return null;
     }
 }
+async function readShellBase(sb) {
+    try {
+        const { data } = await sb.from("module_runtime_config").select("value").eq("key", "shell_base_url").maybeSingle();
+        const { normalizeShellBase } = await import("../shell-base.js");
+        const v = data?.value;
+        return normalizeShellBase(typeof v === "string" ? v : v?.url ?? null);
+    }
+    catch {
+        return null;
+    }
+}
 /** Slaagt alleen als het adres onze eigen webhookroute is (404 + {ok:false}). */
 export async function probeWebhookCallbackBase(base) {
     try {
-        const res = await fetch(`${base}/api/public/gateway/webhook/${"0".repeat(64)}`, {
+        const res = await fetch(`${base}/api/public/gateway/webhook-in?t=${"0".repeat(64)}`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: "{}",
@@ -82,8 +93,17 @@ export async function ensureFloridayWebhookSubscription(supabase, environment, o
         return { ok: false, action: "skipped", reason: `Geen actieve koppeling voor ${environment}` };
     const now = Date.now();
     const { data: existing } = await sb.from(TABLE).select("*").eq("connection_id", conn.id).maybeSingle();
-    const base = opts.callbackBase ?? confirmedBase(existing);
-    if (!opts.force && existing) {
+    // Voorkeur: de eigen Shell (shell_base_url), maar alleen als de probe
+    // bewijst dat de Shell onze webhookroute bedient. Anders verzoek-host of
+    // laatst bevestigd adres. Nooit een vast adres.
+    const shellBase = await readShellBase(sb);
+    const shellOk = shellBase ? (await probeWebhookCallbackBase(shellBase)) === null : false;
+    const base = (shellOk ? shellBase : null) ?? opts.callbackBase ?? confirmedBase(existing);
+    const currentOrigin = confirmedBase(existing);
+    const moveToShell = shellOk && !!existing && currentOrigin !== shellBase;
+    if (moveToShell)
+        console.log(`[webhook-ensure] ${environment}: callback ${currentOrigin} → ${shellBase}`);
+    if (!opts.force && existing && !moveToShell) {
         const decision = await shouldResubscribe(sb, existing, now);
         if (!decision.resubscribe)
             return { ok: true, action: "skipped", reason: decision.why };
@@ -107,7 +127,7 @@ export async function ensureFloridayWebhookSubscription(supabase, environment, o
     const lockUntil = new Date(now + 60000).toISOString();
     const bytes = crypto.getRandomValues(new Uint8Array(32));
     const token = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-    const callbackUrl = `${base}/api/public/gateway/webhook/${token}`;
+    const callbackUrl = `${base}/api/public/gateway/webhook-in?t=${token}`;
     const path = `/${SUPPLIERS_API_VERSION}/webhooks/subscriptions`;
     // Eerst vorige callback bij Floriday afmelden → nooit twee geldige abonnementen.
     if (existing?.callback_url) {

package/dist-lib/lib/gateway/webhook.d.ts

@@ -7,6 +7,12 @@ export interface WebhookResult {
 }
 export declare function runFloridayWebhook(supabase: SupabaseClient, token: string, rawBody: string): Promise<WebhookResult>;
 export declare function handleFloridayWebhook(request: Request, supabase: SupabaseClient, token: string): Promise<Response>;
+/**
+ * Shell-geschikte variant zonder padparameter: POST
+ * /api/public/gateway/webhook-in?t=<token>. Zelfde verificatie (token-hash,
+ * SNS-handtekening) en dedupe als de route met het token in het pad.
+ */
+export declare function handleFloridayWebhookIn(request: Request, supabase: SupabaseClient): Promise<Response>;
 export declare function runWebhookRetryRound(supabase: SupabaseClient): Promise<{
     picked: number;
 }>;

package/dist-lib/lib/gateway/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/webhook.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAW5D,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,wBAAsB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhE;AA4CD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC,CA2JxB;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAKD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBhG;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAWnB"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/webhook.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAW5D,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,wBAAsB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhE;AA4CD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC,CA2JxB;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAGnB;AAKD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBhG;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAWnB"}

package/dist-lib/lib/gateway/webhook.js

@@ -211,6 +211,15 @@ export async function handleFloridayWebhook(request, supabase, token) {
         return Response.json({ ok: false }, { status: 500 });
     }
 }
+/**
+ * Shell-geschikte variant zonder padparameter: POST
+ * /api/public/gateway/webhook-in?t=<token>. Zelfde verificatie (token-hash,
+ * SNS-handtekening) en dedupe als de route met het token in het pad.
+ */
+export async function handleFloridayWebhookIn(request, supabase) {
+    const token = new URL(request.url).searchParams.get("t") ?? "";
+    return handleFloridayWebhook(request, supabase, token);
+}
 // ---------------------------------------------------------------------------
 // Herhaalronde voor mislukte events (cron, elke minuut).
 // ---------------------------------------------------------------------------

package/dist-lib/lib/shell-base.d.ts

@@ -1,2 +1,16 @@
 export declare function normalizeShellBase(raw: unknown): string | null;
+export type ShellBaseDecision = {
+    ok: false;
+    reason: string;
+} | {
+    ok: true;
+    base: string;
+    writeShell: boolean;
+    writeStock: boolean;
+    previous: string | null;
+};
+export declare function decideShellBaseWrites(raw: unknown, current: {
+    shell?: string | null;
+    stock?: string | null;
+}, pingOk: boolean): ShellBaseDecision;
 //# sourceMappingURL=shell-base.d.ts.map

package/dist-lib/lib/shell-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-base.d.ts","sourceRoot":"","sources":["../../src/lib/shell-base.ts"],"names":[],"mappings":"AAGA,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkB9D"}
+{"version":3,"file":"shell-base.d.ts","sourceRoot":"","sources":["../../src/lib/shell-base.ts"],"names":[],"mappings":"AAGA,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkB9D;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAKlG,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACzD,MAAM,EAAE,OAAO,GACd,iBAAiB,CAWnB"}

package/dist-lib/lib/shell-base.js

@@ -29,3 +29,20 @@ export function normalizeShellBase(raw) {
         return null;
     return `https://${host}`;
 }
+// Beslist welke sleutels geschreven worden. shell_base_url = adres van de
+// eigen Shell (alleen normalisatie nodig); stock_queue_processor_base_url
+// stuurt de eigen verwerker en vereist een geslaagde eigen ping.
+export function decideShellBaseWrites(raw, current, pingOk) {
+    if (raw == null || (typeof raw === "string" && !raw.trim()))
+        return { ok: false, reason: "Central Auth gaf geen shell-host" };
+    const base = normalizeShellBase(raw);
+    if (!base)
+        return { ok: false, reason: "ongeldige shell-host" };
+    return {
+        ok: true,
+        base,
+        writeShell: current.shell !== base,
+        writeStock: pingOk && current.stock !== base,
+        previous: current.shell ?? null,
+    };
+}

package/dist-lib/lib/shell-routes.d.ts

@@ -1,5 +1,5 @@
 /** Moet gelijk zijn aan de gateway-routes in package.json (bewaakt door test). */
-export declare const SHELL_GATEWAY_ROUTES: readonly ["/api/public/gateway/active-environment", "/api/public/gateway/auto-process", "/api/public/gateway/cached-list", "/api/public/gateway/code-list", "/api/public/gateway/cron/scan", "/api/public/gateway/diagnostics", "/api/public/gateway/floricode-records", "/api/public/gateway/fulfillment-order/send", "/api/public/gateway/fulfillment-order/status", "/api/public/gateway/media", "/api/public/gateway/media-upload", "/api/public/gateway/pdf", "/api/public/gateway/pdf/bulk", "/api/public/gateway/pdf/bulk-merged", "/api/public/gateway/product-characteristics", "/api/public/gateway/schema", "/api/public/gateway/supply-line", "/api/public/gateway/floriday-get", "/api/public/gateway/write", "/api/public/gateway/trade-item-version"];
+export declare const SHELL_GATEWAY_ROUTES: readonly ["/api/public/gateway/active-environment", "/api/public/gateway/auto-process", "/api/public/gateway/cached-list", "/api/public/gateway/code-list", "/api/public/gateway/cron/scan", "/api/public/gateway/diagnostics", "/api/public/gateway/floricode-records", "/api/public/gateway/fulfillment-order/send", "/api/public/gateway/fulfillment-order/status", "/api/public/gateway/media", "/api/public/gateway/media-upload", "/api/public/gateway/pdf", "/api/public/gateway/pdf/bulk", "/api/public/gateway/pdf/bulk-merged", "/api/public/gateway/product-characteristics", "/api/public/gateway/schema", "/api/public/gateway/supply-line", "/api/public/gateway/floriday-get", "/api/public/gateway/write", "/api/public/gateway/trade-item-version", "/api/public/gateway/webhook-in"];
 export type ShellRouteState = {
     path: string;
     present: boolean;

package/dist-lib/lib/shell-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-routes.d.ts","sourceRoot":"","sources":["../../src/lib/shell-routes.ts"],"names":[],"mappings":"AAYA,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,suBAqBvB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAyBF,0FAA0F;AAC1F,wBAAsB,gBAAgB,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4CvH;AAED,8FAA8F;AAC9F,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlH"}
+{"version":3,"file":"shell-routes.d.ts","sourceRoot":"","sources":["../../src/lib/shell-routes.ts"],"names":[],"mappings":"AAYA,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,wwBAsBvB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAyBF,0FAA0F;AAC1F,wBAAsB,gBAAgB,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4CvH;AAED,8FAA8F;AAC9F,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlH"}

package/dist-lib/lib/shell-routes.js

@@ -31,6 +31,7 @@ export const SHELL_GATEWAY_ROUTES = [
     "/api/public/gateway/floriday-get",
     "/api/public/gateway/write",
     "/api/public/gateway/trade-item-version",
+    "/api/public/gateway/webhook-in",
 ];
 const TTL_MS = 5 * 60 * 1000;
 const cache = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/floriday-authenticatie-module",
-  "version": "1.0.58",
+  "version": "1.0.62",
   "sideEffects": false,
   "type": "module",
   "main": "./dist-lib/index.js",
@@ -594,6 +594,14 @@
         "methods": [
           "POST"
         ]
+      },
+      {
+        "routePath": "/api/public/gateway/webhook-in",
+        "import": "@flowselections/floriday-authenticatie-module/gateway",
+        "handler": "handleFloridayWebhookIn",
+        "methods": [
+          "POST"
+        ]
       }
     ]
   },