@flowselections/floriday-voorraad 1.0.82 → 1.0.84

package/dist-lib/lib/floriday-client.d.ts

@@ -1,5 +1,10 @@
 import type { PackingConfigurationInput } from "./floriday-payload.js";
 import type { FloridayInfo } from "./floriday-info.js";
+/** Fout bij foto-upload: `message` is voor de gebruiker, `adminDetail` voor "Details voor beheer". */
+export declare class PhotoUploadError extends Error {
+    adminDetail: string;
+    constructor(message: string, adminDetail: string);
+}
 export interface PrimaryPackingSummary {
     packagingType: string;
     unitsPerPackage: number;

package/dist-lib/lib/floriday-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floriday-client.d.ts","sourceRoot":"","sources":["../../src/lib/floriday-client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AA2CD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,QAAQ,GACR,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,OAAO,CAAC;IACb,wGAAwG;IACxG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,yFAAyF;IACzF,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;IAC7D,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,SAAS,GAAG,cAAc,GAAG,eAAe,CAAC;IACxD,qEAAqE;IACrE,qBAAqB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpD,+DAA+D;IAC/D,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;8DAC0D;IAC1D,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,yBAAyB,EAAE,GAAG,SAAS,GAC/C,qBAAqB,GAAG,SAAS,CAWnC;AAiCD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAsBtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;oCAKmB,MAAM,WAAW,GAAG;;;;;;oCAwC1C,MAAM,eACP,MAAM,WACV,GAAG;;;;;;IAuCd;;;;;;;OAOG;iCAEc,MAAM,QACf,IAAI,iBACK,MAAM,aACV,MAAM;;iBAmE4C,MAAM,GAAG,IAAI;;aAEjD,MAAM;;CASlC,CAAC"}
+{"version":3,"file":"floriday-client.d.ts","sourceRoot":"","sources":["../../src/lib/floriday-client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,sGAAsG;AACtG,qBAAa,gBAAiB,SAAQ,KAAK;IACL,WAAW,EAAE,MAAM;gBAA3C,OAAO,EAAE,MAAM,EAAS,WAAW,EAAE,MAAM;CAIxD;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AA2CD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,QAAQ,GACR,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,OAAO,CAAC;IACb,wGAAwG;IACxG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,yFAAyF;IACzF,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;IAC7D,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,SAAS,GAAG,cAAc,GAAG,eAAe,CAAC;IACxD,qEAAqE;IACrE,qBAAqB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpD,+DAA+D;IAC/D,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;8DAC0D;IAC1D,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,yBAAyB,EAAE,GAAG,SAAS,GAC/C,qBAAqB,GAAG,SAAS,CAWnC;AAiCD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAsBtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;oCAKmB,MAAM,WAAW,GAAG;;;;;;oCAwC1C,MAAM,eACP,MAAM,WACV,GAAG;;;;;;IAuCd;;;;;;;OAOG;iCAEc,MAAM,QACf,IAAI,iBACK,MAAM,aACV,MAAM;;iBAmF0C,MAAM,GAAG,IAAI;;aAEjD,MAAM;;CAKhC,CAAC"}

package/dist-lib/lib/floriday-client.js

@@ -1,5 +1,13 @@
 import { supabase } from "../integrations/supabase/client.js";
 import { publishTradeItem, updateTradeItemFn } from "./floriday-writes.functions.js";
+/** Fout bij foto-upload: `message` is voor de gebruiker, `adminDetail` voor "Details voor beheer". */
+export class PhotoUploadError extends Error {
+    constructor(message, adminDetail) {
+        super(message);
+        this.adminDetail = adminDetail;
+        this.name = "PhotoUploadError";
+    }
+}
 function summarizePayload(payload) {
     if (!payload || typeof payload !== "object")
         return {};
@@ -203,9 +211,8 @@ export const floriday = {
         // Geef het bestand een naam mee — anders krijgt server "blob".
         const fname = filename ?? file.name ?? `photo-${Date.now()}.jpg`;
         form.append("file", file, fname);
-        // Stille retry: 2× extra pogingen met exponentiële backoff bij 5xx /
-        // netwerkfouten. Bij client-side fouten (te klein, verkeerd type) tonen
-        // we de server-message meteen aan de gebruiker — geen retry.
+        // Alleen bij serverfouten (5xx) of netwerkfouten stil opnieuw proberen.
+        // 404, 401 of een afgekeurde foto meteen met de echte reden tonen.
         const GENERIC = "Foto kon niet worden geüpload. Probeer het later opnieuw.";
         const backoffs = [0, 300, 900];
         let lastErr = null;
@@ -213,63 +220,65 @@ export const floriday = {
             if (backoffs[attempt] > 0) {
                 await new Promise((r) => setTimeout(r, backoffs[attempt]));
             }
+            let res;
             try {
-                const res = await fetch("/api/trade-item-photo", {
+                res = await fetch("/api/trade-item-photo", {
                     method: "POST",
                     headers: { Authorization: `Bearer ${token}` },
                     body: form,
                 });
-                const ct = res.headers.get("content-type") ?? "";
-                const text = await res.text();
-                let parsed = null;
-                if (ct.toLowerCase().includes("application/json") && text) {
-                    try {
-                        parsed = JSON.parse(text);
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                }
-                if (!res.ok) {
-                    const base = parsed?.message || parsed?.error || GENERIC;
-                    const withDetail = parsed?.detail ? `${base} (${parsed.detail})` : base;
-                    const withStatus = parsed?.gatewayStatus
-                        ? `${withDetail} [status ${parsed.gatewayStatus}]`
-                        : withDetail;
-                    lastErr = new Error(withStatus);
-                    if (res.status >= 500 && attempt < backoffs.length - 1)
-                        continue;
-                    throw lastErr;
+            }
+            catch (e) {
+                lastErr = new PhotoUploadError("Floriday is even niet bereikbaar. Probeer het zo opnieuw.", `netwerkfout: ${e?.message ?? String(e)}`);
+                continue;
+            }
+            const ct = res.headers.get("content-type") ?? "";
+            const text = await res.text().catch(() => "");
+            let parsed = null;
+            if (ct.toLowerCase().includes("application/json") && text) {
+                try {
+                    parsed = JSON.parse(text);
                 }
-                if (parsed?.ok === false) {
-                    const base = parsed.message || GENERIC;
-                    const withDetail = parsed.detail ? `${base} (${parsed.detail})` : base;
-                    const withStatus = parsed.gatewayStatus
-                        ? `${withDetail} [status ${parsed.gatewayStatus}]`
-                        : withDetail;
-                    lastErr = new Error(withStatus);
-                    if (parsed.retryable && attempt < backoffs.length - 1)
-                        continue;
-                    throw lastErr;
+                catch {
+                    /* ignore */
                 }
-                if (!parsed?.url) {
-                    lastErr = new Error(GENERIC);
-                    if (attempt < backoffs.length - 1)
-                        continue;
+            }
+            const adminDetail = [
+                `POST /api/trade-item-photo → HTTP ${res.status}`,
+                parsed?.reason ? `reden: ${parsed.reason}` : null,
+                parsed?.gatewayStatus ? `gateway-status: ${parsed.gatewayStatus}` : null,
+                parsed?.detail ? `detail: ${parsed.detail}` : null,
+                !parsed && text ? `antwoord: ${text.slice(0, 160)}` : null,
+            ]
+                .filter(Boolean)
+                .join(" · ");
+            if (res.status === 404 || (!parsed && res.ok)) {
+                throw new PhotoUploadError("Deze functie ontbreekt in de installatie. Vraag de beheerder de Shell bij te werken.", adminDetail);
+            }
+            if (res.status === 401 || res.status === 403) {
+                throw new PhotoUploadError(parsed?.message ?? "Je bent uitgelogd. Log opnieuw in en probeer het nog eens.", adminDetail);
+            }
+            if (res.status >= 500) {
+                lastErr = new PhotoUploadError(parsed?.message ?? GENERIC, adminDetail);
+                if (parsed?.reason === "config_missing")
                     throw lastErr;
-                }
-                return {
-                    ok: true,
-                    imageId: (parsed.imageId ?? parsed.mediaId ?? null),
-                    mediaId: parsed.mediaId ?? parsed.imageId ?? null,
-                    url: parsed.url,
-                };
+                continue;
             }
-            catch (e) {
-                lastErr = e instanceof Error ? e : new Error(String(e));
-                if (attempt >= backoffs.length - 1)
-                    break;
+            if (!res.ok || parsed?.ok === false) {
+                lastErr = new PhotoUploadError(parsed?.message ?? GENERIC, adminDetail);
+                if (parsed?.retryable)
+                    continue;
+                throw lastErr;
             }
+            if (!parsed?.url) {
+                throw new PhotoUploadError(GENERIC, adminDetail);
+            }
+            return {
+                ok: true,
+                imageId: (parsed.imageId ?? parsed.mediaId ?? null),
+                mediaId: parsed.mediaId ?? parsed.imageId ?? null,
+                url: parsed.url,
+            };
         }
         throw lastErr instanceof Error ? lastErr : new Error(GENERIC);
     },

package/dist-lib/lib/publish-readiness.js

@@ -60,8 +60,8 @@ export function buildReadinessReport(input) {
         label: "Minimaal één foto toegevoegd",
         ok: Array.isArray(d.images) && d.images.length > 0,
         stepKey: "fotos",
-        blocking: false,
-        hint: "Zonder foto is het product minder goed vindbaar.",
+        blocking: true,
+        hint: "Floriday vraagt minstens één foto. Opslaan als concept kan zonder foto.",
     });
     // Verplichte eigenschappen uit de productregels + eerder afgekeurde velden.
     const required = new Set([

package/dist-lib/server-hooks/__tests__/trade-item-photo.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=trade-item-photo.test.d.ts.map

package/dist-lib/server-hooks/__tests__/trade-item-photo.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trade-item-photo.test.d.ts","sourceRoot":"","sources":["../../../src/server-hooks/__tests__/trade-item-photo.test.ts"],"names":[],"mappings":""}

package/dist-lib/server-hooks/__tests__/trade-item-photo.test.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { checkImage } from "../trade-item-photo.js";
+function png(w, h) {
+    const b = new Uint8Array(32);
+    b.set([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a], 0);
+    const dv = new DataView(b.buffer);
+    dv.setUint32(16, w);
+    dv.setUint32(20, h);
+    return b;
+}
+function jpg(w, h) {
+    return new Uint8Array([0xff, 0xd8, 0xff, 0xc0, 0x00, 0x11, 0x08, h >> 8, h & 255, w >> 8, w & 255, 3, 0, 0, 0, 0]);
+}
+describe("foto-controle op de server", () => {
+    it("accepteert jpg van 800x1200", () => expect(checkImage(jpg(800, 1200), 400000)).toBeNull());
+    it("weigert kleiner dan 640x640", () => expect(checkImage(png(639, 800), 1000)?.reason).toBe("image_too_small"));
+    it("weigert groter dan 5 MB", () => expect(checkImage(png(800, 800), 5 * 1024 * 1024 + 1)?.reason).toBe("image_too_large"));
+    it("weigert ander bestandstype", () => expect(checkImage(new TextEncoder().encode("GIF89a-----"), 100)?.reason).toBe("unsupported_type"));
+});

package/dist-lib/server-hooks/trade-item-photo.d.ts

@@ -0,0 +1,13 @@
+type UploadReason = "image_too_small" | "image_too_large" | "unsupported_type" | "invalid_payload" | "network" | "not_logged_in" | "not_connected" | "config_missing" | "unknown";
+/** Breedte/hoogte uit PNG-IHDR of JPEG-SOF-marker. */
+export declare function imageSize(b: Uint8Array): {
+    w: number;
+    h: number;
+} | null;
+export declare function checkImage(head: Uint8Array, size: number): {
+    reason: UploadReason;
+    detail: string;
+} | null;
+export declare function handleTradeItemPhoto(request: Request): Promise<Response>;
+export {};
+//# sourceMappingURL=trade-item-photo.d.ts.map

package/dist-lib/server-hooks/trade-item-photo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trade-item-photo.d.ts","sourceRoot":"","sources":["../../src/server-hooks/trade-item-photo.ts"],"names":[],"mappings":"AAqBA,KAAK,YAAY,GACb,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,GACT,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,SAAS,CAAC;AAgFd,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBxE;AAKD,wBAAgB,UAAU,CACxB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,GACX;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASjD;AAMD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+P9E"}

package/dist-lib/server-hooks/trade-item-photo.js

@@ -0,0 +1,354 @@
+/**
+ * Upload-handler voor artikelfoto's (losse app én Shell via flowselections.serverRoutes).
+ * Alleen ingelogde gebruikers van deze database (sessie-bearer); de gateway-
+ * sleutel blijft server-side. Server-only.
+ *
+ * Flow (§14.11):
+ *  1. Browser POSTet multipart/form-data met `file` en optioneel `tradeItemId`.
+ *  2. Wij verifiëren de Supabase-bearer en bepalen de actieve koppeling zelf.
+ *  3. We sturen de RAW bytes door naar /api/public/gateway/media-upload —
+ *     géén base64-inflatie, géén formData-rebuild. HMAC zit in
+ *     gatewayMediaUpload (server-only secret).
+ */
+import { createClient } from "@supabase/supabase-js";
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "Content-Type": "application/json" },
+    });
+}
+function messageForReason(reason) {
+    switch (reason) {
+        case "image_too_small":
+            return "De foto is te klein. Gebruik een foto van minstens 640 × 640 pixels.";
+        case "image_too_large":
+            return "De foto is te groot. Gebruik een foto van maximaal 5 MB.";
+        case "unsupported_type":
+            return "Dit bestandstype kan niet. Gebruik een JPG- of PNG-foto.";
+        case "invalid_payload":
+            return "Floriday accepteert deze foto niet. Probeer een andere foto.";
+        case "network":
+            return "Floriday is even niet bereikbaar. Probeer het zo opnieuw.";
+        case "not_logged_in":
+            return "Je bent uitgelogd. Log opnieuw in en probeer het nog eens.";
+        case "not_connected":
+        case "config_missing":
+            return "De koppeling met Floriday werkt niet. Neem contact op met Flow Selections.";
+        default:
+            return "Foto kon niet worden geüpload. Probeer het opnieuw.";
+    }
+}
+function classifyGatewayError(status, message) {
+    const m = message.toLowerCase();
+    if (m.includes("resolution") || m.includes("640") || m.includes("too small") || m.includes("dimensions")) {
+        return "image_too_small";
+    }
+    if (m.includes("5mb") || m.includes("too large") || m.includes("size") && m.includes("exceed")) {
+        return "image_too_large";
+    }
+    if (m.includes("unsupported") || m.includes("content-type") || m.includes("media type")) {
+        return "unsupported_type";
+    }
+    if (status && status >= 500)
+        return "network";
+    if (status && status >= 400 && status < 500)
+        return "invalid_payload";
+    return "unknown";
+}
+function sanitizeDetail(msg) {
+    // Verwijder tokens/headers/HMAC uit de error-string voordat we het naar
+    // de browser sturen. Alleen de eerste 240 tekens zijn nuttig voor UX.
+    return msg
+        .replace(/Bearer\s+[A-Za-z0-9._-]+/gi, "Bearer ***")
+        .replace(/(x-hmac[^:]*:\s*)[A-Fa-f0-9]+/gi, "$1***")
+        .replace(/(authorization[^:]*:\s*)[^\s,]+/gi, "$1***")
+        .slice(0, 240);
+}
+function uploadFailed(reason, extra = {}) {
+    // Bewust géén HTTP 502/5xx naar de browser: Lovable preview toont zulke
+    // route-responses als runtime error/blank screen. De client krijgt een
+    // typed failure terug en beslist zelf over retry + vriendelijke melding.
+    const retryable = reason === "network" || reason === "unknown";
+    return json({
+        ok: false,
+        error: "upload-mislukt",
+        reason,
+        message: messageForReason(reason),
+        retryable,
+        ...extra,
+    }, 200);
+}
+/** Herkent jpg/png aan de eerste bytes (niet aan bestandsnaam of browsertype). */
+function sniffType(b) {
+    if (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return "image/jpeg";
+    if (b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47)
+        return "image/png";
+    return null;
+}
+/** Breedte/hoogte uit PNG-IHDR of JPEG-SOF-marker. */
+export function imageSize(b) {
+    const t = sniffType(b);
+    if (t === "image/png" && b.length >= 24) {
+        const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
+        return { w: dv.getUint32(16), h: dv.getUint32(20) };
+    }
+    if (t === "image/jpeg") {
+        let i = 2;
+        while (i + 9 < b.length) {
+            if (b[i] !== 0xff) {
+                i++;
+                continue;
+            }
+            const m = b[i + 1];
+            const len = (b[i + 2] << 8) | b[i + 3];
+            if (m >= 0xc0 && m <= 0xcf && m !== 0xc4 && m !== 0xc8 && m !== 0xcc) {
+                return { h: (b[i + 5] << 8) | b[i + 6], w: (b[i + 7] << 8) | b[i + 8] };
+            }
+            i += 2 + len;
+        }
+    }
+    return null;
+}
+const MAX_BYTES = 5 * 1024 * 1024;
+const MIN_SIDE = 640;
+export function checkImage(head, size) {
+    if (!sniffType(head))
+        return { reason: "unsupported_type", detail: "geen jpg/png-handtekening" };
+    if (size > MAX_BYTES)
+        return { reason: "image_too_large", detail: `${size} bytes > ${MAX_BYTES}` };
+    const dim = imageSize(head);
+    if (!dim)
+        return { reason: "invalid_payload", detail: "afmeting niet leesbaar" };
+    if (dim.w < MIN_SIDE || dim.h < MIN_SIDE) {
+        return { reason: "image_too_small", detail: `${dim.w}x${dim.h} < ${MIN_SIDE}x${MIN_SIDE}` };
+    }
+    return null;
+}
+function plainFail(reason, status, detail) {
+    return json({ ok: false, reason, message: messageForReason(reason), detail }, status);
+}
+export async function handleTradeItemPhoto(request) {
+    if (request.method === "OPTIONS")
+        return new Response(null, { status: 204 });
+    if (request.method !== "POST")
+        return json({ error: "Method not allowed" }, 405);
+    try {
+        const SUPABASE_URL = process.env.SUPABASE_URL;
+        const SUPABASE_PUBLISHABLE_KEY = process.env.SUPABASE_PUBLISHABLE_KEY;
+        if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
+            return plainFail("config_missing", 500, "SUPABASE_URL/SUPABASE_PUBLISHABLE_KEY ontbreekt op de server");
+        }
+        // --- 1. Bearer-validatie -------------------------------------------------
+        const authHeader = request.headers.get("authorization");
+        if (!authHeader)
+            return plainFail("not_logged_in", 401, "Unauthorized: geen bearer");
+        if (!authHeader.startsWith("Bearer "))
+            return plainFail("not_logged_in", 401, "Unauthorized: alleen Bearer-tokens");
+        const token = authHeader.slice("Bearer ".length).trim();
+        if (!token)
+            return plainFail("not_logged_in", 401, "Unauthorized: leeg token");
+        const supabase = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+            global: { headers: { Authorization: `Bearer ${token}` } },
+            auth: { storage: undefined, persistSession: false, autoRefreshToken: false },
+        });
+        const { data: claimsData, error: claimsErr } = await supabase.auth.getClaims(token);
+        if (claimsErr || !claimsData?.claims?.sub) {
+            return plainFail("not_logged_in", 401, "Unauthorized: token ongeldig");
+        }
+        // --- 2. Multipart body ---------------------------------------------------
+        let form;
+        try {
+            form = await request.formData();
+        }
+        catch {
+            return json({ error: "Bad request: multipart/form-data verwacht" }, 400);
+        }
+        // Oude clients kunnen nog een connectionId meesturen. Deze waarde is
+        // nooit leidend: de actieve koppeling wordt hieronder server-side
+        // bepaald. Zo kan een browser nooit een koppeling/account kiezen.
+        const clientConnectionId = String(form.get("connectionId") ?? "").trim();
+        const tradeItemId = form.get("tradeItemId")
+            ? String(form.get("tradeItemId"))
+            : null;
+        const file = form.get("file");
+        if (!(file instanceof Blob))
+            return json({ error: "file ontbreekt of geen Blob" }, 400);
+        if (file.size === 0)
+            return json({ error: "Leeg bestand" }, 400);
+        const filename = file.name ||
+            `photo-${Date.now()}.${(file.type || "image/jpeg").split("/")[1] ?? "jpg"}`;
+        const headBytes = new Uint8Array(await file.slice(0, 256 * 1024).arrayBuffer());
+        const check = checkImage(headBytes, file.size);
+        if (check)
+            return uploadFailed(check.reason, { detail: check.detail });
+        const contentType = sniffType(headBytes) ?? "image/jpeg";
+        // --- 3. Actieve koppeling + omgeving via de gedeelde bron ---------------
+        let environment;
+        try {
+            const { checkFloridayReadiness } = await import("../lib/floriday-readiness.server.js");
+            const readiness = await checkFloridayReadiness(supabase);
+            if (!readiness.ready || !readiness.connectionId || !readiness.environment) {
+                return plainFail("not_connected", 409, `FLORIDAY_NOT_READY: ${readiness.message}`);
+            }
+            if (clientConnectionId && readiness.connectionId !== clientConnectionId) {
+                return json({
+                    error: "De verbinding is gewijzigd. Vernieuw de pagina en probeer opnieuw.",
+                }, 409);
+            }
+            environment = readiness.environment;
+        }
+        catch (e) {
+            const { FloridayEnvError } = await import("../lib/floriday-env.js");
+            if (e instanceof FloridayEnvError) {
+                return plainFail("not_connected", 400, `${e.code}: ${e.message}`);
+            }
+            throw e;
+        }
+        // --- 4. Raw bytes doorsturen naar de centrale gateway -------------------
+        const buf = new Uint8Array(await file.arrayBuffer());
+        const hashBuf = await crypto.subtle.digest("SHA-256", buf);
+        const hashHex = Array.from(new Uint8Array(hashBuf))
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("");
+        const idempotencyKey = `inventory:image:${tradeItemId ?? "anon"}:${hashHex.slice(0, 16)}`;
+        // Floriday Suppliers API 2026v1: POST /media (operatie AddImage),
+        // multipart/form-data met verplicht form-veld "image".
+        // LET OP: de gateway plakt het pad achter https://api.[staging.]floriday.io
+        // ZONDER versie-prefix — die moet dus in het pad zelf zitten.
+        const path = "/suppliers-api-2026v1/media";
+        const requestTimestamp = Date.now();
+        const clientUserId = claimsData.claims.sub;
+        const reportFailure = async (info) => {
+            // (a) push naar Auth-module diagnostics-endpoint
+            try {
+                const { reportGatewayFailure } = await import("../lib/floriday-gateway.server.js");
+                await reportGatewayFailure({
+                    module: "inventory",
+                    action: "media-upload",
+                    environment,
+                    path,
+                    referenceId: tradeItemId ?? null,
+                    idempotencyKey,
+                    attemptNumber: info.attemptNumber,
+                    requestTimestamp,
+                    requestBodyHash: hashHex,
+                    fileMeta: {
+                        filename,
+                        contentType,
+                        sizeBytes: buf.byteLength,
+                    },
+                    responseStatus: info.responseStatus ?? null,
+                    responseContentType: info.responseContentType ?? null,
+                    responseSnippet: info.responseSnippet?.slice(0, 500) ?? null,
+                    errorMessage: info.errorMessage,
+                    clientUserId,
+                });
+            }
+            catch (e) {
+                console.warn("[trade-item-photo] reportGatewayFailure faalde", e);
+            }
+            // (b) eigen audit-tabel (zonder snippet)
+            try {
+                const { getAdminClient } = await import("../lib/supabase-admin.server.js");
+                const supabaseAdmin = getAdminClient();
+                const { error: insErr } = await supabaseAdmin
+                    .from("voorraad_media_upload_failures")
+                    .insert({
+                    environment,
+                    path,
+                    reference_id: tradeItemId ?? null,
+                    idempotency_key: idempotencyKey,
+                    attempt_number: info.attemptNumber,
+                    request_timestamp: requestTimestamp,
+                    request_body_hash: hashHex,
+                    filename,
+                    content_type: contentType,
+                    size_bytes: buf.byteLength,
+                    response_status: info.responseStatus ?? null,
+                    response_content_type: info.responseContentType ?? null,
+                    error_message: info.errorMessage,
+                    client_user_id: clientUserId,
+                });
+                if (insErr) {
+                    console.error("[trade-item-photo] audit-insert error", insErr.message, insErr.details);
+                }
+            }
+            catch (e) {
+                console.warn("[trade-item-photo] audit-insert faalde", e);
+            }
+        };
+        try {
+            const { gatewayMediaUpload } = await import("../lib/floriday-gateway.server.js");
+            const res = await gatewayMediaUpload({
+                caller: "voorraad",
+                environment: environment,
+                path,
+                method: "POST",
+                filename,
+                contentType,
+                bytes: buf,
+                formField: "image", // Floriday POST /media vereist form-veld "image"
+                referenceId: tradeItemId ?? undefined,
+                idempotencyKey,
+            });
+            // Floriday 2026v1 levert { mediaId: "<uuid>" } terug op POST /media.
+            const mediaId = (res.data &&
+                (res.data.mediaId ||
+                    res.data.imageId ||
+                    res.data.id)) ||
+                null;
+            const host = environment === "live"
+                ? "https://image.floriday.io"
+                : "https://image.staging.floriday.io";
+            // Docs: https://image.[staging.]floriday.io/{mediaId}.{ext}
+            const ext = contentType === "image/png" ? "png" : "jpg";
+            const url = mediaId
+                ? `${host}/${mediaId}.${ext}`
+                : (res.data && (res.data.url || res.data.imageUrl)) || null;
+            if (!mediaId || !url) {
+                const snippet = JSON.stringify(res.data ?? {}).slice(0, 500);
+                console.error("[trade-item-photo] geen mediaId", { status: res.status, snippet, filename, contentType, size: buf.byteLength });
+                await reportFailure({
+                    attemptNumber: 1,
+                    responseStatus: res.status ?? null,
+                    responseContentType: "application/json",
+                    responseSnippet: snippet,
+                    errorMessage: "Gateway leverde geen mediaId terug",
+                });
+                return uploadFailed("invalid_payload", {
+                    attemptId: res.attemptId ?? null,
+                    gatewayStatus: res.status ?? null,
+                    detail: sanitizeDetail(snippet),
+                });
+            }
+            return json({ ok: true, url, imageId: mediaId, mediaId, attemptId: res.attemptId });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            // Probeer status/content-type uit de error-tekst te halen (gateway
+            // gooit messages als "gateway media-upload → niet-JSON antwoord
+            // (status=502)").
+            const statusMatch = /status=(\d{3})/.exec(msg);
+            const responseStatus = statusMatch ? Number(statusMatch[1]) : null;
+            const reason = classifyGatewayError(responseStatus, msg);
+            console.error("[trade-item-photo] gateway-fout", { reason, responseStatus, msg, filename, contentType, size: buf.byteLength, tradeItemId });
+            await reportFailure({
+                attemptNumber: 1,
+                responseStatus,
+                responseContentType: null,
+                responseSnippet: msg.slice(0, 500),
+                errorMessage: msg,
+            });
+            return uploadFailed(reason, {
+                gatewayStatus: responseStatus,
+                detail: sanitizeDetail(msg),
+            });
+        }
+    }
+    catch (outer) {
+        const msg = outer instanceof Error ? outer.message : String(outer);
+        console.error("[trade-item-photo] unhandled", msg, outer?.stack);
+        return plainFail("unknown", 500, sanitizeDetail(`Interne fout: ${msg}`));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/floriday-voorraad",
-  "version": "1.0.82",
+  "version": "1.0.84",
   "sideEffects": false,
   "type": "module",
   "main": "./dist-lib/index.js",
@@ -158,6 +158,15 @@
           "POST",
           "OPTIONS"
         ]
+      },
+      {
+        "routePath": "/api/trade-item-photo",
+        "import": "@flowselections/floriday-voorraad/hooks",
+        "handler": "handleTradeItemPhoto",
+        "methods": [
+          "POST",
+          "OPTIONS"
+        ]
       }
     ]
   }