@flowselections/google-maps-api-installatie-techniek 1.0.2

package/dist-lib/integrations/supabase/types.js

@@ -0,0 +1,92 @@
+export const Constants = {
+    public: {
+        Enums: {
+            ai_import_status: [
+                "nieuw",
+                "verwerken",
+                "bevestigen",
+                "klaar",
+                "mislukt",
+            ],
+            app_role: [
+                "admin",
+                "planner",
+                "monteur",
+                "administratie",
+                "ai_admin",
+                "manager",
+                "warehouse",
+                "sales",
+                "developer",
+                "receptie",
+            ],
+            doc_layout_type: [
+                "pakbon",
+                "factuur",
+                "offerte",
+                "orderbevestiging",
+                "etiket",
+                "verzendlabel",
+                "productlabel",
+                "barcode_label",
+                "magazijnlijst",
+                "controlelijst",
+                "transportdocument",
+                "vrij",
+                "sticker",
+                "productiebon",
+                "veilingbon",
+                "afleverbrief",
+                "veilingbrief",
+            ],
+            doc_orientation: ["portrait", "landscape"],
+            exact_env: ["staging", "live"],
+            exact_push_status: ["pending", "sent", "error"],
+            itk_customer_segment: ["Business", "Private"],
+            itk_dynamic_field_type: ["text", "select", "date", "checkbox"],
+            planning_item_status: [
+                "gepland",
+                "bezig",
+                "afgerond",
+                "geannuleerd",
+                "concept",
+                "vrijgegeven",
+            ],
+            print_job_status: [
+                "wachtend",
+                "bezig",
+                "voltooid",
+                "mislukt",
+                "geannuleerd",
+            ],
+            printer_connection: [
+                "ipp",
+                "raw9100",
+                "printnode",
+                "cups",
+                "usb",
+                "windows",
+                "airprint",
+                "cloud",
+            ],
+            printer_kind: [
+                "labelprinter",
+                "laserprinter",
+                "inkjet",
+                "thermal",
+                "kantoorprinter",
+                "overig",
+            ],
+            quote_status: [
+                "concept",
+                "verzonden",
+                "bekeken",
+                "in_behandeling",
+                "geaccepteerd",
+                "afgewezen",
+                "verlopen",
+                "gearchiveerd",
+            ],
+        },
+    },
+};

package/dist-lib/lib/central-auth.server.d.ts

@@ -0,0 +1,60 @@
+export declare const GOOGLE_PROVIDER = "google_maps";
+export declare class GoogleCredentialUnavailableError extends Error {
+    constructor(message: string);
+}
+export interface GoogleApiKeyResult {
+    apiKey: string;
+    expiresAt: string | null;
+}
+/**
+ * Haalt de Google Maps API-key op bij Central Auth via
+ * POST /api/token/google_maps met body {"environment":"live"}.
+ * Het antwoordveld access_token bevat de API-key (geen OAuth-token).
+ */
+export declare function fetchGoogleApiKey(): Promise<GoogleApiKeyResult>;
+/** Haalt de Google Maps API-key op via de centrale auth-module. */
+export declare function getGoogleAccessToken(): Promise<string>;
+/** Korte, mensleesbare status voor de beheerschermen. */
+export declare function getGoogleConnectionStatus(): Promise<{
+    connected: boolean;
+    reason: string | null;
+}>;
+export interface MapsConnectionStatus {
+    connected: boolean;
+    centralHost: string | null;
+    secretPresent: boolean;
+    accountPresent: boolean;
+    account: string | null;
+    accountStatus: string | null;
+    expiresAt: string | null;
+    reason: string | null;
+}
+/** Uitgebreide koppelingsstatus voor de statustab. */
+export declare function getMapsConnectionStatus(): Promise<MapsConnectionStatus>;
+export interface MapsDiagnosticStep {
+    name: string;
+    ok: boolean;
+    target: string;
+    httpStatus: number | null;
+    summary: string;
+    /** Gesaneerd JSON-antwoord als tekst (nooit geheimen). */
+    body: string | null;
+    code?: string | null;
+    hint?: string | null;
+}
+export interface MapsDiagnosticsReport {
+    measuredAt: string;
+    centralHost: string | null;
+    secretPresent: boolean;
+    steps: MapsDiagnosticStep[];
+    hints: string[];
+    checklist: string[];
+}
+export declare function collectMapsDiagnostics(probeGoogle: (stepName: string, target: string) => Promise<MapsDiagnosticStep>, probeSupabase: () => Promise<MapsDiagnosticStep>): Promise<MapsDiagnosticsReport>;
+/** Lichte test-aanroep voor de statustab ("Verbinding testen"). */
+export declare function testGoogleConnectionLive(): Promise<{
+    ok: boolean;
+    message: string;
+    detail: string | null;
+}>;
+//# sourceMappingURL=central-auth.server.d.ts.map

package/dist-lib/lib/central-auth.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"central-auth.server.d.ts","sourceRoot":"","sources":["../../src/lib/central-auth.server.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,qBAAa,gCAAiC,SAAQ,KAAK;gBAC7C,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAID;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAgErE;AAED,mEAAmE;AACnE,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAG5D;AAGD,yDAAyD;AACzD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC,CAUD;AAID,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAmBD,sDAAsD;AACtD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiF7E;AAID,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AA+ED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,EAC9E,aAAa,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAC/C,OAAO,CAAC,qBAAqB,CAAC,CA+KhC;AAED,mEAAmE;AACnE,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC,CAoBD"}

package/dist-lib/lib/central-auth.server.js

@@ -0,0 +1,439 @@
+// Server-only helper: haalt de Google Maps API-key op bij de centrale
+// auth-module. Vereist CENTRAL_AUTH_URL en CENTRAL_AUTH_SECRET.
+// De key verlaat de server nooit.
+import { listProviderAccounts, } from "@flowselections/core/server";
+export const GOOGLE_PROVIDER = "google_maps";
+export class GoogleCredentialUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GoogleCredentialUnavailableError";
+    }
+}
+let keyCache = null;
+/**
+ * Haalt de Google Maps API-key op bij Central Auth via
+ * POST /api/token/google_maps met body {"environment":"live"}.
+ * Het antwoordveld access_token bevat de API-key (geen OAuth-token).
+ */
+export async function fetchGoogleApiKey() {
+    const now = Date.now();
+    if (keyCache && keyCache.cachedUntil > now) {
+        return { apiKey: keyCache.apiKey, expiresAt: keyCache.expiresAt };
+    }
+    const cfg = centralConfig();
+    if (!cfg) {
+        throw new GoogleCredentialUnavailableError("Central Auth is niet geconfigureerd (CENTRAL_AUTH_URL/CENTRAL_AUTH_SECRET ontbreken).");
+    }
+    let response;
+    try {
+        response = await fetch(`${cfg.host}/api/token/${GOOGLE_PROVIDER}`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${cfg.secret}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ environment: "live" }),
+        });
+    }
+    catch (error) {
+        throw new GoogleCredentialUnavailableError(`Central Auth is niet bereikbaar: ${errSummary(error)}`);
+    }
+    if (!response.ok) {
+        const detail = (await response.text().catch(() => "")).slice(0, 200);
+        if (response.status === 404) {
+            throw new GoogleCredentialUnavailableError(`Provider "${GOOGLE_PROVIDER}" is niet bekend in Central Auth (HTTP 404).`);
+        }
+        if (response.status === 401 || response.status === 403) {
+            throw new GoogleCredentialUnavailableError("Central Auth weigert het secret van deze module (CENTRAL_AUTH_SECRET klopt niet).");
+        }
+        throw new GoogleCredentialUnavailableError(`Central Auth gaf HTTP ${response.status} terug: ${detail}`);
+    }
+    const payload = (await response.json().catch(() => null));
+    const apiKey = payload?.access_token ?? payload?.accessToken ?? null;
+    if (!apiKey) {
+        throw new GoogleCredentialUnavailableError("Central Auth gaf geen access_token (API-key) terug voor google_maps.");
+    }
+    const expiresAt = payload?.expires_at ?? payload?.expiresAt ?? null;
+    const expiryMs = expiresAt ? Date.parse(expiresAt) : Number.NaN;
+    const cachedUntil = Number.isNaN(expiryMs)
+        ? now + 5 * 60 * 1000
+        : Math.min(expiryMs - 60000, now + 5 * 60 * 1000);
+    keyCache = { apiKey, expiresAt, cachedUntil };
+    return { apiKey, expiresAt };
+}
+/** Haalt de Google Maps API-key op via de centrale auth-module. */
+export async function getGoogleAccessToken() {
+    const { apiKey } = await fetchGoogleApiKey();
+    return apiKey;
+}
+/** Korte, mensleesbare status voor de beheerschermen. */
+export async function getGoogleConnectionStatus() {
+    try {
+        await getGoogleAccessToken();
+        return { connected: true, reason: null };
+    }
+    catch (error) {
+        return {
+            connected: false,
+            reason: error instanceof Error ? error.message : "Onbekende fout",
+        };
+    }
+}
+function centralConfig() {
+    const host = process.env["CENTRAL_AUTH_URL"];
+    const secret = process.env["CENTRAL_AUTH_SECRET"];
+    if (!host || !secret)
+        return null;
+    return { host: host.replace(/\/+$/, ""), secret };
+}
+function firstAccount(accounts) {
+    return Array.isArray(accounts) && accounts.length > 0 ? accounts[0] ?? null : null;
+}
+function accountUsable(account) {
+    if (!account)
+        return false;
+    const status = (account.status ?? "").toLowerCase();
+    return ["active", "connected", "authorized", "ok"].includes(status);
+}
+/** Uitgebreide koppelingsstatus voor de statustab. */
+export async function getMapsConnectionStatus() {
+    const cfg = centralConfig();
+    const base = {
+        connected: false,
+        centralHost: cfg?.host ?? null,
+        secretPresent: Boolean(cfg),
+        accountPresent: false,
+        account: null,
+        accountStatus: null,
+        expiresAt: null,
+        reason: null,
+    };
+    if (!cfg) {
+        return { ...base, reason: "Central Auth is niet geconfigureerd (CENTRAL_AUTH_URL/SECRET ontbreken)." };
+    }
+    // Accountinformatie ophalen.
+    let accounts = [];
+    try {
+        accounts = await listProviderAccounts(GOOGLE_PROVIDER);
+    }
+    catch (error) {
+        const fallback = error instanceof Error ? error.message : "Onbekende fout";
+        const probe = await probeCentralAccounts(GOOGLE_PROVIDER);
+        const referenceProbe = probe.reachable ? await probeCentralAccounts(REFERENCE_PROVIDER) : null;
+        const centralUp = referenceProbe?.reachable === true &&
+            referenceProbe.httpStatus !== null &&
+            referenceProbe.httpStatus < 500;
+        if (probe.httpStatus === 401 || probe.httpStatus === 403) {
+            return { ...base, reason: "Central Auth weigert het secret van deze module (CENTRAL_AUTH_SECRET klopt niet)." };
+        }
+        if (probe.httpStatus === 404) {
+            return {
+                ...base,
+                reason: "De provider google_maps is nog niet ingericht in Central Auth. Voeg google_maps daar toe en koppel een Google-account.",
+            };
+        }
+        if (centralUp && probe.httpStatus !== null && probe.httpStatus >= 500) {
+            return { ...base, reason: `Central Auth gaf een serverfout (HTTP ${probe.httpStatus}).` };
+        }
+        if (!probe.reachable) {
+            return { ...base, reason: `Central Auth is niet bereikbaar: ${probe.error ?? fallback}` };
+        }
+        return { ...base, reason: `Central Auth gaf een fout terug: ${fallback}` };
+    }
+    const account = firstAccount(accounts);
+    if (!account) {
+        return { ...base, reason: "Nog geen Google-account gekoppeld in Central Auth." };
+    }
+    // API-key ophalen als laatste controle.
+    let expiresAt = null;
+    try {
+        const key = await fetchGoogleApiKey();
+        expiresAt = key.expiresAt;
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : "Onbekende fout";
+        return {
+            ...base,
+            accountPresent: true,
+            account: account.accountKey,
+            accountStatus: account.status,
+            reason: `Token ophalen mislukt: ${reason}`,
+        };
+    }
+    return {
+        ...base,
+        connected: accountUsable(account),
+        accountPresent: true,
+        account: account.accountKey,
+        accountStatus: account.status,
+        expiresAt,
+        reason: accountUsable(account) ? null : `Accountstatus: ${account.status}`,
+    };
+}
+function sanitizeValue(value, depth = 0) {
+    if (value === null || value === undefined)
+        return value;
+    if (Array.isArray(value)) {
+        return depth > 4 ? "[...]" : value.slice(0, 10).map((item) => sanitizeValue(item, depth + 1));
+    }
+    if (typeof value === "object") {
+        if (depth > 4)
+            return "{...}";
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            if (/(secret|token|password|key|credential|authorization|apikey)/i.test(key)) {
+                out[key] =
+                    typeof inner === "string"
+                        ? `«verborgen, ${inner.length} tekens»`
+                        : inner === null || inner === undefined
+                            ? "«leeg»"
+                            : "«verborgen»";
+                continue;
+            }
+            out[key] = sanitizeValue(inner, depth + 1);
+        }
+        return out;
+    }
+    if (typeof value === "string")
+        return value.length > 300 ? `${value.slice(0, 300)}…` : value;
+    return value;
+}
+function bodyToText(value) {
+    if (value === null || value === undefined)
+        return null;
+    try {
+        return JSON.stringify(sanitizeValue(value), null, 2);
+    }
+    catch {
+        return null;
+    }
+}
+function errSummary(error) {
+    return error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200);
+}
+/**
+ * Provider waarvan bekend is dat Central Auth hem kent. Wordt alleen gebruikt
+ * om te bepalen of Central Auth zélf bereikbaar is.
+ */
+const REFERENCE_PROVIDER = "2ba";
+/**
+ * Rauwe controle-aanroep op /api/accounts/<provider>. Geeft de HTTP-status
+ * terug zodat we netwerkfouten, 401 en onbekende providers uit elkaar kunnen
+ * houden. Het secret gaat alleen de header in en wordt nooit teruggegeven.
+ */
+async function probeCentralAccounts(provider) {
+    const cfg = centralConfig();
+    if (!cfg)
+        return { reachable: false, httpStatus: null, error: "Central Auth is niet geconfigureerd." };
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 10000);
+        try {
+            const response = await fetch(`${cfg.host}/api/accounts/${encodeURIComponent(provider)}`, {
+                headers: { Authorization: `Bearer ${cfg.secret}` },
+                signal: controller.signal,
+            });
+            return { reachable: true, httpStatus: response.status, error: null };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    catch (error) {
+        return { reachable: false, httpStatus: null, error: errSummary(error) };
+    }
+}
+export async function collectMapsDiagnostics(probeGoogle, probeSupabase) {
+    const cfg = centralConfig();
+    const steps = [];
+    const hints = [];
+    const checklist = [];
+    // Stap 1: configuratie.
+    steps.push({
+        name: "Central Auth-configuratie",
+        ok: Boolean(cfg),
+        target: "CENTRAL_AUTH_URL / CENTRAL_AUTH_SECRET",
+        httpStatus: null,
+        summary: cfg
+            ? `Host: ${cfg.host}`
+            : "CENTRAL_AUTH_URL of CENTRAL_AUTH_SECRET ontbreekt in de server-omgeving.",
+        body: null,
+        code: cfg ? null : "central_config",
+        hint: cfg
+            ? null
+            : "Voeg CENTRAL_AUTH_URL en CENTRAL_AUTH_SECRET toe aan de server-omgeving van deze module.",
+    });
+    if (!cfg) {
+        hints.push("Central Auth is niet geconfigureerd voor deze module.");
+        checklist.push("Voeg CENTRAL_AUTH_URL en CENTRAL_AUTH_SECRET toe aan de server-omgeving.");
+        return { measuredAt: new Date().toISOString(), centralHost: null, secretPresent: false, steps, hints, checklist };
+    }
+    // Stap 2: is Central Auth zelf bereikbaar? Controle op een provider waarvan
+    // bekend is dat Central Auth hem kent.
+    const reference = await probeCentralAccounts(REFERENCE_PROVIDER);
+    const centralReachable = reference.reachable && reference.httpStatus !== null && reference.httpStatus < 500;
+    steps.push({
+        name: "Central Auth bereikbaar",
+        ok: centralReachable,
+        target: `GET ${cfg.host}/api/accounts/${REFERENCE_PROVIDER}`,
+        httpStatus: reference.httpStatus,
+        summary: reference.reachable
+            ? centralReachable
+                ? `Central Auth antwoordt (HTTP ${reference.httpStatus}).`
+                : `Central Auth antwoordt met een serverfout (HTTP ${reference.httpStatus}).`
+            : `Central Auth is niet te bereiken: ${reference.error ?? "onbekende netwerkfout"}`,
+        body: null,
+        code: centralReachable ? null : reference.reachable ? "central_server_error" : "central_unreachable",
+        hint: centralReachable
+            ? null
+            : "Controleer of de Central Auth-module online is en of CENTRAL_AUTH_URL naar de juiste host wijst.",
+    });
+    // Stap 3: accounts ophalen bij Central Auth.
+    let accounts = [];
+    try {
+        accounts = await listProviderAccounts(GOOGLE_PROVIDER);
+        const account = firstAccount(accounts);
+        steps.push({
+            name: "Google-account in Central Auth",
+            ok: Boolean(account),
+            target: `GET /api/accounts/${GOOGLE_PROVIDER}`,
+            httpStatus: null,
+            summary: account
+                ? `Account "${account.accountKey}" met status "${account.status}".`
+                : "Central Auth gaf geen Google-account terug.",
+            body: bodyToText(accounts),
+            code: account ? null : "no_account",
+            hint: account
+                ? null
+                : "Koppel een Google-account in Central Auth (provider: google_maps) en draai de diagnose opnieuw.",
+        });
+        if (!account) {
+            hints.push("Er is nog geen Google-account gekoppeld in Central Auth.");
+            checklist.push("Koppel een Google-account in Central Auth (provider: google_maps).");
+        }
+    }
+    catch (error) {
+        const googleProbe = await probeCentralAccounts(GOOGLE_PROVIDER);
+        let summary;
+        let code;
+        let hint;
+        if (googleProbe.httpStatus === 401 || googleProbe.httpStatus === 403) {
+            summary = "Central Auth wijst de aanroep af: het secret klopt niet.";
+            code = "central_unauthorized";
+            hint = "Controleer CENTRAL_AUTH_SECRET in de server-omgeving van deze module.";
+            hints.push("CENTRAL_AUTH_SECRET wordt door Central Auth geweigerd.");
+            checklist.push("Zet het juiste CENTRAL_AUTH_SECRET in de server-omgeving.");
+        }
+        else if (googleProbe.httpStatus === 404) {
+            summary = `Provider "google_maps" is niet bekend in Central Auth (HTTP 404, unknown_provider).`;
+            code = "provider_not_registered";
+            hint =
+                "Richt de provider google_maps in binnen de Central Auth-module en koppel daar een Google-account met een Maps API-key.";
+            hints.push("De provider google_maps bestaat nog niet in Central Auth; deze module krijgt daardoor geen API-key.");
+            checklist.push("Richt provider google_maps in binnen de Central Auth-module en koppel een Google-account.");
+        }
+        else if (centralReachable && googleProbe.httpStatus !== null && googleProbe.httpStatus >= 500) {
+            summary = `Central Auth gaf een serverfout (HTTP ${googleProbe.httpStatus}).`;
+            code = "central_server_error";
+            hint = "Bekijk de logs van de Central Auth-module; de aanvraag liep daar vast.";
+            hints.push("Central Auth gaf een serverfout terug.");
+        }
+        else if (!googleProbe.reachable) {
+            summary = `Central Auth niet bereikbaar: ${googleProbe.error ?? errSummary(error)}`;
+            code = "central_unreachable";
+            hint = "Controleer of Central Auth online is en of CENTRAL_AUTH_URL juist is.";
+            hints.push("Central Auth is niet bereikbaar.");
+            checklist.push("Controleer CENTRAL_AUTH_URL en of de Central Auth-module online is.");
+        }
+        else {
+            summary = errSummary(error);
+            code = "central_error";
+            hint = "Controleer de Central Auth-module en draai de diagnose opnieuw.";
+            hints.push("Central Auth gaf een onverwachte fout terug.");
+        }
+        steps.push({
+            name: "Google-account in Central Auth",
+            ok: false,
+            target: `GET /api/accounts/${GOOGLE_PROVIDER}`,
+            httpStatus: googleProbe.httpStatus,
+            summary,
+            body: null,
+            code,
+            hint,
+        });
+        return { measuredAt: new Date().toISOString(), centralHost: cfg.host, secretPresent: true, steps, hints, checklist };
+    }
+    // Stap 4: API-key ophalen.
+    let tokenOk = false;
+    try {
+        const { expiresAt } = await fetchGoogleApiKey();
+        tokenOk = true;
+        steps.push({
+            name: "Google Maps API-key ophalen",
+            ok: true,
+            target: `POST /api/token/${GOOGLE_PROVIDER} {"environment":"live"}`,
+            httpStatus: 200,
+            summary: expiresAt
+                ? `API-key ontvangen, geldig tot ${expiresAt}.`
+                : "API-key ontvangen van Central Auth.",
+            body: null,
+        });
+    }
+    catch (error) {
+        steps.push({
+            name: "Google Maps API-key ophalen",
+            ok: false,
+            target: `POST /api/token/${GOOGLE_PROVIDER} {"environment":"live"}`,
+            httpStatus: null,
+            summary: `API-key ophalen mislukt: ${errSummary(error)}`,
+            body: null,
+            code: "key_unavailable",
+            hint: "Controleer of het google_maps-account in Central Auth actief is en een geldige Maps API-key bevat.",
+        });
+        hints.push("De Google Maps API-key kon niet worden opgehaald via Central Auth.");
+        checklist.push("Verifieer in Central Auth dat het google_maps-account actief is en een geldige API-key heeft.");
+    }
+    // Stappen 4 & 5: Google-aanroepen (alleen als token gelukt is).
+    if (tokenOk) {
+        steps.push(await probeGoogle("Google Geocoding-test", "POST https://places.googleapis.com/v1/places:searchText"));
+        steps.push(await probeGoogle("Google Routes-test", "POST https://routes.googleapis.com/distanceMatrix/v2:computeRouteMatrix"));
+    }
+    // Stap 6: Supabase-toegang.
+    steps.push(await probeSupabase());
+    // Hints afleiden uit de Google-stappen.
+    for (const step of steps) {
+        if (!step.ok && step.hint && !hints.includes(step.hint))
+            hints.push(step.hint);
+    }
+    return {
+        measuredAt: new Date().toISOString(),
+        centralHost: cfg.host,
+        secretPresent: true,
+        steps,
+        hints,
+        checklist,
+    };
+}
+/** Lichte test-aanroep voor de statustab ("Verbinding testen"). */
+export async function testGoogleConnectionLive() {
+    try {
+        const { geocodeAddress } = await import("./google-maps.server");
+        const result = await geocodeAddress("Damrak 70, Amsterdam");
+        if (!result) {
+            return { ok: false, message: "Google gaf geen adresresultaat terug.", detail: null };
+        }
+        return {
+            ok: true,
+            message: `Verbinding werkt — Google gaf "${result.formattedAddress}" terug.`,
+            detail: null,
+        };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return {
+            ok: false,
+            message: "Verbinding testen is niet gelukt.",
+            detail: reason.slice(0, 300),
+        };
+    }
+}

package/dist-lib/lib/google-maps.server.d.ts

@@ -0,0 +1,22 @@
+export interface GeocodeResult {
+    formattedAddress: string;
+    lat: number;
+    lng: number;
+    placeId: string;
+}
+export interface LatLng {
+    lat: number;
+    lng: number;
+}
+export interface MatrixElement {
+    originIndex: number;
+    destinationIndex: number;
+    durationSec: number | null;
+    distanceM: number | null;
+    status: "ok" | "unreachable";
+}
+/** Zet één adres om naar coördinaten via Places Text Search. */
+export declare function geocodeAddress(rawAddress: string): Promise<GeocodeResult | null>;
+/** Reistijdmatrix (max 25x25 elementen per aanroep). */
+export declare function computeRouteMatrix(origins: LatLng[], destinations: LatLng[], mode?: string): Promise<MatrixElement[]>;
+//# sourceMappingURL=google-maps.server.d.ts.map

package/dist-lib/lib/google-maps.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-maps.server.d.ts","sourceRoot":"","sources":["../../src/lib/google-maps.server.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,IAAI,GAAG,aAAa,CAAC;CAC9B;AAyBD,gEAAgE;AAChE,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAwB/B;AASD,wDAAwD;AACxD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,IAAI,SAAU,GACb,OAAO,CAAC,aAAa,EAAE,CAAC,CAiC1B"}