[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_229":230,"_231":232},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",37,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","index.ts","latestPath","fileId","828c2900-ad59-11f1-99a3-1607ee4eb77e","name","fileType","http","content","// Abschlag – Buchungssystem für den Golfsimulator (und später weitere Ressourcen).\n// HTTP-Val: Hono + std/sqlite. Diese Datei ist der HTTP-Einstieg.\n\nimport { Hono } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { email as sendEmail } from \"https://esm.town/v/std/email\";\nimport {\n canCancel,\n DEFAULT_GOLF,\n evaluateBooking,\n seatsAvailableFor,\n slotHours,\n type Member,\n type Resource,\n type Seat,\n} from \"./lib/rules.ts\";\nimport { addDays, isValidDate, localNow, slotStartEpoch } from \"./lib/time.ts\";\n\n// ───────────────────────── Schema ─────────────────────────\n\nconst ADMIN_NAME = Deno.env.get(\"ADMIN_NAME\") ?? \"Kirk Lenke\";\nconst SESSION_DAYS = 90;\n\nasync function initDb() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS members (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL UNIQUE COLLATE NOCASE,\n pin_hash TEXT,\n pin_salt TEXT,\n invite_code TEXT,\n is_vip INTEGER NOT NULL DEFAULT 0,\n is_admin INTEGER NOT NULL DEFAULT 0,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS resources (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n capacity INTEGER NOT NULL,\n vip_reserved INTEGER NOT NULL,\n reserve_release_hours INTEGER NOT NULL,\n lead_days_vip INTEGER NOT NULL,\n lead_days_std INTEGER NOT NULL,\n weekday_open INTEGER NOT NULL,\n weekday_close INTEGER NOT NULL,\n weekend_open INTEGER NOT NULL,\n weekend_close INTEGER NOT NULL,\n max_open_per_member INTEGER NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n sort INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY,\n resource_id TEXT NOT NULL,\n member_id INTEGER NOT NULL,\n date TEXT NOT NULL,\n hour INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n UNIQUE(resource_id, date, hour, member_id)\n )`,\n `CREATE INDEX IF NOT EXISTS bookings_slot ON bookings(resource_id, date, hour)`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n member_id INTEGER NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n ]);\n\n // Migrationen für bestehende Datenbanken\n for (const sql of [\n \"ALTER TABLE members ADD COLUMN alias TEXT\",\n \"ALTER TABLE members ADD COLUMN reset_requested_at TEXT\",\n \"ALTER TABLE members ADD COLUMN email TEXT\",\n ]) {\n try { await sqlite.execute(sql); } catch (_) { /* Spalte existiert schon */ }\n }\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_alias ON members(alias COLLATE NOCASE)\");\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_email ON members(email COLLATE NOCASE)\");\n\n const r = await sqlite.execute(\"SELECT COUNT(*) AS n FROM resources\");\n if (Number(r.rows[0].n) === 0) await upsertResource(DEFAULT_GOLF);\n\n const m = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members\");\n if (Number(m.rows[0].n) === 0) {\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_admin, is_vip) VALUES (?, ?, 1, 1)\",\n args: [ADMIN_NAME, code],\n });\n console.log(`Admin \"${ADMIN_NAME}\" angelegt. Einladungscode: ${code}`);\n }\n}\nconst ready = initDb();\n\n// ───────────────────────── Helfer ─────────────────────────\n\nfunction newInviteCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\"; // ohne 0/O/1/I\n const bytes = crypto.getRandomValues(new Uint8Array(6));\n let s = \"\";\n for (const b of bytes) s += alphabet[b % alphabet.length];\n return s.slice(0, 3) + \"-\" + s.slice(3);\n}\n\nfunction hex(buf: ArrayBuffer | Uint8Array): string {\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPin(pin: string, saltHex: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", new TextEncoder().encode(pin), \"PBKDF2\", false, [\"deriveBits\"]);\n const salt = Uint8Array.from(saltHex.match(/../g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits({ name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations: 120_000 }, key, 256);\n return hex(bits);\n}\n\nfunction validPin(pin: unknown): pin is string {\n return typeof pin === \"string\" && /^\\d{4,8}$/.test(pin);\n}\n\nfunction cleanName(name: unknown): string | null {\n if (typeof name !== \"string\") return null;\n const n = name.replace(/\\s+/g, \" \").trim();\n if (n.length < 3 || n.length > 60) return null;\n if (!/^[\\p{L}][\\p{L}\\p{M}' .-]*\\s[\\p{L}][\\p{L}\\p{M}' .-]*$/u.test(n)) return null; // Vor- und Nachname\n return n;\n}\n\nfunction cleanEmail(v: unknown): string | null {\n if (typeof v !== \"string\") return null;\n const e = v.trim().toLowerCase();\n return e.length <= 120 && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(e) ? e : null;\n}\n\nconst ALIAS_RE = /^[\\p{L}\\p{N}][\\p{L}\\p{N}._-]{2,19}$/u;\nfunction cleanAlias(alias: unknown): string | null {\n if (typeof alias !== \"string\") return null;\n const a = alias.trim();\n return ALIAS_RE.test(a) ? a : null;\n}\n\n/** Findet ein aktives Mitglied über Klarnamen oder Alias. */\nasync function findByLogin(input: unknown): Promise | null> {\n if (typeof input !== \"string\") return null;\n const raw = input.replace(/\\s+/g, \" \").trim();\n if (!raw) return null;\n const name = cleanName(raw);\n const r = await sqlite.execute({\n sql: \"SELECT * FROM members WHERE active = 1 AND (name = ? OR alias = ? COLLATE NOCASE OR email = ? COLLATE NOCASE) LIMIT 1\",\n args: [name ?? raw, raw, raw.toLowerCase()],\n });\n return r.rows[0] ?? null;\n}\n\nfunction normCode(code: unknown): string {\n return String(code ?? \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\").replace(/^(.{3})(.{3})$/, \"$1-$2\");\n}\n\nfunction rowToMember(row: Record): Member {\n return {\n id: Number(row.id),\n name: String(row.name),\n alias: row.alias ? String(row.alias) : null,\n isVip: Number(row.is_vip) === 1,\n isAdmin: Number(row.is_admin) === 1,\n active: Number(row.active) === 1,\n };\n}\n\nfunction rowToResource(row: Record): Resource {\n return {\n id: String(row.id),\n name: String(row.name),\n capacity: Number(row.capacity),\n vipReserved: Number(row.vip_reserved),\n reserveReleaseHours: Number(row.reserve_release_hours),\n leadDaysVip: Number(row.lead_days_vip),\n leadDaysStd: Number(row.lead_days_std),\n weekdayOpen: Number(row.weekday_open),\n weekdayClose: Number(row.weekday_close),\n weekendOpen: Number(row.weekend_open),\n weekendClose: Number(row.weekend_close),\n maxOpenPerMember: Number(row.max_open_per_member),\n active: Number(row.active),\n };\n}\n\nasync function upsertResource(r: Resource, sort = 0) {\n await sqlite.execute({\n sql: `INSERT INTO resources (id, name, capacity, vip_reserved, reserve_release_hours, lead_days_vip, lead_days_std,\n weekday_open, weekday_close, weekend_open, weekend_close, max_open_per_member, active, sort)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET name=excluded.name, capacity=excluded.capacity, vip_reserved=excluded.vip_reserved,\n reserve_release_hours=excluded.reserve_release_hours, lead_days_vip=excluded.lead_days_vip,\n lead_days_std=excluded.lead_days_std, weekday_open=excluded.weekday_open, weekday_close=excluded.weekday_close,\n weekend_open=excluded.weekend_open, weekend_close=excluded.weekend_close,\n max_open_per_member=excluded.max_open_per_member, active=excluded.active`,\n args: [\n r.id, r.name, r.capacity, r.vipReserved, r.reserveReleaseHours, r.leadDaysVip, r.leadDaysStd,\n r.weekdayOpen, r.weekdayClose, r.weekendOpen, r.weekendClose, r.maxOpenPerMember, r.active, sort,\n ],\n });\n}\n\nasync function getResource(id: string): Promise {\n const r = await sqlite.execute({ sql: \"SELECT * FROM resources WHERE id = ?\", args: [id] });\n return r.rows[0] ? rowToResource(r.rows[0]) : null;\n}\n\nasync function listResources(onlyActive: boolean): Promise {\n const r = await sqlite.execute(\n onlyActive ? \"SELECT * FROM resources WHERE active = 1 ORDER BY sort, name\" : \"SELECT * FROM resources ORDER BY sort, name\",\n );\n return r.rows.map(rowToResource);\n}\n\nasync function seatsFor(resourceId: string, date: string, hour: number): Promise {\n const r = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? AND b.hour = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date, hour],\n });\n return r.rows.map((row) => ({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n }));\n}\n\nasync function openBookingCount(resourceId: string, memberId: number): Promise {\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT date, hour FROM bookings WHERE resource_id = ? AND member_id = ? AND date >= ?`,\n args: [resourceId, memberId, now.date],\n });\n return r.rows.filter((row) => slotStartEpoch(String(row.date), Number(row.hour)) > now.epoch).length;\n}\n\n// ───────────────────────── Auth ─────────────────────────\n\ntype Env = { Variables: { member: Member | null } };\nconst app = new Hono();\n\napp.use(\"*\", async (c, next) => {\n await ready;\n c.set(\"member\", null);\n const token = getCookie(c, \"abschlag_session\");\n if (token) {\n const r = await sqlite.execute({\n sql: `SELECT m.* FROM sessions s JOIN members m ON m.id = s.member_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND m.active = 1`,\n args: [token],\n });\n if (r.rows[0]) c.set(\"member\", rowToMember(r.rows[0]));\n }\n await next();\n});\n\nfunction requireMember(c: any): Member {\n const m = c.get(\"member\") as Member | null;\n if (!m) throw new HttpError(401, \"Bitte anmelden.\");\n return m;\n}\nfunction requireAdmin(c: any): Member {\n const m = requireMember(c);\n if (!m.isAdmin) throw new HttpError(403, \"Nur für Administratoren.\");\n return m;\n}\nclass HttpError extends Error {\n constructor(public status: number, message: string) {\n super(message);\n }\n}\napp.onError((err, c) => {\n if (err instanceof HttpError) return c.json({ error: err.message }, err.status as any);\n console.error(err);\n return c.json({ error: \"Interner Fehler: \" + err.message }, 500);\n});\n\nasync function createSession(c: any, memberId: number) {\n const token = hex(crypto.getRandomValues(new Uint8Array(32)));\n const expires = new Date(Date.now() + SESSION_DAYS * 86400_000);\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, member_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, memberId, expires.toISOString().replace(\"T\", \" \").slice(0, 19)],\n });\n setCookie(c, \"abschlag_session\", token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n expires,\n });\n}\n\n// ───────────────────────── Seiten & Assets ─────────────────────────\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ───────────────────────── Öffentliche API ─────────────────────────\n\napp.get(\"/api/me\", async (c) => {\n const member = c.get(\"member\");\n const setup = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE pin_hash IS NOT NULL\");\n const firstRun = Number(setup.rows[0].n) === 0;\n let setupCode: string | null = null;\n if (firstRun) {\n const a = await sqlite.execute(\"SELECT name, invite_code FROM members WHERE is_admin = 1 ORDER BY id LIMIT 1\");\n if (a.rows[0]) setupCode = `${a.rows[0].name} · ${a.rows[0].invite_code}`;\n }\n let pendingResets = 0;\n if (member?.isAdmin) {\n const p = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE reset_requested_at IS NOT NULL AND active = 1\");\n pendingResets = Number(p.rows[0].n);\n }\n return c.json({\n member,\n resources: await listResources(true),\n now: localNow(),\n setupCode,\n pendingResets,\n });\n});\n\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const code = normCode(body.code);\n if (!validPin(body.pin)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const row = await findByLogin(body.name);\n if (!row || !row.invite_code || String(row.invite_code) !== code) {\n throw new HttpError(400, \"Name oder Einladungscode stimmen nicht.\");\n }\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.pin, salt);\n await sqlite.execute({\n sql: \"UPDATE members SET pin_hash = ?, pin_salt = ?, invite_code = NULL, reset_requested_at = NULL WHERE id = ?\",\n args: [pinHash, salt, Number(row.id)],\n });\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember({ ...row, pin_hash: pinHash }) });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.pin)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n const row = await findByLogin(body.name);\n if (!row) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n if (!row.pin_hash) throw new HttpError(400, \"Für diesen Namen wurde noch keine PIN festgelegt – bitte zuerst mit dem Einladungscode registrieren.\");\n const check = await hashPin(body.pin, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember(row) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const token = getCookie(c, \"abschlag_session\");\n if (token) await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n deleteCookie(c, \"abschlag_session\", { path: \"/\" });\n return c.json({ ok: true });\n});\n\n// „PIN vergessen“: hinterlegt eine Anfrage, die der Verwalter in der Verwaltung sieht.\n// Antwortet immer gleich, damit niemand Namen ausprobieren kann.\napp.post(\"/api/reset-request\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const row = await findByLogin(body.name);\n if (row && row.pin_hash) {\n await sqlite.execute({\n sql: \"UPDATE members SET reset_requested_at = datetime('now') WHERE id = ?\",\n args: [Number(row.id)],\n });\n }\n return c.json({ ok: true });\n});\n\n// ───────────────────────── Profil ─────────────────────────\n\napp.post(\"/api/profile/alias\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (body.alias === \"\" || body.alias === null) {\n await sqlite.execute({ sql: \"UPDATE members SET alias = NULL WHERE id = ?\", args: [member.id] });\n return c.json({ ok: true, alias: null });\n }\n const alias = cleanAlias(body.alias);\n if (!alias) throw new HttpError(400, \"Alias: 3–20 Zeichen, Buchstaben, Ziffern, Punkt, Bindestrich oder Unterstrich.\");\n if (alias.includes(\" \")) throw new HttpError(400, \"Ein Alias darf keine Leerzeichen enthalten.\");\n const clash = await sqlite.execute({\n sql: \"SELECT id FROM members WHERE (alias = ? COLLATE NOCASE OR name = ?) AND id != ?\",\n args: [alias, alias, member.id],\n });\n if (clash.rows[0]) throw new HttpError(409, \"Dieser Alias ist schon vergeben.\");\n await sqlite.execute({ sql: \"UPDATE members SET alias = ? WHERE id = ?\", args: [alias, member.id] });\n return c.json({ ok: true, alias });\n});\n\napp.post(\"/api/profile/pin\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.current) || !validPin(body.next)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const r = await sqlite.execute({ sql: \"SELECT pin_hash, pin_salt FROM members WHERE id = ?\", args: [member.id] });\n const row = r.rows[0];\n const check = await hashPin(body.current, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Die aktuelle PIN stimmt nicht.\");\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.next, salt);\n const token = getCookie(c, \"abschlag_session\");\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = ?, pin_salt = ? WHERE id = ?\", args: [pinHash, salt, member.id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ? AND token != ?\", args: [member.id, token ?? \"\"] },\n ]);\n return c.json({ ok: true });\n});\n\n// ───────────────────────── Slots & Buchungen ─────────────────────────\n\napp.get(\"/api/slots\", async (c) => {\n const member = requireMember(c);\n const resourceId = c.req.query(\"resource\") ?? \"golf\";\n const date = c.req.query(\"date\");\n if (!isValidDate(date)) throw new HttpError(400, \"Ungültiges Datum.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const rows = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, b.hour, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date],\n });\n const byHour = new Map();\n for (const row of rows.rows) {\n const h = Number(row.hour);\n if (!byHour.has(h)) byHour.set(h, []);\n byHour.get(h)!.push({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n });\n }\n const openCount = await openBookingCount(resourceId, member.id);\n\n const slots = slotHours(resource, date).map((hour) => {\n const seats = byHour.get(hour) ?? [];\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n const startMs = slotStartEpoch(date, hour);\n const avail = seatsAvailableFor(resource, member, seats, startMs, now.epoch);\n const mine = seats.find((s) => s.memberId === member.id) ?? null;\n return {\n hour,\n seats,\n capacity: resource.capacity,\n freeForYou: avail.free,\n reserveActive: avail.reserveActive,\n past: startMs <= now.epoch,\n canBook: verdict.ok,\n reasonCode: verdict.code,\n reason: verdict.reason,\n myBookingId: mine?.bookingId ?? null,\n canCancel: !!mine && canCancel({ date, hour, now }),\n };\n });\n\n return c.json({ date, resource, slots, openCount, now });\n});\n\napp.post(\"/api/bookings\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n const resourceId = String(body.resource ?? \"golf\");\n const date = body.date;\n const hour = Number(body.hour);\n if (!isValidDate(date) || !Number.isInteger(hour)) throw new HttpError(400, \"Ungültiger Termin.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const seats = await seatsFor(resourceId, date, hour);\n const openCount = await openBookingCount(resourceId, member.id);\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n if (!verdict.ok) throw new HttpError(409, verdict.reason);\n\n const ins = await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO bookings (resource_id, member_id, date, hour) VALUES (?, ?, ?, ?)\",\n args: [resourceId, member.id, date, hour],\n });\n const id = Number(ins.lastInsertRowid);\n\n // Schutz gegen gleichzeitige Buchungen: nach dem Schreiben noch einmal zählen.\n const after = await seatsFor(resourceId, date, hour);\n const mine = after.find((s) => s.memberId === member.id);\n if (after.length > resource.capacity && mine && after.indexOf(mine) >= resource.capacity) {\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [mine.bookingId] });\n throw new HttpError(409, \"Diese Stunde wurde gerade von jemand anderem gefüllt.\");\n }\n return c.json({ ok: true, id: mine?.bookingId ?? id });\n});\n\napp.delete(\"/api/bookings/:id\", async (c) => {\n const member = requireMember(c);\n const id = Number(c.req.param(\"id\"));\n const r = await sqlite.execute({ sql: \"SELECT * FROM bookings WHERE id = ?\", args: [id] });\n const row = r.rows[0];\n if (!row) throw new HttpError(404, \"Buchung nicht gefunden.\");\n if (Number(row.member_id) !== member.id && !member.isAdmin) throw new HttpError(403, \"Das ist nicht deine Buchung.\");\n if (!canCancel({ date: String(row.date), hour: Number(row.hour), now: localNow() })) {\n throw new HttpError(409, \"Der Termin hat bereits begonnen und kann nicht mehr storniert werden.\");\n }\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [id] });\n return c.json({ ok: true });\n});\n\napp.get(\"/api/bookings/mine\", async (c) => {\n const member = requireMember(c);\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, r.name AS resource_name, b.date, b.hour\n FROM bookings b JOIN resources r ON r.id = b.resource_id\n WHERE b.member_id = ? AND b.date >= ? ORDER BY b.date, b.hour`,\n args: [member.id, addDays(now.date, -1)],\n });\n const bookings = r.rows\n .map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n resourceName: String(row.resource_name),\n date: String(row.date),\n hour: Number(row.hour),\n }))\n .filter((b) => slotStartEpoch(b.date, b.hour) + 3600_000 > now.epoch);\n return c.json({ bookings });\n});\n\n// ───────────────────────── Admin ─────────────────────────\n\napp.get(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const r = await sqlite.execute(\"SELECT * FROM members ORDER BY active DESC, name\");\n return c.json({\n members: r.rows.map((row) => ({\n ...rowToMember(row),\n registered: !!row.pin_hash,\n inviteCode: row.invite_code ? String(row.invite_code) : null,\n resetRequestedAt: row.reset_requested_at ? String(row.reset_requested_at) : null,\n createdAt: String(row.created_at),\n })),\n });\n});\n\napp.post(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const body = await c.req.json().catch(() => ({}));\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Bitte Vor- und Nachnamen eingeben (z. B. „Anna Müller“).\");\n const dup = await sqlite.execute({ sql: \"SELECT id FROM members WHERE name = ? OR alias = ? COLLATE NOCASE\", args: [name, name] });\n if (dup.rows[0]) throw new HttpError(409, \"Diesen Namen gibt es schon.\");\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_vip) VALUES (?, ?, ?)\",\n args: [name, code, body.isVip ? 1 : 0],\n });\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.patch(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const sets: string[] = [];\n const args: unknown[] = [];\n if (typeof body.isVip === \"boolean\") { sets.push(\"is_vip = ?\"); args.push(body.isVip ? 1 : 0); }\n if (typeof body.isAdmin === \"boolean\") {\n if (id === admin.id && !body.isAdmin) throw new HttpError(400, \"Du kannst dir nicht selbst die Admin-Rechte entziehen.\");\n sets.push(\"is_admin = ?\"); args.push(body.isAdmin ? 1 : 0);\n }\n if (typeof body.active === \"boolean\") {\n if (id === admin.id && !body.active) throw new HttpError(400, \"Du kannst dich nicht selbst deaktivieren.\");\n sets.push(\"active = ?\"); args.push(body.active ? 1 : 0);\n }\n if (body.name !== undefined) {\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Ungültiger Name.\");\n sets.push(\"name = ?\"); args.push(name);\n }\n if (!sets.length) throw new HttpError(400, \"Nichts zu ändern.\");\n args.push(id);\n await sqlite.execute({ sql: `UPDATE members SET ${sets.join(\", \")} WHERE id = ?`, args });\n if (body.active === false) {\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ? AND date >= date('now')\", args: [id] },\n ]);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/admin/members/:id/reset\", async (c) => {\n requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const code = newInviteCode();\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = NULL, pin_salt = NULL, invite_code = ?, reset_requested_at = NULL WHERE id = ?\", args: [code, id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n ]);\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.delete(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n if (id === admin.id) throw new HttpError(400, \"Du kannst dich nicht selbst löschen.\");\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM members WHERE id = ?\", args: [id] },\n ]);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/resources\", async (c) => {\n requireAdmin(c);\n return c.json({ resources: await listResources(false) });\n});\n\napp.put(\"/api/admin/resources/:id\", async (c) => {\n requireAdmin(c);\n const id = c.req.param(\"id\");\n const body = await c.req.json().catch(() => ({}));\n const existing = await getResource(id);\n const base: Resource = existing ?? { ...DEFAULT_GOLF, id, name: id };\n const num = (key: keyof Resource, min: number, max: number) => {\n const v = body[key] === undefined ? base[key] : Number(body[key]);\n if (!Number.isInteger(v) || v < min || v > max) throw new HttpError(400, `Ungültiger Wert für ${key}.`);\n return v as number;\n };\n const r: Resource = {\n id,\n name: typeof body.name === \"string\" && body.name.trim() ? body.name.trim().slice(0, 40) : base.name,\n capacity: num(\"capacity\", 1, 50),\n vipReserved: num(\"vipReserved\", 0, 50),\n reserveReleaseHours: num(\"reserveReleaseHours\", 0, 240),\n leadDaysVip: num(\"leadDaysVip\", 0, 90),\n leadDaysStd: num(\"leadDaysStd\", 0, 90),\n weekdayOpen: num(\"weekdayOpen\", 0, 23),\n weekdayClose: num(\"weekdayClose\", 1, 24),\n weekendOpen: num(\"weekendOpen\", 0, 23),\n weekendClose: num(\"weekendClose\", 1, 24),\n maxOpenPerMember: num(\"maxOpenPerMember\", 1, 50),\n active: body.active === undefined ? base.active : (body.active ? 1 : 0),\n };\n if (r.vipReserved > r.capacity) throw new HttpError(400, \"Reservierte Plätze dürfen die Kapazität nicht übersteigen.\");\n if (r.weekdayOpen >= r.weekdayClose || r.weekendOpen >= r.weekendClose) throw new HttpError(400, \"Öffnung muss vor Schließung liegen.\");\n await upsertResource(r, existing ? undefined : 10);\n return c.json({ ok: true, resource: r });\n});\n\napp.get(\"/api/admin/bookings\", async (c) => {\n requireAdmin(c);\n const now = localNow();\n const from = c.req.query(\"from\") ?? now.date;\n const to = c.req.query(\"to\") ?? addDays(now.date, 14);\n if (!isValidDate(from) || !isValidDate(to)) throw new HttpError(400, \"Ungültiges Datum.\");\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, b.date, b.hour, b.created_at, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.date BETWEEN ? AND ? ORDER BY b.date, b.hour, b.created_at`,\n args: [from, to],\n });\n return c.json({\n bookings: r.rows.map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n date: String(row.date),\n hour: Number(row.hour),\n createdAt: String(row.created_at),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n })),\n });\n});\n\nexport default app.fetch;\n","// Abschlag – Buchungssystem für den Golfsimulator (und später weitere Ressourcen).\n// HTTP-Val: Hono + std/sqlite. Diese Datei ist der HTTP-Einstieg.\n\nimport { Hono } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { email as sendEmail } from \"https://esm.town/v/std/email\";\nimport {\n canCancel,\n DEFAULT_GOLF,\n evaluateBooking,\n seatsAvailableFor,\n slotHours,\n type Member,\n type Resource,\n type Seat,\n} from \"./lib/rules.ts\";\nimport { addDays, isValidDate, localNow, slotStartEpoch } from \"./lib/time.ts\";\n\n// ───────────────────────── Schema ─────────────────────────\n\nconst ADMIN_NAME = Deno.env.get(\"ADMIN_NAME\") ?? \"Kirk Lenke\";\nconst SESSION_DAYS = 90;\n\nasync function initDb() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS members (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL UNIQUE COLLATE NOCASE,\n pin_hash TEXT,\n pin_salt TEXT,\n invite_code TEXT,\n is_vip INTEGER NOT NULL DEFAULT 0,\n is_admin INTEGER NOT NULL DEFAULT 0,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS resources (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n capacity INTEGER NOT NULL,\n vip_reserved INTEGER NOT NULL,\n reserve_release_hours INTEGER NOT NULL,\n lead_days_vip INTEGER NOT NULL,\n lead_days_std INTEGER NOT NULL,\n weekday_open INTEGER NOT NULL,\n weekday_close INTEGER NOT NULL,\n weekend_open INTEGER NOT NULL,\n weekend_close INTEGER NOT NULL,\n max_open_per_member INTEGER NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n sort INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY,\n resource_id TEXT NOT NULL,\n member_id INTEGER NOT NULL,\n date TEXT NOT NULL,\n hour INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n UNIQUE(resource_id, date, hour, member_id)\n )`,\n `CREATE INDEX IF NOT EXISTS bookings_slot ON bookings(resource_id, date, hour)`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n member_id INTEGER NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n ]);\n\n // Migrationen für bestehende Datenbanken\n for (const sql of [\n \"ALTER TABLE members ADD COLUMN alias TEXT\",\n \"ALTER TABLE members ADD COLUMN reset_requested_at TEXT\",\n \"ALTER TABLE members ADD COLUMN email TEXT\",\n ]) {\n try { await sqlite.execute(sql); } catch (_) { /* Spalte existiert schon */ }\n }\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_alias ON members(alias COLLATE NOCASE)\");\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_email ON members(email COLLATE NOCASE)\");\n\n const r = await sqlite.execute(\"SELECT COUNT(*) AS n FROM resources\");\n if (Number(r.rows[0].n) === 0) await upsertResource(DEFAULT_GOLF);\n\n const m = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members\");\n if (Number(m.rows[0].n) === 0) {\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_admin, is_vip) VALUES (?, ?, 1, 1)\",\n args: [ADMIN_NAME, code],\n });\n console.log(`Admin \"${ADMIN_NAME}\" angelegt. Einladungscode: ${code}`);\n }\n}\nconst ready = initDb();\n\n// ───────────────────────── Helfer ─────────────────────────\n\nfunction newInviteCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\"; // ohne 0/O/1/I\n const bytes = crypto.getRandomValues(new Uint8Array(6));\n let s = \"\";\n for (const b of bytes) s += alphabet[b % alphabet.length];\n return s.slice(0, 3) + \"-\" + s.slice(3);\n}\n\nfunction hex(buf: ArrayBuffer | Uint8Array): string {\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPin(pin: string, saltHex: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", new TextEncoder().encode(pin), \"PBKDF2\", false, [\"deriveBits\"]);\n const salt = Uint8Array.from(saltHex.match(/../g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits({ name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations: 120_000 }, key, 256);\n return hex(bits);\n}\n\nfunction validPin(pin: unknown): pin is string {\n return typeof pin === \"string\" && /^\\d{4,8}$/.test(pin);\n}\n\nfunction cleanName(name: unknown): string | null {\n if (typeof name !== \"string\") return null;\n const n = name.replace(/\\s+/g, \" \").trim();\n if (n.length < 3 || n.length > 60) return null;\n if (!/^[\\p{L}][\\p{L}\\p{M}' .-]*\\s[\\p{L}][\\p{L}\\p{M}' .-]*$/u.test(n)) return null; // Vor- und Nachname\n return n;\n}\n\nfunction cleanEmail(v: unknown): string | null {\n if (typeof v !== \"string\") return null;\n const e = v.trim().toLowerCase();\n return e.length <= 120 && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(e) ? e : null;\n}\n\nconst ALIAS_RE = /^[\\p{L}\\p{N}][\\p{L}\\p{N}._-]{2,19}$/u;\nfunction cleanAlias(alias: unknown): string | null {\n if (typeof alias !== \"string\") return null;\n const a = alias.trim();\n return ALIAS_RE.test(a) ? a : null;\n}\n\n/** Findet ein aktives Mitglied über Klarnamen oder Alias. */\nasync function findByLogin(input: unknown): Promise | null> {\n if (typeof input !== \"string\") return null;\n const raw = input.replace(/\\s+/g, \" \").trim();\n if (!raw) return null;\n const name = cleanName(raw);\n const r = await sqlite.execute({\n sql: \"SELECT * FROM members WHERE active = 1 AND (name = ? OR alias = ? COLLATE NOCASE OR email = ? COLLATE NOCASE) LIMIT 1\",\n args: [name ?? raw, raw, raw.toLowerCase()],\n });\n return r.rows[0] ?? null;\n}\n\nfunction normCode(code: unknown): string {\n return String(code ?? \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\").replace(/^(.{3})(.{3})$/, \"$1-$2\");\n}\n\nfunction rowToMember(row: Record): Member {\n return {\n id: Number(row.id),\n name: String(row.name),\n alias: row.alias ? String(row.alias) : null,\n email: row.email ? String(row.email) : null,\n isVip: Number(row.is_vip) === 1,\n isAdmin: Number(row.is_admin) === 1,\n active: Number(row.active) === 1,\n };\n}\n\nfunction rowToResource(row: Record): Resource {\n return {\n id: String(row.id),\n name: String(row.name),\n capacity: Number(row.capacity),\n vipReserved: Number(row.vip_reserved),\n reserveReleaseHours: Number(row.reserve_release_hours),\n leadDaysVip: Number(row.lead_days_vip),\n leadDaysStd: Number(row.lead_days_std),\n weekdayOpen: Number(row.weekday_open),\n weekdayClose: Number(row.weekday_close),\n weekendOpen: Number(row.weekend_open),\n weekendClose: Number(row.weekend_close),\n maxOpenPerMember: Number(row.max_open_per_member),\n active: Number(row.active),\n };\n}\n\nasync function upsertResource(r: Resource, sort = 0) {\n await sqlite.execute({\n sql: `INSERT INTO resources (id, name, capacity, vip_reserved, reserve_release_hours, lead_days_vip, lead_days_std,\n weekday_open, weekday_close, weekend_open, weekend_close, max_open_per_member, active, sort)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET name=excluded.name, capacity=excluded.capacity, vip_reserved=excluded.vip_reserved,\n reserve_release_hours=excluded.reserve_release_hours, lead_days_vip=excluded.lead_days_vip,\n lead_days_std=excluded.lead_days_std, weekday_open=excluded.weekday_open, weekday_close=excluded.weekday_close,\n weekend_open=excluded.weekend_open, weekend_close=excluded.weekend_close,\n max_open_per_member=excluded.max_open_per_member, active=excluded.active`,\n args: [\n r.id, r.name, r.capacity, r.vipReserved, r.reserveReleaseHours, r.leadDaysVip, r.leadDaysStd,\n r.weekdayOpen, r.weekdayClose, r.weekendOpen, r.weekendClose, r.maxOpenPerMember, r.active, sort,\n ],\n });\n}\n\nasync function getResource(id: string): Promise {\n const r = await sqlite.execute({ sql: \"SELECT * FROM resources WHERE id = ?\", args: [id] });\n return r.rows[0] ? rowToResource(r.rows[0]) : null;\n}\n\nasync function listResources(onlyActive: boolean): Promise {\n const r = await sqlite.execute(\n onlyActive ? \"SELECT * FROM resources WHERE active = 1 ORDER BY sort, name\" : \"SELECT * FROM resources ORDER BY sort, name\",\n );\n return r.rows.map(rowToResource);\n}\n\nasync function seatsFor(resourceId: string, date: string, hour: number): Promise {\n const r = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? AND b.hour = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date, hour],\n });\n return r.rows.map((row) => ({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n }));\n}\n\nasync function openBookingCount(resourceId: string, memberId: number): Promise {\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT date, hour FROM bookings WHERE resource_id = ? AND member_id = ? AND date >= ?`,\n args: [resourceId, memberId, now.date],\n });\n return r.rows.filter((row) => slotStartEpoch(String(row.date), Number(row.hour)) > now.epoch).length;\n}\n\n// ───────────────────────── Auth ─────────────────────────\n\ntype Env = { Variables: { member: Member | null } };\nconst app = new Hono();\n\napp.use(\"*\", async (c, next) => {\n await ready;\n c.set(\"member\", null);\n const token = getCookie(c, \"abschlag_session\");\n if (token) {\n const r = await sqlite.execute({\n sql: `SELECT m.* FROM sessions s JOIN members m ON m.id = s.member_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND m.active = 1`,\n args: [token],\n });\n if (r.rows[0]) c.set(\"member\", rowToMember(r.rows[0]));\n }\n await next();\n});\n\nfunction requireMember(c: any): Member {\n const m = c.get(\"member\") as Member | null;\n if (!m) throw new HttpError(401, \"Bitte anmelden.\");\n return m;\n}\nfunction requireAdmin(c: any): Member {\n const m = requireMember(c);\n if (!m.isAdmin) throw new HttpError(403, \"Nur für Administratoren.\");\n return m;\n}\nclass HttpError extends Error {\n constructor(public status: number, message: string) {\n super(message);\n }\n}\napp.onError((err, c) => {\n if (err instanceof HttpError) return c.json({ error: err.message }, err.status as any);\n console.error(err);\n return c.json({ error: \"Interner Fehler: \" + err.message }, 500);\n});\n\nasync function createSession(c: any, memberId: number) {\n const token = hex(crypto.getRandomValues(new Uint8Array(32)));\n const expires = new Date(Date.now() + SESSION_DAYS * 86400_000);\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, member_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, memberId, expires.toISOString().replace(\"T\", \" \").slice(0, 19)],\n });\n setCookie(c, \"abschlag_session\", token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n expires,\n });\n}\n\n// ───────────────────────── Seiten & Assets ─────────────────────────\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ───────────────────────── Öffentliche API ─────────────────────────\n\napp.get(\"/api/me\", async (c) => {\n const member = c.get(\"member\");\n const setup = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE pin_hash IS NOT NULL\");\n const firstRun = Number(setup.rows[0].n) === 0;\n let setupCode: string | null = null;\n if (firstRun) {\n const a = await sqlite.execute(\"SELECT name, invite_code FROM members WHERE is_admin = 1 ORDER BY id LIMIT 1\");\n if (a.rows[0]) setupCode = `${a.rows[0].name} · ${a.rows[0].invite_code}`;\n }\n let pendingResets = 0;\n if (member?.isAdmin) {\n const p = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE reset_requested_at IS NOT NULL AND active = 1\");\n pendingResets = Number(p.rows[0].n);\n }\n return c.json({\n member,\n resources: await listResources(true),\n now: localNow(),\n setupCode,\n pendingResets,\n });\n});\n\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const code = normCode(body.code);\n if (!validPin(body.pin)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const row = await findByLogin(body.name);\n if (!row || !row.invite_code || String(row.invite_code) !== code) {\n throw new HttpError(400, \"Name oder Einladungscode stimmen nicht.\");\n }\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.pin, salt);\n await sqlite.execute({\n sql: \"UPDATE members SET pin_hash = ?, pin_salt = ?, invite_code = NULL, reset_requested_at = NULL WHERE id = ?\",\n args: [pinHash, salt, Number(row.id)],\n });\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember({ ...row, pin_hash: pinHash }) });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.pin)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n const row = await findByLogin(body.name);\n if (!row) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n if (!row.pin_hash) throw new HttpError(400, \"Für diesen Namen wurde noch keine PIN festgelegt – bitte zuerst mit dem Einladungscode registrieren.\");\n const check = await hashPin(body.pin, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember(row) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const token = getCookie(c, \"abschlag_session\");\n if (token) await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n deleteCookie(c, \"abschlag_session\", { path: \"/\" });\n return c.json({ ok: true });\n});\n\n// „PIN vergessen“: hinterlegt eine Anfrage, die der Verwalter in der Verwaltung sieht.\n// Antwortet immer gleich, damit niemand Namen ausprobieren kann.\napp.post(\"/api/reset-request\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const row = await findByLogin(body.name);\n if (row && row.pin_hash) {\n await sqlite.execute({\n sql: \"UPDATE members SET reset_requested_at = datetime('now') WHERE id = ?\",\n args: [Number(row.id)],\n });\n }\n return c.json({ ok: true });\n});\n\n// ───────────────────────── Profil ─────────────────────────\n\napp.post(\"/api/profile/alias\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (body.alias === \"\" || body.alias === null) {\n await sqlite.execute({ sql: \"UPDATE members SET alias = NULL WHERE id = ?\", args: [member.id] });\n return c.json({ ok: true, alias: null });\n }\n const alias = cleanAlias(body.alias);\n if (!alias) throw new HttpError(400, \"Alias: 3–20 Zeichen, Buchstaben, Ziffern, Punkt, Bindestrich oder Unterstrich.\");\n if (alias.includes(\" \")) throw new HttpError(400, \"Ein Alias darf keine Leerzeichen enthalten.\");\n const clash = await sqlite.execute({\n sql: \"SELECT id FROM members WHERE (alias = ? COLLATE NOCASE OR name = ?) AND id != ?\",\n args: [alias, alias, member.id],\n });\n if (clash.rows[0]) throw new HttpError(409, \"Dieser Alias ist schon vergeben.\");\n await sqlite.execute({ sql: \"UPDATE members SET alias = ? WHERE id = ?\", args: [alias, member.id] });\n return c.json({ ok: true, alias });\n});\n\napp.post(\"/api/profile/pin\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.current) || !validPin(body.next)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const r = await sqlite.execute({ sql: \"SELECT pin_hash, pin_salt FROM members WHERE id = ?\", args: [member.id] });\n const row = r.rows[0];\n const check = await hashPin(body.current, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Die aktuelle PIN stimmt nicht.\");\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.next, salt);\n const token = getCookie(c, \"abschlag_session\");\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = ?, pin_salt = ? WHERE id = ?\", args: [pinHash, salt, member.id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ? AND token != ?\", args: [member.id, token ?? \"\"] },\n ]);\n return c.json({ ok: true });\n});\n\n// ───────────────────────── Slots & Buchungen ─────────────────────────\n\napp.get(\"/api/slots\", async (c) => {\n const member = requireMember(c);\n const resourceId = c.req.query(\"resource\") ?? \"golf\";\n const date = c.req.query(\"date\");\n if (!isValidDate(date)) throw new HttpError(400, \"Ungültiges Datum.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const rows = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, b.hour, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date],\n });\n const byHour = new Map();\n for (const row of rows.rows) {\n const h = Number(row.hour);\n if (!byHour.has(h)) byHour.set(h, []);\n byHour.get(h)!.push({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n });\n }\n const openCount = await openBookingCount(resourceId, member.id);\n\n const slots = slotHours(resource, date).map((hour) => {\n const seats = byHour.get(hour) ?? [];\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n const startMs = slotStartEpoch(date, hour);\n const avail = seatsAvailableFor(resource, member, seats, startMs, now.epoch);\n const mine = seats.find((s) => s.memberId === member.id) ?? null;\n return {\n hour,\n seats,\n capacity: resource.capacity,\n freeForYou: avail.free,\n reserveActive: avail.reserveActive,\n past: startMs <= now.epoch,\n canBook: verdict.ok,\n reasonCode: verdict.code,\n reason: verdict.reason,\n myBookingId: mine?.bookingId ?? null,\n canCancel: !!mine && canCancel({ date, hour, now }),\n };\n });\n\n return c.json({ date, resource, slots, openCount, now });\n});\n\napp.post(\"/api/bookings\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n const resourceId = String(body.resource ?? \"golf\");\n const date = body.date;\n const hour = Number(body.hour);\n if (!isValidDate(date) || !Number.isInteger(hour)) throw new HttpError(400, \"Ungültiger Termin.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const seats = await seatsFor(resourceId, date, hour);\n const openCount = await openBookingCount(resourceId, member.id);\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n if (!verdict.ok) throw new HttpError(409, verdict.reason);\n\n const ins = await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO bookings (resource_id, member_id, date, hour) VALUES (?, ?, ?, ?)\",\n args: [resourceId, member.id, date, hour],\n });\n const id = Number(ins.lastInsertRowid);\n\n // Schutz gegen gleichzeitige Buchungen: nach dem Schreiben noch einmal zählen.\n const after = await seatsFor(resourceId, date, hour);\n const mine = after.find((s) => s.memberId === member.id);\n if (after.length > resource.capacity && mine && after.indexOf(mine) >= resource.capacity) {\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [mine.bookingId] });\n throw new HttpError(409, \"Diese Stunde wurde gerade von jemand anderem gefüllt.\");\n }\n return c.json({ ok: true, id: mine?.bookingId ?? id });\n});\n\napp.delete(\"/api/bookings/:id\", async (c) => {\n const member = requireMember(c);\n const id = Number(c.req.param(\"id\"));\n const r = await sqlite.execute({ sql: \"SELECT * FROM bookings WHERE id = ?\", args: [id] });\n const row = r.rows[0];\n if (!row) throw new HttpError(404, \"Buchung nicht gefunden.\");\n if (Number(row.member_id) !== member.id && !member.isAdmin) throw new HttpError(403, \"Das ist nicht deine Buchung.\");\n if (!canCancel({ date: String(row.date), hour: Number(row.hour), now: localNow() })) {\n throw new HttpError(409, \"Der Termin hat bereits begonnen und kann nicht mehr storniert werden.\");\n }\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [id] });\n return c.json({ ok: true });\n});\n\napp.get(\"/api/bookings/mine\", async (c) => {\n const member = requireMember(c);\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, r.name AS resource_name, b.date, b.hour\n FROM bookings b JOIN resources r ON r.id = b.resource_id\n WHERE b.member_id = ? AND b.date >= ? ORDER BY b.date, b.hour`,\n args: [member.id, addDays(now.date, -1)],\n });\n const bookings = r.rows\n .map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n resourceName: String(row.resource_name),\n date: String(row.date),\n hour: Number(row.hour),\n }))\n .filter((b) => slotStartEpoch(b.date, b.hour) + 3600_000 > now.epoch);\n return c.json({ bookings });\n});\n\n// ───────────────────────── Admin ─────────────────────────\n\napp.get(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const r = await sqlite.execute(\"SELECT * FROM members ORDER BY active DESC, name\");\n return c.json({\n members: r.rows.map((row) => ({\n ...rowToMember(row),\n registered: !!row.pin_hash,\n inviteCode: row.invite_code ? String(row.invite_code) : null,\n resetRequestedAt: row.reset_requested_at ? String(row.reset_requested_at) : null,\n createdAt: String(row.created_at),\n })),\n });\n});\n\napp.post(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const body = await c.req.json().catch(() => ({}));\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Bitte Vor- und Nachnamen eingeben (z. B. „Anna Müller“).\");\n const dup = await sqlite.execute({ sql: \"SELECT id FROM members WHERE name = ? OR alias = ? COLLATE NOCASE\", args: [name, name] });\n if (dup.rows[0]) throw new HttpError(409, \"Diesen Namen gibt es schon.\");\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_vip) VALUES (?, ?, ?)\",\n args: [name, code, body.isVip ? 1 : 0],\n });\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.patch(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const sets: string[] = [];\n const args: unknown[] = [];\n if (typeof body.isVip === \"boolean\") { sets.push(\"is_vip = ?\"); args.push(body.isVip ? 1 : 0); }\n if (typeof body.isAdmin === \"boolean\") {\n if (id === admin.id && !body.isAdmin) throw new HttpError(400, \"Du kannst dir nicht selbst die Admin-Rechte entziehen.\");\n sets.push(\"is_admin = ?\"); args.push(body.isAdmin ? 1 : 0);\n }\n if (typeof body.active === \"boolean\") {\n if (id === admin.id && !body.active) throw new HttpError(400, \"Du kannst dich nicht selbst deaktivieren.\");\n sets.push(\"active = ?\"); args.push(body.active ? 1 : 0);\n }\n if (body.name !== undefined) {\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Ungültiger Name.\");\n sets.push(\"name = ?\"); args.push(name);\n }\n if (!sets.length) throw new HttpError(400, \"Nichts zu ändern.\");\n args.push(id);\n await sqlite.execute({ sql: `UPDATE members SET ${sets.join(\", \")} WHERE id = ?`, args });\n if (body.active === false) {\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ? AND date >= date('now')\", args: [id] },\n ]);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/admin/members/:id/reset\", async (c) => {\n requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const code = newInviteCode();\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = NULL, pin_salt = NULL, invite_code = ?, reset_requested_at = NULL WHERE id = ?\", args: [code, id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n ]);\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.delete(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n if (id === admin.id) throw new HttpError(400, \"Du kannst dich nicht selbst löschen.\");\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM members WHERE id = ?\", args: [id] },\n ]);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/resources\", async (c) => {\n requireAdmin(c);\n return c.json({ resources: await listResources(false) });\n});\n\napp.put(\"/api/admin/resources/:id\", async (c) => {\n requireAdmin(c);\n const id = c.req.param(\"id\");\n const body = await c.req.json().catch(() => ({}));\n const existing = await getResource(id);\n const base: Resource = existing ?? { ...DEFAULT_GOLF, id, name: id };\n const num = (key: keyof Resource, min: number, max: number) => {\n const v = body[key] === undefined ? base[key] : Number(body[key]);\n if (!Number.isInteger(v) || v < min || v > max) throw new HttpError(400, `Ungültiger Wert für ${key}.`);\n return v as number;\n };\n const r: Resource = {\n id,\n name: typeof body.name === \"string\" && body.name.trim() ? body.name.trim().slice(0, 40) : base.name,\n capacity: num(\"capacity\", 1, 50),\n vipReserved: num(\"vipReserved\", 0, 50),\n reserveReleaseHours: num(\"reserveReleaseHours\", 0, 240),\n leadDaysVip: num(\"leadDaysVip\", 0, 90),\n leadDaysStd: num(\"leadDaysStd\", 0, 90),\n weekdayOpen: num(\"weekdayOpen\", 0, 23),\n weekdayClose: num(\"weekdayClose\", 1, 24),\n weekendOpen: num(\"weekendOpen\", 0, 23),\n weekendClose: num(\"weekendClose\", 1, 24),\n maxOpenPerMember: num(\"maxOpenPerMember\", 1, 50),\n active: body.active === undefined ? base.active : (body.active ? 1 : 0),\n };\n if (r.vipReserved > r.capacity) throw new HttpError(400, \"Reservierte Plätze dürfen die Kapazität nicht übersteigen.\");\n if (r.weekdayOpen >= r.weekdayClose || r.weekendOpen >= r.weekendClose) throw new HttpError(400, \"Öffnung muss vor Schließung liegen.\");\n await upsertResource(r, existing ? undefined : 10);\n return c.json({ ok: true, resource: r });\n});\n\napp.get(\"/api/admin/bookings\", async (c) => {\n requireAdmin(c);\n const now = localNow();\n const from = c.req.query(\"from\") ?? now.date;\n const to = c.req.query(\"to\") ?? addDays(now.date, 14);\n if (!isValidDate(from) || !isValidDate(to)) throw new HttpError(400, \"Ungültiges Datum.\");\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, b.date, b.hour, b.created_at, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.date BETWEEN ? AND ? ORDER BY b.date, b.hour, b.created_at`,\n args: [from, to],\n });\n return c.json({\n bookings: r.rows.map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n date: String(row.date),\n hour: Number(row.hour),\n createdAt: String(row.created_at),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n })),\n });\n});\n\nexport default app.fetch;\n","createdAt",["D",1789077864239],"branchVersion","branchId","5c695ecc-ad62-4780-8b26-43dbcfbbf94b","id","e5718bb4-559b-409d-a723-e72077efaced","abschlag",["D",1789073537776],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Buchungssystem Golfsimulator (4 Plätze/Std., VIP, PIN-Login)","imageUrl","aa4a2c1b-3d04-409c-88c5-af54cb1d3470","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a08d16-8467-769a-84f6-caf4cfc8139c","tursoName","e5718bb4559b409da723e72077efaced","tursoHostname","e5718bb4559b409da723e72077efaced-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789512044203],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",60,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Thokolosh","handle","displayName","Kirk Lenke","avatar","https://lh3.googleusercontent.com/a/ACg8ocJoDfrcBCOirw40MHfesVj8rSjuldOifXKqr9767Swx6brFywwEAQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":224,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":225,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":226,"_83":227,"_85":228,"_87":25},"tree",[165,169,172],"files",[165,166,167,168,169,170,171,172],"counts",{"_154":62,"_155":156,"_157":62,"_158":159,"_160":161},"contents",[130,131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":148,"_32":149,"_30":150,"_134":-5,"_41":42,"_40":151,"_135":58,"_38":152,"_13":62,"_33":146,"_35":-5,"_24":25,"_138":-5,"_27":153},{"_43":141,"_32":142,"_30":143,"_134":-5,"_41":42,"_40":144,"_135":58,"_38":145,"_13":62,"_33":146,"_35":-5,"_24":25,"_138":-5,"_27":147},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":136,"_13":137,"_33":34,"_35":37,"_24":25,"_138":139,"_27":140},"598eb220-2afb-4cdb-b280-eb9f455a998f","parentId","latest",["D",1789077864239],17,"label","jk-golfakademie",[28],"7e19e212-95e2-4d25-9bb1-ccec38d87308","lib","d7a76aaf-e82b-46e9-915a-6241250f9ed1",2,["D",1789073571875],"directory",[142],"fe2bec12-2b41-40b5-8547-87442acec0e4","frontend","cf10625b-43cb-4093-a001-6cbdd3410d99",4,["D",1789073648998],[149],"pulls","branches",1,"forks","envVars",{"_162":62,"_164":62},"connections",{"_162":62,"_163":62},"count","unfilledCount","emptyCount",{"_43":148,"_32":149,"_30":150,"_134":-5,"_41":42,"_40":151,"_135":58,"_38":221,"_13":62,"_33":146,"_35":-5,"_24":25,"_138":-5,"_174":222,"_27":223},{"_43":212,"_32":213,"_30":214,"_134":150,"_41":42,"_40":215,"_135":25,"_38":216,"_13":217,"_33":181,"_35":218,"_24":25,"_138":-5,"_174":219,"_27":220},{"_43":204,"_32":205,"_30":206,"_134":150,"_41":42,"_40":207,"_135":25,"_38":208,"_13":156,"_33":20,"_35":209,"_24":25,"_138":-5,"_174":210,"_27":211},{"_43":196,"_32":197,"_30":198,"_134":150,"_41":42,"_40":199,"_135":25,"_38":200,"_13":156,"_33":20,"_35":201,"_24":25,"_138":-5,"_174":202,"_27":203},{"_43":141,"_32":142,"_30":143,"_134":-5,"_41":42,"_40":144,"_135":58,"_38":193,"_13":62,"_33":146,"_35":-5,"_24":25,"_138":-5,"_174":194,"_27":195},{"_43":185,"_32":186,"_30":187,"_134":143,"_41":42,"_40":188,"_135":25,"_38":189,"_13":156,"_33":181,"_35":190,"_24":25,"_138":-5,"_174":191,"_27":192},{"_43":177,"_32":178,"_30":179,"_134":143,"_41":42,"_40":144,"_135":58,"_38":180,"_13":62,"_33":181,"_35":182,"_24":25,"_138":-5,"_174":183,"_27":184},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":173,"_13":137,"_33":34,"_35":37,"_24":25,"_138":139,"_174":175,"_27":176},["D",1789077864239],"children",[],[28],"17a3e205-bb37-449c-9c3e-d7f75c402f74","time.ts","96cd6e74-ad59-11f1-8452-1607ee4eb77e",["D",1789073571875],"script","// Zeitfunktionen für Europe/Berlin – Val Town läuft in UTC, die Buchungen\n// sind aber in lokaler Zeit gedacht. Alle Slots werden als (Datum, Stunde)\n// in Berliner Zeit gespeichert.\n\nexport const TZ = \"Europe/Berlin\";\n\nexport type LocalNow = { date: string; hour: number; minute: number; epoch: number };\n\nconst fmt = new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: TZ,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n hour12: false,\n});\n\n/** Zerlegt einen Zeitpunkt in Berliner Datum/Stunde/Minute. */\nexport function toLocal(epochMs: number): LocalNow {\n const parts: Record = {};\n for (const p of fmt.formatToParts(new Date(epochMs))) parts[p.type] = p.value;\n const hour = Number(parts.hour) % 24; // manche Engines liefern \"24\" für Mitternacht\n return {\n date: `${parts.year}-${parts.month}-${parts.day}`,\n hour,\n minute: Number(parts.minute),\n epoch: epochMs,\n };\n}\n\nexport function localNow(): LocalNow {\n return toLocal(Date.now());\n}\n\n/** Berliner (Datum, Stunde) -> Epoch-Millisekunden, sommerzeitsicher. */\nexport function slotStartEpoch(date: string, hour: number): number {\n const [y, m, d] = date.split(\"-\").map(Number);\n // Erste Annahme: als wäre es UTC, dann Offset zweimal korrigieren.\n let guess = Date.UTC(y, m - 1, d, hour, 0, 0);\n for (let i = 0; i < 2; i++) {\n const loc = toLocal(guess);\n const asUtc = Date.UTC(\n Number(loc.date.slice(0, 4)),\n Number(loc.date.slice(5, 7)) - 1,\n Number(loc.date.slice(8, 10)),\n loc.hour,\n loc.minute,\n );\n guess += Date.UTC(y, m - 1, d, hour) - asUtc;\n }\n return guess;\n}\n\n/** 0 = Sonntag … 6 = Samstag, für ein YYYY-MM-DD in Berliner Zeit. */\nexport function weekday(date: string): number {\n const [y, m, d] = date.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d, 12)).getUTCDay();\n}\n\nexport function isWeekend(date: string): boolean {\n const wd = weekday(date);\n return wd === 0 || wd === 6;\n}\n\n/** Kalendertage von `from` bis `to` (positiv, wenn `to` später liegt). */\nexport function daysBetween(from: string, to: string): number {\n return Math.round((dateUtc(to) - dateUtc(from)) / 86400000);\n}\n\nfunction dateUtc(date: string): number {\n const [y, m, d] = date.split(\"-\").map(Number);\n return Date.UTC(y, m - 1, d);\n}\n\nexport function addDays(date: string, n: number): string {\n const [y, m, d] = date.split(\"-\").map(Number);\n const t = new Date(Date.UTC(y, m - 1, d + n, 12));\n return t.toISOString().slice(0, 10);\n}\n\nexport function isValidDate(s: unknown): s is string {\n if (typeof s !== \"string\" || !/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n const [y, m, d] = s.split(\"-\").map(Number);\n const t = new Date(Date.UTC(y, m - 1, d));\n return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n",[],[142,178],"b1f89918-cf3f-48b0-9efa-d9d1ecf7c6c4","rules.ts","a59a4c10-ad59-11f1-aab1-1607ee4eb77e",8,["D",1789075690497],"// Reine Buchungsregeln – keine Datenbank, kein Netzwerk. Wird vom Server\n// benutzt und lässt sich lokal ohne Val Town testen.\n\nimport { daysBetween, isWeekend, slotStartEpoch, type LocalNow } from \"./time.ts\";\n\nexport type Resource = {\n id: string;\n name: string;\n capacity: number; // Plätze pro Stunde (Golf: 4)\n vipReserved: number; // davon bis kurz vor Termin nur für VIPs (Golf: 1)\n reserveReleaseHours: number; // so viele Stunden vor Start wird die VIP-Reserve für alle frei (24)\n leadDaysVip: number; // VIP-Buchungsvorlauf in Tagen (14)\n leadDaysStd: number; // normaler Vorlauf (7)\n weekdayOpen: number; // Mo–Fr: erste buchbare Stunde (9 = 9:00–10:00)\n weekdayClose: number; // Mo–Fr: Schließzeit (22 = letzter Slot 21:00–22:00)\n weekendOpen: number;\n weekendClose: number;\n maxOpenPerMember: number; // offene (zukünftige) Buchungen pro Spieler und Ressource\n active: number;\n};\n\nexport type Member = { id: number; name: string; alias?: string | null; isVip: boolean; isAdmin: boolean; active: boolean };\n\nexport type Seat = { bookingId: number; memberId: number; name: string; isVip: boolean };\n\nexport type Verdict = {\n ok: boolean;\n code:\n | \"ok\"\n | \"closed\"\n | \"past\"\n | \"lead\"\n | \"full\"\n | \"vip_only\"\n | \"already\"\n | \"limit\";\n reason: string;\n};\n\nexport function openingHours(r: Resource, date: string): { open: number; close: number } {\n return isWeekend(date)\n ? { open: r.weekendOpen, close: r.weekendClose }\n : { open: r.weekdayOpen, close: r.weekdayClose };\n}\n\nexport function slotHours(r: Resource, date: string): number[] {\n const { open, close } = openingHours(r, date);\n const hours: number[] = [];\n for (let h = open; h < close; h++) hours.push(h);\n return hours;\n}\n\n/** Freie Plätze aus Sicht eines bestimmten Spielers. */\nexport function seatsAvailableFor(\n r: Resource,\n member: Member,\n seats: Seat[],\n slotStartMs: number,\n nowMs: number,\n): { free: number; reserveActive: boolean } {\n const total = r.capacity - seats.length;\n const reserveActive = r.vipReserved > 0 && slotStartMs - nowMs > r.reserveReleaseHours * 3600_000;\n if (member.isVip || !reserveActive) return { free: Math.max(0, total), reserveActive };\n // Nicht-VIP: darf nur die nicht reservierten Plätze belegen.\n const nonVipSeats = seats.filter((s) => !s.isVip).length;\n const nonVipCap = r.capacity - r.vipReserved;\n return { free: Math.max(0, Math.min(total, nonVipCap - nonVipSeats)), reserveActive };\n}\n\nexport function evaluateBooking(input: {\n resource: Resource;\n member: Member;\n date: string;\n hour: number;\n seats: Seat[];\n now: LocalNow;\n openBookingsOfMember: number; // zukünftige Buchungen dieses Spielers auf dieser Ressource\n}): Verdict {\n const { resource: r, member, date, hour, seats, now } = input;\n\n const { open, close } = openingHours(r, date);\n if (hour < open || hour >= close) {\n return { ok: false, code: \"closed\", reason: `Außerhalb der Öffnungszeit (${open}–${close} Uhr).` };\n }\n\n const startMs = slotStartEpoch(date, hour);\n if (startMs <= now.epoch) {\n return { ok: false, code: \"past\", reason: \"Dieser Termin liegt in der Vergangenheit.\" };\n }\n\n const lead = member.isVip ? r.leadDaysVip : r.leadDaysStd;\n const daysAhead = daysBetween(now.date, date);\n if (daysAhead > lead) {\n return {\n ok: false,\n code: \"lead\",\n reason: member.isVip\n ? `Buchbar ab ${lead} Tage vor dem Termin.`\n : `Buchbar ab ${lead} Tage vor dem Termin (VIP: ${r.leadDaysVip} Tage).`,\n };\n }\n\n if (seats.some((s) => s.memberId === member.id)) {\n return { ok: false, code: \"already\", reason: \"Du bist in dieser Stunde bereits eingetragen.\" };\n }\n\n if (input.openBookingsOfMember >= r.maxOpenPerMember) {\n return {\n ok: false,\n code: \"limit\",\n reason: `Maximal ${r.maxOpenPerMember} offene Buchungen gleichzeitig.`,\n };\n }\n\n if (seats.length >= r.capacity) {\n return { ok: false, code: \"full\", reason: \"Diese Stunde ist voll.\" };\n }\n\n const { free, reserveActive } = seatsAvailableFor(r, member, seats, startMs, now.epoch);\n if (free <= 0) {\n return {\n ok: false,\n code: reserveActive ? \"vip_only\" : \"full\",\n reason: reserveActive\n ? `Der letzte Platz ist bis ${r.reserveReleaseHours} Std. vor Start für VIPs reserviert.`\n : \"Diese Stunde ist voll.\",\n };\n }\n\n return { ok: true, code: \"ok\", reason: \"\" };\n}\n\nexport function canCancel(input: { date: string; hour: number; now: LocalNow }): boolean {\n return slotStartEpoch(input.date, input.hour) > input.now.epoch;\n}\n\n/** Standardressource: der Golfsimulator. */\nexport const DEFAULT_GOLF: Resource = {\n id: \"golf\",\n name: \"Golfsimulator\",\n capacity: 4,\n vipReserved: 1,\n reserveReleaseHours: 24,\n leadDaysVip: 14,\n leadDaysStd: 7,\n weekdayOpen: 9,\n weekdayClose: 22,\n weekendOpen: 10,\n weekendClose: 21,\n maxOpenPerMember: 3,\n active: 1,\n};\n",[],[142,186],["D",1789073571875],[170,171],[142],"6b2ec41f-3693-4814-a776-c3ac1152b473","style.css","e324ab0c-ad59-11f1-a83b-1607ee4eb77e",20,["D",1789075884379],"/* JK Golfakademie – Buchung\n Farbwelt: Fairway-Grün als Akzent, Gold für VIP, warm-neutrale Grautöne.\n Hell ist Standard, Dunkel folgt der Systemeinstellung oder dem Schalter. */\n\n:root {\n color-scheme: light dark;\n\n /* Hell */\n --ground: #f3f4ef;\n --surface: #ffffff;\n --surface-2: #e9ece4;\n --surface-3: #dfe4dc;\n --ink: #101613;\n --ink-2: #4a554e;\n --muted: #7b857e;\n --line: #dde1d8;\n --line-strong: #c9cfc4;\n --accent: #0e6b3e;\n --accent-hover: #0b5a34;\n --accent-ink: #ffffff;\n --accent-soft: #dcf2e4;\n --accent-glow: rgba(14, 107, 62, .18);\n --gold: #b8892a;\n --gold-soft: #f8efd6;\n --danger: #b9382c;\n --danger-soft: #fbe4e1;\n --hero-a: #0f5a36;\n --hero-b: #0a3d26;\n --hero-ink: #eef6f0;\n --shadow-1: 0 1px 2px rgba(16, 22, 19, .05), 0 1px 1px rgba(16, 22, 19, .03);\n --shadow-2: 0 2px 4px rgba(16, 22, 19, .05), 0 12px 32px -16px rgba(16, 22, 19, .25);\n --glass: rgba(243, 244, 239, .78);\n\n --r-sm: 10px;\n --r-md: 14px;\n --r-lg: 20px;\n --font: \"Manrope\", \"Avenir Next\", \"Segoe UI\", system-ui, sans-serif;\n --mono: \"JetBrains Mono\", ui-monospace, SFMono-Regular, Menlo, monospace;\n --ease: cubic-bezier(.2, .7, .2, 1);\n\n accent-color: var(--accent);\n}\n\n@media (prefers-color-scheme: dark) {\n :root:not([data-theme=\"light\"]) {\n --ground: #0b0f0d; --surface: #131916; --surface-2: #1a221d; --surface-3: #232d27;\n --ink: #ecf1ec; --ink-2: #aeb8b1; --muted: #76817a; --line: #253029; --line-strong: #334039;\n --accent: #3fcf80; --accent-hover: #5adb93; --accent-ink: #06170e; --accent-soft: #143526; --accent-glow: rgba(63, 207, 128, .22);\n --gold: #e0b44e; --gold-soft: #33290f; --danger: #f08a7e; --danger-soft: #3a1d19;\n --hero-a: #133f2a; --hero-b: #0a1f15; --hero-ink: #e7f0e9;\n --shadow-1: 0 1px 2px rgba(0,0,0,.5); --shadow-2: 0 2px 4px rgba(0,0,0,.4), 0 16px 40px -20px rgba(0,0,0,.8);\n --glass: rgba(11, 15, 13, .72);\n }\n}\n:root[data-theme=\"dark\"] {\n --ground: #0b0f0d; --surface: #131916; --surface-2: #1a221d; --surface-3: #232d27;\n --ink: #ecf1ec; --ink-2: #aeb8b1; --muted: #76817a; --line: #253029; --line-strong: #334039;\n --accent: #3fcf80; --accent-hover: #5adb93; --accent-ink: #06170e; --accent-soft: #143526; --accent-glow: rgba(63, 207, 128, .22);\n --gold: #e0b44e; --gold-soft: #33290f; --danger: #f08a7e; --danger-soft: #3a1d19;\n --hero-a: #133f2a; --hero-b: #0a1f15; --hero-ink: #e7f0e9;\n --shadow-1: 0 1px 2px rgba(0,0,0,.5); --shadow-2: 0 2px 4px rgba(0,0,0,.4), 0 16px 40px -20px rgba(0,0,0,.8);\n --glass: rgba(11, 15, 13, .72);\n}\n:root[data-theme=\"light\"] { color-scheme: light; }\n:root[data-theme=\"dark\"] { color-scheme: dark; }\n\n/* ───────── Basis ───────── */\n* { box-sizing: border-box; }\nhtml { -webkit-text-size-adjust: 100%; scroll-behavior: smooth; }\nbody {\n margin: 0; background: var(--ground); color: var(--ink);\n font-family: var(--font); font-size: 15.5px; line-height: 1.55;\n font-variant-numeric: tabular-nums; letter-spacing: -.005em;\n min-height: 100dvh; display: flex; flex-direction: column;\n -webkit-font-smoothing: antialiased;\n}\n.wrap { width: 100%; max-width: 1120px; margin-inline: auto; padding-inline: clamp(16px, 4vw, 32px); }\nmain { flex: 1; padding-block: clamp(20px, 4vw, 40px) 56px; }\nh1, h2, h3 { margin: 0; text-wrap: balance; letter-spacing: -.02em; }\np { margin: 0; }\na { color: var(--accent); }\nbutton { font: inherit; cursor: pointer; color: inherit; }\ninput { font: inherit; color: var(--ink); }\n:focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; border-radius: 6px; }\n[hidden] { display: none !important; }\n.mono { font-family: var(--mono); font-weight: 600; letter-spacing: .02em; }\n::selection { background: var(--accent-soft); color: var(--ink); }\n\n.eyebrow { font-size: 12px; font-weight: 700; letter-spacing: .14em; text-transform: uppercase; color: var(--accent); }\n.page-title { font-size: clamp(30px, 5vw, 44px); font-weight: 800; line-height: 1.05; margin-top: 6px; }\n.sub { color: var(--ink-2); margin-top: 8px; max-width: 60ch; }\n.card-title { font-size: 18px; font-weight: 800; }\n.hint { color: var(--muted); font-size: 13.5px; line-height: 1.5; }\n.error { color: var(--danger); font-size: 14px; font-weight: 500; }\n\n/* ───────── Kopfzeile ───────── */\n.topbar {\n position: sticky; top: 0; z-index: 20;\n background: var(--glass); backdrop-filter: blur(14px) saturate(1.4); -webkit-backdrop-filter: blur(14px) saturate(1.4);\n border-bottom: 1px solid var(--line);\n}\n.topbar-inner { display: flex; align-items: center; gap: 12px 20px; min-height: 64px; flex-wrap: wrap; padding-block: 10px; }\n.brand { display: inline-flex; align-items: center; gap: 10px; color: inherit; text-decoration: none; }\n.brand-mark { width: 34px; height: 34px; display: block; }\n.brand-mark svg, .hero-logo svg { width: 100%; height: 100%; display: block; }\n.brand-text { font-weight: 600; font-size: 17px; letter-spacing: -.01em; white-space: nowrap; }\n.brand-text strong { font-weight: 800; }\n.logo-bg { fill: var(--accent); }\n.logo-pole { stroke: #fff; stroke-width: 2.2; stroke-linecap: round; fill: none; }\n.logo-flag { fill: #e3b341; }\n.logo-hole { fill: rgba(0, 0, 0, .35); }\n.logo-ball { fill: #fff; }\n.logo-dimple { fill: rgba(0, 0, 0, .18); }\n\n.nav { display: flex; gap: 2px; padding: 3px; background: var(--surface-2); border-radius: 999px; }\n.navbtn { position: relative; background: transparent; border: 0; color: var(--ink-2); padding: 7px 14px; border-radius: 999px; font-weight: 600; font-size: 14px; transition: color .15s, background-color .15s; }\n.navbtn:hover { color: var(--ink); }\n.navbtn.is-active { background: var(--surface); color: var(--ink); box-shadow: var(--shadow-1); }\n.badge { display: inline-grid; place-items: center; min-width: 18px; height: 18px; padding-inline: 5px; margin-left: 4px; border-radius: 999px; background: var(--gold); color: #1a1408; font-size: 11px; font-weight: 800; vertical-align: 1px; }\n\n.topbar-right { margin-left: auto; display: flex; align-items: center; gap: 10px; }\n.iconbtn { width: 38px; height: 38px; border-radius: 999px; border: 1px solid var(--line); background: var(--surface); display: grid; place-items: center; transition: background-color .15s, border-color .15s, transform .15s var(--ease); }\n.iconbtn:hover { border-color: var(--line-strong); transform: translateY(-1px); }\n.iconbtn svg { width: 18px; height: 18px; fill: none; stroke: currentColor; stroke-width: 1.8; stroke-linecap: round; stroke-linejoin: round; }\n.ico-moon { display: none; }\n:root[data-theme=\"dark\"] .ico-sun { display: none; }\n:root[data-theme=\"dark\"] .ico-moon { display: block; }\n@media (prefers-color-scheme: dark) {\n :root:not([data-theme=\"light\"]) .ico-sun { display: none; }\n :root:not([data-theme=\"light\"]) .ico-moon { display: block; }\n}\n.who { display: flex; align-items: center; gap: 10px; font-size: 14px; }\n.who-name { font-weight: 600; }\n.who-name .vip { color: var(--gold); }\n.linkbtn { background: none; border: 0; color: var(--ink-2); text-decoration: underline; text-underline-offset: 3px; padding: 4px 2px; font-size: 14px; }\n.linkbtn:hover { color: var(--ink); }\n.linkbtn.subtle { justify-self: center; color: var(--muted); }\n\n/* ───────── Buttons ───────── */\n.btn { display: inline-flex; align-items: center; justify-content: center; gap: 8px; border-radius: 999px; padding: 10px 18px; border: 1px solid transparent; font-weight: 700; font-size: 14px; white-space: nowrap; transition: transform .15s var(--ease), background-color .15s, border-color .15s, box-shadow .15s; }\n.btn:active { transform: scale(.98); }\n.btn-primary { background: var(--accent); color: var(--accent-ink); box-shadow: 0 6px 18px -8px var(--accent-glow); }\n.btn-primary:hover { background: var(--accent-hover); transform: translateY(-1px); }\n.btn-ghost { background: var(--surface); border-color: var(--line); color: var(--ink); }\n.btn-ghost:hover { border-color: var(--line-strong); background: var(--surface-2); }\n.btn-danger { background: transparent; border-color: var(--line); color: var(--danger); }\n.btn-danger:hover { background: var(--danger-soft); border-color: transparent; }\n.btn:disabled { opacity: .5; cursor: not-allowed; transform: none; box-shadow: none; }\n.btn-sm { padding: 6px 12px; font-size: 13px; }\n.btn-lg { padding: 13px 22px; font-size: 15px; }\n\n/* ───────── Anmeldung ───────── */\n.auth { padding-top: clamp(8px, 2vw, 24px); }\n.auth-grid { display: grid; grid-template-columns: 1.1fr .9fr; gap: 20px; align-items: stretch; }\n.auth-brand {\n position: relative; overflow: hidden; border-radius: var(--r-lg); padding: clamp(24px, 4vw, 44px);\n background: radial-gradient(120% 90% at 10% 0%, var(--hero-a), var(--hero-b) 70%); color: var(--hero-ink);\n display: flex; flex-direction: column; justify-content: space-between; gap: 32px; min-height: 420px;\n}\n.auth-brand::before {\n content: \"\"; position: absolute; inset: 0; pointer-events: none; opacity: .35;\n background-image: linear-gradient(rgba(255,255,255,.08) 1px, transparent 1px), linear-gradient(90deg, rgba(255,255,255,.08) 1px, transparent 1px);\n background-size: 40px 40px; mask-image: radial-gradient(80% 70% at 80% 100%, #000, transparent);\n}\n.auth-brand::after {\n content: \"\"; position: absolute; right: -60px; bottom: -80px; width: 260px; height: 260px; border-radius: 50%;\n background: radial-gradient(circle at 35% 35%, rgba(255,255,255,.9), rgba(255,255,255,.35) 40%, rgba(255,255,255,0) 70%);\n opacity: .12; pointer-events: none;\n}\n.hero-logo { display: flex; align-items: center; gap: 12px; position: relative; }\n.hero-logo svg { width: 44px; height: 44px; }\n.hero-logo .logo-bg { fill: rgba(255,255,255,.14); }\n.hero-logo-text { font-weight: 600; font-size: 18px; }\n.hero-logo-text strong { font-weight: 800; }\n.hero-title { position: relative; font-size: clamp(34px, 5.2vw, 56px); font-weight: 800; line-height: 1.02; letter-spacing: -.03em; max-width: 12ch; }\n.hero-sub { position: relative; color: rgba(255,255,255,.78); max-width: 42ch; margin-top: 12px; font-size: 15.5px; }\n.hero-facts { position: relative; list-style: none; margin: 0; padding: 0; display: flex; flex-wrap: wrap; gap: 8px; }\n.hero-facts li { display: inline-flex; align-items: center; gap: 8px; padding: 8px 12px; border-radius: 999px; background: rgba(255,255,255,.1); border: 1px solid rgba(255,255,255,.14); font-size: 13.5px; }\n.hero-facts .mono { color: #e3b341; }\n\n.auth-card { background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-lg); padding: clamp(20px, 3vw, 32px); box-shadow: var(--shadow-2); display: grid; gap: 18px; align-content: start; }\n.tabs { display: flex; gap: 2px; padding: 3px; background: var(--surface-2); border-radius: 999px; }\n.tab { flex: 1; background: none; border: 0; padding: 8px 10px; white-space: nowrap; border-radius: 999px; color: var(--ink-2); font-weight: 600; font-size: 14px; transition: background-color .15s, color .15s; }\n.tab.is-active { background: var(--surface); color: var(--ink); box-shadow: var(--shadow-1); }\n.notice { background: var(--gold-soft); border: 1px solid var(--gold); border-radius: var(--r-sm); padding: 10px 12px; font-size: 14px; }\n.notice code { font-family: var(--mono); font-weight: 600; }\n\n/* ───────── Formulare ───────── */\n.form { display: grid; gap: 14px; }\n.form label, .panel label { display: grid; gap: 6px; font-size: 13px; font-weight: 600; color: var(--ink-2); }\n.form input, .panel input[type=\"text\"], .panel input[type=\"password\"], .panel input[type=\"number\"], .row-form input[type=\"text\"] {\n padding: 11px 13px; border: 1px solid var(--line); border-radius: var(--r-sm); background: var(--ground); font-size: 16px; color: var(--ink);\n transition: border-color .15s, box-shadow .15s;\n}\n.form input:focus, .panel input:focus, .row-form input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 4px var(--accent-glow); }\n.form input:user-invalid, .panel input:user-invalid { border-color: var(--danger); }\n.form-row { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }\n.form-actions { display: flex; gap: 8px; flex-wrap: wrap; }\n.check { display: inline-flex; align-items: center; gap: 6px; font-size: 14px; font-weight: 500; }\n.row-form { display: flex; gap: 8px; flex-wrap: wrap; align-items: center; }\n.row-form input[type=\"text\"] { flex: 1 1 180px; }\n\n/* ───────── Buchen ───────── */\n.page-head { display: flex; justify-content: space-between; align-items: flex-end; gap: 16px; flex-wrap: wrap; margin-bottom: 18px; }\n.segmented { display: inline-flex; gap: 2px; padding: 3px; background: var(--surface-2); border-radius: 999px; margin-bottom: 10px; }\n.segmented button { border: 0; background: transparent; padding: 6px 14px; border-radius: 999px; color: var(--ink-2); font-weight: 600; font-size: 13px; }\n.segmented button.is-active { background: var(--surface); color: var(--ink); box-shadow: var(--shadow-1); }\n.legend { display: flex; gap: 14px; font-size: 13px; color: var(--ink-2); padding-bottom: 6px; }\n.legend span { display: inline-flex; align-items: center; gap: 6px; }\n.dot { width: 10px; height: 10px; border-radius: 50%; display: inline-block; border: 1.5px dashed var(--line-strong); background: transparent; }\n.dot-vip { border-style: dashed; border-color: var(--gold); background: var(--gold-soft); }\n.dot-mine { border-style: solid; border-color: var(--accent); background: var(--accent); }\n\n.daystrip { display: flex; gap: 8px; overflow-x: auto; padding: 4px 2px 12px; margin-bottom: 8px; scrollbar-width: thin; scroll-snap-type: x proximity; }\n.day { scroll-snap-align: center; flex: 0 0 auto; min-width: 68px; border: 1px solid var(--line); background: var(--surface); border-radius: var(--r-md); padding: 10px 8px; text-align: center; display: grid; gap: 2px; color: var(--ink-2); transition: transform .15s var(--ease), border-color .15s, background-color .15s; }\n.day:hover { transform: translateY(-2px); border-color: var(--line-strong); }\n.day .wd { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .1em; }\n.day .dn { font-weight: 800; font-size: 22px; color: var(--ink); line-height: 1.05; }\n.day .mo { font-size: 11px; }\n.day.is-weekend { background: var(--surface-2); }\n.day.is-active { border-color: var(--accent); background: var(--accent); color: var(--accent-ink); box-shadow: 0 8px 20px -10px var(--accent-glow); }\n.day.is-active .dn { color: var(--accent-ink); }\n.day.is-locked { opacity: .4; }\n\n.slots { display: grid; gap: 10px; }\n.slot {\n display: grid; grid-template-columns: 110px 1fr auto; align-items: center; gap: 16px;\n background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-md); padding: 14px 16px;\n transition: border-color .15s, box-shadow .2s var(--ease), transform .2s var(--ease);\n animation: rise .35s var(--ease) both;\n}\n.slot:hover { border-color: var(--line-strong); box-shadow: var(--shadow-2); }\n.slot.is-past { opacity: .5; }\n.slot.is-mine { border-color: var(--accent); background: linear-gradient(90deg, var(--accent-soft), transparent 40%); }\n.slot .time { font-family: var(--mono); font-weight: 600; font-size: 19px; line-height: 1.1; letter-spacing: -.01em; }\n.slot .time small { display: block; font-family: var(--font); font-weight: 500; font-size: 12px; color: var(--muted); margin-top: 3px; letter-spacing: 0; }\n.seats { display: flex; flex-wrap: wrap; gap: 6px; align-items: center; }\n.seat { display: inline-flex; align-items: center; gap: 7px; border: 1.5px solid var(--line); border-radius: 999px; padding: 3px 11px 3px 4px; font-size: 13px; min-height: 30px; background: var(--surface); font-weight: 500; }\n.seat .avatar { width: 22px; height: 22px; border-radius: 50%; display: grid; place-items: center; font-size: 10px; font-weight: 800; letter-spacing: 0; background: var(--surface-3); color: var(--ink-2); }\n.seat.is-taken { background: var(--surface-2); border-color: transparent; }\n.seat.is-mine { border-color: var(--accent); background: var(--accent-soft); font-weight: 700; }\n.seat.is-mine .avatar { background: var(--accent); color: var(--accent-ink); }\n.seat.is-vip .avatar { background: var(--gold); color: #1a1408; }\n.seat.is-free { color: var(--muted); border-style: dashed; padding-left: 11px; }\n.seat.is-vip-reserve { color: var(--gold); border-color: var(--gold); border-style: dashed; background: var(--gold-soft); padding-left: 11px; font-weight: 600; }\n.slot .reason { font-size: 12.5px; color: var(--muted); grid-column: 2; margin-top: -6px; }\n.slot .action { display: grid; justify-items: end; gap: 2px; }\n.flash { border-radius: var(--r-sm); padding: 10px 12px; margin-bottom: 12px; font-size: 14px; background: var(--accent-soft); border: 1px solid var(--accent); animation: rise .25s var(--ease) both; }\n.flash.is-error { background: var(--danger-soft); border-color: var(--danger); color: var(--danger); }\n.empty { color: var(--muted); padding: 32px 20px; text-align: center; border: 1px dashed var(--line-strong); border-radius: var(--r-md); }\n\n@keyframes rise { from { opacity: 0; transform: translateY(6px); } to { opacity: 1; transform: none; } }\n\n/* ───────── Meine Termine ───────── */\n.mine-list { display: grid; gap: 10px; }\n.mine { display: grid; grid-template-columns: 1fr auto; gap: 12px; align-items: center; background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-md); padding: 14px 16px; animation: rise .35s var(--ease) both; }\n.mine .when { font-weight: 800; font-size: 17px; }\n.mine .when .mono { font-size: 15px; margin-left: 6px; color: var(--accent); }\n.mine .what { color: var(--ink-2); font-size: 13px; margin-top: 2px; }\n\n/* ───────── Profil / Verwaltung ───────── */\n.grid-2 { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 16px; }\n.admin-grid { display: grid; grid-template-columns: 3fr 2fr; gap: 16px; }\n@media (max-width: 900px) { .admin-grid { grid-template-columns: 1fr; } }\n.panel { background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-lg); padding: 20px; display: grid; gap: 12px; align-content: start; }\n.panel-wide { grid-column: 1 / -1; }\n.table-wrap { overflow-x: auto; margin-inline: -8px; }\n.table { width: 100%; border-collapse: collapse; font-size: 14px; }\n.table th { text-align: left; font-size: 11px; text-transform: uppercase; letter-spacing: .1em; color: var(--muted); font-weight: 700; padding: 8px; border-bottom: 1px solid var(--line); }\n.table td { padding: 10px 8px; border-bottom: 1px solid var(--line); vertical-align: middle; }\n.table td:first-child { white-space: nowrap; font-weight: 600; }\n.table tr:last-child td { border-bottom: 0; }\n.table .actions { display: flex; gap: 6px; justify-content: flex-end; flex-wrap: wrap; }\n.table .sub-line { display: block; font-size: 12px; color: var(--muted); font-weight: 400; }\n.pill { display: inline-block; border-radius: 999px; padding: 2px 9px; font-size: 12px; font-weight: 700; white-space: nowrap; }\n.pill-ok { background: var(--accent-soft); color: var(--accent); }\n.pill-wait { background: var(--gold-soft); color: var(--gold); }\n.pill-off { background: var(--surface-2); color: var(--muted); }\n.pill-reset { background: var(--danger-soft); color: var(--danger); }\n.code { font-family: var(--mono); font-weight: 600; letter-spacing: .04em; }\n.res-form { border: 1px solid var(--line); border-radius: var(--r-md); padding: 14px; display: grid; gap: 10px; margin-bottom: 10px; background: var(--ground); }\n.res-form h3 { font-size: 16px; font-weight: 800; }\n.res-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(140px, 1fr)); gap: 8px; }\n.res-grid label { display: grid; gap: 4px; font-size: 12px; color: var(--ink-2); font-weight: 600; }\n.res-grid input { padding: 8px 10px; border: 1px solid var(--line); border-radius: 8px; background: var(--surface); font-size: 14px; width: 100%; }\n.res-form .row-form { justify-content: space-between; }\n\n.foot { display: flex; justify-content: space-between; gap: 12px; padding-block: 18px; font-size: 12px; color: var(--muted); border-top: 1px solid var(--line); }\n\n/* ───────── Mobil ───────── */\n@media (max-width: 860px) {\n .auth-grid { grid-template-columns: 1fr; }\n .auth-brand { min-height: 0; gap: 22px; }\n .hero-title { max-width: none; }\n}\n@media (max-width: 640px) {\n body { font-size: 15px; }\n .topbar-inner { gap: 8px 12px; }\n .brand-text { display: none; }\n .nav { order: 3; width: 100%; overflow-x: auto; scrollbar-width: none; }\n .navbtn { flex: 1 0 auto; text-align: center; padding-inline: 10px; }\n .who-name { display: none; }\n .slot { grid-template-columns: 1fr; gap: 10px; }\n .slot .time { display: flex; align-items: baseline; gap: 8px; }\n .slot .time small { margin: 0; }\n .slot .action { justify-items: start; }\n .slot .reason { grid-column: 1; }\n .form-row { grid-template-columns: 1fr; }\n .legend { font-size: 12px; gap: 10px; }\n .table-wrap { margin-inline: -12px; padding-inline: 12px; }\n}\n@media (prefers-reduced-motion: reduce) {\n *, *::before, *::after { animation: none !important; transition: none !important; }\n html { scroll-behavior: auto; }\n}\n",[],[149,197],"5ee7d275-4890-476f-a6d1-3b5cb0097d4e","index.html","c4c7ef8e-ad59-11f1-865c-1607ee4eb77e",19,["D",1789075797045],"\n\n\n\n\n\n\n\nJK Golfakademie · Buchung\n\n\n\n\n\n\n\n\n\n\n\n

\n \n \n\n \n \n\n \n \n\n \n \n\n \n

Admin

Verwaltung

Spieler, Regeln und alle Buchungen.

Spieler

Lege jeden Spieler mit Klarnamen an. Der Einladungscode wird einmalig gebraucht, um die eigene PIN festzulegen. Bei „PIN-Reset angefragt“ erzeugst du mit „PIN zurücksetzen“ einen neuen Code.

\n \n \n

\n \n \n \n

Name	Status	VIP	Admin	Code

Ressourcen & Regeln

Jede Ressource hat eigene Kapazität, Zeiten und VIP-Regeln. Für Fitness einfach eine zweite Ressource anlegen.

\n \n

Alle Buchungen der nächsten 14 Tage

\n \n \n \n

Datum	Uhrzeit	Ressource	Spieler	Gebucht am

\n\n\n\n\n\n\n",[],[149,205],"de6c1341-db64-4730-9e14-4d80b3641f11","app.js","0fc28ee0-ad5a-11f1-b2b7-1607ee4eb77e",31,["D",1789075938511],11,"// Abschlag – Oberfläche (ohne Framework, ohne Build-Schritt)\n\nconst $ = (id) => document.getElementById(id);\nconst state = {\n member: null,\n resources: [],\n resource: null,\n now: null,\n date: null,\n view: \"book\",\n};\n\nconst WD = [\"So\", \"Mo\", \"Di\", \"Mi\", \"Do\", \"Fr\", \"Sa\"];\nconst WD_LONG = [\"Sonntag\", \"Montag\", \"Dienstag\", \"Mittwoch\", \"Donnerstag\", \"Freitag\", \"Samstag\"];\nconst MO = [\"Jan\", \"Feb\", \"Mär\", \"Apr\", \"Mai\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Okt\", \"Nov\", \"Dez\"];\n\nasync function api(path, opts = {}) {\n const res = await fetch(path, {\n headers: { \"Content-Type\": \"application/json\" },\n credentials: \"same-origin\",\n ...opts,\n body: opts.body ? JSON.stringify(opts.body) : undefined,\n });\n const data = await res.json().catch(() => ({}));\n if (!res.ok) throw new Error(data.error || `Fehler ${res.status}`);\n return data;\n}\n\nfunction esc(s) {\n return String(s).replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c]));\n}\nfunction weekdayOf(date) {\n const [y, m, d] = date.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d, 12)).getUTCDay();\n}\nfunction addDays(date, n) {\n const [y, m, d] = date.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d + n, 12)).toISOString().slice(0, 10);\n}\nfunction fmtDate(date, long = false) {\n const [y, m, d] = date.split(\"-\").map(Number);\n return `${long ? WD_LONG[weekdayOf(date)] : WD[weekdayOf(date)]}, ${d}. ${MO[m - 1]}${long ? \" \" + y : \"\"}`;\n}\nfunction fmtStamp(utc) {\n const d = new Date(utc.replace(\" \", \"T\") + \"Z\");\n return d.toLocaleString(\"de-DE\", { timeZone: \"Europe/Berlin\", day: \"2-digit\", month: \"2-digit\", hour: \"2-digit\", minute: \"2-digit\" });\n}\nfunction flash(el, text, isError = false) {\n el.textContent = text;\n el.classList.toggle(\"is-error\", isError);\n el.hidden = !text;\n if (text && !isError) setTimeout(() => { if (el.textContent === text) el.hidden = true; }, 4000);\n}\n\nfunction initials(name) {\n return name.split(/\\s+/).filter(Boolean).slice(0, 2).map((p) => p[0].toUpperCase()).join(\"\");\n}\n\n// ───────────── Farbschema ─────────────\n\nconst mq = matchMedia(\"(prefers-color-scheme: dark)\");\nfunction effectiveTheme() {\n const pinned = document.documentElement.dataset.theme;\n return pinned === \"light\" || pinned === \"dark\" ? pinned : (mq.matches ? \"dark\" : \"light\");\n}\nfunction applyTheme(t) {\n const meta = document.querySelector('meta[name=\"color-scheme\"]');\n if (t) {\n document.documentElement.dataset.theme = t;\n meta.content = t;\n try { localStorage.setItem(\"color-scheme\", t); } catch (_) {}\n } else {\n delete document.documentElement.dataset.theme;\n meta.content = \"light dark\";\n try { localStorage.removeItem(\"color-scheme\"); } catch (_) {}\n }\n}\n$(\"theme-toggle\").onclick = () => applyTheme(effectiveTheme() === \"dark\" ? \"light\" : \"dark\");\n$(\"theme-system\").onclick = () => { applyTheme(null); flash($(\"pin-msg\"), \"Farbschema folgt jetzt der Systemeinstellung.\"); };\n\n// ───────────── Ansichten ─────────────\n\nfunction showView(view) {\n state.view = view;\n for (const v of [\"auth\", \"book\", \"mine\", \"profile\", \"admin\"]) $(\"view-\" + v).hidden = v !== view;\n for (const b of document.querySelectorAll(\".navbtn\")) b.classList.toggle(\"is-active\", b.dataset.view === view);\n if (view === \"book\") loadSlots();\n if (view === \"mine\") loadMine();\n if (view === \"profile\") loadProfile();\n if (view === \"admin\") loadAdmin();\n window.scrollTo({ top: 0 });\n}\n\nasync function boot() {\n const me = await api(\"/api/me\");\n state.member = me.member;\n state.resources = me.resources;\n state.now = me.now;\n if (!state.date) state.date = me.now.date;\n if (!state.resource || !state.resources.some((r) => r.id === state.resource.id)) state.resource = state.resources[0] ?? null;\n\n const banner = $(\"setup-banner\");\n if (me.setupCode && !me.member) {\n banner.innerHTML = `Ersteinrichtung. Noch niemand ist registriert. Admin-Zugang: ${esc(me.setupCode)} – bitte sofort unter „Registrieren“ mit diesem Namen und Code eine PIN festlegen.`;\n banner.hidden = false;\n } else banner.hidden = true;\n\n const loggedIn = !!me.member;\n $(\"nav\").hidden = !loggedIn;\n $(\"who\").hidden = !loggedIn;\n if (loggedIn) {\n $(\"who-name\").innerHTML = esc(me.member.alias || me.member.name) + (me.member.isVip ? ' ★' : \"\");\n $(\"nav-admin\").hidden = !me.member.isAdmin;\n const badge = $(\"admin-badge\");\n badge.hidden = !(me.member.isAdmin && me.pendingResets > 0);\n badge.textContent = me.pendingResets || \"\";\n renderResourceTabs();\n showView(state.view === \"auth\" ? \"book\" : state.view);\n } else {\n showView(\"auth\");\n }\n}\n\n// ───────────── Anmeldung ─────────────\n\n$(\"tab-login\").onclick = () => switchAuthTab(\"login\");\n$(\"tab-register\").onclick = () => switchAuthTab(\"register\");\nfunction switchAuthTab(which) {\n $(\"form-login\").hidden = which !== \"login\";\n $(\"form-register\").hidden = which !== \"register\";\n $(\"form-forgot\").hidden = which !== \"forgot\";\n $(\"tab-login\").classList.toggle(\"is-active\", which === \"login\");\n $(\"tab-register\").classList.toggle(\"is-active\", which === \"register\");\n}\n$(\"link-forgot\").onclick = () => switchAuthTab(\"forgot\");\n$(\"link-back-login\").onclick = () => switchAuthTab(\"login\");\n$(\"form-forgot\").onsubmit = async (e) => {\n e.preventDefault();\n try {\n await api(\"/api/reset-request\", { method: \"POST\", body: { name: $(\"forgot-name\").value } });\n const el = $(\"forgot-msg\");\n el.textContent = \"Anfrage gesendet. Sobald der Verwalter sie bearbeitet hat, bekommst du einen neuen Einladungscode.\";\n el.classList.remove(\"is-error\"); el.hidden = false;\n $(\"forgot-name\").value = \"\";\n } catch (err) {\n flash($(\"forgot-msg\"), err.message, true);\n }\n};\n\n$(\"form-login\").onsubmit = async (e) => {\n e.preventDefault();\n $(\"login-error\").hidden = true;\n try {\n await api(\"/api/login\", { method: \"POST\", body: { name: $(\"login-name\").value, pin: $(\"login-pin\").value } });\n $(\"login-pin\").value = \"\";\n state.view = \"book\";\n await boot();\n } catch (err) {\n $(\"login-error\").textContent = err.message;\n $(\"login-error\").hidden = false;\n }\n};\n\n$(\"form-register\").onsubmit = async (e) => {\n e.preventDefault();\n const errEl = $(\"reg-error\");\n errEl.hidden = true;\n if ($(\"reg-pin\").value !== $(\"reg-pin2\").value) {\n errEl.textContent = \"Die beiden PINs stimmen nicht überein.\";\n errEl.hidden = false;\n return;\n }\n try {\n await api(\"/api/register\", {\n method: \"POST\",\n body: { name: $(\"reg-name\").value, code: $(\"reg-code\").value, pin: $(\"reg-pin\").value },\n });\n $(\"reg-pin\").value = $(\"reg-pin2\").value = \"\";\n state.view = \"book\";\n await boot();\n } catch (err) {\n errEl.textContent = err.message;\n errEl.hidden = false;\n }\n};\n\n$(\"logout\").onclick = async () => {\n await api(\"/api/logout\", { method: \"POST\" });\n state.view = \"auth\";\n await boot();\n};\n\nfor (const b of document.querySelectorAll(\".navbtn\")) b.onclick = () => showView(b.dataset.view);\n\n// ───────────── Buchen ─────────────\n\nfunction renderResourceTabs() {\n const el = $(\"resource-tabs\");\n el.hidden = state.resources.length < 2;\n el.innerHTML = state.resources\n .map((r) => ``)\n .join(\"\");\n for (const b of el.querySelectorAll(\"button\")) {\n b.onclick = () => {\n state.resource = state.resources.find((r) => r.id === b.dataset.id);\n renderResourceTabs();\n loadSlots();\n };\n }\n}\n\nfunction renderDaystrip() {\n const r = state.resource;\n const lead = state.member.isVip ? r.leadDaysVip : r.leadDaysStd;\n const days = [];\n const horizon = Math.max(r.leadDaysVip, r.leadDaysStd);\n for (let i = 0; i <= horizon; i++) days.push(addDays(state.now.date, i));\n $(\"daystrip\").innerHTML = days\n .map((d, i) => {\n const [y, m, dd] = d.split(\"-\").map(Number);\n const wd = weekdayOf(d);\n const cls = [\"day\", d === state.date ? \"is-active\" : \"\", wd === 0 || wd === 6 ? \"is-weekend\" : \"\", i > lead ? \"is-locked\" : \"\"].join(\" \");\n const title = i > lead ? `Erst ab ${lead} Tage vorher buchbar` : \"\";\n return ``;\n })\n .join(\"\");\n for (const b of $(\"daystrip\").querySelectorAll(\".day\")) {\n b.onclick = () => { state.date = b.dataset.date; loadSlots(); };\n }\n const active = $(\"daystrip\").querySelector(\".is-active\");\n if (active) active.scrollIntoView({ block: \"nearest\", inline: \"center\", behavior: \"instant\" });\n}\n\nasync function loadSlots() {\n if (!state.resource) {\n $(\"slots\").innerHTML = `

Noch keine Ressource eingerichtet.

`;\n return;\n }\n renderDaystrip();\n const r = state.resource;\n $(\"book-eyebrow\").textContent = r.name;\n $(\"book-title\").textContent = state.date === state.now.date ? \"Heute\" : fmtDate(state.date, true);\n $(\"book-sub\").textContent = (state.date === state.now.date ? fmtDate(state.date, true) + \" · \" : \"\")\n + `${r.capacity} Plätze pro Stunde · `\n + (state.member.isVip ? `als VIP bis ${r.leadDaysVip} Tage im Voraus buchbar` : `bis ${r.leadDaysStd} Tage im Voraus buchbar`);\n try {\n const data = await api(`/api/slots?resource=${encodeURIComponent(r.id)}&date=${state.date}`);\n state.now = data.now;\n renderSlots(data);\n } catch (err) {\n flash($(\"book-msg\"), err.message, true);\n }\n}\n\nfunction renderSlots(data) {\n const r = data.resource;\n const me = state.member;\n if (!data.slots.length) {\n $(\"slots\").innerHTML = `

An diesem Tag ist ${esc(r.name)} geschlossen.

`;\n return;\n }\n $(\"slots\").innerHTML = data.slots\n .map((s) => {\n const chips = [];\n for (const seat of s.seats) {\n const mine = seat.memberId === me.id;\n chips.push(`${esc(initials(seat.name))}${esc(mine ? \"Du\" : seat.name)}`);\n }\n const freeSeats = r.capacity - s.seats.length;\n const nonVipTaken = s.seats.filter((x) => !x.isVip).length;\n // Für alle offen sind höchstens (Kapazität − Reserve) Plätze abzüglich der schon\n // belegten Nicht-VIP-Plätze; der Rest der freien Plätze ist VIP-Reserve.\n let reserved = 0;\n if (s.reserveActive && !s.past) {\n const nonVipCap = r.capacity - r.vipReserved;\n const openForAll = Math.max(0, Math.min(freeSeats, nonVipCap - nonVipTaken));\n reserved = freeSeats - openForAll;\n }\n for (let i = 0; i < freeSeats - reserved; i++) chips.push(`frei`);\n for (let i = 0; i < reserved; i++) chips.push(`★ VIP`);\n\n let action = \"\";\n if (s.myBookingId) {\n action = s.canCancel\n ? ``\n : `läuft`;\n } else if (s.canBook) {\n action = ``;\n } else {\n action = ``;\n }\n const reason = !s.myBookingId && !s.canBook && !s.past && s.reasonCode !== \"full\" ? `

${esc(s.reason)}

` : \"\";\n return `

${s.hour}:00bis ${s.hour + 1}:00

${chips.join(\"\")}

${action}

\n ${reason}\n

`;\n })\n .join(\"\");\n\n for (const b of $(\"slots\").querySelectorAll(\"[data-book]\")) {\n b.onclick = async () => {\n b.disabled = true;\n try {\n await api(\"/api/bookings\", { method: \"POST\", body: { resource: r.id, date: data.date, hour: Number(b.dataset.book) } });\n flash($(\"book-msg\"), `Gebucht: ${fmtDate(data.date)}, ${b.dataset.book}:00 Uhr.`);\n } catch (err) {\n flash($(\"book-msg\"), err.message, true);\n }\n loadSlots();\n };\n }\n for (const b of $(\"slots\").querySelectorAll(\"[data-cancel]\")) {\n b.onclick = async () => {\n b.disabled = true;\n try {\n await api(`/api/bookings/${b.dataset.cancel}`, { method: \"DELETE\" });\n flash($(\"book-msg\"), \"Buchung storniert.\");\n } catch (err) {\n flash($(\"book-msg\"), err.message, true);\n }\n loadSlots();\n };\n }\n}\n\n// ───────────── Meine Termine ─────────────\n\nasync function loadMine() {\n const { bookings } = await api(\"/api/bookings/mine\");\n $(\"mine-sub\").textContent = bookings.length ? `${bookings.length} anstehende${bookings.length === 1 ? \"r Termin\" : \" Termine\"}` : \"\";\n if (!bookings.length) {\n $(\"mine-list\").innerHTML = `

Du hast noch keine Termine. Jetzt buchen

`;\n $(\"go-book\").onclick = (e) => { e.preventDefault(); showView(\"book\"); };\n return;\n }\n $(\"mine-list\").innerHTML = bookings\n .map((b) => `

${fmtDate(b.date, true)}${b.hour}:00–${b.hour + 1}:00

${esc(b.resourceName)}

`)\n .join(\"\");\n for (const btn of $(\"mine-list\").querySelectorAll(\"[data-cancel]\")) {\n btn.onclick = async () => {\n btn.disabled = true;\n try { await api(`/api/bookings/${btn.dataset.cancel}`, { method: \"DELETE\" }); } catch (err) { alert(err.message); }\n loadMine();\n };\n }\n}\n\n// ───────────── Profil ─────────────\n\nfunction loadProfile() {\n const m = state.member;\n $(\"profile-title\").textContent = m.name;\n $(\"profile-sub\").textContent = (m.isVip ? \"VIP-Mitglied\" : \"Mitglied\") + (m.alias ? ` · Alias: ${m.alias}` : \" · noch kein Alias\");\n $(\"alias-input\").value = m.alias || \"\";\n}\n\n$(\"form-alias\").onsubmit = async (e) => {\n e.preventDefault();\n try {\n const r = await api(\"/api/profile/alias\", { method: \"POST\", body: { alias: $(\"alias-input\").value.trim() } });\n state.member.alias = r.alias;\n flash($(\"alias-msg\"), r.alias ? `Alias „${r.alias}“ gespeichert. Du kannst dich jetzt auch damit anmelden.` : \"Alias entfernt.\");\n loadProfile();\n $(\"who-name\").innerHTML = esc(state.member.alias || state.member.name) + (state.member.isVip ? ' ★' : \"\");\n } catch (err) {\n flash($(\"alias-msg\"), err.message, true);\n }\n};\n$(\"alias-clear\").onclick = async () => {\n $(\"alias-input\").value = \"\";\n $(\"form-alias\").requestSubmit();\n};\n\n$(\"form-pin\").onsubmit = async (e) => {\n e.preventDefault();\n if ($(\"pin-next\").value !== $(\"pin-next2\").value) {\n flash($(\"pin-msg\"), \"Die beiden neuen PINs stimmen nicht überein.\", true);\n return;\n }\n try {\n await api(\"/api/profile/pin\", { method: \"POST\", body: { current: $(\"pin-current\").value, next: $(\"pin-next\").value } });\n $(\"pin-current\").value = $(\"pin-next\").value = $(\"pin-next2\").value = \"\";\n flash($(\"pin-msg\"), \"PIN geändert. Andere Geräte wurden abgemeldet.\");\n } catch (err) {\n flash($(\"pin-msg\"), err.message, true);\n }\n};\n\n// ───────────── Verwaltung ─────────────\n\nasync function loadAdmin() {\n await Promise.all([loadMembers(), loadResources(), loadAllBookings()]);\n}\n\nasync function loadMembers() {\n const { members } = await api(\"/api/admin/members\");\n const tb = $(\"members-table\").querySelector(\"tbody\");\n tb.innerHTML = members\n .map((m) => {\n const status = !m.active ? 'deaktiviert'\n : m.resetRequestedAt ? 'PIN-Reset angefragt'\n : m.registered ? 'registriert' : 'wartet';\n const code = m.inviteCode ? `${esc(m.inviteCode)}` : \"—\";\n return `\n ${esc(m.name)}${m.alias ? `Alias: ${esc(m.alias)}` : \"\"}\n ${status}\n \n \n ${code}\n

\n \n ${m.active\n ? ``\n : `\n `}\n

`;\n })\n .join(\"\");\n const patch = async (id, body) => {\n try { await api(`/api/admin/members/${id}`, { method: \"PATCH\", body }); } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadMembers();\n };\n for (const el of tb.querySelectorAll(\"[data-vip]\")) el.onchange = () => patch(el.dataset.vip, { isVip: el.checked });\n for (const el of tb.querySelectorAll(\"[data-admin]\")) el.onchange = () => patch(el.dataset.admin, { isAdmin: el.checked });\n for (const el of tb.querySelectorAll(\"[data-deact]\")) el.onclick = () => patch(el.dataset.deact, { active: false });\n for (const el of tb.querySelectorAll(\"[data-act]\")) el.onclick = () => patch(el.dataset.act, { active: true });\n for (const el of tb.querySelectorAll(\"[data-reset]\")) el.onclick = async () => {\n try {\n const r = await api(`/api/admin/members/${el.dataset.reset}/reset`, { method: \"POST\" });\n flash($(\"admin-msg\"), `Neuer Einladungscode: ${r.inviteCode} – bitte an die Person weitergeben.`);\n const me = await api(\"/api/me\");\n $(\"admin-badge\").hidden = !(me.pendingResets > 0);\n $(\"admin-badge\").textContent = me.pendingResets || \"\";\n } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadMembers();\n };\n for (const el of tb.querySelectorAll(\"[data-del]\")) el.onclick = async () => {\n try { await api(`/api/admin/members/${el.dataset.del}`, { method: \"DELETE\" }); } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadMembers();\n };\n}\n\n$(\"form-add-member\").onsubmit = async (e) => {\n e.preventDefault();\n try {\n const r = await api(\"/api/admin/members\", {\n method: \"POST\",\n body: { name: $(\"new-member-name\").value, isVip: $(\"new-member-vip\").checked },\n });\n flash($(\"admin-msg\"), `${$(\"new-member-name\").value.trim()} angelegt. Einladungscode: ${r.inviteCode}`);\n $(\"new-member-name\").value = \"\";\n $(\"new-member-vip\").checked = false;\n loadMembers();\n } catch (err) {\n flash($(\"admin-msg\"), err.message, true);\n }\n};\n\nconst RES_FIELDS = [\n [\"name\", \"Name\", \"text\"],\n [\"capacity\", \"Plätze / Stunde\", \"number\"],\n [\"vipReserved\", \"davon VIP-Reserve\", \"number\"],\n [\"reserveReleaseHours\", \"Reserve frei ab (Std. vor Start)\", \"number\"],\n [\"leadDaysVip\", \"Vorlauf VIP (Tage)\", \"number\"],\n [\"leadDaysStd\", \"Vorlauf normal (Tage)\", \"number\"],\n [\"maxOpenPerMember\", \"Max. offene Buchungen / Spieler\", \"number\"],\n [\"weekdayOpen\", \"Mo–Fr ab (Uhr)\", \"number\"],\n [\"weekdayClose\", \"Mo–Fr bis (Uhr)\", \"number\"],\n [\"weekendOpen\", \"Sa/So ab (Uhr)\", \"number\"],\n [\"weekendClose\", \"Sa/So bis (Uhr)\", \"number\"],\n];\n\nfunction resourceForm(r, isNew = false) {\n const idField = isNew\n ? `Kennung (Kleinbuchstaben, z. B. fitness)`\n : \"\";\n return ``;\n}\n\nasync function loadResources() {\n const { resources } = await api(\"/api/admin/resources\");\n $(\"resource-forms\").innerHTML = resources.map((r) => resourceForm(r)).join(\"\");\n bindResourceForms();\n}\n\nfunction bindResourceForms() {\n for (const form of $(\"resource-forms\").querySelectorAll(\"form.res-form\")) {\n form.onsubmit = async (e) => {\n e.preventDefault();\n const fd = new FormData(form);\n const body = {};\n for (const [k, v] of fd.entries()) body[k] = k === \"name\" || k === \"id\" ? v : Number(v);\n body.active = form.querySelector('[name=\"active\"]').checked;\n const id = form.dataset.new === \"1\" ? String(fd.get(\"id\")) : form.dataset.res;\n try {\n await api(`/api/admin/resources/${encodeURIComponent(id)}`, { method: \"PUT\", body });\n flash($(\"admin-msg\"), `${body.name} gespeichert.`);\n const me = await api(\"/api/me\");\n state.resources = me.resources;\n renderResourceTabs();\n loadResources();\n } catch (err) {\n flash($(\"admin-msg\"), err.message, true);\n }\n };\n }\n}\n\n$(\"btn-new-resource\").onclick = () => {\n if ($(\"resource-forms\").querySelector('[data-new=\"1\"]')) return;\n const tpl = {\n id: \"\", name: \"Fitness\", capacity: 4, vipReserved: 1, reserveReleaseHours: 24, leadDaysVip: 14, leadDaysStd: 7,\n weekdayOpen: 9, weekdayClose: 22, weekendOpen: 10, weekendClose: 21, maxOpenPerMember: 3, active: 1,\n };\n $(\"resource-forms\").insertAdjacentHTML(\"beforeend\", resourceForm(tpl, true));\n bindResourceForms();\n};\n\nasync function loadAllBookings() {\n const { bookings } = await api(\"/api/admin/bookings\");\n const tb = $(\"bookings-table\").querySelector(\"tbody\");\n if (!bookings.length) {\n tb.innerHTML = `Keine Buchungen in den nächsten 14 Tagen.`;\n return;\n }\n const resName = (id) => state.resources.find((r) => r.id === id)?.name ?? id;\n tb.innerHTML = bookings\n .map((b) => `\n ${fmtDate(b.date)}${b.hour}:00–${b.hour + 1}:00${esc(resName(b.resourceId))}\n ${b.isVip ? '★ ' : \"\"}${esc(b.name)}\n ${fmtStamp(b.createdAt)}\n

`)\n .join(\"\");\n for (const btn of tb.querySelectorAll(\"[data-cancel]\")) {\n btn.onclick = async () => {\n try { await api(`/api/bookings/${btn.dataset.cancel}`, { method: \"DELETE\" }); } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadAllBookings();\n };\n }\n}\n\nboot().catch((err) => {\n document.body.insertAdjacentHTML(\"afterbegin\", `

${esc(err.message)}

`);\n});\n",[],[149,213],["D",1789073648998],[166,167,168],[149],["D",1789073537776],["D",1789512044203],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_127":262,"_263":264,"_265":266,"_267":25,"_268":25,"_269":25,"_270":58,"_271":-5,"_272":-7,"_273":-7,"_274":62,"_275":25,"_276":25,"_277":-5,"_278":25,"_279":25,"_280":25,"_281":-5},"ENV",{"_233":234,"_235":236,"_237":89,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Deine Stunde am Simulator.

PIN zurücksetzen

Heute

Meine Termine

Profil

Alias

PIN ändern

Darstellung

Verwaltung

Spieler

Ressourcen & Regeln

Alle Buchungen der nächsten 14 Tage

${isNew ? \"Neue Ressource\" : esc(r.name)}

Diff · v37