[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_251":252,"_253":254},"routes/_app.x.$handle.$name",{"_100":99,"_32":45,"_109":90,"_27":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":25,"_124":125,"_126":59,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":25},"version",55,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":20,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":33,"_34":20,"_35":36},"deleted",false,"deletedHere","path","frontend/index.html","latestPath","fileId","c4c7ef8e-ad59-11f1-865c-1607ee4eb77e","name","index.html","fileType","content","\n\n\n\n\n\n\n\nJK Golfakademie · Buchung\n\n\n\n\n\n\n\n\n\n\n\n

\n \n \n\n \n \n\n \n \n\n \n \n\n \n

Admin

Verwaltung

Spieler, Regeln und alle Buchungen.

Spieler

Lege jeden Spieler mit Klarnamen an. Der Einladungscode wird einmalig gebraucht, um die eigene PIN festzulegen. Bei „PIN-Reset angefragt“ erzeugst du mit „PIN zurücksetzen“ einen neuen Code.

\n \n \n

\n \n \n \n

Name	Status	VIP	Admin	Code

Ressourcen & Regeln

Jede Ressource hat eigene Kapazität, Zeiten und VIP-Regeln. Für Fitness einfach eine zweite Ressource anlegen.

\n \n

Alle Buchungen der nächsten 14 Tage

\n \n \n \n

Datum	Uhrzeit	Ressource	Spieler	Gebucht am

\n\n\n\n\n\n\n","\n\n\n\n\n\n\n\nJK Golfakademie · Buchung\n\n\n\n\n\n\n\n\n\n\n\n

\n \n \n\n \n \n\n \n \n\n \n \n\n \n

Admin

Verwaltung

Spieler, Regeln und alle Buchungen.

Spieler

Lege jeden Spieler mit Klarnamen an. Der Einladungscode wird einmalig gebraucht, um die eigene PIN festzulegen. Bei „PIN-Reset angefragt“ erzeugst du mit „PIN zurücksetzen“ einen neuen Code.

\n \n \n

\n \n \n \n

Name	Status	VIP	Admin	Code

Ressourcen & Regeln

Jede Ressource hat eigene Kapazität, Zeiten und VIP-Regeln. Für Fitness einfach eine zweite Ressource anlegen.

\n \n

Alle Buchungen der nächsten 14 Tage

\n \n \n \n

Datum	Uhrzeit	Ressource	Spieler	Gebucht am

\n\n\n\n\n\n\n","createdAt",["D",1789079802139],"branchVersion","branchId","5c695ecc-ad62-4780-8b26-43dbcfbbf94b","id","e5718bb4-559b-409d-a723-e72077efaced","abschlag",["D",1789073537776],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Buchungssystem Golfsimulator (4 Plätze/Std., VIP, PIN-Login)","imageUrl","aa4a2c1b-3d04-409c-88c5-af54cb1d3470","pinnedFileId","828c2900-ad59-11f1-99a3-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a08d16-8467-769a-84f6-caf4cfc8139c","tursoName","e5718bb4559b409da723e72077efaced","tursoHostname","e5718bb4559b409da723e72077efaced-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789512044203],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_108":104},"org",{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":25},"branch",{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"isOwned",60,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Thokolosh","handle","displayName","Kirk Lenke","avatar","https://lh3.googleusercontent.com/a/ACg8ocJoDfrcBCOirw40MHfesVj8rSjuldOifXKqr9767Swx6brFywwEAQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":246,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":247,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":248,"_84":249,"_86":250,"_88":25},"tree",[177,182,185,186],"files",[177,178,179,180,181,182,183,184,185,186],"counts",{"_166":63,"_167":168,"_169":63,"_170":171,"_172":173},"contents",[131,132,133,134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":160,"_32":161,"_30":162,"_137":-5,"_41":42,"_40":163,"_139":59,"_38":164,"_13":63,"_34":152,"_35":-5,"_24":25,"_144":-5,"_27":165},{"_43":154,"_32":155,"_30":156,"_137":-5,"_41":42,"_40":157,"_139":59,"_38":158,"_13":63,"_34":152,"_35":-5,"_24":25,"_144":-5,"_27":159},{"_43":147,"_32":148,"_30":149,"_137":-5,"_41":42,"_40":150,"_139":59,"_38":151,"_13":63,"_34":152,"_35":-5,"_24":25,"_144":-5,"_27":153},{"_43":135,"_32":136,"_30":57,"_137":-5,"_41":42,"_40":138,"_139":59,"_38":140,"_13":141,"_34":142,"_35":143,"_24":25,"_144":145,"_27":146},"bccd6142-9f2d-4004-b15c-67eb3dcb9c80","index.ts","parentId",52,"latest",["D",1789078487659],22,"http","// Abschlag – Buchungssystem für den Golfsimulator (und später weitere Ressourcen).\n// HTTP-Val: Hono + std/sqlite. Diese Datei ist der HTTP-Einstieg.\n\nimport { Hono } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { parseVal, readFile, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { email as sendEmail } from \"https://esm.town/v/std/email\";\nimport {\n canCancel,\n DEFAULT_GOLF,\n evaluateBooking,\n seatsAvailableFor,\n slotHours,\n type Member,\n type Resource,\n type Seat,\n} from \"./lib/rules.ts\";\nimport { addDays, isValidDate, localNow, slotStartEpoch } from \"./lib/time.ts\";\n\n// ───────────────────────── Schema ─────────────────────────\n\nconst ADMIN_NAME = Deno.env.get(\"ADMIN_NAME\") ?? \"Kirk Lenke\";\nconst SESSION_DAYS = 90;\n\nasync function initDb() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS members (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL UNIQUE COLLATE NOCASE,\n pin_hash TEXT,\n pin_salt TEXT,\n invite_code TEXT,\n is_vip INTEGER NOT NULL DEFAULT 0,\n is_admin INTEGER NOT NULL DEFAULT 0,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS resources (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n capacity INTEGER NOT NULL,\n vip_reserved INTEGER NOT NULL,\n reserve_release_hours INTEGER NOT NULL,\n lead_days_vip INTEGER NOT NULL,\n lead_days_std INTEGER NOT NULL,\n weekday_open INTEGER NOT NULL,\n weekday_close INTEGER NOT NULL,\n weekend_open INTEGER NOT NULL,\n weekend_close INTEGER NOT NULL,\n max_open_per_member INTEGER NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n sort INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY,\n resource_id TEXT NOT NULL,\n member_id INTEGER NOT NULL,\n date TEXT NOT NULL,\n hour INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n UNIQUE(resource_id, date, hour, member_id)\n )`,\n `CREATE INDEX IF NOT EXISTS bookings_slot ON bookings(resource_id, date, hour)`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n member_id INTEGER NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n ]);\n\n // Migrationen für bestehende Datenbanken\n for (const sql of [\n \"ALTER TABLE members ADD COLUMN alias TEXT\",\n \"ALTER TABLE members ADD COLUMN reset_requested_at TEXT\",\n \"ALTER TABLE members ADD COLUMN email TEXT\",\n ]) {\n try { await sqlite.execute(sql); } catch (_) { /* Spalte existiert schon */ }\n }\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_alias ON members(alias COLLATE NOCASE)\");\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_email ON members(email COLLATE NOCASE)\");\n\n const r = await sqlite.execute(\"SELECT COUNT(*) AS n FROM resources\");\n if (Number(r.rows[0].n) === 0) await upsertResource(DEFAULT_GOLF);\n\n const m = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members\");\n if (Number(m.rows[0].n) === 0) {\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_admin, is_vip) VALUES (?, ?, 1, 1)\",\n args: [ADMIN_NAME, code],\n });\n console.log(`Admin \"${ADMIN_NAME}\" angelegt. Einladungscode: ${code}`);\n }\n}\nconst ready = initDb();\n\n// ───────────────────────── Helfer ─────────────────────────\n\nfunction newInviteCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\"; // ohne 0/O/1/I\n const bytes = crypto.getRandomValues(new Uint8Array(6));\n let s = \"\";\n for (const b of bytes) s += alphabet[b % alphabet.length];\n return s.slice(0, 3) + \"-\" + s.slice(3);\n}\n\nfunction hex(buf: ArrayBuffer | Uint8Array): string {\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPin(pin: string, saltHex: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", new TextEncoder().encode(pin), \"PBKDF2\", false, [\"deriveBits\"]);\n const salt = Uint8Array.from(saltHex.match(/../g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits({ name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations: 120_000 }, key, 256);\n return hex(bits);\n}\n\nfunction validPin(pin: unknown): pin is string {\n return typeof pin === \"string\" && /^\\d{4,8}$/.test(pin);\n}\n\nfunction cleanName(name: unknown): string | null {\n if (typeof name !== \"string\") return null;\n const n = name.replace(/\\s+/g, \" \").trim();\n if (n.length < 3 || n.length > 60) return null;\n if (!/^[\\p{L}][\\p{L}\\p{M}' .-]*\\s[\\p{L}][\\p{L}\\p{M}' .-]*$/u.test(n)) return null; // Vor- und Nachname\n return n;\n}\n\nfunction cleanEmail(v: unknown): string | null {\n if (typeof v !== \"string\") return null;\n const e = v.trim().toLowerCase();\n return e.length <= 120 && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(e) ? e : null;\n}\n\nconst ALIAS_RE = /^[\\p{L}\\p{N}][\\p{L}\\p{N}._-]{2,19}$/u;\nfunction cleanAlias(alias: unknown): string | null {\n if (typeof alias !== \"string\") return null;\n const a = alias.trim();\n return ALIAS_RE.test(a) ? a : null;\n}\n\n/** Findet ein aktives Mitglied über Klarnamen oder Alias. */\nasync function findByLogin(input: unknown): Promise | null> {\n if (typeof input !== \"string\") return null;\n const raw = input.replace(/\\s+/g, \" \").trim();\n if (!raw) return null;\n const name = cleanName(raw);\n const r = await sqlite.execute({\n sql: \"SELECT * FROM members WHERE active = 1 AND (name = ? OR alias = ? COLLATE NOCASE OR email = ? COLLATE NOCASE) LIMIT 1\",\n args: [name ?? raw, raw, raw.toLowerCase()],\n });\n return r.rows[0] ?? null;\n}\n\nfunction normCode(code: unknown): string {\n return String(code ?? \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\").replace(/^(.{3})(.{3})$/, \"$1-$2\");\n}\n\nfunction rowToMember(row: Record): Member {\n return {\n id: Number(row.id),\n name: String(row.name),\n alias: row.alias ? String(row.alias) : null,\n email: row.email ? String(row.email) : null,\n isVip: Number(row.is_vip) === 1,\n isAdmin: Number(row.is_admin) === 1,\n active: Number(row.active) === 1,\n };\n}\n\nfunction rowToResource(row: Record): Resource {\n return {\n id: String(row.id),\n name: String(row.name),\n capacity: Number(row.capacity),\n vipReserved: Number(row.vip_reserved),\n reserveReleaseHours: Number(row.reserve_release_hours),\n leadDaysVip: Number(row.lead_days_vip),\n leadDaysStd: Number(row.lead_days_std),\n weekdayOpen: Number(row.weekday_open),\n weekdayClose: Number(row.weekday_close),\n weekendOpen: Number(row.weekend_open),\n weekendClose: Number(row.weekend_close),\n maxOpenPerMember: Number(row.max_open_per_member),\n active: Number(row.active),\n };\n}\n\nasync function upsertResource(r: Resource, sort = 0) {\n await sqlite.execute({\n sql: `INSERT INTO resources (id, name, capacity, vip_reserved, reserve_release_hours, lead_days_vip, lead_days_std,\n weekday_open, weekday_close, weekend_open, weekend_close, max_open_per_member, active, sort)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET name=excluded.name, capacity=excluded.capacity, vip_reserved=excluded.vip_reserved,\n reserve_release_hours=excluded.reserve_release_hours, lead_days_vip=excluded.lead_days_vip,\n lead_days_std=excluded.lead_days_std, weekday_open=excluded.weekday_open, weekday_close=excluded.weekday_close,\n weekend_open=excluded.weekend_open, weekend_close=excluded.weekend_close,\n max_open_per_member=excluded.max_open_per_member, active=excluded.active`,\n args: [\n r.id, r.name, r.capacity, r.vipReserved, r.reserveReleaseHours, r.leadDaysVip, r.leadDaysStd,\n r.weekdayOpen, r.weekdayClose, r.weekendOpen, r.weekendClose, r.maxOpenPerMember, r.active, sort,\n ],\n });\n}\n\nasync function getResource(id: string): Promise {\n const r = await sqlite.execute({ sql: \"SELECT * FROM resources WHERE id = ?\", args: [id] });\n return r.rows[0] ? rowToResource(r.rows[0]) : null;\n}\n\nasync function listResources(onlyActive: boolean): Promise {\n const r = await sqlite.execute(\n onlyActive ? \"SELECT * FROM resources WHERE active = 1 ORDER BY sort, name\" : \"SELECT * FROM resources ORDER BY sort, name\",\n );\n return r.rows.map(rowToResource);\n}\n\nasync function seatsFor(resourceId: string, date: string, hour: number): Promise {\n const r = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? AND b.hour = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date, hour],\n });\n return r.rows.map((row) => ({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n }));\n}\n\nasync function openBookingCount(resourceId: string, memberId: number): Promise {\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT date, hour FROM bookings WHERE resource_id = ? AND member_id = ? AND date >= ?`,\n args: [resourceId, memberId, now.date],\n });\n return r.rows.filter((row) => slotStartEpoch(String(row.date), Number(row.hour)) > now.epoch).length;\n}\n\n// ───────────────────────── Auth ─────────────────────────\n\ntype Env = { Variables: { member: Member | null } };\nconst app = new Hono();\n\napp.use(\"*\", async (c, next) => {\n await ready;\n c.set(\"member\", null);\n const token = getCookie(c, \"abschlag_session\");\n if (token) {\n const r = await sqlite.execute({\n sql: `SELECT m.* FROM sessions s JOIN members m ON m.id = s.member_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND m.active = 1`,\n args: [token],\n });\n if (r.rows[0]) c.set(\"member\", rowToMember(r.rows[0]));\n }\n await next();\n});\n\nfunction requireMember(c: any): Member {\n const m = c.get(\"member\") as Member | null;\n if (!m) throw new HttpError(401, \"Bitte anmelden.\");\n return m;\n}\nfunction requireAdmin(c: any): Member {\n const m = requireMember(c);\n if (!m.isAdmin) throw new HttpError(403, \"Nur für Administratoren.\");\n return m;\n}\nclass HttpError extends Error {\n constructor(public status: number, message: string) {\n super(message);\n }\n}\napp.onError((err, c) => {\n if (err instanceof HttpError) return c.json({ error: err.message }, err.status as any);\n console.error(err);\n return c.json({ error: \"Interner Fehler: \" + err.message }, 500);\n});\n\nasync function createSession(c: any, memberId: number) {\n const token = hex(crypto.getRandomValues(new Uint8Array(32)));\n const expires = new Date(Date.now() + SESSION_DAYS * 86400_000);\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, member_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, memberId, expires.toISOString().replace(\"T\", \" \").slice(0, 19)],\n });\n setCookie(c, \"abschlag_session\", token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n expires,\n });\n}\n\n// ───────────────────────── Seiten & Assets ─────────────────────────\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\n// Logo liegt als Base64-Text im Val (Binärdateien lassen sich nicht direkt anlegen) und wird hier dekodiert.\nlet logoBytes: Uint8Array | null = null;\napp.get(\"/frontend/logo.png\", async (c) => {\n if (!logoBytes) {\n const b64 = (await readFile(\"/frontend/logo.b64\", import.meta.url)).replace(/\\s+/g, \"\");\n logoBytes = Uint8Array.from(atob(b64), (ch) => ch.charCodeAt(0));\n }\n return new Response(logoBytes, { headers: { \"content-type\": \"image/png\", \"cache-control\": \"public, max-age=86400\" } });\n});\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ───────────────────────── Öffentliche API ─────────────────────────\n\napp.get(\"/api/me\", async (c) => {\n const member = c.get(\"member\");\n const setup = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE pin_hash IS NOT NULL\");\n const firstRun = Number(setup.rows[0].n) === 0;\n let setupCode: string | null = null;\n if (firstRun) {\n const a = await sqlite.execute(\"SELECT name, invite_code FROM members WHERE is_admin = 1 ORDER BY id LIMIT 1\");\n if (a.rows[0]) setupCode = `${a.rows[0].name} · ${a.rows[0].invite_code}`;\n }\n let pendingResets = 0;\n if (member?.isAdmin) {\n const p = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE reset_requested_at IS NOT NULL AND active = 1\");\n pendingResets = Number(p.rows[0].n);\n }\n return c.json({\n member,\n resources: await listResources(true),\n now: localNow(),\n setupCode,\n pendingResets,\n });\n});\n\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const code = normCode(body.code);\n if (!validPin(body.pin)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const row = await findByLogin(body.name);\n if (!row || !row.invite_code || String(row.invite_code) !== code) {\n throw new HttpError(400, \"Name oder Einladungscode stimmen nicht.\");\n }\n const mail = cleanEmail(body.email) ?? (row.email ? String(row.email) : null);\n if (!mail) throw new HttpError(400, \"Bitte eine gültige E-Mail-Adresse angeben – sie wird für das Zurücksetzen der PIN gebraucht.\");\n const taken = await sqlite.execute({ sql: \"SELECT id FROM members WHERE email = ? COLLATE NOCASE AND id != ?\", args: [mail, Number(row.id)] });\n if (taken.rows[0]) throw new HttpError(409, \"Diese E-Mail-Adresse ist schon einem anderen Spieler zugeordnet.\");\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.pin, salt);\n await sqlite.execute({\n sql: \"UPDATE members SET pin_hash = ?, pin_salt = ?, email = ?, invite_code = NULL, reset_requested_at = NULL WHERE id = ?\",\n args: [pinHash, salt, mail, Number(row.id)],\n });\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember({ ...row, pin_hash: pinHash, email: mail }) });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.pin)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n const row = await findByLogin(body.name);\n if (!row) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n if (!row.pin_hash) throw new HttpError(400, \"Für diesen Namen wurde noch keine PIN festgelegt – bitte zuerst mit dem Einladungscode registrieren.\");\n const check = await hashPin(body.pin, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember(row) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const token = getCookie(c, \"abschlag_session\");\n if (token) await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n deleteCookie(c, \"abschlag_session\", { path: \"/\" });\n return c.json({ ok: true });\n});\n\n// „PIN vergessen“: hinterlegt eine Anfrage, die der Verwalter in der Verwaltung sieht.\n// Antwortet immer gleich, damit niemand Namen ausprobieren kann.\napp.post(\"/api/reset-request\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const row = await findByLogin(body.name);\n if (row && row.pin_hash) {\n // Neuer Einladungscode; die alte PIN bleibt gültig, bis mit dem Code eine neue gesetzt wird.\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"UPDATE members SET invite_code = ?, reset_requested_at = datetime('now') WHERE id = ?\",\n args: [code, Number(row.id)],\n });\n const name = String(row.name);\n const to = row.email ? String(row.email) : null;\n const origin = new URL(c.req.url).origin;\n const text = `Hallo ${name},\\n\\nfür dein Konto bei der JK Golfakademie wurde ein PIN-Reset angefordert.\\n\\n` +\n `Dein Einladungscode: ${code}\\n\\nÖffne ${origin}, wähle „Registrieren“, gib deinen Namen, diesen Code und eine neue PIN ein.\\n` +\n `Falls du das nicht warst, kannst du diese E-Mail ignorieren – deine bisherige PIN bleibt gültig.`;\n let delivered = false;\n if (to) {\n try {\n await sendEmail({ to, subject: \"JK Golfakademie – PIN zurücksetzen\", text });\n delivered = true;\n } catch (err) {\n console.error(\"E-Mail an Spieler fehlgeschlagen:\", (err as Error).message);\n }\n }\n if (!delivered) {\n // Fallback: der Verwalter (Val-Owner) bekommt die Anfrage und gibt den Code weiter.\n try {\n await sendEmail({\n subject: `PIN-Reset angefragt: ${name}`,\n text: `${name}${to ? ` (${to})` : \"\"} hat einen PIN-Reset angefragt.\\nNeuer Einladungscode: ${code}\\n` +\n `Bitte an die Person weitergeben (auch sichtbar in der Verwaltung).`,\n });\n } catch (err) {\n console.error(\"E-Mail an Verwalter fehlgeschlagen:\", (err as Error).message);\n }\n }\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/profile/email\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n const mail = cleanEmail(body.email);\n if (!mail) throw new HttpError(400, \"Bitte eine gültige E-Mail-Adresse angeben.\");\n const taken = await sqlite.execute({ sql: \"SELECT id FROM members WHERE email = ? COLLATE NOCASE AND id != ?\", args: [mail, member.id] });\n if (taken.rows[0]) throw new HttpError(409, \"Diese E-Mail-Adresse ist schon einem anderen Spieler zugeordnet.\");\n await sqlite.execute({ sql: \"UPDATE members SET email = ? WHERE id = ?\", args: [mail, member.id] });\n return c.json({ ok: true, email: mail });\n});\n\n// ───────────────────────── Profil ─────────────────────────\n\napp.post(\"/api/profile/alias\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (body.alias === \"\" || body.alias === null) {\n await sqlite.execute({ sql: \"UPDATE members SET alias = NULL WHERE id = ?\", args: [member.id] });\n return c.json({ ok: true, alias: null });\n }\n const alias = cleanAlias(body.alias);\n if (!alias) throw new HttpError(400, \"Alias: 3–20 Zeichen, Buchstaben, Ziffern, Punkt, Bindestrich oder Unterstrich.\");\n if (alias.includes(\" \")) throw new HttpError(400, \"Ein Alias darf keine Leerzeichen enthalten.\");\n const clash = await sqlite.execute({\n sql: \"SELECT id FROM members WHERE (alias = ? COLLATE NOCASE OR name = ?) AND id != ?\",\n args: [alias, alias, member.id],\n });\n if (clash.rows[0]) throw new HttpError(409, \"Dieser Alias ist schon vergeben.\");\n await sqlite.execute({ sql: \"UPDATE members SET alias = ? WHERE id = ?\", args: [alias, member.id] });\n return c.json({ ok: true, alias });\n});\n\napp.post(\"/api/profile/pin\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.current) || !validPin(body.next)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const r = await sqlite.execute({ sql: \"SELECT pin_hash, pin_salt FROM members WHERE id = ?\", args: [member.id] });\n const row = r.rows[0];\n const check = await hashPin(body.current, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Die aktuelle PIN stimmt nicht.\");\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.next, salt);\n const token = getCookie(c, \"abschlag_session\");\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = ?, pin_salt = ? WHERE id = ?\", args: [pinHash, salt, member.id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ? AND token != ?\", args: [member.id, token ?? \"\"] },\n ]);\n return c.json({ ok: true });\n});\n\n// ───────────────────────── Slots & Buchungen ─────────────────────────\n\napp.get(\"/api/slots\", async (c) => {\n const member = requireMember(c);\n const resourceId = c.req.query(\"resource\") ?? \"golf\";\n const date = c.req.query(\"date\");\n if (!isValidDate(date)) throw new HttpError(400, \"Ungültiges Datum.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const rows = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, b.hour, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date],\n });\n const byHour = new Map();\n for (const row of rows.rows) {\n const h = Number(row.hour);\n if (!byHour.has(h)) byHour.set(h, []);\n byHour.get(h)!.push({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n });\n }\n const openCount = await openBookingCount(resourceId, member.id);\n\n const slots = slotHours(resource, date).map((hour) => {\n const seats = byHour.get(hour) ?? [];\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n const startMs = slotStartEpoch(date, hour);\n const avail = seatsAvailableFor(resource, member, seats, startMs, now.epoch);\n const mine = seats.find((s) => s.memberId === member.id) ?? null;\n return {\n hour,\n seats,\n capacity: resource.capacity,\n freeForYou: avail.free,\n reserveActive: avail.reserveActive,\n past: startMs <= now.epoch,\n canBook: verdict.ok,\n reasonCode: verdict.code,\n reason: verdict.reason,\n myBookingId: mine?.bookingId ?? null,\n canCancel: !!mine && canCancel({ date, hour, now }),\n };\n });\n\n return c.json({ date, resource, slots, openCount, now });\n});\n\napp.post(\"/api/bookings\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n const resourceId = String(body.resource ?? \"golf\");\n const date = body.date;\n const hour = Number(body.hour);\n if (!isValidDate(date) || !Number.isInteger(hour)) throw new HttpError(400, \"Ungültiger Termin.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const seats = await seatsFor(resourceId, date, hour);\n const openCount = await openBookingCount(resourceId, member.id);\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n if (!verdict.ok) throw new HttpError(409, verdict.reason);\n\n const ins = await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO bookings (resource_id, member_id, date, hour) VALUES (?, ?, ?, ?)\",\n args: [resourceId, member.id, date, hour],\n });\n const id = Number(ins.lastInsertRowid);\n\n // Schutz gegen gleichzeitige Buchungen: nach dem Schreiben noch einmal zählen.\n const after = await seatsFor(resourceId, date, hour);\n const mine = after.find((s) => s.memberId === member.id);\n if (after.length > resource.capacity && mine && after.indexOf(mine) >= resource.capacity) {\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [mine.bookingId] });\n throw new HttpError(409, \"Diese Stunde wurde gerade von jemand anderem gefüllt.\");\n }\n return c.json({ ok: true, id: mine?.bookingId ?? id });\n});\n\napp.delete(\"/api/bookings/:id\", async (c) => {\n const member = requireMember(c);\n const id = Number(c.req.param(\"id\"));\n const r = await sqlite.execute({ sql: \"SELECT * FROM bookings WHERE id = ?\", args: [id] });\n const row = r.rows[0];\n if (!row) throw new HttpError(404, \"Buchung nicht gefunden.\");\n if (Number(row.member_id) !== member.id && !member.isAdmin) throw new HttpError(403, \"Das ist nicht deine Buchung.\");\n if (!canCancel({ date: String(row.date), hour: Number(row.hour), now: localNow() })) {\n throw new HttpError(409, \"Der Termin hat bereits begonnen und kann nicht mehr storniert werden.\");\n }\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [id] });\n return c.json({ ok: true });\n});\n\napp.get(\"/api/bookings/mine\", async (c) => {\n const member = requireMember(c);\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, r.name AS resource_name, b.date, b.hour\n FROM bookings b JOIN resources r ON r.id = b.resource_id\n WHERE b.member_id = ? AND b.date >= ? ORDER BY b.date, b.hour`,\n args: [member.id, addDays(now.date, -1)],\n });\n const bookings = r.rows\n .map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n resourceName: String(row.resource_name),\n date: String(row.date),\n hour: Number(row.hour),\n }))\n .filter((b) => slotStartEpoch(b.date, b.hour) + 3600_000 > now.epoch);\n return c.json({ bookings });\n});\n\n// ───────────────────────── Admin ─────────────────────────\n\napp.get(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const r = await sqlite.execute(\"SELECT * FROM members ORDER BY active DESC, name\");\n return c.json({\n members: r.rows.map((row) => ({\n ...rowToMember(row),\n registered: !!row.pin_hash,\n inviteCode: row.invite_code ? String(row.invite_code) : null,\n resetRequestedAt: row.reset_requested_at ? String(row.reset_requested_at) : null,\n email: row.email ? String(row.email) : null,\n createdAt: String(row.created_at),\n })),\n });\n});\n\napp.post(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const body = await c.req.json().catch(() => ({}));\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Bitte Vor- und Nachnamen eingeben (z. B. „Anna Müller“).\");\n const dup = await sqlite.execute({ sql: \"SELECT id FROM members WHERE name = ? OR alias = ? COLLATE NOCASE\", args: [name, name] });\n if (dup.rows[0]) throw new HttpError(409, \"Diesen Namen gibt es schon.\");\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_vip) VALUES (?, ?, ?)\",\n args: [name, code, body.isVip ? 1 : 0],\n });\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.patch(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const sets: string[] = [];\n const args: unknown[] = [];\n if (typeof body.isVip === \"boolean\") { sets.push(\"is_vip = ?\"); args.push(body.isVip ? 1 : 0); }\n if (typeof body.isAdmin === \"boolean\") {\n if (id === admin.id && !body.isAdmin) throw new HttpError(400, \"Du kannst dir nicht selbst die Admin-Rechte entziehen.\");\n sets.push(\"is_admin = ?\"); args.push(body.isAdmin ? 1 : 0);\n }\n if (typeof body.active === \"boolean\") {\n if (id === admin.id && !body.active) throw new HttpError(400, \"Du kannst dich nicht selbst deaktivieren.\");\n sets.push(\"active = ?\"); args.push(body.active ? 1 : 0);\n }\n if (body.name !== undefined) {\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Ungültiger Name.\");\n sets.push(\"name = ?\"); args.push(name);\n }\n if (!sets.length) throw new HttpError(400, \"Nichts zu ändern.\");\n args.push(id);\n await sqlite.execute({ sql: `UPDATE members SET ${sets.join(\", \")} WHERE id = ?`, args });\n if (body.active === false) {\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ? AND date >= date('now')\", args: [id] },\n ]);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/admin/members/:id/reset\", async (c) => {\n requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const code = newInviteCode();\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = NULL, pin_salt = NULL, invite_code = ?, reset_requested_at = NULL WHERE id = ?\", args: [code, id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n ]);\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.delete(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n if (id === admin.id) throw new HttpError(400, \"Du kannst dich nicht selbst löschen.\");\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM members WHERE id = ?\", args: [id] },\n ]);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/resources\", async (c) => {\n requireAdmin(c);\n return c.json({ resources: await listResources(false) });\n});\n\napp.put(\"/api/admin/resources/:id\", async (c) => {\n requireAdmin(c);\n const id = c.req.param(\"id\");\n const body = await c.req.json().catch(() => ({}));\n const existing = await getResource(id);\n const base: Resource = existing ?? { ...DEFAULT_GOLF, id, name: id };\n const num = (key: keyof Resource, min: number, max: number) => {\n const v = body[key] === undefined ? base[key] : Number(body[key]);\n if (!Number.isInteger(v) || v < min || v > max) throw new HttpError(400, `Ungültiger Wert für ${key}.`);\n return v as number;\n };\n const r: Resource = {\n id,\n name: typeof body.name === \"string\" && body.name.trim() ? body.name.trim().slice(0, 40) : base.name,\n capacity: num(\"capacity\", 1, 50),\n vipReserved: num(\"vipReserved\", 0, 50),\n reserveReleaseHours: num(\"reserveReleaseHours\", 0, 240),\n leadDaysVip: num(\"leadDaysVip\", 0, 90),\n leadDaysStd: num(\"leadDaysStd\", 0, 90),\n weekdayOpen: num(\"weekdayOpen\", 0, 23),\n weekdayClose: num(\"weekdayClose\", 1, 24),\n weekendOpen: num(\"weekendOpen\", 0, 23),\n weekendClose: num(\"weekendClose\", 1, 24),\n maxOpenPerMember: num(\"maxOpenPerMember\", 1, 50),\n active: body.active === undefined ? base.active : (body.active ? 1 : 0),\n };\n if (r.vipReserved > r.capacity) throw new HttpError(400, \"Reservierte Plätze dürfen die Kapazität nicht übersteigen.\");\n if (r.weekdayOpen >= r.weekdayClose || r.weekendOpen >= r.weekendClose) throw new HttpError(400, \"Öffnung muss vor Schließung liegen.\");\n await upsertResource(r, existing ? undefined : 10);\n return c.json({ ok: true, resource: r });\n});\n\napp.get(\"/api/admin/bookings\", async (c) => {\n requireAdmin(c);\n const now = localNow();\n const from = c.req.query(\"from\") ?? now.date;\n const to = c.req.query(\"to\") ?? addDays(now.date, 14);\n if (!isValidDate(from) || !isValidDate(to)) throw new HttpError(400, \"Ungültiges Datum.\");\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, b.date, b.hour, b.created_at, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.date BETWEEN ? AND ? ORDER BY b.date, b.hour, b.created_at`,\n args: [from, to],\n });\n return c.json({\n bookings: r.rows.map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n date: String(row.date),\n hour: Number(row.hour),\n createdAt: String(row.created_at),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n })),\n });\n});\n\nexport default app.fetch;\n","label","jk-golfakademie",[136],"47ee9864-79a9-4456-ab6a-67dc1c47918e","scripts","fae00817-115f-468d-a43b-0bf42ede5f83",53,["D",1789078499464],"directory",[148],"7e19e212-95e2-4d25-9bb1-ccec38d87308","lib","d7a76aaf-e82b-46e9-915a-6241250f9ed1",2,["D",1789073571875],[155],"fe2bec12-2b41-40b5-8547-87442acec0e4","frontend","cf10625b-43cb-4093-a001-6cbdd3410d99",4,["D",1789073648998],[161],"pulls","branches",1,"forks","envVars",{"_174":63,"_176":63},"connections",{"_174":63,"_175":63},"count","unfilledCount","emptyCount",{"_43":160,"_32":161,"_30":162,"_137":-5,"_41":42,"_40":163,"_139":59,"_38":243,"_13":63,"_34":152,"_35":-5,"_24":25,"_144":-5,"_188":244,"_27":245},{"_43":234,"_32":235,"_30":236,"_137":162,"_41":42,"_40":237,"_139":59,"_38":238,"_13":239,"_34":198,"_35":240,"_24":25,"_144":-5,"_188":241,"_27":242},{"_43":230,"_32":33,"_30":31,"_137":162,"_41":42,"_40":14,"_139":25,"_38":231,"_13":157,"_34":20,"_35":37,"_24":25,"_144":-5,"_188":232,"_27":233},{"_43":222,"_32":223,"_30":224,"_137":162,"_41":42,"_40":225,"_139":59,"_38":226,"_13":63,"_34":20,"_35":227,"_24":25,"_144":-5,"_188":228,"_27":229},{"_43":213,"_32":214,"_30":215,"_137":162,"_41":42,"_40":216,"_139":59,"_38":217,"_13":218,"_34":20,"_35":219,"_24":25,"_144":-5,"_188":220,"_27":221},{"_43":154,"_32":155,"_30":156,"_137":-5,"_41":42,"_40":157,"_139":59,"_38":210,"_13":63,"_34":152,"_35":-5,"_24":25,"_144":-5,"_188":211,"_27":212},{"_43":202,"_32":203,"_30":204,"_137":156,"_41":42,"_40":205,"_139":59,"_38":206,"_13":157,"_34":198,"_35":207,"_24":25,"_144":-5,"_188":208,"_27":209},{"_43":194,"_32":195,"_30":196,"_137":156,"_41":42,"_40":157,"_139":59,"_38":197,"_13":63,"_34":198,"_35":199,"_24":25,"_144":-5,"_188":200,"_27":201},{"_43":147,"_32":148,"_30":149,"_137":-5,"_41":42,"_40":150,"_139":59,"_38":191,"_13":63,"_34":152,"_35":-5,"_24":25,"_144":-5,"_188":192,"_27":193},{"_43":135,"_32":136,"_30":57,"_137":-5,"_41":42,"_40":138,"_139":59,"_38":187,"_13":141,"_34":142,"_35":143,"_24":25,"_144":145,"_188":189,"_27":190},["D",1789078487659],"children",[],[136],["D",1789078499464],[],[148],"17a3e205-bb37-449c-9c3e-d7f75c402f74","time.ts","96cd6e74-ad59-11f1-8452-1607ee4eb77e",["D",1789073571875],"script","// Zeitfunktionen für Europe/Berlin – Val Town läuft in UTC, die Buchungen\n// sind aber in lokaler Zeit gedacht. Alle Slots werden als (Datum, Stunde)\n// in Berliner Zeit gespeichert.\n\nexport const TZ = \"Europe/Berlin\";\n\nexport type LocalNow = { date: string; hour: number; minute: number; epoch: number };\n\nconst fmt = new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: TZ,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n hour12: false,\n});\n\n/** Zerlegt einen Zeitpunkt in Berliner Datum/Stunde/Minute. */\nexport function toLocal(epochMs: number): LocalNow {\n const parts: Record = {};\n for (const p of fmt.formatToParts(new Date(epochMs))) parts[p.type] = p.value;\n const hour = Number(parts.hour) % 24; // manche Engines liefern \"24\" für Mitternacht\n return {\n date: `${parts.year}-${parts.month}-${parts.day}`,\n hour,\n minute: Number(parts.minute),\n epoch: epochMs,\n };\n}\n\nexport function localNow(): LocalNow {\n return toLocal(Date.now());\n}\n\n/** Berliner (Datum, Stunde) -> Epoch-Millisekunden, sommerzeitsicher. */\nexport function slotStartEpoch(date: string, hour: number): number {\n const [y, m, d] = date.split(\"-\").map(Number);\n // Erste Annahme: als wäre es UTC, dann Offset zweimal korrigieren.\n let guess = Date.UTC(y, m - 1, d, hour, 0, 0);\n for (let i = 0; i < 2; i++) {\n const loc = toLocal(guess);\n const asUtc = Date.UTC(\n Number(loc.date.slice(0, 4)),\n Number(loc.date.slice(5, 7)) - 1,\n Number(loc.date.slice(8, 10)),\n loc.hour,\n loc.minute,\n );\n guess += Date.UTC(y, m - 1, d, hour) - asUtc;\n }\n return guess;\n}\n\n/** 0 = Sonntag … 6 = Samstag, für ein YYYY-MM-DD in Berliner Zeit. */\nexport function weekday(date: string): number {\n const [y, m, d] = date.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d, 12)).getUTCDay();\n}\n\nexport function isWeekend(date: string): boolean {\n const wd = weekday(date);\n return wd === 0 || wd === 6;\n}\n\n/** Kalendertage von `from` bis `to` (positiv, wenn `to` später liegt). */\nexport function daysBetween(from: string, to: string): number {\n return Math.round((dateUtc(to) - dateUtc(from)) / 86400000);\n}\n\nfunction dateUtc(date: string): number {\n const [y, m, d] = date.split(\"-\").map(Number);\n return Date.UTC(y, m - 1, d);\n}\n\nexport function addDays(date: string, n: number): string {\n const [y, m, d] = date.split(\"-\").map(Number);\n const t = new Date(Date.UTC(y, m - 1, d + n, 12));\n return t.toISOString().slice(0, 10);\n}\n\nexport function isValidDate(s: unknown): s is string {\n if (typeof s !== \"string\" || !/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n const [y, m, d] = s.split(\"-\").map(Number);\n const t = new Date(Date.UTC(y, m - 1, d));\n return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n",[],[155,195],"e6d6676a-7cb8-4008-9a46-3f038fc70b93","rules.ts","a59a4c10-ad59-11f1-aab1-1607ee4eb77e",41,["D",1789077889611],"// Reine Buchungsregeln – keine Datenbank, kein Netzwerk. Wird vom Server\n// benutzt und lässt sich lokal ohne Val Town testen.\n\nimport { daysBetween, isWeekend, slotStartEpoch, type LocalNow } from \"./time.ts\";\n\nexport type Resource = {\n id: string;\n name: string;\n capacity: number; // Plätze pro Stunde (Golf: 4)\n vipReserved: number; // davon bis kurz vor Termin nur für VIPs (Golf: 1)\n reserveReleaseHours: number; // so viele Stunden vor Start wird die VIP-Reserve für alle frei (24)\n leadDaysVip: number; // VIP-Buchungsvorlauf in Tagen (14)\n leadDaysStd: number; // normaler Vorlauf (7)\n weekdayOpen: number; // Mo–Fr: erste buchbare Stunde (9 = 9:00–10:00)\n weekdayClose: number; // Mo–Fr: Schließzeit (22 = letzter Slot 21:00–22:00)\n weekendOpen: number;\n weekendClose: number;\n maxOpenPerMember: number; // offene (zukünftige) Buchungen pro Spieler und Ressource\n active: number;\n};\n\nexport type Member = { id: number; name: string; alias?: string | null; email?: string | null; isVip: boolean; isAdmin: boolean; active: boolean };\n\nexport type Seat = { bookingId: number; memberId: number; name: string; isVip: boolean };\n\nexport type Verdict = {\n ok: boolean;\n code:\n | \"ok\"\n | \"closed\"\n | \"past\"\n | \"lead\"\n | \"full\"\n | \"vip_only\"\n | \"already\"\n | \"limit\";\n reason: string;\n};\n\nexport function openingHours(r: Resource, date: string): { open: number; close: number } {\n return isWeekend(date)\n ? { open: r.weekendOpen, close: r.weekendClose }\n : { open: r.weekdayOpen, close: r.weekdayClose };\n}\n\nexport function slotHours(r: Resource, date: string): number[] {\n const { open, close } = openingHours(r, date);\n const hours: number[] = [];\n for (let h = open; h < close; h++) hours.push(h);\n return hours;\n}\n\n/** Freie Plätze aus Sicht eines bestimmten Spielers. */\nexport function seatsAvailableFor(\n r: Resource,\n member: Member,\n seats: Seat[],\n slotStartMs: number,\n nowMs: number,\n): { free: number; reserveActive: boolean } {\n const total = r.capacity - seats.length;\n const reserveActive = r.vipReserved > 0 && slotStartMs - nowMs > r.reserveReleaseHours * 3600_000;\n if (member.isVip || !reserveActive) return { free: Math.max(0, total), reserveActive };\n // Nicht-VIP: darf nur die nicht reservierten Plätze belegen.\n const nonVipSeats = seats.filter((s) => !s.isVip).length;\n const nonVipCap = r.capacity - r.vipReserved;\n return { free: Math.max(0, Math.min(total, nonVipCap - nonVipSeats)), reserveActive };\n}\n\nexport function evaluateBooking(input: {\n resource: Resource;\n member: Member;\n date: string;\n hour: number;\n seats: Seat[];\n now: LocalNow;\n openBookingsOfMember: number; // zukünftige Buchungen dieses Spielers auf dieser Ressource\n}): Verdict {\n const { resource: r, member, date, hour, seats, now } = input;\n\n const { open, close } = openingHours(r, date);\n if (hour < open || hour >= close) {\n return { ok: false, code: \"closed\", reason: `Außerhalb der Öffnungszeit (${open}–${close} Uhr).` };\n }\n\n const startMs = slotStartEpoch(date, hour);\n if (startMs <= now.epoch) {\n return { ok: false, code: \"past\", reason: \"Dieser Termin liegt in der Vergangenheit.\" };\n }\n\n const lead = member.isVip ? r.leadDaysVip : r.leadDaysStd;\n const daysAhead = daysBetween(now.date, date);\n if (daysAhead > lead) {\n return {\n ok: false,\n code: \"lead\",\n reason: member.isVip\n ? `Buchbar ab ${lead} Tage vor dem Termin.`\n : `Buchbar ab ${lead} Tage vor dem Termin (VIP: ${r.leadDaysVip} Tage).`,\n };\n }\n\n if (seats.some((s) => s.memberId === member.id)) {\n return { ok: false, code: \"already\", reason: \"Du bist in dieser Stunde bereits eingetragen.\" };\n }\n\n if (input.openBookingsOfMember >= r.maxOpenPerMember) {\n return {\n ok: false,\n code: \"limit\",\n reason: `Maximal ${r.maxOpenPerMember} offene Buchungen gleichzeitig.`,\n };\n }\n\n if (seats.length >= r.capacity) {\n return { ok: false, code: \"full\", reason: \"Diese Stunde ist voll.\" };\n }\n\n const { free, reserveActive } = seatsAvailableFor(r, member, seats, startMs, now.epoch);\n if (free <= 0) {\n return {\n ok: false,\n code: reserveActive ? \"vip_only\" : \"full\",\n reason: reserveActive\n ? `Der letzte Platz ist bis ${r.reserveReleaseHours} Std. vor Start für VIPs reserviert.`\n : \"Diese Stunde ist voll.\",\n };\n }\n\n return { ok: true, code: \"ok\", reason: \"\" };\n}\n\nexport function canCancel(input: { date: string; hour: number; now: LocalNow }): boolean {\n return slotStartEpoch(input.date, input.hour) > input.now.epoch;\n}\n\n/** Standardressource: der Golfsimulator. */\nexport const DEFAULT_GOLF: Resource = {\n id: \"golf\",\n name: \"Golfsimulator\",\n capacity: 4,\n vipReserved: 1,\n reserveReleaseHours: 24,\n leadDaysVip: 14,\n leadDaysStd: 7,\n weekdayOpen: 9,\n weekdayClose: 22,\n weekendOpen: 10,\n weekendClose: 21,\n maxOpenPerMember: 3,\n active: 1,\n};\n",[],[155,203],["D",1789073571875],[183,184],[155],"6e0fd77c-ec39-4f67-bd51-f5d14a542638","style.css","e324ab0c-ad59-11f1-a83b-1607ee4eb77e",45,["D",1789077902772],5,"/* JK Golfakademie – Buchung\n Farbwelt: Fairway-Grün als Akzent, Gold für VIP, warm-neutrale Grautöne.\n Hell ist Standard, Dunkel folgt der Systemeinstellung oder dem Schalter. */\n\n:root {\n color-scheme: light dark;\n\n /* Hell */\n --ground: #f3f4ef;\n --surface: #ffffff;\n --surface-2: #e9ece4;\n --surface-3: #dfe4dc;\n --ink: #101613;\n --ink-2: #4a554e;\n --muted: #7b857e;\n --line: #dde1d8;\n --line-strong: #c9cfc4;\n --accent: #0e6b3e;\n --accent-hover: #0b5a34;\n --accent-ink: #ffffff;\n --accent-soft: #dcf2e4;\n --accent-glow: rgba(14, 107, 62, .18);\n --gold: #b8892a;\n --gold-soft: #f8efd6;\n --danger: #b9382c;\n --danger-soft: #fbe4e1;\n --hero-a: #0f5a36;\n --hero-b: #0a3d26;\n --hero-ink: #eef6f0;\n --shadow-1: 0 1px 2px rgba(16, 22, 19, .05), 0 1px 1px rgba(16, 22, 19, .03);\n --shadow-2: 0 2px 4px rgba(16, 22, 19, .05), 0 12px 32px -16px rgba(16, 22, 19, .25);\n --glass: rgba(243, 244, 239, .78);\n\n --r-sm: 10px;\n --r-md: 14px;\n --r-lg: 20px;\n --font: \"Manrope\", \"Avenir Next\", \"Segoe UI\", system-ui, sans-serif;\n --mono: \"JetBrains Mono\", ui-monospace, SFMono-Regular, Menlo, monospace;\n --ease: cubic-bezier(.2, .7, .2, 1);\n\n accent-color: var(--accent);\n}\n\n@media (prefers-color-scheme: dark) {\n :root:not([data-theme=\"light\"]) {\n --ground: #0b0f0d; --surface: #131916; --surface-2: #1a221d; --surface-3: #232d27;\n --ink: #ecf1ec; --ink-2: #aeb8b1; --muted: #76817a; --line: #253029; --line-strong: #334039;\n --accent: #3fcf80; --accent-hover: #5adb93; --accent-ink: #06170e; --accent-soft: #143526; --accent-glow: rgba(63, 207, 128, .22);\n --gold: #e0b44e; --gold-soft: #33290f; --danger: #f08a7e; --danger-soft: #3a1d19;\n --hero-a: #133f2a; --hero-b: #0a1f15; --hero-ink: #e7f0e9;\n --shadow-1: 0 1px 2px rgba(0,0,0,.5); --shadow-2: 0 2px 4px rgba(0,0,0,.4), 0 16px 40px -20px rgba(0,0,0,.8);\n --glass: rgba(11, 15, 13, .72);\n }\n}\n:root[data-theme=\"dark\"] {\n --ground: #0b0f0d; --surface: #131916; --surface-2: #1a221d; --surface-3: #232d27;\n --ink: #ecf1ec; --ink-2: #aeb8b1; --muted: #76817a; --line: #253029; --line-strong: #334039;\n --accent: #3fcf80; --accent-hover: #5adb93; --accent-ink: #06170e; --accent-soft: #143526; --accent-glow: rgba(63, 207, 128, .22);\n --gold: #e0b44e; --gold-soft: #33290f; --danger: #f08a7e; --danger-soft: #3a1d19;\n --hero-a: #133f2a; --hero-b: #0a1f15; --hero-ink: #e7f0e9;\n --shadow-1: 0 1px 2px rgba(0,0,0,.5); --shadow-2: 0 2px 4px rgba(0,0,0,.4), 0 16px 40px -20px rgba(0,0,0,.8);\n --glass: rgba(11, 15, 13, .72);\n}\n:root[data-theme=\"light\"] { color-scheme: light; }\n:root[data-theme=\"dark\"] { color-scheme: dark; }\n\n/* ───────── Basis ───────── */\n* { box-sizing: border-box; }\nhtml { -webkit-text-size-adjust: 100%; scroll-behavior: smooth; }\nbody {\n margin: 0; background: var(--ground); color: var(--ink);\n font-family: var(--font); font-size: 15.5px; line-height: 1.55;\n font-variant-numeric: tabular-nums; letter-spacing: -.005em;\n min-height: 100dvh; display: flex; flex-direction: column;\n -webkit-font-smoothing: antialiased;\n}\n.wrap { width: 100%; max-width: 1120px; margin-inline: auto; padding-inline: clamp(16px, 4vw, 32px); }\nmain { flex: 1; padding-block: clamp(20px, 4vw, 40px) 56px; }\nh1, h2, h3 { margin: 0; text-wrap: balance; letter-spacing: -.02em; }\np { margin: 0; }\na { color: var(--accent); }\nbutton { font: inherit; cursor: pointer; color: inherit; }\ninput { font: inherit; color: var(--ink); }\n:focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; border-radius: 6px; }\n[hidden] { display: none !important; }\n.mono { font-family: var(--mono); font-weight: 600; letter-spacing: .02em; }\n::selection { background: var(--accent-soft); color: var(--ink); }\n\n.eyebrow { font-size: 12px; font-weight: 700; letter-spacing: .14em; text-transform: uppercase; color: var(--accent); }\n.page-title { font-size: clamp(30px, 5vw, 44px); font-weight: 800; line-height: 1.05; margin-top: 6px; }\n.sub { color: var(--ink-2); margin-top: 8px; max-width: 60ch; }\n.card-title { font-size: 18px; font-weight: 800; }\n.hint { color: var(--muted); font-size: 13.5px; line-height: 1.5; }\n.error { color: var(--danger); font-size: 14px; font-weight: 500; }\n\n/* ───────── Kopfzeile ───────── */\n.topbar {\n position: sticky; top: 0; z-index: 20;\n background: var(--glass); backdrop-filter: blur(14px) saturate(1.4); -webkit-backdrop-filter: blur(14px) saturate(1.4);\n border-bottom: 1px solid var(--line);\n}\n.topbar-inner { display: flex; align-items: center; gap: 12px 20px; min-height: 64px; flex-wrap: wrap; padding-block: 10px; }\n.brand { display: inline-flex; align-items: center; gap: 10px; color: inherit; text-decoration: none; }\n.brand-mark { width: 40px; height: 36px; display: block; }\n.brand-mark img { width: 100%; height: 100%; object-fit: contain; display: block; }\n.brand-text { font-weight: 600; font-size: 17px; letter-spacing: -.01em; white-space: nowrap; }\n.brand-text strong { font-weight: 800; }\n\n.nav { display: flex; gap: 2px; padding: 3px; background: var(--surface-2); border-radius: 999px; }\n.navbtn { position: relative; background: transparent; border: 0; color: var(--ink-2); padding: 7px 14px; border-radius: 999px; font-weight: 600; font-size: 14px; transition: color .15s, background-color .15s; }\n.navbtn:hover { color: var(--ink); }\n.navbtn.is-active { background: var(--surface); color: var(--ink); box-shadow: var(--shadow-1); }\n.badge { display: inline-grid; place-items: center; min-width: 18px; height: 18px; padding-inline: 5px; margin-left: 4px; border-radius: 999px; background: var(--gold); color: #1a1408; font-size: 11px; font-weight: 800; vertical-align: 1px; }\n\n.topbar-right { margin-left: auto; display: flex; align-items: center; gap: 10px; }\n.iconbtn { width: 38px; height: 38px; border-radius: 999px; border: 1px solid var(--line); background: var(--surface); display: grid; place-items: center; transition: background-color .15s, border-color .15s, transform .15s var(--ease); }\n.iconbtn:hover { border-color: var(--line-strong); transform: translateY(-1px); }\n.iconbtn svg { width: 18px; height: 18px; fill: none; stroke: currentColor; stroke-width: 1.8; stroke-linecap: round; stroke-linejoin: round; }\n.ico-moon { display: none; }\n:root[data-theme=\"dark\"] .ico-sun { display: none; }\n:root[data-theme=\"dark\"] .ico-moon { display: block; }\n@media (prefers-color-scheme: dark) {\n :root:not([data-theme=\"light\"]) .ico-sun { display: none; }\n :root:not([data-theme=\"light\"]) .ico-moon { display: block; }\n}\n.who { display: flex; align-items: center; gap: 10px; font-size: 14px; }\n.who-name { font-weight: 600; }\n.who-name .vip { color: var(--gold); }\n.linkbtn { background: none; border: 0; color: var(--ink-2); text-decoration: underline; text-underline-offset: 3px; padding: 4px 2px; font-size: 14px; }\n.linkbtn:hover { color: var(--ink); }\n.linkbtn.subtle { justify-self: center; color: var(--muted); }\n\n/* ───────── Buttons ───────── */\n.btn { display: inline-flex; align-items: center; justify-content: center; gap: 8px; border-radius: 999px; padding: 10px 18px; border: 1px solid transparent; font-weight: 700; font-size: 14px; white-space: nowrap; transition: transform .15s var(--ease), background-color .15s, border-color .15s, box-shadow .15s; }\n.btn:active { transform: scale(.98); }\n.btn-primary { background: var(--accent); color: var(--accent-ink); box-shadow: 0 6px 18px -8px var(--accent-glow); }\n.btn-primary:hover { background: var(--accent-hover); transform: translateY(-1px); }\n.btn-ghost { background: var(--surface); border-color: var(--line); color: var(--ink); }\n.btn-ghost:hover { border-color: var(--line-strong); background: var(--surface-2); }\n.btn-danger { background: transparent; border-color: var(--line); color: var(--danger); }\n.btn-danger:hover { background: var(--danger-soft); border-color: transparent; }\n.btn:disabled { opacity: .5; cursor: not-allowed; transform: none; box-shadow: none; }\n.btn-sm { padding: 6px 12px; font-size: 13px; }\n.btn-lg { padding: 13px 22px; font-size: 15px; }\n\n/* ───────── Anmeldung ───────── */\n.auth { padding-top: clamp(8px, 2vw, 24px); }\n.auth-grid { display: grid; grid-template-columns: 1.1fr .9fr; gap: 20px; align-items: stretch; }\n.auth-brand {\n position: relative; overflow: hidden; border-radius: var(--r-lg); padding: clamp(24px, 4vw, 44px);\n background: radial-gradient(120% 90% at 10% 0%, var(--hero-a), var(--hero-b) 70%); color: var(--hero-ink);\n display: flex; flex-direction: column; justify-content: space-between; gap: 32px; min-height: 420px;\n}\n.auth-brand::before {\n content: \"\"; position: absolute; inset: 0; pointer-events: none; opacity: .35;\n background-image: linear-gradient(rgba(255,255,255,.08) 1px, transparent 1px), linear-gradient(90deg, rgba(255,255,255,.08) 1px, transparent 1px);\n background-size: 40px 40px; mask-image: radial-gradient(80% 70% at 80% 100%, #000, transparent);\n}\n.auth-brand::after {\n content: \"\"; position: absolute; right: -60px; bottom: -80px; width: 260px; height: 260px; border-radius: 50%;\n background: radial-gradient(circle at 35% 35%, rgba(255,255,255,.9), rgba(255,255,255,.35) 40%, rgba(255,255,255,0) 70%);\n opacity: .12; pointer-events: none;\n}\n.hero-logo { position: relative; display: inline-block; align-self: flex-start; background: #f3f4ef; border-radius: 16px; padding: 14px 18px; box-shadow: 0 10px 30px -14px rgba(0,0,0,.6); }\n.hero-logo img { display: block; width: 220px; max-width: 100%; height: auto; }\n.hero-title { position: relative; font-size: clamp(34px, 5.2vw, 56px); font-weight: 800; line-height: 1.02; letter-spacing: -.03em; max-width: 12ch; }\n.hero-sub { position: relative; color: rgba(255,255,255,.78); max-width: 42ch; margin-top: 12px; font-size: 15.5px; }\n.hero-facts { position: relative; list-style: none; margin: 0; padding: 0; display: flex; flex-wrap: wrap; gap: 8px; }\n.hero-facts li { display: inline-flex; align-items: center; gap: 8px; padding: 8px 12px; border-radius: 999px; background: rgba(255,255,255,.1); border: 1px solid rgba(255,255,255,.14); font-size: 13.5px; }\n.hero-facts .mono { color: #e3b341; }\n\n.auth-card { background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-lg); padding: clamp(20px, 3vw, 32px); box-shadow: var(--shadow-2); display: grid; gap: 18px; align-content: start; }\n.tabs { display: flex; gap: 2px; padding: 3px; background: var(--surface-2); border-radius: 999px; }\n.tab { flex: 1; background: none; border: 0; padding: 8px 10px; white-space: nowrap; border-radius: 999px; color: var(--ink-2); font-weight: 600; font-size: 14px; transition: background-color .15s, color .15s; }\n.tab.is-active { background: var(--surface); color: var(--ink); box-shadow: var(--shadow-1); }\n.notice { background: var(--gold-soft); border: 1px solid var(--gold); border-radius: var(--r-sm); padding: 10px 12px; font-size: 14px; }\n.notice code { font-family: var(--mono); font-weight: 600; }\n\n/* ───────── Formulare ───────── */\n.form { display: grid; gap: 14px; }\n.form label, .panel label { display: grid; gap: 6px; font-size: 13px; font-weight: 600; color: var(--ink-2); }\n.form input, .panel input[type=\"text\"], .panel input[type=\"password\"], .panel input[type=\"number\"], .row-form input[type=\"text\"] {\n padding: 11px 13px; border: 1px solid var(--line); border-radius: var(--r-sm); background: var(--ground); font-size: 16px; color: var(--ink);\n transition: border-color .15s, box-shadow .15s;\n}\n.form input:focus, .panel input:focus, .row-form input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 4px var(--accent-glow); }\n.form input:user-invalid, .panel input:user-invalid { border-color: var(--danger); }\n.form-row { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }\n.form-actions { display: flex; gap: 8px; flex-wrap: wrap; }\n.check { display: inline-flex; align-items: center; gap: 6px; font-size: 14px; font-weight: 500; }\n.row-form { display: flex; gap: 8px; flex-wrap: wrap; align-items: center; }\n.row-form input[type=\"text\"] { flex: 1 1 180px; }\n\n/* ───────── Buchen ───────── */\n.page-head { display: flex; justify-content: space-between; align-items: flex-end; gap: 16px; flex-wrap: wrap; margin-bottom: 18px; }\n.segmented { display: inline-flex; gap: 2px; padding: 3px; background: var(--surface-2); border-radius: 999px; margin-bottom: 10px; }\n.segmented button { border: 0; background: transparent; padding: 6px 14px; border-radius: 999px; color: var(--ink-2); font-weight: 600; font-size: 13px; }\n.segmented button.is-active { background: var(--surface); color: var(--ink); box-shadow: var(--shadow-1); }\n.legend { display: flex; gap: 14px; font-size: 13px; color: var(--ink-2); padding-bottom: 6px; }\n.legend span { display: inline-flex; align-items: center; gap: 6px; }\n.dot { width: 10px; height: 10px; border-radius: 50%; display: inline-block; border: 1.5px dashed var(--line-strong); background: transparent; }\n.dot-vip { border-style: dashed; border-color: var(--gold); background: var(--gold-soft); }\n.dot-mine { border-style: solid; border-color: var(--accent); background: var(--accent); }\n\n.daystrip { display: flex; gap: 8px; overflow-x: auto; padding: 4px 2px 12px; margin-bottom: 8px; scrollbar-width: thin; scroll-snap-type: x proximity; }\n.day { scroll-snap-align: center; flex: 0 0 auto; min-width: 68px; border: 1px solid var(--line); background: var(--surface); border-radius: var(--r-md); padding: 10px 8px; text-align: center; display: grid; gap: 2px; color: var(--ink-2); transition: transform .15s var(--ease), border-color .15s, background-color .15s; }\n.day:hover { transform: translateY(-2px); border-color: var(--line-strong); }\n.day .wd { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .1em; }\n.day .dn { font-weight: 800; font-size: 22px; color: var(--ink); line-height: 1.05; }\n.day .mo { font-size: 11px; }\n.day.is-weekend { background: var(--surface-2); }\n.day.is-active { border-color: var(--accent); background: var(--accent); color: var(--accent-ink); box-shadow: 0 8px 20px -10px var(--accent-glow); }\n.day.is-active .dn { color: var(--accent-ink); }\n.day.is-locked { opacity: .4; }\n\n.slots { display: grid; gap: 10px; }\n.slot {\n display: grid; grid-template-columns: 110px 1fr auto; align-items: center; gap: 16px;\n background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-md); padding: 14px 16px;\n transition: border-color .15s, box-shadow .2s var(--ease), transform .2s var(--ease);\n animation: rise .35s var(--ease) both;\n}\n.slot:hover { border-color: var(--line-strong); box-shadow: var(--shadow-2); }\n.slot.is-past { opacity: .5; }\n.slot.is-mine { border-color: var(--accent); background: linear-gradient(90deg, var(--accent-soft), transparent 40%); }\n.slot .time { font-family: var(--mono); font-weight: 600; font-size: 19px; line-height: 1.1; letter-spacing: -.01em; }\n.slot .time small { display: block; font-family: var(--font); font-weight: 500; font-size: 12px; color: var(--muted); margin-top: 3px; letter-spacing: 0; }\n.seats { display: flex; flex-wrap: wrap; gap: 6px; align-items: center; }\n.seat { display: inline-flex; align-items: center; gap: 7px; border: 1.5px solid var(--line); border-radius: 999px; padding: 3px 11px 3px 4px; font-size: 13px; min-height: 30px; background: var(--surface); font-weight: 500; }\n.seat .avatar { width: 22px; height: 22px; border-radius: 50%; display: grid; place-items: center; font-size: 10px; font-weight: 800; letter-spacing: 0; background: var(--surface-3); color: var(--ink-2); }\n.seat.is-taken { background: var(--surface-2); border-color: transparent; }\n.seat.is-mine { border-color: var(--accent); background: var(--accent-soft); font-weight: 700; }\n.seat.is-mine .avatar { background: var(--accent); color: var(--accent-ink); }\n.seat.is-vip .avatar { background: var(--gold); color: #1a1408; }\n.seat.is-free { color: var(--muted); border-style: dashed; padding-left: 11px; }\n.seat.is-vip-reserve { color: var(--gold); border-color: var(--gold); border-style: dashed; background: var(--gold-soft); padding-left: 11px; font-weight: 600; }\n.slot .reason { font-size: 12.5px; color: var(--muted); grid-column: 2; margin-top: -6px; }\n.slot .action { display: grid; justify-items: end; gap: 2px; }\n.flash { border-radius: var(--r-sm); padding: 10px 12px; margin-bottom: 12px; font-size: 14px; background: var(--accent-soft); border: 1px solid var(--accent); animation: rise .25s var(--ease) both; }\n.flash.is-error { background: var(--danger-soft); border-color: var(--danger); color: var(--danger); }\n.empty { color: var(--muted); padding: 32px 20px; text-align: center; border: 1px dashed var(--line-strong); border-radius: var(--r-md); }\n\n@keyframes rise { from { opacity: 0; transform: translateY(6px); } to { opacity: 1; transform: none; } }\n\n/* ───────── Meine Termine ───────── */\n.mine-list { display: grid; gap: 10px; }\n.mine { display: grid; grid-template-columns: 1fr auto; gap: 12px; align-items: center; background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-md); padding: 14px 16px; animation: rise .35s var(--ease) both; }\n.mine .when { font-weight: 800; font-size: 17px; }\n.mine .when .mono { font-size: 15px; margin-left: 6px; color: var(--accent); }\n.mine .what { color: var(--ink-2); font-size: 13px; margin-top: 2px; }\n\n/* ───────── Profil / Verwaltung ───────── */\n.grid-2 { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 16px; }\n.admin-grid { display: grid; grid-template-columns: 3fr 2fr; gap: 16px; }\n@media (max-width: 900px) { .admin-grid { grid-template-columns: 1fr; } }\n.panel { background: var(--surface); border: 1px solid var(--line); border-radius: var(--r-lg); padding: 20px; display: grid; gap: 12px; align-content: start; }\n.panel-wide { grid-column: 1 / -1; }\n.table-wrap { overflow-x: auto; margin-inline: -8px; }\n.table { width: 100%; border-collapse: collapse; font-size: 14px; }\n.table th { text-align: left; font-size: 11px; text-transform: uppercase; letter-spacing: .1em; color: var(--muted); font-weight: 700; padding: 8px; border-bottom: 1px solid var(--line); }\n.table td { padding: 10px 8px; border-bottom: 1px solid var(--line); vertical-align: middle; }\n.table td:first-child { white-space: nowrap; font-weight: 600; }\n.table tr:last-child td { border-bottom: 0; }\n.table .actions { display: flex; gap: 6px; justify-content: flex-end; flex-wrap: wrap; }\n.table .sub-line { display: block; font-size: 12px; color: var(--muted); font-weight: 400; }\n.pill { display: inline-block; border-radius: 999px; padding: 2px 9px; font-size: 12px; font-weight: 700; white-space: nowrap; }\n.pill-ok { background: var(--accent-soft); color: var(--accent); }\n.pill-wait { background: var(--gold-soft); color: var(--gold); }\n.pill-off { background: var(--surface-2); color: var(--muted); }\n.pill-reset { background: var(--danger-soft); color: var(--danger); }\n.code { font-family: var(--mono); font-weight: 600; letter-spacing: .04em; }\n.res-form { border: 1px solid var(--line); border-radius: var(--r-md); padding: 14px; display: grid; gap: 10px; margin-bottom: 10px; background: var(--ground); }\n.res-form h3 { font-size: 16px; font-weight: 800; }\n.res-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(140px, 1fr)); gap: 8px; }\n.res-grid label { display: grid; gap: 4px; font-size: 12px; color: var(--ink-2); font-weight: 600; }\n.res-grid input { padding: 8px 10px; border: 1px solid var(--line); border-radius: 8px; background: var(--surface); font-size: 14px; width: 100%; }\n.res-form .row-form { justify-content: space-between; }\n\n.foot { display: flex; justify-content: space-between; gap: 12px; padding-block: 18px; font-size: 12px; color: var(--muted); border-top: 1px solid var(--line); }\n\n/* ───────── Mobil ───────── */\n@media (max-width: 860px) {\n .auth-grid { grid-template-columns: 1fr; }\n .auth-brand { min-height: 0; gap: 22px; }\n .hero-logo img { width: 170px; }\n .hero-title { max-width: none; }\n}\n@media (max-width: 640px) {\n body { font-size: 15px; }\n .topbar-inner { gap: 8px 12px; }\n .brand-text { display: none; }\n .nav { order: 3; width: 100%; overflow-x: auto; scrollbar-width: none; }\n .navbtn { flex: 1 0 auto; text-align: center; padding-inline: 10px; }\n .who-name { display: none; }\n .slot { grid-template-columns: 1fr; gap: 10px; }\n .slot .time { display: flex; align-items: baseline; gap: 8px; }\n .slot .time small { margin: 0; }\n .slot .action { justify-items: start; }\n .slot .reason { grid-column: 1; }\n .form-row { grid-template-columns: 1fr; }\n .legend { font-size: 12px; gap: 10px; }\n .table-wrap { margin-inline: -12px; padding-inline: 12px; }\n}\n@media (prefers-reduced-motion: reduce) {\n *, *::before, *::after { animation: none !important; transition: none !important; }\n html { scroll-behavior: auto; }\n}\n",[],[161,214],"489a765e-ee02-47c0-9675-c7c53e808141","logo.b64","fecc1092-ad64-11f1-ae0e-1607ee4eb77e",50,["D",1789078470818],"iVBORw0KGgoAAAANSUhEUgAAAUAAAAEbCAMAAACcB62sAAAAkFBMVEUAAAAZVTNSjFo1Z0f1+vdJc1lxc3KlrKfk7elObFxsqG2RrJ2Prpwebx6MrZfb8uUma2l3moWr269qpaJpiXZUcGE6XEmqx7R3l4az4tutybh//39tiXmnx7N4lIR///8A/wC51MUA//+51cbO6di31sUoTTgrTDo4V0X/AAASPiMAAP9VVap/f/+qqlX/AP/KXC2gAAAAMHRSTlMA/v75EfMFDf6jCl2dBOhVBucUDKBgpZudF14CXuxkAgFdAZCV5aVjZAH/AQMCAwHzwHyDAAAmrklEQVR42u19B3ujOpu2rMaAwTa4x07PlHe/b3f//79b9YYotkUmyUTXOZnExhhu nt4EwIdap4xS8QvGx+dyk+9IDfPD6zPG4tUVLY4n8L2iC2MFHsbL10MNkVgzttg/BOZlJkEElB7xN1zhOmrCm5cQEoFbsBiKuw1DUdFi9o2ZWbQQ2C2X85JEsXNRhLCcLyWIa/qNHX56qSR6D4t6ADyLIoGbswRxhV/+ZfQyxbfzmowFz4JIFneSEIunf1Ek4tNayjy6vRg8vQgh27UET4vGf2Q9KnW7LGsyuxI9RYgzsplL9UxP/waGuFG2SrkZ1hiMUSEZoVg2r1Ik0uPjF4dvLVVGVvZrDIYJ+b2dY8BhYdp5uyUQ9X6A1GUjMKzwFya9SpDeedMPHmFgaEvFfnp5d88MxH69cphLUbj+ivitxE9mJvegx3g2P1AD3fpklHWlnsH50MvQ3Eo8 StX8peybJypoaJ733jyBhzvtrbW0KsZrBSITnuwhoO6HsNtKQiyyL8HNtJF+xpl5tz2kV2snjdLMQY1SV7k22nDEdwOUXN+Js9FPb90IsQeac95ztzOobpcTnqXak/TwOCkVWWa8NvyoQFyWiz4MCSyFHGVP4NNae5nk3HLXd5/5g9Se7E4Nelmm2RXjo4lkZZm1IyVV4+f7Hm3ONPNeYvgpAw+Z0BrZufsOmRHM1GbgSDCuVb8c52XNXDy4WJT7tzdpojgkauzJO3ZQD4ZnKQ8/GysL2jtudp3CniA4VwxqKY8q+4OJuBwpRQHFqmG5f5bHVZabQSP/fT7DThAFhuJjnwXDp6OgvWXZbbUxfatIzwak8FqJtv3Cs1Sgu+61mrZM+VhozDvVCudl gWFxfPoEERbxz3bXjV69VSrjSXOtAg9k87qFAgwWM7IViAVWjI8L7R3WXfYNk7XyY+uPbR4KT3Q5r7vjJ7m00agRStiEovPo3cPIWtwrlwM0WnhiEV1lGOZdzMwxXHIIP6xp85gJVjp02HvMXDm8StJ71HeNi5WgwA7wugDki8Eh0cu0BsKPQnbg10OX34yUw5x9xJCDdHTLLvRQrkJ3hUq7AXqSgYXmvjew0IEf4pJ0cf8mfWatnLGyb5jh2XFOBEuON/1gEL4ISprn8SfPmOesOE4rjYZ/gNHefjMUTe2gP/3OYsFsPem4GddHhblh19UsuD5ffSBHT6DSdLAuU4FSfK8A9vQMbnrdsX4AZeDAEYnilCcjV6VWOXc9UUaG4MOQoZB88w5fDSna W70YLS0F1b4kZFTMuYuB/TfqhYrCVI2+LMnMHcYUIjJwgT8E9eFtx4PeSeNVa1z8YiP5owP5XQRI2q/e30nx8OiZlngb/zZNhn8TvRMPMTENGo8qrRrpwmqN20ivYUvgJVmPDvw6WHshvN8qw4qbMadD/HaIQ0gOy7/qonAtSuPwkcNRBghcaw/j7EDQhUmkMQzsQaiynfR0cr/6OR66IZvM82vemXlxuYuay9sCu07rSZDB8rUms8vXRQSo1mb/JqOBOi5RSUs99vBQztRx9e4qmceHuaEQ89TExRQaPUqFwTLvi6deBiAawk9aN8K4WWeu5sfnmEpB9fzdZSH/NhrhCURkFBM8eSGnfU6uzv4OmDB9IO5VlNaJk+HnQwzCnFmG7ykKKaOoCPOS Q+ZGWJ6UIZGjW3LnlzOwY9zU+yVwjWzh+8RECamfwbtByIVfjdrE9yC9qhflm8g8ErwJvQhWJG7CDNKhBOcl408fR7Qy2mJriU9NfiVpazPuHlUqi4G52mBSG8Ib0YsAeAEBGp0iYjdVgW0MkmmUNhUyqIv3sF0a2JZ8rtITDj2+W5Db0WuDhS7HT9ChzAk8OhqlaUlDtMAqfT2h9l0BikL4zg584uLwcZMGvTZaYzVIG8KSp/50wllU1rU5mWQTe3fs5AcUwDd3fEphOHfGtBIAOLuOAHXQAQPnWoVdE0BIyklVCWYPzb+9Hae+yklUcDshIXwRAMnVALJPKjI05ADwg8/I6DAhDWZrXPvUx5+ihq+KPdHEAN5EgIoMfyytqfUkrhm9E4K48vHj dovOhgsr9e4qX+0CALlJdCN+jAzrkkdtspO5cOyJJVRqPyD9clU/yY/6Qb6IcP6Z3A6f7gyJA4hklf7tqz4U1tvkAZvMldpoP010IQOlm6595SXy0l/jmbgzup13iWOqxABMwMB2cd1HZVUJZn793nn6BE9UDIIc5xFr8uMsgJNYLYrGAgx9/FAyABkn23gqw+vofGc+SWgBOwy8deoJ8Fsa0YcgtL9ZCD0TOh0BisUjH9mTsm/d+5tP4MA9zg1M6KxV71pYo6m0BRL4EORBOBUBKusaO0RoHXyCsyk1yAZb7i1ROnVr8XEgdPFLTICCkZkDLAtLMophm8VSrTW4cx6PjFrwoFZCsw8SrkUIV8TSZJEQugyM4ARr0SjDbw2WhpngMq0mxhQvDANn 8txFLKjVId3QOAC1qSb6W6GEK8rOiUWhogjHzkA/0+oR5sNBy8BrSX8ZGasc4Jg8nKQ2JMFjIBIT/tPNTGgiAOFCNqSwn8Qq4rQqBBf62ZBGEOC6FZXpw28MggwrZClQ4eflMCCcDsEXkcixJPgrLYAF2Jq7wCuhudboMldspBJxwEMddvbQGj6y/Sw2gmMzbEgQZSl5mHnBxJowVMhEOOyW6Z8IzkbEpom5LykDRc9SZ61qNzhomNe5UAiOKQVeK2Bu65AytkrBkRgVzF03CuZoBOURpKwPgoZJEAkSJDMlAw1gl+FHxgIYnK8WiqSw95XjIiUHPxjHgMtbRoB1d9uHe7uGO0cwsTH/GAWSwIIerUH4AxDHdhxPSJwC4Z6TYGPVCDPWaEIKNAEf KPV9FwejgF5c8YbG+CImJoMIucIH4R/k/yF1mtaayTdRS6YeeEDTsTbQOiGAK+OGoDOuuArOULfYcwFEhrbG6RFopp0gck0exH2G/Y3a4TkZDwvzFtqwYMqmz1/6tHP+XCigveRnr44o9YlmcEyO0/XlLAleYsAgxcIdQlMISBKRgRA2AjDjMDAAiwkAJMLFWYFDrCIrBoViFQHg2KiDIGSmgM05UFoAYRTAOw5YBUyAP2FMizm9yPODCxxJS6MAAuJEBeAMwguz7NwlJpcDSCyAJM7isAPAPadA5vMTo4arVAA24M0AGDp2jiMWk4WGky8gQC2iiLaonUEAY3IeSGksFAlkawAJiXjEPLZvAwoQJ0suNWDvWDE8v4/JKPysSBtPfxI0okZO8L86 xGQPERI3EuYqNfVq9EkIZwR7zJYKwLV1EWvF0qQPv9atzsiocEKoeSUX96iaIX3cMiN7P4xlhnECAAurMxYqEINa+KEW+zre1aiwIWoBEEnSjYbQmEVBmmAwJON4wziZEtnYSG3VjiTwfCbpNAU5/Y2KB5qwaTyWoFXLSMfOpFAsgKgX+lpFBc2dFMnSwysTi0FbLigyKxPltVkdjNpxGDIymuVqC+1W+BSILvJM9FndlF8v8Mp3M1dBE8ZijHn+wL9k7WWIOQMrG9BnOBKURV4Qdg1xaAM4G6FL/FzpIO83kwEITOhAAlh4AIowFGrj599jt8/iHoxaxQeog4Vn46SgOd0Izm+kk5VbVyRLD+Ccm+sMQPfOJRMHqjh83KTDZ+7VC26E4QpNPL53 ViwVPfid3Bl2QxRzflLqenIcPAEPgr3XO0CAsbtDoWy8NDp9EX7Ml8u4L7edFEDxJY5WlnSn9BvqwwQN4RehKnkKcp0h2EZQSQmdbUHBU3jlMywcAA+pogkOgKQFIBKeU2fyMnYzCI21BePjaC9JzoVUa86A2qfaTwigCdM+y2DMxuNgxbyoH5B41KbfHwmJ6OLqtsCsmnVb+xxAn4U3EwKYB3F4NKI+ElnER0ZjhMdvgsvXlVN6z7KfnPfy3hwAExkyLw6AStCOBzAkQXRRr+vtyeAYAXbUH5YBgPkUAC7jFAjHAHAVfikBJDEeCCiQmohqOgBxP4BIojgKQHIxfrcC6EYmiX3mlgz/PoCknwT9ORuz9wYQtn1tFdWKszCdIKbfC6BOP3RPerJ7 ClyDX3oA5eWYmoeWEpkWwJYWnukoGxkq8riy8zAVC/OUulYhIvwGQ5dGa+EpAIR9AEKTuuwovUdXk99tAKJWmkWYQ9x9RzxNGBhHIYCbCQCUrpwH4MwJ0KGuZLGwwdDsL1BgEAeU0gTOYsalNqQnBnAd+MI21iZ+i03lIILBCfxLAMpssV9nQyJnVwCWU3giYTRmE9rKxO018uLIyM0m/i0AQ50SDQ+qBqXFFL6wHw+kQWEC6nL7TS4MQfRBAIQ6htk+915OFF2kD2dVLgW2AqqOLvMoz+aGROEp/DtaOI5gtGZdAVgnj0gzufCnJ6Tfd58mD3Z5acd0hdFdZw4BTNdz6Fa38cLXNYi11wTxSeJF3D4SgF09J28SQMNtr6BJlhfObVpz1UprhlGo SCrSb3+7BCMyisovPG287VgBaJyGN3BMVpmwsQBWHMD5hdPrZvBaAOHAcegq0o2mVFRdvkmsY/CYDEDDsn8kRdKxACJbnDUFgCQl64cApivtWIG5vqzf0dqYQQK8HkAymLZLJjpVYn2C4iK2Zm6NOQXNSACJJ3JSA5hY9RwnBHAVAIjJZQQ4BkDRVtMqfETdqKRW3bI2Bs/SA/hka8oJvgTAoEK09zAUS1r6JWod+KHWrIXrOod5dZZToZoQQGxlXmeJ76zHkZsEwDa1kdtMR1EfWNi+6F26GmknoopEo9JIAGHQ6ZsSwHbW70b8JIBOD9sOTAEgUZ3cu7H4kdkkACanP1UjvXKa5ZJOcvtlE8OFnxgew8DJAewpfLjawTtIJXw/Sx1PFdGEndep tPIDgsP4zXqt3osBTM+/IilXBNGsIiGATjRBVCGWQ+yL2pyGUgE4Bf0ZAJ1gTLpeOa/KXPw9HwRwFtZVJANwEvpTnUqTBGNifQ4DzjAS8YOOEvLLASShWTkBfrK+0lGXbwkBDDttiiFnGIUSLx2AU+EHMz7IBSyhtaNpQgDnyHVFsiFXhLQK+8jtAKJJ8WOu8COjueVEHetm6gnif/9nhdGQCUiiCeJbAJwWv1xGOp/1+ZLOPaGBKwLAgCEYEiAZDj0NAjid/lV2tGjFf7B2dJUOwJPninDZijeXADgQPBkF4MT4SQALm6zYpASQAbazcVrhy5UDSqSdN74NwKnxY2Zg5Rm4q6QAVm7/jvDlytSjovsB7GgES5i6K7nru7KctUo6fWzlGoIiM3x+ TwDh9PjJuTFOAnedFECHtA8ysdm8N4CT8q9IanIA3X71x6QAUi/K4wRu3wnAqfGDfCidc1sIJx0JfwKNN4sBj86KJAJwcvwWSx54t9M1diDpcgCDasLPuwI4OX4qoI+tFZN6HLyZFKMGMHZPH5sAwB78SCoAuWRyRH2Z1gxky1R3UKmeyvcDsMd/S4Uf3PNJ0qugEDLpKm1E0M8dTA7gO9AfhDzS7laSrhPP03fUsHIaE6rhTgCRLSadGD/Ii78f28mzhAGtzNoxvlaZDkDUzrF0qZSbl8xpNjaYVaXVIkcvUHZKq4Y7AOzCL7kG5itgMwLAZHYMkWVgdjL3RACKFwiJERtJjuBClqyYWcX1BJva5FZBZd6gvWkAlPi5wehoA1ei9SAdOacSN/kK RjuuwZxMCSCyHToxYZcaQU4U1OuHSb+jiMlk5jJyhqekQI2fGqjSXdqLUukQGsTdUwPoVt0o+TAhBRr8VDeykX1oIlUsg57Uy/ykXVlrwjKGkwFI3PJq3/+YBkGhQxznAE6yMZpTfb32+kKTAqgzombSWKB7yRTmtJo3kSO3fCC5FnF6oMTQ77upAPSUcct2mcIcnPMZ5hPrkJX1hsWWQAljqgELe/29s3a1eXoE66UE0G/MT7zWnoTAfLrjNQCiyJCZgAI9/Ga91fqpEOS309ikOplCBGIn3H0EL67ZOR49Ek1w+hTo4zeLddSkRlBFU8vJHDkFIfF8kY558AMVl7EUe8vzdefIRz+SGEEO4IsTI/6TPJoqV20dHSFjKboCvTEAuse5b7YHVKcq DWwCApliq3CnSBDiSyJaiPR3aKGOnrh2WUhvzOamwqyTG29Cx0m2hjwGQhavRpnScLBFkAQAIg+ZAMspEBQi0DHLyDT7C7tNPELNr8PtwjtLBfub3MLX/IPCAstuBNH1AFLmXNnNu2s8yRbNL0798IO0BF/RZdIPzUibBEO2JrCjvh91uXC3IqjKy83dHTCdhAQp3gyM1O/jYeIOeiAtgKOA9heZk1RuMc9/uN1Yd9Ns0MwnwM+slHjiVYP1aABRcNcBCiTGwGigzSFVlkRagW8TdBn2dXw1Y9pFggCfd9fO9oVtAlS/egAiOIzgNYEFtVntYmIR6JdZPqioNBpNgn1qubWhNbFlrjEAYVKDupQc7GweWk2En53eIRuvR3ZtxjHqMAx9E7oLwKQI imC+7W+Y0UnMaGnImNobpEzpxXgvpNs0bOHnFpXHAUyIYC2twGaS/obQlH6zQdUnHoLE9+gKEmxvvRLDuh/AdE7dgotAxwqEKu89wXp01O5BVvqOiglGdshtt+mHUKPuZsO0CKr+U/PpEk/FweCF4tI+pwpc1ro+cmdDGAwJ6AIwmVPH6x3p/5veCpRaZOX4izy9Pq4+AUV94H6cBwFM5NSpUQlzNLUVKNSus4FxIXn4dVRIi4xB0D9oGMA0Tp3oOqhspCmfDj6vwGO2UZiOiwnGA1nRsE0Q4+oBMIlTd4epJ4q2k+lglVkKq7BHZofhkBwMDhgFYAoEOV5ODT05TigCuSV4Zw0Zqf4fLtqrvmdYcowJhwCE3fkCMloECp8UBcV7E63GyZ3KXcnB ceyWj13x1HhN5UgAYfsklyG4523Wzo7xSbdWj/Gwa3DKIs7Rm966MWln+1IS9UlUYQdB/cHtcdsgDETz/8dNh2A6KYBOQ600ZFaP28sS6H0rAvfwBMubEBTDYdancsKqolZ22OHhzKv9vS6835EqGQ/gTQjOqb/BTD09gLYhNL8oNzeoG9HsSgBvQZAPXXx8chOaq4kRdLaLkDY7vaxKqwNC0rWp3xgAuw10NIaDHR2McLINSTsNGbz0888YHy+s0kIDxNcFYC8aXXutjQgkUOyHOSfn4tryMB0fUAhrjPjASr4RPbpV89yyeGaCejq4mBy/k2d08g49fJ5NuKbET+zXQPH8naxoHZE5mgdWchJ8Sdo7/K4AFtJtMxy0A/Q9eNgUGSmlf0Wd2wcB MMPi+SOvXmDy5XQloyPXw0W6Yt/3BXAjvfkzmq65Ic7D9pGJLTfwpDw8IYBqu4Z8FgSYpkcwnwV1TNvPCGCNZXsS8Vqw3mFlVm2hjOvh/z9+NPxHAlAWZf3HOvdLgN+JBO1DUzPPUk5QeDcAM1nIS5DbfPAui/fY8C3F2P9yxhk3pUSpC0GJFoHmF00vYtVDVFXzo4YOWtT1oi7xI/dFM33RhIL3AlCtJW4nnZK5O+HJ8VKsgS9YjjlKHWQkug2UvN+igy98/IXxX7+CdsQ/GY74GFJgk7HVDMyFbeRRePigpgHf63t9r+8VVm505oOj6/GYrddZRPBh/npwssfI2bG3+q6l9eeQCsCPnXd5wkzEhiccCRF11qP+UAUqttSv5jXqa1jao4ppE38j HMFHR+p2WkWOrsAKW0vUuVTwRNkNOO/y3SzFJ9irwkyl3mmAe9vAfFWYDKEroEDhl1PFYV5FHytu3RaOEyXGTJ8JfVmYI04r9YY8Ge4lmrEUiKMUSMdbKRVuf+flFIiDC8YSn501/wkRA1Ny/sdW43cm3Olob5g9P/AEOd9HqsTmCniQf5tz654g8qDvsgJbdhjJs8p5LpQd4XgWNcmlL0W5d8BeyPHKUDLlZ8zVyJ8C5zwNpV0Hivn1onytKY25F7n1igjc8l0GCnnqNb8OndxXDkiF2QWzi6Me2bBzILIDK3Gh7HTsX5qRYOWcjn65rudvE64iikals428qiUGzNxJpCFSqqq6AmCn/wuhEosrpzIZShobMo9k8+S+Wi9YedZulcDcZrHWKgmj H6nZNrAG/1ERy6B7AM349a2wN5LdvElVn6ZPIicZpxbVA7K/aOVOLjHhqAiAhcqdE3mbcr4OCacIbEnQkZlRkRDMgtfFWLQnVY3uA1jEAbQ9eWZ2BpXV7QJAqmdB1ir8WejQBsIK8KJ9o4jcATFebN0JIB95V1gBJU8hAZxJAIv2sCFy7AewUl9I9n66Cv9pxa/4Hk4Ut+NaRHRnjwJQ1sfbzUvkeBAfQIOf2gbOmRiG1KY+MQD5BiuMSXoBdLo0cWFf6gewYZeYQ8nPqAWgnu+ESk/KUt2mKfbRk/PB+NVb2uFBFM3iPP9etVm4UAC6AoULPTe+TYwFoAFc68oIqAf8UedwNbpYA4ic+2Lv3uNMAwih/VZqYqpoozexWek7DAGUn3YuuXEUDAkB pKoasIWfoh1SLpkiwsta1LZTBpO6l8UPsRY6fcwE8Z8uCrwP9GFly5dMwbcFkGkopIKfmtru7P7uKqSsb/T+h7oOpJt01wrAn+6X2keGqL62Bs26AbyPW6HyLH8sgFh1WLMH42l52qL4tVDZZvKPvvAfPxUTYzVYjjSudSkADOekYXX2Wg7vANgHUA2GILqU/oVKjQNreX76EgHwxw+1nwajcKqfBGeYEEB2BDdd2Y+FW4IWKJH4aLcYBUqFwLSTh59OwnGJdTRuygrjF6U9F+a6FQ1CbsZ0AXjGmWuXaektP4oajB0AfyrNTZyhBlhhpSiIRgH8oa9YDor2a4jcJkoxBs/ff6YN4EMfgDnWU7LqJVKRbt+TW6saywU2ztqqYE9eixLyw1lE94WN oEBh41XSRiHqnqVpoQCc/bhvDRY6iRMj9U25oKAIgPJJMitU3BRisgeouKs/VRzxATwrT6xmSh5aM+ZnjIP1WYTpIAFadNTbSEJDryDzrHjdwL5wAVwo4WMAbCmRn55Zr/UQu3fJlMrlkNUjsrGMEaJjUsmr1t/0xi9KA+heiZZFQA92JFKR5L7aQhu8VqMMUCeAJglAHNNR1whxACVXKCpe4LiwJEt8NIb/c5Fleueq+xaA6BwBkLa0sDDVJXkTLUBlJTb1dt8gb6vMeuyKAA3FruIAqnfBErVMp6OmHdX/InOMaBEAWEUMaWfbmzYFdtYcKgAzY2PwFBPJX1T7dQTArQYwa7GwdzVGDNSG/cmxogGAtpnoRWkcyA+HynSkvQC+BpacKNCSZ7lX ulMamouf6qvWSgZeC2B7Ywhlt98pMJizx//8pWdcRgBkUvePArDFwnZtxGRWQ1FS4AkZGQA4OygE10pq/DRcKkjwEgCJvfWf0mi4l6S/FF854Mp1AYhCyvCzwrmSgWvg+KI5VqOgPBlYK7JoeyJFhAKpoihyL3KYSgq1KJB7FcLcUKdF7PD7+3uiHvd/R5TIz5nHwovyz+/fv8vFYrM1SoS5AjspU+TTPHcCWC82Msl6oPgJiIELcQBrJbT9jDNVRb4b43mKu4N6G+e2Fp6BHgBhrtc2Oo6LD+qyAN7X2oNiYjB7bBfloIdT0amFV2pcFdpH9CcTt7bWlmSygyhqxuzbgbCMh2iJGRigLPelCYu4ao8q+5rHF05MSRargwJQ1cy07UBNKuyyGq1y NYB7r/ArUijH2MQAuFgqZ/EXH3OwkoIhQJBbyN12YKHsQFpV1apicu3FAdDMb+NCJwqgPJCuKrFkGBTnpQRR+cIaQBG/UE5idvJ2Ot3ZUA5fQnnsmJlfzHwEjdlmAHTt8bW0Ayu6EovSjh0nM0P09RJoMcTov2MEZGlYLfREckYcEsDSE0kGQGPP8Mikw8IzT4l4nxY7xKEF82nlxTCZvdIAYtrorhDiVq+b4iJ05qkF/CyO+WWMMqVErS/MletC0bRj9EkAz5a6C0XCyszSFeb8bkrliWDd6cMkVqMcLhs6RVoIxX3hwkSXfi6dqLKWXmcT2UGZ3nYrBqD/aWnkwFr6nvyjxth0A0M5Xj05vogideREXX65kTwvGsOUzUoVwNk4xm4tr9ABkCrf cbFkzl3T8GIO48goXzgrnlRsVjjG0nJ9w8dMLPm0OcG70RjkCFOt6Nyg8lbbTiK5stXqrAdA4oRj/oBA4Ii4n41I63Av2nhFJHYI1MytTnyJBOII7+qsWhWETMq0Adxov0Uveel/mH1jItKZ7gogb/eKZS1vaGMlFg98ELfzHLtwDaAST0ik1NoAxuKMEGwiJqoT0i905H3rF6mG8XiyfRId7M9BzwN5lROGWwDuQwD1zqo8IsKNlBNPTGkSfDARaTvRWjKN3fnjeFxqqykSkaZy9PDbAICU/v5NcRzASEh/VjPNYx1BlbURACKiqS33YmVada9zN/fBPvnUzonMiNrbKUKBcwXggwZQDaZmL6xsaCtXgtkBUKsft1lFHy5F5S68UUQOoiNDxHr+ q6XlPQo0NCK/kscyAy3snZkz3nGbi7QTnAPlcyizTCZdAc13bOV+VondSbHl7aiE/Mr3S5Nj5I95m//igv1XXjYmG7YVJ9FGH/uX4nUN2Wnn9pN/cljnuWN0iu+GkH11lfP3CpPQE2cTl0Vdfz5jh5OcQcK+aZfLg/LNodD5YCYDc8K/1i5+n5jdCT+Tl+wVX/2HS0P+beyC2euZvHz+p7qPLXgsRCVBluGOzHdHxpRnm5msV6VQNnct75+d8AjCnLY9F+4oMIvGiXDrPdpTLyYOO4VXTfvz0x21bnhoggcG3k36tQh0sCbQHp/5QWXzKGn805WKw/FfL6iIs9lx2nFZLyBa0kCH6iE6CYcOFVRo9mHrioJDLEpFoueNv56IAkdUJODLKoA6KfDS Esnv9b2+1/f6Xt/rL60sk6WbjnJ6on95tctLm9P3k7pgURqpqP2Ylypy1SbGpkKH3euI062eczklteqVJf6YCNJiZyueVOkFzhG5cd3cVX22FbHqjGRLPyYN2oTGTkawC7C5uQ82QVMmFvR3tFGn84ckQW/4RIkb6e/WfxvAvQwxZM6V5B9UCLoBWyKLSx9v3/rr5q7qQm66ZzPLk05JvWlVpjhX5Nkz8dL87wK4FA8yc0L5jIFXH9UMdMucFlKPZKD+mwDKuRIeA8PJRuWnQNAyioq/r50h9e8OILlfnhqZrvoEDBwqDVE4xsVgg/4WgAuxawdwk0wT7diVzBZ0NTGUz5retpXzLQDeAWULOBcF1h/acTq6CTFZBMx+lH8HwL1gAXfELC+3+ODT CZypPKrH5kZr8IYtW7Hq/S8/CwPz9eg+byTzzA1Y1u8P4AKLHNPj0SmZW+CPn8ZwZnWbUclrfL09fYMCyQLTihc3ZeDDL3erKrTVNbB79L4AKgV8cudrktcPz8AtW0a0t4lUcYneFcC9GJzi9ByJeZHZp8hDNq4DTI4SQXBtYObazQqFsFu7z22DP0sed+VafqrIH7vRrskBVMrC7UT82C5IwMTOZtG8MZqqsQvkvQA8yFoYWjgKRO4q/UnWE3CqxXUX7pVe8RX43WPdJQvd+srPNN/LMx5EcynXiPiaUaHXKGBMW0Jjg+n/fqZcWONKH7n/kgCWTA4guV/qSS1OqSf5bGVAulrUDNcspIXzRqYGcPEmU3GVq4DJ8dMN6PPtFoJFCSEuWr1qyQFU OcsM7InrlH++AYe+CPql+qlXFyN44WRetafU2m4ILyzoNQCfEEF3l4JcjqnH4FIEr3GA3W262jMfPs0qvAHdNZZt0tWFmuQiABtlv9Aj8cvwwadc1FXFsp9acNcdmQbA+6UpbN75fSDgk64Mu0GY3BRuX0KDl/hvWPGvix/Bn8gDiSxnA2KUm0bzC/ZwucT/eFKSY+e19H9m/HDl5UMWuFID18Z7dRfgp+fHOedGr/hT01+wizgffK681HH76o4HUE+n8qmbzMFnX806QFBn7/ACJQRwrwco+fh9lhDqAA3mXj/tWpV8jIxRj3F/F3cqc0D9Yqb5l2iF8fd6QFBZM3hkaGFc+EUmMCvXfhYzJr7EOvp54bxRqZ0CjNmMaYT4s4MuvUdSfcYJ/x00 6OWFzegJysfd3gxgCXSox8yyFN9y+BQpuLEGtUeDaK4aL/m8LXIbgPUbUI21QExQcgII9Au1AlKfi0lpBCEeihAORg+0e+MGIMOhm19Ck7iGH9rIFnx+kwP2zJD4k3xa+XMwGH6rL9aKmgVAQazYmKmSPbkOQGa9yFFSmPrql5RfsJU3C2al8MFIgo1fANMx6AoAGflJMXcCfgkin3DyBVuh/SyPmE0r85186OhPcimAizvdcFQFQ1jIGnzN9RgUyCAzHPPYQ4Rd5KcHhWDuvSF/NnbxRRHEFfAoDXGLMNO6pEMSxsnvWRl//ON3MJgn/1XxE9EtPyNCHvSUlqNorBsH4GLOTUulPbDvUn9p/ASlLf0NwflO95IImeTKIhVcPdzLP3j0dmdHB/xl /LcOBGlo9xEz1ppPQ7pr7bceM52pfhrYd2T4wNUvP4lk3ZqttnvWk3ue2P0/ENQDIJ+grYYgZy1qJtou/NrrsRXH4pP4Kz3NG+C5B4vX+yurnoXrRlvkB786+zpEGPY95HeGL/kw7r0DoUN9d0ArD76C5OjXF39+bCGIwnDnGGQnA6GVhR58Ej0+Ly1U2Tz78c/gJ623cE8hOXFbK2TwfFYjUQXvzrGBT9g9JWwNJP+3BllxDboJpyS+Yh1DEblIvF8QJtngosyAkX1Cj4c2Nznjf4n8jCAMB2oimAE9wo5P3wZ4We5KHrHXo2gEsEVo6pC7T159cD0dhoYzEmMkLa0ZmenAl7c+888OoStecLsTFvIZB4rgmqZiJmJm7ezAxBHHz8E/Sn5yLVvx aAS5xqCBRXzi8L22QjaoxqB6+ofx47utkPbM4gfR5mEIi9JVYB3a4cb/nvbwVwPCeIpERs33b3hxiGDgMoLzHn9P4ZTbmR7aEKL87Gw0uEPtIzb4nyc/qx2eIwFpRA5cGuL5hkTe3DTgm/xcs7qtXwWGdU1ir+dz8OUSl7f6dss9GdkQi3js4Zt723yMS4jGwMcH2hXfkLUgZEJtOc8H4Xv4hq9HFAJwrHs4mSzwN/P2WoXcdn7exCFEfDteANbfMA2T4r5u+cik3n9r3ZEamfttR48MGfG9mb0uvtcwBYpBH3cLovaW2sgOzG/0xq9HEZLGZU5+be5kZOGDwvd/1ZwmZg55EEIAAAAASUVORK5CYII=",[],[161,223],"e79a6030-8fd8-4b36-92ce-72e306bb2d13",["D",1789079802139],[],[161,33],"275c34f9-d891-4236-8116-21b35b9ca76a","app.js","0fc28ee0-ad5a-11f1-b2b7-1607ee4eb77e",49,["D",1789077911300],15,"// Abschlag – Oberfläche (ohne Framework, ohne Build-Schritt)\n\nconst $ = (id) => document.getElementById(id);\nconst state = {\n member: null,\n resources: [],\n resource: null,\n now: null,\n date: null,\n view: \"book\",\n};\n\nconst WD = [\"So\", \"Mo\", \"Di\", \"Mi\", \"Do\", \"Fr\", \"Sa\"];\nconst WD_LONG = [\"Sonntag\", \"Montag\", \"Dienstag\", \"Mittwoch\", \"Donnerstag\", \"Freitag\", \"Samstag\"];\nconst MO = [\"Jan\", \"Feb\", \"Mär\", \"Apr\", \"Mai\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Okt\", \"Nov\", \"Dez\"];\n\nasync function api(path, opts = {}) {\n const res = await fetch(path, {\n headers: { \"Content-Type\": \"application/json\" },\n credentials: \"same-origin\",\n ...opts,\n body: opts.body ? JSON.stringify(opts.body) : undefined,\n });\n const data = await res.json().catch(() => ({}));\n if (!res.ok) throw new Error(data.error || `Fehler ${res.status}`);\n return data;\n}\n\nfunction esc(s) {\n return String(s).replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c]));\n}\nfunction weekdayOf(date) {\n const [y, m, d] = date.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d, 12)).getUTCDay();\n}\nfunction addDays(date, n) {\n const [y, m, d] = date.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d + n, 12)).toISOString().slice(0, 10);\n}\nfunction fmtDate(date, long = false) {\n const [y, m, d] = date.split(\"-\").map(Number);\n return `${long ? WD_LONG[weekdayOf(date)] : WD[weekdayOf(date)]}, ${d}. ${MO[m - 1]}${long ? \" \" + y : \"\"}`;\n}\nfunction fmtStamp(utc) {\n const d = new Date(utc.replace(\" \", \"T\") + \"Z\");\n return d.toLocaleString(\"de-DE\", { timeZone: \"Europe/Berlin\", day: \"2-digit\", month: \"2-digit\", hour: \"2-digit\", minute: \"2-digit\" });\n}\nfunction flash(el, text, isError = false) {\n el.textContent = text;\n el.classList.toggle(\"is-error\", isError);\n el.hidden = !text;\n if (text && !isError) setTimeout(() => { if (el.textContent === text) el.hidden = true; }, 4000);\n}\n\nfunction initials(name) {\n return name.split(/\\s+/).filter(Boolean).slice(0, 2).map((p) => p[0].toUpperCase()).join(\"\");\n}\n\n// ───────────── Farbschema ─────────────\n\nconst mq = matchMedia(\"(prefers-color-scheme: dark)\");\nfunction effectiveTheme() {\n const pinned = document.documentElement.dataset.theme;\n return pinned === \"light\" || pinned === \"dark\" ? pinned : (mq.matches ? \"dark\" : \"light\");\n}\nfunction applyTheme(t) {\n const meta = document.querySelector('meta[name=\"color-scheme\"]');\n if (t) {\n document.documentElement.dataset.theme = t;\n meta.content = t;\n try { localStorage.setItem(\"color-scheme\", t); } catch (_) {}\n } else {\n delete document.documentElement.dataset.theme;\n meta.content = \"light dark\";\n try { localStorage.removeItem(\"color-scheme\"); } catch (_) {}\n }\n}\n$(\"theme-toggle\").onclick = () => applyTheme(effectiveTheme() === \"dark\" ? \"light\" : \"dark\");\n$(\"theme-system\").onclick = () => { applyTheme(null); flash($(\"pin-msg\"), \"Farbschema folgt jetzt der Systemeinstellung.\"); };\n\n// ───────────── Ansichten ─────────────\n\nfunction showView(view) {\n state.view = view;\n for (const v of [\"auth\", \"book\", \"mine\", \"profile\", \"admin\"]) $(\"view-\" + v).hidden = v !== view;\n for (const b of document.querySelectorAll(\".navbtn\")) b.classList.toggle(\"is-active\", b.dataset.view === view);\n if (view === \"book\") loadSlots();\n if (view === \"mine\") loadMine();\n if (view === \"profile\") loadProfile();\n if (view === \"admin\") loadAdmin();\n window.scrollTo({ top: 0 });\n}\n\nasync function boot() {\n const me = await api(\"/api/me\");\n state.member = me.member;\n state.resources = me.resources;\n state.now = me.now;\n if (!state.date) state.date = me.now.date;\n if (!state.resource || !state.resources.some((r) => r.id === state.resource.id)) state.resource = state.resources[0] ?? null;\n\n const banner = $(\"setup-banner\");\n if (me.setupCode && !me.member) {\n banner.innerHTML = `Ersteinrichtung. Noch niemand ist registriert. Admin-Zugang: ${esc(me.setupCode)} – bitte sofort unter „Registrieren“ mit diesem Namen und Code eine PIN festlegen.`;\n banner.hidden = false;\n } else banner.hidden = true;\n\n const loggedIn = !!me.member;\n $(\"nav\").hidden = !loggedIn;\n $(\"who\").hidden = !loggedIn;\n if (loggedIn) {\n $(\"who-name\").innerHTML = esc(me.member.alias || me.member.name) + (me.member.isVip ? ' ★' : \"\");\n $(\"nav-admin\").hidden = !me.member.isAdmin;\n const badge = $(\"admin-badge\");\n badge.hidden = !(me.member.isAdmin && me.pendingResets > 0);\n badge.textContent = me.pendingResets || \"\";\n renderResourceTabs();\n showView(state.view === \"auth\" ? \"book\" : state.view);\n } else {\n showView(\"auth\");\n }\n}\n\n// ───────────── Anmeldung ─────────────\n\n$(\"tab-login\").onclick = () => switchAuthTab(\"login\");\n$(\"tab-register\").onclick = () => switchAuthTab(\"register\");\nfunction switchAuthTab(which) {\n $(\"form-login\").hidden = which !== \"login\";\n $(\"form-register\").hidden = which !== \"register\";\n $(\"form-forgot\").hidden = which !== \"forgot\";\n $(\"tab-login\").classList.toggle(\"is-active\", which === \"login\");\n $(\"tab-register\").classList.toggle(\"is-active\", which === \"register\");\n}\n$(\"link-forgot\").onclick = () => switchAuthTab(\"forgot\");\n$(\"link-back-login\").onclick = () => switchAuthTab(\"login\");\n$(\"form-forgot\").onsubmit = async (e) => {\n e.preventDefault();\n try {\n await api(\"/api/reset-request\", { method: \"POST\", body: { name: $(\"forgot-name\").value } });\n const el = $(\"forgot-msg\");\n el.textContent = \"Anfrage gesendet. Wenn ein Konto mit dieser Angabe existiert, ist der Einladungscode unterwegs – per E-Mail oder über den Verwalter.\";\n el.classList.remove(\"is-error\"); el.hidden = false;\n $(\"forgot-name\").value = \"\";\n } catch (err) {\n flash($(\"forgot-msg\"), err.message, true);\n }\n};\n\n$(\"form-login\").onsubmit = async (e) => {\n e.preventDefault();\n $(\"login-error\").hidden = true;\n try {\n await api(\"/api/login\", { method: \"POST\", body: { name: $(\"login-name\").value, pin: $(\"login-pin\").value } });\n $(\"login-pin\").value = \"\";\n state.view = \"book\";\n await boot();\n } catch (err) {\n $(\"login-error\").textContent = err.message;\n $(\"login-error\").hidden = false;\n }\n};\n\n$(\"form-register\").onsubmit = async (e) => {\n e.preventDefault();\n const errEl = $(\"reg-error\");\n errEl.hidden = true;\n if ($(\"reg-pin\").value !== $(\"reg-pin2\").value) {\n errEl.textContent = \"Die beiden PINs stimmen nicht überein.\";\n errEl.hidden = false;\n return;\n }\n try {\n await api(\"/api/register\", {\n method: \"POST\",\n body: { name: $(\"reg-name\").value, code: $(\"reg-code\").value, email: $(\"reg-email\").value, pin: $(\"reg-pin\").value },\n });\n $(\"reg-pin\").value = $(\"reg-pin2\").value = \"\";\n state.view = \"book\";\n await boot();\n } catch (err) {\n errEl.textContent = err.message;\n errEl.hidden = false;\n }\n};\n\n$(\"logout\").onclick = async () => {\n await api(\"/api/logout\", { method: \"POST\" });\n state.view = \"auth\";\n await boot();\n};\n\nfor (const b of document.querySelectorAll(\".navbtn\")) b.onclick = () => showView(b.dataset.view);\n\n// ───────────── Buchen ─────────────\n\nfunction renderResourceTabs() {\n const el = $(\"resource-tabs\");\n el.hidden = state.resources.length < 2;\n el.innerHTML = state.resources\n .map((r) => ``)\n .join(\"\");\n for (const b of el.querySelectorAll(\"button\")) {\n b.onclick = () => {\n state.resource = state.resources.find((r) => r.id === b.dataset.id);\n renderResourceTabs();\n loadSlots();\n };\n }\n}\n\nfunction renderDaystrip() {\n const r = state.resource;\n const lead = state.member.isVip ? r.leadDaysVip : r.leadDaysStd;\n const days = [];\n const horizon = Math.max(r.leadDaysVip, r.leadDaysStd);\n for (let i = 0; i <= horizon; i++) days.push(addDays(state.now.date, i));\n $(\"daystrip\").innerHTML = days\n .map((d, i) => {\n const [y, m, dd] = d.split(\"-\").map(Number);\n const wd = weekdayOf(d);\n const cls = [\"day\", d === state.date ? \"is-active\" : \"\", wd === 0 || wd === 6 ? \"is-weekend\" : \"\", i > lead ? \"is-locked\" : \"\"].join(\" \");\n const title = i > lead ? `Erst ab ${lead} Tage vorher buchbar` : \"\";\n return ``;\n })\n .join(\"\");\n for (const b of $(\"daystrip\").querySelectorAll(\".day\")) {\n b.onclick = () => { state.date = b.dataset.date; loadSlots(); };\n }\n const active = $(\"daystrip\").querySelector(\".is-active\");\n if (active) active.scrollIntoView({ block: \"nearest\", inline: \"center\", behavior: \"instant\" });\n}\n\nasync function loadSlots() {\n if (!state.resource) {\n $(\"slots\").innerHTML = `

Noch keine Ressource eingerichtet.

`;\n return;\n }\n renderDaystrip();\n const r = state.resource;\n $(\"book-eyebrow\").textContent = r.name;\n $(\"book-title\").textContent = state.date === state.now.date ? \"Heute\" : fmtDate(state.date, true);\n $(\"book-sub\").textContent = (state.date === state.now.date ? fmtDate(state.date, true) + \" · \" : \"\")\n + `${r.capacity} Plätze pro Stunde · `\n + (state.member.isVip ? `als VIP bis ${r.leadDaysVip} Tage im Voraus buchbar` : `bis ${r.leadDaysStd} Tage im Voraus buchbar`);\n try {\n const data = await api(`/api/slots?resource=${encodeURIComponent(r.id)}&date=${state.date}`);\n state.now = data.now;\n renderSlots(data);\n } catch (err) {\n flash($(\"book-msg\"), err.message, true);\n }\n}\n\nfunction renderSlots(data) {\n const r = data.resource;\n const me = state.member;\n if (!data.slots.length) {\n $(\"slots\").innerHTML = `

An diesem Tag ist ${esc(r.name)} geschlossen.

`;\n return;\n }\n $(\"slots\").innerHTML = data.slots\n .map((s) => {\n const chips = [];\n for (const seat of s.seats) {\n const mine = seat.memberId === me.id;\n chips.push(`${esc(initials(seat.name))}${esc(mine ? \"Du\" : seat.name)}`);\n }\n const freeSeats = r.capacity - s.seats.length;\n const nonVipTaken = s.seats.filter((x) => !x.isVip).length;\n // Für alle offen sind höchstens (Kapazität − Reserve) Plätze abzüglich der schon\n // belegten Nicht-VIP-Plätze; der Rest der freien Plätze ist VIP-Reserve.\n let reserved = 0;\n if (s.reserveActive && !s.past) {\n const nonVipCap = r.capacity - r.vipReserved;\n const openForAll = Math.max(0, Math.min(freeSeats, nonVipCap - nonVipTaken));\n reserved = freeSeats - openForAll;\n }\n for (let i = 0; i < freeSeats - reserved; i++) chips.push(`frei`);\n for (let i = 0; i < reserved; i++) chips.push(`★ VIP`);\n\n let action = \"\";\n if (s.myBookingId) {\n action = s.canCancel\n ? ``\n : `läuft`;\n } else if (s.canBook) {\n action = ``;\n } else {\n action = ``;\n }\n const reason = !s.myBookingId && !s.canBook && !s.past && s.reasonCode !== \"full\" ? `

${esc(s.reason)}

` : \"\";\n return `

${s.hour}:00bis ${s.hour + 1}:00

${chips.join(\"\")}

${action}

\n ${reason}\n

`;\n })\n .join(\"\");\n\n for (const b of $(\"slots\").querySelectorAll(\"[data-book]\")) {\n b.onclick = async () => {\n b.disabled = true;\n try {\n await api(\"/api/bookings\", { method: \"POST\", body: { resource: r.id, date: data.date, hour: Number(b.dataset.book) } });\n flash($(\"book-msg\"), `Gebucht: ${fmtDate(data.date)}, ${b.dataset.book}:00 Uhr.`);\n } catch (err) {\n flash($(\"book-msg\"), err.message, true);\n }\n loadSlots();\n };\n }\n for (const b of $(\"slots\").querySelectorAll(\"[data-cancel]\")) {\n b.onclick = async () => {\n b.disabled = true;\n try {\n await api(`/api/bookings/${b.dataset.cancel}`, { method: \"DELETE\" });\n flash($(\"book-msg\"), \"Buchung storniert.\");\n } catch (err) {\n flash($(\"book-msg\"), err.message, true);\n }\n loadSlots();\n };\n }\n}\n\n// ───────────── Meine Termine ─────────────\n\nasync function loadMine() {\n const { bookings } = await api(\"/api/bookings/mine\");\n $(\"mine-sub\").textContent = bookings.length ? `${bookings.length} anstehende${bookings.length === 1 ? \"r Termin\" : \" Termine\"}` : \"\";\n if (!bookings.length) {\n $(\"mine-list\").innerHTML = `

Du hast noch keine Termine. Jetzt buchen

`;\n $(\"go-book\").onclick = (e) => { e.preventDefault(); showView(\"book\"); };\n return;\n }\n $(\"mine-list\").innerHTML = bookings\n .map((b) => `

${fmtDate(b.date, true)}${b.hour}:00–${b.hour + 1}:00

${esc(b.resourceName)}

`)\n .join(\"\");\n for (const btn of $(\"mine-list\").querySelectorAll(\"[data-cancel]\")) {\n btn.onclick = async () => {\n btn.disabled = true;\n try { await api(`/api/bookings/${btn.dataset.cancel}`, { method: \"DELETE\" }); } catch (err) { alert(err.message); }\n loadMine();\n };\n }\n}\n\n// ───────────── Profil ─────────────\n\nfunction loadProfile() {\n const m = state.member;\n $(\"profile-title\").textContent = m.name;\n $(\"profile-sub\").textContent = (m.isVip ? \"VIP-Mitglied\" : \"Mitglied\") + (m.alias ? ` · Alias: ${m.alias}` : \" · noch kein Alias\");\n $(\"alias-input\").value = m.alias || \"\";\n $(\"email-input\").value = m.email || \"\";\n}\n\n$(\"form-email\").onsubmit = async (e) => {\n e.preventDefault();\n try {\n const r = await api(\"/api/profile/email\", { method: \"POST\", body: { email: $(\"email-input\").value } });\n state.member.email = r.email;\n flash($(\"email-msg\"), \"E-Mail-Adresse gespeichert.\");\n } catch (err) {\n flash($(\"email-msg\"), err.message, true);\n }\n};\n\n$(\"form-alias\").onsubmit = async (e) => {\n e.preventDefault();\n try {\n const r = await api(\"/api/profile/alias\", { method: \"POST\", body: { alias: $(\"alias-input\").value.trim() } });\n state.member.alias = r.alias;\n flash($(\"alias-msg\"), r.alias ? `Alias „${r.alias}“ gespeichert. Du kannst dich jetzt auch damit anmelden.` : \"Alias entfernt.\");\n loadProfile();\n $(\"who-name\").innerHTML = esc(state.member.alias || state.member.name) + (state.member.isVip ? ' ★' : \"\");\n } catch (err) {\n flash($(\"alias-msg\"), err.message, true);\n }\n};\n$(\"alias-clear\").onclick = async () => {\n $(\"alias-input\").value = \"\";\n $(\"form-alias\").requestSubmit();\n};\n\n$(\"form-pin\").onsubmit = async (e) => {\n e.preventDefault();\n if ($(\"pin-next\").value !== $(\"pin-next2\").value) {\n flash($(\"pin-msg\"), \"Die beiden neuen PINs stimmen nicht überein.\", true);\n return;\n }\n try {\n await api(\"/api/profile/pin\", { method: \"POST\", body: { current: $(\"pin-current\").value, next: $(\"pin-next\").value } });\n $(\"pin-current\").value = $(\"pin-next\").value = $(\"pin-next2\").value = \"\";\n flash($(\"pin-msg\"), \"PIN geändert. Andere Geräte wurden abgemeldet.\");\n } catch (err) {\n flash($(\"pin-msg\"), err.message, true);\n }\n};\n\n// ───────────── Verwaltung ─────────────\n\nasync function loadAdmin() {\n await Promise.all([loadMembers(), loadResources(), loadAllBookings()]);\n}\n\nasync function loadMembers() {\n const { members } = await api(\"/api/admin/members\");\n const tb = $(\"members-table\").querySelector(\"tbody\");\n tb.innerHTML = members\n .map((m) => {\n const status = !m.active ? 'deaktiviert'\n : m.resetRequestedAt ? 'PIN-Reset angefragt'\n : m.registered ? 'registriert' : 'wartet';\n const code = m.inviteCode ? `${esc(m.inviteCode)}` : \"—\";\n return `\n ${esc(m.name)}${m.alias ? `Alias: ${esc(m.alias)}` : \"\"}${m.email ? `${esc(m.email)}` : \"\"}\n ${status}\n \n \n ${code}\n

\n \n ${m.active\n ? ``\n : `\n `}\n

`;\n })\n .join(\"\");\n const patch = async (id, body) => {\n try { await api(`/api/admin/members/${id}`, { method: \"PATCH\", body }); } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadMembers();\n };\n for (const el of tb.querySelectorAll(\"[data-vip]\")) el.onchange = () => patch(el.dataset.vip, { isVip: el.checked });\n for (const el of tb.querySelectorAll(\"[data-admin]\")) el.onchange = () => patch(el.dataset.admin, { isAdmin: el.checked });\n for (const el of tb.querySelectorAll(\"[data-deact]\")) el.onclick = () => patch(el.dataset.deact, { active: false });\n for (const el of tb.querySelectorAll(\"[data-act]\")) el.onclick = () => patch(el.dataset.act, { active: true });\n for (const el of tb.querySelectorAll(\"[data-reset]\")) el.onclick = async () => {\n try {\n const r = await api(`/api/admin/members/${el.dataset.reset}/reset`, { method: \"POST\" });\n flash($(\"admin-msg\"), `Neuer Einladungscode: ${r.inviteCode} – bitte an die Person weitergeben.`);\n const me = await api(\"/api/me\");\n $(\"admin-badge\").hidden = !(me.pendingResets > 0);\n $(\"admin-badge\").textContent = me.pendingResets || \"\";\n } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadMembers();\n };\n for (const el of tb.querySelectorAll(\"[data-del]\")) el.onclick = async () => {\n try { await api(`/api/admin/members/${el.dataset.del}`, { method: \"DELETE\" }); } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadMembers();\n };\n}\n\n$(\"form-add-member\").onsubmit = async (e) => {\n e.preventDefault();\n try {\n const r = await api(\"/api/admin/members\", {\n method: \"POST\",\n body: { name: $(\"new-member-name\").value, isVip: $(\"new-member-vip\").checked },\n });\n flash($(\"admin-msg\"), `${$(\"new-member-name\").value.trim()} angelegt. Einladungscode: ${r.inviteCode}`);\n $(\"new-member-name\").value = \"\";\n $(\"new-member-vip\").checked = false;\n loadMembers();\n } catch (err) {\n flash($(\"admin-msg\"), err.message, true);\n }\n};\n\nconst RES_FIELDS = [\n [\"name\", \"Name\", \"text\"],\n [\"capacity\", \"Plätze / Stunde\", \"number\"],\n [\"vipReserved\", \"davon VIP-Reserve\", \"number\"],\n [\"reserveReleaseHours\", \"Reserve frei ab (Std. vor Start)\", \"number\"],\n [\"leadDaysVip\", \"Vorlauf VIP (Tage)\", \"number\"],\n [\"leadDaysStd\", \"Vorlauf normal (Tage)\", \"number\"],\n [\"maxOpenPerMember\", \"Max. offene Buchungen / Spieler\", \"number\"],\n [\"weekdayOpen\", \"Mo–Fr ab (Uhr)\", \"number\"],\n [\"weekdayClose\", \"Mo–Fr bis (Uhr)\", \"number\"],\n [\"weekendOpen\", \"Sa/So ab (Uhr)\", \"number\"],\n [\"weekendClose\", \"Sa/So bis (Uhr)\", \"number\"],\n];\n\nfunction resourceForm(r, isNew = false) {\n const idField = isNew\n ? `Kennung (Kleinbuchstaben, z. B. fitness)`\n : \"\";\n return ``;\n}\n\nasync function loadResources() {\n const { resources } = await api(\"/api/admin/resources\");\n $(\"resource-forms\").innerHTML = resources.map((r) => resourceForm(r)).join(\"\");\n bindResourceForms();\n}\n\nfunction bindResourceForms() {\n for (const form of $(\"resource-forms\").querySelectorAll(\"form.res-form\")) {\n form.onsubmit = async (e) => {\n e.preventDefault();\n const fd = new FormData(form);\n const body = {};\n for (const [k, v] of fd.entries()) body[k] = k === \"name\" || k === \"id\" ? v : Number(v);\n body.active = form.querySelector('[name=\"active\"]').checked;\n const id = form.dataset.new === \"1\" ? String(fd.get(\"id\")) : form.dataset.res;\n try {\n await api(`/api/admin/resources/${encodeURIComponent(id)}`, { method: \"PUT\", body });\n flash($(\"admin-msg\"), `${body.name} gespeichert.`);\n const me = await api(\"/api/me\");\n state.resources = me.resources;\n renderResourceTabs();\n loadResources();\n } catch (err) {\n flash($(\"admin-msg\"), err.message, true);\n }\n };\n }\n}\n\n$(\"btn-new-resource\").onclick = () => {\n if ($(\"resource-forms\").querySelector('[data-new=\"1\"]')) return;\n const tpl = {\n id: \"\", name: \"Fitness\", capacity: 4, vipReserved: 1, reserveReleaseHours: 24, leadDaysVip: 14, leadDaysStd: 7,\n weekdayOpen: 9, weekdayClose: 22, weekendOpen: 10, weekendClose: 21, maxOpenPerMember: 3, active: 1,\n };\n $(\"resource-forms\").insertAdjacentHTML(\"beforeend\", resourceForm(tpl, true));\n bindResourceForms();\n};\n\nasync function loadAllBookings() {\n const { bookings } = await api(\"/api/admin/bookings\");\n const tb = $(\"bookings-table\").querySelector(\"tbody\");\n if (!bookings.length) {\n tb.innerHTML = `Keine Buchungen in den nächsten 14 Tagen.`;\n return;\n }\n const resName = (id) => state.resources.find((r) => r.id === id)?.name ?? id;\n tb.innerHTML = bookings\n .map((b) => `\n ${fmtDate(b.date)}${b.hour}:00–${b.hour + 1}:00${esc(resName(b.resourceId))}\n ${b.isVip ? '★ ' : \"\"}${esc(b.name)}\n ${fmtStamp(b.createdAt)}\n

`)\n .join(\"\");\n for (const btn of tb.querySelectorAll(\"[data-cancel]\")) {\n btn.onclick = async () => {\n try { await api(`/api/bookings/${btn.dataset.cancel}`, { method: \"DELETE\" }); } catch (err) { flash($(\"admin-msg\"), err.message, true); }\n loadAllBookings();\n };\n }\n}\n\nboot().catch((err) => {\n document.body.insertAdjacentHTML(\"afterbegin\", `

${esc(err.message)}

`);\n});\n",[],[161,235],["D",1789073648998],[178,179,180,181],[161],["D",1789073537776],["D",1789512044203],{"_100":99,"_108":104},{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":25},{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"ctx",{"_82":-5,"_128":284,"_285":286,"_287":288,"_289":25,"_290":25,"_291":25,"_292":59,"_293":-5,"_294":-7,"_295":-7,"_296":63,"_297":25,"_298":25,"_299":-5,"_300":25,"_301":25,"_302":25,"_303":-5},"ENV",{"_255":256,"_257":258,"_259":90,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Deine Stunde am Simulator.

PIN zurücksetzen

Heute

Meine Termine

Profil

Alias

PIN ändern

Darstellung

Verwaltung

Spieler

Ressourcen & Regeln

Alle Buchungen der nächsten 14 Tage

Deine Stunde am Simulator.

PIN zurücksetzen

Heute

Meine Termine

Profil

Alias

PIN ändern

Darstellung

Verwaltung

Spieler

Ressourcen & Regeln

Alle Buchungen der nächsten 14 Tage

${isNew ? \"Neue Ressource\" : esc(r.name)}

Diff · v55