[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_168":169,"_170":171},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_104":85,"_27":105,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":122,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",19,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.tsx","latestPath","fileId","04a4aefa-5119-11f1-9d4f-ee650bb23af1","name","fileType","http","content","// Elevator Servicebox · ERP-Proxy\n// ENV: AIRTABLE_READ_KEY, AIRTABLE_BASE_ID, AUFZUG_API_KEY\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst TENANT_MAP = { aufzug: \"1\", aszendio: \"4\" };\nconst USER_CACHE = new Map();\nconst CACHE_TTL_MS = 60000;\nconst SESSION_SHORT = 8 * 60 * 60 * 1000;\nconst SESSION_LONG = 30 * 24 * 60 * 60 * 1000;\nconst SESSION_PREFIX = \"esbx_session_\";\n\nasync function setSession(t, d) { await blob.setJSON(SESSION_PREFIX+t, d); }\nasync function getSession(t) {\n let d; try { d = await blob.getJSON(SESSION_PREFIX+t); } catch(_) { return null; }\n if (!d) return null;\n if (d.expires && d.expires < Date.now()) { try { await blob.delete(SESSION_PREFIX+t); } catch(_){} return null; }\n return d;\n}\nasync function deleteSession(t) { try { await blob.delete(SESSION_PREFIX+t); } catch(_){} }\nfunction genToken() {\n const a = new Uint8Array(32); crypto.getRandomValues(a);\n return Array.from(a).map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");\n}\nasync function lookupUser(userKey) {\n const c = USER_CACHE.get(userKey);\n if (c && c.expires > Date.now()) return c.user;\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const readKey = Deno.env.get(\"AIRTABLE_READ_KEY\");\n if (!baseId || !readKey) throw new Error(\"AIRTABLE_BASE_ID/AIRTABLE_READ_KEY env var fehlt\");\n const formula = `AND({api_key}='${userKey.replace(/'/g,\"\\\\'\")}',{status}='aktiv')`;\n const url = `https://api.airtable.com/v0/${baseId}/User?filterByFormula=${encodeURIComponent(formula)}&maxRecords=1`;\n const res = await fetch(url, { headers: { Authorization: \"Bearer \"+readKey } });\n if (!res.ok) throw new Error(\"Airtable User-Lookup HTTP \"+res.status);\n const data = await res.json();\n if (!data.records || !data.records.length) {\n USER_CACHE.set(userKey, { user: null, expires: Date.now()+CACHE_TTL_MS });\n return null;\n }\n const r = data.records[0];\n const u = { id:r.id, api_key:r.fields.api_key, name:r.fields.name, role:r.fields.role, is_admin:r.fields.role===\"admin\" };\n USER_CACHE.set(userKey, { user: u, expires: Date.now()+CACHE_TTL_MS });\n return u;\n}\nasync function resolveAuth(token) {\n const s = await getSession(token);\n if (s) return { kind:\"session\", api_key:s.userApiKey, name:s.name, role:s.role, is_admin:s.isAdmin };\n try {\n const u = await lookupUser(token);\n if (u) return { kind:\"direct\", api_key:u.api_key, name:u.name, role:u.role, is_admin:u.is_admin };\n } catch(_) {}\n return null;\n}\nfunction json(d, s=200) {\n return new Response(JSON.stringify(d), { status:s, headers: { \"content-type\":\"application/json\", \"access-control-allow-origin\":\"*\" } });\n}\n\nexport default async function (req) {\n if (req.method === \"OPTIONS\") return new Response(null, { status:204, headers: {\n \"access-control-allow-origin\":\"*\",\n \"access-control-allow-headers\":\"authorization, content-type, x-erp-tenant, x-sync-secret\",\n \"access-control-allow-methods\":\"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\":\"86400\"\n }});\n const url = new URL(req.url);\n const path = url.pathname.replace(/^\\/+/,\"\");\n\n if (path === \"auth\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const userKey = (b.user_key||\"\").toString().trim();\n if (!userKey) return json({ error:\"user_key fehlt\" }, 400);\n let user; try { user = await lookupUser(userKey); } catch(e) { return json({ error:e.message }, 500); }\n if (!user) return json({ error:\"Ungültiger Login-Key oder Account inaktiv\" }, 401);\n const t = genToken();\n const ttl = b.long_lived ? SESSION_LONG : SESSION_SHORT;\n await setSession(t, { userApiKey:user.api_key, name:user.name, role:user.role, isAdmin:user.is_admin, expires:Date.now()+ttl });\n return json({ session_token:t, expires_in:Math.floor(ttl/1000), user });\n }\n\n // Cron-Jobs authentifizieren sich via X-Sync-Secret Header statt Bearer-Token\n const syncSecret = (req.headers.get(\"x-sync-secret\")||\"\").trim();\n const validSecret = Deno.env.get(\"SYNC_SECRET\");\n const isCron = !!(syncSecret && validSecret && syncSecret === validSecret);\n\n let user;\n if (isCron) {\n user = { kind:\"cron\", api_key:\"cron\", name:\"Cron\", role:\"system\", is_admin:true };\n } else {\n const tok = (req.headers.get(\"authorization\")||\"\").replace(/^Bearer\\s+/i,\"\").trim();\n if (!tok) return json({ error:\"Missing Bearer token\" }, 401);\n user = await resolveAuth(tok);\n if (!user) return json({ error:\"Ungültiges Token\" }, 401);\n }\n\n if (path === \"logout\" && req.method === \"POST\") {\n if (user.kind === \"session\") await deleteSession(tok);\n return json({ ok:true });\n }\n if (path === \"me\") return json({ user });\n if (path === \"health\") return json({ ok:true, user:{ name:user.name, is_admin:user.is_admin } });\n\n // ── Debug: welche Env-Vars sind gesetzt? (Werte nicht ausgegeben) ──\n if (path === \"debug/env\") {\n if (!user.is_admin) return json({ error:\"Nur fuer Admins\" }, 403);\n const keys = [\"AIRTABLE_READ_KEY\",\"AIRTABLE_BASE_ID\",\"AUFZUG_API_KEY\",\"AUFZUG_API_KEY_AUFZUG\",\"AUFZUG_API_KEY_ASZENDIO\",\"AUFZUG_BASE_URL\"];\n const out = {};\n for (const k of keys) {\n const v = Deno.env.get(k);\n out[k] = v ? { set: true, length: v.length, preview: v.length>8 ? v.slice(0,4)+\"...\"+v.slice(-2) : \"(short)\" } : { set: false };\n }\n return json({ env: out, tenant_map: TENANT_MAP });\n }\n\n // ── Debug-Probe: beliebigen ERP-Pfad testen, raw upstream-response zurueckgeben ──\n if (path === \"debug/probe\" && req.method === \"POST\") {\n if (!user.is_admin) return json({ error:\"Nur fuer Admins\" }, 403);\n let b = {}; try { b = await req.json(); } catch(_){}\n const firma = (b.firma||\"aufzug\").toString();\n const probePath = (b.path||\"\").toString().replace(/^\\/+/,\"\");\n // Tenant aus Body (Firmen-Verwaltung) > TENANT_MAP-Fallback\n const tenant = (b.tenant && String(b.tenant).trim()) || TENANT_MAP[firma];\n if (!tenant) return json({ error:\"Kein Tenant fuer Firma \"+firma+\" (weder Body noch TENANT_MAP)\" }, 400);\n const apiKey = Deno.env.get(\"AUFZUG_API_KEY_\"+firma.toUpperCase()) || Deno.env.get(\"AUFZUG_API_KEY\");\n if (!apiKey) return json({ error:\"Kein API-Key fuer Firma \"+firma+\" gesetzt\", expected_env:[\"AUFZUG_API_KEY_\"+firma.toUpperCase(),\"AUFZUG_API_KEY\"] }, 500);\n const baseUrl = Deno.env.get(\"AUFZUG_BASE_URL\") || \"https://verwaltung.api.aufzugshandwerk.de/v1\";\n const target = baseUrl + \"/\" + probePath;\n const t0 = Date.now();\n let upstreamStatus = null, upstreamBody = \"\", upstreamErr = null;\n try {\n const r = await fetch(target, { method:\"GET\", headers: { APIKEY:apiKey, TENANT:tenant, Accept:\"application/json\" } });\n upstreamStatus = r.status;\n upstreamBody = await r.text();\n } catch(e) { upstreamErr = e.message; }\n return json({\n target,\n tenant,\n tenant_source: b.tenant ? \"body\" : \"TENANT_MAP\",\n api_key_source: Deno.env.get(\"AUFZUG_API_KEY_\"+firma.toUpperCase()) ? \"AUFZUG_API_KEY_\"+firma.toUpperCase() : \"AUFZUG_API_KEY\",\n api_key_preview: apiKey.length>8 ? apiKey.slice(0,4)+\"...\"+apiKey.slice(-2) : \"(short)\",\n duration_ms: Date.now()-t0,\n status: upstreamStatus,\n err: upstreamErr,\n body_excerpt: upstreamBody ? upstreamBody.slice(0, 2000) : null\n });\n }\n\n if (path.startsWith(\"aufzug/\")) {\n const rest = path.replace(/^aufzug\\//,\"\");\n const i = rest.indexOf(\"/\");\n if (i < 0) return json({ error:\"Bad path. Erwartet: /aufzug//\" }, 400);\n const firma = rest.slice(0, i);\n const up = rest.slice(i+1);\n // Tenant: X-ERP-Tenant Header (Firmen-Verwaltung) > TENANT_MAP-Fallback\n const tenantHeader = (req.headers.get(\"x-erp-tenant\")||\"\").trim();\n const tenant = tenantHeader || TENANT_MAP[firma];\n if (!tenant) return json({ error:\"Kein Tenant fuer Firma \"+firma+\" – setze ihn in der Firmen-Verwaltung\", hint:\"erlaubte Slugs im Fallback: \"+Object.keys(TENANT_MAP).join(\", \") }, 400);\n // Per-Firma API-Key zuerst, dann globalen Fallback\n const firmaEnvKey = \"AUFZUG_API_KEY_\"+firma.toUpperCase();\n const apiKey = Deno.env.get(firmaEnvKey) || Deno.env.get(\"AUFZUG_API_KEY\");\n if (!apiKey) return json({ error:\"Kein API-Key fuer Firma \"+firma+\" hinterlegt\", expected_env:[firmaEnvKey,\"AUFZUG_API_KEY\"] }, 500);\n const baseUrl = Deno.env.get(\"AUFZUG_BASE_URL\") || \"https://verwaltung.api.aufzugshandwerk.de/v1\";\n const target = baseUrl + \"/\" + up + url.search;\n const t0 = Date.now();\n const init = { method:req.method, headers: { APIKEY:apiKey, TENANT:tenant, Accept:\"application/json\" } };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n const t = await req.text();\n if (t && t.length > 0) { init.body = t; init.headers[\"Content-Type\"] = \"application/json\"; }\n }\n let up2, text;\n try {\n up2 = await fetch(target, init);\n } catch(e) {\n return json({ error:\"Upstream-Verbindung fehlgeschlagen\", target, tenant, message:e.message }, 502);\n }\n const noBody = up2.status===101||up2.status===204||up2.status===205||up2.status===304;\n text = noBody ? null : await up2.text();\n // Bei Upstream-Fehler: strukturierte Fehlerantwort mit Diagnose\n if (up2.status >= 400) {\n return json({\n error: \"Upstream HTTP \"+up2.status,\n target,\n tenant,\n tenant_source: tenantHeader ? \"X-ERP-Tenant header\" : \"TENANT_MAP fallback\",\n method: req.method,\n api_key_source: Deno.env.get(firmaEnvKey) ? firmaEnvKey : \"AUFZUG_API_KEY\",\n duration_ms: Date.now()-t0,\n upstream_body_excerpt: text ? text.slice(0, 1500) : null,\n upstream_content_type: up2.headers.get(\"content-type\") || null\n }, up2.status);\n }\n return new Response(text, { status:up2.status, headers: {\n \"content-type\": up2.headers.get(\"content-type\") || \"application/json\",\n \"access-control-allow-origin\": \"*\",\n \"x-erp-target\": target,\n \"x-erp-tenant\": tenant,\n \"x-erp-duration-ms\": String(Date.now()-t0)\n }});\n }\n\n // ══════════ FRESHDESK PROXY ══════════\n // Routes: /freshdesk//api/v2/... → https://.freshdesk.com/\n // Auth via FRESHDESK_API_KEY_ (Basic Auth, key:X)\n if (path.startsWith(\"freshdesk/\")) {\n const rest = path.replace(/^freshdesk\\//, \"\");\n const i = rest.indexOf(\"/\");\n if (i < 0) return json({ error:\"Bad path. Erwartet: /freshdesk//\" }, 400);\n const firma = rest.slice(0, i);\n const fdPath = rest.slice(i+1);\n const domainEnv = \"FRESHDESK_DOMAIN_\"+firma.toUpperCase();\n const keyEnv = \"FRESHDESK_API_KEY_\"+firma.toUpperCase();\n const domain = Deno.env.get(domainEnv);\n const apiKey = Deno.env.get(keyEnv);\n if (!domain || !apiKey) return json({ error:\"Freshdesk-Config fehlt für Firma \"+firma, expected_env:[domainEnv, keyEnv] }, 500);\n const target = \"https://\" + domain + \".freshdesk.com/\" + fdPath + url.search;\n const t0 = Date.now();\n const basic = btoa(apiKey + \":X\");\n // Forward body as ArrayBuffer wenn vorhanden; Content-Type aus Request übernehmen (wichtig für multipart/form-data!)\n const upstreamHeaders = { \"Authorization\": \"Basic \" + basic };\n const originalCT = req.headers.get(\"content-type\");\n if (originalCT) upstreamHeaders[\"Content-Type\"] = originalCT;\n const fdInit = { method: req.method, headers: upstreamHeaders };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n fdInit.body = await req.arrayBuffer();\n }\n let r;\n try { r = await fetch(target, fdInit); }\n catch(e) { return json({ error:\"Freshdesk-Verbindung fehlgeschlagen\", target, message:e.message }, 502); }\n const noBody = r.status===101||r.status===204||r.status===205||r.status===304;\n const respText = noBody ? null : await r.text();\n if (r.status >= 400) {\n return json({\n error: \"Freshdesk HTTP \"+r.status,\n target,\n firma,\n method: req.method,\n duration_ms: Date.now()-t0,\n upstream_body_excerpt: respText ? respText.slice(0, 1500) : null,\n }, r.status);\n }\n return new Response(respText, { status: r.status, headers: {\n \"content-type\": r.headers.get(\"content-type\") || \"application/json\",\n \"access-control-allow-origin\": \"*\",\n \"x-fd-duration-ms\": String(Date.now()-t0)\n }});\n }\n\n // ══════════ MAILCHIMP PROXY ══════════\n // Routes:\n // POST /mailchimp//ping → Verbindungstest (zeigt Audience-Name)\n // POST /mailchimp//lists → alle Audiences zurückgeben (für Dropdown-Picker)\n // Body optional: { apiKey } → override für ungespeicherten Key\n // POST /mailchimp//upsert → 1 Kontakt anlegen/aktualisieren (idempotent via md5(email))\n // POST /mailchimp//bulk → mehrere Kontakte (Body: { members:[...] })\n // Config-Quelle (Reihenfolge):\n // 1) Airtable Firmen.mailchimp_api_key + .mailchimp_audience_id (über Firmen-Verwaltung in der App)\n // 2) Fallback Env-Vars MAILCHIMP_API_KEY_ / MAILCHIMP_AUDIENCE_\n if (path.startsWith(\"mailchimp/\")) {\n const rest = path.replace(/^mailchimp\\//, \"\");\n const i = rest.indexOf(\"/\");\n if (i < 0) return json({ error:\"Bad path. Erwartet: /mailchimp//\" }, 400);\n const firma = rest.slice(0, i);\n const action = rest.slice(i+1).replace(/\\/+$/,\"\");\n\n // SPECIAL CASE: \"lists\" braucht nur einen API-Key (Audience-ID egal)\n // und akzeptiert optional einen override im Body — für den Picker bevor User gespeichert hat\n if (action === \"lists\") {\n let overrideKey = null;\n if (req.method === \"POST\") {\n try { const b = await req.json(); if (b && b.apiKey) overrideKey = String(b.apiKey).trim(); } catch(_){}\n }\n let useKey = overrideKey;\n if (!useKey) {\n const cfgL = await lookupMailchimpConfig(firma);\n useKey = cfgL.apiKey;\n }\n if (!useKey) return json({\n error:\"Kein Mailchimp-API-Key für Firma \"+firma+\" verfügbar\",\n hint:\"Trage den API-Key in Admin → Firmen-Verwaltung ein (oder schicke ihn im Body als { apiKey: '...' }).\"\n }, 400);\n const dashL = useKey.lastIndexOf(\"-\");\n const serverL = dashL > 0 ? useKey.slice(dashL+1) : \"\";\n if (!serverL) return json({ error:\"Mailchimp API-Key hat keinen Server-Suffix (z.B. -us12). Format prüfen.\" }, 400);\n const baseL = \"https://\"+serverL+\".api.mailchimp.com/3.0\";\n const basicL = btoa(\"anystring:\"+useKey);\n const r = await fetch(baseL+\"/lists?count=100&fields=lists.id,lists.name,lists.stats.member_count,total_items\", {\n headers: { \"Authorization\":\"Basic \"+basicL, \"Accept\":\"application/json\" }\n });\n const txt = await r.text();\n if (!r.ok) {\n let detail = txt; try { const j = JSON.parse(txt); detail = j.detail || j.title || txt; } catch(_){}\n return json({ ok:false, status:r.status, error:\"Mailchimp /lists HTTP \"+r.status, detail:String(detail).slice(0,500) }, r.status);\n }\n let d; try { d = JSON.parse(txt); } catch(_) { d = {}; }\n const lists = (d.lists||[]).map(l => ({\n id: l.id,\n name: l.name,\n member_count: (l.stats && l.stats.member_count) || 0\n }));\n return json({ ok:true, lists, total: d.total_items || lists.length });\n }\n\n const cfg = await lookupMailchimpConfig(firma);\n const apiKey = cfg.apiKey, audId = cfg.audId;\n if (!apiKey || !audId) return json({\n error:\"Mailchimp-Config fehlt für Firma \"+firma,\n hint:\"Trage API-Key und Audience-ID in Admin → Firmen-Verwaltung ein (oder als Env-Vars MAILCHIMP_API_KEY_\"+firma.toUpperCase()+\" / MAILCHIMP_AUDIENCE_\"+firma.toUpperCase()+\").\"\n }, 500);\n // Server-Prefix aus dem Key extrahieren: \"-us12\" → \"us12\"\n const dash = apiKey.lastIndexOf(\"-\");\n const server = dash > 0 ? apiKey.slice(dash+1) : \"\";\n if (!server) return json({ error:\"Mailchimp API-Key hat keinen Server-Suffix (z.B. -us12). Prüfe ob der Key korrekt aus Mailchimp kopiert wurde.\" }, 500);\n const mcBase = \"https://\"+server+\".api.mailchimp.com/3.0\";\n const basic = btoa(\"anystring:\"+apiKey);\n const mcHeaders = { \"Authorization\":\"Basic \"+basic, \"Content-Type\":\"application/json\", \"Accept\":\"application/json\" };\n\n // Helper: md5 → Mailchimp subscriber_hash erwartet md5(lowercase(email))\n async function md5Hex(input) {\n // Deno hat kein native md5 in Web Crypto. Wir nutzen eine kleine JS-Implementierung.\n function md5(s) {\n function r(n,b){return n<>>32-b}\n function a(a,b,c,d,e,f,g){b=b+(a&c|~a&d)+(e>>>0)+g;return r(b,f)+a}\n function k(a,b,c,d,e,f,g){b=b+(a&d|c&~d)+(e>>>0)+g;return r(b,f)+a}\n function l(a,b,c,d,e,f,g){b=b+(a^c^d)+(e>>>0)+g;return r(b,f)+a}\n function m(a,b,c,d,e,f,g){b=b+(c^(a|~d))+(e>>>0)+g;return r(b,f)+a}\n // String → byte array\n const bytes=[]; for(let i=0;i>6);bytes.push(128|c&63);} else {bytes.push(224|c>>12);bytes.push(128|c>>6&63);bytes.push(128|c&63);}}\n const len = bytes.length;\n bytes.push(0x80);\n while(bytes.length%64 !== 56) bytes.push(0);\n const bitLen = len*8;\n bytes.push(bitLen&0xff,(bitLen>>>8)&0xff,(bitLen>>>16)&0xff,(bitLen>>>24)&0xff,0,0,0,0);\n let aH=1732584193,bH=-271733879,cH=-1732584194,dH=271733878;\n for(let i=0;i>>(i*8))&0xff).toString(16).padStart(2,\"0\"); return s; }\n return h(aH)+h(bH)+h(cH)+h(dH);\n }\n return md5(input);\n }\n\n async function mcUpsert(member) {\n const email = String(member.email_address||\"\").trim().toLowerCase();\n if (!email) return { ok:false, error:\"Email fehlt\" };\n const hash = await md5Hex(email);\n const mergeFields = {};\n if (member.merge_fields) Object.assign(mergeFields, member.merge_fields);\n const body = {\n email_address: email,\n status_if_new: \"subscribed\",\n merge_fields: mergeFields\n };\n const target = mcBase+\"/lists/\"+audId+\"/members/\"+hash;\n const r = await fetch(target, { method:\"PUT\", headers: mcHeaders, body: JSON.stringify(body) });\n const txt = await r.text();\n if (!r.ok) {\n let detail = txt; try { const j = JSON.parse(txt); detail = j.detail || j.title || txt; } catch(_){}\n return { ok:false, email, status:r.status, error: detail };\n }\n let memberData = null; try { memberData = JSON.parse(txt); } catch(_){}\n // Tags zusätzlich pushen (separater Endpoint)\n const tags = Array.isArray(member.tags) ? member.tags.filter(t => t && String(t).trim()) : [];\n if (tags.length) {\n const tagBody = { tags: tags.map(t => ({ name: String(t).trim(), status: \"active\" })) };\n const tr = await fetch(mcBase+\"/lists/\"+audId+\"/members/\"+hash+\"/tags\", {\n method:\"POST\", headers: mcHeaders, body: JSON.stringify(tagBody)\n });\n if (!tr.ok) {\n const tt = await tr.text();\n return { ok:true, email, hash, warn:\"Member ok, Tags HTTP \"+tr.status+\": \"+tt.slice(0,200), member: memberData };\n }\n }\n return { ok:true, email, hash, member: memberData };\n }\n\n if (action === \"ping\") {\n const r = await fetch(mcBase+\"/lists/\"+audId, { headers: mcHeaders });\n const txt = await r.text();\n if (!r.ok) return json({ ok:false, status:r.status, body: txt.slice(0,500) }, r.status);\n let d = null; try { d = JSON.parse(txt); } catch(_){}\n return json({ ok:true, audience: d ? { id:d.id, name:d.name, member_count:d.stats && d.stats.member_count } : null });\n }\n if (action === \"upsert\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const result = await mcUpsert(b);\n return json(result, result.ok ? 200 : (result.status||500));\n }\n if (action === \"bulk\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const members = Array.isArray(b.members) ? b.members : [];\n const results = [];\n let ok=0, fail=0, skip=0;\n for (const m of members) {\n if (!m || !m.email_address) { skip++; results.push({ ok:false, error:\"keine Email\", input:m && m.tags }); continue; }\n const r = await mcUpsert(m);\n if (r.ok) ok++; else fail++;\n results.push(r);\n }\n return json({ ok:true, total: members.length, success: ok, failed: fail, skipped: skip, results });\n }\n return json({ error:\"Unbekannte Mailchimp-Action: \"+action, available:[\"ping\",\"upsert\",\"bulk\"] }, 404);\n }\n\n // ══════════ LIFTARO PARTNER API PROXY ══════════\n // Liftaro = neutrale Vergleichsplattform für Wartungsverträge.\n // Wir agieren als Subunternehmer-Partner und beantworten Anfragen.\n // Routes (X-Partner-Key wird serverseitig aus LIFTARO_PARTNER_KEY env-var gesetzt):\n // GET /liftaro/me → Self-Identify\n // GET /liftaro/checks?status=… → Liste Anfragen\n // GET /liftaro/checks/ → Detail\n // POST /liftaro/checks//offer → Angebot abgeben\n // POST /liftaro/checks//decline → Ablehnen\n // POST /liftaro/webhook-test → Test-Webhook auslösen\n if (path === \"liftaro\" || path.startsWith(\"liftaro/\")) {\n const liftaroKey = Deno.env.get(\"LIFTARO_PARTNER_KEY\");\n if (!liftaroKey) return json({\n error:\"LIFTARO_PARTNER_KEY env-var nicht gesetzt\",\n hint:\"Trage den Liftaro-Partner-Key in val.town Settings → Environment Variables ein.\"\n }, 500);\n const LIFTARO_BASE = \"https://check.liftaro.de/partner/api/v2\";\n const sub = path.replace(/^liftaro\\/?/, \"\"); // z.B. \"me\", \"checks\", \"checks/PA-2026-0001/offer\"\n if (!sub) return json({ error:\"Bad path. Erwartet: /liftaro/\" }, 400);\n const target = LIFTARO_BASE + \"/\" + sub + url.search;\n const init = {\n method: req.method,\n headers: {\n \"X-Partner-Key\": liftaroKey,\n \"Accept\": \"application/json\",\n }\n };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n const ct = req.headers.get(\"content-type\") || \"application/json\";\n init.headers[\"Content-Type\"] = ct;\n try { init.body = await req.text(); } catch(_){}\n }\n const t0 = Date.now();\n let up, body;\n try {\n up = await fetch(target, init);\n body = await up.text();\n } catch(e) {\n return json({ error:\"Liftaro-Verbindung fehlgeschlagen\", target, message:e.message }, 502);\n }\n if (up.status >= 400) {\n let detail = body;\n try { const j = JSON.parse(body); detail = j.detail || j.error || j.message || body; } catch(_){}\n return json({\n error:\"Liftaro HTTP \"+up.status,\n target,\n status: up.status,\n detail: String(detail).slice(0, 1500),\n duration_ms: Date.now()-t0,\n }, up.status);\n }\n return new Response(body, {\n status: up.status,\n headers: {\n \"content-type\": up.headers.get(\"content-type\") || \"application/json\",\n \"access-control-allow-origin\": \"*\",\n \"x-liftaro-target\": target,\n \"x-liftaro-duration-ms\": String(Date.now()-t0),\n }\n });\n }\n\n // ══════════ BACKGROUND-SYNC ENDPOINTS ══════════\n\n if (path === \"sync/run\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const firma = (b.firma||\"\").toString();\n if (!firma) return json({ error:\"firma fehlt\" }, 400);\n try {\n const result = await runSyncForFirma(firma, user.api_key || \"system\");\n return json(result);\n } catch(e) {\n const errResult = { firma, error: e.message, finished: new Date().toISOString() };\n try { await blob.setJSON(\"sync_status_\"+firma, errResult); } catch(_){}\n return json({ error: e.message, firma }, 500);\n }\n }\n\n if (path === \"sync/status\" && req.method === \"GET\") {\n let items = [];\n try { items = await blob.list(\"sync_status_\") || []; } catch(_){}\n const statuses = {};\n for (const item of items) {\n const key = (item && item.key) ? item.key : item;\n try {\n const data = await blob.getJSON(key);\n const firma = String(key).replace(\"sync_status_\",\"\");\n statuses[firma] = data;\n } catch(_){}\n }\n return json({ statuses });\n }\n\n // Sync für ALLE aktiven Firmen (für Cron-Jobs)\n if (path === \"sync/run-all\" && req.method === \"POST\") {\n try {\n const firmen = await atReadAll(\"Firmen\");\n const results = [];\n for (const f of firmen) {\n const slug = f.fields && f.fields.slug;\n const tenant = f.fields && f.fields.erp_tenant;\n const aktiv = (f.fields && f.fields.aktiv) !== false;\n if (!slug || !tenant || !aktiv) continue;\n try {\n const r = await runSyncForFirma(slug, user.api_key || \"cron\");\n results.push({ firma:slug, ok:true, created:r.created, updated:r.updated, skipped:r.skipped, errors:r.errors });\n } catch(e) {\n results.push({ firma:slug, ok:false, error: e.message });\n try { await blob.setJSON(\"sync_status_\"+slug, { firma:slug, error:e.message, finished:new Date().toISOString(), triggered_by:user.api_key||\"cron\" }); } catch(_){}\n }\n }\n const summary = { ran: results.length, started: new Date().toISOString(), results };\n try { await blob.setJSON(\"cron_last_run\", summary); } catch(_){}\n return json(summary);\n } catch(e) {\n return json({ error: e.message }, 500);\n }\n }\n\n return json({ error:\"Not found\", path }, 404);\n}\n\n// ══════════ SYNC HELPERS (server-side TS) ══════════\n\nconst ACTIVE_STATUSES = [\"Auftrag bestätigt\", \"In Bearbeitung\", \"Abgeschlossen\"];\n\nfunction normStatus(s) {\n const t = String(s||\"\").toLowerCase().trim();\n if (!t) return \"offen\";\n if (/abgerechnet/.test(t)) return \"abgerechnet\";\n if (/abgeschlossen/.test(t)) return \"abgeschlossen\";\n // Merged: 'In Bearbeitung' + 'Auftrag bestätigt' + legacy → 'offen'\n if (/bearbeit|best.tigt|^offen$|^in_bearbeitung$/.test(t)) return \"offen\";\n return t;\n}\n\nfunction buildKontakt(k) {\n const name = [k.vorname, k.nachname].filter(Boolean).join(\" \").trim();\n const phone = k.telefon || k.mobile || \"\";\n const parts = [];\n if (name) parts.push(name);\n if (phone) parts.push(\"Tel: \"+phone);\n if (k.rolle) parts.push(\"Rolle: \"+k.rolle);\n return parts.join(\"\\n\");\n}\n\nasync function atReadAll(table, params) {\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const readKey = Deno.env.get(\"AIRTABLE_READ_KEY\");\n if (!baseId || !readKey) throw new Error(\"AIRTABLE_BASE_ID/AIRTABLE_READ_KEY env-var fehlt\");\n let records = [];\n let offset = null;\n let safety = 0;\n do {\n let url = \"https://api.airtable.com/v0/\"+baseId+\"/\"+encodeURIComponent(table)+\"?pageSize=100\";\n if (params) url += \"&\"+params;\n if (offset) url += \"&offset=\"+encodeURIComponent(offset);\n const r = await fetch(url, { headers: { Authorization: \"Bearer \"+readKey } });\n if (!r.ok) throw new Error(\"Airtable \"+table+\" GET \"+r.status);\n const d = await r.json();\n records = records.concat(d.records || []);\n offset = d.offset || null;\n if (++safety > 50) break;\n } while (offset);\n return records;\n}\n\nasync function atPatch(table, recId, fields) {\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const writeKey = Deno.env.get(\"AIRTABLE_WRITE_KEY\");\n if (!baseId || !writeKey) throw new Error(\"AIRTABLE_WRITE_KEY env-var fehlt (Setup neu durchlaufen)\");\n const url = \"https://api.airtable.com/v0/\"+baseId+\"/\"+encodeURIComponent(table)+\"/\"+recId;\n const r = await fetch(url, {\n method: \"PATCH\",\n headers: { Authorization: \"Bearer \"+writeKey, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields })\n });\n const d = await r.json();\n if (!r.ok) throw new Error(\"Airtable PATCH \"+r.status+\": \"+(d && d.error && d.error.message || \"\"));\n return d;\n}\n\nasync function atCreate(table, fields) {\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const writeKey = Deno.env.get(\"AIRTABLE_WRITE_KEY\");\n if (!baseId || !writeKey) throw new Error(\"AIRTABLE_WRITE_KEY env-var fehlt (Setup neu durchlaufen)\");\n const url = \"https://api.airtable.com/v0/\"+baseId+\"/\"+encodeURIComponent(table);\n const r = await fetch(url, {\n method: \"POST\",\n headers: { Authorization: \"Bearer \"+writeKey, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields })\n });\n const d = await r.json();\n if (!r.ok) throw new Error(\"Airtable POST \"+r.status+\": \"+(d && d.error && d.error.message || \"\"));\n return d;\n}\n\nasync function lookupTenant(firma) {\n try {\n const recs = await atReadAll(\"Firmen\", \"filterByFormula=\"+encodeURIComponent(\"{slug}='\"+firma+\"'\")+\"&maxRecords=1\");\n const t = recs[0] && recs[0].fields && recs[0].fields.erp_tenant;\n if (t) return String(t).trim();\n } catch(_){}\n const LEGACY = { aufzug: \"1\", aszendio: \"4\" };\n return LEGACY[firma] || null;\n}\n\n// Mailchimp-Config pro Firma. Reihenfolge: Airtable-Felder (Firmen.mailchimp_api_key\n// + .mailchimp_audience_id) → Env-Vars MAILCHIMP_API_KEY_ / MAILCHIMP_AUDIENCE_\n// → null. So kann der Admin alles in der App pflegen, ohne in val.town zu müssen.\nasync function lookupMailchimpConfig(firma) {\n let apiKey = null, audId = null;\n try {\n const recs = await atReadAll(\"Firmen\", \"filterByFormula=\"+encodeURIComponent(\"{slug}='\"+firma+\"'\")+\"&maxRecords=1\");\n const f = recs[0] && recs[0].fields;\n if (f) {\n const k = f.mailchimp_api_key, a = f.mailchimp_audience_id;\n if (k && String(k).trim()) apiKey = String(k).trim();\n if (a && String(a).trim()) audId = String(a).trim();\n }\n } catch(_){}\n if (!apiKey) apiKey = Deno.env.get(\"MAILCHIMP_API_KEY_\"+firma.toUpperCase()) || null;\n if (!audId) audId = Deno.env.get(\"MAILCHIMP_AUDIENCE_\"+firma.toUpperCase()) || null;\n return { apiKey, audId };\n}\n\nasync function erpGet(firma, tenant, apiKey, p) {\n const baseUrl = Deno.env.get(\"AUFZUG_BASE_URL\") || \"https://verwaltung.api.aufzugshandwerk.de/v1\";\n const url = baseUrl+\"/\"+p;\n const r = await fetch(url, { headers: { APIKEY: apiKey, TENANT: tenant, Accept: \"application/json\" } });\n if (!r.ok) {\n const txt = await r.text().catch(()=>\"\");\n throw new Error(\"ERP \"+p+\" HTTP \"+r.status+(txt?\" – \"+txt.slice(0,150):\"\"));\n }\n return r.json();\n}\n\nasync function runSyncForFirma(firma, userKey) {\n const t0 = Date.now();\n try { await blob.setJSON(\"sync_status_\"+firma, { firma, running: true, started: new Date(t0).toISOString(), triggered_by: userKey }); } catch(_){}\n\n const tenant = await lookupTenant(firma);\n if (!tenant) throw new Error(\"Kein ERP-Tenant fuer Firma '\"+firma+\"' (Firmen-Verwaltung).\");\n const apiKey = Deno.env.get(\"AUFZUG_API_KEY_\"+firma.toUpperCase()) || Deno.env.get(\"AUFZUG_API_KEY\");\n if (!apiKey) throw new Error(\"Kein API-Key fuer Firma '\"+firma+\"'.\");\n\n const existing = await atReadAll(\"Auftraege\");\n const byExt = new Map();\n for (const r of existing) {\n if (r.fields && r.fields.ext_id && (r.fields.firma||\"\") === firma) {\n byExt.set(String(r.fields.ext_id), r);\n }\n }\n\n let all;\n try { all = await erpGet(firma, tenant, apiKey, \"api/auftraege\"); }\n catch(_) { all = await erpGet(firma, tenant, apiKey, \"auftraege\"); }\n if (!Array.isArray(all)) all = (all && (all.content || all.items || all.data)) || [];\n const active = all.filter(a => ACTIVE_STATUSES.indexOf(a.status) >= 0);\n\n const toProcess = [];\n let skipped = 0;\n for (const a of active) {\n const ex = byExt.get(String(a.id));\n if (ex && a.lastmodifiedDate && ex.fields.ext_last_modified === a.lastmodifiedDate) {\n // ÜBERSPRINGEN — außer 'auftragswert_netto' fehlt noch (Migration nach v3.09)\n const needsValueBackfill = a.bestellform === \"MITANGEBOT\" && a.angebotid && (ex.fields.auftragswert_netto == null);\n if (!needsValueBackfill) {\n skipped++;\n continue;\n }\n }\n toProcess.push(a);\n }\n\n const angebotCache = new Map();\n const needsAngebot = [];\n for (const a of toProcess) {\n if (a.bestellform === \"MITANGEBOT\" && a.angebotid) {\n const ex = byExt.get(String(a.id));\n if (ex\n && String(ex.fields.angebot_id||\"\") === String(a.angebotid)\n && ex.fields.leistungsumfang\n && ex.fields.auftragswert_netto != null) {\n angebotCache.set(String(a.angebotid), {\n serviceDescription: ex.fields.leistungsumfang,\n offerExplanation: ex.fields.erlaeuterungen,\n typ: ex.fields.angebot_typ,\n netPrice: ex.fields.auftragswert_netto\n });\n } else {\n needsAngebot.push(a);\n }\n }\n }\n if (needsAngebot.length > 0) {\n let idx = 0;\n const worker = async () => {\n while (idx < needsAngebot.length) {\n const a = needsAngebot[idx++];\n try {\n const ang = await erpGet(firma, tenant, apiKey, \"api/angebote/\"+a.angebotid);\n angebotCache.set(String(a.angebotid), ang);\n } catch(_) {}\n }\n };\n await Promise.all(Array.from({ length: Math.min(5, needsAngebot.length) }, () => worker()));\n }\n\n let created = 0, updated = 0, unchanged = 0, withAngebot = 0, errors = 0;\n const USER_MANAGED = [\"techniker_keys\",\"techniker_namen\",\"priority\",\"tmpl\",\"notizen\",\"bilder\",\"subunternehmer_preis\",\"bericht_id\",\"bericht_num\",\"completed_at\",\"created\",\"created_by\"];\n\n for (const a of toProcess) {\n try {\n let ang = null;\n if (a.bestellform === \"MITANGEBOT\" && a.angebotid) {\n ang = angebotCache.get(String(a.angebotid)) || null;\n if (ang) withAngebot++;\n }\n const anlage = a.anlage || {};\n const ansp = anlage.ansprechpartner || {};\n const empf = a.empfaenger || {};\n const hasAnsp = !!(ansp.vorname || ansp.nachname || ansp.telefon || ansp.mobile);\n const kontaktText = hasAnsp ? buildKontakt(ansp) : buildKontakt(empf);\n const haystack = [a.bestellform, a.leistungsbeschreibung, a.notizen, ang && ang.typ, ang && ang.serviceDescription, ang && ang.title, anlage.objektTyp].filter(Boolean).join(\" \").toLowerCase();\n const isWartung = /wartung/.test(haystack);\n const tmplKey = firma + (isWartung ? \"-wartung\" : \"-arbeit\");\n const leistungsumfang = ((ang && ang.serviceDescription) || a.leistungsbeschreibung || a.notizen || \"\").toString().trim();\n\n const fields = {\n firma,\n auftrag_num: a.vorgangsnummer || a.id,\n ext_id: a.id,\n ext_source: \"aufzugshandwerk_v1\",\n ext_vorgangsnummer: a.vorgangsnummer || null,\n ext_last_modified: a.lastmodifiedDate || \"\",\n standort: anlage.anzeigeAdresse || anlage.name || \"\",\n fabriknummer: anlage.fabriknummer || \"\",\n kontakt: kontaktText,\n // Leistungsbeschreibung bevorzugt aus Angebot (leistungsumfang), sonst aus Auftrag/Notizen\n leistungsbeschreibung: leistungsumfang || a.leistungsbeschreibung || a.notizen || \"\",\n status: normStatus(a.status),\n priority: \"normal\",\n due_date: (a.ausfuehrungstermin || \"\").slice(0, 10) || \"\",\n created: a.createdDate || new Date().toISOString(),\n created_by: userKey,\n tmpl: tmplKey,\n stundensatz: anlage.stundensatz || null,\n einsatzpauschale: anlage.einsatzPauschale || null,\n objekttyp: anlage.objektTyp || \"\",\n kunde_firmenname: (anlage.kunde && anlage.kunde.firmenname) || \"\",\n leistungsumfang: leistungsumfang,\n erlaeuterungen: (ang && ang.offerExplanation) || \"\",\n angebot_typ: (ang && ang.typ) || \"\",\n angebot_id: a.angebotid || null,\n bestellform: a.bestellform || \"\",\n auftragswert_netto: ang ? ((ang.netPrice != null ? +ang.netPrice : null) ?? (ang.gesamtpreis != null ? +ang.gesamtpreis : null) ?? (ang.annualPrice != null ? +ang.annualPrice : null)) : null\n };\n\n const ex = byExt.get(String(a.id));\n if (ex) {\n const patch = Object.assign({}, fields);\n for (const k of USER_MANAGED) {\n const v = ex.fields[k];\n const hasVal = v !== undefined && v !== null && v !== \"\" && !(Array.isArray(v) && v.length === 0);\n if (hasVal) delete patch[k];\n }\n if (ex.fields.status === \"abgerechnet\") delete patch.status;\n const protectIfEmpty = [\"kontakt\",\"leistungsumfang\",\"erlaeuterungen\",\"standort\",\"fabriknummer\",\"due_date\"];\n for (const k of protectIfEmpty) {\n if ((patch[k] === \"\" || patch[k] == null) && ex.fields[k]) delete patch[k];\n }\n const changed = {};\n for (const k of Object.keys(patch)) {\n const cur = ex.fields[k];\n const curN = (cur === null || cur === undefined) ? \"\" : cur;\n const newN = (patch[k] === null || patch[k] === undefined) ? \"\" : patch[k];\n if (String(curN) !== String(newN)) changed[k] = patch[k];\n }\n if (a.lastmodifiedDate && ex.fields.ext_last_modified !== a.lastmodifiedDate) {\n changed.ext_last_modified = a.lastmodifiedDate;\n }\n if (Object.keys(changed).length === 0) { unchanged++; continue; }\n await atPatch(\"Auftraege\", ex.id, changed);\n updated++;\n } else {\n await atCreate(\"Auftraege\", fields);\n created++;\n }\n } catch(e) { errors++; }\n }\n\n const result = {\n firma, running: false,\n started: new Date(t0).toISOString(),\n finished: new Date().toISOString(),\n duration_ms: Date.now() - t0,\n total: active.length,\n toProcess: toProcess.length,\n skipped, created, updated, unchanged, withAngebot, errors,\n triggered_by: userKey\n };\n try { await blob.setJSON(\"sync_status_\"+firma, result); } catch(_){}\n return result;\n}\n","// Elevator Servicebox · ERP-Proxy\n// ENV: AIRTABLE_READ_KEY, AIRTABLE_BASE_ID, AUFZUG_API_KEY\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst TENANT_MAP = { aufzug: \"1\", aszendio: \"4\" };\nconst USER_CACHE = new Map();\nconst CACHE_TTL_MS = 60000;\nconst SESSION_SHORT = 8 * 60 * 60 * 1000;\nconst SESSION_LONG = 30 * 24 * 60 * 60 * 1000;\nconst SESSION_PREFIX = \"esbx_session_\";\n\nasync function setSession(t, d) { await blob.setJSON(SESSION_PREFIX+t, d); }\nasync function getSession(t) {\n let d; try { d = await blob.getJSON(SESSION_PREFIX+t); } catch(_) { return null; }\n if (!d) return null;\n if (d.expires && d.expires < Date.now()) { try { await blob.delete(SESSION_PREFIX+t); } catch(_){} return null; }\n return d;\n}\nasync function deleteSession(t) { try { await blob.delete(SESSION_PREFIX+t); } catch(_){} }\nfunction genToken() {\n const a = new Uint8Array(32); crypto.getRandomValues(a);\n return Array.from(a).map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");\n}\nasync function lookupUser(userKey) {\n const c = USER_CACHE.get(userKey);\n if (c && c.expires > Date.now()) return c.user;\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const readKey = Deno.env.get(\"AIRTABLE_READ_KEY\");\n if (!baseId || !readKey) throw new Error(\"AIRTABLE_BASE_ID/AIRTABLE_READ_KEY env var fehlt\");\n const formula = `AND({api_key}='${userKey.replace(/'/g,\"\\\\'\")}',{status}='aktiv')`;\n const url = `https://api.airtable.com/v0/${baseId}/User?filterByFormula=${encodeURIComponent(formula)}&maxRecords=1`;\n const res = await fetch(url, { headers: { Authorization: \"Bearer \"+readKey } });\n if (!res.ok) throw new Error(\"Airtable User-Lookup HTTP \"+res.status);\n const data = await res.json();\n if (!data.records || !data.records.length) {\n USER_CACHE.set(userKey, { user: null, expires: Date.now()+CACHE_TTL_MS });\n return null;\n }\n const r = data.records[0];\n const u = { id:r.id, api_key:r.fields.api_key, name:r.fields.name, role:r.fields.role, is_admin:r.fields.role===\"admin\" };\n USER_CACHE.set(userKey, { user: u, expires: Date.now()+CACHE_TTL_MS });\n return u;\n}\nasync function resolveAuth(token) {\n const s = await getSession(token);\n if (s) return { kind:\"session\", api_key:s.userApiKey, name:s.name, role:s.role, is_admin:s.isAdmin };\n try {\n const u = await lookupUser(token);\n if (u) return { kind:\"direct\", api_key:u.api_key, name:u.name, role:u.role, is_admin:u.is_admin };\n } catch(_) {}\n return null;\n}\nfunction json(d, s=200) {\n return new Response(JSON.stringify(d), { status:s, headers: { \"content-type\":\"application/json\", \"access-control-allow-origin\":\"*\" } });\n}\n\nexport default async function (req) {\n if (req.method === \"OPTIONS\") return new Response(null, { status:204, headers: {\n \"access-control-allow-origin\":\"*\",\n \"access-control-allow-headers\":\"authorization, content-type, x-erp-tenant, x-sync-secret\",\n \"access-control-allow-methods\":\"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\":\"86400\"\n }});\n const url = new URL(req.url);\n const path = url.pathname.replace(/^\\/+/,\"\");\n\n if (path === \"auth\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const userKey = (b.user_key||\"\").toString().trim();\n if (!userKey) return json({ error:\"user_key fehlt\" }, 400);\n let user; try { user = await lookupUser(userKey); } catch(e) { return json({ error:e.message }, 500); }\n if (!user) return json({ error:\"Ungültiger Login-Key oder Account inaktiv\" }, 401);\n const t = genToken();\n const ttl = b.long_lived ? SESSION_LONG : SESSION_SHORT;\n await setSession(t, { userApiKey:user.api_key, name:user.name, role:user.role, isAdmin:user.is_admin, expires:Date.now()+ttl });\n return json({ session_token:t, expires_in:Math.floor(ttl/1000), user });\n }\n\n // Cron-Jobs authentifizieren sich via X-Sync-Secret Header statt Bearer-Token\n const syncSecret = (req.headers.get(\"x-sync-secret\")||\"\").trim();\n const validSecret = Deno.env.get(\"SYNC_SECRET\");\n const isCron = !!(syncSecret && validSecret && syncSecret === validSecret);\n\n let user;\n if (isCron) {\n user = { kind:\"cron\", api_key:\"cron\", name:\"Cron\", role:\"system\", is_admin:true };\n } else {\n const tok = (req.headers.get(\"authorization\")||\"\").replace(/^Bearer\\s+/i,\"\").trim();\n if (!tok) return json({ error:\"Missing Bearer token\" }, 401);\n user = await resolveAuth(tok);\n if (!user) return json({ error:\"Ungültiges Token\" }, 401);\n }\n\n if (path === \"logout\" && req.method === \"POST\") {\n if (user.kind === \"session\") await deleteSession(tok);\n return json({ ok:true });\n }\n if (path === \"me\") return json({ user });\n if (path === \"health\") return json({ ok:true, user:{ name:user.name, is_admin:user.is_admin } });\n\n // ── Debug: welche Env-Vars sind gesetzt? (Werte nicht ausgegeben) ──\n if (path === \"debug/env\") {\n if (!user.is_admin) return json({ error:\"Nur fuer Admins\" }, 403);\n const keys = [\"AIRTABLE_READ_KEY\",\"AIRTABLE_BASE_ID\",\"AUFZUG_API_KEY\",\"AUFZUG_API_KEY_AUFZUG\",\"AUFZUG_API_KEY_ASZENDIO\",\"AUFZUG_BASE_URL\"];\n const out = {};\n for (const k of keys) {\n const v = Deno.env.get(k);\n out[k] = v ? { set: true, length: v.length, preview: v.length>8 ? v.slice(0,4)+\"...\"+v.slice(-2) : \"(short)\" } : { set: false };\n }\n return json({ env: out, tenant_map: TENANT_MAP });\n }\n\n // ── Debug-Probe: beliebigen ERP-Pfad testen, raw upstream-response zurueckgeben ──\n if (path === \"debug/probe\" && req.method === \"POST\") {\n if (!user.is_admin) return json({ error:\"Nur fuer Admins\" }, 403);\n let b = {}; try { b = await req.json(); } catch(_){}\n const firma = (b.firma||\"aufzug\").toString();\n const probePath = (b.path||\"\").toString().replace(/^\\/+/,\"\");\n // Tenant aus Body (Firmen-Verwaltung) > TENANT_MAP-Fallback\n const tenant = (b.tenant && String(b.tenant).trim()) || TENANT_MAP[firma];\n if (!tenant) return json({ error:\"Kein Tenant fuer Firma \"+firma+\" (weder Body noch TENANT_MAP)\" }, 400);\n const apiKey = Deno.env.get(\"AUFZUG_API_KEY_\"+firma.toUpperCase()) || Deno.env.get(\"AUFZUG_API_KEY\");\n if (!apiKey) return json({ error:\"Kein API-Key fuer Firma \"+firma+\" gesetzt\", expected_env:[\"AUFZUG_API_KEY_\"+firma.toUpperCase(),\"AUFZUG_API_KEY\"] }, 500);\n const baseUrl = Deno.env.get(\"AUFZUG_BASE_URL\") || \"https://verwaltung.api.aufzugshandwerk.de/v1\";\n const target = baseUrl + \"/\" + probePath;\n const t0 = Date.now();\n let upstreamStatus = null, upstreamBody = \"\", upstreamErr = null;\n try {\n const r = await fetch(target, { method:\"GET\", headers: { APIKEY:apiKey, TENANT:tenant, Accept:\"application/json\" } });\n upstreamStatus = r.status;\n upstreamBody = await r.text();\n } catch(e) { upstreamErr = e.message; }\n return json({\n target,\n tenant,\n tenant_source: b.tenant ? \"body\" : \"TENANT_MAP\",\n api_key_source: Deno.env.get(\"AUFZUG_API_KEY_\"+firma.toUpperCase()) ? \"AUFZUG_API_KEY_\"+firma.toUpperCase() : \"AUFZUG_API_KEY\",\n api_key_preview: apiKey.length>8 ? apiKey.slice(0,4)+\"...\"+apiKey.slice(-2) : \"(short)\",\n duration_ms: Date.now()-t0,\n status: upstreamStatus,\n err: upstreamErr,\n body_excerpt: upstreamBody ? upstreamBody.slice(0, 2000) : null\n });\n }\n\n if (path.startsWith(\"aufzug/\")) {\n const rest = path.replace(/^aufzug\\//,\"\");\n const i = rest.indexOf(\"/\");\n if (i < 0) return json({ error:\"Bad path. Erwartet: /aufzug//\" }, 400);\n const firma = rest.slice(0, i);\n const up = rest.slice(i+1);\n // Tenant: X-ERP-Tenant Header (Firmen-Verwaltung) > TENANT_MAP-Fallback\n const tenantHeader = (req.headers.get(\"x-erp-tenant\")||\"\").trim();\n const tenant = tenantHeader || TENANT_MAP[firma];\n if (!tenant) return json({ error:\"Kein Tenant fuer Firma \"+firma+\" – setze ihn in der Firmen-Verwaltung\", hint:\"erlaubte Slugs im Fallback: \"+Object.keys(TENANT_MAP).join(\", \") }, 400);\n // Per-Firma API-Key zuerst, dann globalen Fallback\n const firmaEnvKey = \"AUFZUG_API_KEY_\"+firma.toUpperCase();\n const apiKey = Deno.env.get(firmaEnvKey) || Deno.env.get(\"AUFZUG_API_KEY\");\n if (!apiKey) return json({ error:\"Kein API-Key fuer Firma \"+firma+\" hinterlegt\", expected_env:[firmaEnvKey,\"AUFZUG_API_KEY\"] }, 500);\n const baseUrl = Deno.env.get(\"AUFZUG_BASE_URL\") || \"https://verwaltung.api.aufzugshandwerk.de/v1\";\n const target = baseUrl + \"/\" + up + url.search;\n const t0 = Date.now();\n const init = { method:req.method, headers: { APIKEY:apiKey, TENANT:tenant, Accept:\"application/json\" } };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n const t = await req.text();\n if (t && t.length > 0) { init.body = t; init.headers[\"Content-Type\"] = \"application/json\"; }\n }\n let up2, text;\n try {\n up2 = await fetch(target, init);\n } catch(e) {\n return json({ error:\"Upstream-Verbindung fehlgeschlagen\", target, tenant, message:e.message }, 502);\n }\n const noBody = up2.status===101||up2.status===204||up2.status===205||up2.status===304;\n text = noBody ? null : await up2.text();\n // Bei Upstream-Fehler: strukturierte Fehlerantwort mit Diagnose\n if (up2.status >= 400) {\n return json({\n error: \"Upstream HTTP \"+up2.status,\n target,\n tenant,\n tenant_source: tenantHeader ? \"X-ERP-Tenant header\" : \"TENANT_MAP fallback\",\n method: req.method,\n api_key_source: Deno.env.get(firmaEnvKey) ? firmaEnvKey : \"AUFZUG_API_KEY\",\n duration_ms: Date.now()-t0,\n upstream_body_excerpt: text ? text.slice(0, 1500) : null,\n upstream_content_type: up2.headers.get(\"content-type\") || null\n }, up2.status);\n }\n return new Response(text, { status:up2.status, headers: {\n \"content-type\": up2.headers.get(\"content-type\") || \"application/json\",\n \"access-control-allow-origin\": \"*\",\n \"x-erp-target\": target,\n \"x-erp-tenant\": tenant,\n \"x-erp-duration-ms\": String(Date.now()-t0)\n }});\n }\n\n // ══════════ FRESHDESK PROXY ══════════\n // Routes: /freshdesk//api/v2/... → https://.freshdesk.com/\n // Auth via FRESHDESK_API_KEY_ (Basic Auth, key:X)\n if (path.startsWith(\"freshdesk/\")) {\n const rest = path.replace(/^freshdesk\\//, \"\");\n const i = rest.indexOf(\"/\");\n if (i < 0) return json({ error:\"Bad path. Erwartet: /freshdesk//\" }, 400);\n const firma = rest.slice(0, i);\n const fdPath = rest.slice(i+1);\n const domainEnv = \"FRESHDESK_DOMAIN_\"+firma.toUpperCase();\n const keyEnv = \"FRESHDESK_API_KEY_\"+firma.toUpperCase();\n const domain = Deno.env.get(domainEnv);\n const apiKey = Deno.env.get(keyEnv);\n if (!domain || !apiKey) return json({ error:\"Freshdesk-Config fehlt für Firma \"+firma, expected_env:[domainEnv, keyEnv] }, 500);\n const target = \"https://\" + domain + \".freshdesk.com/\" + fdPath + url.search;\n const t0 = Date.now();\n const basic = btoa(apiKey + \":X\");\n // Forward body as ArrayBuffer wenn vorhanden; Content-Type aus Request übernehmen (wichtig für multipart/form-data!)\n const upstreamHeaders = { \"Authorization\": \"Basic \" + basic };\n const originalCT = req.headers.get(\"content-type\");\n if (originalCT) upstreamHeaders[\"Content-Type\"] = originalCT;\n const fdInit = { method: req.method, headers: upstreamHeaders };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n fdInit.body = await req.arrayBuffer();\n }\n let r;\n try { r = await fetch(target, fdInit); }\n catch(e) { return json({ error:\"Freshdesk-Verbindung fehlgeschlagen\", target, message:e.message }, 502); }\n const noBody = r.status===101||r.status===204||r.status===205||r.status===304;\n const respText = noBody ? null : await r.text();\n if (r.status >= 400) {\n return json({\n error: \"Freshdesk HTTP \"+r.status,\n target,\n firma,\n method: req.method,\n duration_ms: Date.now()-t0,\n upstream_body_excerpt: respText ? respText.slice(0, 1500) : null,\n }, r.status);\n }\n return new Response(respText, { status: r.status, headers: {\n \"content-type\": r.headers.get(\"content-type\") || \"application/json\",\n \"access-control-allow-origin\": \"*\",\n \"x-fd-duration-ms\": String(Date.now()-t0)\n }});\n }\n\n // ══════════ MAILCHIMP PROXY ══════════\n // Routes:\n // POST /mailchimp//ping → Verbindungstest (zeigt Audience-Name)\n // POST /mailchimp//lists → alle Audiences zurückgeben (für Dropdown-Picker)\n // Body optional: { apiKey } → override für ungespeicherten Key\n // POST /mailchimp//upsert → 1 Kontakt anlegen/aktualisieren (idempotent via md5(email))\n // POST /mailchimp//bulk → mehrere Kontakte (Body: { members:[...] })\n // Config-Quelle (Reihenfolge):\n // 1) Airtable Firmen.mailchimp_api_key + .mailchimp_audience_id (über Firmen-Verwaltung in der App)\n // 2) Fallback Env-Vars MAILCHIMP_API_KEY_ / MAILCHIMP_AUDIENCE_\n if (path.startsWith(\"mailchimp/\")) {\n const rest = path.replace(/^mailchimp\\//, \"\");\n const i = rest.indexOf(\"/\");\n if (i < 0) return json({ error:\"Bad path. Erwartet: /mailchimp//\" }, 400);\n const firma = rest.slice(0, i);\n const action = rest.slice(i+1).replace(/\\/+$/,\"\");\n\n // SPECIAL CASE: \"lists\" braucht nur einen API-Key (Audience-ID egal)\n // und akzeptiert optional einen override im Body — für den Picker bevor User gespeichert hat\n if (action === \"lists\") {\n let overrideKey = null;\n if (req.method === \"POST\") {\n try { const b = await req.json(); if (b && b.apiKey) overrideKey = String(b.apiKey).trim(); } catch(_){}\n }\n let useKey = overrideKey;\n if (!useKey) {\n const cfgL = await lookupMailchimpConfig(firma);\n useKey = cfgL.apiKey;\n }\n if (!useKey) return json({\n error:\"Kein Mailchimp-API-Key für Firma \"+firma+\" verfügbar\",\n hint:\"Trage den API-Key in Admin → Firmen-Verwaltung ein (oder schicke ihn im Body als { apiKey: '...' }).\"\n }, 400);\n const dashL = useKey.lastIndexOf(\"-\");\n const serverL = dashL > 0 ? useKey.slice(dashL+1) : \"\";\n if (!serverL) return json({ error:\"Mailchimp API-Key hat keinen Server-Suffix (z.B. -us12). Format prüfen.\" }, 400);\n const baseL = \"https://\"+serverL+\".api.mailchimp.com/3.0\";\n const basicL = btoa(\"anystring:\"+useKey);\n const r = await fetch(baseL+\"/lists?count=100&fields=lists.id,lists.name,lists.stats.member_count,total_items\", {\n headers: { \"Authorization\":\"Basic \"+basicL, \"Accept\":\"application/json\" }\n });\n const txt = await r.text();\n if (!r.ok) {\n let detail = txt; try { const j = JSON.parse(txt); detail = j.detail || j.title || txt; } catch(_){}\n return json({ ok:false, status:r.status, error:\"Mailchimp /lists HTTP \"+r.status, detail:String(detail).slice(0,500) }, r.status);\n }\n let d; try { d = JSON.parse(txt); } catch(_) { d = {}; }\n const lists = (d.lists||[]).map(l => ({\n id: l.id,\n name: l.name,\n member_count: (l.stats && l.stats.member_count) || 0\n }));\n return json({ ok:true, lists, total: d.total_items || lists.length });\n }\n\n const cfg = await lookupMailchimpConfig(firma);\n const apiKey = cfg.apiKey, audId = cfg.audId;\n if (!apiKey || !audId) return json({\n error:\"Mailchimp-Config fehlt für Firma \"+firma,\n hint:\"Trage API-Key und Audience-ID in Admin → Firmen-Verwaltung ein (oder als Env-Vars MAILCHIMP_API_KEY_\"+firma.toUpperCase()+\" / MAILCHIMP_AUDIENCE_\"+firma.toUpperCase()+\").\"\n }, 500);\n // Server-Prefix aus dem Key extrahieren: \"-us12\" → \"us12\"\n const dash = apiKey.lastIndexOf(\"-\");\n const server = dash > 0 ? apiKey.slice(dash+1) : \"\";\n if (!server) return json({ error:\"Mailchimp API-Key hat keinen Server-Suffix (z.B. -us12). Prüfe ob der Key korrekt aus Mailchimp kopiert wurde.\" }, 500);\n const mcBase = \"https://\"+server+\".api.mailchimp.com/3.0\";\n const basic = btoa(\"anystring:\"+apiKey);\n const mcHeaders = { \"Authorization\":\"Basic \"+basic, \"Content-Type\":\"application/json\", \"Accept\":\"application/json\" };\n\n // Helper: md5 → Mailchimp subscriber_hash erwartet md5(lowercase(email))\n async function md5Hex(input) {\n // Deno hat kein native md5 in Web Crypto. Wir nutzen eine kleine JS-Implementierung.\n function md5(s) {\n function r(n,b){return n<>>32-b}\n function a(a,b,c,d,e,f,g){b=b+(a&c|~a&d)+(e>>>0)+g;return r(b,f)+a}\n function k(a,b,c,d,e,f,g){b=b+(a&d|c&~d)+(e>>>0)+g;return r(b,f)+a}\n function l(a,b,c,d,e,f,g){b=b+(a^c^d)+(e>>>0)+g;return r(b,f)+a}\n function m(a,b,c,d,e,f,g){b=b+(c^(a|~d))+(e>>>0)+g;return r(b,f)+a}\n // String → byte array\n const bytes=[]; for(let i=0;i>6);bytes.push(128|c&63);} else {bytes.push(224|c>>12);bytes.push(128|c>>6&63);bytes.push(128|c&63);}}\n const len = bytes.length;\n bytes.push(0x80);\n while(bytes.length%64 !== 56) bytes.push(0);\n const bitLen = len*8;\n bytes.push(bitLen&0xff,(bitLen>>>8)&0xff,(bitLen>>>16)&0xff,(bitLen>>>24)&0xff,0,0,0,0);\n let aH=1732584193,bH=-271733879,cH=-1732584194,dH=271733878;\n for(let i=0;i>>(i*8))&0xff).toString(16).padStart(2,\"0\"); return s; }\n return h(aH)+h(bH)+h(cH)+h(dH);\n }\n return md5(input);\n }\n\n async function mcUpsert(member) {\n const email = String(member.email_address||\"\").trim().toLowerCase();\n if (!email) return { ok:false, error:\"Email fehlt\" };\n const hash = await md5Hex(email);\n const mergeFields = {};\n if (member.merge_fields) Object.assign(mergeFields, member.merge_fields);\n const body = {\n email_address: email,\n status_if_new: \"subscribed\",\n merge_fields: mergeFields\n };\n const target = mcBase+\"/lists/\"+audId+\"/members/\"+hash;\n const r = await fetch(target, { method:\"PUT\", headers: mcHeaders, body: JSON.stringify(body) });\n const txt = await r.text();\n if (!r.ok) {\n let detail = txt; try { const j = JSON.parse(txt); detail = j.detail || j.title || txt; } catch(_){}\n return { ok:false, email, status:r.status, error: detail };\n }\n let memberData = null; try { memberData = JSON.parse(txt); } catch(_){}\n // Tags zusätzlich pushen (separater Endpoint)\n const tags = Array.isArray(member.tags) ? member.tags.filter(t => t && String(t).trim()) : [];\n if (tags.length) {\n const tagBody = { tags: tags.map(t => ({ name: String(t).trim(), status: \"active\" })) };\n const tr = await fetch(mcBase+\"/lists/\"+audId+\"/members/\"+hash+\"/tags\", {\n method:\"POST\", headers: mcHeaders, body: JSON.stringify(tagBody)\n });\n if (!tr.ok) {\n const tt = await tr.text();\n return { ok:true, email, hash, warn:\"Member ok, Tags HTTP \"+tr.status+\": \"+tt.slice(0,200), member: memberData };\n }\n }\n return { ok:true, email, hash, member: memberData };\n }\n\n if (action === \"ping\") {\n const r = await fetch(mcBase+\"/lists/\"+audId, { headers: mcHeaders });\n const txt = await r.text();\n if (!r.ok) return json({ ok:false, status:r.status, body: txt.slice(0,500) }, r.status);\n let d = null; try { d = JSON.parse(txt); } catch(_){}\n return json({ ok:true, audience: d ? { id:d.id, name:d.name, member_count:d.stats && d.stats.member_count } : null });\n }\n if (action === \"upsert\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const result = await mcUpsert(b);\n return json(result, result.ok ? 200 : (result.status||500));\n }\n if (action === \"bulk\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const members = Array.isArray(b.members) ? b.members : [];\n const results = [];\n let ok=0, fail=0, skip=0;\n for (const m of members) {\n if (!m || !m.email_address) { skip++; results.push({ ok:false, error:\"keine Email\", input:m && m.tags }); continue; }\n const r = await mcUpsert(m);\n if (r.ok) ok++; else fail++;\n results.push(r);\n }\n return json({ ok:true, total: members.length, success: ok, failed: fail, skipped: skip, results });\n }\n return json({ error:\"Unbekannte Mailchimp-Action: \"+action, available:[\"ping\",\"upsert\",\"bulk\"] }, 404);\n }\n\n // ══════════ LIFTARO PARTNER API PROXY ══════════\n // Liftaro = neutrale Vergleichsplattform für Wartungsverträge.\n // Wir agieren als Subunternehmer-Partner und beantworten Anfragen.\n // Routes (X-Partner-Key wird serverseitig aus LIFTARO_PARTNER_KEY env-var gesetzt):\n // GET /liftaro/me → Self-Identify\n // GET /liftaro/checks?status=… → Liste Anfragen\n // GET /liftaro/checks/ → Detail\n // POST /liftaro/checks//offer → Angebot abgeben\n // POST /liftaro/checks//decline → Ablehnen\n // POST /liftaro/webhook-test → Test-Webhook auslösen\n if (path === \"liftaro\" || path.startsWith(\"liftaro/\")) {\n const liftaroKey = Deno.env.get(\"LIFTARO_PARTNER_KEY\");\n if (!liftaroKey) return json({\n error:\"LIFTARO_PARTNER_KEY env-var nicht gesetzt\",\n hint:\"Trage den Liftaro-Partner-Key in val.town Settings → Environment Variables ein.\"\n }, 500);\n const LIFTARO_BASE = \"https://giltglobalinvest--4c42aaf257b611f19fa0ee650bb23af1.web.val.run/api/v2\";\n const sub = path.replace(/^liftaro\\/?/, \"\"); // z.B. \"me\", \"checks\", \"checks/PA-2026-0001/offer\"\n if (!sub) return json({ error:\"Bad path. Erwartet: /liftaro/\" }, 400);\n const target = LIFTARO_BASE + \"/\" + sub + url.search;\n const init = {\n method: req.method,\n headers: {\n \"X-Partner-Key\": liftaroKey,\n \"Accept\": \"application/json\",\n }\n };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n const ct = req.headers.get(\"content-type\") || \"application/json\";\n init.headers[\"Content-Type\"] = ct;\n try { init.body = await req.text(); } catch(_){}\n }\n const t0 = Date.now();\n let up, body;\n try {\n up = await fetch(target, init);\n body = await up.text();\n } catch(e) {\n return json({ error:\"Liftaro-Verbindung fehlgeschlagen\", target, message:e.message }, 502);\n }\n if (up.status >= 400) {\n let detail = body;\n try { const j = JSON.parse(body); detail = j.detail || j.error || j.message || body; } catch(_){}\n return json({\n error:\"Liftaro HTTP \"+up.status,\n target,\n status: up.status,\n detail: String(detail).slice(0, 1500),\n duration_ms: Date.now()-t0,\n }, up.status);\n }\n return new Response(body, {\n status: up.status,\n headers: {\n \"content-type\": up.headers.get(\"content-type\") || \"application/json\",\n \"access-control-allow-origin\": \"*\",\n \"x-liftaro-target\": target,\n \"x-liftaro-duration-ms\": String(Date.now()-t0),\n }\n });\n }\n\n // ══════════ BACKGROUND-SYNC ENDPOINTS ══════════\n\n if (path === \"sync/run\" && req.method === \"POST\") {\n let b = {}; try { b = await req.json(); } catch(_){}\n const firma = (b.firma||\"\").toString();\n if (!firma) return json({ error:\"firma fehlt\" }, 400);\n try {\n const result = await runSyncForFirma(firma, user.api_key || \"system\");\n return json(result);\n } catch(e) {\n const errResult = { firma, error: e.message, finished: new Date().toISOString() };\n try { await blob.setJSON(\"sync_status_\"+firma, errResult); } catch(_){}\n return json({ error: e.message, firma }, 500);\n }\n }\n\n if (path === \"sync/status\" && req.method === \"GET\") {\n let items = [];\n try { items = await blob.list(\"sync_status_\") || []; } catch(_){}\n const statuses = {};\n for (const item of items) {\n const key = (item && item.key) ? item.key : item;\n try {\n const data = await blob.getJSON(key);\n const firma = String(key).replace(\"sync_status_\",\"\");\n statuses[firma] = data;\n } catch(_){}\n }\n return json({ statuses });\n }\n\n // Sync für ALLE aktiven Firmen (für Cron-Jobs)\n if (path === \"sync/run-all\" && req.method === \"POST\") {\n try {\n const firmen = await atReadAll(\"Firmen\");\n const results = [];\n for (const f of firmen) {\n const slug = f.fields && f.fields.slug;\n const tenant = f.fields && f.fields.erp_tenant;\n const aktiv = (f.fields && f.fields.aktiv) !== false;\n if (!slug || !tenant || !aktiv) continue;\n try {\n const r = await runSyncForFirma(slug, user.api_key || \"cron\");\n results.push({ firma:slug, ok:true, created:r.created, updated:r.updated, skipped:r.skipped, errors:r.errors });\n } catch(e) {\n results.push({ firma:slug, ok:false, error: e.message });\n try { await blob.setJSON(\"sync_status_\"+slug, { firma:slug, error:e.message, finished:new Date().toISOString(), triggered_by:user.api_key||\"cron\" }); } catch(_){}\n }\n }\n const summary = { ran: results.length, started: new Date().toISOString(), results };\n try { await blob.setJSON(\"cron_last_run\", summary); } catch(_){}\n return json(summary);\n } catch(e) {\n return json({ error: e.message }, 500);\n }\n }\n\n return json({ error:\"Not found\", path }, 404);\n}\n\n// ══════════ SYNC HELPERS (server-side TS) ══════════\n\nconst ACTIVE_STATUSES = [\"Auftrag bestätigt\", \"In Bearbeitung\", \"Abgeschlossen\"];\n\nfunction normStatus(s) {\n const t = String(s||\"\").toLowerCase().trim();\n if (!t) return \"offen\";\n if (/abgerechnet/.test(t)) return \"abgerechnet\";\n if (/abgeschlossen/.test(t)) return \"abgeschlossen\";\n // Merged: 'In Bearbeitung' + 'Auftrag bestätigt' + legacy → 'offen'\n if (/bearbeit|best.tigt|^offen$|^in_bearbeitung$/.test(t)) return \"offen\";\n return t;\n}\n\nfunction buildKontakt(k) {\n const name = [k.vorname, k.nachname].filter(Boolean).join(\" \").trim();\n const phone = k.telefon || k.mobile || \"\";\n const parts = [];\n if (name) parts.push(name);\n if (phone) parts.push(\"Tel: \"+phone);\n if (k.rolle) parts.push(\"Rolle: \"+k.rolle);\n return parts.join(\"\\n\");\n}\n\nasync function atReadAll(table, params) {\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const readKey = Deno.env.get(\"AIRTABLE_READ_KEY\");\n if (!baseId || !readKey) throw new Error(\"AIRTABLE_BASE_ID/AIRTABLE_READ_KEY env-var fehlt\");\n let records = [];\n let offset = null;\n let safety = 0;\n do {\n let url = \"https://api.airtable.com/v0/\"+baseId+\"/\"+encodeURIComponent(table)+\"?pageSize=100\";\n if (params) url += \"&\"+params;\n if (offset) url += \"&offset=\"+encodeURIComponent(offset);\n const r = await fetch(url, { headers: { Authorization: \"Bearer \"+readKey } });\n if (!r.ok) throw new Error(\"Airtable \"+table+\" GET \"+r.status);\n const d = await r.json();\n records = records.concat(d.records || []);\n offset = d.offset || null;\n if (++safety > 50) break;\n } while (offset);\n return records;\n}\n\nasync function atPatch(table, recId, fields) {\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const writeKey = Deno.env.get(\"AIRTABLE_WRITE_KEY\");\n if (!baseId || !writeKey) throw new Error(\"AIRTABLE_WRITE_KEY env-var fehlt (Setup neu durchlaufen)\");\n const url = \"https://api.airtable.com/v0/\"+baseId+\"/\"+encodeURIComponent(table)+\"/\"+recId;\n const r = await fetch(url, {\n method: \"PATCH\",\n headers: { Authorization: \"Bearer \"+writeKey, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields })\n });\n const d = await r.json();\n if (!r.ok) throw new Error(\"Airtable PATCH \"+r.status+\": \"+(d && d.error && d.error.message || \"\"));\n return d;\n}\n\nasync function atCreate(table, fields) {\n const baseId = Deno.env.get(\"AIRTABLE_BASE_ID\");\n const writeKey = Deno.env.get(\"AIRTABLE_WRITE_KEY\");\n if (!baseId || !writeKey) throw new Error(\"AIRTABLE_WRITE_KEY env-var fehlt (Setup neu durchlaufen)\");\n const url = \"https://api.airtable.com/v0/\"+baseId+\"/\"+encodeURIComponent(table);\n const r = await fetch(url, {\n method: \"POST\",\n headers: { Authorization: \"Bearer \"+writeKey, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields })\n });\n const d = await r.json();\n if (!r.ok) throw new Error(\"Airtable POST \"+r.status+\": \"+(d && d.error && d.error.message || \"\"));\n return d;\n}\n\nasync function lookupTenant(firma) {\n try {\n const recs = await atReadAll(\"Firmen\", \"filterByFormula=\"+encodeURIComponent(\"{slug}='\"+firma+\"'\")+\"&maxRecords=1\");\n const t = recs[0] && recs[0].fields && recs[0].fields.erp_tenant;\n if (t) return String(t).trim();\n } catch(_){}\n const LEGACY = { aufzug: \"1\", aszendio: \"4\" };\n return LEGACY[firma] || null;\n}\n\n// Mailchimp-Config pro Firma. Reihenfolge: Airtable-Felder (Firmen.mailchimp_api_key\n// + .mailchimp_audience_id) → Env-Vars MAILCHIMP_API_KEY_ / MAILCHIMP_AUDIENCE_\n// → null. So kann der Admin alles in der App pflegen, ohne in val.town zu müssen.\nasync function lookupMailchimpConfig(firma) {\n let apiKey = null, audId = null;\n try {\n const recs = await atReadAll(\"Firmen\", \"filterByFormula=\"+encodeURIComponent(\"{slug}='\"+firma+\"'\")+\"&maxRecords=1\");\n const f = recs[0] && recs[0].fields;\n if (f) {\n const k = f.mailchimp_api_key, a = f.mailchimp_audience_id;\n if (k && String(k).trim()) apiKey = String(k).trim();\n if (a && String(a).trim()) audId = String(a).trim();\n }\n } catch(_){}\n if (!apiKey) apiKey = Deno.env.get(\"MAILCHIMP_API_KEY_\"+firma.toUpperCase()) || null;\n if (!audId) audId = Deno.env.get(\"MAILCHIMP_AUDIENCE_\"+firma.toUpperCase()) || null;\n return { apiKey, audId };\n}\n\nasync function erpGet(firma, tenant, apiKey, p) {\n const baseUrl = Deno.env.get(\"AUFZUG_BASE_URL\") || \"https://verwaltung.api.aufzugshandwerk.de/v1\";\n const url = baseUrl+\"/\"+p;\n const r = await fetch(url, { headers: { APIKEY: apiKey, TENANT: tenant, Accept: \"application/json\" } });\n if (!r.ok) {\n const txt = await r.text().catch(()=>\"\");\n throw new Error(\"ERP \"+p+\" HTTP \"+r.status+(txt?\" – \"+txt.slice(0,150):\"\"));\n }\n return r.json();\n}\n\nasync function runSyncForFirma(firma, userKey) {\n const t0 = Date.now();\n try { await blob.setJSON(\"sync_status_\"+firma, { firma, running: true, started: new Date(t0).toISOString(), triggered_by: userKey }); } catch(_){}\n\n const tenant = await lookupTenant(firma);\n if (!tenant) throw new Error(\"Kein ERP-Tenant fuer Firma '\"+firma+\"' (Firmen-Verwaltung).\");\n const apiKey = Deno.env.get(\"AUFZUG_API_KEY_\"+firma.toUpperCase()) || Deno.env.get(\"AUFZUG_API_KEY\");\n if (!apiKey) throw new Error(\"Kein API-Key fuer Firma '\"+firma+\"'.\");\n\n const existing = await atReadAll(\"Auftraege\");\n const byExt = new Map();\n for (const r of existing) {\n if (r.fields && r.fields.ext_id && (r.fields.firma||\"\") === firma) {\n byExt.set(String(r.fields.ext_id), r);\n }\n }\n\n let all;\n try { all = await erpGet(firma, tenant, apiKey, \"api/auftraege\"); }\n catch(_) { all = await erpGet(firma, tenant, apiKey, \"auftraege\"); }\n if (!Array.isArray(all)) all = (all && (all.content || all.items || all.data)) || [];\n const active = all.filter(a => ACTIVE_STATUSES.indexOf(a.status) >= 0);\n\n const toProcess = [];\n let skipped = 0;\n for (const a of active) {\n const ex = byExt.get(String(a.id));\n if (ex && a.lastmodifiedDate && ex.fields.ext_last_modified === a.lastmodifiedDate) {\n // ÜBERSPRINGEN — außer 'auftragswert_netto' fehlt noch (Migration nach v3.09)\n const needsValueBackfill = a.bestellform === \"MITANGEBOT\" && a.angebotid && (ex.fields.auftragswert_netto == null);\n if (!needsValueBackfill) {\n skipped++;\n continue;\n }\n }\n toProcess.push(a);\n }\n\n const angebotCache = new Map();\n const needsAngebot = [];\n for (const a of toProcess) {\n if (a.bestellform === \"MITANGEBOT\" && a.angebotid) {\n const ex = byExt.get(String(a.id));\n if (ex\n && String(ex.fields.angebot_id||\"\") === String(a.angebotid)\n && ex.fields.leistungsumfang\n && ex.fields.auftragswert_netto != null) {\n angebotCache.set(String(a.angebotid), {\n serviceDescription: ex.fields.leistungsumfang,\n offerExplanation: ex.fields.erlaeuterungen,\n typ: ex.fields.angebot_typ,\n netPrice: ex.fields.auftragswert_netto\n });\n } else {\n needsAngebot.push(a);\n }\n }\n }\n if (needsAngebot.length > 0) {\n let idx = 0;\n const worker = async () => {\n while (idx < needsAngebot.length) {\n const a = needsAngebot[idx++];\n try {\n const ang = await erpGet(firma, tenant, apiKey, \"api/angebote/\"+a.angebotid);\n angebotCache.set(String(a.angebotid), ang);\n } catch(_) {}\n }\n };\n await Promise.all(Array.from({ length: Math.min(5, needsAngebot.length) }, () => worker()));\n }\n\n let created = 0, updated = 0, unchanged = 0, withAngebot = 0, errors = 0;\n const USER_MANAGED = [\"techniker_keys\",\"techniker_namen\",\"priority\",\"tmpl\",\"notizen\",\"bilder\",\"subunternehmer_preis\",\"bericht_id\",\"bericht_num\",\"completed_at\",\"created\",\"created_by\"];\n\n for (const a of toProcess) {\n try {\n let ang = null;\n if (a.bestellform === \"MITANGEBOT\" && a.angebotid) {\n ang = angebotCache.get(String(a.angebotid)) || null;\n if (ang) withAngebot++;\n }\n const anlage = a.anlage || {};\n const ansp = anlage.ansprechpartner || {};\n const empf = a.empfaenger || {};\n const hasAnsp = !!(ansp.vorname || ansp.nachname || ansp.telefon || ansp.mobile);\n const kontaktText = hasAnsp ? buildKontakt(ansp) : buildKontakt(empf);\n const haystack = [a.bestellform, a.leistungsbeschreibung, a.notizen, ang && ang.typ, ang && ang.serviceDescription, ang && ang.title, anlage.objektTyp].filter(Boolean).join(\" \").toLowerCase();\n const isWartung = /wartung/.test(haystack);\n const tmplKey = firma + (isWartung ? \"-wartung\" : \"-arbeit\");\n const leistungsumfang = ((ang && ang.serviceDescription) || a.leistungsbeschreibung || a.notizen || \"\").toString().trim();\n\n const fields = {\n firma,\n auftrag_num: a.vorgangsnummer || a.id,\n ext_id: a.id,\n ext_source: \"aufzugshandwerk_v1\",\n ext_vorgangsnummer: a.vorgangsnummer || null,\n ext_last_modified: a.lastmodifiedDate || \"\",\n standort: anlage.anzeigeAdresse || anlage.name || \"\",\n fabriknummer: anlage.fabriknummer || \"\",\n kontakt: kontaktText,\n // Leistungsbeschreibung bevorzugt aus Angebot (leistungsumfang), sonst aus Auftrag/Notizen\n leistungsbeschreibung: leistungsumfang || a.leistungsbeschreibung || a.notizen || \"\",\n status: normStatus(a.status),\n priority: \"normal\",\n due_date: (a.ausfuehrungstermin || \"\").slice(0, 10) || \"\",\n created: a.createdDate || new Date().toISOString(),\n created_by: userKey,\n tmpl: tmplKey,\n stundensatz: anlage.stundensatz || null,\n einsatzpauschale: anlage.einsatzPauschale || null,\n objekttyp: anlage.objektTyp || \"\",\n kunde_firmenname: (anlage.kunde && anlage.kunde.firmenname) || \"\",\n leistungsumfang: leistungsumfang,\n erlaeuterungen: (ang && ang.offerExplanation) || \"\",\n angebot_typ: (ang && ang.typ) || \"\",\n angebot_id: a.angebotid || null,\n bestellform: a.bestellform || \"\",\n auftragswert_netto: ang ? ((ang.netPrice != null ? +ang.netPrice : null) ?? (ang.gesamtpreis != null ? +ang.gesamtpreis : null) ?? (ang.annualPrice != null ? +ang.annualPrice : null)) : null\n };\n\n const ex = byExt.get(String(a.id));\n if (ex) {\n const patch = Object.assign({}, fields);\n for (const k of USER_MANAGED) {\n const v = ex.fields[k];\n const hasVal = v !== undefined && v !== null && v !== \"\" && !(Array.isArray(v) && v.length === 0);\n if (hasVal) delete patch[k];\n }\n if (ex.fields.status === \"abgerechnet\") delete patch.status;\n const protectIfEmpty = [\"kontakt\",\"leistungsumfang\",\"erlaeuterungen\",\"standort\",\"fabriknummer\",\"due_date\"];\n for (const k of protectIfEmpty) {\n if ((patch[k] === \"\" || patch[k] == null) && ex.fields[k]) delete patch[k];\n }\n const changed = {};\n for (const k of Object.keys(patch)) {\n const cur = ex.fields[k];\n const curN = (cur === null || cur === undefined) ? \"\" : cur;\n const newN = (patch[k] === null || patch[k] === undefined) ? \"\" : patch[k];\n if (String(curN) !== String(newN)) changed[k] = patch[k];\n }\n if (a.lastmodifiedDate && ex.fields.ext_last_modified !== a.lastmodifiedDate) {\n changed.ext_last_modified = a.lastmodifiedDate;\n }\n if (Object.keys(changed).length === 0) { unchanged++; continue; }\n await atPatch(\"Auftraege\", ex.id, changed);\n updated++;\n } else {\n await atCreate(\"Auftraege\", fields);\n created++;\n }\n } catch(e) { errors++; }\n }\n\n const result = {\n firma, running: false,\n started: new Date(t0).toISOString(),\n finished: new Date().toISOString(),\n duration_ms: Date.now() - t0,\n total: active.length,\n toProcess: toProcess.length,\n skipped, created, updated, unchanged, withAngebot, errors,\n triggered_by: userKey\n };\n try { await blob.setJSON(\"sync_status_\"+firma, result); } catch(_){}\n return result;\n}\n","createdAt",["D",1779706662078],"branchVersion","branchId","04643974-5119-11f1-9d4f-ee650bb23af1","id","04635f22-5119-11f1-9d4f-ee650bb23af1","elevatorServiceboxProxy",["D",1778930331484],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Elevator Servicebox ERP-Proxy","imageUrl","b8672cc5-9c71-42c6-931f-a0aabca33bdd","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e049b-6e23-74ee-9bdd-0c49067080a6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_103":99},"org",{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned",27,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","giltglobalinvest","handle","displayName","Patrizio Fontanarosa","avatar","https://lh3.googleusercontent.com/a/ACg8ocL48GSPatvcxwg0cqcSWpW_ddx-HBZAMenADEoTYtVSkvBX8g=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":164,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":165,"_79":166,"_81":167,"_83":25},"tree",[155,156],"files",[155,156],"counts",{"_144":61,"_145":146,"_147":61,"_148":149,"_150":151},"contents",[127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":136,"_32":137,"_30":138,"_130":-5,"_41":42,"_40":139,"_131":122,"_38":140,"_13":61,"_33":141,"_35":142,"_24":25,"_134":-5,"_27":143},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":132,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_27":135},"8d817670-5828-11f1-867f-ee650bb23af1","parentId","latest",["D",1779706662078],15,"label",[28],"f0d7cba2-5242-11f1-99cd-ee650bb23af1","cron-sync.tsx","f0d7cc60-5242-11f1-99cd-ee650bb23af1",11,["D",1779058288711],"interval","// Auto-generated by Elevator Servicebox · Cron-Sync\n// Ruft regelmäßig /sync/run-all am Proxy auf.\nconst PROXY_URL = \"https://giltglobalinvest--04a4aefa511911f19d4fee650bb23af1.web.val.run\";\nconst SYNC_SECRET = \"d24a6215974f73bbfbea0347d4723a1a9f99b0bad18cbec9\";\n\nexport default async function cron() {\n const t0 = Date.now();\n try {\n const res = await fetch(PROXY_URL + \"/sync/run-all\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-Sync-Secret\": SYNC_SECRET,\n },\n });\n const text = await res.text();\n let data; try { data = JSON.parse(text); } catch (_) { data = { _raw: text }; }\n const dur = Date.now() - t0;\n console.log(\"[Cron-Sync]\", res.status, \"in\", dur+\"ms\", JSON.stringify(data).slice(0, 600));\n if (!res.ok) throw new Error(\"HTTP \" + res.status + \": \" + (data && data.error || text.slice(0,150)));\n } catch (e) {\n console.error(\"[Cron-Sync] Fehler:\", e.message);\n throw e;\n }\n}\n",[137],"pulls","branches",1,"forks","envVars",{"_152":14,"_154":61},"connections",{"_152":61,"_153":61},"count","unfilledCount","emptyCount",{"_43":136,"_32":137,"_30":138,"_130":-5,"_41":42,"_40":139,"_131":122,"_38":161,"_13":61,"_33":141,"_35":142,"_24":25,"_134":-5,"_158":162,"_27":163},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":157,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_158":159,"_27":160},["D",1779706662078],"children",[],[28],["D",1779058288711],[],[137],["D",1778930331484],{"_95":94,"_103":99},{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_77":-5,"_124":201,"_202":203,"_204":205,"_206":25,"_207":25,"_208":25,"_209":122,"_210":-5,"_211":-7,"_212":-7,"_213":61,"_214":25,"_215":25,"_216":-5,"_217":25,"_218":25,"_219":25,"_220":-5},"ENV",{"_172":173,"_174":175,"_176":85,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v19