[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_94":93,"_32":45,"_103":84,"_27":104,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":25,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":77,"_78":79,"_80":81,"_82":25},"version",4,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":20,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","valtown-partner-api.ts","latestPath","fileId","4c42aaf2-57b6-11f1-9fa0-ee650bb23af1","name","fileType","http","content","// ════════════════════════════════════════════════════════════════════════\n// Liftaro Partner-API Val (val.town HTTP-Val)\n// ────────────────────────────────────────────────────────────────────────\n// Backend für die Liftaro-Partner-Plattform (V12.13+, Phase 1).\n//\n// Zwei Kanäle:\n// 1) Landing-Page (Token-basiert, primärer Kanal)\n// Liftaro sendet Anfrage per Email mit One-Time-Link\n// Partner ruft Landing-Page auf, lädt PDF + Eckdaten hoch, submittet\n// → POST .../submit landet als Response in Partner-Anfragen\n// 2) API (X-Partner-Key, Phase 8 später)\n// Partner-Software pollt offene Anfragen, submittet via REST\n//\n// Endpoints (alle JSON außer wo anders angegeben):\n//\n// POST /api/partner-anfragen\n// Header: X-App-Secret: \n// Body: {\n// check_id, partner_id, partner_name, partner_email,\n// deadline_days?, // default 5\n// include_vorliegendes_pdf?, // default false\n// vorliegendes_pdf_url?, // signierter Airtable-Link\n// check_snapshot: {\n// objekt_plz, objekt_ort, objekt_strasse?,\n// anzahl_aufzuege, anlagenart, leistungsumfang_text\n// }\n// }\n// Response: { ok, anfrage_id, token, landing_url }\n// Effekt: Legt Partner-Anfragen-Record an, sendet Email an partner_email\n//\n// GET /api/partner-anfragen/:token\n// Public (Token = Auth).\n// Response: { ok, anfrage: { ...anonymisiert... }, vorliegendes_pdf_url? }\n// Effekt: Setzt opened_at beim ersten Aufruf (status: gesendet → geoeffnet)\n//\n// POST /api/partner-anfragen/:token/submit\n// Public (Token = Auth).\n// Body: {\n// response_offer_id?,\n// response_preis_netto, response_laufzeit_jahre,\n// response_kuendigungsfrist_monate, response_wartungen_pro_jahr,\n// response_vollwartung, response_notruf,\n// response_tuev_begl, response_tuev_pruef, response_entstoerung,\n// response_kommentar?,\n// pdf_base64?, pdf_filename? // alternativ multipart\n// }\n// Response: { ok, status: 'angeboten' }\n// Effekt: Schreibt Antwort in Partner-Anfragen, status='angeboten'.\n// Token wird invalidiert (nicht gelöscht, aber Resubmit blockt).\n//\n// GET /api/partner-anfragen/:token/status\n// Public (Token = Auth) — Polling für Partner-UI.\n// Response: { ok, status, deadline_at, responded_at? }\n//\n// POST /api/partner-anfragen/:token/decline\n// Public (Token = Auth).\n// Body: { reason? }\n// Response: { ok, status: 'abgelehnt' }\n//\n// GET /api/checks/:check_id/anfragen\n// Header: X-App-Secret\n// Response: { ok, anfragen: [...] }\n// Effekt: Liftaro-App lädt alle Anfragen zu einem Check (für die Karten-Anzeige)\n//\n// Env-Variablen (val.town Settings → Environment Variables):\n// AIRTABLE_BASE_ID — Airtable App-Base-ID (z.B. \"appXXXX\") [auto-bootstrap]\n// AIRTABLE_KEY — Airtable Personal Access Token [auto-bootstrap]\n// APP_SECRET — Shared secret zwischen Liftaro-Frontend und diesem Val\n// SMTP_VAL_URL — URL des liftaroEmailSender-Vals\n// SMTP_VAL_SECRET — APP_SECRET des SMTP-Vals\n// LANDING_BASE — Basis-URL der Landing-Page,\n// z.B. \"https://check.liftaro.de/partner/anfrage.html\"\n// ALLOWED_ORIGIN — CORS-Origin (z.B. \"https://check.liftaro.de\" oder \"*\")\n// PARTNER_API_VERSION — optional Version-String fürs Health-Log\n//\n// HINWEIS: Tabellen-Schema (Partner-Anfragen) wird von der Liftaro-App\n// via Meta-API erstellt (setupTables in index.html). Dieser Val\n// schreibt nur in die bestehende Tabelle.\n// ════════════════════════════════════════════════════════════════════════\n\nconst ALLOWED_ORIGIN = Deno.env.get(\"ALLOWED_ORIGIN\") || \"*\";\nconst AT_BASE_APP = Deno.env.get(\"AIRTABLE_BASE_ID\") || \"\";\nconst AT_API_KEY = Deno.env.get(\"AIRTABLE_KEY\") || \"\";\nconst APP_SECRET = Deno.env.get(\"APP_SECRET\") || \"\";\nconst SMTP_VAL_URL = Deno.env.get(\"SMTP_VAL_URL\") || \"\";\nconst SMTP_VAL_SECRET = Deno.env.get(\"SMTP_VAL_SECRET\") || \"\";\nconst LANDING_BASE = Deno.env.get(\"LANDING_BASE\") || \"https://check.liftaro.de/partner/anfrage.html\";\nconst PARTNER_API_VERSION = Deno.env.get(\"PARTNER_API_VERSION\") || \"v1\";\n\nconst AT_BASE = `https://api.airtable.com/v0/${AT_BASE_APP}`;\nconst ANFRAGEN_TABLE = \"Partner-Anfragen\";\n\n// ── CORS + JSON-Helper ─────────────────────────────────────────────────\nfunction cors(): HeadersInit {\n return {\n \"Access-Control-Allow-Origin\": ALLOWED_ORIGIN,\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-App-Secret\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\nfunction json(body: any, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...cors() },\n });\n}\n\n// ── Auth ───────────────────────────────────────────────────────────────\nfunction checkAppSecret(req: Request): boolean {\n if (!APP_SECRET) return false;\n return (req.headers.get(\"X-App-Secret\") || \"\") === APP_SECRET;\n}\n\n// ── Token-Generator ────────────────────────────────────────────────────\nfunction newToken(): string {\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n return Array.from(bytes).map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction newAnfrageId(): string {\n const year = new Date().getFullYear();\n // Zufalls-Suffix — Race-Conditions mit echter Sequenz wären komplex, hier reicht Random\n const bytes = new Uint8Array(2);\n crypto.getRandomValues(bytes);\n const suffix = Array.from(bytes).map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n return `PA-${year}-${suffix}`;\n}\n\n// ── Airtable-Helper ────────────────────────────────────────────────────\nasync function atRequest(path: string, init: RequestInit = {}): Promise {\n const url = path.startsWith(\"http\") ? path : `${AT_BASE}${path}`;\n const headers = {\n \"Authorization\": `Bearer ${AT_API_KEY}`,\n \"Content-Type\": \"application/json\",\n ...(init.headers || {}),\n };\n const resp = await fetch(url, { ...init, headers });\n if (!resp.ok) {\n const txt = await resp.text();\n throw new Error(`Airtable ${resp.status}: ${txt.slice(0, 400)}`);\n }\n return resp.json();\n}\n\nasync function atFindByToken(token: string): Promise {\n const filterFormula = encodeURIComponent(`{token}='${token.replace(/'/g, \"\\\\'\")}'`);\n const data = await atRequest(`/${encodeURIComponent(ANFRAGEN_TABLE)}?filterByFormula=${filterFormula}&maxRecords=1`);\n return (data.records && data.records[0]) || null;\n}\n\nasync function atCreate(table: string, fields: any): Promise {\n return atRequest(`/${encodeURIComponent(table)}`, {\n method: \"POST\",\n body: JSON.stringify({ fields }),\n });\n}\n\nasync function atUpdate(table: string, recordId: string, fields: any): Promise {\n return atRequest(`/${encodeURIComponent(table)}/${recordId}`, {\n method: \"PATCH\",\n body: JSON.stringify({ fields }),\n });\n}\n\nasync function atListByCheckId(checkId: string): Promise {\n const filterFormula = encodeURIComponent(`{check_id}='${checkId.replace(/'/g, \"\\\\'\")}'`);\n const data = await atRequest(`/${encodeURIComponent(ANFRAGEN_TABLE)}?filterByFormula=${filterFormula}&pageSize=100`);\n return data.records || [];\n}\n\n// ── PDF-Anhang via Airtable-Attachment-URL hochladen ───────────────────\nasync function atUploadPdfAttachment(recordId: string, field: string, base64: string, filename: string): Promise {\n // Airtable Upload-Attachment-API (Beta): POST /v0////uploadAttachment\n // Body: { contentType, file (base64), filename }\n const url = `https://content.airtable.com/v0/${AT_BASE_APP}/${recordId}/${encodeURIComponent(field)}/uploadAttachment`;\n const resp = await fetch(url, {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${AT_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n contentType: \"application/pdf\",\n file: base64,\n filename: filename || \"angebot.pdf\",\n }),\n });\n if (!resp.ok) {\n const t = await resp.text();\n throw new Error(`Airtable Upload ${resp.status}: ${t.slice(0, 300)}`);\n }\n}\n\n// ── Email an Partner senden (via liftaroEmailSender) ───────────────────\nasync function sendPartnerEmail(toEmail: string, toName: string, params: {\n checkSnapshot: any;\n token: string;\n landingUrl: string;\n deadlineAt: string;\n includeVorliegendes: boolean;\n}): Promise {\n if (!SMTP_VAL_URL || !SMTP_VAL_SECRET) {\n console.warn(\"[partner-api] SMTP not configured — skipping email\");\n return;\n }\n const cs = params.checkSnapshot || {};\n const subject = `Liftaro: Anfrage Wartungsvertrag-Angebot — ${cs.objekt_ort || cs.objekt_plz || \"Objekt\"}`;\n const ddDate = new Date(params.deadlineAt).toLocaleDateString(\"de-DE\");\n\n const body = [\n `Sehr geehrte Damen und Herren${toName ? \" bei \" + toName : \"\"},`,\n ``,\n `wir bitten Sie um ein Alternativangebot für einen Wartungsvertrag für folgendes Objekt:`,\n ``,\n `• Objekt: ${[cs.objekt_strasse, cs.objekt_plz, cs.objekt_ort].filter(Boolean).join(\", \") || \"(siehe Anfrage)\"}`,\n `• Anzahl Aufzüge: ${cs.anzahl_aufzuege || \"—\"}`,\n `• Anlagenart: ${cs.anlagenart || \"—\"}`,\n cs.leistungsumfang_text ? `\\nGewünschter Leistungsumfang:\\n${cs.leistungsumfang_text}` : \"\",\n ``,\n `Bitte geben Sie Ihre Eckdaten (Preis netto/Jahr, Laufzeit, Kündigungsfrist, Leistungen) über folgenden Link ein — kein Login nötig:`,\n ``,\n `▶ ${params.landingUrl}`,\n ``,\n `Antwortfrist: ${ddDate}`,\n ``,\n `Hinweis: Das endgültige Angebot wird durch Liftaro ausgestellt. Sie agieren als Subunternehmer. Bei Annahme erhalten Sie die vollständigen Auftragsdaten.`,\n params.includeVorliegendes ? `\\nDas vorliegende Bestands-Angebot ist auf der Landing-Page zur Einsicht verfügbar.` : \"\",\n ``,\n `Vielen Dank!`,\n `Liftaro GmbH`,\n `https://liftaro.de`,\n ].filter(s => s !== null && s !== undefined).join(\"\\n\");\n\n const resp = await fetch(SMTP_VAL_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"X-App-Secret\": SMTP_VAL_SECRET },\n body: JSON.stringify({\n to: toEmail,\n subject,\n text: body,\n replyTo: \"check@liftaro.de\",\n }),\n });\n if (!resp.ok) {\n const t = await resp.text();\n console.warn(\"[partner-api] sendPartnerEmail failed:\", resp.status, t.slice(0, 300));\n // Nicht fatal — Anfrage bleibt angelegt, kann manuell erneut gesendet werden\n }\n}\n\n// ── Route-Handler ──────────────────────────────────────────────────────\nasync function handleCreateAnfrage(req: Request): Promise {\n if (!checkAppSecret(req)) return json({ error: \"Auth failed\" }, 401);\n let body: any;\n try { body = await req.json(); } catch { return json({ error: \"Invalid JSON\" }, 400); }\n const checkId = String(body.check_id || \"\").trim();\n const partnerId = String(body.partner_id || \"\").trim();\n const partnerEmail = String(body.partner_email || \"\").trim();\n const partnerName = String(body.partner_name || \"\").trim();\n if (!checkId) return json({ error: \"check_id required\" }, 400);\n if (!partnerId) return json({ error: \"partner_id required\" }, 400);\n if (!partnerEmail) return json({ error: \"partner_email required\" }, 400);\n\n const deadlineDays = Math.max(1, Math.min(60, parseInt(body.deadline_days || \"5\", 10) || 5));\n const includeVorliegendes = !!body.include_vorliegendes_pdf;\n const checkSnapshot = body.check_snapshot || {};\n\n const token = newToken();\n const anfrageId = newAnfrageId();\n const now = new Date();\n const deadline = new Date(now.getTime() + deadlineDays * 86400 * 1000);\n const landingUrl = `${LANDING_BASE}?t=${token}`;\n\n const fields: any = {\n id: anfrageId,\n check_id: checkId,\n partner_id: partnerId,\n partner_name: partnerName,\n partner_email: partnerEmail,\n token,\n channel: \"landing\",\n status: \"gesendet\",\n sent_at: now.toISOString(),\n deadline_at: deadline.toISOString(),\n objekt_plz: checkSnapshot.objekt_plz || \"\",\n objekt_ort: checkSnapshot.objekt_ort || \"\",\n objekt_strasse: checkSnapshot.objekt_strasse || \"\",\n anzahl_aufzuege: String(checkSnapshot.anzahl_aufzuege || \"\"),\n anlagenart: checkSnapshot.anlagenart || \"\",\n leistungsumfang_text: checkSnapshot.leistungsumfang_text || \"\",\n include_vorliegendes_pdf: includeVorliegendes,\n };\n\n let recordId = \"\";\n try {\n const created = await atCreate(ANFRAGEN_TABLE, fields);\n recordId = created.id;\n } catch (e: any) {\n return json({ error: \"Could not create Anfrage: \" + e.message }, 500);\n }\n\n // Optional: vorliegendes PDF an die Anfrage hängen, damit der Partner es laden kann\n if (recordId && includeVorliegendes && body.vorliegendes_pdf_base64) {\n try {\n await atUploadPdfAttachment(recordId, \"vorliegendes_pdf_snapshot\", body.vorliegendes_pdf_base64, body.vorliegendes_pdf_filename || \"vorliegendes.pdf\");\n } catch (e: any) {\n console.warn(\"[partner-api] PDF attach failed:\", e.message);\n }\n }\n\n // Email an Partner\n try {\n await sendPartnerEmail(partnerEmail, partnerName, {\n checkSnapshot,\n token,\n landingUrl,\n deadlineAt: deadline.toISOString(),\n includeVorliegendes,\n });\n } catch (e: any) {\n console.warn(\"[partner-api] email failed:\", e.message);\n }\n\n return json({ ok: true, anfrage_id: anfrageId, token, landing_url: landingUrl, deadline_at: deadline.toISOString() }, 200);\n}\n\nasync function handleGetAnfrage(token: string): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n // Status auf \"geoeffnet\" setzen wenn noch \"gesendet\"\n if (f.status === \"gesendet\") {\n try {\n await atUpdate(ANFRAGEN_TABLE, rec.id, { status: \"geoeffnet\", opened_at: new Date().toISOString() });\n f.status = \"geoeffnet\";\n } catch (_) {}\n }\n // Anonymisierte Sicht für Partner: keine Liftaro-Check-ID, keine HV-Daten\n const view = {\n anfrage_id: f.id,\n partner_name: f.partner_name,\n status: f.status,\n sent_at: f.sent_at,\n deadline_at: f.deadline_at,\n objekt_plz: f.objekt_plz,\n objekt_ort: f.objekt_ort,\n objekt_strasse: f.objekt_strasse,\n anzahl_aufzuege: f.anzahl_aufzuege,\n anlagenart: f.anlagenart,\n leistungsumfang_text: f.leistungsumfang_text,\n include_vorliegendes_pdf: !!f.include_vorliegendes_pdf,\n vorliegendes_pdf_url: (Array.isArray(f.vorliegendes_pdf_snapshot) && f.vorliegendes_pdf_snapshot[0]?.url) || null,\n // Antwort-State (falls schon abgesendet, Partner kann sehen)\n response_offer_id: f.response_offer_id || null,\n response_preis_netto: f.response_preis_netto || null,\n response_laufzeit_jahre: f.response_laufzeit_jahre || null,\n response_kuendigungsfrist_monate: f.response_kuendigungsfrist_monate || null,\n response_wartungen_pro_jahr: f.response_wartungen_pro_jahr || null,\n response_kommentar: f.response_kommentar || null,\n responded_at: f.responded_at || null,\n };\n return json({ ok: true, anfrage: view }, 200);\n}\n\nasync function handleSubmitAnfrage(token: string, req: Request): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n if (f.status === \"angeboten\") return json({ error: \"Bereits beantwortet\" }, 409);\n if (f.status === \"abgelehnt\") return json({ error: \"Bereits abgelehnt\" }, 409);\n if (f.status === \"timeout\") return json({ error: \"Anfrage ist abgelaufen\" }, 410);\n\n let body: any;\n try { body = await req.json(); } catch { return json({ error: \"Invalid JSON\" }, 400); }\n\n const upd: any = {\n status: \"angeboten\",\n responded_at: new Date().toISOString(),\n };\n if (body.response_offer_id != null) upd.response_offer_id = String(body.response_offer_id);\n if (body.response_preis_netto != null) upd.response_preis_netto = String(body.response_preis_netto);\n if (body.response_laufzeit_jahre != null) upd.response_laufzeit_jahre = String(body.response_laufzeit_jahre);\n if (body.response_kuendigungsfrist_monate != null) upd.response_kuendigungsfrist_monate = String(body.response_kuendigungsfrist_monate);\n if (body.response_wartungen_pro_jahr != null) upd.response_wartungen_pro_jahr = String(body.response_wartungen_pro_jahr);\n if (body.response_vollwartung != null) upd.response_vollwartung = !!body.response_vollwartung;\n if (body.response_notruf != null) upd.response_notruf = !!body.response_notruf;\n if (body.response_tuev_begl != null) upd.response_tuev_begl = !!body.response_tuev_begl;\n if (body.response_tuev_pruef != null) upd.response_tuev_pruef = !!body.response_tuev_pruef;\n if (body.response_entstoerung != null) upd.response_entstoerung = !!body.response_entstoerung;\n if (body.response_kommentar != null) upd.response_kommentar = String(body.response_kommentar).slice(0, 4000);\n\n try {\n await atUpdate(ANFRAGEN_TABLE, rec.id, upd);\n } catch (e: any) {\n return json({ error: \"Update failed: \" + e.message }, 500);\n }\n\n // PDF (base64) optional anhängen\n if (body.pdf_base64) {\n try {\n await atUploadPdfAttachment(rec.id, \"response_pdf\", body.pdf_base64, body.pdf_filename || \"angebot.pdf\");\n } catch (e: any) {\n console.warn(\"[partner-api] response_pdf upload failed:\", e.message);\n }\n }\n\n return json({ ok: true, status: \"angeboten\" }, 200);\n}\n\nasync function handleDeclineAnfrage(token: string, req: Request): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n if (f.status === \"angeboten\" || f.status === \"abgelehnt\") {\n return json({ error: \"Status bereits final: \" + f.status }, 409);\n }\n let body: any = {};\n try { body = await req.json(); } catch {}\n const reason = String(body?.reason || \"\").slice(0, 1000);\n await atUpdate(ANFRAGEN_TABLE, rec.id, {\n status: \"abgelehnt\",\n responded_at: new Date().toISOString(),\n response_kommentar: reason || \"Abgelehnt ohne Angabe\",\n });\n return json({ ok: true, status: \"abgelehnt\" }, 200);\n}\n\nasync function handleStatus(token: string): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n return json({\n ok: true,\n status: f.status,\n deadline_at: f.deadline_at,\n responded_at: f.responded_at || null,\n sent_at: f.sent_at,\n opened_at: f.opened_at || null,\n }, 200);\n}\n\nasync function handleListByCheck(checkId: string, req: Request): Promise {\n if (!checkAppSecret(req)) return json({ error: \"Auth failed\" }, 401);\n const recs = await atListByCheckId(checkId);\n const list = recs.map(r => ({ _id: r.id, ...r.fields }));\n return json({ ok: true, anfragen: list }, 200);\n}\n\n// ── Router ─────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: cors() });\n }\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\"); // trailing slash weg\n const method = req.method;\n\n try {\n // POST /api/partner-anfragen\n if (method === \"POST\" && path === \"/api/partner-anfragen\") {\n return await handleCreateAnfrage(req);\n }\n // Pattern: /api/partner-anfragen/:token[/...]\n const tokenMatch = path.match(/^\\/api\\/partner-anfragen\\/([A-Za-z0-9_-]{16,64})(\\/[a-z]+)?$/);\n if (tokenMatch) {\n const token = tokenMatch[1];\n const sub = tokenMatch[2] || \"\";\n if (method === \"GET\" && sub === \"\") return await handleGetAnfrage(token);\n if (method === \"GET\" && sub === \"/status\") return await handleStatus(token);\n if (method === \"POST\" && sub === \"/submit\") return await handleSubmitAnfrage(token, req);\n if (method === \"POST\" && sub === \"/decline\") return await handleDeclineAnfrage(token, req);\n }\n // GET /api/checks/:check_id/anfragen\n const listMatch = path.match(/^\\/api\\/checks\\/([A-Za-z0-9_-]+)\\/anfragen$/);\n if (method === \"GET\" && listMatch) {\n return await handleListByCheck(listMatch[1], req);\n }\n // GET / oder /api/health — Self-Check\n if (method === \"GET\" && (path === \"\" || path === \"/\" || path === \"/api/health\")) {\n return json({\n ok: true,\n service: \"liftaroPartnerApi\",\n version: PARTNER_API_VERSION,\n base_configured: !!AT_BASE_APP,\n smtp_configured: !!SMTP_VAL_URL,\n }, 200);\n }\n return json({ error: \"Not found\", path }, 404);\n } catch (e: any) {\n console.error(\"[partner-api] handler error:\", e);\n return json({ error: \"Server error: \" + (e?.message || String(e)) }, 500);\n }\n}\n","// ════════════════════════════════════════════════════════════════════════\n// Liftaro Partner-API Val (val.town HTTP-Val)\n// ────────────────────────────────────────────────────────────────────────\n// Backend für die Liftaro-Partner-Plattform (V12.13+, Phase 1).\n//\n// Zwei Kanäle:\n// 1) Landing-Page (Token-basiert, primärer Kanal)\n// Liftaro sendet Anfrage per Email mit One-Time-Link\n// Partner ruft Landing-Page auf, lädt PDF + Eckdaten hoch, submittet\n// → POST .../submit landet als Response in Partner-Anfragen\n// 2) API (X-Partner-Key, Phase 8 später)\n// Partner-Software pollt offene Anfragen, submittet via REST\n//\n// Endpoints (alle JSON außer wo anders angegeben):\n//\n// POST /api/partner-anfragen\n// Header: X-App-Secret: \n// Body: {\n// check_id, partner_id, partner_name, partner_email,\n// deadline_days?, // default 5\n// include_vorliegendes_pdf?, // default false\n// vorliegendes_pdf_url?, // signierter Airtable-Link\n// check_snapshot: {\n// objekt_plz, objekt_ort, objekt_strasse?,\n// anzahl_aufzuege, anlagenart, leistungsumfang_text\n// }\n// }\n// Response: { ok, anfrage_id, token, landing_url }\n// Effekt: Legt Partner-Anfragen-Record an, sendet Email an partner_email\n//\n// GET /api/partner-anfragen/:token\n// Public (Token = Auth).\n// Response: { ok, anfrage: { ...anonymisiert... }, vorliegendes_pdf_url? }\n// Effekt: Setzt opened_at beim ersten Aufruf (status: gesendet → geoeffnet)\n//\n// POST /api/partner-anfragen/:token/submit\n// Public (Token = Auth).\n// Body: {\n// response_offer_id?,\n// response_preis_netto, response_laufzeit_jahre,\n// response_kuendigungsfrist_monate, response_wartungen_pro_jahr,\n// response_vollwartung, response_notruf,\n// response_tuev_begl, response_tuev_pruef, response_entstoerung,\n// response_kommentar?,\n// pdf_base64?, pdf_filename? // alternativ multipart\n// }\n// Response: { ok, status: 'angeboten' }\n// Effekt: Schreibt Antwort in Partner-Anfragen, status='angeboten'.\n// Token wird invalidiert (nicht gelöscht, aber Resubmit blockt).\n//\n// GET /api/partner-anfragen/:token/status\n// Public (Token = Auth) — Polling für Partner-UI.\n// Response: { ok, status, deadline_at, responded_at? }\n//\n// POST /api/partner-anfragen/:token/decline\n// Public (Token = Auth).\n// Body: { reason? }\n// Response: { ok, status: 'abgelehnt' }\n//\n// GET /api/checks/:check_id/anfragen\n// Header: X-App-Secret\n// Response: { ok, anfragen: [...] }\n// Effekt: Liftaro-App lädt alle Anfragen zu einem Check (für die Karten-Anzeige)\n//\n// ════════════════════════════════════════════════════════════════════════\n// Kanal 2 — Software-Integration für Partner (X-Partner-Key)\n// ════════════════════════════════════════════════════════════════════════\n// Partner-Software pollt offene Anfragen + submittet Angebote direkt aus\n// seinem CRM/Quote-System. Auth: X-Partner-Key (dauerhaft, pro Partner).\n// Partner-Pool-Tabelle muss api_key + active=true gesetzt haben.\n//\n// GET /api/v2/me\n// Header: X-Partner-Key: \n// Response: { ok, partner_id, name, email_kontakt, active, api_version }\n//\n// GET /api/v2/checks?status=offen|alle|angeboten|abgelehnt\n// Header: X-Partner-Key: \n// Response: { ok, count, anfragen: [...] }\n// Default-Filter: offen = status in (gesendet, geoeffnet)\n//\n// GET /api/v2/checks/:anfrage_id\n// Header: X-Partner-Key: \n// Response: { ok, anfrage: { ... } }\n// Setzt opened_at beim ersten Aufruf (gesendet → geoeffnet).\n//\n// POST /api/v2/checks/:anfrage_id/offer\n// Header: X-Partner-Key: \n// Body: { response_offer_id?, response_preis_netto,\n// response_laufzeit_jahre, response_kuendigungsfrist_monate,\n// response_wartungen_pro_jahr, response_vollwartung,\n// response_notruf, response_tuev_begl, response_tuev_pruef,\n// response_entstoerung, response_kommentar?,\n// pdf_base64?, pdf_filename? }\n// Response: { ok, status: 'angeboten', channel: 'api' }\n// Sicherheit: nur Anfragen mit partner_id == eigener Partner werden akzeptiert.\n//\n// POST /api/v2/checks/:anfrage_id/decline\n// Header: X-Partner-Key: \n// Body: { reason? }\n// Response: { ok, status: 'abgelehnt', channel: 'api' }\n//\n// Env-Variablen (val.town Settings → Environment Variables):\n// AIRTABLE_BASE_ID — Airtable App-Base-ID (z.B. \"appXXXX\") [auto-bootstrap]\n// AIRTABLE_KEY — Airtable Personal Access Token [auto-bootstrap]\n// APP_SECRET — Shared secret zwischen Liftaro-Frontend und diesem Val\n// SMTP_VAL_URL — URL des liftaroEmailSender-Vals\n// SMTP_VAL_SECRET — APP_SECRET des SMTP-Vals\n// LANDING_BASE — Basis-URL der Landing-Page,\n// z.B. \"https://check.liftaro.de/partner/anfrage.html\"\n// ALLOWED_ORIGIN — CORS-Origin (z.B. \"https://check.liftaro.de\" oder \"*\")\n// PARTNER_API_VERSION — optional Version-String fürs Health-Log\n//\n// HINWEIS: Tabellen-Schema (Partner-Anfragen) wird von der Liftaro-App\n// via Meta-API erstellt (setupTables in index.html). Dieser Val\n// schreibt nur in die bestehende Tabelle.\n// ════════════════════════════════════════════════════════════════════════\n\nconst ALLOWED_ORIGIN = Deno.env.get(\"ALLOWED_ORIGIN\") || \"*\";\nconst AT_BASE_APP = Deno.env.get(\"AIRTABLE_BASE_ID\") || \"\";\nconst AT_API_KEY = Deno.env.get(\"AIRTABLE_KEY\") || \"\";\nconst APP_SECRET = Deno.env.get(\"APP_SECRET\") || \"\";\nconst SMTP_VAL_URL = Deno.env.get(\"SMTP_VAL_URL\") || \"\";\nconst SMTP_VAL_SECRET = Deno.env.get(\"SMTP_VAL_SECRET\") || \"\";\nconst LANDING_BASE = Deno.env.get(\"LANDING_BASE\") || \"https://check.liftaro.de/partner/anfrage.html\";\nconst PARTNER_API_VERSION = Deno.env.get(\"PARTNER_API_VERSION\") || \"v1\";\n\nconst AT_BASE = `https://api.airtable.com/v0/${AT_BASE_APP}`;\nconst ANFRAGEN_TABLE = \"Partner-Anfragen\";\nconst PARTNER_POOL_TABLE = \"Partner-Pool\";\n\n// ── CORS + JSON-Helper ─────────────────────────────────────────────────\nfunction cors(): HeadersInit {\n return {\n \"Access-Control-Allow-Origin\": ALLOWED_ORIGIN,\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-App-Secret\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\nfunction json(body: any, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...cors() },\n });\n}\n\n// ── Auth ───────────────────────────────────────────────────────────────\nfunction checkAppSecret(req: Request): boolean {\n if (!APP_SECRET) return false;\n return (req.headers.get(\"X-App-Secret\") || \"\") === APP_SECRET;\n}\n\n// ── Token-Generator ────────────────────────────────────────────────────\nfunction newToken(): string {\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n return Array.from(bytes).map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction newAnfrageId(): string {\n const year = new Date().getFullYear();\n // Zufalls-Suffix — Race-Conditions mit echter Sequenz wären komplex, hier reicht Random\n const bytes = new Uint8Array(2);\n crypto.getRandomValues(bytes);\n const suffix = Array.from(bytes).map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n return `PA-${year}-${suffix}`;\n}\n\n// ── Airtable-Helper ────────────────────────────────────────────────────\nasync function atRequest(path: string, init: RequestInit = {}): Promise {\n const url = path.startsWith(\"http\") ? path : `${AT_BASE}${path}`;\n const headers = {\n \"Authorization\": `Bearer ${AT_API_KEY}`,\n \"Content-Type\": \"application/json\",\n ...(init.headers || {}),\n };\n const resp = await fetch(url, { ...init, headers });\n if (!resp.ok) {\n const txt = await resp.text();\n throw new Error(`Airtable ${resp.status}: ${txt.slice(0, 400)}`);\n }\n return resp.json();\n}\n\nasync function atFindByToken(token: string): Promise {\n const filterFormula = encodeURIComponent(`{token}='${token.replace(/'/g, \"\\\\'\")}'`);\n const data = await atRequest(`/${encodeURIComponent(ANFRAGEN_TABLE)}?filterByFormula=${filterFormula}&maxRecords=1`);\n return (data.records && data.records[0]) || null;\n}\n\nasync function atCreate(table: string, fields: any): Promise {\n return atRequest(`/${encodeURIComponent(table)}`, {\n method: \"POST\",\n body: JSON.stringify({ fields }),\n });\n}\n\nasync function atUpdate(table: string, recordId: string, fields: any): Promise {\n return atRequest(`/${encodeURIComponent(table)}/${recordId}`, {\n method: \"PATCH\",\n body: JSON.stringify({ fields }),\n });\n}\n\nasync function atListByCheckId(checkId: string): Promise {\n const filterFormula = encodeURIComponent(`{check_id}='${checkId.replace(/'/g, \"\\\\'\")}'`);\n const data = await atRequest(`/${encodeURIComponent(ANFRAGEN_TABLE)}?filterByFormula=${filterFormula}&pageSize=100`);\n return data.records || [];\n}\n\n// ── PDF-Anhang via Airtable-Attachment-URL hochladen ───────────────────\nasync function atUploadPdfAttachment(recordId: string, field: string, base64: string, filename: string): Promise {\n // Airtable Upload-Attachment-API (Beta): POST /v0////uploadAttachment\n // Body: { contentType, file (base64), filename }\n const url = `https://content.airtable.com/v0/${AT_BASE_APP}/${recordId}/${encodeURIComponent(field)}/uploadAttachment`;\n const resp = await fetch(url, {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${AT_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n contentType: \"application/pdf\",\n file: base64,\n filename: filename || \"angebot.pdf\",\n }),\n });\n if (!resp.ok) {\n const t = await resp.text();\n throw new Error(`Airtable Upload ${resp.status}: ${t.slice(0, 300)}`);\n }\n}\n\n// ── Email an Partner senden (via liftaroEmailSender) ───────────────────\nasync function sendPartnerEmail(toEmail: string, toName: string, params: {\n checkSnapshot: any;\n token: string;\n landingUrl: string;\n deadlineAt: string;\n includeVorliegendes: boolean;\n}): Promise {\n if (!SMTP_VAL_URL || !SMTP_VAL_SECRET) {\n console.warn(\"[partner-api] SMTP not configured — skipping email\");\n return;\n }\n const cs = params.checkSnapshot || {};\n const subject = `Liftaro: Anfrage Wartungsvertrag-Angebot — ${cs.objekt_ort || cs.objekt_plz || \"Objekt\"}`;\n const ddDate = new Date(params.deadlineAt).toLocaleDateString(\"de-DE\");\n\n const body = [\n `Sehr geehrte Damen und Herren${toName ? \" bei \" + toName : \"\"},`,\n ``,\n `wir bitten Sie um ein Alternativangebot für einen Wartungsvertrag für folgendes Objekt:`,\n ``,\n `• Objekt: ${[cs.objekt_strasse, cs.objekt_plz, cs.objekt_ort].filter(Boolean).join(\", \") || \"(siehe Anfrage)\"}`,\n `• Anzahl Aufzüge: ${cs.anzahl_aufzuege || \"—\"}`,\n `• Anlagenart: ${cs.anlagenart || \"—\"}`,\n cs.leistungsumfang_text ? `\\nGewünschter Leistungsumfang:\\n${cs.leistungsumfang_text}` : \"\",\n ``,\n `Bitte geben Sie Ihre Eckdaten (Preis netto/Jahr, Laufzeit, Kündigungsfrist, Leistungen) über folgenden Link ein — kein Login nötig:`,\n ``,\n `▶ ${params.landingUrl}`,\n ``,\n `Antwortfrist: ${ddDate}`,\n ``,\n `Hinweis: Das endgültige Angebot wird durch Liftaro ausgestellt. Sie agieren als Subunternehmer. Bei Annahme erhalten Sie die vollständigen Auftragsdaten.`,\n params.includeVorliegendes ? `\\nDas vorliegende Bestands-Angebot ist auf der Landing-Page zur Einsicht verfügbar.` : \"\",\n ``,\n `Vielen Dank!`,\n `Liftaro GmbH`,\n `https://liftaro.de`,\n ].filter(s => s !== null && s !== undefined).join(\"\\n\");\n\n const resp = await fetch(SMTP_VAL_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"X-App-Secret\": SMTP_VAL_SECRET },\n body: JSON.stringify({\n to: toEmail,\n subject,\n text: body,\n replyTo: \"check@liftaro.de\",\n }),\n });\n if (!resp.ok) {\n const t = await resp.text();\n console.warn(\"[partner-api] sendPartnerEmail failed:\", resp.status, t.slice(0, 300));\n // Nicht fatal — Anfrage bleibt angelegt, kann manuell erneut gesendet werden\n }\n}\n\n// ── Route-Handler ──────────────────────────────────────────────────────\nasync function handleCreateAnfrage(req: Request): Promise {\n if (!checkAppSecret(req)) return json({ error: \"Auth failed\" }, 401);\n let body: any;\n try { body = await req.json(); } catch { return json({ error: \"Invalid JSON\" }, 400); }\n const checkId = String(body.check_id || \"\").trim();\n const partnerId = String(body.partner_id || \"\").trim();\n const partnerEmail = String(body.partner_email || \"\").trim();\n const partnerName = String(body.partner_name || \"\").trim();\n if (!checkId) return json({ error: \"check_id required\" }, 400);\n if (!partnerId) return json({ error: \"partner_id required\" }, 400);\n if (!partnerEmail) return json({ error: \"partner_email required\" }, 400);\n\n const deadlineDays = Math.max(1, Math.min(60, parseInt(body.deadline_days || \"5\", 10) || 5));\n const includeVorliegendes = !!body.include_vorliegendes_pdf;\n const checkSnapshot = body.check_snapshot || {};\n\n const token = newToken();\n const anfrageId = newAnfrageId();\n const now = new Date();\n const deadline = new Date(now.getTime() + deadlineDays * 86400 * 1000);\n const landingUrl = `${LANDING_BASE}?t=${token}`;\n\n const fields: any = {\n id: anfrageId,\n check_id: checkId,\n partner_id: partnerId,\n partner_name: partnerName,\n partner_email: partnerEmail,\n token,\n channel: \"landing\",\n status: \"gesendet\",\n sent_at: now.toISOString(),\n deadline_at: deadline.toISOString(),\n objekt_plz: checkSnapshot.objekt_plz || \"\",\n objekt_ort: checkSnapshot.objekt_ort || \"\",\n objekt_strasse: checkSnapshot.objekt_strasse || \"\",\n anzahl_aufzuege: String(checkSnapshot.anzahl_aufzuege || \"\"),\n anlagenart: checkSnapshot.anlagenart || \"\",\n leistungsumfang_text: checkSnapshot.leistungsumfang_text || \"\",\n include_vorliegendes_pdf: includeVorliegendes,\n };\n\n let recordId = \"\";\n try {\n const created = await atCreate(ANFRAGEN_TABLE, fields);\n recordId = created.id;\n } catch (e: any) {\n return json({ error: \"Could not create Anfrage: \" + e.message }, 500);\n }\n\n // Optional: vorliegendes PDF an die Anfrage hängen, damit der Partner es laden kann\n if (recordId && includeVorliegendes && body.vorliegendes_pdf_base64) {\n try {\n await atUploadPdfAttachment(recordId, \"vorliegendes_pdf_snapshot\", body.vorliegendes_pdf_base64, body.vorliegendes_pdf_filename || \"vorliegendes.pdf\");\n } catch (e: any) {\n console.warn(\"[partner-api] PDF attach failed:\", e.message);\n }\n }\n\n // Email an Partner\n try {\n await sendPartnerEmail(partnerEmail, partnerName, {\n checkSnapshot,\n token,\n landingUrl,\n deadlineAt: deadline.toISOString(),\n includeVorliegendes,\n });\n } catch (e: any) {\n console.warn(\"[partner-api] email failed:\", e.message);\n }\n\n return json({ ok: true, anfrage_id: anfrageId, token, landing_url: landingUrl, deadline_at: deadline.toISOString() }, 200);\n}\n\nasync function handleGetAnfrage(token: string): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n // Status auf \"geoeffnet\" setzen wenn noch \"gesendet\"\n if (f.status === \"gesendet\") {\n try {\n await atUpdate(ANFRAGEN_TABLE, rec.id, { status: \"geoeffnet\", opened_at: new Date().toISOString() });\n f.status = \"geoeffnet\";\n } catch (_) {}\n }\n // Anonymisierte Sicht für Partner: keine Liftaro-Check-ID, keine HV-Daten\n const view = {\n anfrage_id: f.id,\n partner_name: f.partner_name,\n status: f.status,\n sent_at: f.sent_at,\n deadline_at: f.deadline_at,\n objekt_plz: f.objekt_plz,\n objekt_ort: f.objekt_ort,\n objekt_strasse: f.objekt_strasse,\n anzahl_aufzuege: f.anzahl_aufzuege,\n anlagenart: f.anlagenart,\n leistungsumfang_text: f.leistungsumfang_text,\n include_vorliegendes_pdf: !!f.include_vorliegendes_pdf,\n vorliegendes_pdf_url: (Array.isArray(f.vorliegendes_pdf_snapshot) && f.vorliegendes_pdf_snapshot[0]?.url) || null,\n // Antwort-State (falls schon abgesendet, Partner kann sehen)\n response_offer_id: f.response_offer_id || null,\n response_preis_netto: f.response_preis_netto || null,\n response_laufzeit_jahre: f.response_laufzeit_jahre || null,\n response_kuendigungsfrist_monate: f.response_kuendigungsfrist_monate || null,\n response_wartungen_pro_jahr: f.response_wartungen_pro_jahr || null,\n response_kommentar: f.response_kommentar || null,\n responded_at: f.responded_at || null,\n };\n return json({ ok: true, anfrage: view }, 200);\n}\n\nasync function handleSubmitAnfrage(token: string, req: Request): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n if (f.status === \"angeboten\") return json({ error: \"Bereits beantwortet\" }, 409);\n if (f.status === \"abgelehnt\") return json({ error: \"Bereits abgelehnt\" }, 409);\n if (f.status === \"timeout\") return json({ error: \"Anfrage ist abgelaufen\" }, 410);\n\n let body: any;\n try { body = await req.json(); } catch { return json({ error: \"Invalid JSON\" }, 400); }\n\n const upd: any = {\n status: \"angeboten\",\n responded_at: new Date().toISOString(),\n };\n if (body.response_offer_id != null) upd.response_offer_id = String(body.response_offer_id);\n if (body.response_preis_netto != null) upd.response_preis_netto = String(body.response_preis_netto);\n if (body.response_laufzeit_jahre != null) upd.response_laufzeit_jahre = String(body.response_laufzeit_jahre);\n if (body.response_kuendigungsfrist_monate != null) upd.response_kuendigungsfrist_monate = String(body.response_kuendigungsfrist_monate);\n if (body.response_wartungen_pro_jahr != null) upd.response_wartungen_pro_jahr = String(body.response_wartungen_pro_jahr);\n if (body.response_vollwartung != null) upd.response_vollwartung = !!body.response_vollwartung;\n if (body.response_notruf != null) upd.response_notruf = !!body.response_notruf;\n if (body.response_tuev_begl != null) upd.response_tuev_begl = !!body.response_tuev_begl;\n if (body.response_tuev_pruef != null) upd.response_tuev_pruef = !!body.response_tuev_pruef;\n if (body.response_entstoerung != null) upd.response_entstoerung = !!body.response_entstoerung;\n if (body.response_kommentar != null) upd.response_kommentar = String(body.response_kommentar).slice(0, 4000);\n\n try {\n await atUpdate(ANFRAGEN_TABLE, rec.id, upd);\n } catch (e: any) {\n return json({ error: \"Update failed: \" + e.message }, 500);\n }\n\n // PDF (base64) optional anhängen\n if (body.pdf_base64) {\n try {\n await atUploadPdfAttachment(rec.id, \"response_pdf\", body.pdf_base64, body.pdf_filename || \"angebot.pdf\");\n } catch (e: any) {\n console.warn(\"[partner-api] response_pdf upload failed:\", e.message);\n }\n }\n\n return json({ ok: true, status: \"angeboten\" }, 200);\n}\n\nasync function handleDeclineAnfrage(token: string, req: Request): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n if (f.status === \"angeboten\" || f.status === \"abgelehnt\") {\n return json({ error: \"Status bereits final: \" + f.status }, 409);\n }\n let body: any = {};\n try { body = await req.json(); } catch {}\n const reason = String(body?.reason || \"\").slice(0, 1000);\n await atUpdate(ANFRAGEN_TABLE, rec.id, {\n status: \"abgelehnt\",\n responded_at: new Date().toISOString(),\n response_kommentar: reason || \"Abgelehnt ohne Angabe\",\n });\n return json({ ok: true, status: \"abgelehnt\" }, 200);\n}\n\nasync function handleStatus(token: string): Promise {\n const rec = await atFindByToken(token);\n if (!rec) return json({ error: \"Anfrage nicht gefunden\" }, 404);\n const f = rec.fields || {};\n return json({\n ok: true,\n status: f.status,\n deadline_at: f.deadline_at,\n responded_at: f.responded_at || null,\n sent_at: f.sent_at,\n opened_at: f.opened_at || null,\n }, 200);\n}\n\nasync function handleListByCheck(checkId: string, req: Request): Promise {\n if (!checkAppSecret(req)) return json({ error: \"Auth failed\" }, 401);\n const recs = await atListByCheckId(checkId);\n const list = recs.map(r => ({ _id: r.id, ...r.fields }));\n return json({ ok: true, anfragen: list }, 200);\n}\n\n// ════════════════════════════════════════════════════════════════════\n// Kanal 2: Partner-Software-Integration via X-Partner-Key\n// ════════════════════════════════════════════════════════════════════\n// Statt One-Time-Token (Landing-Page) authentifiziert sich der Partner mit\n// einem dauerhaften API-Key, der im Partner-Pool-Record gespeichert ist.\n// Der Partner sieht ALLE Anfragen, die ihm zugeordnet sind, kann sie\n// abrufen, beantworten oder ablehnen — alles strukturiert per JSON.\n\ntype Partner = {\n recId: string;\n partner_id: string;\n name: string;\n email_kontakt?: string;\n active?: boolean;\n};\n\nasync function validatePartnerKey(req: Request): Promise {\n const key = (req.headers.get(\"X-Partner-Key\") || \"\").trim();\n if (!key || key.length < 12) return null;\n const filter = encodeURIComponent(`{api_key}='${key.replace(/'/g, \"\\\\'\")}'`);\n try {\n const data = await atRequest(`/${encodeURIComponent(PARTNER_POOL_TABLE)}?filterByFormula=${filter}&maxRecords=1`);\n const r = (data.records && data.records[0]) || null;\n if (!r) return null;\n const f = r.fields || {};\n if (f.active === false) return null;\n if (!f.partner_id) return null;\n return {\n recId: r.id,\n partner_id: String(f.partner_id),\n name: String(f.name || f.partner_id),\n email_kontakt: f.email_kontakt,\n active: f.active !== false,\n };\n } catch (e: any) {\n console.warn(\"[partner-api/v2] partner lookup failed:\", e.message);\n return null;\n }\n}\n\n// Mappt einen Partner-Anfragen-Record auf die Partner-Sicht (sicher, keine internen Felder).\nfunction _partnerView(rec: any) {\n const f = rec.fields || {};\n return {\n anfrage_id: f.id,\n status: f.status,\n sent_at: f.sent_at,\n opened_at: f.opened_at || null,\n responded_at: f.responded_at || null,\n deadline_at: f.deadline_at,\n objekt_plz: f.objekt_plz,\n objekt_ort: f.objekt_ort,\n objekt_strasse: f.objekt_strasse,\n anzahl_aufzuege: f.anzahl_aufzuege,\n anlagenart: f.anlagenart,\n leistungsumfang_text: f.leistungsumfang_text,\n include_vorliegendes_pdf: !!f.include_vorliegendes_pdf,\n vorliegendes_pdf_url: (Array.isArray(f.vorliegendes_pdf_snapshot) && f.vorliegendes_pdf_snapshot[0]?.url) || null,\n // bereits abgegebene Antwort\n response_offer_id: f.response_offer_id || null,\n response_preis_netto: f.response_preis_netto || null,\n response_laufzeit_jahre: f.response_laufzeit_jahre || null,\n response_kuendigungsfrist_monate: f.response_kuendigungsfrist_monate || null,\n response_wartungen_pro_jahr: f.response_wartungen_pro_jahr || null,\n response_vollwartung: !!f.response_vollwartung,\n response_notruf: !!f.response_notruf,\n response_tuev_begl: !!f.response_tuev_begl,\n response_tuev_pruef: !!f.response_tuev_pruef,\n response_entstoerung: !!f.response_entstoerung,\n response_kommentar: f.response_kommentar || null,\n };\n}\n\n// GET /api/v2/me — Self-Identify\nasync function handleV2Me(partner: Partner): Promise {\n return json({\n ok: true,\n partner_id: partner.partner_id,\n name: partner.name,\n email_kontakt: partner.email_kontakt || null,\n active: partner.active,\n api_version: \"v2\",\n }, 200);\n}\n\n// GET /api/v2/checks?status=offen|alle|angeboten|abgelehnt\nasync function handleV2ListChecks(partner: Partner, url: URL): Promise {\n const statusFilter = (url.searchParams.get(\"status\") || \"offen\").toLowerCase();\n // Basis-Filter: nur Anfragen für diesen Partner\n let formula = `{partner_id}='${partner.partner_id.replace(/'/g, \"\\\\'\")}'`;\n if (statusFilter === \"offen\") {\n formula = `AND(${formula}, OR({status}='gesendet', {status}='geoeffnet'))`;\n } else if (statusFilter !== \"alle\") {\n formula = `AND(${formula}, {status}='${statusFilter.replace(/'/g, \"\\\\'\")}')`;\n }\n const enc = encodeURIComponent(formula);\n try {\n const data = await atRequest(`/${encodeURIComponent(ANFRAGEN_TABLE)}?filterByFormula=${enc}&pageSize=100&sort%5B0%5D%5Bfield%5D=sent_at&sort%5B0%5D%5Bdirection%5D=desc`);\n const list = (data.records || []).map(_partnerView);\n return json({ ok: true, count: list.length, anfragen: list }, 200);\n } catch (e: any) {\n return json({ error: \"List failed: \" + e.message }, 500);\n }\n}\n\n// Holt einen Anfrage-Record und prüft, dass er DIESEM Partner gehört.\nasync function _v2FindAnfrage(partner: Partner, anfrageId: string): Promise {\n const filter = encodeURIComponent(`{id}='${anfrageId.replace(/'/g, \"\\\\'\")}'`);\n try {\n const data = await atRequest(`/${encodeURIComponent(ANFRAGEN_TABLE)}?filterByFormula=${filter}&maxRecords=1`);\n const r = (data.records && data.records[0]) || null;\n if (!r) return { error: json({ error: \"Anfrage nicht gefunden\" }, 404) };\n if ((r.fields?.partner_id || \"\") !== partner.partner_id) {\n return { error: json({ error: \"Diese Anfrage gehört nicht zu Ihrem Partner-Account\" }, 403) };\n }\n return r;\n } catch (e: any) {\n return { error: json({ error: \"Lookup failed: \" + e.message }, 500) };\n }\n}\n\n// GET /api/v2/checks/:anfrage_id\nasync function handleV2GetAnfrage(partner: Partner, anfrageId: string): Promise {\n const rec = await _v2FindAnfrage(partner, anfrageId);\n if ((rec as any).error) return (rec as any).error;\n // Bei erstem Zugriff opened_at + status auf \"geoeffnet\" setzen, falls noch \"gesendet\"\n if (rec.fields?.status === \"gesendet\") {\n try { await atUpdate(ANFRAGEN_TABLE, rec.id, { status: \"geoeffnet\", opened_at: new Date().toISOString() }); rec.fields.status = \"geoeffnet\"; } catch (_) {}\n }\n return json({ ok: true, anfrage: _partnerView(rec) }, 200);\n}\n\n// POST /api/v2/checks/:anfrage_id/offer — analog Kanal-1-submit, aber via API-Key\nasync function handleV2SubmitOffer(partner: Partner, anfrageId: string, req: Request): Promise {\n const rec = await _v2FindAnfrage(partner, anfrageId);\n if ((rec as any).error) return (rec as any).error;\n const f = rec.fields || {};\n if (f.status === \"angeboten\") return json({ error: \"Bereits beantwortet\" }, 409);\n if (f.status === \"abgelehnt\") return json({ error: \"Bereits abgelehnt\" }, 409);\n if (f.status === \"timeout\") return json({ error: \"Anfrage ist abgelaufen\" }, 410);\n\n let body: any;\n try { body = await req.json(); } catch { return json({ error: \"Invalid JSON\" }, 400); }\n\n const upd: any = {\n status: \"angeboten\",\n responded_at: new Date().toISOString(),\n channel: \"api\",\n };\n if (body.response_offer_id != null) upd.response_offer_id = String(body.response_offer_id);\n if (body.response_preis_netto != null) upd.response_preis_netto = String(body.response_preis_netto);\n if (body.response_laufzeit_jahre != null) upd.response_laufzeit_jahre = String(body.response_laufzeit_jahre);\n if (body.response_kuendigungsfrist_monate != null) upd.response_kuendigungsfrist_monate = String(body.response_kuendigungsfrist_monate);\n if (body.response_wartungen_pro_jahr != null) upd.response_wartungen_pro_jahr = String(body.response_wartungen_pro_jahr);\n if (body.response_vollwartung != null) upd.response_vollwartung = !!body.response_vollwartung;\n if (body.response_notruf != null) upd.response_notruf = !!body.response_notruf;\n if (body.response_tuev_begl != null) upd.response_tuev_begl = !!body.response_tuev_begl;\n if (body.response_tuev_pruef != null) upd.response_tuev_pruef = !!body.response_tuev_pruef;\n if (body.response_entstoerung != null) upd.response_entstoerung = !!body.response_entstoerung;\n if (body.response_kommentar != null) upd.response_kommentar = String(body.response_kommentar).slice(0, 4000);\n\n try {\n await atUpdate(ANFRAGEN_TABLE, rec.id, upd);\n } catch (e: any) {\n return json({ error: \"Update failed: \" + e.message }, 500);\n }\n // PDF optional\n if (body.pdf_base64) {\n try {\n await atUploadPdfAttachment(rec.id, \"response_pdf\", body.pdf_base64, body.pdf_filename || \"angebot.pdf\");\n } catch (e: any) {\n console.warn(\"[partner-api/v2] PDF upload failed:\", e.message);\n }\n }\n return json({ ok: true, status: \"angeboten\", channel: \"api\" }, 200);\n}\n\n// POST /api/v2/checks/:anfrage_id/decline\nasync function handleV2DeclineOffer(partner: Partner, anfrageId: string, req: Request): Promise {\n const rec = await _v2FindAnfrage(partner, anfrageId);\n if ((rec as any).error) return (rec as any).error;\n const f = rec.fields || {};\n if (f.status === \"angeboten\" || f.status === \"abgelehnt\") {\n return json({ error: \"Status bereits final: \" + f.status }, 409);\n }\n let body: any = {};\n try { body = await req.json(); } catch {}\n const reason = String(body?.reason || \"\").slice(0, 1000);\n try {\n await atUpdate(ANFRAGEN_TABLE, rec.id, {\n status: \"abgelehnt\",\n responded_at: new Date().toISOString(),\n channel: \"api\",\n response_kommentar: reason || \"Abgelehnt via API\",\n });\n } catch (e: any) {\n return json({ error: \"Update failed: \" + e.message }, 500);\n }\n return json({ ok: true, status: \"abgelehnt\", channel: \"api\" }, 200);\n}\n\n// ── Router ─────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: cors() });\n }\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\"); // trailing slash weg\n const method = req.method;\n\n try {\n // POST /api/partner-anfragen\n if (method === \"POST\" && path === \"/api/partner-anfragen\") {\n return await handleCreateAnfrage(req);\n }\n // Pattern: /api/partner-anfragen/:token[/...]\n const tokenMatch = path.match(/^\\/api\\/partner-anfragen\\/([A-Za-z0-9_-]{16,64})(\\/[a-z]+)?$/);\n if (tokenMatch) {\n const token = tokenMatch[1];\n const sub = tokenMatch[2] || \"\";\n if (method === \"GET\" && sub === \"\") return await handleGetAnfrage(token);\n if (method === \"GET\" && sub === \"/status\") return await handleStatus(token);\n if (method === \"POST\" && sub === \"/submit\") return await handleSubmitAnfrage(token, req);\n if (method === \"POST\" && sub === \"/decline\") return await handleDeclineAnfrage(token, req);\n }\n // GET /api/checks/:check_id/anfragen\n const listMatch = path.match(/^\\/api\\/checks\\/([A-Za-z0-9_-]+)\\/anfragen$/);\n if (method === \"GET\" && listMatch) {\n return await handleListByCheck(listMatch[1], req);\n }\n // ── Kanal 2: /api/v2/* — Partner-Software-Integration via X-Partner-Key ──\n if (path.startsWith(\"/api/v2/\")) {\n const partner = await validatePartnerKey(req);\n if (!partner) return json({ error: \"X-Partner-Key fehlt oder ungültig\" }, 401);\n if (method === \"GET\" && path === \"/api/v2/me\") return await handleV2Me(partner);\n if (method === \"GET\" && path === \"/api/v2/checks\") return await handleV2ListChecks(partner, url);\n const v2Match = path.match(/^\\/api\\/v2\\/checks\\/([A-Za-z0-9_-]+)(\\/[a-z]+)?$/);\n if (v2Match) {\n const aId = v2Match[1];\n const sub = v2Match[2] || \"\";\n if (method === \"GET\" && sub === \"\") return await handleV2GetAnfrage(partner, aId);\n if (method === \"POST\" && sub === \"/offer\") return await handleV2SubmitOffer(partner, aId, req);\n if (method === \"POST\" && sub === \"/decline\") return await handleV2DeclineOffer(partner, aId, req);\n }\n return json({ error: \"v2 route not found\", path }, 404);\n }\n // GET / oder /api/health — Self-Check\n if (method === \"GET\" && (path === \"\" || path === \"/\" || path === \"/api/health\")) {\n return json({\n ok: true,\n service: \"liftaroPartnerApi\",\n version: PARTNER_API_VERSION,\n base_configured: !!AT_BASE_APP,\n smtp_configured: !!SMTP_VAL_URL,\n channels: [\"landing\", \"api\"],\n }, 200);\n }\n return json({ error: \"Not found\", path }, 404);\n } catch (e: any) {\n console.error(\"[partner-api] handler error:\", e);\n return json({ error: \"Server error: \" + (e?.message || String(e)) }, 500);\n }\n}\n","createdAt",["D",1779700670115],"branchVersion","branchId","4b8ef700-57b6-11f1-b5ca-ee650bb23af1","id","4b8e37ca-57b6-11f1-b5ca-ee650bb23af1","liftaroPartnerApi",["D",1779657588846],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","b8672cc5-9c71-42c6-931f-a0aabca33bdd","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e049b-6e23-74ee-9bdd-0c49067080a6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_94":93,"_102":98},"org",{"_94":93,"_95":96,"_97":98,"_18":54,"_99":100,"_101":25},"branch",{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"isOwned",14,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","giltglobalinvest","handle","displayName","Patrizio Fontanarosa","avatar","https://lh3.googleusercontent.com/a/ACg8ocL48GSPatvcxwg0cqcSWpW_ddx-HBZAMenADEoTYtVSkvBX8g=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":150,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":151,"_78":152,"_80":153,"_82":25},"tree",[145],"files",[145],"counts",{"_133":60,"_134":135,"_136":60,"_137":138,"_139":140},"contents",[125],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":126,"_32":28,"_30":31,"_127":-5,"_41":42,"_40":14,"_128":25,"_38":129,"_13":130,"_33":20,"_35":37,"_24":25,"_131":-5,"_27":132},"9a03df68-581a-11f1-82be-ee650bb23af1","parentId","latest",["D",1779700670115],3,"label",[28],"pulls","branches",1,"forks","envVars",{"_141":143,"_144":60},"connections",{"_141":60,"_142":60},"count","unfilledCount",10,"emptyCount",{"_43":126,"_32":28,"_30":31,"_127":-5,"_41":42,"_40":14,"_128":25,"_38":146,"_13":130,"_33":20,"_35":37,"_24":25,"_131":-5,"_147":148,"_27":149},["D",1779700670115],"children",[],[28],["D",1779657588846],{"_94":93,"_102":98},{"_94":93,"_95":96,"_97":98,"_18":54,"_99":100,"_101":25},{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"ctx",{"_76":-5,"_122":187,"_188":189,"_190":191,"_192":25,"_193":25,"_194":25,"_195":196,"_197":-5,"_198":-7,"_199":-7,"_200":60,"_201":25,"_202":25,"_203":-5,"_204":25,"_205":25,"_206":25,"_207":-5},"ENV",{"_158":159,"_160":161,"_162":84,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets",true,"preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v4