Complete 0.7.1 fixes

CloudronManifest.json

@@ -3,7 +3,7 @@
 	"title": "Sendewerk",
 	"description": "Redaktionelle Planung und Durchführung von heinzlive-Sendungen.",
 	"tagline": "Vom Fundstück bis zur Livesendung",
-	"version": "0.6.0",
+	"version": "0.7.1",
 	"healthCheckPath": "/healthz",
 	"httpPort": 3000,
 	"addons": {

docs/ACCEPTANCE.md

@@ -1,5 +1,81 @@
 # Abnahme
 
+## Wartungsrelease 0.7.1
+
+| Bereich                                              | Nachweis                                                                                                                  | Stand                                                      |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| Abschnittsdauer und Rückkehr zu früheren Pieces (#1) | Live-Verhaltenstests für geänderte Plandauer, Wiederaufnahme, Abschnittslaufzeit und Gesamtzeit; Chromium-Ablauf          | erfüllt am 26.10.2026                                      |
+| Mobiler Live-Ablauf und Metadaten (#3, #13)          | mobile Live-Regie ohne horizontalen Überlauf; viewportgebundenes Sheet, Safe-Area-/Standalone-Basis und Fokus in Chromium | Chromium erfüllt; Safari und installierte iOS-Webapp offen |
+| Mobile Sendungskarten (#5)                           | responsive Karten im vollständigen Chromium-Lauf bei 390 Pixeln geöffnet                                                  | erfüllt am 26.10.2026                                      |
+| Vorbereitung nach Einplanung (#6, #15)               | Migration und Servertest für konkrete Usage-Snapshots; Chromium öffnet die Usage und entfernt sie nach „sendefertig“      | erfüllt am 26.10.2026                                      |
+| Kontextabhängige Präsentation (#8)                   | vier serverseitig getrennte Modi; Fundus-/Usage-Vorschauen sowie Link-, Video-, Text-/Bildausgabe in Chromium             | erfüllt am 26.10.2026                                      |
+| Gastansicht und Freigaben (#11, #12)                 | gestalteter Einzeldialog, Verwaltungsreihenfolge und Kartenpadding per Chromium; Tokenersatz mit Invalidierungstest       | erfüllt am 26.10.2026                                      |
+| Iconsuche (#14)                                      | Suchfokus innerhalb der öffnenden Bedienaktion; Chromium bei mobilen und breiten Ansichten                                | erfüllt am 26.10.2026                                      |
+
+- `npm test`: 60 von 60 Verhaltenstests erfolgreich.
+- `npm run lint`: erfolgreich.
+- `npm run check`: 0 Fehler und 0 Warnungen.
+- `npm run build`: erfolgreich mit `@sveltejs/adapter-node`.
+- `npm run test:e2e`: 19 von 19 Chromium-Abläufen erfolgreich.
+- Safari auf echtem iOS-Gerät: offen.
+- Installierte Webapp auf echtem iOS-Gerät: separat offen.
+
+## Etappe 7
+
+| Kriterium                                    | Nachweis                                                                                                                   | Stand                 |
+| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| Feedverwaltung und geplanter/manueller Abruf | Barkeeper-Oberfläche, Prozess-Scheduler und gemeinsame Abruffunktion                                                       | erfüllt am 25.10.2026 |
+| Getrennter Vorschau-Eingang                  | RSS-Beiträge erscheinen separat und werden nur nach Mehrfachauswahl zu Pieces                                              | erfüllt am 25.10.2026 |
+| Kategoriezuordnung und Herkunft              | Auswahlkategorien oder Feed-Standard sowie Original-URL als Piece-Quelle im Verhaltenstest                                 | erfüllt am 25.10.2026 |
+| Dubletten und dauerhaftes Verwerfen          | wiederholter Testabruf erzeugt keinen zweiten Eintrag und stellt Verworfenes nicht wieder her                              | erfüllt am 25.10.2026 |
+| HTML-Bereinigung und Abrufgrenzen            | Testfeed entfernt fremdes HTML; Loopback wird vor Request blockiert; Größe, Zeit, Redirects und Eintragszahl sind begrenzt | erfüllt am 25.10.2026 |
+| Fehlerisolation                              | defekter lokaler Testfeed wird protokolliert, weiterer fälliger Feed trotzdem importiert                                   | erfüllt am 25.10.2026 |
+| Versionierte REST-API und OpenAPI            | `/api/v1` für Pieces, Sendungen und Einplanungen; `/api/v1/openapi.json`                                                   | erfüllt am 25.10.2026 |
+| Begrenzte und widerrufbare Zugänge           | gehashte Tokens; Verhaltenstest für Lesen, verweigertes Schreiben und sofortigen Widerruf                                  | erfüllt am 25.10.2026 |
+| Änderungsnachweis und Idempotenz             | Audit-Ereignisse und persistente Idempotenz; identische Wiederholung liefert dasselbe Ergebnis                             | erfüllt am 25.10.2026 |
+| API-Rundlauf                                 | echter HTTP-Test: lesen, anlegen, ändern, erneut lesen, einplanen und sortieren                                            | erfüllt am 25.10.2026 |
+| Nutzung ohne KI                              | RSS und API sind optional; bestehende Redaktion funktioniert unverändert ohne externen Client                              | erfüllt am 25.10.2026 |
+| Konkrete ChatGPT-/Codex-Anbindung            | keine Clientumgebung oder Zugangsdaten vorhanden                                                                           | offen                 |
+
+- `npm run check`: 0 Fehler und 0 Warnungen.
+- `npm test`: 58 von 58 Verhaltenstests erfolgreich.
+- Gezielte Etappe-7-Tests: 6 von 6 erfolgreich.
+- `npm run build`: erfolgreich mit `@sveltejs/adapter-node`.
+- `npm audit --omit=dev`: 0 gemeldete Schwachstellen.
+- Gezielte Chromium-Prüfung: Desktop-Verwaltung, mobiler Eingang und kompletter
+  HTTP-API-Rundlauf erfolgreich, keine Konsolenfehler.
+- `npm run test:e2e`: auf dem Standardport wegen eines bereits laufenden fremden
+  Prozesses nicht startbar; identische temporäre Konfiguration auf Port 4188 mit
+  16 von 18 erfolgreichen Abläufen. Bekannte Fehler bleiben bei Live-Zeitanzeige
+  und Abschluss/Freigabe bestehen.
+- `npm run lint`: nicht erfolgreich wegen acht bereits vorhandener
+  Prettier-Abweichungen außerhalb der Etappe-7-Dateien; geänderte Dateien wurden
+  separat formatiert.
+- Dokumentationsstatus: **API/MCP getestet, Client-Anbindung offen**. Konkret ist
+  die REST-API getestet; ein zusätzlicher MCP-Adapter wurde nicht benötigt und
+  keine echte ChatGPT-/Codex-Verbindung hergestellt.
+
+## Wartungsrelease 0.6.1
+
+| Bereich                                              | Stand                                                                                       |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| Live-Timer, Kopfzeile, Drawer und Positionsanzeige   | behoben                                                                                     |
+| Mobile Formulare und Iconsuche                       | behoben                                                                                     |
+| Vorbereitungsaufwand und Übersicht                   | behoben                                                                                     |
+| Bild-Präsentationsmodus                              | behoben                                                                                     |
+| Twitch-Tags je Abschnitt                             | behoben                                                                                     |
+| Sendungskarten und Gastabstände                      | behoben                                                                                     |
+| Gemeinsamer Freigabedialog einschließlich Live-Regie | behoben                                                                                     |
+| Editorzustand und Drag-and-drop                      | bestehende zustandserhaltende bzw. alternative Bedienwege unverändert; Browserprüfung offen |
+
+- `npm run check`: 0 Fehler und 0 Warnungen.
+- `npm test`: 52 von 52 Verhaltenstests erfolgreich.
+- `npm run build`: erfolgreich.
+- `npm run test:e2e`: zweiter Lauf mit 14 erfolgreichen Abläufen; Live-Regie und
+  Abschluss/Freigaben schlugen fehl, zwei nachfolgende Abläufe wurden wegen des
+  120-Sekunden-Zeitlimits nicht mehr ausgeführt. Die Browsermatrix ist offen.
+- Safari auf echtem iOS-Gerät: nicht verfügbar.
+
 ## Etappe 1
 
 | Kriterium                                         | Nachweis                                                                                                                | Stand                        |

docs/ARCHITECTURE.md

@@ -3,7 +3,7 @@
 ## Systemgrenze
 
 Sendewerk ist ein einzelner SvelteKit-Prozess. Browserseiten, serverseitige
-Actions, spätere REST-Endpunkte und Hintergrundaufgaben verwenden dieselbe
+Actions, REST-Endpunkte und Hintergrundaufgaben verwenden dieselbe
 Geschäftslogik. SQLite und ein lokales Upload-Verzeichnis sind die einzigen
 persistenten Laufzeitabhängigkeiten. Externe Mail-, RSS- oder KI-Dienste sind
 nicht Voraussetzung für Kernfunktionen.
@@ -11,7 +11,7 @@ nicht Voraussetzung für Kernfunktionen.
 ```text
 Browser -> SvelteKit-Routen -> Anwendungsdienste -> SQLite
                                 |                -> Upload-Verzeichnis
-                                +-> später: Mail/RSS über Adapter
+                                +-> Mail/RSS über begrenzte Adapter
 ```
 
 Servercode lebt unter `src/lib/server` und darf nicht in Browser-Bundles
@@ -33,13 +33,13 @@ spätere API dieselben Regeln verwenden.
 
 ## Gesamtdatenmodell
 
-Die ersten sechs Etappen materialisieren Identität, Inhaltsverwaltung,
-Sendungsplanung, Live-Durchführung, Historie und Lesefreigaben. Folgende Grenzen
-gelten für umgesetzte und spätere Bereiche.
+Die ersten sieben Etappen materialisieren Identität, Inhaltsverwaltung,
+Sendungsplanung, Live-Durchführung, Historie, Lesefreigaben, RSS-Import und eine
+technische API. Folgende Grenzen gelten für umgesetzte und spätere Bereiche.
 
 | Bereich     | Geplante Entitäten und Beziehungen                                                                                                          |
 | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Identität   | `users`, Rollen, Sessions, Einladungen, Reset-Tokens und Sperren sind umgesetzt; technische Zugänge folgen später                           |
+| Identität   | `users`, Rollen, Sessions, Einladungen, Reset-Tokens und Sperren sowie getrennte technische Zugänge                                         |
 | Taxonomie   | getrennte `section_categories`, `formats`, `topics` samt optionalem Themenicon; Pieces und Vorschläge mehrfach verknüpft                    |
 | Inhalt      | `pieces` mit Status, Soft Delete, Favorit, Revision, Texten, Quellen, Werkzeugen und privaten Medien; Vorlagen speichern Snapshots          |
 | Sendungsbau | `shows`, geordnete `show_sections`, `piece_usages` samt Quellen-/Werkzeug-/Themen-/Mediensnapshots, Reservebank und Vorlagen                |
@@ -99,6 +99,43 @@ konfigurierten Outbox-Pfad, `smtp` nutzt Nodemailer nur nach expliziter Auswahl.
 Die feste Anwendungs-Origin erzeugt Links und bestimmt den `Secure`-Status der
 Cookies; sie wird nicht aus ungeprüften Request-Headern übernommen.
 
+Technische Zugänge sind keine Browsersitzungen. Sie besitzen zufällige
+Bearer-Tokens, von denen nur SHA-256-Hashes gespeichert werden, und genau einen
+der Umfänge `read` oder `read_write`. Widerruf wirkt beim nächsten Request.
+`/api/v1` umgeht lediglich den Browser-Loginredirect; jeder Endpunkt prüft Token
+und erforderlichen Umfang selbst. Schreibzugriffe hinterlassen ein
+`audit_event`; Neuanlage und Planungsänderungen verlangen zusätzlich einen je
+Zugang eindeutigen, persistent gespeicherten Idempotenzschlüssel.
+
+## RSS-Import
+
+`src/lib/server/feeds.ts` bildet Abruf, XML-Verarbeitung und Übernahme gemeinsam
+für manuelle Aktionen und den Prozess-Scheduler ab. Der Scheduler startet beim
+ersten Request und prüft minütlich höchstens zehn fällige aktive Feeds. Jeder
+Feed wird getrennt behandelt, sodass ein Fehler weitere Abrufe nicht stoppt.
+HTTP-Abrufe erlauben nur HTTP(S) auf Standardports, prüfen DNS sowie jedes
+Redirectziel gegen interne Adressen und begrenzen Laufzeit, Redirects und
+Antwortgröße. RSS/Atom wird mit deaktivierter Entity-Verarbeitung gelesen;
+höchstens 200 Einträge je Antwort werden berücksichtigt und fremdes HTML wird zu
+reinem Text reduziert.
+
+`feed_entries` ist ein eigener Eingang. `(feed_id, external_id)` verhindert
+Dubletten; Aktualisierungen ändern den redaktionellen Status nicht. `discarded`
+bleibt deshalb auch nach späteren Abrufen erhalten. Erst die bewusste
+Mehrfachauswahl erzeugt innerhalb einer Transaktion normale Inbox-Pieces mit
+Kategorien und Original-URL als Quelle und setzt den Eintrag auf `imported`.
+
+## Technische REST-API
+
+Die Routen unter `/api/v1` bilden keine zweite Fachlogik, sondern rufen
+`content.ts` und `shows.ts` auf. Piece- und Sendungsrevisionen schützen weiterhin
+vor verlorenen Änderungen. `api_idempotency` speichert Request-Hash, Status und
+JSON-Antwort, sodass wiederholte Schreibbefehle dasselbe Ergebnis liefern und
+ein gleicher Schlüssel mit verändertem Inhalt abgewiesen wird. Die OpenAPI-3.1-
+Beschreibung ist unter `/api/v1/openapi.json` erreichbar. Ein MCP-Adapter oder
+produktspezifischer KI-Client gehört nicht zur Laufzeit und ist nicht
+Voraussetzung für die Bedienung.
+
 ## Inhalte, Markdown und Medien
 
 Etappe 3 führt die Inhaltslogik in `src/lib/server/content.ts` zusammen. Listen
@@ -404,3 +441,27 @@ betroffenen Route und Action geprüft. Markdown und fremdes HTML werden vor
 Ausgabe bereinigt. Uploadzugriff folgt denselben Rechten. Netzwerkabrufe für
 Präsentationsmetadaten und Vorschaubilder schützen interne Ziele auch nach
 DNS-Auflösung und Redirects und besitzen Größen-, Zeit- und Redirectlimits.
+
+## Wartungsfelder 0.6.1
+
+Migration `0017` ergänzt den optionalen Vorbereitungsaufwand am Original und
+kommagetrennt validierte Twitch-Tags am Abschnitt. Der Bildmodus wird wegen der
+bestehenden SQLite-Check-Constraints als zusätzliches Kennzeichen an Original
+und Usage-Snapshot gespeichert; nach außen bleibt er der eindeutige Modus
+`image`. Öffentlich passiert weiterhin nur das ausdrücklich gewählte
+Präsentationsmedium.
+
+## Wartungskorrekturen 0.7.1
+
+Migration `0019` ergänzt `preparation_status_snapshot` und
+`preparation_effort_snapshot` an `piece_usages` und übernimmt für vorhandene
+Einplanungen einmalig die damaligen Originalwerte. Danach ist ausschließlich die
+konkrete Sendungsfassung maßgeblich. Einplanen, Duplizieren und bewusstes
+Aktualisieren aus dem Fundus kopieren beide Werte; der Usage-Editor ändert sie
+unabhängig. Die Übersicht berücksichtigt vorbereitende Nicht-Reserve-Usages
+aktiver Sendungen, priorisiert zuerst deren Termin und führt direkt zum Editor.
+
+Ein Freigabe-Ersatzlink rotiert ausschließlich den gehashten Token derselben
+Freigabe. Umfang, Passwort-Hash und Ablauf bleiben erhalten, der alte Token und
+alle bisherigen Gastsitzungen werden in derselben Transaktion ungültig. Der neue
+Klartexttoken wird weiterhin nur in der Action-Antwort ausgegeben.

docs/DECISIONS.md

@@ -451,3 +451,70 @@ oder URL zu wechseln. Bearbeitungen behalten den Link, invalidieren aber
 vorhandene Passwortsitzungen. Vollständiges Löschen ist der unmittelbare
 Widerruf. Die Sendungsbearbeitung und die zentrale Verwaltung verwenden dieselbe
 Geschäftslogik und bleiben Barkeepern vorbehalten.
+
+## D-028: Additive Wartungsfelder und gemeinsamer Freigabedialog
+
+Vorbereitungsaufwand und Twitch-Tags sind optionale additive Felder. Der neue
+Bildmodus verwendet ein separates boolesches Kennzeichen, damit bestehende
+Tabellen und Daten trotz älterer Modus-Check-Constraints ohne riskanten
+Tabellenumbau erhalten bleiben. Freigabeverwaltung bleibt eine gemeinsame
+Komponente und öffnet in allen drei internen Einstiegen als nativer Dialog.
+
+## D-029: RSS als persistenter Eingang mit begrenztem Abruf
+
+Externe Feeds schreiben nie direkt in den Fundus. Quelle und stabiler
+Eintragsschlüssel werden in einem eigenen Eingang gespeichert; dessen Zustand
+`discarded` oder `imported` wird bei einem erneuten Abruf nicht zurückgesetzt.
+Erst eine bewusste Auswahl erzeugt über `content.ts` ein normales Piece samt
+Originalquelle und gewählten Kategorien. Dadurch bleiben redaktionelle
+Entscheidung, Dublettenschutz und Herkunft nachvollziehbar.
+
+Manueller und geplanter Abruf verwenden denselben Adapter. Wie bei
+Linkmetadaten werden private Ziele, Nichtstandardports und ungeprüfte Redirects
+gesperrt; zusätzlich gelten enge Zeit-, Größen- und Mengenlimits. XML-Entities
+bleiben deaktiviert und fremdes HTML wird nicht gespeichert. Ein Fehler wird am
+betroffenen Feed persistiert und unterbricht keine weiteren fälligen Feeds.
+
+## D-030: Technische Tokens, Scopes und persistente Idempotenz
+
+Externe Assistenz erhält keine simulierte Redaktionssitzung und keine
+Sonderrechte. Eigene zufällige Bearer-Tokens liegen nur gehasht vor, sind sofort
+widerrufbar und erlauben entweder Lesen oder Lesen und Schreiben. REST-Routen
+unter `/api/v1` verwenden die bestehenden Inhalts- und Sendungsdienste, damit
+Validierung, Revisionen und Transaktionen identisch bleiben. Jede erfolgreiche
+Mutation wird mit technischem Akteur, Aktion und Ziel protokolliert.
+
+Neuanlage, Einplanung und Sortierung verlangen einen `Idempotency-Key`.
+Zugang, Schlüssel, Hash des Requestinhalts und vollständige Antwort werden in
+derselben SQLite-Transaktion gespeichert. Eine identische Wiederholung erhält
+dieselbe Antwort; ein veränderter Request mit demselben Schlüssel wird
+abgewiesen. OpenAPI 3.1 beschreibt diese Grenze maschinenlesbar. Ein MCP-Adapter
+oder ein bestimmter KI-Client wird nicht vorgetäuscht: Die Anwendung bleibt ohne
+KI vollständig nutzbar und eine konkrete Client-Verbindung muss separat geprüft
+werden.
+
+## D-031: Usage-basierte Vorbereitung und rotierende Freigabelinks
+
+Die Sendungsübersicht erzeugt keinen zusätzlichen Vorbereitungszustand. Sie
+projiziert konkrete Usage-Snapshots aktiver Sendungen, deren Fundus-Original noch
+`preparing` ist. So bleiben bestehende Daten und Snapshots unverändert, während
+ungeplante Fundus-Arbeit aus der Sendungsübersicht verschwindet.
+
+Weil Freigabetokens nur gehasht gespeichert werden, kann ein bestehender Link
+nicht erneut angezeigt werden. Ein Ersatzlink rotiert deshalb den Token derselben
+Freigabe transaktional und löscht alle Gastsitzungen; Sichtumfang, Passwort und
+Ablauf werden nicht stillschweigend verändert.
+
+## D-032: Vorbereitung als Eigenschaft der konkreten Einplanung
+
+Die erste 0.7.1-Umsetzung aus D-031 leitete den Vorbereitungszustand noch vom
+veränderlichen Fundus-Original ab. Das widerspricht der bestehenden Kopierregel
+für Sendungsfassungen und verhindert unterschiedliche Arbeitsstände bei
+Mehrfachverwendung. D-032 ersetzt deshalb diesen Teil von D-031: Status und
+Aufwand werden mit Migration `0019` additiv an `piece_usages` gespeichert.
+
+Vorbereitende und sendefertige Originale dürfen eingeplant werden. Einplanung,
+Duplikation und ausdrückliches Aktualisieren kopieren den Zustand, während der
+Usage-Editor ihn danach unabhängig ändert. `piece_usages.status` bleibt davon
+getrennt und beschreibt weiterhin ausschließlich den Livezustand `open`,
+`current`, `done` oder `skipped`.

docs/RELEASE_NOTES.md

@@ -1,5 +1,67 @@
 # Release Notes
 
+## 0.7.1 - Bedienung und Live-Korrekturen
+
+Veröffentlicht am 25. Oktober 2026, Korrekturstand 26. Oktober 2026
+
+- Live-Abschnittszeiten übernehmen geänderte Plandauern. Frühere erledigte oder
+  übersprungene Pieces können offiziell wiederaufgenommen werden, ohne ihre
+  Abschnittslaufzeit oder die Gesamtzeit zurückzusetzen (#1).
+- Mobiler Live-Ablauf, lange Metadaten und Sendungskarten halten ihre verfügbare
+  Breite ein. Der Ablauf bleibt als fokussierbares Sheet bedienbar (#3, #5, #13).
+- „Noch vorzubereiten“ speichert Status und Aufwand an der konkreten Einplanung,
+  priorisiert aktive Sendungen nach Termin und verlinkt mit den Themenicons direkt
+  in den Usage-Editor. Vorbereitende Originale können regulär eingeplant werden;
+  Mehrfachverwendungen bleiben unabhängig (#6, #15).
+- Fundus- und Usage-Editor unterscheiden Text, Nur Bild, Linkvorschau und Video
+  durch kontextsensitive Eingaben und passende Vorschauen (#8).
+- Gast- und historische Abschnitte besitzen klar gepolsterte äußere Glaskarten.
+  Die Freigabeverwaltung liegt direkt vor dem Werkzeugkatalog; der gemeinsame
+  Dialog und seine Formfelder folgen ohne nativen Doppelrahmen dem Sendewerk-
+  Design. Einmalige Links lassen sich kopieren und sicher ersetzen (#11, #12).
+- Die Iconsuche ist nach dem Öffnen sofort sichtbar und fokussiert (#14).
+- RSS-Feeds und technische Zugänge verwenden in der Verwaltung kompakte
+  Hinzufügen-Einstiege und dieselbe visuelle Listenlogik wie der Werkzeugkatalog.
+- Mobiles Live-Sheet und Backdrop sind am Viewport verankert. Viewport-Fit,
+  Standalone-Metadaten und Web-App-Manifest aktivieren iOS-Safe-Areas; ein echter
+  Safari-/Home-Bildschirm-Test bleibt mangels Gerät offen (#3, #13).
+- Paket, Lockdatei und Cloudron-Manifest tragen Version `0.7.1`. Migration
+  `0019_usage_preparation.sql` ergänzt additive Usage-Snapshots. 60
+  Verhaltenstests und 19 Chromium-Abläufe sind
+  erfolgreich; echtes Safari und die installierte Webapp auf iOS bleiben offen.
+
+## 0.7.0 - RSS-Import und externe Assistenz
+
+Veröffentlicht am 25. Oktober 2026
+
+- Barkeeper verwalten RSS-/Atom-Feeds mit Intervall und Standardkategorie;
+  sichere manuelle und geplante Abrufe laufen fehlerisoliert.
+- Neue Beiträge landen in einem getrennten Auswahlbereich im Eingang. Erst eine
+  bewusste Übernahme erzeugt Pieces, während dauerhaftes Verwerfen, Herkunft,
+  Kategorien und Dublettenschutz erhalten bleiben.
+- Abrufe sperren interne Ziele und begrenzen Ports, Redirects, Laufzeit,
+  Antwortgröße und Eintragszahl. Fremdes Feed-HTML wird zu Text bereinigt.
+- Die versionierte REST-API `/api/v1` liest und ändert Pieces, Sendungen und
+  Einplanungen über getrennte technische Lese- oder Schreibzugänge.
+- Technische Tokens werden nur einmal gezeigt und gehasht gespeichert. Widerruf,
+  Audit-Ereignisse, Revisionen und persistente Idempotenz schützen Änderungen.
+- `/api/v1/openapi.json` beschreibt die Schnittstelle für externe Clients.
+  Sendewerk bleibt ohne KI nutzbar; eine konkrete ChatGPT-/Codex-Anbindung ist
+  weiterhin offen.
+- Migration `0018_rss_and_api.sql` ergänzt Feed-, Zugangs-, Audit- und
+  Idempotenzdaten. Paket, Lockdatei und Cloudron-Manifest tragen Version `0.7.0`.
+
+## 0.6.1 - Redaktionelle Wartung
+
+Veröffentlicht am 25. Oktober 2026
+
+- Live-Countdowns übernehmen geänderte Abschnittsplanzeiten, ohne Laufzeit zu verlieren; die mobile Regie gruppiert ihre Kopfaktionen robuster und zeigt den Ablauf als oberstes Sheet.
+- Mobile Formularfelder und die Iconsuche vermeiden iOS-Fokuszoom; Sendungskarten und Gastansicht erhalten klarere Abstände.
+- Pieces führen optionalen Vorbereitungsaufwand, die Sendungsübersicht bündelt offene Vorbereitung und Abschnitte speichern kopierbare Twitch-Tags.
+- Präsentationen können ein ausdrücklich gewähltes Bild ohne Begleittext ausgeben; Originale und Sendungsfassungen bleiben getrennte Snapshots.
+- Lesefreigaben öffnen in Sendung, Verwaltung und Live-Regie über denselben Dialog.
+- Migration `0017_maintenance_fields.sql` ergänzt ausschließlich optionale, rückwärtskompatible Felder.
+
 ## 0.6.0 - Abschluss, Archiv und Freigaben
 
 Veröffentlicht am 25. Oktober 2026

docs/STATUS.md

@@ -2,10 +2,85 @@
 
 ## Aktueller Umfang
 
-Etappe 1 bis Etappe 6 sind abgeschlossen. Architektur, Gesamtdatenmodell,
+Etappe 1 bis Etappe 7 sind abgeschlossen. Architektur, Gesamtdatenmodell,
 Anmeldung, Rollen, persistente Inhaltsbearbeitung, Sendungsplanung,
 Live-Steuerung, Präsentationsausgabe, unveränderliche Sendungshistorie,
-Archiv und sichere Lesefreigaben sind dokumentiert.
+Archiv, sichere Lesefreigaben, RSS-Import und technische REST-Zugänge sind
+dokumentiert.
+
+## Fehlerkorrekturen 0.7.1
+
+- Explizite Abschnittsdauern werden während der Live-Regie nach Änderungen
+  synchronisiert. Erledigte oder übersprungene Pieces lassen sich bewusst
+  wiederaufnehmen; frühere Abschnitts- und Gesamtzeiten bleiben dabei erhalten.
+- Der mobile Ablauf liegt innerhalb eines isolierten Live-Containers, lange
+  Metadaten verbreitern die Regie nicht mehr und das Sheet ist am mobilen
+  Viewport verankert. `viewport-fit=cover`, Standalone-Metadaten und Manifest
+  aktivieren Safe Areas auch beim Start vom Home-Bildschirm. Sendungskarten
+  stapeln ihre Inhalte auf kleinen Bildschirmen eindeutig.
+- Die Vorbereitung liegt als eigener Status- und Aufwandsnapshot an der konkreten
+  Einplanung. Vorbereitende Fundus-Pieces lassen sich planen; Originaländerungen,
+  Duplikation und bewusste Aktualisierung folgen der bestehenden Snapshotregel.
+  Usage-Titel, Sendung, Abschnitt, Termin und Themenicons führen direkt in den
+  Usage-Editor; „sendefertig“ entfernt die Fassung aus der Übersicht.
+- Text, Nur Bild, Linkvorschau und Video besitzen in Fundus- und Usage-Editor
+  kontextsensitive Felder und Vorschauen. Ausgeblendete Werte bleiben beim
+  Moduswechsel erhalten.
+- Die Iconsuche fokussiert innerhalb der öffnenden Klick-/Tastaturaktion das
+  Suchfeld. RSS-Feeds und technische Zugänge verwenden gestaltete Formfelder.
+- Lesefreigaben öffnen nach Serverantworten wieder mit dem einmalig sichtbaren
+  Link, bieten Kopieren und sichere Ersatzlinks. Ersatzlinks invalidieren den
+  alten Token und dessen Gastsitzungen. Die Verwaltung zeigt Freigaben direkt
+  vor dem Werkzeugkatalog; der Dialog besitzt nur eine gestaltete Glasfläche.
+  Gast- und historische Abschnitte besitzen äußere Karten mit Innenabstand.
+
+Geprüft wurden 60 von 60 Verhaltenstests, Lint, Typprüfung, Produktionsbuild und
+19 von 19 Chromium-Abläufe. Die Browsermatrix öffnete beide Piece-Editoren,
+Sendungsübersicht, Verwaltung und Freigabedialoge, Gastansicht sowie Live-Regie
+bei Desktop- und Mobilbreiten. Safari und die installierte Webapp auf einem
+echten iOS-Gerät bleiben mangels Gerät getrennt offen.
+
+## RSS-Import und externe Assistenz 0.7.0
+
+- Barkeeper verwalten RSS-/Atom-Feeds mit Standardkategorie, Aktivierung und
+  Abrufintervall; manueller Abruf und ein begrenzter Prozess-Scheduler verwenden
+  dieselbe Fehler- und Dublettenlogik.
+- Feedabrufe prüfen Protokoll, Port, DNS und Redirects, begrenzen Laufzeit,
+  Antwortgröße und Eintragszahl und lassen Fehler anderer Feeds unberührt.
+- Fremdes HTML wird entfernt. Beiträge bleiben mit stabiler Herkunft im
+  getrennten Importeingang, bis die Redaktion sie auswählt, kategorisiert und
+  als normale Pieces übernimmt oder dauerhaft verwirft.
+- `/api/v1` bietet Pieces und Sendungen über gehashte, widerrufbare technische
+  Bearer-Tokens mit reinen Lese- oder Lese-/Schreibrechten an. Mutationen nutzen
+  bestehende Dienste, Audit-Ereignisse, Revisionen und persistente
+  Idempotenzschlüssel.
+- Die maschinenlesbare Beschreibung liegt unter `/api/v1/openapi.json`; eine
+  ChatGPT-/Codex- oder andere konkrete Client-Anbindung wurde nicht eingerichtet.
+- Migration `0018_rss_and_api.sql` ergänzt ausschließlich additive Tabellen und
+  Indizes. Sendewerk bleibt ohne KI und ohne konfigurierte Feeds vollständig
+  nutzbar.
+
+Geprüft wurden 58 Verhaltenstests, Typprüfung, Produktionsbuild, Dependency-
+Audit, vier RSS- und zwei Zugangssicherheitstests sowie ein echter HTTP-Rundlauf
+lesen → anlegen → idempotent wiederholen → ändern → erneut lesen → einplanen →
+sortieren. Desktop-Verwaltung und mobiler Eingang wurden in Chromium ohne
+Konsolenfehler geprüft. In der bestehenden Gesamtmatrix waren 16 von 18 Abläufen
+erfolgreich; die bereits bekannte Live-Zeitanzeige und der Ablauf
+Abschluss/Freigabe schlugen weiterhin fehl. Der globale Lintlauf bleibt an acht
+vorhandenen Formatierungsabweichungen außerhalb dieser Etappe offen.
+
+## Wartungsrelease 0.6.1
+
+- Abschnitts-Countdown, mobile Live-Kopfzeile und Ablauf-Sheet wurden korrigiert; die doppelte Piece-Positionsanzeige entfällt.
+- Optionaler Vorbereitungsaufwand, kompakte Vorbereitungsliste und Abschnitts-Twitch-Tags sind additiv persistiert.
+- Der Präsentationsmodus `image` gibt ausschließlich das bewusst gewählte Snapshot-Medium aus.
+- Mobile Eingaben, Iconsuche, Sendungskarten und Gastabstände wurden angepasst.
+- Lesefreigaben verwenden einen gemeinsamen Dialog und sind auch aus der Live-Regie erreichbar.
+
+Geprüft wurden 52 Verhaltenstests, Typprüfung und Produktionsbuild. Im zweiten
+Chromium-Lauf waren 14 Abläufe erfolgreich; zwei Abläufe schlugen vor dem
+Zeitlimit fehl, zwei weitere wurden nicht mehr ausgeführt. Die vollständige
+Browsermatrix bleibt damit offen.
 
 ## Abschluss, Archiv und Freigaben 0.6.0
 

migrations/0017_maintenance_fields.sql

@@ -0,0 +1,10 @@
+ALTER TABLE pieces ADD COLUMN preparation_effort TEXT CHECK (
+	preparation_effort IS NULL OR preparation_effort IN ('low', 'medium', 'high')
+);
+ALTER TABLE pieces ADD COLUMN presentation_image_only INTEGER NOT NULL DEFAULT 0
+	CHECK (presentation_image_only IN (0, 1));
+ALTER TABLE piece_usages ADD COLUMN presentation_image_only_snapshot INTEGER NOT NULL DEFAULT 0
+	CHECK (presentation_image_only_snapshot IN (0, 1));
+
+ALTER TABLE show_sections ADD COLUMN twitch_tags TEXT NOT NULL DEFAULT '';
+ALTER TABLE show_template_sections ADD COLUMN twitch_tags TEXT NOT NULL DEFAULT '';

migrations/0018_rss_and_api.sql

@@ -0,0 +1,66 @@
+CREATE TABLE feed_sources (
+	id TEXT PRIMARY KEY,
+	name TEXT NOT NULL UNIQUE,
+	url TEXT NOT NULL UNIQUE,
+	is_enabled INTEGER NOT NULL DEFAULT 1 CHECK (is_enabled IN (0, 1)),
+	refresh_interval_minutes INTEGER NOT NULL DEFAULT 60 CHECK (refresh_interval_minutes BETWEEN 15 AND 10080),
+	default_category_id TEXT REFERENCES section_categories(id) ON DELETE SET NULL,
+	etag TEXT NOT NULL DEFAULT '',
+	last_modified TEXT NOT NULL DEFAULT '',
+	last_fetched_at_utc TEXT,
+	next_fetch_at_utc TEXT,
+	last_error TEXT NOT NULL DEFAULT '',
+	created_at_utc TEXT NOT NULL,
+	updated_at_utc TEXT NOT NULL
+);
+
+CREATE TABLE feed_entries (
+	id TEXT PRIMARY KEY,
+	feed_id TEXT NOT NULL REFERENCES feed_sources(id) ON DELETE CASCADE,
+	external_id TEXT NOT NULL,
+	title TEXT NOT NULL,
+	url TEXT NOT NULL,
+	summary TEXT NOT NULL DEFAULT '',
+	published_at_utc TEXT,
+	status TEXT NOT NULL DEFAULT 'new' CHECK (status IN ('new', 'imported', 'discarded')),
+	piece_id TEXT REFERENCES pieces(id) ON DELETE SET NULL,
+	first_seen_at_utc TEXT NOT NULL,
+	updated_at_utc TEXT NOT NULL,
+	UNIQUE (feed_id, external_id)
+);
+
+CREATE INDEX feed_entries_status_idx ON feed_entries(status, first_seen_at_utc DESC);
+CREATE INDEX feed_sources_due_idx ON feed_sources(is_enabled, next_fetch_at_utc);
+
+CREATE TABLE technical_accesses (
+	id TEXT PRIMARY KEY,
+	name TEXT NOT NULL UNIQUE,
+	token_hash TEXT NOT NULL UNIQUE,
+	permissions TEXT NOT NULL CHECK (permissions IN ('read', 'read_write')),
+	created_by_user_id TEXT NOT NULL REFERENCES users(id),
+	created_at_utc TEXT NOT NULL,
+	last_used_at_utc TEXT,
+	revoked_at_utc TEXT
+);
+
+CREATE TABLE api_idempotency (
+	access_id TEXT NOT NULL REFERENCES technical_accesses(id) ON DELETE CASCADE,
+	request_key TEXT NOT NULL,
+	request_hash TEXT NOT NULL,
+	status_code INTEGER NOT NULL,
+	response_json TEXT NOT NULL CHECK (json_valid(response_json)),
+	created_at_utc TEXT NOT NULL,
+	PRIMARY KEY (access_id, request_key)
+);
+
+CREATE TABLE audit_events (
+	id TEXT PRIMARY KEY,
+	actor_type TEXT NOT NULL CHECK (actor_type IN ('user', 'technical')),
+	actor_id TEXT NOT NULL,
+	action TEXT NOT NULL,
+	target_type TEXT NOT NULL,
+	target_id TEXT NOT NULL,
+	created_at_utc TEXT NOT NULL
+);
+
+CREATE INDEX audit_events_created_idx ON audit_events(created_at_utc DESC);

migrations/0019_usage_preparation.sql

@@ -0,0 +1,17 @@
+ALTER TABLE piece_usages ADD COLUMN preparation_status_snapshot TEXT NOT NULL DEFAULT 'ready'
+	CHECK (preparation_status_snapshot IN ('preparing', 'ready'));
+
+ALTER TABLE piece_usages ADD COLUMN preparation_effort_snapshot TEXT
+	CHECK (preparation_effort_snapshot IS NULL OR preparation_effort_snapshot IN ('low', 'medium', 'high'));
+
+UPDATE piece_usages
+SET preparation_status_snapshot = CASE
+		WHEN EXISTS (
+			SELECT 1 FROM pieces p
+			WHERE p.id = piece_usages.original_piece_id AND p.status = 'preparing'
+		) THEN 'preparing'
+		ELSE 'ready'
+	END,
+	preparation_effort_snapshot = (
+		SELECT p.preparation_effort FROM pieces p WHERE p.id = piece_usages.original_piece_id
+	);

package-lock.json

@@ -1,15 +1,16 @@
 {
 	"name": "sendewerk",
-	"version": "0.6.0",
+	"version": "0.7.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "sendewerk",
-			"version": "0.6.0",
+			"version": "0.7.1",
 			"dependencies": {
 				"@node-rs/argon2": "^2.2.2",
 				"better-sqlite3": "^13.0.3",
+				"fast-xml-parser": "^5.11.2",
 				"file-type": "^22.2.0",
 				"marked": "^18.1.1",
 				"metascraper": "^5.58.5",
@@ -599,6 +600,18 @@
 				"node": ">= 22.13"
 			}
 		},
+		"node_modules/@nodable/entities": {
+			"version": "3.1.0",
+			"resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-3.1.0.tgz",
+			"integrity": "sha512-LsS/DjHr+uDM647Gru/cA8+J3a3HfhttwCKLyuoyN7yXTFCxKBtSgMQBvrW9yNPa2/zDRUNuGPaH5QUFoa4arQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/nodable"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/@node-rs/argon2": {
 			"version": "2.2.2",
 			"resolved": "https://registry.npmjs.org/@node-rs/argon2/-/argon2-2.2.2.tgz",
@@ -1630,6 +1643,18 @@
 				"url": "https://github.com/sponsors/epoberezkin"
 			}
 		},
+		"node_modules/anynum": {
+			"version": "1.0.1",
+			"resolved": "https://registry.npmjs.org/anynum/-/anynum-1.0.1.tgz",
+			"integrity": "sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/aria-query": {
 			"version": "5.3.1",
 			"resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
@@ -2689,6 +2714,45 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/fast-xml-builder": {
+			"version": "1.3.1",
+			"resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.1.tgz",
+			"integrity": "sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"path-expression-matcher": "^1.6.2",
+				"xml-naming": "^0.3.0"
+			}
+		},
+		"node_modules/fast-xml-parser": {
+			"version": "5.11.2",
+			"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.11.2.tgz",
+			"integrity": "sha512-R9iDuNrQYeQut46cn2r2wHKn4HYzVDvDm5J1wW+koZewykv0yuO2HChTYeZtrULyHIDM9cj9TUXloCsueCQUog==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"@nodable/entities": "^3.0.1",
+				"fast-xml-builder": "^1.2.0",
+				"is-unsafe": "^2.0.0",
+				"path-expression-matcher": "^1.6.2",
+				"strnum": "^2.4.2",
+				"xml-naming": "^0.3.0"
+			},
+			"bin": {
+				"fxparser": "src/cli/cli.js"
+			}
+		},
 		"node_modules/fdir": {
 			"version": "6.5.0",
 			"resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -3055,6 +3119,18 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/is-unsafe": {
+			"version": "2.0.2",
+			"resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.2.tgz",
+			"integrity": "sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/is-uri": {
 			"version": "1.2.14",
 			"resolved": "https://registry.npmjs.org/is-uri/-/is-uri-1.2.14.tgz",
@@ -4052,6 +4128,21 @@
 				"node": ">=8"
 			}
 		},
+		"node_modules/path-expression-matcher": {
+			"version": "1.6.2",
+			"resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.6.2.tgz",
+			"integrity": "sha512-enSlaiat05iasnzmgNxRj8reFdj3puY2QpNgP1aPIaVfT6nn9ICuPoFlKHk8EN22HcwewshO+mN2DGbkCEOtqQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"engines": {
+				"node": ">=14.0.0"
+			}
+		},
 		"node_modules/path-key": {
 			"version": "3.1.1",
 			"resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -4545,6 +4636,21 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/strnum": {
+			"version": "2.5.1",
+			"resolved": "https://registry.npmjs.org/strnum/-/strnum-2.5.1.tgz",
+			"integrity": "sha512-UM4nTLWzQiDBseVxUGxN0wJzIk0UU89Qi7pKXz9qISo+lhviJikTuikBsK/oFRlpvYHvSdz0TVoLyQ+sEpYwxA==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"anynum": "^1.0.1"
+			}
+		},
 		"node_modules/strtok3": {
 			"version": "10.6.2",
 			"resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.6.2.tgz",
@@ -5284,6 +5390,21 @@
 				"node": ">=18"
 			}
 		},
+		"node_modules/xml-naming": {
+			"version": "0.3.0",
+			"resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.3.0.tgz",
+			"integrity": "sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"engines": {
+				"node": ">=16.0.0"
+			}
+		},
 		"node_modules/xmlchars": {
 			"version": "2.2.0",
 			"resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "sendewerk",
 	"private": true,
-	"version": "0.6.0",
+	"version": "0.7.1",
 	"type": "module",
 	"engines": {
 		"node": ">=22.17 <25"
@@ -26,6 +26,7 @@
 	"dependencies": {
 		"@node-rs/argon2": "^2.2.2",
 		"better-sqlite3": "^13.0.3",
+		"fast-xml-parser": "^5.11.2",
 		"file-type": "^22.2.0",
 		"marked": "^18.1.1",
 		"metascraper": "^5.58.5",

src/app.css

@@ -113,10 +113,51 @@
 }
 
 .share-management {
-	margin-bottom: 1.5rem;
+	max-height: min(82dvh, 54rem);
+	padding: clamp(1rem, 2.5vw, 1.4rem);
+	overflow-y: auto;
+}
+
+.share-management-dialog {
+	width: min(64rem, calc(100% - 2rem));
+	max-width: none;
+	max-height: none;
+	margin: auto;
+	padding: 0;
+	border: 1px solid var(--line-strong);
+	border-radius: var(--radius-large);
+	background: color-mix(in srgb, var(--bg-elevated) 94%, transparent);
+	box-shadow: var(--shadow);
+	color: var(--text);
+	overflow: hidden;
+	backdrop-filter: blur(24px) saturate(1.12);
+}
+
+.share-management-dialog::backdrop {
+	background: rgb(3 8 16 / 58%);
+	backdrop-filter: blur(5px);
+}
+
+.share-catalog-panel {
+	display: grid;
+	gap: 0.75rem;
+	margin-bottom: 0.75rem;
 	padding: 1rem;
 }
 
+.share-catalog-panel .panel-heading {
+	margin: 0;
+}
+
+.share-catalog-panel h2 {
+	margin: 0.15rem 0 0;
+	font-size: 1rem;
+}
+
+.share-catalog-panel .catalog-note {
+	margin: 0;
+}
+
 .share-create-form {
 	display: grid;
 	grid-template-columns: repeat(auto-fit, minmax(min(100%, 11rem), 1fr));
@@ -133,6 +174,28 @@
 	font-weight: 700;
 }
 
+.share-create-form :is(input, select),
+.share-edit-form :is(input, select),
+.integration-form :is(input, select) {
+	width: 100%;
+	min-width: 0;
+	min-height: 2.65rem;
+	padding: 0.55rem 0.7rem;
+	border: 1px solid var(--line-strong);
+	border-radius: var(--radius-small);
+	background: var(--field);
+	color: var(--text);
+	font: inherit;
+}
+
+.share-create-form :is(input, select):focus-visible,
+.share-edit-form :is(input, select):focus-visible,
+.integration-form :is(input, select):focus-visible {
+	border-color: var(--accent);
+	outline: 2px solid color-mix(in srgb, var(--accent) 30%, transparent);
+	outline-offset: 1px;
+}
+
 .share-create-form button {
 	align-self: end;
 }
@@ -262,6 +325,13 @@
 	overflow-wrap: anywhere;
 }
 
+.share-result > div {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: 0.75rem;
+}
+
 .guest-shell {
 	min-height: 100dvh;
 }
@@ -294,6 +364,14 @@
 	margin-top: 1.25rem;
 }
 
+.shared-section {
+	padding: clamp(1rem, 2.5vw, 1.35rem);
+}
+
+.historical-section {
+	padding: clamp(1rem, 2.5vw, 1.35rem);
+}
+
 .shared-section > header,
 .historical-section > header,
 .shared-usage-heading,
@@ -328,6 +406,18 @@
 	object-fit: contain;
 }
 
+.output-image-only {
+	display: grid;
+	height: 100%;
+	place-items: center;
+}
+
+.output-image-only img {
+	width: 100%;
+	height: 100%;
+	object-fit: contain;
+}
+
 .shared-copy,
 .historical-usage section,
 .historical-usage details {
@@ -1304,6 +1394,7 @@ textarea:focus {
 }
 
 .live-controller-shell {
+	height: 100vh;
 	height: 100dvh;
 	min-height: 0;
 	margin-left: 0 !important;
@@ -1313,7 +1404,10 @@ textarea:focus {
 
 .live-page {
 	display: grid;
+	position: relative;
+	isolation: isolate;
 	width: 100%;
+	height: 100vh;
 	height: 100dvh;
 	grid-template-rows: auto auto minmax(0, 1fr) auto;
 	gap: 0.55rem;
@@ -1784,7 +1878,7 @@ textarea:focus {
 
 .live-piece-heading {
 	display: grid;
-	grid-template-columns: auto minmax(0, 1fr) auto;
+	grid-template-columns: minmax(0, 1fr) auto;
 	align-items: baseline;
 	gap: 0.35rem 0.65rem;
 	padding-bottom: 0.5rem;
@@ -1807,6 +1901,7 @@ textarea:focus {
 }
 
 .live-current h1 {
+	min-width: 0;
 	max-width: none;
 	margin: 0;
 	font-size: clamp(1.2rem, 2.2vw, 1.9rem);
@@ -2382,7 +2477,7 @@ textarea:focus {
 		z-index: 80;
 		inset: max(0.4rem, env(safe-area-inset-top)) max(0.4rem, env(safe-area-inset-right))
 			max(0.4rem, env(safe-area-inset-bottom)) auto;
-		width: min(22rem, calc(100vw - 0.8rem - env(safe-area-inset-left)));
+		width: min(22rem, calc(100% - 0.8rem - env(safe-area-inset-left)));
 		transform: translateX(calc(100% + 1rem));
 		visibility: hidden;
 		transition:
@@ -2419,9 +2514,16 @@ textarea:focus {
 	}
 
 	.live-piece-heading {
+		min-width: 0;
 		gap: 0.3rem 0.45rem;
 	}
 
+	.live-piece-time {
+		max-width: 8rem;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+
 	.live-support-actions {
 		display: grid;
 	}
@@ -4731,6 +4833,58 @@ textarea:focus {
 	gap: 0.5rem;
 }
 
+.preparation-list {
+	display: grid;
+	grid-template-columns: repeat(auto-fit, minmax(min(18rem, 100%), 1fr));
+	gap: 0.5rem;
+}
+
+.preparation-list a {
+	display: flex;
+	min-width: 0;
+	align-items: center;
+	justify-content: space-between;
+	gap: 0.75rem;
+	padding: 0.7rem 0.8rem;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-medium);
+	background: var(--panel-soft);
+}
+
+.preparation-copy,
+.preparation-copy > span:last-child {
+	display: grid;
+	min-width: 0;
+}
+
+.preparation-copy {
+	grid-template-columns: auto minmax(0, 1fr);
+	align-items: center;
+	gap: 0.6rem;
+}
+
+.preparation-topics {
+	display: flex;
+	gap: 0.2rem;
+	color: var(--accent-text);
+}
+
+.preparation-list small {
+	overflow: hidden;
+	color: var(--text-muted);
+	font-size: 0.68rem;
+	text-overflow: ellipsis;
+	white-space: nowrap;
+}
+
+.effort {
+	padding: 0.2rem 0.45rem;
+	border-radius: 2rem;
+	background: var(--panel-strong);
+	color: var(--text-muted);
+	font-size: 0.62rem;
+}
+
 .show-card {
 	display: flex;
 	align-items: center;
@@ -6427,6 +6581,21 @@ textarea:focus {
 		flex-direction: column;
 		gap: 0.75rem;
 	}
+	input:not([type='checkbox']):not([type='radio']):not([type='hidden']),
+	select,
+	textarea,
+	.icon-picker-popover input[type='search'] {
+		font-size: 1rem;
+	}
+	.icon-picker-popover {
+		display: grid;
+		max-height: calc(100dvh - var(--mobile-header) - var(--mobile-nav) - 1rem);
+		grid-template-rows: auto minmax(0, 1fr) auto;
+	}
+	.icon-picker-grid {
+		min-height: 0;
+		overflow-y: auto;
+	}
 	.usage-editor-dialog {
 		width: calc(100vw - 1rem);
 		max-height: calc(100dvh - 1rem);
@@ -6676,6 +6845,10 @@ textarea:focus {
 	.show-card-facts {
 		align-items: flex-start;
 	}
+	.show-card {
+		flex-direction: column;
+		align-items: stretch;
+	}
 	.show-card-facts {
 		flex-direction: row;
 		align-items: center;
@@ -7361,6 +7534,18 @@ body:has(.heinzlive-output.empty),
 			calc(0.5rem + env(safe-area-inset-left));
 		width: auto;
 		max-height: none;
+		display: grid;
+		grid-template-rows: auto minmax(0, 1fr) auto;
+		overflow: hidden;
+	}
+
+	.icon-picker-popover input[type='search'] {
+		font-size: 1rem;
+	}
+
+	.icon-picker-grid {
+		min-height: 0;
+		overflow-y: auto;
 	}
 
 	.piece-subsection-heading .choice-picker-popover {

src/app.html

@@ -2,8 +2,12 @@
 <html lang="de" data-theme="light" data-theme-preference="system">
 	<head>
 		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
 		<meta name="theme-color" content="#f4f1eb" />
+		<meta name="apple-mobile-web-app-capable" content="yes" />
+		<meta name="apple-mobile-web-app-status-bar-style" content="default" />
+		<meta name="apple-mobile-web-app-title" content="Sendewerk" />
+		<link rel="manifest" href="%sveltekit.assets%/manifest.webmanifest" />
 		<script>
 			(function () {
 				try {

src/hooks.server.ts

@@ -2,6 +2,7 @@ import { randomBytes } from 'node:crypto';
 import { redirect } from '@sveltejs/kit';
 import type { Handle } from '@sveltejs/kit/hooks';
 import { deleteSession, getSessionUser, hasUsers, SESSION_COOKIE } from '#lib/server/auth.js';
+import { startFeedScheduler } from '#lib/server/feeds.js';
 
 const publicPaths = new Set([
 	'/',
@@ -14,9 +15,11 @@ const publicPaths = new Set([
 ]);
 
 export const handle: Handle = async ({ event, resolve }) => {
+	startFeedScheduler();
 	const presentationPath = event.url.pathname.startsWith('/heinzlive/');
 	const sharePath = event.url.pathname.startsWith('/freigabe/');
 	const shareMediaPath = /^\/freigabe\/[^/]+\/media\/[^/]+$/.test(event.url.pathname);
+	const apiPath = event.url.pathname.startsWith('/api/v1/');
 	const presentationTestPath = /^\/fundus\/[^/]+\/praesentation(?:\/|$)/.test(event.url.pathname);
 	const token = event.cookies.get(SESSION_COOKIE);
 	event.locals.user = getSessionUser(token);
@@ -26,6 +29,7 @@ export const handle: Handle = async ({ event, resolve }) => {
 		!presentationPath &&
 		!sharePath &&
 		!publicPaths.has(event.url.pathname) &&
+		!apiPath &&
 		!event.locals.user
 	) {
 		redirect(303, hasUsers() ? '/login' : '/setup');

src/lib/components/IconPicker.svelte

@@ -6,6 +6,7 @@
 		$props();
 	let query = $state('');
 	let menu: HTMLDetailsElement;
+	let searchInput: HTMLInputElement;
 	let filtered = $derived(
 		classicRegularIcons.filter((icon) =>
 			`${icon.name} ${icon.label} ${icon.terms.join(' ')}`
@@ -14,18 +15,31 @@
 		)
 	);
 	let visible = $derived(filtered.slice(0, 120));
+
+	function openAndFocus(event: MouseEvent) {
+		if (menu.open) return;
+		event.preventDefault();
+		menu.open = true;
+		searchInput.focus({ preventScroll: true });
+	}
 </script>
 
 <div class="icon-picker">
 	<input type="hidden" name={inputName} value={name} />
-	<details bind:this={menu}>
-		<summary><AppIcon name={name || 'circle'} /> Icon auswählen</summary>
+	<details
+		bind:this={menu}
+		ontoggle={() => {
+			if (menu.open) queueMicrotask(() => searchInput.focus());
+		}}
+	>
+		<summary onclick={openAndFocus}><AppIcon name={name || 'circle'} /> Icon auswählen</summary>
 		<div class="icon-picker-popover">
 			<label
 				><span class="sr-only">Icons durchsuchen</span><input
 					type="search"
 					placeholder="Icon suchen"
 					bind:value={query}
+					bind:this={searchInput}
 				/></label
 			>
 			<div class="icon-picker-grid">

src/lib/components/PresentationDisplay.svelte

@@ -60,6 +60,10 @@
 				{/each}
 			</footer>{/if}
 	</article>
+{:else if content.mode === 'image'}
+	<article class="output-content output-image-only">
+		{#if imageSrc}<img src={imageSrc} alt={content.images?.[0]?.altText ?? content.title} />{/if}
+	</article>
 {:else if content.mode === 'link'}
 	<article class="output-content output-link-card">
 		{#if imageSrc && !imageUnavailable}<div class="output-link-image">

src/lib/components/ShareManagement.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { resolve } from '$app/paths';
+	import { onMount } from 'svelte';
 	import AppIcon from './AppIcon.svelte';
 
 	type ShareShow = {
@@ -26,12 +27,19 @@
 		shows,
 		shares,
 		fixedShowId = '',
+		catalogPanel = false,
 		form = null
 	}: {
 		shows: ShareShow[];
 		shares: ShareItem[];
 		fixedShowId?: string;
-		form?: { intent?: string; error?: string; success?: string; shareUrl?: string } | null;
+		catalogPanel?: boolean;
+		form?: {
+			intent?: string;
+			error?: string;
+			success?: string | boolean;
+			shareUrl?: string;
+		} | null;
 	} = $props();
 
 	let visibleShows = $derived(
@@ -39,6 +47,18 @@
 			? shows.filter((show) => show.id === fixedShowId)
 			: shows.filter((show) => shares.some((share) => share.showId === show.id))
 	);
+	let dialog: HTMLDialogElement;
+	let copyMessage = $state('');
+
+	onMount(() => {
+		if (form?.intent?.toLowerCase().includes('share')) dialog.showModal();
+	});
+
+	async function copyShareUrl() {
+		if (!form?.shareUrl) return;
+		await navigator.clipboard.writeText(new URL(form.shareUrl, window.location.origin).href);
+		copyMessage = 'Link kopiert.';
+	}
 
 	function germanDate(value: string | null, fallback = 'Termin offen') {
 		return value
@@ -86,164 +106,225 @@
 	}
 </script>
 
-<section
-	class="quiet-panel share-management"
-	aria-labelledby={`share-title-${fixedShowId || 'all'}`}
->
-	<div class="panel-heading">
-		<div>
-			<p class="eyebrow">Gastzugänge</p>
-			<h2 id={`share-title-${fixedShowId || 'all'}`}>Lesefreigaben</h2>
+{#if catalogPanel}
+	<section class="quiet-panel share-catalog-panel">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Gastzugänge</p>
+				<h2>Lesefreigaben</h2>
+			</div>
+			<button
+				class="compact-add-button share-dialog-trigger"
+				type="button"
+				aria-label="Lesefreigaben"
+				onclick={() => dialog.showModal()}
+			>
+				<AppIcon name="link" /> Freigaben verwalten
+			</button>
 		</div>
-		<span class="mail-mode">Aktualisiert sich bis zum Abschluss</span>
-	</div>
-	<p class="share-intro">
-		Der Gast sieht nur diese Sendung und den gewählten Informationsumfang. Der vollständige Link
-		wird aus Sicherheitsgründen nur direkt nach dem Anlegen angezeigt.
-	</p>
-	{#if form?.intent?.toLowerCase().includes('share') && form.error}<div
-			class="form-message error"
-			role="alert"
-		>
-			{form.error}
-		</div>{/if}
-	{#if form?.intent?.toLowerCase().includes('share') && form.success}<div
-			class="form-message success"
-			role="status"
-		>
-			{form.success}
-		</div>{/if}
-	{#if form?.shareUrl}<div class="form-message success share-result" role="status">
-			<strong>Neuer Leselink</strong>
-			<!-- The server returns only a same-origin share path created by this action. -->
-			<!-- eslint-disable-next-line svelte/no-navigation-without-resolve -->
-			<a href={form.shareUrl}>{form.shareUrl}</a>
-		</div>{/if}
+		<p class="catalog-note">
+			Sendungen gezielt als widerrufbaren Leselink mit wählbarem Informationsumfang teilen.
+		</p>
+	</section>
+{:else}
+	<button
+		class="secondary-button share-dialog-trigger"
+		type="button"
+		onclick={() => dialog.showModal()}
+	>
+		<AppIcon name="link" /> Lesefreigaben
+	</button>
+{/if}
+<dialog bind:this={dialog} class="share-management-dialog">
+	<section class="share-management" aria-labelledby={`share-title-${fixedShowId || 'all'}`}>
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Gastzugänge</p>
+				<h2 id={`share-title-${fixedShowId || 'all'}`}>Lesefreigaben</h2>
+			</div>
+			<span class="mail-mode">Aktualisiert sich bis zum Abschluss</span>
+			<button
+				class="dialog-close"
+				type="button"
+				aria-label="Lesefreigaben schließen"
+				onclick={() => dialog.close()}
+			>
+				<AppIcon name="xmark" />
+			</button>
+		</div>
+		<p class="share-intro">
+			Der Gast sieht nur diese Sendung und den gewählten Informationsumfang. Der vollständige Link
+			wird aus Sicherheitsgründen nur direkt nach dem Anlegen angezeigt.
+		</p>
+		{#if form?.intent?.toLowerCase().includes('share') && form.error}<div
+				class="form-message error"
+				role="alert"
+			>
+				{form.error}
+			</div>{/if}
+		{#if form?.intent?.toLowerCase().includes('share') && typeof form.success === 'string'}<div
+				class="form-message success"
+				role="status"
+			>
+				{form.success}
+			</div>{/if}
+		{#if form?.shareUrl}<div class="form-message success share-result" role="status">
+				<strong>Neuer Leselink</strong>
+				<!-- The server returns only a same-origin share path created by this action. -->
+				<div>
+					<!-- eslint-disable-next-line svelte/no-navigation-without-resolve -->
+					<a href={form.shareUrl}>{form.shareUrl}</a><button
+						class="secondary-button"
+						type="button"
+						onclick={copyShareUrl}><AppIcon name="copy" /> Kopieren</button
+					>
+				</div>
+				{#if copyMessage}<small>{copyMessage}</small>{/if}
+			</div>{/if}
 
-	<form class="share-create-form" method="POST" action="?/createShare">
-		{#if fixedShowId}
-			<input type="hidden" name="showId" value={fixedShowId} />
-		{:else}
+		<form class="share-create-form" method="POST" action="?/createShare">
+			{#if fixedShowId}
+				<input type="hidden" name="showId" value={fixedShowId} />
+			{:else}
+				<label
+					>Sendung<select name="showId" required>
+						<option value="">Sendung wählen</option>
+						{#each shows as show (show.id)}<option value={show.id}
+								>{show.title} · {statusLabel(show.status)}</option
+							>{/each}
+					</select></label
+				>
+			{/if}
 			<label
-				>Sendung<select name="showId" required>
-					<option value="">Sendung wählen</option>
-					{#each shows as show (show.id)}<option value={show.id}
-							>{show.title} · {statusLabel(show.status)}</option
-						>{/each}
+				>Informationsumfang<select name="scope">
+					<option value="rundown">Nur Ablauf</option>
+					<option value="moderation">Ablauf und Moderation</option>
+					<option value="research">Vollständig mit Recherche</option>
 				</select></label
 			>
-		{/if}
-		<label
-			>Informationsumfang<select name="scope">
-				<option value="rundown">Nur Ablauf</option>
-				<option value="moderation">Ablauf und Moderation</option>
-				<option value="research">Vollständig mit Recherche</option>
-			</select></label
-		>
-		<label
-			>Optionales Passwort<input
-				name="password"
-				type="password"
-				minlength="12"
-				maxlength="256"
-				autocomplete="new-password"
-			/></label
-		>
-		<label>Optionaler Ablauf<input name="expiresAt" type="datetime-local" /></label>
-		<button class="primary-button" type="submit" disabled={!shows.length}>Leselink anlegen</button>
-	</form>
+			<label
+				>Optionales Passwort<input
+					name="password"
+					type="password"
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<label>Optionaler Ablauf<input name="expiresAt" type="datetime-local" /></label>
+			<button class="primary-button" type="submit" disabled={!shows.length}>Leselink anlegen</button
+			>
+		</form>
 
-	{#if visibleShows.length}
-		<div class="share-show-list">
-			{#each visibleShows as show (show.id)}
-				<article class="share-show-card">
-					<header>
-						<div>
-							<a href={resolve('/sendungen/[id]', { id: show.id })}>{show.title}</a>
-							<small>{germanDate(show.startsAtUtc)} Uhr</small>
-						</div>
-						<span class={`show-state ${show.status}`}>{statusLabel(show.status)}</span>
-					</header>
-					<div class="share-list">
-						{#each shares.filter((share) => share.showId === show.id) as share (share.id)}
-							<details class="share-row">
-								<summary>
-									<span class="share-row-icon"><AppIcon name="link" /></span>
-									<span>
-										<strong>{scopeLabel(share.scope)}</strong>
-										<small
-											>{share.isPasswordProtected ? 'Mit Passwort' : 'Ohne Passwort'} · {germanDate(
-												share.expiresAtUtc,
-												'ohne Ablauf'
-											)}</small
+		{#if visibleShows.length}
+			<div class="share-show-list">
+				{#each visibleShows as show (show.id)}
+					<article class="share-show-card">
+						<header>
+							<div>
+								<a href={resolve('/sendungen/[id]', { id: show.id })}>{show.title}</a>
+								<small>{germanDate(show.startsAtUtc)} Uhr</small>
+							</div>
+							<span class={`show-state ${show.status}`}>{statusLabel(show.status)}</span>
+						</header>
+						<div class="share-list">
+							{#each shares.filter((share) => share.showId === show.id) as share (share.id)}
+								<details class="share-row">
+									<summary>
+										<span class="share-row-icon"><AppIcon name="link" /></span>
+										<span>
+											<strong>{scopeLabel(share.scope)}</strong>
+											<small
+												>{share.isPasswordProtected ? 'Mit Passwort' : 'Ohne Passwort'} · {germanDate(
+													share.expiresAtUtc,
+													'ohne Ablauf'
+												)}</small
+											>
+										</span>
+										<span class:locked={shareState(share) !== 'Aktiv'}>{shareState(share)}</span>
+										<AppIcon name="pen" />
+									</summary>
+									<div class="share-edit-area">
+										{#if share.revokedAtUtc}
+											<p>Diese Freigabe ist widerrufen und kann nur noch gelöscht werden.</p>
+										{:else}
+											<form class="share-edit-form" method="POST" action="?/updateShare">
+												<input type="hidden" name="shareId" value={share.id} />
+												<input type="hidden" name="showId" value={show.id} />
+												<label
+													>Informationsumfang<select name="scope" value={share.scope}>
+														<option value="rundown">Nur Ablauf</option>
+														<option value="moderation">Ablauf und Moderation</option>
+														<option value="research">Vollständig mit Recherche</option>
+													</select></label
+												>
+												<label
+													>Passwort<select name="passwordMode">
+														<option value="keep">Unverändert</option>
+														<option value="remove">Kein Passwort</option>
+														<option value="replace">Neues Passwort setzen</option>
+													</select></label
+												>
+												<label
+													>Neues Passwort<input
+														name="password"
+														type="password"
+														minlength="12"
+														maxlength="256"
+														autocomplete="new-password"
+													/></label
+												>
+												<label
+													>Ablauf<input
+														name="expiresAt"
+														type="datetime-local"
+														value={berlinInput(share.expiresAtUtc)}
+													/><small>Leer lassen, um den Ablauf zu entfernen.</small></label
+												>
+												<button class="secondary-button" type="submit">Freigabe speichern</button>
+											</form>
+										{/if}
+										{#if !share.revokedAtUtc}<form
+												method="POST"
+												action="?/replaceShare"
+												onsubmit={(event) => {
+													if (
+														!confirm('Ersatzlink anlegen? Der bisherige Link wird sofort ungültig.')
+													)
+														event.preventDefault();
+												}}
+											>
+												<input type="hidden" name="shareId" value={share.id} />
+												<input type="hidden" name="showId" value={show.id} />
+												<button class="text-button" type="submit">Ersatzlink anlegen</button>
+											</form>{/if}
+										<form
+											method="POST"
+											action="?/deleteShare"
+											onsubmit={(event) => {
+												if (
+													!confirm('Freigabe endgültig löschen? Der Leselink wird sofort ungültig.')
+												)
+													event.preventDefault();
+											}}
 										>
-									</span>
-									<span class:locked={shareState(share) !== 'Aktiv'}>{shareState(share)}</span>
-									<AppIcon name="pen" />
-								</summary>
-								<div class="share-edit-area">
-									{#if share.revokedAtUtc}
-										<p>Diese Freigabe ist widerrufen und kann nur noch gelöscht werden.</p>
-									{:else}
-										<form class="share-edit-form" method="POST" action="?/updateShare">
 											<input type="hidden" name="shareId" value={share.id} />
-											<label
-												>Informationsumfang<select name="scope" value={share.scope}>
-													<option value="rundown">Nur Ablauf</option>
-													<option value="moderation">Ablauf und Moderation</option>
-													<option value="research">Vollständig mit Recherche</option>
-												</select></label
+											<input type="hidden" name="showId" value={show.id} />
+											<button class="text-button danger-text" type="submit">Freigabe löschen</button
 											>
-											<label
-												>Passwort<select name="passwordMode">
-													<option value="keep">Unverändert</option>
-													<option value="remove">Kein Passwort</option>
-													<option value="replace">Neues Passwort setzen</option>
-												</select></label
-											>
-											<label
-												>Neues Passwort<input
-													name="password"
-													type="password"
-													minlength="12"
-													maxlength="256"
-													autocomplete="new-password"
-												/></label
-											>
-											<label
-												>Ablauf<input
-													name="expiresAt"
-													type="datetime-local"
-													value={berlinInput(share.expiresAtUtc)}
-												/><small>Leer lassen, um den Ablauf zu entfernen.</small></label
-											>
-											<button class="secondary-button" type="submit">Freigabe speichern</button>
 										</form>
-									{/if}
-									<form
-										method="POST"
-										action="?/deleteShare"
-										onsubmit={(event) => {
-											if (
-												!confirm('Freigabe endgültig löschen? Der Leselink wird sofort ungültig.')
-											)
-												event.preventDefault();
-										}}
-									>
-										<input type="hidden" name="shareId" value={share.id} />
-										<button class="text-button danger-text" type="submit">Freigabe löschen</button>
-									</form>
-								</div>
-							</details>
-						{/each}
-						{#if !shares.some((share) => share.showId === show.id)}
-							<p class="quiet-copy">Für diese Sendung gibt es noch keine Lesefreigabe.</p>
-						{/if}
-					</div>
-				</article>
-			{/each}
-		</div>
-	{:else}
-		<p class="quiet-copy">Noch keine Lesefreigaben angelegt.</p>
-	{/if}
-</section>
+									</div>
+								</details>
+							{/each}
+							{#if !shares.some((share) => share.showId === show.id)}
+								<p class="quiet-copy">Für diese Sendung gibt es noch keine Lesefreigabe.</p>
+							{/if}
+						</div>
+					</article>
+				{/each}
+			</div>
+		{:else}
+			<p class="quiet-copy">Noch keine Lesefreigaben angelegt.</p>
+		{/if}
+	</section>
+</dialog>

src/lib/components/UsageEditorDialog.svelte

@@ -1,10 +1,11 @@
 <script lang="ts">
 	import { enhance, type SubmitFunction } from '$app/forms';
-	import { untrack } from 'svelte';
+	import { onMount, untrack } from 'svelte';
 	import MarkdownEditorField from './MarkdownEditorField.svelte';
 	import InlineTitleEditor from './InlineTitleEditor.svelte';
 	import NavIcon from './NavIcon.svelte';
 	import PieceEditorDialog from './PieceEditorDialog.svelte';
+	import PresentationDisplay from './PresentationDisplay.svelte';
 	import type { PieceUsage } from '#lib/server/shows.js';
 
 	let {
@@ -13,7 +14,8 @@
 		sectionId,
 		sections,
 		error,
-		enhanceCommand
+		enhanceCommand,
+		open = false
 	}: {
 		usage: PieceUsage;
 		revision: number;
@@ -21,6 +23,7 @@
 		sections: { id: string; name: string }[];
 		error?: string;
 		enhanceCommand: SubmitFunction;
+		open?: boolean;
 	} = $props();
 
 	let formId = $derived(`usage-editor-form-${usage.id}`);
@@ -30,6 +33,14 @@
 		untrack(() => ({ ...usage, tools: usage.tools.map((tool) => ({ ...tool })) }))
 	);
 	let dirty = $state(false);
+	let selectedSourceId = $state(
+		untrack(
+			() => usage.sources.find((source) => source.url === usage.presentationSourceUrl)?.id ?? ''
+		)
+	);
+	onMount(() => {
+		if (open) editor.showModal();
+	});
 	let selectedMedia = $derived(
 		draft.media.find((media) => media.id === draft.presentationMediaId) ?? null
 	);
@@ -38,12 +49,63 @@
 		return Number((seconds / 60).toFixed(2));
 	}
 
+	function previewHtml(value: string) {
+		return value
+			.replaceAll('&', '&amp;')
+			.replaceAll('<', '&lt;')
+			.replaceAll('>', '&gt;')
+			.replaceAll('"', '&quot;')
+			.replaceAll("'", '&#039;')
+			.replaceAll('\n', '<br>');
+	}
+
 	function requestClose() {
 		if (dirty && !confirm('Ungespeicherte Änderungen verwerfen und Editor schließen?')) return;
 		dirty = false;
 		editor.close();
 	}
 
+	function presentationSourceChanged(event: Event) {
+		selectedSourceId = (event.currentTarget as HTMLSelectElement).value;
+		const source = draft.sources.find((item) => item.id === selectedSourceId);
+		if (!source) return;
+		draft.presentationSourceLabel = source.label;
+		draft.presentationSourceUrl = source.url;
+		draft.presentationSourceTimecodeSeconds = source.timecodeSeconds;
+	}
+
+	let previewContent = $derived({
+		mode: draft.presentationMode,
+		topics: draft.topics.map((topic) => topic.name),
+		title: draft.outputTitle || draft.title,
+		html: previewHtml(draft.presentation),
+		source: draft.presentationSourceUrl
+			? {
+					label: draft.presentationSourceLabel,
+					url: draft.presentationSourceUrl,
+					timecodeSeconds: draft.presentationSourceTimecodeSeconds
+				}
+			: null,
+		previewTitle: draft.presentationTitle,
+		description: draft.presentationDescription,
+		imageUrl: draft.presentationMode === 'link' ? draft.presentationImageUrl : '',
+		siteName: draft.presentationSiteName,
+		provider: draft.presentationProvider,
+		providerId: draft.presentationProviderId,
+		embedUrl: '',
+		sources: [],
+		images: selectedMedia
+			? [{ id: selectedMedia.originalMediaId, altText: selectedMedia.altText }]
+			: []
+	});
+	let previewImageSrc = $derived(
+		selectedMedia && draft.presentationMode === 'text'
+			? '/media'
+			: selectedMedia && draft.presentationMode === 'image'
+				? `/media/${selectedMedia.originalMediaId}`
+				: ''
+	);
+
 	const enhanceEditor: SubmitFunction = async (input) => {
 		const finish = await enhanceCommand(input);
 		return async (result) => {
@@ -125,6 +187,26 @@
 			<details class="piece-meta-details">
 				<summary>Dauer und Einplanung</summary>
 				<div class="piece-meta-grid">
+					<label
+						>Vorbereitungsstatus<select
+							name="preparationStatus"
+							bind:value={draft.preparationStatus}
+						>
+							<option value="preparing">In Vorbereitung</option>
+							<option value="ready">Sendefertig</option>
+						</select></label
+					>
+					<label
+						>Vorbereitungsaufwand<select
+							name="preparationEffort"
+							bind:value={draft.preparationEffort}
+						>
+							<option value={null}>Nicht angegeben</option>
+							<option value="low">Gering</option>
+							<option value="medium">Mittel</option>
+							<option value="high">Hoch</option>
+						</select></label
+					>
 					<label
 						>Dauer in Minuten<input
 							name="durationMinutes"
@@ -212,22 +294,9 @@
 			</div>
 			<div class="piece-presentation-layout">
 				<div class="piece-presentation-controls">
-					<label
-						>Präsentationstitel<input
-							name="outputTitle"
-							maxlength="300"
-							placeholder="Optional, sonst interner Titel"
-							bind:value={draft.outputTitle}
-						/></label
-					>
-					<MarkdownEditorField
-						name="presentation"
-						label="Öffentlicher Text"
-						placeholder="Text für die Publikumsausgabe"
-						bind:value={draft.presentation}
-					/>
+					<p class="field-label">Präsentationsart</p>
 					<div class="presentation-mode-picker" role="group" aria-label="Darstellung">
-						{#each [['text', 'Text'], ['link', 'Linkvorschau'], ['video', 'Video']] as mode (mode[0])}
+						{#each [['text', 'Text'], ['image', 'Nur Bild'], ['link', 'Linkvorschau'], ['video', 'Video']] as mode (mode[0])}
 							<label
 								><input
 									type="radio"
@@ -238,6 +307,25 @@
 							>
 						{/each}
 					</div>
+					{#if draft.presentationMode === 'text'}
+						<label
+							>Öffentliche Überschrift<input
+								name="outputTitle"
+								maxlength="300"
+								placeholder="Optional, sonst interner Titel"
+								bind:value={draft.outputTitle}
+							/></label
+						>
+						<MarkdownEditorField
+							name="presentation"
+							label="Öffentlicher Vorspann"
+							placeholder="Text für die Publikumsausgabe"
+							bind:value={draft.presentation}
+						/>
+					{:else}
+						<input type="hidden" name="outputTitle" value={draft.outputTitle} />
+						<input type="hidden" name="presentation" value={draft.presentation} />
+					{/if}
 					<input
 						type="hidden"
 						name="presentationSourceLabel"
@@ -251,34 +339,44 @@
 					/>
 					<input type="hidden" name="presentationSiteName" value={draft.presentationSiteName} />
 					<input type="hidden" name="presentationMediaId" value={draft.presentationMediaId ?? ''} />
-					{#if draft.presentationMode !== 'text'}
+					{#if draft.presentationMode === 'link' || draft.presentationMode === 'video'}
 						<div class="presentation-settings">
-							<div class="presentation-source-summary wide-field">
-								<span>Ausgewählte Quelle</span>
-								<strong
-									>{draft.presentationSourceLabel ||
-										draft.presentationSourceUrl ||
-										'Keine Quelle'}</strong
+							<label class="wide-field"
+								>{draft.presentationMode === 'video' ? 'Video-URL' : 'Quelle/URL'}<select
+									bind:value={selectedSourceId}
+									onchange={presentationSourceChanged}
 								>
-								{#if draft.presentationSourceUrl}<small>{draft.presentationSourceUrl}</small>{/if}
-							</div>
+									<option value="">Quelle auswählen</option>
+									{#each draft.sources as source (source.id)}
+										<option value={source.id}>{source.label || source.url}</option>
+									{/each}
+								</select></label
+							>
 							<label
-								>Kartentitel<input
+								>{draft.presentationMode === 'video' ? 'Videotitel' : 'Kartentitel'}<input
 									name="presentationTitle"
 									maxlength="300"
 									placeholder="Optionaler Anzeigetitel"
 									bind:value={draft.presentationTitle}
 								/></label
 							>
-							<label
-								>Bild-URL<input
+							{#if draft.presentationMode === 'link'}
+								<label
+									>Vorschaubild-URL<input
+										name="presentationImageUrl"
+										type="url"
+										maxlength="2000"
+										placeholder="Aus der Linkvorschau"
+										bind:value={draft.presentationImageUrl}
+									/></label
+								>
+							{:else}
+								<input
+									type="hidden"
 									name="presentationImageUrl"
-									type="url"
-									maxlength="2000"
-									placeholder="https://…"
-									bind:value={draft.presentationImageUrl}
-								/></label
-							>
+									value={draft.presentationImageUrl}
+								/>
+							{/if}
 							<label class="wide-field"
 								>Anreißer<textarea
 									name="presentationDescription"
@@ -298,18 +396,20 @@
 						<input type="hidden" name="presentationImageUrl" value={draft.presentationImageUrl} />
 					{/if}
 				</div>
-				{#if draft.media.length}<fieldset class="usage-media-picker">
+				{#if draft.media.length && ['text', 'image'].includes(draft.presentationMode)}<fieldset
+						class="usage-media-picker"
+					>
 						<legend>Hochgeladenes Präsentationsbild</legend>
-						<label
-							><input
-								type="radio"
-								checked={!draft.presentationMediaId}
-								onchange={() => {
-									draft.presentationMediaId = null;
-									dirty = true;
-								}}
-							/> Kein Bild</label
-						>
+						{#if draft.presentationMode === 'text'}<label
+								><input
+									type="radio"
+									checked={!draft.presentationMediaId}
+									onchange={() => {
+										draft.presentationMediaId = null;
+										dirty = true;
+									}}
+								/> Kein Bild</label
+							>{/if}
 						<div class="media-grid">
 							{#each draft.media as media (media.id)}<label class="media-presentation-choice"
 									><input
@@ -326,30 +426,7 @@
 						</div>
 					</fieldset>{/if}
 				<aside class="piece-presentation-preview" aria-label="Präsentationsvorschau">
-					<p class="output-kicker">Vorschau · {draft.presentationMode}</p>
-					<h4>{draft.outputTitle || draft.title}</h4>
-					{#if draft.presentationMode === 'text'}
-						<p class="preview-markdown-source">
-							{draft.presentation || 'Noch kein öffentlicher Text.'}
-						</p>
-						{#if selectedMedia}<img
-								src={`/media/${selectedMedia.originalMediaId}`}
-								alt={selectedMedia.altText}
-							/>{/if}
-					{:else}
-						{#if selectedMedia}<img
-								src={`/media/${selectedMedia.originalMediaId}`}
-								alt={selectedMedia.altText}
-							/>{:else if draft.presentationImageUrl}<img
-								src={draft.presentationImageUrl}
-								alt=""
-							/>{/if}
-						<p>
-							{draft.presentationDescription ||
-								draft.presentationSourceUrl ||
-								'Noch keine Vorschauangaben.'}
-						</p>
-					{/if}
+					<PresentationDisplay content={previewContent} imageSrc={previewImageSrc} />
 				</aside>
 			</div>
 		</section>

src/lib/server/api-http.ts

@@ -0,0 +1,47 @@
+import { json } from '@sveltejs/kit';
+
+export async function apiBody(request: Request) {
+	const type = request.headers.get('content-type') ?? '';
+	if (!type.includes('application/json')) throw new Error('API_JSON_REQUIRED');
+	try {
+		return (await request.json()) as Record<string, unknown>;
+	} catch {
+		throw new Error('API_INVALID_JSON');
+	}
+}
+
+export function apiFailure(cause: unknown) {
+	const code = cause instanceof Error ? cause.message : 'API_ERROR';
+	const status =
+		code === 'API_UNAUTHORIZED'
+			? 401
+			: code === 'API_FORBIDDEN'
+				? 403
+				: code === 'NOT_FOUND'
+					? 404
+					: code === 'CONFLICT' || code === 'API_IDEMPOTENCY_CONFLICT'
+						? 409
+						: 400;
+	return json(
+		{
+			error: {
+				code,
+				message:
+					status === 401
+						? 'Authentifizierung erforderlich.'
+						: status === 403
+							? 'Diese Berechtigung fehlt.'
+							: status === 404
+								? 'Nicht gefunden.'
+								: 'Anfrage konnte nicht verarbeitet werden.'
+			}
+		},
+		{ status }
+	);
+}
+
+export function pageInput(url: URL) {
+	const limit = Math.min(100, Math.max(1, Number(url.searchParams.get('limit') ?? 50) || 50));
+	const offset = Math.max(0, Number(url.searchParams.get('offset') ?? 0) || 0);
+	return { limit, offset };
+}

src/lib/server/content.spec.ts

@@ -74,7 +74,8 @@ function completeInput(overrides: Partial<PieceInput> = {}): PieceInput {
 		sources: [
 			{ label: 'Dokumentation', url: 'https://example.com/dokumentation', timecodeSeconds: 75 }
 		],
-		...overrides
+		...overrides,
+		preparationEffort: overrides.preparationEffort ?? null
 	};
 }
 
@@ -332,11 +333,17 @@ describe('content management', () => {
 			presentationMediaId: selected.id
 		});
 
+		savePiece(id, source.revision, {
+			...source,
+			status: 'preparing',
+			presentationMode: 'image'
+		});
 		const duplicateId = await duplicatePiece(id);
 		const duplicate = getPiece(duplicateId)!;
 		expect(duplicate.media).toHaveLength(1);
 		expect(duplicate.presentationMediaId).toBe(duplicate.media[0].id);
 		expect(duplicate.presentationMediaId).not.toBe(selected.id);
+		expect(duplicate.presentationMode).toBe('image');
 
 		const template = savePieceAsTemplate(id, 'Ohne Medienreferenz', 'Nur Inhaltsdaten');
 		const snapshot = getDatabase()

src/lib/server/content.ts

@@ -14,6 +14,7 @@ import {
 export const PIECE_STATUSES = ['inbox', 'preparing', 'ready', 'archived'] as const;
 export type PieceStatus = (typeof PIECE_STATUSES)[number];
 export type EditablePieceStatus = Exclude<PieceStatus, 'archived'>;
+export type PreparationEffort = 'low' | 'medium' | 'high' | null;
 export type TaxonomyKind = 'category' | 'format' | 'topic';
 
 export type PieceSourceInput = {
@@ -42,6 +43,7 @@ export type PieceInput = {
 	summary: string;
 	formatId: string | null;
 	status: EditablePieceStatus;
+	preparationEffort: PreparationEffort;
 	durationSeconds: number;
 	intro: string;
 	researchText: string;
@@ -82,6 +84,7 @@ export type PieceListItem = {
 	sourceCount: number;
 	mediaId: string | null;
 	isFavorite: boolean;
+	preparationEffort: PreparationEffort;
 };
 
 export type PieceEditor = Omit<
@@ -198,6 +201,9 @@ function validatePieceInput(input: PieceInput): ValidatedPieceInput {
 	const title = cleanText(input.title, 200, 'title');
 	if (!title) throw new Error('INVALID_TITLE');
 	if (!['inbox', 'preparing', 'ready'].includes(input.status)) throw new Error('INVALID_STATUS');
+	if (![null, 'low', 'medium', 'high'].includes(input.preparationEffort)) {
+		throw new Error('INVALID_PREPARATION_EFFORT');
+	}
 	if (
 		!Number.isInteger(input.durationSeconds) ||
 		input.durationSeconds < 0 ||
@@ -226,7 +232,7 @@ function validatePieceInput(input: PieceInput): ValidatedPieceInput {
 		}
 		return { label, url, timecodeSeconds: source.timecodeSeconds };
 	});
-	if (!['text', 'link', 'video'].includes(input.presentationMode)) {
+	if (!['text', 'image', 'link', 'video'].includes(input.presentationMode)) {
 		throw new Error('INVALID_PRESENTATION');
 	}
 	const sourcePosition = input.presentationSourcePosition;
@@ -236,7 +242,7 @@ function validatePieceInput(input: PieceInput): ValidatedPieceInput {
 	) {
 		throw new Error('INVALID_PRESENTATION');
 	}
-	if (input.presentationMode !== 'text' && sourcePosition === null) {
+	if (['link', 'video'].includes(input.presentationMode) && sourcePosition === null) {
 		throw new Error('INVALID_PRESENTATION');
 	}
 	const presentationImageUrl = cleanText(input.presentationImageUrl, 2_000, 'presentation_image');
@@ -249,12 +255,16 @@ function validatePieceInput(input: PieceInput): ValidatedPieceInput {
 		input.presentationMediaId === undefined
 			? undefined
 			: cleanText(input.presentationMediaId, 100, 'presentation_media') || null;
+	if (input.presentationMode === 'image' && !presentationMediaId) {
+		throw new Error('INVALID_PRESENTATION');
+	}
 	return {
 		title,
 		outputTitle: cleanText(input.outputTitle, 300, 'output_title'),
 		summary: cleanText(input.summary, 2_000, 'summary'),
 		formatId: input.formatId || null,
 		status: input.status,
+		preparationEffort: input.preparationEffort,
 		durationSeconds: input.durationSeconds,
 		intro: cleanText(input.intro, 50_000, 'intro'),
 		researchText: cleanText(input.researchText, 50_000, 'research'),
@@ -317,6 +327,7 @@ type PieceListRow = {
 	source_count: number;
 	media_id: string | null;
 	is_favorite: number;
+	preparation_effort: PreparationEffort;
 };
 
 export function listPieces(filters: {
@@ -366,6 +377,7 @@ export function listPieces(filters: {
 	const rows = database
 		.prepare(
 			`SELECT p.id, p.title, p.summary, p.status, p.revision, p.duration_seconds, p.is_favorite,
+			 p.preparation_effort,
 			 p.format_id, COALESCE(f.name, 'Ohne Format') AS format,
 			 (SELECT count(*) FROM piece_sources ps WHERE ps.piece_id = p.id) AS source_count,
 			 (SELECT pm.id FROM piece_media pm WHERE pm.piece_id = p.id AND pm.removed_at_utc IS NULL ORDER BY pm.position LIMIT 1) AS media_id
@@ -398,7 +410,8 @@ export function listPieces(filters: {
 		topics: topicStatement.all(row.id) as PieceListItem['topics'],
 		sourceCount: row.source_count,
 		mediaId: row.media_id,
-		isFavorite: row.is_favorite === 1
+		isFavorite: row.is_favorite === 1,
+		preparationEffort: row.preparation_effort
 	}));
 }
 
@@ -433,14 +446,16 @@ type PieceRow = {
 	updated_at_utc: string;
 	is_favorite: number;
 	presentation_media_id: string | null;
+	preparation_effort: PreparationEffort;
 };
 
 export function getPiece(id: string): PieceEditor | null {
 	const database = getDatabase();
 	const row = database
 		.prepare(
-			`SELECT id, title, output_title, summary, format_id, status, duration_seconds, intro, research_text,
-			 moderation_notes, interaction_text, transition_text, presentation_text, presentation_mode,
+			`SELECT id, title, output_title, summary, format_id, status, preparation_effort, duration_seconds, intro, research_text,
+			 moderation_notes, interaction_text, transition_text, presentation_text,
+			 CASE WHEN presentation_image_only = 1 THEN 'image' ELSE presentation_mode END AS presentation_mode,
 			 presentation_source_position, presentation_title, presentation_description,
 			 presentation_image_url, presentation_site_name, presentation_provider,
 			 presentation_provider_id, presentation_title_manual, presentation_description_manual,
@@ -460,6 +475,7 @@ export function getPiece(id: string): PieceEditor | null {
 		summary: row.summary,
 		formatId: row.format_id,
 		status: row.status,
+		preparationEffort: row.preparation_effort,
 		durationSeconds: row.duration_seconds,
 		intro: row.intro,
 		researchText: row.research_text,
@@ -612,9 +628,9 @@ export function savePiece(id: string, expectedRevision: number, rawInput: PieceI
 	const save = database.transaction(() => {
 		const result = database
 			.prepare(
-				`UPDATE pieces SET title = ?, output_title = ?, summary = ?, format_id = ?, status = ?, duration_seconds = ?,
+				`UPDATE pieces SET title = ?, output_title = ?, summary = ?, format_id = ?, status = ?, preparation_effort = ?, duration_seconds = ?,
 				 intro = ?, research_text = ?, moderation_notes = ?, interaction_text = COALESCE(?, interaction_text), transition_text = ?, presentation_text = ?,
-				 presentation_mode = ?, presentation_source_position = ?, presentation_title = ?,
+				 presentation_mode = ?, presentation_image_only = ?, presentation_source_position = ?, presentation_title = ?,
 				 presentation_description = ?, presentation_image_url = ?, presentation_site_name = ?,
 				 presentation_provider = ?, presentation_provider_id = ?, presentation_title_manual = ?,
 				 presentation_description_manual = ?, presentation_image_manual = ?,
@@ -628,6 +644,7 @@ export function savePiece(id: string, expectedRevision: number, rawInput: PieceI
 				input.summary,
 				input.formatId,
 				input.status,
+				input.preparationEffort,
 				input.durationSeconds,
 				input.intro,
 				input.researchText,
@@ -635,7 +652,8 @@ export function savePiece(id: string, expectedRevision: number, rawInput: PieceI
 				input.interactionText ?? null,
 				input.transitionText,
 				input.presentationText,
-				input.presentationMode,
+				input.presentationMode === 'image' ? 'text' : input.presentationMode,
+				input.presentationMode === 'image' ? 1 : 0,
 				input.presentationSourcePosition,
 				input.presentationTitle,
 				input.presentationDescription,
@@ -671,6 +689,7 @@ function blankPieceInput(): ValidatedPieceInput {
 		summary: '',
 		formatId: null,
 		status: 'preparing',
+		preparationEffort: null,
 		durationSeconds: 0,
 		intro: '',
 		researchText: '',
@@ -798,6 +817,7 @@ export function savePieceAsTemplate(
 	delete snapshot.updatedAtUtc;
 	delete snapshot.media;
 	delete snapshot.presentationMediaId;
+	if (snapshot.presentationMode === 'image') snapshot.presentationMode = 'text';
 	snapshot.status = 'preparing';
 	const snapshotJson = JSON.stringify(snapshot);
 	const database = getDatabase();
@@ -917,15 +937,15 @@ export async function duplicatePiece(sourceId: string): Promise<string> {
 		database.transaction(() => {
 			database
 				.prepare(
-					`INSERT INTO pieces (id, title, output_title, summary, format_id, status, duration_seconds, intro,
-					 research_text, moderation_notes, interaction_text, transition_text, presentation_text, presentation_mode,
+					`INSERT INTO pieces (id, title, output_title, summary, format_id, status, preparation_effort, duration_seconds, intro,
+					 research_text, moderation_notes, interaction_text, transition_text, presentation_text, presentation_mode, presentation_image_only,
 					 presentation_source_position, presentation_title, presentation_description,
 					 presentation_image_url, presentation_site_name, presentation_provider,
 					 presentation_provider_id, presentation_title_manual,
 					 presentation_description_manual, presentation_image_manual,
 					 presentation_metadata_fetched_at_utc, created_at_utc, updated_at_utc, revision)
 					 VALUES (
-					 ?, ?, ?, ?, ?, 'preparing', ?, ?, ?, ?, ?, ?, ?,
+					 ?, ?, ?, ?, ?, 'preparing', ?, ?, ?, ?, ?, ?, ?, ?, ?,
 					 ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1
 					 )`
 				)
@@ -935,6 +955,7 @@ export async function duplicatePiece(sourceId: string): Promise<string> {
 					source.outputTitle,
 					source.summary,
 					source.formatId,
+					source.preparationEffort,
 					source.durationSeconds,
 					source.intro,
 					source.researchText,
@@ -942,7 +963,8 @@ export async function duplicatePiece(sourceId: string): Promise<string> {
 					source.interactionText,
 					source.transitionText,
 					source.presentationText,
-					source.presentationMode,
+					source.presentationMode === 'image' ? 'text' : source.presentationMode,
+					source.presentationMode === 'image' ? 1 : 0,
 					source.presentationSourcePosition,
 					source.presentationTitle,
 					source.presentationDescription,

src/lib/server/database.spec.ts

@@ -62,7 +62,7 @@ describe('database setup', () => {
 		database.close();
 
 		expect(counts).toEqual({
-			migrations: 16,
+			migrations: 19,
 			pieces: 6,
 			shows: 2,
 			usages: 5,

src/lib/server/feeds.spec.ts

@@ -0,0 +1,134 @@
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { closeDatabase, getDatabase } from './database.js';
+import {
+	discardFeedEntries,
+	fetchDueFeeds,
+	fetchFeed,
+	importFeedEntries,
+	listFeedEntries,
+	saveFeedSource
+} from './feeds.js';
+import { getPiece } from './content.js';
+
+vi.mock('node:dns/promises', () => ({
+	lookup: vi.fn(async () => [{ address: '93.184.216.34', family: 4 }])
+}));
+
+const validFeed = `<?xml version="1.0"?><rss version="2.0"><channel><title>Test</title><item>
+<guid>entry-1</guid><title>Ein Beitrag</title><link>https://example.org/post</link>
+<description><![CDATA[<p>Kurz <strong>und</strong> gut.</p><script>evil()</script>]]></description>
+<pubDate>Sat, 24 Oct 2026 12:00:00 GMT</pubDate></item></channel></rss>`;
+
+let directory: string;
+
+beforeEach(() => {
+	directory = mkdtempSync(path.join(tmpdir(), 'sendewerk-feed-test-'));
+	process.env.SENDEWERK_DB_PATH = path.join(directory, 'test.sqlite');
+	process.env.SENDEWERK_UPLOAD_DIR = path.join(directory, 'uploads');
+	execFileSync(process.execPath, ['scripts/migrate.mjs'], { cwd: process.cwd(), env: process.env });
+	execFileSync(process.execPath, ['scripts/seed.mjs'], { cwd: process.cwd(), env: process.env });
+});
+
+afterEach(() => {
+	vi.unstubAllGlobals();
+	closeDatabase();
+	delete process.env.SENDEWERK_DB_PATH;
+	delete process.env.SENDEWERK_UPLOAD_DIR;
+	rmSync(directory, { recursive: true, force: true });
+});
+
+describe('RSS import inbox', () => {
+	it('keeps one entry across fetches and preserves a discard decision', async () => {
+		vi.stubGlobal(
+			'fetch',
+			vi.fn(
+				async () => new Response(validFeed, { headers: { 'content-type': 'application/rss+xml' } })
+			)
+		);
+		const feedId = saveFeedSource(null, {
+			name: 'Feed',
+			url: 'https://example.org/feed.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		await fetchFeed(feedId);
+		const [entry] = listFeedEntries();
+		expect(entry.title).toBe('Ein Beitrag');
+		expect(discardFeedEntries([entry.id])).toBe(1);
+		await fetchFeed(feedId);
+		expect(listFeedEntries()).toHaveLength(0);
+		expect(listFeedEntries('discarded')).toHaveLength(1);
+	});
+
+	it('sanitizes foreign HTML and retains the original source on explicit import', async () => {
+		vi.stubGlobal(
+			'fetch',
+			vi.fn(async () => new Response(validFeed))
+		);
+		const feedId = saveFeedSource(null, {
+			name: 'Feed',
+			url: 'https://example.org/feed.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: 'cat-jc'
+		});
+		await fetchFeed(feedId);
+		const [entry] = listFeedEntries();
+		const [pieceId] = importFeedEntries([entry.id], []);
+		const piece = getPiece(pieceId)!;
+		expect(piece.summary).toContain('Kurz und gut.');
+		expect(piece.summary).not.toContain('<script>');
+		expect(piece.sources).toEqual([
+			{ label: 'RSS: Originalbeitrag', url: 'https://example.org/post', timecodeSeconds: null }
+		]);
+		expect(piece.categoryIds).toEqual(['cat-jc']);
+	});
+
+	it('isolates a broken feed while fetching other due feeds', async () => {
+		vi.stubGlobal(
+			'fetch',
+			vi.fn(
+				async (url: URL) => new Response(url.href.includes('broken') ? '<not-feed />' : validFeed)
+			)
+		);
+		saveFeedSource(null, {
+			name: 'A broken',
+			url: 'https://example.org/broken.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		saveFeedSource(null, {
+			name: 'B valid',
+			url: 'https://example.org/valid.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		await fetchDueFeeds();
+		expect(listFeedEntries()).toHaveLength(1);
+		const errors = getDatabase()
+			.prepare("SELECT count(*) AS count FROM feed_sources WHERE last_error <> ''")
+			.get() as { count: number };
+		expect(errors.count).toBe(1);
+	});
+
+	it('blocks loopback targets before sending a request', async () => {
+		const request = vi.fn();
+		vi.stubGlobal('fetch', request);
+		const feedId = saveFeedSource(null, {
+			name: 'Local',
+			url: 'http://127.0.0.1/feed.xml',
+			isEnabled: false,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		await expect(fetchFeed(feedId)).rejects.toThrow('FEED_BLOCKED');
+		expect(request).not.toHaveBeenCalled();
+	});
+});

src/lib/server/feeds.ts

@@ -0,0 +1,457 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import sanitizeHtml from 'sanitize-html';
+import { XMLParser } from 'fast-xml-parser';
+import { createPiece, getPiece, savePiece } from './content.js';
+import { getDatabase } from './database.js';
+
+const MAX_FEED_BYTES = 2 * 1024 * 1024;
+const FETCH_TIMEOUT_MS = 8_000;
+const MAX_REDIRECTS = 3;
+
+export type FeedSource = {
+	id: string;
+	name: string;
+	url: string;
+	isEnabled: boolean;
+	refreshIntervalMinutes: number;
+	defaultCategoryId: string | null;
+	lastFetchedAtUtc: string | null;
+	nextFetchAtUtc: string | null;
+	lastError: string;
+};
+
+export type FeedEntry = {
+	id: string;
+	feedId: string;
+	feedName: string;
+	title: string;
+	url: string;
+	summary: string;
+	publishedAtUtc: string | null;
+	status: 'new' | 'imported' | 'discarded';
+	pieceId: string | null;
+	defaultCategoryId: string | null;
+};
+
+function clean(value: unknown, maximum: number) {
+	return String(value ?? '')
+		.trim()
+		.slice(0, maximum);
+}
+
+function validHttpUrl(value: string) {
+	try {
+		const url = new URL(value);
+		return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password;
+	} catch {
+		return false;
+	}
+}
+
+function privateIpv4(address: string) {
+	const p = address.split('.').map(Number);
+	return (
+		p[0] === 0 ||
+		p[0] === 10 ||
+		p[0] === 127 ||
+		(p[0] === 169 && p[1] === 254) ||
+		(p[0] === 172 && p[1] >= 16 && p[1] <= 31) ||
+		(p[0] === 192 && p[1] === 168) ||
+		p[0] >= 224
+	);
+}
+
+function privateAddress(address: string) {
+	if (isIP(address) === 4) return privateIpv4(address);
+	const value = address.toLowerCase().split('%')[0];
+	if (value === '::' || value === '::1' || value.startsWith('fc') || value.startsWith('fd'))
+		return true;
+	if (/^fe[89ab]/.test(value)) return true;
+	const mapped = value.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1];
+	return mapped ? privateIpv4(mapped) : false;
+}
+
+async function assertPublic(url: URL) {
+	if (!validHttpUrl(url.href) || (url.port && !['80', '443'].includes(url.port)))
+		throw new Error('FEED_BLOCKED');
+	const hostname = url.hostname.replace(/^\[|\]$/g, '');
+	if (hostname === 'localhost' || hostname.endsWith('.localhost')) throw new Error('FEED_BLOCKED');
+	const addresses = isIP(hostname)
+		? [{ address: hostname }]
+		: await lookup(hostname, { all: true, verbatim: true });
+	if (!addresses.length || addresses.some((entry) => privateAddress(entry.address)))
+		throw new Error('FEED_BLOCKED');
+}
+
+async function fetchXml(
+	input: string,
+	headers: Record<string, string>,
+	redirects = 0
+): Promise<{ xml: string; etag: string; lastModified: string; unchanged: boolean }> {
+	const url = new URL(input);
+	await assertPublic(url);
+	const response = await fetch(url, {
+		headers: {
+			Accept: 'application/rss+xml, application/atom+xml, application/xml, text/xml',
+			...headers
+		},
+		redirect: 'manual',
+		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+	});
+	if ([301, 302, 303, 307, 308].includes(response.status)) {
+		if (redirects >= MAX_REDIRECTS) throw new Error('FEED_REDIRECT');
+		const location = response.headers.get('location');
+		if (!location) throw new Error('FEED_FETCH');
+		return fetchXml(new URL(location, url).href, headers, redirects + 1);
+	}
+	if (response.status === 304)
+		return {
+			xml: '',
+			etag: headers['If-None-Match'] ?? '',
+			lastModified: headers['If-Modified-Since'] ?? '',
+			unchanged: true
+		};
+	if (!response.ok) throw new Error(`FEED_HTTP_${response.status}`);
+	const declared = Number(response.headers.get('content-length') ?? 0);
+	if (declared > MAX_FEED_BYTES) throw new Error('FEED_TOO_LARGE');
+	const buffer = Buffer.from(await response.arrayBuffer());
+	if (buffer.length > MAX_FEED_BYTES) throw new Error('FEED_TOO_LARGE');
+	return {
+		xml: buffer.toString('utf8'),
+		etag: response.headers.get('etag') ?? '',
+		lastModified: response.headers.get('last-modified') ?? '',
+		unchanged: false
+	};
+}
+
+function values<T>(value: T | T[] | undefined): T[] {
+	return value === undefined ? [] : Array.isArray(value) ? value : [value];
+}
+
+function textFrom(value: unknown): string {
+	if (typeof value === 'string' || typeof value === 'number') return String(value);
+	if (value && typeof value === 'object') {
+		const record = value as Record<string, unknown>;
+		return textFrom(record['#text'] ?? record.__cdata ?? '');
+	}
+	return '';
+}
+
+function entryLink(value: unknown) {
+	for (const link of values(
+		value as Record<string, unknown> | Record<string, unknown>[] | string | undefined
+	)) {
+		if (typeof link === 'string') return link;
+		if (link && typeof link === 'object') {
+			const href = clean((link as Record<string, unknown>)['@_href'], 2_000);
+			const rel = clean((link as Record<string, unknown>)['@_rel'], 30);
+			if (href && (!rel || rel === 'alternate')) return href;
+		}
+	}
+	return '';
+}
+
+function parseDate(value: unknown) {
+	const raw = textFrom(value);
+	if (!raw) return null;
+	const date = new Date(raw);
+	return Number.isNaN(date.valueOf()) ? null : date.toISOString();
+}
+
+function parseFeed(xml: string) {
+	let document: Record<string, unknown>;
+	try {
+		document = new XMLParser({
+			ignoreAttributes: false,
+			processEntities: false,
+			trimValues: true
+		}).parse(xml) as Record<string, unknown>;
+	} catch {
+		throw new Error('INVALID_FEED');
+	}
+	const rssChannel = (document.rss as Record<string, unknown> | undefined)?.channel as
+		Record<string, unknown> | undefined;
+	const atom = document.feed as Record<string, unknown> | undefined;
+	if (!rssChannel && !atom) throw new Error('INVALID_FEED');
+	const rawEntries = values(
+		(rssChannel?.item ?? atom?.entry) as
+			Record<string, unknown> | Record<string, unknown>[] | undefined
+	);
+	return rawEntries.slice(0, 200).flatMap((entry) => {
+		const title = clean(textFrom(entry.title), 300);
+		const url = clean(entryLink(entry.link) || textFrom(entry.link), 2_000);
+		if (!title || !validHttpUrl(url)) return [];
+		const guid = clean(textFrom(entry.guid ?? entry.id), 2_000);
+		const externalId = guid || createHash('sha256').update(url).digest('hex');
+		const rawSummary = textFrom(entry.description ?? entry.summary ?? entry.content);
+		const summary = clean(
+			sanitizeHtml(rawSummary, { allowedTags: [], allowedAttributes: {} }),
+			5_000
+		);
+		return [
+			{
+				externalId,
+				title,
+				url,
+				summary,
+				publishedAtUtc: parseDate(entry.pubDate ?? entry.published ?? entry.updated)
+			}
+		];
+	});
+}
+
+export function listFeedSources(): FeedSource[] {
+	return (
+		getDatabase()
+			.prepare(
+				`SELECT id, name, url, is_enabled, refresh_interval_minutes,
+		default_category_id, last_fetched_at_utc, next_fetch_at_utc, last_error FROM feed_sources ORDER BY name`
+			)
+			.all() as Array<Record<string, unknown>>
+	).map((row) => ({
+		id: String(row.id),
+		name: String(row.name),
+		url: String(row.url),
+		isEnabled: row.is_enabled === 1,
+		refreshIntervalMinutes: Number(row.refresh_interval_minutes),
+		defaultCategoryId: row.default_category_id ? String(row.default_category_id) : null,
+		lastFetchedAtUtc: row.last_fetched_at_utc ? String(row.last_fetched_at_utc) : null,
+		nextFetchAtUtc: row.next_fetch_at_utc ? String(row.next_fetch_at_utc) : null,
+		lastError: String(row.last_error)
+	}));
+}
+
+export function saveFeedSource(
+	id: string | null,
+	input: {
+		name: string;
+		url: string;
+		isEnabled: boolean;
+		refreshIntervalMinutes: number;
+		defaultCategoryId: string | null;
+	}
+) {
+	const name = clean(input.name, 120);
+	const url = clean(input.url, 2_000);
+	if (
+		!name ||
+		!validHttpUrl(url) ||
+		!Number.isInteger(input.refreshIntervalMinutes) ||
+		input.refreshIntervalMinutes < 15 ||
+		input.refreshIntervalMinutes > 10080
+	)
+		throw new Error('INVALID_FEED');
+	const database = getDatabase();
+	if (
+		input.defaultCategoryId &&
+		!database.prepare('SELECT 1 FROM section_categories WHERE id = ?').get(input.defaultCategoryId)
+	)
+		throw new Error('INVALID_TAXONOMY');
+	const now = new Date().toISOString();
+	if (!id) {
+		id = randomUUID();
+		database
+			.prepare(
+				`INSERT INTO feed_sources (id, name, url, is_enabled, refresh_interval_minutes,
+			default_category_id, next_fetch_at_utc, created_at_utc, updated_at_utc) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				id,
+				name,
+				url,
+				input.isEnabled ? 1 : 0,
+				input.refreshIntervalMinutes,
+				input.defaultCategoryId,
+				input.isEnabled ? now : null,
+				now,
+				now
+			);
+	} else {
+		const result = database
+			.prepare(
+				`UPDATE feed_sources SET name = ?, url = ?, is_enabled = ?, refresh_interval_minutes = ?,
+			default_category_id = ?, next_fetch_at_utc = CASE WHEN ? = 1 THEN COALESCE(next_fetch_at_utc, ?) ELSE NULL END,
+			updated_at_utc = ? WHERE id = ?`
+			)
+			.run(
+				name,
+				url,
+				input.isEnabled ? 1 : 0,
+				input.refreshIntervalMinutes,
+				input.defaultCategoryId,
+				input.isEnabled ? 1 : 0,
+				now,
+				now,
+				id
+			);
+		if (!result.changes) throw new Error('NOT_FOUND');
+	}
+	return id;
+}
+
+export function deleteFeedSource(id: string) {
+	if (!getDatabase().prepare('DELETE FROM feed_sources WHERE id = ?').run(id).changes)
+		throw new Error('NOT_FOUND');
+}
+
+export function listFeedEntries(status: 'new' | 'imported' | 'discarded' = 'new'): FeedEntry[] {
+	return (
+		getDatabase()
+			.prepare(
+				`SELECT e.id, e.feed_id, f.name AS feed_name, e.title, e.url, e.summary,
+		e.published_at_utc, e.status, e.piece_id, f.default_category_id FROM feed_entries e
+		JOIN feed_sources f ON f.id = e.feed_id WHERE e.status = ? ORDER BY COALESCE(e.published_at_utc, e.first_seen_at_utc) DESC`
+			)
+			.all(status) as Array<Record<string, unknown>>
+	).map((row) => ({
+		id: String(row.id),
+		feedId: String(row.feed_id),
+		feedName: String(row.feed_name),
+		title: String(row.title),
+		url: String(row.url),
+		summary: String(row.summary),
+		publishedAtUtc: row.published_at_utc ? String(row.published_at_utc) : null,
+		status: row.status as FeedEntry['status'],
+		pieceId: row.piece_id ? String(row.piece_id) : null,
+		defaultCategoryId: row.default_category_id ? String(row.default_category_id) : null
+	}));
+}
+
+export async function fetchFeed(feedId: string) {
+	const database = getDatabase();
+	const feed = database.prepare('SELECT * FROM feed_sources WHERE id = ?').get(feedId) as
+		Record<string, unknown> | undefined;
+	if (!feed) throw new Error('NOT_FOUND');
+	const now = new Date();
+	try {
+		const response = await fetchXml(String(feed.url), {
+			...(feed.etag ? { 'If-None-Match': String(feed.etag) } : {}),
+			...(feed.last_modified ? { 'If-Modified-Since': String(feed.last_modified) } : {})
+		});
+		let inserted = 0;
+		if (!response.unchanged) {
+			const add =
+				database.prepare(`INSERT INTO feed_entries (id, feed_id, external_id, title, url, summary,
+				published_at_utc, first_seen_at_utc, updated_at_utc) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+				ON CONFLICT(feed_id, external_id) DO UPDATE SET title = excluded.title, url = excluded.url,
+				summary = excluded.summary, published_at_utc = excluded.published_at_utc, updated_at_utc = excluded.updated_at_utc`);
+			for (const entry of parseFeed(response.xml)) {
+				const existed = database
+					.prepare('SELECT 1 FROM feed_entries WHERE feed_id = ? AND external_id = ?')
+					.get(feedId, entry.externalId);
+				add.run(
+					randomUUID(),
+					feedId,
+					entry.externalId,
+					entry.title,
+					entry.url,
+					entry.summary,
+					entry.publishedAtUtc,
+					now.toISOString(),
+					now.toISOString()
+				);
+				if (!existed) inserted += 1;
+			}
+		}
+		const next = new Date(
+			now.getTime() + Number(feed.refresh_interval_minutes) * 60_000
+		).toISOString();
+		database
+			.prepare(
+				`UPDATE feed_sources SET etag = ?, last_modified = ?, last_fetched_at_utc = ?,
+			next_fetch_at_utc = ?, last_error = '', updated_at_utc = ? WHERE id = ?`
+			)
+			.run(
+				response.etag,
+				response.lastModified,
+				now.toISOString(),
+				next,
+				now.toISOString(),
+				feedId
+			);
+		return { inserted, unchanged: response.unchanged };
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message.slice(0, 500) : 'FEED_FETCH';
+		const next = new Date(
+			now.getTime() + Number(feed.refresh_interval_minutes) * 60_000
+		).toISOString();
+		database
+			.prepare(
+				'UPDATE feed_sources SET last_fetched_at_utc = ?, next_fetch_at_utc = ?, last_error = ?, updated_at_utc = ? WHERE id = ?'
+			)
+			.run(now.toISOString(), next, message, now.toISOString(), feedId);
+		throw cause;
+	}
+}
+
+export async function fetchDueFeeds() {
+	const rows = getDatabase()
+		.prepare(
+			`SELECT id FROM feed_sources WHERE is_enabled = 1
+		AND (next_fetch_at_utc IS NULL OR next_fetch_at_utc <= ?) ORDER BY next_fetch_at_utc LIMIT 10`
+		)
+		.all(new Date().toISOString()) as { id: string }[];
+	for (const row of rows) await fetchFeed(row.id).catch(() => undefined);
+}
+
+export function importFeedEntries(entryIds: string[], categoryIds: string[]) {
+	const database = getDatabase();
+	const categories = [...new Set(categoryIds.filter(Boolean))];
+	if (categories.length > 20) throw new Error('INVALID_TAXONOMY');
+	for (const category of categories)
+		if (!database.prepare('SELECT 1 FROM section_categories WHERE id = ?').get(category))
+			throw new Error('INVALID_TAXONOMY');
+	return database.transaction(() =>
+		entryIds.map((entryId) => {
+			const entry = database
+				.prepare(
+					`SELECT e.*, f.default_category_id FROM feed_entries e JOIN feed_sources f ON f.id = e.feed_id
+			WHERE e.id = ? AND e.status = 'new'`
+				)
+				.get(entryId) as Record<string, unknown> | undefined;
+			if (!entry) throw new Error('NOT_FOUND');
+			const pieceId = createPiece('blank');
+			const piece = getPiece(pieceId)!;
+			const assigned = categories.length
+				? categories
+				: entry.default_category_id
+					? [String(entry.default_category_id)]
+					: [];
+			savePiece(pieceId, piece.revision, {
+				...piece,
+				title: String(entry.title),
+				summary: String(entry.summary),
+				status: 'inbox',
+				categoryIds: assigned,
+				sources: [{ label: 'RSS: Originalbeitrag', url: String(entry.url), timecodeSeconds: null }]
+			});
+			database
+				.prepare(
+					"UPDATE feed_entries SET status = 'imported', piece_id = ?, updated_at_utc = ? WHERE id = ?"
+				)
+				.run(pieceId, new Date().toISOString(), entryId);
+			return pieceId;
+		})
+	)();
+}
+
+export function discardFeedEntries(entryIds: string[]) {
+	const database = getDatabase();
+	const update = database.prepare(
+		"UPDATE feed_entries SET status = 'discarded', updated_at_utc = ? WHERE id = ? AND status = 'new'"
+	);
+	const now = new Date().toISOString();
+	return database.transaction(() =>
+		entryIds.reduce((count, id) => count + update.run(now, id).changes, 0)
+	)();
+}
+
+let schedulerStarted = false;
+export function startFeedScheduler() {
+	if (schedulerStarted || process.env.NODE_ENV === 'test') return;
+	schedulerStarted = true;
+	void fetchDueFeeds();
+	setInterval(() => void fetchDueFeeds(), 60_000).unref();
+}

src/lib/server/live.spec.ts

@@ -16,6 +16,7 @@ import {
 	moveOpenUsage,
 	presentationChannelAccess,
 	presentUsage,
+	resumeUsage,
 	rotatePresentationChannelKey,
 	selectUsage,
 	skipCurrent,
@@ -40,7 +41,7 @@ afterEach(() => {
 });
 
 describe('live mode', () => {
-	it('persists a frozen section countdown across usage changes and reloads', () => {
+	it('keeps elapsed section time while applying an updated section plan', () => {
 		getDatabase()
 			.prepare(
 				"UPDATE show_sections SET explicit_duration_seconds = 300 WHERE id = 'section-stories'"
@@ -59,6 +60,11 @@ describe('live mode', () => {
 				"UPDATE show_sections SET explicit_duration_seconds = 600 WHERE id = 'section-stories'"
 			)
 			.run();
+		live = getLiveView('show-october', new Date('2026-10-23T18:01:40.000Z'));
+		expect(live.sectionTimer).toMatchObject({
+			plannedDurationSeconds: 600,
+			elapsedSeconds: 100
+		});
 		completeCurrent(
 			'show-october',
 			'timer-next-piece',
@@ -68,7 +74,7 @@ describe('live mode', () => {
 		live = getLiveView('show-october', new Date('2026-10-23T18:04:00.000Z'));
 		expect(live.current?.id).toBe('usage-effects');
 		expect(live.sectionTimer).toMatchObject({
-			plannedDurationSeconds: 300,
+			plannedDurationSeconds: 600,
 			elapsedSeconds: 240
 		});
 		completeCurrent(
@@ -104,13 +110,54 @@ describe('live mode', () => {
 				.find((usage) => usage.id === 'usage-console')?.status
 		).toBe('done');
 
-		selectUsage('show-october', 'usage-console', 'return-to-completed', live.liveRevision);
+		expect(() =>
+			selectUsage('show-october', 'usage-console', 'return-to-completed', live.liveRevision)
+		).toThrow('INVALID_STATUS');
+		resumeUsage('show-october', 'usage-console', 'resume-completed', live.liveRevision);
 		expect(getLiveView('show-october').current).toMatchObject({
 			id: 'usage-console',
 			status: 'current'
 		});
 	});
 
+	it('resumes a completed piece and its earlier section timer without resetting total time', () => {
+		const database = getDatabase();
+		database
+			.prepare(
+				"UPDATE show_sections SET explicit_duration_seconds = 300 WHERE id = 'section-stories'"
+			)
+			.run();
+		database
+			.prepare("UPDATE show_sections SET explicit_duration_seconds = 200 WHERE id = 'section-game'")
+			.run();
+		database
+			.prepare(
+				"UPDATE piece_usages SET show_section_id = 'section-game', position = 0 WHERE id = 'usage-effects'"
+			)
+			.run();
+		const start = new Date('2026-10-23T18:00:00.000Z');
+		startOrResumeLive('show-october', 'resume-start', 0, start);
+		completeCurrent('show-october', 'resume-next', 1, new Date('2026-10-23T18:01:00.000Z'));
+		let live = getLiveView('show-october', new Date('2026-10-23T18:01:30.000Z'));
+		expect(live.current?.id).toBe('usage-effects');
+		resumeUsage(
+			'show-october',
+			'usage-console',
+			'resume-earlier',
+			live.liveRevision,
+			new Date('2026-10-23T18:01:30.000Z')
+		);
+		live = getLiveView('show-october', new Date('2026-10-23T18:02:00.000Z'));
+		expect(live.current).toMatchObject({ id: 'usage-console', status: 'current' });
+		expect(live.completedCount).toBe(0);
+		expect(live.sectionTimer).toMatchObject({
+			sectionId: 'section-stories',
+			plannedDurationSeconds: 300,
+			elapsedSeconds: 90
+		});
+		expect(live.totalTimer.elapsedSeconds).toBe(120);
+	});
+
 	it('keeps one stable output channel until its key is explicitly rotated', () => {
 		const key = issuePresentationAccess('show-october');
 		expect(issuePresentationAccess('show-october')).toBe(key);
@@ -239,6 +286,40 @@ describe('live mode', () => {
 		expect(media).toBeNull();
 		expect(await getPresentationMedia(token, 'unknown-image')).toBeNull();
 
+		getDatabase()
+			.prepare(
+				`INSERT INTO usage_media_snapshots
+				 (id, usage_id, original_media_id, alt_text, position, is_presentation)
+				 VALUES ('presentation-snapshot', 'usage-console', 'presentation-image',
+				 'Konsole auf dem Tisch', 0, 1)`
+			)
+			.run();
+		getDatabase()
+			.prepare(
+				`UPDATE piece_usages SET presentation_mode_snapshot = 'text',
+				 presentation_image_only_snapshot = 1,
+				 presentation_image_url_snapshot = 'https://private.example.test/not-for-image-mode'
+				 WHERE id = 'usage-console'`
+			)
+			.run();
+		presentUsage(
+			'show-october',
+			'usage-console',
+			'present-image-only',
+			getLiveView('show-october').liveRevision
+		);
+		expect(getPresentationView(token)?.content).toMatchObject({
+			mode: 'image',
+			imageUrl: '',
+			images: [{ id: 'presentation-snapshot', altText: 'Konsole auf dem Tisch' }],
+			sources: []
+		});
+		expect(await getPresentationMedia(token, 'presentation-snapshot')).toMatchObject({
+			mimeType: 'image/png',
+			byteSize: 10,
+			altText: 'Konsole auf dem Tisch'
+		});
+
 		const replacementToken = issuePresentationAccess('show-october');
 		expect(replacementToken).toBe(token);
 		expect(getPresentationView(token)?.content?.title).toBe(

src/lib/server/live.ts

@@ -149,12 +149,13 @@ function orderedUsages(database: Database.Database, showId: string): OrderedUsag
 function usageBelongsToShow(database: Database.Database, showId: string, usageId: string) {
 	const row = database
 		.prepare(
-			`SELECT s.is_reserve_bank FROM piece_usages u
+			`SELECT s.is_reserve_bank, u.status FROM piece_usages u
 			 JOIN show_sections s ON s.id = u.show_section_id
 			 WHERE u.id = ? AND s.show_id = ?`
 		)
-		.get(usageId, showId) as { is_reserve_bank: number } | undefined;
+		.get(usageId, showId) as { is_reserve_bank: number; status: string } | undefined;
 	if (!row || row.is_reserve_bank) throw new Error('NOT_FOUND');
+	return row;
 }
 
 function closeActiveRun(database: Database.Database, showId: string, now: string) {
@@ -261,12 +262,46 @@ function syncSectionTimer(
 	if (!section) throw new Error('NOT_FOUND');
 	const active = database
 		.prepare(
-			'SELECT id, section_id FROM live_section_timers WHERE show_id = ? AND ended_at_utc IS NULL'
+			`SELECT id, section_id, planned_duration_seconds
+			 FROM live_section_timers WHERE show_id = ? AND ended_at_utc IS NULL`
 		)
-		.get(showId) as { id: string; section_id: string } | undefined;
-	if (active?.section_id === section.id) return;
+		.get(showId) as
+		{ id: string; section_id: string; planned_duration_seconds: number } | undefined;
+	if (active?.section_id === section.id) {
+		if (!section.explicit_duration_seconds || section.explicit_duration_seconds <= 0) {
+			closeSectionTimer(database, showId, now);
+		} else if (active.planned_duration_seconds !== section.explicit_duration_seconds) {
+			database
+				.prepare('UPDATE live_section_timers SET planned_duration_seconds = ? WHERE id = ?')
+				.run(section.explicit_duration_seconds, active.id);
+		}
+		return;
+	}
 	if (active) closeSectionTimer(database, showId, now);
 	if (!section.explicit_duration_seconds || section.explicit_duration_seconds <= 0) return;
+	const previous = database
+		.prepare(
+			`SELECT id FROM live_section_timers WHERE show_id = ? AND section_id = ?
+			 ORDER BY started_at_utc DESC LIMIT 1`
+		)
+		.get(showId, section.id) as { id: string } | undefined;
+	if (previous) {
+		database
+			.prepare(
+				`UPDATE live_section_timers SET planned_duration_seconds = ?, ended_at_utc = NULL
+				 WHERE id = ?`
+			)
+			.run(section.explicit_duration_seconds, previous.id);
+		if (showTimerRunning(database, showId)) {
+			database
+				.prepare(
+					`INSERT INTO live_section_timer_runs (id, timer_id, started_at_utc)
+					 VALUES (?, ?, ?)`
+				)
+				.run(randomUUID(), previous.id, now);
+		}
+		return;
+	}
 	const timerId = randomUUID();
 	database
 		.prepare(
@@ -275,12 +310,14 @@ function syncSectionTimer(
 			 VALUES (?, ?, ?, ?, ?)`
 		)
 		.run(timerId, showId, section.id, section.explicit_duration_seconds, now);
-	database
-		.prepare(
-			`INSERT INTO live_section_timer_runs (id, timer_id, started_at_utc)
-			 VALUES (?, ?, ?)`
-		)
-		.run(randomUUID(), timerId, now);
+	if (showTimerRunning(database, showId)) {
+		database
+			.prepare(
+				`INSERT INTO live_section_timer_runs (id, timer_id, started_at_utc)
+				 VALUES (?, ?, ?)`
+			)
+			.run(randomUUID(), timerId, now);
+	}
 }
 
 function activateUsage(database: Database.Database, showId: string, usageId: string, now: string) {
@@ -400,6 +437,9 @@ export function getLiveView(showId: string, nowValue?: Date): LiveView {
 	const state = ensureLiveState(database, showId, now);
 	const show = getShow(showId);
 	if (!show) throw new Error('NOT_FOUND');
+	if (state.started_at_utc && !state.ended_at_utc && state.current_usage_id) {
+		syncSectionTimer(database, showId, state.current_usage_id, now);
+	}
 	const durations = actualDurations(database, showId, now);
 	const sections = show.sections.map((section) => ({
 		...section,
@@ -929,7 +969,8 @@ export function selectUsage(
 		(database, state, now) => {
 			if (!state.started_at_utc) throw new Error('NOT_STARTED');
 			if (!showTimerRunning(database, showId)) throw new Error('TIMER_PAUSED');
-			usageBelongsToShow(database, showId, usageId);
+			const target = usageBelongsToShow(database, showId, usageId);
+			if (target.status !== 'open') throw new Error('INVALID_STATUS');
 			if (state.current_usage_id === usageId) return;
 			if (state.current_usage_id) {
 				closeActiveRun(database, showId, now);
@@ -943,6 +984,36 @@ export function selectUsage(
 	);
 }
 
+export function resumeUsage(
+	showId: string,
+	usageId: string,
+	commandId: string,
+	expectedRevision: number,
+	nowValue?: Date
+) {
+	return executeCommand(
+		showId,
+		commandId,
+		expectedRevision,
+		'resume-usage',
+		(database, state, now) => {
+			if (!state.started_at_utc || state.ended_at_utc) throw new Error('NOT_LIVE');
+			if (!showTimerRunning(database, showId)) throw new Error('TIMER_PAUSED');
+			const target = usageBelongsToShow(database, showId, usageId);
+			if (target.status !== 'done' && target.status !== 'skipped')
+				throw new Error('INVALID_STATUS');
+			if (state.current_usage_id) {
+				closeActiveRun(database, showId, now);
+				database
+					.prepare("UPDATE piece_usages SET status = 'open' WHERE id = ?")
+					.run(state.current_usage_id);
+			}
+			activateUsage(database, showId, usageId, now);
+		},
+		nowValue
+	);
+}
+
 export function presentUsage(
 	showId: string,
 	usageId: string | null,
@@ -1126,7 +1197,8 @@ function getPresentationViewForShow(showId: string): PresentationView {
 	const usage = database
 		.prepare(
 			`SELECT u.title_snapshot, u.output_title_snapshot, u.presentation_snapshot,
-			 u.presentation_mode_snapshot, u.presentation_source_label_snapshot,
+			 CASE WHEN u.presentation_image_only_snapshot = 1 THEN 'image' ELSE u.presentation_mode_snapshot END AS presentation_mode_snapshot,
+			 u.presentation_source_label_snapshot,
 			 u.presentation_source_url_snapshot, u.presentation_source_timecode_snapshot,
 			 u.presentation_title_meta_snapshot, u.presentation_description_snapshot,
 			 u.presentation_image_url_snapshot, u.presentation_site_name_snapshot,
@@ -1152,10 +1224,11 @@ function getPresentationViewForShow(showId: string): PresentationView {
 		  }
 		| undefined;
 	if (!usage) return { revision: state.presentation_revision, content: null };
+	const mode = usage.presentation_mode_snapshot;
 	return {
 		revision: state.presentation_revision,
 		content: {
-			mode: usage.presentation_mode_snapshot,
+			mode,
 			topics: (
 				database
 					.prepare('SELECT name FROM usage_topic_snapshots WHERE usage_id = ? ORDER BY position')
@@ -1172,7 +1245,7 @@ function getPresentationViewForShow(showId: string): PresentationView {
 				: null,
 			previewTitle: usage.presentation_title_meta_snapshot,
 			description: usage.presentation_description_snapshot,
-			imageUrl: usage.presentation_image_url_snapshot,
+			imageUrl: mode === 'link' ? usage.presentation_image_url_snapshot : '',
 			siteName: usage.presentation_site_name_snapshot,
 			provider: usage.presentation_provider_snapshot,
 			providerId: usage.presentation_provider_id_snapshot,
@@ -1182,21 +1255,23 @@ function getPresentationViewForShow(showId: string): PresentationView {
 				usage.presentation_source_timecode_snapshot
 			),
 			sources: [],
-			images: (
-				database
-					.prepare(
-						`SELECT id, alt_text FROM usage_media_snapshots
-						 WHERE usage_id = ? AND is_presentation = 1`
-					)
-					.all(state.presentation_usage_id) as { id: string; alt_text: string }[]
-			).map((media) => ({ id: media.id, altText: media.alt_text }))
+			images: ['text', 'image'].includes(mode)
+				? (
+						database
+							.prepare(
+								`SELECT id, alt_text FROM usage_media_snapshots
+								 WHERE usage_id = ? AND is_presentation = 1`
+							)
+							.all(state.presentation_usage_id) as { id: string; alt_text: string }[]
+					).map((media) => ({ id: media.id, altText: media.alt_text }))
+				: []
 		}
 	};
 }
 
 export async function getPresentationPreviewImage(token: string) {
 	const view = getPresentationView(token);
-	if (!view?.content?.imageUrl || view.content.mode === 'text') return null;
+	if (!view?.content?.imageUrl || view.content.mode !== 'link') return null;
 	try {
 		return await fetchPresentationImage(view.content.imageUrl);
 	} catch {
@@ -1220,7 +1295,8 @@ export async function getPresentationMedia(
 			 JOIN show_sections s ON s.id = u.show_section_id
 			 JOIN piece_media pm ON pm.id = ums.original_media_id
 			 WHERE state.show_id = ? AND s.show_id = state.show_id
-			 AND s.is_reserve_bank = 0 AND ums.id = ? AND ums.is_presentation = 1`
+			 AND s.is_reserve_bank = 0 AND ums.id = ? AND ums.is_presentation = 1
+			 AND (u.presentation_image_only_snapshot = 1 OR u.presentation_mode_snapshot = 'text')`
 		)
 		.get(showId, snapshotId) as
 		{ storage_name: string; mime_type: string; byte_size: number; alt_text: string } | undefined;

src/lib/server/presentation.ts

@@ -8,7 +8,7 @@ import image from 'metascraper-image';
 import publisher from 'metascraper-publisher';
 import title from 'metascraper-title';
 
-export type PresentationMode = 'text' | 'link' | 'video';
+export type PresentationMode = 'text' | 'image' | 'link' | 'video';
 export type VideoProvider = 'youtube' | 'tiktok';
 
 export type PresentationMetadata = {

src/lib/server/shares.spec.ts

@@ -13,6 +13,7 @@ import {
 	getSharedMedia,
 	getSharedShow,
 	revokeShare,
+	replaceShareToken,
 	updateShare
 } from './shares.js';
 import { addPieceUsage, addShowSection, createShow } from './shows.js';
@@ -138,8 +139,17 @@ describe('show shares', () => {
 		expect(getSharedShow(shared.token).status).toBe('password');
 		const session = await authenticateShare(shared.token, 'neues-freigabe-passwort', '192.0.2.20');
 		expect(getSharedShow(shared.token, session.token).status).toBe('authorized');
-		deleteShare(actor, shared.id, created.id);
+		const replacementToken = replaceShareToken(actor, shared.id, created.id);
 		expect(getSharedShow(shared.token, session.token).status).toBe('unavailable');
+		expect(getSharedShow(replacementToken).status).toBe('password');
+		const replacementSession = await authenticateShare(
+			replacementToken,
+			'neues-freigabe-passwort',
+			'192.0.2.20'
+		);
+		expect(getSharedShow(replacementToken, replacementSession.token).status).toBe('authorized');
+		deleteShare(actor, shared.id, created.id);
+		expect(getSharedShow(replacementToken, replacementSession.token).status).toBe('unavailable');
 	});
 
 	it('projects exactly the selected information scope', async () => {

src/lib/server/shares.ts

@@ -193,6 +193,27 @@ export async function updateShare(
 	})();
 }
 
+export function replaceShareToken(
+	actor: AuthUser,
+	shareId: string,
+	expectedShowId?: string
+): string {
+	requireBarkeeperActor(actor);
+	const token = createToken();
+	const database = getDatabase();
+	database.transaction(() => {
+		const result = database
+			.prepare(
+				`UPDATE show_shares SET token_hash = ?
+				 WHERE id = ? AND revoked_at_utc IS NULL${expectedShowId ? ' AND show_id = ?' : ''}`
+			)
+			.run(hashToken(token), ...(expectedShowId ? [shareId, expectedShowId] : [shareId]));
+		if (result.changes !== 1) throw new Error('NOT_FOUND');
+		database.prepare('DELETE FROM show_share_sessions WHERE share_id = ?').run(shareId);
+	})();
+	return token;
+}
+
 export function deleteShare(actor: AuthUser, shareId: string, expectedShowId?: string): void {
 	requireBarkeeperActor(actor);
 	const result = getDatabase()

src/lib/server/shows.spec.ts

@@ -13,6 +13,7 @@ import {
 	duplicatePieceUsage,
 	getPieceUsageContexts,
 	getShow,
+	listPreparationUsages,
 	listShowTemplates,
 	movePieceUsage,
 	moveShowSection,
@@ -60,12 +61,57 @@ function editedUsage(usage: PieceUsage, overrides: Partial<PieceUsage> = {}) {
 		presentationImageUrl: edited.presentationImageUrl,
 		presentationSiteName: edited.presentationSiteName,
 		presentationMediaId: edited.presentationMediaId,
+		preparationStatus: edited.preparationStatus,
+		preparationEffort: edited.preparationEffort,
 		ownNotes: edited.ownNotes,
 		durationSeconds: edited.durationSeconds
 	};
 }
 
 describe('show builder data layer', () => {
+	it('tracks preparation on the concrete usage independently from its original', () => {
+		const database = getDatabase();
+		database
+			.prepare(
+				"UPDATE pieces SET status = 'preparing', preparation_effort = 'high' WHERE id = 'piece-console'"
+			)
+			.run();
+		database.prepare("UPDATE pieces SET status = 'preparing' WHERE id = 'piece-sounds'").run();
+		const show = getShow('show-october')!;
+		const planned = addPieceUsage(show.id, show.revision, {
+			pieceId: 'piece-console',
+			sectionId: show.sections[0].id
+		});
+
+		database
+			.prepare(
+				"UPDATE pieces SET status = 'ready', preparation_effort = 'low' WHERE id = 'piece-console'"
+			)
+			.run();
+		const usages = listPreparationUsages();
+		expect(usages.map((usage) => usage.usageId)).toEqual([planned.id]);
+		expect(usages[0]).toMatchObject({
+			showId: 'show-october',
+			showTitle: 'Herbstsendung: Kleine Welten',
+			sectionName: show.sections[0].name,
+			title: 'Die kleine Konsole mit dem großen Dreh',
+			preparationEffort: 'high',
+			topics: [{ name: 'Gaming' }]
+		});
+		expect(usages.some((usage) => usage.title === 'Drei Sounds, ein Spiel')).toBe(false);
+
+		const plannedUsage = getShow(show.id)!.sections[0].usages.find(
+			(usage) => usage.id === planned.id
+		)!;
+		updatePieceUsage(
+			show.id,
+			planned.id,
+			planned.revision,
+			editedUsage(plannedUsage, { preparationStatus: 'ready' })
+		);
+		expect(listPreparationUsages()).toEqual([]);
+	});
+
 	it('creates a fundus original and usage atomically and idempotently', () => {
 		const created = createShow({ title: 'Direkte Planung', startsAtUtc: null, templateId: null });
 		const section = addShowSection(created.id, created.revision, {

src/lib/server/shows.ts

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import type Database from 'better-sqlite3';
 import { createPiece } from './content.js';
 import { getDatabase } from './database.js';
-import { detectVideoProvider, type PresentationMode } from './presentation.js';
+import { detectVideoProvider, type PresentationMode, type VideoProvider } from './presentation.js';
 
 export const SHOW_STATUSES = ['draft', 'ready', 'live', 'completed'] as const;
 export const USAGE_STATUSES = ['open', 'current', 'done', 'skipped'] as const;
@@ -10,6 +10,8 @@ export const USAGE_STATUSES = ['open', 'current', 'done', 'skipped'] as const;
 export type ShowStatus = (typeof SHOW_STATUSES)[number];
 export type EditableShowStatus = Exclude<ShowStatus, 'completed'>;
 export type UsageStatus = (typeof USAGE_STATUSES)[number];
+export type UsagePreparationStatus = 'preparing' | 'ready';
+export type PreparationEffort = 'low' | 'medium' | 'high' | null;
 
 export type ShowListItem = {
 	id: string;
@@ -21,12 +23,24 @@ export type ShowListItem = {
 	sectionCount: number;
 };
 
+export type PreparationUsage = {
+	usageId: string;
+	showId: string;
+	showTitle: string;
+	showStartsAtUtc: string | null;
+	sectionName: string;
+	title: string;
+	preparationEffort: PreparationEffort;
+	topics: UsageTopic[];
+};
+
 export type ShowTemplateSection = {
 	id: string;
 	name: string;
 	categoryId: string | null;
 	position: number;
 	explicitDurationSeconds: number | null;
+	twitchTags: string[];
 };
 
 export type ShowTemplate = {
@@ -41,6 +55,8 @@ export type PieceUsage = {
 	originalPieceId: string | null;
 	position: number;
 	status: UsageStatus;
+	preparationStatus: UsagePreparationStatus;
+	preparationEffort: PreparationEffort;
 	durationSeconds: number;
 	title: string;
 	outputTitle: string;
@@ -58,7 +74,7 @@ export type PieceUsage = {
 	presentationDescription: string;
 	presentationImageUrl: string;
 	presentationSiteName: string;
-	presentationProvider: string;
+	presentationProvider: VideoProvider | '';
 	presentationProviderId: string;
 	ownNotes: string;
 	sources: { id: string; label: string; url: string; timecodeSeconds: number | null }[];
@@ -106,6 +122,7 @@ export type ShowSection = {
 	categoryColor: string | null;
 	position: number;
 	explicitDurationSeconds: number | null;
+	twitchTags: string[];
 	durationSeconds: number;
 	usages: PieceUsage[];
 };
@@ -144,6 +161,7 @@ export type ShowSectionInput = {
 	name: string;
 	categoryId: string | null;
 	explicitDurationSeconds: number | null;
+	twitchTags?: string[];
 	position?: number;
 };
 
@@ -172,6 +190,8 @@ export type PieceUsageUpdate = {
 	presentationSiteName: string;
 	ownNotes: string;
 	durationSeconds: number;
+	preparationStatus?: UsagePreparationStatus;
+	preparationEffort?: PreparationEffort;
 	tools?: { id: string; workUrl: string; note: string }[];
 	presentationMediaId?: string | null;
 };
@@ -207,6 +227,7 @@ type SectionRow = {
 	category_color_snapshot: string | null;
 	position: number;
 	explicit_duration_seconds: number | null;
+	twitch_tags: string;
 	is_reserve_bank: number;
 };
 
@@ -216,6 +237,8 @@ type UsageRow = {
 	original_piece_id: string | null;
 	position: number;
 	status: UsageStatus;
+	preparation_status_snapshot: UsagePreparationStatus;
+	preparation_effort_snapshot: PreparationEffort;
 	duration_seconds: number;
 	title_snapshot: string;
 	output_title_snapshot: string;
@@ -226,6 +249,7 @@ type UsageRow = {
 	transition_snapshot: string;
 	presentation_snapshot: string;
 	presentation_mode_snapshot: PresentationMode;
+	presentation_image_only_snapshot: number;
 	presentation_source_label_snapshot: string;
 	presentation_source_url_snapshot: string;
 	presentation_source_timecode_snapshot: number | null;
@@ -233,7 +257,7 @@ type UsageRow = {
 	presentation_description_snapshot: string;
 	presentation_image_url_snapshot: string;
 	presentation_site_name_snapshot: string;
-	presentation_provider_snapshot: string;
+	presentation_provider_snapshot: VideoProvider | '';
 	presentation_provider_id_snapshot: string;
 	own_notes: string;
 };
@@ -254,6 +278,14 @@ function validDuration(value: number | null): number | null {
 	return value;
 }
 
+function validTwitchTags(values: string[]) {
+	const tags = [...new Set(values.map((tag) => tag.trim()).filter(Boolean))];
+	if (tags.length > 10 || tags.some((tag) => tag.length > 25 || tag.includes(','))) {
+		throw new Error('INVALID_TWITCH_TAGS');
+	}
+	return tags;
+}
+
 function validPosition(value: number, maximum: number): number {
 	if (!Number.isInteger(value) || value < 0) throw new Error('INVALID_POSITION');
 	return Math.min(value, maximum);
@@ -277,7 +309,7 @@ function validPresentation(
 	imageUrl: string,
 	siteName: string
 ) {
-	if (!['text', 'link', 'video'].includes(mode)) throw new Error('INVALID_PRESENTATION');
+	if (!['text', 'image', 'link', 'video'].includes(mode)) throw new Error('INVALID_PRESENTATION');
 	const cleanUrl = cleanText(sourceUrl, 2_000, 'presentation_source');
 	const cleanImageUrl = cleanText(imageUrl, 2_000, 'presentation_image');
 	for (const value of [cleanUrl, cleanImageUrl]) {
@@ -289,7 +321,7 @@ function validPresentation(
 			throw new Error('INVALID_PRESENTATION');
 		}
 	}
-	if (mode !== 'text' && !cleanUrl) throw new Error('INVALID_PRESENTATION');
+	if ((mode === 'link' || mode === 'video') && !cleanUrl) throw new Error('INVALID_PRESENTATION');
 	if (
 		timecodeSeconds !== null &&
 		(!Number.isInteger(timecodeSeconds) || timecodeSeconds < 0 || timecodeSeconds > 86_400)
@@ -446,6 +478,8 @@ function usageFromRow(database: Database.Database, row: UsageRow): PieceUsage {
 		originalPieceId: row.original_piece_id,
 		position: row.position,
 		status: row.status,
+		preparationStatus: row.preparation_status_snapshot,
+		preparationEffort: row.preparation_effort_snapshot,
 		durationSeconds: row.duration_seconds,
 		title: row.title_snapshot,
 		outputTitle: row.output_title_snapshot,
@@ -756,13 +790,57 @@ export function listShows(statuses?: ShowStatus[]): ShowListItem[] {
 	}));
 }
 
+export function listPreparationUsages(): PreparationUsage[] {
+	const database = getDatabase();
+	const rows = database
+		.prepare(
+			`SELECT u.id AS usage_id, sh.id AS show_id, sh.title AS show_title,
+			 sh.starts_at_utc AS show_starts_at_utc, s.name AS section_name,
+			 u.title_snapshot, u.preparation_effort_snapshot
+			 FROM piece_usages u
+			 JOIN show_sections s ON s.id = u.show_section_id
+			 JOIN shows sh ON sh.id = s.show_id
+			 WHERE sh.status IN ('draft', 'ready', 'live')
+			 AND s.is_reserve_bank = 0 AND u.preparation_status_snapshot = 'preparing'
+			 ORDER BY sh.starts_at_utc IS NULL, sh.starts_at_utc,
+			 CASE u.preparation_effort_snapshot
+			  WHEN 'high' THEN 0 WHEN 'medium' THEN 1 WHEN 'low' THEN 2 ELSE 3 END,
+			 s.position, u.position`
+		)
+		.all() as {
+		usage_id: string;
+		show_id: string;
+		show_title: string;
+		show_starts_at_utc: string | null;
+		section_name: string;
+		title_snapshot: string;
+		preparation_effort_snapshot: PreparationUsage['preparationEffort'];
+	}[];
+	const topics = database.prepare(
+		'SELECT name, icon_name FROM usage_topic_snapshots WHERE usage_id = ? ORDER BY position'
+	);
+	return rows.map((row) => ({
+		usageId: row.usage_id,
+		showId: row.show_id,
+		showTitle: row.show_title,
+		showStartsAtUtc: row.show_starts_at_utc,
+		sectionName: row.section_name,
+		title: row.title_snapshot,
+		preparationEffort: row.preparation_effort_snapshot,
+		topics: (topics.all(row.usage_id) as { name: string; icon_name: string }[]).map((topic) => ({
+			name: topic.name,
+			iconName: topic.icon_name
+		}))
+	}));
+}
+
 export function listShowTemplates(): ShowTemplate[] {
 	const database = getDatabase();
 	const templates = database
 		.prepare('SELECT id, name, description FROM show_templates ORDER BY name')
 		.all() as Omit<ShowTemplate, 'sections'>[];
 	const sectionStatement = database.prepare(
-		`SELECT id, name, category_id, position, explicit_duration_seconds
+		`SELECT id, name, category_id, position, explicit_duration_seconds, twitch_tags
 		 FROM show_template_sections WHERE template_id = ? ORDER BY position`
 	);
 	return templates.map((template) => ({
@@ -774,13 +852,15 @@ export function listShowTemplates(): ShowTemplate[] {
 				category_id: string | null;
 				position: number;
 				explicit_duration_seconds: number | null;
+				twitch_tags: string;
 			}[]
 		).map((section) => ({
 			id: section.id,
 			name: section.name,
 			categoryId: section.category_id,
 			position: section.position,
-			explicitDurationSeconds: section.explicit_duration_seconds
+			explicitDurationSeconds: section.explicit_duration_seconds,
+			twitchTags: section.twitch_tags ? section.twitch_tags.split(',') : []
 		}))
 	}));
 }
@@ -798,7 +878,7 @@ export function getShow(id: string): Show | null {
 		.prepare(
 			`SELECT s.id, s.name, s.category_id, c.name AS category, c.color AS category_color,
 			 s.category_name_snapshot, s.category_color_snapshot,
-			 s.position, s.explicit_duration_seconds, s.is_reserve_bank
+			 s.position, s.explicit_duration_seconds, s.twitch_tags, s.is_reserve_bank
 			 FROM show_sections s LEFT JOIN section_categories c ON c.id = s.category_id
 			 WHERE s.show_id = ? ORDER BY s.position`
 		)
@@ -806,9 +886,12 @@ export function getShow(id: string): Show | null {
 	const usageRows = database
 		.prepare(
 			`SELECT u.id, u.show_section_id, u.original_piece_id, u.position, u.status,
+			 u.preparation_status_snapshot, u.preparation_effort_snapshot,
 			 u.duration_seconds, u.title_snapshot, u.output_title_snapshot, u.intro_snapshot, u.research_snapshot,
 			 u.moderation_snapshot, u.interaction_snapshot, u.transition_snapshot, u.presentation_snapshot,
-			 u.presentation_mode_snapshot, u.presentation_source_label_snapshot,
+			 CASE WHEN u.presentation_image_only_snapshot = 1 THEN 'image' ELSE u.presentation_mode_snapshot END AS presentation_mode_snapshot,
+			 u.presentation_image_only_snapshot,
+			 u.presentation_source_label_snapshot,
 			 u.presentation_source_url_snapshot, u.presentation_source_timecode_snapshot,
 			 u.presentation_title_meta_snapshot, u.presentation_description_snapshot,
 			 u.presentation_image_url_snapshot, u.presentation_site_name_snapshot,
@@ -841,6 +924,7 @@ export function getShow(id: string): Show | null {
 						: (row.category_color_snapshot ?? row.category_color),
 				position: row.position,
 				explicitDurationSeconds: row.explicit_duration_seconds,
+				twitchTags: row.twitch_tags ? row.twitch_tags.split(',') : [],
 				durationSeconds:
 					row.explicit_duration_seconds ??
 					usages.reduce((total, usage) => total + usage.durationSeconds, 0),
@@ -957,7 +1041,7 @@ export function createShow(input: CreateShowInput): CreatedMutationResult {
 		const templateSections = input.templateId
 			? (database
 					.prepare(
-						`SELECT name, category_id, position, explicit_duration_seconds
+						`SELECT name, category_id, position, explicit_duration_seconds, twitch_tags
 						 FROM show_template_sections WHERE template_id = ? ORDER BY position`
 					)
 					.all(input.templateId) as {
@@ -965,11 +1049,12 @@ export function createShow(input: CreateShowInput): CreatedMutationResult {
 					category_id: string | null;
 					position: number;
 					explicit_duration_seconds: number | null;
+					twitch_tags: string;
 				}[])
 			: [];
 		const insertSection = database.prepare(
 			`INSERT INTO show_sections (id, show_id, name, category_id, position,
-			 explicit_duration_seconds, is_reserve_bank) VALUES (?, ?, ?, ?, ?, ?, ?)`
+			 explicit_duration_seconds, twitch_tags, is_reserve_bank) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
 		);
 		for (const section of templateSections) {
 			insertSection.run(
@@ -979,10 +1064,11 @@ export function createShow(input: CreateShowInput): CreatedMutationResult {
 				section.category_id,
 				section.position,
 				section.explicit_duration_seconds,
+				section.twitch_tags,
 				0
 			);
 		}
-		insertSection.run(randomUUID(), id, 'Reservebank', null, templateSections.length, null, 1);
+		insertSection.run(randomUUID(), id, 'Reservebank', null, templateSections.length, null, '', 1);
 	});
 	create();
 	return { id, revision: 1, updatedAtUtc: now };
@@ -1033,7 +1119,7 @@ export function duplicateCompletedShow(
 		const sections = database
 			.prepare(
 				`SELECT id, name, category_id, category_name_snapshot, category_color_snapshot,
-				 position, explicit_duration_seconds, is_reserve_bank
+				 position, explicit_duration_seconds, twitch_tags, is_reserve_bank
 				 FROM show_sections WHERE show_id = ? ORDER BY position`
 			)
 			.all(sourceShowId) as {
@@ -1044,12 +1130,13 @@ export function duplicateCompletedShow(
 			category_color_snapshot: string | null;
 			position: number;
 			explicit_duration_seconds: number | null;
+			twitch_tags: string;
 			is_reserve_bank: number;
 		}[];
 		const insertSection = database.prepare(
 			`INSERT INTO show_sections (id, show_id, name, category_id, category_name_snapshot,
-			 category_color_snapshot, position, explicit_duration_seconds, is_reserve_bank)
-			 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			 category_color_snapshot, position, explicit_duration_seconds, twitch_tags, is_reserve_bank)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 		);
 		const usages = database.prepare(
 			'SELECT * FROM piece_usages WHERE show_section_id = ? ORDER BY position'
@@ -1062,8 +1149,9 @@ export function duplicateCompletedShow(
 			 presentation_source_url_snapshot, presentation_source_timecode_snapshot,
 			 presentation_title_meta_snapshot, presentation_description_snapshot,
 			 presentation_image_url_snapshot, presentation_site_name_snapshot,
-			 presentation_provider_snapshot, presentation_provider_id_snapshot, own_notes, is_reserve)
-			 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			 presentation_provider_snapshot, presentation_provider_id_snapshot, presentation_image_only_snapshot,
+			 preparation_status_snapshot, preparation_effort_snapshot, own_notes, is_reserve)
+			 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 		);
 		for (const section of sections) {
 			const sectionId = randomUUID();
@@ -1076,6 +1164,7 @@ export function duplicateCompletedShow(
 				section.category_color_snapshot,
 				section.position,
 				section.explicit_duration_seconds,
+				section.twitch_tags,
 				section.is_reserve_bank
 			);
 			for (const usage of usages.all(section.id) as (UsageRow & { is_reserve: number })[]) {
@@ -1104,6 +1193,9 @@ export function duplicateCompletedShow(
 					usage.presentation_site_name_snapshot,
 					usage.presentation_provider_snapshot,
 					usage.presentation_provider_id_snapshot,
+					usage.presentation_image_only_snapshot,
+					usage.preparation_status_snapshot,
+					usage.preparation_effort_snapshot,
 					usage.own_notes,
 					usage.is_reserve
 				);
@@ -1150,6 +1242,7 @@ export function addShowSection(
 ): CreatedMutationResult {
 	const name = cleanText(input.name, 200, 'section_name', true);
 	const duration = validDuration(input.explicitDurationSeconds);
+	const twitchTags = validTwitchTags(input.twitchTags ?? []);
 	const database = getDatabase();
 	requireCategory(database, input.categoryId);
 	return database.transaction(() => {
@@ -1174,9 +1267,9 @@ export function addShowSection(
 		database
 			.prepare(
 				`INSERT INTO show_sections (id, show_id, name, category_id, position,
-				 explicit_duration_seconds, is_reserve_bank) VALUES (?, ?, ?, ?, ?, ?, 0)`
+				 explicit_duration_seconds, twitch_tags, is_reserve_bank) VALUES (?, ?, ?, ?, ?, ?, ?, 0)`
 			)
-			.run(id, showId, name, input.categoryId, temporaryPosition, duration);
+			.run(id, showId, name, input.categoryId, temporaryPosition, duration, twitchTags.join(','));
 		visibleIds.splice(position, 0, id);
 		const reserveId = reserveSectionId(database, showId);
 		normalizePositions(database, 'show_sections', [...visibleIds, reserveId]);
@@ -1192,6 +1285,7 @@ export function updateShowSection(
 ): MutationResult {
 	const name = cleanText(input.name, 200, 'section_name', true);
 	const duration = validDuration(input.explicitDurationSeconds);
+	const twitchTags = validTwitchTags(input.twitchTags ?? []);
 	const database = getDatabase();
 	requireCategory(database, input.categoryId);
 	return database.transaction(() => {
@@ -1199,11 +1293,11 @@ export function updateShowSection(
 		sectionBelongsToShow(database, showId, sectionId);
 		database
 			.prepare(
-				`UPDATE show_sections SET name = ?, category_id = ?, explicit_duration_seconds = ?,
+				`UPDATE show_sections SET name = ?, category_id = ?, explicit_duration_seconds = ?, twitch_tags = ?,
 				 category_name_snapshot = NULL, category_color_snapshot = NULL
 				 WHERE id = ?`
 			)
-			.run(name, input.categoryId, duration, sectionId);
+			.run(name, input.categoryId, duration, twitchTags.join(','), sectionId);
 		return result;
 	})();
 }
@@ -1275,12 +1369,14 @@ export function addPieceUsage(
 		const piece = database
 			.prepare(
 				`SELECT p.title, p.output_title, p.duration_seconds, p.intro, p.research_text, p.moderation_notes,
-				 p.interaction_text, p.transition_text, p.presentation_text, p.status, p.presentation_mode,
+				 p.interaction_text, p.transition_text, p.presentation_text, p.status,
+				 CASE WHEN p.presentation_image_only = 1 THEN 'image' ELSE p.presentation_mode END AS presentation_mode,
 				 COALESCE(ps.label, '') AS presentation_source_label,
 				 COALESCE(ps.url, '') AS presentation_source_url,
 				 ps.timecode_seconds AS presentation_source_timecode,
 				 p.presentation_title, p.presentation_description, p.presentation_image_url,
-				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id
+				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id,
+				 p.preparation_effort
 				 FROM pieces p LEFT JOIN piece_sources ps ON ps.piece_id = p.id
 				 AND ps.position = p.presentation_source_position WHERE p.id = ?`
 			)
@@ -1306,6 +1402,7 @@ export function addPieceUsage(
 					presentation_provider: string;
 					presentation_provider_id: string;
 					status: string;
+					preparation_effort: PreparationEffort;
 			  }
 			| undefined;
 		if (!piece) throw new Error('NOT_FOUND');
@@ -1316,7 +1413,7 @@ export function addPieceUsage(
 		) {
 			throw new Error('NOT_FOUND');
 		}
-		if (piece.status !== 'ready') throw new Error('PIECE_NOT_READY');
+		if (!['preparing', 'ready'].includes(piece.status)) throw new Error('PIECE_NOT_READY');
 		const ids = (
 			database
 				.prepare('SELECT id FROM piece_usages WHERE show_section_id = ? ORDER BY position')
@@ -1329,12 +1426,13 @@ export function addPieceUsage(
 				`INSERT INTO piece_usages (id, show_section_id, original_piece_id, position, status,
 				 duration_seconds, title_snapshot, output_title_snapshot, intro_snapshot, research_snapshot,
 				 moderation_snapshot, interaction_snapshot, transition_snapshot, presentation_snapshot,
-				 presentation_mode_snapshot, presentation_source_label_snapshot,
+				 presentation_mode_snapshot, presentation_image_only_snapshot, presentation_source_label_snapshot,
 				 presentation_source_url_snapshot, presentation_source_timecode_snapshot,
 				 presentation_title_meta_snapshot, presentation_description_snapshot,
 				 presentation_image_url_snapshot, presentation_site_name_snapshot,
-				 presentation_provider_snapshot, presentation_provider_id_snapshot, own_notes, is_reserve)
-				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', ?)`
+				 presentation_provider_snapshot, presentation_provider_id_snapshot,
+				 preparation_status_snapshot, preparation_effort_snapshot, own_notes, is_reserve)
+				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', ?)`
 			)
 			.run(
 				id,
@@ -1350,7 +1448,8 @@ export function addPieceUsage(
 				piece.interaction_text,
 				piece.transition_text,
 				piece.presentation_text,
-				piece.presentation_mode,
+				piece.presentation_mode === 'image' ? 'text' : piece.presentation_mode,
+				piece.presentation_mode === 'image' ? 1 : 0,
 				piece.presentation_source_label,
 				piece.presentation_source_url,
 				piece.presentation_source_timecode,
@@ -1360,6 +1459,8 @@ export function addPieceUsage(
 				piece.presentation_site_name,
 				piece.presentation_provider,
 				piece.presentation_provider_id,
+				piece.status,
+				piece.preparation_effort,
 				input.sectionId === null ? 1 : 0
 			);
 		snapshotPieceRelations(database, id, input.pieceId);
@@ -1436,11 +1537,12 @@ export function duplicatePieceUsage(
 			.prepare(
 				`SELECT original_piece_id, status, duration_seconds, title_snapshot, output_title_snapshot, intro_snapshot,
 				 research_snapshot, moderation_snapshot, interaction_snapshot, transition_snapshot, presentation_snapshot,
-				 presentation_mode_snapshot, presentation_source_label_snapshot,
+				 presentation_mode_snapshot, presentation_image_only_snapshot, presentation_source_label_snapshot,
 				 presentation_source_url_snapshot, presentation_source_timecode_snapshot,
 				 presentation_title_meta_snapshot, presentation_description_snapshot,
 				 presentation_image_url_snapshot, presentation_site_name_snapshot,
 				 presentation_provider_snapshot, presentation_provider_id_snapshot,
+				 preparation_status_snapshot, preparation_effort_snapshot,
 				 own_notes, is_reserve FROM piece_usages WHERE id = ?`
 			)
 			.get(usageId) as Omit<UsageRow, 'id' | 'show_section_id' | 'position'> & {
@@ -1459,12 +1561,13 @@ export function duplicatePieceUsage(
 				`INSERT INTO piece_usages (id, show_section_id, original_piece_id, position, status,
 				 duration_seconds, title_snapshot, output_title_snapshot, intro_snapshot, research_snapshot,
 				 moderation_snapshot, interaction_snapshot, transition_snapshot, presentation_snapshot,
-				 presentation_mode_snapshot, presentation_source_label_snapshot,
+				 presentation_mode_snapshot, presentation_image_only_snapshot, presentation_source_label_snapshot,
 				 presentation_source_url_snapshot, presentation_source_timecode_snapshot,
 				 presentation_title_meta_snapshot, presentation_description_snapshot,
 				 presentation_image_url_snapshot, presentation_site_name_snapshot,
-				 presentation_provider_snapshot, presentation_provider_id_snapshot, own_notes, is_reserve)
-				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+				 presentation_provider_snapshot, presentation_provider_id_snapshot,
+				 preparation_status_snapshot, preparation_effort_snapshot, own_notes, is_reserve)
+				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 			)
 			.run(
 				id,
@@ -1481,6 +1584,7 @@ export function duplicatePieceUsage(
 				source.transition_snapshot,
 				source.presentation_snapshot,
 				source.presentation_mode_snapshot,
+				source.presentation_image_only_snapshot,
 				source.presentation_source_label_snapshot,
 				source.presentation_source_url_snapshot,
 				source.presentation_source_timecode_snapshot,
@@ -1490,6 +1594,8 @@ export function duplicatePieceUsage(
 				source.presentation_site_name_snapshot,
 				source.presentation_provider_snapshot,
 				source.presentation_provider_id_snapshot,
+				source.preparation_status_snapshot,
+				source.preparation_effort_snapshot,
 				source.own_notes,
 				source.is_reserve
 			);
@@ -1512,12 +1618,14 @@ export function refreshPieceUsageFromOriginal(
 		const source = database
 			.prepare(
 				`SELECT p.title, p.output_title, p.duration_seconds, p.intro, p.research_text,
-				 p.moderation_notes, p.interaction_text, p.transition_text, p.presentation_text, p.presentation_mode,
+				 p.moderation_notes, p.interaction_text, p.transition_text, p.presentation_text,
+				 CASE WHEN p.presentation_image_only = 1 THEN 'image' ELSE p.presentation_mode END AS presentation_mode,
 				 COALESCE(ps.label, '') AS presentation_source_label,
 				 COALESCE(ps.url, '') AS presentation_source_url,
 				 ps.timecode_seconds AS presentation_source_timecode,
 				 p.presentation_title, p.presentation_description, p.presentation_image_url,
-				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id
+				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id,
+				 p.status, p.preparation_effort
 				 FROM piece_usages u JOIN pieces p ON p.id = u.original_piece_id
 				 LEFT JOIN piece_sources ps ON ps.piece_id = p.id
 				 AND ps.position = p.presentation_source_position
@@ -1544,19 +1652,23 @@ export function refreshPieceUsageFromOriginal(
 					presentation_site_name: string;
 					presentation_provider: string;
 					presentation_provider_id: string;
+					status: string;
+					preparation_effort: PreparationEffort;
 			  }
 			| undefined;
 		if (!source) throw new Error('ORIGINAL_NOT_FOUND');
+		if (!['preparing', 'ready'].includes(source.status)) throw new Error('PIECE_NOT_READY');
 		database
 			.prepare(
 				`UPDATE piece_usages SET title_snapshot = ?, output_title_snapshot = ?, duration_seconds = ?, intro_snapshot = ?,
 				 research_snapshot = ?, moderation_snapshot = ?, interaction_snapshot = ?, transition_snapshot = ?,
-				 presentation_snapshot = ?, presentation_mode_snapshot = ?,
+				 presentation_snapshot = ?, presentation_mode_snapshot = ?, presentation_image_only_snapshot = ?,
 				 presentation_source_label_snapshot = ?, presentation_source_url_snapshot = ?,
 				 presentation_source_timecode_snapshot = ?, presentation_title_meta_snapshot = ?,
 				 presentation_description_snapshot = ?, presentation_image_url_snapshot = ?,
 				 presentation_site_name_snapshot = ?, presentation_provider_snapshot = ?,
-				 presentation_provider_id_snapshot = ? WHERE id = ?`
+				 presentation_provider_id_snapshot = ?, preparation_status_snapshot = ?,
+				 preparation_effort_snapshot = ? WHERE id = ?`
 			)
 			.run(
 				source.title,
@@ -1568,7 +1680,8 @@ export function refreshPieceUsageFromOriginal(
 				source.interaction_text,
 				source.transition_text,
 				source.presentation_text,
-				source.presentation_mode,
+				source.presentation_mode === 'image' ? 'text' : source.presentation_mode,
+				source.presentation_mode === 'image' ? 1 : 0,
 				source.presentation_source_label,
 				source.presentation_source_url,
 				source.presentation_source_timecode,
@@ -1578,6 +1691,8 @@ export function refreshPieceUsageFromOriginal(
 				source.presentation_site_name,
 				source.presentation_provider,
 				source.presentation_provider_id,
+				source.status,
+				source.preparation_effort,
 				usageId
 			);
 		snapshotPieceRelations(
@@ -1602,6 +1717,18 @@ export function updatePieceUsage(
 	const title = cleanText(input.title, 200, 'title', true);
 	const outputTitle = cleanText(input.outputTitle, 300, 'output_title');
 	const duration = validDuration(input.durationSeconds)!;
+	if (
+		input.preparationStatus !== undefined &&
+		!['preparing', 'ready'].includes(input.preparationStatus)
+	) {
+		throw new Error('INVALID_PREPARATION_STATUS');
+	}
+	if (
+		input.preparationEffort !== undefined &&
+		![null, 'low', 'medium', 'high'].includes(input.preparationEffort)
+	) {
+		throw new Error('INVALID_PREPARATION_EFFORT');
+	}
 	const values = {
 		intro: cleanText(input.intro, 50_000, 'intro'),
 		research: cleanText(input.research, 50_000, 'research'),
@@ -1612,7 +1739,7 @@ export function updatePieceUsage(
 		presentation: cleanText(input.presentation, 50_000, 'presentation'),
 		ownNotes: cleanText(input.ownNotes, 50_000, 'notes')
 	};
-	const presentation = validPresentation(
+	const submittedPresentation = validPresentation(
 		input.presentationMode,
 		input.presentationSourceLabel,
 		input.presentationSourceUrl,
@@ -1626,16 +1753,68 @@ export function updatePieceUsage(
 	return database.transaction(() => {
 		const result = bumpShow(database, showId, expectedRevision);
 		usageSection(database, showId, usageId);
+		const currentPreparation = database
+			.prepare(
+				`SELECT preparation_status_snapshot, preparation_effort_snapshot
+				 FROM piece_usages WHERE id = ?`
+			)
+			.get(usageId) as {
+			preparation_status_snapshot: UsagePreparationStatus;
+			preparation_effort_snapshot: PreparationEffort;
+		};
+		let presentation = submittedPresentation;
+		if (presentation.mode === 'link' || presentation.mode === 'video') {
+			const source = database
+				.prepare(
+					`SELECT label, url, timecode_seconds FROM usage_source_snapshots
+					 WHERE usage_id = ? AND url = ?`
+				)
+				.get(usageId, presentation.sourceUrl) as
+				{ label: string; url: string; timecode_seconds: number | null } | undefined;
+			if (!source) throw new Error('INVALID_PRESENTATION');
+			presentation = validPresentation(
+				presentation.mode,
+				source.label,
+				source.url,
+				source.timecode_seconds,
+				presentation.title,
+				presentation.description,
+				presentation.imageUrl,
+				presentation.siteName
+			);
+		}
+		const selectedMediaId =
+			input.presentationMediaId === undefined
+				? ((
+						database
+							.prepare(
+								'SELECT id FROM usage_media_snapshots WHERE usage_id = ? AND is_presentation = 1'
+							)
+							.get(usageId) as { id: string } | undefined
+					)?.id ?? null)
+				: input.presentationMediaId;
+		if (
+			selectedMediaId !== null &&
+			!database
+				.prepare('SELECT 1 FROM usage_media_snapshots WHERE id = ? AND usage_id = ?')
+				.get(selectedMediaId, usageId)
+		) {
+			throw new Error('INVALID_PRESENTATION_MEDIA');
+		}
+		if (presentation.mode === 'image' && !selectedMediaId) {
+			throw new Error('INVALID_PRESENTATION_MEDIA');
+		}
 		database
 			.prepare(
 				`UPDATE piece_usages SET title_snapshot = ?, output_title_snapshot = ?, intro_snapshot = ?, research_snapshot = ?,
 				 moderation_snapshot = ?, interaction_snapshot = COALESCE(?, interaction_snapshot), transition_snapshot = ?, presentation_snapshot = ?,
-				 presentation_mode_snapshot = ?, presentation_source_label_snapshot = ?,
+				 presentation_mode_snapshot = ?, presentation_image_only_snapshot = ?, presentation_source_label_snapshot = ?,
 				 presentation_source_url_snapshot = ?, presentation_source_timecode_snapshot = ?,
 				 presentation_title_meta_snapshot = ?, presentation_description_snapshot = ?,
 				 presentation_image_url_snapshot = ?, presentation_site_name_snapshot = ?,
 				 presentation_provider_snapshot = ?, presentation_provider_id_snapshot = ?,
-				 own_notes = ?, duration_seconds = ? WHERE id = ?`
+				 own_notes = ?, duration_seconds = ?, preparation_status_snapshot = ?,
+				 preparation_effort_snapshot = ? WHERE id = ?`
 			)
 			.run(
 				title,
@@ -1646,7 +1825,8 @@ export function updatePieceUsage(
 				values.interaction,
 				values.transition,
 				values.presentation,
-				presentation.mode,
+				presentation.mode === 'image' ? 'text' : presentation.mode,
+				presentation.mode === 'image' ? 1 : 0,
 				presentation.sourceLabel,
 				presentation.sourceUrl,
 				presentation.timecodeSeconds,
@@ -1658,6 +1838,10 @@ export function updatePieceUsage(
 				presentation.providerId,
 				values.ownNotes,
 				duration,
+				input.preparationStatus ?? currentPreparation.preparation_status_snapshot,
+				input.preparationEffort === undefined
+					? currentPreparation.preparation_effort_snapshot
+					: input.preparationEffort,
 				usageId
 			);
 		if (input.tools) {
@@ -1690,23 +1874,15 @@ export function updatePieceUsage(
 			}
 		}
 		if (input.presentationMediaId !== undefined) {
-			if (
-				input.presentationMediaId !== null &&
-				!database
-					.prepare('SELECT 1 FROM usage_media_snapshots WHERE id = ? AND usage_id = ?')
-					.get(input.presentationMediaId, usageId)
-			) {
-				throw new Error('INVALID_PRESENTATION_MEDIA');
-			}
 			database
 				.prepare('UPDATE usage_media_snapshots SET is_presentation = 0 WHERE usage_id = ?')
 				.run(usageId);
-			if (input.presentationMediaId !== null) {
+			if (selectedMediaId !== null) {
 				database
 					.prepare(
 						'UPDATE usage_media_snapshots SET is_presentation = 1 WHERE id = ? AND usage_id = ?'
 					)
-					.run(input.presentationMediaId, usageId);
+					.run(selectedMediaId, usageId);
 			}
 		}
 		return result;

src/lib/server/technical-access.spec.ts

@@ -0,0 +1,97 @@
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import type { AuthUser } from './auth.js';
+import { closeDatabase, getDatabase } from './database.js';
+import {
+	authenticateTechnical,
+	createTechnicalAccess,
+	idempotentResponse,
+	revokeTechnicalAccess
+} from './technical-access.js';
+
+let directory: string;
+let actor: AuthUser;
+
+beforeEach(() => {
+	directory = mkdtempSync(path.join(tmpdir(), 'sendewerk-api-test-'));
+	process.env.SENDEWERK_DB_PATH = path.join(directory, 'test.sqlite');
+	process.env.SENDEWERK_UPLOAD_DIR = path.join(directory, 'uploads');
+	execFileSync(process.execPath, ['scripts/migrate.mjs'], { cwd: process.cwd(), env: process.env });
+	execFileSync(process.execPath, ['scripts/seed.mjs'], { cwd: process.cwd(), env: process.env });
+	const now = new Date().toISOString();
+	getDatabase()
+		.prepare(
+			`INSERT INTO users (id, email, email_normalized, display_name, password_hash, role,
+		password_changed_at_utc, created_at_utc, updated_at_utc) VALUES ('test-user', 'test@example.org',
+		'test@example.org', 'Test', 'not-used', 'barkeeper', ?, ?, ?)`
+		)
+		.run(now, now, now);
+	actor = {
+		id: 'test-user',
+		email: 'test@example.org',
+		displayName: 'Test',
+		role: 'barkeeper',
+		lockedAtUtc: null
+	};
+});
+
+afterEach(() => {
+	closeDatabase();
+	delete process.env.SENDEWERK_DB_PATH;
+	delete process.env.SENDEWERK_UPLOAD_DIR;
+	rmSync(directory, { recursive: true, force: true });
+});
+
+function request(token: string, key?: string) {
+	return new Request('https://sendewerk.test/api/v1/pieces', {
+		headers: { Authorization: `Bearer ${token}`, ...(key ? { 'Idempotency-Key': key } : {}) }
+	});
+}
+
+describe('technical API access', () => {
+	it('enforces permissions and revocation without storing the raw token', () => {
+		const created = createTechnicalAccess(actor, 'Leser', 'read');
+		expect(authenticateTechnical(request(created.token))).toMatchObject({
+			name: 'Leser',
+			permissions: 'read'
+		});
+		expect(() => authenticateTechnical(request(created.token), true)).toThrow('API_FORBIDDEN');
+		expect(
+			getDatabase()
+				.prepare('SELECT token_hash FROM technical_accesses WHERE id = ?')
+				.get(created.id)
+		).not.toMatchObject({ token_hash: created.token });
+		revokeTechnicalAccess(actor, created.id);
+		expect(() => authenticateTechnical(request(created.token))).toThrow('API_UNAUTHORIZED');
+	});
+
+	it('replays an identical idempotent write and rejects a changed payload', () => {
+		const created = createTechnicalAccess(actor, 'Schreiber', 'read_write');
+		const technical = authenticateTechnical(request(created.token), true);
+		let calls = 0;
+		const first = idempotentResponse(
+			technical,
+			request(created.token, 'command-1'),
+			{ title: 'A' },
+			() => ({ status: 201, body: { calls: ++calls } })
+		);
+		const replay = idempotentResponse(
+			technical,
+			request(created.token, 'command-1'),
+			{ title: 'A' },
+			() => ({ status: 201, body: { calls: ++calls } })
+		);
+		expect(first.duplicate).toBe(false);
+		expect(replay).toMatchObject({ duplicate: true, body: { calls: 1 } });
+		expect(calls).toBe(1);
+		expect(() =>
+			idempotentResponse(technical, request(created.token, 'command-1'), { title: 'B' }, () => ({
+				status: 201,
+				body: {}
+			}))
+		).toThrow('API_IDEMPOTENCY_CONFLICT');
+	});
+});

src/lib/server/technical-access.ts

@@ -0,0 +1,151 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import type { AuthUser } from './auth.js';
+import { getDatabase } from './database.js';
+
+export type TechnicalPermission = 'read' | 'read_write';
+export type TechnicalActor = { id: string; name: string; permissions: TechnicalPermission };
+
+function tokenHash(token: string) {
+	return createHash('sha256').update(token).digest('hex');
+}
+
+export function listTechnicalAccesses() {
+	return getDatabase()
+		.prepare(
+			`SELECT id, name, permissions, created_at_utc AS createdAtUtc,
+		last_used_at_utc AS lastUsedAtUtc, revoked_at_utc AS revokedAtUtc FROM technical_accesses ORDER BY name`
+		)
+		.all() as {
+		id: string;
+		name: string;
+		permissions: TechnicalPermission;
+		createdAtUtc: string;
+		lastUsedAtUtc: string | null;
+		revokedAtUtc: string | null;
+	}[];
+}
+
+export function createTechnicalAccess(actor: AuthUser, nameValue: string, permissions: string) {
+	const name = nameValue.trim();
+	if (!name || name.length > 120 || !['read', 'read_write'].includes(permissions))
+		throw new Error('INVALID_ACCESS');
+	const token = randomBytes(32).toString('base64url');
+	const id = randomUUID();
+	const now = new Date().toISOString();
+	getDatabase()
+		.prepare(
+			`INSERT INTO technical_accesses
+		(id, name, token_hash, permissions, created_by_user_id, created_at_utc) VALUES (?, ?, ?, ?, ?, ?)`
+		)
+		.run(id, name, tokenHash(token), permissions, actor.id, now);
+	auditTechnical(
+		{ id: actor.id, name: actor.displayName, permissions: 'read_write' },
+		'technical_access.create',
+		'technical_access',
+		id,
+		'user'
+	);
+	return { id, token };
+}
+
+export function revokeTechnicalAccess(actor: AuthUser, id: string) {
+	const result = getDatabase()
+		.prepare(
+			'UPDATE technical_accesses SET revoked_at_utc = ? WHERE id = ? AND revoked_at_utc IS NULL'
+		)
+		.run(new Date().toISOString(), id);
+	if (!result.changes) throw new Error('NOT_FOUND');
+	auditTechnical(
+		{ id: actor.id, name: actor.displayName, permissions: 'read_write' },
+		'technical_access.revoke',
+		'technical_access',
+		id,
+		'user'
+	);
+}
+
+export function authenticateTechnical(request: Request, write = false): TechnicalActor {
+	const authorization = request.headers.get('authorization') ?? '';
+	const token = authorization.startsWith('Bearer ') ? authorization.slice(7).trim() : '';
+	if (!token) throw new Error('API_UNAUTHORIZED');
+	const row = getDatabase()
+		.prepare(
+			`SELECT id, name, permissions FROM technical_accesses
+		WHERE token_hash = ? AND revoked_at_utc IS NULL`
+		)
+		.get(tokenHash(token)) as TechnicalActor | undefined;
+	if (!row) throw new Error('API_UNAUTHORIZED');
+	if (write && row.permissions !== 'read_write') throw new Error('API_FORBIDDEN');
+	getDatabase()
+		.prepare('UPDATE technical_accesses SET last_used_at_utc = ? WHERE id = ?')
+		.run(new Date().toISOString(), row.id);
+	return row;
+}
+
+export function auditTechnical(
+	actor: TechnicalActor,
+	action: string,
+	targetType: string,
+	targetId: string,
+	actorType: 'technical' | 'user' = 'technical'
+) {
+	getDatabase()
+		.prepare(
+			`INSERT INTO audit_events (id, actor_type, actor_id, action, target_type, target_id, created_at_utc)
+		VALUES (?, ?, ?, ?, ?, ?, ?)`
+		)
+		.run(
+			randomUUID(),
+			actorType,
+			actor.id,
+			action.slice(0, 120),
+			targetType.slice(0, 80),
+			targetId.slice(0, 200),
+			new Date().toISOString()
+		);
+}
+
+export function idempotentResponse(
+	actor: TechnicalActor,
+	request: Request,
+	body: unknown,
+	operation: () => { status: number; body: unknown }
+) {
+	const key = request.headers.get('idempotency-key')?.trim() ?? '';
+	if (!key || key.length > 200) throw new Error('API_IDEMPOTENCY_REQUIRED');
+	const hash = createHash('sha256')
+		.update(`${request.method} ${new URL(request.url).pathname}\n${JSON.stringify(body)}`)
+		.digest('hex');
+	const database = getDatabase();
+	return database.transaction(() => {
+		const existing = database
+			.prepare(
+				'SELECT request_hash, status_code, response_json FROM api_idempotency WHERE access_id = ? AND request_key = ?'
+			)
+			.get(actor.id, key) as
+			{ request_hash: string; status_code: number; response_json: string } | undefined;
+		if (existing) {
+			if (existing.request_hash !== hash) throw new Error('API_IDEMPOTENCY_CONFLICT');
+			return {
+				status: existing.status_code,
+				body: JSON.parse(existing.response_json),
+				duplicate: true
+			};
+		}
+		const result = operation();
+		database
+			.prepare(
+				`INSERT INTO api_idempotency
+			(access_id, request_key, request_hash, status_code, response_json, created_at_utc) VALUES (?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				actor.id,
+				key,
+				hash,
+				result.status,
+				JSON.stringify(result.body),
+				new Date().toISOString()
+			);
+		return { ...result, duplicate: false };
+	})();
+}

src/routes/api/v1/openapi.json/+server.ts

@@ -0,0 +1,105 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+
+const id = { name: 'id', in: 'path', required: true, schema: { type: 'string' } };
+const usageId = { name: 'usageId', in: 'path', required: true, schema: { type: 'string' } };
+const idempotency = {
+	name: 'Idempotency-Key',
+	in: 'header',
+	required: true,
+	schema: { type: 'string' }
+};
+const ok = { '200': { description: 'Erfolgreich' } };
+const jsonBody = (schema: Record<string, unknown>) => ({
+	required: true,
+	content: { 'application/json': { schema } }
+});
+
+export const GET: RequestHandler = () =>
+	json({
+		openapi: '3.1.0',
+		info: {
+			title: 'Sendewerk API',
+			version: '1.0.0',
+			description:
+				'Versionierte API für technische Redaktionszugänge. Schreibzugriffe benötigen einen Idempotency-Key.'
+		},
+		servers: [{ url: '/api/v1' }],
+		security: [{ bearerAuth: [] }],
+		components: {
+			securitySchemes: {
+				bearerAuth: { type: 'http', scheme: 'bearer', bearerFormat: 'Sendewerk technical token' }
+			},
+			schemas: {
+				PieceWrite: {
+					type: 'object',
+					properties: {
+						title: { type: 'string' },
+						summary: { type: 'string' },
+						status: { enum: ['inbox', 'preparing', 'ready'] },
+						durationSeconds: { type: 'integer', minimum: 0 }
+					}
+				},
+				ShowWrite: {
+					type: 'object',
+					required: ['title'],
+					properties: {
+						title: { type: 'string' },
+						startsAtUtc: { type: ['string', 'null'], format: 'date-time' },
+						templateId: { type: ['string', 'null'] }
+					}
+				}
+			}
+		},
+		paths: {
+			'/pieces': {
+				get: { summary: 'Pieces lesen', responses: ok },
+				post: {
+					summary: 'Piece anlegen',
+					parameters: [idempotency],
+					requestBody: jsonBody({ $ref: '#/components/schemas/PieceWrite' }),
+					responses: { '201': { description: 'Angelegt' } }
+				}
+			},
+			'/pieces/{id}': {
+				get: { summary: 'Piece lesen', parameters: [id], responses: ok },
+				patch: {
+					summary: 'Piece ändern',
+					parameters: [id],
+					requestBody: jsonBody({
+						allOf: [
+							{ $ref: '#/components/schemas/PieceWrite' },
+							{ type: 'object', required: ['revision'] }
+						]
+					}),
+					responses: ok
+				}
+			},
+			'/shows': {
+				get: { summary: 'Sendungen lesen', responses: ok },
+				post: {
+					summary: 'Sendung anlegen',
+					parameters: [idempotency],
+					requestBody: jsonBody({ $ref: '#/components/schemas/ShowWrite' }),
+					responses: { '201': { description: 'Angelegt' } }
+				}
+			},
+			'/shows/{id}': { get: { summary: 'Sendung lesen', parameters: [id], responses: ok } },
+			'/shows/{id}/usages': {
+				post: {
+					summary: 'Piece einplanen',
+					parameters: [id, idempotency],
+					requestBody: jsonBody({ type: 'object', required: ['revision', 'pieceId'] }),
+					responses: { '201': { description: 'Eingeplant' } }
+				}
+			},
+			'/shows/{id}/usages/{usageId}': {
+				patch: {
+					summary: 'Einplanung sortieren',
+					parameters: [id, usageId, idempotency],
+					requestBody: jsonBody({ type: 'object', required: ['revision', 'position'] }),
+					responses: ok
+				}
+			}
+		}
+	});

src/routes/api/v1/pieces/+server.ts

@@ -0,0 +1,69 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure, pageInput } from '#lib/server/api-http.js';
+import {
+	createPiece,
+	getPiece,
+	listPieces,
+	savePiece,
+	type PieceStatus
+} from '#lib/server/content.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, url }) => {
+	try {
+		authenticateTechnical(request);
+		const { limit, offset } = pageInput(url);
+		const status = url.searchParams.get('status') as PieceStatus | null;
+		const statuses = status ? [status] : (['inbox', 'preparing', 'ready'] as PieceStatus[]);
+		const all = listPieces({ statuses, query: url.searchParams.get('q') ?? '' });
+		return json({
+			data: all.slice(offset, offset + limit),
+			pagination: { limit, offset, total: all.length }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};
+
+export const POST: RequestHandler = async ({ request }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			const id = createPiece('blank');
+			const piece = getPiece(id)!;
+			savePiece(id, piece.revision, {
+				...piece,
+				title: String(body.title ?? ''),
+				summary: String(body.summary ?? ''),
+				status: ['inbox', 'preparing', 'ready'].includes(String(body.status))
+					? (body.status as 'inbox' | 'preparing' | 'ready')
+					: 'preparing',
+				durationSeconds: Number(body.durationSeconds ?? 0),
+				sources: Array.isArray(body.sources)
+					? body.sources.map((source) => ({
+							label: String((source as Record<string, unknown>).label ?? ''),
+							url: String((source as Record<string, unknown>).url ?? ''),
+							timecodeSeconds:
+								(source as Record<string, unknown>).timecodeSeconds == null
+									? null
+									: Number((source as Record<string, unknown>).timecodeSeconds)
+						}))
+					: []
+			});
+			auditTechnical(actor, 'piece.create', 'piece', id);
+			return { status: 201, body: { data: getPiece(id) } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/pieces/[id]/+server.ts

@@ -0,0 +1,44 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure } from '#lib/server/api-http.js';
+import { getPiece, savePiece } from '#lib/server/content.js';
+import { auditTechnical, authenticateTechnical } from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, params }) => {
+	try {
+		authenticateTechnical(request);
+		const piece = getPiece(params.id);
+		if (!piece) throw new Error('NOT_FOUND');
+		return json({ data: piece });
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};
+
+export const PATCH: RequestHandler = async ({ request, params }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const piece = getPiece(params.id);
+		if (!piece) throw new Error('NOT_FOUND');
+		if (piece.status === 'archived') throw new Error('INVALID_STATUS');
+		if (Number(body.revision) !== piece.revision) throw new Error('CONFLICT');
+		const status =
+			body.status !== undefined
+				? (String(body.status) as 'inbox' | 'preparing' | 'ready')
+				: piece.status;
+		savePiece(params.id, piece.revision, {
+			...piece,
+			status,
+			...(body.title !== undefined ? { title: String(body.title) } : {}),
+			...(body.summary !== undefined ? { summary: String(body.summary) } : {}),
+			...(body.durationSeconds !== undefined
+				? { durationSeconds: Number(body.durationSeconds) }
+				: {})
+		});
+		auditTechnical(actor, 'piece.update', 'piece', params.id);
+		return json({ data: getPiece(params.id) });
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/+server.ts

@@ -0,0 +1,45 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure, pageInput } from '#lib/server/api-http.js';
+import { createShow, getShow, listShows } from '#lib/server/shows.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, url }) => {
+	try {
+		authenticateTechnical(request);
+		const { limit, offset } = pageInput(url);
+		const all = listShows();
+		return json({
+			data: all.slice(offset, offset + limit),
+			pagination: { limit, offset, total: all.length }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};
+
+export const POST: RequestHandler = async ({ request }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			const created = createShow({
+				title: String(body.title ?? ''),
+				startsAtUtc: body.startsAtUtc ? String(body.startsAtUtc) : null,
+				templateId: body.templateId ? String(body.templateId) : null
+			});
+			auditTechnical(actor, 'show.create', 'show', created.id);
+			return { status: 201, body: { data: getShow(created.id) } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/[id]/+server.ts

@@ -0,0 +1,16 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiFailure } from '#lib/server/api-http.js';
+import { getShow } from '#lib/server/shows.js';
+import { authenticateTechnical } from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, params }) => {
+	try {
+		authenticateTechnical(request);
+		const show = getShow(params.id);
+		if (!show) throw new Error('NOT_FOUND');
+		return json({ data: show });
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/[id]/usages/+server.ts

@@ -0,0 +1,31 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure } from '#lib/server/api-http.js';
+import { addPieceUsage, getShow } from '#lib/server/shows.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const POST: RequestHandler = async ({ request, params }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			const created = addPieceUsage(params.id, Number(body.revision), {
+				pieceId: String(body.pieceId ?? ''),
+				sectionId: body.sectionId ? String(body.sectionId) : null,
+				position: body.position == null ? undefined : Number(body.position)
+			});
+			auditTechnical(actor, 'usage.create', 'usage', created.id);
+			return { status: 201, body: { data: getShow(params.id), usageId: created.id } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/[id]/usages/[usageId]/+server.ts

@@ -0,0 +1,30 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure } from '#lib/server/api-http.js';
+import { getShow, movePieceUsage } from '#lib/server/shows.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const PATCH: RequestHandler = async ({ request, params }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			movePieceUsage(params.id, params.usageId, Number(body.revision), {
+				sectionId: body.sectionId ? String(body.sectionId) : null,
+				position: Number(body.position)
+			});
+			auditTechnical(actor, 'usage.move', 'usage', params.usageId);
+			return { status: 200, body: { data: getShow(params.id) } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/eingang/+page.server.ts

@@ -1,11 +1,16 @@
 import { fail } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 import { requireUser } from '#lib/server/auth.js';
-import { captureInbox, listPieces, setPieceDeleted } from '#lib/server/content.js';
+import { captureInbox, getTaxonomy, listPieces, setPieceDeleted } from '#lib/server/content.js';
+import { discardFeedEntries, importFeedEntries, listFeedEntries } from '#lib/server/feeds.js';
 
 export const load: PageServerLoad = ({ locals }) => {
 	requireUser(locals.user);
-	return { pieces: listPieces({ statuses: ['inbox'] }) };
+	return {
+		pieces: listPieces({ statuses: ['inbox'] }),
+		feedEntries: listFeedEntries(),
+		taxonomy: getTaxonomy()
+	};
 };
 
 export const actions = {
@@ -36,5 +41,27 @@ export const actions = {
 		} catch {
 			return fail(409, { error: 'Das Piece wurde inzwischen geändert. Bitte neu laden.' });
 		}
+	},
+	importFeeds: async ({ locals, request }) => {
+		requireUser(locals.user);
+		const data = await request.formData();
+		const entryIds = data.getAll('entryIds').map(String);
+		if (!entryIds.length) return fail(400, { feedError: 'Mindestens einen Beitrag auswählen.' });
+		try {
+			const pieceIds = importFeedEntries(entryIds, data.getAll('categoryIds').map(String));
+			return {
+				feedSuccess: `${pieceIds.length} ${pieceIds.length === 1 ? 'Beitrag' : 'Beiträge'} in den Eingang übernommen.`
+			};
+		} catch {
+			return fail(400, { feedError: 'Die Auswahl konnte nicht übernommen werden.' });
+		}
+	},
+	discardFeeds: async ({ locals, request }) => {
+		requireUser(locals.user);
+		const data = await request.formData();
+		const entryIds = data.getAll('entryIds').map(String);
+		if (!entryIds.length) return fail(400, { feedError: 'Mindestens einen Beitrag auswählen.' });
+		const count = discardFeedEntries(entryIds);
+		return { feedSuccess: `${count} ${count === 1 ? 'Beitrag' : 'Beiträge'} verworfen.` };
 	}
 } satisfies Actions;

src/routes/eingang/+page.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+	/* eslint-disable svelte/no-navigation-without-resolve -- RSS links are validated external URLs. */
 	import { resolve } from '$app/paths';
 	import AppIcon from '#lib/components/AppIcon.svelte';
 	import type { PageProps } from './$types';
@@ -43,6 +44,65 @@
 			<button class="primary-button" type="submit">Im Eingang ablegen</button>
 		</form>
 	</section>
+	<section class="quiet-panel feed-inbox">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">RSS-Importeingang</p>
+				<h2>Beiträge sichten</h2>
+			</div>
+			<span>{data.feedEntries.length} neu</span>
+		</div>
+		<p>Beiträge bleiben hier getrennt, bis du sie auswählst und in den Fundus übernimmst.</p>
+		{#if form?.feedError}<div class="form-message error" role="alert">{form.feedError}</div>{/if}
+		{#if form?.feedSuccess}<div class="form-message success" role="status">
+				{form.feedSuccess}
+			</div>{/if}
+		{#if data.feedEntries.length}
+			<form method="POST" class="feed-selection">
+				<fieldset class="feed-categories">
+					<legend>Kategorien für die Auswahl <span>(Feed-Standard gilt ohne Auswahl)</span></legend>
+					{#each data.taxonomy.categories as category (category.id)}
+						<label
+							><input type="checkbox" name="categoryIds" value={category.id} />
+							{category.name}</label
+						>
+					{/each}
+				</fieldset>
+				<div class="feed-entry-list">
+					{#each data.feedEntries as entry (entry.id)}
+						<label class="feed-entry">
+							<input type="checkbox" name="entryIds" value={entry.id} />
+							<span
+								><small
+									>{entry.feedName}{entry.publishedAtUtc
+										? ` · ${new Date(entry.publishedAtUtc).toLocaleDateString('de-DE')}`
+										: ''}</small
+								><strong>{entry.title}</strong>{#if entry.summary}<span>{entry.summary}</span>{/if}
+								<a
+									href={entry.url}
+									target="_blank"
+									rel="noreferrer"
+									onclick={(event) => event.stopPropagation()}>Original öffnen</a
+								></span
+							>
+						</label>
+					{/each}
+				</div>
+				<div class="feed-actions">
+					<button class="primary-button" type="submit" formaction="?/importFeeds"
+						>Auswahl übernehmen</button
+					>
+					<button class="text-button danger-text" type="submit" formaction="?/discardFeeds"
+						>Auswahl verwerfen</button
+					>
+				</div>
+			</form>
+		{:else}
+			<p class="empty-copy">
+				Keine neuen Feed-Beiträge. Aktivierte Feeds werden automatisch abgerufen.
+			</p>
+		{/if}
+	</section>
 	{#if data.pieces.length}
 		<section class="inbox-list">
 			<h2>{data.pieces.length} {data.pieces.length === 1 ? 'offener Inhalt' : 'offene Inhalte'}</h2>
@@ -81,3 +141,59 @@
 			<p>Neue Gedanken und Links können oben direkt aufgenommen werden.</p>
 		</section>{/if}
 </div>
+
+<style>
+	.feed-inbox {
+		display: grid;
+		gap: 1rem;
+		margin-block: 1.5rem;
+	}
+	.feed-selection,
+	.feed-entry-list {
+		display: grid;
+		gap: 0.75rem;
+	}
+	.feed-categories {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.6rem 1rem;
+		border: 0;
+		padding: 0;
+	}
+	.feed-categories legend {
+		width: 100%;
+		font-weight: 700;
+		margin-bottom: 0.45rem;
+	}
+	.feed-categories legend span {
+		font-weight: 400;
+		color: var(--color-text-muted);
+	}
+	.feed-entry {
+		display: grid;
+		grid-template-columns: auto 1fr;
+		gap: 0.8rem;
+		align-items: start;
+		padding: 0.9rem;
+		border: 1px solid var(--color-border);
+		border-radius: 0.7rem;
+		cursor: pointer;
+	}
+	.feed-entry > span {
+		display: grid;
+		gap: 0.25rem;
+		min-width: 0;
+	}
+	.feed-entry small {
+		color: var(--color-text-muted);
+	}
+	.feed-entry a {
+		width: fit-content;
+	}
+	.feed-actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.75rem;
+		align-items: center;
+	}
+</style>

src/routes/fundus/[id]/+page.server.ts

@@ -75,6 +75,7 @@ function pieceInput(data: FormData): PieceInput {
 		summary: text(data, 'summary'),
 		formatId: text(data, 'formatId') || null,
 		status: text(data, 'status') as EditablePieceStatus,
+		preparationEffort: (text(data, 'preparationEffort') || null) as PieceInput['preparationEffort'],
 		durationSeconds: durationInSeconds(data),
 		intro: text(data, 'intro'),
 		researchText: text(data, 'researchText'),

src/routes/fundus/[id]/+page.svelte

@@ -77,14 +77,19 @@
 				: draft.presentationProvider === 'tiktok' && draft.presentationProviderId
 					? `https://www.tiktok.com/player/v1/${draft.presentationProviderId}`
 					: '',
-		images: selectedMedia ? [{ id: selectedMedia.id, altText: selectedMedia.altText }] : []
+		images:
+			selectedMedia && ['text', 'image'].includes(draft.presentationMode)
+				? [{ id: selectedMedia.id, altText: selectedMedia.altText }]
+				: []
 	});
 	let presentationPreviewImage = $derived(
-		selectedMedia
+		selectedMedia && ['text', 'image'].includes(draft.presentationMode)
 			? draft.presentationMode === 'text'
 				? '/media'
 				: `/media/${selectedMedia.id}`
-			: sourcePreviewImage
+			: draft.presentationMode === 'link'
+				? sourcePreviewImage
+				: ''
 	);
 	let pendingHref: string | null = null;
 	let allowNavigation = false;
@@ -116,8 +121,8 @@
 		if (
 			control instanceof HTMLInputElement &&
 			control.name === 'presentationMode' &&
-			control.value !== 'text' &&
-			draft.presentationSourcePosition === null
+			((['link', 'video'].includes(control.value) && draft.presentationSourcePosition === null) ||
+				(control.value === 'image' && !draft.presentationMediaId))
 		) {
 			return;
 		}
@@ -347,6 +352,14 @@
 								bind:value={durationMinutes}
 							/></label
 						>
+						<label
+							>Vorbereitungsaufwand<select
+								name="preparationEffort"
+								bind:value={draft.preparationEffort}
+								><option value={null}>Nicht angegeben</option><option value="low">Gering</option
+								><option value="medium">Mittel</option><option value="high">Hoch</option></select
+							></label
+						>
 						<label
 							>Format<select name="formatId" bind:value={draft.formatId}
 								><option value={null}>Ohne Format</option
@@ -526,23 +539,9 @@
 				</div>
 				<div class="piece-presentation-layout">
 					<div class="piece-presentation-controls">
-						<label
-							>Präsentationstitel<input
-								name="outputTitle"
-								maxlength="300"
-								placeholder="Optional, sonst interner Titel"
-								bind:value={draft.outputTitle}
-							/></label
-						>
-						<MarkdownEditorField
-							name="presentationText"
-							label="Öffentlicher Text"
-							placeholder="Text für die Publikumsausgabe"
-							rows={8}
-							bind:value={draft.presentationText}
-						/>
+						<p class="field-label">Präsentationsart</p>
 						<div class="presentation-mode-picker" role="group" aria-label="Darstellung">
-							{#each [['text', 'Text'], ['link', 'Linkvorschau'], ['video', 'Video']] as mode (mode[0])}<label
+							{#each [['text', 'Text'], ['image', 'Nur Bild'], ['link', 'Linkvorschau'], ['video', 'Video']] as mode (mode[0])}<label
 									><input
 										type="radio"
 										name="presentationMode"
@@ -551,60 +550,103 @@
 									/>{mode[1]}</label
 								>{/each}
 						</div>
-						<div class="presentation-settings">
+						{#if draft.presentationMode === 'text'}
 							<label
-								>Quelle<select
-									name="presentationSourcePosition"
-									bind:value={draft.presentationSourcePosition}
-									onchange={presentationSourceChanged}
-									><option value={null}>Quelle auswählen</option
-									>{#each sources as source, index (index)}{#if source.url}<option value={index}
-												>{source.label || source.url}</option
-											>{/if}{/each}</select
-								></label
-							>
-							<label
-								>Kartentitel<input
-									name="presentationTitle"
+								>Öffentliche Überschrift<input
+									name="outputTitle"
 									maxlength="300"
-									placeholder="Optionaler Anzeigetitel"
-									bind:value={draft.presentationTitle}
-									oninput={() => (draft.presentationTitleManual = true)}
+									placeholder="Optional, sonst interner Titel"
+									bind:value={draft.outputTitle}
 								/></label
 							>
-							<label
-								>Bild-URL<input
-									name="presentationImageUrl"
-									type="url"
-									maxlength="2000"
-									placeholder="https://…"
-									bind:value={draft.presentationImageUrl}
-									oninput={() => (draft.presentationImageManual = true)}
-								/></label
-							>
-							<label class="wide-field"
-								>Anreißer<textarea
-									name="presentationDescription"
-									rows="3"
-									maxlength="1000"
-									placeholder="Kurzer Text zur Vorschau"
-									bind:value={draft.presentationDescription}
-									oninput={() => (draft.presentationDescriptionManual = true)}></textarea></label
-							>
-							<div class="presentation-preview-actions wide-field">
-								<button
-									class="secondary-button"
-									type="button"
-									onclick={() => previewForm.requestSubmit()}
-									disabled={actionsBlocked || draft.presentationSourcePosition === null}
-									>Vorschau laden</button
-								><small
-									>{draft.presentationMetadataFetchedAtUtc
-										? `Zuletzt geladen: ${new Date(draft.presentationMetadataFetchedAtUtc).toLocaleString('de-DE')}`
-										: 'Noch keine Metadaten geladen.'}</small
+							<MarkdownEditorField
+								name="presentationText"
+								label="Öffentlicher Vorspann"
+								placeholder="Text für die Publikumsausgabe"
+								rows={8}
+								bind:value={draft.presentationText}
+							/>
+						{:else}
+							<input type="hidden" name="outputTitle" value={draft.outputTitle} />
+							<input type="hidden" name="presentationText" value={draft.presentationText} />
+						{/if}
+						{#if draft.presentationMode === 'link' || draft.presentationMode === 'video'}
+							<div class="presentation-settings">
+								<label
+									>{draft.presentationMode === 'video' ? 'Video-URL' : 'Quelle/URL'}<select
+										name="presentationSourcePosition"
+										bind:value={draft.presentationSourcePosition}
+										onchange={presentationSourceChanged}
+										><option value={null}>Quelle auswählen</option
+										>{#each sources as source, index (index)}{#if source.url}<option value={index}
+													>{source.label || source.url}</option
+												>{/if}{/each}</select
+									></label
 								>
+								<label
+									>{draft.presentationMode === 'video' ? 'Videotitel' : 'Kartentitel'}<input
+										name="presentationTitle"
+										maxlength="300"
+										placeholder="Optionaler Anzeigetitel"
+										bind:value={draft.presentationTitle}
+										oninput={() => (draft.presentationTitleManual = true)}
+									/></label
+								>
+								{#if draft.presentationMode === 'link'}
+									<label
+										>Vorschaubild-URL<input
+											name="presentationImageUrl"
+											type="url"
+											maxlength="2000"
+											placeholder="Wird aus der Linkvorschau geladen"
+											bind:value={draft.presentationImageUrl}
+											oninput={() => (draft.presentationImageManual = true)}
+										/></label
+									>
+								{:else}
+									<input
+										type="hidden"
+										name="presentationImageUrl"
+										value={draft.presentationImageUrl}
+									/>
+								{/if}
+								<label class="wide-field"
+									>Anreißer<textarea
+										name="presentationDescription"
+										rows="3"
+										maxlength="1000"
+										placeholder="Kurzer Text zur Vorschau"
+										bind:value={draft.presentationDescription}
+										oninput={() => (draft.presentationDescriptionManual = true)}></textarea></label
+								>
+								<div class="presentation-preview-actions wide-field">
+									<button
+										class="secondary-button"
+										type="button"
+										onclick={() => previewForm.requestSubmit()}
+										disabled={actionsBlocked || draft.presentationSourcePosition === null}
+										>Vorschau laden</button
+									><small
+										>{draft.presentationMetadataFetchedAtUtc
+											? `Zuletzt geladen: ${new Date(draft.presentationMetadataFetchedAtUtc).toLocaleString('de-DE')}`
+											: 'Noch keine Metadaten geladen.'}</small
+									>
+								</div>
 							</div>
-						</div>
+						{:else}
+							<input
+								type="hidden"
+								name="presentationSourcePosition"
+								value={draft.presentationSourcePosition ?? ''}
+							/>
+							<input type="hidden" name="presentationTitle" value={draft.presentationTitle} />
+							<input
+								type="hidden"
+								name="presentationDescription"
+								value={draft.presentationDescription}
+							/>
+							<input type="hidden" name="presentationImageUrl" value={draft.presentationImageUrl} />
+						{/if}
 					</div>
 					<aside class="piece-presentation-preview" aria-label="Präsentationsvorschau">
 						<PresentationDisplay
@@ -631,6 +673,7 @@
 				<input type="hidden" name="presentationSiteName" value={draft.presentationSiteName} />
 				<input type="hidden" name="presentationProvider" value={draft.presentationProvider} />
 				<input type="hidden" name="presentationProviderId" value={draft.presentationProviderId} />
+				<input type="hidden" name="presentationMediaId" value={draft.presentationMediaId ?? ''} />
 				<input
 					type="hidden"
 					name="presentationMetadataFetchedAtUtc"
@@ -639,7 +682,11 @@
 			</section>
 		</form>
 
-		<section class="piece-editor-panel piece-media-panel" hidden={activeSection !== 'presentation'}>
+		<section
+			class="piece-editor-panel piece-media-panel"
+			hidden={activeSection !== 'presentation' ||
+				!['text', 'image'].includes(draft.presentationMode)}
+		>
 			<div class="piece-subsection-heading">
 				<div>
 					<p class="eyebrow">Hochgeladene Bilder</p>
@@ -647,12 +694,10 @@
 				</div>
 				<small>JPEG, PNG, WebP oder GIF bis 5 MB</small>
 			</div>
-			{#if data.piece.media.length}<label class="media-none"
+			{#if draft.media.length && draft.presentationMode === 'text'}<label class="media-none"
 					><input
-						form="piece-editor-form"
 						type="radio"
-						name="presentationMediaId"
-						value=""
+						name="presentationMediaChoice"
 						checked={!draft.presentationMediaId}
 						onchange={() => {
 							draft.presentationMediaId = null;
@@ -661,13 +706,11 @@
 					/> Kein hochgeladenes Bild</label
 				>
 				<div class="media-grid">
-					{#each data.piece.media as media (media.id)}<figure>
+					{#each draft.media as media (media.id)}<figure>
 							<label class="media-presentation-choice"
 								><input
-									form="piece-editor-form"
 									type="radio"
-									name="presentationMediaId"
-									value={media.id}
+									name="presentationMediaChoice"
 									checked={draft.presentationMediaId === media.id}
 									onchange={() => {
 										draft.presentationMediaId = media.id;

src/routes/fundus/[id]/praesentation/+page.svelte

@@ -14,10 +14,12 @@
 	<div class="presentation-test-status" role="status">Isolierte Testansicht</div>
 	<PresentationDisplay
 		content={data.content}
-		imageSrc={data.content.images.length
-			? data.content.mode === 'text'
-				? '/media'
-				: `/media/${data.content.images[0].id}`
-			: `/fundus/${data.pieceId}/praesentation/preview-image`}
+		imageSrc={data.content.mode === 'text' && data.content.images.length
+			? '/media'
+			: data.content.mode === 'image' && data.content.images.length
+				? `/media/${data.content.images[0].id}`
+				: data.content.mode === 'link' && data.content.imageUrl
+					? `/fundus/${data.pieceId}/praesentation/preview-image`
+					: ''}
 	/>
 </main>

src/routes/fundus/[id]/praesentation/preview-image/+server.ts

@@ -7,7 +7,9 @@ import { fetchPresentationImage } from '#lib/server/presentation.js';
 export const GET: RequestHandler = async ({ locals, params }) => {
 	requireUser(locals.user);
 	const piece = getPiece(params.id);
-	if (!piece?.presentationImageUrl) error(404, 'Vorschaubild nicht verfügbar');
+	if (piece?.presentationMode !== 'link' || !piece.presentationImageUrl) {
+		error(404, 'Vorschaubild nicht verfügbar');
+	}
 	try {
 		const image = await fetchPresentationImage(piece.presentationImageUrl);
 		return new Response(new Uint8Array(image.data), {

src/routes/live/+page.server.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { error, fail } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
-import { requireUser } from '#lib/server/auth.js';
+import { requireBarkeeper, requireUser } from '#lib/server/auth.js';
 import { finalizeShow, getCompletionSummary } from '#lib/server/completion.js';
 import {
 	completeCurrent,
@@ -16,6 +16,7 @@ import {
 	rotatePresentationChannelKey,
 	resetSectionTimer,
 	resetTotalTimer,
+	resumeUsage,
 	resumeEndedLive,
 	resumeLive,
 	selectUsage,
@@ -25,6 +26,14 @@ import {
 	startOrResumeLive
 } from '#lib/server/live.js';
 import { listShows } from '#lib/server/shows.js';
+import {
+	createShare,
+	deleteShare,
+	listShares,
+	replaceShareToken,
+	updateShare
+} from '#lib/server/shares.js';
+import { berlinLocalToUtc } from '#lib/server/time.js';
 
 function text(data: FormData, name: string) {
 	return String(data.get(name) || '');
@@ -71,13 +80,15 @@ function attempt(intent: string, operation: () => unknown) {
 }
 
 export const load: PageServerLoad = ({ locals, url }) => {
-	requireUser(locals.user);
+	const actor = requireUser(locals.user);
 	const showId = url.searchParams.get('show') || listShows()[0]?.id;
 	if (!showId) error(404, 'Keine Sendung vorhanden');
 	try {
 		const live = getLiveView(showId);
 		return {
 			live,
+			canManageShares: actor.role === 'barkeeper',
+			shares: actor.role === 'barkeeper' ? listShares(actor, showId) : [],
 			commandId: randomUUID(),
 			completion:
 				live.endedAtUtc && live.show.status !== 'completed' ? getCompletionSummary(showId) : null
@@ -90,6 +101,73 @@ export const load: PageServerLoad = ({ locals, url }) => {
 };
 
 export const actions = {
+	createShare: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const share = await createShare(actor, {
+				showId: text(data, 'showId'),
+				scope: text(data, 'scope'),
+				password: text(data, 'password'),
+				expiresAtUtc: berlinLocalToUtc(text(data, 'expiresAt'), 'INVALID_EXPIRY')
+			});
+			return {
+				intent: 'createShare',
+				success: 'Leselink angelegt.',
+				shareUrl: `/freigabe/${share.token}`
+			};
+		} catch (cause) {
+			const problem = actionError(cause);
+			return fail(problem.status, { intent: 'createShare', ...problem });
+		}
+	},
+	updateShare: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			await updateShare(
+				actor,
+				text(data, 'shareId'),
+				{
+					scope: text(data, 'scope'),
+					passwordMode: text(data, 'passwordMode'),
+					password: text(data, 'password'),
+					expiresAtUtc: berlinLocalToUtc(text(data, 'expiresAt'), 'INVALID_EXPIRY')
+				},
+				text(data, 'showId')
+			);
+			return { intent: 'updateShare', success: 'Freigabe aktualisiert.' };
+		} catch (cause) {
+			const problem = actionError(cause);
+			return fail(problem.status, { intent: 'updateShare', ...problem });
+		}
+	},
+	replaceShare: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const token = replaceShareToken(actor, text(data, 'shareId'), text(data, 'showId'));
+			return {
+				intent: 'replaceShare',
+				success: 'Ersatzlink angelegt. Der bisherige Link ist ungültig.',
+				shareUrl: `/freigabe/${token}`
+			};
+		} catch (cause) {
+			const problem = actionError(cause);
+			return fail(problem.status, { intent: 'replaceShare', ...problem });
+		}
+	},
+	deleteShare: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			deleteShare(actor, text(data, 'shareId'), text(data, 'showId'));
+			return { intent: 'deleteShare', success: 'Freigabe gelöscht.' };
+		} catch (cause) {
+			const problem = actionError(cause);
+			return fail(problem.status, { intent: 'deleteShare', ...problem });
+		}
+	},
 	start: async ({ locals, request }) => {
 		requireUser(locals.user);
 		const data = await request.formData();
@@ -210,6 +288,18 @@ export const actions = {
 			)
 		);
 	},
+	resumeUsage: async ({ locals, request }) => {
+		requireUser(locals.user);
+		const data = await request.formData();
+		return attempt('resumeUsage', () =>
+			resumeUsage(
+				text(data, 'showId'),
+				text(data, 'usageId'),
+				text(data, 'commandId'),
+				Number(data.get('revision'))
+			)
+		);
+	},
 	present: async ({ locals, request }) => {
 		requireUser(locals.user);
 		const data = await request.formData();

src/routes/live/+page.svelte

@@ -4,6 +4,7 @@
 	import { onMount, tick, untrack } from 'svelte';
 	import AppIcon from '#lib/components/AppIcon.svelte';
 	import ThemeToggle from '#lib/components/ThemeToggle.svelte';
+	import ShareManagement from '#lib/components/ShareManagement.svelte';
 	import { formatClock, formatDuration } from '#lib/format.js';
 	import type { PageProps } from './$types';
 
@@ -49,6 +50,9 @@
 	let currentSection = $derived(
 		data.live.sections.find((section) => section.id === data.live.current?.sectionId) ?? null
 	);
+	let viewedSection = $derived(
+		data.live.sections.find((section) => section.id === viewedUsage?.sectionId) ?? null
+	);
 	let presentedUsage = $derived(
 		allUsages.find((usage) => usage.id === data.live.presentationUsageId) ?? null
 	);
@@ -101,6 +105,16 @@
 			data.live.sectionTimer.sectionId === data.live.current.sectionId
 		)
 	);
+
+	async function copyTwitchTags() {
+		if (!viewedSection?.twitchTags.length) return;
+		try {
+			await navigator.clipboard.writeText(viewedSection.twitchTags.join(', '));
+			popupMessage = 'Twitch-Tags kopiert.';
+		} catch {
+			popupMessage = 'Kopieren wurde vom Browser blockiert.';
+		}
+	}
 	let runningOffsetSeconds = $derived(
 		data.live.totalTimer.runningSinceUtc ? Math.max(0, Math.floor((now - loadedAt) / 1000)) : 0
 	);
@@ -577,6 +591,12 @@
 			</section>
 			<section>
 				<strong>Ausgabekanal</strong>
+				{#if data.canManageShares}<ShareManagement
+						shows={[{ ...data.live.show, startsAtUtc: null }]}
+						shares={data.shares}
+						fixedShowId={data.live.show.id}
+						{form}
+					/>{/if}
 				<form method="POST" action={liveAction('createOutput')} use:enhance={enhanceOutput}>
 					<input type="hidden" name="showId" value={data.live.show.id} />
 					<button class="secondary-button" type="submit">Ausgabe verbinden und öffnen</button>
@@ -794,12 +814,19 @@
 			>
 				<div class="live-current-scroll" bind:this={pieceScroller} onscroll={persistSettings}>
 					<div class="live-piece-heading">
-						<span class="live-piece-position">Piece {viewedPosition}/{data.live.totalCount}</span>
 						<h1 id="current-title">{viewedUsage.title}</h1>
 						{#if showTimes}<strong class="live-piece-time">
 								{formatClock(viewedActualSeconds)} / {formatClock(viewedUsage.durationSeconds)}
 							</strong>{/if}
 					</div>
+					{#if viewedSection?.twitchTags.length}<button
+							class="text-button live-twitch-tags"
+							type="button"
+							onclick={copyTwitchTags}
+						>
+							<AppIcon name="copy" />
+							{viewedSection.twitchTags.join(' · ')}
+						</button>{/if}
 
 					{#if viewedUsage.introHtml}<section class="live-script-section live-intro">
 							<span>Einleitung</span>
@@ -983,6 +1010,22 @@
 										>
 									</button>
 									<div class="live-run-actions">
+										{#if usage.status === 'done' || usage.status === 'skipped'}<form
+												method="POST"
+												action={liveAction('resumeUsage')}
+												use:enhance={enhanceCommand}
+											>
+												<input type="hidden" name="showId" value={data.live.show.id} />
+												<input type="hidden" name="usageId" value={usage.id} />
+												<input type="hidden" name="revision" value={data.live.liveRevision} />
+												<input type="hidden" name="commandId" value={data.commandId} />
+												<button
+													class="text-button"
+													type="submit"
+													disabled={data.live.isPaused || Boolean(data.live.endedAtUtc)}
+													>Wiederaufnehmen</button
+												>
+											</form>{/if}
 										{#if usage.status === 'open'}<details class="live-run-order">
 												<summary aria-label={`${usage.title} sortieren`}
 													><AppIcon name="ellipsis" /></summary
@@ -1159,38 +1202,52 @@
 							: 'Präsentieren'}
 					</button>
 				</form>
-				<form method="POST" action={liveAction('skip')} use:enhance={enhanceCommand}>
-					<input type="hidden" name="showId" value={data.live.show.id} />
-					<input type="hidden" name="revision" value={data.live.liveRevision} />
-					<input type="hidden" name="commandId" value={data.commandId} />
-					<button
-						class="secondary-button"
-						type="submit"
-						disabled={!viewingLiveCurrent || data.live.isPaused || Boolean(data.live.endedAtUtc)}
-						title={!viewingLiveCurrent
-							? 'Zuerst im Ablauf zum aktuellen Live-Piece zurückkehren'
-							: undefined}>Überspringen</button
-					>
-				</form>
-				<form method="POST" action={liveAction('complete')} use:enhance={enhanceCommand}>
-					<input type="hidden" name="showId" value={data.live.show.id} />
-					<input type="hidden" name="revision" value={data.live.liveRevision} />
-					<input type="hidden" name="commandId" value={data.commandId} />
-					<button
-						class="primary-button"
-						type="submit"
-						disabled={!viewingLiveCurrent || data.live.isPaused || Boolean(data.live.endedAtUtc)}
-						title={!viewingLiveCurrent
-							? 'Zuerst im Ablauf zum aktuellen Live-Piece zurückkehren'
-							: undefined}
-					>
-						{data.live.next
-							? 'Erledigen & weiter'
-							: hasOtherOpenUsages
-								? 'Erledigen'
-								: 'Erledigen & Sendungsende'}
-					</button>
-				</form>
+				{#if (viewedUsage.status === 'done' || viewedUsage.status === 'skipped') && !viewingLiveCurrent}
+					<form method="POST" action={liveAction('resumeUsage')} use:enhance={enhanceCommand}>
+						<input type="hidden" name="showId" value={data.live.show.id} />
+						<input type="hidden" name="usageId" value={viewedUsage.id} />
+						<input type="hidden" name="revision" value={data.live.liveRevision} />
+						<input type="hidden" name="commandId" value={data.commandId} />
+						<button
+							class="primary-button"
+							type="submit"
+							disabled={data.live.isPaused || Boolean(data.live.endedAtUtc)}>Wiederaufnehmen</button
+						>
+					</form>
+				{:else}
+					<form method="POST" action={liveAction('skip')} use:enhance={enhanceCommand}>
+						<input type="hidden" name="showId" value={data.live.show.id} />
+						<input type="hidden" name="revision" value={data.live.liveRevision} />
+						<input type="hidden" name="commandId" value={data.commandId} />
+						<button
+							class="secondary-button"
+							type="submit"
+							disabled={!viewingLiveCurrent || data.live.isPaused || Boolean(data.live.endedAtUtc)}
+							title={!viewingLiveCurrent
+								? 'Zuerst im Ablauf zum aktuellen Live-Piece zurückkehren'
+								: undefined}>Überspringen</button
+						>
+					</form>
+					<form method="POST" action={liveAction('complete')} use:enhance={enhanceCommand}>
+						<input type="hidden" name="showId" value={data.live.show.id} />
+						<input type="hidden" name="revision" value={data.live.liveRevision} />
+						<input type="hidden" name="commandId" value={data.commandId} />
+						<button
+							class="primary-button"
+							type="submit"
+							disabled={!viewingLiveCurrent || data.live.isPaused || Boolean(data.live.endedAtUtc)}
+							title={!viewingLiveCurrent
+								? 'Zuerst im Ablauf zum aktuellen Live-Piece zurückkehren'
+								: undefined}
+						>
+							{data.live.next
+								? 'Erledigen & weiter'
+								: hasOtherOpenUsages
+									? 'Erledigen'
+									: 'Erledigen & Sendungsende'}
+						</button>
+					</form>
+				{/if}
 			{:else if sessionComplete}<strong class="live-finished-label">Ablauf abgeschlossen</strong
 				>{/if}
 		</div>

src/routes/sendungen/+page.server.ts

@@ -2,7 +2,12 @@ import { fail, redirect } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 import { berlinDateKey, berlinMonthKey, normalizeMonthKey, shiftMonth } from '#lib/calendar.js';
 import { getShowOverviewView, requireUser, setShowOverviewView } from '#lib/server/auth.js';
-import { createShow, listShows, listShowTemplates } from '#lib/server/shows.js';
+import {
+	createShow,
+	listPreparationUsages,
+	listShows,
+	listShowTemplates
+} from '#lib/server/shows.js';
 import { berlinLocalToUtc } from '#lib/server/time.js';
 
 export const load: PageServerLoad = ({ locals, url }) => {
@@ -12,6 +17,7 @@ export const load: PageServerLoad = ({ locals, url }) => {
 	const selectedMonth = normalizeMonthKey(url.searchParams.get('month'), todayMonth);
 	return {
 		shows: listShows(['draft', 'ready', 'live']),
+		preparationUsages: listPreparationUsages(),
 		templates: listShowTemplates(),
 		view: getShowOverviewView(user.id),
 		selectedMonth,

src/routes/sendungen/+page.svelte

@@ -53,6 +53,10 @@
 		}).format(new Date(`${value}T12:00:00Z`));
 	}
 
+	function preparationHref(showId: string, usageId: string) {
+		return `${resolve('/sendungen/[id]', { id: showId })}?usage=${encodeURIComponent(usageId)}#usage-${encodeURIComponent(usageId)}`;
+	}
+
 	function statusLabel(status: string) {
 		if (status === 'ready') return 'Bereit';
 		if (status === 'draft') return 'Entwurf';
@@ -125,6 +129,44 @@
 		</form>
 	</details>
 
+	{#if data.preparationUsages.length}<section
+			class="show-library preparation-overview"
+			aria-labelledby="preparation-title"
+		>
+			<header>
+				<h2 id="preparation-title">Noch vorzubereiten</h2>
+				<span>{data.preparationUsages.length}</span>
+			</header>
+			<div class="preparation-list">
+				{#each data.preparationUsages as usage (usage.usageId)}
+					<!-- The helper starts from a route resolved against the configured base path. -->
+					<!-- eslint-disable-next-line svelte/no-navigation-without-resolve -->
+					<a href={preparationHref(usage.showId, usage.usageId)}>
+						<div class="preparation-copy">
+							<span
+								class="preparation-topics"
+								aria-label={usage.topics.map((topic) => topic.name).join(', ')}
+								>{#each usage.topics as topic (topic.name)}<AppIcon
+										name={topic.iconName}
+									/>{/each}</span
+							>
+							<span
+								><strong>{usage.title}</strong><small>{usage.showTitle} · {usage.sectionName}</small
+								></span
+							>
+						</div>
+						{#if usage.preparationEffort}<b class={`effort ${usage.preparationEffort}`}
+								>{usage.preparationEffort === 'low'
+									? 'Gering'
+									: usage.preparationEffort === 'medium'
+										? 'Mittel'
+										: 'Hoch'}</b
+							>{/if}
+					</a>
+				{/each}
+			</div>
+		</section>{/if}
+
 	<section class="show-library" aria-labelledby="show-library-title">
 		<header>
 			<h2 id="show-library-title">{data.view === 'list' ? 'Geplante Sendungen' : 'Kalender'}</h2>

src/routes/sendungen/[id]/+page.server.ts

@@ -4,7 +4,13 @@ import type { Actions, PageServerLoad } from './$types';
 import { requireBarkeeper, requireUser } from '#lib/server/auth.js';
 import { getHistoricalActualDurations } from '#lib/server/completion.js';
 import { getTaxonomy, listPieces, listPieceTemplates } from '#lib/server/content.js';
-import { createShare, deleteShare, listShares, updateShare } from '#lib/server/shares.js';
+import {
+	createShare,
+	deleteShare,
+	listShares,
+	replaceShareToken,
+	updateShare
+} from '#lib/server/shares.js';
 import { berlinLocalToUtc } from '#lib/server/time.js';
 import {
 	addPieceUsage,
@@ -123,7 +129,7 @@ export const load: PageServerLoad = ({ locals, params, url }) => {
 		};
 	}
 	const pieces = listPieces({
-		statuses: ['ready'],
+		statuses: ['preparing', 'ready'],
 		query: url.searchParams.get('q') ?? '',
 		categoryId: url.searchParams.get('category') ?? ''
 	});
@@ -192,6 +198,20 @@ export const actions = {
 			return fail(actionError(cause).status, { intent: 'updateShare', ...actionError(cause) });
 		}
 	},
+	replaceShare: async ({ locals, params, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const token = replaceShareToken(actor, text(data, 'shareId'), params.id);
+			return {
+				intent: 'replaceShare',
+				success: 'Ersatzlink angelegt. Der bisherige Link ist ungültig.',
+				shareUrl: `/freigabe/${token}`
+			};
+		} catch (cause) {
+			return fail(actionError(cause).status, { intent: 'replaceShare', ...actionError(cause) });
+		}
+	},
 	deleteShare: async ({ locals, params, request }) => {
 		const actor = requireBarkeeper(locals.user);
 		const data = await request.formData();
@@ -233,7 +253,8 @@ export const actions = {
 			addShowSection(params.id, Number(data.get('revision')), {
 				name: text(data, 'name'),
 				categoryId: text(data, 'categoryId') || null,
-				explicitDurationSeconds: nullableDuration(data)
+				explicitDurationSeconds: nullableDuration(data),
+				twitchTags: text(data, 'twitchTags').split(/[\n,]/)
 			})
 		);
 	},
@@ -244,7 +265,8 @@ export const actions = {
 			updateShowSection(params.id, text(data, 'sectionId'), Number(data.get('revision')), {
 				name: text(data, 'name'),
 				categoryId: text(data, 'categoryId') || null,
-				explicitDurationSeconds: nullableDuration(data)
+				explicitDurationSeconds: nullableDuration(data),
+				twitchTags: text(data, 'twitchTags').split(/[\n,]/)
 			})
 		);
 	},
@@ -316,6 +338,9 @@ export const actions = {
 				presentationDescription: text(data, 'presentationDescription'),
 				presentationImageUrl: text(data, 'presentationImageUrl'),
 				presentationSiteName: text(data, 'presentationSiteName'),
+				preparationStatus: text(data, 'preparationStatus') as PieceUsageUpdate['preparationStatus'],
+				preparationEffort: (text(data, 'preparationEffort') ||
+					null) as PieceUsageUpdate['preparationEffort'],
 				presentationMediaId: text(data, 'presentationMediaId') || null,
 				tools: toolIds.map((id, index) => ({
 					id,

src/routes/sendungen/[id]/+page.svelte

@@ -431,7 +431,7 @@
 				<header class="pane-heading">
 					<div>
 						<p class="eyebrow">Quelle</p>
-						<h2 id="source-title">Sendefertiger Fundus</h2>
+						<h2 id="source-title">Planbarer Fundus</h2>
 					</div>
 					<span>{visiblePieces.length}</span>
 				</header>
@@ -661,6 +661,7 @@
 								{#if section.usages.length}<div class="usage-list">
 										{#each section.usages as usage, usageIndex (usage.id)}
 											<div
+												id={`usage-${usage.id}`}
 												class="usage-drag-slot"
 												role="presentation"
 												ondragover={(event) => {
@@ -750,6 +751,7 @@
 														</form>
 														<UsageEditorDialog
 															{usage}
+															open={page.url.searchParams.get('usage') === usage.id}
 															revision={data.show.revision}
 															sectionId={section.id}
 															sections={data.show.sections}
@@ -828,6 +830,13 @@
 												value={section.explicitDurationSeconds ?? ''}
 												placeholder="Summe der Pieces"
 											/></label
+										><label
+											>Twitch-Tags<input
+												name="twitchTags"
+												maxlength="300"
+												value={section.twitchTags.join(', ')}
+												placeholder="Gaming, Deutsch"
+											/></label
 										><button class="secondary-button" type="submit">Abschnitt speichern</button>
 									</form>
 									<form
@@ -885,6 +894,12 @@
 							max="86400"
 							placeholder="optional, Sekunden"
 						/></label
+					><label
+						>Twitch-Tags<input
+							name="twitchTags"
+							maxlength="300"
+							placeholder="Gaming, Deutsch"
+						/></label
 					><button class="primary-button" type="submit">Abschnitt hinzufügen</button>
 				</form>
 

src/routes/verwaltung/+page.server.ts

@@ -8,10 +8,22 @@ import {
 	type TaxonomyKind
 } from '#lib/server/content.js';
 import { getMailConfig } from '#lib/server/config.js';
-import { createShare, deleteShare, listShares, updateShare } from '#lib/server/shares.js';
+import {
+	createShare,
+	deleteShare,
+	listShares,
+	replaceShareToken,
+	updateShare
+} from '#lib/server/shares.js';
 import { listShows } from '#lib/server/shows.js';
 import { berlinLocalToUtc } from '#lib/server/time.js';
 import { createTool, listTools, updateTool, type ToolInput } from '#lib/server/tools.js';
+import { deleteFeedSource, fetchFeed, listFeedSources, saveFeedSource } from '#lib/server/feeds.js';
+import {
+	createTechnicalAccess,
+	listTechnicalAccesses,
+	revokeTechnicalAccess
+} from '#lib/server/technical-access.js';
 import {
 	inviteUser,
 	isRole,
@@ -33,6 +45,8 @@ export const load: PageServerLoad = ({ locals }) => {
 		tools: listTools(true),
 		shows: listShows(),
 		shares: listShares(locals.user!),
+		feeds: listFeedSources(),
+		technicalAccesses: listTechnicalAccesses(),
 		mailTransport: getMailConfig().transport
 	};
 };
@@ -59,6 +73,8 @@ function actionError(cause: unknown): string {
 	if (code === 'INVALID_EXPIRY') return 'Der Ablaufzeitpunkt muss in der Zukunft liegen.';
 	if (code === 'INVALID_SCOPE') return 'Der Informationsumfang ist ungültig.';
 	if (code === 'INVALID_PASSWORD_MODE') return 'Die Passwortoption ist ungültig.';
+	if (code === 'INVALID_FEED') return 'Name, URL und Abrufintervall bitte prüfen.';
+	if (code === 'INVALID_ACCESS') return 'Name und Berechtigung bitte prüfen.';
 	return 'Die Aktion konnte nicht ausgeführt werden.';
 }
 
@@ -108,6 +124,20 @@ export const actions = {
 			return fail(400, { intent: 'updateShare', error: actionError(cause) });
 		}
 	},
+	replaceShare: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const token = replaceShareToken(actor, String(data.get('shareId') || ''));
+			return {
+				intent: 'replaceShare',
+				success: 'Ersatzlink angelegt. Der bisherige Link ist ungültig.',
+				shareUrl: `/freigabe/${token}`
+			};
+		} catch (cause) {
+			return fail(400, { intent: 'replaceShare', error: actionError(cause) });
+		}
+	},
 	deleteShare: async ({ locals, request }) => {
 		const actor = requireBarkeeper(locals.user);
 		const data = await request.formData();
@@ -249,5 +279,78 @@ export const actions = {
 		} catch (cause) {
 			return fail(400, { intent: 'tool', error: actionError(cause) });
 		}
+	},
+	saveFeed: async ({ locals, request }) => {
+		requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			saveFeedSource(String(data.get('feedId') || '') || null, {
+				name: String(data.get('name') || ''),
+				url: String(data.get('url') || ''),
+				isEnabled: data.get('isEnabled') === '1',
+				refreshIntervalMinutes: Number(data.get('refreshIntervalMinutes')),
+				defaultCategoryId: String(data.get('defaultCategoryId') || '') || null
+			});
+			return { intent: 'feed', success: 'Feed gespeichert.' };
+		} catch (cause) {
+			return fail(400, { intent: 'feed', error: actionError(cause) });
+		}
+	},
+	deleteFeed: async ({ locals, request }) => {
+		requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			deleteFeedSource(String(data.get('feedId') || ''));
+			return { intent: 'feed', success: 'Feed entfernt.' };
+		} catch (cause) {
+			return fail(400, { intent: 'feed', error: actionError(cause) });
+		}
+	},
+	fetchFeed: async ({ locals, request }) => {
+		requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const result = await fetchFeed(String(data.get('feedId') || ''));
+			return {
+				intent: 'feed',
+				success: result.unchanged
+					? 'Feed ist unverändert.'
+					: `${result.inserted} neue Beiträge abgerufen.`
+			};
+		} catch {
+			return fail(400, {
+				intent: 'feed',
+				error: 'Feed konnte nicht sicher abgerufen oder gelesen werden.'
+			});
+		}
+	},
+	createTechnicalAccess: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const created = createTechnicalAccess(
+				actor,
+				String(data.get('name') || ''),
+				String(data.get('permissions') || '')
+			);
+			return {
+				intent: 'technicalAccess',
+				success:
+					'Technischer Zugang angelegt. Token jetzt sicher hinterlegen; es wird nicht erneut angezeigt.',
+				technicalToken: created.token
+			};
+		} catch (cause) {
+			return fail(400, { intent: 'technicalAccess', error: actionError(cause) });
+		}
+	},
+	revokeTechnicalAccess: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			revokeTechnicalAccess(actor, String(data.get('accessId') || ''));
+			return { intent: 'technicalAccess', success: 'Technischer Zugang widerrufen.' };
+		} catch (cause) {
+			return fail(400, { intent: 'technicalAccess', error: actionError(cause) });
+		}
 	}
 } satisfies Actions;

src/routes/verwaltung/+page.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { resolve } from '$app/paths';
 	import AppIcon from '#lib/components/AppIcon.svelte';
 	import IconPicker from '#lib/components/IconPicker.svelte';
 	import ShareManagement from '#lib/components/ShareManagement.svelte';
@@ -31,7 +32,188 @@
 		>
 			{form.success}
 		</div>{/if}
-	<ShareManagement shows={data.shows} shares={data.shares} {form} />
+	<h2 class="section-heading">Schnittstellen</h2>
+	<section class="quiet-panel integration-panel">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Import</p>
+				<h2>RSS-Feeds</h2>
+			</div>
+			<span>{data.feeds.length} eingerichtet</span>
+		</div>
+		<p>
+			Aktive Feeds werden im gewählten Intervall abgerufen. Beiträge landen zuerst separat im
+			Eingang.
+		</p>
+		<details class="integration-create">
+			<summary class="compact-add-button"><AppIcon name="plus" /> Feed hinzufügen</summary>
+			<form class="integration-form" method="POST" action="?/saveFeed">
+				<label>Name<input name="name" required maxlength="120" /></label>
+				<label
+					>Feed-URL<input
+						name="url"
+						type="url"
+						required
+						maxlength="2000"
+						placeholder="https://example.org/feed.xml"
+					/></label
+				>
+				<label
+					>Intervall in Minuten<input
+						name="refreshIntervalMinutes"
+						type="number"
+						min="15"
+						max="10080"
+						value="60"
+						required
+					/></label
+				>
+				<label
+					>Standardkategorie<select name="defaultCategoryId"
+						><option value="">Keine</option
+						>{#each data.taxonomy.categories as category (category.id)}<option value={category.id}
+								>{category.name}</option
+							>{/each}</select
+					></label
+				>
+				<label class="check-row"
+					><input type="checkbox" name="isEnabled" value="1" checked /> Automatisch abrufen</label
+				>
+				<button class="primary-button" type="submit">Feed anlegen</button>
+			</form>
+		</details>
+		<div class="integration-list">
+			{#each data.feeds as feed (feed.id)}
+				<details>
+					<summary
+						><span
+							><strong>{feed.name}</strong><small
+								>{feed.lastError
+									? `Fehler: ${feed.lastError}`
+									: feed.lastFetchedAtUtc
+										? `Zuletzt: ${new Date(feed.lastFetchedAtUtc).toLocaleString('de-DE')}`
+										: 'Noch nicht abgerufen'}</small
+							></span
+						><AppIcon name="pen" /></summary
+					>
+					<form class="integration-form" method="POST" action="?/saveFeed">
+						<input type="hidden" name="feedId" value={feed.id} />
+						<label>Name<input name="name" required maxlength="120" value={feed.name} /></label>
+						<label
+							>Feed-URL<input
+								name="url"
+								type="url"
+								required
+								maxlength="2000"
+								value={feed.url}
+							/></label
+						>
+						<label
+							>Intervall in Minuten<input
+								name="refreshIntervalMinutes"
+								type="number"
+								min="15"
+								max="10080"
+								value={feed.refreshIntervalMinutes}
+								required
+							/></label
+						>
+						<label
+							>Standardkategorie<select name="defaultCategoryId"
+								><option value="">Keine</option
+								>{#each data.taxonomy.categories as category (category.id)}<option
+										value={category.id}
+										selected={feed.defaultCategoryId === category.id}>{category.name}</option
+									>{/each}</select
+							></label
+						>
+						<label class="check-row"
+							><input type="checkbox" name="isEnabled" value="1" checked={feed.isEnabled} /> Automatisch
+							abrufen</label
+						>
+						<button class="secondary-button" type="submit">Speichern</button>
+					</form>
+					<div class="row-actions">
+						<form method="POST" action="?/fetchFeed">
+							<input type="hidden" name="feedId" value={feed.id} /><button
+								class="text-button"
+								type="submit">Jetzt abrufen</button
+							>
+						</form>
+						<form
+							method="POST"
+							action="?/deleteFeed"
+							onsubmit={(event) =>
+								!confirm('Feed und seinen Importeingang löschen?') && event.preventDefault()}
+						>
+							<input type="hidden" name="feedId" value={feed.id} /><button
+								class="text-button danger-text"
+								type="submit">Feed löschen</button
+							>
+						</form>
+					</div>
+				</details>
+			{/each}
+		</div>
+	</section>
+
+	<section class="quiet-panel integration-panel">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Externe Assistenz</p>
+				<h2>Technische Zugänge</h2>
+			</div>
+			<a href={resolve('/api/v1/openapi.json')} target="_blank">OpenAPI</a>
+		</div>
+		<p>
+			Tokens gelten ausschließlich für die API. Schreibende Aufrufe werden protokolliert und müssen
+			idempotent sein.
+		</p>
+		{#if form?.technicalToken}<div class="token-reveal" role="status">
+				<strong>Token, einmalig sichtbar</strong><code>{form.technicalToken}</code>
+			</div>{/if}
+		<details class="integration-create">
+			<summary class="compact-add-button"><AppIcon name="plus" /> Zugang hinzufügen</summary>
+			<form class="integration-form" method="POST" action="?/createTechnicalAccess">
+				<label
+					>Name<input
+						name="name"
+						required
+						maxlength="120"
+						placeholder="Redaktionsassistenz"
+					/></label
+				>
+				<label
+					>Berechtigung<select name="permissions"
+						><option value="read">Nur lesen</option><option value="read_write"
+							>Lesen und schreiben</option
+						></select
+					></label
+				>
+				<button class="primary-button" type="submit">Zugang anlegen</button>
+			</form>
+		</details>
+		<div class="integration-list">
+			{#each data.technicalAccesses as access (access.id)}
+				<div class="access-row">
+					<span
+						><strong>{access.name}</strong><small
+							>{access.permissions === 'read' ? 'Nur lesen' : 'Lesen und schreiben'} · {access.revokedAtUtc
+								? 'Widerrufen'
+								: access.lastUsedAtUtc
+									? `Zuletzt genutzt ${new Date(access.lastUsedAtUtc).toLocaleString('de-DE')}`
+									: 'Noch nicht genutzt'}</small
+						></span
+					>{#if !access.revokedAtUtc}<form method="POST" action="?/revokeTechnicalAccess">
+							<input type="hidden" name="accessId" value={access.id} /><button
+								class="secondary-button"
+								type="submit">Widerrufen</button
+							>
+						</form>{/if}
+				</div>
+			{/each}
+		</div>
+	</section>
 
 	<section class="quiet-panel account-panel">
 		<div class="panel-heading">
@@ -129,7 +311,8 @@
 		</section>
 	</div>
 
-	<h2 class="section-heading">Werkzeuge</h2>
+	<h2 class="section-heading">Werkzeuge & Freigaben</h2>
+	<ShareManagement shows={data.shows} shares={data.shares} {form} catalogPanel />
 	<section class="quiet-panel tool-management">
 		<div class="panel-heading">
 			<div>
@@ -272,3 +455,80 @@
 		</section>
 	</div>
 </div>
+
+<style>
+	.integration-panel {
+		display: grid;
+		gap: 1rem;
+		margin-block: 1.5rem;
+	}
+	.integration-form {
+		display: grid;
+		grid-template-columns: repeat(auto-fit, minmax(12rem, 1fr));
+		gap: 0.8rem;
+		align-items: end;
+	}
+	.integration-create > summary {
+		width: fit-content;
+		cursor: pointer;
+		list-style: none;
+	}
+	.integration-create > summary::-webkit-details-marker {
+		display: none;
+	}
+	.integration-create[open] > .integration-form {
+		margin-top: 0.8rem;
+	}
+	.integration-form label:not(.check-row) {
+		display: grid;
+		gap: 0.35rem;
+	}
+	.check-row {
+		display: flex;
+		gap: 0.5rem;
+		align-items: center;
+		min-height: 2.6rem;
+	}
+	.integration-list {
+		display: grid;
+		gap: 0.5rem;
+	}
+	.integration-list details,
+	.access-row {
+		padding: 0.75rem 0.8rem;
+		border: 1px solid var(--line);
+		border-radius: var(--radius-medium);
+		background: var(--panel-soft);
+	}
+	.integration-list summary,
+	.access-row {
+		display: flex;
+		justify-content: space-between;
+		gap: 1rem;
+		align-items: center;
+	}
+	.integration-list summary > span,
+	.access-row > span {
+		display: grid;
+		gap: 0.2rem;
+	}
+	.integration-list small {
+		color: var(--text-muted);
+	}
+	.row-actions {
+		display: flex;
+		gap: 1rem;
+		margin-top: 0.75rem;
+	}
+	.token-reveal {
+		display: grid;
+		gap: 0.4rem;
+		padding: 0.8rem;
+		border: 2px solid var(--color-accent);
+		border-radius: 0.7rem;
+		overflow-wrap: anywhere;
+	}
+	.token-reveal code {
+		user-select: all;
+	}
+</style>

static/manifest.webmanifest

@@ -0,0 +1,11 @@
+{
+	"name": "Sendewerk",
+	"short_name": "Sendewerk",
+	"description": "Redaktion, Sendungsplanung und Live-Regie für heinzlive",
+	"start_url": "/sendungen",
+	"display": "standalone",
+	"background_color": "#0b1220",
+	"theme_color": "#0b1220",
+	"lang": "de",
+	"orientation": "any"
+}

tests/ui.e2e.ts

@@ -364,6 +364,23 @@ function setSectionDuration(sectionId: string, seconds: number | null) {
 	database.close();
 }
 
+function setUsagePreparation(
+	usageId: string,
+	status: 'preparing' | 'ready',
+	effort: 'low' | 'medium' | 'high' | null
+) {
+	const dataDirectory = process.env.SENDEWERK_E2E_DATA_DIR;
+	if (!dataDirectory) throw new Error('E2E-Datenverzeichnis ist nicht konfiguriert.');
+	const database = new Database(path.join(dataDirectory, 'e2e.sqlite'));
+	database
+		.prepare(
+			`UPDATE piece_usages SET preparation_status_snapshot = ?,
+			 preparation_effort_snapshot = ? WHERE id = ?`
+		)
+		.run(status, effort, usageId);
+	database.close();
+}
+
 test.beforeAll(async ({ browser }) => {
 	const page = await browser.newPage();
 	await page.goto('/');
@@ -665,7 +682,6 @@ test('show overview switches persistently between list, calendar and mobile agen
 		const octoberDay = page
 			.locator('.show-calendar-day')
 			.filter({ hasText: 'Kalender Frühtermin' });
-		await expect(octoberDay).toHaveClass(/today/);
 		await expect(octoberDay).toContainText('Kalender Spättermin');
 		await expect(octoberDay.locator('.show-calendar-event')).toHaveCount(2);
 		await expect(octoberDay.locator('.show-calendar-event').first()).toContainText('10:00');
@@ -703,6 +719,43 @@ test('show overview switches persistently between list, calendar and mobile agen
 	}
 });
 
+test('preparation opens and updates the concrete scheduled usage', async ({ page }) => {
+	setUsagePreparation('usage-console', 'preparing', 'high');
+	try {
+		await page.goto('/sendungen');
+		const preparation = page.locator('.preparation-overview');
+		await expect(preparation).toContainText('Die kleine Konsole mit dem großen Dreh');
+		await expect(preparation).toContainText('Hoch');
+		await preparation.getByRole('link', { name: /Die kleine Konsole/ }).click();
+		await expect(page).toHaveURL(/usage=usage-console/);
+
+		const editor = page.getByRole('dialog', {
+			name: 'Die kleine Konsole mit dem großen Dreh'
+		});
+		await expect(editor).toBeVisible();
+		await editor.getByRole('button', { name: 'Präsentation', exact: true }).click();
+		await expect(editor.getByRole('radio', { name: 'Text', exact: true })).toBeChecked();
+		await editor.getByRole('radio', { name: 'Nur Bild', exact: true }).check();
+		await expect(editor.getByRole('combobox', { name: 'Quelle/URL', exact: true })).toHaveCount(0);
+		await editor.getByRole('radio', { name: 'Linkvorschau', exact: true }).check();
+		await expect(editor.getByRole('combobox', { name: 'Quelle/URL', exact: true })).toBeVisible();
+		await expect(editor.getByLabel('Kartentitel')).toBeVisible();
+		await editor.getByRole('radio', { name: 'Video', exact: true }).check();
+		await expect(editor.getByRole('combobox', { name: 'Video-URL', exact: true })).toBeVisible();
+		await expect(editor.getByLabel('Videotitel')).toBeVisible();
+		await editor.getByRole('radio', { name: 'Text', exact: true }).check();
+		await editor.getByRole('button', { name: 'Sendungstext', exact: true }).click();
+		await editor.getByText('Dauer und Einplanung', { exact: true }).click();
+		await editor.getByLabel('Vorbereitungsstatus').selectOption('ready');
+		await editor.getByRole('button', { name: 'Verwendung speichern' }).click();
+
+		await page.goto('/sendungen');
+		await expect(page.locator('.preparation-overview')).toHaveCount(0);
+	} finally {
+		setUsagePreparation('usage-console', 'ready', null);
+	}
+});
+
 test('desktop builder keeps the fundus beside the wider run sheet', async ({ page }, testInfo) => {
 	await page.setViewportSize({ width: 1280, height: 900 });
 	await page.goto('/fundus');
@@ -1106,6 +1159,7 @@ test('inbox, archive and administration stay concise', async ({ page }) => {
 		await topicIconPicker.getByText('Icon auswählen', { exact: true }).click();
 		const popover = topicIconPicker.locator('.icon-picker-popover');
 		await expect(popover).toBeVisible();
+		await expect(topicIconPicker.getByPlaceholder('Icon suchen')).toBeFocused();
 		const popoverBox = await popover.boundingBox();
 		expect(popoverBox?.x ?? -1).toBeGreaterThanOrEqual(0);
 		expect((popoverBox?.x ?? width) + (popoverBox?.width ?? 1)).toBeLessThanOrEqual(width);
@@ -1276,6 +1330,14 @@ test('live control persists state and exposes only explicit presentation data',
 	});
 	await page.getByLabel('Alternativtext').fill('Kleine Konsole im Live-Bild');
 	await page.getByRole('button', { name: 'Bild hochladen' }).click();
+	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
+	await page.getByRole('radio', { name: 'Nur Bild', exact: true }).check();
+	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
+	await page.reload();
+	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
+	await expect(page.getByRole('radio', { name: 'Nur Bild', exact: true })).toBeChecked();
+	await page.getByRole('radio', { name: 'Text', exact: true }).check();
+	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
 	await page.goto('/sendungen/show-october');
 	const plannedConsole = page
 		.locator('.editable-usage')
@@ -1414,8 +1476,11 @@ test('live control persists state and exposes only explicit presentation data',
 			.locator('.live-run-item.current')
 			.filter({ hasText: 'Warum praktische Effekte wieder auffallen' })
 	).toBeVisible();
-	await expect(page.getByRole('button', { name: 'Überspringen' })).toBeDisabled();
-	await expect(page.getByRole('button', { name: /Erledigen/ })).toBeDisabled();
+	await expect(
+		page.locator('.live-action-bar').getByRole('button', { name: 'Wiederaufnehmen', exact: true })
+	).toBeVisible();
+	await expect(page.getByRole('button', { name: 'Überspringen' })).toHaveCount(0);
+	await expect(page.getByRole('button', { name: /Erledigen/ })).toHaveCount(0);
 	await expect(
 		output.getByRole('heading', { name: 'Die kleine Konsole mit dem großen Dreh' })
 	).toBeVisible();
@@ -1665,6 +1730,7 @@ test('completion, archive and protected guest sharing work end to end', async ({
 	addCompletionFixture();
 	try {
 		await page.goto('/sendungen/e2e-completion');
+		await page.getByRole('button', { name: 'Lesefreigaben' }).click();
 		const planningShares = page.locator('.share-management');
 		await expect(planningShares.getByText('Aktualisiert sich bis zum Abschluss')).toBeVisible();
 		await planningShares.getByLabel('Informationsumfang').selectOption('moderation');
@@ -1736,9 +1802,31 @@ test('completion, archive and protected guest sharing work end to end', async ({
 		await expect(page.getByText('Gesendeter Abschlussbeitrag')).toBeVisible();
 		await expect(page.getByText('Übersprungener Abschlussbeitrag')).toBeVisible();
 		await expect(page.getByRole('button', { name: 'Sendungsdaten speichern' })).toHaveCount(0);
+		expect(
+			await page
+				.locator('.historical-section')
+				.first()
+				.evaluate((element) => Number.parseFloat(getComputedStyle(element).paddingInlineStart))
+		).toBeGreaterThan(0);
 
 		await page.goto('/verwaltung');
+		const shareCatalog = page.locator('.share-catalog-panel');
+		await expect(shareCatalog).toBeVisible();
+		const catalogOrder = await page.evaluate(() => {
+			const share = document.querySelector('.share-catalog-panel')?.getBoundingClientRect();
+			const tools = document.querySelector('.tool-management')?.getBoundingClientRect();
+			return share && tools ? share.bottom <= tools.top : false;
+		});
+		expect(catalogOrder).toBe(true);
+		await page.getByRole('button', { name: 'Lesefreigaben' }).click();
 		const shareManagement = page.locator('.share-management');
+		await expect(page.locator('.share-management-dialog')).toBeVisible();
+		const dialogStyle = await page.locator('.share-management-dialog').evaluate((element) => ({
+			borderRadius: Number.parseFloat(getComputedStyle(element).borderRadius),
+			background: getComputedStyle(element).backgroundColor
+		}));
+		expect(dialogStyle.borderRadius).toBeGreaterThan(0);
+		expect(dialogStyle.background).not.toBe('rgba(0, 0, 0, 0)');
 		await shareManagement.getByLabel('Sendung').selectOption('e2e-completion');
 		await shareManagement.getByLabel('Informationsumfang').selectOption('moderation');
 		await shareManagement.getByLabel('Optionales Passwort').fill('E2E-Freigabe-Passwort');
@@ -1766,6 +1854,12 @@ test('completion, archive and protected guest sharing work end to end', async ({
 		await expect(guestPage.getByText('PRIVATE_FREIGABE_RECHERCHE')).toHaveCount(0);
 		await expect(guestPage.getByText('PRIVATE_FREIGABE_NOTIZ')).toHaveCount(0);
 		await expect(guestPage.getByAltText('Freigegebenes Abschlussbild')).toBeVisible();
+		expect(
+			await guestPage
+				.locator('.shared-section')
+				.first()
+				.evaluate((element) => Number.parseFloat(getComputedStyle(element).paddingInlineStart))
+		).toBeGreaterThan(0);
 		await guestPage.setViewportSize({ width: 390, height: 844 });
 		await expectNoHorizontalOverflow(guestPage);
 		await guestPage.screenshot({ path: testInfo.outputPath('share-mobile.png'), fullPage: true });
@@ -1784,6 +1878,7 @@ test('completion, archive and protected guest sharing work end to end', async ({
 		expect(guestWrite.status()).toBe(403);
 
 		await page.goto('/verwaltung');
+		await page.getByRole('button', { name: 'Lesefreigaben' }).click();
 		const showCard = page.locator('.share-show-card').filter({ hasText: 'E2E Abschluss' });
 		await expect(showCard.getByText('Abgeschlossen')).toBeVisible();
 		const shareRow = showCard.locator('.share-row').first();
@@ -1852,7 +1947,7 @@ test('pieces autosave safely, detect conflicts and protect uploaded images', asy
 	);
 	await openEditorialField(page, 'Präsentationstext');
 	await page
-		.getByRole('textbox', { name: 'Öffentlicher Text', exact: true })
+		.getByRole('textbox', { name: 'Öffentlicher Vorspann', exact: true })
 		.fill('## Sichere Vorschau\n\n<script>globalThis.e2eXss = true</script> **sichtbar**');
 	await openEditorialField(page, 'Private Recherche');
 	await page.getByRole('button', { name: 'Quelle hinzufügen' }).click();
@@ -2000,7 +2095,7 @@ test('a quickly captured video can be written and previewed before classificatio
 
 	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
 	await page.getByRole('radio', { name: 'Video', exact: true }).check();
-	await page.getByRole('combobox', { name: 'Quelle', exact: true }).selectOption('0');
+	await page.getByRole('combobox', { name: 'Video-URL', exact: true }).selectOption('0');
 	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
 
 	const previewPromise = page.waitForEvent('popup');
@@ -2026,9 +2121,10 @@ test('link preview uses one existing source, persists manual fields and isolates
 	await page.goto('/fundus/piece-console');
 	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
 	await page.getByRole('radio', { name: 'Linkvorschau', exact: true }).check();
-	await page.getByRole('combobox', { name: 'Quelle', exact: true }).selectOption('0');
+	await page.getByRole('combobox', { name: 'Quelle/URL', exact: true }).selectOption('0');
 	await page.getByLabel('Kartentitel').fill('Manuell korrigierte Linkvorschau');
 	await page.getByLabel('Anreißer').fill('Ein kurzer manueller Anreißer ohne Vorschaubild.');
+	await page.getByLabel('Vorschaubild-URL').fill('');
 	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
 	await page.reload();
 	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
@@ -2044,7 +2140,7 @@ test('link preview uses one existing source, persists manual fields and isolates
 		preview.getByRole('heading', { name: 'Manuell korrigierte Linkvorschau' })
 	).toBeVisible();
 	await expect(preview.getByText('Ein kurzer manueller Anreißer ohne Vorschaubild.')).toBeVisible();
-	await expect(preview.locator('.output-link-image')).toHaveCount(1);
+	await expect(preview.locator('.output-link-image')).toHaveCount(0);
 	await preview.screenshot({
 		path: testInfo.outputPath('linkvorschau-desktop.png'),
 		fullPage: true